commit 6c47e7d5da028f171def976b0702413eb0ad95a1 · pyrox.dev/nixpkgs

+10 -8

nixos/doc/manual/administration/service-mgmt.chapter.md

···

       126
        
       You can define services by adding them to `systemd.services`:

     

       127
        
       

     

       128
        
       ```nix

     

       129
       -
       systemd.services.myservice = {

     

       130
       -
         after = [ "network-online.target" ];

     

       131
       -
         requires = [ "network-online.target" ];

     

       0
        
       
     

       132
        
       

     

       133
       -
         before = [ "multi-user.target" ];

     

       134
       -
         wantedBy = [ "multi-user.target" ];

     

       135
        
       

     

       136
       -
         serviceConfig = {

     

       137
       -
           ExecStart = "...";

     

       0
        
       
     

       138
        
         };

     

       139
       -
       };

     

       140
        
       ```

     

       141
        
       

     

       142
        
       If you want to specify a multi-line script for `ExecStart`,

···

       126
        
       You can define services by adding them to `systemd.services`:

     

       127
        
       

     

       128
        
       ```nix

     

       129
       +
       {

     

       130
       +
         systemd.services.myservice = {

     

       131
       +
           after = [ "network-online.target" ];

     

       132
       +
           requires = [ "network-online.target" ];

     

       133
        
       

     

       134
       +
           before = [ "multi-user.target" ];

     

       135
       +
           wantedBy = [ "multi-user.target" ];

     

       136
        
       

     

       137
       +
           serviceConfig = {

     

       138
       +
             ExecStart = "...";

     

       139
       +
           };

     

       140
        
         };

     

       141
       +
       }

     

       142
        
       ```

     

       143
        
       

     

       144
        
       If you want to specify a multi-line script for `ExecStart`,

+1 -1

nixos/doc/manual/configuration/adding-custom-packages.section.md

···

       111
        
           extraPkgs = pkgs: [

     

       112
        
             # missing libraries here, e.g.: `pkgs.libepoxy`

     

       113
        
           ];

     

       114
       -
         }

     

       115
        
       }

     

       116
        
       ```

     

       117

···

       111
        
           extraPkgs = pkgs: [

     

       112
        
             # missing libraries here, e.g.: `pkgs.libepoxy`

     

       113
        
           ];

     

       114
       +
         };

     

       115
        
       }

     

       116
        
       ```

     

       117

+1 -1

nixos/doc/manual/configuration/mattermost.chapter.md

···

       33
        
       

     

       34
        
           # For example, to disable auto-installation of prepackaged plugins.

     

       35
        
           settings.PluginSettings.AutomaticPrepackagedPlugins = false;

     

       36
       -
         }

     

       37
        
       }

     

       38
        
       ```

     

       39

···

       33
        
       

     

       34
        
           # For example, to disable auto-installation of prepackaged plugins.

     

       35
        
           settings.PluginSettings.AutomaticPrepackagedPlugins = false;

     

       36
       +
         };

     

       37
        
       }

     

       38
        
       ```

     

       39

+6 -2

nixos/doc/manual/configuration/user-mgmt.chapter.md

···

       137
        
       You can enable Userborn via:

     

       138
        
       

     

       139
        
       ```nix

     

       140
       -
       services.userborn.enable = true;

     

       0
        
       
     

       0
        
       
     

       141
        
       ```

     

       142
        
       

     

       143
        
       You can configure Userborn to store the password files

     
···

       145
        
       location to `/etc`:

     

       146
        
       

     

       147
        
       ```nix

     

       148
       -
       services.userborn.passwordFilesLocation = "/persistent/etc";

     

       0
        
       
     

       0
        
       
     

       149
        
       ```

     

       150
        
       

     

       151
        
       This is useful when you store `/etc` on a `tmpfs` or if `/etc` is immutable

···

       137
        
       You can enable Userborn via:

     

       138
        
       

     

       139
        
       ```nix

     

       140
       +
       {

     

       141
       +
         services.userborn.enable = true;

     

       142
       +
       }

     

       143
        
       ```

     

       144
        
       

     

       145
        
       You can configure Userborn to store the password files

     
···

       147
        
       location to `/etc`:

     

       148
        
       

     

       149
        
       ```nix

     

       150
       +
       {

     

       151
       +
         services.userborn.passwordFilesLocation = "/persistent/etc";

     

       152
       +
       }

     

       153
        
       ```

     

       154
        
       

     

       155
        
       This is useful when you store `/etc` on a `tmpfs` or if `/etc` is immutable

+100 -91

nixos/doc/manual/development/testing-hardware-features.section.md

···

       22
        
       physical layer.

     

       23
        
       

     

       24
        
       ```nix

     

       25
       -
       airgap =

     

       26
       -
         { config, ... }:

     

       27
       -
         {

     

       28
       -
           networking.interfaces.eth1.ipv4.addresses = lib.mkForce [

     

       29
       -
             {

     

       30
       -
               address = "192.168.1.2";

     

       31
       -
               prefixLength = 24;

     

       32
       -
             }

     

       33
       -
           ];

     

       34
       -
           services.vwifi = {

     

       35
       -
             server = {

     

       36
       -
               enable = true;

     

       37
       -
               ports.tcp = 8212;

     

       38
       -
               # uncomment if you want to enable monitor mode on another node

     

       39
       -
               # ports.spy = 8213;

     

       40
       -
               openFirewall = true;

     

       0
        
       
     

       0
        
       
     

       41
        
             };

     

       42
        
           };

     

       43
       -
         };

     

       44
        
       ```

     

       45
        
       

     

       46
        
       ### AP {#sec-nixos-test-wifi-ap}

     
···

       48
        
       A node like this will act as a wireless access point in infrastructure mode.

     

       49
        
       

     

       50
        
       ```nix

     

       51
       -
       ap =

     

       52
       -
         { config, ... }:

     

       53
       -
         {

     

       54
       -
           networking.interfaces.eth1.ipv4.addresses = lib.mkForce [

     

       55
       -
             {

     

       56
       -
               address = "192.168.1.3";

     

       57
       -
               prefixLength = 24;

     

       58
       -
             }

     

       59
       -
           ];

     

       60
       -
           services.hostapd = {

     

       61
       -
             enable = true;

     

       62
       -
             radios.wlan0 = {

     

       63
       -
               channel = 1;

     

       64
       -
               networks.wlan0 = {

     

       65
       -
                 ssid = "NixOS Test Wi-Fi Network";

     

       66
       -
                 authentication = {

     

       67
       -
                   mode = "wpa3-sae";

     

       68
       -
                   saePasswords = [ { password = "supersecret"; } ];

     

       69
       -
                   enableRecommendedPairwiseCiphers = true;

     

       0
        
       
     

       0
        
       
     

       70
        
                 };

     

       71
        
               };

     

       72
        
             };

     

       73
       -
           };

     

       74
       -
           services.vwifi = {

     

       75
       -
             module = {

     

       76
       -
               enable = true;

     

       77
       -
               macPrefix = "74:F8:F6:00:01";

     

       78
       -
             };

     

       79
       -
             client = {

     

       80
       -
               enable = true;

     

       81
       -
               serverAddress = "192.168.1.2";

     

       82
        
             };

     

       83
        
           };

     

       84
       -
         };

     

       85
        
       ```

     

       86
        
       

     

       87
        
       ### Station {#sec-nixos-test-wifi-station}

     
···

       89
        
       A node like this acts as a wireless client.

     

       90
        
       

     

       91
        
       ```nix

     

       92
       -
       station =

     

       93
       -
         { config, ... }:

     

       94
       -
         {

     

       95
       -
           networking.interfaces.eth1.ipv4.addresses = lib.mkForce [

     

       96
       -
             {

     

       97
       -
               address = "192.168.1.3";

     

       98
       -
               prefixLength = 24;

     

       99
       -
             }

     

       100
       -
           ];

     

       101
       -
           networking.wireless = {

     

       102
       -
             # No, really, we want it enabled!

     

       103
       -
             enable = lib.mkOverride 0 true;

     

       104
       -
             interfaces = [ "wlan0" ];

     

       105
       -
             networks = {

     

       106
       -
               "NixOS Test Wi-Fi Network" = {

     

       107
       -
                 psk = "supersecret";

     

       108
       -
                 authProtocols = [ "SAE" ];

     

       0
        
       
     

       0
        
       
     

       109
        
               };

     

       110
        
             };

     

       111
       -
           };

     

       112
       -
           services.vwifi = {

     

       113
       -
             module = {

     

       114
       -
               enable = true;

     

       115
       -
               macPrefix = "74:F8:F6:00:02";

     

       116
       -
             };

     

       117
       -
             client = {

     

       118
       -
               enable = true;

     

       119
       -
               serverAddress = "192.168.1.2";

     

       120
        
             };

     

       121
        
           };

     

       122
       -
         };

     

       123
        
       ```

     

       124
        
       

     

       125
        
       ### Monitor {#sec-nixos-test-wifi-monitor}

     
···

       128
        
       all packets broadcast by all other nodes through the spy interface.

     

       129
        
       

     

       130
        
       ```nix

     

       131
       -
       monitor =

     

       132
       -
         { config, ... }:

     

       133
       -
         {

     

       134
       -
           networking.interfaces.eth1.ipv4.addresses = lib.mkForce [

     

       135
       -
             {

     

       136
       -
               address = "192.168.1.4";

     

       137
       -
               prefixLength = 24;

     

       138
       -
             }

     

       139
       -
           ];

     

       0
        
       
     

       140
        
       

     

       141
       -
           services.vwifi = {

     

       142
       -
             module = {

     

       143
       -
               enable = true;

     

       144
       -
               macPrefix = "74:F8:F6:00:03";

     

       145
       -
             };

     

       146
       -
             client = {

     

       147
       -
               enable = true;

     

       148
       -
               spy = true;

     

       149
       -
               serverAddress = "192.168.1.2";

     

       0
        
       
     

       150
        
             };

     

       151
        
           };

     

       0
        
       
     

       152
        
       ```

···

       22
        
       physical layer.

     

       23
        
       

     

       24
        
       ```nix

     

       25
       +
       {

     

       26
       +
         airgap =

     

       27
       +
           { config, ... }:

     

       28
       +
           {

     

       29
       +
             networking.interfaces.eth1.ipv4.addresses = lib.mkForce [

     

       30
       +
               {

     

       31
       +
                 address = "192.168.1.2";

     

       32
       +
                 prefixLength = 24;

     

       33
       +
               }

     

       34
       +
             ];

     

       35
       +
             services.vwifi = {

     

       36
       +
               server = {

     

       37
       +
                 enable = true;

     

       38
       +
                 ports.tcp = 8212;

     

       39
       +
                 # uncomment if you want to enable monitor mode on another node

     

       40
       +
                 # ports.spy = 8213;

     

       41
       +
                 openFirewall = true;

     

       42
       +
               };

     

       43
        
             };

     

       44
        
           };

     

       45
       +
       }

     

       46
        
       ```

     

       47
        
       

     

       48
        
       ### AP {#sec-nixos-test-wifi-ap}

     
···

       50
        
       A node like this will act as a wireless access point in infrastructure mode.

     

       51
        
       

     

       52
        
       ```nix

     

       53
       +
       {

     

       54
       +
         ap =

     

       55
       +
           { config, ... }:

     

       56
       +
           {

     

       57
       +
             networking.interfaces.eth1.ipv4.addresses = lib.mkForce [

     

       58
       +
               {

     

       59
       +
                 address = "192.168.1.3";

     

       60
       +
                 prefixLength = 24;

     

       61
       +
               }

     

       62
       +
             ];

     

       63
       +
             services.hostapd = {

     

       64
       +
               enable = true;

     

       65
       +
               radios.wlan0 = {

     

       66
       +
                 channel = 1;

     

       67
       +
                 networks.wlan0 = {

     

       68
       +
                   ssid = "NixOS Test Wi-Fi Network";

     

       69
       +
                   authentication = {

     

       70
       +
                     mode = "wpa3-sae";

     

       71
       +
                     saePasswords = [ { password = "supersecret"; } ];

     

       72
       +
                     enableRecommendedPairwiseCiphers = true;

     

       73
       +
                   };

     

       74
        
                 };

     

       75
        
               };

     

       76
        
             };

     

       77
       +
             services.vwifi = {

     

       78
       +
               module = {

     

       79
       +
                 enable = true;

     

       80
       +
                 macPrefix = "74:F8:F6:00:01";

     

       81
       +
               };

     

       82
       +
               client = {

     

       83
       +
                 enable = true;

     

       84
       +
                 serverAddress = "192.168.1.2";

     

       85
       +
               };

     

       86
        
             };

     

       87
        
           };

     

       88
       +
       }

     

       89
        
       ```

     

       90
        
       

     

       91
        
       ### Station {#sec-nixos-test-wifi-station}

     
···

       93
        
       A node like this acts as a wireless client.

     

       94
        
       

     

       95
        
       ```nix

     

       96
       +
       {

     

       97
       +
         station =

     

       98
       +
           { config, ... }:

     

       99
       +
           {

     

       100
       +
             networking.interfaces.eth1.ipv4.addresses = lib.mkForce [

     

       101
       +
               {

     

       102
       +
                 address = "192.168.1.3";

     

       103
       +
                 prefixLength = 24;

     

       104
       +
               }

     

       105
       +
             ];

     

       106
       +
             networking.wireless = {

     

       107
       +
               # No, really, we want it enabled!

     

       108
       +
               enable = lib.mkOverride 0 true;

     

       109
       +
               interfaces = [ "wlan0" ];

     

       110
       +
               networks = {

     

       111
       +
                 "NixOS Test Wi-Fi Network" = {

     

       112
       +
                   psk = "supersecret";

     

       113
       +
                   authProtocols = [ "SAE" ];

     

       114
       +
                 };

     

       115
        
               };

     

       116
        
             };

     

       117
       +
             services.vwifi = {

     

       118
       +
               module = {

     

       119
       +
                 enable = true;

     

       120
       +
                 macPrefix = "74:F8:F6:00:02";

     

       121
       +
               };

     

       122
       +
               client = {

     

       123
       +
                 enable = true;

     

       124
       +
                 serverAddress = "192.168.1.2";

     

       125
       +
               };

     

       126
        
             };

     

       127
        
           };

     

       128
       +
       }

     

       129
        
       ```

     

       130
        
       

     

       131
        
       ### Monitor {#sec-nixos-test-wifi-monitor}

     
···

       134
        
       all packets broadcast by all other nodes through the spy interface.

     

       135
        
       

     

       136
        
       ```nix

     

       137
       +
       {

     

       138
       +
         monitor =

     

       139
       +
           { config, ... }:

     

       140
       +
           {

     

       141
       +
             networking.interfaces.eth1.ipv4.addresses = lib.mkForce [

     

       142
       +
               {

     

       143
       +
                 address = "192.168.1.4";

     

       144
       +
                 prefixLength = 24;

     

       145
       +
               }

     

       146
       +
             ];

     

       147
        
       

     

       148
       +
             services.vwifi = {

     

       149
       +
               module = {

     

       150
       +
                 enable = true;

     

       151
       +
                 macPrefix = "74:F8:F6:00:03";

     

       152
       +
               };

     

       153
       +
               client = {

     

       154
       +
                 enable = true;

     

       155
       +
                 spy = true;

     

       156
       +
                 serverAddress = "192.168.1.2";

     

       157
       +
               };

     

       158
        
             };

     

       159
        
           };

     

       160
       +
       }

     

       161
        
       ```

+2

nixos/doc/manual/installation/building-images-via-nixos-rebuild-build-image.chapter.md

···

       25
        
       E.g. images for the cloud provider Linode use `grub2` as a bootloader by default. If you are using `systemd-boot` on other platforms and want to disable it for Linode only, you could use the following options:

     

       26
        
       

     

       27
        
       ``` nix

     

       0
        
       
     

       28
        
         image.modules.linode = {

     

       29
        
           boot.loader.systemd-boot.enable = lib.mkForce false;

     

       30
        
         };

     

       0
        
       
     

       31
        
       ```

···

       25
        
       E.g. images for the cloud provider Linode use `grub2` as a bootloader by default. If you are using `systemd-boot` on other platforms and want to disable it for Linode only, you could use the following options:

     

       26
        
       

     

       27
        
       ``` nix

     

       28
       +
       {

     

       29
        
         image.modules.linode = {

     

       30
        
           boot.loader.systemd-boot.enable = lib.mkForce false;

     

       31
        
         };

     

       32
       +
       }

     

       33
        
       ```

+5 -3

nixos/doc/manual/release-notes/rl-2405.section.md

···

       243
        
       - `azure-cli` now has extension support. For example, to install the `aks-preview` extension, use

     

       244
        
       

     

       245
        
         ```nix

     

       246
       -
         environment.systemPackages = [

     

       247
       -
           (azure-cli.withExtensions [ azure-cli.extensions.aks-preview ])

     

       248
       -
         ];

     

       0
        
       
     

       0
        
       
     

       249
        
         ```

     

       250
        
         To make the `azure-cli` immutable and prevent clashes in case `azure-cli` is also installed via other package managers, some configuration files were moved into the derivation.

     

       251
        
         This can be disabled by overriding `withImmutableConfig = false` when building `azure-cli`.

···

       243
        
       - `azure-cli` now has extension support. For example, to install the `aks-preview` extension, use

     

       244
        
       

     

       245
        
         ```nix

     

       246
       +
         {

     

       247
       +
           environment.systemPackages = [

     

       248
       +
             (azure-cli.withExtensions [ azure-cli.extensions.aks-preview ])

     

       249
       +
           ];

     

       250
       +
         }

     

       251
        
         ```

     

       252
        
         To make the `azure-cli` immutable and prevent clashes in case `azure-cli` is also installed via other package managers, some configuration files were moved into the derivation.

     

       253
        
         This can be disabled by overriding `withImmutableConfig = false` when building `azure-cli`.

+21 -17

nixos/doc/manual/release-notes/rl-2411.section.md

···

       615
        
         Then, follow the instructions on the [upstream release notes](https://github.com/majewsky/portunus/releases/tag/v2.0.0) to upgrade all existing user accounts to strong password hashes.

     

       616
        
         If you need to upgrade to 24.11 without having completed the migration, consider the security implications of weak password hashes on your user accounts, and add the following to your configuration:

     

       617
        
         ```nix

     

       618
       -
         services.portunus.package      = pkgs.portunus.override { libxcrypt = pkgs.libxcrypt-legacy; };

     

       619
       -
         services.portunus.ldap.package = pkgs.openldap.override { libxcrypt = pkgs.libxcrypt-legacy; };

     

       0
        
       
     

       0
        
       
     

       620
        
         ```

     

       621
        
       

     

       622
        
       - The default value of `services.kubernetes.kubelet.hostname` is now lowercased.

     
···

       956
        
         - If you want to maintain the exact behavior of the option, use the following snippet

     

       957
        
       

     

       958
        
       ```nix

     

       959
       -
       services.actkbd = let

     

       960
       -
         volumeStep = "1%";

     

       961
       -
       in {

     

       962
       -
         enable = true;

     

       963
       -
         bindings = [

     

       964
       -
           # "Mute" media key

     

       965
       -
           { keys = [ 113 ]; events = [ "key" ];       command = "${alsa-utils}/bin/amixer -q set Master toggle"; }

     

       0
        
       
     

       966
        
       

     

       967
       -
           # "Lower Volume" media key

     

       968
       -
           { keys = [ 114 ]; events = [ "key" "rep" ]; command = "${alsa-utils}/bin/amixer -q set Master ${volumeStep}- unmute"; }

     

       969
        
       

     

       970
       -
           # "Raise Volume" media key

     

       971
       -
           { keys = [ 115 ]; events = [ "key" "rep" ]; command = "${alsa-utils}/bin/amixer -q set Master ${volumeStep}+ unmute"; }

     

       972
        
       

     

       973
       -
           # "Mic Mute" media key

     

       974
       -
           { keys = [ 190 ]; events = [ "key" ];       command = "${alsa-utils}/bin/amixer -q set Capture toggle"; }

     

       975
       -
         ];

     

       976
       -
       };

     

       0
        
       
     

       977
        
       ```

     

       978
        
       

     

       979
        
       ### `hardware.deviceTree.overlays` compatible string matching {#sec-release-24.11-migration-dto-compatible}

···

       615
        
         Then, follow the instructions on the [upstream release notes](https://github.com/majewsky/portunus/releases/tag/v2.0.0) to upgrade all existing user accounts to strong password hashes.

     

       616
        
         If you need to upgrade to 24.11 without having completed the migration, consider the security implications of weak password hashes on your user accounts, and add the following to your configuration:

     

       617
        
         ```nix

     

       618
       +
         {

     

       619
       +
           services.portunus.package      = pkgs.portunus.override { libxcrypt = pkgs.libxcrypt-legacy; };

     

       620
       +
           services.portunus.ldap.package = pkgs.openldap.override { libxcrypt = pkgs.libxcrypt-legacy; };

     

       621
       +
         }

     

       622
        
         ```

     

       623
        
       

     

       624
        
       - The default value of `services.kubernetes.kubelet.hostname` is now lowercased.

     
···

       958
        
         - If you want to maintain the exact behavior of the option, use the following snippet

     

       959
        
       

     

       960
        
       ```nix

     

       961
       +
       {

     

       962
       +
         services.actkbd = let

     

       963
       +
           volumeStep = "1%";

     

       964
       +
         in {

     

       965
       +
           enable = true;

     

       966
       +
           bindings = [

     

       967
       +
             # "Mute" media key

     

       968
       +
             { keys = [ 113 ]; events = [ "key" ];       command = "${alsa-utils}/bin/amixer -q set Master toggle"; }

     

       969
        
       

     

       970
       +
             # "Lower Volume" media key

     

       971
       +
             { keys = [ 114 ]; events = [ "key" "rep" ]; command = "${alsa-utils}/bin/amixer -q set Master ${volumeStep}- unmute"; }

     

       972
        
       

     

       973
       +
             # "Raise Volume" media key

     

       974
       +
             { keys = [ 115 ]; events = [ "key" "rep" ]; command = "${alsa-utils}/bin/amixer -q set Master ${volumeStep}+ unmute"; }

     

       975
        
       

     

       976
       +
             # "Mic Mute" media key

     

       977
       +
             { keys = [ 190 ]; events = [ "key" ];       command = "${alsa-utils}/bin/amixer -q set Capture toggle"; }

     

       978
       +
           ];

     

       979
       +
         };

     

       980
       +
       }

     

       981
        
       ```

     

       982
        
       

     

       983
        
       ### `hardware.deviceTree.overlays` compatible string matching {#sec-release-24.11-migration-dto-compatible}

+15 -11

nixos/doc/manual/release-notes/rl-2505.section.md

···

       355
        
       - To avoid delaying user logins unnecessarily the `multi-user.target` is no longer ordered after `network-online.target`.

     

       356
        
         System services requiring a connection to start correctly must explicitly state so, i.e.

     

       357
        
         ```nix

     

       358
       -
         systemd.services.<name> = {

     

       359
       -
           wants = [ "network-online.target" ];

     

       360
       -
           after = [ "network-online.target" ];

     

       361
       -
         };

     

       0
        
       
     

       0
        
       
     

       362
        
         ```

     

       363
        
         This changed follows a deprecation period of one year started in NixOS 24.05 (see [PR #283818](https://github.com/NixOS/nixpkgs/pull/283818)).

     

       364
        
       

     
···

       457
        
         Example:

     

       458
        
       

     

       459
        
         ```nix

     

       460
       -
         services.mysql = {

     

       461
       -
           enable = true;

     

       462
       -
           galeraCluster = {

     

       463
        
             enable = true;

     

       464
       -
             localName = "Node 1";

     

       465
       -
             localAddress = "galera_01";

     

       466
       -
             nodeAddresses = [ "galera_01" "galera_02" "galera_03"];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       467
        
           };

     

       468
       -
         };

     

       469
        
         ```

     

       470
        
       

     

       471
        
       - systemd's {manpage}`systemd-ssh-generator(8)` now works out of the box on NixOS.

···

       355
        
       - To avoid delaying user logins unnecessarily the `multi-user.target` is no longer ordered after `network-online.target`.

     

       356
        
         System services requiring a connection to start correctly must explicitly state so, i.e.

     

       357
        
         ```nix

     

       358
       +
         {

     

       359
       +
           systemd.services."<name>" = {

     

       360
       +
             wants = [ "network-online.target" ];

     

       361
       +
             after = [ "network-online.target" ];

     

       362
       +
           };

     

       363
       +
         }

     

       364
        
         ```

     

       365
        
         This changed follows a deprecation period of one year started in NixOS 24.05 (see [PR #283818](https://github.com/NixOS/nixpkgs/pull/283818)).

     

       366
        
       

     
···

       459
        
         Example:

     

       460
        
       

     

       461
        
         ```nix

     

       462
       +
         {

     

       463
       +
           services.mysql = {

     

       0
        
       
     

       464
        
             enable = true;

     

       465
       +
             galeraCluster = {

     

       466
       +
               enable = true;

     

       467
       +
               localName = "Node 1";

     

       468
       +
               localAddress = "galera_01";

     

       469
       +
               nodeAddresses = [ "galera_01" "galera_02" "galera_03"];

     

       470
       +
             };

     

       471
        
           };

     

       472
       +
         }

     

       473
        
         ```

     

       474
        
       

     

       475
        
       - systemd's {manpage}`systemd-ssh-generator(8)` now works out of the box on NixOS.

+32 -30

nixos/modules/services/databases/postgresql.md

···

       94
        
       `ensureUsers` is run in `postgresql-setup`, so this is where `postStart` must be added to:

     

       95
        
       

     

       96
        
       ```nix

     

       97
       -
         {

     

       98
       -
           systemd.services.postgresql-setup.postStart = ''

     

       99
       -
             psql service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'

     

       100
       -
             psql service1 -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'

     

       101
       -
             # ....

     

       102
       -
           '';

     

       103
       -
         }

     

       104
        
       ```

     

       105
        
       

     

       106
        
       #### in intermediate oneshot service {#module-services-postgres-initializing-extra-permissions-superuser-oneshot}

     
···

       114
        
       Both can lead to unexpected errors either during initial database creation or restore, when using `postgresql.service`.

     

       115
        
       

     

       116
        
       ```nix

     

       117
       -
         {

     

       118
       -
           systemd.services."migrate-service1-db1" = {

     

       119
       -
             serviceConfig.Type = "oneshot";

     

       120
       -
             requiredBy = "service1.service";

     

       121
       -
             before = "service1.service";

     

       122
       -
             after = "postgresql.target";

     

       123
       -
             serviceConfig.User = "postgres";

     

       124
       -
             environment.PGPORT = toString services.postgresql.settings.port;

     

       125
       -
             path = [ postgresql ];

     

       126
       -
             script = ''

     

       127
       -
               psql service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'

     

       128
       -
               psql service1 -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'

     

       129
       -
               # ....

     

       130
       -
             '';

     

       131
       -
           };

     

       132
       -
         }

     

       133
        
       ```

     

       134
        
       

     

       135
        
       ## Authentication {#module-services-postgres-authentication}

     
···

       147
        
       You can then use [](#opt-services.postgresql.identMap) to define the map and [](#opt-services.postgresql.authentication) to enable it:

     

       148
        
       

     

       149
        
       ```nix

     

       150
       -
       services.postgresql = {

     

       151
       -
         identMap = ''

     

       152
       -
           admin root admin

     

       153
       -
         '';

     

       154
       -
         authentication = ''

     

       155
       -
           local all admin peer map=admin

     

       156
       -
         '';

     

       0
        
       
     

       0
        
       
     

       157
        
       }

     

       158
        
       ```

     

       159

···

       94
        
       `ensureUsers` is run in `postgresql-setup`, so this is where `postStart` must be added to:

     

       95
        
       

     

       96
        
       ```nix

     

       97
       +
       {

     

       98
       +
         systemd.services.postgresql-setup.postStart = ''

     

       99
       +
           psql service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'

     

       100
       +
           psql service1 -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'

     

       101
       +
           # ....

     

       102
       +
         '';

     

       103
       +
       }

     

       104
        
       ```

     

       105
        
       

     

       106
        
       #### in intermediate oneshot service {#module-services-postgres-initializing-extra-permissions-superuser-oneshot}

     
···

       114
        
       Both can lead to unexpected errors either during initial database creation or restore, when using `postgresql.service`.

     

       115
        
       

     

       116
        
       ```nix

     

       117
       +
       {

     

       118
       +
         systemd.services."migrate-service1-db1" = {

     

       119
       +
           serviceConfig.Type = "oneshot";

     

       120
       +
           requiredBy = "service1.service";

     

       121
       +
           before = "service1.service";

     

       122
       +
           after = "postgresql.target";

     

       123
       +
           serviceConfig.User = "postgres";

     

       124
       +
           environment.PGPORT = toString services.postgresql.settings.port;

     

       125
       +
           path = [ postgresql ];

     

       126
       +
           script = ''

     

       127
       +
             psql service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'

     

       128
       +
             psql service1 -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'

     

       129
       +
             # ....

     

       130
       +
           '';

     

       131
       +
         };

     

       132
       +
       }

     

       133
        
       ```

     

       134
        
       

     

       135
        
       ## Authentication {#module-services-postgres-authentication}

     
···

       147
        
       You can then use [](#opt-services.postgresql.identMap) to define the map and [](#opt-services.postgresql.authentication) to enable it:

     

       148
        
       

     

       149
        
       ```nix

     

       150
       +
       {

     

       151
       +
         services.postgresql = {

     

       152
       +
           identMap = ''

     

       153
       +
             admin root admin

     

       154
       +
           '';

     

       155
       +
           authentication = ''

     

       156
       +
             local all admin peer map=admin

     

       157
       +
           '';

     

       158
       +
         };

     

       159
        
       }

     

       160
        
       ```

     

       161

+3 -1

nixos/modules/services/misc/paisa.md

···

       21
        
       access to the command at runtime.

     

       22
        
       

     

       23
        
       ```nix

     

       24
       -
       systemd.services.paisa.path = [ pkgs.hledger ];

     

       0
        
       
     

       0
        
       
     

       25
        
       ```

     

       26
        
       

     

       27
        
       ::: {.note}

···

       21
        
       access to the command at runtime.

     

       22
        
       

     

       23
        
       ```nix

     

       24
       +
       {

     

       25
       +
         systemd.services.paisa.path = [ pkgs.hledger ];

     

       26
       +
       }

     

       27
        
       ```

     

       28
        
       

     

       29
        
       ::: {.note}

+1 -1

nixos/modules/services/monitoring/glances.md

···

       16
        
           enable = true;

     

       17
        
           openFirewall = true;

     

       18
        
         };

     

       19
       -
       };

     

       20
        
       ```

···

       16
        
           enable = true;

     

       17
        
           openFirewall = true;

     

       18
        
         };

     

       19
       +
       }

     

       20
        
       ```

+1 -1

nixos/modules/services/networking/crab-hole.md

···

       103
        
             certificate = ./dns.example.com.crt;

     

       104
        
             key = "/dns.example.com.key";

     

       105
        
             # optional (default = 3000)

     

       106
       -
             timeout_ms = 3000

     

       107
        
           }

     

       108
        
         ];

     

       109
        
       }

···

       103
        
             certificate = ./dns.example.com.crt;

     

       104
        
             key = "/dns.example.com.key";

     

       105
        
             # optional (default = 3000)

     

       106
       +
             timeout_ms = 3000;

     

       107
        
           }

     

       108
        
         ];

     

       109
        
       }

+7 -5

nixos/modules/services/networking/jotta-cli.md

···

       15
        
       ## Example Configuration {#module-services-jotta-cli-example-configuration}

     

       16
        
       

     

       17
        
       ```nix

     

       18
       -
       services.jotta-cli = {

     

       19
       -
         enable = true;

     

       20
       -
         options = [ "slow" ];

     

       21
       -
         package = pkgs.jotta-cli;

     

       22
       -
       };

     

       0
        
       
     

       0
        
       
     

       23
        
       ```

     

       24
        
       

     

       25
        
       This uses `jotta-cli` and `jottad` from the `pkgs.jotta-cli` package and starts `jottad` in low memory mode.

···

       15
        
       ## Example Configuration {#module-services-jotta-cli-example-configuration}

     

       16
        
       

     

       17
        
       ```nix

     

       18
       +
       {

     

       19
       +
         services.jotta-cli = {

     

       20
       +
           enable = true;

     

       21
       +
           options = [ "slow" ];

     

       22
       +
           package = pkgs.jotta-cli;

     

       23
       +
         };

     

       24
       +
       }

     

       25
        
       ```

     

       26
        
       

     

       27
        
       This uses `jotta-cli` and `jottad` from the `pkgs.jotta-cli` package and starts `jottad` in low memory mode.

+23 -21

nixos/modules/services/networking/netbird/server.md

···

       9
        
       There are quite a few settings that need to be passed to Netbird for it to function, and a minimal config looks like :

     

       10
        
       

     

       11
        
       ```nix

     

       12
       -
       services.netbird.server = {

     

       13
       -
         enable = true;

     

       0
        
       
     

       14
        
       

     

       15
       -
         domain = "netbird.example.selfhosted";

     

       16
        
       

     

       17
       -
         enableNginx = true;

     

       18
        
       

     

       19
       -
         coturn = {

     

       20
       -
           enable = true;

     

       21
        
       

     

       22
       -
           passwordFile = "/path/to/a/secret/password";

     

       23
       -
         };

     

       24
        
       

     

       25
       -
         management = {

     

       26
       -
           oidcConfigEndpoint = "https://sso.example.selfhosted/oauth2/openid/netbird/.well-known/openid-configuration";

     

       27
        
       

     

       28
       -
           settings = {

     

       29
       -
             TURNConfig = {

     

       30
       -
               Turns = [

     

       31
       -
                 {

     

       32
       -
                   Proto = "udp";

     

       33
       -
                   URI = "turn:netbird.example.selfhosted:3478";

     

       34
       -
                   Username = "netbird";

     

       35
       -
                   Password._secret = "/path/to/a/secret/password";

     

       36
       -
                 }

     

       37
       -
               ];

     

       0
        
       
     

       38
        
             };

     

       39
        
           };

     

       40
        
         };

     

       41
       -
       };

     

       42
        
       ```

···

       9
        
       There are quite a few settings that need to be passed to Netbird for it to function, and a minimal config looks like :

     

       10
        
       

     

       11
        
       ```nix

     

       12
       +
       {

     

       13
       +
         services.netbird.server = {

     

       14
       +
           enable = true;

     

       15
        
       

     

       16
       +
           domain = "netbird.example.selfhosted";

     

       17
        
       

     

       18
       +
           enableNginx = true;

     

       19
        
       

     

       20
       +
           coturn = {

     

       21
       +
             enable = true;

     

       22
        
       

     

       23
       +
             passwordFile = "/path/to/a/secret/password";

     

       24
       +
           };

     

       25
        
       

     

       26
       +
           management = {

     

       27
       +
             oidcConfigEndpoint = "https://sso.example.selfhosted/oauth2/openid/netbird/.well-known/openid-configuration";

     

       28
        
       

     

       29
       +
             settings = {

     

       30
       +
               TURNConfig = {

     

       31
       +
                 Turns = [

     

       32
       +
                   {

     

       33
       +
                     Proto = "udp";

     

       34
       +
                     URI = "turn:netbird.example.selfhosted:3478";

     

       35
       +
                     Username = "netbird";

     

       36
       +
                     Password._secret = "/path/to/a/secret/password";

     

       37
       +
                   }

     

       38
       +
                 ];

     

       39
       +
               };

     

       40
        
             };

     

       41
        
           };

     

       42
        
         };

     

       43
       +
       }

     

       44
        
       ```

+10 -11

nixos/modules/services/networking/pihole-ftl.md

···

       99
        
       {

     

       100
        
         services.pihole-ftl = {

     

       101
        
           settings.misc.dnsmasq_lines = [

     

       102
       -
               # Specify the secondary interface

     

       103
       -
               "interface=enp1s0"

     

       104
       -
               # A different device is the router on this network, e.g. the one

     

       105
       -
               # provided by your ISP

     

       106
       -
               "dhcp-option=enp1s0,option:router,192.168.0.1"

     

       107
       -
               # Specify the IPv4 ranges to allocate, with a 1-day lease time

     

       108
       -
               "dhcp-range=enp1s0,192.168.0.10,192.168.0.253,1d"

     

       109
       -
               # Enable IPv6

     

       110
       -
               "dhcp-range=::f,::ff,constructor:enp1s0,ra-names,ra-stateless"

     

       111
       -
             ];

     

       112
       -
           };

     

       113
        
         };

     

       114
        
       }

     

       115
        
       ```

···

       99
        
       {

     

       100
        
         services.pihole-ftl = {

     

       101
        
           settings.misc.dnsmasq_lines = [

     

       102
       +
             # Specify the secondary interface

     

       103
       +
             "interface=enp1s0"

     

       104
       +
             # A different device is the router on this network, e.g. the one

     

       105
       +
             # provided by your ISP

     

       106
       +
             "dhcp-option=enp1s0,option:router,192.168.0.1"

     

       107
       +
             # Specify the IPv4 ranges to allocate, with a 1-day lease time

     

       108
       +
             "dhcp-range=enp1s0,192.168.0.10,192.168.0.253,1d"

     

       109
       +
             # Enable IPv6

     

       110
       +
             "dhcp-range=::f,::ff,constructor:enp1s0,ra-names,ra-stateless"

     

       111
       +
           ];

     

       0
        
       
     

       112
        
         };

     

       113
        
       }

     

       114
        
       ```

+1 -1

nixos/modules/services/system/kerberos/kerberos-server.md

···

       24
        
               admin_server = "kerberos.example.com";

     

       25
        
             };

     

       26
        
           };

     

       27
       -
         }

     

       28
        
       

     

       29
        
         services.kerberos-server = {

     

       30
        
           enable = true;

···

       24
        
               admin_server = "kerberos.example.com";

     

       25
        
             };

     

       26
        
           };

     

       27
       +
         };

     

       28
        
       

     

       29
        
         services.kerberos-server = {

     

       30
        
           enable = true;

+5 -3

nixos/modules/services/web-apps/nextcloud.md

···

       208
        
           the cache size to zero:

     

       209
        
       

     

       210
        
           ```nix

     

       211
       -
           services.nextcloud.phpOptions."realpath_cache_size" = "0";

     

       0
        
       
     

       0
        
       
     

       212
        
           ```

     

       213
        
       

     

       214
        
         - **Empty Files on chunked uploads**

     
···

       286
        
       

     

       287
        
       ```nix

     

       288
        
       { config, pkgs, ... }: {

     

       289
       -
         services.nextcloud.extraApps = with config.services.nextcloud.package.packages.apps; [

     

       290
        
           inherit user_oidc calendar contacts;

     

       291
       -
         ];

     

       292
        
       }

     

       293
        
       ```

     

       294

···

       208
        
           the cache size to zero:

     

       209
        
       

     

       210
        
           ```nix

     

       211
       +
           {

     

       212
       +
             services.nextcloud.phpOptions."realpath_cache_size" = "0";

     

       213
       +
           }

     

       214
        
           ```

     

       215
        
       

     

       216
        
         - **Empty Files on chunked uploads**

     
···

       288
        
       

     

       289
        
       ```nix

     

       290
        
       { config, pkgs, ... }: {

     

       291
       +
         services.nextcloud.extraApps = with config.services.nextcloud.package.packages.apps; {

     

       292
        
           inherit user_oidc calendar contacts;

     

       293
       +
         };

     

       294
        
       }

     

       295
        
       ```

     

       296

+2 -2

nixos/modules/services/web-apps/szurubooru.md

···

       40
        
       

     

       41
        
           server = {

     

       42
        
             port = 8080;

     

       43
       -
             ...

     

       44
        
           };

     

       45
        
       

     

       46
       -
           ...

     

       47
        
         };

     

       48
        
       

     

       49
        
         services.nginx.virtualHosts."szurubooru.domain.tld" = {

···

       40
        
       

     

       41
        
           server = {

     

       42
        
             port = 8080;

     

       43
       +
             # ...

     

       44
        
           };

     

       45
        
       

     

       46
       +
           # ...

     

       47
        
         };

     

       48
        
       

     

       49
        
         services.nginx.virtualHosts."szurubooru.domain.tld" = {

+18 -14

pkgs/applications/networking/cluster/k3s/docs/examples/EXTERNAL_CONTAINERD.md

···

       6
        
       ## Configure Containerd

     

       7
        
       

     

       8
        
       ```nix

     

       9
       -
       virtualisation.containerd = {

     

       10
       -
         enable = true;

     

       11
       -
         settings.plugins."io.containerd.grpc.v1.cri".cni = {

     

       12
       -
           bin_dir = "/var/lib/rancher/k3s/data/current/bin";

     

       13
       -
           conf_dir = "/var/lib/rancher/k3s/agent/etc/cni/net.d";

     

       14
       -
         };

     

       15
       -
         # Optionally, configure containerd to use the k3s pause image

     

       16
       -
         settings.plugins."io.containerd.grpc.v1.cri" = {

     

       17
       -
           sandbox_image = "docker.io/rancher/mirrored-pause:3.6";

     

       0
        
       
     

       0
        
       
     

       18
        
         };

     

       19
       -
       };

     

       20
        
       ```

     

       21
        
       

     

       22
        
       ## Configure k3s

     

       23
        
       

     

       24
        
       ```nix

     

       25
       -
       services.k3s = {

     

       26
       -
         enable = true;

     

       27
       -
         extraFlags = [ "--container-runtime-endpoint unix:///run/containerd/containerd.sock" ];

     

       28
       -
       };

     

       0
        
       
     

       0
        
       
     

       29
        
       ```

     

       30
        
       

     

       31
        
       ## Importing Container Images

···

       6
        
       ## Configure Containerd

     

       7
        
       

     

       8
        
       ```nix

     

       9
       +
       {

     

       10
       +
         virtualisation.containerd = {

     

       11
       +
           enable = true;

     

       12
       +
           settings.plugins."io.containerd.grpc.v1.cri".cni = {

     

       13
       +
             bin_dir = "/var/lib/rancher/k3s/data/current/bin";

     

       14
       +
             conf_dir = "/var/lib/rancher/k3s/agent/etc/cni/net.d";

     

       15
       +
           };

     

       16
       +
           # Optionally, configure containerd to use the k3s pause image

     

       17
       +
           settings.plugins."io.containerd.grpc.v1.cri" = {

     

       18
       +
             sandbox_image = "docker.io/rancher/mirrored-pause:3.6";

     

       19
       +
           };

     

       20
        
         };

     

       21
       +
       }

     

       22
        
       ```

     

       23
        
       

     

       24
        
       ## Configure k3s

     

       25
        
       

     

       26
        
       ```nix

     

       27
       +
       {

     

       28
       +
         services.k3s = {

     

       29
       +
           enable = true;

     

       30
       +
           extraFlags = [ "--container-runtime-endpoint unix:///run/containerd/containerd.sock" ];

     

       31
       +
         };

     

       32
       +
       }

     

       33
        
       ```

     

       34
        
       

     

       35
        
       ## Importing Container Images

+8 -3

pkgs/by-name/README.md

···

       99
        
       

     

       100
        
       ```nix

     

       101
        
       # all-packages.nix

     

       102
       -
       fooWithBaz = foo.override {

     

       103
       -
         bar = baz;

     

       104
       -
       };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       105
        
       # turned into pkgs/by-name/fo/fooWithBaz/package.nix with:

     

       106
        
       {

     

       107
        
         foo,

···

       99
        
       

     

       100
        
       ```nix

     

       101
        
       # all-packages.nix

     

       102
       +
       {

     

       103
       +
         fooWithBaz = foo.override {

     

       104
       +
           bar = baz;

     

       105
       +
         };

     

       106
       +
       }

     

       107
       +
       ```

     

       108
       +
       

     

       109
       +
       ```nix

     

       110
        
       # turned into pkgs/by-name/fo/fooWithBaz/package.nix with:

     

       111
        
       {

     

       112
        
         foo,

+5 -1

pkgs/by-name/az/azure-cli/README.md

···

       56
        
       Based on this, you can add an attribute to `extensions-manual.nix`:

     

       57
        
       

     

       58
        
       ```nix

     

       0
        
       
     

       59
        
         azure-devops = mkAzExtension {

     

       60
        
           pname = "azure-devops";

     

       61
        
           version = "1.0.0";

     
···

       67
        
           ];

     

       68
        
           meta.maintainers = with lib.maintainers; [ katexochen ];

     

       69
        
         };

     

       0
        
       
     

       70
        
       ```

     

       71
        
       

     

       72
        
       * The attribute name should be the same as `pname`.

     
···

       113
        
       this example:

     

       114
        
       

     

       115
        
       ```nix

     

       116
       -
       blockchain = throw "The 'blockchain' extension for azure-cli was deprecated upstream"; # Added 2024-04-26

     

       0
        
       
     

       0
        
       
     

       117
        
       ```

···

       56
        
       Based on this, you can add an attribute to `extensions-manual.nix`:

     

       57
        
       

     

       58
        
       ```nix

     

       59
       +
       {

     

       60
        
         azure-devops = mkAzExtension {

     

       61
        
           pname = "azure-devops";

     

       62
        
           version = "1.0.0";

     
···

       68
        
           ];

     

       69
        
           meta.maintainers = with lib.maintainers; [ katexochen ];

     

       70
        
         };

     

       71
       +
       }

     

       72
        
       ```

     

       73
        
       

     

       74
        
       * The attribute name should be the same as `pname`.

     
···

       115
        
       this example:

     

       116
        
       

     

       117
        
       ```nix

     

       118
       +
       {

     

       119
       +
         blockchain = throw "The 'blockchain' extension for azure-cli was deprecated upstream"; # Added 2024-04-26

     

       120
       +
       }

     

       121
        
       ```

+2 -1

pkgs/servers/home-assistant/custom-components/README.md

···

       80
        
       can be ignored on a per requirement basis.

     

       81
        
       

     

       82
        
       ```nix

     

       0
        
       
     

       83
        
         dependencies = [

     

       84
        
           pyemvue

     

       85
        
         ];

     
···

       88
        
         ignoreVersionRequirement = [

     

       89
        
           "pyemvue"

     

       90
        
         ];

     

       0
        
       
     

       91
        
       ```

     

       92
       -
       `

···

       80
        
       can be ignored on a per requirement basis.

     

       81
        
       

     

       82
        
       ```nix

     

       83
       +
       {

     

       84
        
         dependencies = [

     

       85
        
           pyemvue

     

       86
        
         ];

     
···

       89
        
         ignoreVersionRequirement = [

     

       90
        
           "pyemvue"

     

       91
        
         ];

     

       92
       +
       }

     

       93
        
       ```

     

       0