| Age | Commit message (Collapse) | Author |
|---|
|
|
|
rl-2003: mention grub 2.04 update
|
|
|
|
|
|
|
|
nixos/networking: make /etc/netgroup by default
|
|
nixos/uwsgi: run with capabilities instead of root
|
|
|
|
|
|
|
|
fish-foreign-env: remove alias to incompatible package
|
|
This will prevent nscd from complaining /etc/netgroup being absent.
Signed-off-by: Masanori Ogino <167209+omasanori@users.noreply.github.com>
|
|
The fish-foreign-env and the fishPlugins.foreign-env packages aren't
compatible due to changes in directory layout.
It's better to remove the alias so that the evaluation explicitly fails
instead of allowing silent runtime breakage.
GitHub: see https://github.com/NixOS/nixpkgs/pull/107834#issuecomment-756995696
GitHub: see https://github.com/LnL7/nix-darwin/issues/269
GitHub: see https://github.com/nix-community/home-manager/issues/1701
GitHub: see https://github.com/nix-community/home-manager/issues/1702
|
|
Revert "nixos/gnome3: don't install epiphany default"
|
|
|
|
nixos/tor: improve type-checking and hardening
|
|
|
|
And relocate the installed fish functions to the `vendor_functions.d` so
that they're automatically loaded.
|
|
Enabling the profile can lead to hard-to-debug issues, which should be
warned about in addition to the cost in features and performance.
See https://github.com/NixOS/nixpkgs/issues/108262 for an example.
|
|
androidenv did not previously write license files, which caused certain
gradle-based Android tools to fail. Restructure androidenv's list of
Android packages into a single repo.json file to prevent duplication
and enable us to extract the EULA texts, which we then hash with
builtins.hashString to produce the license files that Android gradle
tools look for.
Remove includeDocs and lldbVersions, as these have been removed
from the Android package repositories.
Improve documentation and examples.
|
|
Fixes #77395.
Fixes #82790.
|
|
prometheus-json-exporter: unstable-2017-10-06 -> 0.2.0
|
|
* Content of `programlisting` shouldn't be indented, otherwise it's
weirdly indented in the output.
* Use `<xref linkend=.../>` in the release notes: then users can
directly go to the option documentation when reading release notes.
* Don't use docbook tags in `mkRemovedOptionModule`: it's only used
during evaluation where docbook isn't rendered.
|
|
|
|
|
|
|
|
This reverts commit f19b7b03a03b7f1d5beb44471eb9298de4b9e186, reversing
changes made to 572a864d024b0c91ac39133f35364362b2376c07.
Sorry. I pushed the wrong staging-next (the one that had my master
merged in). This was not intended.
|
|
|
|
There are two use case for this flag:
1. NixOS developer usually use a nixpkgs checkout for development.
Copying nixpkgs everytime when rebuilding NixOS is way to slow, even
with NVME disks.
2. Folks migrating from impure configuration in a sufficient complex
infrastructure need this flag to gradually migrate to NixOS flakes.
|
|
|
|
|
|
|
|
|
|
nixos/manual: fix typo in virtualbox installation guide
|
|
|
|
[staging] wafHook: Don't wrap Python 2
|
|
assertions"
|
|
fadenb/release_notes_wpa_supplicant_breaking_change
nixos/release-notes: Warn on wpa_supplicant changes
|
|
Module-builtin assertions, disabling assertions and submodule assertions
|
|
This is a fixup of 9728907c
|
|
Previously the .enable option was used to encode the condition as well,
which lead to some oddness:
- In order to encode an assertion, one had to invert it
- To disable a check, one had to mkForce it
By introducing a separate .check option this is solved because:
- It can be used to encode assertions
- Disabling is done separately with .enable option, whose default can be
overridden without a mkForce
|
|
|
|
andir/ml2pr/PATCH-nixos-users-groups-createHome-Ensure-HOME-permissions-fix-description
nixos/users-groups: createHome: Ensure HOME permissions, fix description
|
|
Since slurm-20.11.0.1 the dbd server requires slurmdbd.conf to be
in mode 600 to protect the database password. This change creates
slurmdbd.conf on-the-fly at service startup and thus avoids that
the database password ends up in the nix store.
|
|
It's very surprising that services.tor.client.enable would set
services.privoxy.enable. This violates the principle of least
astonishment, because it's Privoxy that can integrate with Tor, rather
than the other way around.
So this patch moves the Privoxy Tor integration to the Privoxy module,
and it also disables it by default. This change is documented in the
release notes.
Reported-by: V <v@anomalous.eu>
|
|
configuration.nix(1) states
users.extraUsers.<name>.createHome
[...] If [...] the home directory already exists but is not
owned by the user, directory owner and group will be changed to
match the user.
i.e. ownership would change only if the user mismatched; the code
however ignores the owner, it is sufficient to enable `createHome`:
if ($u->{createHome}) {
make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home};
chown $u->{uid}, $u->{gid}, $u->{home};
}
Furthermore, permissions are ignored on already existing directories and
therefore may allow others to read private data eventually.
Given that createHome already acts as switch to not only create but
effectively own the home directory, manage permissions in the same
manner to ensure the intended default and cover all primary attributes.
Avoid yet another configuration option to have administrators make a
clear and simple choice between securely managing home directories
and optionally defering management to own code (taking care of custom
location, ownership, mode, extended attributes, etc.).
While here, simplify and thereby fix misleading documentation.
|
|
dnscrypt-proxy2: base settings on example config
|
|
nixos/mailman: make Postfix support optional (provided you configure the MTA yourself)
|
|
yourself)
Mailman can now work with MTAs other than Postfix. You'll have to configure
it yourself using the options in `services.mailman.settings.mta`.
This addition is reflected in the release notes for 21.03.
|
|
|
