···

       
220
       
 
       


     

       
221
       
 
       
- `racket_7_9` has been removed, as it is insecure. It is recommended to use Racket 8 instead.

     

       
222
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
223
       
 
       
- `rofi` has been updated from 1.7.5 to 1.7.6 which introduces some breaking changes to binary plugins, and also contains a lot of new features and bug fixes. This is highlighted because the patch version bump does not indicate the volume of changes by itself. See the [upstream release notes](https://github.com/davatorium/rofi/releases/tag/1.7.6) for the full list of changes.

     

       
224
       
 
       


     

       
225
       
 
       
- `ente-auth` now uses the name `enteauth` for its binary. The previous name was `ente_auth`.

     

···

       
220
       
 
       


     

       
221
       
 
       
- `racket_7_9` has been removed, as it is insecure. It is recommended to use Racket 8 instead.

     

       
222
       
 
       


     

       
223
       
+
       
- `services.mongodb.initialRootPassword` has been replaced with the more secure option [`services.mongodb.initialRootPasswordFile`](#opt-services.mongodb.initialRootPasswordFile)

     

       
224
       
+
       


     

       
225
       
 
       
- `rofi` has been updated from 1.7.5 to 1.7.6 which introduces some breaking changes to binary plugins, and also contains a lot of new features and bug fixes. This is highlighted because the patch version bump does not indicate the volume of changes by itself. See the [upstream release notes](https://github.com/davatorium/rofi/releases/tag/1.7.6) for the full list of changes.

     

       
226
       
 
       


     

       
227
       
 
       
- `ente-auth` now uses the name `enteauth` for its binary. The previous name was `ente_auth`.

     

···

       
27
       
 
       
in

     

       
28
       
 
       


     

       
29
       
 
       
{

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
30
       
 
       


     

       
31
       
 
       
  ###### interface

     

       
32
       
 
       


     
···

       
64
       
 
       
        description = "Enable client authentication. Creates a default superuser with username root!";

     

       
65
       
 
       
      };

     

       
66
       
 
       


     

       
67
       
-
       
      initialRootPassword = lib.mkOption {

     

       
68
       
-
       
        type = lib.types.nullOr lib.types.str;

     

       
69
       
 
       
        default = null;

     

       
70
       
-
       
        description = "Password for the root user if auth is enabled.";

     

       
71
       
 
       
      };

     

       
72
       
 
       


     

       
73
       
 
       
      dbpath = lib.mkOption {

     
···

       
116
       
 
       
  config = lib.mkIf config.services.mongodb.enable {

     

       
117
       
 
       
    assertions = [

     

       
118
       
 
       
      {

     

       
119
       
-
       
        assertion = !cfg.enableAuth || cfg.initialRootPassword != null;

     

       
120
       
-
       
        message = "`enableAuth` requires `initialRootPassword` to be set.";

     

       
121
       
 
       
      }

     

       
122
       
 
       
    ];

     

       
123
       
 
       


     
···

       
168
       
 
       
            # wait for mongodb

     

       
169
       
 
       
            while ! ${mongoshExe} --eval "db.version()" > /dev/null 2>&1; do sleep 0.1; done

     

       
170
       
 
       


     

       
0
       
 
       

     

       
171
       
 
       
          ${mongoshExe} <<EOF

     

       
172
       
 
       
            use admin;

     

       
173
       
 
       
            db.createUser(

     

       
174
       
 
       
              {

     

       
175
       
 
       
                user: "root",

     

       
176
       
-
       
                pwd: "${cfg.initialRootPassword}",

     

       
177
       
 
       
                roles: [

     

       
178
       
 
       
                  { role: "userAdminAnyDatabase", db: "admin" },

     

       
179
       
 
       
                  { role: "dbAdminAnyDatabase", db: "admin" },

     
···

       
189
       
 
       
      postStart = ''

     

       
190
       
 
       
        if test -e "${cfg.dbpath}/.first_startup"; then

     

       
191
       
 
       
          ${lib.optionalString (cfg.initialScript != null) ''

     

       
192
       
-
       
            ${mongoshExe} ${lib.optionalString (cfg.enableAuth) "-u root -p ${cfg.initialRootPassword}"} admin "${cfg.initialScript}"

     

       
0
       
 
       

     

       
193
       
 
       
          ''}

     

       
194
       
 
       
          rm -f "${cfg.dbpath}/.first_startup"

     

       
195
       
 
       
        fi

     

···

       
27
       
 
       
in

     

       
28
       
 
       


     

       
29
       
 
       
{

     

       
30
       
+
       
  imports = [

     

       
31
       
+
       
    (lib.mkRemovedOptionModule [

     

       
32
       
+
       
      "services"

     

       
33
       
+
       
      "mongodb"

     

       
34
       
+
       
      "initialRootPassword"

     

       
35
       
+
       
    ] "Use services.mongodb.initialRootPasswordFile to securely provide the initial root password.")

     

       
36
       
+
       
  ];

     

       
37
       
 
       


     

       
38
       
 
       
  ###### interface

     

       
39
       
 
       


     
···

       
71
       
 
       
        description = "Enable client authentication. Creates a default superuser with username root!";

     

       
72
       
 
       
      };

     

       
73
       
 
       


     

       
74
       
+
       
      initialRootPasswordFile = lib.mkOption {

     

       
75
       
+
       
        type = lib.types.nullOr lib.types.path;

     

       
76
       
 
       
        default = null;

     

       
77
       
+
       
        description = "Path to the file containing the password for the root user if auth is enabled.";

     

       
78
       
 
       
      };

     

       
79
       
 
       


     

       
80
       
 
       
      dbpath = lib.mkOption {

     
···

       
123
       
 
       
  config = lib.mkIf config.services.mongodb.enable {

     

       
124
       
 
       
    assertions = [

     

       
125
       
 
       
      {

     

       
126
       
+
       
        assertion = !cfg.enableAuth || cfg.initialRootPasswordFile != null;

     

       
127
       
+
       
        message = "`enableAuth` requires `initialRootPasswordFile` to be set.";

     

       
128
       
 
       
      }

     

       
129
       
 
       
    ];

     

       
130
       
 
       


     
···

       
175
       
 
       
            # wait for mongodb

     

       
176
       
 
       
            while ! ${mongoshExe} --eval "db.version()" > /dev/null 2>&1; do sleep 0.1; done

     

       
177
       
 
       


     

       
178
       
+
       
            initialRootPassword=$(<${cfg.initialRootPasswordFile})

     

       
179
       
 
       
          ${mongoshExe} <<EOF

     

       
180
       
 
       
            use admin;

     

       
181
       
 
       
            db.createUser(

     

       
182
       
 
       
              {

     

       
183
       
 
       
                user: "root",

     

       
184
       
+
       
                pwd: "$initialRootPassword",

     

       
185
       
 
       
                roles: [

     

       
186
       
 
       
                  { role: "userAdminAnyDatabase", db: "admin" },

     

       
187
       
 
       
                  { role: "dbAdminAnyDatabase", db: "admin" },

     
···

       
197
       
 
       
      postStart = ''

     

       
198
       
 
       
        if test -e "${cfg.dbpath}/.first_startup"; then

     

       
199
       
 
       
          ${lib.optionalString (cfg.initialScript != null) ''

     

       
200
       
+
       
            initialRootPassword=$(<${cfg.initialRootPasswordFile})

     

       
201
       
+
       
            ${mongoshExe} ${lib.optionalString (cfg.enableAuth) "-u root -p $initialRootPassword"} admin "${cfg.initialScript}"

     

       
202
       
 
       
          ''}

     

       
203
       
 
       
          rm -f "${cfg.dbpath}/.first_startup"

     

       
204
       
 
       
        fi