···273273274274- `services.chronyd` is now started with additional systemd sandbox/hardening options for better security.
275275276276+- PostgreSQL has opt-in support for [JIT compilation](https://www.postgresql.org/docs/current/jit-reason.html). It can be enabled like this:
277277+ ```nix
278278+ {
279279+ services.postgresql = {
280280+ enable = true;
281281+ enableJIT = true;
282282+ };
283283+ }
284284+ ```
285285+276286- `services.dhcpcd` service now don't solicit or accept IPv6 Router Advertisements on interfaces that use static IPv6 addresses.
277287278288- The module `services.headscale` was refactored to be compliant with [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md). To be precise, this means that the following things have changed:
+37
nixos/modules/services/databases/postgresql.md
···171171 };
172172}
173173```
174174+175175+## JIT (Just-In-Time compilation) {#module-services-postgres-jit}
176176+177177+[JIT](https://www.postgresql.org/docs/current/jit-reason.html)-support in the PostgreSQL package
178178+is disabled by default because of the ~300MiB closure-size increase from the LLVM dependency. It
179179+can be optionally enabled in PostgreSQL with the following config option:
180180+181181+```nix
182182+{
183183+ services.postgresql.enableJIT = true;
184184+}
185185+```
186186+187187+This makes sure that the [`jit`](https://www.postgresql.org/docs/current/runtime-config-query.html#GUC-JIT)-setting
188188+is set to `on` and a PostgreSQL package with JIT enabled is used. Further tweaking of the JIT compiler, e.g. setting a different
189189+query cost threshold via [`jit_above_cost`](https://www.postgresql.org/docs/current/runtime-config-query.html#GUC-JIT-ABOVE-COST)
190190+can be done manually via [`services.postgresql.settings`](#opt-services.postgresql.settings).
191191+192192+The attribute-names of JIT-enabled PostgreSQL packages are suffixed with `_jit`, i.e. for each `pkgs.postgresql`
193193+(and `pkgs.postgresql_<major>`) in `nixpkgs` there's also a `pkgs.postgresql_jit` (and `pkgs.postgresql_<major>_jit`).
194194+Alternatively, a JIT-enabled variant can be derived from a given `postgresql` package via `postgresql.withJIT`.
195195+This is also useful if it's not clear which attribute from `nixpkgs` was originally used (e.g. when working with
196196+[`config.services.postgresql.package`](#opt-services.postgresql.package) or if the package was modified via an
197197+overlay) since all modifications are propagated to `withJIT`. I.e.
198198+199199+```nix
200200+with import <nixpkgs> {
201201+ overlays = [
202202+ (self: super: {
203203+ postgresql = super.postgresql.overrideAttrs (_: { pname = "foobar"; });
204204+ })
205205+ ];
206206+};
207207+postgresql.withJIT.pname
208208+```
209209+210210+evaluates to `"foobar"`.
+20-7
nixos/modules/services/databases/postgresql.nix
···77 cfg = config.services.postgresql;
8899 postgresql =
1010+ let
1111+ # ensure that
1212+ # services.postgresql = {
1313+ # enableJIT = true;
1414+ # package = pkgs.postgresql_<major>;
1515+ # };
1616+ # works.
1717+ base = if cfg.enableJIT && !cfg.package.jitSupport then cfg.package.withJIT else cfg.package;
1818+ in
1019 if cfg.extraPlugins == []
1111- then cfg.package
1212- else cfg.package.withPackages (_: cfg.extraPlugins);
2020+ then base
2121+ else base.withPackages (_: cfg.extraPlugins);
13221423 toStr = value:
1524 if true == value then "yes"
···4150 services.postgresql = {
42514352 enable = mkEnableOption (lib.mdDoc "PostgreSQL Server");
5353+5454+ enableJIT = mkEnableOption (lib.mdDoc "JIT support");
44554556 package = mkOption {
4657 type = types.package;
···435446 log_line_prefix = cfg.logLinePrefix;
436447 listen_addresses = if cfg.enableTCPIP then "*" else "localhost";
437448 port = cfg.port;
449449+ jit = mkDefault (if cfg.enableJIT then "on" else "off");
438450 };
439451440452 services.postgresql.package = let
441453 mkThrow = ver: throw "postgresql_${ver} was removed, please upgrade your postgresql version.";
454454+ base = if versionAtLeast config.system.stateVersion "22.05" then pkgs.postgresql_14
455455+ else if versionAtLeast config.system.stateVersion "21.11" then pkgs.postgresql_13
456456+ else if versionAtLeast config.system.stateVersion "20.03" then pkgs.postgresql_11
457457+ else if versionAtLeast config.system.stateVersion "17.09" then mkThrow "9_6"
458458+ else mkThrow "9_5";
442459 in
443460 # Note: when changing the default, make it conditional on
444461 # ‘system.stateVersion’ to maintain compatibility with existing
445462 # systems!
446446- mkDefault (if versionAtLeast config.system.stateVersion "22.05" then pkgs.postgresql_14
447447- else if versionAtLeast config.system.stateVersion "21.11" then pkgs.postgresql_13
448448- else if versionAtLeast config.system.stateVersion "20.03" then pkgs.postgresql_11
449449- else if versionAtLeast config.system.stateVersion "17.09" then mkThrow "9_6"
450450- else mkThrow "9_5");
463463+ mkDefault (if cfg.enableJIT then base.withJIT else base);
451464452465 services.postgresql.dataDir = mkDefault "/var/lib/postgresql/${cfg.package.psqlSchema}";
453466