Fix build since commit 093cc00cdd
("cc-wrapper: Always export environment variables for binutils").
The apcupsd build system uses "$(STRIP)" as flags for the "install"
program. Now that $STRIP is the path to the strip binary, we cannot pass
that to "install". Fixes this:
...
COPY multimon.cgi => /nix/store/...-apcupsd-3.14.14/libexec/cgi-bin
/nix/store/...-coreutils-8.27/bin/install: cannot stat 'strip': No such file or directory
enableUpstreamMimeTypes controls whether to include the list of mime
types bundled with lighttpd (upstream). This option is enabled by
default and gives a much more complete mime type list than we currently
have. If you disable this, no mime types will be added by NixOS and you
will have to add your own mime types in services.lighttpd.extraConfig.
Place them in $out/share/lighttpd/doc/config/.
Most importantly, this includes a complete set of mime types in the
$out/share/lighttpd/doc/config/conf.d/mime.conf file. The plan is to use
that file in the NixOS lighttpd module.
* mod_dirlisting is auto-loaded by lighttpd and should not be explicitly
loaded in the configuration file.
* The rest comes from looking at "ls -1 $lighttpd/lib/*.so" when
lighttpd is built with "enableMagnet" and "enableMysql".
Suggest prefixing commit messages that touches NixOS code with
"nixos/<module>" instead of the current "<name> service" prefix.
"<name> service" is limiting in that NixOS code is more than the
services. It is also easier to spot NixOS changes with explicit
"nixos/..." prefix.
Use xmlstarlet to update the OVMF path on each startup, like we do for
<emulator>...qemu-kvm</emulator>.
A libvirt domain using UEFI cannot start if the OVMF path is garbage
collected/missing.
Instead of grep and sed, which is brittle.
(I don't know how to preserve the comment we currently add to say that
this line is auto-updated. But I don't think it adds much value, so I'm
not spending any effort on it.)
Adds /dev/disk/by-{id,label}/* symlinks for bcache device nodes, in the
final rootfs.
Symlinks will only be created for bcache devices that contain
filesystems. So if you have a blank bcache device or run LVM on top of
bcache you will not get this kind of symlink.
Or else `services.udev.packages = [ bcache-tools ]` cannot be used.
To not break bcache in the initrd I'm modifying this in stage-1.nix:
- --replace /bin/sh ${extraUtils}/bin/sh
+ --replace ${bash}/bin/sh ${extraUtils}/bin/sh
Reasoning behind that change:
* If not modifying the /bin/sh pattern in any way, it will also match
${bash}/bin/sh, creating a broken path like
/nix/store/HASH-bash/nix/store/HASH-bash/bin/sh in the udev rule file.
* The addition of /bin/sh was done in 775f381a9e
("stage-1: add bcache support"). It seems somewhat plausible that
no new users have appeared since then and we can take this opportunity
to back out of this change without much fear of regressions.
If there _are_ regressions, they should be in the form of build time
errors, not runtime (boot), due to how the udev rule output is checked
for invalid path references. So low risk, IMHO.
* An alternative approach could be to copy the /bin/sh substitute rule
over to the non-initrd udev rules implementation in NixOS, but I think
this way is better:
- The rules file comes with a working path out of the box.
- We can use more precise pattern matching when modifying the udev
rules for the initrd.
* Create "full.pem" from selfsigned certificate
* Tell simp_le to create "full.pem"
* Inject service dependency between lighttpd and the generation of certificates
Side note: According to the internet these servers also use the
"full.pem" format: pound, ejabberd, pure-ftpd.
Fixes this:
.vino-server-wr[8931]: Using the 'memory' GSettings backend. \
Your settings will not be saved or shared with other applications.
Still, the screen sharing settings under "gnome-control-center sharing"
does not seem to be persisted (except the enabling/disabling sharing
flag itself). Making changes and then re-opening gnome-control-center
shows the default screen sharing settings. Sigh.
Without this change there will be silent errors when enabling screen
sharing. The GUI thinks it enables the service when it in fact does not
(errors are seen in the system journal).
vino is already in the closure of gnome-control-center, so this is
basically free.
Configuration of screen sharing is done in GNOME control center.
The build fails due to missing qt linguist tools. That's solved by
adding 'qttools'. But the build fails soon after with missing 'Sql'
module. I didn't manage to solve that, so use Qt 5.6 where it works.
Using libsForQt seems to be the way Qt packages are composed today, so
use that (seems safer).
OVMF is built from edk2 sources so that's where its version number comes
from (logically). The edk2 version number is 2014-12-10, so this change
only ensures the version numbers won't drift apart in the future. (There
is no hash change.)
This allows gitweb to expand '~' in /etc/gitconfig. Without a $HOME
variable, it fails to list any projects and instead show the text
"No such projects found" in the UI.
Setting $HOME to the gitweb project root seems like a sensible value.
This allows customizing the nixpkgs arguments by the caller. My use case
is creating a personal nixpkgs channel containing some unfree packages.
The default is still to not build unfree packages, so for nixpkgs this
is no functional change.
The test failure started happening with commit
8d18f67a97 ("awscli: 1.11.45 -> 1.11.75"). That commit
also updates botocore, a dependency of boto3.
This unbreaks 'nixops' (a dependee).
qtquickcontrols2, qtwebchannel, qtwebengine, qtwebkit.
Added in the same order as the modules are listed in default.nix (and
then reformatted the block).
qtquickcontrols2, qtwebkit.
Added in the same order as the modules are listed in default.nix (and
then reformatted the block).
(The qt55 expression already has all modules in *full.)
So that pkg-config can be used to find 'moc' etc. (Currently it points
to a non-existing path.)
Fixes#22945 ('Linux kbuild incompatible with "nix-shell -p qt5.full"').
Add aliases like "eclipse-cpp = eclipse-cpp-46" so that user
configurations can point to "eclipse-cpp" and have it not regularly
break as nixpkgs is updated.
Fixes this:
$ gscriptor
Can't load '/nix/store/17w6hdwbli924v7d43xxxp66qhgqpc24-perl-Pango-1.227/lib/perl5/site_perl/5.22.2/x86_64-linux-thread-multi/auto/Pango/Pango.so' for module Pango: /nix/store/17w6hdwbli924v7d43xxxp66qhgqpc24-perl-Pango-1.227/lib/perl5/site_perl/5.22.2/x86_64-linux-thread-multi/auto/Pango/Pango.so: undefined symbol: cairo_font_type_to_sv at /nix/store/5z1wn7knhckr3a0asb8lzp99sdai09f2-perl-5.22.2/lib/perl5/5.22.2/x86_64-linux-thread-multi/DynaLoader.pm line 193.
at /nix/store/srdac7af3nz6fb74haa8l8ls9wd9pas0-perl-Gtk2-1.2498/lib/perl5/site_perl/5.22.2/x86_64-linux-thread-multi/Gtk2.pm line 31.
Compilation failed in require at /nix/store/srdac7af3nz6fb74haa8l8ls9wd9pas0-perl-Gtk2-1.2498/lib/perl5/site_perl/5.22.2/x86_64-linux-thread-multi/Gtk2.pm line 31.
BEGIN failed--compilation aborted at /nix/store/srdac7af3nz6fb74haa8l8ls9wd9pas0-perl-Gtk2-1.2498/lib/perl5/site_perl/5.22.2/x86_64-linux-thread-multi/Gtk2.pm line 31.
Compilation failed in require at /nix/store/sgy2xsyvmam09pl25x8gb507gyiz9ybn-pcsc-tools-1.4.25/bin/.gscriptor-wrapped line 28.
BEGIN failed--compilation aborted at /nix/store/sgy2xsyvmam09pl25x8gb507gyiz9ybn-pcsc-tools-1.4.25/bin/.gscriptor-wrapped line 28.
To be able to use Wireshark as an ordinary user, the 'dumpcap' program
must be installed setuid root. This module module simplifies such a
configuration to simply:
programs.wireshark.enable = true;
The setuid wrapper is available for users in the 'wireshark' group.
Changes v1 -> v2:
- add "defaultText" to the programs.wireshark.package option (AFAIK,
that prevents the manual from being needlessly rebuilt when the
package changes)
* The source attribute is mandatory, not optional
* The program attribute is optional
* Move the info about the mandatory attribute first (most important,
IMHO)
The GeoIP databases from MaxMind have no stable URLs and change every
month (or so). Our current method of packaging these database in Nix and
playing catch-up with ever-changing file hashes is a bad idea. For
instance, it makes it impossible to realize old NixOS configurations.
This patch adds a NixOS service that periodically updates the GeoIP
databases in /var/lib/geoip-databases. Moving NixOS modules over can be
done in later patches.
I tried adding MD5 check, but not all databases have them, so i skipped
it. We are downloading over HTTPS though, it should be good. I also
tried adding zip support, but the first zip file I extracted had a
different filename inside than the archive name, which breaks an
assumption in this service, so I skipped that too.
Changes v9 -> v10:
- Pass "--max-time" to curl to set upper bound on downloads (ensures
no indefinite hanging if there's problem with networking).
Timeout for network connectivity check: 60s.
Timeout for geoip database (each): 15m.
Changes v8 -> v9:
- Mention the random timer delay in the documentation for the
'interval' option.
Changes v7 -> v8:
- Add "RemainAfterExit=true" for the setup service, so it won't be
restarted needlessly. (Thanks @danbst!)
Changes v6 -> v7:
- Add --skip-existing flag to geoip-updater, which skips updating
existing database files. Pass that flag when we run the service on
boot (and on any NixOS configuration change).
(IMHO, this is somewhat a workaround for systemd persistent timers
not being triggered immediately when a timer has never expired
before. But it does have the nice side effect of ensuring that the
installed databases always correspond to the configured ones, since
the service is now always run after configuration changes.)
Changes v5 -> v6:
- Update database files atomically (per DB)
- If a database is removed from the configuration, it'll be removed
from /var/lib/geoip-databases too (on next run).
- Add NixOS module assertion so that if user inputs non- .gz or .xz
file there will be a build time error instead of runtime.
- Run updater as user "nobody" instead of "root".
- Rename NixOS service from "geoip-databases" to "geoip-updater".
- Drop RemainAfterExit, or else the timer won't trigger the unit.
- Bring back "curl --fail", or else we won't catch and log curl
failures.
Changes v4 -> v5:
- Add "GeoLite2-City.mmdb.gz" to default database list.
Changes v3 -> v4:
- Remove unneeded geoip-updater-setup.service after adding
'wantedBy = [ "multi-user.target" ]' directly to
geoip-updater.service
- Drop unneeded "Service" name from service descriptions.
Changes v2 -> v3:
- Network may be down when starting from a cold boot, so try a few
times. Possibly, if using systemd-networkd, it'll pass on the first
try. But with default DHCP on NixOS, the service is started before
hostnames can be resolved and thus we need a few extra seconds.
- Add error handling and mark service as failed if fatal error.
- Add proper syslog log levels.
- Add RandomizedDelaySec=3600 to the timer to not put high load on the
MaxMind servers. Suggested by @Mic92.
- Set RemainAfterExit on geoip-updater.service instead of
geoip-updater-setup.service. (The latter is only a proxy that pulls
in the former service).
Changes v1 -> v2:
From Данило Глинський (Danylo Hlynskyi) <abcz2.uprola@gmail.com>:
nixos/geoip-databases: add `databases` option and fix initial setup
There were two great issues when using this service:
- When you just enable service, databases aren't downloaded, they are
downloaded when timer triggers. Fixed this with automatic download on
first system activation.
- When there is no internet, updater outputs nothing to logs, which is
IMO misbehavior. Fixed this with removing `--fail` option, better be
explicit here.
This reverts commit 278d3050ae because it
breaks zenmap:
$ zenmap
Could not import the zenmapGUI.App module: 'No module named zenmapGUI.App'.
I checked in these directories:
/nix/store/2hiz11plgjdrk2mziwc2jcxqalqh9hii-nmap-graphical-7.12/bin
/home/bfo/forks/nixpkgs
/nix/store/0l4lriqf07qah8c0kh9kcyc8l5iyij16-python-2.7.12/lib/python27.zip
/nix/store/0l4lriqf07qah8c0kh9kcyc8l5iyij16-python-2.7.12/lib/python2.7
/nix/store/0l4lriqf07qah8c0kh9kcyc8l5iyij16-python-2.7.12/lib/python2.7/plat-linux2
/nix/store/0l4lriqf07qah8c0kh9kcyc8l5iyij16-python-2.7.12/lib/python2.7/lib-tk
/nix/store/0l4lriqf07qah8c0kh9kcyc8l5iyij16-python-2.7.12/lib/python2.7/lib-old
/nix/store/0l4lriqf07qah8c0kh9kcyc8l5iyij16-python-2.7.12/lib/python2.7/lib-dynload
/nix/store/0l4lriqf07qah8c0kh9kcyc8l5iyij16-python-2.7.12/lib/python2.7/site-packages
If you installed Zenmap in another directory, you may have to add the
modules directory to the PYTHONPATH environment variable.
I don't know what happened in 754a9cf698
("gnome3.20: remove"), but that hash doesn't work. (Did gnome update
tarball in place?)
I ran "./maintainers/scripts/gnome.sh update epiphany" and selected the
current major.minor version. Now the hash is working.
Without it, the following error is shown in the "Add Printer" window:
Failed to group devices: 'The name org.fedoraproject.Config.Printing was not provided by any .service files'
The reason being less mental overhead when reading upstream
documentation. Examples can be pasted right into the configuration
instead of translating to Nix attrset first.
/etc/hostname is the file used by hostnamectl(1) and the
org.freedesktop.hostname1 dbus service (both provided by systemd) to get
the "static hostname". Better provide it so that users of those
tools/services get a proper hostname.
An example of an issue created by the lack of /etc/hostname is that the
bluetooth stack on NixOS identifies itself to peers as "BlueZ $VERSION"
instead of the hostname.
References:
https://www.freedesktop.org/software/systemd/man/hostname.html
Changes v1 -> v2:
* ensure /etc/hostname ends with a newline
The current default value of listenAddress = null blows up:
$ nixos-rebuild build
error: cannot coerce null to a string, at
.../nixpkgs/nixos/modules/services/monitoring/prometheus/alertmanager.nix:97:16
With listenAddress = "" we use the same default as upstream and there is
no blow up :-)
...by providing a default value of "no labels" (an empty attrset).
Without this change we get
$ nixos-rebuild test -I nixpkgs=.
building Nix...
building the system configuration...
error: The option `services.prometheus.scrapeConfigs.[definition 1-entry 1].static_configs.[definition 1-entry 1].labels' is used but not defined.
which is unneeded, because labels _are_ optional.
The structured options are incomplete compared to upstream and I think
it will be a maintenance burden to try to keep up. Instead, provide an
option for the raw config file contents (prometheus.yml).
This reverts commit 656cc3acaf because it
causes building the manual to fail:
$ nixos-rebuild build
...
building path(s) ‘/nix/store/s9y5z78z5pssvmixcmv9ix13gs8xj87f-manual-olinkdb’
Writing /nix/store/s9y5z78z5pssvmixcmv9ix13gs8xj87f-manual-olinkdb/manual.db for book(book-nixos-manual)
./man-pages.xml:625: element para: Relax-NG validity error : Did not expect element para there
./man-pages.xml:3: element variablelist: Relax-NG validity error : Element refsection has extra content: variablelist
./man-pages.xml:29: element refsection: Relax-NG validity error : Element refentry has extra content: refsection
./man-pages.xml:3: element reference: Relax-NG validity error : Element reference failed to validate content
./man-pages.xml fails to validate
CC @cleverca22, @Mic92
The collectd service runs as an unprivileged user by default, so it does
not leak more information to its data directory than any user can obtain
elsewhere by other means.
If people are running it as root and are worried about information leak,
we can add collectd group and set perms to 750.
CC @offlinehacker.
Fixes#21198.
Bjørn Forsman