···245 lib.optional (cfg.settings.admin-server-port != null && cfg.settings.server-host != "127.0.0.1")
246 "The PostgREST admin server is potentially listening on a public host. This may expose sensitive information via the `/config` endpoint.";
2470000248 systemd.services.postgrest = {
249 description = "PostgREST";
250
···245 lib.optional (cfg.settings.admin-server-port != null && cfg.settings.server-host != "127.0.0.1")
246 "The PostgREST admin server is potentially listening on a public host. This may expose sensitive information via the `/config` endpoint.";
247248+ # Since we're using DynamicUser, we can't add the e.g. nginx user to
249+ # a postgrest group, so the unix socket must be world-readable to make it useful.
250+ services.postgrest.settings.service-unix-socket-mode = "666";
251+252 systemd.services.postgrest = {
253 description = "PostgREST";
254
···1+diff --git a/admin/python-config-ldflags.py b/admin/python-config-ldflags.py
2+index 0854698..f397a7c 100644
3+--- a/admin/python-config-ldflags.py
4++++ b/admin/python-config-ldflags.py
5+@@ -1,38 +1,70 @@
6+-#!/usr/bin/env python
7++# This scripts retrieves the proper options to be used to link against
8++# the libpython, in a machine-independant way. It invokes the official
9++# script python-config (which thankfully deals with all the details).
10+11+-# DUPLICATE of "python-config --ldflags", fixed for the library location
12++import sys
13++newerpython = (sys.version_info[0] == 3 and sys.version_info[1] > 7)
14+15+-# This utility is known to work with:
16+-# python2.6 (system install) under SL6.4
17+-# python2.7 (custom install) under SL6.4
18+-# python3.4 (custom install) under SL6.4
19+-# python2.7 (system install) under Fedora20
20+-# python2.7 (Apple install) under MacOSX
21+-# python2.7 (MacPorts install) under MacOSX
22+-# python3.4 (MacPorts install) under MacOSX
23++if newerpython:
24++ # From now on avoid duplicating python-config, which evolves on its own.
25++ # Invoke 'python-config --ldflags --embed'. The embed option (under
26++ # Python 3) adds the libpython itself, whose name is highly
27++ # unpredictible under the variety of machines and configurations we
28++ # support
29++ import subprocess
30++ output = subprocess.check_output(['python-config', '--ldflags','--embed'])
31++ output = output.decode('utf-8')
32++ #print(output)
33+34+-import sys
35+-import sysconfig
36++ args = output.split()
37+38+-pyver = sysconfig.get_config_var('VERSION')
39+-getvar = sysconfig.get_config_var
40++ output = ''
41++ for arg in args:
42++ # Discard /usr/lib* path which causes troubles on the link command
43++ # line, as it basically overrides all other custom paths coming after
44++ # it. No need to put these paths on command line, they are found
45++ # implicitly by the linker.
46++ if arg not in ['-L/usr/lib','-L/usr/lib32','-L/usr/lib64']:
47++ output += arg+' '
48++
49++ print(output)
50+51+-libs = getvar('LIBS').split() + getvar('SYSLIBS').split()
52+-if (hasattr(sys,'abiflags')):
53+- libs.append('-lpython' + pyver + sys.abiflags)
54+ else:
55+- libs.append('-lpython' + pyver)
56++ # DUPLICATE of "python-config --ldflags", fixed for the library location
57++ # This proved to work gracefully up to Python 3.5 (exact limit unclear)
58++
59++ # This utility is known to work with:
60++ # python2.6 (system install) under SL6.4
61++ # python2.7 (custom install) under SL6.4
62++ # python3.4 (custom install) under SL6.4
63++ # python3.7 (custom install) under Debian12
64++ # python2.7 (system install) under Fedora20
65++ # python2.7 (Apple install) under MacOSX
66++ # python2.7 (MacPorts install) under MacOSX
67++ # python3.4 (MacPorts install) under MacOSX
68++
69++ import sys
70++ import sysconfig
71++
72++ pyver = sysconfig.get_config_var('VERSION')
73++ getvar = sysconfig.get_config_var
74++
75++ libs = getvar('LIBS').split() + getvar('SYSLIBS').split()
76++ if (hasattr(sys,'abiflags')):
77++ libs.append('-lpython' + pyver + sys.abiflags)
78++ else:
79++ libs.append('-lpython' + pyver)
80+81+-# Add the library path, except /usr/lib* which causes troubles
82+-# on the link command line, as it basically overrides all other
83+-# custom paths coming after it. No need to put these paths on
84+-# command line, they are found implicitly by the linker.
85+-ldpath = getvar('LIBDIR')
86+-if ldpath not in ['/usr/lib','/usr/lib32','/usr/lib64']:
87+- libs.insert(0, '-L' + getvar('LIBDIR'))
88++ # Add the library path, except /usr/lib* which causes troubles
89++ # on the link command line, as it basically overrides all other
90++ # custom paths coming after it. No need to put these paths on
91++ # command line, they are found implicitly by the linker.
92++ ldpath = getvar('LIBDIR')
93++ if ldpath not in ['/usr/lib','/usr/lib32','/usr/lib64']:
94++ libs.insert(0, '-L' + getvar('LIBDIR'))
95+96+-# Framework (specific for Mac)
97+-if not getvar('PYTHONFRAMEWORK'):
98+- libs.extend(getvar('LINKFORSHARED').split())
99++ # Framework (specific for Mac)
100++ if not getvar('PYTHONFRAMEWORK'):
101++ libs.extend(getvar('LINKFORSHARED').split())
102+103+-print(' '.join(libs))
104++ print(' '.join(libs))
···743 svn_all_fast_export = svn-all-fast-export;
744 topGit = top-git;
745 }; # Added 2021-01-14
746-0747 gkraken = throw "'gkraken' has been deprecated by upstream. Consider using the replacement 'coolercontrol' instead."; # Added 2024-11-22
748 glew-egl = lib.warnOnInstantiate "'glew-egl' is now provided by 'glew' directly" glew; # Added 2024-08-11
749 glfw-wayland = glfw; # Added 2024-04-19
···834 hardinfo = throw "'hardinfo' has been removed as it was abandoned upstream. Consider using 'hardinfo2' instead."; # added 2025-04-17
835 hasura-graphql-engine = throw "hasura-graphql-engine has been removed because was broken and its packaging severly out of date"; # Added 2025-02-14
836 haven-cli = throw "'haven-cli' has been removed due to the official announcement of the project closure. Read more at https://havenprotocol.org/2024/12/12/project-closure-announcement"; # Added 2025-02-25
0837 HentaiAtHome = hentai-at-home; # Added 2024-06-12
838 hll2390dw-cups = throw "The hll2390dw-cups package was dropped since it was unmaintained."; # Added 2024-06-21
839 hoarder = throw "'hoarder' has been renamed to 'karakeep'"; # Added 2025-04-21
···1215 mq-cli = throw "'mq-cli' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
1216 mrkd = throw "'mrkd' has been removed as it is unmaintained since 2021"; # Added 2024-12-21
1217 msp430NewlibCross = msp430Newlib; # Added 2024-09-06
01218 mupdf_1_17 = throw "'mupdf_1_17' has been removed due to being outdated and insecure. Consider using 'mupdf' instead."; # Added 2024-08-22
1219 music-player = throw "'music-player' has been removed due to lack of maintenance upstream. Consider using 'fum' or 'termusic' instead."; # Added 2025-05-02
1220 mustache-tcl = tclPackages.mustache-tcl; # Added 2024-10-02
···743 svn_all_fast_export = svn-all-fast-export;
744 topGit = top-git;
745 }; # Added 2021-01-14
746+ givaro_3 = throw "'givaro_3' has been removed as it is end-of-life. Consider using the up-to-date 'givaro' instead"; # Added 2025-05-07
747+ givaro_3_7 = throw "'givaro_3_7' has been removed as it is end-of-life. Consider using the up-to-date 'givaro' instead"; # Added 2025-05-07
748 gkraken = throw "'gkraken' has been deprecated by upstream. Consider using the replacement 'coolercontrol' instead."; # Added 2024-11-22
749 glew-egl = lib.warnOnInstantiate "'glew-egl' is now provided by 'glew' directly" glew; # Added 2024-08-11
750 glfw-wayland = glfw; # Added 2024-04-19
···835 hardinfo = throw "'hardinfo' has been removed as it was abandoned upstream. Consider using 'hardinfo2' instead."; # added 2025-04-17
836 hasura-graphql-engine = throw "hasura-graphql-engine has been removed because was broken and its packaging severly out of date"; # Added 2025-02-14
837 haven-cli = throw "'haven-cli' has been removed due to the official announcement of the project closure. Read more at https://havenprotocol.org/2024/12/12/project-closure-announcement"; # Added 2025-02-25
838+ hawknl = throw "'hawknl' has been removed as it was unmaintained and the upstream unavailable"; # Added 2025-05-07
839 HentaiAtHome = hentai-at-home; # Added 2024-06-12
840 hll2390dw-cups = throw "The hll2390dw-cups package was dropped since it was unmaintained."; # Added 2024-06-21
841 hoarder = throw "'hoarder' has been renamed to 'karakeep'"; # Added 2025-04-21
···1217 mq-cli = throw "'mq-cli' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
1218 mrkd = throw "'mrkd' has been removed as it is unmaintained since 2021"; # Added 2024-12-21
1219 msp430NewlibCross = msp430Newlib; # Added 2024-09-06
1220+ mumps_par = lib.warnOnInstantiate "mumps_par has been renamed to mumps-mpi" mumps-mpi; # Added 2025-05-07
1221 mupdf_1_17 = throw "'mupdf_1_17' has been removed due to being outdated and insecure. Consider using 'mupdf' instead."; # Added 2024-08-22
1222 music-player = throw "'music-player' has been removed due to lack of maintenance upstream. Consider using 'fum' or 'termusic' instead."; # Added 2025-05-02
1223 mustache-tcl = tclPackages.mustache-tcl; # Added 2024-10-02