···160160 Refer to the `nixos-generate-config` step in
161161 [](#sec-installation) for more information.
162162163163+ ::: {.note}
164164+ On [UEFI](https://en.wikipedia.org/wiki/UEFI) systems, check that your `/etc/nixos/hardware-configuration.nix` did the right thing with the [EFI System Partition](https://en.wikipedia.org/wiki/EFI_system_partition).
165165+ In NixOS, by default, both [systemd-boot](https://systemd.io/BOOT/) and [grub](https://www.gnu.org/software/grub/index.html) expect it to be mounted on `/boot`.
166166+ However, the configuration generator bases its [](#opt-fileSystems) configuration on the current mount points at the time it is run.
167167+ If the current system and NixOS's bootloader configuration don't agree on where the [EFI System Partition](https://en.wikipedia.org/wiki/EFI_system_partition) is to be mounted, you'll need to manually alter the mount point in `hardware-configuration.nix` before building the system closure.
168168+ :::
169169+170170+ ::: {.note}
171171+ The lustrate process will not work if the [](#opt-boot.initrd.systemd.enable) option is set to `true`.
172172+ If you want to use this option, wait until after the first boot into the NixOS system to enable it and rebuild.
173173+ :::
174174+163175 You'll likely want to set a root password for your first boot using
164176 the configuration files because you won't have a chance to enter a
165177 password until after you reboot. You can initialize the root password
···231243 $ echo etc/nixos | sudo tee -a /etc/NIXOS_LUSTRATE
232244 ```
233245234234-1. Finally, move the `/boot` directory of your current distribution out
235235- of the way (the lustrate process will take care of the rest once you
236236- reboot, but this one must be moved out now because NixOS needs to
237237- install its own boot files:
246246+1. Finally, install NixOS's boot system, backing up the current boot system's files in the process.
247247+248248+ The details of this step can vary depending on the bootloader configuration in NixOS and the bootloader in use by the current system.
249249+250250+ The commands below should work for:
251251+252252+ - [BIOS](https://en.wikipedia.org/wiki/BIOS) systems.
253253+254254+ - [UEFI](https://en.wikipedia.org/wiki/UEFI) systems where both the current system and NixOS mount the [EFI System Partition](https://en.wikipedia.org/wiki/EFI_system_partition) on `/boot`.
255255+ Both [systemd-boot](https://systemd.io/BOOT/) and [grub](https://www.gnu.org/software/grub/index.html) expect this by default in NixOS, but other distributions vary.
238256239257 ::: {.warning}
240240- Once you complete this step, your current distribution will no
241241- longer be bootable! If you didn't get all the NixOS configuration
242242- right, especially those settings pertaining to boot loading and root
243243- partition, NixOS may not be bootable either. Have a USB rescue
244244- device ready in case this happens.
258258+ Once you complete this step, your current distribution will no longer be bootable!
259259+ If you didn't get all the NixOS configuration right, especially those settings pertaining to boot loading and root partition, NixOS may not be bootable either.
260260+ Have a USB rescue device ready in case this happens.
261261+ :::
262262+263263+ ::: {.warning}
264264+ On [UEFI](https://en.wikipedia.org/wiki/UEFI) systems, anything on the [EFI System Partition](https://en.wikipedia.org/wiki/EFI_system_partition) will be removed by these commands, such as other coexisting OS's bootloaders.
245265 :::
246266247267 ```ShellSession
248248- $ sudo mv -v /boot /boot.bak &&
249249- sudo /nix/var/nix/profiles/system/bin/switch-to-configuration boot
268268+ $ sudo mkdir /boot.bak && sudo mv /boot/* /boot.bak &&
269269+ sudo NIXOS_INSTALL_BOOTLOADER=1 /nix/var/nix/profiles/system/bin/switch-to-configuration boot
250270 ```
251271252272 Cross your fingers, reboot, hopefully you should get a NixOS prompt!
273273+274274+ In other cases, most commonly where the [EFI System Partition](https://en.wikipedia.org/wiki/EFI_system_partition) of the current system is instead mounted on `/boot/efi`, the goal is to:
275275+276276+ - Make sure `/boot` (and the [EFI System Partition](https://en.wikipedia.org/wiki/EFI_system_partition), if mounted elsewhere) are mounted how the NixOS configuration would mount them.
277277+278278+ - Clear them of files related to the current system, backing them up outside of `/boot`.
279279+ NixOS will move the backups into `/old-root` along with everything else when it first boots.
280280+281281+ - Instruct the NixOS closure built earlier to install its bootloader with:
282282+ ```ShellSession
283283+ sudo NIXOS_INSTALL_BOOTLOADER=1 /nix/var/nix/profiles/system/bin/switch-to-configuration boot
284284+ ```
2532852542861. If for some reason you want to revert to the old distribution,
255287 you'll need to boot on a USB rescue disk and do something along
···4949 vim
5050 nano
51515252- # Include some version control tools.
5353- git
5454- rsync
5555-5652 # Firefox for reading the manual.
5753 firefox
5854
···1717 sdImage = {
1818 populateFirmwareCommands = let
1919 configTxt = pkgs.writeText "config.txt" ''
2020+ # u-boot refuses to start (gets stuck at rainbow polygon) without this,
2121+ # at least on Raspberry Pi 0.
2222+ enable_uart=1
2323+2024 # Prevent the firmware from smashing the framebuffer setup done by the mainline kernel
2125 # when attempting to show low-voltage or overtemperature warnings.
2226 avoid_warnings=1
···2832 kernel=u-boot-rpi1.bin
2933 '';
3034 in ''
3131- (cd ${pkgs.raspberrypifw}/share/raspberrypi/boot && cp bootcode.bin fixup*.dat start*.elf $NIX_BUILD_TOP/firmware/)
3535+ (cd ${pkgs.raspberrypifw}/share/raspberrypi/boot && cp bootcode.bin fixup*.dat start*.elf *.dtb $NIX_BUILD_TOP/firmware/)
3236 cp ${pkgs.ubootRaspberryPiZero}/u-boot.bin firmware/u-boot-rpi0.bin
3337 cp ${pkgs.ubootRaspberryPi}/u-boot.bin firmware/u-boot-rpi1.bin
3438 cp ${configTxt} firmware/config.txt
+2-2
nixos/modules/profiles/installation-device.nix
···7474 # installation device for head-less systems i.e. arm boards by manually
7575 # mounting the storage in a different system.
7676 services.openssh = {
7777- enable = true;
7878- settings.PermitRootLogin = "yes";
7777+ enable = mkDefault true;
7878+ settings.PermitRootLogin = mkDefault "yes";
7979 };
80808181 # Enable wpa_supplicant, but don't start it by default.
···10351035 all kernel interfaces.
10361036 '';
1037103710381038- start_action = mkEnumParam ["none" "trap" "start"] "none" ''
10381038+ start_action = mkEnumParam ["none" "trap" "start" "trap|start" ] "none" ''
10391039 Action to perform after loading the configuration.
1040104010411041 - The default of `none` loads the connection only, which
···10431043 - The value `trap` installs a trap policy, which triggers
10441044 the tunnel as soon as matching traffic has been detected.
10451045 - The value `start` initiates the connection actively.
10461046+ - Since version 5.9.6 two modes above can be combined with `trap|start`,
10471047+ to immediately initiate a connection for which trap policies have been installed.
1046104810471049 When unloading or replacing a CHILD_SA configuration having a
10481050 {option}`start_action` different from `none`,
-9
nixos/modules/services/web-apps/plausible.md
···1515{
1616 services.plausible = {
1717 enable = true;
1818- adminUser = {
1919- # activate is used to skip the email verification of the admin-user that's
2020- # automatically created by plausible. This is only supported if
2121- # postgresql is configured by the module. This is done by default, but
2222- # can be turned off with services.plausible.database.postgres.setup.
2323- activate = true;
2424- email = "admin@localhost";
2525- passwordFile = "/run/secrets/plausible-admin-pwd";
2626- };
2718 server = {
2819 baseUrl = "http://analytics.example.org";
2920 # secretKeybaseFile is a path to the file which contains the secret generated
+5-47
nixos/modules/services/web-apps/plausible.nix
···11111212 package = mkPackageOption pkgs "plausible" { };
13131414- adminUser = {
1515- name = mkOption {
1616- default = "admin";
1717- type = types.str;
1818- description = ''
1919- Name of the admin user that plausible will created on initial startup.
2020- '';
2121- };
2222-2323- email = mkOption {
2424- type = types.str;
2525- example = "admin@localhost";
2626- description = ''
2727- Email-address of the admin-user.
2828- '';
2929- };
3030-3131- passwordFile = mkOption {
3232- type = types.either types.str types.path;
3333- description = ''
3434- Path to the file which contains the password of the admin user.
3535- '';
3636- };
3737-3838- activate = mkEnableOption "activating the freshly created admin-user";
3939- };
4040-4114 database = {
4215 clickhouse = {
4316 setup = mkEnableOption "creating a clickhouse instance" // { default = true; };
···164137165138 imports = [
166139 (mkRemovedOptionModule [ "services" "plausible" "releaseCookiePath" ] "Plausible uses no distributed Erlang features, so this option is no longer necessary and was removed")
140140+ (mkRemovedOptionModule [ "services" "plausible" "adminUser" "name" ] "Admin user is now created using first start wizard")
141141+ (mkRemovedOptionModule [ "services" "plausible" "adminUser" "email" ] "Admin user is now created using first start wizard")
142142+ (mkRemovedOptionModule [ "services" "plausible" "adminUser" "passwordFile" ] "Admin user is now created using first start wizard")
143143+ (mkRemovedOptionModule [ "services" "plausible" "adminUser" "activate" ] "Admin user is now created using first start wizard")
167144 ];
168145169146 config = mkIf cfg.enable {
170170- assertions = [
171171- { assertion = cfg.adminUser.activate -> cfg.database.postgres.setup;
172172- message = ''
173173- Unable to automatically activate the admin-user if no locally managed DB for
174174- postgres (`services.plausible.database.postgres.setup') is enabled!
175175- '';
176176- }
177177- ];
178178-179147 services.postgresql = mkIf cfg.database.postgres.setup {
180148 enable = true;
181149 };
···243211 # Home is needed to connect to the node with iex
244212 HOME = "/var/lib/plausible";
245213246246- ADMIN_USER_NAME = cfg.adminUser.name;
247247- ADMIN_USER_EMAIL = cfg.adminUser.email;
248248-249249- DATABASE_SOCKET_DIR = cfg.database.postgres.socket;
250250- DATABASE_NAME = cfg.database.postgres.dbname;
214214+ DATABASE_URL = "postgresql:///${cfg.database.postgres.dbname}?host=${cfg.database.postgres.socket}";
251215 CLICKHOUSE_DATABASE_URL = cfg.database.clickhouse.url;
252216253217 BASE_URL = cfg.server.baseUrl;
···270234 # even though we set `RELEASE_DISTRIBUTION=none` so the cookie should be unused.
271235 # Thus, make a random one, which should then be ignored.
272236 export RELEASE_COOKIE=$(tr -dc A-Za-z0-9 < /dev/urandom | head -c 20)
273273- export ADMIN_USER_PWD="$(< $CREDENTIALS_DIRECTORY/ADMIN_USER_PWD )"
274237 export SECRET_KEY_BASE="$(< $CREDENTIALS_DIRECTORY/SECRET_KEY_BASE )"
275238276239 ${lib.optionalString (cfg.mail.smtp.passwordFile != null)
···283246284247 ${cfg.package}/migrate.sh
285248 export IP_GEOLOCATION_DB=${pkgs.dbip-country-lite}/share/dbip/dbip-country-lite.mmdb
286286- ${cfg.package}/bin/plausible eval "(Plausible.Release.prepare() ; Plausible.Auth.create_user(\"$ADMIN_USER_NAME\", \"$ADMIN_USER_EMAIL\", \"$ADMIN_USER_PWD\"))"
287287- ${optionalString cfg.adminUser.activate ''
288288- psql -d plausible <<< "UPDATE users SET email_verified=true where email = '$ADMIN_USER_EMAIL';"
289289- ''}
290249291250 exec plausible start
292251 '';
···297256 WorkingDirectory = "/var/lib/plausible";
298257 StateDirectory = "plausible";
299258 LoadCredential = [
300300- "ADMIN_USER_PWD:${cfg.adminUser.passwordFile}"
301259 "SECRET_KEY_BASE:${cfg.server.secretKeybaseFile}"
302260 ] ++ lib.optionals (cfg.mail.smtp.passwordFile != null) [ "SMTP_USER_PWD:${cfg.mail.smtp.passwordFile}"];
303261 };
···4141my $out = "@out@";
4242# System closure path to switch to
4343my $toplevel = "@toplevel@";
4444-# Path to the directory containing systemd tools of the old system
4545-my $cur_systemd = abs_path("/run/current-system/sw/bin");
4646-# Path to the systemd store path of the new system
4747-my $new_systemd = "@systemd@";
48444945# To be robust against interruption, record what units need to be started etc.
5046# We read these files again every time this script starts to make sure we continue
···129125if ($action eq "boot") {
130126 exit(0);
131127}
128128+129129+# Path to the directory containing systemd tools of the old system
130130+# Needs to be after the "boot" action exits, as this directory will not exist when doing a NIXOS_LUSTRATE install
131131+my $cur_systemd = abs_path("/run/current-system/sw/bin");
132132+# Path to the systemd store path of the new system
133133+my $new_systemd = "@systemd@";
132134133135# Check if we can activate the new configuration.
134136my $cur_init_interface_version = read_file("/run/current-system/init-interface-version", err_mode => "quiet") // "";
+3-24
nixos/tests/plausible.nix
···11-import ./make-test-python.nix ({ pkgs, lib, ... }: {
11+import ./make-test-python.nix ({ lib, ... }: {
22 name = "plausible";
33- meta = with lib.maintainers; {
44- maintainers = [ ];
33+ meta = {
44+ maintainers = lib.teams.cyberus.members;
55 };
6677 nodes.machine = { pkgs, ... }: {
88 virtualisation.memorySize = 4096;
99 services.plausible = {
1010 enable = true;
1111- adminUser = {
1212- email = "admin@example.org";
1313- passwordFile = "${pkgs.writeText "pwd" "foobar"}";
1414- activate = true;
1515- };
1611 server = {
1712 baseUrl = "http://localhost:8000";
1813 secretKeybaseFile = "${pkgs.writeText "dont-try-this-at-home" "nannannannannannannannannannannannannannannannannannannan_batman!"}";
···3227 machine.succeed("curl -f localhost:8000 >&2")
33283429 machine.succeed("curl -f localhost:8000/js/script.js >&2")
3535-3636- csrf_token = machine.succeed(
3737- "curl -c /tmp/cookies localhost:8000/login | grep '_csrf_token' | sed -E 's,.*value=\"(.*)\".*,\\1,g'"
3838- )
3939-4040- machine.succeed(
4141- f"curl -b /tmp/cookies -f -X POST localhost:8000/login -F email=admin@example.org -F password=foobar -F _csrf_token={csrf_token.strip()} -D headers"
4242- )
4343-4444- # By ensuring that the user is redirected to the dashboard after login, we
4545- # also make sure that the automatic verification of the module works.
4646- machine.succeed(
4747- "[[ $(grep 'location: ' headers | cut -d: -f2- | xargs echo) == /sites* ]]"
4848- )
4949-5050- machine.shutdown()
5130 '';
5231})
···3636# note: there is a generic builder in pkgs/games/sm64ex/generic.nix that is meant to help build sm64ex and its forks; however sm64coopdx has departed significantly enough in its build that it doesn't make sense to use that other than the baseRom derivation
3737stdenv.mkDerivation (finalAttrs: {
3838 pname = "sm64coopdx";
3939- version = "1.0.3";
3939+ version = "1.0.4";
40404141 src = fetchFromGitHub {
4242 owner = "coop-deluxe";
4343 repo = "sm64coopdx";
4444 rev = "v${finalAttrs.version}";
4545- hash = "sha256-cIH3escLFMcHgtFxeSKIo5nZXvaknti+EVt72uB4XXc=";
4545+ hash = "sha256-v50C87/NN75owxtLL4vm8TLZha7U8FkefPhpO6iXYGU=";
4646 };
47474848 nativeBuildInputs = [ makeWrapper ];
···7171 # remove -march flags, stdenv manages them
7272 substituteInPlace Makefile \
7373 --replace-fail ' -march=$(TARGET_ARCH)' ""
7474- # workaround a bug in the build
7575- # see https://github.com/coop-deluxe/sm64coopdx/issues/186#issuecomment-2216163935
7676- # this can likely be removed when the next version releases
7777- make build/us_pc/sound/sequences.bin
7874 '';
79758076 installPhase = ''
···997997 std::env::set_var("LOCALE_ARCHIVE", locale_archive);
998998 }
99999910001000- let current_system_bin = std::path::PathBuf::from("/run/current-system/sw/bin")
10011001- .canonicalize()
10021002- .context("/run/current-system/sw/bin is missing")?;
10031003-10041000 let os_release = parse_os_release().context("Failed to parse os-release")?;
1005100110061002 let distro_id_re = Regex::new(format!("^\"?{}\"?$", distro_id).as_str())
···10711067 if *action == Action::Boot {
10721068 std::process::exit(0);
10731069 }
10701070+10711071+ // Needs to be after the "boot" action exits, as this directory will not exist when doing a NIXOS_LUSTRATE install
10721072+ let current_system_bin = std::path::PathBuf::from("/run/current-system/sw/bin")
10731073+ .canonicalize()
10741074+ .context("/run/current-system/sw/bin is missing")?;
1074107510751076 let current_init_interface_version =
10761077 std::fs::read_to_string("/run/current-system/init-interface-version").unwrap_or_default();
···22 lib,
33 buildPythonPackage,
44 fetchFromGitHub,
55+ fetchpatch,
5667 # dependencies
78 appdirs,
···2930 rev = "refs/tags/v${version}";
3031 hash = "sha256-dxCGCPnk1IFKg8ZVqMJsojQL0KlNirKlHJoaaOYIzMU=";
3132 };
3333+3434+ patches = [
3535+ # TODO: this has been merged in master and will thus be included in the next release.
3636+ (fetchpatch {
3737+ name = "migrate-from-nose-to-pytest";
3838+ url = "https://github.com/openvax/mhcflurry/commit/8e9f35381a476362ca41cb71eb0a90f6573fe4b3.patch";
3939+ hash = "sha256-PyyxGrjE3OZR8dKHEQBQGiRG9A8kcz/e14PRyrVvqrE=";
4040+ })
4141+ ];
32423343 # keras and tensorflow are not in the official setup.py requirements but are required for the CLI utilities to run.
3444 dependencies = [
···94104 changelog = "https://github.com/openvax/mhcflurry/releases/tag/v${version}";
95105 license = lib.licenses.asl20;
96106 maintainers = with lib.maintainers; [ samuela ];
9797- # Requires a recent version of tensorflow
9898- broken = lib.versionOlder tensorflow.version "2.15.0";
99107 };
100108}
···6969+
7070+ Rectangle {
7171+ width: 700
7272-+ height: 200
7272++ height: 250
7373+ color: palette.base
7474+ radius: 10
7575+ border.width: 0
7676+ Text {
7777+ color: palette.text
7878+ width: 600
7979-+ height: 150
7979++ height: 200
8080+ anchors.centerIn: parent
8181-+ text: qsTr("NixOS is fully open source, but it also provides optional software packages that do not respect users' freedom to run, copy, distribute, study, change and improve the software, and are commonly not open source. By default such "unfree" packages are not allowed, but you can enable it here. If you check this box, you agree that unfree software may be installed which might have additional End User License Agreements (EULAs) that you need to agree to. If not enabled, some hardware (notably Nvidia GPUs and some WiFi chips) might not work or not work optimally.<br/>")
8181++ text: qsTr("NixOS is fully open source, but it also provides optional software packages that do not respect users' freedom to run, copy, distribute, study, change and improve the software, and are commonly not open source. By default such \"unfree\" packages are not allowed, but you can enable it here. If you check this box, you agree that unfree software may be installed which might have additional End User License Agreements (EULAs) that you need to agree to. If not enabled, some hardware (notably Nvidia GPUs and some WiFi chips) might not work or not work optimally.<br/>")
8282+ font.pointSize: 12
8383+ wrapMode: Text.WordWrap
8484+ }
···8686+ CheckBox {
8787+ id: element2
8888+ anchors.horizontalCenter: parent.horizontalCenter
8989-+ y: 145
8989++ y: 190
9090+ text: qsTr("Allow unfree software")
9191+ checked: false
9292+
···7070 ### I ###
71717272 insert_dylib = throw "'darwin.insert_dylib' has been renamed to 'insert-dylib'"; # added 2024-04-04
7373+ ios-deploy = throw "'darwin.ios-deploy' has been renamed to 'ios-deploy'"; # added 2024-11-28
73747475 ### L ###
7576
-2
pkgs/top-level/darwin-packages.nix
···229229 # As the name says, this is broken, but I don't want to lose it since it's a direction we want to go in
230230 # libdispatch-broken = callPackage ../os-specific/darwin/swift-corelibs/libdispatch.nix { };
231231232232- ios-deploy = callPackage ../os-specific/darwin/ios-deploy {};
233233-234232 # See doc/packages/darwin-builder.section.md
235233 linux-builder = lib.makeOverridable ({ modules }:
236234 let