···272272 </listitem>
273273 <listitem>
274274 <para>
275275+ <link xlink:href="https://www.ausweisapp.bund.de/">AusweisApp2</link>,
276276+ the authentication software for the German ID card. Available
277277+ as
278278+ <link linkend="opt-programs.ausweisapp.enable">programs.ausweisapp</link>.
279279+ </para>
280280+ </listitem>
281281+ <listitem>
282282+ <para>
275283 <link xlink:href="https://github.com/zalando/patroni">Patroni</link>,
276284 a template for PostgreSQL HA with ZooKeeper, etcd or Consul.
277285 Available as
+2
nixos/doc/manual/release-notes/rl-2211.section.md
···96969797- [Grafana Tempo](https://www.grafana.com/oss/tempo/), a distributed tracing store. Available as [services.tempo](#opt-services.tempo.enable).
98989999+- [AusweisApp2](https://www.ausweisapp.bund.de/), the authentication software for the German ID card. Available as [programs.ausweisapp](#opt-programs.ausweisapp.enable).
100100+99101- [Patroni](https://github.com/zalando/patroni), a template for PostgreSQL HA with ZooKeeper, etcd or Consul.
100102Available as [services.patroni](options.html#opt-services.patroni.enable).
101103
···11+{ lib, stdenv, fetchzip }:
22+33+stdenv.mkDerivation rec {
44+ pname = "gatk";
55+ version = "4.2.6.1";
66+ src = fetchzip {
77+ url = "https://github.com/broadinstitute/gatk/releases/download/${version}/gatk-${version}.zip";
88+ sha256 = "0hjlsl7fxf3ankyjidqhwxc70gjh6z4lnjzw6b5fldzb0qvgfvy8";
99+ };
1010+1111+ installPhase = ''
1212+ mkdir -p $out/bin
1313+ install -m755 -D $src/gatk $out/bin/
1414+ install -m755 -D $src/gatk-package-${version}-local.jar $out/bin/
1515+ '';
1616+1717+ meta = with lib; {
1818+ homepage = "https://gatk.broadinstitute.org/hc/en-us";
1919+ description = "A wide variety of tools with a primary focus on variant discovery and genotyping." ;
2020+ license = licenses.asl20;
2121+ sourceProvenance = with lib.sourceTypes; [ binaryBytecode ] ;
2222+ maintainers = with maintainers; [ apraga ];
2323+ longDescription = ''
2424+ The GATK is the industry standard for identifying SNPs and indels in germline
2525+ DNA and RNAseq data. Its scope is now expanding to include somatic short variant
2626+ calling, and to tackle copy number (CNV) and structural variation (SV). In
2727+ addition to the variant callers themselves, the GATK also includes many
2828+ utilities to perform related tasks such as processing and quality control of
2929+ high-throughput sequencing data, and bundles the popular Picard toolkit.
3030+3131+ These tools were primarily designed to process exomes and whole genomes
3232+ generated with Illumina sequencing technology, but they can be adapted to handle
3333+ a variety of other technologies and experimental designs. And although it was
3434+ originally developed for human genetics, the GATK has since evolved to handle
3535+ genome data from any organism, with any level of ploidy.
3636+ '';
3737+ };
3838+}
···11+From 045f33745f863ba20acfc3fe335c575d9cd87884 Mon Sep 17 00:00:00 2001
22+From: Maximilian Bosch <maximilian@mbosch.me>
33+Date: Sat, 10 Sep 2022 15:18:05 +0200
44+Subject: [PATCH] Setup: remove custom dbuser creation behavior
55+66+Both PostgreSQL and MySQL can be authenticated against from Nextcloud by
77+supplying a database password. Now, during setup the following things
88+happen:
99+1010+* When using postgres and the db user has elevated permissions, a new
1111+ unprivileged db user is created and the settings `dbuser`/`dbpass` are
1212+ altered in `config.php`.
1313+1414+* When using MySQL, the password is **always** regenerated since
1515+ 24.0.5/23.0.9[1].
1616+1717+I consider both cases problematic: the reason why people do configuration
1818+management is to have it as single source of truth! So, IMHO any
1919+application that silently alters config and thus causes deployed
2020+nodes to diverge from the configuration is harmful for that.
2121+2222+I guess it was sheer luck that it worked for so long in NixOS because
2323+nobody has apparently used password authentication with a privileged
2424+user to operate Nextcloud (which is a good thing in fact).
2525+2626+[1] https://github.com/nextcloud/server/pull/33513
2727+---
2828+ lib/private/Setup/MySQL.php | 53 --------------------------------
2929+ lib/private/Setup/PostgreSQL.php | 26 ----------------
3030+ 2 files changed, 79 deletions(-)
3131+3232+diff --git a/lib/private/Setup/MySQL.php b/lib/private/Setup/MySQL.php
3333+index 2c16cac3d2..9b2265091f 100644
3434+--- a/lib/private/Setup/MySQL.php
3535++++ b/lib/private/Setup/MySQL.php
3636+@@ -142,59 +142,6 @@ class MySQL extends AbstractDatabase {
3737+ $rootUser = $this->dbUser;
3838+ $rootPassword = $this->dbPassword;
3939+4040+- //create a random password so we don't need to store the admin password in the config file
4141+- $saveSymbols = str_replace(['\"', '\\', '\'', '`'], '', ISecureRandom::CHAR_SYMBOLS);
4242+- $password = $this->random->generate(22, ISecureRandom::CHAR_ALPHANUMERIC . $saveSymbols)
4343+- . $this->random->generate(2, ISecureRandom::CHAR_UPPER)
4444+- . $this->random->generate(2, ISecureRandom::CHAR_LOWER)
4545+- . $this->random->generate(2, ISecureRandom::CHAR_DIGITS)
4646+- . $this->random->generate(2, $saveSymbols)
4747+- ;
4848+- $this->dbPassword = str_shuffle($password);
4949+-
5050+- try {
5151+- //user already specified in config
5252+- $oldUser = $this->config->getValue('dbuser', false);
5353+-
5454+- //we don't have a dbuser specified in config
5555+- if ($this->dbUser !== $oldUser) {
5656+- //add prefix to the admin username to prevent collisions
5757+- $adminUser = substr('oc_' . $username, 0, 16);
5858+-
5959+- $i = 1;
6060+- while (true) {
6161+- //this should be enough to check for admin rights in mysql
6262+- $query = 'SELECT user FROM mysql.user WHERE user=?';
6363+- $result = $connection->executeQuery($query, [$adminUser]);
6464+-
6565+- //current dbuser has admin rights
6666+- $data = $result->fetchAll();
6767+- $result->closeCursor();
6868+- //new dbuser does not exist
6969+- if (count($data) === 0) {
7070+- //use the admin login data for the new database user
7171+- $this->dbUser = $adminUser;
7272+- $this->createDBUser($connection);
7373+-
7474+- break;
7575+- } else {
7676+- //repeat with different username
7777+- $length = strlen((string)$i);
7878+- $adminUser = substr('oc_' . $username, 0, 16 - $length) . $i;
7979+- $i++;
8080+- }
8181+- }
8282+- }
8383+- } catch (\Exception $ex) {
8484+- $this->logger->info('Can not create a new MySQL user, will continue with the provided user.', [
8585+- 'exception' => $ex,
8686+- 'app' => 'mysql.setup',
8787+- ]);
8888+- // Restore the original credentials
8989+- $this->dbUser = $rootUser;
9090+- $this->dbPassword = $rootPassword;
9191+- }
9292+-
9393+ $this->config->setValues([
9494+ 'dbuser' => $this->dbUser,
9595+ 'dbpassword' => $this->dbPassword,
9696+diff --git a/lib/private/Setup/PostgreSQL.php b/lib/private/Setup/PostgreSQL.php
9797+index bc24909dc3..e49e5508e1 100644
9898+--- a/lib/private/Setup/PostgreSQL.php
9999++++ b/lib/private/Setup/PostgreSQL.php
100100+@@ -45,32 +45,6 @@ class PostgreSQL extends AbstractDatabase {
101101+ $connection = $this->connect([
102102+ 'dbname' => 'postgres'
103103+ ]);
104104+- //check for roles creation rights in postgresql
105105+- $builder = $connection->getQueryBuilder();
106106+- $builder->automaticTablePrefix(false);
107107+- $query = $builder
108108+- ->select('rolname')
109109+- ->from('pg_roles')
110110+- ->where($builder->expr()->eq('rolcreaterole', new Literal('TRUE')))
111111+- ->andWhere($builder->expr()->eq('rolname', $builder->createNamedParameter($this->dbUser)));
112112+-
113113+- try {
114114+- $result = $query->execute();
115115+- $canCreateRoles = $result->rowCount() > 0;
116116+- } catch (DatabaseException $e) {
117117+- $canCreateRoles = false;
118118+- }
119119+-
120120+- if ($canCreateRoles) {
121121+- //use the admin login data for the new database user
122122+-
123123+- //add prefix to the postgresql user name to prevent collisions
124124+- $this->dbUser = 'oc_' . strtolower($username);
125125+- //create a new password so we don't need to store the admin config in the config file
126126+- $this->dbPassword = \OC::$server->getSecureRandom()->generate(30, ISecureRandom::CHAR_ALPHANUMERIC);
127127+-
128128+- $this->createDBUser($connection);
129129+- }
130130+131131+ $this->config->setValues([
132132+ 'dbuser' => $this->dbUser,
133133+--
134134+2.36.2
135135+