Commit Graph

226 Commits

Author SHA1 Message Date
rnhmjoj
3bb69836cb
nixos/profiles/minimal: don't install freedesktop files
This saves about 25M from the closure size of:

$ nix build -f nixos system --arg configuration '
  { imports = [ ./nixos/modules/profiles/minimal.nix ];
    fileSystems."/".label="root";
    boot.loader.grub.device = "nodev";
  }'
2022-10-21 14:54:38 +02:00
Alyssa Ross
d165f7a513
nixos/installer: fix eval with missing config arg
Fixes: 4cdda329f0 ("nixos/modules/profiles/base.nix: omit zfs if unavailable")
2022-10-10 23:58:22 +00:00
Adam Joseph
4cdda329f0 nixos/modules/profiles/base.nix: omit zfs if unavailable
The `boot.zfs.enabled` option is marked `readOnly`, so this is the only way to
successfully build a NixOS installer image for platforms that zfs does not build
for.

Co-authored-by: Alyssa Ross <hi@alyssa.is>
2022-10-10 22:41:57 +00:00
Andrew Marshall
37da853f49 nixos/installer: mkForce -> mkImageMediaOverride
This is image media, so use the override level designed for it. As
detailed in the definition for mkImageMediaOverride:

> image media profiles can be derived by inclusion into host config,
> hence needing to override host config, but do allow user to mkForce
2022-08-14 12:14:34 -04:00
pennae
087472b1e5 nixos/*: automatically convert option docs 2022-08-06 20:39:12 +02:00
K900
1a5602e833
Merge pull request #143885 from peat-psuwit/all-hardware-reset-raspberry
profiles/all-hardware.nix: add reset-raspberry for USB on RPi 4
2022-08-04 15:28:43 +03:00
Alyssa Ross
5330c0a1af
treewide: use isAarch where appropriate 2022-07-30 16:18:27 +00:00
Sandro Jäckel
515b36c093
nixos/i18n: don't build all supportedLocales by default 2022-06-11 23:29:29 +02:00
Bernardo Meurer
78f6f77962
Merge pull request #169113 from ElvishJerricco/systemd-stage-1-installer-tests
nixos: Installer tests for systemd stage 1
2022-04-30 13:18:57 -07:00
Janne Heß
007108f04d
nixos/*qemu*: Add systemd initrd support 2022-04-30 20:47:42 +02:00
Bernardo Meurer
dcfaae6679
nixos/modules/profiles/all-hardware: add nvme to initrd modules 2022-04-26 15:22:37 -07:00
Will Fancher
9ee5d61a16 nixos: Installer tests for systemd stage 1 2022-04-17 18:31:35 -04:00
polykernel
4a9d9928dc nixos/nix-daemon: use structural settings
The `nix.*` options, apart from options for setting up the
daemon itself, currently provide a lot of setting mappings
for the Nix daemon configuration. The scope of the mapping yields
convience, but the line where an option is considered essential
is blurry. For instance, the `extra-sandbox-paths` mapping is
provided without its primary consumer, and the corresponding
`sandbox-paths` option is also not mapped.

The current system increases the maintenance burden as maintainers have to
closely follow upstream changes. In this case, there are two state versions
of Nix which have to be maintained collectively, with different options
avaliable.

This commit aims to following the standard outlined in RFC 42[1] to
implement a structural setting pattern. The Nix configuration is encoded
at its core as key-value pairs which maps nicely to attribute sets, making
it feasible to express in the Nix language itself. Some existing options are
kept such as `buildMachines` and `registry` which present a simplified interface
to managing the respective settings. The interface is exposed as `nix.settings`.

Legacy configurations are mapped to their corresponding options under `nix.settings`
for backwards compatibility.

Various options settings in other nixos modules and relevant tests have been
updated to use structural setting for consistency.

The generation and validation of the configration file has been modified to
use `writeTextFile` instead of `runCommand` for clarity. Note that validation
is now mandatory as strict checking of options has been pushed down to the
derivation level due to freeformType consuming unmatched options. Furthermore,
validation can not occur when cross-compiling due to current limitations.

A new option `publicHostKey` was added to the `buildMachines`
submodule corresponding to the base64 encoded public host key settings
exposed in the builder syntax. The build machine generation was subsequently
rewritten to use `concatStringsSep` for better performance by grouping
concatenations.

[1] - https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md
2022-01-26 21:04:50 -05:00
Zhaofeng Li
d7cdd09ad2 all-hardware: Add virtio_mmio module 2022-01-06 17:23:10 -08:00
Zhaofeng Li
41cad5ea68 all-hardware: Disable VMWare and Hyper-V modules on non-X86 platforms 2022-01-06 17:23:10 -08:00
Artturi
02e95c2fd7
Merge pull request #146288 from Artturin/mtoolsandsuch 2021-11-19 00:21:08 +02:00
Artturin
3f339f3cf4 profiles/base: add mtools 2021-11-17 00:26:31 +02:00
Artturin
115e6e7299 nixos/profiles/minimal: disable command-not-found
reduces size by about 1M
2021-11-16 18:27:38 +02:00
Ratchanan Srirattanamet
2140fed726 profiles/all-hardware.nix: add reset-raspberry for USB on RPi 4
This is needed for USB to work on RPi 4. Kernel's defconfig demoted the
module from built-in to module in 5.14. See [1].

[1] https://lore.kernel.org/linux-arm-kernel/ab43364b-55cc-08e6-a647-6e50a1743f03@gmail.com/
2021-11-13 16:28:38 +00:00
Your Name
1b79176310 NixOS AWS AMI: enable the serial console on ttyS0 2021-08-20 12:42:02 -04:00
rnhmjoj
d857340c8e
nixos/installer: simplify and document wifi setup
The wpa_supplicant service in the NixOS installer is unusable because
the control socket is disabled and /etc/wpa_supplicant.conf ignored.

The manual currently recommends manually starting the daemon and using
wpa_passphrase, but this requires figuring out the interface name,
driver and only works for WPA2 personal networks.

By enabling the control socket, instead, a user can configure the
network via wpa_cli (or wpa_gui in the graphical installer), which
support more advanced network configurations.
2021-08-15 12:08:32 +02:00
Florian Klink
6c0058f47f
Merge pull request #85073 from hyperfekt/systemd-pstore
nixos/systemd|filesystems: mount and evacuate /sys/fs/pstore using systemd-pstore
2021-05-17 00:00:52 +02:00
github-actions[bot]
bf5d8bb531
Merge master into staging-next 2021-05-14 00:58:11 +00:00
Samuel Dionne-Riel
12ede41735
Merge pull request #110435 from superloach/patch-2
nixos/modules: add "sdhci_pci" to availableKernelModules
2021-05-13 17:45:22 -04:00
hyperfekt
3e3e763a07 nixos/systemd: enable systemd-pstore.service
As described in issue #81138, the Install section of upstream units is
currently ignored, so we make it part of the sysinit.target manually.
2021-05-09 23:21:51 +02:00
github-actions[bot]
b4416b52c5
Merge master into staging-next 2021-05-08 00:46:50 +00:00
Samuel Dionne-Riel
cb9b46a3cd profiles/all-hardware.nix: Add vc4 for broadcom hardware
Namely, early KMS on raspberry pi
2021-05-04 19:42:13 -04:00
Samuel Dionne-Riel
f5b7687d26 profiles/all-hardware.nix: Share some config for all ARM 2021-05-04 19:42:13 -04:00
Samuel Dionne-Riel
14ac6de024 profiles/all-hardware.nix: Fix for arvmv7l-linux 2021-05-04 19:42:13 -04:00
Samuel Dionne-Riel
82625705c6 profiles/all-hardware.nix: Add analogix-dp
While it's being brought in implicitly by the other analogix driver,
let's be explicit, in case things change.
2021-05-04 19:42:13 -04:00
Samuel Dionne-Riel
9fa3e2c2a3 profiles/all-hardware.nix: Add regulator needed for rockchip
But not exclusive to rockchip
2021-05-04 19:42:13 -04:00
Samuel Dionne-Riel
535d463cf9 profiles/all-hardware.nix: Add rockchip modules 2021-05-04 19:42:13 -04:00
Samuel Dionne-Riel
70205bd13c profiles/all-hardware.nix: Add support for Raspberry Pi 4 USB 2021-05-04 19:42:13 -04:00
Samuel Dionne-Riel
a846d19831 profiles/all-hardware.nix: Add power regulator modules
This is used on some allwinner platforms, and is a weak dependency for
USB to work.
2021-05-04 19:42:12 -04:00
Samuel Dionne-Riel
a8af02fe6d profiles/all-hardware.nix: Add modules for integrated displays
Namely, this is used by the pinebook's display
2021-05-04 19:42:12 -04:00
Samuel Dionne-Riel
5bc36c1b30 profiles/all-hardware.nix: Add support for Allwinner hardware 2021-05-04 19:42:12 -04:00
Samuel Dionne-Riel
c60de92917 profiles/all-hardware.nix: Add simplefb for AArch64 2021-05-04 19:42:12 -04:00
Julien Moutinho
b42a0e205d nixos/apparmor: disable killUnconfinedConfinables by default 2021-04-23 07:20:20 +02:00
Dominik Xaver Hörl
893d911b55 nixos/hidepid: drop the module as the hidepid mount option is broken
This has been in an unusable state since the switch to cgroups-v2.
See https://github.com/NixOS/nixpkgs/issues/73800 for details.
2021-02-21 13:51:37 +01:00
Erik Arvstedt
0b5fd3b784 qemu-guest: remove security.rngd setting
Since release 20.09 `rngd.enable` defaults to false, so this setting is redundant.

Also fix the `qemu-quest` section of the manual that incorrectly claimed
that `rngd` was enabled.
2021-01-27 18:27:34 +01:00
Terra Brown
c2a901798e
nixos/modules: add "sdhci_pci" to availableKernelModules
Encountered issues booting the live image on an Acer R11 Chromebook (CYAN). Got help from @samueldr on Freenode, and adding this module fixed it. Likely useful for other platforms/situations where booting from SD is necessary.
2021-01-21 23:08:54 -05:00
Vladimír Čunát
9e2880e5fa
nixos ISO image: revert another part of 8ca33835ba 2021-01-13 15:25:19 +01:00
Vladimír Čunát
8ca33835ba
nixos: fixup build of aarch64 minimal ISO (fixes #109252)
Perhaps it's not pretty nor precise; feel free to improve.
2021-01-13 14:05:45 +01:00
Alyssa Ross
6c3d21aff9
nixos/getty: rename from services.mingetty
It's been 8.5 years since NixOS used mingetty, but the option was
never renamed (despite the file definining the module being renamed in
9f5051b76c ("Rename mingetty module to agetty")).

I've chosen to rename it to services.getty here, rather than
services.agetty, because getty is implemantation-neutral and also the
name of the unit that is generated.
2021-01-05 09:09:42 +00:00
talyz
0f0d5c0c49
profiles/hardened: Add note about potential instability
Enabling the profile can lead to hard-to-debug issues, which should be
warned about in addition to the cost in features and performance.

See https://github.com/NixOS/nixpkgs/issues/108262 for an example.
2021-01-04 16:03:29 +01:00
TredwellGit
b6e21a7609 nixos/hardened: update blacklisted filesystems
241a158269/suse-module-tools.spec (L24)
2020-09-27 06:16:58 +00:00
Jörg Thalheim
a5872edf2f
nixos/installer: enable sshd by default
Right now the UX for installing NixOS on a headless system is very bad.
To enable sshd without physical steps users have to have either physical
access or need to be very knowledge-able to figure out how to modify the
installation image by hand to put an `sshd.service` symlink in the
right directory in /nix/store. This is in particular a problem on ARM
SBCs (single board computer) but also other hardware where network is
the only meaningful way to access the hardware.

This commit enables sshd by default. This does not give anyone access to
the NixOS installer since by default. There is no user with a non-empty
password or key. It makes it easy however to add ssh keys to the
installation image (usb stick, sd-card on arm boards) by simply mounting
it and adding a keys to `/root/.ssh/authorized_keys`.
Importantly this should not require nix/nixos on the machine that
prepare the installation device and even feasiable on non-linux systems
by using ext4 third party drivers.

Potential new threats: Since this enables sshd by default a
potential bug in openssh could lead to remote code execution. Openssh
has a very good track-record over the last 20 years, which makes it
far more likely that Linux itself would have a remote code execution
vulnerability. It is trusted by millions of servers on many operating
systems to be exposed to the internet by default.

Co-authored-by: Samuel Dionne-Riel <samuel@dionne-riel.com>
2020-09-06 20:26:08 +02:00
Izorkin
e21e5a9483 nixos/security/misc: add option unprivilegedUsernsClone 2020-08-25 14:18:24 +03:00
davidak
5a3738d22b
nixos/systemPackages: clean up (#91213)
* nixos/systemPackages: clean up

* Update nixos/doc/manual/release-notes/rl-2009.xml

Co-authored-by: Jan Tojnar <jtojnar@gmail.com>

* Update nixos/doc/manual/release-notes/rl-2009.xml

Co-authored-by: 8573 <8573@users.noreply.github.com>

Co-authored-by: Jan Tojnar <jtojnar@gmail.com>
Co-authored-by: 8573 <8573@users.noreply.github.com>
2020-08-20 13:45:54 +00:00
worldofpeace
490cd7889e nixos/displayManager: make autoLogin options independent of DM type
Co-authored-by: volth <volth@volth.com>
2020-07-09 21:15:35 -04:00