Commit Graph

51395 Commits

Author SHA1 Message Date
frantathefranta
361f6a6354 nixos/conman: init module
Adding a service for the conman package

Changes to conman service as per review

(cherry picked from commit 8b97231460)
2025-08-15 18:22:31 -04:00
Defelo
5e0dafbe09 zipline: 4.2.1 -> 4.2.3
Changelog: https://github.com/diced/zipline/releases/tag/v4.2.2
Diff: https://github.com/diced/zipline/compare/v4.2.1...v4.2.2

Changelog: https://github.com/diced/zipline/releases/tag/v4.2.3
Diff: https://github.com/diced/zipline/compare/v4.2.2...v4.2.3
(cherry picked from commit ed4ce19544)
2025-08-15 10:55:14 +00:00
Wolfgang Walther
483bf4e400 [Backport release-25.05]: nixos/slurm: remove mysql/InnoDB tuning settings, unbreak test (#432790) 2025-08-14 07:23:00 +00:00
Wolfgang Walther
0f9967d795 [Backport release-25.05] nixos/freshrss: fix loading extensions' static content (#431314) 2025-08-13 20:26:43 +00:00
transcaffeine
fed325eb7f matrix-synapse: 1.133.0 -> 1.134.0
Release notes: https://github.com/element-hq/synapse/releases/tag/v1.134.0
Full changelog: https://github.com/element-hq/synapse/compare/v1.133.0...v1.134.0

(cherry picked from commit d3bc50865f)
2025-08-12 09:04:23 +08:00
Yethal
8409a094b3 virtualisation/oci-containers: fix podman systemd service name
(cherry picked from commit 68710f4064)
2025-08-11 16:39:49 +00:00
Markus Kowalewski
587d72880a nixos/slurm: remove mysql/InnoDB tuning settings, unbreak test
The tuning settings are recommended for production setups:
(https://slurm.schedmd.com/accounting.html#slurm-accounting-configuration-before-build)

These are not needed in the test and broke the MySQL service.

(cherry picked from commit 68d450a5b8)
2025-08-11 14:23:02 +02:00
Tert0
4aa2c4aaae nixos/tests/velocity: fix mcstatus command
(cherry picked from commit 4999e4345a)
2025-08-10 16:38:46 +02:00
Wolfgang Walther
a55f91168b [Backport release-25.05] nixos/garage: set LimitNOFILE (#429643) 2025-08-09 17:14:04 +00:00
Wolfgang Walther
2b196d1c7f [Backport release-25.05] nixosTests.firefly-iii: Added meta.platforms so that tests are skipped appropriately (#428630) 2025-08-09 17:09:10 +00:00
Wolfgang Walther
9e0d46b18f [Backport release-25.05] peertube: remove spawn (#427195) 2025-08-09 16:59:42 +00:00
Wolfgang Walther
311b0326e6 [Backport release-25.05] nixos/iio: add package option (#427218) 2025-08-09 16:58:37 +00:00
lassulus
2932635c2e [Backport release-25.05] paretosecurity: 0.2.38 -> 0.3.2 (#431393) 2025-08-08 13:28:53 +02:00
Seth Flynn
722bf47885 [Backport release-25.05] tuned: init at 2.25.1 (#430398) 2025-08-07 09:30:36 -04:00
liberodark
e728d7ae4b nixos/ntpd-rs: hardening
(cherry picked from commit a9cd681b8d)
2025-08-07 16:20:54 +05:30
Seth Flynn
6dacbe7880 nixos/tuned: enable upower with tuned-ppd
Fixes: #431105
(cherry picked from commit 8f2a71ff49)
2025-08-06 20:21:50 -04:00
Matt Christ
4714abbe16 nixos/freshrss: fix loading extensions' static content
Before this change, the THIRDPARTY_EXTENSIONS_PATH would end up with a
double-slash in the path, which was breaking FreshRSS's is_valid_path
detection.

(cherry picked from commit 637fc36529)
2025-08-06 20:18:21 -04:00
Sizhe Zhao
1c6aede85d nixosTests.freshrss: handleTest -> runTest
(cherry picked from commit da6ecbe539)
2025-08-06 20:18:15 -04:00
Neyts Zupan
b8ba4745db paretosecurity: 0.2.38 -> 0.3.2
Test for linking had to be removed because now the linking is more
complex and it would take too much mocking to test it.

The test in question was moved to the dashboard codebase that is
closed-source, if that helps in any way.

(cherry picked from commit a667834a5f)
2025-08-06 08:26:54 +00:00
Amadej Kastelic
afc5524721 nixos/cjdns: update for cjdns 22.1 compatibility
(cherry picked from commit 7476494b3b)
2025-08-03 15:43:34 +02:00
Pavol Rusnak
0f73779511 cjdns: bring changes from master 2025-08-03 15:41:36 +02:00
Seth Flynn
2514f13aa6 nixos/tuned: init
(cherry picked from commit 3eeb7ad06a)
2025-08-02 10:57:37 -04:00
Aleksana
eb3085f230 [25.05] Backport nixos/kanidm: accept originUrls following rfc8252 (#429527) 2025-08-02 22:14:05 +08:00
André Silva
64058315d1 [Backport release-25.05] nixos/qbittorrent: init (#429630) 2025-08-01 12:46:13 +01:00
Jhonas Wernery
4b555c184b nixos/garage: set LimitNOFILE (#429633)
Upstream uses 42000, see:
https://garagehq.deuxfleurs.fr/documentation/cookbook/systemd/

(cherry picked from commit 92b504d2ff)
2025-07-30 16:55:57 +00:00
bas
13df1220cc nixos/qbittorrent: add maintainer undefined-landmark
As discussed in PR #287923. The author agreed to add me as a maintainer
to the module after merging.

(cherry picked from commit 380cd5924b)
2025-07-30 17:07:14 +02:00
nuko
3849dd705e nixos/qbittorrent: init service module
nixos/qbittorrent: add default serverConfig & fix test

Migrate to runTest

Replace lib.optional with lib.optionals

nixos/qbittorrent: update release notes to 2511

(cherry picked from commit 84d174e312)
2025-07-30 17:04:45 +02:00
Martin Weinelt
a10ae85d3a nixos/tlsrpt: configure explicit http_script
Make sure we get curl into the system, since when the tlsrpt rua is an
HTTP URL we need to be able to deliver to that.

(cherry picked from commit e030814446)
2025-07-30 13:36:27 +00:00
K900
c2d2283f41 nixos/release-small: fix eval
This was just broken for ages and no one noticed.

(cherry picked from commit 2ca6167483)
2025-07-30 09:39:58 +00:00
Marc Plano-Lesay
4fd3a59d8a nixos/kanidm: accept originUrls following rfc8252 (#428204)
(cherry picked from commit 0d25584641)
2025-07-30 15:06:11 +10:00
Will Fancher
67a2f9968f [Backport release-25.05] nixos/systemd: fix run0 failing to run commands (#429202) 2025-07-29 23:33:42 -04:00
Thomas Gerbet
33cb0b9a21 sudo: 1.9.17p1 -> 1.9.17p2
Changes:
https://www.sudo.ws/releases/stable/#1.9.17p2
(cherry picked from commit a3a0962f23)
2025-07-29 21:43:27 +00:00
Defelo
b6639d9b3e nixos/tests/go-httpbin: init
(cherry picked from commit e1b8c6c493)
2025-07-29 20:04:56 +05:30
Defelo
17847f675a nixos/go-httpbin: init module
(cherry picked from commit 224dc30d39)
2025-07-29 20:04:55 +05:30
Jason Yundt
d5378cec85 nixos/systemd: fix run0 failing to run commands
Fixes #361592.

I was able to test this change by doing the following:

1. Create a file named “test-systemd-run0.nix” that contains this Nix
expression:

    let
      nixpkgs = /path/to/nixpkgs;
      pkgs = import nixpkgs { };
    in
    pkgs.testers.runNixOSTest {
      name = "test-systemd-run0";
      nodes.machine = {
        security.polkit.enable = true;
      };
      testScript = ''
        start_all()
        machine.succeed("run0 env")
      '';
    }

2. Replace “/path/to/nixpkgs” with the actual path to an actual copy of
Nixpkgs.

3. Run the integration test by running this command:

    nix-build <path to test-systemd-run0.nix>

(cherry picked from commit d54262911c)
2025-07-28 21:59:21 +00:00
Martin Weinelt
007eb35d91 nixos/tlsrpt: fix permissions to execute postdrop
Calling to sendmail without AF_NETLINK causes:

> sendmail: fatal: inet_addr_local[getifaddrs]: getifaddrs: Address family not supported by protocol

and without AF_INET/AF_INET6:

> sendmail: warning: inet_protocols: disabling IPv6 name/address support: Address family not supported by protocol
> sendmail: warning: inet_protocols: disabling IPv4 name/address support: Address family not supported by protocol

Move the configurePostfix option one level up, since it now also
reconfigures the reportd systemd unit.

(cherry picked from commit b438f32b2a)
2025-07-28 14:16:59 +00:00
Martin Weinelt
c3246b01ba nixos/tlsrpt: fix restart trigger
Triggering on a symlink target does not work.

(cherry picked from commit c3c5a3bfd0)
2025-07-28 14:16:59 +00:00
Martin Weinelt
6a90d84e44 nixos/tlsrpt: fix default postfix sendmail path
It is not in the PATH for the reportd, since it is a SUID wrapper.

(cherry picked from commit 1f9431801f)
2025-07-28 14:16:59 +00:00
Maximilian Bosch
b210d55d48 nixos/lib/test-driver: try using XDG_RUNTIME_DIR if available
At work we have the use-case that several people connect to a large
Linux box to run tests and debug those interactively.

All tests write their state into a global `/tmp` -- e.g. the vde1 socket
and the VMs' state. This leads to conflicts when multiple people are
doing this.

This change tries to use XDG_RUNTIME_DIR before using Python's detection
of a global temp directory: when connecting, this requires a working
user session, but then we get working directories per user. This is
preferable over doing something like `mktemp -d` per run since that
would break use-cases where you want to keep the VMs' state across
multiple sessions (`--keep-vm-state`).

(cherry picked from commit 59b4d0de90)
2025-07-28 09:03:14 +00:00
Martin Weinelt
89b59646e8 [Backport release-25.05] postfix-tlspol: 1.8.9 -> 1.8.12 (#428692) 2025-07-27 15:01:43 +02:00
NullCube
ebb3620e76 installer/nixos-generate-config: remove broadcom_sta
Resolves the installer failing on devices that include this hardware, as
broadcom_sta was marked as insecure due to being unmaintained and having
active CVE's.

This commit be reverted when/if the installer has a mechanism for allowing
insecure packages.

(cherry picked from commit 9c9f467d49)
2025-07-27 04:36:21 +00:00
Martin Weinelt
3856b699f3 postfix-tlspol: adopt package and module
(cherry picked from commit e6445e42fa)
2025-07-26 16:25:15 -04:00
Martin Weinelt
c50fcdd313 nixos/postfix-tlspol: only preset dns resolver with useLocalResolver
This is the best indicator we have about whether to use a local resolver.

In the meantime I'm lobbying upstream to read /etc/resolv.conf.

(cherry picked from commit b201963951)
2025-07-26 16:25:15 -04:00
Savyasachee Jha
3b5f0b9ca6 nixosTests.firefly-iii: Added meta.platforms so that tests are skipped appropriately
(cherry picked from commit 91a1beec91)
2025-07-26 16:08:14 +00:00
weriomat
11f226d19d nixos/vector: add option to disable the configuration validation
Currently, during built time the configuration gets checked by vector.
This can be a problem if [environment
variables](https://vector.dev/docs/reference/environment_variables/) are
interpolated into the configuration. In this case the validation can be
disabled. This came up in trying to find a solution for
[#377889](https://github.com/NixOS/nixpkgs/issues/377889).

(cherry picked from commit 6b4ce1ee23)
2025-07-26 17:30:29 +02:00
Nick Ionata
e6279c5e35 nixos/vector: add graceful shutdown limit option
This adds a NixOS module option to configure the Vector cli option
`--graceful-shutdown-limit-secs`,
https://vector.dev/docs/reference/cli/#vector_graceful_shutdown_limit_secs.

(cherry picked from commit 25a40ead28)
2025-07-26 17:30:12 +02:00
Martin Weinelt
d3b13a2850 nixos/frigate: don't clear model cache
Upstream stores the model cache in the config directory, which is
unnecessarily messy. The cache directory is still the correct place for
these, since they can be pruned and redownloaded, we just don't want it
to happen on every restart.

Fixes: #427714
(cherry picked from commit cb4fd4e3ca)
2025-07-25 16:42:12 +00:00
diniamo
8fa81f2c6c nixos/grafana: add openFirewall option
(cherry picked from commit 5bb944c6f5)
2025-07-25 16:14:53 +00:00
Martin Weinelt
268ecc7bb2 kea: 2.6.2 -> 2.6.3
https://downloads.isc.org/isc/kea/2.6.3/Kea-2.6.3-ReleaseNotes.txt

https://kb.isc.org/docs/cve-2025-32801
https://kb.isc.org/docs/cve-2025-32802
https://kb.isc.org/docs/cve-2025-32803

Fixes: CVE-2025-32801, CVE-2025-32802, CVE-2025-32803

(cherry picked from commit fde8885198)
2025-07-25 17:33:14 +02:00
Alyssa Ross
ae4dffd28d linux/common-config: enable AX25
This will allow dropping the linuxPackages_ham variant.  Fedora sets
these in their default kernel, so I don't anticipate any problem with
us doing the same.

Tested building linux_5_4, linux, and linux_latest on x86_64.

(cherry picked from commit d735743b39)
2025-07-24 15:45:19 +02:00