diff --git a/nixos/doc/manual/release-notes/rl-1903.xml b/nixos/doc/manual/release-notes/rl-1903.xml index bade93c0984e..975c566411c0 100644 --- a/nixos/doc/manual/release-notes/rl-1903.xml +++ b/nixos/doc/manual/release-notes/rl-1903.xml @@ -245,6 +245,66 @@ options. + + + The nscd now disables all caching of + passwd and group databases by + default. This was interferring with the correct functioning of the + libnss_systemd.so module which is used by + systemd to manage uids and usernames in the presence + of DynamicUser= in systemd services. + The was already the default behaviour in presence of + services.sssd.enable = true because nscd caching + would interfere sssd in unpredictable ways as well.Because we're using nscd + not for caching, but for convincing glibc to find NSS modules in the + nix store instead of an absolute path, we have decided to disable + caching globally now, as it's usually not the behaviour the user wants + and can lead to surprising behaviour. + Furthermore, negative caching of host lookups is also disabled now by + default. This should fix the issue of dns lookups failing in the + presence of an unreliable network. + + + If the old behaviour is desired, this can be restored by setting + the services.nscd.config option + with the desired caching parameters. + + services.nscd.config = + '' + server-user nscd + threads 1 + paranoia no + debug-level 0 + + enable-cache passwd yes + positive-time-to-live passwd 600 + negative-time-to-live passwd 20 + suggested-size passwd 211 + check-files passwd yes + persistent passwd no + shared passwd yes + + enable-cache group yes + positive-time-to-live group 3600 + negative-time-to-live group 60 + suggested-size group 211 + check-files group yes + persistent group no + shared group yes + + enable-cache hosts yes + positive-time-to-live hosts 600 + negative-time-to-live hosts 5 + suggested-size hosts 211 + check-files hosts yes + persistent hosts no + shared hosts yes + ''; + + See #50316 + for details. + + GitLab Shell previously used the nix store paths for the