···157157 module where user Fontconfig settings are available.
158158 </para>
159159 </listitem>
160160+ <listitem>
161161+ <para>
162162+ ZFS/SPL have been updated to 0.7.0, <literal>zfsUnstable, splUnstable</literal>
163163+ have therefore been removed.
164164+ </para>
165165+ </listitem>
160166161167</itemizedlist>
162168
+64-11
nixos/modules/config/swap.nix
···5566let
7788+ randomEncryptionCoerce = enable: { inherit enable; };
99+1010+ randomEncryptionOpts = { ... }: {
1111+1212+ options = {
1313+1414+ enable = mkOption {
1515+ default = false;
1616+ type = types.bool;
1717+ description = ''
1818+ Encrypt swap device with a random key. This way you won't have a persistent swap device.
1919+2020+ WARNING: Don't try to hibernate when you have at least one swap partition with
2121+ this option enabled! We have no way to set the partition into which hibernation image
2222+ is saved, so if your image ends up on an encrypted one you would lose it!
2323+2424+ WARNING #2: Do not use /dev/disk/by-uuid/… or /dev/disk/by-label/… as your swap device
2525+ when using randomEncryption as the UUIDs and labels will get erased on every boot when
2626+ the partition is encrypted. Best to use /dev/disk/by-partuuid/…
2727+ '';
2828+ };
2929+3030+ cipher = mkOption {
3131+ default = "aes-xts-plain64";
3232+ example = "serpent-xts-plain64";
3333+ type = types.str;
3434+ description = ''
3535+ Use specified cipher for randomEncryption.
3636+3737+ Hint: Run "cryptsetup benchmark" to see which one is fastest on your machine.
3838+ '';
3939+ };
4040+4141+ source = mkOption {
4242+ default = "/dev/urandom";
4343+ example = "/dev/random";
4444+ type = types.str;
4545+ description = ''
4646+ Define the source of randomness to obtain a random key for encryption.
4747+ '';
4848+ };
4949+5050+ };
5151+5252+ };
5353+854 swapCfg = {config, options, ...}: {
9551056 options = {
···47934894 randomEncryption = mkOption {
4995 default = false;
5050- type = types.bool;
9696+ example = {
9797+ enable = true;
9898+ cipher = "serpent-xts-plain64";
9999+ source = "/dev/random";
100100+ };
101101+ type = types.coercedTo types.bool randomEncryptionCoerce (types.submodule randomEncryptionOpts);
51102 description = ''
52103 Encrypt swap device with a random key. This way you won't have a persistent swap device.
104104+105105+ HINT: run "cryptsetup benchmark" to test cipher performance on your machine.
5310654107 WARNING: Don't try to hibernate when you have at least one swap partition with
55108 this option enabled! We have no way to set the partition into which hibernation image
···77130 device = mkIf options.label.isDefined
78131 "/dev/disk/by-label/${config.label}";
79132 deviceName = lib.replaceChars ["\\"] [""] (escapeSystemdPath config.device);
8080- realDevice = if config.randomEncryption then "/dev/mapper/${deviceName}" else config.device;
133133+ realDevice = if config.randomEncryption.enable then "/dev/mapper/${deviceName}" else config.device;
81134 };
8213583136 };
···125178126179 createSwapDevice = sw:
127180 assert sw.device != "";
128128- assert !(sw.randomEncryption && lib.hasPrefix "/dev/disk/by-uuid" sw.device);
129129- assert !(sw.randomEncryption && lib.hasPrefix "/dev/disk/by-label" sw.device);
181181+ assert !(sw.randomEncryption.enable && lib.hasPrefix "/dev/disk/by-uuid" sw.device);
182182+ assert !(sw.randomEncryption.enable && lib.hasPrefix "/dev/disk/by-label" sw.device);
130183 let realDevice' = escapeSystemdPath sw.realDevice;
131184 in nameValuePair "mkswap-${sw.deviceName}"
132185 { description = "Initialisation of swap device ${sw.device}";
133186 wantedBy = [ "${realDevice'}.swap" ];
134187 before = [ "${realDevice'}.swap" ];
135135- path = [ pkgs.utillinux ] ++ optional sw.randomEncryption pkgs.cryptsetup;
188188+ path = [ pkgs.utillinux ] ++ optional sw.randomEncryption.enable pkgs.cryptsetup;
136189137190 script =
138191 ''
···145198 truncate --size "${toString sw.size}M" "${sw.device}"
146199 fi
147200 chmod 0600 ${sw.device}
148148- ${optionalString (!sw.randomEncryption) "mkswap ${sw.realDevice}"}
201201+ ${optionalString (!sw.randomEncryption.enable) "mkswap ${sw.realDevice}"}
149202 fi
150203 ''}
151151- ${optionalString sw.randomEncryption ''
152152- cryptsetup open ${sw.device} ${sw.deviceName} --type plain --key-file /dev/urandom
204204+ ${optionalString sw.randomEncryption.enable ''
205205+ cryptsetup plainOpen -c ${sw.randomEncryption.cipher} -d ${sw.randomEncryption.source} ${sw.device} ${sw.deviceName}
153206 mkswap ${sw.realDevice}
154207 ''}
155208 '';
···157210 unitConfig.RequiresMountsFor = [ "${dirOf sw.device}" ];
158211 unitConfig.DefaultDependencies = false; # needed to prevent a cycle
159212 serviceConfig.Type = "oneshot";
160160- serviceConfig.RemainAfterExit = sw.randomEncryption;
161161- serviceConfig.ExecStop = optionalString sw.randomEncryption "${pkgs.cryptsetup}/bin/cryptsetup luksClose ${sw.deviceName}";
213213+ serviceConfig.RemainAfterExit = sw.randomEncryption.enable;
214214+ serviceConfig.ExecStop = optionalString sw.randomEncryption.enable "${pkgs.cryptsetup}/bin/cryptsetup luksClose ${sw.deviceName}";
162215 restartIfChanged = false;
163216 };
164217165165- in listToAttrs (map createSwapDevice (filter (sw: sw.size != null || sw.randomEncryption) config.swapDevices));
218218+ in listToAttrs (map createSwapDevice (filter (sw: sw.size != null || sw.randomEncryption.enable) config.swapDevices));
166219167220 };
168221
···243243 preStart = ''
244244 if [ ! -d ${lib.escapeShellArg nodedir} ]; then
245245 mkdir -p /var/db/tahoe-lafs
246246- tahoe create-introducer "${lib.escapeShellArg nodedir}
246246+ tahoe create-introducer ${lib.escapeShellArg nodedir}
247247 fi
248248249249 # Tahoe has created a predefined tahoe.cfg which we must now
···648648649649 services.xserver.xkbDir = mkDefault "${pkgs.xkeyboard_config}/etc/X11/xkb";
650650651651- system.extraDependencies = singleton (pkgs.runCommand "xkb-layouts-exist" {
652652- inherit (cfg) layout xkbDir;
651651+ system.extraDependencies = singleton (pkgs.runCommand "xkb-validated" {
652652+ inherit (cfg) xkbModel layout xkbVariant xkbOptions;
653653+ nativeBuildInputs = [ pkgs.xkbvalidate ];
653654 } ''
654654- # We can use the default IFS here, because the layouts won't contain
655655- # spaces or tabs and are ruled out by the sed expression below.
656656- availableLayouts="$(
657657- sed -n -e ':i /^! \(layout\|variant\) *$/ {
658658- # Loop through all of the layouts/variants until we hit another ! at
659659- # the start of the line or the line is empty ('t' branches only if
660660- # the last substitution was successful, so if the line is empty the
661661- # substition will fail).
662662- :l; n; /^!/bi; s/^ *\([^ ]\+\).*/\1/p; tl
663663- }' "$xkbDir/rules/base.lst" | sort -u
664664- )"
665665-666666- layoutNotFound() {
667667- echo >&2
668668- echo "The following layouts and variants are available:" >&2
669669- echo >&2
670670-671671- # While an output width of 80 is more desirable for small terminals, we
672672- # really don't know the amount of columns of the terminal from within
673673- # the builder. The content in $availableLayouts however is pretty
674674- # large, so let's opt for a larger width here, because it will print a
675675- # smaller amount of lines on modern KMS/framebuffer terminals and won't
676676- # lose information even in smaller terminals (it only will look a bit
677677- # ugly).
678678- echo "$availableLayouts" | ${pkgs.utillinux}/bin/column -c 150 >&2
679679-680680- echo >&2
681681- echo "However, the keyboard layout definition in" \
682682- "\`services.xserver.layout' contains the layout \`$1', which" \
683683- "isn't a valid layout or variant." >&2
684684- echo >&2
685685- exit 1
686686- }
687687-688688- # Again, we don't need to take care of IFS, see the comment for
689689- # $availableLayouts.
690690- for l in ''${layout//,/ }; do
691691- if ! echo "$availableLayouts" | grep -qxF "$l"; then
692692- layoutNotFound "$l"
693693- fi
694694- done
695695-655655+ validate "$xkbModel" "$layout" "$xkbVariant" "$xkbOptions"
696656 touch "$out"
697657 '');
698658
···24242525 kernel = config.boot.kernelPackages;
26262727- packages = if config.boot.zfs.enableUnstable then {
2828- spl = kernel.splUnstable;
2929- zfs = kernel.zfsUnstable;
3030- zfsUser = pkgs.zfsUnstable;
3131- } else {
2727+ packages = {
3228 spl = kernel.spl;
3329 zfs = kernel.zfs;
3430 zfsUser = pkgs.zfs;
···62586359 options = {
6460 boot.zfs = {
6565- enableUnstable = mkOption {
6666- type = types.bool;
6767- default = false;
6868- description = ''
6969- Use the unstable zfs package. This might be an option, if the latest
7070- kernel is not yet supported by a published release of ZFS. Enabling
7171- this option will install a development version of ZFS on Linux. The
7272- version will have already passed an extensive test suite, but it is
7373- more likely to hit an undiscovered bug compared to running a released
7474- version of ZFS on Linux.
7575- '';
7676- };
7777-7861 extraPools = mkOption {
7962 type = types.listOf types.str;
8063 default = [];