diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 58834f4597e5d1393cc83f5241ba5a025e29b064..d1086658a077a65278bfb54758efb0a250f826f2 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -47,22 +47,25 @@
/nixos/doc/manual/man-nixos-option.xml @nbp
/nixos/modules/installer/tools/nixos-option.sh @nbp
+# NixOS integration test driver
+/nixos/lib/test-driver @tfc
+
# New NixOS modules
/nixos/modules/module-list.nix @Infinisil
# Python-related code and docs
/maintainers/scripts/update-python-libraries @FRidh
-/pkgs/top-level/python-packages.nix @FRidh
+/pkgs/top-level/python-packages.nix @FRidh @jonringer
/pkgs/development/interpreters/python @FRidh
-/pkgs/development/python-modules @FRidh
+/pkgs/development/python-modules @FRidh @jonringer
/doc/languages-frameworks/python.section.md @FRidh
# Haskell
-/pkgs/development/compilers/ghc @basvandijk
-/pkgs/development/haskell-modules @basvandijk
-/pkgs/development/haskell-modules/default.nix @basvandijk
-/pkgs/development/haskell-modules/generic-builder.nix @basvandijk
-/pkgs/development/haskell-modules/hoogle.nix @basvandijk
+/pkgs/development/compilers/ghc @basvandijk @cdepillabout
+/pkgs/development/haskell-modules @basvandijk @cdepillabout
+/pkgs/development/haskell-modules/default.nix @basvandijk @cdepillabout
+/pkgs/development/haskell-modules/generic-builder.nix @basvandijk @cdepillabout
+/pkgs/development/haskell-modules/hoogle.nix @basvandijk @cdepillabout
# Perl
/pkgs/development/interpreters/perl @volth
@@ -130,6 +133,12 @@
/nixos/tests/hardened.nix @joachifm
/pkgs/os-specific/linux/kernel/hardened-config.nix @joachifm
+# Network Time Daemons
+/pkgs/tools/networking/chrony @thoughtpolice
+/pkgs/tools/networking/ntp @thoughtpolice
+/pkgs/tools/networking/openntpd @thoughtpolice
+/nixos/modules/services/networking/ntp @thoughtpolice
+
# Dhall
/pkgs/development/dhall-modules @Gabriel439 @Profpatsch
/pkgs/development/interpreters/dhall @Gabriel439 @Profpatsch
@@ -150,3 +159,19 @@
/pkgs/applications/editors/emacs-modes @adisbladis
/pkgs/applications/editors/emacs @adisbladis
/pkgs/top-level/emacs-packages.nix @adisbladis
+
+# VimPlugins
+/pkgs/misc/vim-plugins @jonringer
+
+# VsCode Extensions
+/pkgs/misc/vscode-extensions @jonringer
+
+# Prometheus exporter modules and tests
+/nixos/modules/services/monitoring/prometheus/exporters.nix @WilliButz
+/nixos/modules/services/monitoring/prometheus/exporters.xml @WilliButz
+/nixos/tests/prometheus-exporters.nix @WilliButz
+
+# PHP
+/pkgs/development/interpreters/php @etu
+/pkgs/top-level/php-packages.nix @etu
+/pkgs/build-support/build-pecl.nix @etu
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 07eddc80c2531e2ef7e3982395113054d4392190..706952b208db1080bd5734cebf28f292d17b8d3e 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -6,9 +6,8 @@ under the terms of [COPYING](../COPYING), which is an MIT-like license.
## Opening issues
* Make sure you have a [GitHub account](https://github.com/signup/free)
-* [Submit an issue](https://github.com/NixOS/nixpkgs/issues) - assuming one does not already exist.
- * Clearly describe the issue including steps to reproduce when it is a bug.
- * Include information what version of nixpkgs and Nix are you using (nixos-version or git revision).
+* Make sure there is no open issue on the topic
+* [Submit a new issue](https://github.com/NixOS/nixpkgs/issues/new/choose) by choosing the kind of topic and fill out the template
## Submitting changes
@@ -51,4 +50,4 @@ For package version upgrades and such a one-line commit message is usually suffi
## Reviewing contributions
-See the nixpkgs manual for more details on how to [Review contributions](https://nixos.org/nixpkgs/manual/#sec-reviewing-contributions).
+See the nixpkgs manual for more details on how to [Review contributions](https://nixos.org/nixpkgs/manual/#chap-reviewing-contributions).
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index a4f1c61e8f59119409805889074f42184edab7c6..b923902cf929d3550f6d843941cb74478df910ee 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,4 +1,4 @@
-
+
###### Motivation for this change
@@ -6,13 +6,13 @@
-- [ ] Tested using sandboxing ([nix.useSandbox](http://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS, or option `sandbox` in [`nix.conf`](http://nixos.org/nix/manual/#sec-conf-file) on non-NixOS)
+- [ ] Tested using sandboxing ([nix.useSandbox](http://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS, or option `sandbox` in [`nix.conf`](http://nixos.org/nix/manual/#sec-conf-file) on non-NixOS linux)
- Built on platform(s)
- [ ] NixOS
- [ ] macOS
- [ ] other Linux distributions
- [ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests))
-- [ ] Tested compilation of all pkgs that depend on this change using `nix-shell -p nix-review --run "nix-review wip"`
+- [ ] Tested compilation of all pkgs that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review wip"`
- [ ] Tested execution of all binary files (usually in `./result/bin/`)
- [ ] Determined the impact on package closure size (by running `nix path-info -S` before and after)
- [ ] Ensured that relevant documentation is up to date
diff --git a/.github/stale.yml b/.github/stale.yml
new file mode 100644
index 0000000000000000000000000000000000000000..bf47ba3c25b406ebd147fe02d341a34ac1ed7924
--- /dev/null
+++ b/.github/stale.yml
@@ -0,0 +1,32 @@
+# Number of days of inactivity before an issue becomes stale
+daysUntilStale: 180
+# Number of days of inactivity before a stale issue is closed
+daysUntilClose: false
+# Issues with these labels will never be considered stale
+exemptLabels:
+ - 1.severity: security
+# Label to use when marking an issue as stale
+staleLabel: 2.status: stale
+# Comment to post when marking an issue as stale. Set to `false` to disable
+markComment: >
+ Thank you for your contributions.
+
+ This has been automatically marked as stale because it has had no
+ activity for 180 days.
+
+ If this is still important to you, we ask that you leave a
+ comment below. Your comment can be as simple as "still important
+ to me". This lets people see that at least one person still cares
+ about this. Someone will have to do this at most twice a year if
+ there is no other activity.
+
+ Here are suggestions that might help resolve this more quickly:
+
+ 1. Search for maintainers and people that previously touched the
+ related code and @ mention them in a comment.
+ 2. Ask on the [NixOS Discourse](https://discourse.nixos.org/).
+ 3. Ask on the [#nixos channel](irc://irc.freenode.net/#nixos) on
+ [irc.freenode.net](https://freenode.net).
+
+# Comment to post when closing a stale issue. Set to `false` to disable
+closeComment: false
diff --git a/.version b/.version
index ba19dc3bb41eab373afe125b2874aafd25e5027e..88b8320330daf8986231569f186c981de4f98464 100644
--- a/.version
+++ b/.version
@@ -1 +1 @@
-19.09
\ No newline at end of file
+20.03
\ No newline at end of file
diff --git a/README.md b/README.md
index b34438e41a8fbba95f3b874ef441965d4d257eb0..f5090e023289c910d852a73efcebf068b8bce6c0 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@
* [NixOS Manual](https://nixos.org/nixos/manual) - how to install, configure, and maintain a purely-functional Linux distribution
* [Nixpkgs Manual](https://nixos.org/nixpkgs/manual/) - contributing to Nixpkgs and using programming-language-specific Nix expressions
-* [Nix Package Manager Manual](https://nixos.org/nix/manual) - how to write Nix expresssions (programs), and how to use Nix command line tools
+* [Nix Package Manager Manual](https://nixos.org/nix/manual) - how to write Nix expressions (programs), and how to use Nix command line tools
# Community
@@ -27,7 +27,7 @@
# Other Project Repositories
-The sources of all offical Nix-related projects are in the [NixOS
+The sources of all official Nix-related projects are in the [NixOS
organization on GitHub](https://github.com/NixOS/). Here are some of
the main ones:
@@ -44,16 +44,14 @@ Nixpkgs and NixOS are built and tested by our continuous integration
system, [Hydra](https://hydra.nixos.org/).
* [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 19.03 release](https://hydra.nixos.org/jobset/nixos/release-19.03)
+* [Continuous package builds for the NixOS 19.09 release](https://hydra.nixos.org/jobset/nixos/release-19.09)
* [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 19.03 release](https://hydra.nixos.org/job/nixos/release-19.03/tested#tabs-constituents)
+* [Tests for the NixOS 19.09 release](https://hydra.nixos.org/job/nixos/release-19.09/tested#tabs-constituents)
Artifacts successfully built with Hydra are published to cache at
https://cache.nixos.org/. When successful build and test criteria are
met, the Nixpkgs expressions are distributed via [Nix
-channels](https://nixos.org/nix/manual/#sec-channels). The channels
-are provided via a read-only mirror of the Nixpkgs repository called
-[nixpkgs-channels](https://github.com/NixOS/nixpkgs-channels).
+channels](https://nixos.org/nix/manual/#sec-channels).
# Contributing
diff --git a/doc/builders/fetchers.xml b/doc/builders/fetchers.xml
new file mode 100644
index 0000000000000000000000000000000000000000..f07c310dcdf1d56ba3dd149b4631b1e63bf967a6
--- /dev/null
+++ b/doc/builders/fetchers.xml
@@ -0,0 +1,150 @@
+
+ Fetchers
+
+ When using Nix, you will frequently need to download source code and other files from the internet. Nixpkgs comes with a few helper functions that allow you to fetch fixed-output derivations in a structured way.
+
+
+ The two fetcher primitives are fetchurl and fetchzip. Both of these have two required arguments, a URL and a hash. The hash is typically sha256, although many more hash algorithms are supported. Nixpkgs contributors are currently recommended to use sha256. This hash will be used by Nix to identify your source. A typical usage of fetchurl is provided below.
+
+
+
+ The main difference between fetchurl and fetchzip is in how they store the contents. fetchurl will store the unaltered contents of the URL within the Nix store. fetchzip on the other hand will decompress the archive for you, making files and directories directly accessible in the future. fetchzip can only be used with archives. Despite the name, fetchzip is not limited to .zip files and can also be used with any tarball.
+
+
+ fetchpatch works very similarly to fetchurl with the same arguments expected. It expects patch files as a source and and performs normalization on them before computing the checksum. For example it will remove comments or other unstable parts that are sometimes added by version control systems and can change over time.
+
+
+ Other fetcher functions allow you to add source code directly from a VCS such as subversion or git. These are mostly straightforward names based on the name of the command used with the VCS system. Because they give you a working repository, they act most like fetchzip.
+
+
+
+
+ fetchsvn
+
+
+
+ Used with Subversion. Expects url to a Subversion directory, rev, and sha256.
+
+
+
+
+
+ fetchgit
+
+
+
+ Used with Git. Expects url to a Git repo, rev, and sha256. rev in this case can be full the git commit id (SHA1 hash) or a tag name like refs/tags/v1.0.
+
+
+
+
+
+ fetchfossil
+
+
+
+ Used with Fossil. Expects url to a Fossil archive, rev, and sha256.
+
+
+
+
+
+ fetchcvs
+
+
+
+ Used with CVS. Expects cvsRoot, tag, and sha256.
+
+
+
+
+
+ fetchhg
+
+
+
+ Used with Mercurial. Expects url, rev, and sha256.
+
+
+
+
+
+ A number of fetcher functions wrap part of fetchurl and fetchzip. They are mainly convenience functions intended for commonly used destinations of source code in Nixpkgs. These wrapper fetchers are listed below.
+
+
+
+
+ fetchFromGitHub
+
+
+
+ fetchFromGitHub expects four arguments. owner is a string corresponding to the GitHub user or organization that controls this repository. repo corresponds to the name of the software repository. These are located at the top of every GitHub HTML page as owner/repo. rev corresponds to the Git commit hash or tag (e.g v1.0) that will be downloaded from Git. Finally, sha256 corresponds to the hash of the extracted directory. Again, other hash algorithms are also available but sha256 is currently preferred.
+
+
+
+
+
+ fetchFromGitLab
+
+
+
+ This is used with GitLab repositories. The arguments expected are very similar to fetchFromGitHub above.
+
+
+
+
+
+ fetchFromGitiles
+
+
+
+ This is used with Gitiles repositories. The arguments expected
+ are similar to fetchgit.
+
+
+
+
+
+ fetchFromBitbucket
+
+
+
+ This is used with BitBucket repositories. The arguments expected are very similar to fetchFromGitHub above.
+
+
+
+
+
+ fetchFromSavannah
+
+
+
+ This is used with Savannah repositories. The arguments expected are very similar to fetchFromGitHub above.
+
+
+
+
+
+ fetchFromRepoOrCz
+
+
+
+ This is used with repo.or.cz repositories. The arguments expected are very similar to fetchFromGitHub above.
+
+
+
+
+
diff --git a/doc/builders/images.xml b/doc/builders/images.xml
new file mode 100644
index 0000000000000000000000000000000000000000..5e042a8ada80a8c318a6b6f6711383b1c3c5877b
--- /dev/null
+++ b/doc/builders/images.xml
@@ -0,0 +1,12 @@
+
+ Images
+
+ This chapter describes tools for creating various types of images.
+
+
+
+
+
+
diff --git a/doc/functions/appimagetools.xml b/doc/builders/images/appimagetools.xml
similarity index 74%
rename from doc/functions/appimagetools.xml
rename to doc/builders/images/appimagetools.xml
index e6dbc22f48ddd14489fa41c3faf3277423f1c90d..37e4251cda2ea87a605b9875ab3c35af0e6e1f18 100644
--- a/doc/functions/appimagetools.xml
+++ b/doc/builders/images/appimagetools.xml
@@ -5,17 +5,12 @@
pkgs.appimageTools
- pkgs.appimageTools is a set of functions for extracting
- and wrapping AppImage files.
- They are meant to be used if traditional packaging from source is infeasible,
- or it would take too long. To quickly run an AppImage file,
- pkgs.appimage-run can be used as well.
+ pkgs.appimageTools is a set of functions for extracting and wrapping AppImage files. They are meant to be used if traditional packaging from source is infeasible, or it would take too long. To quickly run an AppImage file, pkgs.appimage-run can be used as well.
- The appimageTools API is unstable and may be subject to
- backwards-incompatible changes in the future.
+ The appimageTools API is unstable and may be subject to backwards-incompatible changes in the future.
@@ -23,9 +18,7 @@
AppImage formats
- There are different formats for AppImages, see
- the
- specification for details.
+ There are different formats for AppImages, see the specification for details.
@@ -55,8 +48,7 @@ type2.AppImage: ELF 64-bit LSB executable, x86-64, version 1 (SYSV) (Lepton 3.x)
- Note how the type 1 AppImage is described as an ISO 9660 CD-ROM
- filesystem, and the type 2 AppImage is not.
+ Note how the type 1 AppImage is described as an ISO 9660 CD-ROM filesystem, and the type 2 AppImage is not.
@@ -64,8 +56,7 @@ type2.AppImage: ELF 64-bit LSB executable, x86-64, version 1 (SYSV) (Lepton 3.x)
Wrapping
- Depending on the type of AppImage you're wrapping, you'll have to use
- wrapType1 or wrapType2.
+ Depending on the type of AppImage you're wrapping, you'll have to use wrapType1 or wrapType2.
@@ -91,23 +82,16 @@ appimageTools.wrapType2 { # or wrapType1
- extraPkgs allows you to pass a function to include
- additional packages inside the FHS environment your AppImage is going to
- run in. There are a few ways to learn which dependencies an application
- needs:
+ extraPkgs allows you to pass a function to include additional packages inside the FHS environment your AppImage is going to run in. There are a few ways to learn which dependencies an application needs:
- Looking through the extracted AppImage files, reading its scripts and
- running patchelf and ldd on its
- executables. This can also be done in appimage-run,
- by setting APPIMAGE_DEBUG_EXEC=bash.
+ Looking through the extracted AppImage files, reading its scripts and running patchelf and ldd on its executables. This can also be done in appimage-run, by setting APPIMAGE_DEBUG_EXEC=bash.
- Running strace -vfefile on the wrapped executable,
- looking for libraries that can't be found.
+ Running strace -vfefile on the wrapped executable, looking for libraries that can't be found.
diff --git a/doc/functions/dockertools.xml b/doc/builders/images/dockertools.xml
similarity index 60%
rename from doc/functions/dockertools.xml
rename to doc/builders/images/dockertools.xml
index a284182bb047c1b3c4c6785179f6abfe4132651c..e7f37fdaaf00ea51bdfa1a167e6d5d93c9f8410a 100644
--- a/doc/functions/dockertools.xml
+++ b/doc/builders/images/dockertools.xml
@@ -5,33 +5,18 @@
pkgs.dockerTools
- pkgs.dockerTools is a set of functions for creating and
- manipulating Docker images according to the
-
- Docker Image Specification v1.2.0 . Docker itself is not used to
- perform any of the operations done by these functions.
+ pkgs.dockerTools is a set of functions for creating and manipulating Docker images according to the Docker Image Specification v1.2.0 . Docker itself is not used to perform any of the operations done by these functions.
-
-
- The dockerTools API is unstable and may be subject to
- backwards-incompatible changes in the future.
-
-
-
buildImage
- This function is analogous to the docker build command,
- in that it can be used to build a Docker-compatible repository tarball
- containing a single image with one or multiple layers. As such, the result
- is suitable for being loaded in Docker with docker load.
+ This function is analogous to the docker build command, in that it can be used to build a Docker-compatible repository tarball containing a single image with one or multiple layers. As such, the result is suitable for being loaded in Docker with docker load.
- The parameters of buildImage with relative example values
- are described below:
+ The parameters of buildImage with relative example values are described below:
@@ -63,135 +48,89 @@ buildImage {
- The above example will build a Docker image redis/latest
- from the given base image. Loading and running this image in Docker results
- in redis-server being started automatically.
+ The above example will build a Docker image redis/latest from the given base image. Loading and running this image in Docker results in redis-server being started automatically.
- name specifies the name of the resulting image. This is
- the only required argument for buildImage.
+ name specifies the name of the resulting image. This is the only required argument for buildImage.
- tag specifies the tag of the resulting image. By
- default it's null, which indicates that the nix output
- hash will be used as tag.
+ tag specifies the tag of the resulting image. By default it's null, which indicates that the nix output hash will be used as tag.
- fromImage is the repository tarball containing the base
- image. It must be a valid Docker image, such as exported by
- docker save. By default it's null,
- which can be seen as equivalent to FROM scratch of a
- Dockerfile.
+ fromImage is the repository tarball containing the base image. It must be a valid Docker image, such as exported by docker save. By default it's null, which can be seen as equivalent to FROM scratch of a Dockerfile.
- fromImageName can be used to further specify the base
- image within the repository, in case it contains multiple images. By
- default it's null, in which case
- buildImage will peek the first image available in the
- repository.
+ fromImageName can be used to further specify the base image within the repository, in case it contains multiple images. By default it's null, in which case buildImage will peek the first image available in the repository.
- fromImageTag can be used to further specify the tag of
- the base image within the repository, in case an image contains multiple
- tags. By default it's null, in which case
- buildImage will peek the first tag available for the
- base image.
+ fromImageTag can be used to further specify the tag of the base image within the repository, in case an image contains multiple tags. By default it's null, in which case buildImage will peek the first tag available for the base image.
- contents is a derivation that will be copied in the new
- layer of the resulting image. This can be similarly seen as ADD
- contents/ / in a Dockerfile. By default
- it's null.
+ contents is a derivation that will be copied in the new layer of the resulting image. This can be similarly seen as ADD contents/ / in a Dockerfile. By default it's null.
- runAsRoot is a bash script that will run as root in an
- environment that overlays the existing layers of the base image with the
- new resulting layer, including the previously copied
- contents derivation. This can be similarly seen as
- RUN ... in a Dockerfile.
+ runAsRoot is a bash script that will run as root in an environment that overlays the existing layers of the base image with the new resulting layer, including the previously copied contents derivation. This can be similarly seen as RUN ... in a Dockerfile.
- Using this parameter requires the kvm device to be
- available.
+ Using this parameter requires the kvm device to be available.
- config is used to specify the configuration of the
- containers that will be started off the built image in Docker. The
- available options are listed in the
-
- Docker Image Specification v1.2.0 .
+ config is used to specify the configuration of the containers that will be started off the built image in Docker. The available options are listed in the Docker Image Specification v1.2.0 .
- After the new layer has been created, its closure (to which
- contents, config and
- runAsRoot contribute) will be copied in the layer itself.
- Only new dependencies that are not already in the existing layers will be
- copied.
+ After the new layer has been created, its closure (to which contents, config and runAsRoot contribute) will be copied in the layer itself. Only new dependencies that are not already in the existing layers will be copied.
- At the end of the process, only one new single layer will be produced and
- added to the resulting image.
+ At the end of the process, only one new single layer will be produced and added to the resulting image.
- The resulting repository will only list the single image
- image/tag. In the case of
- it would be
- redis/latest.
+ The resulting repository will only list the single image image/tag. In the case of it would be redis/latest.
- It is possible to inspect the arguments with which an image was built using
- its buildArgs attribute.
+ It is possible to inspect the arguments with which an image was built using its buildArgs attribute.
- If you see errors similar to getProtocolByName: does not exist (no
- such protocol name: tcp) you may need to add
- pkgs.iana-etc to contents.
+ If you see errors similar to getProtocolByName: does not exist (no such protocol name: tcp) you may need to add pkgs.iana-etc to contents.
- If you see errors similar to Error_Protocol ("certificate has
- unknown CA",True,UnknownCa) you may need to add
- pkgs.cacert to contents.
+ If you see errors similar to Error_Protocol ("certificate has unknown CA",True,UnknownCa) you may need to add pkgs.cacert to contents.
Impurely Defining a Docker Layer's Creation Date
- By default buildImage will use a static date of one
- second past the UNIX Epoch. This allows buildImage to
- produce binary reproducible images. When listing images with
- docker images, the newly created images will be listed
- like this:
+ By default buildImage will use a static date of one second past the UNIX Epoch. This allows buildImage to produce binary reproducible images. When listing images with docker images, the newly created images will be listed like this:
- You can break binary reproducibility but have a sorted, meaningful
- CREATED column by setting created to
- now.
+ You can break binary reproducibility but have a sorted, meaningful CREATED column by setting created to now.
- and now the Docker CLI will display a reasonable date and sort the images
- as expected:
+ and now the Docker CLI will display a reasonable date and sort the images as expected:
buildLayeredImage
- Create a Docker image with many of the store paths being on their own layer
- to improve sharing between images.
+ Create a Docker image with many of the store paths being on their own layer to improve sharing between images.
@@ -264,8 +199,7 @@ hello latest de2bf4786de6 About a minute ago 25.2MB
- Top level paths in the container. Either a single derivation, or a list
- of derivations.
+ Top level paths in the container. Either a single derivation, or a list of derivations.
Default:[]
@@ -278,10 +212,7 @@ hello latest de2bf4786de6 About a minute ago 25.2MB
- Run-time configuration of the container. A full list of the options are
- available at in the
-
- Docker Image Specification v1.2.0 .
+ Run-time configuration of the container. A full list of the options are available at in the Docker Image Specification v1.2.0 .
Default:{}
@@ -294,9 +225,7 @@ hello latest de2bf4786de6 About a minute ago 25.2MB
- Date and time the layers were created. Follows the same
- now exception supported by
- buildImage.
+ Date and time the layers were created. Follows the same now exception supported by buildImage.
Default:1970-01-01T00:00:01Z
@@ -325,10 +254,7 @@ hello latest de2bf4786de6 About a minute ago 25.2MB
- Shell commands to run while building the final layer, without access
- to most of the layer contents. Changes to this layer are "on top"
- of all the other layers, so can create additional directories
- and files.
+ Shell commands to run while building the final layer, without access to most of the layer contents. Changes to this layer are "on top" of all the other layers, so can create additional directories and files.
@@ -338,8 +264,7 @@ hello latest de2bf4786de6 About a minute ago 25.2MB
Behavior of contents in the final image
- Each path directly listed in contents will have a
- symlink in the root of the image.
+ Each path directly listed in contents will have a symlink in the root of the image.
@@ -350,8 +275,7 @@ pkgs.dockerTools.buildLayeredImage {
contents = [ pkgs.hello ];
}
]]>
- will create symlinks for all the paths in the hello
- package:
+ will create symlinks for all the paths in the hello package:
/nix/store/h1zb1padqbbb7jicsvkmrym3r6snphxg-hello-2.10/bin/hello
/share/info/hello.info -> /nix/store/h1zb1padqbbb7jicsvkmrym3r6snphxg-hello-2.10/share/info/hello.info
@@ -364,13 +288,11 @@ pkgs.dockerTools.buildLayeredImage {
Automatic inclusion of config references
- The closure of config is automatically included in the
- closure of the final image.
+ The closure of config is automatically included in the closure of the final image.
- This allows you to make very simple Docker images with very little code.
- This container will start up and run hello:
+ This allows you to make very simple Docker images with very little code. This container will start up and run hello:
Adjusting maxLayers
- Increasing the maxLayers increases the number of layers
- which have a chance to be shared between different images.
+ Increasing the maxLayers increases the number of layers which have a chance to be shared between different images.
- Modern Docker installations support up to 128 layers, however older
- versions support as few as 42.
+ Modern Docker installations support up to 128 layers, however older versions support as few as 42.
- If the produced image will not be extended by other Docker builds, it is
- safe to set maxLayers to 128. However
- it will be impossible to extend the image further.
+ If the produced image will not be extended by other Docker builds, it is safe to set maxLayers to 128. However it will be impossible to extend the image further.
- The first (maxLayers-2) most "popular" paths will have
- their own individual layers, then layer #maxLayers-1
- will contain all the remaining "unpopular" paths, and finally layer
- #maxLayers will contain the Image configuration.
+ The first (maxLayers-2) most "popular" paths will have their own individual layers, then layer #maxLayers-1 will contain all the remaining "unpopular" paths, and finally layer #maxLayers will contain the Image configuration.
- Docker's Layers are not inherently ordered, they are content-addressable
- and are not explicitly layered until they are composed in to an Image.
+ Docker's Layers are not inherently ordered, they are content-addressable and are not explicitly layered until they are composed in to an Image.
@@ -417,10 +331,7 @@ pkgs.dockerTools.buildLayeredImage {
pullImage
- This function is analogous to the docker pull command, in
- that it can be used to pull a Docker image from a Docker registry. By
- default Docker Hub is used
- to pull images.
+ This function is analogous to the docker pull command, in that it can be used to pull a Docker image from a Docker registry. By default Docker Hub is used to pull images.
@@ -445,76 +356,51 @@ pullImage {
- imageName specifies the name of the image to be
- downloaded, which can also include the registry namespace (e.g.
- nixos). This argument is required.
+ imageName specifies the name of the image to be downloaded, which can also include the registry namespace (e.g. nixos). This argument is required.
- imageDigest specifies the digest of the image to be
- downloaded. This argument is required.
+ imageDigest specifies the digest of the image to be downloaded. This argument is required.
- finalImageName, if specified, this is the name of the
- image to be created. Note it is never used to fetch the image since we
- prefer to rely on the immutable digest ID. By default it's equal to
- imageName.
+ finalImageName, if specified, this is the name of the image to be created. Note it is never used to fetch the image since we prefer to rely on the immutable digest ID. By default it's equal to imageName.
- finalImageTag, if specified, this is the tag of the
- image to be created. Note it is never used to fetch the image since we
- prefer to rely on the immutable digest ID. By default it's
- latest.
+ finalImageTag, if specified, this is the tag of the image to be created. Note it is never used to fetch the image since we prefer to rely on the immutable digest ID. By default it's latest.
- sha256 is the checksum of the whole fetched image. This
- argument is required.
+ sha256 is the checksum of the whole fetched image. This argument is required.
- os, if specified, is the operating system of the
- fetched image. By default it's linux.
+ os, if specified, is the operating system of the fetched image. By default it's linux.
- arch, if specified, is the cpu architecture of the
- fetched image. By default it's x86_64.
+ arch, if specified, is the cpu architecture of the fetched image. By default it's x86_64.
- nix-prefetch-docker command can be used to get required
- image parameters:
-
+ nix-prefetch-docker command can be used to get required image parameters:
$ nix run nixpkgs.nix-prefetch-docker -c nix-prefetch-docker --image-name mysql --image-tag 5
-
- Since a given imageName may transparently refer to a
- manifest list of images which support multiple architectures and/or
- operating systems, you can supply the and
- arguments to specify exactly which image you want.
- By default it will match the OS and architecture of the host the command is
- run on.
-
+ Since a given imageName may transparently refer to a manifest list of images which support multiple architectures and/or operating systems, you can supply the and arguments to specify exactly which image you want. By default it will match the OS and architecture of the host the command is run on.
$ nix-prefetch-docker --image-name mysql --image-tag 5 --arch x86_64 --os linux
-
- Desired image name and tag can be set using
- and
- arguments:
-
+ Desired image name and tag can be set using and arguments:
$ nix-prefetch-docker --image-name mysql --image-tag 5 --final-image-name eu.gcr.io/my-project/mysql --final-image-tag prod
@@ -525,17 +411,12 @@ pullImage {
exportImage
- This function is analogous to the docker export command,
- in that it can be used to flatten a Docker image that contains multiple
- layers. It is in fact the result of the merge of all the layers of the
- image. As such, the result is suitable for being imported in Docker with
- docker import.
+ This function is analogous to the docker export command, in that it can be used to flatten a Docker image that contains multiple layers. It is in fact the result of the merge of all the layers of the image. As such, the result is suitable for being imported in Docker with docker import.
- Using this function requires the kvm device to be
- available.
+ Using this function requires the kvm device to be available.
@@ -557,14 +438,11 @@ exportImage {
- The parameters relative to the base image have the same synopsis as
- described in , except that
- fromImage is the only required argument in this case.
+ The parameters relative to the base image have the same synopsis as described in , except that fromImage is the only required argument in this case.
- The name argument is the name of the derivation output,
- which defaults to fromImage.name.
+ The name argument is the name of the derivation output, which defaults to fromImage.name.
@@ -572,11 +450,7 @@ exportImage {
shadowSetup
- This constant string is a helper for setting up the base files for managing
- users and groups, only if such files don't exist already. It is suitable for
- being used in a runAsRoot
- script for cases like
- in the example below:
+ This constant string is a helper for setting up the base files for managing users and groups, only if such files don't exist already. It is suitable for being used in a runAsRoot script for cases like in the example below:
@@ -598,9 +472,7 @@ buildImage {
- Creating base files like /etc/passwd or
- /etc/login.defs is necessary for shadow-utils to
- manipulate users and groups.
+ Creating base files like /etc/passwd or /etc/login.defs is necessary for shadow-utils to manipulate users and groups.
diff --git a/doc/functions/ocitools.xml b/doc/builders/images/ocitools.xml
similarity index 60%
rename from doc/functions/ocitools.xml
rename to doc/builders/images/ocitools.xml
index 163bee2382e6f214ab73a5958e45a3b5900bb1ec..f61075b242f8ad6054099dcd3c75da76607f7fc5 100644
--- a/doc/functions/ocitools.xml
+++ b/doc/builders/images/ocitools.xml
@@ -5,26 +5,18 @@
pkgs.ociTools
- pkgs.ociTools is a set of functions for creating
- containers according to the
- OCI
- container specification v1.0.0. Beyond that it makes no assumptions
- about the container runner you choose to use to run the created container.
+ pkgs.ociTools is a set of functions for creating containers according to the OCI container specification v1.0.0. Beyond that it makes no assumptions about the container runner you choose to use to run the created container.
buildContainer
- This function creates a simple OCI container that runs a single command
- inside of it. An OCI container consists of a config.json
- and a rootfs directory.The nix store of the container will contain all
- referenced dependencies of the given command.
+ This function creates a simple OCI container that runs a single command inside of it. An OCI container consists of a config.json and a rootfs directory.The nix store of the container will contain all referenced dependencies of the given command.
- The parameters of buildContainer with an example value
- are described below:
+ The parameters of buildContainer with an example value are described below:
@@ -51,23 +43,17 @@ buildContainer {
- args specifies a set of arguments to run inside the container.
- This is the only required argument for buildContainer.
- All referenced packages inside the derivation will be made available
- inside the container
+ args specifies a set of arguments to run inside the container. This is the only required argument for buildContainer. All referenced packages inside the derivation will be made available inside the container
- mounts specifies additional mount points chosen by the
- user. By default only a minimal set of necessary filesystems are mounted
- into the container (e.g procfs, cgroupfs)
+ mounts specifies additional mount points chosen by the user. By default only a minimal set of necessary filesystems are mounted into the container (e.g procfs, cgroupfs)
- readonly makes the container's rootfs read-only if it is set to true.
- The default value is false false.
+ readonly makes the container's rootfs read-only if it is set to true. The default value is false false.
diff --git a/doc/functions/snap/example-firefox.nix b/doc/builders/images/snap/example-firefox.nix
similarity index 100%
rename from doc/functions/snap/example-firefox.nix
rename to doc/builders/images/snap/example-firefox.nix
diff --git a/doc/functions/snap/example-hello.nix b/doc/builders/images/snap/example-hello.nix
similarity index 100%
rename from doc/functions/snap/example-hello.nix
rename to doc/builders/images/snap/example-hello.nix
diff --git a/doc/functions/snaptools.xml b/doc/builders/images/snaptools.xml
similarity index 61%
rename from doc/functions/snaptools.xml
rename to doc/builders/images/snaptools.xml
index d0e3efdf6c674c8d7cb7a42d8a9ca729c898b0d6..422fcfa37d88519d05b23f927605f5472402fd4c 100644
--- a/doc/functions/snaptools.xml
+++ b/doc/builders/images/snaptools.xml
@@ -5,28 +5,22 @@
pkgs.snapTools
- pkgs.snapTools is a set of functions for creating
- Snapcraft images. Snap and Snapcraft is not used to perform these operations.
+ pkgs.snapTools is a set of functions for creating Snapcraft images. Snap and Snapcraft is not used to perform these operations.
The makeSnap Function
- makeSnap takes a single named argument,
- meta. This argument mirrors
- the upstream
- snap.yaml format exactly.
+ makeSnap takes a single named argument, meta. This argument mirrors the upstream snap.yaml format exactly.
- The base should not be be specified, as
- makeSnap will force set it.
+ The base should not be be specified, as makeSnap will force set it.
- Currently, makeSnap does not support creating GUI
- stubs.
+ Currently, makeSnap does not support creating GUI stubs.
@@ -40,9 +34,7 @@
- nix-build this expression and install it with
- snap install ./result --dangerous.
- hello will now be the Snapcraft version of the package.
+ nix-build this expression and install it with snap install ./result --dangerous. hello will now be the Snapcraft version of the package.
@@ -53,21 +45,14 @@
Making a Graphical Snap
- Graphical programs require many more integrations with the host. This
- example uses Firefox as an example, because it is one of the most
- complicated programs we could package.
+ Graphical programs require many more integrations with the host. This example uses Firefox as an example, because it is one of the most complicated programs we could package.
- nix-build this expression and install it with
- snap install ./result --dangerous.
- nix-example-firefox will now be the Snapcraft version of
- the Firefox package.
+ nix-build this expression and install it with snap install ./result --dangerous. nix-example-firefox will now be the Snapcraft version of the Firefox package.
- The specific meaning behind plugs can be looked up in the
- Snapcraft
- interface documentation.
+ The specific meaning behind plugs can be looked up in the Snapcraft interface documentation.
diff --git a/doc/builders/packages/citrix.xml b/doc/builders/packages/citrix.xml
new file mode 100644
index 0000000000000000000000000000000000000000..c629dc9ee503ecd468e3f1a4027fc67c6deee6d8
--- /dev/null
+++ b/doc/builders/packages/citrix.xml
@@ -0,0 +1,44 @@
+
+ Citrix Workspace
+
+
+
+
+ Please note that the citrix_receiver package has been deprecated since its development was discontinued by upstream and has been replaced by the citrix workspace app.
+
+
+ Citrix Receiver and Citrix Workspace App are a remote desktop viewers which provide access to XenDesktop installations.
+
+
+
+ Basic usage
+
+
+ The tarball archive needs to be downloaded manually as the license agreements of the vendor for Citrix Receiver or Citrix Workspace need to be accepted first. Then run nix-prefetch-url file://$PWD/linuxx64-$version.tar.gz. With the archive available in the store the package can be built and installed with Nix.
+
+
+
+ Caution with nix-shell installs
+
+ It's recommended to install Citrix Receiver and/or Citrix Workspace using nix-env -i or globally to ensure that the .desktop files are installed properly into $XDG_CONFIG_DIRS. Otherwise it won't be possible to open .ica files automatically from the browser to start a Citrix connection.
+
+
+
+
+
+ Custom certificates
+
+
+ The Citrix Workspace App in nixpkgs trust several certificates from the Mozilla database by default. However several companies using Citrix might require their own corporate certificate. On distros with imperative packaging these certs can be stored easily in $ICAROOT, however this directory is a store path in nixpkgs. In order to work around this issue the package provides a simple mechanism to add custom certificates without rebuilding the entire package using symlinkJoin:
+
+ { config.allowUnfree = true; };
+let extraCerts = [ ./custom-cert-1.pem ./custom-cert-2.pem /* ... */ ]; in
+citrix_workspace.override {
+ inherit extraCerts;
+}]]>
+
+
+
+
diff --git a/doc/builders/packages/dlib.xml b/doc/builders/packages/dlib.xml
new file mode 100644
index 0000000000000000000000000000000000000000..5f768dd51b62d5cc52242852eaf8a56e70c76679
--- /dev/null
+++ b/doc/builders/packages/dlib.xml
@@ -0,0 +1,24 @@
+
+ DLib
+
+
+ DLib is a modern, C++-based toolkit which provides several machine learning algorithms.
+
+
+
+ Compiling without AVX support
+
+
+ Especially older CPUs don't support AVX (Advanced Vector Extensions) instructions that are used by DLib to optimize their algorithms.
+
+
+
+ On the affected hardware errors like Illegal instruction will occur. In those cases AVX support needs to be disabled:
+self: super: {
+ dlib = super.dlib.override { avxSupport = false; };
+}
+
+
+
diff --git a/doc/builders/packages/eclipse.xml b/doc/builders/packages/eclipse.xml
new file mode 100644
index 0000000000000000000000000000000000000000..fc5094ed8f364ccf93f352877a88de4164464cea
--- /dev/null
+++ b/doc/builders/packages/eclipse.xml
@@ -0,0 +1,72 @@
+
+ Eclipse
+
+
+ The Nix expressions related to the Eclipse platform and IDE are in pkgs/applications/editors/eclipse.
+
+
+
+ Nixpkgs provides a number of packages that will install Eclipse in its various forms. These range from the bare-bones Eclipse Platform to the more fully featured Eclipse SDK or Scala-IDE packages and multiple version are often available. It is possible to list available Eclipse packages by issuing the command:
+
+$ nix-env -f '<nixpkgs>' -qaP -A eclipses --description
+
+ Once an Eclipse variant is installed it can be run using the eclipse command, as expected. From within Eclipse it is then possible to install plugins in the usual manner by either manually specifying an Eclipse update site or by installing the Marketplace Client plugin and using it to discover and install other plugins. This installation method provides an Eclipse installation that closely resemble a manually installed Eclipse.
+
+
+
+ If you prefer to install plugins in a more declarative manner then Nixpkgs also offer a number of Eclipse plugins that can be installed in an Eclipse environment. This type of environment is created using the function eclipseWithPlugins found inside the nixpkgs.eclipses attribute set. This function takes as argument { eclipse, plugins ? [], jvmArgs ? [] } where eclipse is a one of the Eclipse packages described above, plugins is a list of plugin derivations, and jvmArgs is a list of arguments given to the JVM running the Eclipse. For example, say you wish to install the latest Eclipse Platform with the popular Eclipse Color Theme plugin and also allow Eclipse to use more RAM. You could then add
+
+packageOverrides = pkgs: {
+ myEclipse = with pkgs.eclipses; eclipseWithPlugins {
+ eclipse = eclipse-platform;
+ jvmArgs = [ "-Xmx2048m" ];
+ plugins = [ plugins.color-theme ];
+ };
+}
+
+ to your Nixpkgs configuration (~/.config/nixpkgs/config.nix) and install it by running nix-env -f '<nixpkgs>' -iA myEclipse and afterward run Eclipse as usual. It is possible to find out which plugins are available for installation using eclipseWithPlugins by running
+
+$ nix-env -f '<nixpkgs>' -qaP -A eclipses.plugins --description
+
+
+
+
+ If there is a need to install plugins that are not available in Nixpkgs then it may be possible to define these plugins outside Nixpkgs using the buildEclipseUpdateSite and buildEclipsePlugin functions found in the nixpkgs.eclipses.plugins attribute set. Use the buildEclipseUpdateSite function to install a plugin distributed as an Eclipse update site. This function takes { name, src } as argument where src indicates the Eclipse update site archive. All Eclipse features and plugins within the downloaded update site will be installed. When an update site archive is not available then the buildEclipsePlugin function can be used to install a plugin that consists of a pair of feature and plugin JARs. This function takes an argument { name, srcFeature, srcPlugin } where srcFeature and srcPlugin are the feature and plugin JARs, respectively.
+
+
+
+ Expanding the previous example with two plugins using the above functions we have
+
+packageOverrides = pkgs: {
+ myEclipse = with pkgs.eclipses; eclipseWithPlugins {
+ eclipse = eclipse-platform;
+ jvmArgs = [ "-Xmx2048m" ];
+ plugins = [
+ plugins.color-theme
+ (plugins.buildEclipsePlugin {
+ name = "myplugin1-1.0";
+ srcFeature = fetchurl {
+ url = "http://…/features/myplugin1.jar";
+ sha256 = "123…";
+ };
+ srcPlugin = fetchurl {
+ url = "http://…/plugins/myplugin1.jar";
+ sha256 = "123…";
+ };
+ });
+ (plugins.buildEclipseUpdateSite {
+ name = "myplugin2-1.0";
+ src = fetchurl {
+ stripRoot = false;
+ url = "http://…/myplugin2.zip";
+ sha256 = "123…";
+ };
+ });
+ ];
+ };
+}
+
+
+
diff --git a/doc/builders/packages/elm.xml b/doc/builders/packages/elm.xml
new file mode 100644
index 0000000000000000000000000000000000000000..a067f6c7c70ee742489629cd71c7ee94de0de19b
--- /dev/null
+++ b/doc/builders/packages/elm.xml
@@ -0,0 +1,17 @@
+
+ Elm
+
+
+ To start a development environment do nix-shell -p elmPackages.elm elmPackages.elm-format
+
+
+
+ To update Elm compiler, see nixpkgs/pkgs/development/compilers/elm/README.md.
+
+
+
+ To package Elm applications, read about elm2nix.
+
+
diff --git a/doc/builders/packages/emacs.xml b/doc/builders/packages/emacs.xml
new file mode 100644
index 0000000000000000000000000000000000000000..9cce7c40863aff3497c90f6560f3abefa005d2bb
--- /dev/null
+++ b/doc/builders/packages/emacs.xml
@@ -0,0 +1,131 @@
+
+ Emacs
+
+
+ Configuring Emacs
+
+
+ The Emacs package comes with some extra helpers to make it easier to configure. emacsWithPackages allows you to manage packages from ELPA. This means that you will not have to install that packages from within Emacs. For instance, if you wanted to use company, counsel, flycheck, ivy, magit, projectile, and use-package you could use this as a ~/.config/nixpkgs/config.nix override:
+
+
+
+{
+ packageOverrides = pkgs: with pkgs; {
+ myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
+ company
+ counsel
+ flycheck
+ ivy
+ magit
+ projectile
+ use-package
+ ]));
+ }
+}
+
+
+
+ You can install it like any other packages via nix-env -iA myEmacs. However, this will only install those packages. It will not configure them for us. To do this, we need to provide a configuration file. Luckily, it is possible to do this from within Nix! By modifying the above example, we can make Emacs load a custom config file. The key is to create a package that provide a default.el file in /share/emacs/site-start/. Emacs knows to load this file automatically when it starts.
+
+
+
+{
+ packageOverrides = pkgs: with pkgs; rec {
+ myEmacsConfig = writeText "default.el" ''
+;; initialize package
+
+(require 'package)
+(package-initialize 'noactivate)
+(eval-when-compile
+ (require 'use-package))
+
+;; load some packages
+
+(use-package company
+ :bind ("<C-tab>" . company-complete)
+ :diminish company-mode
+ :commands (company-mode global-company-mode)
+ :defer 1
+ :config
+ (global-company-mode))
+
+(use-package counsel
+ :commands (counsel-descbinds)
+ :bind (([remap execute-extended-command] . counsel-M-x)
+ ("C-x C-f" . counsel-find-file)
+ ("C-c g" . counsel-git)
+ ("C-c j" . counsel-git-grep)
+ ("C-c k" . counsel-ag)
+ ("C-x l" . counsel-locate)
+ ("M-y" . counsel-yank-pop)))
+
+(use-package flycheck
+ :defer 2
+ :config (global-flycheck-mode))
+
+(use-package ivy
+ :defer 1
+ :bind (("C-c C-r" . ivy-resume)
+ ("C-x C-b" . ivy-switch-buffer)
+ :map ivy-minibuffer-map
+ ("C-j" . ivy-call))
+ :diminish ivy-mode
+ :commands ivy-mode
+ :config
+ (ivy-mode 1))
+
+(use-package magit
+ :defer
+ :if (executable-find "git")
+ :bind (("C-x g" . magit-status)
+ ("C-x G" . magit-dispatch-popup))
+ :init
+ (setq magit-completing-read-function 'ivy-completing-read))
+
+(use-package projectile
+ :commands projectile-mode
+ :bind-keymap ("C-c p" . projectile-command-map)
+ :defer 5
+ :config
+ (projectile-global-mode))
+ '';
+ myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
+ (runCommand "default.el" {} ''
+mkdir -p $out/share/emacs/site-lisp
+cp ${myEmacsConfig} $out/share/emacs/site-lisp/default.el
+'')
+ company
+ counsel
+ flycheck
+ ivy
+ magit
+ projectile
+ use-package
+ ]));
+ };
+}
+
+
+
+ This provides a fairly full Emacs start file. It will load in addition to the user's presonal config. You can always disable it by passing -q to the Emacs command.
+
+
+
+ Sometimes emacsWithPackages is not enough, as this package set has some priorities imposed on packages (with the lowest priority assigned to Melpa Unstable, and the highest for packages manually defined in pkgs/top-level/emacs-packages.nix). But you can't control this priorities when some package is installed as a dependency. You can override it on per-package-basis, providing all the required dependencies manually - but it's tedious and there is always a possibility that an unwanted dependency will sneak in through some other package. To completely override such a package you can use overrideScope'.
+
+
+
+overrides = self: super: rec {
+ haskell-mode = self.melpaPackages.haskell-mode;
+ ...
+};
+((emacsPackagesGen emacs).overrideScope' overrides).emacsWithPackages (p: with p; [
+ # here both these package will use haskell-mode of our own choice
+ ghc-mod
+ dante
+])
+
+
+
diff --git a/doc/builders/packages/ibus.xml b/doc/builders/packages/ibus.xml
new file mode 100644
index 0000000000000000000000000000000000000000..2ed37903a27339b016b5effc7dbc2fc883654225
--- /dev/null
+++ b/doc/builders/packages/ibus.xml
@@ -0,0 +1,57 @@
+
+ ibus-engines.typing-booster
+
+
+ This package is an ibus-based completion method to speed up typing.
+
+
+
+ Activating the engine
+
+
+ IBus needs to be configured accordingly to activate typing-booster. The configuration depends on the desktop manager in use. For detailed instructions, please refer to the upstream docs.
+
+
+
+ On NixOS you need to explicitly enable ibus with given engines before customizing your desktop to use typing-booster. This can be achieved using the ibus module:
+{ pkgs, ... }: {
+ i18n.inputMethod = {
+ enabled = "ibus";
+ ibus.engines = with pkgs.ibus-engines; [ typing-booster ];
+ };
+}
+
+
+
+
+ Using custom hunspell dictionaries
+
+
+ The IBus engine is based on hunspell to support completion in many languages. By default the dictionaries de-de, en-us, fr-modernees-es, it-it, sv-se and sv-fi are in use. To add another dictionary, the package can be overridden like this:
+ibus-engines.typing-booster.override {
+ langs = [ "de-at" "en-gb" ];
+}
+
+
+
+ Note: each language passed to langs must be an attribute name in pkgs.hunspellDicts.
+
+
+
+
+ Built-in emoji picker
+
+
+ The ibus-engines.typing-booster package contains a program named emoji-picker. To display all emojis correctly, a special font such as noto-fonts-emoji is needed:
+
+
+
+ On NixOS it can be installed using the following expression:
+{ pkgs, ... }: {
+ fonts.fonts = with pkgs; [ noto-fonts-emoji ];
+}
+
+
+
diff --git a/doc/builders/packages/index.xml b/doc/builders/packages/index.xml
new file mode 100644
index 0000000000000000000000000000000000000000..9f3f58a8d90319e8020497e2830432599f1803b7
--- /dev/null
+++ b/doc/builders/packages/index.xml
@@ -0,0 +1,23 @@
+
+ Packages
+
+ This chapter contains information about how to use and maintain the Nix expressions for a number of specific packages, such as the Linux kernel or X.org.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/doc/builders/packages/kakoune.xml b/doc/builders/packages/kakoune.xml
new file mode 100644
index 0000000000000000000000000000000000000000..728d40dacc92faa97f3f16cee34d717b6cd848be
--- /dev/null
+++ b/doc/builders/packages/kakoune.xml
@@ -0,0 +1,14 @@
+
+ Kakoune
+
+
+ Kakoune can be built to autoload plugins:
+(kakoune.override {
+ configure = {
+ plugins = with pkgs.kakounePlugins; [ parinfer-rust ];
+ };
+})
+
+
diff --git a/doc/builders/packages/linux.xml b/doc/builders/packages/linux.xml
new file mode 100644
index 0000000000000000000000000000000000000000..72d0e21493b3f00552925b4e6aea6396ec233f29
--- /dev/null
+++ b/doc/builders/packages/linux.xml
@@ -0,0 +1,85 @@
+
+ Linux kernel
+
+
+ The Nix expressions to build the Linux kernel are in pkgs/os-specific/linux/kernel.
+
+
+
+ The function that builds the kernel has an argument kernelPatches which should be a list of {name, patch, extraConfig} attribute sets, where name is the name of the patch (which is included in the kernel’s meta.description attribute), patch is the patch itself (possibly compressed), and extraConfig (optional) is a string specifying extra options to be concatenated to the kernel configuration file (.config).
+
+
+
+ The kernel derivation exports an attribute features specifying whether optional functionality is or isn’t enabled. This is used in NixOS to implement kernel-specific behaviour. For instance, if the kernel has the iwlwifi feature (i.e. has built-in support for Intel wireless chipsets), then NixOS doesn’t have to build the external iwlwifi package:
+
+modulesTree = [kernel]
+ ++ pkgs.lib.optional (!kernel.features ? iwlwifi) kernelPackages.iwlwifi
+ ++ ...;
+
+
+
+
+ How to add a new (major) version of the Linux kernel to Nixpkgs:
+
+
+
+ Copy the old Nix expression (e.g. linux-2.6.21.nix) to the new one (e.g. linux-2.6.22.nix) and update it.
+
+
+
+
+ Add the new kernel to all-packages.nix (e.g., create an attribute kernel_2_6_22).
+
+
+
+
+ Now we’re going to update the kernel configuration. First unpack the kernel. Then for each supported platform (i686, x86_64, uml) do the following:
+
+
+
+ Make an copy from the old config (e.g. config-2.6.21-i686-smp) to the new one (e.g. config-2.6.22-i686-smp).
+
+
+
+
+ Copy the config file for this platform (e.g. config-2.6.22-i686-smp) to .config in the kernel source tree.
+
+
+
+
+ Run make oldconfig ARCH={i386,x86_64,um} and answer all questions. (For the uml configuration, also add SHELL=bash.) Make sure to keep the configuration consistent between platforms (i.e. don’t enable some feature on i686 and disable it on x86_64).
+
+
+
+
+ If needed you can also run make menuconfig:
+
+$ nix-env -i ncurses
+$ export NIX_CFLAGS_LINK=-lncurses
+$ make menuconfig ARCH=arch
+
+
+
+
+ Copy .config over the new config file (e.g. config-2.6.22-i686-smp).
+
+
+
+
+
+
+
+ Test building the kernel: nix-build -A kernel_2_6_22. If it compiles, ship it! For extra credit, try booting NixOS with it.
+
+
+
+
+ It may be that the new kernel requires updating the external kernel modules and kernel-dependent packages listed in the linuxPackagesFor function in all-packages.nix (such as the NVIDIA drivers, AUFS, etc.). If the updated packages aren’t backwards compatible with older kernels, you may need to keep the older versions around.
+
+
+
+
+
diff --git a/doc/builders/packages/locales.xml b/doc/builders/packages/locales.xml
new file mode 100644
index 0000000000000000000000000000000000000000..44fdef034e77f1cd2b158604c0ac26ba60978ffe
--- /dev/null
+++ b/doc/builders/packages/locales.xml
@@ -0,0 +1,13 @@
+
+ Locales
+
+
+ To allow simultaneous use of packages linked against different versions of glibc with different locale archive formats Nixpkgs patches glibc to rely on LOCALE_ARCHIVE environment variable.
+
+
+
+ On non-NixOS distributions this variable is obviously not set. This can cause regressions in language support or even crashes in some Nixpkgs-provided programs. The simplest way to mitigate this problem is exporting the LOCALE_ARCHIVE variable pointing to ${glibcLocales}/lib/locale/locale-archive. The drawback (and the reason this is not the default) is the relatively large (a hundred MiB) size of the full set of locales. It is possible to build a custom set of locales by overriding parameters allLocales and locales of the package.
+
+
diff --git a/doc/builders/packages/nginx.xml b/doc/builders/packages/nginx.xml
new file mode 100644
index 0000000000000000000000000000000000000000..65854ba0236675233d57a2b0b27ddfec224daf99
--- /dev/null
+++ b/doc/builders/packages/nginx.xml
@@ -0,0 +1,25 @@
+
+ Nginx
+
+
+ Nginx is a reverse proxy and lightweight webserver.
+
+
+
+ ETags on static files served from the Nix store
+
+
+ HTTP has a couple different mechanisms for caching to prevent clients from having to download the same content repeatedly if a resource has not changed since the last time it was requested. When nginx is used as a server for static files, it implements the caching mechanism based on the Last-Modified response header automatically; unfortunately, it works by using filesystem timestamps to determine the value of the Last-Modified header. This doesn't give the desired behavior when the file is in the Nix store, because all file timestamps are set to 0 (for reasons related to build reproducibility).
+
+
+
+ Fortunately, HTTP supports an alternative (and more effective) caching mechanism: the ETag response header. The value of the ETag header specifies some identifier for the particular content that the server is sending (e.g. a hash). When a client makes a second request for the same resource, it sends that value back in an If-None-Match header. If the ETag value is unchanged, then the server does not need to resend the content.
+
+
+
+ As of NixOS 19.09, the nginx package in Nixpkgs is patched such that when nginx serves a file out of /nix/store, the hash in the store path is used as the ETag header in the HTTP response, thus providing proper caching functionality. This happens automatically; you do not need to do modify any configuration to get this behavior.
+
+
+
diff --git a/doc/builders/packages/opengl.xml b/doc/builders/packages/opengl.xml
new file mode 100644
index 0000000000000000000000000000000000000000..5f4433a288446ff14d59f5d4897240a0c381d309
--- /dev/null
+++ b/doc/builders/packages/opengl.xml
@@ -0,0 +1,9 @@
+
+ OpenGL
+
+
+ Packages that use OpenGL have NixOS desktop as their primary target. The current solution for loading the GPU-specific drivers is based on libglvnd and looks for the driver implementation in LD_LIBRARY_PATH. If you are using a non-NixOS GNU/Linux/X11 desktop with free software video drivers, consider launching OpenGL-dependent programs from Nixpkgs with Nixpkgs versions of libglvnd and mesa_drivers in LD_LIBRARY_PATH. For proprietary video drivers you might have luck with also adding the corresponding video driver package.
+
+
diff --git a/doc/builders/packages/shell-helpers.xml b/doc/builders/packages/shell-helpers.xml
new file mode 100644
index 0000000000000000000000000000000000000000..cb70d527d67b7abf2bf6b775c5a76e3c941f8064
--- /dev/null
+++ b/doc/builders/packages/shell-helpers.xml
@@ -0,0 +1,25 @@
+
+ Interactive shell helpers
+
+
+ Some packages provide the shell integration to be more useful. But unlike other systems, nix doesn't have a standard share directory location. This is why a bunch PACKAGE-share scripts are shipped that print the location of the corresponding shared folder. Current list of such packages is as following:
+
+
+
+ autojump: autojump-share
+
+
+
+
+ fzf: fzf-share
+
+
+
+ E.g. autojump can then used in the .bashrc like this:
+
+ source "$(autojump-share)/autojump.bash"
+
+
+
diff --git a/doc/builders/packages/steam.xml b/doc/builders/packages/steam.xml
new file mode 100644
index 0000000000000000000000000000000000000000..8dfede59ac1ba16e2dc407488a3f07403faad48f
--- /dev/null
+++ b/doc/builders/packages/steam.xml
@@ -0,0 +1,131 @@
+
+ Steam
+
+
+ Steam in Nix
+
+
+ Steam is distributed as a .deb file, for now only as an i686 package (the amd64 package only has documentation). When unpacked, it has a script called steam that in Ubuntu (their target distro) would go to /usr/bin . When run for the first time, this script copies some files to the user's home, which include another script that is the ultimate responsible for launching the steam binary, which is also in $HOME.
+
+
+
+ Nix problems and constraints:
+
+
+
+ We don't have /bin/bash and many scripts point there. Similarly for /usr/bin/python .
+
+
+
+
+ We don't have the dynamic loader in /lib .
+
+
+
+
+ The steam.sh script in $HOME can not be patched, as it is checked and rewritten by steam.
+
+
+
+
+ The steam binary cannot be patched, it's also checked.
+
+
+
+
+
+
+ The current approach to deploy Steam in NixOS is composing a FHS-compatible chroot environment, as documented here. This allows us to have binaries in the expected paths without disrupting the system, and to avoid patching them to work in a non FHS environment.
+
+
+
+
+ How to play
+
+
+ For 64-bit systems it's important to have
+hardware.opengl.driSupport32Bit = true;
+ in your /etc/nixos/configuration.nix. You'll also need
+hardware.pulseaudio.support32Bit = true;
+ if you are using PulseAudio - this will enable 32bit ALSA apps integration. To use the Steam controller or other Steam supported controllers such as the DualShock 4 or Nintendo Switch Pro, you need to add
+hardware.steam-hardware.enable = true;
+ to your configuration.
+
+
+
+
+ Troubleshooting
+
+
+
+
+
+ Steam fails to start. What do I do?
+
+
+
+ Try to run
+strace steam
+ to see what is causing steam to fail.
+
+
+
+
+
+ Using the FOSS Radeon or nouveau (nvidia) drivers
+
+
+
+
+
+ The newStdcpp parameter was removed since NixOS 17.09 and should not be needed anymore.
+
+
+
+
+ Steam ships statically linked with a version of libcrypto that conflics with the one dynamically loaded by radeonsi_dri.so. If you get the error
+steam.sh: line 713: 7842 Segmentation fault (core dumped)
+ have a look at this pull request.
+
+
+
+
+
+
+
+ Java
+
+
+
+
+
+ There is no java in steam chrootenv by default. If you get a message like
+/home/foo/.local/share/Steam/SteamApps/common/towns/towns.sh: line 1: java: command not found
+ You need to add
+ steam.override { withJava = true; };
+ to your configuration.
+
+
+
+
+
+
+
+
+
+
+ steam-run
+
+
+ The FHS-compatible chroot used for steam can also be used to run other linux games that expect a FHS environment. To do it, add
+pkgs.(steam.override {
+ nativeOnly = true;
+ newStdcpp = true;
+ }).run
+ to your configuration, rebuild, and run the game with
+steam-run ./foo
+
+
+
diff --git a/doc/builders/packages/unfree.xml b/doc/builders/packages/unfree.xml
new file mode 100644
index 0000000000000000000000000000000000000000..3d4f199f8fb0ddb17b17b4f8960f385a229f4134
--- /dev/null
+++ b/doc/builders/packages/unfree.xml
@@ -0,0 +1,13 @@
+
+ Unfree software
+
+
+ All users of Nixpkgs are free software users, and many users (and developers) of Nixpkgs want to limit and tightly control their exposure to unfree software. At the same time, many users need (or want) to run some specific pieces of proprietary software. Nixpkgs includes some expressions for unfree software packages. By default unfree software cannot be installed and doesn’t show up in searches. To allow installing unfree software in a single Nix invocation one can export NIXPKGS_ALLOW_UNFREE=1. For a persistent solution, users can set allowUnfree in the Nixpkgs configuration.
+
+
+
+ Fine-grained control is possible by defining allowUnfreePredicate function in config; it takes the mkDerivation parameter attrset and returns true for unfree packages that should be allowed.
+
+
diff --git a/doc/builders/packages/weechat.xml b/doc/builders/packages/weechat.xml
new file mode 100644
index 0000000000000000000000000000000000000000..a110d3f491c796f244052ed6328e4c4396ceff35
--- /dev/null
+++ b/doc/builders/packages/weechat.xml
@@ -0,0 +1,85 @@
+
+ Weechat
+
+
+ Weechat can be configured to include your choice of plugins, reducing its closure size from the default configuration which includes all available plugins. To make use of this functionality, install an expression that overrides its configuration such as
+weechat.override {configure = {availablePlugins, ...}: {
+ plugins = with availablePlugins; [ python perl ];
+ }
+}
+ If the configure function returns an attrset without the plugins attribute, availablePlugins will be used automatically.
+
+
+
+ The plugins currently available are python, perl, ruby, guile, tcl and lua.
+
+
+
+ The python and perl plugins allows the addition of extra libraries. For instance, the inotify.py script in weechat-scripts requires D-Bus or libnotify, and the fish.py script requires pycrypto. To use these scripts, use the plugin's withPackages attribute:
+weechat.override { configure = {availablePlugins, ...}: {
+ plugins = with availablePlugins; [
+ (python.withPackages (ps: with ps; [ pycrypto python-dbus ]))
+ ];
+ };
+}
+
+
+
+
+ In order to also keep all default plugins installed, it is possible to use the following method:
+weechat.override { configure = { availablePlugins, ... }: {
+ plugins = builtins.attrValues (availablePlugins // {
+ python = availablePlugins.python.withPackages (ps: with ps; [ pycrypto python-dbus ]);
+ });
+}; }
+
+
+
+
+ WeeChat allows to set defaults on startup using the --run-command. The configure method can be used to pass commands to the program:
+weechat.override {
+ configure = { availablePlugins, ... }: {
+ init = ''
+ /set foo bar
+ /server add freenode chat.freenode.org
+ '';
+ };
+}
+ Further values can be added to the list of commands when running weechat --run-command "your-commands".
+
+
+
+ Additionally it's possible to specify scripts to be loaded when starting weechat. These will be loaded before the commands from init:
+weechat.override {
+ configure = { availablePlugins, ... }: {
+ scripts = with pkgs.weechatScripts; [
+ weechat-xmpp weechat-matrix-bridge wee-slack
+ ];
+ init = ''
+ /set plugins.var.python.jabber.key "val"
+ '':
+ };
+}
+
+
+
+ In nixpkgs there's a subpackage which contains derivations for WeeChat scripts. Such derivations expect a passthru.scripts attribute which contains a list of all scripts inside the store path. Furthermore all scripts have to live in $out/share. An exemplary derivation looks like this:
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation {
+ name = "exemplary-weechat-script";
+ src = fetchurl {
+ url = "https://scripts.tld/your-scripts.tar.gz";
+ sha256 = "...";
+ };
+ passthru.scripts = [ "foo.py" "bar.lua" ];
+ installPhase = ''
+ mkdir $out/share
+ cp foo.py $out/share
+ cp bar.lua $out/share
+ '';
+}
+
+
diff --git a/doc/builders/packages/xorg.xml b/doc/builders/packages/xorg.xml
new file mode 100644
index 0000000000000000000000000000000000000000..ebf4930cc0976b398050ec18a9523f8b3d3e5567
--- /dev/null
+++ b/doc/builders/packages/xorg.xml
@@ -0,0 +1,34 @@
+
+ X.org
+
+
+ The Nix expressions for the X.org packages reside in pkgs/servers/x11/xorg/default.nix. This file is automatically generated from lists of tarballs in an X.org release. As such it should not be modified directly; rather, you should modify the lists, the generator script or the file pkgs/servers/x11/xorg/overrides.nix, in which you can override or add to the derivations produced by the generator.
+
+
+
+ The generator is invoked as follows:
+
+$ cd pkgs/servers/x11/xorg
+$ cat tarballs-7.5.list extra.list old.list \
+ | perl ./generate-expr-from-tarballs.pl
+
+ For each of the tarballs in the .list files, the script downloads it, unpacks it, and searches its configure.ac and *.pc.in files for dependencies. This information is used to generate default.nix. The generator caches downloaded tarballs between runs. Pay close attention to the NOT FOUND: name messages at the end of the run, since they may indicate missing dependencies. (Some might be optional dependencies, however.)
+
+
+
+ A file like tarballs-7.5.list contains all tarballs in a X.org release. It can be generated like this:
+
+$ export i="mirror://xorg/X11R7.4/src/everything/"
+$ cat $(PRINT_PATH=1 nix-prefetch-url $i | tail -n 1) \
+ | perl -e 'while (<>) { if (/(href|HREF)="([^"]*.bz2)"/) { print "$ENV{'i'}$2\n"; }; }' \
+ | sort > tarballs-7.4.list
+
+ extra.list contains libraries that aren’t part of X.org proper, but are closely related to it, such as libxcb. old.list contains some packages that were removed from X.org, but are still needed by some people or by other packages (such as imake).
+
+
+
+ If the expression for a package requires derivation attributes that the generator cannot figure out automatically (say, patches or a postInstall hook), you should modify pkgs/servers/x11/xorg/overrides.nix.
+
+
diff --git a/doc/builders/special.xml b/doc/builders/special.xml
new file mode 100644
index 0000000000000000000000000000000000000000..15fdba9a0419e989b17bf010a64880c7603e6414
--- /dev/null
+++ b/doc/builders/special.xml
@@ -0,0 +1,10 @@
+
+ Special builders
+
+ This chapter describes several special builders.
+
+
+
+
diff --git a/doc/functions/fhs-environments.xml b/doc/builders/special/fhs-environments.xml
similarity index 65%
rename from doc/functions/fhs-environments.xml
rename to doc/builders/special/fhs-environments.xml
index 79682080be314a1d545d3429af06214ee1f5740d..e7b81e97a23f9da34e98c83cb4bb6c1174cd58f8 100644
--- a/doc/functions/fhs-environments.xml
+++ b/doc/builders/special/fhs-environments.xml
@@ -5,15 +5,7 @@
buildFHSUserEnv
- buildFHSUserEnv provides a way to build and run
- FHS-compatible lightweight sandboxes. It creates an isolated root with bound
- /nix/store, so its footprint in terms of disk space
- needed is quite small. This allows one to run software which is hard or
- unfeasible to patch for NixOS -- 3rd-party source trees with FHS assumptions,
- games distributed as tarballs, software with integrity checking and/or
- external self-updated binaries. It uses Linux namespaces feature to create
- temporary lightweight environments which are destroyed after all child
- processes exit, without root user rights requirement. Accepted arguments are:
+ buildFHSUserEnv provides a way to build and run FHS-compatible lightweight sandboxes. It creates an isolated root with bound /nix/store, so its footprint in terms of disk space needed is quite small. This allows one to run software which is hard or unfeasible to patch for NixOS -- 3rd-party source trees with FHS assumptions, games distributed as tarballs, software with integrity checking and/or external self-updated binaries. It uses Linux namespaces feature to create temporary lightweight environments which are destroyed after all child processes exit, without root user rights requirement. Accepted arguments are:
@@ -33,8 +25,7 @@
- Packages to be installed for the main host's architecture (i.e. x86_64 on
- x86_64 installations). Along with libraries binaries are also installed.
+ Packages to be installed for the main host's architecture (i.e. x86_64 on x86_64 installations). Along with libraries binaries are also installed.
@@ -44,9 +35,7 @@
- Packages to be installed for all architectures supported by a host (i.e.
- i686 and x86_64 on x86_64 installations). Only libraries are installed by
- default.
+ Packages to be installed for all architectures supported by a host (i.e. i686 and x86_64 on x86_64 installations). Only libraries are installed by default.
@@ -66,8 +55,7 @@
- Like extraBuildCommands, but executed only on multilib
- architectures.
+ Like extraBuildCommands, but executed only on multilib architectures.
@@ -77,8 +65,7 @@
- Additional derivation outputs to be linked for both target and
- multi-architecture packages.
+ Additional derivation outputs to be linked for both target and multi-architecture packages.
@@ -88,8 +75,7 @@
- Additional commands to be executed for finalizing the derivation with
- runner script.
+ Additional commands to be executed for finalizing the derivation with runner script.
@@ -99,16 +85,14 @@
- A command that would be executed inside the sandbox and passed all the
- command line arguments. It defaults to bash.
+ A command that would be executed inside the sandbox and passed all the command line arguments. It defaults to bash.
- One can create a simple environment using a shell.nix like
- that:
+ One can create a simple environment using a shell.nix like that:
- Running nix-shell would then drop you into a shell with
- these libraries and binaries available. You can use this to run closed-source
- applications which expect FHS structure without hassles: simply change
- runScript to the application path, e.g.
- ./bin/start.sh -- relative paths are supported.
+ Running nix-shell would then drop you into a shell with these libraries and binaries available. You can use this to run closed-source applications which expect FHS structure without hassles: simply change runScript to the application path, e.g. ./bin/start.sh -- relative paths are supported.
diff --git a/doc/functions/shell.xml b/doc/builders/special/mkshell.xml
similarity index 79%
rename from doc/functions/shell.xml
rename to doc/builders/special/mkshell.xml
index e5031c9463c0676c94a1c172fecea137b1d090e4..cef65d06b8823176659f60f9ec55fad9683ea4a7 100644
--- a/doc/functions/shell.xml
+++ b/doc/builders/special/mkshell.xml
@@ -5,9 +5,7 @@
pkgs.mkShell
- pkgs.mkShell is a special kind of derivation that is
- only useful when using it combined with nix-shell. It will
- in fact fail to instantiate when invoked with nix-build.
+ pkgs.mkShell is a special kind of derivation that is only useful when using it combined with nix-shell. It will in fact fail to instantiate when invoked with nix-build.
diff --git a/doc/builders/trivial-builders.xml b/doc/builders/trivial-builders.xml
new file mode 100644
index 0000000000000000000000000000000000000000..94948c57b91f9efd910292521494f609516c449b
--- /dev/null
+++ b/doc/builders/trivial-builders.xml
@@ -0,0 +1,90 @@
+
+ Trivial builders
+
+ Nixpkgs provides a couple of functions that help with building derivations. The most important one, stdenv.mkDerivation, has already been documented above. The following functions wrap stdenv.mkDerivation, making it easier to use in certain cases.
+
+
+
+
+ runCommand
+
+
+
+ This takes three arguments, name, env, and buildCommand. name is just the name that Nix will append to the store path in the same way that stdenv.mkDerivation uses its name attribute. env is an attribute set specifying environment variables that will be set for this derivation. These attributes are then passed to the wrapped stdenv.mkDerivation. buildCommand specifies the commands that will be run to create this derivation. Note that you will need to create $out for Nix to register the command as successful.
+
+
+ An example of using runCommand is provided below.
+
+
+(import <nixpkgs> {}).runCommand "my-example" {} ''
+ echo My example command is running
+
+ mkdir $out
+
+ echo I can write data to the Nix store > $out/message
+
+ echo I can also run basic commands like:
+
+ echo ls
+ ls
+
+ echo whoami
+ whoami
+
+ echo date
+ date
+''
+
+
+
+
+
+ runCommandCC
+
+
+
+ This works just like runCommand. The only difference is that it also provides a C compiler in buildCommand’s environment. To minimize your dependencies, you should only use this if you are sure you will need a C compiler as part of running your command.
+
+
+
+
+
+ runCommandLocal
+
+
+
+ Variant of runCommand that forces the derivation to be built locally, it is not substituted. This is intended for very cheap commands (<1s execution time). It saves on the network roundrip and can speed up a build.
+
+
+ This sets allowSubstitutes to false, so only use runCommandLocal if you are certain the user will always have a builder for the system of the derivation. This should be true for most trivial use cases (e.g. just copying some files to a different location or adding symlinks), because there the system is usually the same as builtins.currentSystem.
+
+
+
+
+
+ writeTextFile, writeText, writeTextDir, writeScript, writeScriptBin
+
+
+
+ These functions write text to the Nix store. This is useful for creating scripts from Nix expressions. writeTextFile takes an attribute set and expects two arguments, name and text. name corresponds to the name used in the Nix store path. text will be the contents of the file. You can also set executable to true to make this file have the executable bit set.
+
+
+ Many more commands wrap writeTextFile including writeText, writeTextDir, writeScript, and writeScriptBin. These are convenience functions over writeTextFile.
+
+
+
+
+
+ symlinkJoin
+
+
+
+ This can be used to put many derivations into the same directory structure. It works by creating a new derivation and adding symlinks to each of the paths listed. It expects two arguments, name, and paths. name is the name used in the Nix store path for the created derivation. paths is a list of paths that will be symlinked. These paths can be to Nix store derivations or any other subdirectory contained within.
+
+
+
+
+
diff --git a/doc/coding-conventions.xml b/doc/contributing/coding-conventions.xml
similarity index 64%
rename from doc/coding-conventions.xml
rename to doc/contributing/coding-conventions.xml
index 48356247a49e1bf07d86462998eec4293b944745..fcb6501f6159915653a7281fe53d298cd0380081 100644
--- a/doc/coding-conventions.xml
+++ b/doc/contributing/coding-conventions.xml
@@ -8,24 +8,17 @@
- Use 2 spaces of indentation per indentation level in Nix expressions, 4
- spaces in shell scripts.
+ Use 2 spaces of indentation per indentation level in Nix expressions, 4 spaces in shell scripts.
- Do not use tab characters, i.e. configure your editor to use soft tabs.
- For instance, use (setq-default indent-tabs-mode nil)
- in Emacs. Everybody has different tab settings so it’s asking for
- trouble.
+ Do not use tab characters, i.e. configure your editor to use soft tabs. For instance, use (setq-default indent-tabs-mode nil) in Emacs. Everybody has different tab settings so it’s asking for trouble.
- Use lowerCamelCase for variable names, not
- UpperCamelCase. Note, this rule does not apply to
- package attribute names, which instead follow the rules in
- .
+ Use lowerCamelCase for variable names, not UpperCamelCase. Note, this rule does not apply to package attribute names, which instead follow the rules in .
@@ -52,8 +45,7 @@ foo { arg = ...; }
- In attribute sets or lists that span multiple lines, the attribute names
- or list elements should be aligned:
+ In attribute sets or lists that span multiple lines, the attribute names or list elements should be aligned:
# A long list.
list = [
@@ -97,8 +89,7 @@ attrs = { x = 1280; y = 1024; };
- Breaking in the middle of a function argument can give hard-to-read code,
- like
+ Breaking in the middle of a function argument can give hard-to-read code, like
someFunction { x = 1280;
y = 1024; } otherArg
@@ -123,8 +114,7 @@ in someFunction res otherArg yetAnotherArg
- The bodies of functions, asserts, and withs are not indented to prevent a
- lot of superfluous indentation levels, i.e.
+ The bodies of functions, asserts, and withs are not indented to prevent a lot of superfluous indentation levels, i.e.
{ arg1, arg2 }:
assert system == "i686-linux";
@@ -156,8 +146,7 @@ stdenv.mkDerivation { ...
- Functions should list their expected arguments as precisely as possible.
- That is, write
+ Functions should list their expected arguments as precisely as possible. That is, write
{ stdenv, fetchurl, perl }: ...
@@ -171,9 +160,7 @@ args: with args; ...
- For functions that are truly generic in the number of arguments (such as
- wrappers around mkDerivation) that have some required
- arguments, you should write them using an @-pattern:
+ For functions that are truly generic in the number of arguments (such as wrappers around mkDerivation) that have some required arguments, you should write them using an @-pattern:
{ stdenv, doCoverageAnalysis ? false, ... } @ args:
@@ -197,35 +184,20 @@ args.stdenv.mkDerivation (args // {
Package naming
- The key words must, must not,
- required, shall, shall
- not, should, should
- not, recommended, may,
- and optional in this section are to be interpreted as
- described in RFC
- 2119. Only emphasized words are to be
- interpreted in this way.
+ The key words must, must not, required, shall, shall not, should, should not, recommended, may, and optional in this section are to be interpreted as described in RFC 2119. Only emphasized words are to be interpreted in this way.
- In Nixpkgs, there are generally three different names associated with a
- package:
+ In Nixpkgs, there are generally three different names associated with a package:
- The name attribute of the derivation (excluding the
- version part). This is what most users see, in particular when using
- nix-env.
+ The name attribute of the derivation (excluding the version part). This is what most users see, in particular when using nix-env.
- The variable name used for the instantiated package in
- all-packages.nix, and when passing it as a
- dependency to other functions. Typically this is called the
- package attribute name. This is what Nix expression
- authors see. It can also be used when installing using nix-env
- -iA.
+ The variable name used for the instantiated package in all-packages.nix, and when passing it as a dependency to other functions. Typically this is called the package attribute name. This is what Nix expression authors see. It can also be used when installing using nix-env -iA.
@@ -234,12 +206,7 @@ args.stdenv.mkDerivation (args // {
- Most of the time, these are the same. For instance, the package
- e2fsprogs has a name attribute
- "e2fsprogs-version", is bound
- to the variable name e2fsprogs in
- all-packages.nix, and the Nix expression is in
- pkgs/os-specific/linux/e2fsprogs/default.nix.
+ Most of the time, these are the same. For instance, the package e2fsprogs has a name attribute "e2fsprogs-version", is bound to the variable name e2fsprogs in all-packages.nix, and the Nix expression is in pkgs/os-specific/linux/e2fsprogs/default.nix.
@@ -247,51 +214,32 @@ args.stdenv.mkDerivation (args // {
- The name attribute should be
- identical to the upstream package name.
+ The name attribute should be identical to the upstream package name.
- The name attribute must not
- contain uppercase letters — e.g., "mplayer-1.0rc2"
- instead of "MPlayer-1.0rc2".
+ The name attribute must not contain uppercase letters — e.g., "mplayer-1.0rc2" instead of "MPlayer-1.0rc2".
- The version part of the name attribute
- must start with a digit (following a dash) — e.g.,
- "hello-0.3.1rc2".
+ The version part of the name attribute must start with a digit (following a dash) — e.g., "hello-0.3.1rc2".
- If a package is not a release but a commit from a repository, then the
- version part of the name must be the date of that
- (fetched) commit. The date must be in
- "YYYY-MM-DD" format. Also append
- "unstable" to the name - e.g.,
- "pkgname-unstable-2014-09-23".
+ If a package is not a release but a commit from a repository, then the version part of the name must be the date of that (fetched) commit. The date must be in "YYYY-MM-DD" format. Also append "unstable" to the name - e.g., "pkgname-unstable-2014-09-23".
- Dashes in the package name should be preserved in
- new variable names, rather than converted to underscores or camel cased
- — e.g., http-parser instead of
- http_parser or httpParser. The
- hyphenated style is preferred in all three package names.
+ Dashes in the package name should be preserved in new variable names, rather than converted to underscores or camel cased — e.g., http-parser instead of http_parser or httpParser. The hyphenated style is preferred in all three package names.
- If there are multiple versions of a package, this
- should be reflected in the variable names in
- all-packages.nix, e.g. json-c-0-9
- and json-c-0-11. If there is an obvious “default”
- version, make an attribute like json-c = json-c-0-9;.
- See also
+ If there are multiple versions of a package, this should be reflected in the variable names in all-packages.nix, e.g. json-c-0-9 and json-c-0-11. If there is an obvious “default” version, make an attribute like json-c = json-c-0-9;. See also
@@ -301,31 +249,18 @@ args.stdenv.mkDerivation (args // {
File naming and organisation
- Names of files and directories should be in lowercase, with dashes between
- words — not in camel case. For instance, it should be
- all-packages.nix, not
- allPackages.nix or
- AllPackages.nix.
+ Names of files and directories should be in lowercase, with dashes between words — not in camel case. For instance, it should be all-packages.nix, not allPackages.nix or AllPackages.nix.
Hierarchy
- Each package should be stored in its own directory somewhere in the
- pkgs/ tree, i.e. in
- pkgs/category/subcategory/.../pkgname.
- Below are some rules for picking the right category for a package. Many
- packages fall under several categories; what matters is the
- primary purpose of a package. For example, the
- libxml2 package builds both a library and some tools;
- but it’s a library foremost, so it goes under
- pkgs/development/libraries.
+ Each package should be stored in its own directory somewhere in the pkgs/ tree, i.e. in pkgs/category/subcategory/.../pkgname. Below are some rules for picking the right category for a package. Many packages fall under several categories; what matters is the primary purpose of a package. For example, the libxml2 package builds both a library and some tools; but it’s a library foremost, so it goes under pkgs/development/libraries.
- When in doubt, consider refactoring the pkgs/ tree,
- e.g. creating new categories or splitting up an existing category.
+ When in doubt, consider refactoring the pkgs/ tree, e.g. creating new categories or splitting up an existing category.
@@ -341,8 +276,7 @@ args.stdenv.mkDerivation (args // {
- development/libraries (e.g.
- libxml2)
+ development/libraries (e.g. libxml2)
@@ -352,8 +286,7 @@ args.stdenv.mkDerivation (args // {
- development/compilers (e.g.
- gcc)
+ development/compilers (e.g. gcc)
@@ -363,8 +296,7 @@ args.stdenv.mkDerivation (args // {
- development/interpreters (e.g.
- guile)
+ development/interpreters (e.g. guile)
@@ -380,8 +312,7 @@ args.stdenv.mkDerivation (args // {
- development/tools/parsing (e.g.
- bison, flex)
+ development/tools/parsing (e.g. bison, flex)
@@ -391,8 +322,7 @@ args.stdenv.mkDerivation (args // {
- development/tools/build-managers (e.g.
- gnumake)
+ development/tools/build-managers (e.g. gnumake)
@@ -402,8 +332,7 @@ args.stdenv.mkDerivation (args // {
- development/tools/misc (e.g.
- binutils)
+ development/tools/misc (e.g. binutils)
@@ -429,8 +358,7 @@ args.stdenv.mkDerivation (args // {
- (A tool is a relatively small program, especially one intended to be
- used non-interactively.)
+ (A tool is a relatively small program, especially one intended to be used non-interactively.)
@@ -439,8 +367,7 @@ args.stdenv.mkDerivation (args // {
- tools/networking (e.g.
- wget)
+ tools/networking (e.g. wget)
@@ -470,8 +397,7 @@ args.stdenv.mkDerivation (args // {
- tools/archivers (e.g. zip,
- tar)
+ tools/archivers (e.g. zip, tar)
@@ -481,8 +407,7 @@ args.stdenv.mkDerivation (args // {
- tools/compression (e.g.
- gzip, bzip2)
+ tools/compression (e.g. gzip, bzip2)
@@ -492,8 +417,7 @@ args.stdenv.mkDerivation (args // {
- tools/security (e.g. nmap,
- gnupg)
+ tools/security (e.g. nmap, gnupg)
@@ -532,8 +456,7 @@ args.stdenv.mkDerivation (args // {
- servers/http (e.g.
- apache-httpd)
+ servers/http (e.g. apache-httpd)
@@ -543,8 +466,7 @@ args.stdenv.mkDerivation (args // {
- servers/x11 (e.g. xorg —
- this includes the client libraries and programs)
+ servers/x11 (e.g. xorg — this includes the client libraries and programs)
@@ -567,8 +489,7 @@ args.stdenv.mkDerivation (args // {
- desktops (e.g. kde,
- gnome, enlightenment)
+ desktops (e.g. kde, gnome, enlightenment)
@@ -578,8 +499,7 @@ args.stdenv.mkDerivation (args // {
- applications/window-managers (e.g.
- awesome, stumpwm)
+ applications/window-managers (e.g. awesome, stumpwm)
@@ -589,8 +509,7 @@ args.stdenv.mkDerivation (args // {
- A (typically large) program with a distinct user interface, primarily
- used interactively.
+ A (typically large) program with a distinct user interface, primarily used interactively.
@@ -599,8 +518,7 @@ args.stdenv.mkDerivation (args // {
- applications/version-management (e.g.
- subversion)
+ applications/version-management (e.g. subversion)
@@ -610,8 +528,7 @@ args.stdenv.mkDerivation (args // {
- applications/video (e.g.
- vlc)
+ applications/video (e.g. vlc)
@@ -621,8 +538,7 @@ args.stdenv.mkDerivation (args // {
- applications/graphics (e.g.
- gimp)
+ applications/graphics (e.g. gimp)
@@ -638,8 +554,7 @@ args.stdenv.mkDerivation (args // {
- applications/networking/mailreaders (e.g.
- thunderbird)
+ applications/networking/mailreaders (e.g. thunderbird)
@@ -649,8 +564,7 @@ args.stdenv.mkDerivation (args // {
- applications/networking/newsreaders (e.g.
- pan)
+ applications/networking/newsreaders (e.g. pan)
@@ -660,8 +574,7 @@ args.stdenv.mkDerivation (args // {
- applications/networking/browsers (e.g.
- firefox)
+ applications/networking/browsers (e.g. firefox)
@@ -707,6 +620,16 @@ args.stdenv.mkDerivation (args // {
+
+
+ If it’s an icon theme:
+
+
+
+ data/icons
+
+
+
If it’s related to SGML/XML processing:
@@ -719,8 +642,7 @@ args.stdenv.mkDerivation (args // {
- data/sgml+xml/schemas/xml-dtd (e.g.
- docbook)
+ data/sgml+xml/schemas/xml-dtd (e.g. docbook)
@@ -733,14 +655,24 @@ args.stdenv.mkDerivation (args // {
(Okay, these are executable...)
- data/sgml+xml/stylesheets/xslt (e.g.
- docbook-xsl)
+ data/sgml+xml/stylesheets/xslt (e.g. docbook-xsl)
+
+
+ If it’s a theme for a desktop environment,
+ a window manager or a display manager:
+
+
+
+ data/themes
+
+
+
@@ -771,36 +703,15 @@ args.stdenv.mkDerivation (args // {
Versioning
- Because every version of a package in Nixpkgs creates a potential
- maintenance burden, old versions of a package should not be kept unless
- there is a good reason to do so. For instance, Nixpkgs contains several
- versions of GCC because other packages don’t build with the latest
- version of GCC. Other examples are having both the latest stable and latest
- pre-release version of a package, or to keep several major releases of an
- application that differ significantly in functionality.
+ Because every version of a package in Nixpkgs creates a potential maintenance burden, old versions of a package should not be kept unless there is a good reason to do so. For instance, Nixpkgs contains several versions of GCC because other packages don’t build with the latest version of GCC. Other examples are having both the latest stable and latest pre-release version of a package, or to keep several major releases of an application that differ significantly in functionality.
- If there is only one version of a package, its Nix expression should be
- named e2fsprogs/default.nix. If there are multiple
- versions, this should be reflected in the filename, e.g.
- e2fsprogs/1.41.8.nix and
- e2fsprogs/1.41.9.nix. The version in the filename
- should leave out unnecessary detail. For instance, if we keep the latest
- Firefox 2.0.x and 3.5.x versions in Nixpkgs, they should be named
- firefox/2.0.nix and
- firefox/3.5.nix, respectively (which, at a given
- point, might contain versions 2.0.0.20 and
- 3.5.4). If a version requires many auxiliary files, you
- can use a subdirectory for each version, e.g.
- firefox/2.0/default.nix and
- firefox/3.5/default.nix.
+ If there is only one version of a package, its Nix expression should be named e2fsprogs/default.nix. If there are multiple versions, this should be reflected in the filename, e.g. e2fsprogs/1.41.8.nix and e2fsprogs/1.41.9.nix. The version in the filename should leave out unnecessary detail. For instance, if we keep the latest Firefox 2.0.x and 3.5.x versions in Nixpkgs, they should be named firefox/2.0.nix and firefox/3.5.nix, respectively (which, at a given point, might contain versions 2.0.0.20 and 3.5.4). If a version requires many auxiliary files, you can use a subdirectory for each version, e.g. firefox/2.0/default.nix and firefox/3.5/default.nix.
- All versions of a package must be included in
- all-packages.nix to make sure that they evaluate
- correctly.
+ All versions of a package must be included in all-packages.nix to make sure that they evaluate correctly.
@@ -808,25 +719,15 @@ args.stdenv.mkDerivation (args // {
Fetching Sources
- There are multiple ways to fetch a package source in nixpkgs. The general
- guideline is that you should package reproducible sources with a high degree
- of availability. Right now there is only one fetcher which has mirroring
- support and that is fetchurl. Note that you should also
- prefer protocols which have a corresponding proxy environment variable.
+ There are multiple ways to fetch a package source in nixpkgs. The general guideline is that you should package reproducible sources with a high degree of availability. Right now there is only one fetcher which has mirroring support and that is fetchurl. Note that you should also prefer protocols which have a corresponding proxy environment variable.
- You can find many source fetch helpers in
- pkgs/build-support/fetch*.
+ You can find many source fetch helpers in pkgs/build-support/fetch*.
- In the file pkgs/top-level/all-packages.nix you can find
- fetch helpers, these have names on the form fetchFrom*.
- The intention of these are to provide snapshot fetches but using the same
- api as some of the version controlled fetchers from
- pkgs/build-support/. As an example going from bad to
- good:
+ In the file pkgs/top-level/all-packages.nix you can find fetch helpers, these have names on the form fetchFrom*. The intention of these are to provide snapshot fetches but using the same api as some of the version controlled fetchers from pkgs/build-support/. As an example going from bad to good:
@@ -863,11 +764,7 @@ src = fetchFromGitHub {
sha256 = "1i2yxndxb6yc9l6c99pypbd92lfq5aac4klq7y2v93c9qvx2cgpc";
}
- Find the value to put as sha256 by running
- nix run -f '<nixpkgs>' nix-prefetch-github -c
- nix-prefetch-github --rev 1f795f9f44607cc5bec70d1300150bfefcef2aae NixOS
- nix or nix-prefetch-url --unpack
- https://github.com/NixOS/nix/archive/1f795f9f44607cc5bec70d1300150bfefcef2aae.tar.gz.
+ Find the value to put as sha256 by running nix run -f '<nixpkgs>' nix-prefetch-github -c nix-prefetch-github --rev 1f795f9f44607cc5bec70d1300150bfefcef2aae NixOS nix or nix-prefetch-url --unpack https://github.com/NixOS/nix/archive/1f795f9f44607cc5bec70d1300150bfefcef2aae.tar.gz.
@@ -883,40 +780,23 @@ src = fetchFromGitHub {
- Prefetch URL (with nix-prefetch-XXX
- URL, where
- XXX is one of url,
- git, hg, cvs,
- bzr, svn). Hash is printed to
- stdout.
+ Prefetch URL (with nix-prefetch-XXXURL, where XXX is one of url, git, hg, cvs, bzr, svn). Hash is printed to stdout.
- Prefetch by package source (with nix-prefetch-url
- '<nixpkgs>' -A PACKAGE.src,
- where PACKAGE is package attribute name). Hash
- is printed to stdout.
+ Prefetch by package source (with nix-prefetch-url '<nixpkgs>' -A PACKAGE.src, where PACKAGE is package attribute name). Hash is printed to stdout.
- This works well when you've upgraded existing package version and want to
- find out new hash, but is useless if package can't be accessed by
- attribute or package has multiple sources (.srcs,
- architecture-dependent sources, etc).
+ This works well when you've upgraded existing package version and want to find out new hash, but is useless if package can't be accessed by attribute or package has multiple sources (.srcs, architecture-dependent sources, etc).
- Upstream provided hash: use it when upstream provides
- sha256 or sha512 (when upstream
- provides md5, don't use it, compute
- sha256 instead).
+ Upstream provided hash: use it when upstream provides sha256 or sha512 (when upstream provides md5, don't use it, compute sha256 instead).
- A little nuance is that nix-prefetch-* tools produce
- hash encoded with base32, but upstream usually provides
- hexadecimal (base16) encoding. Fetchers understand both
- formats. Nixpkgs does not standardize on any one format.
+ A little nuance is that nix-prefetch-* tools produce hash encoded with base32, but upstream usually provides hexadecimal (base16) encoding. Fetchers understand both formats. Nixpkgs does not standardize on any one format.
You can convert between formats with nix-hash, for example:
@@ -927,28 +807,18 @@ src = fetchFromGitHub {
- Extracting hash from local source tarball can be done with
- sha256sum. Use nix-prefetch-url
- file:///path/to/tarball if you want base32 hash.
+ Extracting hash from local source tarball can be done with sha256sum. Use nix-prefetch-url file:///path/to/tarball if you want base32 hash.
- Fake hash: set fake hash in package expression, perform build and extract
- correct hash from error Nix prints.
+ Fake hash: set fake hash in package expression, perform build and extract correct hash from error Nix prints.
- For package updates it is enough to change one symbol to make hash fake.
- For new packages, you can use lib.fakeSha256,
- lib.fakeSha512 or any other fake hash.
+ For package updates it is enough to change one symbol to make hash fake. For new packages, you can use lib.fakeSha256, lib.fakeSha512 or any other fake hash.
- This is last resort method when reconstructing source URL is non-trivial
- and nix-prefetch-url -A isn't applicable (for example,
-
- one of kodi dependencies). The easiest way then
- would be replace hash with a fake one and rebuild. Nix build will fail and
- error message will contain desired hash.
+ This is last resort method when reconstructing source URL is non-trivial and nix-prefetch-url -A isn't applicable (for example, one of kodi dependencies). The easiest way then would be replace hash with a fake one and rebuild. Nix build will fail and error message will contain desired hash.
@@ -962,9 +832,7 @@ src = fetchFromGitHub {
Obtaining hashes securely
- Let's say Man-in-the-Middle (MITM) sits close to your network. Then instead
- of fetching source you can fetch malware, and instead of source hash you
- get hash of malware. Here are security considerations for this scenario:
+ Let's say Man-in-the-Middle (MITM) sits close to your network. Then instead of fetching source you can fetch malware, and instead of source hash you get hash of malware. Here are security considerations for this scenario:
@@ -975,8 +843,7 @@ src = fetchFromGitHub {
- hashes from upstream (in method 3) should be obtained via secure
- protocol;
+ hashes from upstream (in method 3) should be obtained via secure protocol;
@@ -986,12 +853,7 @@ src = fetchFromGitHub {
- https:// URLs are not secure in method 5. When
- obtaining hashes with fake hash method, TLS checks are disabled. So
- refetch source hash from several different networks to exclude MITM
- scenario. Alternatively, use fake hash method to make Nix error, but
- instead of extracting hash from error, extract
- https:// URL and prefetch it with method 1.
+ https:// URLs are not secure in method 5. When obtaining hashes with fake hash method, TLS checks are disabled. So refetch source hash from several different networks to exclude MITM scenario. Alternatively, use fake hash method to make Nix error, but instead of extracting hash from error, extract https:// URL and prefetch it with method 1.
@@ -1001,8 +863,7 @@ src = fetchFromGitHub {
Patches
- Patches available online should be retrieved using
- fetchpatch.
+ Patches available online should be retrieved using fetchpatch.
@@ -1018,10 +879,7 @@ patches = [
- Otherwise, you can add a .patch file to the
- nixpkgs repository. In the interest of keeping our
- maintenance burden to a minimum, only patches that are unique to
- nixpkgs should be added in this way.
+ Otherwise, you can add a .patch file to the nixpkgs repository. In the interest of keeping our maintenance burden to a minimum, only patches that are unique to nixpkgs should be added in this way.
@@ -1031,8 +889,7 @@ patches = [ ./0001-changes.patch ];
- If you do need to do create this sort of patch file, one way to do so is
- with git:
+ If you do need to do create this sort of patch file, one way to do so is with git:
@@ -1043,8 +900,7 @@ patches = [ ./0001-changes.patch ];
- If a git repository is not already present, create one and stage all of
- the source files.
+ If a git repository is not already present, create one and stage all of the source files.
$ git init
$ git add .
@@ -1052,8 +908,7 @@ patches = [ ./0001-changes.patch ];
- Edit some files to make whatever changes need to be included in the
- patch.
+ Edit some files to make whatever changes need to be included in the patch.
diff --git a/doc/contributing.xml b/doc/contributing/contributing-to-documentation.xml
similarity index 71%
rename from doc/contributing.xml
rename to doc/contributing/contributing-to-documentation.xml
index 523c1c9c8f03030e76ba0971c584b561114a90ac..b0266043775fbb8fa467a7f66355fa695357f514 100644
--- a/doc/contributing.xml
+++ b/doc/contributing/contributing-to-documentation.xml
@@ -3,10 +3,8 @@
xml:id="chap-contributing">
Contributing to this documentation
- The DocBook sources of the Nixpkgs manual are in the
- doc
- subdirectory of the Nixpkgs repository.
+ The DocBook sources of the Nixpkgs manual are in the doc subdirectory of the Nixpkgs repository.
You can quickly check your edits with make:
@@ -17,19 +15,16 @@ xlink:href="https://github.com/NixOS/nixpkgs/tree/master/doc">doc
[nix-shell]$ make
- If you experience problems, run make debug to help
- understand the docbook errors.
+ If you experience problems, run make debug to help understand the docbook errors.
- After making modifications to the manual, it's important to build it before
- committing. You can do that as follows:
+ After making modifications to the manual, it's important to build it before committing. You can do that as follows:
$ cd /path/to/nixpkgs/doc
$ nix-shell
[nix-shell]$ make clean
[nix-shell]$ nix-build .
- If the build succeeds, the manual will be in
- ./result/share/doc/nixpkgs/manual.html.
+ If the build succeeds, the manual will be in ./result/share/doc/nixpkgs/manual.html.
diff --git a/doc/quick-start.xml b/doc/contributing/quick-start.xml
similarity index 52%
rename from doc/quick-start.xml
rename to doc/contributing/quick-start.xml
index 292d66864a4c1d073f7186b16996eaeae0b3f377..80514cba49043c7271e02ae6816d1b8a1bb44e12 100644
--- a/doc/quick-start.xml
+++ b/doc/contributing/quick-start.xml
@@ -15,120 +15,75 @@
- Find a good place in the Nixpkgs tree to add the Nix expression for your
- package. For instance, a library package typically goes into
- pkgs/development/libraries/pkgname,
- while a web browser goes into
- pkgs/applications/networking/browsers/pkgname.
- See for some hints on the tree
- organisation. Create a directory for your package, e.g.
+ Find a good place in the Nixpkgs tree to add the Nix expression for your package. For instance, a library package typically goes into pkgs/development/libraries/pkgname, while a web browser goes into pkgs/applications/networking/browsers/pkgname. See for some hints on the tree organisation. Create a directory for your package, e.g.
$ mkdir pkgs/development/libraries/libfoo
- In the package directory, create a Nix expression — a piece of code that
- describes how to build the package. In this case, it should be a
- function that is called with the package dependencies
- as arguments, and returns a build of the package in the Nix store. The
- expression should usually be called default.nix.
+ In the package directory, create a Nix expression — a piece of code that describes how to build the package. In this case, it should be a function that is called with the package dependencies as arguments, and returns a build of the package in the Nix store. The expression should usually be called default.nix.
$ emacs pkgs/development/libraries/libfoo/default.nix
$ git add pkgs/development/libraries/libfoo/default.nix
- You can have a look at the existing Nix expressions under
- pkgs/ to see how it’s done. Here are some good
- ones:
+ You can have a look at the existing Nix expressions under pkgs/ to see how it’s done. Here are some good ones:
- GNU Hello:
- pkgs/applications/misc/hello/default.nix.
- Trivial package, which specifies some meta
- attributes which is good practice.
+ GNU Hello: pkgs/applications/misc/hello/default.nix. Trivial package, which specifies some meta attributes which is good practice.
- GNU cpio:
- pkgs/tools/archivers/cpio/default.nix.
- Also a simple package. The generic builder in stdenv
- does everything for you. It has no dependencies beyond
- stdenv.
+ GNU cpio: pkgs/tools/archivers/cpio/default.nix. Also a simple package. The generic builder in stdenv does everything for you. It has no dependencies beyond stdenv.
- GNU Multiple Precision arithmetic library (GMP):
- pkgs/development/libraries/gmp/5.1.x.nix.
- Also done by the generic builder, but has a dependency on
- m4.
+ GNU Multiple Precision arithmetic library (GMP): pkgs/development/libraries/gmp/5.1.x.nix. Also done by the generic builder, but has a dependency on m4.
- Pan, a GTK-based newsreader:
- pkgs/applications/networking/newsreaders/pan/default.nix.
- Has an optional dependency on gtkspell, which is
- only built if spellCheck is true.
+ Pan, a GTK-based newsreader: pkgs/applications/networking/newsreaders/pan/default.nix. Has an optional dependency on gtkspell, which is only built if spellCheck is true.
- Apache HTTPD:
- pkgs/servers/http/apache-httpd/2.4.nix.
- A bunch of optional features, variable substitutions in the configure
- flags, a post-install hook, and miscellaneous hackery.
+ Apache HTTPD: pkgs/servers/http/apache-httpd/2.4.nix. A bunch of optional features, variable substitutions in the configure flags, a post-install hook, and miscellaneous hackery.
- Thunderbird:
- pkgs/applications/networking/mailreaders/thunderbird/default.nix.
- Lots of dependencies.
+ Thunderbird: pkgs/applications/networking/mailreaders/thunderbird/default.nix. Lots of dependencies.
- JDiskReport, a Java utility:
- pkgs/tools/misc/jdiskreport/default.nix
- (and the
- builder).
- Nixpkgs doesn’t have a decent stdenv for Java yet
- so this is pretty ad-hoc.
+ JDiskReport, a Java utility: pkgs/tools/misc/jdiskreport/default.nix (and the builder). Nixpkgs doesn’t have a decent stdenv for Java yet so this is pretty ad-hoc.
- XML::Simple, a Perl module:
- pkgs/top-level/perl-packages.nix
- (search for the XMLSimple attribute). Most Perl
- modules are so simple to build that they are defined directly in
- perl-packages.nix; no need to make a separate file
- for them.
+ XML::Simple, a Perl module: pkgs/top-level/perl-packages.nix (search for the XMLSimple attribute). Most Perl modules are so simple to build that they are defined directly in perl-packages.nix; no need to make a separate file for them.
- Adobe Reader:
- pkgs/applications/misc/adobe-reader/default.nix.
- Shows how binary-only packages can be supported. In particular the
- builder
- uses patchelf to set the RUNPATH and ELF interpreter
- of the executables so that the right libraries are found at runtime.
+ Adobe Reader: pkgs/applications/misc/adobe-reader/default.nix. Shows how binary-only packages can be supported. In particular the builder uses patchelf to set the RUNPATH and ELF interpreter of the executables so that the right libraries are found at runtime.
@@ -138,67 +93,45 @@
- All meta attributes are
- optional, but it’s still a good idea to provide at least the
- description, homepage and
- meta attributes are optional, but it’s still a good idea to provide at least the description, homepage and license.
- You can use nix-prefetch-url
- url to get the SHA-256 hash of source
- distributions. There are similar commands as
- nix-prefetch-git and
- nix-prefetch-hg available in
- nix-prefetch-scripts package.
+ You can use nix-prefetch-urlurl to get the SHA-256 hash of source distributions. There are similar commands as nix-prefetch-git and nix-prefetch-hg available in nix-prefetch-scripts package.
- A list of schemes for mirror:// URLs can be found in
- mirror:// URLs can be found in pkgs/build-support/fetchurl/mirrors.nix.
- The exact syntax and semantics of the Nix expression language, including
- the built-in function, are described in the Nix manual in the
- chapter
- on writing Nix expressions.
+ The exact syntax and semantics of the Nix expression language, including the built-in function, are described in the Nix manual in the chapter on writing Nix expressions.
- Add a call to the function defined in the previous step to
- pkgs/top-level/all-packages.nix
- with some descriptive name for the variable, e.g.
- libfoo.
+ Add a call to the function defined in the previous step to pkgs/top-level/all-packages.nix with some descriptive name for the variable, e.g. libfoo.
$ emacs pkgs/top-level/all-packages.nix
- The attributes in that file are sorted by category (like “Development /
- Libraries”) that more-or-less correspond to the directory structure of
- Nixpkgs, and then by attribute name.
+ The attributes in that file are sorted by category (like “Development / Libraries”) that more-or-less correspond to the directory structure of Nixpkgs, and then by attribute name.
- To test whether the package builds, run the following command from the
- root of the nixpkgs source tree:
+ To test whether the package builds, run the following command from the root of the nixpkgs source tree:
$ nix-build -A libfoo
- where libfoo should be the variable name defined in the
- previous step. You may want to add the flag to keep
- the temporary build directory in case something fails. If the build
- succeeds, a symlink ./result to the package in the
- Nix store is created.
+ where libfoo should be the variable name defined in the previous step. You may want to add the flag to keep the temporary build directory in case something fails. If the build succeeds, a symlink ./result to the package in the Nix store is created.
@@ -211,11 +144,8 @@
Optionally commit the new package and open a pull request to nixpkgs, or
- use
- the Patches category on Discourse for sending a patch without a
- GitHub account.
+ xlink:href="https://github.com/NixOS/nixpkgs/pulls">to nixpkgs, or use the Patches category on Discourse for sending a patch without a GitHub account.
diff --git a/doc/reviewing-contributions.xml b/doc/contributing/reviewing-contributions.xml
similarity index 70%
rename from doc/reviewing-contributions.xml
rename to doc/contributing/reviewing-contributions.xml
index 5aa950625efa55cf350508c44d4f07fdbe889872..fe79d8d992b14689bf133ad747809ea9f69110e4 100644
--- a/doc/reviewing-contributions.xml
+++ b/doc/contributing/reviewing-contributions.xml
@@ -2,72 +2,44 @@
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
- xml:id="sec-reviewing-contributions">
+ xml:id="chap-reviewing-contributions">
Reviewing contributions
- The following section is a draft, and the policy for reviewing is still
- being discussed in issues such as
- #11166
- and
- #20836
- .
+ The following section is a draft, and the policy for reviewing is still being discussed in issues such as #11166 and #20836 .
- The Nixpkgs project receives a fairly high number of contributions via GitHub
- pull requests. Reviewing and approving these is an important task and a way
- to contribute to the project.
+ The Nixpkgs project receives a fairly high number of contributions via GitHub pull requests. Reviewing and approving these is an important task and a way to contribute to the project.
- The high change rate of Nixpkgs makes any pull request that remains open for
- too long subject to conflicts that will require extra work from the submitter
- or the merger. Reviewing pull requests in a timely manner and being
- responsive to the comments is the key to avoid this issue. GitHub provides
- sort filters that can be used to see the
- most
- recently and the
- least
- recently updated pull requests. We highly encourage looking at
-
- this list of ready to merge, unreviewed pull requests.
+ The high change rate of Nixpkgs makes any pull request that remains open for too long subject to conflicts that will require extra work from the submitter or the merger. Reviewing pull requests in a timely manner and being responsive to the comments is the key to avoid this issue. GitHub provides sort filters that can be used to see the most recently and the least recently updated pull requests. We highly encourage looking at this list of ready to merge, unreviewed pull requests.
- When reviewing a pull request, please always be nice and polite.
- Controversial changes can lead to controversial opinions, but it is important
- to respect every community member and their work.
+ When reviewing a pull request, please always be nice and polite. Controversial changes can lead to controversial opinions, but it is important to respect every community member and their work.
- GitHub provides reactions as a simple and quick way to provide feedback to
- pull requests or any comments. The thumb-down reaction should be used with
- care and if possible accompanied with some explanation so the submitter has
- directions to improve their contribution.
+ GitHub provides reactions as a simple and quick way to provide feedback to pull requests or any comments. The thumb-down reaction should be used with care and if possible accompanied with some explanation so the submitter has directions to improve their contribution.
- pull request reviews should include a list of what has been reviewed in a
- comment, so other reviewers and mergers can know the state of the review.
+ pull request reviews should include a list of what has been reviewed in a comment, so other reviewers and mergers can know the state of the review.
- All the review template samples provided in this section are generic and
- meant as examples. Their usage is optional and the reviewer is free to adapt
- them to their liking.
+ All the review template samples provided in this section are generic and meant as examples. Their usage is optional and the reviewer is free to adapt them to their liking.
Package updates
- A package update is the most trivial and common type of pull request. These
- pull requests mainly consist of updating the version part of the package
- name and the source hash.
+ A package update is the most trivial and common type of pull request. These pull requests mainly consist of updating the version part of the package name and the source hash.
- It can happen that non-trivial updates include patches or more complex
- changes.
+ It can happen that non-trivial updates include patches or more complex changes.
@@ -82,8 +54,7 @@
- 8.has: package (update) and any topic label that fit
- the updated package.
+ 8.has: package (update) and any topic label that fit the updated package.
@@ -105,9 +76,7 @@
- CODEOWNERS
- will make GitHub notify users based on the submitted changes, but it can
- happen that it misses some of the package maintainers.
+ CODEOWNERS will make GitHub notify users based on the submitted changes, but it can happen that it misses some of the package maintainers.
@@ -119,15 +88,12 @@
- License can change with version updates, so it should be checked to
- match the upstream license.
+ License can change with version updates, so it should be checked to match the upstream license.
- If the package has no maintainer, a maintainer must be set. This can be
- the update submitter or a community member that accepts to take
- maintainership of the package.
+ If the package has no maintainer, a maintainer must be set. This can be the update submitter or a community member that accepts to take maintainership of the package.
@@ -144,29 +110,17 @@
- pull requests are often targeted to the master or staging branch, and
- building the pull request locally when it is submitted can trigger many
- source builds.
+ pull requests are often targeted to the master or staging branch, and building the pull request locally when it is submitted can trigger many source builds.
- It is possible to rebase the changes on nixos-unstable or
- nixpkgs-unstable for easier review by running the following commands
- from a nixpkgs clone.
+ It is possible to rebase the changes on nixos-unstable or nixpkgs-unstable for easier review by running the following commands from a nixpkgs clone.
-$ git remote add channels https://github.com/NixOS/nixpkgs-channels.git
-$ git fetch channels nixos-unstable
+$ git fetch origin nixos-unstable $ git fetch origin pull/PRNUMBER/head $ git rebase --onto nixos-unstable BASEBRANCH FETCH_HEAD
-
-
- This should be done only once to be able to fetch channel branches
- from the nixpkgs-channels repository.
-
-
Fetching the nixos-unstable branch.
@@ -174,9 +128,7 @@
- Fetching the pull request changes, PRNUMBER is the
- number at the end of the pull request title and
- BASEBRANCH the base branch of the pull request.
+ Fetching the pull request changes, PRNUMBER is the number at the end of the pull request title and BASEBRANCH the base branch of the pull request.
@@ -189,15 +141,10 @@
- The
- nix-review
- tool can be used to review a pull request content in a single command.
- PRNUMBER should be replaced by the number at the end
- of the pull request title. You can also provide the full github pull
- request url.
+ The nixpkgs-review tool can be used to review a pull request content in a single command. PRNUMBER should be replaced by the number at the end of the pull request title. You can also provide the full github pull request url.
-$ nix-shell -p nix-review --run "nix-review pr PRNUMBER"
+$ nix-shell -p nixpkgs-review --run "nixpkgs-review pr PRNUMBER"
@@ -231,8 +178,7 @@
New packages
- New packages are a common type of pull requests. These pull requests
- consists in adding a new nix-expression for a package.
+ New packages are a common type of pull requests. These pull requests consists in adding a new nix-expression for a package.
@@ -247,8 +193,7 @@
- 8.has: package (new) and any topic label that fit the
- new package.
+ 8.has: package (new) and any topic label that fit the new package.
@@ -280,8 +225,7 @@
- A maintainer must be set. This can be the package submitter or a
- community member that accepts to take maintainership of the package.
+ A maintainer must be set. This can be the package submitter or a community member that accepts to take maintainership of the package.
@@ -303,8 +247,7 @@
- The most appropriate function should be used (e.g. packages from GitHub
- should use fetchFromGitHub).
+ The most appropriate function should be used (e.g. packages from GitHub should use fetchFromGitHub).
@@ -351,8 +294,7 @@
Module updates
- Module updates are submissions changing modules in some ways. These often
- contains changes to the options or introduce new options.
+ Module updates are submissions changing modules in some ways. These often contains changes to the options or introduce new options.
@@ -367,8 +309,7 @@
- 8.has: module (update) and any topic label that fit
- the module.
+ 8.has: module (update) and any topic label that fit the module.
@@ -380,9 +321,7 @@
- CODEOWNERS
- will make GitHub notify users based on the submitted changes, but it can
- happen that it misses some of the package maintainers.
+ CODEOWNERS will make GitHub notify users based on the submitted changes, but it can happen that it misses some of the package maintainers.
@@ -399,9 +338,7 @@
- Type should be appropriate (string related types differs in their
- merging capabilities, optionSet and
- string types are deprecated).
+ Type should be appropriate (string related types differs in their merging capabilities, optionSet and string types are deprecated).
@@ -418,23 +355,19 @@
- mkRenamedOptionModule and
- mkAliasOptionModule functions provide way to make
- option changes backward compatible.
+ mkRenamedOptionModule and mkAliasOptionModule functions provide way to make option changes backward compatible.
- Ensure that removed options are declared with
- mkRemovedOptionModule
+ Ensure that removed options are declared with mkRemovedOptionModule
- Ensure that changes that are not backward compatible are mentioned in
- release notes.
+ Ensure that changes that are not backward compatible are mentioned in release notes.
@@ -480,8 +413,7 @@
- 8.has: module (new) and any topic label that fit the
- module.
+ 8.has: module (new) and any topic label that fit the module.
@@ -498,9 +430,7 @@
- Type should be appropriate (string related types differs in their
- merging capabilities, optionSet and
- string types are deprecated).
+ Type should be appropriate (string related types differs in their merging capabilities, optionSet and string types are deprecated).
@@ -522,8 +452,7 @@
- Module documentation should be declared with
- meta.doc.
+ Module documentation should be declared with meta.doc.
@@ -535,8 +464,7 @@
- For example, enabling a module should not open firewall ports by
- default.
+ For example, enabling a module should not open firewall ports by default.
@@ -573,25 +501,18 @@
- If you consider having enough knowledge and experience in a topic and would
- like to be a long-term reviewer for related submissions, please contact the
- current reviewers for that topic. They will give you information about the
- reviewing process. The main reviewers for a topic can be hard to find as
- there is no list, but checking past pull requests to see who reviewed or
- git-blaming the code to see who committed to that topic can give some hints.
+ If you consider having enough knowledge and experience in a topic and would like to be a long-term reviewer for related submissions, please contact the current reviewers for that topic. They will give you information about the reviewing process. The main reviewers for a topic can be hard to find as there is no list, but checking past pull requests to see who reviewed or git-blaming the code to see who committed to that topic can give some hints.
- Container system, boot system and library changes are some examples of the
- pull requests fitting this category.
+ Container system, boot system and library changes are some examples of the pull requests fitting this category.
Merging pull requests
- It is possible for community members that have enough knowledge and
- experience on a special topic to contribute by merging pull requests.
+ It is possible for community members that have enough knowledge and experience on a special topic to contribute by merging pull requests.
@@ -608,12 +529,8 @@ policy.
-->
- In a case a contributor definitively leaves the Nix community, they should
- create an issue or post on
- Discourse with
- references of packages and modules they maintain so the maintainership can
- be taken over by other contributors.
+ In a case a contributor definitively leaves the Nix community, they should create an issue or post on Discourse with references of packages and modules they maintain so the maintainership can be taken over by other contributors.
diff --git a/doc/submitting-changes.xml b/doc/contributing/submitting-changes.xml
similarity index 55%
rename from doc/submitting-changes.xml
rename to doc/contributing/submitting-changes.xml
index a04ec08b048438f61140fed442ebad15eb69f4ee..f283ae1e68512706c9aa84b0fdf18f2efe6d0bf8 100644
--- a/doc/submitting-changes.xml
+++ b/doc/contributing/submitting-changes.xml
@@ -8,8 +8,7 @@
- Read Manual (How to
- write packages for Nix).
+ Read Manual (How to write packages for Nix).
@@ -23,15 +22,11 @@
- You can make branch from a commit of your local
- nixos-version. That will help you to avoid
- additional local compilations. Because you will receive packages from
- binary cache.
+ You can make branch from a commit of your local nixos-version. That will help you to avoid additional local compilations. Because you will receive packages from binary cache.
- For example: nixos-version returns
- 15.05.git.0998212 (Dingo). So you can do:
+ For example: nixos-version returns 15.05.git.0998212 (Dingo). So you can do:
@@ -55,9 +50,7 @@
- If you removed pkgs, made some major NixOS changes etc., write about
- them in
- nixos/doc/manual/release-notes/rl-unstable.xml.
+ If you removed pkgs, made some major NixOS changes etc., write about them in nixos/doc/manual/release-notes/rl-unstable.xml.
@@ -65,8 +58,7 @@
- Check for unnecessary whitespace with git diff --check
- before committing.
+ Check for unnecessary whitespace with git diff --check before committing.
@@ -121,8 +113,7 @@ Additional information.
- nix-env -i pkg-name -f <path to your local nixpkgs
- folder>
+ nix-env -i pkg-name -f <path to your local nixpkgs folder>
@@ -134,14 +125,12 @@ Additional information.
- Make sure it's in
- pkgs/top-level/all-packages.nix
+ Make sure it's in pkgs/top-level/all-packages.nix
- nix-env -i pkg-name -f <path to your local nixpkgs
- folder>
+ nix-env -i pkg-name -f <path to your local nixpkgs folder>
@@ -149,15 +138,11 @@ Additional information.
- If you don't want to install pkg in you
- profile.
+ If you don't want to install pkg in you profile.
- nix-build -A pkg-attribute-name <path to your local
- nixpkgs folder>/default.nix and check results in the
- folder result. It will appear in the same
- directory where you did nix-build.
+ nix-build -A pkg-attribute-name <path to your local nixpkgs folder>/default.nix and check results in the folder result. It will appear in the same directory where you did nix-build.
@@ -165,9 +150,7 @@ Additional information.
- If you did nix-env -i pkg-name you can do
- nix-env -e pkg-name to uninstall it from your
- system.
+ If you did nix-env -i pkg-name you can do nix-env -e pkg-name to uninstall it from your system.
@@ -179,10 +162,7 @@ Additional information.
- You can add new module to your NixOS configuration file (usually
- it's /etc/nixos/configuration.nix). And do
- sudo nixos-rebuild test -I nixpkgs=<path to your local
- nixpkgs folder> --fast.
+ You can add new module to your NixOS configuration file (usually it's /etc/nixos/configuration.nix). And do sudo nixos-rebuild test -I nixpkgs=<path to your local nixpkgs folder> --fast.
@@ -193,9 +173,7 @@ Additional information.
- If you have commits pkg-name: oh, forgot to insert
- whitespace: squash commits in this case. Use git rebase
- -i.
+ If you have commits pkg-name: oh, forgot to insert whitespace: squash commits in this case. Use git rebase -i.
@@ -220,8 +198,7 @@ Additional information.
- Write the title in format (pkg-name | nixos/<module>):
- improvement.
+ Write the title in format (pkg-name | nixos/<module>): improvement.
@@ -233,8 +210,7 @@ Additional information.
- Write in comment if you have tested your patch. Do not rely much on
- TravisCI.
+ Write in comment if you have tested your patch. Do not rely much on TravisCI.
@@ -244,8 +220,7 @@ Additional information.
- Notify maintainers of the package. For example add to the message:
- cc @jagajaga @domenkozar.
+ Notify maintainers of the package. For example add to the message: cc @jagajaga @domenkozar.
@@ -253,69 +228,71 @@ Additional information.
+
+ Submitting security fixes
+
+
+ Security fixes are submitted in the same way as other changes and thus the same guidelines apply.
+
+
+
+ If the security fix comes in the form of a patch and a CVE is available, then the name of the patch should be the CVE identifier, so e.g. CVE-2019-13636.patch in the case of a patch that is included in the Nixpkgs tree. If a patch is fetched the name needs to be set as well, e.g.:
+
+
+
+ (fetchpatch {
+ name = "CVE-2019-11068.patch";
+ url = "https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6.patch";
+ sha256 = "0pkpb4837km15zgg6h57bncp66d5lwrlvkr73h0lanywq7zrwhj8";
+ })
+
+
+
+ If a security fix applies to both master and a stable release then, similar to regular changes, they are preferably delivered via master first and cherry-picked to the release branch.
+
+
+
+ Critical security fixes may by-pass the staging branches and be delivered directly to release branches such as master and release-*.
+
+ Pull Request Template
- The pull request template helps determine what steps have been made for a
- contribution so far, and will help guide maintainers on the status of a
- change. The motivation section of the PR should include any extra details
- the title does not address and link any existing issues related to the pull
- request.
+ The pull request template helps determine what steps have been made for a contribution so far, and will help guide maintainers on the status of a change. The motivation section of the PR should include any extra details the title does not address and link any existing issues related to the pull request.
- When a PR is created, it will be pre-populated with some checkboxes detailed
- below:
+ When a PR is created, it will be pre-populated with some checkboxes detailed below:
Tested using sandboxing
- When sandbox builds are enabled, Nix will setup an isolated environment for
- each build process. It is used to remove further hidden dependencies set by
- the build environment to improve reproducibility. This includes access to
- the network during the build outside of fetch*
- functions and files outside the Nix store. Depending on the operating
- system access to other resources are blocked as well (ex. inter process
- communication is isolated on Linux); see
- build-use-sandbox
- in Nix manual for details.
+ When sandbox builds are enabled, Nix will setup an isolated environment for each build process. It is used to remove further hidden dependencies set by the build environment to improve reproducibility. This includes access to the network during the build outside of fetch* functions and files outside the Nix store. Depending on the operating system access to other resources are blocked as well (ex. inter process communication is isolated on Linux); see sandbox in Nix manual for details.
- Sandboxing is not enabled by default in Nix due to a small performance hit
- on each build. In pull requests for
- nixpkgs
- people are asked to test builds with sandboxing enabled (see
- Tested using sandboxing in the pull request template)
- because
- inhttps://nixos.org/hydra/
- sandboxing is also used.
+ Sandboxing is not enabled by default in Nix due to a small performance hit on each build. In pull requests for nixpkgs people are asked to test builds with sandboxing enabled (see Tested using sandboxing in the pull request template) because inhttps://nixos.org/hydra/ sandboxing is also used.
- Depending if you use NixOS or other platforms you can use one of the
- following methods to enable sandboxing
- before building the package:
+ Depending if you use NixOS or other platforms you can use one of the following methods to enable sandboxing before building the package:
- Globally enable sandboxing on NixOS:
- add the following to configuration.nix
+ Globally enable sandboxing on NixOS: add the following to configuration.nixnix.useSandbox = true;
- Globally enable sandboxing on non-NixOS
- platforms: add the following to:
- /etc/nix/nix.conf
-build-use-sandbox = true
+ Globally enable sandboxing on non-NixOS platforms: add the following to: /etc/nix/nix.conf
+sandbox = true
@@ -326,11 +303,7 @@ Additional information.
Built on platform(s)
- Many Nix packages are designed to run on multiple platforms. As such, it's
- important to let the maintainer know which platforms your changes have been
- tested on. It's not always practical to test a change on all platforms, and
- is not required for a pull request to be merged. Only check the systems you
- tested the build on in this section.
+ Many Nix packages are designed to run on multiple platforms. As such, it's important to let the maintainer know which platforms your changes have been tested on. It's not always practical to test a change on all platforms, and is not required for a pull request to be merged. Only check the systems you tested the build on in this section.
@@ -338,37 +311,31 @@ Additional information.
Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
- Packages with automated tests are much more likely to be merged in a timely
- fashion because it doesn't require as much manual testing by the maintainer
- to verify the functionality of the package. If there are existing tests for
- the package, they should be run to verify your changes do not break the
- tests. Tests only apply to packages with NixOS modules defined and can only
- be run on Linux. For more details on writing and running tests, see the
- section
- in the NixOS manual.
+ Packages with automated tests are much more likely to be merged in a timely fashion because it doesn't require as much manual testing by the maintainer to verify the functionality of the package. If there are existing tests for the package, they should be run to verify your changes do not break the tests. Tests only apply to packages with NixOS modules defined and can only be run on Linux. For more details on writing and running tests, see the section in the NixOS manual.
- Tested compilation of all pkgs that depend on this change using nix-review
+ Tested compilation of all pkgs that depend on this change using nixpkgs-review
- If you are updating a package's version, you can use nix-review to make
- sure all packages that depend on the updated package still compile
- correctly. The nix-review utility can look for and build
- all dependencies either based on uncommited changes with the
- wip option or specifying a github pull request number.
+ If you are updating a package's version, you can use nixpkgs-review to make sure all packages that depend on the updated package still compile correctly. The nixpkgs-review utility can look for and build all dependencies either based on uncommited changes with the wip option or specifying a github pull request number.
review changes from pull request number 12345:
-nix-shell -p nix-review --run "nix-review pr 12345"
+ nix run nixpkgs.nixpkgs-review -c nixpkgs-review pr 12345
review uncommitted changes:
-nix-shell -p nix-review --run "nix-review wip"
+ nix run nixpkgs.nixpkgs-review -c nixpkgs-review wip
+
+
+
+ review changes from last commit:
+ nix run nixpkgs.nixpkgs-review -c nixpkgs-review rev HEAD
@@ -376,13 +343,7 @@ Additional information.
Tested execution of all binary files (usually in ./result/bin/)
- It's important to test any executables generated by a build when you change
- or create a package in nixpkgs. This can be done by looking in
- ./result/bin and running any files in there, or at a
- minimum, the main executable for the package. For example, if you make a
- change to texlive, you probably would only check the
- binaries associated with the change you made rather than testing all of
- them.
+ It's important to test any executables generated by a build when you change or create a package in nixpkgs. This can be done by looking in ./result/bin and running any files in there, or at a minimum, the main executable for the package. For example, if you make a change to texlive, you probably would only check the binaries associated with the change you made rather than testing all of them.
@@ -390,14 +351,8 @@ Additional information.
Meets Nixpkgs contribution standards
- The last checkbox is fits
- CONTRIBUTING.md.
- The contributing document has detailed information on standards the Nix
- community has for commit messages, reviews, licensing of contributions you
- make to the project, etc... Everyone should read and understand the
- standards the community has for contributing before submitting a pull
- request.
+ The last checkbox is fits CONTRIBUTING.md. The contributing document has detailed information on standards the Nix community has for commit messages, reviews, licensing of contributions you make to the project, etc... Everyone should read and understand the standards the community has for contributing before submitting a pull request.
@@ -435,61 +390,49 @@ Additional information.
- Commits must be sufficiently tested before being merged, both for the
- master and staging branches.
+ Commits must be sufficiently tested before being merged, both for the master and staging branches.
- Hydra builds for master and staging should not be used as testing
- platform, it's a build farm for changes that have been already tested.
+ Hydra builds for master and staging should not be used as testing platform, it's a build farm for changes that have been already tested.
- When changing the bootloader installation process, extra care must be
- taken. Grub installations cannot be rolled back, hence changes may break
- people's installations forever. For any non-trivial change to the
- bootloader please file a PR asking for review, especially from @edolstra.
+ When changing the bootloader installation process, extra care must be taken. Grub installations cannot be rolled back, hence changes may break people's installations forever. For any non-trivial change to the bootloader please file a PR asking for review, especially from @edolstra.
Master branch
-
-
-
-
- It should only see non-breaking commits that do not cause mass rebuilds.
-
-
-
+
+ The master branch is the main development branch.
+ It should only see non-breaking commits that do not cause mass rebuilds.
+ Staging branch
+
+ The staging branch is a development branch where mass-rebuilds go.
+ It should only see non-breaking mass-rebuild commits.
+ That means it is not to be used for testing, and changes must have been well tested already.
+ If the branch is already in a broken state, please refrain from adding extra new breakages.
+
+
-
-
-
- It's only for non-breaking mass-rebuild commits. That means it's not to
- be used for testing, and changes must have been well tested already.
- Read
- policy here.
-
-
-
-
- If the branch is already in a broken state, please refrain from adding
- extra new breakages. Stabilize it for a few days, merge into master, then
- resume development on staging.
- Keep
- an eye on the staging evaluations here. If any fixes for staging
- happen to be already in master, then master can be merged into staging.
-
-
-
+
+ Staging-next branch
+
+ The staging-next branch is for stabilizing mass-rebuilds submitted to the staging branch prior to merging them into master.
+ Mass-rebuilds should go via the staging branch.
+ It should only see non-breaking commits that are fixing issues blocking it from being merged into the master branch.
+
+
+ If the branch is already in a broken state, please refrain from adding extra new breakages. Stabilize it for a few days and then merge into master.
+
@@ -498,10 +441,7 @@ Additional information.
- If you're cherry-picking a commit to a stable release branch, always use
- git cherry-pick -xe and ensure the message contains a
- clear description about why this needs to be included in the stable
- branch.
+ If you're cherry-picking a commit to a stable release branch (“backporting”), always use git cherry-pick -xe and ensure the message contains a clear description about why this needs to be included in the stable branch.
An example of a cherry-picked commit would look like this:
diff --git a/doc/cross-compilation.xml b/doc/cross-compilation.xml
deleted file mode 100644
index b7844da195d7f58f18f25ed5ce3aa72cc99bf366..0000000000000000000000000000000000000000
--- a/doc/cross-compilation.xml
+++ /dev/null
@@ -1,678 +0,0 @@
-
- Cross-compilation
-
- Introduction
-
-
- "Cross-compilation" means compiling a program on one machine for another
- type of machine. For example, a typical use of cross-compilation is to
- compile programs for embedded devices. These devices often don't have the
- computing power and memory to compile their own programs. One might think
- that cross-compilation is a fairly niche concern. However, there are
- significant advantages to rigorously distinguishing between build-time and
- run-time environments! Significant, because the benefits apply even when one
- is developing and deploying on the same machine. Nixpkgs is increasingly
- adopting the opinion that packages should be written with cross-compilation
- in mind, and nixpkgs should evaluate in a similar way (by minimizing
- cross-compilation-specific special cases) whether or not one is
- cross-compiling.
-
-
-
- This chapter will be organized in three parts. First, it will describe the
- basics of how to package software in a way that supports cross-compilation.
- Second, it will describe how to use Nixpkgs when cross-compiling. Third, it
- will describe the internal infrastructure supporting cross-compilation.
-
-
-
-
- Packaging in a cross-friendly manner
-
-
- Platform parameters
-
-
- Nixpkgs follows the
- conventions
- of GNU autoconf. We distinguish between 3 types of platforms when
- building a derivation: build,
- host, and target. In
- summary, build is the platform on which a package
- is being built, host is the platform on which it
- will run. The third attribute, target, is relevant
- only for certain specific compilers and build tools.
-
-
-
- In Nixpkgs, these three platforms are defined as attribute sets under the
- names buildPlatform, hostPlatform,
- and targetPlatform. They are always defined as
- attributes in the standard environment. That means one can access them
- like:
-{ stdenv, fooDep, barDep, .. }: ...stdenv.buildPlatform...
- .
-
-
-
-
-
- buildPlatform
-
-
-
- The "build platform" is the platform on which a package is built. Once
- someone has a built package, or pre-built binary package, the build
- platform should not matter and can be ignored.
-
-
-
-
-
- hostPlatform
-
-
-
- The "host platform" is the platform on which a package will be run. This
- is the simplest platform to understand, but also the one with the worst
- name.
-
-
-
-
-
- targetPlatform
-
-
-
- The "target platform" attribute is, unlike the other two attributes, not
- actually fundamental to the process of building software. Instead, it is
- only relevant for compatibility with building certain specific compilers
- and build tools. It can be safely ignored for all other packages.
-
-
- The build process of certain compilers is written in such a way that the
- compiler resulting from a single build can itself only produce binaries
- for a single platform. The task of specifying this single "target
- platform" is thus pushed to build time of the compiler. The root cause
- of this is that the compiler (which will be run on the host) and the
- standard library/runtime (which will be run on the target) are built by
- a single build process.
-
-
- There is no fundamental need to think about a single target ahead of
- time like this. If the tool supports modular or pluggable backends, both
- the need to specify the target at build time and the constraint of
- having only a single target disappear. An example of such a tool is
- LLVM.
-
-
- Although the existence of a "target platfom" is arguably a historical
- mistake, it is a common one: examples of tools that suffer from it are
- GCC, Binutils, GHC and Autoconf. Nixpkgs tries to avoid sharing in the
- mistake where possible. Still, because the concept of a target platform
- is so ingrained, it is best to support it as is.
-
-
-
-
-
-
- The exact schema these fields follow is a bit ill-defined due to a long and
- convoluted evolution, but this is slowly being cleaned up. You can see
- examples of ones used in practice in
- lib.systems.examples; note how they are not all very
- consistent. For now, here are few fields can count on them containing:
-
-
-
-
-
- system
-
-
-
- This is a two-component shorthand for the platform. Examples of this
- would be "x86_64-darwin" and "i686-linux"; see
- lib.systems.doubles for more. The first component
- corresponds to the CPU architecture of the platform and the second to
- the operating system of the platform ([cpu]-[os]).
- This format has built-in support in Nix, such as the
- builtins.currentSystem impure string.
-
-
-
-
-
- config
-
-
-
- This is a 3- or 4- component shorthand for the platform. Examples of
- this would be x86_64-unknown-linux-gnu and
- aarch64-apple-darwin14. This is a standard format
- called the "LLVM target triple", as they are pioneered by LLVM. In the
- 4-part form, this corresponds to
- [cpu]-[vendor]-[os]-[abi]. This format is strictly
- more informative than the "Nix host double", as the previous format
- could analogously be termed. This needs a better name than
- config!
-
-
-
-
-
- parsed
-
-
-
- This is a Nix representation of a parsed LLVM target triple with
- white-listed components. This can be specified directly, or actually
- parsed from the config. See
- lib.systems.parse for the exact representation.
-
-
-
-
-
- libc
-
-
-
- This is a string identifying the standard C library used. Valid
- identifiers include "glibc" for GNU libc, "libSystem" for Darwin's
- Libsystem, and "uclibc" for µClibc. It should probably be refactored to
- use the module system, like parse.
-
-
-
-
-
- is*
-
-
-
- These predicates are defined in lib.systems.inspect,
- and slapped onto every platform. They are superior to the ones in
- stdenv as they force the user to be explicit about
- which platform they are inspecting. Please use these instead of those.
-
-
-
-
-
- platform
-
-
-
- This is, quite frankly, a dumping ground of ad-hoc settings (it's an
- attribute set). See lib.systems.platforms for
- examples—there's hopefully one in there that will work verbatim for
- each platform that is working. Please help us triage these flags and
- give them better homes!
-
-
-
-
-
-
-
- Theory of dependency categorization
-
-
-
- This is a rather philosophical description that isn't very
- Nixpkgs-specific. For an overview of all the relevant attributes given to
- mkDerivation, see
- . For a description of how
- everything is implemented, see
- .
-
-
-
-
- In this section we explore the relationship between both runtime and
- build-time dependencies and the 3 Autoconf platforms.
-
-
-
- A run time dependency between two packages requires that their host
- platforms match. This is directly implied by the meaning of "host platform"
- and "runtime dependency": The package dependency exists while both packages
- are running on a single host platform.
-
-
-
- A build time dependency, however, has a shift in platforms between the
- depending package and the depended-on package. "build time dependency"
- means that to build the depending package we need to be able to run the
- depended-on's package. The depending package's build platform is therefore
- equal to the depended-on package's host platform.
-
-
-
- If both the dependency and depending packages aren't compilers or other
- machine-code-producing tools, we're done. And indeed
- buildInputs and nativeBuildInputs
- have covered these simpler build-time and run-time (respectively) changes
- for many years. But if the dependency does produce machine code, we might
- need to worry about its target platform too. In principle, that target
- platform might be any of the depending package's build, host, or target
- platforms, but we prohibit dependencies from a "later" platform to an
- earlier platform to limit confusion because we've never seen a legitimate
- use for them.
-
-
-
- Finally, if the depending package is a compiler or other
- machine-code-producing tool, it might need dependencies that run at "emit
- time". This is for compilers that (regrettably) insist on being built
- together with their source langauges' standard libraries. Assuming build !=
- host != target, a run-time dependency of the standard library cannot be run
- at the compiler's build time or run time, but only at the run time of code
- emitted by the compiler.
-
-
-
- Putting this all together, that means we have dependencies in the form
- "host → target", in at most the following six combinations:
-
-
Possible dependency types
-
-
-
Dependency's host platform
-
Dependency's target platform
-
-
-
-
-
build
-
build
-
-
-
build
-
host
-
-
-
build
-
target
-
-
-
host
-
host
-
-
-
host
-
target
-
-
-
target
-
target
-
-
-
-
-
-
- Some examples will make this table clearer. Suppose there's some package
- that is being built with a (build, host, target)
- platform triple of (foo, bar, baz). If it has a
- build-time library dependency, that would be a "host → build" dependency
- with a triple of (foo, foo, *) (the target platform is
- irrelevant). If it needs a compiler to be built, that would be a "build →
- host" dependency with a triple of (foo, foo, *) (the
- target platform is irrelevant). That compiler, would be built with another
- compiler, also "build → host" dependency, with a triple of (foo,
- foo, foo).
-
-
-
-
- Cross packaging cookbook
-
-
- Some frequently encountered problems when packaging for cross-compilation
- should be answered here. Ideally, the information above is exhaustive, so
- this section cannot provide any new information, but it is ludicrous and
- cruel to expect everyone to spend effort working through the interaction of
- many features just to figure out the same answer to the same common
- problem. Feel free to add to this list!
-
-
-
-
-
-
- What if my package's build system needs to build a C program to be run
- under the build environment?
-
-
-
-
-depsBuildBuild = [ buildPackages.stdenv.cc ];
- Add it to your mkDerivation invocation.
-
-
-
-
-
-
- My package fails to find ar.
-
-
-
-
- Many packages assume that an unprefixed ar is
- available, but Nix doesn't provide one. It only provides a prefixed one,
- just as it only does for all the other binutils programs. It may be
- necessary to patch the package to fix the build system to use a prefixed
- `ar`.
-
-
-
-
-
-
- My package's testsuite needs to run host platform code.
-
-
-
-
-doCheck = stdenv.hostPlatform != stdenv.buildPlatfrom;
- Add it to your mkDerivation invocation.
-
-
-
-
-
-
-
-
- Cross-building packages
-
-
- Nixpkgs can be instantiated with localSystem alone, in
- which case there is no cross-compiling and everything is built by and for
- that system, or also with crossSystem, in which case
- packages run on the latter, but all building happens on the former. Both
- parameters take the same schema as the 3 (build, host, and target) platforms
- defined in the previous section. As mentioned above,
- lib.systems.examples has some platforms which are used as
- arguments for these parameters in practice. You can use them
- programmatically, or on the command line:
-
-nix-build <nixpkgs> --arg crossSystem '(import <nixpkgs/lib>).systems.examples.fooBarBaz' -A whatever
-
-
-
-
- Eventually we would like to make these platform examples an unnecessary
- convenience so that
-
-nix-build <nixpkgs> --arg crossSystem '{ config = "<arch>-<os>-<vendor>-<abi>"; }' -A whatever
- works in the vast majority of cases. The problem today is dependencies on
- other sorts of configuration which aren't given proper defaults. We rely on
- the examples to crudely to set those configuration parameters in some
- vaguely sane manner on the users behalf. Issue
- #34274
- tracks this inconvenience along with its root cause in crufty configuration
- options.
-
-
-
-
- While one is free to pass both parameters in full, there's a lot of logic to
- fill in missing fields. As discussed in the previous section, only one of
- system, config, and
- parsed is needed to infer the other two. Additionally,
- libc will be inferred from parse.
- Finally, localSystem.system is also
- impurely inferred based on the platform evaluation
- occurs. This means it is often not necessary to pass
- localSystem at all, as in the command-line example in the
- previous paragraph.
-
-
-
-
- Many sources (manual, wiki, etc) probably mention passing
- system, platform, along with the
- optional crossSystem to nixpkgs: import
- <nixpkgs> { system = ..; platform = ..; crossSystem = ..;
- }. Passing those two instead of localSystem is
- still supported for compatibility, but is discouraged. Indeed, much of the
- inference we do for these parameters is motivated by compatibility as much
- as convenience.
-
-
-
-
- One would think that localSystem and
- crossSystem overlap horribly with the three
- *Platforms (buildPlatform,
- hostPlatform, and targetPlatform; see
- stage.nix or the manual). Actually, those identifiers are
- purposefully not used here to draw a subtle but important distinction: While
- the granularity of having 3 platforms is necessary to properly *build*
- packages, it is overkill for specifying the user's *intent* when making a
- build plan or package set. A simple "build vs deploy" dichotomy is adequate:
- the sliding window principle described in the previous section shows how to
- interpolate between the these two "end points" to get the 3 platform triple
- for each bootstrapping stage. That means for any package a given package
- set, even those not bound on the top level but only reachable via
- dependencies or buildPackages, the three platforms will
- be defined as one of localSystem or
- crossSystem, with the former replacing the latter as one
- traverses build-time dependencies. A last simple difference is that
- crossSystem should be null when one doesn't want to
- cross-compile, while the *Platforms are always non-null.
- localSystem is always non-null.
-
-
-
-
- Cross-compilation infrastructure
-
-
- Implementation of dependencies
-
-
- The categorizes of dependencies developed in
- are specified as
- lists of derivations given to mkDerivation, as
- documented in . In short,
- each list of dependencies for "host → target" of "foo → bar" is called
- depsFooBar, with exceptions for backwards
- compatibility that depsBuildHost is instead called
- nativeBuildInputs and depsHostTarget
- is instead called buildInputs. Nixpkgs is now structured
- so that each depsFooBar is automatically taken from
- pkgsFooBar. (These pkgsFooBars are
- quite new, so there is no special case for
- nativeBuildInputs and buildInputs.)
- For example, pkgsBuildHost.gcc should be used at
- build-time, while pkgsHostTarget.gcc should be used at
- run-time.
-
-
-
- Now, for most of Nixpkgs's history, there were no
- pkgsFooBar attributes, and most packages have not been
- refactored to use it explicitly. Prior to those, there were just
- buildPackages, pkgs, and
- targetPackages. Those are now redefined as aliases to
- pkgsBuildHost, pkgsHostTarget, and
- pkgsTargetTarget. It is acceptable, even
- recommended, to use them for libraries to show that the host platform is
- irrelevant.
-
-
-
- But before that, there was just pkgs, even though both
- buildInputs and nativeBuildInputs
- existed. [Cross barely worked, and those were implemented with some hacks
- on mkDerivation to override dependencies.] What this
- means is the vast majority of packages do not use any explicit package set
- to populate their dependencies, just using whatever
- callPackage gives them even if they do correctly sort
- their dependencies into the multiple lists described above. And indeed,
- asking that users both sort their dependencies, and
- take them from the right attribute set, is both too onerous and redundant,
- so the recommended approach (for now) is to continue just categorizing by
- list and not using an explicit package set.
-
-
-
- To make this work, we "splice" together the six
- pkgsFooBar package sets and have
- callPackage actually take its arguments from that. This
- is currently implemented in pkgs/top-level/splice.nix.
- mkDerivation then, for each dependency attribute, pulls
- the right derivation out from the splice. This splicing can be skipped when
- not cross-compiling as the package sets are the same, but still is a bit
- slow for cross-compiling. We'd like to do something better, but haven't
- come up with anything yet.
-
-
-
-
- Bootstrapping
-
-
- Each of the package sets described above come from a single bootstrapping
- stage. While pkgs/top-level/default.nix, coordinates
- the composition of stages at a high level,
- pkgs/top-level/stage.nix "ties the knot" (creates the
- fixed point) of each stage. The package sets are defined per-stage however,
- so they can be thought of as edges between stages (the nodes) in a graph.
- Compositions like pkgsBuildTarget.targetPackages can be
- thought of as paths to this graph.
-
-
-
- While there are many package sets, and thus many edges, the stages can also
- be arranged in a linear chain. In other words, many of the edges are
- redundant as far as connectivity is concerned. This hinges on the type of
- bootstrapping we do. Currently for cross it is:
-
-
-
- (native, native, native)
-
-
-
-
- (native, native, foreign)
-
-
-
-
- (native, foreign, foreign)
-
-
-
- In each stage, pkgsBuildHost refers the the previous
- stage, pkgsBuildBuild refers to the one before that, and
- pkgsHostTarget refers to the current one, and
- pkgsTargetTarget refers to the next one. When there is
- no previous or next stage, they instead refer to the current stage. Note
- how all the invariants regarding the mapping between dependency and depending
- packages' build host and target platforms are preserved.
- pkgsBuildTarget and pkgsHostHost are
- more complex in that the stage fitting the requirements isn't always a
- fixed chain of "prevs" and "nexts" away (modulo the "saturating"
- self-references at the ends). We just special case each instead. All the primary
- edges are implemented is in pkgs/stdenv/booter.nix,
- and secondarily aliases in pkgs/top-level/stage.nix.
-
-
-
-
- Note the native stages are bootstrapped in legacy ways that predate the
- current cross implementation. This is why the the bootstrapping stages
- leading up to the final stages are ignored inthe previous paragraph.
-
-
-
-
- If one looks at the 3 platform triples, one can see that they overlap such
- that one could put them together into a chain like:
-
-(native, native, native, foreign, foreign)
-
- If one imagines the saturating self references at the end being replaced
- with infinite stages, and then overlays those platform triples, one ends up
- with the infinite tuple:
-
-(native..., native, native, native, foreign, foreign, foreign...)
-
- On can then imagine any sequence of platforms such that there are bootstrap
- stages with their 3 platforms determined by "sliding a window" that is the
- 3 tuple through the sequence. This was the original model for
- bootstrapping. Without a target platform (assume a better world where all
- compilers are multi-target and all standard libraries are built in their
- own derivation), this is sufficient. Conversely if one wishes to cross
- compile "faster", with a "Canadian Cross" bootstraping stage where
- build != host != target, more bootstrapping stages are
- needed since no sliding window providess the pesky
- pkgsBuildTarget package set since it skips the Canadian
- cross stage's "host".
-
-
-
-
- It is much better to refer to buildPackages than
- targetPackages, or more broadly package sets that do
- not mention "target". There are three reasons for this.
-
-
- First, it is because bootstrapping stages do not have a unique
- targetPackages. For example a (x86-linux,
- x86-linux, arm-linux) and (x86-linux, x86-linux,
- x86-windows) package set both have a (x86-linux,
- x86-linux, x86-linux) package set. Because there is no canonical
- targetPackages for such a native (build ==
- host == target) package set, we set their
- targetPackages
-
-
- Second, it is because this is a frequent source of hard-to-follow
- "infinite recursions" / cycles. When only package sets that don't mention
- target are used, the package set forms a directed acyclic graph. This
- means that all cycles that exist are confined to one stage. This means
- they are a lot smaller, and easier to follow in the code or a backtrace. It
- also means they are present in native and cross builds alike, and so more
- likely to be caught by CI and other users.
-
-
- Thirdly, it is because everything target-mentioning only exists to
- accommodate compilers with lousy build systems that insist on the compiler
- itself and standard library being built together. Of course that is bad
- because bigger derivations means longer rebuilds. It is also problematic because
- it tends to make the standard libraries less like other libraries than
- they could be, complicating code and build systems alike. Because of the
- other problems, and because of these innate disadvantages, compilers ought
- to be packaged another way where possible.
-
-
-
-
-
- If one explores Nixpkgs, they will see derivations with names like
- gccCross. Such *Cross derivations is
- a holdover from before we properly distinguished between the host and
- target platforms—the derivation with "Cross" in the name covered the
- build = host != target case, while the other covered
- the host = target, with build platform the same or not
- based on whether one was using its .nativeDrv or
- .crossDrv. This ugliness will disappear soon.
-
-
-
-
-
diff --git a/doc/doc-support/parameters.xml b/doc/doc-support/parameters.xml
index bc13e2b70dec972d20a6c57b5365c97a03782ae6..e4b33e66ee4dd51351d1dc29ea2bbac5fa212ae0 100644
--- a/doc/doc-support/parameters.xml
+++ b/doc/doc-support/parameters.xml
@@ -8,7 +8,7 @@
-
+
diff --git a/doc/functions.xml b/doc/functions.xml
index 96bd95958eae8461d253409fc357c3469a5e15c2..5a9240ec800e2ee7413dd17ba3c927b2ff2796fc 100644
--- a/doc/functions.xml
+++ b/doc/functions.xml
@@ -4,21 +4,11 @@
xml:id="chap-functions">
Functions reference
- The nixpkgs repository has several utility functions to manipulate Nix
- expressions.
+ The nixpkgs repository has several utility functions to manipulate Nix expressions.
-
-
-
-
-
-
-
-
-
diff --git a/doc/functions/debug.xml b/doc/functions/debug.xml
index c6b3611eea53dc43437418d6a4c062322e15047e..c27421f12e76c3487c5978cf9eb810cde4005591 100644
--- a/doc/functions/debug.xml
+++ b/doc/functions/debug.xml
@@ -5,17 +5,10 @@
Debugging Nix Expressions
- Nix is a unityped, dynamic language, this means every value can potentially
- appear anywhere. Since it is also non-strict, evaluation order and what
- ultimately is evaluated might surprise you. Therefore it is important to be
- able to debug nix expressions.
+ Nix is a unityped, dynamic language, this means every value can potentially appear anywhere. Since it is also non-strict, evaluation order and what ultimately is evaluated might surprise you. Therefore it is important to be able to debug nix expressions.
- In the lib/debug.nix file you will find a number of
- functions that help (pretty-)printing values while evaluation is runnnig. You
- can even specify how deep these values should be printed recursively, and
- transform them on the fly. Please consult the docstrings in
- lib/debug.nix for usage information.
+ In the lib/debug.nix file you will find a number of functions that help (pretty-)printing values while evaluation is runnnig. You can even specify how deep these values should be printed recursively, and transform them on the fly. Please consult the docstrings in lib/debug.nix for usage information.
diff --git a/doc/functions/fetchers.xml b/doc/functions/fetchers.xml
deleted file mode 100644
index a736008c9d41817c1027c3d214da34815091ad50..0000000000000000000000000000000000000000
--- a/doc/functions/fetchers.xml
+++ /dev/null
@@ -1,194 +0,0 @@
-
- Fetcher functions
-
-
- When using Nix, you will frequently need to download source code and other
- files from the internet. Nixpkgs comes with a few helper functions that allow
- you to fetch fixed-output derivations in a structured way.
-
-
-
- The two fetcher primitives are fetchurl and
- fetchzip. Both of these have two required arguments, a
- URL and a hash. The hash is typically sha256, although
- many more hash algorithms are supported. Nixpkgs contributors are currently
- recommended to use sha256. This hash will be used by Nix
- to identify your source. A typical usage of fetchurl is provided below.
-
-
-
-
-
- The main difference between fetchurl and
- fetchzip is in how they store the contents.
- fetchurl will store the unaltered contents of the URL
- within the Nix store. fetchzip on the other hand will
- decompress the archive for you, making files and directories directly
- accessible in the future. fetchzip can only be used with
- archives. Despite the name, fetchzip is not limited to
- .zip files and can also be used with any tarball.
-
-
-
- fetchpatch works very similarly to
- fetchurl with the same arguments expected. It expects
- patch files as a source and and performs normalization on them before
- computing the checksum. For example it will remove comments or other unstable
- parts that are sometimes added by version control systems and can change over
- time.
-
-
-
- Other fetcher functions allow you to add source code directly from a VCS such
- as subversion or git. These are mostly straightforward names based on the
- name of the command used with the VCS system. Because they give you a working
- repository, they act most like fetchzip.
-
-
-
-
-
- fetchsvn
-
-
-
- Used with Subversion. Expects url to a Subversion
- directory, rev, and sha256.
-
-
-
-
-
- fetchgit
-
-
-
- Used with Git. Expects url to a Git repo,
- rev, and sha256.
- rev in this case can be full the git commit id (SHA1
- hash) or a tag name like refs/tags/v1.0.
-
-
-
-
-
- fetchfossil
-
-
-
- Used with Fossil. Expects url to a Fossil archive,
- rev, and sha256.
-
-
-
-
-
- fetchcvs
-
-
-
- Used with CVS. Expects cvsRoot, tag,
- and sha256.
-
-
-
-
-
- fetchhg
-
-
-
- Used with Mercurial. Expects url,
- rev, and sha256.
-
-
-
-
-
-
- A number of fetcher functions wrap part of fetchurl and
- fetchzip. They are mainly convenience functions intended
- for commonly used destinations of source code in Nixpkgs. These wrapper
- fetchers are listed below.
-
-
-
-
-
- fetchFromGitHub
-
-
-
- fetchFromGitHub expects four arguments.
- owner is a string corresponding to the GitHub user or
- organization that controls this repository. repo
- corresponds to the name of the software repository. These are located at
- the top of every GitHub HTML page as
- owner/repo. rev
- corresponds to the Git commit hash or tag (e.g v1.0)
- that will be downloaded from Git. Finally, sha256
- corresponds to the hash of the extracted directory. Again, other hash
- algorithms are also available but sha256 is currently
- preferred.
-
-
-
-
-
- fetchFromGitLab
-
-
-
- This is used with GitLab repositories. The arguments expected are very
- similar to fetchFromGitHub above.
-
-
-
-
-
- fetchFromBitbucket
-
-
-
- This is used with BitBucket repositories. The arguments expected are very
- similar to fetchFromGitHub above.
-
-
-
-
-
- fetchFromSavannah
-
-
-
- This is used with Savannah repositories. The arguments expected are very
- similar to fetchFromGitHub above.
-
-
-
-
-
- fetchFromRepoOrCz
-
-
-
- This is used with repo.or.cz repositories. The arguments expected are very
- similar to fetchFromGitHub above.
-
-
-
-
-
diff --git a/doc/functions/generators.xml b/doc/functions/generators.xml
index e860b10e8979f090d5763c57b3cbd3ae7998b616..9ce1f85eb1731e697a6bad390863198f9c741495 100644
--- a/doc/functions/generators.xml
+++ b/doc/functions/generators.xml
@@ -5,28 +5,15 @@
Generators
- Generators are functions that create file formats from nix data structures,
- e. g. for configuration files. There are generators available for:
- INI, JSON and YAML
+ Generators are functions that create file formats from nix data structures, e. g. for configuration files. There are generators available for: INI, JSON and YAML
- All generators follow a similar call interface: generatorName
- configFunctions data, where configFunctions is an
- attrset of user-defined functions that format nested parts of the content.
- They each have common defaults, so often they do not need to be set manually.
- An example is mkSectionName ? (name: libStr.escape [ "[" "]" ]
- name) from the INI generator. It receives the name
- of a section and sanitizes it. The default mkSectionName
- escapes [ and ] with a backslash.
+ All generators follow a similar call interface: generatorName configFunctions data, where configFunctions is an attrset of user-defined functions that format nested parts of the content. They each have common defaults, so often they do not need to be set manually. An example is mkSectionName ? (name: libStr.escape [ "[" "]" ] name) from the INI generator. It receives the name of a section and sanitizes it. The default mkSectionName escapes [ and ] with a backslash.
- Generators can be fine-tuned to produce exactly the file format required by
- your application/service. One example is an INI-file format which uses
- : as separator, the strings
- "yes"/"no" as boolean values and
- requires all string values to be quoted:
+ Generators can be fine-tuned to produce exactly the file format required by your application/service. One example is an INI-file format which uses : as separator, the strings "yes"/"no" as boolean values and requires all string values to be quoted:
@@ -77,13 +64,11 @@ merge:"diff3"
- Nix store paths can be converted to strings by enclosing a derivation
- attribute like so: "${drv}".
+ Nix store paths can be converted to strings by enclosing a derivation attribute like so: "${drv}".
- Detailed documentation for each generator can be found in
- lib/generators.nix.
+ Detailed documentation for each generator can be found in lib/generators.nix.
diff --git a/doc/functions/library.xml b/doc/functions/library.xml
index e6aedaa6efdd5e77b2c2c6113af709e5b687cb85..6ffb944b5a609dbe572e8d8bf86775b13abb41e7 100644
--- a/doc/functions/library.xml
+++ b/doc/functions/library.xml
@@ -5,8 +5,7 @@
Nixpkgs Library Functions
- Nixpkgs provides a standard library at pkgs.lib, or
- through import <nixpkgs/lib>.
+ Nixpkgs provides a standard library at pkgs.lib, or through import <nixpkgs/lib>.
diff --git a/doc/functions/library/asserts.xml b/doc/functions/library/asserts.xml
index 437850e408bc2194e96759daa5d552d7e18455c0..10891039e86961e4409bdd96423e343c2024d5ef 100644
--- a/doc/functions/library/asserts.xml
+++ b/doc/functions/library/asserts.xml
@@ -27,8 +27,7 @@
- Condition under which the msg should
- not be printed.
+ Condition under which the msg should not be printed.
@@ -64,9 +63,7 @@ stderr> assert failed
- Specialized asserts.assertMsg for checking if
- val is one of the elements of xs.
- Useful for checking enums.
+ Specialized asserts.assertMsg for checking if val is one of the elements of xs. Useful for checking enums.
@@ -76,8 +73,7 @@ stderr> assert failed
- The name of the variable the user entered val into,
- for inclusion in the error message.
+ The name of the variable the user entered val into, for inclusion in the error message.
@@ -87,8 +83,7 @@ stderr> assert failed
- The value of what the user provided, to be compared against the values in
- xs.
+ The value of what the user provided, to be compared against the values in xs.
diff --git a/doc/functions/library/attrsets.xml b/doc/functions/library/attrsets.xml
index 65d0b40e2e82728e4ec2b88abf9cfe8cdb4af779..f9234069392ea89f030aac86701e9d32bad2dda7 100644
--- a/doc/functions/library/attrsets.xml
+++ b/doc/functions/library/attrsets.xml
@@ -23,8 +23,7 @@
- A list of strings representing the path through the nested attribute set
- set.
+ A list of strings representing the path through the nested attribute set set.
@@ -34,8 +33,7 @@
- Default value if attrPath does not resolve to an
- existing value.
+ Default value if attrPath does not resolve to an existing value.
@@ -88,8 +86,7 @@ lib.attrsets.attrByPath [ "a" "b" ] 0 {}
- A list of strings representing the path through the nested attribute set
- set.
+ A list of strings representing the path through the nested attribute set set.
@@ -125,8 +122,7 @@ lib.attrsets.hasAttrByPath
- Create a new attribute set with value set at the nested
- attribute location specified in attrPath.
+ Create a new attribute set with value set at the nested attribute location specified in attrPath.
@@ -146,8 +142,7 @@ lib.attrsets.hasAttrByPath
- The value to set at the location described by
- attrPath.
+ The value to set at the location described by attrPath.
@@ -171,8 +166,7 @@ lib.attrsets.setAttrByPath [ "a" "b" ] 3
- Like except
- without a default, and it will throw if the value doesn't exist.
+ Like except without a default, and it will throw if the value doesn't exist.
@@ -182,8 +176,7 @@ lib.attrsets.setAttrByPath [ "a" "b" ] 3
- A list of strings representing the path through the nested attribute set
- set.
+ A list of strings representing the path through the nested attribute set set.
@@ -235,8 +228,7 @@ lib.attrsets.getAttrFromPath [ "x" "y" ] { }
- The list of attributes to fetch from set. Each
- attribute name must exist on the attrbitue set.
+ The list of attributes to fetch from set. Each attribute name must exist on the attrbitue set.
@@ -282,8 +274,7 @@ error: attribute 'd' missing
- Provides a backwards-compatible interface of
- builtins.attrValues for Nix version older than 1.8.
+ Provides a backwards-compatible interface of builtins.attrValues for Nix version older than 1.8.
@@ -317,14 +308,11 @@ lib.attrsets.attrValues { a = 1; b = 2; c = 3; }
- Collect each attribute named `attr' from the list of attribute sets,
- sets. Sets that don't contain the named attribute are
- ignored.
+ Collect each attribute named `attr' from the list of attribute sets, sets. Sets that don't contain the named attribute are ignored.
- Provides a backwards-compatible interface of
- builtins.catAttrs for Nix version older than 1.9.
+ Provides a backwards-compatible interface of builtins.catAttrs for Nix version older than 1.9.
@@ -334,8 +322,7 @@ lib.attrsets.attrValues { a = 1; b = 2; c = 3; }
- Attribute name to select from each attribute set in
- sets.
+ Attribute name to select from each attribute set in sets.
@@ -372,8 +359,7 @@ catAttrs "a" [{a = 1;} {b = 0;} {a = 2;}]
- Filter an attribute set by removing all attributes for which the given
- predicate return false.
+ Filter an attribute set by removing all attributes for which the given predicate return false.
@@ -386,8 +372,7 @@ catAttrs "a" [{a = 1;} {b = 0;} {a = 2;}]
String -> Any -> Bool
- Predicate which returns true to include an attribute, or returns false to
- exclude it.
+ Predicate which returns true to include an attribute, or returns false to exclude it.
@@ -412,8 +397,7 @@ catAttrs "a" [{a = 1;} {b = 0;} {a = 2;}]
- Returns true to include the attribute,
- false to exclude the attribute.
+ Returns true to include the attribute, false to exclude the attribute.
@@ -447,8 +431,7 @@ filterAttrs (n: v: n == "foo") { foo = 1; bar = 2; }
- Filter an attribute set recursively by removing all attributes for which the
- given predicate return false.
+ Filter an attribute set recursively by removing all attributes for which the given predicate return false.
@@ -461,8 +444,7 @@ filterAttrs (n: v: n == "foo") { foo = 1; bar = 2; }
String -> Any -> Bool
- Predicate which returns true to include an attribute, or returns false to
- exclude it.
+ Predicate which returns true to include an attribute, or returns false to exclude it.
@@ -487,8 +469,7 @@ filterAttrs (n: v: n == "foo") { foo = 1; bar = 2; }
- Returns true to include the attribute,
- false to exclude the attribute.
+ Returns true to include the attribute, false to exclude the attribute.
@@ -557,8 +538,7 @@ lib.attrsets.filterAttrsRecursive
Any -> Any -> Any
- Given a value val and a collector
- col, combine the two.
+ Given a value val and a collector col, combine the two.
@@ -578,8 +558,7 @@ lib.attrsets.filterAttrsRecursive
- The result of previous op calls with other values
- and nul.
+ The result of previous op calls with other values and nul.
@@ -632,9 +611,7 @@ lib.attrsets.foldAttrs
- Recursively collect sets that verify a given predicate named
- pred from the set attrs. The recursion
- stops when pred returns true.
+ Recursively collect sets that verify a given predicate named pred from the set attrs. The recursion stops when pred returns true.
@@ -702,8 +679,7 @@ collect (x: x ? outPath)
- Utility function that creates a {name, value} pair as
- expected by builtins.listToAttrs.
+ Utility function that creates a {name, value} pair as expected by builtins.listToAttrs.
@@ -747,13 +723,11 @@ nameValuePair "some" 6
- Apply a function to each element in an attribute set, creating a new
- attribute set.
+ Apply a function to each element in an attribute set, creating a new attribute set.
- Provides a backwards-compatible interface of
- builtins.mapAttrs for Nix version older than 2.1.
+ Provides a backwards-compatible interface of builtins.mapAttrs for Nix version older than 2.1.
@@ -814,9 +788,7 @@ lib.attrsets.mapAttrs
- Like mapAttrs, but allows the name of each attribute to
- be changed in addition to the value. The applied function should return both
- the new name and value as a nameValuePair.
+ Like mapAttrs, but allows the name of each attribute to be changed in addition to the value. The applied function should return both the new name and value as a nameValuePair.
@@ -829,10 +801,8 @@ lib.attrsets.mapAttrs
String -> Any -> { name = String; value = Any }
- Given an attribute's name and value, return a new
- name
- value pair.
+ Given an attribute's name and value, return a new name value pair.
@@ -891,8 +861,7 @@ lib.attrsets.mapAttrs' (name: value: lib.attrsets.nameValuePair ("foo_" + name)
- Call fn for each attribute in the given
- set and return the result in a list.
+ Call fn for each attribute in the given set and return the result in a list.
@@ -962,9 +931,7 @@ lib.attrsets.mapAttrsToList (name: value: "${name}=${value}")
- Like mapAttrs, except that it recursively applies
- itself to attribute sets. Also, the first argument of the argument function
- is a list of the names of the containing attributes.
+ Like mapAttrs, except that it recursively applies itself to attribute sets. Also, the first argument of the argument function is a list of the names of the containing attributes.
@@ -989,10 +956,7 @@ lib.attrsets.mapAttrsToList (name: value: "${name}=${value}")
The list of attribute names to this value.
- For example, the name_path for the
- example string in the attribute set { foo
- = { bar = "example"; }; } is [ "foo" "bar"
- ].
+ For example, the name_path for the example string in the attribute set { foo = { bar = "example"; }; } is [ "foo" "bar" ].
@@ -1059,11 +1023,7 @@ mapAttrsRecursive
- Like mapAttrsRecursive, but it takes an additional
- predicate function that tells it whether to recursive into an attribute set.
- If it returns false, mapAttrsRecursiveCond does not
- recurse, but does apply the map function. It is returns true, it does
- recurse, and does not apply the map function.
+ Like mapAttrsRecursive, but it takes an additional predicate function that tells it whether to recursive into an attribute set. If it returns false, mapAttrsRecursiveCond does not recurse, but does apply the map function. It is returns true, it does recurse, and does not apply the map function.
@@ -1076,8 +1036,7 @@ mapAttrsRecursive
(AttrSet -> Bool)
- Determine if mapAttrsRecursive should recurse deeper
- in to the attribute set.
+ Determine if mapAttrsRecursive should recurse deeper in to the attribute set.
@@ -1114,10 +1073,7 @@ mapAttrsRecursive
The list of attribute names to this value.
- For example, the name_path for the
- example string in the attribute set { foo
- = { bar = "example"; }; } is [ "foo" "bar"
- ].
+ For example, the name_path for the example string in the attribute set { foo = { bar = "example"; }; } is [ "foo" "bar" ].
@@ -1181,8 +1137,7 @@ lib.attrsets.mapAttrsRecursiveCond
- Generate an attribute set by mapping a function over a list of attribute
- names.
+ Generate an attribute set by mapping a function over a list of attribute names.
@@ -1241,8 +1196,7 @@ lib.attrsets.genAttrs [ "foo" "bar" ] (name: "x_${name}")
- Check whether the argument is a derivation. Any set with { type =
- "derivation"; } counts as a derivation.
+ Check whether the argument is a derivation. Any set with { type = "derivation"; } counts as a derivation.
@@ -1320,8 +1274,7 @@ lib.attrsets.isDerivation "foobar"
- Condition under which the as attribute set is
- returned.
+ Condition under which the as attribute set is returned.
@@ -1363,8 +1316,7 @@ lib.attrsets.optionalAttrs false { my = "set"; }
- Merge sets of attributes and use the function f to merge
- attribute values where the attribute name is in names.
+ Merge sets of attributes and use the function f to merge attribute values where the attribute name is in names.
@@ -1451,11 +1403,8 @@ lib.attrsets.zipAttrsWithNames
- Merge sets of attributes and use the function f to merge
- attribute values. Similar to
- where
- all key names are passed for names.
+ Merge sets of attributes and use the function f to merge attribute values. Similar to where all key names are passed for names.
@@ -1531,9 +1480,7 @@ lib.attrsets.zipAttrsWith
- Merge sets of attributes and combine each attribute value in to a list.
- Similar to
- where the merge function returns a list of all values.
+ Merge sets of attributes and combine each attribute value in to a list. Similar to where the merge function returns a list of all values.
@@ -1573,12 +1520,7 @@ lib.attrsets.zipAttrs
- Does the same as the update operator // except that
- attributes are merged until the given predicate is verified. The predicate
- should accept 3 arguments which are the path to reach the attribute, a part
- of the first attribute set and a part of the second attribute set. When the
- predicate is verified, the value of the first attribute set is replaced by
- the value of the second attribute set.
+ Does the same as the update operator // except that attributes are merged until the given predicate is verified. The predicate should accept 3 arguments which are the path to reach the attribute, a part of the first attribute set and a part of the second attribute set. When the predicate is verified, the value of the first attribute set is replaced by the value of the second attribute set.
@@ -1681,10 +1623,7 @@ lib.attrsets.recursiveUpdateUntil (path: l: r: path == ["foo"])
- A recursive variant of the update operator //. The
- recursion stops when one of the attribute values is not an attribute set, in
- which case the right hand side value takes precedence over the left hand
- side value.
+ A recursive variant of the update operator //. The recursion stops when one of the attribute values is not an attribute set, in which case the right hand side value takes precedence over the left hand side value.
diff --git a/doc/functions/nix-gitignore.xml b/doc/functions/nix-gitignore.xml
index 9011570d1eaed005b66fc7359c71e01dd098701e..37a82b196ccf2d92b4bf8331b633c4b8db48edfc 100644
--- a/doc/functions/nix-gitignore.xml
+++ b/doc/functions/nix-gitignore.xml
@@ -5,21 +5,14 @@
pkgs.nix-gitignore
- pkgs.nix-gitignore is a function that acts similarly to
- builtins.filterSource but also allows filtering with the
- help of the gitignore format.
+ pkgs.nix-gitignore is a function that acts similarly to builtins.filterSource but also allows filtering with the help of the gitignore format.
Usage
- pkgs.nix-gitignore exports a number of functions, but
- you'll most likely need either gitignoreSource or
- gitignoreSourcePure. As their first argument, they both
- accept either 1. a file with gitignore lines or 2. a string with gitignore
- lines, or 3. a list of either of the two. They will be concatenated into a
- single big string.
+ pkgs.nix-gitignore exports a number of functions, but you'll most likely need either gitignoreSource or gitignoreSourcePure. As their first argument, they both accept either 1. a file with gitignore lines or 2. a string with gitignore lines, or 3. a list of either of the two. They will be concatenated into a single big string.
- These functions are derived from the Filter functions by
- setting the first filter argument to (_: _: true):
+ These functions are derived from the Filter functions by setting the first filter argument to (_: _: true):
- Those filter functions accept the same arguments the
- builtins.filterSource function would pass to its filters,
- thus fn: gitignoreFilterSourcePure fn "" should be
- extensionally equivalent to filterSource. The file is
- blacklisted iff it's blacklisted by either your filter or the
- gitignoreFilter.
+ Those filter functions accept the same arguments the builtins.filterSource function would pass to its filters, thus fn: gitignoreFilterSourcePure fn "" should be extensionally equivalent to filterSource. The file is blacklisted iff it's blacklisted by either your filter or the gitignoreFilter.
@@ -71,8 +58,7 @@ gitignoreFilter = ign: root: filterPattern (gitignoreToPatterns ign) root;
gitignore files in subdirectories
- If you wish to use a filter that would search for .gitignore files in
- subdirectories, just like git does by default, use this function:
+ If you wish to use a filter that would search for .gitignore files in subdirectories, just like git does by default, use this function:
- Overriding
-
-
- Sometimes one wants to override parts of nixpkgs, e.g.
- derivation attributes, the results of derivations.
-
-
-
- These functions are used to make changes to packages, returning only single
- packages. Overlays, on the other
- hand, can be used to combine the overridden packages across the entire
- package set of Nixpkgs.
-
-
-
- <pkg>.override
-
-
- The function override is usually available for all the
- derivations in the nixpkgs expression (pkgs).
-
-
-
- It is used to override the arguments passed to a function.
-
-
-
- Example usages:
-pkgs.foo.override { arg1 = val1; arg2 = val2; ... }
-
-
-import pkgs.path { overlays = [ (self: super: {
- foo = super.foo.override { barSupport = true ; };
- })]};
-
-
-mypkg = pkgs.callPackage ./mypkg.nix {
- mydep = pkgs.mydep.override { ... };
- }
-
-
-
-
- In the first example, pkgs.foo is the result of a
- function call with some default arguments, usually a derivation. Using
- pkgs.foo.override will call the same function with the
- given new arguments.
-
-
-
-
- <pkg>.overrideAttrs
-
-
- The function overrideAttrs allows overriding the
- attribute set passed to a stdenv.mkDerivation call,
- producing a new derivation based on the original one. This function is
- available on all derivations produced by the
- stdenv.mkDerivation function, which is most packages in
- the nixpkgs expression pkgs.
-
-
-
- Example usage:
-
-helloWithDebug = pkgs.hello.overrideAttrs (oldAttrs: rec {
- separateDebugInfo = true;
-});
-
-
-
-
- In the above example, the separateDebugInfo attribute is
- overridden to be true, thus building debug info for
- helloWithDebug, while all other attributes will be
- retained from the original hello package.
-
-
-
- The argument oldAttrs is conventionally used to refer to
- the attr set originally passed to stdenv.mkDerivation.
-
-
-
-
- Note that separateDebugInfo is processed only by the
- stdenv.mkDerivation function, not the generated, raw Nix
- derivation. Thus, using overrideDerivation will not work
- in this case, as it overrides only the attributes of the final derivation.
- It is for this reason that overrideAttrs should be
- preferred in (almost) all cases to overrideDerivation,
- i.e. to allow using stdenv.mkDerivation to process input
- arguments, as well as the fact that it is easier to use (you can use the
- same attribute names you see in your Nix code, instead of the ones
- generated (e.g. buildInputs vs
- nativeBuildInputs), and it involves less typing).
-
-
-
-
-
- <pkg>.overrideDerivation
-
-
-
- You should prefer overrideAttrs in almost all cases, see
- its documentation for the reasons why.
- overrideDerivation is not deprecated and will continue
- to work, but is less nice to use and does not have as many abilities as
- overrideAttrs.
-
-
-
-
-
- Do not use this function in Nixpkgs as it evaluates a Derivation before
- modifying it, which breaks package abstraction and removes error-checking
- of function arguments. In addition, this evaluation-per-function
- application incurs a performance penalty, which can become a problem if
- many overrides are used. It is only intended for ad-hoc customisation, such
- as in ~/.config/nixpkgs/config.nix.
-
-
-
-
- The function overrideDerivation creates a new derivation
- based on an existing one by overriding the original's attributes with the
- attribute set produced by the specified function. This function is available
- on all derivations defined using the makeOverridable
- function. Most standard derivation-producing functions, such as
- stdenv.mkDerivation, are defined using this function,
- which means most packages in the nixpkgs expression,
- pkgs, have this function.
-
-
-
- Example usage:
-
-mySed = pkgs.gnused.overrideDerivation (oldAttrs: {
- name = "sed-4.2.2-pre";
- src = fetchurl {
- url = ftp://alpha.gnu.org/gnu/sed/sed-4.2.2-pre.tar.bz2;
- sha256 = "11nq06d131y4wmf3drm0yk502d2xc6n5qy82cg88rb9nqd2lj41k";
- };
- patches = [];
-});
-
-
-
-
- In the above example, the name, src,
- and patches of the derivation will be overridden, while
- all other attributes will be retained from the original derivation.
-
-
-
- The argument oldAttrs is used to refer to the attribute
- set of the original derivation.
-
-
-
-
- A package's attributes are evaluated *before* being modified by the
- overrideDerivation function. For example, the
- name attribute reference in url =
- "mirror://gnu/hello/${name}.tar.gz"; is filled-in *before* the
- overrideDerivation function modifies the attribute set.
- This means that overriding the name attribute, in this
- example, *will not* change the value of the url
- attribute. Instead, we need to override both the name
- *and* url attributes.
-
-
-
-
-
- lib.makeOverridable
-
-
- The function lib.makeOverridable is used to make the
- result of a function easily customizable. This utility only makes sense for
- functions that accept an argument set and return an attribute set.
-
-
-
- Example usage:
-
-f = { a, b }: { result = a+b; };
-c = lib.makeOverridable f { a = 1; b = 2; };
-
-
-
-
- The variable c is the value of the f
- function applied with some default arguments. Hence the value of
- c.result is 3, in this example.
-
-
-
- The variable c however also has some additional
- functions, like c.override which can
- be used to override the default arguments. In this example the value of
- (c.override { a = 4; }).result is 6.
-
-
-
diff --git a/doc/functions/prefer-remote-fetch.xml b/doc/functions/prefer-remote-fetch.xml
index 3e43fd28ade8c7d36989873af946d2912caaf15b..94d25d3d3aeb69e138a73e2a9d791ed76d675eb6 100644
--- a/doc/functions/prefer-remote-fetch.xml
+++ b/doc/functions/prefer-remote-fetch.xml
@@ -5,16 +5,12 @@
prefer-remote-fetch overlay
- prefer-remote-fetch is an overlay that download sources
- on remote builder. This is useful when the evaluating machine has a slow
- upload while the builder can fetch faster directly from the source. To use
- it, put the following snippet as a new overlay:
+ prefer-remote-fetch is an overlay that download sources on remote builder. This is useful when the evaluating machine has a slow upload while the builder can fetch faster directly from the source. To use it, put the following snippet as a new overlay:
self: super:
(super.prefer-remote-fetch self super)
- A full configuration example for that sets the overlay up for your own
- account, could look like this
+ A full configuration example for that sets the overlay up for your own account, could look like this
$ mkdir ~/.config/nixpkgs/overlays/
$ cat > ~/.config/nixpkgs/overlays/prefer-remote-fetch.nix <<EOF
diff --git a/doc/functions/trivial-builders.xml b/doc/functions/trivial-builders.xml
deleted file mode 100644
index 0211a4f31728141f77f873ceaff0a6c253d3a349..0000000000000000000000000000000000000000
--- a/doc/functions/trivial-builders.xml
+++ /dev/null
@@ -1,113 +0,0 @@
-
- Trivial builders
-
-
- Nixpkgs provides a couple of functions that help with building derivations.
- The most important one, stdenv.mkDerivation, has already
- been documented above. The following functions wrap
- stdenv.mkDerivation, making it easier to use in certain
- cases.
-
-
-
-
-
- runCommand
-
-
-
- This takes three arguments, name,
- env, and buildCommand.
- name is just the name that Nix will append to the store
- path in the same way that stdenv.mkDerivation uses its
- name attribute. env is an attribute
- set specifying environment variables that will be set for this derivation.
- These attributes are then passed to the wrapped
- stdenv.mkDerivation. buildCommand
- specifies the commands that will be run to create this derivation. Note
- that you will need to create $out for Nix to register
- the command as successful.
-
-
- An example of using runCommand is provided below.
-
-
-(import <nixpkgs> {}).runCommand "my-example" {} ''
- echo My example command is running
-
- mkdir $out
-
- echo I can write data to the Nix store > $out/message
-
- echo I can also run basic commands like:
-
- echo ls
- ls
-
- echo whoami
- whoami
-
- echo date
- date
-''
-
-
-
-
-
- runCommandCC
-
-
-
- This works just like runCommand. The only difference is
- that it also provides a C compiler in buildCommand’s
- environment. To minimize your dependencies, you should only use this if
- you are sure you will need a C compiler as part of running your command.
-
-
-
-
-
- writeTextFile, writeText, writeTextDir, writeScript, writeScriptBin
-
-
-
- These functions write text to the Nix store. This is
- useful for creating scripts from Nix expressions.
- writeTextFile takes an attribute set and expects two
- arguments, name and text.
- name corresponds to the name used in the Nix store
- path. text will be the contents of the file. You can
- also set executable to true to make this file have the
- executable bit set.
-
-
- Many more commands wrap writeTextFile including
- writeText, writeTextDir,
- writeScript, and writeScriptBin.
- These are convenience functions over writeTextFile.
-
-
-
-
-
- symlinkJoin
-
-
-
- This can be used to put many derivations into the same directory
- structure. It works by creating a new derivation and adding symlinks to
- each of the paths listed. It expects two arguments,
- name, and paths.
- name is the name used in the Nix store path for the
- created derivation. paths is a list of paths that will
- be symlinked. These paths can be to Nix store derivations or any other
- subdirectory contained within.
-
-
-
-
-
diff --git a/doc/languages-frameworks/android.section.md b/doc/languages-frameworks/android.section.md
index f268c552566028a335a98386883ab2ea13b0e3d7..9a5df2523a25a7dac730a06e5b32a92fc47b2b2a 100644
--- a/doc/languages-frameworks/android.section.md
+++ b/doc/languages-frameworks/android.section.md
@@ -95,7 +95,7 @@ $ nix-build
The Android SDK gets deployed with all desired plugin versions.
-We can also deploy subsets of the Android SDK. For example, to only the the
+We can also deploy subsets of the Android SDK. For example, to only the
`platform-tools` package, you can evaluate the following expression:
```nix
diff --git a/doc/languages-frameworks/beam.xml b/doc/languages-frameworks/beam.xml
index dee7f2d74191eca4a69458be47500329635066ca..278535237c2c6eeec1d8a93b5ee05ca56b2107c3 100644
--- a/doc/languages-frameworks/beam.xml
+++ b/doc/languages-frameworks/beam.xml
@@ -7,12 +7,7 @@
Introduction
- In this document and related Nix expressions, we use the term,
- BEAM, to describe the environment. BEAM is the name of
- the Erlang Virtual Machine and, as far as we're concerned, from a packaging
- perspective, all languages that run on the BEAM are interchangeable. That
- which varies, like the build system, is transparent to users of any given
- BEAM package, so we make no distinction.
+ In this document and related Nix expressions, we use the term, BEAM, to describe the environment. BEAM is the name of the Erlang Virtual Machine and, as far as we're concerned, from a packaging perspective, all languages that run on the BEAM are interchangeable. That which varies, like the build system, is transparent to users of any given BEAM package, so we make no distinction.
@@ -20,57 +15,32 @@
Structure
- All BEAM-related expressions are available via the top-level
- beam attribute, which includes:
+ All BEAM-related expressions are available via the top-level beam attribute, which includes:
- interpreters: a set of compilers running on the BEAM,
- including multiple Erlang/OTP versions
- (beam.interpreters.erlangR19, etc), Elixir
- (beam.interpreters.elixir) and LFE
- (beam.interpreters.lfe).
+ interpreters: a set of compilers running on the BEAM, including multiple Erlang/OTP versions (beam.interpreters.erlangR19, etc), Elixir (beam.interpreters.elixir) and LFE (beam.interpreters.lfe).
- packages: a set of package sets, each compiled with a
- specific Erlang/OTP version, e.g.
- beam.packages.erlangR19.
+ packages: a set of package builders (Mix and rebar3), each compiled with a specific Erlang/OTP version, e.g. beam.packages.erlangR19.
- The default Erlang compiler, defined by
- beam.interpreters.erlang, is aliased as
- erlang. The default BEAM package set is defined by
- beam.packages.erlang and aliased at the top level as
- beamPackages.
+ The default Erlang compiler, defined by beam.interpreters.erlang, is aliased as erlang. The default BEAM package set is defined by beam.packages.erlang and aliased at the top level as beamPackages.
- To create a package set built with a custom Erlang version, use the lambda,
- beam.packagesWith, which accepts an Erlang/OTP derivation
- and produces a package set similar to
- beam.packages.erlang.
+ To create a package builder built with a custom Erlang version, use the lambda, beam.packagesWith, which accepts an Erlang/OTP derivation and produces a package builder similar to beam.packages.erlang.
- Many Erlang/OTP distributions available in
- beam.interpreters have versions with ODBC and/or Java
- enabled. For example, there's
- beam.interpreters.erlangR19_odbc_javac, which corresponds
- to beam.interpreters.erlangR19.
-
-
-
- We also provide the lambda,
- beam.packages.erlang.callPackage, which simplifies
- writing BEAM package definitions by injecting all packages from
- beam.packages.erlang into the top-level context.
+ Many Erlang/OTP distributions available in beam.interpreters have versions with ODBC and/or Java enabled or without wx (no observer support). For example, there's beam.interpreters.erlangR22_odbc_javac, which corresponds to beam.interpreters.erlangR22 and beam.interpreters.erlangR22_nox, which corresponds to beam.interpreters.erlangR22.
@@ -81,28 +51,7 @@
Rebar3
- By default, Rebar3 wants to manage its own dependencies. This is perfectly
- acceptable in the normal, non-Nix setup, but in the Nix world, it is not.
- To rectify this, we provide two versions of Rebar3:
-
-
-
- rebar3: patched to remove the ability to download
- anything. When not running it via nix-shell or
- nix-build, it's probably not going to work as
- desired.
-
-
-
-
- rebar3-open: the normal, unmodified Rebar3. It should
- work exactly as would any other version of Rebar3. Any Erlang package
- should rely on rebar3 instead. See
- .
-
-
-
+ We provide a version of Rebar3, under rebar3. We also provide a helper to fetch Rebar3 dependencies from a lockfile under fetchRebar3Deps.
@@ -110,10 +59,7 @@
Mix & Erlang.mk
- Both Mix and Erlang.mk work exactly as expected. There is a bootstrap
- process that needs to be run for both, however, which is supported by the
- buildMix and buildErlangMk
- derivations, respectively.
+ Both Mix and Erlang.mk work exactly as expected. There is a bootstrap process that needs to be run for both, however, which is supported by the buildMix and buildErlangMk derivations, respectively.
@@ -122,41 +68,14 @@
How to Install BEAM Packages
- BEAM packages are not registered at the top level, simply because they are
- not relevant to the vast majority of Nix users. They are installable using
- the beam.packages.erlang attribute set (aliased as
- beamPackages), which points to packages built by the
- default Erlang/OTP version in Nixpkgs, as defined by
- beam.interpreters.erlang. To list the available packages
- in beamPackages, use the following command:
-
-
-
-$ nix-env -f "<nixpkgs>" -qaP -A beamPackages
-beamPackages.esqlite esqlite-0.2.1
-beamPackages.goldrush goldrush-0.1.7
-beamPackages.ibrowse ibrowse-4.2.2
-beamPackages.jiffy jiffy-0.14.5
-beamPackages.lager lager-3.0.2
-beamPackages.meck meck-0.8.3
-beamPackages.rebar3-pc pc-1.1.0
-
-
-
- To install any of those packages into your profile, refer to them by their
- attribute path (first column):
+ BEAM builders are not registered at the top level, simply because they are not relevant to the vast majority of Nix users.
+ To install any of those builders into your profile, refer to them by their attribute path beamPackages.rebar3:
-
-$ nix-env -f "<nixpkgs>" -iA beamPackages.ibrowse
-
-
-
- The attribute path of any BEAM package corresponds to the name of that
- particular package in Hex or its
- OTP Application/Release name.
-
-
+
+ $ nix-env -f "<nixpkgs>" -iA beamPackages.rebar3
+
+
Packaging BEAM Applications
@@ -168,53 +87,11 @@ beamPackages.rebar3-pc pc-1.1.0
Rebar3 Packages
- The Nix function, buildRebar3, defined in
- beam.packages.erlang.buildRebar3 and aliased at the top
- level, can be used to build a derivation that understands how to build a
- Rebar3 project. For example, we can build
- hex2nix
- as follows:
-
-
-
-{ stdenv, fetchFromGitHub, buildRebar3, ibrowse, jsx, erlware_commons }:
-
-buildRebar3 rec {
- name = "hex2nix";
- version = "0.0.1";
-
- src = fetchFromGitHub {
- owner = "ericbmerritt";
- repo = "hex2nix";
- rev = "${version}";
- sha256 = "1w7xjidz1l5yjmhlplfx7kphmnpvqm67w99hd2m7kdixwdxq0zqg";
- };
-
- beamDeps = [ ibrowse jsx erlware_commons ];
-}
-
-
-
- Such derivations are callable with
- beam.packages.erlang.callPackage (see
- ). To call this package using
- the normal callPackage, refer to dependency packages
- via beamPackages, e.g.
- beamPackages.ibrowse.
-
-
-
- Notably, buildRebar3 includes
- beamDeps, while stdenv.mkDerivation
- does not. BEAM dependencies added there will be correctly handled by the
- system.
+ The Nix function, buildRebar3, defined in beam.packages.erlang.buildRebar3 and aliased at the top level, can be used to build a derivation that understands how to build a Rebar3 project.
- If a package needs to compile native code via Rebar3's port compilation
- mechanism, add compilePort = true; to the derivation.
+ If a package needs to compile native code via Rebar3's port compilation mechanism, add compilePort = true; to the derivation.
@@ -222,96 +99,21 @@ buildRebar3 rec {
Erlang.mk Packages
- Erlang.mk functions similarly to Rebar3, except we use
- buildErlangMk instead of
- buildRebar3.
+ Erlang.mk functions similarly to Rebar3, except we use buildErlangMk instead of buildRebar3.
-
-{ buildErlangMk, fetchHex, cowlib, ranch }:
-
-buildErlangMk {
- name = "cowboy";
- version = "1.0.4";
-
- src = fetchHex {
- pkg = "cowboy";
- version = "1.0.4";
- sha256 = "6a0edee96885fae3a8dd0ac1f333538a42e807db638a9453064ccfdaa6b9fdac";
- };
-
- beamDeps = [ cowlib ranch ];
-
- meta = {
- description = ''
- Small, fast, modular HTTP server written in Erlang
- '';
- license = stdenv.lib.licenses.isc;
- homepage = https://github.com/ninenines/cowboy;
- };
-}
-Mix Packages
- Mix functions similarly to Rebar3, except we use
- buildMix instead of buildRebar3.
+ Mix functions similarly to Rebar3, except we use buildMix instead of buildRebar3.
-
-{ buildMix, fetchHex, plug, absinthe }:
-
-buildMix {
- name = "absinthe_plug";
- version = "1.0.0";
-
- src = fetchHex {
- pkg = "absinthe_plug";
- version = "1.0.0";
- sha256 = "08459823fe1fd4f0325a8bf0c937a4520583a5a26d73b193040ab30a1dfc0b33";
- };
-
- beamDeps = [ plug absinthe ];
-
- meta = {
- description = ''
- A plug for Absinthe, an experimental GraphQL toolkit
- '';
- license = stdenv.lib.licenses.bsd3;
- homepage = https://github.com/CargoSense/absinthe_plug;
- };
-}
-
-
Alternatively, we can use buildHex as a shortcut:
-
-
-{ buildHex, buildMix, plug, absinthe }:
-
-buildHex {
- name = "absinthe_plug";
- version = "1.0.0";
-
- sha256 = "08459823fe1fd4f0325a8bf0c937a4520583a5a26d73b193040ab30a1dfc0b33";
-
- builder = buildMix;
-
- beamDeps = [ plug absinthe ];
-
- meta = {
- description = ''
- A plug for Absinthe, an experimental GraphQL toolkit
- '';
- license = stdenv.lib.licenses.bsd3;
- homepage = https://github.com/CargoSense/absinthe_plug;
- };
-}
-
@@ -319,75 +121,13 @@ buildHex {
How to Develop
-
- Accessing an Environment
-
-
- Often, we simply want to access a valid environment that contains a
- specific package and its dependencies. We can accomplish that with the
- env attribute of a derivation. For example, let's say we
- want to access an Erlang REPL with ibrowse loaded up. We
- could do the following:
-
-
-
-$ nix-shell -A beamPackages.ibrowse.env --run "erl"
-Erlang/OTP 18 [erts-7.0] [source] [64-bit] [smp:4:4] [async-threads:10] [hipe] [kernel-poll:false]
-
-Eshell V7.0 (abort with ^G)
-1> m(ibrowse).
-Module: ibrowse
-MD5: 3b3e0137d0cbb28070146978a3392945
-Compiled: January 10 2016, 23:34
-Object file: /nix/store/g1rlf65rdgjs4abbyj4grp37ry7ywivj-ibrowse-4.2.2/lib/erlang/lib/ibrowse-4.2.2/ebin/ibrowse.beam
-Compiler options: [{outdir,"/tmp/nix-build-ibrowse-4.2.2.drv-0/hex-source-ibrowse-4.2.2/_build/default/lib/ibrowse/ebin"},
-debug_info,debug_info,nowarn_shadow_vars,
-warn_unused_import,warn_unused_vars,warnings_as_errors,
-{i,"/tmp/nix-build-ibrowse-4.2.2.drv-0/hex-source-ibrowse-4.2.2/_build/default/lib/ibrowse/include"}]
-Exports:
-add_config/1 send_req_direct/7
-all_trace_off/0 set_dest/3
-code_change/3 set_max_attempts/3
-get_config_value/1 set_max_pipeline_size/3
-get_config_value/2 set_max_sessions/3
-get_metrics/0 show_dest_status/0
-get_metrics/2 show_dest_status/1
-handle_call/3 show_dest_status/2
-handle_cast/2 spawn_link_worker_process/1
-handle_info/2 spawn_link_worker_process/2
-init/1 spawn_worker_process/1
-module_info/0 spawn_worker_process/2
-module_info/1 start/0
-rescan_config/0 start_link/0
-rescan_config/1 stop/0
-send_req/3 stop_worker_process/1
-send_req/4 stream_close/1
-send_req/5 stream_next/1
-send_req/6 terminate/2
-send_req_direct/4 trace_off/0
-send_req_direct/5 trace_off/2
-send_req_direct/6 trace_on/0
-trace_on/2
-ok
-2>
-
-
-
- Notice the -A beamPackages.ibrowse.env. That is the key
- to this functionality.
-
-
-
Creating a Shell
-
- Getting access to an environment often isn't enough to do real development.
- Usually, we need to create a shell.nix file and do our
- development inside of the environment specified therein. This file looks a
- lot like the packaging described above, except that src
- points to the project root and we call the package directly.
-
+
+ Usually, we need to create a shell.nix file and do our development inside of the environment specified therein. Just install your version of erlang and other interpreter, and then user your normal build tools.
+ As an example with elixir:
+
{ pkgs ? import "<nixpkgs"> {} }:
@@ -396,133 +136,24 @@ with pkgs;
let
- f = { buildRebar3, ibrowse, jsx, erlware_commons }:
- buildRebar3 {
- name = "hex2nix";
- version = "0.1.0";
- src = ./.;
- beamDeps = [ ibrowse jsx erlware_commons ];
- };
- drv = beamPackages.callPackage f {};
+ elixir = beam.packages.erlangR22.elixir_1_9;
in
+mkShell {
+ buildInputs = [ elixir ];
- drv
+ ERL_INCLUDE_PATH="${erlang}/lib/erlang/usr/include";
+}
Building in a Shell (for Mix Projects)
- We can leverage the support of the derivation, irrespective of the build
- derivation, by calling the commands themselves.
-
-
-
-# =============================================================================
-# Variables
-# =============================================================================
-
-NIX_TEMPLATES := "$(CURDIR)/nix-templates"
-
-TARGET := "$(PREFIX)"
-
-PROJECT_NAME := thorndyke
-
-NIXPKGS=../nixpkgs
-NIX_PATH=nixpkgs=$(NIXPKGS)
-NIX_SHELL=nix-shell -I "$(NIX_PATH)" --pure
-# =============================================================================
-# Rules
-# =============================================================================
-.PHONY= all test clean repl shell build test analyze configure install \
- test-nix-install publish plt analyze
-
-all: build
-
-guard-%:
- @ if [ "${${*}}" == "" ]; then \
- echo "Environment variable $* not set"; \
- exit 1; \
- fi
-
-clean:
- rm -rf _build
- rm -rf .cache
-
-repl:
- $(NIX_SHELL) --run "iex -pa './_build/prod/lib/*/ebin'"
-
-shell:
- $(NIX_SHELL)
-
-configure:
- $(NIX_SHELL) --command 'eval "$$configurePhase"'
-
-build: configure
- $(NIX_SHELL) --command 'eval "$$buildPhase"'
-
-install:
- $(NIX_SHELL) --command 'eval "$$installPhase"'
-
-test:
- $(NIX_SHELL) --command 'mix test --no-start --no-deps-check'
-
-plt:
- $(NIX_SHELL) --run "mix dialyzer.plt --no-deps-check"
-
-analyze: build plt
- $(NIX_SHELL) --run "mix dialyzer --no-compile"
-
-
-
-
- Using a shell.nix as described (see
- ) should just work. Aside from
- test, plt, and
- analyze, the Make targets work just fine for all of the
- build derivations.
+ Using a shell.nix as described (see ) should just work.
-
-
- Generating Packages from Hex with hex2nix
-
-
- Updating the Hex package set
- requires
- hex2nix.
- Given the path to the Erlang modules (usually
- pkgs/development/erlang-modules), it will dump a file
- called hex-packages.nix, containing all the packages that
- use a recognized build system in
- Hex. It can't be determined,
- however, whether every package is buildable.
-
-
-
- To make life easier for our users, try to build every
- Hex package and remove those
- that fail. To do that, simply run the following command in the root of your
- nixpkgs repository:
-
-
-
-$ nix-build -A beamPackages
-
-
-
- That will attempt to build every package in beamPackages.
- Then manually remove those that fail. Hopefully, someone will improve
- hex2nix
- in the future to automate the process.
-
-
diff --git a/doc/languages-frameworks/bower.xml b/doc/languages-frameworks/bower.xml
index 118f6e10473ab855aa7cb09b9d9bd8d004cf9811..b0738cad293bcc25b5775f0b576e2d0fadf8519e 100644
--- a/doc/languages-frameworks/bower.xml
+++ b/doc/languages-frameworks/bower.xml
@@ -4,32 +4,22 @@
Bower
- Bower is a package manager for web
- site front-end components. Bower packages (comprising of build artefacts and
- sometimes sources) are stored in git repositories,
- typically on Github. The package registry is run by the Bower team with
- package metadata coming from the bower.json file within
- each package.
+ Bower is a package manager for web site front-end components. Bower packages (comprising of build artefacts and sometimes sources) are stored in git repositories, typically on Github. The package registry is run by the Bower team with package metadata coming from the bower.json file within each package.
- The end result of running Bower is a bower_components
- directory which can be included in the web app's build process.
+ The end result of running Bower is a bower_components directory which can be included in the web app's build process.
- Bower can be run interactively, by installing
- nodePackages.bower. More interestingly, the Bower
- components can be declared in a Nix derivation, with the help of
- nodePackages.bower2nix.
+ Bower can be run interactively, by installing nodePackages.bower. More interestingly, the Bower components can be declared in a Nix derivation, with the help of nodePackages.bower2nix.
bower2nix usage
- Suppose you have a bower.json with the following
- contents:
+ Suppose you have a bower.json with the following contents:
bower.json
@@ -45,8 +35,7 @@
- Running bower2nix will produce something like the
- following output:
+ Running bower2nix will produce something like the following output:
- Using the bower2nix command line arguments, the output
- can be redirected to a file. A name like
- bower-packages.nix would be fine.
+ Using the bower2nix command line arguments, the output can be redirected to a file. A name like bower-packages.nix would be fine.
- The resulting derivation is a union of all the downloaded Bower packages
- (and their dependencies). To use it, they still need to be linked together
- by Bower, which is where buildBowerComponents is useful.
+ The resulting derivation is a union of all the downloaded Bower packages (and their dependencies). To use it, they still need to be linked together by Bower, which is where buildBowerComponents is useful.
@@ -74,10 +59,7 @@ buildEnv { name = "bower-env"; ignoreCollisions = true; paths = [
buildBowerComponents function
- The function is implemented in
-
- pkgs/development/bower-modules/generic/default.nix.
- Example usage:
+ The function is implemented in pkgs/development/bower-modules/generic/default.nix. Example usage:
buildBowerComponents
@@ -91,34 +73,27 @@ bowerComponents = buildBowerComponents {
- In , the following arguments are
- of special significance to the function:
+ In , the following arguments are of special significance to the function:
- generated specifies the file which was created by
- bower2nix.
+ generated specifies the file which was created by bower2nix.
- src is your project's sources. It needs to contain a
- bower.json file.
+ src is your project's sources. It needs to contain a bower.json file.
- buildBowerComponents will run Bower to link together the
- output of bower2nix, resulting in a
- bower_components directory which can be used.
+ buildBowerComponents will run Bower to link together the output of bower2nix, resulting in a bower_components directory which can be used.
- Here is an example of a web frontend build process using
- gulp. You might use grunt, or anything
- else.
+ Here is an example of a web frontend build process using gulp. You might use grunt, or anything else.
@@ -174,21 +149,17 @@ pkgs.stdenv.mkDerivation {
- The result of buildBowerComponents is an input to the
- frontend build.
+ The result of buildBowerComponents is an input to the frontend build.
- Whether to symlink or copy the bower_components
- directory depends on the build tool in use. In this case a copy is used
- to avoid gulp silliness with permissions.
+ Whether to symlink or copy the bower_components directory depends on the build tool in use. In this case a copy is used to avoid gulp silliness with permissions.
- gulp requires HOME to refer to a
- writeable directory.
+ gulp requires HOME to refer to a writeable directory.
@@ -210,17 +181,13 @@ pkgs.stdenv.mkDerivation {
- This means that Bower was looking for a package version which doesn't
- exist in the generated bower-packages.nix.
+ This means that Bower was looking for a package version which doesn't exist in the generated bower-packages.nix.
- If bower.json has been updated, then run
- bower2nix again.
+ If bower.json has been updated, then run bower2nix again.
- It could also be a bug in bower2nix or
- fetchbower. If possible, try reformulating the version
- specification in bower.json.
+ It could also be a bug in bower2nix or fetchbower. If possible, try reformulating the version specification in bower.json.
diff --git a/doc/languages-frameworks/coq.xml b/doc/languages-frameworks/coq.xml
index 4314df5c9df29e602d4749c65e4cf2f1340a9d5f..86d9226166f5959d97ac5d271a6f01e796a609a1 100644
--- a/doc/languages-frameworks/coq.xml
+++ b/doc/languages-frameworks/coq.xml
@@ -4,31 +4,19 @@
Coq
- Coq libraries should be installed in
- $(out)/lib/coq/${coq.coq-version}/user-contrib/. Such
- directories are automatically added to the $COQPATH
- environment variable by the hook defined in the Coq derivation.
+ Coq libraries should be installed in $(out)/lib/coq/${coq.coq-version}/user-contrib/. Such directories are automatically added to the $COQPATH environment variable by the hook defined in the Coq derivation.
- Some extensions (plugins) might require OCaml and sometimes other OCaml
- packages. The coq.ocamlPackages attribute can be used to
- depend on the same package set Coq was built against.
+ Some extensions (plugins) might require OCaml and sometimes other OCaml packages. The coq.ocamlPackages attribute can be used to depend on the same package set Coq was built against.
- Coq libraries may be compatible with some specific versions of Coq only. The
- compatibleCoqVersions attribute is used to precisely
- select those versions of Coq that are compatible with this derivation.
+ Coq libraries may be compatible with some specific versions of Coq only. The compatibleCoqVersions attribute is used to precisely select those versions of Coq that are compatible with this derivation.
- Here is a simple package example. It is a pure Coq library, thus it depends
- on Coq. It builds on the Mathematical Components library, thus it also takes
- mathcomp as buildInputs. Its
- Makefile has been generated using
- coq_makefile so we only have to set the
- $COQLIB variable at install time.
+ Here is a simple package example. It is a pure Coq library, thus it depends on Coq. It builds on the Mathematical Components library, thus it also takes mathcomp as buildInputs. Its Makefile has been generated using coq_makefile so we only have to set the $COQLIB variable at install time.
diff --git a/doc/languages-frameworks/emscripten.section.md b/doc/languages-frameworks/emscripten.section.md
index 24c49ec1409c2b20005776b5613d1b42279445a8..80e1094809ade19662a0b8e01c952fe922797f91 100644
--- a/doc/languages-frameworks/emscripten.section.md
+++ b/doc/languages-frameworks/emscripten.section.md
@@ -1,4 +1,4 @@
-# User's Guide to Emscripten in Nixpkgs
+# Emscripten
[Emscripten](https://github.com/kripken/emscripten): An LLVM-to-JavaScript Compiler
diff --git a/doc/languages-frameworks/gnome.xml b/doc/languages-frameworks/gnome.xml
new file mode 100644
index 0000000000000000000000000000000000000000..bb68d026ae23f6db62972bfe691fbe453e60ebf1
--- /dev/null
+++ b/doc/languages-frameworks/gnome.xml
@@ -0,0 +1,282 @@
+
+ GNOME
+
+
+ Packaging GNOME applications
+
+
+ Programs in the GNOME universe are written in various languages but they all use GObject-based libraries like GLib, GTK or GStreamer. These libraries are often modular, relying on looking into certain directories to find their modules. However, due to Nix’s specific file system organization, this will fail without our intervention. Fortunately, the libraries usually allow overriding the directories through environment variables, either natively or thanks to a patch in nixpkgs. Wrapping the executables to ensure correct paths are available to the application constitutes a significant part of packaging a modern desktop application. In this section, we will describe various modules needed by such applications, environment variables needed to make the modules load, and finally a script that will do the work for us.
+
+
+
+ Settings
+
+
+ GSettings API is often used for storing settings. GSettings schemas are required, to know the type and other metadata of the stored values. GLib looks for glib-2.0/schemas/gschemas.compiled files inside the directories of XDG_DATA_DIRS.
+
+
+
+ On Linux, GSettings API is implemented using dconf backend. You will need to add dconf GIO module to GIO_EXTRA_MODULES variable, otherwise the memory backend will be used and the saved settings will not be persistent.
+
+
+
+ Last you will need the dconf database D-Bus service itself. You can enable it using .
+
+
+
+ Some applications will also require gsettings-desktop-schemas for things like reading proxy configuration or user interface customization. This dependency is often not mentioned by upstream, you should grep for org.gnome.desktop and org.gnome.system to see if the schemas are needed.
+
+
+
+
+ Icons
+
+
+ When an application uses icons, an icon theme should be available in XDG_DATA_DIRS during runtime. The package for the default, icon-less hicolor-icon-theme (should be propagated by every icon theme) contains a setup hook that will pick up icon themes from buildInputs and pass it to our wrapper. Unfortunately, relying on that would mean every user has to download the theme included in the package expression no matter their preference. For that reason, we leave the installation of icon theme on the user. If you use one of the desktop environments, you probably already have an icon theme installed.
+
+
+
+ To avoid costly file system access when locating icons, GTK, as well as Qt, can rely on icon-theme.cache files from the themes’ top-level directories. These files are generated using gtk-update-icon-cache, which is expected to be run whenever an icon is added or removed to an icon theme (typically an application icon into hicolor theme) and some programs do indeed run this after icon installation. However, since packages are installed into their own prefix by Nix, this would lead to conflicts. For that reason, gtk3 provides a setup hook that will clean the file from installation. Since most applications only ship their own icon that will be loaded on start-up, it should not affect them too much. On the other hand, icon themes are much larger and more widely used so we need to cache them. Because we recommend installing icon themes globally, we will generate the cache files from all packages in a profile using a NixOS module. You can enable the cache generation using option if your desktop environment does not already do that.
+
+
+
+
+ GTK Themes
+
+
+ Previously, a GTK theme needed to be in XDG_DATA_DIRS. This is no longer necessary for most programs since GTK incorporated Adwaita theme. Some programs (for example, those designed for elementary HIG) might require a special theme like pantheon.elementary-gtk-theme.
+
+
+
+
+ GObject introspection typelibs
+
+
+ GObject introspection allows applications to use C libraries in other languages easily. It does this through typelib files searched in GI_TYPELIB_PATH.
+
+
+
+
+ Various plug-ins
+
+
+ If your application uses GStreamer or Grilo, you should set GST_PLUGIN_SYSTEM_PATH_1_0 and GRL_PLUGIN_PATH, respectively.
+
+
+
+
+
+ Onto wrapGAppsHook
+
+
+ Given the requirements above, the package expression would become messy quickly:
+
+preFixup = ''
+ for f in $(find $out/bin/ $out/libexec/ -type f -executable); do
+ wrapProgram "$f" \
+ --prefix GIO_EXTRA_MODULES : "${getLib dconf}/lib/gio/modules" \
+ --prefix XDG_DATA_DIRS : "$out/share" \
+ --prefix XDG_DATA_DIRS : "$out/share/gsettings-schemas/${name}" \
+ --prefix XDG_DATA_DIRS : "${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}" \
+ --prefix XDG_DATA_DIRS : "${hicolor-icon-theme}/share" \
+ --prefix GI_TYPELIB_PATH : "${lib.makeSearchPath "lib/girepository-1.0" [ pango json-glib ]}"
+ done
+'';
+
+ Fortunately, there is wrapGAppsHook, that does the wrapping for us. In particular, it works in conjunction with other setup hooks that will populate the variable:
+
+
+
+ wrapGAppsHook itself will add the package’s share directory to XDG_DATA_DIRS.
+
+
+
+
+ glib setup hook will populate GSETTINGS_SCHEMAS_PATH and then wrapGAppsHook will prepend it to XDG_DATA_DIRS.
+
+
+
+
+ One of gtk3’s setup hooks will remove icon-theme.cache files from package’s icon theme directories to avoid conflicts. Icon theme packages should prevent this with dontDropIconThemeCache = true;.
+
+
+
+
+ dconf.lib is a dependency of wrapGAppsHook, which then also adds it to the GIO_EXTRA_MODULES variable.
+
+
+
+
+ hicolor-icon-theme’s setup hook will add icon themes to XDG_ICON_DIRS which is prepended to XDG_DATA_DIRS by wrapGAppsHook.
+
+
+
+
+ gobject-introspection setup hook populates GI_TYPELIB_PATH variable with lib/girepository-1.0 directories of dependencies, which is then added to wrapper by wrapGAppsHook. It also adds share directories of dependencies to XDG_DATA_DIRS, which is intended to promote GIR files but it also pollutes the closures of packages using wrapGAppsHook.
+
+
+
+ The setup hook currently does not work in expressions with strictDeps enabled, like Python packages. In those cases, you will need to disable it with strictDeps = false;.
+
+
+
+
+
+ Setup hooks of gst_all_1.gstreamer and gnome3.grilo will populate the GST_PLUGIN_SYSTEM_PATH_1_0 and GRL_PLUGIN_PATH variables, respectively, which will then be added to the wrapper by wrapGAppsHook.
+
+
+
+
+
+
+ You can also pass additional arguments to makeWrapper using gappsWrapperArgs in preFixup hook:
+
+preFixup = ''
+ gappsWrapperArgs+=(
+ # Thumbnailers
+ --prefix XDG_DATA_DIRS : "${gdk-pixbuf}/share"
+ --prefix XDG_DATA_DIRS : "${librsvg}/share"
+ --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
+ )
+'';
+
+
+
+
+
+ Updating GNOME packages
+
+
+ Most GNOME package offer updateScript, it is therefore possible to update to latest source tarball by running nix-shell maintainers/scripts/update.nix --argstr package gnome3.nautilus or even en masse with nix-shell maintainers/scripts/update.nix --argstr path gnome3. Read the package’s NEWS file to see what changed.
+
+
+
+
+ Frequently encountered issues
+
+
+
+
+ GLib-GIO-ERROR **: 06:04:50.903: No GSettings schemas are installed on the system
+
+
+
+ There are no schemas avalable in XDG_DATA_DIRS. Temporarily add a random package containing schemas like gsettings-desktop-schemas to buildInputs. glib and wrapGAppsHook setup hooks will take care of making the schemas available to application and you will see the actual missing schemas with the next error. Or you can try looking through the source code for the actual schemas used.
+
+
+
+
+
+ GLib-GIO-ERROR **: 06:04:50.903: Settings schema ‘org.gnome.foo’ is not installed
+
+
+
+ Package is missing some GSettings schemas. You can find out the package containing the schema with nix-locate org.gnome.foo.gschema.xml and let the hooks handle the wrapping as above.
+
+
+
+
+
+ When using wrapGAppsHook with special derivers you can end up with double wrapped binaries.
+
+
+
+ This is because derivers like python.pkgs.buildPythonApplication or qt5.mkDerivation have setup-hooks automatically added that produce wrappers with makeWrapper. The simplest way to workaround that is to disable the wrapGAppsHook automatic wrapping with dontWrapGApps = true; and pass the arguments it intended to pass to makeWrapper to another.
+
+
+ In the case of a Python application it could look like:
+
+python3.pkgs.buildPythonApplication {
+ pname = "gnome-music";
+ version = "3.32.2";
+
+ nativeBuildInputs = [
+ wrapGAppsHook
+ gobject-introspection
+ ...
+ ];
+
+ dontWrapGApps = true;
+
+ # Arguments to be passed to `makeWrapper`, only used by buildPython*
+ preFixup = ''
+ makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+ '';
+}
+
+ And for a QT app like:
+
+mkDerivation {
+ pname = "calibre";
+ version = "3.47.0";
+
+ nativeBuildInputs = [
+ wrapGAppsHook
+ qmake
+ ...
+ ];
+
+ dontWrapGApps = true;
+
+ # Arguments to be passed to `makeWrapper`, only used by qt5’s mkDerivation
+ preFixup = ''
+ qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+ '';
+}
+
+
+
+
+
+
+ I am packaging a project that cannot be wrapped, like a library or GNOME Shell extension.
+
+
+
+ You can rely on applications depending on the library set the necessary environment variables but that it often easy to miss. Instead we recommend to patch the paths in the source code whenever possible. Here are some examples:
+
+
+
+ Replacing a GI_TYPELIB_PATH in GNOME Shell extension – we are using substituteAll to include the path to a typelib into a patch.
+
+
+
+
+ The following examples are hardcoding GSettings schema paths. To get the schema paths we use the functions
+
+
+
+ glib.getSchemaPath Takes a nix package attribute as an argument.
+
+
+
+
+ glib.makeSchemaPath Takes a package output like $out and a derivation name. You should use this if the schemas you need to hardcode are in the same derivation.
+
+
+
+
+
+ Hard-coding GSettings schema path in Vala plug-in (dynamically loaded library) – here, substituteAll cannot be used since the schema comes from the same package preventing us from pass its path to the function, probably due to a Nix bug.
+
+
+ Hard-coding GSettings schema path in C library – nothing special other than using Coccinelle patch to generate the patch itself.
+
+
+
+
+
+
+
+
+ I need to wrap a binary outside bin and libexec directories.
+
+
+
+ You can manually trigger the wrapping with wrapGApp in preFixup phase. It takes a path to a program as a first argument; the remaining arguments are passed directly to wrapProgram function.
+
+
+
+
+
+
diff --git a/doc/languages-frameworks/go.xml b/doc/languages-frameworks/go.xml
index b2b4962cb5f633666b65b10270cf6c2675b50a5d..53c891e66f876e0ac40bcb8f2fb9ddb0bd04d378 100644
--- a/doc/languages-frameworks/go.xml
+++ b/doc/languages-frameworks/go.xml
@@ -7,21 +7,16 @@
Go modules
- The function buildGoModule builds Go programs managed
- with Go modules. It builds a
- Go
- modules through a two phase build:
+ The function buildGoModule builds Go programs managed with Go modules. It builds a Go modules through a two phase build:
- An intermediate fetcher derivation. This derivation will be used to fetch
- all of the dependencies of the Go module.
+ An intermediate fetcher derivation. This derivation will be used to fetch all of the dependencies of the Go module.
- A final derivation will use the output of the intermediate derivation to
- build the binaries and produce the final output.
+ A final derivation will use the output of the intermediate derivation to build the binaries and produce the final output.
@@ -31,7 +26,7 @@
buildGoModule
pet = buildGoModule rec {
- name = "pet-${version}";
+ pname = "pet";
version = "0.3.4";
src = fetchFromGitHub {
@@ -57,40 +52,43 @@ pet = buildGoModule rec {
- is an example expression using
- buildGoModule, the following arguments are of special significance to the
- function:
+ is an example expression using buildGoModule, the following arguments are of special significance to the function:
- modSha256 is the hash of the output of the
- intermediate fetcher derivation.
+ modSha256 is the hash of the output of the intermediate fetcher derivation.
- subPackages limits the builder from building child
- packages that have not been listed. If subPackages is
- not specified, all child packages will be built.
+ subPackages limits the builder from building child packages that have not been listed. If subPackages is not specified, all child packages will be built.
+
+
+ modSha256 can also take null as an input.
+
+ When `null` is used as a value, the derivation won't be a
+ fixed-output derivation but disable the build sandbox instead. This can be useful outside
+ of nixpkgs where re-generating the modSha256 on each mod.sum changes is cumbersome,
+ but will fail to build by Hydra, as builds with a disabled sandbox are discouraged.
+ Go legacy
- The function buildGoPackage builds legacy Go programs,
- not supporting Go modules.
+ The function buildGoPackage builds legacy Go programs, not supporting Go modules.
buildGoPackage
deis = buildGoPackage rec {
- name = "deis-${version}";
+ pname = "deis";
version = "1.13.0";
goPackagePath = "github.com/deis/deis";
@@ -111,49 +109,36 @@ deis = buildGoPackage rec {
- is an example expression using
- buildGoPackage, the following arguments are of special significance to the
- function:
+ is an example expression using buildGoPackage, the following arguments are of special significance to the function:
- goPackagePath specifies the package's canonical Go
- import path.
+ goPackagePath specifies the package's canonical Go import path.
- subPackages limits the builder from building child
- packages that have not been listed. If subPackages is
- not specified, all child packages will be built.
+ subPackages limits the builder from building child packages that have not been listed. If subPackages is not specified, all child packages will be built.
- In this example only github.com/deis/deis/client will
- be built.
+ In this example only github.com/deis/deis/client will be built.
- goDeps is where the Go dependencies of a Go program
- are listed as a list of package source identified by Go import path. It
- could be imported as a separate deps.nix file for
- readability. The dependency data structure is described below.
+ goDeps is where the Go dependencies of a Go program are listed as a list of package source identified by Go import path. It could be imported as a separate deps.nix file for readability. The dependency data structure is described below.
- buildFlags is a list of flags passed to the go build
- command.
+ buildFlags is a list of flags passed to the go build command.
- The goDeps attribute can be imported from a separate
- nix file that defines which Go libraries are needed and
- should be included in GOPATH for
- buildPhase.
+ The goDeps attribute can be imported from a separate nix file that defines which Go libraries are needed and should be included in GOPATH for buildPhase.
@@ -196,27 +181,18 @@ deis = buildGoPackage rec {
- fetch type that needs to be used to get package
- source. If git is used there should be
- url, rev and
- sha256 defined next to it.
+ fetch type that needs to be used to get package source. If git is used there should be url, rev and sha256 defined next to it.
- To extract dependency information from a Go package in automated way use
- go2nix. It can
- produce complete derivation and goDeps file for Go
- programs.
+ To extract dependency information from a Go package in automated way use go2nix. It can produce complete derivation and goDeps file for Go programs.
- buildGoPackage produces
- where
- bin includes program binaries. You can test build a Go
- binary as follows:
+ buildGoPackage produces where bin includes program binaries. You can test build a Go binary as follows:
$ nix-build -A deis.bin
@@ -224,13 +200,11 @@ deis = buildGoPackage rec {
$ nix-build -A deis.all
- bin output will be installed by default with
- nix-env -i or systemPackages.
+ bin output will be installed by default with nix-env -i or systemPackages.
- You may use Go packages installed into the active Nix profiles by adding the
- following to your ~/.bashrc:
+ You may use Go packages installed into the active Nix profiles by adding the following to your ~/.bashrc:
for p in $NIX_PROFILES; do
GOPATH="$p/share/go:$GOPATH"
diff --git a/doc/languages-frameworks/haskell.section.md b/doc/languages-frameworks/haskell.section.md
index 48d22831cd9b01de19b45d6d4908823cc87c3f00..be5c7b7c8d162dc0450a6e2eaa506987f46f449c 100644
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@@ -3,7 +3,7 @@ title: User's Guide for Haskell in Nixpkgs
author: Peter Simons
date: 2015-06-01
---
-# User's Guide to the Haskell Infrastructure
+# Haskell
## How to install Haskell packages
@@ -25,14 +25,14 @@ avoided that by keeping all Haskell-related packages in a separate attribute
set called `haskellPackages`, which the following command will list:
```
$ nix-env -f "" -qaP -A haskellPackages
-haskellPackages.a50 a50-0.5
-haskellPackages.abacate haskell-abacate-0.0.0.0
-haskellPackages.abcBridge haskell-abcBridge-0.12
-haskellPackages.afv afv-0.1.1
-haskellPackages.alex alex-3.1.4
-haskellPackages.Allure Allure-0.4.101.1
-haskellPackages.alms alms-0.6.7
-[... some 8000 entries omitted ...]
+haskellPackages.a50 a50-0.5
+haskellPackages.AAI AAI-0.2.0.1
+haskellPackages.abacate abacate-0.0.0.0
+haskellPackages.abc-puzzle abc-puzzle-0.2.1
+haskellPackages.abcBridge abcBridge-0.15
+haskellPackages.abcnotation abcnotation-1.9.0
+haskellPackages.abeson abeson-0.1.0.1
+[... some 14000 entries omitted ...]
```
To install any of those packages into your profile, refer to them by their
@@ -101,19 +101,21 @@ to compile your Haskell packages with any GHC version you please. The following
command displays the complete list of available compilers:
```
$ nix-env -f "" -qaP -A haskell.compiler
-haskell.compiler.ghc6104 ghc-6.10.4
-haskell.compiler.ghc6123 ghc-6.12.3
-haskell.compiler.ghc704 ghc-7.0.4
-haskell.compiler.ghc722 ghc-7.2.2
-haskell.compiler.ghc742 ghc-7.4.2
-haskell.compiler.ghc763 ghc-7.6.3
-haskell.compiler.ghc784 ghc-7.8.4
-haskell.compiler.ghc7102 ghc-7.10.2
-haskell.compiler.ghcHEAD ghc-7.11.20150402
-haskell.compiler.ghcNokinds ghc-nokinds-7.11.20150704
-haskell.compiler.ghcjs ghcjs-0.1.0
-haskell.compiler.jhc jhc-0.8.2
-haskell.compiler.uhc uhc-1.1.9.0
+haskell.compiler.ghc822 ghc-8.2.2
+haskell.compiler.integer-simple.ghc822 ghc-8.2.2
+haskell.compiler.ghc822Binary ghc-8.2.2-binary
+haskell.compiler.ghc844 ghc-8.4.4
+haskell.compiler.ghc863Binary ghc-8.6.3-binary
+haskell.compiler.ghc864 ghc-8.6.4
+haskell.compiler.integer-simple.ghc864 ghc-8.6.4
+haskell.compiler.ghc865 ghc-8.6.5
+haskell.compiler.integer-simple.ghc865 ghc-8.6.5
+haskell.compiler.ghc881 ghc-8.8.1
+haskell.compiler.integer-simple.ghc881 ghc-8.8.1
+haskell.compiler.ghcHEAD ghc-8.9.20190601
+haskell.compiler.integer-simple.ghcHEAD ghc-8.9.20190601
+haskell.compiler.ghcjs84 ghcjs-8.4.0.1
+haskell.compiler.ghcjs ghcjs-8.6.0.1
```
We have no package sets for `jhc` or `uhc` yet, unfortunately, but for every
@@ -398,7 +400,9 @@ nix:
For more on how to write a `shell.nix` file see the below section. You'll need
to express a derivation. Note that Nixpkgs ships with a convenience wrapper
function around `mkDerivation` called `haskell.lib.buildStackProject` to help you
-create this derivation in exactly the way Stack expects. All of the same inputs
+create this derivation in exactly the way Stack expects. However for this to work
+you need to disable the sandbox, which you can do by using `--option sandbox relaxed`
+or `--option sandbox false` to the Nix command. All of the same inputs
as `mkDerivation` can be provided. For example, to build a Stack project that
including packages that link against a version of the R library compiled with
special options turned on:
diff --git a/doc/languages-frameworks/idris.section.md b/doc/languages-frameworks/idris.section.md
index e88015f08e3f872cf3fbff0eb6d3ac877581a27a..8d7962d7fb9b2224e5302fd7835b2da4957e1c15 100644
--- a/doc/languages-frameworks/idris.section.md
+++ b/doc/languages-frameworks/idris.section.md
@@ -1,4 +1,4 @@
-# Idris packages
+# Idris
## Installing Idris
diff --git a/doc/languages-frameworks/index.xml b/doc/languages-frameworks/index.xml
index cd4e95cfae69a699d8d6d843c33958882a3da7de..9364c764bbf9f82dcf85061a7a24d4c43fabc1fb 100644
--- a/doc/languages-frameworks/index.xml
+++ b/doc/languages-frameworks/index.xml
@@ -1,19 +1,17 @@
- Support for specific programming languages and frameworks
+ Languages and frameworks
- The standard build environment makes it
- easy to build typical Autotools-based packages with very little code. Any
- other kind of package can be accomodated by overriding the appropriate phases
- of stdenv. However, there are specialised functions in
- Nixpkgs to easily build packages for other programming languages, such as
- Perl or Haskell. These are described in this chapter.
+ The standard build environment makes it easy to build typical Autotools-based packages with very little code. Any other kind of package can be accomodated by overriding the appropriate phases of stdenv. However, there are specialised functions in Nixpkgs to easily build packages for other programming languages, such as Perl or Haskell. These are described in this chapter.
+
+
+
@@ -31,6 +29,4 @@
-
-
diff --git a/doc/languages-frameworks/ios.section.md b/doc/languages-frameworks/ios.section.md
index 6684b809ffe614e1318f235c8c3e0e6de4505152..5a81795c004a50e7051601135e230df4e7b407f9 100644
--- a/doc/languages-frameworks/ios.section.md
+++ b/doc/languages-frameworks/ios.section.md
@@ -1,7 +1,7 @@
---
title: iOS
author: Sander van der Burg
-date: 2018-11-18
+date: 2019-11-10
---
# iOS
@@ -217,3 +217,13 @@ xcode.simulateApp {
By providing the result of an `xcode.buildApp {}` function and configuring the
app bundle id, the app gets deployed automatically and started.
+
+Troubleshooting
+---------------
+In some rare cases, it may happen that after a failure, changes are not picked
+up. Most likely, this is caused by a derived data cache that Xcode maintains.
+To wipe it you can run:
+
+```bash
+$ rm -rf ~/Library/Developer/Xcode/DerivedData
+```
diff --git a/doc/languages-frameworks/java.xml b/doc/languages-frameworks/java.xml
index 68a1a097984deffaa742f83705e38e1b07db39b3..bf0fc48839223742eea28672c52d33481c4558e5 100644
--- a/doc/languages-frameworks/java.xml
+++ b/doc/languages-frameworks/java.xml
@@ -15,37 +15,24 @@ stdenv.mkDerivation {
buildPhase = "ant";
}
- Note that jdk is an alias for the OpenJDK (self-built
- where available, or pre-built via Zulu). Platforms with OpenJDK not (yet) in
- Nixpkgs (Aarch32, Aarch64) point to the
- (unfree) oraclejdk.
+ Note that jdk is an alias for the OpenJDK (self-built where available, or pre-built via Zulu). Platforms with OpenJDK not (yet) in Nixpkgs (Aarch32, Aarch64) point to the (unfree) oraclejdk.
- JAR files that are intended to be used by other packages should be installed
- in $out/share/java. JDKs have a stdenv setup hook that
- add any JARs in the share/java directories of the build
- inputs to the CLASSPATH environment variable. For instance, if
- the package libfoo installs a JAR named
- foo.jar in its share/java
- directory, and another package declares the attribute
+ JAR files that are intended to be used by other packages should be installed in $out/share/java. JDKs have a stdenv setup hook that add any JARs in the share/java directories of the build inputs to the CLASSPATH environment variable. For instance, if the package libfoo installs a JAR named foo.jar in its share/java directory, and another package declares the attribute
buildInputs = [ libfoo ];
nativeBuildInputs = [ jdk ];
- then CLASSPATH will be set to
- /nix/store/...-libfoo/share/java/foo.jar.
+ then CLASSPATH will be set to /nix/store/...-libfoo/share/java/foo.jar.
- Private JARs should be installed in a location like
- $out/share/package-name.
+ Private JARs should be installed in a location like $out/share/package-name.
- If your Java package provides a program, you need to generate a wrapper
- script to run it using the OpenJRE. You can use
- makeWrapper for this:
+ If your Java package provides a program, you need to generate a wrapper script to run it using the OpenJRE. You can use makeWrapper for this:
nativeBuildInputs = [ makeWrapper ];
@@ -56,30 +43,21 @@ installPhase =
--add-flags "-cp $out/share/java/foo.jar org.foo.Main"
'';
- Note the use of jre, which is the part of the OpenJDK
- package that contains the Java Runtime Environment. By using
- ${jre}/bin/java instead of
- ${jdk}/bin/java, you prevent your package from depending
- on the JDK at runtime.
+ Note the use of jre, which is the part of the OpenJDK package that contains the Java Runtime Environment. By using ${jre}/bin/java instead of ${jdk}/bin/java, you prevent your package from depending on the JDK at runtime.
- Note all JDKs passthru home, so if your application
- requires environment variables like JAVA_HOME being set, that
- can be done in a generic fashion with the --set argument
- of makeWrapper:
+ Note all JDKs passthru home, so if your application requires environment variables like JAVA_HOME being set, that can be done in a generic fashion with the --set argument of makeWrapper:
--set JAVA_HOME ${jdk.home}
- It is possible to use a different Java compiler than javac
- from the OpenJDK. For instance, to use the GNU Java Compiler:
+ It is possible to use a different Java compiler than javac from the OpenJDK. For instance, to use the GNU Java Compiler:
nativeBuildInputs = [ gcj ant ];
- Here, Ant will automatically use gij (the GNU Java
- Runtime) instead of the OpenJRE.
+ Here, Ant will automatically use gij (the GNU Java Runtime) instead of the OpenJRE.
diff --git a/doc/languages-frameworks/lua.xml b/doc/languages-frameworks/lua.xml
index 5144bb24ff6e729573bbc468d53b061c1a2523ee..bcca6b7375391cb87edef7054709624696b4a9f2 100644
--- a/doc/languages-frameworks/lua.xml
+++ b/doc/languages-frameworks/lua.xml
@@ -4,18 +4,11 @@
Lua
- Lua packages are built by the buildLuaPackage function.
- This function is implemented in
-
- pkgs/development/lua-modules/generic/default.nix
- and works similarly to buildPerlPackage. (See
- for details.)
+ Lua packages are built by the buildLuaPackage function. This function is implemented in pkgs/development/lua-modules/generic/default.nix and works similarly to buildPerlPackage. (See for details.)
- Lua packages are defined in
- pkgs/top-level/lua-packages.nix.
- Most of them are simple. For example:
+ Lua packages are defined in pkgs/top-level/lua-packages.nix. Most of them are simple. For example:
fileSystem = buildLuaPackage {
name = "filesystem-1.6.2";
@@ -33,16 +26,11 @@ fileSystem = buildLuaPackage {
- Though, more complicated package should be placed in a seperate file in
- pkgs/development/lua-modules.
- Lua packages accept additional parameter disabled, which
- defines the condition of disabling package from luaPackages. For example, if
- package has disabled assigned to lua.luaversion
- != "5.1", it will not be included in any luaPackages except
- lua51Packages, making it only be built for lua 5.1.
+ Lua packages accept additional parameter disabled, which defines the condition of disabling package from luaPackages. For example, if package has disabled assigned to lua.luaversion != "5.1", it will not be included in any luaPackages except lua51Packages, making it only be built for lua 5.1.
diff --git a/doc/languages-frameworks/node.section.md b/doc/languages-frameworks/node.section.md
index c6dce04c7b8b00409e191b16b04c6cd679ef16d7..4dc95fc1dd98f33a094bfd836c0a463faf1851cf 100644
--- a/doc/languages-frameworks/node.section.md
+++ b/doc/languages-frameworks/node.section.md
@@ -1,5 +1,5 @@
-Node.js packages
-================
+Node.js
+=======
The `pkgs/development/node-packages` folder contains a generated collection of
[NPM packages](https://npmjs.com/) that can be installed with the Nix package
manager.
diff --git a/doc/languages-frameworks/ocaml.xml b/doc/languages-frameworks/ocaml.xml
index b7006ecba998137d3baad7347d72b75ba59f62e6..a0ea209b493c0facb30fbf7a25e1d7fb9e3f2a2e 100644
--- a/doc/languages-frameworks/ocaml.xml
+++ b/doc/languages-frameworks/ocaml.xml
@@ -4,35 +4,15 @@
OCaml
- OCaml libraries should be installed in
- $(out)/lib/ocaml/${ocaml.version}/site-lib/. Such
- directories are automatically added to the $OCAMLPATH
- environment variable when building another package that depends on them or
- when opening a nix-shell.
+ OCaml libraries should be installed in $(out)/lib/ocaml/${ocaml.version}/site-lib/. Such directories are automatically added to the $OCAMLPATH environment variable when building another package that depends on them or when opening a nix-shell.
- Given that most of the OCaml ecosystem is now built with dune, nixpkgs
- includes a convenience build support function called
- buildDunePackage that will build an OCaml package using
- dune, OCaml and findlib and any additional dependencies provided as
- buildInputs or propagatedBuildInputs.
+ Given that most of the OCaml ecosystem is now built with dune, nixpkgs includes a convenience build support function called buildDunePackage that will build an OCaml package using dune, OCaml and findlib and any additional dependencies provided as buildInputs or propagatedBuildInputs.
- Here is a simple package example. It defines an (optional) attribute
- minimumOCamlVersion that will be used to throw a
- descriptive evaluation error if building with an older OCaml is attempted. It
- uses the fetchFromGitHub fetcher to get its source. It
- sets the doCheck (optional) attribute to
- true which means that tests will be run with dune
- runtest -p angstrom after the build (dune build -p
- angstrom) is complete. It uses alcotest as a
- build input (because it is needed to run the tests) and
- bigstringaf and result as propagated
- build inputs (thus they will also be available to libraries depending on this
- library). The library will be installed using the
- angstrom.install file that dune generates.
+ Here is a simple package example. It defines an (optional) attribute minimumOCamlVersion that will be used to throw a descriptive evaluation error if building with an older OCaml is attempted. It uses the fetchFromGitHub fetcher to get its source. It sets the doCheck (optional) attribute to true which means that tests will be run with dune runtest -p angstrom after the build (dune build -p angstrom) is complete. It uses alcotest as a build input (because it is needed to run the tests) and bigstringaf and result as propagated build inputs (thus they will also be available to libraries depending on this library). The library will be installed using the angstrom.install file that dune generates.
@@ -65,11 +45,7 @@ buildDunePackage rec {
- Here is a second example, this time using a source archive generated with
- dune-release. It is a good idea to use this archive when
- it is available as it will usually contain substituted variables such as a
- %%VERSION%% field. This library does not depend on any
- other OCaml library and no tests are run after building it.
+ Here is a second example, this time using a source archive generated with dune-release. It is a good idea to use this archive when it is available as it will usually contain substituted variables such as a %%VERSION%% field. This library does not depend on any other OCaml library and no tests are run after building it.
diff --git a/doc/languages-frameworks/perl.xml b/doc/languages-frameworks/perl.xml
index 065212a0e18079459bbe91b63ef65b31d7dd4d23..d9b6b2721c675b0a6bec4324bcd6b48454436994 100644
--- a/doc/languages-frameworks/perl.xml
+++ b/doc/languages-frameworks/perl.xml
@@ -4,24 +4,13 @@
Perl
- Nixpkgs provides a function buildPerlPackage, a generic
- package builder function for any Perl package that has a standard
- Makefile.PL. It’s implemented in
- buildPerlPackage, a generic package builder function for any Perl package that has a standard Makefile.PL. It’s implemented in pkgs/development/perl-modules/generic.
- Perl packages from CPAN are defined in
- pkgs/top-level/perl-packages.nix,
- rather than pkgs/all-packages.nix. Most Perl packages
- are so straight-forward to build that they are defined here directly, rather
- than having a separate function for each package called from
- perl-packages.nix. However, more complicated packages
- should be put in a separate file, typically in
- pkgs/development/perl-modules. Here is an example of the
- former:
+ Perl packages from CPAN are defined in pkgs/top-level/perl-packages.nix, rather than pkgs/all-packages.nix. Most Perl packages are so straight-forward to build that they are defined here directly, rather than having a separate function for each package called from perl-packages.nix. However, more complicated packages should be put in a separate file, typically in pkgs/development/perl-modules. Here is an example of the former:
ClassC3 = buildPerlPackage rec {
name = "Class-C3-0.21";
@@ -31,32 +20,22 @@ ClassC3 = buildPerlPackage rec {
};
};
- Note the use of mirror://cpan/, and the
- ${name} in the URL definition to ensure that the name
- attribute is consistent with the source that we’re actually downloading.
- Perl packages are made available in all-packages.nix
- through the variable perlPackages. For instance, if you
- have a package that needs ClassC3, you would typically
- write
+ Note the use of mirror://cpan/, and the ${name} in the URL definition to ensure that the name attribute is consistent with the source that we’re actually downloading. Perl packages are made available in all-packages.nix through the variable perlPackages. For instance, if you have a package that needs ClassC3, you would typically write
foo = import ../path/to/foo.nix {
inherit stdenv fetchurl ...;
inherit (perlPackages) ClassC3;
};
- in all-packages.nix. You can test building a Perl
- package as follows:
+ in all-packages.nix. You can test building a Perl package as follows:
$ nix-build -A perlPackages.ClassC3
- buildPerlPackage adds perl- to the
- start of the name attribute, so the package above is actually called
- perl-Class-C3-0.21. So to install it, you can say:
+ buildPerlPackage adds perl- to the start of the name attribute, so the package above is actually called perl-Class-C3-0.21. So to install it, you can say:
$ nix-env -i perl-Class-C3
- (Of course you can also install using the attribute name: nix-env -i
- -A perlPackages.ClassC3.)
+ (Of course you can also install using the attribute name: nix-env -i -A perlPackages.ClassC3.)
@@ -64,40 +43,24 @@ foo = import ../path/to/foo.nix {
- In the configure phase, it calls perl Makefile.PL to
- generate a Makefile. You can set the variable
- makeMakerFlags to pass flags to
- Makefile.PL
+ In the configure phase, it calls perl Makefile.PL to generate a Makefile. You can set the variable makeMakerFlags to pass flags to Makefile.PL
- It adds the contents of the PERL5LIB environment variable
- to #! .../bin/perl line of Perl scripts as
- -Idir flags. This ensures
- that a script can find its dependencies. (This can cause this shebang line
- to become too long for Darwin to handle; see the note below.)
+ It adds the contents of the PERL5LIB environment variable to #! .../bin/perl line of Perl scripts as -Idir flags. This ensures that a script can find its dependencies. (This can cause this shebang line to become too long for Darwin to handle; see the note below.)
- In the fixup phase, it writes the propagated build inputs
- (propagatedBuildInputs) to the file
- $out/nix-support/propagated-user-env-packages.
- nix-env recursively installs all packages listed in
- this file when you install a package that has it. This ensures that a Perl
- package can find its dependencies.
+ In the fixup phase, it writes the propagated build inputs (propagatedBuildInputs) to the file $out/nix-support/propagated-user-env-packages. nix-env recursively installs all packages listed in this file when you install a package that has it. This ensures that a Perl package can find its dependencies.
- buildPerlPackage is built on top of
- stdenv, so everything can be customised in the usual way.
- For instance, the BerkeleyDB module has a
- preConfigure hook to generate a configuration file used by
- Makefile.PL:
+ buildPerlPackage is built on top of stdenv, so everything can be customised in the usual way. For instance, the BerkeleyDB module has a preConfigure hook to generate a configuration file used by Makefile.PL:
{ buildPerlPackage, fetchurl, db }:
@@ -118,12 +81,7 @@ buildPerlPackage rec {
- Dependencies on other Perl packages can be specified in the
- buildInputs and propagatedBuildInputs
- attributes. If something is exclusively a build-time dependency, use
- buildInputs; if it’s (also) a runtime dependency, use
- propagatedBuildInputs. For instance, this builds a Perl
- module that has runtime dependencies on a bunch of other modules:
+ Dependencies on other Perl packages can be specified in the buildInputs and propagatedBuildInputs attributes. If something is exclusively a build-time dependency, use buildInputs; if it’s (also) a runtime dependency, use propagatedBuildInputs. For instance, this builds a Perl module that has runtime dependencies on a bunch of other modules:
ClassC3Componentised = buildPerlPackage rec {
name = "Class-C3-Componentised-1.0004";
@@ -139,11 +97,7 @@ ClassC3Componentised = buildPerlPackage rec {
- On Darwin, if a script has too many
- -Idir flags in its first line
- (its “shebang line”), it will not run. This can be worked around by calling
- the shortenPerlShebang function from the
- postInstall phase:
+ On Darwin, if a script has too many -Idir flags in its first line (its “shebang line”), it will not run. This can be worked around by calling the shortenPerlShebang function from the postInstall phase:
{ stdenv, buildPerlPackage, fetchurl, shortenPerlShebang }:
@@ -162,20 +116,14 @@ ImageExifTool = buildPerlPackage {
'';
};
- This will remove the -I flags from the shebang line,
- rewrite them in the use lib form, and put them on the next
- line instead. This function can be given any number of Perl scripts as
- arguments; it will modify them in-place.
+ This will remove the -I flags from the shebang line, rewrite them in the use lib form, and put them on the next line instead. This function can be given any number of Perl scripts as arguments; it will modify them in-place.
Generation from CPAN
- Nix expressions for Perl packages can be generated (almost) automatically
- from CPAN. This is done by the program
- nix-generate-from-cpan, which can be installed as
- follows:
+ Nix expressions for Perl packages can be generated (almost) automatically from CPAN. This is done by the program nix-generate-from-cpan, which can be installed as follows:
@@ -183,9 +131,7 @@ ImageExifTool = buildPerlPackage {
- This program takes a Perl module name, looks it up on CPAN, fetches and
- unpacks the corresponding package, and prints a Nix expression on standard
- output. For example:
+ This program takes a Perl module name, looks it up on CPAN, fetches and unpacks the corresponding package, and prints a Nix expression on standard output. For example:
$ nix-generate-from-cpan XML::Simple
XMLSimple = buildPerlPackage rec {
@@ -201,9 +147,7 @@ ImageExifTool = buildPerlPackage {
};
};
- The output can be pasted into
- pkgs/top-level/perl-packages.nix or wherever else you
- need it.
+ The output can be pasted into pkgs/top-level/perl-packages.nix or wherever else you need it.
@@ -211,13 +155,7 @@ ImageExifTool = buildPerlPackage {
Cross-compiling modules
- Nixpkgs has experimental support for cross-compiling Perl modules. In many
- cases, it will just work out of the box, even for modules with native
- extensions. Sometimes, however, the Makefile.PL for a module may
- (indirectly) import a native module. In that case, you will need to make a
- stub for that module that will satisfy the Makefile.PL and install it into
- lib/perl5/site_perl/cross_perl/${perl.version}. See the
- postInstall for DBI for an example.
+ Nixpkgs has experimental support for cross-compiling Perl modules. In many cases, it will just work out of the box, even for modules with native extensions. Sometimes, however, the Makefile.PL for a module may (indirectly) import a native module. In that case, you will need to make a stub for that module that will satisfy the Makefile.PL and install it into lib/perl5/site_perl/cross_perl/${perl.version}. See the postInstall for DBI for an example.
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 88dc42ebc6c23399545f480b7b73ee631495113d..9cb0e1eecc1683862bce36852f1f8a3d0c536370 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -144,6 +144,24 @@ What's happening here?
2. Then we create a Python 3.5 environment with the `withPackages` function.
3. The `withPackages` function expects us to provide a function as an argument that takes the set of all python packages and returns a list of packages to include in the environment. Here, we select the packages `numpy` and `toolz` from the package set.
+To combine this with `mkShell` you can:
+
+```nix
+with import {};
+
+let
+ pythonEnv = python35.withPackages (ps: [
+ ps.numpy
+ ps.toolz
+ ]);
+in mkShell {
+ buildInputs = [
+ pythonEnv
+ hello
+ ];
+}
+```
+
##### Execute command with `--run`
A convenient option with `nix-shell` is the `--run`
option, with which you can execute a command in the `nix-shell`. We can
@@ -593,7 +611,7 @@ as the interpreter unless overridden otherwise.
All parameters from `stdenv.mkDerivation` function are still supported. The following are specific to `buildPythonPackage`:
* `catchConflicts ? true`: If `true`, abort package build if a package name appears more than once in dependency tree. Default is `true`.
-* `disabled` ? false: If `true`, package is not build for the particular Python interpreter version.
+* `disabled` ? false: If `true`, package is not built for the particular Python interpreter version.
* `dontWrapPythonPrograms ? false`: Skip wrapping of python programs.
* `permitUserSite ? false`: Skip setting the `PYTHONNOUSERSITE` environment variable in wrapped programs.
* `installFlags ? []`: A list of strings. Arguments to be passed to `pip install`. To pass options to `python setup.py install`, use `--install-option`. E.g., `installFlags=["--install-option='--cpp_implementation'"]`.
@@ -850,9 +868,8 @@ Note: There is a boolean value `lib.inNixShell` set to `true` if nix-shell is in
Packages inside nixpkgs are written by hand. However many tools exist in
community to help save time. No tool is preferred at the moment.
-- [python2nix](https://github.com/proger/python2nix) by Vladimir Kirillov
-- [pypi2nix](https://github.com/garbas/pypi2nix) by Rok Garbas
-- [pypi2nix](https://github.com/offlinehacker/pypi2nix) by Jaka Hudoklin
+- [pypi2nix](https://github.com/nix-community/pypi2nix): Generate Nix expressions for your Python project. Note that [sharing derivations from pypi2nix with nixpkgs is possible but not encouraged](https://github.com/nix-community/pypi2nix/issues/222#issuecomment-443497376).
+- [python2nix](https://github.com/proger/python2nix) by Vladimir Kirillov.
### Deterministic builds
@@ -1017,7 +1034,10 @@ Create this `default.nix` file, together with a `requirements.txt` and simply ex
```nix
with import {};
-with python27Packages;
+
+let
+ pythonPackages = python27Packages;
+in
stdenv.mkDerivation {
name = "impurePythonEnv";
@@ -1027,9 +1047,8 @@ stdenv.mkDerivation {
buildInputs = [
# these packages are required for virtualenv and pip to work:
#
- python27Full
- python27Packages.virtualenv
- python27Packages.pip
+ pythonPackages.virtualenv
+ pythonPackages.pip
# the following packages are related to the dependencies of your python
# project.
# In this particular example the python modules listed in the
@@ -1042,14 +1061,13 @@ stdenv.mkDerivation {
libxml2
libxslt
libzip
- stdenv
zlib
];
shellHook = ''
# set SOURCE_DATE_EPOCH so that we can use python wheels
SOURCE_DATE_EPOCH=$(date +%s)
- virtualenv --no-setuptools venv
+ virtualenv --python=${pythonPackages.python.interpreter} --no-setuptools venv
export PATH=$PWD/venv/bin:$PATH
pip install -r requirements.txt
'';
diff --git a/doc/languages-frameworks/qt.xml b/doc/languages-frameworks/qt.xml
index 3332ce8c06e429e311b7ef6032d4034aa3d83fbc..8d97de504ad342c045296f7608fb0d44226b9337 100644
--- a/doc/languages-frameworks/qt.xml
+++ b/doc/languages-frameworks/qt.xml
@@ -4,16 +4,12 @@
Qt
- This section describes the differences between Nix expressions for Qt
- libraries and applications and Nix expressions for other C++ software. Some
- knowledge of the latter is assumed. There are primarily two problems which
- the Qt infrastructure is designed to address: ensuring consistent versioning
- of all dependencies and finding dependencies at runtime.
+ This section describes the differences between Nix expressions for Qt libraries and applications and Nix expressions for other C++ software. Some knowledge of the latter is assumed. There are primarily two problems which the Qt infrastructure is designed to address: ensuring consistent versioning of all dependencies and finding dependencies at runtime.
- Nix expression for a Qt package (default.nix)
-
+ Nix expression for a Qt package (default.nix)
+
{ mkDerivation, lib, qtbase }:
mkDerivation {
@@ -26,53 +22,36 @@ mkDerivation {
-
-
- Import mkDerivation and Qt (such as
- qtbase modules directly. Do not
- import Qt package sets; the Qt versions of dependencies may not be
- coherent, causing build and runtime failures.
-
-
-
-
- Use mkDerivation instead of
- stdenv.mkDerivation. mkDerivation
- is a wrapper around stdenv.mkDerivation which
- applies some Qt-specific settings.
- This deriver accepts the same arguments as
- stdenv.mkDerivation; refer to
- for details.
-
-
- To use another deriver instead of
- stdenv.mkDerivation, use
- mkDerivationWith:
+
+
+ Import mkDerivation and Qt (such as qtbase modules directly. Do not import Qt package sets; the Qt versions of dependencies may not be coherent, causing build and runtime failures.
+
+
+
+
+ Use mkDerivation instead of stdenv.mkDerivation. mkDerivation is a wrapper around stdenv.mkDerivation which applies some Qt-specific settings. This deriver accepts the same arguments as stdenv.mkDerivation; refer to for details.
+
+
+ To use another deriver instead of stdenv.mkDerivation, use mkDerivationWith:
mkDerivationWith myDeriver {
# ...
}
- If you cannot use mkDerivationWith, please refer to
- .
-
-
-
-
- mkDerivation accepts the same arguments as
- stdenv.mkDerivation, such as
- buildInputs.
-
-
+ If you cannot use mkDerivationWith, please refer to .
+
+
+
+
+ mkDerivation accepts the same arguments as stdenv.mkDerivation, such as buildInputs.
+
+
- Locating runtime dependencies
-
- Qt applications need to be wrapped to find runtime dependencies. If you
- cannot use mkDerivation or
- mkDerivationWith above, include
- wrapQtAppsHook in nativeBuildInputs:
+ Locating runtime dependencies
+
+ Qt applications need to be wrapped to find runtime dependencies. If you cannot use mkDerivation or mkDerivationWith above, include wrapQtAppsHook in nativeBuildInputs:
stdenv.mkDerivation {
# ...
@@ -80,13 +59,11 @@ stdenv.mkDerivation {
nativeBuildInputs = [ wrapQtAppsHook ];
}
-
+
- Entries added to qtWrapperArgs are used to modify the
- wrappers created by wrapQtAppsHook. The entries are
- passed as arguments to .
+ Entries added to qtWrapperArgs are used to modify the wrappers created by wrapQtAppsHook. The entries are passed as arguments to .
mkDerivation {
# ...
@@ -97,10 +74,7 @@ mkDerivation {
- Set dontWrapQtApps to stop applications from being
- wrapped automatically. It is required to wrap applications manually with
- wrapQtApp, using the syntax of
- :
+ Set dontWrapQtApps to stop applications from being wrapped automatically. It is required to wrap applications manually with wrapQtApp, using the syntax of :
mkDerivation {
# ...
@@ -115,16 +89,12 @@ mkDerivation {
- wrapQtAppsHook ignores files that are non-ELF executables.
- This means that scripts won't be automatically wrapped so you'll need to manually
- wrap them as previously mentioned. An example of when you'd always need to do this
- is with Python applications that use PyQT.
+ wrapQtAppsHook ignores files that are non-ELF executables. This means that scripts won't be automatically wrapped so you'll need to manually wrap them as previously mentioned. An example of when you'd always need to do this is with Python applications that use PyQT.
- Libraries are built with every available version of Qt. Use the meta.broken
- attribute to disable the package for unsupported Qt versions:
+ Libraries are built with every available version of Qt. Use the meta.broken attribute to disable the package for unsupported Qt versions:
mkDerivation {
# ...
@@ -136,13 +106,11 @@ mkDerivation {
- Adding a library to Nixpkgs
-
- Add a Qt library to all-packages.nix by adding it to the
- collection inside mkLibsForQt5. This ensures that the
- library is built with every available version of Qt as needed.
-
- Adding a Qt library to all-packages.nix
+ Adding a library to Nixpkgs
+
+ Add a Qt library to all-packages.nix by adding it to the collection inside mkLibsForQt5. This ensures that the library is built with every available version of Qt as needed.
+
+ Adding a Qt library to all-packages.nix
{
# ...
@@ -156,19 +124,16 @@ mkDerivation {
# ...
}
-
-
+
+
- Adding an application to Nixpkgs
-
- Add a Qt application to all-packages.nix using
- libsForQt5.callPackage instead of the usual
- callPackage. The former ensures that all dependencies
- are built with the same version of Qt.
-
- Adding a Qt application to all-packages.nix
+ Adding an application to Nixpkgs
+
+ Add a Qt application to all-packages.nix using libsForQt5.callPackage instead of the usual callPackage. The former ensures that all dependencies are built with the same version of Qt.
+
+ Adding a Qt application to all-packages.nix
{
# ...
@@ -178,8 +143,7 @@ mkDerivation {
# ...
}
-
-
+
+
-
diff --git a/doc/languages-frameworks/r.section.md b/doc/languages-frameworks/r.section.md
index c8f02bd1478067990b03e0a2c7fd1e2f03a0ba69..d4e1617779ce47f289d5378872f64b93c1d39692 100644
--- a/doc/languages-frameworks/r.section.md
+++ b/doc/languages-frameworks/r.section.md
@@ -1,5 +1,5 @@
-R packages
-==========
+R
+=
## Installation
diff --git a/doc/languages-frameworks/ruby.xml b/doc/languages-frameworks/ruby.xml
index df4e5acb22cb94892a5f0dd06c5e7be8b27d170e..b28745fd6e2754ce91dae7068b8a1ba5db8495e7 100644
--- a/doc/languages-frameworks/ruby.xml
+++ b/doc/languages-frameworks/ruby.xml
@@ -4,11 +4,7 @@
Ruby
- There currently is support to bundle applications that are packaged as Ruby
- gems. The utility "bundix" allows you to write a
- Gemfile, let bundler create a
- Gemfile.lock, and then convert this into a nix
- expression that contains all Gem dependencies automatically.
+ There currently is support to bundle applications that are packaged as Ruby gems. The utility "bundix" allows you to write a Gemfile, let bundler create a Gemfile.lock, and then convert this into a nix expression that contains all Gem dependencies automatically.
@@ -45,9 +41,7 @@ bundlerEnv rec {
- Please check in the Gemfile,
- Gemfile.lock and the gemset.nix so
- future updates can be run easily.
+ Please check in the Gemfile, Gemfile.lock and the gemset.nix so future updates can be run easily.
@@ -62,10 +56,7 @@ $ nix-shell -p bundix --run 'bundix'
- For tools written in Ruby - i.e. where the desire is to install a package and
- then execute e.g. rake at the command line, there is an
- alternative builder called bundlerApp. Set up the
- gemset.nix the same way, and then, for example:
+ For tools written in Ruby - i.e. where the desire is to install a package and then execute e.g. rake at the command line, there is an alternative builder called bundlerApp. Set up the gemset.nix the same way, and then, for example:
@@ -87,29 +78,11 @@ bundlerApp {
- The chief advantage of bundlerApp over
- bundlerEnv is the executables introduced in the
- environment are precisely those selected in the exes list,
- as opposed to bundlerEnv which adds all the executables
- made available by gems in the gemset, which can mean e.g.
- rspec or rake in unpredictable versions
- available from various packages.
+ The chief advantage of bundlerApp over bundlerEnv is the executables introduced in the environment are precisely those selected in the exes list, as opposed to bundlerEnv which adds all the executables made available by gems in the gemset, which can mean e.g. rspec or rake in unpredictable versions available from various packages.
- Resulting derivations for both builders also have two helpful attributes,
- env and wrappedRuby. The first one
- allows one to quickly drop into nix-shell with the
- specified environment present. E.g. nix-shell -A sensu.env
- would give you an environment with Ruby preset so it has all the libraries
- necessary for sensu in its paths. The second one can be
- used to make derivations from custom Ruby scripts which have
- Gemfiles with their dependencies specified. It is a
- derivation with ruby wrapped so it can find all the needed
- dependencies. For example, to make a derivation my-script
- for a my-script.rb (which should be placed in
- bin) you should run bundix as
- specified above and then use bundlerEnv like this:
+ Resulting derivations for both builders also have two helpful attributes, env and wrappedRuby. The first one allows one to quickly drop into nix-shell with the specified environment present. E.g. nix-shell -A sensu.env would give you an environment with Ruby preset so it has all the libraries necessary for sensu in its paths. The second one can be used to make derivations from custom Ruby scripts which have Gemfiles with their dependencies specified. It is a derivation with ruby wrapped so it can find all the needed dependencies. For example, to make a derivation my-script for a my-script.rb (which should be placed in bin) you should run bundix as specified above and then use bundlerEnv like this:
diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index 2d9338f2e89bf0ce1efe600e0ec6ba9380ef0c4d..709a0d504cf73b6ea07d372882ba8db24c30b429 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -4,7 +4,7 @@ author: Matthias Beyer
date: 2017-03-05
---
-# User's Guide to the Rust Infrastructure
+# Rust
To install the rust compiler and cargo put
@@ -43,6 +43,7 @@ rustPlatform.buildRustPackage rec {
};
cargoSha256 = "0q68qyl2h6i0qsz82z840myxlnjay8p1w5z7hfyr8fqp7wgwa9cx";
+ verifyCargoDeps = true;
meta = with stdenv.lib; {
description = "A fast line-oriented regex search tool, similar to ag and ack";
@@ -64,6 +65,20 @@ When the `Cargo.lock`, provided by upstream, is not in sync with the
added in `cargoPatches` will also be prepended to the patches in `patches` at
build-time.
+When `verifyCargoDeps` is set to `true`, the build will also verify that the
+`cargoSha256` is not out of date by comparing the `Cargo.lock` file in both the `cargoDeps` and `src`. Note that this option changes the value of `cargoSha256` since it also copies the `Cargo.lock` in it. To avoid breaking backward-compatibility this option is not enabled by default but hopefully will be in the future.
+
+### Building a crate for a different target
+
+To build your crate with a different cargo `--target` simply specify the `target` attribute:
+
+```nix
+pkgs.rustPlatform.buildRustPackage {
+ (...)
+ target = "x86_64-fortanix-unknown-sgx";
+}
+```
+
## Compiling Rust crates using Nix instead of Cargo
### Simple operation
@@ -188,7 +203,7 @@ argument and returns a set that contains all attribute that should be
overwritten.
For more complicated cases, such as when parts of the crate's
-derivation depend on the the crate's version, the `attrs` argument of
+derivation depend on the crate's version, the `attrs` argument of
the override above can be read, as in the following example, which
patches the derivation:
diff --git a/doc/languages-frameworks/texlive.xml b/doc/languages-frameworks/texlive.xml
index 97f274933bef274aff2087abbfc75cdfe25ece6d..8fa8f963b2f6b2f2cd218f02c8bd5d6608d9eb76 100644
--- a/doc/languages-frameworks/texlive.xml
+++ b/doc/languages-frameworks/texlive.xml
@@ -4,8 +4,7 @@
TeX Live
- Since release 15.09 there is a new TeX Live packaging that lives entirely
- under attribute texlive.
+ Since release 15.09 there is a new TeX Live packaging that lives entirely under attribute texlive.
@@ -14,28 +13,23 @@
- For basic usage just pull texlive.combined.scheme-basic
- for an environment with basic LaTeX support.
+ For basic usage just pull texlive.combined.scheme-basic for an environment with basic LaTeX support.
- It typically won't work to use separately installed packages together.
- Instead, you can build a custom set of packages like this:
+ It typically won't work to use separately installed packages together. Instead, you can build a custom set of packages like this:
texlive.combine {
inherit (texlive) scheme-small collection-langkorean algorithms cm-super;
}
- There are all the schemes, collections and a few thousand packages, as
- defined upstream (perhaps with tiny differences).
+ There are all the schemes, collections and a few thousand packages, as defined upstream (perhaps with tiny differences).
- By default you only get executables and files needed during runtime, and a
- little documentation for the core packages. To change that, you need to
- add pkgFilter function to combine.
+ By default you only get executables and files needed during runtime, and a little documentation for the core packages. To change that, you need to add pkgFilter function to combine.
texlive.combine {
# inherit (texlive) whatever-you-want;
@@ -59,15 +53,103 @@ nix-repl> texlive.collection-
- Note that the wrapper assumes that the result has a chance to be useful.
- For example, the core executables should be present, as well as some core
- data files. The supported way of ensuring this is by including some
- scheme, for example scheme-basic, into the combination.
+ Note that the wrapper assumes that the result has a chance to be useful. For example, the core executables should be present, as well as some core data files. The supported way of ensuring this is by including some scheme, for example scheme-basic, into the combination.
+
+ Custom packages
+
+ You may find that you need to use an external TeX package. A derivation for such package has to provide contents of the "texmf" directory in its output and provide the tlType attribute. Here is a (very verbose) example:
+ {};
+
+let
+ foiltex_run = stdenvNoCC.mkDerivation {
+ pname = "latex-foiltex";
+ version = "2.1.4b";
+ passthru.tlType = "run";
+
+ srcs = [
+ (fetchurl {
+ url = "http://mirrors.ctan.org/macros/latex/contrib/foiltex/foiltex.dtx";
+ sha256 = "07frz0krpz7kkcwlayrwrj2a2pixmv0icbngyw92srp9fp23cqpz";
+ })
+ (fetchurl {
+ url = "http://mirrors.ctan.org/macros/latex/contrib/foiltex/foiltex.ins";
+ sha256 = "09wkyidxk3n3zvqxfs61wlypmbhi1pxmjdi1kns9n2ky8ykbff99";
+ })
+ ];
+
+ unpackPhase = ''
+ runHook preUnpack
+
+ for _src in $srcs; do
+ cp "$_src" $(stripHash "$_src")
+ done
+
+ runHook postUnpack
+ '';
+
+ nativeBuildInputs = [ texlive.combined.scheme-small ];
+
+ dontConfigure = true;
+
+ buildPhase = ''
+ runHook preBuild
+
+ # Generate the style files
+ latex foiltex.ins
+
+ runHook postBuild
+ '';
+
+ installPhase = ''
+ runHook preInstall
+
+ path="$out/tex/latex/foiltex"
+ mkdir -p "$path"
+ cp *.{cls,def,clo} "$path/"
+
+ runHook postInstall
+ '';
+
+ meta = with lib; {
+ description = "A LaTeX2e class for overhead transparencies";
+ license = licenses.unfreeRedistributable;
+ maintainers = with maintainers; [ veprbl ];
+ platforms = platforms.all;
+ };
+ };
+ foiltex = { pkgs = [ foiltex_run ]; };
+
+ latex_with_foiltex = texlive.combine {
+ inherit (texlive) scheme-small;
+ inherit foiltex;
+ };
+in
+ runCommand "test.pdf" {
+ nativeBuildInputs = [ latex_with_foiltex ];
+ } ''
+cat >test.tex <
+
+
+
Known problems
@@ -84,14 +166,12 @@ nix-repl> texlive.collection-
- feature/bug: when a package is rejected by pkgFilter,
- its dependencies are still propagated;
+ feature/bug: when a package is rejected by pkgFilter, its dependencies are still propagated;
- in case of any bugs or feature requests, file a github issue or better a
- pull request and /cc @vcunat.
+ in case of any bugs or feature requests, file a github issue or better a pull request and /cc @vcunat.
diff --git a/doc/languages-frameworks/vim.section.md b/doc/languages-frameworks/vim.section.md
index 537e7b93e5230dbcaa2df1c2a5831dc3fb6bde7e..05a23d26cf2f77b78aacdbe53c7070c1a1429bd4 100644
--- a/doc/languages-frameworks/vim.section.md
+++ b/doc/languages-frameworks/vim.section.md
@@ -3,7 +3,7 @@ title: User's Guide for Vim in Nixpkgs
author: Marc Weber
date: 2016-06-25
---
-# User's Guide to Vim Plugins/Addons/Bundles/Scripts in Nixpkgs
+# Vim
Both Neovim and Vim can be configured to include your favorite plugins
and additional libraries.
diff --git a/doc/manual.xml b/doc/manual.xml
index ab845e1a10866a972445e31d08e09d07bd644807..1f69872d2a7269ba6dad364e4078e4af70be7a61 100644
--- a/doc/manual.xml
+++ b/doc/manual.xml
@@ -5,21 +5,37 @@
Version
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+ Using Nixpkgs
+
+
+
+
+
+
+ Standard environment
+
+
+
+
+
+
+
+ Builders
+
+
+
+
+
+
+
+
+ Contributing to Nixpkgs
+
+
+
+
+
+
diff --git a/doc/multiple-output.xml b/doc/multiple-output.xml
deleted file mode 100644
index d0247e081f9958fa46d18b9d15519f45cef8a97e..0000000000000000000000000000000000000000
--- a/doc/multiple-output.xml
+++ /dev/null
@@ -1,330 +0,0 @@
-
-
-]>
-
- Multiple-output packages
-
- Introduction
-
-
- The Nix language allows a derivation to produce multiple outputs, which is
- similar to what is utilized by other Linux distribution packaging systems.
- The outputs reside in separate Nix store paths, so they can be mostly
- handled independently of each other, including passing to build inputs,
- garbage collection or binary substitution. The exception is that building
- from source always produces all the outputs.
-
-
-
- The main motivation is to save disk space by reducing runtime closure sizes;
- consequently also sizes of substituted binaries get reduced. Splitting can
- be used to have more granular runtime dependencies, for example the typical
- reduction is to split away development-only files, as those are typically
- not needed during runtime. As a result, closure sizes of many packages can
- get reduced to a half or even much less.
-
-
-
-
- The reduction effects could be instead achieved by building the parts in
- completely separate derivations. That would often additionally reduce
- build-time closures, but it tends to be much harder to write such
- derivations, as build systems typically assume all parts are being built at
- once. This compromise approach of single source package producing multiple
- binary packages is also utilized often by rpm and deb.
-
-
-
-
- Installing a split package
-
-
- When installing a package via systemPackages or
- nix-env you have several options:
-
-
-
-
-
- You can install particular outputs explicitly, as each is available in the
- Nix language as an attribute of the package. The
- outputs attribute contains a list of output names.
-
-
-
-
- You can let it use the default outputs. These are handled by
- meta.outputsToInstall attribute that contains a list of
- output names.
-
-
- TODO: more about tweaking the attribute, etc.
-
-
-
-
- NixOS provides configuration option
- environment.extraOutputsToInstall that allows adding
- extra outputs of environment.systemPackages atop the
- default ones. It's mainly meant for documentation and debug symbols, and
- it's also modified by specific options.
-
-
-
- At this moment there is no similar configurability for packages installed
- by nix-env. You can still use approach from
- to override
- meta.outputsToInstall attributes, but that's a rather
- inconvenient way.
-
-
-
-
-
-
- Using a split package
-
-
- In the Nix language the individual outputs can be reached explicitly as
- attributes, e.g. coreutils.info, but the typical case is
- just using packages as build inputs.
-
-
-
- When a multiple-output derivation gets into a build input of another
- derivation, the dev output is added if it exists,
- otherwise the first output is added. In addition to that,
- propagatedBuildOutputs of that package which by default
- contain $outputBin and $outputLib are
- also added. (See .)
-
-
-
- In some cases it may be desirable to combine different outputs under a
- single store path. A function symlinkJoin can be used to
- do this. (Note that it may negate some closure size benefits of using a
- multiple-output package.)
-
-
-
- Writing a split derivation
-
-
- Here you find how to write a derivation that produces multiple outputs.
-
-
-
- In nixpkgs there is a framework supporting multiple-output derivations. It
- tries to cover most cases by default behavior. You can find the source
- separated in
- <nixpkgs/pkgs/build-support/setup-hooks/multiple-outputs.sh>;
- it's relatively well-readable. The whole machinery is triggered by defining
- the outputs attribute to contain the list of desired
- output names (strings).
-
-
-outputs = [ "bin" "dev" "out" "doc" ];
-
-
- Often such a single line is enough. For each output an equally named
- environment variable is passed to the builder and contains the path in nix
- store for that output. Typically you also want to have the main
- out output, as it catches any files that didn't get
- elsewhere.
-
-
-
-
- There is a special handling of the debug output,
- described at .
-
-
-
-
- Binaries first
-
-
- A commonly adopted convention in nixpkgs is that
- executables provided by the package are contained within its first output.
- This convention allows the dependent packages to reference the executables
- provided by packages in a uniform manner. For instance, provided with the
- knowledge that the perl package contains a
- perl executable it can be referenced as
- ${pkgs.perl}/bin/perl within a Nix derivation that needs
- to execute a Perl script.
-
-
-
- The glibc package is a deliberate single exception to
- the binaries first convention. The glibc
- has libs as its first output allowing the libraries
- provided by glibc to be referenced directly (e.g.
- ${stdenv.glibc}/lib/ld-linux-x86-64.so.2). The
- executables provided by glibc can be accessed via its
- bin attribute (e.g.
- ${stdenv.glibc.bin}/bin/ldd).
-
-
-
- The reason for why glibc deviates from the convention is
- because referencing a library provided by glibc is a
- very common operation among Nix packages. For instance, third-party
- executables packaged by Nix are typically patched and relinked with the
- relevant version of glibc libraries from Nix packages
- (please see the documentation on
- patchelf for more
- details).
-
-
-
-
- File type groups
-
-
- The support code currently recognizes some particular kinds of outputs and
- either instructs the build system of the package to put files into their
- desired outputs or it moves the files during the fixup phase. Each group of
- file types has an outputFoo variable specifying the
- output name where they should go. If that variable isn't defined by the
- derivation writer, it is guessed – a default output name is defined,
- falling back to other possibilities if the output isn't defined.
-
-
-
-
-
- $outputDev
-
-
-
- is for development-only files. These include C(++) headers, pkg-config,
- cmake and aclocal files. They go to dev or
- out by default.
-
-
-
-
-
- $outputBin
-
-
-
- is meant for user-facing binaries, typically residing in bin/. They go
- to bin or out by default.
-
-
-
-
-
- $outputLib
-
-
-
- is meant for libraries, typically residing in lib/
- and libexec/. They go to lib or
- out by default.
-
-
-
-
-
- $outputDoc
-
-
-
- is for user documentation, typically residing in
- share/doc/. It goes to doc or
- out by default.
-
-
-
-
-
- $outputDevdoc
-
-
-
- is for developer documentation. Currently we count
- gtk-doc and devhelp books in there. It goes to devdoc
- or is removed (!) by default. This is because e.g. gtk-doc tends to be
- rather large and completely unused by nixpkgs users.
-
-
-
-
-
- $outputMan
-
-
-
- is for man pages (except for section 3). They go to
- man or $outputBin by default.
-
-
-
-
-
- $outputDevman
-
-
-
- is for section 3 man pages. They go to devman or
- $outputMan by default.
-
-
-
-
-
- $outputInfo
-
-
-
- is for info pages. They go to info or
- $outputBin by default.
-
-
-
-
-
-
-
- Common caveats
-
-
-
-
- Some configure scripts don't like some of the parameters passed by
- default by the framework, e.g. --docdir=/foo/bar. You
- can disable this by setting setOutputFlags = false;.
-
-
-
-
- The outputs of a single derivation can retain references to each other,
- but note that circular references are not allowed. (And each
- strongly-connected component would act as a single output anyway.)
-
-
-
-
- Most of split packages contain their core functionality in libraries.
- These libraries tend to refer to various kind of data that typically gets
- into out, e.g. locale strings, so there is often no
- advantage in separating the libraries into lib, as
- keeping them in out is easier.
-
-
-
-
- Some packages have hidden assumptions on install paths, which complicates
- splitting.
-
-
-
-
-
-
-
diff --git a/doc/overlays.xml b/doc/overlays.xml
deleted file mode 100644
index bff2339ca9338cbdf5e14d91b47cfd2b1dbeee5f..0000000000000000000000000000000000000000
--- a/doc/overlays.xml
+++ /dev/null
@@ -1,195 +0,0 @@
-
- Overlays
-
- This chapter describes how to extend and change Nixpkgs using overlays.
- Overlays are used to add layers in the fixed-point used by Nixpkgs to compose
- the set of all packages.
-
-
- Nixpkgs can be configured with a list of overlays, which are applied in
- order. This means that the order of the overlays can be significant if
- multiple layers override the same package.
-
-
-
- Installing overlays
-
-
- The list of overlays can be set either explicitly in a Nix expression, or
- through <nixpkgs-overlays> or user configuration
- files.
-
-
-
- Set overlays in NixOS or Nix expressions
-
-
- On a NixOS system the value of the nixpkgs.overlays
- option, if present, is passed to the system Nixpkgs directly as an
- argument. Note that this does not affect the overlays for non-NixOS
- operations (e.g. nix-env), which are
- looked up independently.
-
-
-
- The list of overlays can be passed explicitly when importing nixpkgs, for
- example import <nixpkgs> { overlays = [ overlay1 overlay2 ];
- }.
-
-
-
- Further overlays can be added by calling the pkgs.extend
- or pkgs.appendOverlays, although it is often preferable
- to avoid these functions, because they recompute the Nixpkgs fixpoint,
- which is somewhat expensive to do.
-
-
-
-
- Install overlays via configuration lookup
-
-
- The list of overlays is determined as follows.
-
-
-
-
-
-
- First, if an
- overlays
- argument to the Nixpkgs function itself is given, then that is
- used and no path lookup will be performed.
-
-
-
-
- Otherwise, if the Nix path entry
- <nixpkgs-overlays> exists, we look for overlays at
- that path, as described below.
-
-
- See the section on NIX_PATH in the Nix manual for
- more details on how to set a value for
- <nixpkgs-overlays>.
-
-
-
-
- If one of ~/.config/nixpkgs/overlays.nix and
- ~/.config/nixpkgs/overlays/ exists, then we look
- for overlays at that path, as described below. It is an error if both
- exist.
-
-
-
-
-
-
- If we are looking for overlays at a path, then there are two cases:
-
-
-
- If the path is a file, then the file is imported as a Nix expression and
- used as the list of overlays.
-
-
-
-
- If the path is a directory, then we take the content of the directory,
- order it lexicographically, and attempt to interpret each as an overlay
- by:
-
-
-
- Importing the file, if it is a .nix file.
-
-
-
-
- Importing a top-level default.nix file, if it is
- a directory.
-
-
-
-
-
-
-
-
-
- Because overlays that are set in NixOS configuration do not affect
- non-NixOS operations such as nix-env, the
- overlays.nix option provides a convenient way to use
- the same overlays for a NixOS system configuration and user configuration:
- the same file can be used as overlays.nix and imported
- as the value of nixpkgs.overlays.
-
-
-
-
-
-
-
- Defining overlays
-
-
- Overlays are Nix functions which accept two arguments, conventionally called
- self and super, and return a set of
- packages. For example, the following is a valid overlay.
-
-
-
-self: super:
-
-{
- boost = super.boost.override {
- python = self.python3;
- };
- rr = super.callPackage ./pkgs/rr {
- stdenv = self.stdenv_32bit;
- };
-}
-
-
-
- The first argument (self) corresponds to the final
- package set. You should use this set for the dependencies of all packages
- specified in your overlay. For example, all the dependencies of
- rr in the example above come from
- self, as well as the overridden dependencies used in the
- boost override.
-
-
-
- The second argument (super) corresponds to the result of
- the evaluation of the previous stages of Nixpkgs. It does not contain any of
- the packages added by the current overlay, nor any of the following
- overlays. This set should be used either to refer to packages you wish to
- override, or to access functions defined in Nixpkgs. For example, the
- original recipe of boost in the above example, comes from
- super, as well as the callPackage
- function.
-
-
-
- The value returned by this function should be a set similar to
- pkgs/top-level/all-packages.nix, containing overridden
- and/or new packages.
-
-
-
- Overlays are similar to other methods for customizing Nixpkgs, in particular
- the packageOverrides attribute described in
- . Indeed,
- packageOverrides acts as an overlay with only the
- super argument. It is therefore appropriate for basic
- use, but overlays are more powerful and easier to distribute.
-
-
-
diff --git a/doc/package-notes.xml b/doc/package-notes.xml
deleted file mode 100644
index d2c660e22a9b010dfb580d2885e0eb9307e2e38a..0000000000000000000000000000000000000000
--- a/doc/package-notes.xml
+++ /dev/null
@@ -1,590 +0,0 @@
-
- Package Notes
-
- This chapter contains information about how to use and maintain the Nix
- expressions for a number of specific packages, such as the Linux kernel or
- X.org.
-
-
-
- Linux kernel
-
-
- The Nix expressions to build the Linux kernel are in
- pkgs/os-specific/linux/kernel.
-
-
-
- The function that builds the kernel has an argument
- kernelPatches which should be a list of {name,
- patch, extraConfig} attribute sets, where name
- is the name of the patch (which is included in the kernel’s
- meta.description attribute), patch is
- the patch itself (possibly compressed), and extraConfig
- (optional) is a string specifying extra options to be concatenated to the
- kernel configuration file (.config).
-
-
-
- The kernel derivation exports an attribute features
- specifying whether optional functionality is or isn’t enabled. This is
- used in NixOS to implement kernel-specific behaviour. For instance, if the
- kernel has the iwlwifi feature (i.e. has built-in support
- for Intel wireless chipsets), then NixOS doesn’t have to build the
- external iwlwifi package:
-
-modulesTree = [kernel]
- ++ pkgs.lib.optional (!kernel.features ? iwlwifi) kernelPackages.iwlwifi
- ++ ...;
-
-
-
-
- How to add a new (major) version of the Linux kernel to Nixpkgs:
-
-
-
- Copy the old Nix expression (e.g. linux-2.6.21.nix)
- to the new one (e.g. linux-2.6.22.nix) and update
- it.
-
-
-
-
- Add the new kernel to all-packages.nix (e.g., create
- an attribute kernel_2_6_22).
-
-
-
-
- Now we’re going to update the kernel configuration. First unpack the
- kernel. Then for each supported platform (i686,
- x86_64, uml) do the following:
-
-
-
- Make an copy from the old config (e.g.
- config-2.6.21-i686-smp) to the new one (e.g.
- config-2.6.22-i686-smp).
-
-
-
-
- Copy the config file for this platform (e.g.
- config-2.6.22-i686-smp) to
- .config in the kernel source tree.
-
-
-
-
- Run make oldconfig
- ARCH={i386,x86_64,um} and answer
- all questions. (For the uml configuration, also add
- SHELL=bash.) Make sure to keep the configuration
- consistent between platforms (i.e. don’t enable some feature on
- i686 and disable it on x86_64).
-
-
-
-
- If needed you can also run make menuconfig:
-
-$ nix-env -i ncurses
-$ export NIX_CFLAGS_LINK=-lncurses
-$ make menuconfig ARCH=arch
-
-
-
-
- Copy .config over the new config file (e.g.
- config-2.6.22-i686-smp).
-
-
-
-
-
-
-
- Test building the kernel: nix-build -A kernel_2_6_22.
- If it compiles, ship it! For extra credit, try booting NixOS with it.
-
-
-
-
- It may be that the new kernel requires updating the external kernel
- modules and kernel-dependent packages listed in the
- linuxPackagesFor function in
- all-packages.nix (such as the NVIDIA drivers, AUFS,
- etc.). If the updated packages aren’t backwards compatible with older
- kernels, you may need to keep the older versions around.
-
-
-
-
-
-
-
- X.org
-
-
- The Nix expressions for the X.org packages reside in
- pkgs/servers/x11/xorg/default.nix. This file is
- automatically generated from lists of tarballs in an X.org release. As such
- it should not be modified directly; rather, you should modify the lists, the
- generator script or the file
- pkgs/servers/x11/xorg/overrides.nix, in which you can
- override or add to the derivations produced by the generator.
-
-
-
- The generator is invoked as follows:
-
-$ cd pkgs/servers/x11/xorg
-$ cat tarballs-7.5.list extra.list old.list \
- | perl ./generate-expr-from-tarballs.pl
-
- For each of the tarballs in the .list files, the script
- downloads it, unpacks it, and searches its configure.ac
- and *.pc.in files for dependencies. This information is
- used to generate default.nix. The generator caches
- downloaded tarballs between runs. Pay close attention to the NOT
- FOUND: name messages at the end of the
- run, since they may indicate missing dependencies. (Some might be optional
- dependencies, however.)
-
-
-
- A file like tarballs-7.5.list contains all tarballs in
- a X.org release. It can be generated like this:
-
-$ export i="mirror://xorg/X11R7.4/src/everything/"
-$ cat $(PRINT_PATH=1 nix-prefetch-url $i | tail -n 1) \
- | perl -e 'while (<>) { if (/(href|HREF)="([^"]*.bz2)"/) { print "$ENV{'i'}$2\n"; }; }' \
- | sort > tarballs-7.4.list
-
- extra.list contains libraries that aren’t part of
- X.org proper, but are closely related to it, such as
- libxcb. old.list contains some
- packages that were removed from X.org, but are still needed by some people
- or by other packages (such as imake).
-
-
-
- If the expression for a package requires derivation attributes that the
- generator cannot figure out automatically (say, patches
- or a postInstall hook), you should modify
- pkgs/servers/x11/xorg/overrides.nix.
-
-
-
-
-
-
-
-
- Eclipse
-
-
- The Nix expressions related to the Eclipse platform and IDE are in
- pkgs/applications/editors/eclipse.
-
-
-
- Nixpkgs provides a number of packages that will install Eclipse in its
- various forms. These range from the bare-bones Eclipse Platform to the more
- fully featured Eclipse SDK or Scala-IDE packages and multiple version are
- often available. It is possible to list available Eclipse packages by
- issuing the command:
-
-$ nix-env -f '<nixpkgs>' -qaP -A eclipses --description
-
- Once an Eclipse variant is installed it can be run using the
- eclipse command, as expected. From within Eclipse it is
- then possible to install plugins in the usual manner by either manually
- specifying an Eclipse update site or by installing the Marketplace Client
- plugin and using it to discover and install other plugins. This installation
- method provides an Eclipse installation that closely resemble a manually
- installed Eclipse.
-
-
-
- If you prefer to install plugins in a more declarative manner then Nixpkgs
- also offer a number of Eclipse plugins that can be installed in an
- Eclipse environment. This type of environment is
- created using the function eclipseWithPlugins found
- inside the nixpkgs.eclipses attribute set. This function
- takes as argument { eclipse, plugins ? [], jvmArgs ? [] }
- where eclipse is a one of the Eclipse packages described
- above, plugins is a list of plugin derivations, and
- jvmArgs is a list of arguments given to the JVM running
- the Eclipse. For example, say you wish to install the latest Eclipse
- Platform with the popular Eclipse Color Theme plugin and also allow Eclipse
- to use more RAM. You could then add
-
-packageOverrides = pkgs: {
- myEclipse = with pkgs.eclipses; eclipseWithPlugins {
- eclipse = eclipse-platform;
- jvmArgs = [ "-Xmx2048m" ];
- plugins = [ plugins.color-theme ];
- };
-}
-
- to your Nixpkgs configuration
- (~/.config/nixpkgs/config.nix) and install it by
- running nix-env -f '<nixpkgs>' -iA myEclipse and
- afterward run Eclipse as usual. It is possible to find out which plugins are
- available for installation using eclipseWithPlugins by
- running
-
-$ nix-env -f '<nixpkgs>' -qaP -A eclipses.plugins --description
-
-
-
-
- If there is a need to install plugins that are not available in Nixpkgs then
- it may be possible to define these plugins outside Nixpkgs using the
- buildEclipseUpdateSite and
- buildEclipsePlugin functions found in the
- nixpkgs.eclipses.plugins attribute set. Use the
- buildEclipseUpdateSite function to install a plugin
- distributed as an Eclipse update site. This function takes { name,
- src } as argument where src indicates the
- Eclipse update site archive. All Eclipse features and plugins within the
- downloaded update site will be installed. When an update site archive is not
- available then the buildEclipsePlugin function can be
- used to install a plugin that consists of a pair of feature and plugin JARs.
- This function takes an argument { name, srcFeature, srcPlugin
- } where srcFeature and
- srcPlugin are the feature and plugin JARs, respectively.
-
-
-
- Expanding the previous example with two plugins using the above functions we
- have
-
-packageOverrides = pkgs: {
- myEclipse = with pkgs.eclipses; eclipseWithPlugins {
- eclipse = eclipse-platform;
- jvmArgs = [ "-Xmx2048m" ];
- plugins = [
- plugins.color-theme
- (plugins.buildEclipsePlugin {
- name = "myplugin1-1.0";
- srcFeature = fetchurl {
- url = "http://…/features/myplugin1.jar";
- sha256 = "123…";
- };
- srcPlugin = fetchurl {
- url = "http://…/plugins/myplugin1.jar";
- sha256 = "123…";
- };
- });
- (plugins.buildEclipseUpdateSite {
- name = "myplugin2-1.0";
- src = fetchurl {
- stripRoot = false;
- url = "http://…/myplugin2.zip";
- sha256 = "123…";
- };
- });
- ];
- };
-}
-
-
-
-
- Elm
-
-
- To start a development environment do nix-shell -p elmPackages.elm elmPackages.elm-format
-
-
-
- To update Elm compiler, see
- nixpkgs/pkgs/development/compilers/elm/README.md.
-
-
-
- To package Elm applications,
- read about
- elm2nix.
-
-
-
- Kakoune
-
-
- Kakoune can be built to autoload plugins:
-(kakoune.override {
- configure = {
- plugins = with pkgs.kakounePlugins; [ parinfer-rust ];
- };
-})
-
-
-
- Interactive shell helpers
-
-
- Some packages provide the shell integration to be more useful. But unlike
- other systems, nix doesn't have a standard share directory location. This is
- why a bunch PACKAGE-share scripts are shipped that print
- the location of the corresponding shared folder. Current list of such
- packages is as following:
-
-
-
- autojump: autojump-share
-
-
-
-
- fzf: fzf-share
-
-
-
- E.g. autojump can then used in the .bashrc like this:
-
- source "$(autojump-share)/autojump.bash"
-
-
-
-
- Weechat
-
-
- Weechat can be configured to include your choice of plugins, reducing its
- closure size from the default configuration which includes all available
- plugins. To make use of this functionality, install an expression that
- overrides its configuration such as
-weechat.override {configure = {availablePlugins, ...}: {
- plugins = with availablePlugins; [ python perl ];
- }
-}
- If the configure function returns an attrset without the
- plugins attribute, availablePlugins
- will be used automatically.
-
-
-
- The plugins currently available are python,
- perl, ruby, guile,
- tcl and lua.
-
-
-
- The python and perl plugins allows the addition of extra libraries. For
- instance, the inotify.py script in weechat-scripts
- requires D-Bus or libnotify, and the fish.py script
- requires pycrypto. To use these scripts, use the plugin's
- withPackages attribute:
-weechat.override { configure = {availablePlugins, ...}: {
- plugins = with availablePlugins; [
- (python.withPackages (ps: with ps; [ pycrypto python-dbus ]))
- ];
- };
-}
-
-
-
-
- In order to also keep all default plugins installed, it is possible to use
- the following method:
-weechat.override { configure = { availablePlugins, ... }: {
- plugins = builtins.attrValues (availablePlugins // {
- python = availablePlugins.python.withPackages (ps: with ps; [ pycrypto python-dbus ]);
- });
-}; }
-
-
-
-
- WeeChat allows to set defaults on startup using the
- --run-command. The configure method
- can be used to pass commands to the program:
-weechat.override {
- configure = { availablePlugins, ... }: {
- init = ''
- /set foo bar
- /server add freenode chat.freenode.org
- '';
- };
-}
- Further values can be added to the list of commands when running
- weechat --run-command "your-commands".
-
-
-
- Additionally it's possible to specify scripts to be loaded when starting
- weechat. These will be loaded before the commands from
- init:
-weechat.override {
- configure = { availablePlugins, ... }: {
- scripts = with pkgs.weechatScripts; [
- weechat-xmpp weechat-matrix-bridge wee-slack
- ];
- init = ''
- /set plugins.var.python.jabber.key "val"
- '':
- };
-}
-
-
-
- In nixpkgs there's a subpackage which contains
- derivations for WeeChat scripts. Such derivations expect a
- passthru.scripts attribute which contains a list of all
- scripts inside the store path. Furthermore all scripts have to live in
- $out/share. An exemplary derivation looks like this:
-{ stdenv, fetchurl }:
-
-stdenv.mkDerivation {
- name = "exemplary-weechat-script";
- src = fetchurl {
- url = "https://scripts.tld/your-scripts.tar.gz";
- sha256 = "...";
- };
- passthru.scripts = [ "foo.py" "bar.lua" ];
- installPhase = ''
- mkdir $out/share
- cp foo.py $out/share
- cp bar.lua $out/share
- '';
-}
-
-
-
- ibus-engines.typing-booster
-
-
- This package is an ibus-based completion method to speed up typing.
-
-
-
- Activating the engine
-
-
- IBus needs to be configured accordingly to activate
- typing-booster. The configuration depends on the desktop
- manager in use. For detailed instructions, please refer to the
- upstream
- docs.
-
-
-
- On NixOS you need to explicitly enable ibus with given
- engines before customizing your desktop to use
- typing-booster. This can be achieved using the
- ibus module:
-{ pkgs, ... }: {
- i18n.inputMethod = {
- enabled = "ibus";
- ibus.engines = with pkgs.ibus-engines; [ typing-booster ];
- };
-}
-
-
-
-
- Using custom hunspell dictionaries
-
-
- The IBus engine is based on hunspell to support
- completion in many languages. By default the dictionaries
- de-de, en-us, fr-moderne
- es-es, it-it,
- sv-se and sv-fi are in use. To add
- another dictionary, the package can be overridden like this:
-ibus-engines.typing-booster.override {
- langs = [ "de-at" "en-gb" ];
-}
-
-
-
- Note: each language passed to langs must be an
- attribute name in pkgs.hunspellDicts.
-
-
-
-
- Built-in emoji picker
-
-
- The ibus-engines.typing-booster package contains a
- program named emoji-picker. To display all emojis
- correctly, a special font such as noto-fonts-emoji is
- needed:
-
-
-
- On NixOS it can be installed using the following expression:
-{ pkgs, ... }: {
- fonts.fonts = with pkgs; [ noto-fonts-emoji ];
-}
-
-
-
-
- Nginx
-
-
- Nginx is a
- reverse proxy and lightweight webserver.
-
-
-
- ETags on static files served from the Nix store
-
-
- HTTP has a couple different mechanisms for caching to prevent
- clients from having to download the same content repeatedly
- if a resource has not changed since the last time it was requested.
- When nginx is used as a server for static files, it implements
- the caching mechanism based on the
- Last-Modified
- response header automatically; unfortunately, it works by using
- filesystem timestamps to determine the value of the
- Last-Modified header. This doesn't give the
- desired behavior when the file is in the Nix store, because all
- file timestamps are set to 0 (for reasons related to build
- reproducibility).
-
-
-
- Fortunately, HTTP supports an alternative (and more effective)
- caching mechanism: the
- ETag
- response header. The value of the ETag header
- specifies some identifier for the particular content that the
- server is sending (e.g. a hash). When a client makes a second
- request for the same resource, it sends that value back in an
- If-None-Match header. If the ETag value is
- unchanged, then the server does not need to resend the content.
-
-
-
- As of NixOS 19.09, the nginx package in Nixpkgs is patched such
- that when nginx serves a file out of /nix/store,
- the hash in the store path is used as the ETag
- header in the HTTP response, thus providing proper caching functionality.
- This happens automatically; you do not need to do modify any
- configuration to get this behavior.
-
-
-
-
diff --git a/doc/package-specific-user-notes.xml b/doc/package-specific-user-notes.xml
deleted file mode 100644
index a176f4d13959895c51ea78ca42b256ed9d46ced0..0000000000000000000000000000000000000000
--- a/doc/package-specific-user-notes.xml
+++ /dev/null
@@ -1,482 +0,0 @@
-
- Package-specific usage notes
-
- These chapters includes some notes
- that apply to specific packages and should
- answer some of the frequently asked questions
- related to Nixpkgs use.
-
- Some useful information related to package use
- can be found in package-specific development notes.
-
-
-
- OpenGL
-
-
- Packages that use OpenGL have NixOS desktop as their primary target. The
- current solution for loading the GPU-specific drivers is based on
- libglvnd and looks for the driver implementation in
- LD_LIBRARY_PATH. If you are using a non-NixOS
- GNU/Linux/X11 desktop with free software video drivers, consider launching
- OpenGL-dependent programs from Nixpkgs with Nixpkgs versions of
- libglvnd and mesa_drivers in
- LD_LIBRARY_PATH. For proprietary video drivers you might
- have luck with also adding the corresponding video driver package.
-
-
-
- Locales
-
-
- To allow simultaneous use of packages linked against different versions of
- glibc with different locale archive formats Nixpkgs
- patches glibc to rely on
- LOCALE_ARCHIVE environment variable.
-
-
-
- On non-NixOS distributions this variable is obviously not set. This can
- cause regressions in language support or even crashes in some
- Nixpkgs-provided programs. The simplest way to mitigate this problem is
- exporting the LOCALE_ARCHIVE variable pointing to
- ${glibcLocales}/lib/locale/locale-archive. The drawback
- (and the reason this is not the default) is the relatively large (a hundred
- MiB) size of the full set of locales. It is possible to build a custom set
- of locales by overriding parameters allLocales and
- locales of the package.
-
-
-
-
- Emacs
-
-
- Configuring Emacs
-
-
- The Emacs package comes with some extra helpers to make it easier to
- configure. emacsWithPackages allows you to manage
- packages from ELPA. This means that you will not have to install that
- packages from within Emacs. For instance, if you wanted to use
- company, counsel,
- flycheck, ivy,
- magit, projectile, and
- use-package you could use this as a
- ~/.config/nixpkgs/config.nix override:
-
-
-
-{
- packageOverrides = pkgs: with pkgs; {
- myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
- company
- counsel
- flycheck
- ivy
- magit
- projectile
- use-package
- ]));
- }
-}
-
-
-
- You can install it like any other packages via nix-env -iA
- myEmacs. However, this will only install those packages. It will
- not configure them for us. To do this, we need to
- provide a configuration file. Luckily, it is possible to do this from
- within Nix! By modifying the above example, we can make Emacs load a custom
- config file. The key is to create a package that provide a
- default.el file in
- /share/emacs/site-start/. Emacs knows to load this
- file automatically when it starts.
-
-
-
-{
- packageOverrides = pkgs: with pkgs; rec {
- myEmacsConfig = writeText "default.el" ''
-;; initialize package
-
-(require 'package)
-(package-initialize 'noactivate)
-(eval-when-compile
- (require 'use-package))
-
-;; load some packages
-
-(use-package company
- :bind ("<C-tab>" . company-complete)
- :diminish company-mode
- :commands (company-mode global-company-mode)
- :defer 1
- :config
- (global-company-mode))
-
-(use-package counsel
- :commands (counsel-descbinds)
- :bind (([remap execute-extended-command] . counsel-M-x)
- ("C-x C-f" . counsel-find-file)
- ("C-c g" . counsel-git)
- ("C-c j" . counsel-git-grep)
- ("C-c k" . counsel-ag)
- ("C-x l" . counsel-locate)
- ("M-y" . counsel-yank-pop)))
-
-(use-package flycheck
- :defer 2
- :config (global-flycheck-mode))
-
-(use-package ivy
- :defer 1
- :bind (("C-c C-r" . ivy-resume)
- ("C-x C-b" . ivy-switch-buffer)
- :map ivy-minibuffer-map
- ("C-j" . ivy-call))
- :diminish ivy-mode
- :commands ivy-mode
- :config
- (ivy-mode 1))
-
-(use-package magit
- :defer
- :if (executable-find "git")
- :bind (("C-x g" . magit-status)
- ("C-x G" . magit-dispatch-popup))
- :init
- (setq magit-completing-read-function 'ivy-completing-read))
-
-(use-package projectile
- :commands projectile-mode
- :bind-keymap ("C-c p" . projectile-command-map)
- :defer 5
- :config
- (projectile-global-mode))
- '';
- myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
- (runCommand "default.el" {} ''
-mkdir -p $out/share/emacs/site-lisp
-cp ${myEmacsConfig} $out/share/emacs/site-lisp/default.el
-'')
- company
- counsel
- flycheck
- ivy
- magit
- projectile
- use-package
- ]));
- };
-}
-
-
-
- This provides a fairly full Emacs start file. It will load in addition to
- the user's presonal config. You can always disable it by passing
- -q to the Emacs command.
-
-
-
- Sometimes emacsWithPackages is not enough, as this
- package set has some priorities imposed on packages (with the lowest
- priority assigned to Melpa Unstable, and the highest for packages manually
- defined in pkgs/top-level/emacs-packages.nix). But you
- can't control this priorities when some package is installed as a
- dependency. You can override it on per-package-basis, providing all the
- required dependencies manually - but it's tedious and there is always a
- possibility that an unwanted dependency will sneak in through some other
- package. To completely override such a package you can use
- overrideScope'.
-
-
-
-overrides = self: super: rec {
- haskell-mode = self.melpaPackages.haskell-mode;
- ...
-};
-((emacsPackagesGen emacs).overrideScope' overrides).emacsWithPackages (p: with p; [
- # here both these package will use haskell-mode of our own choice
- ghc-mod
- dante
-])
-
-
-
-
-
- DLib
-
-
- DLib is a modern, C++-based toolkit which
- provides several machine learning algorithms.
-
-
-
- Compiling without AVX support
-
-
- Especially older CPUs don't support
- AVX
- (Advanced Vector Extensions) instructions that are used by DLib to
- optimize their algorithms.
-
-
-
- On the affected hardware errors like Illegal instruction will occur.
- In those cases AVX support needs to be disabled:
-self: super: {
- dlib = super.dlib.override { avxSupport = false; };
-}
-
-
-
-
-
- Unfree software
-
-
- All users of Nixpkgs are free software users, and many users (and
- developers) of Nixpkgs want to limit and tightly control their exposure to
- unfree software. At the same time, many users need (or want)
- to run some specific
- pieces of proprietary software. Nixpkgs includes some expressions for unfree
- software packages. By default unfree software cannot be installed and
- doesn’t show up in searches. To allow installing unfree software in a
- single Nix invocation one can export
- NIXPKGS_ALLOW_UNFREE=1. For a persistent solution, users
- can set allowUnfree in the Nixpkgs configuration.
-
-
-
- Fine-grained control is possible by defining
- allowUnfreePredicate function in config; it takes the
- mkDerivation parameter attrset and returns
- true for unfree packages that should be allowed.
-
-
-
-
- Steam
-
-
- Steam in Nix
-
-
- Steam is distributed as a .deb file, for now only as
- an i686 package (the amd64 package only has documentation). When unpacked,
- it has a script called steam that in Ubuntu (their
- target distro) would go to /usr/bin . When run for the
- first time, this script copies some files to the user's home, which include
- another script that is the ultimate responsible for launching the steam
- binary, which is also in $HOME.
-
-
-
- Nix problems and constraints:
-
-
-
- We don't have /bin/bash and many scripts point
- there. Similarly for /usr/bin/python .
-
-
-
-
- We don't have the dynamic loader in /lib .
-
-
-
-
- The steam.sh script in $HOME can not be patched, as
- it is checked and rewritten by steam.
-
-
-
-
- The steam binary cannot be patched, it's also checked.
-
-
-
-
-
-
- The current approach to deploy Steam in NixOS is composing a FHS-compatible
- chroot environment, as documented
- here.
- This allows us to have binaries in the expected paths without disrupting
- the system, and to avoid patching them to work in a non FHS environment.
-
-
-
-
- How to play
-
-
- For 64-bit systems it's important to have
-hardware.opengl.driSupport32Bit = true;
- in your /etc/nixos/configuration.nix. You'll also need
-hardware.pulseaudio.support32Bit = true;
- if you are using PulseAudio - this will enable 32bit ALSA apps integration.
- To use the Steam controller or other Steam supported controllers such as
- the DualShock 4 or Nintendo Switch Pro, you need to add
-hardware.steam-hardware.enable = true;
- to your configuration.
-
-
-
-
- Troubleshooting
-
-
-
-
-
- Steam fails to start. What do I do?
-
-
-
- Try to run
-strace steam
- to see what is causing steam to fail.
-
-
-
-
-
- Using the FOSS Radeon or nouveau (nvidia) drivers
-
-
-
-
-
- The newStdcpp parameter was removed since NixOS
- 17.09 and should not be needed anymore.
-
-
-
-
- Steam ships statically linked with a version of libcrypto that
- conflics with the one dynamically loaded by radeonsi_dri.so. If you
- get the error
-steam.sh: line 713: 7842 Segmentation fault (core dumped)
- have a look at
- this
- pull request.
-
-
-
-
-
-
-
- Java
-
-
-
-
-
- There is no java in steam chrootenv by default. If you get a message
- like
-/home/foo/.local/share/Steam/SteamApps/common/towns/towns.sh: line 1: java: command not found
- You need to add
- steam.override { withJava = true; };
- to your configuration.
-
-
-
-
-
-
-
-
-
-
- steam-run
-
-
- The FHS-compatible chroot used for steam can also be used to run other
- linux games that expect a FHS environment. To do it, add
-pkgs.(steam.override {
- nativeOnly = true;
- newStdcpp = true;
- }).run
- to your configuration, rebuild, and run the game with
-steam-run ./foo
-
-
-
-
-
- Citrix Receiver & Citrix Workspace App
-
-
-
-
- Please note that the citrix_receiver package has been deprecated since its
- development was discontinued by upstream
- and will be replaced by the citrix workspace app.
-
-
- Citrix Receiver and
- Citrix Workspace App
- are a remote desktop viewers which provide access to
- XenDesktop
- installations.
-
-
-
- Basic usage
-
-
- The tarball archive needs to be downloaded manually as the license
- agreements of the vendor for
- Citrix Receiver
- or Citrix Workspace
- need to be accepted first.
- Then run nix-prefetch-url file://$PWD/linuxx64-$version.tar.gz.
- With the archive available
- in the store the package can be built and installed with Nix.
-
-
-
- Caution with nix-shell installs
-
- It's recommended to install Citrix Receiver
- and/or Citrix Workspace using
- nix-env -i or globally to
- ensure that the .desktop files are installed properly
- into $XDG_CONFIG_DIRS. Otherwise it won't be possible to
- open .ica files automatically from the browser to start
- a Citrix connection.
-
-
-
-
-
- Custom certificates
-
-
- The Citrix Receiver and Citrix Workspace App
- in nixpkgs trust several certificates
- from the
- Mozilla database by default. However several companies using Citrix
- might require their own corporate certificate. On distros with imperative
- packaging these certs can be stored easily in
- $ICAROOT,
- however this directory is a store path in nixpkgs. In
- order to work around this issue the package provides a simple mechanism to
- add custom certificates without rebuilding the entire package using
- symlinkJoin:
-
- { config.allowUnfree = true; };
-let extraCerts = [ ./custom-cert-1.pem ./custom-cert-2.pem /* ... */ ]; in
-citrix_workspace.override { # the same applies for `citrix_receiver` if used.
- inherit extraCerts;
-}]]>
-
-
-
-
-
diff --git a/doc/introduction.chapter.md b/doc/preface.chapter.md
similarity index 67%
rename from doc/introduction.chapter.md
rename to doc/preface.chapter.md
index 6abdc2714e2c7c47e5af897490d4e65c20482d07..88ca5e2e3cec591c744ed1c5218ef66787abc64b 100644
--- a/doc/introduction.chapter.md
+++ b/doc/preface.chapter.md
@@ -1,44 +1,45 @@
---
-title: Introduction
+title: Preface
author: Frederik Rietdijk
date: 2015-11-25
---
-# Introduction
+# Preface
The Nix Packages collection (Nixpkgs) is a set of thousands of packages for the
-[Nix package manager](http://nixos.org/nix/), released under a
+[Nix package manager](https://nixos.org/nix/), released under a
[permissive MIT/X11 license](https://github.com/NixOS/nixpkgs/blob/master/COPYING).
Packages are available for several platforms, and can be used with the Nix
-package manager on most GNU/Linux distributions as well as NixOS.
+package manager on most GNU/Linux distributions as well as [NixOS](https://nixos.org/nixos).
This manual primarily describes how to write packages for the Nix Packages collection
(Nixpkgs). Thus it’s mainly for packagers and developers who want to add packages to
Nixpkgs. If you like to learn more about the Nix package manager and the Nix
-expression language, then you are kindly referred to the [Nix manual](http://nixos.org/nix/manual/).
+expression language, then you are kindly referred to the [Nix manual](https://nixos.org/nix/manual/).
+The NixOS distribution is documented in the [NixOS manual](https://nixos.org/nixos/manual/).
## Overview of Nixpkgs
Nix expressions describe how to build packages from source and are collected in
the [nixpkgs repository](https://github.com/NixOS/nixpkgs). Also included in the
collection are Nix expressions for
-[NixOS modules](http://nixos.org/nixos/manual/index.html#sec-writing-modules).
+[NixOS modules](https://nixos.org/nixos/manual/index.html#sec-writing-modules).
With these expressions the Nix package manager can build binary packages.
Packages, including the Nix packages collection, are distributed through
-[channels](http://nixos.org/nix/manual/#sec-channels). The collection is
+[channels](https://nixos.org/nix/manual/#sec-channels). The collection is
distributed for users of Nix on non-NixOS distributions through the channel
`nixpkgs`. Users of NixOS generally use one of the `nixos-*` channels, e.g.
-`nixos-16.03`, which includes all packages and modules for the stable NixOS
-16.03. Stable NixOS releases are generally only given
+`nixos-19.09`, which includes all packages and modules for the stable NixOS
+19.09. Stable NixOS releases are generally only given
security updates. More up to date packages and modules are available via the
`nixos-unstable` channel.
Both `nixos-unstable` and `nixpkgs` follow the `master` branch of the Nixpkgs
repository, although both do lag the `master` branch by generally
-[a couple of days](http://howoldis.herokuapp.com/). Updates to a channel are
+[a couple of days](https://howoldis.herokuapp.com/). Updates to a channel are
distributed as soon as all tests for that channel pass, e.g.
-[this table](http://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
+[this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
shows the status of tests for the `nixpkgs` channel.
The tests are conducted by a cluster called [Hydra](http://nixos.org/hydra/),
@@ -47,5 +48,5 @@ which also builds binary packages from the Nix expressions in Nixpkgs for
The binaries are made available via a [binary cache](https://cache.nixos.org).
The current Nix expressions of the channels are available in the
-[`nixpkgs-channels`](https://github.com/NixOS/nixpkgs-channels) repository,
-which has branches corresponding to the available channels.
+[`nixpkgs`](https://github.com/NixOS/nixpkgs) repository in branches
+that correspond to the channel names (e.g. `nixos-19.09-small`).
diff --git a/doc/release-notes.xml b/doc/release-notes.xml
index 8d9b1813010a291607c4601b592bc7039f3f15c6..b85f61da079c0444e1cb0a2205db087686f803a4 100644
--- a/doc/release-notes.xml
+++ b/doc/release-notes.xml
@@ -6,15 +6,11 @@
Release 0.14 (June 4, 2012)
- In preparation for the switch from Subversion to Git, this release is mainly
- the prevent the Nixpkgs version number from going backwards. (This would
- happen because prerelease version numbers produced for the Git repository
- are lower than those for the Subversion repository.)
+ In preparation for the switch from Subversion to Git, this release is mainly the prevent the Nixpkgs version number from going backwards. (This would happen because prerelease version numbers produced for the Git repository are lower than those for the Subversion repository.)
- Since the last release, there have been thousands of changes and new
- packages by numerous contributors. For details, see the commit logs.
+ Since the last release, there have been thousands of changes and new packages by numerous contributors. For details, see the commit logs.
@@ -55,14 +51,11 @@
Release 0.12 (April 24, 2009)
- There are way too many additions to Nixpkgs since the last release to list
- here: for example, the number of packages on Linux has increased from 1002
- to 2159. However, some specific improvements are worth listing:
+ There are way too many additions to Nixpkgs since the last release to list here: for example, the number of packages on Linux has increased from 1002 to 2159. However, some specific improvements are worth listing:
- Nixpkgs now has a manual. In particular, it describes the standard build
- environment in detail.
+ Nixpkgs now has a manual. In particular, it describes the standard build environment in detail.
@@ -122,9 +115,7 @@
- Support for building derivations in a virtual machine, including RPM and
- Debian builds in automatically generated VM images. See
- pkgs/build-support/vm/default.nix for details.
+ Support for building derivations in a virtual machine, including RPM and Debian builds in automatically generated VM images. See pkgs/build-support/vm/default.nix for details.
@@ -136,13 +127,7 @@
- The following people contributed to this release: Andres Löh, Arie
- Middelkoop, Armijn Hemel, Eelco Dolstra, Lluís Batlle, Ludovic Courtès,
- Marc Weber, Mart Kolthof, Martin Bravenboer, Michael Raskin, Nicolas
- Pierron, Peter Simons, Pjotr Prins, Rob Vermaas, Sander van der Burg, Tobias
- Hammerschmidt, Valentin David, Wouter den Breejen and Yury G. Kudryashov. In
- addition, several people contributed patches on the
- nix-dev mailing list.
+ The following people contributed to this release: Andres Löh, Arie Middelkoop, Armijn Hemel, Eelco Dolstra, Lluís Batlle, Ludovic Courtès, Marc Weber, Mart Kolthof, Martin Bravenboer, Michael Raskin, Nicolas Pierron, Peter Simons, Pjotr Prins, Rob Vermaas, Sander van der Burg, Tobias Hammerschmidt, Valentin David, Wouter den Breejen and Yury G. Kudryashov. In addition, several people contributed patches on the nix-dev mailing list.
@@ -153,25 +138,12 @@
- The standard build environment (stdenv) is now pure on
- the x86_64-linux and powerpc-linux
- platforms, just as on i686-linux. (Purity means that
- building and using the standard environment has no dependencies outside
- of the Nix store. For instance, it doesn’t require an external C
- compiler such as /usr/bin/gcc.) Also, the statically
- linked binaries used in the bootstrap process are now automatically
- reproducible, making it easy to update the bootstrap tools and to add
- support for other Linux platforms. See
- pkgs/stdenv/linux/make-bootstrap-tools.nix for
- details.
+ The standard build environment (stdenv) is now pure on the x86_64-linux and powerpc-linux platforms, just as on i686-linux. (Purity means that building and using the standard environment has no dependencies outside of the Nix store. For instance, it doesn’t require an external C compiler such as /usr/bin/gcc.) Also, the statically linked binaries used in the bootstrap process are now automatically reproducible, making it easy to update the bootstrap tools and to add support for other Linux platforms. See pkgs/stdenv/linux/make-bootstrap-tools.nix for details.
- Hook variables in the generic builder are now executed using the
- eval shell command. This has a major advantage: you
- can write hooks directly in Nix expressions. For instance, rather than
- writing a builder like this:
+ Hook variables in the generic builder are now executed using the eval shell command. This has a major advantage: you can write hooks directly in Nix expressions. For instance, rather than writing a builder like this:
source $stdenv/setup
@@ -182,91 +154,57 @@ postInstall() {
}
genericBuild
- (the gzip builder), you can just add this attribute to
- the derivation:
+ (the gzip builder), you can just add this attribute to the derivation:
postInstall = "ln -sf gzip $out/bin/gunzip; ln -sf gzip $out/bin/zcat";
- and so a separate build script becomes unnecessary. This should allow us
- to get rid of most builders in Nixpkgs.
+ and so a separate build script becomes unnecessary. This should allow us to get rid of most builders in Nixpkgs.
- It is now possible to have the generic builder pass arguments to
- configure and make that contain
- whitespace. Previously, for example, you could say in a builder,
+ It is now possible to have the generic builder pass arguments to configure and make that contain whitespace. Previously, for example, you could say in a builder,
configureFlags="CFLAGS=-O0"
but not
configureFlags="CFLAGS=-O0 -g"
- since the -g would be interpreted as a separate
- argument to configure. Now you can say
+ since the -g would be interpreted as a separate argument to configure. Now you can say
configureFlagsArray=("CFLAGS=-O0 -g")
or similarly
configureFlagsArray=("CFLAGS=-O0 -g" "LDFLAGS=-L/foo -L/bar")
- which does the right thing. Idem for makeFlags,
- installFlags, checkFlags and
- distFlags.
+ which does the right thing. Idem for makeFlags, installFlags, checkFlags and distFlags.
- Unfortunately you can't pass arrays to Bash through the environment, so
- you can't put the array above in a Nix expression, e.g.,
+ Unfortunately you can't pass arrays to Bash through the environment, so you can't put the array above in a Nix expression, e.g.,
configureFlagsArray = ["CFLAGS=-O0 -g"];
- since it would just be flattened to a since string. However, you
- can use the inline hooks described above:
+ since it would just be flattened to a since string. However, you can use the inline hooks described above:
preConfigure = "configureFlagsArray=(\"CFLAGS=-O0 -g\")";
- The function fetchurl now has support for two
- different kinds of mirroring of files. First, it has support for
- content-addressable mirrors. For example, given the
- fetchurl call
+ The function fetchurl now has support for two different kinds of mirroring of files. First, it has support for content-addressable mirrors. For example, given the fetchurl call
fetchurl {
url = http://releases.mozilla.org/.../firefox-2.0.0.6-source.tar.bz2;
sha1 = "eb72f55e4a8bf08e8c6ef227c0ade3d068ba1082";
}
- fetchurl will first try to download this file from
- .
- If that file doesn’t exist, it will try the original URL. In general,
- the “content-addressed” location is
- mirror/hash-type/hash.
- There is currently only one content-addressable mirror
- (), but more can be
- specified in the hashedMirrors attribute in
- pkgs/build-support/fetchurl/mirrors.nix, or by
- setting the NIX_HASHED_MIRRORS environment variable to a
- whitespace-separated list of URLs.
+ fetchurl will first try to download this file from . If that file doesn’t exist, it will try the original URL. In general, the “content-addressed” location is mirror/hash-type/hash. There is currently only one content-addressable mirror (), but more can be specified in the hashedMirrors attribute in pkgs/build-support/fetchurl/mirrors.nix, or by setting the NIX_HASHED_MIRRORS environment variable to a whitespace-separated list of URLs.
- Second, fetchurl has support for widely-mirrored
- distribution sites such as SourceForge or the Linux kernel archives.
- Given a URL of the form
- mirror://site/path,
- it will try to download path from a
- configurable list of mirrors for site. (This
- idea was borrowed from Gentoo Linux.) Example:
+ Second, fetchurl has support for widely-mirrored distribution sites such as SourceForge or the Linux kernel archives. Given a URL of the form mirror://site/path, it will try to download path from a configurable list of mirrors for site. (This idea was borrowed from Gentoo Linux.) Example:
fetchurl {
url = mirror://gnu/gcc/gcc-4.2.0/gcc-core-4.2.0.tar.bz2;
sha256 = "0ykhzxhr8857dr97z0j9wyybfz1kjr71xk457cfapfw5fjas4ny1";
}
- Currently site can be
- sourceforge, gnu and
- kernel. The list of mirrors is defined in
- pkgs/build-support/fetchurl/mirrors.nix. You can
- override the list of mirrors for a particular site by setting the
- environment variable
- NIX_MIRRORS_site, e.g.
+ Currently site can be sourceforge, gnu and kernel. The list of mirrors is defined in pkgs/build-support/fetchurl/mirrors.nix. You can override the list of mirrors for a particular site by setting the environment variable NIX_MIRRORS_site, e.g.
export NIX_MIRRORS_sourceforge=http://osdn.dl.sourceforge.net/sourceforge/
@@ -339,9 +277,7 @@ export NIX_MIRRORS_sourceforge=http://osdn.dl.sourceforge.net/sourceforge/
- The following people contributed to this release: Andres Löh, Arie
- Middelkoop, Armijn Hemel, Eelco Dolstra, Marc Weber, Mart Kolthof, Martin
- Bravenboer, Michael Raskin, Wouter den Breejen and Yury G. Kudryashov.
+ The following people contributed to this release: Andres Löh, Arie Middelkoop, Armijn Hemel, Eelco Dolstra, Marc Weber, Mart Kolthof, Martin Bravenboer, Michael Raskin, Wouter den Breejen and Yury G. Kudryashov.
@@ -349,10 +285,8 @@ export NIX_MIRRORS_sourceforge=http://osdn.dl.sourceforge.net/sourceforge/
- This release of Nixpkgs requires
- Nix 0.10
- or higher.
+ This release of Nixpkgs requires Nix 0.10 or higher.
@@ -363,32 +297,15 @@ xlink:href='http://nixos.org/releases/nix/nix-0.10/'>Nix 0.10
- pkgs/system/all-packages-generic.nix is gone, we now
- just have pkgs/top-level/all-packages.nix that
- contains all available packages. This should cause much less confusion
- with users. all-packages.nix is a function that by
- default returns packages for the current platform, but you can override
- this by specifying a different system argument.
+ pkgs/system/all-packages-generic.nix is gone, we now just have pkgs/top-level/all-packages.nix that contains all available packages. This should cause much less confusion with users. all-packages.nix is a function that by default returns packages for the current platform, but you can override this by specifying a different system argument.
- Certain packages in Nixpkgs are now user-configurable through a
- configuration file, i.e., without having to edit the Nix expressions in
- Nixpkgs. For instance, the Firefox provided in the Nixpkgs channel is
- built without the RealPlayer plugin (for legal reasons). Previously, you
- could easily enable RealPlayer support by editing the call to the Firefox
- function in all-packages.nix, but such changes are
- not respected when Firefox is subsequently updated through the Nixpkgs
- channel.
+ Certain packages in Nixpkgs are now user-configurable through a configuration file, i.e., without having to edit the Nix expressions in Nixpkgs. For instance, the Firefox provided in the Nixpkgs channel is built without the RealPlayer plugin (for legal reasons). Previously, you could easily enable RealPlayer support by editing the call to the Firefox function in all-packages.nix, but such changes are not respected when Firefox is subsequently updated through the Nixpkgs channel.
- The Nixpkgs configuration file (found in
- ~/.nixpkgs/config.nix or through the
- NIXPKGS_CONFIG environment variable) is an attribute set
- that contains configuration options that
- all-packages.nix reads and uses for certain packages.
- For instance, the following configuration file:
+ The Nixpkgs configuration file (found in ~/.nixpkgs/config.nix or through the NIXPKGS_CONFIG environment variable) is an attribute set that contains configuration options that all-packages.nix reads and uses for certain packages. For instance, the following configuration file:
{
firefox = {
@@ -398,9 +315,7 @@ xlink:href='http://nixos.org/releases/nix/nix-0.10/'>Nix 0.10
persistently enables RealPlayer support in the Firefox build.
- (Actually, firefox.enableRealPlayer is the
- only configuration option currently available, but
- more are sure to be added.)
+ (Actually, firefox.enableRealPlayer is the only configuration option currently available, but more are sure to be added.)
@@ -409,17 +324,8 @@ xlink:href='http://nixos.org/releases/nix/nix-0.10/'>Nix 0.10
- i686-cygwin, i.e., Windows (using
- Cygwin). The standard
- environment on i686-cygwin by default builds
- binaries for the Cygwin environment (i.e., it uses Cygwin tools and
- produces executables that use the Cygwin library). However, there is
- also a standard environment that produces binaries that use
- MinGW. You can
- use it by calling all-package.nix with the
- stdenvType argument set to
- "i686-mingw".
+ i686-cygwin, i.e., Windows (using Cygwin). The standard environment on i686-cygwin by default builds binaries for the Cygwin environment (i.e., it uses Cygwin tools and produces executables that use the Cygwin library). However, there is also a standard environment that produces binaries that use MinGW. You can use it by calling all-package.nix with the stdenvType argument set to "i686-mingw".
@@ -434,9 +340,7 @@ xlink:href='http://nixos.org/releases/nix/nix-0.10/'>Nix 0.10
- x86_64-linux, i.e., Linux on 64-bit AMD/Intel CPUs.
- Unlike i686-linux, this platform doesn’t have a
- pure stdenv yet.
+ x86_64-linux, i.e., Linux on 64-bit AMD/Intel CPUs. Unlike i686-linux, this platform doesn’t have a pure stdenv yet.
@@ -472,21 +376,10 @@ xlink:href='http://nixos.org/releases/nix/nix-0.10/'>Nix 0.10
- It is now much easier to override the default C
- compiler and other tools in stdenv for specific
- packages. all-packages.nix provides two utility
- functions for this purpose: overrideGCC and
- overrideInStdenv. Both take a
- stdenv and return an augmented
- stdenv; the formed changes the C compiler, and the
- latter adds additional packages to the front of
- stdenv’s initial PATH, allowing tools
- to be overridden.
+ It is now much easier to override the default C compiler and other tools in stdenv for specific packages. all-packages.nix provides two utility functions for this purpose: overrideGCC and overrideInStdenv. Both take a stdenv and return an augmented stdenv; the formed changes the C compiler, and the latter adds additional packages to the front of stdenv’s initial PATH, allowing tools to be overridden.
- For instance, the package strategoxt doesn’t build
- with the GNU Make in stdenv (version 3.81), so we call
- it with an augmented stdenv that uses GNU Make 3.80:
+ For instance, the package strategoxt doesn’t build with the GNU Make in stdenv (version 3.81), so we call it with an augmented stdenv that uses GNU Make 3.80:
strategoxt = (import ../development/compilers/strategoxt) {
inherit fetchurl pkgconfig sdf aterm;
@@ -494,8 +387,7 @@ strategoxt = (import ../development/compilers/strategoxt) {
};
gnumake380 = ...;
- Likewise, there are many packages that don’t compile with the default
- GCC (4.1.1), but that’s easily fixed:
+ Likewise, there are many packages that don’t compile with the default GCC (4.1.1), but that’s easily fixed:
exult = import ../games/exult {
inherit fetchurl SDL SDL_mixer zlib libpng unzip;
@@ -505,13 +397,7 @@ exult = import ../games/exult {
- It has also become much easier to experiment with changes to the
- stdenv setup script (which notably contains the generic
- builder). Since edits to pkgs/stdenv/generic/setup.sh
- trigger a rebuild of everything, this was formerly
- quite painful. But now stdenv contains a function to
- “regenerate” stdenv with a different setup script,
- allowing the use of a different setup script for specific packages:
+ It has also become much easier to experiment with changes to the stdenv setup script (which notably contains the generic builder). Since edits to pkgs/stdenv/generic/setup.sh trigger a rebuild of everything, this was formerly quite painful. But now stdenv contains a function to “regenerate” stdenv with a different setup script, allowing the use of a different setup script for specific packages:
pkg = import ... {
stdenv = stdenv.regenerate ./my-setup.sh;
@@ -521,10 +407,7 @@ pkg = import ... {
- Packages can now have a human-readable description
- field. Package descriptions are shown by nix-env -qa
- --description. In addition, they’re shown on the Nixpkgs
- release page. A description can be added to a package as follows:
+ Packages can now have a human-readable description field. Package descriptions are shown by nix-env -qa --description. In addition, they’re shown on the Nixpkgs release page. A description can be added to a package as follows:
stdenv.mkDerivation {
name = "exult-1.2";
@@ -533,34 +416,26 @@ stdenv.mkDerivation {
description = "A reimplementation of the Ultima VII game engine";
};
}
- The meta attribute is not passed to the builder, so
- changes to the description do not trigger a rebuild. Additional
- meta attributes may be defined in the future (such as
- the URL of the package’s homepage, the license, etc.).
+ The meta attribute is not passed to the builder, so changes to the description do not trigger a rebuild. Additional meta attributes may be defined in the future (such as the URL of the package’s homepage, the license, etc.).
- The following people contributed to this release: Andres Löh, Armijn Hemel,
- Christof Douma, Eelco Dolstra, Eelco Visser, Mart Kolthof, Martin
- Bravenboer, Merijn de Jonge, Rob Vermaas and Roy van den Broek.
+ The following people contributed to this release: Andres Löh, Armijn Hemel, Christof Douma, Eelco Dolstra, Eelco Visser, Mart Kolthof, Martin Bravenboer, Merijn de Jonge, Rob Vermaas and Roy van den Broek.
Release 0.9 (January 31, 2006)
- There have been zillions of changes since the last release of Nixpkgs. Many
- packages have been added or updated. The following are some of the more
- notable changes:
+ There have been zillions of changes since the last release of Nixpkgs. Many packages have been added or updated. The following are some of the more notable changes:
- Distribution files have been moved to
- .
@@ -576,24 +451,17 @@ stdenv.mkDerivation {
- The old, unofficial Xlibs has been replaced by the official modularised
- X11 distribution from X.org, i.e., X11R7.0. X11R7.0 consists of 287 (!)
- packages, all of which are in Nixpkgs though not all have been tested. It
- is now possible to build a working X server (previously we only had X
- client libraries). We use a fully Nixified X server on NixOS.
+ The old, unofficial Xlibs has been replaced by the official modularised X11 distribution from X.org, i.e., X11R7.0. X11R7.0 consists of 287 (!) packages, all of which are in Nixpkgs though not all have been tested. It is now possible to build a working X server (previously we only had X client libraries). We use a fully Nixified X server on NixOS.
- The Sun JDK 5 has been purified, i.e., it doesn’t require any non-Nix
- components such as /lib/ld-linux.so.2. This means
- that Java applications such as Eclipse and Azureus can run on NixOS.
+ The Sun JDK 5 has been purified, i.e., it doesn’t require any non-Nix components such as /lib/ld-linux.so.2. This means that Java applications such as Eclipse and Azureus can run on NixOS.
- Hardware-accelerated OpenGL support, used by games like Quake 3 (which is
- now built from source).
+ Hardware-accelerated OpenGL support, used by games like Quake 3 (which is now built from source).
@@ -608,8 +476,7 @@ stdenv.mkDerivation {
- Some support for cross-compilation: cross-compiling builds of GCC and
- Binutils, and cross-compiled builds of the C library uClibc.
+ Some support for cross-compilation: cross-compiling builds of GCC and Binutils, and cross-compiled builds of the C library uClibc.
@@ -618,8 +485,7 @@ stdenv.mkDerivation {
- teTeX, including support for building LaTeX documents using Nix (with
- automatic dependency determination).
+ teTeX, including support for building LaTeX documents using Nix (with automatic dependency determination).
@@ -629,14 +495,12 @@ stdenv.mkDerivation {
- System-level packages to support NixOS, e.g. Grub, GNU
- parted and so on.
+ System-level packages to support NixOS, e.g. Grub, GNU parted and so on.
- ecj, the Eclipse Compiler for Java, so we finally
- have a freely distributable compiler that supports Java 5.0.
+ ecj, the Eclipse Compiler for Java, so we finally have a freely distributable compiler that supports Java 5.0.
@@ -661,8 +525,7 @@ stdenv.mkDerivation {
- kdelibs. This allows us to add KDE-based packages
- (such as kcachegrind).
+ kdelibs. This allows us to add KDE-based packages (such as kcachegrind).
@@ -671,17 +534,14 @@ stdenv.mkDerivation {
- The following people contributed to this release: Andres Löh, Armijn Hemel,
- Bogdan Dumitriu, Christof Douma, Eelco Dolstra, Eelco Visser, Mart Kolthof,
- Martin Bravenboer, Rob Vermaas and Roy van den Broek.
+ The following people contributed to this release: Andres Löh, Armijn Hemel, Bogdan Dumitriu, Christof Douma, Eelco Dolstra, Eelco Visser, Mart Kolthof, Martin Bravenboer, Rob Vermaas and Roy van den Broek.
Release 0.8 (April 11, 2005)
- This release is mostly to remain synchronised with the changed hashing
- scheme in Nix 0.8.
+ This release is mostly to remain synchronised with the changed hashing scheme in Nix 0.8.
@@ -706,16 +566,10 @@ stdenv.mkDerivation {
- The bootstrap process for the standard build environment on Linux
- (stdenv-linux) has been improved. It is no longer dependent in its initial
- bootstrap stages on the system Glibc, GCC, and other tools. Rather,
- Nixpkgs contains a statically linked bash and curl, and uses that to
- download other statically linked tools. These are then used to build a
- Glibc and dynamically linked versions of all other tools.
+ The bootstrap process for the standard build environment on Linux (stdenv-linux) has been improved. It is no longer dependent in its initial bootstrap stages on the system Glibc, GCC, and other tools. Rather, Nixpkgs contains a statically linked bash and curl, and uses that to download other statically linked tools. These are then used to build a Glibc and dynamically linked versions of all other tools.
- This change also makes the bootstrap process faster. For instance, GCC is
- built only once instead of three times.
+ This change also makes the bootstrap process faster. For instance, GCC is built only once instead of three times.
(Contributed by Armijn Hemel.)
@@ -723,17 +577,13 @@ stdenv.mkDerivation {
- Tarballs used by Nixpkgs are now obtained from the same server that hosts
- Nixpkgs (). This
- reduces the risk of packages being unbuildable due to moved or deleted
- files on various servers.
+ Tarballs used by Nixpkgs are now obtained from the same server that hosts Nixpkgs (). This reduces the risk of packages being unbuildable due to moved or deleted files on various servers.
- There now is a generic mechanism for building Perl modules. See the
- various Perl modules defined in pkgs/system/all-packages-generic.nix.
+ There now is a generic mechanism for building Perl modules. See the various Perl modules defined in pkgs/system/all-packages-generic.nix.
diff --git a/doc/stdenv.xml b/doc/stdenv.xml
deleted file mode 100644
index 15a13ba49e8e702f04a6882db3ce15d9b7dd45cf..0000000000000000000000000000000000000000
--- a/doc/stdenv.xml
+++ /dev/null
@@ -1,3136 +0,0 @@
-
- The Standard Environment
-
- The standard build environment in the Nix Packages collection provides an
- environment for building Unix packages that does a lot of common build tasks
- automatically. In fact, for Unix packages that use the standard
- ./configure; make; make install build interface, you
- don’t need to write a build script at all; the standard environment does
- everything automatically. If stdenv doesn’t do what you
- need automatically, you can easily customise or override the various build
- phases.
-
-
- Using stdenv
-
-
- To build a package with the standard environment, you use the function
- stdenv.mkDerivation, instead of the primitive built-in
- function derivation, e.g.
-
-stdenv.mkDerivation {
- name = "libfoo-1.2.3";
- src = fetchurl {
- url = http://example.org/libfoo-1.2.3.tar.bz2;
- sha256 = "0x2g1jqygyr5wiwg4ma1nd7w4ydpy82z9gkcv8vh2v8dn3y58v5m";
- };
-}
- (stdenv needs to be in scope, so if you write this in a
- separate Nix expression from pkgs/all-packages.nix, you
- need to pass it as a function argument.) Specifying a
- name and a src is the absolute minimum
- Nix requires. For convenience, you can also use pname and
- version attributes and mkDerivation
- will automatically set name to
- "${pname}-${version}" by default. Since
- RFC 0035,
- this is preferred for packages in Nixpkgs, as it allows us to reuse the
- version easily:
-
-stdenv.mkDerivation rec {
- pname = "libfoo";
- version = "1.2.3";
- src = fetchurl {
- url = "http://example.org/libfoo-source-${version}.tar.bz2";
- sha256 = "0x2g1jqygyr5wiwg4ma1nd7w4ydpy82z9gkcv8vh2v8dn3y58v5m";
- };
-}
-
-
-
- Many packages have dependencies that are not provided in the standard
- environment. It’s usually sufficient to specify those dependencies in the
- buildInputs attribute:
-
-stdenv.mkDerivation {
- name = "libfoo-1.2.3";
- ...
- buildInputs = [libbar perl ncurses];
-}
- This attribute ensures that the bin subdirectories of
- these packages appear in the PATH environment variable during
- the build, that their include subdirectories are
- searched by the C compiler, and so on. (See
- for details.)
-
-
-
- Often it is necessary to override or modify some aspect of the build. To
- make this easier, the standard environment breaks the package build into a
- number of phases, all of which can be overridden or
- modified individually: unpacking the sources, applying patches, configuring,
- building, and installing. (There are some others; see
- .) For instance, a package that doesn’t
- supply a makefile but instead has to be compiled “manually” could be
- handled like this:
-
-stdenv.mkDerivation {
- name = "fnord-4.5";
- ...
- buildPhase = ''
- gcc foo.c -o foo
- '';
- installPhase = ''
- mkdir -p $out/bin
- cp foo $out/bin
- '';
-}
- (Note the use of ''-style string literals, which are very
- convenient for large multi-line script fragments because they don’t need
- escaping of " and \, and because
- indentation is intelligently removed.)
-
-
-
- There are many other attributes to customise the build. These are listed in
- .
-
-
-
- While the standard environment provides a generic builder, you can still
- supply your own build script:
-
-stdenv.mkDerivation {
- name = "libfoo-1.2.3";
- ...
- builder = ./builder.sh;
-}
- where the builder can do anything it wants, but typically starts with
-
-source $stdenv/setup
-
- to let stdenv set up the environment (e.g., process the
- buildInputs). If you want, you can still use
- stdenv’s generic builder:
-
-source $stdenv/setup
-
-buildPhase() {
- echo "... this is my custom build phase ..."
- gcc foo.c -o foo
-}
-
-installPhase() {
- mkdir -p $out/bin
- cp foo $out/bin
-}
-
-genericBuild
-
-
-
-
- Tools provided by stdenv
-
-
- The standard environment provides the following packages:
-
-
-
- The GNU C Compiler, configured with C and C++ support.
-
-
-
-
- GNU coreutils (contains a few dozen standard Unix commands).
-
-
-
-
- GNU findutils (contains find).
-
-
-
-
- GNU diffutils (contains diff, cmp).
-
-
-
-
- GNU sed.
-
-
-
-
- GNU grep.
-
-
-
-
- GNU awk.
-
-
-
-
- GNU tar.
-
-
-
-
- gzip, bzip2 and
- xz.
-
-
-
-
- GNU Make. It has been patched to provide nested output
- that can be fed into the nix-log2xml command and
- log2html stylesheet to create a structured, readable
- output of the build steps performed by Make.
-
-
-
-
- Bash. This is the shell used for all builders in the Nix Packages
- collection. Not using /bin/sh removes a large source
- of portability problems.
-
-
-
-
- The patch command.
-
-
-
-
-
-
- On Linux, stdenv also includes the
- patchelf utility.
-
-
-
- Specifying dependencies
-
-
- As described in the Nix manual, almost any *.drv store
- path in a derivation's attribute set will induce a dependency on that
- derivation. mkDerivation, however, takes a few attributes
- intended to, between them, include all the dependencies of a package. This
- is done both for structure and consistency, but also so that certain other
- setup can take place. For example, certain dependencies need their bin
- directories added to the PATH. That is built-in, but other
- setup is done via a pluggable mechanism that works in conjunction with these
- dependency attributes. See for details.
-
-
-
- Dependencies can be broken down along three axes: their host and target
- platforms relative to the new derivation's, and whether they are propagated.
- The platform distinctions are motivated by cross compilation; see
- for exactly what each platform means.
-
-
- The build platform is ignored because it is a mere implementation detail
- of the package satisfying the dependency: As a general programming
- principle, dependencies are always specified as
- interfaces, not concrete implementation.
-
-
- But even if one is not cross compiling, the platforms imply whether or not
- the dependency is needed at run-time or build-time, a concept that makes
- perfect sense outside of cross compilation. By default, the
- run-time/build-time distinction is just a hint for mental clarity, but with
- strictDeps set it is mostly enforced even in the native
- case.
-
-
-
- The extension of PATH with dependencies, alluded to above,
- proceeds according to the relative platforms alone. The process is carried
- out only for dependencies whose host platform matches the new derivation's
- build platform i.e. dependencies which run on the platform where the new
- derivation will be built.
-
-
- Currently, this means for native builds all dependencies are put on the
- PATH. But in the future that may not be the case for sake
- of matching cross: the platforms would be assumed to be unique for native
- and cross builds alike, so only the depsBuild* and
- nativeBuildInputs would be added to the
- PATH.
-
-
- For each dependency dep of those dependencies,
- dep/bin, if present, is
- added to the PATH environment variable.
-
-
-
- The dependency is propagated when it forces some of its other-transitive
- (non-immediate) downstream dependencies to also take it on as an immediate
- dependency. Nix itself already takes a package's transitive dependencies
- into account, but this propagation ensures nixpkgs-specific infrastructure
- like setup hooks (mentioned above) also are run as if the propagated
- dependency.
-
-
-
- It is important to note that dependencies are not necessarily propagated as
- the same sort of dependency that they were before, but rather as the
- corresponding sort so that the platform rules still line up. The exact rules
- for dependency propagation can be given by assigning to each dependency two
- integers based one how its host and target platforms are offset from the
- depending derivation's platforms. Those offsets are given below in the
- descriptions of each dependency list attribute. Algorithmically, we traverse
- propagated inputs, accumulating every propagated dependency's propagated
- dependencies and adjusting them to account for the "shift in perspective"
- described by the current dependency's platform offsets. This results in sort
- a transitive closure of the dependency relation, with the offsets being
- approximately summed when two dependency links are combined. We also prune
- transitive dependencies whose combined offsets go out-of-bounds, which can
- be viewed as a filter over that transitive closure removing dependencies
- that are blatantly absurd.
-
-
-
- We can define the process precisely with
- Natural
- Deduction using the inference rules. This probably seems a bit
- obtuse, but so is the bash code that actually implements it!
-
-
- The findInputs function, currently residing in
- pkgs/stdenv/generic/setup.sh, implements the
- propagation logic.
-
-
- They're confusing in very different ways so... hopefully if something
- doesn't make sense in one presentation, it will in the other!
-
-let mapOffset(h, t, i) = i + (if i <= 0 then h else t - 1)
-
-propagated-dep(h0, t0, A, B)
-propagated-dep(h1, t1, B, C)
-h0 + h1 in {-1, 0, 1}
-h0 + t1 in {-1, 0, 1}
--------------------------------------- Transitive property
-propagated-dep(mapOffset(h0, t0, h1),
- mapOffset(h0, t0, t1),
- A, C)
-
-let mapOffset(h, t, i) = i + (if i <= 0 then h else t - 1)
-
-dep(h0, _, A, B)
-propagated-dep(h1, t1, B, C)
-h0 + h1 in {-1, 0, 1}
-h0 + t1 in {-1, 0, -1}
------------------------------ Take immediate dependencies' propagated dependencies
-propagated-dep(mapOffset(h0, t0, h1),
- mapOffset(h0, t0, t1),
- A, C)
-
-propagated-dep(h, t, A, B)
------------------------------ Propagated dependencies count as dependencies
-dep(h, t, A, B)
- Some explanation of this monstrosity is in order. In the common case, the
- target offset of a dependency is the successor to the target offset:
- t = h + 1. That means that:
-
-let f(h, t, i) = i + (if i <= 0 then h else t - 1)
-let f(h, h + 1, i) = i + (if i <= 0 then h else (h + 1) - 1)
-let f(h, h + 1, i) = i + (if i <= 0 then h else h)
-let f(h, h + 1, i) = i + h
-
- This is where "sum-like" comes in from above: We can just sum all of the
- host offsets to get the host offset of the transitive dependency. The target
- offset is the transitive dependency is simply the host offset + 1, just as
- it was with the dependencies composed to make this transitive one; it can be
- ignored as it doesn't add any new information.
-
-
-
- Because of the bounds checks, the uncommon cases are h =
- t and h + 2 = t. In the former case, the
- motivation for mapOffset is that since its host and
- target platforms are the same, no transitive dependency of it should be able
- to "discover" an offset greater than its reduced target offsets.
- mapOffset effectively "squashes" all its transitive
- dependencies' offsets so that none will ever be greater than the target
- offset of the original h = t package. In the other case,
- h + 1 is skipped over between the host and target
- offsets. Instead of squashing the offsets, we need to "rip" them apart so no
- transitive dependencies' offset is that one.
-
-
-
- Overall, the unifying theme here is that propagation shouldn't be
- introducing transitive dependencies involving platforms the depending
- package is unaware of. [One can imagine the dependending package asking for
- dependencies with the platforms it knows about; other platforms it doesn't
- know how to ask for. The platform description in that scenario is a kind of
- unforagable capability.] The offset bounds checking and definition of
- mapOffset together ensure that this is the case.
- Discovering a new offset is discovering a new platform, and since those
- platforms weren't in the derivation "spec" of the needing package, they
- cannot be relevant. From a capability perspective, we can imagine that the
- host and target platforms of a package are the capabilities a package
- requires, and the depending package must provide the capability to the
- dependency.
-
-
-
- Variables specifying dependencies
-
-
- depsBuildBuild
-
-
-
- A list of dependencies whose host and target platforms are the new
- derivation's build platform. This means a -1 host and
- -1 target offset from the new derivation's platforms.
- These are programs and libraries used at build time that produce programs
- and libraries also used at build time. If the dependency doesn't care
- about the target platform (i.e. isn't a compiler or similar tool), put it
- in nativeBuildInputs instead. The most common use of
- this buildPackages.stdenv.cc, the default C compiler
- for this role. That example crops up more than one might think in old
- commonly used C libraries.
-
-
- Since these packages are able to be run at build-time, they are always
- added to the PATH, as described above. But since these
- packages are only guaranteed to be able to run then, they shouldn't
- persist as run-time dependencies. This isn't currently enforced, but
- could be in the future.
-
-
-
-
-
- nativeBuildInputs
-
-
-
- A list of dependencies whose host platform is the new derivation's build
- platform, and target platform is the new derivation's host platform. This
- means a -1 host offset and 0 target
- offset from the new derivation's platforms. These are programs and
- libraries used at build-time that, if they are a compiler or similar
- tool, produce code to run at run-time—i.e. tools used to build the new
- derivation. If the dependency doesn't care about the target platform
- (i.e. isn't a compiler or similar tool), put it here, rather than in
- depsBuildBuild or depsBuildTarget.
- This could be called depsBuildHost but
- nativeBuildInputs is used for historical continuity.
-
-
- Since these packages are able to be run at build-time, they are added to
- the PATH, as described above. But since these packages are
- only guaranteed to be able to run then, they shouldn't persist as
- run-time dependencies. This isn't currently enforced, but could be in the
- future.
-
-
-
-
-
- depsBuildTarget
-
-
-
- A list of dependencies whose host platform is the new derivation's build
- platform, and target platform is the new derivation's target platform.
- This means a -1 host offset and 1
- target offset from the new derivation's platforms. These are programs
- used at build time that produce code to run with code produced by the
- depending package. Most commonly, these are tools used to build the
- runtime or standard library that the currently-being-built compiler will
- inject into any code it compiles. In many cases, the
- currently-being-built-compiler is itself employed for that task, but when
- that compiler won't run (i.e. its build and host platform differ) this is
- not possible. Other times, the compiler relies on some other tool, like
- binutils, that is always built separately so that the dependency is
- unconditional.
-
-
- This is a somewhat confusing concept to wrap one’s head around, and for
- good reason. As the only dependency type where the platform offsets are
- not adjacent integers, it requires thinking of a bootstrapping stage
- two away from the current one. It and its use-case
- go hand in hand and are both considered poor form: try to not need this
- sort of dependency, and try to avoid building standard libraries and
- runtimes in the same derivation as the compiler produces code using them.
- Instead strive to build those like a normal library, using the
- newly-built compiler just as a normal library would. In short, do not use
- this attribute unless you are packaging a compiler and are sure it is
- needed.
-
-
- Since these packages are able to run at build time, they are added to the
- PATH, as described above. But since these packages are
- only guaranteed to be able to run then, they shouldn't persist as
- run-time dependencies. This isn't currently enforced, but could be in the
- future.
-
-
-
-
-
- depsHostHost
-
-
-
- A list of dependencies whose host and target platforms match the new
- derivation's host platform. This means a 0 host offset
- and 0 target offset from the new derivation's host
- platform. These are packages used at run-time to generate code also used
- at run-time. In practice, this would usually be tools used by compilers
- for macros or a metaprogramming system, or libraries used by the macros
- or metaprogramming code itself. It's always preferable to use a
- depsBuildBuild dependency in the derivation being
- built over a depsHostHost on the tool doing the
- building for this purpose.
-
-
-
-
-
- buildInputs
-
-
-
- A list of dependencies whose host platform and target platform match the
- new derivation's. This means a 0 host offset and a
- 1 target offset from the new derivation's host
- platform. This would be called depsHostTarget but for
- historical continuity. If the dependency doesn't care about the target
- platform (i.e. isn't a compiler or similar tool), put it here, rather
- than in depsBuildBuild.
-
-
- These are often programs and libraries used by the new derivation at
- run-time, but that isn't always the case. For
- example, the machine code in a statically-linked library is only used at
- run-time, but the derivation containing the library is only needed at
- build-time. Even in the dynamic case, the library may also be needed at
- build-time to appease the linker.
-
-
-
-
-
- depsTargetTarget
-
-
-
- A list of dependencies whose host platform matches the new derivation's
- target platform. This means a 1 offset from the new
- derivation's platforms. These are packages that run on the target
- platform, e.g. the standard library or run-time deps of standard library
- that a compiler insists on knowing about. It's poor form in almost all
- cases for a package to depend on another from a future stage [future
- stage corresponding to positive offset]. Do not use this attribute unless
- you are packaging a compiler and are sure it is needed.
-
-
-
-
-
- depsBuildBuildPropagated
-
-
-
- The propagated equivalent of depsBuildBuild. This
- perhaps never ought to be used, but it is included for consistency [see
- below for the others].
-
-
-
-
-
- propagatedNativeBuildInputs
-
-
-
- The propagated equivalent of nativeBuildInputs. This
- would be called depsBuildHostPropagated but for
- historical continuity. For example, if package Y has
- propagatedNativeBuildInputs = [X], and package
- Z has buildInputs = [Y], then
- package Z will be built as if it included package
- X in its nativeBuildInputs. If
- instead, package Z has nativeBuildInputs =
- [Y], then Z will be built as if it included
- X in the depsBuildBuild of package
- Z, because of the sum of the two -1
- host offsets.
-
-
-
-
-
- depsBuildTargetPropagated
-
-
-
- The propagated equivalent of depsBuildTarget. This is
- prefixed for the same reason of alerting potential users.
-
-
-
-
-
- depsHostHostPropagated
-
-
-
- The propagated equivalent of depsHostHost.
-
-
-
-
-
- propagatedBuildInputs
-
-
-
- The propagated equivalent of buildInputs. This would
- be called depsHostTargetPropagated but for historical
- continuity.
-
-
-
-
-
- depsTargetTargetPropagated
-
-
-
- The propagated equivalent of depsTargetTarget. This is
- prefixed for the same reason of alerting potential users.
-
-
-
-
-
-
- Attributes
-
-
- Variables affecting stdenv initialisation
-
-
- NIX_DEBUG
-
-
-
- A natural number indicating how much information to log. If set to 1 or
- higher, stdenv will print moderate debugging
- information during the build. In particular, the gcc
- and ld wrapper scripts will print out the complete
- command line passed to the wrapped tools. If set to 6 or higher, the
- stdenv setup script will be run with set
- -x tracing. If set to 7 or higher, the gcc
- and ld wrapper scripts will also be run with
- set -x tracing.
-
-
-
-
-
-
- Attributes affecting build properties
-
-
- enableParallelBuilding
-
-
-
- If set to true, stdenv will pass
- specific flags to make and other build tools to enable
- parallel building with up to build-cores workers.
-
-
- Unless set to false, some build systems with good
- support for parallel building including cmake,
- meson, and qmake will set it to
- true.
-
-
-
-
-
-
- Special variables
-
-
- passthru
-
-
-
- This is an attribute set which can be filled with arbitrary values. For
- example:
-
-passthru = {
- foo = "bar";
- baz = {
- value1 = 4;
- value2 = 5;
- };
-}
-
-
-
- Values inside it are not passed to the builder, so you can change them
- without triggering a rebuild. However, they can be accessed outside of a
- derivation directly, as if they were set inside a derivation itself, e.g.
- hello.baz.value1. We don't specify any usage or schema
- of passthru - it is meant for values that would be
- useful outside the derivation in other parts of a Nix expression (e.g. in
- other derivations). An example would be to convey some specific
- dependency of your derivation which contains a program with plugins
- support. Later, others who make derivations with plugins can use
- passed-through dependency to ensure that their plugin would be
- binary-compatible with built program.
-
-
-
-
-
- passthru.updateScript
-
-
-
- A script to be run by maintainers/scripts/update.nix
- when the package is matched. It needs to be an executable file, either on
- the file system:
-
-passthru.updateScript = ./update.sh;
-
- or inside the expression itself:
-
-passthru.updateScript = writeScript "update-zoom-us" ''
- #!/usr/bin/env nix-shell
- #!nix-shell -i bash -p curl pcre common-updater-scripts
-
- set -eu -o pipefail
-
- version="$(curl -sI https://zoom.us/client/latest/zoom_x86_64.tar.xz | grep -Fi 'Location:' | pcregrep -o1 '/(([0-9]\.?)+)/')"
- update-source-version zoom-us "$version"
-'';
-
- The attribute can also contain a list, a script followed by arguments to
- be passed to it:
-
-passthru.updateScript = [ ../../update.sh pname "--requested-release=unstable" ];
-
-
-
- The script will be usually run from the root of the Nixpkgs repository
- but you should not rely on that. Also note that the update scripts will
- be run in parallel by default; you should avoid running git
- commit or any other commands that cannot handle that.
-
-
- For information about how to run the updates, execute
- nix-shell maintainers/scripts/update.nix.
-
-
-
-
-
-
- Phases
-
-
- The generic builder has a number of phases. Package
- builds are split into phases to make it easier to override specific parts of
- the build (e.g., unpacking the sources or installing the binaries).
- Furthermore, it allows a nicer presentation of build logs in the Nix build
- farm.
-
-
-
- Each phase can be overridden in its entirety either by setting the
- environment variable namePhase
- to a string containing some shell commands to be executed, or by redefining
- the shell function namePhase.
- The former is convenient to override a phase from the derivation, while the
- latter is convenient from a build script. However, typically one only wants
- to add some commands to a phase, e.g. by defining
- postInstall or preFixup, as skipping
- some of the default actions may have unexpected consequences. The default
- script for each phase is defined in the file pkgs/stdenv/generic/setup.sh.
-
-
-
- Controlling phases
-
-
- There are a number of variables that control what phases are executed and
- in what order:
-
- Variables affecting phase control
-
-
- phases
-
-
-
- Specifies the phases. You can change the order in which phases are
- executed, or add new phases, by setting this variable. If it’s not
- set, the default value is used, which is $prePhases
- unpackPhase patchPhase $preConfigurePhases configurePhase
- $preBuildPhases buildPhase checkPhase $preInstallPhases installPhase
- fixupPhase installCheckPhase $preDistPhases distPhase $postPhases.
-
-
- Usually, if you just want to add a few phases, it’s more convenient
- to set one of the variables below (such as
- preInstallPhases), as you then don’t specify all
- the normal phases.
-
-
-
-
-
- prePhases
-
-
-
- Additional phases executed before any of the default phases.
-
-
-
-
-
- preConfigurePhases
-
-
-
- Additional phases executed just before the configure phase.
-
-
-
-
-
- preBuildPhases
-
-
-
- Additional phases executed just before the build phase.
-
-
-
-
-
- preInstallPhases
-
-
-
- Additional phases executed just before the install phase.
-
-
-
-
-
- preFixupPhases
-
-
-
- Additional phases executed just before the fixup phase.
-
-
-
-
-
- preDistPhases
-
-
-
- Additional phases executed just before the distribution phase.
-
-
-
-
-
- postPhases
-
-
-
- Additional phases executed after any of the default phases.
-
-
-
-
-
-
-
-
- The unpack phase
-
-
- The unpack phase is responsible for unpacking the source code of the
- package. The default implementation of unpackPhase
- unpacks the source files listed in the src environment
- variable to the current directory. It supports the following files by
- default:
-
-
-
- Tar files
-
-
-
- These can optionally be compressed using gzip
- (.tar.gz, .tgz or
- .tar.Z), bzip2
- (.tar.bz2, .tbz2 or
- .tbz) or xz
- (.tar.xz, .tar.lzma or
- .txz).
-
-
-
-
-
- Zip files
-
-
-
- Zip files are unpacked using unzip. However,
- unzip is not in the standard environment, so you
- should add it to nativeBuildInputs yourself.
-
-
-
-
-
- Directories in the Nix store
-
-
-
- These are simply copied to the current directory. The hash part of the
- file name is stripped, e.g.
- /nix/store/1wydxgby13cz...-my-sources would be
- copied to my-sources.
-
-
-
-
- Additional file types can be supported by setting the
- unpackCmd variable (see below).
-
-
-
-
-
- Variables controlling the unpack phase
-
-
- srcs / src
-
-
-
- The list of source files or directories to be unpacked or copied. One of
- these must be set.
-
-
-
-
-
- sourceRoot
-
-
-
- After running unpackPhase, the generic builder
- changes the current directory to the directory created by unpacking the
- sources. If there are multiple source directories, you should set
- sourceRoot to the name of the intended directory.
-
-
-
-
-
- setSourceRoot
-
-
-
- Alternatively to setting sourceRoot, you can set
- setSourceRoot to a shell command to be evaluated by
- the unpack phase after the sources have been unpacked. This command must
- set sourceRoot.
-
-
-
-
-
- preUnpack
-
-
-
- Hook executed at the start of the unpack phase.
-
-
-
-
-
- postUnpack
-
-
-
- Hook executed at the end of the unpack phase.
-
-
-
-
-
- dontUnpack
-
-
-
- Set to true to skip the unpack phase.
-
-
-
-
-
- dontMakeSourcesWritable
-
-
-
- If set to 1, the unpacked sources are
- not made writable. By default, they are made
- writable to prevent problems with read-only sources. For example, copied
- store directories would be read-only without this.
-
-
-
-
-
- unpackCmd
-
-
-
- The unpack phase evaluates the string $unpackCmd for
- any unrecognised file. The path to the current source file is contained
- in the curSrc variable.
-
-
-
-
-
-
-
- The patch phase
-
-
- The patch phase applies the list of patches defined in the
- patches variable.
-
-
-
- Variables controlling the patch phase
-
-
- patches
-
-
-
- The list of patches. They must be in the format accepted by the
- patch command, and may optionally be compressed using
- gzip (.gz),
- bzip2 (.bz2) or
- xz (.xz).
-
-
-
-
-
- patchFlags
-
-
-
- Flags to be passed to patch. If not set, the argument
- is used, which causes the leading directory
- component to be stripped from the file names in each patch.
-
-
-
-
-
- prePatch
-
-
-
- Hook executed at the start of the patch phase.
-
-
-
-
-
- postPatch
-
-
-
- Hook executed at the end of the patch phase.
-
-
-
-
-
-
-
- The configure phase
-
-
- The configure phase prepares the source tree for building. The default
- configurePhase runs ./configure
- (typically an Autoconf-generated script) if it exists.
-
-
-
- Variables controlling the configure phase
-
-
- configureScript
-
-
-
- The name of the configure script. It defaults to
- ./configure if it exists; otherwise, the configure
- phase is skipped. This can actually be a command (like perl
- ./Configure.pl).
-
-
-
-
-
- configureFlags
-
-
-
- A list of strings passed as additional arguments to the configure
- script.
-
-
-
-
-
- dontConfigure
-
-
-
- Set to true to skip the configure phase.
-
-
-
-
-
- configureFlagsArray
-
-
-
- A shell array containing additional arguments passed to the configure
- script. You must use this instead of configureFlags
- if the arguments contain spaces.
-
-
-
-
-
- dontAddPrefix
-
-
-
- By default, the flag --prefix=$prefix is added to the
- configure flags. If this is undesirable, set this variable to true.
-
-
-
-
-
- prefix
-
-
-
- The prefix under which the package must be installed, passed via the
- option to the configure script. It defaults to
- .
-
-
-
-
-
- prefixKey
-
-
-
- The key to use when specifying the prefix. By default, this is set to
- as that is used by the majority of packages.
-
-
-
-
-
- dontAddDisableDepTrack
-
-
-
- By default, the flag --disable-dependency-tracking is
- added to the configure flags to speed up Automake-based builds. If this
- is undesirable, set this variable to true.
-
-
-
-
-
- dontFixLibtool
-
-
-
- By default, the configure phase applies some special hackery to all
- files called ltmain.sh before running the configure
- script in order to improve the purity of Libtool-based packages
-
-
- It clears the
- sys_lib_*search_path
- variables in the Libtool script to prevent Libtool from using
- libraries in /usr/lib and such.
-
-
- . If this is undesirable, set this variable to true.
-
-
-
-
-
- dontDisableStatic
-
-
-
- By default, when the configure script has
- , the option
- is added to the configure flags.
-
-
- If this is undesirable, set this variable to true.
-
-
-
-
-
- configurePlatforms
-
-
-
- By default, when cross compiling, the configure script has
- and passed.
- Packages can instead pass [ "build" "host" "target" ]
- or a subset to control exactly which platform flags are passed.
- Compilers and other tools can use this to also pass the target platform.
-
-
- Eventually these will be passed building natively as well, to improve
- determinism: build-time guessing, as is done today, is a risk of
- impurity.
-
-
-
-
-
-
-
- preConfigure
-
-
-
- Hook executed at the start of the configure phase.
-
-
-
-
-
- postConfigure
-
-
-
- Hook executed at the end of the configure phase.
-
-
-
-
-
-
-
- The build phase
-
-
- The build phase is responsible for actually building the package (e.g.
- compiling it). The default buildPhase simply calls
- make if a file named Makefile,
- makefile or GNUmakefile exists in
- the current directory (or the makefile is explicitly
- set); otherwise it does nothing.
-
-
-
- Variables controlling the build phase
-
-
- dontBuild
-
-
-
- Set to true to skip the build phase.
-
-
-
-
-
- makefile
-
-
-
- The file name of the Makefile.
-
-
-
-
-
- makeFlags
-
-
-
- A list of strings passed as additional flags to make.
- These flags are also used by the default install and check phase. For
- setting make flags specific to the build phase, use
- buildFlags (see below).
-
-makeFlags = [ "PREFIX=$(out)" ];
-
-
-
- The flags are quoted in bash, but environment variables can be
- specified by using the make syntax.
-
-
-
-
-
-
-
- makeFlagsArray
-
-
-
- A shell array containing additional arguments passed to
- make. You must use this instead of
- makeFlags if the arguments contain spaces, e.g.
-
-preBuild = ''
- makeFlagsArray+=(CFLAGS="-O0 -g" LDFLAGS="-lfoo -lbar")
-'';
-
- Note that shell arrays cannot be passed through environment variables,
- so you cannot set makeFlagsArray in a derivation
- attribute (because those are passed through environment variables): you
- have to define them in shell code.
-
-
-
-
-
- buildFlags / buildFlagsArray
-
-
-
- A list of strings passed as additional flags to make.
- Like makeFlags and makeFlagsArray,
- but only used by the build phase.
-
-
-
-
-
- preBuild
-
-
-
- Hook executed at the start of the build phase.
-
-
-
-
-
- postBuild
-
-
-
- Hook executed at the end of the build phase.
-
-
-
-
-
-
- You can set flags for make through the
- makeFlags variable.
-
-
-
- Before and after running make, the hooks
- preBuild and postBuild are called,
- respectively.
-
-
-
-
- The check phase
-
-
- The check phase checks whether the package was built correctly by running
- its test suite. The default checkPhase calls
- make check, but only if the doCheck
- variable is enabled.
-
-
-
- Variables controlling the check phase
-
-
- doCheck
-
-
-
- Controls whether the check phase is executed. By default it is skipped,
- but if doCheck is set to true, the check phase is
- usually executed. Thus you should set
-doCheck = true;
- in the derivation to enable checks. The exception is cross compilation.
- Cross compiled builds never run tests, no matter how
- doCheck is set, as the newly-built program won't run
- on the platform used to build it.
-
-
-
-
-
- makeFlags / makeFlagsArray / makefile
-
-
-
- See the build phase for details.
-
-
-
-
-
- checkTarget
-
-
-
- The make target that runs the tests. Defaults to
- check.
-
-
-
-
-
- checkFlags / checkFlagsArray
-
-
-
- A list of strings passed as additional flags to make.
- Like makeFlags and makeFlagsArray,
- but only used by the check phase.
-
-
-
-
-
- checkInputs
-
-
-
- A list of dependencies used by the phase. This gets included in
- nativeBuildInputs when doCheck is
- set.
-
-
-
-
-
- preCheck
-
-
-
- Hook executed at the start of the check phase.
-
-
-
-
-
- postCheck
-
-
-
- Hook executed at the end of the check phase.
-
-
-
-
-
-
-
- The install phase
-
-
- The install phase is responsible for installing the package in the Nix
- store under out. The default
- installPhase creates the directory
- $out and calls make install.
-
-
-
- Variables controlling the install phase
-
-
- makeFlags / makeFlagsArray / makefile
-
-
-
- See the build phase for details.
-
-
-
-
-
- installTargets
-
-
-
- The make targets that perform the installation. Defaults to
- install. Example:
-
-installTargets = "install-bin install-doc";
-
-
-
-
-
- installFlags / installFlagsArray
-
-
-
- A list of strings passed as additional flags to make.
- Like makeFlags and makeFlagsArray,
- but only used by the install phase.
-
-
-
-
-
- preInstall
-
-
-
- Hook executed at the start of the install phase.
-
-
-
-
-
- postInstall
-
-
-
- Hook executed at the end of the install phase.
-
-
-
-
-
-
-
- The fixup phase
-
-
- The fixup phase performs some (Nix-specific) post-processing actions on the
- files installed under $out by the install phase. The
- default fixupPhase does the following:
-
-
-
- It moves the man/, doc/ and
- info/ subdirectories of $out to
- share/.
-
-
-
-
- It strips libraries and executables of debug information.
-
-
-
-
- On Linux, it applies the patchelf command to ELF
- executables and libraries to remove unused directories from the
- RPATH in order to prevent unnecessary runtime
- dependencies.
-
-
-
-
- It rewrites the interpreter paths of shell scripts to paths found in
- PATH. E.g., /usr/bin/perl will be
- rewritten to
- /nix/store/some-perl/bin/perl
- found in PATH.
-
-
-
-
-
-
- Variables controlling the fixup phase
-
-
- dontFixup
-
-
-
- Set to true to skip the fixup phase.
-
-
-
-
-
- dontStrip
-
-
-
- If set, libraries and executables are not stripped. By default, they
- are.
-
-
-
-
-
- dontStripHost
-
-
-
- Like dontStrip, but only affects the
- strip command targetting the package's host platform.
- Useful when supporting cross compilation, but otherwise feel free to
- ignore.
-
-
-
-
-
- dontStripTarget
-
-
-
- Like dontStrip, but only affects the
- strip command targetting the packages' target
- platform. Useful when supporting cross compilation, but otherwise feel
- free to ignore.
-
-
-
-
-
- dontMoveSbin
-
-
-
- If set, files in $out/sbin are not moved to
- $out/bin. By default, they are.
-
-
-
-
-
- stripAllList
-
-
-
- List of directories to search for libraries and executables from which
- all symbols should be stripped. By default, it’s
- empty. Stripping all symbols is risky, since it may remove not just
- debug symbols but also ELF information necessary for normal execution.
-
-
-
-
-
- stripAllFlags
-
-
-
- Flags passed to the strip command applied to the
- files in the directories listed in stripAllList.
- Defaults to (i.e. ).
-
-
-
-
-
- stripDebugList
-
-
-
- List of directories to search for libraries and executables from which
- only debugging-related symbols should be stripped. It defaults to
- lib bin sbin.
-
-
-
-
-
- stripDebugFlags
-
-
-
- Flags passed to the strip command applied to the
- files in the directories listed in stripDebugList.
- Defaults to (i.e. ).
-
-
-
-
-
- dontPatchELF
-
-
-
- If set, the patchelf command is not used to remove
- unnecessary RPATH entries. Only applies to Linux.
-
-
-
-
-
- dontPatchShebangs
-
-
-
- If set, scripts starting with #! do not have their
- interpreter paths rewritten to paths in the Nix store.
-
-
-
-
-
- dontPruneLibtoolFiles
-
-
-
- If set, libtool .la files associated with shared
- libraries won't have their dependency_libs field
- cleared.
-
-
-
-
-
- forceShare
-
-
-
- The list of directories that must be moved from
- $out to $out/share. Defaults
- to man doc info.
-
-
-
-
-
- setupHook
-
-
-
- A package can export a setup
- hook by setting this variable. The setup hook, if defined, is
- copied to $out/nix-support/setup-hook. Environment
- variables are then substituted in it using
- substituteAll.
-
-
-
-
-
- preFixup
-
-
-
- Hook executed at the start of the fixup phase.
-
-
-
-
-
- postFixup
-
-
-
- Hook executed at the end of the fixup phase.
-
-
-
-
-
- separateDebugInfo
-
-
-
- If set to true, the standard environment will enable
- debug information in C/C++ builds. After installation, the debug
- information will be separated from the executables and stored in the
- output named debug. (This output is enabled
- automatically; you don’t need to set the outputs
- attribute explicitly.) To be precise, the debug information is stored in
- debug/lib/debug/.build-id/XX/YYYY…,
- where XXYYYY… is the build
- ID of the binary — a SHA-1 hash of the contents of the
- binary. Debuggers like GDB use the build ID to look up the separated
- debug information.
-
-
- For example, with GDB, you can add
-
-set debug-file-directory ~/.nix-profile/lib/debug
-
- to ~/.gdbinit. GDB will then be able to find debug
- information installed via nix-env -i.
-
-
-
-
-
-
-
- The installCheck phase
-
-
- The installCheck phase checks whether the package was installed correctly
- by running its test suite against the installed directories. The default
- installCheck calls make
- installcheck.
-
-
-
- Variables controlling the installCheck phase
-
-
- doInstallCheck
-
-
-
- Controls whether the installCheck phase is executed. By default it is
- skipped, but if doInstallCheck is set to true, the
- installCheck phase is usually executed. Thus you should set
-doInstallCheck = true;
- in the derivation to enable install checks. The exception is cross
- compilation. Cross compiled builds never run tests, no matter how
- doInstallCheck is set, as the newly-built program
- won't run on the platform used to build it.
-
-
-
-
-
- installCheckTarget
-
-
-
- The make target that runs the install tests. Defaults to
- installcheck.
-
-
-
-
-
- installCheckFlags / installCheckFlagsArray
-
-
-
- A list of strings passed as additional flags to make.
- Like makeFlags and makeFlagsArray,
- but only used by the installCheck phase.
-
-
-
-
-
- installCheckInputs
-
-
-
- A list of dependencies used by the phase. This gets included in
- nativeBuildInputs when
- doInstallCheck is set.
-
-
-
-
-
- preInstallCheck
-
-
-
- Hook executed at the start of the installCheck phase.
-
-
-
-
-
- postInstallCheck
-
-
-
- Hook executed at the end of the installCheck phase.
-
-
-
-
-
-
-
- The distribution phase
-
-
- The distribution phase is intended to produce a source distribution of the
- package. The default distPhase first calls
- make dist, then it copies the resulting source tarballs
- to $out/tarballs/. This phase is only executed if the
- attribute doDist is set.
-
-
-
- Variables controlling the distribution phase
-
-
- distTarget
-
-
-
- The make target that produces the distribution. Defaults to
- dist.
-
-
-
-
-
- distFlags / distFlagsArray
-
-
-
- Additional flags passed to make.
-
-
-
-
-
- tarballs
-
-
-
- The names of the source distribution files to be copied to
- $out/tarballs/. It can contain shell wildcards. The
- default is *.tar.gz.
-
-
-
-
-
- dontCopyDist
-
-
-
- If set, no files are copied to $out/tarballs/.
-
-
-
-
-
- preDist
-
-
-
- Hook executed at the start of the distribution phase.
-
-
-
-
-
- postDist
-
-
-
- Hook executed at the end of the distribution phase.
-
-
-
-
-
-
-
- Shell functions
-
-
- The standard environment provides a number of useful functions.
-
-
-
-
-
- makeWrapperexecutablewrapperfileargs
-
-
-
- Constructs a wrapper for a program with various possible arguments. For
- example:
-
-# adds `FOOBAR=baz` to `$out/bin/foo`’s environment
-makeWrapper $out/bin/foo $wrapperfile --set FOOBAR baz
-
-# prefixes the binary paths of `hello` and `git`
-# Be advised that paths often should be patched in directly
-# (via string replacements or in `configurePhase`).
-makeWrapper $out/bin/foo $wrapperfile --prefix PATH : ${lib.makeBinPath [ hello git ]}
-
- There’s many more kinds of arguments, they are documented in
- nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh.
-
-
- wrapProgram is a convenience function you probably
- want to use most of the time.
-
-
-
-
-
- substituteinfileoutfilesubs
-
-
-
- Performs string substitution on the contents of
- infile, writing the result to
- outfile. The substitutions in
- subs are of the following form:
-
-
-
- s1s2
-
-
-
- Replace every occurrence of the string s1
- by s2.
-
-
-
-
-
- varName
-
-
-
- Replace every occurrence of
- @varName@ by the
- contents of the environment variable
- varName. This is useful for generating
- files from templates, using
- @...@ in the template
- as placeholders.
-
-
-
-
-
- varNames
-
-
-
- Replace every occurrence of
- @varName@ by the string
- s.
-
-
-
-
-
-
- Example:
-
-substitute ./foo.in ./foo.out \
- --replace /usr/bin/bar $bar/bin/bar \
- --replace "a string containing spaces" "some other text" \
- --subst-var someVar
-
-
-
- substitute is implemented using the
- replace
- command. Unlike with the sed command, you don’t have
- to worry about escaping special characters. It supports performing
- substitutions on binary files (such as executables), though there
- you’ll probably want to make sure that the replacement string is as
- long as the replaced string.
-
-
-
-
-
- substituteInPlacefilesubs
-
-
-
- Like substitute, but performs the substitutions in
- place on the file file.
-
-
-
-
-
- substituteAllinfileoutfile
-
-
-
- Replaces every occurrence of
- @varName@, where
- varName is any environment variable, in
- infile, writing the result to
- outfile. For instance, if
- infile has the contents
-
-#! @bash@/bin/sh
-PATH=@coreutils@/bin
-echo @foo@
-
- and the environment contains
- bash=/nix/store/bmwp0q28cf21...-bash-3.2-p39 and
- coreutils=/nix/store/68afga4khv0w...-coreutils-6.12,
- but does not contain the variable foo, then the output
- will be
-
-#! /nix/store/bmwp0q28cf21...-bash-3.2-p39/bin/sh
-PATH=/nix/store/68afga4khv0w...-coreutils-6.12/bin
-echo @foo@
-
- That is, no substitution is performed for undefined variables.
-
-
- Environment variables that start with an uppercase letter or an
- underscore are filtered out, to prevent global variables (like
- HOME) or private variables (like
- __ETC_PROFILE_DONE) from accidentally getting
- substituted. The variables also have to be valid bash “names”, as
- defined in the bash manpage (alphanumeric or _, must
- not start with a number).
-
-
-
-
-
- substituteAllInPlacefile
-
-
-
- Like substituteAll, but performs the substitutions
- in place on the file file.
-
-
-
-
-
- stripHashpath
-
-
-
- Strips the directory and hash part of a store path, outputting the name
- part to stdout. For example:
-
-# prints coreutils-8.24
-stripHash "/nix/store/9s9r019176g7cvn2nvcw41gsp862y6b4-coreutils-8.24"
-
- If you wish to store the result in another variable, then the following
- idiom may be useful:
-
-name="/nix/store/9s9r019176g7cvn2nvcw41gsp862y6b4-coreutils-8.24"
-someVar=$(stripHash $name)
-
-
-
-
-
-
- wrapProgramexecutablemakeWrapperArgs
-
-
-
- Convenience function for makeWrapper that
- automatically creates a sane wrapper file It takes all the same arguments
- as makeWrapper, except for --argv0.
-
-
- It cannot be applied multiple times, since it will overwrite the wrapper
- file.
-
-
-
-
-
-
- Package setup hooks
-
-
- Nix itself considers a build-time dependency as merely something that should
- previously be built and accessible at build time—packages themselves are
- on their own to perform any additional setup. In most cases, that is fine,
- and the downstream derivation can deal with its own dependencies. But for a
- few common tasks, that would result in almost every package doing the same
- sort of setup work—depending not on the package itself, but entirely on
- which dependencies were used.
-
-
-
- In order to alleviate this burden, the setup hook
- mechanism was written, where any package can include a shell script that [by
- convention rather than enforcement by Nix], any downstream
- reverse-dependency will source as part of its build process. That allows the
- downstream dependency to merely specify its dependencies, and lets those
- dependencies effectively initialize themselves. No boilerplate mirroring the
- list of dependencies is needed.
-
-
-
- The setup hook mechanism is a bit of a sledgehammer though: a powerful
- feature with a broad and indiscriminate area of effect. The combination of
- its power and implicit use may be expedient, but isn't without costs. Nix
- itself is unchanged, but the spirit of added dependencies being effect-free
- is violated even if the letter isn't. For example, if a derivation path is
- mentioned more than once, Nix itself doesn't care and simply makes sure the
- dependency derivation is already built just the same—depending is just
- needing something to exist, and needing is idempotent. However, a dependency
- specified twice will have its setup hook run twice, and that could easily
- change the build environment (though a well-written setup hook will
- therefore strive to be idempotent so this is in fact not observable). More
- broadly, setup hooks are anti-modular in that multiple dependencies, whether
- the same or different, should not interfere and yet their setup hooks may
- well do so.
-
-
-
- The most typical use of the setup hook is actually to add other hooks which
- are then run (i.e. after all the setup hooks) on each dependency. For
- example, the C compiler wrapper's setup hook feeds itself flags for each
- dependency that contains relevant libraries and headers. This is done by
- defining a bash function, and appending its name to one of
- envBuildBuildHooks`, envBuildHostHooks`,
- envBuildTargetHooks`, envHostHostHooks`,
- envHostTargetHooks`, or envTargetTargetHooks`.
- These 6 bash variables correspond to the 6 sorts of dependencies by platform
- (there's 12 total but we ignore the propagated/non-propagated axis).
-
-
-
- Packages adding a hook should not hard code a specific hook, but rather
- choose a variable relative to how they are included.
- Returning to the C compiler wrapper example, if the wrapper itself is an
- n dependency, then it only wants to accumulate flags from
- n + 1 dependencies, as only those ones match the
- compiler's target platform. The hostOffset variable is
- defined with the current dependency's host offset
- targetOffset with its target offset, before its setup hook is
- sourced. Additionally, since most environment hooks don't care about the
- target platform, that means the setup hook can append to the right bash
- array by doing something like
-
-addEnvHooks "$hostOffset" myBashFunction
-
-
-
-
- The existence of setups hooks has long been documented
- and packages inside Nixpkgs are free to use this mechanism. Other packages,
- however, should not rely on these mechanisms not changing between Nixpkgs
- versions. Because of the existing issues with this system, there's little
- benefit from mandating it be stable for any period of time.
-
-
-
- First, let’s cover some setup hooks that are part of Nixpkgs default
- stdenv. This means that they are run for every package built using
- stdenv.mkDerivation. Some of these are platform
- specific, so they may run on Linux but not Darwin or vice-versa.
-
-
-
- move-docs.sh
-
-
-
- This setup hook moves any installed documentation to the
- /share subdirectory directory. This includes the man,
- doc and info directories. This is needed for legacy programs that do not
- know how to use the share subdirectory.
-
-
-
-
-
- compress-man-pages.sh
-
-
-
- This setup hook compresses any man pages that have been installed. The
- compression is done using the gzip program. This helps to reduce the
- installed size of packages.
-
-
-
-
-
- strip.sh
-
-
-
- This runs the strip command on installed binaries and libraries. This
- removes unnecessary information like debug symbols when they are not
- needed. This also helps to reduce the installed size of packages.
-
-
-
-
-
- patch-shebangs.sh
-
-
-
- This setup hook patches installed scripts to use the full path to the
- shebang interpreter. A shebang interpreter is the first commented line
- of a script telling the operating system which program will run the
- script (e.g #!/bin/bash). In Nix, we want an exact
- path to that interpreter to be used. This often replaces
- /bin/sh with a path in the Nix store.
-
-
-
-
-
- audit-tmpdir.sh
-
-
-
- This verifies that no references are left from the install binaries to
- the directory used to build those binaries. This ensures that the
- binaries do not need things outside the Nix store. This is currently
- supported in Linux only.
-
-
-
-
-
- multiple-outputs.sh
-
-
-
- This setup hook adds configure flags that tell packages to install files
- into any one of the proper outputs listed in outputs.
- This behavior can be turned off by setting
- setOutputFlags to false in the derivation
- environment. See for more
- information.
-
-
-
-
-
- move-sbin.sh
-
-
-
- This setup hook moves any binaries installed in the sbin subdirectory
- into bin. In addition, a link is provided from sbin to bin for
- compatibility.
-
-
-
-
-
- move-lib64.sh
-
-
-
- This setup hook moves any libraries installed in the lib64 subdirectory
- into lib. In addition, a link is provided from lib64 to lib for
- compatibility.
-
-
-
-
-
- set-source-date-epoch-to-latest.sh
-
-
-
- This sets SOURCE_DATE_EPOCH to the modification time
- of the most recent file.
-
-
-
-
-
- Bintools Wrapper
-
-
-
- The Bintools Wrapper wraps the binary utilities for a bunch of
- miscellaneous purposes. These are GNU Binutils when targetting Linux,
- and a mix of cctools and GNU binutils for Darwin. [The "Bintools" name
- is supposed to be a compromise between "Binutils" and "cctools" not
- denoting any specific implementation.] Specifically, the underlying
- bintools package, and a C standard library (glibc or Darwin's libSystem,
- just for the dynamic loader) are all fed in, and dependency finding,
- hardening (see below), and purity checks for each are handled by the
- Bintools Wrapper. Packages typically depend on CC Wrapper, which in turn
- (at run time) depends on the Bintools Wrapper.
-
-
- The Bintools Wrapper was only just recently split off from CC Wrapper,
- so the division of labor is still being worked out. For example, it
- shouldn't care about about the C standard library, but just take a
- derivation with the dynamic loader (which happens to be the glibc on
- linux). Dependency finding however is a task both wrappers will continue
- to need to share, and probably the most important to understand. It is
- currently accomplished by collecting directories of host-platform
- dependencies (i.e. buildInputs and
- nativeBuildInputs) in environment variables. The
- Bintools Wrapper's setup hook causes any lib and
- lib64 subdirectories to be added to
- NIX_LDFLAGS. Since the CC Wrapper and the Bintools
- Wrapper use the same strategy, most of the Bintools Wrapper code is
- sparsely commented and refers to the CC Wrapper. But the CC Wrapper's
- code, by contrast, has quite lengthy comments. The Bintools Wrapper
- merely cites those, rather than repeating them, to avoid falling out of
- sync.
-
-
- A final task of the setup hook is defining a number of standard
- environment variables to tell build systems which executables fulfill
- which purpose. They are defined to just be the base name of the tools,
- under the assumption that the Bintools Wrapper's binaries will be on the
- path. Firstly, this helps poorly-written packages, e.g. ones that look
- for just gcc when CC isn't defined yet
- clang is to be used. Secondly, this helps packages
- not get confused when cross-compiling, in which case multiple Bintools
- Wrappers may simultaneously be in use.
-
-
- Each wrapper targets a single platform, so if binaries for multiple
- platforms are needed, the underlying binaries must be wrapped multiple
- times. As this is a property of the wrapper itself, the multiple
- wrappings are needed whether or not the same underlying binaries can
- target multiple platforms.
-
-
- BUILD_- and TARGET_-prefixed versions of
- the normal environment variable are defined for additional Bintools
- Wrappers, properly disambiguating them.
-
-
- A problem with this final task is that the Bintools Wrapper is honest
- and defines LD as ld. Most packages,
- however, firstly use the C compiler for linking, secondly use
- LD anyways, defining it as the C compiler, and thirdly,
- only so define LD when it is undefined as a fallback.
- This triple-threat means Bintools Wrapper will break those packages, as
- LD is already defined as the actual linker which the package won't
- override yet doesn't want to use. The workaround is to define, just for
- the problematic package, LD as the C compiler. A good way
- to do this would be preConfigure = "LD=$CC".
-
-
-
-
-
- CC Wrapper
-
-
-
- The CC Wrapper wraps a C toolchain for a bunch of miscellaneous
- purposes. Specifically, a C compiler (GCC or Clang), wrapped binary
- tools, and a C standard library (glibc or Darwin's libSystem, just for
- the dynamic loader) are all fed in, and dependency finding, hardening
- (see below), and purity checks for each are handled by the CC Wrapper.
- Packages typically depend on the CC Wrapper, which in turn (at run-time)
- depends on the Bintools Wrapper.
-
-
- Dependency finding is undoubtedly the main task of the CC Wrapper. This
- works just like the Bintools Wrapper, except that any
- include subdirectory of any relevant dependency is
- added to NIX_CFLAGS_COMPILE. The setup hook itself
- contains some lengthy comments describing the exact convoluted mechanism
- by which this is accomplished.
-
-
- Similarly, the CC Wrapper follows the Bintools Wrapper in defining
- standard environment variables with the names of the tools it wraps, for
- the same reasons described above. Importantly, while it includes a
- cc symlink to the c compiler for portability, the
- CC will be defined using the compiler's "real name" (i.e.
- gcc or clang). This helps lousy
- build systems that inspect on the name of the compiler rather than run
- it.
-
-
-
-
-
-
-
- Here are some more packages that provide a setup hook. Since the list of
- hooks is extensible, this is not an exhaustive list the mechanism is only to
- be used as a last resort, it might cover most uses.
-
-
-
- Perl
-
-
-
- Adds the lib/site_perl subdirectory of each build
- input to the PERL5LIB environment variable. For instance,
- if buildInputs contains Perl, then the
- lib/site_perl subdirectory of each input is added
- to the PERL5LIB environment variable.
-
-
-
-
-
- Python
-
-
-
- Adds the lib/${python.libPrefix}/site-packages
- subdirectory of each build input to the PYTHONPATH
- environment variable.
-
-
-
-
-
- pkg-config
-
-
-
- Adds the lib/pkgconfig and
- share/pkgconfig subdirectories of each build input
- to the PKG_CONFIG_PATH environment variable.
-
-
-
-
-
- Automake
-
-
-
- Adds the share/aclocal subdirectory of each build
- input to the ACLOCAL_PATH environment variable.
-
-
-
-
-
- Autoconf
-
-
-
- The autoreconfHook derivation adds
- autoreconfPhase, which runs autoreconf, libtoolize
- and automake, essentially preparing the configure script in
- autotools-based builds. Most autotools-based packages come with the
- configure script pre-generated, but this hook is necessary for a few
- packages and when you need to patch the package’s configure scripts.
-
-
-
-
-
- libxml2
-
-
-
- Adds every file named catalog.xml found under the
- xml/dtd and xml/xsl
- subdirectories of each build input to the
- XML_CATALOG_FILES environment variable.
-
-
-
-
-
- teTeX / TeX Live
-
-
-
- Adds the share/texmf-nix subdirectory of each build
- input to the TEXINPUTS environment variable.
-
-
-
-
-
- Qt 4
-
-
-
- Sets the QTDIR environment variable to Qt’s path.
-
-
-
-
-
- gdk-pixbuf
-
-
-
- Exports GDK_PIXBUF_MODULE_FILE environment variable to
- the builder. Add librsvg package to buildInputs to
- get svg support.
-
-
-
-
-
- GHC
-
-
-
- Creates a temporary package database and registers every Haskell build
- input in it (TODO: how?).
-
-
-
-
-
- GStreamer
-
-
-
- Adds the GStreamer plugins subdirectory of each build input to the
- GST_PLUGIN_SYSTEM_PATH_1_0 or
- GST_PLUGIN_SYSTEM_PATH environment variable.
-
-
-
-
-
- autoPatchelfHook
-
-
-
- This is a special setup hook which helps in packaging proprietary
- software in that it automatically tries to find missing shared library
- dependencies of ELF files based on the given
- buildInputs and nativeBuildInputs.
-
-
- You can also specify a runtimeDependencies environment
- variable which lists dependencies that are unconditionally added to all
- executables.
-
-
- This is useful for programs that use
- dlopen
- 3 to load libraries at runtime.
-
-
- In certain situations you may want to run the main command
- (autoPatchelf) of the setup hook on a file or a set
- of directories instead of unconditionally patching all outputs. This can
- be done by setting the dontAutoPatchelf environment
- variable to a non-empty value.
-
-
- The autoPatchelf command also recognizes a
- --no-recurse command line flag,
- which prevents it from recursing into subdirectories.
-
-
-
-
-
- breakpointHook
-
-
-
- This hook will make a build pause instead of stopping when a failure
- happens. It prevents nix from cleaning up the build environment
- immediately and allows the user to attach to a build environment using
- the cntr command. Upon build error it will print
- instructions on how to use cntr, which can be used to
- enter the environment for debugging. Installing cntr and running the
- command will provide shell access to the build sandbox of failed build.
- At /var/lib/cntr the sandboxed filesystem is
- mounted. All commands and files of the system are still accessible
- within the shell. To execute commands from the sandbox use the cntr exec
- subcommand. cntr is only supported
- on Linux-based platforms. To use it first add cntr to
- your environment.systemPackages on NixOS or
- alternatively to the root user on non-NixOS systems. Then in the package
- that is supposed to be inspected, add breakpointHook
- to nativeBuildInputs.
-
-nativeBuildInputs = [ breakpointHook ];
-
- When a build failure happens there will be an instruction printed that
- shows how to attach with cntr to the build sandbox.
-
-
- Caution with remote builds
-
- This won't work with remote builds as the build environment is on
- a different machine and can't be accessed by cntr.
- Remote builds can be turned off by setting --option builders ''
- for nix-build or --builders '' for
- nix build.
-
-
-
-
-
-
- installShellFiles
-
-
-
- This hook helps with installing manpages and shell completion files. It
- exposes 2 shell functions installManPage and
- installShellCompletion that can be used from your
- postInstall hook.
-
-
- The installManPage function takes one or more paths
- to manpages to install. The manpages must have a section suffix, and may
- optionally be compressed (with .gz suffix). This
- function will place them into the correct directory.
-
-
- The installShellCompletion function takes one or more
- paths to shell completion files. By default it will autodetect the shell
- type from the completion file extension, but you may also specify it by
- passing one of --bash, --fish, or
- --zsh. These flags apply to all paths listed after
- them (up until another shell flag is given). Each path may also have a
- custom installation name provided by providing a flag --name
- NAME before the path. If this flag is not provided, zsh
- completions will be renamed automatically such that
- foobar.zsh becomes _foobar.
-
-nativeBuildInputs = [ installShellFiles ];
-postInstall = ''
- installManPage doc/foobar.1 doc/barfoo.3
- # explicit behavior
- installShellCompletion --bash --name foobar.bash share/completions.bash
- installShellCompletion --fish --name foobar.fish share/completions.fish
- installShellCompletion --zsh --name _foobar share/completions.zsh
- # implicit behavior
- installShellCompletion share/completions/foobar.{bash,fish,zsh}
-'';
-
-
-
-
-
-
- libiconv, libintl
-
-
-
- A few libraries automatically add to NIX_LDFLAGS
- their library, making their symbols automatically available to the
- linker. This includes libiconv and libintl (gettext). This is done to
- provide compatibility between GNU Linux, where libiconv and libintl are
- bundled in, and other systems where that might not be the case.
- Sometimes, this behavior is not desired. To disable this behavior, set
- dontAddExtraLibs.
-
-
-
-
-
- cmake
-
-
-
- Overrides the default configure phase to run the CMake command. By
- default, we use the Make generator of CMake. In addition, dependencies
- are added automatically to CMAKE_PREFIX_PATH so that packages are
- correctly detected by CMake. Some additional flags are passed in to give
- similar behavior to configure-based packages. You can disable this
- hook’s behavior by setting configurePhase to a custom value, or by
- setting dontUseCmakeConfigure. cmakeFlags controls flags passed only to
- CMake. By default, parallel building is enabled as CMake supports
- parallel building almost everywhere. When Ninja is also in use, CMake
- will detect that and use the ninja generator.
-
-
-
-
-
- xcbuildHook
-
-
-
- Overrides the build and install phases to run the “xcbuild” command.
- This hook is needed when a project only comes with build files for the
- XCode build system. You can disable this behavior by setting buildPhase
- and configurePhase to a custom value. xcbuildFlags controls flags passed
- only to xcbuild.
-
-
-
-
-
- meson
-
-
-
- Overrides the configure phase to run meson to generate Ninja files. You
- can disable this behavior by setting configurePhase to a custom value,
- or by setting dontUseMesonConfigure. To run these files, you should
- accompany meson with ninja. mesonFlags controls only the flags passed to
- meson. By default, parallel building is enabled as Meson supports
- parallel building almost everywhere.
-
-
-
-
-
- ninja
-
-
-
- Overrides the build, install, and check phase to run ninja instead of
- make. You can disable this behavior with the dontUseNinjaBuild,
- dontUseNinjaInstall, and dontUseNinjaCheck, respectively. Parallel
- building is enabled by default in Ninja.
-
-
-
-
-
- unzip
-
-
-
- This setup hook will allow you to unzip .zip files specified in $src.
- There are many similar packages like unrar, undmg, etc.
-
-
-
-
-
- wafHook
-
-
-
- Overrides the configure, build, and install phases. This will run the
- "waf" script used by many projects. If wafPath (default ./waf) doesn’t
- exist, it will copy the version of waf available in Nixpkgs. wafFlags can
- be used to pass flags to the waf script.
-
-
-
-
-
- scons
-
-
-
- Overrides the build, install, and check phases. This uses the scons
- build system as a replacement for make. scons does not provide a
- configure phase, so everything is managed at build and install time.
-
-
-
-
-
-
-
- Purity in Nixpkgs
-
-
- [measures taken to prevent dependencies on packages outside the store, and
- what you can do to prevent them]
-
-
-
- GCC doesn't search in locations such as /usr/include.
- In fact, attempts to add such directories through the
- flag are filtered out. Likewise, the linker (from GNU binutils) doesn't
- search in standard locations such as /usr/lib. Programs
- built on Linux are linked against a GNU C Library that likewise doesn't
- search in the default system locations.
-
-
-
- Hardening in Nixpkgs
-
-
- There are flags available to harden packages at compile or link-time. These
- can be toggled using the stdenv.mkDerivation parameters
- hardeningDisable and hardeningEnable.
-
-
-
- Both parameters take a list of flags as strings. The special
- "all" flag can be passed to
- hardeningDisable to turn off all hardening. These flags
- can also be used as environment variables for testing or development
- purposes.
-
-
-
- The following flags are enabled by default and might require disabling with
- hardeningDisable if the program to package is
- incompatible.
-
-
-
-
-
- format
-
-
-
- Adds the compiler options. At present, this warns
- about calls to printf and scanf
- functions where the format string is not a string literal and there are
- no format arguments, as in printf(foo);. This may be a
- security hole if the format string came from untrusted input and contains
- %n.
-
-
- This needs to be turned off or fixed for errors similar to:
-
-
-/tmp/nix-build-zynaddsubfx-2.5.2.drv-0/zynaddsubfx-2.5.2/src/UI/guimain.cpp:571:28: error: format not a string literal and no format arguments [-Werror=format-security]
- printf(help_message);
- ^
-cc1plus: some warnings being treated as errors
-
-
-
-
-
- stackprotector
-
-
-
- Adds the compiler options. This adds safety checks
- against stack overwrites rendering many potential code injection attacks
- into aborting situations. In the best case this turns code injection
- vulnerabilities into denial of service or into non-issues (depending on
- the application).
-
-
- This needs to be turned off or fixed for errors similar to:
-
-
-bin/blib.a(bios_console.o): In function `bios_handle_cup':
-/tmp/nix-build-ipxe-20141124-5cbdc41.drv-0/ipxe-5cbdc41/src/arch/i386/firmware/pcbios/bios_console.c:86: undefined reference to `__stack_chk_fail'
-
-
-
-
-
- fortify
-
-
-
- Adds the compiler options.
- During code generation the compiler knows a great deal of information
- about buffer sizes (where possible), and attempts to replace insecure
- unlimited length buffer function calls with length-limited ones. This is
- especially useful for old, crufty code. Additionally, format strings in
- writable memory that contain '%n' are blocked. If an application depends
- on such a format string, it will need to be worked around.
-
-
- Additionally, some warnings are enabled which might trigger build
- failures if compiler warnings are treated as errors in the package build.
- In this case, set to
- .
-
-
- This needs to be turned off or fixed for errors similar to:
-
-
-malloc.c:404:15: error: return type is an incomplete type
-malloc.c:410:19: error: storage size of 'ms' isn't known
-
-
-strdup.h:22:1: error: expected identifier or '(' before '__extension__'
-
-
-strsep.c:65:23: error: register name not specified for 'delim'
-
-
-installwatch.c:3751:5: error: conflicting types for '__open_2'
-
-
-fcntl2.h:50:4: error: call to '__open_missing_mode' declared with attribute error: open with O_CREAT or O_TMPFILE in second argument needs 3 arguments
-
-
-
-
-
- pic
-
-
-
- Adds the compiler options. This options adds
- support for position independent code in shared libraries and thus making
- ASLR possible.
-
-
- Most notably, the Linux kernel, kernel modules and other code not running
- in an operating system environment like boot loaders won't build with PIC
- enabled. The compiler will is most cases complain that PIC is not
- supported for a specific build.
-
-
- This needs to be turned off or fixed for assembler errors similar to:
-
-
-ccbLfRgg.s: Assembler messages:
-ccbLfRgg.s:33: Error: missing or invalid displacement expression `private_key_len@GOTOFF'
-
-
-
-
-
- strictoverflow
-
-
-
- Signed integer overflow is undefined behaviour according to the C
- standard. If it happens, it is an error in the program as it should check
- for overflow before it can happen, not afterwards. GCC provides built-in
- functions to perform arithmetic with overflow checking, which are correct
- and faster than any custom implementation. As a workaround, the option
- makes gcc behave as if signed
- integer overflows were defined.
-
-
- This flag should not trigger any build or runtime errors.
-
-
-
-
-
- relro
-
-
-
- Adds the linker option. During program load,
- several ELF memory sections need to be written to by the linker, but can
- be turned read-only before turning over control to the program. This
- prevents some GOT (and .dtors) overwrite attacks, but at least the part
- of the GOT used by the dynamic linker (.got.plt) is still vulnerable.
-
-
- This flag can break dynamic shared object loading. For instance, the
- module systems of Xorg and OpenCV are incompatible with this flag. In
- almost all cases the bindnow flag must also be
- disabled and incompatible programs typically fail with similar errors at
- runtime.
-
-
-
-
-
- bindnow
-
-
-
- Adds the linker option. During program load,
- all dynamic symbols are resolved, allowing for the complete GOT to be
- marked read-only (due to relro). This prevents GOT
- overwrite attacks. For very large applications, this can incur some
- performance loss during initial load while symbols are resolved, but this
- shouldn't be an issue for daemons.
-
-
- This flag can break dynamic shared object loading. For instance, the
- module systems of Xorg and PHP are incompatible with this flag. Programs
- incompatible with this flag often fail at runtime due to missing symbols,
- like:
-
-
-intel_drv.so: undefined symbol: vgaHWFreeHWRec
-
-
-
-
-
-
- The following flags are disabled by default and should be enabled with
- hardeningEnable for packages that take untrusted input
- like network services.
-
-
-
-
-
- pie
-
-
-
- Adds the compiler and linker
- options. Position Independent Executables are needed to take advantage of
- Address Space Layout Randomization, supported by modern kernel versions.
- While ASLR can already be enforced for data areas in the stack and heap
- (brk and mmap), the code areas must be compiled as position-independent.
- Shared libraries already do this with the pic flag, so
- they gain ASLR automatically, but binary .text regions need to be build
- with pie to gain ASLR. When this happens, ROP attacks
- are much harder since there are no static locations to bounce off of
- during a memory corruption attack.
-
-
-
-
-
-
- For more in-depth information on these hardening flags and hardening in
- general, refer to the
- Debian Wiki,
- Ubuntu
- Wiki,
- Gentoo
- Wiki, and the
-
- Arch Wiki.
-
-
-
diff --git a/doc/stdenv/cross-compilation.xml b/doc/stdenv/cross-compilation.xml
new file mode 100644
index 0000000000000000000000000000000000000000..bea56a0c2fc18ddfa7bc1794fdce197f929ceff9
--- /dev/null
+++ b/doc/stdenv/cross-compilation.xml
@@ -0,0 +1,394 @@
+
+ Cross-compilation
+
+ Introduction
+
+
+ "Cross-compilation" means compiling a program on one machine for another type of machine. For example, a typical use of cross-compilation is to compile programs for embedded devices. These devices often don't have the computing power and memory to compile their own programs. One might think that cross-compilation is a fairly niche concern. However, there are significant advantages to rigorously distinguishing between build-time and run-time environments! Significant, because the benefits apply even when one is developing and deploying on the same machine. Nixpkgs is increasingly adopting the opinion that packages should be written with cross-compilation in mind, and nixpkgs should evaluate in a similar way (by minimizing cross-compilation-specific special cases) whether or not one is cross-compiling.
+
+
+
+ This chapter will be organized in three parts. First, it will describe the basics of how to package software in a way that supports cross-compilation. Second, it will describe how to use Nixpkgs when cross-compiling. Third, it will describe the internal infrastructure supporting cross-compilation.
+
+
+
+
+ Packaging in a cross-friendly manner
+
+
+ Platform parameters
+
+
+ Nixpkgs follows the conventions of GNU autoconf. We distinguish between 3 types of platforms when building a derivation: build, host, and target. In summary, build is the platform on which a package is being built, host is the platform on which it will run. The third attribute, target, is relevant only for certain specific compilers and build tools.
+
+
+
+ In Nixpkgs, these three platforms are defined as attribute sets under the names buildPlatform, hostPlatform, and targetPlatform. They are always defined as attributes in the standard environment. That means one can access them like:
+{ stdenv, fooDep, barDep, .. }: ...stdenv.buildPlatform...
+ .
+
+
+
+
+
+ buildPlatform
+
+
+
+ The "build platform" is the platform on which a package is built. Once someone has a built package, or pre-built binary package, the build platform should not matter and can be ignored.
+
+
+
+
+
+ hostPlatform
+
+
+
+ The "host platform" is the platform on which a package will be run. This is the simplest platform to understand, but also the one with the worst name.
+
+
+
+
+
+ targetPlatform
+
+
+
+ The "target platform" attribute is, unlike the other two attributes, not actually fundamental to the process of building software. Instead, it is only relevant for compatibility with building certain specific compilers and build tools. It can be safely ignored for all other packages.
+
+
+ The build process of certain compilers is written in such a way that the compiler resulting from a single build can itself only produce binaries for a single platform. The task of specifying this single "target platform" is thus pushed to build time of the compiler. The root cause of this is that the compiler (which will be run on the host) and the standard library/runtime (which will be run on the target) are built by a single build process.
+
+
+ There is no fundamental need to think about a single target ahead of time like this. If the tool supports modular or pluggable backends, both the need to specify the target at build time and the constraint of having only a single target disappear. An example of such a tool is LLVM.
+
+
+ Although the existence of a "target platfom" is arguably a historical mistake, it is a common one: examples of tools that suffer from it are GCC, Binutils, GHC and Autoconf. Nixpkgs tries to avoid sharing in the mistake where possible. Still, because the concept of a target platform is so ingrained, it is best to support it as is.
+
+
+
+
+
+
+ The exact schema these fields follow is a bit ill-defined due to a long and convoluted evolution, but this is slowly being cleaned up. You can see examples of ones used in practice in lib.systems.examples; note how they are not all very consistent. For now, here are few fields can count on them containing:
+
+
+
+
+
+ system
+
+
+
+ This is a two-component shorthand for the platform. Examples of this would be "x86_64-darwin" and "i686-linux"; see lib.systems.doubles for more. The first component corresponds to the CPU architecture of the platform and the second to the operating system of the platform ([cpu]-[os]). This format has built-in support in Nix, such as the builtins.currentSystem impure string.
+
+
+
+
+
+ config
+
+
+
+ This is a 3- or 4- component shorthand for the platform. Examples of this would be x86_64-unknown-linux-gnu and aarch64-apple-darwin14. This is a standard format called the "LLVM target triple", as they are pioneered by LLVM. In the 4-part form, this corresponds to [cpu]-[vendor]-[os]-[abi]. This format is strictly more informative than the "Nix host double", as the previous format could analogously be termed. This needs a better name than config!
+
+
+
+
+
+ parsed
+
+
+
+ This is a Nix representation of a parsed LLVM target triple with white-listed components. This can be specified directly, or actually parsed from the config. See lib.systems.parse for the exact representation.
+
+
+
+
+
+ libc
+
+
+
+ This is a string identifying the standard C library used. Valid identifiers include "glibc" for GNU libc, "libSystem" for Darwin's Libsystem, and "uclibc" for µClibc. It should probably be refactored to use the module system, like parse.
+
+
+
+
+
+ is*
+
+
+
+ These predicates are defined in lib.systems.inspect, and slapped onto every platform. They are superior to the ones in stdenv as they force the user to be explicit about which platform they are inspecting. Please use these instead of those.
+
+
+
+
+
+ platform
+
+
+
+ This is, quite frankly, a dumping ground of ad-hoc settings (it's an attribute set). See lib.systems.platforms for examples—there's hopefully one in there that will work verbatim for each platform that is working. Please help us triage these flags and give them better homes!
+
+
+
+
+
+
+
+ Theory of dependency categorization
+
+
+
+ This is a rather philosophical description that isn't very Nixpkgs-specific. For an overview of all the relevant attributes given to mkDerivation, see . For a description of how everything is implemented, see .
+
+
+
+
+ In this section we explore the relationship between both runtime and build-time dependencies and the 3 Autoconf platforms.
+
+
+
+ A run time dependency between two packages requires that their host platforms match. This is directly implied by the meaning of "host platform" and "runtime dependency": The package dependency exists while both packages are running on a single host platform.
+
+
+
+ A build time dependency, however, has a shift in platforms between the depending package and the depended-on package. "build time dependency" means that to build the depending package we need to be able to run the depended-on's package. The depending package's build platform is therefore equal to the depended-on package's host platform.
+
+
+
+ If both the dependency and depending packages aren't compilers or other machine-code-producing tools, we're done. And indeed buildInputs and nativeBuildInputs have covered these simpler build-time and run-time (respectively) changes for many years. But if the dependency does produce machine code, we might need to worry about its target platform too. In principle, that target platform might be any of the depending package's build, host, or target platforms, but we prohibit dependencies from a "later" platform to an earlier platform to limit confusion because we've never seen a legitimate use for them.
+
+
+
+ Finally, if the depending package is a compiler or other machine-code-producing tool, it might need dependencies that run at "emit time". This is for compilers that (regrettably) insist on being built together with their source langauges' standard libraries. Assuming build != host != target, a run-time dependency of the standard library cannot be run at the compiler's build time or run time, but only at the run time of code emitted by the compiler.
+
+
+
+ Putting this all together, that means we have dependencies in the form "host → target", in at most the following six combinations:
+
+
Possible dependency types
+
+
+
Dependency's host platform
+
Dependency's target platform
+
+
+
+
+
build
+
build
+
+
+
build
+
host
+
+
+
build
+
target
+
+
+
host
+
host
+
+
+
host
+
target
+
+
+
target
+
target
+
+
+
+
+
+
+ Some examples will make this table clearer. Suppose there's some package that is being built with a (build, host, target) platform triple of (foo, bar, baz). If it has a build-time library dependency, that would be a "host → build" dependency with a triple of (foo, foo, *) (the target platform is irrelevant). If it needs a compiler to be built, that would be a "build → host" dependency with a triple of (foo, foo, *) (the target platform is irrelevant). That compiler, would be built with another compiler, also "build → host" dependency, with a triple of (foo, foo, foo).
+
+
+
+
+ Cross packaging cookbook
+
+
+ Some frequently encountered problems when packaging for cross-compilation should be answered here. Ideally, the information above is exhaustive, so this section cannot provide any new information, but it is ludicrous and cruel to expect everyone to spend effort working through the interaction of many features just to figure out the same answer to the same common problem. Feel free to add to this list!
+
+
+
+
+
+
+ What if my package's build system needs to build a C program to be run under the build environment?
+
+
+
+
+depsBuildBuild = [ buildPackages.stdenv.cc ];
+ Add it to your mkDerivation invocation.
+
+
+
+
+
+
+ My package fails to find ar.
+
+
+
+
+ Many packages assume that an unprefixed ar is available, but Nix doesn't provide one. It only provides a prefixed one, just as it only does for all the other binutils programs. It may be necessary to patch the package to fix the build system to use a prefixed ar.
+
+
+
+
+
+
+ My package's testsuite needs to run host platform code.
+
+
+
+
+doCheck = stdenv.hostPlatform != stdenv.buildPlatfrom;
+ Add it to your mkDerivation invocation.
+
+
+
+
+
+
+
+
+ Cross-building packages
+
+
+ Nixpkgs can be instantiated with localSystem alone, in which case there is no cross-compiling and everything is built by and for that system, or also with crossSystem, in which case packages run on the latter, but all building happens on the former. Both parameters take the same schema as the 3 (build, host, and target) platforms defined in the previous section. As mentioned above, lib.systems.examples has some platforms which are used as arguments for these parameters in practice. You can use them programmatically, or on the command line:
+
+nix-build '<nixpkgs>' --arg crossSystem '(import <nixpkgs/lib>).systems.examples.fooBarBaz' -A whatever
+
+
+
+
+ Eventually we would like to make these platform examples an unnecessary convenience so that
+
+nix-build '<nixpkgs>' --arg crossSystem '{ config = "<arch>-<os>-<vendor>-<abi>"; }' -A whatever
+ works in the vast majority of cases. The problem today is dependencies on other sorts of configuration which aren't given proper defaults. We rely on the examples to crudely to set those configuration parameters in some vaguely sane manner on the users behalf. Issue #34274 tracks this inconvenience along with its root cause in crufty configuration options.
+
+
+
+
+ While one is free to pass both parameters in full, there's a lot of logic to fill in missing fields. As discussed in the previous section, only one of system, config, and parsed is needed to infer the other two. Additionally, libc will be inferred from parse. Finally, localSystem.system is also impurely inferred based on the platform evaluation occurs. This means it is often not necessary to pass localSystem at all, as in the command-line example in the previous paragraph.
+
+
+
+
+ Many sources (manual, wiki, etc) probably mention passing system, platform, along with the optional crossSystem to nixpkgs: import <nixpkgs> { system = ..; platform = ..; crossSystem = ..; }. Passing those two instead of localSystem is still supported for compatibility, but is discouraged. Indeed, much of the inference we do for these parameters is motivated by compatibility as much as convenience.
+
+
+
+
+ One would think that localSystem and crossSystem overlap horribly with the three *Platforms (buildPlatform, hostPlatform, and targetPlatform; see stage.nix or the manual). Actually, those identifiers are purposefully not used here to draw a subtle but important distinction: While the granularity of having 3 platforms is necessary to properly *build* packages, it is overkill for specifying the user's *intent* when making a build plan or package set. A simple "build vs deploy" dichotomy is adequate: the sliding window principle described in the previous section shows how to interpolate between the these two "end points" to get the 3 platform triple for each bootstrapping stage. That means for any package a given package set, even those not bound on the top level but only reachable via dependencies or buildPackages, the three platforms will be defined as one of localSystem or crossSystem, with the former replacing the latter as one traverses build-time dependencies. A last simple difference is that crossSystem should be null when one doesn't want to cross-compile, while the *Platforms are always non-null. localSystem is always non-null.
+
+
+
+
+ Cross-compilation infrastructure
+
+
+ Implementation of dependencies
+
+
+ The categorizes of dependencies developed in are specified as lists of derivations given to mkDerivation, as documented in . In short, each list of dependencies for "host → target" of "foo → bar" is called depsFooBar, with exceptions for backwards compatibility that depsBuildHost is instead called nativeBuildInputs and depsHostTarget is instead called buildInputs. Nixpkgs is now structured so that each depsFooBar is automatically taken from pkgsFooBar. (These pkgsFooBars are quite new, so there is no special case for nativeBuildInputs and buildInputs.) For example, pkgsBuildHost.gcc should be used at build-time, while pkgsHostTarget.gcc should be used at run-time.
+
+
+
+ Now, for most of Nixpkgs's history, there were no pkgsFooBar attributes, and most packages have not been refactored to use it explicitly. Prior to those, there were just buildPackages, pkgs, and targetPackages. Those are now redefined as aliases to pkgsBuildHost, pkgsHostTarget, and pkgsTargetTarget. It is acceptable, even recommended, to use them for libraries to show that the host platform is irrelevant.
+
+
+
+ But before that, there was just pkgs, even though both buildInputs and nativeBuildInputs existed. [Cross barely worked, and those were implemented with some hacks on mkDerivation to override dependencies.] What this means is the vast majority of packages do not use any explicit package set to populate their dependencies, just using whatever callPackage gives them even if they do correctly sort their dependencies into the multiple lists described above. And indeed, asking that users both sort their dependencies, and take them from the right attribute set, is both too onerous and redundant, so the recommended approach (for now) is to continue just categorizing by list and not using an explicit package set.
+
+
+
+ To make this work, we "splice" together the six pkgsFooBar package sets and have callPackage actually take its arguments from that. This is currently implemented in pkgs/top-level/splice.nix. mkDerivation then, for each dependency attribute, pulls the right derivation out from the splice. This splicing can be skipped when not cross-compiling as the package sets are the same, but still is a bit slow for cross-compiling. We'd like to do something better, but haven't come up with anything yet.
+
+
+
+
+ Bootstrapping
+
+
+ Each of the package sets described above come from a single bootstrapping stage. While pkgs/top-level/default.nix, coordinates the composition of stages at a high level, pkgs/top-level/stage.nix "ties the knot" (creates the fixed point) of each stage. The package sets are defined per-stage however, so they can be thought of as edges between stages (the nodes) in a graph. Compositions like pkgsBuildTarget.targetPackages can be thought of as paths to this graph.
+
+
+
+ While there are many package sets, and thus many edges, the stages can also be arranged in a linear chain. In other words, many of the edges are redundant as far as connectivity is concerned. This hinges on the type of bootstrapping we do. Currently for cross it is:
+
+
+
+ (native, native, native)
+
+
+
+
+ (native, native, foreign)
+
+
+
+
+ (native, foreign, foreign)
+
+
+
+ In each stage, pkgsBuildHost refers to the previous stage, pkgsBuildBuild refers to the one before that, and pkgsHostTarget refers to the current one, and pkgsTargetTarget refers to the next one. When there is no previous or next stage, they instead refer to the current stage. Note how all the invariants regarding the mapping between dependency and depending packages' build host and target platforms are preserved. pkgsBuildTarget and pkgsHostHost are more complex in that the stage fitting the requirements isn't always a fixed chain of "prevs" and "nexts" away (modulo the "saturating" self-references at the ends). We just special case each instead. All the primary edges are implemented is in pkgs/stdenv/booter.nix, and secondarily aliases in pkgs/top-level/stage.nix.
+
+
+
+
+ Note the native stages are bootstrapped in legacy ways that predate the current cross implementation. This is why the bootstrapping stages leading up to the final stages are ignored inthe previous paragraph.
+
+
+
+
+ If one looks at the 3 platform triples, one can see that they overlap such that one could put them together into a chain like:
+
+(native, native, native, foreign, foreign)
+
+ If one imagines the saturating self references at the end being replaced with infinite stages, and then overlays those platform triples, one ends up with the infinite tuple:
+
+(native..., native, native, native, foreign, foreign, foreign...)
+
+ On can then imagine any sequence of platforms such that there are bootstrap stages with their 3 platforms determined by "sliding a window" that is the 3 tuple through the sequence. This was the original model for bootstrapping. Without a target platform (assume a better world where all compilers are multi-target and all standard libraries are built in their own derivation), this is sufficient. Conversely if one wishes to cross compile "faster", with a "Canadian Cross" bootstraping stage where build != host != target, more bootstrapping stages are needed since no sliding window providess the pesky pkgsBuildTarget package set since it skips the Canadian cross stage's "host".
+
+
+
+
+ It is much better to refer to buildPackages than targetPackages, or more broadly package sets that do not mention "target". There are three reasons for this.
+
+
+ First, it is because bootstrapping stages do not have a unique targetPackages. For example a (x86-linux, x86-linux, arm-linux) and (x86-linux, x86-linux, x86-windows) package set both have a (x86-linux, x86-linux, x86-linux) package set. Because there is no canonical targetPackages for such a native (build == host == target) package set, we set their targetPackages
+
+
+ Second, it is because this is a frequent source of hard-to-follow "infinite recursions" / cycles. When only package sets that don't mention target are used, the package set forms a directed acyclic graph. This means that all cycles that exist are confined to one stage. This means they are a lot smaller, and easier to follow in the code or a backtrace. It also means they are present in native and cross builds alike, and so more likely to be caught by CI and other users.
+
+
+ Thirdly, it is because everything target-mentioning only exists to accommodate compilers with lousy build systems that insist on the compiler itself and standard library being built together. Of course that is bad because bigger derivations means longer rebuilds. It is also problematic because it tends to make the standard libraries less like other libraries than they could be, complicating code and build systems alike. Because of the other problems, and because of these innate disadvantages, compilers ought to be packaged another way where possible.
+
+
+
+
+
+ If one explores Nixpkgs, they will see derivations with names like gccCross. Such *Cross derivations is a holdover from before we properly distinguished between the host and target platforms—the derivation with "Cross" in the name covered the build = host != target case, while the other covered the host = target, with build platform the same or not based on whether one was using its .nativeDrv or .crossDrv. This ugliness will disappear soon.
+
+
+
+
+
diff --git a/doc/meta.xml b/doc/stdenv/meta.xml
similarity index 58%
rename from doc/meta.xml
rename to doc/stdenv/meta.xml
index 58c390a68b84da9bbf9e8c18f50d9a8c778db6ea..9371196818ad9272a557400d26c0ea687e4cd632 100644
--- a/doc/meta.xml
+++ b/doc/stdenv/meta.xml
@@ -3,10 +3,7 @@
xml:id="chap-meta">
Meta-attributes
- Nix packages can declare meta-attributes that contain
- information about a package such as a description, its homepage, its license,
- and so on. For instance, the GNU Hello package has a meta
- declaration like this:
+ Nix packages can declare meta-attributes that contain information about a package such as a description, its homepage, its license, and so on. For instance, the GNU Hello package has a meta declaration like this:
meta = with stdenv.lib; {
description = "A program that produces a familiar, friendly greeting";
@@ -22,13 +19,10 @@ meta = with stdenv.lib; {
- Meta-attributes are not passed to the builder of the package. Thus, a change
- to a meta-attribute doesn’t trigger a recompilation of the package. The
- value of a meta-attribute must be a string.
+ Meta-attributes are not passed to the builder of the package. Thus, a change to a meta-attribute doesn’t trigger a recompilation of the package. The value of a meta-attribute must be a string.
- The meta-attributes of a package can be queried from the command-line using
- nix-env:
+ The meta-attributes of a package can be queried from the command-line using nix-env:
$ nix-env -qa hello --json
{
@@ -67,8 +61,7 @@ meta = with stdenv.lib; {
- nix-env knows about the description
- field specifically:
+ nix-env knows about the description field specifically:
$ nix-env -qa hello --description
hello-2.3 A program that produces a familiar, friendly greeting
@@ -88,18 +81,13 @@ hello-2.3 A program that produces a familiar, friendly greeting
- A short (one-line) description of the package. This is shown by
- nix-env -q --description and also on the Nixpkgs
- release pages.
+ A short (one-line) description of the package. This is shown by nix-env -q --description and also on the Nixpkgs release pages.
- Don’t include a period at the end. Don’t include newline characters.
- Capitalise the first character. For brevity, don’t repeat the name of
- package — just describe what it does.
+ Don’t include a period at the end. Don’t include newline characters. Capitalise the first character. For brevity, don’t repeat the name of package — just describe what it does.
- Wrong: "libpng is a library that allows you to decode PNG
- images."
+ Wrong: "libpng is a library that allows you to decode PNG images."
Right: "A library for decoding PNG images"
@@ -122,9 +110,7 @@ hello-2.3 A program that produces a familiar, friendly greeting
- Release branch. Used to specify that a package is not going to receive
- updates that are not in this branch; for example, Linux kernel 3.0 is
- supposed to be updated to 3.0.X, not 3.1.
+ Release branch. Used to specify that a package is not going to receive updates that are not in this branch; for example, Linux kernel 3.0 is supposed to be updated to 3.0.X, not 3.1.
@@ -134,8 +120,7 @@ hello-2.3 A program that produces a familiar, friendly greeting
- The package’s homepage. Example:
- https://www.gnu.org/software/hello/manual/
+ The package’s homepage. Example: https://www.gnu.org/software/hello/manual/
@@ -145,8 +130,7 @@ hello-2.3 A program that produces a familiar, friendly greeting
- The page where a link to the current version can be found. Example:
- https://ftp.gnu.org/gnu/hello/
+ The page where a link to the current version can be found. Example: https://ftp.gnu.org/gnu/hello/
@@ -156,10 +140,7 @@ hello-2.3 A program that produces a familiar, friendly greeting
- A link or a list of links to the location of Changelog for a package.
- A link may use expansion to refer to the correct changelog version.
- Example:
- "https://git.savannah.gnu.org/cgit/hello.git/plain/NEWS?h=v${version}"
+ A link or a list of links to the location of Changelog for a package. A link may use expansion to refer to the correct changelog version. Example: "https://git.savannah.gnu.org/cgit/hello.git/plain/NEWS?h=v${version}"
@@ -169,46 +150,32 @@ hello-2.3 A program that produces a familiar, friendly greeting
- The license, or licenses, for the package. One from the attribute set
- defined in
-
- nixpkgs/lib/licenses.nix. At this moment
- using both a list of licenses and a single license is valid. If the
- license field is in the form of a list representation, then it means that
- parts of the package are licensed differently. Each license should
- preferably be referenced by their attribute. The non-list attribute value
- can also be a space delimited string representation of the contained
- attribute shortNames or spdxIds. The following are all valid examples:
+ The license, or licenses, for the package. One from the attribute set defined in nixpkgs/lib/licenses.nix. At this moment using both a list of licenses and a single license is valid. If the license field is in the form of a list representation, then it means that parts of the package are licensed differently. Each license should preferably be referenced by their attribute. The non-list attribute value can also be a space delimited string representation of the contained attribute shortNames or spdxIds. The following are all valid examples:
- Single license referenced by attribute (preferred)
- stdenv.lib.licenses.gpl3.
+ Single license referenced by attribute (preferred) stdenv.lib.licenses.gpl3.
- Single license referenced by its attribute shortName (frowned upon)
- "gpl3".
+ Single license referenced by its attribute shortName (frowned upon) "gpl3".
- Single license referenced by its attribute spdxId (frowned upon)
- "GPL-3.0".
+ Single license referenced by its attribute spdxId (frowned upon) "GPL-3.0".
- Multiple licenses referenced by attribute (preferred) with
- stdenv.lib.licenses; [ asl20 free ofl ].
+ Multiple licenses referenced by attribute (preferred) with stdenv.lib.licenses; [ asl20 free ofl ].
- Multiple licenses referenced as a space delimited string of attribute
- shortNames (frowned upon) "asl20 free ofl".
+ Multiple licenses referenced as a space delimited string of attribute shortNames (frowned upon) "asl20 free ofl".
@@ -222,13 +189,8 @@ hello-2.3 A program that produces a familiar, friendly greeting
- A list of names and e-mail addresses of the maintainers of this Nix
- expression. If you would like to be a maintainer of a package, you may
- want to add yourself to
- nixpkgs/maintainers/maintainer-list.nix
- and write something like [ stdenv.lib.maintainers.alice
- stdenv.lib.maintainers.bob ].
+ A list of names and e-mail addresses of the maintainers of this Nix expression. If you would like to be a maintainer of a package, you may want to add yourself to nixpkgs/maintainers/maintainer-list.nix and write something like [ stdenv.lib.maintainers.alice stdenv.lib.maintainers.bob ].
@@ -238,10 +200,7 @@ hello-2.3 A program that produces a familiar, friendly greeting
- The priority of the package, used by
- nix-env to resolve file name conflicts between
- packages. See the Nix manual page for nix-env for
- details. Example: "10" (a low-priority package).
+ The priority of the package, used by nix-env to resolve file name conflicts between packages. See the Nix manual page for nix-env for details. Example: "10" (a low-priority package).
@@ -251,15 +210,11 @@ hello-2.3 A program that produces a familiar, friendly greeting
- The list of Nix platform types on which the package is supported. Hydra
- builds packages according to the platform specified. If no platform is
- specified, the package does not have prebuilt binaries. An example is:
+ The list of Nix platform types on which the package is supported. Hydra builds packages according to the platform specified. If no platform is specified, the package does not have prebuilt binaries. An example is:
meta.platforms = stdenv.lib.platforms.linux;
- Attribute Set stdenv.lib.platforms defines
-
- various common lists of platforms types.
+ Attribute Set stdenv.lib.platforms defines various common lists of platforms types.
@@ -270,23 +225,14 @@ meta.platforms = stdenv.lib.platforms.linux;
- This attribute is special in that it is not actually under the
- meta attribute set but rather under the
- passthru attribute set. This is due to how
- meta attributes work, and the fact that they
- are supposed to contain only metadata, not derivations.
+ This attribute is special in that it is not actually under the meta attribute set but rather under the passthru attribute set. This is due to how meta attributes work, and the fact that they are supposed to contain only metadata, not derivations.
- An attribute set with as values tests. A test is a derivation, which
- builds successfully when the test passes, and fails to build otherwise. A
- derivation that is a test needs to have meta.timeout
- defined.
+ An attribute set with as values tests. A test is a derivation, which builds successfully when the test passes, and fails to build otherwise. A derivation that is a test needs to have meta.timeout defined.
- The NixOS tests are available as nixosTests in
- parameters of derivations. For instance, the OpenSMTPD derivation
- includes lines similar to:
+ The NixOS tests are available as nixosTests in parameters of derivations. For instance, the OpenSMTPD derivation includes lines similar to:
{ /* ... */, nixosTests }:
{
@@ -305,13 +251,7 @@ meta.platforms = stdenv.lib.platforms.linux;
- A timeout (in seconds) for building the derivation. If the derivation
- takes longer than this time to build, it can fail due to breaking the
- timeout. However, all computers do not have the same computing power,
- hence some builders may decide to apply a multiplicative factor to this
- value. When filling this value in, try to keep it approximately
- consistent with other values already present in
- nixpkgs.
+ A timeout (in seconds) for building the derivation. If the derivation takes longer than this time to build, it can fail due to breaking the timeout. However, all computers do not have the same computing power, hence some builders may decide to apply a multiplicative factor to this value. When filling this value in, try to keep it approximately consistent with other values already present in nixpkgs.
@@ -321,13 +261,7 @@ meta.platforms = stdenv.lib.platforms.linux;
- The list of Nix platform types for which the Hydra instance at
- hydra.nixos.org will build the package. (Hydra is the
- Nix-based continuous build system.) It defaults to the value of
- meta.platforms. Thus, the only reason to set
- meta.hydraPlatforms is if you want
- hydra.nixos.org to build the package on a subset of
- meta.platforms, or not at all, e.g.
+ The list of Nix platform types for which the Hydra instance at hydra.nixos.org will build the package. (Hydra is the Nix-based continuous build system.) It defaults to the value of meta.platforms. Thus, the only reason to set meta.hydraPlatforms is if you want hydra.nixos.org to build the package on a subset of meta.platforms, or not at all, e.g.
meta.platforms = stdenv.lib.platforms.linux;
meta.hydraPlatforms = [];
@@ -341,10 +275,7 @@ meta.hydraPlatforms = [];
- If set to true, the package is marked as “broken”,
- meaning that it won’t show up in nix-env -qa, and
- cannot be built or installed. Such packages should be removed from
- Nixpkgs eventually unless they are fixed.
+ If set to true, the package is marked as “broken”, meaning that it won’t show up in nix-env -qa, and cannot be built or installed. Such packages should be removed from Nixpkgs eventually unless they are fixed.
@@ -354,12 +285,7 @@ meta.hydraPlatforms = [];
- If set to true, the package is tested to be updated
- correctly by the update-walker.sh script without
- additional settings. Such packages have meta.version
- set and their homepage (or the page specified by
- meta.downloadPage) contains a direct link to the
- package tarball.
+ If set to true, the package is tested to be updated correctly by the update-walker.sh script without additional settings. Such packages have meta.version set and their homepage (or the page specified by meta.downloadPage) contains a direct link to the package tarball.
@@ -369,17 +295,11 @@ meta.hydraPlatforms = [];
Licenses
- The meta.license attribute should preferrably contain a
- value from stdenv.lib.licenses defined in
-
- nixpkgs/lib/licenses.nix, or in-place license
- description of the same format if the license is unlikely to be useful in
- another expression.
+ The meta.license attribute should preferrably contain a value from stdenv.lib.licenses defined in nixpkgs/lib/licenses.nix, or in-place license description of the same format if the license is unlikely to be useful in another expression.
- Although it's typically better to indicate the specific license, a few
- generic options are available:
+ Although it's typically better to indicate the specific license, a few generic options are available:
@@ -397,18 +317,10 @@ meta.hydraPlatforms = [];
- Unfree package that can be redistributed in binary form. That is, it’s
- legal to redistribute the output of the derivation.
- This means that the package can be included in the Nixpkgs channel.
+ Unfree package that can be redistributed in binary form. That is, it’s legal to redistribute the output of the derivation. This means that the package can be included in the Nixpkgs channel.
- Sometimes proprietary software can only be redistributed unmodified.
- Make sure the builder doesn’t actually modify the original binaries;
- otherwise we’re breaking the license. For instance, the NVIDIA X11
- drivers can be redistributed unmodified, but our builder applies
- patchelf to make them work. Thus, its license is
- "unfree" and it cannot be included in the Nixpkgs
- channel.
+ Sometimes proprietary software can only be redistributed unmodified. Make sure the builder doesn’t actually modify the original binaries; otherwise we’re breaking the license. For instance, the NVIDIA X11 drivers can be redistributed unmodified, but our builder applies patchelf to make them work. Thus, its license is "unfree" and it cannot be included in the Nixpkgs channel.
@@ -418,9 +330,7 @@ meta.hydraPlatforms = [];
- Unfree package that cannot be redistributed. You can build it yourself,
- but you cannot redistribute the output of the derivation. Thus it cannot
- be included in the Nixpkgs channel.
+ Unfree package that cannot be redistributed. You can build it yourself, but you cannot redistribute the output of the derivation. Thus it cannot be included in the Nixpkgs channel.
@@ -430,9 +340,7 @@ meta.hydraPlatforms = [];
- This package supplies unfree, redistributable firmware. This is a
- separate value from unfree-redistributable because
- not everybody cares whether firmware is free.
+ This package supplies unfree, redistributable firmware. This is a separate value from unfree-redistributable because not everybody cares whether firmware is free.
diff --git a/doc/stdenv/multiple-output.xml b/doc/stdenv/multiple-output.xml
new file mode 100644
index 0000000000000000000000000000000000000000..83275bb2fbd1acd133ef3024b682052c51abaa58
--- /dev/null
+++ b/doc/stdenv/multiple-output.xml
@@ -0,0 +1,232 @@
+
+
+]>
+
+ Multiple-output packages
+
+ Introduction
+
+
+ The Nix language allows a derivation to produce multiple outputs, which is similar to what is utilized by other Linux distribution packaging systems. The outputs reside in separate Nix store paths, so they can be mostly handled independently of each other, including passing to build inputs, garbage collection or binary substitution. The exception is that building from source always produces all the outputs.
+
+
+
+ The main motivation is to save disk space by reducing runtime closure sizes; consequently also sizes of substituted binaries get reduced. Splitting can be used to have more granular runtime dependencies, for example the typical reduction is to split away development-only files, as those are typically not needed during runtime. As a result, closure sizes of many packages can get reduced to a half or even much less.
+
+
+
+
+ The reduction effects could be instead achieved by building the parts in completely separate derivations. That would often additionally reduce build-time closures, but it tends to be much harder to write such derivations, as build systems typically assume all parts are being built at once. This compromise approach of single source package producing multiple binary packages is also utilized often by rpm and deb.
+
+
+
+
+ Installing a split package
+
+
+ When installing a package via systemPackages or nix-env you have several options:
+
+
+
+
+
+ You can install particular outputs explicitly, as each is available in the Nix language as an attribute of the package. The outputs attribute contains a list of output names.
+
+
+
+
+ You can let it use the default outputs. These are handled by meta.outputsToInstall attribute that contains a list of output names.
+
+
+ TODO: more about tweaking the attribute, etc.
+
+
+
+
+ NixOS provides configuration option environment.extraOutputsToInstall that allows adding extra outputs of environment.systemPackages atop the default ones. It's mainly meant for documentation and debug symbols, and it's also modified by specific options.
+
+
+
+ At this moment there is no similar configurability for packages installed by nix-env. You can still use approach from to override meta.outputsToInstall attributes, but that's a rather inconvenient way.
+
+
+
+
+
+
+ Using a split package
+
+
+ In the Nix language the individual outputs can be reached explicitly as attributes, e.g. coreutils.info, but the typical case is just using packages as build inputs.
+
+
+
+ When a multiple-output derivation gets into a build input of another derivation, the dev output is added if it exists, otherwise the first output is added. In addition to that, propagatedBuildOutputs of that package which by default contain $outputBin and $outputLib are also added. (See .)
+
+
+
+ In some cases it may be desirable to combine different outputs under a single store path. A function symlinkJoin can be used to do this. (Note that it may negate some closure size benefits of using a multiple-output package.)
+
+
+
+ Writing a split derivation
+
+
+ Here you find how to write a derivation that produces multiple outputs.
+
+
+
+ In nixpkgs there is a framework supporting multiple-output derivations. It tries to cover most cases by default behavior. You can find the source separated in <nixpkgs/pkgs/build-support/setup-hooks/multiple-outputs.sh>; it's relatively well-readable. The whole machinery is triggered by defining the outputs attribute to contain the list of desired output names (strings).
+
+
+outputs = [ "bin" "dev" "out" "doc" ];
+
+
+ Often such a single line is enough. For each output an equally named environment variable is passed to the builder and contains the path in nix store for that output. Typically you also want to have the main out output, as it catches any files that didn't get elsewhere.
+
+
+
+
+ There is a special handling of the debug output, described at .
+
+
+
+
+ Binaries first
+
+
+ A commonly adopted convention in nixpkgs is that executables provided by the package are contained within its first output. This convention allows the dependent packages to reference the executables provided by packages in a uniform manner. For instance, provided with the knowledge that the perl package contains a perl executable it can be referenced as ${pkgs.perl}/bin/perl within a Nix derivation that needs to execute a Perl script.
+
+
+
+ The glibc package is a deliberate single exception to the binaries first convention. The glibc has libs as its first output allowing the libraries provided by glibc to be referenced directly (e.g. ${stdenv.glibc}/lib/ld-linux-x86-64.so.2). The executables provided by glibc can be accessed via its bin attribute (e.g. ${stdenv.glibc.bin}/bin/ldd).
+
+
+
+ The reason for why glibc deviates from the convention is because referencing a library provided by glibc is a very common operation among Nix packages. For instance, third-party executables packaged by Nix are typically patched and relinked with the relevant version of glibc libraries from Nix packages (please see the documentation on patchelf for more details).
+
+
+
+
+ File type groups
+
+
+ The support code currently recognizes some particular kinds of outputs and either instructs the build system of the package to put files into their desired outputs or it moves the files during the fixup phase. Each group of file types has an outputFoo variable specifying the output name where they should go. If that variable isn't defined by the derivation writer, it is guessed – a default output name is defined, falling back to other possibilities if the output isn't defined.
+
+
+
+
+
+ $outputDev
+
+
+
+ is for development-only files. These include C(++) headers, pkg-config, cmake and aclocal files. They go to dev or out by default.
+
+
+
+
+
+ $outputBin
+
+
+
+ is meant for user-facing binaries, typically residing in bin/. They go to bin or out by default.
+
+
+
+
+
+ $outputLib
+
+
+
+ is meant for libraries, typically residing in lib/ and libexec/. They go to lib or out by default.
+
+
+
+
+
+ $outputDoc
+
+
+
+ is for user documentation, typically residing in share/doc/. It goes to doc or out by default.
+
+
+
+
+
+ $outputDevdoc
+
+
+
+ is for developer documentation. Currently we count gtk-doc and devhelp books in there. It goes to devdoc or is removed (!) by default. This is because e.g. gtk-doc tends to be rather large and completely unused by nixpkgs users.
+
+
+
+
+
+ $outputMan
+
+
+
+ is for man pages (except for section 3). They go to man or $outputBin by default.
+
+
+
+
+
+ $outputDevman
+
+
+
+ is for section 3 man pages. They go to devman or $outputMan by default.
+
+
+
+
+
+ $outputInfo
+
+
+
+ is for info pages. They go to info or $outputBin by default.
+
+
+
+
+
+
+
+ Common caveats
+
+
+
+
+ Some configure scripts don't like some of the parameters passed by default by the framework, e.g. --docdir=/foo/bar. You can disable this by setting setOutputFlags = false;.
+
+
+
+
+ The outputs of a single derivation can retain references to each other, but note that circular references are not allowed. (And each strongly-connected component would act as a single output anyway.)
+
+
+
+
+ Most of split packages contain their core functionality in libraries. These libraries tend to refer to various kind of data that typically gets into out, e.g. locale strings, so there is often no advantage in separating the libraries into lib, as keeping them in out is easier.
+
+
+
+
+ Some packages have hidden assumptions on install paths, which complicates splitting.
+
+
+
+
+
+
+
diff --git a/doc/platform-notes.xml b/doc/stdenv/platform-notes.xml
similarity index 55%
rename from doc/platform-notes.xml
rename to doc/stdenv/platform-notes.xml
index 157d3fe2fcdda7b51f51a648957e90d7e5477174..5a266fdc0eea075bcb5fda648c917c8d04bf8b9f 100644
--- a/doc/platform-notes.xml
+++ b/doc/stdenv/platform-notes.xml
@@ -1,6 +1,6 @@
+ xml:id="chap-platform-notes">
Platform NotesDarwin (macOS)
@@ -12,12 +12,7 @@
- The Darwin stdenv uses clang instead of gcc. When
- referring to the compiler $CC or cc
- will work in both cases. Some builds hardcode gcc/g++ in their build
- scripts, that can usually be fixed with using something like
- makeFlags = [ "CC=cc" ]; or by patching the build
- scripts.
+ The Darwin stdenv uses clang instead of gcc. When referring to the compiler $CC or cc will work in both cases. Some builds hardcode gcc/g++ in their build scripts, that can usually be fixed with using something like makeFlags = [ "CC=cc" ]; or by patching the build scripts.
stdenv.mkDerivation {
@@ -31,12 +26,7 @@ stdenv.mkDerivation {
- On Darwin, libraries are linked using absolute paths, libraries are
- resolved by their install_name at link time. Sometimes
- packages won't set this correctly causing the library lookups to fail at
- runtime. This can be fixed by adding extra linker flags or by running
- install_name_tool -id during the
- fixupPhase.
+ On Darwin, libraries are linked using absolute paths, libraries are resolved by their install_name at link time. Sometimes packages won't set this correctly causing the library lookups to fail at runtime. This can be fixed by adding extra linker flags or by running install_name_tool -id during the fixupPhase.
stdenv.mkDerivation {
@@ -48,16 +38,10 @@ stdenv.mkDerivation {
- Even if the libraries are linked using absolute paths and resolved via
- their install_name correctly, tests can sometimes fail
- to run binaries. This happens because the checkPhase
- runs before the libraries are installed.
+ Even if the libraries are linked using absolute paths and resolved via their install_name correctly, tests can sometimes fail to run binaries. This happens because the checkPhase runs before the libraries are installed.
- This can usually be solved by running the tests after the
- installPhase or alternatively by using
- DYLD_LIBRARY_PATH. More information about this variable
- can be found in the
+ This can usually be solved by running the tests after the installPhase or alternatively by using DYLD_LIBRARY_PATH. More information about this variable can be found in the dyld1 manpage.
@@ -78,11 +62,7 @@ stdenv.mkDerivation {
- Some packages assume xcode is available and use xcrun
- to resolve build tools like clang, etc. This causes
- errors like xcode-select: error: no developer tools were found at
- '/Applications/Xcode.app' while the build doesn't actually depend
- on xcode.
+ Some packages assume xcode is available and use xcrun to resolve build tools like clang, etc. This causes errors like xcode-select: error: no developer tools were found at '/Applications/Xcode.app' while the build doesn't actually depend on xcode.
stdenv.mkDerivation {
@@ -95,9 +75,7 @@ stdenv.mkDerivation {
}
- The package xcbuild can be used to build projects that
- really depend on Xcode. However, this replacement is not 100% compatible
- with Xcode and can occasionally cause issues.
+ The package xcbuild can be used to build projects that really depend on Xcode. However, this replacement is not 100% compatible with Xcode and can occasionally cause issues.
diff --git a/doc/stdenv/stdenv.xml b/doc/stdenv/stdenv.xml
new file mode 100644
index 0000000000000000000000000000000000000000..1e97bf6157bb33291d327602273d500d2d595cc7
--- /dev/null
+++ b/doc/stdenv/stdenv.xml
@@ -0,0 +1,2385 @@
+
+ The Standard Environment
+
+ The standard build environment in the Nix Packages collection provides an environment for building Unix packages that does a lot of common build tasks automatically. In fact, for Unix packages that use the standard ./configure; make; make install build interface, you don’t need to write a build script at all; the standard environment does everything automatically. If stdenv doesn’t do what you need automatically, you can easily customise or override the various build phases.
+
+
+ Using stdenv
+
+
+ To build a package with the standard environment, you use the function stdenv.mkDerivation, instead of the primitive built-in function derivation, e.g.
+
+stdenv.mkDerivation {
+ name = "libfoo-1.2.3";
+ src = fetchurl {
+ url = http://example.org/libfoo-1.2.3.tar.bz2;
+ sha256 = "0x2g1jqygyr5wiwg4ma1nd7w4ydpy82z9gkcv8vh2v8dn3y58v5m";
+ };
+}
+ (stdenv needs to be in scope, so if you write this in a separate Nix expression from pkgs/all-packages.nix, you need to pass it as a function argument.) Specifying a name and a src is the absolute minimum Nix requires. For convenience, you can also use pname and version attributes and mkDerivation will automatically set name to "${pname}-${version}" by default. Since RFC 0035, this is preferred for packages in Nixpkgs, as it allows us to reuse the version easily:
+
+stdenv.mkDerivation rec {
+ pname = "libfoo";
+ version = "1.2.3";
+ src = fetchurl {
+ url = "http://example.org/libfoo-source-${version}.tar.bz2";
+ sha256 = "0x2g1jqygyr5wiwg4ma1nd7w4ydpy82z9gkcv8vh2v8dn3y58v5m";
+ };
+}
+
+
+
+ Many packages have dependencies that are not provided in the standard environment. It’s usually sufficient to specify those dependencies in the buildInputs attribute:
+
+stdenv.mkDerivation {
+ name = "libfoo-1.2.3";
+ ...
+ buildInputs = [libbar perl ncurses];
+}
+ This attribute ensures that the bin subdirectories of these packages appear in the PATH environment variable during the build, that their include subdirectories are searched by the C compiler, and so on. (See for details.)
+
+
+
+ Often it is necessary to override or modify some aspect of the build. To make this easier, the standard environment breaks the package build into a number of phases, all of which can be overridden or modified individually: unpacking the sources, applying patches, configuring, building, and installing. (There are some others; see .) For instance, a package that doesn’t supply a makefile but instead has to be compiled “manually” could be handled like this:
+
+stdenv.mkDerivation {
+ name = "fnord-4.5";
+ ...
+ buildPhase = ''
+ gcc foo.c -o foo
+ '';
+ installPhase = ''
+ mkdir -p $out/bin
+ cp foo $out/bin
+ '';
+}
+ (Note the use of ''-style string literals, which are very convenient for large multi-line script fragments because they don’t need escaping of " and \, and because indentation is intelligently removed.)
+
+
+
+ There are many other attributes to customise the build. These are listed in .
+
+
+
+ While the standard environment provides a generic builder, you can still supply your own build script:
+
+stdenv.mkDerivation {
+ name = "libfoo-1.2.3";
+ ...
+ builder = ./builder.sh;
+}
+ where the builder can do anything it wants, but typically starts with
+
+source $stdenv/setup
+
+ to let stdenv set up the environment (e.g., process the buildInputs). If you want, you can still use stdenv’s generic builder:
+
+source $stdenv/setup
+
+buildPhase() {
+ echo "... this is my custom build phase ..."
+ gcc foo.c -o foo
+}
+
+installPhase() {
+ mkdir -p $out/bin
+ cp foo $out/bin
+}
+
+genericBuild
+
+
+
+
+ Tools provided by stdenv
+
+
+ The standard environment provides the following packages:
+
+
+
+ The GNU C Compiler, configured with C and C++ support.
+
+
+
+
+ GNU coreutils (contains a few dozen standard Unix commands).
+
+
+
+
+ GNU findutils (contains find).
+
+
+
+
+ GNU diffutils (contains diff, cmp).
+
+
+
+
+ GNU sed.
+
+
+
+
+ GNU grep.
+
+
+
+
+ GNU awk.
+
+
+
+
+ GNU tar.
+
+
+
+
+ gzip, bzip2 and xz.
+
+
+
+
+ GNU Make. It has been patched to provide nested output that can be fed into the nix-log2xml command and log2html stylesheet to create a structured, readable output of the build steps performed by Make.
+
+
+
+
+ Bash. This is the shell used for all builders in the Nix Packages collection. Not using /bin/sh removes a large source of portability problems.
+
+
+
+
+ The patch command.
+
+
+
+
+
+
+ On Linux, stdenv also includes the patchelf utility.
+
+
+
+ Specifying dependencies
+
+
+ As described in the Nix manual, almost any *.drv store path in a derivation's attribute set will induce a dependency on that derivation. mkDerivation, however, takes a few attributes intended to, between them, include all the dependencies of a package. This is done both for structure and consistency, but also so that certain other setup can take place. For example, certain dependencies need their bin directories added to the PATH. That is built-in, but other setup is done via a pluggable mechanism that works in conjunction with these dependency attributes. See for details.
+
+
+
+ Dependencies can be broken down along three axes: their host and target platforms relative to the new derivation's, and whether they are propagated. The platform distinctions are motivated by cross compilation; see for exactly what each platform means.
+
+
+ The build platform is ignored because it is a mere implementation detail of the package satisfying the dependency: As a general programming principle, dependencies are always specified as interfaces, not concrete implementation.
+
+
+ But even if one is not cross compiling, the platforms imply whether or not the dependency is needed at run-time or build-time, a concept that makes perfect sense outside of cross compilation. By default, the run-time/build-time distinction is just a hint for mental clarity, but with strictDeps set it is mostly enforced even in the native case.
+
+
+
+ The extension of PATH with dependencies, alluded to above, proceeds according to the relative platforms alone. The process is carried out only for dependencies whose host platform matches the new derivation's build platform i.e. dependencies which run on the platform where the new derivation will be built.
+
+
+ Currently, this means for native builds all dependencies are put on the PATH. But in the future that may not be the case for sake of matching cross: the platforms would be assumed to be unique for native and cross builds alike, so only the depsBuild* and nativeBuildInputs would be added to the PATH.
+
+
+ For each dependency dep of those dependencies, dep/bin, if present, is added to the PATH environment variable.
+
+
+
+ The dependency is propagated when it forces some of its other-transitive (non-immediate) downstream dependencies to also take it on as an immediate dependency. Nix itself already takes a package's transitive dependencies into account, but this propagation ensures nixpkgs-specific infrastructure like setup hooks (mentioned above) also are run as if the propagated dependency.
+
+
+
+ It is important to note that dependencies are not necessarily propagated as the same sort of dependency that they were before, but rather as the corresponding sort so that the platform rules still line up. The exact rules for dependency propagation can be given by assigning to each dependency two integers based one how its host and target platforms are offset from the depending derivation's platforms. Those offsets are given below in the descriptions of each dependency list attribute. Algorithmically, we traverse propagated inputs, accumulating every propagated dependency's propagated dependencies and adjusting them to account for the "shift in perspective" described by the current dependency's platform offsets. This results in sort a transitive closure of the dependency relation, with the offsets being approximately summed when two dependency links are combined. We also prune transitive dependencies whose combined offsets go out-of-bounds, which can be viewed as a filter over that transitive closure removing dependencies that are blatantly absurd.
+
+
+
+ We can define the process precisely with Natural Deduction using the inference rules. This probably seems a bit obtuse, but so is the bash code that actually implements it!
+
+
+ The findInputs function, currently residing in pkgs/stdenv/generic/setup.sh, implements the propagation logic.
+
+
+ They're confusing in very different ways so... hopefully if something doesn't make sense in one presentation, it will in the other!
+
+let mapOffset(h, t, i) = i + (if i <= 0 then h else t - 1)
+
+propagated-dep(h0, t0, A, B)
+propagated-dep(h1, t1, B, C)
+h0 + h1 in {-1, 0, 1}
+h0 + t1 in {-1, 0, 1}
+-------------------------------------- Transitive property
+propagated-dep(mapOffset(h0, t0, h1),
+ mapOffset(h0, t0, t1),
+ A, C)
+
+let mapOffset(h, t, i) = i + (if i <= 0 then h else t - 1)
+
+dep(h0, _, A, B)
+propagated-dep(h1, t1, B, C)
+h0 + h1 in {-1, 0, 1}
+h0 + t1 in {-1, 0, -1}
+----------------------------- Take immediate dependencies' propagated dependencies
+propagated-dep(mapOffset(h0, t0, h1),
+ mapOffset(h0, t0, t1),
+ A, C)
+
+propagated-dep(h, t, A, B)
+----------------------------- Propagated dependencies count as dependencies
+dep(h, t, A, B)
+ Some explanation of this monstrosity is in order. In the common case, the target offset of a dependency is the successor to the target offset: t = h + 1. That means that:
+
+let f(h, t, i) = i + (if i <= 0 then h else t - 1)
+let f(h, h + 1, i) = i + (if i <= 0 then h else (h + 1) - 1)
+let f(h, h + 1, i) = i + (if i <= 0 then h else h)
+let f(h, h + 1, i) = i + h
+
+ This is where "sum-like" comes in from above: We can just sum all of the host offsets to get the host offset of the transitive dependency. The target offset is the transitive dependency is simply the host offset + 1, just as it was with the dependencies composed to make this transitive one; it can be ignored as it doesn't add any new information.
+
+
+
+ Because of the bounds checks, the uncommon cases are h = t and h + 2 = t. In the former case, the motivation for mapOffset is that since its host and target platforms are the same, no transitive dependency of it should be able to "discover" an offset greater than its reduced target offsets. mapOffset effectively "squashes" all its transitive dependencies' offsets so that none will ever be greater than the target offset of the original h = t package. In the other case, h + 1 is skipped over between the host and target offsets. Instead of squashing the offsets, we need to "rip" them apart so no transitive dependencies' offset is that one.
+
+
+
+ Overall, the unifying theme here is that propagation shouldn't be introducing transitive dependencies involving platforms the depending package is unaware of. [One can imagine the dependending package asking for dependencies with the platforms it knows about; other platforms it doesn't know how to ask for. The platform description in that scenario is a kind of unforagable capability.] The offset bounds checking and definition of mapOffset together ensure that this is the case. Discovering a new offset is discovering a new platform, and since those platforms weren't in the derivation "spec" of the needing package, they cannot be relevant. From a capability perspective, we can imagine that the host and target platforms of a package are the capabilities a package requires, and the depending package must provide the capability to the dependency.
+
+
+
+ Variables specifying dependencies
+
+
+ depsBuildBuild
+
+
+
+ A list of dependencies whose host and target platforms are the new derivation's build platform. This means a -1 host and -1 target offset from the new derivation's platforms. These are programs and libraries used at build time that produce programs and libraries also used at build time. If the dependency doesn't care about the target platform (i.e. isn't a compiler or similar tool), put it in nativeBuildInputs instead. The most common use of this buildPackages.stdenv.cc, the default C compiler for this role. That example crops up more than one might think in old commonly used C libraries.
+
+
+ Since these packages are able to be run at build-time, they are always added to the PATH, as described above. But since these packages are only guaranteed to be able to run then, they shouldn't persist as run-time dependencies. This isn't currently enforced, but could be in the future.
+
+
+
+
+
+ nativeBuildInputs
+
+
+
+ A list of dependencies whose host platform is the new derivation's build platform, and target platform is the new derivation's host platform. This means a -1 host offset and 0 target offset from the new derivation's platforms. These are programs and libraries used at build-time that, if they are a compiler or similar tool, produce code to run at run-time—i.e. tools used to build the new derivation. If the dependency doesn't care about the target platform (i.e. isn't a compiler or similar tool), put it here, rather than in depsBuildBuild or depsBuildTarget. This could be called depsBuildHost but nativeBuildInputs is used for historical continuity.
+
+
+ Since these packages are able to be run at build-time, they are added to the PATH, as described above. But since these packages are only guaranteed to be able to run then, they shouldn't persist as run-time dependencies. This isn't currently enforced, but could be in the future.
+
+
+
+
+
+ depsBuildTarget
+
+
+
+ A list of dependencies whose host platform is the new derivation's build platform, and target platform is the new derivation's target platform. This means a -1 host offset and 1 target offset from the new derivation's platforms. These are programs used at build time that produce code to run with code produced by the depending package. Most commonly, these are tools used to build the runtime or standard library that the currently-being-built compiler will inject into any code it compiles. In many cases, the currently-being-built-compiler is itself employed for that task, but when that compiler won't run (i.e. its build and host platform differ) this is not possible. Other times, the compiler relies on some other tool, like binutils, that is always built separately so that the dependency is unconditional.
+
+
+ This is a somewhat confusing concept to wrap one’s head around, and for good reason. As the only dependency type where the platform offsets are not adjacent integers, it requires thinking of a bootstrapping stage two away from the current one. It and its use-case go hand in hand and are both considered poor form: try to not need this sort of dependency, and try to avoid building standard libraries and runtimes in the same derivation as the compiler produces code using them. Instead strive to build those like a normal library, using the newly-built compiler just as a normal library would. In short, do not use this attribute unless you are packaging a compiler and are sure it is needed.
+
+
+ Since these packages are able to run at build time, they are added to the PATH, as described above. But since these packages are only guaranteed to be able to run then, they shouldn't persist as run-time dependencies. This isn't currently enforced, but could be in the future.
+
+
+
+
+
+ depsHostHost
+
+
+
+ A list of dependencies whose host and target platforms match the new derivation's host platform. This means a 0 host offset and 0 target offset from the new derivation's host platform. These are packages used at run-time to generate code also used at run-time. In practice, this would usually be tools used by compilers for macros or a metaprogramming system, or libraries used by the macros or metaprogramming code itself. It's always preferable to use a depsBuildBuild dependency in the derivation being built over a depsHostHost on the tool doing the building for this purpose.
+
+
+
+
+
+ buildInputs
+
+
+
+ A list of dependencies whose host platform and target platform match the new derivation's. This means a 0 host offset and a 1 target offset from the new derivation's host platform. This would be called depsHostTarget but for historical continuity. If the dependency doesn't care about the target platform (i.e. isn't a compiler or similar tool), put it here, rather than in depsBuildBuild.
+
+
+ These are often programs and libraries used by the new derivation at run-time, but that isn't always the case. For example, the machine code in a statically-linked library is only used at run-time, but the derivation containing the library is only needed at build-time. Even in the dynamic case, the library may also be needed at build-time to appease the linker.
+
+
+
+
+
+ depsTargetTarget
+
+
+
+ A list of dependencies whose host platform matches the new derivation's target platform. This means a 1 offset from the new derivation's platforms. These are packages that run on the target platform, e.g. the standard library or run-time deps of standard library that a compiler insists on knowing about. It's poor form in almost all cases for a package to depend on another from a future stage [future stage corresponding to positive offset]. Do not use this attribute unless you are packaging a compiler and are sure it is needed.
+
+
+
+
+
+ depsBuildBuildPropagated
+
+
+
+ The propagated equivalent of depsBuildBuild. This perhaps never ought to be used, but it is included for consistency [see below for the others].
+
+
+
+
+
+ propagatedNativeBuildInputs
+
+
+
+ The propagated equivalent of nativeBuildInputs. This would be called depsBuildHostPropagated but for historical continuity. For example, if package Y has propagatedNativeBuildInputs = [X], and package Z has buildInputs = [Y], then package Z will be built as if it included package X in its nativeBuildInputs. If instead, package Z has nativeBuildInputs = [Y], then Z will be built as if it included X in the depsBuildBuild of package Z, because of the sum of the two -1 host offsets.
+
+
+
+
+
+ depsBuildTargetPropagated
+
+
+
+ The propagated equivalent of depsBuildTarget. This is prefixed for the same reason of alerting potential users.
+
+
+
+
+
+ depsHostHostPropagated
+
+
+
+ The propagated equivalent of depsHostHost.
+
+
+
+
+
+ propagatedBuildInputs
+
+
+
+ The propagated equivalent of buildInputs. This would be called depsHostTargetPropagated but for historical continuity.
+
+
+
+
+
+ depsTargetTargetPropagated
+
+
+
+ The propagated equivalent of depsTargetTarget. This is prefixed for the same reason of alerting potential users.
+
+
+
+
+
+
+ Attributes
+
+
+ Variables affecting stdenv initialisation
+
+
+ NIX_DEBUG
+
+
+
+ A natural number indicating how much information to log. If set to 1 or higher, stdenv will print moderate debugging information during the build. In particular, the gcc and ld wrapper scripts will print out the complete command line passed to the wrapped tools. If set to 6 or higher, the stdenv setup script will be run with set -x tracing. If set to 7 or higher, the gcc and ld wrapper scripts will also be run with set -x tracing.
+
+
+
+
+
+
+ Attributes affecting build properties
+
+
+ enableParallelBuilding
+
+
+
+ If set to true, stdenv will pass specific flags to make and other build tools to enable parallel building with up to build-cores workers.
+
+
+ Unless set to false, some build systems with good support for parallel building including cmake, meson, and qmake will set it to true.
+
+
+
+
+
+
+ Special variables
+
+
+ passthru
+
+
+
+ This is an attribute set which can be filled with arbitrary values. For example:
+
+passthru = {
+ foo = "bar";
+ baz = {
+ value1 = 4;
+ value2 = 5;
+ };
+}
+
+
+
+ Values inside it are not passed to the builder, so you can change them without triggering a rebuild. However, they can be accessed outside of a derivation directly, as if they were set inside a derivation itself, e.g. hello.baz.value1. We don't specify any usage or schema of passthru - it is meant for values that would be useful outside the derivation in other parts of a Nix expression (e.g. in other derivations). An example would be to convey some specific dependency of your derivation which contains a program with plugins support. Later, others who make derivations with plugins can use passed-through dependency to ensure that their plugin would be binary-compatible with built program.
+
+
+
+
+
+ passthru.updateScript
+
+
+
+ A script to be run by maintainers/scripts/update.nix when the package is matched. It needs to be an executable file, either on the file system:
+
+passthru.updateScript = ./update.sh;
+
+ or inside the expression itself:
+
+passthru.updateScript = writeScript "update-zoom-us" ''
+ #!/usr/bin/env nix-shell
+ #!nix-shell -i bash -p curl pcre common-updater-scripts
+
+ set -eu -o pipefail
+
+ version="$(curl -sI https://zoom.us/client/latest/zoom_x86_64.tar.xz | grep -Fi 'Location:' | pcregrep -o1 '/(([0-9]\.?)+)/')"
+ update-source-version zoom-us "$version"
+'';
+
+ The attribute can also contain a list, a script followed by arguments to be passed to it:
+
+passthru.updateScript = [ ../../update.sh pname "--requested-release=unstable" ];
+
+
+
+ The script will be usually run from the root of the Nixpkgs repository but you should not rely on that. Also note that the update scripts will be run in parallel by default; you should avoid running git commit or any other commands that cannot handle that.
+
+
+ For information about how to run the updates, execute nix-shell maintainers/scripts/update.nix.
+
+
+
+
+
+
+ Phases
+
+
+ The generic builder has a number of phases. Package builds are split into phases to make it easier to override specific parts of the build (e.g., unpacking the sources or installing the binaries). Furthermore, it allows a nicer presentation of build logs in the Nix build farm.
+
+
+
+ Each phase can be overridden in its entirety either by setting the environment variable namePhase to a string containing some shell commands to be executed, or by redefining the shell function namePhase. The former is convenient to override a phase from the derivation, while the latter is convenient from a build script. However, typically one only wants to add some commands to a phase, e.g. by defining postInstall or preFixup, as skipping some of the default actions may have unexpected consequences. The default script for each phase is defined in the file pkgs/stdenv/generic/setup.sh.
+
+
+
+ Controlling phases
+
+
+ There are a number of variables that control what phases are executed and in what order:
+
+ Variables affecting phase control
+
+
+ phases
+
+
+
+ Specifies the phases. You can change the order in which phases are executed, or add new phases, by setting this variable. If it’s not set, the default value is used, which is $prePhases unpackPhase patchPhase $preConfigurePhases configurePhase $preBuildPhases buildPhase checkPhase $preInstallPhases installPhase fixupPhase installCheckPhase $preDistPhases distPhase $postPhases.
+
+
+ Usually, if you just want to add a few phases, it’s more convenient to set one of the variables below (such as preInstallPhases), as you then don’t specify all the normal phases.
+
+
+
+
+
+ prePhases
+
+
+
+ Additional phases executed before any of the default phases.
+
+
+
+
+
+ preConfigurePhases
+
+
+
+ Additional phases executed just before the configure phase.
+
+
+
+
+
+ preBuildPhases
+
+
+
+ Additional phases executed just before the build phase.
+
+
+
+
+
+ preInstallPhases
+
+
+
+ Additional phases executed just before the install phase.
+
+
+
+
+
+ preFixupPhases
+
+
+
+ Additional phases executed just before the fixup phase.
+
+
+
+
+
+ preDistPhases
+
+
+
+ Additional phases executed just before the distribution phase.
+
+
+
+
+
+ postPhases
+
+
+
+ Additional phases executed after any of the default phases.
+
+
+
+
+
+
+
+
+ The unpack phase
+
+
+ The unpack phase is responsible for unpacking the source code of the package. The default implementation of unpackPhase unpacks the source files listed in the src environment variable to the current directory. It supports the following files by default:
+
+
+
+ Tar files
+
+
+
+ These can optionally be compressed using gzip (.tar.gz, .tgz or .tar.Z), bzip2 (.tar.bz2, .tbz2 or .tbz) or xz (.tar.xz, .tar.lzma or .txz).
+
+
+
+
+
+ Zip files
+
+
+
+ Zip files are unpacked using unzip. However, unzip is not in the standard environment, so you should add it to nativeBuildInputs yourself.
+
+
+
+
+
+ Directories in the Nix store
+
+
+
+ These are simply copied to the current directory. The hash part of the file name is stripped, e.g. /nix/store/1wydxgby13cz...-my-sources would be copied to my-sources.
+
+
+
+
+ Additional file types can be supported by setting the unpackCmd variable (see below).
+
+
+
+
+
+ Variables controlling the unpack phase
+
+
+ srcs / src
+
+
+
+ The list of source files or directories to be unpacked or copied. One of these must be set.
+
+
+
+
+
+ sourceRoot
+
+
+
+ After running unpackPhase, the generic builder changes the current directory to the directory created by unpacking the sources. If there are multiple source directories, you should set sourceRoot to the name of the intended directory.
+
+
+
+
+
+ setSourceRoot
+
+
+
+ Alternatively to setting sourceRoot, you can set setSourceRoot to a shell command to be evaluated by the unpack phase after the sources have been unpacked. This command must set sourceRoot.
+
+
+
+
+
+ preUnpack
+
+
+
+ Hook executed at the start of the unpack phase.
+
+
+
+
+
+ postUnpack
+
+
+
+ Hook executed at the end of the unpack phase.
+
+
+
+
+
+ dontUnpack
+
+
+
+ Set to true to skip the unpack phase.
+
+
+
+
+
+ dontMakeSourcesWritable
+
+
+
+ If set to 1, the unpacked sources are not made writable. By default, they are made writable to prevent problems with read-only sources. For example, copied store directories would be read-only without this.
+
+
+
+
+
+ unpackCmd
+
+
+
+ The unpack phase evaluates the string $unpackCmd for any unrecognised file. The path to the current source file is contained in the curSrc variable.
+
+
+
+
+
+
+
+ The patch phase
+
+
+ The patch phase applies the list of patches defined in the patches variable.
+
+
+
+ Variables controlling the patch phase
+
+
+ patches
+
+
+
+ The list of patches. They must be in the format accepted by the patch command, and may optionally be compressed using gzip (.gz), bzip2 (.bz2) or xz (.xz).
+
+
+
+
+
+ patchFlags
+
+
+
+ Flags to be passed to patch. If not set, the argument is used, which causes the leading directory component to be stripped from the file names in each patch.
+
+
+
+
+
+ prePatch
+
+
+
+ Hook executed at the start of the patch phase.
+
+
+
+
+
+ postPatch
+
+
+
+ Hook executed at the end of the patch phase.
+
+
+
+
+
+
+
+ The configure phase
+
+
+ The configure phase prepares the source tree for building. The default configurePhase runs ./configure (typically an Autoconf-generated script) if it exists.
+
+
+
+ Variables controlling the configure phase
+
+
+ configureScript
+
+
+
+ The name of the configure script. It defaults to ./configure if it exists; otherwise, the configure phase is skipped. This can actually be a command (like perl ./Configure.pl).
+
+
+
+
+
+ configureFlags
+
+
+
+ A list of strings passed as additional arguments to the configure script.
+
+
+
+
+
+ dontConfigure
+
+
+
+ Set to true to skip the configure phase.
+
+
+
+
+
+ configureFlagsArray
+
+
+
+ A shell array containing additional arguments passed to the configure script. You must use this instead of configureFlags if the arguments contain spaces.
+
+
+
+
+
+ dontAddPrefix
+
+
+
+ By default, the flag --prefix=$prefix is added to the configure flags. If this is undesirable, set this variable to true.
+
+
+
+
+
+ prefix
+
+
+
+ The prefix under which the package must be installed, passed via the option to the configure script. It defaults to .
+
+
+
+
+
+ prefixKey
+
+
+
+ The key to use when specifying the prefix. By default, this is set to as that is used by the majority of packages.
+
+
+
+
+
+ dontAddDisableDepTrack
+
+
+
+ By default, the flag --disable-dependency-tracking is added to the configure flags to speed up Automake-based builds. If this is undesirable, set this variable to true.
+
+
+
+
+
+ dontFixLibtool
+
+
+
+ By default, the configure phase applies some special hackery to all files called ltmain.sh before running the configure script in order to improve the purity of Libtool-based packages
+
+
+ It clears the sys_lib_*search_path variables in the Libtool script to prevent Libtool from using libraries in /usr/lib and such.
+
+
+ . If this is undesirable, set this variable to true.
+
+
+
+
+
+ dontDisableStatic
+
+
+
+ By default, when the configure script has , the option is added to the configure flags.
+
+
+ If this is undesirable, set this variable to true.
+
+
+
+
+
+ configurePlatforms
+
+
+
+ By default, when cross compiling, the configure script has and passed. Packages can instead pass [ "build" "host" "target" ] or a subset to control exactly which platform flags are passed. Compilers and other tools can use this to also pass the target platform.
+
+
+ Eventually these will be passed building natively as well, to improve determinism: build-time guessing, as is done today, is a risk of impurity.
+
+
+
+
+
+
+
+ preConfigure
+
+
+
+ Hook executed at the start of the configure phase.
+
+
+
+
+
+ postConfigure
+
+
+
+ Hook executed at the end of the configure phase.
+
+
+
+
+
+
+
+ The build phase
+
+
+ The build phase is responsible for actually building the package (e.g. compiling it). The default buildPhase simply calls make if a file named Makefile, makefile or GNUmakefile exists in the current directory (or the makefile is explicitly set); otherwise it does nothing.
+
+
+
+ Variables controlling the build phase
+
+
+ dontBuild
+
+
+
+ Set to true to skip the build phase.
+
+
+
+
+
+ makefile
+
+
+
+ The file name of the Makefile.
+
+
+
+
+
+ makeFlags
+
+
+
+ A list of strings passed as additional flags to make. These flags are also used by the default install and check phase. For setting make flags specific to the build phase, use buildFlags (see below).
+
+makeFlags = [ "PREFIX=$(out)" ];
+
+
+
+ The flags are quoted in bash, but environment variables can be specified by using the make syntax.
+
+
+
+
+
+
+
+ makeFlagsArray
+
+
+
+ A shell array containing additional arguments passed to make. You must use this instead of makeFlags if the arguments contain spaces, e.g.
+
+preBuild = ''
+ makeFlagsArray+=(CFLAGS="-O0 -g" LDFLAGS="-lfoo -lbar")
+'';
+
+ Note that shell arrays cannot be passed through environment variables, so you cannot set makeFlagsArray in a derivation attribute (because those are passed through environment variables): you have to define them in shell code.
+
+
+
+
+
+ buildFlags / buildFlagsArray
+
+
+
+ A list of strings passed as additional flags to make. Like makeFlags and makeFlagsArray, but only used by the build phase.
+
+
+
+
+
+ preBuild
+
+
+
+ Hook executed at the start of the build phase.
+
+
+
+
+
+ postBuild
+
+
+
+ Hook executed at the end of the build phase.
+
+
+
+
+
+
+ You can set flags for make through the makeFlags variable.
+
+
+
+ Before and after running make, the hooks preBuild and postBuild are called, respectively.
+
+
+
+
+ The check phase
+
+
+ The check phase checks whether the package was built correctly by running its test suite. The default checkPhase calls make check, but only if the doCheck variable is enabled.
+
+
+
+ Variables controlling the check phase
+
+
+ doCheck
+
+
+
+ Controls whether the check phase is executed. By default it is skipped, but if doCheck is set to true, the check phase is usually executed. Thus you should set
+doCheck = true;
+ in the derivation to enable checks. The exception is cross compilation. Cross compiled builds never run tests, no matter how doCheck is set, as the newly-built program won't run on the platform used to build it.
+
+
+
+
+
+ makeFlags / makeFlagsArray / makefile
+
+
+
+ See the build phase for details.
+
+
+
+
+
+ checkTarget
+
+
+
+ The make target that runs the tests. Defaults to check.
+
+
+
+
+
+ checkFlags / checkFlagsArray
+
+
+
+ A list of strings passed as additional flags to make. Like makeFlags and makeFlagsArray, but only used by the check phase.
+
+
+
+
+
+ checkInputs
+
+
+
+ A list of dependencies used by the phase. This gets included in nativeBuildInputs when doCheck is set.
+
+
+
+
+
+ preCheck
+
+
+
+ Hook executed at the start of the check phase.
+
+
+
+
+
+ postCheck
+
+
+
+ Hook executed at the end of the check phase.
+
+
+
+
+
+
+
+ The install phase
+
+
+ The install phase is responsible for installing the package in the Nix store under out. The default installPhase creates the directory $out and calls make install.
+
+
+
+ Variables controlling the install phase
+
+
+ dontInstall
+
+
+
+ Set to true to skip the install phase.
+
+
+
+
+
+ makeFlags / makeFlagsArray / makefile
+
+
+
+ See the build phase for details.
+
+
+
+
+
+ installTargets
+
+
+
+ The make targets that perform the installation. Defaults to install. Example:
+
+installTargets = "install-bin install-doc";
+
+
+
+
+
+ installFlags / installFlagsArray
+
+
+
+ A list of strings passed as additional flags to make. Like makeFlags and makeFlagsArray, but only used by the install phase.
+
+
+
+
+
+ preInstall
+
+
+
+ Hook executed at the start of the install phase.
+
+
+
+
+
+ postInstall
+
+
+
+ Hook executed at the end of the install phase.
+
+
+
+
+
+
+
+ The fixup phase
+
+
+ The fixup phase performs some (Nix-specific) post-processing actions on the files installed under $out by the install phase. The default fixupPhase does the following:
+
+
+
+ It moves the man/, doc/ and info/ subdirectories of $out to share/.
+
+
+
+
+ It strips libraries and executables of debug information.
+
+
+
+
+ On Linux, it applies the patchelf command to ELF executables and libraries to remove unused directories from the RPATH in order to prevent unnecessary runtime dependencies.
+
+
+
+
+ It rewrites the interpreter paths of shell scripts to paths found in PATH. E.g., /usr/bin/perl will be rewritten to /nix/store/some-perl/bin/perl found in PATH.
+
+
+
+
+
+
+ Variables controlling the fixup phase
+
+
+ dontFixup
+
+
+
+ Set to true to skip the fixup phase.
+
+
+
+
+
+ dontStrip
+
+
+
+ If set, libraries and executables are not stripped. By default, they are.
+
+
+
+
+
+ dontStripHost
+
+
+
+ Like dontStrip, but only affects the strip command targetting the package's host platform. Useful when supporting cross compilation, but otherwise feel free to ignore.
+
+
+
+
+
+ dontStripTarget
+
+
+
+ Like dontStrip, but only affects the strip command targetting the packages' target platform. Useful when supporting cross compilation, but otherwise feel free to ignore.
+
+
+
+
+
+ dontMoveSbin
+
+
+
+ If set, files in $out/sbin are not moved to $out/bin. By default, they are.
+
+
+
+
+
+ stripAllList
+
+
+
+ List of directories to search for libraries and executables from which all symbols should be stripped. By default, it’s empty. Stripping all symbols is risky, since it may remove not just debug symbols but also ELF information necessary for normal execution.
+
+
+
+
+
+ stripAllFlags
+
+
+
+ Flags passed to the strip command applied to the files in the directories listed in stripAllList. Defaults to (i.e. ).
+
+
+
+
+
+ stripDebugList
+
+
+
+ List of directories to search for libraries and executables from which only debugging-related symbols should be stripped. It defaults to lib bin sbin.
+
+
+
+
+
+ stripDebugFlags
+
+
+
+ Flags passed to the strip command applied to the files in the directories listed in stripDebugList. Defaults to (i.e. ).
+
+
+
+
+
+ dontPatchELF
+
+
+
+ If set, the patchelf command is not used to remove unnecessary RPATH entries. Only applies to Linux.
+
+
+
+
+
+ dontPatchShebangs
+
+
+
+ If set, scripts starting with #! do not have their interpreter paths rewritten to paths in the Nix store.
+
+
+
+
+
+ dontPruneLibtoolFiles
+
+
+
+ If set, libtool .la files associated with shared libraries won't have their dependency_libs field cleared.
+
+
+
+
+
+ forceShare
+
+
+
+ The list of directories that must be moved from $out to $out/share. Defaults to man doc info.
+
+
+
+
+
+ setupHook
+
+
+
+ A package can export a setup hook by setting this variable. The setup hook, if defined, is copied to $out/nix-support/setup-hook. Environment variables are then substituted in it using substituteAll.
+
+
+
+
+
+ preFixup
+
+
+
+ Hook executed at the start of the fixup phase.
+
+
+
+
+
+ postFixup
+
+
+
+ Hook executed at the end of the fixup phase.
+
+
+
+
+
+ separateDebugInfo
+
+
+
+ If set to true, the standard environment will enable debug information in C/C++ builds. After installation, the debug information will be separated from the executables and stored in the output named debug. (This output is enabled automatically; you don’t need to set the outputs attribute explicitly.) To be precise, the debug information is stored in debug/lib/debug/.build-id/XX/YYYY…, where XXYYYY… is the build ID of the binary — a SHA-1 hash of the contents of the binary. Debuggers like GDB use the build ID to look up the separated debug information.
+
+
+ For example, with GDB, you can add
+
+set debug-file-directory ~/.nix-profile/lib/debug
+
+ to ~/.gdbinit. GDB will then be able to find debug information installed via nix-env -i.
+
+
+
+
+
+
+
+ The installCheck phase
+
+
+ The installCheck phase checks whether the package was installed correctly by running its test suite against the installed directories. The default installCheck calls make installcheck.
+
+
+
+ Variables controlling the installCheck phase
+
+
+ doInstallCheck
+
+
+
+ Controls whether the installCheck phase is executed. By default it is skipped, but if doInstallCheck is set to true, the installCheck phase is usually executed. Thus you should set
+doInstallCheck = true;
+ in the derivation to enable install checks. The exception is cross compilation. Cross compiled builds never run tests, no matter how doInstallCheck is set, as the newly-built program won't run on the platform used to build it.
+
+
+
+
+
+ installCheckTarget
+
+
+
+ The make target that runs the install tests. Defaults to installcheck.
+
+
+
+
+
+ installCheckFlags / installCheckFlagsArray
+
+
+
+ A list of strings passed as additional flags to make. Like makeFlags and makeFlagsArray, but only used by the installCheck phase.
+
+
+
+
+
+ installCheckInputs
+
+
+
+ A list of dependencies used by the phase. This gets included in nativeBuildInputs when doInstallCheck is set.
+
+
+
+
+
+ preInstallCheck
+
+
+
+ Hook executed at the start of the installCheck phase.
+
+
+
+
+
+ postInstallCheck
+
+
+
+ Hook executed at the end of the installCheck phase.
+
+
+
+
+
+
+
+ The distribution phase
+
+
+ The distribution phase is intended to produce a source distribution of the package. The default distPhase first calls make dist, then it copies the resulting source tarballs to $out/tarballs/. This phase is only executed if the attribute doDist is set.
+
+
+
+ Variables controlling the distribution phase
+
+
+ distTarget
+
+
+
+ The make target that produces the distribution. Defaults to dist.
+
+
+
+
+
+ distFlags / distFlagsArray
+
+
+
+ Additional flags passed to make.
+
+
+
+
+
+ tarballs
+
+
+
+ The names of the source distribution files to be copied to $out/tarballs/. It can contain shell wildcards. The default is *.tar.gz.
+
+
+
+
+
+ dontCopyDist
+
+
+
+ If set, no files are copied to $out/tarballs/.
+
+
+
+
+
+ preDist
+
+
+
+ Hook executed at the start of the distribution phase.
+
+
+
+
+
+ postDist
+
+
+
+ Hook executed at the end of the distribution phase.
+
+
+
+
+
+
+
+ Shell functions
+
+
+ The standard environment provides a number of useful functions.
+
+
+
+
+
+ makeWrapperexecutablewrapperfileargs
+
+
+
+ Constructs a wrapper for a program with various possible arguments. For example:
+
+# adds `FOOBAR=baz` to `$out/bin/foo`’s environment
+makeWrapper $out/bin/foo $wrapperfile --set FOOBAR baz
+
+# prefixes the binary paths of `hello` and `git`
+# Be advised that paths often should be patched in directly
+# (via string replacements or in `configurePhase`).
+makeWrapper $out/bin/foo $wrapperfile --prefix PATH : ${lib.makeBinPath [ hello git ]}
+
+ There’s many more kinds of arguments, they are documented in nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh.
+
+
+ wrapProgram is a convenience function you probably want to use most of the time.
+
+
+
+
+
+ substituteinfileoutfilesubs
+
+
+
+ Performs string substitution on the contents of infile, writing the result to outfile. The substitutions in subs are of the following form:
+
+
+
+ s1s2
+
+
+
+ Replace every occurrence of the string s1 by s2.
+
+
+
+
+
+ varName
+
+
+
+ Replace every occurrence of @varName@ by the contents of the environment variable varName. This is useful for generating files from templates, using @...@ in the template as placeholders.
+
+
+
+
+
+ varNames
+
+
+
+ Replace every occurrence of @varName@ by the string s.
+
+
+
+
+
+
+ Example:
+
+substitute ./foo.in ./foo.out \
+ --replace /usr/bin/bar $bar/bin/bar \
+ --replace "a string containing spaces" "some other text" \
+ --subst-var someVar
+
+
+
+ substitute is implemented using the replace command. Unlike with the sed command, you don’t have to worry about escaping special characters. It supports performing substitutions on binary files (such as executables), though there you’ll probably want to make sure that the replacement string is as long as the replaced string.
+
+
+
+
+
+ substituteInPlacefilesubs
+
+
+
+ Like substitute, but performs the substitutions in place on the file file.
+
+
+
+
+
+ substituteAllinfileoutfile
+
+
+
+ Replaces every occurrence of @varName@, where varName is any environment variable, in infile, writing the result to outfile. For instance, if infile has the contents
+
+#! @bash@/bin/sh
+PATH=@coreutils@/bin
+echo @foo@
+
+ and the environment contains bash=/nix/store/bmwp0q28cf21...-bash-3.2-p39 and coreutils=/nix/store/68afga4khv0w...-coreutils-6.12, but does not contain the variable foo, then the output will be
+
+#! /nix/store/bmwp0q28cf21...-bash-3.2-p39/bin/sh
+PATH=/nix/store/68afga4khv0w...-coreutils-6.12/bin
+echo @foo@
+
+ That is, no substitution is performed for undefined variables.
+
+
+ Environment variables that start with an uppercase letter or an underscore are filtered out, to prevent global variables (like HOME) or private variables (like __ETC_PROFILE_DONE) from accidentally getting substituted. The variables also have to be valid bash “names”, as defined in the bash manpage (alphanumeric or _, must not start with a number).
+
+
+
+
+
+ substituteAllInPlacefile
+
+
+
+ Like substituteAll, but performs the substitutions in place on the file file.
+
+
+
+
+
+ stripHashpath
+
+
+
+ Strips the directory and hash part of a store path, outputting the name part to stdout. For example:
+
+# prints coreutils-8.24
+stripHash "/nix/store/9s9r019176g7cvn2nvcw41gsp862y6b4-coreutils-8.24"
+
+ If you wish to store the result in another variable, then the following idiom may be useful:
+
+name="/nix/store/9s9r019176g7cvn2nvcw41gsp862y6b4-coreutils-8.24"
+someVar=$(stripHash $name)
+
+
+
+
+
+
+ wrapProgramexecutablemakeWrapperArgs
+
+
+
+ Convenience function for makeWrapper that automatically creates a sane wrapper file. It takes all the same arguments as makeWrapper, except for --argv0.
+
+
+ It cannot be applied multiple times, since it will overwrite the wrapper file.
+
+
+
+
+
+
+ Package setup hooks
+
+
+ Nix itself considers a build-time dependency as merely something that should previously be built and accessible at build time—packages themselves are on their own to perform any additional setup. In most cases, that is fine, and the downstream derivation can deal with its own dependencies. But for a few common tasks, that would result in almost every package doing the same sort of setup work—depending not on the package itself, but entirely on which dependencies were used.
+
+
+
+ In order to alleviate this burden, the setup hook mechanism was written, where any package can include a shell script that [by convention rather than enforcement by Nix], any downstream reverse-dependency will source as part of its build process. That allows the downstream dependency to merely specify its dependencies, and lets those dependencies effectively initialize themselves. No boilerplate mirroring the list of dependencies is needed.
+
+
+
+ The setup hook mechanism is a bit of a sledgehammer though: a powerful feature with a broad and indiscriminate area of effect. The combination of its power and implicit use may be expedient, but isn't without costs. Nix itself is unchanged, but the spirit of added dependencies being effect-free is violated even if the letter isn't. For example, if a derivation path is mentioned more than once, Nix itself doesn't care and simply makes sure the dependency derivation is already built just the same—depending is just needing something to exist, and needing is idempotent. However, a dependency specified twice will have its setup hook run twice, and that could easily change the build environment (though a well-written setup hook will therefore strive to be idempotent so this is in fact not observable). More broadly, setup hooks are anti-modular in that multiple dependencies, whether the same or different, should not interfere and yet their setup hooks may well do so.
+
+
+
+ The most typical use of the setup hook is actually to add other hooks which are then run (i.e. after all the setup hooks) on each dependency. For example, the C compiler wrapper's setup hook feeds itself flags for each dependency that contains relevant libraries and headers. This is done by defining a bash function, and appending its name to one of envBuildBuildHooks, envBuildHostHooks, envBuildTargetHooks, envHostHostHooks, envHostTargetHooks, or envTargetTargetHooks. These 6 bash variables correspond to the 6 sorts of dependencies by platform (there's 12 total but we ignore the propagated/non-propagated axis).
+
+
+
+ Packages adding a hook should not hard code a specific hook, but rather choose a variable relative to how they are included. Returning to the C compiler wrapper example, if the wrapper itself is an n dependency, then it only wants to accumulate flags from n + 1 dependencies, as only those ones match the compiler's target platform. The hostOffset variable is defined with the current dependency's host offset targetOffset with its target offset, before its setup hook is sourced. Additionally, since most environment hooks don't care about the target platform, that means the setup hook can append to the right bash array by doing something like
+
+addEnvHooks "$hostOffset" myBashFunction
+
+
+
+
+ The existence of setups hooks has long been documented and packages inside Nixpkgs are free to use this mechanism. Other packages, however, should not rely on these mechanisms not changing between Nixpkgs versions. Because of the existing issues with this system, there's little benefit from mandating it be stable for any period of time.
+
+
+
+ First, let’s cover some setup hooks that are part of Nixpkgs default stdenv. This means that they are run for every package built using stdenv.mkDerivation. Some of these are platform specific, so they may run on Linux but not Darwin or vice-versa.
+
+
+
+ move-docs.sh
+
+
+
+ This setup hook moves any installed documentation to the /share subdirectory directory. This includes the man, doc and info directories. This is needed for legacy programs that do not know how to use the share subdirectory.
+
+
+
+
+
+ compress-man-pages.sh
+
+
+
+ This setup hook compresses any man pages that have been installed. The compression is done using the gzip program. This helps to reduce the installed size of packages.
+
+
+
+
+
+ strip.sh
+
+
+
+ This runs the strip command on installed binaries and libraries. This removes unnecessary information like debug symbols when they are not needed. This also helps to reduce the installed size of packages.
+
+
+
+
+
+ patch-shebangs.sh
+
+
+
+ This setup hook patches installed scripts to use the full path to the shebang interpreter. A shebang interpreter is the first commented line of a script telling the operating system which program will run the script (e.g #!/bin/bash). In Nix, we want an exact path to that interpreter to be used. This often replaces /bin/sh with a path in the Nix store.
+
+
+
+
+
+ audit-tmpdir.sh
+
+
+
+ This verifies that no references are left from the install binaries to the directory used to build those binaries. This ensures that the binaries do not need things outside the Nix store. This is currently supported in Linux only.
+
+
+
+
+
+ multiple-outputs.sh
+
+
+
+ This setup hook adds configure flags that tell packages to install files into any one of the proper outputs listed in outputs. This behavior can be turned off by setting setOutputFlags to false in the derivation environment. See for more information.
+
+
+
+
+
+ move-sbin.sh
+
+
+
+ This setup hook moves any binaries installed in the sbin subdirectory into bin. In addition, a link is provided from sbin to bin for compatibility.
+
+
+
+
+
+ move-lib64.sh
+
+
+
+ This setup hook moves any libraries installed in the lib64 subdirectory into lib. In addition, a link is provided from lib64 to lib for compatibility.
+
+
+
+
+
+ set-source-date-epoch-to-latest.sh
+
+
+
+ This sets SOURCE_DATE_EPOCH to the modification time of the most recent file.
+
+
+
+
+
+ Bintools Wrapper
+
+
+
+ The Bintools Wrapper wraps the binary utilities for a bunch of miscellaneous purposes. These are GNU Binutils when targetting Linux, and a mix of cctools and GNU binutils for Darwin. [The "Bintools" name is supposed to be a compromise between "Binutils" and "cctools" not denoting any specific implementation.] Specifically, the underlying bintools package, and a C standard library (glibc or Darwin's libSystem, just for the dynamic loader) are all fed in, and dependency finding, hardening (see below), and purity checks for each are handled by the Bintools Wrapper. Packages typically depend on CC Wrapper, which in turn (at run time) depends on the Bintools Wrapper.
+
+
+ The Bintools Wrapper was only just recently split off from CC Wrapper, so the division of labor is still being worked out. For example, it shouldn't care about the C standard library, but just take a derivation with the dynamic loader (which happens to be the glibc on linux). Dependency finding however is a task both wrappers will continue to need to share, and probably the most important to understand. It is currently accomplished by collecting directories of host-platform dependencies (i.e. buildInputs and nativeBuildInputs) in environment variables. The Bintools Wrapper's setup hook causes any lib and lib64 subdirectories to be added to NIX_LDFLAGS. Since the CC Wrapper and the Bintools Wrapper use the same strategy, most of the Bintools Wrapper code is sparsely commented and refers to the CC Wrapper. But the CC Wrapper's code, by contrast, has quite lengthy comments. The Bintools Wrapper merely cites those, rather than repeating them, to avoid falling out of sync.
+
+
+ A final task of the setup hook is defining a number of standard environment variables to tell build systems which executables fulfill which purpose. They are defined to just be the base name of the tools, under the assumption that the Bintools Wrapper's binaries will be on the path. Firstly, this helps poorly-written packages, e.g. ones that look for just gcc when CC isn't defined yet clang is to be used. Secondly, this helps packages not get confused when cross-compiling, in which case multiple Bintools Wrappers may simultaneously be in use.
+
+
+ Each wrapper targets a single platform, so if binaries for multiple platforms are needed, the underlying binaries must be wrapped multiple times. As this is a property of the wrapper itself, the multiple wrappings are needed whether or not the same underlying binaries can target multiple platforms.
+
+
+ BUILD_- and TARGET_-prefixed versions of the normal environment variable are defined for additional Bintools Wrappers, properly disambiguating them.
+
+
+ A problem with this final task is that the Bintools Wrapper is honest and defines LD as ld. Most packages, however, firstly use the C compiler for linking, secondly use LD anyways, defining it as the C compiler, and thirdly, only so define LD when it is undefined as a fallback. This triple-threat means Bintools Wrapper will break those packages, as LD is already defined as the actual linker which the package won't override yet doesn't want to use. The workaround is to define, just for the problematic package, LD as the C compiler. A good way to do this would be preConfigure = "LD=$CC".
+
+
+
+
+
+ CC Wrapper
+
+
+
+ The CC Wrapper wraps a C toolchain for a bunch of miscellaneous purposes. Specifically, a C compiler (GCC or Clang), wrapped binary tools, and a C standard library (glibc or Darwin's libSystem, just for the dynamic loader) are all fed in, and dependency finding, hardening (see below), and purity checks for each are handled by the CC Wrapper. Packages typically depend on the CC Wrapper, which in turn (at run-time) depends on the Bintools Wrapper.
+
+
+ Dependency finding is undoubtedly the main task of the CC Wrapper. This works just like the Bintools Wrapper, except that any include subdirectory of any relevant dependency is added to NIX_CFLAGS_COMPILE. The setup hook itself contains some lengthy comments describing the exact convoluted mechanism by which this is accomplished.
+
+
+ Similarly, the CC Wrapper follows the Bintools Wrapper in defining standard environment variables with the names of the tools it wraps, for the same reasons described above. Importantly, while it includes a cc symlink to the c compiler for portability, the CC will be defined using the compiler's "real name" (i.e. gcc or clang). This helps lousy build systems that inspect on the name of the compiler rather than run it.
+
+
+
+
+
+
+
+ Here are some more packages that provide a setup hook. Since the list of hooks is extensible, this is not an exhaustive list. The mechanism is only to be used as a last resort, so it might cover most uses.
+
+
+
+ Perl
+
+
+
+ Adds the lib/site_perl subdirectory of each build input to the PERL5LIB environment variable. For instance, if buildInputs contains Perl, then the lib/site_perl subdirectory of each input is added to the PERL5LIB environment variable.
+
+
+
+
+
+ Python
+
+
+
+ Adds the lib/${python.libPrefix}/site-packages subdirectory of each build input to the PYTHONPATH environment variable.
+
+
+
+
+
+ pkg-config
+
+
+
+ Adds the lib/pkgconfig and share/pkgconfig subdirectories of each build input to the PKG_CONFIG_PATH environment variable.
+
+
+
+
+
+ Automake
+
+
+
+ Adds the share/aclocal subdirectory of each build input to the ACLOCAL_PATH environment variable.
+
+
+
+
+
+ Autoconf
+
+
+
+ The autoreconfHook derivation adds autoreconfPhase, which runs autoreconf, libtoolize and automake, essentially preparing the configure script in autotools-based builds. Most autotools-based packages come with the configure script pre-generated, but this hook is necessary for a few packages and when you need to patch the package’s configure scripts.
+
+
+
+
+
+ libxml2
+
+
+
+ Adds every file named catalog.xml found under the xml/dtd and xml/xsl subdirectories of each build input to the XML_CATALOG_FILES environment variable.
+
+
+
+
+
+ teTeX / TeX Live
+
+
+
+ Adds the share/texmf-nix subdirectory of each build input to the TEXINPUTS environment variable.
+
+
+
+
+
+ Qt 4
+
+
+
+ Sets the QTDIR environment variable to Qt’s path.
+
+
+
+
+
+ gdk-pixbuf
+
+
+
+ Exports GDK_PIXBUF_MODULE_FILE environment variable to the builder. Add librsvg package to buildInputs to get svg support.
+
+
+
+
+
+ GHC
+
+
+
+ Creates a temporary package database and registers every Haskell build input in it (TODO: how?).
+
+
+
+
+
+ GNOME platform
+
+
+
+ Hooks related to GNOME platform and related libraries like GLib, GTK and GStreamer are described in .
+
+
+
+
+
+ autoPatchelfHook
+
+
+
+ This is a special setup hook which helps in packaging proprietary software in that it automatically tries to find missing shared library dependencies of ELF files based on the given buildInputs and nativeBuildInputs.
+
+
+ You can also specify a runtimeDependencies environment variable which lists dependencies that are unconditionally added to all executables.
+
+
+ This is useful for programs that use
+ dlopen
+ 3 to load libraries at runtime.
+
+
+ In certain situations you may want to run the main command (autoPatchelf) of the setup hook on a file or a set of directories instead of unconditionally patching all outputs. This can be done by setting the dontAutoPatchelf environment variable to a non-empty value.
+
+
+ The autoPatchelf command also recognizes a --no-recurse command line flag, which prevents it from recursing into subdirectories.
+
+
+
+
+
+ breakpointHook
+
+
+
+ This hook will make a build pause instead of stopping when a failure happens. It prevents nix from cleaning up the build environment immediately and allows the user to attach to a build environment using the cntr command. Upon build error it will print instructions on how to use cntr, which can be used to enter the environment for debugging. Installing cntr and running the command will provide shell access to the build sandbox of failed build. At /var/lib/cntr the sandboxed filesystem is mounted. All commands and files of the system are still accessible within the shell. To execute commands from the sandbox use the cntr exec subcommand. cntr is only supported on Linux-based platforms. To use it first add cntr to your environment.systemPackages on NixOS or alternatively to the root user on non-NixOS systems. Then in the package that is supposed to be inspected, add breakpointHook to nativeBuildInputs.
+
+nativeBuildInputs = [ breakpointHook ];
+
+ When a build failure happens there will be an instruction printed that shows how to attach with cntr to the build sandbox.
+
+
+ Caution with remote builds
+
+ This won't work with remote builds as the build environment is on a different machine and can't be accessed by cntr. Remote builds can be turned off by setting --option builders '' for nix-build or --builders '' for nix build.
+
+
+
+
+
+
+ installShellFiles
+
+
+
+ This hook helps with installing manpages and shell completion files. It exposes 2 shell functions installManPage and installShellCompletion that can be used from your postInstall hook.
+
+
+ The installManPage function takes one or more paths to manpages to install. The manpages must have a section suffix, and may optionally be compressed (with .gz suffix). This function will place them into the correct directory.
+
+
+ The installShellCompletion function takes one or more paths to shell completion files. By default it will autodetect the shell type from the completion file extension, but you may also specify it by passing one of --bash, --fish, or --zsh. These flags apply to all paths listed after them (up until another shell flag is given). Each path may also have a custom installation name provided by providing a flag --name NAME before the path. If this flag is not provided, zsh completions will be renamed automatically such that foobar.zsh becomes _foobar.
+
+nativeBuildInputs = [ installShellFiles ];
+postInstall = ''
+ installManPage doc/foobar.1 doc/barfoo.3
+ # explicit behavior
+ installShellCompletion --bash --name foobar.bash share/completions.bash
+ installShellCompletion --fish --name foobar.fish share/completions.fish
+ installShellCompletion --zsh --name _foobar share/completions.zsh
+ # implicit behavior
+ installShellCompletion share/completions/foobar.{bash,fish,zsh}
+'';
+
+
+
+
+
+
+ libiconv, libintl
+
+
+
+ A few libraries automatically add to NIX_LDFLAGS their library, making their symbols automatically available to the linker. This includes libiconv and libintl (gettext). This is done to provide compatibility between GNU Linux, where libiconv and libintl are bundled in, and other systems where that might not be the case. Sometimes, this behavior is not desired. To disable this behavior, set dontAddExtraLibs.
+
+
+
+
+
+ cmake
+
+
+
+ Overrides the default configure phase to run the CMake command. By default, we use the Make generator of CMake. In addition, dependencies are added automatically to CMAKE_PREFIX_PATH so that packages are correctly detected by CMake. Some additional flags are passed in to give similar behavior to configure-based packages. You can disable this hook’s behavior by setting configurePhase to a custom value, or by setting dontUseCmakeConfigure. cmakeFlags controls flags passed only to CMake. By default, parallel building is enabled as CMake supports parallel building almost everywhere. When Ninja is also in use, CMake will detect that and use the ninja generator.
+
+
+
+
+
+ xcbuildHook
+
+
+
+ Overrides the build and install phases to run the “xcbuild” command. This hook is needed when a project only comes with build files for the XCode build system. You can disable this behavior by setting buildPhase and configurePhase to a custom value. xcbuildFlags controls flags passed only to xcbuild.
+
+
+
+
+
+ Meson
+
+
+
+ Overrides the configure phase to run meson to generate Ninja files. To run these files, you should accompany Meson with ninja. By default, enableParallelBuilding is enabled as Meson supports parallel building almost everywhere.
+
+
+ Variables controlling Meson
+
+
+ mesonFlags
+
+
+
+ Controls the flags passed to meson.
+
+
+
+
+
+ mesonBuildType
+
+
+
+ Which --buildtype to pass to Meson. We default to plain.
+
+
+
+
+
+ mesonAutoFeatures
+
+
+
+ What value to set -Dauto_features= to. We default to enabled.
+
+
+
+
+
+ mesonWrapMode
+
+
+
+ What value to set -Dwrap_mode= to. We default to nodownload as we disallow network access.
+
+
+
+
+
+ dontUseMesonConfigure
+
+
+
+ Disables using Meson's configurePhase.
+
+
+
+
+
+
+
+
+ ninja
+
+
+
+ Overrides the build, install, and check phase to run ninja instead of make. You can disable this behavior with the dontUseNinjaBuild, dontUseNinjaInstall, and dontUseNinjaCheck, respectively. Parallel building is enabled by default in Ninja.
+
+
+
+
+
+ unzip
+
+
+
+ This setup hook will allow you to unzip .zip files specified in $src. There are many similar packages like unrar, undmg, etc.
+
+
+
+
+
+ wafHook
+
+
+
+ Overrides the configure, build, and install phases. This will run the "waf" script used by many projects. If wafPath (default ./waf) doesn’t exist, it will copy the version of waf available in Nixpkgs. wafFlags can be used to pass flags to the waf script.
+
+
+
+
+
+ scons
+
+
+
+ Overrides the build, install, and check phases. This uses the scons build system as a replacement for make. scons does not provide a configure phase, so everything is managed at build and install time.
+
+
+
+
+
+
+
+ Purity in Nixpkgs
+
+
+ [measures taken to prevent dependencies on packages outside the store, and what you can do to prevent them]
+
+
+
+ GCC doesn't search in locations such as /usr/include. In fact, attempts to add such directories through the flag are filtered out. Likewise, the linker (from GNU binutils) doesn't search in standard locations such as /usr/lib. Programs built on Linux are linked against a GNU C Library that likewise doesn't search in the default system locations.
+
+
+
+ Hardening in Nixpkgs
+
+
+ There are flags available to harden packages at compile or link-time. These can be toggled using the stdenv.mkDerivation parameters hardeningDisable and hardeningEnable.
+
+
+
+ Both parameters take a list of flags as strings. The special "all" flag can be passed to hardeningDisable to turn off all hardening. These flags can also be used as environment variables for testing or development purposes.
+
+
+
+ The following flags are enabled by default and might require disabling with hardeningDisable if the program to package is incompatible.
+
+
+
+
+
+ format
+
+
+
+ Adds the compiler options. At present, this warns about calls to printf and scanf functions where the format string is not a string literal and there are no format arguments, as in printf(foo);. This may be a security hole if the format string came from untrusted input and contains %n.
+
+
+ This needs to be turned off or fixed for errors similar to:
+
+
+/tmp/nix-build-zynaddsubfx-2.5.2.drv-0/zynaddsubfx-2.5.2/src/UI/guimain.cpp:571:28: error: format not a string literal and no format arguments [-Werror=format-security]
+ printf(help_message);
+ ^
+cc1plus: some warnings being treated as errors
+
+
+
+
+
+ stackprotector
+
+
+
+ Adds the compiler options. This adds safety checks against stack overwrites rendering many potential code injection attacks into aborting situations. In the best case this turns code injection vulnerabilities into denial of service or into non-issues (depending on the application).
+
+
+ This needs to be turned off or fixed for errors similar to:
+
+
+bin/blib.a(bios_console.o): In function `bios_handle_cup':
+/tmp/nix-build-ipxe-20141124-5cbdc41.drv-0/ipxe-5cbdc41/src/arch/i386/firmware/pcbios/bios_console.c:86: undefined reference to `__stack_chk_fail'
+
+
+
+
+
+ fortify
+
+
+
+ Adds the compiler options. During code generation the compiler knows a great deal of information about buffer sizes (where possible), and attempts to replace insecure unlimited length buffer function calls with length-limited ones. This is especially useful for old, crufty code. Additionally, format strings in writable memory that contain '%n' are blocked. If an application depends on such a format string, it will need to be worked around.
+
+
+ Additionally, some warnings are enabled which might trigger build failures if compiler warnings are treated as errors in the package build. In this case, set to .
+
+
+ This needs to be turned off or fixed for errors similar to:
+
+
+malloc.c:404:15: error: return type is an incomplete type
+malloc.c:410:19: error: storage size of 'ms' isn't known
+
+
+strdup.h:22:1: error: expected identifier or '(' before '__extension__'
+
+
+strsep.c:65:23: error: register name not specified for 'delim'
+
+
+installwatch.c:3751:5: error: conflicting types for '__open_2'
+
+
+fcntl2.h:50:4: error: call to '__open_missing_mode' declared with attribute error: open with O_CREAT or O_TMPFILE in second argument needs 3 arguments
+
+
+
+
+
+ pic
+
+
+
+ Adds the compiler options. This options adds support for position independent code in shared libraries and thus making ASLR possible.
+
+
+ Most notably, the Linux kernel, kernel modules and other code not running in an operating system environment like boot loaders won't build with PIC enabled. The compiler will is most cases complain that PIC is not supported for a specific build.
+
+
+ This needs to be turned off or fixed for assembler errors similar to:
+
+
+ccbLfRgg.s: Assembler messages:
+ccbLfRgg.s:33: Error: missing or invalid displacement expression `private_key_len@GOTOFF'
+
+
+
+
+
+ strictoverflow
+
+
+
+ Signed integer overflow is undefined behaviour according to the C standard. If it happens, it is an error in the program as it should check for overflow before it can happen, not afterwards. GCC provides built-in functions to perform arithmetic with overflow checking, which are correct and faster than any custom implementation. As a workaround, the option makes gcc behave as if signed integer overflows were defined.
+
+
+ This flag should not trigger any build or runtime errors.
+
+
+
+
+
+ relro
+
+
+
+ Adds the linker option. During program load, several ELF memory sections need to be written to by the linker, but can be turned read-only before turning over control to the program. This prevents some GOT (and .dtors) overwrite attacks, but at least the part of the GOT used by the dynamic linker (.got.plt) is still vulnerable.
+
+
+ This flag can break dynamic shared object loading. For instance, the module systems of Xorg and OpenCV are incompatible with this flag. In almost all cases the bindnow flag must also be disabled and incompatible programs typically fail with similar errors at runtime.
+
+
+
+
+
+ bindnow
+
+
+
+ Adds the linker option. During program load, all dynamic symbols are resolved, allowing for the complete GOT to be marked read-only (due to relro). This prevents GOT overwrite attacks. For very large applications, this can incur some performance loss during initial load while symbols are resolved, but this shouldn't be an issue for daemons.
+
+
+ This flag can break dynamic shared object loading. For instance, the module systems of Xorg and PHP are incompatible with this flag. Programs incompatible with this flag often fail at runtime due to missing symbols, like:
+
+
+intel_drv.so: undefined symbol: vgaHWFreeHWRec
+
+
+
+
+
+
+ The following flags are disabled by default and should be enabled with hardeningEnable for packages that take untrusted input like network services.
+
+
+
+
+
+ pie
+
+
+
+ Adds the compiler and linker options. Position Independent Executables are needed to take advantage of Address Space Layout Randomization, supported by modern kernel versions. While ASLR can already be enforced for data areas in the stack and heap (brk and mmap), the code areas must be compiled as position-independent. Shared libraries already do this with the pic flag, so they gain ASLR automatically, but binary .text regions need to be build with pie to gain ASLR. When this happens, ROP attacks are much harder since there are no static locations to bounce off of during a memory corruption attack.
+
+
+
+
+
+
+ For more in-depth information on these hardening flags and hardening in general, refer to the Debian Wiki, Ubuntu Wiki, Gentoo Wiki, and the Arch Wiki.
+
+
+
diff --git a/doc/configuration.xml b/doc/using/configuration.xml
similarity index 60%
rename from doc/configuration.xml
rename to doc/using/configuration.xml
index 6720f54374a1a4336c5427e35ecfd596fe1a0c3e..f4d6e9110064a076cc1d28ae1540cb935cd56945 100644
--- a/doc/configuration.xml
+++ b/doc/using/configuration.xml
@@ -3,49 +3,38 @@
xml:id="chap-packageconfig">
Global configuration
- Nix comes with certain defaults about what packages can and cannot be
- installed, based on a package's metadata. By default, Nix will prevent
- installation if any of the following criteria are true:
+ Nix comes with certain defaults about what packages can and cannot be installed, based on a package's metadata. By default, Nix will prevent installation if any of the following criteria are true:
- The package is thought to be broken, and has had its
- meta.broken set to true.
+ The package is thought to be broken, and has had its meta.broken set to true.
- The package isn't intended to run on the given system, as none of its
- meta.platforms match the given system.
+ The package isn't intended to run on the given system, as none of its meta.platforms match the given system.
- The package's meta.license is set to a license which is
- considered to be unfree.
+ The package's meta.license is set to a license which is considered to be unfree.
- The package has known security vulnerabilities but has not or can not be
- updated for some reason, and a list of issues has been entered in to the
- package's meta.knownVulnerabilities.
+ The package has known security vulnerabilities but has not or can not be updated for some reason, and a list of issues has been entered in to the package's meta.knownVulnerabilities.
- Note that all this is checked during evaluation already, and the check
- includes any package that is evaluated. In particular, all build-time
- dependencies are checked. nix-env -qa will (attempt to)
- hide any packages that would be refused.
+ Note that all this is checked during evaluation already, and the check includes any package that is evaluated. In particular, all build-time dependencies are checked. nix-env -qa will (attempt to) hide any packages that would be refused.
Each of these criteria can be altered in the nixpkgs configuration.
- The nixpkgs configuration for a NixOS system is set in the
- configuration.nix, as in the following example:
+ The nixpkgs configuration for a NixOS system is set in the configuration.nix, as in the following example:
{
nixpkgs.config = {
@@ -53,13 +42,10 @@
};
}
- However, this does not allow unfree software for individual users. Their
- configurations are managed separately.
+ However, this does not allow unfree software for individual users. Their configurations are managed separately.
- A user's of nixpkgs configuration is stored in a user-specific configuration
- file located at ~/.config/nixpkgs/config.nix. For
- example:
+ A user's nixpkgs configuration is stored in a user-specific configuration file located at ~/.config/nixpkgs/config.nix. For example:
{
allowUnfree = true;
@@ -67,31 +53,25 @@
- Note that we are not able to test or build unfree software on Hydra due to
- policy. Most unfree licenses prohibit us from either executing or
- distributing the software.
+ Note that we are not able to test or build unfree software on Hydra due to policy. Most unfree licenses prohibit us from either executing or distributing the software.
Installing broken packages
- There are two ways to try compiling a package which has been marked as
- broken.
+ There are two ways to try compiling a package which has been marked as broken.
- For allowing the build of a broken package once, you can use an
- environment variable for a single invocation of the nix tools:
+ For allowing the build of a broken package once, you can use an environment variable for a single invocation of the nix tools:
$ export NIXPKGS_ALLOW_BROKEN=1
- For permanently allowing broken packages to be built, you may add
- allowBroken = true; to your user's configuration file,
- like this:
+ For permanently allowing broken packages to be built, you may add allowBroken = true; to your user's configuration file, like this:
{
allowBroken = true;
@@ -105,23 +85,19 @@
Installing packages on unsupported systems
- There are also two ways to try compiling a package which has been marked as
- unsuported for the given system.
+ There are also two ways to try compiling a package which has been marked as unsuported for the given system.
- For allowing the build of a broken package once, you can use an
- environment variable for a single invocation of the nix tools:
+ For allowing the build of a broken package once, you can use an environment variable for a single invocation of the nix tools:
$ export NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM=1
- For permanently allowing broken packages to be built, you may add
- allowUnsupportedSystem = true; to your user's
- configuration file, like this:
+ For permanently allowing broken packages to be built, you may add allowUnsupportedSystem = true; to your user's configuration file, like this:
{
allowUnsupportedSystem = true;
@@ -132,42 +108,29 @@
- The difference between a package being unsupported on some system and being
- broken is admittedly a bit fuzzy. If a program ought to
- work on a certain platform, but doesn't, the platform should be included in
- meta.platforms, but marked as broken with e.g.
- meta.broken = !hostPlatform.isWindows. Of course, this
- begs the question of what "ought" means exactly. That is left to the package
- maintainer.
+ The difference between a package being unsupported on some system and being broken is admittedly a bit fuzzy. If a program ought to work on a certain platform, but doesn't, the platform should be included in meta.platforms, but marked as broken with e.g. meta.broken = !hostPlatform.isWindows. Of course, this begs the question of what "ought" means exactly. That is left to the package maintainer.
Installing unfree packages
- There are several ways to tweak how Nix handles a package which has been
- marked as unfree.
+ There are several ways to tweak how Nix handles a package which has been marked as unfree.
- To temporarily allow all unfree packages, you can use an environment
- variable for a single invocation of the nix tools:
+ To temporarily allow all unfree packages, you can use an environment variable for a single invocation of the nix tools:
$ export NIXPKGS_ALLOW_UNFREE=1
- It is possible to permanently allow individual unfree packages, while
- still blocking unfree packages by default using the
- allowUnfreePredicate configuration option in the user
- configuration file.
+ It is possible to permanently allow individual unfree packages, while still blocking unfree packages by default using the allowUnfreePredicate configuration option in the user configuration file.
- This option is a function which accepts a package as a parameter, and
- returns a boolean. The following example configuration accepts a package
- and always returns false:
+ This option is a function which accepts a package as a parameter, and returns a boolean. The following example configuration accepts a package and always returns false:
{
allowUnfreePredicate = (pkg: false);
@@ -175,8 +138,7 @@
- For a more useful example, try the following. This configuration only
- allows unfree packages named flash player and visual studio code:
+ For a more useful example, try the following. This configuration only allows unfree packages named flash player and visual studio code:
{
allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
@@ -189,14 +151,10 @@
- It is also possible to whitelist and blacklist licenses that are
- specifically acceptable or not acceptable, using
- whitelistedLicenses and
- blacklistedLicenses, respectively.
+ It is also possible to whitelist and blacklist licenses that are specifically acceptable or not acceptable, using whitelistedLicenses and blacklistedLicenses, respectively.
- The following example configuration whitelists the licenses
- amd and wtfpl:
+ The following example configuration whitelists the licenses amd and wtfpl:
{
whitelistedLicenses = with stdenv.lib.licenses; [ amd wtfpl ];
@@ -204,8 +162,7 @@
- The following example configuration blacklists the gpl3
- and agpl3 licenses:
+ The following example configuration blacklists the gpl3 and agpl3 licenses:
{
blacklistedLicenses = with stdenv.lib.licenses; [ agpl3 gpl3 ];
@@ -216,37 +173,29 @@
- A complete list of licenses can be found in the file
- lib/licenses.nix of the nixpkgs tree.
+ A complete list of licenses can be found in the file lib/licenses.nix of the nixpkgs tree.
Installing insecure packages
- There are several ways to tweak how Nix handles a package which has been
- marked as insecure.
+ There are several ways to tweak how Nix handles a package which has been marked as insecure.
- To temporarily allow all insecure packages, you can use an environment
- variable for a single invocation of the nix tools:
+ To temporarily allow all insecure packages, you can use an environment variable for a single invocation of the nix tools:
$ export NIXPKGS_ALLOW_INSECURE=1
- It is possible to permanently allow individual insecure packages, while
- still blocking other insecure packages by default using the
- permittedInsecurePackages configuration option in the
- user configuration file.
+ It is possible to permanently allow individual insecure packages, while still blocking other insecure packages by default using the permittedInsecurePackages configuration option in the user configuration file.
- The following example configuration permits the installation of the
- hypothetically insecure package hello, version
- 1.2.3:
+ The following example configuration permits the installation of the hypothetically insecure package hello, version 1.2.3:
{
permittedInsecurePackages = [
@@ -258,18 +207,13 @@
- It is also possible to create a custom policy around which insecure
- packages to allow and deny, by overriding the
- allowInsecurePredicate configuration option.
+ It is also possible to create a custom policy around which insecure packages to allow and deny, by overriding the allowInsecurePredicate configuration option.
- The allowInsecurePredicate option is a function which
- accepts a package and returns a boolean, much like
- allowUnfreePredicate.
+ The allowInsecurePredicate option is a function which accepts a package and returns a boolean, much like allowUnfreePredicate.
- The following configuration example only allows insecure packages with
- very short names:
+ The following configuration example only allows insecure packages with very short names:
{
allowInsecurePredicate = pkg: builtins.stringLength (lib.getName pkg) <= 5;
@@ -277,8 +221,7 @@
- Note that permittedInsecurePackages is only checked if
- allowInsecurePredicate is not specified.
+ Note that permittedInsecurePackages is only checked if allowInsecurePredicate is not specified.
@@ -288,10 +231,7 @@
Modify packages via packageOverrides
- You can define a function called packageOverrides in your
- local ~/.config/nixpkgs/config.nix to override Nix
- packages. It must be a function that takes pkgs as an argument and returns a
- modified set of packages.
+ You can define a function called packageOverrides in your local ~/.config/nixpkgs/config.nix to override Nix packages. It must be a function that takes pkgs as an argument and returns a modified set of packages.
{
packageOverrides = pkgs: rec {
@@ -308,15 +248,7 @@
Build an environment
- Using packageOverrides, it is possible to manage
- packages declaratively. This means that we can list all of our desired
- packages within a declarative Nix expression. For example, to have
- aspell, bc,
- ffmpeg, coreutils,
- gdb, nixUnstable,
- emscripten, jq,
- nox, and silver-searcher, we could
- use the following in ~/.config/nixpkgs/config.nix:
+ Using packageOverrides, it is possible to manage packages declaratively. This means that we can list all of our desired packages within a declarative Nix expression. For example, to have aspell, bc, ffmpeg, coreutils, gdb, nixUnstable, emscripten, jq, nox, and silver-searcher, we could use the following in ~/.config/nixpkgs/config.nix:
@@ -342,13 +274,7 @@
- To install it into our environment, you can just run nix-env -iA
- nixpkgs.myPackages. If you want to load the packages to be built
- from a working copy of nixpkgs you just run
- nix-env -f. -iA myPackages. To explore what's been
- installed, just look through ~/.nix-profile/. You can
- see that a lot of stuff has been installed. Some of this stuff is useful
- some of it isn't. Let's tell Nixpkgs to only link the stuff that we want:
+ To install it into our environment, you can just run nix-env -iA nixpkgs.myPackages. If you want to load the packages to be built from a working copy of nixpkgs you just run nix-env -f. -iA myPackages. To explore what's been installed, just look through ~/.nix-profile/. You can see that a lot of stuff has been installed. Some of this stuff is useful some of it isn't. Let's tell Nixpkgs to only link the stuff that we want:
@@ -375,12 +301,7 @@
- pathsToLink tells Nixpkgs to only link the paths listed
- which gets rid of the extra stuff in the profile. /bin
- and /share are good defaults for a user environment,
- getting rid of the clutter. If you are running on Nix on MacOS, you may
- want to add another path as well, /Applications, that
- makes GUI apps available.
+ pathsToLink tells Nixpkgs to only link the paths listed which gets rid of the extra stuff in the profile. /bin and /share are good defaults for a user environment, getting rid of the clutter. If you are running on Nix on MacOS, you may want to add another path as well, /Applications, that makes GUI apps available.
@@ -388,13 +309,7 @@
Getting documentation
- After building that new environment, look through
- ~/.nix-profile to make sure everything is there that
- we wanted. Discerning readers will note that some files are missing. Look
- inside ~/.nix-profile/share/man/man1/ to verify this.
- There are no man pages for any of the Nix tools! This is because some
- packages like Nix have multiple outputs for things like documentation (see
- section 4). Let's make Nix install those as well.
+ After building that new environment, look through ~/.nix-profile to make sure everything is there that we wanted. Discerning readers will note that some files are missing. Look inside ~/.nix-profile/share/man/man1/ to verify this. There are no man pages for any of the Nix tools! This is because some packages like Nix have multiple outputs for things like documentation (see section 4). Let's make Nix install those as well.
@@ -421,9 +336,7 @@
- This provides us with some useful documentation for using our packages.
- However, if we actually want those manpages to be detected by man, we need
- to set up our environment. This can also be managed within Nix expressions.
+ This provides us with some useful documentation for using our packages. However, if we actually want those manpages to be detected by man, we need to set up our environment. This can also be managed within Nix expressions.
@@ -459,9 +372,7 @@
- For this to work fully, you must also have this script sourced when you are
- logged in. Try adding something like this to your
- ~/.profile file:
+ For this to work fully, you must also have this script sourced when you are logged in. Try adding something like this to your ~/.profile file:
@@ -476,8 +387,7 @@ fi
- Now just run source $HOME/.profile and you can starting
- loading man pages from your environent.
+ Now just run source $HOME/.profile and you can starting loading man pages from your environent.
@@ -485,9 +395,7 @@ fi
GNU info setup
- Configuring GNU info is a little bit trickier than man pages. To work
- correctly, info needs a database to be generated. This can be done with
- some small modifications to our environment scripts.
+ Configuring GNU info is a little bit trickier than man pages. To work correctly, info needs a database to be generated. This can be done with some small modifications to our environment scripts.
@@ -533,11 +441,7 @@ fi
- postBuild tells Nixpkgs to run a command after building
- the environment. In this case, install-info adds the
- installed info pages to dir which is GNU info's default
- root node. Note that texinfoInteractive is added to the
- environment to give the install-info command.
+ postBuild tells Nixpkgs to run a command after building the environment. In this case, install-info adds the installed info pages to dir which is GNU info's default root node. Note that texinfoInteractive is added to the environment to give the install-info command.
diff --git a/doc/using/overlays.xml b/doc/using/overlays.xml
new file mode 100644
index 0000000000000000000000000000000000000000..26a888368abf72877de8eda640c48b217915b867
--- /dev/null
+++ b/doc/using/overlays.xml
@@ -0,0 +1,140 @@
+
+ Overlays
+
+ This chapter describes how to extend and change Nixpkgs using overlays. Overlays are used to add layers in the fixed-point used by Nixpkgs to compose the set of all packages.
+
+
+ Nixpkgs can be configured with a list of overlays, which are applied in order. This means that the order of the overlays can be significant if multiple layers override the same package.
+
+
+
+ Installing overlays
+
+
+ The list of overlays can be set either explicitly in a Nix expression, or through <nixpkgs-overlays> or user configuration files.
+
+
+
+ Set overlays in NixOS or Nix expressions
+
+
+ On a NixOS system the value of the nixpkgs.overlays option, if present, is passed to the system Nixpkgs directly as an argument. Note that this does not affect the overlays for non-NixOS operations (e.g. nix-env), which are looked up independently.
+
+
+
+ The list of overlays can be passed explicitly when importing nixpkgs, for example import <nixpkgs> { overlays = [ overlay1 overlay2 ]; }.
+
+
+
+ Further overlays can be added by calling the pkgs.extend or pkgs.appendOverlays, although it is often preferable to avoid these functions, because they recompute the Nixpkgs fixpoint, which is somewhat expensive to do.
+
+
+
+
+ Install overlays via configuration lookup
+
+
+ The list of overlays is determined as follows.
+
+
+
+
+
+
+ First, if an overlays argument to the Nixpkgs function itself is given, then that is used and no path lookup will be performed.
+
+
+
+
+ Otherwise, if the Nix path entry <nixpkgs-overlays> exists, we look for overlays at that path, as described below.
+
+
+ See the section on NIX_PATH in the Nix manual for more details on how to set a value for <nixpkgs-overlays>.
+
+
+
+
+ If one of ~/.config/nixpkgs/overlays.nix and ~/.config/nixpkgs/overlays/ exists, then we look for overlays at that path, as described below. It is an error if both exist.
+
+
+
+
+
+
+ If we are looking for overlays at a path, then there are two cases:
+
+
+
+ If the path is a file, then the file is imported as a Nix expression and used as the list of overlays.
+
+
+
+
+ If the path is a directory, then we take the content of the directory, order it lexicographically, and attempt to interpret each as an overlay by:
+
+
+
+ Importing the file, if it is a .nix file.
+
+
+
+
+ Importing a top-level default.nix file, if it is a directory.
+
+
+
+
+
+
+
+
+
+ Because overlays that are set in NixOS configuration do not affect non-NixOS operations such as nix-env, the overlays.nix option provides a convenient way to use the same overlays for a NixOS system configuration and user configuration: the same file can be used as overlays.nix and imported as the value of nixpkgs.overlays.
+
+
+
+
+
+
+
+ Defining overlays
+
+
+ Overlays are Nix functions which accept two arguments, conventionally called self and super, and return a set of packages. For example, the following is a valid overlay.
+
+
+
+self: super:
+
+{
+ boost = super.boost.override {
+ python = self.python3;
+ };
+ rr = super.callPackage ./pkgs/rr {
+ stdenv = self.stdenv_32bit;
+ };
+}
+
+
+
+ The first argument (self) corresponds to the final package set. You should use this set for the dependencies of all packages specified in your overlay. For example, all the dependencies of rr in the example above come from self, as well as the overridden dependencies used in the boost override.
+
+
+
+ The second argument (super) corresponds to the result of the evaluation of the previous stages of Nixpkgs. It does not contain any of the packages added by the current overlay, nor any of the following overlays. This set should be used either to refer to packages you wish to override, or to access functions defined in Nixpkgs. For example, the original recipe of boost in the above example, comes from super, as well as the callPackage function.
+
+
+
+ The value returned by this function should be a set similar to pkgs/top-level/all-packages.nix, containing overridden and/or new packages.
+
+
+
+ Overlays are similar to other methods for customizing Nixpkgs, in particular the packageOverrides attribute described in . Indeed, packageOverrides acts as an overlay with only the super argument. It is therefore appropriate for basic use, but overlays are more powerful and easier to distribute.
+
+
+
diff --git a/doc/using/overrides.xml b/doc/using/overrides.xml
new file mode 100644
index 0000000000000000000000000000000000000000..c9d36ddb2d7b60d09f4ccab404206ef9878c0003
--- /dev/null
+++ b/doc/using/overrides.xml
@@ -0,0 +1,145 @@
+
+ Overriding
+
+ Sometimes one wants to override parts of nixpkgs, e.g. derivation attributes, the results of derivations.
+
+
+ These functions are used to make changes to packages, returning only single packages. Overlays, on the other hand, can be used to combine the overridden packages across the entire package set of Nixpkgs.
+
+
+ <pkg>.override
+
+
+ The function override is usually available for all the derivations in the nixpkgs expression (pkgs).
+
+
+
+ It is used to override the arguments passed to a function.
+
+
+
+ Example usages:
+pkgs.foo.override { arg1 = val1; arg2 = val2; ... }
+
+
+import pkgs.path { overlays = [ (self: super: {
+ foo = super.foo.override { barSupport = true ; };
+ })]};
+
+
+mypkg = pkgs.callPackage ./mypkg.nix {
+ mydep = pkgs.mydep.override { ... };
+ }
+
+
+
+
+ In the first example, pkgs.foo is the result of a function call with some default arguments, usually a derivation. Using pkgs.foo.override will call the same function with the given new arguments.
+
+
+
+ <pkg>.overrideAttrs
+
+
+ The function overrideAttrs allows overriding the attribute set passed to a stdenv.mkDerivation call, producing a new derivation based on the original one. This function is available on all derivations produced by the stdenv.mkDerivation function, which is most packages in the nixpkgs expression pkgs.
+
+
+
+ Example usage:
+
+helloWithDebug = pkgs.hello.overrideAttrs (oldAttrs: rec {
+ separateDebugInfo = true;
+});
+
+
+
+
+ In the above example, the separateDebugInfo attribute is overridden to be true, thus building debug info for helloWithDebug, while all other attributes will be retained from the original hello package.
+
+
+
+ The argument oldAttrs is conventionally used to refer to the attr set originally passed to stdenv.mkDerivation.
+
+
+
+
+ Note that separateDebugInfo is processed only by the stdenv.mkDerivation function, not the generated, raw Nix derivation. Thus, using overrideDerivation will not work in this case, as it overrides only the attributes of the final derivation. It is for this reason that overrideAttrs should be preferred in (almost) all cases to overrideDerivation, i.e. to allow using stdenv.mkDerivation to process input arguments, as well as the fact that it is easier to use (you can use the same attribute names you see in your Nix code, instead of the ones generated (e.g. buildInputs vs nativeBuildInputs), and it involves less typing).
+
+
+
+
+ <pkg>.overrideDerivation
+
+
+
+ You should prefer overrideAttrs in almost all cases, see its documentation for the reasons why. overrideDerivation is not deprecated and will continue to work, but is less nice to use and does not have as many abilities as overrideAttrs.
+
+
+
+
+
+ Do not use this function in Nixpkgs as it evaluates a Derivation before modifying it, which breaks package abstraction and removes error-checking of function arguments. In addition, this evaluation-per-function application incurs a performance penalty, which can become a problem if many overrides are used. It is only intended for ad-hoc customisation, such as in ~/.config/nixpkgs/config.nix.
+
+
+
+
+ The function overrideDerivation creates a new derivation based on an existing one by overriding the original's attributes with the attribute set produced by the specified function. This function is available on all derivations defined using the makeOverridable function. Most standard derivation-producing functions, such as stdenv.mkDerivation, are defined using this function, which means most packages in the nixpkgs expression, pkgs, have this function.
+
+
+
+ Example usage:
+
+mySed = pkgs.gnused.overrideDerivation (oldAttrs: {
+ name = "sed-4.2.2-pre";
+ src = fetchurl {
+ url = ftp://alpha.gnu.org/gnu/sed/sed-4.2.2-pre.tar.bz2;
+ sha256 = "11nq06d131y4wmf3drm0yk502d2xc6n5qy82cg88rb9nqd2lj41k";
+ };
+ patches = [];
+});
+
+
+
+
+ In the above example, the name, src, and patches of the derivation will be overridden, while all other attributes will be retained from the original derivation.
+
+
+
+ The argument oldAttrs is used to refer to the attribute set of the original derivation.
+
+
+
+
+ A package's attributes are evaluated *before* being modified by the overrideDerivation function. For example, the name attribute reference in url = "mirror://gnu/hello/${name}.tar.gz"; is filled-in *before* the overrideDerivation function modifies the attribute set. This means that overriding the name attribute, in this example, *will not* change the value of the url attribute. Instead, we need to override both the name *and* url attributes.
+
+
+
+
+ lib.makeOverridable
+
+
+ The function lib.makeOverridable is used to make the result of a function easily customizable. This utility only makes sense for functions that accept an argument set and return an attribute set.
+
+
+
+ Example usage:
+
+f = { a, b }: { result = a+b; };
+c = lib.makeOverridable f { a = 1; b = 2; };
+
+
+
+
+ The variable c is the value of the f function applied with some default arguments. Hence the value of c.result is 3, in this example.
+
+
+
+ The variable c however also has some additional functions, like c.override which can be used to override the default arguments. In this example the value of (c.override { a = 4; }).result is 6.
+
+
+
diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index d374d229f5975f0eddb5b03d379fc0ce1d359c96..086c3d746fc187873ecede9c7e433526936d849a 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -354,7 +354,7 @@ rec {
=> { a = ["x" "y"]; b = ["z"] }
*/
zipAttrsWith = f: sets: zipAttrsWithNames (concatMap attrNames sets) f sets;
- /* Like `zipAttrsWith' with `(name: values: value)' as the function.
+ /* Like `zipAttrsWith' with `(name: values: values)' as the function.
Example:
zipAttrs [{a = "x";} {a = "y"; b = "z";}]
diff --git a/lib/customisation.nix b/lib/customisation.nix
index 3be36fcd719b03a0320de900726bb1638634a878..ac234e3b8c6fb2f3916e4e99984b12b41fef2f1e 100644
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@@ -66,22 +66,31 @@ rec {
*/
makeOverridable = f: origArgs:
let
- ff = f origArgs;
+ result = f origArgs;
+
+ # Creates a functor with the same arguments as f
+ copyArgs = g: lib.setFunctionArgs g (lib.functionArgs f);
+ # Changes the original arguments with (potentially a function that returns) a set of new attributes
overrideWith = newArgs: origArgs // (if lib.isFunction newArgs then newArgs origArgs else newArgs);
+
+ # Re-call the function but with different arguments
+ overrideArgs = copyArgs (newArgs: makeOverridable f (overrideWith newArgs));
+ # Change the result of the function call by applying g to it
+ overrideResult = g: makeOverridable (copyArgs (args: g (f args))) origArgs;
in
- if builtins.isAttrs ff then (ff // {
- override = newArgs: makeOverridable f (overrideWith newArgs);
- overrideDerivation = fdrv:
- makeOverridable (args: overrideDerivation (f args) fdrv) origArgs;
- ${if ff ? overrideAttrs then "overrideAttrs" else null} = fdrv:
- makeOverridable (args: (f args).overrideAttrs fdrv) origArgs;
- })
- else if lib.isFunction ff then {
- override = newArgs: makeOverridable f (overrideWith newArgs);
- __functor = self: ff;
- overrideDerivation = throw "overrideDerivation not yet supported for functors";
- }
- else ff;
+ if builtins.isAttrs result then
+ result // {
+ override = overrideArgs;
+ overrideDerivation = fdrv: overrideResult (x: overrideDerivation x fdrv);
+ ${if result ? overrideAttrs then "overrideAttrs" else null} = fdrv:
+ overrideResult (x: x.overrideAttrs fdrv);
+ }
+ else if lib.isFunction result then
+ # Transform the result into a functor while propagating its arguments
+ lib.setFunctionArgs result (lib.functionArgs result) // {
+ override = overrideArgs;
+ }
+ else result;
/* Call the package function in the file `fn' with the required
diff --git a/lib/default.nix b/lib/default.nix
index 0e840dd6c9e688b47dce48a8c9e7f137b7e65834..8af5315258606b4c59ddb84a71302372ed0c98c3 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -57,8 +57,8 @@ let
hasAttr head isAttrs isBool isInt isList isString length
lessThan listToAttrs pathExists readFile replaceStrings seq
stringLength sub substring tail;
- inherit (trivial) id const concat or and bitAnd bitOr bitXor bitNot
- boolToString mergeAttrs flip mapNullable inNixShell min max
+ inherit (trivial) id const pipe concat or and bitAnd bitOr bitXor
+ bitNot boolToString mergeAttrs flip mapNullable inNixShell min max
importJSON warn info showWarnings nixpkgsVersion version mod compare
splitByAndCompare functionArgs setFunctionArgs isFunction;
inherit (fixedPoints) fix fix' converge extends composeExtensions
@@ -135,5 +135,7 @@ let
mergeAttrsByFuncDefaultsClean mergeAttrBy
fakeSha256 fakeSha512
nixType imap;
+ inherit (versions)
+ splitVersion;
});
in lib
diff --git a/lib/licenses.nix b/lib/licenses.nix
index 83e1ec7748d56fb22cd919683164028c7a938925..986b7fa1fdd9df83e37dab9a2999469f64b2a56d 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -218,9 +218,9 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
fullName = "Common Public License 1.0";
};
- curl = {
- fullName = "MIT/X11 derivate";
- url = "https://curl.haxx.se/docs/copyright.html";
+ curl = spdx {
+ spdxId = "curl";
+ fullName = "curl License";
};
doc = spdx {
@@ -613,6 +613,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
url = https://enterprise.dejacode.com/licenses/public/purdue-bsd;
};
+ qhull = spdx {
+ spdxId = "Qhull";
+ fullName = "Qhull License";
+ };
+
qpl = spdx {
spdxId = "QPL-1.0";
fullName = "Q Public License 1.0";
diff --git a/lib/modules.nix b/lib/modules.nix
index c3c903c1dfa800eab8f407cb71e7c022381f402c..44db77b5d1c6a4a2b1fd62d58ea1042ea11cc970 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -326,6 +326,8 @@ rec {
# The value with a check that it is defined
valueDefined = if res.isDefined then res.mergedValue else
+ # (nixos-option detects this specific error message and gives it special
+ # handling. If changed here, please change it there too.)
throw "The option `${showOption loc}' is used but not defined.";
# Apply the 'apply' function to the merged value. This allows options to
@@ -591,12 +593,16 @@ rec {
{ options, ... }:
{ options = setAttrByPath optionName (mkOption {
visible = false;
+ apply = x: throw "The option `${showOption optionName}' can no longer be used since it's been removed. ${replacementInstructions}";
});
- config.warnings =
- let opt = getAttrFromPath optionName options; in
- optional opt.isDefined ''
+ config.assertions =
+ let opt = getAttrFromPath optionName options; in [{
+ assertion = !opt.isDefined;
+ message = ''
The option definition `${showOption optionName}' in ${showFiles opt.files} no longer has any effect; please remove it.
- ${replacementInstructions}'';
+ ${replacementInstructions}
+ '';
+ }];
};
/* Return a module that causes a warning to be shown if the
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 0c0cdf1f11b197e2d1d6b3ab74dfb9cfd7421c3d..026117cc34fd2317fcfabc04af57d805f569f531 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -37,6 +37,7 @@ rec {
else if final.isAndroid then "bionic"
else if final.isLinux /* default */ then "glibc"
else if final.isMsp430 then "newlib"
+ else if final.isVc4 then "newlib"
else if final.isAvr then "avrlibc"
else if final.isNetBSD then "nblibc"
# TODO(@Ericson2314) think more about other operating systems
@@ -79,6 +80,7 @@ rec {
else if final.isAarch64 then "arm64"
else if final.isx86_32 then "x86"
else if final.isx86_64 then "ia64"
+ else if final.isMips then "mips"
else final.parsed.cpu.name;
qemuArch =
diff --git a/lib/systems/doubles.nix b/lib/systems/doubles.nix
index 58cff18e648832e116f6eb2851e0349738dfaa01..96e602d0e167357c84a8ba57094ebadafb64af23 100644
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@@ -26,7 +26,9 @@ let
"riscv32-linux" "riscv64-linux"
- "aarch64-none" "avr-none" "arm-none" "i686-none" "x86_64-none" "powerpc-none" "msp430-none" "riscv64-none" "riscv32-none"
+ "aarch64-none" "avr-none" "arm-none" "i686-none" "x86_64-none" "powerpc-none" "msp430-none" "riscv64-none" "riscv32-none" "vc4-none"
+
+ "js-ghcjs"
];
allParsed = map parse.mkSystemFromString all;
@@ -45,6 +47,8 @@ in {
x86_64 = filterDoubles predicates.isx86_64;
mips = filterDoubles predicates.isMips;
riscv = filterDoubles predicates.isRiscV;
+ vc4 = filterDoubles predicates.isVc4;
+ js = filterDoubles predicates.isJavaScript;
cygwin = filterDoubles predicates.isCygwin;
darwin = filterDoubles predicates.isDarwin;
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index f20b37dbb7a590a71cc0a47124c917cd9c786ce6..19b3790ecbe0e599fa14b962d1c6adc990b817c6 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -118,6 +118,12 @@ rec {
config = "avr";
};
+ vc4 = {
+ config = "vc4-elf";
+ libc = "newlib";
+ platform = {};
+ };
+
arm-embedded = {
config = "arm-none-eabi";
libc = "newlib";
diff --git a/lib/systems/inspect.nix b/lib/systems/inspect.nix
index 8a983b3d363720caeab170b102cdd9b41067630c..d1980c6dff817fd3f0fdc7062900ba216908c1e4 100644
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@@ -21,6 +21,7 @@ rec {
isSparc = { cpu = { family = "sparc"; }; };
isWasm = { cpu = { family = "wasm"; }; };
isMsp430 = { cpu = { family = "msp430"; }; };
+ isVc4 = { cpu = { family = "vc4"; }; };
isAvr = { cpu = { family = "avr"; }; };
isAlpha = { cpu = { family = "alpha"; }; };
isJavaScript = { cpu = cpuTypes.js; };
diff --git a/lib/systems/parse.nix b/lib/systems/parse.nix
index 5a3805cf997a2f6d278b4ace0f42ecc046644aa2..6a02dbb51528cb5366c5d4cfc6f3ff5c9d995151 100644
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@@ -112,6 +112,8 @@ rec {
msp430 = { bits = 16; significantByte = littleEndian; family = "msp430"; };
avr = { bits = 8; family = "avr"; };
+ vc4 = { bits = 32; significantByte = littleEndian; family = "vc4"; };
+
js = { bits = 32; significantByte = littleEndian; family = "js"; };
};
@@ -330,6 +332,7 @@ rec {
}
];
};
+ gnuabi64 = { abi = "64"; };
musleabi = { float = "soft"; };
musleabihf = { float = "hard"; };
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index d8f412d3fc49ae4a94faca0ab59903e45d5776c0..b064faa1e1ba637645593bbef548590d38249d66 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -18,6 +18,31 @@ runTests {
expected = 2;
};
+ testPipe = {
+ expr = pipe 2 [
+ (x: x + 2) # 2 + 2 = 4
+ (x: x * 2) # 4 * 2 = 8
+ ];
+ expected = 8;
+ };
+
+ testPipeEmpty = {
+ expr = pipe 2 [];
+ expected = 2;
+ };
+
+ testPipeStrings = {
+ expr = pipe [ 3 4 ] [
+ (map toString)
+ (map (s: s + "\n"))
+ concatStrings
+ ];
+ expected = ''
+ 3
+ 4
+ '';
+ };
+
/*
testOr = {
expr = or true false;
@@ -102,6 +127,21 @@ runTests {
expected = [ "2001" "db8" "0" "0042" "" "8a2e" "370" "" ];
};
+ testSplitVersionSingle = {
+ expr = versions.splitVersion "1";
+ expected = [ "1" ];
+ };
+
+ testSplitVersionDouble = {
+ expr = versions.splitVersion "1.2";
+ expected = [ "1" "2" ];
+ };
+
+ testSplitVersionTriple = {
+ expr = versions.splitVersion "1.2.3";
+ expected = [ "1" "2" "3" ];
+ };
+
testIsStorePath = {
expr =
let goodPath =
diff --git a/lib/tests/systems.nix b/lib/tests/systems.nix
index 818749442f9f3600714743e8b963f7947aa81321..6f52912994dfe2a3fb0f9adc303b64d06daf6850 100644
--- a/lib/tests/systems.nix
+++ b/lib/tests/systems.nix
@@ -12,7 +12,7 @@ let
expected = lib.sort lib.lessThan y;
};
in with lib.systems.doubles; lib.runTests {
- testall = mseteq all (linux ++ darwin ++ freebsd ++ openbsd ++ netbsd ++ illumos ++ wasi ++ windows ++ embedded);
+ testall = mseteq all (linux ++ darwin ++ freebsd ++ openbsd ++ netbsd ++ illumos ++ wasi ++ windows ++ embedded ++ js);
testarm = mseteq arm [ "armv5tel-linux" "armv6l-linux" "armv7a-linux" "armv7l-linux" "arm-none" "armv7a-darwin" ];
testi686 = mseteq i686 [ "i686-linux" "i686-freebsd" "i686-netbsd" "i686-openbsd" "i686-cygwin" "i686-windows" "i686-none" "i686-darwin" ];
diff --git a/lib/trivial.nix b/lib/trivial.nix
index f2710a6f0338d50bb70e8c7f0418a8d6a15215c5..3a25e31fb052b5db1641b397655739f8a905f28a 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -29,6 +29,43 @@ rec {
# Value to ignore
y: x;
+ /* Pipes a value through a list of functions, left to right.
+
+ Type: pipe :: a -> [] ->
+ Example:
+ pipe 2 [
+ (x: x + 2) # 2 + 2 = 4
+ (x: x * 2) # 4 * 2 = 8
+ ]
+ => 8
+
+ # ideal to do text transformations
+ pipe [ "a/b" "a/c" ] [
+
+ # create the cp command
+ (map (file: ''cp "${src}/${file}" $out\n''))
+
+ # concatenate all commands into one string
+ lib.concatStrings
+
+ # make that string into a nix derivation
+ (pkgs.runCommand "copy-to-out" {})
+
+ ]
+ =>
+
+ The output type of each function has to be the input type
+ of the next function, and the last function returns the
+ final value.
+ */
+ pipe = val: functions:
+ let reverseApply = x: f: f x;
+ in builtins.foldl' reverseApply val functions;
+ /* note please don’t add a function like `compose = flip pipe`.
+ This would confuse users, because the order of the functions
+ in the list is not clear. With pipe, it’s obvious that it
+ goes first-to-last. With `compose`, not so much.
+ */
## Named versions corresponding to some builtin operators.
@@ -134,7 +171,7 @@ rec {
On each release the first letter is bumped and a new animal is chosen
starting with that new letter.
*/
- codeName = "Loris";
+ codeName = "Markhor";
/* Returns the current nixpkgs version suffix as string. */
versionSuffix =
diff --git a/lib/versions.nix b/lib/versions.nix
index 2c05445b3dd077a54d49d6a51503609402394ca9..0e9d81ac78b1ea9519a0f5a2d880bac0e382105b 100644
--- a/lib/versions.nix
+++ b/lib/versions.nix
@@ -1,13 +1,15 @@
/* Version string functions. */
{ lib }:
-let
+rec {
- splitVersion = builtins.splitVersion or (lib.splitString ".");
-
-in
+ /* Break a version string into its component parts.
-{
+ Example:
+ splitVersion "1.2.3"
+ => ["1" "2" "3"]
+ */
+ splitVersion = builtins.splitVersion or (lib.splitString ".");
/* Get the major version string from a string.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a5b7ce5eaa47f97e1c8055742ae84dc7084a03cb..5337aa6d9120ae2290447fd5993e2643f624323b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -137,6 +137,11 @@
githubId = 2321000;
name = "Ruslan Babayev";
};
+ acairncross = {
+ email = "acairncross@gmail.com";
+ github = "acairncross";
+ name = "Aiken Cairncross";
+ };
acowley = {
email = "acowley@gmail.com";
github = "acowley";
@@ -184,6 +189,12 @@
githubId = 1250775;
name = "Adolfo E. García Castro";
};
+ adsr = {
+ email = "as@php.net";
+ github = "adsr";
+ githubId = 315003;
+ name = "Adam Saponara";
+ };
aepsil0n = {
email = "eduard.bopp@aepsil0n.de";
github = "aepsil0n";
@@ -305,6 +316,7 @@
alexbakker = {
email = "ab@alexbakker.me";
github = "alexbakker";
+ githubId = 2387841;
name = "Alexander Bakker";
};
alexchapman = {
@@ -356,6 +368,16 @@
github = "alunduil";
name = "Alex Brandt";
};
+ alva = {
+ email = "alva@skogen.is";
+ github = "fjallarefur";
+ githubId = 42881386;
+ name = "Alva";
+ keys = [{
+ longkeyid = "ed25519/0xF53E323342F7A6D3";
+ fingerprint = "B422 CFB1 C9EF 73F7 E1E2 698D F53E 3233 42F7 A6D3A";
+ }];
+ };
amar1729 = {
email = "amar.paul16@gmail.com";
github = "amar1729";
@@ -536,12 +558,24 @@
githubId = 56009;
name = "Arcadio Rubio García";
};
+ arcnmx = {
+ email = "arcnmx@users.noreply.github.com";
+ github = "arcnmx";
+ githubId = 13426784;
+ name = "arcnmx";
+ };
ardumont = {
email = "eniotna.t@gmail.com";
github = "ardumont";
githubId = 718812;
name = "Antoine R. Dumont";
};
+ arianvp = {
+ email = "arian.vanputten@gmail.com";
+ github = "arianvp";
+ githubId = 628387;
+ name = "Arian van Putten";
+ };
aristid = {
email = "aristidb@gmail.com";
github = "aristidb";
@@ -570,6 +604,12 @@
fingerprint = "3D2B B230 F9FA F0C5 1832 46DD 4FDC 96F1 61E7 BA8A";
}];
};
+ arthur = {
+ email = "me@arthur.li";
+ github = "arthurl";
+ githubId = 3965744;
+ name = "Arthur Lee";
+ };
artuuge = {
email = "artuuge@gmail.com";
github = "artuuge";
@@ -692,8 +732,18 @@
githubId = 135230;
name = "Aycan iRiCAN";
};
+ b4dm4n = {
+ email = "fabianm88@gmail.com";
+ github = "B4dM4n";
+ githubId = 448169;
+ name = "Fabian Möller";
+ keys = [{
+ longkeyid = "rsa4096/0x754B5C0963C42C5";
+ fingerprint = "6309 E212 29D4 DA30 AF24 BDED 754B 5C09 63C4 2C50";
+ }];
+ };
babariviere = {
- email = "babariviere@protonmail.com";
+ email = "babathriviere@gmail.com";
github = "babariviere";
githubId = 12128029;
name = "babariviere";
@@ -895,6 +945,12 @@
githubId = 5718007;
name = "Bastian Köcher";
};
+ blitz = {
+ email = "js@alien8.de";
+ github = "blitz";
+ githubId = 37907;
+ name = "Julian Stecklina";
+ };
bluescreen303 = {
email = "mathijs@bluescreen303.nl";
github = "bluescreen303";
@@ -1055,6 +1111,12 @@
githubId = 5555066;
name = "Andrew Cann";
};
+ cap = {
+ name = "cap";
+ email = "nixos_xasenw9@digitalpostkasten.de";
+ github = "scaredmushroom";
+ githubId = 45340040;
+ };
carlosdagos = {
email = "m@cdagostino.io";
github = "carlosdagos";
@@ -1109,16 +1171,18 @@
githubId = 977929;
name = "Cody Allen";
};
- cf6b88f = {
- email = "elmo.todurov@eesti.ee";
- name = "Elmo Todurov";
- };
cfouche = {
email = "chaddai.fouche@gmail.com";
github = "Chaddai";
githubId = 5771456;
name = "Chaddaï Fouché";
};
+ cfsmp3 = {
+ email = "carlos@sanz.dev";
+ github = "cfsmp3";
+ githubId = 5949913;
+ name = "Carlos Fernandez Sanz";
+ };
chaduffy = {
email = "charles@dyfis.net";
github = "charles-dyfis-net";
@@ -1165,6 +1229,12 @@
githubId = 30435868;
name = "Okina Matara";
};
+ chkno = {
+ email = "chuck@intelligence.org";
+ github = "chkno";
+ githubId = 1118859;
+ name = "Scott Worley";
+ };
choochootrain = {
email = "hurshal@imap.cc";
github = "choochootrain";
@@ -1219,6 +1289,12 @@
githubId = 3956062;
name = "Simon Lackerbauer";
};
+ cizra = {
+ email = "todurov+nix@gmail.com";
+ github = "cizra";
+ githubId = 2131991;
+ name = "Elmo Todurov";
+ };
ck3d = {
email = "ck3d@gmx.de";
github = "ck3d";
@@ -1336,6 +1412,12 @@
githubId = 1740337;
name = "Chris Ostrouchov";
};
+ contrun = {
+ email = "uuuuuu@protonmail.com";
+ github = "contrun";
+ githubId = 32609395;
+ name = "B YI";
+ };
couchemar = {
email = "couchemar@yandex.ru";
github = "couchemar";
@@ -1348,6 +1430,12 @@
githubId = 411324;
name = "Carles Pagès";
};
+ craigem = {
+ email = "craige@mcwhirter.io";
+ github = "craigem";
+ githubId = 6470493;
+ name = "Craige McWhirter";
+ };
cransom = {
email = "cransom@hubns.net";
github = "cransom";
@@ -1391,7 +1479,7 @@
};
cypherpunk2140 = {
email = "stefan.mihaila@pm.me";
- github = "cypherpunk2140";
+ github = "stefan-mihaila";
githubId = 2217136;
name = "Ștefan D. Mihăilă";
keys = [
@@ -1403,6 +1491,26 @@
}
];
};
+ d-goldin = {
+ email = "dgoldin+github@protonmail.ch";
+ github = "d-goldin";
+ githubId = 43349662;
+ name = "Dima";
+ keys = [{
+ longkeyid = "rsa4096/BAB1D15FB7B4D4CE";
+ fingerprint = "1C4E F4FE 7F8E D8B7 1E88 CCDF BAB1 D15F B7B4 D4CE";
+ }];
+ };
+ dadada = {
+ name = "dadada";
+ email = "dadada@dadada.li";
+ github = "dadada";
+ githubId = 7216772;
+ keys = [{
+ longkeyid = "ed25519/0xEEB8D1CE62C4DFEA";
+ fingerprint = "D68C 8469 5C08 7E0F 733A 28D0 EEB8 D1CE 62C4 DFEA";
+ }];
+ };
dalance = {
email = "dalance@gmail.com";
github = "dalance";
@@ -1427,6 +1535,12 @@
githubId = 245394;
name = "Hannu Hartikainen";
};
+ danderson = {
+ email = "dave@natulte.net";
+ github = "danderson";
+ githubId = 1918;
+ name = "David Anderson";
+ };
danharaj = {
email = "dan@obsidian.systems";
github = "danharaj";
@@ -1478,6 +1592,16 @@
github = "davidrusu";
name = "David Rusu";
};
+ davidtwco = {
+ email = "nix@david.davidtw.co";
+ github = "davidtwco";
+ githubId = 1295100;
+ name = "David Wood";
+ keys = [{
+ longkeyid = "rsa4096/0x01760B4F9F53F154";
+ fingerprint = "5B08 313C 6853 E5BF FA91 A817 0176 0B4F 9F53 F154";
+ }];
+ };
davorb = {
email = "davor@davor.se";
github = "davorb";
@@ -1502,6 +1626,12 @@
githubId = 14032;
name = "Daniel Brockman";
};
+ dduan = {
+ email = "daniel@duan.ca";
+ github = "dduan";
+ githubId = 75067;
+ name = "Daniel Duan";
+ };
deepfire = {
email = "_deepfire@feelingofgreen.ru";
github = "deepfire";
@@ -1643,6 +1773,12 @@
githubId = 1316469;
name = "Naomi Morse";
};
+ dkudriavtsev = {
+ email = "dkudriavtsev@gmail.com";
+ github = "dkudriavtsev";
+ githubId = 9790772;
+ name = "Dmitry Kudriavtsev";
+ };
dmalikov = {
email = "malikov.d.y@gmail.com";
github = "dmalikov";
@@ -1661,6 +1797,12 @@
githubId = 875324;
name = "David Johnson";
};
+ dmrauh = {
+ email = "dmrauh@posteo.de";
+ github = "dmrauh";
+ githubId = 37698547;
+ name = "Dominik Michael Rauh";
+ };
dmvianna = {
email = "dmlvianna@gmail.com";
github = "dmvianna";
@@ -1697,7 +1839,7 @@
name = "Chris Double";
};
dpaetzel = {
- email = "david.a.paetzel@gmail.com";
+ email = "david.paetzel@posteo.de";
github = "dpaetzel";
githubId = 974130;
name = "David Pätzel";
@@ -1863,7 +2005,7 @@
name = "Edward Tjörnhammar";
};
eelco = {
- email = "eelco.dolstra@logicblox.com";
+ email = "edolstra+nixpkgs@gmail.com";
github = "edolstra";
githubId = 1148549;
name = "Eelco Dolstra";
@@ -1875,7 +2017,9 @@
name = "Eric Hegnes";
};
ehmry = {
- email = "emery@vfemail.net";
+ email = "ehmry@posteo.net";
+ github= "ehmry";
+ githubId = 537775;
name = "Emery Hemingway";
};
eikek = {
@@ -1944,6 +2088,12 @@
githubId = 1365692;
name = "Will Fancher";
};
+ elyhaka = {
+ email = "elyhaka@protonmail.com";
+ github = "Elyhaka";
+ githubId = 57923898;
+ name = "Elyhaka";
+ };
emmanuelrosa = {
email = "emmanuel_rosa@aol.com";
github = "emmanuelrosa";
@@ -1961,12 +2111,24 @@
github = "ericnorris";
githubId = 1906605;
};
+ Enteee = {
+ email = "nix@duckpond.ch";
+ github = "Enteee";
+ githubid = 5493775;
+ name = "Ente";
+ };
enzime = {
email = "enzime@users.noreply.github.com";
github = "enzime";
githubId = 10492681;
name = "Michael Hoang";
};
+ eonpatapon = {
+ email = "eon@patapon.info";
+ github = "eonpatapon";
+ githubId = 418227;
+ name = "Jean-Philippe Braun";
+ };
eperuffo = {
email = "info@emanueleperuffo.com";
github = "emanueleperuffo";
@@ -1977,6 +2139,12 @@
email = "mpcervin@uncg.edu";
name = "Mabry Cervin";
};
+ equirosa = {
+ email = "eduardo@eduardoquiros.com";
+ github = "equirosa";
+ githubId = 39096810;
+ name = "Eduardo Quiros";
+ };
eqyiel = {
email = "ruben@maher.fyi";
github = "eqyiel";
@@ -1995,6 +2163,11 @@
githubId = 4828;
name = "Eric Merritt";
};
+ ericdallo = {
+ email = "ercdll1337@gmail.com";
+ github = "ericdallo";
+ name = "Eric Dallo";
+ };
ericsagnes = {
email = "eric.sagnes@gmail.com";
github = "ericsagnes";
@@ -2028,11 +2201,23 @@
githubId = 1583484;
name = "Andrey Golovizin";
};
+ ersin = {
+ email = "me@ersinakinci.com";
+ github = "earksiinni";
+ githubId = 5427394;
+ name = "Ersin Akinci";
+ };
ertes = {
email = "esz@posteo.de";
github = "ertes";
name = "Ertugrul Söylemez";
};
+ esclear = {
+ email = "esclear@users.noreply.github.com";
+ github = "esclear";
+ githubId = 7432848;
+ name = "Daniel Albert";
+ };
Esteth = {
email = "adam.copp@gmail.com";
name = "Adam Copp";
@@ -2065,6 +2250,12 @@
githubId = 195032;
name = "Eric Evenchick";
};
+ evenbrenden = {
+ email = "evenbrenden@gmail.com";
+ github = "evenbrenden";
+ githubId = 2512008;
+ name = "Even Brenden";
+ };
exfalso = {
email = "0slemi0@gmail.com";
github = "exfalso";
@@ -2101,12 +2292,6 @@
githubId = 2817965;
name = "f--t";
};
- fleaz = {
- email = "mail@felixbreidenstein.de";
- github = "fleaz";
- githubId = 2489598;
- name = "Felix Breidenstein";
- };
fadenb = {
email = "tristan.helmich+nixos@gmail.com";
github = "fadenb";
@@ -2147,12 +2332,32 @@
githubId = 8182846;
name = "Francesco Gazzetta";
};
+ filalex77 = {
+ email = "brightone@protonmail.com";
+ github = "filalex77";
+ githubId = 12615679;
+ name = "Oleksii Filonenko";
+ keys = [{
+ longkeyid = "rsa3072/0xA1BC8428323ECFE8";
+ fingerprint = "F549 3B7F 9372 5578 FDD3 D0B8 A1BC 8428 323E CFE8";
+ }];
+ };
FireyFly = {
email = "nix@firefly.nu";
github = "FireyFly";
githubId = 415760;
name = "Jonas Höglund";
};
+ Flakebi = {
+ email = "flakebi@t-online.de";
+ github = "Flakebi";
+ githubId = 6499211;
+ name = "Sebastian Neubauer";
+ keys = [{
+ longkeyid = "rsa4096/0xECC755EE583C1672";
+ fingerprint = "2F93 661D AC17 EA98 A104 F780 ECC7 55EE 583C 1672";
+ }];
+ };
flexw = {
email = "felix.weilbach@t-online.de";
github = "FlexW";
@@ -2237,7 +2442,7 @@
name = "Frede Emil";
};
freepotion = {
- email = "free.potion@yandex.ru";
+ email = "42352817+freepotion@users.noreply.github.com";
github = "freepotion";
githubId = 42352817;
name = "Free Potion";
@@ -2310,6 +2515,12 @@
githubId = 40521440;
name = "Haruka Akiyama";
};
+ fuzen = {
+ email = "me@fuzen.cafe";
+ github = "fuzen-py";
+ githubId = 17859309;
+ name = "Fuzen";
+ };
fuzzy-id = {
email = "hacking+nixos@babibo.de";
name = "Thomas Bach";
@@ -2332,6 +2543,12 @@
githubId = 7047019;
name = "Florent Becker";
};
+ gamb = {
+ email = "adam.gamble@pm.me";
+ github = "gamb";
+ githubId = 293586;
+ name = "Adam Gamble";
+ };
garbas = {
email = "rok@garbas.si";
github = "garbas";
@@ -2348,6 +2565,12 @@
github = "gavinrogers";
name = "Gavin Rogers";
};
+ gazally = {
+ email = "gazally@runbox.com";
+ github = "gazally";
+ githubId = 16470252;
+ name = "Gemini Lasswell";
+ };
gebner = {
email = "gebner@gebner.org";
github = "gebner";
@@ -2490,6 +2713,12 @@
githubId = 9705357;
name = "Guillaume Bouchard";
};
+ GuillaumeDesforges = {
+ email = "aceus02@gmail.com";
+ github = "GuillaumeDesforges";
+ githubId = 1882000;
+ name = "Guillaume Desforges";
+ };
guillaumekoenig = {
email = "guillaume.edward.koenig@gmail.com";
github = "guillaumekoenig";
@@ -2592,6 +2821,11 @@
githubId = 1401179;
name = "Guanpeng Xu";
};
+ hexa = {
+ github = "mweinelt";
+ githubId = 131599;
+ name = "Martin Weinelt";
+ };
hhm = {
email = "heehooman+nixpkgs@gmail.com";
github = "hhm0";
@@ -2602,6 +2836,15 @@
email = "t@larkery.com";
name = "Tom Hinton";
};
+ hkjn = {
+ email = "me@hkjn.me";
+ name = "Henrik Jonsson";
+ github = "hkjn";
+ keys = [{
+ longkeyid = "rsa4096/0x03EFBF839A5FDC15";
+ fingerprint = "D618 7A03 A40A 3D56 62F5 4B46 03EF BF83 9A5F DC15";
+ }];
+ };
hlolli = {
email = "hlolli@gmail.com";
github = "hlolli";
@@ -2650,6 +2893,12 @@
githubId = 69209;
name = "Ian Duncan";
};
+ ianmjones = {
+ email = "ian@ianmjones.com";
+ github = "ianmjones";
+ githubId = 4710;
+ name = "Ian M. Jones";
+ };
ianwookim = {
email = "ianwookim@gmail.com";
github = "wavewave";
@@ -2725,7 +2974,12 @@
infinisil = {
email = "contact@infinisil.com";
github = "infinisil";
+ githubId = 20525370;
name = "Silvan Mosberger";
+ keys = [{
+ longkeyid = "rsa4096/0x422E9EDAE0157170";
+ fingerprint = "6C2B 55D4 4E04 8266 6B7D DA1A 422E 9EDA E015 7170";
+ }];
};
ingenieroariel = {
email = "ariel@nunez.co";
@@ -2739,6 +2993,15 @@
githubId = 137306;
name = "Michele Catalano";
};
+ isgy = {
+ email = "isgy@teiyg.com";
+ github = "isgy";
+ githubId = 13622947;
+ keys = [{
+ longkeyid = "rsa4096/0xD3E1B013B4631293";
+ fingerprint = "1412 816B A9FA F62F D051 1975 D3E1 B013 B463 1293";
+ }];
+ };
ivan = {
email = "ivan@ludios.org";
github = "ivan";
@@ -2787,6 +3050,12 @@
githubId = 26877687;
name = "Yurii Izorkin";
};
+ jacg = {
+ name = "Jacek Generowicz";
+ email = "jacg@my-post-office.net";
+ github = "jacg";
+ githubId = 2570854;
+ };
jasoncarr = {
email = "jcarr250@gmail.com";
github = "jasoncarr0";
@@ -2815,6 +3084,12 @@
githubId = 820715;
name = "Jake Logemann";
};
+ jakestanger = {
+ email = "mail@jstanger.dev";
+ github = "JakeStanger";
+ githubId = 5057870;
+ name = "Jake Stanger";
+ };
jakewaksbaum = {
email = "jake.waksbaum@gmail.com";
github = "jbaum98";
@@ -2882,6 +3157,7 @@
jdanek = {
email = "jdanek@redhat.com";
github = "jdanekrh";
+ githubId = 17877663;
keys = [{
longkeyid = "ed25519/0x69275CADF15D872E";
fingerprint = "D4A6 F051 AD58 2E7C BCED 5439 6927 5CAD F15D 872E";
@@ -2982,6 +3258,11 @@
githubId = 184898;
name = "Jirka Marsik";
};
+ jitwit = {
+ email = "jrn@bluefarm.ca";
+ github = "jitwit";
+ name = "jitwit";
+ };
jlesquembre = {
email = "jl@lafuente.me";
github = "jlesquembre";
@@ -2994,6 +3275,12 @@
githubId = 2195834;
name = "Jaakko Luttinen";
};
+ jm2dev = {
+ email = "jomarcar@gmail.com";
+ github = "jm2dev";
+ githubId = 474643;
+ name = "José Miguel Martínez Carrasco";
+ };
jmagnusj = {
email = "jmagnusj@gmail.com";
github = "magnusjonsson";
@@ -3041,6 +3328,7 @@
joesalisbury = {
email = "salisbury.joseph@gmail.com";
github = "JosephSalisbury";
+ githubId = 297653;
name = "Joe Salisbury";
};
johanot = {
@@ -3106,6 +3394,11 @@
githubId = 392720;
name = "Jon Banafato";
};
+ jonathanmarler = {
+ email = "johnnymarler@gmail.com";
+ github = "marler8997";
+ name = "Jonathan Marler";
+ };
jonathanreeve = {
email = "jon.reeve@gmail.com";
github = "JonathanReeve";
@@ -3189,6 +3482,12 @@
github = "juliendehos";
name = "Julien Dehos";
};
+ jumper149 = {
+ email = "felixspringer149@gmail.com";
+ github = "jumper149";
+ githubId = 39434424;
+ name = "Felix Springer";
+ };
justinwoo = {
email = "moomoowoo@gmail.com";
github = "justinwoo";
@@ -3201,6 +3500,12 @@
githubId = 8460;
name = "John Wiegley";
};
+ jwijenbergh = {
+ email = "jeroenwijenbergh@protonmail.com";
+ github = "jwijenbergh";
+ githubId = 46386452;
+ name = "Jeroen Wijenbergh";
+ };
jwilberding = {
email = "jwilberding@afiniate.com";
name = "Jordan Wilberding";
@@ -3243,6 +3548,12 @@
email = "info+nix@chmist.com";
name = "karolchmist";
};
+ kayhide = {
+ email = "kayhide@gmail.com";
+ github = "kayhide";
+ githubId = 1730718;
+ name = "Hideaki Kawai";
+ };
kazcw = {
email = "kaz@lambdaverse.org";
github = "kazcw";
@@ -3300,6 +3611,7 @@
kim0 = {
email = "email.ahmedkamal@googlemail.com";
github = "kim0";
+ githubId = 59667;
name = "Ahmed Kamal";
};
kimburgess = {
@@ -3323,6 +3635,7 @@
kirikaza = {
email = "k@kirikaza.ru";
github = "kirikaza";
+ githubId = 804677;
name = "Kirill Kazakov";
};
kisonecat = {
@@ -3357,6 +3670,12 @@
github = "klntsky";
githubId = 18447310;
};
+ kmcopper = {
+ email = "kmcopper@danwin1210.me";
+ name = "Kyle Copperfield";
+ github = "kmcopper";
+ githubId = 57132115;
+ };
kmeakin = {
email = "karlwfmeakin@gmail.com";
name = "Karl Meakin";
@@ -3370,7 +3689,11 @@
github = "kmein";
githubId = 10352507;
};
-
+ knairda = {
+ email = "adrian@kummerlaender.eu";
+ name = "Adrian Kummerlaender";
+ github = "KnairdA";
+ };
knedlsepp = {
email = "josef.kemetmueller@gmail.com";
github = "knedlsepp";
@@ -3445,6 +3768,7 @@
ktor = {
email = "kruszewsky@gmail.com";
github = "ktor";
+ githubId = 99639;
name = "Pawel Kruszewski";
};
ktosiek = {
@@ -3459,12 +3783,29 @@
githubId = 449813;
name = "Roman Kuznetsov";
};
+ kylesferrazza = {
+ name = "Kyle Sferrazza";
+ email = "kyle.sferrazza@gmail.com";
+
+ github = "kylesferrazza";
+ githubId = 6677292;
+
+ keys = [{
+ longkeyid = "rsa4096/81A1540948162372";
+ fingerprint = "5A9A 1C9B 2369 8049 3B48 CF5B 81A1 5409 4816 2372";
+ }];
+ };
kylewlacy = {
email = "kylelacy+nix@pm.me";
github = "kylewlacy";
githubId = 1362179;
name = "Kyle Lacy";
};
+ laikq = {
+ email = "gwen@quasebarth.de";
+ github = "laikq";
+ name = "Gwendolyn Quasebarth";
+ };
lasandell = {
email = "lasandell@gmail.com";
github = "lasandell";
@@ -3482,6 +3823,19 @@
github = "Lassulus";
name = "Lassulus";
};
+ lattfein = {
+ email = "lattfein@gmail.com";
+ # Their GitHub account was deleted.
+ #
+ # See: https://github.com/NixOS/nixpkgs/pull/69007 where this
+ # was added but is now owned by a ghost.
+ #
+ # Possibly the username lattfein (currently github ID 56827487) is
+ # owned by the same person, but we should confirm before adding
+ # the GitHub name or ID back.
+ # github = "lattfein";
+ name = "Koki Yasuno";
+ };
layus = {
email = "layus.on@gmail.com";
github = "layus";
@@ -3576,9 +3930,16 @@
githubId = 307589;
name = "Nathaniel Baxter";
};
+ liff = {
+ email = "liff@iki.fi";
+ github = "liff";
+ githubId = 124475;
+ name = "Olli Helenius";
+ };
lightbulbjim = {
email = "chris@killred.net";
github = "lightbulbjim";
+ githubId = 4312404;
name = "Chris Rendle-Short";
};
lightdiscord = {
@@ -3692,6 +4053,22 @@
github = "lovek323";
name = "Jason O'Conal";
};
+ lovesegfault = {
+ email = "meurerbernardo@gmail.com";
+ github = "lovesegfault";
+ githubId = 7243783;
+ name = "Bernardo Meurer";
+ keys = [
+ {
+ longkeyid = "rsa2048/0xE421C74191EA186C";
+ fingerprint = "5894 12CE 19DF 582A E10A 3320 E421 C741 91EA 186C";
+ }
+ {
+ longkeyid = "rsa2048/0x4A6D87A0E7475769";
+ fingerprint = "56A8 E164 E834 290C 4AC0 EE3E 4A6D 87A0 E747 5769";
+ }
+ ];
+ };
lowfatcomputing = {
email = "andreas.wagner@lowfatcomputing.org";
github = "lowfatcomputing";
@@ -3763,6 +4140,11 @@
githubId = 13791;
name = "Luke Gorrie";
};
+ lumi = {
+ email = "lumi@pew.im";
+ github = "lumi-me-not";
+ name = "lumi";
+ };
luz = {
email = "luz666@daum.net";
github = "Luz";
@@ -3848,6 +4230,12 @@
github = "marcweber";
githubId = 34086;
name = "Marc Weber";
+ };
+ marcus7070 = {
+ email = "marcus@geosol.com.au";
+ github = "marcus7070";
+ githubId = 50230945;
+ name = "Marcus Boyd";
};
marenz = {
email = "marenz@arkom.men";
@@ -3934,6 +4322,12 @@
githubId = 427866;
name = "Matthias Beyer";
};
+ matthuszagh = {
+ email = "huszaghmatt@gmail.com";
+ github = "matthuszagh";
+ githubId = 7377393;
+ name = "Matt Huszagh";
+ };
matti-kariluoma = {
email = "matti@kariluo.ma";
github = "matti-kariluoma";
@@ -4147,11 +4541,11 @@
email = "miltador@yandex.ua";
name = "Vasiliy Solovey";
};
- mimadrid = {
- email = "mimadrid@ucm.es";
- github = "mimadrid";
+ mimame = {
+ email = "miguel.madrid.mencia@gmail.com";
+ github = "mimame";
githubId = 3269878;
- name = "Miguel Madrid";
+ name = "Miguel Madrid Mencía";
};
minijackson = {
email = "minijackson@riseup.net";
@@ -4181,18 +4575,43 @@
githubId = 16974598;
name = "Mike Playle";
};
+ mkaito = {
+ email = "chris@mkaito.net";
+ github = "mkaito";
+ githubId = 20434;
+ name = "Christian Höppner";
+ };
mkazulak = {
email = "kazulakm@gmail.com";
github = "mulderr";
githubId = 5698461;
name = "Maciej Kazulak";
};
+ mkf = {
+ email = "m@mikf.pl";
+ github = "mkf";
+ name = "Michał Krzysztof Feiler";
+ keys = [{
+ longkeyid = "rsa4096/0xE35C2D7C2C6AC724";
+ fingerprint = "1E36 9940 CC7E 01C4 CFE8 F20A E35C 2D7C 2C6A C724";
+ }];
+ };
mkg = {
email = "mkg@vt.edu";
github = "mkgvt";
githubId = 22477669;
name = "Mark K Gardner";
};
+ mkg20001 = {
+ email = "mkg20001+nix@gmail.com";
+ github = "mkg20001";
+ githubId = 7735145;
+ name = "Maciej Krüger";
+ keys = [{
+ longkeyid = "rsa4096/0x0D948CE19CF49C5F";
+ fingerprint = "E90C BA34 55B3 6236 740C 038F 0D94 8CE1 9CF4 9C5F";
+ }];
+ };
mlieberman85 = {
email = "mlieberman85@gmail.com";
github = "mlieberman85";
@@ -4205,6 +4624,18 @@
githubId = 104795;
name = "Marek Mahut";
};
+ mmai = {
+ email = "henri.bourcereau@gmail.com";
+ github = "mmai";
+ githubId = 117842;
+ name = "Henri Bourcereau";
+ };
+ mmilata = {
+ email = "martin@martinmilata.cz";
+ github = "mmilata";
+ gitHubId = 85857;
+ name = "Martin Milata";
+ };
mmlb = {
email = "me.mmlb@mmlb.me";
github = "mmlb";
@@ -4262,6 +4693,10 @@
github = "moredread";
githubId = 100848;
name = "André-Patrick Bubel";
+ keys = [{
+ longkeyid = "rsa8192/0x118CE7C424B45728";
+ fingerprint = "4412 38AD CAD3 228D 876C 5455 118C E7C4 24B4 5728";
+ }];
};
moretea = {
email = "maarten@moretea.nl";
@@ -4315,6 +4750,12 @@
githubId = 2881922;
name = "Francis St-Amour";
};
+ mtrsk = {
+ email = "marcos.schonfinkel@protonmail.com";
+ github = "mtrsk";
+ githubId = 16356569;
+ name = "Marcos Benevides";
+ };
mredaelli = {
email = "massimo@typish.io";
github = "mredaelli";
@@ -4352,6 +4793,12 @@
githubId = 437005;
name = "Mikkel Christiansen";
};
+ mschuwalow = {
+ github = "mschuwalow";
+ githubId = 16665913;
+ name = "Maxim Schuwalow";
+ email = "maxim.schuwalow@gmail.com";
+ };
msiedlarek = {
email = "mikolaj@siedlarek.pl";
github = "msiedlarek";
@@ -4462,12 +4909,6 @@
githubId = 364510;
name = "Tobias Geerinckx-Rice";
};
- ndowens = {
- email = "ndowens04@gmail.com";
- github = "ndowens";
- githubId = 117743;
- name = "Nathan Owens";
- };
neeasade = {
email = "nathanisom27@gmail.com";
github = "neeasade";
@@ -4598,6 +5039,12 @@
githubId = 2946283;
name = "Brian Cohen";
};
+ novoxudonoser = {
+ email = "radnovox@gmail.com";
+ github = "novoxudonoser";
+ githubId = 6052922;
+ name = "Kirill Struokov";
+ };
np = {
email = "np.nix@nicolaspouillard.fr";
github = "np";
@@ -4818,6 +5265,12 @@
githubId = 20792;
name = "Sebastian Galkin";
};
+ pashashocky = {
+ email = "pashashocky@gmail.com";
+ github = "pashashocky";
+ githubId = 673857;
+ name = "Pash Shocky";
+ };
pashev = {
email = "pashev.igor@gmail.com";
github = "ip1981";
@@ -4943,6 +5396,16 @@
githubId = 1179566;
name = "Nicolas B. Pierron";
};
+ pingiun = {
+ email = "nixos@pingiun.com";
+ github = "pingiun";
+ githubId = 1576660;
+ name = "Jelle Besseling";
+ keys = [{
+ longkeyid = "rsa4096/0x9712452E8BE3372E";
+ fingerprint = "A3A3 65AE 16ED A7A0 C29C 88F1 9712 452E 8BE3 372E";
+ }];
+ };
piotr = {
email = "ppietrasa@gmail.com";
name = "Piotr Pietraszkiewicz";
@@ -5359,6 +5822,12 @@
github = "rickynils";
name = "Rickard Nilsson";
};
+ rileyinman = {
+ email = "rileyminman@gmail.com";
+ github = "rileyinman";
+ githubId = 37246692;
+ name = "Riley Inman";
+ };
ris = {
email = "code@humanleg.org.uk";
github = "risicle";
@@ -5742,6 +6211,16 @@
githubId = 307899;
name = "Gurkan Gur";
};
+ servalcatty = {
+ email = "servalcat@pm.me";
+ github = "servalcatty";
+ githubid = 51969817;
+ name = "Serval";
+ keys = [{
+ longkeyid = "rsa4096/0x4A2AAAA382F8294C";
+ fingerprint = "A317 37B3 693C 921B 480C C629 4A2A AAA3 82F8 294C";
+ }];
+ };
sfrijters = {
email = "sfrijters@gmail.com";
github = "sfrijters";
@@ -5760,8 +6239,14 @@
githubId = 1151264;
name = "Sebastian Graf";
};
+ shahrukh330 = {
+ email = "shahrukh330@gmail.com";
+ github = "shahrukh330";
+ githubId = 1588288;
+ name = "Shahrukh Khan";
+ };
shanemikel = {
- email = "shanemikel1@gmail.com";
+ email = "shanepearlman@pm.me";
github = "shanemikel";
githubId = 6720672;
name = "Shane Pearlman";
@@ -5811,6 +6296,12 @@
githubId = 819413;
name = "Benedict Aas";
};
+ shyim = {
+ email = "s.sayakci@gmail.com";
+ github = "shyim";
+ githubId = 6224096;
+ name = "Soner Sayakci";
+ };
siddharthist = {
email = "langston.barrett@gmail.com";
github = "langston-barrett";
@@ -5840,6 +6331,16 @@
github = "sikmir";
githubId = 688044;
name = "Nikolay Korotkiy";
+ keys = [{
+ longkeyid = "rsa2048/0xD1DE6D7F693663A5";
+ fingerprint = "ADF4 C13D 0E36 1240 BD01 9B51 D1DE 6D7F 6936 63A5";
+ }];
+ };
+ simonchatts = {
+ email = "code@chatts.net";
+ github = "simonchatts";
+ githubId = 11135311;
+ name = "Simon Chatterjee";
};
simonvandel = {
email = "simon.vandel@gmail.com";
@@ -5934,6 +6435,12 @@
githubId = 1437166;
name = "Xia Bin";
};
+ softinio = {
+ email = "code@softinio.com";
+ github = "softinio";
+ githubId = 3371635;
+ name = "Salar Rahmanian";
+ };
solson = {
email = "scott@solson.me";
github = "solson";
@@ -6138,6 +6645,12 @@
githubId = 120188;
name = "Scott W. Dunlop";
};
+ sweber = {
+ email = "sweber2342+nixpkgs@gmail.com";
+ github = "sweber83";
+ githubId = 19905904;
+ name = "Simon Weber";
+ };
swflint = {
email = "swflint@flintfam.org";
github = "swflint";
@@ -6255,6 +6768,12 @@
githubId = 506181;
name = "Peter Marheine";
};
+ tasmo = {
+ email = "tasmo@tasmo.de";
+ github = "tasmo";
+ githubId = 102685;
+ name = "Thomas Friese";
+ };
tavyc = {
email = "octavian.cerna@gmail.com";
github = "tavyc";
@@ -6354,6 +6873,12 @@
githubId = 42933;
name = "Andrew Childs";
};
+ thefenriswolf = {
+ email = "stefan.rohrbacher97@gmail.com";
+ github = "thefenriswolf";
+ githubId = 8547242;
+ name = "Stefan Rohrbacher";
+ };
thesola10 = {
email = "thesola10@bobile.fr";
github = "thesola10";
@@ -6394,6 +6919,12 @@
githubId = 224674;
name = "Thomas Pham";
};
+ Thra11 = {
+ email = "tahall256@protonmail.ch";
+ github = "Thra11";
+ githubId = 1391883;
+ name = "Tom Hall";
+ };
tilpner = {
email = "till@hoeppner.ws";
github = "tilpner";
@@ -6435,6 +6966,16 @@
githubId = 13026;
name = "Jonathan Rudenberg";
};
+ tkerber = {
+ email = "tk@drwx.org";
+ github = "tkerber";
+ githubId = 5722198;
+ name = "Thomas Kerber";
+ keys = [ {
+ longkeyid = "rsa4096/0x8489B911F9ED617B";
+ fingerprint = "556A 403F B0A2 D423 F656 3424 8489 B911 F9ED 617B";
+ } ];
+ };
tmplt = {
email = "tmplt@dragons.rocks";
github = "tmplt";
@@ -6482,6 +7023,12 @@
githubId = 178444;
name = "Thomas Bereknyei";
};
+ tomfitzhenry = {
+ email = "tom@tom-fitzhenry.me.uk";
+ github = "tomfitzhenry";
+ githubId = 61303;
+ name = "Tom Fitzhenry";
+ };
tomsmeets = {
email = "tom.tsmeets@gmail.com";
github = "tomsmeets";
@@ -6512,6 +7059,12 @@
githubId = 1312290;
name = "Trevor Joynson";
};
+ tricktron = {
+ email = "tgagnaux@gmail.com";
+ github = "tricktron";
+ githubId = 16036882;
+ name = "Thibault Gagnaux";
+ };
trino = {
email = "muehlhans.hubert@ekodia.de";
github = "hmuehlhans";
@@ -6524,6 +7077,11 @@
githubId = 483735;
name = "Dmitry Geurkov";
};
+ tscholak = {
+ email = "torsten.scholak@googlemail.com";
+ github = "tscholak";
+ name = "Torsten Scholak";
+ };
tstrobel = {
email = "4ZKTUB6TEP74PYJOPWIR013S2AV29YUBW5F9ZH2F4D5UMJUJ6S@hash.domains";
name = "Thomas Strobel";
@@ -6636,7 +7194,7 @@
githubId = 1525767;
name = "Vaibhav Sagar";
};
- valebes = {
+ valebes = {
email = "valebes@gmail.com";
github = "valebes";
githubid = 10956211;
@@ -6840,6 +7398,12 @@
email = "kirill.wedens@gmail.com";
name = "wedens";
};
+ WhittlesJr = {
+ email = "alex.joseph.whitt@gmail.com";
+ github = "WhittlesJr";
+ githubId = 19174984;
+ name = "Alex Whitt";
+ };
willibutz = {
email = "willibutz@posteo.de";
github = "willibutz";
@@ -6937,6 +7501,12 @@
githubId = 36407913;
name = "Uli Baum";
};
+ xfix = {
+ email = "konrad@borowski.pw";
+ github = "xfix";
+ githubId = 1297598;
+ name = "Konrad Borowski";
+ };
xnaveira = {
email = "xnaveira@gmail.com";
github = "xnaveira";
@@ -7049,8 +7619,24 @@
githubId = 1866448;
name = "Eric Bailey";
};
- z77z = {
- email = "maggesi@math.unifi.it";
+ Yumasi = {
+ email = "gpagnoux@gmail.com";
+ github = "Yumasi";
+ githubId = 24368641;
+ name = "Guillaume Pagnoux";
+ keys = [{
+ longkeyid = "rsa4096/0xEC5065899AEAAF4C";
+ fingerprint = "85F8 E850 F8F2 F823 F934 535B EC50 6589 9AEA AF4C";
+ }];
+ };
+ yvt = {
+ email = "i@yvt.jp";
+ github = "yvt";
+ githubId = 5253988;
+ name = "yvt";
+ };
+ maggesi = {
+ email = "marco.maggesi@gmail.com";
github = "maggesi";
githubId = 1809783;
name = "Marco Maggesi";
@@ -7094,6 +7680,12 @@
email = "zef@zef.me";
name = "Zef Hemel";
};
+ zfnmxt = {
+ name = "zfnmxt";
+ email = "zfnmxt@zfnmxt.com";
+ github = "zfnmxt";
+ githubId = 37446532;
+ };
zgrannan = {
email = "zgrannan@gmail.com";
github = "zgrannan";
@@ -7166,4 +7758,34 @@
githubId = 1986844;
name = "Daniel Wheeler";
};
+ misuzu = {
+ email = "bakalolka@gmail.com";
+ github = "misuzu";
+ githubId = 248143;
+ name = "misuzu";
+ };
+ zokrezyl = {
+ email = "zokrezyl@gmail.com";
+ github = "zokrezyl";
+ githubId = 51886259;
+ name = "Zokre Zyl";
+ };
+ rakesh4g = {
+ email = "rakeshgupta4u@gmail.com";
+ github = "rakesh4g";
+ githubId = 50867187;
+ name = "Rakesh Gupta";
+ };
+ mlatus = {
+ email = "wqseleven@gmail.com";
+ github = "Ninlives";
+ githubId = 17873203;
+ name = "mlatus";
+ };
+ waiting-for-dev = {
+ email = "marc@lamarciana.com";
+ github = "waiting-for-dev";
+ githubId = 52650;
+ name = "Marc Busqué";
+ };
}
diff --git a/maintainers/scripts/hydra-eval-failures.py b/maintainers/scripts/hydra-eval-failures.py
index 23669502e46d6b6a0e0eaf0248316e8dbf11211a..6e7ec2dbc002d61e97d44ea646f613b580429e76 100755
--- a/maintainers/scripts/hydra-eval-failures.py
+++ b/maintainers/scripts/hydra-eval-failures.py
@@ -11,13 +11,15 @@ import click
import requests
from pyquery import PyQuery as pq
+def map_dict (f, d):
+ for k,v in d.items():
+ d[k] = f(v)
maintainers_json = subprocess.check_output([
- 'nix-instantiate', '-E', 'import ./maintainers/maintainer-list.nix {}', '--eval', '--json'
+ 'nix-instantiate', '-A', 'lib.maintainers', '--eval', '--strict', '--json'
])
maintainers = json.loads(maintainers_json)
-MAINTAINERS = {v: k for k, v in maintainers.items()}
-
+MAINTAINERS = map_dict(lambda v: v.get('github', None), maintainers)
def get_response_text(url):
return pq(requests.get(url).text) # IO
@@ -38,30 +40,39 @@ def get_maintainers(attr_name):
'-A',
'.'.join(nixname[1:]) + '.meta',
EVAL_FILE[nixname[0]],
+ '--arg',
+ 'nixpkgs',
+ './.',
'--json'])
meta = json.loads(meta_json)
- if meta.get('maintainers'):
- return [MAINTAINERS[name] for name in meta['maintainers'] if MAINTAINERS.get(name)]
+ return meta.get('maintainers', [])
except:
return []
+def filter_github_users(maintainers):
+ github_only = []
+ for i in maintainers:
+ if i.get('github'):
+ github_only.append(i)
+ return github_only
+
def print_build(table_row):
a = pq(table_row)('a')[1]
print("- [ ] [{}]({})".format(a.text, a.get('href')), flush=True)
-
- maintainers = get_maintainers(a.text)
- if maintainers:
- print(" - maintainers: {}".format(", ".join(map(lambda u: '@' + u, maintainers))))
+
+ job_maintainers = filter_github_users(get_maintainers(a.text))
+ if job_maintainers:
+ print(" - maintainers: {}".format(" ".join(map(lambda u: '@' + u.get('github'), job_maintainers))))
# TODO: print last three persons that touched this file
# TODO: pinpoint the diff that broke this build, or maybe it's transient or maybe it never worked?
-
+
sys.stdout.flush()
@click.command()
@click.option(
'--jobset',
- default="nixos/release-17.09",
- help='Hydra project like nixos/release-17.09')
+ default="nixos/release-19.09",
+ help='Hydra project like nixos/release-19.09')
def cli(jobset):
"""
Given a Hydra project, inspect latest evaluation
@@ -93,6 +104,7 @@ def cli(jobset):
print_build(tr)
+
if __name__ == "__main__":
try:
cli()
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index a6fbcd5a0beb6221bf11489163aa84cfb057ba71..526a928438d27da322042ddd4fd741af49b89b8f 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -37,14 +37,17 @@ lua-zlib,,,,,koral
lua_cliargs,,,,,
luabitop,,,,,
luacheck,,,,,
+luacov,,,,,
luadbi,,,,,
luadbi-mysql,,,,,
luadbi-postgresql,,,,,
luadbi-sqlite3,,,,,
+luadoc,,,,,
luaevent,,,,,
luaexpat,,,1.3.0-1,,arobyn flosse
luaffi,,http://luarocks.org/dev,,,
luafilesystem,,,1.7.0-2,,flosse vcunat
+lualogging,,,,,
luaossl,,,,lua5_1,vcunat
luaposix,,,,,vyp lblasc
luasec,,,,,flosse
@@ -68,3 +71,4 @@ say,,,,,
std__debug,std._debug,,,,
std_normalize,std.normalize,,,,
stdlib,,,,,vyp
+pulseaudio,,,,,doronbehar
diff --git a/maintainers/scripts/nix-generate-from-cpan.pl b/maintainers/scripts/nix-generate-from-cpan.pl
index 2dda39fd12e143ba3fb981b85258a009c887826b..e04d3713e9a1b8b55747fa2b6e22da28fb9df0cd 100755
--- a/maintainers/scripts/nix-generate-from-cpan.pl
+++ b/maintainers/scripts/nix-generate-from-cpan.pl
@@ -226,7 +226,7 @@ sub pkg_to_attr {
sub get_pkg_name {
my ($module) = @_;
- return $module->package_name . '-' . $module->package_version;
+ return ( $module->package_name, $module->package_version =~ s/^v(\d)/$1/r );
}
sub read_meta {
@@ -375,13 +375,13 @@ die "module $module_name not found\n" if scalar @modules == 0;
die "multiple packages that match module $module_name\n" if scalar @modules > 1;
my $module = $modules[0];
-my $pkg_name = get_pkg_name $module;
+my ($pkg_name, $pkg_version) = get_pkg_name $module;
my $attr_name = pkg_to_attr $module;
INFO( "attribute name: ", $attr_name );
INFO( "module: ", $module->module );
INFO( "version: ", $module->version );
-INFO( "package: ", $module->package, " (", $pkg_name, ", ", $attr_name, ")" );
+INFO( "package: ", $module->package, " (", "$pkg_name-$pkg_version", ", ", $attr_name, ")" );
INFO( "path: ", $module->path );
my $tar_path = $module->fetch();
@@ -436,10 +436,11 @@ my $build_fun = -e "$pkg_path/Build.PL"
print STDERR "===\n";
print <${1:?usage: $0 }
cat <
{
=
- [ { hostName = "example.org";
- documentRoot = "/webroot";
+ { "blog.example.org" = {
+ documentRoot = "/webroot/blog.example.org";
adminAddr = "alice@example.org";
- enableUserDir = true;
- }
- { hostName = "example.org";
- documentRoot = "/webroot";
+ forceSSL = true;
+ enableACME = true;
+ enablePHP = true;
+ };
+ "wiki.example.org" = {
+ documentRoot = "/webroot/wiki.example.org";
adminAddr = "alice@example.org";
- enableUserDir = true;
- enableSSL = true;
- sslServerCert = "/root/ssl-example-org.crt";
- sslServerKey = "/root/ssl-example-org.key";
- }
- ];
+ forceSSL = true;
+ enableACME = true;
+ enablePHP = true;
+ };
+ };
}
It defines two virtual hosts with nearly identical configuration; the only
- difference is that the second one has SSL enabled. To prevent this
+ difference is the document root directories. To prevent this
duplication, we can use a let:
let
- exampleOrgCommon =
- { hostName = "example.org";
- documentRoot = "/webroot";
- adminAddr = "alice@example.org";
- enableUserDir = true;
+ commonConfig =
+ { adminAddr = "alice@example.org";
+ forceSSL = true;
+ enableACME = true;
};
in
{
=
- [ exampleOrgCommon
- (exampleOrgCommon // {
- enableSSL = true;
- sslServerCert = "/root/ssl-example-org.crt";
- sslServerKey = "/root/ssl-example-org.key";
- })
- ];
+ { "blog.example.org" = (commonConfig // { documentRoot = "/webroot/blog.example.org"; });
+ "wiki.example.org" = (commonConfig // { documentRoot = "/webroot/wiki.example.com"; });
+ };
}
- The let exampleOrgCommon = ...
- defines a variable named exampleOrgCommon. The
+ The let commonConfig = ...
+ defines a variable named commonConfig. The
// operator merges two attribute sets, so the
configuration of the second virtual host is the set
- exampleOrgCommon extended with the SSL options.
+ commonConfig extended with the document root option.
@@ -63,13 +59,13 @@ in
{
=
- let exampleOrgCommon = ...; in
- [ exampleOrgCommon
- (exampleOrgCommon // { ... })
- ];
+ let commonConfig = ...; in
+ { "blog.example.org" = (commonConfig // { ... })
+ "wiki.example.org" = (commonConfig // { ... })
+ };
}
- but not { let exampleOrgCommon = ...; in
+ but not { let commonConfig = ...; in
...; } since attributes (as opposed to
attribute values) are not expressions.
@@ -77,80 +73,29 @@ in
Functions provide another method of abstraction. For
instance, suppose that we want to generate lots of different virtual hosts,
- all with identical configuration except for the host name. This can be done
+ all with identical configuration except for the document root. This can be done
as follows:
{
=
let
- makeVirtualHost = name:
- { hostName = name;
- documentRoot = "/webroot";
+ makeVirtualHost = webroot:
+ { documentRoot = webroot;
adminAddr = "alice@example.org";
+ forceSSL = true;
+ enableACME = true;
};
in
- [ (makeVirtualHost "example.org")
- (makeVirtualHost "example.com")
- (makeVirtualHost "example.gov")
- (makeVirtualHost "example.nl")
- ];
+ { "example.org" = (makeVirtualHost "/webroot/example.org");
+ "example.com" = (makeVirtualHost "/webroot/example.com");
+ "example.gov" = (makeVirtualHost "/webroot/example.gov");
+ "example.nl" = (makeVirtualHost "/webroot/example.nl");
+ };
}
Here, makeVirtualHost is a function that takes a single
- argument name and returns the configuration for a virtual
+ argument webroot and returns the configuration for a virtual
host. That function is then called for several names to produce the list of
virtual host configurations.
-
-
- We can further improve on this by using the function map,
- which applies another function to every element in a list:
-
-{
- =
- let
- makeVirtualHost = ...;
- in map makeVirtualHost
- [ "example.org" "example.com" "example.gov" "example.nl" ];
-}
-
- (The function map is called a higher-order
- function because it takes another function as an argument.)
-
-
-
- What if you need more than one argument, for instance, if we want to use a
- different documentRoot for each virtual host? Then we can
- make makeVirtualHost a function that takes a
- set as its argument, like this:
-
-{
- =
- let
- makeVirtualHost = { name, root }:
- { hostName = name;
- documentRoot = root;
- adminAddr = "alice@example.org";
- };
- in map makeVirtualHost
- [ { name = "example.org"; root = "/sites/example.org"; }
- { name = "example.com"; root = "/sites/example.com"; }
- { name = "example.gov"; root = "/sites/example.gov"; }
- { name = "example.nl"; root = "/sites/example.nl"; }
- ];
-}
-
- But in this case (where every root is a subdirectory of
- /sites named after the virtual host), it would have been
- shorter to define makeVirtualHost as
-
-makeVirtualHost = name:
- { hostName = name;
- documentRoot = "/sites/${name}";
- adminAddr = "alice@example.org";
- };
-
- Here, the construct ${...}
- allows the result of an expression to be spliced into a string.
-
diff --git a/nixos/doc/manual/configuration/config-file.xml b/nixos/doc/manual/configuration/config-file.xml
index eadafb94b8f6d1b3aabdbbe6c50ffbec236184c4..7ccb5b3664ea340e6734af819df7f3a3a0bcc79e 100644
--- a/nixos/doc/manual/configuration/config-file.xml
+++ b/nixos/doc/manual/configuration/config-file.xml
@@ -27,7 +27,7 @@
{ = true;
= "alice@example.org";
- = "/webroot";
+ services.httpd.virtualHosts.localhost.documentRoot = "/webroot";
}
defines a configuration with three option definitions that together enable
@@ -50,7 +50,11 @@
httpd = {
enable = true;
adminAddr = "alice@example.org";
- documentRoot = "/webroot";
+ virtualHosts = {
+ localhost = {
+ documentRoot = "/webroot";
+ };
+ };
};
};
}
diff --git a/nixos/doc/manual/configuration/profiles/graphical.xml b/nixos/doc/manual/configuration/profiles/graphical.xml
index 73e3abc59d0cc33101c07a25115b530cf6ec7ab0..cc6d0825d241e7ad02a83ab808bb0e96439e9853 100644
--- a/nixos/doc/manual/configuration/profiles/graphical.xml
+++ b/nixos/doc/manual/configuration/profiles/graphical.xml
@@ -13,9 +13,7 @@
It sets ,
,
- (
-
- without Qt4 Support), and
+ , and
to true. It also
includes glxinfo and firefox in the system packages list.
diff --git a/nixos/doc/manual/configuration/wireless.xml b/nixos/doc/manual/configuration/wireless.xml
index 9c0e3a8d7aa4fb649111409a3b360102bfcef7d9..247d29d5831499f0b68a76fd4b62f42d733a1eeb 100644
--- a/nixos/doc/manual/configuration/wireless.xml
+++ b/nixos/doc/manual/configuration/wireless.xml
@@ -19,10 +19,17 @@
NixOS lets you specify networks for wpa_supplicant declaratively:
= {
- echelon = {
+ echelon = { # SSID with no spaces or special characters
psk = "abcdefgh";
};
- "free.wifi" = {};
+ "echelon's AP" = { # SSID with spaces and/or special characters
+ psk = "ijklmnop";
+ };
+ echelon = { # Hidden SSID
+ hidden = true;
+ psk = "qrstuvwx";
+ };
+ free.wifi = {}; # Public wireless network
};
Be aware that keys will be written to the nix store in plaintext! When no
diff --git a/nixos/doc/manual/configuration/x-windows.xml b/nixos/doc/manual/configuration/x-windows.xml
index f6f659b02afa6534dfebc435122581b2d9e2fd10..55ad9fe6e6530b76cb847834edf83154a45c60e8 100644
--- a/nixos/doc/manual/configuration/x-windows.xml
+++ b/nixos/doc/manual/configuration/x-windows.xml
@@ -39,7 +39,7 @@
can select an alternative one by picking one of the following lines:
= true;
- = true;
+ = true;
@@ -83,8 +83,7 @@
desktop environment. If you wanted no desktop environment and i3 as your your
window manager, you'd define:
- = "none";
- = "i3";
+ = "none+i3";
And, finally, to enable auto-login for a user johndoe:
diff --git a/nixos/doc/manual/configuration/xfce.xml b/nixos/doc/manual/configuration/xfce.xml
index 6ac99c6b2bee4d8af9af202e1a36311b27b3238c..027828bb936d663d59d854279a5b26823440391e 100644
--- a/nixos/doc/manual/configuration/xfce.xml
+++ b/nixos/doc/manual/configuration/xfce.xml
@@ -7,9 +7,8 @@
To enable the Xfce Desktop Environment, set
-services.xserver.desktopManager = {
- xfce.enable = true;
- default = "xfce";
+ = true;
+ = "xfce";
};
diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index f9de2db1a084376fe6dbbae8328b8063b8d25bbb..6ca75f869f45c475b7475039e83dca7ff84e3bdb 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -62,14 +62,13 @@ let
"--stringparam html.stylesheet 'style.css overrides.css highlightjs/mono-blue.css'"
"--stringparam html.script './highlightjs/highlight.pack.js ./highlightjs/loader.js'"
"--param xref.with.number.and.title 1"
- "--param toc.section.depth 3"
+ "--param toc.section.depth 0"
"--stringparam admon.style ''"
"--stringparam callout.graphics.extension .svg"
"--stringparam current.docid manual"
"--param chunk.section.depth 0"
"--param chunk.first.sections 1"
"--param use.id.as.filename 1"
- "--stringparam generate.toc 'book toc appendix toc'"
"--stringparam chunk.toc ${toc}"
];
diff --git a/nixos/doc/manual/development/option-declarations.xml b/nixos/doc/manual/development/option-declarations.xml
index eee81bf64263802d3fece3f36e6d085cdd094473..56ebf4816306e1cfbf0330bc7d1e226ac84d4c6c 100644
--- a/nixos/doc/manual/development/option-declarations.xml
+++ b/nixos/doc/manual/development/option-declarations.xml
@@ -99,7 +99,7 @@ xlink:href="https://nixos.org/nixpkgs/manual/#sec-package-naming">
As an example, we will take the case of display managers. There is a central
display manager module for generic display manager options and a module file
- per display manager backend (slim, sddm, gdm ...).
+ per display manager backend (sddm, gdm ...).
@@ -146,7 +146,7 @@ xlink:href="https://nixos.org/nixpkgs/manual/#sec-package-naming">
/>), and to extend
it in each backend module
(,
+ linkend='ex-option-declaration-eot-backend-gdm' />,
).
@@ -167,11 +167,11 @@ services.xserver.displayManager.enable = mkOption {
};
-
- Extending services.xserver.displayManager.enable in the slim module
+
+ Extending services.xserver.displayManager.enable in the gdm module
services.xserver.displayManager.enable = mkOption {
- type = with types; nullOr (enum [ "slim" ]);
+ type = with types; nullOr (enum [ "gdm" ]);
};
diff --git a/nixos/doc/manual/development/releases.xml b/nixos/doc/manual/development/releases.xml
index 1cdec64f69b045295f8f501dd763d2e0cf07eea1..9371af9984d1d3948e831a5f6f70b175a1536d02 100755
--- a/nixos/doc/manual/development/releases.xml
+++ b/nixos/doc/manual/development/releases.xml
@@ -45,12 +45,12 @@
git tag -a -s -m "Release 17.09-beta" 17.09-beta
- && git push --tags
+ && git push origin 17.09-beta
- From the master branch run git checkout -B
+ From the master branch run git checkout -b
release-17.09.
@@ -157,7 +157,7 @@
Release Nix (currently only Eelco Dolstra can do that).
-
+
Make sure fallback is updated.
@@ -169,8 +169,8 @@
- Change stableBranch to true and wait for channel to
- update.
+ Change stableBranch to true in Hydra and wait for
+ the channel to update.
@@ -193,9 +193,11 @@
- Update http://nixos.org/nixos/download.html and
- http://nixos.org/nixos/manual in
- https://github.com/NixOS/nixos-org-configurations
+ Update the
+ NIXOS_SERIES
+ in the
+ nixos-homepage
+ repository.
@@ -212,7 +214,8 @@
- Send an email to nix-dev to announce the release with above information.
+ Create a new topic on the
+ Discourse instance to announce the release with the above information.
Best to check how previous email was formulated to see what needs to be
included.
diff --git a/nixos/doc/manual/development/running-nixos-tests-interactively.xml b/nixos/doc/manual/development/running-nixos-tests-interactively.xml
index e390d62fde2f80b3f0851aaf398661450662b38c..31216874c7060221e1b965a96e7c7b366079ab6f 100644
--- a/nixos/doc/manual/development/running-nixos-tests-interactively.xml
+++ b/nixos/doc/manual/development/running-nixos-tests-interactively.xml
@@ -2,7 +2,7 @@
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
- xml:id="sec-running-nixos-tests">
+ xml:id="sec-running-nixos-tests-interactively">
Running Tests interactively
@@ -14,14 +14,14 @@
starting VDE switch for network 1
>
- You can then take any Perl statement, e.g.
+ You can then take any Python statement, e.g.
-> startAll
-> testScript
-> $machine->succeed("touch /tmp/foo")
-> print($machine->succeed("pwd")) # Show stdout of command
+> start_all()
+> test_script()
+> machine.succeed("touch /tmp/foo")
+> print(machine.succeed("pwd")) # Show stdout of command
- The function testScript executes the entire test script
+ The function test_script executes the entire test script
and drops you back into the test driver command line upon its completion.
This allows you to inspect the state of the VMs after the test (e.g. to debug
the test script).
diff --git a/nixos/doc/manual/development/running-nixos-tests.xml b/nixos/doc/manual/development/running-nixos-tests.xml
index 13ae1ed9369998c872a452c769533b41ed7dcdfc..e9257c907daf32b8bc42968f4d586887a2f350bc 100644
--- a/nixos/doc/manual/development/running-nixos-tests.xml
+++ b/nixos/doc/manual/development/running-nixos-tests.xml
@@ -2,7 +2,7 @@
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
- xml:id="sec-running-nixos-tests-interactively">
+ xml:id="sec-running-nixos-tests">
Running Tests
diff --git a/nixos/doc/manual/development/sources.xml b/nixos/doc/manual/development/sources.xml
index 3c30c782746df4ab9180803882adbf29542ff0bb..b333ccabb420afb2066799b0a250528b54d42430 100644
--- a/nixos/doc/manual/development/sources.xml
+++ b/nixos/doc/manual/development/sources.xml
@@ -13,17 +13,16 @@
$ git clone https://github.com/NixOS/nixpkgs
$ cd nixpkgs
-$ git remote add channels https://github.com/NixOS/nixpkgs-channels
-$ git remote update channels
+$ git remote update origin
This will check out the latest Nixpkgs sources to
./nixpkgs the NixOS sources to
./nixpkgs/nixos. (The NixOS source tree lives in a
- subdirectory of the Nixpkgs repository.) The remote
- channels refers to a read-only repository that tracks the
- Nixpkgs/NixOS channels (see for more
+ subdirectory of the Nixpkgs repository.) The
+ nixpkgs repository has branches that correspond
+ to each Nixpkgs/NixOS channel (see for more
information about channels). Thus, the Git branch
- channels/nixos-17.03 will contain the latest built and
+ origin/nixos-17.03 will contain the latest built and
tested version available in the nixos-17.03 channel.
@@ -40,15 +39,15 @@
Or, to base your local branch on the latest version available in a NixOS
channel:
-$ git remote update channels
-$ git checkout -b local channels/nixos-17.03
+$ git remote update origin
+$ git checkout -b local origin/nixos-17.03
(Replace nixos-17.03 with the name of the channel you want
to use.) You can use git merge or git
rebase to keep your local branch in sync with the channel, e.g.
-$ git remote update channels
-$ git merge channels/nixos-17.03
+$ git remote update origin
+$ git merge origin/nixos-17.03
You can use git cherry-pick to copy commits from your
local branch to the upstream branch.
diff --git a/nixos/doc/manual/development/writing-nixos-tests.xml b/nixos/doc/manual/development/writing-nixos-tests.xml
index 6be2d0a4d231f62c78d6c198d1663b5b948e0c4f..e5a887c18c7709e7accc26508f519a719dc58ebe 100644
--- a/nixos/doc/manual/development/writing-nixos-tests.xml
+++ b/nixos/doc/manual/development/writing-nixos-tests.xml
@@ -8,7 +8,7 @@
A NixOS test is a Nix expression that has the following structure:
-import ./make-test.nix {
+import ./make-test-python.nix {
# Either the configuration of a single machine:
machine =
@@ -27,11 +27,11 @@ import ./make-test.nix {
testScript =
''
- Perl code…
+ Python code…
'';
}
- The attribute testScript is a bit of Perl code that
+ The attribute testScript is a bit of Python code that
executes the test (described below). During the test, it will start one or
more virtual machines, the configuration of which is described by the
attribute machine (if you need only one machine in your
@@ -96,26 +96,27 @@ xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/virtualis
- The test script is a sequence of Perl statements that perform various
+ The test script is a sequence of Python statements that perform various
actions, such as starting VMs, executing commands in the VMs, and so on. Each
virtual machine is represented as an object stored in the variable
- $name, where
- name is the identifier of the machine (which is
- just machine if you didn’t specify multiple machines
- using the nodes attribute). For instance, the following
- starts the machine, waits until it has finished booting, then executes a
- command and checks that the output is more-or-less correct:
+ name if this is also the
+ identifier of the machine in the declarative config.
+ If you didn't specify multiple machines using the nodes
+ attribute, it is just machine.
+ The following example starts the machine, waits until it has finished booting,
+ then executes a command and checks that the output is more-or-less correct:
-$machine->start;
-$machine->waitForUnit("default.target");
-$machine->succeed("uname") =~ /Linux/ or die;
+machine.start()
+machine.wait_for_unit("default.target")
+if not "Linux" in machine.succeed("uname"):
+ raise Exception("Wrong OS")
The first line is actually unnecessary; machines are implicitly started when
- you first execute an action on them (such as waitForUnit
+ you first execute an action on them (such as wait_for_unit
or succeed). If you have multiple machines, you can speed
up the test by starting them in parallel:
-startAll;
+start_all()
@@ -187,7 +188,7 @@ startAll;
- getScreenText
+ get_screen_text
@@ -204,7 +205,7 @@ startAll;
- sendMonitorCommand
+ send_monitor_command
@@ -215,23 +216,23 @@ startAll;
- sendKeys
+ send_keys
Simulate pressing keys on the virtual keyboard, e.g.,
- sendKeys("ctrl-alt-delete").
+ send_keys("ctrl-alt-delete").
- sendChars
+ send_chars
Simulate typing a sequence of characters on the virtual keyboard, e.g.,
- sendKeys("foobar\n") will type the string
+ send_keys("foobar\n") will type the string
foobar followed by the Enter key.
@@ -272,7 +273,7 @@ startAll;
- waitUntilSucceeds
+ wait_until_succeeds
@@ -282,7 +283,7 @@ startAll;
- waitUntilFails
+ wait_until_fails
@@ -292,7 +293,7 @@ startAll;
- waitForUnit
+ wait_for_unit
@@ -302,7 +303,7 @@ startAll;
- waitForFile
+ wait_for_file
@@ -312,7 +313,7 @@ startAll;
- waitForOpenPort
+ wait_for_open_port
@@ -323,7 +324,7 @@ startAll;
- waitForClosedPort
+ wait_for_closed_port
@@ -333,7 +334,7 @@ startAll;
- waitForX
+ wait_for_x
@@ -343,13 +344,13 @@ startAll;
- waitForText
+ wait_for_text
Wait until the supplied regular expressions matches the textual contents
of the screen by using optical character recognition (see
- getScreenText).
+ get_screen_text).
@@ -361,23 +362,23 @@ startAll;
- waitForWindow
+ wait_for_window
Wait until an X11 window has appeared whose name matches the given
- regular expression, e.g., waitForWindow(qr/Terminal/).
+ regular expression, e.g., wait_for_window("Terminal").
- copyFileFromHost
+ copy_file_from_host
Copies a file from host to machine, e.g.,
- copyFileFromHost("myfile", "/etc/my/important/file").
+ copy_file_from_host("myfile", "/etc/my/important/file").
The first argument is the file on the host. The file needs to be
@@ -397,8 +398,8 @@ startAll;
-$machine->systemctl("list-jobs --no-pager"); // runs `systemctl list-jobs --no-pager`
-$machine->systemctl("list-jobs --no-pager", "any-user"); // spawns a shell for `any-user` and runs `systemctl --user list-jobs --no-pager`
+machine.systemctl("list-jobs --no-pager") # runs `systemctl list-jobs --no-pager`
+machine.systemctl("list-jobs --no-pager", "any-user") # spawns a shell for `any-user` and runs `systemctl --user list-jobs --no-pager`
@@ -408,14 +409,33 @@ $machine->systemctl("list-jobs --no-pager", "any-user"); // spawns a shell for `
To test user units declared by systemd.user.services the
- optional $user argument can be used:
+ optional user argument can be used:
-$machine->start;
-$machine->waitForX;
-$machine->waitForUnit("xautolock.service", "x-session-user");
+machine.start()
+machine.wait_for_x()
+machine.wait_for_unit("xautolock.service", "x-session-user")
+
+ This applies to systemctl, get_unit_info,
+ wait_for_unit, start_job and
+ stop_job.
+
+
+
+ For faster dev cycles it's also possible to disable the code-linters (this shouldn't
+ be commited though):
+
+import ./make-test-python.nix {
+ skipLint = true;
+ machine =
+ { config, pkgs, ... }:
+ { configuration…
+ };
+
+ testScript =
+ ''
+ Python code…
+ '';
+}
- This applies to systemctl, getUnitInfo,
- waitForUnit, startJob and
- stopJob.
diff --git a/nixos/doc/manual/installation/installing-virtualbox-guest.xml b/nixos/doc/manual/installation/installing-virtualbox-guest.xml
index 5c86eacfbf45c509e21815a56c749a41151ab952..0ba909fa953fb60f78c1e66b4e466baf51af0ead 100644
--- a/nixos/doc/manual/installation/installing-virtualbox-guest.xml
+++ b/nixos/doc/manual/installation/installing-virtualbox-guest.xml
@@ -47,6 +47,11 @@
acceleration
+
+
+ Click on Settings / Display / Screen and select VBoxVGA as Graphics Controller
+
+
Save the settings, start the virtual machine, and continue installation
diff --git a/nixos/doc/manual/installation/installing.xml b/nixos/doc/manual/installation/installing.xml
index 9cea2db610e0d85d9b10c484cac9a39e79738d68..4041b4ad163a96ab9ac5485eb2374d9e42644526 100644
--- a/nixos/doc/manual/installation/installing.xml
+++ b/nixos/doc/manual/installation/installing.xml
@@ -68,7 +68,7 @@
If you would like to continue the installation from a different machine you
need to activate the SSH daemon via systemctl start
sshd. You then must set a password for either root or
- nixos with passwd> to be able to login.
+ nixos with passwd to be able to login.
@@ -380,7 +380,10 @@
If you need to configure networking for your machine the configuration
- options are described in .
+ options are described in . In particular,
+ while wifi is supported on the installation image, it is not enabled by
+ default in the configuration generated by
+ nixos-generate-config.
Another critical option is , specifying the
@@ -392,7 +395,11 @@
hardware-configuration.nix is included from
configuration.nix and will be overwritten by future
invocations of nixos-generate-config; thus, you
- generally should not modify it.)
+ generally should not modify it.) Additionally, you may want to look at
+ Hardware
+ configuration for known-hardware at this point or after
+ installation.
+
@@ -414,11 +421,11 @@
Do the installation:
# nixos-install
- Cross fingers. If this fails due to a temporary problem (such as a network
- issue while downloading binaries from the NixOS binary cache), you can
- just re-run nixos-install. Otherwise, fix your
- configuration.nix and then re-run
- nixos-install.
+ This will install your system based on the configuration you provided.
+ If anything fails due to a configuration problem or any other issue
+ (such as a network outage while downloading binaries from the NixOS
+ binary cache), you can re-run nixos-install after
+ fixing your configuration.nix.
As the last step, nixos-install will ask you to set the
@@ -471,7 +478,7 @@ Retype new UNIX password: ***
shows what packages are available, and
$ nix-env -f '<nixpkgs>' -iA w3m
- install the w3m browser.
+ installs the w3m browser.
diff --git a/nixos/doc/manual/installation/upgrading.xml b/nixos/doc/manual/installation/upgrading.xml
index 35b4d266e12efa5c29e33f30e680d99d51aaedc8..8d3f35b7c26f4e34cd75abb769e2c51d8f1ef0dd 100644
--- a/nixos/doc/manual/installation/upgrading.xml
+++ b/nixos/doc/manual/installation/upgrading.xml
@@ -14,7 +14,7 @@
Stable channels, such as
nixos-19.03.
+ xlink:href="https://nixos.org/channels/nixos-19.09">nixos-19.09.
These only get conservative bug fixes and package upgrades. For instance,
a channel update may cause the Linux kernel on your system to be upgraded
from 4.19.34 to 4.19.38 (a minor bug fix), but not from
@@ -38,7 +38,7 @@
Small channels, such as
nixos-19.03-small
+ xlink:href="https://nixos.org/channels/nixos-19.09-small">nixos-19.09-small
or
nixos-unstable-small.
@@ -63,8 +63,8 @@
When you first install NixOS, you’re automatically subscribed to the NixOS
channel that corresponds to your installation source. For instance, if you
- installed from a 19.03 ISO, you will be subscribed to the
- nixos-19.03 channel. To see which NixOS channel you’re
+ installed from a 19.09 ISO, you will be subscribed to the
+ nixos-19.09 channel. To see which NixOS channel you’re
subscribed to, run the following as root:
# nix-channel --list | grep nixos
@@ -75,13 +75,13 @@ nixos https://nixos.org/channels/nixos-unstable
# nix-channel --add https://nixos.org/channels/channel-name nixos
(Be sure to include the nixos parameter at the end.) For
- instance, to use the NixOS 19.03 stable channel:
+ instance, to use the NixOS 19.09 stable channel:
-# nix-channel --add https://nixos.org/channels/nixos-19.03 nixos
+# nix-channel --add https://nixos.org/channels/nixos-19.09 nixos
If you have a server, you may want to use the “small” channel instead:
-# nix-channel --add https://nixos.org/channels/nixos-19.03-small nixos
+# nix-channel --add https://nixos.org/channels/nixos-19.09-small nixos
And if you want to live on the bleeding edge:
@@ -127,7 +127,7 @@ nixos https://nixos.org/channels/nixos-unstable
current channel. (To see when the service runs, see systemctl
list-timers.) You can also specify a channel explicitly, e.g.
- = https://nixos.org/channels/nixos-19.03;
+ = https://nixos.org/channels/nixos-19.09;
diff --git a/nixos/doc/manual/man-configuration.xml b/nixos/doc/manual/man-configuration.xml
index 9f30b79251017882edb973b8c4f0104485654ca2..ddb1408fdcf59a31bc6fd55c971a4f426fce4b77 100644
--- a/nixos/doc/manual/man-configuration.xml
+++ b/nixos/doc/manual/man-configuration.xml
@@ -8,8 +8,8 @@
- configuration.nix
- NixOS system configuration specification
+ configuration.nix
+ NixOS system configuration specificationDescription
diff --git a/nixos/doc/manual/man-nixos-build-vms.xml b/nixos/doc/manual/man-nixos-build-vms.xml
index 7d6e04e0dd90bbf056bb6070adcc71989cc6a0b6..d114261f53bef32704fa670342ee25808b6f8a1b 100644
--- a/nixos/doc/manual/man-nixos-build-vms.xml
+++ b/nixos/doc/manual/man-nixos-build-vms.xml
@@ -8,8 +8,8 @@
- nixos-build-vms
- build a network of virtual machines from a network of NixOS configurations
+ nixos-build-vms
+ build a network of virtual machines from a network of NixOS configurations
diff --git a/nixos/doc/manual/man-nixos-enter.xml b/nixos/doc/manual/man-nixos-enter.xml
index 1481db467122d9577e807c67a80b14884bbef237..fe560d3efdd8efaf4c8ed6000e1bd103c8bf8ec6 100644
--- a/nixos/doc/manual/man-nixos-enter.xml
+++ b/nixos/doc/manual/man-nixos-enter.xml
@@ -8,8 +8,8 @@
- nixos-enter
- run a command in a NixOS chroot environment
+ nixos-enter
+ run a command in a NixOS chroot environment
diff --git a/nixos/doc/manual/man-nixos-generate-config.xml b/nixos/doc/manual/man-nixos-generate-config.xml
index 61531a8f01ca043d6f37dc620cde68871eeba0cb..9ac3b918ff693b71e80b59a6777a132cbb810fa5 100644
--- a/nixos/doc/manual/man-nixos-generate-config.xml
+++ b/nixos/doc/manual/man-nixos-generate-config.xml
@@ -8,8 +8,8 @@
- nixos-generate-config
- generate NixOS configuration modules
+ nixos-generate-config
+ generate NixOS configuration modules
diff --git a/nixos/doc/manual/man-nixos-install.xml b/nixos/doc/manual/man-nixos-install.xml
index 4fb94ee7494c86a346143e2960e946404e4db2b8..93082f914bee621d2c72709cc8133a78c79b2212 100644
--- a/nixos/doc/manual/man-nixos-install.xml
+++ b/nixos/doc/manual/man-nixos-install.xml
@@ -8,12 +8,32 @@
- nixos-install
- install bootloader and NixOS
+ nixos-install
+ install bootloader and NixOSnixos-install
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -134,6 +154,23 @@
This command accepts the following options:
+
+ /
+
+ Increases the level of verbosity of diagnostic messages
+ printed on standard error. For each Nix operation, the information
+ printed on standard output is well-defined; any diagnostic
+ information is printed on standard error, never on standard
+ output.
+ Please note that this option may be specified repeatedly.
+
+
+
+ /
+
+ Print the full build logs of nix build to stderr.
+
+
diff --git a/nixos/doc/manual/man-nixos-option.xml b/nixos/doc/manual/man-nixos-option.xml
index 3e316e10d4eb4d5c14387f0b6d4094769bfd0ec1..b82f31256099ca809bb90f315a7772e0449b071f 100644
--- a/nixos/doc/manual/man-nixos-option.xml
+++ b/nixos/doc/manual/man-nixos-option.xml
@@ -8,8 +8,8 @@
- nixos-option
- inspect a NixOS configuration
+ nixos-option
+ inspect a NixOS configuration
@@ -19,14 +19,10 @@
-
+
-
-
-
- option.name
@@ -62,22 +58,11 @@
-
-
-
-
- This option enables verbose mode, which currently is just the Bash
- set debug mode.
-
-
-
-
-
-
+
- This option causes the output to be rendered as XML.
+ Print the values of all options.
@@ -134,4 +119,13 @@ Defined by:
bug, please report to Nicolas Pierron.
+
+ See also
+
+
+ configuration.nix
+ 5
+
+
+
diff --git a/nixos/doc/manual/man-nixos-rebuild.xml b/nixos/doc/manual/man-nixos-rebuild.xml
index 4c20cfcdd7d2f6a120c17e728229fe79642f24e5..495dbc8859b1db4ba438e6873b7bc7c1435d5845 100644
--- a/nixos/doc/manual/man-nixos-rebuild.xml
+++ b/nixos/doc/manual/man-nixos-rebuild.xml
@@ -7,10 +7,12 @@
NixOS
+
- nixos-rebuild
- reconfigure a NixOS machine
+ nixos-rebuild
+ reconfigure a NixOS machine
+
nixos-rebuild
@@ -74,6 +76,7 @@
builder-spec
+
@@ -121,8 +124,10 @@
+
Description
+
This command updates the system so that it corresponds to the configuration
specified in /etc/nixos/configuration.nix. Thus, every
@@ -133,9 +138,11 @@
(re)starts any system services if needed. Please note that user services need
to be started manually as they aren't detected by the activation script at the moment.
+
This command has one required argument, which specifies the desired
operation. It must be one of the following:
+
@@ -152,6 +159,7 @@
+
@@ -165,6 +173,7 @@
+
@@ -179,6 +188,7 @@
+
@@ -197,6 +207,7 @@
+
@@ -208,6 +219,7 @@
+
@@ -222,6 +234,7 @@
+
@@ -232,6 +245,7 @@
+
@@ -249,12 +263,14 @@
$ ./result/bin/run-*-vm
+
The VM is implemented using the qemu package. For
best performance, you should load the kvm-intel or
kvm-amd kernel modules to get hardware
virtualisation.
+
The VM mounts the Nix store of the host through the 9P file system. The
host Nix store is read-only, so Nix commands that modify the Nix store
@@ -262,6 +278,7 @@
nixos-rebuild; to change the VM’s configuration,
you must halt the VM and re-run the commands above.
+
The VM has its own ext3 root file system, which is
automatically created when the VM is first started, and is persistent
@@ -272,6 +289,7 @@
+
@@ -294,11 +312,13 @@
+
Options
This command accepts the following options:
+
@@ -310,6 +330,7 @@
+
@@ -321,6 +342,7 @@
+
@@ -336,6 +358,7 @@
+
@@ -349,6 +372,7 @@
+
@@ -363,6 +387,7 @@
+
builder-spec
@@ -382,6 +407,7 @@
+
@@ -412,6 +438,7 @@
+
@@ -437,6 +464,7 @@
+
@@ -449,6 +477,7 @@
be accessible over ssh, and for the commands ,
and you need root access.
+
If is not explicitly specified,
will implicitly be set to the same value as
@@ -457,6 +486,7 @@
place remotely (and no build artifacts will be copied to the local
machine).
+
You can include a remote user name in the host name
(user@host). You can also set ssh options by
@@ -464,7 +494,22 @@
+
+
+
+
+
+
+
+ When set, nixos-rebuild prefixes remote commands that run on
+ the and
+ systems with sudo. Setting this option allows
+ deploying as a non-root user.
+
+
+
+
In addition, nixos-rebuild accepts various Nix-related
flags, including / ,
@@ -473,8 +518,10 @@
. See the Nix manual for details.
+
Environment
+
@@ -487,6 +534,7 @@
+
NIX_SSHOPTS
@@ -500,9 +548,12 @@
+
Files
+
+
/run/current-system
@@ -513,6 +564,7 @@
+
/nix/var/nix/profiles/system
@@ -524,8 +576,10 @@
+
+
Bugs
diff --git a/nixos/doc/manual/man-nixos-version.xml b/nixos/doc/manual/man-nixos-version.xml
index 931c4a5ad029333a169bbbcad00489f2680be16c..e9ad8bddcace63391333f7c3bd7bfdd6d2b45428 100644
--- a/nixos/doc/manual/man-nixos-version.xml
+++ b/nixos/doc/manual/man-nixos-version.xml
@@ -7,8 +7,8 @@
NixOS
- nixos-version
- show the NixOS version
+ nixos-version
+ show the NixOS version
diff --git a/nixos/doc/manual/manual.xml b/nixos/doc/manual/manual.xml
index 12f52e1997c8d207e0414218e2aaa1aff243daa3..18a67a2dd9416222d3bd9ce21ed75d059be270f5 100644
--- a/nixos/doc/manual/manual.xml
+++ b/nixos/doc/manual/manual.xml
@@ -8,32 +8,7 @@
Version
-
- Preface
-
- This manual describes how to install, use and extend NixOS, a Linux
- distribution based on the purely functional package management system Nix.
-
-
- If you encounter problems, please report them on the
- Discourse or
- on the
- #nixos channel on Freenode. Bugs should be
- reported in
- NixOS’
- GitHub issue tracker.
-
-
-
- Commands prefixed with # have to be run as root, either
- requiring to login as root user or temporarily switching to it using
- sudo for example.
-
-
-
+
diff --git a/nixos/doc/manual/preface.xml b/nixos/doc/manual/preface.xml
new file mode 100644
index 0000000000000000000000000000000000000000..6ac9ae7e7861d1aa86ba1aa40a5c55b76531f2cc
--- /dev/null
+++ b/nixos/doc/manual/preface.xml
@@ -0,0 +1,37 @@
+
+ Preface
+
+ This manual describes how to install, use and extend NixOS, a Linux
+ distribution based on the purely functional package management system
+ Nix, that is composed
+ using modules and packages defined in the
+ Nixpkgs project.
+
+
+ Additional information regarding the Nix package manager and the Nixpkgs
+ project can be found in respectively the
+ Nix manual and the
+ Nixpkgs manual.
+
+
+ If you encounter problems, please report them on the
+ Discourse or
+ on the
+ #nixos channel on Freenode. Bugs should be
+ reported in
+ NixOS’
+ GitHub issue tracker.
+
+
+
+ Commands prefixed with # have to be run as root, either
+ requiring to login as root user or temporarily switching to it using
+ sudo for example.
+
+
+
diff --git a/nixos/doc/manual/release-notes/release-notes.xml b/nixos/doc/manual/release-notes/release-notes.xml
index 02b5914772143cdaf8f28b4049f29c10c9448363..444862c5739bbd1b0d91c55661963923b3de82f6 100644
--- a/nixos/doc/manual/release-notes/release-notes.xml
+++ b/nixos/doc/manual/release-notes/release-notes.xml
@@ -8,6 +8,7 @@
This section lists the release notes for each stable version of NixOS and
current unstable revision.
+
diff --git a/nixos/doc/manual/release-notes/rl-1909.xml b/nixos/doc/manual/release-notes/rl-1909.xml
index db46294430022eabf8b1b10ef0c96c423e250cc6..4102fe206e19d0842f7a3088480d7d46996a848a 100644
--- a/nixos/doc/manual/release-notes/rl-1909.xml
+++ b/nixos/doc/manual/release-notes/rl-1909.xml
@@ -3,7 +3,7 @@
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
xml:id="sec-release-19.09">
- Release 19.09 (“Loris”, 2019/09/??)
+ Release 19.09 (“Loris”, 2019/10/09)
+
+
+ Nix has been updated to 2.3; see its
+ release
+ notes.
+
+
+
+ Core version changes:
+ systemd: 239 -> 243
+ gcc: 7 -> 8
+ glibc: 2.27 (unchanged)
+ linux: 4.19 LTS (unchanged)
+ openssl: 1.0 -> 1.1
+
+
+ Desktop version changes:
+ plasma5: 5.14 -> 5.16
+ gnome3: 3.30 -> 3.32
+
PHP now defaults to PHP 7.3, updated from 7.2.
@@ -170,6 +190,13 @@
+
+
+ has been added.
+ If you previously had blueman installed via please
+ migrate to using the NixOS module, as this would result in an insufficiently configured blueman.
+
+
@@ -449,8 +476,9 @@
- is now disabled by default.
- It was not useful except for debugging purposes and was confusingly set as default in some circumstances.
+ is now disabled by default if stateVersion is 19.09 or higher.
+ Previously the xterm desktopManager was enabled when xserver was enabled, but it isn't useful for all people so it didn't make sense to
+ have any desktopManager enabled default.
@@ -477,6 +505,92 @@
Prometheus 2 is now configured with services.prometheus.
+
+
+ Citrix Receiver (citrix_receiver) has been dropped in favor of Citrix Workspace
+ (citrix_workspace).
+
+
+
+
+ The services.gitlab module has had its literal secret options (,
+ ,
+ ,
+ ,
+ ,
+ and
+ ) replaced by file-based versions (,
+ ,
+ ,
+ ,
+ ,
+ and
+ ). This was done so that secrets aren't stored
+ in the world-readable nix store, but means that for each option you'll have to create a file with
+ the same exact string, add "File" to the end of the option name, and change the definition to a
+ string pointing to the corresponding file; e.g. services.gitlab.databasePassword = "supersecurepassword"
+ becomes services.gitlab.databasePasswordFile = "/path/to/secret_file" where the
+ file secret_file contains the string supersecurepassword.
+
+
+ The state path () now has the following restriction:
+ no parent directory can be owned by any other user than root or the user
+ specified in ; i.e. if
+ is set to /var/lib/gitlab/state, gitlab and all parent directories
+ must be owned by either root or the user specified in .
+
+
+
+
+ The option is unsupported in combination with
+ in anticipation of defaulting to it.
+ It has to be set to false and enabled per
+ interface with
+
+
+
+
+ The Twitter client corebird has been dropped as it is discontinued and does not work against the new Twitter API.
+ Please use the fork cawbird instead which has been adapted to the API changes and is still maintained.
+
+
+
+
+ The nodejs-11_x package has been removed as it's EOLed by upstream.
+
+
+
+
+ Because of the systemd upgrade,
+ systemd-timesyncd will no longer work if
+ is not set correctly. When
+ upgrading from NixOS 19.03, please make sure that
+ is set to
+ "19.03", or lower if the installation dates back to an
+ earlier version of NixOS.
+
+
+
+
+ Due to the short lifetime of non-LTS kernel releases package attributes like linux_5_1,
+ linux_5_2 and linux_5_3 have been removed to discourage dependence
+ on specific non-LTS kernel versions in stable NixOS releases.
+
+ Going forward, versioned attributes like linux_4_9 will exist for LTS versions only.
+ Please use linux_latest or linux_testing if you depend on non-LTS
+ releases. Keep in mind that linux_latest and linux_testing will
+ change versions under the hood during the lifetime of a stable release and might include breaking changes.
+
+
+
+
+ Because of the systemd upgrade,
+ some network interfaces might change their name. For details see
+
+ upstream docs or
+ our ticket.
+
+
@@ -675,7 +789,7 @@
- This also configures the kernel to pass coredumps to systemd-coredump,
+ This also configures the kernel to pass core dumps to systemd-coredump,
and restricts the SysRq key combinations to the sync command only.
These sysctl snippets can be found in /etc/sysctl.d/50-*.conf,
and overridden via boot.kernel.sysctl
@@ -684,12 +798,15 @@
- Coredumps are now acquired by systemd-coredump by default.
- systemd-coredump behaviour can still be modified via
- .
- To stick to the old behaviour (having the kernel dump to a file called core
- in the working directory), without piping it through systemd-coredump, set
- to "core".
+ Core dumps are now processed by systemd-coredump
+ by default. systemd-coredump behaviour can
+ still be modified via
+ . To stick to the
+ old behaviour (having the kernel dump to a file called
+ core in the working directory), without piping
+ it through systemd-coredump, set
+ to
+ false.
diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml
new file mode 100644
index 0000000000000000000000000000000000000000..13f4c62c018a69d8acb6577a2447adb4ad9bf325
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@@ -0,0 +1,402 @@
+
+ Release 20.03 (“Markhor”, 2020.03/??)
+
+
+ Highlights
+
+
+ In addition to numerous new and upgraded packages, this release has the
+ following highlights:
+
+
+
+
+
+ Support is planned until the end of October 2020, handing over to 20.09.
+
+
+
+
+ Postgresql for NixOS service now defaults to v11.
+
+
+
+
+ The graphical installer image starts the graphical session automatically.
+ Before you'd be greeted by a tty and asked to enter systemctl start display-manager.
+ It is now possible to disable the display-manager from running by selecting the Disable display-manager
+ quirk in the boot menu.
+
+
+
+
+ By default zfs pools will now be trimmed on a weekly basis.
+ Trimming is only done on supported devices (i.e. NVME or SSDs)
+ and should improve throughput and lifetime of these devices.
+ It is controlled by the services.zfs.trim.enable varname.
+ The zfs scrub service (services.zfs.autoScrub.enable)
+ and the zfs autosnapshot service (services.zfs.autoSnapshot.enable)
+ are now only enabled if zfs is set in config.boot.initrd.supportedFilesystems or
+ config.boot.supportedFilesystems. These lists will automatically contain
+ zfs as soon as any zfs mountpoint is configured in fileSystems.
+
+
+
+
+ nixos-option has been rewritten in C++, speeding it up, improving correctness,
+ and adding a option which prints all options and their values.
+
+
+
+
+ and options were replaced by a single option to improve support for upstream session files. If you used something like:
+
+services.xserver.desktopManager.default = "xfce";
+services.xserver.windowManager.default = "icewm";
+
+ you should change it to:
+
+services.xserver.displayManager.defaultSession = "xfce+icewm";
+
+
+
+
+
+
+
+ New Services
+
+
+ The following new services were added since the last release:
+
+
+
+
+
+ The kubernetes kube-proxy now supports a new hostname configuration
+ services.kubernetes.proxy.hostname which has to
+ be set if the hostname of the node should be non default.
+
+
+
+
+ UPower's configuration is now managed by NixOS and can be customized
+ via .
+
+
+
+
+
+
+
+ Backward Incompatibilities
+
+
+ When upgrading from a previous release, please be aware of the following
+ incompatible changes:
+
+
+
+
+
+ GnuPG is now built without support for a graphical passphrase entry
+ by default. Please enable the gpg-agent user service
+ via the NixOS option programs.gnupg.agent.enable.
+ Note that upstream recommends using gpg-agent and
+ will spawn a gpg-agent on the first invocation of
+ GnuPG anyway.
+
+
+
+
+ The dynamicHosts option has been removed from the
+ networkd
+ module. Allowing (multiple) regular users to override host entries
+ affecting the whole system opens up a huge attack vector.
+ There seem to be very rare cases where this might be useful.
+ Consider setting system-wide host entries using
+ networking.hosts, provide
+ them via the DNS server in your network, or use
+ environment.etc
+ to add a file into /etc/NetworkManager/dnsmasq.d
+ reconfiguring hostsdir.
+
+
+
+
+ The 99-main.network file was removed. Maching all
+ network interfaces caused many breakages, see
+ #18962
+ and #71106.
+
+
+ We already don't support the global networking.useDHCP,
+ networking.defaultGateway and
+ networking.defaultGateway6 options
+ if networking.useNetworkd is enabled,
+ but direct users to configure the per-device
+ networking.interfaces.<name>.… options.
+
+
+
+
+ The stdenv now runs all bash with set -u, to catch the use of undefined variables.
+ Before, it itself used set -u but was careful to unset it so other packages' code ran as before.
+ Now, all bash code is held to the same high standard, and the rather complex stateful manipulation of the options can be discarded.
+
+
+
+
+ The SLIM Display Manager has been removed, as it has been unmaintained since 2013.
+ Consider migrating to a different display manager such as LightDM (current default in NixOS),
+ SDDM, GDM, or using the startx module which uses Xinitrc.
+
+
+
+
+ The BEAM package set has been deleted. You will only find there the different interpreters.
+ You should now use the different build tools coming with the languages with sandbox mode disabled.
+
+
+
+
+ There is now only one Xfce package-set and module. This means attributes, xfce4-14
+ xfce4-12, and xfceUnstable all now point to the latest Xfce 4.14
+ packages. And in future NixOS releases will be the latest released version of Xfce available at the
+ time during the releases development (if viable).
+
+
+
+
+ The phpfpm module now sets
+ PrivateTmp=true in its systemd units for better process isolation.
+ If you rely on /tmp being shared with other services, explicitly override this by
+ setting serviceConfig.PrivateTmp to false for each phpfpm unit.
+
+
+
+
+ KDE’s old multimedia framework Phonon no longer supports Qt 4. For that reason, Plasma desktop also does not have option any more.
+
+
+
+
+ The BeeGFS module has been removed.
+
+
+
+
+ The osquery module has been removed.
+
+
+
+
+ Going forward, ~/bin in the users home directory will no longer be in PATH by default.
+ If you depend on this you should set the option environment.homeBinInPath to true.
+ The aforementioned option was added this release.
+
+
+
+
+ The buildRustCrate infrastructure now produces lib outputs in addition to the out output.
+ This has led to drastically reduced closed sizes for some rust crates since development dependencies are now in the lib output.
+
+
+
+
+ Pango was upgraded to 1.44, which no longer uses freetype for font loading. This means that type1
+ and bitmap fonts are no longer supported in applications relying on Pango for font rendering
+ (notably, GTK application). See
+ upstream issue for more information.
+
+
+
+
+ The packages openobex and obexftp
+ are no longer installed when enabling Bluetooth via
+ .
+
+
+
+
+ The dump1090 derivation has been changed to use FlightAware's dump1090
+ as its upstream. However, this version does not have an internal webserver anymore. The
+ assets in the share/dump1090 directory of the derivation can be used
+ in conjunction with an external webserver to replace this functionality.
+
+
+
+
+ The fourStore and fourStoreEndpoint modules have been removed.
+
+
+
+
+ Polkit no longer has the user of uid 0 (root) as an admin identity.
+ We now follow the upstream default of only having every member of the wheel
+ group admin privileged. Before it was root and members of wheel.
+ The positive outcome of this is pkexec GUI popups or terminal prompts
+ will no longer require the user to choose between two essentially equivalent
+ choices (whether to perform the action as themselves with wheel permissions, or as the root user).
+
+
+
+
+ NixOS containers no longer build NixOS manual by default. This saves evaluation time,
+ especially if there are many declarative containers defined. Note that this is already done
+ when <nixos/modules/profiles/minimal.nix> module is included
+ in container config.
+
+
+
+
+ The kresd services deprecates the interfaces option
+ in favor of the listenPlain option which requires full
+ systemd.socket compatible
+ declaration which always include a port.
+
+
+
+
+ Virtual console options have been reorganized and can be found under
+ a single top-level attribute: console.
+ The full set of changes is as follows:
+
+
+
+
+ i18n.consoleFont renamed to
+ console.font
+
+
+
+
+ i18n.consoleKeyMap renamed to
+ console.keyMap
+
+
+
+
+ i18n.consoleColors renamed to
+ console.colors
+
+
+
+
+ i18n.consolePackages renamed to
+ console.packages
+
+
+
+
+ i18n.consoleUseXkbConfig renamed to
+ console.useXkbConfig
+
+
+
+
+ boot.earlyVconsoleSetup renamed to
+ console.earlySetup
+
+
+
+
+ boot.extraTTYs renamed to
+ console.extraTTYs
+
+
+
+
+
+
+ The awstats module has been rewritten
+ to serve stats via static html pages, updated on a timer, over nginx,
+ instead of dynamic cgi pages over apache.
+
+
+ Minor changes will be required to migrate existing configurations. Details of the
+ required changes can seen by looking through the awstats
+ module.
+
+
+
+
+ The httpd module no longer provides options to support serving web content without defining a virtual host. As a
+ result of this the services.httpd.logPerVirtualHost
+ option now defaults to true instead of false. Please update your
+ configuration to make use of services.httpd.virtualHosts.
+
+
+ The services.httpd.virtualHosts.<name>
+ option has changed type from a list of submodules to an attribute set of submodules, better matching
+ services.nginx.virtualHosts.<name>.
+
+
+ This change comes with the addition of the following options which mimic the functionality of their nginx counterparts:
+ services.httpd.virtualHosts.<name>.addSSL,
+ services.httpd.virtualHosts.<name>.forceSSL,
+ services.httpd.virtualHosts.<name>.onlySSL,
+ services.httpd.virtualHosts.<name>.enableACME,
+ services.httpd.virtualHosts.<name>.acmeRoot, and
+ services.httpd.virtualHosts.<name>.useACMEHost.
+
+
+
+
+
+
+ Other Notable Changes
+
+
+
+ SD images are now compressed by default using bzip2.
+
+
+
+ The nginx web server previously started its master process as root
+ privileged, then ran worker processes as a less privileged identity user.
+ This was changed to start all of nginx as a less privileged user (defined by
+ services.nginx.user and
+ services.nginx.group). As a consequence, all files that
+ are needed for nginx to run (included configuration fragments, SSL
+ certificates and keys, etc.) must now be readable by this less privileged
+ user/group.
+
+
+
+
+ OpenSSH has been upgraded from 7.9 to 8.1, improving security and adding features
+ but with potential incompatibilities. Consult the
+
+ release announcement for more information.
+
+
+
+
+ PRETTY_NAME in /etc/os-release
+ now uses the short rather than full version string.
+
+
+
+
+
diff --git a/nixos/doc/xmlformat.conf b/nixos/doc/xmlformat.conf
index 4a565c8465bc038a515c5cbdb3c6cc115f06c2c7..c3f39c7fd81b8e9019ae861c5eebc7b8e76d609f 100644
--- a/nixos/doc/xmlformat.conf
+++ b/nixos/doc/xmlformat.conf
@@ -37,7 +37,6 @@ para abstract
entry-break 1
exit-break 1
normalize yes
- wrap-length 79
title
format block
diff --git a/nixos/lib/make-ext4-fs.nix b/nixos/lib/make-ext4-fs.nix
index 932adcd979670d179294b4e97578ef39df083a85..f46d3990c06baca0168aa543aeb756e04c4df970 100644
--- a/nixos/lib/make-ext4-fs.nix
+++ b/nixos/lib/make-ext4-fs.nix
@@ -4,8 +4,11 @@
# generated image is sized to only fit its contents, with the expectation
# that a script resizes the filesystem at boot time.
{ pkgs
+, lib
# List of derivations to be included
, storePaths
+# Whether or not to compress the resulting image with zstd
+, compressImage ? false, zstd
# Shell commands to populate the ./files directory.
# All files in that directory are copied to the root of the FS.
, populateImageCommands ? ""
@@ -20,18 +23,20 @@
let
sdClosureInfo = pkgs.buildPackages.closureInfo { rootPaths = storePaths; };
in
-
pkgs.stdenv.mkDerivation {
- name = "ext4-fs.img";
+ name = "ext4-fs.img${lib.optionalString compressImage ".zst"}";
- nativeBuildInputs = [e2fsprogs.bin libfaketime perl lkl];
+ nativeBuildInputs = [ e2fsprogs.bin libfaketime perl lkl ]
+ ++ lib.optional compressImage zstd;
buildCommand =
''
+ ${if compressImage then "img=temp.img" else "img=$out"}
(
mkdir -p ./files
${populateImageCommands}
)
+
# Add the closures of the top-level store objects.
storePaths=$(cat ${sdClosureInfo}/store-paths)
@@ -42,28 +47,26 @@ pkgs.stdenv.mkDerivation {
bytes=$((2 * 4096 * $numInodes + 4096 * $numDataBlocks))
echo "Creating an EXT4 image of $bytes bytes (numInodes=$numInodes, numDataBlocks=$numDataBlocks)"
- truncate -s $bytes $out
- faketime -f "1970-01-01 00:00:01" mkfs.ext4 -L ${volumeLabel} -U ${uuid} $out
+ truncate -s $bytes $img
+ faketime -f "1970-01-01 00:00:01" mkfs.ext4 -L ${volumeLabel} -U ${uuid} $img
# Also include a manifest of the closures in a format suitable for nix-store --load-db.
cp ${sdClosureInfo}/registration nix-path-registration
- cptofs -t ext4 -i $out nix-path-registration /
+ cptofs -t ext4 -i $img nix-path-registration /
# Create nix/store before copying paths
faketime -f "1970-01-01 00:00:01" mkdir -p nix/store
- cptofs -t ext4 -i $out nix /
+ cptofs -t ext4 -i $img nix /
echo "copying store paths to image..."
- cptofs -t ext4 -i $out $storePaths /nix/store/
+ cptofs -t ext4 -i $img $storePaths /nix/store/
- (
echo "copying files to image..."
- cd ./files
- cptofs -t ext4 -i $out ./* /
- )
+ cptofs -t ext4 -i $img ./files/* /
+
# I have ended up with corrupted images sometimes, I suspect that happens when the build machine's disk gets full during the build.
- if ! fsck.ext4 -n -f $out; then
+ if ! fsck.ext4 -n -f $img; then
echo "--- Fsck failed for EXT4 image of $bytes bytes (numInodes=$numInodes, numDataBlocks=$numDataBlocks) ---"
cat errorlog
return 1
@@ -71,9 +74,9 @@ pkgs.stdenv.mkDerivation {
(
# Resizes **snugly** to its actual limits (or closer to)
- free=$(dumpe2fs $out | grep '^Free blocks:')
- blocksize=$(dumpe2fs $out | grep '^Block size:')
- blocks=$(dumpe2fs $out | grep '^Block count:')
+ free=$(dumpe2fs $img | grep '^Free blocks:')
+ blocksize=$(dumpe2fs $img | grep '^Block size:')
+ blocks=$(dumpe2fs $img | grep '^Block count:')
blocks=$((''${blocks##*:})) # format the number.
blocksize=$((''${blocksize##*:})) # format the number.
# System can't boot with 0 blocks free.
@@ -82,10 +85,15 @@ pkgs.stdenv.mkDerivation {
size=$(( blocks - ''${free##*:} + fudge ))
echo "Resizing from $blocks blocks to $size blocks. (~ $((size*blocksize/1024/1024))MiB)"
- EXT2FS_NO_MTAB_OK=yes resize2fs $out -f $size
+ EXT2FS_NO_MTAB_OK=yes resize2fs $img -f $size
)
# And a final fsck, because of the previous truncating.
- fsck.ext4 -n -f $out
+ fsck.ext4 -n -f $img
+
+ if [ ${builtins.toString compressImage} ]; then
+ echo "Compressing image"
+ zstd -v --no-progress ./$img -o $out
+ fi
'';
}
diff --git a/nixos/lib/make-iso9660-image.nix b/nixos/lib/make-iso9660-image.nix
index 8cd19b6e1874b1f8e0f51017f76faea7b1420c96..0f3f2b5b5234d1e54ca5075eab2361e8f044d624 100644
--- a/nixos/lib/make-iso9660-image.nix
+++ b/nixos/lib/make-iso9660-image.nix
@@ -10,9 +10,9 @@
contents
, # In addition to `contents', the closure of the store paths listed
- # in `packages' are also placed in the Nix store of the CD. This is
- # a list of attribute sets {object, symlink} where `object' if a
- # store path whose closure will be copied, and `symlink' is a
+ # in `storeContents' are also placed in the Nix store of the CD.
+ # This is a list of attribute sets {object, symlink} where `object'
+ # is a store path whose closure will be copied, and `symlink' is a
# symlink to `object' that will be added to the CD.
storeContents ? []
diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index 35c8b543dece54dda34d8a600d9739a0efd375c8..eee8f612410de6a35a36cbe0dda6279f78156972 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -86,7 +86,7 @@ let
optionsList = lib.sort optionLess optionsListDesc;
# Convert the list of options into an XML file.
- optionsXML = builtins.toFile "options.xml" (builtins.toXML optionsList);
+ optionsXML = pkgs.writeText "options.xml" (builtins.toXML optionsList);
optionsNix = builtins.listToAttrs (map (o: { name = o.name; value = removeAttrs o ["name" "visible" "internal"]; }) optionsList);
diff --git a/nixos/lib/test-driver/test-driver.py b/nixos/lib/test-driver/test-driver.py
new file mode 100644
index 0000000000000000000000000000000000000000..7e575189209ae944717651c1d77a863c1443f742
--- /dev/null
+++ b/nixos/lib/test-driver/test-driver.py
@@ -0,0 +1,900 @@
+#! /somewhere/python3
+from contextlib import contextmanager, _GeneratorContextManager
+from xml.sax.saxutils import XMLGenerator
+import _thread
+import atexit
+import os
+import ptpython.repl
+import pty
+from queue import Queue, Empty
+import re
+import shutil
+import socket
+import subprocess
+import sys
+import tempfile
+import time
+import unicodedata
+from typing import Tuple, Any, Callable, Dict, Iterator, Optional, List
+import shlex
+import pathlib
+
+CHAR_TO_KEY = {
+ "A": "shift-a",
+ "N": "shift-n",
+ "-": "0x0C",
+ "_": "shift-0x0C",
+ "B": "shift-b",
+ "O": "shift-o",
+ "=": "0x0D",
+ "+": "shift-0x0D",
+ "C": "shift-c",
+ "P": "shift-p",
+ "[": "0x1A",
+ "{": "shift-0x1A",
+ "D": "shift-d",
+ "Q": "shift-q",
+ "]": "0x1B",
+ "}": "shift-0x1B",
+ "E": "shift-e",
+ "R": "shift-r",
+ ";": "0x27",
+ ":": "shift-0x27",
+ "F": "shift-f",
+ "S": "shift-s",
+ "'": "0x28",
+ '"': "shift-0x28",
+ "G": "shift-g",
+ "T": "shift-t",
+ "`": "0x29",
+ "~": "shift-0x29",
+ "H": "shift-h",
+ "U": "shift-u",
+ "\\": "0x2B",
+ "|": "shift-0x2B",
+ "I": "shift-i",
+ "V": "shift-v",
+ ",": "0x33",
+ "<": "shift-0x33",
+ "J": "shift-j",
+ "W": "shift-w",
+ ".": "0x34",
+ ">": "shift-0x34",
+ "K": "shift-k",
+ "X": "shift-x",
+ "/": "0x35",
+ "?": "shift-0x35",
+ "L": "shift-l",
+ "Y": "shift-y",
+ " ": "spc",
+ "M": "shift-m",
+ "Z": "shift-z",
+ "\n": "ret",
+ "!": "shift-0x02",
+ "@": "shift-0x03",
+ "#": "shift-0x04",
+ "$": "shift-0x05",
+ "%": "shift-0x06",
+ "^": "shift-0x07",
+ "&": "shift-0x08",
+ "*": "shift-0x09",
+ "(": "shift-0x0A",
+ ")": "shift-0x0B",
+}
+
+# Forward references
+nr_tests: int
+nr_succeeded: int
+log: "Logger"
+machines: "List[Machine]"
+
+
+def eprint(*args: object, **kwargs: Any) -> None:
+ print(*args, file=sys.stderr, **kwargs)
+
+
+def make_command(args: list) -> str:
+ return " ".join(map(shlex.quote, (map(str, args))))
+
+
+def create_vlan(vlan_nr: str) -> Tuple[str, str, "subprocess.Popen[bytes]", Any]:
+ global log
+ log.log("starting VDE switch for network {}".format(vlan_nr))
+ vde_socket = os.path.abspath("./vde{}.ctl".format(vlan_nr))
+ pty_master, pty_slave = pty.openpty()
+ vde_process = subprocess.Popen(
+ ["vde_switch", "-s", vde_socket, "--dirmode", "0777"],
+ bufsize=1,
+ stdin=pty_slave,
+ stdout=subprocess.PIPE,
+ stderr=subprocess.PIPE,
+ shell=False,
+ )
+ fd = os.fdopen(pty_master, "w")
+ fd.write("version\n")
+ # TODO: perl version checks if this can be read from
+ # an if not, dies. we could hang here forever. Fix it.
+ vde_process.stdout.readline()
+ if not os.path.exists(os.path.join(vde_socket, "ctl")):
+ raise Exception("cannot start vde_switch")
+
+ return (vlan_nr, vde_socket, vde_process, fd)
+
+
+def retry(fn: Callable) -> None:
+ """Call the given function repeatedly, with 1 second intervals,
+ until it returns True or a timeout is reached.
+ """
+
+ for _ in range(900):
+ if fn(False):
+ return
+ time.sleep(1)
+
+ if not fn(True):
+ raise Exception("action timed out")
+
+
+class Logger:
+ def __init__(self) -> None:
+ self.logfile = os.environ.get("LOGFILE", "/dev/null")
+ self.logfile_handle = open(self.logfile, "wb")
+ self.xml = XMLGenerator(self.logfile_handle, encoding="utf-8")
+ self.queue: "Queue[Dict[str, str]]" = Queue(1000)
+
+ self.xml.startDocument()
+ self.xml.startElement("logfile", attrs={})
+
+ def close(self) -> None:
+ self.xml.endElement("logfile")
+ self.xml.endDocument()
+ self.logfile_handle.close()
+
+ def sanitise(self, message: str) -> str:
+ return "".join(ch for ch in message if unicodedata.category(ch)[0] != "C")
+
+ def maybe_prefix(self, message: str, attributes: Dict[str, str]) -> str:
+ if "machine" in attributes:
+ return "{}: {}".format(attributes["machine"], message)
+ return message
+
+ def log_line(self, message: str, attributes: Dict[str, str]) -> None:
+ self.xml.startElement("line", attributes)
+ self.xml.characters(message)
+ self.xml.endElement("line")
+
+ def log(self, message: str, attributes: Dict[str, str] = {}) -> None:
+ eprint(self.maybe_prefix(message, attributes))
+ self.drain_log_queue()
+ self.log_line(message, attributes)
+
+ def enqueue(self, message: Dict[str, str]) -> None:
+ self.queue.put(message)
+
+ def drain_log_queue(self) -> None:
+ try:
+ while True:
+ item = self.queue.get_nowait()
+ attributes = {"machine": item["machine"], "type": "serial"}
+ self.log_line(self.sanitise(item["msg"]), attributes)
+ except Empty:
+ pass
+
+ @contextmanager
+ def nested(self, message: str, attributes: Dict[str, str] = {}) -> Iterator[None]:
+ eprint(self.maybe_prefix(message, attributes))
+
+ self.xml.startElement("nest", attrs={})
+ self.xml.startElement("head", attributes)
+ self.xml.characters(message)
+ self.xml.endElement("head")
+
+ tic = time.time()
+ self.drain_log_queue()
+ yield
+ self.drain_log_queue()
+ toc = time.time()
+ self.log("({:.2f} seconds)".format(toc - tic))
+
+ self.xml.endElement("nest")
+
+
+class Machine:
+ def __init__(self, args: Dict[str, Any]) -> None:
+ if "name" in args:
+ self.name = args["name"]
+ else:
+ self.name = "machine"
+ cmd = args.get("startCommand", None)
+ if cmd:
+ match = re.search("run-(.+)-vm$", cmd)
+ if match:
+ self.name = match.group(1)
+
+ self.script = args.get("startCommand", self.create_startcommand(args))
+
+ tmp_dir = os.environ.get("TMPDIR", tempfile.gettempdir())
+
+ def create_dir(name: str) -> str:
+ path = os.path.join(tmp_dir, name)
+ os.makedirs(path, mode=0o700, exist_ok=True)
+ return path
+
+ self.state_dir = create_dir("vm-state-{}".format(self.name))
+ self.shared_dir = create_dir("{}/xchg".format(self.state_dir))
+
+ self.booted = False
+ self.connected = False
+ self.pid: Optional[int] = None
+ self.socket = None
+ self.monitor: Optional[socket.socket] = None
+ self.logger: Logger = args["log"]
+ self.allow_reboot = args.get("allowReboot", False)
+
+ @staticmethod
+ def create_startcommand(args: Dict[str, str]) -> str:
+ net_backend = "-netdev user,id=net0"
+ net_frontend = "-device virtio-net-pci,netdev=net0"
+
+ if "netBackendArgs" in args:
+ net_backend += "," + args["netBackendArgs"]
+
+ if "netFrontendArgs" in args:
+ net_frontend += "," + args["netFrontendArgs"]
+
+ start_command = (
+ "qemu-kvm -m 384 " + net_backend + " " + net_frontend + " $QEMU_OPTS "
+ )
+
+ if "hda" in args:
+ hda_path = os.path.abspath(args["hda"])
+ if args.get("hdaInterface", "") == "scsi":
+ start_command += (
+ "-drive id=hda,file="
+ + hda_path
+ + ",werror=report,if=none "
+ + "-device scsi-hd,drive=hda "
+ )
+ else:
+ start_command += (
+ "-drive file="
+ + hda_path
+ + ",if="
+ + args["hdaInterface"]
+ + ",werror=report "
+ )
+
+ if "cdrom" in args:
+ start_command += "-cdrom " + args["cdrom"] + " "
+
+ if "usb" in args:
+ start_command += (
+ "-device piix3-usb-uhci -drive "
+ + "id=usbdisk,file="
+ + args["usb"]
+ + ",if=none,readonly "
+ + "-device usb-storage,drive=usbdisk "
+ )
+ if "bios" in args:
+ start_command += "-bios " + args["bios"] + " "
+
+ start_command += args.get("qemuFlags", "")
+
+ return start_command
+
+ def is_up(self) -> bool:
+ return self.booted and self.connected
+
+ def log(self, msg: str) -> None:
+ self.logger.log(msg, {"machine": self.name})
+
+ def nested(self, msg: str, attrs: Dict[str, str] = {}) -> _GeneratorContextManager:
+ my_attrs = {"machine": self.name}
+ my_attrs.update(attrs)
+ return self.logger.nested(msg, my_attrs)
+
+ def wait_for_monitor_prompt(self) -> str:
+ assert self.monitor is not None
+ answer = ""
+ while True:
+ undecoded_answer = self.monitor.recv(1024)
+ if not undecoded_answer:
+ break
+ answer += undecoded_answer.decode()
+ if answer.endswith("(qemu) "):
+ break
+ return answer
+
+ def send_monitor_command(self, command: str) -> str:
+ message = ("{}\n".format(command)).encode()
+ self.log("sending monitor command: {}".format(command))
+ assert self.monitor is not None
+ self.monitor.send(message)
+ return self.wait_for_monitor_prompt()
+
+ def wait_for_unit(self, unit: str, user: Optional[str] = None) -> None:
+ """Wait for a systemd unit to get into "active" state.
+ Throws exceptions on "failed" and "inactive" states as well as
+ after timing out.
+ """
+
+ def check_active(_: Any) -> bool:
+ info = self.get_unit_info(unit, user)
+ state = info["ActiveState"]
+ if state == "failed":
+ raise Exception('unit "{}" reached state "{}"'.format(unit, state))
+
+ if state == "inactive":
+ status, jobs = self.systemctl("list-jobs --full 2>&1", user)
+ if "No jobs" in jobs:
+ info = self.get_unit_info(unit, user)
+ if info["ActiveState"] == state:
+ raise Exception(
+ (
+ 'unit "{}" is inactive and there ' "are no pending jobs"
+ ).format(unit)
+ )
+
+ return state == "active"
+
+ retry(check_active)
+
+ def get_unit_info(self, unit: str, user: Optional[str] = None) -> Dict[str, str]:
+ status, lines = self.systemctl('--no-pager show "{}"'.format(unit), user)
+ if status != 0:
+ raise Exception(
+ 'retrieving systemctl info for unit "{}" {} failed with exit code {}'.format(
+ unit, "" if user is None else 'under user "{}"'.format(user), status
+ )
+ )
+
+ line_pattern = re.compile(r"^([^=]+)=(.*)$")
+
+ def tuple_from_line(line: str) -> Tuple[str, str]:
+ match = line_pattern.match(line)
+ assert match is not None
+ return match[1], match[2]
+
+ return dict(
+ tuple_from_line(line)
+ for line in lines.split("\n")
+ if line_pattern.match(line)
+ )
+
+ def systemctl(self, q: str, user: Optional[str] = None) -> Tuple[int, str]:
+ if user is not None:
+ q = q.replace("'", "\\'")
+ return self.execute(
+ (
+ "su -l {} -c "
+ "$'XDG_RUNTIME_DIR=/run/user/`id -u` "
+ "systemctl --user {}'"
+ ).format(user, q)
+ )
+ return self.execute("systemctl {}".format(q))
+
+ def require_unit_state(self, unit: str, require_state: str = "active") -> None:
+ with self.nested(
+ "checking if unit ‘{}’ has reached state '{}'".format(unit, require_state)
+ ):
+ info = self.get_unit_info(unit)
+ state = info["ActiveState"]
+ if state != require_state:
+ raise Exception(
+ "Expected unit ‘{}’ to to be in state ".format(unit)
+ + "'active' but it is in state ‘{}’".format(state)
+ )
+
+ def execute(self, command: str) -> Tuple[int, str]:
+ self.connect()
+
+ out_command = "( {} ); echo '|!EOF' $?\n".format(command)
+ self.shell.send(out_command.encode())
+
+ output = ""
+ status_code_pattern = re.compile(r"(.*)\|\!EOF\s+(\d+)")
+
+ while True:
+ chunk = self.shell.recv(4096).decode()
+ match = status_code_pattern.match(chunk)
+ if match:
+ output += match[1]
+ status_code = int(match[2])
+ return (status_code, output)
+ output += chunk
+
+ def succeed(self, *commands: str) -> str:
+ """Execute each command and check that it succeeds."""
+ output = ""
+ for command in commands:
+ with self.nested("must succeed: {}".format(command)):
+ (status, out) = self.execute(command)
+ if status != 0:
+ self.log("output: {}".format(out))
+ raise Exception(
+ "command `{}` failed (exit code {})".format(command, status)
+ )
+ output += out
+ return output
+
+ def fail(self, *commands: str) -> None:
+ """Execute each command and check that it fails."""
+ for command in commands:
+ with self.nested("must fail: {}".format(command)):
+ status, output = self.execute(command)
+ if status == 0:
+ raise Exception(
+ "command `{}` unexpectedly succeeded".format(command)
+ )
+
+ def wait_until_succeeds(self, command: str) -> str:
+ """Wait until a command returns success and return its output.
+ Throws an exception on timeout.
+ """
+ output = ""
+
+ def check_success(_: Any) -> bool:
+ nonlocal output
+ status, output = self.execute(command)
+ return status == 0
+
+ with self.nested("waiting for success: {}".format(command)):
+ retry(check_success)
+ return output
+
+ def wait_until_fails(self, command: str) -> str:
+ """Wait until a command returns failure.
+ Throws an exception on timeout.
+ """
+ output = ""
+
+ def check_failure(_: Any) -> bool:
+ nonlocal output
+ status, output = self.execute(command)
+ return status != 0
+
+ with self.nested("waiting for failure: {}".format(command)):
+ retry(check_failure)
+ return output
+
+ def wait_for_shutdown(self) -> None:
+ if not self.booted:
+ return
+
+ with self.nested("waiting for the VM to power off"):
+ sys.stdout.flush()
+ self.process.wait()
+
+ self.pid = None
+ self.booted = False
+ self.connected = False
+
+ def get_tty_text(self, tty: str) -> str:
+ status, output = self.execute(
+ "fold -w$(stty -F /dev/tty{0} size | "
+ "awk '{{print $2}}') /dev/vcs{0}".format(tty)
+ )
+ return output
+
+ def wait_until_tty_matches(self, tty: str, regexp: str) -> None:
+ """Wait until the visible output on the chosen TTY matches regular
+ expression. Throws an exception on timeout.
+ """
+ matcher = re.compile(regexp)
+
+ def tty_matches(last: bool) -> bool:
+ text = self.get_tty_text(tty)
+ if last:
+ self.log(
+ f"Last chance to match /{regexp}/ on TTY{tty}, "
+ f"which currently contains: {text}"
+ )
+ return len(matcher.findall(text)) > 0
+
+ with self.nested("waiting for {} to appear on tty {}".format(regexp, tty)):
+ retry(tty_matches)
+
+ def send_chars(self, chars: List[str]) -> None:
+ with self.nested("sending keys ‘{}‘".format(chars)):
+ for char in chars:
+ self.send_key(char)
+
+ def wait_for_file(self, filename: str) -> None:
+ """Waits until the file exists in machine's file system."""
+
+ def check_file(_: Any) -> bool:
+ status, _ = self.execute("test -e {}".format(filename))
+ return status == 0
+
+ with self.nested("waiting for file ‘{}‘".format(filename)):
+ retry(check_file)
+
+ def wait_for_open_port(self, port: int) -> None:
+ def port_is_open(_: Any) -> bool:
+ status, _ = self.execute("nc -z localhost {}".format(port))
+ return status == 0
+
+ with self.nested("waiting for TCP port {}".format(port)):
+ retry(port_is_open)
+
+ def wait_for_closed_port(self, port: int) -> None:
+ def port_is_closed(_: Any) -> bool:
+ status, _ = self.execute("nc -z localhost {}".format(port))
+ return status != 0
+
+ retry(port_is_closed)
+
+ def start_job(self, jobname: str, user: Optional[str] = None) -> Tuple[int, str]:
+ return self.systemctl("start {}".format(jobname), user)
+
+ def stop_job(self, jobname: str, user: Optional[str] = None) -> Tuple[int, str]:
+ return self.systemctl("stop {}".format(jobname), user)
+
+ def wait_for_job(self, jobname: str) -> None:
+ self.wait_for_unit(jobname)
+
+ def connect(self) -> None:
+ if self.connected:
+ return
+
+ with self.nested("waiting for the VM to finish booting"):
+ self.start()
+
+ tic = time.time()
+ self.shell.recv(1024)
+ # TODO: Timeout
+ toc = time.time()
+
+ self.log("connected to guest root shell")
+ self.log("(connecting took {:.2f} seconds)".format(toc - tic))
+ self.connected = True
+
+ def screenshot(self, filename: str) -> None:
+ out_dir = os.environ.get("out", os.getcwd())
+ word_pattern = re.compile(r"^\w+$")
+ if word_pattern.match(filename):
+ filename = os.path.join(out_dir, "{}.png".format(filename))
+ tmp = "{}.ppm".format(filename)
+
+ with self.nested(
+ "making screenshot {}".format(filename),
+ {"image": os.path.basename(filename)},
+ ):
+ self.send_monitor_command("screendump {}".format(tmp))
+ ret = subprocess.run("pnmtopng {} > {}".format(tmp, filename), shell=True)
+ os.unlink(tmp)
+ if ret.returncode != 0:
+ raise Exception("Cannot convert screenshot")
+
+ def copy_from_vm(self, source: str, target_dir: str = "") -> None:
+ """Copy a file from the VM (specified by an in-VM source path) to a path
+ relative to `$out`. The file is copied via the `shared_dir` shared among
+ all the VMs (using a temporary directory).
+ """
+ # Compute the source, target, and intermediate shared file names
+ out_dir = pathlib.Path(os.environ.get("out", os.getcwd()))
+ vm_src = pathlib.Path(source)
+ with tempfile.TemporaryDirectory(dir=self.shared_dir) as shared_td:
+ shared_temp = pathlib.Path(shared_td)
+ vm_shared_temp = pathlib.Path("/tmp/xchg") / shared_temp.name
+ vm_intermediate = vm_shared_temp / vm_src.name
+ intermediate = shared_temp / vm_src.name
+ # Copy the file to the shared directory inside VM
+ self.succeed(make_command(["mkdir", "-p", vm_shared_temp]))
+ self.succeed(make_command(["cp", "-r", vm_src, vm_intermediate]))
+ self.succeed("sync")
+ abs_target = out_dir / target_dir / vm_src.name
+ abs_target.parent.mkdir(exist_ok=True, parents=True)
+ # Copy the file from the shared directory outside VM
+ if intermediate.is_dir():
+ shutil.copytree(intermediate, abs_target)
+ else:
+ shutil.copy(intermediate, abs_target)
+ # Make sure the cleanup is synced into VM
+ self.succeed("sync")
+
+ def dump_tty_contents(self, tty: str) -> None:
+ """Debugging: Dump the contents of the TTY
+ """
+ self.execute("fold -w 80 /dev/vcs{} | systemd-cat".format(tty))
+
+ def get_screen_text(self) -> str:
+ if shutil.which("tesseract") is None:
+ raise Exception("get_screen_text used but enableOCR is false")
+
+ magick_args = (
+ "-filter Catrom -density 72 -resample 300 "
+ + "-contrast -normalize -despeckle -type grayscale "
+ + "-sharpen 1 -posterize 3 -negate -gamma 100 "
+ + "-blur 1x65535"
+ )
+
+ tess_args = "-c debug_file=/dev/null --psm 11 --oem 2"
+
+ with self.nested("performing optical character recognition"):
+ with tempfile.NamedTemporaryFile() as tmpin:
+ self.send_monitor_command("screendump {}".format(tmpin.name))
+
+ cmd = "convert {} {} tiff:- | tesseract - - {}".format(
+ magick_args, tmpin.name, tess_args
+ )
+ ret = subprocess.run(cmd, shell=True, capture_output=True)
+ if ret.returncode != 0:
+ raise Exception(
+ "OCR failed with exit code {}".format(ret.returncode)
+ )
+
+ return ret.stdout.decode("utf-8")
+
+ def wait_for_text(self, regex: str) -> None:
+ def screen_matches(last: bool) -> bool:
+ text = self.get_screen_text()
+ matches = re.search(regex, text) is not None
+
+ if last and not matches:
+ self.log("Last OCR attempt failed. Text was: {}".format(text))
+
+ return matches
+
+ with self.nested("waiting for {} to appear on screen".format(regex)):
+ retry(screen_matches)
+
+ def send_key(self, key: str) -> None:
+ key = CHAR_TO_KEY.get(key, key)
+ self.send_monitor_command("sendkey {}".format(key))
+
+ def start(self) -> None:
+ if self.booted:
+ return
+
+ self.log("starting vm")
+
+ def create_socket(path: str) -> socket.socket:
+ if os.path.exists(path):
+ os.unlink(path)
+ s = socket.socket(family=socket.AF_UNIX, type=socket.SOCK_STREAM)
+ s.bind(path)
+ s.listen(1)
+ return s
+
+ monitor_path = os.path.join(self.state_dir, "monitor")
+ self.monitor_socket = create_socket(monitor_path)
+
+ shell_path = os.path.join(self.state_dir, "shell")
+ self.shell_socket = create_socket(shell_path)
+
+ qemu_options = (
+ " ".join(
+ [
+ "" if self.allow_reboot else "-no-reboot",
+ "-monitor unix:{}".format(monitor_path),
+ "-chardev socket,id=shell,path={}".format(shell_path),
+ "-device virtio-serial",
+ "-device virtconsole,chardev=shell",
+ "-device virtio-rng-pci",
+ "-serial stdio" if "DISPLAY" in os.environ else "-nographic",
+ ]
+ )
+ + " "
+ + os.environ.get("QEMU_OPTS", "")
+ )
+
+ environment = dict(os.environ)
+ environment.update(
+ {
+ "TMPDIR": self.state_dir,
+ "SHARED_DIR": self.shared_dir,
+ "USE_TMPDIR": "1",
+ "QEMU_OPTS": qemu_options,
+ }
+ )
+
+ self.process = subprocess.Popen(
+ self.script,
+ bufsize=1,
+ stdin=subprocess.DEVNULL,
+ stdout=subprocess.PIPE,
+ stderr=subprocess.STDOUT,
+ shell=True,
+ cwd=self.state_dir,
+ env=environment,
+ )
+ self.monitor, _ = self.monitor_socket.accept()
+ self.shell, _ = self.shell_socket.accept()
+
+ def process_serial_output() -> None:
+ for _line in self.process.stdout:
+ line = _line.decode("unicode_escape").replace("\r", "").rstrip()
+ eprint("{} # {}".format(self.name, line))
+ self.logger.enqueue({"msg": line, "machine": self.name})
+
+ _thread.start_new_thread(process_serial_output, ())
+
+ self.wait_for_monitor_prompt()
+
+ self.pid = self.process.pid
+ self.booted = True
+
+ self.log("QEMU running (pid {})".format(self.pid))
+
+ def shutdown(self) -> None:
+ if not self.booted:
+ return
+
+ self.shell.send("poweroff\n".encode())
+ self.wait_for_shutdown()
+
+ def crash(self) -> None:
+ if not self.booted:
+ return
+
+ self.log("forced crash")
+ self.send_monitor_command("quit")
+ self.wait_for_shutdown()
+
+ def wait_for_x(self) -> None:
+ """Wait until it is possible to connect to the X server. Note that
+ testing the existence of /tmp/.X11-unix/X0 is insufficient.
+ """
+
+ def check_x(_: Any) -> bool:
+ cmd = (
+ "journalctl -b SYSLOG_IDENTIFIER=systemd | "
+ + 'grep "Reached target Current graphical"'
+ )
+ status, _ = self.execute(cmd)
+ if status != 0:
+ return False
+ status, _ = self.execute("[ -e /tmp/.X11-unix/X0 ]")
+ return status == 0
+
+ with self.nested("waiting for the X11 server"):
+ retry(check_x)
+
+ def get_window_names(self) -> List[str]:
+ return self.succeed(
+ r"xwininfo -root -tree | sed 's/.*0x[0-9a-f]* \"\([^\"]*\)\".*/\1/; t; d'"
+ ).splitlines()
+
+ def wait_for_window(self, regexp: str) -> None:
+ pattern = re.compile(regexp)
+
+ def window_is_visible(last_try: bool) -> bool:
+ names = self.get_window_names()
+ if last_try:
+ self.log(
+ "Last chance to match {} on the window list,".format(regexp)
+ + " which currently contains: "
+ + ", ".join(names)
+ )
+ return any(pattern.search(name) for name in names)
+
+ with self.nested("Waiting for a window to appear"):
+ retry(window_is_visible)
+
+ def sleep(self, secs: int) -> None:
+ time.sleep(secs)
+
+ def forward_port(self, host_port: int = 8080, guest_port: int = 80) -> None:
+ """Forward a TCP port on the host to a TCP port on the guest.
+ Useful during interactive testing.
+ """
+ self.send_monitor_command(
+ "hostfwd_add tcp::{}-:{}".format(host_port, guest_port)
+ )
+
+ def block(self) -> None:
+ """Make the machine unreachable by shutting down eth1 (the multicast
+ interface used to talk to the other VMs). We keep eth0 up so that
+ the test driver can continue to talk to the machine.
+ """
+ self.send_monitor_command("set_link virtio-net-pci.1 off")
+
+ def unblock(self) -> None:
+ """Make the machine reachable.
+ """
+ self.send_monitor_command("set_link virtio-net-pci.1 on")
+
+
+def create_machine(args: Dict[str, Any]) -> Machine:
+ global log
+ args["log"] = log
+ args["redirectSerial"] = os.environ.get("USE_SERIAL", "0") == "1"
+ return Machine(args)
+
+
+def start_all() -> None:
+ global machines
+ with log.nested("starting all VMs"):
+ for machine in machines:
+ machine.start()
+
+
+def join_all() -> None:
+ global machines
+ with log.nested("waiting for all VMs to finish"):
+ for machine in machines:
+ machine.wait_for_shutdown()
+
+
+def test_script() -> None:
+ exec(os.environ["testScript"])
+
+
+def run_tests() -> None:
+ global machines
+ tests = os.environ.get("tests", None)
+ if tests is not None:
+ with log.nested("running the VM test script"):
+ try:
+ exec(tests, globals())
+ except Exception as e:
+ eprint("error: {}".format(str(e)))
+ sys.exit(1)
+ else:
+ ptpython.repl.embed(locals(), globals())
+
+ # TODO: Collect coverage data
+
+ for machine in machines:
+ if machine.is_up():
+ machine.execute("sync")
+
+ if nr_tests != 0:
+ eprint("{} out of {} tests succeeded".format(nr_succeeded, nr_tests))
+ if nr_tests > nr_succeeded:
+ sys.exit(1)
+
+
+@contextmanager
+def subtest(name: str) -> Iterator[None]:
+ global nr_tests
+ global nr_succeeded
+
+ with log.nested(name):
+ nr_tests += 1
+ try:
+ yield
+ nr_succeeded += 1
+ return True
+ except Exception as e:
+ log.log("error: {}".format(str(e)))
+
+ return False
+
+
+if __name__ == "__main__":
+ log = Logger()
+
+ vlan_nrs = list(dict.fromkeys(os.environ["VLANS"].split()))
+ vde_sockets = [create_vlan(v) for v in vlan_nrs]
+ for nr, vde_socket, _, _ in vde_sockets:
+ os.environ["QEMU_VDE_SOCKET_{}".format(nr)] = vde_socket
+
+ vm_scripts = sys.argv[1:]
+ machines = [create_machine({"startCommand": s}) for s in vm_scripts]
+ machine_eval = [
+ "{0} = machines[{1}]".format(m.name, idx) for idx, m in enumerate(machines)
+ ]
+ exec("\n".join(machine_eval))
+
+ nr_tests = 0
+ nr_succeeded = 0
+
+ @atexit.register
+ def clean_up() -> None:
+ with log.nested("cleaning up"):
+ for machine in machines:
+ if machine.pid is None:
+ continue
+ log.log("killing {} (pid {})".format(machine.name, machine.pid))
+ machine.process.kill()
+
+ for _, _, process, _ in vde_sockets:
+ process.kill()
+ log.close()
+
+ tic = time.time()
+ run_tests()
+ toc = time.time()
+ print("test script finished in {:.2f}s".format(toc - tic))
diff --git a/nixos/lib/testing-python.nix b/nixos/lib/testing-python.nix
new file mode 100644
index 0000000000000000000000000000000000000000..3d09be3b6cd50e6db8a48faf1265936726143199
--- /dev/null
+++ b/nixos/lib/testing-python.nix
@@ -0,0 +1,284 @@
+{ system
+, pkgs ? import ../.. { inherit system config; }
+ # Use a minimal kernel?
+, minimal ? false
+ # Ignored
+, config ? {}
+ # Modules to add to each VM
+, extraConfigurations ? [] }:
+
+with import ./build-vms.nix { inherit system pkgs minimal extraConfigurations; };
+with pkgs;
+
+let
+ jquery-ui = callPackage ./testing/jquery-ui.nix { };
+ jquery = callPackage ./testing/jquery.nix { };
+
+in rec {
+
+ inherit pkgs;
+
+
+ testDriver = let
+ testDriverScript = ./test-driver/test-driver.py;
+ in stdenv.mkDerivation {
+ name = "nixos-test-driver";
+
+ nativeBuildInputs = [ makeWrapper ];
+ buildInputs = [ (python3.withPackages (p: [ p.ptpython ])) ];
+ checkInputs = with python3Packages; [ pylint black mypy ];
+
+ dontUnpack = true;
+
+ preferLocalBuild = true;
+
+ doCheck = true;
+ checkPhase = ''
+ mypy --disallow-untyped-defs \
+ --no-implicit-optional \
+ --ignore-missing-imports ${testDriverScript}
+ pylint --errors-only ${testDriverScript}
+ black --check --diff ${testDriverScript}
+ '';
+
+ installPhase =
+ ''
+ mkdir -p $out/bin
+ cp ${testDriverScript} $out/bin/nixos-test-driver
+ chmod u+x $out/bin/nixos-test-driver
+ # TODO: copy user script part into this file (append)
+
+ wrapProgram $out/bin/nixos-test-driver \
+ --prefix PATH : "${lib.makeBinPath [ qemu_test vde2 netpbm coreutils ]}" \
+ '';
+ };
+
+
+ # Run an automated test suite in the given virtual network.
+ # `driver' is the script that runs the network.
+ runTests = driver:
+ stdenv.mkDerivation {
+ name = "vm-test-run-${driver.testName}";
+
+ requiredSystemFeatures = [ "kvm" "nixos-test" ];
+
+ buildInputs = [ libxslt ];
+
+ buildCommand =
+ ''
+ mkdir -p $out/nix-support
+
+ LOGFILE=$out/log.xml tests='exec(os.environ["testScript"])' ${driver}/bin/nixos-test-driver
+
+ # Generate a pretty-printed log.
+ xsltproc --output $out/log.html ${./test-driver/log2html.xsl} $out/log.xml
+ ln -s ${./test-driver/logfile.css} $out/logfile.css
+ ln -s ${./test-driver/treebits.js} $out/treebits.js
+ ln -s ${jquery}/js/jquery.min.js $out/
+ ln -s ${jquery}/js/jquery.js $out/
+ ln -s ${jquery-ui}/js/jquery-ui.min.js $out/
+ ln -s ${jquery-ui}/js/jquery-ui.js $out/
+
+ touch $out/nix-support/hydra-build-products
+ echo "report testlog $out log.html" >> $out/nix-support/hydra-build-products
+
+ for i in */xchg/coverage-data; do
+ mkdir -p $out/coverage-data
+ mv $i $out/coverage-data/$(dirname $(dirname $i))
+ done
+ '';
+ };
+
+
+ makeTest =
+ { testScript
+ , makeCoverageReport ? false
+ , enableOCR ? false
+ , name ? "unnamed"
+ # Skip linting (mainly intended for faster dev cycles)
+ , skipLint ? false
+ , ...
+ } @ t:
+
+ let
+ # A standard store path to the vm monitor is built like this:
+ # /tmp/nix-build-vm-test-run-$name.drv-0/vm-state-machine/monitor
+ # The max filename length of a unix domain socket is 108 bytes.
+ # This means $name can at most be 50 bytes long.
+ maxTestNameLen = 50;
+ testNameLen = builtins.stringLength name;
+
+ testDriverName = with builtins;
+ if testNameLen > maxTestNameLen then
+ abort ("The name of the test '${name}' must not be longer than ${toString maxTestNameLen} " +
+ "it's currently ${toString testNameLen} characters long.")
+ else
+ "nixos-test-driver-${name}";
+
+ nodes = buildVirtualNetwork (
+ t.nodes or (if t ? machine then { machine = t.machine; } else { }));
+
+ testScript' =
+ # Call the test script with the computed nodes.
+ if lib.isFunction testScript
+ then testScript { inherit nodes; }
+ else testScript;
+
+ vlans = map (m: m.config.virtualisation.vlans) (lib.attrValues nodes);
+
+ vms = map (m: m.config.system.build.vm) (lib.attrValues nodes);
+
+ ocrProg = tesseract4.override { enableLanguages = [ "eng" ]; };
+
+ imagemagick_tiff = imagemagick_light.override { inherit libtiff; };
+
+ # Generate onvenience wrappers for running the test driver
+ # interactively with the specified network, and for starting the
+ # VMs from the command line.
+ driver = let warn = if skipLint then lib.warn "Linting is disabled!" else lib.id; in warn (runCommand testDriverName
+ { buildInputs = [ makeWrapper];
+ testScript = testScript';
+ preferLocalBuild = true;
+ testName = name;
+ }
+ ''
+ mkdir -p $out/bin
+
+ echo -n "$testScript" > $out/test-script
+ ${lib.optionalString (!skipLint) ''
+ ${python3Packages.black}/bin/black --check --diff $out/test-script
+ ''}
+
+ ln -s ${testDriver}/bin/nixos-test-driver $out/bin/
+ vms=($(for i in ${toString vms}; do echo $i/bin/run-*-vm; done))
+ wrapProgram $out/bin/nixos-test-driver \
+ --add-flags "''${vms[*]}" \
+ ${lib.optionalString enableOCR
+ "--prefix PATH : '${ocrProg}/bin:${imagemagick_tiff}/bin'"} \
+ --run "export testScript=\"\$(cat $out/test-script)\"" \
+ --set VLANS '${toString vlans}'
+ ln -s ${testDriver}/bin/nixos-test-driver $out/bin/nixos-run-vms
+ wrapProgram $out/bin/nixos-run-vms \
+ --add-flags "''${vms[*]}" \
+ ${lib.optionalString enableOCR "--prefix PATH : '${ocrProg}/bin'"} \
+ --set tests 'start_all(); join_all();' \
+ --set VLANS '${toString vlans}' \
+ ${lib.optionalString (builtins.length vms == 1) "--set USE_SERIAL 1"}
+ ''); # "
+
+ passMeta = drv: drv // lib.optionalAttrs (t ? meta) {
+ meta = (drv.meta or {}) // t.meta;
+ };
+
+ test = passMeta (runTests driver);
+ report = passMeta (releaseTools.gcovReport { coverageRuns = [ test ]; });
+
+ nodeNames = builtins.attrNames nodes;
+ invalidNodeNames = lib.filter
+ (node: builtins.match "^[A-z_][A-z0-9_]+$" node == null) nodeNames;
+
+ in
+ if lib.length invalidNodeNames > 0 then
+ throw ''
+ Cannot create machines out of (${lib.concatStringsSep ", " invalidNodeNames})!
+ All machines are referenced as perl variables in the testing framework which will break the
+ script when special characters are used.
+
+ Please stick to alphanumeric chars and underscores as separation.
+ ''
+ else
+ (if makeCoverageReport then report else test) // {
+ inherit nodes driver test;
+ };
+
+ runInMachine =
+ { drv
+ , machine
+ , preBuild ? ""
+ , postBuild ? ""
+ , ... # ???
+ }:
+ let
+ vm = buildVM { }
+ [ machine
+ { key = "run-in-machine";
+ networking.hostName = "client";
+ nix.readOnlyStore = false;
+ virtualisation.writableStore = false;
+ }
+ ];
+
+ buildrunner = writeText "vm-build" ''
+ source $1
+
+ ${coreutils}/bin/mkdir -p $TMPDIR
+ cd $TMPDIR
+
+ exec $origBuilder $origArgs
+ '';
+
+ testScript = ''
+ startAll;
+ $client->waitForUnit("multi-user.target");
+ ${preBuild}
+ $client->succeed("env -i ${bash}/bin/bash ${buildrunner} /tmp/xchg/saved-env >&2");
+ ${postBuild}
+ $client->succeed("sync"); # flush all data before pulling the plug
+ '';
+
+ vmRunCommand = writeText "vm-run" ''
+ xchg=vm-state-client/xchg
+ ${coreutils}/bin/mkdir $out
+ ${coreutils}/bin/mkdir -p $xchg
+
+ for i in $passAsFile; do
+ i2=''${i}Path
+ _basename=$(${coreutils}/bin/basename ''${!i2})
+ ${coreutils}/bin/cp ''${!i2} $xchg/$_basename
+ eval $i2=/tmp/xchg/$_basename
+ ${coreutils}/bin/ls -la $xchg
+ done
+
+ unset i i2 _basename
+ export | ${gnugrep}/bin/grep -v '^xchg=' > $xchg/saved-env
+ unset xchg
+
+ export tests='${testScript}'
+ ${testDriver}/bin/nixos-test-driver ${vm.config.system.build.vm}/bin/run-*-vm
+ ''; # */
+
+ in
+ lib.overrideDerivation drv (attrs: {
+ requiredSystemFeatures = [ "kvm" ];
+ builder = "${bash}/bin/sh";
+ args = ["-e" vmRunCommand];
+ origArgs = attrs.args;
+ origBuilder = attrs.builder;
+ });
+
+
+ runInMachineWithX = { require ? [], ... } @ args:
+ let
+ client =
+ { ... }:
+ {
+ inherit require;
+ virtualisation.memorySize = 1024;
+ services.xserver.enable = true;
+ services.xserver.displayManager.auto.enable = true;
+ services.xserver.displayManager.defaultSession = "none+icewm";
+ services.xserver.windowManager.icewm.enable = true;
+ };
+ in
+ runInMachine ({
+ machine = client;
+ preBuild =
+ ''
+ $client->waitForX;
+ '';
+ } // args);
+
+
+ simpleTest = as: (makeTest as).test;
+
+}
diff --git a/nixos/lib/testing.nix b/nixos/lib/testing.nix
index 7670687710363d90b9b5e51dbce5b11aa65639d6..ae8ecd6270ce316b9453a01a2b7ac65994922ef8 100644
--- a/nixos/lib/testing.nix
+++ b/nixos/lib/testing.nix
@@ -248,11 +248,9 @@ in rec {
inherit require;
virtualisation.memorySize = 1024;
services.xserver.enable = true;
- services.xserver.displayManager.slim.enable = false;
services.xserver.displayManager.auto.enable = true;
- services.xserver.windowManager.default = "icewm";
+ services.xserver.displayManager.defaultSession = "none+icewm";
services.xserver.windowManager.icewm.enable = true;
- services.xserver.desktopManager.default = "none";
};
in
runInMachine ({
diff --git a/nixos/maintainers/scripts/ec2/create-amis.sh b/nixos/maintainers/scripts/ec2/create-amis.sh
index c4149e3e8ffe69bccbf6174e25a101b2b629569a..5dc1c5aaed57d503e3afc97e77163989950116f5 100755
--- a/nixos/maintainers/scripts/ec2/create-amis.sh
+++ b/nixos/maintainers/scripts/ec2/create-amis.sh
@@ -14,7 +14,7 @@
set -euo pipefail
# configuration
-state_dir=/home/deploy/amis/ec2-images
+state_dir=$HOME/amis/ec2-images
home_region=eu-west-1
bucket=nixos-amis
@@ -211,11 +211,11 @@ upload_image() {
log "Registering snapshot $snapshot_id as AMI"
local block_device_mappings=(
- "DeviceName=/dev/sda1,Ebs={SnapshotId=$snapshot_id,VolumeSize=$image_logical_gigabytes,DeleteOnTermination=true,VolumeType=gp2}"
+ "DeviceName=/dev/xvda,Ebs={SnapshotId=$snapshot_id,VolumeSize=$image_logical_gigabytes,DeleteOnTermination=true,VolumeType=gp2}"
)
local extra_flags=(
- --root-device-name /dev/sda1
+ --root-device-name /dev/xvda
--sriov-net-support simple
--ena-support
--virtualization-type hvm
diff --git a/nixos/maintainers/scripts/gce/create-gce.sh b/nixos/maintainers/scripts/gce/create-gce.sh
index 48748a59d298a41ff022f7c9ae76efc507c124ca..77cc64e591e9993fa69165dd84cb3fb9b55485ba 100755
--- a/nixos/maintainers/scripts/gce/create-gce.sh
+++ b/nixos/maintainers/scripts/gce/create-gce.sh
@@ -15,7 +15,7 @@ nix-build '' \
-j 10
img_path=$(echo gce/*.tar.gz)
-img_name=$(basename "$img_path")
+img_name=${IMAGE_NAME:-$(basename "$img_path")}
img_id=$(echo "$img_name" | sed 's|.raw.tar.gz$||;s|\.|-|g;s|_|-|g')
if ! gsutil ls "gs://${BUCKET_NAME}/$img_name"; then
gsutil cp "$img_path" "gs://${BUCKET_NAME}/$img_name"
diff --git a/nixos/modules/config/console.nix b/nixos/modules/config/console.nix
new file mode 100644
index 0000000000000000000000000000000000000000..f662ed62d31dc003101348df51462708a3212903
--- /dev/null
+++ b/nixos/modules/config/console.nix
@@ -0,0 +1,203 @@
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.console;
+
+ makeColor = i: concatMapStringsSep "," (x: "0x" + substring (2*i) 2 x);
+
+ isUnicode = hasSuffix "UTF-8" (toUpper config.i18n.defaultLocale);
+
+ optimizedKeymap = pkgs.runCommand "keymap" {
+ nativeBuildInputs = [ pkgs.buildPackages.kbd ];
+ LOADKEYS_KEYMAP_PATH = "${consoleEnv}/share/keymaps/**";
+ preferLocalBuild = true;
+ } ''
+ loadkeys -b ${optionalString isUnicode "-u"} "${cfg.keyMap}" > $out
+ '';
+
+ # Sadly, systemd-vconsole-setup doesn't support binary keymaps.
+ vconsoleConf = pkgs.writeText "vconsole.conf" ''
+ KEYMAP=${cfg.keyMap}
+ FONT=${cfg.font}
+ '';
+
+ consoleEnv = pkgs.buildEnv {
+ name = "console-env";
+ paths = [ pkgs.kbd ] ++ cfg.packages;
+ pathsToLink = [
+ "/share/consolefonts"
+ "/share/consoletrans"
+ "/share/keymaps"
+ "/share/unimaps"
+ ];
+ };
+
+ setVconsole = !config.boot.isContainer;
+in
+
+{
+ ###### interface
+
+ options.console = {
+ font = mkOption {
+ type = types.str;
+ default = "Lat2-Terminus16";
+ example = "LatArCyrHeb-16";
+ description = ''
+ The font used for the virtual consoles. Leave empty to use
+ whatever the setfont program considers the
+ default font.
+ '';
+ };
+
+ keyMap = mkOption {
+ type = with types; either str path;
+ default = "us";
+ example = "fr";
+ description = ''
+ The keyboard mapping table for the virtual consoles.
+ '';
+ };
+
+ colors = mkOption {
+ type = types.listOf types.str;
+ default = [];
+ example = [
+ "002b36" "dc322f" "859900" "b58900"
+ "268bd2" "d33682" "2aa198" "eee8d5"
+ "002b36" "cb4b16" "586e75" "657b83"
+ "839496" "6c71c4" "93a1a1" "fdf6e3"
+ ];
+ description = ''
+ The 16 colors palette used by the virtual consoles.
+ Leave empty to use the default colors.
+ Colors must be in hexadecimal format and listed in
+ order from color 0 to color 15.
+ '';
+
+ };
+
+ packages = mkOption {
+ type = types.listOf types.package;
+ default = with pkgs.kbdKeymaps; [ dvp neo ];
+ defaultText = ''with pkgs.kbdKeymaps; [ dvp neo ]'';
+ description = ''
+ List of additional packages that provide console fonts, keymaps and
+ other resources for virtual consoles use.
+ '';
+ };
+
+ extraTTYs = mkOption {
+ default = [];
+ type = types.listOf types.str;
+ example = ["tty8" "tty9"];
+ description = ''
+ TTY (virtual console) devices, in addition to the consoles on
+ which mingetty and syslogd run, that must be initialised.
+ Only useful if you have some program that you want to run on
+ some fixed console. For example, the NixOS installation CD
+ opens the manual in a web browser on console 7, so it sets
+ to ["tty7"].
+ '';
+ };
+
+ useXkbConfig = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ If set, configure the virtual console keymap from the xserver
+ keyboard settings.
+ '';
+ };
+
+ earlySetup = mkOption {
+ default = false;
+ type = types.bool;
+ description = ''
+ Enable setting virtual console options as early as possible (in initrd).
+ '';
+ };
+
+ };
+
+
+ ###### implementation
+
+ config = mkMerge [
+ { console.keyMap = with config.services.xserver;
+ mkIf cfg.useXkbConfig
+ (pkgs.runCommand "xkb-console-keymap" { preferLocalBuild = true; } ''
+ '${pkgs.ckbcomp}/bin/ckbcomp' -model '${xkbModel}' -layout '${layout}' \
+ -option '${xkbOptions}' -variant '${xkbVariant}' > "$out"
+ '');
+ }
+
+ (mkIf (!setVconsole) {
+ systemd.services.systemd-vconsole-setup.enable = false;
+ })
+
+ (mkIf setVconsole (mkMerge [
+ { environment.systemPackages = [ pkgs.kbd ];
+
+ # Let systemd-vconsole-setup.service do the work of setting up the
+ # virtual consoles.
+ environment.etc."vconsole.conf".source = vconsoleConf;
+ # Provide kbd with additional packages.
+ environment.etc.kbd.source = "${consoleEnv}/share";
+
+ boot.initrd.preLVMCommands = mkBefore ''
+ kbd_mode ${if isUnicode then "-u" else "-a"} -C /dev/console
+ printf "\033%%${if isUnicode then "G" else "@"}" >> /dev/console
+ loadkmap < ${optimizedKeymap}
+
+ ${optionalString cfg.earlySetup ''
+ setfont -C /dev/console $extraUtils/share/consolefonts/font.psf
+ ''}
+ '';
+
+ systemd.services.systemd-vconsole-setup =
+ { before = [ "display-manager.service" ];
+ after = [ "systemd-udev-settle.service" ];
+ restartTriggers = [ vconsoleConf consoleEnv ];
+ };
+ }
+
+ (mkIf (cfg.colors != []) {
+ boot.kernelParams = [
+ "vt.default_red=${makeColor 0 cfg.colors}"
+ "vt.default_grn=${makeColor 1 cfg.colors}"
+ "vt.default_blu=${makeColor 2 cfg.colors}"
+ ];
+ })
+
+ (mkIf cfg.earlySetup {
+ boot.initrd.extraUtilsCommands = ''
+ mkdir -p $out/share/consolefonts
+ ${if substring 0 1 cfg.font == "/" then ''
+ font="${cfg.font}"
+ '' else ''
+ font="$(echo ${consoleEnv}/share/consolefonts/${cfg.font}.*)"
+ ''}
+ if [[ $font == *.gz ]]; then
+ gzip -cd $font > $out/share/consolefonts/font.psf
+ else
+ cp -L $font $out/share/consolefonts/font.psf
+ fi
+ '';
+ })
+ ]))
+ ];
+
+ imports = [
+ (mkRenamedOptionModule [ "i18n" "consoleFont" ] [ "console" "font" ])
+ (mkRenamedOptionModule [ "i18n" "consoleKeyMap" ] [ "console" "keyMap" ])
+ (mkRenamedOptionModule [ "i18n" "consoleColors" ] [ "console" "colors" ])
+ (mkRenamedOptionModule [ "i18n" "consolePackages" ] [ "console" "packages" ])
+ (mkRenamedOptionModule [ "i18n" "consoleUseXkbConfig" ] [ "console" "useXkbConfig" ])
+ (mkRenamedOptionModule [ "boot" "earlyVconsoleSetup" ] [ "console" "earlySetup" ])
+ (mkRenamedOptionModule [ "boot" "extraTTYs" ] [ "console" "extraTTYs" ])
+ ];
+}
diff --git a/nixos/modules/config/fonts/corefonts.nix b/nixos/modules/config/fonts/corefonts.nix
deleted file mode 100644
index b9f69879a10365bf9cabbfccc062e519396436b0..0000000000000000000000000000000000000000
--- a/nixos/modules/config/fonts/corefonts.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-# This module is deprecated, since you can just say ‘fonts.fonts = [
-# pkgs.corefonts ];’ instead.
-
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-{
-
- options = {
-
- fonts = {
-
- enableCoreFonts = mkOption {
- visible = false;
- default = false;
- description = ''
- Whether to include Microsoft's proprietary Core Fonts. These fonts
- are redistributable, but only verbatim, among other restrictions.
- See
- for details.
- '';
- };
-
- };
-
- };
-
-
- config = mkIf config.fonts.enableCoreFonts {
-
- fonts.fonts = [ pkgs.corefonts ];
-
- };
-
-}
diff --git a/nixos/modules/config/fonts/fontconfig-ultimate.nix b/nixos/modules/config/fonts/fontconfig-ultimate.nix
deleted file mode 100644
index 84d90899dfff4e1d22f083b835e447ab9019f003..0000000000000000000000000000000000000000
--- a/nixos/modules/config/fonts/fontconfig-ultimate.nix
+++ /dev/null
@@ -1,86 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with lib;
-
-let cfg = config.fonts.fontconfig.ultimate;
-
- latestVersion = pkgs.fontconfig.configVersion;
-
- # The configuration to be included in /etc/font/
- confPkg = pkgs.runCommand "font-ultimate-conf" { preferLocalBuild = true; } ''
- support_folder=$out/etc/fonts/conf.d
- latest_folder=$out/etc/fonts/${latestVersion}/conf.d
-
- mkdir -p $support_folder
- mkdir -p $latest_folder
-
- # fontconfig ultimate substitutions
- ${optionalString (cfg.substitutions != "none") ''
- ln -s ${pkgs.fontconfig-ultimate}/etc/fonts/presets/${cfg.substitutions}/*.conf \
- $support_folder
- ln -s ${pkgs.fontconfig-ultimate}/etc/fonts/presets/${cfg.substitutions}/*.conf \
- $latest_folder
- ''}
-
- # fontconfig ultimate various configuration files
- ln -s ${pkgs.fontconfig-ultimate}/etc/fonts/conf.d/*.conf \
- $support_folder
- ln -s ${pkgs.fontconfig-ultimate}/etc/fonts/conf.d/*.conf \
- $latest_folder
- '';
-
-in
-{
-
- options = {
-
- fonts = {
-
- fontconfig = {
-
- ultimate = {
- enable = mkOption {
- type = types.bool;
- default = false;
- description = ''
- Enable fontconfig-ultimate settings (formerly known as
- Infinality). Besides the customizable settings in this NixOS
- module, fontconfig-ultimate also provides many font-specific
- rendering tweaks.
- '';
- };
-
- substitutions = mkOption {
- type = types.enum ["free" "combi" "ms" "none"];
- default = "free";
- description = ''
- Font substitutions to replace common Type 1 fonts with nicer
- TrueType fonts. free uses free fonts,
- ms uses Microsoft fonts,
- combi uses a combination, and
- none disables the substitutions.
- '';
- };
-
- preset = mkOption {
- type = types.enum ["ultimate1" "ultimate2" "ultimate3" "ultimate4" "ultimate5" "osx" "windowsxp"];
- default = "ultimate3";
- description = ''
- FreeType rendering settings preset. Any of the presets may be
- customized by setting environment variables.
- '';
- };
- };
- };
- };
-
- };
-
- config = mkIf (config.fonts.fontconfig.enable && cfg.enable) {
-
- fonts.fontconfig.confPackages = [ confPkg ];
- environment.variables.INFINALITY_FT = cfg.preset;
-
- };
-
-}
diff --git a/nixos/modules/config/fonts/fontconfig.nix b/nixos/modules/config/fonts/fontconfig.nix
index 8f227c423266bc47a87f0ef05d4585e099c81e9a..3bfa1893a8bac48b539321f47825e82dd71f6da1 100644
--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@@ -264,6 +264,16 @@ let
};
in
{
+ imports = [
+ (mkRenamedOptionModule [ "fonts" "fontconfig" "ultimate" "allowBitmaps" ] [ "fonts" "fontconfig" "allowBitmaps" ])
+ (mkRenamedOptionModule [ "fonts" "fontconfig" "ultimate" "allowType1" ] [ "fonts" "fontconfig" "allowType1" ])
+ (mkRenamedOptionModule [ "fonts" "fontconfig" "ultimate" "useEmbeddedBitmaps" ] [ "fonts" "fontconfig" "useEmbeddedBitmaps" ])
+ (mkRenamedOptionModule [ "fonts" "fontconfig" "ultimate" "forceAutohint" ] [ "fonts" "fontconfig" "forceAutohint" ])
+ (mkRenamedOptionModule [ "fonts" "fontconfig" "ultimate" "renderMonoTTFAsBitmap" ] [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ])
+ (mkRemovedOptionModule [ "fonts" "fontconfig" "hinting" "style" ] "")
+ (mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
+ (mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
+ ];
options = {
diff --git a/nixos/modules/config/fonts/fonts.nix b/nixos/modules/config/fonts/fonts.nix
index abb806b601a76a5f497531204b6120bf569579b1..b9bae44b2f9c1991472e239355985e37a4c3486c 100644
--- a/nixos/modules/config/fonts/fonts.nix
+++ b/nixos/modules/config/fonts/fonts.nix
@@ -3,6 +3,9 @@
with lib;
{
+ imports = [
+ (mkRemovedOptionModule [ "fonts" "enableCoreFonts" ] "Use fonts.fonts = [ pkgs.corefonts ]; instead.")
+ ];
options = {
diff --git a/nixos/modules/config/i18n.nix b/nixos/modules/config/i18n.nix
index dc7305b1ba24c7ded0dbbaaa8fc3937e30d1e3d1..45691f4839c8d34f21644bd42459aba2eca98a17 100644
--- a/nixos/modules/config/i18n.nix
+++ b/nixos/modules/config/i18n.nix
@@ -58,66 +58,6 @@ with lib;
'';
};
- consolePackages = mkOption {
- type = types.listOf types.package;
- default = with pkgs.kbdKeymaps; [ dvp neo ];
- defaultText = ''with pkgs.kbdKeymaps; [ dvp neo ]'';
- description = ''
- List of additional packages that provide console fonts, keymaps and
- other resources.
- '';
- };
-
- consoleFont = mkOption {
- type = types.str;
- default = "Lat2-Terminus16";
- example = "LatArCyrHeb-16";
- description = ''
- The font used for the virtual consoles. Leave empty to use
- whatever the setfont program considers the
- default font.
- '';
- };
-
- consoleUseXkbConfig = mkOption {
- type = types.bool;
- default = false;
- description = ''
- If set, configure the console keymap from the xserver keyboard
- settings.
- '';
- };
-
- consoleKeyMap = mkOption {
- type = mkOptionType {
- name = "string or path";
- check = t: (isString t || types.path.check t);
- };
-
- default = "us";
- example = "fr";
- description = ''
- The keyboard mapping table for the virtual consoles.
- '';
- };
-
- consoleColors = mkOption {
- type = types.listOf types.str;
- default = [];
- example = [
- "002b36" "dc322f" "859900" "b58900"
- "268bd2" "d33682" "2aa198" "eee8d5"
- "002b36" "cb4b16" "586e75" "657b83"
- "839496" "6c71c4" "93a1a1" "fdf6e3"
- ];
- description = ''
- The 16 colors palette used by the virtual consoles.
- Leave empty to use the default colors.
- Colors must be in hexadecimal format and listed in
- order from color 0 to color 15.
- '';
- };
-
};
};
@@ -127,13 +67,6 @@ with lib;
config = {
- i18n.consoleKeyMap = with config.services.xserver;
- mkIf config.i18n.consoleUseXkbConfig
- (pkgs.runCommand "xkb-console-keymap" { preferLocalBuild = true; } ''
- '${pkgs.ckbcomp}/bin/ckbcomp' -model '${xkbModel}' -layout '${layout}' \
- -option '${xkbOptions}' -variant '${xkbVariant}' > "$out"
- '');
-
environment.systemPackages =
optional (config.i18n.supportedLocales != []) config.i18n.glibcLocales;
diff --git a/nixos/modules/config/networking.nix b/nixos/modules/config/networking.nix
index a89667ea221cc4dc0621346b13188f8907c9e48f..81427bb8ee64cea50d064df79ca7c230dd299ec5 100644
--- a/nixos/modules/config/networking.nix
+++ b/nixos/modules/config/networking.nix
@@ -16,6 +16,9 @@ let
in
{
+ imports = [
+ (mkRemovedOptionModule [ "networking" "hostConf" ] "Use environment.etc.\"host.conf\" instead.")
+ ];
options = {
@@ -41,19 +44,6 @@ in
'';
};
- networking.hostConf = lib.mkOption {
- type = types.lines;
- default = "multi on";
- example = ''
- multi on
- reorder on
- trim lan
- '';
- description = ''
- The contents of /etc/host.conf. See also host.conf5.
- '';
- };
-
networking.timeServers = mkOption {
default = [
"0.nixos.pool.ntp.org"
@@ -186,7 +176,9 @@ in
'';
# /etc/host.conf: resolver configuration file
- "host.conf".text = cfg.hostConf;
+ "host.conf".text = ''
+ multi on
+ '';
} // optionalAttrs (pkgs.stdenv.hostPlatform.libc == "glibc") {
# /etc/rpc: RPC program numbers.
diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index 74cf74d74181fbadb779ee77671ff2fa617ae28c..873b8073fed9c8a5530509cd58b587a88f4acb59 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -34,7 +34,6 @@ with lib;
networkmanager-openvpn = super.networkmanager-openvpn.override { withGnome = false; };
networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
- pinentry = super.pinentry.override { gtk2 = null; gcr = null; qt4 = null; qt5 = null; };
gobject-introspection = super.gobject-introspection.override { x11Support = false; };
}));
};
diff --git a/nixos/modules/config/pulseaudio.nix b/nixos/modules/config/pulseaudio.nix
index 5c3e3930258379b05e2c4414d64a1cb07030fb4e..9baad9b585455a6099110ba40a2881de3f310d32 100644
--- a/nixos/modules/config/pulseaudio.nix
+++ b/nixos/modules/config/pulseaudio.nix
@@ -51,8 +51,7 @@ let
# that we can disable the autospawn feature in programs that
# are built with PulseAudio support (like KDE).
clientConf = writeText "client.conf" ''
- autospawn=${if nonSystemWide then "yes" else "no"}
- ${optionalString nonSystemWide "daemon-binary=${binary}"}
+ autospawn=no
${cfg.extraClientConf}
'';
@@ -99,11 +98,12 @@ in {
description = ''
If false, a PulseAudio server is launched automatically for
each user that tries to use the sound system. The server runs
- with user privileges. This is the recommended and most secure
- way to use PulseAudio. If true, one system-wide PulseAudio
+ with user privileges. If true, one system-wide PulseAudio
server is launched on boot, running as the user "pulse", and
only users in the "audio" group will have access to the server.
Please read the PulseAudio documentation for more details.
+
+ Don't enable this option unless you know what you are doing.
'';
};
diff --git a/nixos/modules/config/qt5.nix b/nixos/modules/config/qt5.nix
index 7de1c0f5d5574eedfab86d716bb786ab789f7436..d9dec74f1552519cbd7e34675289a24e7843e223 100644
--- a/nixos/modules/config/qt5.nix
+++ b/nixos/modules/config/qt5.nix
@@ -10,7 +10,7 @@ let
isQtStyle = cfg.platformTheme == "gtk2" && cfg.style != "adwaita";
packages = if isQGnome then [ pkgs.qgnomeplatform pkgs.adwaita-qt ]
- else if isQtStyle then [ pkgs.qtstyleplugins ]
+ else if isQtStyle then [ pkgs.libsForQt5.qtstyleplugins ]
else throw "`qt5.platformTheme` ${cfg.platformTheme} and `qt5.style` ${cfg.style} are not compatible.";
in
diff --git a/nixos/modules/config/resolvconf.nix b/nixos/modules/config/resolvconf.nix
index 406c6a7ac32960750839c1f765291635d5cca23c..7d2f252a88863fed6f84514b3cbb3906e9d90135 100644
--- a/nixos/modules/config/resolvconf.nix
+++ b/nixos/modules/config/resolvconf.nix
@@ -33,6 +33,12 @@ let
in
{
+ imports = [
+ (mkRenamedOptionModule [ "networking" "dnsSingleRequest" ] [ "networking" "resolvconf" "dnsSingleRequest" ])
+ (mkRenamedOptionModule [ "networking" "dnsExtensionMechanism" ] [ "networking" "resolvconf" "dnsExtensionMechanism" ])
+ (mkRenamedOptionModule [ "networking" "extraResolvconfConf" ] [ "networking" "resolvconf" "extraConfig" ])
+ (mkRenamedOptionModule [ "networking" "resolvconfOptions" ] [ "networking" "resolvconf" "extraOptions" ])
+ ];
options = {
diff --git a/nixos/modules/config/shells-environment.nix b/nixos/modules/config/shells-environment.nix
index 9dfc1add82996e3691687248dce910253f635876..a0a20228a742230a87874b8f77ad5f3a225fba20 100644
--- a/nixos/modules/config/shells-environment.nix
+++ b/nixos/modules/config/shells-environment.nix
@@ -118,6 +118,14 @@ in
type = with types; attrsOf (nullOr (either str path));
};
+ environment.homeBinInPath = mkOption {
+ description = ''
+ Include ~/bin/ in $PATH.
+ '';
+ default = false;
+ type = types.bool;
+ };
+
environment.binsh = mkOption {
default = "${config.system.build.binsh}/bin/sh";
defaultText = "\${config.system.build.binsh}/bin/sh";
@@ -157,6 +165,8 @@ in
# terminal instead of logging out of X11).
environment.variables = config.environment.sessionVariables;
+ environment.profileRelativeEnvVars = config.environment.profileRelativeSessionVariables;
+
environment.shellAliases = mapAttrs (name: mkDefault) {
ls = "ls --color=tty";
ll = "ls -l";
@@ -184,8 +194,10 @@ in
${cfg.extraInit}
- # ~/bin if it exists overrides other bin directories.
- export PATH="$HOME/bin:$PATH"
+ ${optionalString cfg.homeBinInPath ''
+ # ~/bin if it exists overrides other bin directories.
+ export PATH="$HOME/bin:$PATH"
+ ''}
'';
system.activationScripts.binsh = stringAfter [ "stdio" ]
diff --git a/nixos/modules/config/swap.nix b/nixos/modules/config/swap.nix
index fed3fa3bc7c88b2853e606ef73639cbb7f9a0892..d0fc0d4a3ea409205c5408f31aca29f21efd7a5a 100644
--- a/nixos/modules/config/swap.nix
+++ b/nixos/modules/config/swap.nix
@@ -58,7 +58,7 @@ let
device = mkOption {
example = "/dev/sda3";
type = types.str;
- description = "Path of the device.";
+ description = "Path of the device or swap file.";
};
label = mkOption {
diff --git a/nixos/modules/config/sysctl.nix b/nixos/modules/config/sysctl.nix
index fb2b58eed7203fec0f9d8514ad11f6190fcb308f..e59c7a32c28780d5a3b922ab2c9d662e81930d6d 100644
--- a/nixos/modules/config/sysctl.nix
+++ b/nixos/modules/config/sysctl.nix
@@ -54,7 +54,7 @@ in
# Hide kernel pointers (e.g. in /proc/modules) for unprivileged
# users as these make it easier to exploit kernel vulnerabilities.
- boot.kernel.sysctl."kernel.kptr_restrict" = 1;
+ boot.kernel.sysctl."kernel.kptr_restrict" = mkDefault 1;
# Disable YAMA by default to allow easy debugging.
boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkDefault 0;
diff --git a/nixos/modules/config/system-environment.nix b/nixos/modules/config/system-environment.nix
index 6011e354ece48ac8e1a966b0861dfc88190fd724..4888740ba3d5337cdb272f5568ec2881eff35fd5 100644
--- a/nixos/modules/config/system-environment.nix
+++ b/nixos/modules/config/system-environment.nix
@@ -18,25 +18,88 @@ in
default = {};
description = ''
A set of environment variables used in the global environment.
- These variables will be set by PAM.
- The value of each variable can be either a string or a list of
- strings. The latter is concatenated, interspersed with colon
- characters.
+ These variables will be set by PAM early in the login process.
+
+ The value of each session variable can be either a string or a
+ list of strings. The latter is concatenated, interspersed with
+ colon characters.
+
+ Note, due to limitations in the PAM format values may not
+ contain the " character.
+
+ Also, these variables are merged into
+ and it is
+ therefore not possible to use PAM style variables such as
+ @{HOME}.
'';
type = with types; attrsOf (either str (listOf str));
apply = mapAttrs (n: v: if isList v then concatStringsSep ":" v else v);
};
+ environment.profileRelativeSessionVariables = mkOption {
+ type = types.attrsOf (types.listOf types.str);
+ example = { PATH = [ "/bin" ]; MANPATH = [ "/man" "/share/man" ]; };
+ description = ''
+ Attribute set of environment variable used in the global
+ environment. These variables will be set by PAM early in the
+ login process.
+
+ Variable substitution is available as described in
+
+ pam_env.conf
+ 5
+ .
+
+ Each attribute maps to a list of relative paths. Each relative
+ path is appended to the each profile of
+ to form the content of
+ the corresponding environment variable.
+
+ Also, these variables are merged into
+ and it is
+ therefore not possible to use PAM style variables such as
+ @{HOME}.
+ '';
+ };
+
};
config = {
- system.build.pamEnvironment = pkgs.writeText "pam-environment"
- ''
- ${concatStringsSep "\n" (
- (mapAttrsToList (n: v: ''${n}="${concatStringsSep ":" v}"'')
- (zipAttrsWith (const concatLists) ([ (mapAttrs (n: v: [ v ]) cfg.sessionVariables) ]))))}
- '';
+ system.build.pamEnvironment =
+ let
+ suffixedVariables =
+ flip mapAttrs cfg.profileRelativeSessionVariables (envVar: suffixes:
+ flip concatMap cfg.profiles (profile:
+ map (suffix: "${profile}${suffix}") suffixes
+ )
+ );
+
+ # We're trying to use the same syntax for PAM variables and env variables.
+ # That means we need to map the env variables that people might use to their
+ # equivalent PAM variable.
+ replaceEnvVars = replaceStrings ["$HOME" "$USER"] ["@{HOME}" "@{PAM_USER}"];
+
+ pamVariable = n: v:
+ ''${n} DEFAULT="${concatStringsSep ":" (map replaceEnvVars (toList v))}"'';
+
+ pamVariables =
+ concatStringsSep "\n"
+ (mapAttrsToList pamVariable
+ (zipAttrsWith (n: concatLists)
+ [
+ # Make sure security wrappers are prioritized without polluting
+ # shell environments with an extra entry. Sessions which depend on
+ # pam for its environment will otherwise have eg. broken sudo. In
+ # particular Gnome Shell sometimes fails to source a proper
+ # environment from a shell.
+ { PATH = [ config.security.wrapperDir ]; }
+
+ (mapAttrs (n: toList) cfg.sessionVariables)
+ suffixedVariables
+ ]));
+ in
+ pkgs.writeText "pam-environment" "${pamVariables}\n";
};
diff --git a/nixos/modules/config/system-path.nix b/nixos/modules/config/system-path.nix
index fae2fc74008290df848919ec3c5a385bec8bb219..aba9bc0945b19118552b39346c009422885de5f7 100644
--- a/nixos/modules/config/system-path.nix
+++ b/nixos/modules/config/system-path.nix
@@ -135,6 +135,9 @@ in
# outputs TODO: note that the tools will often not be linked by default
postBuild =
''
+ # Remove wrapped binaries, they shouldn't be accessible via PATH.
+ find $out/bin -maxdepth 1 -name ".*-wrapped" -type l -delete
+
if [ -x $out/bin/glib-compile-schemas -a -w $out/share/glib-2.0/schemas ]; then
$out/bin/glib-compile-schemas $out/share/glib-2.0/schemas
fi
diff --git a/nixos/modules/config/terminfo.nix b/nixos/modules/config/terminfo.nix
index b86ce2dbf05726939f5adc762166bde2cf4cb6ad..1396640af6724e61b60dcadfc79c6732d5e4efcd 100644
--- a/nixos/modules/config/terminfo.nix
+++ b/nixos/modules/config/terminfo.nix
@@ -12,7 +12,7 @@
source = "${config.system.path}/share/terminfo";
};
- environment.profileRelativeEnvVars = {
+ environment.profileRelativeSessionVariables = {
TERMINFO_DIRS = [ "/share/terminfo" ];
};
diff --git a/nixos/modules/config/unix-odbc-drivers.nix b/nixos/modules/config/unix-odbc-drivers.nix
index 8dd811727389a3926cba1ac10bb5b8b57866970e..abc12a627d6fae5fdb485e69ea0f47f9117f7001 100644
--- a/nixos/modules/config/unix-odbc-drivers.nix
+++ b/nixos/modules/config/unix-odbc-drivers.nix
@@ -24,7 +24,7 @@ in {
Specifies Unix ODBC drivers to be registered in
/etc/odbcinst.ini. You may also want to
add pkgs.unixODBC to the system path to get
- a command line client to connnect to ODBC databases.
+ a command line client to connect to ODBC databases.
'';
};
};
diff --git a/nixos/modules/config/update-users-groups.pl b/nixos/modules/config/update-users-groups.pl
index 59cea51c611b497aa980293516699d64cdf9600a..15e448b787aaf4cee33c53a5ad3ac4c24e66ca26 100644
--- a/nixos/modules/config/update-users-groups.pl
+++ b/nixos/modules/config/update-users-groups.pl
@@ -56,12 +56,12 @@ sub allocGid {
$gidsUsed{$prevGid} = 1;
return $prevGid;
}
- return allocId(\%gidsUsed, \%gidsPrevUsed, 400, 499, 0, sub { my ($gid) = @_; getgrgid($gid) });
+ return allocId(\%gidsUsed, \%gidsPrevUsed, 400, 999, 0, sub { my ($gid) = @_; getgrgid($gid) });
}
sub allocUid {
my ($name, $isSystemUser) = @_;
- my ($min, $max, $up) = $isSystemUser ? (400, 499, 0) : (1000, 29999, 1);
+ my ($min, $max, $up) = $isSystemUser ? (400, 999, 0) : (1000, 29999, 1);
my $prevUid = $uidMap->{$name};
if (defined $prevUid && $prevUid >= $min && $prevUid <= $max && !defined $uidsUsed{$prevUid}) {
print STDERR "reviving user '$name' with UID $prevUid\n";
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index ba79bd3d6ecc5708dbc13edcc5a77ab547a16239..141e43fec39b2823e6ff73327ffc4b99385ca0c0 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -251,7 +251,7 @@ let
default = [];
example = literalExample "[ pkgs.firefox pkgs.thunderbird ]";
description = ''
- The set of packages that should be made availabe to the user.
+ The set of packages that should be made available to the user.
This is in contrast to ,
which adds packages to all users.
'';
@@ -403,6 +403,10 @@ let
filter types.shellPackage.check shells;
in {
+ imports = [
+ (mkAliasOptionModule [ "users" "extraUsers" ] [ "users" "users" ])
+ (mkAliasOptionModule [ "users" "extraGroups" ] [ "users" "groups" ])
+ ];
###### interface
diff --git a/nixos/modules/config/vpnc.nix b/nixos/modules/config/vpnc.nix
deleted file mode 100644
index 356e007c0a3e94663bc58a8481a762def4e46a83..0000000000000000000000000000000000000000
--- a/nixos/modules/config/vpnc.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{ config, lib, ... }:
-
-with lib;
-
-let
- cfg = config.networking.vpnc;
- mkServiceDef = name: value:
- {
- name = "vpnc/${name}.conf";
- value = { text = value; };
- };
-
-in
-{
- options = {
- networking.vpnc = {
- services = mkOption {
- type = types.attrsOf types.str;
- default = {};
- example = literalExample ''
- { test = '''
- IPSec gateway 192.168.1.1
- IPSec ID someID
- IPSec secret secretKey
- Xauth username name
- Xauth password pass
- ''';
- }
- '';
- description =
- ''
- The names of cisco VPNs and their associated definitions
- '';
- };
- };
- };
-
- config.environment.etc = mapAttrs' mkServiceDef cfg.services;
-}
-
-
diff --git a/nixos/modules/config/xdg/icons.nix b/nixos/modules/config/xdg/icons.nix
index 8268a3771a0ea553561bd2af8b1a3154b5ce1b2e..4677ce090b0bda3b7cb6109786d64233c725cc25 100644
--- a/nixos/modules/config/xdg/icons.nix
+++ b/nixos/modules/config/xdg/icons.nix
@@ -7,21 +7,32 @@ with lib;
type = types.bool;
default = true;
description = ''
- Whether to install files to support the
+ Whether to install files to support the
XDG Icon Theme specification.
'';
};
};
config = mkIf config.xdg.icons.enable {
- environment.pathsToLink = [
- "/share/icons"
- "/share/pixmaps"
+ environment.pathsToLink = [
+ "/share/icons"
+ "/share/pixmaps"
+ ];
+
+ # libXcursor looks for cursors in XCURSOR_PATH
+ # it mostly follows the spec for icons
+ # See: https://www.x.org/releases/current/doc/man/man3/Xcursor.3.xhtml Themes
+
+ # These are preferred so they come first in the list
+ environment.sessionVariables.XCURSOR_PATH = [
+ "$HOME/.icons"
+ "$HOME/.local/share/icons"
+ ];
+
+ environment.profileRelativeSessionVariables.XCURSOR_PATH = [
+ "/share/icons"
+ "/share/pixmaps"
];
-
- environment.profileRelativeEnvVars = {
- XCURSOR_PATH = [ "/share/icons" ];
- };
};
}
diff --git a/nixos/modules/config/xdg/portal.nix b/nixos/modules/config/xdg/portal.nix
index bdbbfda2bb424be5fe53e5f2d0f50e6731eae253..95fa8e05fa3fff35ff08e5c31db9f8bd614611bf 100644
--- a/nixos/modules/config/xdg/portal.nix
+++ b/nixos/modules/config/xdg/portal.nix
@@ -3,6 +3,10 @@
with lib;
{
+ imports = [
+ (mkRenamedOptionModule [ "services" "flatpak" "extraPortals" ] [ "xdg" "portal" "extraPortals" ])
+ ];
+
options.xdg.portal = {
enable =
mkEnableOption "xdg desktop integration"//{
diff --git a/nixos/modules/config/xdg/sounds.nix b/nixos/modules/config/xdg/sounds.nix
index 148240d631cf266696522da2a1fae60f38c84b10..14d6340fc33bc06363abe2c900f0c01337f396cb 100644
--- a/nixos/modules/config/xdg/sounds.nix
+++ b/nixos/modules/config/xdg/sounds.nix
@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
with lib;
{
@@ -14,6 +14,10 @@ with lib;
};
config = mkIf config.xdg.sounds.enable {
+ environment.systemPackages = [
+ pkgs.sound-theme-freedesktop
+ ];
+
environment.pathsToLink = [
"/share/sounds"
];
diff --git a/nixos/modules/hardware/all-firmware.nix b/nixos/modules/hardware/all-firmware.nix
index 534fcc34276b496985ccaa5dd49d342be894285b..16be8bcfdd7d981262f893baab12fe2b2aa5ffc3 100644
--- a/nixos/modules/hardware/all-firmware.nix
+++ b/nixos/modules/hardware/all-firmware.nix
@@ -6,6 +6,14 @@ let
cfg = config.hardware;
in {
+ imports = [
+ (mkRenamedOptionModule [ "networking" "enableRT73Firmware" ] [ "hardware" "enableRedistributableFirmware" ])
+ (mkRenamedOptionModule [ "networking" "enableIntel3945ABGFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
+ (mkRenamedOptionModule [ "networking" "enableIntel2100BGFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
+ (mkRenamedOptionModule [ "networking" "enableRalinkFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
+ (mkRenamedOptionModule [ "networking" "enableRTL8192cFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
+ ];
+
###### interface
options = {
diff --git a/nixos/modules/hardware/brightnessctl.nix b/nixos/modules/hardware/brightnessctl.nix
index 341e4b791c237a96625902acfe6eb1498e34f98f..2d54398d10df559f4cf8ecedc327a9a2702399b4 100644
--- a/nixos/modules/hardware/brightnessctl.nix
+++ b/nixos/modules/hardware/brightnessctl.nix
@@ -25,6 +25,7 @@ in
config = mkIf cfg.enable {
services.udev.packages = with pkgs; [ brightnessctl ];
+ environment.systemPackages = with pkgs; [ brightnessctl ];
};
}
diff --git a/nixos/modules/hardware/brillo.nix b/nixos/modules/hardware/brillo.nix
new file mode 100644
index 0000000000000000000000000000000000000000..e970c94809989665d55fcdc7f2444ff0788cb41e
--- /dev/null
+++ b/nixos/modules/hardware/brillo.nix
@@ -0,0 +1,22 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+ cfg = config.hardware.brillo;
+in
+{
+ options = {
+ hardware.brillo = {
+ enable = mkEnableOption ''
+ Enable brillo in userspace.
+ This will allow brightness control from users in the video group.
+ '';
+ };
+ };
+
+
+ config = mkIf cfg.enable {
+ services.udev.packages = [ pkgs.brillo ];
+ environment.systemPackages = [ pkgs.brillo ];
+ };
+}
diff --git a/nixos/modules/hardware/ckb-next.nix b/nixos/modules/hardware/ckb-next.nix
index 20b2756d8b2663e8cfcfcd100d86d68fdf846f78..fe0ca9f26d54d4dd2e97a08abcb88f0868c5bb28 100644
--- a/nixos/modules/hardware/ckb-next.nix
+++ b/nixos/modules/hardware/ckb-next.nix
@@ -7,6 +7,11 @@ let
in
{
+ imports = [
+ (mkRenamedOptionModule [ "hardware" "ckb" "enable" ] [ "hardware" "ckb-next" "enable" ])
+ (mkRenamedOptionModule [ "hardware" "ckb" "package" ] [ "hardware" "ckb-next" "package" ])
+ ];
+
options.hardware.ckb-next = {
enable = mkEnableOption "the Corsair keyboard/mouse driver";
diff --git a/nixos/modules/hardware/ksm.nix b/nixos/modules/hardware/ksm.nix
index 99d46c25236e00fd165b563f4865476475d85d0e..0938dbdc11018cfca77474b11e2a930034901c5f 100644
--- a/nixos/modules/hardware/ksm.nix
+++ b/nixos/modules/hardware/ksm.nix
@@ -6,6 +6,10 @@ let
cfg = config.hardware.ksm;
in {
+ imports = [
+ (mkRenamedOptionModule [ "hardware" "enableKSM" ] [ "hardware" "ksm" "enable" ])
+ ];
+
options.hardware.ksm = {
enable = mkEnableOption "Kernel Same-Page Merging";
sleep = mkOption {
diff --git a/nixos/modules/hardware/opengl.nix b/nixos/modules/hardware/opengl.nix
index 57cac56bd8ab18202f0e5228c3046ddbb854e537..89dc5008df5838b7abddc7f8027e548026b1c78e 100644
--- a/nixos/modules/hardware/opengl.nix
+++ b/nixos/modules/hardware/opengl.nix
@@ -31,6 +31,11 @@ let
in
{
+
+ imports = [
+ (mkRenamedOptionModule [ "services" "xserver" "vaapiDrivers" ] [ "hardware" "opengl" "extraPackages" ])
+ ];
+
options = {
hardware.opengl = {
diff --git a/nixos/modules/hardware/steam-hardware.nix b/nixos/modules/hardware/steam-hardware.nix
index 378aeffe71b5ebc9b2671b5d4e5b2386d2961dd8..6218c9ffbb9b14ed525444e4874147684d0719d7 100644
--- a/nixos/modules/hardware/steam-hardware.nix
+++ b/nixos/modules/hardware/steam-hardware.nix
@@ -21,5 +21,12 @@ in
services.udev.packages = [
pkgs.steamPackages.steam
];
+
+ # The uinput module needs to be loaded in order to trigger the udev rules
+ # defined in the steam package for setting permissions on /dev/uinput.
+ #
+ # If the udev rules are not triggered, some controllers won't work with
+ # steam.
+ boot.kernelModules = [ "uinput" ];
};
}
diff --git a/nixos/modules/hardware/video/displaylink.nix b/nixos/modules/hardware/video/displaylink.nix
index 669ac849cbad0f0ae08912acb8b636831489a23a..912f53da836a834c1bfb24b327e77d8b9f26df58 100644
--- a/nixos/modules/hardware/video/displaylink.nix
+++ b/nixos/modules/hardware/video/displaylink.nix
@@ -19,6 +19,21 @@ in
config = mkIf enabled {
boot.extraModulePackages = [ evdi ];
+ boot.kernelModules = [ "evdi" ];
+
+ environment.etc."X11/xorg.conf.d/40-displaylink.conf".text = ''
+ Section "OutputClass"
+ Identifier "DisplayLink"
+ MatchDriver "evdi"
+ Driver "modesetting"
+ Option "AccelMethod" "none"
+ EndSection
+ '';
+
+ # make the device available
+ services.xserver.displayManager.sessionCommands = ''
+ ${lib.getBin pkgs.xorg.xrandr}/bin/xrandr --setprovideroutputsource 1 0
+ '';
# Those are taken from displaylink-installer.sh and from Arch Linux AUR package.
@@ -47,18 +62,13 @@ in
description = "DisplayLink Manager Service";
after = [ "display-manager.service" ];
conflicts = [ "getty@tty7.service" ];
- path = [ pkgs.kmod ];
serviceConfig = {
ExecStart = "${displaylink}/bin/DisplayLinkManager";
Restart = "always";
RestartSec = 5;
+ LogsDirectory = "displaylink";
};
-
- preStart = ''
- mkdir -p /var/log/displaylink
- modprobe evdi
- '';
};
};
diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index 3ab2afc9740704eb1fc06eec48c73235edc1b6da..fcb30187fa2fbba0d7e35d71ef047f40136c3728 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -75,7 +75,7 @@ in
Note that this configuration will only be successful when a display manager
for which the
- option is supported is used; notably, SLiM is not supported.
+ option is supported is used.
'';
};
@@ -111,9 +111,10 @@ in
config = mkIf enabled {
assertions = [
{
- assertion = with config.services.xserver.displayManager; gdm.enable -> !gdm.wayland;
- message = "NVIDIA drivers don't support wayland, set services.xserver.displayManager.gdm.wayland=false";
+ assertion = with config.services.xserver.displayManager; gdm.nvidiaWayland -> cfg.modesetting.enable;
+ message = "You cannot use wayland with GDM without modesetting enabled for NVIDIA drivers, set `hardware.nvidia.modesetting.enable = true`";
}
+
{
assertion = !optimusCfg.enable ||
(optimusCfg.nvidiaBusId != "" && optimusCfg.intelBusId != "");
diff --git a/nixos/modules/i18n/input-method/ibus.nix b/nixos/modules/i18n/input-method/ibus.nix
index 8109ef76c4029226ef467604c9daf4727c483b29..810e1643d3167e85341ca783a7b30c2da03867c3 100644
--- a/nixos/modules/i18n/input-method/ibus.nix
+++ b/nixos/modules/i18n/input-method/ibus.nix
@@ -27,6 +27,10 @@ let
};
in
{
+ imports = [
+ (mkRenamedOptionModule [ "programs" "ibus" "plugins" ] [ "i18n" "inputMethod" "ibus" "engines" ])
+ ];
+
options = {
i18n.inputMethod.ibus = {
engines = mkOption {
@@ -53,9 +57,15 @@ in
config = mkIf (config.i18n.inputMethod.enabled == "ibus") {
i18n.inputMethod.package = ibusPackage;
+ environment.systemPackages = [
+ ibusAutostart
+ ];
+
# Without dconf enabled it is impossible to use IBus
- environment.systemPackages = with pkgs; [
- gnome3.dconf ibusAutostart
+ programs.dconf.enable = true;
+
+ services.dbus.packages = [
+ ibusAutostart
];
environment.variables = {
diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
index 1578e1547bc1fc1b2deff01848b1c59e0eb7a811..e0b558dcb0d85b9a6c8d1e99fd4b088809c61fe0 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
@@ -22,20 +22,7 @@ with lib;
});
'';
- services.xserver = {
- enable = true;
-
- # Don't start the X server by default.
- autorun = mkForce false;
-
- # Automatically login as nixos.
- displayManager.slim = {
- enable = true;
- defaultUser = "nixos";
- autoLogin = true;
- };
-
- };
+ services.xserver.enable = true;
# Provide networkmanager for easy wireless configuration.
networking.networkmanager.enable = true;
diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix
index 0b813bbf37b4c408bd9456cd94d466e15cab531a..23c3426bff08899ff2aaf5c99811ea737ae21926 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix
@@ -10,8 +10,6 @@ with lib;
services.xserver.desktopManager.gnome3.enable = true;
- services.xserver.displayManager.slim.enable = mkForce false;
-
# Auto-login as root.
services.xserver.displayManager.gdm.autoLogin = {
enable = true;
diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix
index 559899b0a3b157b4a25f1a720c1094f419e3f893..e00d3f7535b2f68c67727912f9c4ceec91a65f04 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix
@@ -11,7 +11,15 @@ with lib;
services.xserver = {
desktopManager.plasma5 = {
enable = true;
- enableQt4Support = false;
+ };
+
+ # Automatically login as nixos.
+ displayManager.sddm = {
+ enable = true;
+ autoLogin = {
+ enable = true;
+ user = "nixos";
+ };
};
};
@@ -22,14 +30,8 @@ with lib;
system.activationScripts.installerDesktop = let
- manualDesktopFile = pkgs.writeScript "nixos-manual.desktop" ''
- [Desktop Entry]
- Version=1.0
- Type=Application
- Name=NixOS Manual
- Exec=firefox ${config.system.build.manual.manual}/share/doc/nixos/index.html
- Icon=text-html
- '';
+ # Comes from documentation.nix when xserver and nixos.enable are true.
+ manualDesktopFile = "/run/current-system/sw/share/applications/nixos-manual.desktop";
homeDir = "/home/nixos/";
desktopDir = homeDir + "Desktop/";
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index d5c92cfc1d9e4a8111a5520f97149a24068dc489..11319e5f4f823e0438689fb560fa40fd5c531219 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -24,7 +24,7 @@ let
# Name appended to menuentry defaults to params if no specific name given.
option.name or (if option ? params then "(${option.params})" else "")
}' ${if option ? class then " --class ${option.class}" else ""} {
- linux ${defaults.image} ${defaults.params} ${
+ linux ${defaults.image} \''${isoboot} ${defaults.params} ${
option.params or ""
}
initrd ${defaults.initrd}
@@ -165,8 +165,8 @@ let
else
"# No refind for ${targetArch}"
;
-
- grubPkgs = if config.boot.loader.grub.forcei686 then pkgs.pkgsi686Linux else pkgs;
+
+ grubPkgs = if config.boot.loader.grub.forcei686 then pkgs.pkgsi686Linux else pkgs;
grubMenuCfg = ''
#
@@ -268,6 +268,12 @@ let
set timeout=10
${grubMenuCfg}
+ # If the parameter iso_path is set, append the findiso parameter to the kernel
+ # line. We need this to allow the nixos iso to be booted from grub directly.
+ if [ \''${iso_path} ] ; then
+ set isoboot="findiso=\''${iso_path}"
+ fi
+
#
# Menu entries
#
@@ -284,6 +290,14 @@ let
${buildMenuAdditionalParamsGrub2 config "video=1920x1080@60"}
}
+ # If we boot into a graphical environment where X is autoran
+ # and always crashes, it makes the media unusable. Allow the user
+ # to disable this.
+ submenu "Disable display-manager" --class quirk-disable-displaymanager {
+ ${grubMenuCfg}
+ ${buildMenuAdditionalParamsGrub2 config "systemd.mask=display-manager.service"}
+ }
+
# Some laptop and convertibles have the panel installed in an
# inconvenient way, rotated away from the keyboard.
# Those entries makes it easier to use the installer.
@@ -562,8 +576,6 @@ in
boot.initrd.availableKernelModules = [ "squashfs" "iso9660" "uas" ];
- boot.blacklistedKernelModules = [ "nouveau" ];
-
boot.initrd.kernelModules = [ "loop" ];
# Closures to be copied to the Nix store on the CD, namely the init
@@ -591,9 +603,6 @@ in
{ source = config.system.build.squashfsStore;
target = "/nix-store.squashfs";
}
- { source = config.isoImage.efiSplashImage;
- target = "/EFI/boot/efi-background.png";
- }
{ source = config.isoImage.splashImage;
target = "/isolinux/background.png";
}
@@ -618,6 +627,9 @@ in
{ source = "${efiDir}/EFI";
target = "/EFI";
}
+ { source = (pkgs.writeTextDir "grub/loopback.cfg" "source /EFI/boot/grub.cfg") + "/grub";
+ target = "/boot/grub";
+ }
] ++ optionals (config.boot.loader.grub.memtest86.enable && canx86BiosBoot) [
{ source = "${pkgs.memtest86plus}/memtest.bin";
target = "/boot/memtest.bin";
@@ -626,6 +638,10 @@ in
{ source = config.isoImage.grubTheme;
target = "/EFI/boot/grub-theme";
}
+ ] ++ [
+ { source = config.isoImage.efiSplashImage;
+ target = "/EFI/boot/efi-background.png";
+ }
];
boot.loader.timeout = 10;
diff --git a/nixos/modules/installer/cd-dvd/sd-image-raspberrypi.nix b/nixos/modules/installer/cd-dvd/sd-image-raspberrypi.nix
index 2a131d9ce980f946ad09d7f16353089c9e697c8e..ba4127eaa0e8501d726dd11dc8250301e0c456ea 100644
--- a/nixos/modules/installer/cd-dvd/sd-image-raspberrypi.nix
+++ b/nixos/modules/installer/cd-dvd/sd-image-raspberrypi.nix
@@ -19,7 +19,7 @@ in
boot.loader.generic-extlinux-compatible.enable = true;
boot.consoleLogLevel = lib.mkDefault 7;
- boot.kernelPackages = pkgs.linuxPackages_rpi;
+ boot.kernelPackages = pkgs.linuxPackages_rpi1;
sdImage = {
populateFirmwareCommands = let
diff --git a/nixos/modules/installer/cd-dvd/sd-image-raspberrypi4.nix b/nixos/modules/installer/cd-dvd/sd-image-raspberrypi4.nix
new file mode 100644
index 0000000000000000000000000000000000000000..c545a1e7e2424194774a0a1b47bbe65d2fbfaa5f
--- /dev/null
+++ b/nixos/modules/installer/cd-dvd/sd-image-raspberrypi4.nix
@@ -0,0 +1,31 @@
+# To build, use:
+# nix-build nixos -I nixos-config=nixos/modules/installer/cd-dvd/sd-image-raspberrypi4.nix -A config.system.build.sdImage
+{ config, lib, pkgs, ... }:
+
+{
+ imports = [
+ ../../profiles/base.nix
+ ../../profiles/installation-device.nix
+ ./sd-image.nix
+ ];
+
+ boot.loader.grub.enable = false;
+ boot.loader.raspberryPi.enable = true;
+ boot.loader.raspberryPi.version = 4;
+ boot.kernelPackages = pkgs.linuxPackages_rpi4;
+
+ boot.consoleLogLevel = lib.mkDefault 7;
+
+ sdImage = {
+ firmwareSize = 128;
+ # This is a hack to avoid replicating config.txt from boot.loader.raspberryPi
+ populateFirmwareCommands =
+ "${config.system.build.installBootLoader} ${config.system.build.toplevel} -d ./firmware";
+ # As the boot process is done entirely in the firmware partition.
+ populateRootCommands = "";
+ };
+
+ # the installation media is also the installation target,
+ # so we don't want to provide the installation configuration.nix.
+ installer.cloneConfig = false;
+}
diff --git a/nixos/modules/installer/cd-dvd/sd-image.nix b/nixos/modules/installer/cd-dvd/sd-image.nix
index 0a01504415549bbad3d134ae294676954e274baa..901c60befb6cedbd91d980428f78d2783941ef26 100644
--- a/nixos/modules/installer/cd-dvd/sd-image.nix
+++ b/nixos/modules/installer/cd-dvd/sd-image.nix
@@ -18,6 +18,7 @@ with lib;
let
rootfsImage = pkgs.callPackage ../../../lib/make-ext4-fs.nix ({
inherit (config.sdImage) storePaths;
+ compressImage = true;
populateImageCommands = config.sdImage.populateRootCommands;
volumeLabel = "NIXOS_SD";
} // optionalAttrs (config.sdImage.rootPartitionUUID != null) {
@@ -98,6 +99,16 @@ in
populate the ./files/boot (/boot) directory.
'';
};
+
+ compressImage = mkOption {
+ type = types.bool;
+ default = true;
+ description = ''
+ Whether the SD image should be compressed using
+ bzip2.
+ '';
+ };
+
};
config = {
@@ -118,23 +129,33 @@ in
sdImage.storePaths = [ config.system.build.toplevel ];
- system.build.sdImage = pkgs.callPackage ({ stdenv, dosfstools, e2fsprogs, mtools, libfaketime, utillinux }: stdenv.mkDerivation {
+ system.build.sdImage = pkgs.callPackage ({ stdenv, dosfstools, e2fsprogs,
+ mtools, libfaketime, utillinux, bzip2, zstd }: stdenv.mkDerivation {
name = config.sdImage.imageName;
- nativeBuildInputs = [ dosfstools e2fsprogs mtools libfaketime utillinux ];
+ nativeBuildInputs = [ dosfstools e2fsprogs mtools libfaketime utillinux bzip2 zstd ];
+
+ inherit (config.sdImage) compressImage;
buildCommand = ''
mkdir -p $out/nix-support $out/sd-image
export img=$out/sd-image/${config.sdImage.imageName}
echo "${pkgs.stdenv.buildPlatform.system}" > $out/nix-support/system
- echo "file sd-image $img" >> $out/nix-support/hydra-build-products
+ if test -n "$compressImage"; then
+ echo "file sd-image $img.bz2" >> $out/nix-support/hydra-build-products
+ else
+ echo "file sd-image $img" >> $out/nix-support/hydra-build-products
+ fi
+
+ echo "Decompressing rootfs image"
+ zstd -d --no-progress "${rootfsImage}" -o ./root-fs.img
# Gap in front of the first partition, in MiB
gap=8
# Create the image file sized to fit /boot/firmware and /, plus slack for the gap.
- rootSizeBlocks=$(du -B 512 --apparent-size ${rootfsImage} | awk '{ print $1 }')
+ rootSizeBlocks=$(du -B 512 --apparent-size ./root-fs.img | awk '{ print $1 }')
firmwareSizeBlocks=$((${toString config.sdImage.firmwareSize} * 1024 * 1024 / 512))
imageSize=$((rootSizeBlocks * 512 + firmwareSizeBlocks * 512 + gap * 1024 * 1024))
truncate -s $imageSize $img
@@ -152,7 +173,7 @@ in
# Copy the rootfs into the SD image
eval $(partx $img -o START,SECTORS --nr 2 --pairs)
- dd conv=notrunc if=${rootfsImage} of=$img seek=$START count=$SECTORS
+ dd conv=notrunc if=./root-fs.img of=$img seek=$START count=$SECTORS
# Create a FAT32 /boot/firmware partition of suitable size into firmware_part.img
eval $(partx $img -o START,SECTORS --nr 1 --pairs)
@@ -168,14 +189,19 @@ in
# Verify the FAT partition before copying it.
fsck.vfat -vn firmware_part.img
dd conv=notrunc if=firmware_part.img of=$img seek=$START count=$SECTORS
+ if test -n "$compressImage"; then
+ bzip2 $img
+ fi
'';
}) {};
boot.postBootCommands = ''
# On the first boot do some maintenance tasks
if [ -f /nix-path-registration ]; then
+ set -euo pipefail
+ set -x
# Figure out device names for the boot device and root filesystem.
- rootPart=$(readlink -f /dev/disk/by-label/NIXOS_SD)
+ rootPart=$(${pkgs.utillinux}/bin/findmnt -n -o SOURCE /)
bootDevice=$(lsblk -npo PKNAME $rootPart)
# Resize the root partition and the filesystem to fit the disk
diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix
index 2673887d2b9657fbd14fab0adaf93643acfc55f8..d7149b35d4c0cde9c7ad5279a5b1286029c1ef63 100644
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@@ -1,6 +1,6 @@
{
- x86_64-linux = "/nix/store/3ds3cgji9vjxdbgp10av6smyym1126d1-nix-2.3";
- i686-linux = "/nix/store/ln1ndqvfpc9cdl03vqxi6kvlxm9wfv9g-nix-2.3";
- aarch64-linux = "/nix/store/n8a1rwzrp20qcr2c4hvyn6c5q9zx8csw-nix-2.3";
- x86_64-darwin = "/nix/store/jq6npmpld02sz4rgniz0qrsdfnm6j17a-nix-2.3";
+ x86_64-linux = "/nix/store/6chjfy4j6hjwj5f8zcbbdg02i21x1qsi-nix-2.3.1";
+ i686-linux = "/nix/store/xa8z7fwszjjm4kiwrxfc8xv9c1pzzm7a-nix-2.3.1";
+ aarch64-linux = "/nix/store/8cac1ivcnchlpzmdjby2f71l1fwpnymr-nix-2.3.1";
+ x86_64-darwin = "/nix/store/6639l9815ggdnb4aka22qcjy7p8w4hb9-nix-2.3.1";
}
diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index cfdbdaabf5c52051f383908c591f6abf5d095d51..629c56814a169121300b74758383f7dd2b01a52f 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -335,6 +335,9 @@ if (@swaps) {
next unless -e $swapFilename;
my $dev = findStableDevPath $swapFilename;
if ($swapType =~ "partition") {
+ # zram devices are more likely created by configuration.nix, so
+ # ignore them here
+ next if ($swapFilename =~ /^\/dev\/zram/);
push @swapDevices, "{ device = \"$dev\"; }";
} elsif ($swapType =~ "file") {
# swap *files* are more likely specified in configuration.nix, so
@@ -498,7 +501,7 @@ if (-f $fb_modes_file && -r $fb_modes_file) {
my $console_width = $1, my $console_height = $2;
if ($console_width > 1920) {
push @attrs, "# High-DPI console";
- push @attrs, 'i18n.consoleFont = lib.mkDefault "${pkgs.terminus_font}/share/consolefonts/ter-u28n.psf.gz";';
+ push @attrs, 'console.font = lib.mkDefault "${pkgs.terminus_font}/share/consolefonts/ter-u28n.psf.gz";';
}
}
@@ -563,6 +566,24 @@ $fsAndSwap
${\join "", (map { " $_\n" } (uniq @attrs))}}
EOF
+sub generateNetworkingDhcpConfig {
+ my $config = <' system -I "nixos-config=$NIXOS_CONFIG"
+ -f '' system -I "nixos-config=$NIXOS_CONFIG" ${verbosity[@]} ${buildLogs}
system=$(readlink -f $outLink)
fi
@@ -103,7 +111,7 @@ fi
# a progress bar.
nix-env --store "$mountPoint" "${extraBuildFlags[@]}" \
--extra-substituters "$sub" \
- -p $mountPoint/nix/var/nix/profiles/system --set "$system"
+ -p $mountPoint/nix/var/nix/profiles/system --set "$system" ${verbosity[@]}
# Copy the NixOS/Nixpkgs sources to the target as the initial contents
# of the NixOS channel.
@@ -115,7 +123,8 @@ if [[ -z $noChannelCopy ]]; then
echo "copying channel..."
mkdir -p $mountPoint/nix/var/nix/profiles/per-user/root
nix-env --store "$mountPoint" "${extraBuildFlags[@]}" --extra-substituters "$sub" \
- -p $mountPoint/nix/var/nix/profiles/per-user/root/channels --set "$channelPath" --quiet
+ -p $mountPoint/nix/var/nix/profiles/per-user/root/channels --set "$channelPath" --quiet \
+ ${verbosity[@]}
install -m 0700 -d $mountPoint/root/.nix-defexpr
ln -sfn /nix/var/nix/profiles/per-user/root/channels $mountPoint/root/.nix-defexpr/channels
fi
diff --git a/nixos/modules/installer/tools/nixos-option.sh b/nixos/modules/installer/tools/nixos-option.sh
deleted file mode 100644
index 4560e9c7403aa6607b0e02b9ca8bd5ab480d621f..0000000000000000000000000000000000000000
--- a/nixos/modules/installer/tools/nixos-option.sh
+++ /dev/null
@@ -1,327 +0,0 @@
-#! @shell@ -e
-
-# FIXME: rewrite this in a more suitable language.
-
-usage () {
- exec man nixos-option
- exit 1
-}
-
-#####################
-# Process Arguments #
-#####################
-
-xml=false
-verbose=false
-nixPath=""
-
-option=""
-exit_code=0
-
-argfun=""
-for arg; do
- if test -z "$argfun"; then
- case $arg in
- -*)
- sarg="$arg"
- longarg=""
- while test "$sarg" != "-"; do
- case $sarg in
- --*) longarg=$arg; sarg="--";;
- -I) argfun="include_nixpath";;
- -*) usage;;
- esac
- # remove the first letter option
- sarg="-${sarg#??}"
- done
- ;;
- *) longarg=$arg;;
- esac
- for larg in $longarg; do
- case $larg in
- --xml) xml=true;;
- --verbose) verbose=true;;
- --help) usage;;
- -*) usage;;
- *) if test -z "$option"; then
- option="$larg"
- else
- usage
- fi;;
- esac
- done
- else
- case $argfun in
- set_*)
- var=$(echo $argfun | sed 's,^set_,,')
- eval $var=$arg
- ;;
- include_nixpath)
- nixPath="-I $arg $nixPath"
- ;;
- esac
- argfun=""
- fi
-done
-
-if $verbose; then
- set -x
-else
- set +x
-fi
-
-#############################
-# Process the configuration #
-#############################
-
-evalNix(){
- # disable `-e` flag, it's possible that the evaluation of `nix-instantiate` fails (e.g. due to broken pkgs)
- set +e
- result=$(nix-instantiate ${nixPath:+$nixPath} - --eval-only "$@" 2>&1)
- exit_code=$?
- set -e
-
- if test $exit_code -eq 0; then
- sed '/^warning: Nix search path/d' <&2 < {};
- nixpkgs = import {};
-in with nixpkgs.lib;
-"
-
-# This function is used for converting the option definition path given by
-# the user into accessors for reaching the definition and the declaration
-# corresponding to this option.
-generateAccessors(){
- if result=$(evalNix --strict --show-trace <"
- else if strict then
- if isAttrs x then mapAttrs (n: cleanOutput) x
- else if isList x then map cleanOutput x
- else x
- else x;
-in
- cleanOutput value
-EOF
-}
-
-evalOpt(){
- evalAttr "option" "" "$@"
-}
-
-evalCfg(){
- local strict="$1"
- evalAttr "config" "$strict"
-}
-
-findSources(){
- local suffix=$1
- evalNix --strict <,0,g; :inner; s/{[^\{\}]*};/0;/g; t inner;' | \
- evalNix --strict
-}
-
-# map a simple list which contains strings or paths.
-nixMap() {
- local fun="$1"
- local list="$2"
- local elem
- for elem in $list; do
- test $elem = '[' -o $elem = ']' && continue;
- $fun $elem
- done
-}
-
-# This duplicates the work made below, but it is useful for processing
-# the output of nixos-option with other tools such as nixos-gui.
-if $xml; then
- evalNix --xml --no-location < /dev/null)" = '"option"'; then
- echo "Value:"
- evalCfg 1
-
- echo
-
- echo "Default:"
- if default=$(evalOpt "default" - 2> /dev/null); then
- echo "$default"
- else
- echo ""
- fi
- echo
- if example=$(evalOpt "example" - 2> /dev/null); then
- echo "Example:"
- echo "$example"
- echo
- fi
- echo "Description:"
- echo
- echo $(evalOpt "description")
-
- echo $desc;
-
- printPath () { echo " $1"; }
-
- echo "Declared by:"
- nixMap printPath "$(findSources "declarations")"
- echo
- echo "Defined by:"
- nixMap printPath "$(findSources "files")"
- echo
-
-else
- # echo 1>&2 "Warning: This value is not an option."
-
- result=$(evalCfg "")
- if [ ! -z "$result" ]; then
- names=$(attrNames "$result" 2> /dev/null)
- echo 1>&2 "This attribute set contains:"
- escapeQuotes () { eval echo "$1"; }
- nixMap escapeQuotes "$names"
- else
- echo 1>&2 "An error occurred while looking for attribute names. Are you sure that '$option' exists?"
- fi
-fi
-
-exit $exit_code
diff --git a/nixos/modules/installer/tools/nixos-option/CMakeLists.txt b/nixos/modules/installer/tools/nixos-option/CMakeLists.txt
new file mode 100644
index 0000000000000000000000000000000000000000..e5834598c4fde8ab7f4561979c3f50755365a21b
--- /dev/null
+++ b/nixos/modules/installer/tools/nixos-option/CMakeLists.txt
@@ -0,0 +1,8 @@
+cmake_minimum_required (VERSION 2.6)
+project (nixos-option)
+
+add_executable(nixos-option nixos-option.cc libnix-copy-paste.cc)
+target_link_libraries(nixos-option PRIVATE -lnixmain -lnixexpr -lnixstore -lnixutil)
+target_compile_features(nixos-option PRIVATE cxx_std_17)
+
+install (TARGETS nixos-option DESTINATION bin)
diff --git a/nixos/modules/installer/tools/nixos-option/default.nix b/nixos/modules/installer/tools/nixos-option/default.nix
new file mode 100644
index 0000000000000000000000000000000000000000..753fd92c7bbf66ba92f0cb78fd880463d28961d7
--- /dev/null
+++ b/nixos/modules/installer/tools/nixos-option/default.nix
@@ -0,0 +1,11 @@
+{lib, stdenv, boost, cmake, pkgconfig, nix, ... }:
+stdenv.mkDerivation rec {
+ name = "nixos-option";
+ src = ./.;
+ nativeBuildInputs = [ cmake pkgconfig ];
+ buildInputs = [ boost nix ];
+ meta = {
+ license = stdenv.lib.licenses.lgpl2Plus;
+ maintainers = with lib.maintainers; [ chkno ];
+ };
+}
diff --git a/nixos/modules/installer/tools/nixos-option/libnix-copy-paste.cc b/nixos/modules/installer/tools/nixos-option/libnix-copy-paste.cc
new file mode 100644
index 0000000000000000000000000000000000000000..875c07da6399665dda41b112a3572c2f53c241f2
--- /dev/null
+++ b/nixos/modules/installer/tools/nixos-option/libnix-copy-paste.cc
@@ -0,0 +1,83 @@
+// These are useful methods inside the nix library that ought to be exported.
+// Since they are not, copy/paste them here.
+// TODO: Delete these and use the ones in the library as they become available.
+
+#include // for nix/globals.hh's reference to SYSTEM
+
+#include "libnix-copy-paste.hh"
+#include // for basic_altstringbuf...
+#include // for basic_altstringbuf...
+#include // for basic_format
+#include // for format
+#include // for basic_format::basi...
+#include // for get_pointer
+#include // for operator<<, basic_...
+#include // for Strings, Error
+#include // for string, basic_string
+
+using boost::format;
+using nix::Error;
+using nix::Strings;
+using std::string;
+
+// From nix/src/libexpr/attr-path.cc
+Strings parseAttrPath(const string & s)
+{
+ Strings res;
+ string cur;
+ string::const_iterator i = s.begin();
+ while (i != s.end()) {
+ if (*i == '.') {
+ res.push_back(cur);
+ cur.clear();
+ } else if (*i == '"') {
+ ++i;
+ while (1) {
+ if (i == s.end())
+ throw Error(format("missing closing quote in selection path '%1%'") % s);
+ if (*i == '"')
+ break;
+ cur.push_back(*i++);
+ }
+ } else
+ cur.push_back(*i);
+ ++i;
+ }
+ if (!cur.empty())
+ res.push_back(cur);
+ return res;
+}
+
+// From nix/src/nix/repl.cc
+bool isVarName(const string & s)
+{
+ if (s.size() == 0)
+ return false;
+ char c = s[0];
+ if ((c >= '0' && c <= '9') || c == '-' || c == '\'')
+ return false;
+ for (auto & i : s)
+ if (!((i >= 'a' && i <= 'z') || (i >= 'A' && i <= 'Z') || (i >= '0' && i <= '9') || i == '_' || i == '-' ||
+ i == '\''))
+ return false;
+ return true;
+}
+
+// From nix/src/nix/repl.cc
+std::ostream & printStringValue(std::ostream & str, const char * string)
+{
+ str << "\"";
+ for (const char * i = string; *i; i++)
+ if (*i == '\"' || *i == '\\')
+ str << "\\" << *i;
+ else if (*i == '\n')
+ str << "\\n";
+ else if (*i == '\r')
+ str << "\\r";
+ else if (*i == '\t')
+ str << "\\t";
+ else
+ str << *i;
+ str << "\"";
+ return str;
+}
diff --git a/nixos/modules/installer/tools/nixos-option/libnix-copy-paste.hh b/nixos/modules/installer/tools/nixos-option/libnix-copy-paste.hh
new file mode 100644
index 0000000000000000000000000000000000000000..2274e9a0f85320b4c5e900998b9a8393b55fb6cd
--- /dev/null
+++ b/nixos/modules/installer/tools/nixos-option/libnix-copy-paste.hh
@@ -0,0 +1,9 @@
+#pragma once
+
+#include
+#include
+#include
+
+nix::Strings parseAttrPath(const std::string & s);
+bool isVarName(const std::string & s);
+std::ostream & printStringValue(std::ostream & str, const char * string);
diff --git a/nixos/modules/installer/tools/nixos-option/nixos-option.cc b/nixos/modules/installer/tools/nixos-option/nixos-option.cc
new file mode 100644
index 0000000000000000000000000000000000000000..9b92dc829cd16a5be4ffa5c30e670b4c2cc100ba
--- /dev/null
+++ b/nixos/modules/installer/tools/nixos-option/nixos-option.cc
@@ -0,0 +1,618 @@
+#include // for nix/globals.hh's reference to SYSTEM
+
+#include // for exception_ptr, current_exception
+#include // for function
+#include // for operator<<, basic_ostream, ostrin...
+#include // for next
+#include // for _List_iterator
+#include // for allocator, unique_ptr, make_unique
+#include // for operator new
+#include // for argvToStrings, UsageError
+#include // for findAlongAttrPath
+#include // for Attr, Bindings, Bindings::iterator
+#include // for MixEvalArgs
+#include // for EvalState::forceValue
+#include // for EvalState, initGC, operator<<
+#include // for initPlugins, Settings, settings
+#include // for Pos
+#include // for getArg, LegacyArgs, printVersion
+#include // for openStore
+#include // for Symbol, SymbolTable
+#include // for Error, Path, Strings, PathSet
+#include // for absPath, baseNameOf
+#include // for Value, Value::(anonymous), Value:...
+#include // for string, operator+, operator==
+#include // for move
+#include // for get, holds_alternative, variant
+#include // for vector<>::iterator, vector
+
+#include "libnix-copy-paste.hh"
+
+using nix::absPath;
+using nix::Bindings;
+using nix::Error;
+using nix::EvalError;
+using nix::EvalState;
+using nix::Path;
+using nix::PathSet;
+using nix::Strings;
+using nix::Symbol;
+using nix::tAttrs;
+using nix::ThrownError;
+using nix::tLambda;
+using nix::tString;
+using nix::UsageError;
+using nix::Value;
+
+// An ostream wrapper to handle nested indentation
+class Out
+{
+ public:
+ class Separator
+ {};
+ const static Separator sep;
+ enum LinePolicy
+ {
+ ONE_LINE,
+ MULTI_LINE
+ };
+ explicit Out(std::ostream & ostream) : ostream(ostream), policy(ONE_LINE), writeSinceSep(true) {}
+ Out(Out & o, const std::string & start, const std::string & end, LinePolicy policy);
+ Out(Out & o, const std::string & start, const std::string & end, int count)
+ : Out(o, start, end, count < 2 ? ONE_LINE : MULTI_LINE)
+ {}
+ Out(const Out &) = delete;
+ Out(Out &&) = default;
+ Out & operator=(const Out &) = delete;
+ Out & operator=(Out &&) = delete;
+ ~Out() { ostream << end; }
+
+ private:
+ std::ostream & ostream;
+ std::string indentation;
+ std::string end;
+ LinePolicy policy;
+ bool writeSinceSep;
+ template friend Out & operator<<(Out & o, T thing);
+};
+
+template Out & operator<<(Out & o, T thing)
+{
+ if (!o.writeSinceSep && o.policy == Out::MULTI_LINE) {
+ o.ostream << o.indentation;
+ }
+ o.writeSinceSep = true;
+ o.ostream << thing;
+ return o;
+}
+
+template <> Out & operator<<(Out & o, Out::Separator /* thing */)
+{
+ o.ostream << (o.policy == Out::ONE_LINE ? " " : "\n");
+ o.writeSinceSep = false;
+ return o;
+}
+
+Out::Out(Out & o, const std::string & start, const std::string & end, LinePolicy policy)
+ : ostream(o.ostream), indentation(policy == ONE_LINE ? o.indentation : o.indentation + " "),
+ end(policy == ONE_LINE ? end : o.indentation + end), policy(policy), writeSinceSep(true)
+{
+ o << start;
+ *this << Out::sep;
+}
+
+// Stuff needed for evaluation
+struct Context
+{
+ Context(EvalState & state, Bindings & autoArgs, Value optionsRoot, Value configRoot)
+ : state(state), autoArgs(autoArgs), optionsRoot(optionsRoot), configRoot(configRoot),
+ underscoreType(state.symbols.create("_type"))
+ {}
+ EvalState & state;
+ Bindings & autoArgs;
+ Value optionsRoot;
+ Value configRoot;
+ Symbol underscoreType;
+};
+
+Value evaluateValue(Context & ctx, Value & v)
+{
+ ctx.state.forceValue(v);
+ if (ctx.autoArgs.empty()) {
+ return v;
+ }
+ Value called{};
+ ctx.state.autoCallFunction(ctx.autoArgs, v, called);
+ return called;
+}
+
+bool isOption(Context & ctx, const Value & v)
+{
+ if (v.type != tAttrs) {
+ return false;
+ }
+ const auto & atualType = v.attrs->find(ctx.underscoreType);
+ if (atualType == v.attrs->end()) {
+ return false;
+ }
+ try {
+ Value evaluatedType = evaluateValue(ctx, *atualType->value);
+ if (evaluatedType.type != tString) {
+ return false;
+ }
+ return static_cast(evaluatedType.string.s) == "option";
+ } catch (Error &) {
+ return false;
+ }
+}
+
+// Add quotes to a component of a path.
+// These are needed for paths like:
+// fileSystems."/".fsType
+// systemd.units."dbus.service".text
+std::string quoteAttribute(const std::string & attribute)
+{
+ if (isVarName(attribute)) {
+ return attribute;
+ }
+ std::ostringstream buf;
+ printStringValue(buf, attribute.c_str());
+ return buf.str();
+}
+
+const std::string appendPath(const std::string & prefix, const std::string & suffix)
+{
+ if (prefix.empty()) {
+ return quoteAttribute(suffix);
+ }
+ return prefix + "." + quoteAttribute(suffix);
+}
+
+bool forbiddenRecursionName(std::string name) { return (!name.empty() && name[0] == '_') || name == "haskellPackages"; }
+
+void recurse(const std::function)> & f,
+ Context & ctx, Value v, const std::string & path)
+{
+ std::variant evaluated;
+ try {
+ evaluated = evaluateValue(ctx, v);
+ } catch (Error &) {
+ evaluated = std::current_exception();
+ }
+ if (!f(path, evaluated)) {
+ return;
+ }
+ if (std::holds_alternative(evaluated)) {
+ return;
+ }
+ const Value & evaluated_value = std::get(evaluated);
+ if (evaluated_value.type != tAttrs) {
+ return;
+ }
+ for (const auto & child : evaluated_value.attrs->lexicographicOrder()) {
+ if (forbiddenRecursionName(child->name)) {
+ continue;
+ }
+ recurse(f, ctx, *child->value, appendPath(path, child->name));
+ }
+}
+
+// Calls f on all the option names
+void mapOptions(const std::function & f, Context & ctx, Value root)
+{
+ recurse(
+ [f, &ctx](const std::string & path, std::variant v) {
+ bool isOpt = std::holds_alternative(v) || isOption(ctx, std::get(v));
+ if (isOpt) {
+ f(path);
+ }
+ return !isOpt;
+ },
+ ctx, root, "");
+}
+
+// Calls f on all the config values inside one option.
+// Simple options have one config value inside, like sound.enable = true.
+// Compound options have multiple config values. For example, the option
+// "users.users" has about 1000 config values inside it:
+// users.users.avahi.createHome = false;
+// users.users.avahi.cryptHomeLuks = null;
+// users.users.avahi.description = "`avahi-daemon' privilege separation user";
+// ...
+// users.users.avahi.openssh.authorizedKeys.keyFiles = [ ];
+// users.users.avahi.openssh.authorizedKeys.keys = [ ];
+// ...
+// users.users.avahi.uid = 10;
+// users.users.avahi.useDefaultShell = false;
+// users.users.cups.createHome = false;
+// ...
+// users.users.cups.useDefaultShell = false;
+// users.users.gdm = ... ... ...
+// users.users.messagebus = ... .. ...
+// users.users.nixbld1 = ... .. ...
+// ...
+// users.users.systemd-timesync = ... .. ...
+void mapConfigValuesInOption(
+ const std::function v)> & f,
+ const std::string & path, Context & ctx)
+{
+ Value * option;
+ try {
+ option = findAlongAttrPath(ctx.state, path, ctx.autoArgs, ctx.configRoot);
+ } catch (Error &) {
+ f(path, std::current_exception());
+ return;
+ }
+ recurse(
+ [f, ctx](const std::string & path, std::variant v) {
+ bool leaf = std::holds_alternative(v) || std::get(v).type != tAttrs ||
+ ctx.state.isDerivation(std::get(v));
+ if (!leaf) {
+ return true; // Keep digging
+ }
+ f(path, v);
+ return false;
+ },
+ ctx, *option, path);
+}
+
+std::string describeError(const Error & e) { return "«error: " + e.msg() + "»"; }
+
+void describeDerivation(Context & ctx, Out & out, Value v)
+{
+ // Copy-pasted from nix/src/nix/repl.cc :(
+ Bindings::iterator i = v.attrs->find(ctx.state.sDrvPath);
+ PathSet pathset;
+ try {
+ Path drvPath = i != v.attrs->end() ? ctx.state.coerceToPath(*i->pos, *i->value, pathset) : "???";
+ out << "«derivation " << drvPath << "»";
+ } catch (Error & e) {
+ out << describeError(e);
+ }
+}
+
+Value parseAndEval(EvalState & state, const std::string & expression, const std::string & path)
+{
+ Value v{};
+ state.eval(state.parseExprFromString(expression, absPath(path)), v);
+ return v;
+}
+
+void printValue(Context & ctx, Out & out, std::variant maybeValue, const std::string & path);
+
+void printList(Context & ctx, Out & out, Value & v)
+{
+ Out listOut(out, "[", "]", v.listSize());
+ for (unsigned int n = 0; n < v.listSize(); ++n) {
+ printValue(ctx, listOut, *v.listElems()[n], "");
+ listOut << Out::sep;
+ }
+}
+
+void printAttrs(Context & ctx, Out & out, Value & v, const std::string & path)
+{
+ Out attrsOut(out, "{", "}", v.attrs->size());
+ for (const auto & a : v.attrs->lexicographicOrder()) {
+ std::string name = a->name;
+ attrsOut << name << " = ";
+ printValue(ctx, attrsOut, *a->value, appendPath(path, name));
+ attrsOut << ";" << Out::sep;
+ }
+}
+
+void multiLineStringEscape(Out & out, const std::string & s)
+{
+ int i;
+ for (i = 1; i < s.size(); i++) {
+ if (s[i - 1] == '$' && s[i] == '{') {
+ out << "''${";
+ i++;
+ } else if (s[i - 1] == '\'' && s[i] == '\'') {
+ out << "'''";
+ i++;
+ } else {
+ out << s[i - 1];
+ }
+ }
+ if (i == s.size()) {
+ out << s[i - 1];
+ }
+}
+
+void printMultiLineString(Out & out, const Value & v)
+{
+ std::string s = v.string.s;
+ Out strOut(out, "''", "''", Out::MULTI_LINE);
+ std::string::size_type begin = 0;
+ while (begin < s.size()) {
+ std::string::size_type end = s.find('\n', begin);
+ if (end == std::string::npos) {
+ multiLineStringEscape(strOut, s.substr(begin, s.size() - begin));
+ break;
+ }
+ multiLineStringEscape(strOut, s.substr(begin, end - begin));
+ strOut << Out::sep;
+ begin = end + 1;
+ }
+}
+
+void printValue(Context & ctx, Out & out, std::variant maybeValue, const std::string & path)
+{
+ try {
+ if (auto ex = std::get_if(&maybeValue)) {
+ std::rethrow_exception(*ex);
+ }
+ Value v = evaluateValue(ctx, std::get(maybeValue));
+ if (ctx.state.isDerivation(v)) {
+ describeDerivation(ctx, out, v);
+ } else if (v.isList()) {
+ printList(ctx, out, v);
+ } else if (v.type == tAttrs) {
+ printAttrs(ctx, out, v, path);
+ } else if (v.type == tString && std::string(v.string.s).find('\n') != std::string::npos) {
+ printMultiLineString(out, v);
+ } else {
+ ctx.state.forceValueDeep(v);
+ out << v;
+ }
+ } catch (ThrownError & e) {
+ if (e.msg() == "The option `" + path + "' is used but not defined.") {
+ // 93% of errors are this, and just letting this message through would be
+ // misleading. These values may or may not actually be "used" in the
+ // config. The thing throwing the error message assumes that if anything
+ // ever looks at this value, it is a "use" of this value. But here in
+ // nixos-option, we are looking at this value only to print it.
+ // In order to avoid implying that this undefined value is actually
+ // referenced, eat the underlying error message and emit "«not defined»".
+ out << "«not defined»";
+ } else {
+ out << describeError(e);
+ }
+ } catch (Error & e) {
+ out << describeError(e);
+ }
+}
+
+void printConfigValue(Context & ctx, Out & out, const std::string & path, std::variant v)
+{
+ out << path << " = ";
+ printValue(ctx, out, std::move(v), path);
+ out << ";\n";
+}
+
+void printAll(Context & ctx, Out & out)
+{
+ mapOptions(
+ [&ctx, &out](const std::string & optionPath) {
+ mapConfigValuesInOption(
+ [&ctx, &out](const std::string & configPath, std::variant v) {
+ printConfigValue(ctx, out, configPath, v);
+ },
+ optionPath, ctx);
+ },
+ ctx, ctx.optionsRoot);
+}
+
+void printAttr(Context & ctx, Out & out, const std::string & path, Value & root)
+{
+ try {
+ printValue(ctx, out, *findAlongAttrPath(ctx.state, path, ctx.autoArgs, root), path);
+ } catch (Error & e) {
+ out << describeError(e);
+ }
+}
+
+bool hasExample(Context & ctx, Value & option)
+{
+ try {
+ findAlongAttrPath(ctx.state, "example", ctx.autoArgs, option);
+ return true;
+ } catch (Error &) {
+ return false;
+ }
+}
+
+void printOption(Context & ctx, Out & out, const std::string & path, Value & option)
+{
+ out << "Value:\n";
+ printAttr(ctx, out, path, ctx.configRoot);
+
+ out << "\n\nDefault:\n";
+ printAttr(ctx, out, "default", option);
+
+ out << "\n\nType:\n";
+ printAttr(ctx, out, "type.description", option);
+
+ if (hasExample(ctx, option)) {
+ out << "\n\nExample:\n";
+ printAttr(ctx, out, "example", option);
+ }
+
+ out << "\n\nDescription:\n";
+ printAttr(ctx, out, "description", option);
+
+ out << "\n\nDeclared by:\n";
+ printAttr(ctx, out, "declarations", option);
+
+ out << "\n\nDefined by:\n";
+ printAttr(ctx, out, "files", option);
+ out << "\n";
+}
+
+void printListing(Out & out, Value & v)
+{
+ out << "This attribute set contains:\n";
+ for (const auto & a : v.attrs->lexicographicOrder()) {
+ std::string name = a->name;
+ if (!name.empty() && name[0] != '_') {
+ out << name << "\n";
+ }
+ }
+}
+
+bool optionTypeIs(Context & ctx, Value & v, const std::string & soughtType)
+{
+ try {
+ const auto & typeLookup = v.attrs->find(ctx.state.sType);
+ if (typeLookup == v.attrs->end()) {
+ return false;
+ }
+ Value type = evaluateValue(ctx, *typeLookup->value);
+ if (type.type != tAttrs) {
+ return false;
+ }
+ const auto & nameLookup = type.attrs->find(ctx.state.sName);
+ if (nameLookup == type.attrs->end()) {
+ return false;
+ }
+ Value name = evaluateValue(ctx, *nameLookup->value);
+ if (name.type != tString) {
+ return false;
+ }
+ return name.string.s == soughtType;
+ } catch (Error &) {
+ return false;
+ }
+}
+
+bool isAggregateOptionType(Context & ctx, Value & v)
+{
+ return optionTypeIs(ctx, v, "attrsOf") || optionTypeIs(ctx, v, "listOf") || optionTypeIs(ctx, v, "loaOf");
+}
+
+MakeError(OptionPathError, EvalError);
+
+Value getSubOptions(Context & ctx, Value & option)
+{
+ Value getSubOptions = evaluateValue(ctx, *findAlongAttrPath(ctx.state, "type.getSubOptions", ctx.autoArgs, option));
+ if (getSubOptions.type != tLambda) {
+ throw OptionPathError("Option's type.getSubOptions isn't a function");
+ }
+ Value emptyString{};
+ nix::mkString(emptyString, "");
+ Value v;
+ ctx.state.callFunction(getSubOptions, emptyString, v, nix::Pos{});
+ return v;
+}
+
+// Carefully walk an option path, looking for sub-options when a path walks past
+// an option value.
+Value findAlongOptionPath(Context & ctx, const std::string & path)
+{
+ Strings tokens = parseAttrPath(path);
+ Value v = ctx.optionsRoot;
+ for (auto i = tokens.begin(); i != tokens.end(); i++) {
+ const auto & attr = *i;
+ try {
+ bool lastAttribute = std::next(i) == tokens.end();
+ v = evaluateValue(ctx, v);
+ if (attr.empty()) {
+ throw OptionPathError("empty attribute name");
+ }
+ if (isOption(ctx, v) && optionTypeIs(ctx, v, "submodule")) {
+ v = getSubOptions(ctx, v);
+ }
+ if (isOption(ctx, v) && isAggregateOptionType(ctx, v) && !lastAttribute) {
+ v = getSubOptions(ctx, v);
+ // Note that we've consumed attr, but didn't actually use it. This is the path component that's looked
+ // up in the list or attribute set that doesn't name an option -- the "root" in "users.users.root.name".
+ } else if (v.type != tAttrs) {
+ throw OptionPathError("Value is %s while a set was expected", showType(v));
+ } else {
+ const auto & next = v.attrs->find(ctx.state.symbols.create(attr));
+ if (next == v.attrs->end()) {
+ throw OptionPathError("Attribute not found", attr, path);
+ }
+ v = *next->value;
+ }
+ } catch (OptionPathError & e) {
+ throw OptionPathError("At '%s' in path '%s': %s", attr, path, e.msg());
+ }
+ }
+ return v;
+}
+
+void printOne(Context & ctx, Out & out, const std::string & path)
+{
+ try {
+ Value option = findAlongOptionPath(ctx, path);
+ option = evaluateValue(ctx, option);
+ if (isOption(ctx, option)) {
+ printOption(ctx, out, path, option);
+ } else {
+ printListing(out, option);
+ }
+ } catch (Error & e) {
+ std::cerr << "error: " << e.msg()
+ << "\nAn error occurred while looking for attribute names. Are "
+ "you sure that '"
+ << path << "' exists?\n";
+ }
+}
+
+int main(int argc, char ** argv)
+{
+ bool all = false;
+ std::string path = ".";
+ std::string optionsExpr = "(import {}).options";
+ std::string configExpr = "(import {}).config";
+ std::vector args;
+
+ struct MyArgs : nix::LegacyArgs, nix::MixEvalArgs
+ {
+ using nix::LegacyArgs::LegacyArgs;
+ };
+
+ MyArgs myArgs(nix::baseNameOf(argv[0]), [&](Strings::iterator & arg, const Strings::iterator & end) {
+ if (*arg == "--help") {
+ nix::showManPage("nixos-option");
+ } else if (*arg == "--version") {
+ nix::printVersion("nixos-option");
+ } else if (*arg == "--all") {
+ all = true;
+ } else if (*arg == "--path") {
+ path = nix::getArg(*arg, arg, end);
+ } else if (*arg == "--options_expr") {
+ optionsExpr = nix::getArg(*arg, arg, end);
+ } else if (*arg == "--config_expr") {
+ configExpr = nix::getArg(*arg, arg, end);
+ } else if (!arg->empty() && arg->at(0) == '-') {
+ return false;
+ } else {
+ args.push_back(*arg);
+ }
+ return true;
+ });
+
+ myArgs.parseCmdline(nix::argvToStrings(argc, argv));
+
+ nix::initPlugins();
+ nix::initGC();
+ nix::settings.readOnlyMode = true;
+ auto store = nix::openStore();
+ auto state = std::make_unique(myArgs.searchPath, store);
+
+ Value optionsRoot = parseAndEval(*state, optionsExpr, path);
+ Value configRoot = parseAndEval(*state, configExpr, path);
+
+ Context ctx{*state, *myArgs.getAutoArgs(*state), optionsRoot, configRoot};
+ Out out(std::cout);
+
+ if (all) {
+ if (!args.empty()) {
+ throw UsageError("--all cannot be used with arguments");
+ }
+ printAll(ctx, out);
+ } else {
+ if (args.empty()) {
+ printOne(ctx, out, "");
+ }
+ for (const auto & arg : args) {
+ printOne(ctx, out, arg);
+ }
+ }
+
+ ctx.state.printStats();
+
+ return 0;
+}
diff --git a/nixos/modules/installer/tools/nixos-rebuild.sh b/nixos/modules/installer/tools/nixos-rebuild.sh
index 6a08c9b4c6c62e1a0cd1aac10775b88bb7d70948..c53dc1000c4ac00ce328505e23352414bcc1bbe0 100644
--- a/nixos/modules/installer/tools/nixos-rebuild.sh
+++ b/nixos/modules/installer/tools/nixos-rebuild.sh
@@ -22,6 +22,7 @@ repair=
profile=/nix/var/nix/profiles/system
buildHost=
targetHost=
+maybeSudo=
while [ "$#" -gt 0 ]; do
i="$1"; shift 1
@@ -89,6 +90,11 @@ while [ "$#" -gt 0 ]; do
targetHost="$1"
shift 1
;;
+ --use-remote-sudo)
+ # note the trailing space
+ maybeSudo="sudo "
+ shift 1
+ ;;
*)
echo "$0: unknown option \`$i'"
exit 1
@@ -96,7 +102,6 @@ while [ "$#" -gt 0 ]; do
esac
done
-
if [ -z "$buildHost" -a -n "$targetHost" ]; then
buildHost="$targetHost"
fi
@@ -111,9 +116,9 @@ buildHostCmd() {
if [ -z "$buildHost" ]; then
"$@"
elif [ -n "$remoteNix" ]; then
- ssh $SSHOPTS "$buildHost" PATH="$remoteNix:$PATH" "$@"
+ ssh $SSHOPTS "$buildHost" env PATH="$remoteNix:$PATH" "$maybeSudo$@"
else
- ssh $SSHOPTS "$buildHost" "$@"
+ ssh $SSHOPTS "$buildHost" "$maybeSudo$@"
fi
}
@@ -121,7 +126,7 @@ targetHostCmd() {
if [ -z "$targetHost" ]; then
"$@"
else
- ssh $SSHOPTS "$targetHost" "$@"
+ ssh $SSHOPTS "$targetHost" "$maybeSudo$@"
fi
}
diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index 05add59117d1190bb5c837d780af184e7cad0b87..e4db39b5c8108381f81443f7877fb050920317fa 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -41,10 +41,7 @@ let
inherit (config.system.nixos-generate-config) configuration;
};
- nixos-option = makeProg {
- name = "nixos-option";
- src = ./nixos-option.sh;
- };
+ nixos-option = pkgs.callPackage ./nixos-option { };
nixos-version = makeProg {
name = "nixos-version";
@@ -96,6 +93,7 @@ in
# networking.hostName = "nixos"; # Define your hostname.
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
+ $networkingDhcpConfig
# Configure network proxy if necessary
# networking.proxy.default = "http://user:password\@proxy:port/";
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
@@ -119,7 +117,11 @@ in
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.
# programs.mtr.enable = true;
- # programs.gnupg.agent = { enable = true; enableSSHSupport = true; };
+ # programs.gnupg.agent = {
+ # enable = true;
+ # enableSSHSupport = true;
+ # pinentryFlavor = "gnome3";
+ # };
# List services that you want to enable:
diff --git a/nixos/modules/misc/documentation.nix b/nixos/modules/misc/documentation.nix
index deecb005270f09031d2b37bb11e01215930683ab..820553270e3bc0d454ae6df5d8a96cb2d4a08922 100644
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@@ -67,6 +67,11 @@ let
in
{
+ imports = [
+ (mkRenamedOptionModule [ "programs" "info" "enable" ] [ "documentation" "info" "enable" ])
+ (mkRenamedOptionModule [ "programs" "man" "enable" ] [ "documentation" "man" "enable" ])
+ (mkRenamedOptionModule [ "services" "nixosManual" "enable" ] [ "documentation" "nixos" "enable" ])
+ ];
options = {
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index ac6af1ce8b77ff49d3a51d488ba55ee16ba94ceb..bedd87a368eb10ab944cef5aa30025c14a6d77f6 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -11,6 +11,9 @@
{ lib, ... }:
+let
+ inherit (lib) types;
+in
{
options = {
@@ -19,6 +22,7 @@
description = ''
The user IDs used in NixOS.
'';
+ type = types.attrsOf types.int;
};
ids.gids = lib.mkOption {
@@ -26,6 +30,7 @@
description = ''
The group IDs used in NixOS.
'';
+ type = types.attrsOf types.int;
};
};
@@ -75,8 +80,8 @@
#kdm = 39; # dropped in 17.03
#ghostone = 40; # dropped in 18.03
git = 41;
- fourstore = 42;
- fourstorehttp = 43;
+ #fourstore = 42; # dropped in 20.03
+ #fourstorehttp = 43; # dropped in 20.03
virtuoso = 44;
rtkit = 45;
dovecot2 = 46;
@@ -128,7 +133,7 @@
tcpcryptd = 93; # tcpcryptd uses a hard-coded uid. We patch it in Nixpkgs to match this choice.
firebird = 95;
#keys = 96; # unused
- haproxy = 97;
+ #haproxy = 97; # DynamicUser as of 2019-11-08
mongodb = 98;
openldap = 99;
#users = 100; # unused
@@ -328,7 +333,7 @@
qemu-libvirtd = 301;
# kvm = 302; # unused
# render = 303; # unused
- zeronet = 304;
+ # zeronet = 304; # removed 2019-01-03
lirc = 305;
lidarr = 306;
slurm = 307;
@@ -443,7 +448,7 @@
#tcpcryptd = 93; # unused
firebird = 95;
keys = 96;
- haproxy = 97;
+ #haproxy = 97; # DynamicUser as of 2019-11-08
#mongodb = 98; # unused
openldap = 99;
munin = 102;
@@ -629,7 +634,7 @@
qemu-libvirtd = 301;
kvm = 302; # default udev rules from systemd requires these
render = 303; # default udev rules from systemd requires these
- zeronet = 304;
+ # zeronet = 304; # removed 2019-01-03
lirc = 305;
lidarr = 306;
slurm = 307;
diff --git a/nixos/modules/misc/locate.nix b/nixos/modules/misc/locate.nix
index 449149e4bb65fca6cc3ba1a0fb61c606f4be6717..552535c253e615111ac87d2b1e5a9e69a77aa4e0 100644
--- a/nixos/modules/misc/locate.nix
+++ b/nixos/modules/misc/locate.nix
@@ -7,6 +7,11 @@ let
isMLocate = hasPrefix "mlocate" cfg.locate.name;
isFindutils = hasPrefix "findutils" cfg.locate.name;
in {
+ imports = [
+ (mkRenamedOptionModule [ "services" "locate" "period" ] [ "services" "locate" "interval" ])
+ (mkRemovedOptionModule [ "services" "locate" "includeStore" ] "Use services.locate.prunePaths" )
+ ];
+
options.services.locate = with types; {
enable = mkOption {
type = bool;
@@ -128,7 +133,10 @@ in {
# directory creation needs to be separated from main service
# because ReadWritePaths fails when the directory doesn't already exist
- systemd.tmpfiles.rules = [ "d ${dirOf cfg.output} 0755 root root -" ];
+ systemd.tmpfiles.rules =
+ let dir = dirOf cfg.output; in
+ mkIf (dir != "/var/cache")
+ [ "d ${dir} 0755 root root -" ];
systemd.services.update-locatedb =
{ description = "Update Locate Database";
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index 773724ffbd5e85b12db2c54df4ee9450e1244f29..0540b493003fe360a102b1e88feb75262d8caa2f 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -10,6 +10,12 @@ let
in
{
+ imports = [
+ (mkRenamedOptionModule [ "system" "nixosVersion" ] [ "system" "nixos" "version" ])
+ (mkRenamedOptionModule [ "system" "nixosVersionSuffix" ] [ "system" "nixos" "versionSuffix" ])
+ (mkRenamedOptionModule [ "system" "nixosRevision" ] [ "system" "nixos" "revision" ])
+ (mkRenamedOptionModule [ "system" "nixosLabel" ] [ "system" "nixos" "label" ])
+ ];
options.system = {
@@ -92,7 +98,7 @@ in
VERSION="${cfg.version} (${cfg.codeName})"
VERSION_CODENAME=${toLower cfg.codeName}
VERSION_ID="${cfg.version}"
- PRETTY_NAME="NixOS ${cfg.version} (${cfg.codeName})"
+ PRETTY_NAME="NixOS ${cfg.release} (${cfg.codeName})"
LOGO="nix-snowflake"
HOME_URL="https://nixos.org/"
DOCUMENTATION_URL="https://nixos.org/nixos/manual/index.html"
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 5b7f391ed5a50d113b752c850fb1a101dbfef885..5b21aec51bddf55ae72d6a32f50cda73850edeec 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1,9 +1,7 @@
[
./config/debug-info.nix
- ./config/fonts/corefonts.nix
./config/fonts/fontconfig.nix
./config/fonts/fontconfig-penultimate.nix
- ./config/fonts/fontconfig-ultimate.nix
./config/fonts/fontdir.nix
./config/fonts/fonts.nix
./config/fonts/ghostscript.nix
@@ -13,6 +11,7 @@
./config/xdg/mime.nix
./config/xdg/portal.nix
./config/appstream.nix
+ ./config/console.nix
./config/xdg/sounds.nix
./config/gtk/gtk-icon-cache.nix
./config/gnu.nix
@@ -37,13 +36,13 @@
./config/terminfo.nix
./config/unix-odbc-drivers.nix
./config/users-groups.nix
- ./config/vpnc.nix
./config/vte.nix
./config/zram.nix
./hardware/acpilight.nix
./hardware/all-firmware.nix
./hardware/bladeRF.nix
./hardware/brightnessctl.nix
+ ./hardware/brillo.nix
./hardware/ckb-next.nix
./hardware/cpu/amd-microcode.nix
./hardware/cpu/intel-microcode.nix
@@ -96,9 +95,9 @@
./programs/adb.nix
./programs/atop.nix
./programs/autojump.nix
+ ./programs/bandwhich.nix
./programs/bash/bash.nix
./programs/bcc.nix
- ./programs/blcr.nix
./programs/browserpass.nix
./programs/captive-browser.nix
./programs/ccache.nix
@@ -143,7 +142,6 @@
./programs/seahorse.nix
./programs/slock.nix
./programs/shadow.nix
- ./programs/shell.nix
./programs/spacefm.nix
./programs/singularity.nix
./programs/ssh.nix
@@ -229,6 +227,7 @@
./services/backup/rsnapshot.nix
./services/backup/tarsnap.nix
./services/backup/tsm.nix
+ ./services/backup/zfs-replication.nix
./services/backup/znapzend.nix
./services/cluster/hadoop/default.nix
./services/cluster/kubernetes/addons/dns.nix
@@ -257,8 +256,6 @@
./services/continuous-integration/jenkins/default.nix
./services/continuous-integration/jenkins/job-builder.nix
./services/continuous-integration/jenkins/slave.nix
- ./services/databases/4store-endpoint.nix
- ./services/databases/4store.nix
./services/databases/aerospike.nix
./services/databases/cassandra.nix
./services/databases/clickhouse.nix
@@ -299,16 +296,18 @@
./services/desktops/gnome3/chrome-gnome-shell.nix
./services/desktops/gnome3/evolution-data-server.nix
./services/desktops/gnome3/glib-networking.nix
+ ./services/desktops/gnome3/gnome-initial-setup.nix
./services/desktops/gnome3/gnome-keyring.nix
./services/desktops/gnome3/gnome-online-accounts.nix
- ./services/desktops/gnome3/gnome-remote-desktop.nix
./services/desktops/gnome3/gnome-online-miners.nix
+ ./services/desktops/gnome3/gnome-remote-desktop.nix
./services/desktops/gnome3/gnome-settings-daemon.nix
./services/desktops/gnome3/gnome-user-share.nix
./services/desktops/gnome3/rygel.nix
./services/desktops/gnome3/sushi.nix
./services/desktops/gnome3/tracker.nix
./services/desktops/gnome3/tracker-miners.nix
+ ./services/desktops/neard.nix
./services/desktops/profile-sync-daemon.nix
./services/desktops/system-config-printer.nix
./services/desktops/telepathy.nix
@@ -317,17 +316,20 @@
./services/development/bloop.nix
./services/development/hoogle.nix
./services/development/jupyter/default.nix
+ ./services/development/lorri.nix
./services/editors/emacs.nix
./services/editors/infinoted.nix
./services/games/factorio.nix
./services/games/minecraft-server.nix
./services/games/minetest-server.nix
+ ./services/games/openarena.nix
./services/games/terraria.nix
./services/hardware/acpid.nix
./services/hardware/actkbd.nix
./services/hardware/bluetooth.nix
./services/hardware/bolt.nix
./services/hardware/brltty.nix
+ ./services/hardware/fancontrol.nix
./services/hardware/freefall.nix
./services/hardware/fwupd.nix
./services/hardware/illum.nix
@@ -443,6 +445,7 @@
./services/misc/logkeys.nix
./services/misc/leaps.nix
./services/misc/lidarr.nix
+ ./services/misc/mame.nix
./services/misc/mathics.nix
./services/misc/matrix-synapse.nix
./services/misc/mbpfan.nix
@@ -502,6 +505,7 @@
./services/monitoring/das_watchdog.nix
./services/monitoring/datadog-agent.nix
./services/monitoring/dd-agent/dd-agent.nix
+ ./services/monitoring/do-agent.nix
./services/monitoring/fusion-inventory.nix
./services/monitoring/grafana.nix
./services/monitoring/grafana-reporter.nix
@@ -516,7 +520,6 @@
./services/monitoring/munin.nix
./services/monitoring/nagios.nix
./services/monitoring/netdata.nix
- ./services/monitoring/osquery.nix
./services/monitoring/prometheus/default.nix
./services/monitoring/prometheus/alertmanager.nix
./services/monitoring/prometheus/exporters.nix
@@ -536,7 +539,6 @@
./services/monitoring/zabbix-agent.nix
./services/monitoring/zabbix-proxy.nix
./services/monitoring/zabbix-server.nix
- ./services/network-filesystems/beegfs.nix
./services/network-filesystems/cachefilesd.nix
./services/network-filesystems/davfs2.nix
./services/network-filesystems/drbd.nix
@@ -547,6 +549,8 @@
./services/network-filesystems/nfsd.nix
./services/network-filesystems/openafs/client.nix
./services/network-filesystems/openafs/server.nix
+ ./services/network-filesystems/orangefs/server.nix
+ ./services/network-filesystems/orangefs/client.nix
./services/network-filesystems/rsyncd.nix
./services/network-filesystems/samba.nix
./services/network-filesystems/tahoe.nix
@@ -555,6 +559,7 @@
./services/network-filesystems/yandex-disk.nix
./services/network-filesystems/xtreemfs.nix
./services/network-filesystems/ceph.nix
+ ./services/networking/3proxy.nix
./services/networking/amuled.nix
./services/networking/aria2.nix
./services/networking/asterisk.nix
@@ -567,7 +572,6 @@
./services/networking/bird.nix
./services/networking/bitlbee.nix
./services/networking/charybdis.nix
- ./services/networking/chrony.nix
./services/networking/cjdns.nix
./services/networking/cntlm.nix
./services/networking/connman.nix
@@ -601,6 +605,7 @@
./services/networking/gdomap.nix
./services/networking/git-daemon.nix
./services/networking/gnunet.nix
+ ./services/networking/go-shadowsocks2.nix
./services/networking/gogoclient.nix
./services/networking/gvpe.nix
./services/networking/hans.nix
@@ -614,7 +619,6 @@
./services/networking/iodine.nix
./services/networking/iperf3.nix
./services/networking/ircd-hybrid/default.nix
- ./services/networking/jormungandr.nix
./services/networking/iwd.nix
./services/networking/keepalived/default.nix
./services/networking/keybase.nix
@@ -650,14 +654,15 @@
./services/networking/nntp-proxy.nix
./services/networking/nsd.nix
./services/networking/ntopng.nix
- ./services/networking/ntpd.nix
+ ./services/networking/ntp/chrony.nix
+ ./services/networking/ntp/ntpd.nix
+ ./services/networking/ntp/openntpd.nix
./services/networking/nullidentdmod.nix
./services/networking/nylon.nix
./services/networking/ocserv.nix
./services/networking/ofono.nix
./services/networking/oidentd.nix
./services/networking/openfire.nix
- ./services/networking/openntpd.nix
./services/networking/openvpn.nix
./services/networking/ostinato.nix
./services/networking/owamp.nix
@@ -665,6 +670,7 @@
./services/networking/polipo.nix
./services/networking/powerdns.nix
./services/networking/pdns-recursor.nix
+ ./services/networking/pppd.nix
./services/networking/pptpd.nix
./services/networking/prayer.nix
./services/networking/privoxy.nix
@@ -686,10 +692,13 @@
./services/networking/skydns.nix
./services/networking/shadowsocks.nix
./services/networking/shairport-sync.nix
+ ./services/networking/shorewall.nix
+ ./services/networking/shorewall6.nix
./services/networking/shout.nix
./services/networking/sniproxy.nix
./services/networking/smokeping.nix
./services/networking/softether.nix
+ ./services/networking/spacecookie.nix
./services/networking/spiped.nix
./services/networking/squid.nix
./services/networking/sslh.nix
@@ -711,12 +720,14 @@
./services/networking/tinc.nix
./services/networking/tinydns.nix
./services/networking/tftpd.nix
+ ./services/networking/trickster.nix
./services/networking/tox-bootstrapd.nix
./services/networking/tox-node.nix
./services/networking/toxvpn.nix
./services/networking/tvheadend.nix
./services/networking/unbound.nix
./services/networking/unifi.nix
+ ./services/networking/v2ray.nix
./services/networking/vsftpd.nix
./services/networking/wakeonlan.nix
./services/networking/websockify.nix
@@ -727,6 +738,7 @@
./services/networking/xinetd.nix
./services/networking/xl2tpd.nix
./services/networking/xrdp.nix
+ ./services/networking/yggdrasil.nix
./services/networking/zerobin.nix
./services/networking/zeronet.nix
./services/networking/zerotierone.nix
@@ -791,6 +803,7 @@
./services/web-apps/cryptpad.nix
./services/web-apps/documize.nix
./services/web-apps/frab.nix
+ ./services/web-apps/gotify-server.nix
./services/web-apps/icingaweb2/icingaweb2.nix
./services/web-apps/icingaweb2/module-monitoring.nix
./services/web-apps/limesurvey.nix
@@ -802,9 +815,13 @@
./services/web-apps/nexus.nix
./services/web-apps/pgpkeyserver-lite.nix
./services/web-apps/matomo.nix
+ ./services/web-apps/moinmoin.nix
./services/web-apps/restya-board.nix
./services/web-apps/tt-rss.nix
+ ./services/web-apps/trac.nix
+ ./services/web-apps/trilium.nix
./services/web-apps/selfoss.nix
+ ./services/web-apps/shiori.nix
./services/web-apps/virtlyst.nix
./services/web-apps/wordpress.nix
./services/web-apps/youtrack.nix
@@ -830,6 +847,7 @@
./services/web-servers/shellinabox.nix
./services/web-servers/tomcat.nix
./services/web-servers/traefik.nix
+ ./services/web-servers/ttyd.nix
./services/web-servers/uwsgi.nix
./services/web-servers/varnish/default.nix
./services/web-servers/zope2.nix
@@ -853,8 +871,10 @@
./services/x11/hardware/multitouch.nix
./services/x11/hardware/synaptics.nix
./services/x11/hardware/wacom.nix
+ ./services/x11/hardware/digimend.nix
./services/x11/hardware/cmt.nix
./services/x11/gdk-pixbuf.nix
+ ./services/x11/imwheel.nix
./services/x11/redshift.nix
./services/x11/urxvtd.nix
./services/x11/window-managers/awesome.nix
@@ -925,7 +945,6 @@
./tasks/filesystems/vfat.nix
./tasks/filesystems/xfs.nix
./tasks/filesystems/zfs.nix
- ./tasks/kbd.nix
./tasks/lvm.nix
./tasks/network-interfaces.nix
./tasks/network-interfaces-systemd.nix
@@ -938,6 +957,7 @@
./virtualisation/anbox.nix
./virtualisation/container-config.nix
./virtualisation/containers.nix
+ ./virtualisation/cri-o.nix
./virtualisation/docker.nix
./virtualisation/docker-containers.nix
./virtualisation/ecs-agent.nix
diff --git a/nixos/modules/profiles/graphical.nix b/nixos/modules/profiles/graphical.nix
index 649f5564ac61207c862e5cace41cf2b824491382..d80456cede565660453c013c3c9ea1c408f451cf 100644
--- a/nixos/modules/profiles/graphical.nix
+++ b/nixos/modules/profiles/graphical.nix
@@ -9,14 +9,12 @@
displayManager.sddm.enable = true;
desktopManager.plasma5 = {
enable = true;
- enableQt4Support = false;
};
libinput.enable = true; # for touchpad support on many laptops
};
# Enable sound in virtualbox appliances.
hardware.pulseaudio.enable = true;
- hardware.pulseaudio.systemWide = true; # Needed since we run plasma as root.
environment.systemPackages = [ pkgs.glxinfo pkgs.firefox ];
}
diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix
index 626d8b1d2bde5508e92eba2eb5bb01af1a515d36..f7b2f5c7fc1e8a34316bf7b09e5fc406a7c5c1de 100644
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@@ -52,6 +52,27 @@ with lib;
"ax25"
"netrom"
"rose"
+
+ # Old or rare or insufficiently audited filesystems
+ "adfs"
+ "affs"
+ "bfs"
+ "befs"
+ "cramfs"
+ "efs"
+ "erofs"
+ "exofs"
+ "freevxfs"
+ "f2fs"
+ "hfs"
+ "hpfs"
+ "jfs"
+ "minix"
+ "nilfs2"
+ "qnx4"
+ "qnx6"
+ "sysv"
+ "ufs"
];
# Restrict ptrace() usage to processes with a pre-defined relationship
diff --git a/nixos/modules/profiles/installation-device.nix b/nixos/modules/profiles/installation-device.nix
index fd30220ce1c918bc5d6315d8bf45587536176832..4596e163404ca5c3e206e6e6533f647c8051545b 100644
--- a/nixos/modules/profiles/installation-device.nix
+++ b/nixos/modules/profiles/installation-device.nix
@@ -31,9 +31,6 @@ with lib;
# Let the user play Rogue on TTY 8 during the installation.
#services.rogue.enable = true;
- # Disable some other stuff we don't need.
- services.udisks2.enable = mkDefault false;
-
# Use less privileged nixos user
users.users.nixos = {
isNormalUser = true;
diff --git a/nixos/modules/profiles/qemu-guest.nix b/nixos/modules/profiles/qemu-guest.nix
index 315d04093b134df806997b68f18c1d9e0b82ae3a..0ea70107f71785e347a0197d8007ad5bd1b5d82a 100644
--- a/nixos/modules/profiles/qemu-guest.nix
+++ b/nixos/modules/profiles/qemu-guest.nix
@@ -1,7 +1,7 @@
# Common configuration for virtual machines running under QEMU (using
# virtio).
-{ ... }:
+{ lib, ... }:
{
boot.initrd.availableKernelModules = [ "virtio_net" "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_scsi" "9p" "9pnet_virtio" ];
@@ -15,5 +15,5 @@
hwclock -s
'';
- security.rngd.enable = false;
+ security.rngd.enable = lib.mkDefault false;
}
diff --git a/nixos/modules/programs/adb.nix b/nixos/modules/programs/adb.nix
index 250d8c252a3bcf165b3e37139360527c9abbf04c..83bcfe886aa15a1221df59bab2d37082966d6271 100644
--- a/nixos/modules/programs/adb.nix
+++ b/nixos/modules/programs/adb.nix
@@ -23,7 +23,8 @@ with lib;
###### implementation
config = mkIf config.programs.adb.enable {
services.udev.packages = [ pkgs.android-udev-rules ];
- environment.systemPackages = [ pkgs.androidenv.androidPkgs_9_0.platform-tools ];
+ # Give platform-tools lower priority so mke2fs+friends are taken from other packages first
+ environment.systemPackages = [ (lowPrio pkgs.androidenv.androidPkgs_9_0.platform-tools) ];
users.groups.adbusers = {};
};
}
diff --git a/nixos/modules/programs/bandwhich.nix b/nixos/modules/programs/bandwhich.nix
new file mode 100644
index 0000000000000000000000000000000000000000..5413044f46141b10d5a1be4a08a304f18b1b01bf
--- /dev/null
+++ b/nixos/modules/programs/bandwhich.nix
@@ -0,0 +1,29 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let cfg = config.programs.bandwhich;
+in {
+ meta.maintainers = with maintainers; [ filalex77 ];
+
+ options = {
+ programs.bandwhich = {
+ enable = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Whether to add bandwhich to the global environment and configure a
+ setcap wrapper for it.
+ '';
+ };
+ };
+ };
+
+ config = mkIf cfg.enable {
+ environment.systemPackages = with pkgs; [ bandwhich ];
+ security.wrappers.bandwhich = {
+ source = "${pkgs.bandwhich}/bin/bandwhich";
+ capabilities = "cap_net_raw,cap_net_admin+ep";
+ };
+ };
+}
diff --git a/nixos/modules/programs/bash/bash.nix b/nixos/modules/programs/bash/bash.nix
index 548babac38ca1d308574026e38f4906573fd85bc..366c07c0a3528e113d0b5f7d5ca7d2132a37e366 100644
--- a/nixos/modules/programs/bash/bash.nix
+++ b/nixos/modules/programs/bash/bash.nix
@@ -40,6 +40,10 @@ let
in
{
+ imports = [
+ (mkRemovedOptionModule [ "programs" "bash" "enable" ] "")
+ ];
+
options = {
programs.bash = {
diff --git a/nixos/modules/programs/blcr.nix b/nixos/modules/programs/blcr.nix
deleted file mode 100644
index 804e1d01f12b86a4ecfdd4cffed1db19bbcc73f7..0000000000000000000000000000000000000000
--- a/nixos/modules/programs/blcr.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{ config, lib, ... }:
-
-let
- inherit (lib) mkOption mkIf;
- cfg = config.environment.blcr;
- blcrPkg = config.boot.kernelPackages.blcr;
-in
-
-{
- ###### interface
-
- options = {
- environment.blcr.enable = mkOption {
- default = false;
- description =
- "Whether to enable support for the BLCR checkpointing tool.";
- };
- };
-
- ###### implementation
-
- config = mkIf cfg.enable {
- boot.kernelModules = [ "blcr" "blcr_imports" ];
- boot.extraModulePackages = [ blcrPkg ];
- environment.systemPackages = [ blcrPkg ];
- };
-}
diff --git a/nixos/modules/programs/dconf.nix b/nixos/modules/programs/dconf.nix
index eeebc3558bdf9b5160101448459c201f44cbb669..e0e2ffd80cffb5dfde712fa6a9a3c6ef88070861 100644
--- a/nixos/modules/programs/dconf.nix
+++ b/nixos/modules/programs/dconf.nix
@@ -32,13 +32,13 @@ in
environment.etc = optionals (cfg.profiles != {})
(mapAttrsToList mkDconfProfile cfg.profiles);
- services.dbus.packages = [ pkgs.gnome3.dconf ];
+ services.dbus.packages = [ pkgs.dconf ];
# For dconf executable
- environment.systemPackages = [ pkgs.gnome3.dconf ];
+ environment.systemPackages = [ pkgs.dconf ];
# Needed for unwrapped applications
- environment.variables.GIO_EXTRA_MODULES = mkIf cfg.enable [ "${pkgs.gnome3.dconf.lib}/lib/gio/modules" ];
+ environment.variables.GIO_EXTRA_MODULES = mkIf cfg.enable [ "${pkgs.dconf.lib}/lib/gio/modules" ];
};
}
diff --git a/nixos/modules/programs/environment.nix b/nixos/modules/programs/environment.nix
index 66eb83482664999581336c29e7ae30dbe11da049..38bdabb4fa81267c758a5f856e2fe7dd4a08ae79 100644
--- a/nixos/modules/programs/environment.nix
+++ b/nixos/modules/programs/environment.nix
@@ -20,7 +20,6 @@ in
{ NIXPKGS_CONFIG = "/etc/nix/nixpkgs-config.nix";
PAGER = mkDefault "less -R";
EDITOR = mkDefault "nano";
- XCURSOR_PATH = [ "$HOME/.icons" ];
XDG_CONFIG_DIRS = [ "/etc/xdg" ]; # needs to be before profile-relative paths to allow changes through environment.etc
};
@@ -30,7 +29,7 @@ in
];
# TODO: move most of these elsewhere
- environment.profileRelativeEnvVars =
+ environment.profileRelativeSessionVariables =
{ PATH = [ "/bin" ];
INFOPATH = [ "/info" "/share/info" ];
KDEDIRS = [ "" ];
diff --git a/nixos/modules/programs/gnupg.nix b/nixos/modules/programs/gnupg.nix
index bcbc994efe9b316b40c20ea74249a8ee22ea9759..2d262d9065796c374d57c7beb5ea799c4f9bb27b 100644
--- a/nixos/modules/programs/gnupg.nix
+++ b/nixos/modules/programs/gnupg.nix
@@ -6,6 +6,19 @@ let
cfg = config.programs.gnupg;
+ xserverCfg = config.services.xserver;
+
+ defaultPinentryFlavor =
+ if xserverCfg.desktopManager.lxqt.enable
+ || xserverCfg.desktopManager.plasma5.enable then
+ "qt"
+ else if xserverCfg.desktopManager.xfce.enable then
+ "gtk2"
+ else if xserverCfg.enable || config.programs.sway.enable then
+ "gnome3"
+ else
+ null;
+
in
{
@@ -54,6 +67,20 @@ in
'';
};
+ agent.pinentryFlavor = mkOption {
+ type = types.nullOr (types.enum pkgs.pinentry.flavors);
+ example = "gnome3";
+ description = ''
+ Which pinentry interface to use. If not null, the path to the
+ pinentry binary will be passed to gpg-agent via commandline and
+ thus overrides the pinentry option in gpg-agent.conf in the user's
+ home directory.
+ If not set at all, it'll pick an appropriate flavor depending on the
+ system configuration (qt flavor for lxqt and plasma5, gtk2 for xfce
+ 4.12, gnome3 on all other systems with X enabled, ncurses otherwise).
+ '';
+ };
+
dirmngr.enable = mkOption {
type = types.bool;
default = false;
@@ -64,6 +91,16 @@ in
};
config = mkIf cfg.agent.enable {
+ programs.gnupg.agent.pinentryFlavor = mkDefault defaultPinentryFlavor;
+
+ # This overrides the systemd user unit shipped with the gnupg package
+ systemd.user.services.gpg-agent = mkIf (cfg.agent.pinentryFlavor != null) {
+ serviceConfig.ExecStart = [ "" ''
+ ${pkgs.gnupg}/bin/gpg-agent --supervised \
+ --pinentry-program ${pkgs.pinentry.${cfg.agent.pinentryFlavor}}/bin/pinentry
+ '' ];
+ };
+
systemd.user.sockets.gpg-agent = {
wantedBy = [ "sockets.target" ];
};
@@ -83,7 +120,9 @@ in
systemd.user.sockets.dirmngr = mkIf cfg.dirmngr.enable {
wantedBy = [ "sockets.target" ];
};
-
+
+ services.dbus.packages = mkIf (cfg.agent.pinentryFlavor == "gnome3") [ pkgs.gcr ];
+
environment.systemPackages = with pkgs; [ cfg.package ];
systemd.packages = [ cfg.package ];
diff --git a/nixos/modules/programs/less.nix b/nixos/modules/programs/less.nix
index e19935b77cafbfbc75028210c056ad7272445cde..75b3e707d576d4119a084f9d3f7a561d9b97b188 100644
--- a/nixos/modules/programs/less.nix
+++ b/nixos/modules/programs/less.nix
@@ -54,8 +54,8 @@ in
type = types.attrsOf types.str;
default = {};
example = {
- h = "noaction 5\e(";
- l = "noaction 5\e)";
+ h = "noaction 5\\e(";
+ l = "noaction 5\\e)";
};
description = "Defines new command keys.";
};
diff --git a/nixos/modules/programs/mtr.nix b/nixos/modules/programs/mtr.nix
index 1fdec4c04f682e97a09922c7c339f8e800602a90..75b710c1584fc31d4d5c1e835e20e9319a4e0070 100644
--- a/nixos/modules/programs/mtr.nix
+++ b/nixos/modules/programs/mtr.nix
@@ -4,6 +4,7 @@ with lib;
let
cfg = config.programs.mtr;
+
in {
options = {
programs.mtr = {
@@ -15,13 +16,22 @@ in {
setcap wrapper for it.
'';
};
+
+ package = mkOption {
+ type = types.package;
+ default = pkgs.mtr;
+ description = ''
+ The package to use.
+ '';
+ };
};
};
config = mkIf cfg.enable {
- environment.systemPackages = with pkgs; [ mtr ];
+ environment.systemPackages = with pkgs; [ cfg.package ];
+
security.wrappers.mtr-packet = {
- source = "${pkgs.mtr}/bin/mtr-packet";
+ source = "${cfg.package}/bin/mtr-packet";
capabilities = "cap_net_raw+p";
};
};
diff --git a/nixos/modules/programs/nm-applet.nix b/nixos/modules/programs/nm-applet.nix
index e42219e9638c931b179b52ca72697d74eb4f5367..1b806071c43c56827f846236dae6495c26ee9a1e 100644
--- a/nixos/modules/programs/nm-applet.nix
+++ b/nixos/modules/programs/nm-applet.nix
@@ -10,5 +10,7 @@
partOf = [ "graphical-session.target" ];
serviceConfig.ExecStart = "${pkgs.networkmanagerapplet}/bin/nm-applet";
};
+
+ services.dbus.packages = [ pkgs.gcr ];
};
}
diff --git a/nixos/modules/programs/oblogout.nix b/nixos/modules/programs/oblogout.nix
index 720c29b1eaeef77e07b9212c31c19d156c24a8ed..a039b0623b52cb3988ad04aa1da3556e1fcb8f27 100644
--- a/nixos/modules/programs/oblogout.nix
+++ b/nixos/modules/programs/oblogout.nix
@@ -1,176 +1,11 @@
-# Global configuration for oblogout.
-
{ config, lib, pkgs, ... }:
with lib;
-let cfg = config.programs.oblogout;
-
-in
{
- ###### interface
-
- options = {
-
- programs.oblogout = {
-
- enable = mkOption {
- type = types.bool;
- default = false;
- description = ''
- Whether to install OBLogout and create /etc/oblogout.conf.
- See ${pkgs.oblogout}/share/doc/README.
- '';
- };
-
- opacity = mkOption {
- type = types.int;
- default = 70;
- description = ''
- Opacity percentage of Cairo rendered backgrounds.
- '';
- };
-
- bgcolor = mkOption {
- type = types.str;
- default = "black";
- description = ''
- Colour name or hex code (#ffffff) of the background color.
- '';
- };
-
- buttontheme = mkOption {
- type = types.str;
- default = "simplistic";
- description = ''
- Icon theme for the buttons, must be in the themes folder of
- the package, or in
- ~/.themes/<name>/oblogout/.
- '';
- };
-
- buttons = mkOption {
- type = types.str;
- default = "cancel, logout, restart, shutdown, suspend, hibernate";
- description = ''
- List and order of buttons to show.
- '';
- };
-
- cancel = mkOption {
- type = types.str;
- default = "Escape";
- description = ''
- Cancel logout/shutdown shortcut.
- '';
- };
-
- shutdown = mkOption {
- type = types.str;
- default = "S";
- description = ''
- Shutdown shortcut.
- '';
- };
-
- restart = mkOption {
- type = types.str;
- default = "R";
- description = ''
- Restart shortcut.
- '';
- };
-
- suspend = mkOption {
- type = types.str;
- default = "U";
- description = ''
- Suspend shortcut.
- '';
- };
-
- logout = mkOption {
- type = types.str;
- default = "L";
- description = ''
- Logout shortcut.
- '';
- };
-
- lock = mkOption {
- type = types.str;
- default = "K";
- description = ''
- Lock session shortcut.
- '';
- };
-
- hibernate = mkOption {
- type = types.str;
- default = "H";
- description = ''
- Hibernate shortcut.
- '';
- };
-
- clogout = mkOption {
- type = types.str;
- default = "openbox --exit";
- description = ''
- Command to logout.
- '';
- };
-
- clock = mkOption {
- type = types.str;
- default = "";
- description = ''
- Command to lock screen.
- '';
- };
-
- cswitchuser = mkOption {
- type = types.str;
- default = "";
- description = ''
- Command to switch user.
- '';
- };
- };
- };
-
- ###### implementation
-
- config = mkIf cfg.enable {
- environment.systemPackages = [ pkgs.oblogout ];
-
- environment.etc."oblogout.conf".text = ''
- [settings]
- usehal = false
-
- [looks]
- opacity = ${toString cfg.opacity}
- bgcolor = ${cfg.bgcolor}
- buttontheme = ${cfg.buttontheme}
- buttons = ${cfg.buttons}
- [shortcuts]
- cancel = ${cfg.cancel}
- shutdown = ${cfg.shutdown}
- restart = ${cfg.restart}
- suspend = ${cfg.suspend}
- logout = ${cfg.logout}
- lock = ${cfg.lock}
- hibernate = ${cfg.hibernate}
+ imports = [
+ (mkRemovedOptionModule [ "programs" "oblogout" ] "programs.oblogout has been removed from NixOS. This is because the oblogout repository has been archived upstream.")
+ ];
- [commands]
- shutdown = systemctl poweroff
- restart = systemctl reboot
- suspend = systemctl suspend
- hibernate = systemctl hibernate
- logout = ${cfg.clogout}
- lock = ${cfg.clock}
- switchuser = ${cfg.cswitchuser}
- '';
- };
}
diff --git a/nixos/modules/programs/seahorse.nix b/nixos/modules/programs/seahorse.nix
index c08b0a85374cdeb8e1b85efdb8f90f9a88ec81f1..b229d2a2c0db0b0bd8fe3c07416f081ff12548fa 100644
--- a/nixos/modules/programs/seahorse.nix
+++ b/nixos/modules/programs/seahorse.nix
@@ -31,6 +31,8 @@ with lib;
config = mkIf config.programs.seahorse.enable {
+ programs.ssh.askPassword = mkDefault "${pkgs.gnome3.seahorse}/libexec/seahorse/ssh-askpass";
+
environment.systemPackages = [
pkgs.gnome3.seahorse
];
diff --git a/nixos/modules/programs/shadow.nix b/nixos/modules/programs/shadow.nix
index 8ec4169207db51282139e0adc3cbfbb20e56b4cc..7eaf79d864e79251e048c716e8a572a73dd32dde 100644
--- a/nixos/modules/programs/shadow.nix
+++ b/nixos/modules/programs/shadow.nix
@@ -6,17 +6,27 @@ with lib;
let
+ /*
+ There are three different sources for user/group id ranges, each of which gets
+ used by different programs:
+ - The login.defs file, used by the useradd, groupadd and newusers commands
+ - The update-users-groups.pl file, used by NixOS in the activation phase to
+ decide on which ids to use for declaratively defined users without a static
+ id
+ - Systemd compile time options -Dsystem-uid-max= and -Dsystem-gid-max=, used
+ by systemd for features like ConditionUser=@system and systemd-sysusers
+ */
loginDefs =
''
DEFAULT_HOME yes
SYS_UID_MIN 400
- SYS_UID_MAX 499
+ SYS_UID_MAX 999
UID_MIN 1000
UID_MAX 29999
SYS_GID_MIN 400
- SYS_GID_MAX 499
+ SYS_GID_MAX 999
GID_MIN 1000
GID_MAX 29999
diff --git a/nixos/modules/programs/shell.nix b/nixos/modules/programs/shell.nix
deleted file mode 100644
index b7f7b91b5fbe265b31e02ca4ceabdf8655dd9d52..0000000000000000000000000000000000000000
--- a/nixos/modules/programs/shell.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-# This module defines a standard configuration for NixOS shells.
-
-{ config, lib, ... }:
-
-with lib;
-
-{
-
- config = {
-
- environment.shellInit =
- ''
- # Set up the per-user profile.
- mkdir -m 0755 -p "$NIX_USER_PROFILE_DIR"
- if [ "$(stat -c '%u' "$NIX_USER_PROFILE_DIR")" != "$(id -u)" ]; then
- echo "WARNING: the per-user profile dir $NIX_USER_PROFILE_DIR should belong to user id $(id -u)" >&2
- fi
-
- if [ -w "$HOME" ]; then
- if ! [ -L "$HOME/.nix-profile" ]; then
- if [ "$USER" != root ]; then
- ln -s "$NIX_USER_PROFILE_DIR/profile" "$HOME/.nix-profile"
- else
- # Root installs in the system-wide profile by default.
- ln -s /nix/var/nix/profiles/default "$HOME/.nix-profile"
- fi
- fi
-
- # Subscribe the root user to the NixOS channel by default.
- if [ "$USER" = root -a ! -e "$HOME/.nix-channels" ]; then
- echo "${config.system.defaultChannel} nixos" > "$HOME/.nix-channels"
- fi
-
- # Create the per-user garbage collector roots directory.
- NIX_USER_GCROOTS_DIR="/nix/var/nix/gcroots/per-user/$USER"
- mkdir -m 0755 -p "$NIX_USER_GCROOTS_DIR"
- if [ "$(stat -c '%u' "$NIX_USER_GCROOTS_DIR")" != "$(id -u)" ]; then
- echo "WARNING: the per-user gcroots dir $NIX_USER_GCROOTS_DIR should belong to user id $(id -u)" >&2
- fi
-
- # Set up a default Nix expression from which to install stuff.
- if [ ! -e "$HOME/.nix-defexpr" -o -L "$HOME/.nix-defexpr" ]; then
- rm -f "$HOME/.nix-defexpr"
- mkdir -p "$HOME/.nix-defexpr"
- if [ "$USER" != root ]; then
- ln -s /nix/var/nix/profiles/per-user/root/channels "$HOME/.nix-defexpr/channels_root"
- fi
- fi
- fi
- '';
-
- };
-
-}
diff --git a/nixos/modules/programs/ssh.nix b/nixos/modules/programs/ssh.nix
index 733b8f7636fd22426e9ed45d8aac058a3375b641..80198990ed110c687455293a0df475f7b1d2f4e3 100644
--- a/nixos/modules/programs/ssh.nix
+++ b/nixos/modules/programs/ssh.nix
@@ -115,6 +115,16 @@ in
'';
};
+ agentPKCS11Whitelist = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = "\${pkgs.opensc}/lib/opensc-pkcs11.so";
+ description = ''
+ A pattern-list of acceptable paths for PKCS#11 shared libraries
+ that may be used with the -s option to ssh-add.
+ '';
+ };
+
package = mkOption {
type = types.package;
default = pkgs.openssh;
@@ -241,6 +251,7 @@ in
ExecStart =
"${cfg.package}/bin/ssh-agent " +
optionalString (cfg.agentTimeout != null) ("-t ${cfg.agentTimeout} ") +
+ optionalString (cfg.agentPKCS11Whitelist != null) ("-P ${cfg.agentPKCS11Whitelist} ") +
"-a %t/ssh-agent";
StandardOutput = "null";
Type = "forking";
diff --git a/nixos/modules/programs/ssmtp.nix b/nixos/modules/programs/ssmtp.nix
index 0e060e3f522610911b519ae53d881db8471cc423..f794eac8af00cc2373c8ec7735f101d05cbac507 100644
--- a/nixos/modules/programs/ssmtp.nix
+++ b/nixos/modules/programs/ssmtp.nix
@@ -8,18 +8,21 @@
with lib;
let
-
- cfg = config.networking.defaultMailServer;
+ cfg = config.services.ssmtp;
in
-
{
+ imports = [
+ (mkRenamedOptionModule [ "networking" "defaultMailServer" ] [ "services" "ssmtp" ])
+ (mkRenamedOptionModule [ "services" "ssmtp" "directDelivery" ] [ "services" "ssmtp" "enable" ])
+ ];
+
options = {
- networking.defaultMailServer = {
+ services.ssmtp = {
- directDelivery = mkOption {
+ enable = mkOption {
type = types.bool;
default = false;
description = ''
@@ -29,7 +32,7 @@ in
sendmail or postfix on
your machine, set this option to true, and
set the option
- to the
+ to the
host name of your preferred mail server.
'';
};
@@ -129,9 +132,9 @@ in
};
- config = mkIf cfg.directDelivery {
+ config = mkIf cfg.enable {
- networking.defaultMailServer.authPassFile = mkIf (cfg.authPass != "")
+ services.ssmtp.authPassFile = mkIf (cfg.authPass != "")
(mkDefault (toString (pkgs.writeTextFile {
name = "ssmtp-authpass";
text = cfg.authPass;
diff --git a/nixos/modules/programs/sway.nix b/nixos/modules/programs/sway.nix
index b4f03151cdc1a4184ed2f5cb0c9a5d9d1e7ef50e..e2a4018e9023e5ec9a53425f7496167207bd2bb2 100644
--- a/nixos/modules/programs/sway.nix
+++ b/nixos/modules/programs/sway.nix
@@ -4,26 +4,32 @@ with lib;
let
cfg = config.programs.sway;
- swayPackage = pkgs.sway;
- swayWrapped = pkgs.writeShellScriptBin "sway" ''
- set -o errexit
-
- if [ ! "$_SWAY_WRAPPER_ALREADY_EXECUTED" ]; then
- export _SWAY_WRAPPER_ALREADY_EXECUTED=1
- ${cfg.extraSessionCommands}
- fi
+ wrapperOptions = types.submodule {
+ options =
+ let
+ mkWrapperFeature = default: description: mkOption {
+ type = types.bool;
+ inherit default;
+ example = !default;
+ description = "Whether to make use of the ${description}";
+ };
+ in {
+ base = mkWrapperFeature true ''
+ base wrapper to execute extra session commands and prepend a
+ dbus-run-session to the sway command.
+ '';
+ gtk = mkWrapperFeature false ''
+ wrapGAppsHook wrapper to execute sway with required environment
+ variables for GTK applications.
+ '';
+ };
+ };
- if [ "$DBUS_SESSION_BUS_ADDRESS" ]; then
- export DBUS_SESSION_BUS_ADDRESS
- exec ${swayPackage}/bin/sway "$@"
- else
- exec ${pkgs.dbus}/bin/dbus-run-session ${swayPackage}/bin/sway "$@"
- fi
- '';
- swayJoined = pkgs.symlinkJoin {
- name = "sway-joined";
- paths = [ swayWrapped swayPackage ];
+ swayPackage = pkgs.sway.override {
+ extraSessionCommands = cfg.extraSessionCommands;
+ withBaseWrapper = cfg.wrapperFeatures.base;
+ withGtkWrapper = cfg.wrapperFeatures.gtk;
};
in {
options.programs.sway = {
@@ -35,6 +41,15 @@ in {
Please have a look at the "extraSessionCommands" example for running
programs natively under Wayland'';
+ wrapperFeatures = mkOption {
+ type = wrapperOptions;
+ default = { };
+ example = { gtk = true; };
+ description = ''
+ Attribute set of features to enable in the wrapper.
+ '';
+ };
+
extraSessionCommands = mkOption {
type = types.lines;
default = "";
@@ -75,8 +90,17 @@ in {
};
config = mkIf cfg.enable {
+ assertions = [
+ {
+ assertion = cfg.extraSessionCommands != "" -> cfg.wrapperFeatures.base;
+ message = ''
+ The extraSessionCommands for Sway will not be run if
+ wrapperFeatures.base is disabled.
+ '';
+ }
+ ];
environment = {
- systemPackages = [ swayJoined ] ++ cfg.extraPackages;
+ systemPackages = [ swayPackage ] ++ cfg.extraPackages;
etc = {
"sway/config".source = mkOptionDefault "${swayPackage}/etc/sway/config";
#"sway/security.d".source = mkOptionDefault "${swayPackage}/etc/sway/security.d/";
@@ -87,6 +111,8 @@ in {
hardware.opengl.enable = mkDefault true;
fonts.enableDefaultFonts = mkDefault true;
programs.dconf.enable = mkDefault true;
+ # To make a Sway session available if a display manager like SDDM is enabled:
+ services.xserver.displayManager.sessionPackages = [ swayPackage ];
};
meta.maintainers = with lib.maintainers; [ gnidorah primeos colemickens ];
diff --git a/nixos/modules/programs/x2goserver.nix b/nixos/modules/programs/x2goserver.nix
index 77a1a0da79938ea63eeb091e63649b3afff0bdd1..7d74231e956b7ac4bddafbe46ba8a1be1a2d4311 100644
--- a/nixos/modules/programs/x2goserver.nix
+++ b/nixos/modules/programs/x2goserver.nix
@@ -69,6 +69,7 @@ in {
users.users.x2go = {
home = "/var/lib/x2go/db";
group = "x2go";
+ isSystemUser = true;
};
security.wrappers.x2gosqliteWrapper = {
diff --git a/nixos/modules/programs/zsh/oh-my-zsh.nix b/nixos/modules/programs/zsh/oh-my-zsh.nix
index f4df4e983e421cb2ded660466ca1ec230f211f0c..932a780a356a6f857b53b8069f58d32e640ac7a4 100644
--- a/nixos/modules/programs/zsh/oh-my-zsh.nix
+++ b/nixos/modules/programs/zsh/oh-my-zsh.nix
@@ -29,6 +29,13 @@ let
in
{
+ imports = [
+ (mkRenamedOptionModule [ "programs" "zsh" "oh-my-zsh" "enable" ] [ "programs" "zsh" "ohMyZsh" "enable" ])
+ (mkRenamedOptionModule [ "programs" "zsh" "oh-my-zsh" "theme" ] [ "programs" "zsh" "ohMyZsh" "theme" ])
+ (mkRenamedOptionModule [ "programs" "zsh" "oh-my-zsh" "custom" ] [ "programs" "zsh" "ohMyZsh" "custom" ])
+ (mkRenamedOptionModule [ "programs" "zsh" "oh-my-zsh" "plugins" ] [ "programs" "zsh" "ohMyZsh" "plugins" ])
+ ];
+
options = {
programs.zsh.ohMyZsh = {
enable = mkOption {
diff --git a/nixos/modules/programs/zsh/zsh-autosuggestions.nix b/nixos/modules/programs/zsh/zsh-autosuggestions.nix
index ded17f38a618eae87d69d518895b600151cffe17..037888fdc5a842d71e24ded336422a377db484d6 100644
--- a/nixos/modules/programs/zsh/zsh-autosuggestions.nix
+++ b/nixos/modules/programs/zsh/zsh-autosuggestions.nix
@@ -6,6 +6,10 @@ let
cfg = config.programs.zsh.autosuggestions;
in
{
+ imports = [
+ (mkRenamedOptionModule [ "programs" "zsh" "enableAutosuggestions" ] [ "programs" "zsh" "autosuggestions" "enable" ])
+ ];
+
options.programs.zsh.autosuggestions = {
enable = mkEnableOption "zsh-autosuggestions";
diff --git a/nixos/modules/programs/zsh/zsh-syntax-highlighting.nix b/nixos/modules/programs/zsh/zsh-syntax-highlighting.nix
index 7184e5d9b9a826a5a4ccc67f5e442517880a044f..927a904369d5ed585ded010ca52a94a6c3b49493 100644
--- a/nixos/modules/programs/zsh/zsh-syntax-highlighting.nix
+++ b/nixos/modules/programs/zsh/zsh-syntax-highlighting.nix
@@ -6,6 +6,13 @@ let
cfg = config.programs.zsh.syntaxHighlighting;
in
{
+ imports = [
+ (mkRenamedOptionModule [ "programs" "zsh" "enableSyntaxHighlighting" ] [ "programs" "zsh" "syntaxHighlighting" "enable" ])
+ (mkRenamedOptionModule [ "programs" "zsh" "syntax-highlighting" "enable" ] [ "programs" "zsh" "syntaxHighlighting" "enable" ])
+ (mkRenamedOptionModule [ "programs" "zsh" "syntax-highlighting" "highlighters" ] [ "programs" "zsh" "syntaxHighlighting" "highlighters" ])
+ (mkRenamedOptionModule [ "programs" "zsh" "syntax-highlighting" "patterns" ] [ "programs" "zsh" "syntaxHighlighting" "patterns" ])
+ ];
+
options = {
programs.zsh.syntaxHighlighting = {
enable = mkEnableOption "zsh-syntax-highlighting";
@@ -81,7 +88,7 @@ in
];
programs.zsh.interactiveShellInit = with pkgs;
- lib.concatStringsSep "\n" ([
+ lib.mkAfter (lib.concatStringsSep "\n" ([
"source ${zsh-syntax-highlighting}/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh"
] ++ optional (length(cfg.highlighters) > 0)
"ZSH_HIGHLIGHT_HIGHLIGHTERS=(${concatStringsSep " " cfg.highlighters})"
@@ -95,6 +102,6 @@ in
styles: design:
"ZSH_HIGHLIGHT_STYLES[${styles}]='${design}'"
) cfg.styles)
- );
+ ));
};
}
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index d1303f90ad8d56c5f9a98b4f67efe9c875786df9..7109ab5a1099d6f0c8284c8dbafb2b3fbca1b390 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -4,301 +4,30 @@ with lib;
{
imports = [
- (mkRenamedOptionModule [ "networking" "enableRT73Firmware" ] [ "hardware" "enableRedistributableFirmware" ])
- (mkRenamedOptionModule [ "networking" "enableIntel3945ABGFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
- (mkRenamedOptionModule [ "networking" "enableIntel2100BGFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
- (mkRenamedOptionModule [ "networking" "enableRalinkFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
- (mkRenamedOptionModule [ "networking" "enableRTL8192cFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
- (mkRenamedOptionModule [ "networking" "networkmanager" "useDnsmasq" ] [ "networking" "networkmanager" "dns" ])
- (mkChangedOptionModule [ "services" "printing" "gutenprint" ] [ "services" "printing" "drivers" ]
- (config:
- let enabled = getAttrFromPath [ "services" "printing" "gutenprint" ] config;
- in if enabled then [ pkgs.gutenprint ] else [ ]))
- (mkChangedOptionModule [ "services" "ddclient" "domain" ] [ "services" "ddclient" "domains" ]
- (config:
- let value = getAttrFromPath [ "services" "ddclient" "domain" ] config;
- in if value != "" then [ value ] else []))
- (mkRemovedOptionModule [ "services" "ddclient" "homeDir" ] "")
- (mkRenamedOptionModule [ "services" "flatpak" "extraPortals" ] [ "xdg" "portal" "extraPortals" ])
- (mkRenamedOptionModule [ "services" "i2pd" "extIp" ] [ "services" "i2pd" "address" ])
- (mkRenamedOptionModule [ "services" "kubernetes" "apiserver" "admissionControl" ] [ "services" "kubernetes" "apiserver" "enableAdmissionPlugins" ])
- (mkRenamedOptionModule [ "services" "kubernetes" "apiserver" "address" ] ["services" "kubernetes" "apiserver" "bindAddress"])
- (mkRenamedOptionModule [ "services" "kubernetes" "apiserver" "port" ] ["services" "kubernetes" "apiserver" "insecurePort"])
- (mkRemovedOptionModule [ "services" "kubernetes" "apiserver" "publicAddress" ] "")
- (mkRenamedOptionModule [ "services" "kubernetes" "addons" "dashboard" "enableRBAC" ] [ "services" "kubernetes" "addons" "dashboard" "rbac" "enable" ])
- (mkRenamedOptionModule [ "services" "kubernetes" "controllerManager" "address" ] ["services" "kubernetes" "controllerManager" "bindAddress"])
- (mkRenamedOptionModule [ "services" "kubernetes" "controllerManager" "port" ] ["services" "kubernetes" "controllerManager" "insecurePort"])
- (mkRenamedOptionModule [ "services" "kubernetes" "etcd" "servers" ] [ "services" "kubernetes" "apiserver" "etcd" "servers" ])
- (mkRenamedOptionModule [ "services" "kubernetes" "etcd" "keyFile" ] [ "services" "kubernetes" "apiserver" "etcd" "keyFile" ])
- (mkRenamedOptionModule [ "services" "kubernetes" "etcd" "certFile" ] [ "services" "kubernetes" "apiserver" "etcd" "certFile" ])
- (mkRenamedOptionModule [ "services" "kubernetes" "etcd" "caFile" ] [ "services" "kubernetes" "apiserver" "etcd" "caFile" ])
- (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "applyManifests" ] "")
- (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "cadvisorPort" ] "")
- (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "allowPrivileged" ] "")
- (mkRenamedOptionModule [ "services" "kubernetes" "proxy" "address" ] ["services" "kubernetes" "proxy" "bindAddress"])
- (mkRemovedOptionModule [ "services" "kubernetes" "verbose" ] "")
- (mkRenamedOptionModule [ "services" "logstash" "address" ] [ "services" "logstash" "listenAddress" ])
- (mkRenamedOptionModule [ "services" "neo4j" "host" ] [ "services" "neo4j" "defaultListenAddress" ])
- (mkRenamedOptionModule [ "services" "neo4j" "listenAddress" ] [ "services" "neo4j" "defaultListenAddress" ])
- (mkRenamedOptionModule [ "services" "neo4j" "enableBolt" ] [ "services" "neo4j" "bolt" "enable" ])
- (mkRenamedOptionModule [ "services" "neo4j" "enableHttps" ] [ "services" "neo4j" "https" "enable" ])
- (mkRenamedOptionModule [ "services" "neo4j" "certDir" ] [ "services" "neo4j" "directories" "certificates" ])
- (mkRenamedOptionModule [ "services" "neo4j" "dataDir" ] [ "services" "neo4j" "directories" "home" ])
- (mkRemovedOptionModule [ "services" "neo4j" "port" ] "Use services.neo4j.http.listenAddress instead.")
- (mkRemovedOptionModule [ "services" "neo4j" "boltPort" ] "Use services.neo4j.bolt.listenAddress instead.")
- (mkRemovedOptionModule [ "services" "neo4j" "httpsPort" ] "Use services.neo4j.https.listenAddress instead.")
- (mkRemovedOptionModule [ "services" "misc" "nzbget" "configFile" ] "The configuration of nzbget is now managed by users through the web interface.")
- (mkRemovedOptionModule [ "services" "misc" "nzbget" "dataDir" ] "The data directory for nzbget is now /var/lib/nzbget.")
- (mkRemovedOptionModule [ "services" "misc" "nzbget" "openFirewall" ] "The port used by nzbget is managed through the web interface so you should adjust your firewall rules accordingly.")
- (mkRemovedOptionModule [ "services" "prometheus" "alertmanager" "user" ] "The alertmanager service is now using systemd's DynamicUser mechanism which obviates a user setting.")
- (mkRemovedOptionModule [ "services" "prometheus" "alertmanager" "group" ] "The alertmanager service is now using systemd's DynamicUser mechanism which obviates a group setting.")
- (mkRemovedOptionModule [ "services" "prometheus" "alertmanagerURL" ] ''
- Due to incompatibility, the alertmanagerURL option has been removed,
- please use 'services.prometheus2.alertmanagers' instead.
- '')
- (mkRenamedOptionModule [ "services" "prometheus2" ] [ "services" "prometheus" ])
- (mkRenamedOptionModule [ "services" "tor" "relay" "portSpec" ] [ "services" "tor" "relay" "port" ])
- (mkRenamedOptionModule [ "services" "vmwareGuest" ] [ "virtualisation" "vmware" "guest" ])
- (mkRenamedOptionModule [ "jobs" ] [ "systemd" "services" ])
+ /*
+ This file defines some renaming/removing options for backwards compatibility
- (mkRenamedOptionModule [ "services" "gitlab" "stateDir" ] [ "services" "gitlab" "statePath" ])
- (mkRemovedOptionModule [ "services" "gitlab" "satelliteDir" ] "")
-
- (mkRenamedOptionModule [ "services" "clamav" "updater" "config" ] [ "services" "clamav" "updater" "extraConfig" ])
-
- (mkRemovedOptionModule [ "security" "setuidOwners" ] "Use security.wrappers instead")
- (mkRemovedOptionModule [ "security" "setuidPrograms" ] "Use security.wrappers instead")
-
- (mkRenamedOptionModule [ "security" "virtualization" "flushL1DataCache" ] [ "security" "virtualisation" "flushL1DataCache" ])
-
- # PAM
- (mkRenamedOptionModule [ "security" "pam" "enableU2F" ] [ "security" "pam" "u2f" "enable" ])
-
- # rmilter/rspamd
- (mkRemovedOptionModule [ "services" "rmilter" ] "Use services.rspamd.* instead to set up milter service")
-
- # Xsession script
- (mkRenamedOptionModule [ "services" "xserver" "displayManager" "job" "logsXsession" ] [ "services" "xserver" "displayManager" "job" "logToFile" ])
- (mkRenamedOptionModule [ "services" "xserver" "displayManager" "logToJournal" ] [ "services" "xserver" "displayManager" "job" "logToJournal" ])
-
- # Old Grub-related options.
- (mkRenamedOptionModule [ "boot" "loader" "grub" "timeout" ] [ "boot" "loader" "timeout" ])
- (mkRenamedOptionModule [ "boot" "loader" "gummiboot" "timeout" ] [ "boot" "loader" "timeout" ])
-
- # OpenSSH
- (mkAliasOptionModule [ "services" "sshd" "enable" ] [ "services" "openssh" "enable" ])
- (mkAliasOptionModule [ "services" "openssh" "knownHosts" ] [ "programs" "ssh" "knownHosts" ])
-
- # libvirtd
- (mkRemovedOptionModule [ "virtualisation" "libvirtd" "enableKVM" ]
- "Set the option `virtualisation.libvirtd.qemuPackage' instead.")
-
- # ibus
- (mkRenamedOptionModule [ "programs" "ibus" "plugins" ] [ "i18n" "inputMethod" "ibus" "engines" ])
-
- # sandboxing
- (mkRenamedOptionModule [ "nix" "useChroot" ] [ "nix" "useSandbox" ])
- (mkRenamedOptionModule [ "nix" "chrootDirs" ] [ "nix" "sandboxPaths" ])
-
- (mkRenamedOptionModule [ "services" "xserver" "vaapiDrivers" ] [ "hardware" "opengl" "extraPackages" ])
+ It should ONLY be used when the relevant module can't define these imports
+ itself, such as when the module was removed completely.
+ See https://github.com/NixOS/nixpkgs/pull/61570 for explanation
+ */
+ # This alias module can't be where _module.check is defined because it would
+ # be added to submodules as well there
(mkAliasOptionModule [ "environment" "checkConfigurationOptions" ] [ "_module" "check" ])
- # opendkim
- (mkRenamedOptionModule [ "services" "opendkim" "keyFile" ] [ "services" "opendkim" "keyPath" ])
-
- # Enlightenment
- (mkRenamedOptionModule [ "services" "xserver" "desktopManager" "e19" "enable" ] [ "services" "xserver" "desktopManager" "enlightenment" "enable" ])
-
- # Iodine
- (mkRenamedOptionModule [ "services" "iodined" "enable" ] [ "services" "iodine" "server" "enable" ])
- (mkRenamedOptionModule [ "services" "iodined" "domain" ] [ "services" "iodine" "server" "domain" ])
- (mkRenamedOptionModule [ "services" "iodined" "ip" ] [ "services" "iodine" "server" "ip" ])
- (mkRenamedOptionModule [ "services" "iodined" "extraConfig" ] [ "services" "iodine" "server" "extraConfig" ])
- (mkRemovedOptionModule [ "services" "iodined" "client" ] "")
-
- # Unity3D
- (mkRenamedOptionModule [ "programs" "unity3d" "enable" ] [ "security" "chromiumSuidSandbox" "enable" ])
-
- # murmur
- (mkRenamedOptionModule [ "services" "murmur" "welcome" ] [ "services" "murmur" "welcometext" ])
- (mkRemovedOptionModule [ "services" "murmur" "pidfile" ] "Hardcoded to /run/murmur/murmurd.pid now")
-
- # parsoid
- (mkRemovedOptionModule [ "services" "parsoid" "interwikis" ] "Use services.parsoid.wikis instead")
-
- # plexpy / tautulli
- (mkRenamedOptionModule [ "services" "plexpy" ] [ "services" "tautulli" ])
-
- # piwik was renamed to matomo
- (mkRenamedOptionModule [ "services" "piwik" "enable" ] [ "services" "matomo" "enable" ])
- (mkRenamedOptionModule [ "services" "piwik" "webServerUser" ] [ "services" "matomo" "webServerUser" ])
- (mkRenamedOptionModule [ "services" "piwik" "phpfpmProcessManagerConfig" ] [ "services" "matomo" "phpfpmProcessManagerConfig" ])
- (mkRenamedOptionModule [ "services" "piwik" "nginx" ] [ "services" "matomo" "nginx" ])
-
- # tarsnap
- (mkRemovedOptionModule [ "services" "tarsnap" "cachedir" ] "Use services.tarsnap.archives..cachedir")
-
- # alsa
- (mkRenamedOptionModule [ "sound" "enableMediaKeys" ] [ "sound" "mediaKeys" "enable" ])
-
- # postgrey
- (mkMergedOptionModule [ [ "services" "postgrey" "inetAddr" ] [ "services" "postgrey" "inetPort" ] ] [ "services" "postgrey" "socket" ] (config: let
- value = p: getAttrFromPath p config;
- inetAddr = [ "services" "postgrey" "inetAddr" ];
- inetPort = [ "services" "postgrey" "inetPort" ];
- in
- if value inetAddr == null
- then { path = "/run/postgrey.sock"; }
- else { addr = value inetAddr; port = value inetPort; }
- ))
-
- # dhcpd
- (mkRenamedOptionModule [ "services" "dhcpd" ] [ "services" "dhcpd4" ])
-
- # locate
- (mkRenamedOptionModule [ "services" "locate" "period" ] [ "services" "locate" "interval" ])
- (mkRemovedOptionModule [ "services" "locate" "includeStore" ] "Use services.locate.prunePaths" )
-
- # nfs
- (mkRenamedOptionModule [ "services" "nfs" "lockdPort" ] [ "services" "nfs" "server" "lockdPort" ])
- (mkRenamedOptionModule [ "services" "nfs" "statdPort" ] [ "services" "nfs" "server" "statdPort" ])
-
- # KDE Plasma 5
- (mkRenamedOptionModule [ "services" "xserver" "desktopManager" "kde5" ] [ "services" "xserver" "desktopManager" "plasma5" ])
-
- # Fontconfig
- (mkRenamedOptionModule [ "fonts" "fontconfig" "ultimate" "allowBitmaps" ] [ "fonts" "fontconfig" "allowBitmaps" ])
- (mkRenamedOptionModule [ "fonts" "fontconfig" "ultimate" "allowType1" ] [ "fonts" "fontconfig" "allowType1" ])
- (mkRenamedOptionModule [ "fonts" "fontconfig" "ultimate" "useEmbeddedBitmaps" ] [ "fonts" "fontconfig" "useEmbeddedBitmaps" ])
- (mkRenamedOptionModule [ "fonts" "fontconfig" "ultimate" "forceAutohint" ] [ "fonts" "fontconfig" "forceAutohint" ])
- (mkRenamedOptionModule [ "fonts" "fontconfig" "ultimate" "renderMonoTTFAsBitmap" ] [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ])
-
- # postgresqlBackup
- (mkRemovedOptionModule [ "services" "postgresqlBackup" "period" ] ''
- A systemd timer is now used instead of cron.
- The starting time can be configured via services.postgresqlBackup.startAt.
- '')
-
- # phpfpm
- (mkRemovedOptionModule [ "services" "phpfpm" "poolConfigs" ] "Use services.phpfpm.pools instead.")
-
- # zabbixServer
- (mkRenamedOptionModule [ "services" "zabbixServer" "dbServer" ] [ "services" "zabbixServer" "database" "host" ])
-
- # Profile splitting
- (mkRenamedOptionModule [ "virtualisation" "growPartition" ] [ "boot" "growPartition" ])
-
- # misc/version.nix
- (mkRenamedOptionModule [ "system" "nixosVersion" ] [ "system" "nixos" "version" ])
- (mkRenamedOptionModule [ "system" "nixosVersionSuffix" ] [ "system" "nixos" "versionSuffix" ])
- (mkRenamedOptionModule [ "system" "nixosRevision" ] [ "system" "nixos" "revision" ])
- (mkRenamedOptionModule [ "system" "nixosLabel" ] [ "system" "nixos" "label" ])
-
- # Users
- (mkAliasOptionModule [ "users" "extraUsers" ] [ "users" "users" ])
- (mkAliasOptionModule [ "users" "extraGroups" ] [ "users" "groups" ])
-
- # Options that are obsolete and have no replacement.
- (mkRemovedOptionModule [ "boot" "initrd" "luks" "enable" ] "")
- (mkRemovedOptionModule [ "programs" "bash" "enable" ] "")
- (mkRemovedOptionModule [ "services" "samba" "defaultShare" ] "")
- (mkRemovedOptionModule [ "services" "syslog-ng" "serviceName" ] "")
- (mkRemovedOptionModule [ "services" "syslog-ng" "listenToJournal" ] "")
- (mkRemovedOptionModule [ "ec2" "metadata" ] "")
- (mkRemovedOptionModule [ "services" "openvpn" "enable" ] "")
- (mkRemovedOptionModule [ "services" "printing" "cupsFilesConf" ] "")
- (mkRemovedOptionModule [ "services" "printing" "cupsdConf" ] "")
- (mkRemovedOptionModule [ "services" "tor" "relay" "isBridge" ] "Use services.tor.relay.role instead.")
- (mkRemovedOptionModule [ "services" "tor" "relay" "isExit" ] "Use services.tor.relay.role instead.")
- (mkRemovedOptionModule [ "services" "xserver" "startGnuPGAgent" ]
- "See the 16.09 release notes for more information.")
- (mkRemovedOptionModule [ "services" "phpfpm" "phpIni" ] "")
- (mkRemovedOptionModule [ "services" "dovecot2" "package" ] "")
+ # Completely removed modules
(mkRemovedOptionModule [ "services" "firefox" "syncserver" "user" ] "")
(mkRemovedOptionModule [ "services" "firefox" "syncserver" "group" ] "")
- (mkRemovedOptionModule [ "fonts" "fontconfig" "hinting" "style" ] "")
- (mkRemovedOptionModule [ "services" "xserver" "displayManager" "sddm" "themes" ]
- "Set the option `services.xserver.displayManager.sddm.package' instead.")
- (mkRemovedOptionModule [ "services" "xserver" "desktopManager" "xfce" "screenLock" ] "")
- (mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
- (mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
- (mkRemovedOptionModule [ "virtualisation" "xen" "qemu" ] "You don't need this option anymore, it will work without it.")
- (mkRemovedOptionModule [ "services" "logstash" "enableWeb" ] "The web interface was removed from logstash")
- (mkRemovedOptionModule [ "boot" "zfs" "enableLegacyCrypto" ] "The corresponding package was removed from nixpkgs.")
(mkRemovedOptionModule [ "services" "winstone" ] "The corresponding package was removed from nixpkgs.")
- (mkRemovedOptionModule [ "services" "mysql" "pidDir" ] "Don't wait for pidfiles, describe dependencies through systemd")
- (mkRemovedOptionModule [ "services" "mysql" "rootPassword" ] "Use socket authentication or set the password outside of the nix store.")
- (mkRemovedOptionModule [ "services" "zabbixServer" "dbPassword" ] "Use services.zabbixServer.database.passwordFile instead.")
- (mkRemovedOptionModule [ "systemd" "generator-packages" ] "Use systemd.packages instead.")
- (mkRemovedOptionModule [ "systemd" "coredump" "enable" ] "Enabled by default. Set boot.kernel.sysctl.\"kernel.core_pattern\" = \"core\"; to disable.")
-
- # ZSH
- (mkRenamedOptionModule [ "programs" "zsh" "enableSyntaxHighlighting" ] [ "programs" "zsh" "syntaxHighlighting" "enable" ])
- (mkRenamedOptionModule [ "programs" "zsh" "syntax-highlighting" "enable" ] [ "programs" "zsh" "syntaxHighlighting" "enable" ])
- (mkRenamedOptionModule [ "programs" "zsh" "syntax-highlighting" "highlighters" ] [ "programs" "zsh" "syntaxHighlighting" "highlighters" ])
- (mkRenamedOptionModule [ "programs" "zsh" "syntax-highlighting" "patterns" ] [ "programs" "zsh" "syntaxHighlighting" "patterns" ])
- (mkRenamedOptionModule [ "programs" "zsh" "oh-my-zsh" "enable" ] [ "programs" "zsh" "ohMyZsh" "enable" ])
- (mkRenamedOptionModule [ "programs" "zsh" "oh-my-zsh" "theme" ] [ "programs" "zsh" "ohMyZsh" "theme" ])
- (mkRenamedOptionModule [ "programs" "zsh" "oh-my-zsh" "custom" ] [ "programs" "zsh" "ohMyZsh" "custom" ])
- (mkRenamedOptionModule [ "programs" "zsh" "oh-my-zsh" "plugins" ] [ "programs" "zsh" "ohMyZsh" "plugins" ])
-
- (mkRenamedOptionModule [ "programs" "zsh" "enableAutosuggestions" ] [ "programs" "zsh" "autosuggestions" "enable" ])
-
- # Xen
- (mkRenamedOptionModule [ "virtualisation" "xen" "qemu-package" ] [ "virtualisation" "xen" "package-qemu" ])
-
- (mkRenamedOptionModule [ "programs" "info" "enable" ] [ "documentation" "info" "enable" ])
- (mkRenamedOptionModule [ "programs" "man" "enable" ] [ "documentation" "man" "enable" ])
- (mkRenamedOptionModule [ "services" "nixosManual" "enable" ] [ "documentation" "nixos" "enable" ])
-
- # ckb
- (mkRenamedOptionModule [ "hardware" "ckb" "enable" ] [ "hardware" "ckb-next" "enable" ])
- (mkRenamedOptionModule [ "hardware" "ckb" "package" ] [ "hardware" "ckb-next" "package" ])
-
- # binfmt
- (mkRenamedOptionModule [ "boot" "binfmtMiscRegistrations" ] [ "boot" "binfmt" "registrations" ])
-
- # ACME
- (mkRemovedOptionModule [ "security" "acme" "directory"] "ACME Directory is now hardcoded to /var/lib/acme and its permisisons are managed by systemd. See https://github.com/NixOS/nixpkgs/issues/53852 for more info.")
- (mkRemovedOptionModule [ "security" "acme" "preDelay"] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")
- (mkRemovedOptionModule [ "security" "acme" "activationDelay"] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")
-
- # KSM
- (mkRenamedOptionModule [ "hardware" "enableKSM" ] [ "hardware" "ksm" "enable" ])
-
- # resolvconf
- (mkRenamedOptionModule [ "networking" "dnsSingleRequest" ] [ "networking" "resolvconf" "dnsSingleRequest" ])
- (mkRenamedOptionModule [ "networking" "dnsExtensionMechanism" ] [ "networking" "resolvconf" "dnsExtensionMechanism" ])
- (mkRenamedOptionModule [ "networking" "extraResolvconfConf" ] [ "networking" "resolvconf" "extraConfig" ])
- (mkRenamedOptionModule [ "networking" "resolvconfOptions" ] [ "networking" "resolvconf" "extraOptions" ])
-
- # Redshift
- (mkChangedOptionModule [ "services" "redshift" "latitude" ] [ "location" "latitude" ]
- (config:
- let value = getAttrFromPath [ "services" "redshift" "latitude" ] config;
- in if value == null then
- throw "services.redshift.latitude is set to null, you can remove this"
- else builtins.fromJSON value))
- (mkChangedOptionModule [ "services" "redshift" "longitude" ] [ "location" "longitude" ]
- (config:
- let value = getAttrFromPath [ "services" "redshift" "longitude" ] config;
- in if value == null then
- throw "services.redshift.longitude is set to null, you can remove this"
- else builtins.fromJSON value))
-
- # Redis
- (mkRemovedOptionModule [ "services" "redis" "user" ] "The redis module now is hardcoded to the redis user.")
- (mkRemovedOptionModule [ "services" "redis" "dbpath" ] "The redis module now uses /var/lib/redis as data directory.")
- (mkRemovedOptionModule [ "services" "redis" "dbFilename" ] "The redis module now uses /var/lib/redis/dump.rdb as database dump location.")
- (mkRemovedOptionModule [ "services" "redis" "appendOnlyFilename" ] "This option was never used.")
- (mkRemovedOptionModule [ "services" "redis" "pidFile" ] "This option was removed.")
-
- ] ++ (forEach [ "blackboxExporter" "collectdExporter" "fritzboxExporter"
- "jsonExporter" "minioExporter" "nginxExporter" "nodeExporter"
- "snmpExporter" "unifiExporter" "varnishExporter" ]
- (opt: mkRemovedOptionModule [ "services" "prometheus" "${opt}" ] ''
- The prometheus exporters are now configured using `services.prometheus.exporters'.
- See the 18.03 release notes for more information.
- '' ));
+ (mkRemovedOptionModule [ "networking" "vpnc" ] "Use environment.etc.\"vpnc/service.conf\" instead.")
+ (mkRemovedOptionModule [ "environment.blcr.enable" ] "The BLCR module has been removed")
+ (mkRemovedOptionModule [ "services.beegfsEnable" ] "The BeeGFS module has been removed")
+ (mkRemovedOptionModule [ "services.beegfs" ] "The BeeGFS module has been removed")
+ (mkRemovedOptionModule [ "services.osquery" ] "The osquery module has been removed")
+ (mkRemovedOptionModule [ "services.fourStore" ] "The fourStore module has been removed")
+ (mkRemovedOptionModule [ "services.fourStoreEndpoint" ] "The fourStoreEndpoint module has been removed")
+
+ # Do NOT add any option renames here, see top of the file
+ ];
}
diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index b321c04e574c49b15362433f8a524e5d1d48eb3a..890c421b0ea9d5fb76b936f5ae93d35a10351400 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -20,6 +20,16 @@ let
'';
};
+ server = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ description = ''
+ ACME Directory Resource URI. Defaults to let's encrypt
+ production endpoint,
+ https://acme-v02.api.letsencrypt.org/directory, if unset.
+ '';
+ };
+
domain = mkOption {
type = types.str;
default = name;
@@ -69,9 +79,9 @@ let
plugins = mkOption {
type = types.listOf (types.enum [
"cert.der" "cert.pem" "chain.pem" "external.sh"
- "fullchain.pem" "full.pem" "key.der" "key.pem" "account_key.json"
+ "fullchain.pem" "full.pem" "key.der" "key.pem" "account_key.json" "account_reg.json"
]);
- default = [ "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
+ default = [ "fullchain.pem" "full.pem" "key.pem" "account_key.json" "account_reg.json" ];
description = ''
Plugins to enable. With default settings simp_le will
store public certificate bundle in fullchain.pem,
@@ -109,7 +119,18 @@ in
{
###### interface
-
+ imports = [
+ (mkRemovedOptionModule [ "security" "acme" "production" ] ''
+ Use security.acme.server to define your staging ACME server URL instead.
+
+ To use the let's encrypt staging server, use security.acme.server =
+ "https://acme-staging-v02.api.letsencrypt.org/directory".
+ ''
+ )
+ (mkRemovedOptionModule [ "security" "acme" "directory"] "ACME Directory is now hardcoded to /var/lib/acme and its permisisons are managed by systemd. See https://github.com/NixOS/nixpkgs/issues/53852 for more info.")
+ (mkRemovedOptionModule [ "security" "acme" "preDelay"] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")
+ (mkRemovedOptionModule [ "security" "acme" "activationDelay"] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")
+ ];
options = {
security.acme = {
@@ -129,6 +150,16 @@ in
'';
};
+ server = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ description = ''
+ ACME Directory Resource URI. Defaults to let's encrypt
+ production endpoint,
+ https://acme-v02.api.letsencrypt.org/directory, if unset.
+ '';
+ };
+
preliminarySelfsigned = mkOption {
type = types.bool;
default = true;
@@ -142,20 +173,6 @@ in
'';
};
- production = mkOption {
- type = types.bool;
- default = true;
- description = ''
- If set to true, use Let's Encrypt's production environment
- instead of the staging environment. The main benefit of the
- staging environment is to get much higher rate limits.
-
- See
- https://letsencrypt.org/docs/staging-environment
- for more detail.
- '';
- };
-
certs = mkOption {
default = { };
type = with types; attrsOf (submodule certOpts);
@@ -198,13 +215,24 @@ in
++ optionals (data.email != null) [ "--email" data.email ]
++ concatMap (p: [ "-f" p ]) data.plugins
++ concatLists (mapAttrsToList (name: root: [ "-d" (if root == null then name else "${name}:${root}")]) data.extraDomains)
- ++ optionals (!cfg.production) ["--server" "https://acme-staging.api.letsencrypt.org/directory"];
+ ++ optionals (cfg.server != null || data.server != null) ["--server" (if data.server == null then cfg.server else data.server)];
acmeService = {
description = "Renew ACME Certificate for ${cert}";
after = [ "network.target" "network-online.target" ];
wants = [ "network-online.target" ];
+ # simp_le uses requests, which uses certifi under the hood,
+ # which doesn't respect the system trust store.
+ # At least in the acme test, we provision a fake CA, impersonating the LE endpoint.
+ # REQUESTS_CA_BUNDLE is a way to teach python requests to use something else
+ environment.REQUESTS_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
serviceConfig = {
Type = "oneshot";
+ # With RemainAfterExit the service is considered active even
+ # after the main process having exited, which means when it
+ # gets changed, the activation phase restarts it, meaning
+ # the permissions of the StateDirectory get adjusted
+ # according to the specified group
+ RemainAfterExit = true;
SuccessExitStatus = [ "0" "1" ];
User = data.user;
Group = data.group;
@@ -213,9 +241,9 @@ in
StateDirectoryMode = rights;
WorkingDirectory = "/var/lib/${lpath}";
ExecStart = "${pkgs.simp_le}/bin/simp_le ${escapeShellArgs cmdline}";
- ExecStopPost =
+ ExecStartPost =
let
- script = pkgs.writeScript "acme-post-stop" ''
+ script = pkgs.writeScript "acme-post-start" ''
#!${pkgs.runtimeShell} -e
${data.postRun}
'';
diff --git a/nixos/modules/security/apparmor-suid.nix b/nixos/modules/security/apparmor-suid.nix
index 498c2f25d1c0d992586cf7b9375941995acf70af..3c93f5440ab5bcf94a1bc7ea0b3b48bb7e25ad60 100644
--- a/nixos/modules/security/apparmor-suid.nix
+++ b/nixos/modules/security/apparmor-suid.nix
@@ -4,6 +4,9 @@ let
in
with lib;
{
+ imports = [
+ (mkRenamedOptionModule [ "security" "virtualization" "flushL1DataCache" ] [ "security" "virtualisation" "flushL1DataCache" ])
+ ];
options.security.apparmor.confineSUIDApplications = mkOption {
default = true;
diff --git a/nixos/modules/security/chromium-suid-sandbox.nix b/nixos/modules/security/chromium-suid-sandbox.nix
index 2255477f26e4cb6a70c3e3bd41b87c3460a1268f..b83dbc4202a8df5901e49166f2ef58369c920294 100644
--- a/nixos/modules/security/chromium-suid-sandbox.nix
+++ b/nixos/modules/security/chromium-suid-sandbox.nix
@@ -7,6 +7,10 @@ let
sandbox = pkgs.chromium.sandbox;
in
{
+ imports = [
+ (mkRenamedOptionModule [ "programs" "unity3d" "enable" ] [ "security" "chromiumSuidSandbox" "enable" ])
+ ];
+
options.security.chromiumSuidSandbox.enable = mkOption {
type = types.bool;
default = false;
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 9c7ddc2f4eea27aaebdd48bce8158ec8a71f41d7..0adc27c47f021922242d8b3fd2c171fc76d04cfe 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -351,7 +351,7 @@ let
${let oath = config.security.pam.oath; in optionalString cfg.oathAuth
"auth requisite ${pkgs.oathToolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits}"}
${let yubi = config.security.pam.yubico; in optionalString cfg.yubicoAuth
- "auth ${yubi.control} ${pkgs.yubico-pam}/lib/security/pam_yubico.so id=${toString yubi.id} ${optionalString yubi.debug "debug"}"}
+ "auth ${yubi.control} ${pkgs.yubico-pam}/lib/security/pam_yubico.so mode=${toString yubi.mode} ${optionalString (yubi.mode == "client") "id=${toString yubi.id}"} ${optionalString yubi.debug "debug"}"}
'' +
# Modules in this block require having the password set in PAM_AUTHTOK.
# pam_unix is marked as 'sufficient' on NixOS which means nothing will run
@@ -415,7 +415,7 @@ let
# Session management.
${optionalString cfg.setEnvironment ''
- session required pam_env.so envfile=${config.system.build.pamEnvironment}
+ session required pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
''}
session required pam_unix.so
${optionalString cfg.setLoginUid
@@ -484,6 +484,10 @@ in
{
+ imports = [
+ (mkRenamedOptionModule [ "security" "pam" "enableU2F" ] [ "security" "pam" "u2f" "enable" ])
+ ];
+
###### interface
options = {
@@ -696,6 +700,23 @@ in
Debug output to stderr.
'';
};
+ mode = mkOption {
+ default = "client";
+ type = types.enum [ "client" "challenge-response" ];
+ description = ''
+ Mode of operation.
+
+ Use "client" for online validation with a YubiKey validation service such as
+ the YubiCloud.
+
+ Use "challenge-response" for offline validation using YubiKeys with HMAC-SHA-1
+ Challenge-Response configurations. See the man-page ykpamcfg(1) for further
+ details on how to configure offline Challenge-Response validation.
+
+ More information can be found here.
+ '';
+ };
};
security.pam.enableEcryptfs = mkOption {
@@ -742,13 +763,6 @@ in
environment.etc =
mapAttrsToList (n: v: makePAMService v) config.security.pam.services;
- systemd.tmpfiles.rules = optionals
- (any (s: s.updateWtmp) (attrValues config.security.pam.services))
- [
- "f /var/log/wtmp"
- "f /var/log/lastlog"
- ];
-
security.pam.services =
{ other.text =
''
diff --git a/nixos/modules/security/pam_mount.nix b/nixos/modules/security/pam_mount.nix
index 8b131c54a2a5e29e8c99ac738f901813d2ac7af9..75f58462d13d32fba2762afe9bd2e312dd202673 100644
--- a/nixos/modules/security/pam_mount.nix
+++ b/nixos/modules/security/pam_mount.nix
@@ -50,9 +50,6 @@ in
- ${concatStrings (map userVolumeEntry (attrValues extraUserVolumes))}
- ${concatStringsSep "\n" cfg.extraVolumes}
-
@@ -64,6 +61,9 @@ in
${pkgs.pam_mount}/bin/mount.crypt %(VOLUME) %(MNTPT)${pkgs.pam_mount}/bin/umount.crypt %(MNTPT)${pkgs.pam_mount}/bin/pmvarrun -u %(USER) -o %(OPERATION)
+
+ ${concatStrings (map userVolumeEntry (attrValues extraUserVolumes))}
+ ${concatStringsSep "\n" cfg.extraVolumes}
'';
}];
diff --git a/nixos/modules/security/polkit.nix b/nixos/modules/security/polkit.nix
index f2b2df4004cb863195299851f6b63f76418af187..a6724bd758327bc3df4b3c4183b37013d1ca3b3c 100644
--- a/nixos/modules/security/polkit.nix
+++ b/nixos/modules/security/polkit.nix
@@ -42,15 +42,14 @@ in
security.polkit.adminIdentities = mkOption {
type = types.listOf types.str;
- default = [ "unix-user:0" "unix-group:wheel" ];
+ default = [ "unix-group:wheel" ];
example = [ "unix-user:alice" "unix-group:admin" ];
description =
''
Specifies which users are considered “administrators”, for those
actions that require the user to authenticate as an
administrator (i.e. have an auth_admin
- value). By default, this is the root
- user and all users in the wheel group.
+ value). By default, this is all users in the wheel group.
'';
};
diff --git a/nixos/modules/security/wrappers/default.nix b/nixos/modules/security/wrappers/default.nix
index 47738e7962ea66bcc8c61e0e28f20f95bf5858bc..a0fadb018ecaa14531f2083bdceb3bd473201bcc 100644
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@@ -94,6 +94,10 @@ let
) programs;
in
{
+ imports = [
+ (lib.mkRemovedOptionModule [ "security" "setuidOwners" ] "Use security.wrappers instead")
+ (lib.mkRemovedOptionModule [ "security" "setuidPrograms" ] "Use security.wrappers instead")
+ ];
###### interface
diff --git a/nixos/modules/services/admin/oxidized.nix b/nixos/modules/services/admin/oxidized.nix
index 39112c3970d5a055b0674282639c34040ee5c376..885eaed1de6f372882b0f05f8269b6d164c9f676 100644
--- a/nixos/modules/services/admin/oxidized.nix
+++ b/nixos/modules/services/admin/oxidized.nix
@@ -89,6 +89,7 @@ in
group = cfg.group;
home = cfg.dataDir;
createHome = true;
+ isSystemUser = true;
};
systemd.services.oxidized = {
@@ -110,6 +111,7 @@ in
Restart = "always";
WorkingDirectory = cfg.dataDir;
KillSignal = "SIGKILL";
+ PIDFile = "${cfg.dataDir}.config/oxidized/pid";
};
};
};
diff --git a/nixos/modules/services/amqp/rabbitmq.nix b/nixos/modules/services/amqp/rabbitmq.nix
index 302b94de1965cdfff13a46c6f35e37b14632752f..697732426ccfbefc2a02198fff8d6be96de843df 100644
--- a/nixos/modules/services/amqp/rabbitmq.nix
+++ b/nixos/modules/services/amqp/rabbitmq.nix
@@ -80,7 +80,7 @@ in {
configItems = mkOption {
default = {};
type = types.attrsOf types.str;
- example = ''
+ example = literalExample ''
{
"auth_backends.1.authn" = "rabbit_auth_backend_ldap";
"auth_backends.1.authz" = "rabbit_auth_backend_internal";
diff --git a/nixos/modules/services/audio/alsa.nix b/nixos/modules/services/audio/alsa.nix
index f632644af09ef4655dcd903f762347eb3d6ccaf1..990398e65463c8517197791619587852ab25a028 100644
--- a/nixos/modules/services/audio/alsa.nix
+++ b/nixos/modules/services/audio/alsa.nix
@@ -12,6 +12,9 @@ let
in
{
+ imports = [
+ (mkRenamedOptionModule [ "sound" "enableMediaKeys" ] [ "sound" "mediaKeys" "enable" ])
+ ];
###### interface
diff --git a/nixos/modules/services/audio/jack.nix b/nixos/modules/services/audio/jack.nix
index aa3351f401afb0b336a74b8058f32b5e05bbcfdd..ceff366d0bbb2d91b5a842e07506cf51416af33f 100644
--- a/nixos/modules/services/audio/jack.nix
+++ b/nixos/modules/services/audio/jack.nix
@@ -223,6 +223,7 @@ in {
group = "jackaudio";
extraGroups = [ "audio" ];
description = "JACK Audio system service user";
+ isSystemUser = true;
};
# http://jackaudio.org/faq/linux_rt_config.html
security.pam.loginLimits = [
diff --git a/nixos/modules/services/audio/mpd.nix b/nixos/modules/services/audio/mpd.nix
index 0df8f9688d2540683536f10892b73f83f07622f2..7932d094197b7672b048786b08342fa1dcfb7496 100644
--- a/nixos/modules/services/audio/mpd.nix
+++ b/nixos/modules/services/audio/mpd.nix
@@ -18,7 +18,6 @@ let
''}
state_file "${cfg.dataDir}/state"
sticker_file "${cfg.dataDir}/sticker.sql"
- log_file "syslog"
user "${cfg.user}"
group "${cfg.group}"
@@ -181,6 +180,7 @@ in {
ProtectKernelModules = true;
RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX AF_NETLINK";
RestrictNamespaces = true;
+ Restart = "always";
};
};
diff --git a/nixos/modules/services/audio/roon-server.nix b/nixos/modules/services/audio/roon-server.nix
index 4eda3c5708da78e40da4d63088d0d34ed13ced90..6aed485638ccf9721ce9f8ed9f3ef5b1ec403ad9 100644
--- a/nixos/modules/services/audio/roon-server.nix
+++ b/nixos/modules/services/audio/roon-server.nix
@@ -66,7 +66,8 @@ in {
if cfg.user == "roon-server" then {
isSystemUser = true;
description = "Roon Server user";
- groups = [ cfg.group "audio" ];
+ group = cfg.group;
+ extraGroups = [ "audio" ];
}
else {};
};
diff --git a/nixos/modules/services/audio/spotifyd.nix b/nixos/modules/services/audio/spotifyd.nix
index e3556b2559c28605b1373f6f85fb5022abe3db45..4b74e753279551fd6612f729505a00e0c9ddfe7c 100644
--- a/nixos/modules/services/audio/spotifyd.nix
+++ b/nixos/modules/services/audio/spotifyd.nix
@@ -28,7 +28,7 @@ in
after = [ "network-online.target" "sound.target" ];
description = "spotifyd, a Spotify playing daemon";
serviceConfig = {
- ExecStart = "${pkgs.spotifyd}/bin/spotifyd --no-daemon --cache_path /var/cache/spotifyd --config ${spotifydConf}";
+ ExecStart = "${pkgs.spotifyd}/bin/spotifyd --no-daemon --cache-path /var/cache/spotifyd --config-path ${spotifydConf}";
Restart = "always";
RestartSec = 12;
DynamicUser = true;
diff --git a/nixos/modules/services/backup/automysqlbackup.nix b/nixos/modules/services/backup/automysqlbackup.nix
index 1884f3536a97bb89398f444e532235919e1639ca..e3a8d1f79934b7e847719e1be6b6f38b5b8d83ad 100644
--- a/nixos/modules/services/backup/automysqlbackup.nix
+++ b/nixos/modules/services/backup/automysqlbackup.nix
@@ -99,7 +99,10 @@ in
environment.systemPackages = [ pkg ];
- users.users.${user}.group = group;
+ users.users.${user} = {
+ group = group;
+ isSystemUser = true;
+ };
users.groups.${group} = { };
systemd.tmpfiles.rules = [
diff --git a/nixos/modules/services/backup/bacula.nix b/nixos/modules/services/backup/bacula.nix
index 41bda7893a757b23672339d36327211a3783e2a5..cef304734aeeeccf34ab7659572f80c16dcced59 100644
--- a/nixos/modules/services/backup/bacula.nix
+++ b/nixos/modules/services/backup/bacula.nix
@@ -44,7 +44,17 @@ let
Pid Directory = "/run";
${sd_cfg.extraStorageConfig}
}
-
+
+ ${concatStringsSep "\n" (mapAttrsToList (name: value: ''
+ Autochanger {
+ Name = "${name}";
+ Device = ${concatStringsSep ", " (map (a: "\"${a}\"") value.devices)};
+ Changer Device = "${value.changerDevice}";
+ Changer Command = "${value.changerCommand}";
+ ${value.extraAutochangerConfig}
+ }
+ '') sd_cfg.autochanger)}
+
${concatStringsSep "\n" (mapAttrsToList (name: value: ''
Device {
Name = "${name}";
@@ -103,7 +113,19 @@ let
password = mkOption {
# TODO: required?
description = ''
- Specifies the password that must be supplied for a Director to b
+ Specifies the password that must be supplied for the default Bacula
+ Console to be authorized. The same password must appear in the
+ Director resource of the Console configuration file. For added
+ security, the password is never passed across the network but instead
+ a challenge response hash code created with the password. This
+ directive is required. If you have either /dev/random or bc on your
+ machine, Bacula will generate a random password during the
+ configuration process, otherwise it will be left blank and you must
+ manually supply it.
+
+ The password is plain text. It is not generated through any special
+ process but as noted above, it is better to use random text for
+ security reasons.
'';
};
@@ -111,26 +133,133 @@ let
default = "no";
example = "yes";
description = ''
- If Monitor is set to no (default), this director will have full
+ If Monitor is set to no, this director will have
+ full access to this Storage daemon. If Monitor is set to
+ yes, this director will only be able to fetch the
+ current status of this Storage daemon.
+
+ Please note that if this director is being used by a Monitor, we
+ highly recommend to set this directive to yes to avoid serious
+ security problems.
+ '';
+ };
+ };
+ };
+
+ autochangerOptions = {...}:
+ {
+ options = {
+ changerDevice = mkOption {
+ description = ''
+ The specified name-string must be the generic SCSI device name of the
+ autochanger that corresponds to the normal read/write Archive Device
+ specified in the Device resource. This generic SCSI device name
+ should be specified if you have an autochanger or if you have a
+ standard tape drive and want to use the Alert Command (see below).
+ For example, on Linux systems, for an Archive Device name of
+ /dev/nst0, you would specify
+ /dev/sg0 for the Changer Device name. Depending
+ on your exact configuration, and the number of autochangers or the
+ type of autochanger, what you specify here can vary. This directive
+ is optional. See the Using AutochangersAutochangersChapter chapter of
+ this manual for more details of using this and the following
+ autochanger directives.
+ '';
+ };
+
+ changerCommand = mkOption {
+ description = ''
+ The name-string specifies an external program to be called that will
+ automatically change volumes as required by Bacula. Normally, this
+ directive will be specified only in the AutoChanger resource, which
+ is then used for all devices. However, you may also specify the
+ different Changer Command in each Device resource. Most frequently,
+ you will specify the Bacula supplied mtx-changer script as follows:
+
+ "/path/mtx-changer %c %o %S %a %d"
+
+ and you will install the mtx on your system (found in the depkgs
+ release). An example of this command is in the default bacula-sd.conf
+ file. For more details on the substitution characters that may be
+ specified to configure your autochanger please see the
+ AutochangersAutochangersChapter chapter of this manual. For FreeBSD
+ users, you might want to see one of the several chio scripts in
+ examples/autochangers.
+ '';
+ default = "/etc/bacula/mtx-changer %c %o %S %a %d";
+ };
+
+ devices = mkOption {
+ description = ''
+ '';
+ };
+
+ extraAutochangerConfig = mkOption {
+ default = "";
+ description = ''
+ Extra configuration to be passed in Autochanger directive.
+ '';
+ example = ''
+
'';
};
};
};
+
deviceOptions = {...}:
{
options = {
archiveDevice = mkOption {
# TODO: required?
description = ''
- The specified name-string gives the system file name of the storage device managed by this storage daemon. This will usually be the device file name of a removable storage device (tape drive), for example " /dev/nst0" or "/dev/rmt/0mbn". For a DVD-writer, it will be for example /dev/hdc. It may also be a directory name if you are archiving to disk storage.
+ The specified name-string gives the system file name of the storage
+ device managed by this storage daemon. This will usually be the
+ device file name of a removable storage device (tape drive), for
+ example /dev/nst0 or
+ /dev/rmt/0mbn. For a DVD-writer, it will be for
+ example /dev/hdc. It may also be a directory name
+ if you are archiving to disk storage. In this case, you must supply
+ the full absolute path to the directory. When specifying a tape
+ device, it is preferable that the "non-rewind" variant of the device
+ file name be given.
'';
};
mediaType = mkOption {
# TODO: required?
description = ''
- The specified name-string names the type of media supported by this device, for example, "DLT7000". Media type names are arbitrary in that you set them to anything you want, but they must be known to the volume database to keep track of which storage daemons can read which volumes. In general, each different storage type should have a unique Media Type associated with it. The same name-string must appear in the appropriate Storage resource definition in the Director's configuration file.
+ The specified name-string names the type of media supported by this
+ device, for example, DLT7000. Media type names are
+ arbitrary in that you set them to anything you want, but they must be
+ known to the volume database to keep track of which storage daemons
+ can read which volumes. In general, each different storage type
+ should have a unique Media Type associated with it. The same
+ name-string must appear in the appropriate Storage resource
+ definition in the Director's configuration file.
+
+ Even though the names you assign are arbitrary (i.e. you choose the
+ name you want), you should take care in specifying them because the
+ Media Type is used to determine which storage device Bacula will
+ select during restore. Thus you should probably use the same Media
+ Type specification for all drives where the Media can be freely
+ interchanged. This is not generally an issue if you have a single
+ Storage daemon, but it is with multiple Storage daemons, especially
+ if they have incompatible media.
+
+ For example, if you specify a Media Type of DDS-4
+ then during the restore, Bacula will be able to choose any Storage
+ Daemon that handles DDS-4. If you have an
+ autochanger, you might want to name the Media Type in a way that is
+ unique to the autochanger, unless you wish to possibly use the
+ Volumes in other drives. You should also ensure to have unique Media
+ Type names if the Media is not compatible between drives. This
+ specification is required for all devices.
+
+ In addition, if you are using disk storage, each Device resource will
+ generally have a different mount point or directory. In order for
+ Bacula to select the correct Device resource, each one must have a
+ unique Media Type.
'';
};
@@ -166,8 +295,8 @@ in {
default = "${config.networking.hostName}-fd";
description = ''
The client name that must be used by the Director when connecting.
- Generally, it is a good idea to use a name related to the machine
- so that error messages can be easily identified if you have multiple
+ Generally, it is a good idea to use a name related to the machine so
+ that error messages can be easily identified if you have multiple
Clients. This directive is required.
'';
};
@@ -232,7 +361,8 @@ in {
default = 9103;
type = types.int;
description = ''
- Specifies port number on which the Storage daemon listens for Director connections. The default is 9103.
+ Specifies port number on which the Storage daemon listens for
+ Director connections.
'';
};
@@ -251,7 +381,15 @@ in {
'';
type = with types; attrsOf (submodule deviceOptions);
};
-
+
+ autochanger = mkOption {
+ default = {};
+ description = ''
+ This option defines Autochanger resources in Bacula Storage Daemon.
+ '';
+ type = with types; attrsOf (submodule autochangerOptions);
+ };
+
extraStorageConfig = mkOption {
default = "";
description = ''
@@ -287,7 +425,8 @@ in {
name = mkOption {
default = "${config.networking.hostName}-dir";
description = ''
- The director name used by the system administrator. This directive is required.
+ The director name used by the system administrator. This directive is
+ required.
'';
};
@@ -295,7 +434,12 @@ in {
default = 9101;
type = types.int;
description = ''
- Specify the port (a positive integer) on which the Director daemon will listen for Bacula Console connections. This same port number must be specified in the Director resource of the Console configuration file. The default is 9101, so normally this directive need not be specified. This directive should not be used if you specify DirAddresses (N.B plural) directive.
+ Specify the port (a positive integer) on which the Director daemon
+ will listen for Bacula Console connections. This same port number
+ must be specified in the Director resource of the Console
+ configuration file. The default is 9101, so normally this directive
+ need not be specified. This directive should not be used if you
+ specify DirAddresses (N.B plural) directive.
'';
};
diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix
index 2ad116a7872ade8234b6993e82d6d6255b0ec3f0..a2eb80c55a8c9cc6a40f3b678ff4a923ccae9607 100644
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@@ -8,7 +8,7 @@ let
builtins.substring 0 1 x == "/" # absolute path
|| builtins.substring 0 1 x == "." # relative path
|| builtins.match "[.*:.*]" == null; # not machine:path
-
+
mkExcludeFile = cfg:
# Write each exclude pattern to a new line
pkgs.writeText "excludefile" (concatStringsSep "\n" cfg.exclude);
@@ -68,7 +68,7 @@ let
{ BORG_PASSPHRASE = passphrase; }
else { };
- mkBackupService = name: cfg:
+ mkBackupService = name: cfg:
let
userHome = config.users.users.${cfg.user}.home;
in nameValuePair "borgbackup-job-${name}" {
@@ -98,18 +98,35 @@ let
inherit (cfg) startAt;
};
+ # utility function around makeWrapper
+ mkWrapperDrv = {
+ original, name, set ? {}
+ }:
+ pkgs.runCommandNoCC "${name}-wrapper" {
+ buildInputs = [ pkgs.makeWrapper ];
+ } (with lib; ''
+ makeWrapper "${original}" "$out/bin/${name}" \
+ ${concatStringsSep " \\\n " (mapAttrsToList (name: value: ''--set ${name} "${value}"'') set)}
+ '');
+
+ mkBorgWrapper = name: cfg: mkWrapperDrv {
+ original = "${pkgs.borgbackup}/bin/borg";
+ name = "borg-job-${name}";
+ set = { BORG_REPO = cfg.repo; } // (mkPassEnv cfg) // cfg.environment;
+ };
+
# Paths listed in ReadWritePaths must exist before service is started
mkActivationScript = name: cfg:
let
install = "install -o ${cfg.user} -g ${cfg.group}";
in
nameValuePair "borgbackup-job-${name}" (stringAfter [ "users" ] (''
- # Eensure that the home directory already exists
+ # Ensure that the home directory already exists
# We can't assert createHome == true because that's not the case for root
- cd "${config.users.users.${cfg.user}.home}"
+ cd "${config.users.users.${cfg.user}.home}"
${install} -d .config/borg
${install} -d .cache/borg
- '' + optionalString (isLocalPath cfg.repo) ''
+ '' + optionalString (isLocalPath cfg.repo && !cfg.removableDevice) ''
${install} -d ${escapeShellArg cfg.repo}
''));
@@ -163,13 +180,24 @@ let
+ " without at least one public key";
};
+ mkRemovableDeviceAssertions = name: cfg: {
+ assertion = !(isLocalPath cfg.repo) -> !cfg.removableDevice;
+ message = ''
+ borgbackup.repos.${name}: repo isn't a local path, thus it can't be a removable device!
+ '';
+ };
+
in {
meta.maintainers = with maintainers; [ dotlambda ];
###### interface
options.services.borgbackup.jobs = mkOption {
- description = "Deduplicating backups using BorgBackup.";
+ description = ''
+ Deduplicating backups using BorgBackup.
+ Adding a job will cause a borg-job-NAME wrapper to be added
+ to your system path, so that you can perform maintenance easily.
+ '';
default = { };
example = literalExample ''
{
@@ -202,6 +230,12 @@ in {
example = "user@machine:/path/to/repo";
};
+ removableDevice = mkOption {
+ type = types.bool;
+ default = false;
+ description = "Whether the repo (which must be local) is a removable device.";
+ };
+
archiveBaseName = mkOption {
type = types.strMatching "[^/{}]+";
default = "${globalConfig.networking.hostName}-${name}";
@@ -511,7 +545,6 @@ in {
type = types.attrsOf (types.submodule (
{ ... }: {
options = {
-
path = mkOption {
type = types.path;
description = ''
@@ -598,7 +631,8 @@ in {
(with config.services.borgbackup; {
assertions =
mapAttrsToList mkPassAssertion jobs
- ++ mapAttrsToList mkKeysAssertion repos;
+ ++ mapAttrsToList mkKeysAssertion repos
+ ++ mapAttrsToList mkRemovableDeviceAssertions jobs;
system.activationScripts = mapAttrs' mkActivationScript jobs;
@@ -610,6 +644,6 @@ in {
users = mkMerge (mapAttrsToList mkUsersConfig repos);
- environment.systemPackages = with pkgs; [ borgbackup ];
+ environment.systemPackages = with pkgs; [ borgbackup ] ++ (mapAttrsToList mkBorgWrapper jobs);
});
}
diff --git a/nixos/modules/services/backup/postgresql-backup.nix b/nixos/modules/services/backup/postgresql-backup.nix
index 13a36ae32ac0ef82dc1a7e17ca0020cb819a8808..580c7ce68f1dbcd95cb61549fb3aa10d3e1e0190 100644
--- a/nixos/modules/services/backup/postgresql-backup.nix
+++ b/nixos/modules/services/backup/postgresql-backup.nix
@@ -35,6 +35,13 @@ let
in {
+ imports = [
+ (mkRemovedOptionModule [ "services" "postgresqlBackup" "period" ] ''
+ A systemd timer is now used instead of cron.
+ The starting time can be configured via services.postgresqlBackup.startAt.
+ '')
+ ];
+
options = {
services.postgresqlBackup = {
enable = mkOption {
@@ -82,7 +89,7 @@ in {
pgdumpOptions = mkOption {
type = types.separatedString " ";
- default = "-Cbo";
+ default = "-C";
description = ''
Command line options for pg_dump. This options is not used
if config.services.postgresqlBackup.backupAll is enabled.
diff --git a/nixos/modules/services/backup/postgresql-wal-receiver.nix b/nixos/modules/services/backup/postgresql-wal-receiver.nix
index d9a37037992e1fa7cc9733581477fdcda7f48885..3d9869d534313761cec61a01dbf088d16363245a 100644
--- a/nixos/modules/services/backup/postgresql-wal-receiver.nix
+++ b/nixos/modules/services/backup/postgresql-wal-receiver.nix
@@ -169,13 +169,14 @@ in {
systemd.services = with attrsets; mapAttrs' (name: config: nameValuePair "postgresql-wal-receiver-${name}" {
description = "PostgreSQL WAL receiver (${name})";
wantedBy = [ "multi-user.target" ];
+ startLimitIntervalSec = 0; # retry forever, useful in case of network disruption
serviceConfig = {
User = "postgres";
Group = "postgres";
KillSignal = "SIGINT";
Restart = "always";
- RestartSec = 30;
+ RestartSec = 60;
};
inherit (config) environment;
diff --git a/nixos/modules/services/backup/tarsnap.nix b/nixos/modules/services/backup/tarsnap.nix
index 4fc7c24813a55b27777a6c1b6bc45f752bf3996b..6d99a1efb61380b7b549088ecc6ea1b38709e0aa 100644
--- a/nixos/modules/services/backup/tarsnap.nix
+++ b/nixos/modules/services/backup/tarsnap.nix
@@ -23,6 +23,10 @@ let
'';
in
{
+ imports = [
+ (mkRemovedOptionModule [ "services" "tarsnap" "cachedir" ] "Use services.tarsnap.archives..cachedir")
+ ];
+
options = {
services.tarsnap = {
enable = mkOption {
diff --git a/nixos/modules/services/backup/znapzend.nix b/nixos/modules/services/backup/znapzend.nix
index f317078ddda22ae3127165163df4eef13c6fe491..203631a577f0d3078a5665b041bd8772e2bb8559 100644
--- a/nixos/modules/services/backup/znapzend.nix
+++ b/nixos/modules/services/backup/znapzend.nix
@@ -34,6 +34,8 @@ let
description = "string of the form number{b|k|M|G}";
};
+ enabledFeatures = concatLists (mapAttrsToList (name: enabled: optional enabled name) cfg.features);
+
# Type for a string that must contain certain other strings (the list parameter).
# Note that these would need regex escaping.
stringContainingStrings = list: let
@@ -354,6 +356,22 @@ in
'';
default = false;
};
+
+ features.recvu = mkEnableOption ''
+ recvu feature which uses -u on the receiving end to keep the destination
+ filesystem unmounted.
+ '';
+ features.compressed = mkEnableOption ''
+ compressed feature which adds the options -Lce to
+ the zfs send command. When this is enabled, make
+ sure that both the sending and receiving pool have the same relevant
+ features enabled. Using -c will skip unneccessary
+ decompress-compress stages, -L is for large block
+ support and -e is for embedded data support. see
+ znapzend1
+ and zfs8
+ for more info.
+ '';
};
};
@@ -381,12 +399,22 @@ in
'';
serviceConfig = {
+ # znapzendzetup --import apparently tries to connect to the backup
+ # host 3 times with a timeout of 30 seconds, leading to a startup
+ # delay of >90s when the host is down, which is just above the default
+ # service timeout of 90 seconds. Increase the timeout so it doesn't
+ # make the service fail in that case.
+ TimeoutStartSec = 180;
+ # Needs to have write access to ZFS
+ User = "root";
ExecStart = let
args = concatStringsSep " " [
"--logto=${cfg.logTo}"
"--loglevel=${cfg.logLevel}"
(optionalString cfg.noDestroy "--nodestroy")
(optionalString cfg.autoCreation "--autoCreation")
+ (optionalString (enabledFeatures != [])
+ "--features=${concatStringsSep "," enabledFeatures}")
]; in "${pkgs.znapzend}/bin/znapzend ${args}";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
Restart = "on-failure";
diff --git a/nixos/modules/services/cluster/kubernetes/addons/dashboard.nix b/nixos/modules/services/cluster/kubernetes/addons/dashboard.nix
index 70f96d75a4619b8bc092783ccd5004675a1da366..2ed7742eda09bb4139e1e8a23d721f7622b2d8d5 100644
--- a/nixos/modules/services/cluster/kubernetes/addons/dashboard.nix
+++ b/nixos/modules/services/cluster/kubernetes/addons/dashboard.nix
@@ -5,6 +5,10 @@ with lib;
let
cfg = config.services.kubernetes.addons.dashboard;
in {
+ imports = [
+ (mkRenamedOptionModule [ "services" "kubernetes" "addons" "dashboard" "enableRBAC" ] [ "services" "kubernetes" "addons" "dashboard" "rbac" "enable" ])
+ ];
+
options.services.kubernetes.addons.dashboard = {
enable = mkEnableOption "kubernetes dashboard addon";
diff --git a/nixos/modules/services/cluster/kubernetes/addons/dns.nix b/nixos/modules/services/cluster/kubernetes/addons/dns.nix
index 47e588de3c9337becd214dc763ae90cc2d61ac9b..f12e866930dabf2ca45338fd358ae3399f84f820 100644
--- a/nixos/modules/services/cluster/kubernetes/addons/dns.nix
+++ b/nixos/modules/services/cluster/kubernetes/addons/dns.nix
@@ -3,7 +3,7 @@
with lib;
let
- version = "1.5.0";
+ version = "1.6.4";
cfg = config.services.kubernetes.addons.dns;
ports = {
dns = 10053;
@@ -55,9 +55,9 @@ in {
type = types.attrs;
default = {
imageName = "coredns/coredns";
- imageDigest = "sha256:e83beb5e43f8513fa735e77ffc5859640baea30a882a11cc75c4c3244a737d3c";
+ imageDigest = "sha256:493ee88e1a92abebac67cbd4b5658b4730e0f33512461442d8d9214ea6734a9b";
finalImageTag = version;
- sha256 = "15sbmhrxjxidj0j0cccn1qxpg6al175w43m6ngspl0mc132zqc9q";
+ sha256 = "0fm9zdjavpf5hni8g7fkdd3csjbhd7n7py7llxjc66sbii087028";
};
};
};
@@ -68,7 +68,7 @@ in {
services.kubernetes.addonManager.bootstrapAddons = {
coredns-cr = {
- apiVersion = "rbac.authorization.k8s.io/v1beta1";
+ apiVersion = "rbac.authorization.k8s.io/v1";
kind = "ClusterRole";
metadata = {
labels = {
@@ -94,7 +94,7 @@ in {
};
coredns-crb = {
- apiVersion = "rbac.authorization.k8s.io/v1beta1";
+ apiVersion = "rbac.authorization.k8s.io/v1";
kind = "ClusterRoleBinding";
metadata = {
annotations = {
@@ -170,7 +170,7 @@ in {
};
coredns-deploy = {
- apiVersion = "extensions/v1beta1";
+ apiVersion = "apps/v1";
kind = "Deployment";
metadata = {
labels = {
diff --git a/nixos/modules/services/cluster/kubernetes/apiserver.nix b/nixos/modules/services/cluster/kubernetes/apiserver.nix
index 33796bf2e0806e7418d8dcd779a7dc6b8016e6ca..95bdb4c0d14e442d8da0fe819aa521907181332a 100644
--- a/nixos/modules/services/cluster/kubernetes/apiserver.nix
+++ b/nixos/modules/services/cluster/kubernetes/apiserver.nix
@@ -13,6 +13,18 @@ let
)) + ".1");
in
{
+
+ imports = [
+ (mkRenamedOptionModule [ "services" "kubernetes" "apiserver" "admissionControl" ] [ "services" "kubernetes" "apiserver" "enableAdmissionPlugins" ])
+ (mkRenamedOptionModule [ "services" "kubernetes" "apiserver" "address" ] ["services" "kubernetes" "apiserver" "bindAddress"])
+ (mkRenamedOptionModule [ "services" "kubernetes" "apiserver" "port" ] ["services" "kubernetes" "apiserver" "insecurePort"])
+ (mkRemovedOptionModule [ "services" "kubernetes" "apiserver" "publicAddress" ] "")
+ (mkRenamedOptionModule [ "services" "kubernetes" "etcd" "servers" ] [ "services" "kubernetes" "apiserver" "etcd" "servers" ])
+ (mkRenamedOptionModule [ "services" "kubernetes" "etcd" "keyFile" ] [ "services" "kubernetes" "apiserver" "etcd" "keyFile" ])
+ (mkRenamedOptionModule [ "services" "kubernetes" "etcd" "certFile" ] [ "services" "kubernetes" "apiserver" "etcd" "certFile" ])
+ (mkRenamedOptionModule [ "services" "kubernetes" "etcd" "caFile" ] [ "services" "kubernetes" "apiserver" "etcd" "caFile" ])
+ ];
+
###### interface
options.services.kubernetes.apiserver = with lib.types; {
diff --git a/nixos/modules/services/cluster/kubernetes/controller-manager.nix b/nixos/modules/services/cluster/kubernetes/controller-manager.nix
index 0b73d090f241721b0fa90f6b22f5c132f6d37a07..a99ef6640e974f8b8dac968b8ee92c9e93c595c3 100644
--- a/nixos/modules/services/cluster/kubernetes/controller-manager.nix
+++ b/nixos/modules/services/cluster/kubernetes/controller-manager.nix
@@ -7,6 +7,11 @@ let
cfg = top.controllerManager;
in
{
+ imports = [
+ (mkRenamedOptionModule [ "services" "kubernetes" "controllerManager" "address" ] ["services" "kubernetes" "controllerManager" "bindAddress"])
+ (mkRenamedOptionModule [ "services" "kubernetes" "controllerManager" "port" ] ["services" "kubernetes" "controllerManager" "insecurePort"])
+ ];
+
###### interface
options.services.kubernetes.controllerManager = with lib.types; {
diff --git a/nixos/modules/services/cluster/kubernetes/default.nix b/nixos/modules/services/cluster/kubernetes/default.nix
index 3790ac9b6918f8e0a064f37e137f30fea92794db..3605d0365094c0d5251a87aa83221e01eabeb12b 100644
--- a/nixos/modules/services/cluster/kubernetes/default.nix
+++ b/nixos/modules/services/cluster/kubernetes/default.nix
@@ -74,6 +74,10 @@ let
};
in {
+ imports = [
+ (mkRemovedOptionModule [ "services" "kubernetes" "verbose" ] "")
+ ];
+
###### interface
options.services.kubernetes = {
diff --git a/nixos/modules/services/cluster/kubernetes/flannel.nix b/nixos/modules/services/cluster/kubernetes/flannel.nix
index d799e638fc94a932d19959332ad15c56477238a4..548ffed1ddb5884e8bbbaf214b28d69e4ce0b82c 100644
--- a/nixos/modules/services/cluster/kubernetes/flannel.nix
+++ b/nixos/modules/services/cluster/kubernetes/flannel.nix
@@ -40,6 +40,7 @@ in
cni.config = mkDefault [{
name = "mynet";
type = "flannel";
+ cniVersion = "0.3.1";
delegate = {
isDefaultGateway = true;
bridge = "docker0";
diff --git a/nixos/modules/services/cluster/kubernetes/kubelet.nix b/nixos/modules/services/cluster/kubernetes/kubelet.nix
index 250da4c807ec04cd0be4f81b7aa7c1714756361d..c3d67552cc8c3719f919d0af544a89aae23c3063 100644
--- a/nixos/modules/services/cluster/kubernetes/kubelet.nix
+++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix
@@ -52,6 +52,12 @@ let
taints = concatMapStringsSep "," (v: "${v.key}=${v.value}:${v.effect}") (mapAttrsToList (n: v: v) cfg.taints);
in
{
+ imports = [
+ (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "applyManifests" ] "")
+ (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "cadvisorPort" ] "")
+ (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "allowPrivileged" ] "")
+ ];
+
###### interface
options.services.kubernetes.kubelet = with lib.types; {
@@ -92,7 +98,7 @@ in
default = [];
example = literalExample ''
[{
- "cniVersion": "0.2.0",
+ "cniVersion": "0.3.1",
"name": "mynet",
"type": "bridge",
"bridge": "cni0",
@@ -106,7 +112,7 @@ in
]
}
} {
- "cniVersion": "0.2.0",
+ "cniVersion": "0.3.1",
"type": "loopback"
}]
'';
diff --git a/nixos/modules/services/cluster/kubernetes/proxy.nix b/nixos/modules/services/cluster/kubernetes/proxy.nix
index bd4bf04ea833a9d211d13503c37b18bc1eaadcde..86d1dc2439bd965775d3a46bcfa0e2563f4ba1d2 100644
--- a/nixos/modules/services/cluster/kubernetes/proxy.nix
+++ b/nixos/modules/services/cluster/kubernetes/proxy.nix
@@ -7,6 +7,9 @@ let
cfg = top.proxy;
in
{
+ imports = [
+ (mkRenamedOptionModule [ "services" "kubernetes" "proxy" "address" ] ["services" "kubernetes" "proxy" "bindAddress"])
+ ];
###### interface
options.services.kubernetes.proxy = with lib.types; {
@@ -31,6 +34,12 @@ in
type = listOf str;
};
+ hostname = mkOption {
+ description = "Kubernetes proxy hostname override.";
+ default = config.networking.hostName;
+ type = str;
+ };
+
kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes proxy";
verbosity = mkOption {
@@ -59,6 +68,7 @@ in
"--cluster-cidr=${top.clusterCidr}"} \
${optionalString (cfg.featureGates != [])
"--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
+ --hostname-override=${cfg.hostname} \
--kubeconfig=${top.lib.mkKubeConfig "kube-proxy" cfg.kubeconfig} \
${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
${cfg.extraOpts}
@@ -69,6 +79,8 @@ in
};
};
+ services.kubernetes.proxy.hostname = with config.networking; mkDefault hostName;
+
services.kubernetes.pki.certs = {
kubeProxyClient = top.lib.mkCert {
name = "kube-proxy-client";
diff --git a/nixos/modules/services/computing/slurm/slurm.nix b/nixos/modules/services/computing/slurm/slurm.nix
index d1a1383e45b0b840ee81bafc63ccd792364ba886..c70d999ca96d9cb152ec014be190c113aec5227e 100644
--- a/nixos/modules/services/computing/slurm/slurm.nix
+++ b/nixos/modules/services/computing/slurm/slurm.nix
@@ -18,7 +18,7 @@ let
${optionalString (cfg.controlAddr != null) ''controlAddr=${cfg.controlAddr}''}
${toString (map (x: "NodeName=${x}\n") cfg.nodeName)}
${toString (map (x: "PartitionName=${x}\n") cfg.partitionName)}
- PlugStackConfig=${plugStackConfig}
+ PlugStackConfig=${plugStackConfig}/plugstack.conf
ProctrackType=${cfg.procTrackType}
${cfg.extraConfig}
'';
@@ -39,6 +39,8 @@ let
DbdHost=${cfg.dbdserver.dbdHost}
SlurmUser=${cfg.user}
StorageType=accounting_storage/mysql
+ StorageUser=${cfg.dbdserver.storageUser}
+ ${optionalString (cfg.dbdserver.storagePass != null) "StoragePass=${cfg.dbdserver.storagePass}"}
${cfg.dbdserver.extraConfig}
'';
@@ -48,7 +50,6 @@ let
name = "etc-slurm";
paths = [ configFile cgroupConfig plugStackConfig ] ++ cfg.extraConfigPaths;
};
-
in
{
@@ -86,6 +87,37 @@ in
'';
};
+ storageUser = mkOption {
+ type = types.str;
+ default = cfg.user;
+ description = ''
+ Database user name.
+ '';
+ };
+
+ storagePass = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ description = ''
+ Database password. Note that this password will be publicable
+ readable in the nix store. Use
+ to store the and config file and password outside the nix store.
+ '';
+ };
+
+ configFile = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ description = ''
+ Path to slurmdbd.conf. The password for the database connection
+ is stored in the config file. Use this option to specfify a path
+ outside the nix store. If this option is unset a configuration file
+ will be generated. See also:
+ slurmdbd.conf
+ 8.
+ '';
+ };
+
extraConfig = mkOption {
type = types.lines;
default = "";
@@ -112,7 +144,7 @@ in
package = mkOption {
type = types.package;
- default = pkgs.slurm;
+ default = pkgs.slurm.override { enableX11 = ! cfg.enableSrunX11; };
defaultText = "pkgs.slurm";
example = literalExample "pkgs.slurm-full";
description = ''
@@ -178,9 +210,14 @@ in
If enabled srun will accept the option "--x11" to allow for X11 forwarding
from within an interactive session or a batch job. This activates the
slurm-spank-x11 module. Note that this option also enables
- 'services.openssh.forwardX11' on the client.
+ on the client.
This option requires slurm to be compiled without native X11 support.
+ The default behavior is to re-compile the slurm package with native X11
+ support disabled if this option is set to true.
+
+ To use the native X11 support add PrologFlags=X11 in .
+ Note that this method will only work RSA SSH host keys.
'';
};
@@ -356,7 +393,11 @@ in
requires = [ "munged.service" "mysql.service" ];
# slurm strips the last component off the path
- environment.SLURM_CONF = "${slurmdbdConf}/slurm.conf";
+ environment.SLURM_CONF =
+ if (cfg.dbdserver.configFile == null) then
+ "${slurmdbdConf}/slurm.conf"
+ else
+ cfg.dbdserver.configFile;
serviceConfig = {
Type = "forking";
diff --git a/nixos/modules/services/continuous-integration/buildkite-agent.nix b/nixos/modules/services/continuous-integration/buildkite-agent.nix
index 12cc3d2b1ccced89fef110f844c93fbfd68e871c..32f361454bc18434845a5c70398cc7a5402b6bf9 100644
--- a/nixos/modules/services/continuous-integration/buildkite-agent.nix
+++ b/nixos/modules/services/continuous-integration/buildkite-agent.nix
@@ -191,6 +191,7 @@ in
createHome = true;
description = "Buildkite agent user";
extraGroups = [ "keys" ];
+ isSystemUser = true;
};
environment.systemPackages = [ cfg.package ];
diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix
index 500acb48562030fa0991081cf322e66a9a420a0a..30c5550f71c5a99ee8195b2cc93f69653696258e 100644
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -242,8 +242,8 @@ in
environment.variables = hydraEnv;
nix.extraOptions = ''
- gc-keep-outputs = true
- gc-keep-derivations = true
+ keep-outputs = true
+ keep-derivations = true
# The default (`true') slows Nix down a lot since the build farm
# has so many GC roots.
@@ -275,6 +275,7 @@ in
${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createdb -O hydra hydra
touch ${baseDir}/.db-created
fi
+ echo "create extension if not exists pg_trgm" | ${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} -- ${config.services.postgresql.package}/bin/psql hydra
''}
if [ ! -e ${cfg.gcRootsDir} ]; then
@@ -379,6 +380,23 @@ in
};
};
+ systemd.services.hydra-notify =
+ { wantedBy = [ "multi-user.target" ];
+ requires = [ "hydra-init.service" ];
+ after = [ "hydra-init.service" ];
+ restartTriggers = [ hydraConf ];
+ environment = env // {
+ PGPASSFILE = "${baseDir}/pgpass-queue-runner";
+ };
+ serviceConfig =
+ { ExecStart = "@${cfg.package}/bin/hydra-notify hydra-notify";
+ # FIXME: run this under a less privileged user?
+ User = "hydra-queue-runner";
+ Restart = "always";
+ RestartSec = 5;
+ };
+ };
+
# If there is less than a certain amount of free disk space, stop
# the queue/evaluator to prevent builds from failing or aborting.
systemd.services.hydra-check-space =
@@ -416,6 +434,8 @@ in
hydra-users hydra-queue-runner hydra
hydra-users hydra-www hydra
hydra-users root hydra
+ # The postgres user is used to create the pg_trgm extension for the hydra database
+ hydra-users postgres postgres
'';
services.postgresql.authentication = optionalString haveLocalDB
diff --git a/nixos/modules/services/continuous-integration/jenkins/default.nix b/nixos/modules/services/continuous-integration/jenkins/default.nix
index ec6a36413fe7b3afa7ed13e271b25f47668c5c10..0ec906713885d12d1496506135fb85ec757f4761 100644
--- a/nixos/modules/services/continuous-integration/jenkins/default.nix
+++ b/nixos/modules/services/continuous-integration/jenkins/default.nix
@@ -193,7 +193,7 @@ in {
then ""
else
let pluginCmds = lib.attrsets.mapAttrsToList
- (n: v: "cp ${v} ${cfg.home}/plugins/${n}.hpi")
+ (n: v: "cp ${v} ${cfg.home}/plugins/${n}.jpi")
cfg.plugins;
in ''
rm -r ${cfg.home}/plugins || true
diff --git a/nixos/modules/services/databases/4store-endpoint.nix b/nixos/modules/services/databases/4store-endpoint.nix
deleted file mode 100644
index 59ed0e5f0afdf8b37c0b1f00a09e720436dd4ed5..0000000000000000000000000000000000000000
--- a/nixos/modules/services/databases/4store-endpoint.nix
+++ /dev/null
@@ -1,74 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
- cfg = config.services.fourStoreEndpoint;
- endpointUser = "fourstorehttp";
- run = "${pkgs.su}/bin/su -s ${pkgs.runtimeShell} ${endpointUser} -c";
-in
-with lib;
-{
-
- ###### interface
-
- options = {
-
- services.fourStoreEndpoint = {
-
- enable = mkOption {
- default = false;
- description = "Whether to enable 4Store SPARQL endpoint.";
- };
-
- database = mkOption {
- default = config.services.fourStore.database;
- description = "RDF database name to expose via the endpoint. Defaults to local 4Store database name.";
- };
-
- listenAddress = mkOption {
- default = null;
- description = "IP address to listen on.";
- };
-
- port = mkOption {
- default = 8080;
- description = "port to listen on.";
- };
-
- options = mkOption {
- default = "";
- description = "Extra CLI options to pass to 4Store's 4s-httpd process.";
- };
-
- };
-
- };
-
-
- ###### implementation
-
- config = mkIf cfg.enable {
-
- assertions = singleton
- { assertion = cfg.enable -> cfg.database != "";
- message = "Must specify 4Store database name";
- };
-
- users.users = singleton
- { name = endpointUser;
- uid = config.ids.uids.fourstorehttp;
- description = "4Store SPARQL endpoint user";
- };
-
- services.avahi.enable = true;
-
- systemd.services."4store-endpoint" = {
- after = [ "network.target" ];
- wantedBy = [ "multi-user.target" ];
-
- script = ''
- ${run} '${pkgs.rdf4store}/bin/4s-httpd -D ${cfg.options} ${if cfg.listenAddress!=null then "-H ${cfg.listenAddress}" else "" } -p ${toString cfg.port} ${cfg.database}'
- '';
- };
-
- };
-
-}
diff --git a/nixos/modules/services/databases/4store.nix b/nixos/modules/services/databases/4store.nix
deleted file mode 100644
index be4351c1c38f457631221a157b397554508fad81..0000000000000000000000000000000000000000
--- a/nixos/modules/services/databases/4store.nix
+++ /dev/null
@@ -1,72 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
- cfg = config.services.fourStore;
- stateDir = "/var/lib/4store";
- fourStoreUser = "fourstore";
- run = "${pkgs.su}/bin/su -s ${pkgs.runtimeShell} ${fourStoreUser}";
-in
-with lib;
-{
-
- ###### interface
-
- options = {
-
- services.fourStore = {
-
- enable = mkOption {
- default = false;
- description = "Whether to enable 4Store RDF database server.";
- };
-
- database = mkOption {
- default = "";
- description = "RDF database name. If it doesn't exist, it will be created. Databases are stored in ${stateDir}.";
- };
-
- options = mkOption {
- default = "";
- description = "Extra CLI options to pass to 4Store.";
- };
-
- };
-
- };
-
-
- ###### implementation
-
- config = mkIf cfg.enable {
-
- assertions = singleton
- { assertion = cfg.enable -> cfg.database != "";
- message = "Must specify 4Store database name.";
- };
-
- users.users = singleton
- { name = fourStoreUser;
- uid = config.ids.uids.fourstore;
- description = "4Store database user";
- home = stateDir;
- };
-
- services.avahi.enable = true;
-
- systemd.services."4store" = {
- after = [ "network.target" ];
- wantedBy = [ "multi-user.target" ];
-
- preStart = ''
- mkdir -p ${stateDir}/
- chown ${fourStoreUser} ${stateDir}
- if ! test -e "${stateDir}/${cfg.database}"; then
- ${run} -c '${pkgs.rdf4store}/bin/4s-backend-setup ${cfg.database}'
- fi
- '';
-
- script = ''
- ${run} -c '${pkgs.rdf4store}/bin/4s-backend -D ${cfg.options} ${cfg.database}'
- '';
- };
- };
-}
diff --git a/nixos/modules/services/databases/memcached.nix b/nixos/modules/services/databases/memcached.nix
index 84d2c8674f4ebf35eae53e7b00f09ec73210339f..d1dfdb41bf402fdcf5b33f51723ca3a62b40791a 100644
--- a/nixos/modules/services/databases/memcached.nix
+++ b/nixos/modules/services/databases/memcached.nix
@@ -67,6 +67,7 @@ in
users.users = optional (cfg.user == "memcached") {
name = "memcached";
description = "Memcached server user";
+ isSystemUser = true;
};
environment.systemPackages = [ memcached ];
diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index 9f7727bb89f91cd75030e644513e6e6f3657eeb5..6af32700fc77bfeb97effdb7ea422a2701b3d8b6 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -24,6 +24,10 @@ let
in
{
+ imports = [
+ (mkRemovedOptionModule [ "services" "mysql" "pidDir" ] "Don't wait for pidfiles, describe dependencies through systemd")
+ (mkRemovedOptionModule [ "services" "mysql" "rootPassword" ] "Use socket authentication or set the password outside of the nix store.")
+ ];
###### interface
@@ -268,8 +272,13 @@ in
port = ${toString cfg.port}
datadir = ${cfg.dataDir}
${optionalString (cfg.bind != null) "bind-address = ${cfg.bind}" }
- ${optionalString (cfg.replication.role == "master" || cfg.replication.role == "slave") "log-bin=mysql-bin"}
- ${optionalString (cfg.replication.role == "master" || cfg.replication.role == "slave") "server-id = ${toString cfg.replication.serverId}"}
+ ${optionalString (cfg.replication.role == "master" || cfg.replication.role == "slave")
+ ''
+ log-bin=mysql-bin-${toString cfg.replication.serverId}
+ log-bin-index=mysql-bin-${toString cfg.replication.serverId}.index
+ relay-log=mysql-relay-bin
+ server-id = ${toString cfg.replication.serverId}
+ ''}
${optionalString (cfg.ensureUsers != [])
''
plugin-load-add = auth_socket.so
@@ -377,6 +386,7 @@ in
( echo "stop slave;"
echo "change master to master_host='${cfg.replication.masterHost}', master_user='${cfg.replication.masterUser}', master_password='${cfg.replication.masterPassword}';"
+ echo "set global slave_exec_mode='IDEMPOTENT';"
echo "start slave;"
) | ${mysql}/bin/mysql -u root -N
''}
diff --git a/nixos/modules/services/databases/neo4j.nix b/nixos/modules/services/databases/neo4j.nix
index 5533182c31168f4b7948ba5eff5e079351a53c77..29a83300ec10aed439c8fecf77a97553488f2195 100644
--- a/nixos/modules/services/databases/neo4j.nix
+++ b/nixos/modules/services/databases/neo4j.nix
@@ -103,6 +103,18 @@ let
in {
+ imports = [
+ (mkRenamedOptionModule [ "services" "neo4j" "host" ] [ "services" "neo4j" "defaultListenAddress" ])
+ (mkRenamedOptionModule [ "services" "neo4j" "listenAddress" ] [ "services" "neo4j" "defaultListenAddress" ])
+ (mkRenamedOptionModule [ "services" "neo4j" "enableBolt" ] [ "services" "neo4j" "bolt" "enable" ])
+ (mkRenamedOptionModule [ "services" "neo4j" "enableHttps" ] [ "services" "neo4j" "https" "enable" ])
+ (mkRenamedOptionModule [ "services" "neo4j" "certDir" ] [ "services" "neo4j" "directories" "certificates" ])
+ (mkRenamedOptionModule [ "services" "neo4j" "dataDir" ] [ "services" "neo4j" "directories" "home" ])
+ (mkRemovedOptionModule [ "services" "neo4j" "port" ] "Use services.neo4j.http.listenAddress instead.")
+ (mkRemovedOptionModule [ "services" "neo4j" "boltPort" ] "Use services.neo4j.bolt.listenAddress instead.")
+ (mkRemovedOptionModule [ "services" "neo4j" "httpsPort" ] "Use services.neo4j.https.listenAddress instead.")
+ ];
+
###### interface
options.services.neo4j = {
diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
index 7bba4dacddcca73e952570958aa96bfea1505c8f..c8fdd89d0d8fb4852180d2f92e4ece21849a2673 100644
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@@ -226,7 +226,8 @@ in
# Note: when changing the default, make it conditional on
# ‘system.stateVersion’ to maintain compatibility with existing
# systems!
- mkDefault (if versionAtLeast config.system.stateVersion "17.09" then pkgs.postgresql_9_6
+ mkDefault (if versionAtLeast config.system.stateVersion "20.03" then pkgs.postgresql_11
+ else if versionAtLeast config.system.stateVersion "17.09" then pkgs.postgresql_9_6
else if versionAtLeast config.system.stateVersion "16.03" then pkgs.postgresql_9_5
else throw "postgresql_9_4 was removed, please upgrade your postgresql version.");
@@ -338,9 +339,9 @@ in
'') cfg.ensureDatabases}
'' + ''
${concatMapStrings (user: ''
- $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || $PSQL -tAc "CREATE USER ${user.name}"
+ $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || $PSQL -tAc 'CREATE USER "${user.name}"'
${concatStringsSep "\n" (mapAttrsToList (database: permission: ''
- $PSQL -tAc 'GRANT ${permission} ON ${database} TO ${user.name}'
+ $PSQL -tAc 'GRANT ${permission} ON ${database} TO "${user.name}"'
'') user.ensurePermissions)}
'') cfg.ensureUsers}
'';
diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
index 9c389d80a6dfef109929335a526e108f672dab41..70895fa53e455ec1073a0c4953875994171eb04a 100644
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@@ -32,6 +32,13 @@ let
'';
in
{
+ imports = [
+ (mkRemovedOptionModule [ "services" "redis" "user" ] "The redis module now is hardcoded to the redis user.")
+ (mkRemovedOptionModule [ "services" "redis" "dbpath" ] "The redis module now uses /var/lib/redis as data directory.")
+ (mkRemovedOptionModule [ "services" "redis" "dbFilename" ] "The redis module now uses /var/lib/redis/dump.rdb as database dump location.")
+ (mkRemovedOptionModule [ "services" "redis" "appendOnlyFilename" ] "This option was never used.")
+ (mkRemovedOptionModule [ "services" "redis" "pidFile" ] "This option was removed.")
+ ];
###### interface
@@ -185,27 +192,22 @@ in
###### implementation
config = mkIf config.services.redis.enable {
-
- boot.kernel.sysctl = mkIf cfg.vmOverCommit {
- "vm.overcommit_memory" = "1";
- };
+ boot.kernel.sysctl = (mkMerge [
+ { "vm.nr_hugepages" = "0"; }
+ ( mkIf cfg.vmOverCommit { "vm.overcommit_memory" = "1"; } )
+ ]);
networking.firewall = mkIf cfg.openFirewall {
allowedTCPPorts = [ cfg.port ];
};
- users.users.redis.description = "Redis database user";
+ users.users.redis = {
+ description = "Redis database user";
+ isSystemUser = true;
+ };
environment.systemPackages = [ cfg.package ];
- systemd.services.disable-transparent-huge-pages = {
- description = "Disable Transparent Huge Pages (required by Redis)";
- before = [ "redis.service" ];
- wantedBy = [ "redis.service" ];
- script = "echo never > /sys/kernel/mm/transparent_hugepage/enabled";
- serviceConfig.Type = "oneshot";
- };
-
systemd.services.redis =
{ description = "Redis Server";
diff --git a/nixos/modules/services/databases/rethinkdb.nix b/nixos/modules/services/databases/rethinkdb.nix
index 4828e594b3283200f9dae1c8e2d30b1ce0d5dc57..f18fbaf5b062a1d1dd1ffec706928d101190af85 100644
--- a/nixos/modules/services/databases/rethinkdb.nix
+++ b/nixos/modules/services/databases/rethinkdb.nix
@@ -99,6 +99,7 @@ in
users.users.rethinkdb = mkIf (cfg.user == "rethinkdb")
{ name = "rethinkdb";
description = "RethinkDB server user";
+ isSystemUser = true;
};
users.groups = optionalAttrs (cfg.group == "rethinkdb") (singleton
diff --git a/nixos/modules/services/desktops/geoclue2.nix b/nixos/modules/services/desktops/geoclue2.nix
index 6007dddf50c0c31310a268ddc96b0d25cc2ea2a2..542b2ead410407b65759f5ae629fe728b9cff9ed 100644
--- a/nixos/modules/services/desktops/geoclue2.nix
+++ b/nixos/modules/services/desktops/geoclue2.nix
@@ -188,34 +188,41 @@ in
systemd.packages = [ package ];
- users.users.geoclue = {
- isSystemUser = true;
- home = "/var/lib/geoclue";
- group = "geoclue";
- description = "Geoinformation service";
- };
-
- users.groups.geoclue = {};
+ # we cannot use DynamicUser as we need the the geoclue user to exist for the dbus policy to work
+ users = {
+ users.geoclue = {
+ isSystemUser = true;
+ home = "/var/lib/geoclue";
+ group = "geoclue";
+ description = "Geoinformation service";
+ };
- systemd.tmpfiles.rules = [
- "d /var/lib/geoclue 0755 geoclue geoclue"
- ];
+ groups.geoclue = {};
+ };
- # restart geoclue service when the configuration changes
- systemd.services.geoclue.restartTriggers = [
- config.environment.etc."geoclue/geoclue.conf".source
- ];
+ systemd.services.geoclue = {
+ # restart geoclue service when the configuration changes
+ restartTriggers = [
+ config.environment.etc."geoclue/geoclue.conf".source
+ ];
+ serviceConfig.StateDirectory = "geoclue";
+ };
# this needs to run as a user service, since it's associated with the
# user who is making the requests
systemd.user.services = mkIf cfg.enableDemoAgent {
geoclue-agent = {
description = "Geoclue agent";
- script = "${package}/libexec/geoclue-2.0/demos/agent";
# this should really be `partOf = [ "geoclue.service" ]`, but
# we can't be part of a system service, and the agent should
# be okay with the main service coming and going
wantedBy = [ "default.target" ];
+ serviceConfig = {
+ Type = "exec";
+ ExecStart = "${package}/libexec/geoclue-2.0/demos/agent";
+ Restart = "on-failure";
+ PrivateTmp = true;
+ };
};
};
@@ -256,4 +263,6 @@ in
};
} // mapAttrs' appConfigToINICompatible cfg.appConfig);
};
+
+ meta.maintainers = with lib.maintainers; [ worldofpeace ];
}
diff --git a/nixos/modules/services/desktops/gnome3/gnome-initial-setup.nix b/nixos/modules/services/desktops/gnome3/gnome-initial-setup.nix
new file mode 100644
index 0000000000000000000000000000000000000000..d715d52c2d067807dafc2537b395f6b88300f380
--- /dev/null
+++ b/nixos/modules/services/desktops/gnome3/gnome-initial-setup.nix
@@ -0,0 +1,86 @@
+# GNOME Initial Setup.
+
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+
+ # GNOME initial setup's run is conditioned on whether
+ # the gnome-initial-setup-done file exists in XDG_CONFIG_HOME
+ # Because of this, every existing user will have initial setup
+ # running because they never ran it before.
+ #
+ # To prevent this we create the file if the users stateVersion
+ # is older than 20.03 (the release we added this module).
+
+ script = pkgs.writeScript "create-gis-stamp-files" ''
+ #!${pkgs.runtimeShell}
+ setup_done=$HOME/.config/gnome-initial-setup-done
+
+ echo "Creating g-i-s stamp file $setup_done ..."
+ cat - > $setup_done <<- EOF
+ yes
+ EOF
+ '';
+
+ createGisStampFilesAutostart = pkgs.writeTextFile rec {
+ name = "create-g-i-s-stamp-files";
+ destination = "/etc/xdg/autostart/${name}.desktop";
+ text = ''
+ [Desktop Entry]
+ Type=Application
+ Name=Create GNOME Initial Setup stamp files
+ Exec=${script}
+ StartupNotify=false
+ NoDisplay=true
+ OnlyShowIn=GNOME;
+ AutostartCondition=unless-exists gnome-initial-setup-done
+ X-GNOME-Autostart-Phase=EarlyInitialization
+ '';
+ };
+
+in
+
+{
+
+ ###### interface
+
+ options = {
+
+ services.gnome3.gnome-initial-setup = {
+
+ enable = mkEnableOption "GNOME Initial Setup, a Simple, easy, and safe way to prepare a new system";
+
+ };
+
+ };
+
+
+ ###### implementation
+
+ config = mkIf config.services.gnome3.gnome-initial-setup.enable {
+
+ environment.systemPackages = [
+ pkgs.gnome3.gnome-initial-setup
+ ]
+ ++ optional (versionOlder config.system.stateVersion "20.03") createGisStampFilesAutostart
+ ;
+
+ systemd.packages = [
+ pkgs.gnome3.gnome-initial-setup
+ ];
+
+ systemd.user.targets."gnome-session".wants = [
+ "gnome-initial-setup-copy-worker.service"
+ "gnome-initial-setup-first-login.service"
+ "gnome-welcome-tour.service"
+ ];
+
+ systemd.user.targets."gnome-session@gnome-initial-setup".wants = [
+ "gnome-initial-setup.service"
+ ];
+
+ };
+
+}
diff --git a/nixos/modules/services/desktops/gnome3/gnome-settings-daemon.nix b/nixos/modules/services/desktops/gnome3/gnome-settings-daemon.nix
index 7f7adcf26acf4af41d142103349269aa80baaab7..2f83fd653bdee97cd329af445df6308d8f7b22fc 100644
--- a/nixos/modules/services/desktops/gnome3/gnome-settings-daemon.nix
+++ b/nixos/modules/services/desktops/gnome3/gnome-settings-daemon.nix
@@ -12,6 +12,12 @@ in
{
+ imports = [
+ (mkRemovedOptionModule
+ ["services" "gnome3" "gnome-settings-daemon" "package"]
+ "")
+ ];
+
###### interface
options = {
@@ -20,13 +26,6 @@ in
enable = mkEnableOption "GNOME Settings Daemon";
- # There are many forks of gnome-settings-daemon
- package = mkOption {
- type = types.package;
- default = pkgs.gnome3.gnome-settings-daemon;
- description = "Which gnome-settings-daemon package to use.";
- };
-
};
};
@@ -36,9 +35,39 @@ in
config = mkIf cfg.enable {
- environment.systemPackages = [ cfg.package ];
-
- services.udev.packages = [ cfg.package ];
+ environment.systemPackages = [
+ pkgs.gnome3.gnome-settings-daemon
+ ];
+
+ services.udev.packages = [
+ pkgs.gnome3.gnome-settings-daemon
+ ];
+
+ systemd.packages = [
+ pkgs.gnome3.gnome-settings-daemon
+ ];
+
+ systemd.user.targets."gnome-session-initialized".wants = [
+ "gsd-color.target"
+ "gsd-datetime.target"
+ "gsd-keyboard.target"
+ "gsd-media-keys.target"
+ "gsd-print-notifications.target"
+ "gsd-rfkill.target"
+ "gsd-screensaver-proxy.target"
+ "gsd-sharing.target"
+ "gsd-smartcard.target"
+ "gsd-sound.target"
+ "gsd-wacom.target"
+ "gsd-wwan.target"
+ "gsd-a11y-settings.target"
+ "gsd-housekeeping.target"
+ "gsd-power.target"
+ ];
+
+ systemd.user.targets."gnome-session-x11-services".wants = [
+ "gsd-xsettings.target"
+ ];
};
diff --git a/nixos/modules/services/desktops/neard.nix b/nixos/modules/services/desktops/neard.nix
new file mode 100644
index 0000000000000000000000000000000000000000..9b0f8d1b3a77460207c0fb816b3fbec34b839b4f
--- /dev/null
+++ b/nixos/modules/services/desktops/neard.nix
@@ -0,0 +1,23 @@
+# neard service.
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+ ###### interface
+ options = {
+ services.neard = {
+ enable = mkEnableOption "neard, NFC daemon";
+ };
+ };
+
+
+ ###### implementation
+ config = mkIf config.services.neard.enable {
+ environment.systemPackages = [ pkgs.neard ];
+
+ services.dbus.packages = [ pkgs.neard ];
+
+ systemd.packages = [ pkgs.neard ];
+ };
+}
diff --git a/nixos/modules/services/desktops/pantheon/contractor.nix b/nixos/modules/services/desktops/pantheon/contractor.nix
index 2638a21df73363e4815585584bbbe08787eaeb7a..c76145191a70414ac028ce8db16376726f196d5a 100644
--- a/nixos/modules/services/desktops/pantheon/contractor.nix
+++ b/nixos/modules/services/desktops/pantheon/contractor.nix
@@ -6,35 +6,12 @@ with lib;
{
- meta.maintainers = pkgs.pantheon.maintainers;
-
- ###### interface
-
- options = {
-
- services.pantheon.contractor = {
-
- enable = mkEnableOption "contractor, a desktop-wide extension service used by pantheon";
-
- };
-
- };
-
###### implementation
config = mkIf config.services.pantheon.contractor.enable {
- environment.systemPackages = with pkgs.pantheon; [
- contractor
- extra-elementary-contracts
- ];
-
- services.dbus.packages = [ pkgs.pantheon.contractor ];
-
- environment.pathsToLink = [
- "/share/contractor"
- ];
+
};
diff --git a/nixos/modules/services/desktops/pantheon/files.nix b/nixos/modules/services/desktops/pantheon/files.nix
index 577aad6c29872918246746b84595fad8c1a15a34..8cee9f42b62ff63cfdbfbd8b14022ab72faf37a2 100644
--- a/nixos/modules/services/desktops/pantheon/files.nix
+++ b/nixos/modules/services/desktops/pantheon/files.nix
@@ -6,33 +6,8 @@ with lib;
{
- meta.maintainers = pkgs.pantheon.maintainers;
-
- ###### interface
-
- options = {
-
- services.pantheon.files = {
-
- enable = mkEnableOption "pantheon files daemon";
-
- };
-
- };
-
-
- ###### implementation
-
- config = mkIf config.services.pantheon.files.enable {
-
- environment.systemPackages = [
- pkgs.pantheon.elementary-files
- ];
-
- services.dbus.packages = [
- pkgs.pantheon.elementary-files
- ];
-
- };
+ imports = [
+ (mkRemovedOptionModule [ "services" "pantheon" "files" "enable" ] "Use `environment.systemPackages [ pkgs.pantheon.elementary-files ];`")
+ ];
}
diff --git a/nixos/modules/services/desktops/system-config-printer.nix b/nixos/modules/services/desktops/system-config-printer.nix
index 8a80be266b20888158054709f00b7637a49320fb..09c68c587b43d40903021f28486547a31524a27b 100644
--- a/nixos/modules/services/desktops/system-config-printer.nix
+++ b/nixos/modules/services/desktops/system-config-printer.nix
@@ -33,6 +33,9 @@ with lib;
pkgs.system-config-printer
];
+ # for $out/bin/install-printer-driver
+ services.packagekit.enable = true;
+
};
}
diff --git a/nixos/modules/services/desktops/tumbler.nix b/nixos/modules/services/desktops/tumbler.nix
index d18088d4634b817f3c07c0c2768a3b9e916c3906..a833e99ff8c6837a6a0f35d4f68bbd21e47e6a71 100644
--- a/nixos/modules/services/desktops/tumbler.nix
+++ b/nixos/modules/services/desktops/tumbler.nix
@@ -7,12 +7,17 @@ with lib;
let
cfg = config.services.tumbler;
- tumbler = cfg.package;
in
{
+ imports = [
+ (mkRemovedOptionModule
+ [ "services" "tumbler" "package" ]
+ "")
+ ];
+
###### interface
options = {
@@ -21,13 +26,6 @@ in
enable = mkEnableOption "Tumbler, A D-Bus thumbnailer service";
- package = mkOption {
- type = types.package;
- default = pkgs.xfce4-14.tumbler;
- description = "Which tumbler package to use";
- example = pkgs.xfce4-12.tumbler;
- };
-
};
};
@@ -37,11 +35,11 @@ in
config = mkIf cfg.enable {
- environment.systemPackages = [
+ environment.systemPackages = with pkgs.xfce; [
tumbler
];
- services.dbus.packages = [
+ services.dbus.packages = with pkgs.xfce; [
tumbler
];
diff --git a/nixos/modules/services/development/lorri.nix b/nixos/modules/services/development/lorri.nix
new file mode 100644
index 0000000000000000000000000000000000000000..c843aa56d133ced9df7688111fe54c968bbc43ad
--- /dev/null
+++ b/nixos/modules/services/development/lorri.nix
@@ -0,0 +1,47 @@
+{ config, lib, pkgs, ... }:
+
+let
+ cfg = config.services.lorri;
+ socketPath = "lorri/daemon.socket";
+in {
+ options = {
+ services.lorri = {
+ enable = lib.mkOption {
+ default = false;
+ type = lib.types.bool;
+ description = ''
+ Enables the daemon for `lorri`, a nix-shell replacement for project
+ development. The socket-activated daemon starts on the first request
+ issued by the `lorri` command.
+ '';
+ };
+ };
+ };
+
+ config = lib.mkIf cfg.enable {
+ systemd.user.sockets.lorri = {
+ description = "Socket for Lorri Daemon";
+ wantedBy = [ "sockets.target" ];
+ socketConfig = {
+ ListenStream = "%t/${socketPath}";
+ RuntimeDirectory = "lorri";
+ };
+ };
+
+ systemd.user.services.lorri = {
+ description = "Lorri Daemon";
+ requires = [ "lorri.socket" ];
+ after = [ "lorri.socket" ];
+ path = with pkgs; [ config.nix.package git gnutar gzip ];
+ serviceConfig = {
+ ExecStart = "${pkgs.lorri}/bin/lorri daemon";
+ PrivateTmp = true;
+ ProtectSystem = "strict";
+ ProtectHome = "read-only";
+ Restart = "on-failure";
+ };
+ };
+
+ environment.systemPackages = [ pkgs.lorri ];
+ };
+}
diff --git a/nixos/modules/services/editors/emacs.nix b/nixos/modules/services/editors/emacs.nix
index ba7ec967919e7f553ac6af31be24130862977c8d..d791b387665fcf08b8927bda96055535ddbbd00c 100644
--- a/nixos/modules/services/editors/emacs.nix
+++ b/nixos/modules/services/editors/emacs.nix
@@ -95,13 +95,7 @@ in {
environment.systemPackages = [ cfg.package editorScript desktopApplicationFile ];
- environment.variables = {
- # This is required so that GTK applications launched from Emacs
- # get properly themed:
- GTK_DATA_PREFIX = "${config.system.path}";
- } // (if cfg.defaultEditor then {
- EDITOR = mkOverride 900 "${editorScript}/bin/emacseditor";
- } else {});
+ environment.variables.EDITOR = mkIf cfg.defaultEditor (mkOverride 900 "${editorScript}/bin/emacseditor");
};
meta.doc = ./emacs.xml;
diff --git a/nixos/modules/services/editors/infinoted.nix b/nixos/modules/services/editors/infinoted.nix
index 9cc8d421270ea26dd808d9551f453b9419bf2397..be36676169427a0bf508aae32a41f52c13059466 100644
--- a/nixos/modules/services/editors/infinoted.nix
+++ b/nixos/modules/services/editors/infinoted.nix
@@ -115,6 +115,7 @@ in {
{ name = "infinoted";
description = "Infinoted user";
group = cfg.group;
+ isSystemUser = true;
};
users.groups = optional (cfg.group == "infinoted")
{ name = "infinoted";
diff --git a/nixos/modules/services/games/openarena.nix b/nixos/modules/services/games/openarena.nix
new file mode 100644
index 0000000000000000000000000000000000000000..8c014d78809b832bc8ba3101d12a5ee964c8a719
--- /dev/null
+++ b/nixos/modules/services/games/openarena.nix
@@ -0,0 +1,56 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.openarena;
+in
+{
+ options = {
+ services.openarena = {
+ enable = mkEnableOption "OpenArena";
+
+ openPorts = mkOption {
+ type = types.bool;
+ default = false;
+ description = "Whether to open firewall ports for OpenArena";
+ };
+
+ extraFlags = mkOption {
+ type = types.listOf types.str;
+ default = [];
+ description = ''Extra flags to pass to oa_ded'';
+ example = [
+ "+set dedicated 2"
+ "+set sv_hostname 'My NixOS OpenArena Server'"
+ # Load a map. Mandatory for clients to be able to connect.
+ "+map oa_dm1"
+ ];
+ };
+ };
+ };
+
+ config = mkIf cfg.enable {
+ networking.firewall = mkIf cfg.openPorts {
+ allowedUDPPorts = [ 27960 ];
+ };
+
+ systemd.services.openarena = {
+ description = "OpenArena";
+ wantedBy = [ "multi-user.target" ];
+ after = [ "network.target" ];
+
+ serviceConfig = {
+ DynamicUser = true;
+ StateDirectory = "openarena";
+ ExecStart = "${pkgs.openarena}/bin/oa_ded +set fs_basepath ${pkgs.openarena}/openarena-0.8.8 +set fs_homepath /var/lib/openarena ${concatStringsSep " " cfg.extraFlags}";
+ Restart = "on-failure";
+
+ # Hardening
+ CapabilityBoundingSet = "";
+ NoNewPrivileges = true;
+ PrivateDevices = true;
+ };
+ };
+ };
+}
diff --git a/nixos/modules/services/hardware/bluetooth.nix b/nixos/modules/services/hardware/bluetooth.nix
index c5f9d1f9b725331a0819fea880a2ed1e94b730d7..11d67418a31e554cd79a0a475138b3747422ada8 100644
--- a/nixos/modules/services/hardware/bluetooth.nix
+++ b/nixos/modules/services/hardware/bluetooth.nix
@@ -36,17 +36,25 @@ in {
'';
};
+ config = mkOption {
+ type = with types; attrsOf (attrsOf (oneOf [ bool int str ]));
+ example = {
+ General = {
+ ControllerMode = "bredr";
+ };
+ };
+ description = "Set configuration for system-wide bluetooth (/etc/bluetooth/main.conf).";
+ };
+
extraConfig = mkOption {
- type = types.lines;
- default = "";
+ type = with types; nullOr lines;
+ default = null;
example = ''
[General]
ControllerMode = bredr
'';
description = ''
Set additional configuration for system-wide bluetooth (/etc/bluetooth/main.conf).
-
- NOTE: We already include [Policy], so any configuration under the Policy group should come first.
'';
};
};
@@ -56,16 +64,18 @@ in {
###### implementation
config = mkIf cfg.enable {
+ warnings = optional (cfg.extraConfig != null) "hardware.bluetooth.`extraConfig` is deprecated, please use hardware.bluetooth.`config`.";
- environment.systemPackages = [ bluez-bluetooth pkgs.openobex pkgs.obexftp ];
+ hardware.bluetooth.config = {
+ Policy = {
+ AutoEnable = mkDefault cfg.powerOnBoot;
+ };
+ };
- environment.etc = singleton {
- source = pkgs.writeText "main.conf" ''
- [Policy]
- AutoEnable=${lib.boolToString cfg.powerOnBoot}
+ environment.systemPackages = [ bluez-bluetooth ];
- ${cfg.extraConfig}
- '';
+ environment.etc = singleton {
+ source = pkgs.writeText "main.conf" (generators.toINI { } cfg.config + optionalString (cfg.extraConfig != null) cfg.extraConfig);
target = "bluetooth/main.conf";
};
diff --git a/nixos/modules/services/hardware/fancontrol.nix b/nixos/modules/services/hardware/fancontrol.nix
new file mode 100644
index 0000000000000000000000000000000000000000..bb4541a784dae61e5ceb182cdd007d9f4d361112
--- /dev/null
+++ b/nixos/modules/services/hardware/fancontrol.nix
@@ -0,0 +1,45 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.hardware.fancontrol;
+ configFile = pkgs.writeText "fancontrol.conf" cfg.config;
+
+in{
+ options.hardware.fancontrol = {
+ enable = mkEnableOption "software fan control (requires fancontrol.config)";
+
+ config = mkOption {
+ default = null;
+ type = types.lines;
+ description = "Fancontrol configuration file content. See pwmconfig8 from the lm_sensors package.";
+ example = ''
+ # Configuration file generated by pwmconfig
+ INTERVAL=10
+ DEVPATH=hwmon3=devices/virtual/thermal/thermal_zone2 hwmon4=devices/platform/f71882fg.656
+ DEVNAME=hwmon3=soc_dts1 hwmon4=f71869a
+ FCTEMPS=hwmon4/device/pwm1=hwmon3/temp1_input
+ FCFANS= hwmon4/device/pwm1=hwmon4/device/fan1_input
+ MINTEMP=hwmon4/device/pwm1=35
+ MAXTEMP=hwmon4/device/pwm1=65
+ MINSTART=hwmon4/device/pwm1=150
+ MINSTOP=hwmon4/device/pwm1=0
+ '';
+ };
+ };
+
+ config = mkIf cfg.enable {
+ systemd.services.fancontrol = {
+ unitConfig.Documentation = "man:fancontrol(8)";
+ description = "software fan control";
+ wantedBy = [ "multi-user.target" ];
+ after = [ "lm_sensors.service" ];
+
+ serviceConfig = {
+ Type = "simple";
+ ExecStart = "${pkgs.lm_sensors}/sbin/fancontrol ${configFile}";
+ };
+ };
+ };
+}
diff --git a/nixos/modules/services/hardware/fwupd.nix b/nixos/modules/services/hardware/fwupd.nix
index 6c341bcbf2406cbf976360154975eaa3e2fb83f3..51877970a8bcb25eaa58aca2270d48728e39403f 100644
--- a/nixos/modules/services/hardware/fwupd.nix
+++ b/nixos/modules/services/hardware/fwupd.nix
@@ -74,7 +74,7 @@ in {
default = false;
description = ''
Whether to enable test remote. This is used by
- installed tests.
+ installed tests.
'';
};
@@ -115,10 +115,6 @@ in {
services.udev.packages = [ cfg.package ];
systemd.packages = [ cfg.package ];
-
- systemd.tmpfiles.rules = [
- "d /var/lib/fwupd 0755 root root -"
- ];
};
meta = {
diff --git a/nixos/modules/services/hardware/tlp.nix b/nixos/modules/services/hardware/tlp.nix
index 4f8af7978286a79f7abc3ef0d79eb517eb2bcb63..adc1881a525d738cc19f6b02f569160570c10aba 100644
--- a/nixos/modules/services/hardware/tlp.nix
+++ b/nixos/modules/services/hardware/tlp.nix
@@ -37,7 +37,7 @@ in
enable = mkOption {
type = types.bool;
default = false;
- description = "Whether to enable the TLP daemon.";
+ description = "Whether to enable the TLP power management daemon.";
};
extraConfig = mkOption {
diff --git a/nixos/modules/services/hardware/trezord.nix b/nixos/modules/services/hardware/trezord.nix
index 62824ed7350a77fc9bfea5e44e8ef6c0f5c322fa..c517e9fbb2bdac55c4eadb8f8dd5220526a3f78c 100644
--- a/nixos/modules/services/hardware/trezord.nix
+++ b/nixos/modules/services/hardware/trezord.nix
@@ -44,20 +44,7 @@ in {
### implementation
config = mkIf cfg.enable {
- services.udev.packages = lib.singleton (pkgs.writeTextFile {
- name = "trezord-udev-rules";
- destination = "/etc/udev/rules.d/51-trezor.rules";
- text = ''
- # TREZOR v1 (One)
- SUBSYSTEM=="usb", ATTR{idVendor}=="534c", ATTR{idProduct}=="0001", MODE="0660", GROUP="trezord", TAG+="uaccess", SYMLINK+="trezor%n"
- KERNEL=="hidraw*", ATTRS{idVendor}=="534c", ATTRS{idProduct}=="0001", MODE="0660", GROUP="trezord", TAG+="uaccess"
-
- # TREZOR v2 (T)
- SUBSYSTEM=="usb", ATTR{idVendor}=="1209", ATTR{idProduct}=="53c0", MODE="0660", GROUP="trezord", TAG+="uaccess", SYMLINK+="trezor%n"
- SUBSYSTEM=="usb", ATTR{idVendor}=="1209", ATTR{idProduct}=="53c1", MODE="0660", GROUP="trezord", TAG+="uaccess", SYMLINK+="trezor%n"
- KERNEL=="hidraw*", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="53c1", MODE="0660", GROUP="trezord", TAG+="uaccess"
- '';
- });
+ services.udev.packages = [ pkgs.trezor-udev-rules ];
systemd.services.trezord = {
description = "TREZOR Bridge";
@@ -74,6 +61,7 @@ in {
users.users.trezord = {
group = "trezord";
description = "Trezor bridge daemon user";
+ isSystemUser = true;
};
users.groups.trezord = {};
diff --git a/nixos/modules/services/hardware/udev.nix b/nixos/modules/services/hardware/udev.nix
index 83ab93bd7cfc0c7d071860e171121ee5ec9fa90b..50997bb9bb1b1311c52a8986155b355a82460991 100644
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@@ -221,8 +221,8 @@ in
type = types.lines;
description = ''
Additional hwdb files. They'll be written
- into file 10-local.hwdb. Thus they are
- read before all other files.
+ into file 99-local.hwdb. Thus they are
+ read after all other files.
'';
};
diff --git a/nixos/modules/services/hardware/udisks2.nix b/nixos/modules/services/hardware/udisks2.nix
index ed8703be921cbba48bce8f3f36969c5c3d9aaa05..e898f32605856063412faf6c7d21adfdd60c7e63 100644
--- a/nixos/modules/services/hardware/udisks2.nix
+++ b/nixos/modules/services/hardware/udisks2.nix
@@ -34,10 +34,7 @@ with lib;
services.dbus.packages = [ pkgs.udisks2 ];
- system.activationScripts.udisks2 =
- ''
- mkdir -m 0755 -p /var/lib/udisks2
- '';
+ systemd.tmpfiles.rules = [ "d /var/lib/udisks2 0755 root root -" ];
services.udev.packages = [ pkgs.udisks2 ];
diff --git a/nixos/modules/services/hardware/upower.nix b/nixos/modules/services/hardware/upower.nix
index 5e7ac7a6e6591df928aec9858c2221e967514148..449810b53150fa680f071e3607031a724335bbbe 100644
--- a/nixos/modules/services/hardware/upower.nix
+++ b/nixos/modules/services/hardware/upower.nix
@@ -37,6 +37,172 @@ in
'';
};
+ enableWattsUpPro = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Enable the Watts Up Pro device.
+
+ The Watts Up Pro contains a generic FTDI USB device without a specific
+ vendor and product ID. When we probe for WUP devices, we can cause
+ the user to get a perplexing "Device or resource busy" error when
+ attempting to use their non-WUP device.
+
+ The generic FTDI device is known to also be used on:
+
+
+ Sparkfun FT232 breakout board
+ Parallax Propeller
+
+ '';
+ };
+
+ noPollBatteries = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Don't poll the kernel for battery level changes.
+
+ Some hardware will send us battery level changes through
+ events, rather than us having to poll for it. This option
+ allows disabling polling for hardware that sends out events.
+ '';
+ };
+
+ ignoreLid = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Do we ignore the lid state
+
+ Some laptops are broken. The lid state is either inverted, or stuck
+ on or off. We can't do much to fix these problems, but this is a way
+ for users to make the laptop panel vanish, a state that might be used
+ by a couple of user-space daemons. On Linux systems, see also
+ logind.conf(5).
+ '';
+ };
+
+ usePercentageForPolicy = mkOption {
+ type = types.bool;
+ default = true;
+ description = ''
+ Policy for warnings and action based on battery levels
+
+ Whether battery percentage based policy should be used. The default
+ is to use the percentage, which
+ should work around broken firmwares. It is also more reliable than
+ the time left (frantically saving all your files is going to use more
+ battery than letting it rest for example).
+ '';
+ };
+
+ percentageLow = mkOption {
+ type = types.ints.unsigned;
+ default = 10;
+ description = ''
+ When usePercentageForPolicy is
+ true, the levels at which UPower will consider the
+ battery low.
+
+ This will also be used for batteries which don't have time information
+ such as that of peripherals.
+
+ If any value (of percentageLow,
+ percentageCritical and
+ percentageAction) is invalid, or not in descending
+ order, the defaults will be used.
+ '';
+ };
+
+ percentageCritical = mkOption {
+ type = types.ints.unsigned;
+ default = 3;
+ description = ''
+ When usePercentageForPolicy is
+ true, the levels at which UPower will consider the
+ battery critical.
+
+ This will also be used for batteries which don't have time information
+ such as that of peripherals.
+
+ If any value (of percentageLow,
+ percentageCritical and
+ percentageAction) is invalid, or not in descending
+ order, the defaults will be used.
+ '';
+ };
+
+ percentageAction = mkOption {
+ type = types.ints.unsigned;
+ default = 2;
+ description = ''
+ When usePercentageForPolicy is
+ true, the levels at which UPower will take action
+ for the critical battery level.
+
+ This will also be used for batteries which don't have time information
+ such as that of peripherals.
+
+ If any value (of percentageLow,
+ percentageCritical and
+ percentageAction) is invalid, or not in descending
+ order, the defaults will be used.
+ '';
+ };
+
+ timeLow = mkOption {
+ type = types.ints.unsigned;
+ default = 1200;
+ description = ''
+ When usePercentageForPolicy is
+ false, the time remaining at which UPower will
+ consider the battery low.
+
+ If any value (of timeLow,
+ timeCritical and timeAction) is
+ invalid, or not in descending order, the defaults will be used.
+ '';
+ };
+
+ timeCritical = mkOption {
+ type = types.ints.unsigned;
+ default = 300;
+ description = ''
+ When usePercentageForPolicy is
+ false, the time remaining at which UPower will
+ consider the battery critical.
+
+ If any value (of timeLow,
+ timeCritical and timeAction) is
+ invalid, or not in descending order, the defaults will be used.
+ '';
+ };
+
+ timeAction = mkOption {
+ type = types.ints.unsigned;
+ default = 120;
+ description = ''
+ When usePercentageForPolicy is
+ false, the time remaining at which UPower will
+ take action for the critical battery level.
+
+ If any value (of timeLow,
+ timeCritical and timeAction) is
+ invalid, or not in descending order, the defaults will be used.
+ '';
+ };
+
+ criticalPowerAction = mkOption {
+ type = types.enum [ "PowerOff" "Hibernate" "HybridSleep" ];
+ default = "HybridSleep";
+ description = ''
+ The action to take when timeAction or
+ percentageAction has been reached for the batteries
+ (UPS or laptop batteries) supplying the computer
+ '';
+ };
+
};
};
@@ -54,6 +220,21 @@ in
systemd.packages = [ cfg.package ];
+ environment.etc."UPower/UPower.conf".text = generators.toINI {} {
+ UPower = {
+ EnableWattsUpPro = cfg.enableWattsUpPro;
+ NoPollBatteries = cfg.noPollBatteries;
+ IgnoreLid = cfg.ignoreLid;
+ UsePercentageForPolicy = cfg.usePercentageForPolicy;
+ PercentageLow = cfg.percentageLow;
+ PercentageCritical = cfg.percentageCritical;
+ PercentageAction = cfg.percentageAction;
+ TimeLow = cfg.timeLow;
+ TimeCritical = cfg.timeCritical;
+ TimeAction = cfg.timeAction;
+ CriticalPowerAction = cfg.criticalPowerAction;
+ };
+ };
};
}
diff --git a/nixos/modules/services/hardware/usbmuxd.nix b/nixos/modules/services/hardware/usbmuxd.nix
index 93ced0b9f04d42689ce6b9e9fcd6f517540b5796..39bbcaf4627ca77d7750fc7ecb28e8e49d73606b 100644
--- a/nixos/modules/services/hardware/usbmuxd.nix
+++ b/nixos/modules/services/hardware/usbmuxd.nix
@@ -47,6 +47,7 @@ in
name = cfg.user;
description = "usbmuxd user";
group = cfg.group;
+ isSystemUser = true;
};
users.groups = optional (cfg.group == defaultUserGroup) {
diff --git a/nixos/modules/services/hardware/vdr.nix b/nixos/modules/services/hardware/vdr.nix
index 6e246f70f515fa0b5c4e9667740cd479c6482ce2..8a6cde51b06ffcb62a0451099fc7778966e6f37a 100644
--- a/nixos/modules/services/hardware/vdr.nix
+++ b/nixos/modules/services/hardware/vdr.nix
@@ -66,6 +66,7 @@ in {
users.users.vdr = {
group = "vdr";
home = libDir;
+ isSystemUser = true;
};
users.groups.vdr = {};
diff --git a/nixos/modules/services/logging/awstats.nix b/nixos/modules/services/logging/awstats.nix
index a92ff3bee490b02ee9efb9f90b5cecf0478b62b9..5939d7808f7f1b1eca1d975bdae5836484ce8576 100644
--- a/nixos/modules/services/logging/awstats.nix
+++ b/nixos/modules/services/logging/awstats.nix
@@ -4,31 +4,117 @@ with lib;
let
cfg = config.services.awstats;
- httpd = config.services.httpd;
package = pkgs.awstats;
-in
+ configOpts = {name, config, ...}: {
+ options = {
+ type = mkOption{
+ type = types.enum [ "mail" "web" ];
+ default = "web";
+ example = "mail";
+ description = ''
+ The type of log being collected.
+ '';
+ };
+ domain = mkOption {
+ type = types.str;
+ default = name;
+ description = "The domain name to collect stats for.";
+ example = "example.com";
+ };
+
+ logFile = mkOption {
+ type = types.str;
+ example = "/var/spool/nginx/logs/access.log";
+ description = ''
+ The log file to be scanned.
+ For mail, set this to
+
+ journalctl $OLD_CURSOR -u postfix.service | ''${pkgs.perl}/bin/perl ''${pkgs.awstats.out}/share/awstats/tools/maillogconvert.pl standard |
+
+ '';
+ };
+
+ logFormat = mkOption {
+ type = types.str;
+ default = "1";
+ description = ''
+ The log format being used.
+
+ For mail, set this to
+
+ %time2 %email %email_r %host %host_r %method %url %code %bytesd
+
+ '';
+ };
+
+ hostAliases = mkOption {
+ type = types.listOf types.str;
+ default = [];
+ example = "[ \"www.example.org\" ]";
+ description = ''
+ List of aliases the site has.
+ '';
+ };
+
+ extraConfig = mkOption {
+ type = types.attrsOf types.str;
+ default = {};
+ example = literalExample ''
+ {
+ "ValidHTTPCodes" = "404";
+ }
+ '';
+ description = "Extra configuration to be appendend to awstats.\${name}.conf.";
+ };
+
+ webService = {
+ enable = mkEnableOption "awstats web service";
+
+ hostname = mkOption {
+ type = types.str;
+ default = config.domain;
+ description = "The hostname the web service appears under.";
+ };
+
+ urlPrefix = mkOption {
+ type = types.str;
+ default = "/awstats";
+ description = "The URL prefix under which the awstats pages appear.";
+ };
+ };
+ };
+ };
+ webServices = filterAttrs (name: value: value.webService.enable) cfg.configs;
+in
{
+ imports = [
+ (mkRemovedOptionModule [ "services" "awstats" "service" "enable" ] "Please enable per domain with `services.awstats.configs..webService.enable`")
+ (mkRemovedOptionModule [ "services" "awstats" "service" "urlPrefix" ] "Please set per domain with `services.awstats.configs..webService.urlPrefix`")
+ (mkRenamedOptionModule [ "services" "awstats" "vardir" ] [ "services" "awstats" "dataDir" ])
+ ];
+
options.services.awstats = {
- enable = mkOption {
- type = types.bool;
- default = cfg.service.enable;
- description = ''
- Enable the awstats program (but not service).
- Currently only simple httpd (Apache) configs are supported,
- and awstats plugins may not work correctly.
- '';
- };
- vardir = mkOption {
+ enable = mkEnableOption "awstats";
+
+ dataDir = mkOption {
type = types.path;
default = "/var/lib/awstats";
- description = "The directory where variable awstats data will be stored.";
+ description = "The directory where awstats data will be stored.";
};
- extraConfig = mkOption {
- type = types.lines;
- default = "";
- description = "Extra configuration to be appendend to awstats.conf.";
+ configs = mkOption {
+ type = types.attrsOf (types.submodule configOpts);
+ default = {};
+ example = literalExample ''
+ {
+ "mysite" = {
+ domain = "example.com";
+ logFile = "/var/spool/nginx/logs/access.log";
+ };
+ }
+ '';
+ description = "Attribute set of domains to collect stats for.";
};
updateAt = mkOption {
@@ -42,75 +128,129 @@ in
7)
'';
};
-
- service = {
- enable = mkOption {
- type = types.bool;
- default = false;
- description = ''Enable the awstats web service. This switches on httpd.'';
- };
- urlPrefix = mkOption {
- type = types.str;
- default = "/awstats";
- description = "The URL prefix under which the awstats service appears.";
- };
- };
};
config = mkIf cfg.enable {
environment.systemPackages = [ package.bin ];
- /* TODO:
- - heed config.services.httpd.logPerVirtualHost, etc.
- - Can't AllowToUpdateStatsFromBrowser, as CGI scripts don't have permission
- to read the logs, and our httpd config apparently doesn't an option for that.
- */
- environment.etc."awstats/awstats.conf".source = pkgs.runCommand "awstats.conf"
+
+ environment.etc = mapAttrs' (name: opts:
+ nameValuePair "awstats/awstats.${name}.conf" {
+ source = pkgs.runCommand "awstats.${name}.conf"
{ preferLocalBuild = true; }
- ( let
- logFormat =
- if httpd.logFormat == "combined" then "1" else
- if httpd.logFormat == "common" then "4" else
- throw "awstats service doesn't support Apache log format `${httpd.logFormat}`";
- in
- ''
- sed \
- -e 's|^\(DirData\)=.*$|\1="${cfg.vardir}"|' \
- -e 's|^\(DirIcons\)=.*$|\1="icons"|' \
- -e 's|^\(CreateDirDataIfNotExists\)=.*$|\1=1|' \
- -e 's|^\(SiteDomain\)=.*$|\1="${httpd.hostName}"|' \
- -e 's|^\(LogFile\)=.*$|\1="${httpd.logDir}/access_log"|' \
- -e 's|^\(LogFormat\)=.*$|\1=${logFormat}|' \
- < '${package.out}/wwwroot/cgi-bin/awstats.model.conf' > "$out"
- echo '${cfg.extraConfig}' >> "$out"
- '');
-
- systemd.tmpfiles.rules = optionals cfg.service.enable [
- "d '${cfg.vardir}' - ${httpd.user} ${httpd.group} - -"
- "Z '${cfg.vardir}' - ${httpd.user} ${httpd.group} - -"
- ];
-
- # The httpd sub-service showing awstats.
- services.httpd = optionalAttrs cfg.service.enable {
- enable = true;
- extraConfig = ''
- Alias ${cfg.service.urlPrefix}/classes "${package.out}/wwwroot/classes/"
- Alias ${cfg.service.urlPrefix}/css "${package.out}/wwwroot/css/"
- Alias ${cfg.service.urlPrefix}/icons "${package.out}/wwwroot/icon/"
- ScriptAlias ${cfg.service.urlPrefix}/ "${package.out}/wwwroot/cgi-bin/"
-
-
- Options None
- Require all granted
-
- '';
- };
+ (''
+ sed \
+ ''
+ # set up mail stats
+ + optionalString (opts.type == "mail")
+ ''
+ -e 's|^\(LogType\)=.*$|\1=M|' \
+ -e 's|^\(LevelForBrowsersDetection\)=.*$|\1=0|' \
+ -e 's|^\(LevelForOSDetection\)=.*$|\1=0|' \
+ -e 's|^\(LevelForRefererAnalyze\)=.*$|\1=0|' \
+ -e 's|^\(LevelForRobotsDetection\)=.*$|\1=0|' \
+ -e 's|^\(LevelForSearchEnginesDetection\)=.*$|\1=0|' \
+ -e 's|^\(LevelForFileTypesDetection\)=.*$|\1=0|' \
+ -e 's|^\(LevelForWormsDetection\)=.*$|\1=0|' \
+ -e 's|^\(ShowMenu\)=.*$|\1=1|' \
+ -e 's|^\(ShowSummary\)=.*$|\1=HB|' \
+ -e 's|^\(ShowMonthStats\)=.*$|\1=HB|' \
+ -e 's|^\(ShowDaysOfMonthStats\)=.*$|\1=HB|' \
+ -e 's|^\(ShowDaysOfWeekStats\)=.*$|\1=HB|' \
+ -e 's|^\(ShowHoursStats\)=.*$|\1=HB|' \
+ -e 's|^\(ShowDomainsStats\)=.*$|\1=0|' \
+ -e 's|^\(ShowHostsStats\)=.*$|\1=HB|' \
+ -e 's|^\(ShowAuthenticatedUsers\)=.*$|\1=0|' \
+ -e 's|^\(ShowRobotsStats\)=.*$|\1=0|' \
+ -e 's|^\(ShowEMailSenders\)=.*$|\1=HBML|' \
+ -e 's|^\(ShowEMailReceivers\)=.*$|\1=HBML|' \
+ -e 's|^\(ShowSessionsStats\)=.*$|\1=0|' \
+ -e 's|^\(ShowPagesStats\)=.*$|\1=0|' \
+ -e 's|^\(ShowFileTypesStats\)=.*$|\1=0|' \
+ -e 's|^\(ShowFileSizesStats\)=.*$|\1=0|' \
+ -e 's|^\(ShowBrowsersStats\)=.*$|\1=0|' \
+ -e 's|^\(ShowOSStats\)=.*$|\1=0|' \
+ -e 's|^\(ShowOriginStats\)=.*$|\1=0|' \
+ -e 's|^\(ShowKeyphrasesStats\)=.*$|\1=0|' \
+ -e 's|^\(ShowKeywordsStats\)=.*$|\1=0|' \
+ -e 's|^\(ShowMiscStats\)=.*$|\1=0|' \
+ -e 's|^\(ShowHTTPErrorsStats\)=.*$|\1=0|' \
+ -e 's|^\(ShowSMTPErrorsStats\)=.*$|\1=1|' \
+ ''
+ +
+ # common options
+ ''
+ -e 's|^\(DirData\)=.*$|\1="${cfg.dataDir}/${name}"|' \
+ -e 's|^\(DirIcons\)=.*$|\1="icons"|' \
+ -e 's|^\(CreateDirDataIfNotExists\)=.*$|\1=1|' \
+ -e 's|^\(SiteDomain\)=.*$|\1="${name}"|' \
+ -e 's|^\(LogFile\)=.*$|\1="${opts.logFile}"|' \
+ -e 's|^\(LogFormat\)=.*$|\1="${opts.logFormat}"|' \
+ ''
+ +
+ # extra config
+ concatStringsSep "\n" (mapAttrsToList (n: v: ''
+ -e 's|^\(${n}\)=.*$|\1="${v}"|' \
+ '') opts.extraConfig)
+ +
+ ''
+ < '${package.out}/wwwroot/cgi-bin/awstats.model.conf' > "$out"
+ '');
+ }) cfg.configs;
- systemd.services.awstats-update = mkIf (cfg.updateAt != null) {
- description = "awstats log collector";
- script = "exec '${package.bin}/bin/awstats' -update -config=awstats.conf";
- startAt = cfg.updateAt;
- };
+ # create data directory with the correct permissions
+ systemd.tmpfiles.rules =
+ [ "d '${cfg.dataDir}' 755 root root - -" ] ++
+ mapAttrsToList (name: opts: "d '${cfg.dataDir}/${name}' 755 root root - -") cfg.configs ++
+ [ "Z '${cfg.dataDir}' 755 root root - -" ];
+
+ # nginx options
+ services.nginx.virtualHosts = mapAttrs'(name: opts: {
+ name = opts.webService.hostname;
+ value = {
+ locations = {
+ "${opts.webService.urlPrefix}/css/" = {
+ alias = "${package.out}/wwwroot/css/";
+ };
+ "${opts.webService.urlPrefix}/icons/" = {
+ alias = "${package.out}/wwwroot/icon/";
+ };
+ "${opts.webService.urlPrefix}/" = {
+ alias = "${cfg.dataDir}/${name}/";
+ extraConfig = ''
+ autoindex on;
+ '';
+ };
+ };
+ };
+ }) webServices;
+
+ # update awstats
+ systemd.services = mkIf (cfg.updateAt != null) (mapAttrs' (name: opts:
+ nameValuePair "awstats-${name}-update" {
+ description = "update awstats for ${name}";
+ script = optionalString (opts.type == "mail")
+ ''
+ if [[ -f "${cfg.dataDir}/${name}-cursor" ]]; then
+ CURSOR="$(cat "${cfg.dataDir}/${name}-cursor" | tr -d '\n')"
+ if [[ -n "$CURSOR" ]]; then
+ echo "Using cursor: $CURSOR"
+ export OLD_CURSOR="--cursor $CURSOR"
+ fi
+ fi
+ NEW_CURSOR="$(journalctl $OLD_CURSOR -u postfix.service --show-cursor | tail -n 1 | tr -d '\n' | sed -e 's#^-- cursor: \(.*\)#\1#')"
+ echo "New cursor: $NEW_CURSOR"
+ ${package.bin}/bin/awstats -update -config=${name}
+ if [ -n "$NEW_CURSOR" ]; then
+ echo -n "$NEW_CURSOR" > ${cfg.dataDir}/${name}-cursor
+ fi
+ '' + ''
+ ${package.out}/share/awstats/tools/awstats_buildstaticpages.pl \
+ -config=${name} -update -dir=${cfg.dataDir}/${name} \
+ -awstatsprog=${package.bin}/bin/awstats
+ '';
+ startAt = cfg.updateAt;
+ }) cfg.configs);
};
}
diff --git a/nixos/modules/services/logging/logstash.nix b/nixos/modules/services/logging/logstash.nix
index 4943e8d7db3a527275ff16752f4e9201ecdb3770..21a83803fd8c6cc00d796f8a96ef8915f93efb2b 100644
--- a/nixos/modules/services/logging/logstash.nix
+++ b/nixos/modules/services/logging/logstash.nix
@@ -37,6 +37,11 @@ let
in
{
+ imports = [
+ (mkRenamedOptionModule [ "services" "logstash" "address" ] [ "services" "logstash" "listenAddress" ])
+ (mkRemovedOptionModule [ "services" "logstash" "enableWeb" ] "The web interface was removed from logstash")
+ ];
+
###### interface
options = {
diff --git a/nixos/modules/services/logging/syslog-ng.nix b/nixos/modules/services/logging/syslog-ng.nix
index 65e103ac2ba58ef3623940ccaa75e6e8d392c364..35055311680bbad3736892db89ba134680e18f17 100644
--- a/nixos/modules/services/logging/syslog-ng.nix
+++ b/nixos/modules/services/logging/syslog-ng.nix
@@ -25,6 +25,10 @@ let
];
in {
+ imports = [
+ (mkRemovedOptionModule [ "services" "syslog-ng" "serviceName" ] "")
+ (mkRemovedOptionModule [ "services" "syslog-ng" "listenToJournal" ] "")
+ ];
options = {
diff --git a/nixos/modules/services/mail/dovecot.nix b/nixos/modules/services/mail/dovecot.nix
index cdbb776454b658620a7b18e66f738a2e9190a630..2cda8c49f5e13f336540db0df9eb235642effcd6 100644
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@@ -86,7 +86,7 @@ let
}
plugin {
- quota_rule = *:storage=${cfg.quotaGlobalPerUser}
+ quota_rule = *:storage=${cfg.quotaGlobalPerUser}
quota = maildir:User quota # per virtual mail user quota # BUG/FIXME broken, we couldn't get this working
quota_status_success = DUNNO
quota_status_nouser = DUNNO
@@ -133,6 +133,9 @@ let
};
in
{
+ imports = [
+ (mkRemovedOptionModule [ "services" "dovecot2" "package" ] "")
+ ];
options.services.dovecot2 = {
enable = mkEnableOption "Dovecot 2.x POP3/IMAP server";
@@ -181,7 +184,7 @@ in
};
configFile = mkOption {
- type = types.nullOr types.str;
+ type = types.nullOr types.path;
default = null;
description = "Config file used for the whole dovecot configuration.";
apply = v: if v != null then v else pkgs.writeText "dovecot.conf" dovecotConf;
diff --git a/nixos/modules/services/mail/mailcatcher.nix b/nixos/modules/services/mail/mailcatcher.nix
index fa8d41e918d3d093b69e771ed46a9be8fce706e7..84f06ed199dc68c5caca845c956f59c6ffd0f649 100644
--- a/nixos/modules/services/mail/mailcatcher.nix
+++ b/nixos/modules/services/mail/mailcatcher.nix
@@ -3,7 +3,7 @@
let
cfg = config.services.mailcatcher;
- inherit (lib) mkEnableOption mkIf mkOption types;
+ inherit (lib) mkEnableOption mkIf mkOption types optionalString;
in
{
# interface
@@ -25,6 +25,13 @@ in
description = "The port address of the http server.";
};
+ http.path = mkOption {
+ type = with types; nullOr str;
+ default = null;
+ description = "Prefix to all HTTP paths.";
+ example = "/mailcatcher";
+ };
+
smtp.ip = mkOption {
type = types.str;
default = "127.0.0.1";
@@ -53,7 +60,8 @@ in
serviceConfig = {
DynamicUser = true;
Restart = "always";
- ExecStart = "${pkgs.mailcatcher}/bin/mailcatcher --foreground --no-quit --http-ip ${cfg.http.ip} --http-port ${toString cfg.http.port} --smtp-ip ${cfg.smtp.ip} --smtp-port ${toString cfg.smtp.port}";
+ ExecStart = "${pkgs.mailcatcher}/bin/mailcatcher --foreground --no-quit --http-ip ${cfg.http.ip} --http-port ${toString cfg.http.port} --smtp-ip ${cfg.smtp.ip} --smtp-port ${toString cfg.smtp.port}" + optionalString (cfg.http.path != null) " --http-path ${cfg.http.path}";
+ AmbientCapabilities = optionalString (cfg.http.port < 1024 || cfg.smtp.port < 1024) "cap_net_bind_service";
};
};
};
diff --git a/nixos/modules/services/mail/mailhog.nix b/nixos/modules/services/mail/mailhog.nix
index b78f4c8e0e663838d812d5ce19e5f6320b8b27a5..0f998c6d0ea63f7e2d193a0ccd3603a1c7957c11 100644
--- a/nixos/modules/services/mail/mailhog.nix
+++ b/nixos/modules/services/mail/mailhog.nix
@@ -27,6 +27,7 @@ in {
users.users.mailhog = {
name = cfg.user;
description = "MailHog service user";
+ isSystemUser = true;
};
systemd.services.mailhog = {
diff --git a/nixos/modules/services/mail/mailman.nix b/nixos/modules/services/mail/mailman.nix
index 11dd5cb48db04154a6f442cf1b0fa4b858d77764..e917209f3d1f500274028c37cec4dea918594abf 100644
--- a/nixos/modules/services/mail/mailman.nix
+++ b/nixos/modules/services/mail/mailman.nix
@@ -6,16 +6,35 @@ let
cfg = config.services.mailman;
- pythonEnv = pkgs.python3.withPackages (ps: [ps.mailman]);
+ mailmanPyEnv = pkgs.python3.withPackages (ps: with ps; [mailman mailman-hyperkitty]);
mailmanExe = with pkgs; stdenv.mkDerivation {
name = "mailman-" + python3Packages.mailman.version;
+ buildInputs = [makeWrapper];
unpackPhase = ":";
installPhase = ''
mkdir -p $out/bin
- sed >"$out/bin/mailman" <"${pythonEnv}/bin/mailman" \
- -e "2 iexport MAILMAN_CONFIG_FILE=/etc/mailman.cfg"
- chmod +x $out/bin/mailman
+ makeWrapper ${mailmanPyEnv}/bin/mailman $out/bin/mailman \
+ --set MAILMAN_CONFIG_FILE /etc/mailman.cfg
+ '';
+ };
+
+ mailmanWeb = pkgs.python3Packages.mailman-web.override {
+ serverEMail = cfg.siteOwner;
+ archiverKey = cfg.hyperkittyApiKey;
+ allowedHosts = cfg.webHosts;
+ };
+
+ mailmanWebPyEnv = pkgs.python3.withPackages (x: with x; [mailman-web]);
+
+ mailmanWebExe = with pkgs; stdenv.mkDerivation {
+ inherit (mailmanWeb) name;
+ buildInputs = [makeWrapper];
+ unpackPhase = ":";
+ installPhase = ''
+ mkdir -p $out/bin
+ makeWrapper ${mailmanWebPyEnv}/bin/django-admin $out/bin/mailman-web \
+ --set DJANGO_SETTINGS_MODULE settings
'';
};
@@ -28,11 +47,30 @@ let
bin_dir: ${pkgs.python3Packages.mailman}/bin
var_dir: /var/lib/mailman
queue_dir: $var_dir/queue
+ template_dir: $var_dir/templates
log_dir: $var_dir/log
lock_dir: $var_dir/lock
etc_dir: /etc
ext_dir: $etc_dir/mailman.d
pid_file: /run/mailman/master.pid
+ '' + optionalString (cfg.hyperkittyApiKey != null) ''
+ [archiver.hyperkitty]
+ class: mailman_hyperkitty.Archiver
+ enable: yes
+ configuration: ${pkgs.writeText "mailman-hyperkitty.cfg" mailmanHyperkittyCfg}
+ '';
+
+ mailmanHyperkittyCfg = ''
+ [general]
+ # This is your HyperKitty installation, preferably on the localhost. This
+ # address will be used by Mailman to forward incoming emails to HyperKitty
+ # for archiving. It does not need to be publicly available, in fact it's
+ # better if it is not.
+ base_url: ${cfg.hyperkittyBaseUrl}
+
+ # Shared API key, must be the identical to the value in HyperKitty's
+ # settings.
+ api_key: ${cfg.hyperkittyApiKey}
'';
in {
@@ -51,7 +89,7 @@ in {
siteOwner = mkOption {
type = types.str;
- default = "postmaster";
+ default = "postmaster@example.org";
description = ''
Certain messages that must be delivered to a human, but which can't
be delivered to a list owner (e.g. a bounce from a list owner), will
@@ -59,6 +97,48 @@ in {
'';
};
+ webRoot = mkOption {
+ type = types.path;
+ default = "${mailmanWeb}/${pkgs.python3.sitePackages}";
+ defaultText = "pkgs.python3Packages.mailman-web";
+ description = ''
+ The web root for the Hyperkity + Postorius apps provided by Mailman.
+ This variable can be set, of course, but it mainly exists so that site
+ admins can refer to it in their own hand-written httpd configuration files.
+ '';
+ };
+
+ webHosts = mkOption {
+ type = types.listOf types.str;
+ default = [];
+ description = ''
+ The list of hostnames and/or IP addresses from which the Mailman Web
+ UI will accept requests. By default, "localhost" and "127.0.0.1" are
+ enabled. All additional names under which your web server accepts
+ requests for the UI must be listed here or incoming requests will be
+ rejected.
+ '';
+ };
+
+ hyperkittyBaseUrl = mkOption {
+ type = types.str;
+ default = "http://localhost/hyperkitty/";
+ description = ''
+ Where can Mailman connect to Hyperkitty's internal API, preferably on
+ localhost?
+ '';
+ };
+
+ hyperkittyApiKey = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ description = ''
+ The shared secret used to authenticate Mailman's internal
+ communication with Hyperkitty. Must be set to enable support for the
+ Hyperkitty archiver. Note that this secret is going to be visible to
+ all local users in the Nix store.
+ '';
+ };
};
};
@@ -71,25 +151,22 @@ in {
{ assertion = cfg.enable -> config.services.postfix.enable;
message = "Mailman requires Postfix";
}
- { assertion = config.services.postfix.recipientDelimiter == "+";
- message = "Postfix's recipientDelimiter must be set to '+'.";
- }
];
users.users.mailman = { description = "GNU Mailman"; isSystemUser = true; };
environment = {
- systemPackages = [ mailmanExe ];
+ systemPackages = [ mailmanExe mailmanWebExe pkgs.sassc ];
etc."mailman.cfg".text = mailmanCfg;
};
services.postfix = {
relayDomains = [ "hash:/var/lib/mailman/data/postfix_domains" ];
+ recipientDelimiter = "+"; # bake recipient addresses in mail envelopes via VERP
config = {
transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
- # Mailman uses recipient delimiters, so we don't need special handling.
- owner_request_special = "no";
+ owner_request_special = "no"; # Mailman handles -owner addresses on its own
};
};
@@ -109,6 +186,112 @@ in {
};
};
+ systemd.services.mailman-web = {
+ description = "Init Postorius DB";
+ before = [ "httpd.service" ];
+ requiredBy = [ "httpd.service" ];
+ script = ''
+ ${mailmanWebExe}/bin/mailman-web migrate
+ rm -rf static
+ ${mailmanWebExe}/bin/mailman-web collectstatic
+ ${mailmanWebExe}/bin/mailman-web compress
+ '';
+ serviceConfig = {
+ User = config.services.httpd.user;
+ Type = "oneshot";
+ StateDirectory = "mailman-web";
+ StateDirectoryMode = "0700";
+ WorkingDirectory = "/var/lib/mailman-web";
+ };
+ };
+
+ systemd.services.mailman-daily = {
+ description = "Trigger daily Mailman events";
+ startAt = "daily";
+ serviceConfig = {
+ ExecStart = "${mailmanExe}/bin/mailman digests --send";
+ User = "mailman";
+ };
+ };
+
+ systemd.services.hyperkitty = {
+ enable = cfg.hyperkittyApiKey != null;
+ description = "GNU Hyperkitty QCluster Process";
+ after = [ "network.target" ];
+ wantedBy = [ "mailman.service" "multi-user.target" ];
+ serviceConfig = {
+ ExecStart = "${mailmanWebExe}/bin/mailman-web qcluster";
+ User = config.services.httpd.user;
+ WorkingDirectory = "/var/lib/mailman-web";
+ };
+ };
+
+ systemd.services.hyperkitty-minutely = {
+ enable = cfg.hyperkittyApiKey != null;
+ description = "Trigger minutely Hyperkitty events";
+ startAt = "minutely";
+ serviceConfig = {
+ ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs minutely";
+ User = config.services.httpd.user;
+ WorkingDirectory = "/var/lib/mailman-web";
+ };
+ };
+
+ systemd.services.hyperkitty-quarter-hourly = {
+ enable = cfg.hyperkittyApiKey != null;
+ description = "Trigger quarter-hourly Hyperkitty events";
+ startAt = "*:00/15";
+ serviceConfig = {
+ ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs quarter_hourly";
+ User = config.services.httpd.user;
+ WorkingDirectory = "/var/lib/mailman-web";
+ };
+ };
+
+ systemd.services.hyperkitty-hourly = {
+ enable = cfg.hyperkittyApiKey != null;
+ description = "Trigger hourly Hyperkitty events";
+ startAt = "hourly";
+ serviceConfig = {
+ ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs hourly";
+ User = config.services.httpd.user;
+ WorkingDirectory = "/var/lib/mailman-web";
+ };
+ };
+
+ systemd.services.hyperkitty-daily = {
+ enable = cfg.hyperkittyApiKey != null;
+ description = "Trigger daily Hyperkitty events";
+ startAt = "daily";
+ serviceConfig = {
+ ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs daily";
+ User = config.services.httpd.user;
+ WorkingDirectory = "/var/lib/mailman-web";
+ };
+ };
+
+ systemd.services.hyperkitty-weekly = {
+ enable = cfg.hyperkittyApiKey != null;
+ description = "Trigger weekly Hyperkitty events";
+ startAt = "weekly";
+ serviceConfig = {
+ ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs weekly";
+ User = config.services.httpd.user;
+ WorkingDirectory = "/var/lib/mailman-web";
+ };
+ };
+
+ systemd.services.hyperkitty-yearly = {
+ enable = cfg.hyperkittyApiKey != null;
+ description = "Trigger yearly Hyperkitty events";
+ startAt = "yearly";
+ serviceConfig = {
+ ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs yearly";
+ User = config.services.httpd.user;
+ WorkingDirectory = "/var/lib/mailman-web";
+ };
+ };
+
};
}
diff --git a/nixos/modules/services/mail/opendkim.nix b/nixos/modules/services/mail/opendkim.nix
index 253823cbaf9c0274250f9b92eb8c4dfbb6b2b4f1..6431531d5eb6f131a0275e56707d79be9e9518eb 100644
--- a/nixos/modules/services/mail/opendkim.nix
+++ b/nixos/modules/services/mail/opendkim.nix
@@ -18,6 +18,9 @@ let
] ++ optionals (cfg.configFile != null) [ "-x" cfg.configFile ];
in {
+ imports = [
+ (mkRenamedOptionModule [ "services" "opendkim" "keyFile" ] [ "services" "opendkim" "keyPath" ])
+ ];
###### interface
diff --git a/nixos/modules/services/mail/opensmtpd.nix b/nixos/modules/services/mail/opensmtpd.nix
index a870550ba50b30a25677475399ab2da0fa42c7bd..1fabe2da45c5060c86b83033318b11aaeeb3ef37 100644
--- a/nixos/modules/services/mail/opensmtpd.nix
+++ b/nixos/modules/services/mail/opensmtpd.nix
@@ -101,6 +101,12 @@ in {
};
};
+ systemd.tmpfiles.rules = [
+ "d /var/spool/smtpd 711 root - - -"
+ "d /var/spool/smtpd/offline 770 root smtpq - -"
+ "d /var/spool/smtpd/purge 700 smtpq root - -"
+ ];
+
systemd.services.opensmtpd = let
procEnv = pkgs.buildEnv {
name = "opensmtpd-procs";
@@ -110,18 +116,6 @@ in {
in {
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
- preStart = ''
- mkdir -p /var/spool/smtpd
- chmod 711 /var/spool/smtpd
-
- mkdir -p /var/spool/smtpd/offline
- chown root.smtpq /var/spool/smtpd/offline
- chmod 770 /var/spool/smtpd/offline
-
- mkdir -p /var/spool/smtpd/purge
- chown smtpq.root /var/spool/smtpd/purge
- chmod 700 /var/spool/smtpd/purge
- '';
serviceConfig.ExecStart = "${cfg.package}/sbin/smtpd -d -f ${conf} ${args}";
environment.OPENSMTPD_PROC_PATH = "${procEnv}/libexec/opensmtpd";
};
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index d5fd76da970baf62e1fed0b6ae3dc9c6f2e83edb..df438a0c69d197cc212088e81a5334e300fe46e9 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -631,6 +631,14 @@ in
setgid = true;
};
+ security.wrappers.mailq = {
+ program = "mailq";
+ source = "${pkgs.postfix}/bin/mailq";
+ group = setgidGroup;
+ setuid = false;
+ setgid = true;
+ };
+
security.wrappers.postqueue = {
program = "postqueue";
source = "${pkgs.postfix}/bin/postqueue";
diff --git a/nixos/modules/services/mail/postgrey.nix b/nixos/modules/services/mail/postgrey.nix
index 88fb7f0b4ad178b407f3149acb9e0b128e5979b6..709f6b21aa0ada78e756102c03cc8ef1356cf5f7 100644
--- a/nixos/modules/services/mail/postgrey.nix
+++ b/nixos/modules/services/mail/postgrey.nix
@@ -42,6 +42,17 @@ with lib; let
};
in {
+ imports = [
+ (mkMergedOptionModule [ [ "services" "postgrey" "inetAddr" ] [ "services" "postgrey" "inetPort" ] ] [ "services" "postgrey" "socket" ] (config: let
+ value = p: getAttrFromPath p config;
+ inetAddr = [ "services" "postgrey" "inetAddr" ];
+ inetPort = [ "services" "postgrey" "inetPort" ];
+ in
+ if value inetAddr == null
+ then { path = "/run/postgrey.sock"; }
+ else { addr = value inetAddr; port = value inetPort; }
+ ))
+ ];
options = {
services.postgrey = with types; {
diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index bdedfa1bb7017c6cf27328e319517f0b2c32115c..36dda619ad06335a76c16a256efd35537d2d8db1 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -160,7 +160,7 @@ in
${pkgs.sudo}/bin/sudo -u ${pgSuperUser} psql postgres -c "create role ${cfg.database.username} with login password '${cfg.database.password}'";
${pkgs.sudo}/bin/sudo -u ${pgSuperUser} psql postgres -c "create database ${cfg.database.dbname} with owner ${cfg.database.username}";
fi
- PGPASSWORD=${cfg.database.password} ${pkgs.postgresql}/bin/psql -U ${cfg.database.username} \
+ PGPASSWORD="${cfg.database.password}" ${pkgs.postgresql}/bin/psql -U ${cfg.database.username} \
-f ${cfg.package}/SQL/postgres.initial.sql \
-h ${cfg.database.host} ${cfg.database.dbname}
touch /var/lib/roundcube/db-created
diff --git a/nixos/modules/services/mail/rspamd.nix b/nixos/modules/services/mail/rspamd.nix
index 89aa9d17ff7f65c9ac43b1fca099a25fd0d1943a..f156595e6f88bee9ea8df48d5c28792a5e62b7b1 100644
--- a/nixos/modules/services/mail/rspamd.nix
+++ b/nixos/modules/services/mail/rspamd.nix
@@ -60,7 +60,7 @@ let
};
type = mkOption {
type = types.nullOr (types.enum [
- "normal" "controller" "fuzzy_storage" "rspamd_proxy" "lua" "proxy"
+ "normal" "controller" "fuzzy" "rspamd_proxy" "lua" "proxy"
]);
description = ''
The type of this worker. The type proxy is
@@ -68,7 +68,7 @@ let
replaced with rspamd_proxy.
'';
apply = let
- from = "services.rspamd.workers.\”${name}\".type";
+ from = "services.rspamd.workers.\"${name}\".type";
files = options.type.files;
warning = "The option `${from}` defined in ${showFiles files} has enum value `proxy` which has been renamed to `rspamd_proxy`";
in x: if x == "proxy" then traceWarning warning "rspamd_proxy" else x;
@@ -220,7 +220,6 @@ let
in
{
-
###### interface
options = {
@@ -414,5 +413,6 @@ in
"Socket activation never worked correctly and could at this time not be fixed and so was removed")
(mkRenamedOptionModule [ "services" "rspamd" "bindSocket" ] [ "services" "rspamd" "workers" "normal" "bindSockets" ])
(mkRenamedOptionModule [ "services" "rspamd" "bindUISocket" ] [ "services" "rspamd" "workers" "controller" "bindSockets" ])
+ (mkRemovedOptionModule [ "services" "rmilter" ] "Use services.rspamd.* instead to set up milter service")
];
}
diff --git a/nixos/modules/services/mail/rss2email.nix b/nixos/modules/services/mail/rss2email.nix
index df454abc826719ff0b5a6029078fe891afe68bfb..c1e5964c4536d8e5149e66c7b487b7fd174c49d5 100644
--- a/nixos/modules/services/mail/rss2email.nix
+++ b/nixos/modules/services/mail/rss2email.nix
@@ -43,9 +43,8 @@ in {
[DEFAULT] block along with the
to parameter.
- See
- https://github.com/rss2email/rss2email/blob/master/r2e.1
- for more information on which parameters are accepted.
+ See man r2e for more information on which
+ parameters are accepted.
'';
};
diff --git a/nixos/modules/services/misc/airsonic.nix b/nixos/modules/services/misc/airsonic.nix
index 919d3b2f6e6406e1bcc6160bac39ffed7e549b59..c296e048cea41507576276b842167777eeb1aa15 100644
--- a/nixos/modules/services/misc/airsonic.nix
+++ b/nixos/modules/services/misc/airsonic.nix
@@ -148,6 +148,7 @@ in {
name = cfg.user;
home = cfg.home;
createHome = true;
+ isSystemUser = true;
};
};
}
diff --git a/nixos/modules/services/misc/apache-kafka.nix b/nixos/modules/services/misc/apache-kafka.nix
index 798e902ccae429f89af2b91ccd6dbec8048c2830..46308f74dc915571ed862ccb00b8a8f065f99e73 100644
--- a/nixos/modules/services/misc/apache-kafka.nix
+++ b/nixos/modules/services/misc/apache-kafka.nix
@@ -131,7 +131,7 @@ in {
home = head cfg.logDirs;
};
- systemd.tmpfiles.rules = map (logDir: "d '${logDir} 0700 apache-kafka - - -") cfg.logDirs;
+ systemd.tmpfiles.rules = map (logDir: "d '${logDir}' 0700 apache-kafka - - -") cfg.logDirs;
systemd.services.apache-kafka = {
description = "Apache Kafka Daemon";
diff --git a/nixos/modules/services/misc/beanstalkd.nix b/nixos/modules/services/misc/beanstalkd.nix
index 06e881406b52aaaebeb24eb6f0246e93a877e80b..bcd133c97411e136dbb40d54753102653834eafa 100644
--- a/nixos/modules/services/misc/beanstalkd.nix
+++ b/nixos/modules/services/misc/beanstalkd.nix
@@ -44,7 +44,8 @@ in
serviceConfig = {
DynamicUser = true;
Restart = "always";
- ExecStart = "${pkg}/bin/beanstalkd -l ${cfg.listen.address} -p ${toString cfg.listen.port}";
+ ExecStart = "${pkg}/bin/beanstalkd -l ${cfg.listen.address} -p ${toString cfg.listen.port} -b $STATE_DIRECTORY";
+ StateDirectory = "beanstalkd";
};
};
diff --git a/nixos/modules/services/misc/docker-registry.nix b/nixos/modules/services/misc/docker-registry.nix
index c87607d2666af959d27144891c5197c201fda94c..89bac4f47d73659766b1d6112e31fcdcc8778168 100644
--- a/nixos/modules/services/misc/docker-registry.nix
+++ b/nixos/modules/services/misc/docker-registry.nix
@@ -145,11 +145,13 @@ in {
};
users.users.docker-registry =
- if cfg.storagePath != null
+ (if cfg.storagePath != null
then {
createHome = true;
home = cfg.storagePath;
}
- else {};
+ else {}) // {
+ isSystemUser = true;
+ };
};
}
diff --git a/nixos/modules/services/misc/dysnomia.nix b/nixos/modules/services/misc/dysnomia.nix
index 9402d5cd801c0c0d3ca723373f2c34383408a3d2..33a6fb15264165e105daacaf9af861b1fdd52b3b 100644
--- a/nixos/modules/services/misc/dysnomia.nix
+++ b/nixos/modules/services/misc/dysnomia.nix
@@ -151,6 +151,7 @@ in
enableSubversionRepository = config.services.svnserve.enable;
enableTomcatWebApplication = config.services.tomcat.enable;
enableMongoDatabase = config.services.mongodb.enable;
+ enableInfluxDatabase = config.services.influxdb.enable;
});
dysnomia.properties = {
diff --git a/nixos/modules/services/misc/errbot.nix b/nixos/modules/services/misc/errbot.nix
index 256adce2f02e1428253ce36bb3502924033de85d..b447ba5d438d2857072524b60c0107c4d0e589f5 100644
--- a/nixos/modules/services/misc/errbot.nix
+++ b/nixos/modules/services/misc/errbot.nix
@@ -76,7 +76,10 @@ in {
};
config = mkIf (cfg.instances != {}) {
- users.users.errbot.group = "errbot";
+ users.users.errbot = {
+ group = "errbot";
+ isSystemUser = true;
+ };
users.groups.errbot = {};
systemd.services = mapAttrs' (name: instanceCfg: nameValuePair "errbot-${name}" (
diff --git a/nixos/modules/services/misc/ethminer.nix b/nixos/modules/services/misc/ethminer.nix
index 2958cf2144735f0aac38a1028fd315b8b277cca9..95afb0460fb8ea38bcee00bd70f4d3e9e574f716 100644
--- a/nixos/modules/services/misc/ethminer.nix
+++ b/nixos/modules/services/misc/ethminer.nix
@@ -71,7 +71,7 @@ in
maxPower = mkOption {
type = types.int;
- default = 115;
+ default = 113;
description = "Miner max watt usage.";
};
@@ -92,7 +92,9 @@ in
serviceConfig = {
DynamicUser = true;
+ ExecStartPre = "${pkgs.ethminer}/bin/.ethminer-wrapped --list-devices";
ExecStartPost = optional (cfg.toolkit == "cuda") "+${getBin config.boot.kernelPackages.nvidia_x11}/bin/nvidia-smi -pl ${toString cfg.maxPower}";
+ Restart = "always";
};
environment = {
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 59c1c104b9b92e76fc0c0e7da7736ca12a31c784..258476dd9feb3933cdfcc1e384b9eadd99378e14 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -322,6 +322,7 @@ in
"d '${cfg.stateDir}/conf' - ${cfg.user} gitea - -"
"d '${cfg.stateDir}/custom' - ${cfg.user} gitea - -"
"d '${cfg.stateDir}/custom/conf' - ${cfg.user} gitea - -"
+ "d '${cfg.stateDir}/log' - ${cfg.user} gitea - -"
"d '${cfg.repositoryRoot}' - ${cfg.user} gitea - -"
"Z '${cfg.stateDir}' - ${cfg.user} gitea - -"
@@ -393,6 +394,26 @@ in
WorkingDirectory = cfg.stateDir;
ExecStart = "${gitea.bin}/bin/gitea web";
Restart = "always";
+
+ # Filesystem
+ ProtectHome = true;
+ PrivateDevices = true;
+ ProtectKernelTunables = true;
+ ProtectKernelModules = true;
+ ProtectControlGroups = true;
+ ReadWritePaths = cfg.stateDir;
+ # Caps
+ CapabilityBoundingSet = "";
+ NoNewPrivileges = true;
+ # Misc.
+ LockPersonality = true;
+ RestrictRealtime = true;
+ PrivateMounts = true;
+ PrivateUsers = true;
+ MemoryDenyWriteExecute = true;
+ SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @raw-io @reboot @resources @setuid @swap";
+ SystemCallArchitectures = "native";
+ RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
};
environment = {
@@ -408,6 +429,7 @@ in
home = cfg.stateDir;
useDefaultShell = true;
group = "gitea";
+ isSystemUser = true;
};
};
@@ -451,4 +473,5 @@ in
timerConfig.OnCalendar = cfg.dump.interval;
};
};
+ meta.maintainers = with lib.maintainers; [ srhb ];
}
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index caef4ad4ea80cf7625c02f06032cf49c5f62ab6b..61d0ce0aef8ce4159c2a2ab299e8a9784ee23fb2 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -1,7 +1,5 @@
{ config, lib, pkgs, utils, ... }:
-# TODO: support non-postgresql
-
with lib;
let
@@ -9,6 +7,11 @@ let
ruby = cfg.packages.gitlab.ruby;
+ postgresqlPackage = if config.services.postgresql.enable then
+ config.services.postgresql.package
+ else
+ pkgs.postgresql;
+
gitlabSocket = "${cfg.statePath}/tmp/sockets/gitlab.socket";
gitalySocket = "${cfg.statePath}/tmp/sockets/gitaly.socket";
pathUrlQuote = url: replaceStrings ["/"] ["%2F"] url;
@@ -24,6 +27,9 @@ let
} // cfg.extraDatabaseConfig;
};
+ # We only want to create a database if we're actually going to connect to it.
+ databaseActuallyCreateLocally = cfg.databaseCreateLocally && cfg.databaseHost == "";
+
gitalyToml = pkgs.writeText "gitaly.toml" ''
socket_path = "${lib.escape ["\""] gitalySocket}"
bin_dir = "${cfg.packages.gitaly}/bin"
@@ -140,7 +146,7 @@ let
mkdir -p $out/bin
makeWrapper ${cfg.packages.gitlab.rubyEnv}/bin/rake $out/bin/gitlab-rake \
${concatStrings (mapAttrsToList (name: value: "--set ${name} '${value}' ") gitlabEnv)} \
- --set PATH '${lib.makeBinPath [ pkgs.nodejs pkgs.gzip pkgs.git pkgs.gnutar config.services.postgresql.package pkgs.coreutils pkgs.procps ]}:$PATH' \
+ --set PATH '${lib.makeBinPath [ pkgs.nodejs pkgs.gzip pkgs.git pkgs.gnutar postgresqlPackage pkgs.coreutils pkgs.procps ]}:$PATH' \
--set RAKEOPT '-f ${cfg.packages.gitlab}/share/gitlab/Rakefile' \
--run 'cd ${cfg.packages.gitlab}/share/gitlab'
'';
@@ -155,7 +161,7 @@ let
mkdir -p $out/bin
makeWrapper ${cfg.packages.gitlab.rubyEnv}/bin/rails $out/bin/gitlab-rails \
${concatStrings (mapAttrsToList (name: value: "--set ${name} '${value}' ") gitlabEnv)} \
- --set PATH '${lib.makeBinPath [ pkgs.nodejs pkgs.gzip pkgs.git pkgs.gnutar config.services.postgresql.package pkgs.coreutils pkgs.procps ]}:$PATH' \
+ --set PATH '${lib.makeBinPath [ pkgs.nodejs pkgs.gzip pkgs.git pkgs.gnutar postgresqlPackage pkgs.coreutils pkgs.procps ]}:$PATH' \
--run 'cd ${cfg.packages.gitlab}/share/gitlab'
'';
};
@@ -183,6 +189,11 @@ let
in {
+ imports = [
+ (mkRenamedOptionModule [ "services" "gitlab" "stateDir" ] [ "services" "gitlab" "statePath" ])
+ (mkRemovedOptionModule [ "services" "gitlab" "satelliteDir" ] "")
+ ];
+
options = {
services.gitlab = {
enable = mkOption {
@@ -225,7 +236,15 @@ in {
statePath = mkOption {
type = types.str;
default = "/var/gitlab/state";
- description = "Gitlab state directory, logs are stored here.";
+ description = ''
+ Gitlab state directory. Configuration, repositories and
+ logs, among other things, are stored here.
+
+ The directory will be created automatically if it doesn't
+ exist already. Its parent directories must be owned by
+ either root or the user set in
+ .
+ '';
};
backupPath = mkOption {
@@ -260,8 +279,8 @@ in {
description = ''
Whether a database should be automatically created on the
local host. Set this to false if you plan
- on provisioning a local database yourself or use an external
- one.
+ on provisioning a local database yourself. This has no effect
+ if is customized.
'';
};
@@ -551,8 +570,8 @@ in {
assertions = [
{
- assertion = cfg.databaseCreateLocally -> (cfg.user == cfg.databaseUsername);
- message = "For local automatic database provisioning services.gitlab.user and services.gitlab.databaseUsername should be identical.";
+ assertion = databaseActuallyCreateLocally -> (cfg.user == cfg.databaseUsername);
+ message = ''For local automatic database provisioning (services.gitlab.databaseCreateLocally == true) with peer authentication (services.gitlab.databaseHost == "") to work services.gitlab.user and services.gitlab.databaseUsername must be identical.'';
}
{
assertion = (cfg.databaseHost != "") -> (cfg.databasePasswordFile != null);
@@ -586,14 +605,16 @@ in {
services.redis.enable = mkDefault true;
# We use postgres as the main data store.
- services.postgresql = optionalAttrs cfg.databaseCreateLocally {
+ services.postgresql = optionalAttrs databaseActuallyCreateLocally {
enable = true;
ensureUsers = singleton { name = cfg.databaseUsername; };
};
# The postgresql module doesn't currently support concepts like
# objects owners and extensions; for now we tack on what's needed
# here.
- systemd.services.postgresql.postStart = mkAfter (optionalString cfg.databaseCreateLocally ''
+ systemd.services.postgresql.postStart = mkAfter (optionalString databaseActuallyCreateLocally ''
+ set -eu
+
$PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.databaseName}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${cfg.databaseName}" OWNER "${cfg.databaseUsername}"'
current_owner=$($PSQL -tAc "SELECT pg_catalog.pg_get_userbyid(datdba) FROM pg_catalog.pg_database WHERE datname = '${cfg.databaseName}'")
if [[ "$current_owner" != "${cfg.databaseUsername}" ]]; then
@@ -635,7 +656,7 @@ in {
"d ${cfg.statePath} 0750 ${cfg.user} ${cfg.group} -"
"d ${cfg.statePath}/builds 0750 ${cfg.user} ${cfg.group} -"
"d ${cfg.statePath}/config 0750 ${cfg.user} ${cfg.group} -"
- "D ${cfg.statePath}/config/initializers 0750 ${cfg.user} ${cfg.group} -"
+ "d ${cfg.statePath}/config/initializers 0750 ${cfg.user} ${cfg.group} -"
"d ${cfg.statePath}/db 0750 ${cfg.user} ${cfg.group} -"
"d ${cfg.statePath}/log 0750 ${cfg.user} ${cfg.group} -"
"d ${cfg.statePath}/repositories 2770 ${cfg.user} ${cfg.group} -"
@@ -652,7 +673,6 @@ in {
"d ${gitlabConfig.production.shared.path}/artifacts 0750 ${cfg.user} ${cfg.group} -"
"d ${gitlabConfig.production.shared.path}/lfs-objects 0750 ${cfg.user} ${cfg.group} -"
"d ${gitlabConfig.production.shared.path}/pages 0750 ${cfg.user} ${cfg.group} -"
- "L+ ${cfg.statePath}/lib - - - - ${cfg.packages.gitlab}/share/gitlab/lib"
"L+ /run/gitlab/config - - - - ${cfg.statePath}/config"
"L+ /run/gitlab/log - - - - ${cfg.statePath}/log"
"L+ /run/gitlab/tmp - - - - ${cfg.statePath}/tmp"
@@ -669,12 +689,16 @@ in {
wantedBy = [ "multi-user.target" ];
environment = gitlabEnv;
path = with pkgs; [
- config.services.postgresql.package
+ postgresqlPackage
gitAndTools.git
ruby
openssh
nodejs
gnupg
+
+ # Needed for GitLab project imports
+ gnutar
+ gzip
];
serviceConfig = {
Type = "simple";
@@ -722,7 +746,6 @@ in {
gitlab-workhorse
];
serviceConfig = {
- PermissionsStartOnly = true; # preStart must be run as root
Type = "simple";
User = cfg.user;
Group = cfg.group;
@@ -746,89 +769,109 @@ in {
wantedBy = [ "multi-user.target" ];
environment = gitlabEnv;
path = with pkgs; [
- config.services.postgresql.package
+ postgresqlPackage
gitAndTools.git
openssh
nodejs
procps
gnupg
];
- preStart = ''
- cp -f ${cfg.packages.gitlab}/share/gitlab/VERSION ${cfg.statePath}/VERSION
- rm -rf ${cfg.statePath}/db/*
- cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/config.dist/* ${cfg.statePath}/config
- cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/db/* ${cfg.statePath}/db
-
- ${cfg.packages.gitlab-shell}/bin/install
-
- ${optionalString cfg.smtp.enable ''
- install -m u=rw ${smtpSettings} ${cfg.statePath}/config/initializers/smtp_settings.rb
- ${optionalString (cfg.smtp.passwordFile != null) ''
- smtp_password=$(<'${cfg.smtp.passwordFile}')
- ${pkgs.replace}/bin/replace-literal -e '@smtpPassword@' "$smtp_password" '${cfg.statePath}/config/initializers/smtp_settings.rb'
- ''}
- ''}
- (
- umask u=rwx,g=,o=
+ serviceConfig = {
+ Type = "simple";
+ User = cfg.user;
+ Group = cfg.group;
+ TimeoutSec = "infinity";
+ Restart = "on-failure";
+ WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab";
+ ExecStartPre = let
+ preStartFullPrivileges = ''
+ shopt -s dotglob nullglob
+ set -eu
- ${pkgs.openssl}/bin/openssl rand -hex 32 > ${cfg.statePath}/gitlab_shell_secret
+ chown --no-dereference '${cfg.user}':'${cfg.group}' '${cfg.statePath}'/*
+ chown --no-dereference '${cfg.user}':'${cfg.group}' '${cfg.statePath}'/config/*
+ '';
+ preStart = ''
+ set -eu
- ${if cfg.databasePasswordFile != null then ''
- export db_password="$(<'${cfg.databasePasswordFile}')"
+ cp -f ${cfg.packages.gitlab}/share/gitlab/VERSION ${cfg.statePath}/VERSION
+ rm -rf ${cfg.statePath}/db/*
+ rm -rf ${cfg.statePath}/config/initializers/*
+ rm -f ${cfg.statePath}/lib
+ cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/config.dist/* ${cfg.statePath}/config
+ cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/db/* ${cfg.statePath}/db
- if [[ -z "$db_password" ]]; then
- >&2 echo "Database password was an empty string!"
- exit 1
- fi
+ ${cfg.packages.gitlab-shell}/bin/install
- ${pkgs.jq}/bin/jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
- '.production.password = $ENV.db_password' \
- >'${cfg.statePath}/config/database.yml'
- ''
- else ''
- ${pkgs.jq}/bin/jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
- >'${cfg.statePath}/config/database.yml'
- ''
- }
-
- ${utils.genJqSecretsReplacementSnippet
- gitlabConfig
- "${cfg.statePath}/config/gitlab.yml"
- }
-
- if [[ -h '${cfg.statePath}/config/secrets.yml' ]]; then
- rm '${cfg.statePath}/config/secrets.yml'
- fi
+ ${optionalString cfg.smtp.enable ''
+ install -m u=rw ${smtpSettings} ${cfg.statePath}/config/initializers/smtp_settings.rb
+ ${optionalString (cfg.smtp.passwordFile != null) ''
+ smtp_password=$(<'${cfg.smtp.passwordFile}')
+ ${pkgs.replace}/bin/replace-literal -e '@smtpPassword@' "$smtp_password" '${cfg.statePath}/config/initializers/smtp_settings.rb'
+ ''}
+ ''}
- export secret="$(<'${cfg.secrets.secretFile}')"
- export db="$(<'${cfg.secrets.dbFile}')"
- export otp="$(<'${cfg.secrets.otpFile}')"
- export jws="$(<'${cfg.secrets.jwsFile}')"
- ${pkgs.jq}/bin/jq -n '{production: {secret_key_base: $ENV.secret,
- otp_key_base: $ENV.db,
- db_key_base: $ENV.otp,
- openid_connect_signing_key: $ENV.jws}}' \
- > '${cfg.statePath}/config/secrets.yml'
- )
+ (
+ umask u=rwx,g=,o=
- initial_root_password="$(<'${cfg.initialRootPasswordFile}')"
- ${gitlab-rake}/bin/gitlab-rake gitlab:db:configure GITLAB_ROOT_PASSWORD="$initial_root_password" \
- GITLAB_ROOT_EMAIL='${cfg.initialRootEmail}'
+ ${pkgs.openssl}/bin/openssl rand -hex 32 > ${cfg.statePath}/gitlab_shell_secret
- # We remove potentially broken links to old gitlab-shell versions
- rm -Rf ${cfg.statePath}/repositories/**/*.git/hooks
+ if [[ -h '${cfg.statePath}/config/database.yml' ]]; then
+ rm '${cfg.statePath}/config/database.yml'
+ fi
- ${pkgs.git}/bin/git config --global core.autocrlf "input"
- '';
+ ${if cfg.databasePasswordFile != null then ''
+ export db_password="$(<'${cfg.databasePasswordFile}')"
+
+ if [[ -z "$db_password" ]]; then
+ >&2 echo "Database password was an empty string!"
+ exit 1
+ fi
+
+ ${pkgs.jq}/bin/jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
+ '.production.password = $ENV.db_password' \
+ >'${cfg.statePath}/config/database.yml'
+ ''
+ else ''
+ ${pkgs.jq}/bin/jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
+ >'${cfg.statePath}/config/database.yml'
+ ''
+ }
+
+ ${utils.genJqSecretsReplacementSnippet
+ gitlabConfig
+ "${cfg.statePath}/config/gitlab.yml"
+ }
+
+ if [[ -h '${cfg.statePath}/config/secrets.yml' ]]; then
+ rm '${cfg.statePath}/config/secrets.yml'
+ fi
- serviceConfig = {
- Type = "simple";
- User = cfg.user;
- Group = cfg.group;
- TimeoutSec = "infinity";
- Restart = "on-failure";
- WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab";
+ export secret="$(<'${cfg.secrets.secretFile}')"
+ export db="$(<'${cfg.secrets.dbFile}')"
+ export otp="$(<'${cfg.secrets.otpFile}')"
+ export jws="$(<'${cfg.secrets.jwsFile}')"
+ ${pkgs.jq}/bin/jq -n '{production: {secret_key_base: $ENV.secret,
+ otp_key_base: $ENV.otp,
+ db_key_base: $ENV.db,
+ openid_connect_signing_key: $ENV.jws}}' \
+ > '${cfg.statePath}/config/secrets.yml'
+ )
+
+ initial_root_password="$(<'${cfg.initialRootPasswordFile}')"
+ ${gitlab-rake}/bin/gitlab-rake gitlab:db:configure GITLAB_ROOT_PASSWORD="$initial_root_password" \
+ GITLAB_ROOT_EMAIL='${cfg.initialRootEmail}' > /dev/null
+
+ # We remove potentially broken links to old gitlab-shell versions
+ rm -Rf ${cfg.statePath}/repositories/**/*.git/hooks
+
+ ${pkgs.git}/bin/git config --global core.autocrlf "input"
+ '';
+ in [
+ "+${pkgs.writeShellScript "gitlab-pre-start-full-privileges" preStartFullPrivileges}"
+ "${pkgs.writeShellScript "gitlab-pre-start" preStart}"
+ ];
ExecStart = "${cfg.packages.gitlab.rubyEnv}/bin/unicorn -c ${cfg.statePath}/config/unicorn.rb -E production";
};
diff --git a/nixos/modules/services/misc/gollum.nix b/nixos/modules/services/misc/gollum.nix
index 7653b415bf09452d12cf5da9391b95c113e8acc8..f4a9c72b1545ebd1faccd44e9aca8bd4c3b981d4 100644
--- a/nixos/modules/services/misc/gollum.nix
+++ b/nixos/modules/services/misc/gollum.nix
@@ -71,6 +71,7 @@ in
group = config.users.users.gollum.name;
description = "Gollum user";
createHome = false;
+ isSystemUser = true;
};
users.groups.gollum = { };
diff --git a/nixos/modules/services/misc/home-assistant.nix b/nixos/modules/services/misc/home-assistant.nix
index f1b3512467400b6c6e47ab68ef7f2bba3aaf5845..74702c97f551fae2591463543b7fc9bb4ea6e299 100644
--- a/nixos/modules/services/misc/home-assistant.nix
+++ b/nixos/modules/services/misc/home-assistant.nix
@@ -224,6 +224,7 @@ in {
KillSignal = "SIGINT";
PrivateTmp = true;
RemoveIPC = true;
+ AmbientCapabilities = "cap_net_raw,cap_net_admin+eip";
};
path = [
"/run/wrappers" # needed for ping
diff --git a/nixos/modules/services/misc/jellyfin.nix b/nixos/modules/services/misc/jellyfin.nix
index 55559206568d94186d9075042fd27aaf3b29b225..6ecdfb57dc3582aaafb000cca6dd48eb50f78eaa 100644
--- a/nixos/modules/services/misc/jellyfin.nix
+++ b/nixos/modules/services/misc/jellyfin.nix
@@ -41,7 +41,10 @@ in
};
users.users = mkIf (cfg.user == "jellyfin") {
- jellyfin.group = cfg.group;
+ jellyfin = {
+ group = cfg.group;
+ isSystemUser = true;
+ };
};
users.groups = mkIf (cfg.group == "jellyfin") {
diff --git a/nixos/modules/services/misc/lidarr.nix b/nixos/modules/services/misc/lidarr.nix
index 40755c16217114e5f4e09b21c5879f26054bbeeb..8ff1adadcf2390cd572e333a634391ac0009558b 100644
--- a/nixos/modules/services/misc/lidarr.nix
+++ b/nixos/modules/services/misc/lidarr.nix
@@ -10,6 +10,12 @@ in
services.lidarr = {
enable = mkEnableOption "Lidarr";
+ dataDir = mkOption {
+ type = types.str;
+ default = "/var/lib/lidarr/.config/Lidarr";
+ description = "The directory where Lidarr stores its data files.";
+ };
+
package = mkOption {
type = types.package;
default = pkgs.lidarr;
@@ -44,6 +50,10 @@ in
};
config = mkIf cfg.enable {
+ systemd.tmpfiles.rules = [
+ "d '${cfg.dataDir}' 0700 ${cfg.user} ${cfg.group} - -"
+ ];
+
systemd.services.lidarr = {
description = "Lidarr";
after = [ "network.target" ];
@@ -53,11 +63,8 @@ in
Type = "simple";
User = cfg.user;
Group = cfg.group;
- ExecStart = "${cfg.package}/bin/Lidarr";
+ ExecStart = "${cfg.package}/bin/Lidarr -nobrowser -data='${cfg.dataDir}'";
Restart = "on-failure";
-
- StateDirectory = "lidarr";
- StateDirectoryMode = "0770";
};
};
diff --git a/nixos/modules/services/misc/mame.nix b/nixos/modules/services/misc/mame.nix
new file mode 100644
index 0000000000000000000000000000000000000000..c5d5e9e483719c8edbf26863d4968d7f9d7e854f
--- /dev/null
+++ b/nixos/modules/services/misc/mame.nix
@@ -0,0 +1,67 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.mame;
+ mame = "mame${lib.optionalString pkgs.stdenv.is64bit "64"}";
+in
+{
+ options = {
+ services.mame = {
+ enable = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Whether to setup TUN/TAP Ethernet interface for MAME emulator.
+ '';
+ };
+ user = mkOption {
+ type = types.str;
+ description = ''
+ User from which you run MAME binary.
+ '';
+ };
+ hostAddr = mkOption {
+ type = types.str;
+ description = ''
+ IP address of the host system. Usually an address of the main network
+ adapter or the adapter through which you get an internet connection.
+ '';
+ example = "192.168.31.156";
+ };
+ emuAddr = mkOption {
+ type = types.str;
+ description = ''
+ IP address of the guest system. The same you set inside guest OS under
+ MAME. Should be on the same subnet as .
+ '';
+ example = "192.168.31.155";
+ };
+ };
+ };
+
+ config = mkIf cfg.enable {
+ environment.systemPackages = [ pkgs.mame ];
+
+ security.wrappers."${mame}" = {
+ source = "${pkgs.mame}/bin/${mame}";
+ capabilities = "cap_net_admin,cap_net_raw+eip";
+ };
+
+ systemd.services.mame = {
+ description = "MAME TUN/TAP Ethernet interface";
+ after = [ "network.target" ];
+ wantedBy = [ "multi-user.target" ];
+ path = [ pkgs.iproute ];
+ serviceConfig = {
+ Type = "oneshot";
+ RemainAfterExit = true;
+ ExecStart = "${pkgs.mame}/bin/taputil.sh -c ${cfg.user} ${cfg.emuAddr} ${cfg.hostAddr} -";
+ ExecStop = "${pkgs.mame}/bin/taputil.sh -d ${cfg.user}";
+ };
+ };
+ };
+
+ meta.maintainers = with lib.maintainers; [ gnidorah ];
+}
diff --git a/nixos/modules/services/misc/matrix-synapse.nix b/nixos/modules/services/misc/matrix-synapse.nix
index 018fac386163d2a426b18bb9221d7ba29a60be39..0bda8980720d2c14d97a61c79f40de97b323d5b8 100644
--- a/nixos/modules/services/misc/matrix-synapse.nix
+++ b/nixos/modules/services/misc/matrix-synapse.nix
@@ -79,7 +79,11 @@ turn_user_lifetime: "${cfg.turn_user_lifetime}"
user_creation_max_duration: ${cfg.user_creation_max_duration}
bcrypt_rounds: ${cfg.bcrypt_rounds}
allow_guest_access: ${boolToString cfg.allow_guest_access}
-trusted_third_party_id_servers: ${builtins.toJSON cfg.trusted_third_party_id_servers}
+
+account_threepid_delegates:
+ ${optionalString (cfg.account_threepid_delegates.email != null) "email: ${cfg.account_threepid_delegates.email}"}
+ ${optionalString (cfg.account_threepid_delegates.msisdn != null) "msisdn: ${cfg.account_threepid_delegates.msisdn}"}
+
room_invite_state_types: ${builtins.toJSON cfg.room_invite_state_types}
${optionalString (cfg.macaroon_secret_key != null) ''
macaroon_secret_key: "${cfg.macaroon_secret_key}"
@@ -102,6 +106,7 @@ perspectives:
'') cfg.servers)}
}
}
+redaction_retention_period: ${toString cfg.redaction_retention_period}
app_service_config_files: ${builtins.toJSON cfg.app_service_config_files}
${cfg.extraConfig}
@@ -402,6 +407,9 @@ in {
"192.168.0.0/16"
"100.64.0.0/10"
"169.254.0.0/16"
+ "::1/128"
+ "fe80::/64"
+ "fc00::/7"
];
description = ''
List of IP address CIDR ranges that the URL preview spider is denied
@@ -552,14 +560,18 @@ in {
accessible to anonymous users.
'';
};
- trusted_third_party_id_servers = mkOption {
- type = types.listOf types.str;
- default = [
- "matrix.org"
- "vector.im"
- ];
+ account_threepid_delegates.email = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ description = ''
+ Delegate email sending to https://example.org
+ '';
+ };
+ account_threepid_delegates.msisdn = mkOption {
+ type = types.nullOr types.str;
+ default = null;
description = ''
- The list of identity servers trusted to verify third party identifiers by this server.
+ Delegate SMS sending to this local process (https://localhost:8090)
'';
};
room_invite_state_types = mkOption {
@@ -600,6 +612,13 @@ in {
A list of application service config file to use
'';
};
+ redaction_retention_period = mkOption {
+ type = types.int;
+ default = 7;
+ description = ''
+ How long to keep redacted events in unredacted form in the database.
+ '';
+ };
extraConfig = mkOption {
type = types.lines;
default = "";
@@ -652,43 +671,30 @@ in {
gid = config.ids.gids.matrix-synapse;
} ];
- services.postgresql.enable = mkIf usePostgresql (mkDefault true);
+ services.postgresql = mkIf (usePostgresql && cfg.create_local_database) {
+ enable = mkDefault true;
+ ensureDatabases = [ cfg.database_name ];
+ ensureUsers = [{
+ name = cfg.database_user;
+ ensurePermissions = { "DATABASE \"${cfg.database_name}\"" = "ALL PRIVILEGES"; };
+ }];
+ };
systemd.services.matrix-synapse = {
description = "Synapse Matrix homeserver";
- after = [ "network.target" "postgresql.service" ];
+ after = [ "network.target" ] ++ lib.optional config.services.postgresql.enable "postgresql.service" ;
wantedBy = [ "multi-user.target" ];
preStart = ''
${cfg.package}/bin/homeserver \
--config-path ${configFile} \
--keys-directory ${cfg.dataDir} \
--generate-keys
- '' + optionalString (usePostgresql && cfg.create_local_database) ''
- if ! test -e "${cfg.dataDir}/db-created"; then
- ${pkgs.sudo}/bin/sudo -u ${pg.superUser} \
- ${pg.package}/bin/createuser \
- --login \
- --no-createdb \
- --no-createrole \
- --encrypted \
- ${cfg.database_user}
- ${pkgs.sudo}/bin/sudo -u ${pg.superUser} \
- ${pg.package}/bin/createdb \
- --owner=${cfg.database_user} \
- --encoding=UTF8 \
- --lc-collate=C \
- --lc-ctype=C \
- --template=template0 \
- ${cfg.database_name}
- touch "${cfg.dataDir}/db-created"
- fi
'';
serviceConfig = {
Type = "notify";
User = "matrix-synapse";
Group = "matrix-synapse";
WorkingDirectory = cfg.dataDir;
- PermissionsStartOnly = true;
ExecStart = ''
${cfg.package}/bin/homeserver \
${ concatMapStringsSep "\n " (x: "--config-path ${x} \\") ([ configFile ] ++ cfg.extraConfigFiles) }
@@ -699,4 +705,12 @@ in {
};
};
};
+
+ imports = [
+ (mkRemovedOptionModule [ "services" "matrix-synapse" "trusted_third_party_id_servers" ] ''
+ The `trusted_third_party_id_servers` option as been removed in `matrix-synapse` v1.4.0
+ as the behavior is now obsolete.
+ '')
+ ];
+
}
diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix
index 3826f728afd0f4c93b7559b1e00389ee7217536e..24780446d50499fe7ac311c0631d323af098998d 100644
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@@ -10,7 +10,7 @@ let
nixVersion = getVersion nix;
- isNix20 = versionAtLeast nixVersion "2.0pre";
+ isNix23 = versionAtLeast nixVersion "2.3pre";
makeNixBuildUser = nr:
{ name = "nixbld${toString nr}";
@@ -27,43 +27,30 @@ let
nixbldUsers = map makeNixBuildUser (range 1 cfg.nrBuildUsers);
nixConf =
- let
- # In Nix < 2.0, If we're using sandbox for builds, then provide
- # /bin/sh in the sandbox as a bind-mount to bash. This means we
- # also need to include the entire closure of bash. Nix >= 2.0
- # provides a /bin/sh by default.
- sh = pkgs.runtimeShell;
- binshDeps = pkgs.writeReferencesToFile sh;
- in
- pkgs.runCommand "nix.conf" { preferLocalBuild = true; extraOptions = cfg.extraOptions; } (''
- ${optionalString (!isNix20) ''
- extraPaths=$(for i in $(cat ${binshDeps}); do if test -d $i; then echo $i; fi; done)
- ''}
+ assert versionAtLeast nixVersion "2.2";
+ pkgs.runCommand "nix.conf" { preferLocalBuild = true; extraOptions = cfg.extraOptions; } (
+ ''
cat > $out </dev/null
+ NIX_CONF_DIR=$PWD ${cfg.package}/bin/nix show-config ${optionalString isNix23 "--no-net --option experimental-features nix-command"} >/dev/null
'')
);
in
{
+ imports = [
+ (mkRenamedOptionModule [ "nix" "useChroot" ] [ "nix" "useSandbox" ])
+ (mkRenamedOptionModule [ "nix" "chrootDirs" ] [ "nix" "sandboxPaths" ])
+ ];
###### interface
@@ -165,8 +156,8 @@ in
type = types.lines;
default = "";
example = ''
- gc-keep-outputs = true
- gc-keep-derivations = true
+ keep-outputs = true
+ keep-derivations = true
'';
description = "Additional text appended to nix.conf.";
};
@@ -421,8 +412,7 @@ in
systemd.services.nix-daemon =
{ path = [ nix pkgs.utillinux config.programs.ssh.package ]
- ++ optionals cfg.distributedBuilds [ pkgs.gzip ]
- ++ optionals (!isNix20) [ pkgs.openssl.bin ];
+ ++ optionals cfg.distributedBuilds [ pkgs.gzip ];
environment = cfg.envVars
// { CURL_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt"; }
@@ -439,34 +429,13 @@ in
restartTriggers = [ nixConf ];
};
- nix.envVars =
- optionalAttrs (!isNix20) {
- NIX_CONF_DIR = "/etc/nix";
-
- # Enable the copy-from-other-stores substituter, which allows
- # builds to be sped up by copying build results from remote
- # Nix stores. To do this, mount the remote file system on a
- # subdirectory of /run/nix/remote-stores.
- NIX_OTHER_STORES = "/run/nix/remote-stores/*/nix";
- }
-
- // optionalAttrs (cfg.distributedBuilds && !isNix20) {
- NIX_BUILD_HOOK = "${nix}/libexec/nix/build-remote.pl";
- };
-
# Set up the environment variables for running Nix.
environment.sessionVariables = cfg.envVars //
{ NIX_PATH = cfg.nixPath;
};
- environment.extraInit = optionalString (!isNix20)
+ environment.extraInit =
''
- # Set up secure multi-user builds: non-root users build through the
- # Nix daemon.
- if [ "$USER" != root -o ! -w /nix/var/nix/db ]; then
- export NIX_REMOTE=daemon
- fi
- '' + ''
if [ -e "$HOME/.nix-defexpr/channels" ]; then
export NIX_PATH="$HOME/.nix-defexpr/channels''${NIX_PATH:+:$NIX_PATH}"
fi
@@ -478,21 +447,15 @@ in
services.xserver.displayManager.hiddenUsers = map ({ name, ... }: name) nixbldUsers;
- # FIXME: use systemd-tmpfiles to create Nix directories.
system.activationScripts.nix = stringAfter [ "etc" "users" ]
''
- # Nix initialisation.
- install -m 0755 -d \
- /nix/var/nix/gcroots \
- /nix/var/nix/temproots \
- /nix/var/nix/userpool \
- /nix/var/nix/profiles \
- /nix/var/nix/db \
- /nix/var/log/nix/drvs
- install -m 1777 -d \
- /nix/var/nix/gcroots/per-user \
- /nix/var/nix/profiles/per-user \
- /nix/var/nix/gcroots/tmp
+ # Create directories in /nix.
+ ${nix}/bin/nix ping-store --no-net
+
+ # Subscribe the root user to the NixOS channel by default.
+ if [ ! -e "/root/.nix-channels" ]; then
+ echo "${config.system.defaultChannel} nixos" > "/root/.nix-channels"
+ fi
'';
nix.systemFeatures = mkDefault (
diff --git a/nixos/modules/services/misc/nix-optimise.nix b/nixos/modules/services/misc/nix-optimise.nix
index 416529f690e0505567b6a75199a7d771effa5fdd..e02026d5f76c7e2c60ca5c52bbfc6905bd3f68e4 100644
--- a/nixos/modules/services/misc/nix-optimise.nix
+++ b/nixos/modules/services/misc/nix-optimise.nix
@@ -40,8 +40,8 @@ in
systemd.services.nix-optimise =
{ description = "Nix Store Optimiser";
- # No point running it inside a nixos-container. It should be on the host instead.
- unitConfig.ConditionVirtualization = "!container";
+ # No point this if the nix daemon (and thus the nix store) is outside
+ unitConfig.ConditionPathIsReadWrite = "/nix/var/nix/daemon-socket";
serviceConfig.ExecStart = "${config.nix.package}/bin/nix-store --optimise";
startAt = optionals cfg.automatic cfg.dates;
};
diff --git a/nixos/modules/services/misc/nzbget.nix b/nixos/modules/services/misc/nzbget.nix
index eb7b4c05d82d07401ba71b2ed9e046c4c0fa2464..715ec891cd689622cd4987373a0ad04a06942ac6 100644
--- a/nixos/modules/services/misc/nzbget.nix
+++ b/nixos/modules/services/misc/nzbget.nix
@@ -27,6 +27,12 @@ let
in
{
+ imports = [
+ (mkRemovedOptionModule [ "services" "misc" "nzbget" "configFile" ] "The configuration of nzbget is now managed by users through the web interface.")
+ (mkRemovedOptionModule [ "services" "misc" "nzbget" "dataDir" ] "The data directory for nzbget is now /var/lib/nzbget.")
+ (mkRemovedOptionModule [ "services" "misc" "nzbget" "openFirewall" ] "The port used by nzbget is managed through the web interface so you should adjust your firewall rules accordingly.")
+ ];
+
# interface
options = {
diff --git a/nixos/modules/services/misc/osrm.nix b/nixos/modules/services/misc/osrm.nix
index f89f37ccd9df5c3c628f30c28704a567ccf036a4..79c347ab7e0ef9dc23118828f29ce993a41c33af 100644
--- a/nixos/modules/services/misc/osrm.nix
+++ b/nixos/modules/services/misc/osrm.nix
@@ -59,6 +59,7 @@ in
group = config.users.users.osrm.name;
description = "OSRM user";
createHome = false;
+ isSystemUser = true;
};
users.groups.osrm = { };
diff --git a/nixos/modules/services/misc/parsoid.nix b/nixos/modules/services/misc/parsoid.nix
index c757093e5c1b2a972e7ef9948d98e2a594bb4806..61626e78f8b383141b300f4f4aafc61e4615f516 100644
--- a/nixos/modules/services/misc/parsoid.nix
+++ b/nixos/modules/services/misc/parsoid.nix
@@ -26,6 +26,10 @@ let
in
{
+ imports = [
+ (mkRemovedOptionModule [ "services" "parsoid" "interwikis" ] "Use services.parsoid.wikis instead")
+ ];
+
##### interface
options = {
diff --git a/nixos/modules/services/misc/pykms.nix b/nixos/modules/services/misc/pykms.nix
index ab00086e591e1db5fc32d914b3daaa0eac69f73f..25aa27ae767335327a225e5c4392f9738c5abe25 100644
--- a/nixos/modules/services/misc/pykms.nix
+++ b/nixos/modules/services/misc/pykms.nix
@@ -4,10 +4,15 @@ with lib;
let
cfg = config.services.pykms;
+ libDir = "/var/lib/pykms";
in {
meta.maintainers = with lib.maintainers; [ peterhoeg ];
+ imports = [
+ (mkRemovedOptionModule [ "services" "pykms" "verbose" ] "Use services.pykms.logLevel instead")
+ ];
+
options = {
services.pykms = {
enable = mkOption {
@@ -28,12 +33,6 @@ in {
description = "The port on which to listen.";
};
- verbose = mkOption {
- type = types.bool;
- default = false;
- description = "Show verbose output.";
- };
-
openFirewallPort = mkOption {
type = types.bool;
default = false;
@@ -45,30 +44,44 @@ in {
default = "64M";
description = "How much memory to use at most.";
};
+
+ logLevel = mkOption {
+ type = types.enum [ "CRITICAL" "ERROR" "WARNING" "INFO" "DEBUG" "MINI" ];
+ default = "INFO";
+ description = "How much to log";
+ };
+
+ extraArgs = mkOption {
+ type = types.listOf types.str;
+ default = [];
+ description = "Additional arguments";
+ };
};
};
config = mkIf cfg.enable {
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewallPort [ cfg.port ];
- systemd.services.pykms = let
- home = "/var/lib/pykms";
- in {
+ systemd.services.pykms = {
description = "Python KMS";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
# python programs with DynamicUser = true require HOME to be set
- environment.HOME = home;
+ environment.HOME = libDir;
serviceConfig = with pkgs; {
DynamicUser = true;
- StateDirectory = baseNameOf home;
- ExecStartPre = "${getBin pykms}/bin/create_pykms_db.sh ${home}/clients.db";
+ StateDirectory = baseNameOf libDir;
+ ExecStartPre = "${getBin pykms}/libexec/create_pykms_db.sh ${libDir}/clients.db";
ExecStart = lib.concatStringsSep " " ([
- "${getBin pykms}/bin/server.py"
+ "${getBin pykms}/bin/server"
+ "--logfile STDOUT"
+ "--loglevel ${cfg.logLevel}"
+ ] ++ cfg.extraArgs ++ [
cfg.listenAddress
(toString cfg.port)
- ] ++ lib.optional cfg.verbose "--verbose");
- WorkingDirectory = home;
+ ]);
+ ProtectHome = "tmpfs";
+ WorkingDirectory = libDir;
Restart = "on-failure";
MemoryLimit = cfg.memoryLimit;
};
diff --git a/nixos/modules/services/misc/redmine.nix b/nixos/modules/services/misc/redmine.nix
index 24b9e27ac2da5a1c0c258727a8c128647908842e..bf9a6914a48314a41114ae815936ee9ba60a5fb8 100644
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@@ -62,20 +62,11 @@ in
services.redmine = {
enable = mkEnableOption "Redmine";
- # default to the 4.x series not forcing major version upgrade of those on the 3.x series
package = mkOption {
type = types.package;
- default = if versionAtLeast config.system.stateVersion "19.03"
- then pkgs.redmine_4
- else pkgs.redmine
- ;
- defaultText = "pkgs.redmine";
- description = ''
- Which Redmine package to use. This defaults to version 3.x if
- system.stateVersion < 19.03 and version 4.x
- otherwise.
- '';
- example = "pkgs.redmine_4.override { ruby = pkgs.ruby_2_4; }";
+ default = pkgs.redmine;
+ description = "Which Redmine package to use.";
+ example = "pkgs.redmine.override { ruby = pkgs.ruby_2_4; }";
};
user = mkOption {
diff --git a/nixos/modules/services/misc/tautulli.nix b/nixos/modules/services/misc/tautulli.nix
index 50e450366478cda3958ab17618961925c573170e..aded33629f1c21cae539e12d68e9b1d93004c847 100644
--- a/nixos/modules/services/misc/tautulli.nix
+++ b/nixos/modules/services/misc/tautulli.nix
@@ -6,6 +6,10 @@ let
cfg = config.services.tautulli;
in
{
+ imports = [
+ (mkRenamedOptionModule [ "services" "plexpy" ] [ "services" "tautulli" ])
+ ];
+
options = {
services.tautulli = {
enable = mkEnableOption "Tautulli Plex Monitor";
diff --git a/nixos/modules/services/misc/zoneminder.nix b/nixos/modules/services/misc/zoneminder.nix
index 3bff04e7127d7933a4e1fbd8c07892483a09041f..d7f7324580c036be4a5a386857cedca33fb4b04a 100644
--- a/nixos/modules/services/misc/zoneminder.nix
+++ b/nixos/modules/services/misc/zoneminder.nix
@@ -265,7 +265,7 @@ in {
}
location /cache/ {
- alias /var/cache/${dirName};
+ alias /var/cache/${dirName}/;
}
location ~ \.php$ {
diff --git a/nixos/modules/services/monitoring/collectd.nix b/nixos/modules/services/monitoring/collectd.nix
index 6a4c678eb21f3029b7c36d8d0457ca48334c7e58..731ac743b7c631b8e6ba6ec192fe0b0a64e685e2 100644
--- a/nixos/modules/services/monitoring/collectd.nix
+++ b/nixos/modules/services/monitoring/collectd.nix
@@ -16,13 +16,29 @@ let
NotifyLevel "OKAY"
+ ${concatStrings (mapAttrsToList (plugin: pluginConfig: ''
+ LoadPlugin ${plugin}
+
+ ${pluginConfig}
+
+ '') cfg.plugins)}
+
${concatMapStrings (f: ''
- Include "${f}"
+ Include "${f}"
'') cfg.include}
${cfg.extraConfig}
'';
+ package =
+ if cfg.buildMinimalPackage
+ then minimalPackage
+ else cfg.package;
+
+ minimalPackage = cfg.package.override {
+ enabledPlugins = [ "syslog" ] ++ builtins.attrNames cfg.plugins;
+ };
+
in {
options.services.collectd = with types; {
enable = mkEnableOption "collectd agent";
@@ -33,7 +49,15 @@ in {
description = ''
Which collectd package to use.
'';
- type = package;
+ type = types.package;
+ };
+
+ buildMinimalPackage = mkOption {
+ default = false;
+ description = ''
+ Build a minimal collectd package with only the configured `services.collectd.plugins`
+ '';
+ type = types.bool;
};
user = mkOption {
@@ -68,6 +92,15 @@ in {
type = listOf str;
};
+ plugins = mkOption {
+ default = {};
+ example = { cpu = ""; memory = ""; network = "Server 192.168.1.1 25826"; };
+ description = ''
+ Attribute set of plugin names to plugin config segments
+ '';
+ type = types.attrsOf types.str;
+ };
+
extraConfig = mkOption {
default = "";
description = ''
@@ -89,7 +122,7 @@ in {
wantedBy = [ "multi-user.target" ];
serviceConfig = {
- ExecStart = "${cfg.package}/sbin/collectd -C ${conf} -f";
+ ExecStart = "${package}/sbin/collectd -C ${conf} -f";
User = cfg.user;
Restart = "on-failure";
RestartSec = 3;
@@ -98,6 +131,7 @@ in {
users.users = optional (cfg.user == "collectd") {
name = "collectd";
+ isSystemUser = true;
};
};
}
diff --git a/nixos/modules/services/monitoring/do-agent.nix b/nixos/modules/services/monitoring/do-agent.nix
new file mode 100644
index 0000000000000000000000000000000000000000..2d3fe2f7976878c6da7f1703371be1ab3af233ff
--- /dev/null
+++ b/nixos/modules/services/monitoring/do-agent.nix
@@ -0,0 +1,34 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.do-agent;
+in
+{
+ options.services.do-agent = {
+ enable = mkEnableOption "do-agent, the DigitalOcean droplet metrics agent";
+ };
+
+ config = mkIf cfg.enable {
+ environment.systemPackages = [ pkgs.do-agent ];
+
+ systemd.services.do-agent = {
+ description = "DigitalOcean Droplet Metrics Agent";
+ wantedBy = [ "multi-user.target" ];
+ after = [ "network-online.target" ];
+ wants = [ "network-online.target" ];
+ serviceConfig = {
+ ExecStart = "${pkgs.do-agent}/bin/do-agent --syslog";
+ Restart = "always";
+ OOMScoreAdjust = -900;
+ SyslogIdentifier = "DigitalOceanAgent";
+ PrivateTmp = "yes";
+ ProtectSystem = "full";
+ ProtectHome = "yes";
+ NoNewPrivileges = "yes";
+ DynamicUser = "yes";
+ };
+ };
+ };
+}
diff --git a/nixos/modules/services/monitoring/fusion-inventory.nix b/nixos/modules/services/monitoring/fusion-inventory.nix
index b90579bb70c76591cfb58f73c6e755b5045ebe4b..fe19ed5619542a0b66047a45bd6c6ad8f5ee8f16 100644
--- a/nixos/modules/services/monitoring/fusion-inventory.nix
+++ b/nixos/modules/services/monitoring/fusion-inventory.nix
@@ -49,6 +49,7 @@ in {
users.users = singleton {
name = "fusion-inventory";
description = "FusionInventory user";
+ isSystemUser = true;
};
systemd.services.fusion-inventory = {
diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix
index bf1084eecc3accc3a40c01592515f60f86b55a72..0f8bc2471e33501037619ad86ad04460c0a369c4 100644
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -43,7 +43,7 @@ let
ANALYTICS_REPORTING_ENABLED = boolToString cfg.analytics.reporting.enable;
- SMTP_ENABLE = boolToString cfg.smtp.enable;
+ SMTP_ENABLED = boolToString cfg.smtp.enable;
SMTP_HOST = cfg.smtp.host;
SMTP_USER = cfg.smtp.user;
SMTP_PASSWORD = cfg.smtp.password;
diff --git a/nixos/modules/services/monitoring/graphite.nix b/nixos/modules/services/monitoring/graphite.nix
index 64cb6c3da1e572c9af8777d0774bf12bb81081ad..f7874af3df29c5f60885e99b2fe97561440a1c5d 100644
--- a/nixos/modules/services/monitoring/graphite.nix
+++ b/nixos/modules/services/monitoring/graphite.nix
@@ -239,7 +239,7 @@ in {
description = "Any metrics received which match one of the experssions will be dropped.";
default = null;
type = types.nullOr types.str;
- example = "^some\.noisy\.metric\.prefix\..*";
+ example = "^some\\.noisy\\.metric\\.prefix\\..*";
};
whitelist = mkOption {
diff --git a/nixos/modules/services/monitoring/nagios.nix b/nixos/modules/services/monitoring/nagios.nix
index 6a3b977694620cd4a0d5e60978dcb418e5fc7c90..94f378bebc34a939bad155fc51d34b25897305e1 100644
--- a/nixos/modules/services/monitoring/nagios.nix
+++ b/nixos/modules/services/monitoring/nagios.nix
@@ -8,6 +8,7 @@ let
nagiosState = "/var/lib/nagios";
nagiosLogDir = "/var/log/nagios";
+ urlPath = "/nagios";
nagiosObjectDefs = cfg.objectDefs;
@@ -16,32 +17,39 @@ let
preferLocalBuild = true;
} "mkdir -p $out; ln -s $nagiosObjectDefs $out/";
- nagiosCfgFile = pkgs.writeText "nagios.cfg"
- ''
- # Paths for state and logs.
- log_file=${nagiosLogDir}/current
- log_archive_path=${nagiosLogDir}/archive
- status_file=${nagiosState}/status.dat
- object_cache_file=${nagiosState}/objects.cache
- temp_file=${nagiosState}/nagios.tmp
- lock_file=/run/nagios.lock # Not used I think.
- state_retention_file=${nagiosState}/retention.dat
- query_socket=${nagiosState}/nagios.qh
- check_result_path=${nagiosState}
- command_file=${nagiosState}/nagios.cmd
-
- # Configuration files.
- #resource_file=resource.cfg
- cfg_dir=${nagiosObjectDefsDir}
-
- # Uid/gid that the daemon runs under.
- nagios_user=nagios
- nagios_group=nagios
-
- # Misc. options.
- illegal_macro_output_chars=`~$&|'"<>
- retain_state_information=1
- ''; # "
+ nagiosCfgFile = let
+ default = {
+ log_file="${nagiosLogDir}/current";
+ log_archive_path="${nagiosLogDir}/archive";
+ status_file="${nagiosState}/status.dat";
+ object_cache_file="${nagiosState}/objects.cache";
+ temp_file="${nagiosState}/nagios.tmp";
+ lock_file="/run/nagios.lock";
+ state_retention_file="${nagiosState}/retention.dat";
+ query_socket="${nagiosState}/nagios.qh";
+ check_result_path="${nagiosState}";
+ command_file="${nagiosState}/nagios.cmd";
+ cfg_dir="${nagiosObjectDefsDir}";
+ nagios_user="nagios";
+ nagios_group="nagios";
+ illegal_macro_output_chars="`~$&|'\"<>";
+ retain_state_information="1";
+ };
+ lines = mapAttrsToList (key: value: "${key}=${value}") (default // cfg.extraConfig);
+ content = concatStringsSep "\n" lines;
+ file = pkgs.writeText "nagios.cfg" content;
+ validated = pkgs.runCommand "nagios-checked.cfg" {preferLocalBuild=true;} ''
+ cp ${file} nagios.cfg
+ # nagios checks the existence of /var/lib/nagios, but
+ # it does not exists in the build sandbox, so we fake it
+ mkdir lib
+ lib=$(readlink -f lib)
+ sed -i s@=${nagiosState}@=$lib@ nagios.cfg
+ ${pkgs.nagios}/bin/nagios -v nagios.cfg && cp ${file} $out
+ '';
+ defaultCfgFile = if cfg.validateConfig then validated else file;
+ in
+ if cfg.mainConfigFile == null then defaultCfgFile else cfg.mainConfigFile;
# Plain configuration for the Nagios web-interface with no
# authentication.
@@ -49,12 +57,12 @@ let
''
main_config_file=${cfg.mainConfigFile}
use_authentication=0
- url_html_path=${cfg.urlPath}
+ url_html_path=${urlPath}
'';
extraHttpdConfig =
''
- ScriptAlias ${cfg.urlPath}/cgi-bin ${pkgs.nagios}/sbin
+ ScriptAlias ${urlPath}/cgi-bin ${pkgs.nagios}/sbin
Options ExecCGI
@@ -62,7 +70,7 @@ let
SetEnv NAGIOS_CGI_CONFIG ${cfg.cgiConfigFile}
- Alias ${cfg.urlPath} ${pkgs.nagios}/share
+ Alias ${urlPath} ${pkgs.nagios}/share
Options None
@@ -72,16 +80,15 @@ let
in
{
+ imports = [
+ (mkRemovedOptionModule [ "services" "nagios" "urlPath" ] "The urlPath option has been removed as it is hard coded to /nagios in the nagios package.")
+ ];
+
+ meta.maintainers = with lib.maintainers; [ symphorien ];
+
options = {
services.nagios = {
- enable = mkOption {
- default = false;
- description = "
- Whether to use Nagios to monitor
- your system or network.
- ";
- };
+ enable = mkEnableOption "Nagios to monitor your system or network.";
objectDefs = mkOption {
description = "
@@ -89,12 +96,14 @@ in
the hosts, host groups, services and contacts for the
network that you want Nagios to monitor.
";
+ type = types.listOf types.path;
+ example = literalExample "[ ./objects.cfg ]";
};
plugins = mkOption {
type = types.listOf types.package;
- default = [pkgs.nagiosPluginsOfficial pkgs.ssmtp];
- defaultText = "[pkgs.nagiosPluginsOfficial pkgs.ssmtp]";
+ default = with pkgs; [ nagiosPluginsOfficial ssmtp mailutils ];
+ defaultText = "[pkgs.nagiosPluginsOfficial pkgs.ssmtp pkgs.mailutils]";
description = "
Packages to be added to the Nagios PATH.
Typically used to add plugins, but can be anything.
@@ -102,14 +111,29 @@ in
};
mainConfigFile = mkOption {
- type = types.package;
- default = nagiosCfgFile;
- defaultText = "nagiosCfgFile";
+ type = types.nullOr types.package;
+ default = null;
description = "
- Derivation for the main configuration file of Nagios.
+ If non-null, overrides the main configuration file of Nagios.
";
};
+ extraConfig = mkOption {
+ type = types.attrsOf types.str;
+ example = {
+ debug_level = "-1";
+ debug_file = "/var/log/nagios/debug.log";
+ };
+ default = {};
+ description = "Configuration to add to /etc/nagios.cfg";
+ };
+
+ validateConfig = mkOption {
+ type = types.bool;
+ default = pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform;
+ description = "if true, the syntax of the nagios configuration file is checked at build time";
+ };
+
cgiConfigFile = mkOption {
type = types.package;
default = nagiosCGICfgFile;
@@ -121,6 +145,7 @@ in
};
enableWebInterface = mkOption {
+ type = types.bool;
default = false;
description = "
Whether to enable the Nagios web interface. You should also
@@ -128,13 +153,20 @@ in
";
};
- urlPath = mkOption {
- default = "/nagios";
- description = "
- The URL path under which the Nagios web interface appears.
- That is, you can access the Nagios web interface through
- http://server/urlPath.
- ";
+ virtualHost = mkOption {
+ type = types.submodule (import ../web-servers/apache-httpd/per-server-options.nix);
+ example = literalExample ''
+ { hostName = "example.org";
+ adminAddr = "webmaster@example.org";
+ enableSSL = true;
+ sslServerCert = "/var/lib/acme/example.org/full.pem";
+ sslServerKey = "/var/lib/acme/example.org/key.pem";
+ }
+ '';
+ description = ''
+ Apache configuration can be done by adapting .
+ See for further information.
+ '';
};
};
};
@@ -153,7 +185,7 @@ in
# This isn't needed, it's just so that the user can type "nagiostats
# -c /etc/nagios.cfg".
environment.etc = [
- { source = cfg.mainConfigFile;
+ { source = nagiosCfgFile;
target = "nagios.cfg";
}
];
@@ -161,7 +193,7 @@ in
environment.systemPackages = [ pkgs.nagios ];
systemd.services.nagios = {
description = "Nagios monitoring daemon";
- path = [ pkgs.nagios ];
+ path = [ pkgs.nagios ] ++ cfg.plugins;
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
@@ -172,16 +204,13 @@ in
RestartSec = 2;
LogsDirectory = "nagios";
StateDirectory = "nagios";
+ ExecStart = "${pkgs.nagios}/bin/nagios /etc/nagios.cfg";
+ X-ReloadIfChanged = nagiosCfgFile;
};
-
- script = ''
- for i in ${toString cfg.plugins}; do
- export PATH=$i/bin:$i/sbin:$i/libexec:$PATH
- done
- exec ${pkgs.nagios}/bin/nagios ${cfg.mainConfigFile}
- '';
};
- services.httpd.extraConfig = optionalString cfg.enableWebInterface extraHttpdConfig;
+ services.httpd.virtualHosts = optionalAttrs cfg.enableWebInterface {
+ ${cfg.virtualHost.hostName} = mkMerge [ cfg.virtualHost { extraConfig = extraHttpdConfig; } ];
+ };
};
}
diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix
index 463b1b882acf585f3f66ce9e7990d7a9348481a6..3ffde8e9bce225bf6cb76fdd8f6025e7f19e965f 100644
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@@ -138,7 +138,7 @@ in {
description = "Real time performance monitoring";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
- path = (with pkgs; [ gawk curl ]) ++ lib.optional cfg.python.enable
+ path = (with pkgs; [ curl gawk which ]) ++ lib.optional cfg.python.enable
(pkgs.python3.withPackages cfg.python.extraPackages);
serviceConfig = {
Environment="PYTHONPATH=${pkgs.netdata}/libexec/netdata/python.d/python_modules";
@@ -181,6 +181,7 @@ in {
users.users = optional (cfg.user == defaultUser) {
name = defaultUser;
+ isSystemUser = true;
};
users.groups = optional (cfg.group == defaultUser) {
diff --git a/nixos/modules/services/monitoring/osquery.nix b/nixos/modules/services/monitoring/osquery.nix
deleted file mode 100644
index c8c625577d39c43de1510441952467e3c25b7be0..0000000000000000000000000000000000000000
--- a/nixos/modules/services/monitoring/osquery.nix
+++ /dev/null
@@ -1,91 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with builtins;
-with lib;
-
-let
- cfg = config.services.osquery;
-
-in
-
-{
-
- options = {
-
- services.osquery = {
-
- enable = mkEnableOption "osquery";
-
- loggerPath = mkOption {
- type = types.path;
- description = "Base directory used for logging.";
- default = "/var/log/osquery";
- };
-
- pidfile = mkOption {
- type = types.path;
- description = "Path used for pid file.";
- default = "/var/osquery/osqueryd.pidfile";
- };
-
- utc = mkOption {
- type = types.bool;
- description = "Attempt to convert all UNIX calendar times to UTC.";
- default = true;
- };
-
- databasePath = mkOption {
- type = types.path;
- description = "Path used for database file.";
- default = "/var/osquery/osquery.db";
- };
-
- extraConfig = mkOption {
- type = types.attrs // {
- merge = loc: foldl' (res: def: recursiveUpdate res def.value) {};
- };
- description = "Extra config to be recursively merged into the JSON config file.";
- default = { };
- };
- };
-
- };
-
- config = mkIf cfg.enable {
-
- environment.systemPackages = [ pkgs.osquery ];
-
- environment.etc."osquery/osquery.conf".text = toJSON (
- recursiveUpdate {
- options = {
- config_plugin = "filesystem";
- logger_plugin = "filesystem";
- logger_path = cfg.loggerPath;
- database_path = cfg.databasePath;
- utc = cfg.utc;
- };
- } cfg.extraConfig
- );
-
- systemd.services.osqueryd = {
- description = "The osquery Daemon";
- after = [ "network.target" "syslog.service" ];
- wantedBy = [ "multi-user.target" ];
- path = [ pkgs.osquery ];
- preStart = ''
- mkdir -p ${escapeShellArg cfg.loggerPath}
- mkdir -p "$(dirname ${escapeShellArg cfg.pidfile})"
- mkdir -p "$(dirname ${escapeShellArg cfg.databasePath})"
- '';
- serviceConfig = {
- TimeoutStartSec = "infinity";
- ExecStart = "${pkgs.osquery}/bin/osqueryd --logger_path ${escapeShellArg cfg.loggerPath} --pidfile ${escapeShellArg cfg.pidfile} --database_path ${escapeShellArg cfg.databasePath}";
- KillMode = "process";
- KillSignal = "SIGTERM";
- Restart = "on-failure";
- };
- };
-
- };
-
-}
diff --git a/nixos/modules/services/monitoring/prometheus/alertmanager.nix b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
index 11d85e9c4fc3aa9ff0343f24b781951532380422..9af6b1d94f374e66e32fd7cb88f1b3f0ba4a2320 100644
--- a/nixos/modules/services/monitoring/prometheus/alertmanager.nix
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
@@ -27,6 +27,15 @@ let
"--log.format ${cfg.logFormat}"
);
in {
+ imports = [
+ (mkRemovedOptionModule [ "services" "prometheus" "alertmanager" "user" ] "The alertmanager service is now using systemd's DynamicUser mechanism which obviates a user setting.")
+ (mkRemovedOptionModule [ "services" "prometheus" "alertmanager" "group" ] "The alertmanager service is now using systemd's DynamicUser mechanism which obviates a group setting.")
+ (mkRemovedOptionModule [ "services" "prometheus" "alertmanagerURL" ] ''
+ Due to incompatibility, the alertmanagerURL option has been removed,
+ please use 'services.prometheus2.alertmanagers' instead.
+ '')
+ ];
+
options = {
services.prometheus.alertmanager = {
enable = mkEnableOption "Prometheus Alertmanager";
diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix
index 191c0bff9c841ed2caad198514d0d196c059d958..b67f697ca0dea383b4af34c4b1e6d806ef90c6d1 100644
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@@ -464,6 +464,11 @@ let
};
in {
+
+ imports = [
+ (mkRenamedOptionModule [ "services" "prometheus2" ] [ "services" "prometheus" ])
+ ];
+
options.services.prometheus = {
enable = mkOption {
diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index b69310c34ff512df8b7a328fad050c90907c6db2..36ebffa44636f5f742a9d1b2047d72c783e6bffa 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -30,10 +30,12 @@ let
"json"
"mail"
"minio"
+ "nextcloud"
"nginx"
"node"
"postfix"
"postgres"
+ "rspamd"
"snmp"
"surfboard"
"tor"
@@ -158,6 +160,24 @@ let
};
in
{
+
+ imports = (lib.forEach [ "blackboxExporter" "collectdExporter" "fritzboxExporter"
+ "jsonExporter" "minioExporter" "nginxExporter" "nodeExporter"
+ "snmpExporter" "unifiExporter" "varnishExporter" ]
+ (opt: lib.mkRemovedOptionModule [ "services" "prometheus" "${opt}" ] ''
+ The prometheus exporters are now configured using `services.prometheus.exporters'.
+ See the 18.03 release notes for more information.
+ '' ))
+
+ ++ (lib.forEach [ "enable" "substitutions" "preset" ]
+ (opt: lib.mkRemovedOptionModule [ "fonts" "fontconfig" "ultimate" "${opt}" ] ''
+ The fonts.fontconfig.ultimate module and configuration is obsolete.
+ The repository has since been archived and activity has ceased.
+ https://github.com/bohoomil/fontconfig-ultimate/issues/171.
+ No action should be needed for font configuration, as the fonts.fontconfig
+ module is already used by default.
+ '' ));
+
options.services.prometheus.exporters = mkOption {
type = types.submodule {
options = (mkSubModules);
@@ -193,6 +213,11 @@ in
services.prometheus.exporters.minio.minioAddress = mkDefault "http://localhost:9000";
services.prometheus.exporters.minio.minioAccessKey = mkDefault config.services.minio.accessKey;
services.prometheus.exporters.minio.minioAccessSecret = mkDefault config.services.minio.secretKey;
+ })] ++ [(mkIf config.services.rspamd.enable {
+ services.prometheus.exporters.rspamd.url = mkDefault "http://localhost:11334/stat";
+ })] ++ [(mkIf config.services.nginx.enable {
+ systemd.services.prometheus-nginx-exporter.after = [ "nginx.service" ];
+ systemd.services.prometheus-nginx-exporter.requires = [ "nginx.service" ];
})] ++ (mapAttrsToList (name: conf:
mkExporterConf {
inherit name;
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/blackbox.nix b/nixos/modules/services/monitoring/prometheus/exporters/blackbox.nix
index ca4366121e1251a7805d6fa6ef52a01ef03699b8..8a90afa998423b65e3db1ace5255509687ff8821 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/blackbox.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/blackbox.nix
@@ -3,16 +3,34 @@
with lib;
let
+ logPrefix = "services.prometheus.exporter.blackbox";
cfg = config.services.prometheus.exporters.blackbox;
- checkConfig = file: pkgs.runCommand "checked-blackbox-exporter.conf" {
- preferLocalBuild = true;
- buildInputs = [ pkgs.buildPackages.prometheus-blackbox-exporter ]; } ''
- ln -s ${file} $out
- blackbox_exporter --config.check --config.file $out
- '';
-in
-{
+ # This ensures that we can deal with string paths, path types and
+ # store-path strings with context.
+ coerceConfigFile = file:
+ if (builtins.isPath file) || (lib.isStorePath file) then
+ file
+ else
+ (lib.warn ''
+ ${logPrefix}: configuration file "${file}" is being copied to the nix-store.
+ If you would like to avoid that, please set enableConfigCheck to false.
+ '' /. + file);
+ checkConfigLocation = file:
+ if lib.hasPrefix "/tmp/" file then
+ throw
+ "${logPrefix}: configuration file must not reside within /tmp - it won't be visible to the systemd service."
+ else
+ true;
+ checkConfig = file:
+ pkgs.runCommand "checked-blackbox-exporter.conf" {
+ preferLocalBuild = true;
+ buildInputs = [ pkgs.buildPackages.prometheus-blackbox-exporter ];
+ } ''
+ ln -s ${coerceConfigFile file} $out
+ blackbox_exporter --config.check --config.file $out
+ '';
+in {
port = 9115;
extraOpts = {
configFile = mkOption {
@@ -21,14 +39,29 @@ in
Path to configuration file.
'';
};
+ enableConfigCheck = mkOption {
+ type = types.bool;
+ default = true;
+ description = ''
+ Whether to run a correctness check for the configuration file. This depends
+ on the configuration file residing in the nix-store. Paths passed as string will
+ be copied to the store.
+ '';
+ };
};
- serviceOpts = {
+
+ serviceOpts = let
+ adjustedConfigFile = if cfg.enableConfigCheck then
+ checkConfig cfg.configFile
+ else
+ checkConfigLocation cfg.configFile;
+ in {
serviceConfig = {
AmbientCapabilities = [ "CAP_NET_RAW" ]; # for ping probes
ExecStart = ''
${pkgs.prometheus-blackbox-exporter}/bin/blackbox_exporter \
--web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
- --config.file ${checkConfig cfg.configFile} \
+ --config.file ${adjustedConfigFile} \
${concatStringsSep " \\\n " cfg.extraFlags}
'';
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/nextcloud.nix b/nixos/modules/services/monitoring/prometheus/exporters/nextcloud.nix
new file mode 100644
index 0000000000000000000000000000000000000000..5f9a52053f79eabb29d732252eb5617d63fdb578
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/nextcloud.nix
@@ -0,0 +1,58 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+ cfg = config.services.prometheus.exporters.nextcloud;
+in
+{
+ port = 9205;
+ extraOpts = {
+ url = mkOption {
+ type = types.str;
+ example = "https://domain.tld";
+ description = ''
+ URL to the Nextcloud serverinfo page.
+ Adding the path to the serverinfo API is optional, it defaults
+ to /ocs/v2.php/apps/serverinfo/api/v1/info.
+ '';
+ };
+ username = mkOption {
+ type = types.str;
+ default = "nextcloud-exporter";
+ description = ''
+ Username for connecting to Nextcloud.
+ Note that this account needs to have admin privileges in Nextcloud.
+ '';
+ };
+ passwordFile = mkOption {
+ type = types.path;
+ example = "/path/to/password-file";
+ description = ''
+ File containing the password for connecting to Nextcloud.
+ Make sure that this file is readable by the exporter user.
+ '';
+ };
+ timeout = mkOption {
+ type = types.str;
+ default = "5s";
+ description = ''
+ Timeout for getting server info document.
+ '';
+ };
+ };
+ serviceOpts = {
+ serviceConfig = {
+ DynamicUser = false;
+ ExecStart = ''
+ ${pkgs.prometheus-nextcloud-exporter}/bin/nextcloud-exporter \
+ -a ${cfg.listenAddress}:${toString cfg.port} \
+ -u ${cfg.username} \
+ -t ${cfg.timeout} \
+ -l ${cfg.url} \
+ -p @${cfg.passwordFile} \
+ ${concatStringsSep " \\\n " cfg.extraFlags}
+ '';
+ };
+ };
+}
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/nginx.nix b/nixos/modules/services/monitoring/prometheus/exporters/nginx.nix
index 554377df37ba348ada9b719d02e75a901dcf30b4..ba852fea4336da19b2b02fd28da925964467704a 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/nginx.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/nginx.nix
@@ -49,6 +49,6 @@ in
(mkRemovedOptionModule [ "insecure" ] ''
This option was replaced by 'prometheus.exporters.nginx.sslVerify'.
'')
- ({ options.warnings = options.warnings; })
+ ({ options.warnings = options.warnings; options.assertions = options.assertions; })
];
}
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/rspamd.nix b/nixos/modules/services/monitoring/prometheus/exporters/rspamd.nix
new file mode 100644
index 0000000000000000000000000000000000000000..1f02ae2072499dcbeb566e3ee656e10e31c839d8
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/rspamd.nix
@@ -0,0 +1,92 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+ cfg = config.services.prometheus.exporters.rspamd;
+
+ prettyJSON = conf:
+ pkgs.runCommand "rspamd-exporter-config.yml" { } ''
+ echo '${builtins.toJSON conf}' | ${pkgs.buildPackages.jq}/bin/jq '.' > $out
+ '';
+
+ generateConfig = extraLabels: (map (path: {
+ name = "rspamd_${replaceStrings [ "." " " ] [ "_" "_" ] path}";
+ path = "$.${path}";
+ labels = extraLabels;
+ }) [
+ "actions.'add header'"
+ "actions.'no action'"
+ "actions.'rewrite subject'"
+ "actions.'soft reject'"
+ "actions.greylist"
+ "actions.reject"
+ "bytes_allocated"
+ "chunks_allocated"
+ "chunks_freed"
+ "chunks_oversized"
+ "connections"
+ "control_connections"
+ "ham_count"
+ "learned"
+ "pools_allocated"
+ "pools_freed"
+ "read_only"
+ "scanned"
+ "shared_chunks_allocated"
+ "spam_count"
+ "total_learns"
+ ]) ++ [{
+ name = "rspamd_statfiles";
+ type = "object";
+ path = "$.statfiles[*]";
+ labels = recursiveUpdate {
+ symbol = "$.symbol";
+ type = "$.type";
+ } extraLabels;
+ values = {
+ revision = "$.revision";
+ size = "$.size";
+ total = "$.total";
+ used = "$.used";
+ languages = "$.languages";
+ users = "$.users";
+ };
+ }];
+in
+{
+ port = 7980;
+ extraOpts = {
+ listenAddress = {}; # not used
+
+ url = mkOption {
+ type = types.str;
+ description = ''
+ URL to the rspamd metrics endpoint.
+ Defaults to http://localhost:11334/stat when
+ is true.
+ '';
+ };
+
+ extraLabels = mkOption {
+ type = types.attrsOf types.str;
+ default = {
+ host = config.networking.hostName;
+ };
+ defaultText = "{ host = config.networking.hostName; }";
+ example = literalExample ''
+ {
+ host = config.networking.hostName;
+ custom_label = "some_value";
+ }
+ '';
+ description = "Set of labels added to each metric.";
+ };
+ };
+ serviceOpts.serviceConfig.ExecStart = ''
+ ${pkgs.prometheus-json-exporter}/bin/prometheus-json-exporter \
+ --port ${toString cfg.port} \
+ ${cfg.url} ${prettyJSON (generateConfig cfg.extraLabels)} \
+ ${concatStringsSep " \\\n " cfg.extraFlags}
+ '';
+}
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix b/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
index 8ae2c927b58c5f1ad28875376304e6c3f2658ff8..374f83a2939d01527cfbe0c390c082b7af49b8e0 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
@@ -6,6 +6,10 @@ let
cfg = config.services.prometheus.exporters.wireguard;
in {
port = 9586;
+ imports = [
+ (mkRenamedOptionModule [ "addr" ] [ "listenAddress" ])
+ ({ options.warnings = options.warnings; options.assertions = options.assertions; })
+ ];
extraOpts = {
verbose = mkEnableOption "Verbose logging mode for prometheus-wireguard-exporter";
@@ -51,6 +55,7 @@ in {
ExecStart = ''
${pkgs.prometheus-wireguard-exporter}/bin/prometheus_wireguard_exporter \
-p ${toString cfg.port} \
+ -l ${cfg.listenAddress} \
${optionalString cfg.verbose "-v"} \
${optionalString cfg.singleSubnetPerField "-s"} \
${optionalString cfg.withRemoteIp "-r"} \
diff --git a/nixos/modules/services/monitoring/sysstat.nix b/nixos/modules/services/monitoring/sysstat.nix
index d668faa53cc33ea4feb00258ff9a9cd88ad2dc71..ca2cff827232013dfdc821ace316e719b4b330f4 100644
--- a/nixos/modules/services/monitoring/sysstat.nix
+++ b/nixos/modules/services/monitoring/sysstat.nix
@@ -5,15 +5,10 @@ let
in {
options = {
services.sysstat = {
- enable = mkOption {
- type = types.bool;
- default = false;
- description = ''
- Whether to enable sar system activity collection.
- '';
- };
+ enable = mkEnableOption "sar system activity collection";
collect-frequency = mkOption {
+ type = types.str;
default = "*:00/10";
description = ''
OnCalendar specification for sysstat-collect
@@ -21,6 +16,7 @@ in {
};
collect-args = mkOption {
+ type = types.str;
default = "1 1";
description = ''
Arguments to pass sa1 when collecting statistics
@@ -33,13 +29,13 @@ in {
systemd.services.sysstat = {
description = "Resets System Activity Logs";
wantedBy = [ "multi-user.target" ];
- preStart = "test -d /var/log/sa || mkdir -p /var/log/sa";
serviceConfig = {
User = "root";
RemainAfterExit = true;
Type = "oneshot";
ExecStart = "${pkgs.sysstat}/lib/sa/sa1 --boot";
+ LogsDirectory = "sa";
};
};
diff --git a/nixos/modules/services/monitoring/thanos.nix b/nixos/modules/services/monitoring/thanos.nix
index 215cd43fd86440bb825622497ce37a787380a457..52dab28cf72ff2d1bda50b677a27b895f0123a86 100644
--- a/nixos/modules/services/monitoring/thanos.nix
+++ b/nixos/modules/services/monitoring/thanos.nix
@@ -126,6 +126,8 @@ let
'';
description = ''
Path to YAML file that contains tracing configuration.
+
+ See format details:
'';
};
};
@@ -141,6 +143,8 @@ let
will default to its path.
If is set this option has no effect.
+
+ See format details:
'';
};
};
@@ -187,6 +191,8 @@ let
'';
description = ''
Path to YAML file that contains object store configuration.
+
+ See format details:
'';
};
};
@@ -202,6 +208,8 @@ let
will default to its path.
If is set this option has no effect.
+
+ See format details:
'';
};
};
@@ -276,6 +284,24 @@ let
block-sync-concurrency = mkParamDef types.int 20 ''
Number of goroutines to use when syncing blocks from object storage.
'';
+
+ min-time = mkParamDef types.str "0000-01-01T00:00:00Z" ''
+ Start of time range limit to serve.
+
+ Thanos Store serves only metrics, which happened later than this
+ value. Option can be a constant time in RFC3339 format or time duration
+ relative to current time, such as -1d or 2h45m. Valid duration units are
+ ms, s, m, h, d, w, y.
+ '';
+
+ max-time = mkParamDef types.str "9999-12-31T23:59:59Z" ''
+ End of time range limit to serve.
+
+ Thanos Store serves only blocks, which happened eariler than this
+ value. Option can be a constant time in RFC3339 format or time duration
+ relative to current time, such as -1d or 2h45m. Valid duration units are
+ ms, s, m, h, d, w, y.
+ '';
};
query = params.common cfg.query // {
@@ -560,6 +586,14 @@ let
'';
};
+ downsampling.disable = mkFlagParam ''
+ Disables downsampling.
+
+ This is not recommended as querying long time ranges without
+ non-downsampled data is not efficient and useful e.g it is not possible
+ to render all samples for a human eye anyway
+ '';
+
block-sync-concurrency = mkParamDef types.int 20 ''
Number of goroutines to use when syncing block metadata from object storage.
'';
diff --git a/nixos/modules/services/monitoring/zabbix-agent.nix b/nixos/modules/services/monitoring/zabbix-agent.nix
index 856b9432892b5b58af353e40de98137880860609..b3383ed628b2952196a2959dfceb18a464352bc5 100644
--- a/nixos/modules/services/monitoring/zabbix-agent.nix
+++ b/nixos/modules/services/monitoring/zabbix-agent.nix
@@ -131,6 +131,7 @@ in
users.users.${user} = {
description = "Zabbix Agent daemon user";
inherit group;
+ isSystemUser = true;
};
users.groups.${group} = { };
diff --git a/nixos/modules/services/monitoring/zabbix-server.nix b/nixos/modules/services/monitoring/zabbix-server.nix
index 4b4049ed360e0f045157496464a0949309590fa0..b4e4378ce1e76536bb8e509ee1c063193620f86d 100644
--- a/nixos/modules/services/monitoring/zabbix-server.nix
+++ b/nixos/modules/services/monitoring/zabbix-server.nix
@@ -30,6 +30,7 @@ let
DBUser = ${cfg.database.user}
${optionalString (cfg.database.passwordFile != null) "Include ${passwordFile}"}
${optionalString (mysqlLocal && cfg.database.socket != null) "DBSocket = ${cfg.database.socket}"}
+ PidFile = ${runtimeDir}/zabbix_server.pid
SocketDir = ${runtimeDir}
FpingLocation = /run/wrappers/bin/fping
${optionalString (cfg.modules != {}) "LoadModulePath = ${moduleEnv}/lib"}
@@ -43,6 +44,11 @@ let
in
{
+ imports = [
+ (lib.mkRenamedOptionModule [ "services" "zabbixServer" "dbServer" ] [ "services" "zabbixServer" "database" "host" ])
+ (lib.mkRemovedOptionModule [ "services" "zabbixServer" "dbPassword" ] "Use services.zabbixServer.database.passwordFile instead.")
+ ];
+
# interface
options = {
diff --git a/nixos/modules/services/network-filesystems/beegfs.nix b/nixos/modules/services/network-filesystems/beegfs.nix
deleted file mode 100644
index 2e03a422665ab0504041a949478784ebd65594bd..0000000000000000000000000000000000000000
--- a/nixos/modules/services/network-filesystems/beegfs.nix
+++ /dev/null
@@ -1,357 +0,0 @@
-{ config, lib, pkgs, ...} :
-
-with lib;
-
-let
- cfg = config.services.beegfs;
-
- # functions for the generations of config files
-
- configMgmtd = name: cfg: pkgs.writeText "mgmt-${name}.conf" ''
- storeMgmtdDirectory = ${cfg.mgmtd.storeDir}
- storeAllowFirstRunInit = false
- connAuthFile = ${cfg.connAuthFile}
- connPortShift = ${toString cfg.connPortShift}
-
- ${cfg.mgmtd.extraConfig}
- '';
-
- configAdmon = name: cfg: pkgs.writeText "admon-${name}.conf" ''
- sysMgmtdHost = ${cfg.mgmtdHost}
- connAuthFile = ${cfg.connAuthFile}
- connPortShift = ${toString cfg.connPortShift}
-
- ${cfg.admon.extraConfig}
- '';
-
- configMeta = name: cfg: pkgs.writeText "meta-${name}.conf" ''
- storeMetaDirectory = ${cfg.meta.storeDir}
- sysMgmtdHost = ${cfg.mgmtdHost}
- connAuthFile = ${cfg.connAuthFile}
- connPortShift = ${toString cfg.connPortShift}
- storeAllowFirstRunInit = false
-
- ${cfg.meta.extraConfig}
- '';
-
- configStorage = name: cfg: pkgs.writeText "storage-${name}.conf" ''
- storeStorageDirectory = ${cfg.storage.storeDir}
- sysMgmtdHost = ${cfg.mgmtdHost}
- connAuthFile = ${cfg.connAuthFile}
- connPortShift = ${toString cfg.connPortShift}
- storeAllowFirstRunInit = false
-
- ${cfg.storage.extraConfig}
- '';
-
- configHelperd = name: cfg: pkgs.writeText "helperd-${name}.conf" ''
- connAuthFile = ${cfg.connAuthFile}
- ${cfg.helperd.extraConfig}
- '';
-
- configClientFilename = name : "/etc/beegfs/client-${name}.conf";
-
- configClient = name: cfg: ''
- sysMgmtdHost = ${cfg.mgmtdHost}
- connAuthFile = ${cfg.connAuthFile}
- connPortShift = ${toString cfg.connPortShift}
-
- ${cfg.client.extraConfig}
- '';
-
- serviceList = [
- { service = "admon"; cfgFile = configAdmon; }
- { service = "meta"; cfgFile = configMeta; }
- { service = "mgmtd"; cfgFile = configMgmtd; }
- { service = "storage"; cfgFile = configStorage; }
- ];
-
- # functions to generate systemd.service entries
-
- systemdEntry = service: cfgFile: (mapAttrs' ( name: cfg:
- (nameValuePair "beegfs-${service}-${name}" (mkIf cfg.${service}.enable {
- wantedBy = [ "multi-user.target" ];
- requires = [ "network-online.target" ];
- after = [ "network-online.target" ];
- serviceConfig = rec {
- ExecStart = ''
- ${pkgs.beegfs}/bin/beegfs-${service} \
- cfgFile=${cfgFile name cfg} \
- pidFile=${PIDFile}
- '';
- PIDFile = "/run/beegfs-${service}-${name}.pid";
- TimeoutStopSec = "300";
- };
- }))) cfg);
-
- systemdHelperd = mapAttrs' ( name: cfg:
- (nameValuePair "beegfs-helperd-${name}" (mkIf cfg.client.enable {
- wantedBy = [ "multi-user.target" ];
- requires = [ "network-online.target" ];
- after = [ "network-online.target" ];
- serviceConfig = rec {
- ExecStart = ''
- ${pkgs.beegfs}/bin/beegfs-helperd \
- cfgFile=${configHelperd name cfg} \
- pidFile=${PIDFile}
- '';
- PIDFile = "/run/beegfs-helperd-${name}.pid";
- TimeoutStopSec = "300";
- };
- }))) cfg;
-
- # wrappers to beegfs tools. Avoid typing path of config files
- utilWrappers = mapAttrsToList ( name: cfg:
- ( pkgs.runCommand "beegfs-utils-${name}" {
- nativeBuildInputs = [ pkgs.makeWrapper ];
- preferLocalBuild = true;
- } ''
- mkdir -p $out/bin
-
- makeWrapper ${pkgs.beegfs}/bin/beegfs-check-servers \
- $out/bin/beegfs-check-servers-${name} \
- --add-flags "-c ${configClientFilename name}" \
- --prefix PATH : ${lib.makeBinPath [ pkgs.beegfs ]}
-
- makeWrapper ${pkgs.beegfs}/bin/beegfs-ctl \
- $out/bin/beegfs-ctl-${name} \
- --add-flags "--cfgFile=${configClientFilename name}"
-
- makeWrapper ${pkgs.beegfs}/bin/beegfs-ctl \
- $out/bin/beegfs-df-${name} \
- --add-flags "--cfgFile=${configClientFilename name}" \
- --add-flags --listtargets \
- --add-flags --hidenodeid \
- --add-flags --pools \
- --add-flags --spaceinfo
-
- makeWrapper ${pkgs.beegfs}/bin/beegfs-fsck \
- $out/bin/beegfs-fsck-${name} \
- --add-flags "--cfgFile=${configClientFilename name}"
- ''
- )) cfg;
-in
-{
- ###### interface
-
- options = {
- services.beegfsEnable = mkEnableOption "BeeGFS";
-
- services.beegfs = mkOption {
- default = {};
- description = ''
- BeeGFS configurations. Every mount point requires a separate configuration.
- '';
- type = with types; attrsOf (submodule ({ ... } : {
- options = {
- mgmtdHost = mkOption {
- type = types.str;
- default = null;
- example = "master";
- description = ''Hostname of managament host.'';
- };
-
- connAuthFile = mkOption {
- type = types.str;
- default = "";
- example = "/etc/my.key";
- description = "File containing shared secret authentication.";
- };
-
- connPortShift = mkOption {
- type = types.int;
- default = 0;
- example = 5;
- description = ''
- For each additional beegfs configuration shift all
- service TCP/UDP ports by at least 5.
- '';
- };
-
- client = {
- enable = mkEnableOption "BeeGFS client";
-
- mount = mkOption {
- type = types.bool;
- default = true;
- description = "Create fstab entry automatically";
- };
-
- mountPoint = mkOption {
- type = types.str;
- default = "/run/beegfs";
- description = ''
- Mount point under which the beegfs filesytem should be mounted.
- If mounted manually the mount option specifing the config file is needed:
- cfgFile=/etc/beegfs/beegfs-client-<name>.conf
- '';
- };
-
- extraConfig = mkOption {
- type = types.lines;
- default = "";
- description = ''
- Additional lines for beegfs-client.conf.
- See documentation for further details.
- '';
- };
- };
-
- helperd = {
- enable = mkOption {
- type = types.bool;
- default = true;
- description = ''
- Enable the BeeGFS helperd.
- The helpered is need for logging purposes on the client.
- Disabling helperd allows for runing the client
- with allowUnfree = false.
- '';
- };
-
- extraConfig = mkOption {
- type = types.lines;
- default = "";
- description = ''
- Additional lines for beegfs-helperd.conf. See documentation
- for further details.
- '';
- };
- };
-
- mgmtd = {
- enable = mkEnableOption "BeeGFS mgmtd daemon";
-
- storeDir = mkOption {
- type = types.path;
- default = null;
- example = "/data/beegfs-mgmtd";
- description = ''
- Data directory for mgmtd.
- Must not be shared with other beegfs daemons.
- This directory must exist and it must be initialized
- with beegfs-setup-mgmtd, e.g. "beegfs-setup-mgmtd -C -p <storeDir>"
- '';
- };
-
- extraConfig = mkOption {
- type = types.lines;
- default = "";
- description = ''
- Additional lines for beegfs-mgmtd.conf. See documentation
- for further details.
- '';
- };
- };
-
- admon = {
- enable = mkEnableOption "BeeGFS admon daemon";
-
- extraConfig = mkOption {
- type = types.lines;
- default = "";
- description = ''
- Additional lines for beegfs-admon.conf. See documentation
- for further details.
- '';
- };
- };
-
- meta = {
- enable = mkEnableOption "BeeGFS meta data daemon";
-
- storeDir = mkOption {
- type = types.path;
- default = null;
- example = "/data/beegfs-meta";
- description = ''
- Data directory for meta data service.
- Must not be shared with other beegfs daemons.
- The underlying filesystem must be mounted with xattr turned on.
- This directory must exist and it must be initialized
- with beegfs-setup-meta, e.g.
- "beegfs-setup-meta -C -s <serviceID> -p <storeDir>"
- '';
- };
-
- extraConfig = mkOption {
- type = types.str;
- default = "";
- description = ''
- Additional lines for beegfs-meta.conf. See documentation
- for further details.
- '';
- };
- };
-
- storage = {
- enable = mkEnableOption "BeeGFS storage daemon";
-
- storeDir = mkOption {
- type = types.path;
- default = null;
- example = "/data/beegfs-storage";
- description = ''
- Data directories for storage service.
- Must not be shared with other beegfs daemons.
- The underlying filesystem must be mounted with xattr turned on.
- This directory must exist and it must be initialized
- with beegfs-setup-storage, e.g.
- "beegfs-setup-storage -C -s <serviceID> -i <storageTargetID> -p <storeDir>"
- '';
- };
-
- extraConfig = mkOption {
- type = types.str;
- default = "";
- description = ''
- Addional lines for beegfs-storage.conf. See documentation
- for further details.
- '';
- };
- };
- };
- }));
- };
- };
-
- ###### implementation
-
- config =
- mkIf config.services.beegfsEnable {
-
- environment.systemPackages = utilWrappers;
-
- # Put the client.conf files in /etc since they are needed
- # by the commandline tools
- environment.etc = mapAttrs' ( name: cfg:
- (nameValuePair "beegfs/client-${name}.conf" (mkIf (cfg.client.enable)
- {
- enable = true;
- text = configClient name cfg;
- }))) cfg;
-
- # Kernel module, we need it only once per host.
- boot = mkIf (
- foldr (a: b: a || b) false
- (map (x: x.client.enable) (collect (x: x ? client) cfg)))
- {
- kernelModules = [ "beegfs" ];
- extraModulePackages = [ pkgs.linuxPackages.beegfs-module ];
- };
-
- # generate fstab entries
- fileSystems = mapAttrs' (name: cfg:
- (nameValuePair cfg.client.mountPoint (optionalAttrs cfg.client.mount (mkIf cfg.client.enable {
- device = "beegfs_nodev";
- fsType = "beegfs";
- mountPoint = cfg.client.mountPoint;
- options = [ "cfgFile=${configClientFilename name}" "_netdev" ];
- })))) cfg;
-
- # generate systemd services
- systemd.services = systemdHelperd //
- foldr (a: b: a // b) {}
- (map (x: systemdEntry x.service x.cfgFile) serviceList);
- };
-}
diff --git a/nixos/modules/services/network-filesystems/ceph.nix b/nixos/modules/services/network-filesystems/ceph.nix
index 656a2d21b8687fb81807a998a5bd35cad7d588ef..543a7b25d5d6173939ddabc520559b5807185a21 100644
--- a/nixos/modules/services/network-filesystems/ceph.nix
+++ b/nixos/modules/services/network-filesystems/ceph.nix
@@ -9,12 +9,14 @@ let
expandCamelCase = replaceStrings upperChars (map (s: " ${s}") lowerChars);
expandCamelCaseAttrs = mapAttrs' (name: value: nameValuePair (expandCamelCase name) value);
- makeServices = (daemonType: daemonIds: extraServiceConfig:
+ makeServices = (daemonType: daemonIds:
mkMerge (map (daemonId:
- { "ceph-${daemonType}-${daemonId}" = makeService daemonType daemonId cfg.global.clusterName pkgs.ceph extraServiceConfig; })
+ { "ceph-${daemonType}-${daemonId}" = makeService daemonType daemonId cfg.global.clusterName pkgs.ceph; })
daemonIds));
- makeService = (daemonType: daemonId: clusterName: ceph: extraServiceConfig: {
+ makeService = (daemonType: daemonId: clusterName: ceph:
+ let
+ stateDirectory = "ceph/${if daemonType == "rgw" then "radosgw" else daemonType}/${clusterName}-${daemonId}"; in {
enable = true;
description = "Ceph ${builtins.replaceStrings lowerChars upperChars daemonType} daemon ${daemonId}";
after = [ "network-online.target" "time-sync.target" ] ++ optional (daemonType == "osd") "ceph-mon.target";
@@ -22,6 +24,11 @@ let
partOf = [ "ceph-${daemonType}.target" ];
wantedBy = [ "ceph-${daemonType}.target" ];
+ path = [ pkgs.getopt ];
+
+ # Don't start services that are not yet initialized
+ unitConfig.ConditionPathExists = "/var/lib/${stateDirectory}/keyring";
+
serviceConfig = {
LimitNOFILE = 1048576;
LimitNPROC = 1048576;
@@ -34,22 +41,22 @@ let
Restart = "on-failure";
StartLimitBurst = "5";
StartLimitInterval = "30min";
+ StateDirectory = stateDirectory;
+ User = "ceph";
+ Group = if daemonType == "osd" then "disk" else "ceph";
ExecStart = ''${ceph.out}/bin/${if daemonType == "rgw" then "radosgw" else "ceph-${daemonType}"} \
- -f --cluster ${clusterName} --id ${daemonId} --setuser ceph \
- --setgroup ${if daemonType == "osd" then "disk" else "ceph"}'';
- } // extraServiceConfig
- // optionalAttrs (daemonType == "osd") { ExecStartPre = ''${ceph.lib}/libexec/ceph/ceph-osd-prestart.sh \
- --id ${daemonId} --cluster ${clusterName}''; };
- } // optionalAttrs (builtins.elem daemonType [ "mds" "mon" "rgw" "mgr" ]) {
- preStart = ''
- daemonPath="/var/lib/ceph/${if daemonType == "rgw" then "radosgw" else daemonType}/${clusterName}-${daemonId}"
- if [ ! -d $daemonPath ]; then
- mkdir -m 755 -p $daemonPath
- chown -R ceph:ceph $daemonPath
- fi
- '';
- } // optionalAttrs (daemonType == "osd") { path = [ pkgs.getopt ]; }
- );
+ -f --cluster ${clusterName} --id ${daemonId}'';
+ } // optionalAttrs (daemonType == "osd") {
+ ExecStartPre = ''${ceph.lib}/libexec/ceph/ceph-osd-prestart.sh --id ${daemonId} --cluster ${clusterName}'';
+ StartLimitBurst = "30";
+ RestartSec = "20s";
+ PrivateDevices = "no"; # osd needs disk access
+ } // optionalAttrs ( daemonType == "mon") {
+ RestartSec = "10";
+ } // optionalAttrs (lib.elem daemonType ["mgr" "mds"]) {
+ StartLimitBurst = "3";
+ };
+ });
makeTarget = (daemonType:
{
@@ -58,6 +65,7 @@ let
partOf = [ "ceph.target" ];
wantedBy = [ "ceph.target" ];
before = [ "ceph.target" ];
+ unitConfig.StopWhenUnneeded = true;
};
}
);
@@ -377,22 +385,22 @@ in
systemd.services = let
services = []
- ++ optional cfg.mon.enable (makeServices "mon" cfg.mon.daemons { RestartSec = "10"; })
- ++ optional cfg.mds.enable (makeServices "mds" cfg.mds.daemons { StartLimitBurst = "3"; })
- ++ optional cfg.osd.enable (makeServices "osd" cfg.osd.daemons { StartLimitBurst = "30";
- RestartSec = "20s";
- PrivateDevices = "no"; # osd needs disk access
- })
- ++ optional cfg.rgw.enable (makeServices "rgw" cfg.rgw.daemons { })
- ++ optional cfg.mgr.enable (makeServices "mgr" cfg.mgr.daemons { StartLimitBurst = "3"; });
+ ++ optional cfg.mon.enable (makeServices "mon" cfg.mon.daemons)
+ ++ optional cfg.mds.enable (makeServices "mds" cfg.mds.daemons)
+ ++ optional cfg.osd.enable (makeServices "osd" cfg.osd.daemons)
+ ++ optional cfg.rgw.enable (makeServices "rgw" cfg.rgw.daemons)
+ ++ optional cfg.mgr.enable (makeServices "mgr" cfg.mgr.daemons);
in
mkMerge services;
systemd.targets = let
targets = [
- { ceph = { description = "Ceph target allowing to start/stop all ceph service instances at once";
- wantedBy = [ "multi-user.target" ]; }; }
- ] ++ optional cfg.mon.enable (makeTarget "mon")
+ { ceph = {
+ description = "Ceph target allowing to start/stop all ceph service instances at once";
+ wantedBy = [ "multi-user.target" ];
+ unitConfig.StopWhenUnneeded = true;
+ }; } ]
+ ++ optional cfg.mon.enable (makeTarget "mon")
++ optional cfg.mds.enable (makeTarget "mds")
++ optional cfg.osd.enable (makeTarget "osd")
++ optional cfg.rgw.enable (makeTarget "rgw")
@@ -401,7 +409,11 @@ in
mkMerge targets;
systemd.tmpfiles.rules = [
+ "d /etc/ceph - ceph ceph - -"
"d /run/ceph 0770 ceph ceph -"
- ];
+ "d /var/lib/ceph - ceph ceph - -"]
+ ++ optionals cfg.mgr.enable [ "d /var/lib/ceph/mgr - ceph ceph - -"]
+ ++ optionals cfg.mon.enable [ "d /var/lib/ceph/mon - ceph ceph - -"]
+ ++ optionals cfg.osd.enable [ "d /var/lib/ceph/osd - ceph ceph - -"];
};
}
diff --git a/nixos/modules/services/network-filesystems/nfsd.nix b/nixos/modules/services/network-filesystems/nfsd.nix
index 1a78f9a76a331f1d531117ee383cc0648ddcacce..1b62bfa8203587f0364c2c0b11568ecc229cc067 100644
--- a/nixos/modules/services/network-filesystems/nfsd.nix
+++ b/nixos/modules/services/network-filesystems/nfsd.nix
@@ -11,6 +11,10 @@ let
in
{
+ imports = [
+ (mkRenamedOptionModule [ "services" "nfs" "lockdPort" ] [ "services" "nfs" "server" "lockdPort" ])
+ (mkRenamedOptionModule [ "services" "nfs" "statdPort" ] [ "services" "nfs" "server" "statdPort" ])
+ ];
###### interface
diff --git a/nixos/modules/services/network-filesystems/orangefs/client.nix b/nixos/modules/services/network-filesystems/orangefs/client.nix
new file mode 100644
index 0000000000000000000000000000000000000000..b69d9e713c3dc834d6bed6243aa204648e644bc5
--- /dev/null
+++ b/nixos/modules/services/network-filesystems/orangefs/client.nix
@@ -0,0 +1,97 @@
+{ config, lib, pkgs, ...} :
+
+with lib;
+
+let
+ cfg = config.services.orangefs.client;
+
+in {
+ ###### interface
+
+ options = {
+ services.orangefs.client = {
+ enable = mkEnableOption "OrangeFS client daemon";
+
+ extraOptions = mkOption {
+ type = with types; listOf str;
+ default = [];
+ description = "Extra command line options for pvfs2-client.";
+ };
+
+ fileSystems = mkOption {
+ description = ''
+ The orangefs file systems to be mounted.
+ This option is prefered over using directly since
+ the pvfs client service needs to be running for it to be mounted.
+ '';
+
+ example = [{
+ mountPoint = "/orangefs";
+ target = "tcp://server:3334/orangefs";
+ }];
+
+ type = with types; listOf (submodule ({ ... } : {
+ options = {
+
+ mountPoint = mkOption {
+ type = types.str;
+ default = "/orangefs";
+ description = "Mount point.";
+ };
+
+ options = mkOption {
+ type = with types; listOf str;
+ default = [];
+ description = "Mount options";
+ };
+
+ target = mkOption {
+ type = types.str;
+ default = null;
+ example = "tcp://server:3334/orangefs";
+ description = "Target URL";
+ };
+ };
+ }));
+ };
+ };
+ };
+
+
+ ###### implementation
+
+ config = mkIf cfg.enable {
+ environment.systemPackages = [ pkgs.orangefs ];
+
+ boot.supportedFilesystems = [ "pvfs2" ];
+ boot.kernelModules = [ "orangefs" ];
+
+ systemd.services.orangefs-client = {
+ requires = [ "network-online.target" ];
+ after = [ "network-online.target" ];
+
+ serviceConfig = {
+ Type = "simple";
+
+ ExecStart = ''
+ ${pkgs.orangefs}/bin/pvfs2-client-core \
+ --logtype=syslog ${concatStringsSep " " cfg.extraOptions}
+ '';
+
+ TimeoutStopSec = "120";
+ };
+ };
+
+ systemd.mounts = map (fs: {
+ requires = [ "orangefs-client.service" ];
+ after = [ "orangefs-client.service" ];
+ bindsTo = [ "orangefs-client.service" ];
+ wantedBy = [ "remote-fs.target" ];
+ type = "pvfs2";
+ options = concatStringsSep "," fs.options;
+ what = fs.target;
+ where = fs.mountPoint;
+ }) cfg.fileSystems;
+ };
+}
+
diff --git a/nixos/modules/services/network-filesystems/orangefs/server.nix b/nixos/modules/services/network-filesystems/orangefs/server.nix
new file mode 100644
index 0000000000000000000000000000000000000000..74ebdc13402459db25aed1ea25b12f4903252c9e
--- /dev/null
+++ b/nixos/modules/services/network-filesystems/orangefs/server.nix
@@ -0,0 +1,225 @@
+{ config, lib, pkgs, ...} :
+
+with lib;
+
+let
+ cfg = config.services.orangefs.server;
+
+ aliases = mapAttrsToList (alias: url: alias) cfg.servers;
+
+ # Maximum handle number is 2^63
+ maxHandle = 9223372036854775806;
+
+ # One range of handles for each meta/data instance
+ handleStep = maxHandle / (length aliases) / 2;
+
+ fileSystems = mapAttrsToList (name: fs: ''
+
+ Name ${name}
+ ID ${toString fs.id}
+ RootHandle ${toString fs.rootHandle}
+
+ ${fs.extraConfig}
+
+
+ ${concatStringsSep "\n" (
+ imap0 (i: alias:
+ let
+ begin = i * handleStep + 3;
+ end = begin + handleStep - 1;
+ in "Range ${alias} ${toString begin}-${toString end}") aliases
+ )}
+
+
+
+ ${concatStringsSep "\n" (
+ imap0 (i: alias:
+ let
+ begin = i * handleStep + 3 + (length aliases) * handleStep;
+ end = begin + handleStep - 1;
+ in "Range ${alias} ${toString begin}-${toString end}") aliases
+ )}
+
+
+
+ TroveSyncMeta ${if fs.troveSyncMeta then "yes" else "no"}
+ TroveSyncData ${if fs.troveSyncData then "yes" else "no"}
+ ${fs.extraStorageHints}
+
+
+
+ '') cfg.fileSystems;
+
+ configFile = ''
+
+ LogType ${cfg.logType}
+ DataStorageSpace ${cfg.dataStorageSpace}
+ MetaDataStorageSpace ${cfg.metadataStorageSpace}
+
+ BMIModules ${concatStringsSep "," cfg.BMIModules}
+ ${cfg.extraDefaults}
+
+
+ ${cfg.extraConfig}
+
+
+ ${concatStringsSep "\n" (mapAttrsToList (alias: url: "Alias ${alias} ${url}") cfg.servers)}
+
+
+ ${concatStringsSep "\n" fileSystems}
+ '';
+
+in {
+ ###### interface
+
+ options = {
+ services.orangefs.server = {
+ enable = mkEnableOption "OrangeFS server";
+
+ logType = mkOption {
+ type = with types; enum [ "file" "syslog" ];
+ default = "syslog";
+ description = "Destination for log messages.";
+ };
+
+ dataStorageSpace = mkOption {
+ type = types.str;
+ default = null;
+ example = "/data/storage";
+ description = "Directory for data storage.";
+ };
+
+ metadataStorageSpace = mkOption {
+ type = types.str;
+ default = null;
+ example = "/data/meta";
+ description = "Directory for meta data storage.";
+ };
+
+ BMIModules = mkOption {
+ type = with types; listOf str;
+ default = [ "bmi_tcp" ];
+ example = [ "bmi_tcp" "bmi_ib"];
+ description = "List of BMI modules to load.";
+ };
+
+ extraDefaults = mkOption {
+ type = types.lines;
+ default = "";
+ description = "Extra config for <Defaults> section.";
+ };
+
+ extraConfig = mkOption {
+ type = types.lines;
+ default = "";
+ description = "Extra config for the global section.";
+ };
+
+ servers = mkOption {
+ type = with types; attrsOf types.str;
+ default = {};
+ example = ''
+ {
+ node1="tcp://node1:3334";
+ node2="tcp://node2:3334";
+ }
+ '';
+ description = "URLs for storage server including port. The attribute names define the server alias.";
+ };
+
+ fileSystems = mkOption {
+ description = ''
+ These options will create the <FileSystem> sections of config file.
+ '';
+ default = { orangefs = {}; };
+ defaultText = literalExample "{ orangefs = {}; }";
+ example = literalExample ''
+ {
+ fs1 = {
+ id = 101;
+ };
+
+ fs2 = {
+ id = 102;
+ };
+ }
+ '';
+ type = with types; attrsOf (submodule ({ ... } : {
+ options = {
+ id = mkOption {
+ type = types.int;
+ default = 1;
+ description = "File system ID (must be unique within configuration).";
+ };
+
+ rootHandle = mkOption {
+ type = types.int;
+ default = 3;
+ description = "File system root ID.";
+ };
+
+ extraConfig = mkOption {
+ type = types.lines;
+ default = "";
+ description = "Extra config for <FileSystem> section.";
+ };
+
+ troveSyncMeta = mkOption {
+ type = types.bool;
+ default = true;
+ description = "Sync meta data.";
+ };
+
+ troveSyncData = mkOption {
+ type = types.bool;
+ default = false;
+ description = "Sync data.";
+ };
+
+ extraStorageHints = mkOption {
+ type = types.lines;
+ default = "";
+ description = "Extra config for <StorageHints> section.";
+ };
+ };
+ }));
+ };
+ };
+ };
+
+ ###### implementation
+
+ config = mkIf cfg.enable {
+ environment.systemPackages = [ pkgs.orangefs ];
+
+ # orangefs daemon will run as user
+ users.users.orangefs.isSystemUser = true;
+ users.groups.orangefs = {};
+
+ # To format the file system the config file is needed.
+ environment.etc."orangefs/server.conf" = {
+ text = configFile;
+ user = "orangefs";
+ group = "orangefs";
+ };
+
+ systemd.services.orangefs-server = {
+ wantedBy = [ "multi-user.target" ];
+ requires = [ "network-online.target" ];
+ after = [ "network-online.target" ];
+
+ serviceConfig = {
+ # Run as "simple" in forground mode.
+ # This is more reliable
+ ExecStart = ''
+ ${pkgs.orangefs}/bin/pvfs2-server -d \
+ /etc/orangefs/server.conf
+ '';
+ TimeoutStopSec = "120";
+ User = "orangefs";
+ Group = "orangefs";
+ };
+ };
+ };
+
+}
diff --git a/nixos/modules/services/network-filesystems/samba.nix b/nixos/modules/services/network-filesystems/samba.nix
index 055508a32244d9c8f9cdd3ad26e0173a49eb93f1..a3c22ce69484cb4aad18dcd3453e823013e95273 100644
--- a/nixos/modules/services/network-filesystems/samba.nix
+++ b/nixos/modules/services/network-filesystems/samba.nix
@@ -12,11 +12,6 @@ let
samba = cfg.package;
- setupScript =
- ''
- mkdir -p /var/lock/samba /var/log/samba /var/cache/samba /var/lib/samba/private
- '';
-
shareConfig = name:
let share = getAttr name cfg.shares; in
"[${name}]\n " + (smbToString (
@@ -45,6 +40,7 @@ let
daemonService = appName: args:
{ description = "Samba Service Daemon ${appName}";
+ after = [ (mkIf (cfg.enableNmbd && "${appName}" == "smbd") "samba-nmbd.service") ];
requiredBy = [ "samba.target" ];
partOf = [ "samba.target" ];
@@ -61,6 +57,7 @@ let
Type = "notify";
NotifyAccess = "all"; #may not do anything...
};
+ unitConfig.RequiresMountsFor = "/var/lib/samba";
restartTriggers = [ configFile ];
};
@@ -68,6 +65,9 @@ let
in
{
+ imports = [
+ (mkRemovedOptionModule [ "services" "samba" "defaultShare" ] "")
+ ];
###### interface
@@ -118,7 +118,7 @@ in
type = types.package;
default = pkgs.samba;
defaultText = "pkgs.samba";
- example = literalExample "pkgs.samba3";
+ example = literalExample "pkgs.samba4Full";
description = ''
Defines which package should be used for the samba server.
'';
@@ -227,8 +227,7 @@ in
systemd = {
targets.samba = {
description = "Samba Server";
- requires = [ "samba-setup.service" ];
- after = [ "samba-setup.service" "network.target" ];
+ after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
};
# Refer to https://github.com/samba-team/samba/tree/master/packaging/systemd
@@ -237,12 +236,13 @@ in
samba-smbd = daemonService "smbd" "";
samba-nmbd = mkIf cfg.enableNmbd (daemonService "nmbd" "");
samba-winbindd = mkIf cfg.enableWinbindd (daemonService "winbindd" "");
- samba-setup = {
- description = "Samba Setup Task";
- script = setupScript;
- unitConfig.RequiresMountsFor = "/var/lib/samba";
- };
};
+ tmpfiles.rules = [
+ "d /var/lock/samba - - - - -"
+ "d /var/log/samba - - - - -"
+ "d /var/cache/samba - - - - -"
+ "d /var/lib/samba/private - - - - -"
+ ];
};
security.pam.services.samba = {};
diff --git a/nixos/modules/services/networking/3proxy.nix b/nixos/modules/services/networking/3proxy.nix
new file mode 100644
index 0000000000000000000000000000000000000000..26aa16679467ad34b22cbed81ce79a651bc7eb19
--- /dev/null
+++ b/nixos/modules/services/networking/3proxy.nix
@@ -0,0 +1,424 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+ pkg = pkgs._3proxy;
+ cfg = config.services._3proxy;
+ optionalList = list: if list == [ ] then "*" else concatMapStringsSep "," toString list;
+in {
+ options.services._3proxy = {
+ enable = mkEnableOption "3proxy";
+ confFile = mkOption {
+ type = types.path;
+ example = "/var/lib/3proxy/3proxy.conf";
+ description = ''
+ Ignore all other 3proxy options and load configuration from this file.
+ '';
+ };
+ usersFile = mkOption {
+ type = types.nullOr types.path;
+ default = null;
+ example = "/var/lib/3proxy/3proxy.passwd";
+ description = ''
+ Load users and passwords from this file.
+
+ Example users file with plain-text passwords:
+
+
+ test1:CL:password1
+ test2:CL:password2
+
+
+ Example users file with md5-crypted passwords:
+
+
+ test1:CR:$1$tFkisVd2$1GA8JXkRmTXdLDytM/i3a1
+ test2:CR:$1$rkpibm5J$Aq1.9VtYAn0JrqZ8M.1ME.
+
+
+ You can generate md5-crypted passwords via https://unix4lyfe.org/crypt/
+ Note that htpasswd tool generates incompatible md5-crypted passwords.
+ Consult documentation for more information.
+ '';
+ };
+ services = mkOption {
+ type = types.listOf (types.submodule {
+ options = {
+ type = mkOption {
+ type = types.enum [
+ "proxy"
+ "socks"
+ "pop3p"
+ "ftppr"
+ "admin"
+ "dnspr"
+ "tcppm"
+ "udppm"
+ ];
+ example = "proxy";
+ description = ''
+ Service type. The following values are valid:
+
+
+
+ "proxy": HTTP/HTTPS proxy (default port 3128).
+
+
+ "socks": SOCKS 4/4.5/5 proxy (default port 1080).
+
+
+ "pop3p": POP3 proxy (default port 110).
+
+
+ "ftppr": FTP proxy (default port 21).
+
+
+ "admin": Web interface (default port 80).
+
+
+ "dnspr": Caching DNS proxy (default port 53).
+
+
+ "tcppm": TCP portmapper.
+
+
+ "udppm": UDP portmapper.
+
+
+ '';
+ };
+ bindAddress = mkOption {
+ type = types.str;
+ default = "[::]";
+ example = "127.0.0.1";
+ description = ''
+ Address used for service.
+ '';
+ };
+ bindPort = mkOption {
+ type = types.nullOr types.int;
+ default = null;
+ example = 3128;
+ description = ''
+ Override default port used for service.
+ '';
+ };
+ maxConnections = mkOption {
+ type = types.int;
+ default = 100;
+ example = 1000;
+ description = ''
+ Maximum number of simulationeous connections to this service.
+ '';
+ };
+ auth = mkOption {
+ type = types.listOf (types.enum [ "none" "iponly" "strong" ]);
+ example = [ "iponly" "strong" ];
+ description = ''
+ Authentication type. The following values are valid:
+
+
+
+ "none": disables both authentication and authorization. You can not use ACLs.
+
+
+ "iponly": specifies no authentication. ACLs authorization is used.
+
+
+ "strong": authentication by username/password. If user is not registered his access is denied regardless of ACLs.
+
+
+
+ Double authentication is possible, e.g.
+
+
+ {
+ auth = [ "iponly" "strong" ];
+ acl = [
+ {
+ rule = "allow";
+ targets = [ "192.168.0.0/16" ];
+ }
+ {
+ rule = "allow"
+ users = [ "user1" "user2" ];
+ }
+ ];
+ }
+
+ In this example strong username authentication is not required to access 192.168.0.0/16.
+ '';
+ };
+ acl = mkOption {
+ type = types.listOf (types.submodule {
+ options = {
+ rule = mkOption {
+ type = types.enum [ "allow" "deny" ];
+ example = "allow";
+ description = ''
+ ACL rule. The following values are valid:
+
+
+
+ "allow": connections allowed.
+
+
+ "deny": connections not allowed.
+
+
+ '';
+ };
+ users = mkOption {
+ type = types.listOf types.str;
+ default = [ ];
+ example = [ "user1" "user2" "user3" ];
+ description = ''
+ List of users, use empty list for any.
+ '';
+ };
+ sources = mkOption {
+ type = types.listOf types.str;
+ default = [ ];
+ example = [ "127.0.0.1" "192.168.1.0/24" ];
+ description = ''
+ List of source IP range, use empty list for any.
+ '';
+ };
+ targets = mkOption {
+ type = types.listOf types.str;
+ default = [ ];
+ example = [ "127.0.0.1" "192.168.1.0/24" ];
+ description = ''
+ List of target IP ranges, use empty list for any.
+ May also contain host names instead of addresses.
+ It's possible to use wildmask in the begginning and in the the end of hostname, e.g. *badsite.com or *badcontent*.
+ Hostname is only checked if hostname presents in request.
+ '';
+ };
+ targetPorts = mkOption {
+ type = types.listOf types.int;
+ default = [ ];
+ example = [ 80 443 ];
+ description = ''
+ List of target ports, use empty list for any.
+ '';
+ };
+ };
+ });
+ default = [ ];
+ example = literalExample ''
+ [
+ {
+ rule = "allow";
+ users = [ "user1" ];
+ }
+ {
+ rule = "allow";
+ sources = [ "192.168.1.0/24" ];
+ }
+ {
+ rule = "deny";
+ }
+ ]
+ '';
+ description = ''
+ Use this option to limit user access to resources.
+ '';
+ };
+ extraArguments = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = "-46";
+ description = ''
+ Extra arguments for service.
+ Consult "Options" section in documentation for available arguments.
+ '';
+ };
+ extraConfig = mkOption {
+ type = types.nullOr types.lines;
+ default = null;
+ description = ''
+ Extra configuration for service. Use this to configure things like bandwidth limiter or ACL-based redirection.
+ Consult documentation for available options.
+ '';
+ };
+ };
+ });
+ default = [ ];
+ example = literalExample ''
+ [
+ {
+ type = "proxy";
+ bindAddress = "192.168.1.24";
+ bindPort = 3128;
+ auth = [ "none" ];
+ }
+ {
+ type = "proxy";
+ bindAddress = "10.10.1.20";
+ bindPort = 3128;
+ auth = [ "iponly" ];
+ }
+ {
+ type = "socks";
+ bindAddress = "172.17.0.1";
+ bindPort = 1080;
+ auth = [ "strong" ];
+ }
+ ]
+ '';
+ description = ''
+ Use this option to define 3proxy services.
+ '';
+ };
+ denyPrivate = mkOption {
+ type = types.bool;
+ default = true;
+ description = ''
+ Whether to deny access to private IP ranges including loopback.
+ '';
+ };
+ privateRanges = mkOption {
+ type = types.listOf types.str;
+ default = [
+ "0.0.0.0/8"
+ "127.0.0.0/8"
+ "10.0.0.0/8"
+ "100.64.0.0/10"
+ "172.16.0.0/12"
+ "192.168.0.0/16"
+ "::"
+ "::1"
+ "fc00::/7"
+ ];
+ example = [
+ "0.0.0.0/8"
+ "127.0.0.0/8"
+ "10.0.0.0/8"
+ "100.64.0.0/10"
+ "172.16.0.0/12"
+ "192.168.0.0/16"
+ "::"
+ "::1"
+ "fc00::/7"
+ ];
+ description = ''
+ What IP ranges to deny access when denyPrivate is set tu true.
+ '';
+ };
+ resolution = mkOption {
+ type = types.submodule {
+ options = {
+ nserver = mkOption {
+ type = types.listOf types.str;
+ default = [ ];
+ example = [ "127.0.0.53" "192.168.1.3:5353/tcp" ];
+ description = ''
+ List of nameservers to use.
+
+ Up to 5 nservers may be specified. If no nserver is configured,
+ default system name resolution functions are used.
+ '';
+ };
+ nscache = mkOption {
+ type = types.int;
+ default = 65535;
+ example = 65535;
+ description = "Set name cache size for IPv4.";
+ };
+ nscache6 = mkOption {
+ type = types.int;
+ default = 65535;
+ example = 65535;
+ description = "Set name cache size for IPv6.";
+ };
+ nsrecord = mkOption {
+ type = types.attrsOf types.str;
+ default = { };
+ example = {
+ "files.local" = "192.168.1.12";
+ "site.local" = "192.168.1.43";
+ };
+ description = "Adds static nsrecords.";
+ };
+ };
+ };
+ default = { };
+ description = ''
+ Use this option to configure name resolution and DNS caching.
+ '';
+ };
+ extraConfig = mkOption {
+ type = types.nullOr types.lines;
+ default = null;
+ description = ''
+ Extra configuration, appended to the 3proxy configuration file.
+ Consult documentation for available options.
+ '';
+ };
+ };
+
+ config = mkIf cfg.enable {
+ services._3proxy.confFile = mkDefault (pkgs.writeText "3proxy.conf" ''
+ # log to stdout
+ log
+
+ ${concatMapStringsSep "\n" (x: "nserver " + x) cfg.resolution.nserver}
+
+ nscache ${toString cfg.resolution.nscache}
+ nscache6 ${toString cfg.resolution.nscache6}
+
+ ${concatMapStringsSep "\n" (x: "nsrecord " + x)
+ (mapAttrsToList (name: value: "${name} ${value}")
+ cfg.resolution.nsrecord)}
+
+ ${optionalString (cfg.usersFile != null)
+ ''users $"${cfg.usersFile}"''
+ }
+
+ ${concatMapStringsSep "\n" (service: ''
+ auth ${concatStringsSep " " service.auth}
+
+ ${optionalString (cfg.denyPrivate)
+ "deny * * ${optionalList cfg.privateRanges}"}
+
+ ${concatMapStringsSep "\n" (acl:
+ "${acl.rule} ${
+ concatMapStringsSep " " optionalList [
+ acl.users
+ acl.sources
+ acl.targets
+ acl.targetPorts
+ ]
+ }") service.acl}
+
+ maxconn ${toString service.maxConnections}
+
+ ${optionalString (service.extraConfig != null) service.extraConfig}
+
+ ${service.type} -i${toString service.bindAddress} ${
+ optionalString (service.bindPort != null)
+ "-p${toString service.bindPort}"
+ } ${
+ optionalString (service.extraArguments != null) service.extraArguments
+ }
+
+ flush
+ '') cfg.services}
+ ${optionalString (cfg.extraConfig != null) cfg.extraConfig}
+ '');
+ systemd.services."3proxy" = {
+ description = "Tiny free proxy server";
+ documentation = [ "https://github.com/z3APA3A/3proxy/wiki" ];
+ after = [ "network.target" ];
+ wantedBy = [ "multi-user.target" ];
+ serviceConfig = {
+ DynamicUser = true;
+ StateDirectory = "3proxy";
+ ExecStart = "${pkg}/bin/3proxy ${cfg.confFile}";
+ Restart = "on-failure";
+ };
+ };
+ };
+
+ meta.maintainers = with maintainers; [ misuzu ];
+}
diff --git a/nixos/modules/services/networking/bind.nix b/nixos/modules/services/networking/bind.nix
index 06af4dbcca4ecf3332ca7f73a830da0adec70eef..d09c6735e123c4b25295ebf9f3d6ef8b2abae913 100644
--- a/nixos/modules/services/networking/bind.nix
+++ b/nixos/modules/services/networking/bind.nix
@@ -78,7 +78,11 @@ in
cacheNetworks = mkOption {
default = ["127.0.0.0/24"];
description = "
- What networks are allowed to use us as a resolver.
+ What networks are allowed to use us as a resolver. Note
+ that this is for recursive queries -- all networks are
+ allowed to query zones configured with the `zones` option.
+ It is recommended that you limit cacheNetworks to avoid your
+ server being used for DNS amplification attacks.
";
};
diff --git a/nixos/modules/services/networking/bitcoind.nix b/nixos/modules/services/networking/bitcoind.nix
index 1439d739da9d848d433c1662e9510269e7162cc1..4e00a88654747d18b69de50ce9f7021579fbfbcc 100644
--- a/nixos/modules/services/networking/bitcoind.nix
+++ b/nixos/modules/services/networking/bitcoind.nix
@@ -177,9 +177,6 @@ in {
NoNewPrivileges = "true";
PrivateDevices = "true";
MemoryDenyWriteExecute = "true";
-
- # Permission for preStart
- PermissionsStartOnly = "true";
};
};
users.users.${cfg.user} = {
@@ -187,6 +184,7 @@ in {
group = cfg.group;
description = "Bitcoin daemon user";
home = cfg.dataDir;
+ isSystemUser = true;
};
users.groups.${cfg.group} = {
name = cfg.group;
diff --git a/nixos/modules/services/networking/connman.nix b/nixos/modules/services/networking/connman.nix
index 31127f7904996402029fb6b2ed3bac28dedfdfac..8402be939fe5319e08c58ba7ec8d3e251ef14a40 100644
--- a/nixos/modules/services/networking/connman.nix
+++ b/nixos/modules/services/networking/connman.nix
@@ -4,7 +4,7 @@ with pkgs;
with lib;
let
- cfg = config.networking.connman;
+ cfg = config.services.connman;
configFile = pkgs.writeText "connman.conf" ''
[General]
NetworkInterfaceBlacklist=${concatStringsSep "," cfg.networkInterfaceBlacklist}
@@ -13,11 +13,15 @@ let
'';
in {
+ imports = [
+ (mkRenamedOptionModule [ "networking" "connman" ] [ "services" "connman" ])
+ ];
+
###### interface
options = {
- networking.connman = {
+ services.connman = {
enable = mkOption {
type = types.bool;
@@ -71,13 +75,13 @@ in {
assertions = [{
assertion = !config.networking.useDHCP;
- message = "You can not use services.networking.connman with services.networking.useDHCP";
+ message = "You can not use services.connman with networking.useDHCP";
}{
assertion = config.networking.wireless.enable;
- message = "You must use services.networking.connman with services.networking.wireless";
+ message = "You must use services.connman with networking.wireless";
}{
assertion = !config.networking.networkmanager.enable;
- message = "You can not use services.networking.connman with services.networking.networkmanager";
+ message = "You can not use services.connman with networking.networkmanager";
}];
environment.systemPackages = [ connman ];
diff --git a/nixos/modules/services/networking/ddclient.nix b/nixos/modules/services/networking/ddclient.nix
index 04ce5ca3a8749266808503f0ce23d2a2e578bea4..053efe712709112ec86023c22ca81cb1d10c0f83 100644
--- a/nixos/modules/services/networking/ddclient.nix
+++ b/nixos/modules/services/networking/ddclient.nix
@@ -30,6 +30,14 @@ with lib;
{
+ imports = [
+ (mkChangedOptionModule [ "services" "ddclient" "domain" ] [ "services" "ddclient" "domains" ]
+ (config:
+ let value = getAttrFromPath [ "services" "ddclient" "domain" ] config;
+ in if value != "" then [ value ] else []))
+ (mkRemovedOptionModule [ "services" "ddclient" "homeDir" ] "")
+ ];
+
###### interface
options = {
diff --git a/nixos/modules/services/networking/dhcpd.nix b/nixos/modules/services/networking/dhcpd.nix
index 0b2063bc424664ff1216dca02c6f0952d477a8d4..67f7d81188700b498b11b9914df5749da2a2ca38 100644
--- a/nixos/modules/services/networking/dhcpd.nix
+++ b/nixos/modules/services/networking/dhcpd.nix
@@ -182,6 +182,10 @@ in
{
+ imports = [
+ (mkRenamedOptionModule [ "services" "dhcpd" ] [ "services" "dhcpd4" ])
+ ];
+
###### interface
options = {
diff --git a/nixos/modules/services/networking/dnscache.nix b/nixos/modules/services/networking/dnscache.nix
index 5051fc916d9699ab8a7992e613d53fd0e769863f..d123bca9321931485be589eb48f346c8acb3b923 100644
--- a/nixos/modules/services/networking/dnscache.nix
+++ b/nixos/modules/services/networking/dnscache.nix
@@ -84,7 +84,7 @@ in {
config = mkIf config.services.dnscache.enable {
environment.systemPackages = [ pkgs.djbdns ];
- users.users.dnscache = {};
+ users.users.dnscache.isSystemUser = true;
systemd.services.dnscache = {
description = "djbdns dnscache server";
diff --git a/nixos/modules/services/networking/dnschain.nix b/nixos/modules/services/networking/dnschain.nix
index 5b58ea9b0c9106824a8f103d78f2a7dfd6aff3ac..2586f2d74e9c32e05dfe767da1ad5e86c5b33f94 100644
--- a/nixos/modules/services/networking/dnschain.nix
+++ b/nixos/modules/services/networking/dnschain.nix
@@ -137,7 +137,7 @@ in
];
services.pdns-recursor = mkIf cfgs.pdns-recursor.resolveDNSChainQueries {
- forwardZones =
+ forwardZonesRecurse =
{ bit = "127.0.0.1:${toString cfg.dns.port}";
dns = "127.0.0.1:${toString cfg.dns.port}";
};
@@ -180,4 +180,6 @@ in
};
+ meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
}
diff --git a/nixos/modules/services/networking/dnscrypt-wrapper.nix b/nixos/modules/services/networking/dnscrypt-wrapper.nix
index bf13d5c6f5fec6f1607320d103d6fded6e2db94a..e53fb7a157828f55ec6ca156df387510867eca50 100644
--- a/nixos/modules/services/networking/dnscrypt-wrapper.nix
+++ b/nixos/modules/services/networking/dnscrypt-wrapper.nix
@@ -142,6 +142,7 @@ in {
description = "dnscrypt-wrapper daemon user";
home = "${dataDir}";
createHome = true;
+ isSystemUser = true;
};
users.groups.dnscrypt-wrapper = { };
@@ -196,4 +197,7 @@ in {
};
};
+
+ meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
}
diff --git a/nixos/modules/services/networking/dnsdist.nix b/nixos/modules/services/networking/dnsdist.nix
index 12eee136e6394b5b4c1b5603487a2cf1bb9e3ff3..8249da69bc1a800b348b546f7b9bc4c763911a48 100644
--- a/nixos/modules/services/networking/dnsdist.nix
+++ b/nixos/modules/services/networking/dnsdist.nix
@@ -46,11 +46,10 @@ in {
RestartSec="1";
DynamicUser = true;
StartLimitInterval="0";
- PrivateTmp=true;
PrivateDevices=true;
- CapabilityBoundingSet="CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID";
+ AmbientCapabilities="CAP_NET_BIND_SERVICE";
+ CapabilityBoundingSet="CAP_NET_BIND_SERVICE";
ExecStart = "${pkgs.dnsdist}/bin/dnsdist --supervised --disable-syslog --config ${configFile}";
- ProtectSystem="full";
ProtectHome=true;
RestrictAddressFamilies="AF_UNIX AF_INET AF_INET6";
LimitNOFILE="16384";
diff --git a/nixos/modules/services/networking/eternal-terminal.nix b/nixos/modules/services/networking/eternal-terminal.nix
index be7337ece7e4f227741d905f93b87e90bf9db396..a2e5b30dc0f02541ed6d1ea9001c93bc7bf20cec 100644
--- a/nixos/modules/services/networking/eternal-terminal.nix
+++ b/nixos/modules/services/networking/eternal-terminal.nix
@@ -23,6 +23,8 @@ in
type = types.int;
description = ''
The port the server should listen on. Will use the server's default (2022) if not specified.
+
+ Make sure to open this port in the firewall if necessary.
'';
};
@@ -86,4 +88,8 @@ in
};
};
};
+
+ meta = {
+ maintainers = with lib.maintainers; [ pingiun ];
+ };
}
diff --git a/nixos/modules/services/networking/fakeroute.nix b/nixos/modules/services/networking/fakeroute.nix
index 82a9fb729d841a7c9962bcce8007cfa97feaf9ad..7916ad4098a7c3344df9ceee63ef8cf28f15baff 100644
--- a/nixos/modules/services/networking/fakeroute.nix
+++ b/nixos/modules/services/networking/fakeroute.nix
@@ -60,4 +60,6 @@ in
};
+ meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
}
diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix
index 5b3aa19af3bb7715caa3e7d54cc357bc09d48268..15aaf74106740abf7705995dc7fce145c9e507b6 100644
--- a/nixos/modules/services/networking/firewall.nix
+++ b/nixos/modules/services/networking/firewall.nix
@@ -42,16 +42,7 @@ let
kernelHasRPFilter = ((kernel.config.isEnabled or (x: false)) "IP_NF_MATCH_RPFILTER") || (kernel.features.netfilterRPFilter or false);
- helpers =
- ''
- # Helper command to manipulate both the IPv4 and IPv6 tables.
- ip46tables() {
- iptables -w "$@"
- ${optionalString config.networking.enableIPv6 ''
- ip6tables -w "$@"
- ''}
- }
- '';
+ helpers = import ./helpers.nix { inherit config lib; };
writeShScript = name: text: let dir = pkgs.writeScriptBin name ''
#! ${pkgs.runtimeShell} -e
@@ -271,7 +262,7 @@ let
apply = canonicalizePortList;
example = [ 22 80 ];
description =
- ''
+ ''
List of TCP ports on which incoming connections are
accepted.
'';
@@ -282,7 +273,7 @@ let
default = [ ];
example = [ { from = 8999; to = 9003; } ];
description =
- ''
+ ''
A range of TCP ports on which incoming connections are
accepted.
'';
@@ -331,6 +322,17 @@ in
'';
};
+ package = mkOption {
+ type = types.package;
+ default = pkgs.iptables;
+ defaultText = "pkgs.iptables";
+ example = literalExample "pkgs.iptables-nftables-compat";
+ description =
+ ''
+ The iptables package to use for running the firewall service."
+ '';
+ };
+
logRefusedConnections = mkOption {
type = types.bool;
default = true;
@@ -536,7 +538,7 @@ in
networking.firewall.trustedInterfaces = [ "lo" ];
- environment.systemPackages = [ pkgs.iptables ] ++ cfg.extraPackages;
+ environment.systemPackages = [ cfg.package ] ++ cfg.extraPackages;
boot.kernelModules = (optional cfg.autoLoadConntrackHelpers "nf_conntrack")
++ map (x: "nf_conntrack_${x}") cfg.connectionTrackingModules;
@@ -555,7 +557,7 @@ in
before = [ "network-pre.target" ];
after = [ "systemd-modules-load.service" ];
- path = [ pkgs.iptables ] ++ cfg.extraPackages;
+ path = [ cfg.package ] ++ cfg.extraPackages;
# FIXME: this module may also try to load kernel modules, but
# containers don't have CAP_SYS_MODULE. So the host system had
diff --git a/nixos/modules/services/networking/go-shadowsocks2.nix b/nixos/modules/services/networking/go-shadowsocks2.nix
new file mode 100644
index 0000000000000000000000000000000000000000..afbd7ea27c65c82c513b1e1fb3b463e01716eca2
--- /dev/null
+++ b/nixos/modules/services/networking/go-shadowsocks2.nix
@@ -0,0 +1,30 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+ cfg = config.services.go-shadowsocks2.server;
+in {
+ options.services.go-shadowsocks2.server = {
+ enable = mkEnableOption "go-shadowsocks2 server";
+
+ listenAddress = mkOption {
+ type = types.str;
+ description = "Server listen address or URL";
+ example = "ss://AEAD_CHACHA20_POLY1305:your-password@:8488";
+ };
+ };
+
+ config = mkIf cfg.enable {
+ systemd.services.go-shadowsocks2-server = {
+ description = "go-shadowsocks2 server";
+
+ after = [ "network.target" ];
+ wantedBy = [ "multi-user.target" ];
+
+ serviceConfig = {
+ ExecStart = "${pkgs.go-shadowsocks2}/bin/go-shadowsocks2 -s '${cfg.listenAddress}'";
+ DynamicUser = true;
+ };
+ };
+ };
+}
diff --git a/nixos/modules/services/networking/hans.nix b/nixos/modules/services/networking/hans.nix
index 20e57e4626efa5e64ef9e3064fb022d33d7d620e..4f60300f5ff41b27757c05cc8df1198882c55941 100644
--- a/nixos/modules/services/networking/hans.nix
+++ b/nixos/modules/services/networking/hans.nix
@@ -138,6 +138,7 @@ in
users.users = singleton {
name = hansUser;
description = "Hans daemon user";
+ isSystemUser = true;
};
};
diff --git a/nixos/modules/services/networking/haproxy.nix b/nixos/modules/services/networking/haproxy.nix
index 0438d0bf8d86061e0c627741b5cae849b546b036..aff71e5e97daff7295f749dc4984e84704918cce 100644
--- a/nixos/modules/services/networking/haproxy.nix
+++ b/nixos/modules/services/networking/haproxy.nix
@@ -1,7 +1,16 @@
{ config, lib, pkgs, ... }:
+
let
cfg = config.services.haproxy;
- haproxyCfg = pkgs.writeText "haproxy.conf" cfg.config;
+
+ haproxyCfg = pkgs.writeText "haproxy.conf" ''
+ global
+ # needed for hot-reload to work without dropping packets in multi-worker mode
+ stats socket /run/haproxy/haproxy.sock mode 600 expose-fd listeners level user
+
+ ${cfg.config}
+ '';
+
in
with lib;
{
@@ -25,9 +34,7 @@ with lib;
haproxy.conf.
'';
};
-
};
-
};
config = mkIf cfg.enable {
@@ -42,21 +49,16 @@ with lib;
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
- Type = "forking";
- PIDFile = "/run/haproxy.pid";
- ExecStartPre = "${pkgs.haproxy}/sbin/haproxy -c -q -f ${haproxyCfg}";
- ExecStart = "${pkgs.haproxy}/sbin/haproxy -D -f ${haproxyCfg} -p /run/haproxy.pid";
- ExecReload = "-${pkgs.bash}/bin/bash -c \"exec ${pkgs.haproxy}/sbin/haproxy -D -f ${haproxyCfg} -p /run/haproxy.pid -sf $MAINPID\"";
+ DynamicUser = true;
+ Type = "notify";
+ # when running the config test, don't be quiet so we can see what goes wrong
+ ExecStartPre = "${pkgs.haproxy}/sbin/haproxy -c -f ${haproxyCfg}";
+ ExecStart = "${pkgs.haproxy}/sbin/haproxy -Ws -f ${haproxyCfg}";
+ Restart = "on-failure";
+ RuntimeDirectory = "haproxy";
+ # needed in case we bind to port < 1024
+ AmbientCapabilities = "CAP_NET_BIND_SERVICE";
};
};
-
- environment.systemPackages = [ pkgs.haproxy ];
-
- users.users.haproxy = {
- group = "haproxy";
- uid = config.ids.uids.haproxy;
- };
-
- users.groups.haproxy.gid = config.ids.uids.haproxy;
};
}
diff --git a/nixos/modules/services/networking/helpers.nix b/nixos/modules/services/networking/helpers.nix
new file mode 100644
index 0000000000000000000000000000000000000000..d7d42de0e3a868a919409a5a0a538adebf2bc373
--- /dev/null
+++ b/nixos/modules/services/networking/helpers.nix
@@ -0,0 +1,11 @@
+{ config, lib, ... }: ''
+ # Helper command to manipulate both the IPv4 and IPv6 tables.
+ ip46tables() {
+ iptables -w "$@"
+ ${
+ lib.optionalString config.networking.enableIPv6 ''
+ ip6tables -w "$@"
+ ''
+ }
+ }
+''
diff --git a/nixos/modules/services/networking/i2pd.nix b/nixos/modules/services/networking/i2pd.nix
index f2be417738ee8b1b886e43a87f06bb853f383a14..e2c2275b5512ca21a5e3f4c5c36391c7d37b31b8 100644
--- a/nixos/modules/services/networking/i2pd.nix
+++ b/nixos/modules/services/networking/i2pd.nix
@@ -235,6 +235,10 @@ in
{
+ imports = [
+ (mkRenamedOptionModule [ "services" "i2pd" "extIp" ] [ "services" "i2pd" "address" ])
+ ];
+
###### interface
options = {
diff --git a/nixos/modules/services/networking/iodine.nix b/nixos/modules/services/networking/iodine.nix
index 344f84374bbd6485481f1d6f4deee1b3193ad516..97b5843bbcf1cfb9ca8c7e78fad8115371c3a4bd 100644
--- a/nixos/modules/services/networking/iodine.nix
+++ b/nixos/modules/services/networking/iodine.nix
@@ -11,6 +11,13 @@ let
in
{
+ imports = [
+ (mkRenamedOptionModule [ "services" "iodined" "enable" ] [ "services" "iodine" "server" "enable" ])
+ (mkRenamedOptionModule [ "services" "iodined" "domain" ] [ "services" "iodine" "server" "domain" ])
+ (mkRenamedOptionModule [ "services" "iodined" "ip" ] [ "services" "iodine" "server" "ip" ])
+ (mkRenamedOptionModule [ "services" "iodined" "extraConfig" ] [ "services" "iodine" "server" "extraConfig" ])
+ (mkRemovedOptionModule [ "services" "iodined" "client" ] "")
+ ];
### configuration
diff --git a/nixos/modules/services/networking/jormungandr.nix b/nixos/modules/services/networking/jormungandr.nix
deleted file mode 100644
index 85e804d6cf25ed07642207a757be9aa9b0fc040b..0000000000000000000000000000000000000000
--- a/nixos/modules/services/networking/jormungandr.nix
+++ /dev/null
@@ -1,100 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
- cfg = config.services.jormungandr;
-
- inherit (lib) mkEnableOption mkIf mkOption;
- inherit (lib) optionalString types;
-
- dataDir = "/var/lib/jormungandr";
-
- # Default settings so far, as the service matures we will
- # move these out as separate settings
- configSettings = {
- storage = dataDir;
- p2p = {
- public_address = "/ip4/127.0.0.1/tcp/8299";
- messages = "high";
- blocks = "high";
- };
- rest = {
- listen = "127.0.0.1:8607";
- };
- };
-
- configFile = if cfg.configFile == null then
- pkgs.writeText "jormungandr.yaml" (builtins.toJSON configSettings)
- else cfg.configFile;
-
-in {
-
- options = {
-
- services.jormungandr = {
- enable = mkEnableOption "jormungandr service";
-
- configFile = mkOption {
- type = types.nullOr types.path;
- default = null;
- example = "/var/lib/jormungandr/node.yaml";
- description = ''
- The path of the jormungandr blockchain configuration file in YAML format.
- If no file is specified, a file is generated using the other options.
- '';
- };
-
- secretFile = mkOption {
- type = types.nullOr types.path;
- default = null;
- example = "/etc/secret/jormungandr.yaml";
- description = ''
- The path of the jormungandr blockchain secret node configuration file in
- YAML format. Do not store this in nix store!
- '';
- };
-
- genesisBlockHash = mkOption {
- type = types.nullOr types.str;
- default = null;
- example = "d70495af81ae8600aca3e642b2427327cb6001ec4d7a0037e96a00dabed163f9";
- description = ''
- Set the genesis block hash (the hash of the block0) so we can retrieve
- the genesis block (and the blockchain configuration) from the existing
- storage or from the network.
- '';
- };
-
- genesisBlockFile = mkOption {
- type = types.nullOr types.path;
- default = null;
- example = "/var/lib/jormungandr/block-0.bin";
- description = ''
- The path of the genesis block file if we are hosting it locally.
- '';
- };
-
- };
- };
-
- config = mkIf cfg.enable {
-
- systemd.services.jormungandr = {
- description = "jormungandr server";
- wantedBy = [ "multi-user.target" ];
- after = [ "network-online.target" ];
- environment = {
- RUST_BACKTRACE = "full";
- };
- serviceConfig = {
- DynamicUser = true;
- StateDirectory = baseNameOf dataDir;
- ExecStart = ''
- ${pkgs.jormungandr}/bin/jormungandr --config ${configFile} \
- ${optionalString (cfg.secretFile != null) " --secret ${cfg.secretFile}"} \
- ${optionalString (cfg.genesisBlockHash != null) " --genesis-block-hash ${cfg.genesisBlockHash}"} \
- ${optionalString (cfg.genesisBlockFile != null) " --genesis-block ${cfg.genesisBlockFile}"}
- '';
- };
- };
- };
-}
diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
index fc516c01230a331dcaf932cfae834d8fd31c0c39..574074944d5e768aef8ee8efbe05438106675936 100644
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@@ -13,6 +13,17 @@ in
{
meta.maintainers = [ maintainers.vcunat /* upstream developer */ ];
+ imports = [
+ (mkChangedOptionModule [ "services" "kresd" "interfaces" ] [ "services" "kresd" "listenPlain" ]
+ (config:
+ let value = getAttrFromPath [ "services" "kresd" "interfaces" ] config;
+ in map
+ (iface: if elem ":" (stringToCharacters iface) then "[${iface}]:53" else "${iface}:53") # Syntax depends on being IPv6 or IPv4.
+ value
+ )
+ )
+ ];
+
###### interface
options.services.kresd = {
enable = mkOption {
@@ -39,11 +50,12 @@ in
Directory for caches. They are intended to survive reboots.
'';
};
- interfaces = mkOption {
+ listenPlain = mkOption {
type = with types; listOf str;
- default = [ "::1" "127.0.0.1" ];
+ default = [ "[::1]:53" "127.0.0.1:53" ];
description = ''
- What addresses the server should listen on. (UDP+TCP 53)
+ What addresses and ports the server should listen on.
+ For detailed syntax see ListenStream in man systemd.socket.
'';
};
listenTLS = mkOption {
@@ -51,7 +63,7 @@ in
default = [];
example = [ "198.51.100.1:853" "[2001:db8::1]:853" "853" ];
description = ''
- Addresses on which kresd should provide DNS over TLS (see RFC 7858).
+ Addresses and ports on which kresd should provide DNS over TLS (see RFC 7858).
For detailed syntax see ListenStream in man systemd.socket.
'';
};
@@ -76,10 +88,7 @@ in
systemd.sockets.kresd = rec {
wantedBy = [ "sockets.target" ];
before = wantedBy;
- listenStreams = map
- # Syntax depends on being IPv6 or IPv4.
- (iface: if elem ":" (stringToCharacters iface) then "[${iface}]:53" else "${iface}:53")
- cfg.interfaces;
+ listenStreams = cfg.listenPlain;
socketConfig = {
ListenDatagram = listenStreams;
FreeBind = true;
diff --git a/nixos/modules/services/networking/matterbridge.nix b/nixos/modules/services/networking/matterbridge.nix
index 1fd63348c16c187cd00aca85688dd18cc7f0c880..682eaa6eb297bf5ace9c531e07ea6ad0e2febbb6 100644
--- a/nixos/modules/services/networking/matterbridge.nix
+++ b/nixos/modules/services/networking/matterbridge.nix
@@ -95,6 +95,7 @@ in
users.users = optional (cfg.user == "matterbridge")
{ name = "matterbridge";
group = "matterbridge";
+ isSystemUser = true;
};
users.groups = optional (cfg.group == "matterbridge")
diff --git a/nixos/modules/services/networking/minidlna.nix b/nixos/modules/services/networking/minidlna.nix
index 0947471adbc943d66d14fdaf74141a70f0ee0857..3ddea3c9757b30acf90eaa69eacc8b355f09f582 100644
--- a/nixos/modules/services/networking/minidlna.nix
+++ b/nixos/modules/services/networking/minidlna.nix
@@ -36,6 +36,37 @@ in
'';
};
+ services.minidlna.friendlyName = mkOption {
+ type = types.str;
+ default = "${config.networking.hostName} MiniDLNA";
+ defaultText = "$HOSTNAME MiniDLNA";
+ example = "rpi3";
+ description =
+ ''
+ Name that the DLNA server presents to clients.
+ '';
+ };
+
+ services.minidlna.rootContainer = mkOption {
+ type = types.str;
+ default = ".";
+ example = "B";
+ description =
+ ''
+ Use a different container as the root of the directory tree presented
+ to clients. The possible values are:
+ - "." - standard container
+ - "B" - "Browse Directory"
+ - "M" - "Music"
+ - "P" - "Pictures"
+ - "V" - "Video"
+ - Or, you can specify the ObjectID of your desired root container
+ (eg. 1$F for Music/Playlists)
+ If you specify "B" and the client device is audio-only then
+ "Music/Folders" will be used as root.
+ '';
+ };
+
services.minidlna.loglevel = mkOption {
type = types.str;
default = "warn";
@@ -66,7 +97,37 @@ in
services.minidlna.config = mkOption {
type = types.lines;
- description = "The contents of MiniDLNA's configuration file.";
+ description =
+ ''
+ The contents of MiniDLNA's configuration file.
+ When the service is activated, a basic template is generated
+ from the current options opened here.
+ '';
+ };
+
+ services.minidlna.extraConfig = mkOption {
+ type = types.lines;
+ default = "";
+ example = ''
+ # Not exhaustive example
+ # Support for streaming .jpg and .mp3 files to a TiVo supporting HMO.
+ enable_tivo=no
+ # SSDP notify interval, in seconds.
+ notify_interval=10
+ # maximum number of simultaneous connections
+ # note: many clients open several simultaneous connections while
+ # streaming
+ max_connections=50
+ # set this to yes to allow symlinks that point outside user-defined
+ # media_dirs.
+ wide_links=yes
+ '';
+ description =
+ ''
+ Extra minidlna options not yet opened for configuration here
+ (strict_dlna, model_number, model_name, etc...). This is appended
+ to the current service already provided.
+ '';
};
};
@@ -75,13 +136,15 @@ in
services.minidlna.config =
''
port=${toString port}
- friendly_name=${config.networking.hostName} MiniDLNA
+ friendly_name=${cfg.friendlyName}
db_dir=/var/cache/minidlna
log_level=${cfg.loglevel}
inotify=yes
+ root_container=${cfg.rootContainer}
${concatMapStrings (dir: ''
media_dir=${dir}
'') cfg.mediaDirs}
+ ${cfg.extraConfig}
'';
users.users.minidlna = {
diff --git a/nixos/modules/services/networking/monero.nix b/nixos/modules/services/networking/monero.nix
index 831e4d60d8da3c5d25fb1948be3f927ac5c2cd84..98a3456f639696df9b0eb43cfd09118a7d4238e0 100644
--- a/nixos/modules/services/networking/monero.nix
+++ b/nixos/modules/services/networking/monero.nix
@@ -224,15 +224,17 @@ in
};
};
- assertions = singleton {
- assertion = cfg.mining.enable -> cfg.mining.address != "";
- message = ''
+ assertions = singleton {
+ assertion = cfg.mining.enable -> cfg.mining.address != "";
+ message = ''
You need a Monero address to receive mining rewards:
specify one using option monero.mining.address.
- '';
- };
+ '';
+ };
};
+ meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
}
diff --git a/nixos/modules/services/networking/morty.nix b/nixos/modules/services/networking/morty.nix
index 1b3084fe9abbc81d2c81c91f2bee65c610f23ca2..e3a6444c11635f8077b0a209c5a63cbeb58c5a7d 100644
--- a/nixos/modules/services/networking/morty.nix
+++ b/nixos/modules/services/networking/morty.nix
@@ -74,6 +74,7 @@ in
{ description = "Morty user";
createHome = true;
home = "/var/lib/morty";
+ isSystemUser = true;
};
systemd.services.morty =
diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix
index 082953d2f6ab7b9a86ffc0c0edd195afe713bd79..3054ae1b201f5d30b9a4b83c44a11b1f3224cb87 100644
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@@ -46,6 +46,11 @@ let
'';
in
{
+ imports = [
+ (mkRenamedOptionModule [ "services" "murmur" "welcome" ] [ "services" "murmur" "welcometext" ])
+ (mkRemovedOptionModule [ "services" "murmur" "pidfile" ] "Hardcoded to /run/murmur/murmurd.pid now")
+ ];
+
options = {
services.murmur = {
enable = mkOption {
diff --git a/nixos/modules/services/networking/mxisd.nix b/nixos/modules/services/networking/mxisd.nix
index 02e89f441b3455cd41ac13dec9c42cf876736201..a3d61922e578593179614f0b4893da871978b23e 100644
--- a/nixos/modules/services/networking/mxisd.nix
+++ b/nixos/modules/services/networking/mxisd.nix
@@ -3,6 +3,15 @@
with lib;
let
+
+ isMa1sd =
+ package:
+ lib.hasPrefix "ma1sd" package.name;
+
+ isMxisd =
+ package:
+ lib.hasPrefix "mxisd" package.name;
+
cfg = config.services.mxisd;
server = optionalAttrs (cfg.server.name != null) { inherit (cfg.server) name; }
@@ -12,37 +21,41 @@ let
matrix.domain = cfg.matrix.domain;
key.path = "${cfg.dataDir}/signing.key";
storage = {
- provider.sqlite.database = "${cfg.dataDir}/mxisd.db";
+ provider.sqlite.database = if isMa1sd cfg.package
+ then "${cfg.dataDir}/ma1sd.db"
+ else "${cfg.dataDir}/mxisd.db";
};
} // optionalAttrs (server != {}) { inherit server; };
# merges baseConfig and extraConfig into a single file
fullConfig = recursiveUpdate baseConfig cfg.extraConfig;
- configFile = pkgs.writeText "mxisd-config.yaml" (builtins.toJSON fullConfig);
+ configFile = if isMa1sd cfg.package
+ then pkgs.writeText "ma1sd-config.yaml" (builtins.toJSON fullConfig)
+ else pkgs.writeText "mxisd-config.yaml" (builtins.toJSON fullConfig);
in {
options = {
services.mxisd = {
- enable = mkEnableOption "mxisd matrix federated identity server";
+ enable = mkEnableOption "matrix federated identity server";
package = mkOption {
type = types.package;
default = pkgs.mxisd;
defaultText = "pkgs.mxisd";
- description = "The mxisd package to use";
+ description = "The mxisd/ma1sd package to use";
};
dataDir = mkOption {
type = types.str;
default = "/var/lib/mxisd";
- description = "Where data mxisd uses resides";
+ description = "Where data mxisd/ma1sd uses resides";
};
extraConfig = mkOption {
type = types.attrs;
default = {};
- description = "Extra options merged into the mxisd configuration";
+ description = "Extra options merged into the mxisd/ma1sd configuration";
};
matrix = {
@@ -62,7 +75,7 @@ in {
type = types.nullOr types.str;
default = null;
description = ''
- Public hostname of mxisd, if different from the Matrix domain.
+ Public hostname of mxisd/ma1sd, if different from the Matrix domain.
'';
};
@@ -103,11 +116,13 @@ in {
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
- serviceConfig = {
+ serviceConfig = let
+ executable = if isMa1sd cfg.package then "ma1sd" else "mxisd";
+ in {
Type = "simple";
User = "mxisd";
Group = "mxisd";
- ExecStart = "${cfg.package}/bin/mxisd -c ${configFile}";
+ ExecStart = "${cfg.package}/bin/${executable} -c ${configFile}";
WorkingDirectory = cfg.dataDir;
Restart = "on-failure";
};
diff --git a/nixos/modules/services/networking/namecoind.nix b/nixos/modules/services/networking/namecoind.nix
index c8ee0a2f5647475dfe38b988442effc9e7ed326c..43a9a0b2598b8d6946ca3a946cb82e203878d8c8 100644
--- a/nixos/modules/services/networking/namecoind.nix
+++ b/nixos/modules/services/networking/namecoind.nix
@@ -201,4 +201,6 @@ in
};
+ meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
}
diff --git a/nixos/modules/services/networking/nat.nix b/nixos/modules/services/networking/nat.nix
index 89d8590093dd5a3a12bf0d438bc20f5392ca1a64..f1238bc6b168ba53aa1f0142f2f72c01199767de 100644
--- a/nixos/modules/services/networking/nat.nix
+++ b/nixos/modules/services/networking/nat.nix
@@ -7,29 +7,36 @@
with lib;
let
-
cfg = config.networking.nat;
dest = if cfg.externalIP == null then "-j MASQUERADE" else "-j SNAT --to-source ${cfg.externalIP}";
+ helpers = import ./helpers.nix { inherit config lib; };
+
flushNat = ''
- iptables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true
- iptables -w -t nat -F nixos-nat-pre 2>/dev/null || true
- iptables -w -t nat -X nixos-nat-pre 2>/dev/null || true
- iptables -w -t nat -D POSTROUTING -j nixos-nat-post 2>/dev/null || true
- iptables -w -t nat -F nixos-nat-post 2>/dev/null || true
- iptables -w -t nat -X nixos-nat-post 2>/dev/null || true
+ ${helpers}
+ ip46tables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true
+ ip46tables -w -t nat -F nixos-nat-pre 2>/dev/null || true
+ ip46tables -w -t nat -X nixos-nat-pre 2>/dev/null || true
+ ip46tables -w -t nat -D POSTROUTING -j nixos-nat-post 2>/dev/null || true
+ ip46tables -w -t nat -F nixos-nat-post 2>/dev/null || true
+ ip46tables -w -t nat -X nixos-nat-post 2>/dev/null || true
+ ip46tables -w -t nat -D OUTPUT -j nixos-nat-out 2>/dev/null || true
+ ip46tables -w -t nat -F nixos-nat-out 2>/dev/null || true
+ ip46tables -w -t nat -X nixos-nat-out 2>/dev/null || true
${cfg.extraStopCommands}
'';
setupNat = ''
+ ${helpers}
# Create subchain where we store rules
- iptables -w -t nat -N nixos-nat-pre
- iptables -w -t nat -N nixos-nat-post
+ ip46tables -w -t nat -N nixos-nat-pre
+ ip46tables -w -t nat -N nixos-nat-post
+ ip46tables -w -t nat -N nixos-nat-out
# We can't match on incoming interface in POSTROUTING, so
- # mark packets coming from the external interfaces.
+ # mark packets coming from the internal interfaces.
${concatMapStrings (iface: ''
iptables -w -t nat -A nixos-nat-pre \
-i '${iface}' -j MARK --set-mark 1
@@ -88,8 +95,9 @@ let
${cfg.extraCommands}
# Append our chains to the nat tables
- iptables -w -t nat -A PREROUTING -j nixos-nat-pre
- iptables -w -t nat -A POSTROUTING -j nixos-nat-post
+ ip46tables -w -t nat -A PREROUTING -j nixos-nat-pre
+ ip46tables -w -t nat -A POSTROUTING -j nixos-nat-post
+ ip46tables -w -t nat -A OUTPUT -j nixos-nat-out
'';
in
diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 2061c02fffbdbe8026dddae074d5b7581f4ff25d..53029b590677d079b3c36b813d454168efb053e5 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -5,11 +5,21 @@ with lib;
let
cfg = config.networking.networkmanager;
- dynamicHostsEnabled =
- cfg.dynamicHosts.enable && cfg.dynamicHosts.hostsDirs != {};
-
- # /var/lib/misc is for dnsmasq.leases.
- stateDirs = "/var/lib/NetworkManager /var/lib/dhclient /var/lib/misc";
+ basePackages = with pkgs; [
+ crda
+ modemmanager
+ networkmanager
+ networkmanager-fortisslvpn
+ networkmanager-iodine
+ networkmanager-l2tp
+ networkmanager-openconnect
+ networkmanager-openvpn
+ networkmanager-vpnc
+ ] ++ optional (!delegateWireless && !enableIwd) wpa_supplicant;
+
+ delegateWireless = config.networking.wireless.enable == true && cfg.unmanaged != [];
+
+ enableIwd = cfg.wifi.backend == "iwd";
configFile = pkgs.writeText "NetworkManager.conf" ''
[main]
@@ -25,6 +35,7 @@ let
[logging]
level=${cfg.logLevel}
+ audit=${lib.boolToString config.security.audit.enable}
[connection]
ipv6.ip6-privacy=2
@@ -35,6 +46,7 @@ let
[device]
wifi.scan-rand-mac-address=${if cfg.wifi.scanRandMacAddress then "yes" else "no"}
+ wifi.backend=${cfg.wifi.backend}
${cfg.extraConfig}
'';
@@ -173,29 +185,18 @@ in {
'';
};
- # Ugly hack for using the correct gnome3 packageSet
- basePackages = mkOption {
- type = types.attrsOf types.package;
- default = { inherit (pkgs)
- networkmanager modemmanager wpa_supplicant crda
- networkmanager-openvpn networkmanager-vpnc
- networkmanager-openconnect networkmanager-fortisslvpn
- networkmanager-l2tp networkmanager-iodine; };
- internal = true;
- };
-
packages = mkOption {
- type = types.listOf types.path;
+ type = types.listOf types.package;
default = [ ];
description = ''
Extra packages that provide NetworkManager plugins.
'';
- apply = list: (attrValues cfg.basePackages) ++ list;
+ apply = list: basePackages ++ list;
};
dhcp = mkOption {
type = types.enum [ "dhclient" "dhcpcd" "internal" ];
- default = "dhclient";
+ default = "internal";
description = ''
Which program (or internal library) should be used for DHCP.
'';
@@ -232,6 +233,15 @@ in {
wifi = {
macAddress = macAddressOpt;
+ backend = mkOption {
+ type = types.enum [ "wpa_supplicant" "iwd" ];
+ default = "wpa_supplicant";
+ description = ''
+ Specify the Wi-Fi backend used for the device.
+ Currently supported are or (experimental).
+ '';
+ };
+
powersave = mkOption {
type = types.nullOr types.bool;
default = null;
@@ -322,73 +332,36 @@ in {
so you don't need to to that yourself.
'';
};
-
- dynamicHosts = {
- enable = mkOption {
- type = types.bool;
- default = false;
- description = ''
- Enabling this option requires the
- option to be
- set to dnsmasq. If enabled, the directories
- defined by the
-
- option will be set up when the service starts. The dnsmasq instance
- managed by NetworkManager will then watch those directories for
- hosts files (see the --hostsdir option of
- dnsmasq). This way a non-privileged user can add or override DNS
- entries on the local system (depending on what hosts directories
- that are configured)..
- '';
- };
- hostsDirs = mkOption {
- type = with types; attrsOf (submodule {
- options = {
- user = mkOption {
- type = types.str;
- default = "root";
- description = ''
- The user that will own the hosts directory.
- '';
- };
- group = mkOption {
- type = types.str;
- default = "root";
- description = ''
- The group that will own the hosts directory.
- '';
- };
- };
- });
- default = {};
- description = ''
- Defines a set of directories (relative to
- /run/NetworkManager/hostdirs) that dnsmasq will
- watch for hosts files.
- '';
- };
- };
};
};
+ imports = [
+ (mkRenamedOptionModule [ "networking" "networkmanager" "useDnsmasq" ] [ "networking" "networkmanager" "dns" ])
+ (mkRemovedOptionModule ["networking" "networkmanager" "dynamicHosts"] ''
+ This option was removed because allowing (multiple) regular users to
+ override host entries affecting the whole system opens up a huge attack
+ vector. There seem to be very rare cases where this might be useful.
+ Consider setting system-wide host entries using networking.hosts, provide
+ them via the DNS server in your network, or use environment.etc
+ to add a file into /etc/NetworkManager/dnsmasq.d reconfiguring hostsdir.
+ '')
+ ];
+
###### implementation
config = mkIf cfg.enable {
assertions = [
- { assertion = config.networking.wireless.enable == false;
- message = "You can not use networking.networkmanager with networking.wireless";
- }
- { assertion = !dynamicHostsEnabled || (dynamicHostsEnabled && cfg.dns == "dnsmasq");
+ { assertion = config.networking.wireless.enable == true -> cfg.unmanaged != [];
message = ''
- To use networking.networkmanager.dynamicHosts you also need to set
- networking.networkmanager.dns = "dnsmasq"
+ You can not use networking.networkmanager with networking.wireless.
+ Except if you mark some interfaces as unmanaged by NetworkManager.
'';
}
];
- environment.etc = with cfg.basePackages; [
+ environment.etc = with pkgs; [
{ source = configFile;
target = "NetworkManager/NetworkManager.conf";
}
@@ -419,12 +392,6 @@ in {
target = "NetworkManager/dispatcher.d/${dispatcherTypesSubdirMap.${s.type}}03userscript${lib.fixedWidthNumber 4 i}";
mode = "0544";
}) cfg.dispatcherScripts
- ++ optional dynamicHostsEnabled
- { target = "NetworkManager/dnsmasq.d/dyndns.conf";
- text = concatMapStrings (n: ''
- hostsdir=/run/NetworkManager/hostsdirs/${n}
- '') (attrNames cfg.dynamicHosts.hostsDirs);
- }
++ optional cfg.enableStrongSwan
{ source = "${pkgs.networkmanager_strongswan}/lib/NetworkManager/VPN/nm-strongswan-service.name";
target = "NetworkManager/VPN/nm-strongswan-service.name";
@@ -453,35 +420,32 @@ in {
systemd.packages = cfg.packages;
+ systemd.tmpfiles.rules = [
+ "d /etc/NetworkManager/system-connections 0700 root root -"
+ "d /etc/ipsec.d 0700 root root -"
+ "d /var/lib/NetworkManager-fortisslvpn 0700 root root -"
+
+ "d /var/lib/dhclient 0755 root root -"
+ "d /var/lib/misc 0755 root root -" # for dnsmasq.leases
+ ];
+
systemd.services.NetworkManager = {
wantedBy = [ "network.target" ];
restartTriggers = [ configFile ];
- preStart = ''
- mkdir -m 700 -p /etc/NetworkManager/system-connections
- mkdir -m 700 -p /etc/ipsec.d
- mkdir -m 755 -p ${stateDirs}
- '';
+ aliases = [ "dbus-org.freedesktop.NetworkManager.service" ];
+
+ serviceConfig = {
+ StateDirectory = "NetworkManager";
+ StateDirectoryMode = 755; # not sure if this really needs to be 755
+ };
};
systemd.services.NetworkManager-wait-online = {
wantedBy = [ "network-online.target" ];
};
- systemd.services.nm-setup-hostsdirs = mkIf dynamicHostsEnabled {
- wantedBy = [ "NetworkManager.service" ];
- before = [ "NetworkManager.service" ];
- partOf = [ "NetworkManager.service" ];
- script = concatStrings (mapAttrsToList (n: d: ''
- mkdir -p "/run/NetworkManager/hostsdirs/${n}"
- chown "${d.user}:${d.group}" "/run/NetworkManager/hostsdirs/${n}"
- chmod 0775 "/run/NetworkManager/hostsdirs/${n}"
- '') cfg.dynamicHosts.hostsDirs);
- serviceConfig = {
- Type = "oneshot";
- RemainAfterExit = true;
- };
- };
+ systemd.services.ModemManager.aliases = [ "dbus-org.freedesktop.ModemManager1.service" ];
systemd.services.NetworkManager-dispatcher = {
wantedBy = [ "network.target" ];
@@ -489,22 +453,29 @@ in {
# useful binaries for user-specified hooks
path = [ pkgs.iproute pkgs.utillinux pkgs.coreutils ];
+ aliases = [ "dbus-org.freedesktop.nm-dispatcher.service" ];
};
- # Turn off NixOS' network management
- networking = {
- useDHCP = false;
- # use mkDefault to trigger the assertion about the conflict above
- wireless.enable = mkDefault false;
- };
+ # Turn off NixOS' network management when networking is managed entirely by NetworkManager
+ networking = mkMerge [
+ (mkIf (!delegateWireless) {
+ useDHCP = false;
+ })
- security.polkit.extraConfig = polkitConf;
+ (mkIf cfg.enableStrongSwan {
+ networkmanager.packages = [ pkgs.networkmanager_strongswan ];
+ })
+
+ (mkIf enableIwd {
+ wireless.iwd.enable = true;
+ })
+ ];
- networking.networkmanager.packages =
- mkIf cfg.enableStrongSwan [ pkgs.networkmanager_strongswan ];
+ security.polkit.extraConfig = polkitConf;
- services.dbus.packages =
- optional cfg.enableStrongSwan pkgs.strongswanNM ++ cfg.packages;
+ services.dbus.packages = cfg.packages
+ ++ optional cfg.enableStrongSwan pkgs.strongswanNM
+ ++ optional (cfg.dns == "dnsmasq") pkgs.dnsmasq;
services.udev.packages = cfg.packages;
};
diff --git a/nixos/modules/services/networking/nghttpx/default.nix b/nixos/modules/services/networking/nghttpx/default.nix
index d6e1906e388164ddd3ef852ec2806854298916e3..881a2670f5db0c382651ea4c66e3000464d2f15f 100644
--- a/nixos/modules/services/networking/nghttpx/default.nix
+++ b/nixos/modules/services/networking/nghttpx/default.nix
@@ -96,6 +96,7 @@ in
users.groups.nghttpx = { };
users.users.nghttpx = {
group = config.users.groups.nghttpx.name;
+ isSystemUser = true;
};
diff --git a/nixos/modules/services/networking/chrony.nix b/nixos/modules/services/networking/ntp/chrony.nix
similarity index 91%
rename from nixos/modules/services/networking/chrony.nix
rename to nixos/modules/services/networking/ntp/chrony.nix
index 77f7025770005342061b6681ce4d8cc0ea971524..c74476c7a155837deebf5ceaf2de40373b598a47 100644
--- a/nixos/modules/services/networking/chrony.nix
+++ b/nixos/modules/services/networking/ntp/chrony.nix
@@ -9,11 +9,11 @@ let
keyFile = "${stateDir}/chrony.keys";
configFile = pkgs.writeText "chrony.conf" ''
- ${concatMapStringsSep "\n" (server: "server " + server) cfg.servers}
+ ${concatMapStringsSep "\n" (server: "server " + server + " iburst") cfg.servers}
${optionalString
(cfg.initstepslew.enabled && (cfg.servers != []))
- "initstepslew ${toString cfg.initstepslew.threshold} ${concatStringsSep " " cfg.initstepslew.servers}"
+ "initstepslew ${toString cfg.initstepslew.threshold} ${concatStringsSep " " cfg.servers}"
}
driftfile ${stateDir}/chrony.drift
@@ -24,7 +24,7 @@ let
${cfg.extraConfig}
'';
- chronyFlags = "-m -u chrony -f ${configFile} ${toString cfg.extraFlags}";
+ chronyFlags = "-n -m -u chrony -f ${configFile} ${toString cfg.extraFlags}";
in
{
options = {
@@ -48,7 +48,6 @@ in
default = {
enabled = true;
threshold = 1000; # by default, same threshold as 'ntpd -g' (1000s)
- servers = cfg.servers;
};
description = ''
Allow chronyd to make a rapid measurement of the system clock error at
@@ -76,6 +75,8 @@ in
};
config = mkIf cfg.enable {
+ meta.maintainers = with lib.maintainers; [ thoughtpolice ];
+
environment.systemPackages = [ pkgs.chrony ];
users.groups = singleton
@@ -115,7 +116,7 @@ in
unitConfig.ConditionCapability = "CAP_SYS_TIME";
serviceConfig =
- { Type = "forking";
+ { Type = "simple";
ExecStart = "${pkgs.chrony}/bin/chronyd ${chronyFlags}";
ProtectHome = "yes";
diff --git a/nixos/modules/services/networking/ntpd.nix b/nixos/modules/services/networking/ntp/ntpd.nix
similarity index 98%
rename from nixos/modules/services/networking/ntpd.nix
rename to nixos/modules/services/networking/ntp/ntpd.nix
index 588d1c6edb0732979d2a9ce3cf5699121e39035e..1197c84f0459f3106a9e173acbfaeb6c64091f6d 100644
--- a/nixos/modules/services/networking/ntpd.nix
+++ b/nixos/modules/services/networking/ntp/ntpd.nix
@@ -96,6 +96,7 @@ in
###### implementation
config = mkIf config.services.ntp.enable {
+ meta.maintainers = with lib.maintainers; [ thoughtpolice ];
# Make tools such as ntpq available in the system path.
environment.systemPackages = [ pkgs.ntp ];
diff --git a/nixos/modules/services/networking/openntpd.nix b/nixos/modules/services/networking/ntp/openntpd.nix
similarity index 96%
rename from nixos/modules/services/networking/openntpd.nix
rename to nixos/modules/services/networking/ntp/openntpd.nix
index f3920aa8064603eb2eb0235ecbb3acbbb5f586aa..471d15b1687bd856fed18b398b951b93d6a91a85 100644
--- a/nixos/modules/services/networking/openntpd.nix
+++ b/nixos/modules/services/networking/ntp/openntpd.nix
@@ -52,6 +52,7 @@ in
###### implementation
config = mkIf cfg.enable {
+ meta.maintainers = with lib.maintainers; [ thoughtpolice ];
services.timesyncd.enable = mkForce false;
# Add ntpctl to the environment for status checking
diff --git a/nixos/modules/services/networking/openvpn.nix b/nixos/modules/services/networking/openvpn.nix
index 05be97e66a3d4d2107b402a6df6a33b6dce86994..dcd7e9e5fa4cd6773166769811d5d076a81449b0 100644
--- a/nixos/modules/services/networking/openvpn.nix
+++ b/nixos/modules/services/networking/openvpn.nix
@@ -73,6 +73,9 @@ let
in
{
+ imports = [
+ (mkRemovedOptionModule [ "services" "openvpn" "enable" ] "")
+ ];
###### interface
diff --git a/nixos/modules/services/networking/owamp.nix b/nixos/modules/services/networking/owamp.nix
index 821a0258f4bece79ca3adf769c7bade2f201045b..dbb2e3b4c40923fe936e2a15a5157a17ba3a90c7 100644
--- a/nixos/modules/services/networking/owamp.nix
+++ b/nixos/modules/services/networking/owamp.nix
@@ -21,6 +21,7 @@ in
name = "owamp";
group = "owamp";
description = "Owamp daemon";
+ isSystemUser = true;
};
users.groups = singleton {
diff --git a/nixos/modules/services/networking/pdns-recursor.nix b/nixos/modules/services/networking/pdns-recursor.nix
index ebfdd9f35b72bacc9131a6be0a33aa3d54fbf046..6ff181377fccd57c830131f003612e1c0260eaee 100644
--- a/nixos/modules/services/networking/pdns-recursor.nix
+++ b/nixos/modules/services/networking/pdns-recursor.nix
@@ -90,11 +90,19 @@ in {
};
forwardZones = mkOption {
+ type = types.attrs;
+ default = {};
+ description = ''
+ DNS zones to be forwarded to other authoritative servers.
+ '';
+ };
+
+ forwardZonesRecurse = mkOption {
type = types.attrs;
example = { eth = "127.0.0.1:5353"; };
default = {};
description = ''
- DNS zones to be forwarded to other servers.
+ DNS zones to be forwarded to other recursive servers.
'';
};
@@ -158,7 +166,8 @@ in {
webserver-port = cfg.api.port;
webserver-allow-from = cfg.api.allowFrom;
- forward-zones = mapAttrsToList (zone: uri: "${zone}.=${uri}") cfg.forwardZones;
+ forward-zones = mapAttrsToList (zone: uri: "${zone}.=${uri}") cfg.forwardZones;
+ forward-zones-recurse = mapAttrsToList (zone: uri: "${zone}.=${uri}") cfg.forwardZonesRecurse;
export-etc-hosts = cfg.exportHosts;
dnssec = cfg.dnssecValidation;
serve-rfc1918 = cfg.serveRFC1918;
@@ -210,4 +219,6 @@ in {
"To change extra Recursor settings use services.pdns-recursor.settings instead.")
];
+ meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
}
diff --git a/nixos/modules/services/networking/pppd.nix b/nixos/modules/services/networking/pppd.nix
new file mode 100644
index 0000000000000000000000000000000000000000..e96c27bd84b4a3fc45b1382c13839fdb959a4cc3
--- /dev/null
+++ b/nixos/modules/services/networking/pppd.nix
@@ -0,0 +1,134 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.pppd;
+in
+{
+ meta = {
+ maintainers = with maintainers; [ danderson ];
+ };
+
+ options = {
+ services.pppd = {
+ enable = mkEnableOption "pppd";
+
+ package = mkOption {
+ default = pkgs.ppp;
+ defaultText = "pkgs.ppp";
+ type = types.package;
+ description = "pppd package to use.";
+ };
+
+ peers = mkOption {
+ default = {};
+ description = "pppd peers.";
+ type = types.attrsOf (types.submodule (
+ { name, ... }:
+ {
+ options = {
+ name = mkOption {
+ type = types.str;
+ default = name;
+ example = "dialup";
+ description = "Name of the PPP peer.";
+ };
+
+ enable = mkOption {
+ type = types.bool;
+ default = true;
+ example = false;
+ description = "Whether to enable this PPP peer.";
+ };
+
+ autostart = mkOption {
+ type = types.bool;
+ default = true;
+ example = false;
+ description = "Whether the PPP session is automatically started at boot time.";
+ };
+
+ config = mkOption {
+ type = types.lines;
+ default = "";
+ description = "pppd configuration for this peer, see the pppd(8) man page.";
+ };
+ };
+ }));
+ };
+ };
+ };
+
+ config = let
+ enabledConfigs = filter (f: f.enable) (attrValues cfg.peers);
+
+ mkEtc = peerCfg: {
+ "ppp/peers/${peerCfg.name}".text = peerCfg.config;
+ };
+
+ mkSystemd = peerCfg: {
+ "pppd-${peerCfg.name}" = {
+ restartTriggers = [ config.environment.etc."ppp/peers/${peerCfg.name}".source ];
+ before = [ "network.target" ];
+ wants = [ "network.target" ];
+ after = [ "network-pre.target" ];
+ environment = {
+ # pppd likes to write directly into /var/run. This is rude
+ # on a modern system, so we use libredirect to transparently
+ # move those files into /run/pppd.
+ LD_PRELOAD = "${pkgs.libredirect}/lib/libredirect.so";
+ NIX_REDIRECTS = "/var/run=/run/pppd";
+ };
+ serviceConfig = {
+ ExecStart = "${getBin cfg.package}/sbin/pppd call ${peerCfg.name} nodetach nolog";
+ Restart = "always";
+ RestartSec = 5;
+
+ AmbientCapabilities = "CAP_SYS_TTY_CONFIG CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_ADMIN";
+ CapabilityBoundingSet = "CAP_SYS_TTY_CONFIG CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_ADMIN";
+ KeyringMode = "private";
+ LockPersonality = true;
+ MemoryDenyWriteExecute = true;
+ NoNewPrivileges = true;
+ PrivateMounts = true;
+ PrivateTmp = true;
+ ProtectControlGroups = true;
+ ProtectHome = true;
+ ProtectHostname = true;
+ ProtectKernelModules = true;
+ # pppd can be configured to tweak kernel settings.
+ ProtectKernelTunables = false;
+ ProtectSystem = "strict";
+ RemoveIPC = true;
+ RestrictAddressFamilies = "AF_PACKET AF_UNIX AF_PPPOX AF_ATMPVC AF_ATMSVC AF_INET AF_INET6 AF_IPX";
+ RestrictNamespaces = true;
+ RestrictRealtime = true;
+ RestrictSUIDSGID = true;
+ SecureBits = "no-setuid-fixup-locked noroot-locked";
+ SystemCallFilter = "@system-service";
+ SystemCallArchitectures = "native";
+
+ # All pppd instances on a system must share a runtime
+ # directory in order for PPP multilink to work correctly. So
+ # we give all instances the same /run/pppd directory to store
+ # things in.
+ #
+ # For the same reason, we can't set PrivateUsers=true, because
+ # all instances need to run as the same user to access the
+ # multilink database.
+ RuntimeDirectory = "pppd";
+ RuntimeDirectoryPreserve = true;
+ };
+ wantedBy = mkIf peerCfg.autostart [ "multi-user.target" ];
+ };
+ };
+
+ etcFiles = map mkEtc enabledConfigs;
+ systemdConfigs = map mkSystemd enabledConfigs;
+
+ in mkIf cfg.enable {
+ environment.etc = mkMerge etcFiles;
+ systemd.services = mkMerge systemdConfigs;
+ };
+}
diff --git a/nixos/modules/services/networking/privoxy.nix b/nixos/modules/services/networking/privoxy.nix
index 49ca839a2c3783a50b6094e8c875faa5964c54a9..1f41c720adf58255e8dbd2da1f50ab938d7e93b2 100644
--- a/nixos/modules/services/networking/privoxy.nix
+++ b/nixos/modules/services/networking/privoxy.nix
@@ -109,4 +109,6 @@ in
};
+ meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
}
diff --git a/nixos/modules/services/networking/prosody.nix b/nixos/modules/services/networking/prosody.nix
index 1ae063aa6bb52d3b11e48ee73b8a295eaa5e23fa..7a503e7116658d16a326c8cdf819984148507a4f 100644
--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@@ -465,7 +465,7 @@ in
modules_enabled = {
- ${ lib.concatStringsSep "\n\ \ " (lib.mapAttrsToList
+ ${ lib.concatStringsSep "\n " (lib.mapAttrsToList
(name: val: optionalString val "${toLua name};")
cfg.modules) }
${ lib.concatStringsSep "\n" (map (x: "${toLua x};") cfg.package.communityModules)}
diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix
index 9412d0ef8a62e37a58f2e2ac1fb85e508ac2b323..60fb3d5d6d4438ca90c91d85927c9c16a9f99f6c 100644
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@@ -75,4 +75,6 @@ in
};
+ meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
}
diff --git a/nixos/modules/services/networking/shorewall.nix b/nixos/modules/services/networking/shorewall.nix
new file mode 100644
index 0000000000000000000000000000000000000000..0f94d414fcf748faa4845e5e27e817a4b21787e5
--- /dev/null
+++ b/nixos/modules/services/networking/shorewall.nix
@@ -0,0 +1,75 @@
+{ config, lib, pkgs, ... }:
+let
+ types = lib.types;
+ cfg = config.services.shorewall;
+in {
+ options = {
+ services.shorewall = {
+ enable = lib.mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Whether to enable Shorewall IPv4 Firewall.
+
+
+ Enabling this service WILL disable the existing NixOS
+ firewall! Default firewall rules provided by packages are not
+ considered at the moment.
+
+
+ '';
+ };
+ package = lib.mkOption {
+ type = types.package;
+ default = pkgs.shorewall;
+ defaultText = "pkgs.shorewall";
+ description = "The shorewall package to use.";
+ };
+ configs = lib.mkOption {
+ type = types.attrsOf types.str;
+ default = {};
+ description = ''
+ This option defines the Shorewall configs.
+ The attribute name defines the name of the config,
+ and the attribute value defines the content of the config.
+ '';
+ apply = lib.mapAttrs (name: text: pkgs.writeText "${name}" text);
+ };
+ };
+ };
+
+ config = lib.mkIf cfg.enable {
+ systemd.services.firewall.enable = false;
+ systemd.services.shorewall = {
+ description = "Shorewall IPv4 Firewall";
+ after = [ "ipset.target" ];
+ before = [ "network-pre.target" ];
+ wants = [ "network-pre.target" ];
+ wantedBy = [ "multi-user.target" ];
+ reloadIfChanged = true;
+ restartTriggers = lib.attrValues cfg.configs;
+ serviceConfig = {
+ Type = "oneshot";
+ RemainAfterExit = "yes";
+ ExecStart = "${cfg.package}/bin/shorewall start";
+ ExecReload = "${cfg.package}/bin/shorewall reload";
+ ExecStop = "${cfg.package}/bin/shorewall stop";
+ };
+ preStart = ''
+ install -D -d -m 750 /var/lib/shorewall
+ install -D -d -m 755 /var/lock/subsys
+ touch /var/log/shorewall.log
+ chown 750 /var/log/shorewall.log
+ '';
+ };
+ environment = {
+ etc = lib.mapAttrsToList
+ (name: file:
+ { source = file;
+ target = "shorewall/${name}";
+ })
+ cfg.configs;
+ systemPackages = [ cfg.package ];
+ };
+ };
+}
diff --git a/nixos/modules/services/networking/shorewall6.nix b/nixos/modules/services/networking/shorewall6.nix
new file mode 100644
index 0000000000000000000000000000000000000000..9c22a037c0b43816844908dd70f0ca84d96fc6e9
--- /dev/null
+++ b/nixos/modules/services/networking/shorewall6.nix
@@ -0,0 +1,75 @@
+{ config, lib, pkgs, ... }:
+let
+ types = lib.types;
+ cfg = config.services.shorewall6;
+in {
+ options = {
+ services.shorewall6 = {
+ enable = lib.mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Whether to enable Shorewall IPv6 Firewall.
+
+
+ Enabling this service WILL disable the existing NixOS
+ firewall! Default firewall rules provided by packages are not
+ considered at the moment.
+
+
+ '';
+ };
+ package = lib.mkOption {
+ type = types.package;
+ default = pkgs.shorewall;
+ defaultText = "pkgs.shorewall";
+ description = "The shorewall package to use.";
+ };
+ configs = lib.mkOption {
+ type = types.attrsOf types.str;
+ default = {};
+ description = ''
+ This option defines the Shorewall configs.
+ The attribute name defines the name of the config,
+ and the attribute value defines the content of the config.
+ '';
+ apply = lib.mapAttrs (name: text: pkgs.writeText "${name}" text);
+ };
+ };
+ };
+
+ config = lib.mkIf cfg.enable {
+ systemd.services.firewall.enable = false;
+ systemd.services.shorewall6 = {
+ description = "Shorewall IPv6 Firewall";
+ after = [ "ipset.target" ];
+ before = [ "network-pre.target" ];
+ wants = [ "network-pre.target" ];
+ wantedBy = [ "multi-user.target" ];
+ reloadIfChanged = true;
+ restartTriggers = lib.attrValues cfg.configs;
+ serviceConfig = {
+ Type = "oneshot";
+ RemainAfterExit = "yes";
+ ExecStart = "${cfg.package}/bin/shorewall6 start";
+ ExecReload = "${cfg.package}/bin/shorewall6 reload";
+ ExecStop = "${cfg.package}/bin/shorewall6 stop";
+ };
+ preStart = ''
+ install -D -d -m 750 /var/lib/shorewall6
+ install -D -d -m 755 /var/lock/subsys
+ touch /var/log/shorewall6.log
+ chown 750 /var/log/shorewall6.log
+ '';
+ };
+ environment = {
+ etc = lib.mapAttrsToList
+ (name: file:
+ { source = file;
+ target = "shorewall6/${name}";
+ })
+ cfg.configs;
+ systemPackages = [ cfg.package ];
+ };
+ };
+}
diff --git a/nixos/modules/services/networking/smokeping.nix b/nixos/modules/services/networking/smokeping.nix
index d4d0594a9cdd3e1bed4c15eb751b5cbfe21f7418..b48b0b3a9d6bb71930f50c437476c2b875bc5408 100644
--- a/nixos/modules/services/networking/smokeping.nix
+++ b/nixos/modules/services/networking/smokeping.nix
@@ -299,7 +299,8 @@ in
mkdir -m 0755 -p ${smokepingHome}/cache ${smokepingHome}/data
rm -f ${smokepingHome}/cropper
ln -s ${cfg.package}/htdocs/cropper ${smokepingHome}/cropper
- cp ${cgiHome} ${smokepingHome}/smokeping.fcgi
+ rm -f ${smokepingHome}/smokeping.fcgi
+ ln -s ${cgiHome} ${smokepingHome}/smokeping.fcgi
${cfg.package}/bin/smokeping --check --config=${configPath}
${cfg.package}/bin/smokeping --static --config=${configPath}
'';
@@ -314,5 +315,7 @@ in
serviceConfig.Restart = "always";
};
};
+
+ meta.maintainers = with lib.maintainers; [ erictapen ];
}
diff --git a/nixos/modules/services/networking/spacecookie.nix b/nixos/modules/services/networking/spacecookie.nix
new file mode 100644
index 0000000000000000000000000000000000000000..c4d06df6ad4abc70f82e0e0a90fc5b3801c1bbc1
--- /dev/null
+++ b/nixos/modules/services/networking/spacecookie.nix
@@ -0,0 +1,83 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.spacecookie;
+ configFile = pkgs.writeText "spacecookie.json" (lib.generators.toJSON {} {
+ inherit (cfg) hostname port root;
+ });
+in {
+
+ options = {
+
+ services.spacecookie = {
+
+ enable = mkEnableOption "spacecookie";
+
+ hostname = mkOption {
+ type = types.str;
+ default = "localhost";
+ description = "The hostname the service is reachable via. Clients will use this hostname for further requests after loading the initial gopher menu.";
+ };
+
+ port = mkOption {
+ type = types.port;
+ default = 70;
+ description = "Port the gopher service should be exposed on.";
+ };
+
+ root = mkOption {
+ type = types.path;
+ default = "/srv/gopher";
+ description = "The root directory spacecookie serves via gopher.";
+ };
+ };
+ };
+
+ config = mkIf cfg.enable {
+
+ systemd.sockets.spacecookie = {
+ description = "Socket for the Spacecookie Gopher Server";
+ wantedBy = [ "sockets.target" ];
+ listenStreams = [ "[::]:${toString cfg.port}" ];
+ socketConfig = {
+ BindIPv6Only = "both";
+ };
+ };
+
+ systemd.services.spacecookie = {
+ description = "Spacecookie Gopher Server";
+ wantedBy = [ "multi-user.target" ];
+ requires = [ "spacecookie.socket" ];
+
+ serviceConfig = {
+ Type = "notify";
+ ExecStart = "${pkgs.haskellPackages.spacecookie}/bin/spacecookie ${configFile}";
+ FileDescriptorStoreMax = 1;
+
+ DynamicUser = true;
+
+ ProtectSystem = "strict";
+ ProtectHome = true;
+ PrivateTmp = true;
+ PrivateDevices = true;
+ PrivateMounts = true;
+ PrivateUsers = true;
+
+ ProtectKernelTunables = true;
+ ProtectKernelModules = true;
+ ProtectControlGroups = true;
+
+ CapabilityBoundingSet = "";
+ NoNewPrivileges = true;
+ LockPersonality = true;
+ RestrictRealtime = true;
+
+ # AF_UNIX for communication with systemd
+ # AF_INET replaced by BindIPv6Only=both
+ RestrictAddressFamilies = "AF_UNIX AF_INET6";
+ };
+ };
+ };
+}
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index 91fc7d72bc6d2c644c6a277f8a194c6951bdc4bb..b0e2e303cbc027b3d46fc8ae33363393ab37e1c9 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -74,6 +74,10 @@ let
in
{
+ imports = [
+ (mkAliasOptionModule [ "services" "sshd" "enable" ] [ "services" "openssh" "enable" ])
+ (mkAliasOptionModule [ "services" "openssh" "knownHosts" ] [ "programs" "ssh" "knownHosts" ])
+ ];
###### interface
diff --git a/nixos/modules/services/networking/stunnel.nix b/nixos/modules/services/networking/stunnel.nix
index cbc899f2b4d7354472dd6f042cc0740ec4920f02..ab51bba2f6acf7245a19a9ff65e948a45c03aa20 100644
--- a/nixos/modules/services/networking/stunnel.nix
+++ b/nixos/modules/services/networking/stunnel.nix
@@ -57,7 +57,13 @@ let
};
CAPath = mkOption {
- type = types.path;
+ type = types.nullOr types.path;
+ default = null;
+ description = "Path to a directory containing certificates to validate against.";
+ };
+
+ CAFile = mkOption {
+ type = types.nullOr types.path;
default = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
description = "Path to a file containing certificates to validate against.";
};
@@ -196,6 +202,7 @@ in
verifyChain = ${yesNo v.verifyChain}
verifyPeer = ${yesNo v.verifyPeer}
${optionalString (v.CAPath != null) "CApath = ${v.CAPath}"}
+ ${optionalString (v.CAFile != null) "CAFile = ${v.CAFile}"}
${optionalString (v.verifyHostname != null) "checkHost = ${v.verifyHostname}"}
OCSPaia = yes
@@ -216,6 +223,12 @@ in
};
};
+ meta.maintainers = with maintainers; [
+ # Server side
+ lschuermann
+ # Client side
+ das_j
+ ];
};
}
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 165fd5970cf88a048dd78121ad4dd4237ad624fa..b3f2af5b179416a39104808ac87812c192b56a34 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -18,6 +18,7 @@ let
fsWatcherEnabled = folder.watch;
fsWatcherDelayS = folder.watchDelay;
ignorePerms = folder.ignorePerms;
+ versioning = folder.versioning;
}) (filterAttrs (
_: folder:
folder.enable
@@ -220,6 +221,69 @@ in {
'';
};
+ versioning = mkOption {
+ default = null;
+ description = ''
+ How to keep changed/deleted files with syncthing.
+ There are 4 different types of versioning with different parameters.
+ See https://docs.syncthing.net/users/versioning.html
+ '';
+ example = [
+ {
+ versioning = {
+ type = "simple";
+ params.keep = "10";
+ };
+ }
+ {
+ versioning = {
+ type = "trashcan";
+ params.cleanoutDays = "1000";
+ };
+ }
+ {
+ versioning = {
+ type = "staggered";
+ params = {
+ cleanInterval = "3600";
+ maxAge = "31536000";
+ versionsPath = "/syncthing/backup";
+ };
+ };
+ }
+ {
+ versioning = {
+ type = "external";
+ params.versionsPath = pkgs.writers.writeBash "backup" ''
+ folderpath="$1"
+ filepath="$2"
+ rm -rf "$folderpath/$filepath"
+ '';
+ };
+ }
+ ];
+ type = with types; nullOr (submodule {
+ options = {
+ type = mkOption {
+ type = enum [ "external" "simple" "staggered" "trashcan" ];
+ description = ''
+ Type of versioning.
+ See https://docs.syncthing.net/users/versioning.html
+ '';
+ };
+ params = mkOption {
+ type = attrsOf (either str path);
+ description = ''
+ Parameters for versioning. Structure depends on versioning.type.
+ See https://docs.syncthing.net/users/versioning.html
+ '';
+ };
+ };
+ });
+ };
+
+
+
rescanInterval = mkOption {
type = types.int;
default = 3600;
diff --git a/nixos/modules/services/networking/thelounge.nix b/nixos/modules/services/networking/thelounge.nix
index b1d23372955ed9d1dcfff2e505f1e71421b99988..875d8f6616978c1eb603feeba3064e29b7cdb895 100644
--- a/nixos/modules/services/networking/thelounge.nix
+++ b/nixos/modules/services/networking/thelounge.nix
@@ -56,6 +56,7 @@ in {
users.users.thelounge = {
description = "thelounge service user";
group = "thelounge";
+ isSystemUser = true;
};
users.groups.thelounge = {};
systemd.services.thelounge = {
diff --git a/nixos/modules/services/networking/tinydns.nix b/nixos/modules/services/networking/tinydns.nix
index 7d5db71601ef572675c4301c60a594adba7de6b7..79507b2ebcddbc87d3d3c8f97c27b99c2ee1f2d9 100644
--- a/nixos/modules/services/networking/tinydns.nix
+++ b/nixos/modules/services/networking/tinydns.nix
@@ -32,11 +32,12 @@ with lib;
config = mkIf config.services.tinydns.enable {
environment.systemPackages = [ pkgs.djbdns ];
- users.users.tinydns = {};
+ users.users.tinydns.isSystemUser = true;
systemd.services.tinydns = {
description = "djbdns tinydns server";
wantedBy = [ "multi-user.target" ];
+ after = [ "network.target" ];
path = with pkgs; [ daemontools djbdns ];
preStart = ''
rm -rf /var/lib/tinydns
diff --git a/nixos/modules/services/networking/toxvpn.nix b/nixos/modules/services/networking/toxvpn.nix
index 7daacba185fe738d5131c59cf30a81562975f63f..9e97faeebc1e8728fa6acf12848c0d426c09778d 100644
--- a/nixos/modules/services/networking/toxvpn.nix
+++ b/nixos/modules/services/networking/toxvpn.nix
@@ -23,7 +23,7 @@ with lib;
type = types.listOf types.str;
default = [];
example = ''[ "toxid1" "toxid2" ]'';
- description = "peers to automacally connect to on startup";
+ description = "peers to automatically connect to on startup";
};
};
};
diff --git a/nixos/modules/services/networking/trickster.nix b/nixos/modules/services/networking/trickster.nix
new file mode 100644
index 0000000000000000000000000000000000000000..8760dd5a93827d8578b1d18a315bfba4d61abe78
--- /dev/null
+++ b/nixos/modules/services/networking/trickster.nix
@@ -0,0 +1,112 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.trickster;
+in
+{
+
+ options = {
+ services.trickster = {
+ enable = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Enable Trickster.
+ '';
+ };
+
+ package = mkOption {
+ type = types.package;
+ default = pkgs.trickster;
+ defaultText = "pkgs.trickster";
+ description = ''
+ Package that should be used for trickster.
+ '';
+ };
+
+ configFile = mkOption {
+ type = types.nullOr types.path;
+ default = null;
+ description = ''
+ Path to configuration file.
+ '';
+ };
+
+ instance-id = mkOption {
+ type = types.nullOr types.int;
+ default = null;
+ description = ''
+ Instance ID for when running multiple processes (default null).
+ '';
+ };
+
+ log-level = mkOption {
+ type = types.str;
+ default = "info";
+ description = ''
+ Level of Logging to use (debug, info, warn, error) (default "info").
+ '';
+ };
+
+ metrics-port = mkOption {
+ type = types.port;
+ default = 8082;
+ description = ''
+ Port that the /metrics endpoint will listen on.
+ '';
+ };
+
+ origin = mkOption {
+ type = types.str;
+ default = "http://prometheus:9090";
+ description = ''
+ URL to the Prometheus Origin. Enter it like you would in grafana, e.g., http://prometheus:9090 (default http://prometheus:9090).
+ '';
+ };
+
+ profiler-port = mkOption {
+ type = types.nullOr types.port;
+ default = null;
+ description = ''
+ Port that the /debug/pprof endpoint will listen on.
+ '';
+ };
+
+ proxy-port = mkOption {
+ type = types.port;
+ default = 9090;
+ description = ''
+ Port that the Proxy server will listen on.
+ '';
+ };
+
+ };
+ };
+
+ config = mkIf cfg.enable {
+ systemd.services.trickster = {
+ description = "Dashboard Accelerator for Prometheus";
+ after = [ "network.target" ];
+ wantedBy = [ "multi-user.target" ];
+ serviceConfig = {
+ DynamicUser = true;
+ ExecStart = ''
+ ${cfg.package}/bin/trickster \
+ -log-level ${cfg.log-level} \
+ -metrics-port ${toString cfg.metrics-port} \
+ -origin ${cfg.origin} \
+ -proxy-port ${toString cfg.proxy-port} \
+ ${optionalString (cfg.configFile != null) "-config ${cfg.configFile}"} \
+ ${optionalString (cfg.profiler-port != null) "-profiler-port ${cfg.profiler-port}"} \
+ ${optionalString (cfg.instance-id != null) "-instance-id ${cfg.instance-id}"}
+ '';
+ ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+ Restart = "always";
+ };
+ };
+
+ };
+}
+
diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix
index 3cf82e8839bb1a6c0561d0656856453c10488d1b..baed83591e1ed675ae6726a6a41f85be77496f2b 100644
--- a/nixos/modules/services/networking/unbound.nix
+++ b/nixos/modules/services/networking/unbound.nix
@@ -53,6 +53,13 @@ in
enable = mkEnableOption "Unbound domain name server";
+ package = mkOption {
+ type = types.package;
+ default = pkgs.unbound;
+ defaultText = "pkgs.unbound";
+ description = "The unbound package to use";
+ };
+
allowedAccess = mkOption {
default = [ "127.0.0.0/24" ];
type = types.listOf types.str;
@@ -94,7 +101,7 @@ in
config = mkIf cfg.enable {
- environment.systemPackages = [ pkgs.unbound ];
+ environment.systemPackages = [ cfg.package ];
users.users.unbound = {
description = "unbound daemon user";
@@ -114,7 +121,7 @@ in
mkdir -m 0755 -p ${stateDir}/dev/
cp ${confFile} ${stateDir}/unbound.conf
${optionalString cfg.enableRootTrustAnchor ''
- ${pkgs.unbound}/bin/unbound-anchor -a ${rootTrustAnchorFile} || echo "Root anchor updated!"
+ ${cfg.package}/bin/unbound-anchor -a ${rootTrustAnchorFile} || echo "Root anchor updated!"
chown unbound ${stateDir} ${rootTrustAnchorFile}
''}
touch ${stateDir}/dev/random
@@ -122,7 +129,7 @@ in
'';
serviceConfig = {
- ExecStart = "${pkgs.unbound}/bin/unbound -d -c ${stateDir}/unbound.conf";
+ ExecStart = "${cfg.package}/bin/unbound -d -c ${stateDir}/unbound.conf";
ExecStopPost="${pkgs.utillinux}/bin/umount ${stateDir}/dev/random";
ProtectSystem = true;
diff --git a/nixos/modules/services/networking/v2ray.nix b/nixos/modules/services/networking/v2ray.nix
new file mode 100644
index 0000000000000000000000000000000000000000..a1774cdffbb9c527335561fd1b6325a3b45ed866
--- /dev/null
+++ b/nixos/modules/services/networking/v2ray.nix
@@ -0,0 +1,81 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+ options = {
+
+ services.v2ray = {
+ enable = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Whether to run v2ray server.
+
+ Either configFile or config must be specified.
+ '';
+ };
+
+ configFile = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = "/etc/v2ray/config.json";
+ description = ''
+ The absolute path to the configuration file.
+
+ Either configFile or config must be specified.
+
+ See .
+ '';
+ };
+
+ config = mkOption {
+ type = types.nullOr (types.attrsOf types.unspecified);
+ default = null;
+ example = {
+ inbounds = [{
+ port = 1080;
+ listen = "127.0.0.1";
+ protocol = "http";
+ }];
+ outbounds = [{
+ protocol = "freedom";
+ }];
+ };
+ description = ''
+ The configuration object.
+
+ Either `configFile` or `config` must be specified.
+
+ See .
+ '';
+ };
+ };
+
+ };
+
+ config = let
+ cfg = config.services.v2ray;
+ configFile = if cfg.configFile != null
+ then cfg.configFile
+ else (pkgs.writeText "v2ray.json" (builtins.toJSON cfg.config));
+
+ in mkIf cfg.enable {
+ assertions = [
+ {
+ assertion = (cfg.configFile == null) != (cfg.config == null);
+ message = "Either but not both `configFile` and `config` should be specified for v2ray.";
+ }
+ ];
+
+ systemd.services.v2ray = {
+ description = "v2ray Daemon";
+ after = [ "network.target" ];
+ wantedBy = [ "multi-user.target" ];
+ path = [ pkgs.v2ray ];
+ script = ''
+ exec v2ray -config ${configFile}
+ '';
+ };
+ };
+}
diff --git a/nixos/modules/services/networking/vsftpd.nix b/nixos/modules/services/networking/vsftpd.nix
index 67be60da567398f75251408a84ba95b3b1b92cad..90093d9a78d9e0ac8bf4400391e3b16e99b4e4c2 100644
--- a/nixos/modules/services/networking/vsftpd.nix
+++ b/nixos/modules/services/networking/vsftpd.nix
@@ -34,6 +34,15 @@ let
};
optionDescription = [
+ (yesNoOption "allowWriteableChroot" "allow_writeable_chroot" false ''
+ Allow the use of writeable root inside chroot().
+ '')
+ (yesNoOption "virtualUseLocalPrivs" "virtual_use_local_privs" false ''
+ If enabled, virtual users will use the same privileges as local
+ users. By default, virtual users will use the same privileges as
+ anonymous users, which tends to be more restrictive (especially
+ in terms of write access).
+ '')
(yesNoOption "anonymousUser" "anonymous_enable" false ''
Whether to enable the anonymous FTP user.
'')
@@ -76,9 +85,21 @@ let
outgoing data connections can only connect to the client. Only enable if you
know what you are doing!
'')
- (yesNoOption "ssl_tlsv1" "ssl_tlsv1" true '' '')
- (yesNoOption "ssl_sslv2" "ssl_sslv2" false '' '')
- (yesNoOption "ssl_sslv3" "ssl_sslv3" false '' '')
+ (yesNoOption "ssl_tlsv1" "ssl_tlsv1" true ''
+ Only applies if is activated. If
+ enabled, this option will permit TLS v1 protocol connections.
+ TLS v1 connections are preferred.
+ '')
+ (yesNoOption "ssl_sslv2" "ssl_sslv2" false ''
+ Only applies if is activated. If
+ enabled, this option will permit SSL v2 protocol connections.
+ TLS v1 connections are preferred.
+ '')
+ (yesNoOption "ssl_sslv3" "ssl_sslv3" false ''
+ Only applies if is activated. If
+ enabled, this option will permit SSL v3 protocol connections.
+ TLS v1 connections are preferred.
+ '')
];
configFile = pkgs.writeText "vsftpd.conf"
@@ -98,6 +119,9 @@ let
listen=YES
nopriv_user=vsftpd
secure_chroot_dir=/var/empty
+ ${optionalString (cfg.localRoot != null) ''
+ local_root=${cfg.localRoot}
+ ''}
syslog_enable=YES
${optionalString (pkgs.stdenv.hostPlatform.system == "x86_64-linux") ''
seccomp_sandbox=NO
@@ -106,6 +130,11 @@ let
${optionalString cfg.anonymousUser ''
anon_root=${cfg.anonymousUserHome}
''}
+ ${optionalString cfg.enableVirtualUsers ''
+ guest_enable=YES
+ guest_username=vsftpd
+ pam_service_name=vsftpd
+ ''}
${cfg.extraConfig}
'';
@@ -119,10 +148,7 @@ in
services.vsftpd = {
- enable = mkOption {
- default = false;
- description = "Whether to enable the vsftpd FTP server.";
- };
+ enable = mkEnableOption "vsftpd";
userlist = mkOption {
default = [];
@@ -143,6 +169,61 @@ in
'';
};
+ enableVirtualUsers = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Whether to enable the pam_userdb-based
+ virtual user system
+ '';
+ };
+
+ userDbPath = mkOption {
+ type = types.nullOr types.str;
+ example = "/etc/vsftpd/userDb";
+ default = null;
+ description = ''
+ Only applies if is true.
+ Path pointing to the pam_userdb user
+ database used by vsftpd to authenticate the virtual users.
+
+ This user list should be stored in the Berkeley DB database
+ format.
+
+ To generate a new user database, create a text file, add
+ your users using the following format:
+
+ user1
+ password1
+ user2
+ password2
+
+
+ You can then install pkgs.db to generate
+ the Berkeley DB using
+
+ db_load -T -t hash -f logins.txt userDb.db
+
+
+ Caution: pam_userdb will automatically
+ append a .db suffix to the filename you
+ provide though this option. This option shouldn't include
+ this filetype suffix.
+ '';
+ };
+
+ localRoot = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = "/var/www/$USER";
+ description = ''
+ This option represents a directory which vsftpd will try to
+ change into after a local (i.e. non- anonymous) login.
+
+ Failure is silently ignored.
+ '';
+ };
+
anonymousUserHome = mkOption {
type = types.path;
default = "/home/ftp/";
@@ -186,18 +267,25 @@ in
config = mkIf cfg.enable {
- assertions = singleton
+ assertions = [
{ assertion =
(cfg.forceLocalLoginsSSL -> cfg.rsaCertFile != null)
&& (cfg.forceLocalDataSSL -> cfg.rsaCertFile != null);
message = "vsftpd: If forceLocalLoginsSSL or forceLocalDataSSL is true then a rsaCertFile must be provided!";
- };
+ }
+ {
+ assertion = (cfg.enableVirtualUsers -> cfg.userDbPath != null)
+ && (cfg.enableVirtualUsers -> cfg.localUsers != null);
+ message = "vsftpd: If enableVirtualUsers is true, you need to setup both the userDbPath and localUsers options.";
+ }];
users.users =
[ { name = "vsftpd";
uid = config.ids.uids.vsftpd;
description = "VSFTPD user";
- home = "/homeless-shelter";
+ home = if cfg.localRoot != null
+ then cfg.localRoot # <= Necessary for virtual users.
+ else "/homeless-shelter";
}
] ++ optional cfg.anonymousUser
{ name = "ftp";
@@ -213,23 +301,24 @@ in
# = false and whitelist root
services.vsftpd.userlist = if cfg.userlistDeny then ["root"] else [];
- systemd.services.vsftpd =
- { description = "Vsftpd Server";
+ systemd = {
+ tmpfiles.rules = optional cfg.anonymousUser
+ #Type Path Mode User Gr Age Arg
+ "d '${builtins.toString cfg.anonymousUserHome}' 0555 'ftp' 'ftp' - -";
+ services.vsftpd = {
+ description = "Vsftpd Server";
wantedBy = [ "multi-user.target" ];
- preStart =
- optionalString cfg.anonymousUser
- ''
- mkdir -p -m 555 ${cfg.anonymousUserHome}
- chown -R ftp:ftp ${cfg.anonymousUserHome}
- '';
-
serviceConfig.ExecStart = "@${vsftpd}/sbin/vsftpd vsftpd ${configFile}";
serviceConfig.Restart = "always";
serviceConfig.Type = "forking";
};
+ };
+ security.pam.services.vsftpd.text = mkIf (cfg.enableVirtualUsers && cfg.userDbPath != null)''
+ auth required pam_userdb.so db=${cfg.userDbPath}
+ account required pam_userdb.so db=${cfg.userDbPath}
+ '';
};
-
}
diff --git a/nixos/modules/services/networking/wireguard.nix b/nixos/modules/services/networking/wireguard.nix
index 4176da2c8cb8fd8a8a21c25bfaa0e143cefedf03..980961225c9e0944064b5a0569446f117327bfe2 100644
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@@ -112,6 +112,32 @@ let
Determines whether to add allowed IPs as routes or not.
'';
};
+
+ socketNamespace = mkOption {
+ default = null;
+ type = with types; nullOr str;
+ example = "container";
+ description = ''The pre-existing network namespace in which the
+ WireGuard interface is created, and which retains the socket even if the
+ interface is moved via . When
+ null, the interface is created in the init namespace.
+ See documentation.
+ '';
+ };
+
+ interfaceNamespace = mkOption {
+ default = null;
+ type = with types; nullOr str;
+ example = "init";
+ description = ''The pre-existing network namespace the WireGuard
+ interface is moved to. The special value init means
+ the init namespace. When null, the interface is not
+ moved.
+ See documentation.
+ '';
+ };
};
};
@@ -239,6 +265,10 @@ let
if peer.presharedKey != null
then pkgs.writeText "wg-psk" peer.presharedKey
else peer.presharedKeyFile;
+ src = interfaceCfg.socketNamespace;
+ dst = interfaceCfg.interfaceNamespace;
+ ip = nsWrap "ip" src dst;
+ wg = nsWrap "wg" src dst;
in nameValuePair "wireguard-${interfaceName}-peer-${unitName}"
{
description = "WireGuard Peer - ${interfaceName} - ${peer.publicKey}";
@@ -255,16 +285,16 @@ let
};
script = let
- wg_setup = "wg set ${interfaceName} peer ${peer.publicKey}" +
+ wg_setup = "${wg} set ${interfaceName} peer ${peer.publicKey}" +
optionalString (psk != null) " preshared-key ${psk}" +
optionalString (peer.endpoint != null) " endpoint ${peer.endpoint}" +
optionalString (peer.persistentKeepalive != null) " persistent-keepalive ${toString peer.persistentKeepalive}" +
optionalString (peer.allowedIPs != []) " allowed-ips ${concatStringsSep "," peer.allowedIPs}";
route_setup =
- optionalString (interfaceCfg.allowedIPsAsRoutes != false)
+ optionalString interfaceCfg.allowedIPsAsRoutes
(concatMapStringsSep "\n"
(allowedIP:
- "ip route replace ${allowedIP} dev ${interfaceName} table ${interfaceCfg.table}"
+ "${ip} route replace ${allowedIP} dev ${interfaceName} table ${interfaceCfg.table}"
) peer.allowedIPs);
in ''
${wg_setup}
@@ -272,13 +302,13 @@ let
'';
postStop = let
- route_destroy = optionalString (interfaceCfg.allowedIPsAsRoutes != false)
+ route_destroy = optionalString interfaceCfg.allowedIPsAsRoutes
(concatMapStringsSep "\n"
(allowedIP:
- "ip route delete ${allowedIP} dev ${interfaceName} table ${interfaceCfg.table}"
+ "${ip} route delete ${allowedIP} dev ${interfaceName} table ${interfaceCfg.table}"
) peer.allowedIPs);
in ''
- wg set ${interfaceName} peer ${peer.publicKey} remove
+ ${wg} set ${interfaceName} peer ${peer.publicKey} remove
${route_destroy}
'';
};
@@ -287,6 +317,13 @@ let
# exactly one way to specify the private key must be set
#assert (values.privateKey != null) != (values.privateKeyFile != null);
let privKey = if values.privateKeyFile != null then values.privateKeyFile else pkgs.writeText "wg-key" values.privateKey;
+ src = values.socketNamespace;
+ dst = values.interfaceNamespace;
+ ipPreMove = nsWrap "ip" src null;
+ ipPostMove = nsWrap "ip" src dst;
+ wg = nsWrap "wg" src dst;
+ ns = if dst == "init" then "1" else dst;
+
in
nameValuePair "wireguard-${name}"
{
@@ -307,26 +344,33 @@ let
${values.preSetup}
- ip link add dev ${name} type wireguard
+ ${ipPreMove} link add dev ${name} type wireguard
+ ${optionalString (values.interfaceNamespace != null && values.interfaceNamespace != values.socketNamespace) "${ipPreMove} link set ${name} netns ${ns}"}
${concatMapStringsSep "\n" (ip:
- "ip address add ${ip} dev ${name}"
+ "${ipPostMove} address add ${ip} dev ${name}"
) values.ips}
- wg set ${name} private-key ${privKey} ${
+ ${wg} set ${name} private-key ${privKey} ${
optionalString (values.listenPort != null) " listen-port ${toString values.listenPort}"}
- ip link set up dev ${name}
+ ${ipPostMove} link set up dev ${name}
${values.postSetup}
'';
postStop = ''
- ip link del dev ${name}
+ ${ipPostMove} link del dev ${name}
${values.postShutdown}
'';
};
+ nsWrap = cmd: src: dst:
+ let
+ nsList = filter (ns: ns != null) [ src dst ];
+ ns = last nsList;
+ in
+ if (length nsList > 0 && ns != "init") then "ip netns exec ${ns} ${cmd}" else cmd;
in
{
diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix
index 63e59e7c8fac3df7983cd7900fc40dfc7b2910b7..8f05c3949fba71b1efd41acaca92655a560eaebf 100644
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@@ -103,6 +103,13 @@ in {
description = ''
Set this to true if the SSID of the network is hidden.
'';
+ example = literalExample ''
+ { echelon = {
+ hidden = true;
+ psk = "abcdefgh";
+ };
+ }
+ '';
};
priority = mkOption {
@@ -146,10 +153,13 @@ in {
'';
default = {};
example = literalExample ''
- { echelon = {
+ { echelon = { # SSID with no spaces or special characters
psk = "abcdefgh";
};
- "free.wifi" = {};
+ "echelon's AP" = { # SSID with spaces and/or special characters
+ psk = "ijklmnop";
+ };
+ "free.wifi" = {}; # Public wireless network
}
'';
};
@@ -226,9 +236,12 @@ in {
${if ifaces == [] then ''
for i in $(cd /sys/class/net && echo *); do
DEVTYPE=
- source /sys/class/net/$i/uevent
- if [ "$DEVTYPE" = "wlan" -o -e /sys/class/net/$i/wireless ]; then
- ifaces="$ifaces''${ifaces:+ -N} -i$i"
+ UEVENT_PATH=/sys/class/net/$i/uevent
+ if [ -e "$UEVENT_PATH" ]; then
+ source "$UEVENT_PATH"
+ if [ "$DEVTYPE" = "wlan" -o -e /sys/class/net/$i/wireless ]; then
+ ifaces="$ifaces''${ifaces:+ -N} -i$i"
+ fi
fi
done
'' else ''
diff --git a/nixos/modules/services/networking/yggdrasil.nix b/nixos/modules/services/networking/yggdrasil.nix
new file mode 100644
index 0000000000000000000000000000000000000000..9e675ecd6f4b9956f864abfb222194cdd712d8ef
--- /dev/null
+++ b/nixos/modules/services/networking/yggdrasil.nix
@@ -0,0 +1,187 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+ cfg = config.services.yggdrasil;
+ configProvided = (cfg.config != {});
+ configAsFile = (if configProvided then
+ toString (pkgs.writeTextFile {
+ name = "yggdrasil-conf";
+ text = builtins.toJSON cfg.config;
+ })
+ else null);
+ configFileProvided = (cfg.configFile != null);
+ generateConfig = (
+ if configProvided && configFileProvided then
+ "${pkgs.jq}/bin/jq -s add ${configAsFile} ${cfg.configFile}"
+ else if configProvided then
+ "cat ${configAsFile}"
+ else if configFileProvided then
+ "cat ${cfg.configFile}"
+ else
+ "${cfg.package}/bin/yggdrasil -genconf"
+ );
+
+in {
+ options = with types; {
+ services.yggdrasil = {
+ enable = mkEnableOption "the yggdrasil system service";
+
+ configFile = mkOption {
+ type = nullOr str;
+ default = null;
+ example = "/run/keys/yggdrasil.conf";
+ description = ''
+ A file which contains JSON configuration for yggdrasil.
+
+ You do not have to supply a complete configuration, as
+ yggdrasil will use default values for anything which is
+ omitted. If the encryption and signing keys are omitted,
+ yggdrasil will generate new ones each time the service is
+ started, resulting in a random IPv6 address on the yggdrasil
+ network each time.
+
+ If both this option and are
+ supplied, they will be combined, with values from
+ taking precedence.
+
+ You can use the command nix-shell -p yggdrasil --run
+ "yggdrasil -genconf -json" to generate a default
+ JSON configuration.
+ '';
+ };
+
+ config = mkOption {
+ type = attrs;
+ default = {};
+ example = {
+ Peers = [
+ "tcp://aa.bb.cc.dd:eeeee"
+ "tcp://[aaaa:bbbb:cccc:dddd::eeee]:fffff"
+ ];
+ Listen = [
+ "tcp://0.0.0.0:xxxxx"
+ ];
+ };
+ description = ''
+ Configuration for yggdrasil, as a Nix attribute set.
+
+ Warning: this is stored in the WORLD-READABLE Nix store!
+ Therefore, it is not appropriate for private keys. If you
+ do not specify the keys, yggdrasil will generate a new set
+ each time the service is started, creating a random IPv6
+ address on the yggdrasil network each time.
+
+ If you wish to specify the keys, use
+ . If both
+ and are
+ supplied, they will be combined, with values from
+ taking precedence.
+
+ You can use the command nix-shell -p yggdrasil --run
+ "yggdrasil -genconf" to generate default
+ configuration values with documentation.
+ '';
+ };
+
+ openMulticastPort = mkOption {
+ type = bool;
+ default = false;
+ description = ''
+ Whether to open the UDP port used for multicast peer
+ discovery. The NixOS firewall blocks link-local
+ communication, so in order to make local peering work you
+ will also need to set LinkLocalTCPPort in your
+ yggdrasil configuration ( or
+ ) to a port number other than 0,
+ and then add that port to
+ .
+ '';
+ };
+
+ denyDhcpcdInterfaces = mkOption {
+ type = listOf str;
+ default = [];
+ example = [ "tap*" ];
+ description = ''
+ Disable the DHCP client for any interface whose name matches
+ any of the shell glob patterns in this list. Use this
+ option to prevent the DHCP client from broadcasting requests
+ on the yggdrasil network. It is only necessary to do so
+ when yggdrasil is running in TAP mode, because TUN
+ interfaces do not support broadcasting.
+ '';
+ };
+
+ package = mkOption {
+ type = package;
+ default = pkgs.yggdrasil;
+ defaultText = "pkgs.yggdrasil";
+ description = "Yggdrasil package to use.";
+ };
+ };
+ };
+
+ config = mkIf cfg.enable {
+ assertions = [
+ { assertion = config.networking.enableIPv6;
+ message = "networking.enableIPv6 must be true for yggdrasil to work";
+ }
+ ];
+
+ systemd.services.yggdrasil = {
+ description = "Yggdrasil Network Service";
+ path = [ cfg.package ] ++ optional (configProvided && configFileProvided) pkgs.jq;
+ bindsTo = [ "network-online.target" ];
+ after = [ "network-online.target" ];
+ wantedBy = [ "multi-user.target" ];
+
+ preStart = ''
+ ${generateConfig} | yggdrasil -normaliseconf -useconf > /run/yggdrasil/yggdrasil.conf
+ '';
+
+ serviceConfig = {
+ ExecStart = "${cfg.package}/bin/yggdrasil -useconffile /run/yggdrasil/yggdrasil.conf";
+ ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+ Restart = "always";
+
+ RuntimeDirectory = "yggdrasil";
+ RuntimeDirectoryMode = "0700";
+ BindReadOnlyPaths = mkIf configFileProvided
+ [ "${cfg.configFile}" ];
+
+ # TODO: as of yggdrasil 0.3.8 and systemd 243, yggdrasil fails
+ # to set up the network adapter when DynamicUser is set. See
+ # github.com/yggdrasil-network/yggdrasil-go/issues/557. The
+ # following options are implied by DynamicUser according to
+ # the systemd.exec documentation, and can be removed if the
+ # upstream issue is fixed and DynamicUser is set to true:
+ PrivateTmp = true;
+ RemoveIPC = true;
+ NoNewPrivileges = true;
+ ProtectSystem = "strict";
+ RestrictSUIDSGID = true;
+ # End of list of options implied by DynamicUser.
+
+ AmbientCapabilities = "CAP_NET_ADMIN";
+ CapabilityBoundingSet = "CAP_NET_ADMIN";
+ MemoryDenyWriteExecute = true;
+ ProtectControlGroups = true;
+ ProtectHome = "tmpfs";
+ ProtectKernelModules = true;
+ ProtectKernelTunables = true;
+ RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
+ RestrictNamespaces = true;
+ RestrictRealtime = true;
+ SystemCallArchitectures = "native";
+ SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @resources";
+ };
+ };
+
+ networking.dhcpcd.denyInterfaces = cfg.denyDhcpcdInterfaces;
+ networking.firewall.allowedUDPPorts = mkIf cfg.openMulticastPort [ 9001 ];
+
+ # Make yggdrasilctl available on the command line.
+ environment.systemPackages = [ cfg.package ];
+ };
+ meta.maintainers = with lib.maintainers; [ gazally ];
+}
diff --git a/nixos/modules/services/networking/zeronet.nix b/nixos/modules/services/networking/zeronet.nix
index f4988a90268502210dc07cde6d68d3d064987c44..f354a9d42c79717717755eabbcc9136e314401f3 100644
--- a/nixos/modules/services/networking/zeronet.nix
+++ b/nixos/modules/services/networking/zeronet.nix
@@ -1,44 +1,39 @@
{ config, lib, pkgs, ... }:
let
+ inherit (lib) generators literalExample mkEnableOption mkIf mkOption recursiveUpdate types;
cfg = config.services.zeronet;
-
- zConfFile = pkgs.writeTextFile {
- name = "zeronet.conf";
-
- text = ''
- [global]
- data_dir = ${cfg.dataDir}
- log_dir = ${cfg.logDir}
- '' + lib.optionalString (cfg.port != null) ''
- ui_port = ${toString cfg.port}
- '' + lib.optionalString (cfg.fileserverPort != null) ''
- fileserver_port = ${toString cfg.fileserverPort}
- '' + lib.optionalString (cfg.torAlways) ''
- tor = always
- '' + cfg.extraConfig;
+ dataDir = "/var/lib/zeronet";
+ configFile = pkgs.writeText "zeronet.conf" (generators.toINI {} (recursiveUpdate defaultSettings cfg.settings));
+
+ defaultSettings = {
+ global = {
+ data_dir = dataDir;
+ log_dir = dataDir;
+ ui_port = cfg.port;
+ fileserver_port = cfg.fileserverPort;
+ tor = if !cfg.tor then "disable" else if cfg.torAlways then "always" else "enable";
+ };
};
in with lib; {
options.services.zeronet = {
enable = mkEnableOption "zeronet";
- dataDir = mkOption {
- type = types.path;
- default = "/var/lib/zeronet";
- example = "/home/okina/zeronet";
- description = "Path to the zeronet data directory.";
- };
+ settings = mkOption {
+ type = with types; attrsOf (oneOf [ str int bool (listOf str) ]);
+ default = {};
+ example = literalExample "global.tor = enable;";
- logDir = mkOption {
- type = types.path;
- default = "/var/log/zeronet";
- example = "/home/okina/zeronet/log";
- description = "Path to the zeronet log directory.";
+ description = ''
+ zeronet.conf configuration. Refer to
+
+ for details on supported values;
+ '';
};
port = mkOption {
- type = types.nullOr types.int;
- default = null;
+ type = types.int;
+ default = 43110;
example = 43110;
description = "Optional zeronet web UI port.";
};
@@ -63,22 +58,13 @@ in with lib; {
default = false;
description = "Use TOR for all zeronet traffic.";
};
-
- extraConfig = mkOption {
- type = types.lines;
- default = "";
-
- description = ''
- Extra configuration. Contents will be added verbatim to the
- configuration file at the end.
- '';
- };
};
config = mkIf cfg.enable {
services.tor = mkIf cfg.tor {
enable = true;
controlPort = 9051;
+
extraConfig = ''
CacheDirectoryGroupReadable 1
CookieAuthentication 1
@@ -86,37 +72,25 @@ in with lib; {
'';
};
- systemd.tmpfiles.rules = [
- "d '${cfg.dataDir}' 750 zeronet zeronet - -"
- "d '${cfg.logDir}' 750 zeronet zeronet - -"
- ];
-
systemd.services.zeronet = {
description = "zeronet";
after = [ "network.target" (optionalString cfg.tor "tor.service") ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
- PrivateTmp = "yes";
User = "zeronet";
- Group = "zeronet";
- ExecStart = "${pkgs.zeronet}/bin/zeronet --config_file ${zConfFile}";
- };
- };
-
- users = {
- groups.zeronet.gid = config.ids.gids.zeronet;
-
- users.zeronet = {
- description = "zeronet service user";
- home = cfg.dataDir;
- createHome = true;
- group = "zeronet";
- extraGroups = mkIf cfg.tor [ "tor" ];
- uid = config.ids.uids.zeronet;
+ DynamicUser = true;
+ StateDirectory = "zeronet";
+ SupplementaryGroups = mkIf cfg.tor [ "tor" ];
+ ExecStart = "${pkgs.zeronet}/bin/zeronet --config_file ${configFile}";
};
};
};
+ imports = [
+ (mkRemovedOptionModule [ "services" "zeronet" "dataDir" ] "Zeronet will store data by default in /var/lib/zeronet")
+ (mkRemovedOptionModule [ "services" "zeronet" "logDir" ] "Zeronet will log by default in /var/lib/zeronet")
+ ];
+
meta.maintainers = with maintainers; [ chiiruno ];
}
diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix
index 3fcae611dc793079ce8634f6f3c4263c6317ac77..cc35be49bc3bdb7a8764c0e15f468d3c5350a4c4 100644
--- a/nixos/modules/services/printing/cupsd.nix
+++ b/nixos/modules/services/printing/cupsd.nix
@@ -31,7 +31,7 @@ let
# part of CUPS itself, e.g. the SMB backend is part of Samba. Since
# we can't update ${cups.out}/lib/cups itself, we create a symlink tree
# here and add the additional programs. The ServerBin directive in
- # cupsd.conf tells cupsd to use this tree.
+ # cups-files.conf tells cupsd to use this tree.
bindir = pkgs.buildEnv {
name = "cups-progs";
paths =
@@ -112,6 +112,15 @@ in
{
+ imports = [
+ (mkChangedOptionModule [ "services" "printing" "gutenprint" ] [ "services" "printing" "drivers" ]
+ (config:
+ let enabled = getAttrFromPath [ "services" "printing" "gutenprint" ] config;
+ in if enabled then [ pkgs.gutenprint ] else [ ]))
+ (mkRemovedOptionModule [ "services" "printing" "cupsFilesConf" ] "")
+ (mkRemovedOptionModule [ "services" "printing" "cupsdConf" ] "")
+ ];
+
###### interface
options = {
diff --git a/nixos/modules/services/scheduling/marathon.nix b/nixos/modules/services/scheduling/marathon.nix
index 0961a67770e1b72de15b964312ed5f03e305592a..2e0d20c64b23a0f30cd59fa90de73821baeda0ae 100644
--- a/nixos/modules/services/scheduling/marathon.nix
+++ b/nixos/modules/services/scheduling/marathon.nix
@@ -93,6 +93,6 @@ in {
};
};
- users.users.${cfg.user} = { };
+ users.users.${cfg.user}.isSystemUser = true;
};
}
diff --git a/nixos/modules/services/security/bitwarden_rs/default.nix b/nixos/modules/services/security/bitwarden_rs/default.nix
index 80fd65891ff8fa8a04738eab322d0425053846c7..d1817db0755501081ae3038bc4cf9045111f385b 100644
--- a/nixos/modules/services/security/bitwarden_rs/default.nix
+++ b/nixos/modules/services/security/bitwarden_rs/default.nix
@@ -74,7 +74,10 @@ in {
webVaultEnabled = mkDefault true;
};
- users.users.bitwarden_rs = { inherit group; };
+ users.users.bitwarden_rs = {
+ inherit group;
+ isSystemUser = true;
+ };
users.groups.bitwarden_rs = { };
systemd.services.bitwarden_rs = {
diff --git a/nixos/modules/services/security/clamav.nix b/nixos/modules/services/security/clamav.nix
index 04b433f8f2bf665d48c83081b06b42b93180d282..ef5bde7907e0a7ecc03476382ca317a41f3ead4f 100644
--- a/nixos/modules/services/security/clamav.nix
+++ b/nixos/modules/services/security/clamav.nix
@@ -30,6 +30,10 @@ let
'';
in
{
+ imports = [
+ (mkRenamedOptionModule [ "services" "clamav" "updater" "config" ] [ "services" "clamav" "updater" "extraConfig" ])
+ ];
+
options = {
services.clamav = {
daemon = {
diff --git a/nixos/modules/services/security/fprintd.nix b/nixos/modules/services/security/fprintd.nix
index 5662ebc61d20c9c4b603436106c597a722e67391..8ece1ca19013024ca856da3b7841309b649ca7e4 100644
--- a/nixos/modules/services/security/fprintd.nix
+++ b/nixos/modules/services/security/fprintd.nix
@@ -50,13 +50,6 @@ in
systemd.packages = [ cfg.package ];
-
- # The upstream unit does not use StateDirectory, and will
- # fail if the directory it needs is not present. Should be
- # fixed when https://gitlab.freedesktop.org/libfprint/fprintd/merge_requests/5
- # is merged.
- systemd.services.fprintd.serviceConfig.StateDirectory = "fprint";
-
};
}
diff --git a/nixos/modules/services/security/oauth2_proxy.nix b/nixos/modules/services/security/oauth2_proxy.nix
index bb03f7fc9e43cb95fb838fb85e390b5936d6a427..2abb9ec32acaa5db9b38827d037f84b7eb72de04 100644
--- a/nixos/modules/services/security/oauth2_proxy.nix
+++ b/nixos/modules/services/security/oauth2_proxy.nix
@@ -546,6 +546,7 @@ in
users.users.oauth2_proxy = {
description = "OAuth2 Proxy";
+ isSystemUser = true;
};
systemd.services.oauth2_proxy = {
diff --git a/nixos/modules/services/security/tor.nix b/nixos/modules/services/security/tor.nix
index ed862387cce1d9dcd80b533077c41974048a873c..18c105b2f5765b3218dc77e8c0572ef88f6d5290 100644
--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@@ -106,6 +106,12 @@ let
in
{
+ imports = [
+ (mkRenamedOptionModule [ "services" "tor" "relay" "portSpec" ] [ "services" "tor" "relay" "port" ])
+ (mkRemovedOptionModule [ "services" "tor" "relay" "isBridge" ] "Use services.tor.relay.role instead.")
+ (mkRemovedOptionModule [ "services" "tor" "relay" "isExit" ] "Use services.tor.relay.role instead.")
+ ];
+
options = {
services.tor = {
enable = mkOption {
diff --git a/nixos/modules/services/security/vault.nix b/nixos/modules/services/security/vault.nix
index d5962ba9af9009a3b821593e4b1be95c97be5da3..b0ab8fadcbec9a8c442dc5185d5c3fcd599ada82 100644
--- a/nixos/modules/services/security/vault.nix
+++ b/nixos/modules/services/security/vault.nix
@@ -119,9 +119,8 @@ in
};
users.groups.vault.gid = config.ids.gids.vault;
- systemd.tmpfiles.rules = optional (cfg.storagePath != null) [
- "d '${cfg.storagePath}' 0700 vault vault - -"
- ];
+ systemd.tmpfiles.rules = optional (cfg.storagePath != null)
+ "d '${cfg.storagePath}' 0700 vault vault - -";
systemd.services.vault = {
description = "Vault server daemon";
diff --git a/nixos/modules/services/torrent/magnetico.nix b/nixos/modules/services/torrent/magnetico.nix
index 02fa2ac0750a5739bb4b50a33c1feb9700a21905..7465c10e002c500ca89fd45699ba1d560dff925a 100644
--- a/nixos/modules/services/torrent/magnetico.nix
+++ b/nixos/modules/services/torrent/magnetico.nix
@@ -35,6 +35,7 @@ let
(if (cfg.web.credentialsFile != null || cfg.web.credentials != { })
then "--credentials=${toString credFile}"
else "--no-auth")
+ "--addr=${address}:${toString port}"
] ++ extraOptions);
in {
@@ -171,12 +172,13 @@ in {
users.users.magnetico = {
description = "Magnetico daemons user";
+ isSystemUser = true;
};
systemd.services.magneticod = {
description = "Magnetico DHT crawler";
wantedBy = [ "multi-user.target" ];
- after = [ "network-online.target" ];
+ after = [ "network.target" ];
serviceConfig = {
User = "magnetico";
@@ -188,7 +190,7 @@ in {
systemd.services.magneticow = {
description = "Magnetico web interface";
wantedBy = [ "multi-user.target" ];
- after = [ "network-online.target" "magneticod.service"];
+ after = [ "network.target" "magneticod.service"];
serviceConfig = {
User = "magnetico";
@@ -201,7 +203,7 @@ in {
assertions =
[
{
- assertion = cfg.web.credentialsFile != null || cfg.web.credentials != { };
+ assertion = cfg.web.credentialsFile == null || cfg.web.credentials == { };
message = ''
The options services.magnetico.web.credentialsFile and
services.magnetico.web.credentials are mutually exclusives.
@@ -211,4 +213,6 @@ in {
};
+ meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
}
diff --git a/nixos/modules/services/torrent/transmission.nix b/nixos/modules/services/torrent/transmission.nix
index 7409eb8cdcbef970158c07ce849c486685f1194d..aa1acdf7d20b98513d6e6ed6e7d1a24ac822bb35 100644
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@@ -7,6 +7,7 @@ let
apparmor = config.security.apparmor.enable;
homeDir = cfg.home;
+ downloadDirPermissions = cfg.downloadDirPermissions;
downloadDir = "${homeDir}/Downloads";
incompleteDir = "${homeDir}/.incomplete";
@@ -16,16 +17,14 @@ let
# for users in group "transmission" to have access to torrents
fullSettings = { umask = 2; download-dir = downloadDir; incomplete-dir = incompleteDir; } // cfg.settings;
- # Directories transmission expects to exist and be ug+rwx.
- directoriesToManage = [ homeDir settingsDir fullSettings.download-dir fullSettings.incomplete-dir ];
-
preStart = pkgs.writeScript "transmission-pre-start" ''
#!${pkgs.runtimeShell}
set -ex
- for DIR in ${escapeShellArgs directoriesToManage}; do
+ for DIR in "${homeDir}" "${settingsDir}" "${fullSettings.download-dir}" "${fullSettings.incomplete-dir}"; do
mkdir -p "$DIR"
- chmod 770 "$DIR"
done
+ chmod 700 "${homeDir}" "${settingsDir}"
+ chmod ${downloadDirPermissions} "${fullSettings.download-dir}" "${fullSettings.incomplete-dir}"
cp -f ${settingsFile} ${settingsDir}/settings.json
'';
in
@@ -71,6 +70,16 @@ in
'';
};
+ downloadDirPermissions = mkOption {
+ type = types.str;
+ default = "770";
+ example = "775";
+ description = ''
+ The permissions to set for download-dir and incomplete-dir.
+ They will be applied on every service start.
+ '';
+ };
+
port = mkOption {
type = types.int;
default = 9091;
@@ -109,7 +118,7 @@ in
# 1) Only the "transmission" user and group have access to torrents.
# 2) Optionally update/force specific fields into the configuration file.
serviceConfig.ExecStartPre = preStart;
- serviceConfig.ExecStart = "${pkgs.transmission}/bin/transmission-daemon -f --port ${toString config.services.transmission.port}";
+ serviceConfig.ExecStart = "${pkgs.transmission}/bin/transmission-daemon -f --port ${toString config.services.transmission.port} --config-dir ${settingsDir}";
serviceConfig.ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
serviceConfig.User = cfg.user;
serviceConfig.Group = cfg.group;
diff --git a/nixos/modules/services/web-apps/codimd.nix b/nixos/modules/services/web-apps/codimd.nix
index 7ae7cd9c52d8cf09e2b9be7111080805f0ce11dc..5f56f8ed5a09175499c1986d0aaf4215fe5f780c 100644
--- a/nixos/modules/services/web-apps/codimd.nix
+++ b/nixos/modules/services/web-apps/codimd.nix
@@ -893,6 +893,7 @@ in
extraGroups = cfg.groups;
home = cfg.workDir;
createHome = true;
+ isSystemUser = true;
};
systemd.services.codimd = {
diff --git a/nixos/modules/services/web-apps/documize.nix b/nixos/modules/services/web-apps/documize.nix
index 37359869cb64623f88df9c79070e1becd15e4e67..1b90299aa23c83f366842e4301c5e7ad2d0e56e1 100644
--- a/nixos/modules/services/web-apps/documize.nix
+++ b/nixos/modules/services/web-apps/documize.nix
@@ -14,6 +14,15 @@ in {
options.services.documize = {
enable = mkEnableOption "Documize Wiki";
+ stateDirectoryName = mkOption {
+ type = types.str;
+ default = "documize";
+ description = ''
+ The name of the directory below /var/lib/private
+ where documize runs in and stores, for example, backups.
+ '';
+ };
+
package = mkOption {
type = types.package;
default = pkgs.documize-community;
@@ -132,6 +141,8 @@ in {
];
Restart = "always";
DynamicUser = "yes";
+ StateDirectory = cfg.stateDirectoryName;
+ WorkingDirectory = "/var/lib/${cfg.stateDirectoryName}";
};
};
};
diff --git a/nixos/modules/services/web-apps/frab.nix b/nixos/modules/services/web-apps/frab.nix
index 7914e5cc0ee19b17ddeeb8d872a0c18263eee764..a9a30b409220f036b2813080e575bf1e42af49d4 100644
--- a/nixos/modules/services/web-apps/frab.nix
+++ b/nixos/modules/services/web-apps/frab.nix
@@ -177,6 +177,7 @@ in
{ name = cfg.user;
group = cfg.group;
home = "${cfg.statePath}";
+ isSystemUser = true;
}
];
diff --git a/nixos/modules/services/web-apps/gotify-server.nix b/nixos/modules/services/web-apps/gotify-server.nix
new file mode 100644
index 0000000000000000000000000000000000000000..03e01f46a94413d77483132e4598d405e8d6396b
--- /dev/null
+++ b/nixos/modules/services/web-apps/gotify-server.nix
@@ -0,0 +1,49 @@
+{ pkgs, lib, config, ... }:
+
+with lib;
+
+let
+ cfg = config.services.gotify;
+in {
+ options = {
+ services.gotify = {
+ enable = mkEnableOption "Gotify webserver";
+
+ port = mkOption {
+ type = types.port;
+ description = ''
+ Port the server listens to.
+ '';
+ };
+
+ stateDirectoryName = mkOption {
+ type = types.str;
+ default = "gotify-server";
+ description = ''
+ The name of the directory below /var/lib where
+ gotify stores its runtime data.
+ '';
+ };
+ };
+ };
+
+ config = mkIf cfg.enable {
+ systemd.services.gotify-server = {
+ wantedBy = [ "multi-user.target" ];
+ after = [ "network.target" ];
+ description = "Simple server for sending and receiving messages";
+
+ environment = {
+ GOTIFY_SERVER_PORT = toString cfg.port;
+ };
+
+ serviceConfig = {
+ WorkingDirectory = "/var/lib/${cfg.stateDirectoryName}";
+ StateDirectory = cfg.stateDirectoryName;
+ Restart = "always";
+ DynamicUser = "yes";
+ ExecStart = "${pkgs.gotify-server}/bin/server";
+ };
+ };
+ };
+}
diff --git a/nixos/modules/services/web-apps/limesurvey.nix b/nixos/modules/services/web-apps/limesurvey.nix
index 68b57a9b90ddfc8b0854caf2df6dfdceb90ea52c..e00a47191c6f97225011f36f2af047c25275b5ac 100644
--- a/nixos/modules/services/web-apps/limesurvey.nix
+++ b/nixos/modules/services/web-apps/limesurvey.nix
@@ -3,7 +3,7 @@
let
inherit (lib) mkDefault mkEnableOption mkForce mkIf mkMerge mkOption;
- inherit (lib) mapAttrs optional optionalString types;
+ inherit (lib) literalExample mapAttrs optional optionalString types;
cfg = config.services.limesurvey;
fpm = config.services.phpfpm.pools.limesurvey;
@@ -100,19 +100,15 @@ in
};
virtualHost = mkOption {
- type = types.submodule ({
- options = import ../web-servers/apache-httpd/per-server-options.nix {
- inherit lib;
- forMainServer = false;
- };
- });
- example = {
- hostName = "survey.example.org";
- enableSSL = true;
- adminAddr = "webmaster@example.org";
- sslServerCert = "/var/lib/acme/survey.example.org/full.pem";
- sslServerKey = "/var/lib/acme/survey.example.org/key.pem";
- };
+ type = types.submodule (import ../web-servers/apache-httpd/per-server-options.nix);
+ example = literalExample ''
+ {
+ hostName = "survey.example.org";
+ adminAddr = "webmaster@example.org";
+ forceSSL = true;
+ enableACME = true;
+ }
+ '';
description = ''
Apache configuration can be done by adapting services.httpd.virtualHosts.<name>.
See for further information.
@@ -184,7 +180,7 @@ in
config = {
tempdir = "${stateDir}/tmp";
uploaddir = "${stateDir}/upload";
- force_ssl = mkIf cfg.virtualHost.enableSSL "on";
+ force_ssl = mkIf (cfg.virtualHost.addSSL || cfg.virtualHost.forceSSL || cfg.virtualHost.onlySSL) "on";
config.defaultlang = "en";
};
};
@@ -215,38 +211,36 @@ in
enable = true;
adminAddr = mkDefault cfg.virtualHost.adminAddr;
extraModules = [ "proxy_fcgi" ];
- virtualHosts = [ (mkMerge [
- cfg.virtualHost {
- documentRoot = mkForce "${pkg}/share/limesurvey";
- extraConfig = ''
- Alias "/tmp" "${stateDir}/tmp"
-
- AllowOverride all
- Require all granted
- Options -Indexes +FollowSymlinks
-
-
- Alias "/upload" "${stateDir}/upload"
-
- AllowOverride all
- Require all granted
- Options -Indexes
-
-
-
-
-
- SetHandler "proxy:unix:${fpm.socket}|fcgi://localhost/"
-
-
-
- AllowOverride all
- Options -Indexes
- DirectoryIndex index.php
-
- '';
- }
- ]) ];
+ virtualHosts.${cfg.virtualHost.hostName} = mkMerge [ cfg.virtualHost {
+ documentRoot = mkForce "${pkg}/share/limesurvey";
+ extraConfig = ''
+ Alias "/tmp" "${stateDir}/tmp"
+
+ AllowOverride all
+ Require all granted
+ Options -Indexes +FollowSymlinks
+
+
+ Alias "/upload" "${stateDir}/upload"
+
+ AllowOverride all
+ Require all granted
+ Options -Indexes
+
+
+
+
+
+ SetHandler "proxy:unix:${fpm.socket}|fcgi://localhost/"
+
+
+
+ AllowOverride all
+ Options -Indexes
+ DirectoryIndex index.php
+
+ '';
+ } ];
};
systemd.tmpfiles.rules = [
@@ -277,7 +271,10 @@ in
systemd.services.httpd.after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
- users.users.${user}.group = group;
+ users.users.${user} = {
+ group = group;
+ isSystemUser = true;
+ };
};
}
diff --git a/nixos/modules/services/web-apps/matomo-doc.xml b/nixos/modules/services/web-apps/matomo-doc.xml
index 8485492c51c78b373515795b442231e0a3dd1176..69d1170e4523b8d5bf32f384611d1698f97dfb1f 100644
--- a/nixos/modules/services/web-apps/matomo-doc.xml
+++ b/nixos/modules/services/web-apps/matomo-doc.xml
@@ -84,12 +84,6 @@ GRANT ALL PRIVILEGES ON matomo.* TO 'matomo'@'localhost';
Issues
-
-
- Matomo's file integrity check will warn you. This is due to the patches
- necessary for NixOS, you can safely ignore this.
-
-
Matomo will warn you that the JavaScript tracker is not writable. This is
@@ -105,7 +99,7 @@ GRANT ALL PRIVILEGES ON matomo.* TO 'matomo'@'localhost';
You can use other web servers by forwarding calls for
index.php and piwik.php to the
- /run/phpfpm-matomo.sock fastcgi unix socket. You can use
+ services.phpfpm.pools.<name>.socket fastcgi unix socket. You can use
the nginx configuration in the module code as a reference to what else
should be configured.
diff --git a/nixos/modules/services/web-apps/matomo.nix b/nixos/modules/services/web-apps/matomo.nix
index d9f840408cc82f8b221cbf26dc2bc60bdcb1a4d0..75da474dc4464af94b258cd27097a8c3e78810af 100644
--- a/nixos/modules/services/web-apps/matomo.nix
+++ b/nixos/modules/services/web-apps/matomo.nix
@@ -2,15 +2,13 @@
with lib;
let
cfg = config.services.matomo;
+ fpm = config.services.phpfpm.pools.${pool};
user = "matomo";
dataDir = "/var/lib/${user}";
deprecatedDataDir = "/var/lib/piwik";
pool = user;
- # it's not possible to use /run/phpfpm/${pool}.sock because /run/phpfpm/ is root:root 0770,
- # and therefore is not accessible by the web server.
- phpSocket = "/run/phpfpm-${pool}.sock";
phpExecutionUnit = "phpfpm-${pool}";
databaseService = "mysql.service";
@@ -20,6 +18,14 @@ let
in join config.networking.hostName config.networking.domain;
in {
+ imports = [
+ (mkRenamedOptionModule [ "services" "piwik" "enable" ] [ "services" "matomo" "enable" ])
+ (mkRenamedOptionModule [ "services" "piwik" "webServerUser" ] [ "services" "matomo" "webServerUser" ])
+ (mkRemovedOptionModule [ "services" "piwik" "phpfpmProcessManagerConfig" ] "Use services.phpfpm.pools..settings")
+ (mkRemovedOptionModule [ "services" "matomo" "phpfpmProcessManagerConfig" ] "Use services.phpfpm.pools..settings")
+ (mkRenamedOptionModule [ "services" "piwik" "nginx" ] [ "services" "matomo" "nginx" ])
+ ];
+
options = {
services.matomo = {
# NixOS PR for database setup: https://github.com/NixOS/nixpkgs/pull/6963
@@ -50,7 +56,7 @@ in {
default = null;
example = "lighttpd";
description = ''
- Name of the web server user that forwards requests to the ${phpSocket} fastcgi socket for Matomo if the nginx
+ Name of the web server user that forwards requests to the fastcgi socket for Matomo if the nginx
option is not used. Either this option or the nginx option is mandatory.
If you want to use another webserver than nginx, you need to set this to that server's user
and pass fastcgi requests to `index.php`, `matomo.php` and `piwik.php` (legacy name) to this socket.
@@ -71,25 +77,6 @@ in {
'';
};
- phpfpmProcessManagerConfig = mkOption {
- type = types.str;
- default = ''
- ; default phpfpm process manager settings
- pm = dynamic
- pm.max_children = 75
- pm.start_servers = 10
- pm.min_spare_servers = 5
- pm.max_spare_servers = 20
- pm.max_requests = 500
-
- ; log worker's stdout, but this has a performance hit
- catch_workers_output = yes
- '';
- description = ''
- Settings for phpfpm's process manager. You might need to change this depending on the load for Matomo.
- '';
- };
-
nginx = mkOption {
type = types.nullOr (types.submodule (
recursiveUpdate
@@ -105,8 +92,8 @@ in {
default = null;
example = {
serverAliases = [
- "matomo.$\{config.networking.domain\}"
- "stats.$\{config.networking.domain\}"
+ "matomo.\${config.networking.domain}"
+ "stats.\${config.networking.domain}"
];
enableACME = false;
};
@@ -115,7 +102,7 @@ in {
Either this option or the webServerUser option is mandatory.
Set this to {} to just enable the virtualHost if you don't need any customization.
If enabled, then by default, the is
- ${user}.$\{config.networking.hostName\}.$\{config.networking.domain\},
+ ''${user}.''${config.networking.hostName}.''${config.networking.domain},
SSL is active, and certificates are acquired via ACME.
If this is set to null (the default), no nginx virtualHost will be configured.
'';
@@ -233,15 +220,24 @@ in {
else if (cfg.webServerUser != null) then cfg.webServerUser else "";
in {
${pool} = {
- listen = phpSocket;
- extraConfig = ''
- listen.owner = ${socketOwner}
- listen.group = root
- listen.mode = 0600
- user = ${user}
- env[PIWIK_USER_PATH] = ${dataDir}
- ${cfg.phpfpmProcessManagerConfig}
+ inherit user;
+ phpOptions = ''
+ error_log = 'stderr'
+ log_errors = on
'';
+ settings = mapAttrs (name: mkDefault) {
+ "listen.owner" = socketOwner;
+ "listen.group" = "root";
+ "listen.mode" = "0660";
+ "pm" = "dynamic";
+ "pm.max_children" = 75;
+ "pm.start_servers" = 10;
+ "pm.min_spare_servers" = 5;
+ "pm.max_spare_servers" = 20;
+ "pm.max_requests" = 500;
+ "catch_workers_output" = true;
+ };
+ phpEnv.PIWIK_USER_PATH = dataDir;
};
};
@@ -264,18 +260,18 @@ in {
};
# allow index.php for webinterface
locations."= /index.php".extraConfig = ''
- fastcgi_pass unix:${phpSocket};
+ fastcgi_pass unix:${fpm.socket};
'';
# allow matomo.php for tracking
locations."= /matomo.php".extraConfig = ''
- fastcgi_pass unix:${phpSocket};
+ fastcgi_pass unix:${fpm.socket};
'';
# allow piwik.php for tracking (deprecated name)
locations."= /piwik.php".extraConfig = ''
- fastcgi_pass unix:${phpSocket};
+ fastcgi_pass unix:${fpm.socket};
'';
# Any other attempt to access any php files is forbidden
- locations."~* ^.+\.php$".extraConfig = ''
+ locations."~* ^.+\\.php$".extraConfig = ''
return 403;
'';
# Disallow access to unneeded directories
@@ -284,7 +280,7 @@ in {
return 403;
'';
# Disallow access to several helper files
- locations."~* \.(?:bat|git|ini|sh|txt|tpl|xml|md)$".extraConfig = ''
+ locations."~* \\.(?:bat|git|ini|sh|txt|tpl|xml|md)$".extraConfig = ''
return 403;
'';
# No crawling of this site for bots that obey robots.txt - no useful information here.
diff --git a/nixos/modules/services/web-apps/mediawiki.nix b/nixos/modules/services/web-apps/mediawiki.nix
index ec2568bf952d3670eaf1c23cbf9dba331bb11c00..8a109b39bb5797b72a0a09194218f7002b5d3ce4 100644
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@@ -64,7 +64,7 @@ let
$wgScriptPath = "";
## The protocol and server name to use in fully-qualified URLs
- $wgServer = "${if cfg.virtualHost.enableSSL then "https" else "http"}://${cfg.virtualHost.hostName}";
+ $wgServer = "${if cfg.virtualHost.addSSL || cfg.virtualHost.forceSSL || cfg.virtualHost.onlySSL then "https" else "http"}://${cfg.virtualHost.hostName}";
## The URL path to static resources (images, scripts, etc.)
$wgResourceBasePath = $wgScriptPath;
@@ -290,19 +290,13 @@ in
};
virtualHost = mkOption {
- type = types.submodule ({
- options = import ../web-servers/apache-httpd/per-server-options.nix {
- inherit lib;
- forMainServer = false;
- };
- });
+ type = types.submodule (import ../web-servers/apache-httpd/per-server-options.nix);
example = literalExample ''
{
hostName = "mediawiki.example.org";
- enableSSL = true;
adminAddr = "webmaster@example.org";
- sslServerCert = "/var/lib/acme/mediawiki.example.org/full.pem";
- sslServerKey = "/var/lib/acme/mediawiki.example.org/key.pem";
+ forceSSL = true;
+ enableACME = true;
}
'';
description = ''
@@ -389,31 +383,28 @@ in
services.httpd = {
enable = true;
- adminAddr = mkDefault cfg.virtualHost.adminAddr;
extraModules = [ "proxy_fcgi" ];
- virtualHosts = [ (mkMerge [
- cfg.virtualHost {
- documentRoot = mkForce "${pkg}/share/mediawiki";
- extraConfig = ''
-
-
-
- SetHandler "proxy:unix:${fpm.socket}|fcgi://localhost/"
-
-
-
- Require all granted
- DirectoryIndex index.php
- AllowOverride All
-
- '' + optionalString (cfg.uploadsDir != null) ''
- Alias "/images" "${cfg.uploadsDir}"
-
- Require all granted
-
- '';
- }
- ]) ];
+ virtualHosts.${cfg.virtualHost.hostName} = mkMerge [ cfg.virtualHost {
+ documentRoot = mkForce "${pkg}/share/mediawiki";
+ extraConfig = ''
+
+
+
+ SetHandler "proxy:unix:${fpm.socket}|fcgi://localhost/"
+
+
+
+ Require all granted
+ DirectoryIndex index.php
+ AllowOverride All
+
+ '' + optionalString (cfg.uploadsDir != null) ''
+ Alias "/images" "${cfg.uploadsDir}"
+
+ Require all granted
+
+ '';
+ } ];
};
systemd.tmpfiles.rules = [
@@ -461,7 +452,10 @@ in
systemd.services.httpd.after = optional (cfg.database.createLocally && cfg.database.type == "mysql") "mysql.service";
- users.users.${user}.group = group;
+ users.users.${user} = {
+ group = group;
+ isSystemUser = true;
+ };
environment.systemPackages = [ mediawikiScripts ];
};
diff --git a/nixos/modules/services/web-apps/moinmoin.nix b/nixos/modules/services/web-apps/moinmoin.nix
new file mode 100644
index 0000000000000000000000000000000000000000..0fee64be0bb2ffd2b505891eba40e193856a8aed
--- /dev/null
+++ b/nixos/modules/services/web-apps/moinmoin.nix
@@ -0,0 +1,303 @@
+{ config, lib, pkgs, ... }:
+with lib;
+
+let
+ cfg = config.services.moinmoin;
+ python = pkgs.python27;
+ pkg = python.pkgs.moinmoin;
+ dataDir = "/var/lib/moin";
+ usingGunicorn = cfg.webServer == "nginx-gunicorn" || cfg.webServer == "gunicorn";
+ usingNginx = cfg.webServer == "nginx-gunicorn";
+ user = "moin";
+ group = "moin";
+
+ uLit = s: ''u"${s}"'';
+ indentLines = n: str: concatMapStrings (line: "${fixedWidthString n " " " "}${line}\n") (splitString "\n" str);
+
+ moinCliWrapper = wikiIdent: pkgs.writeShellScriptBin "moin-${wikiIdent}" ''
+ ${pkgs.su}/bin/su -s ${pkgs.runtimeShell} -c "${pkg}/bin/moin --config-dir=/var/lib/moin/${wikiIdent}/config $*" ${user}
+ '';
+
+ wikiConfig = wikiIdent: w: ''
+ # -*- coding: utf-8 -*-
+
+ from MoinMoin.config import multiconfig, url_prefix_static
+
+ class Config(multiconfig.DefaultConfig):
+ ${optionalString (w.webLocation != "/") ''
+ url_prefix_static = '${w.webLocation}' + url_prefix_static
+ ''}
+
+ sitename = u'${w.siteName}'
+ page_front_page = u'${w.frontPage}'
+
+ data_dir = '${dataDir}/${wikiIdent}/data'
+ data_underlay_dir = '${dataDir}/${wikiIdent}/underlay'
+
+ language_default = u'${w.languageDefault}'
+ ${optionalString (w.superUsers != []) ''
+ superuser = [${concatMapStringsSep ", " uLit w.superUsers}]
+ ''}
+
+ ${indentLines 4 w.extraConfig}
+ '';
+ wikiConfigFile = name: wiki: pkgs.writeText "${name}.py" (wikiConfig name wiki);
+
+in
+{
+ options.services.moinmoin = with types; {
+ enable = mkEnableOption "MoinMoin Wiki Engine";
+
+ webServer = mkOption {
+ type = enum [ "nginx-gunicorn" "gunicorn" "none" ];
+ default = "nginx-gunicorn";
+ example = "none";
+ description = ''
+ Which web server to use to serve the wiki.
+ Use none if you want to configure this yourself.
+ '';
+ };
+
+ gunicorn.workers = mkOption {
+ type = ints.positive;
+ default = 3;
+ example = 10;
+ description = ''
+ The number of worker processes for handling requests.
+ '';
+ };
+
+ wikis = mkOption {
+ type = attrsOf (submodule ({ name, ... }: {
+ options = {
+ siteName = mkOption {
+ type = str;
+ default = "Untitled Wiki";
+ example = "ExampleWiki";
+ description = ''
+ Short description of your wiki site, displayed below the logo on each page, and
+ used in RSS documents as the channel title.
+ '';
+ };
+
+ webHost = mkOption {
+ type = str;
+ description = "Host part of the wiki URL. If undefined, the name of the attribute set will be used.";
+ example = "wiki.example.org";
+ };
+
+ webLocation = mkOption {
+ type = str;
+ default = "/";
+ example = "/moin";
+ description = "Location part of the wiki URL.";
+ };
+
+ frontPage = mkOption {
+ type = str;
+ default = "LanguageSetup";
+ example = "FrontPage";
+ description = ''
+ Front page name. Set this to something like FrontPage once languages are
+ configured.
+ '';
+ };
+
+ superUsers = mkOption {
+ type = listOf str;
+ default = [];
+ example = [ "elvis" ];
+ description = ''
+ List of trusted user names with wiki system administration super powers.
+
+ Please note that accounts for these users need to be created using the moin command-line utility, e.g.:
+ moin-WIKINAME account create --name=NAME --email=EMAIL --password=PASSWORD.
+ '';
+ };
+
+ languageDefault = mkOption {
+ type = str;
+ default = "en";
+ example = "de";
+ description = "The ISO-639-1 name of the main wiki language. Languages that MoinMoin does not support are ignored.";
+ };
+
+ extraConfig = mkOption {
+ type = lines;
+ default = "";
+ example = ''
+ show_hosts = True
+ search_results_per_page = 100
+ acl_rights_default = u"Known:read,write,delete,revert All:read"
+ logo_string = u"