From 798b7fdc5cf07786c74a79e5c63b6ebcafed42eb Mon Sep 17 00:00:00 2001 From: pennae Date: Tue, 3 Jan 2023 02:14:10 +0100 Subject: doc/filters: fix myst-reader role detection matching on only `{...}` does not trigger if the role tag is preceded by something usually considered a semantic separator that isn't a separator as markdown knows it, e.g. punctuation characters. --- doc/build-aux/pandoc-filters/myst-reader/roles.lua | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/doc/build-aux/pandoc-filters/myst-reader/roles.lua b/doc/build-aux/pandoc-filters/myst-reader/roles.lua index c33a688eeba7..f4ef6d390b40 100644 --- a/doc/build-aux/pandoc-filters/myst-reader/roles.lua +++ b/doc/build-aux/pandoc-filters/myst-reader/roles.lua @@ -17,9 +17,16 @@ function Inlines(inlines) if correct_tags then -- docutils supports alphanumeric strings separated by [-._:] -- We are slightly more liberal for simplicity. - local role = first.text:match('^{([-._+:%w]+)}$') - if role ~= nil then - inlines:remove(i) + -- Allow preceding punctuation (eg '('), otherwise '({file}`...`)' + -- does not match. Also allow anything followed by a non-breaking space + -- since pandoc emits those after certain abbreviations (e.g. e.g.). + local prefix, role = first.text:match('^(.*){([-._+:%w]+)}$') + if role ~= nil and (prefix == '' or prefix:match("^.*[%p ]$") ~= nil) then + if prefix == '' then + inlines:remove(i) + else + first.text = prefix + end second.attributes['role'] = role second.classes:insert('interpreted-text') end -- cgit v1.2.3 From 80a78f2e1e8228a99786039d987bda3855db930c Mon Sep 17 00:00:00 2001 From: pennae Date: Mon, 2 Jan 2023 22:57:19 +0100 Subject: nixos/manual: remove links from program listings markdown cannot represent those links. remove them all now instead of in each chapter conversion to keep the diff for each chapter small and more understandable. --- nixos/modules/i18n/input-method/default.xml | 16 +-- nixos/modules/programs/digitalbitbox/doc.xml | 10 +- nixos/modules/programs/plotinus.xml | 2 +- nixos/modules/security/acme/doc.xml | 113 +++++++++--------- nixos/modules/services/databases/postgresql.xml | 16 +-- nixos/modules/services/desktops/flatpak.xml | 4 +- nixos/modules/services/editors/emacs.xml | 8 +- nixos/modules/services/hardware/trezord.xml | 2 +- nixos/modules/services/mail/mailman.xml | 16 +-- nixos/modules/services/matrix/mjolnir.xml | 14 +-- nixos/modules/services/matrix/synapse.xml | 74 ++++++------ nixos/modules/services/misc/gitlab.xml | 52 ++++----- .../modules/services/misc/sourcehut/sourcehut.xml | 54 ++++----- nixos/modules/services/misc/taskserver/doc.xml | 8 +- nixos/modules/services/misc/weechat.xml | 4 +- nixos/modules/services/networking/prosody.xml | 38 +++--- nixos/modules/services/web-apps/discourse.xml | 128 ++++++++++----------- nixos/modules/services/web-apps/grocy.xml | 12 +- nixos/modules/services/web-apps/jitsi-meet.xml | 28 ++--- nixos/modules/services/web-apps/keycloak.xml | 14 +-- nixos/modules/services/web-apps/nextcloud.xml | 42 +++---- nixos/modules/services/web-apps/plausible.xml | 12 +- .../services/x11/desktop-managers/gnome.xml | 24 ++-- .../services/x11/desktop-managers/pantheon.xml | 8 +- 24 files changed, 349 insertions(+), 350 deletions(-) diff --git a/nixos/modules/i18n/input-method/default.xml b/nixos/modules/i18n/input-method/default.xml index dd66316c7308..ba621baf4417 100644 --- a/nixos/modules/i18n/input-method/default.xml +++ b/nixos/modules/i18n/input-method/default.xml @@ -60,8 +60,8 @@ i18n.inputMethod = { - enabled = "ibus"; - ibus.engines = with pkgs.ibus-engines; [ anthy hangul mozc ]; + enabled = "ibus"; + ibus.engines = with pkgs.ibus-engines; [ anthy hangul mozc ]; }; @@ -151,8 +151,8 @@ ibus.engines = with pkgs.ibus-engines; [ table table-others ]; i18n.inputMethod = { - enabled = "fcitx"; - fcitx.engines = with pkgs.fcitx-engines; [ mozc hangul m17n ]; + enabled = "fcitx"; + fcitx.engines = with pkgs.fcitx-engines; [ mozc hangul m17n ]; }; @@ -224,7 +224,7 @@ i18n.inputMethod = { i18n.inputMethod = { - enabled = "nabi"; + enabled = "nabi"; }; @@ -242,7 +242,7 @@ i18n.inputMethod = { i18n.inputMethod = { - enabled = "uim"; + enabled = "uim"; }; @@ -267,7 +267,7 @@ i18n.inputMethod = { i18n.inputMethod = { - enabled = "hime"; + enabled = "hime"; }; @@ -284,7 +284,7 @@ i18n.inputMethod = { i18n.inputMethod = { - enabled = "kime"; + enabled = "kime"; }; diff --git a/nixos/modules/programs/digitalbitbox/doc.xml b/nixos/modules/programs/digitalbitbox/doc.xml index c63201628dbd..e4ac6195dae6 100644 --- a/nixos/modules/programs/digitalbitbox/doc.xml +++ b/nixos/modules/programs/digitalbitbox/doc.xml @@ -12,7 +12,7 @@ setting programs.digitalbitbox to true in a manner similar to - = true; +programs.digitalbitbox.enable = true; and bundles the digitalbitbox package (see digitalbitbox package which could be installed as follows: - = [ +environment.systemPackages = [ pkgs.digitalbitbox ]; @@ -53,7 +53,7 @@ The digitalbitbox hardware package enables the udev rules for Digital Bitbox devices and may be installed as follows: - = true; +hardware.digitalbitbox.enable = true; @@ -63,8 +63,8 @@ by means of overriding as follows: programs.digitalbitbox = { - enable = true; - package = pkgs.digitalbitbox.override { + enable = true; + package = pkgs.digitalbitbox.override { udevRule51 = "something else"; }; }; diff --git a/nixos/modules/programs/plotinus.xml b/nixos/modules/programs/plotinus.xml index 8fc8c22c6d76..656c072b97aa 100644 --- a/nixos/modules/programs/plotinus.xml +++ b/nixos/modules/programs/plotinus.xml @@ -24,7 +24,7 @@ To enable Plotinus, add the following to your configuration.nix: - = true; +programs.plotinus.enable = true; diff --git a/nixos/modules/security/acme/doc.xml b/nixos/modules/security/acme/doc.xml index 1439594a5aca..4c02eae45f92 100644 --- a/nixos/modules/security/acme/doc.xml +++ b/nixos/modules/security/acme/doc.xml @@ -57,37 +57,36 @@ NixOS supports fetching ACME certificates for you by setting - enableACME - = true; in a virtualHost config. We first create self-signed + enableACME = true; in a virtualHost config. We first create self-signed placeholder certificates in place of the real ACME certs. The placeholder certs are overwritten when the ACME certs arrive. For foo.example.com the config would look like this: - = true; - = "admin+acme@example.com"; +security.acme.acceptTerms = true; +security.acme.defaults.email = "admin+acme@example.com"; services.nginx = { - enable = true; - virtualHosts = { + enable = true; + virtualHosts = { "foo.example.com" = { - forceSSL = true; - enableACME = true; - # All serverAliases will be added as extra domain names on the certificate. - serverAliases = [ "bar.example.com" ]; + forceSSL = true; + enableACME = true; + # All serverAliases will be added as extra domain names on the certificate. + serverAliases = [ "bar.example.com" ]; locations."/" = { - root = "/var/www"; + root = "/var/www"; }; }; # We can also add a different vhost and reuse the same certificate # but we have to append extraDomainNames manually beforehand: - # security.acme.certs."foo.example.com".extraDomainNames = [ "baz.example.com" ]; + # security.acme.certs."foo.example.com".extraDomainNames = [ "baz.example.com" ]; "baz.example.com" = { - forceSSL = true; - useACMEHost = "foo.example.com"; + forceSSL = true; + useACMEHost = "foo.example.com"; locations."/" = { - root = "/var/www"; + root = "/var/www"; }; }; }; @@ -114,41 +113,41 @@ services.nginx = { - = true; - = "admin+acme@example.com"; +security.acme.acceptTerms = true; +security.acme.defaults.email = "admin+acme@example.com"; # /var/lib/acme/.challenges must be writable by the ACME user # and readable by the Nginx user. The easiest way to achieve # this is to add the Nginx user to the ACME group. -users.users.nginx.extraGroups = [ "acme" ]; +users.users.nginx.extraGroups = [ "acme" ]; services.nginx = { - enable = true; - virtualHosts = { + enable = true; + virtualHosts = { "acmechallenge.example.com" = { # Catchall vhost, will redirect users to HTTPS for all vhosts - serverAliases = [ "*.example.com" ]; + serverAliases = [ "*.example.com" ]; locations."/.well-known/acme-challenge" = { - root = "/var/lib/acme/.challenges"; + root = "/var/lib/acme/.challenges"; }; locations."/" = { - return = "301 https://$host$request_uri"; + return = "301 https://$host$request_uri"; }; }; }; } # Alternative config for Apache -users.users.wwwrun.extraGroups = [ "acme" ]; +users.users.wwwrun.extraGroups = [ "acme" ]; services.httpd = { - enable = true; - virtualHosts = { + enable = true; + virtualHosts = { "acmechallenge.example.com" = { # Catchall vhost, will redirect users to HTTPS for all vhosts - serverAliases = [ "*.example.com" ]; + serverAliases = [ "*.example.com" ]; # /var/lib/acme/.challenges must be writable by the ACME user and readable by the Apache user. # By default, this is the case. - documentRoot = "/var/lib/acme/.challenges"; - extraConfig = '' + documentRoot = "/var/lib/acme/.challenges"; + extraConfig = '' RewriteEngine On RewriteCond %{HTTPS} off RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge [NC] @@ -164,16 +163,16 @@ services.httpd = { -."foo.example.com" = { - webroot = "/var/lib/acme/.challenges"; - email = "foo@example.com"; +security.acme.certs."foo.example.com" = { + webroot = "/var/lib/acme/.challenges"; + email = "foo@example.com"; # Ensure that the web server you use can read the generated certs - # Take a look at the group option for the web server you choose. - group = "nginx"; + # Take a look at the group option for the web server you choose. + group = "nginx"; # Since we have a wildcard vhost to handle port 80, # we can generate certs for anything! # Just make sure your DNS resolves them. - extraDomainNames = [ "mail.example.com" ]; + extraDomainNames = [ "mail.example.com" ]; }; @@ -203,11 +202,11 @@ services.httpd = { services.bind = { - enable = true; - extraConfig = '' + enable = true; + extraConfig = '' include "/var/lib/secrets/dnskeys.conf"; ''; - zones = [ + zones = [ rec { name = "example.com"; file = "/var/db/bind/${name}"; @@ -218,14 +217,14 @@ services.bind = { } # Now we can configure ACME - = true; - = "admin+acme@example.com"; -."example.com" = { - domain = "*.example.com"; - dnsProvider = "rfc2136"; - credentialsFile = "/var/lib/secrets/certs.secret"; +security.acme.acceptTerms = true; +security.acme.defaults.email = "admin+acme@example.com"; +security.acme.certs."example.com" = { + domain = "*.example.com"; + dnsProvider = "rfc2136"; + credentialsFile = "/var/lib/secrets/certs.secret"; # We don't need to wait for propagation since this is a local DNS server - dnsPropagationCheck = false; + dnsPropagationCheck = false; }; @@ -296,23 +295,23 @@ systemd.services.dns-rfc2136-conf = { # Configure ACME appropriately - = true; - = "admin+acme@example.com"; - = { - dnsProvider = "rfc2136"; - credentialsFile = "/var/lib/secrets/certs.secret"; +security.acme.acceptTerms = true; +security.acme.defaults.email = "admin+acme@example.com"; +security.acme.defaults = { + dnsProvider = "rfc2136"; + credentialsFile = "/var/lib/secrets/certs.secret"; # We don't need to wait for propagation since this is a local DNS server - dnsPropagationCheck = false; + dnsPropagationCheck = false; }; # For each virtual host you would like to use DNS-01 validation with, # set acmeRoot = null services.nginx = { - enable = true; - virtualHosts = { + enable = true; + virtualHosts = { "foo.example.com" = { - enableACME = true; - acmeRoot = null; + enableACME = true; + acmeRoot = null; }; }; } @@ -349,8 +348,8 @@ security.acme.certs."mail.example.com".postRun = '' # Now you must augment OpenSMTPD's systemd service to load # the certificate files. -systemd.services.opensmtpd.requires = ["acme-finished-mail.example.com.target"]; -systemd.services.opensmtpd.serviceConfig.LoadCredential = let +systemd.services.opensmtpd.requires = ["acme-finished-mail.example.com.target"]; +systemd.services.opensmtpd.serviceConfig.LoadCredential = let certDir = config.security.acme.certs."mail.example.com".directory; in [ "cert.pem:${certDir}/cert.pem" diff --git a/nixos/modules/services/databases/postgresql.xml b/nixos/modules/services/databases/postgresql.xml index e48c578e6ce6..fc91e0dc4c06 100644 --- a/nixos/modules/services/databases/postgresql.xml +++ b/nixos/modules/services/databases/postgresql.xml @@ -23,8 +23,8 @@ To enable PostgreSQL, add the following to your configuration.nix: - = true; - = pkgs.postgresql_11; +services.postgresql.enable = true; +services.postgresql.package = pkgs.postgresql_11; Note that you are required to specify the desired version of PostgreSQL (e.g. pkgs.postgresql_11). Since upgrading your PostgreSQL version requires a database dump and reload (see below), NixOS cannot provide a default value for such as the most recent release of PostgreSQL. @@ -45,7 +45,7 @@ Type "help" for help. By default, PostgreSQL stores its databases in /var/lib/postgresql/$psqlSchema. You can override this using , e.g. - = "/data/postgresql"; +services.postgresql.dataDir = "/data/postgresql"; @@ -71,7 +71,7 @@ Type "help" for help. { config, pkgs, ... }: { - = [ + environment.systemPackages = [ (let # XXX specify the postgresql package you'd like to upgrade to. # Do not forget to list the extensions you need. @@ -87,8 +87,8 @@ Type "help" for help. export NEWBIN="${newPostgres}/bin" - export OLDDATA="${config.}" - export OLDBIN="${config.}/bin" + export OLDDATA="${config.services.postgresql.dataDir}" + export OLDBIN="${config.services.postgresql.package}/bin" install -d -m 0700 -o postgres -g postgres "$NEWDATA" cd "$NEWDATA" @@ -189,8 +189,8 @@ postgresql_11.pkgs.pg_partman postgresql_11.pkgs.pgroonga To add plugins via NixOS configuration, set services.postgresql.extraPlugins: - = pkgs.postgresql_11; - = with pkgs.postgresql_11.pkgs; [ +services.postgresql.package = pkgs.postgresql_11; +services.postgresql.extraPlugins = with pkgs.postgresql_11.pkgs; [ pg_repack postgis ]; diff --git a/nixos/modules/services/desktops/flatpak.xml b/nixos/modules/services/desktops/flatpak.xml index 8f080b250228..a6d27e40b0a3 100644 --- a/nixos/modules/services/desktops/flatpak.xml +++ b/nixos/modules/services/desktops/flatpak.xml @@ -20,7 +20,7 @@ To enable Flatpak, add the following to your configuration.nix: - = true; + services.flatpak.enable = true; @@ -29,7 +29,7 @@ in other cases, you will need to add something like the following to your configuration.nix: - = [ pkgs.xdg-desktop-portal-gtk ]; + xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ]; diff --git a/nixos/modules/services/editors/emacs.xml b/nixos/modules/services/editors/emacs.xml index fd99ee9442c9..dfadf27d41dc 100644 --- a/nixos/modules/services/editors/emacs.xml +++ b/nixos/modules/services/editors/emacs.xml @@ -375,8 +375,8 @@ in [...] To install and enable the systemd user service for Emacs daemon, add the following to your configuration.nix: - = true; - = import /home/cassou/.emacs.d { pkgs = pkgs; }; +services.emacs.enable = true; +services.emacs.package = import /home/cassou/.emacs.d { pkgs = pkgs; }; @@ -459,8 +459,8 @@ emacsclient --create-frame --tty # opens a new frame on the current terminal Emacs daemon is not wanted for all users, it is possible to install the service but not globally enable it: - = false; - = true; +services.emacs.enable = false; +services.emacs.install = true; diff --git a/nixos/modules/services/hardware/trezord.xml b/nixos/modules/services/hardware/trezord.xml index 972d409d9d0e..e1f42bc08294 100644 --- a/nixos/modules/services/hardware/trezord.xml +++ b/nixos/modules/services/hardware/trezord.xml @@ -19,7 +19,7 @@ To enable Trezor support, add the following to your configuration.nix: - = true; +services.trezord.enable = true; This will add all necessary udev rules and start Trezor Bridge. diff --git a/nixos/modules/services/mail/mailman.xml b/nixos/modules/services/mail/mailman.xml index 27247fb064f2..9510cbe82c52 100644 --- a/nixos/modules/services/mail/mailman.xml +++ b/nixos/modules/services/mail/mailman.xml @@ -28,14 +28,14 @@ }; }; services.mailman = { - enable = true; - serve.enable = true; - hyperkitty.enable = true; - webHosts = ["lists.example.org"]; - siteOwner = "mailman@example.org"; + enable = true; + serve.enable = true; + hyperkitty.enable = true; + webHosts = ["lists.example.org"]; + siteOwner = "mailman@example.org"; }; - services.nginx.virtualHosts."lists.example.org".enableACME = true; - networking.firewall.allowedTCPPorts = [ 25 80 443 ]; + services.nginx.virtualHosts."lists.example.org".enableACME = true; + networking.firewall.allowedTCPPorts = [ 25 80 443 ]; } @@ -65,7 +65,7 @@ mailman = { enable = true; siteOwner = "mailman@example.org"; - enablePostfix = false; + enablePostfix = false; settings.mta = { incoming = "mailman.mta.exim4.LMTP"; outgoing = "mailman.mta.deliver.deliver"; diff --git a/nixos/modules/services/matrix/mjolnir.xml b/nixos/modules/services/matrix/mjolnir.xml index b07abe339791..4e0f14a3c0b5 100644 --- a/nixos/modules/services/matrix/mjolnir.xml +++ b/nixos/modules/services/matrix/mjolnir.xml @@ -67,16 +67,16 @@ { services.mjolnir = { enable = true; - homeserverUrl = "https://matrix.domain.tld"; - pantalaimon = { - enable = true; - username = "mjolnir"; - passwordFile = "/run/secrets/mjolnir-password"; + homeserverUrl = "https://matrix.domain.tld"; + pantalaimon = { + enable = true; + username = "mjolnir"; + passwordFile = "/run/secrets/mjolnir-password"; }; - protectedRooms = [ + protectedRooms = [ "https://matrix.to/#/!xxx:domain.tld" ]; - managementRoom = "!yyy:domain.tld"; + managementRoom = "!yyy:domain.tld"; }; } diff --git a/nixos/modules/services/matrix/synapse.xml b/nixos/modules/services/matrix/synapse.xml index 40ad72173a53..f834e54f3c8d 100644 --- a/nixos/modules/services/matrix/synapse.xml +++ b/nixos/modules/services/matrix/synapse.xml @@ -47,12 +47,12 @@ let return 200 '${builtins.toJSON data}'; ''; in { - = "myhostname"; - = "example.org"; - = [ 80 443 ]; + networking.hostName = "myhostname"; + networking.domain = "example.org"; + networking.firewall.allowedTCPPorts = [ 80 443 ]; - = true; - = pkgs.writeText "synapse-init.sql" '' + services.postgresql.enable = true; + services.postgresql.initialScript = pkgs.writeText "synapse-init.sql" '' CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse'; CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 @@ -61,42 +61,42 @@ in { ''; services.nginx = { - enable = true; - recommendedTlsSettings = true; - recommendedOptimisation = true; - recommendedGzipSettings = true; - recommendedProxySettings = true; - virtualHosts = { + enable = true; + recommendedTlsSettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; + recommendedProxySettings = true; + virtualHosts = { "${config.networking.domain}" = { - enableACME = true; - forceSSL = true; - locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig; - locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig; + enableACME = true; + forceSSL = true; + locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig; + locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig; }; "${fqdn}" = { - enableACME = true; - forceSSL = true; - locations."/".extraConfig = '' + enableACME = true; + forceSSL = true; + locations."/".extraConfig = '' return 404; ''; - locations."/_matrix".proxyPass = "http://[::1]:8008"; - locations."/_synapse/client".proxyPass = "http://[::1]:8008"; + locations."/_matrix".proxyPass = "http://[::1]:8008"; + locations."/_synapse/client".proxyPass = "http://[::1]:8008"; }; }; }; services.matrix-synapse = { - enable = true; - settings.server_name = config.networking.domain; - settings.listeners = [ - { port = 8008; - bind_addresses = [ "::1" ]; - type = "http"; - tls = false; - x_forwarded = true; - resources = [ { - names = [ "client" "federation" ]; - compress = true; + enable = true; + settings.server_name = config.networking.domain; + settings.listeners = [ + { port = 8008; + bind_addresses = [ "::1" ]; + type = "http"; + tls = false; + x_forwarded = true; + resources = [ { + names = [ "client" "federation" ]; + compress = true; } ]; } ]; @@ -159,7 +159,7 @@ in { Registering Matrix users If you want to run a server with public registration by anybody, you can - then enable services.matrix-synapse.settings.enable_registration = + then enable services.matrix-synapse.settings.enable_registration = true;. Otherwise, or you can generate a registration secret with pwgen -s 64 1 and set it with . @@ -202,7 +202,7 @@ Success! Include the file like this in your configuration: { - = [ + services.matrix-synapse.extraConfigFiles = [ "/run/secrets/matrix-shared-secret" ]; } @@ -244,13 +244,13 @@ Success! { services.nginx.virtualHosts."element.${fqdn}" = { - enableACME = true; - forceSSL = true; - serverAliases = [ + enableACME = true; + forceSSL = true; + serverAliases = [ "element.${config.networking.domain}" ]; - root = pkgs.element-web.override { + root = pkgs.element-web.override { conf = { default_server_config = clientConfig; # see `clientConfig` from the snippet above. }; diff --git a/nixos/modules/services/misc/gitlab.xml b/nixos/modules/services/misc/gitlab.xml index 9816fdac7dd7..a9f8d5fd7219 100644 --- a/nixos/modules/services/misc/gitlab.xml +++ b/nixos/modules/services/misc/gitlab.xml @@ -20,16 +20,16 @@ For instance, the following configuration could be used to use nginx as frontend proxy: -services.nginx = { - enable = true; - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedProxySettings = true; - recommendedTlsSettings = true; - virtualHosts."git.example.com" = { - enableACME = true; - forceSSL = true; - locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket"; +services.nginx = { + enable = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; + virtualHosts."git.example.com" = { + enableACME = true; + forceSSL = true; + locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket"; }; }; @@ -53,26 +53,26 @@ A basic configuration with some custom settings could look like this: services.gitlab = { - enable = true; - databasePasswordFile = "/var/keys/gitlab/db_password"; - initialRootPasswordFile = "/var/keys/gitlab/root_password"; - https = true; - host = "git.example.com"; - port = 443; - user = "git"; - group = "git"; + enable = true; + databasePasswordFile = "/var/keys/gitlab/db_password"; + initialRootPasswordFile = "/var/keys/gitlab/root_password"; + https = true; + host = "git.example.com"; + port = 443; + user = "git"; + group = "git"; smtp = { - enable = true; - address = "localhost"; - port = 25; + enable = true; + address = "localhost"; + port = 25; }; secrets = { - dbFile = "/var/keys/gitlab/db"; - secretFile = "/var/keys/gitlab/secret"; - otpFile = "/var/keys/gitlab/otp"; - jwsFile = "/var/keys/gitlab/jws"; + dbFile = "/var/keys/gitlab/db"; + secretFile = "/var/keys/gitlab/secret"; + otpFile = "/var/keys/gitlab/otp"; + jwsFile = "/var/keys/gitlab/jws"; }; - extraConfig = { + extraConfig = { gitlab = { email_from = "gitlab-no-reply@example.com"; email_display_name = "Example GitLab"; diff --git a/nixos/modules/services/misc/sourcehut/sourcehut.xml b/nixos/modules/services/misc/sourcehut/sourcehut.xml index 41094f65a94d..a769ded524c5 100644 --- a/nixos/modules/services/misc/sourcehut/sourcehut.xml +++ b/nixos/modules/services/misc/sourcehut/sourcehut.xml @@ -15,11 +15,11 @@ Sourcehut is a Python and Go based set of applications. This NixOS module also provides basic configuration integrating Sourcehut into locally running - services.nginx, - services.redis.servers.sourcehut, - services.postfix + services.nginx, + services.redis.servers.sourcehut, + services.postfix and - services.postgresql services. + services.postgresql services. @@ -34,21 +34,21 @@ let in { networking = { - hostName = "srht"; - domain = "tld"; - firewall.allowedTCPPorts = [ 22 80 443 ]; + hostName = "srht"; + domain = "tld"; + firewall.allowedTCPPorts = [ 22 80 443 ]; }; services.sourcehut = { - enable = true; - git.enable = true; - man.enable = true; - meta.enable = true; - nginx.enable = true; - postfix.enable = true; - postgresql.enable = true; - redis.enable = true; - settings = { + enable = true; + git.enable = true; + man.enable = true; + meta.enable = true; + nginx.enable = true; + postfix.enable = true; + postgresql.enable = true; + redis.enable = true; + settings = { "sr.ht" = { environment = "production"; global-domain = fqdn; @@ -61,26 +61,26 @@ in { }; }; - security.acme.certs."${fqdn}".extraDomainNames = [ + security.acme.certs."${fqdn}".extraDomainNames = [ "meta.${fqdn}" "man.${fqdn}" "git.${fqdn}" ]; services.nginx = { - enable = true; + enable = true; # only recommendedProxySettings are strictly required, but the rest make sense as well. - recommendedTlsSettings = true; - recommendedOptimisation = true; - recommendedGzipSettings = true; - recommendedProxySettings = true; + recommendedTlsSettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; + recommendedProxySettings = true; # Settings to setup what certificates are used for which endpoint. - virtualHosts = { - "${fqdn}".enableACME = true; - "meta.${fqdn}".useACMEHost = fqdn: - "man.${fqdn}".useACMEHost = fqdn: - "git.${fqdn}".useACMEHost = fqdn: + virtualHosts = { + "${fqdn}".enableACME = true; + "meta.${fqdn}".useACMEHost = fqdn: + "man.${fqdn}".useACMEHost = fqdn: + "git.${fqdn}".useACMEHost = fqdn: }; }; } diff --git a/nixos/modules/services/misc/taskserver/doc.xml b/nixos/modules/services/misc/taskserver/doc.xml index f6ead7c37857..e3f778f3159b 100644 --- a/nixos/modules/services/misc/taskserver/doc.xml +++ b/nixos/modules/services/misc/taskserver/doc.xml @@ -91,10 +91,10 @@ For example, let's say you have the following configuration: { - = true; - = "server"; - = "::"; - services.taskserver.organisations.my-company.users = [ "alice" ]; + services.taskserver.enable = true; + services.taskserver.fqdn = "server"; + services.taskserver.listenHost = "::"; + services.taskserver.organisations.my-company.users = [ "alice" ]; } This creates an organisation called my-company with the diff --git a/nixos/modules/services/misc/weechat.xml b/nixos/modules/services/misc/weechat.xml index 7255edfb9da3..b17f9a871ff9 100644 --- a/nixos/modules/services/misc/weechat.xml +++ b/nixos/modules/services/misc/weechat.xml @@ -25,7 +25,7 @@ { ... }: { - services.weechat.enable = true; + services.weechat.enable = true; } @@ -46,7 +46,7 @@ support: { - programs.screen.screenrc = '' + programs.screen.screenrc = '' multiuser on acladd normal_user ''; diff --git a/nixos/modules/services/networking/prosody.xml b/nixos/modules/services/networking/prosody.xml index 6358d744ff78..e8f27d10e8c3 100644 --- a/nixos/modules/services/networking/prosody.xml +++ b/nixos/modules/services/networking/prosody.xml @@ -38,21 +38,21 @@ endpoint will look like this: services.prosody = { - enable = true; - admins = [ "root@example.org" ]; - ssl.cert = "/var/lib/acme/example.org/fullchain.pem"; - ssl.key = "/var/lib/acme/example.org/key.pem"; - virtualHosts."example.org" = { - enabled = true; - domain = "example.org"; - ssl.cert = "/var/lib/acme/example.org/fullchain.pem"; - ssl.key = "/var/lib/acme/example.org/key.pem"; + enable = true; + admins = [ "root@example.org" ]; + ssl.cert = "/var/lib/acme/example.org/fullchain.pem"; + ssl.key = "/var/lib/acme/example.org/key.pem"; + virtualHosts."example.org" = { + enabled = true; + domain = "example.org"; + ssl.cert = "/var/lib/acme/example.org/fullchain.pem"; + ssl.key = "/var/lib/acme/example.org/key.pem"; }; - muc = [ { - domain = "conference.example.org"; + muc = [ { + domain = "conference.example.org"; } ]; - uploadHttp = { - domain = "upload.example.org"; + uploadHttp = { + domain = "upload.example.org"; }; }; @@ -72,13 +72,13 @@ services.prosody = { a TLS certificate for the three endponits: security.acme = { - email = "root@example.org"; - acceptTerms = true; - certs = { + email = "root@example.org"; + acceptTerms = true; + certs = { "example.org" = { - webroot = "/var/www/example.org"; - email = "root@example.org"; - extraDomainNames = [ "conference.example.org" "upload.example.org" ]; + webroot = "/var/www/example.org"; + email = "root@example.org"; + extraDomainNames = [ "conference.example.org" "upload.example.org" ]; }; }; }; diff --git a/nixos/modules/services/web-apps/discourse.xml b/nixos/modules/services/web-apps/discourse.xml index ad9b65abf51e..d9dc28fa5e4e 100644 --- a/nixos/modules/services/web-apps/discourse.xml +++ b/nixos/modules/services/web-apps/discourse.xml @@ -15,18 +15,18 @@ A minimal configuration using Let's Encrypt for TLS certificates looks like this: services.discourse = { - enable = true; - hostname = "discourse.example.com"; + enable = true; + hostname = "discourse.example.com"; admin = { - email = "admin@example.com"; - username = "admin"; - fullName = "Administrator"; - passwordFile = "/path/to/password_file"; + email = "admin@example.com"; + username = "admin"; + fullName = "Administrator"; + passwordFile = "/path/to/password_file"; }; - secretKeyBaseFile = "/path/to/secret_key_base_file"; + secretKeyBaseFile = "/path/to/secret_key_base_file"; }; -security.acme.email = "me@example.com"; -security.acme.acceptTerms = true; +security.acme.email = "me@example.com"; +security.acme.acceptTerms = true; @@ -48,17 +48,17 @@ services.discourse = { services.discourse = { - enable = true; - hostname = "discourse.example.com"; - sslCertificate = "/path/to/ssl_certificate"; - sslCertificateKey = "/path/to/ssl_certificate_key"; + enable = true; + hostname = "discourse.example.com"; + sslCertificate = "/path/to/ssl_certificate"; + sslCertificateKey = "/path/to/ssl_certificate_key"; admin = { - email = "admin@example.com"; - username = "admin"; - fullName = "Administrator"; - passwordFile = "/path/to/password_file"; + email = "admin@example.com"; + username = "admin"; + fullName = "Administrator"; + passwordFile = "/path/to/password_file"; }; - secretKeyBaseFile = "/path/to/secret_key_base_file"; + secretKeyBaseFile = "/path/to/secret_key_base_file"; }; @@ -108,24 +108,24 @@ services.discourse = { services.discourse = { - enable = true; - hostname = "discourse.example.com"; - sslCertificate = "/path/to/ssl_certificate"; - sslCertificateKey = "/path/to/ssl_certificate_key"; + enable = true; + hostname = "discourse.example.com"; + sslCertificate = "/path/to/ssl_certificate"; + sslCertificateKey = "/path/to/ssl_certificate_key"; admin = { - email = "admin@example.com"; - username = "admin"; - fullName = "Administrator"; - passwordFile = "/path/to/password_file"; + email = "admin@example.com"; + username = "admin"; + fullName = "Administrator"; + passwordFile = "/path/to/password_file"; }; mail.outgoing = { - serverAddress = "smtp.emailprovider.com"; - port = 587; - username = "user@emailprovider.com"; - passwordFile = "/path/to/smtp_password_file"; + serverAddress = "smtp.emailprovider.com"; + port = 587; + username = "user@emailprovider.com"; + passwordFile = "/path/to/smtp_password_file"; }; - mail.incoming.enable = true; - secretKeyBaseFile = "/path/to/secret_key_base_file"; + mail.incoming.enable = true; + secretKeyBaseFile = "/path/to/secret_key_base_file"; }; @@ -210,24 +210,24 @@ services.discourse = { and changes a few request limits in the backend settings: services.discourse = { - enable = true; - hostname = "discourse.example.com"; - sslCertificate = "/path/to/ssl_certificate"; - sslCertificateKey = "/path/to/ssl_certificate_key"; + enable = true; + hostname = "discourse.example.com"; + sslCertificate = "/path/to/ssl_certificate"; + sslCertificateKey = "/path/to/ssl_certificate_key"; admin = { - email = "admin@example.com"; - username = "admin"; - fullName = "Administrator"; - passwordFile = "/path/to/password_file"; + email = "admin@example.com"; + username = "admin"; + fullName = "Administrator"; + passwordFile = "/path/to/password_file"; }; mail.outgoing = { - serverAddress = "smtp.emailprovider.com"; - port = 587; - username = "user@emailprovider.com"; - passwordFile = "/path/to/smtp_password_file"; + serverAddress = "smtp.emailprovider.com"; + port = 587; + username = "user@emailprovider.com"; + passwordFile = "/path/to/smtp_password_file"; }; - mail.incoming.enable = true; - siteSettings = { + mail.incoming.enable = true; + siteSettings = { required = { title = "My Cats"; site_description = "Discuss My Cats (and be nice plz)"; @@ -238,13 +238,13 @@ services.discourse = { github_client_secret._secret = /run/keys/discourse_github_client_secret; }; }; - backendSettings = { + backendSettings = { max_reqs_per_ip_per_minute = 300; max_reqs_per_ip_per_10_seconds = 60; max_asset_reqs_per_ip_per_10_seconds = 250; max_reqs_per_ip_mode = "warn+block"; }; - secretKeyBaseFile = "/path/to/secret_key_base_file"; + secretKeyBaseFile = "/path/to/secret_key_base_file"; }; @@ -320,33 +320,33 @@ services.discourse = { services.discourse = { - enable = true; - hostname = "discourse.example.com"; - sslCertificate = "/path/to/ssl_certificate"; - sslCertificateKey = "/path/to/ssl_certificate_key"; + enable = true; + hostname = "discourse.example.com"; + sslCertificate = "/path/to/ssl_certificate"; + sslCertificateKey = "/path/to/ssl_certificate_key"; admin = { - email = "admin@example.com"; - username = "admin"; - fullName = "Administrator"; - passwordFile = "/path/to/password_file"; + email = "admin@example.com"; + username = "admin"; + fullName = "Administrator"; + passwordFile = "/path/to/password_file"; }; mail.outgoing = { - serverAddress = "smtp.emailprovider.com"; - port = 587; - username = "user@emailprovider.com"; - passwordFile = "/path/to/smtp_password_file"; + serverAddress = "smtp.emailprovider.com"; + port = 587; + username = "user@emailprovider.com"; + passwordFile = "/path/to/smtp_password_file"; }; - mail.incoming.enable = true; - plugins = with config.services.discourse.package.plugins; [ + mail.incoming.enable = true; + plugins = with config.services.discourse.package.plugins; [ discourse-spoiler-alert discourse-solved ]; - siteSettings = { + siteSettings = { plugins = { spoiler_enabled = false; }; }; - secretKeyBaseFile = "/path/to/secret_key_base_file"; + secretKeyBaseFile = "/path/to/secret_key_base_file"; }; diff --git a/nixos/modules/services/web-apps/grocy.xml b/nixos/modules/services/web-apps/grocy.xml index fdf6d00f4b12..46a49fe601ed 100644 --- a/nixos/modules/services/web-apps/grocy.xml +++ b/nixos/modules/services/web-apps/grocy.xml @@ -17,8 +17,8 @@ { pkgs, ... }: { services.grocy = { - enable = true; - hostName = "grocy.tld"; + enable = true; + hostName = "grocy.tld"; }; } This configures a simple vhost using nginx @@ -45,19 +45,19 @@ # The default currency in the system for invoices etc. # Please note that exchange rates aren't taken into account, this # is just the setting for what's shown in the frontend. - currency = "EUR"; + currency = "EUR"; # The display language (and locale configuration) for grocy. - culture = "de"; + culture = "de"; calendar = { # Whether or not to show the week-numbers # in the calendar. - showWeekNumber = true; + showWeekNumber = true; # Index of the first day to be shown in the calendar (0=Sunday, 1=Monday, # 2=Tuesday and so on). - firstDayOfWeek = 2; + firstDayOfWeek = 2; }; }; } diff --git a/nixos/modules/services/web-apps/jitsi-meet.xml b/nixos/modules/services/web-apps/jitsi-meet.xml index ff44c724adf4..8909ac5b0d37 100644 --- a/nixos/modules/services/web-apps/jitsi-meet.xml +++ b/nixos/modules/services/web-apps/jitsi-meet.xml @@ -15,13 +15,13 @@ A minimal configuration using Let's Encrypt for TLS certificates looks like this: { services.jitsi-meet = { - enable = true; - hostName = "jitsi.example.com"; + enable = true; + hostName = "jitsi.example.com"; }; - services.jitsi-videobridge.openFirewall = true; - networking.firewall.allowedTCPPorts = [ 80 443 ]; - security.acme.email = "me@example.com"; - security.acme.acceptTerms = true; + services.jitsi-videobridge.openFirewall = true; + networking.firewall.allowedTCPPorts = [ 80 443 ]; + security.acme.email = "me@example.com"; + security.acme.acceptTerms = true; } @@ -32,22 +32,22 @@ Here is the minimal configuration with additional configurations: { services.jitsi-meet = { - enable = true; - hostName = "jitsi.example.com"; - config = { + enable = true; + hostName = "jitsi.example.com"; + config = { enableWelcomePage = false; prejoinPageEnabled = true; defaultLang = "fi"; }; - interfaceConfig = { + interfaceConfig = { SHOW_JITSI_WATERMARK = false; SHOW_WATERMARK_FOR_GUESTS = false; }; }; - services.jitsi-videobridge.openFirewall = true; - networking.firewall.allowedTCPPorts = [ 80 443 ]; - security.acme.email = "me@example.com"; - security.acme.acceptTerms = true; + services.jitsi-videobridge.openFirewall = true; + networking.firewall.allowedTCPPorts = [ 80 443 ]; + security.acme.email = "me@example.com"; + security.acme.acceptTerms = true; } diff --git a/nixos/modules/services/web-apps/keycloak.xml b/nixos/modules/services/web-apps/keycloak.xml index 861756e33ac0..cf9de043cf74 100644 --- a/nixos/modules/services/web-apps/keycloak.xml +++ b/nixos/modules/services/web-apps/keycloak.xml @@ -185,15 +185,15 @@ A basic configuration with some custom settings could look like this: services.keycloak = { - enable = true; + enable = true; settings = { - hostname = "keycloak.example.com"; - hostname-strict-backchannel = true; + hostname = "keycloak.example.com"; + hostname-strict-backchannel = true; }; - initialAdminPassword = "e6Wcm0RrtegMEHl"; # change on first login - sslCertificate = "/run/keys/ssl_cert"; - sslCertificateKey = "/run/keys/ssl_key"; - database.passwordFile = "/run/keys/db_password"; + initialAdminPassword = "e6Wcm0RrtegMEHl"; # change on first login + sslCertificate = "/run/keys/ssl_cert"; + sslCertificateKey = "/run/keys/ssl_key"; + database.passwordFile = "/run/keys/db_password"; }; diff --git a/nixos/modules/services/web-apps/nextcloud.xml b/nixos/modules/services/web-apps/nextcloud.xml index 4207c4008d5b..533f34f7fcce 100644 --- a/nixos/modules/services/web-apps/nextcloud.xml +++ b/nixos/modules/services/web-apps/nextcloud.xml @@ -31,22 +31,22 @@ { pkgs, ... }: { services.nextcloud = { - enable = true; - hostName = "nextcloud.tld"; + enable = true; + hostName = "nextcloud.tld"; config = { - dbtype = "pgsql"; - dbuser = "nextcloud"; - dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself - dbname = "nextcloud"; - adminpassFile = "/path/to/admin-pass-file"; - adminuser = "root"; + dbtype = "pgsql"; + dbuser = "nextcloud"; + dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself + dbname = "nextcloud"; + adminpassFile = "/path/to/admin-pass-file"; + adminuser = "root"; }; }; services.postgresql = { - enable = true; - ensureDatabases = [ "nextcloud" ]; - ensureUsers = [ + enable = true; + ensureDatabases = [ "nextcloud" ]; + ensureUsers = [ { name = "nextcloud"; ensurePermissions."DATABASE nextcloud" = "ALL PRIVIL