Merge remote-tracking branch 'upstream/master' into hardened-stdenv

This commit is contained in:
Robin Gloster 2016-06-10 09:27:04 +00:00
commit 8031cba2ab
1116 changed files with 79612 additions and 24052 deletions

View File

@ -1,7 +1,14 @@
language: python
python: "3.4"
sudo: required
dist: trusty
matrix:
allow_failures:
- os: osx
include:
- os: linux
language: generic
sudo: required
dist: trusty
- os: osx
language: generic
osx_image: xcode7.3
before_install: ./maintainers/scripts/travis-nox-review-pr.sh nix
install: ./maintainers/scripts/travis-nox-review-pr.sh nox
script: ./maintainers/scripts/travis-nox-review-pr.sh build

View File

@ -11,6 +11,7 @@
abaldeau = "Andreas Baldeau <andreas@baldeau.net>";
abbradar = "Nikolay Amiantov <ab@fmap.me>";
aboseley = "Adam Boseley <adam.boseley@gmail.com>";
abuibrahim = "Ruslan Babayev <ruslan@babayev.com>";
adev = "Adrien Devresse <adev@adev.name>";
Adjective-Object = "Maxwell Huang-Hobbs <mhuan13@gmail.com>";
adnelson = "Allen Nelson <ithinkican@gmail.com>";
@ -74,6 +75,8 @@
chaoflow = "Florian Friesdorf <flo@chaoflow.net>";
chattered = "Phil Scott <me@philscotted.com>";
choochootrain = "Hurshal Patel <hurshal@imap.cc>";
chris-martin = "Chris Martin <ch.martin@gmail.com>";
chrisjefferson = "Christopher Jefferson <chris@bubblescope.net>";
christopherpoole = "Christopher Mark Poole <mail@christopherpoole.net>";
cleverca22 = "Michael Bishop <cleverca22@gmail.com>";
cmcdragonkai = "Roger Qiu <roger.qiu@matrix.ai>";
@ -238,6 +241,7 @@
meisternu = "Matt Miemiec <meister@krutt.org>";
michaelpj = "Michael Peyton Jones <michaelpj@gmail.com>";
michelk = "Michel Kuhlmann <michel@kuhlmanns.info>";
mimadrid = "Miguel Madrid <mimadrid@ucm.es>";
mingchuan = "Ming Chuan <ming@culpring.com>";
mirdhyn = "Merlin Gaillard <mirdhyn@gmail.com>";
mirrexagon = "Andrew Abbott <mirrexagon@mirrexagon.com>";

View File

@ -554,12 +554,10 @@ rec {
apply = x: use (toOf config);
});
config = {
/*
warnings =
let opt = getAttrFromPath from options; in
optional (warn && opt.isDefined)
"The option `${showOption from}' defined in ${showFiles opt.files} has been renamed to `${showOption to}'.";
*/
} // setAttrByPath to (mkAliasDefinitions (getAttrFromPath from options));
};

View File

@ -4,6 +4,11 @@ let lib = import ./default.nix; in
rec {
# Returns the type of a path: regular (for file), symlink, or directory
pathType = p: with builtins; getAttr (baseNameOf p) (readDir (dirOf p));
# Returns true if the path exists and is a directory, false otherwise
pathIsDirectory = p: if builtins.pathExists p then (pathType p) == "directory" else false;
# Bring in a path as a source, filtering out all Subversion and CVS
# directories, as well as backup files (*~).
@ -29,6 +34,7 @@ rec {
in type == "directory" || lib.any (ext: lib.hasSuffix ext base) exts;
in builtins.filterSource filter path;
# Get the commit id of a git repo
# Example: commitIdFromGitRepo <nixpkgs/.git>
commitIdFromGitRepo =

View File

@ -13,28 +13,36 @@ if [[ $1 == nix ]]; then
sudo mkdir /etc/nix
sudo sh -c 'echo "build-max-jobs = 4" > /etc/nix/nix.conf'
# Nix builds in /tmp and we need exec support
sudo mount
sudo mount -o remount,exec /run
# Verify evaluation
echo "=== Verifying that nixpkgs evaluates..."
nix-env -f. -qa --json >/dev/null
elif [[ $1 == nox ]]; then
source $HOME/.nix-profile/etc/profile.d/nix.sh
echo "=== Installing nox..."
git clone -q https://github.com/madjar/nox
pip --quiet install -e nox
nix-build -A nox '<nixpkgs>' --show-trace
elif [[ $1 == build ]]; then
source $HOME/.nix-profile/etc/profile.d/nix.sh
echo "=== Checking NixOS options"
nix-build nixos/release.nix -A options
if [[ $TRAVIS_OS_NAME == "osx" ]]; then
echo "Skipping NixOS things on darwin"
else
echo "=== Checking NixOS options"
nix-build nixos/release.nix -A options --show-trace
echo "=== Checking tarball creation"
nix-build pkgs/top-level/release.nix -A tarball
echo "=== Checking tarball creation"
nix-build pkgs/top-level/release.nix -A tarball --show-trace
fi
if [[ $TRAVIS_PULL_REQUEST == false ]]; then
echo "=== Not a pull request"
else
echo "=== Checking PR"
if ! nox-review pr ${TRAVIS_PULL_REQUEST}; then
if ! nix-shell -p nox --run "nox-review pr ${TRAVIS_PULL_REQUEST}"; then
if sudo dmesg | egrep 'Out of memory|Killed process' > /tmp/oom-log; then
echo "=== The build failed due to running out of memory:"
cat /tmp/oom-log

View File

@ -21,7 +21,7 @@ Alternatively, you can use a systemd unit that does the same in the
background:
<screen>
$ systemctl start nix-gc.service
# systemctl start nix-gc.service
</screen>
You can tell NixOS in <filename>configuration.nix</filename> to run
@ -59,4 +59,4 @@ $ nix-store --optimise
Since this command needs to read the entire Nix store, it can take
quite a while to finish.</para>
</chapter>
</chapter>

View File

@ -13,7 +13,7 @@ create</literal>, it gets it own private IPv4 address in the range
address as follows:
<screen>
$ nixos-container show-ip foo
# nixos-container show-ip foo
10.233.4.2
$ ping -c1 10.233.4.2
@ -47,4 +47,4 @@ where <literal>eth0</literal> should be replaced with the desired
external interface. Note that <literal>ve-+</literal> is a wildcard
that matches all container interfaces.</para>
</section>
</section>

View File

@ -11,7 +11,7 @@
identifier <literal>foo</literal> as follows:
<screen>
$ nixos-container create foo
# nixos-container create foo
</screen>
This creates the containers root directory in
@ -25,7 +25,7 @@ line. For instance, to create a container that has
<literal>root</literal>:
<screen>
$ nixos-container create foo --config 'services.openssh.enable = true; \
# nixos-container create foo --config 'services.openssh.enable = true; \
users.extraUsers.root.openssh.authorizedKeys.keys = ["ssh-dss AAAAB3N…"];'
</screen>
@ -35,7 +35,7 @@ $ nixos-container create foo --config 'services.openssh.enable = true; \
run:
<screen>
$ nixos-container start foo
# nixos-container start foo
</screen>
This command will return as soon as the container has booted and has
@ -46,7 +46,7 @@ Thus, if something went wrong, you can get status info using
<command>systemctl</command>:
<screen>
$ systemctl status container@foo
# systemctl status container@foo
</screen>
</para>
@ -55,7 +55,7 @@ $ systemctl status container@foo
root using the <command>root-login</command> operation:
<screen>
$ nixos-container root-login foo
# nixos-container root-login foo
[root@foo:~]#
</screen>
@ -65,7 +65,7 @@ authentication). You can also get a regular login prompt using the
the host:
<screen>
$ nixos-container login foo
# nixos-container login foo
foo login: alice
Password: ***
</screen>
@ -74,7 +74,7 @@ With <command>nixos-container run</command>, you can execute arbitrary
commands in the container:
<screen>
$ nixos-container run foo -- uname -a
# nixos-container run foo -- uname -a
Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux
</screen>
@ -86,17 +86,17 @@ container. First, on the host, you can edit
and run
<screen>
$ nixos-container update foo
# nixos-container update foo
</screen>
This will build and activate the new configuration. You can also
specify a new configuration on the command line:
<screen>
$ nixos-container update foo --config 'services.httpd.enable = true; \
# nixos-container update foo --config 'services.httpd.enable = true; \
services.httpd.adminAddr = "foo@example.org";'
$ curl http://$(nixos-container show-ip foo)/
# curl http://$(nixos-container show-ip foo)/
&lt;!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">…
</screen>
@ -116,9 +116,9 @@ start</literal>, respectively, or by using
destroy a container, including its file system, do
<screen>
$ nixos-container destroy foo
# nixos-container destroy foo
</screen>
</para>
</section>
</section>

View File

@ -9,10 +9,10 @@
<para>You can enter rescue mode by running:
<screen>
$ systemctl rescue</screen>
# systemctl rescue</screen>
This will eventually give you a single-user root shell. Systemd will
stop (almost) all system services. To get out of maintenance mode,
just exit from the rescue shell.</para>
</section>
</section>

View File

@ -18,14 +18,14 @@ You can disable the use of the binary cache by adding <option>--option
use-binary-caches false</option>, e.g.
<screen>
$ nixos-rebuild switch --option use-binary-caches false
# nixos-rebuild switch --option use-binary-caches false
</screen>
If you have an alternative binary cache at your disposal, you can use
it instead:
<screen>
$ nixos-rebuild switch --option binary-caches http://my-cache.example.org/
# nixos-rebuild switch --option binary-caches http://my-cache.example.org/
</screen>
</para>

View File

@ -10,7 +10,7 @@
doing:
<screen>
$ shutdown
# shutdown
</screen>
This is equivalent to running <command>systemctl
@ -19,7 +19,7 @@ poweroff</command>.</para>
<para>To reboot the system, run
<screen>
$ reboot
# reboot
</screen>
which is equivalent to <command>systemctl reboot</command>.
@ -28,7 +28,7 @@ Alternatively, you can quickly reboot the system using
the new kernel into memory:
<screen>
$ systemctl kexec
# systemctl kexec
</screen>
</para>
@ -41,4 +41,4 @@ $ systemctl kexec
i.e. on a virtual console or in X11; otherwise, the user is asked for
authentication.</para>
</chapter>
</chapter>

View File

@ -19,7 +19,7 @@ fails to boot. After the system has booted, you can make the selected
configuration the default for subsequent boots:
<screen>
$ /run/current-system/bin/switch-to-configuration boot</screen>
# /run/current-system/bin/switch-to-configuration boot</screen>
</para>
@ -27,12 +27,12 @@ $ /run/current-system/bin/switch-to-configuration boot</screen>
system:
<screen>
$ nixos-rebuild switch --rollback</screen>
# nixos-rebuild switch --rollback</screen>
This is equivalent to running:
<screen>
$ /nix/var/nix/profiles/system-<replaceable>N</replaceable>-link/bin/switch-to-configuration switch</screen>
# /nix/var/nix/profiles/system-<replaceable>N</replaceable>-link/bin/switch-to-configuration switch</screen>
where <replaceable>N</replaceable> is the number of the NixOS system
configuration. To get a list of the available configurations, do:
@ -45,4 +45,4 @@ lrwxrwxrwx 1 root root 78 Aug 12 13:54 /nix/var/nix/profiles/system-268-link ->
</para>
</section>
</section>

View File

@ -66,9 +66,9 @@ messages from the service.
<para>Units can be stopped, started or restarted:
<screen>
$ systemctl stop postgresql.service
$ systemctl start postgresql.service
$ systemctl restart postgresql.service
# systemctl stop postgresql.service
# systemctl start postgresql.service
# systemctl restart postgresql.service
</screen>
These operations are synchronous: they wait until the service has

View File

@ -18,7 +18,7 @@ you may be able to fix it automatically.</para>
system configuration, you can fix it by doing
<screen>
$ nixos-rebuild switch --repair
# nixos-rebuild switch --repair
</screen>
This will cause Nix to check every path in the closure, and if its
@ -28,10 +28,10 @@ the path is rebuilt or redownloaded.</para>
<para>You can also scan the entire Nix store for corrupt paths:
<screen>
$ nix-store --verify --check-contents --repair
# nix-store --verify --check-contents --repair
</screen>
Any corrupt paths will be redownloaded if theyre available in a
binary cache; otherwise, they cannot be repaired.</para>
</section>
</section>

View File

@ -45,9 +45,9 @@ track of this, you can terminate a session in a way that ensures that
all the sessions processes are gone:
<screen>
$ loginctl terminate-session c3
# loginctl terminate-session c3
</screen>
</para>
</chapter>
</chapter>

View File

@ -31,7 +31,7 @@ and you run <command>nixos-rebuild</command>, specifying your own
Nixpkgs tree:
<screen>
$ nixos-rebuild switch -I nixpkgs=/path/to/my/nixpkgs</screen>
# nixos-rebuild switch -I nixpkgs=/path/to/my/nixpkgs</screen>
</para>

View File

@ -82,7 +82,7 @@ $ nix-shell '<nixpkgs>' -A linuxPackages.kernel
$ unpackPhase
$ cd linux-*
$ make -C $dev/lib/modules/*/build M=$(pwd)/drivers/net/ethernet/mellanox modules
$ sudo insmod ./drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko
# insmod ./drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko
]]></screen>
</section>

View File

@ -12,7 +12,7 @@ here is how you create an encrypted Ext4 file system on the device
<filename>/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d</filename>:
<screen>
$ cryptsetup luksFormat /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d
# cryptsetup luksFormat /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d
WARNING!
========
@ -22,10 +22,10 @@ Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase: ***
Verify passphrase: ***
$ cryptsetup luksOpen /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d crypted
# cryptsetup luksOpen /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d crypted
Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: ***
$ mkfs.ext4 /dev/mapper/crypted
# mkfs.ext4 /dev/mapper/crypted
</screen>
To ensure that this file system is automatically mounted at boot time

View File

@ -63,14 +63,14 @@ commands such as <command>useradd</command>,
account named <literal>alice</literal>:
<screen>
$ useradd -m alice</screen>
# useradd -m alice</screen>
To make all nix tools available to this new user use `su - USER` which
opens a login shell (==shell that loads the profile) for given user.
This will create the ~/.nix-defexpr symlink. So run:
<screen>
$ su - alice -c "true"</screen>
# su - alice -c "true"</screen>
The flag <option>-m</option> causes the creation of a home directory
@ -79,7 +79,7 @@ have an initial password and therefore cannot log in. A password can
be set using the <command>passwd</command> utility:
<screen>
$ passwd alice
# passwd alice
Enter new UNIX password: ***
Retype new UNIX password: ***
</screen>
@ -87,7 +87,7 @@ Retype new UNIX password: ***
A user can be deleted using <command>userdel</command>:
<screen>
$ userdel -r alice</screen>
# userdel -r alice</screen>
The flag <option>-r</option> deletes the users home directory.
Accounts can be modified using <command>usermod</command>. Unix

View File

@ -41,13 +41,13 @@ If you are using WPA2 the <command>wpa_passphrase</command> tool might be useful
to generate the <literal>wpa_supplicant.conf</literal>.
<screen>
$ wpa_passphrase ESSID PSK > /etc/wpa_supplicant.conf</screen>
# wpa_passphrase ESSID PSK > /etc/wpa_supplicant.conf</screen>
After you have edited the <literal>wpa_supplicant.conf</literal>,
you need to restart the wpa_supplicant service.
<screen>
$ systemctl restart wpa_supplicant.service</screen>
# systemctl restart wpa_supplicant.service</screen>
</para>
</section>

View File

@ -5,7 +5,7 @@
xml:id="sec-x11">
<title>X Window System</title>
<para>The X Window System (X11) provides the basis of NixOS graphical
user interface. It can be enabled as follows:
<programlisting>
@ -48,7 +48,7 @@ services.xserver.autorun = false;
</programlisting>
The X server can then be started manually:
<screen>
$ systemctl start display-manager.service
# systemctl start display-manager.service
</screen>
</para>
@ -115,5 +115,14 @@ services.xserver.synaptics.twoFingerScroll = true;
</simplesect>
<simplesect><title>GTK/Qt themes</title>
<para>GTK themes can be installed either to user profile or system-wide (via
<literal>system.environmentPackages</literal>). To make Qt 5 applications look similar
to GTK2 ones, you can install <literal>qt5.qtbase.gtk</literal> package into your
system environment. It should work for all Qt 5 library versions.
</para>
</simplesect>
</chapter>

View File

@ -25,8 +25,8 @@ $ nix-build -A config.system.build.isoImage -I nixos-config=modules/installer/cd
suggested by the following command:
<screen>
$ mount -o loop -t iso9660 ./result/iso/cd.iso /mnt/iso</screen>
# mount -o loop -t iso9660 ./result/iso/cd.iso /mnt/iso</screen>
</para>
</chapter>
</chapter>

View File

@ -94,8 +94,8 @@ $ nix-build -A 'config.systemd.units."httpd.service".unit'
<screen>
$ cp $(nix-build -A 'config.systemd.units."httpd.service".unit')/httpd.service \
/run/systemd/system/tmp-httpd.service
$ systemctl daemon-reload
$ systemctl start tmp-httpd.service
# systemctl daemon-reload
# systemctl start tmp-httpd.service
</screen>
Note that the unit must not have the same name as any unit in
@ -110,4 +110,4 @@ $ systemctl start tmp-httpd.service
</para>
</chapter>
</chapter>

View File

@ -70,7 +70,7 @@ sources, you need to tell <command>nixos-rebuild</command> about them
using the <option>-I</option> flag:
<screen>
$ nixos-rebuild switch -I nixpkgs=<replaceable>/my/sources</replaceable>/nixpkgs
# nixos-rebuild switch -I nixpkgs=<replaceable>/my/sources</replaceable>/nixpkgs
</screen>
</para>

View File

@ -12,16 +12,16 @@ properly:
<screen>
$ nix-build -A config.system.build.nixos-install
$ mount -t tmpfs none /mnt
$ ./result/bin/nixos-install</screen>
# mount -t tmpfs none /mnt
# ./result/bin/nixos-install</screen>
To start a login shell in the new NixOS installation in
<filename>/mnt</filename>:
<screen>
$ ./result/bin/nixos-install --chroot
# ./result/bin/nixos-install --chroot
</screen>
</para>
</chapter>
</chapter>

View File

@ -10,7 +10,7 @@ contains the current configuration of your machine. Whenever youve
changed something to that file, you should do
<screen>
$ nixos-rebuild switch</screen>
# nixos-rebuild switch</screen>
to build the new configuration, make it the default configuration for
booting, and try to realise the configuration in the running system
@ -23,7 +23,7 @@ either run them from a root shell or by prefixing them with
<para>You can also do
<screen>
$ nixos-rebuild test</screen>
# nixos-rebuild test</screen>
to build the configuration and switch the running system to it, but
without making it the boot default. So if (say) the configuration
@ -33,7 +33,7 @@ configuration.</para>
<para>There is also
<screen>
$ nixos-rebuild boot</screen>
# nixos-rebuild boot</screen>
to build the configuration and make it the boot default, but not
switch to it now (so it will only take effect after the next
@ -44,7 +44,7 @@ of the GRUB 2 boot screen by giving it a different <emphasis>profile
name</emphasis>, e.g.
<screen>
$ nixos-rebuild switch -p test </screen>
# nixos-rebuild switch -p test </screen>
which causes the new configuration (and previous ones created using
<literal>-p test</literal>) to show up in the GRUB submenu “NixOS -

View File

@ -5,7 +5,7 @@
xml:id="sec-uefi-installation">
<title>UEFI Installation</title>
<para>NixOS can also be installed on UEFI systems. The procedure
is by and large the same as a BIOS installation, with the following
changes:
@ -26,7 +26,7 @@ changes:
<literal>vfat</literal> filesystem.</para>
</listitem>
<listitem>
<para>You must set <option>boot.loader.gummiboot.enable</option> to
<para>You must set <option>boot.loader.systemd-boot.enable</option> to
<literal>true</literal>. <command>nixos-generate-config</command>
should do this automatically for new configurations when booted in
UEFI mode.</para>
@ -38,7 +38,7 @@ changes:
</listitem>
<listitem>
<para>You may want to look at the options starting with
<option>boot.loader.efi</option> and <option>boot.loader.gummiboot</option>
<option>boot.loader.efi</option> and <option>boot.loader.systemd-boot</option>
as well.</para>
</listitem>
</itemizedlist>

View File

@ -54,7 +54,7 @@
changes. For example:
<screen>
$ mkfs.ext4 -L nixos /dev/sda1</screen>
# mkfs.ext4 -L nixos /dev/sda1</screen>
</para></listitem>
@ -66,10 +66,10 @@ $ mkfs.ext4 -L nixos /dev/sda1</screen>
<listitem><para>For creating LVM volumes, the LVM commands, e.g.,
<screen>
$ pvcreate /dev/sda1 /dev/sdb1
$ vgcreate MyVolGroup /dev/sda1 /dev/sdb1
$ lvcreate --size 2G --name bigdisk MyVolGroup
$ lvcreate --size 1G --name smalldisk MyVolGroup</screen>
# pvcreate /dev/sda1 /dev/sdb1
# vgcreate MyVolGroup /dev/sda1 /dev/sdb1
# lvcreate --size 2G --name bigdisk MyVolGroup
# lvcreate --size 1G --name smalldisk MyVolGroup</screen>
</para></listitem>
@ -84,7 +84,7 @@ $ lvcreate --size 1G --name smalldisk MyVolGroup</screen>
be installed on <filename>/mnt</filename>, e.g.
<screen>
$ mount /dev/disk/by-label/nixos /mnt
# mount /dev/disk/by-label/nixos /mnt
</screen>
</para></listitem>
@ -113,14 +113,14 @@ $ mount /dev/disk/by-label/nixos /mnt
generate an initial configuration file for you:
<screen>
$ nixos-generate-config --root /mnt</screen>
# nixos-generate-config --root /mnt</screen>
You should then edit
<filename>/mnt/etc/nixos/configuration.nix</filename> to suit your
needs:
<screen>
$ nano /mnt/etc/nixos/configuration.nix
# nano /mnt/etc/nixos/configuration.nix
</screen>
If youre using the graphical ISO image, other editors may be
@ -162,7 +162,7 @@ $ nano /mnt/etc/nixos/configuration.nix
<listitem><para>Do the installation:
<screen>
$ nixos-install</screen>
# nixos-install</screen>
Cross fingers. If this fails due to a temporary problem (such as
a network issue while downloading binaries from the NixOS binary
@ -186,7 +186,7 @@ Retype new UNIX password: ***
<listitem><para>If everything went well:
<screen>
$ reboot</screen>
# reboot</screen>
</para></listitem>
@ -235,15 +235,15 @@ drive (here <filename>/dev/sda</filename>). <xref linkend="ex-config"
<example xml:id='ex-install-sequence'><title>Commands for Installing NixOS on <filename>/dev/sda</filename></title>
<screen>
$ fdisk /dev/sda # <lineannotation>(or whatever device you want to install on)</lineannotation>
$ mkfs.ext4 -L nixos /dev/sda1
$ mkswap -L swap /dev/sda2
$ swapon /dev/sda2
$ mount /dev/disk/by-label/nixos /mnt
$ nixos-generate-config --root /mnt
$ nano /mnt/etc/nixos/configuration.nix
$ nixos-install
$ reboot</screen>
# fdisk /dev/sda # <lineannotation>(or whatever device you want to install on)</lineannotation>
# mkfs.ext4 -L nixos /dev/sda1
# mkswap -L swap /dev/sda2
# swapon /dev/sda2
# mount /dev/disk/by-label/nixos /mnt
# nixos-generate-config --root /mnt
# nano /mnt/etc/nixos/configuration.nix
# nixos-install
# reboot</screen>
</example>
<example xml:id='ex-config'><title>NixOS Configuration</title>

View File

@ -60,33 +60,33 @@ the <literal>nixos-14.12</literal> channel. To see which NixOS
channel youre subscribed to, run the following as root:
<screen>
$ nix-channel --list | grep nixos
# nix-channel --list | grep nixos
nixos https://nixos.org/channels/nixos-unstable
</screen>
To switch to a different NixOS channel, do
<screen>
$ nix-channel --add https://nixos.org/channels/<replaceable>channel-name</replaceable> nixos
# nix-channel --add https://nixos.org/channels/<replaceable>channel-name</replaceable> nixos
</screen>
(Be sure to include the <literal>nixos</literal> parameter at the
end.) For instance, to use the NixOS 14.12 stable channel:
<screen>
$ nix-channel --add https://nixos.org/channels/nixos-14.12 nixos
# nix-channel --add https://nixos.org/channels/nixos-14.12 nixos
</screen>
If you have a server, you may want to use the “small” channel instead:
<screen>
$ nix-channel --add https://nixos.org/channels/nixos-14.12-small nixos
# nix-channel --add https://nixos.org/channels/nixos-14.12-small nixos
</screen>
And if you want to live on the bleeding edge:
<screen>
$ nix-channel --add https://nixos.org/channels/nixos-unstable nixos
# nix-channel --add https://nixos.org/channels/nixos-unstable nixos
</screen>
</para>
@ -95,7 +95,7 @@ $ nix-channel --add https://nixos.org/channels/nixos-unstable nixos
channel by running
<screen>
$ nixos-rebuild switch --upgrade
# nixos-rebuild switch --upgrade
</screen>
which is equivalent to the more verbose <literal>nix-channel --update

View File

@ -1,7 +1,7 @@
<refentry xmlns="http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude">
<refmeta>
<refentrytitle><filename>configuration.nix</filename></refentrytitle>
<manvolnum>5</manvolnum>
@ -34,5 +34,5 @@ therein.</para>
<xi:include href="options-db.xml" />
</refsection>
</refentry>

View File

@ -1,7 +1,7 @@
<refentry xmlns="http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude">
<refmeta>
<refentrytitle><command>nixos-build-vms</command></refentrytitle>
<manvolnum>8</manvolnum>
@ -42,10 +42,10 @@ points to the generated virtual network.
services.openssh.enable = true;
nixpkgs.system = "i686-linux";
deployment.targetHost = "test1.example.net";
# Other NixOS options
};
test2 = {pkgs, config, ...}:
{
services.openssh.enable = true;
@ -53,7 +53,7 @@ points to the generated virtual network.
environment.systemPackages = [ pkgs.lynx ];
nixpkgs.system = "x86_64-linux";
deployment.targetHost = "test2.example.net";
# Other NixOS options
};
}

View File

@ -1,7 +1,7 @@
<refentry xmlns="http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude">
<refmeta>
<refentrytitle><command>nixos-option</command></refentrytitle>
<manvolnum>8</manvolnum>
@ -64,7 +64,7 @@ $ nixos-option boot.loader.grub.enable
Value:
true
Default:
Default:
true
Description:

View File

@ -3,7 +3,7 @@
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
xml:id="book-nixos-manual">
<info>
<title>NixOS Manual</title>
<subtitle>Version <xi:include href="version" parse="text" /></subtitle>
@ -26,6 +26,9 @@
xlink:href="https://github.com/NixOS/nixpkgs/issues">NixOS GitHub
issue tracker</link>.</para>
<note><para>Commands prefixed with <literal>#</literal> have to be run as
root, either requiring to login as root user or temporarily switching
to it using <literal>sudo</literal> for example.</para></note>
</preface>
<xi:include href="installation/installation.xml" />

View File

@ -11,6 +11,7 @@
<xsl:output method='xml' encoding="UTF-8" />
<xsl:param name="revision" />
<xsl:param name="program" />
<xsl:template match="/expr/list">
@ -188,7 +189,7 @@
</xsl:otherwise>
</xsl:choose>
</xsl:when>
<xsl:when test="$revision != 'local' and contains(@value, 'nixops') and contains(@value, '/nix/')">
<xsl:when test="$revision != 'local' and $program = 'nixops' and contains(@value, '/nix/')">
<xsl:attribute name="xlink:href">https://github.com/NixOS/nixops/blob/<xsl:value-of select="$revision"/>/nix/<xsl:value-of select="substring-after(@value, '/nix/')"/></xsl:attribute>
</xsl:when>
<xsl:otherwise>

View File

@ -16,6 +16,10 @@ has the following highlights: </para>
See <xref linkend="sec-booting-from-pxe" /> for documentation.</para>
</listitem>
<listitem>
<para>Xorg-server-1.18.*. If you choose <literal>"ati_unfree"</literal> driver,
1.17.* is still used due to ABI incompatibility.</para>
</listitem>
</itemizedlist>
<para>The following new services were added since the last release:</para>

View File

@ -18,6 +18,8 @@ in
config = mkIf enabled {
nixpkgs.config.xorg.fglrxCompat = true;
services.xserver.drivers = singleton
{ name = "fglrx"; modules = [ ati_x11 ]; libPath = [ "${ati_x11}/lib" ]; };

View File

@ -64,7 +64,7 @@ let
# The EFI boot image.
efiDir = pkgs.runCommand "efi-directory" {} ''
mkdir -p $out/EFI/boot
cp -v ${pkgs.gummiboot}/lib/gummiboot/gummiboot${targetArch}.efi $out/EFI/boot/boot${targetArch}.efi
cp -v ${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${targetArch}.efi $out/EFI/boot/boot${targetArch}.efi
mkdir -p $out/loader/entries
echo "title NixOS Live CD" > $out/loader/entries/nixos-livecd.conf

View File

@ -518,8 +518,8 @@ if ($showHardwareConfig) {
my $bootLoaderConfig = "";
if (-e "/sys/firmware/efi/efivars") {
$bootLoaderConfig = <<EOF;
# Use the gummiboot efi boot loader.
boot.loader.gummiboot.enable = true;
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
EOF
} elsif ($virt ne "systemd-nspawn") {

View File

@ -104,8 +104,8 @@ in
# changing them would not rebuild the manual
nixosLabel = mkDefault (maybeEnv "NIXOS_LABEL" cfg.nixosVersion);
nixosVersion = mkDefault (maybeEnv "NIXOS_VERSION" (cfg.nixosRelease + cfg.nixosVersionSuffix));
nixosRevision = mkIf (pathExists gitRepo) (mkDefault gitCommitId);
nixosVersionSuffix = mkIf (pathExists gitRepo) (mkDefault (".git." + gitCommitId));
nixosRevision = mkIf (pathIsDirectory gitRepo) (mkDefault gitCommitId);
nixosVersionSuffix = mkIf (pathIsDirectory gitRepo) (mkDefault (".git." + gitCommitId));
# Note: code names must only increase in alphabetical order.
nixosCodeName = "Flounder";

View File

@ -79,6 +79,7 @@
./programs/ssh.nix
./programs/ssmtp.nix
./programs/tmux.nix
./programs/unity3d.nix
./programs/venus.nix
./programs/wvdial.nix
./programs/xfs_quota.nix
@ -127,6 +128,7 @@
./services/continuous-integration/jenkins/default.nix
./services/continuous-integration/jenkins/slave.nix
./services/continuous-integration/jenkins/job-builder.nix
./services/continuous-integration/hydra/default.nix
./services/databases/4store-endpoint.nix
./services/databases/4store.nix
./services/databases/couchdb.nix
@ -428,6 +430,7 @@
./services/security/haveged.nix
./services/security/hologram.nix
./services/security/munge.nix
./services/security/oauth2_proxy.nix
./services/security/physlock.nix
./services/security/torify.nix
./services/security/tor.nix
@ -503,10 +506,10 @@
./system/boot/loader/grub/grub.nix
./system/boot/loader/grub/ipxe.nix
./system/boot/loader/grub/memtest.nix
./system/boot/loader/gummiboot/gummiboot.nix
./system/boot/loader/init-script/init-script.nix
./system/boot/loader/loader.nix
./system/boot/loader/raspberrypi/raspberrypi.nix
./system/boot/loader/systemd-boot/systemd-boot.nix
./system/boot/luksroot.nix
./system/boot/modprobe.nix
./system/boot/networkd.nix

View File

@ -0,0 +1,25 @@
{ config, lib, pkgs, ... }:
with lib;
let cfg = config.programs.unity3d;
in {
options = {
programs.unity3d.enable = mkEnableOption "Unity3D, a game development tool";
};
config = mkIf cfg.enable {
security.setuidOwners = [{
program = "unity-chrome-sandbox";
source = "${pkgs.unity3d.sandbox}/bin/unity-chrome-sandbox";
owner = "root";
#group = "root";
setuid = true;
#setgid = true;
}];
environment.systemPackages = [ pkgs.unity3d ];
};
}

View File

@ -114,6 +114,19 @@ in
'';
};
preliminarySelfsigned = mkOption {
type = types.bool;
default = true;
description = ''
Whether a preliminary self-signed certificate should be generated before
doing ACME requests. This can be useful when certificates are required in
a webserver, but ACME needs the webserver to make its requests.
With preliminary self-signed certificate the webserver can be started and
can later reload the correct ACME certificates.
'';
};
certs = mkOption {
default = { };
type = types.loaOf types.optionSet;
@ -140,54 +153,126 @@ in
config = mkMerge [
(mkIf (cfg.certs != { }) {
systemd.services = flip mapAttrs' cfg.certs (cert: data:
let
cpath = "${cfg.directory}/${cert}";
rights = if data.allowKeysForGroup then "750" else "700";
cmdline = [ "-v" "-d" cert "--default_root" data.webroot "--valid_min" cfg.validMin ]
++ optionals (data.email != null) [ "--email" data.email ]
++ concatMap (p: [ "-f" p ]) data.plugins
++ concatLists (mapAttrsToList (name: root: [ "-d" (if root == null then name else "${name}:${root}")]) data.extraDomains);
systemd.services = let
services = concatLists servicesLists;
servicesLists = mapAttrsToList certToServices cfg.certs;
certToServices = cert: data:
let
cpath = "${cfg.directory}/${cert}";
rights = if data.allowKeysForGroup then "750" else "700";
cmdline = [ "-v" "-d" cert "--default_root" data.webroot "--valid_min" cfg.validMin ]
++ optionals (data.email != null) [ "--email" data.email ]
++ concatMap (p: [ "-f" p ]) data.plugins
++ concatLists (mapAttrsToList (name: root: [ "-d" (if root == null then name else "${name}:${root}")]) data.extraDomains);
acmeService = {
description = "Renew ACME Certificate for ${cert}";
after = [ "network.target" ];
serviceConfig = {
Type = "oneshot";
SuccessExitStatus = [ "0" "1" ];
PermissionsStartOnly = true;
User = data.user;
Group = data.group;
PrivateTmp = true;
};
path = [ pkgs.simp_le ];
preStart = ''
mkdir -p '${cfg.directory}'
if [ ! -d '${cpath}' ]; then
mkdir '${cpath}'
fi
chmod ${rights} '${cpath}'
chown -R '${data.user}:${data.group}' '${cpath}'
'';
script = ''
cd '${cpath}'
set +e
simp_le ${concatMapStringsSep " " (arg: escapeShellArg (toString arg)) cmdline}
EXITCODE=$?
set -e
echo "$EXITCODE" > /tmp/lastExitCode
exit "$EXITCODE"
'';
postStop = ''
if [ -e /tmp/lastExitCode ] && [ "$(cat /tmp/lastExitCode)" = "0" ]; then
echo "Executing postRun hook..."
${data.postRun}
fi
'';
in nameValuePair
("acme-${cert}")
({
description = "Renew ACME Certificate for ${cert}";
after = [ "network.target" ];
serviceConfig = {
Type = "oneshot";
SuccessExitStatus = [ "0" "1" ];
PermissionsStartOnly = true;
User = data.user;
Group = data.group;
PrivateTmp = true;
before = [ "acme-certificates.target" ];
wantedBy = [ "acme-certificates.target" ];
};
selfsignedService = {
description = "Create preliminary self-signed certificate for ${cert}";
preStart = ''
if [ ! -d '${cpath}' ]
then
mkdir -p '${cpath}'
chmod ${rights} '${cpath}'
chown '${data.user}:${data.group}' '${cpath}'
fi
'';
script =
''
# Create self-signed key
workdir="/run/acme-selfsigned-${cert}"
${pkgs.openssl.bin}/bin/openssl genrsa -des3 -passout pass:x -out $workdir/server.pass.key 2048
${pkgs.openssl.bin}/bin/openssl rsa -passin pass:x -in $workdir/server.pass.key -out $workdir/server.key
${pkgs.openssl.bin}/bin/openssl req -new -key $workdir/server.key -out $workdir/server.csr \
-subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=IT Department/CN=example.com"
${pkgs.openssl.bin}/bin/openssl x509 -req -days 1 -in $workdir/server.csr -signkey $workdir/server.key -out $workdir/server.crt
# Move key to destination
mv $workdir/server.key ${cpath}/key.pem
mv $workdir/server.crt ${cpath}/fullchain.pem
# Clean up working directory
rm $workdir/server.csr
rm $workdir/server.pass.key
# Give key acme permissions
chmod ${rights} '${cpath}/key.pem'
chown '${data.user}:${data.group}' '${cpath}/key.pem'
chmod ${rights} '${cpath}/fullchain.pem'
chown '${data.user}:${data.group}' '${cpath}/fullchain.pem'
'';
serviceConfig = {
Type = "oneshot";
RuntimeDirectory = "acme-selfsigned-${cert}";
PermissionsStartOnly = true;
User = data.user;
Group = data.group;
};
unitConfig = {
# Do not create self-signed key when key already exists
ConditionPathExists = "!${cpath}/key.pem";
};
before = [
"acme-selfsigned-certificates.target"
];
wantedBy = [
"acme-selfsigned-certificates.target"
];
};
in (
[ { name = "acme-${cert}"; value = acmeService; } ]
++
(if cfg.preliminarySelfsigned
then [ { name = "acme-selfsigned-${cert}"; value = selfsignedService; } ]
else []
)
);
servicesAttr = listToAttrs services;
nginxAttr = {
nginx = {
after = [ "acme-selfsigned-certificates.target" ];
wants = [ "acme-selfsigned-certificates.target" "acme-certificates.target" ];
};
};
path = [ pkgs.simp_le ];
preStart = ''
mkdir -p '${cfg.directory}'
if [ ! -d '${cpath}' ]; then
mkdir '${cpath}'
fi
chmod ${rights} '${cpath}'
chown -R '${data.user}:${data.group}' '${cpath}'
'';
script = ''
cd '${cpath}'
set +e
simp_le ${concatMapStringsSep " " (arg: escapeShellArg (toString arg)) cmdline}
EXITCODE=$?
set -e
echo "$EXITCODE" > /tmp/lastExitCode
exit "$EXITCODE"
'';
postStop = ''
if [ -e /tmp/lastExitCode ] && [ "$(cat /tmp/lastExitCode)" = "0" ]; then
echo "Executing postRun hook..."
${data.postRun}
fi
'';
})
);
in
servicesAttr //
(if config.services.nginx.enable then nginxAttr else {});
systemd.timers = flip mapAttrs' cfg.certs (cert: data: nameValuePair
("acme-${cert}")
@ -200,6 +285,9 @@ in
};
})
);
systemd.targets."acme-selfsigned-certificates" = mkIf cfg.preliminarySelfsigned {};
systemd.targets."acme-certificates" = {};
})
{ meta.maintainers = with lib.maintainers; [ abbradar fpletz globin ];

View File

@ -66,4 +66,32 @@ options for the <literal>security.acme</literal> module.</para>
</section>
<section><title>Using ACME certificates in Nginx</title>
<para>In practice ACME is mostly used for retrieval and renewal of
certificates that will be used in a webserver like Nginx. A configuration for
Nginx that uses the certificates from ACME for
<literal>foo.example.com</literal> will look similar to:
</para>
<programlisting>
services.nginx.httpConfig = ''
server {
server_name foo.example.com;
listen 443 ssl;
ssl_certificate ${config.security.acme.directory}/foo.example.com/fullchain.pem;
ssl_certificate_key ${config.security.acme.directory}/foo.example.com/key.pem;
root /var/www/foo.example.com/;
}
'';
</programlisting>
<para>Now Nginx will try to use the certificates that will be retrieved by ACME.
ACME needs Nginx (or any other webserver) to function and Nginx needs
the certificates to actually start. For this reason the ACME module
automatically generates self-signed certificates that will be used by Nginx to
start. After that Nginx is used by ACME to retrieve the actual ACME
certificates. <literal>security.acme.preliminarySelfsigned</literal> can be
used to control whether to generate the self-signed certificates.
</para>
</section>
</chapter>

View File

@ -0,0 +1,418 @@
{ config, pkgs, lib, ... }:
with lib;
let
cfg = config.services.hydra;
baseDir = "/var/lib/hydra";
hydraConf = pkgs.writeScript "hydra.conf" cfg.extraConfig;
hydraEnv =
{ HYDRA_DBI = cfg.dbi;
HYDRA_CONFIG = "${baseDir}/hydra.conf";
HYDRA_DATA = "${baseDir}";
};
env =
{ NIX_REMOTE = "daemon";
SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt"; # Remove in 16.03
PGPASSFILE = "${baseDir}/pgpass";
NIX_REMOTE_SYSTEMS = concatStringsSep ":" cfg.buildMachinesFiles;
} // optionalAttrs (cfg.smtpHost != null) {
EMAIL_SENDER_TRANSPORT = "SMTP";
EMAIL_SENDER_TRANSPORT_host = cfg.smtpHost;
} // hydraEnv // cfg.extraEnv;
serverEnv = env //
{ HYDRA_TRACKER = cfg.tracker;
COLUMNS = "80";
PGPASSFILE = "${baseDir}/pgpass-www"; # grrr
} // (optionalAttrs cfg.debugServer { DBIC_TRACE = "1"; });
localDB = "dbi:Pg:dbname=hydra;user=hydra;";
haveLocalDB = cfg.dbi == localDB;
in
{
###### interface
options = {
services.hydra = rec {
enable = mkOption {
type = types.bool;
default = false;
description = ''
Whether to run Hydra services.
'';
};
dbi = mkOption {
type = types.str;
default = localDB;
example = "dbi:Pg:dbname=hydra;host=postgres.example.org;user=foo;";
description = ''
The DBI string for Hydra database connection.
'';
};
package = mkOption {
type = types.path;
default = pkgs.hydra;
defaultText = "pkgs.hydra";
description = "The Hydra package.";
};
hydraURL = mkOption {
type = types.str;
description = ''
The base URL for the Hydra webserver instance. Used for links in emails.
'';
};
listenHost = mkOption {
type = types.str;
default = "*";
example = "localhost";
description = ''
The hostname or address to listen on or <literal>*</literal> to listen
on all interfaces.
'';
};
port = mkOption {
type = types.int;
default = 3000;
description = ''
TCP port the web server should listen to.
'';
};
minimumDiskFree = mkOption {
type = types.int;
default = 0;
description = ''
Threshold of minimum disk space (GiB) to determine if the queue runner should run or not.
'';
};
minimumDiskFreeEvaluator = mkOption {
type = types.int;
default = 0;
description = ''
Threshold of minimum disk space (GiB) to determine if the evaluator should run or not.
'';
};
notificationSender = mkOption {
type = types.str;
description = ''
Sender email address used for email notifications.
'';
};
smtpHost = mkOption {
type = types.nullOr types.str;
default = null;
example = ["localhost"];
description = ''
Hostname of the SMTP server to use to send email.
'';
};
tracker = mkOption {
type = types.str;
default = "";
description = ''
Piece of HTML that is included on all pages.
'';
};
logo = mkOption {
type = types.nullOr types.path;
default = null;
description = ''
Path to a file containing the logo of your Hydra instance.
'';
};
debugServer = mkOption {
type = types.bool;
default = false;
description = "Whether to run the server in debug mode.";
};
extraConfig = mkOption {
type = types.lines;
description = "Extra lines for the Hydra configuration.";
};
extraEnv = mkOption {
type = types.attrsOf types.str;
default = {};
description = "Extra environment variables for Hydra.";
};
gcRootsDir = mkOption {
type = types.path;
default = "/nix/var/nix/gcroots/hydra";
description = "Directory that holds Hydra garbage collector roots.";
};
buildMachinesFiles = mkOption {
type = types.listOf types.path;
default = [];
example = [ "/etc/nix/machines" "/var/lib/hydra/provisioner/machines" ];
description = "List of files containing build machines.";
};
useSubstitutes = mkOption {
type = types.bool;
default = false;
description = ''
Whether to use binary caches for downloading store paths. Note that
binary substitutions trigger (a potentially large number of) additional
HTTP requests that slow down the queue monitor thread significantly.
Also, this Hydra instance will serve those downloaded store paths to
its users with its own signature attached as if it had built them
itself, so don't enable this feature unless your active binary caches
are absolute trustworthy.
'';
};
};
};
###### implementation
config = mkIf cfg.enable {
users.extraGroups.hydra = { };
users.extraUsers.hydra =
{ description = "Hydra";
group = "hydra";
createHome = true;
home = baseDir;
useDefaultShell = true;
};
users.extraUsers.hydra-queue-runner =
{ description = "Hydra queue runner";
group = "hydra";
useDefaultShell = true;
home = "${baseDir}/queue-runner"; # really only to keep SSH happy
};
users.extraUsers.hydra-www =
{ description = "Hydra web server";
group = "hydra";
useDefaultShell = true;
};
nix.trustedUsers = [ "hydra-queue-runner" ];
services.hydra.extraConfig =
''
using_frontend_proxy 1
base_uri ${cfg.hydraURL}
notification_sender ${cfg.notificationSender}
max_servers 25
${optionalString (cfg.logo != null) ''
hydra_logo ${cfg.logo}
''}
gc_roots_dir ${cfg.gcRootsDir}
'';
environment.systemPackages = [ cfg.package ];
environment.variables = hydraEnv;
nix.extraOptions = ''
gc-keep-outputs = true
gc-keep-derivations = true
# The default (`true') slows Nix down a lot since the build farm
# has so many GC roots.
gc-check-reachability = false
'';
systemd.services.hydra-init =
{ wantedBy = [ "multi-user.target" ];
requires = optional haveLocalDB "postgresql.service";
after = optional haveLocalDB "postgresql.service";
environment = env;
preStart = ''
mkdir -p ${baseDir}
chown hydra.hydra ${baseDir}
chmod 0750 ${baseDir}
ln -sf ${hydraConf} ${baseDir}/hydra.conf
mkdir -m 0700 -p ${baseDir}/www
chown hydra-www.hydra ${baseDir}/www
mkdir -m 0700 -p ${baseDir}/queue-runner
mkdir -m 0750 -p ${baseDir}/build-logs
chown hydra-queue-runner.hydra ${baseDir}/queue-runner ${baseDir}/build-logs
${optionalString haveLocalDB ''
if ! [ -e ${baseDir}/.db-created ]; then
${config.services.postgresql.package}/bin/createuser hydra
${config.services.postgresql.package}/bin/createdb -O hydra hydra
touch ${baseDir}/.db-created
fi
''}
if [ ! -e ${cfg.gcRootsDir} ]; then
# Move legacy roots directory.
if [ -e /nix/var/nix/gcroots/per-user/hydra/hydra-roots ]; then
mv /nix/var/nix/gcroots/per-user/hydra/hydra-roots ${cfg.gcRootsDir}
fi
mkdir -p ${cfg.gcRootsDir}
fi
# Move legacy hydra-www roots.
if [ -e /nix/var/nix/gcroots/per-user/hydra-www/hydra-roots ]; then
find /nix/var/nix/gcroots/per-user/hydra-www/hydra-roots/ -type f \
| xargs -r mv -f -t ${cfg.gcRootsDir}/
rmdir /nix/var/nix/gcroots/per-user/hydra-www/hydra-roots
fi
chown hydra.hydra ${cfg.gcRootsDir}
chmod 2775 ${cfg.gcRootsDir}
'';
serviceConfig.ExecStart = "${cfg.package}/bin/hydra-init";
serviceConfig.PermissionsStartOnly = true;
serviceConfig.User = "hydra";
serviceConfig.Type = "oneshot";
serviceConfig.RemainAfterExit = true;
};
systemd.services.hydra-server =
{ wantedBy = [ "multi-user.target" ];
requires = [ "hydra-init.service" ];
after = [ "hydra-init.service" ];
environment = serverEnv;
serviceConfig =
{ ExecStart =
"@${cfg.package}/bin/hydra-server hydra-server -f -h '${cfg.listenHost}' "
+ "-p ${toString cfg.port} --max_spare_servers 5 --max_servers 25 "
+ "--max_requests 100 ${optionalString cfg.debugServer "-d"}";
User = "hydra-www";
PermissionsStartOnly = true;
Restart = "always";
};
};
systemd.services.hydra-queue-runner =
{ wantedBy = [ "multi-user.target" ];
requires = [ "hydra-init.service" ];
after = [ "hydra-init.service" "network.target" ];
path = [ cfg.package pkgs.nettools pkgs.openssh pkgs.bzip2 config.nix.package ];
environment = env // {
PGPASSFILE = "${baseDir}/pgpass-queue-runner"; # grrr
IN_SYSTEMD = "1"; # to get log severity levels
};
serviceConfig =
{ ExecStart = "@${cfg.package}/bin/hydra-queue-runner hydra-queue-runner -v --option build-use-substitutes ${if cfg.useSubstitutes then "true" else "false"}";
ExecStopPost = "${cfg.package}/bin/hydra-queue-runner --unlock";
User = "hydra-queue-runner";
Restart = "always";
# Ensure we can get core dumps.
LimitCORE = "infinity";
WorkingDirectory = "${baseDir}/queue-runner";
};
};
systemd.services.hydra-evaluator =
{ wantedBy = [ "multi-user.target" ];
requires = [ "hydra-init.service" ];
after = [ "hydra-init.service" "network.target" ];
path = [ pkgs.nettools ];
environment = env;
serviceConfig =
{ ExecStart = "@${cfg.package}/bin/hydra-evaluator hydra-evaluator";
User = "hydra";
Restart = "always";
WorkingDirectory = baseDir;
};
};
systemd.services.hydra-update-gc-roots =
{ requires = [ "hydra-init.service" ];
after = [ "hydra-init.service" ];
environment = env;
serviceConfig =
{ ExecStart = "@${cfg.package}/bin/hydra-update-gc-roots hydra-update-gc-roots";
User = "hydra";
};
startAt = "2,14:15";
};
systemd.services.hydra-send-stats =
{ wantedBy = [ "multi-user.target" ];
after = [ "hydra-init.service" ];
environment = env;
serviceConfig =
{ ExecStart = "@${cfg.package}/bin/hydra-send-stats hydra-send-stats";
User = "hydra";
};
};
# If there is less than a certain amount of free disk space, stop
# the queue/evaluator to prevent builds from failing or aborting.
systemd.services.hydra-check-space =
{ script =
''
if [ $(($(stat -f -c '%a' /nix/store) * $(stat -f -c '%S' /nix/store))) -lt $((${toString cfg.minimumDiskFree} * 1024**3)) ]; then
echo "stopping Hydra queue runner due to lack of free space..."
systemctl stop hydra-queue-runner
fi
if [ $(($(stat -f -c '%a' /nix/store) * $(stat -f -c '%S' /nix/store))) -lt $((${toString cfg.minimumDiskFreeEvaluator} * 1024**3)) ]; then
echo "stopping Hydra evaluator due to lack of free space..."
systemctl stop hydra-evaluator
fi
'';
startAt = "*:0/5";
};
# Periodically compress build logs. The queue runner compresses
# logs automatically after a step finishes, but this doesn't work
# if the queue runner is stopped prematurely.
systemd.services.hydra-compress-logs =
{ path = [ pkgs.bzip2 ];
script =
''
find /var/lib/hydra/build-logs -type f -name "*.drv" -mtime +3 -size +0c | xargs -r bzip2 -v -f
'';
startAt = "Sun 01:45";
};
services.postgresql.enable = mkIf haveLocalDB true;
services.postgresql.identMap = optionalString haveLocalDB
''
hydra-users hydra hydra
hydra-users hydra-queue-runner hydra
hydra-users hydra-www hydra
hydra-users root hydra
'';
services.postgresql.authentication = optionalString haveLocalDB
''
local hydra all ident map=hydra-users
'';
};
}

View File

@ -52,11 +52,12 @@ in
description = "
sldapd.conf configuration
";
example = ''
include ''${pkgs.openldap}/etc/openldap/schema/core.schema
include ''${pkgs.openldap}/etc/openldap/schema/cosine.schema
include ''${pkgs.openldap}/etc/openldap/schema/inetorgperson.schema
include ''${pkgs.openldap}/etc/openldap/schema/nis.schema
example = literalExample ''
'''
include ${pkgs.openldap.out}/etc/openldap/schema/core.schema
include ${pkgs.openldap.out}/etc/openldap/schema/cosine.schema
include ${pkgs.openldap.out}/etc/openldap/schema/inetorgperson.schema
include ${pkgs.openldap.out}/etc/openldap/schema/nis.schema
database bdb
suffix dc=example,dc=org
@ -64,6 +65,7 @@ in
# NOTE: change after first start
rootpw secret
directory /var/db/openldap
'''
'';
};
};

View File

@ -1,29 +1,51 @@
{ config, lib, pkgs, ... }:
let
cfgFile = pkgs.writeText "reader.conf" "";
in
with lib;
{
let
cfgFile = pkgs.writeText "reader.conf" config.services.pcscd.readerConfig;
pluginEnv = pkgs.buildEnv {
name = "pcscd-plugins";
paths = map (p: "${p}/pcsc/drivers") config.services.pcscd.plugins;
};
in {
###### interface
options = {
services.pcscd = {
enable = mkEnableOption "PCSC-Lite daemon";
enable = mkOption {
default = false;
description = "Whether to enable the PCSC-Lite daemon.";
plugins = mkOption {
type = types.listOf types.package;
default = [ pkgs.ccid ];
defaultText = "[ pkgs.ccid ]";
example = literalExample "[ pkgs.pcsc-cyberjack ]";
description = "Plugin packages to be used for PCSC-Lite.";
};
readerConfig = mkOption {
type = types.lines;
default = "";
example = ''
FRIENDLYNAME "Some serial reader"
DEVICENAME /dev/ttyS0
LIBPATH /path/to/serial_reader.so
CHANNELID 1
'';
description = ''
Configuration for devices that aren't hotpluggable.
See <citerefentry><refentrytitle>reader.conf</refentrytitle>
<manvolnum>5</manvolnum></citerefentry> for valid options.
'';
};
};
};
###### implementation
config = mkIf config.services.pcscd.enable {
@ -37,18 +59,11 @@ with lib;
systemd.services.pcscd = {
description = "PCSC-Lite daemon";
preStart = ''
mkdir -p /var/lib/pcsc
rm -Rf /var/lib/pcsc/drivers
ln -s ${pkgs.ccid}/pcsc/drivers /var/lib/pcsc/
'';
environment.PCSCLITE_HP_DROPDIR = pluginEnv;
serviceConfig = {
Type = "forking";
ExecStart = "${pkgs.pcsclite}/sbin/pcscd --auto-exit -c ${cfgFile}";
ExecReload = "${pkgs.pcsclite}/sbin/pcscd --hotplug";
ExecStart = "${pkgs.pcsclite}/sbin/pcscd -f -x -c ${cfgFile}";
ExecReload = "${pkgs.pcsclite}/sbin/pcscd -H";
};
};
};
}

View File

@ -89,8 +89,8 @@ in
'';
example = literalExample "${pkgs.dnscrypt-proxy}/share/dnscrypt-proxy/dnscrypt-resolvers.csv";
default = pkgs.fetchurl {
url = "https://raw.githubusercontent.com/jedisct1/dnscrypt-proxy/master/dnscrypt-resolvers.csv";
sha256 = "0lac20qhcgjxxiiz8jzcn3hkqj4ywl58hahp5n2i6vf9akfyqp7c";
url = https://raw.githubusercontent.com/jedisct1/dnscrypt-proxy/master/dnscrypt-resolvers.csv;
sha256 = "171zvdqcqqvcw3zr7wl9h1wmdmk6m3h55xr4gq2z1j7a0x0ba2in";
};
defaultText = "pkgs.fetchurl { url = ...; sha256 = ...; }";
};

View File

@ -29,21 +29,27 @@ let
done
${cfg.up}
${optionalString cfg.updateResolvConf
"${pkgs.update-resolv-conf}/libexec/openvpn/update-resolv-conf"}
'';
downScript = ''
#! /bin/sh
export PATH=${path}
${optionalString cfg.updateResolvConf
"${pkgs.update-resolv-conf}/libexec/openvpn/update-resolv-conf"}
${cfg.down}
'';
configFile = pkgs.writeText "openvpn-config-${name}"
''
errors-to-stderr
${optionalString (cfg.up != "" || cfg.down != "") "script-security 2"}
${optionalString (cfg.up != "" || cfg.down != "" || cfg.updateResolvConf) "script-security 2"}
${cfg.config}
${optionalString (cfg.up != "") "up ${pkgs.writeScript "openvpn-${name}-up" upScript}"}
${optionalString (cfg.down != "") "down ${pkgs.writeScript "openvpn-${name}-down" downScript}"}
${optionalString (cfg.up != "" || cfg.updateResolvConf)
"up ${pkgs.writeScript "openvpn-${name}-up" upScript}"}
${optionalString (cfg.down != "" || cfg.updateResolvConf)
"down ${pkgs.writeScript "openvpn-${name}-down" downScript}"}
'';
in {
@ -145,6 +151,16 @@ in
description = "Whether this OpenVPN instance should be started automatically.";
};
updateResolvConf = mkOption {
default = false;
type = types.bool;
description = ''
Use the script from the update-resolv-conf package to automatically
update resolv.conf with the DNS information provided by openvpn. The
script will be run after the "up" commands and before the "down" commands.
'';
};
};
};

View File

@ -0,0 +1,523 @@
# NixOS module for oauth2_proxy.
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.oauth2_proxy;
# Use like:
# repeatedArgs (arg: "--arg=${arg}") args
repeatedArgs = concatMapStringsSep " ";
# 'toString' doesn't quite do what we want for bools.
fromBool = x: if x then "true" else "false";
# oauth2_proxy provides many options that are only relevant if you are using
# a certain provider. This set maps from provider name to a function that
# takes the configuration and returns a string that can be inserted into the
# command-line to launch oauth2_proxy.
providerSpecificOptions = {
azure = cfg: ''
--azure-tenant=${cfg.azure.tenant} \
--resource=${cfg.azure.resource} \
'';
github = cfg: ''
$(optionalString (!isNull cfg.github.org) "--github-org=${cfg.github.org}") \
$(optionalString (!isNull cfg.github.team) "--github-org=${cfg.github.team}") \
'';
google = cfg: ''
--google-admin-email=${cfg.google.adminEmail} \
--google-service-account=${cfg.google.serviceAccountJSON} \
$(repeatedArgs (group: "--google-group=${group}") cfg.google.groups) \
'';
};
authenticatedEmailsFile = pkgs.writeText "authenticated-emails" cfg.email.addresses;
getProviderOptions = cfg: provider:
if providerSpecificOptions ? provider then providerSpecificOptions.provider cfg else "";
mkCommandLine = cfg: ''
--provider='${cfg.provider}' \
${optionalString (!isNull cfg.email.addresses) "--authenticated-emails-file='${authenticatedEmailsFile}'"} \
--approval-prompt='${cfg.approvalPrompt}' \
${optionalString (cfg.passBasicAuth && !isNull cfg.basicAuthPassword) "--basic-auth-password='${cfg.basicAuthPassword}'"} \
--client-id='${cfg.clientID}' \
--client-secret='${cfg.clientSecret}' \
${optionalString (!isNull cfg.cookie.domain) "--cookie-domain='${cfg.cookie.domain}'"} \
--cookie-expire='${cfg.cookie.expire}' \
--cookie-httponly=${fromBool cfg.cookie.httpOnly} \
--cookie-name='${cfg.cookie.name}' \
--cookie-secret='${cfg.cookie.secret}' \
--cookie-secure=${fromBool cfg.cookie.secure} \
${optionalString (!isNull cfg.cookie.refresh) "--cookie-refresh='${cfg.cookie.refresh}'"} \
${optionalString (!isNull cfg.customTemplatesDir) "--custom-templates-dir='${cfg.customTemplatesDir}'"} \
${repeatedArgs (x: "--email-domain='${x}'") cfg.email.domains} \
--http-address='${cfg.httpAddress}' \
${optionalString (!isNull cfg.htpasswd.file) "--htpasswd-file='${cfg.htpasswd.file}' --display-htpasswd-form=${fromBool cfg.htpasswd.displayForm}"} \
${optionalString (!isNull cfg.loginURL) "--login-url='${cfg.loginURL}'"} \
--pass-access-token=${fromBool cfg.passAccessToken} \
--pass-basic-auth=${fromBool cfg.passBasicAuth} \
--pass-host-header=${fromBool cfg.passHostHeader} \
--proxy-prefix='${cfg.proxyPrefix}' \
${optionalString (!isNull cfg.profileURL) "--profile-url='${cfg.profileURL}'"} \
${optionalString (!isNull cfg.redeemURL) "--redeem-url='${cfg.redeemURL}'"} \
${optionalString (!isNull cfg.redirectURL) "--redirect-url='${cfg.redirectURL}'"} \
--request-logging=${fromBool cfg.requestLogging} \
${optionalString (!isNull cfg.scope) "--scope='${cfg.scope}'"} \
${repeatedArgs (x: "--skip-auth-regex='${x}'") cfg.skipAuthRegexes} \
${optionalString (!isNull cfg.signatureKey) "--signature-key='${cfg.signatureKey}'"} \
--upstream='${cfg.upstream}' \
${optionalString (!isNull cfg.validateURL) "--validate-url='${cfg.validateURL}'"} \
${optionalString cfg.tls.enable "--tls-cert='${cfg.tls.certificate}' --tls-key='${cfg.tls.key}' --https-address='${cfg.tls.httpsAddress}'"} \
'' + getProviderOptions cfg cfg.provider;
in
{
options.services.oauth2_proxy = {
enable = mkEnableOption "oauth2_proxy";
package = mkOption {
type = types.package;
default = pkgs.oauth2_proxy;
defaultText = "pkgs.oauth2_proxy";
description = ''
The package that provides oauth2_proxy.
'';
};
##############################################
# PROVIDER configuration
provider = mkOption {
type = types.enum [
"google"
"github"
"azure"
"gitlab"
"linkedin"
"myusa"
];
default = "google";
description = ''
OAuth provider.
'';
};
approvalPrompt = mkOption {
type = types.enum ["force" "auto"];
default = "force";
description = ''
OAuth approval_prompt.
'';
};
clientID = mkOption {
type = types.str;
description = ''
The OAuth Client ID.
'';
example = "123456.apps.googleusercontent.com";
};
clientSecret = mkOption {
type = types.str;
description = ''
The OAuth Client Secret.
'';
};
skipAuthRegexes = mkOption {
type = types.listOf types.str;
default = [];
description = ''
Skip authentication for requests matching any of these regular
expressions.
'';
};
# XXX: Not clear whether these two options are mutually exclusive or not.
email = {
domains = mkOption {
type = types.listOf types.str;
default = [];
description = ''
Authenticate emails with the specified domains. Use
<literal>*</literal> to authenticate any email.
'';
};
addresses = mkOption {
type = types.nullOr types.lines;
default = null;
description = ''
Line-separated email addresses that are allowed to authenticate.
'';
};
};
loginURL = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
Authentication endpoint.
You only need to set this if you are using a self-hosted provider (e.g.
Github Enterprise). If you're using a publicly hosted provider
(e.g github.com), then the default works.
'';
example = "https://provider.example.com/oauth/authorize";
};
redeemURL = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
Token redemption endpoint.
You only need to set this if you are using a self-hosted provider (e.g.
Github Enterprise). If you're using a publicly hosted provider
(e.g github.com), then the default works.
'';
example = "https://provider.example.com/oauth/token";
};
validateURL = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
Access token validation endpoint.
You only need to set this if you are using a self-hosted provider (e.g.
Github Enterprise). If you're using a publicly hosted provider
(e.g github.com), then the default works.
'';
example = "https://provider.example.com/user/emails";
};
redirectURL = mkOption {
# XXX: jml suspects this is always necessary, but the command-line
# doesn't require it so making it optional.
type = types.nullOr types.str;
default = null;
description = ''
The OAuth2 redirect URL.
'';
example = "https://internalapp.yourcompany.com/oauth2/callback";
};
azure = {
tenant = mkOption {
type = types.str;
default = "common";
description = ''
Go to a tenant-specific or common (tenant-independent) endpoint.
'';
};
resource = mkOption {
type = types.str;
description = ''
The resource that is protected.
'';
};
};
google = {
adminEmail = mkOption {
type = types.str;
description = ''
The Google Admin to impersonate for API calls.
Only users with access to the Admin APIs can access the Admin SDK
Directory API, thus the service account needs to impersonate one of
those users to access the Admin SDK Directory API.
See <link xlink:href="https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account" />.
'';
};
groups = mkOption {
type = types.listOf types.str;
default = [];
description = ''
Restrict logins to members of these Google groups.
'';
};
serviceAccountJSON = mkOption {
type = types.path;
description = ''
The path to the service account JSON credentials.
'';
};
};
github = {
org = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
Restrict logins to members of this organisation.
'';
};
team = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
Restrict logins to members of this team.
'';
};
};
####################################################
# UPSTREAM Configuration
upstream = mkOption {
type = types.commas;
description = ''
The http url(s) of the upstream endpoint or <literal>file://</literal>
paths for static files. Routing is based on the path.
'';
};
passAccessToken = mkOption {
type = types.bool;
default = false;
description = ''
Pass OAuth access_token to upstream via X-Forwarded-Access-Token header.
'';
};
passBasicAuth = mkOption {
type = types.bool;
default = true;
description = ''
Pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream.
'';
};
basicAuthPassword = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
The password to set when passing the HTTP Basic Auth header.
'';
};
passHostHeader = mkOption {
type = types.bool;
default = true;
description = ''
Pass the request Host Header to upstream.
'';
};
signatureKey = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
GAP-Signature request signature key.
'';
example = "sha1:secret0";
};
cookie = {
domain = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
An optional cookie domain to force cookies to.
'';
example = ".yourcompany.com";
};
expire = mkOption {
type = types.str;
default = "168h0m0s";
description = ''
Expire timeframe for cookie.
'';
};
httpOnly = mkOption {
type = types.bool;
default = true;
description = ''
Set HttpOnly cookie flag.
'';
};
name = mkOption {
type = types.str;
default = "_oauth2_proxy";
description = ''
The name of the cookie that the oauth_proxy creates.
'';
};
refresh = mkOption {
# XXX: Unclear what the behavior is when this is not specified.
type = types.nullOr types.str;
default = null;
description = ''
Refresh the cookie after this duration; 0 to disable.
'';
example = "168h0m0s";
};
secret = mkOption {
type = types.str;
description = ''
The seed string for secure cookies.
'';
};
secure = mkOption {
type = types.bool;
default = true;
description = ''
Set secure (HTTPS) cookie flag.
'';
};
};
####################################################
# OAUTH2 PROXY configuration
httpAddress = mkOption {
type = types.str;
default = "127.0.0.1:4180";
description = ''
HTTPS listening address. This module does not expose the port by
default. If you want this URL to be accessible to other machines, please
add the port to <literal>networking.firewall.allowedTCPPorts</literal>.
'';
};
htpasswd = {
file = mkOption {
type = types.nullOr types.path;
default = null;
description = ''
Additionally authenticate against a htpasswd file. Entries must be
created with <literal>htpasswd -s</literal> for SHA encryption.
'';
};
displayForm = mkOption {
type = types.bool;
default = true;
description = ''
Display username / password login form if an htpasswd file is provided.
'';
};
};
customTemplatesDir = mkOption {
type = types.nullOr types.path;
default = null;
description = ''
Path to custom HTML templates.
'';
};
proxyPrefix = mkOption {
type = types.str;
default = "/oauth2";
description = ''
The url root path that this proxy should be nested under.
'';
};
tls = {
enable = mkOption {
type = types.bool;
default = false;
description = ''
Whether to serve over TLS.
'';
};
certificate = mkOption {
type = types.path;
description = ''
Path to certificate file.
'';
};
key = mkOption {
type = types.path;
description = ''
Path to private key file.
'';
};
httpsAddress = mkOption {
type = types.str;
default = ":443";
description = ''
<literal>addr:port</literal> to listen on for HTTPS clients.
Remember to add <literal>port</literal> to
<literal>allowedTCPPorts</literal> if you want other machines to be
able to connect to it.
'';
};
};
requestLogging = mkOption {
type = types.bool;
default = true;
description = ''
Log requests to stdout.
'';
};
####################################################
# UNKNOWN
# XXX: Is this mandatory? Is it part of another group? Is it part of the provider specification?
scope = mkOption {
# XXX: jml suspects this is always necessary, but the command-line
# doesn't require it so making it optional.
type = types.nullOr types.str;
default = null;
description = ''
OAuth scope specification.
'';
};
profileURL = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
Profile access endpoint.
'';
};
};
config = mkIf cfg.enable {
users.extraUsers.oauth2_proxy = {
description = "OAuth2 Proxy";
};
systemd.services.oauth2_proxy = {
description = "OAuth2 Proxy";
path = [ cfg.package ];
wantedBy = [ "multi-user.target" ];
after = [ "network-interfaces.target" ];
serviceConfig = {
User = "oauth2_proxy";
Restart = "always";
ExecStart = "${cfg.package}/bin/oauth2_proxy ${mkCommandLine cfg}";
};
};
};
}

View File

@ -81,7 +81,6 @@ in {
};
environment.gnome3.packageSet = mkOption {
type = types.nullOr types.package;
default = null;
example = literalExample "pkgs.gnome3_18";
description = "Which GNOME 3 package set to use.";

View File

@ -117,6 +117,9 @@ in
# Install activity manager if available
++ lib.optional (lib.hasAttr "kactivitymanagerd" kde5) kde5.kactivitymanagerd
# frameworkintegration was split with plasma-integration in Plasma 5.6
++ lib.optional (lib.hasAttr "plasma-integration" kde5) kde5.plasma-integration
# Optional hardware support features
++ lib.optional config.hardware.bluetooth.enable kde5.bluedevil
++ lib.optional config.networking.networkmanager.enable kde5.plasma-nm
@ -167,7 +170,9 @@ in
services.xserver.displayManager.sddm = {
theme = "breeze";
themes = [
kde5.extra-cmake-modules # for the setup-hook
kde5.plasma-workspace
kde5.breeze-icons
(kde5.oxygen-icons or kde5.oxygen-icons5)
];
};

View File

@ -463,7 +463,14 @@ in
{ source = "${cfg.xkbDir}";
target = "X11/xkb";
}
]);
])
# Needed since 1.18; see https://bugs.freedesktop.org/show_bug.cgi?id=89023#c5
++ (let cfgPath = "/X11/xorg.conf.d/10-evdev.conf"; in
[{
source = xorg.xf86inputevdev.out + "/share" + cfgPath;
target = cfgPath;
}]
);
environment.systemPackages =
[ xorg.xorgserver.out
@ -479,6 +486,7 @@ in
xorg.xauth
pkgs.xterm
pkgs.xdg_utils
xorg.xf86inputevdev.out # get evdev.4 man page
]
++ optional (elem "virtualbox" cfg.videoDrivers) xorg.xrefresh;
@ -538,7 +546,7 @@ in
services.xserver.modules =
concatLists (catAttrs "modules" cfg.drivers) ++
[ xorg.xorgserver.out
xorg.xf86inputevdev
xorg.xf86inputevdev.out
];
services.xserver.xkbDir = mkDefault "${pkgs.xkeyboard_config}/etc/X11/xkb";

View File

@ -4,19 +4,16 @@ with lib;
{
options.boot.loader.efi = {
canTouchEfiVariables = mkOption {
default = false;
type = types.bool;
description = "Whether or not the installation process should modify efi boot variables.";
description = "Whether the installation process is allowed to modify EFI boot variables.";
};
efiSysMountPoint = mkOption {
default = "/boot";
type = types.str;
description = "Where the EFI System Partition is mounted.";
};
};

View File

@ -488,7 +488,7 @@ in
}
{
assertion = if args.efiSysMountPoint == null then true else hasPrefix "/" args.efiSysMountPoint;
message = "Efi paths must be absolute, not ${args.efiSysMountPoint}";
message = "EFI paths must be absolute, not ${args.efiSysMountPoint}";
}
] ++ flip map args.devices (device: {
assertion = device == "nodev" || hasPrefix "/" device;

View File

@ -88,16 +88,16 @@ def remove_old_entries(gens):
if not path in known_paths:
os.unlink(path)
parser = argparse.ArgumentParser(description='Update NixOS-related gummiboot files')
parser = argparse.ArgumentParser(description='Update NixOS-related systemd-boot files')
parser.add_argument('default_config', metavar='DEFAULT-CONFIG', help='The default NixOS config to boot')
args = parser.parse_args()
# We deserve our own env var!
if os.getenv("NIXOS_INSTALL_GRUB") == "1":
if "@canTouchEfiVariables@" == "1":
subprocess.check_call(["@gummiboot@/bin/gummiboot", "--path=@efiSysMountPoint@", "install"])
subprocess.check_call(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "install"])
else:
subprocess.check_call(["@gummiboot@/bin/gummiboot", "--path=@efiSysMountPoint@", "--no-variables", "install"])
subprocess.check_call(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "--no-variables", "install"])
mkdir_p("@efiSysMountPoint@/efi/nixos")
mkdir_p("@efiSysMountPoint@/loader/entries")

View File

@ -3,16 +3,18 @@
with lib;
let
cfg = config.boot.loader.gummiboot;
cfg = config.boot.loader.systemd-boot;
efi = config.boot.loader.efi;
gummibootBuilder = pkgs.substituteAll {
src = ./gummiboot-builder.py;
src = ./systemd-boot-builder.py;
isExecutable = true;
inherit (pkgs) python gummiboot;
inherit (pkgs) python;
systemd = config.systemd.package;
nix = config.nix.package.out;
@ -21,13 +23,18 @@ let
inherit (efi) efiSysMountPoint canTouchEfiVariables;
};
in {
options.boot.loader.gummiboot = {
imports =
[ (mkRenamedOptionModule [ "boot" "loader" "gummiboot" "enable" ] [ "boot" "loader" "systemd-boot" "enable" ])
];
options.boot.loader.systemd-boot = {
enable = mkOption {
default = false;
type = types.bool;
description = "Whether to enable the gummiboot UEFI boot manager";
description = "Whether to enable the systemd-boot (formerly gummiboot) EFI boot manager";
};
};
@ -45,7 +52,7 @@ in {
system = {
build.installBootLoader = gummibootBuilder;
boot.loader.id = "gummiboot";
boot.loader.id = "systemd-boot";
requiredKernelConfig = with config.lib.kernelConfig; [
(isYes "EFI_STUB")

View File

@ -41,6 +41,8 @@ if [ ! -e /proc/1 ]; then
mount -n -t proc proc /proc
mkdir -m 0755 -p /dev
mount -t devtmpfs devtmpfs /dev
mkdir -m 0755 -p /sys
mount -t sysfs sysfs /sys
fi

View File

@ -77,7 +77,7 @@ in
KERNEL=="vboxuser", OWNER="root", GROUP="root", MODE="0666"
# Allow systemd dependencies on vboxguest.
KERNEL=="vboxguest", TAG+="systemd"
SUBSYSTEM=="misc", KERNEL=="vboxguest", TAG+="systemd"
'';
};

View File

@ -0,0 +1,41 @@
import ./make-test.nix ({ pkgs, ...} : {
name = "gnome3-gdm";
meta = with pkgs.stdenv.lib.maintainers; {
maintainers = [ lethalman ];
};
machine =
{ config, pkgs, ... }:
{ imports = [ ./common/user-account.nix ];
services.xserver.enable = true;
services.xserver.displayManager.gdm = {
enable = true;
autoLogin = {
enable = true;
user = "alice";
};
};
services.xserver.desktopManager.gnome3.enable = true;
environment.gnome3.packageSet = pkgs.gnome3_20;
virtualisation.memorySize = 512;
};
testScript =
''
$machine->waitForX;
$machine->sleep(15);
# Check that logging in has given the user ownership of devices.
$machine->succeed("getfacl /dev/snd/timer | grep -q alice");
$machine->succeed("su - alice -c 'DISPLAY=:0.0 gnome-terminal &'");
$machine->succeed("xauth merge ~alice/.Xauthority");
$machine->waitForWindow(qr/Terminal/);
$machine->sleep(20);
$machine->screenshot("screen");
'';
})

38
nixos/tests/gnome3_20.nix Normal file
View File

@ -0,0 +1,38 @@
import ./make-test.nix ({ pkgs, ...} : {
name = "gnome3";
meta = with pkgs.stdenv.lib.maintainers; {
maintainers = [ domenkozar eelco chaoflow lethalman ];
};
machine =
{ config, pkgs, ... }:
{ imports = [ ./common/user-account.nix ];
services.xserver.enable = true;
services.xserver.displayManager.auto.enable = true;
services.xserver.displayManager.auto.user = "alice";
services.xserver.desktopManager.gnome3.enable = true;
environment.gnome3.packageSet = pkgs.gnome3_20;
virtualisation.memorySize = 512;
};
testScript =
''
$machine->waitForX;
$machine->sleep(15);
# Check that logging in has given the user ownership of devices.
$machine->succeed("getfacl /dev/snd/timer | grep -q alice");
$machine->succeed("su - alice -c 'DISPLAY=:0.0 gnome-terminal &'");
$machine->succeed("xauth merge ~alice/.Xauthority");
$machine->waitForWindow(qr/Terminal/);
$machine->mustSucceed("timeout 900 bash -c 'journalctl -f|grep -m 1 \"GNOME Shell started\"'");
$machine->sleep(10);
$machine->screenshot("screen");
'';
})

View File

@ -30,8 +30,8 @@ let
boot.loader.grub.configurationLimit = 100 + ${toString forceGrubReinstallCount};
''}
${optionalString (bootLoader == "gummiboot") ''
boot.loader.gummiboot.enable = true;
${optionalString (bootLoader == "systemd-boot") ''
boot.loader.systemd-boot.enable = true;
''}
hardware.enableAllFirmware = lib.mkForce false;
@ -57,7 +57,7 @@ let
(if system == "x86_64-linux" then "-m 768 " else "-m 512 ") +
(optionalString (system == "x86_64-linux") "-cpu kvm64 ");
hdFlags = ''hda => "vm-state-machine/machine.qcow2", hdaInterface => "${iface}", ''
+ optionalString (bootLoader == "gummiboot") ''bios => "${pkgs.OVMF}/FV/OVMF.fd", '';
+ optionalString (bootLoader == "systemd-boot") ''bios => "${pkgs.OVMF}/FV/OVMF.fd", '';
in
''
$machine->start;
@ -159,7 +159,7 @@ let
makeInstallerTest = name:
{ createPartitions, preBootCommands ? "", extraConfig ? ""
, bootLoader ? "grub" # either "grub" or "gummiboot"
, bootLoader ? "grub" # either "grub" or "systemd-boot"
, grubVersion ? 2, grubDevice ? "/dev/vda", grubIdentifier ? "uuid"
, enableOCR ? false, meta ? {}
}:
@ -195,7 +195,7 @@ let
virtualisation.qemu.diskInterface =
if grubVersion == 1 then "scsi" else "virtio";
boot.loader.gummiboot.enable = mkIf (bootLoader == "gummiboot") true;
boot.loader.systemd-boot.enable = mkIf (bootLoader == "systemd-boot") true;
hardware.enableAllFirmware = mkForce false;
@ -208,7 +208,6 @@ let
pkgs.unionfs-fuse
pkgs.ntp
pkgs.nixos-artwork
pkgs.gummiboot
pkgs.perlPackages.XMLLibXML
pkgs.perlPackages.ListCompare
]
@ -250,7 +249,7 @@ in {
'';
};
# Simple GPT/UEFI configuration using Gummiboot with 3 partitions: ESP, swap & root filesystem
# Simple GPT/UEFI configuration using systemd-boot with 3 partitions: ESP, swap & root filesystem
simpleUefiGummiboot = makeInstallerTest "simpleUefiGummiboot"
{ createPartitions =
''
@ -270,7 +269,7 @@ in {
"mount LABEL=BOOT /mnt/boot",
);
'';
bootLoader = "gummiboot";
bootLoader = "systemd-boot";
};
# Same as the previous, but now with a separate /boot partition.

View File

@ -1,4 +1,6 @@
import ./make-test.nix ({ pkgs, ...} : {
import ./make-test.nix ({ pkgs, ...} :
{
name = "sddm";
meta = with pkgs.stdenv.lib.maintainers; {
maintainers = [ ttuegel ];
@ -6,6 +8,7 @@ import ./make-test.nix ({ pkgs, ...} : {
machine = { lib, ... }: {
imports = [ ./common/user-account.nix ];
virtualisation.memorySize = 1024;
services.xserver.enable = true;
services.xserver.displayManager.sddm = {
enable = true;
@ -14,18 +17,38 @@ import ./make-test.nix ({ pkgs, ...} : {
user = "alice";
};
};
services.xserver.windowManager.default = "icewm";
services.xserver.windowManager.icewm.enable = true;
services.xserver.desktopManager.default = "none";
services.xserver.desktopManager.kde5.enable = true;
};
enableOCR = true;
testScript = { nodes, ... }: ''
startAll;
$machine->waitForFile("/home/alice/.Xauthority");
$machine->succeed("xauth merge ~alice/.Xauthority");
$machine->waitForWindow("^IceWM ");
testScript = { nodes, ... }:
let xdo = "${pkgs.xdotool}/bin/xdotool"; in
''
sub krunner {
my ($win,) = @_;
$machine->execute("${xdo} key Alt+F2 sleep 1 type $win");
$machine->execute("${xdo} search --sync --onlyvisible --class krunner sleep 5 key Return");
}
$machine->waitUntilSucceeds("pgrep plasmashell");
$machine->succeed("xauth merge ~alice/.Xauthority");
$machine->waitForWindow(qr/Desktop.*/);
# Check that logging in has given the user ownership of devices.
$machine->succeed("getfacl /dev/snd/timer | grep -q alice");
krunner("dolphin");
$machine->waitForWindow(qr/.*Dolphin/);
krunner("konsole");
$machine->waitForWindow(qr/.*Konsole/);
krunner("systemsettings5");
$machine->waitForWindow(qr/.*Settings/);
$machine->sleep(20);
$machine->execute("${xdo} key Alt+F1 sleep 10");
$machine->screenshot("screen");
'';
})

View File

@ -52,7 +52,7 @@ in
--replace '#!/usr/bin/perl' '#!${perl}/bin/perl'
wrapProgram "$out/bin/abcde" --prefix PATH ":" \
"$out/bin:${which}/bin:${libcdio}/bin:${cddiscid}/bin:${wget}/bin:${vorbis-tools}/bin:${id3v2}/bin:${eyeD3}/bin:${lame}/bin:${flac}/bin"
${stdenv.lib.makeBinPath [ "$out" which libcdio cddiscid wget vorbis-tools id3v2 eyeD3 lame flac ]}
wrapProgram "$out/bin/cddb-tool" --prefix PATH ":" \
"${wget}/bin"

View File

@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
src = fetchgit {
url = git://git.ardour.org/ardour/ardour.git;
rev = "7024232855d268633760674d34c096ce447b7240";
sha256 = "ede3730455c3c91b2fd612871fa7262bdacd3dff4ba77c5dfbc3c1f0de9b8a36";
sha256 = "0pnnx22asizin5rvf352nfv6003zarw3jd64magp10310wrfiwbq";
};
buildInputs =

View File

@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
src = fetchgit {
url = "https://github.com/harryhaaren/openAV-ArtyFX.git";
rev = "3a8cb9a5e4ffaf27a497a31cc9cd6f2e79622d5b";
sha256 = "2e3f6ab6f829c0ec177e85f4e419286616cf35fb7303445caa09d3438cac27d5";
sha256 = "0nsmycm64a686ysfnmdvnaazijvfj90z5wyp96kyr81nsrbcv2ij";
};
buildInputs = [ cairomm cmake libjack2 libpthreadstubs libXdmcp libxshmfence libsndfile lv2 ntk pkgconfig ];

View File

@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
src = fetchgit {
url = "https://github.com/DISTRHO/DISTRHO-Ports.git";
rev = "53458838505efef91ed069d0a7d970b6b3588eba";
sha256 = "0fb4dxfvvqy8lnm9c91sxwn5wbcw8grfpm52zag25vrls251aih3";
sha256 = "1wjzgy5yyi52fn4si2m8zrbbzqsh3p75avfx744jmxj5gpq5qa92";
};
patchPhase = ''

View File

@ -14,7 +14,7 @@ let
src = fetchgit {
url = "git://git.code.sf.net/p/faudiostream/code";
rev = "931fca3e649f99ef09025d37bd6a7dc70a03e6f6";
sha256 = "05yam8jfdnziysvpxa5w118k5bbl103vamyqgka6vyhjjizp1nx7";
sha256 = "1h2qfwxqf9406v0w6kqyxlzn88zw3xmwgxg9f01n4jvd72zxll78";
};
meta = with stdenv.lib; {

View File

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
src = fetchgit {
url = "https://github.com/OSSIA/i-score.git";
rev = "ede2453b139346ae46702b5e2643c5488f8c89fb";
sha256 = "04li771nj0k8gym7vg6rnawjkp2f6d5m5mby26h0k6ksf7hg7h70";
sha256 = "0mk0zsqhx9z7ry1amjki89h6yp5ysi1qgy2j3kzhrm5sfazvf0x3";
leaveDotGit = true;
deepClone = true;
};

View File

@ -7,7 +7,7 @@ stdenv.mkDerivation {
src = fetchgit {
url = https://github.com/swh/ladspa.git;
rev = "4b8437e8037cace3d5bf8ce6d1d1da0182aba686";
sha256 = "7d9aa13a064903b330bd52e35c1f810f1c8a253ea5eb4e5a3a69a051af03150e";
sha256 = "1rmqm4780dhp0pj2scl3k7m8hpp1x6w6ln4wwg954zb9570rqaxx";
};
buildInputs = [ autoreconfHook fftw ladspaH libxml2 pkgconfig perl perlPackages.XMLParser ];

View File

@ -8,7 +8,7 @@ pythonPackages.buildPythonApplication rec {
src = fetchgit {
url = "git://github.com/aszlig/LastWatch.git";
rev = "refs/tags/v${version}";
sha256 = "c43f0fd87e9f3daafc7e8676daf2e89c8e21fbabc278eb1455e28d2997587a92";
sha256 = "0nlng3595j5jvnikk8i5hb915zak5zsmfn2306cc4gfcns9xzjwp";
};
pythonPath = [

View File

@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
url = "https://github.com/thomasvs/morituri.git";
fetchSubmodules = true;
rev = "135b2f7bf27721177e3aeb1d26403f1b29116599";
sha256 = "1ccxq1spny6xgd7nqwn13n9nqa00ay0nhflg3vbdkvbirh8fgxwq";
sha256 = "1sl5y5j3gdbynf2v0gf9dwd2hzawj8lm8ywadid7qm34yn8lx12k";
};
pythonPath = [

View File

@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
src = fetchgit {
url = "https://github.com/cth103/plugin-torture";
rev = "9ee06016982bdfbaa215cd0468cc6ada6367462a";
sha256 = "bfe9213fd2c1451d7acc1381d63301c4e6ff69ce86d31a886ece5159ba850706";
sha256 = "0ynzfs3z95lbw4l1w276as2a37zxp0cw6pi3lbikr0qk0r7j5j10";
};
buildInputs = [ boost ladspaH lilv lv2 pkgconfig serd sord sratom ];

View File

@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
src = fetchgit {
url = "https://github.com/swh/lv2.git";
rev = "978d5d8f549fd22048157a6d044af0faeaacbd7f";
sha256 = "3a9c042785b856623339aedafa5bc019b41beb8034d8594c7bbd6c9c26368065";
sha256 = "10jj8sp67caxvmzjxwyzapc34jpry5nrkkp49kyyvyk5dgkpbsjw";
};
patchPhase = ''

View File

@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
url = "https://github.com/zamaudio/zam-plugins.git";
deepClone = true;
rev = "91fe56931a3e57b80f18c740d2dde6b44f962aee";
sha256 = "1s0s028h3z3pfd4qvi63fsg6bv33bvz0p5fbmbmhypzqjlx6mlkb";
sha256 = "1ldrqh6nk0m1axb553wjp1gfznw8b6b3k0v0z1jdwy425sl6g07d";
};
buildInputs = [ boost libX11 mesa liblo libjack2 ladspaH lv2 pkgconfig rubberband libsndfile ];

View File

@ -1,15 +1,15 @@
{ stdenv, fetchurl, makeWrapper, jre, cpio, gawk, gnugrep, gnused, procps, swt, gtk2, glib, libXtst }:
let
version = "4.6.0";
rev = "3"; #tracks unversioned changes that occur on download.code42.com from time to time
version = "4.7.0";
rev = "1"; #tracks unversioned changes that occur on download.code42.com from time to time
in stdenv.mkDerivation rec {
name = "crashplan-${version}-r${rev}";
crashPlanArchive = fetchurl {
url = "https://download.code42.com/installs/linux/install/CrashPlan/CrashPlan_${version}_Linux.tgz";
sha256 = "0crrx8gy132xcpjfah08qhsl8g2arx14p5mpypcihl9j6mldi6mz";
sha256 = "1r50fyswvqjxsdslbyibbxwz2fs8iim15hxr0k05jrzmkhjm4g5v";
};
srcs = [ crashPlanArchive ];

View File

@ -68,14 +68,19 @@ in
stdenv.mkDerivation {
name = "sddm-${version}";
phases = "installPhase";
nativeBuildInputs = [ lndir makeQtWrapper ];
buildInputs = [ unwrapped ] ++ themes;
themes = map (pkg: pkg.out or pkg) themes;
inherit unwrapped;
unpackPhase = "true";
configurePhase = "runHook preConfigure; runHook postConfigure";
buildPhase = "runHook preBuild; runHook postBuild";
installPhase = ''
runHook preInstall
makeQtWrapper "$unwrapped/bin/sddm" "$out/bin/sddm"
mkdir -p "$out/share/sddm"
@ -85,6 +90,8 @@ stdenv.mkDerivation {
lndir -silent "$sddmDir" "$out/share/sddm"
fi
done
runHook postInstall
'';
inherit (unwrapped) meta;

View File

@ -31,6 +31,8 @@ stdenv.mkDerivation rec {
patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
--set-rpath "${atomEnv.libPath}" \
$out/share/atom/resources/app/apm/bin/node
patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
$out/share/atom/resources/app.asar.unpacked/node_modules/symbols-view/vendor/ctags-linux
'';
meta = with stdenv.lib; {

View File

@ -1,12 +1,14 @@
diff --git a/lib/careadlinkat.h b/lib/careadlinkat.h
index 5cdb813..7a272e8 100644
index 84ede3e..8e8f42e 100644
--- a/lib/careadlinkat.h
+++ b/lib/careadlinkat.h
@@ -23,6 +23,8 @@
@@ -23,6 +23,10 @@
#include <fcntl.h>
#include <unistd.h>
+#ifndef AT_FDCWD
+#define AT_FDCWD -2
+#endif
+
struct allocator;

View File

@ -1,12 +1,14 @@
diff --git a/lib/careadlinkat.h b/lib/careadlinkat.h
index 5cdb813..7a272e8 100644
index 84ede3e..8e8f42e 100644
--- a/lib/careadlinkat.h
+++ b/lib/careadlinkat.h
@@ -23,6 +23,8 @@
@@ -23,6 +23,10 @@
#include <fcntl.h>
#include <unistd.h>
+#ifndef AT_FDCWD
+#define AT_FDCWD -2
+#endif
+
struct allocator;

View File

@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
src = fetchgit {
url = "https://github.com/cask/cask.git";
rev = "717b64a9ba7640ec366e8573da0c01f9c4d57b0c";
sha256 = "0j18rzgpibisfcci6kcgjs8nlkfi1dw33dxp6ab6zaiarydwgcs5";
sha256 = "0bq24hac1z77g1bybwlk991dcc3pss2gjpwq0a6vvrqg5hw02lsf";
};
buildInputs = [ emacs python ];

View File

@ -5,7 +5,7 @@ clangStdenv.mkDerivation {
src = fetchgit {
url = "git://github.com/Golevka/emacs-clang-complete-async.git";
rev = "f01488971ec8b5752780d130fb84de0c16a46f31";
sha256 = "1c8zqi6axbsb951azz9iqx3j52j30nd9ypv396hvids3g02cirrf";
sha256 = "01smjinrvx0w5z847a43fh2hyr6rrq1kaglfakbr6dcr313w89x9";
};
buildInputs = [ llvmPackages.llvm ];

View File

@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
src = fetchgit {
url = "https://github.com/sigma/gh.el.git";
rev = "ef03b63d063ec22f03af449aa955c98dfad7f80e";
sha256 = "efa231e0091e8c7785385149dc97b2d8dc24aba65f4b0974b8ed7f62b7596ad3";
sha256 = "1pciq16vl5l4kvj08q4ib1jzk2bb2y1makcsyaw8k9jblqviw756";
};
buildInputs = [ emacs ];

View File

@ -6,7 +6,7 @@ stdenv.mkDerivation {
src = fetchgit {
url = "git://github.com/mooz/js2-mode.git";
rev = "3abcd90ddc2f446ddf0fb874dd79ba870c26ad2d";
sha256 = "c0aaab4eeb8d60cfd5c382c3e30d4725e5ec492720d573e663ea69ee43aa73a8";
sha256 = "0sh9ax2w0ydhjjn4vnwbgy3926p7ad6h6nmsnm0a3zlldj9a4vwn";
};
buildInputs = [ emacs ];

File diff suppressed because it is too large Load Diff

View File

@ -37,7 +37,7 @@ self:
overrides = {
ac-php = super.ac-php.override {
inherit (self.melpaPackages) company popup;
inherit (self.melpaPackages) popup;
};
# upstream issue: mismatched filename

View File

@ -6,7 +6,7 @@ stdenv.mkDerivation (rec {
src = fetchgit {
url = "https://github.com/ProofGeneral/PG.git";
rev = "16991280fb09743ae7320aef77f6a166afb907d7";
sha256 = "08zhfl6xbl4q7lrl7wdp72xr155k06778by0d60g28mfx59b7sqc";
sha256 = "1yakjxfz6a09m7lrxff04sj1717gpmhq2bsibd5f9lkp6z0w2i0q";
};
buildInputs = [ emacs texinfo perl which ] ++ stdenv.lib.optional enableDoc texLive;

View File

@ -8,7 +8,7 @@ pythonPackages.buildPythonApplication rec {
src = fetchgit {
url = "https://github.com/leo-editor/leo-editor";
rev = "refs/tags/Leo-${version}-final";
sha256 = "3cc5259609890bbde9cfee71f4f60b959b3f5b740f7d403c99ea2d9796b4758e";
sha256 = "0km5mvzfpfbxxhcjr4if24qhgk2c7dsvmfinz0zrbfriip848vcp";
};
propagatedBuildInputs = with pythonPackages; [ pyqt4 sqlite3 ];

View File

@ -1,6 +1,6 @@
{ stdenv, fetchFromGitHub, cmake, gettext, glib, libmsgpack, libtermkey
, libtool, libuv, lpeg, lua, luajit, luaMessagePack, luabitop, man, ncurses
, perl, pkgconfig, unibilium, makeWrapper, vimUtils, xsel
, libtool, libuv, lua, luajit, luaPackages, man, ncurses, perl, pkgconfig
, unibilium, makeWrapper, vimUtils, xsel
, withPython ? true, pythonPackages, extraPythonPackages ? []
, withPython3 ? true, python3Packages, extraPython3Packages ? []
@ -21,10 +21,10 @@ let
version = "2015-11-06";
src = fetchFromGitHub {
sha256 = "090pyf1n5asaw1m2l9bsbdv3zd753aq1plb0w0drbc2k43ds7k3g";
rev = "a9c7c6fd20fa35e0ad3e0e98901ca12dfca9c25c";
repo = "libvterm";
owner = "neovim";
repo = "libvterm";
rev = "a9c7c6fd20fa35e0ad3e0e98901ca12dfca9c25c";
sha256 = "090pyf1n5asaw1m2l9bsbdv3zd753aq1plb0w0drbc2k43ds7k3g";
};
buildInputs = [ perl ];
@ -39,7 +39,7 @@ let
description = "VT220/xterm/ECMA-48 terminal emulator library";
homepage = http://www.leonerd.org.uk/code/libvterm/;
license = licenses.mit;
maintainers = with maintainers; [ nckx ];
maintainers = with maintainers; [ nckx garbas ];
platforms = platforms.unix;
};
};
@ -60,13 +60,13 @@ let
neovim = stdenv.mkDerivation rec {
name = "neovim-${version}";
version = "0.1.3";
version = "0.1.4";
src = fetchFromGitHub {
sha256 = "1bkyfxsgb7894848nphsi6shr8bvi9z6ch0zvh2df7vkkzji8chr";
rev = "v${version}";
repo = "neovim";
owner = "neovim";
repo = "neovim";
rev = "v${version}";
sha256 = "14c4gydkm2mz22i616190yif1k0i6d7h5hyxa1mf5cmcyqmp3kkp";
};
enableParallelBuilding = true;
@ -79,13 +79,15 @@ let
# https://github.com/NixOS/nixpkgs/issues/14442
lua
luajit
lpeg
luaMessagePack
luabitop
libmsgpack
ncurses
neovimLibvterm
unibilium
luaPackages.lpeg
luaPackages.mpack
luaPackages.luabitop
] ++ optional withJemalloc jemalloc;
nativeBuildInputs = [
@ -95,8 +97,12 @@ let
pkgconfig
];
LUA_CPATH="${lpeg}/lib/lua/${lua.luaversion}/?.so;${luabitop}/lib/lua/5.2/?.so";
LUA_PATH="${luaMessagePack}/share/lua/5.1/?.lua";
LUA_CPATH = "${luaPackages.lpeg}/lib/lua/${lua.luaversion}/?.so;${luaPackages.mpack}/lib/lua/${lua.luaversion}/?.so;${luaPackages.luabitop}/lib/lua/${lua.luaversion}/?.so";
configureFlags = [
"-DCMAKE_BUILD_TYPE=RelWithDebInfo"
"-DENABLE_JEMALLOC=ON"
];
# triggers on buffer overflow bug while running tests
hardeningDisable = [ "fortify" ];
@ -114,7 +120,7 @@ let
install_name_tool -change libjemalloc.1.dylib \
${jemalloc}/lib/libjemalloc.1.dylib \
$out/bin/nvim
sed -i -e "s|'xsel|'${xsel}/bin/xsel|" share/nvim/runtime/autoload/provider/clipboard.vim
sed -i -e "s|'xsel|'${xsel}/bin/xsel|" $out/share/nvim/runtime/autoload/provider/clipboard.vim
'' + optionalString withPython ''
ln -s ${pythonEnv}/bin/python $out/bin/nvim-python
'' + optionalString withPyGUI ''

View File

@ -4,7 +4,7 @@ args@{ fetchgit, stdenv, ncurses, pkgconfig, gettext
, libICE, ... }: with args;
let tag = "20140827";
sha256 = "02adf2212872db3c5d133642d2c12fbfc28b506e4c0c42552e3d079756f63f65";
sha256 = "0ncgbcm23z25naicxqkblz0mcl1zar2qwgi37y5ar8q8884w9ml2";
in
let inherit (args.composableDerivation) composableDerivation edf; in

View File

@ -12,7 +12,7 @@ in
src = fetchgit {
url = "git://github.com/mkeeter/antimony.git";
rev = gitRev;
sha256 = "19ir3y5ipmfyygcn8mbxika4j3af6dfrv54dvhn6maz7dy8h30f4";
sha256 = "0azjdkbixz2pyk2yy7a0ya5xk60xgw3l2pd4pj4ijyqxx5jmh0sy";
};
patches = [ ./paths-fix.patch ];

View File

@ -1,18 +1,19 @@
{ stdenv, makeWrapper, fetchurl, xlibsWrapper, imlib2, libjpeg, libpng
, libXinerama, curl, libexif }:
, libXinerama, curl, libexif, perlPackages }:
stdenv.mkDerivation rec {
name = "feh-2.15.2";
name = "feh-2.15.4";
src = fetchurl {
url = "http://feh.finalrewind.org/${name}.tar.bz2";
sha256 = "0bnfk50y2l5zkr292l4yyws1m7ibdmr398vxj7c0djh965frpj1q";
sha256 = "b8a9c29f37b1349228b19866f712b677e2a150837bc46be8c5d6348dd4850758";
};
outputs = [ "out" "doc" ];
nativeBuildInputs = [ makeWrapper ];
buildInputs = [ xlibsWrapper imlib2 libjpeg libpng libXinerama curl libexif ];
buildInputs = [ xlibsWrapper imlib2 libjpeg libpng libXinerama curl libexif ]
++ stdenv.lib.optional doCheck [ perlPackages.TestCommand perlPackages.TestHarness ];
preBuild = ''
makeFlags="PREFIX=$out exif=1"
@ -23,6 +24,11 @@ stdenv.mkDerivation rec {
--add-flags '--theme=feh'
'';
checkPhase = ''
PERL5LIB="${perlPackages.TestCommand}/lib/perl5/site_perl" make test
'';
doCheck = true;
meta = {
description = "A light-weight image viewer";
homepage = https://derf.homelinux.org/projects/feh/;

View File

@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
sha256 = "06ql3x732x2rlnanv0a8aharsnj91j5kplksg574090rks51z42d";
};
patches = [ ./deprecated-scopedptr.patch ];
postPatch = ''
patchShebangs share/extensions
''

View File

@ -0,0 +1,16 @@
glibmm deprecated ScopedPtr
---
diff -u src/ui/clipboard.cpp src/ui/clipboard.cpp
--- a/src/ui/clipboard.cpp 2015-01-28 04:32:28.162676000 +0100
+++ b/src/ui/clipboard.cpp 2016-04-03 09:13:12.360980533 +0200
@@ -1402,7 +1402,7 @@
Glib::ustring target;
if (atom_name) {
- target = Glib::ScopedPtr<char>(atom_name).get(); //This frees the gchar*.
+ target = Glib::make_unique_ptr_gfree(atom_name).get(); //This frees the gchar*.
}
listTargets.push_back(target);
Diff finished. Sun Apr 3 09:13:51 2016

View File

@ -0,0 +1,45 @@
{ stdenv, lib, fetchgit, cmake, extra-cmake-modules, makeQtWrapper
, karchive, kconfig, kwidgetsaddons, kcompletion, kcoreaddons
, kguiaddons, ki18n, kitemmodels, kitemviews, kwindowsystem
, kio, kcrash
, boost, libraw, fftw, eigen, exiv2, lcms2, gsl, openexr
, openjpeg, opencolorio, vc, poppler_qt5, curl, ilmbase
}:
stdenv.mkDerivation rec {
name = "krita-${version}";
version = "3.0";
src = fetchgit {
url = "http://phabricator.kde.org/diffusion/KRITA/krita.git";
rev = "refs/tags/v${version}";
sha256 = "0aas86667ncp8jz00c8qk7bm26g76l65cysh06wxr8kxbvqynrdn";
};
nativeBuildInputs = [ cmake extra-cmake-modules makeQtWrapper ];
buildInputs = [
karchive kconfig kwidgetsaddons kcompletion kcoreaddons kguiaddons
ki18n kitemmodels kitemviews kwindowsystem kio kcrash
boost libraw fftw eigen exiv2 lcms2 gsl openexr
openjpeg opencolorio vc poppler_qt5 curl ilmbase
];
NIX_CFLAGS_COMPILE = [ "-I${ilmbase}/include/OpenEXR" ];
enableParallelBuilding = true;
postInstall = ''
for i in $out/bin/*; do
wrapQtProgram "$i"
done
'';
meta = with stdenv.lib; {
description = "A free an open source painting application";
homepage = "https://krita.org/";
maintainers = with maintainers; [ abbradar ];
platforms = platforms.linux;
licenses = licenses.gpl2;
};
}

View File

@ -0,0 +1,78 @@
{ withKDE ? true
, stdenv, fetchurl, gettext, poppler_qt4, qt4
# Qt only (no KDE):
, pkgconfig
# With KDE
, cmake, automoc4, kdelibs
}:
# Warning: You will also need a working pdflatex installation containing (at
# least) auctex and pgf.
assert withKDE -> kdelibs != null;
let
version = "0.10";
qtikz = {
name = "qtikz-${version}";
conf = ''
# installation prefix:
#PREFIX = ""
# install desktop file here (*nix only):
DESKTOPDIR = ''$''${PREFIX}/share/applications
# install mimetype here:
MIMEDIR = ''$''${PREFIX}/share/mime/packages
CONFIG -= debug
CONFIG += release
# qmake command:
QMAKECOMMAND = qmake
# lrelease command:
LRELEASECOMMAND = lrelease
# qcollectiongenerator command:
#QCOLLECTIONGENERATORCOMMAND = qcollectiongenerator
# TikZ documentation default file path:
TIKZ_DOCUMENTATION_DEFAULT = ''$''${PREFIX}/share/doc/texmf/pgf/pgfmanual.pdf.gz
'';
patchPhase = ''
echo "$conf" > conf.pri
'';
configurePhase = ''
qmake PREFIX="$out" ./qtikz.pro
'';
buildInputs = [ gettext qt4 poppler_qt4 pkgconfig ];
};
ktikz = {
name = "ktikz-${version}";
buildInputs = [ kdelibs cmake qt4 automoc4 gettext poppler_qt4 ];
};
common = {
inherit version;
src = fetchurl {
url = "http://www.hackenberger.at/ktikz/ktikz_${version}.tar.gz";
md5 = "e8f0826cba2447250bcdcd389a71a2ac";
};
enableParallelBuilding = true;
meta = with stdenv.lib; {
description = "Editor for the TikZ language";
license = licenses.gpl2;
platforms = platforms.linux;
maintainers = [ maintainers.layus ];
};
};
in stdenv.mkDerivation (common // (if withKDE then ktikz else qtikz))

View File

@ -58,7 +58,7 @@ buildDotnetPackage rec {
makeWrapperArgs = [
''--prefix MONO_GAC_PREFIX ':' "${gtksharp}"''
''--prefix LD_LIBRARY_PATH ':' "${gtksharp}/lib"''
''--prefix LD_LIBRARY_PATH ':' "${gtksharp.gtk}/lib"''
''--prefix LD_LIBRARY_PATH ':' "${gtksharp.gtk.out}/lib"''
];
postInstall = ''

View File

@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
src = fetchgit {
url = "https://github.com/GilesBathgate/RapCAD.git";
rev = "refs/tags/v${version}";
sha256 = "15c18jvgbwyrfhv7r35ih0gzx35vjlsbi984h1sckgh2z17hjq8l";
sha256 = "1i5h4sw7mdbpdbssmbjccwgidndrsc606zz4wy9pjsg2wzrabw7x";
};
buildInputs = [ qtbase qmakeHook cgal boost gmp mpfr flex bison dxflib readline mesa_glu ];

View File

@ -3,7 +3,7 @@
callPackage ./generic.nix (args // {
version = "2016-05-09";
src = fetchgit {
sha256 = "5e3d647503d1231395a6782c6aa536b52b3d45585a87a0600ce0aca8b422cf82";
sha256 = "17y2l59vz2l0y5ya89390x6lim75p1mp8s5c2wzp9l4d5fy8j8dd";
rev = "1e013654cc3af09f4731ab9ec8d8324d03a7de4a";
url = "git://alioth.debian.org/git/sane/sane-backends.git";
};

View File

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
wrapProgram $out/bin/shutter \
--set PERL5LIB "${stdenv.lib.makePerlPath perlModules}" \
--prefix PATH : "${imagemagick}/bin" \
--prefix PATH : "${imagemagick.out}/bin" \
--set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"
'';

Some files were not shown because too many files have changed in this diff Show More