From d26e830997dd03deff62d585da94ddbb58f7b83f Mon Sep 17 00:00:00 2001 From: Corey O'Connor Date: Wed, 26 Sep 2018 14:22:40 -0700 Subject: [PATCH 01/52] vlc: 3.0.3 -> 3.0.4 (#47406) (cherry picked from commit 26ce2652584b46adac8704d67e04984069fdc799) Didn't build, invalid url for vlc-qt5.11.patch. --- pkgs/applications/video/vlc/default.nix | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) diff --git a/pkgs/applications/video/vlc/default.nix b/pkgs/applications/video/vlc/default.nix index 6fedc227e447..b08ff812ace4 100644 --- a/pkgs/applications/video/vlc/default.nix +++ b/pkgs/applications/video/vlc/default.nix @@ -20,11 +20,11 @@ assert (withQt5 -> qtbase != null && qtsvg != null && qtx11extras != null); stdenv.mkDerivation rec { name = "vlc-${version}"; - version = "3.0.3"; + version = "3.0.4"; src = fetchurl { url = "http://get.videolan.org/vlc/${version}/${name}.tar.xz"; - sha256 = "0lavzly8l0ll1d9iris9cnirgcs77g48lxj14058dxqkvd5v1a4v"; + sha256 = "17jsq0zqpqyxw4ckvjba0hf6zk8ywc4wf8sy3z03hh3ij0vxpwq1"; }; # VLC uses a *ton* of libraries for various pieces of functionality, many of @@ -52,18 +52,6 @@ stdenv.mkDerivation rec { # set the path to the compiler BUILDCC = "${stdenv.cc}/bin/gcc"; - patches = [ - (fetchpatch { - name = "vlc-qt5.11.patch"; - url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/vlc-qt5.11.patch?h=packages/vlc"; - sha256 = "0yh65bhhaz876cazhagnafs1dr61184lpj3y0m3y7k37bswykj8p"; - }) - (fetchpatch { - url = "https://github.com/videolan/vlc/commit/26e2d3906658c30f2f88f4b1bc9630ec43bf5525.patch"; - sha256 = "0sm73cbzxva8sww526bh5yin1k2pdkvj826wdlmqnj7xf0f3mki4"; - }) - ]; - postPatch = '' substituteInPlace configure \ --replace /bin/echo echo From 3c85e586b39b183354a235634e6a0b761ad18d76 Mon Sep 17 00:00:00 2001 From: Austin Seipp Date: Wed, 26 Sep 2018 19:37:32 -0500 Subject: [PATCH 02/52] libiio: install python bindings Signed-off-by: Austin Seipp (cherry picked from commit af48e5783a11091e73c43be7722aa7a3ca51ff8c) --- pkgs/development/libraries/libiio/default.nix | 13 +++++++++++-- pkgs/top-level/python-packages.nix | 5 +++++ 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/libiio/default.nix b/pkgs/development/libraries/libiio/default.nix index defb17bcd88a..51cdc289d626 100644 --- a/pkgs/development/libraries/libiio/default.nix +++ b/pkgs/development/libraries/libiio/default.nix @@ -1,6 +1,6 @@ { stdenv, fetchFromGitHub , cmake, flex, bison -, libxml2 +, libxml2, python }: stdenv.mkDerivation rec { @@ -14,11 +14,20 @@ stdenv.mkDerivation rec { sha256 = "05sbvvjka03qi080ad6g2y6gfwqp3n3zv7dpv237dym0zjyxqfa7"; }; - outputs = [ "out" "lib" "dev" ]; + outputs = [ "out" "lib" "dev" "python" ]; nativeBuildInputs = [ cmake flex bison ]; buildInputs = [ libxml2 ]; + postInstall = '' + mkdir -p $python/lib/${python.libPrefix}/site-packages/ + touch $python/lib/${python.libPrefix}/site-packages/ + cp ../bindings/python/iio.py $python/lib/${python.libPrefix}/site-packages/ + + substitute ../bindings/python/iio.py $python/lib/${python.libPrefix}/site-packages/iio.py \ + --replace 'libiio.so.0' $lib/lib/libiio.so.0 + ''; + meta = with stdenv.lib; { description = "API for interfacing with the Linux Industrial I/O Subsystem"; homepage = https://github.com/analogdevicesinc/libiio; diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 98c646e4157e..9b79c1bcc5c9 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -17314,6 +17314,11 @@ EOF libtorrentRasterbar = (toPythonModule (pkgs.libtorrentRasterbar.override { inherit python; })).python; + + libiio = (toPythonModule (pkgs.libiio.override { + inherit python; + })).python; + }); in fix' (extends overrides packages) From cf64adec53eedb53b215eaeb42ec17d129804630 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Wed, 26 Sep 2018 22:18:30 +0200 Subject: [PATCH 03/52] golden-cheetah: add desktop item and icon (cherry picked from commit bb51ba9bb883816b0f15b169c2f03510ad55c60d) --- .../misc/golden-cheetah/default.nix | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/misc/golden-cheetah/default.nix b/pkgs/applications/misc/golden-cheetah/default.nix index eecc34b3d94f..01447281fe76 100644 --- a/pkgs/applications/misc/golden-cheetah/default.nix +++ b/pkgs/applications/misc/golden-cheetah/default.nix @@ -1,8 +1,19 @@ { stdenv, fetchurl , qtbase, qtsvg, qtserialport, qtwebkit, qtmultimedia, qttools, qtconnectivity -, yacc, flex, zlib, qmake, makeWrapper +, yacc, flex, zlib, qmake, makeDesktopItem, makeWrapper }: -stdenv.mkDerivation rec { + +let + desktopItem = makeDesktopItem { + name = "goldencheetah"; + exec = "GoldenCheetah"; + icon = "goldencheetah"; + desktopName = "GoldenCheetah"; + genericName = "GoldenCheetah"; + comment = "Performance software for cyclists, runners and triathletes"; + categories = "Application;Utility;"; + }; +in stdenv.mkDerivation rec { name = "golden-cheetah-${version}"; version = "3.4"; src = fetchurl { @@ -27,6 +38,8 @@ stdenv.mkDerivation rec { mkdir -p $out/bin cp src/GoldenCheetah $out/bin wrapProgram $out/bin/GoldenCheetah --set LD_LIBRARY_PATH "${zlib.out}/lib" + install -Dm644 "${desktopItem}/share/applications/"* -t $out/share/applications/ + install -Dm644 src/Resources/images/gc.png $out/share/pixmaps/goldencheetah.png runHook postInstall ''; From d101614d7123a4cf9b4be89fa31e701dba3e3716 Mon Sep 17 00:00:00 2001 From: Jean-Philippe Cugnet Date: Tue, 25 Sep 2018 23:21:06 +0200 Subject: [PATCH 04/52] erlangR20: 20.3.8 -> 20.3.8.9 (cherry picked from commit 6e5682ab41030afc2f04591cb431eeb7808e2f79) Backport #47369 --- pkgs/development/interpreters/erlang/R20.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/interpreters/erlang/R20.nix b/pkgs/development/interpreters/erlang/R20.nix index 19ac6d355926..c408d21d9b31 100644 --- a/pkgs/development/interpreters/erlang/R20.nix +++ b/pkgs/development/interpreters/erlang/R20.nix @@ -1,8 +1,8 @@ { mkDerivation }: mkDerivation rec { - version = "20.3.8"; - sha256 = "1griiszz1x34idmwi6234br7bqd1d7mimim63amjgi9ds79jh6jj"; + version = "20.3.8.9"; + sha256 = "0v2iiyzss8hiih98wvj0gi2qzdmmhh7bvc9p025wlfm4k7r1109a"; prePatch = '' substituteInPlace configure.in --replace '`sw_vers -productVersion`' '10.10' From cdb33d1ddcf3dbd019cffe7849ff4f4409d70890 Mon Sep 17 00:00:00 2001 From: Jean-Philippe Cugnet Date: Tue, 25 Sep 2018 22:39:54 +0200 Subject: [PATCH 05/52] erlangR19: 19.3.6.6 -> 19.3.6.11 (cherry picked from commit bf227129935912caead713fc2706a91767af8ce5) Backport of #47367 --- pkgs/development/interpreters/erlang/R19.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/interpreters/erlang/R19.nix b/pkgs/development/interpreters/erlang/R19.nix index d94d4a5a14d0..e0d4ecbc95ac 100644 --- a/pkgs/development/interpreters/erlang/R19.nix +++ b/pkgs/development/interpreters/erlang/R19.nix @@ -1,8 +1,8 @@ { mkDerivation, fetchpatch }: mkDerivation rec { - version = "19.3.6.6"; - sha256 = "05l81gig0hmr951pjvwknc9x2qvpm95ph9z072hn4jqg13rzbgvg"; + version = "19.3.6.11"; + sha256 = "0b02iv8dly1vkc2xnqqi030sdj34h4gji2h4qgilllajr1f868vm"; patches = [ # macOS 10.13 crypto fix from OTP-20.1.2 From 0f4e1170540809de4428d9e0f77939b7de8deb6b Mon Sep 17 00:00:00 2001 From: Brian Olsen Date: Mon, 26 Feb 2018 23:57:44 +0100 Subject: [PATCH 06/52] nixos/rspamd: Preserve runtime directory when using socket activation (cherry picked from commit 458bcc8f7a95874afc21cc58ddef6e87d9924d5a) --- nixos/modules/services/mail/rspamd.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/mail/rspamd.nix b/nixos/modules/services/mail/rspamd.nix index b3dae60c2c7e..5ecdd3ef6cf4 100644 --- a/nixos/modules/services/mail/rspamd.nix +++ b/nixos/modules/services/mail/rspamd.nix @@ -308,6 +308,7 @@ in ExecStart = "${pkgs.rspamd}/bin/rspamd ${optionalString cfg.debug "-d"} --user=${cfg.user} --group=${cfg.group} --pid=/run/rspamd.pid -c ${rspamdConfFile} -f"; Restart = "always"; RuntimeDirectory = "rspamd"; + RuntimeDirectoryPreserve = mkIf cfg.socketActivation true; PrivateTmp = true; Sockets = mkIf cfg.socketActivation (concatStringsSep " " allSocketNames); }; From 94d12f3e7cc5b02e53f3ed92e34546bb971dfd6c Mon Sep 17 00:00:00 2001 From: John Ericson Date: Thu, 27 Sep 2018 18:27:07 -0400 Subject: [PATCH 07/52] ghcjs-{7.10, 8.0}: Make symmetrical There's no reason other than misleading branch names to prefer one over another. --- .../ghcjs/{ghcjs.patch => 7.10/boot.patch} | 0 .../compilers/ghcjs/7.10/default.nix | 50 +++++++++++++++++++ .../compilers/ghcjs/{ => 7.10}/shims.nix | 0 .../compilers/ghcjs/{ => 7.10}/stage2.nix | 0 .../{ghcjs-head.patch => 8.0/boot.patch} | 0 .../ghcjs/{head.nix => 8.0/default.nix} | 8 +-- .../ghcjs/{head_shims.nix => 8.0/shims.nix} | 0 .../ghcjs/{head_stage2.nix => 8.0/stage2.nix} | 0 pkgs/development/compilers/ghcjs/base.nix | 46 +++-------------- pkgs/development/compilers/ghcjs/default.nix | 5 -- pkgs/top-level/haskell-packages.nix | 4 +- 11 files changed, 62 insertions(+), 51 deletions(-) rename pkgs/development/compilers/ghcjs/{ghcjs.patch => 7.10/boot.patch} (100%) create mode 100644 pkgs/development/compilers/ghcjs/7.10/default.nix rename pkgs/development/compilers/ghcjs/{ => 7.10}/shims.nix (100%) rename pkgs/development/compilers/ghcjs/{ => 7.10}/stage2.nix (100%) rename pkgs/development/compilers/ghcjs/{ghcjs-head.patch => 8.0/boot.patch} (100%) rename pkgs/development/compilers/ghcjs/{head.nix => 8.0/default.nix} (84%) rename pkgs/development/compilers/ghcjs/{head_shims.nix => 8.0/shims.nix} (100%) rename pkgs/development/compilers/ghcjs/{head_stage2.nix => 8.0/stage2.nix} (100%) delete mode 100644 pkgs/development/compilers/ghcjs/default.nix diff --git a/pkgs/development/compilers/ghcjs/ghcjs.patch b/pkgs/development/compilers/ghcjs/7.10/boot.patch similarity index 100% rename from pkgs/development/compilers/ghcjs/ghcjs.patch rename to pkgs/development/compilers/ghcjs/7.10/boot.patch diff --git a/pkgs/development/compilers/ghcjs/7.10/default.nix b/pkgs/development/compilers/ghcjs/7.10/default.nix new file mode 100644 index 000000000000..f18a094aa3cf --- /dev/null +++ b/pkgs/development/compilers/ghcjs/7.10/default.nix @@ -0,0 +1,50 @@ +{ fetchgit, fetchFromGitHub, bootPkgs, cabal-install }: + +bootPkgs.callPackage ../base.nix { + version = "0.2.0"; + + inherit bootPkgs cabal-install; + + ghcjsSrc = fetchFromGitHub { + owner = "ghcjs"; + repo = "ghcjs"; + rev = "689c7753f50353dd05606ed79c51cd5a94d3922a"; + sha256 = "076020a9gjv8ldj5ckm43sbzq9s6c5xj6lpd8v28ybpiama3m6b4"; + }; + ghcjsBootSrc = fetchgit { + url = git://github.com/ghcjs/ghcjs-boot.git; + rev = "8c549931da27ba9e607f77195208ec156c840c8a"; + sha256 = "0yg9bnabja39qysh9pg1335qbvbc0r2mdw6cky94p7kavacndfdv"; + fetchSubmodules = true; + }; + + shims = import ./shims.nix { inherit fetchFromGitHub; }; + stage1Packages = [ + "array" + "base" + "binary" + "bytestring" + "containers" + "deepseq" + "directory" + "filepath" + "ghc-boot" + "ghc-boot-th" + "ghc-prim" + "ghci" + "ghcjs-prim" + "ghcjs-th" + "integer-gmp" + "pretty" + "primitive" + "process" + "rts" + "template-haskell" + "time" + "transformers" + "unix" + ]; + stage2 = import ./stage2.nix; + + patches = [ ./boot.patch ]; +} diff --git a/pkgs/development/compilers/ghcjs/shims.nix b/pkgs/development/compilers/ghcjs/7.10/shims.nix similarity index 100% rename from pkgs/development/compilers/ghcjs/shims.nix rename to pkgs/development/compilers/ghcjs/7.10/shims.nix diff --git a/pkgs/development/compilers/ghcjs/stage2.nix b/pkgs/development/compilers/ghcjs/7.10/stage2.nix similarity index 100% rename from pkgs/development/compilers/ghcjs/stage2.nix rename to pkgs/development/compilers/ghcjs/7.10/stage2.nix diff --git a/pkgs/development/compilers/ghcjs/ghcjs-head.patch b/pkgs/development/compilers/ghcjs/8.0/boot.patch similarity index 100% rename from pkgs/development/compilers/ghcjs/ghcjs-head.patch rename to pkgs/development/compilers/ghcjs/8.0/boot.patch diff --git a/pkgs/development/compilers/ghcjs/head.nix b/pkgs/development/compilers/ghcjs/8.0/default.nix similarity index 84% rename from pkgs/development/compilers/ghcjs/head.nix rename to pkgs/development/compilers/ghcjs/8.0/default.nix index 84eb2d8bd0da..a786f536eb9b 100644 --- a/pkgs/development/compilers/ghcjs/head.nix +++ b/pkgs/development/compilers/ghcjs/8.0/default.nix @@ -1,6 +1,6 @@ { fetchgit, fetchFromGitHub, bootPkgs, cabal-install }: -bootPkgs.callPackage ./base.nix { +bootPkgs.callPackage ../base.nix { version = "0.2.020170323"; inherit bootPkgs cabal-install; @@ -18,7 +18,7 @@ bootPkgs.callPackage ./base.nix { fetchSubmodules = true; }; - shims = import ./head_shims.nix { inherit fetchFromGitHub; }; + shims = import ./shims.nix { inherit fetchFromGitHub; }; stage1Packages = [ "array" "base" @@ -44,7 +44,7 @@ bootPkgs.callPackage ./base.nix { "transformers" "unix" ]; - stage2 = import ./head_stage2.nix; + stage2 = import ./stage2.nix; - patches = [ ./ghcjs-head.patch ]; + patches = [ ./boot.patch ]; } diff --git a/pkgs/development/compilers/ghcjs/head_shims.nix b/pkgs/development/compilers/ghcjs/8.0/shims.nix similarity index 100% rename from pkgs/development/compilers/ghcjs/head_shims.nix rename to pkgs/development/compilers/ghcjs/8.0/shims.nix diff --git a/pkgs/development/compilers/ghcjs/head_stage2.nix b/pkgs/development/compilers/ghcjs/8.0/stage2.nix similarity index 100% rename from pkgs/development/compilers/ghcjs/head_stage2.nix rename to pkgs/development/compilers/ghcjs/8.0/stage2.nix diff --git a/pkgs/development/compilers/ghcjs/base.nix b/pkgs/development/compilers/ghcjs/base.nix index 46e9d8d72bed..34c332d87d91 100644 --- a/pkgs/development/compilers/ghcjs/base.nix +++ b/pkgs/development/compilers/ghcjs/base.nix @@ -37,57 +37,23 @@ , coreutils , libiconv -, version ? "0.2.0" -, ghcjsSrc ? fetchFromGitHub { - owner = "ghcjs"; - repo = "ghcjs"; - rev = "689c7753f50353dd05606ed79c51cd5a94d3922a"; - sha256 = "076020a9gjv8ldj5ckm43sbzq9s6c5xj6lpd8v28ybpiama3m6b4"; - } -, ghcjsBootSrc ? fetchgit { - url = git://github.com/ghcjs/ghcjs-boot.git; - rev = "8c549931da27ba9e607f77195208ec156c840c8a"; - sha256 = "0yg9bnabja39qysh9pg1335qbvbc0r2mdw6cky94p7kavacndfdv"; - fetchSubmodules = true; - } +, version +, ghcjsSrc +, ghcjsBootSrc , ghcjsBoot ? import ./ghcjs-boot.nix { inherit runCommand; src = ghcjsBootSrc; } -, shims ? import ./shims.nix { inherit fetchFromGitHub; } +, shims # This is the list of the Stage 1 packages that are built into a booted ghcjs installation # It can be generated with the command: # nix-shell -p haskell.packages.ghcjs.ghc --command "ghcjs-pkg list | sed -n 's/^ \(.*\)-\([0-9.]*\)$/\1_\2/ p' | sed 's/\./_/g' | sed 's/^\([^_]*\)\(.*\)$/ \"\1\"/'" -, stage1Packages ? [ - "array" - "base" - "binary" - "bytestring" - "containers" - "deepseq" - "directory" - "filepath" - "ghc-boot" - "ghc-boot-th" - "ghc-prim" - "ghci" - "ghcjs-prim" - "ghcjs-th" - "integer-gmp" - "pretty" - "primitive" - "process" - "rts" - "template-haskell" - "time" - "transformers" - "unix" - ] +, stage1Packages , stage2 ? import ./stage2.nix -, patches ? [ ./ghcjs.patch ] +, patches # used for resolving compiler plugins , ghcLibdir ? null diff --git a/pkgs/development/compilers/ghcjs/default.nix b/pkgs/development/compilers/ghcjs/default.nix deleted file mode 100644 index 7f3cc9440015..000000000000 --- a/pkgs/development/compilers/ghcjs/default.nix +++ /dev/null @@ -1,5 +0,0 @@ -{ bootPkgs, cabal-install }: - -bootPkgs.callPackage ./base.nix { - inherit bootPkgs cabal-install; -} diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix index ea5cc8ded1db..69fcc283326d 100644 --- a/pkgs/top-level/haskell-packages.nix +++ b/pkgs/top-level/haskell-packages.nix @@ -80,11 +80,11 @@ in { llvmPackages = pkgs.llvmPackages_5; }; ghcjs = compiler.ghcjs84; - ghcjs710 = packages.ghc7103.callPackage ../development/compilers/ghcjs { + ghcjs710 = packages.ghc7103.callPackage ../development/compilers/ghcjs/7.10 { bootPkgs = packages.ghc7103; inherit (pkgs) cabal-install; }; - ghcjs80 = packages.ghc802.callPackage ../development/compilers/ghcjs/head.nix { + ghcjs80 = packages.ghc802.callPackage ../development/compilers/ghcjs/8.0 { bootPkgs = packages.ghc802; inherit (pkgs) cabal-install; }; From 5ba8458ebde700ea37c9371fb73a6537b438ac7e Mon Sep 17 00:00:00 2001 From: John Ericson Date: Thu, 27 Sep 2018 18:43:59 -0400 Subject: [PATCH 08/52] ghcjs-{7.10, 8.0}: Expose the good `.override` The per-version `default.nix`es just fill in default arguments. It is much more useful to have the `.override` from the inner `callPackage`, for finer control. Converting the outer `callPackage` to a plain import makes the inner one the only one, revealing its `.override`. --- pkgs/top-level/haskell-packages.nix | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix index 69fcc283326d..6bdcaf49af91 100644 --- a/pkgs/top-level/haskell-packages.nix +++ b/pkgs/top-level/haskell-packages.nix @@ -80,13 +80,17 @@ in { llvmPackages = pkgs.llvmPackages_5; }; ghcjs = compiler.ghcjs84; - ghcjs710 = packages.ghc7103.callPackage ../development/compilers/ghcjs/7.10 { + # Use `import` because `callPackage inside`. + ghcjs710 = import ../development/compilers/ghcjs/7.10 { bootPkgs = packages.ghc7103; inherit (pkgs) cabal-install; + inherit (buildPackages) fetchgit fetchFromGitHub; }; - ghcjs80 = packages.ghc802.callPackage ../development/compilers/ghcjs/8.0 { + # `import` on purpose; see above. + ghcjs80 = import ../development/compilers/ghcjs/8.0 { bootPkgs = packages.ghc802; inherit (pkgs) cabal-install; + inherit (buildPackages) fetchgit fetchFromGitHub; }; ghcjs82 = callPackage ../development/compilers/ghcjs-ng { bootPkgs = packages.ghc822; From 0e0cd2fc30d16c565f1781bfbd64913e27ecaf6d Mon Sep 17 00:00:00 2001 From: Sarah Brofeldt Date: Fri, 28 Sep 2018 09:45:22 +0200 Subject: [PATCH 09/52] haskellPackages.term-rewriting: doJailbreak and dontCheck (cherry picked from commit 5c45ca0943b170aa31e917288f1b0aaa9cbb2da1) Backport of #47456 --- pkgs/development/haskell-modules/configuration-common.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix index 75f5d8c2f069..4fced9b8018f 100644 --- a/pkgs/development/haskell-modules/configuration-common.nix +++ b/pkgs/development/haskell-modules/configuration-common.nix @@ -1001,6 +1001,9 @@ self: super: { ''; }); + # https://github.com/haskell-rewriting/term-rewriting/issues/11 + term-rewriting = dontCheck (doJailbreak super.term-rewriting); + # https://github.com/nick8325/twee/pull/1 twee-lib = dontHaddock super.twee-lib; From a7fa8e1aa8e945bb424164e521b35e1d87f4c74c Mon Sep 17 00:00:00 2001 From: Tuomas Tynkkynen Date: Wed, 26 Sep 2018 22:17:14 +0300 Subject: [PATCH 10/52] Add ssh backdoor to VM tests infrastructure. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Thanks to @dezgeg for prototype implementation, I've cleaned it up and added documentation. (cherry picked from commit d6e3db44cf09d04f0a3cd5b7ccb4a5dc3b7bfaa9) Signed-off-by: Domen Kožar --- .../development/debugging-nixos-tests.xml | 36 +++++++++++++++++++ nixos/doc/manual/development/nixos-tests.xml | 1 + nixos/lib/test-driver/Machine.pm | 6 ++-- .../modules/testing/test-instrumentation.nix | 3 +- 4 files changed, 43 insertions(+), 3 deletions(-) create mode 100644 nixos/doc/manual/development/debugging-nixos-tests.xml diff --git a/nixos/doc/manual/development/debugging-nixos-tests.xml b/nixos/doc/manual/development/debugging-nixos-tests.xml new file mode 100644 index 000000000000..0adf1293f7a3 --- /dev/null +++ b/nixos/doc/manual/development/debugging-nixos-tests.xml @@ -0,0 +1,36 @@ +
+ Debugging NixOS tests + + + Tests may fail and infrastructure offers access to inspect machine state. + + + + To prevent test from stopping and cleaning up, insert a sleep command: + + + +$machine->succeed("sleep 84000"); + + + + As soon as machine starts run as root: + + + +nix-shell -p socat --run "socat STDIO,raw,echo=0,escape=0x11 UNIX:/tmp/nix-build-vm-test-run-*.drv-0/vm-state-machine/backdoor" + + + + You may need to find the correct path, replacing /tmp, * or machine. + + + + Press "enter" to open up console and login as "root". After you're done, press "ctrl-q" to exit the console. + + +
diff --git a/nixos/doc/manual/development/nixos-tests.xml b/nixos/doc/manual/development/nixos-tests.xml index 2695082e3867..d068887200a9 100644 --- a/nixos/doc/manual/development/nixos-tests.xml +++ b/nixos/doc/manual/development/nixos-tests.xml @@ -16,4 +16,5 @@ xlink:href="https://github.com/NixOS/nixpkgs/tree/master/nixos/tests">nixos/test + diff --git a/nixos/lib/test-driver/Machine.pm b/nixos/lib/test-driver/Machine.pm index b18f48464cee..a00fe25c2b8e 100644 --- a/nixos/lib/test-driver/Machine.pm +++ b/nixos/lib/test-driver/Machine.pm @@ -155,8 +155,10 @@ sub start { $ENV{USE_TMPDIR} = 1; $ENV{QEMU_OPTS} = ($self->{allowReboot} ? "" : "-no-reboot ") . - "-monitor unix:./monitor -chardev socket,id=shell,path=./shell " . - "-device virtio-serial -device virtconsole,chardev=shell " . + "-monitor unix:./monitor " . + "-chardev socket,id=shell,path=./shell -device virtio-serial -device virtconsole,chardev=shell " . + # socket backdoor, see "Debugging NixOS tests" section in NixOS manual + "-chardev socket,id=backdoor,path=./backdoor,server,nowait -device virtio-serial -device virtconsole,chardev=backdoor " . "-device virtio-rng-pci " . ($showGraphics ? "-serial stdio" : "-nographic") . " " . ($ENV{QEMU_OPTS} || ""); chdir $self->{stateDir} or die; diff --git a/nixos/modules/testing/test-instrumentation.nix b/nixos/modules/testing/test-instrumentation.nix index ed4cfa7805e2..aa0db4afd978 100644 --- a/nixos/modules/testing/test-instrumentation.nix +++ b/nixos/modules/testing/test-instrumentation.nix @@ -55,7 +55,8 @@ with import ../../lib/qemu-flags.nix { inherit pkgs; }; systemd.services."serial-getty@hvc0".enable = false; # Only use a serial console, no TTY. - virtualisation.qemu.consoles = [ qemuSerialDevice ]; + # hvc1: socket backdoor, see "Debugging NixOS tests" section in NixOS manual + virtualisation.qemu.consoles = [ "hvc1" qemuSerialDevice ]; boot.initrd.preDeviceCommands = '' From 0c29a5146782451e5b51e76bfac0eba68d2f221e Mon Sep 17 00:00:00 2001 From: xeji <36407913+xeji@users.noreply.github.com> Date: Fri, 28 Sep 2018 11:52:39 +0200 Subject: [PATCH 11/52] linuxPackages.jool: 3.5.7 -> unstable-20180706 (#47284) 3.5.7 doesn't build with kernel 4.14.71. Needs most recent upstream revision to build, which supports kernels up to 4.17. (cherry picked from commit f0e4b31eb2035dfbbb6cb419584141f709579969) --- pkgs/os-specific/linux/jool/default.nix | 2 +- pkgs/os-specific/linux/jool/source.nix | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/os-specific/linux/jool/default.nix b/pkgs/os-specific/linux/jool/default.nix index 84a621e7f120..d65be175fc1d 100644 --- a/pkgs/os-specific/linux/jool/default.nix +++ b/pkgs/os-specific/linux/jool/default.nix @@ -1,6 +1,6 @@ { stdenv, fetchFromGitHub, kernel }: -assert stdenv.lib.versionOlder kernel.version "4.17"; +assert stdenv.lib.versionOlder kernel.version "4.18"; let sourceAttrs = (import ./source.nix) { inherit fetchFromGitHub; }; diff --git a/pkgs/os-specific/linux/jool/source.nix b/pkgs/os-specific/linux/jool/source.nix index f15b91f9f142..24134b8b8182 100644 --- a/pkgs/os-specific/linux/jool/source.nix +++ b/pkgs/os-specific/linux/jool/source.nix @@ -1,11 +1,11 @@ { fetchFromGitHub }: rec { - version = "3.5.7"; + version = "unstable-20180706"; src = fetchFromGitHub { owner = "NICMx"; repo = "Jool"; - rev = "v${version}"; - sha256 = "1qxhrchhm4lbyxkp6wm47a85aa4d9wlyy3kdijl8rarngvh8j1yx"; + rev = "de791931d94e972c36bb3c102a9cadab5230c285"; + sha256 = "09mr7lc9k17znpslsfmndx4vgl240llcgblxm92fizmwz23y1d6c"; }; } From 1e1821c1664f8e9943431832cc9a1169c5bcaa75 Mon Sep 17 00:00:00 2001 From: Orivej Desh Date: Fri, 28 Sep 2018 09:57:26 +0000 Subject: [PATCH 12/52] retroshare: mark as broken (#47350) Broken by libupnp: 1.6.21 -> 1.8.3 (#41684). (cherry picked from commit eeac44c81a4408b022839f955f8ec2ec5f49c2d1) --- pkgs/applications/networking/p2p/retroshare/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/applications/networking/p2p/retroshare/default.nix b/pkgs/applications/networking/p2p/retroshare/default.nix index 34b4780633b8..2d523cc07dd9 100644 --- a/pkgs/applications/networking/p2p/retroshare/default.nix +++ b/pkgs/applications/networking/p2p/retroshare/default.nix @@ -54,5 +54,6 @@ stdenv.mkDerivation rec { license = licenses.gpl2Plus; platforms = platforms.linux; maintainers = [ maintainers.domenkozar ]; + broken = true; # broken by libupnp: 1.6.21 -> 1.8.3 (#41684) }; } From 1e9f50f1569a9c73afeed29c023b727057b7cd67 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Thu, 27 Sep 2018 21:46:31 +0100 Subject: [PATCH 13/52] systemd: don't restart user-runtime-dir@ on upgrades Likewise logind we should not try to restart this service after upgrade, the user's current session depends on it. (cherry picked from commit aa69bb5743069f62204433aaa493861bea53755f) --- nixos/modules/system/boot/systemd.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index 12e029ae57f8..3ac4c02b61f5 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -886,6 +886,9 @@ in #systemd.services.systemd-logind.restartTriggers = [ config.environment.etc."systemd/logind.conf".source ]; systemd.services.systemd-logind.restartIfChanged = false; systemd.services.systemd-logind.stopIfChanged = false; + # The user-runtime-dir@ service is managed by systemd-logind we should not touch it or else we break the users' sessions. + systemd.services."user-runtime-dir@".stopIfChanged = false; + systemd.services."user-runtime-dir@".restartIfChanged = false; systemd.services.systemd-journald.restartTriggers = [ config.environment.etc."systemd/journald.conf".source ]; systemd.services.systemd-journald.stopIfChanged = false; systemd.targets.local-fs.unitConfig.X-StopOnReconfiguration = true; From d892f1aa90c3a22016d78e3bedefa773dc66879a Mon Sep 17 00:00:00 2001 From: John Ericson Date: Fri, 28 Sep 2018 12:06:31 -0400 Subject: [PATCH 14/52] ghcjs-*: Expose the version of GHC used This is more meaningful than the GHCJS version for most tasks. --- pkgs/development/compilers/ghcjs-ng/default.nix | 1 + pkgs/development/compilers/ghcjs/base.nix | 1 + 2 files changed, 2 insertions(+) diff --git a/pkgs/development/compilers/ghcjs-ng/default.nix b/pkgs/development/compilers/ghcjs-ng/default.nix index 92211042acd9..025d74bcda04 100644 --- a/pkgs/development/compilers/ghcjs-ng/default.nix +++ b/pkgs/development/compilers/ghcjs-ng/default.nix @@ -42,6 +42,7 @@ let targetPrefix = ""; inherit bootGhcjs; inherit (bootGhcjs) version; + ghcVersion = bootPkgs.ghc.version; isGhcjs = true; enableShared = true; diff --git a/pkgs/development/compilers/ghcjs/base.nix b/pkgs/development/compilers/ghcjs/base.nix index 34c332d87d91..93e6a47934fc 100644 --- a/pkgs/development/compilers/ghcjs/base.nix +++ b/pkgs/development/compilers/ghcjs/base.nix @@ -133,6 +133,7 @@ in mkDerivation (rec { ''; passthru = { inherit bootPkgs; + ghcVersion = ghc.version; isCross = true; isGhcjs = true; inherit nodejs ghcjsBoot; From 3108f741fe671905cf66c046556ead8429b6204f Mon Sep 17 00:00:00 2001 From: Brian Olsen Date: Fri, 28 Sep 2018 04:00:24 +0200 Subject: [PATCH 15/52] nixos/rspamd: Remove non-working socket activation The socket activation I added to the rspamd module doesn't actually work and can't be made to work without changes to rspamd. See: #47421 See: rspamd/rspamd#2035 (cherry picked from commit 783a58f363fd1ccfa1817ed3f030eaef59cfde9d) --- nixos/modules/services/mail/rspamd.nix | 82 ++------------------------ nixos/tests/rspamd.nix | 54 ++--------------- 2 files changed, 10 insertions(+), 126 deletions(-) diff --git a/nixos/modules/services/mail/rspamd.nix b/nixos/modules/services/mail/rspamd.nix index 5ecdd3ef6cf4..bba11796a3d3 100644 --- a/nixos/modules/services/mail/rspamd.nix +++ b/nixos/modules/services/mail/rspamd.nix @@ -115,36 +115,10 @@ let }; }; - indexOf = default: start: list: e: - if list == [] - then default - else if (head list) == e then start - else (indexOf default (start + (length (listenStreams (head list).socket))) (tail list) e); - - systemdSocket = indexOf (abort "Socket not found") 0 allSockets; - isUnixSocket = socket: hasPrefix "/" (if (isString socket) then socket else socket.socket); - isPort = hasPrefix "*:"; - isIPv4Socket = hasPrefix "*v4:"; - isIPv6Socket = hasPrefix "*v6:"; - isLocalHost = hasPrefix "localhost:"; - listenStreams = socket: - if (isLocalHost socket) then - let port = (removePrefix "localhost:" socket); - in [ "127.0.0.1:${port}" ] ++ (if config.networking.enableIPv6 then ["[::1]:${port}"] else []) - else if (isIPv6Socket socket) then [removePrefix "*v6:" socket] - else if (isPort socket) then [removePrefix "*:" socket] - else if (isIPv4Socket socket) then - throw "error: IPv4 only socket not supported in rspamd with socket activation" - else if (length (splitString " " socket)) != 1 then - throw "error: string options not supported in rspamd with socket activation" - else [socket]; - mkBindSockets = enabled: socks: concatStringsSep "\n " (flatten (map (each: - if cfg.socketActivation && enabled != false then - let systemd = (systemdSocket each); - in (imap (idx: e: "bind_socket = \"systemd:${toString (systemd + idx - 1)}\";") (listenStreams each.socket)) - else "bind_socket = \"${each.rawEntry}\";") socks)); + mkBindSockets = enabled: socks: concatStringsSep "\n " + (flatten (map (each: "bind_socket = \"${each.rawEntry}\";") socks)); rspamdConfFile = pkgs.writeText "rspamd.conf" '' @@ -175,18 +149,6 @@ let ${cfg.extraConfig} ''; - allMappedSockets = flatten (mapAttrsToList (name: value: - if value.enable != false - then imap (idx: each: { - name = "${name}"; - index = idx; - value = each; - }) value.bindSockets - else []) cfg.workers); - allSockets = map (e: e.value) allMappedSockets; - - allSocketNames = map (each: "rspamd-${each.name}-${toString each.index}.socket") allMappedSockets; - in { @@ -205,13 +167,6 @@ in description = "Whether to run the rspamd daemon in debug mode."; }; - socketActivation = mkOption { - type = types.bool; - description = '' - Enable systemd socket activation for rspamd. - ''; - }; - workers = mkOption { type = with types; attrsOf (submodule workerOpts); description = '' @@ -272,13 +227,6 @@ in config = mkIf cfg.enable { - services.rspamd.socketActivation = mkDefault (!opts.bindSocket.isDefined && !opts.bindUISocket.isDefined); - - assertions = [ { - assertion = !cfg.socketActivation || !(opts.bindSocket.isDefined || opts.bindUISocket.isDefined); - message = "Can't use socketActivation for rspamd when using renamed bind socket options"; - } ]; - # Allow users to run 'rspamc' and 'rspamadm'. environment.systemPackages = [ pkgs.rspamd ]; @@ -299,18 +247,14 @@ in systemd.services.rspamd = { description = "Rspamd Service"; - wantedBy = mkIf (!cfg.socketActivation) [ "multi-user.target" ]; - after = [ "network.target" ] ++ - (if cfg.socketActivation then allSocketNames else []); - requires = mkIf cfg.socketActivation allSocketNames; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; serviceConfig = { ExecStart = "${pkgs.rspamd}/bin/rspamd ${optionalString cfg.debug "-d"} --user=${cfg.user} --group=${cfg.group} --pid=/run/rspamd.pid -c ${rspamdConfFile} -f"; Restart = "always"; RuntimeDirectory = "rspamd"; - RuntimeDirectoryPreserve = mkIf cfg.socketActivation true; PrivateTmp = true; - Sockets = mkIf cfg.socketActivation (concatStringsSep " " allSocketNames); }; preStart = '' @@ -318,24 +262,10 @@ in ${pkgs.coreutils}/bin/chown ${cfg.user}:${cfg.group} /var/lib/rspamd ''; }; - systemd.sockets = mkIf cfg.socketActivation - (listToAttrs (map (each: { - name = "rspamd-${each.name}-${toString each.index}"; - value = { - description = "Rspamd socket ${toString each.index} for worker ${each.name}"; - wantedBy = [ "sockets.target" ]; - listenStreams = (listenStreams each.value.socket); - socketConfig = { - BindIPv6Only = mkIf (isIPv6Socket each.value.socket) "ipv6-only"; - Service = "rspamd.service"; - SocketUser = mkIf (isUnixSocket each.value.socket) each.value.owner; - SocketGroup = mkIf (isUnixSocket each.value.socket) each.value.group; - SocketMode = mkIf (isUnixSocket each.value.socket) each.value.mode; - }; - }; - }) allMappedSockets)); }; imports = [ + (mkRemovedOptionModule [ "services" "rspamd" "socketActivation" ] + "Socket activation never worked correctly and could at this time not be fixed and so was removed") (mkRenamedOptionModule [ "services" "rspamd" "bindSocket" ] [ "services" "rspamd" "workers" "normal" "bindSockets" ]) (mkRenamedOptionModule [ "services" "rspamd" "bindUISocket" ] [ "services" "rspamd" "workers" "controller" "bindSockets" ]) ]; diff --git a/nixos/tests/rspamd.nix b/nixos/tests/rspamd.nix index 6b2e2dd3a531..a12622b6aa0b 100644 --- a/nixos/tests/rspamd.nix +++ b/nixos/tests/rspamd.nix @@ -13,13 +13,10 @@ let $machine->succeed("[[ \"\$(stat -c %G ${socket})\" == \"${group}\" ]]"); $machine->succeed("[[ \"\$(stat -c %a ${socket})\" == \"${mode}\" ]]"); ''; - simple = name: socketActivation: enableIPv6: makeTest { + simple = name: enableIPv6: makeTest { name = "rspamd-${name}"; machine = { - services.rspamd = { - enable = true; - socketActivation = socketActivation; - }; + services.rspamd.enable = true; networking.enableIPv6 = enableIPv6; }; testScript = '' @@ -32,13 +29,6 @@ let sleep 10; $machine->log($machine->succeed("cat /etc/rspamd.conf")); $machine->log($machine->succeed("systemctl cat rspamd.service")); - ${if socketActivation then '' - $machine->log($machine->succeed("systemctl cat rspamd-controller-1.socket")); - $machine->log($machine->succeed("systemctl cat rspamd-normal-1.socket")); - '' else '' - $machine->fail("systemctl cat rspamd-controller-1.socket"); - $machine->fail("systemctl cat rspamd-normal-1.socket"); - ''} $machine->log($machine->succeed("curl http://localhost:11334/auth")); $machine->log($machine->succeed("curl http://127.0.0.1:11334/auth")); ${optionalString enableIPv6 '' @@ -48,10 +38,8 @@ let }; in { - simple = simple "simple" false true; - ipv4only = simple "ipv4only" false false; - simple-socketActivated = simple "simple-socketActivated" true true; - ipv4only-socketActivated = simple "ipv4only-socketActivated" true false; + simple = simple "simple" true; + ipv4only = simple "ipv4only" false; deprecated = makeTest { name = "rspamd-deprecated"; machine = { @@ -68,7 +56,6 @@ in ${checkSocket "/run/rspamd.sock" "root" "root" "600" } ${checkSocket "/run/rspamd-worker.sock" "root" "root" "666" } $machine->log($machine->succeed("cat /etc/rspamd.conf")); - $machine->fail("systemctl cat rspamd-normal-1.socket"); $machine->log($machine->succeed("rspamc -h /run/rspamd-worker.sock stat")); $machine->log($machine->succeed("curl --unix-socket /run/rspamd-worker.sock http://localhost/ping")); ''; @@ -79,7 +66,6 @@ in machine = { services.rspamd = { enable = true; - socketActivation = false; workers.normal.bindSockets = [{ socket = "/run/rspamd.sock"; mode = "0600"; @@ -101,38 +87,6 @@ in ${checkSocket "/run/rspamd.sock" "root" "root" "600" } ${checkSocket "/run/rspamd-worker.sock" "root" "root" "666" } $machine->log($machine->succeed("cat /etc/rspamd.conf")); - $machine->fail("systemctl cat rspamd-normal-1.socket"); - $machine->log($machine->succeed("rspamc -h /run/rspamd-worker.sock stat")); - $machine->log($machine->succeed("curl --unix-socket /run/rspamd-worker.sock http://localhost/ping")); - ''; - }; - socketActivated = makeTest { - name = "rspamd-socketActivated"; - machine = { - services.rspamd = { - enable = true; - workers.normal.bindSockets = [{ - socket = "/run/rspamd.sock"; - mode = "0600"; - owner = "root"; - group = "root"; - }]; - workers.controller.bindSockets = [{ - socket = "/run/rspamd-worker.sock"; - mode = "0666"; - owner = "root"; - group = "root"; - }]; - }; - }; - - testScript = '' - startAll - $machine->waitForFile("/run/rspamd.sock"); - ${checkSocket "/run/rspamd.sock" "root" "root" "600" } - ${checkSocket "/run/rspamd-worker.sock" "root" "root" "666" } - $machine->log($machine->succeed("cat /etc/rspamd.conf")); - $machine->log($machine->succeed("systemctl cat rspamd-normal-1.socket")); $machine->log($machine->succeed("rspamc -h /run/rspamd-worker.sock stat")); $machine->log($machine->succeed("curl --unix-socket /run/rspamd-worker.sock http://localhost/ping")); ''; From c1f9ffc740ebfe44562d79bdc701974dcf5dd7f1 Mon Sep 17 00:00:00 2001 From: Daiderd Jordan Date: Sat, 22 Sep 2018 22:55:58 +0200 Subject: [PATCH 16/52] fox: mark broken on darwin Undefined symbols for architecture x86_64: "_MPCreateSemaphore", referenced from: FX::FXSemaphore::FXSemaphore(int) in FXThread.o FX::FXSemaphore::FXSemaphore(int) in FXThread.o "_MPDeleteSemaphore", referenced from: FX::FXSemaphore::~FXSemaphore() in FXThread.o FX::FXSemaphore::~FXSemaphore() in FXThread.o "_MPSignalSemaphore", referenced from: FX::FXSemaphore::post() in FXThread.o "_MPWaitOnSemaphore", referenced from: FX::FXSemaphore::wait() in FXThread.o FX::FXSemaphore::trywait() in FXThread.o ld: symbol(s) not found for architecture x86_64 /cc ZHF #45961 (cherry picked from commit 6390b8b63e623d83558ff97102cd8a21ed99dd75) --- pkgs/development/libraries/fox/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/development/libraries/fox/default.nix b/pkgs/development/libraries/fox/default.nix index 8dd78c41b14a..40430f34334c 100644 --- a/pkgs/development/libraries/fox/default.nix +++ b/pkgs/development/libraries/fox/default.nix @@ -32,6 +32,7 @@ stdenv.mkDerivation rec { homepage = http://fox-toolkit.org; license = licenses.lgpl3; maintainers = []; + broken = stdenv.isDarwin; platforms = platforms.all; }; } From e087e2023961266f33a521ad17345c4911864a2f Mon Sep 17 00:00:00 2001 From: Daiderd Jordan Date: Sat, 22 Sep 2018 23:13:43 +0200 Subject: [PATCH 17/52] flpsed: mark linux only Doesn't build on darwin and probably other platforms. GsWidget.H:26:3: error: 'Atom' does not name a type; did you mean 'tm'? Atom atoms[5]; ^~~~ tm GsWidget.cxx: In member function 'void GsWidget::setProps()': GsWidget.cxx:47:2: error: 'atoms' was not declared in this scope atoms[0] = XInternAtom(fl_display,"GHOSTVIEW" , false); ^~~~~ /cc ZHF #45961 (cherry picked from commit cd78d0cc3ff97924bbc810b025fc0833e2b71916) --- pkgs/applications/editors/flpsed/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/editors/flpsed/default.nix b/pkgs/applications/editors/flpsed/default.nix index 67f789eee782..1c40b509bfe4 100644 --- a/pkgs/applications/editors/flpsed/default.nix +++ b/pkgs/applications/editors/flpsed/default.nix @@ -1,4 +1,4 @@ -{stdenv, fetchurl, fltk13, ghostscript}: +{ stdenv, fetchurl, fltk13, ghostscript, xlibs }: stdenv.mkDerivation rec { name = "flpsed-${version}"; @@ -21,7 +21,7 @@ stdenv.mkDerivation rec { description = "WYSIWYG PostScript annotator"; homepage = http://flpsed.org/flpsed.html; license = licenses.gpl3; - platforms = platforms.mesaPlatforms; + platforms = platforms.linux; maintainers = with maintainers; [ fuuzetsu ]; }; } From f5db056efd08680810ed25ddf58e4cb1a426b94a Mon Sep 17 00:00:00 2001 From: Daiderd Jordan Date: Tue, 25 Sep 2018 22:33:03 +0200 Subject: [PATCH 18/52] freedroidrpg: don't build on hydra Similar to some other builds, sdl-config gets stuck and times out. checking for sdl-config... /nix/store/q2hm1ka0qxs2gv5bmrxj7j80lygk4b5z-SDL-1.2.15-dev/bin/sdl-config building of '/nix/store/m2d7v0n5hd2498vfxp18i37p7r1lf76p-freedroidrpg-0.16.1' timed out after 7200 seconds of silence /cc ZHF #45961 (cherry picked from commit 9b9981928325f1c19b9b65291aa0c29d35ae7e11) --- pkgs/games/freedroidrpg/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/games/freedroidrpg/default.nix b/pkgs/games/freedroidrpg/default.nix index 875af8e06642..2ebb60f3d5db 100644 --- a/pkgs/games/freedroidrpg/default.nix +++ b/pkgs/games/freedroidrpg/default.nix @@ -58,5 +58,6 @@ in stdenv.mkDerivation rec { maintainers = with maintainers; [ jtojnar ]; platforms = platforms.unix; + hydraPlatforms = platforms.linux; # sdl-config times out on darwin }; } From c922e20b5d39e2c623e8ca0e462d2efe938a0d87 Mon Sep 17 00:00:00 2001 From: symphorien Date: Fri, 28 Sep 2018 22:15:53 +0000 Subject: [PATCH 19/52] exempi: patch CVE-2018-12648, enable tests on linux (#47496) (cherry picked from commit e502c72773e559a9453086d48943e64074406094) --- pkgs/development/libraries/exempi/default.nix | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/pkgs/development/libraries/exempi/default.nix b/pkgs/development/libraries/exempi/default.nix index ac2c21d4cf0e..3bc5270f0537 100644 --- a/pkgs/development/libraries/exempi/default.nix +++ b/pkgs/development/libraries/exempi/default.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchurl, expat, zlib, boost, libiconv, darwin }: +{ stdenv, fetchurl, fetchpatch, expat, zlib, boost, libiconv, darwin }: stdenv.mkDerivation rec { name = "exempi-2.4.5"; @@ -8,6 +8,17 @@ stdenv.mkDerivation rec { sha256 = "07i29xmg8bqriviaf4vi1mwha4lrw85kfla29cfym14fp3z8aqa0"; }; + patches = [ + # CVE-2018-12648 + # https://gitlab.freedesktop.org/libopenraw/exempi/issues/9 + # remove with exempi > 2.4.5 + (fetchpatch { + name = "CVE-2018-12648.patch"; + url = https://gitlab.freedesktop.org/libopenraw/exempi/commit/8ed2f034705fd2d032c81383eee8208fd4eee0ac.patch; + sha256 = "1nh8irk5p26868875wq5n8g92xp4crfb8fdd8gyna76ldyzqqx9q"; + }) + ]; + configureFlags = [ "--with-boost=${boost.dev}" ]; @@ -15,6 +26,8 @@ stdenv.mkDerivation rec { buildInputs = [ expat zlib boost ] ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.CoreServices ]; + doCheck = stdenv.isLinux; + meta = with stdenv.lib; { homepage = https://libopenraw.freedesktop.org/wiki/Exempi/; platforms = platforms.linux ++ platforms.darwin; From 56591a244e62058cd856cdb257468517fcfe2262 Mon Sep 17 00:00:00 2001 From: "Wael M. Nasreddine" Date: Fri, 28 Sep 2018 15:32:02 -0700 Subject: [PATCH 20/52] browsh: 1.4.10 -> 1.4.13 (cherry picked from commit fa46ce38286c36cd8d5c840ba1baebbdc567568a) Backport of #47501 --- pkgs/applications/networking/browsers/browsh/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/browsers/browsh/default.nix b/pkgs/applications/networking/browsers/browsh/default.nix index cf90d2afd000..a910f1d14bdf 100644 --- a/pkgs/applications/networking/browsers/browsh/default.nix +++ b/pkgs/applications/networking/browsers/browsh/default.nix @@ -1,14 +1,14 @@ { stdenv, buildGoPackage, fetchurl, fetchFromGitHub, go-bindata }: let - version = "1.4.10"; + version = "1.4.13"; # TODO: must build the extension instead of downloading it. But since it's # literally an asset that is indifferent regardless of the platform, this # might be just enough. webext = fetchurl { url = "https://github.com/browsh-org/browsh/releases/download/v${version}/browsh-${version}-an.fx.xpi"; - sha256 = "0rgwzv1qahqy52q7zz4dklnwx7w4x3gj92ka8n0ypgf9fjjnmqas"; + sha256 = "11477z7mva8lwfxsrfxckvgqkxrjhc80czra8cqhpakf0fih1a4g"; }; in buildGoPackage rec { From 6c68068a52d12818c471f9901a58e2d5f53420e3 Mon Sep 17 00:00:00 2001 From: Tom Bereknyei Date: Fri, 28 Sep 2018 14:14:32 -0400 Subject: [PATCH 21/52] gnuradio: 3.7.13.3 -> 3.7.13.4 (cherry picked from commit a054f269bf67b77492b5bf5ed526009ec3f2743a) Backport of #47491 --- pkgs/applications/misc/gnuradio/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/misc/gnuradio/default.nix b/pkgs/applications/misc/gnuradio/default.nix index 0224d5fd68c7..a7c00cceaa72 100644 --- a/pkgs/applications/misc/gnuradio/default.nix +++ b/pkgs/applications/misc/gnuradio/default.nix @@ -26,13 +26,13 @@ stdenv.mkDerivation rec { name = "gnuradio-${version}"; - version = "3.7.13.3"; + version = "3.7.13.4"; src = fetchFromGitHub { owner = "gnuradio"; repo = "gnuradio"; rev = "v${version}"; - sha256 = "1qpa53axqavdv2ykby7rwh7xmhvv964xq1d7rcvbwkry7dngrbib"; + sha256 = "0ybfn2zfr9lc1bi3c794l4bzpj8y6vas9c4rbcj4nqlx0zf3p8fn"; fetchSubmodules = true; }; From fe195c03edf26a28af99ea0a2229486ac03eb489 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Sun, 23 Sep 2018 10:52:40 +0200 Subject: [PATCH 22/52] Merge #45683: nvidia_x11: 390.77 -> 390.87 (cherry picked from commit d9f7d27ef54188158311fb787c273afd7d8e5f12) --- pkgs/os-specific/linux/nvidia-x11/default.nix | 12 ++++++---- .../linux/nvidia-x11/drm_mode_connector.patch | 24 +++++++++++++++++++ 2 files changed, 31 insertions(+), 5 deletions(-) create mode 100644 pkgs/os-specific/linux/nvidia-x11/drm_mode_connector.patch diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix index 16bab9979d03..d9ff157e1429 100644 --- a/pkgs/os-specific/linux/nvidia-x11/default.nix +++ b/pkgs/os-specific/linux/nvidia-x11/default.nix @@ -17,11 +17,13 @@ in rec { # Policy: use the highest stable version as the default (on our master). stable = generic { - version = "390.77"; - sha256_32bit = "1yd313ghh2qbn07d5wbkshfwgkm4mh49vcqkydds3b3xk0mx4i8l"; - sha256_64bit = "10kjccrkdn360035lh985cadhwy6lk9xrw3wlmww2wqfaa25f775"; - settingsSha256 = "1wvxldpjkrx0ldjm5l6ycm6paxpcw89h0n6hfkznfkahkq7fwxdj"; - persistencedSha256 = "1gklmc0v17m018cwpdlzwdyd45y4sjvjhj8a3l44baygix5zn30f"; + version = "390.87"; + sha256_32bit = "0rlr1f4lnpb8c4qz4w5r8xw5gdy9bzz26qww45qyl1qav3wwaaaw"; + sha256_64bit = "07k1kq8lkgbvjyr2dnbxcz6nppcwpq17wf925w8kfq78345hla9q"; + settingsSha256 = "0xlaiy7jr95z0v2c6cwll89nxnb142pybw7m08jg44r7n13ffv3r"; + persistencedSha256 = "0mhwk321garyl6m12261cj03ycv0qz1sbrlbq6cqwjpq4f1s7h58"; + + patches = lib.optional (kernel.meta.branch == "4.19") ./drm_mode_connector.patch; }; beta = stable; # not enough interest to maintain beta ATM diff --git a/pkgs/os-specific/linux/nvidia-x11/drm_mode_connector.patch b/pkgs/os-specific/linux/nvidia-x11/drm_mode_connector.patch new file mode 100644 index 000000000000..58cf06fae45f --- /dev/null +++ b/pkgs/os-specific/linux/nvidia-x11/drm_mode_connector.patch @@ -0,0 +1,24 @@ +diff -ura a/kernel/nvidia-drm/nvidia-drm-connector.c b/kernel/nvidia-drm/nvidia-drm-connector.c +--- a/kernel/nvidia-drm/nvidia-drm-connector.c 2018-09-07 17:38:31.807453997 -0400 ++++ b/kernel/nvidia-drm/nvidia-drm-connector.c 2018-09-07 17:39:22.446185824 -0400 +@@ -226,7 +226,7 @@ + + + if (nv_connector->edid != NULL) { +- drm_mode_connector_update_edid_property( ++ drm_connector_update_edid_property( + connector, nv_connector->edid); + } + +diff -ura a/kernel/nvidia-drm/nvidia-drm-encoder.c b/kernel/nvidia-drm/nvidia-drm-encoder.c +--- a/kernel/nvidia-drm/nvidia-drm-encoder.c 2018-09-07 17:38:31.807453997 -0400 ++++ b/kernel/nvidia-drm/nvidia-drm-encoder.c 2018-09-07 17:39:35.083798484 -0400 +@@ -216,7 +216,7 @@ + + /* Attach encoder and connector */ + +- ret = drm_mode_connector_attach_encoder(connector, encoder); ++ ret = drm_connector_attach_encoder(connector, encoder); + + if (ret != 0) { + NV_DRM_DEV_LOG_ERR( From b72abcf86153a51c3832b63d3ab05159f1deec1c Mon Sep 17 00:00:00 2001 From: Arian van Putten Date: Fri, 28 Sep 2018 11:25:32 +0200 Subject: [PATCH 23/52] doc: Update section about imperative containers Nix commands inside the container have been broken since 18.03, and no fix is yet in sight. Lets remove from the documentation that this is a usecase that we support, as it doesn't seem likely that this will be fixed before 18.09 either. See #40355 (cherry picked from commit f309440ee3b6830fd886f824be81b0fecfba52fc) --- .../administration/imperative-containers.xml | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/nixos/doc/manual/administration/imperative-containers.xml b/nixos/doc/manual/administration/imperative-containers.xml index 9bb62bc2ece9..cfd0e5c172b1 100644 --- a/nixos/doc/manual/administration/imperative-containers.xml +++ b/nixos/doc/manual/administration/imperative-containers.xml @@ -73,8 +73,7 @@ Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux - There are several ways to change the configuration of the container. First, - on the host, you can edit + To change the configuration of the container, you can edit /var/lib/container/name/etc/nixos/configuration.nix, and run @@ -87,7 +86,16 @@ Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux = true; = "foo@example.org"; = [ 80 ]; -' + ' + + + Note that in previous versions of NixOS (17.09 and earlier) one could + also use all nix-related commands (like nixos-rebuild switch) + from inside the container. However, since the release of Nix 2.0 this + is not supported anymore. Supporting Nix commands inside the + container might be possible again in future versions. See + the github issue for tracking progress on this issue. + # curl http://$(nixos-container show-ip foo)/ <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">… @@ -96,14 +104,6 @@ Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux /etc/nixos/configuration.nix. - - Alternatively, you can change the configuration from within the container - itself by running nixos-rebuild switch inside the - container. Note that the container by default does not have a copy of the - NixOS channel, so you should run nix-channel --update - first. - - Containers can be stopped and started using nixos-container stop and nixos-container start, respectively, or From 1d5b7a7d4204f25ab2cd9869e1a267ecd04f65c5 Mon Sep 17 00:00:00 2001 From: Tycho Grouwstra Date: Sat, 29 Sep 2018 20:48:28 +0200 Subject: [PATCH 24/52] gitkraken: 4.0.2 -> 4.0.5 (#47512) Fixes #47498. Note that the releases have moved to a new URL; I'm not sure they still host the earlier versions. (cherry picked from commit 9d727e0a913a1a98908d49bdd91105a3b66b530c) backported because previous source url returns 404. --- pkgs/applications/version-management/gitkraken/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/version-management/gitkraken/default.nix b/pkgs/applications/version-management/gitkraken/default.nix index 051ea080fb4e..0fcbe54be175 100644 --- a/pkgs/applications/version-management/gitkraken/default.nix +++ b/pkgs/applications/version-management/gitkraken/default.nix @@ -12,11 +12,11 @@ let in stdenv.mkDerivation rec { name = "gitkraken-${version}"; - version = "4.0.2"; + version = "4.0.5"; src = fetchurl { - url = "https://release.gitkraken.com/linux/v${version}.deb"; - sha256 = "0dnckd75fcgc9wa4ivbnw2djmk4phzzr891snhxpsvb1dhlc7rgx"; + url = "https://release.axocdn.com/linux/GitKraken-v${version}.deb"; + sha256 = "15wxcahlnz2k3331wqv30d5gq38fqh178hv87xky9b9vyh8qpcvz"; }; libPath = makeLibraryPath [ From c2e605e9d1a575b36a27277d9433e9be30e31d4f Mon Sep 17 00:00:00 2001 From: Tim Steinbach Date: Sat, 29 Sep 2018 17:52:31 -0400 Subject: [PATCH 25/52] linux: 4.4.158 -> 4.4.159 (cherry picked from commit 7769fd6a80a5ac8a1ea7d50749eaeae2263cb92e) --- pkgs/os-specific/linux/kernel/linux-4.4.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix index d906700f437e..bafa975b6184 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.4.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix @@ -1,11 +1,11 @@ { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args: buildLinux (args // rec { - version = "4.4.158"; + version = "4.4.159"; extraMeta.branch = "4.4"; src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "1a921xq475y961izkzn8n4ky9s7n4xsvhs9qh664xk5biip8y72p"; + sha256 = "1hivz1pyy4scp4s09ibz36ni4d1pwivizwls5dbh5qjy0pdvn00f"; }; } // (args.argsOverride or {})) From 9bd9306c365bb3875f020a3c0049644633a90eab Mon Sep 17 00:00:00 2001 From: Tim Steinbach Date: Sat, 29 Sep 2018 17:52:51 -0400 Subject: [PATCH 26/52] linux: 4.9.129 -> 4.9.130 (cherry picked from commit 74f56e14d932fa1d964cff5a0f85bda5e0e3cd34) --- pkgs/os-specific/linux/kernel/linux-4.9.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix index d34db0989963..5c4bee036d86 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.9.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix @@ -1,11 +1,11 @@ { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args: buildLinux (args // rec { - version = "4.9.129"; + version = "4.9.130"; extraMeta.branch = "4.9"; src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "064kwdsxzk65mn991cmxqs31i332szf2z3lw5lgbzhgyzk9i0mbg"; + sha256 = "0zqaidirnr3v9xibp04rr2cjww3nd3phg28cgid0s8q0idm3xnv0"; }; } // (args.argsOverride or {})) From 99b696927ad1086598815b2d8ac51f583f0bb6ff Mon Sep 17 00:00:00 2001 From: Tim Steinbach Date: Sat, 29 Sep 2018 17:53:07 -0400 Subject: [PATCH 27/52] linux: 4.14.72 -> 4.14.73 (cherry picked from commit 00e57782bcf0f57ebea3200b51769b2c6f28b599) --- pkgs/os-specific/linux/kernel/linux-4.14.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix index 5decdc14e110..6c1740ea2e43 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.14.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix @@ -3,7 +3,7 @@ with stdenv.lib; buildLinux (args // rec { - version = "4.14.72"; + version = "4.14.73"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "0zsmch2m9drk297n6ck8ja6m5p4fzg87lz8ky3y41g0b4l35k4nz"; + sha256 = "07p3w3p8izgk1d0dblvn9ckk4ay10f40pqbwpzvpsi6c3ha3i7lr"; }; } // (args.argsOverride or {})) From b7cab85b264ab814adabbd296d4cf72d83bc843b Mon Sep 17 00:00:00 2001 From: Tim Steinbach Date: Sat, 29 Sep 2018 17:53:22 -0400 Subject: [PATCH 28/52] linux: 4.18.10 -> 4.18.11 (cherry picked from commit 5eefdebf49b50cda87d5ee958736187a902058d9) --- pkgs/os-specific/linux/kernel/linux-4.18.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-4.18.nix b/pkgs/os-specific/linux/kernel/linux-4.18.nix index 48ae108c48a7..00e8a04f1b9d 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.18.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.18.nix @@ -3,7 +3,7 @@ with stdenv.lib; buildLinux (args // rec { - version = "4.18.10"; + version = "4.18.11"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "1pli16s1vprmrq4cdii93k8rqrxy20a7vs7jf77fgdfaiizlyq0h"; + sha256 = "131chbsavavz2hnjyx1xjvsnxdcr0y02p054n9mdvxfalvsiklrn"; }; } // (args.argsOverride or {})) From 29624f6bb26908128450cfda940d26cddefdc923 Mon Sep 17 00:00:00 2001 From: Tuomas Tynkkynen Date: Sun, 30 Sep 2018 01:02:45 +0300 Subject: [PATCH 29/52] Revert "doc: Update section about imperative containers" This reverts commit b72abcf86153a51c3832b63d3ab05159f1deec1c. Breaks manual build: https://nix-cache.s3.amazonaws.com/log/wnjcy6n5f871bpyy9nd06smiz1ggv99c-nixos-manual-combined.drv --- .../administration/imperative-containers.xml | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/nixos/doc/manual/administration/imperative-containers.xml b/nixos/doc/manual/administration/imperative-containers.xml index cfd0e5c172b1..9bb62bc2ece9 100644 --- a/nixos/doc/manual/administration/imperative-containers.xml +++ b/nixos/doc/manual/administration/imperative-containers.xml @@ -73,7 +73,8 @@ Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux - To change the configuration of the container, you can edit + There are several ways to change the configuration of the container. First, + on the host, you can edit /var/lib/container/name/etc/nixos/configuration.nix, and run @@ -86,16 +87,7 @@ Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux = true; = "foo@example.org"; = [ 80 ]; - ' - - - Note that in previous versions of NixOS (17.09 and earlier) one could - also use all nix-related commands (like nixos-rebuild switch) - from inside the container. However, since the release of Nix 2.0 this - is not supported anymore. Supporting Nix commands inside the - container might be possible again in future versions. See - the github issue for tracking progress on this issue. - +' # curl http://$(nixos-container show-ip foo)/ <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">… @@ -104,6 +96,14 @@ Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux /etc/nixos/configuration.nix. + + Alternatively, you can change the configuration from within the container + itself by running nixos-rebuild switch inside the + container. Note that the container by default does not have a copy of the + NixOS channel, so you should run nix-channel --update + first. + + Containers can be stopped and started using nixos-container stop and nixos-container start, respectively, or From 6b1ebeb5eb70d9e673a82d30a7624e4be6d6f016 Mon Sep 17 00:00:00 2001 From: Tuomas Tynkkynen Date: Mon, 3 Sep 2018 21:09:27 +0300 Subject: [PATCH 30/52] systemd: Replace meta.available checks This sort of code breaks config.{allowBroken, allowUnsupportedSystem} = true by making them do unpredictable things. (cherry picked from commit fe7919f7a135788f5ea81bf94b6eb33ac95a85cd) --- pkgs/os-specific/linux/systemd/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index dd8105c8c058..db64b8e6f6de 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap, kmod +{ stdenv, lib, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap, kmod , xz, pam, acl, libuuid, m4, utillinux, libffi , glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libidn2, libapparmor , audit, lz4, bzip2, libmicrohttpd, pcre2 @@ -10,8 +10,8 @@ , getent , buildPackages , withSelinux ? false, libselinux -, withLibseccomp ? libseccomp.meta.available, libseccomp -, withKexectools ? kexectools.meta.available, kexectools +, withLibseccomp ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) libseccomp.meta.platforms, libseccomp +, withKexectools ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) kexectools.meta.platforms, kexectools }: let From 50da3198919230462e8de1dc23762fdf8615b7ae Mon Sep 17 00:00:00 2001 From: Tuomas Tynkkynen Date: Wed, 29 Aug 2018 01:20:22 +0300 Subject: [PATCH 31/52] nix: Replace meta.available checks This sort of code breaks config.{allowBroken, allowUnsupportedSystem} = true by making them do unpredictable things. (cherry picked from commit cdeafe7cdf5d6272049f45dc695a9715fad4d414) Conflicts: pkgs/tools/package-management/nix/default.nix --- pkgs/tools/package-management/nix/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix index 4581a8351dce..6d15b8b9e4a1 100644 --- a/pkgs/tools/package-management/nix/default.nix +++ b/pkgs/tools/package-management/nix/default.nix @@ -5,7 +5,7 @@ , storeDir ? "/nix/store" , stateDir ? "/nix/var" , confDir ? "/etc" -, withLibseccomp ? libseccomp.meta.available, libseccomp +, withLibseccomp ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) libseccomp.meta.platforms, libseccomp }: let @@ -74,7 +74,7 @@ let stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform ? nix && stdenv.hostPlatform.nix ? system ) ''--with-system=${stdenv.hostPlatform.nix.system}'' # RISC-V support in progress https://github.com/seccomp/libseccomp/pull/50 - ++ lib.optional (!libseccomp.meta.available) "--disable-seccomp-sandboxing"; + ++ lib.optional (!withLibseccomp) "--disable-seccomp-sandboxing"; makeFlags = "profiledir=$(out)/etc/profile.d"; From 2c3443e2d2f8a77cb5a5a187195a1b9e0d27d61f Mon Sep 17 00:00:00 2001 From: Tuomas Tynkkynen Date: Wed, 29 Aug 2018 01:20:43 +0300 Subject: [PATCH 32/52] apparmor: Replace meta.available checks This sort of code breaks config.{allowBroken, allowUnsupportedSystem} = true by making them do unpredictable things. (cherry picked from commit 50d036088802a30934103f320458b151fb96f8b0) --- pkgs/os-specific/linux/apparmor/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix index 08428f95b06c..3ffaef8109f3 100644 --- a/pkgs/os-specific/linux/apparmor/default.nix +++ b/pkgs/os-specific/linux/apparmor/default.nix @@ -1,10 +1,10 @@ -{ stdenv, fetchurl, fetchpatch, makeWrapper, autoreconfHook +{ stdenv, lib, fetchurl, fetchpatch, makeWrapper, autoreconfHook , pkgconfig, which , flex, bison , linuxHeaders ? stdenv.cc.libc.linuxHeaders , gawk -, withPerl ? stdenv.hostPlatform == stdenv.buildPlatform && perl.meta.available or false, perl -, withPython ? stdenv.hostPlatform == stdenv.buildPlatform && python.meta.available or false, python +, withPerl ? stdenv.hostPlatform == stdenv.buildPlatform && lib.any (lib.meta.platformMatch stdenv.hostPlatform) perl.meta.platforms, perl +, withPython ? stdenv.hostPlatform == stdenv.buildPlatform && lib.any (lib.meta.platformMatch stdenv.hostPlatform) python.meta.platforms, python , swig , ncurses , pam From ae63055af9c61735bf971e05464f6458f84302b6 Mon Sep 17 00:00:00 2001 From: Tuomas Tynkkynen Date: Wed, 29 Aug 2018 01:20:54 +0300 Subject: [PATCH 33/52] treewide: Replace meta.available checks in `shouldUsePackages` copypasta This reverts commit 79d8353b5e4bb98f1b51ab32b9b26df81bb7e106. This sort of code breaks config.{allowBroken, allowUnsupportedSystem} = true by making them do unpredictable things. (cherry picked from commit 5e84926a667d496d1c09d00df260299e853cdd03) --- pkgs/development/libraries/wiredtiger/default.nix | 2 +- pkgs/misc/jackaudio/default.nix | 2 +- pkgs/misc/jackaudio/jack1.nix | 2 +- pkgs/os-specific/linux/ffado/default.nix | 2 +- pkgs/servers/shishi/default.nix | 2 +- pkgs/tools/filesystems/ceph/generic.nix | 3 ++- 6 files changed, 7 insertions(+), 6 deletions(-) diff --git a/pkgs/development/libraries/wiredtiger/default.nix b/pkgs/development/libraries/wiredtiger/default.nix index c4d94af850dd..56068c435d80 100644 --- a/pkgs/development/libraries/wiredtiger/default.nix +++ b/pkgs/development/libraries/wiredtiger/default.nix @@ -14,7 +14,7 @@ let mkEnable = mkFlag "enable-" "disable-"; mkWith = mkFlag "with-" "without-"; - shouldUsePkg = pkg: if pkg != null && pkg.meta.available then pkg else null; + shouldUsePkg = pkg: if pkg != null && stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) pkg.meta.platforms then pkg else null; optLz4 = shouldUsePkg lz4; optSnappy = shouldUsePkg snappy; diff --git a/pkgs/misc/jackaudio/default.nix b/pkgs/misc/jackaudio/default.nix index 391ac107ab71..efd5aa4e9194 100644 --- a/pkgs/misc/jackaudio/default.nix +++ b/pkgs/misc/jackaudio/default.nix @@ -14,7 +14,7 @@ with stdenv.lib; let inherit (python2Packages) python dbus-python; - shouldUsePkg = pkg: if pkg != null && pkg.meta.available then pkg else null; + shouldUsePkg = pkg: if pkg != null && stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) pkg.meta.platforms then pkg else null; libOnly = prefix == "lib"; diff --git a/pkgs/misc/jackaudio/jack1.nix b/pkgs/misc/jackaudio/jack1.nix index c11be4ad0c0c..2e349cf691c9 100644 --- a/pkgs/misc/jackaudio/jack1.nix +++ b/pkgs/misc/jackaudio/jack1.nix @@ -5,7 +5,7 @@ }: let - shouldUsePkg = pkg: if pkg != null && pkg.meta.available then pkg else null; + shouldUsePkg = pkg: if pkg != null && stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) pkg.meta.platforms then pkg else null; optAlsaLib = shouldUsePkg alsaLib; optDb = shouldUsePkg db; diff --git a/pkgs/os-specific/linux/ffado/default.nix b/pkgs/os-specific/linux/ffado/default.nix index 4e3e373d244c..85218042cf76 100644 --- a/pkgs/os-specific/linux/ffado/default.nix +++ b/pkgs/os-specific/linux/ffado/default.nix @@ -11,7 +11,7 @@ let - shouldUsePkg = pkg: if pkg != null && pkg.meta.available then pkg else null; + shouldUsePkg = pkg: if pkg != null && stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) pkg.meta.platforms then pkg else null; libOnly = prefix == "lib"; diff --git a/pkgs/servers/shishi/default.nix b/pkgs/servers/shishi/default.nix index 1540a6f1fd18..b066ff18bfdc 100644 --- a/pkgs/servers/shishi/default.nix +++ b/pkgs/servers/shishi/default.nix @@ -14,7 +14,7 @@ let mkWith = mkFlag "with-" "without-"; mkOther = mkFlag "" "" true; - shouldUsePkg = pkg: if pkg != null && pkg.meta.available then pkg else null; + shouldUsePkg = pkg: if pkg != null && stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) pkg.meta.platforms then pkg else null; optPam = shouldUsePkg pam; optLibidn = shouldUsePkg libidn; diff --git a/pkgs/tools/filesystems/ceph/generic.nix b/pkgs/tools/filesystems/ceph/generic.nix index 14fedd6610e1..c4856d925299 100644 --- a/pkgs/tools/filesystems/ceph/generic.nix +++ b/pkgs/tools/filesystems/ceph/generic.nix @@ -37,7 +37,8 @@ with stdenv.lib; let shouldUsePkg = pkg_: let pkg = (builtins.tryEval pkg_).value; - in if pkg.meta.available or false then pkg else null; + in if lib.any (lib.meta.platformMatch stdenv.hostPlatform) pkg.meta.platforms + then pkg else null; optYasm = shouldUsePkg yasm; optFcgi = shouldUsePkg fcgi; From 5330abad5328e4c9643bc224093c88bd6f1d6694 Mon Sep 17 00:00:00 2001 From: Tuomas Tynkkynen Date: Wed, 29 Aug 2018 01:21:05 +0300 Subject: [PATCH 34/52] ghc: Replace meta.available checks for enableIntegerSimple This sort of code breaks config.{allowBroken, allowUnsupportedSystem} = true by making them do unpredictable things. (cherry picked from commit f4dd2fed7f57782fae0b3c9c9226effc5185ab7d) --- pkgs/development/compilers/ghc/7.10.3.nix | 2 +- pkgs/development/compilers/ghc/8.0.2.nix | 2 +- pkgs/development/compilers/ghc/8.2.2.nix | 2 +- pkgs/development/compilers/ghc/8.4.3.nix | 2 +- pkgs/development/compilers/ghc/8.6.1.nix | 2 +- pkgs/development/compilers/ghc/head.nix | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pkgs/development/compilers/ghc/7.10.3.nix b/pkgs/development/compilers/ghc/7.10.3.nix index a4374a452402..b69ae80d0db5 100644 --- a/pkgs/development/compilers/ghc/7.10.3.nix +++ b/pkgs/development/compilers/ghc/7.10.3.nix @@ -15,7 +15,7 @@ , # If enabled, GHC will be built with the GPL-free but slower integer-simple # library instead of the faster but GPLed integer-gmp library. - enableIntegerSimple ? !(gmp.meta.available or false), gmp + enableIntegerSimple ? !(stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) gmp.meta.platforms), gmp , # If enabled, use -fPIC when compiling static libs. enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform diff --git a/pkgs/development/compilers/ghc/8.0.2.nix b/pkgs/development/compilers/ghc/8.0.2.nix index 0946db713783..f7422d150ac0 100644 --- a/pkgs/development/compilers/ghc/8.0.2.nix +++ b/pkgs/development/compilers/ghc/8.0.2.nix @@ -14,7 +14,7 @@ , # If enabled, GHC will be built with the GPL-free but slower integer-simple # library instead of the faster but GPLed integer-gmp library. - enableIntegerSimple ? !(gmp.meta.available or false), gmp + enableIntegerSimple ? !(stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) gmp.meta.platforms), gmp , # If enabled, use -fPIC when compiling static libs. enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform diff --git a/pkgs/development/compilers/ghc/8.2.2.nix b/pkgs/development/compilers/ghc/8.2.2.nix index 6a1914a9c2c8..aac8cf4fd220 100644 --- a/pkgs/development/compilers/ghc/8.2.2.nix +++ b/pkgs/development/compilers/ghc/8.2.2.nix @@ -15,7 +15,7 @@ , # If enabled, GHC will be built with the GPL-free but slower integer-simple # library instead of the faster but GPLed integer-gmp library. - enableIntegerSimple ? !(gmp.meta.available or false), gmp + enableIntegerSimple ? !(stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) gmp.meta.platforms), gmp , # If enabled, use -fPIC when compiling static libs. enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform diff --git a/pkgs/development/compilers/ghc/8.4.3.nix b/pkgs/development/compilers/ghc/8.4.3.nix index 8fba60d527fd..e43f9a57d0a4 100644 --- a/pkgs/development/compilers/ghc/8.4.3.nix +++ b/pkgs/development/compilers/ghc/8.4.3.nix @@ -14,7 +14,7 @@ , # If enabled, GHC will be built with the GPL-free but slower integer-simple # library instead of the faster but GPLed integer-gmp library. - enableIntegerSimple ? !(gmp.meta.available or false), gmp + enableIntegerSimple ? !(stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) gmp.meta.platforms), gmp , # If enabled, use -fPIC when compiling static libs. enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform diff --git a/pkgs/development/compilers/ghc/8.6.1.nix b/pkgs/development/compilers/ghc/8.6.1.nix index c12401f05778..62ea39791b90 100644 --- a/pkgs/development/compilers/ghc/8.6.1.nix +++ b/pkgs/development/compilers/ghc/8.6.1.nix @@ -14,7 +14,7 @@ , # If enabled, GHC will be built with the GPL-free but slower integer-simple # library instead of the faster but GPLed integer-gmp library. - enableIntegerSimple ? !(gmp.meta.available or false), gmp + enableIntegerSimple ? !(stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) gmp.meta.platforms), gmp , # If enabled, use -fPIC when compiling static libs. enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform diff --git a/pkgs/development/compilers/ghc/head.nix b/pkgs/development/compilers/ghc/head.nix index af5efbd7df8c..87045815a37f 100644 --- a/pkgs/development/compilers/ghc/head.nix +++ b/pkgs/development/compilers/ghc/head.nix @@ -14,7 +14,7 @@ , # If enabled, GHC will be built with the GPL-free but slower integer-simple # library instead of the faster but GPLed integer-gmp library. - enableIntegerSimple ? !(gmp.meta.available or false), gmp + enableIntegerSimple ? !(stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) gmp.meta.platforms), gmp , # If enabled, use -fPIC when compiling static libs. enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform From aa0c7bd5ed059e0f7278bacc63c3e4b0aab7d991 Mon Sep 17 00:00:00 2001 From: Tuomas Tynkkynen Date: Wed, 29 Aug 2018 01:21:33 +0300 Subject: [PATCH 35/52] nixos/kexec: Replace meta.available checks This sort of code breaks config.{allowBroken, allowUnsupportedSystem} = true by making them do unpredictable things. [dezgeg: Also squash in the bugfix commit "nixos/kexec: Fix typo in meta.platforms" by aszlig] (cherry picked from commit 599c4df46a90c7415a6cc0689f0b23d22e7fdb67) (cherry picked from commit fd8bca45c994fc3b36dce4263c1d4419493f193e) --- nixos/modules/system/boot/kexec.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/system/boot/kexec.nix b/nixos/modules/system/boot/kexec.nix index 3e5d7b40f2c5..61f9c6d0e7eb 100644 --- a/nixos/modules/system/boot/kexec.nix +++ b/nixos/modules/system/boot/kexec.nix @@ -1,7 +1,7 @@ { pkgs, lib, ... }: { - config = lib.mkIf (pkgs.kexectools.meta.available) { + config = lib.mkIf (lib.any (lib.meta.platformMatch pkgs.stdenv.hostPlatform) pkgs.kexectools.meta.platforms) { environment.systemPackages = [ pkgs.kexectools ]; systemd.services."prepare-kexec" = From 4c3a0ae44566b74ba4114e991f0e2ee0552caa87 Mon Sep 17 00:00:00 2001 From: Will Dietz Date: Fri, 28 Sep 2018 14:53:04 -0500 Subject: [PATCH 36/52] nix-daemon: only add channels dir to NIX_PATH if exists Per reviewer comment (thanks!). (cherry picked from commit 243e28bc96db0827eebfe2769de7e4393f791ca0) --- nixos/modules/services/misc/nix-daemon.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix index 9a8ca6f43bfe..24379ec27354 100644 --- a/nixos/modules/services/misc/nix-daemon.nix +++ b/nixos/modules/services/misc/nix-daemon.nix @@ -446,7 +446,9 @@ in export NIX_REMOTE=daemon fi '' + '' - export NIX_PATH="$HOME/.nix-defexpr/channels''${NIX_PATH:+:$NIX_PATH}" + if [ -e "$HOME/.nix-defexpr/channels" ]; then + export NIX_PATH="$HOME/.nix-defexpr/channels''${NIX_PATH:+:$NIX_PATH}" + fi ''; nix.nrBuildUsers = mkDefault (lib.max 32 cfg.maxJobs); From 4867086bc7e1528b8f8279dce47cf30087722859 Mon Sep 17 00:00:00 2001 From: Graham Christensen Date: Sat, 29 Sep 2018 20:44:34 -0400 Subject: [PATCH 37/52] Revert "Revert "doc: Update section about imperative containers"" I fixed the problem. This reverts commit 29624f6bb26908128450cfda940d26cddefdc923. --- .../administration/imperative-containers.xml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/nixos/doc/manual/administration/imperative-containers.xml b/nixos/doc/manual/administration/imperative-containers.xml index 9bb62bc2ece9..fa380477f6cb 100644 --- a/nixos/doc/manual/administration/imperative-containers.xml +++ b/nixos/doc/manual/administration/imperative-containers.xml @@ -73,8 +73,7 @@ Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux - There are several ways to change the configuration of the container. First, - on the host, you can edit + To change the configuration of the container, you can edit /var/lib/container/name/etc/nixos/configuration.nix, and run @@ -87,8 +86,7 @@ Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux = true; = "foo@example.org"; = [ 80 ]; -' - + ' # curl http://$(nixos-container show-ip foo)/ <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">… @@ -97,11 +95,13 @@ Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux - Alternatively, you can change the configuration from within the container - itself by running nixos-rebuild switch inside the - container. Note that the container by default does not have a copy of the - NixOS channel, so you should run nix-channel --update - first. + Note that in previous versions of NixOS (17.09 and earlier) one could also + use all nix-related commands (like nixos-rebuild switch) + from inside the container. However, since the release of Nix 2.0 this is not + supported anymore. Supporting Nix commands inside the container might be + possible again in future versions. See + the github + issue for tracking progress on this issue. From 26537f5379239013933a399d6951475a565e4d25 Mon Sep 17 00:00:00 2001 From: Graham Christensen Date: Sat, 29 Sep 2018 20:49:27 -0400 Subject: [PATCH 38/52] docs: format --- .../doc/manual/configuration/linux-kernel.xml | 19 +- .../development/debugging-nixos-tests.xml | 7 +- .../installing-behind-a-proxy.xml | 47 +- nixos/doc/manual/installation/installing.xml | 4 +- nixos/doc/manual/manual.xml | 4 +- nixos/doc/manual/release-notes/rl-1509.xml | 10 +- nixos/doc/manual/release-notes/rl-1809.xml | 266 +++--- nixos/modules/i18n/input-method/default.xml | 295 ++++--- nixos/modules/programs/digitalbitbox/doc.xml | 97 +-- nixos/modules/programs/plotinus.xml | 37 +- nixos/modules/programs/zsh/oh-my-zsh.xml | 164 ++-- nixos/modules/security/acme.xml | 92 +- nixos/modules/security/hidepid.xml | 37 +- .../services/databases/foundationdb.xml | 549 +++++++----- .../modules/services/databases/postgresql.xml | 88 +- nixos/modules/services/desktops/flatpak.xml | 71 +- nixos/modules/services/editors/emacs.xml | 787 +++++++++--------- nixos/modules/services/misc/gitlab.xml | 106 +-- .../modules/services/misc/taskserver/doc.xml | 209 +++-- nixos/modules/services/misc/weechat.xml | 73 +- .../monitoring/prometheus/exporters.xml | 148 ++-- .../services/networking/dnscrypt-proxy.xml | 69 +- .../modules/services/web-apps/matomo-doc.xml | 131 ++- 23 files changed, 1780 insertions(+), 1530 deletions(-) diff --git a/nixos/doc/manual/configuration/linux-kernel.xml b/nixos/doc/manual/configuration/linux-kernel.xml index 2f766f2b32f7..644d3a33ffd2 100644 --- a/nixos/doc/manual/configuration/linux-kernel.xml +++ b/nixos/doc/manual/configuration/linux-kernel.xml @@ -84,18 +84,17 @@ nixpkgs.config.packageOverrides = pkgs: allowImportFromDerivation = true; }; ]]> - -You can edit the config with this snippet (by default make menuconfig won't work - out of the box on nixos): - make + menuconfig won't work out of the box on nixos): + {}; kernelToOverride.overrideAttrs (o: {nativeBuildInputs=o.nativeBuildInputs ++ [ pkgconfig ncurses ];})' ]]> - - - or you can let nixpkgs generate the configuration. - Nixpkgs generates it via answering the interactive kernel utility make config. - The answers depend on parameters passed to pkgs/os-specific/linux/kernel/generic.nix - (which you can influence by overriding extraConfig, autoModules, modDirVersion, preferBuiltin, extraConfig). + or you can let nixpkgs generate the configuration. Nixpkgs generates it via + answering the interactive kernel utility make config. The + answers depend on parameters passed to + pkgs/os-specific/linux/kernel/generic.nix (which you + can influence by overriding extraConfig, autoModules, + modDirVersion, preferBuiltin, extraConfig). - You may need to find the correct path, replacing /tmp, * or machine. + You may need to find the correct path, replacing /tmp, + * or machine. - Press "enter" to open up console and login as "root". After you're done, press "ctrl-q" to exit the console. + Press "enter" to open up console and login as "root". After you're done, + press "ctrl-q" to exit the console. - diff --git a/nixos/doc/manual/installation/installing-behind-a-proxy.xml b/nixos/doc/manual/installation/installing-behind-a-proxy.xml index c59d073c61c7..8f9baff44b51 100644 --- a/nixos/doc/manual/installation/installing-behind-a-proxy.xml +++ b/nixos/doc/manual/installation/installing-behind-a-proxy.xml @@ -5,28 +5,29 @@ xml:id="sec-installing-behind-proxy"> Installing behind a proxy - + To install NixOS behind a proxy, do the following before running nixos-install. - - + + + - - Update proxy configuration in - /mnt/etc/nixos/configuration.nix to keep the - internet accessible after reboot. - - + + Update proxy configuration in + /mnt/etc/nixos/configuration.nix to keep the internet + accessible after reboot. + + networking.proxy.default = "http://user:password@proxy:port/"; networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; - - Setup the proxy environment variables in the shell where you are - running nixos-install. - - + + Setup the proxy environment variables in the shell where you are running + nixos-install. + + # proxy_url="http://user:password@proxy:port/" # export http_proxy="$proxy_url" # export HTTP_PROXY="$proxy_url" @@ -34,14 +35,14 @@ networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; # export HTTPS_PROXY="$proxy_url" - + - - - If you are switching networks with different proxy configurations, use the - nesting.clone option in - configuration.nix to switch proxies at runtime. - Refer to for more information. - - + + + If you are switching networks with different proxy configurations, use the + nesting.clone option in + configuration.nix to switch proxies at runtime. Refer to + for more information. + + diff --git a/nixos/doc/manual/installation/installing.xml b/nixos/doc/manual/installation/installing.xml index 916384559e24..1366e8f93596 100644 --- a/nixos/doc/manual/installation/installing.xml +++ b/nixos/doc/manual/installation/installing.xml @@ -327,8 +327,8 @@ Retype new UNIX password: *** For unattended installations, it is possible to use - nixos-install --no-root-passwd - in order to disable the password prompt entirely. + nixos-install --no-root-passwd in order to disable the + password prompt entirely. diff --git a/nixos/doc/manual/manual.xml b/nixos/doc/manual/manual.xml index a5efde32885c..12f52e1997c8 100644 --- a/nixos/doc/manual/manual.xml +++ b/nixos/doc/manual/manual.xml @@ -17,8 +17,8 @@ If you encounter problems, please report them on the Discourse - or on the Discourse or + on the #nixos channel on Freenode. Bugs should be reported in diff --git a/nixos/doc/manual/release-notes/rl-1509.xml b/nixos/doc/manual/release-notes/rl-1509.xml index 4eb2f9aa0a95..e500c9d63422 100644 --- a/nixos/doc/manual/release-notes/rl-1509.xml +++ b/nixos/doc/manual/release-notes/rl-1509.xml @@ -435,11 +435,11 @@ system.autoUpgrade.enable = true; system.stateVersion = "14.12"; - The new option ensures that - certain configuration changes that could break existing systems (such as - the sshd host key setting) will maintain compatibility - with the specified NixOS release. NixOps sets the state version of - existing deployments automatically. + The new option ensures that certain + configuration changes that could break existing systems (such as the + sshd host key setting) will maintain compatibility with + the specified NixOS release. NixOps sets the state version of existing + deployments automatically. diff --git a/nixos/doc/manual/release-notes/rl-1809.xml b/nixos/doc/manual/release-notes/rl-1809.xml index 5a565f08b2cb..f0797b51340d 100644 --- a/nixos/doc/manual/release-notes/rl-1809.xml +++ b/nixos/doc/manual/release-notes/rl-1809.xml @@ -19,13 +19,13 @@ - - Support for wrapping binaries using firejail has been - added through programs.firejail.wrappedBinaries. - - - For example - + + Support for wrapping binaries using firejail has been + added through programs.firejail.wrappedBinaries. + + + For example + programs.firejail = { enable = true; @@ -35,9 +35,10 @@ programs.firejail = { }; }; - - This will place firefox and mpv binaries in the global path wrapped by firejail. - + + This will place firefox and mpv + binaries in the global path wrapped by firejail. + @@ -75,16 +76,20 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull' - The services.cassandra module has been reworked and - was rewritten from scratch. The service has succeeding tests for - the versions 2.1, 2.2, 3.0 and 3.11 of Apache Cassandra. + The services.cassandra module has been reworked and was + rewritten from scratch. The service has succeeding tests for the versions + 2.1, 2.2, 3.0 and 3.11 of + Apache + Cassandra. - There is a new services.foundationdb module for deploying - FoundationDB clusters. + There is a new services.foundationdb module for + deploying + FoundationDB + clusters. @@ -97,24 +102,26 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull' - services.strongswan-swanctl - is a modern replacement for services.strongswan. - You can use either one of them to setup IPsec VPNs but not both at the same time. + services.strongswan-swanctl is a modern replacement for + services.strongswan. You can use either one of them to + setup IPsec VPNs but not both at the same time. - services.strongswan-swanctl uses the - swanctl - command which uses the modern - vici - Versatile IKE Configuration Interface. - The deprecated ipsec command used in services.strongswan is using the legacy - stroke configuration interface. + services.strongswan-swanctl uses the + swanctl + command which uses the modern + vici + Versatile IKE Configuration Interface. The deprecated + ipsec command used in + services.strongswan is using the legacy + stroke + configuration interface. - The new services.elasticsearch-curator service - periodically curates or manages, your Elasticsearch indices and snapshots. + The new services.elasticsearch-curator service + periodically curates or manages, your Elasticsearch indices and snapshots. @@ -135,8 +142,8 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull' - The deprecated services.cassandra module has - seen a complete rewrite. (See above.) + The deprecated services.cassandra module has seen a + complete rewrite. (See above.) @@ -186,41 +193,44 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull' - services.munge now runs as user (and group) munge instead of root. - Make sure the key file is accessible to the daemon. + services.munge now runs as user (and group) + munge instead of root. Make sure the key file is + accessible to the daemon. - dockerTools.buildImage now uses null as default value for tag, - which indicates that the nix output hash will be used as tag. + dockerTools.buildImage now uses null + as default value for tag, which indicates that the nix + output hash will be used as tag. - The ELK stack: elasticsearch, logstash and kibana - has been upgraded from 2.* to 6.3.*. - The 2.* versions have been unsupported since last year - so they have been removed. You can still use the 5.* versions under the names - elasticsearch5, logstash5 and - kibana5. + The ELK stack: elasticsearch, + logstash and kibana has been + upgraded from 2.* to 6.3.*. The 2.* versions have been + unsupported since + last year so they have been removed. You can still use the 5.* + versions under the names elasticsearch5, + logstash5 and kibana5. - The elastic beats: - filebeat, heartbeat, - metricbeat and packetbeat - have had the same treatment: they now target 6.3.* as well. - The 5.* versions are available under the names: + The elastic beats: filebeat, + heartbeat, metricbeat and + packetbeat have had the same treatment: they now target + 6.3.* as well. The 5.* versions are available under the names: filebeat5, heartbeat5, metricbeat5 and packetbeat5 The ELK-6.3 stack now comes with - X-Pack by default. - Since X-Pack is licensed under the - Elastic License - the ELK packages now have an unfree license. To use them you need to specify - allowUnfree = true; in your nixpkgs configuration. + X-Pack by + default. Since X-Pack is licensed under the + Elastic + License the ELK packages now have an unfree license. To use them + you need to specify allowUnfree = true; in your nixpkgs + configuration. Fortunately there is also a free variant of the ELK stack without X-Pack. @@ -231,20 +241,23 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull' - Options - boot.initrd.luks.devices.name.yubikey.ramfsMountPoint - boot.initrd.luks.devices.name.yubikey.storage.mountPoint - were removed. luksroot.nix module never supported more than one YubiKey at - a time anyway, hence those options never had any effect. You should be able to remove them - from your config without any issues. + Options + boot.initrd.luks.devices.name.yubikey.ramfsMountPoint + boot.initrd.luks.devices.name.yubikey.storage.mountPoint + were removed. luksroot.nix module never supported more + than one YubiKey at a time anyway, hence those options never had any + effect. You should be able to remove them from your config without any + issues. - stdenv.system and system in nixpkgs now refer to the host platform instead of the build platform. - For native builds this is not change, let alone a breaking one. - For cross builds, it is a breaking change, and stdenv.buildPlatform.system can be used instead for the old behavior. - They should be using that anyways for clarity. + stdenv.system and system in nixpkgs + now refer to the host platform instead of the build platform. For native + builds this is not change, let alone a breaking one. For cross builds, it + is a breaking change, and stdenv.buildPlatform.system + can be used instead for the old behavior. They should be using that + anyways for clarity. @@ -298,26 +311,33 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull' - The pkgs argument to NixOS modules can now be set directly using nixpkgs.pkgs. Previously, only the system, config and overlays arguments could be used to influence pkgs. + The pkgs argument to NixOS modules can now be set + directly using nixpkgs.pkgs. Previously, only the + system, config and + overlays arguments could be used to influence + pkgs. - A NixOS system can now be constructed more easily based on a preexisting invocation of Nixpkgs. For example: - + A NixOS system can now be constructed more easily based on a preexisting + invocation of Nixpkgs. For example: + inherit (pkgs.nixos { boot.loader.grub.enable = false; fileSystems."/".device = "/dev/xvda1"; }) toplevel kernel initialRamdisk manual; - - This benefits evaluation performance, lets you write Nixpkgs packages that depend on NixOS images and is consistent with a deployment architecture that would be centered around Nixpkgs overlays. + This benefits evaluation performance, lets you write Nixpkgs packages that + depend on NixOS images and is consistent with a deployment architecture + that would be centered around Nixpkgs overlays. - lib.traceValIfNot has been deprecated. Use - if/then/else and lib.traceValSeq instead. + lib.traceValIfNot has been deprecated. Use + if/then/else and lib.traceValSeq + instead. @@ -336,9 +356,9 @@ inherit (pkgs.nixos { - lib.recursiveUpdateUntil was not acting according to its - specification. It has been fixed to act according to the docstring, and a - test has been added. + lib.recursiveUpdateUntil was not acting according to + its specification. It has been fixed to act according to the docstring, + and a test has been added. @@ -408,11 +428,11 @@ inherit (pkgs.nixos { - - The Kubernetes package has been bumped to major version 1.11. - Please consult the - release notes - for details on new features and api changes. + + The Kubernetes package has been bumped to major version 1.11. Please + consult the + release + notes for details on new features and api changes. @@ -432,8 +452,8 @@ inherit (pkgs.nixos { - The option services.kubernetes.apiserver.address - was renamed to services.kubernetes.apiserver.bindAddress. + The option services.kubernetes.apiserver.address was + renamed to services.kubernetes.apiserver.bindAddress. Note that the default value has changed from 127.0.0.1 to 0.0.0.0. @@ -445,76 +465,86 @@ inherit (pkgs.nixos { - The option services.kubernetes.addons.dashboard.enableRBAC - was renamed to services.kubernetes.addons.dashboard.rbac.enable. + The option + services.kubernetes.addons.dashboard.enableRBAC was + renamed to + services.kubernetes.addons.dashboard.rbac.enable. The Kubernetes Dashboard now has only minimal RBAC permissions by default. - If dashboard cluster-admin rights are desired, - set services.kubernetes.addons.dashboard.rbac.clusterAdmin to true. - On existing clusters, in order for the revocation of privileges to take effect, - the current ClusterRoleBinding for kubernetes-dashboard must be manually removed: - kubectl delete clusterrolebinding kubernetes-dashboard + If dashboard cluster-admin rights are desired, set + services.kubernetes.addons.dashboard.rbac.clusterAdmin + to true. On existing clusters, in order for the revocation of privileges + to take effect, the current ClusterRoleBinding for kubernetes-dashboard + must be manually removed: kubectl delete clusterrolebinding + kubernetes-dashboard The programs.screen module provides allows to configure - /etc/screenrc, however the module behaved fairly counterintuitive as - the config exists, but the package wasn't available. Since 18.09 pkgs.screen - will be added to environment.systemPackages. + /etc/screenrc, however the module behaved fairly + counterintuitive as the config exists, but the package wasn't available. + Since 18.09 pkgs.screen will be added to + environment.systemPackages. - The module now uses WPA2 by default. + The module now uses WPA2 by + default. - s6Dns, s6Networking, - s6LinuxUtils and s6PortableUtils - renamed to - s6-dns, s6-networking, - s6-linux-utils and s6-portable-utils respectively. + s6Dns, s6Networking, + s6LinuxUtils and s6PortableUtils + renamed to s6-dns, s6-networking, + s6-linux-utils and s6-portable-utils + respectively. - - + + - The module option is now defaulted to true. + The module option is now defaulted to + true. - - + + - The config activation script of nixos-rebuild now - reloads - all user units for each authenticated user. + The config activation script of nixos-rebuild now + reloads + all user units for each authenticated user. - - + + - The default display manager is now LightDM. - To use SLiM set services.xserver.displayManager.slim.enable - to true. + The default display manager is now LightDM. To use SLiM set + services.xserver.displayManager.slim.enable to + true. - - + + - NixOS option descriptions are now automatically broken up into individual - paragraphs if the text contains two consecutive newlines, so it's no - longer necessary to use </para><para> to start - a new paragraph. + NixOS option descriptions are now automatically broken up into individual + paragraphs if the text contains two consecutive newlines, so it's no + longer necessary to use </para><para> to start a + new paragraph. - - + + - Top-level buildPlatform, hostPlatform, and targetPlatform in Nixpkgs are deprecated. - Please use their equivalents in stdenv instead: - stdenv.buildPlatform, stdenv.hostPlatform, and stdenv.targetPlatform. + Top-level buildPlatform, + hostPlatform, and targetPlatform in + Nixpkgs are deprecated. Please use their equivalents in + stdenv instead: + stdenv.buildPlatform, + stdenv.hostPlatform, and + stdenv.targetPlatform. - + diff --git a/nixos/modules/i18n/input-method/default.xml b/nixos/modules/i18n/input-method/default.xml index ab918a9fb23e..117482fb0d57 100644 --- a/nixos/modules/i18n/input-method/default.xml +++ b/nixos/modules/i18n/input-method/default.xml @@ -3,32 +3,50 @@ xmlns:xi="http://www.w3.org/2001/XInclude" version="5.0" xml:id="module-services-input-methods"> + Input Methods + + Input methods are an operating system component that allows any data, such as + keyboard strokes or mouse movements, to be received as input. In this way + users can enter characters and symbols not found on their input devices. + Using an input method is obligatory for any language that has more graphemes + than there are keys on the keyboard. + + + The following input methods are available in NixOS: + + + + + IBus: The intelligent input bus. + + + + + Fcitx: A customizable lightweight input method. + + + + + Nabi: A Korean input method based on XIM. + + + + + Uim: The universal input method, is a library with a XIM bridge. + + + +
+ IBus -Input Methods + + IBus is an Intelligent Input Bus. It provides full featured and user + friendly input method user interface. + -Input methods are an operating system component that allows any data, such - as keyboard strokes or mouse movements, to be received as input. In this way - users can enter characters and symbols not found on their input devices. Using - an input method is obligatory for any language that has more graphemes than - there are keys on the keyboard. - -The following input methods are available in NixOS: - - - IBus: The intelligent input bus. - Fcitx: A customizable lightweight input - method. - Nabi: A Korean input method based on XIM. - Uim: The universal input method, is a library with a XIM - bridge. - - -
IBus - -IBus is an Intelligent Input Bus. It provides full featured and user - friendly input method user interface. - -The following snippet can be used to configure IBus: + + The following snippet can be used to configure IBus: + i18n.inputMethod = { @@ -37,57 +55,89 @@ i18n.inputMethod = { }; -i18n.inputMethod.ibus.engines is optional and can be - used to add extra IBus engines. + + i18n.inputMethod.ibus.engines is optional and can be used + to add extra IBus engines. + -Available extra IBus engines are: + + Available extra IBus engines are: + - - Anthy (ibus-engines.anthy): Anthy is a - system for Japanese input method. It converts Hiragana text to Kana Kanji - mixed text. - Hangul (ibus-engines.hangul): Korean input - method. - m17n (ibus-engines.m17n): m17n is an input - method that uses input methods and corresponding icons in the m17n - database. - mozc (ibus-engines.mozc): A Japanese input - method from Google. - Table (ibus-engines.table): An input method - that load tables of input methods. - table-others (ibus-engines.table-others): - Various table-based input methods. To use this, and any other table-based - input methods, it must appear in the list of engines along with - table. For example: + + + + Anthy (ibus-engines.anthy): Anthy is a system for + Japanese input method. It converts Hiragana text to Kana Kanji mixed text. + + + + + Hangul (ibus-engines.hangul): Korean input method. + + + + + m17n (ibus-engines.m17n): m17n is an input method that + uses input methods and corresponding icons in the m17n database. + + + + + mozc (ibus-engines.mozc): A Japanese input method from + Google. + + + + + Table (ibus-engines.table): An input method that load + tables of input methods. + + + + + table-others (ibus-engines.table-others): Various + table-based input methods. To use this, and any other table-based input + methods, it must appear in the list of engines along with + table. For example: ibus.engines = with pkgs.ibus-engines; [ table table-others ]; - - + + + -To use any input method, the package must be added in the configuration, - as shown above, and also (after running nixos-rebuild) the - input method must be added from IBus' preference dialog. + + To use any input method, the package must be added in the configuration, as + shown above, and also (after running nixos-rebuild) the + input method must be added from IBus' preference dialog. + - - Troubleshooting - If IBus works in some applications but not others, a likely cause of - this is that IBus is depending on a different version of - glib to what the applications are depending on. This can - be checked by running nix-store -q --requisites <path> | grep - glib, where <path> is the path of either - IBus or an application in the Nix store. The glib - packages must match exactly. If they do not, uninstalling and reinstalling - the application is a likely fix. - -
+ + Troubleshooting + + If IBus works in some applications but not others, a likely cause of this + is that IBus is depending on a different version of glib + to what the applications are depending on. This can be checked by running + nix-store -q --requisites <path> | grep glib, + where <path> is the path of either IBus or an + application in the Nix store. The glib packages must + match exactly. If they do not, uninstalling and reinstalling the + application is a likely fix. + + +
+
+ Fcitx -
Fcitx + + Fcitx is an input method framework with extension support. It has three + built-in Input Method Engine, Pinyin, QuWei and Table-based input methods. + -Fcitx is an input method framework with extension support. It has three - built-in Input Method Engine, Pinyin, QuWei and Table-based input - methods. -The following snippet can be used to configure Fcitx: + + The following snippet can be used to configure Fcitx: + i18n.inputMethod = { @@ -96,51 +146,89 @@ i18n.inputMethod = { }; -i18n.inputMethod.fcitx.engines is optional and can be - used to add extra Fcitx engines. + + i18n.inputMethod.fcitx.engines is optional and can be + used to add extra Fcitx engines. + -Available extra Fcitx engines are: + + Available extra Fcitx engines are: + - - Anthy (fcitx-engines.anthy): Anthy is a - system for Japanese input method. It converts Hiragana text to Kana Kanji - mixed text. - Chewing (fcitx-engines.chewing): Chewing is - an intelligent Zhuyin input method. It is one of the most popular input - methods among Traditional Chinese Unix users. - Hangul (fcitx-engines.hangul): Korean input - method. - Unikey (fcitx-engines.unikey): Vietnamese input - method. - m17n (fcitx-engines.m17n): m17n is an input - method that uses input methods and corresponding icons in the m17n - database. - mozc (fcitx-engines.mozc): A Japanese input - method from Google. - table-others (fcitx-engines.table-others): - Various table-based input methods. - -
+ + + + Anthy (fcitx-engines.anthy): Anthy is a system for + Japanese input method. It converts Hiragana text to Kana Kanji mixed text. + + + + + Chewing (fcitx-engines.chewing): Chewing is an + intelligent Zhuyin input method. It is one of the most popular input + methods among Traditional Chinese Unix users. + + + + + Hangul (fcitx-engines.hangul): Korean input method. + + + + + Unikey (fcitx-engines.unikey): Vietnamese input method. + + + + + m17n (fcitx-engines.m17n): m17n is an input method that + uses input methods and corresponding icons in the m17n database. + + + + + mozc (fcitx-engines.mozc): A Japanese input method from + Google. + + + + + table-others (fcitx-engines.table-others): Various + table-based input methods. + + + +
+
+ Nabi -
Nabi + + Nabi is an easy to use Korean X input method. It allows you to enter + phonetic Korean characters (hangul) and pictographic Korean characters + (hanja). + -Nabi is an easy to use Korean X input method. It allows you to enter - phonetic Korean characters (hangul) and pictographic Korean characters - (hanja). -The following snippet can be used to configure Nabi: + + The following snippet can be used to configure Nabi: + i18n.inputMethod = { enabled = "nabi"; }; -
+
+
+ Uim -
Uim + + Uim (short for "universal input method") is a multilingual input method + framework. Applications can use it through so-called bridges. + -Uim (short for "universal input method") is a multilingual input method - framework. Applications can use it through so-called bridges. -The following snippet can be used to configure uim: + + The following snippet can be used to configure uim: + i18n.inputMethod = { @@ -148,8 +236,9 @@ i18n.inputMethod = { }; -Note: The option can be - used to choose uim toolbar. - -
+ + Note: The option can be + used to choose uim toolbar. + +
diff --git a/nixos/modules/programs/digitalbitbox/doc.xml b/nixos/modules/programs/digitalbitbox/doc.xml index a26653dda535..c63201628dbd 100644 --- a/nixos/modules/programs/digitalbitbox/doc.xml +++ b/nixos/modules/programs/digitalbitbox/doc.xml @@ -3,75 +3,64 @@ xmlns:xi="http://www.w3.org/2001/XInclude" version="5.0" xml:id="module-programs-digitalbitbox"> - - Digital Bitbox - - - Digital Bitbox is a hardware wallet and second-factor authenticator. - - - - The digitalbitbox programs module may be - installed by setting programs.digitalbitbox - to true in a manner similar to - + Digital Bitbox + + Digital Bitbox is a hardware wallet and second-factor authenticator. + + + The digitalbitbox programs module may be installed by + setting programs.digitalbitbox to true + in a manner similar to = true; - - and bundles the digitalbitbox package (see digitalbitbox package (see + ), which contains the - dbb-app and dbb-cli binaries, - along with the hardware module (see dbb-app and dbb-cli binaries, along + with the hardware module (see + ) which sets up the - necessary udev rules to access the device. - + necessary udev rules to access the device. + + + Enabling the digitalbitbox module is pretty much the easiest way to get a + Digital Bitbox device working on your system. + + + For more information, see + . + +
+ Package - Enabling the digitalbitbox module is pretty much the easiest way to - get a Digital Bitbox device working on your system. - - - - For more information, see - . - - -
- Package - - - The binaries, dbb-app (a GUI tool) and - dbb-cli (a CLI tool), are available through the - digitalbitbox package which could be installed - as follows: - + The binaries, dbb-app (a GUI tool) and + dbb-cli (a CLI tool), are available through the + digitalbitbox package which could be installed as + follows: = [ pkgs.digitalbitbox ]; - -
- - -
- Hardware - - - The digitalbitbox hardware package enables the udev rules for - Digital Bitbox devices and may be installed as follows: + +
+
+ Hardware + + The digitalbitbox hardware package enables the udev rules for Digital Bitbox + devices and may be installed as follows: = true; - - - - In order to alter the udev rules, one may provide different values for - the udevRule51 and udevRule52 - attributes by means of overriding as follows: + + + In order to alter the udev rules, one may provide different values for the + udevRule51 and udevRule52 attributes + by means of overriding as follows: programs.digitalbitbox = { enable = true; @@ -80,6 +69,6 @@ programs.digitalbitbox = { }; }; - -
+ +
diff --git a/nixos/modules/programs/plotinus.xml b/nixos/modules/programs/plotinus.xml index 91740ee16ec2..902cd89e0c49 100644 --- a/nixos/modules/programs/plotinus.xml +++ b/nixos/modules/programs/plotinus.xml @@ -3,23 +3,28 @@ xmlns:xi="http://www.w3.org/2001/XInclude" version="5.0" xml:id="module-program-plotinus"> - -Plotinus - -Source: modules/programs/plotinus.nix - -Upstream documentation: - -Plotinus is a searchable command palette in every modern GTK+ application. - -When in a GTK+3 application and Plotinus is enabled, you can press Ctrl+Shift+P to open the command palette. The command palette provides a searchable list of of all menu items in the application. - -To enable Plotinus, add the following to your configuration.nix: - + Plotinus + + Source: + modules/programs/plotinus.nix + + + Upstream documentation: + + + + Plotinus is a searchable command palette in every modern GTK+ application. + + + When in a GTK+3 application and Plotinus is enabled, you can press + Ctrl+Shift+P to open the command palette. The command + palette provides a searchable list of of all menu items in the application. + + + To enable Plotinus, add the following to your + configuration.nix: = true; - - - + diff --git a/nixos/modules/programs/zsh/oh-my-zsh.xml b/nixos/modules/programs/zsh/oh-my-zsh.xml index 6567d4a42fac..5cf690c1a560 100644 --- a/nixos/modules/programs/zsh/oh-my-zsh.xml +++ b/nixos/modules/programs/zsh/oh-my-zsh.xml @@ -3,18 +3,20 @@ xmlns:xi="http://www.w3.org/2001/XInclude" version="5.0" xml:id="module-programs-zsh-ohmyzsh"> + Oh my ZSH + + oh-my-zsh is a + framework to manage your ZSH + configuration including completion scripts for several CLI tools or custom + prompt themes. + +
+ Basic usage -Oh my ZSH - -oh-my-zsh is a framework -to manage your ZSH configuration -including completion scripts for several CLI tools or custom prompt themes. - -
Basic usage -The module uses the oh-my-zsh package with all available features. The -initial setup using Nix expressions is fairly similar to the configuration format -of oh-my-zsh. - + + The module uses the oh-my-zsh package with all available + features. The initial setup using Nix expressions is fairly similar to the + configuration format of oh-my-zsh. { programs.ohMyZsh = { @@ -24,39 +26,50 @@ of oh-my-zsh. }; } + For a detailed explanation of these arguments please refer to the + oh-my-zsh + docs. + -For a detailed explanation of these arguments please refer to the -oh-my-zsh docs. - -The expression generates the needed -configuration and writes it into your /etc/zshrc. -
+ + The expression generates the needed configuration and writes it into your + /etc/zshrc. + +
+
+ Custom additions -
Custom additions - -Sometimes third-party or custom scripts such as a modified theme may be needed. -oh-my-zsh provides the -ZSH_CUSTOM -environment variable for this which points to a directory with additional scripts. - -The module can do this as well: + + Sometimes third-party or custom scripts such as a modified theme may be + needed. oh-my-zsh provides the + ZSH_CUSTOM + environment variable for this which points to a directory with additional + scripts. + + + The module can do this as well: { programs.ohMyZsh.custom = "~/path/to/custom/scripts"; } -
+ +
+
+ Custom environments -
Custom environments - -There are several extensions for oh-my-zsh packaged in nixpkgs. -One of them is nix-zsh-completions -which bundles completion scripts and a plugin for oh-my-zsh. - -Rather than using a single mutable path for ZSH_CUSTOM, it's also possible to -generate this path from a list of Nix packages: + + There are several extensions for oh-my-zsh packaged in + nixpkgs. One of them is + nix-zsh-completions + which bundles completion scripts and a plugin for + oh-my-zsh. + + + Rather than using a single mutable path for ZSH_CUSTOM, + it's also possible to generate this path from a list of Nix packages: { pkgs, ... }: { @@ -66,42 +79,59 @@ generate this path from a list of Nix packages: ]; } + Internally a single store path will be created using + buildEnv. Please refer to the docs of + buildEnv + for further reference. + -Internally a single store path will be created using buildEnv. -Please refer to the docs of -buildEnv -for further reference. + + Please keep in mind that this is not compatible with + programs.ohMyZsh.custom as it requires an immutable store + path while custom shall remain mutable! An evaluation + failure will be thrown if both custom and + customPkgs are set. + +
+
+ Package your own customizations -Please keep in mind that this is not compatible with programs.ohMyZsh.custom -as it requires an immutable store path while custom shall remain mutable! An evaluation failure -will be thrown if both custom and customPkgs are set. -
+ + If third-party customizations (e.g. new themes) are supposed to be added to + oh-my-zsh there are several pitfalls to keep in mind: + -
Package your own customizations - -If third-party customizations (e.g. new themes) are supposed to be added to oh-my-zsh -there are several pitfalls to keep in mind: - - - - To comply with the default structure of ZSH the entire output needs to be written to - $out/share/zsh. - - - Completion scripts are supposed to be stored at $out/share/zsh/site-functions. This directory - is part of the fpath - and the package should be compatible with pure ZSH setups. The module will automatically link - the contents of site-functions to completions directory in the proper store path. - - - The plugins directory needs the structure pluginname/pluginname.plugin.zsh - as structured in the upstream repo. + + + + To comply with the default structure of ZSH the entire + output needs to be written to $out/share/zsh. - - + + + + Completion scripts are supposed to be stored at + $out/share/zsh/site-functions. This directory is part + of the + fpath + and the package should be compatible with pure ZSH + setups. The module will automatically link the contents of + site-functions to completions directory in the proper + store path. + + + + + The plugins directory needs the structure + pluginname/pluginname.plugin.zsh as structured in the + upstream + repo. + + + - -A derivation for oh-my-zsh may look like this: + + A derivation for oh-my-zsh may look like this: { stdenv, fetchFromGitHub }: @@ -120,6 +150,6 @@ stdenv.mkDerivation rec { ''; } - -
+ +
diff --git a/nixos/modules/security/acme.xml b/nixos/modules/security/acme.xml index b4cd83f6632c..ef71fe53d0c7 100644 --- a/nixos/modules/security/acme.xml +++ b/nixos/modules/security/acme.xml @@ -3,23 +3,25 @@ xmlns:xi="http://www.w3.org/2001/XInclude" version="5.0" xml:id="module-security-acme"> + SSL/TLS Certificates with ACME + + NixOS supports automatic domain validation & certificate retrieval and + renewal using the ACME protocol. This is currently only implemented by and + for Let's Encrypt. The alternative ACME client simp_le is + used under the hood. + +
+ Prerequisites -SSL/TLS Certificates with ACME - -NixOS supports automatic domain validation & certificate -retrieval and renewal using the ACME protocol. This is currently only -implemented by and for Let's Encrypt. The alternative ACME client -simp_le is used under the hood. - -
Prerequisites - -You need to have a running HTTP server for verification. The server must -have a webroot defined that can serve -.well-known/acme-challenge. This directory must be -writeable by the user that will run the ACME client. - -For instance, this generic snippet could be used for Nginx: + + You need to have a running HTTP server for verification. The server must + have a webroot defined that can serve + .well-known/acme-challenge. This directory must be + writeable by the user that will run the ACME client. + + + For instance, this generic snippet could be used for Nginx: http { server { @@ -37,43 +39,47 @@ http { } } - - -
- -
Configuring - -To enable ACME certificate retrieval & renewal for a certificate for -foo.example.com, add the following in your -configuration.nix: + +
+
+ Configuring + + To enable ACME certificate retrieval & renewal for a certificate for + foo.example.com, add the following in your + configuration.nix: ."foo.example.com" = { webroot = "/var/www/challenges"; email = "foo@example.com"; }; - + -The private key key.pem and certificate -fullchain.pem will be put into -/var/lib/acme/foo.example.com. The target directory can -be configured with the option . - + + The private key key.pem and certificate + fullchain.pem will be put into + /var/lib/acme/foo.example.com. The target directory can + be configured with the option . + -Refer to for all available configuration -options for the security.acme module. + + Refer to for all available configuration + options for the security.acme + module. + +
+
+ Using ACME certificates in Nginx -
- -
Using ACME certificates in Nginx -NixOS supports fetching ACME certificates for you by setting - enableACME = true; in a virtualHost config. We -first create self-signed placeholder certificates in place of the -real ACME certs. The placeholder certs are overwritten when the ACME -certs arrive. For foo.example.com the config would -look like. - + + NixOS supports fetching ACME certificates for you by setting + enableACME + = true; in a virtualHost config. We first create self-signed + placeholder certificates in place of the real ACME certs. The placeholder + certs are overwritten when the ACME certs arrive. For + foo.example.com the config would look like. + services.nginx = { @@ -89,5 +95,5 @@ services.nginx = { }; } -
+
diff --git a/nixos/modules/security/hidepid.xml b/nixos/modules/security/hidepid.xml index d69341eb3cde..5a17cb1da412 100644 --- a/nixos/modules/security/hidepid.xml +++ b/nixos/modules/security/hidepid.xml @@ -3,31 +3,26 @@ xmlns:xi="http://www.w3.org/2001/XInclude" version="5.0" xml:id="sec-hidepid"> - - Hiding process information - - - Setting + Hiding process information + + Setting = true; - ensures that access to process information is restricted to the - owning user. This implies, among other things, that command-line - arguments remain private. Unless your deployment relies on unprivileged - users being able to inspect the process information of other users, this - option should be safe to enable. - - - - Members of the proc group are exempt from process - information hiding. - - - - To allow a service foo to run without process information hiding, set + ensures that access to process information is restricted to the owning user. + This implies, among other things, that command-line arguments remain private. + Unless your deployment relies on unprivileged users being able to inspect the + process information of other users, this option should be safe to enable. + + + Members of the proc group are exempt from process + information hiding. + + + To allow a service foo to run without process + information hiding, set systemd.services.foo.serviceConfig.SupplementaryGroups = [ "proc" ]; - - + diff --git a/nixos/modules/services/databases/foundationdb.xml b/nixos/modules/services/databases/foundationdb.xml index 7883680d46cc..bf4b644c9b86 100644 --- a/nixos/modules/services/databases/foundationdb.xml +++ b/nixos/modules/services/databases/foundationdb.xml @@ -3,42 +3,50 @@ xmlns:xi="http://www.w3.org/2001/XInclude" version="5.0" xml:id="module-services-foundationdb"> + FoundationDB + + Source: + modules/services/databases/foundationdb.nix + + + Upstream documentation: + + + + Maintainer: Austin Seipp + + + Available version(s): 5.1.x, 5.2.x, 6.0.x + + + FoundationDB (or "FDB") is an open source, distributed, transactional + key-value store. + +
+ Configuring and basic setup -FoundationDB - -Source: modules/services/databases/foundationdb.nix - -Upstream documentation: - -Maintainer: Austin Seipp - -Available version(s): 5.1.x, 5.2.x, 6.0.x - -FoundationDB (or "FDB") is an open source, distributed, transactional -key-value store. - -
Configuring and basic setup - -To enable FoundationDB, add the following to your -configuration.nix: - + + To enable FoundationDB, add the following to your + configuration.nix: services.foundationdb.enable = true; services.foundationdb.package = pkgs.foundationdb52; # FoundationDB 5.2.x - + -The option is required, -and must always be specified. Due to the fact FoundationDB network protocols and -on-disk storage formats may change between (major) versions, and upgrades must -be explicitly handled by the user, you must always manually specify this -yourself so that the NixOS module will use the proper version. Note that minor, -bugfix releases are always compatible. - -After running nixos-rebuild, you can verify whether -FoundationDB is running by executing fdbcli (which is added -to ): + + The option is required, and + must always be specified. Due to the fact FoundationDB network protocols and + on-disk storage formats may change between (major) versions, and upgrades + must be explicitly handled by the user, you must always manually specify + this yourself so that the NixOS module will use the proper version. Note + that minor, bugfix releases are always compatible. + + + After running nixos-rebuild, you can verify whether + FoundationDB is running by executing fdbcli (which is + added to ): $ sudo -u foundationdb fdbcli Using cluster file `/etc/foundationdb/fdb.cluster'. @@ -66,14 +74,14 @@ Cluster: fdb> - - -You can also write programs using the available client libraries. -For example, the following Python program can be run in order to grab the -cluster status, as a quick example. (This example uses -nix-shell shebang support to automatically supply the -necessary Python modules). + + + You can also write programs using the available client libraries. For + example, the following Python program can be run in order to grab the + cluster status, as a quick example. (This example uses + nix-shell shebang support to automatically supply the + necessary Python modules). a@link> cat fdb-status.py #! /usr/bin/env nix-shell @@ -100,255 +108,336 @@ a@link> ./fdb-status.py FoundationDB available: True a@link> - + -FoundationDB is run under the foundationdb user and -group by default, but this may be changed in the NixOS configuration. The -systemd unit foundationdb.service controls the -fdbmonitor process. + + FoundationDB is run under the foundationdb user and group + by default, but this may be changed in the NixOS configuration. The systemd + unit foundationdb.service controls the + fdbmonitor process. + -By default, the NixOS module for FoundationDB creates a single -SSD-storage based database for development and basic usage. This storage engine -is designed for SSDs and will perform poorly on HDDs; however it can handle far -more data than the alternative "memory" engine and is a better default choice -for most deployments. (Note that you can change the storage backend on-the-fly -for a given FoundationDB cluster using fdbcli.) + + By default, the NixOS module for FoundationDB creates a single SSD-storage + based database for development and basic usage. This storage engine is + designed for SSDs and will perform poorly on HDDs; however it can handle far + more data than the alternative "memory" engine and is a better default + choice for most deployments. (Note that you can change the storage backend + on-the-fly for a given FoundationDB cluster using + fdbcli.) + -Furthermore, only 1 server process and 1 backup agent are started in the -default configuration. See below for more on scaling to increase this. - -FoundationDB stores all data for all server processes under -/var/lib/foundationdb. You can override this using -, e.g. + + Furthermore, only 1 server process and 1 backup agent are started in the + default configuration. See below for more on scaling to increase this. + + + FoundationDB stores all data for all server processes under + /var/lib/foundationdb. You can override this using + , e.g. services.foundationdb.dataDir = "/data/fdb"; + - + + Similarly, logs are stored under /var/log/foundationdb + by default, and there is a corresponding + as well. + +
+
+ Scaling processes and backup agents -Similarly, logs are stored under -/var/log/foundationdb by default, and there is a -corresponding as well. + + Scaling the number of server processes is quite easy; simply specify + to be the number of + FoundationDB worker processes that should be started on the machine. + -
+ + FoundationDB worker processes typically require 4GB of RAM per-process at + minimum for good performance, so this option is set to 1 by default since + the maximum amount of RAM is unknown. You're advised to abide by this + restriction, so pick a number of processes so that each has 4GB or more. + -
Scaling processes and backup agents + + A similar option exists in order to scale backup agent processes, + . Backup agents are + not as performance/RAM sensitive, so feel free to experiment with the number + of available backup processes. + +
+
+ Clustering -Scaling the number of server processes is quite easy; simply specify - to be the number of -FoundationDB worker processes that should be started on the machine. + + FoundationDB on NixOS works similarly to other Linux systems, so this + section will be brief. Please refer to the full FoundationDB documentation + for more on clustering. + -FoundationDB worker processes typically require 4GB of RAM per-process at -minimum for good performance, so this option is set to 1 by default since the -maximum amount of RAM is unknown. You're advised to abide by this restriction, -so pick a number of processes so that each has 4GB or more. + + FoundationDB organizes clusters using a set of + coordinators, which are just specially-designated + worker processes. By default, every installation of FoundationDB on NixOS + will start as its own individual cluster, with a single coordinator: the + first worker process on localhost. + -A similar option exists in order to scale backup agent processes, -. Backup agents are not -as performance/RAM sensitive, so feel free to experiment with the number of -available backup processes. + + Coordinators are specified globally using the + /etc/foundationdb/fdb.cluster file, which all servers and + client applications will use to find and join coordinators. Note that this + file can not be managed by NixOS so easily: + FoundationDB is designed so that it will rewrite the file at runtime for all + clients and nodes when cluster coordinators change, with clients + transparently handling this without intervention. It is fundamentally a + mutable file, and you should not try to manage it in any way in NixOS. + -
+ + When dealing with a cluster, there are two main things you want to do: + -
Clustering + + + + Add a node to the cluster for storage/compute. + + + + + Promote an ordinary worker to a coordinator. + + + -FoundationDB on NixOS works similarly to other Linux systems, so this -section will be brief. Please refer to the full FoundationDB documentation for -more on clustering. + + A node must already be a member of the cluster in order to properly be + promoted to a coordinator, so you must always add it first if you wish to + promote it. + -FoundationDB organizes clusters using a set of -coordinators, which are just specially-designated worker -processes. By default, every installation of FoundationDB on NixOS will start -as its own individual cluster, with a single coordinator: the first worker -process on localhost. + + To add a machine to a FoundationDB cluster: + -Coordinators are specified globally using the -/etc/foundationdb/fdb.cluster file, which all servers and -client applications will use to find and join coordinators. Note that this file -can not be managed by NixOS so easily: FoundationDB is -designed so that it will rewrite the file at runtime for all clients and nodes -when cluster coordinators change, with clients transparently handling this -without intervention. It is fundamentally a mutable file, and you should not -try to manage it in any way in NixOS. + + + + Choose one of the servers to start as the initial coordinator. + + + + + Copy the /etc/foundationdb/fdb.cluster file from this + server to all the other servers. Restart FoundationDB on all of these + other servers, so they join the cluster. + + + + + All of these servers are now connected and working together in the + cluster, under the chosen coordinator. + + + -When dealing with a cluster, there are two main things you want to -do: + + At this point, you can add as many nodes as you want by just repeating the + above steps. By default there will still be a single coordinator: you can + use fdbcli to change this and add new coordinators. + - - Add a node to the cluster for storage/compute. - Promote an ordinary worker to a coordinator. - + + As a convenience, FoundationDB can automatically assign coordinators based + on the redundancy mode you wish to achieve for the cluster. Once all the + nodes have been joined, simply set the replication policy, and then issue + the coordinators auto command + -A node must already be a member of the cluster in order to properly be -promoted to a coordinator, so you must always add it first if you wish to -promote it. - -To add a machine to a FoundationDB cluster: - - - Choose one of the servers to start as the initial coordinator. - - Copy the /etc/foundationdb/fdb.cluster file - from this server to all the other servers. Restart FoundationDB on all of - these other servers, so they join the cluster. - All of these servers are now connected and working together - in the cluster, under the chosen coordinator. - - -At this point, you can add as many nodes as you want by just repeating -the above steps. By default there will still be a single coordinator: you can -use fdbcli to change this and add new coordinators. - -As a convenience, FoundationDB can automatically assign coordinators -based on the redundancy mode you wish to achieve for the cluster. Once all the -nodes have been joined, simply set the replication policy, and then issue the -coordinators auto command - -For example, assuming we have 3 nodes available, we can enable double -redundancy mode, then auto-select coordinators. For double redundancy, 3 -coordinators is ideal: therefore FoundationDB will make -every node a coordinator automatically: + + For example, assuming we have 3 nodes available, we can enable double + redundancy mode, then auto-select coordinators. For double redundancy, 3 + coordinators is ideal: therefore FoundationDB will make + every node a coordinator automatically: + fdbcli> configure double ssd fdbcli> coordinators auto -This will transparently update all the servers within seconds, and -appropriately rewrite the fdb.cluster file, as well as -informing all client processes to do the same. + + This will transparently update all the servers within seconds, and + appropriately rewrite the fdb.cluster file, as well as + informing all client processes to do the same. + +
+
+ Client connectivity -
+ + By default, all clients must use the current fdb.cluster + file to access a given FoundationDB cluster. This file is located by default + in /etc/foundationdb/fdb.cluster on all machines with the + FoundationDB service enabled, so you may copy the active one from your + cluster to a new node in order to connect, if it is not part of the cluster. + +
+
+ Client authorization and TLS -
Client connectivity + + By default, any user who can connect to a FoundationDB process with the + correct cluster configuration can access anything. FoundationDB uses a + pluggable design to transport security, and out of the box it supports a + LibreSSL-based plugin for TLS support. This plugin not only does in-flight + encryption, but also performs client authorization based on the given + endpoint's certificate chain. For example, a FoundationDB server may be + configured to only accept client connections over TLS, where the client TLS + certificate is from organization Acme Co in the + Research and Development unit. + -By default, all clients must use the current -fdb.cluster file to access a given FoundationDB cluster. -This file is located by default in -/etc/foundationdb/fdb.cluster on all machines with the -FoundationDB service enabled, so you may copy the active one from your cluster -to a new node in order to connect, if it is not part of the cluster. + + Configuring TLS with FoundationDB is done using the + options in order to control the + peer verification string, as well as the certificate and its private key. + -
+ + Note that the certificate and its private key must be accessible to the + FoundationDB user account that the server runs under. These files are also + NOT managed by NixOS, as putting them into the store may reveal private + information. + -
Client authorization and TLS - -By default, any user who can connect to a FoundationDB process with the -correct cluster configuration can access anything. FoundationDB uses a -pluggable design to transport security, and out of the box it supports a -LibreSSL-based plugin for TLS support. This plugin not only does in-flight -encryption, but also performs client authorization based on the given -endpoint's certificate chain. For example, a FoundationDB server may be -configured to only accept client connections over TLS, where the client TLS -certificate is from organization Acme Co in the -Research and Development unit. - -Configuring TLS with FoundationDB is done using the - options in order to control the peer -verification string, as well as the certificate and its private key. - -Note that the certificate and its private key must be accessible to the -FoundationDB user account that the server runs under. These files are also NOT -managed by NixOS, as putting them into the store may reveal private -information. - -After you have a key and certificate file in place, it is not enough to -simply set the NixOS module options -- you must also configure the -fdb.cluster file to specify that a given set of coordinators -use TLS. This is as simple as adding the suffix :tls to your -cluster coordinator configuration, after the port number. For example, assuming -you have a coordinator on localhost with the default configuration, simply -specifying: + + After you have a key and certificate file in place, it is not enough to + simply set the NixOS module options -- you must also configure the + fdb.cluster file to specify that a given set of + coordinators use TLS. This is as simple as adding the suffix + :tls to your cluster coordinator configuration, after the + port number. For example, assuming you have a coordinator on localhost with + the default configuration, simply specifying: + XXXXXX:XXXXXX@127.0.0.1:4500:tls -will configure all clients and server processes to use TLS from now -on. + + will configure all clients and server processes to use TLS from now on. + +
+
+ Backups and Disaster Recovery -
+ + The usual rules for doing FoundationDB backups apply on NixOS as written in + the FoundationDB manual. However, one important difference is the security + profile for NixOS: by default, the foundationdb systemd + unit uses Linux namespaces to restrict write access to + the system, except for the log directory, data directory, and the + /etc/foundationdb/ directory. This is enforced by default + and cannot be disabled. + -
Backups and Disaster Recovery + + However, a side effect of this is that the fdbbackup + command doesn't work properly for local filesystem backups: FoundationDB + uses a server process alongside the database processes to perform backups + and copy the backups to the filesystem. As a result, this process is put + under the restricted namespaces above: the backup process can only write to + a limited number of paths. + -The usual rules for doing FoundationDB backups apply on NixOS as written -in the FoundationDB manual. However, one important difference is the security -profile for NixOS: by default, the foundationdb systemd unit -uses Linux namespaces to restrict write access to the -system, except for the log directory, data directory, and the -/etc/foundationdb/ directory. This is enforced by default -and cannot be disabled. + + In order to allow flexible backup locations on local disks, the FoundationDB + NixOS module supports a + option. This + option takes a list of paths, and adds them to the systemd unit, allowing + the processes inside the service to write (and read) the specified + directories. + -However, a side effect of this is that the fdbbackup -command doesn't work properly for local filesystem backups: FoundationDB uses a -server process alongside the database processes to perform backups and copy the -backups to the filesystem. As a result, this process is put under the -restricted namespaces above: the backup process can only write to a limited -number of paths. - -In order to allow flexible backup locations on local disks, the -FoundationDB NixOS module supports a - option. This option -takes a list of paths, and adds them to the systemd unit, allowing the -processes inside the service to write (and read) the specified -directories. - -For example, to create backups in /opt/fdb-backups, -first set up the paths in the module options: + + For example, to create backups in /opt/fdb-backups, first + set up the paths in the module options: + services.foundationdb.extraReadWritePaths = [ "/opt/fdb-backups" ]; -Restart the FoundationDB service, and it will now be able to write to -this directory (even if it does not yet exist.) Note: this path -must exist before restarting the unit. Otherwise, systemd -will not include it in the private FoundationDB namespace (and it will not add -it dynamically at runtime). + + Restart the FoundationDB service, and it will now be able to write to this + directory (even if it does not yet exist.) Note: this path + must exist before restarting the unit. Otherwise, + systemd will not include it in the private FoundationDB namespace (and it + will not add it dynamically at runtime). + -You can now perform a backup: + + You can now perform a backup: + $ sudo -u foundationdb fdbbackup start -t default -d file:///opt/fdb-backups $ sudo -u foundationdb fdbbackup status -t default +
+
+ Known limitations -
+ + The FoundationDB setup for NixOS should currently be considered beta. + FoundationDB is not new software, but the NixOS compilation and integration + has only undergone fairly basic testing of all the available functionality. + -
Known limitations + + + + There is no way to specify individual parameters for individual + fdbserver processes. Currently, all server processes + inherit all the global fdbmonitor settings. + + + + + Ruby bindings are not currently installed. + + + + + Go bindings are not currently installed. + + + +
+
+ Options -The FoundationDB setup for NixOS should currently be considered beta. -FoundationDB is not new software, but the NixOS compilation and integration has -only undergone fairly basic testing of all the available functionality. - - - There is no way to specify individual parameters for - individual fdbserver processes. Currently, all server - processes inherit all the global fdbmonitor settings. - - Ruby bindings are not currently installed. - Go bindings are not currently installed. - - -
- -
Options - -NixOS's FoundationDB module allows you to configure all of the most -relevant configuration options for fdbmonitor, matching it -quite closely. A complete list of options for the FoundationDB module may be -found here. You should -also read the FoundationDB documentation as well. - -
- -
Full documentation - -FoundationDB is a complex piece of software, and requires careful -administration to properly use. Full documentation for administration can be -found here: . - -
+ + NixOS's FoundationDB module allows you to configure all of the most relevant + configuration options for fdbmonitor, matching it quite + closely. A complete list of options for the FoundationDB module may be found + here. You should + also read the FoundationDB documentation as well. + +
+
+ Full documentation + + FoundationDB is a complex piece of software, and requires careful + administration to properly use. Full documentation for administration can be + found here: . + +
diff --git a/nixos/modules/services/databases/postgresql.xml b/nixos/modules/services/databases/postgresql.xml index 1aaf33963245..f89f0d653164 100644 --- a/nixos/modules/services/databases/postgresql.xml +++ b/nixos/modules/services/databases/postgresql.xml @@ -3,36 +3,39 @@ xmlns:xi="http://www.w3.org/2001/XInclude" version="5.0" xml:id="module-postgresql"> - -PostgreSQL - + PostgreSQL - -Source: modules/services/databases/postgresql.nix - -Upstream documentation: - + + Source: + modules/services/databases/postgresql.nix + + + Upstream documentation: + + + + PostgreSQL is an advanced, free relational database. + + +
+ Configuring -PostgreSQL is an advanced, free relational database. - -
Configuring - -To enable PostgreSQL, add the following to your -configuration.nix: - + + To enable PostgreSQL, add the following to your + configuration.nix: = true; = pkgs.postgresql94; - -Note that you are required to specify the desired version of -PostgreSQL (e.g. pkgs.postgresql94). Since -upgrading your PostgreSQL version requires a database dump and reload -(see below), NixOS cannot provide a default value for - such as the most recent -release of PostgreSQL. + Note that you are required to specify the desired version of PostgreSQL + (e.g. pkgs.postgresql94). Since upgrading your PostgreSQL + version requires a database dump and reload (see below), NixOS cannot + provide a default value for + such as the most recent + release of PostgreSQL. + -By default, PostgreSQL stores its databases in -/var/db/postgresql. You can override this using -, e.g. - + + By default, PostgreSQL stores its databases in + /var/db/postgresql. You can override this using + , e.g. = "/data/postgresql"; + +
+
+ Upgrading - - -
- - -
Upgrading - -FIXME: document dump/upgrade/load cycle. - -
- - -
Options - - A complete list of options for the PostgreSQL module may be found here. - -
- + + FIXME: document dump/upgrade/load cycle. + +
+
+ Options + + A complete list of options for the PostgreSQL module may be found + here. + +
diff --git a/nixos/modules/services/desktops/flatpak.xml b/nixos/modules/services/desktops/flatpak.xml index d9c8b711c450..8045d5fa14f8 100644 --- a/nixos/modules/services/desktops/flatpak.xml +++ b/nixos/modules/services/desktops/flatpak.xml @@ -3,51 +3,54 @@ xmlns:xi="http://www.w3.org/2001/XInclude" version="5.0" xml:id="module-services-flatpak"> - -Flatpak - -Source: modules/services/desktop/flatpak.nix - -Upstream documentation: - -Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. - - - To enable Flatpak, add the following to your configuration.nix: - - + Flatpak + + Source: + modules/services/desktop/flatpak.nix + + + Upstream documentation: + + + + Flatpak is a system for building, distributing, and running sandboxed desktop + applications on Linux. + + + To enable Flatpak, add the following to your + configuration.nix: + = true; - - - - For the sandboxed apps to work correctly, desktop integration portals need to be installed. If you run GNOME, this will be handled automatically for you; in other cases, you will need to add something like the following to your configuration.nix: - - + + + For the sandboxed apps to work correctly, desktop integration portals need to + be installed. If you run GNOME, this will be handled automatically for you; + in other cases, you will need to add something like the following to your + configuration.nix: + = [ pkgs.xdg-desktop-portal-gtk ]; - - - - Then, you will need to add a repository, for example, Flathub, either using the following commands: - - + + + Then, you will need to add a repository, for example, + Flathub, + either using the following commands: + flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo flatpak update - - or by opening the repository file in GNOME Software. - - - + or by opening the + repository + file in GNOME Software. + + Finally, you can search and install programs: - - + flatpak search bustle flatpak install flathub org.freedesktop.Bustle flatpak run org.freedesktop.Bustle - Again, GNOME Software offers graphical interface for these tasks. - + diff --git a/nixos/modules/services/editors/emacs.xml b/nixos/modules/services/editors/emacs.xml index 94eb2e6a77bf..6cf20cf4aa7e 100644 --- a/nixos/modules/services/editors/emacs.xml +++ b/nixos/modules/services/editors/emacs.xml @@ -3,150 +3,148 @@ xmlns:xi="http://www.w3.org/2001/XInclude" version="5.0" xml:id="module-services-emacs"> - - Emacs - - + + Emacs is an + extensible, customizable, self-documenting real-time display editor — and + more. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp + programming language with extensions to support text editing. + + + Emacs runs within a graphical desktop environment using the X Window System, + but works equally well on a text terminal. Under + macOS, a "Mac port" edition is available, which + uses Apple's native GUI frameworks. + + + Nixpkgs provides a superior environment for + running Emacs. It's simple to create custom builds + by overriding the default packages. Chaotic collections of Emacs Lisp code + and extensions can be brought under control using declarative package + management. NixOS even provides a + systemd user service for automatically starting the Emacs + daemon. + +
+ Installing <application>Emacs</application> - Emacs - is an extensible, customizable, self-documenting real-time display - editor — and more. At its core is an interpreter for Emacs Lisp, a - dialect of the Lisp programming language with extensions to - support text editing. + Emacs can be installed in the normal way for Nix (see + ). In addition, a NixOS + service can be enabled. - - Emacs runs within a graphical desktop environment using the X - Window System, but works equally well on a text terminal. Under - macOS, a "Mac port" edition is - available, which uses Apple's native GUI frameworks. - +
+ The Different Releases of Emacs - - Nixpkgs provides a superior environment - for running Emacs. It's simple to - create custom builds by overriding the default packages. Chaotic - collections of Emacs Lisp code and extensions can be brought under - control using declarative package - management. NixOS even provides a - systemd user service for automatically - starting the Emacs daemon. - + + Nixpkgs defines several basic Emacs packages. + The following are attributes belonging to the pkgs set: + + + + emacs + + + emacs25 + + + + The latest stable version of Emacs 25 using the + GTK+ 2 + widget toolkit. + + + + + + emacs25-nox + + + + Emacs 25 built without any dependency on X11 libraries. + + + + + + emacsMacport + + + emacs25Macport + + + + Emacs 25 with the "Mac port" patches, providing a more native look and + feel under macOS. + + + + + -
- Installing <application>Emacs</application> + + If those aren't suitable, then the following imitation Emacs editors are + also available in Nixpkgs: + Zile, + mg, + Yi. + +
- - Emacs can be installed in the normal way for Nix (see - ). - In addition, a NixOS service - can be enabled. - +
+ Adding Packages to Emacs -
- The Different Releases of Emacs + + Emacs includes an entire ecosystem of functionality beyond text editing, + including a project planner, mail and news reader, debugger interface, + calendar, and more. + - - Nixpkgs defines several basic Emacs - packages. The following are attributes belonging to the - pkgs set: - - - - emacs - emacs25 - - - The latest stable version of Emacs 25 using the GTK+ 2 widget - toolkit. - - - - - emacs25-nox - - - Emacs 25 built without any dependency on X11 - libraries. - - - - - emacsMacport - emacs25Macport - - - Emacs 25 with the "Mac port" patches, providing a more - native look and feel under macOS. - - - - - - - - If those aren't suitable, then the following imitation Emacs - editors are also available in Nixpkgs: - Zile, - mg, - Yi. - - -
-
- Adding Packages to Emacs - - Emacs includes an entire ecosystem of functionality beyond - text editing, including a project planner, mail and news - reader, debugger interface, calendar, and more. - - - - Most extensions are gotten with the Emacs packaging system - (package.el) from + Most extensions are gotten with the Emacs packaging system + (package.el) from + Emacs Lisp Package Archive - (ELPA), - MELPA, - MELPA Stable, - and Org ELPA. - Nixpkgs is regularly updated to mirror all these archives. - + (ELPA), + MELPA, + MELPA Stable, and + Org ELPA. Nixpkgs is + regularly updated to mirror all these archives. + - - Under NixOS, you can continue to use - package-list-packages and - package-install to install packages. You - can also declare the set of Emacs packages you need using the - derivations from Nixpkgs. The rest of this section discusses - declarative installation of Emacs packages through nixpkgs. - + + Under NixOS, you can continue to use + package-list-packages and + package-install to install packages. You can also + declare the set of Emacs packages you need using the derivations from + Nixpkgs. The rest of this section discusses declarative installation of + Emacs packages through nixpkgs. + - - - This documentation describes the new Emacs packages - framework in NixOS 16.03 - (emacsPackagesNg) which should not be - confused with the previous and deprecated framework - (emacs24Packages). - - + + + This documentation describes the new Emacs packages framework in NixOS + 16.03 (emacsPackagesNg) which should not be confused + with the previous and deprecated framework + (emacs24Packages). + + - - The first step to declare the list of packages you want in - your Emacs installation is to create a dedicated - derivation. This can be done in a dedicated - emacs.nix file such as: - - - Nix expression to build Emacs with packages (<filename>emacs.nix</filename>) - + + The first step to declare the list of packages you want in your Emacs + installation is to create a dedicated derivation. This can be done in a + dedicated emacs.nix file such as: + + Nix expression to build Emacs with packages (<filename>emacs.nix</filename>) + /* This is a nix expression to build Emacs and some Emacs packages I like from source on any distribution where Nix is installed. This will install @@ -181,119 +179,104 @@ in pkgs.notmuch # From main packages set ]) - - - - - - The first non-comment line in this file - ({ pkgs ? ... }) - indicates that the whole file represents a function. - - - - - - The let expression below defines a - myEmacs binding pointing to the current - stable version of Emacs. This binding is here to separate the - choice of the Emacs binary from the specification of the - required packages. - - - - - - This generates an emacsWithPackages - function. It takes a single argument: a function from a - package set to a list of packages (the packages that will - be available in Emacs). - - - - - - The rest of the file specifies the list of packages to - install. In the example, two packages - (magit and - zerodark-theme) are taken from MELPA - stable. - - - - - - Two packages (undo-tree and - zoom-frm) are taken from MELPA. - - - - - Three packages are taken from GNU ELPA. - - - - - notmuch is taken from a nixpkgs derivation - which contains an Emacs mode. - - - - - - + + + - The result of this configuration will be an - emacs command which launches Emacs with all - of your chosen packages in the load-path. + The first non-comment line in this file ({ pkgs ? ... + }) indicates that the whole file represents a function. - + + - You can check that it works by executing this in a terminal: + The let expression below defines a + myEmacs binding pointing to the current stable + version of Emacs. This binding is here to separate the choice of the + Emacs binary from the specification of the required packages. + + + + + This generates an emacsWithPackages function. It + takes a single argument: a function from a package set to a list of + packages (the packages that will be available in Emacs). + + + + + The rest of the file specifies the list of packages to install. In the + example, two packages (magit and + zerodark-theme) are taken from MELPA stable. + + + + + Two packages (undo-tree and + zoom-frm) are taken from MELPA. + + + + + Three packages are taken from GNU ELPA. + + + + + notmuch is taken from a nixpkgs derivation which + contains an Emacs mode. + + + + + + The result of this configuration will be an emacs + command which launches Emacs with all of your chosen packages in the + load-path. + + + + You can check that it works by executing this in a terminal: $ nix-build emacs.nix $ ./result/bin/emacs -q + and then typing M-x package-initialize. Check that you + can use all the packages you want in this Emacs instance. For example, try + switching to the zerodark theme through M-x load-theme <RET> + zerodark <RET> y. + - and then typing M-x package-initialize. - Check that you can use all the packages you want in this - Emacs instance. For example, try switching to the zerodark - theme through - M-x load-theme <RET> zerodark <RET> y. - + + + A few popular extensions worth checking out are: auctex, company, + edit-server, flycheck, helm, iedit, magit, multiple-cursors, projectile, + and yasnippet. + + - - - A few popular extensions worth checking out are: auctex, - company, edit-server, flycheck, helm, iedit, magit, - multiple-cursors, projectile, and yasnippet. - - - - - The list of available packages in the various ELPA - repositories can be seen with the following commands: - - Querying Emacs packages - + The list of available packages in the various ELPA repositories can be seen + with the following commands: + + Querying Emacs packages +" -qaP -A emacsPackagesNg.elpaPackages nix-env -f "" -qaP -A emacsPackagesNg.melpaPackages nix-env -f "" -qaP -A emacsPackagesNg.melpaStablePackages nix-env -f "" -qaP -A emacsPackagesNg.orgPackages ]]> - - + + - - If you are on NixOS, you can install this particular Emacs for - all users by adding it to the list of system packages - (see ). Simply - modify your file configuration.nix to - make it contain: - - Custom Emacs in <filename>configuration.nix</filename> - + If you are on NixOS, you can install this particular Emacs for all users by + adding it to the list of system packages (see + ). Simply modify your file + configuration.nix to make it contain: + + Custom Emacs in <filename>configuration.nix</filename> +" -qaP -A emacsPackagesNg.orgPackages ]; } ]]> - - + + - - In this case, the next nixos-rebuild switch - will take care of adding your emacs to the - PATH environment variable - (see ). - + + In this case, the next nixos-rebuild switch will take + care of adding your emacs to the PATH + environment variable (see ). + - - If you are not on NixOS or want to install this particular - Emacs only for yourself, you can do so by adding it to your - ~/.config/nixpkgs/config.nix - (see Nixpkgs manual): - - Custom Emacs in <filename>~/.config/nixpkgs/config.nix</filename> - + If you are not on NixOS or want to install this particular Emacs only for + yourself, you can do so by adding it to your + ~/.config/nixpkgs/config.nix (see + Nixpkgs + manual): + + Custom Emacs in <filename>~/.config/nixpkgs/config.nix</filename> + - - + + - - In this case, the next - nix-env -f '<nixpkgs>' -iA myemacs - will take care of adding your emacs to the - PATH environment variable. - -
+ + In this case, the next nix-env -f '<nixpkgs>' -iA + myemacs will take care of adding your emacs to the + PATH environment variable. + +
-
- Advanced Emacs Configuration +
+ Advanced Emacs Configuration - - If you want, you can tweak the Emacs package itself from your - emacs.nix. For example, if you want to - have a GTK+3-based Emacs instead of the default GTK+2-based - binary and remove the automatically generated - emacs.desktop (useful is you only use - emacsclient), you can change your file - emacs.nix in this way: - + + If you want, you can tweak the Emacs package itself from your + emacs.nix. For example, if you want to have a + GTK+3-based Emacs instead of the default GTK+2-based binary and remove the + automatically generated emacs.desktop (useful is you + only use emacsclient), you can change your file + emacs.nix in this way: + - - Custom Emacs build - + Custom Emacs build + {} }: let myEmacs = (pkgs.emacs.override { @@ -370,161 +352,143 @@ let }); in [...] ]]> - + - - After building this file as shown in , - you will get an GTK3-based Emacs binary pre-loaded with your - favorite packages. - -
+ + After building this file as shown in , you + will get an GTK3-based Emacs binary pre-loaded with your favorite packages. +
- -
+
+
Running Emacs as a Service + - NixOS provides an optional - systemd service which launches - - Emacs daemon - - with the user's login session. + NixOS provides an optional + systemd service which launches + + Emacs daemon with the user's login session. - Source: - modules/services/editors/emacs.nix + Source: + modules/services/editors/emacs.nix
- Enabling the Service - - - To install and enable the systemd - user service for Emacs daemon, add the following to your - configuration.nix: + Enabling the Service + + To install and enable the systemd user service for Emacs + daemon, add the following to your configuration.nix: = true; = import /home/cassou/.emacs.d { pkgs = pkgs; }; - + - - The services.emacs.package option allows a - custom derivation to be used, for example, one created by - emacsWithPackages. - + + The services.emacs.package option allows a custom + derivation to be used, for example, one created by + emacsWithPackages. + - - Ensure that the Emacs server is enabled for your user's Emacs - configuration, either by customizing the - server-mode variable, or by adding - (server-start) to - ~/.emacs.d/init.el. - - - - To start the daemon, execute the following: + + Ensure that the Emacs server is enabled for your user's Emacs + configuration, either by customizing the server-mode + variable, or by adding (server-start) to + ~/.emacs.d/init.el. + + + To start the daemon, execute the following: $ nixos-rebuild switch # to activate the new configuration.nix $ systemctl --user daemon-reload # to force systemd reload $ systemctl --user start emacs.service # to start the Emacs daemon - - The server should now be ready to serve Emacs clients. - - + The server should now be ready to serve Emacs clients. +
- Starting the client - - Ensure that the emacs server is enabled, either by customizing - the server-mode variable, or by adding - (server-start) to - ~/.emacs. - + Starting the client - - To connect to the emacs daemon, run one of the following: - + Ensure that the emacs server is enabled, either by customizing the + server-mode variable, or by adding + (server-start) to ~/.emacs. + + + + To connect to the emacs daemon, run one of the following: + - +
- Configuring the <varname>EDITOR</varname> variable - + Configuring the <varname>EDITOR</varname> variable - - If is - true, the EDITOR variable - will be set to a wrapper script which launches - emacsclient. - + - - Any setting of EDITOR in the shell config - files will override - services.emacs.defaultEditor. - To make sure EDITOR refers to the Emacs - wrapper script, remove any existing EDITOR - assignment from .profile, - .bashrc, .zshenv or - any other shell config file. - + + If is + true, the EDITOR variable will be set + to a wrapper script which launches emacsclient. + - - If you have formed certain bad habits when editing files, - these can be corrected with a shell alias to the wrapper - script: - alias vi=$EDITOR - + + Any setting of EDITOR in the shell config files will + override services.emacs.defaultEditor. To make sure + EDITOR refers to the Emacs wrapper script, remove any + existing EDITOR assignment from + .profile, .bashrc, + .zshenv or any other shell config file. + + + + If you have formed certain bad habits when editing files, these can be + corrected with a shell alias to the wrapper script: +alias vi=$EDITOR +
- Per-User Enabling of the Service - - - In general, systemd user services - are globally enabled by symlinks in - /etc/systemd/user. In the case where - Emacs daemon is not wanted for all users, it is possible to - install the service but not globally enable it: + Per-User Enabling of the Service + + In general, systemd user services are globally enabled + by symlinks in /etc/systemd/user. In the case where + Emacs daemon is not wanted for all users, it is possible to install the + service but not globally enable it: = false; = true; - + - - To enable the systemd user service for just - the currently logged in user, run: - - systemctl --user enable emacs - - This will add the symlink - ~/.config/systemd/user/emacs.service. - + + To enable the systemd user service for just the + currently logged in user, run: +systemctl --user enable emacs + This will add the symlink + ~/.config/systemd/user/emacs.service. +
-
- -
+
+
Configuring Emacs - The Emacs init file should be changed to load the extension - packages at startup: - - - Package initialization in <filename>.emacs</filename> - + Package initialization in <filename>.emacs</filename> + - + - After the declarative emacs package configuration has been - tested, previously downloaded packages can be cleaned up by - removing ~/.emacs.d/elpa (do make a backup - first, in case you forgot a package). + After the declarative emacs package configuration has been tested, + previously downloaded packages can be cleaned up by removing + ~/.emacs.d/elpa (do make a backup first, in case you + forgot a package). -
- A Major Mode for Nix Expressions + A Major Mode for Nix Expressions - - Of interest may be melpaPackages.nix-mode, - which provides syntax highlighting for the Nix language. This is - particularly convenient if you regularly edit Nix files. - + + Of interest may be melpaPackages.nix-mode, which + provides syntax highlighting for the Nix language. This is particularly + convenient if you regularly edit Nix files. +
- Accessing man pages - - You can use woman to get completion of all - available man pages. For example, type M-x woman - <RET> nixos-rebuild <RET>. - + Accessing man pages + + + You can use woman to get completion of all available + man pages. For example, type M-x woman <RET> nixos-rebuild + <RET>. +
- Editing DocBook 5 XML Documents - - Emacs includes Editing DocBook 5 XML Documents + + + Emacs includes + nXML, - a major-mode for validating and editing XML documents. - When editing DocBook 5.0 documents, such as - this one, - nXML needs to be configured with the relevant schema, which is - not included. - + a major-mode for validating and editing XML documents. When editing DocBook + 5.0 documents, such as this one, + nXML needs to be configured with the relevant schema, which is not + included. + - - To install the DocBook 5.0 schemas, either add - pkgs.docbook5 to - ( + To install the DocBook 5.0 schemas, either add + pkgs.docbook5 to + + (NixOS), or run - nix-env -i pkgs.docbook5 - (Nix). - + nix-env -i pkgs.docbook5 + (Nix). + - - Then customize the variable rng-schema-locating-files to include ~/.emacs.d/schemas.xml and put the following text into that file: - - nXML Schema Configuration (<filename>~/.emacs.d/schemas.xml</filename>) - + Then customize the variable rng-schema-locating-files to + include ~/.emacs.d/schemas.xml and put the following + text into that file: + + nXML Schema Configuration (<filename>~/.emacs.d/schemas.xml</filename>) +