This fixes the fonts directory availability when not running an xserver,
such as headless machines.
(cherry picked from commit a27dc95e72b5671df59e04853aa48a50d65f2031)
Currently fails with:
$ nixos-rebuild test --target-host myhost --use-remote-sudo
building Nix...
sudo: /run/current-system/sw/bin/sudo must be owned by uid 0 and have the setuid bit set
It seems setting an explicit PATH in the ssh command overrides the
remote setuid wrappers.
(cherry picked from commit 35a8d78e44d566d6d2ddba42ae5137f7a511a090)
If the `default_doi_resolver` and `use_default_settings` are used
together searx crashes.
(cherry picked from commit 2a90b3329b18fadf35bf79966cd2330d83547b7e)
A hard failure breaks the NixOS installer, which can't possibly
know the interface names in advance.
(cherry picked from commit be01320a6c39867eac0a20b4dfe04680d3b1ce26)
I'm not sure how the build broke[1] or how it worked before, but
the problem is zip is being used in place of p7zip, which obviously
fail as the flags have different meanings.
[1]: https://hydra.nixos.org/build/143354937
(cherry picked from commit 302d6b1b8b94f2082f9937d04e27c2aaefb93aa2)
The default backend is chosen based on the content of the $DISPLAY
variable *and* a successfull call to libX11, loaded via dlopen().
The test fails because dlopen looks in /usr/lib and /lib, so matplotlib
falls back to a headless backend.
To reproduce try running:
$ nix-shell -I nixpkgs=$PWD -p \
'python3.withPackages (p: [ p.matplotlib ])' --run python
>>> import matplotlib.pyplot as plt
>>> assert plt.get_backend() == "TkAgg"
(cherry picked from commit 7e2ec8f8a15b77c14c185c4044e99ba05e8b6a38)
Upstream has been providing a very thoroughly designed set of systemd units,
udev and polkit rules. With these the brltty daemon is activated
asynchronously via udev, runs as a dedicated user with runtime and state
directories set up using systemd-tmpfiles.
This is much better than the current unit, which runs a single instance
as root and pulls in systemd-udev-settle to wait for the hardware.
Since 03eaa48 added perl.withPackages, there is a canonical way to
create a perl interpreter from a list of libraries, for use in script
shebangs or generic build inputs. This method is declarative (what we
are doing is clear), produces short shebangs[1] and needs not to wrap
existing scripts.
Unfortunately there are a few exceptions that I've found:
1. Scripts that are calling perl with the -T switch. This makes perl
ignore PERL5LIB, which is what perl.withPackages is using to inform
the interpreter of the library paths.
2. Perl packages that depends on libraries in their own path. This
is not possible because perl.withPackages works at build time. The
workaround is to add `-I $out/${perl.libPrefix}` to the shebang.
In all other cases I propose to switch to perl.withPackages.
[1]: https://lwn.net/Articles/779997/
This hack reduces the source derivation size from 3.7G to 450M by
removing the src/3rparty submodule .git directory and compressing
the whole directory. This is needed to avoid the 2G limit on hydra.
This is a major rewrite of the Privoxy module:
- As per RFC0042, remove privoxy.extraConfig and replace it
with a privoxy.settings option, which maps a NixOS freeform
submodule to the Privoxy configuration format.
- Move all top-level options that mirrored a setting to
the real ones in privoxy.settings. This still keeps the
type-checking, default values and examples in places.
- Add two convenience options: userActions and userFilters, which
simplify the operation of creating a file with pkgs.writeText,
converting it to a string and adding it to the actionsfile/
filterfile list.
- Add a privoxy.inspectHttps option to automagically setup TLS
decryption support. I don't know how long have been waiting
for this feature: can't believe it has just happened.
- Also add a privoxy.certsLifetime to control the periodical
cleanup of the temporary certificates generate by Privoxy.
This dependency has been added in 65eae4d, when NixOS switched to
systemd, as a substitute for the previous udevtrigger and hasn't been
touched since. It's probably unneeded as the upstream unit[1] doesn't
do it and I haven't found any mention of any problem in NixOS or the
upstream issue trackers.
[1]: https://gitlab.com/libvirt/libvirt/-/blob/master/src/remote/libvirtd.service.in
- Actually run tcsd as tss/tss
- Install a udev rule to set /dev/tpm* permissions
- Remove systemd-udev-settle dependency, use dev-tpm0.device instead
- Use systemd-tmpfiles to set up the state directory
- Add documentation URI to tcsd.service
This module cannot be easily tested with a NixOS test due to the TPM
dependency. Technically, one could be emulated using swtpm[1], but this
is not packaged in Nixpkgs. If you computer has a real TPM you can do a
passthrough in Qemu, but this requires running the VM as root and of
course it's not determinstic:
$ nix build -f nixos vm --arg configuration '
{
virtualisation.qemu.options = [
"-tpmdev passthrough,id=tpm0,path=/dev/tpm0,cancel-path=/sys/class/tpm/tpm0/cancel"
"-device tpm-tis,tpmdev=tpm0"
];
users.users.root.hashedPassword = "";
services.tcsd.enable = true;
}'
After starting the VM, log in as root, you can check the service has
started with `systemctl status tcsd`.
[1]: https://github.com/stefanberger/swtpm
- Actually use the zfsSupport option
- Add documentation URI to lxd.service
- Add lxd.socket to enable socket activatation
- Add proper dependencies and remove systemd-udev-settle from lxd.service
- Set up /var/lib/lxc/rootfs using systemd.tmpfiles
- Configure safe start and shutdown of lxd.service
- Configure restart on failures of lxd.service
The sysfs file /sys/kernel/mm/ksm/run seems to be available as soon as
the kernel has started, so no point in waiting for udev to "settle". If
for some reason it doesn't, we let the unit fail explicitly.
It's a dull and boring day, it's cold outside and I'm stuck at home: let
me tell you the story of systemd-vconsole-setup.
In the beginnings of NixOS[1], systemd-vconsole-setup was a powerful
sysinit.target unit, installed and running at boot to set up fonts
keyboard layouts and even colors of the virtual consoles. If needed, the
service would also be restarted after a configuration change, consoles
were happy and everything was good, well, almost.
Since the service had no way to specify the dependency "ttys are ready",
modesetting could sometimes happen *after* systemd-vconsole-setup had
started, leaving the console in a broken state. So abbradar worked
around that by putting a systemd-udev-settle `After=`.
In the meanwhile, probably realizing their mistake, systemd added a
shiny udev rule to start the systemd-udev-settle at the right time[2].
However, the rule bypassed systemd by directly running the binary
`systemd-udev-settle`, and the service - though still installed - fell
into disuse.
Two years would pass before a good samaritan, seeing the poor jobless
systemd-udev-settle service, decided to give it the coup de grâs[3] by
unlisting it from the installed units.
This, combined with another bug, caused quite a commotion[4] in NixOS;
to see why remember the fact that `WantedBy=` in upstream units doesn't
work[5], so it had to be added manually in cc542110, but while systemd
removed it, the NixOS unit continued to install and restart the service,
making a lot of fuss when switching configuration.
After at least thee different tentative fixes, deedrah realised[6] what
the root cause was and fpletz put the final nail[7] in the coffin of
systemd-udev-settle. The service would never see the light of a boot
again, NixOS would not restart it all the time but thanks to udev
consoles would still get their pretty fonts and playful colors.
The En..
..no, wait! You should ask what came of systemd-udev-settle, first.
And why is the service even around if udev is doing all the work?
Udev-settle, like the deceitful snake that he is, laid hidden for years.
He looks innocuous doesn't it? A little hack. Only until it leaves his
den and a poor user[8] drops dead. Obviously, it serves no purpose, as
the service is not part of the boot process anymore, so let's remove it
for good!
About the service, it may not be useful at boot, but it can be started
to pick up changes in vconsole.conf and set the consoles accordingly.
But wait, this doesn't work anymore: the service is never started at
boot (remember f76d2aa6), so switch-to-configuration.pl will not restart
it. Fortunately it can be repaired: here I install a new unit which
does *nothing* on start, but restarts the real service when reloaded.
This perfectly reproduces the original behavior, hopefully without the
original bugs too.
The End?
[1]: https://github.com/NixOS/nixpkgs/commit/cc5421106942ce82473f4afd74d156d8d1e303bd
[2]: https://github.com/systemd/systemd/commit/f6ba8671d83f9fce9a00045d8fa399a1c07ba7fc#diff-84849fddcef81458f69725dc18c6614aade5c4f41a032b6908ebcf1ee6740636
[3]: https://github.com/systemd/systemd/commit/8125e8d38e3aa099c7dce8b0161997b8842aebdc
[4]: https://web.archive.org/web/20180603130107/https://github.com/NixOS/nixpkgs/issues/22470
[5]: https://github.com/NixOS/nixpkgs/issues/81138
[6]: https://web.archive.org/web/20180603130107/https://github.com/NixOS/nixpkgs/issues/22470#issuecomment-330930456
[7]: https://github.com/NixOS/nixpkgs/commit/f76d2aa6e3b4ed6ca9da1e761b1ef2ec36b227c8
[8]: https://github.com/NixOS/nixpkgs/issues/107341
Renaming an interface must be done in stage-1: otherwise udev will
report the interface as ready and network daemons (networkd, dhcpcd,
etc.) will bring it up. Once up the interface can't be changed and the
renaming will fail.
Note: link files are read directly by udev, so they can be used even
without networkd enabled.
Thinkfan underwent some major changes and the config file
is now based on YAML. This commit contains a number of changes:
- rewrite the module to output the new format;
- add a `settings` option, following RFC 0042[1];
- add fancy type-checking for the most critical options
- use upstream systemd units (which fix the resume issue)
[1]: https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md
This is a very simple module that installs a single udev rule.
The rule set the ownership of all /dev/i2c-* devices to a
group, "i2c" by default but can be changed. The "uaccess" tag
also makes systemd add an ACL for users with a seat[1].
Fix issue #91771
[1]: https://enotty.pipebreaker.pl/2012/05/23/linux-automatic-user-acl-management/
- Remove the custom installPhase: upstream has added an install target
and it does a better job than we do
- Improve meta: description -> longDescription and add a short one
- Fix license: GPL3 -> GPL3+
rnhmjoj