| Age | Commit message (Collapse) | Author |
|---|
|
nixos/zfs: populate PATH with needed programs for zed
|
|
libvirt: 5.4.0 -> 6.1.0
|
|
make literalExample receive string arguments.
Fix nixos/nixos-homepage#255
|
|
|
|
|
|
nixos/btrfs: make autoScrub not prevent shutdown or suspend
|
|
NixOS/auto-upgrade: Add optional randomized delay
|
|
|
|
fixes https://github.com/NixOS/nixpkgs/issues/81602
|
|
Co-Authored-By: Pascal Hertleif <killercup@gmail.com>
|
|
|
|
openvswitch: better integration with systemd
|
|
silence warning from #63103 in encrypted-devices.nix
|
|
|
|
Fixes: #79086 #79017
|
|
3c74e48d9c8dbcede89a72ea18cd27def4b498a9 was a bit too much, it updated
permissions of all files recursively, causing files to be readable by
the group.
This isn't a problem immediately after bootup, but on a new activation,
as tmpfiles.d get restarted then, updating the permission bits of
now-existing files.
This updates the `Z` to be a `z` (the non-recursive variant), and adds a
`d` to ensure a directory is created (which should be covered by the
initrd shell script anyway)
|
|
|
|
boot.specialFileSystems is used to describe mount points to be set up in
stage 1 and 2.
We use it to create /run/keys already there, so sshd-in-initrd scenarios
can consume keys sent over through nixops send-keys.
However, it seems the kernel only supports the gid=… option for tmpfs,
not ramfs, causing /run/keys to be owned by the root group, not keys
group.
This was/is worked around in nixops by running a chown root:keys
/run/keys whenever pushing keys [1], and as machines had to have pushed keys
to be usable, this was pretty much always the case.
This is causing regressions in setups not provisioned via nixops, that
still use /run/keys for secrets (through cloud provider startup scripts
for example), as suddenly being an owner of the "keys" group isn't
enough to access the folder.
This PR removes the defunct gid=… option in the mount script called in
stage 1 and 2, and introduces a tmpfiles rule which takes care of fixing
up permissions as part of sysinit.target (very early in systemd bootup,
so before regular services are started).
In case of nixops deployments, this doesn't change anything.
nixops-based deployments receiving secrets from nixops send-keys in
initrd will simply have the permissions already set once tmpfiles is
started.
Fixes #42344
[1]: https://github.com/NixOS/nixops/blob/884d6c3994b227eb09c307e5d25d6885c9af8220/nixops/backends/__init__.py#L267-L269
|
|
temp addresses
|
|
We should wait until after `multi-user.target` is triggered to allow
hardware to finish initializing, such as network devices and USB drives.
This ensures `powertop --auto-tune` sets more tunables to "Good".
Fixes #66820
|
|
This commit moves all the virtual console related options
to a dedicated config/console.nix NixOS module.
Currently most of these are defined in config/i18n.nix
with a "console" prefix like `i18n.consoleFont`,
`i18n.consoleColors` or under `boot` and are implemented
in tasks/kbd.nix.
Since they have little to do with actual internationalisation
and are (informally) in an attrset already, it makes sense to
move them to a specific module.
|
|
|
|
nixos/networkd: only set gateway if it's explicitly specified in the module system
|
|
Systemd dependencies for scripted mode
were refactored according to analysis in #34586.
networking.vswitches can now be used with systemd-networkd,
although they are not supported by the daemon, a nixos receipe
creates the switch and attached required interfaces (just like
the scripted version).
Vlans and internal interfaces are implemented following the
template format i.e. each interface is
described using an attributeSet (vlan and type at the moment).
If vlan is present, then interface is added to the vswitch with
given tag (access mode). Type internal enabled vswitch to create
interfaces (see openvswitch docs).
Added configuration for configuring supported openFlow version on
the vswitch
This commit is a split from the original PR #35127.
|
|
A patch is necessary upstream to support multiple configs via symlinks
in /etc/request-key.d
Once that is done, we can add support for CIFS as well
|
|
A centralized list for these renames is not good because:
- It breaks disabledModules for modules that have a rename defined
- Adding/removing renames for a module means having to find them in the
central file
- Merge conflicts due to multiple people editing the central file
|
|
system
|
|
Co-authored-by: sjau <github.com@sjau.ch>
|
|
|
|
Just maching all network interfaces caused many breakages, see #18962
and #71106.
We already don't support the global networking.useDHCP,
networking.defaultGateway(6) options if networking.useNetworkd is
enabled, but direct users to configure the per-device
networking.interfaces.<name?>.… options.
|
|
nixos module zfs: provide /etc/zfs/zpool.d
|
|
This makes them consistent with the way zfs.trim is enabled
and allow to enable them by default in future.
|
|
Since we only have a single pipe we can save the overhead of building a derivation
when creating the zfs trim service file when building the system.
|
|
Also don't fail the service if there are no pools yet.
This might happen on installation ISOs.
|
|
networkd: disallow useDHCP
|
|
The scripts for zpool iostat -c and zpool status -c are located in
/etc/zfs/zpool.d
|
|
mkRemovedOptionModule: assert on removed options
|
|
We don't want to ignore config that can mess up machines. In general
this should always fail evaluation, as you think you are changing
behaviour and don't, which can easily create run-time errors we can
catch early.
|
|
TL;DR: ipv6 tests were broken (probably the privacy-extension stuff)
https://github.com/NixOS/nixpkgs/pull/68227#issuecomment-536159177
|
|
nixos/zfs: Enable trim by default
|
|
|
|
network-interfaces.nix: escape '.' in interface names passed to sysctl
|
|
|
|
|
|
|
|
This setting will be removed with the switch to systemd-networkd. The
use of per interface config is encouraged instead.
|
|
Resolves #28527
|
|
With systemd version 243 network units with empty match block will
generate warnigs. The reasoning seems to be that the intended behaviour
is hard to infere. Being explicit about really meaning any interface is
the reasonable thing here.
We want to get rid of this mechanism in the long run but as long as we
do not have a replacement we should stick with it and keep it in
reasonable good shape.
|
|
|
|
|
