summaryrefslogtreecommitdiffstats
path: root/nixos
diff options
context:
space:
mode:
Diffstat (limited to 'nixos')
-rw-r--r--nixos/doc/manual/release-notes/rl-2405.section.md5
-rw-r--r--nixos/modules/profiles/perlless.nix2
-rw-r--r--nixos/modules/services/hardware/kanata.nix31
-rw-r--r--nixos/modules/services/misc/zoneminder.nix2
-rw-r--r--nixos/modules/services/security/oauth2-proxy.nix2
-rw-r--r--nixos/modules/services/security/step-ca.nix2
-rw-r--r--nixos/modules/services/web-apps/nextcloud.md5
-rw-r--r--nixos/modules/services/web-apps/nextcloud.nix4
-rw-r--r--nixos/modules/services/web-servers/caddy/default.nix3
-rw-r--r--nixos/modules/services/web-servers/traefik.nix2
-rw-r--r--nixos/modules/system/activation/test.nix4
-rw-r--r--nixos/modules/system/activation/top-level.nix23
-rw-r--r--nixos/tests/patroni.nix2
13 files changed, 37 insertions, 50 deletions
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 095ddfbc6aaa..323277420229 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -282,6 +282,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
"mysecret"` becomes `services.aria2.rpcSecretFile = "/path/to/secret_file"`
where the file `secret_file` contains the string `mysecret`.
+- The `system.forbiddenDependenciesRegex` option has been renamed to `system.forbiddenDependenciesRegexes` and now has the type of `listOf string` instead of `string` to accept multiple regexes.
+
- `openssh`, `openssh_hpn` and `openssh_gssapi` are now compiled without support for the DSA signature algorithm as it is being deprecated upstream. Users still relying on DSA keys should consider upgrading
to another signature algorithm. However, for the time being it is possible to restore DSA key support using `override` to set `dsaKeysSupport = true`.
@@ -372,7 +374,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
- If [`system.stateVersion`](#opt-system.stateVersion) is >=24.05, `pkgs.nextcloud29` will be installed by default.
- If [`system.stateVersion`](#opt-system.stateVersion) is >=23.11, `pkgs.nextcloud27` will be installed by default.
- Please note that an upgrade from v27 (or older) to v29 directly is not possible. Please upgrade to `nextcloud28` (or earlier) first. Nextcloud prohibits skipping major versions while upgrading. You can upgrade by declaring [`services.nextcloud.package = pkgs.nextcloud28;`](options.html#opt-services.nextcloud.package).
- - Known warnings after the upgrade are documented in [](#module-services-nextcloud-known-warnings).
+ - Known warnings after the upgrade are documented in [](#module-services-nextcloud-known-warnings) from now on.
+ - The "Photos" app only displays Media from inside the `Photos` directory. This can be changed manually in the "Photos" tab below "Photos settings".
- The vendored third party libraries have been mostly removed from `cudaPackages.nsight_systems`, which we now only ship for `cudaPackages_11_8` and later due to outdated dependencies. Users comfortable with the vendored dependencies may use `overrideAttrs` to amend the `postPatch` phase and the `meta.broken` correspondingly. Alternatively, one could package the deprecated `boost170` locally, as required for `cudaPackages_11_4.nsight_systems`.
diff --git a/nixos/modules/profiles/perlless.nix b/nixos/modules/profiles/perlless.nix
index 90abd14f077e..010e4f8f2a28 100644
--- a/nixos/modules/profiles/perlless.nix
+++ b/nixos/modules/profiles/perlless.nix
@@ -26,6 +26,6 @@
# Check that the system does not contain a Nix store path that contains the
# string "perl".
- system.forbiddenDependenciesRegex = "perl";
+ system.forbiddenDependenciesRegexes = ["perl"];
}
diff --git a/nixos/modules/services/hardware/kanata.nix b/nixos/modules/services/hardware/kanata.nix
index 333b2d2a88a5..c7e0e93baf6e 100644
--- a/nixos/modules/services/hardware/kanata.nix
+++ b/nixos/modules/services/hardware/kanata.nix
@@ -5,6 +5,8 @@ with lib;
let
cfg = config.services.kanata;
+ upstreamDoc = "See [the upstream documentation](https://github.com/jtroo/kanata/blob/main/docs/config.adoc) and [example config files](https://github.com/jtroo/kanata/tree/main/cfg_samples) for more information.";
+
keyboard = {
options = {
devices = mkOption {
@@ -22,28 +24,16 @@ let
type = types.lines;
example = ''
(defsrc
- grv 1 2 3 4 5 6 7 8 9 0 - = bspc
- tab q w e r t y u i o p [ ] \
- caps a s d f g h j k l ; ' ret
- lsft z x c v b n m , . / rsft
- lctl lmet lalt spc ralt rmet rctl)
-
- (deflayer qwerty
- grv 1 2 3 4 5 6 7 8 9 0 - = bspc
- tab q w e r t y u i o p [ ] \
- @cap a s d f g h j k l ; ' ret
- lsft z x c v b n m , . / rsft
- lctl lmet lalt spc ralt rmet rctl)
-
- (defalias
- ;; tap within 100ms for capslk, hold more than 100ms for lctl
- cap (tap-hold 100 100 caps lctl))
+ caps)
+
+ (deflayermap (default-layer)
+ ;; tap caps lock as caps lock, hold caps lock as left control
+ caps (tap-hold 100 100 caps lctl))
'';
description = ''
Configuration other than `defcfg`.
- See [example config files](https://github.com/jtroo/kanata)
- for more information.
+ ${upstreamDoc}
'';
};
extraDefCfg = mkOption {
@@ -55,8 +45,7 @@ let
from the devices option) and
`linux-continue-if-no-devs-found` (hardcoded to be yes).
- See [example config files](https://github.com/jtroo/kanata)
- for more information.
+ ${upstreamDoc}
'';
};
extraArgs = mkOption {
@@ -153,7 +142,7 @@ in
options.services.kanata = {
enable = mkEnableOption "kanata, a tool to improve keyboard comfort and usability with advanced customization";
package = mkPackageOption pkgs "kanata" {
- example = "kanata-with-cmd";
+ example = [ "kanata-with-cmd" ];
extraDescription = ''
::: {.note}
If {option}`danger-enable-cmd` is enabled in any of the keyboards, the
diff --git a/nixos/modules/services/misc/zoneminder.nix b/nixos/modules/services/misc/zoneminder.nix
index 84c3a6710c0d..d09cd87febff 100644
--- a/nixos/modules/services/misc/zoneminder.nix
+++ b/nixos/modules/services/misc/zoneminder.nix
@@ -350,7 +350,7 @@ in {
RestartSec = "10s";
CacheDirectory = dirs cacheDirs;
RuntimeDirectory = dirName;
- ReadWriteDirectories = lib.mkIf useCustomDir [ cfg.storageDir ];
+ ReadWritePaths = lib.mkIf useCustomDir [ cfg.storageDir ];
StateDirectory = dirs (lib.optionals (!useCustomDir) libDirs);
LogsDirectory = dirName;
PrivateTmp = true;
diff --git a/nixos/modules/services/security/oauth2-proxy.nix b/nixos/modules/services/security/oauth2-proxy.nix
index 075e64b743b1..78a772845a35 100644
--- a/nixos/modules/services/security/oauth2-proxy.nix
+++ b/nixos/modules/services/security/oauth2-proxy.nix
@@ -17,7 +17,7 @@ let
inherit (cfg.github) org team;
}; };
- google = cfg: { google = with cfg.google; optionalAttrs (groups != []) {
+ google = cfg: { google = with cfg.google; lib.optionalAttrs (groups != []) {
admin-email = adminEmail;
service-account = serviceAccountJSON;
group = groups;
diff --git a/nixos/modules/services/security/step-ca.nix b/nixos/modules/services/security/step-ca.nix
index c708cb2b8910..e9195fbd5160 100644
--- a/nixos/modules/services/security/step-ca.nix
+++ b/nixos/modules/services/security/step-ca.nix
@@ -107,7 +107,7 @@ in
UMask = "0077";
Environment = "HOME=%S/step-ca";
WorkingDirectory = ""; # override upstream
- ReadWriteDirectories = ""; # override upstream
+ ReadWritePaths = ""; # override upstream
# LocalCredential handles file permission problems arising from the use of DynamicUser.
LoadCredential = "intermediate_password:${cfg.intermediatePasswordFile}";
diff --git a/nixos/modules/services/web-apps/nextcloud.md b/nixos/modules/services/web-apps/nextcloud.md
index ec860d307b38..0b615deae44b 100644
--- a/nixos/modules/services/web-apps/nextcloud.md
+++ b/nixos/modules/services/web-apps/nextcloud.md
@@ -205,11 +205,6 @@ it complains loudly now. So nothing actionable here by default. Alternatively yo
* set [](#opt-services.nextcloud.settings.log_type) to "file" to be able to view logs
from the admin panel.
-### Your web server is not properly set up to resolve `.well-known` URLs, failed on: `/.well-known/caldav` {#module-services-nextcloud-warning-wellknown-caldav}
-
-This warning appearing seems to be an upstream issue and is being sorted out
-in [nextcloud/server#45033](https://github.com/nextcloud/server/issues/45033).
-
## Maintainer information {#module-services-nextcloud-maintainer-info}
As stated in the previous paragraph, we must provide a clean upgrade-path for Nextcloud
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 21f76938f20c..f313a1c91224 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -1105,10 +1105,10 @@ in {
extraConfig = ''
absolute_redirect off;
location = /.well-known/carddav {
- return 301 /remote.php/dav;
+ return 301 /remote.php/dav/;
}
location = /.well-known/caldav {
- return 301 /remote.php/dav;
+ return 301 /remote.php/dav/;
}
location ~ ^/\.well-known/(?!acme-challenge|pki-validation) {
return 301 /index.php$request_uri;
diff --git a/nixos/modules/services/web-servers/caddy/default.nix b/nixos/modules/services/web-servers/caddy/default.nix
index 08ce50bff62c..1cd1448c7d56 100644
--- a/nixos/modules/services/web-servers/caddy/default.nix
+++ b/nixos/modules/services/web-servers/caddy/default.nix
@@ -360,6 +360,7 @@ in
serviceConfig = let
runOptions = ''--config ${configPath} ${optionalString (cfg.adapter != null) "--adapter ${cfg.adapter}"}'';
in {
+ # Override the `ExecStart` line from upstream's systemd unit file by our own:
# https://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStart=
# If the empty string is assigned to this option, the list of commands to start is reset, prior assignments of this option will have no effect.
ExecStart = [ "" ''${cfg.package}/bin/caddy run ${runOptions} ${optionalString cfg.resume "--resume"}'' ];
@@ -367,7 +368,7 @@ in
ExecReload = [ "" ''${cfg.package}/bin/caddy reload ${runOptions} --force'' ];
User = cfg.user;
Group = cfg.group;
- ReadWriteDirectories = cfg.dataDir;
+ ReadWritePaths = [ cfg.dataDir ];
StateDirectory = mkIf (cfg.dataDir == "/var/lib/caddy") [ "caddy" ];
LogsDirectory = mkIf (cfg.logDir == "/var/log/caddy") [ "caddy" ];
Restart = "on-failure";
diff --git a/nixos/modules/services/web-servers/traefik.nix b/nixos/modules/services/web-servers/traefik.nix
index 9c53455bcf3d..1a65ce21112e 100644
--- a/nixos/modules/services/web-servers/traefik.nix
+++ b/nixos/modules/services/web-servers/traefik.nix
@@ -170,7 +170,7 @@ in {
PrivateDevices = true;
ProtectHome = true;
ProtectSystem = "full";
- ReadWriteDirectories = cfg.dataDir;
+ ReadWritePaths = [ cfg.dataDir ];
RuntimeDirectory = "traefik";
};
};
diff --git a/nixos/modules/system/activation/test.nix b/nixos/modules/system/activation/test.nix
index 8cf000451c6e..fd251d528957 100644
--- a/nixos/modules/system/activation/test.nix
+++ b/nixos/modules/system/activation/test.nix
@@ -5,7 +5,7 @@
}:
let
node-forbiddenDependencies-fail = nixos ({ ... }: {
- system.forbiddenDependenciesRegex = "-dev$";
+ system.forbiddenDependenciesRegexes = ["-dev$"];
environment.etc."dev-dependency" = {
text = "${expect.dev}";
};
@@ -14,7 +14,7 @@ let
boot.loader.grub.enable = false;
});
node-forbiddenDependencies-succeed = nixos ({ ... }: {
- system.forbiddenDependenciesRegex = "-dev$";
+ system.forbiddenDependenciesRegexes = ["-dev$"];
system.extraDependencies = [ expect.dev ];
documentation.enable = false;
fileSystems."/".device = "ignore-root-device";
diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix
index 4cf3012646fa..ed0ece19f2fa 100644
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@@ -86,6 +86,7 @@ in
../build.nix
(mkRemovedOptionModule [ "nesting" "clone" ] "Use `specialisation.«name» = { inheritParentConfig = true; configuration = { ... }; }` instead.")
(mkRemovedOptionModule [ "nesting" "children" ] "Use `specialisation.«name».configuration = { ... }` instead.")
+ (mkRenamedOptionModule [ "system" "forbiddenDependenciesRegex" ] [ "system" "forbiddenDependenciesRegexes" ])
];
options = {
@@ -160,12 +161,12 @@ in
'';
};
- system.forbiddenDependenciesRegex = mkOption {
- default = "";
- example = "-dev$";
- type = types.str;
+ system.forbiddenDependenciesRegexes = mkOption {
+ default = [];
+ example = ["-dev$"];
+ type = types.listOf types.str;
description = ''
- A POSIX Extended Regular Expression that matches store paths that
+ POSIX Extended Regular Expressions that match store paths that
should not appear in the system closure, with the exception of {option}`system.extraDependencies`, which is not checked.
'';
};
@@ -289,15 +290,14 @@ in
"$out/configuration.nix"
'' +
optionalString
- (config.system.forbiddenDependenciesRegex != "")
- ''
- if [[ $forbiddenDependenciesRegex != "" && -n $closureInfo ]]; then
- if forbiddenPaths="$(grep -E -- "$forbiddenDependenciesRegex" $closureInfo/store-paths)"; then
+ (config.system.forbiddenDependenciesRegexes != []) (lib.concatStringsSep "\n" (map (regex: ''
+ if [[ ${regex} != "" && -n $closureInfo ]]; then
+ if forbiddenPaths="$(grep -E -- "${regex}" $closureInfo/store-paths)"; then
echo -e "System closure $out contains the following disallowed paths:\n$forbiddenPaths"
exit 1
fi
fi
- '';
+ '') config.system.forbiddenDependenciesRegexes));
system.systemBuilderArgs = {
@@ -319,8 +319,7 @@ in
# option, as opposed to `system.extraDependencies`.
passedChecks = concatStringsSep " " config.system.checks;
}
- // lib.optionalAttrs (config.system.forbiddenDependenciesRegex != "") {
- inherit (config.system) forbiddenDependenciesRegex;
+ // lib.optionalAttrs (config.system.forbiddenDependenciesRegexes != []) {
closureInfo = pkgs.closureInfo { rootPaths = [
# override to avoid infinite recursion (and to allow using extraDependencies to add forbidden dependencies)
(config.system.build.toplevel.overrideAttrs (_: { extraDependencies = []; closureInfo = null; }))
diff --git a/nixos/tests/patroni.nix b/nixos/tests/patroni.nix
index 1f15cd59677a..68fce4051553 100644
--- a/nixos/tests/patroni.nix
+++ b/nixos/tests/patroni.nix
@@ -155,7 +155,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
print(node.succeed("patronictl list cluster1"))
node.wait_until_succeeds(f"[ $(patronictl list -f json cluster1 | jq 'length') == {expected_replicas + 1} ]")
node.wait_until_succeeds("[ $(patronictl list -f json cluster1 | jq 'map(select(.Role | test(\"^Leader$\"))) | map(select(.State | test(\"^running$\"))) | length') == 1 ]")
- node.wait_until_succeeds(f"[ $(patronictl list -f json cluster1 | jq 'map(select(.Role | test(\"^Replica$\"))) | map(select(.State | test(\"^running$\"))) | length') == {expected_replicas} ]")
+ node.wait_until_succeeds(f"[ $(patronictl list -f json cluster1 | jq 'map(select(.Role | test(\"^Replica$\"))) | map(select(.State | test(\"^streaming$\"))) | length') == {expected_replicas} ]")
print(node.succeed("patronictl list cluster1"))
client.wait_until_succeeds("psql -h 127.0.0.1 -U postgres --command='select 1;'")
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-02 22:12:12 +0000