Commit Graph

783 Commits

Author SHA1 Message Date
Franz Pletz
69f8e94c46
Merge pull request #199587 from lorenz/fscrypt
nixos/pam: support fscrypt login protectors
2022-11-14 09:42:35 +01:00
Lorenz Brun
f046cc0923 nixos/pam: support fscrypt login protectors
fscrypt can automatically unlock directories with the user's login
password. To do this it ships a PAM module which reads the user's
password and loads the respective keys into the user's kernel keyring.

Significant inspiration was taken from the ecryptfs implementation.
2022-11-11 15:37:39 +01:00
Bobby Rong
03e68946a0
Merge pull request #186628 from ocfox/pam_faildelay
nixos/pam: add option failDelay
2022-11-07 19:54:57 +08:00
ocfox
ab0ae8f5e1
nixos/pam: add option failDelay
Co-authored-by: Bobby Rong <rjl931189261@126.com>
2022-11-07 19:16:35 +08:00
Naïm Favier
814628a45d
Merge pull request #174951 from dpausp/fix-pam-tty-audit 2022-11-01 23:50:58 +01:00
Yorick van Pelt
af4a43e36a
treewide: convert fake octal ints to strings
These were being cast to strings later and then reinterpreted as
octal.
2022-10-28 17:23:44 +02:00
Sandro
6c10d52d0d
Merge pull request #194036 from gloaming/polkit-debug-logs 2022-10-26 22:23:45 +02:00
Martin Weinelt
fcf2d05d81 nixos/acme: Relax syscall filter after go upgrade
With Go 1.19 calls to setrlimit are required for lego to run.

While we could allow setrlimit alone, I think it is not unreasonable to
allow @resources in general.

Closes: #197513
2022-10-25 07:22:27 +10:00
Tobias Stenzel
8111e4f113 nixos/pam: fix pam_tty_audit config
Escape the line breaks to render a valid config.
Module arguments have to be at the same line or line endings have to be
escaped with a backslash.
2022-10-22 23:20:09 +02:00
Azat Bahawi
e04579e7cd nixos/please: init module
Co-authored-by: Cole Helbling <cole.e.helbling@outlook.com>
2022-10-15 07:05:10 -07:00
Christian Kögler
aff16d8bc8
Merge pull request #190052 from JasonWoof/acme-example
nixos/doc: fix acme dns-01 example
2022-10-07 12:53:15 +02:00
Lucas Savva
49c0fd7d60 nixos/acme: Disable lego renew sleeping
Lego has a built-in mechanism for sleeping for a random amount
of time before renewing a certificate. In our environment this
is not only unnecessary (as our systemd timer takes care of it)
but also unwanted since it slows down the execution of the
systemd service encompassing it, thus also slowing down the
start up of any services its depending on.

Also added FixedRandomDelay to the timer for more predictability.
2022-10-06 10:30:24 -04:00
Lucas Savva
657ecbca0e nixos/acme: Make account creds check more robust
Fixes #190493

Check if an actual key file exists. This does not
completely cover the work accountHash does to ensure
that a new account is registered when account
related options are changed.
2022-10-06 10:30:24 -04:00
Lucas Savva
39796cad46 nixos/acme: Fix cert renewal with built in webserver
Fixes #191794

Lego threw a permission denied error binding to port 80.
AmbientCapabilities with CAP_NET_BIND_SERVICE was required.
Also added a test for this.
2022-10-06 10:30:24 -04:00
Craig Hall
a4995b6f0a nixos/polkit: Add debug option 2022-10-02 10:13:04 +01:00
Fabián Heredia Montiel
a233e59d19 nixos/pam: fix deprecated gnome3 reference 2022-09-25 00:39:27 -05:00
Jason Yundt
17352e8995 nixos/security/wrappers: clarify required format for capabilities
Before this change, the description for
security.wrappers.<name>.capabilities made it seem like you could just
string together the names of capabilities like this:

  capabilities = "CAP_SETUID,CAP_SETGID";

In reality, each item in the list must be a full-on capability clause:

  capabilities = "CAP_SETUID=ep,CAP_SETGID+i";
2022-09-11 16:36:58 +02:00
Jason Woofenden
7e5617aa7a nixos/doc: fix acme dns-01 example
Summary: fix errors with example code in the manual that shows how to set up DNS-01 verification via the acme protocol, e.g. for those who want to get wildcard certificates from Let's Encrypt.

Fix syntax error in nix arrays (there should not be commas.)

Fix permissions on /var/lib/secrets so it can be read by bind daemon. Without this fix bind won't start.

Add the missing feature: put the generated secret into certs.secret
2022-09-06 16:03:22 -04:00
pennae
722b99bc0e nixos/*: convert options with admonitions to MD
rendering changes only slightly, most changes are in spacing.
2022-08-31 16:36:16 +02:00
pennae
bd56368848 nixos/*: md-convert hidden plaintext options
most of these are hidden because they're either part of a submodule that
doesn't have its type rendered (eg because the submodule type is used in
an either type) or because they are explicitly hidden. some of them are
merely hidden from nix-doc-munge by how their option is put together.
2022-08-31 16:32:54 +02:00
pennae
9547123258 nixos/*: convert internal option descriptions to MD
we'll have to do it eventually, may as well be now.
2022-08-31 16:32:54 +02:00
pennae
ef176dcf7e nixos/*: automatically convert option descriptions
conversions were done using https://github.com/pennae/nix-doc-munge
using (probably) rev f34e145 running

    nix-doc-munge nixos/**/*.nix
    nix-doc-munge --import nixos/**/*.nix

the tool ensures that only changes that could affect the generated
manual *but don't* are committed, other changes require manual review
and are discarded.
2022-08-31 16:32:53 +02:00
pennae
e4f876eb7e nixos/*: convert varlist-using options to MD
there are sufficiently few variable list around, and they are
sufficiently simple, that it doesn't seem helpful to add another
markdown extension for them. rendering differences are small, except in
the tor module: admonitions inside other blocks cannot be made to work
well with mistune (and likely most other markdown processors), so those
had to be shuffled a bit. we also lose paragraph breaks in the list
items due to how we have to render from markdown to docbook, but once we
remove docbook from the pipeline those paragraph breaks will be restored.
2022-08-31 16:32:53 +02:00
pennae
c915b915b5 nixos/*: md-convert options with unordered lists
mostly no rendering changes. some lists (like simplelist) don't have an
exact translation to markdown, so we use a comma-separated list of
literals instead.
2022-08-31 16:32:53 +02:00
Lassulus
f95d0b966e
Merge pull request #173495 from wucke13/pam-fix 2022-08-21 20:57:17 +02:00
pennae
6039648c50 nixos/*: automatically convert option docs 2022-08-19 22:40:58 +02:00
pennae
7e7d68a250 nixos/*: mark pre-existing markdown descriptions as mdDoc 2022-08-19 22:40:58 +02:00
pennae
b51f8036c2 nixos/*: use properly indented strings for option docs
using regular strings works well for docbook because docbook is not as
whitespace-sensitive as markdown. markdown would render all of these as
code blocks when given the chance.
2022-08-19 22:40:58 +02:00
pennae
e4ed177f82 nixos/* eliminate inner whitespace in tags that was missed earlier
nix-doc-munge won't match tags that contain newlines anywhere. most of
these have already been removed, but a few obviously made it through.
2022-08-19 22:40:58 +02:00
pennae
8f8e101527 nixos/*: normalize <package> to <literal>
this renders the same in the manpage and a little more clearly in the
html manual. in the manpage there continues to be no distinction from
regular text, the html manual gets code-type markup (which was probably
the intention for most of these uses anyway).
2022-08-19 22:40:58 +02:00
Christian Kögler
5d52f38905
Merge pull request #166942 from AleXoundOS/patch-1
NixOS manual: fix ACME certificates in Nginx configuration sample
2022-08-19 09:55:43 +02:00
Maximilian Bosch
9e8ea1b855
Merge pull request #183717 from NetaliDev/mysql-auth
nixos: add mysql/mariadb user authentication module
2022-08-16 20:30:16 +02:00
Robert Hensing
d00583540b
Merge pull request #184368 from DieracDelta/jr/wrappers-run-size-option
nixos/security: add size option to /run/wrappers
2022-08-14 19:13:17 +02:00
Justin Restivo
82640adbf0 nixos/security: add size option to /run/wrappers 2022-08-14 07:31:37 -07:00
pennae
087472b1e5 nixos/*: automatically convert option docs 2022-08-06 20:39:12 +02:00
Netali
1a35b5aacb
nixos/pam: move pam_unix to the end of the account chain 2022-08-06 19:43:28 +02:00
Netali
f23a1e6a54
nixos: add mysql/mariadb user authentication 2022-08-06 19:39:23 +02:00
pennae
423545fe48 nixos/*: normalize manpage references to single-line form
now nix-doc-munge will not introduce whitespace changes when it replaces
manpage references with the MD equivalent.

no change to the manpage, changes to the HTML manual are whitespace only.
2022-08-05 18:34:50 +02:00
pennae
61e93df189 nixos/*: automatically convert option docs to MD
once again using nix-doc-munge (69d080323a)
2022-08-03 22:46:41 +02:00
pennae
3aebb4a2be nixos/*: normalize link format
make (almost) all links appear on only a single line, with no
unnecessary whitespace, using double quotes for attributes. this lets us
automatically convert them to markdown easily.

the few remaining links are extremely long link in a gnome module, we'll
come back to those at a later date.
2022-08-03 21:57:46 +02:00
pennae
9c8531c8a5 nixos/*: replace <replaceable>s with «thing»
we can't embed syntactic annotations of this kind in markdown code
blocks without yet another extension. replaceable is rare enough to make
this not much worth it, so we'll go with «thing» instead. the module
system already uses this format for its placeholder names in attrsOf
paths.
2022-08-03 21:08:58 +02:00
pennae
16102dce2f nixos/*: replace <code> in option docs with <literal>
markdown can't represent the difference without another extension and
both the html manual and the manpage render them the same, so keeping the
distinction is not very useful on its own. with the distinction removed
we can automatically convert many options that use <code> tags to markdown.

the manpage remains unchanged, html manual does not render
differently (but class names on code tags do change from "code" to "literal").
2022-08-03 21:03:23 +02:00
pennae
6b13dd0e9e
Merge pull request #183491 from pennae/automatic-md-conversions
treewide: automatically md-convert option descriptions
2022-08-02 02:15:30 +02:00
Dan Callaghan
43aab2f50b
nixos/pam: add an option to control Kerberos PAM modules
Instead of enabling the PAM modules based on config.krb5.enable,
introduce a new option to control the PAM modules specifically.

Users may want to turn on config.krb5.enable, to get a working Kerberos
client config with tools like kinit, while letting pam_sss or something
else handle Kerberos password lookups.
2022-08-01 21:28:05 +10:00
pennae
2e751c0772 treewide: automatically md-convert option descriptions
the conversion procedure is simple:

 - find all things that look like options, ie calls to either `mkOption`
   or `lib.mkOption` that take an attrset. remember the attrset as the
   option
 - for all options, find a `description` attribute who's value is not a
   call to `mdDoc` or `lib.mdDoc`
 - textually convert the entire value of the attribute to MD with a few
   simple regexes (the set from mdize-module.sh)
 - if the change produced a change in the manual output, discard
 - if the change kept the manual unchanged, add some text to the
   description to make sure we've actually found an option. if the
   manual changes this time, keep the converted description

this procedure converts 80% of nixos options to markdown. around 2000
options remain to be inspected, but most of those fail the "does not
change the manual output check": currently the MD conversion process
does not faithfully convert docbook tags like <code> and <package>, so
any option using such tags will not be converted at all.
2022-07-30 15:16:34 +02:00
pennae
a16b25432e
Merge pull request #182685 from pennae/invariant-option-conversions
treewide: invariant option conversions to MD
2022-07-27 15:39:47 +02:00
Stig
550aaf8c96
Merge pull request #182379 from stigtsp/fix/pam-u2f-cue
nixos/security/pam: fix u2f options leakage
2022-07-26 03:19:01 +02:00
pennae
cbc44d68a7 nixos/security: invariant option docs MD conversions 2022-07-24 13:01:18 +02:00
Netali
93132dc09c
nixos/pam: refactor pam_mount unmounting fix 2022-07-22 04:17:14 +02:00
Stig Palmquist
d07f3037e2
nixos/security/pam: fix u2f options leakage
Fix bug where pam_u2f options would be partially included in other pam.d
files if the module was enable for specific services, resulting in
broken configuration.
2022-07-21 23:14:09 +02:00