···841841 version of zfs.
842842 </para>
843843 </listitem>
844844+ <listitem>
845845+ <para>
846846+ Nginx will use the value of
847847+ <literal>sslTrustedCertificate</literal> if provided for a
848848+ virtual host, even if <literal>enableACME</literal> is set.
849849+ This is useful for providers not using the same certificate to
850850+ sign OCSP responses and server certificates.
851851+ </para>
852852+ </listitem>
844853 </itemizedlist>
845854 </section>
846855</section>
+2
nixos/doc/manual/release-notes/rl-2111.section.md
···213213- The [services.syncoid.enable](options.html#opt-services.syncoid.enable) module now properly drops ZFS permissions after usage. Before it delegated permissions to whole pools instead of datasets and didn't clean up after execution. You can manually look this up for your pools by running `zfs allow your-pool-name` and use `zfs unallow syncoid your-pool-name` to clean this up.
214214215215- Zfs: `latestCompatibleLinuxPackages` is now exported on the zfs package. One can use `boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;` to always track the latest compatible kernel with a given version of zfs.
216216+217217+- Nginx will use the value of `sslTrustedCertificate` if provided for a virtual host, even if `enableACME` is set. This is useful for providers not using the same certificate to sign OCSP responses and server certificates.
+44-8
nixos/modules/security/acme.nix
···2121 # The Group can vary depending on what the user has specified in
2222 # security.acme.certs.<cert>.group on some of the services.
2323 commonServiceConfig = {
2424- Type = "oneshot";
2525- User = "acme";
2626- Group = mkDefault "acme";
2727- UMask = 0022;
2828- StateDirectoryMode = 750;
2929- ProtectSystem = "full";
3030- PrivateTmp = true;
2424+ Type = "oneshot";
2525+ User = "acme";
2626+ Group = mkDefault "acme";
2727+ UMask = 0022;
2828+ StateDirectoryMode = 750;
2929+ ProtectSystem = "strict";
3030+ ReadWritePaths = [
3131+ "/var/lib/acme"
3232+ ];
3333+ PrivateTmp = true;
31343232- WorkingDirectory = "/tmp";
3535+ WorkingDirectory = "/tmp";
3636+3737+ CapabilityBoundingSet = [ "" ];
3838+ DevicePolicy = "closed";
3939+ LockPersonality = true;
4040+ MemoryDenyWriteExecute = true;
4141+ NoNewPrivileges = true;
4242+ PrivateDevices = true;
4343+ ProtectClock = true;
4444+ ProtectHome = true;
4545+ ProtectHostname = true;
4646+ ProtectControlGroups = true;
4747+ ProtectKernelLogs = true;
4848+ ProtectKernelModules = true;
4949+ ProtectKernelTunables = true;
5050+ ProtectProc = "invisible";
5151+ ProcSubset = "pid";
5252+ RemoveIPC = true;
5353+ RestrictAddressFamilies = [
5454+ "AF_INET"
5555+ "AF_INET6"
5656+ ];
5757+ RestrictNamespaces = true;
5858+ RestrictRealtime = true;
5959+ RestrictSUIDSGID = true;
6060+ SystemCallArchitectures = "native";
6161+ SystemCallFilter = [
6262+ # 1. allow a reasonable set of syscalls
6363+ "@system-service"
6464+ # 2. and deny unreasonable ones
6565+ "~@privileged @resources"
6666+ # 3. then allow the required subset within denied groups
6767+ "@chown"
6868+ ];
3369 };
34703571 # In order to avoid race conditions creating the CA for selfsigned certs,
···99 default = false;
1010 description = ''
1111 This option enables Mullvad VPN daemon.
1212+ This sets <option>networking.firewall.checkReversePath</option> to "loose", which might be undesirable for security.
1213 '';
1314 };
1415···17181819 # mullvad-daemon writes to /etc/iproute2/rt_tables
1920 networking.iproute2.enable = true;
2121+2222+ # See https://github.com/NixOS/nixpkgs/issues/113589
2323+ networking.firewall.checkReversePath = "loose";
20242125 systemd.services.mullvad-daemon = {
2226 description = "Mullvad VPN daemon";
···4246 };
4347 };
44484545- meta.maintainers = [ maintainers.xfix ];
4949+ meta.maintainers = with maintainers; [ ymarkus ];
4650}
+19-10
nixos/modules/services/networking/ntp/chrony.nix
···8181 '';
8282 };
83838484- initstepslew = mkOption {
8585- type = types.attrsOf (types.either types.bool types.int);
8686- default = {
8787- enabled = true;
8888- threshold = 1000; # by default, same threshold as 'ntpd -g' (1000s)
8484+ initstepslew = {
8585+ enabled = mkOption {
8686+ type = types.bool;
8787+ default = true;
8888+ description = ''
8989+ Allow chronyd to make a rapid measurement of the system clock error
9090+ at boot time, and to correct the system clock by stepping before
9191+ normal operation begins.
9292+ '';
9393+ };
9494+9595+ threshold = mkOption {
9696+ type = types.either types.float types.int;
9797+ default = 1000; # by default, same threshold as 'ntpd -g' (1000s)
9898+ description = ''
9999+ The threshold of system clock error (in seconds) above which the
100100+ clock will be stepped. If the correction required is less than the
101101+ threshold, a slew is used instead.
102102+ '';
89103 };
9090- description = ''
9191- Allow chronyd to make a rapid measurement of the system clock error at
9292- boot time, and to correct the system clock by stepping before normal
9393- operation begins.
9494- '';
95104 };
9610597106 directory = mkOption {
···145145 sslTrustedCertificate = mkOption {
146146 type = types.nullOr types.path;
147147 default = null;
148148- example = "/var/root.cert";
148148+ example = "\${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
149149 description = "Path to root SSL certificate for stapling and client certificates.";
150150 };
151151
+1
nixos/modules/system/boot/systemd.nix
···1128112811291129 users.groups.systemd-journal.gid = config.ids.gids.systemd-journal;
11301130 users.users.systemd-journal-gateway.uid = config.ids.uids.systemd-journal-gateway;
11311131+ users.users.systemd-journal-gateway.group = "systemd-journal-gateway";
11311132 users.groups.systemd-journal-gateway.gid = config.ids.gids.systemd-journal-gateway;
1132113311331134 # Generate timer units for all services that have a ‘startAt’ value.
···6060 # extra `/`.
6161 ./normalize-var.patch
6262 ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
6363+ # Prevent a compilation error on darwin
6464+ ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-targetconditionals.patch
6365 ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
64666567 # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
···7788buildPythonPackage rec {
99 pname = "resolvelib";
1010- version = "0.7.1";
1010+ # Currently this package is only used by Ansible and breaking changes
1111+ # are frequently introduced, so when upgrading ensure the new version
1212+ # is compatible with Ansible
1313+ # https://github.com/NixOS/nixpkgs/pull/128636
1414+ # https://github.com/ansible/ansible/blob/devel/requirements.txt
1515+ version = "0.5.5";
11161217 src = fetchFromGitHub {
1318 owner = "sarugaku";
1419 repo = "resolvelib";
1520 rev = version;
1616- sha256 = "1fqz75riagizihvf4j7wc3zjw6kmg1dd8sf49aszyml105kb33n8";
2121+ sha256 = "198vfv78hilpg0d0mjzchzp9zk6239wnra61vlsgwpcgz66d2bgv";
1722 };
18231924 checkInputs = [
···10101111with pkgs;
12121313-let
1414- self =
1515- builtins.trace ''
1616- It seems that you are using a patched Nixpkgs that references the self
1717- variable in pkgs/top-level/all-packages.nix. This variable was incorrectly
1818- named, so its usage needs attention. Please use pkgs for packages or super
1919- for functions.
2020- ''
2121- res; # Do *NOT* use res in your fork. It will be removed.
2222-2323- # TODO: turn self into an error
2424-2525-in
2613{
27142815 # A stdenv capable of building 32-bit binaries. On x86_64-linux,
···32603247 };
3261324832623249 psrecord = python3Packages.callPackage ../tools/misc/psrecord {};
32503250+32513251+ reg = callPackage ../tools/virtualization/reg { };
3263325232643253 river = callPackage ../applications/window-managers/river { };
32653254···1354913538 cvise = python3Packages.callPackage ../development/tools/misc/cvise {
1355013539 inherit (llvmPackages_11) llvm libclang;
1355113540 };
1354113541+1354213542+ cwltool = callPackage ../applications/science/misc/cwltool { };
13552135431355313544 dprint = callPackage ../development/tools/dprint { };
1355413545···28695286862869628687 zola = callPackage ../applications/misc/zola {
2869728688 inherit (darwin.apple_sdk.frameworks) CoreServices;
2869828698- # Version 0.13.0 has the lexical_core 0.7.4 dependency that doesn't build
2869928699- # with rust 1.53. This should be fixed in the next version.
2870028700- rustPlatform = rustPackages_1_45.rustPlatform;
2870128689 };
28702286902870328691 zombietrackergps = libsForQt5.callPackage ../applications/gis/zombietrackergps { };