public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
254,881 Commits 1 Branch 0 Tags
60c54866ede05a162cff0df0802aa8ac4dccf708
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Graham Christensen d9c3f13df3 Merge pull request #104776 from grahamc/utillinux 
utillinux: rename to util-linux
 2020-11-24 15:14:36 -05:00
Graham Christensen bc49a0815a utillinux: rename to util-linux 2020-11-24 12:42:06 -05:00
Graham Christensen 22965d84d5 sssd: fix build on glibc-2.32 
For https://hydra.nixos.org/build/128488320 which errored with:

    src/responder/nss/nss_cmd.c:733:16: error: 'nss_setnetgrent' redeclared as different kind of symbol
      733 | static errno_t nss_setnetgrent(struct cli_ctx *cli_ctx,
          |                ^~~~~~~~~~~~~~~
    In file included from ./src/sss_client/sss_cli.h:28,
                     from ./src/db/sysdb.h:27,
                     from src/responder/nss/nss_cmd.c:26:
    /nix/store/a2n8nrsf215x01a7fv8l94crdjwf69pa-glibc-2.32-dev/include/nss.h:184:25: note: previous declaration of 'nss_setnetgrent' was here
      184 | typedef enum nss_status nss_setnetgrent (const char *, struct __netgrent *);
          |                         ^~~~~~~~~~~~~~~
    make[2]: *** [Makefile:17818: src/responder/nss/nss_cmd.o] Error 1
    make[2]: Leaving directory '/build/sssd-1.16.4'
    make[1]: *** [Makefile:33824: all-recursive] Error 1
    make[1]: Leaving directory '/build/sssd-1.16.4'
    make: *** [Makefile:10123: all] Error 2
 2020-11-24 09:50:33 -05:00
Graham Christensen b8a78e5b2a Merge pull request #104702 from NixOS/revert-104484-danderson/influxdb2 
Revert "influxdb2: init at v2.0.2"
 2020-11-23 14:56:14 -05:00
Graham Christensen fbc4af5725 Revert "influxdb2: init at v2.0.2 (#104484)" 
This reverts commit ecbe92e576.
 2020-11-23 14:55:26 -05:00
Graham Christensen 1ee1134cb1 Merge pull request #104456 from endgame/refresh-instance-metadata-on-boot 
Refresh instance metadata on boot
 2020-11-22 08:23:14 -05:00
Graham Christensen 75d7828724 Merge pull request #98544 from Mic92/unfuck-update-user-group 
nixos/update-user-groups: Fix encoding issues + atomic writes
 2020-11-20 10:28:52 -05:00
Graham Christensen e52ecd43c5 Merge pull request #104335 from grahamc/amazon-image-fixup2 
nixos: release-combined: only build the amazon image for x86_64,aarch…
 2020-11-19 21:09:11 -05:00
Graham Christensen b339462460 nixos: release-combined: only build the amazon image for x86_64,aarch64-linux -- exclude i686 2020-11-19 19:34:23 -05:00
Graham Christensen 1115df837e Merge pull request #104322 from grahamc/amazon-image 
nixos/release-small: add amazonImage
 2020-11-19 18:45:07 -05:00
Graham Christensen 1ef139f3b0 nixos/release-small: add amazonImage 
fixup breakage from #104193
 2020-11-19 17:45:40 -05:00
Graham Christensen 7fa7bf2fda Merge pull request #104193 from grahamc/ec2-metadata-imdsv2 
NixOS EC2 AMI: Support IMDSv2
 2020-11-19 16:11:32 -05:00
Graham Christensen 0d87ce610e nixos: release: add amazonImage as a channel blocker 2020-11-19 13:56:55 -05:00
Graham Christensen f2cfecdec3 nixos ami: preflight the imds token 
According to Freenode's ##AWS, the metadata server can sometimes
take a few moments to get its shoes on, and the very first boot
of a machine can see failed requests for a few moments.
 2020-11-19 13:56:44 -05:00
Graham Christensen 83ea88e03f nixos: ec2 ami: support IMDSv2 
AWS's metadata service has two versions. Version 1 allowed plain HTTP
requests to get metadata. However, this was frequently abused when a
user could trick an AWS-hosted server in to proxying requests to the
metadata service. Since the metadata service is frequently used to
generate AWS access keys, this is pretty gnarly. Version two is
identical except it requires the caller to request a token and provide
it on each request.

Today, starting a NixOS AMI in EC2 where the metadata service is
configured to only allow v2 requests fails: the user's SSH key is not
placed, and configuration provided by the user-data is not applied.
The server is useless. This patch addresses that.

Note the dependency on curl is not a joyful one, and it expand the
initrd by 30M. However, see the added comment for more information
about why this is needed. Note the idea of using `echo` and `nc` are
laughable. Don't do that.
 2020-11-19 13:00:56 -05:00
Graham Christensen 21339b41bf nixos: openstack: have its own metadata fetcher expression 
These two APIs have diverged over time and are no longer compatible.
 2020-11-18 11:42:32 -05:00
Graham Christensen f9121be82e Merge pull request #103307 from grahamc/zfs-scripts 
zfs: extend zpool scripts with :$PATH, remove sudo
 2020-11-10 10:20:02 -05:00
Graham Christensen b3d4f5dada zfs: extend zpool scripts with :$PATH, remove sudo 
sudo the package is not suid, so remove it from the PATH. Extend
PATH with $PATH to fetch sudo from the outer PATH. Move the generation
of `path` in to Nix, so the sed expression can use single quotes,
which prevents $PATH being interpolated at build-time.
 2020-11-10 08:50:22 -05:00
Graham Christensen 43b99f23b3 Merge pull request #102532 from grahamc/nixUnstable-bump 
nixUnstable: 3.0pre20201020_e0ca98c -> 2.4pre20201102_550e11f
 2020-11-02 17:15:14 -05:00
Graham Christensen f4f9f307a4 nixUnstable: 3.0pre20201020_e0ca98c -> 2.4pre20201102_550e11f 2020-11-02 16:53:06 -05:00
Graham Christensen 75a2bc94fa Merge pull request #101192 from grahamc/nixpkgs-location-basic-auth 
nginx: support basic auth in location blocks
 2020-11-02 09:44:54 -05:00
Graham Christensen 3361a037b9 nginx: add a warning that nginx's basic auth isn't very good. 2020-11-02 08:16:01 -05:00
Graham Christensen a4b86b2bf5 nginx: test basic auth 2020-11-02 08:16:01 -05:00
Graham Christensen c7bf3828f0 nginx: add basic auth support for locations 2020-11-02 08:16:00 -05:00
Graham Christensen 33cf4f0e8e nginx: factor out the generation of basic auth generation 2020-11-02 08:16:00 -05:00
Graham Christensen 800ebd4561 Merge pull request #102201 from danderson/danderson/add-cli-to-path 
nixos/tailscale: add tailscale to environment.systemPackages.
 2020-10-30 21:22:16 -04:00
Graham Christensen 38a394bdee Merge pull request #102174 from grahamc/ami-root-use-gpt 
AMI root partition table: use GPT to support >2T partitions
 2020-10-30 16:14:37 -04:00
Graham Christensen 860a3a23c6 Merge pull request #102175 from grahamc/ami-random 
amazon-image: random.trust_cpu=on to cut 10s from boot
 2020-10-30 16:13:41 -04:00
Graham Christensen c06b97175b Merge pull request #102173 from grahamc/create-amis 
create-amis.sh: fixup shellcheck issues, improve error logging, and add configurable service names
 2020-10-30 16:13:18 -04:00
Graham Christensen 82578fc725 Merge pull request #102172 from grahamc/stage-1-datestamps 
stage-1: add datestamps to logs
 2020-10-30 16:13:02 -04:00
Graham Christensen b34cf366aa Merge pull request #102171 from grahamc/faster-ext-resize 
stage-1: modprobe ext{2,3,4} before resizing (so resizing takes less than 45 minutes)
 2020-10-30 16:12:50 -04:00
Graham Christensen d77ddf2a40 nixos.amazonAmi: use legacy+gpt disk images to support partitions >2T 2020-10-30 15:50:25 -04:00
Graham Christensen d78aa080f5 make-disk-image: support legacy+gpt 2020-10-30 15:50:24 -04:00
Graham Christensen c851030763 amazon-image: random.trust_cpu=on to cut 10s from boot 
Ubuntu and other distros already have this set via kernel config.
 2020-10-30 13:45:19 -04:00
Graham ChristensenandCole Helbling 74a577b293 create-amis: improve wording around the service name's IAM role 
Co-authored-by: Cole Helbling <cole.e.helbling@outlook.com>
 2020-10-30 12:40:17 -04:00
Graham Christensen ece5c0f304 stage-1: modprobe ext{2,3,4} before resizing 
I noticed booting a system with an ext4 root which expanded to 5T took
quite a long time (12 minutes in some cases, 43(!) in others.)

I changed stage-1 to run `resize2fs -d 62` for extra debug output and
timing information. It revealed the adjust_superblock step taking
almost all of the time:

    [Fri Oct 30 11:10:15 UTC 2020] zero_high_bits_in_metadata: Memory used: 132k/0k (63k/70k), time:  0.00/ 0.00/ 0.00
    [Fri Oct 30 11:21:09 UTC 2020] adjust_superblock: Memory used: 396k/4556k (295k/102k), time: 654.21/ 0.59/ 5.13

but when I ran resize2fs on a disk with the identical content growing
to the identical target size, it would only take about 30 seconds. I
looked at what happened between those two steps in the fast case with
strace and found:

```
   235	getrusage(RUSAGE_SELF, {ru_utime={tv_sec=0, tv_usec=1795}, ru_stime={tv_sec=0, tv_usec=3590}, ...}) = 0
   236	write(1, "zero_high_bits_in_metadata: Memo"..., 84zero_high_bits_in_metadata: Memory used: 132k/0k (72k/61k), time:  0.00/ 0.00/ 0.00
   237	) = 84
   238	gettimeofday({tv_sec=1604061278, tv_usec=480147}, NULL) = 0
   239	getrusage(RUSAGE_SELF, {ru_utime={tv_sec=0, tv_usec=1802}, ru_stime={tv_sec=0, tv_usec=3603}, ...}) = 0
   240	gettimeofday({tv_sec=1604061278, tv_usec=480192}, NULL) = 0
   241	mmap(NULL, 2564096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa3c7355000
   242	access("/sys/fs/ext4/features/lazy_itable_init", F_OK) = 0
   243	brk(0xf85000)                           = 0xf85000
   244	brk(0xfa6000)                           = 0xfa6000
   245	gettimeofday({tv_sec=1604061278, tv_usec=538828}, NULL) = 0
   246	getrusage(RUSAGE_SELF, {ru_utime={tv_sec=0, tv_usec=58720}, ru_stime={tv_sec=0, tv_usec=3603}, ...}) = 0
   247	write(1, "adjust_superblock: Memory used: "..., 79adjust_superblock: Memory used: 396k/2504k (305k/92k), time:  0.06/ 0.06/ 0.00
   248	) = 79
   249	gettimeofday({tv_sec=1604061278, tv_usec=539119}, NULL) = 0
   250	getrusage(RUSAGE_SELF, {ru_utime={tv_sec=0, tv_usec=58812}, ru_stime={tv_sec=0, tv_usec=3603}, ...}) = 0
   251	gettimeofday({tv_sec=1604061279, tv_usec=939}, NULL) = 0
   252	getrusage(RUSAGE_SELF, {ru_utime={tv_sec=0, tv_usec=520411}, ru_stime={tv_sec=0, tv_usec=3603}, ...}) = 0
   253	write(1, "fix_uninit_block_bitmaps 2: Memo"..., 88fix_uninit_block_bitmaps 2: Memory used: 396k/2504k (305k/92k), time:  0.46/ 0.46/ 0.00
   254	) = 88
```

In particular the access to /sys/fs seemed interesting. Looking
at the source of resize2fs:

```
[root@ip-172-31-22-182:~/e2fsprogs-1.45.5]# rg -B2 -A1 /sys/fs/ext4/features/lazy_itable_init .
./resize/resize2fs.c
923-	if (getenv("RESIZE2FS_FORCE_LAZY_ITABLE_INIT") ||
924-	    (!getenv("RESIZE2FS_FORCE_ITABLE_INIT") &&
925:	     access("/sys/fs/ext4/features/lazy_itable_init", F_OK) == 0))
926-		lazy_itable_init = 1;
```

I confirmed /sys is mounted, and then found a bug suggesting the
ext4 module is maybe not loaded:
https://bugzilla.redhat.com/show_bug.cgi?id=1071909

My home server doesn't have ext4 loaded and had 3T to play with, so
I tried (and succeeded with) replicating the issue locally:

```
[root@kif:/scratch]# lsmod | grep -i ext

[root@kif:/scratch]# zfs create -V 3G rpool/scratch/ext4

[root@kif:/scratch]# time mkfs.ext4 /dev/zvol/rpool/scratch/ext4
mke2fs 1.45.5 (07-Jan-2020)
Discarding device blocks: done
Creating filesystem with 786432 4k blocks and 196608 inodes
Filesystem UUID: 560a4a8f-93dc-40cc-97a5-f10049bf801f
Superblock backups stored on blocks:
	32768, 98304, 163840, 229376, 294912

Allocating group tables: done
Writing inode tables: done
Creating journal (16384 blocks): done
Writing superblocks and filesystem accounting information: done

real	0m2.261s
user	0m0.000s
sys	0m0.025s

[root@kif:/scratch]# zfs set volsize=3T rpool/scratch/ext4

[root@kif:/scratch]# time resize2fs -d 62 /dev/zvol/rpool/scratch/ext4
resize2fs 1.45.5 (07-Jan-2020)
fs has 11 inodes, 1 groups required.
fs requires 16390 data blocks.
With 1 group(s), we have 22234 blocks available.
Last group's overhead is 10534
Need 16390 data blocks in last group
Final size of last group is 26924
Estimated blocks needed: 26924
Extents safety margin: 49
Resizing the filesystem on /dev/zvol/rpool/scratch/ext4 to 805306368 (4k) blocks.
read_bitmaps: Memory used: 132k/0k (63k/70k), time:  0.00/ 0.00/ 0.00
read_bitmaps: I/O read: 1MB, write: 0MB, rate: 3802.28MB/s
fix_uninit_block_bitmaps 1: Memory used: 132k/0k (63k/70k), time:  0.00/ 0.00/ 0.00
resize_group_descriptors: Memory used: 132k/0k (68k/65k), time:  0.00/ 0.00/ 0.00
move_bg_metadata: Memory used: 132k/0k (68k/65k), time:  0.00/ 0.00/ 0.00
zero_high_bits_in_metadata: Memory used: 132k/0k (68k/65k), time:  0.00/ 0.00/ 0.00
```

here it got stuck for quite some time ... straceing this 20 minutes in revealed this in a tight loop:

```
getuid()                                = 0
geteuid()                               = 0
getgid()                                = 0
getegid()                               = 0
prctl(PR_GET_DUMPABLE)                  = 1 (SUID_DUMP_USER)
fallocate(3, FALLOC_FL_ZERO_RANGE, 2222649901056, 2097152) = 0
fsync(3)                                = 0
```

it finally ended 43(!) minutes later:

```
adjust_superblock: Memory used: 264k/3592k (210k/55k), time: 2554.03/ 0.16/15.07
fix_uninit_block_bitmaps 2: Memory used: 264k/3592k (210k/55k), time:  0.16/ 0.16/ 0.00
blocks_to_move: Memory used: 264k/3592k (211k/54k), time:  0.00/ 0.00/ 0.00
Number of free blocks: 755396/780023556, Needed: 0
block_mover: Memory used: 264k/3592k (216k/49k), time:  0.05/ 0.01/ 0.00
block_mover: I/O read: 1MB, write: 0MB, rate: 18.68MB/s
inode_scan_and_fix: Memory used: 264k/3592k (216k/49k), time:  0.00/ 0.00/ 0.00
inode_ref_fix: Memory used: 264k/3592k (216k/49k), time:  0.00/ 0.00/ 0.00
move_itables: Memory used: 264k/3592k (216k/49k), time:  0.00/ 0.00/ 0.00
calculate_summary_stats: Memory used: 264k/3592k (216k/49k), time: 16.35/16.35/ 0.00
fix_resize_inode: Memory used: 264k/3592k (222k/43k), time:  0.04/ 0.00/ 0.00
fix_resize_inode: I/O read: 1MB, write: 0MB, rate: 22.80MB/s
fix_sb_journal_backup: Memory used: 264k/3592k (222k/43k), time:  0.00/ 0.00/ 0.00
overall resize2fs: Memory used: 264k/3592k (222k/43k), time: 2570.90/16.68/15.07
overall resize2fs: I/O read: 1MB, write: 1MB, rate: 0.00MB/s
The filesystem on /dev/zvol/rpool/scratch/ext4 is now 805306368 (4k) blocks long.

real	43m1.943s
user	0m16.761s
sys	0m15.069s
```

I then cleaned up and recreated the zvol, loaded the ext4 module, created the ext4 fs,
resized the volume, and resize2fs'd and it went quite quickly:

```
[root@kif:/scratch]# zfs destroy rpool/scratch/ext4

[root@kif:/scratch]# zfs create -V 3G rpool/scratch/ext4

[root@kif:/scratch]# modprobe ext4

[root@kif:/scratch]# time resize2fs -d 62 /dev/zvol/rpool/scratch/ext4

[root@kif:/scratch]# time mkfs.ext4 /dev/zvol/rpool/scratch/ext4
mke2fs 1.45.5 (07-Jan-2020)
Discarding device blocks: done
Creating filesystem with 786432 4k blocks and 196608 inodes
Filesystem UUID: 5b415f2f-a8c4-4ba0-ac1d-78860de77610
Superblock backups stored on blocks:
	32768, 98304, 163840, 229376, 294912

Allocating group tables: done
Writing inode tables: done
Creating journal (16384 blocks): done
Writing superblocks and filesystem accounting information: done

real	0m1.013s
user	0m0.001s
sys	0m0.023s

[root@kif:/scratch]# zfs set volsize=3T rpool/scratch/ext4

[root@kif:/scratch]# time resize2fs -d 62 /dev/zvol/rpool/scratch/ext4
resize2fs 1.45.5 (07-Jan-2020)
fs has 11 inodes, 1 groups required.
fs requires 16390 data blocks.
With 1 group(s), we have 22234 blocks available.
Last group's overhead is 10534
Need 16390 data blocks in last group
Final size of last group is 26924
Estimated blocks needed: 26924
Extents safety margin: 49
Resizing the filesystem on /dev/zvol/rpool/scratch/ext4 to 805306368 (4k) blocks.
read_bitmaps: Memory used: 132k/0k (63k/70k), time:  0.00/ 0.00/ 0.00
read_bitmaps: I/O read: 1MB, write: 0MB, rate: 3389.83MB/s
fix_uninit_block_bitmaps 1: Memory used: 132k/0k (63k/70k), time:  0.00/ 0.00/ 0.00
resize_group_descriptors: Memory used: 132k/0k (68k/65k), time:  0.00/ 0.00/ 0.00
move_bg_metadata: Memory used: 132k/0k (68k/65k), time:  0.00/ 0.00/ 0.00
zero_high_bits_in_metadata: Memory used: 132k/0k (68k/65k), time:  0.00/ 0.00/ 0.00
adjust_superblock: Memory used: 264k/1540k (210k/55k), time:  0.02/ 0.02/ 0.00
fix_uninit_block_bitmaps 2: Memory used: 264k/1540k (210k/55k), time:  0.15/ 0.15/ 0.00
blocks_to_move: Memory used: 264k/1540k (211k/54k), time:  0.00/ 0.00/ 0.00
Number of free blocks: 755396/780023556, Needed: 0
block_mover: Memory used: 264k/3592k (216k/49k), time:  0.01/ 0.01/ 0.00
block_mover: I/O read: 1MB, write: 0MB, rate: 157.11MB/s
inode_scan_and_fix: Memory used: 264k/3592k (216k/49k), time:  0.00/ 0.00/ 0.00
inode_ref_fix: Memory used: 264k/3592k (216k/49k), time:  0.00/ 0.00/ 0.00
move_itables: Memory used: 264k/3592k (216k/49k), time:  0.00/ 0.00/ 0.00

calculate_summary_stats: Memory used: 264k/3592k (216k/49k), time: 16.20/16.20/ 0.00
fix_resize_inode: Memory used: 264k/3592k (222k/43k), time:  0.00/ 0.00/ 0.00
fix_resize_inode: I/O read: 1MB, write: 0MB, rate: 5319.15MB/s
fix_sb_journal_backup: Memory used: 264k/3592k (222k/43k), time:  0.00/ 0.00/ 0.00
overall resize2fs: Memory used: 264k/3592k (222k/43k), time: 16.45/16.38/ 0.00
overall resize2fs: I/O read: 1MB, write: 1MB, rate: 0.06MB/s
The filesystem on /dev/zvol/rpool/scratch/ext4 is now 805306368 (4k) blocks long.

real	0m17.908s
user	0m16.386s
sys	0m0.079s
```

Success!
 2020-10-30 12:18:23 -04:00
Graham Christensen a179781696 stage-1: add datestamps to logs 
When the stage-1 logs get imported in to the journal, they all get
loaded with the same timestamp. This makes it difficult to identify
what might be taking a long time in early boot.
 2020-10-30 12:16:35 -04:00
Graham Christensen 2bf1fc0345 create-amis: allow customizing the service role name 
The complete setup on the AWS end can be configured
with the following Terraform configuration. It generates
a ./credentials.sh which I just copy/pasted in to the
create-amis.sh script near the top. Note: the entire stack
of users and bucket can be destroyed at the end of the
import.

    variable "region" {
      type = string
    }
    variable "availability_zone" {
      type = string
    }

    provider "aws" {
      region = var.region
    }

    resource "aws_s3_bucket" "nixos-amis" {
      bucket_prefix = "nixos-amis-"
      lifecycle_rule {
        enabled = true
        abort_incomplete_multipart_upload_days = 1
        expiration {
          days = 7
        }
      }
    }

    resource "local_file" "credential-file" {
      file_permission = "0700"
      filename = "${path.module}/credentials.sh"
      sensitive_content = <<SCRIPT
    export service_role_name="${aws_iam_role.vmimport.name}"
    export bucket="${aws_s3_bucket.nixos-amis.bucket}"
    export AWS_ACCESS_KEY_ID="${aws_iam_access_key.uploader.id}"
    export AWS_SECRET_ACCESS_KEY="${aws_iam_access_key.uploader.secret}"
    SCRIPT
    }

    # The following resources are for the *uploader*
    resource "aws_iam_user" "uploader" {
      name = "nixos-amis-uploader"
    }

    resource "aws_iam_access_key" "uploader" {
      user = aws_iam_user.uploader.name
    }

    resource "aws_iam_user_policy" "upload-to-nixos-amis" {
      user = aws_iam_user.uploader.name

      policy = data.aws_iam_policy_document.upload-policy-document.json
    }

    data "aws_iam_policy_document" "upload-policy-document" {
      statement {
        effect = "Allow"

        actions = [
          "s3:ListBucket",
          "s3:GetBucketLocation",
        ]

        resources = [
          aws_s3_bucket.nixos-amis.arn
        ]
      }

      statement {
        effect = "Allow"

        actions = [
          "s3:PutObject",
          "s3:GetObject",
          "s3:DeleteObject",
        ]

        resources = [
          "${aws_s3_bucket.nixos-amis.arn}/*"
        ]
      }

      statement {
        effect = "Allow"
        actions = [
          "ec2:ImportSnapshot",
          "ec2:DescribeImportSnapshotTasks",
          "ec2:DescribeImportSnapshotTasks",
          "ec2:RegisterImage",
          "ec2:DescribeImages"
        ]
        resources = [
          "*"
        ]
      }
    }

    # The following resources are for the *vmimport service user*
    # See: https://docs.aws.amazon.com/vm-import/latest/userguide/vmie_prereqs.html#vmimport-role
    resource "aws_iam_role" "vmimport" {
      assume_role_policy = data.aws_iam_policy_document.vmimport-trust.json
    }

    resource "aws_iam_role_policy" "vmimport-access" {
      role = aws_iam_role.vmimport.id
      policy = data.aws_iam_policy_document.vmimport-access.json
    }

    data "aws_iam_policy_document" "vmimport-access" {
      statement {
        effect = "Allow"
        actions = [
          "s3:GetBucketLocation",
          "s3:GetObject",
          "s3:ListBucket",
        ]
        resources = [
          aws_s3_bucket.nixos-amis.arn,
          "${aws_s3_bucket.nixos-amis.arn}/*"
        ]
      }
      statement {
        effect = "Allow"
        actions = [
          "ec2:ModifySnapshotAttribute",
          "ec2:CopySnapshot",
          "ec2:RegisterImage",
          "ec2:Describe*"
        ]
        resources = [
          "*"
        ]
      }
    }

    data "aws_iam_policy_document" "vmimport-trust" {
      statement {
        effect = "Allow"
        principals {
          type = "Service"
          identifiers = [ "vmie.amazonaws.com" ]
        }

        actions = [
          "sts:AssumeRole"
        ]

        condition {
          test = "StringEquals"
          variable = "sts:ExternalId"
          values = [ "vmimport" ]
        }
      }
    }
 2020-10-30 12:12:08 -04:00
Graham Christensen e253de8a77 create-amis.sh: log the full response if describing the import snapshot tasks fails 2020-10-30 12:08:01 -04:00
Graham Christensen f92a883ddb nixos ec2/create-amis.sh: shellcheck: $ is not needed in arithmetic 2020-10-30 12:08:01 -04:00
Graham Christensen 7dac8470cf nixos ec2/create-amis.sh: shellcheck: explicitly make the additions to block_device_mappings single strings 2020-10-30 12:08:00 -04:00
Graham Christensen a66a22ca54 nixos ec2/create-amis.sh: shellcheck: read without -r mangles backslashes 2020-10-30 12:08:00 -04:00
Graham Christensen baf7ed3f24 nixos ec2/create-amis.sh: shellcheck: SC2155: Declare and assign separately to avoid masking return values. 2020-10-30 12:07:59 -04:00
Graham Christensen f5994c208d nixos ec2/create-amis.sh: shellcheck: quote state_dir reference 2020-10-30 12:07:59 -04:00
Graham Christensen c76692192a nixos ec2/create-amis.sh: shellcheck: quote region references 2020-10-30 12:07:49 -04:00
Graham Christensen 4770d412c9 Merge pull request #101470 from endocrimes/dani/bump-p4 
p4: 2020.1.1991450 -> 2020.1.2007551
 2020-10-23 12:17:10 -04:00
Graham Christensen ad9c8e6f04 Merge pull request #101416 from endocrimes/dani/tailscale-version 
tailscale: Include version in build flags
 2020-10-23 09:47:28 -04:00
Graham Christensen 8726057fbd Merge pull request #84617 from xfix/remove-rasm-march-native 
rasm: remove -march=native from compilation flags
 2020-10-14 12:02:36 -04:00
Graham Christensen 961a99db3c oil: 0.8.pre6 -> 0.8.1 2020-10-02 08:42:23 -04:00
Graham Christensen d9a93852d4 nixos-rebuild: support --upgrade-all and document --upgrade (#83327) 2020-09-25 17:22:11 +02:00
Graham Christensen fe3a49fd90 Merge pull request #98272 from tnias/nixos_doc_dev_test_link 
nixos/doc: fix dead link
 2020-09-19 09:21:12 -04:00
Graham Christensen 6e98b8ff93 Merge pull request #97790 from Infinisil/release-nixpkgsArgs 
release*: Support nixpkgsArgs for all release-*.nix files
 2020-09-16 09:17:02 -04:00
Graham Christensen ff42f461f0 Merge pull request #93161 from cole-h/rm-tmp 
Remove tmp file from tarball job
 2020-07-15 07:31:31 -04:00
Graham Christensen 0c10b75288 Merge pull request #93110 from grahamc/systemd-executable 
stage-2: parameterized systemd executable
 2020-07-14 15:45:00 -04:00
Graham Christensen 64dd9c1d6a stage-2: parameterized systemd executable 
This lets users do sneaky things before systemd starts, and
permanently affect the environment in which systemd runs. For example,
we could start systemd in a non-default network namespace by setting
the systemdExecutable to a wrapper script containing:

    #!/bin/sh
    ip netns add virtual
    touch /var/run/netns/physical
    mount -o bind /proc/self/ns/net /var/run/netns/physical
    exec ip netns exec virtual systemd

_note: the above example does literally work, but there are unresolved
problems with udev and dhcp._
 2020-07-14 13:18:14 -04:00
Graham Christensen cb330dafd5 Merge pull request #91908 from purcell/libpromhttp 
libpromhttp: init at 0.1.1, build in combination with libprom
 2020-07-08 21:24:23 -04:00
Graham Christensen 84ecbc9a19 libvirtd: don't start libvirtd-tcp.socket by default 
Per upstream:

> libvirtd-tcp.socket - the unit file corresponding to the TCP 16509
> port for non-TLS remote access. This socket should not be configured
> to start on boot until the administrator has configured a suitable
> authentication mechanism.
 2020-07-08 19:50:23 -04:00
Graham Christensen 8d2179a9c6 Merge pull request #91713 from delroth/diffoscope-149 
diffoscope: 148 -> 150
 2020-07-06 10:29:23 -04:00
Graham Christensen 353446511b Merge pull request #92456 from marenz2569/fix-firestarter-v1.7.4-hash 
firestarter: v1.7.4 fix commit hash
 2020-07-06 10:15:39 -04:00
Graham Christensen 9d335706a0 Merge pull request #92092 from ElvishJerricco/zfs-encryption-systemd-ask-password 
ZFS: Update description for requestEncryptionCredentials
 2020-07-02 17:25:53 -04:00
Graham Christensen 105e63469d Merge pull request #91344 from ElvishJerricco/zfs-encryption-systemd-ask-password 
ZFS: Ask for stage 2 encryption passwords using systemd-ask-password
 2020-07-02 14:15:18 -04:00
Graham Christensen 38060ee399 Merge pull request #91666 from Atemu/undervolt-warning 
undervolt: clarify that the service is unofficial
 2020-06-27 08:39:55 -04:00
Graham Christensen 00aebe9011 Merge pull request #89204 from andersk/musescore 
musescore: Add missing inputs qtgraphicaleffects, qtquickcontrols2
 2020-06-23 16:23:41 -04:00
Graham Christensen 740fa4dc5b Merge pull request #91165 from NixOS/revert-91160-nixos-hardware-merge 
Revert "Merge nixos-hardware into nixpkgs under `/nixos/hardware`"
 2020-06-20 08:34:57 -04:00
Graham Christensen 5d0725a063 Revert "Merge nixos-hardware into nixpkgs under /nixos/hardware" 2020-06-20 08:21:15 -04:00
Graham Christensen ac8f8bd752 Merge pull request #90336 from bachp/plex-1.19.4.2935 
plex: 1.19.2.2737 -> 1.19.4.2935
 2020-06-19 11:04:36 -04:00
Graham Christensen 38e990d520 Merge pull request #90673 from grahamc/google-chrome-path 
google-chrome: add coreutils to PATH
 2020-06-17 13:49:24 -04:00
Graham Christensen 5609f90c50 Merge pull request #90672 from grahamc/xdg-util-path 
xdg_utils: xdg-open: add $out to PATH
 2020-06-17 13:49:09 -04:00
Graham Christensen e8ddc0cfa7 google-chrome: add coreutils to PATH 
google-chrome-stable can't run without coreutils in PATH
 2020-06-17 08:32:34 -04:00
Graham Christensen 4b5880f015 xdg_utils: xdg-open: add $out to PATH 
Otherwise, xdg-open cannot call xdg-mime and this does not work:

    "${pkgs.xdg_utils}/bin/xdg-open"
 2020-06-17 08:27:55 -04:00
Graham Christensen 5a17473f0a Merge pull request #90192 from kraem/kraem/pkgs/facetimehd/remove-nixpkgs-patch 
facetimehd: remove patch in nixpkgs, patched upstream
 2020-06-12 11:46:35 -04:00
Graham Christensen 77dddf6a9d Merge pull request #90180 from kraem/kraem/pkgs/facetimehd/2020-04-16 
facetimehd: 2019-12-10 -> 2020-04-16
 2020-06-12 07:59:56 -04:00
Graham Christensen 80b39add79 Merge pull request #90095 from mgdm/add-rtl-ais 
rtl-ais: init at 0.8.1
 2020-06-11 16:15:04 -04:00
Graham Christensen 90c533d649 Merge pull request #89827 from romildo/upd.ibm-plex 
ibm-plex: 4.0.2 -> 5.0.0
 2020-06-09 09:24:56 -04:00
Graham Christensen ac44b7f958 Merge pull request #89797 from dali99/dandellion-mumble-1.3.1 
mumble: 1.3.0 -> 1.3.1
 2020-06-09 06:55:34 -04:00
Graham Christensen 4512cd1385 Merge pull request #60174 from exarkun/patch-2 
Fix the rootPartitionUUID description
 2020-06-02 08:54:51 -04:00
Graham Christensen fb587d7bb5 Merge pull request #85445 from manveru/crystal-all-llvm 
crystal: use llvm 10 exclusively
 2020-05-07 07:49:03 -04:00
Graham Christensen c2d814880a Merge pull request #86969 from prusnak/wxsqlite 
wxsqlite3: 3.3.1 -> 4.5.1
 2020-05-07 07:11:42 -04:00
Graham Christensen fadb044579 Merge pull request #86059 from AmineChikhaoui/20.03-amis 
ec2-amis.nix: add NixOS 20.03 images
 2020-04-26 10:01:56 -04:00
Graham Christensen a2e9965d74 Merge pull request #82414 from AmineChikhaoui/update-ec2-amis-19-09 
ec2 amis: update 19.09 AMIs
 2020-04-25 18:15:41 -04:00
Graham Christensen e42312e354 Merge pull request #85183 from Xe/zig-0.6.0 
zig: upgrade to 0.6.0
 2020-04-17 15:17:45 -04:00
Graham Christensen be9cc04925 Merge pull request #85453 from bqv/patch-1 
sv-kalendar: fix meta
 2020-04-17 14:16:34 -04:00
Graham Christensen b76e3eab18 Merge pull request #84153 from colemickens/nixpkgs-obs-v4lsink 
obs-v4l2sink: init at unstable-20181012
 2020-04-17 08:29:30 -04:00
Graham Christensen ff80d9c19b Merge pull request #77500 from Emantor/pkg/microcom 
microcom: init at 2019.01.0
 2020-04-13 07:46:07 -04:00
Graham Christensen 56c8b7eeda Merge pull request #84946 from bqv/nftables 
nixos/nftables: fix typo in ruleset example
 2020-04-12 09:38:55 -04:00
Graham Christensen 35d8514a91 Merge pull request #81848 from grahamc/nested-specialisation 
specialisation: replace nesting with named configurations
 2020-04-12 08:56:11 -04:00
Graham Christensenandworldofpeace ec2d28e323 specialisation: replace nesting with named configurations 
Co-authored-by: worldofpeace <worldofpeace@protonmail.ch>
 2020-04-12 08:12:50 -04:00
Graham Christensen ab931c607b Merge pull request #84732 from cleverca22/fix-rpi-platforms 
device-tree_rpi: fix platforms
 2020-04-08 12:43:30 -04:00
Graham Christensen 2bf8a722d5 Merge pull request #83249 from bennofs/fix-nixos-aarch64-eval-master 
nixos/release-combined.nix: fix tested/supportedSystems (master version of #82886)
 2020-04-08 08:50:47 -04:00
Graham Christensen eb036df54a Merge pull request #84620 from cleverca22/fix-kafka-test 
nixos: kafka test: fix building for other arches
 2020-04-07 12:31:56 -04:00
Graham Christensen 65d3a18576 Merge pull request #84387 from kraem/fix/facetimehd-linux-5.6 
facetimehd: update src to build with linux >= 5.6
 2020-04-05 16:28:50 -04:00
Graham Christensen be353eb83a Merge pull request #84369 from cleverca22/fix-k3s 
k3s: fix https://hydra.nixos.org/build/116132269
 2020-04-05 15:07:51 -04:00
Graham Christensen 4d226bad77 Merge pull request #83600 from Ma27/hydra-two-stage-deploy 
hydra: 2020-02-06 -> 2020-03-{24,27}
 2020-03-28 19:18:10 -04:00
Graham Christensen 4c94930554 Merge pull request #83235 from helsinki-systems/upd/memcached 
memcached: 1.5.22 -> 1.6.2
 2020-03-24 21:02:27 -04:00
Graham Christensen 66222ad555 Merge pull request #76824 from puzzlewolf/grandorgue/init 
grandorgue: init at 0.3.1-r2333
 2020-03-24 09:59:51 -04:00
Graham Christensen 28cb73749b Merge pull request #82696 from bhipple/u/ami 
nixos-ami: update nvme_core.io_timeout for linux kernel >= 4.15
 2020-03-22 07:18:53 -04:00
Graham Christensen 7f0a2998ef Merge pull request #82941 from flokli/systemd-network-link-no-networkd-without-lib-pushdown 
nixos/systemd: apply .link even when networkd is disabled (without the lib refactor this time)
 2020-03-19 09:53:38 -04:00
Graham Christensen 5e57beab9c Merge pull request #82051 from NixOS/arm-bootstrap 
stdenv: update ARM bootstrap tarballs
 2020-03-16 19:36:00 -04:00
Graham ChristensenandCole Helbling 6b361c3a31 armv{5tel,6l,7l}: bootstrap-files: quote URLs for rfc-45 
Co-authored-by: Cole Helbling <cole.e.helbling@outlook.com>
 2020-03-16 19:04:39 -04:00
Graham Christensen 11b54adeac armv{5tel,6l,7l}: update bootstrap tools after #80497 2020-03-16 18:11:59 -04:00