commit 694d5b19d30bf66687b42fb77f43ea7cd1002a62 · pyrox.dev/nixpkgs

+1 -2

nixos/modules/hardware/logitech.nix

···

       34
       34
        
               default = [ "0a07" "c222" "c225" "c227" "c251" ];

     

       35
       35
        
               description = ''

     

       36
       36
        
                 List of USB device ids supported by g15daemon.

     

       37
       37
       -
                 </para>

     

       38
       38
       -
                 <para>

     

       37
       37
       +
       

     

       39
       38
        
                 You most likely do not need to change this.

     

       40
       39
        
               '';

     

       41
       40
        
             };

+1 -1

nixos/modules/installer/cd-dvd/iso-image.nix

···

       618
       618
        
               This will be directly appended (without whitespace) to the NixOS version

     

       619
       619
        
               string, like for example if it is set to <literal>XXX</literal>:

     

       620
       620
        
       

     

       621
       621
       -
               <para><literal>NixOS 99.99-pre666XXX</literal></para>

     

       621
       621
       +
               <literal>NixOS 99.99-pre666XXX</literal>

     

       622
       622
        
             '';

     

       623
       623
        
           };

     

       624
       624

+1 -2

nixos/modules/programs/firejail.nix

···

       71
       71
        
             '';

     

       72
       72
        
             description = ''

     

       73
       73
        
               Wrap the binaries in firejail and place them in the global path.

     

       74
       74
       -
               </para>

     

       75
       75
       -
               <para>

     

       74
       74
       +
       

     

       76
       75
        
               You will get file collisions if you put the actual application binary in

     

       77
       76
        
               the global environment (such as by adding the application package to

     

       78
       77
        
               <code>environment.systemPackages</code>), and applications started via

+15 -30

nixos/modules/services/databases/neo4j.nix

···

       145
       145
        
               <option>directories.imports</option>. It restricts

     

       146
       146
        
               access to only those files within that directory and its

     

       147
       147
        
               subdirectories.

     

       148
       148
       -
               </para>

     

       149
       149
       -
               <para>

     

       148
       148
       +
       

     

       150
       149
        
               Setting this option to <literal>false</literal> introduces

     

       151
       150
        
               possible security problems.

     

       152
       151
        
             '';

     
···

       158
       157
        
             description = ''

     

       159
       158
        
               Default network interface to listen for incoming connections. To

     

       160
       159
        
               listen for connections on all interfaces, use "0.0.0.0".

     

       161
       161
       -
               </para>

     

       162
       162
       -
               <para>

     

       160
       160
       +
       

     

       163
       161
        
               Specifies the default IP address and address part of connector

     

       164
       162
        
               specific <option>listenAddress</option> options. To bind specific

     

       165
       163
        
               connectors to a specific network interfaces, specify the entire

     
···

       229
       227
        
               default = "legacy";

     

       230
       228
        
               description = ''

     

       231
       229
        
                 Neo4j SSL policy for BOLT traffic.

     

       232
       232
       -
                 </para>

     

       233
       233
       -
                 <para>

     

       230
       230
       +
       

     

       234
       231
        
                 The legacy policy is a special policy which is not defined in

     

       235
       232
        
                 the policy configuration section, but rather derives from

     

       236
       233
        
                 <option>directories.certificates</option> and

     

       237
       234
        
                 associated files (by default: <filename>neo4j.key</filename> and

     

       238
       235
        
                 <filename>neo4j.cert</filename>). Its use will be deprecated.

     

       239
       239
       -
                 </para>

     

       240
       240
       -
                 <para>

     

       236
       236
       +
       

     

       241
       237
        
                 Note: This connector must be configured to support/require

     

       242
       238
        
                 SSL/TLS for the legacy policy to actually be utilized. See

     

       243
       239
        
                 <option>bolt.tlsLevel</option>.

     
···

       261
       257
        
               description = ''

     

       262
       258
        
                 Directory for storing certificates to be used by Neo4j for

     

       263
       259
        
                 TLS connections.

     

       264
       264
       -
                 </para>

     

       265
       265
       -
                 <para>

     

       260
       260
       +
       

     

       266
       261
        
                 When setting this directory to something other than its default,

     

       267
       262
        
                 ensure the directory's existence, and that read/write permissions are

     

       268
       263
        
                 given to the Neo4j daemon user <literal>neo4j</literal>.

     

       269
       269
       -
                 </para>

     

       270
       270
       -
                 <para>

     

       264
       264
       +
       

     

       271
       265
        
                 Note that changing this directory from its default will prevent

     

       272
       266
        
                 the directory structure required for each SSL policy from being

     

       273
       267
        
                 automatically generated. A policy's directory structure as defined by

     
···

       286
       280
        
               description = ''

     

       287
       281
        
                 Path of the data directory. You must not configure more than one

     

       288
       282
        
                 Neo4j installation to use the same data directory.

     

       289
       289
       -
                 </para>

     

       290
       290
       -
                 <para>

     

       283
       283
       +
       

     

       291
       284
        
                 When setting this directory to something other than its default,

     

       292
       285
        
                 ensure the directory's existence, and that read/write permissions are

     

       293
       286
        
                 given to the Neo4j daemon user <literal>neo4j</literal>.

     
···

       314
       307
        
                 <literal>LOAD CSV</literal> clause. Only meaningful when

     

       315
       308
        
                 <option>constrainLoadCvs</option> is set to

     

       316
       309
        
                 <literal>true</literal>.

     

       317
       317
       -
                 </para>

     

       318
       318
       -
                 <para>

     

       310
       310
       +
       

     

       319
       311
        
                 When setting this directory to something other than its default,

     

       320
       312
        
                 ensure the directory's existence, and that read permission is

     

       321
       313
        
                 given to the Neo4j daemon user <literal>neo4j</literal>.

     
···

       330
       322
        
                 Path of the database plugin directory. Compiled Java JAR files that

     

       331
       323
        
                 contain database procedures will be loaded if they are placed in

     

       332
       324
        
                 this directory.

     

       333
       333
       -
                 </para>

     

       334
       334
       -
                 <para>

     

       325
       325
       +
       

     

       335
       326
        
                 When setting this directory to something other than its default,

     

       336
       327
        
                 ensure the directory's existence, and that read permission is

     

       337
       328
        
                 given to the Neo4j daemon user <literal>neo4j</literal>.

     
···

       388
       379
        
               default = "legacy";

     

       389
       380
        
               description = ''

     

       390
       381
        
                 Neo4j SSL policy for HTTPS traffic.

     

       391
       391
       -
                 </para>

     

       392
       392
       -
                 <para>

     

       382
       382
       +
       

     

       393
       383
        
                 The legacy policy is a special policy which is not defined in the

     

       394
       384
        
                 policy configuration section, but rather derives from

     

       395
       385
        
                 <option>directories.certificates</option> and

     
···

       422
       412
        
                     certificate. Only performed when both objects cannot be found for

     

       423
       413
        
                     this policy. It is recommended to turn this off again after keys

     

       424
       414
        
                     have been generated.

     

       425
       425
       -
                     </para>

     

       426
       426
       -
                     <para>

     

       415
       415
       +
       

     

       427
       416
        
                     The public certificate is required to be duplicated to the

     

       428
       417
        
                     directory holding trusted certificates as defined by the

     

       429
       418
        
                     <option>trustedDir</option> option.

     

       430
       430
       -
                     </para>

     

       431
       431
       -
                     <para>

     

       419
       419
       +
       

     

       432
       420
        
                     Keys should in general be generated and distributed offline by a

     

       433
       421
        
                     trusted certificate authority and not by utilizing this mode.

     

       434
       422
        
                   '';

     
···

       444
       432
        
                     option as well as <option>directories.certificates</option> are

     

       445
       433
        
                     left at their default. Ensure read/write permissions are given

     

       446
       434
        
                     to the Neo4j daemon user <literal>neo4j</literal>.

     

       447
       447
       -
                     </para>

     

       448
       448
       -
                     <para>

     

       435
       435
       +
       

     

       449
       436
        
                     It is also possible to override each individual

     

       450
       437
        
                     configuration with absolute paths. See the

     

       451
       438
        
                     <option>privateKey</option> and <option>publicCertificate</option>

     
···

       488
       475
        
                     for this policy to be found in the <option>baseDirectory</option>,

     

       489
       476
        
                     or the absolute path to the certificate file. It is mandatory

     

       490
       477
        
                     that a certificate can be found or generated.

     

       491
       491
       -
                     </para>

     

       492
       492
       -
                     <para>

     

       478
       478
       +
       

     

       493
       479
        
                     The public certificate is required to be duplicated to the

     

       494
       480
        
                     directory holding trusted certificates as defined by the

     

       495
       481
        
                     <option>trustedDir</option> option.

     
···

       545
       531
        
                     <option>directories.certificates</option> to something other than

     

       546
       532
        
                     their default. Ensure read/write permissions are given to the

     

       547
       533
        
                     Neo4j daemon user <literal>neo4j</literal>.

     

       548
       548
       -
                     </para>

     

       549
       549
       -
                     <para>

     

       534
       534
       +
       

     

       550
       535
        
                     The public certificate as defined by

     

       551
       536
        
                     <option>publicCertificate</option> is required to be duplicated

     

       552
       537
        
                     to this directory.

+2 -2

nixos/modules/services/databases/pgmanage.nix

···

       64
       64
        
             };

     

       65
       65
        
             description = ''

     

       66
       66
        
               pgmanage requires at least one PostgreSQL server be defined.

     

       67
       67
       -
               </para><para>

     

       67
       67
       +
       

     

       68
       68
        
               Detailed information about PostgreSQL connection strings is available at:

     

       69
       69
        
               <link xlink:href="http://www.postgresql.org/docs/current/static/libpq-connect.html"/>

     

       70
       70
       -
               </para><para>

     

       70
       70
       +
       

     

       71
       71
        
               Note that you should not specify your user name or password. That

     

       72
       72
        
               information will be entered on the login screen. If you specify a

     

       73
       73
        
               username or password, it will be removed by pgmanage before attempting to

+3 -6

nixos/modules/services/hardware/lcd.nix

···

       63
       63
        
                 default = false;

     

       64
       64
        
                 description = ''

     

       65
       65
        
                   Set group-write permissions on a USB device.

     

       66
       66
       -
                   </para>

     

       67
       67
       -
                   <para>

     

       66
       66
       +
       

     

       68
       67
        
                   A USB connected LCD panel will most likely require having its

     

       69
       68
        
                   permissions modified for lcdd to write to it. Enabling this option

     

       70
       69
        
                   sets group-write permissions on the device identified by

     
···

       72
       71
        
                   <option>services.hardware.lcd.usbPid</option>. In order to find the

     

       73
       72
        
                   values, you can run the <command>lsusb</command> command. Example

     

       74
       73
        
                   output:

     

       75
       75
       -
                   </para>

     

       76
       76
       -
                   <para>

     

       74
       74
       +
       

     

       77
       75
        
                   <literal>

     

       78
       76
        
                   Bus 005 Device 002: ID 0403:c630 Future Technology Devices International, Ltd lcd2usb interface

     

       79
       77
        
                   </literal>

     

       80
       80
       -
                   </para>

     

       81
       81
       -
                   <para>

     

       78
       78
       +
       

     

       82
       79
        
                   In this case the vendor id is 0403 and the product id is c630.

     

       83
       80
        
                 '';

     

       84
       81
        
               };

-6

nixos/modules/services/matrix/appservice-discord.nix

···

       42
       42
        
               '';

     

       43
       43
        
               description = ''

     

       44
       44
        
                 <filename>config.yaml</filename> configuration as a Nix attribute set.

     

       45
       45
       -
                 </para>

     

       46
       45
        
       

     

       47
       47
       -
                 <para>

     

       48
       46
        
                 Configuration options should match those described in

     

       49
       47
        
                 <link xlink:href="https://github.com/Half-Shot/matrix-appservice-discord/blob/master/config/config.sample.yaml">

     

       50
       48
        
                 config.sample.yaml</link>.

     

       51
       51
       -
                 </para>

     

       52
       49
        
       

     

       53
       53
       -
                 <para>

     

       54
       50
        
                 <option>config.bridge.domain</option> and <option>config.bridge.homeserverUrl</option>

     

       55
       51
        
                 should be set to match the public host name of the Matrix homeserver for webhooks and avatars to work.

     

       56
       56
       -
                 </para>

     

       57
       52
        
       

     

       58
       58
       -
                 <para>

     

       59
       53
        
                 Secret tokens should be specified using <option>environmentFile</option>

     

       60
       54
        
                 instead of this world-readable attribute set.

     

       61
       55
        
               '';

-2

nixos/modules/services/matrix/mautrix-facebook.nix

···

       80
       80
        
                 Configuration options should match those described in

     

       81
       81
        
                 <link xlink:href="https://github.com/mautrix/facebook/blob/master/mautrix_facebook/example-config.yaml">

     

       82
       82
        
                 example-config.yaml</link>.

     

       83
       83
       -
                 </para>

     

       84
       83
        
       

     

       85
       85
       -
                 <para>

     

       86
       84
        
                 Secret tokens should be specified using <option>environmentFile</option>

     

       87
       85
        
                 instead of this world-readable attribute set.

     

       88
       86
        
               '';

-2

nixos/modules/services/matrix/mautrix-telegram.nix

···

       83
       83
        
                 Configuration options should match those described in

     

       84
       84
        
                 <link xlink:href="https://github.com/tulir/mautrix-telegram/blob/master/example-config.yaml">

     

       85
       85
        
                 example-config.yaml</link>.

     

       86
       86
       -
                 </para>

     

       87
       86
        
       

     

       88
       88
       -
                 <para>

     

       89
       87
        
                 Secret tokens should be specified using <option>environmentFile</option>

     

       90
       88
        
                 instead of this world-readable attribute set.

     

       91
       89
        
               '';

+2 -2

nixos/modules/services/misc/autorandr.nix

···

       154
       154
        
               });

     

       155
       155
        
               description = ''

     

       156
       156
        
                 Output scale configuration.

     

       157
       157
       -
                 </para><para>

     

       157
       157
       +
       

     

       158
       158
        
                 Either configure by pixels or a scaling factor. When using pixel method the

     

       159
       159
        
                 <citerefentry>

     

       160
       160
        
                   <refentrytitle>xrandr</refentrytitle>

     
···

       165
       165
        
                 will be used; when using factor method the option

     

       166
       166
        
                 <parameter class="command">--scale</parameter>

     

       167
       167
        
                 will be used.

     

       168
       168
       -
                 </para><para>

     

       168
       168
       +
       

     

       169
       169
        
                 This option is a shortcut version of the transform option and they are mutually

     

       170
       170
        
                 exclusive.

     

       171
       171
        
               '';

+3 -6

nixos/modules/services/misc/bees.nix

···

       17
       17
        
               not configure multiple instances for subvolumes of the same filesystem

     

       18
       18
        
               (or block devices which are part of the same filesystem), but only for

     

       19
       19
        
               completely independent btrfs filesystems.

     

       20
       20
       -
               </para>

     

       21
       21
       -
               <para>

     

       20
       20
       +
       

     

       22
       21
        
               This must be in a format usable by findmnt; that could be a key=value

     

       23
       22
        
               pair, or a bare path to a mount point.

     

       24
       23
        
               Using bare paths will allow systemd to start the beesd service only

     
···

       31
       30
        
             default = 1024; # 1GB; default from upstream beesd script

     

       32
       31
        
             description = ''

     

       33
       32
        
               Hash table size in MB; must be a multiple of 16.

     

       34
       34
       -
               </para>

     

       35
       35
       -
               <para>

     

       33
       33
       +
       

     

       36
       34
        
               A larger ratio of index size to storage size means smaller blocks of

     

       37
       35
        
               duplicate content are recognized.

     

       38
       38
       -
               </para>

     

       39
       39
       -
               <para>

     

       36
       36
       +
       

     

       40
       37
        
               If you have 1TB of data, a 4GB hash table (which is to say, a value of

     

       41
       38
        
               4096) will permit 4KB extents (the smallest possible size) to be

     

       42
       39
        
               recognized, whereas a value of 1024 -- creating a 1GB hash table --

+2 -4

nixos/modules/services/misc/nix-daemon.nix

···

       636
       636
        
                   <manvolnum>5</manvolnum>

     

       637
       637
        
                 </citerefentry> for avalaible options.

     

       638
       638
        
                 The value declared here will be translated directly to the key-value pairs Nix expects.

     

       639
       639
       -
                 </para>

     

       640
       640
       -
                 <para>

     

       639
       639
       +
       

     

       641
       640
        
                 You can use <command>nix-instantiate --eval --strict '&lt;nixpkgs/nixos&gt;' -A config.nix.settings</command>

     

       642
       641
        
                 to view the current value. By default it is empty.

     

       643
       643
       -
                 </para>

     

       644
       644
       -
                 <para>

     

       642
       642
       +
       

     

       645
       643
        
                 Nix configurations defined under <option>nix.*</option> will be translated and applied to this

     

       646
       644
        
                 option. In addition, configuration specified in <option>nix.extraOptions</option> which will be appended

     

       647
       645
        
                 verbatim to the resulting config file.

+1 -3

nixos/modules/services/misc/zoneminder.nix

···

       68
       68
        
           services.zoneminder = with lib; {

     

       69
       69
        
             enable = lib.mkEnableOption ''

     

       70
       70
        
               ZoneMinder

     

       71
       71
       -
               </para><para>

     

       71
       71
       +
       

     

       72
       72
        
               If you intend to run the database locally, you should set

     

       73
       73
        
               `config.services.zoneminder.database.createLocally` to true. Otherwise,

     

       74
       74
        
               when set to `false` (the default), you will have to create the database

     
···

       82
       82
        
               default = "nginx";

     

       83
       83
        
               description = ''

     

       84
       84
        
                 The webserver to configure for the PHP frontend.

     

       85
       85
       -
                 </para>

     

       86
       86
       -
                 <para>

     

       87
       85
        
       

     

       88
       86
        
                 Set it to `none` if you want to configure it yourself. PRs are welcome

     

       89
       87
        
                 for support for other web servers.

+2 -2

nixos/modules/services/monitoring/netdata.nix

···

       118
       118
        
                 Extra paths to add to the netdata global "plugins directory"

     

       119
       119
        
                 option.  Useful for when you want to include your own

     

       120
       120
        
                 collection scripts.

     

       121
       121
       -
                 </para><para>

     

       121
       121
       +
       

     

       122
       122
        
                 Details about writing a custom netdata plugin are available at:

     

       123
       123
        
                 <link xlink:href="https://docs.netdata.cloud/collectors/plugins.d/"/>

     

       124
       124
       -
                 </para><para>

     

       124
       124
       +
       

     

       125
       125
        
                 Cannot be combined with configText.

     

       126
       126
        
               '';

     

       127
       127
        
             };

+2 -3

nixos/modules/services/networking/networkmanager.nix

···

       329
       329
        
               default = "default";

     

       330
       330
        
               description = ''

     

       331
       331
        
                 Set the DNS (<literal>resolv.conf</literal>) processing mode.

     

       332
       332
       -
                 </para>

     

       333
       333
       -
                 <para>

     

       332
       332
       +
       

     

       334
       333
        
                 A description of these modes can be found in the main section of

     

       335
       334
        
                 <link xlink:href="https://developer.gnome.org/NetworkManager/stable/NetworkManager.conf.html">

     

       336
       335
        
                   https://developer.gnome.org/NetworkManager/stable/NetworkManager.conf.html

     
···

       390
       389
        
               default = false;

     

       391
       390
        
               description = ''

     

       392
       391
        
                 Enable the StrongSwan plugin.

     

       393
       393
       -
                 </para><para>

     

       392
       392
       +
       

     

       394
       393
        
                 If you enable this option the

     

       395
       394
        
                 <literal>networkmanager_strongswan</literal> plugin will be added to

     

       396
       395
        
                 the <option>networking.networkmanager.plugins</option> option

+3 -6

nixos/modules/services/networking/ntp/ntpd.nix

···

       43
       43
        
               description = ''

     

       44
       44
        
                 Whether to synchronise your machine's time using ntpd, as a peer in

     

       45
       45
        
                 the NTP network.

     

       46
       46
       -
                 </para>

     

       47
       47
       -
                 <para>

     

       46
       46
       +
       

     

       48
       47
        
                 Disables <literal>systemd.timesyncd</literal> if enabled.

     

       49
       48
        
               '';

     

       50
       49
        
             };

     
···

       53
       52
        
               type = types.listOf types.str;

     

       54
       53
        
               description = ''

     

       55
       54
        
                 The restriction flags to be set by default.

     

       56
       56
       -
                 </para>

     

       57
       57
       -
                 <para>

     

       55
       55
       +
       

     

       58
       56
        
                 The default flags prevent external hosts from using ntpd as a DDoS

     

       59
       57
        
                 reflector, setting system time, and querying OS/ntpd version. As

     

       60
       58
        
                 recommended in section 6.5.1.1.3, answer "No" of

     
···

       67
       65
        
               type = types.listOf types.str;

     

       68
       66
        
               description = ''

     

       69
       67
        
                 The restriction flags to be set on source.

     

       70
       70
       -
                 </para>

     

       71
       71
       -
                 <para>

     

       68
       68
       +
       

     

       72
       69
        
                 The default flags allow peers to be added by ntpd from configured

     

       73
       70
        
                 pool(s), but not by other means.

     

       74
       71
        
               '';

+3 -6

nixos/modules/services/networking/ssh/sshd.nix

···

       300
       300
        
               ];

     

       301
       301
        
               description = ''

     

       302
       302
        
                 Allowed key exchange algorithms

     

       303
       303
       -
                 </para>

     

       304
       304
       -
                 <para>

     

       303
       303
       +
       

     

       305
       304
        
                 Uses the lower bound recommended in both

     

       306
       305
        
                 <link xlink:href="https://stribika.github.io/2015/01/04/secure-secure-shell.html" />

     

       307
       306
        
                 and

     
···

       321
       320
        
               ];

     

       322
       321
        
               description = ''

     

       323
       322
        
                 Allowed ciphers

     

       324
       324
       -
                 </para>

     

       325
       325
       -
                 <para>

     

       323
       323
       +
       

     

       326
       324
        
                 Defaults to recommended settings from both

     

       327
       325
        
                 <link xlink:href="https://stribika.github.io/2015/01/04/secure-secure-shell.html" />

     

       328
       326
        
                 and

     
···

       342
       340
        
               ];

     

       343
       341
        
               description = ''

     

       344
       342
        
                 Allowed MACs

     

       345
       345
       -
                 </para>

     

       346
       346
       -
                 <para>

     

       343
       343
       +
       

     

       347
       344
        
                 Defaults to recommended settings from both

     

       348
       345
        
                 <link xlink:href="https://stribika.github.io/2015/01/04/secure-secure-shell.html" />

     

       349
       346
        
                 and

+2 -1

nixos/modules/services/networking/strongswan-swanctl/param-constructors.nix

···

       59
       59
        
           if strongswanDefault == null

     

       60
       60
        
           then description

     

       61
       61
        
           else description + ''

     

       62
       62
       -
             </para><para>

     

       62
       62
       +
       

     

       63
       63
       +
       

     

       63
       64
        
             StrongSwan default: <literal><![CDATA[${builtins.toJSON strongswanDefault}]]></literal>

     

       64
       65
        
           '';

     

       65
       66

+45 -45

nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix

···

       15
       15
        
           file = mkOptionalStrParam ''

     

       16
       16
        
             Absolute path to the certificate to load. Passed as-is to the daemon, so

     

       17
       17
        
             it must be readable by it.

     

       18
       18
       -
             </para><para>

     

       18
       18
       +
       

     

       19
       19
        
             Configure either this or <option>handle</option>, but not both, in one section.

     

       20
       20
        
           '';

     

       21
       21
        
       

     

       22
       22
        
           handle = mkOptionalHexParam ''

     

       23
       23
        
             Hex-encoded CKA_ID or handle of the certificate on a token or TPM,

     

       24
       24
        
             respectively.

     

       25
       25
       -
             </para><para>

     

       25
       25
       +
       

     

       26
       26
        
             Configure either this or <option>file</option>, but not both, in one section.

     

       27
       27
        
           '';

     

       28
       28
        
       

     
···

       40
       40
        
           cacert = mkOptionalStrParam ''

     

       41
       41
        
             The certificates may use a relative path from the swanctl

     

       42
       42
        
             <literal>x509ca</literal> directory or an absolute path.

     

       43
       43
       -
             </para><para>

     

       43
       43
       +
       

     

       44
       44
        
             Configure one of <option>cacert</option>,

     

       45
       45
        
             <option>file</option>, or

     

       46
       46
        
             <option>handle</option> per section.

     
···

       82
       82
        
           local_addrs	= mkCommaSepListParam [] ''

     

       83
       83
        
             Local address(es) to use for IKE communication. Takes

     

       84
       84
        
             single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.

     

       85
       85
       -
             </para><para>

     

       85
       85
       +
       

     

       86
       86
        
             As initiator, the first non-range/non-subnet is used to initiate the

     

       87
       87
        
             connection from. As responder, the local destination address must match at

     

       88
       88
        
             least to one of the specified addresses, subnets or ranges.

     

       89
       89
       -
             </para><para>

     

       89
       89
       +
       

     

       90
       90
        
             If FQDNs are assigned they are resolved every time a configuration lookup

     

       91
       91
        
             is done. If DNS resolution times out, the lookup is delayed for that time.

     

       92
       92
        
           '';

     
···

       94
       94
        
           remote_addrs = mkCommaSepListParam [] ''

     

       95
       95
        
             Remote address(es) to use for IKE communication. Takes

     

       96
       96
        
             single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.

     

       97
       97
       -
             </para><para>

     

       97
       97
       +
       

     

       98
       98
        
             As initiator, the first non-range/non-subnet is used to initiate the

     

       99
       99
        
             connection to. As responder, the initiator source address must match at

     

       100
       100
        
             least to one of the specified addresses, subnets or ranges.

     

       101
       101
       -
             </para><para>

     

       101
       101
       +
       

     

       102
       102
        
             If FQDNs are assigned they are resolved every time a configuration lookup

     

       103
       103
        
             is done. If DNS resolution times out, the lookup is delayed for that time.

     

       104
       104
        
             To initiate a connection, at least one specific address or DNS name must

     
···

       110
       110
        
             backend is used, which is usually <literal>500</literal>. If port

     

       111
       111
        
             <literal>500</literal> is used, automatic IKE port floating to port

     

       112
       112
        
             <literal>4500</literal> is used to work around NAT issues.

     

       113
       113
       -
             </para><para>

     

       113
       113
       +
       

     

       114
       114
        
             Using a non-default local IKE port requires support from the socket

     

       115
       115
        
             backend in use (socket-dynamic).

     

       116
       116
        
           '';

     
···

       126
       126
        
             for IKE an encryption algorithm, an integrity algorithm, a pseudo random

     

       127
       127
        
             function and a Diffie-Hellman group. For AEAD algorithms, instead of

     

       128
       128
        
             encryption and integrity algorithms, a combined algorithm is used.

     

       129
       129
       -
             </para><para>

     

       129
       129
       +
       

     

       130
       130
        
             In IKEv2, multiple algorithms of the same kind can be specified in a

     

       131
       131
        
             single proposal, from which one gets selected. In IKEv1, only one

     

       132
       132
        
             algorithm per kind is allowed per proposal, more algorithms get implicitly

     

       133
       133
        
             stripped. Use multiple proposals to offer different algorithms

     

       134
       134
        
             combinations in IKEv1.

     

       135
       135
       -
             </para><para>

     

       135
       135
       +
       

     

       136
       136
        
             Algorithm keywords get separated using dashes. Multiple proposals may be

     

       137
       137
        
             specified in a list. The special value <literal>default</literal> forms a

     

       138
       138
        
             default proposal of supported algorithms considered safe, and is usually a

     
···

       159
       159
        
             If the default of yes is used, Mode Config works in pull mode, where the

     

       160
       160
        
             initiator actively requests a virtual IP. With no, push mode is used,

     

       161
       161
        
             where the responder pushes down a virtual IP to the initiating peer.

     

       162
       162
       -
             </para><para>

     

       162
       162
       +
       

     

       163
       163
        
             Push mode is currently supported for IKEv1, but not in IKEv2. It is used

     

       164
       164
        
             by a few implementations only, pull mode is recommended.

     

       165
       165
        
           '';

     
···

       174
       174
        
             To enforce UDP encapsulation of ESP packets, the IKE daemon can fake the

     

       175
       175
        
             NAT detection payloads. This makes the peer believe that NAT takes place

     

       176
       176
        
             on the path, forcing it to encapsulate ESP packets in UDP.

     

       177
       177
       -
             </para><para>

     

       177
       177
       +
       

     

       178
       178
        
             Usually this is not required, but it can help to work around connectivity

     

       179
       179
        
             issues with too restrictive intermediary firewalls.

     

       180
       180
        
           '';

     
···

       183
       183
        
             Enables MOBIKE on IKEv2 connections. MOBIKE is enabled by default on IKEv2

     

       184
       184
        
             connections, and allows mobility of clients and multi-homing on servers by

     

       185
       185
        
             migrating active IPsec tunnels.

     

       186
       186
       -
             </para><para>

     

       186
       186
       +
       

     

       187
       187
        
             Usually keeping MOBIKE enabled is unproblematic, as it is not used if the

     

       188
       188
        
             peer does not indicate support for it. However, due to the design of

     

       189
       189
        
             MOBIKE, IKEv2 always floats to port 4500 starting from the second

     
···

       222
       222
        
             <listitem><para>Finally, setting the option to <literal>no</literal> will disable announcing

     

       223
       223
        
             support for this feature.</para></listitem>

     

       224
       224
        
             </itemizedlist>

     

       225
       225
       -
             </para><para>

     

       225
       225
       +
       

     

       226
       226
        
             Note that fragmented IKE messages sent by a peer are always processed

     

       227
       227
        
             irrespective of the value of this option (even when set to no).

     

       228
       228
        
           '';

     
···

       284
       284
        
           unique = mkEnumParam ["no" "never" "keep" "replace"] "no" ''

     

       285
       285
        
             Connection uniqueness policy to enforce. To avoid multiple connections

     

       286
       286
        
             from the same user, a uniqueness policy can be enforced.

     

       287
       287
       -
             </para><para>

     

       287
       287
       +
       

     

       288
       288
        
             <itemizedlist>

     

       289
       289
        
             <listitem><para>

     

       290
       290
        
             The value <literal>never</literal> does never enforce such a policy, even

     
···

       306
       306
        
             To compare connections for uniqueness, the remote IKE identity is used. If

     

       307
       307
        
             EAP or XAuth authentication is involved, the EAP-Identity or XAuth

     

       308
       308
        
             username is used to enforce the uniqueness policy instead.

     

       309
       309
       -
             </para><para>

     

       309
       309
       +
       

     

       310
       310
        
             On initiators this setting specifies whether an INITIAL_CONTACT notify is

     

       311
       311
        
             sent during IKE_AUTH if no existing connection is found with the remote

     

       312
       312
        
             peer (determined by the identities of the first authentication

     
···

       320
       320
        
             possible to actively reauthenticate as responder. The IKEv2

     

       321
       321
        
             reauthentication lifetime negotiation can instruct the client to perform

     

       322
       322
        
             reauthentication.

     

       323
       323
       -
             </para><para>

     

       323
       323
       +
       

     

       324
       324
        
             Reauthentication is disabled by default. Enabling it usually may lead to

     

       325
       325
        
             small connection interruptions, as strongSwan uses a break-before-make

     

       326
       326
        
             policy with IKEv2 to avoid any conflicts with associated tunnel resources.

     
···

       330
       330
        
             IKE rekeying refreshes key material using a Diffie-Hellman exchange, but

     

       331
       331
        
             does not re-check associated credentials. It is supported in IKEv2 only,

     

       332
       332
        
             IKEv1 performs a reauthentication procedure instead.

     

       333
       333
       -
             </para><para>

     

       333
       333
       +
       

     

       334
       334
        
             With the default value IKE rekeying is scheduled every 4 hours, minus the

     

       335
       335
        
             configured rand_time. If a reauth_time is configured, rekey_time defaults

     

       336
       336
        
             to zero, disabling rekeying; explicitly set both to enforce rekeying and

     
···

       343
       343
        
             perpetually, a maximum hard lifetime may be specified. If the IKE_SA fails

     

       344
       344
        
             to rekey or reauthenticate within the specified time, the IKE_SA gets

     

       345
       345
        
             closed.

     

       346
       346
       -
             </para><para>

     

       346
       346
       +
       

     

       347
       347
        
             In contrast to CHILD_SA rekeying, over_time is relative in time to the

     

       348
       348
        
             rekey_time and reauth_time values, as it applies to both.

     

       349
       349
       -
             </para><para>

     

       349
       349
       +
       

     

       350
       350
        
             The default is 10% of the longer of <option>rekey_time</option> and

     

       351
       351
        
             <option>reauth_time</option>.

     

       352
       352
        
           '';

     
···

       356
       356
        
             rekey/reauth times. To avoid having both peers initiating the rekey/reauth

     

       357
       357
        
             procedure simultaneously, a random time gets subtracted from the

     

       358
       358
        
             rekey/reauth times.

     

       359
       359
       -
             </para><para>

     

       359
       359
       +
       

     

       360
       360
        
             The default is equal to the configured <option>over_time</option>.

     

       361
       361
        
           '';

     

       362
       362
        
       

     
···

       410
       410
        
               List of certificate candidates to use for

     

       411
       411
        
               authentication. The certificates may use a relative path from the

     

       412
       412
        
               swanctl <literal>x509</literal> directory or an absolute path.

     

       413
       413
       -
               </para><para>

     

       413
       413
       +
       

     

       414
       414
        
               The certificate used for authentication is selected based on the

     

       415
       415
        
               received certificate request payloads. If no appropriate CA can be

     

       416
       416
        
               located, the first certificate is used.

     
···

       426
       426
        
               List of raw public key candidates to use for

     

       427
       427
        
               authentication. The public keys may use a relative path from the swanctl

     

       428
       428
        
               <literal>pubkey</literal> directory or an absolute path.

     

       429
       429
       -
               </para><para>

     

       429
       429
       +
       

     

       430
       430
        
               Even though multiple local public keys could be defined in principle,

     

       431
       431
        
               only the first public key in the list is used for authentication.

     

       432
       432
        
             '';

     
···

       504
       504
        
               authentication. This identity may differ from the IKE identity,

     

       505
       505
        
               especially when EAP authentication is delegated from the IKE responder

     

       506
       506
        
               to an AAA backend.

     

       507
       507
       -
               </para><para>

     

       507
       507
       +
       

     

       508
       508
        
               For EAP-(T)TLS, this defines the identity for which the server must

     

       509
       509
        
               provide a certificate in the TLS exchange.

     

       510
       510
        
             '';

     
···

       518
       518
        
             defines the rules how authentication is performed for the local

     

       519
       519
        
             peer. Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple

     

       520
       520
        
             Authentication or IKEv1 XAuth.

     

       521
       521
       -
             </para><para>

     

       521
       521
       +
       

     

       522
       522
        
             Each round is defined in a section having <literal>local</literal> as

     

       523
       523
        
             prefix, and an optional unique suffix. To define a single authentication

     

       524
       524
        
             round, the suffix may be omitted.

     
···

       620
       620
        
               Authentication to expect from remote. See the <option>local</option>

     

       621
       621
        
               section's <option>auth</option> keyword description about the details of

     

       622
       622
        
               supported mechanisms.

     

       623
       623
       -
               </para><para>

     

       623
       623
       +
       

     

       624
       624
        
               Since 5.4.0, to require a trustchain public key strength for the remote

     

       625
       625
        
               side, specify the key type followed by the minimum strength in bits (for

     

       626
       626
        
               example <literal>ecdsa-384</literal> or

     
···

       641
       641
        
               <literal>pubkey</literal> or <literal>rsa</literal> constraints are

     

       642
       642
        
               configured RSASSA-PSS signatures will only be accepted if enabled in

     

       643
       643
        
               <literal>strongswan.conf</literal>(5).

     

       644
       644
       -
               </para><para>

     

       644
       644
       +
       

     

       645
       645
        
               To specify trust chain constraints for EAP-(T)TLS, append a colon to the

     

       646
       646
        
               EAP method, followed by the key type/size and hash algorithm as

     

       647
       647
        
               discussed above (e.g. <literal>eap-tls:ecdsa-384-sha384</literal>).

     
···

       652
       652
        
             defines the constraints how the peers must authenticate to use this

     

       653
       653
        
             connection. Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple

     

       654
       654
        
             Authentication or IKEv1 XAuth.

     

       655
       655
       -
             </para><para>

     

       655
       655
       +
       

     

       656
       656
        
             Each round is defined in a section having <literal>remote</literal> as

     

       657
       657
        
             prefix, and an optional unique suffix. To define a single authentication

     

       658
       658
        
             round, the suffix may be omitted.

     
···

       665
       665
        
               Diffie-Hellman group. If a DH group is specified, CHILD_SA/Quick Mode

     

       666
       666
        
               rekeying and initial negotiation uses a separate Diffie-Hellman exchange

     

       667
       667
        
               using the specified group (refer to esp_proposals for details).

     

       668
       668
       -
               </para><para>

     

       668
       668
       +
       

     

       669
       669
        
               In IKEv2, multiple algorithms of the same kind can be specified in a

     

       670
       670
        
               single proposal, from which one gets selected. In IKEv1, only one

     

       671
       671
        
               algorithm per kind is allowed per proposal, more algorithms get

     

       672
       672
        
               implicitly stripped. Use multiple proposals to offer different algorithms

     

       673
       673
        
               combinations in IKEv1.

     

       674
       674
       -
               </para><para>

     

       674
       674
       +
       

     

       675
       675
        
               Algorithm keywords get separated using dashes. Multiple proposals may be

     

       676
       676
        
               specified in a list. The special value <literal>default</literal> forms

     

       677
       677
        
               a default proposal of supported algorithms considered safe, and is

     
···

       686
       686
        
               an optional Extended Sequence Number Mode indicator. For AEAD proposals,

     

       687
       687
        
               a combined mode algorithm is used instead of the separate

     

       688
       688
        
               encryption/integrity algorithms.

     

       689
       689
       -
               </para><para>

     

       689
       689
       +
       

     

       690
       690
        
               If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial

     

       691
       691
        
               negotiation use a separate Diffie-Hellman exchange using the specified

     

       692
       692
        
               group. However, for IKEv2, the keys of the CHILD_SA created implicitly

     
···

       695
       695
        
               rekeyed or is created with a separate CREATE_CHILD_SA exchange. A

     

       696
       696
        
               proposal mismatch might, therefore, not immediately be noticed when the

     

       697
       697
        
               SA is established, but may later cause rekeying to fail.

     

       698
       698
       -
               </para><para>

     

       698
       698
       +
       

     

       699
       699
        
               Extended Sequence Number support may be indicated with the

     

       700
       700
        
               <literal>esn</literal> and <literal>noesn</literal> values, both may be

     

       701
       701
        
               included to indicate support for both modes. If omitted,

     

       702
       702
        
               <literal>noesn</literal> is assumed.

     

       703
       703
       -
               </para><para>

     

       703
       703
       +
       

     

       704
       704
        
               In IKEv2, multiple algorithms of the same kind can be specified in a

     

       705
       705
        
               single proposal, from which one gets selected. In IKEv1, only one

     

       706
       706
        
               algorithm per kind is allowed per proposal, more algorithms get

     

       707
       707
        
               implicitly stripped. Use multiple proposals to offer different algorithms

     

       708
       708
        
               combinations in IKEv1.

     

       709
       709
       -
               </para><para>

     

       709
       709
       +
       

     

       710
       710
        
               Algorithm keywords get separated using dashes. Multiple proposals may be

     

       711
       711
        
               specified as a list. The special value <literal>default</literal> forms

     

       712
       712
        
               a default proposal of supported algorithms considered safe, and is

     
···

       729
       729
        
               selector. The special value <literal>dynamic</literal> may be used

     

       730
       730
        
               instead of a subnet definition, which gets replaced by the tunnel outer

     

       731
       731
        
               address or the virtual IP, if negotiated. This is the default.

     

       732
       732
       -
               </para><para>

     

       732
       732
       +
       

     

       733
       733
        
               A protocol/port selector is surrounded by opening and closing square

     

       734
       734
        
               brackets. Between these brackets, a numeric or getservent(3) protocol

     

       735
       735
        
               name may be specified. After the optional protocol restriction, an

     
···

       738
       738
        
               special value <literal>opaque</literal> for RFC 4301 OPAQUE

     

       739
       739
        
               selectors. Port ranges may be specified as well, none of the kernel

     

       740
       740
        
               backends currently support port ranges, though.

     

       741
       741
       -
               </para><para>

     

       741
       741
       +
       

     

       742
       742
        
               When IKEv1 is used only the first selector is interpreted, except if the

     

       743
       743
        
               Cisco Unity extension plugin is used. This is due to a limitation of the

     

       744
       744
        
               IKEv1 protocol, which only allows a single pair of selectors per

     
···

       761
       761
        
               specified in the proposal.  To avoid rekey collisions initiated by both

     

       762
       762
        
               ends simultaneously, a value in the range of <option>rand_time</option>

     

       763
       763
        
               gets subtracted to form the effective soft lifetime.

     

       764
       764
       -
               </para><para>

     

       764
       764
       +
       

     

       765
       765
        
               By default CHILD_SA rekeying is scheduled every hour, minus

     

       766
       766
        
               <option>rand_time</option>.

     

       767
       767
        
             '';

     
···

       783
       783
        
               Number of bytes processed before initiating CHILD_SA rekeying. CHILD_SA

     

       784
       784
        
               rekeying refreshes key material, optionally using a Diffie-Hellman

     

       785
       785
        
               exchange if a group is specified in the proposal.

     

       786
       786
       -
               </para><para>

     

       786
       786
       +
       

     

       787
       787
        
               To avoid rekey collisions initiated by both ends simultaneously, a value

     

       788
       788
        
               in the range of <option>rand_bytes</option> gets subtracted to form the

     

       789
       789
        
               effective soft volume limit.

     

       790
       790
       -
               </para><para>

     

       790
       790
       +
       

     

       791
       791
        
               Volume based CHILD_SA rekeying is disabled by default.

     

       792
       792
        
             '';

     

       793
       793
        
       

     
···

       808
       808
        
               Number of packets processed before initiating CHILD_SA rekeying. CHILD_SA

     

       809
       809
        
               rekeying refreshes key material, optionally using a Diffie-Hellman

     

       810
       810
        
               exchange if a group is specified in the proposal.

     

       811
       811
       -
               </para><para>

     

       811
       811
       +
       

     

       812
       812
        
               To avoid rekey collisions initiated by both ends simultaneously, a value

     

       813
       813
        
               in the range of <option>rand_packets</option> gets subtracted to form

     

       814
       814
        
               the effective soft packet count limit.

     

       815
       815
       -
               </para><para>

     

       815
       815
       +
       

     

       816
       816
        
               Packet count based CHILD_SA rekeying is disabled by default.

     

       817
       817
        
             '';

     

       818
       818
        
       

     
···

       821
       821
        
               this hard packets limit is never reached, because the CHILD_SA gets

     

       822
       822
        
               rekeyed before. If that fails for whatever reason, this limit closes the

     

       823
       823
        
               CHILD_SA.

     

       824
       824
       -
               </para><para>

     

       824
       824
       +
       

     

       825
       825
        
               The default is 10% more than <option>rekey_bytes</option>.

     

       826
       826
        
             '';

     

       827
       827
        
       

     
···

       936
       936
        
               <literal>%unique</literal> sets a unique mark on each CHILD_SA instance,

     

       937
       937
        
               beyond that the value <literal>%unique-dir</literal> assigns a different

     

       938
       938
        
               unique mark for each

     

       939
       939
       -
               </para><para>

     

       939
       939
       +
       

     

       940
       940
        
               An additional mask may be appended to the mark, separated by

     

       941
       941
        
               <literal>/</literal>. The default mask if omitted is

     

       942
       942
        
               <literal>0xffffffff</literal>.

     
···

       960
       960
        
               value <literal>%unique</literal> sets a unique mark on each CHILD_SA

     

       961
       961
        
               instance, beyond that the value <literal>%unique-dir</literal> assigns a

     

       962
       962
        
               different unique mark for each CHILD_SA direction (in/out).

     

       963
       963
       -
               </para><para>

     

       963
       963
       +
       

     

       964
       964
        
               An additional mask may be appended to the mark, separated by

     

       965
       965
        
               <literal>/</literal>. The default mask if omitted is

     

       966
       966
        
               <literal>0xffffffff</literal>.

     
···

       1102
       1102
        
               <literal>start</literal> tries to re-create the CHILD_SA.

     

       1103
       1103
        
               </para></listitem>

     

       1104
       1104
        
               </itemizedlist>

     

       1105
       1105
       -
               </para><para>

     

       1105
       1105
       +
       

     

       1106
       1106
        
               <option>close_action</option> does not provide any guarantee that the

     

       1107
       1107
        
               CHILD_SA is kept alive. It acts on explicit close messages only, but not

     

       1108
       1108
        
               on negotiation failures. Use trap policies to reliably re-create failed

+7 -14

nixos/modules/services/networking/znc/default.nix

···

       156
       156
        
                 format ZNC expects. This is much more flexible than the legacy options

     

       157
       157
        
                 under <option>services.znc.confOptions.*</option>, but also can't do

     

       158
       158
        
                 any type checking.

     

       159
       159
       -
                 </para>

     

       160
       160
       -
                 <para>

     

       159
       159
       +
       

     

       161
       160
        
                 You can use <command>nix-instantiate --eval --strict '&lt;nixpkgs/nixos&gt;' -A config.services.znc.config</command>

     

       162
       161
        
                 to view the current value. By default it contains a listener for port

     

       163
       162
        
                 5000 with SSL enabled.

     

       164
       164
       -
                 </para>

     

       165
       165
       -
                 <para>

     

       163
       163
       +
       

     

       166
       164
        
                 Nix attributes called <literal>extraConfig</literal> will be inserted

     

       167
       165
        
                 verbatim into the resulting config file.

     

       168
       168
       -
                 </para>

     

       169
       169
       -
                 <para>

     

       166
       166
       +
       

     

       170
       167
        
                 If <option>services.znc.useLegacyConfig</option> is turned on, the

     

       171
       168
        
                 option values in <option>services.znc.confOptions.*</option> will be

     

       172
       169
        
                 gracefully be applied to this option.

     

       173
       173
       -
                 </para>

     

       174
       174
       -
                 <para>

     

       170
       170
       +
       

     

       175
       171
        
                 If you intend to update the configuration through this option, be sure

     

       176
       172
        
                 to enable <option>services.znc.mutable</option>, otherwise none of the

     

       177
       173
        
                 changes here will be applied after the initial deploy.

     
···

       184
       180
        
               description = ''

     

       185
       181
        
                 Configuration file for ZNC. It is recommended to use the

     

       186
       182
        
                 <option>config</option> option instead.

     

       187
       187
       -
                 </para>

     

       188
       188
       -
                 <para>

     

       183
       183
       +
       

     

       189
       184
        
                 Setting this option will override any auto-generated config file

     

       190
       185
        
                 through the <option>confOptions</option> or <option>config</option>

     

       191
       186
        
                 options.

     
···

       208
       203
        
                 Indicates whether to allow the contents of the

     

       209
       204
        
                 <literal>dataDir</literal> directory to be changed by the user at

     

       210
       205
        
                 run-time.

     

       211
       211
       -
                 </para>

     

       212
       212
       -
                 <para>

     

       206
       206
       +
       

     

       213
       207
        
                 If enabled, modifications to the ZNC configuration after its initial

     

       214
       208
        
                 creation are not overwritten by a NixOS rebuild. If disabled, the

     

       215
       209
        
                 ZNC configuration is rebuilt on every NixOS rebuild.

     

       216
       216
       -
                 </para>

     

       217
       217
       -
                 <para>

     

       210
       210
       +
       

     

       218
       211
        
                 If the user wants to manage the ZNC service using the web admin

     

       219
       212
        
                 interface, this option should be enabled.

     

       220
       213
        
               '';

+1 -2

nixos/modules/services/networking/znc/options.nix

···

       106
       106
        
                 <option>services.znc.confOptions.*</option> options.

     

       107
       107
        
                 You can use <command>nix-instantiate --eval --strict '&lt;nixpkgs/nixos&gt;' -A config.services.znc.config</command>

     

       108
       108
        
                 to view the current value of the config.

     

       109
       109
       -
                 </para>

     

       110
       110
       -
                 <para>

     

       109
       109
       +
       

     

       111
       110
        
                 In any case, if you need more flexibility,

     

       112
       111
        
                 <option>services.znc.config</option> can be used to override/add to

     

       113
       112
        
                 all of the legacy options.

+1 -2

nixos/modules/services/x11/desktop-managers/plasma5.nix

···

       172
       172
        
             default = false;

     

       173
       173
        
             description = ''

     

       174
       174
        
               Support setting monitor brightness via DDC.

     

       175
       175
       -
               </para>

     

       176
       176
       -
               <para>

     

       175
       175
       +
       

     

       177
       176
        
               This is not needed for controlling brightness of the internal monitor

     

       178
       177
        
               of a laptop and as it is considered experimental by upstream, it is

     

       179
       178
        
               disabled by default.

+1 -1

nixos/modules/system/activation/top-level.nix

···

       335
       335
        
             '';

     

       336
       336
        
             description = ''

     

       337
       337
        
               The name of the system used in the <option>system.build.toplevel</option> derivation.

     

       338
       338
       -
               </para><para>

     

       338
       338
       +
       

     

       339
       339
        
               That derivation has the following name:

     

       340
       340
        
               <literal>"nixos-system-''${config.system.name}-''${config.system.nixos.label}"</literal>

     

       341
       341
        
             '';

+6 -6

nixos/modules/system/boot/loader/grub/grub.nix

···

       624
       624
        
               type = types.bool;

     

       625
       625
        
               description = ''

     

       626
       626
        
                 Whether to invoke <literal>grub-install</literal> with

     

       627
       627
       -
                 <literal>--removable</literal>.</para>

     

       627
       627
       +
                 <literal>--removable</literal>.

     

       628
       628
        
       

     

       629
       629
       -
                 <para>Unless you turn this on, GRUB will install itself somewhere in

     

       629
       629
       +
                 Unless you turn this on, GRUB will install itself somewhere in

     

       630
       630
        
                 <literal>boot.loader.efi.efiSysMountPoint</literal> (exactly where

     

       631
       631
        
                 depends on other config variables). If you've set

     

       632
       632
        
                 <literal>boot.loader.efi.canTouchEfiVariables</literal> *AND* you

     
···

       637
       637
        
                 NVRAM will not be modified, and your system will not find GRUB at

     

       638
       638
        
                 boot time. However, GRUB will still return success so you may miss

     

       639
       639
        
                 the warning that gets printed ("<literal>efibootmgr: EFI variables

     

       640
       640
       -
                 are not supported on this system.</literal>").</para>

     

       640
       640
       +
                 are not supported on this system.</literal>").

     

       641
       641
        
       

     

       642
       642
       -
                 <para>If you turn this feature on, GRUB will install itself in a

     

       642
       642
       +
                 If you turn this feature on, GRUB will install itself in a

     

       643
       643
        
                 special location within <literal>efiSysMountPoint</literal> (namely

     

       644
       644
        
                 <literal>EFI/boot/boot$arch.efi</literal>) which the firmwares

     

       645
       645
       -
                 are hardcoded to try first, regardless of NVRAM EFI variables.</para>

     

       645
       645
       +
                 are hardcoded to try first, regardless of NVRAM EFI variables.

     

       646
       646
        
       

     

       647
       647
       -
                 <para>To summarize, turn this on if:

     

       647
       647
       +
                 To summarize, turn this on if:

     

       648
       648
        
                 <itemizedlist>

     

       649
       649
        
                   <listitem><para>You are installing NixOS and want it to boot in UEFI mode,

     

       650
       650
        
                   but you are currently booted in legacy mode</para></listitem>

-2

nixos/modules/system/boot/systemd/logind.nix

···

       33
       33
        
               terminated.  If false, the scope is "abandoned" (see

     

       34
       34
        
               <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.scope.html#">

     

       35
       35
        
               systemd.scope(5)</link>), and processes are not killed.

     

       36
       36
       -
               </para>

     

       37
       36
        
       

     

       38
       38
       -
               <para>

     

       39
       37
        
               See <link xlink:href="https://www.freedesktop.org/software/systemd/man/logind.conf.html#KillUserProcesses=">logind.conf(5)</link>

     

       40
       38
        
               for more details.

     

       41
       39
        
             '';

+1 -1

nixos/modules/tasks/scsi-link-power-management.nix

···

       28
       28
        
             description = ''

     

       29
       29
        
               SCSI link power management policy. The kernel default is

     

       30
       30
        
               "max_performance".

     

       31
       31
       -
               </para><para>

     

       31
       31
       +
       

     

       32
       32
        
               "med_power_with_dipm" is supported by kernel versions

     

       33
       33
        
               4.15 and newer.

     

       34
       34
        
             '';