···377377378378- [Nginx virtual hosts](#opt-services.nginx.virtualHosts) using `forceSSL` or
379379 `globalRedirect` can now have redirect codes other than 301 through
380380+381381+- `bacula` now allows to configure `TLS` for encrypted communication.
382382+380383 `redirectCode`.
381384382385- `libjxl` 0.9.0 [dropped support for the butteraugli API](https://github.com/libjxl/libjxl/pull/2576). You will no longer be able to set `enableButteraugli` on `libaom`.
+186-36
nixos/modules/services/backup/bacula.nix
···44# TODO: test configuration when building nixexpr (use -t parameter)
55# TODO: support sqlite3 (it's deprecate?) and mysql
6677-with lib;
8798let
99+ inherit (lib)
1010+ concatStringsSep
1111+ literalExpression
1212+ mapAttrsToList
1313+ mdDoc
1414+ mkIf
1515+ mkOption
1616+ optional
1717+ optionalString
1818+ types
1919+ ;
1020 libDir = "/var/lib/bacula";
11212222+ yes_no = bool: if bool then "yes" else "no";
2323+ tls_conf = tls_cfg: optionalString tls_cfg.enable (
2424+ concatStringsSep
2525+ "\n"
2626+ (
2727+ ["TLS Enable = yes;"]
2828+ ++ optional (tls_cfg.require != null) "TLS Require = ${yes_no tls_cfg.require};"
2929+ ++ optional (tls_cfg.certificate != null) ''TLS Certificate = "${tls_cfg.certificate}";''
3030+ ++ [''TLS Key = "${tls_cfg.key}";'']
3131+ ++ optional (tls_cfg.verifyPeer != null) "TLS Verify Peer = ${yes_no tls_cfg.verifyPeer};"
3232+ ++ optional (tls_cfg.allowedCN != [ ]) "TLS Allowed CN = ${concatStringsSep " " (tls_cfg.allowedCN)};"
3333+ ++ optional (tls_cfg.caCertificateFile != null) ''TLS CA Certificate File = "${tls_cfg.caCertificateFile}";''
3434+ )
3535+ );
3636+1237 fd_cfg = config.services.bacula-fd;
1338 fd_conf = pkgs.writeText "bacula-fd.conf"
1439 ''
···1843 WorkingDirectory = ${libDir};
1944 Pid Directory = /run;
2045 ${fd_cfg.extraClientConfig}
4646+ ${tls_conf fd_cfg.tls}
2147 }
22482349 ${concatStringsSep "\n" (mapAttrsToList (name: value: ''
···2551 Name = "${name}";
2652 Password = ${value.password};
2753 Monitor = ${value.monitor};
5454+ ${tls_conf value.tls}
2855 }
2956 '') fd_cfg.director)}
3057···4471 WorkingDirectory = ${libDir};
4572 Pid Directory = /run;
4673 ${sd_cfg.extraStorageConfig}
7474+ ${tls_conf sd_cfg.tls}
4775 }
48764977 ${concatStringsSep "\n" (mapAttrsToList (name: value: ''
···7098 Name = "${name}";
7199 Password = ${value.password};
72100 Monitor = ${value.monitor};
101101+ ${tls_conf value.tls}
73102 }
74103 '') sd_cfg.director)}
75104···90119 Working Directory = ${libDir};
91120 Pid Directory = /run/;
92121 QueryFile = ${pkgs.bacula}/etc/query.sql;
122122+ ${tls_conf dir_cfg.tls}
93123 ${dir_cfg.extraDirectorConfig}
94124 }
95125···108138 ${dir_cfg.extraConfig}
109139 '';
110140111111- directorOptions = {...}:
141141+ linkOption = name: destination: "[${name}](#opt-${builtins.replaceStrings [ "<" ">"] ["_" "_"] destination})";
142142+ tlsLink = destination: submodulePath: linkOption "${submodulePath}.${destination}" "${submodulePath}.${destination}";
143143+144144+ tlsOptions = submodulePath: {...}:
145145+ {
146146+ options = {
147147+ enable = mkOption {
148148+ type = types.bool;
149149+ default = false;
150150+ description = mdDoc ''
151151+ Specifies if TLS should be enabled.
152152+ If this set to `false` TLS will be completely disabled, even if ${tlsLink "tls.require" submodulePath} is true.
153153+ '';
154154+ };
155155+ require = mkOption {
156156+ type = types.nullOr types.bool;
157157+ default = null;
158158+ description = mdDoc ''
159159+ Require TLS or TLS-PSK encryption.
160160+ This directive is ignored unless one of ${tlsLink "tls.enable" submodulePath} is true or TLS PSK Enable is set to `yes`.
161161+ If TLS is not required while TLS or TLS-PSK are enabled, then the Bacula component
162162+ will connect with other components either with or without TLS or TLS-PSK
163163+164164+ If ${tlsLink "tls.enable" submodulePath} or TLS-PSK is enabled and TLS is required, then the Bacula
165165+ component will refuse any connection request that does not use TLS.
166166+ '';
167167+ };
168168+ certificate = mkOption {
169169+ type = types.nullOr types.path;
170170+ default = null;
171171+ description = mdDoc ''
172172+ The full path to the PEM encoded TLS certificate.
173173+ It will be used as either a client or server certificate,
174174+ depending on the connection direction.
175175+ This directive is required in a server context, but it may
176176+ not be specified in a client context if ${tlsLink "tls.verifyPeer" submodulePath} is
177177+ `false` in the corresponding server context.
178178+ '';
179179+ };
180180+ key = mkOption {
181181+ type = types.path;
182182+ description = mdDoc ''
183183+ The path of a PEM encoded TLS private key.
184184+ It must correspond to the TLS certificate.
185185+ '';
186186+ };
187187+ verifyPeer = mkOption {
188188+ type = types.nullOr types.bool;
189189+ default = null;
190190+ description = mdDoc ''
191191+ Verify peer certificate.
192192+ Instructs server to request and verify the client's X.509 certificate.
193193+ Any client certificate signed by a known-CA will be accepted.
194194+ Additionally, the client's X509 certificate Common Name must meet the value of the Address directive.
195195+ If ${tlsLink "tls.allowedCN" submodulePath} is used,
196196+ the client's x509 certificate Common Name must also correspond to
197197+ one of the CN specified in the ${tlsLink "tls.allowedCN" submodulePath} directive.
198198+ This directive is valid only for a server and not in client context.
199199+200200+ Standard from Bacula is `true`.
201201+ '';
202202+ };
203203+ allowedCN = mkOption {
204204+ type = types.listOf types.str;
205205+ default = [ ];
206206+ description = mdDoc ''
207207+ Common name attribute of allowed peer certificates.
208208+ This directive is valid for a server and in a client context.
209209+ If this directive is specified, the peer certificate will be verified against this list.
210210+ In the case this directive is configured on a server side, the allowed
211211+ CN list will not be checked if ${tlsLink "tls.verifyPeer" submodulePath} is false.
212212+ '';
213213+ };
214214+ caCertificateFile = mkOption {
215215+ type = types.nullOr types.path;
216216+ default = null;
217217+ description = mdDoc ''
218218+ The path specifying a PEM encoded TLS CA certificate(s).
219219+ Multiple certificates are permitted in the file.
220220+ One of TLS CA Certificate File or TLS CA Certificate Dir are required in a server context, unless
221221+ ${tlsLink "tls.verifyPeer" submodulePath} is false, and are always required in a client context.
222222+ '';
223223+ };
224224+ };
225225+ };
226226+227227+ directorOptions = submodulePath:{...}:
112228 {
113229 options = {
114230 password = mkOption {
115231 type = types.str;
116232 # TODO: required?
117117- description = lib.mdDoc ''
233233+ description = mdDoc ''
118234 Specifies the password that must be supplied for the default Bacula
119235 Console to be authorized. The same password must appear in the
120236 Director resource of the Console configuration file. For added
···135251 type = types.enum [ "no" "yes" ];
136252 default = "no";
137253 example = "yes";
138138- description = lib.mdDoc ''
254254+ description = mdDoc ''
139255 If Monitor is set to `no`, this director will have
140256 full access to this Storage daemon. If Monitor is set to
141257 `yes`, this director will only be able to fetch the
···146262 security problems.
147263 '';
148264 };
265265+266266+ tls = mkOption {
267267+ type = types.submodule (tlsOptions "${submodulePath}.director.<name>");
268268+ description = mdDoc ''
269269+ TLS Options for the Director in this Configuration.
270270+ '';
271271+ };
149272 };
150273 };
151274···154277 options = {
155278 changerDevice = mkOption {
156279 type = types.str;
157157- description = lib.mdDoc ''
280280+ description = mdDoc ''
158281 The specified name-string must be the generic SCSI device name of the
159282 autochanger that corresponds to the normal read/write Archive Device
160283 specified in the Device resource. This generic SCSI device name
···173296174297 changerCommand = mkOption {
175298 type = types.str;
176176- description = lib.mdDoc ''
299299+ description = mdDoc ''
177300 The name-string specifies an external program to be called that will
178301 automatically change volumes as required by Bacula. Normally, this
179302 directive will be specified only in the AutoChanger resource, which
···195318 };
196319197320 devices = mkOption {
198198- description = lib.mdDoc "";
321321+ description = mdDoc "";
199322 type = types.listOf types.str;
200323 };
201324202325 extraAutochangerConfig = mkOption {
203326 default = "";
204327 type = types.lines;
205205- description = lib.mdDoc ''
328328+ description = mdDoc ''
206329 Extra configuration to be passed in Autochanger directive.
207330 '';
208331 example = ''
···219342 archiveDevice = mkOption {
220343 # TODO: required?
221344 type = types.str;
222222- description = lib.mdDoc ''
345345+ description = mdDoc ''
223346 The specified name-string gives the system file name of the storage
224347 device managed by this storage daemon. This will usually be the
225348 device file name of a removable storage device (tape drive), for
···236359 mediaType = mkOption {
237360 # TODO: required?
238361 type = types.str;
239239- description = lib.mdDoc ''
362362+ description = mdDoc ''
240363 The specified name-string names the type of media supported by this
241364 device, for example, `DLT7000`. Media type names are
242365 arbitrary in that you set them to anything you want, but they must be
···274397 extraDeviceConfig = mkOption {
275398 default = "";
276399 type = types.lines;
277277- description = lib.mdDoc ''
400400+ description = mdDoc ''
278401 Extra configuration to be passed in Device directive.
279402 '';
280403 example = ''
···295418 enable = mkOption {
296419 type = types.bool;
297420 default = false;
298298- description = lib.mdDoc ''
421421+ description = mdDoc ''
299422 Whether to enable the Bacula File Daemon.
300423 '';
301424 };
···304427 default = "${config.networking.hostName}-fd";
305428 defaultText = literalExpression ''"''${config.networking.hostName}-fd"'';
306429 type = types.str;
307307- description = lib.mdDoc ''
430430+ description = mdDoc ''
308431 The client name that must be used by the Director when connecting.
309432 Generally, it is a good idea to use a name related to the machine so
310433 that error messages can be easily identified if you have multiple
···315438 port = mkOption {
316439 default = 9102;
317440 type = types.port;
318318- description = lib.mdDoc ''
441441+ description = mdDoc ''
319442 This specifies the port number on which the Client listens for
320443 Director connections. It must agree with the FDPort specified in
321444 the Client resource of the Director's configuration file.
···324447325448 director = mkOption {
326449 default = {};
327327- description = lib.mdDoc ''
450450+ description = mdDoc ''
328451 This option defines director resources in Bacula File Daemon.
329452 '';
330330- type = with types; attrsOf (submodule directorOptions);
453453+ type = types.attrsOf (types.submodule (directorOptions "services.bacula-fd"));
331454 };
332455456456+457457+ tls = mkOption {
458458+ type = types.submodule (tlsOptions "services.bacula-fd");
459459+ default = { };
460460+ description = mdDoc ''
461461+ TLS Options for the File Daemon.
462462+ Important notice: The backup won't be encrypted.
463463+ '';
464464+ };
465465+333466 extraClientConfig = mkOption {
334467 default = "";
335468 type = types.lines;
336336- description = lib.mdDoc ''
469469+ description = mdDoc ''
337470 Extra configuration to be passed in Client directive.
338471 '';
339472 example = ''
···345478 extraMessagesConfig = mkOption {
346479 default = "";
347480 type = types.lines;
348348- description = lib.mdDoc ''
481481+ description = mdDoc ''
349482 Extra configuration to be passed in Messages directive.
350483 '';
351484 example = ''
···358491 enable = mkOption {
359492 type = types.bool;
360493 default = false;
361361- description = lib.mdDoc ''
494494+ description = mdDoc ''
362495 Whether to enable Bacula Storage Daemon.
363496 '';
364497 };
···367500 default = "${config.networking.hostName}-sd";
368501 defaultText = literalExpression ''"''${config.networking.hostName}-sd"'';
369502 type = types.str;
370370- description = lib.mdDoc ''
503503+ description = mdDoc ''
371504 Specifies the Name of the Storage daemon.
372505 '';
373506 };
···375508 port = mkOption {
376509 default = 9103;
377510 type = types.port;
378378- description = lib.mdDoc ''
511511+ description = mdDoc ''
379512 Specifies port number on which the Storage daemon listens for
380513 Director connections.
381514 '';
···383516384517 director = mkOption {
385518 default = {};
386386- description = lib.mdDoc ''
519519+ description = mdDoc ''
387520 This option defines Director resources in Bacula Storage Daemon.
388521 '';
389389- type = with types; attrsOf (submodule directorOptions);
522522+ type = types.attrsOf (types.submodule (directorOptions "services.bacula-sd"));
390523 };
391524392525 device = mkOption {
393526 default = {};
394394- description = lib.mdDoc ''
527527+ description = mdDoc ''
395528 This option defines Device resources in Bacula Storage Daemon.
396529 '';
397397- type = with types; attrsOf (submodule deviceOptions);
530530+ type = types.attrsOf (types.submodule deviceOptions);
398531 };
399532400533 autochanger = mkOption {
401534 default = {};
402402- description = lib.mdDoc ''
535535+ description = mdDoc ''
403536 This option defines Autochanger resources in Bacula Storage Daemon.
404537 '';
405405- type = with types; attrsOf (submodule autochangerOptions);
538538+ type = types.attrsOf (types.submodule autochangerOptions);
406539 };
407540408541 extraStorageConfig = mkOption {
409542 default = "";
410543 type = types.lines;
411411- description = lib.mdDoc ''
544544+ description = mdDoc ''
412545 Extra configuration to be passed in Storage directive.
413546 '';
414547 example = ''
···420553 extraMessagesConfig = mkOption {
421554 default = "";
422555 type = types.lines;
423423- description = lib.mdDoc ''
556556+ description = mdDoc ''
424557 Extra configuration to be passed in Messages directive.
425558 '';
426559 example = ''
427560 console = all
428561 '';
429562 };
563563+ tls = mkOption {
564564+ type = types.submodule (tlsOptions "services.bacula-sd");
565565+ default = { };
566566+ description = mdDoc ''
567567+ TLS Options for the Storage Daemon.
568568+ Important notice: The backup won't be encrypted.
569569+ '';
570570+ };
430571431572 };
432573···434575 enable = mkOption {
435576 type = types.bool;
436577 default = false;
437437- description = lib.mdDoc ''
578578+ description = mdDoc ''
438579 Whether to enable Bacula Director Daemon.
439580 '';
440581 };
···443584 default = "${config.networking.hostName}-dir";
444585 defaultText = literalExpression ''"''${config.networking.hostName}-dir"'';
445586 type = types.str;
446446- description = lib.mdDoc ''
587587+ description = mdDoc ''
447588 The director name used by the system administrator. This directive is
448589 required.
449590 '';
···452593 port = mkOption {
453594 default = 9101;
454595 type = types.port;
455455- description = lib.mdDoc ''
596596+ description = mdDoc ''
456597 Specify the port (a positive integer) on which the Director daemon
457598 will listen for Bacula Console connections. This same port number
458599 must be specified in the Director resource of the Console
···465606 password = mkOption {
466607 # TODO: required?
467608 type = types.str;
468468- description = lib.mdDoc ''
609609+ description = mdDoc ''
469610 Specifies the password that must be supplied for a Director.
470611 '';
471612 };
···473614 extraMessagesConfig = mkOption {
474615 default = "";
475616 type = types.lines;
476476- description = lib.mdDoc ''
617617+ description = mdDoc ''
477618 Extra configuration to be passed in Messages directive.
478619 '';
479620 example = ''
···484625 extraDirectorConfig = mkOption {
485626 default = "";
486627 type = types.lines;
487487- description = lib.mdDoc ''
628628+ description = mdDoc ''
488629 Extra configuration to be passed in Director directive.
489630 '';
490631 example = ''
···496637 extraConfig = mkOption {
497638 default = "";
498639 type = types.lines;
499499- description = lib.mdDoc ''
640640+ description = mdDoc ''
500641 Extra configuration for Bacula Director Daemon.
501642 '';
502643 example = ''
503644 TODO
504645 '';
505646 };
647647+648648+ tls = mkOption {
649649+ type = types.submodule (tlsOptions "services.bacula-dir");
650650+ default = { };
651651+ description = mdDoc ''
652652+ TLS Options for the Director.
653653+ Important notice: The backup won't be encrypted.
654654+ '';
655655+ };
506656 };
507657 };
508658
···11-diff --git a/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java b/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java
22-index 6fff2af..7e2877e 100644
33---- a/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java
44-+++ b/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java
55-@@ -47,6 +47,16 @@ public final class PosixLocalEnvProvider implements LocalEnvProvider {
66- Map<String, String> env, BinTools binTools, String fallbackTmpDir) {
77- ImmutableMap.Builder<String, String> result = ImmutableMap.builder();
88- result.putAll(Maps.filterKeys(env, k -> !k.equals("TMPDIR")));
99-+
1010-+ // In case we are running on NixOS.
1111-+ // If bash is called with an unset PATH on this platform,
1212-+ // it will set it to /no-such-path and default tools will be missings.
1313-+ // See, https://github.com/NixOS/nixpkgs/issues/94222
1414-+ // So we ensure that minimal dependencies are present.
1515-+ if (!env.containsKey("PATH")){
1616-+ result.put("PATH", "@actionsPathPatch@");
1717-+ }
1818-+
1919- String p = clientEnv.get("TMPDIR");
2020- if (Strings.isNullOrEmpty(p)) {
2121- // Do not use `fallbackTmpDir`, use `/tmp` instead. This way if the user didn't export TMPDIR
2222-index 95642767c6..39d3c62461 100644
2323---- a/src/main/java/com/google/devtools/build/lib/exec/local/XcodeLocalEnvProvider.java
2424-+++ b/src/main/java/com/google/devtools/build/lib/exec/local/XcodeLocalEnvProvider.java
2525-@@ -74,6 +74,16 @@ public final class XcodeLocalEnvProvider implements LocalEnvProvider {
2626-2727- ImmutableMap.Builder<String, String> newEnvBuilder = ImmutableMap.builder();
2828- newEnvBuilder.putAll(Maps.filterKeys(env, k -> !k.equals("TMPDIR")));
2929-+
3030-+ // In case we are running on NixOS.
3131-+ // If bash is called with an unset PATH on this platform,
3232-+ // it will set it to /no-such-path and default tools will be missings.
3333-+ // See, https://github.com/NixOS/nixpkgs/issues/94222
3434-+ // So we ensure that minimal dependencies are present.
3535-+ if (!env.containsKey("PATH")){
3636-+ newEnvBuilder.put("PATH", "@actionsPathPatch@");
3737-+ }
3838-+
3939- String p = clientEnv.get("TMPDIR");
4040- if (Strings.isNullOrEmpty(p)) {
4141- // Do not use `fallbackTmpDir`, use `/tmp` instead. This way if the user didn't export TMPDIR
···11-#!/usr/bin/env python3
22-import sys
33-import json
44-55-if len(sys.argv) != 2:
66- print("usage: ./this-script src-deps.json < WORKSPACE", file=sys.stderr)
77- print("Takes the bazel WORKSPACE file and reads all archives into a json dict (by evaling it as python code)", file=sys.stderr)
88- print("Hail Eris.", file=sys.stderr)
99- sys.exit(1)
1010-1111-http_archives = []
1212-1313-# just the kw args are the dict { name, sha256, urls … }
1414-def http_archive(**kw):
1515- http_archives.append(kw)
1616-# like http_file
1717-def http_file(**kw):
1818- http_archives.append(kw)
1919-2020-# this is inverted from http_archive/http_file and bundles multiple archives
2121-def distdir_tar(**kw):
2222- for archive_name in kw['archives']:
2323- http_archives.append({
2424- "name": archive_name,
2525- "sha256": kw['sha256'][archive_name],
2626- "urls": kw['urls'][archive_name]
2727- })
2828-2929-# TODO?
3030-def git_repository(**kw):
3131- print(json.dumps(kw, sort_keys=True, indent=4), file=sys.stderr)
3232- sys.exit(1)
3333-3434-# execute the WORKSPACE like it was python code in this module,
3535-# using all the function stubs from above.
3636-exec(sys.stdin.read())
3737-3838-# transform to a dict with the names as keys
3939-d = { el['name']: el for el in http_archives }
4040-4141-def has_urls(el):
4242- return ('url' in el and el['url']) or ('urls' in el and el['urls'])
4343-def has_sha256(el):
4444- return 'sha256' in el and el['sha256']
4545-bad_archives = list(filter(lambda el: not has_urls(el) or not has_sha256(el), d.values()))
4646-if bad_archives:
4747- print('Following bazel dependencies are missing url or sha256', file=sys.stderr)
4848- print('Check bazel sources for master or non-checksummed dependencies', file=sys.stderr)
4949- for el in bad_archives:
5050- print(json.dumps(el, sort_keys=True, indent=4), file=sys.stderr)
5151- sys.exit(1)
5252-5353-with open(sys.argv[1], "w") as f:
5454- print(json.dumps(d, sort_keys=True, indent=4), file=f)
···22, buildPythonPackage
33, fetchPypi
44, brotli
55+, hatchling
56, certifi
67, ffmpeg
78, rtmpdump
···910, pycryptodomex
1011, websockets
1112, mutagen
1313+, requests
1214, secretstorage
1515+, urllib3
1316, atomicparsleySupport ? true
1417, ffmpegSupport ? true
1518, rtmpSupport ? true
···2225 # The websites yt-dlp deals with are a very moving target. That means that
2326 # downloads break constantly. Because of that, updates should always be backported
2427 # to the latest stable release.
2525- version = "2023.12.30";
2828+ version = "2024.3.10";
2929+ pyproject = true;
26302731 src = fetchPypi {
2828- inherit pname version;
2929- hash = "sha256-oRhi5XchsKDwiD3+taTXm6ITotTEXhiA6f1w+OZXDDg=";
3232+ inherit version;
3333+ pname = "yt_dlp";
3434+ hash = "sha256-bnTLFKadvrhyyO9OC4u+0u6EbsYzUTzzEkp0wfrtwHs=";
3035 };
3636+3737+ nativeBuildInputs = [
3838+ hatchling
3939+ ];
31403241 propagatedBuildInputs = [
3342 brotli
3443 certifi
3544 mutagen
3645 pycryptodomex
4646+ requests
3747 secretstorage # "optional", as in not in requirements.txt, needed for `--cookies-from-browser`
4848+ urllib3
3849 websockets
3950 ];
4051···4859 ++ lib.optional atomicparsleySupport atomicparsley
4960 ++ lib.optional ffmpegSupport ffmpeg
5061 ++ lib.optional rtmpSupport rtmpdump;
5151- in lib.optionalString (packagesToBinPath != [])
6262+ in lib.optionals (packagesToBinPath != [])
5263 [ ''--prefix PATH : "${lib.makeBinPath packagesToBinPath}"'' ];
53645465 setupPyBuildFlags = [
+1
pkgs/top-level/aliases.nix
···9797 bashInteractive_5 = bashInteractive; # Added 2021-08-20
9898 bash_5 = bash; # Added 2021-08-20
9999 bazel_3 = throw "bazel 3 is past end of life as it is not an lts version"; # Added 2023-02-02
100100+ bazel_4 = throw "'bazel_4' has been removed from nixpkgs as it has reached end of life"; # Added 2024-01-23
100101 bedup = throw "bedup was removed because it was broken and abandoned upstream"; # added 2023-02-04
101102 bee-unstable = throw "bee-unstable has been removed, use 'bee' instead"; # Added 2024-02-12
102103 bee-clef = throw "bee-clef has been removed as the upstream project was archived"; # Added 2024-02-12