···841 version of zfs.
842 </para>
843 </listitem>
000000000844 </itemizedlist>
845 </section>
846</section>
···841 version of zfs.
842 </para>
843 </listitem>
844+ <listitem>
845+ <para>
846+ Nginx will use the value of
847+ <literal>sslTrustedCertificate</literal> if provided for a
848+ virtual host, even if <literal>enableACME</literal> is set.
849+ This is useful for providers not using the same certificate to
850+ sign OCSP responses and server certificates.
851+ </para>
852+ </listitem>
853 </itemizedlist>
854 </section>
855</section>
+2
nixos/doc/manual/release-notes/rl-2111.section.md
···213- The [services.syncoid.enable](options.html#opt-services.syncoid.enable) module now properly drops ZFS permissions after usage. Before it delegated permissions to whole pools instead of datasets and didn't clean up after execution. You can manually look this up for your pools by running `zfs allow your-pool-name` and use `zfs unallow syncoid your-pool-name` to clean this up.
214215- Zfs: `latestCompatibleLinuxPackages` is now exported on the zfs package. One can use `boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;` to always track the latest compatible kernel with a given version of zfs.
00
···213- The [services.syncoid.enable](options.html#opt-services.syncoid.enable) module now properly drops ZFS permissions after usage. Before it delegated permissions to whole pools instead of datasets and didn't clean up after execution. You can manually look this up for your pools by running `zfs allow your-pool-name` and use `zfs unallow syncoid your-pool-name` to clean this up.
214215- Zfs: `latestCompatibleLinuxPackages` is now exported on the zfs package. One can use `boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;` to always track the latest compatible kernel with a given version of zfs.
216+217+- Nginx will use the value of `sslTrustedCertificate` if provided for a virtual host, even if `enableACME` is set. This is useful for providers not using the same certificate to sign OCSP responses and server certificates.
+44-8
nixos/modules/security/acme.nix
···21 # The Group can vary depending on what the user has specified in
22 # security.acme.certs.<cert>.group on some of the services.
23 commonServiceConfig = {
24- Type = "oneshot";
25- User = "acme";
26- Group = mkDefault "acme";
27- UMask = 0022;
28- StateDirectoryMode = 750;
29- ProtectSystem = "full";
30- PrivateTmp = true;
0003132- WorkingDirectory = "/tmp";
00000000000000000000000000000000033 };
3435 # In order to avoid race conditions creating the CA for selfsigned certs,
···21 # The Group can vary depending on what the user has specified in
22 # security.acme.certs.<cert>.group on some of the services.
23 commonServiceConfig = {
24+ Type = "oneshot";
25+ User = "acme";
26+ Group = mkDefault "acme";
27+ UMask = 0022;
28+ StateDirectoryMode = 750;
29+ ProtectSystem = "strict";
30+ ReadWritePaths = [
31+ "/var/lib/acme"
32+ ];
33+ PrivateTmp = true;
3435+ WorkingDirectory = "/tmp";
36+37+ CapabilityBoundingSet = [ "" ];
38+ DevicePolicy = "closed";
39+ LockPersonality = true;
40+ MemoryDenyWriteExecute = true;
41+ NoNewPrivileges = true;
42+ PrivateDevices = true;
43+ ProtectClock = true;
44+ ProtectHome = true;
45+ ProtectHostname = true;
46+ ProtectControlGroups = true;
47+ ProtectKernelLogs = true;
48+ ProtectKernelModules = true;
49+ ProtectKernelTunables = true;
50+ ProtectProc = "invisible";
51+ ProcSubset = "pid";
52+ RemoveIPC = true;
53+ RestrictAddressFamilies = [
54+ "AF_INET"
55+ "AF_INET6"
56+ ];
57+ RestrictNamespaces = true;
58+ RestrictRealtime = true;
59+ RestrictSUIDSGID = true;
60+ SystemCallArchitectures = "native";
61+ SystemCallFilter = [
62+ # 1. allow a reasonable set of syscalls
63+ "@system-service"
64+ # 2. and deny unreasonable ones
65+ "~@privileged @resources"
66+ # 3. then allow the required subset within denied groups
67+ "@chown"
68+ ];
69 };
7071 # In order to avoid race conditions creating the CA for selfsigned certs,
···9 default = false;
10 description = ''
11 This option enables Mullvad VPN daemon.
12+ This sets <option>networking.firewall.checkReversePath</option> to "loose", which might be undesirable for security.
13 '';
14 };
15···1819 # mullvad-daemon writes to /etc/iproute2/rt_tables
20 networking.iproute2.enable = true;
21+22+ # See https://github.com/NixOS/nixpkgs/issues/113589
23+ networking.firewall.checkReversePath = "loose";
2425 systemd.services.mullvad-daemon = {
26 description = "Mullvad VPN daemon";
···46 };
47 };
4849+ meta.maintainers = with maintainers; [ ymarkus ];
50}
+19-10
nixos/modules/services/networking/ntp/chrony.nix
···81 '';
82 };
8384- initstepslew = mkOption {
85- type = types.attrsOf (types.either types.bool types.int);
86- default = {
87- enabled = true;
88- threshold = 1000; # by default, same threshold as 'ntpd -g' (1000s)
0000000000000089 };
90- description = ''
91- Allow chronyd to make a rapid measurement of the system clock error at
92- boot time, and to correct the system clock by stepping before normal
93- operation begins.
94- '';
95 };
9697 directory = mkOption {
···81 '';
82 };
8384+ initstepslew = {
85+ enabled = mkOption {
86+ type = types.bool;
87+ default = true;
88+ description = ''
89+ Allow chronyd to make a rapid measurement of the system clock error
90+ at boot time, and to correct the system clock by stepping before
91+ normal operation begins.
92+ '';
93+ };
94+95+ threshold = mkOption {
96+ type = types.either types.float types.int;
97+ default = 1000; # by default, same threshold as 'ntpd -g' (1000s)
98+ description = ''
99+ The threshold of system clock error (in seconds) above which the
100+ clock will be stepped. If the correction required is less than the
101+ threshold, a slew is used instead.
102+ '';
103 };
00000104 };
105106 directory = mkOption {
+4-1
nixos/modules/services/networking/tinc.nix
···427 nameValuePair ("tinc.${network}") ({
428 description = "Tinc daemon user for ${network}";
429 isSystemUser = true;
0430 })
431 );
432-00433 };
434435 meta.maintainers = with maintainers; [ minijackson ];
···145 sslTrustedCertificate = mkOption {
146 type = types.nullOr types.path;
147 default = null;
148- example = "/var/root.cert";
149 description = "Path to root SSL certificate for stapling and client certificates.";
150 };
151
···145 sslTrustedCertificate = mkOption {
146 type = types.nullOr types.path;
147 default = null;
148+ example = "\${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
149 description = "Path to root SSL certificate for stapling and client certificates.";
150 };
151
+1
nixos/modules/system/boot/systemd.nix
···11281129 users.groups.systemd-journal.gid = config.ids.gids.systemd-journal;
1130 users.users.systemd-journal-gateway.uid = config.ids.uids.systemd-journal-gateway;
01131 users.groups.systemd-journal-gateway.gid = config.ids.gids.systemd-journal-gateway;
11321133 # Generate timer units for all services that have a ‘startAt’ value.
···11281129 users.groups.systemd-journal.gid = config.ids.gids.systemd-journal;
1130 users.users.systemd-journal-gateway.uid = config.ids.uids.systemd-journal-gateway;
1131+ users.users.systemd-journal-gateway.group = "systemd-journal-gateway";
1132 users.groups.systemd-journal-gateway.gid = config.ids.gids.systemd-journal-gateway;
11331134 # Generate timer units for all services that have a ‘startAt’ value.
···60 # extra `/`.
61 ./normalize-var.patch
62 ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
0063 ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
6465 # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
···60 # extra `/`.
61 ./normalize-var.patch
62 ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
63+ # Prevent a compilation error on darwin
64+ ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-targetconditionals.patch
65 ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
6667 # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
···301 # Builds in 2+h with 2 cores, and ~15m with a big-parallel builder.
302 requiredSystemFeatures = [ "big-parallel" ];
30300000304 meta = with lib; {
305 description = "Open source, prototype-to-production deep learning platform";
306 homepage = "https://pytorch.org/";
···301 # Builds in 2+h with 2 cores, and ~15m with a big-parallel builder.
302 requiredSystemFeatures = [ "big-parallel" ];
303304+ passthru = {
305+ inherit cudaSupport;
306+ cudaArchList = final_cudaArchList;
307+ };
308+309 meta = with lib; {
310 description = "Open source, prototype-to-production deep learning platform";
311 homepage = "https://pytorch.org/";
···78buildPythonPackage rec {
9 pname = "resolvelib";
10+ # Currently this package is only used by Ansible and breaking changes
11+ # are frequently introduced, so when upgrading ensure the new version
12+ # is compatible with Ansible
13+ # https://github.com/NixOS/nixpkgs/pull/128636
14+ # https://github.com/ansible/ansible/blob/devel/requirements.txt
15+ version = "0.5.5";
1617 src = fetchFromGitHub {
18 owner = "sarugaku";
19 repo = "resolvelib";
20 rev = version;
21+ sha256 = "198vfv78hilpg0d0mjzchzp9zk6239wnra61vlsgwpcgz66d2bgv";
22 };
2324 checkInputs = [
···1011with pkgs;
1213-let
14- self =
15- builtins.trace ''
16- It seems that you are using a patched Nixpkgs that references the self
17- variable in pkgs/top-level/all-packages.nix. This variable was incorrectly
18- named, so its usage needs attention. Please use pkgs for packages or super
19- for functions.
20- ''
21- res; # Do *NOT* use res in your fork. It will be removed.
22-23- # TODO: turn self into an error
24-25-in
26{
2728 # A stdenv capable of building 32-bit binaries. On x86_64-linux,
···3260 };
32613262 psrecord = python3Packages.callPackage ../tools/misc/psrecord {};
0032633264 river = callPackage ../applications/window-managers/river { };
3265···13549 cvise = python3Packages.callPackage ../development/tools/misc/cvise {
13550 inherit (llvmPackages_11) llvm libclang;
13551 };
001355213553 dprint = callPackage ../development/tools/dprint { };
13554···2869528696 zola = callPackage ../applications/misc/zola {
28697 inherit (darwin.apple_sdk.frameworks) CoreServices;
28698- # Version 0.13.0 has the lexical_core 0.7.4 dependency that doesn't build
28699- # with rust 1.53. This should be fixed in the next version.
28700- rustPlatform = rustPackages_1_45.rustPlatform;
28701 };
2870228703 zombietrackergps = libsForQt5.callPackage ../applications/gis/zombietrackergps { };