diff --git a/third_party/nixpkgs/.gitattributes b/third_party/nixpkgs/.gitattributes
index 36ea933888..d77c01fd62 100644
--- a/third_party/nixpkgs/.gitattributes
+++ b/third_party/nixpkgs/.gitattributes
@@ -1,5 +1,6 @@
**/deps.nix linguist-generated
**/deps.json linguist-generated
+**/deps.toml lingust-generated
**/node-packages.nix linguist-generated
pkgs/applications/editors/emacs-modes/*-generated.nix linguist-generated
diff --git a/third_party/nixpkgs/.github/CODEOWNERS b/third_party/nixpkgs/.github/CODEOWNERS
index 2477f507a0..96bdccccf5 100644
--- a/third_party/nixpkgs/.github/CODEOWNERS
+++ b/third_party/nixpkgs/.github/CODEOWNERS
@@ -45,6 +45,7 @@
/pkgs/build-support/setup-hooks @Ericson2314
/pkgs/build-support/setup-hooks/auto-patchelf.sh @layus
/pkgs/build-support/setup-hooks/auto-patchelf.py @layus
+/pkgs/pkgs-lib @infinisil
# Nixpkgs build-support
/pkgs/build-support/writers @lassulus @Profpatsch
@@ -132,7 +133,7 @@
/pkgs/development/ruby-modules @marsam
# Rust
-/pkgs/development/compilers/rust @Mic92 @LnL7 @zowoq @winterqt @figsoda
+/pkgs/development/compilers/rust @Mic92 @zowoq @winterqt @figsoda
/pkgs/build-support/rust @zowoq @winterqt @figsoda
/doc/languages-frameworks/rust.section.md @zowoq @winterqt @figsoda
diff --git a/third_party/nixpkgs/.github/workflows/manual-rendering.yml b/third_party/nixpkgs/.github/workflows/manual-rendering.yml
index f571bf773f..ad47776086 100644
--- a/third_party/nixpkgs/.github/workflows/manual-rendering.yml
+++ b/third_party/nixpkgs/.github/workflows/manual-rendering.yml
@@ -54,7 +54,7 @@ jobs:
# less noisy until all nixpkgs pull requests have stopped using
# docbook for option docs.
- name: Comment on failure
- uses: peter-evans/create-or-update-comment@v2
+ uses: peter-evans/create-or-update-comment@v3
if: ${{ failure() && steps.check.conclusion == 'failure' }}
with:
issue-number: 189318
diff --git a/third_party/nixpkgs/.github/workflows/periodic-merge-24h.yml b/third_party/nixpkgs/.github/workflows/periodic-merge-24h.yml
index 6d6bbb7e14..ae39d6cfef 100644
--- a/third_party/nixpkgs/.github/workflows/periodic-merge-24h.yml
+++ b/third_party/nixpkgs/.github/workflows/periodic-merge-24h.yml
@@ -51,7 +51,7 @@ jobs:
github_token: ${{ secrets.GITHUB_TOKEN }}
- name: Comment on failure
- uses: peter-evans/create-or-update-comment@v2
+ uses: peter-evans/create-or-update-comment@v3
if: ${{ failure() }}
with:
issue-number: 105153
diff --git a/third_party/nixpkgs/.github/workflows/periodic-merge-6h.yml b/third_party/nixpkgs/.github/workflows/periodic-merge-6h.yml
index 764ccaec0d..300c418054 100644
--- a/third_party/nixpkgs/.github/workflows/periodic-merge-6h.yml
+++ b/third_party/nixpkgs/.github/workflows/periodic-merge-6h.yml
@@ -49,7 +49,7 @@ jobs:
github_token: ${{ secrets.GITHUB_TOKEN }}
- name: Comment on failure
- uses: peter-evans/create-or-update-comment@v2
+ uses: peter-evans/create-or-update-comment@v3
if: ${{ failure() }}
with:
issue-number: 105153
diff --git a/third_party/nixpkgs/.github/workflows/update-terraform-providers.yml b/third_party/nixpkgs/.github/workflows/update-terraform-providers.yml
index 050d764ddc..e0e68b4bf1 100644
--- a/third_party/nixpkgs/.github/workflows/update-terraform-providers.yml
+++ b/third_party/nixpkgs/.github/workflows/update-terraform-providers.yml
@@ -46,7 +46,7 @@ jobs:
run: |
git clean -f
- name: create PR
- uses: peter-evans/create-pull-request@v4
+ uses: peter-evans/create-pull-request@v5
with:
body: |
Automatic update by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.
diff --git a/third_party/nixpkgs/doc/builders/special/darwin-builder.section.md b/third_party/nixpkgs/doc/builders/special/darwin-builder.section.md
index 3913b69249..30bf2d0951 100644
--- a/third_party/nixpkgs/doc/builders/special/darwin-builder.section.md
+++ b/third_party/nixpkgs/doc/builders/special/darwin-builder.section.md
@@ -61,3 +61,89 @@ builders-use-substitutes = true
```ShellSession
$ sudo launchctl kickstart -k system/org.nixos.nix-daemon
```
+
+## Example flake usage
+
+```
+{
+ inputs = {
+ nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-22.11-darwin";
+ darwin.url = "github:lnl7/nix-darwin/master";
+ darwin.inputs.nixpkgs.follows = "nixpkgs";
+ };
+
+ outputs = { self, darwin, nixpkgs, ... }@inputs:
+ let
+
+ inherit (darwin.lib) darwinSystem;
+ system = "aarch64-darwin";
+ pkgs = nixpkgs.legacyPackages."${system}";
+ linuxSystem = builtins.replaceStrings [ "darwin" ] [ "linux" ] system;
+
+ darwin-builder = nixpkgs.lib.nixosSystem {
+ system = linuxSystem;
+ modules = [
+ "${nixpkgs}/nixos/modules/profiles/macos-builder.nix"
+ { virtualisation.host.pkgs = pkgs; }
+ ];
+ };
+ in {
+
+ darwinConfigurations = {
+ machine1 = darwinSystem {
+ inherit system;
+ modules = [
+ {
+ nix.distributedBuilds = true;
+ nix.buildMachines = [{
+ hostName = "ssh://builder@localhost";
+ system = linuxSystem;
+ maxJobs = 4;
+ supportedFeatures = [ "kvm" "benchmark" "big-parallel" ];
+ }];
+
+ launchd.daemons.darwin-builder = {
+ command = "${darwin-builder.config.system.build.macos-builder-installer}/bin/create-builder";
+ serviceConfig = {
+ KeepAlive = true;
+ RunAtLoad = true;
+ StandardOutPath = "/var/log/darwin-builder.log";
+ StandardErrorPath = "/var/log/darwin-builder.log";
+ };
+ };
+ }
+ ];
+ };
+ };
+
+ };
+}
+```
+
+## Reconfiguring the builder
+
+Initially you should not change the builder configuration else you will not be
+able to use the binary cache. However, after you have the builder running locally
+you may use it to build a modified builder with additional storage or memory.
+
+To do this, you just need to set the `virtualisation.darwin-builder.*` parameters as
+in the example below and rebuild.
+
+```
+ darwin-builder = nixpkgs.lib.nixosSystem {
+ system = linuxSystem;
+ modules = [
+ "${nixpkgs}/nixos/modules/profiles/macos-builder.nix"
+ {
+ virtualisation.host.pkgs = pkgs;
+ virtualisation.darwin-builder.diskSize = 5120;
+ virtualisation.darwin-builder.memorySize = 1024;
+ virtualisation.darwin-builder.hostPort = 33022;
+ virtualisation.darwin-builder.workingDirectory = "/var/lib/darwin-builder";
+ }
+ ];
+```
+
+You may make any other changes to your VM in this attribute set. For example,
+you could enable Docker or X11 forwarding to your Darwin host.
+
diff --git a/third_party/nixpkgs/doc/contributing/coding-conventions.chapter.md b/third_party/nixpkgs/doc/contributing/coding-conventions.chapter.md
index 2530b14a2f..7a538de18d 100644
--- a/third_party/nixpkgs/doc/contributing/coding-conventions.chapter.md
+++ b/third_party/nixpkgs/doc/contributing/coding-conventions.chapter.md
@@ -454,7 +454,7 @@ In the file `pkgs/top-level/all-packages.nix` you can find fetch helpers, these
owner = "NixOS";
repo = "nix";
rev = "1f795f9f44607cc5bec70d1300150bfefcef2aae";
- hash = "ha256-7D4m+saJjbSFP5hOwpQq2FGR2rr+psQMTcyb1ZvtXsQ=;
+ hash = "ha256-7D4m+saJjbSFP5hOwpQq2FGR2rr+psQMTcyb1ZvtXsQ=";
}
```
diff --git a/third_party/nixpkgs/doc/languages-frameworks/index.xml b/third_party/nixpkgs/doc/languages-frameworks/index.xml
index f089b99a04..e1e35564e3 100644
--- a/third_party/nixpkgs/doc/languages-frameworks/index.xml
+++ b/third_party/nixpkgs/doc/languages-frameworks/index.xml
@@ -25,6 +25,7 @@
+
diff --git a/third_party/nixpkgs/doc/languages-frameworks/lisp.section.md b/third_party/nixpkgs/doc/languages-frameworks/lisp.section.md
new file mode 100644
index 0000000000..3c408eaa09
--- /dev/null
+++ b/third_party/nixpkgs/doc/languages-frameworks/lisp.section.md
@@ -0,0 +1,304 @@
+# lisp-modules {#lisp}
+
+This document describes the Nixpkgs infrastructure for building Common Lisp
+libraries that use ASDF (Another System Definition Facility). It lives in
+`pkgs/development/lisp-modules`.
+
+## Overview {#lisp-overview}
+
+The main entry point of the API are the Common Lisp implementation packages
+(e.g. `abcl`, `ccl`, `clasp-common-lisp`, `clisp` `ecl`, `sbcl`)
+themselves. They have the `pkgs` and `withPackages` attributes, which can be
+used to discover available packages and to build wrappers, respectively.
+
+The `pkgs` attribute set contains packages that were automatically imported from
+Quicklisp, and any other manually defined ones. Not every package works for all
+the CL implementations (e.g. `nyxt` only makes sense for `sbcl`).
+
+The `withPackages` function is of primary utility. It is used to build runnable
+wrappers, with a pinned and pre-built ASDF FASL available in the `ASDF`
+environment variable, and `CL_SOURCE_REGISTRY`/`ASDF_OUTPUT_TRANSLATIONS`
+configured to find the desired systems on runtime.
+
+With a few exceptions, the primary thing that the infrastructure does is to run
+`asdf:load-system` for each system specified in the `systems` argument to
+`build-asdf-system`, and save the FASLs to the Nix store. Then, it makes these
+FASLs available to wrappers. Any other use-cases, such as producing SBCL
+executables with `sb-ext:save-lisp-and-die`, are achieved via overriding the
+`buildPhase` etc.
+
+In addition, Lisps have the `withOverrides` function, which can be used to
+substitute any package in the scope of their `pkgs`. This will be useful
+together with `overrideLispAttrs` when dealing with slashy ASDF systems, because
+they should stay in the main package and be build by specifying the `systems`
+argument to `build-asdf-system`.
+
+## The 90% use case example {#lisp-use-case-example}
+
+The most common way to use the library is to run ad-hoc wrappers like this:
+
+`nix-shell -p 'sbcl.withPackages (ps: with ps; [ alexandria ])'`
+
+Then, in a shell:
+
+```
+$ result/bin/sbcl
+* (load (sb-ext:posix-getenv "ASDF"))
+* (asdf:load-system 'alexandria)
+```
+
+Also one can create a `pkgs.mkShell` environment in `shell.nix`/`flake.nix`:
+
+```
+let
+ sbcl' = sbcl.withPackages (ps: [ ps.alexandria ]);
+in mkShell {
+ buildInputs = [ sbcl' ];
+}
+```
+
+Such a Lisp can be now used e.g. to compile your sources:
+
+```
+buildPhase = ''
+ ${sbcl'}/bin/sbcl --load my-build-file.lisp
+''
+```
+
+## Importing packages from Quicklisp {#lisp-importing-packages-from-quicklisp}
+
+The library is able to very quickly import all the packages distributed by
+Quicklisp by parsing its `releases.txt` and `systems.txt` files. These files are
+available from [http://beta.quicklisp.org/dist/quicklisp.txt].
+
+The import process is implemented in the `import` directory as Common Lisp
+functions in the `org.lispbuilds.nix` ASDF system. To run the script, one can
+execute `ql-import.lisp`:
+
+```
+nix-shell --run 'sbcl --script ql-import.lisp'
+```
+
+The script will:
+
+1. Download the latest Quicklisp `systems.txt` and `releases.txt` files
+2. Generate an SQLite database of all QL systems in `packages.sqlite`
+3. Generate an `imported.nix` file from the database
+
+The maintainer's job there is to:
+
+1. Re-run the `ql-import.lisp` script
+2. Add missing native dependencies in `ql.nix`
+3. For packages that still don't build, package them manually in `packages.nix`
+
+Also, the `imported.nix` file **must not be edited manually**! It should only be
+generated as described in this section.
+
+### Adding native dependencies {#lisp-quicklisp-adding-native-dependencies}
+
+The Quicklisp files contain ASDF dependency data, but don't include native
+library (CFFI) dependencies, and, in the case of ABCL, Java dependencies.
+
+The `ql.nix` file contains a long list of overrides, where these dependencies
+can be added.
+
+Packages defined in `packages.nix` contain these dependencies naturally.
+
+### Trusting `systems.txt` and `releases.txt` {#lisp-quicklisp-trusting}
+
+The previous implementation of `lisp-modules` didn't fully trust the Quicklisp
+data, because there were times where the dependencies specified were not
+complete, and caused broken builds. It instead used a `nix-shell` environment to
+discover real dependencies by using the ASDF APIs.
+
+The current implementation has chosen to trust this data, because it's faster to
+parse a text file than to build each system to generate its Nix file, and
+because that way packages can be mass-imported. Because of that, there may come
+a day where some packages will break, due to bugs in Quicklisp. In that case,
+the fix could be a manual override in `packages.nix` and `ql.nix`.
+
+A known fact is that Quicklisp doesn't include dependencies on slashy systems in
+its data. This is an example of a situation where such fixes were used, e.g. to
+replace the `systems` attribute of the affected packages. (See the definition of
+`iolib`).
+
+### Quirks {#lisp-quicklisp-quirks}
+
+During Quicklisp import:
+
+- `+` in names are converted to `_plus{_,}`: `cl+ssl`->`cl_plus_ssl`, `alexandria+`->`alexandria_plus`
+- `.` to `_dot_`: `iolib.base`->`iolib_dot_base`
+- names starting with a number have a `_` prepended (`3d-vectors`->`_3d-vectors`)
+- `_` in names is converted to `__` for reversibility
+
+
+## Defining packages manually inside Nixpkgs {#lisp-defining-packages-inside}
+
+New packages, that for some reason are not in Quicklisp, and so cannot be
+auto-imported, can be written in the `packages.nix` file.
+
+In that file, use the `build-asdf-system` function, which is a wrapper around
+`mkDerivation` for building ASDF systems. Various other hacks are present, such
+as `build-with-compile-into-pwd` for systems which create files during
+compilation.
+
+The `build-asdf-system` function is documented with comments in
+`nix-cl.nix`. Also, `packages.nix` is full of examples of how to use it.
+
+## Defining packages manually outside Nixpkgs {#lisp-defining-packages-outside}
+
+Lisp derivations (`abcl`, `sbcl` etc.) also export the `buildASDFSystem`
+function, which is the same as `build-asdf-system`, except for the `lisp`
+argument which is set to the given CL implementation.
+
+It can be used to define packages outside Nixpkgs, and, for example, add them
+into the package scope with `withOverrides` which will be discussed later on.
+
+### Including an external package in scope {#lisp-including-external-pkg-in-scope}
+
+A package defined outside Nixpkgs using `buildASDFSystem` can be woven into the
+Nixpkgs-provided scope like this:
+
+```
+let
+ alexandria = sbcl.buildASDFSystem rec {
+ pname = "alexandria";
+ version = "1.4";
+ src = fetchFromGitLab {
+ domain = "gitlab.common-lisp.net";
+ owner = "alexandria";
+ repo = "alexandria";
+ rev = "v${version}";
+ hash = "sha256-1Hzxt65dZvgOFIljjjlSGgKYkj+YBLwJCACi5DZsKmQ=";
+ };
+ };
+ sbcl' = sbcl.withOverrides (self: super: {
+ inherit alexandria;
+ });
+in sbcl'.pkgs.alexandria
+```
+
+## Overriding package attributes {#lisp-overriding-package-attributes}
+
+Packages export the `overrideLispAttrs` function, which can be used to build a
+new package with different parameters.
+
+Example of overriding `alexandria`:
+
+```
+sbcl.pkgs.alexandria.overrideLispAttrs (oldAttrs: rec {
+ version = "1.4";
+ src = fetchFromGitLab {
+ domain = "gitlab.common-lisp.net";
+ owner = "alexandria";
+ repo = "alexandria";
+ rev = "v${version}";
+ hash = "sha256-1Hzxt65dZvgOFIljjjlSGgKYkj+YBLwJCACi5DZsKmQ=";
+ };
+})
+```
+
+## Overriding packages in scope {#lisp-overriding-packages-in-scope}
+
+Packages can be woven into a new scope by using `withOverrides`:
+
+```
+let
+ sbcl' = sbcl.withOverrides (self: super: {
+ alexandria = super.alexandria.overrideLispAttrs (oldAttrs: rec {
+ pname = "alexandria";
+ version = "1.4";
+ src = fetchFromGitLab {
+ domain = "gitlab.common-lisp.net";
+ owner = "alexandria";
+ repo = "alexandria";
+ rev = "v${version}";
+ hash = "sha256-1Hzxt65dZvgOFIljjjlSGgKYkj+YBLwJCACi5DZsKmQ=";
+ };
+ });
+ });
+in builtins.elemAt sbcl'.pkgs.bordeaux-threads.lispLibs 0
+```
+
+### Dealing with slashy systems {#lisp-dealing-with-slashy-systems}
+
+Slashy (secondary) systems should not exist in their own packages! Instead, they
+should be included in the parent package as an extra entry in the `systems`
+argument to the `build-asdf-system`/`buildASDFSystem` functions.
+
+The reason is that ASDF searches for a secondary system in the `.asd` of the
+parent package. Thus, having them separate would cause either one of them not to
+load cleanly, because one will contains FASLs of itself but not the other, and
+vice versa.
+
+To package slashy systems, use `overrideLispAttrs`, like so:
+
+```
+ecl.pkgs.alexandria.overrideLispAttrs (oldAttrs: {
+ systems = oldAttrs.systems ++ [ "alexandria/tests" ];
+ lispLibs = oldAttrs.lispLibs ++ [ ecl.pkgs.rt ];
+})
+```
+
+See the respective section on using `withOverrides` for how to weave it back
+into `ecl.pkgs`.
+
+Note that sometimes the slashy systems might not only have more dependencies
+than the main one, but create a circular dependency between `.asd`
+files. Unfortunately, in this case an adhoc solution becomes necessary.
+
+## Building Wrappers {#lisp-building-wrappers}
+
+Wrappers can be built using the `withPackages` function of Common Lisp
+implementations (`abcl`, `ecl`, `sbcl` etc.):
+
+```
+sbcl.withPackages (ps: [ ps.alexandria ps.bordeaux-threads ])
+```
+
+Such a wrapper can then be executed like this:
+
+```
+result/bin/sbcl
+```
+
+### Loading ASDF {#lisp-loading-asdf}
+
+For best results, avoid calling `(require 'asdf)` When using the
+library-generated wrappers.
+
+Use `(load (ext:getenv "ASDF"))` instead, supplying your implementation's way of
+getting an environment variable for `ext:getenv`. This will load the
+(pre-compiled to FASL) Nixpkgs-provided version of ASDF.
+
+### Loading systems {#lisp-loading-systems}
+
+There, you can simply use `asdf:load-system`. This works by setting the right
+values for the `CL_SOURCE_REGISTRY`/`ASDF_OUTPUT_TRANSLATIONS` environment
+variables, so that systems are found in the Nix store and pre-compiled FASLs are
+loaded.
+
+## Adding a new Lisp {#lisp-adding-a-new-lisp}
+
+The function `wrapLisp` is used to wrap Common Lisp implementations. It adds the
+`pkgs`, `withPackages`, `withOverrides` and `buildASDFSystem` attributes to the
+derivation.
+
+`wrapLisp` takes these arguments:
+
+- `pkg`: the Lisp package
+- `faslExt`: Implementation-specific extension for FASL files
+- `program`: The name of executable file in `${pkg}/bin/` (Default: `pkg.pname`)
+- `flags`: A list of flags to always pass to `program` (Default: `[]`)
+- `asdf`: The ASDF version to use (Default: `pkgs.asdf_3_3`)
+- `packageOverrides`: Package overrides config (Default: `(self: super: {})`)
+
+This example wraps CLISP:
+
+```
+wrapLisp {
+ pkg = clisp;
+ faslExt = "fas";
+ flags = ["-E" "UTF8"];
+}
+```
diff --git a/third_party/nixpkgs/doc/languages-frameworks/rust.section.md b/third_party/nixpkgs/doc/languages-frameworks/rust.section.md
index 689dd938d7..a9a817201c 100644
--- a/third_party/nixpkgs/doc/languages-frameworks/rust.section.md
+++ b/third_party/nixpkgs/doc/languages-frameworks/rust.section.md
@@ -162,7 +162,7 @@ required to build a rust package. A simple fix is to use:
```nix
postPatch = ''
- cp ${./Cargo.lock} Cargo.lock
+ ln -s ${./Cargo.lock} Cargo.lock
'';
```
diff --git a/third_party/nixpkgs/doc/languages-frameworks/texlive.section.md b/third_party/nixpkgs/doc/languages-frameworks/texlive.section.md
index e790e217ca..72ab14126b 100644
--- a/third_party/nixpkgs/doc/languages-frameworks/texlive.section.md
+++ b/third_party/nixpkgs/doc/languages-frameworks/texlive.section.md
@@ -40,17 +40,24 @@ Since release 15.09 there is a new TeX Live packaging that lives entirely under
## Custom packages {#sec-language-texlive-custom-packages}
+You may find that you need to use an external TeX package. A derivation for such package has to provide the contents of the "texmf" directory in its output and provide the appropriate `tlType` attribute (one of `"run"`, `"bin"`, `"doc"`, `"source"`). Dependencies on other TeX packages can be listed in the attribute `tlDeps`.
-You may find that you need to use an external TeX package. A derivation for such package has to provide contents of the "texmf" directory in its output and provide the `tlType` attribute. Here is a (very verbose) example:
+Such derivation must then be listed in the attribute `pkgs` of an attribute set passed to `texlive.combine`, for instance by passing `extraPkgs = { pkgs = [ custom_package ]; };`. Within Nixpkgs, `pkgs` should be part of the derivation itself, allowing users to call `texlive.combine { inherit (texlive) scheme-small; inherit some_tex_package; }`.
+
+Here is a (very verbose) example where the attribute `pkgs` is attached to the derivation itself, which requires creating a fixed point. See also the packages `auctex`, `eukleides`, `mftrace` for more examples.
```nix
with import {};
let
- foiltex_run = stdenvNoCC.mkDerivation {
+ foiltex = stdenvNoCC.mkDerivation (finalAttrs: {
pname = "latex-foiltex";
version = "2.1.4b";
- passthru.tlType = "run";
+ passthru = {
+ pkgs = [ finalAttrs.finalPackage ];
+ tlDeps = with texlive; [ latex ];
+ tlType = "run";
+ };
srcs = [
(fetchurl {
@@ -102,8 +109,7 @@ let
maintainers = with maintainers; [ veprbl ];
platforms = platforms.all;
};
- };
- foiltex = { pkgs = [ foiltex_run ]; };
+ });
latex_with_foiltex = texlive.combine {
inherit (texlive) scheme-small;
diff --git a/third_party/nixpkgs/lib/licenses.nix b/third_party/nixpkgs/lib/licenses.nix
index 2bca8d36b5..873056d2fa 100644
--- a/third_party/nixpkgs/lib/licenses.nix
+++ b/third_party/nixpkgs/lib/licenses.nix
@@ -909,6 +909,13 @@ in mkLicense lset) ({
url = "https://github.com/thestk/stk/blob/master/LICENSE";
};
+ tsl = {
+ shortName = "TSL";
+ fullName = "Timescale License Agreegment";
+ url = "https://github.com/timescale/timescaledb/blob/main/tsl/LICENSE-TIMESCALE";
+ unfree = true;
+ };
+
tcltk = {
spdxId = "TCL";
fullName = "TCL/TK License";
diff --git a/third_party/nixpkgs/lib/modules.nix b/third_party/nixpkgs/lib/modules.nix
index 051dbe2ef8..9c3e2085e3 100644
--- a/third_party/nixpkgs/lib/modules.nix
+++ b/third_party/nixpkgs/lib/modules.nix
@@ -567,15 +567,19 @@ rec {
zipAttrsWith (n: concatLists)
(map (module: let subtree = module.${attr}; in
if !(builtins.isAttrs subtree) then
- throw ''
- You're trying to declare a value of type `${builtins.typeOf subtree}'
- rather than an attribute-set for the option
+ throw (if attr == "config" then ''
+ You're trying to define a value of type `${builtins.typeOf subtree}'
+ rather than an attribute set for the option
`${builtins.concatStringsSep "." prefix}'!
This usually happens if `${builtins.concatStringsSep "." prefix}' has option
definitions inside that are not matched. Please check how to properly define
this option by e.g. referring to `man 5 configuration.nix'!
- ''
+ '' else ''
+ An option declaration for `${builtins.concatStringsSep "." prefix}' has type
+ `${builtins.typeOf subtree}' rather than an attribute set.
+ Did you mean to define this outside of `options'?
+ '')
else
mapAttrs (n: f module) subtree
) modules);
diff --git a/third_party/nixpkgs/lib/strings.nix b/third_party/nixpkgs/lib/strings.nix
index 3c3529c328..e875520c68 100644
--- a/third_party/nixpkgs/lib/strings.nix
+++ b/third_party/nixpkgs/lib/strings.nix
@@ -2,7 +2,9 @@
{ lib }:
let
-inherit (builtins) length;
+ inherit (builtins) length;
+
+ inherit (lib.trivial) warnIf;
asciiTable = import ./ascii-table.nix;
@@ -207,7 +209,20 @@ rec {
normalizePath "/a//b///c/"
=> "/a/b/c/"
*/
- normalizePath = s: (builtins.foldl' (x: y: if y == "/" && hasSuffix "/" x then x else x+y) "" (stringToCharacters s));
+ normalizePath = s:
+ warnIf
+ (isPath s)
+ ''
+ lib.strings.normalizePath: The argument (${toString s}) is a path value, but only strings are supported.
+ Path values are always normalised in Nix, so there's no need to call this function on them.
+ This function also copies the path to the Nix store and returns the store path, the same as "''${path}" will, which may not be what you want.
+ This behavior is deprecated and will throw an error in the future.''
+ (
+ builtins.foldl'
+ (x: y: if y == "/" && hasSuffix "/" x then x else x+y)
+ ""
+ (stringToCharacters s)
+ );
/* Depending on the boolean `cond', return either the given string
or the empty string. Useful to concatenate against a bigger string.
@@ -240,7 +255,17 @@ rec {
# Prefix to check for
pref:
# Input string
- str: substring 0 (stringLength pref) str == pref;
+ str:
+ # Before 23.05, paths would be copied to the store before converting them
+ # to strings and comparing. This was surprising and confusing.
+ warnIf
+ (isPath pref)
+ ''
+ lib.strings.hasPrefix: The first argument (${toString pref}) is a path value, but only strings are supported.
+ There is almost certainly a bug in the calling code, since this function always returns `false` in such a case.
+ This function also copies the path to the Nix store, which may not be what you want.
+ This behavior is deprecated and will throw an error in the future.''
+ (substring 0 (stringLength pref) str == pref);
/* Determine whether a string has given suffix.
@@ -260,8 +285,20 @@ rec {
let
lenContent = stringLength content;
lenSuffix = stringLength suffix;
- in lenContent >= lenSuffix &&
- substring (lenContent - lenSuffix) lenContent content == suffix;
+ in
+ # Before 23.05, paths would be copied to the store before converting them
+ # to strings and comparing. This was surprising and confusing.
+ warnIf
+ (isPath suffix)
+ ''
+ lib.strings.hasSuffix: The first argument (${toString suffix}) is a path value, but only strings are supported.
+ There is almost certainly a bug in the calling code, since this function always returns `false` in such a case.
+ This function also copies the path to the Nix store, which may not be what you want.
+ This behavior is deprecated and will throw an error in the future.''
+ (
+ lenContent >= lenSuffix
+ && substring (lenContent - lenSuffix) lenContent content == suffix
+ );
/* Determine whether a string contains the given infix
@@ -278,7 +315,16 @@ rec {
=> false
*/
hasInfix = infix: content:
- builtins.match ".*${escapeRegex infix}.*" "${content}" != null;
+ # Before 23.05, paths would be copied to the store before converting them
+ # to strings and comparing. This was surprising and confusing.
+ warnIf
+ (isPath infix)
+ ''
+ lib.strings.hasInfix: The first argument (${toString infix}) is a path value, but only strings are supported.
+ There is almost certainly a bug in the calling code, since this function always returns `false` in such a case.
+ This function also copies the path to the Nix store, which may not be what you want.
+ This behavior is deprecated and will throw an error in the future.''
+ (builtins.match ".*${escapeRegex infix}.*" "${content}" != null);
/* Convert a string to a list of characters (i.e. singleton strings).
This allows you to, e.g., map a function over each character. However,
@@ -570,14 +616,23 @@ rec {
prefix:
# Input string
str:
- let
+ # Before 23.05, paths would be copied to the store before converting them
+ # to strings and comparing. This was surprising and confusing.
+ warnIf
+ (isPath prefix)
+ ''
+ lib.strings.removePrefix: The first argument (${toString prefix}) is a path value, but only strings are supported.
+ There is almost certainly a bug in the calling code, since this function never removes any prefix in such a case.
+ This function also copies the path to the Nix store, which may not be what you want.
+ This behavior is deprecated and will throw an error in the future.''
+ (let
preLen = stringLength prefix;
sLen = stringLength str;
in
- if hasPrefix prefix str then
+ if substring 0 preLen str == prefix then
substring preLen (sLen - preLen) str
else
- str;
+ str);
/* Return a string without the specified suffix, if the suffix matches.
@@ -594,14 +649,23 @@ rec {
suffix:
# Input string
str:
- let
+ # Before 23.05, paths would be copied to the store before converting them
+ # to strings and comparing. This was surprising and confusing.
+ warnIf
+ (isPath suffix)
+ ''
+ lib.strings.removeSuffix: The first argument (${toString suffix}) is a path value, but only strings are supported.
+ There is almost certainly a bug in the calling code, since this function never removes any suffix in such a case.
+ This function also copies the path to the Nix store, which may not be what you want.
+ This behavior is deprecated and will throw an error in the future.''
+ (let
sufLen = stringLength suffix;
sLen = stringLength str;
in
if sufLen <= sLen && suffix == substring (sLen - sufLen) sufLen str then
substring 0 (sLen - sufLen) str
else
- str;
+ str);
/* Return true if string v1 denotes a version older than v2.
diff --git a/third_party/nixpkgs/lib/tests/modules.sh b/third_party/nixpkgs/lib/tests/modules.sh
index 8081b186a2..c1cf0a94a1 100755
--- a/third_party/nixpkgs/lib/tests/modules.sh
+++ b/third_party/nixpkgs/lib/tests/modules.sh
@@ -189,7 +189,7 @@ checkConfigOutput '^"foo"$' config.submodule.foo ./declare-submoduleWith-special
## shorthandOnlyDefines config behaves as expected
checkConfigOutput '^true$' config.submodule.config ./declare-submoduleWith-shorthand.nix ./define-submoduleWith-shorthand.nix
checkConfigError 'is not of type `boolean' config.submodule.config ./declare-submoduleWith-shorthand.nix ./define-submoduleWith-noshorthand.nix
-checkConfigError "You're trying to declare a value of type \`bool'\n\s*rather than an attribute-set for the option" config.submodule.config ./declare-submoduleWith-noshorthand.nix ./define-submoduleWith-shorthand.nix
+checkConfigError "You're trying to define a value of type \`bool'\n\s*rather than an attribute set for the option" config.submodule.config ./declare-submoduleWith-noshorthand.nix ./define-submoduleWith-shorthand.nix
checkConfigOutput '^true$' config.submodule.config ./declare-submoduleWith-noshorthand.nix ./define-submoduleWith-noshorthand.nix
## submoduleWith should merge all modules in one swoop
diff --git a/third_party/nixpkgs/maintainers/maintainer-list.nix b/third_party/nixpkgs/maintainers/maintainer-list.nix
index acfd0716e4..05bb679373 100644
--- a/third_party/nixpkgs/maintainers/maintainer-list.nix
+++ b/third_party/nixpkgs/maintainers/maintainer-list.nix
@@ -850,6 +850,12 @@
githubId = 858965;
name = "Andrew Morsillo";
};
+ amz-x = {
+ email = "mail@amz-x.com";
+ github = "amz-x";
+ githubId = 18249234;
+ name = "Christopher Crouse";
+ };
AnatolyPopov = {
email = "aipopov@live.ru";
github = "AnatolyPopov";
@@ -1180,6 +1186,12 @@
githubId = 58516559;
name = "Alexander Rezvov";
};
+ arian-d = {
+ email = "arianxdehghani@gmail.com";
+ github = "arian-d";
+ githubId = 40076285;
+ name = "Arian Dehghani";
+ };
arianvp = {
email = "arian.vanputten@gmail.com";
github = "arianvp";
@@ -1329,6 +1341,12 @@
githubId = 84152630;
name = "Ashley Chiara";
};
+ ashleyghooper = {
+ email = "ashleyghooper@gmail.com";
+ github = "ashleyghooper";
+ githubId = 11037075;
+ name = "Ashley Hooper";
+ };
aske = {
email = "aske@fmap.me";
github = "aske";
@@ -1457,6 +1475,12 @@
githubId = 574938;
name = "Jonathan Glines";
};
+ austin-artificial = {
+ email = "austin.platt@artificial.io";
+ github = "austin-artificial";
+ githubId = 126663376;
+ name = "Austin Platt";
+ };
austinbutler = {
email = "austinabutler@gmail.com";
github = "austinbutler";
@@ -2409,12 +2433,6 @@
githubId = 91694;
name = "Javier Candeira";
};
- candyc1oud = {
- email = "candyc1oud@outlook.com";
- github = "candyc1oud";
- githubId = 113157395;
- name = "Candy Cloud";
- };
canndrew = {
email = "shum@canndrew.org";
github = "canndrew";
@@ -2757,6 +2775,15 @@
githubId = 2245737;
name = "Christopher Mark Poole";
};
+ christoph-heiss = {
+ email = "christoph@c8h4.io";
+ github = "christoph-heiss";
+ githubId = 7571069;
+ name = "Christoph Heiss";
+ keys = [{
+ fingerprint = "9C56 1D64 30B2 8D6B DCBC 9CEB 73D5 E7FD EE3D E49A";
+ }];
+ };
chuahou = {
email = "human+github@chuahou.dev";
github = "chuahou";
@@ -2989,6 +3016,13 @@
githubId = 298705;
name = "Cyril Cohen";
};
+ colamaroro = {
+ name = "Corentin Rondier";
+ email = "github@rondier.io";
+ github = "colamaroro";
+ githubId = 12484955;
+ matrix = "@colamaroro:lovelyrad.io";
+ };
cole-h = {
name = "Cole Helbling";
email = "cole.e.helbling@outlook.com";
@@ -3252,6 +3286,13 @@
fingerprint = "2B1F 70F9 5F1B 48DA 2265 A7FA A6BC 8B8C EB31 659B";
}];
};
+ cyntheticfox = {
+ email = "houstdav000@gmail.com";
+ github = "cyntheticfox";
+ githubId = 17628961;
+ matrix = "@houstdav000:gh0st.ems.host";
+ name = "Cynthia Fox";
+ };
cyounkins = {
name = "Craig Younkins";
email = "cyounkins@gmail.com";
@@ -3379,6 +3420,11 @@
githubId = 1298344;
name = "Daniel Fullmer";
};
+ dansbandit = {
+ github = "dansbandit";
+ githubId = 4530687;
+ name = "dansbandit";
+ };
danth = {
name = "Daniel Thwaites";
email = "danthwaites30@btinternet.com";
@@ -3657,6 +3703,12 @@
githubId = 706758;
name = "Christian Gerbrandt";
};
+ derdennisop = {
+ email = "dennish@wuitz.de";
+ github = "derdennisop";
+ githubId = 52411861;
+ name = "Dennis";
+ };
derekcollison = {
email = "derek@nats.io";
github = "derekcollison";
@@ -4019,6 +4071,15 @@
githubId = 108501;
name = "David Pflug";
};
+ dr460nf1r3 = {
+ email = "root@dr460nf1r3.org";
+ github = "dr460nf1r3";
+ githubId = 12834713;
+ name = "Nico Jensch";
+ keys = [{
+ fingerprint = "D245 D484 F357 8CB1 7FD6 DA6B 67DB 29BF F3C9 6757";
+ }];
+ };
dramaturg = {
email = "seb@ds.ag";
github = "dramaturg";
@@ -4061,12 +4122,6 @@
fingerprint = "85F3 72DF 4AF3 EF13 ED34 72A3 0AAF 2901 E804 0715";
}];
};
- drzoidberg = {
- email = "jakob@mast3rsoft.com";
- github = "jakobneufeld";
- githubId = 24791219;
- name = "Jakob Neufeld";
- };
dsalaza4 = {
email = "podany270895@gmail.com";
github = "dsalaza4";
@@ -4137,7 +4192,7 @@
};
dylanmtaylor = {
email = "dylan@dylanmtaylor.com";
- github = "dylamtaylor";
+ github = "dylanmtaylor";
githubId = 277927;
name = "Dylan Taylor";
};
@@ -4309,6 +4364,12 @@
githubId = 701128;
name = "Eike Kettner";
};
+ eken = {
+ email = "edvin.kallstrom@protonmail.com";
+ github = "Eken-beep";
+ name = "Edvin Källström";
+ githubId = 84442052;
+ };
ekleog = {
email = "leo@gaspard.io";
matrix = "@leo:gaspard.ninja";
@@ -4687,6 +4748,12 @@
githubId = 32169529;
name = "Etienne Jean";
};
+ ettom = {
+ email = "ettom22@hotmail.com";
+ github = "ettom";
+ githubId = 36895504;
+ name = "ettom";
+ };
etu = {
email = "elis@hirwing.se";
matrix = "@etu:semi.social";
@@ -4713,6 +4780,13 @@
fingerprint = "8129 5B85 9C5A F703 C2F4 1E29 2D1D 402E 1776 3DD6";
}];
};
+ evan-goode = {
+ email = "mail@evangoo.de";
+ name = "Evan Goode";
+ github = "evan-goode";
+ githubId = 7495216;
+ matrix = "@goode:matrix.org";
+ };
evanjs = {
email = "evanjsx@gmail.com";
github = "evanjs";
@@ -4931,6 +5005,13 @@
keys = [{ fingerprint = "7391 BF2D A2C3 B2C9 BE25 ACA9 C7A7 4616 F302 5DF4"; }];
matrix = "@felipeqq2:pub.solar";
};
+ felixalbrigtsen = {
+ email = "felixalbrigtsen@gmail.com";
+ github = "felixalbrigtsen";
+ githubId = 64613093;
+ name = "Felix Albrigtsen";
+ matrix = "@felixalb:pvv.ntnu.no";
+ };
felixscheinost = {
name = "Felix Scheinost";
email = "felix.scheinost@posteo.de";
@@ -6170,13 +6251,6 @@
githubId = 25618740;
name = "Vincent Cui";
};
- houstdav000 = {
- email = "houstdav000@gmail.com";
- github = "houstdav000";
- githubId = 17628961;
- matrix = "@houstdav000:gh0st.ems.host";
- name = "David Houston";
- };
hoverbear = {
email = "operator+nix@hoverbear.org";
matrix = "@hoverbear:matrix.org";
@@ -6958,6 +7032,12 @@
githubId = 17029738;
name = "Jean-Charles Quillet";
};
+ jedsek = {
+ email = "jedsek@qq.com";
+ github = "jedsek";
+ githubId = 63626406;
+ name = "Jedsek";
+ };
jefdaj = {
email = "jefdaj@gmail.com";
github = "jefdaj";
@@ -7049,6 +7129,13 @@
fingerprint = "7EB1 C02A B62B B464 6D7C E4AE D1D0 9DE1 69EA 19A0";
}];
};
+ jfvillablanca = {
+ email = "jmfv.dev@gmail.com";
+ matrix = "@jfvillablanca:matrix.org";
+ github = "jfvillablanca";
+ githubId = 31008330;
+ name = "Jann Marc Villablanca";
+ };
jgart = {
email = "jgart@dismail.de";
github = "jgarte";
@@ -7816,6 +7903,12 @@
githubId = 1047859;
name = "Kaz Wesley";
};
+ kazenyuk = {
+ email = "kazenyuk@pm.me";
+ github = "nvmd";
+ githubId = 524492;
+ name = "Sergey Kazenyuk";
+ };
kcalvinalvin = {
email = "calvin@kcalvinalvin.info";
github = "kcalvinalvin";
@@ -8160,6 +8253,12 @@
github = "konradmalik";
githubId = 13033392;
};
+ konst-aa = {
+ email = "konstantin.astafurov@gmail.com";
+ github = "konst-aa";
+ githubId = 40547702;
+ name = "Konstantin Astafurov";
+ };
koozz = {
email = "koozz@linux.com";
github = "koozz";
@@ -9403,6 +9502,12 @@
githubId = 43853194;
name = "Matheus Vieira";
};
+ mathiassven = {
+ email = "github@mathiassven.com";
+ github = "MathiasSven";
+ githubId = 24759037;
+ name = "Mathias Sven";
+ };
mathnerd314 = {
email = "mathnerd314.gph+hs@gmail.com";
github = "Mathnerd314";
@@ -10528,6 +10633,12 @@
githubId = 772914;
name = "Mikael Voss";
};
+ mwdomino = {
+ email = "matt@dominey.io";
+ github = "mwdomino";
+ githubId = 46284538;
+ name = "Matt Dominey";
+ };
mwolfe = {
email = "corp@m0rg.dev";
github = "m0rg-dev";
@@ -10866,6 +10977,15 @@
githubId = 8214542;
name = "Nicolò Balzarotti";
};
+ nicoo = {
+ email = "nicoo@debian.org";
+ github = "nbraud";
+ githubId = 1155801;
+ name = "nicoo";
+ keys = [{
+ fingerprint = "E44E 9EA5 4B8E 256A FB73 49D3 EC9D 3708 72BC 7A8C";
+ }];
+ };
nidabdella = {
name = "Mohamed Nidabdella";
email = "nidabdella.mohamed@gmail.com";
@@ -10936,6 +11056,12 @@
githubId = 47835714;
name = "Nintron";
};
+ niols = {
+ email = "niols@niols.fr";
+ github = "niols";
+ githubId = 5920602;
+ name = "Nicolas Jeannerod";
+ };
nioncode = {
email = "nioncode+github@gmail.com";
github = "nioncode";
@@ -12731,11 +12857,6 @@
githubId = 220211;
name = "Renato Garcia";
};
- rencire = {
- github = "rencire";
- githubId = 546296;
- name = "Eric Ren";
- };
renesat = {
name = "Ivan Smolyakov";
email = "smol.ivan97@gmail.com";
@@ -12748,12 +12869,6 @@
githubId = 3302;
name = "Renzo Carbonara";
};
- retrry = {
- email = "retrry@gmail.com";
- github = "retrry";
- githubId = 500703;
- name = "Tadas Barzdžius";
- };
revol-xut = {
email = "revol-xut@protonmail.com";
name = "Tassilo Tanneberger";
@@ -13775,12 +13890,6 @@
github = "ShamrockLee";
githubId = 44064051;
};
- shanemikel = {
- email = "shanepearlman@pm.me";
- github = "shanemikel";
- githubId = 6720672;
- name = "Shane Pearlman";
- };
shanesveller = {
email = "shane@sveller.dev";
github = "shanesveller";
@@ -14349,6 +14458,12 @@
githubId = 6362238;
name = "Christoph Honal";
};
+ star-szr = {
+ email = "nixpkgs@scottr.mailworks.org";
+ github = "star-szr";
+ githubId = 327943;
+ name = "Scott Zhu Reeves";
+ };
stasjok = {
name = "Stanislav Asunkin";
email = "nixpkgs@stasjok.ru";
@@ -14570,13 +14685,6 @@
githubId = 2666479;
name = "Y Nguyen";
};
- superherointj = {
- name = "Sérgio Marcelo";
- email = "sergiomarcelo+nixpkgs@ya.ru";
- matrix = "@superherointj:matrix.org";
- github = "superherointj";
- githubId = 5861043;
- };
SuperSandro2000 = {
email = "sandro.jaeckel@gmail.com";
matrix = "@sandro:supersandro.de";
@@ -15231,6 +15339,12 @@
githubId = 1618946;
name = "Tiago Castro";
};
+ tie = {
+ name = "Ivan Trubach";
+ email = "mr.trubach@icloud.com";
+ github = "tie";
+ githubId = 14792994;
+ };
tilcreator = {
name = "TilCreator";
email = "contact.nixos@tc-j.de";
@@ -16871,6 +16985,12 @@
githubId = 568532;
name = "Christian Zagrodnick";
};
+ zahrun = {
+ email = "zahrun@murena.io";
+ github = "zahrun";
+ githubId = 10415894;
+ name = "Zahrun";
+ };
zakame = {
email = "zakame@zakame.net";
github = "zakame";
@@ -17091,6 +17211,12 @@
githubId = 20029431;
name = "Zyansheep";
};
+ zygot = {
+ email = "stefan.bordei13@gmail.com";
+ github = "stefan-bordei";
+ githubId = 71881325;
+ name = "Stefan Bordei";
+ };
zzamboni = {
email = "diego@zzamboni.org";
github = "zzamboni";
diff --git a/third_party/nixpkgs/maintainers/scripts/haskell/update-stackage.sh b/third_party/nixpkgs/maintainers/scripts/haskell/update-stackage.sh
index 95efeff732..4acb76233c 100755
--- a/third_party/nixpkgs/maintainers/scripts/haskell/update-stackage.sh
+++ b/third_party/nixpkgs/maintainers/scripts/haskell/update-stackage.sh
@@ -40,6 +40,7 @@ sed -r \
-e 's|^constraints:||' \
-e 's|^ +| - |' \
-e 's|,$||' \
+ -e '/^with-compiler:/d' \
-e '/installed$/d' \
-e '/^$/d' \
< "${tmpfile}" | sort --ignore-case >"${tmpfile_new}"
diff --git a/third_party/nixpkgs/maintainers/scripts/luarocks-packages.csv b/third_party/nixpkgs/maintainers/scripts/luarocks-packages.csv
index 60389f9abb..514a967009 100644
--- a/third_party/nixpkgs/maintainers/scripts/luarocks-packages.csv
+++ b/third_party/nixpkgs/maintainers/scripts/luarocks-packages.csv
@@ -82,7 +82,7 @@ luautf8,,,,,,pstn
luazip,,,,,,
lua-yajl,,,,,,pstn
luuid,,,,,,
-luv,,,,1.43.0-0,,
+luv,,,,1.44.2-1,,
lush.nvim,https://github.com/rktjmp/lush.nvim,,,,,teto
lyaml,,,,,,lblasc
markdown,,,,,,
diff --git a/third_party/nixpkgs/maintainers/scripts/update.py b/third_party/nixpkgs/maintainers/scripts/update.py
index 7ae08958a1..bbed2bda5e 100644
--- a/third_party/nixpkgs/maintainers/scripts/update.py
+++ b/third_party/nixpkgs/maintainers/scripts/update.py
@@ -100,7 +100,7 @@ async def commit_changes(name: str, merge_lock: asyncio.Lock, worktree: str, bra
# Git can only handle a single index operation at a time
async with merge_lock:
await check_subprocess('git', 'add', *change['files'], cwd=worktree)
- commit_message = '{attrPath}: {oldVersion} → {newVersion}'.format(**change)
+ commit_message = '{attrPath}: {oldVersion} -> {newVersion}'.format(**change)
if 'commitMessage' in change:
commit_message = change['commitMessage']
elif 'commitBody' in change:
diff --git a/third_party/nixpkgs/maintainers/team-list.nix b/third_party/nixpkgs/maintainers/team-list.nix
index 55d6fa72ec..34f4576054 100644
--- a/third_party/nixpkgs/maintainers/team-list.nix
+++ b/third_party/nixpkgs/maintainers/team-list.nix
@@ -288,12 +288,14 @@ with lib.maintainers; {
golang = {
members = [
- c00w
kalbasit
mic92
zowoq
qbit
];
+ githubTeams = [
+ "golang"
+ ];
scope = "Maintain Golang compilers.";
shortName = "Go";
enableFeatureFreezePing = true;
@@ -423,6 +425,21 @@ with lib.maintainers; {
shortName = "Linux Kernel";
};
+ lisp = {
+ members = [
+ raskin
+ lukego
+ nagy
+ uthar
+ ];
+ githubTeams = [
+ "lisp"
+ ];
+ scope = "Maintain the Lisp ecosystem.";
+ shortName = "lisp";
+ enableFeatureFreezePing = true;
+ };
+
llvm = {
members = [
dtzWill
@@ -718,12 +735,14 @@ with lib.maintainers; {
rust = {
members = [
figsoda
- lnl7
mic92
tjni
winter
zowoq
];
+ githubTeams = [
+ "rust"
+ ];
scope = "Maintain the Rust compiler toolchain and nixpkgs integration.";
shortName = "Rust";
enableFeatureFreezePing = true;
diff --git a/third_party/nixpkgs/nixos/doc/manual/default.nix b/third_party/nixpkgs/nixos/doc/manual/default.nix
index 4032595e80..68132f302e 100644
--- a/third_party/nixpkgs/nixos/doc/manual/default.nix
+++ b/third_party/nixpkgs/nixos/doc/manual/default.nix
@@ -168,7 +168,7 @@ let
./manual.md \
./manual-combined-pre.xml
- ${pkgs.libxslt.bin}/bin/xsltproc \
+ xsltproc \
-o manual-combined.xml ${./../../lib/make-options-doc/postprocess-option-descriptions.xsl} \
manual-combined-pre.xml
diff --git a/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2305.section.md b/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2305.section.md
index e23f1b562e..8c8a815196 100644
--- a/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -16,8 +16,12 @@ In addition to numerous new and upgraded packages, this release has the followin
It's recommended to use `nixos-rebuild boot` and `reboot`, rather than `nixos-rebuild switch` - since in some rare cases
the switch of a live system might fail.
+ - glibc: 2.35 -\> 2.37
+
- Cinnamon has been updated to 5.6, see [the pull request](https://github.com/NixOS/nixpkgs/pull/201328#issue-1449910204) for what is changed.
+- GNOME has been upgraded to version 44. Please see the [release notes](https://release.gnome.org/44/) for details.
+
- KDE Plasma has been updated to v5.27, see [the release notes](https://kde.org/announcements/plasma/5/5.27.0/) for what is changed.
- `nixos-rebuild` now supports an extra `--specialisation` option that can be used to change specialisation for `switch` and `test` commands.
@@ -45,8 +49,14 @@ In addition to numerous new and upgraded packages, this release has the followin
- [gmediarender](https://github.com/hzeller/gmrender-resurrect), a simple, headless UPnP/DLNA renderer. Available as [services.gmediarender](options.html#opt-services.gmediarender.enable).
+- [hyprland](https://github.com/hyprwm/hyprland), a dynamic tiling Wayland compositor that doesn't sacrifice on its looks. Available as [programs.hyprland](#opt-programs.hyprland.enable).
+
+- [minipro](https://gitlab.com/DavidGriffith/minipro/), an open source program for controlling the MiniPRO TL866xx series of chip programmers. Available as [programs.minipro](options.html#opt-programs.minipro.enable).
+
- [stevenblack-blocklist](https://github.com/StevenBlack/hosts), A unified hosts file with base extensions for blocking unwanted websites. Available as [networking.stevenblack](options.html#opt-networking.stevenblack.enable).
+- [Budgie Desktop](https://github.com/BuddiesOfBudgie/budgie-desktop), a familiar, modern desktop environment. Availabe as [services.xserver.desktopManager.budgie](options.html#opt-services.xserver.desktopManager.budgie).
+
- [imaginary](https://github.com/h2non/imaginary), a microservice for high-level image processing that Nextcloud can use to generate previews. Available as [services.imaginary](#opt-services.imaginary.enable).
- [opensearch](https://opensearch.org), a search server alternative to Elasticsearch. Available as [services.opensearch](options.html#opt-services.opensearch.enable).
@@ -71,6 +81,8 @@ In addition to numerous new and upgraded packages, this release has the followin
- [v2rayA](https://v2raya.org), a Linux web GUI client of Project V which supports V2Ray, Xray, SS, SSR, Trojan and Pingtunnel. Available as [services.v2raya](options.html#opt-services.v2raya.enable).
+- [wstunnel](https://github.com/erebe/wstunnel), a proxy tunnelling arbitrary TCP or UDP traffic through a WebSocket connection. Instances may be configured via [services.wstunnel](options.html#opt-services.wstunnel.enable).
+
- [ulogd](https://www.netfilter.org/projects/ulogd/index.html), a userspace logging daemon for netfilter/iptables related logging. Available as [services.ulogd](options.html#opt-services.ulogd.enable).
- [jellyseerr](https://github.com/Fallenbagel/jellyseerr), a web-based requests manager for Jellyfin, forked from Overseerr. Available as [services.jellyseerr](#opt-services.jellyseerr.enable).
@@ -85,12 +97,18 @@ In addition to numerous new and upgraded packages, this release has the followin
- [nimdow](https://github.com/avahe-kellenberger/nimdow), a window manager written in Nim, inspired by dwm.
+- [trurl](https://github.com/curl/trurl), a command line tool for URL parsing and manipulation.
+
- [woodpecker-agents](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-agents](#opt-services.woodpecker-agents.agents._name_.enable).
- [woodpecker-server](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-server](#opt-services.woodpecker-server.enable).
- [ReGreet](https://github.com/rharish101/ReGreet), a clean and customizable greeter for greetd. Available as [programs.regreet](#opt-programs.regreet.enable).
+- [v4l2-relayd](https://git.launchpad.net/v4l2-relayd), a streaming relay for v4l2loopback using gstreamer. Available as [services.v4l2-relayd](#opt-services.v4l2-relayd.instances._name_.enable).
+
+- [hardware.ipu6](#opt-hardware.ipu6.enable) adds support for ipu6 based webcams on intel tiger lake and alder lake.
+
## Backward Incompatibilities {#sec-release-23.05-incompatibilities}
@@ -128,6 +146,8 @@ In addition to numerous new and upgraded packages, this release has the followin
- The [services.unifi-video.openFirewall](#opt-services.unifi-video.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitly set this option to `true`, or configure your firewall.
+- The option `i18n.inputMethod.fcitx5.enableRimeData` has been removed. Default RIME data is now included in `fcitx5-rime` by default, and can be customized using `fcitx5-rime.override { rimeDataPkgs = [ pkgs.rime-data, package2, ... ]; }`
+
- Kime has been updated from 2.5.6 to 3.0.2 and the `i18n.inputMethod.kime.config` option has been removed. Users should use `daemonModules`, `iconColor`, and `extraConfig` options under `i18n.inputMethod.kime` instead.
- `tut` has been updated from 1.0.34 to 2.0.0, and now uses the TOML format for the configuration file instead of INI. Additional information can be found [here](https://github.com/RasmusLindroth/tut/releases/tag/2.0.0).
@@ -152,6 +172,8 @@ In addition to numerous new and upgraded packages, this release has the followin
- `lib.systems.examples.ghcjs` and consequently `pkgsCross.ghcjs` now use the target triplet `javascript-unknown-ghcjs` instead of `js-unknown-ghcjs`. This has been done to match an [upstream decision](https://gitlab.haskell.org/ghc/ghc/-/commit/6636b670233522f01d002c9b97827d00289dbf5c) to follow Cabal's platform naming more closely. Nixpkgs will also reject `js` as an architecture name.
+- The old unsupported version 6.x of the ELK-stack and Elastic beats have been removed. Use OpenSearch instead.
+
- The `cosmoc` package has been removed. The upstream scripts in `cosmocc` should be used instead.
- Qt 5.12 and 5.14 have been removed, as the corresponding branches have been EOL upstream for a long time. This affected under 10 packages in nixpkgs, largely unmaintained upstream as well, however, out-of-tree package expressions may need to be updated manually.
@@ -187,6 +209,8 @@ In addition to numerous new and upgraded packages, this release has the followin
- [services.xserver.videoDrivers](options.html#opt-services.xserver.videoDrivers) now defaults to the `modesetting` driver over device-specific ones. The `radeon`, `amdgpu` and `nouveau` drivers are still available, but effectively unmaintained and not recommended for use.
+- To enable the HTTP3 (QUIC) protocol for a nginx virtual host, set the `quic` attribute on it to true, e.g. `services.nginx.virtualHosts..quic = true;`.
+
- conntrack helper autodetection has been removed from kernels 6.0 and up upstream, and an assertion was added to ensure things don't silently stop working. Migrate your configuration to assign helpers explicitly or use an older LTS kernel branch as a temporary workaround.
- The `services.pipewire.config` options have been removed, as they have basically never worked correctly. All behavior defined by the default configuration can be overridden with drop-in files as necessary - see [below](#sec-release-23.05-migration-pipewire) for details.
@@ -201,13 +225,18 @@ In addition to numerous new and upgraded packages, this release has the followin
- The `baget` package and module was removed due to being unmaintained.
+- `go-ethereum` package has been updated to v1.11.5 and the `puppeth` command is no longer available as of v1.11.0.
+
+- The `pnpm` package has be updated to from version 7.29.1 to version 8.1.1 and Node.js 14 support has been discontinued (though, there are workarounds if Node.js 14 is still required)
+ - Migration instructions: ["Before updating pnpm to v8 in your CI, regenerate your pnpm-lock.yaml. To upgrade your lockfile, run pnpm install and commit the changes. Existing dependencies will not be updated; however, due to configuration changes in pnpm v8, some missing peer dependencies may be added to the lockfile and some packages may get deduplicated. You can commit the new lockfile even before upgrading Node.js in the CI, as pnpm v7 already supports the new lockfile format."](https://github.com/pnpm/pnpm/releases/tag/v8.0.0)
+
## Other Notable Changes {#sec-release-23.05-notable-changes}
- `vim_configurable` has been renamed to `vim-full` to avoid confusion: `vim-full`'s build-time features are configurable, but both `vim` and `vim-full` are _customizable_ (in the sense of user configuration, like vimrc).
-- Pantheon now defaults to Mutter 42 and GNOME settings daemon 42, all Pantheon packages are now tracking elementary OS 7 updates.
+- Pantheon now defaults to Mutter 43 and GNOME settings daemon 43, all Pantheon packages are now tracking elementary OS 7 updates.
- The module for the application firewall `opensnitch` got the ability to configure rules. Available as [services.opensnitch.rules](#opt-services.opensnitch.rules)
@@ -225,6 +254,10 @@ In addition to numerous new and upgraded packages, this release has the followin
- `services.openssh.ciphers` to `services.openssh.settings.Ciphers`
- `services.openssh.gatewayPorts` to `services.openssh.settings.GatewayPorts`
+- `netbox` was updated to 3.4. NixOS' `services.netbox.package` still defaults to 3.3 if `stateVersion` is earlier than 23.05. Please review upstream's [breaking changes](https://github.com/netbox-community/netbox/releases/tag/v3.4.0), and upgrade NetBox by changing `services.netbox.package`. Database migrations will be run automatically.
+
+- `services.netbox` now support RFC42-style options, through `services.netbox.settings`.
+
- `services.mastodon` gained a tootctl wrapped named `mastodon-tootctl` similar to `nextcloud-occ` which can be executed from any user and switches to the configured mastodon user with sudo and sources the environment variables.
- DocBook option documentation, which has been deprecated since 22.11, will now cause a warning when documentation is built. Out-of-tree modules should migrate to using CommonMark documentation as outlined in [](#sec-option-declarations) to silence this warning.
@@ -235,6 +268,12 @@ In addition to numerous new and upgraded packages, this release has the followin
- `services.borgmatic` now allows for multiple configurations, placed in `/etc/borgmatic.d/`, you can define them with `services.borgmatic.configurations`.
+- `service.openafsServer` features a new backup server `pkgs.fabs` as a
+ replacement for openafs's own `buserver`. See
+ [FABS](https://github.com/openafs-contrib/fabs) to check if this is an viable
+ replacement. It stores backups as volume dump files and thus better integrates
+ into contemporary backup solutions.
+
- The `dnsmasq` service now takes configuration via the
`services.dnsmasq.settings` attribute set. The option
`services.dnsmasq.extraConfig` will be deprecated when NixOS 22.11 reaches
@@ -284,6 +323,7 @@ In addition to numerous new and upgraded packages, this release has the followin
```
- `services.dhcpcd` service now don't solicit or accept IPv6 Router Advertisements on interfaces that use static IPv6 addresses.
+ If network uses both IPv6 Unique local addresses (ULA) and global IPv6 address auto-configuration with SLAAC, must add the parameter `networking.dhcpcd.IPv6rs = true;`.
- The module `services.headscale` was refactored to be compliant with [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md). To be precise, this means that the following things have changed:
@@ -306,6 +346,8 @@ In addition to numerous new and upgraded packages, this release has the followin
- Enabling global redirect in `services.nginx.virtualHosts` now allows one to add exceptions with the `locations` option.
+- A new option `proxyCachePath` has been added to `services.nginx`. Learn more about proxy_cache_path: .
+
- A new option `recommendedBrotliSettings` has been added to `services.nginx`. Learn more about compression in Brotli format [here](https://github.com/google/ngx_brotli/blob/master/README.md).
- Updated recommended settings in `services.nginx.recommendedGzipSettings`:
@@ -358,10 +400,17 @@ In addition to numerous new and upgraded packages, this release has the followin
- The option `services.prometheus.exporters.pihole.interval` does not exist anymore and has been removed.
+- The option `services.gpsd.device` has been replaced with
+ `services.gpsd.devices`, which supports multiple devices.
+
- `k3s` can now be configured with an EnvironmentFile for its systemd service, allowing secrets to be provided without ending up in the Nix Store.
- `boot.initrd.luks.device.` has a new `tryEmptyPassphrase` option, this is useful for OEM's who need to install an encrypted disk with a future settable passphrase
+- Lisp gained a [manual section](https://nixos.org/manual/nixpkgs/stable/#lisp), documenting a new and backwards incompatible interface. The previous interface will be removed in a future release.
+
+- The `bind` module now allows the per-zone `allow-query` setting to be configured (previously it was hard-coded to `any`; it still defaults to `any` to retain compatibility).
+
## Detailed migration information {#sec-release-23.05-migration}
### Pipewire configuration overrides {#sec-release-23.05-migration-pipewire}
diff --git a/third_party/nixpkgs/nixos/modules/config/users-groups.nix b/third_party/nixpkgs/nixos/modules/config/users-groups.nix
index 852f0a22f3..e44cce11f3 100644
--- a/third_party/nixpkgs/nixos/modules/config/users-groups.nix
+++ b/third_party/nixpkgs/nixos/modules/config/users-groups.nix
@@ -733,8 +733,9 @@ in {
sep = "\\$";
base64 = "[a-zA-Z0-9./]+";
id = cryptSchemeIdPatternGroup;
+ name = "[a-z0-9-]+";
value = "[a-zA-Z0-9/+.-]+";
- options = "${id}(=${value})?(,${id}=${value})*";
+ options = "${name}(=${value})?(,${name}=${value})*";
scheme = "${id}(${sep}${options})?";
content = "${base64}${sep}${base64}(${sep}${base64})?";
mcf = "^${sep}${scheme}${sep}${content}$";
diff --git a/third_party/nixpkgs/nixos/modules/hardware/opengl.nix b/third_party/nixpkgs/nixos/modules/hardware/opengl.nix
index 7b5e669d47..9108bcbd16 100644
--- a/third_party/nixpkgs/nixos/modules/hardware/opengl.nix
+++ b/third_party/nixpkgs/nixos/modules/hardware/opengl.nix
@@ -69,50 +69,21 @@ in
package = mkOption {
type = types.package;
internal = true;
- default = cfg.mesaPackage;
description = lib.mdDoc ''
The package that provides the OpenGL implementation.
-
- The default is Mesa's drivers which should cover all OpenGL-capable
- hardware. If you want to use another Mesa version, adjust
- {option}`mesaPackage`.
'';
};
+
package32 = mkOption {
type = types.package;
internal = true;
- default = cfg.mesaPackage32;
description = lib.mdDoc ''
- Same as {option}`package` but for the 32-bit OpenGL implementation on
- 64-bit systems. Used when {option}`driSupport32Bit` is set.
+ The package that provides the 32-bit OpenGL implementation on
+ 64-bit systems. Used when {option}`driSupport32Bit` is
+ set.
'';
};
- mesaPackage = mkOption {
- type = types.package;
- default = pkgs.mesa;
- defaultText = literalExpression "pkgs.mesa";
- example = literalExpression "pkgs.mesa_22";
- description = lib.mdDoc ''
- The Mesa driver package used for rendering support on the system.
-
- You should only need to adjust this if you require a newer Mesa
- version for your hardware or because you need to patch a bug.
- '';
- apply = mesa: mesa.drivers or (throw "`mesa` package must have a `drivers` output.");
- };
- mesaPackage32 = mkOption {
- type = types.package;
- default = pkgs.pkgsi686Linux.mesa;
- defaultText = literalExpression "pkgs.pkgsi686Linux.mesa";
- example = literalExpression "pkgs.pkgsi686Linux.mesa_22";
- description = lib.mdDoc ''
- Same as {option}`mesaPackage` but for the 32-bit Mesa on 64-bit
- systems. Used when {option}`driSupport32Bit` is set.
- '';
- apply = mesa: mesa.drivers or (throw "`mesa` package must have a `drivers` output.");
- };
-
extraPackages = mkOption {
type = types.listOf types.package;
default = [];
@@ -126,6 +97,7 @@ in
:::
'';
};
+
extraPackages32 = mkOption {
type = types.listOf types.package;
default = [];
@@ -181,6 +153,9 @@ in
environment.sessionVariables.LD_LIBRARY_PATH = mkIf cfg.setLdLibraryPath
([ "/run/opengl-driver/lib" ] ++ optional cfg.driSupport32Bit "/run/opengl-driver-32/lib");
+ hardware.opengl.package = mkDefault pkgs.mesa.drivers;
+ hardware.opengl.package32 = mkDefault pkgs.pkgsi686Linux.mesa.drivers;
+
boot.extraModulePackages = optional (elem "virtualbox" videoDrivers) kernelPackages.virtualboxGuestAdditions;
};
}
diff --git a/third_party/nixpkgs/nixos/modules/hardware/video/nvidia.nix b/third_party/nixpkgs/nixos/modules/hardware/video/nvidia.nix
index 79a3ab6baa..592d11d647 100644
--- a/third_party/nixpkgs/nixos/modules/hardware/video/nvidia.nix
+++ b/third_party/nixpkgs/nixos/modules/hardware/video/nvidia.nix
@@ -26,6 +26,8 @@ let
nvidiaPersistencedEnabled = cfg.nvidiaPersistenced;
nvidiaSettings = cfg.nvidiaSettings;
busIDType = types.strMatching "([[:print:]]+[\:\@][0-9]{1,3}\:[0-9]{1,2}\:[0-9])?";
+
+ ibtSupport = cfg.open || (nvidia_x11.ibtSupport or false);
in
{
@@ -462,7 +464,7 @@ in
boot.kernelParams = optional (offloadCfg.enable || cfg.modesetting.enable) "nvidia-drm.modeset=1"
++ optional cfg.powerManagement.enable "nvidia.NVreg_PreserveVideoMemoryAllocations=1"
++ optional cfg.open "nvidia.NVreg_OpenRmEnableUnsupportedGpus=1"
- ++ optional (!cfg.open && config.boot.kernelPackages.kernel.kernelAtLeast "6.2" && lib.versionOlder nvidia_x11.version "530") "ibt=off";
+ ++ optional (config.boot.kernelPackages.kernel.kernelAtLeast "6.2" && !ibtSupport) "ibt=off";
services.udev.extraRules =
''
diff --git a/third_party/nixpkgs/nixos/modules/hardware/video/webcam/ipu6.nix b/third_party/nixpkgs/nixos/modules/hardware/video/webcam/ipu6.nix
new file mode 100644
index 0000000000..fce78cda34
--- /dev/null
+++ b/third_party/nixpkgs/nixos/modules/hardware/video/webcam/ipu6.nix
@@ -0,0 +1,57 @@
+{ config, lib, pkgs, ... }:
+let
+
+ inherit (lib) mkDefault mkEnableOption mkIf mkOption optional types;
+
+ cfg = config.hardware.ipu6;
+
+in
+{
+
+ options.hardware.ipu6 = {
+
+ enable = mkEnableOption (lib.mdDoc "support for Intel IPU6/MIPI cameras");
+
+ platform = mkOption {
+ type = types.enum [ "ipu6" "ipu6ep" ];
+ description = lib.mdDoc ''
+ Choose the version for your hardware platform.
+
+ Use `ipu6` for Tiger Lake and `ipu6ep` for Alder Lake respectively.
+ '';
+ };
+
+ };
+
+ config = mkIf cfg.enable {
+
+ boot.extraModulePackages = with config.boot.kernelPackages; [
+ ipu6-drivers
+ ];
+
+ hardware.firmware = with pkgs; [ ]
+ ++ optional (cfg.platform == "ipu6") ipu6-camera-bin
+ ++ optional (cfg.platform == "ipu6ep") ipu6ep-camera-bin;
+
+ services.udev.extraRules = ''
+ SUBSYSTEM=="intel-ipu6-psys", MODE="0660", GROUP="video"
+ '';
+
+ services.v4l2-relayd.instances.ipu6 = {
+ enable = mkDefault true;
+
+ cardLabel = mkDefault "Intel MIPI Camera";
+
+ extraPackages = with pkgs.gst_all_1; [ ]
+ ++ optional (cfg.platform == "ipu6") icamerasrc-ipu6
+ ++ optional (cfg.platform == "ipu6ep") icamerasrc-ipu6ep;
+
+ input = {
+ pipeline = "icamerasrc";
+ format = mkIf (cfg.platform == "ipu6ep") (mkDefault "NV12");
+ };
+ };
+
+ };
+
+}
diff --git a/third_party/nixpkgs/nixos/modules/i18n/input-method/fcitx5.nix b/third_party/nixpkgs/nixos/modules/i18n/input-method/fcitx5.nix
index aa816c90a3..7251240d26 100644
--- a/third_party/nixpkgs/nixos/modules/i18n/input-method/fcitx5.nix
+++ b/third_party/nixpkgs/nixos/modules/i18n/input-method/fcitx5.nix
@@ -5,10 +5,9 @@ with lib;
let
im = config.i18n.inputMethod;
cfg = im.fcitx5;
- addons = cfg.addons ++ optional cfg.enableRimeData pkgs.rime-data;
- fcitx5Package = pkgs.fcitx5-with-addons.override { inherit addons; };
- whetherRimeDataDir = any (p: p.pname == "fcitx5-rime") cfg.addons;
-in {
+ fcitx5Package = pkgs.fcitx5-with-addons.override { inherit (cfg) addons; };
+in
+{
options = {
i18n.inputMethod.fcitx5 = {
addons = mkOption {
@@ -19,30 +18,23 @@ in {
Enabled Fcitx5 addons.
'';
};
-
- enableRimeData = mkEnableOption (lib.mdDoc "default rime-data with fcitx5-rime");
};
};
+ imports = [
+ (mkRemovedOptionModule [ "i18n" "inputMethod" "fcitx5" "enableRimeData" ] ''
+ RIME data is now included in `fcitx5-rime` by default, and can be customized using `fcitx5-rime.override { rimeDataPkgs = ...; }`
+ '')
+ ];
+
config = mkIf (im.enabled == "fcitx5") {
i18n.inputMethod.package = fcitx5Package;
- environment = mkMerge [{
- variables = {
- GTK_IM_MODULE = "fcitx";
- QT_IM_MODULE = "fcitx";
- XMODIFIERS = "@im=fcitx";
- QT_PLUGIN_PATH = [ "${fcitx5Package}/${pkgs.qt6.qtbase.qtPluginPrefix}" ];
- };
- }
- (mkIf whetherRimeDataDir {
- pathsToLink = [
- "/share/rime-data"
- ];
-
- variables = {
- NIX_RIME_DATA_DIR = "/run/current-system/sw/share/rime-data";
- };
- })];
+ environment.variables = {
+ GTK_IM_MODULE = "fcitx";
+ QT_IM_MODULE = "fcitx";
+ XMODIFIERS = "@im=fcitx";
+ QT_PLUGIN_PATH = [ "${fcitx5Package}/${pkgs.qt6.qtbase.qtPluginPrefix}" ];
+ };
};
}
diff --git a/third_party/nixpkgs/nixos/modules/misc/documentation.nix b/third_party/nixpkgs/nixos/modules/misc/documentation.nix
index ecc40ad6ad..e0c6af4abe 100644
--- a/third_party/nixpkgs/nixos/modules/misc/documentation.nix
+++ b/third_party/nixpkgs/nixos/modules/misc/documentation.nix
@@ -131,7 +131,8 @@ let
desktopItem = pkgs.makeDesktopItem {
name = "nixos-manual";
desktopName = "NixOS Manual";
- genericName = "View NixOS documentation in a web browser";
+ genericName = "System Manual";
+ comment = "View NixOS documentation in a web browser";
icon = "nix-snowflake";
exec = "nixos-help";
categories = ["System"];
diff --git a/third_party/nixpkgs/nixos/modules/misc/ids.nix b/third_party/nixpkgs/nixos/modules/misc/ids.nix
index bed50b8160..5b278b5e80 100644
--- a/third_party/nixpkgs/nixos/modules/misc/ids.nix
+++ b/third_party/nixpkgs/nixos/modules/misc/ids.nix
@@ -233,7 +233,7 @@ in
# nix-serve = 199; # unused, removed 2020-12-12
#tvheadend = 200; # dynamically allocated as of 2021-09-18
uwsgi = 201;
- gitit = 202;
+ # gitit = 202; # unused, module was removed 2023-04-03
riemanntools = 203;
subsonic = 204;
# riak = 205; # unused, remove 2022-07-22
diff --git a/third_party/nixpkgs/nixos/modules/module-list.nix b/third_party/nixpkgs/nixos/modules/module-list.nix
index abd88d285a..bac096efac 100644
--- a/third_party/nixpkgs/nixos/modules/module-list.nix
+++ b/third_party/nixpkgs/nixos/modules/module-list.nix
@@ -99,6 +99,7 @@
./hardware/video/switcheroo-control.nix
./hardware/video/uvcvideo/default.nix
./hardware/video/webcam/facetimehd.nix
+ ./hardware/video/webcam/ipu6.nix
./hardware/wooting.nix
./hardware/xone.nix
./hardware/xpadneo.nix
@@ -179,6 +180,7 @@
./programs/haguichi.nix
./programs/hamster.nix
./programs/htop.nix
+ ./programs/hyprland.nix
./programs/iay.nix
./programs/iftop.nix
./programs/i3lock.nix
@@ -195,6 +197,7 @@
./programs/mdevctl.nix
./programs/mepo.nix
./programs/mininet.nix
+ ./programs/minipro.nix
./programs/miriway.nix
./programs/mosh.nix
./programs/msmtp.nix
@@ -276,6 +279,7 @@
./security/doas.nix
./security/duosec.nix
./security/google_oslogin.nix
+ ./security/ipa.nix
./security/lock-kernel-modules.nix
./security/misc.nix
./security/oath.nix
@@ -562,6 +566,7 @@
./services/mail/schleuder.nix
./services/mail/spamassassin.nix
./services/mail/sympa.nix
+ ./services/mail/zeyple.nix
./services/matrix/appservice-discord.nix
./services/matrix/appservice-irc.nix
./services/matrix/conduit.nix
@@ -611,7 +616,6 @@
./services/misc/gammu-smsd.nix
./services/misc/geoipupdate.nix
./services/misc/gitea.nix
- # ./services/misc/gitit.nix
./services/misc/gitlab.nix
./services/misc/gitolite.nix
./services/misc/gitweb.nix
@@ -1038,6 +1042,7 @@
./services/networking/wg-quick.nix
./services/networking/wireguard.nix
./services/networking/wpa_supplicant.nix
+ ./services/networking/wstunnel.nix
./services/networking/x2goserver.nix
./services/networking/xandikos.nix
./services/networking/xinetd.nix
@@ -1127,6 +1132,7 @@
./services/video/replay-sorcery.nix
./services/video/rtsp-simple-server.nix
./services/video/unifi-video.nix
+ ./services/video/v4l2-relayd.nix
./services/wayland/cage.nix
./services/web-apps/akkoma.nix
./services/web-apps/alps.nix
@@ -1137,6 +1143,7 @@
./services/web-apps/calibre-web.nix
./services/web-apps/coder.nix
./services/web-apps/changedetection-io.nix
+ ./services/web-apps/chatgpt-retrieval-plugin.nix
./services/web-apps/cloudlog.nix
./services/web-apps/code-server.nix
./services/web-apps/convos.nix
diff --git a/third_party/nixpkgs/nixos/modules/profiles/installation-device.nix b/third_party/nixpkgs/nixos/modules/profiles/installation-device.nix
index 980720691a..32884f4b87 100644
--- a/third_party/nixpkgs/nixos/modules/profiles/installation-device.nix
+++ b/third_party/nixpkgs/nixos/modules/profiles/installation-device.nix
@@ -52,9 +52,9 @@ with lib;
services.getty.helpLine = ''
The "nixos" and "root" accounts have empty passwords.
- An ssh daemon is running. You then must set a password
- for either "root" or "nixos" with `passwd` or add an ssh key
- to /home/nixos/.ssh/authorized_keys be able to login.
+ To log in over ssh you must set a password for either "nixos" or "root"
+ with `passwd` (prefix with `sudo` for "root"), or add your public key to
+ /home/nixos/.ssh/authorized_keys or /root/.ssh/authorized_keys.
If you need a wireless connection, type
`sudo systemctl start wpa_supplicant` and configure a
@@ -65,8 +65,8 @@ with lib;
start the graphical user interface.
'';
- # We run sshd by default. Login via root is only possible after adding a
- # password via "passwd" or by adding a ssh key to /home/nixos/.ssh/authorized_keys.
+ # We run sshd by default. Login is only possible after adding a
+ # password via "passwd" or by adding a ssh key to ~/.ssh/authorized_keys.
# The latter one is particular useful if keys are manually added to
# installation device for head-less systems i.e. arm boards by manually
# mounting the storage in a different system.
diff --git a/third_party/nixpkgs/nixos/modules/profiles/macos-builder.nix b/third_party/nixpkgs/nixos/modules/profiles/macos-builder.nix
index 4a5359582b..768c673e7f 100644
--- a/third_party/nixpkgs/nixos/modules/profiles/macos-builder.nix
+++ b/third_party/nixpkgs/nixos/modules/profiles/macos-builder.nix
@@ -7,6 +7,8 @@ let
keyType = "ed25519";
+ cfg = config.virtualisation.darwin-builder;
+
in
{
@@ -24,156 +26,214 @@ in
}
];
- # The builder is not intended to be used interactively
- documentation.enable = false;
-
- environment.etc = {
- "ssh/ssh_host_ed25519_key" = {
- mode = "0600";
-
- source = ./keys/ssh_host_ed25519_key;
+ options.virtualisation.darwin-builder = with lib; {
+ diskSize = mkOption {
+ default = 20 * 1024;
+ type = types.int;
+ example = 30720;
+ description = "The maximum disk space allocated to the runner in MB";
};
-
- "ssh/ssh_host_ed25519_key.pub" = {
- mode = "0644";
-
- source = ./keys/ssh_host_ed25519_key.pub;
+ memorySize = mkOption {
+ default = 3 * 1024;
+ type = types.int;
+ example = 8192;
+ description = "The runner's memory in MB";
};
- };
-
- # DNS fails for QEMU user networking (SLiRP) on macOS. See:
- #
- # https://github.com/utmapp/UTM/issues/2353
- #
- # This works around that by using a public DNS server other than the DNS
- # server that QEMU provides (normally 10.0.2.3)
- networking.nameservers = [ "8.8.8.8" ];
-
- nix.settings = {
- auto-optimise-store = true;
-
- min-free = 1024 * 1024 * 1024;
-
- max-free = 3 * 1024 * 1024 * 1024;
-
- trusted-users = [ "root" user ];
- };
-
- services = {
- getty.autologinUser = user;
-
- openssh = {
- enable = true;
-
- authorizedKeysFiles = [ "${keysDirectory}/%u_${keyType}.pub" ];
- };
- };
-
- system.build.macos-builder-installer =
- let
- privateKey = "/etc/nix/${user}_${keyType}";
-
- publicKey = "${privateKey}.pub";
-
- # This installCredentials script is written so that it's as easy as
- # possible for a user to audit before confirming the `sudo`
- installCredentials = hostPkgs.writeShellScript "install-credentials" ''
- KEYS="''${1}"
- INSTALL=${hostPkgs.coreutils}/bin/install
- "''${INSTALL}" -g nixbld -m 600 "''${KEYS}/${user}_${keyType}" ${privateKey}
- "''${INSTALL}" -g nixbld -m 644 "''${KEYS}/${user}_${keyType}.pub" ${publicKey}
+ min-free = mkOption {
+ default = 1024 * 1024 * 1024;
+ type = types.int;
+ example = 1073741824;
+ description = ''
+ The threshold (in bytes) of free disk space left at which to
+ start garbage collection on the runner
'';
-
- hostPkgs = config.virtualisation.host.pkgs;
-
- script = hostPkgs.writeShellScriptBin "create-builder" ''
- KEYS="''${KEYS:-./keys}"
- ${hostPkgs.coreutils}/bin/mkdir --parent "''${KEYS}"
- PRIVATE_KEY="''${KEYS}/${user}_${keyType}"
- PUBLIC_KEY="''${PRIVATE_KEY}.pub"
- if [ ! -e "''${PRIVATE_KEY}" ] || [ ! -e "''${PUBLIC_KEY}" ]; then
- ${hostPkgs.coreutils}/bin/rm --force -- "''${PRIVATE_KEY}" "''${PUBLIC_KEY}"
- ${hostPkgs.openssh}/bin/ssh-keygen -q -f "''${PRIVATE_KEY}" -t ${keyType} -N "" -C 'builder@localhost'
- fi
- if ! ${hostPkgs.diffutils}/bin/cmp "''${PUBLIC_KEY}" ${publicKey}; then
- (set -x; sudo --reset-timestamp ${installCredentials} "''${KEYS}")
- fi
- KEYS="$(nix-store --add "$KEYS")" ${config.system.build.vm}/bin/run-nixos-vm
+ };
+ max-free = mkOption {
+ default = 3 * 1024 * 1024 * 1024;
+ type = types.int;
+ example = 3221225472;
+ description = ''
+ The threshold (in bytes) of free disk space left at which to
+ stop garbage collection on the runner
'';
+ };
+ workingDirectory = mkOption {
+ default = ".";
+ type = types.str;
+ example = "/var/lib/darwin-builder";
+ description = ''
+ The working directory to use to run the script. When running
+ as part of a flake will need to be set to a non read-only filesystem.
+ '';
+ };
+ hostPort = mkOption {
+ default = 22;
+ type = types.int;
+ example = 31022;
+ description = ''
+ The localhost host port to forward TCP to the guest port.
+ '';
+ };
+ };
- in
- script.overrideAttrs (old: {
- meta = (old.meta or { }) // {
- platforms = lib.platforms.darwin;
+ config = {
+ # The builder is not intended to be used interactively
+ documentation.enable = false;
+
+ environment.etc = {
+ "ssh/ssh_host_ed25519_key" = {
+ mode = "0600";
+
+ source = ./keys/ssh_host_ed25519_key;
};
- });
- system = {
- # To prevent gratuitous rebuilds on each change to Nixpkgs
- nixos.revision = null;
+ "ssh/ssh_host_ed25519_key.pub" = {
+ mode = "0644";
- stateVersion = lib.mkDefault (throw ''
- The macOS linux builder should not need a stateVersion to be set, but a module
- has accessed stateVersion nonetheless.
- Please inspect the trace of the following command to figure out which module
- has a dependency on stateVersion.
-
- nix-instantiate --attr darwin.builder --show-trace
- '');
- };
-
- users.users."${user}" = {
- isNormalUser = true;
- };
-
- security.polkit.enable = true;
-
- security.polkit.extraConfig = ''
- polkit.addRule(function(action, subject) {
- if (action.id === "org.freedesktop.login1.power-off" && subject.user === "${user}") {
- return "yes";
- } else {
- return "no";
- }
- })
- '';
-
- virtualisation = {
- diskSize = 20 * 1024;
-
- memorySize = 3 * 1024;
-
- forwardPorts = [
- { from = "host"; guest.port = 22; host.port = 22; }
- ];
-
- # Disable graphics for the builder since users will likely want to run it
- # non-interactively in the background.
- graphics = false;
-
- sharedDirectories.keys = {
- source = "\"$KEYS\"";
- target = keysDirectory;
+ source = ./keys/ssh_host_ed25519_key.pub;
+ };
};
- # If we don't enable this option then the host will fail to delegate builds
- # to the guest, because:
+ # DNS fails for QEMU user networking (SLiRP) on macOS. See:
#
- # - The host will lock the path to build
- # - The host will delegate the build to the guest
- # - The guest will attempt to lock the same path and fail because
- # the lockfile on the host is visible on the guest
+ # https://github.com/utmapp/UTM/issues/2353
#
- # Snapshotting the host's /nix/store as an image isolates the guest VM's
- # /nix/store from the host's /nix/store, preventing this problem.
- useNixStoreImage = true;
+ # This works around that by using a public DNS server other than the DNS
+ # server that QEMU provides (normally 10.0.2.3)
+ networking.nameservers = [ "8.8.8.8" ];
- # Obviously the /nix/store needs to be writable on the guest in order for it
- # to perform builds.
- writableStore = true;
+ nix.settings = {
+ auto-optimise-store = true;
- # This ensures that anything built on the guest isn't lost when the guest is
- # restarted.
- writableStoreUseTmpfs = false;
+ min-free = cfg.min-free;
+
+ max-free = cfg.max-free;
+
+ trusted-users = [ "root" user ];
+ };
+
+ services = {
+ getty.autologinUser = user;
+
+ openssh = {
+ enable = true;
+
+ authorizedKeysFiles = [ "${keysDirectory}/%u_${keyType}.pub" ];
+ };
+ };
+
+ system.build.macos-builder-installer =
+ let
+ privateKey = "/etc/nix/${user}_${keyType}";
+
+ publicKey = "${privateKey}.pub";
+
+ # This installCredentials script is written so that it's as easy as
+ # possible for a user to audit before confirming the `sudo`
+ installCredentials = hostPkgs.writeShellScript "install-credentials" ''
+ KEYS="''${1}"
+ INSTALL=${hostPkgs.coreutils}/bin/install
+ "''${INSTALL}" -g nixbld -m 600 "''${KEYS}/${user}_${keyType}" ${privateKey}
+ "''${INSTALL}" -g nixbld -m 644 "''${KEYS}/${user}_${keyType}.pub" ${publicKey}
+ '';
+
+ hostPkgs = config.virtualisation.host.pkgs;
+
+ script = hostPkgs.writeShellScriptBin "create-builder" (
+ # When running as non-interactively as part of a DarwinConfiguration the working directory
+ # must be set to a writeable directory.
+ (if cfg.workingDirectory != "." then ''
+ ${hostPkgs.coreutils}/bin/mkdir --parent "${cfg.workingDirectory}"
+ cd "${cfg.workingDirectory}"
+ '' else "") + ''
+ KEYS="''${KEYS:-./keys}"
+ ${hostPkgs.coreutils}/bin/mkdir --parent "''${KEYS}"
+ PRIVATE_KEY="''${KEYS}/${user}_${keyType}"
+ PUBLIC_KEY="''${PRIVATE_KEY}.pub"
+ if [ ! -e "''${PRIVATE_KEY}" ] || [ ! -e "''${PUBLIC_KEY}" ]; then
+ ${hostPkgs.coreutils}/bin/rm --force -- "''${PRIVATE_KEY}" "''${PUBLIC_KEY}"
+ ${hostPkgs.openssh}/bin/ssh-keygen -q -f "''${PRIVATE_KEY}" -t ${keyType} -N "" -C 'builder@localhost'
+ fi
+ if ! ${hostPkgs.diffutils}/bin/cmp "''${PUBLIC_KEY}" ${publicKey}; then
+ (set -x; sudo --reset-timestamp ${installCredentials} "''${KEYS}")
+ fi
+ KEYS="$(${hostPkgs.nix}/bin/nix-store --add "$KEYS")" ${config.system.build.vm}/bin/run-nixos-vm
+ '');
+
+ in
+ script.overrideAttrs (old: {
+ meta = (old.meta or { }) // {
+ platforms = lib.platforms.darwin;
+ };
+ });
+
+ system = {
+ # To prevent gratuitous rebuilds on each change to Nixpkgs
+ nixos.revision = null;
+
+ stateVersion = lib.mkDefault (throw ''
+ The macOS linux builder should not need a stateVersion to be set, but a module
+ has accessed stateVersion nonetheless.
+ Please inspect the trace of the following command to figure out which module
+ has a dependency on stateVersion.
+
+ nix-instantiate --attr darwin.builder --show-trace
+ '');
+ };
+
+ users.users."${user}" = {
+ isNormalUser = true;
+ };
+
+ security.polkit.enable = true;
+
+ security.polkit.extraConfig = ''
+ polkit.addRule(function(action, subject) {
+ if (action.id === "org.freedesktop.login1.power-off" && subject.user === "${user}") {
+ return "yes";
+ } else {
+ return "no";
+ }
+ })
+ '';
+
+ virtualisation = {
+ diskSize = cfg.diskSize;
+
+ memorySize = cfg.memorySize;
+
+ forwardPorts = [
+ { from = "host"; guest.port = 22; host.port = cfg.hostPort; }
+ ];
+
+ # Disable graphics for the builder since users will likely want to run it
+ # non-interactively in the background.
+ graphics = false;
+
+ sharedDirectories.keys = {
+ source = "\"$KEYS\"";
+ target = keysDirectory;
+ };
+
+ # If we don't enable this option then the host will fail to delegate builds
+ # to the guest, because:
+ #
+ # - The host will lock the path to build
+ # - The host will delegate the build to the guest
+ # - The guest will attempt to lock the same path and fail because
+ # the lockfile on the host is visible on the guest
+ #
+ # Snapshotting the host's /nix/store as an image isolates the guest VM's
+ # /nix/store from the host's /nix/store, preventing this problem.
+ useNixStoreImage = true;
+
+ # Obviously the /nix/store needs to be writable on the guest in order for it
+ # to perform builds.
+ writableStore = true;
+
+ # This ensures that anything built on the guest isn't lost when the guest is
+ # restarted.
+ writableStoreUseTmpfs = false;
+ };
};
}
diff --git a/third_party/nixpkgs/nixos/modules/programs/hyprland.nix b/third_party/nixpkgs/nixos/modules/programs/hyprland.nix
new file mode 100644
index 0000000000..b14f1f77fc
--- /dev/null
+++ b/third_party/nixpkgs/nixos/modules/programs/hyprland.nix
@@ -0,0 +1,84 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+with lib; let
+ cfg = config.programs.hyprland;
+
+ defaultHyprlandPackage = pkgs.hyprland.override {
+ enableXWayland = cfg.xwayland.enable;
+ hidpiXWayland = cfg.xwayland.hidpi;
+ nvidiaPatches = cfg.nvidiaPatches;
+ };
+in
+{
+ options.programs.hyprland = {
+ enable = mkEnableOption null // {
+ description = mdDoc ''
+ Hyprland, the dynamic tiling Wayland compositor that doesn't sacrifice on its looks.
+
+ You can manually launch Hyprland by executing {command}`Hyprland` on a TTY.
+
+ A configuration file will be generated in {file}`~/.config/hypr/hyprland.conf`.
+ See for more information.
+ '';
+ };
+
+ package = mkOption {
+ type = types.path;
+ default = defaultHyprlandPackage;
+ defaultText = literalExpression ''
+ pkgs.hyprland.override {
+ enableXWayland = config.programs.hyprland.xwayland.enable;
+ hidpiXWayland = config.programs.hyprland.xwayland.hidpi;
+ nvidiaPatches = config.programs.hyprland.nvidiaPatches;
+ }
+ '';
+ example = literalExpression ".packages..default";
+ description = mdDoc ''
+ The Hyprland package to use.
+ Setting this option will make {option}`programs.hyprland.xwayland` and
+ {option}`programs.hyprland.nvidiaPatches` not work.
+ '';
+ };
+
+ xwayland = {
+ enable = mkEnableOption (mdDoc "XWayland") // { default = true; };
+ hidpi = mkEnableOption null // {
+ description = mdDoc ''
+ Enable HiDPI XWayland, based on [XWayland MR 733](https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/733).
+ See for more info.
+ '';
+ };
+ };
+
+ nvidiaPatches = mkEnableOption (mdDoc "patching wlroots for better Nvidia support");
+ };
+
+ config = mkIf cfg.enable {
+ environment = {
+ systemPackages = [ cfg.package ];
+
+ };
+
+ fonts.enableDefaultFonts = mkDefault true;
+ hardware.opengl.enable = mkDefault true;
+
+ programs = {
+ dconf.enable = mkDefault true;
+ xwayland.enable = mkDefault true;
+ };
+
+ security.polkit.enable = true;
+
+ services.xserver.displayManager.sessionPackages = [ cfg.package ];
+
+ xdg.portal = {
+ enable = mkDefault true;
+ extraPortals = [
+ pkgs.xdg-desktop-portal-hyprland
+ ];
+ };
+ };
+}
diff --git a/third_party/nixpkgs/nixos/modules/programs/minipro.nix b/third_party/nixpkgs/nixos/modules/programs/minipro.nix
new file mode 100644
index 0000000000..a947f83f2e
--- /dev/null
+++ b/third_party/nixpkgs/nixos/modules/programs/minipro.nix
@@ -0,0 +1,29 @@
+{ config, lib, pkgs, ... }:
+
+let
+ cfg = config.programs.minipro;
+in
+{
+ options = {
+ programs.minipro = {
+ enable = lib.mkEnableOption (lib.mdDoc "minipro") // {
+ description = lib.mdDoc ''
+ Installs minipro and its udev rules.
+ Users of the `plugdev` group can interact with connected MiniPRO chip programmers.
+ '';
+ };
+
+ package = lib.mkPackageOptionMD pkgs "minipro" { };
+ };
+ };
+
+ config = lib.mkIf cfg.enable {
+ users.groups.plugdev = { };
+ environment.systemPackages = [ cfg.package ];
+ services.udev.packages = [ cfg.package ];
+ };
+
+ meta = {
+ maintainers = with lib.maintainers; [ infinidoge ];
+ };
+}
diff --git a/third_party/nixpkgs/nixos/modules/programs/tsm-client.nix b/third_party/nixpkgs/nixos/modules/programs/tsm-client.nix
index 7adff7cd28..41560544c2 100644
--- a/third_party/nixpkgs/nixos/modules/programs/tsm-client.nix
+++ b/third_party/nixpkgs/nixos/modules/programs/tsm-client.nix
@@ -6,7 +6,7 @@ let
inherit (lib.attrsets) attrNames filterAttrs hasAttr mapAttrs mapAttrsToList optionalAttrs;
inherit (lib.modules) mkDefault mkIf;
inherit (lib.options) literalExpression mkEnableOption mkOption;
- inherit (lib.strings) concatStringsSep optionalString toLower;
+ inherit (lib.strings) concatLines optionalString toLower;
inherit (lib.types) addCheck attrsOf lines nonEmptyStr nullOr package path port str strMatching submodule;
# Checks if given list of strings contains unique
@@ -164,7 +164,7 @@ let
mkLine = k: v: k + optionalString (v!="") " ${v}";
lines = mapAttrsToList mkLine attrset;
in
- concatStringsSep "\n" lines;
+ concatLines lines;
config.stanza = ''
server ${config.name}
${config.text}
@@ -263,7 +263,7 @@ let
${optionalString (cfg.defaultServername!=null) "defaultserver ${cfg.defaultServername}"}
- ${concatStringsSep "\n" (mapAttrsToList (k: v: v.stanza) cfg.servers)}
+ ${concatLines (mapAttrsToList (k: v: v.stanza) cfg.servers)}
'';
in
diff --git a/third_party/nixpkgs/nixos/modules/security/ipa.nix b/third_party/nixpkgs/nixos/modules/security/ipa.nix
new file mode 100644
index 0000000000..7075be9504
--- /dev/null
+++ b/third_party/nixpkgs/nixos/modules/security/ipa.nix
@@ -0,0 +1,258 @@
+{
+ config,
+ lib,
+ pkgs,
+ ...
+}:
+with lib; let
+ cfg = config.security.ipa;
+ pyBool = x:
+ if x
+ then "True"
+ else "False";
+
+ ldapConf = pkgs.writeText "ldap.conf" ''
+ # Turning this off breaks GSSAPI used with krb5 when rdns = false
+ SASL_NOCANON on
+
+ URI ldaps://${cfg.server}
+ BASE ${cfg.basedn}
+ TLS_CACERT /etc/ipa/ca.crt
+ '';
+ nssDb =
+ pkgs.runCommand "ipa-nssdb"
+ {
+ nativeBuildInputs = [pkgs.nss.tools];
+ } ''
+ mkdir -p $out
+ certutil -d $out -N --empty-password
+ certutil -d $out -A --empty-password -n "${cfg.realm} IPA CA" -t CT,C,C -i ${cfg.certificate}
+ '';
+in {
+ options = {
+ security.ipa = {
+ enable = mkEnableOption (lib.mdDoc "FreeIPA domain integration");
+
+ certificate = mkOption {
+ type = types.package;
+ description = lib.mdDoc ''
+ IPA server CA certificate.
+
+ Use `nix-prefetch-url http://$server/ipa/config/ca.crt` to
+ obtain the file and the hash.
+ '';
+ example = literalExpression ''
+ pkgs.fetchurl {
+ url = http://ipa.example.com/ipa/config/ca.crt;
+ sha256 = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+ };
+ '';
+ };
+
+ domain = mkOption {
+ type = types.str;
+ example = "example.com";
+ description = lib.mdDoc "Domain of the IPA server.";
+ };
+
+ realm = mkOption {
+ type = types.str;
+ example = "EXAMPLE.COM";
+ description = lib.mdDoc "Kerberos realm.";
+ };
+
+ server = mkOption {
+ type = types.str;
+ example = "ipa.example.com";
+ description = lib.mdDoc "IPA Server hostname.";
+ };
+
+ basedn = mkOption {
+ type = types.str;
+ example = "dc=example,dc=com";
+ description = lib.mdDoc "Base DN to use when performing LDAP operations.";
+ };
+
+ offlinePasswords = mkOption {
+ type = types.bool;
+ default = true;
+ description = lib.mdDoc "Whether to store offline passwords when the server is down.";
+ };
+
+ cacheCredentials = mkOption {
+ type = types.bool;
+ default = true;
+ description = lib.mdDoc "Whether to cache credentials.";
+ };
+
+ ifpAllowedUids = mkOption {
+ type = types.listOf types.string;
+ default = ["root"];
+ description = lib.mdDoc "A list of users allowed to access the ifp dbus interface.";
+ };
+
+ dyndns = {
+ enable = mkOption {
+ type = types.bool;
+ default = true;
+ description = lib.mdDoc "Whether to enable FreeIPA automatic hostname updates.";
+ };
+
+ interface = mkOption {
+ type = types.str;
+ example = "eth0";
+ default = "*";
+ description = lib.mdDoc "Network interface to perform hostname updates through.";
+ };
+ };
+
+ chromiumSupport = mkOption {
+ type = types.bool;
+ default = true;
+ description = lib.mdDoc "Whether to whitelist the FreeIPA domain in Chromium.";
+ };
+ };
+ };
+
+ config = mkIf cfg.enable {
+ assertions = [
+ {
+ assertion = !config.krb5.enable;
+ message = "krb5 must be disabled through `krb5.enable` for FreeIPA integration to work.";
+ }
+ {
+ assertion = !config.users.ldap.enable;
+ message = "ldap must be disabled through `users.ldap.enable` for FreeIPA integration to work.";
+ }
+ ];
+
+ environment.systemPackages = with pkgs; [krb5Full freeipa];
+
+ environment.etc = {
+ "ipa/default.conf".text = ''
+ [global]
+ basedn = ${cfg.basedn}
+ realm = ${cfg.realm}
+ domain = ${cfg.domain}
+ server = ${cfg.server}
+ host = ${config.networking.hostName}
+ xmlrpc_uri = https://${cfg.server}/ipa/xml
+ enable_ra = True
+ '';
+
+ "ipa/nssdb".source = nssDb;
+
+ "krb5.conf".text = ''
+ [libdefaults]
+ default_realm = ${cfg.realm}
+ dns_lookup_realm = false
+ dns_lookup_kdc = true
+ rdns = false
+ ticket_lifetime = 24h
+ forwardable = true
+ udp_preference_limit = 0
+
+ [realms]
+ ${cfg.realm} = {
+ kdc = ${cfg.server}:88
+ master_kdc = ${cfg.server}:88
+ admin_server = ${cfg.server}:749
+ default_domain = ${cfg.domain}
+ pkinit_anchors = FILE:/etc/ipa/ca.crt
+ }
+
+ [domain_realm]
+ .${cfg.domain} = ${cfg.realm}
+ ${cfg.domain} = ${cfg.realm}
+ ${cfg.server} = ${cfg.realm}
+
+ [dbmodules]
+ ${cfg.realm} = {
+ db_library = ${pkgs.freeipa}/lib/krb5/plugins/kdb/ipadb.so
+ }
+ '';
+
+ "openldap/ldap.conf".source = ldapConf;
+ };
+
+ environment.etc."chromium/policies/managed/freeipa.json" = mkIf cfg.chromiumSupport {
+ text = ''
+ { "AuthServerWhitelist": "*.${cfg.domain}" }
+ '';
+ };
+
+ system.activationScripts.ipa = stringAfter ["etc"] ''
+ # libcurl requires a hard copy of the certificate
+ if ! ${pkgs.diffutils}/bin/diff ${cfg.certificate} /etc/ipa/ca.crt > /dev/null 2>&1; then
+ rm -f /etc/ipa/ca.crt
+ cp ${cfg.certificate} /etc/ipa/ca.crt
+ fi
+
+ if [ ! -f /etc/krb5.keytab ]; then
+ cat <
+ for details on supported values.
+ '';
+ };
+
+ keys = mkOption {
+ type = with types; listOf path;
+ description = lib.mdDoc "List of public key files that will be imported by gpg.";
+ };
+
+ rotateLogs = mkOption {
+ type = types.bool;
+ default = true;
+ description = lib.mdDoc "Whether to enable rotation of log files.";
+ };
+ };
+
+ config = mkIf cfg.enable {
+ users.groups = optionalAttrs (cfg.group == "zeyple") { "${cfg.group}" = { }; };
+ users.users = optionalAttrs (cfg.user == "zeyple") {
+ "${cfg.user}" = {
+ isSystemUser = true;
+ group = cfg.group;
+ };
+ };
+
+ services.zeyple.settings = {
+ zeyple = mapAttrs (name: mkDefault) {
+ log_file = "/var/log/zeyple/zeyple.log";
+ force_encrypt = true;
+ };
+
+ gpg = mapAttrs (name: mkDefault) { home = "${gpgHome}"; };
+
+ relay = mapAttrs (name: mkDefault) {
+ host = "localhost";
+ port = 10026;
+ };
+ };
+
+ environment.etc."zeyple.conf".source = ini.generate "zeyple.conf" cfg.settings;
+
+ systemd.tmpfiles.rules = [ "f '${cfg.settings.zeyple.log_file}' 0600 ${cfg.user} ${cfg.group} - -" ];
+ services.logrotate = mkIf cfg.rotateLogs {
+ enable = true;
+ settings.zeyple = {
+ files = cfg.settings.zeyple.log_file;
+ frequency = "weekly";
+ rotate = 5;
+ compress = true;
+ copytruncate = true;
+ };
+ };
+
+ services.postfix.extraMasterConf = ''
+ zeyple unix - n n - - pipe
+ user=${cfg.user} argv=${pkgs.zeyple}/bin/zeyple ''${recipient}
+
+ localhost:${toString cfg.settings.relay.port} inet n - n - 10 smtpd
+ -o content_filter=
+ -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks,no_milters
+ -o smtpd_helo_restrictions=
+ -o smtpd_client_restrictions=
+ -o smtpd_sender_restrictions=
+ -o smtpd_recipient_restrictions=permit_mynetworks,reject
+ -o mynetworks=127.0.0.0/8,[::1]/128
+ -o smtpd_authorized_xforward_hosts=127.0.0.0/8,[::1]/128
+ '';
+
+ services.postfix.extraConfig = "content_filter = zeyple";
+ };
+}
diff --git a/third_party/nixpkgs/nixos/modules/services/matrix/dendrite.nix b/third_party/nixpkgs/nixos/modules/services/matrix/dendrite.nix
index a8006547fc..244c15fbf7 100644
--- a/third_party/nixpkgs/nixos/modules/services/matrix/dendrite.nix
+++ b/third_party/nixpkgs/nixos/modules/services/matrix/dendrite.nix
@@ -159,6 +159,15 @@ in
'';
};
};
+ options.relay_api.database = {
+ connection_string = lib.mkOption {
+ type = lib.types.str;
+ default = "file:relayapi.db";
+ description = lib.mdDoc ''
+ Database for the Relay Server.
+ '';
+ };
+ };
options.media_api = {
database = {
connection_string = lib.mkOption {
@@ -294,7 +303,7 @@ in
-o /run/dendrite/dendrite.yaml
''];
ExecStart = lib.strings.concatStringsSep " " ([
- "${pkgs.dendrite}/bin/dendrite-monolith-server"
+ "${pkgs.dendrite}/bin/dendrite"
"--config /run/dendrite/dendrite.yaml"
] ++ lib.optionals (cfg.httpPort != null) [
"--http-bind-address :${builtins.toString cfg.httpPort}"
diff --git a/third_party/nixpkgs/nixos/modules/services/misc/atuin.nix b/third_party/nixpkgs/nixos/modules/services/misc/atuin.nix
index 508e2862b6..c603042fb3 100644
--- a/third_party/nixpkgs/nixos/modules/services/misc/atuin.nix
+++ b/third_party/nixpkgs/nixos/modules/services/misc/atuin.nix
@@ -28,6 +28,12 @@ in
description = mdDoc "The host address the atuin server should listen on.";
};
+ maxHistoryLength = mkOption {
+ type = types.int;
+ default = 8192;
+ description = mdDoc "The max length of each history item the atuin server should store.";
+ };
+
port = mkOption {
type = types.port;
default = 8888;
@@ -72,6 +78,7 @@ in
environment = {
ATUIN_HOST = cfg.host;
ATUIN_PORT = toString cfg.port;
+ ATUIN_MAX_HISTORY_LENGTH = toString cfg.maxHistoryLength;
ATUIN_OPEN_REGISTRATION = boolToString cfg.openRegistration;
ATUIN_DB_URI = "postgresql:///atuin";
ATUIN_PATH = cfg.path;
diff --git a/third_party/nixpkgs/nixos/modules/services/misc/gitit.nix b/third_party/nixpkgs/nixos/modules/services/misc/gitit.nix
deleted file mode 100644
index 0fafa76b54..0000000000
--- a/third_party/nixpkgs/nixos/modules/services/misc/gitit.nix
+++ /dev/null
@@ -1,725 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
- cfg = config.services.gitit;
-
- homeDir = "/var/lib/gitit";
-
- toYesNo = b: if b then "yes" else "no";
-
- gititShared = with cfg.haskellPackages; gitit + "/share/" + ghc.targetPrefix + ghc.haskellCompilerName + "/" + gitit.pname + "-" + gitit.version;
-
- gititWithPkgs = hsPkgs: extras: hsPkgs.ghcWithPackages (self: with self; [ gitit ] ++ (extras self));
-
- gititSh = hsPkgs: extras: with pkgs; let
- env = gititWithPkgs hsPkgs extras;
- in writeScript "gitit" ''
- #!${runtimeShell}
- cd $HOME
- export NIX_GHC="${env}/bin/ghc"
- export NIX_GHCPKG="${env}/bin/ghc-pkg"
- export NIX_GHC_DOCDIR="${env}/share/doc/ghc/html"
- export NIX_GHC_LIBDIR=$( $NIX_GHC --print-libdir )
- ${env}/bin/gitit -f ${configFile}
- '';
-
- gititOptions = {
-
- enable = mkOption {
- type = types.bool;
- default = false;
- description = lib.mdDoc "Enable the gitit service.";
- };
-
- haskellPackages = mkOption {
- default = pkgs.haskellPackages;
- defaultText = literalExpression "pkgs.haskellPackages";
- example = literalExpression "pkgs.haskell.packages.ghc784";
- description = lib.mdDoc "haskellPackages used to build gitit and plugins.";
- };
-
- extraPackages = mkOption {
- type = types.functionTo (types.listOf types.package);
- default = self: [];
- example = literalExpression ''
- haskellPackages: [
- haskellPackages.wreq
- ]
- '';
- description = lib.mdDoc ''
- Extra packages available to ghc when running gitit. The
- value must be a function which receives the attrset defined
- in {var}`haskellPackages` as the sole argument.
- '';
- };
-
- address = mkOption {
- type = types.str;
- default = "0.0.0.0";
- description = lib.mdDoc "IP address on which the web server will listen.";
- };
-
- port = mkOption {
- type = types.int;
- default = 5001;
- description = lib.mdDoc "Port on which the web server will run.";
- };
-
- wikiTitle = mkOption {
- type = types.str;
- default = "Gitit!";
- description = lib.mdDoc "The wiki title.";
- };
-
- repositoryType = mkOption {
- type = types.enum ["git" "darcs" "mercurial"];
- default = "git";
- description = lib.mdDoc "Specifies the type of repository used for wiki content.";
- };
-
- repositoryPath = mkOption {
- type = types.path;
- default = homeDir + "/wiki";
- description = lib.mdDoc ''
- Specifies the path of the repository directory. If it does not
- exist, gitit will create it on startup.
- '';
- };
-
- requireAuthentication = mkOption {
- type = types.enum [ "none" "modify" "read" ];
- default = "modify";
- description = lib.mdDoc ''
- If 'none', login is never required, and pages can be edited
- anonymously. If 'modify', login is required to modify the wiki
- (edit, add, delete pages, upload files). If 'read', login is
- required to see any wiki pages.
- '';
- };
-
- authenticationMethod = mkOption {
- type = types.enum [ "form" "http" "generic" "github" ];
- default = "form";
- description = lib.mdDoc ''
- 'form' means that users will be logged in and registered using forms
- in the gitit web interface. 'http' means that gitit will assume that
- HTTP authentication is in place and take the logged in username from
- the "Authorization" field of the HTTP request header (in addition,
- the login/logout and registration links will be suppressed).
- 'generic' means that gitit will assume that some form of
- authentication is in place that directly sets REMOTE_USER to the name
- of the authenticated user (e.g. mod_auth_cas on apache). 'rpx' means
- that gitit will attempt to log in through https://rpxnow.com. This
- requires that 'rpx-domain', 'rpx-key', and 'base-url' be set below,
- and that 'curl' be in the system path.
- '';
- };
-
- userFile = mkOption {
- type = types.path;
- default = homeDir + "/gitit-users";
- description = lib.mdDoc ''
- Specifies the path of the file containing user login information. If
- it does not exist, gitit will create it (with an empty user list).
- This file is not used if 'http' is selected for
- authentication-method.
- '';
- };
-
- sessionTimeout = mkOption {
- type = types.int;
- default = 60;
- description = lib.mdDoc ''
- Number of minutes of inactivity before a session expires.
- '';
- };
-
- staticDir = mkOption {
- type = types.path;
- default = gititShared + "/data/static";
- description = lib.mdDoc ''
- Specifies the path of the static directory (containing javascript,
- css, and images). If it does not exist, gitit will create it and
- populate it with required scripts, stylesheets, and images.
- '';
- };
-
- defaultPageType = mkOption {
- type = types.enum [ "markdown" "rst" "latex" "html" "markdown+lhs" "rst+lhs" "latex+lhs" ];
- default = "markdown";
- description = lib.mdDoc ''
- Specifies the type of markup used to interpret pages in the wiki.
- Possible values are markdown, rst, latex, html, markdown+lhs,
- rst+lhs, and latex+lhs. (the +lhs variants treat the input as
- literate Haskell. See pandoc's documentation for more details.) If
- Markdown is selected, pandoc's syntax extensions (for footnotes,
- delimited code blocks, etc.) will be enabled. Note that pandoc's
- restructuredtext parser is not complete, so some pages may not be
- rendered correctly if rst is selected. The same goes for latex and
- html.
- '';
- };
-
- math = mkOption {
- type = types.enum [ "mathml" "raw" "mathjax" "jsmath" "google" ];
- default = "mathml";
- description = lib.mdDoc ''
- Specifies how LaTeX math is to be displayed. Possible values are
- mathml, raw, mathjax, jsmath, and google. If mathml is selected,
- gitit will convert LaTeX math to MathML and link in a script,
- MathMLinHTML.js, that allows the MathML to be seen in Gecko browsers,
- IE + mathplayer, and Opera. In other browsers you may get a jumble of
- characters. If raw is selected, the LaTeX math will be displayed as
- raw LaTeX math. If mathjax is selected, gitit will link to the
- remote mathjax script. If jsMath is selected, gitit will link to the
- script /js/jsMath/easy/load.js, and will assume that jsMath has been
- installed into the js/jsMath directory. This is the most portable
- solution. If google is selected, the google chart API is called to
- render the formula as an image. This requires a connection to google,
- and might raise a technical or a privacy problem.
- '';
- };
-
- mathJaxScript = mkOption {
- type = types.str;
- default = "https://d3eoax9i5htok0.cloudfront.net/mathjax/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML";
- description = lib.mdDoc ''
- Specifies the path to MathJax rendering script. You might want to
- use your own MathJax script to render formulas without Internet
- connection or if you want to use some special LaTeX packages. Note:
- path specified there cannot be an absolute path to a script on your
- hdd, instead you should run your (local if you wish) HTTP server
- which will serve the MathJax.js script. You can easily (in four lines
- of code) serve MathJax.js using
- http://happstack.com/docs/crashcourse/FileServing.html Do not forget
- the "http://" prefix (e.g. http://localhost:1234/MathJax.js).
- '';
- };
-
- showLhsBirdTracks = mkOption {
- type = types.bool;
- default = false;
- description = lib.mdDoc ''
- Specifies whether to show Haskell code blocks in "bird style", with
- "> " at the beginning of each line.
- '';
- };
-
- templatesDir = mkOption {
- type = types.path;
- default = gititShared + "/data/templates";
- description = lib.mdDoc ''
- Specifies the path of the directory containing page templates. If it
- does not exist, gitit will create it with default templates. Users
- may wish to edit the templates to customize the appearance of their
- wiki. The template files are HStringTemplate templates. Variables to
- be interpolated appear between $\'s. Literal $\'s must be
- backslash-escaped.
- '';
- };
-
- logFile = mkOption {
- type = types.path;
- default = homeDir + "/gitit.log";
- description = lib.mdDoc ''
- Specifies the path of gitit's log file. If it does not exist, gitit
- will create it. The log is in Apache combined log format.
- '';
- };
-
- logLevel = mkOption {
- type = types.enum [ "DEBUG" "INFO" "NOTICE" "WARNING" "ERROR" "CRITICAL" "ALERT" "EMERGENCY" ];
- default = "ERROR";
- description = lib.mdDoc ''
- Determines how much information is logged. Possible values (from
- most to least verbose) are DEBUG, INFO, NOTICE, WARNING, ERROR,
- CRITICAL, ALERT, EMERGENCY.
- '';
- };
-
- frontPage = mkOption {
- type = types.str;
- default = "Front Page";
- description = lib.mdDoc ''
- Specifies which wiki page is to be used as the wiki's front page.
- Gitit creates a default front page on startup, if one does not exist
- already.
- '';
- };
-
- noDelete = mkOption {
- type = types.str;
- default = "Front Page, Help";
- description = lib.mdDoc ''
- Specifies pages that cannot be deleted through the web interface.
- (They can still be deleted directly using git or darcs.) A
- comma-separated list of page names. Leave blank to allow every page
- to be deleted.
- '';
- };
-
- noEdit = mkOption {
- type = types.str;
- default = "Help";
- description = lib.mdDoc ''
- Specifies pages that cannot be edited through the web interface.
- Leave blank to allow every page to be edited.
- '';
- };
-
- defaultSummary = mkOption {
- type = types.str;
- default = "";
- description = lib.mdDoc ''
- Specifies text to be used in the change description if the author
- leaves the "description" field blank. If default-summary is blank
- (the default), the author will be required to fill in the description
- field.
- '';
- };
-
- tableOfContents = mkOption {
- type = types.bool;
- default = true;
- description = lib.mdDoc ''
- Specifies whether to print a tables of contents (with links to
- sections) on each wiki page.
- '';
- };
-
- plugins = mkOption {
- type = with types; listOf str;
- default = [ (gititShared + "/plugins/Dot.hs") ];
- description = lib.mdDoc ''
- Specifies a list of plugins to load. Plugins may be specified either
- by their path or by their module name. If the plugin name starts
- with Gitit.Plugin., gitit will assume that the plugin is an installed
- module and will not try to find a source file.
- '';
- };
-
- useCache = mkOption {
- type = types.bool;
- default = false;
- description = lib.mdDoc ''
- Specifies whether to cache rendered pages. Note that if use-feed is
- selected, feeds will be cached regardless of the value of use-cache.
- '';
- };
-
- cacheDir = mkOption {
- type = types.path;
- default = homeDir + "/cache";
- description = lib.mdDoc "Path where rendered pages will be cached.";
- };
-
- maxUploadSize = mkOption {
- type = types.str;
- default = "1000K";
- description = lib.mdDoc ''
- Specifies an upper limit on the size (in bytes) of files uploaded
- through the wiki's web interface. To disable uploads, set this to
- 0K. This will result in the uploads link disappearing and the
- _upload url becoming inactive.
- '';
- };
-
- maxPageSize = mkOption {
- type = types.str;
- default = "1000K";
- description = lib.mdDoc "Specifies an upper limit on the size (in bytes) of pages.";
- };
-
- debugMode = mkOption {
- type = types.bool;
- default = false;
- description = lib.mdDoc "Causes debug information to be logged while gitit is running.";
- };
-
- compressResponses = mkOption {
- type = types.bool;
- default = true;
- description = lib.mdDoc "Specifies whether HTTP responses should be compressed.";
- };
-
- mimeTypesFile = mkOption {
- type = types.path;
- default = "/etc/mime/types.info";
- description = lib.mdDoc ''
- Specifies the path of a file containing mime type mappings. Each
- line of the file should contain two fields, separated by whitespace.
- The first field is the mime type, the second is a file extension.
- For example:
- ```
- video/x-ms-wmx wmx
- ```
- If the file is not found, some simple defaults will be used.
- '';
- };
-
- useReCaptcha = mkOption {
- type = types.bool;
- default = false;
- description = lib.mdDoc ''
- If true, causes gitit to use the reCAPTCHA service
- (http://recaptcha.net) to prevent bots from creating accounts.
- '';
- };
-
- reCaptchaPrivateKey = mkOption {
- type = with types; nullOr str;
- default = null;
- description = lib.mdDoc ''
- Specifies the private key for the reCAPTCHA service. To get
- these, you need to create an account at http://recaptcha.net.
- '';
- };
-
- reCaptchaPublicKey = mkOption {
- type = with types; nullOr str;
- default = null;
- description = lib.mdDoc ''
- Specifies the public key for the reCAPTCHA service. To get
- these, you need to create an account at http://recaptcha.net.
- '';
- };
-
- accessQuestion = mkOption {
- type = types.str;
- default = "What is the code given to you by Ms. X?";
- description = lib.mdDoc ''
- Specifies a question that users must answer when they attempt to
- create an account
- '';
- };
-
- accessQuestionAnswers = mkOption {
- type = types.str;
- default = "RED DOG, red dog";
- description = lib.mdDoc ''
- Specifies a question that users must answer when they attempt to
- create an account, along with a comma-separated list of acceptable
- answers. This can be used to institute a rudimentary password for
- signing up as a user on the wiki, or as an alternative to reCAPTCHA.
- Example:
- access-question: What is the code given to you by Ms. X?
- access-question-answers: RED DOG, red dog
- '';
- };
-
- rpxDomain = mkOption {
- type = with types; nullOr str;
- default = null;
- description = lib.mdDoc ''
- Specifies the domain and key of your RPX account. The domain is just
- the prefix of the complete RPX domain, so if your full domain is
- 'https://foo.rpxnow.com/', use 'foo' as the value of rpx-domain.
- '';
- };
-
- rpxKey = mkOption {
- type = with types; nullOr str;
- default = null;
- description = lib.mdDoc "RPX account access key.";
- };
-
- mailCommand = mkOption {
- type = types.str;
- default = "sendmail %s";
- description = lib.mdDoc ''
- Specifies the command to use to send notification emails. '%s' will
- be replaced by the destination email address. The body of the
- message will be read from stdin. If this field is left blank,
- password reset will not be offered.
- '';
- };
-
- resetPasswordMessage = mkOption {
- type = types.lines;
- default = ''
- > From: gitit@$hostname$
- > To: $useremail$
- > Subject: Wiki password reset
- >
- > Hello $username$,
- >
- > To reset your password, please follow the link below:
- > http://$hostname$:$port$$resetlink$
- >
- > Regards
- '';
- description = lib.mdDoc ''
- Gives the text of the message that will be sent to the user should
- she want to reset her password, or change other registration info.
- The lines must be indented, and must begin with '>'. The initial
- spaces and '> ' will be stripped off. $username$ will be replaced by
- the user's username, $useremail$ by her email address, $hostname$ by
- the hostname on which the wiki is running (as returned by the
- hostname system call), $port$ by the port on which the wiki is
- running, and $resetlink$ by the relative path of a reset link derived
- from the user's existing hashed password. If your gitit wiki is being
- proxied to a location other than the root path of $port$, you should
- change the link to reflect this: for example, to
- http://$hostname$/path/to/wiki$resetlink$ or
- http://gitit.$hostname$$resetlink$
- '';
- };
-
- useFeed = mkOption {
- type = types.bool;
- default = false;
- description = lib.mdDoc ''
- Specifies whether an ATOM feed should be enabled (for the site and
- for individual pages).
- '';
- };
-
- baseUrl = mkOption {
- type = with types; nullOr str;
- default = null;
- description = lib.mdDoc ''
- The base URL of the wiki, to be used in constructing feed IDs and RPX
- token_urls. Set this if useFeed is false or authentication-method
- is 'rpx'.
- '';
- };
-
- absoluteUrls = mkOption {
- type = types.bool;
- default = false;
- description = lib.mdDoc ''
- Make wikilinks absolute with respect to the base-url. So, for
- example, in a wiki served at the base URL '/wiki', on a page
- Sub/Page, the wikilink `[Cactus]()` will produce a link to
- '/wiki/Cactus' if absoluteUrls is true, and a relative link to
- 'Cactus' (referring to '/wiki/Sub/Cactus') if absolute-urls is 'no'.
- '';
- };
-
- feedDays = mkOption {
- type = types.int;
- default = 14;
- description = lib.mdDoc "Number of days to be included in feeds.";
- };
-
- feedRefreshTime = mkOption {
- type = types.int;
- default = 60;
- description = lib.mdDoc "Number of minutes to cache feeds before refreshing.";
- };
-
- pdfExport = mkOption {
- type = types.bool;
- default = false;
- description = lib.mdDoc ''
- If true, PDF will appear in export options. PDF will be created using
- pdflatex, which must be installed and in the path. Note that PDF
- exports create significant additional server load.
- '';
- };
-
- pandocUserData = mkOption {
- type = with types; nullOr path;
- default = null;
- description = lib.mdDoc ''
- If a directory is specified, this will be searched for pandoc
- customizations. These can include a templates/ directory for custom
- templates for various export formats, an S5 directory for custom S5
- styles, and a reference.odt for ODT exports. If no directory is
- specified, $HOME/.pandoc will be searched. See pandoc's README for
- more information.
- '';
- };
-
- xssSanitize = mkOption {
- type = types.bool;
- default = true;
- description = lib.mdDoc ''
- If true, all HTML (including that produced by pandoc) is filtered
- through xss-sanitize. Set to no only if you trust all of your users.
- '';
- };
-
- oauthClientId = mkOption {
- type = with types; nullOr str;
- default = null;
- description = lib.mdDoc "OAuth client ID";
- };
-
- oauthClientSecret = mkOption {
- type = with types; nullOr str;
- default = null;
- description = lib.mdDoc "OAuth client secret";
- };
-
- oauthCallback = mkOption {
- type = with types; nullOr str;
- default = null;
- description = lib.mdDoc "OAuth callback URL";
- };
-
- oauthAuthorizeEndpoint = mkOption {
- type = with types; nullOr str;
- default = null;
- description = lib.mdDoc "OAuth authorize endpoint";
- };
-
- oauthAccessTokenEndpoint = mkOption {
- type = with types; nullOr str;
- default = null;
- description = lib.mdDoc "OAuth access token endpoint";
- };
-
- githubOrg = mkOption {
- type = with types; nullOr str;
- default = null;
- description = lib.mdDoc "Github organization";
- };
- };
-
- configFile = pkgs.writeText "gitit.conf" ''
- address: ${cfg.address}
- port: ${toString cfg.port}
- wiki-title: ${cfg.wikiTitle}
- repository-type: ${cfg.repositoryType}
- repository-path: ${cfg.repositoryPath}
- require-authentication: ${cfg.requireAuthentication}
- authentication-method: ${cfg.authenticationMethod}
- user-file: ${cfg.userFile}
- session-timeout: ${toString cfg.sessionTimeout}
- static-dir: ${cfg.staticDir}
- default-page-type: ${cfg.defaultPageType}
- math: ${cfg.math}
- mathjax-script: ${cfg.mathJaxScript}
- show-lhs-bird-tracks: ${toYesNo cfg.showLhsBirdTracks}
- templates-dir: ${cfg.templatesDir}
- log-file: ${cfg.logFile}
- log-level: ${cfg.logLevel}
- front-page: ${cfg.frontPage}
- no-delete: ${cfg.noDelete}
- no-edit: ${cfg.noEdit}
- default-summary: ${cfg.defaultSummary}
- table-of-contents: ${toYesNo cfg.tableOfContents}
- plugins: ${concatStringsSep "," cfg.plugins}
- use-cache: ${toYesNo cfg.useCache}
- cache-dir: ${cfg.cacheDir}
- max-upload-size: ${cfg.maxUploadSize}
- max-page-size: ${cfg.maxPageSize}
- debug-mode: ${toYesNo cfg.debugMode}
- compress-responses: ${toYesNo cfg.compressResponses}
- mime-types-file: ${cfg.mimeTypesFile}
- use-recaptcha: ${toYesNo cfg.useReCaptcha}
- recaptcha-private-key: ${toString cfg.reCaptchaPrivateKey}
- recaptcha-public-key: ${toString cfg.reCaptchaPublicKey}
- access-question: ${cfg.accessQuestion}
- access-question-answers: ${cfg.accessQuestionAnswers}
- rpx-domain: ${toString cfg.rpxDomain}
- rpx-key: ${toString cfg.rpxKey}
- mail-command: ${cfg.mailCommand}
- reset-password-message: ${cfg.resetPasswordMessage}
- use-feed: ${toYesNo cfg.useFeed}
- base-url: ${toString cfg.baseUrl}
- absolute-urls: ${toYesNo cfg.absoluteUrls}
- feed-days: ${toString cfg.feedDays}
- feed-refresh-time: ${toString cfg.feedRefreshTime}
- pdf-export: ${toYesNo cfg.pdfExport}
- pandoc-user-data: ${toString cfg.pandocUserData}
- xss-sanitize: ${toYesNo cfg.xssSanitize}
-
- [Github]
- oauthclientid: ${toString cfg.oauthClientId}
- oauthclientsecret: ${toString cfg.oauthClientSecret}
- oauthcallback: ${toString cfg.oauthCallback}
- oauthauthorizeendpoint: ${toString cfg.oauthAuthorizeEndpoint}
- oauthaccesstokenendpoint: ${toString cfg.oauthAccessTokenEndpoint}
- github-org: ${toString cfg.githubOrg}
- '';
-
-in
-
-{
-
- options.services.gitit = gititOptions;
-
- config = mkIf cfg.enable {
-
- users.users.gitit = {
- group = config.users.groups.gitit.name;
- description = "Gitit user";
- home = homeDir;
- createHome = true;
- uid = config.ids.uids.gitit;
- };
-
- users.groups.gitit.gid = config.ids.gids.gitit;
-
- systemd.services.gitit = let
- uid = toString config.ids.uids.gitit;
- gid = toString config.ids.gids.gitit;
- in {
- description = "Git and Pandoc Powered Wiki";
- after = [ "network.target" ];
- wantedBy = [ "multi-user.target" ];
- path = with pkgs; [ curl ]
- ++ optional cfg.pdfExport texlive.combined.scheme-basic
- ++ optional (cfg.repositoryType == "darcs") darcs
- ++ optional (cfg.repositoryType == "mercurial") mercurial
- ++ optional (cfg.repositoryType == "git") git;
-
- preStart = let
- gm = "gitit@${config.networking.hostName}";
- in
- with cfg; ''
- chown ${uid}:${gid} -R ${homeDir}
- for dir in ${repositoryPath} ${staticDir} ${templatesDir} ${cacheDir}
- do
- if [ ! -d $dir ]
- then
- mkdir -p $dir
- find $dir -type d -exec chmod 0750 {} +
- find $dir -type f -exec chmod 0640 {} +
- fi
- done
- cd ${repositoryPath}
- ${
- if repositoryType == "darcs" then
- ''
- if [ ! -d _darcs ]
- then
- darcs initialize
- echo "${gm}" > _darcs/prefs/email
- ''
- else if repositoryType == "mercurial" then
- ''
- if [ ! -d .hg ]
- then
- hg init
- cat >> .hg/hgrc <` and set this option to `:$PROXY_PASSWORD@:`. Note however that this will also locally leak the passwords at runtime via e.g. /proc//cmdline.
+
+ :::
+ '';
+ type = types.nullOr types.str;
+ default = null;
+ };
+
+ soMark = mkOption {
+ description = mdDoc "Mark network packets with the SO_MARK sockoption with the specified value. Setting this option will also enable the required `CAP_NET_ADMIN` capability for the systemd service.";
+ type = types.nullOr types.int;
+ default = null;
+ };
+
+ upgradePathPrefix = mkOption {
+ description = mdDoc "Use a specific HTTP path prefix that will show up in the upgrade request to the `wstunnel` server. Useful when running `wstunnel` behind a reverse proxy.";
+ type = types.nullOr types.str;
+ default = null;
+ example = "wstunnel";
+ };
+
+ hostHeader = mkOption {
+ description = mdDoc "Use this as the HTTP host header instead of the real hostname. Useful for circumventing hostname-based firewalls.";
+ type = types.nullOr types.str;
+ default = null;
+ };
+
+ tlsSNI = mkOption {
+ description = mdDoc "Use this as the SNI while connecting via TLS. Useful for circumventing hostname-based firewalls.";
+ type = types.nullOr types.str;
+ default = null;
+ };
+
+ tlsVerifyCertificate = mkOption {
+ description = mdDoc "Whether to verify the TLS certificate of the server. It might be useful to set this to `false` when working with the `tlsSNI` option.";
+ type = types.bool;
+ default = true;
+ };
+
+ # The original argument name `websocketPingFrequency` is a misnomer, as the frequency is the inverse of the interval.
+ websocketPingInterval = mkOption {
+ description = mdDoc "Do a heartbeat ping every N seconds to keep up the websocket connection.";
+ type = types.nullOr types.ints.unsigned;
+ default = null;
+ };
+
+ upgradeCredentials = mkOption {
+ description = mdDoc ''
+ Use these credentials to authenticate during the HTTP upgrade request (Basic authorization type, `USER:[PASS]`).
+
+ ::: {.warning}
+ Passwords specified here will be world-readable in the Nix store! To pass a password to the service, point the `environmentFile` option to a file containing `HTTP_PASSWORD=` and set this option to `:$HTTP_PASSWORD`. Note however that this will also locally leak the passwords at runtime via e.g. /proc//cmdline.
+ :::
+ '';
+ type = types.nullOr types.str;
+ default = null;
+ };
+
+ customHeaders = mkOption {
+ description = mdDoc "Custom HTTP headers to send during the upgrade request.";
+ type = types.attrsOf types.str;
+ default = {};
+ example = {
+ "X-Some-Header" = "some-value";
+ };
+ };
+ };
+ };
+ generateServerUnit = name: serverCfg: {
+ name = "wstunnel-server-${name}";
+ value = {
+ description = "wstunnel server - ${name}";
+ requires = [ "network.target" "network-online.target" ];
+ after = [ "network.target" "network-online.target" ];
+ wantedBy = optional serverCfg.autoStart "multi-user.target";
+
+ serviceConfig = let
+ certConfig = config.security.acme.certs."${serverCfg.useACMEHost}";
+ in {
+ Type = "simple";
+ ExecStart = with serverCfg; let
+ resolvedTlsCertificate = if useACMEHost != null
+ then "${certConfig.directory}/fullchain.pem"
+ else tlsCertificate;
+ resolvedTlsKey = if useACMEHost != null
+ then "${certConfig.directory}/key.pem"
+ else tlsKey;
+ in ''
+ ${package}/bin/wstunnel \
+ --server \
+ ${optionalString (restrictTo != null) "--restrictTo=${utils.escapeSystemdExecArg (hostPortToString restrictTo)}"} \
+ ${optionalString (resolvedTlsCertificate != null) "--tlsCertificate=${utils.escapeSystemdExecArg resolvedTlsCertificate}"} \
+ ${optionalString (resolvedTlsKey != null) "--tlsKey=${utils.escapeSystemdExecArg resolvedTlsKey}"} \
+ ${optionalString verboseLogging "--verbose"} \
+ ${attrsToArgs extraArgs} \
+ ${utils.escapeSystemdExecArg "${if enableHTTPS then "wss" else "ws"}://${hostPortToString listen}"}
+ '';
+ EnvironmentFile = optional (serverCfg.environmentFile != null) serverCfg.environmentFile;
+ DynamicUser = true;
+ SupplementaryGroups = optional (serverCfg.useACMEHost != null) certConfig.group;
+ PrivateTmp = true;
+ AmbientCapabilities = optional (serverCfg.listen.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+ NoNewPrivileges = true;
+ RestrictNamespaces = "uts ipc pid user cgroup";
+ ProtectSystem = "strict";
+ ProtectHome = true;
+ ProtectKernelTunables = true;
+ ProtectKernelModules = true;
+ ProtectControlGroups = true;
+ PrivateDevices = true;
+ RestrictSUIDSGID = true;
+
+ };
+ };
+ };
+ generateClientUnit = name: clientCfg: {
+ name = "wstunnel-client-${name}";
+ value = {
+ description = "wstunnel client - ${name}";
+ requires = [ "network.target" "network-online.target" ];
+ after = [ "network.target" "network-online.target" ];
+ wantedBy = optional clientCfg.autoStart "multi-user.target";
+
+ serviceConfig = {
+ Type = "simple";
+ ExecStart = with clientCfg; ''
+ ${package}/bin/wstunnel \
+ ${concatStringsSep " " (builtins.map (x: "--localToRemote=${localRemoteToString x}") localToRemote)} \
+ ${concatStringsSep " " (mapAttrsToList (n: v: "--customHeaders=\"${n}: ${v}\"") customHeaders)} \
+ ${optionalString (dynamicToRemote != null) "--dynamicToRemote=${utils.escapeSystemdExecArg (hostPortToString dynamicToRemote)}"} \
+ ${optionalString udp "--udp"} \
+ ${optionalString (httpProxy != null) "--httpProxy=${httpProxy}"} \
+ ${optionalString (soMark != null) "--soMark=${toString soMark}"} \
+ ${optionalString (upgradePathPrefix != null) "--upgradePathPrefix=${upgradePathPrefix}"} \
+ ${optionalString (hostHeader != null) "--hostHeader=${hostHeader}"} \
+ ${optionalString (tlsSNI != null) "--tlsSNI=${tlsSNI}"} \
+ ${optionalString tlsVerifyCertificate "--tlsVerifyCertificate"} \
+ ${optionalString (websocketPingInterval != null) "--websocketPingFrequency=${toString websocketPingInterval}"} \
+ ${optionalString (upgradeCredentials != null) "--upgradeCredentials=${upgradeCredentials}"} \
+ --udpTimeoutSec=${toString udpTimeout} \
+ ${optionalString verboseLogging "--verbose"} \
+ ${attrsToArgs extraArgs} \
+ ${utils.escapeSystemdExecArg "${if enableHTTPS then "wss" else "ws"}://${hostPortToString connectTo}"}
+ '';
+ EnvironmentFile = optional (clientCfg.environmentFile != null) clientCfg.environmentFile;
+ DynamicUser = true;
+ PrivateTmp = true;
+ AmbientCapabilities = (optional (clientCfg.soMark != null) [ "CAP_NET_ADMIN" ]) ++ (optional ((clientCfg.dynamicToRemote.port or 1024) < 1024 || (any (x: x.local.port < 1024) clientCfg.localToRemote)) [ "CAP_NET_BIND_SERVICE" ]);
+ NoNewPrivileges = true;
+ RestrictNamespaces = "uts ipc pid user cgroup";
+ ProtectSystem = "strict";
+ ProtectHome = true;
+ ProtectKernelTunables = true;
+ ProtectKernelModules = true;
+ ProtectControlGroups = true;
+ PrivateDevices = true;
+ RestrictSUIDSGID = true;
+ };
+ };
+ };
+in {
+ options.services.wstunnel = {
+ enable = mkEnableOption (mdDoc "wstunnel");
+
+ servers = mkOption {
+ description = mdDoc "`wstunnel` servers to set up.";
+ type = types.attrsOf (types.submodule serverSubmodule);
+ default = {};
+ example = {
+ "wg-tunnel" = {
+ listen.port = 8080;
+ enableHTTPS = true;
+ tlsCertificate = "/var/lib/secrets/fullchain.pem";
+ tlsKey = "/var/lib/secrets/key.pem";
+ restrictTo = {
+ host = "127.0.0.1";
+ port = 51820;
+ };
+ };
+ };
+ };
+
+ clients = mkOption {
+ description = mdDoc "`wstunnel` clients to set up.";
+ type = types.attrsOf (types.submodule clientSubmodule);
+ default = {};
+ example = {
+ "wg-tunnel" = {
+ connectTo = {
+ host = "example.com";
+ port = 8080;
+ };
+ enableHTTPS = true;
+ localToRemote = {
+ local = {
+ host = "127.0.0.1";
+ port = 51820;
+ };
+ remote = {
+ host = "127.0.0.1";
+ port = 51820;
+ };
+ };
+ udp = true;
+ };
+ };
+ };
+ };
+
+ config = mkIf cfg.enable {
+ systemd.services = (mapAttrs' generateServerUnit (filterAttrs (n: v: v.enable) cfg.servers)) // (mapAttrs' generateClientUnit (filterAttrs (n: v: v.enable) cfg.clients));
+
+ assertions = (mapAttrsToList (name: serverCfg: {
+ assertion = !(serverCfg.useACMEHost != null && (serverCfg.tlsCertificate != null || serverCfg.tlsKey != null));
+ message = ''
+ Options services.wstunnel.servers."${name}".useACMEHost and services.wstunnel.servers."${name}".{tlsCertificate, tlsKey} are mutually exclusive.
+ '';
+ }) cfg.servers) ++
+ (mapAttrsToList (name: serverCfg: {
+ assertion = !((serverCfg.tlsCertificate != null || serverCfg.tlsKey != null) && !(serverCfg.tlsCertificate != null && serverCfg.tlsKey != null));
+ message = ''
+ services.wstunnel.servers."${name}".tlsCertificate and services.wstunnel.servers."${name}".tlsKey need to be set together.
+ '';
+ }) cfg.servers) ++
+ (mapAttrsToList (name: clientCfg: {
+ assertion = !(clientCfg.localToRemote == [] && clientCfg.dynamicToRemote == null);
+ message = ''
+ Either one of services.wstunnel.clients."${name}".localToRemote or services.wstunnel.clients."${name}".dynamicToRemote must be set.
+ '';
+ }) cfg.clients);
+ };
+
+ meta.maintainers = with maintainers; [ alyaeanyx ];
+}
diff --git a/third_party/nixpkgs/nixos/modules/services/video/v4l2-relayd.nix b/third_party/nixpkgs/nixos/modules/services/video/v4l2-relayd.nix
new file mode 100644
index 0000000000..2a9dbe0015
--- /dev/null
+++ b/third_party/nixpkgs/nixos/modules/services/video/v4l2-relayd.nix
@@ -0,0 +1,199 @@
+{ config, lib, pkgs, utils, ... }:
+let
+
+ inherit (lib) attrValues concatStringsSep filterAttrs length listToAttrs literalExpression
+ makeSearchPathOutput mkEnableOption mkIf mkOption nameValuePair optionals types;
+ inherit (utils) escapeSystemdPath;
+
+ cfg = config.services.v4l2-relayd;
+
+ kernelPackages = config.boot.kernelPackages;
+
+ gst = (with pkgs.gst_all_1; [
+ gst-plugins-bad
+ gst-plugins-base
+ gst-plugins-good
+ gstreamer.out
+ ]);
+
+ instanceOpts = { name, ... }: {
+ options = {
+ enable = mkEnableOption (lib.mdDoc "this v4l2-relayd instance");
+
+ name = mkOption {
+ type = types.str;
+ default = name;
+ description = lib.mdDoc ''
+ The name of the instance.
+ '';
+ };
+
+ cardLabel = mkOption {
+ type = types.str;
+ description = lib.mdDoc ''
+ The name the camera will show up as.
+ '';
+ };
+
+ extraPackages = mkOption {
+ type = with types; listOf package;
+ default = [ ];
+ description = lib.mdDoc ''
+ Extra packages to add to {env}`GST_PLUGIN_PATH` for the instance.
+ '';
+ };
+
+ input = {
+ pipeline = mkOption {
+ type = types.str;
+ description = lib.mdDoc ''
+ The gstreamer-pipeline to use for the input-stream.
+ '';
+ };
+
+ format = mkOption {
+ type = types.str;
+ default = "YUY2";
+ description = lib.mdDoc ''
+ The video-format to read from input-stream.
+ '';
+ };
+
+ width = mkOption {
+ type = types.ints.positive;
+ default = 1280;
+ description = lib.mdDoc ''
+ The width to read from input-stream.
+ '';
+ };
+
+ height = mkOption {
+ type = types.ints.positive;
+ default = 720;
+ description = lib.mdDoc ''
+ The height to read from input-stream.
+ '';
+ };
+
+ framerate = mkOption {
+ type = types.ints.positive;
+ default = 30;
+ description = lib.mdDoc ''
+ The framerate to read from input-stream.
+ '';
+ };
+ };
+
+ output = {
+ format = mkOption {
+ type = types.str;
+ default = "YUY2";
+ description = lib.mdDoc ''
+ The video-format to write to output-stream.
+ '';
+ };
+ };
+
+ };
+ };
+
+in
+{
+
+ options.services.v4l2-relayd = {
+
+ instances = mkOption {
+ type = with types; attrsOf (submodule instanceOpts);
+ default = { };
+ example = literalExpression ''
+ {
+ example = {
+ cardLabel = "Example card";
+ input.pipeline = "videotestsrc";
+ };
+ }
+ '';
+ description = lib.mdDoc ''
+ v4l2-relayd instances to be created.
+ '';
+ };
+
+ };
+
+ config =
+ let
+
+ mkInstanceService = instance: {
+ description = "Streaming relay for v4l2loopback using GStreamer";
+
+ after = [ "modprobe@v4l2loopback.service" "systemd-logind.service" ];
+ wantedBy = [ "multi-user.target" ];
+
+ serviceConfig = {
+ Type = "simple";
+ Restart = "always";
+ PrivateNetwork = true;
+ PrivateTmp = true;
+ LimitNPROC = 1;
+ };
+
+ environment = {
+ GST_PLUGIN_PATH = makeSearchPathOutput "lib" "lib/gstreamer-1.0" (gst ++ instance.extraPackages);
+ V4L2_DEVICE_FILE = "/run/v4l2-relayd-${instance.name}/device";
+ };
+
+ script =
+ let
+ appsrcOptions = concatStringsSep "," [
+ "caps=video/x-raw"
+ "format=${instance.input.format}"
+ "width=${toString instance.input.width}"
+ "height=${toString instance.input.height}"
+ "framerate=${toString instance.input.framerate}/1"
+ ];
+
+ outputPipeline = [
+ "appsrc name=appsrc ${appsrcOptions}"
+ "videoconvert"
+ ] ++ optionals (instance.input.format != instance.output.format) [
+ "video/x-raw,format=${instance.output.format}"
+ "queue"
+ ] ++ [ "v4l2sink name=v4l2sink device=$(cat $V4L2_DEVICE_FILE)" ];
+ in
+ ''
+ exec ${pkgs.v4l2-relayd}/bin/v4l2-relayd -i "${instance.input.pipeline}" -o "${concatStringsSep " ! " outputPipeline}"
+ '';
+
+ preStart = ''
+ mkdir -p $(dirname $V4L2_DEVICE_FILE)
+ ${kernelPackages.v4l2loopback.bin}/bin/v4l2loopback-ctl add -x 1 -n "${instance.cardLabel}" > $V4L2_DEVICE_FILE
+ '';
+
+ postStop = ''
+ ${kernelPackages.v4l2loopback.bin}/bin/v4l2loopback-ctl delete $(cat $V4L2_DEVICE_FILE)
+ rm -rf $(dirname $V4L2_DEVICE_FILE)
+ '';
+ };
+
+ mkInstanceServices = instances: listToAttrs (map
+ (instance:
+ nameValuePair "v4l2-relayd-${escapeSystemdPath instance.name}" (mkInstanceService instance)
+ )
+ instances);
+
+ enabledInstances = attrValues (filterAttrs (n: v: v.enable) cfg.instances);
+
+ in
+ {
+
+ boot = mkIf ((length enabledInstances) > 0) {
+ extraModulePackages = [ kernelPackages.v4l2loopback ];
+ kernelModules = [ "v4l2loopback" ];
+ };
+
+ systemd.services = mkInstanceServices enabledInstances;
+
+ };
+
+ meta.maintainers = with lib.maintainers; [ betaboon ];
+}
diff --git a/third_party/nixpkgs/nixos/modules/services/web-apps/chatgpt-retrieval-plugin.nix b/third_party/nixpkgs/nixos/modules/services/web-apps/chatgpt-retrieval-plugin.nix
new file mode 100644
index 0000000000..f29d095bc1
--- /dev/null
+++ b/third_party/nixpkgs/nixos/modules/services/web-apps/chatgpt-retrieval-plugin.nix
@@ -0,0 +1,106 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+ cfg = config.services.chatgpt-retrieval-plugin;
+in
+{
+ options.services.chatgpt-retrieval-plugin = {
+ enable = mkEnableOption (lib.mdDoc "chatgpt-retrieval-plugin service");
+
+ port = mkOption {
+ type = types.port;
+ default = 8080;
+ description = lib.mdDoc "Port the chatgpt-retrieval-plugin service listens on.";
+ };
+
+ host = mkOption {
+ type = types.str;
+ default = "127.0.0.1";
+ example = "0.0.0.0";
+ description = lib.mdDoc "The hostname or IP address for chatgpt-retrieval-plugin to bind to.";
+ };
+
+ bearerTokenPath = mkOption {
+ type = types.path;
+ description = lib.mdDoc ''
+ Path to the secret bearer token used for the http api authentication.
+ '';
+ default = "";
+ example = "config.age.secrets.CHATGPT_RETRIEVAL_PLUGIN_BEARER_TOKEN.path";
+ };
+
+ openaiApiKeyPath = mkOption {
+ type = types.path;
+ description = lib.mdDoc ''
+ Path to the secret openai api key used for embeddings.
+ '';
+ default = "";
+ example = "config.age.secrets.CHATGPT_RETRIEVAL_PLUGIN_OPENAI_API_KEY.path";
+ };
+
+ datastore = mkOption {
+ type = types.enum [ "pinecone" "weaviate" "zilliz" "milvus" "qdrant" "redis" ];
+ default = "qdrant";
+ description = lib.mdDoc "This specifies the vector database provider you want to use to store and query embeddings.";
+ };
+
+ qdrantCollection = mkOption {
+ type = types.str;
+ description = lib.mdDoc ''
+ name of the qdrant collection used to store documents.
+ '';
+ default = "document_chunks";
+ };
+ };
+
+ config = mkIf cfg.enable {
+
+ assertions = [
+ {
+ assertion = cfg.bearerTokenPath != "";
+ message = "services.chatgpt-retrieval-plugin.bearerTokenPath should not be an empty string.";
+ }
+ {
+ assertion = cfg.openaiApiKeyPath != "";
+ message = "services.chatgpt-retrieval-plugin.openaiApiKeyPath should not be an empty string.";
+ }
+ ];
+
+ systemd.services.chatgpt-retrieval-plugin = {
+ description = "ChatGPT Retrieval Plugin";
+ after = [ "network.target" ];
+ wantedBy = [ "multi-user.target" ];
+
+ serviceConfig = {
+ DynamicUser = true;
+ Restart = "always";
+ LoadCredential = [
+ "BEARER_TOKEN:${cfg.bearerTokenPath}"
+ "OPENAI_API_KEY:${cfg.openaiApiKeyPath}"
+ ];
+ StateDirectory = "chatgpt-retrieval-plugin";
+ StateDirectoryMode = "0755";
+ };
+
+ # it doesn't make sense to pass secrets as env vars, this is a hack until
+ # upstream has proper secret management.
+ script = ''
+ export BEARER_TOKEN=$(${pkgs.systemd}/bin/systemd-creds cat BEARER_TOKEN)
+ export OPENAI_API_KEY=$(${pkgs.systemd}/bin/systemd-creds cat OPENAI_API_KEY)
+ exec ${pkgs.chatgpt-retrieval-plugin}/bin/start --host ${cfg.host} --port ${toString cfg.port}
+ '';
+
+ environment = {
+ DATASTORE = cfg.datastore;
+ QDRANT_COLLECTION = mkIf (cfg.datastore == "qdrant") cfg.qdrantCollection;
+ };
+ };
+
+ systemd.tmpfiles.rules = [
+ # create the directory for static files for fastapi
+ "C /var/lib/chatgpt-retrieval-plugin/.well-known - - - - ${pkgs.chatgpt-retrieval-plugin}/${pkgs.python3Packages.python.sitePackages}/.well-known"
+ ];
+ };
+}
diff --git a/third_party/nixpkgs/nixos/modules/services/web-apps/cloudlog.nix b/third_party/nixpkgs/nixos/modules/services/web-apps/cloudlog.nix
index 9c6284fd1b..da2cf93d7f 100644
--- a/third_party/nixpkgs/nixos/modules/services/web-apps/cloudlog.nix
+++ b/third_party/nixpkgs/nixos/modules/services/web-apps/cloudlog.nix
@@ -36,7 +36,8 @@ let
);
'';
configFile = pkgs.writeText "config.php" ''
- ${strings.fileContents "${pkgs.cloudlog}/install/config/config.php"}
+ (cfg.user == cfg.database.user);
@@ -517,6 +591,12 @@ in {
environment.systemPackages = [ mastodonTootctl ];
+ systemd.targets.mastodon = {
+ description = "Target for all Mastodon services";
+ wantedBy = [ "multi-user.target" ];
+ after = [ "network.target" ];
+ };
+
systemd.services.mastodon-init-dirs = {
script = ''
umask 077
@@ -551,7 +631,7 @@ in {
environment = env;
serviceConfig = {
Type = "oneshot";
- WorkingDirectory = cfg.package;
+ SyslogIdentifier = "mastodon-init-dirs";
# System Call Filtering
SystemCallFilter = [ ("~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ])) "@chown" "pipe" "pipe2" ];
} // cfgService;
@@ -609,7 +689,7 @@ in {
requires = [ "mastodon-init-dirs.service" ]
++ lib.optional databaseActuallyCreateLocally "postgresql.service"
++ lib.optional cfg.automaticMigrations "mastodon-init-db.service";
- wantedBy = [ "multi-user.target" ];
+ wantedBy = [ "mastodon.target" ];
description = "Mastodon streaming";
environment = env // (if cfg.enableUnixSocket
then { SOCKET = "/run/mastodon-streaming/streaming.socket"; }
@@ -636,7 +716,7 @@ in {
requires = [ "mastodon-init-dirs.service" ]
++ lib.optional databaseActuallyCreateLocally "postgresql.service"
++ lib.optional cfg.automaticMigrations "mastodon-init-db.service";
- wantedBy = [ "multi-user.target" ];
+ wantedBy = [ "mastodon.target" ];
description = "Mastodon web";
environment = env // (if cfg.enableUnixSocket
then { SOCKET = "/run/mastodon-web/web.socket"; }
@@ -657,31 +737,6 @@ in {
path = with pkgs; [ file imagemagick ffmpeg ];
};
- systemd.services.mastodon-sidekiq = {
- after = [ "network.target" "mastodon-init-dirs.service" ]
- ++ lib.optional databaseActuallyCreateLocally "postgresql.service"
- ++ lib.optional cfg.automaticMigrations "mastodon-init-db.service";
- requires = [ "mastodon-init-dirs.service" ]
- ++ lib.optional databaseActuallyCreateLocally "postgresql.service"
- ++ lib.optional cfg.automaticMigrations "mastodon-init-db.service";
- wantedBy = [ "multi-user.target" ];
- description = "Mastodon sidekiq";
- environment = env // {
- PORT = toString(cfg.sidekiqPort);
- DB_POOL = toString cfg.sidekiqThreads;
- };
- serviceConfig = {
- ExecStart = "${cfg.package}/bin/sidekiq -c ${toString cfg.sidekiqThreads} -r ${cfg.package}";
- Restart = "always";
- RestartSec = 20;
- EnvironmentFile = [ "/var/lib/mastodon/.secrets_env" ] ++ cfg.extraEnvFiles;
- WorkingDirectory = cfg.package;
- # System Call Filtering
- SystemCallFilter = [ ("~" + lib.concatStringsSep " " systemCallsList) "@chown" "pipe" "pipe2" ];
- } // cfgService;
- path = with pkgs; [ file imagemagick ffmpeg ];
- };
-
systemd.services.mastodon-media-auto-remove = lib.mkIf cfg.mediaAutoRemove.enable {
description = "Mastodon media auto remove";
environment = env;
@@ -757,7 +812,9 @@ in {
];
users.groups.${cfg.group}.members = lib.optional cfg.configureNginx config.services.nginx.user;
- };
+ }
+ { systemd.services = sidekiqUnits; }
+ ]);
meta.maintainers = with lib.maintainers; [ happy-river erictapen ];
diff --git a/third_party/nixpkgs/nixos/modules/services/web-apps/mediawiki.nix b/third_party/nixpkgs/nixos/modules/services/web-apps/mediawiki.nix
index 07f2967486..357c2d4a12 100644
--- a/third_party/nixpkgs/nixos/modules/services/web-apps/mediawiki.nix
+++ b/third_party/nixpkgs/nixos/modules/services/web-apps/mediawiki.nix
@@ -46,6 +46,15 @@ let
done
'';
+ dbAddr = if cfg.database.socket == null then
+ "${cfg.database.host}:${toString cfg.database.port}"
+ else if cfg.database.type == "mysql" then
+ "${cfg.database.host}:${cfg.database.socket}"
+ else if cfg.database.type == "postgres" then
+ "${cfg.database.socket}"
+ else
+ throw "Unsupported database type: ${cfg.database.type} for socket: ${cfg.database.socket}";
+
mediawikiConfig = pkgs.writeText "LocalSettings.php" ''
cfg.database.type == "mysql";
- message = "services.mediawiki.createLocally is currently only supported for database type 'mysql'";
+ { assertion = cfg.database.createLocally -> (cfg.database.type == "mysql" || cfg.database.type == "postgres");
+ message = "services.mediawiki.createLocally is currently only supported for database type 'mysql' and 'postgres'";
}
{ assertion = cfg.database.createLocally -> cfg.database.user == user;
message = "services.mediawiki.database.user must be set to ${user} if services.mediawiki.database.createLocally is set true";
@@ -374,15 +390,23 @@ in
Vector = "${cfg.package}/share/mediawiki/skins/Vector";
};
- services.mysql = mkIf cfg.database.createLocally {
+ services.mysql = mkIf (cfg.database.type == "mysql" && cfg.database.createLocally) {
enable = true;
package = mkDefault pkgs.mariadb;
ensureDatabases = [ cfg.database.name ];
- ensureUsers = [
- { name = cfg.database.user;
- ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
- }
- ];
+ ensureUsers = [{
+ name = cfg.database.user;
+ ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
+ }];
+ };
+
+ services.postgresql = mkIf (cfg.database.type == "postgres" && cfg.database.createLocally) {
+ enable = true;
+ ensureDatabases = [ cfg.database.name ];
+ ensureUsers = [{
+ name = cfg.database.user;
+ ensurePermissions = { "DATABASE \"${cfg.database.name}\"" = "ALL PRIVILEGES"; };
+ }];
};
services.phpfpm.pools.mediawiki = {
@@ -431,7 +455,8 @@ in
systemd.services.mediawiki-init = {
wantedBy = [ "multi-user.target" ];
before = [ "phpfpm-mediawiki.service" ];
- after = optional cfg.database.createLocally "mysql.service";
+ after = optional (cfg.database.type == "mysql" && cfg.database.createLocally) "mysql.service"
+ ++ optional (cfg.database.type == "postgres" && cfg.database.createLocally) "postgresql.service";
script = ''
if ! test -e "${stateDir}/secret.key"; then
tr -dc A-Za-z0-9 /dev/null | head -c 64 > ${stateDir}/secret.key
@@ -442,7 +467,7 @@ in
${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/install.php \
--confpath /tmp \
--scriptpath / \
- --dbserver ${cfg.database.host}${optionalString (cfg.database.socket != null) ":${cfg.database.socket}"} \
+ --dbserver "${dbAddr}" \
--dbport ${toString cfg.database.port} \
--dbname ${cfg.database.name} \
${optionalString (cfg.database.tablePrefix != null) "--dbprefix ${cfg.database.tablePrefix}"} \
@@ -464,7 +489,8 @@ in
};
};
- systemd.services.httpd.after = optional (cfg.database.createLocally && cfg.database.type == "mysql") "mysql.service";
+ systemd.services.httpd.after = optional (cfg.database.createLocally && cfg.database.type == "mysql") "mysql.service"
+ ++ optional (cfg.database.createLocally && cfg.database.type == "postgres") "postgresql.service";
users.users.${user} = {
group = group;
diff --git a/third_party/nixpkgs/nixos/modules/services/web-apps/netbox.nix b/third_party/nixpkgs/nixos/modules/services/web-apps/netbox.nix
index e028f16004..0ecb20e8c2 100644
--- a/third_party/nixpkgs/nixos/modules/services/web-apps/netbox.nix
+++ b/third_party/nixpkgs/nixos/modules/services/web-apps/netbox.nix
@@ -4,45 +4,17 @@ with lib;
let
cfg = config.services.netbox;
+ pythonFmt = pkgs.formats.pythonVars {};
staticDir = cfg.dataDir + "/static";
- configFile = pkgs.writeTextFile {
- name = "configuration.py";
- text = ''
- STATIC_ROOT = '${staticDir}'
- MEDIA_ROOT = '${cfg.dataDir}/media'
- REPORTS_ROOT = '${cfg.dataDir}/reports'
- SCRIPTS_ROOT = '${cfg.dataDir}/scripts'
- ALLOWED_HOSTS = ['*']
- DATABASE = {
- 'NAME': 'netbox',
- 'USER': 'netbox',
- 'HOST': '/run/postgresql',
- }
-
- # Redis database settings. Redis is used for caching and for queuing background tasks such as webhook events. A separate
- # configuration exists for each. Full connection details are required in both sections, and it is strongly recommended
- # to use two separate database IDs.
- REDIS = {
- 'tasks': {
- 'URL': 'unix://${config.services.redis.servers.netbox.unixSocket}?db=0',
- 'SSL': False,
- },
- 'caching': {
- 'URL': 'unix://${config.services.redis.servers.netbox.unixSocket}?db=1',
- 'SSL': False,
- }
- }
-
- with open("${cfg.secretKeyFile}", "r") as file:
- SECRET_KEY = file.readline()
-
- ${optionalString cfg.enableLdap "REMOTE_AUTH_BACKEND = 'netbox.authentication.LDAPBackend'"}
-
- ${cfg.extraConfig}
- '';
+ settingsFile = pythonFmt.generate "netbox-settings.py" cfg.settings;
+ extraConfigFile = pkgs.writeTextFile {
+ name = "netbox-extraConfig.py";
+ text = cfg.extraConfig;
};
- pkg = (pkgs.netbox.overrideAttrs (old: {
+ configFile = pkgs.concatText "configuration.py" [ settingsFile extraConfigFile ];
+
+ pkg = (cfg.package.overrideAttrs (old: {
installPhase = old.installPhase + ''
ln -s ${configFile} $out/opt/netbox/netbox/netbox/configuration.py
'' + optionalString cfg.enableLdap ''
@@ -70,6 +42,30 @@ in {
'';
};
+ settings = lib.mkOption {
+ description = lib.mdDoc ''
+ Configuration options to set in `configuration.py`.
+ See the [documentation](https://docs.netbox.dev/en/stable/configuration/) for more possible options.
+ '';
+
+ default = { };
+
+ type = lib.types.submodule {
+ freeformType = pythonFmt.type;
+
+ options = {
+ ALLOWED_HOSTS = lib.mkOption {
+ type = with lib.types; listOf str;
+ default = ["*"];
+ description = lib.mdDoc ''
+ A list of valid fully-qualified domain names (FQDNs) and/or IP
+ addresses that can be used to reach the NetBox service.
+ '';
+ };
+ };
+ };
+ };
+
listenAddress = mkOption {
type = types.str;
default = "[::1]";
@@ -78,6 +74,17 @@ in {
'';
};
+ package = mkOption {
+ type = types.package;
+ default = if versionAtLeast config.system.stateVersion "23.05" then pkgs.netbox else pkgs.netbox_3_3;
+ defaultText = literalExpression ''
+ if versionAtLeast config.system.stateVersion "23.05" then pkgs.netbox else pkgs.netbox_3_3;
+ '';
+ description = lib.mdDoc ''
+ NetBox package to use.
+ '';
+ };
+
port = mkOption {
type = types.port;
default = 8001;
@@ -117,7 +124,7 @@ in {
default = "";
description = lib.mdDoc ''
Additional lines of configuration appended to the `configuration.py`.
- See the [documentation](https://netbox.readthedocs.io/en/stable/configuration/optional-settings/) for more possible options.
+ See the [documentation](https://docs.netbox.dev/en/stable/configuration/) for more possible options.
'';
};
@@ -138,11 +145,90 @@ in {
Path to the Configuration-File for LDAP-Authentication, will be loaded as `ldap_config.py`.
See the [documentation](https://netbox.readthedocs.io/en/stable/installation/6-ldap/#configuration) for possible options.
'';
+ example = ''
+ import ldap
+ from django_auth_ldap.config import LDAPSearch, PosixGroupType
+
+ AUTH_LDAP_SERVER_URI = "ldaps://ldap.example.com/"
+
+ AUTH_LDAP_USER_SEARCH = LDAPSearch(
+ "ou=accounts,ou=posix,dc=example,dc=com",
+ ldap.SCOPE_SUBTREE,
+ "(uid=%(user)s)",
+ )
+
+ AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
+ "ou=groups,ou=posix,dc=example,dc=com",
+ ldap.SCOPE_SUBTREE,
+ "(objectClass=posixGroup)",
+ )
+ AUTH_LDAP_GROUP_TYPE = PosixGroupType()
+
+ # Mirror LDAP group assignments.
+ AUTH_LDAP_MIRROR_GROUPS = True
+
+ # For more granular permissions, we can map LDAP groups to Django groups.
+ AUTH_LDAP_FIND_GROUP_PERMS = True
+ '';
};
};
config = mkIf cfg.enable {
- services.netbox.plugins = mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
+ services.netbox = {
+ plugins = mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
+ settings = {
+ STATIC_ROOT = staticDir;
+ MEDIA_ROOT = "${cfg.dataDir}/media";
+ REPORTS_ROOT = "${cfg.dataDir}/reports";
+ SCRIPTS_ROOT = "${cfg.dataDir}/scripts";
+
+ DATABASE = {
+ NAME = "netbox";
+ USER = "netbox";
+ HOST = "/run/postgresql";
+ };
+
+ # Redis database settings. Redis is used for caching and for queuing
+ # background tasks such as webhook events. A separate configuration
+ # exists for each. Full connection details are required in both
+ # sections, and it is strongly recommended to use two separate database
+ # IDs.
+ REDIS = {
+ tasks = {
+ URL = "unix://${config.services.redis.servers.netbox.unixSocket}?db=0";
+ SSL = false;
+ };
+ caching = {
+ URL = "unix://${config.services.redis.servers.netbox.unixSocket}?db=1";
+ SSL = false;
+ };
+ };
+
+ REMOTE_AUTH_BACKEND = lib.mkIf cfg.enableLdap "netbox.authentication.LDAPBackend";
+
+ LOGGING = lib.mkDefault {
+ version = 1;
+
+ formatters.precise.format = "[%(levelname)s@%(name)s] %(message)s";
+
+ handlers.console = {
+ class = "logging.StreamHandler";
+ formatter = "precise";
+ };
+
+ # log to console/systemd instead of file
+ root = {
+ level = "INFO";
+ handlers = [ "console" ];
+ };
+ };
+ };
+
+ extraConfig = ''
+ with open("${cfg.secretKeyFile}", "r") as file:
+ SECRET_KEY = file.readline()
+ '';
+ };
services.redis.servers.netbox.enable = true;
diff --git a/third_party/nixpkgs/nixos/modules/services/web-servers/garage.nix b/third_party/nixpkgs/nixos/modules/services/web-servers/garage.nix
index df8ed96f8d..ebd4147393 100644
--- a/third_party/nixpkgs/nixos/modules/services/web-servers/garage.nix
+++ b/third_party/nixpkgs/nixos/modules/services/web-servers/garage.nix
@@ -51,11 +51,11 @@ in
default = "none";
type = types.enum ([ "none" "1" "2" "3" 1 2 3 ]);
apply = v: toString v;
- description = lib.mdDoc "Garage replication mode, defaults to none, see: for reference.";
+ description = lib.mdDoc "Garage replication mode, defaults to none, see: for reference.";
};
};
};
- description = lib.mdDoc "Garage configuration, see for reference.";
+ description = lib.mdDoc "Garage configuration, see for reference.";
};
package = mkOption {
diff --git a/third_party/nixpkgs/nixos/modules/services/web-servers/nginx/default.nix b/third_party/nixpkgs/nixos/modules/services/web-servers/nginx/default.nix
index 064c86a9a7..3d19186e1a 100644
--- a/third_party/nixpkgs/nixos/modules/services/web-servers/nginx/default.nix
+++ b/third_party/nixpkgs/nixos/modules/services/web-servers/nginx/default.nix
@@ -31,6 +31,7 @@ let
# Mime.types values are taken from brotli sample configuration - https://github.com/google/ngx_brotli
# and Nginx Server Configs - https://github.com/h5bp/server-configs-nginx
+ # "text/html" is implicitly included in {brotli,gzip,zstd}_types
compressMimeTypes = [
"application/atom+xml"
"application/geo+json"
@@ -55,7 +56,6 @@ let
"text/calendar"
"text/css"
"text/csv"
- "text/html"
"text/javascript"
"text/markdown"
"text/plain"
@@ -102,6 +102,17 @@ let
proxy_set_header X-Forwarded-Server $host;
'';
+ proxyCachePathConfig = concatStringsSep "\n" (mapAttrsToList (name: proxyCachePath: ''
+ proxy_cache_path ${concatStringsSep " " [
+ "/var/cache/nginx/${name}"
+ "keys_zone=${proxyCachePath.keysZoneName}:${proxyCachePath.keysZoneSize}"
+ "levels=${proxyCachePath.levels}"
+ "use_temp_path=${if proxyCachePath.useTempPath then "on" else "off"}"
+ "inactive=${proxyCachePath.inactive}"
+ "max_size=${proxyCachePath.maxSize}"
+ ]};
+ '') (filterAttrs (name: conf: conf.enable) cfg.proxyCachePath));
+
upstreamConfig = toString (flip mapAttrsToList cfg.upstreams (name: upstream: ''
upstream ${name} {
${toString (flip mapAttrsToList upstream.servers (name: server: ''
@@ -184,8 +195,9 @@ let
brotli_types ${lib.concatStringsSep " " compressMimeTypes};
''}
- ${optionalString cfg.recommendedGzipSettings ''
+ ${optionalString cfg.recommendedGzipSettings
# https://docs.nginx.com/nginx/admin-guide/web-server/compression/
+ ''
gzip on;
gzip_static on;
gzip_vary on;
@@ -240,16 +252,10 @@ let
server_tokens ${if cfg.serverTokens then "on" else "off"};
- ${optionalString cfg.proxyCache.enable ''
- proxy_cache_path /var/cache/nginx keys_zone=${cfg.proxyCache.keysZoneName}:${cfg.proxyCache.keysZoneSize}
- levels=${cfg.proxyCache.levels}
- use_temp_path=${if cfg.proxyCache.useTempPath then "on" else "off"}
- inactive=${cfg.proxyCache.inactive}
- max_size=${cfg.proxyCache.maxSize};
- ''}
-
${cfg.commonHttpConfig}
+ ${proxyCachePathConfig}
+
${vhosts}
${optionalString cfg.statusPage ''
@@ -311,12 +317,15 @@ let
else defaultListen;
listenString = { addr, port, ssl, extraParameters ? [], ... }:
- (if ssl && vhost.http3 then "
- # UDP listener for **QUIC+HTTP/3
- listen ${addr}:${toString port} http3 "
+ # UDP listener for QUIC transport protocol.
+ (if ssl && vhost.quic then "
+ listen ${addr}:${toString port} quic "
+ optionalString vhost.default "default_server "
+ optionalString vhost.reuseport "reuseport "
- + optionalString (extraParameters != []) (concatStringsSep " " extraParameters)
+ + optionalString (extraParameters != []) (concatStringsSep " " (
+ let inCompatibleParameters = [ "ssl" "proxy_protocol" "http2" ];
+ isCompatibleParameter = param: !(any (p: p == param) inCompatibleParameters);
+ in filter isCompatibleParameter extraParameters))
+ ";" else "")
+ "
@@ -363,6 +372,10 @@ let
server {
${concatMapStringsSep "\n" listenString hostListen}
server_name ${vhost.serverName} ${concatStringsSep " " vhost.serverAliases};
+ ${optionalString (hasSSL && vhost.quic) ''
+ http3 ${if vhost.http3 then "on" else "off"};
+ http3_hq ${if vhost.http3_hq then "on" else "off"};
+ ''}
${acmeLocation}
${optionalString (vhost.root != null) "root ${vhost.root};"}
${optionalString (vhost.globalRedirect != null) ''
@@ -384,9 +397,10 @@ let
ssl_conf_command Options KTLS;
''}
- ${optionalString (hasSSL && vhost.http3) ''
+ ${optionalString (hasSSL && vhost.quic && vhost.http3)
# Advertise that HTTP/3 is available
- add_header Alt-Svc 'h3=":443"; ma=86400' always;
+ ''
+ add_header Alt-Svc 'h3=":$server_port"; ma=86400';
''}
${mkBasicAuth vhostName vhost}
@@ -476,7 +490,8 @@ in
default = false;
type = types.bool;
description = lib.mdDoc ''
- Enable recommended brotli settings. Learn more about compression in Brotli format [here](https://github.com/google/ngx_brotli/blob/master/README.md).
+ Enable recommended brotli settings.
+ Learn more about compression in Brotli format [here](https://github.com/google/ngx_brotli/).
This adds `pkgs.nginxModules.brotli` to `services.nginx.additionalModules`.
'';
@@ -487,6 +502,18 @@ in
type = types.bool;
description = lib.mdDoc ''
Enable recommended gzip settings.
+ Learn more about compression in Gzip format [here](https://docs.nginx.com/nginx/admin-guide/web-server/compression/).
+ '';
+ };
+
+ recommendedZstdSettings = mkOption {
+ default = false;
+ type = types.bool;
+ description = lib.mdDoc ''
+ Enable recommended zstd settings.
+ Learn more about compression in Zstd format [here](https://github.com/tokers/zstd-nginx-module).
+
+ This adds `pkgs.nginxModules.zstd` to `services.nginx.additionalModules`.
'';
};
@@ -498,16 +525,6 @@ in
'';
};
- recommendedZstdSettings = mkOption {
- default = false;
- type = types.bool;
- description = lib.mdDoc ''
- Enable recommended zstd settings. Learn more about compression in Zstd format [here](https://github.com/tokers/zstd-nginx-module).
-
- This adds `pkgs.nginxModules.zstd` to `services.nginx.additionalModules`.
- '';
- };
-
proxyTimeout = mkOption {
type = types.str;
default = "60s";
@@ -796,10 +813,10 @@ in
'';
};
- proxyCache = mkOption {
- type = types.submodule {
+ proxyCachePath = mkOption {
+ type = types.attrsOf (types.submodule ({ ... }: {
options = {
- enable = mkEnableOption (lib.mdDoc "Enable proxy cache");
+ enable = mkEnableOption (lib.mdDoc "this proxy cache path entry");
keysZoneName = mkOption {
type = types.str;
@@ -857,9 +874,12 @@ in
description = lib.mdDoc "Set maximum cache size";
};
};
- };
+ }));
default = {};
- description = lib.mdDoc "Configure proxy cache";
+ description = lib.mdDoc ''
+ Configure a proxy cache path entry.
+ See for documentation.
+ '';
};
resolver = mkOption {
@@ -970,6 +990,12 @@ in
The Nginx log directory has been moved to /var/log/nginx, the cache directory
to /var/cache/nginx. The option services.nginx.stateDir has been removed.
'')
+ (mkRenamedOptionModule [ "services" "nginx" "proxyCache" "inactive" ] [ "services" "nginx" "proxyCachePath" "" "inactive" ])
+ (mkRenamedOptionModule [ "services" "nginx" "proxyCache" "useTempPath" ] [ "services" "nginx" "proxyCachePath" "" "useTempPath" ])
+ (mkRenamedOptionModule [ "services" "nginx" "proxyCache" "levels" ] [ "services" "nginx" "proxyCachePath" "" "levels" ])
+ (mkRenamedOptionModule [ "services" "nginx" "proxyCache" "keysZoneSize" ] [ "services" "nginx" "proxyCachePath" "" "keysZoneSize" ])
+ (mkRenamedOptionModule [ "services" "nginx" "proxyCache" "keysZoneName" ] [ "services" "nginx" "proxyCachePath" "" "keysZoneName" ])
+ (mkRenamedOptionModule [ "services" "nginx" "proxyCache" "enable" ] [ "services" "nginx" "proxyCachePath" "" "enable" ])
];
config = mkIf cfg.enable {
@@ -1027,6 +1053,14 @@ in
services.nginx.virtualHosts..useACMEHost are mutually exclusive.
'';
}
+
+ {
+ assertion = cfg.package.pname != "nginxQuic" -> all (host: !host.quic) (attrValues virtualHosts);
+ message = ''
+ services.nginx.service.virtualHosts..quic requires using nginxQuic package,
+ which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;`.
+ '';
+ }
] ++ map (name: mkCertOwnershipAssertion {
inherit (cfg) group user;
cert = config.security.acme.certs.${name};
diff --git a/third_party/nixpkgs/nixos/modules/services/web-servers/nginx/vhost-options.nix b/third_party/nixpkgs/nixos/modules/services/web-servers/nginx/vhost-options.nix
index 089decb5f4..5b33694cf2 100644
--- a/third_party/nixpkgs/nixos/modules/services/web-servers/nginx/vhost-options.nix
+++ b/third_party/nixpkgs/nixos/modules/services/web-servers/nginx/vhost-options.nix
@@ -188,24 +188,54 @@ with lib;
type = types.bool;
default = true;
description = lib.mdDoc ''
- Whether to enable HTTP 2.
+ Whether to enable the HTTP/2 protocol.
Note that (as of writing) due to nginx's implementation, to disable
- HTTP 2 you have to disable it on all vhosts that use a given
+ HTTP/2 you have to disable it on all vhosts that use a given
IP address / port.
- If there is one server block configured to enable http2,then it is
+ If there is one server block configured to enable http2, then it is
enabled for all server blocks on this IP.
See https://stackoverflow.com/a/39466948/263061.
'';
};
http3 = mkOption {
+ type = types.bool;
+ default = true;
+ description = lib.mdDoc ''
+ Whether to enable the HTTP/3 protocol.
+ This requires using `pkgs.nginxQuic` package
+ which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;`
+ and activate the QUIC transport protocol
+ `services.nginx.virtualHosts..quic = true;`.
+ Note that HTTP/3 support is experimental and
+ *not* yet recommended for production.
+ Read more at https://quic.nginx.org/
+ '';
+ };
+
+ http3_hq = mkOption {
type = types.bool;
default = false;
description = lib.mdDoc ''
- Whether to enable HTTP 3.
+ Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests.
+ This requires using `pkgs.nginxQuic` package
+ which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;`
+ and activate the QUIC transport protocol
+ `services.nginx.virtualHosts..quic = true;`.
+ Note that special application protocol support is experimental and
+ *not* yet recommended for production.
+ Read more at https://quic.nginx.org/
+ '';
+ };
+
+ quic = mkOption {
+ type = types.bool;
+ default = false;
+ description = lib.mdDoc ''
+ Whether to enable the QUIC transport protocol.
This requires using `pkgs.nginxQuic` package
which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;`.
- Note that HTTP 3 support is experimental and
+ Note that QUIC support is experimental and
*not* yet recommended for production.
Read more at https://quic.nginx.org/
'';
diff --git a/third_party/nixpkgs/nixos/modules/services/x11/desktop-managers/budgie.nix b/third_party/nixpkgs/nixos/modules/services/x11/desktop-managers/budgie.nix
new file mode 100644
index 0000000000..6e6d5ef3fa
--- /dev/null
+++ b/third_party/nixpkgs/nixos/modules/services/x11/desktop-managers/budgie.nix
@@ -0,0 +1,201 @@
+{ lib, pkgs, config, utils, ... }:
+
+let
+ inherit (lib) concatMapStrings literalExpression mdDoc mkDefault mkEnableOption mkIf mkOption types;
+
+ cfg = config.services.xserver.desktopManager.budgie;
+
+ nixos-background-light = pkgs.nixos-artwork.wallpapers.nineish;
+ nixos-background-dark = pkgs.nixos-artwork.wallpapers.nineish-dark-gray;
+
+ nixos-gsettings-overrides = pkgs.budgie.budgie-gsettings-overrides.override {
+ inherit (cfg) extraGSettingsOverrides extraGSettingsOverridePackages;
+ inherit nixos-background-dark nixos-background-light;
+ };
+in {
+ options = {
+ services.xserver.desktopManager.budgie = {
+ enable = mkEnableOption (mdDoc "Budgie desktop");
+
+ sessionPath = mkOption {
+ description = mdDoc "Additional list of packages to be added to the session search path. Useful for GSettings-conditional autostart.";
+ type = with types; listOf package;
+ example = literalExpression "[ pkgs.budgie.budgie-desktop-view ]";
+ default = [];
+ };
+
+ extraGSettingsOverrides = mkOption {
+ description = mdDoc "Additional GSettings overrides.";
+ type = types.lines;
+ default = "";
+ };
+
+ extraGSettingsOverridePackages = mkOption {
+ description = mdDoc "List of packages for which GSettings are overridden.";
+ type = with types; listOf path;
+ default = [];
+ };
+ };
+
+ environment.budgie.excludePackages = mkOption {
+ description = mdDoc "Which packages Budgie should exclude from the default environment.";
+ type = with types; listOf package;
+ default = [];
+ example = literalExpression "[ pkgs.mate-terminal ]";
+ };
+ };
+
+ config = mkIf cfg.enable {
+ services.xserver.displayManager.sessionPackages = with pkgs; [
+ budgie.budgie-desktop
+ ];
+
+ services.xserver.displayManager.lightdm.greeters.slick = {
+ enable = mkDefault true;
+ theme = mkDefault { name = "Qogir"; package = pkgs.qogir-theme; };
+ iconTheme = mkDefault { name = "Qogir"; package = pkgs.qogir-icon-theme; };
+ cursorTheme = mkDefault { name = "Qogir"; package = pkgs.qogir-icon-theme; };
+ };
+
+ services.xserver.desktopManager.budgie.sessionPath = [ pkgs.budgie.budgie-desktop-view ];
+
+ environment.extraInit = ''
+ ${concatMapStrings (p: ''
+ if [ -d "${p}/share/gsettings-schemas/${p.name}" ]; then
+ export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${p}/share/gsettings-schemas/${p.name}
+ fi
+ if [ -d "${p}/lib/girepository-1.0" ]; then
+ export GI_TYPELIB_PATH=$GI_TYPELIB_PATH''${GI_TYPELIB_PATH:+:}${p}/lib/girepository-1.0
+ export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${p}/lib
+ fi
+ '') cfg.sessionPath}
+ '';
+
+ environment.systemPackages = with pkgs;
+ [
+ # Budgie Desktop.
+ budgie.budgie-backgrounds
+ budgie.budgie-control-center
+ budgie.budgie-desktop
+ budgie.budgie-desktop-view
+ budgie.budgie-screensaver
+
+ # Required by the Budgie Desktop session.
+ (gnome.gnome-session.override {gnomeShellSupport = false;})
+
+ # Required by Budgie Menu.
+ gnome-menus
+
+ # Provides `gsettings`.
+ glib
+
+ # Update user directories.
+ xdg-user-dirs
+ ]
+ ++ (utils.removePackagesByName [
+ cinnamon.nemo
+ mate.eom
+ mate.pluma
+ mate.atril
+ mate.engrampa
+ mate.mate-calc
+ mate.mate-terminal
+ mate.mate-system-monitor
+ vlc
+
+ # Desktop themes.
+ qogir-theme
+ qogir-icon-theme
+
+ # Default settings.
+ nixos-gsettings-overrides
+ ] config.environment.budgie.excludePackages)
+ ++ cfg.sessionPath;
+
+ # Fonts.
+ fonts.fonts = mkDefault [
+ pkgs.noto-fonts
+ pkgs.hack-font
+ ];
+ fonts.fontconfig.defaultFonts = {
+ sansSerif = mkDefault ["Noto Sans"];
+ monospace = mkDefault ["Hack"];
+ };
+
+ # Qt application style.
+ qt = {
+ enable = mkDefault true;
+ style = mkDefault "gtk2";
+ platformTheme = mkDefault "gtk2";
+ };
+
+ environment.pathsToLink = [
+ "/share" # TODO: https://github.com/NixOS/nixpkgs/issues/47173
+ ];
+
+ # GSettings overrides.
+ environment.sessionVariables.NIX_GSETTINGS_OVERRIDES_DIR = "${nixos-gsettings-overrides}/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas";
+
+ # Required by Budgie Desktop.
+ services.xserver.updateDbusEnvironment = true;
+ programs.dconf.enable = true;
+
+ # Required by Budgie Screensaver.
+ security.pam.services.budgie-screensaver = {};
+
+ # Required by Budgie's Polkit Dialog.
+ security.polkit.enable = mkDefault true;
+
+ # Required by Budgie Panel plugins and/or Budgie Control Center panels.
+ networking.networkmanager.enable = mkDefault true; # for BCC's Network panel.
+ programs.nm-applet.enable = config.networking.networkmanager.enable; # Budgie has no Network applet.
+ programs.nm-applet.indicator = false; # Budgie doesn't support AppIndicators.
+
+ hardware.bluetooth.enable = mkDefault true; # for Budgie's Status Indicator and BCC's Bluetooth panel.
+ hardware.pulseaudio.enable = mkDefault true; # for Budgie's Status Indicator and BCC's Sound panel.
+
+ xdg.portal.enable = mkDefault true; # for BCC's Applications panel.
+ xdg.portal.extraPortals = with pkgs; [
+ xdg-desktop-portal-gtk # provides a XDG Portals implementation.
+ ];
+
+ services.geoclue2.enable = mkDefault true; # for BCC's Privacy > Location Services panel.
+ services.upower.enable = config.powerManagement.enable; # for Budgie's Status Indicator and BCC's Power panel.
+ services.xserver.libinput.enable = mkDefault true; # for BCC's Mouse panel.
+ services.colord.enable = mkDefault true; # for BCC's Color panel.
+ services.gnome.at-spi2-core.enable = mkDefault true; # for BCC's A11y panel.
+ services.accounts-daemon.enable = mkDefault true; # for BCC's Users panel.
+ services.fprintd.enable = mkDefault true; # for BCC's Users panel.
+ services.udisks2.enable = mkDefault true; # for BCC's Details panel.
+
+ # For BCC's Online Accounts panel.
+ services.gnome.gnome-online-accounts.enable = mkDefault true;
+ services.gnome.gnome-online-miners.enable = true;
+
+ # For BCC's Printers panel.
+ services.printing.enable = mkDefault true;
+ services.system-config-printer.enable = config.services.printing.enable;
+
+ # For BCC's Sharing panel.
+ services.dleyna-renderer.enable = mkDefault true;
+ services.dleyna-server.enable = mkDefault true;
+ services.gnome.gnome-user-share.enable = mkDefault true;
+ services.gnome.rygel.enable = mkDefault true;
+
+ # Other default services.
+ services.gnome.evolution-data-server.enable = mkDefault true;
+ services.gnome.glib-networking.enable = mkDefault true;
+ services.gnome.gnome-keyring.enable = mkDefault true;
+ services.gnome.gnome-settings-daemon.enable = mkDefault true;
+ services.gvfs.enable = mkDefault true;
+
+ # Register packages for DBus.
+ services.dbus.packages = with pkgs; [
+ budgie.budgie-control-center
+ ];
+
+ # Shell integration for MATE Terminal.
+ programs.bash.vteIntegration = true;
+ programs.zsh.vteIntegration = true;
+ };
+}
diff --git a/third_party/nixpkgs/nixos/modules/services/x11/desktop-managers/default.nix b/third_party/nixpkgs/nixos/modules/services/x11/desktop-managers/default.nix
index 510561246a..a261ca4405 100644
--- a/third_party/nixpkgs/nixos/modules/services/x11/desktop-managers/default.nix
+++ b/third_party/nixpkgs/nixos/modules/services/x11/desktop-managers/default.nix
@@ -21,7 +21,7 @@ in
./none.nix ./xterm.nix ./phosh.nix ./xfce.nix ./plasma5.nix ./lumina.nix
./lxqt.nix ./enlightenment.nix ./gnome.nix ./retroarch.nix ./kodi.nix
./mate.nix ./pantheon.nix ./surf-display.nix ./cde.nix
- ./cinnamon.nix
+ ./cinnamon.nix ./budgie.nix
];
options = {
diff --git a/third_party/nixpkgs/nixos/modules/services/x11/window-managers/qtile.nix b/third_party/nixpkgs/nixos/modules/services/x11/window-managers/qtile.nix
index cc24522970..b07fd8a904 100644
--- a/third_party/nixpkgs/nixos/modules/services/x11/window-managers/qtile.nix
+++ b/third_party/nixpkgs/nixos/modules/services/x11/window-managers/qtile.nix
@@ -27,8 +27,7 @@ in
type = types.enum [ "x11" "wayland" ];
default = "x11";
description = lib.mdDoc ''
- Backend to use in qtile:
- or .
+ Backend to use in qtile: `x11` or `wayland`.
'';
};
diff --git a/third_party/nixpkgs/nixos/modules/services/x11/window-managers/stumpwm.nix b/third_party/nixpkgs/nixos/modules/services/x11/window-managers/stumpwm.nix
index 162af689db..c6fc49f582 100644
--- a/third_party/nixpkgs/nixos/modules/services/x11/window-managers/stumpwm.nix
+++ b/third_party/nixpkgs/nixos/modules/services/x11/window-managers/stumpwm.nix
@@ -15,10 +15,10 @@ in
services.xserver.windowManager.session = singleton {
name = "stumpwm";
start = ''
- ${pkgs.lispPackages.stumpwm}/bin/stumpwm &
+ ${pkgs.sbclPackages.stumpwm}/bin/stumpwm &
waitPID=$!
'';
};
- environment.systemPackages = [ pkgs.lispPackages.stumpwm ];
+ environment.systemPackages = [ pkgs.sbclPackages.stumpwm ];
};
}
diff --git a/third_party/nixpkgs/nixos/modules/system/boot/resolved.nix b/third_party/nixpkgs/nixos/modules/system/boot/resolved.nix
index 0ab2a87597..4e7201833d 100644
--- a/third_party/nixpkgs/nixos/modules/system/boot/resolved.nix
+++ b/third_party/nixpkgs/nixos/modules/system/boot/resolved.nix
@@ -16,7 +16,9 @@ in
default = false;
type = types.bool;
description = lib.mdDoc ''
- Whether to enable the systemd DNS resolver daemon.
+ Whether to enable the systemd DNS resolver daemon, `systemd-resolved`.
+
+ Search for `services.resolved` to see all options.
'';
};
diff --git a/third_party/nixpkgs/nixos/modules/virtualisation/linode-image.nix b/third_party/nixpkgs/nixos/modules/virtualisation/linode-image.nix
index f8d212d9cd..51f793ac01 100644
--- a/third_party/nixpkgs/nixos/modules/virtualisation/linode-image.nix
+++ b/third_party/nixpkgs/nixos/modules/virtualisation/linode-image.nix
@@ -62,5 +62,5 @@ in
};
};
- meta.maintainers = with maintainers; [ houstdav000 ];
+ meta.maintainers = with maintainers; [ cyntheticfox ];
}
diff --git a/third_party/nixpkgs/nixos/release-small.nix b/third_party/nixpkgs/nixos/release-small.nix
index 2b553adf2b..6204dc731a 100644
--- a/third_party/nixpkgs/nixos/release-small.nix
+++ b/third_party/nixpkgs/nixos/release-small.nix
@@ -85,7 +85,8 @@ in rec {
stdenv
subversion
tarball
- vim;
+ vim
+ tests-stdenv-gcc-stageCompare;
};
tested = let
@@ -135,6 +136,7 @@ in rec {
"nixos.tests.proxy"
"nixos.tests.simple"
"nixpkgs.jdk"
+ "nixpkgs.tests-stdenv-gcc-stageCompare"
])
];
};
diff --git a/third_party/nixpkgs/nixos/tests/all-tests.nix b/third_party/nixpkgs/nixos/tests/all-tests.nix
index 3167a865fc..2ad1ec3502 100644
--- a/third_party/nixpkgs/nixos/tests/all-tests.nix
+++ b/third_party/nixpkgs/nixos/tests/all-tests.nix
@@ -112,6 +112,7 @@ in {
btrbk-doas = handleTest ./btrbk-doas.nix {};
btrbk-no-timer = handleTest ./btrbk-no-timer.nix {};
btrbk-section-order = handleTest ./btrbk-section-order.nix {};
+ budgie = handleTest ./budgie.nix {};
buildbot = handleTest ./buildbot.nix {};
buildkite-agents = handleTest ./buildkite-agents.nix {};
caddy = handleTest ./caddy.nix {};
@@ -122,9 +123,9 @@ in {
cassandra_3_0 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_0; };
cassandra_3_11 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_11; };
cassandra_4 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_4; };
- ceph-multi-node = handleTestOn ["x86_64-linux"] ./ceph-multi-node.nix {};
- ceph-single-node = handleTestOn ["x86_64-linux"] ./ceph-single-node.nix {};
- ceph-single-node-bluestore = handleTestOn ["x86_64-linux"] ./ceph-single-node-bluestore.nix {};
+ ceph-multi-node = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-multi-node.nix {};
+ ceph-single-node = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-single-node.nix {};
+ ceph-single-node-bluestore = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-single-node-bluestore.nix {};
certmgr = handleTest ./certmgr.nix {};
cfssl = handleTestOn ["aarch64-linux" "x86_64-linux"] ./cfssl.nix {};
cgit = handleTest ./cgit.nix {};
@@ -459,7 +460,8 @@ in {
netdata = handleTest ./netdata.nix {};
networking.networkd = handleTest ./networking.nix { networkd = true; };
networking.scripted = handleTest ./networking.nix { networkd = false; };
- netbox = handleTest ./web-apps/netbox.nix {};
+ netbox = handleTest ./web-apps/netbox.nix { inherit (pkgs) netbox; };
+ netbox_3_3 = handleTest ./web-apps/netbox.nix { netbox = pkgs.netbox_3_3; };
# TODO: put in networking.nix after the test becomes more complete
networkingProxy = handleTest ./networking-proxy.nix {};
nextcloud = handleTest ./nextcloud {};
diff --git a/third_party/nixpkgs/nixos/tests/budgie.nix b/third_party/nixpkgs/nixos/tests/budgie.nix
new file mode 100644
index 0000000000..b9eba74b45
--- /dev/null
+++ b/third_party/nixpkgs/nixos/tests/budgie.nix
@@ -0,0 +1,51 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+ name = "budgie";
+
+ meta = with lib; {
+ maintainers = [ maintainers.federicoschonborn ];
+ };
+
+ nodes.machine = { ... }: {
+ imports = [
+ ./common/user-account.nix
+ ];
+
+ services.xserver.enable = true;
+
+ services.xserver.displayManager = {
+ lightdm.enable = true;
+ autoLogin = {
+ enable = true;
+ user = "alice";
+ };
+ };
+
+ services.xserver.desktopManager.budgie.enable = true;
+ };
+
+ testScript = { nodes, ... }:
+ let
+ user = nodes.machine.users.users.alice;
+ in
+ ''
+ with subtest("Wait for login"):
+ machine.wait_for_x()
+ machine.wait_for_file("${user.home}/.Xauthority")
+ machine.succeed("xauth merge ${user.home}/.Xauthority")
+
+ with subtest("Check that logging in has given the user ownership of devices"):
+ machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+
+ with subtest("Check if Budgie session components actually start"):
+ machine.wait_until_succeeds("pgrep budgie-daemon")
+ machine.wait_for_window("budgie-daemon")
+ machine.wait_until_succeeds("pgrep budgie-panel")
+ machine.wait_for_window("budgie-panel")
+
+ with subtest("Open MATE terminal"):
+ machine.succeed("su - ${user.name} -c 'DISPLAY=:0 mate-terminal >&2 &'")
+ machine.wait_for_window("Terminal")
+ machine.sleep(20)
+ machine.screenshot("screen")
+ '';
+})
diff --git a/third_party/nixpkgs/nixos/tests/buildbot.nix b/third_party/nixpkgs/nixos/tests/buildbot.nix
index 977c728835..467c8d8baf 100644
--- a/third_party/nixpkgs/nixos/tests/buildbot.nix
+++ b/third_party/nixpkgs/nixos/tests/buildbot.nix
@@ -23,7 +23,7 @@ import ./make-test-python.nix {
];
};
networking.firewall.allowedTCPPorts = [ 8010 8011 9989 ];
- environment.systemPackages = with pkgs; [ git python3Packages.buildbot-full ];
+ environment.systemPackages = with pkgs; [ git buildbot-full ];
};
bbworker = { pkgs, ... }: {
@@ -31,7 +31,7 @@ import ./make-test-python.nix {
enable = true;
masterUrl = "bbmaster:9989";
};
- environment.systemPackages = with pkgs; [ git python3Packages.buildbot-worker ];
+ environment.systemPackages = with pkgs; [ git buildbot-worker ];
};
gitrepo = { pkgs, ... }: {
diff --git a/third_party/nixpkgs/nixos/tests/elk.nix b/third_party/nixpkgs/nixos/tests/elk.nix
index f42be00f23..5c332cb5f2 100644
--- a/third_party/nixpkgs/nixos/tests/elk.nix
+++ b/third_party/nixpkgs/nixos/tests/elk.nix
@@ -268,14 +268,6 @@ let
'';
}) { inherit pkgs system; };
in {
- ELK-6 = mkElkTest "elk-6-oss" {
- name = "elk-6-oss";
- elasticsearch = pkgs.elasticsearch6-oss;
- logstash = pkgs.logstash6-oss;
- kibana = pkgs.kibana6-oss;
- journalbeat = pkgs.journalbeat6;
- metricbeat = pkgs.metricbeat6;
- };
# We currently only package upstream binaries.
# Feel free to package an SSPL licensed source-based package!
# ELK-7 = mkElkTest "elk-7-oss" {
@@ -287,13 +279,6 @@ in {
# metricbeat = pkgs.metricbeat7;
# };
unfree = lib.dontRecurseIntoAttrs {
- ELK-6 = mkElkTest "elk-6" {
- elasticsearch = pkgs.elasticsearch6;
- logstash = pkgs.logstash6;
- kibana = pkgs.kibana6;
- journalbeat = pkgs.journalbeat6;
- metricbeat = pkgs.metricbeat6;
- };
ELK-7 = mkElkTest "elk-7" {
elasticsearch = pkgs.elasticsearch7;
logstash = pkgs.logstash7;
diff --git a/third_party/nixpkgs/nixos/tests/gnome-xorg.nix b/third_party/nixpkgs/nixos/tests/gnome-xorg.nix
index 618458b1f6..d616d4f023 100644
--- a/third_party/nixpkgs/nixos/tests/gnome-xorg.nix
+++ b/third_party/nixpkgs/nixos/tests/gnome-xorg.nix
@@ -24,7 +24,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
services.xserver.desktopManager.gnome.enable = true;
services.xserver.desktopManager.gnome.debug = true;
services.xserver.displayManager.defaultSession = "gnome-xorg";
- programs.gnome-terminal.enable = true;
systemd.user.services = {
"org.gnome.Shell@x11" = {
@@ -61,10 +60,10 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
# False when startup is done
startingUp = su "${gdbus} ${eval} Main.layoutManager._startingUp";
- # Start gnome-terminal
- gnomeTerminalCommand = su "gnome-terminal";
+ # Start Console
+ launchConsole = su "${bus} gapplication launch org.gnome.Console";
- # Hopefully gnome-terminal's wm class
+ # Hopefully Console's wm class
wmClass = su "${gdbus} ${eval} global.display.focus_window.wm_class";
in ''
with subtest("Login to GNOME Xorg with GDM"):
@@ -82,13 +81,17 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
"${startingUp} | grep -q 'true,..false'"
)
- with subtest("Open Gnome Terminal"):
+ with subtest("Open Console"):
+ # Close the Activities view so that Shell can correctly track the focused window.
+ machine.send_key("esc")
+
machine.succeed(
- "${gnomeTerminalCommand}"
+ "${launchConsole}"
)
- # correct output should be (true, '"Gnome-terminal"')
+ # correct output should be (true, '"kgx"')
+ # For some reason, this deviates from Wayland.
machine.wait_until_succeeds(
- "${wmClass} | grep -q 'true,...Gnome-terminal'"
+ "${wmClass} | grep -q 'true,...kgx'"
)
machine.sleep(20)
machine.screenshot("screen")
diff --git a/third_party/nixpkgs/nixos/tests/gnome.nix b/third_party/nixpkgs/nixos/tests/gnome.nix
index 05619cbd7d..5a28e3bb0e 100644
--- a/third_party/nixpkgs/nixos/tests/gnome.nix
+++ b/third_party/nixpkgs/nixos/tests/gnome.nix
@@ -22,14 +22,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
services.xserver.desktopManager.gnome.enable = true;
services.xserver.desktopManager.gnome.debug = true;
- programs.gnome-terminal.enable = true;
-
- environment.systemPackages = [
- (pkgs.makeAutostartItem {
- name = "org.gnome.Terminal";
- package = pkgs.gnome.gnome-terminal;
- })
- ];
systemd.user.services = {
"org.gnome.Shell@wayland" = {
@@ -64,10 +56,10 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
# False when startup is done
startingUp = su "${gdbus} ${eval} Main.layoutManager._startingUp";
- # Start gnome-terminal
- gnomeTerminalCommand = su "${bus} gnome-terminal";
+ # Start Console
+ launchConsole = su "${bus} gapplication launch org.gnome.Console";
- # Hopefully gnome-terminal's wm class
+ # Hopefully Console's wm class
wmClass = su "${gdbus} ${eval} global.display.focus_window.wm_class";
in ''
with subtest("Login to GNOME with GDM"):
@@ -86,10 +78,16 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
"${startingUp} | grep -q 'true,..false'"
)
- with subtest("Open Gnome Terminal"):
- # correct output should be (true, '"gnome-terminal-server"')
+ with subtest("Open Console"):
+ # Close the Activities view so that Shell can correctly track the focused window.
+ machine.send_key("esc")
+
+ machine.succeed(
+ "${launchConsole}"
+ )
+ # correct output should be (true, '"org.gnome.Console"')
machine.wait_until_succeeds(
- "${wmClass} | grep -q 'gnome-terminal-server'"
+ "${wmClass} | grep -q 'true,...org.gnome.Console'"
)
machine.sleep(20)
machine.screenshot("screen")
diff --git a/third_party/nixpkgs/nixos/tests/graylog.nix b/third_party/nixpkgs/nixos/tests/graylog.nix
index 23f426fc7a..3f7cc3a914 100644
--- a/third_party/nixpkgs/nixos/tests/graylog.nix
+++ b/third_party/nixpkgs/nixos/tests/graylog.nix
@@ -8,7 +8,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
services.mongodb.enable = true;
services.elasticsearch.enable = true;
- services.elasticsearch.package = pkgs.elasticsearch-oss;
services.elasticsearch.extraConf = ''
network.publish_host: 127.0.0.1
network.bind_host: 127.0.0.1
diff --git a/third_party/nixpkgs/nixos/tests/libreswan.nix b/third_party/nixpkgs/nixos/tests/libreswan.nix
index ff3d2344a6..aadba941fa 100644
--- a/third_party/nixpkgs/nixos/tests/libreswan.nix
+++ b/third_party/nixpkgs/nixos/tests/libreswan.nix
@@ -107,6 +107,8 @@ in
with subtest("Network is up"):
alice.wait_until_succeeds("ping -c1 bob")
+ alice.succeed("systemctl restart ipsec")
+ bob.succeed("systemctl restart ipsec")
with subtest("Eve can eavesdrop cleartext traffic"):
eavesdrop()
diff --git a/third_party/nixpkgs/nixos/tests/mediawiki.nix b/third_party/nixpkgs/nixos/tests/mediawiki.nix
index 7f31d6aadf..1ae82d65b3 100644
--- a/third_party/nixpkgs/nixos/tests/mediawiki.nix
+++ b/third_party/nixpkgs/nixos/tests/mediawiki.nix
@@ -1,28 +1,57 @@
-import ./make-test-python.nix ({ pkgs, lib, ... }: {
- name = "mediawiki";
- meta.maintainers = [ lib.maintainers.aanderse ];
+{
+ system ? builtins.currentSystem,
+ config ? {},
+ pkgs ? import ../.. { inherit system config; },
+}:
- nodes.machine =
- { ... }:
- { services.mediawiki.enable = true;
- services.mediawiki.virtualHost.hostName = "localhost";
- services.mediawiki.virtualHost.adminAddr = "root@example.com";
- services.mediawiki.passwordFile = pkgs.writeText "password" "correcthorsebatterystaple";
- services.mediawiki.extensions = {
- Matomo = pkgs.fetchzip {
- url = "https://github.com/DaSchTour/matomo-mediawiki-extension/archive/v4.0.1.tar.gz";
- sha256 = "0g5rd3zp0avwlmqagc59cg9bbkn3r7wx7p6yr80s644mj6dlvs1b";
- };
- ParserFunctions = null;
+let
+ shared = {
+ services.mediawiki.enable = true;
+ services.mediawiki.virtualHost.hostName = "localhost";
+ services.mediawiki.virtualHost.adminAddr = "root@example.com";
+ services.mediawiki.passwordFile = pkgs.writeText "password" "correcthorsebatterystaple";
+ services.mediawiki.extensions = {
+ Matomo = pkgs.fetchzip {
+ url = "https://github.com/DaSchTour/matomo-mediawiki-extension/archive/v4.0.1.tar.gz";
+ sha256 = "0g5rd3zp0avwlmqagc59cg9bbkn3r7wx7p6yr80s644mj6dlvs1b";
};
+ ParserFunctions = null;
};
+ };
- testScript = ''
- start_all()
+ testLib = import ../lib/testing-python.nix {
+ inherit system pkgs;
+ extraConfigurations = [ shared ];
+ };
+in
+{
+ mysql = testLib.makeTest {
+ name = "mediawiki-mysql";
+ nodes.machine = {
+ services.mediawiki.database.type = "mysql";
+ };
+ testScript = ''
+ start_all()
- machine.wait_for_unit("phpfpm-mediawiki.service")
+ machine.wait_for_unit("phpfpm-mediawiki.service")
- page = machine.succeed("curl -fL http://localhost/")
- assert "MediaWiki has been installed" in page
- '';
-})
+ page = machine.succeed("curl -fL http://localhost/")
+ assert "MediaWiki has been installed" in page
+ '';
+ };
+
+ postgresql = testLib.makeTest {
+ name = "mediawiki-postgres";
+ nodes.machine = {
+ services.mediawiki.database.type = "postgres";
+ };
+ testScript = ''
+ start_all()
+
+ machine.wait_for_unit("phpfpm-mediawiki.service")
+
+ page = machine.succeed("curl -fL http://localhost/")
+ assert "MediaWiki has been installed" in page
+ '';
+ };
+}
diff --git a/third_party/nixpkgs/nixos/tests/nginx-http3.nix b/third_party/nixpkgs/nixos/tests/nginx-http3.nix
index 319f6aac18..f003130b46 100644
--- a/third_party/nixpkgs/nixos/tests/nginx-http3.nix
+++ b/third_party/nixpkgs/nixos/tests/nginx-http3.nix
@@ -36,8 +36,10 @@ in
sslCertificateKey = ./common/acme/server/acme.test.key.pem;
http2 = true;
http3 = true;
+ http3_hq = false;
+ quic = true;
reuseport = true;
- root = lib.mkForce (pkgs.runCommandLocal "testdir2" {} ''
+ root = lib.mkForce (pkgs.runCommandLocal "testdir" {} ''
mkdir "$out"
cat > "$out/index.html" <Hello World!