···113113 , # Description of the type, defined recursively by embedding the wrapped type if any.
114114 description ? null
115115 # A hint for whether or not this description needs parentheses. Possible values:
116116- # - "noun": a simple noun phrase such as "positive integer"
117117- # - "conjunction": a phrase with a potentially ambiguous "or" connective.
116116+ # - "noun": a noun phrase
117117+ # Example description: "positive integer",
118118+ # - "conjunction": a phrase with a potentially ambiguous "or" connective
119119+ # Example description: "int or string"
118120 # - "composite": a phrase with an "of" connective
121121+ # Example description: "list of string"
122122+ # - "nonRestrictiveClause": a noun followed by a comma and a clause
123123+ # Example description: "positive integer, meaning >0"
119124 # See the `optionDescriptionPhrase` function.
120125 , descriptionClass ? null
121126 , # DO NOT USE WITHOUT KNOWING WHAT YOU ARE DOING!
···338343 unsigned = addCheck types.int (x: x >= 0) // {
339344 name = "unsignedInt";
340345 description = "unsigned integer, meaning >=0";
346346+ descriptionClass = "nonRestrictiveClause";
341347 };
342348 positive = addCheck types.int (x: x > 0) // {
343349 name = "positiveInt";
344350 description = "positive integer, meaning >0";
351351+ descriptionClass = "nonRestrictiveClause";
345352 };
346353 u8 = unsign 8 256;
347354 u16 = unsign 16 65536;
···383390 nonnegative = addCheck number (x: x >= 0) // {
384391 name = "numberNonnegative";
385392 description = "nonnegative integer or floating point number, meaning >=0";
393393+ descriptionClass = "nonRestrictiveClause";
386394 };
387395 positive = addCheck number (x: x > 0) // {
388396 name = "numberPositive";
389397 description = "positive integer or floating point number, meaning >0";
398398+ descriptionClass = "nonRestrictiveClause";
390399 };
391400 };
392401···463472 passwdEntry = entryType: addCheck entryType (str: !(hasInfix ":" str || hasInfix "\n" str)) // {
464473 name = "passwdEntry ${entryType.name}";
465474 description = "${optionDescriptionPhrase (class: class == "noun") entryType}, not containing newlines or colons";
475475+ descriptionClass = "nonRestrictiveClause";
466476 };
467477468478 attrs = mkOptionType {
···870880 # Either value of type `t1` or `t2`.
871881 either = t1: t2: mkOptionType rec {
872882 name = "either";
873873- description = "${optionDescriptionPhrase (class: class == "noun" || class == "conjunction") t1} or ${optionDescriptionPhrase (class: class == "noun" || class == "conjunction" || class == "composite") t2}";
883883+ description =
884884+ if t1.descriptionClass or null == "nonRestrictiveClause"
885885+ then
886886+ # Plain, but add comma
887887+ "${t1.description}, or ${optionDescriptionPhrase (class: class == "noun" || class == "conjunction") t2}"
888888+ else
889889+ "${optionDescriptionPhrase (class: class == "noun" || class == "conjunction") t1} or ${optionDescriptionPhrase (class: class == "noun" || class == "conjunction" || class == "composite") t2}";
874890 descriptionClass = "conjunction";
875891 check = x: t1.check x || t2.check x;
876892 merge = loc: defs:
···30303131- [rspamd-trainer](https://gitlab.com/onlime/rspamd-trainer), script triggered by a helper which reads mails from a specific mail inbox and feeds them into rspamd for spam/ham training.
32323333+- [ollama](https://ollama.ai), server for running large language models locally.
3434+3335- [Anki Sync Server](https://docs.ankiweb.net/sync-server.html), the official sync server built into recent versions of Anki. Available as [services.anki-sync-server](#opt-services.anki-sync-server.enable).
3436The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the anki-sync-server softwares.
3537···76787779 `CONFIG_FILE_NAME` includes `bpf_pinning`, `ematch_map`, `group`, `nl_protos`, `rt_dsfield`, `rt_protos`, `rt_realms`, `rt_scopes`, and `rt_tables`.
78808181+- The `systemd.oomd` module behavior is changed as:
8282+8383+ - Raise ManagedOOMMemoryPressureLimit from 50% to 80%. This should make systemd-oomd kill things less often, and fix issues like [this](https://pagure.io/fedora-workstation/issue/358).
8484+ Reference: [commit](https://src.fedoraproject.org/rpms/systemd/c/806c95e1c70af18f81d499b24cd7acfa4c36ffd6?branch=806c95e1c70af18f81d499b24cd7acfa4c36ffd6)
8585+8686+ - Remove swap policy. This helps prevent killing processes when user's swap is small.
8787+8888+ - Expand the memory pressure policy to system.slice, user-.slice, and all user owned slices. Reference: [commit](https://src.fedoraproject.org/rpms/systemd/c/7665e1796f915dedbf8e014f0a78f4f576d609bb)
8989+9090+ - `systemd.oomd.enableUserServices` is renamed to `systemd.oomd.enableUserSlices`.
9191+7992## Other Notable Changes {#sec-release-24.05-notable-changes}
80938194<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
···91104 The `nimPackages` and `nim2Packages` sets have been removed.
92105 See https://nixos.org/manual/nixpkgs/unstable#nim for more information.
93106107107+- [Portunus](https://github.com/majewsky/portunus) has been updated to 2.0.
108108+ This version of Portunus supports strong password hashes, but the legacy hash SHA-256 is also still supported to ensure a smooth migration of existing user accounts.
109109+ After upgrading, follow the instructions on the [upstream release notes](https://github.com/majewsky/portunus/releases/tag/v2.0.0) to upgrade all user accounts to strong password hashes.
110110+ Support for weak password hashes will be removed in NixOS 24.11.
111111+94112- `libass` now uses the native CoreText backend on Darwin, which may fix subtitle rendering issues with `mpv`, `ffmpeg`, etc.
113113+114114+- The following options of the Nextcloud module were moved into [`services.nextcloud.extraOptions`](#opt-services.nextcloud.extraOptions) and renamed to match the name from Nextcloud's `config.php`:
115115+ - `logLevel` -> [`loglevel`](#opt-services.nextcloud.extraOptions.loglevel),
116116+ - `logType` -> [`log_type`](#opt-services.nextcloud.extraOptions.log_type),
117117+ - `defaultPhoneRegion` -> [`default_phone_region`](#opt-services.nextcloud.extraOptions.default_phone_region),
118118+ - `overwriteProtocol` -> [`overwriteprotocol`](#opt-services.nextcloud.extraOptions.overwriteprotocol),
119119+ - `skeletonDirectory` -> [`skeletondirectory`](#opt-services.nextcloud.extraOptions.skeletondirectory),
120120+ - `globalProfiles` -> [`profile.enabled`](#opt-services.nextcloud.extraOptions._profile.enabled_),
121121+ - `extraTrustedDomains` -> [`trusted_domains`](#opt-services.nextcloud.extraOptions.trusted_domains) and
122122+ - `trustedProxies` -> [`trusted_proxies`](#opt-services.nextcloud.extraOptions.trusted_proxies).
9512396124- The Yama LSM is now enabled by default in the kernel, which prevents ptracing
97125 non-child processes. This means you will not be able to attach gdb to an
···102102 ldap = {
103103 package = mkOption {
104104 type = types.package;
105105- # needs openldap built with a libxcrypt that support crypt sha256 until https://github.com/majewsky/portunus/issues/2 is solved
105105+ # needs openldap built with a libxcrypt that support crypt sha256 until users have had time to migrate to newer hashes
106106+ # Ref: <https://github.com/majewsky/portunus/issues/2>
107107+ # TODO: remove in NixOS 24.11 (cf. same note on pkgs/servers/portunus/default.nix)
106108 default = pkgs.openldap.override { libxcrypt = pkgs.libxcrypt-legacy; };
107109 defaultText = lib.literalExpression "pkgs.openldap.override { libxcrypt = pkgs.libxcrypt-legacy; }";
108110 description = lib.mdDoc "The OpenLDAP package to use.";
···5151In case the application serves multiple domains (those are checked with
5252[`$_SERVER['HTTP_HOST']`](https://www.php.net/manual/en/reserved.variables.server.php))
5353it's needed to add them to
5454-[`services.nextcloud.config.extraTrustedDomains`](#opt-services.nextcloud.config.extraTrustedDomains).
5454+[`services.nextcloud.extraOptions.trusted_domains`](#opt-services.nextcloud.extraOptions.trusted_domains).
55555656Auto updates for Nextcloud apps can be enabled using
5757[`services.nextcloud.autoUpdateApps`](#opt-services.nextcloud.autoUpdateApps.enable).
+177-143
nixos/modules/services/web-apps/nextcloud.nix
···2323 catch_workers_output = "yes";
2424 };
25252626+ appStores = {
2727+ # default apps bundled with pkgs.nextcloudXX, e.g. files, contacts
2828+ apps = {
2929+ enabled = true;
3030+ writable = false;
3131+ };
3232+ # apps installed via cfg.extraApps
3333+ nix-apps = {
3434+ enabled = cfg.extraApps != { };
3535+ linkTarget = pkgs.linkFarm "nix-apps"
3636+ (mapAttrsToList (name: path: { inherit name path; }) cfg.extraApps);
3737+ writable = false;
3838+ };
3939+ # apps installed via the app store.
4040+ store-apps = {
4141+ enabled = cfg.appstoreEnable == null || cfg.appstoreEnable;
4242+ linkTarget = "${cfg.home}/store-apps";
4343+ writable = true;
4444+ };
4545+ };
4646+4747+ webroot = pkgs.runCommand
4848+ "${cfg.package.name or "nextcloud"}-with-apps"
4949+ { }
5050+ ''
5151+ mkdir $out
5252+ ln -sfv "${cfg.package}"/* "$out"
5353+ ${concatStrings
5454+ (mapAttrsToList (name: store: optionalString (store.enabled && store?linkTarget) ''
5555+ if [ -e "$out"/${name} ]; then
5656+ echo "Didn't expect ${name} already in $out!"
5757+ exit 1
5858+ fi
5959+ ln -sfTv ${store.linkTarget} "$out"/${name}
6060+ '') appStores)}
6161+ '';
6262+2663 inherit (cfg) datadir;
27642865 phpPackage = cfg.phpPackage.buildEnv {
···45824683 occ = pkgs.writeScriptBin "nextcloud-occ" ''
4784 #! ${pkgs.runtimeShell}
4848- cd ${cfg.package}
8585+ cd ${webroot}
4986 sudo=exec
5087 if [[ "$USER" != nextcloud ]]; then
5188 sudo='exec /run/wrappers/bin/sudo -u nextcloud --preserve-env=NEXTCLOUD_CONFIG_DIR --preserve-env=OC_PASS'
···94131 (mkRemovedOptionModule [ "services" "nextcloud" "disableImagemagick" ] ''
95132 Use services.nextcloud.enableImagemagick instead.
96133 '')
134134+ (mkRenamedOptionModule
135135+ [ "services" "nextcloud" "logLevel" ] [ "services" "nextcloud" "extraOptions" "loglevel" ])
136136+ (mkRenamedOptionModule
137137+ [ "services" "nextcloud" "logType" ] [ "services" "nextcloud" "extraOptions" "log_type" ])
138138+ (mkRenamedOptionModule
139139+ [ "services" "nextcloud" "config" "defaultPhoneRegion" ] [ "services" "nextcloud" "extraOptions" "default_phone_region" ])
140140+ (mkRenamedOptionModule
141141+ [ "services" "nextcloud" "config" "overwriteProtocol" ] [ "services" "nextcloud" "extraOptions" "overwriteprotocol" ])
142142+ (mkRenamedOptionModule
143143+ [ "services" "nextcloud" "skeletonDirectory" ] [ "services" "nextcloud" "extraOptions" "skeletondirectory" ])
144144+ (mkRenamedOptionModule
145145+ [ "services" "nextcloud" "config" "globalProfiles" ] [ "services" "nextcloud" "extraOptions" "profile.enabled" ])
146146+ (mkRenamedOptionModule
147147+ [ "services" "nextcloud" "config" "extraTrustedDomains" ] [ "services" "nextcloud" "extraOptions" "trusted_domains" ])
148148+ (mkRenamedOptionModule
149149+ [ "services" "nextcloud" "config" "trustedProxies" ] [ "services" "nextcloud" "extraOptions" "trusted_proxies" ])
97150 ];
9815199152 options.services.nextcloud = {
···157210 Set this to false to disable the installation of apps from the global appstore. App management is always enabled regardless of this setting.
158211 '';
159212 };
160160- logLevel = mkOption {
161161- type = types.ints.between 0 4;
162162- default = 2;
163163- description = lib.mdDoc ''
164164- Log level value between 0 (DEBUG) and 4 (FATAL).
165165-166166- - 0 (debug): Log all activity.
167167-168168- - 1 (info): Log activity such as user logins and file activities, plus warnings, errors, and fatal errors.
169169-170170- - 2 (warn): Log successful operations, as well as warnings of potential problems, errors and fatal errors.
171171-172172- - 3 (error): Log failed operations and fatal errors.
173173-174174- - 4 (fatal): Log only fatal errors that cause the server to stop.
175175- '';
176176- };
177177- logType = mkOption {
178178- type = types.enum [ "errorlog" "file" "syslog" "systemd" ];
179179- default = "syslog";
180180- description = lib.mdDoc ''
181181- Logging backend to use.
182182- systemd requires the php-systemd package to be added to services.nextcloud.phpExtraExtensions.
183183- See the [nextcloud documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/logging_configuration.html) for details.
184184- '';
185185- };
186213 https = mkOption {
187214 type = types.bool;
188215 default = false;
···206233 '';
207234 };
208235209209- skeletonDirectory = mkOption {
210210- default = "";
211211- type = types.str;
212212- description = lib.mdDoc ''
213213- The directory where the skeleton files are located. These files will be
214214- copied to the data directory of new users. Leave empty to not copy any
215215- skeleton files.
216216- '';
217217- };
218218-219236 webfinger = mkOption {
220237 type = types.bool;
221238 default = false;
···315332316333 };
317334318318-319335 config = {
320336 dbtype = mkOption {
321337 type = types.enum [ "sqlite" "pgsql" "mysql" ];
···380396 setup of Nextcloud by the systemd service `nextcloud-setup.service`.
381397 '';
382398 };
383383-384384- extraTrustedDomains = mkOption {
385385- type = types.listOf types.str;
386386- default = [];
387387- description = lib.mdDoc ''
388388- Trusted domains from which the Nextcloud installation will be
389389- accessible. You don't need to add
390390- `services.nextcloud.hostname` here.
391391- '';
392392- };
393393-394394- trustedProxies = mkOption {
395395- type = types.listOf types.str;
396396- default = [];
397397- description = lib.mdDoc ''
398398- Trusted proxies to provide if the Nextcloud installation is being
399399- proxied to secure against, e.g. spoofing.
400400- '';
401401- };
402402-403403- overwriteProtocol = mkOption {
404404- type = types.nullOr (types.enum [ "http" "https" ]);
405405- default = null;
406406- example = "https";
407407-408408- description = lib.mdDoc ''
409409- Force Nextcloud to always use HTTP or HTTPS i.e. for link generation.
410410- Nextcloud uses the currently used protocol by default, but when
411411- behind a reverse-proxy, it may use `http` for everything although
412412- Nextcloud may be served via HTTPS.
413413- '';
414414- };
415415-416416- defaultPhoneRegion = mkOption {
417417- default = null;
418418- type = types.nullOr types.str;
419419- example = "DE";
420420- description = lib.mdDoc ''
421421- An [ISO 3166-1](https://www.iso.org/iso-3166-country-codes.html)
422422- country code which replaces automatic phone-number detection
423423- without a country code.
424424-425425- As an example, with `DE` set as the default phone region,
426426- the `+49` prefix can be omitted for phone numbers.
427427- '';
428428- };
429429-430399 objectstore = {
431400 s3 = {
432401 enable = mkEnableOption (lib.mdDoc ''
···609578 The nextcloud-occ program preconfigured to target this Nextcloud instance.
610579 '';
611580 };
612612- globalProfiles = mkEnableOption (lib.mdDoc "global profiles") // {
613613- description = lib.mdDoc ''
614614- Makes user-profiles globally available under `nextcloud.tld/u/user.name`.
615615- Even though it's enabled by default in Nextcloud, it must be explicitly enabled
616616- here because it has the side-effect that personal information is even accessible to
617617- unauthenticated users by default.
618581619619- By default, the following properties are set to “Show to everyone”
620620- if this flag is enabled:
621621- - About
622622- - Full name
623623- - Headline
624624- - Organisation
625625- - Profile picture
626626- - Role
627627- - Twitter
628628- - Website
582582+ extraOptions = mkOption {
583583+ type = types.submodule {
584584+ freeformType = jsonFormat.type;
585585+ options = {
629586630630- Only has an effect in Nextcloud 23 and later.
631631- '';
632632- };
587587+ loglevel = mkOption {
588588+ type = types.ints.between 0 4;
589589+ default = 2;
590590+ description = lib.mdDoc ''
591591+ Log level value between 0 (DEBUG) and 4 (FATAL).
633592634634- extraOptions = mkOption {
635635- type = jsonFormat.type;
593593+ - 0 (debug): Log all activity.
594594+595595+ - 1 (info): Log activity such as user logins and file activities, plus warnings, errors, and fatal errors.
596596+597597+ - 2 (warn): Log successful operations, as well as warnings of potential problems, errors and fatal errors.
598598+599599+ - 3 (error): Log failed operations and fatal errors.
600600+601601+ - 4 (fatal): Log only fatal errors that cause the server to stop.
602602+ '';
603603+ };
604604+ log_type = mkOption {
605605+ type = types.enum [ "errorlog" "file" "syslog" "systemd" ];
606606+ default = "syslog";
607607+ description = lib.mdDoc ''
608608+ Logging backend to use.
609609+ systemd requires the php-systemd package to be added to services.nextcloud.phpExtraExtensions.
610610+ See the [nextcloud documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/logging_configuration.html) for details.
611611+ '';
612612+ };
613613+ skeletondirectory = mkOption {
614614+ default = "";
615615+ type = types.str;
616616+ description = lib.mdDoc ''
617617+ The directory where the skeleton files are located. These files will be
618618+ copied to the data directory of new users. Leave empty to not copy any
619619+ skeleton files.
620620+ '';
621621+ };
622622+ trusted_domains = mkOption {
623623+ type = types.listOf types.str;
624624+ default = [];
625625+ description = lib.mdDoc ''
626626+ Trusted domains, from which the nextcloud installation will be
627627+ accessible. You don't need to add
628628+ `services.nextcloud.hostname` here.
629629+ '';
630630+ };
631631+ trusted_proxies = mkOption {
632632+ type = types.listOf types.str;
633633+ default = [];
634634+ description = lib.mdDoc ''
635635+ Trusted proxies, to provide if the nextcloud installation is being
636636+ proxied to secure against e.g. spoofing.
637637+ '';
638638+ };
639639+ overwriteprotocol = mkOption {
640640+ type = types.enum [ "" "http" "https" ];
641641+ default = "";
642642+ example = "https";
643643+ description = lib.mdDoc ''
644644+ Force Nextcloud to always use HTTP or HTTPS i.e. for link generation.
645645+ Nextcloud uses the currently used protocol by default, but when
646646+ behind a reverse-proxy, it may use `http` for everything although
647647+ Nextcloud may be served via HTTPS.
648648+ '';
649649+ };
650650+ default_phone_region = mkOption {
651651+ default = "";
652652+ type = types.str;
653653+ example = "DE";
654654+ description = lib.mdDoc ''
655655+ An [ISO 3166-1](https://www.iso.org/iso-3166-country-codes.html)
656656+ country code which replaces automatic phone-number detection
657657+ without a country code.
658658+659659+ As an example, with `DE` set as the default phone region,
660660+ the `+49` prefix can be omitted for phone numbers.
661661+ '';
662662+ };
663663+ "profile.enabled" = mkEnableOption (lib.mdDoc "global profiles") // {
664664+ description = lib.mdDoc ''
665665+ Makes user-profiles globally available under `nextcloud.tld/u/user.name`.
666666+ Even though it's enabled by default in Nextcloud, it must be explicitly enabled
667667+ here because it has the side-effect that personal information is even accessible to
668668+ unauthenticated users by default.
669669+ By default, the following properties are set to “Show to everyone”
670670+ if this flag is enabled:
671671+ - About
672672+ - Full name
673673+ - Headline
674674+ - Organisation
675675+ - Profile picture
676676+ - Role
677677+ - Twitter
678678+ - Website
679679+ Only has an effect in Nextcloud 23 and later.
680680+ '';
681681+ };
682682+ };
683683+ };
636684 default = {};
637685 description = lib.mdDoc ''
638686 Extra options which should be appended to Nextcloud's config.php file.
···766814 # When upgrading the Nextcloud package, Nextcloud can report errors such as
767815 # "The files of the app [all apps in /var/lib/nextcloud/apps] were not replaced correctly"
768816 # Restarting phpfpm on Nextcloud package update fixes these issues (but this is a workaround).
769769- phpfpm-nextcloud.restartTriggers = [ cfg.package ];
817817+ phpfpm-nextcloud.restartTriggers = [ webroot ];
770818771819 nextcloud-setup = let
772820 c = cfg.config;
773773- writePhpArray = a: "[${concatMapStringsSep "," (val: ''"${toString val}"'') a}]";
774821 requiresReadSecretFunction = c.dbpassFile != null || c.objectstore.s3.enable;
775822 objectstoreConfig = let s3 = c.objectstore.s3; in optionalString s3.enable ''
776823 'objectstore' => [
···800847801848 nextcloudGreaterOrEqualThan = req: versionAtLeast cfg.package.version req;
802849850850+ mkAppStoreConfig = name: { enabled, writable, ... }: optionalString enabled ''
851851+ [ 'path' => '${webroot}/${name}', 'url' => '/${name}', 'writable' => ${boolToString writable} ],
852852+ '';
853853+803854 overrideConfig = pkgs.writeText "nextcloud-config.php" ''
804855 <?php
805856 ${optionalString requiresReadSecretFunction ''
···828879 }
829880 $CONFIG = [
830881 'apps_paths' => [
831831- ${optionalString (cfg.extraApps != { }) "[ 'path' => '${cfg.home}/nix-apps', 'url' => '/nix-apps', 'writable' => false ],"}
832832- [ 'path' => '${cfg.home}/apps', 'url' => '/apps', 'writable' => false ],
833833- [ 'path' => '${cfg.home}/store-apps', 'url' => '/store-apps', 'writable' => true ],
882882+ ${concatStrings (mapAttrsToList mkAppStoreConfig appStores)}
834883 ],
835884 ${optionalString (showAppStoreSetting) "'appstoreenabled' => ${renderedAppStoreSetting},"}
836836- 'datadirectory' => '${datadir}/data',
837837- 'skeletondirectory' => '${cfg.skeletonDirectory}',
838885 ${optionalString cfg.caching.apcu "'memcache.local' => '\\OC\\Memcache\\APCu',"}
839839- 'log_type' => '${cfg.logType}',
840840- 'loglevel' => '${builtins.toString cfg.logLevel}',
841841- ${optionalString (c.overwriteProtocol != null) "'overwriteprotocol' => '${c.overwriteProtocol}',"}
842886 ${optionalString (c.dbname != null) "'dbname' => '${c.dbname}',"}
843887 ${optionalString (c.dbhost != null) "'dbhost' => '${c.dbhost}',"}
844888 ${optionalString (c.dbport != null) "'dbport' => '${toString c.dbport}',"}
···851895 ''
852896 }
853897 'dbtype' => '${c.dbtype}',
854854- 'trusted_domains' => ${writePhpArray ([ cfg.hostName ] ++ c.extraTrustedDomains)},
855855- 'trusted_proxies' => ${writePhpArray (c.trustedProxies)},
856856- ${optionalString (c.defaultPhoneRegion != null) "'default_phone_region' => '${c.defaultPhoneRegion}',"}
857857- ${optionalString (nextcloudGreaterOrEqualThan "23") "'profile.enabled' => ${boolToString cfg.globalProfiles},"}
858898 ${objectstoreConfig}
859899 ];
860900···907947 (i: v: ''
908948 ${occ}/bin/nextcloud-occ config:system:set trusted_domains \
909949 ${toString i} --value="${toString v}"
910910- '') ([ cfg.hostName ] ++ cfg.config.extraTrustedDomains));
950950+ '') ([ cfg.hostName ] ++ cfg.extraOptions.trusted_domains));
911951912952 in {
913953 wantedBy = [ "multi-user.target" ];
···935975 exit 1
936976 fi
937977938938- ln -sf ${cfg.package}/apps ${cfg.home}/
939939-940940- # Install extra apps
941941- ln -sfT \
942942- ${pkgs.linkFarm "nix-apps"
943943- (mapAttrsToList (name: path: { inherit name path; }) cfg.extraApps)} \
944944- ${cfg.home}/nix-apps
978978+ ${concatMapStrings (name: ''
979979+ if [ -d "${cfg.home}"/${name} ]; then
980980+ echo "Cleaning up ${name}; these are now bundled in the webroot store-path!"
981981+ rm -r "${cfg.home}"/${name}
982982+ fi
983983+ '') [ "nix-apps" "apps" ]}
945984946985 # create nextcloud directories.
947986 # if the directories exist already with wrong permissions, we fix that
948948- for dir in ${datadir}/config ${datadir}/data ${cfg.home}/store-apps ${cfg.home}/nix-apps; do
987987+ for dir in ${datadir}/config ${datadir}/data ${cfg.home}/store-apps; do
949988 if [ ! -e $dir ]; then
950989 install -o nextcloud -g nextcloud -d $dir
951990 elif [ $(stat -c "%G" $dir) != "nextcloud" ]; then
···9821021 environment.NEXTCLOUD_CONFIG_DIR = "${datadir}/config";
9831022 serviceConfig.Type = "oneshot";
9841023 serviceConfig.User = "nextcloud";
985985- serviceConfig.ExecStart = "${phpPackage}/bin/php -f ${cfg.package}/cron.php";
10241024+ serviceConfig.ExecStart = "${phpPackage}/bin/php -f ${webroot}/cron.php";
9861025 };
9871026 nextcloud-update-plugins = mkIf cfg.autoUpdateApps.enable {
9881027 after = [ "nextcloud-setup.service" ];
···10431082 user = "nextcloud";
10441083 };
1045108410461046- services.nextcloud = lib.mkIf cfg.configureRedis {
10471047- caching.redis = true;
10481048- extraOptions = {
10851085+ services.nextcloud = {
10861086+ caching.redis = lib.mkIf cfg.configureRedis true;
10871087+ extraOptions = mkMerge [({
10881088+ datadirectory = lib.mkDefault "${datadir}/data";
10891089+ trusted_domains = [ cfg.hostName ];
10901090+ }) (lib.mkIf cfg.configureRedis {
10491091 "memcache.distributed" = ''\OC\Memcache\Redis'';
10501092 "memcache.locking" = ''\OC\Memcache\Redis'';
10511093 redis = {
10521094 host = config.services.redis.servers.nextcloud.unixSocket;
10531095 port = 0;
10541096 };
10551055- };
10971097+ })];
10561098 };
1057109910581100 services.nginx.enable = mkDefault true;
1059110110601102 services.nginx.virtualHosts.${cfg.hostName} = {
10611061- root = cfg.package;
11031103+ root = webroot;
10621104 locations = {
10631105 "= /robots.txt" = {
10641106 priority = 100;
···10741116 return 302 /remote.php/webdav/$is_args$args;
10751117 }
10761118 '';
10771077- };
10781078- "~ ^/store-apps" = {
10791079- priority = 201;
10801080- extraConfig = "root ${cfg.home};";
10811081- };
10821082- "~ ^/nix-apps" = {
10831083- priority = 201;
10841084- extraConfig = "root ${cfg.home};";
10851119 };
10861120 "^~ /.well-known" = {
10871121 priority = 210;
+19-6
nixos/modules/system/boot/systemd/oomd.nix
···33 cfg = config.systemd.oomd;
4455in {
66+ imports = [
77+ (lib.mkRemovedOptionModule [ "systemd" "oomd" "enableUserServices" ] "Use systemd.oomd.enableUserSlices instead.")
88+ ];
99+610 options.systemd.oomd = {
711 enable = lib.mkEnableOption (lib.mdDoc "the `systemd-oomd` OOM killer") // { default = true; };
812913 # Fedora enables the first and third option by default. See the 10-oomd-* files here:
1010- # https://src.fedoraproject.org/rpms/systemd/tree/acb90c49c42276b06375a66c73673ac351025597
1414+ # https://src.fedoraproject.org/rpms/systemd/tree/806c95e1c70af18f81d499b24cd7acfa4c36ffd6
1115 enableRootSlice = lib.mkEnableOption (lib.mdDoc "oomd on the root slice (`-.slice`)");
1216 enableSystemSlice = lib.mkEnableOption (lib.mdDoc "oomd on the system slice (`system.slice`)");
1313- enableUserServices = lib.mkEnableOption (lib.mdDoc "oomd on all user services (`user@.service`)");
1717+ enableUserSlices = lib.mkEnableOption (lib.mdDoc "oomd on all user slices (`user@.slice`) and all user owned slices");
14181519 extraConfig = lib.mkOption {
1620 type = with lib.types; attrsOf (oneOf [ str int bool ]);
···4448 users.groups.systemd-oom = { };
45494650 systemd.slices."-".sliceConfig = lib.mkIf cfg.enableRootSlice {
4747- ManagedOOMSwap = "kill";
5151+ ManagedOOMMemoryPressure = "kill";
5252+ ManagedOOMMemoryPressureLimit = "80%";
4853 };
4954 systemd.slices."system".sliceConfig = lib.mkIf cfg.enableSystemSlice {
5050- ManagedOOMSwap = "kill";
5555+ ManagedOOMMemoryPressure = "kill";
5656+ ManagedOOMMemoryPressureLimit = "80%";
5157 };
5252- systemd.services."user@".serviceConfig = lib.mkIf cfg.enableUserServices {
5858+ systemd.slices."user-".sliceConfig = lib.mkIf cfg.enableUserSlices {
5359 ManagedOOMMemoryPressure = "kill";
5454- ManagedOOMMemoryPressureLimit = "50%";
6060+ ManagedOOMMemoryPressureLimit = "80%";
6161+ };
6262+ systemd.user.units."slice" = lib.mkIf cfg.enableUserSlices {
6363+ text = ''
6464+ ManagedOOMMemoryPressure=kill
6565+ ManagedOOMMemoryPressureLimit=80%
6666+ '';
6767+ overrideStrategy = "asDropin";
5568 };
5669 };
5770}
···2233stdenv.mkDerivation rec {
44 pname = "tdlib";
55- version = "1.8.22";
55+ version = "1.8.23";
6677 src = fetchFromGitHub {
88 owner = "tdlib";
···1111 # The tdlib authors do not set tags for minor versions, but
1212 # external programs depending on tdlib constrain the minor
1313 # version, hence we set a specific commit with a known version.
1414- rev = "24893faf75d84b2b885f3f7aeb9d5a3c056fa7be";
1515- hash = "sha256-4cfnre71+rQSuPrtFJMzIEPYVCZH/W142b4Pn2NxvqI=";
1414+ rev = "27c3eaeb4964bd5f18d8488e354abde1a4383e49";
1515+ hash = "sha256-TxgzZn/OF5b5FWzwnOWIozH+1d7O0RG3h+WKV10rxpE=";
1616 };
17171818 buildInputs = [ gperf openssl readline zlib ];
···603603 mess = throw "'mess' has been renamed to/replaced by 'mame'"; # Converted to throw 2023-09-10
604604 microsoft_gsl = microsoft-gsl; # Added 2023-05-26
605605 migraphx = throw "'migraphx' has been replaced with 'rocmPackages.migraphx'"; # Added 2023-10-08
606606+ minishift = throw "'minishift' has been removed as it was discontinued upstream. Use 'crc' to setup a microshift cluster instead"; # Added 2023-12-30
606607 miopen = throw "'miopen' has been replaced with 'rocmPackages.miopen'"; # Added 2023-10-08
607608 miopengemm = throw "'miopengemm' has been replaced with 'rocmPackages.miopengemm'"; # Added 2023-10-08
608609 miopen-hip = throw "'miopen-hip' has been replaced with 'rocmPackages.miopen-hip'"; # Added 2023-10-08