Commit Graph

59 Commits

Author SHA1 Message Date
ChanningHe
ba380a05c9 nixos/komodo-periphery: v2.0.0+ support 2026-06-29 11:57:09 +09:00
ChanningHe
c58c765fa5 nixos/komodo-periphery: init module 2025-12-12 15:30:03 +09:00
Florian
9768ddcc51 nixos/pgadmin: Apply more hardening settings (#449299) 2025-10-14 04:58:50 +00:00
Felix Singer
cc38ed4577 nixos/pgadmin: Use lib.mkEnableOption where possible
Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 16:03:09 +02:00
Felix Singer
3d4b08cd40 nixos/pgadmin: Set ProtectProc to invisble in service config
For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ProtectProc=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 15:43:12 +02:00
Felix Singer
c268ff5f26 nixos/pgadmin: Set ProtectControlGroups to strict in service config
For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ProtectControlGroups=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 15:42:41 +02:00
Felix Singer
f0f0fcee17 nixos/pgadmin: Enable PrivateUsers hardening in service config
For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#PrivateUsers=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 15:42:06 +02:00
Felix Singer
915cb926cf nixos/pgadmin: Enable MountAPIVFS hardening in service config
This setting is already implied by others, but add it for completeness
as well. For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#MountAPIVFS=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 15:41:07 +02:00
Felix Singer
7e86ecfaf0 nixos/pgadmin: Ensure proper permissions for state directory
Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 02:33:24 +02:00
Felix Singer
1d41699431 nixos/pgadmin: Ensure proper permissions for logs directory
Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 02:32:40 +02:00
Florian
5a8b8b2b9d nixos/pgadmin: Apply hardening options (#441052) 2025-09-22 06:31:41 +00:00
Johannes Kirschbauer
30b647732c nixos/modules: meshcentral use correct type in freeformType 2025-09-14 11:37:18 +02:00
Felix Singer
35693b3279 nixos/pgadmin: Apply hardening options
Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-09-11 07:20:07 +02:00
Joachim Ernst
f976e53564 nixos/oxidized: allow for providing config by other means
- especially usefull, when secrets are used in configFile
  and `replace-secret` or `scalpel` should be used
2025-08-07 14:26:35 +02:00
Wolfgang Walther
5a0711127c treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
Wolfgang Walther
41c5662cbe nixos/postgresql: move postStart into separate unit
This avoids restarting the postgresql server, when only ensureDatabases
or ensureUsers have been changed. It will also allow to properly wait
for recovery to finish later.

To wait for "postgresql is ready" in other services, we now provide a
postgresql.target.

Resolves #400018

Co-authored-by: Marcel <me@m4rc3l.de>
2025-06-24 15:26:47 +02:00
liberodark
99bdbcbd01 oxidized: fix symlink 2025-05-30 11:05:47 +02:00
liberodark
5fffaee9e9 oxidized: switch to tmpfiles 2025-05-07 16:03:33 +02:00
Silvan Mosberger
4f0dadbf38 treewide: format all inactive Nix files
After final improvements to the official formatter implementation,
this commit now performs the first treewide reformat of Nix files using it.
This is part of the implementation of RFC 166.

Only "inactive" files are reformatted, meaning only files that
aren't being touched by any PR with activity in the past 2 months.
This is to avoid conflicts for PRs that might soon be merged.
Later we can do a full treewide reformat to get the rest,
which should not cause as many conflicts.

A CI check has already been running for some time to ensure that new and
already-formatted files are formatted, so the files being reformatted here
should also stay formatted.

This commit was automatically created and can be verified using

    nix-build a08b3a4d19.tar.gz \
      --argstr baseRev b32a094368
    result/bin/apply-formatting $NIXPKGS_PATH
2024-12-10 20:26:33 +01:00
Felix Buehler
5a670b332a nixos/services.salt.minion: remove with lib; 2024-11-27 22:26:57 +01:00
Felix Buehler
503fd3014a nixos/services.oxidized: remove with lib; 2024-11-27 22:26:57 +01:00
Felix Buehler
5e67f3e4c8 nixos/services.pgadmin: remove with lib; 2024-09-15 10:43:46 +02:00
Felix Buehler
3e47355b3f nixos/services.salt.master: remove with lib; 2024-08-30 00:30:38 +02:00
éclairevoyant
aeee4fc133 treewide: replace mkPackageOptionMD with mkPackageOption 2024-06-26 23:05:42 -04:00
Linus Heckemann
e5adf0b547 maintainers: drop lheckemann 2024-06-21 15:54:54 +02:00
Maciej Krüger
a4776f9fc9 nixos/docuum: add missing options 2024-06-19 19:10:36 +02:00
TNE
4582b524ba pgadmin: Use systemd's LoadCredential for password files (#312569)
* pgadmin: Use systemd's LoadCredential for password files

* Update nixos/modules/services/admin/pgadmin.nix

---------

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
2024-05-19 00:16:00 +02:00
stuebinm
6afb255d97 nixos: remove all uses of lib.mdDoc
these changes were generated with nixq 0.0.2, by running

  nixq ">> lib.mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
  nixq ">> mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
  nixq ">> Inherit >> mdDoc[remove]" --batchmode nixos/**.nix

two mentions of the mdDoc function remain in nixos/, both of which
are inside of comments.

Since lib.mdDoc is already defined as just id, this commit is a no-op as
far as Nix (and the built manual) is concerned.
2024-04-13 10:07:35 -07:00
Bjørn Forsman
a29010fe79 nixos: improve many 'enable' descriptions 2024-04-09 07:10:17 +02:00
Maciej Krüger
94d6d4e93a nixos/docuum: add module for docuum package
Co-Authored-By: Martin Weinelt <mweinelt@users.noreply.github.com>
2024-03-23 18:25:55 +01:00
Florian Brandes
1c1ca56266 pgadmin: 8.1 -> 8.2
Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
2024-01-13 09:54:32 +01:00
Maciej Krüger
6ba04cc302 Merge pull request #270876 from gador/pgadmin-check-pw
nixos/pgadmin: add minimumPasswordLength setting and check
2024-01-12 21:00:40 +01:00
Marcel
0be0d8a860 nixos/pgadmin: disable upgrade check 2024-01-11 16:22:28 +01:00
Florian Brandes
bc21d288f4 nixos/pgadmin: apply review suggestions
Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
2024-01-11 11:32:32 +01:00
boozedog
0b522b2429 nixos/pgadmin: add package option 2023-12-26 11:56:25 +01:00
Florian Brandes
010a6250db nixos/pgadmin: add passwordLength setting
pgadmin by default checks the length of the password
and will fail with passwords < 6 characters.
The produced error message is buried in python tracebacks
and hard to find and debug.

Therefore this adds the setting, and also adds a check
in the pre-start script of pgadmin.

The nixos/pgadmin tests have been modified, also.

Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
2023-11-29 10:21:52 +01:00
h7x4
0a37316d6c treewide: use mkPackageOption
This commit replaces a lot of usages of `mkOption` with the package
type, to be `mkPackageOption`, in order to reduce the amount of code.
2023-11-27 01:28:36 +01:00
Florian Brandes
73f09f2145 pgadmin4: 6.12 -> 6.13
- Add update script
- Add email options to pgadmin4 nixOS module
- Add override for flask 2.2

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
2022-09-22 17:42:20 +02:00
pennae
ef176dcf7e nixos/*: automatically convert option descriptions
conversions were done using https://github.com/pennae/nix-doc-munge
using (probably) rev f34e145 running

    nix-doc-munge nixos/**/*.nix
    nix-doc-munge --import nixos/**/*.nix

the tool ensures that only changes that could affect the generated
manual *but don't* are committed, other changes require manual review
and are discarded.
2022-08-31 16:32:53 +02:00
pennae
c915b915b5 nixos/*: md-convert options with unordered lists
mostly no rendering changes. some lists (like simplelist) don't have an
exact translation to markdown, so we use a comma-separated list of
literals instead.
2022-08-31 16:32:53 +02:00
pennae
2e751c0772 treewide: automatically md-convert option descriptions
the conversion procedure is simple:

 - find all things that look like options, ie calls to either `mkOption`
   or `lib.mkOption` that take an attrset. remember the attrset as the
   option
 - for all options, find a `description` attribute who's value is not a
   call to `mdDoc` or `lib.mdDoc`
 - textually convert the entire value of the attribute to MD with a few
   simple regexes (the set from mdize-module.sh)
 - if the change produced a change in the manual output, discard
 - if the change kept the manual unchanged, add some text to the
   description to make sure we've actually found an option. if the
   manual changes this time, keep the converted description

this procedure converts 80% of nixos options to markdown. around 2000
options remain to be inspected, but most of those fail the "does not
change the manual output check": currently the MD conversion process
does not faithfully convert docbook tags like <code> and <package>, so
any option using such tags will not be converted at all.
2022-07-30 15:16:34 +02:00
Maciej Krüger
42a5831e62 nixos/pgadmin: init 2022-02-26 14:30:14 +01:00
Naïm Favier
2ddc335e6f nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
Linus Heckemann
a175be0e7e nixos/meshcentral: init module 2021-07-29 11:42:42 +02:00
Graham Christensen
bc49a0815a utillinux: rename to util-linux 2020-11-24 12:42:06 -05:00
Flakebi
e0ea4826f4 salt: remove aneeshusa and add Flakebi as maintainer 2020-10-23 19:48:48 +02:00
WilliButz
482b39a7e5 nixos/oxidized: add missing slash to PIDFile path 2020-01-06 16:58:54 +01:00
WilliButz
727f2e9a3e nixos/oxidized: specify PID file in service 2019-12-12 23:19:07 +01:00
Janne Heß
d6c08776ba treewide: Switch to system users 2019-10-12 22:25:28 +02:00
Tristan Helmich (omniIT)
02dfc07a04 nixos/oxidized: Use symlinks for config files
The old `cp` suffers from a permission issue on the 2nd start of the
service. The files were copied from the read-only nix store. On the 2nd
start of the service the `cp` failed.
The new version force creates a symlink which does not suffer from this.
2019-08-14 09:30:51 +00:00