summaryrefslogtreecommitdiffstats
path: root/nixos
diff options
context:
space:
mode:
Diffstat (limited to 'nixos')
-rw-r--r--nixos/doc/manual/release-notes/rl-2103.xml10
-rw-r--r--nixos/modules/services/mail/rspamd.nix2
-rw-r--r--nixos/modules/services/misc/nix-daemon.nix2
-rw-r--r--nixos/modules/services/networking/powerdns.nix40
-rw-r--r--nixos/modules/services/networking/prosody.nix2
-rw-r--r--nixos/modules/services/security/fail2ban.nix4
-rw-r--r--nixos/modules/services/security/usbguard.nix4
-rw-r--r--nixos/modules/services/x11/display-managers/gdm.nix2
-rw-r--r--nixos/modules/services/x11/display-managers/sddm.nix4
-rw-r--r--nixos/tests/powerdns.nix60
10 files changed, 95 insertions, 35 deletions
diff --git a/nixos/doc/manual/release-notes/rl-2103.xml b/nixos/doc/manual/release-notes/rl-2103.xml
index c160ab5783d3..374ea1cbd165 100644
--- a/nixos/doc/manual/release-notes/rl-2103.xml
+++ b/nixos/doc/manual/release-notes/rl-2103.xml
@@ -99,6 +99,16 @@
to <literal>/run/pdns-recursor</literal> to match upstream.
</para>
</listitem>
+ <listitem>
+ <para>
+ PowerDNS has been updated from <literal>4.2.x</literal> to <literal>4.3.x</literal>. Please
+ be sure to review the <link xlink:href="https://doc.powerdns.com/authoritative/upgrading.html#x-to-4-3-0">Upgrade Notes</link>
+ provided by upstream before upgrading. Worth specifically noting is that the service now runs
+ entirely as a dedicated <literal>pdns</literal> user, instead of starting as <literal>root</literal>
+ and dropping privileges, as well as the default <literal>socket-dir</literal> location changing from
+ <literal>/var/lib/powerdns</literal> to <literal>/run/pdns</literal>.
+ </para>
+ </listitem>
</itemizedlist>
</section>
diff --git a/nixos/modules/services/mail/rspamd.nix b/nixos/modules/services/mail/rspamd.nix
index aacdbe2aeed2..86a3f52107d5 100644
--- a/nixos/modules/services/mail/rspamd.nix
+++ b/nixos/modules/services/mail/rspamd.nix
@@ -153,7 +153,7 @@ let
${concatStringsSep "\n" (mapAttrsToList (name: value: let
includeName = if name == "rspamd_proxy" then "proxy" else name;
- tryOverride = if value.extraConfig == "" then "true" else "false";
+ tryOverride = boolToString (value.extraConfig == "");
in ''
worker "${value.type}" {
type = "${value.type}";
diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix
index 2680b1cc0d3b..ed05882a6343 100644
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@@ -45,7 +45,7 @@ let
trusted-substituters = ${toString cfg.trustedBinaryCaches}
trusted-public-keys = ${toString cfg.binaryCachePublicKeys}
auto-optimise-store = ${boolToString cfg.autoOptimiseStore}
- require-sigs = ${if cfg.requireSignedBinaryCaches then "true" else "false"}
+ require-sigs = ${boolToString cfg.requireSignedBinaryCaches}
trusted-users = ${toString cfg.trustedUsers}
allowed-users = ${toString cfg.allowedUsers}
${optionalString (!cfg.distributedBuilds) ''
diff --git a/nixos/modules/services/networking/powerdns.nix b/nixos/modules/services/networking/powerdns.nix
index ba05e15389f6..8cae61b83543 100644
--- a/nixos/modules/services/networking/powerdns.nix
+++ b/nixos/modules/services/networking/powerdns.nix
@@ -8,42 +8,40 @@ let
in {
options = {
services.powerdns = {
- enable = mkEnableOption "Powerdns domain name server";
+ enable = mkEnableOption "PowerDNS domain name server";
extraConfig = mkOption {
type = types.lines;
default = "launch=bind";
description = ''
- Extra lines to be added verbatim to pdns.conf.
- Powerdns will chroot to /var/lib/powerdns.
- So any file, powerdns is supposed to be read,
- should be in /var/lib/powerdns and needs to specified
- relative to the chroot.
+ PowerDNS configuration. Refer to
+ <link xlink:href="https://doc.powerdns.com/authoritative/settings.html"/>
+ for details on supported values.
'';
};
};
};
- config = mkIf config.services.powerdns.enable {
+ config = mkIf cfg.enable {
+
+ systemd.packages = [ pkgs.powerdns ];
+
systemd.services.pdns = {
- unitConfig.Documentation = "man:pdns_server(1) man:pdns_control(1)";
- description = "Powerdns name server";
wantedBy = [ "multi-user.target" ];
- after = ["network.target" "mysql.service" "postgresql.service" "openldap.service"];
+ after = [ "network.target" "mysql.service" "postgresql.service" "openldap.service" ];
serviceConfig = {
- Restart="on-failure";
- RestartSec="1";
- StartLimitInterval="0";
- PrivateDevices=true;
- CapabilityBoundingSet="CAP_CHOWN CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT";
- NoNewPrivileges=true;
- ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /var/lib/powerdns";
- ExecStart = "${pkgs.powerdns}/bin/pdns_server --setuid=nobody --setgid=nogroup --chroot=/var/lib/powerdns --socket-dir=/ --daemon=no --guardian=no --disable-syslog --write-pid=no --config-dir=${configDir}";
- ProtectSystem="full";
- ProtectHome=true;
- RestrictAddressFamilies="AF_UNIX AF_INET AF_INET6";
+ ExecStart = [ "" "${pkgs.powerdns}/bin/pdns_server --config-dir=${configDir} --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no" ];
};
};
+
+ users.users.pdns = {
+ isSystemUser = true;
+ group = "pdns";
+ description = "PowerDNS";
+ };
+
+ users.groups.pdns = {};
+
};
}
diff --git a/nixos/modules/services/networking/prosody.nix b/nixos/modules/services/networking/prosody.nix
index a6c1cb0f4797..e7a7aa700be6 100644
--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@@ -261,7 +261,7 @@ let
toLua = x:
if builtins.isString x then ''"${x}"''
- else if builtins.isBool x then (if x == true then "true" else "false")
+ else if builtins.isBool x then boolToString x
else if builtins.isInt x then toString x
else if builtins.isList x then ''{ ${lib.concatStringsSep ", " (map (n: toLua n) x) } }''
else throw "Invalid Lua value";
diff --git a/nixos/modules/services/security/fail2ban.nix b/nixos/modules/services/security/fail2ban.nix
index 3f84f9c2560c..cf0d72d5c531 100644
--- a/nixos/modules/services/security/fail2ban.nix
+++ b/nixos/modules/services/security/fail2ban.nix
@@ -282,12 +282,12 @@ in
services.fail2ban.jails.DEFAULT = ''
${optionalString cfg.bantime-increment.enable ''
# Bantime incremental
- bantime.increment = ${if cfg.bantime-increment.enable then "true" else "false"}
+ bantime.increment = ${boolToString cfg.bantime-increment.enable}
bantime.maxtime = ${cfg.bantime-increment.maxtime}
bantime.factor = ${cfg.bantime-increment.factor}
bantime.formula = ${cfg.bantime-increment.formula}
bantime.multipliers = ${cfg.bantime-increment.multipliers}
- bantime.overalljails = ${if cfg.bantime-increment.overalljails then "true" else "false"}
+ bantime.overalljails = ${boolToString cfg.bantime-increment.overalljails}
''}
# Miscellaneous options
ignoreip = 127.0.0.1/8 ${optionalString config.networking.enableIPv6 "::1"} ${concatStringsSep " " cfg.ignoreIP}
diff --git a/nixos/modules/services/security/usbguard.nix b/nixos/modules/services/security/usbguard.nix
index 16a90da52314..71fd71a2cab2 100644
--- a/nixos/modules/services/security/usbguard.nix
+++ b/nixos/modules/services/security/usbguard.nix
@@ -19,13 +19,13 @@ let
PresentDevicePolicy=${cfg.presentDevicePolicy}
PresentControllerPolicy=${cfg.presentControllerPolicy}
InsertedDevicePolicy=${cfg.insertedDevicePolicy}
- RestoreControllerDeviceState=${if cfg.restoreControllerDeviceState then "true" else "false"}
+ RestoreControllerDeviceState=${boolToString cfg.restoreControllerDeviceState}
# this does not seem useful for endusers to change
DeviceManagerBackend=uevent
IPCAllowedUsers=${concatStringsSep " " cfg.IPCAllowedUsers}
IPCAllowedGroups=${concatStringsSep " " cfg.IPCAllowedGroups}
IPCAccessControlFiles=/var/lib/usbguard/IPCAccessControl.d/
- DeviceRulesWithPort=${if cfg.deviceRulesWithPort then "true" else "false"}
+ DeviceRulesWithPort=${boolToString cfg.deviceRulesWithPort}
# HACK: that way audit logs still land in the journal
AuditFilePath=/dev/null
'';
diff --git a/nixos/modules/services/x11/display-managers/gdm.nix b/nixos/modules/services/x11/display-managers/gdm.nix
index eae70a57c781..25b424e485f3 100644
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@@ -264,7 +264,7 @@ in
# presented and there's a little delay.
environment.etc."gdm/custom.conf".text = ''
[daemon]
- WaylandEnable=${if cfg.gdm.wayland then "true" else "false"}
+ WaylandEnable=${boolToString cfg.gdm.wayland}
${optionalString cfg.autoLogin.enable (
if cfg.gdm.autoLogin.delay > 0 then ''
TimedLoginEnable=true
diff --git a/nixos/modules/services/x11/display-managers/sddm.nix b/nixos/modules/services/x11/display-managers/sddm.nix
index e63bb2e44539..4040b903426b 100644
--- a/nixos/modules/services/x11/display-managers/sddm.nix
+++ b/nixos/modules/services/x11/display-managers/sddm.nix
@@ -55,10 +55,10 @@ let
XauthPath=${pkgs.xorg.xauth}/bin/xauth
DisplayCommand=${Xsetup}
DisplayStopCommand=${Xstop}
- EnableHidpi=${if cfg.enableHidpi then "true" else "false"}
+ EnableHidpi=${boolToString cfg.enableHidpi}
[Wayland]
- EnableHidpi=${if cfg.enableHidpi then "true" else "false"}
+ EnableHidpi=${boolToString cfg.enableHidpi}
SessionDir=${dmcfg.sessionData.desktops}/share/wayland-sessions
${optionalString dmcfg.autoLogin.enable ''
diff --git a/nixos/tests/powerdns.nix b/nixos/tests/powerdns.nix
index 75d71315e644..d025934ad2b3 100644
--- a/nixos/tests/powerdns.nix
+++ b/nixos/tests/powerdns.nix
@@ -1,13 +1,65 @@
-import ./make-test-python.nix ({ pkgs, ... }: {
+# This test runs PowerDNS authoritative server with the
+# generic MySQL backend (gmysql) to connect to a
+# MariaDB server using UNIX sockets authentication.
+
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
name = "powerdns";
nodes.server = { ... }: {
services.powerdns.enable = true;
- environment.systemPackages = [ pkgs.dnsutils ];
+ services.powerdns.extraConfig = ''
+ launch=gmysql
+ gmysql-user=pdns
+ '';
+
+ services.mysql = {
+ enable = true;
+ package = pkgs.mariadb;
+ ensureDatabases = [ "powerdns" ];
+ ensureUsers = lib.singleton
+ { name = "pdns";
+ ensurePermissions = { "powerdns.*" = "ALL PRIVILEGES"; };
+ };
+ };
+
+ environment.systemPackages = with pkgs;
+ [ dnsutils powerdns mariadb ];
};
testScript = ''
- server.wait_for_unit("pdns")
- server.succeed("dig version.bind txt chaos \@127.0.0.1")
+ import re
+
+ with subtest("PowerDNS database exists"):
+ server.wait_for_unit("mysql")
+ server.succeed("echo 'SHOW DATABASES;' | sudo -u pdns mysql -u pdns >&2")
+
+ with subtest("Loading the MySQL schema works"):
+ server.succeed(
+ "sudo -u pdns mysql -u pdns -D powerdns <"
+ "${pkgs.powerdns}/share/doc/pdns/schema.mysql.sql"
+ )
+
+ with subtest("PowerDNS server starts"):
+ server.wait_for_unit("pdns")
+ server.succeed("dig version.bind txt chaos @127.0.0.1 >&2")
+
+ with subtest("Adding an example zone works"):
+ # Extract configuration file needed by pdnsutil
+ unit = server.succeed("systemctl cat pdns")
+ conf = re.search("(--config-dir=[^ ]+)", unit).group(1)
+ pdnsutil = "sudo -u pdns pdnsutil " + conf
+ server.succeed(f"{pdnsutil} create-zone example.com ns1.example.com")
+ server.succeed(f"{pdnsutil} add-record example.com ns1 A 192.168.1.2")
+
+ with subtest("Querying the example zone works"):
+ reply = server.succeed("dig +noall +answer ns1.example.com @127.0.0.1")
+ assert (
+ "192.168.1.2" in reply
+ ), f""""
+ The reply does not contain the expected IP address:
+ Expected:
+ ns1.example.com. 3600 IN A 192.168.1.2
+ Reply:
+ {reply}"""
'';
})
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-17 16:24:07 +0000