Merge remote-tracking branch 'origin/master' into staging-next
Conflicts: pkgs/applications/graphics/emulsion/default.nix pkgs/development/tools/misc/texlab/default.nix pkgs/development/tools/rust/bindgen/default.nix pkgs/development/tools/rust/cargo-udeps/default.nix pkgs/misc/emulators/ruffle/default.nix pkgs/tools/misc/code-minimap/default.nix
This commit is contained in:
Jonathan Ringer
@@ -895,6 +895,7 @@
|
||||
./services/system/kerberos/default.nix
|
||||
./services/system/nscd.nix
|
||||
./services/system/saslauthd.nix
|
||||
./services/system/self-deploy.nix
|
||||
./services/system/uptimed.nix
|
||||
./services/torrent/deluge.nix
|
||||
./services/torrent/flexget.nix
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Global configuration for atop.
|
||||
|
||||
{ config, lib, ... }:
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
@@ -12,11 +12,83 @@ in
|
||||
|
||||
options = {
|
||||
|
||||
programs.atop = {
|
||||
programs.atop = rec {
|
||||
|
||||
enable = mkEnableOption "Atop";
|
||||
|
||||
package = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.atop;
|
||||
description = ''
|
||||
Which package to use for Atop.
|
||||
'';
|
||||
};
|
||||
|
||||
netatop = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to install and enable the netatop kernel module.
|
||||
Note: this sets the kernel taint flag "O" for loading out-of-tree modules.
|
||||
'';
|
||||
};
|
||||
package = mkOption {
|
||||
type = types.package;
|
||||
default = config.boot.kernelPackages.netatop;
|
||||
description = ''
|
||||
Which package to use for netatop.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
atopgpu.enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to install and enable the atopgpud daemon to get information about
|
||||
NVIDIA gpus.
|
||||
'';
|
||||
};
|
||||
|
||||
setuidWrapper.enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to install a setuid wrapper for Atop. This is required to use some of
|
||||
the features as non-root user (e.g.: ipc information, netatop, atopgpu).
|
||||
Atop tries to drop the root privileges shortly after starting.
|
||||
'';
|
||||
};
|
||||
|
||||
atopService.enable = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
Whether to enable the atop service responsible for storing statistics for
|
||||
long-term analysis.
|
||||
'';
|
||||
};
|
||||
atopRotateTimer.enable = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
Whether to enable the atop-rotate timer, which restarts the atop service
|
||||
daily to make sure the data files are rotate.
|
||||
'';
|
||||
};
|
||||
atopacctService.enable = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
Whether to enable the atopacct service which manages process accounting.
|
||||
This allows Atop to gather data about processes that disappeared in between
|
||||
two refresh intervals.
|
||||
'';
|
||||
};
|
||||
settings = mkOption {
|
||||
type = types.attrs;
|
||||
default = {};
|
||||
default = { };
|
||||
example = {
|
||||
flags = "a1f";
|
||||
interval = 5;
|
||||
@@ -25,12 +97,50 @@ in
|
||||
Parameters to be written to <filename>/etc/atoprc</filename>.
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf (cfg.settings != {}) {
|
||||
environment.etc.atoprc.text =
|
||||
concatStrings (mapAttrsToList (n: v: "${n} ${toString v}\n") cfg.settings);
|
||||
};
|
||||
config = mkIf cfg.enable (
|
||||
let
|
||||
atop =
|
||||
if cfg.atopgpu.enable then
|
||||
(cfg.package.override { withAtopgpu = true; })
|
||||
else
|
||||
cfg.package;
|
||||
in
|
||||
{
|
||||
environment.etc = mkIf (cfg.settings != { }) {
|
||||
atoprc.text = concatStrings
|
||||
(mapAttrsToList
|
||||
(n: v: ''
|
||||
${n} ${toString v}
|
||||
'')
|
||||
cfg.settings);
|
||||
};
|
||||
environment.systemPackages = [ atop (lib.mkIf cfg.netatop.enable cfg.netatop.package) ];
|
||||
boot.extraModulePackages = [ (lib.mkIf cfg.netatop.enable cfg.netatop.package) ];
|
||||
systemd =
|
||||
let
|
||||
mkSystemd = type: cond: name: restartTriggers: {
|
||||
${name} = lib.mkIf cond {
|
||||
inherit restartTriggers;
|
||||
wantedBy = [ (if type == "services" then "multi-user.target" else if type == "timers" then "timers.target" else null) ];
|
||||
};
|
||||
};
|
||||
mkService = mkSystemd "services";
|
||||
mkTimer = mkSystemd "timers";
|
||||
in
|
||||
{
|
||||
packages = [ atop (lib.mkIf cfg.netatop.enable cfg.netatop.package) ];
|
||||
services =
|
||||
mkService cfg.atopService.enable "atop" [ atop ]
|
||||
// mkService cfg.atopacctService.enable "atopacct" [ atop ]
|
||||
// mkService cfg.netatop.enable "netatop" [ cfg.netatop.package ]
|
||||
// mkService cfg.atopgpu.enable "atopgpu" [ atop ];
|
||||
timers = mkTimer cfg.atopRotateTimer.enable "atop-rotate" [ atop ];
|
||||
};
|
||||
security.wrappers =
|
||||
lib.mkIf cfg.setuidWrapper.enable { atop = { source = "${atop}/bin/atop"; }; };
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
@@ -145,15 +145,7 @@ in {
|
||||
|
||||
programs.feedbackd.enable = true;
|
||||
|
||||
# https://source.puri.sm/Librem5/phosh/-/issues/303
|
||||
security.pam.services.phosh = {
|
||||
text = ''
|
||||
auth requisite pam_nologin.so
|
||||
auth required pam_succeed_if.so user != root quiet_success
|
||||
auth required pam_securetty.so
|
||||
auth requisite pam_nologin.so
|
||||
'';
|
||||
};
|
||||
security.pam.services.phosh = {};
|
||||
|
||||
services.gnome.core-shell.enable = true;
|
||||
services.gnome.core-os-services.enable = true;
|
||||
|
||||
@@ -133,7 +133,7 @@ in
|
||||
|
||||
parser = ${pkgs.apparmor-parser}/bin/apparmor_parser
|
||||
ldd = ${pkgs.glibc.bin}/bin/ldd
|
||||
logger = ${pkgs.utillinux}/bin/logger
|
||||
logger = ${pkgs.util-linux}/bin/logger
|
||||
|
||||
# customize how file ownership permissions are presented
|
||||
# 0 - off
|
||||
|
||||
@@ -103,8 +103,8 @@ in
|
||||
};
|
||||
|
||||
dataDir = mkOption {
|
||||
default = "/var/lib/znc/";
|
||||
example = "/home/john/.znc/";
|
||||
default = "/var/lib/znc";
|
||||
example = "/home/john/.znc";
|
||||
type = types.path;
|
||||
description = ''
|
||||
The state directory for ZNC. The config and the modules will be linked
|
||||
@@ -258,6 +258,34 @@ in
|
||||
ExecStart = "${pkgs.znc}/bin/znc --foreground --datadir ${cfg.dataDir} ${escapeShellArgs cfg.extraFlags}";
|
||||
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
|
||||
ExecStop = "${pkgs.coreutils}/bin/kill -INT $MAINPID";
|
||||
# Hardening
|
||||
CapabilityBoundingSet = [ "" ];
|
||||
DevicePolicy = "closed";
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProcSubset = "pid";
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
ProtectSystem = "strict";
|
||||
ReadWritePaths = [ cfg.dataDir ];
|
||||
RemoveIPC = true;
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
|
||||
UMask = "0027";
|
||||
};
|
||||
preStart = ''
|
||||
mkdir -p ${cfg.dataDir}/configs
|
||||
|
||||
@@ -44,7 +44,7 @@ let
|
||||
modules = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ "simple_away" ];
|
||||
example = literalExample "[ simple_away sasl ]";
|
||||
example = literalExample ''[ "simple_away" "sasl" ]'';
|
||||
description = ''
|
||||
ZNC network modules to load.
|
||||
'';
|
||||
|
||||
@@ -0,0 +1,170 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.self-deploy;
|
||||
|
||||
workingDirectory = "/var/lib/nixos-self-deploy";
|
||||
repositoryDirectory = "${workingDirectory}/repo";
|
||||
outPath = "${workingDirectory}/system";
|
||||
|
||||
gitWithRepo = "git -C ${repositoryDirectory}";
|
||||
|
||||
renderNixArgs = args:
|
||||
let
|
||||
toArg = key: value:
|
||||
if builtins.isString value
|
||||
then " --argstr ${lib.escapeShellArg key} ${lib.escapeShellArg value}"
|
||||
else " --arg ${lib.escapeShellArg key} ${lib.escapeShellArg (toString value)}";
|
||||
in
|
||||
lib.concatStrings (lib.mapAttrsToList toArg args);
|
||||
|
||||
isPathType = x: lib.strings.isCoercibleToString x && builtins.substring 0 1 (toString x) == "/";
|
||||
|
||||
in
|
||||
{
|
||||
options.services.self-deploy = {
|
||||
enable = lib.mkEnableOption "self-deploy";
|
||||
|
||||
nixFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
|
||||
default = "/default.nix";
|
||||
|
||||
description = ''
|
||||
Path to nix file in repository. Leading '/' refers to root of
|
||||
git repository.
|
||||
'';
|
||||
};
|
||||
|
||||
nixAttribute = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
|
||||
description = ''
|
||||
Attribute of `nixFile` that builds the current system.
|
||||
'';
|
||||
};
|
||||
|
||||
nixArgs = lib.mkOption {
|
||||
type = lib.types.attrs;
|
||||
|
||||
default = { };
|
||||
|
||||
description = ''
|
||||
Arguments to `nix-build` passed as `--argstr` or `--arg` depending on
|
||||
the type.
|
||||
'';
|
||||
};
|
||||
|
||||
switchCommand = lib.mkOption {
|
||||
type = lib.types.enum [ "boot" "switch" "dry-activate" "test" ];
|
||||
|
||||
default = "switch";
|
||||
|
||||
description = ''
|
||||
The `switch-to-configuration` subcommand used.
|
||||
'';
|
||||
};
|
||||
|
||||
repository = lib.mkOption {
|
||||
type = with lib.types; oneOf [ path str ];
|
||||
|
||||
description = ''
|
||||
The repository to fetch from. Must be properly formatted for git.
|
||||
|
||||
If this value is set to a path (must begin with `/`) then it's
|
||||
assumed that the repository is local and the resulting service
|
||||
won't wait for the network to be up.
|
||||
|
||||
If the repository will be fetched over SSH, you must add an
|
||||
entry to `programs.ssh.knownHosts` for the SSH host for the fetch
|
||||
to be successful.
|
||||
'';
|
||||
};
|
||||
|
||||
sshKeyFile = lib.mkOption {
|
||||
type = with lib.types; nullOr path;
|
||||
|
||||
default = null;
|
||||
|
||||
description = ''
|
||||
Path to SSH private key used to fetch private repositories over
|
||||
SSH.
|
||||
'';
|
||||
};
|
||||
|
||||
branch = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
|
||||
default = "master";
|
||||
|
||||
description = ''
|
||||
Branch to track
|
||||
|
||||
Technically speaking any ref can be specified here, as this is
|
||||
passed directly to a `git fetch`, but for the use-case of
|
||||
continuous deployment you're likely to want to specify a branch.
|
||||
'';
|
||||
};
|
||||
|
||||
startAt = lib.mkOption {
|
||||
type = with lib.types; either str (listOf str);
|
||||
|
||||
default = "hourly";
|
||||
|
||||
description = ''
|
||||
The schedule on which to run the `self-deploy` service. Format
|
||||
specified by `systemd.time 7`.
|
||||
|
||||
This value can also be a list of `systemd.time 7` formatted
|
||||
strings, in which case the service will be started on multiple
|
||||
schedules.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services.self-deploy = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
requires = lib.mkIf (!(isPathType cfg.repository)) [ "network-online.target" ];
|
||||
|
||||
environment.GIT_SSH_COMMAND = lib.mkIf (!(isNull cfg.sshKeyFile))
|
||||
"${pkgs.openssh}/bin/ssh -i ${lib.escapeShellArg cfg.sshKeyFile}";
|
||||
|
||||
restartIfChanged = false;
|
||||
|
||||
path = with pkgs; [
|
||||
git
|
||||
nix
|
||||
systemd
|
||||
];
|
||||
|
||||
script = ''
|
||||
if [ ! -e ${repositoryDirectory} ]; then
|
||||
mkdir --parents ${repositoryDirectory}
|
||||
git init ${repositoryDirectory}
|
||||
fi
|
||||
|
||||
${gitWithRepo} fetch ${lib.escapeShellArg cfg.repository} ${lib.escapeShellArg cfg.branch}
|
||||
|
||||
${gitWithRepo} checkout FETCH_HEAD
|
||||
|
||||
nix-build${renderNixArgs cfg.nixArgs} ${lib.cli.toGNUCommandLineShell { } {
|
||||
attr = cfg.nixAttribute;
|
||||
out-link = outPath;
|
||||
}} ${lib.escapeShellArg "${repositoryDirectory}${cfg.nixFile}"}
|
||||
|
||||
${lib.optionalString (cfg.switchCommand != "test")
|
||||
"nix-env --profile /nix/var/nix/profiles/system --set ${outPath}"}
|
||||
|
||||
${outPath}/bin/switch-to-configuration ${cfg.switchCommand}
|
||||
|
||||
rm ${outPath}
|
||||
|
||||
${gitWithRepo} gc --prune=all
|
||||
|
||||
${lib.optionalString (cfg.switchCommand == "boot") "systemctl reboot"}
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -64,6 +64,7 @@ in
|
||||
{
|
||||
|
||||
meta = {
|
||||
doc = ./gnome.xml;
|
||||
maintainers = teams.gnome.members;
|
||||
};
|
||||
|
||||
@@ -553,7 +554,7 @@ in
|
||||
/* gnome-boxes */
|
||||
] config.environment.gnome.excludePackages);
|
||||
|
||||
services.sysprof.enable = true;
|
||||
services.sysprof.enable = notExcluded pkgs.sysprof;
|
||||
})
|
||||
];
|
||||
|
||||
|
||||
@@ -0,0 +1,276 @@
|
||||
<chapter xmlns="http://docbook.org/ns/docbook"
|
||||
xmlns:xlink="http://www.w3.org/1999/xlink"
|
||||
xml:id="chap-gnome">
|
||||
<title>GNOME Desktop</title>
|
||||
<para>
|
||||
GNOME provides a simple, yet full-featured desktop environment with a focus on productivity. Its Mutter compositor supports both Wayland and X server, and the GNOME Shell user interface is fully customizable by extensions.
|
||||
</para>
|
||||
|
||||
<section xml:id="sec-gnome-enable">
|
||||
<title>Enabling GNOME</title>
|
||||
|
||||
<para>
|
||||
All of the core apps, optional apps, games, and core developer tools from GNOME are available.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
To enable the GNOME desktop use:
|
||||
</para>
|
||||
|
||||
<programlisting>
|
||||
<xref linkend="opt-services.xserver.desktopManager.gnome.enable"/> = true;
|
||||
<xref linkend="opt-services.xserver.displayManager.gdm.enable"/> = true;
|
||||
</programlisting>
|
||||
|
||||
<note>
|
||||
<para>
|
||||
While it is not strictly necessary to use GDM as the display manager with GNOME, it is recommended, as some features such as screen lock <link xlink:href="#sec-gnome-faq-can-i-use-lightdm-with-gnome">might not work</link> without it.
|
||||
</para>
|
||||
</note>
|
||||
|
||||
<para>
|
||||
The default applications used in NixOS are very minimal, inspired by the defaults used in <link xlink:href="https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/40.0/elements/core/meta-gnome-core-utilities.bst">gnome-build-meta</link>.
|
||||
</para>
|
||||
|
||||
<section xml:id="sec-gnome-without-the-apps">
|
||||
<title>GNOME without the apps</title>
|
||||
|
||||
<para>
|
||||
If you’d like to only use the GNOME desktop and not the apps, you can disable them with:
|
||||
</para>
|
||||
|
||||
<programlisting>
|
||||
<xref linkend="opt-services.gnome.core-utilities.enable"/> = false;
|
||||
</programlisting>
|
||||
|
||||
<para>
|
||||
and none of them will be installed.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
If you’d only like to omit a subset of the core utilities, you can use <xref linkend="opt-environment.gnome.excludePackages"/>.
|
||||
Note that this mechanism can only exclude core utilities, games and core developer tools.
|
||||
</para>
|
||||
</section>
|
||||
|
||||
<section xml:id="sec-gnome-disabling-services">
|
||||
<title>Disabling GNOME services</title>
|
||||
|
||||
<para>
|
||||
It is also possible to disable many of the <link xlink:href="https://github.com/NixOS/nixpkgs/blob/b8ec4fd2a4edc4e30d02ba7b1a2cc1358f3db1d5/nixos/modules/services/x11/desktop-managers/gnome.nix#L329-L348">core services</link>. For example, if you do not need indexing files, you can disable Tracker with:
|
||||
</para>
|
||||
|
||||
<programlisting>
|
||||
<xref linkend="opt-services.gnome.tracker-miners.enable"/> = false;
|
||||
<xref linkend="opt-services.gnome.tracker.enable"/> = false;
|
||||
</programlisting>
|
||||
|
||||
<para>
|
||||
Note, however, that doing so is not supported and might break some applications. Notably, GNOME Music cannot work without Tracker.
|
||||
</para>
|
||||
</section>
|
||||
|
||||
<section xml:id="sec-gnome-games">
|
||||
<title>GNOME games</title>
|
||||
|
||||
<para>
|
||||
You can install all of the GNOME games with:
|
||||
</para>
|
||||
|
||||
<programlisting>
|
||||
<xref linkend="opt-services.gnome.games.enable"/> = true;
|
||||
</programlisting>
|
||||
</section>
|
||||
|
||||
<section xml:id="sec-gnome-core-developer-tools">
|
||||
<title>GNOME core developer tools</title>
|
||||
|
||||
<para>
|
||||
You can install GNOME core developer tools with:
|
||||
</para>
|
||||
|
||||
<programlisting>
|
||||
<xref linkend="opt-services.gnome.core-developer-tools.enable"/> = true;
|
||||
</programlisting>
|
||||
</section>
|
||||
</section>
|
||||
|
||||
<section xml:id="sec-gnome-enable-flashback">
|
||||
<title>Enabling GNOME Flashback</title>
|
||||
|
||||
<para>
|
||||
GNOME Flashback provides a desktop environment based on the classic GNOME 2 architecture. You can enable the default GNOME Flashback session, which uses the Metacity window manager, with:
|
||||
</para>
|
||||
|
||||
<programlisting>
|
||||
<xref linkend="opt-services.xserver.desktopManager.gnome.flashback.enableMetacity"/> = true;
|
||||
</programlisting>
|
||||
|
||||
<para>
|
||||
It is also possible to create custom sessions that replace Metacity with a different window manager using <xref linkend="opt-services.xserver.desktopManager.gnome.flashback.customSessions"/>.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
The following example uses <literal>xmonad</literal> window manager:
|
||||
</para>
|
||||
|
||||
<programlisting>
|
||||
<xref linkend="opt-services.xserver.desktopManager.gnome.flashback.customSessions"/> = [
|
||||
{
|
||||
wmName = "xmonad";
|
||||
wmLabel = "XMonad";
|
||||
wmCommand = "${pkgs.haskellPackages.xmonad}/bin/xmonad";
|
||||
}
|
||||
];
|
||||
</programlisting>
|
||||
|
||||
</section>
|
||||
<section xml:id="sec-gnome-gdm">
|
||||
<title>GDM</title>
|
||||
|
||||
<para>
|
||||
If you want to use GNOME Wayland session on Nvidia hardware, you need to enable:
|
||||
</para>
|
||||
|
||||
<programlisting>
|
||||
<xref linkend="opt-services.xserver.displayManager.gdm.nvidiaWayland"/> = true;
|
||||
</programlisting>
|
||||
|
||||
<para>
|
||||
as the default configuration will forbid this.
|
||||
</para>
|
||||
</section>
|
||||
|
||||
<section xml:id="sec-gnome-icons-and-gtk-themes">
|
||||
<title>Icons and GTK Themes</title>
|
||||
|
||||
<para>
|
||||
Icon themes and GTK themes don’t require any special option to install in NixOS.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
You can add them to <xref linkend="opt-environment.systemPackages"/> and switch to them with GNOME Tweaks.
|
||||
If you’d like to do this manually in dconf, change the values of the following keys:
|
||||
</para>
|
||||
|
||||
<programlisting>
|
||||
/org/gnome/desktop/interface/gtk-theme
|
||||
/org/gnome/desktop/interface/icon-theme
|
||||
</programlisting>
|
||||
|
||||
<para>
|
||||
in <literal>dconf-editor</literal>
|
||||
</para>
|
||||
</section>
|
||||
|
||||
<section xml:id="sec-gnome-shell-extensions">
|
||||
<title>Shell Extensions</title>
|
||||
|
||||
<para>
|
||||
Most Shell extensions are packaged under the <literal>gnomeExtensions</literal> attribute.
|
||||
Some packages that include Shell extensions, like <literal>gnome.gpaste</literal>, don’t have their extension decoupled under this attribute.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
You can install them like any other package:
|
||||
</para>
|
||||
|
||||
<programlisting>
|
||||
<xref linkend="opt-environment.systemPackages"/> = [
|
||||
gnomeExtensions.dash-to-dock
|
||||
gnomeExtensions.gsconnect
|
||||
gnomeExtensions.mpris-indicator-button
|
||||
];
|
||||
</programlisting>
|
||||
|
||||
<para>
|
||||
Unfortunately, we lack a way for these to be managed in a completely declarative way.
|
||||
So you have to enable them manually with an Extensions application.
|
||||
It is possible to use a <link xlink:href="#sec-gnome-gsettings-overrides">GSettings override</link> for this on <literal>org.gnome.shell.enabled-extensions</literal>, but that will only influence the default value.
|
||||
</para>
|
||||
</section>
|
||||
|
||||
<section xml:id="sec-gnome-gsettings-overrides">
|
||||
<title>GSettings Overrides</title>
|
||||
|
||||
<para>
|
||||
Majority of software building on the GNOME platform use GLib’s <link xlink:href="https://developer.gnome.org/gio/unstable/GSettings.html">GSettings</link> system to manage runtime configuration. For our purposes, the system consists of XML schemas describing the individual configuration options, stored in the package, and a settings backend, where the values of the settings are stored. On NixOS, like on most Linux distributions, dconf database is used as the backend.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
<link xlink:href="https://developer.gnome.org/gio/unstable/GSettings.html#id-1.4.19.2.9.25">GSettings vendor overrides</link> can be used to adjust the default values for settings of the GNOME desktop and apps by replacing the default values specified in the XML schemas. Using overrides will allow you to pre-seed user settings before you even start the session.
|
||||
</para>
|
||||
|
||||
<warning>
|
||||
<para>
|
||||
Overrides really only change the default values for GSettings keys so if you or an application changes the setting value, the value set by the override will be ignored. Until <link xlink:href="https://github.com/NixOS/nixpkgs/issues/54150">NixOS’s dconf module implements changing values</link>, you will either need to keep that in mind and clear the setting from the backend using <literal>dconf reset</literal> command when that happens, or use the <link xlink:href="https://nix-community.github.io/home-manager/options.html#opt-dconf.settings">module from home-manager</link>.
|
||||
</para>
|
||||
</warning>
|
||||
|
||||
<para>
|
||||
You can override the default GSettings values using the <xref linkend="opt-services.xserver.desktopManager.gnome.extraGSettingsOverrides"/> option.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
Take note that whatever packages you want to override GSettings for, you need to add them to
|
||||
<xref linkend="opt-services.xserver.desktopManager.gnome.extraGSettingsOverridePackages"/>.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
You can use <literal>dconf-editor</literal> tool to explore which GSettings you can set.
|
||||
</para>
|
||||
|
||||
<section xml:id="sec-gnome-gsettings-overrides-example">
|
||||
<title>Example</title>
|
||||
|
||||
<programlisting>
|
||||
services.xserver.desktopManager.gnome = {
|
||||
<link xlink:href="#opt-services.xserver.desktopManager.gnome.extraGSettingsOverrides">extraGSettingsOverrides</link> = ''
|
||||
# Change default background
|
||||
[org.gnome.desktop.background]
|
||||
picture-uri='file://${pkgs.nixos-artwork.wallpapers.mosaic-blue.gnomeFilePath}'
|
||||
|
||||
# Favorite apps in gnome-shell
|
||||
[org.gnome.shell]
|
||||
favorite-apps=['org.gnome.Photos.desktop', 'org.gnome.Nautilus.desktop']
|
||||
'';
|
||||
|
||||
<link xlink:href="#opt-services.xserver.desktopManager.gnome.extraGSettingsOverridePackages">extraGSettingsOverridePackages</link> = [
|
||||
pkgs.gsettings-desktop-schemas # for org.gnome.desktop
|
||||
pkgs.gnome.gnome-shell # for org.gnome.shell
|
||||
];
|
||||
};
|
||||
</programlisting>
|
||||
</section>
|
||||
</section>
|
||||
|
||||
<section xml:id="sec-gnome-faq">
|
||||
<title>Frequently Asked Questions</title>
|
||||
|
||||
<section xml:id="sec-gnome-faq-can-i-use-lightdm-with-gnome">
|
||||
<title>Can I use LightDM with GNOME?</title>
|
||||
|
||||
<para>
|
||||
Yes you can, and any other display-manager in NixOS.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
However, it doesn’t work correctly for the Wayland session of GNOME Shell yet, and
|
||||
won’t be able to lock your screen.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
See <link xlink:href="https://github.com/NixOS/nixpkgs/issues/56342">this issue.</link>
|
||||
</para>
|
||||
</section>
|
||||
|
||||
<section xml:id="sec-gnome-faq-nixos-rebuild-switch-kills-session">
|
||||
<title>Why does <literal>nixos-rebuild switch</literal> sometimes kill my session?</title>
|
||||
|
||||
<para>
|
||||
This is a known <link xlink:href="https://github.com/NixOS/nixpkgs/issues/44344">issue</link> without any workarounds.
|
||||
If you are doing a fairly large upgrade, it is probably safer to use <literal>nixos-rebuild boot</literal>.
|
||||
</para>
|
||||
</section>
|
||||
</section>
|
||||
</chapter>
|
||||
@@ -716,10 +716,17 @@ let
|
||||
"NTP"
|
||||
"EmitSIP"
|
||||
"SIP"
|
||||
"EmitPOP3"
|
||||
"POP3"
|
||||
"EmitSMTP"
|
||||
"SMTP"
|
||||
"EmitLPR"
|
||||
"LPR"
|
||||
"EmitRouter"
|
||||
"EmitTimezone"
|
||||
"Timezone"
|
||||
"SendOption"
|
||||
"SendVendorOption"
|
||||
])
|
||||
(assertInt "PoolOffset")
|
||||
(assertMinimum "PoolOffset" 0)
|
||||
@@ -728,6 +735,9 @@ let
|
||||
(assertValueOneOf "EmitDNS" boolValues)
|
||||
(assertValueOneOf "EmitNTP" boolValues)
|
||||
(assertValueOneOf "EmitSIP" boolValues)
|
||||
(assertValueOneOf "EmitPOP3" boolValues)
|
||||
(assertValueOneOf "EmitSMTP" boolValues)
|
||||
(assertValueOneOf "EmitLPR" boolValues)
|
||||
(assertValueOneOf "EmitRouter" boolValues)
|
||||
(assertValueOneOf "EmitTimezone" boolValues)
|
||||
];
|
||||
|
||||
@@ -90,7 +90,7 @@ in rec {
|
||||
(onFullSupported "nixos.tests.keymap.azerty")
|
||||
(onFullSupported "nixos.tests.keymap.colemak")
|
||||
(onFullSupported "nixos.tests.keymap.dvorak")
|
||||
(onFullSupported "nixos.tests.keymap.dvp")
|
||||
(onFullSupported "nixos.tests.keymap.dvorak-programmer")
|
||||
(onFullSupported "nixos.tests.keymap.neo")
|
||||
(onFullSupported "nixos.tests.keymap.qwertz")
|
||||
(onFullSupported "nixos.tests.latestKernel.login")
|
||||
|
||||
@@ -29,6 +29,7 @@ in
|
||||
ammonite = handleTest ./ammonite.nix {};
|
||||
apparmor = handleTest ./apparmor.nix {};
|
||||
atd = handleTest ./atd.nix {};
|
||||
atop = handleTest ./atop.nix {};
|
||||
avahi = handleTest ./avahi.nix {};
|
||||
avahi-with-resolved = handleTest ./avahi.nix { networkd = true; };
|
||||
awscli = handleTest ./awscli.nix { };
|
||||
|
||||
@@ -0,0 +1,213 @@
|
||||
{ system ? builtins.currentSystem
|
||||
, config ? { }
|
||||
, pkgs ? import ../.. { inherit system config; }
|
||||
}:
|
||||
|
||||
with import ../lib/testing-python.nix { inherit system pkgs; };
|
||||
with pkgs.lib;
|
||||
|
||||
let assertions = rec {
|
||||
path = program: path: ''
|
||||
with subtest("The path of ${program} should be ${path}"):
|
||||
p = machine.succeed("type -p \"${program}\" | head -c -1")
|
||||
assert p == "${path}", f"${program} is {p}, expected ${path}"
|
||||
'';
|
||||
unit = name: state: ''
|
||||
with subtest("Unit ${name} should be ${state}"):
|
||||
machine.require_unit_state("${name}", "${state}")
|
||||
'';
|
||||
version = ''
|
||||
import re
|
||||
|
||||
with subtest("binary should report the correct version"):
|
||||
pkgver = "${pkgs.atop.version}"
|
||||
ver = re.sub(r'(?s)^Version: (\d\.\d\.\d).*', r'\1', machine.succeed("atop -V"))
|
||||
assert ver == pkgver, f"Version is `{ver}`, expected `{pkgver}`"
|
||||
'';
|
||||
atoprc = contents:
|
||||
if builtins.stringLength contents > 0 then ''
|
||||
with subtest("/etc/atoprc should have the correct contents"):
|
||||
f = machine.succeed("cat /etc/atoprc")
|
||||
assert f == "${contents}", f"/etc/atoprc contents: '{f}', expected '${contents}'"
|
||||
'' else ''
|
||||
with subtest("/etc/atoprc should not be present"):
|
||||
machine.succeed("test ! -e /etc/atoprc")
|
||||
'';
|
||||
wrapper = present:
|
||||
if present then path "atop" "/run/wrappers/bin/atop" + ''
|
||||
with subtest("Wrapper should be setuid root"):
|
||||
stat = machine.succeed("stat --printf '%a %u' /run/wrappers/bin/atop")
|
||||
assert stat == "4511 0", f"Wrapper stat is {stat}, expected '4511 0'"
|
||||
''
|
||||
else path "atop" "/run/current-system/sw/bin/atop";
|
||||
atopService = present:
|
||||
if present then
|
||||
unit "atop.service" "active"
|
||||
+ ''
|
||||
with subtest("atop.service should have written some data to /var/log/atop"):
|
||||
files = int(machine.succeed("ls -1 /var/log/atop | wc -l"))
|
||||
assert files > 0, "Expected at least 1 data file"
|
||||
'' else unit "atop.service" "inactive";
|
||||
atopRotateTimer = present:
|
||||
unit "atop-rotate.timer" (if present then "active" else "inactive");
|
||||
atopacctService = present:
|
||||
if present then
|
||||
unit "atopacct.service" "active"
|
||||
+ ''
|
||||
with subtest("atopacct.service should enable process accounting"):
|
||||
machine.succeed("test -f /run/pacct_source")
|
||||
|
||||
with subtest("atopacct.service should write data to /run/pacct_shadow.d"):
|
||||
files = int(machine.succeed("ls -1 /run/pacct_shadow.d | wc -l"))
|
||||
assert files >= 1, "Expected at least 1 pacct_shadow.d file"
|
||||
'' else unit "atopacct.service" "inactive";
|
||||
netatop = present:
|
||||
if present then
|
||||
unit "netatop.service" "active"
|
||||
+ ''
|
||||
with subtest("The netatop kernel module should be loaded"):
|
||||
out = machine.succeed("modprobe -n -v netatop")
|
||||
assert out == "", f"Module should be loaded already, but modprobe would have done {out}."
|
||||
'' else ''
|
||||
with subtest("The netatop kernel module should be absent"):
|
||||
machine.fail("modprobe -n -v netatop")
|
||||
'';
|
||||
atopgpu = present:
|
||||
if present then
|
||||
(unit "atopgpu.service" "active") + (path "atopgpud" "/run/current-system/sw/bin/atopgpud")
|
||||
else (unit "atopgpu.service" "inactive") + ''
|
||||
with subtest("atopgpud should not be present"):
|
||||
machine.fail("type -p atopgpud")
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
name = "atop";
|
||||
|
||||
justThePackage = makeTest {
|
||||
name = "atop-justThePackage";
|
||||
machine = {
|
||||
environment.systemPackages = [ pkgs.atop ];
|
||||
};
|
||||
testScript = with assertions; builtins.concatStringsSep "\n" [
|
||||
version
|
||||
(atoprc "")
|
||||
(wrapper false)
|
||||
(atopService false)
|
||||
(atopRotateTimer false)
|
||||
(atopacctService false)
|
||||
(netatop false)
|
||||
(atopgpu false)
|
||||
];
|
||||
};
|
||||
defaults = makeTest {
|
||||
name = "atop-defaults";
|
||||
machine = {
|
||||
programs.atop = {
|
||||
enable = true;
|
||||
};
|
||||
};
|
||||
testScript = with assertions; builtins.concatStringsSep "\n" [
|
||||
version
|
||||
(atoprc "")
|
||||
(wrapper false)
|
||||
(atopService true)
|
||||
(atopRotateTimer true)
|
||||
(atopacctService true)
|
||||
(netatop false)
|
||||
(atopgpu false)
|
||||
];
|
||||
};
|
||||
minimal = makeTest {
|
||||
name = "atop-minimal";
|
||||
machine = {
|
||||
programs.atop = {
|
||||
enable = true;
|
||||
atopService.enable = false;
|
||||
atopRotateTimer.enable = false;
|
||||
atopacctService.enable = false;
|
||||
};
|
||||
};
|
||||
testScript = with assertions; builtins.concatStringsSep "\n" [
|
||||
version
|
||||
(atoprc "")
|
||||
(wrapper false)
|
||||
(atopService false)
|
||||
(atopRotateTimer false)
|
||||
(atopacctService false)
|
||||
(netatop false)
|
||||
(atopgpu false)
|
||||
];
|
||||
};
|
||||
netatop = makeTest {
|
||||
name = "atop-netatop";
|
||||
machine = {
|
||||
programs.atop = {
|
||||
enable = true;
|
||||
netatop.enable = true;
|
||||
};
|
||||
};
|
||||
testScript = with assertions; builtins.concatStringsSep "\n" [
|
||||
version
|
||||
(atoprc "")
|
||||
(wrapper false)
|
||||
(atopService true)
|
||||
(atopRotateTimer true)
|
||||
(atopacctService true)
|
||||
(netatop true)
|
||||
(atopgpu false)
|
||||
];
|
||||
};
|
||||
atopgpu = makeTest {
|
||||
name = "atop-atopgpu";
|
||||
machine = {
|
||||
nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (getName pkg) [
|
||||
"cudatoolkit"
|
||||
];
|
||||
|
||||
programs.atop = {
|
||||
enable = true;
|
||||
atopgpu.enable = true;
|
||||
};
|
||||
};
|
||||
testScript = with assertions; builtins.concatStringsSep "\n" [
|
||||
version
|
||||
(atoprc "")
|
||||
(wrapper false)
|
||||
(atopService true)
|
||||
(atopRotateTimer true)
|
||||
(atopacctService true)
|
||||
(netatop false)
|
||||
(atopgpu true)
|
||||
];
|
||||
};
|
||||
everything = makeTest {
|
||||
name = "atop-everthing";
|
||||
machine = {
|
||||
nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (getName pkg) [
|
||||
"cudatoolkit"
|
||||
];
|
||||
|
||||
programs.atop = {
|
||||
enable = true;
|
||||
settings = {
|
||||
flags = "faf1";
|
||||
interval = 2;
|
||||
};
|
||||
setuidWrapper.enable = true;
|
||||
netatop.enable = true;
|
||||
atopgpu.enable = true;
|
||||
};
|
||||
};
|
||||
testScript = with assertions; builtins.concatStringsSep "\n" [
|
||||
version
|
||||
(atoprc "flags faf1\\ninterval 2\\n")
|
||||
(wrapper true)
|
||||
(atopService true)
|
||||
(atopRotateTimer true)
|
||||
(atopacctService true)
|
||||
(netatop true)
|
||||
(atopgpu true)
|
||||
];
|
||||
};
|
||||
}
|
||||
+25
-53
@@ -17,56 +17,27 @@ in
|
||||
let
|
||||
alice = config.users.users.alice;
|
||||
in {
|
||||
# Automatically login on tty1 as a normal user:
|
||||
imports = [ ./common/user-account.nix ];
|
||||
services.getty.autologinUser = "alice";
|
||||
programs.bash.loginShellInit = ''
|
||||
if [ "$(tty)" = "/dev/tty1" ]; then
|
||||
set -e
|
||||
|
||||
mkdir -p ~/.config/cagebreak
|
||||
cp -f ${cagebreakConfigfile} ~/.config/cagebreak/config
|
||||
|
||||
cagebreak
|
||||
fi
|
||||
'';
|
||||
|
||||
hardware.opengl.enable = true;
|
||||
programs.xwayland.enable = true;
|
||||
environment.systemPackages = [ pkgs.cagebreak pkgs.wallutils ];
|
||||
services.xserver = {
|
||||
enable = true;
|
||||
displayManager.autoLogin = {
|
||||
enable = true;
|
||||
user = alice.name;
|
||||
};
|
||||
};
|
||||
services.xserver.windowManager.session = lib.singleton {
|
||||
manage = "desktop";
|
||||
name = "cagebreak";
|
||||
start = ''
|
||||
export XDG_RUNTIME_DIR="/run/user/${toString alice.uid}"
|
||||
${pkgs.cagebreak}/bin/cagebreak &
|
||||
waitPID=$!
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.services.setupCagebreakConfig = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
before = [ "multi-user.target" ];
|
||||
environment = {
|
||||
HOME = alice.home;
|
||||
};
|
||||
unitConfig = {
|
||||
type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
user = alice.name;
|
||||
};
|
||||
script = ''
|
||||
cd $HOME
|
||||
CONFFILE=$HOME/.config/cagebreak/config
|
||||
mkdir -p $(dirname $CONFFILE)
|
||||
cp ${cagebreakConfigfile} $CONFFILE
|
||||
'';
|
||||
};
|
||||
|
||||
# Copied from cage:
|
||||
# this needs a fairly recent kernel, otherwise:
|
||||
# [backend/drm/util.c:215] Unable to add DRM framebuffer: No such file or directory
|
||||
# [backend/drm/legacy.c:15] Virtual-1: Failed to set CRTC: No such file or directory
|
||||
# [backend/drm/util.c:215] Unable to add DRM framebuffer: No such file or directory
|
||||
# [backend/drm/legacy.c:15] Virtual-1: Failed to set CRTC: No such file or directory
|
||||
# [backend/drm/drm.c:618] Failed to initialize renderer on connector 'Virtual-1': initial page-flip failed
|
||||
# [backend/drm/drm.c:701] Failed to initialize renderer for plane
|
||||
boot.kernelPackages = pkgs.linuxPackages_latest;
|
||||
|
||||
virtualisation.memorySize = 1024;
|
||||
# Need to switch to a different VGA card / GPU driver than the default one (std) so that Cagebreak can launch:
|
||||
virtualisation.qemu.options = [ "-vga virtio" ];
|
||||
};
|
||||
|
||||
enableOCR = true;
|
||||
@@ -80,14 +51,15 @@ in
|
||||
machine.wait_for_file("${XDG_RUNTIME_DIR}/wayland-0")
|
||||
|
||||
with subtest("ensure wayland works with wayinfo from wallutils"):
|
||||
machine.succeed("env XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR} wayinfo")
|
||||
print(machine.succeed("env XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR} wayinfo"))
|
||||
|
||||
with subtest("ensure xwayland works with xterm"):
|
||||
machine.send_key("ctrl-t")
|
||||
machine.send_key("t")
|
||||
machine.wait_until_succeeds("pgrep xterm")
|
||||
machine.wait_for_text("${user.name}@machine")
|
||||
machine.screenshot("screen")
|
||||
machine.send_key("ctrl-d")
|
||||
# TODO: Fix the XWayland test (log the cagebreak output to debug):
|
||||
# with subtest("ensure xwayland works with xterm"):
|
||||
# machine.send_key("ctrl-t")
|
||||
# machine.send_key("t")
|
||||
# machine.wait_until_succeeds("pgrep xterm")
|
||||
# machine.wait_for_text("${user.name}@machine")
|
||||
# machine.screenshot("screen")
|
||||
# machine.send_key("ctrl-d")
|
||||
'';
|
||||
})
|
||||
|
||||
@@ -44,12 +44,11 @@ import ./make-test-python.nix ({ pkgs, ...} :
|
||||
# - https://github.com/NixOS/nixpkgs/issues/108772
|
||||
# - https://github.com/NixOS/nixpkgs/pull/117555
|
||||
print(machine.succeed("su - alice -c 'file ~/.config/Signal/sql/db.sqlite'"))
|
||||
# TODO: The DB should be encrypted and the following should be machine.fail
|
||||
# instead of machine.succeed but the DB is currently unencrypted and we
|
||||
# want to notice if this isn't the case anymore as the transition to a
|
||||
# encrypted DB can cause data loss!:
|
||||
machine.succeed(
|
||||
"su - alice -c 'file ~/.config/Signal/sql/db.sqlite' | grep -i sqlite"
|
||||
"su - alice -c 'file ~/.config/Signal/sql/db.sqlite' | grep 'db.sqlite: data'"
|
||||
)
|
||||
machine.fail(
|
||||
"su - alice -c 'file ~/.config/Signal/sql/db.sqlite' | grep -e SQLite -e database"
|
||||
)
|
||||
'';
|
||||
})
|
||||
|
||||
@@ -3,7 +3,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: let
|
||||
v2rayUser = {
|
||||
# A random UUID.
|
||||
id = "a6a46834-2150-45f8-8364-0f6f6ab32384";
|
||||
alterId = 4;
|
||||
alterId = 0; # Non-zero support will be disabled in the future.
|
||||
};
|
||||
|
||||
# 1080 [http proxy] -> 1081 [vmess] -> direct
|
||||
|
||||
Reference in New Issue
Block a user