summaryrefslogtreecommitdiffstats
path: root/nixos
diff options
context:
space:
mode:
Diffstat (limited to 'nixos')
-rw-r--r--nixos/doc/manual/release-notes/rl-2405.section.md2
-rw-r--r--nixos/modules/profiles/perlless.nix2
-rw-r--r--nixos/modules/services/misc/zoneminder.nix2
-rw-r--r--nixos/modules/services/security/oauth2-proxy.nix2
-rw-r--r--nixos/modules/services/security/step-ca.nix2
-rw-r--r--nixos/modules/services/web-servers/caddy/default.nix3
-rw-r--r--nixos/modules/services/web-servers/traefik.nix2
-rw-r--r--nixos/modules/system/activation/test.nix4
-rw-r--r--nixos/modules/system/activation/top-level.nix23
9 files changed, 22 insertions, 20 deletions
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 93a9da175b1e..e545bda2fba3 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -282,6 +282,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
"mysecret"` becomes `services.aria2.rpcSecretFile = "/path/to/secret_file"`
where the file `secret_file` contains the string `mysecret`.
+- The `system.forbiddenDependenciesRegex` option has been renamed to `system.forbiddenDependenciesRegexes` and now has the type of `listOf string` instead of `string` to accept multiple regexes.
+
- `openssh`, `openssh_hpn` and `openssh_gssapi` are now compiled without support for the DSA signature algorithm as it is being deprecated upstream. Users still relying on DSA keys should consider upgrading
to another signature algorithm. However, for the time being it is possible to restore DSA key support using `override` to set `dsaKeysSupport = true`.
diff --git a/nixos/modules/profiles/perlless.nix b/nixos/modules/profiles/perlless.nix
index 90abd14f077e..010e4f8f2a28 100644
--- a/nixos/modules/profiles/perlless.nix
+++ b/nixos/modules/profiles/perlless.nix
@@ -26,6 +26,6 @@
# Check that the system does not contain a Nix store path that contains the
# string "perl".
- system.forbiddenDependenciesRegex = "perl";
+ system.forbiddenDependenciesRegexes = ["perl"];
}
diff --git a/nixos/modules/services/misc/zoneminder.nix b/nixos/modules/services/misc/zoneminder.nix
index 84c3a6710c0d..d09cd87febff 100644
--- a/nixos/modules/services/misc/zoneminder.nix
+++ b/nixos/modules/services/misc/zoneminder.nix
@@ -350,7 +350,7 @@ in {
RestartSec = "10s";
CacheDirectory = dirs cacheDirs;
RuntimeDirectory = dirName;
- ReadWriteDirectories = lib.mkIf useCustomDir [ cfg.storageDir ];
+ ReadWritePaths = lib.mkIf useCustomDir [ cfg.storageDir ];
StateDirectory = dirs (lib.optionals (!useCustomDir) libDirs);
LogsDirectory = dirName;
PrivateTmp = true;
diff --git a/nixos/modules/services/security/oauth2-proxy.nix b/nixos/modules/services/security/oauth2-proxy.nix
index 075e64b743b1..78a772845a35 100644
--- a/nixos/modules/services/security/oauth2-proxy.nix
+++ b/nixos/modules/services/security/oauth2-proxy.nix
@@ -17,7 +17,7 @@ let
inherit (cfg.github) org team;
}; };
- google = cfg: { google = with cfg.google; optionalAttrs (groups != []) {
+ google = cfg: { google = with cfg.google; lib.optionalAttrs (groups != []) {
admin-email = adminEmail;
service-account = serviceAccountJSON;
group = groups;
diff --git a/nixos/modules/services/security/step-ca.nix b/nixos/modules/services/security/step-ca.nix
index c708cb2b8910..e9195fbd5160 100644
--- a/nixos/modules/services/security/step-ca.nix
+++ b/nixos/modules/services/security/step-ca.nix
@@ -107,7 +107,7 @@ in
UMask = "0077";
Environment = "HOME=%S/step-ca";
WorkingDirectory = ""; # override upstream
- ReadWriteDirectories = ""; # override upstream
+ ReadWritePaths = ""; # override upstream
# LocalCredential handles file permission problems arising from the use of DynamicUser.
LoadCredential = "intermediate_password:${cfg.intermediatePasswordFile}";
diff --git a/nixos/modules/services/web-servers/caddy/default.nix b/nixos/modules/services/web-servers/caddy/default.nix
index 08ce50bff62c..1cd1448c7d56 100644
--- a/nixos/modules/services/web-servers/caddy/default.nix
+++ b/nixos/modules/services/web-servers/caddy/default.nix
@@ -360,6 +360,7 @@ in
serviceConfig = let
runOptions = ''--config ${configPath} ${optionalString (cfg.adapter != null) "--adapter ${cfg.adapter}"}'';
in {
+ # Override the `ExecStart` line from upstream's systemd unit file by our own:
# https://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStart=
# If the empty string is assigned to this option, the list of commands to start is reset, prior assignments of this option will have no effect.
ExecStart = [ "" ''${cfg.package}/bin/caddy run ${runOptions} ${optionalString cfg.resume "--resume"}'' ];
@@ -367,7 +368,7 @@ in
ExecReload = [ "" ''${cfg.package}/bin/caddy reload ${runOptions} --force'' ];
User = cfg.user;
Group = cfg.group;
- ReadWriteDirectories = cfg.dataDir;
+ ReadWritePaths = [ cfg.dataDir ];
StateDirectory = mkIf (cfg.dataDir == "/var/lib/caddy") [ "caddy" ];
LogsDirectory = mkIf (cfg.logDir == "/var/log/caddy") [ "caddy" ];
Restart = "on-failure";
diff --git a/nixos/modules/services/web-servers/traefik.nix b/nixos/modules/services/web-servers/traefik.nix
index 9c53455bcf3d..1a65ce21112e 100644
--- a/nixos/modules/services/web-servers/traefik.nix
+++ b/nixos/modules/services/web-servers/traefik.nix
@@ -170,7 +170,7 @@ in {
PrivateDevices = true;
ProtectHome = true;
ProtectSystem = "full";
- ReadWriteDirectories = cfg.dataDir;
+ ReadWritePaths = [ cfg.dataDir ];
RuntimeDirectory = "traefik";
};
};
diff --git a/nixos/modules/system/activation/test.nix b/nixos/modules/system/activation/test.nix
index 8cf000451c6e..fd251d528957 100644
--- a/nixos/modules/system/activation/test.nix
+++ b/nixos/modules/system/activation/test.nix
@@ -5,7 +5,7 @@
}:
let
node-forbiddenDependencies-fail = nixos ({ ... }: {
- system.forbiddenDependenciesRegex = "-dev$";
+ system.forbiddenDependenciesRegexes = ["-dev$"];
environment.etc."dev-dependency" = {
text = "${expect.dev}";
};
@@ -14,7 +14,7 @@ let
boot.loader.grub.enable = false;
});
node-forbiddenDependencies-succeed = nixos ({ ... }: {
- system.forbiddenDependenciesRegex = "-dev$";
+ system.forbiddenDependenciesRegexes = ["-dev$"];
system.extraDependencies = [ expect.dev ];
documentation.enable = false;
fileSystems."/".device = "ignore-root-device";
diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix
index 4cf3012646fa..ed0ece19f2fa 100644
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@@ -86,6 +86,7 @@ in
../build.nix
(mkRemovedOptionModule [ "nesting" "clone" ] "Use `specialisation.«name» = { inheritParentConfig = true; configuration = { ... }; }` instead.")
(mkRemovedOptionModule [ "nesting" "children" ] "Use `specialisation.«name».configuration = { ... }` instead.")
+ (mkRenamedOptionModule [ "system" "forbiddenDependenciesRegex" ] [ "system" "forbiddenDependenciesRegexes" ])
];
options = {
@@ -160,12 +161,12 @@ in
'';
};
- system.forbiddenDependenciesRegex = mkOption {
- default = "";
- example = "-dev$";
- type = types.str;
+ system.forbiddenDependenciesRegexes = mkOption {
+ default = [];
+ example = ["-dev$"];
+ type = types.listOf types.str;
description = ''
- A POSIX Extended Regular Expression that matches store paths that
+ POSIX Extended Regular Expressions that match store paths that
should not appear in the system closure, with the exception of {option}`system.extraDependencies`, which is not checked.
'';
};
@@ -289,15 +290,14 @@ in
"$out/configuration.nix"
'' +
optionalString
- (config.system.forbiddenDependenciesRegex != "")
- ''
- if [[ $forbiddenDependenciesRegex != "" && -n $closureInfo ]]; then
- if forbiddenPaths="$(grep -E -- "$forbiddenDependenciesRegex" $closureInfo/store-paths)"; then
+ (config.system.forbiddenDependenciesRegexes != []) (lib.concatStringsSep "\n" (map (regex: ''
+ if [[ ${regex} != "" && -n $closureInfo ]]; then
+ if forbiddenPaths="$(grep -E -- "${regex}" $closureInfo/store-paths)"; then
echo -e "System closure $out contains the following disallowed paths:\n$forbiddenPaths"
exit 1
fi
fi
- '';
+ '') config.system.forbiddenDependenciesRegexes));
system.systemBuilderArgs = {
@@ -319,8 +319,7 @@ in
# option, as opposed to `system.extraDependencies`.
passedChecks = concatStringsSep " " config.system.checks;
}
- // lib.optionalAttrs (config.system.forbiddenDependenciesRegex != "") {
- inherit (config.system) forbiddenDependenciesRegex;
+ // lib.optionalAttrs (config.system.forbiddenDependenciesRegexes != []) {
closureInfo = pkgs.closureInfo { rootPaths = [
# override to avoid infinite recursion (and to allow using extraDependencies to add forbidden dependencies)
(config.system.build.toplevel.overrideAttrs (_: { extraDependencies = []; closureInfo = null; }))
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-11 01:55:09 +0000