commit 933a41a73fe2174b90cabb7d671ee2cc5658701a · pyrox.dev/nixpkgs

+5 -6

nixos/modules/security/lock-kernel-modules.nix

···

       22
       22
        
       

     

       23
       23
        
         config = mkIf config.security.lockKernelModules {

     

       24
       24
        
           boot.kernelModules = concatMap (x:

     

       25
       25
       -
             if x.device != null

     

       26
       26
       -
               then

     

       27
       27
       -
                 if x.fsType == "vfat"

     

       28
       28
       -
                   then [ "vfat" "nls-cp437" "nls-iso8859-1" ]

     

       29
       29
       -
                   else [ x.fsType ]

     

       30
       30
       -
               else []) config.system.build.fileSystems;

     

       25
       25
       +
             optionals (x.device != null) (

     

       26
       26
       +
               if x.fsType == "vfat"

     

       27
       27
       +
               then [ "vfat" "nls-cp437" "nls-iso8859-1" ]

     

       28
       28
       +
               else [ x.fsType ])

     

       29
       29
       +
             ) config.system.build.fileSystems;

     

       31
       30
        
       

     

       32
       31
        
           systemd.services.disable-kernel-module-loading = {

     

       33
       32
        
             description = "Disable kernel module loading";

+2 -2

nixos/modules/security/sudo.nix

···

       216
       216
        
               ${concatStringsSep "\n" (

     

       217
       217
        
                 lists.flatten (

     

       218
       218
        
                   map (

     

       219
       219
       -
                     rule: if (length rule.commands != 0) then [

     

       219
       219
       +
                     rule: optionals (length rule.commands != 0) [

     

       220
       220
        
                       (map (user: "${toUserString user}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.users)

     

       221
       221
        
                       (map (group: "${toGroupString group}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.groups)

     

       222
       222
       -
                     ] else []

     

       222
       222
       +
                     ]

     

       223
       223
        
                   ) cfg.extraRules

     

       224
       224
        
                 )

     

       225
       225
        
               )}

+1 -1

nixos/modules/services/backup/restic.nix

···

       298
       298
        
                 let

     

       299
       299
        
                   extraOptions = concatMapStrings (arg: " -o ${arg}") backup.extraOptions;

     

       300
       300
        
                   resticCmd = "${backup.package}/bin/restic${extraOptions}";

     

       301
       301
       -
                   excludeFlags = if (backup.exclude != []) then ["--exclude-file=${pkgs.writeText "exclude-patterns" (concatStringsSep "\n" backup.exclude)}"] else [];

     

       301
       301
       +
                   excludeFlags = optional (backup.exclude != []) "--exclude-file=${pkgs.writeText "exclude-patterns" (concatStringsSep "\n" backup.exclude)}";

     

       302
       302
        
                   filesFromTmpFile = "/run/restic-backups-${name}/includes";

     

       303
       303
        
                   backupPaths =

     

       304
       304
        
                     if (backup.dynamicFilesFrom == null)

+1 -1

nixos/modules/services/games/factorio.nix

···

       294
       294
        
             };

     

       295
       295
        
           };

     

       296
       296
        
       

     

       297
       297
       -
           networking.firewall.allowedUDPPorts = if cfg.openFirewall then [ cfg.port ] else [];

     

       297
       297
       +
           networking.firewall.allowedUDPPorts = optional cfg.openFirewall cfg.port;

     

       298
       298
        
         };

     

       299
       299
        
       }

+1 -1

nixos/modules/services/games/freeciv.nix

···

       16
       16
        
           generate = name: value:

     

       17
       17
        
             let mkParam = k: v:

     

       18
       18
        
                   if v == null then []

     

       19
       19
       -
                   else if isBool v then if v then [("--"+k)] else []

     

       19
       19
       +
                   else if isBool v then optional v ("--"+k)

     

       20
       20
        
                   else [("--"+k) v];

     

       21
       21
        
                 mkParams = k: v: map (mkParam k) (if isList v then v else [v]);

     

       22
       22
        
             in escapeShellArgs (concatLists (concatLists (mapAttrsToList mkParams value)));

+2 -2

nixos/modules/services/network-filesystems/glusterfs.nix

···

       15
       15
        
           rm -f /var/lib/glusterd/secure-access

     

       16
       16
        
         '';

     

       17
       17
        
       

     

       18
       18
       -
         restartTriggers = if (cfg.tlsSettings != null) then [

     

       18
       18
       +
         restartTriggers = optionals (cfg.tlsSettings != null) [

     

       19
       19
        
           config.environment.etc."ssl/glusterfs.pem".source

     

       20
       20
        
           config.environment.etc."ssl/glusterfs.key".source

     

       21
       21
        
           config.environment.etc."ssl/glusterfs.ca".source

     

       22
       22
       -
         ] else [];

     

       22
       22
       +
         ];

     

       23
       23
        
       

     

       24
       24
        
         cfg = config.services.glusterfs;

     

       25
       25

+1 -1

nixos/modules/services/networking/ddclient.nix

···

       48
       48
        
           (mkChangedOptionModule [ "services" "ddclient" "domain" ] [ "services" "ddclient" "domains" ]

     

       49
       49
        
             (config:

     

       50
       50
        
               let value = getAttrFromPath [ "services" "ddclient" "domain" ] config;

     

       51
       51
       -
               in if value != "" then [ value ] else []))

     

       51
       51
       +
               in optional (value != "") value))

     

       52
       52
        
           (mkRemovedOptionModule [ "services" "ddclient" "homeDir" ] "")

     

       53
       53
        
           (mkRemovedOptionModule [ "services" "ddclient" "password" ] "Use services.ddclient.passwordFile instead.")

     

       54
       54
        
           (mkRemovedOptionModule [ "services" "ddclient" "ipv6" ] "")

+21 -32

nixos/modules/services/networking/i2pd.nix

···

       169
       169
        
               (boolOpt "enabled" proto.enable)

     

       170
       170
        
               (strOpt "address" proto.address)

     

       171
       171
        
               (intOpt "port" proto.port)

     

       172
       172
       -
               ] ++ (if proto ? keys then optionalNullString "keys" proto.keys else [])

     

       173
       173
       -
               ++ (if proto ? auth then optionalNullBool "auth" proto.auth else [])

     

       174
       174
       -
               ++ (if proto ? user then optionalNullString "user" proto.user else [])

     

       175
       175
       -
               ++ (if proto ? pass then optionalNullString "pass" proto.pass else [])

     

       176
       176
       -
               ++ (if proto ? strictHeaders then optionalNullBool "strictheaders" proto.strictHeaders else [])

     

       177
       177
       -
               ++ (if proto ? hostname then optionalNullString "hostname" proto.hostname else [])

     

       178
       178
       -
               ++ (if proto ? outproxy then optionalNullString "outproxy" proto.outproxy else [])

     

       179
       179
       -
               ++ (if proto ? outproxyPort then optionalNullInt "outproxyport" proto.outproxyPort else [])

     

       180
       180
       -
               ++ (if proto ? outproxyEnable then optionalNullBool "outproxy.enabled" proto.outproxyEnable else []);

     

       172
       172
       +
               ] ++ (optionals (proto ? keys) (optionalNullString "keys" proto.keys))

     

       173
       173
       +
               ++ (optionals (proto ? auth) (optionalNullBool "auth" proto.auth))

     

       174
       174
       +
               ++ (optionals (proto ? user) (optionalNullString "user" proto.user))

     

       175
       175
       +
               ++ (optionals (proto ? pass) (optionalNullString "pass" proto.pass))

     

       176
       176
       +
               ++ (optionals (proto ? strictHeaders) (optionalNullBool "strictheaders" proto.strictHeaders))

     

       177
       177
       +
               ++ (optionals (proto ? hostname) (optionalNullString "hostname" proto.hostname))

     

       178
       178
       +
               ++ (optionals (proto ? outproxy) (optionalNullString "outproxy" proto.outproxy))

     

       179
       179
       +
               ++ (optionals (proto ? outproxyPort) (optionalNullInt "outproxyport" proto.outproxyPort))

     

       180
       180
       +
               ++ (optionals (proto ? outproxyEnable) (optionalNullBool "outproxy.enabled" proto.outproxyEnable));

     

       181
       181
        
               in (concatStringsSep "\n" protoOpts)

     

       182
       182
        
             ));

     

       183
       183
        
         in

     
···

       192
       192
        
               "type = client"

     

       193
       193
        
               (intOpt "port" tun.port)

     

       194
       194
        
               (strOpt "destination" tun.destination)

     

       195
       195
       -
               ] ++ (if tun ? destinationPort then optionalNullInt "destinationport" tun.destinationPort else [])

     

       196
       196
       -
               ++ (if tun ? keys then

     

       197
       197
       -
                   optionalNullString "keys" tun.keys else [])

     

       198
       198
       -
               ++ (if tun ? address then

     

       199
       199
       -
                   optionalNullString "address" tun.address else [])

     

       200
       200
       -
               ++ (if tun ? inbound.length then

     

       201
       201
       -
                   optionalNullInt "inbound.length" tun.inbound.length else [])

     

       202
       202
       -
               ++ (if tun ? inbound.quantity then

     

       203
       203
       -
                   optionalNullInt "inbound.quantity" tun.inbound.quantity else [])

     

       204
       204
       -
               ++ (if tun ? outbound.length then

     

       205
       205
       -
                   optionalNullInt "outbound.length" tun.outbound.length else [])

     

       206
       206
       -
               ++ (if tun ? outbound.quantity then

     

       207
       207
       -
                   optionalNullInt "outbound.quantity" tun.outbound.quantity else [])

     

       208
       208
       -
               ++ (if tun ? crypto.tagsToSend then

     

       209
       209
       -
                   optionalNullInt "crypto.tagstosend" tun.crypto.tagsToSend else []);

     

       195
       195
       +
               ] ++ (optionals (tun ? destinationPort) (optionalNullInt "destinationport" tun.destinationPort))

     

       196
       196
       +
               ++ (optionals (tun ? keys) (optionalNullString "keys" tun.keys))

     

       197
       197
       +
               ++ (optionals (tun ? address) (optionalNullString "address" tun.address))

     

       198
       198
       +
               ++ (optionals (tun ? inbound.length) (optionalNullInt "inbound.length" tun.inbound.length))

     

       199
       199
       +
               ++ (optionals (tun ? inbound.quantity) (optionalNullInt "inbound.quantity" tun.inbound.quantity))

     

       200
       200
       +
               ++ (optionals (tun ? outbound.length) (optionalNullInt "outbound.length" tun.outbound.length))

     

       201
       201
       +
               ++ (optionals (tun ? outbound.quantity) (optionalNullInt "outbound.quantity" tun.outbound.quantity))

     

       202
       202
       +
               ++ (optionals (tun ? crypto.tagsToSend) (optionalNullInt "crypto.tagstosend" tun.crypto.tagsToSend));

     

       210
       203
        
               in concatStringsSep "\n" outTunOpts))

     

       211
       204
        
           (flip map

     

       212
       205
        
             (collect (tun: tun ? port && tun ? address) cfg.inTunnels)

     
···

       215
       208
        
               "type = server"

     

       216
       209
        
               (intOpt "port" tun.port)

     

       217
       210
        
               (strOpt "host" tun.address)

     

       218
       218
       -
             ] ++ (if tun ? destination then

     

       219
       219
       -
                   optionalNullString "destination" tun.destination else [])

     

       220
       220
       -
               ++ (if tun ? keys then

     

       221
       221
       -
                   optionalNullString "keys" tun.keys else [])

     

       222
       222
       -
               ++ (if tun ? inPort then

     

       223
       223
       -
                   optionalNullInt "inport" tun.inPort else [])

     

       224
       224
       -
               ++ (if tun ? accessList then

     

       225
       225
       -
                   optionalEmptyList "accesslist" tun.accessList else []);

     

       211
       211
       +
             ] ++ (optionals (tun ? destination) (optionalNullString "destination" tun.destination))

     

       212
       212
       +
               ++ (optionals (tun ? keys) (optionalNullString "keys" tun.keys))

     

       213
       213
       +
               ++ (optionals (tun ? inPort) (optionalNullInt "inport" tun.inPort))

     

       214
       214
       +
               ++ (optionals (tun ? accessList) (optionalEmptyList "accesslist" tun.accessList));

     

       226
       215
        
               in concatStringsSep "\n" inTunOpts))];

     

       227
       216
        
           in pkgs.writeText "i2pd-tunnels.conf" opts;

     

       228
       217

+2 -3

nixos/modules/services/networking/prosody.nix

···

       757
       757
        
       

     

       758
       758
        
           environment.etc."prosody/prosody.cfg.lua".text =

     

       759
       759
        
             let

     

       760
       760
       -
               httpDiscoItems = if (cfg.uploadHttp != null)

     

       761
       761
       -
                   then [{ url = cfg.uploadHttp.domain; description = "HTTP upload endpoint";}]

     

       762
       762
       -
                   else [];

     

       760
       760
       +
               httpDiscoItems = optionals (cfg.uploadHttp != null)

     

       761
       761
       +
                   [{ url = cfg.uploadHttp.domain; description = "HTTP upload endpoint";}];

     

       763
       762
        
               mucDiscoItems = builtins.foldl'

     

       764
       763
        
                   (acc: muc: [{ url = muc.domain; description = "${muc.domain} MUC endpoint";}] ++ acc)

     

       765
       764
        
                   []

+1 -1

nixos/modules/services/networking/ssh/sshd.nix

···

       528
       528
        
       

     

       529
       529
        
             };

     

       530
       530
        
       

     

       531
       531
       -
           networking.firewall.allowedTCPPorts = if cfg.openFirewall then cfg.ports else [];

     

       531
       531
       +
           networking.firewall.allowedTCPPorts = optionals cfg.openFirewall cfg.ports;

     

       532
       532
        
       

     

       533
       533
        
           security.pam.services.sshd =

     

       534
       534
        
             { startSession = true;

+1 -1

nixos/modules/services/networking/vsftpd.nix

···

       305
       305
        
       

     

       306
       306
        
           # If you really have to access root via FTP use mkOverride or userlistDeny

     

       307
       307
        
           # = false and whitelist root

     

       308
       308
       -
           services.vsftpd.userlist = if cfg.userlistDeny then ["root"] else [];

     

       308
       308
       +
           services.vsftpd.userlist = optional cfg.userlistDeny "root";

     

       309
       309
        
       

     

       310
       310
        
           systemd = {

     

       311
       311
        
             tmpfiles.rules = optional cfg.anonymousUser

+2 -3

nixos/modules/services/security/tor.nix

···

       769
       769
        
                 };

     

       770
       770
        
                 options.SOCKSPort = mkOption {

     

       771
       771
        
                   description = lib.mdDoc (descriptionGeneric "SOCKSPort");

     

       772
       772
       -
                   default = if cfg.settings.HiddenServiceNonAnonymousMode == true then [{port = 0;}] else [];

     

       772
       772
       +
                   default = lib.optionals cfg.settings.HiddenServiceNonAnonymousMode [{port = 0;}];

     

       773
       773
        
                   defaultText = literalExpression ''

     

       774
       774
        
                     if config.${opt.settings}.HiddenServiceNonAnonymousMode == true

     

       775
       775
        
                     then [ { port = 0; } ]

     
···

       897
       897
        
             allowedTCPPorts =

     

       898
       898
        
               concatMap (o:

     

       899
       899
        
                 if isInt o && o > 0 then [o]

     

       900
       900
       -
                 else if o ? "port" && isInt o.port && o.port > 0 then [o.port]

     

       901
       901
       -
                 else []

     

       900
       900
       +
                 else optionals (o ? "port" && isInt o.port && o.port > 0) [o.port]

     

       902
       901
        
               ) (flatten [

     

       903
       902
        
                 cfg.settings.ORPort

     

       904
       903
        
                 cfg.settings.DirPort

+1 -1

nixos/modules/services/web-apps/dex.nix

···

       6
       6
        
         cfg = config.services.dex;

     

       7
       7
        
         fixClient = client: if client ? secretFile then ((builtins.removeAttrs client [ "secretFile" ]) // { secret = client.secretFile; }) else client;

     

       8
       8
        
         filteredSettings = mapAttrs (n: v: if n == "staticClients" then (builtins.map fixClient v) else v) cfg.settings;

     

       9
       9
       -
         secretFiles = flatten (builtins.map (c: if c ? secretFile then [ c.secretFile ] else []) (cfg.settings.staticClients or []));

     

       9
       9
       +
         secretFiles = flatten (builtins.map (c: optional (c ? secretFile) c.secretFile) (cfg.settings.staticClients or []));

     

       10
       10
        
       

     

       11
       11
        
         settingsFormat = pkgs.formats.yaml {};

     

       12
       12
        
         configFile = settingsFormat.generate "config.yaml" filteredSettings;

+1 -3

nixos/modules/services/web-apps/mastodon.nix

···

       91
       91
        
       

     

       92
       92
        
         envFile = pkgs.writeText "mastodon.env" (lib.concatMapStrings (s: s + "\n") (

     

       93
       93
        
           (lib.concatLists (lib.mapAttrsToList (name: value:

     

       94
       94
       -
             if value != null then [

     

       95
       95
       -
               "${name}=\"${toString value}\""

     

       96
       96
       -
             ] else []

     

       94
       94
       +
             lib.optional (value != null) ''${name}="${toString value}"''

     

       97
       95
        
           ) env))));

     

       98
       96
        
       

     

       99
       97
        
         mastodonTootctl = let

+1 -3

nixos/modules/services/web-apps/nifi.nix

···

       13
       13
        
       

     

       14
       14
        
         envFile = pkgs.writeText "nifi.env" (lib.concatMapStrings (s: s + "\n") (

     

       15
       15
        
           (lib.concatLists (lib.mapAttrsToList (name: value:

     

       16
       16
       -
             if value != null then [

     

       17
       17
       -
               "${name}=\"${toString value}\""

     

       18
       18
       -
             ] else []

     

       16
       16
       +
             lib.optional (value != null) ''${name}="${toString value}"''

     

       19
       17
        
           ) env))));

     

       20
       18
        
       

     

       21
       19
        
         nifiEnv = pkgs.writeShellScriptBin "nifi-env" ''

+1 -3

nixos/modules/services/web-apps/peertube.nix

···

       52
       52
        
       

     

       53
       53
        
         envFile = pkgs.writeText "peertube.env" (lib.concatMapStrings (s: s + "\n") (

     

       54
       54
        
           (lib.concatLists (lib.mapAttrsToList (name: value:

     

       55
       55
       -
             if value != null then [

     

       56
       56
       -
               "${name}=\"${toString value}\""

     

       57
       57
       -
             ] else []

     

       55
       55
       +
             lib.optional (value != null) ''${name}="${toString value}"''

     

       58
       56
        
           ) env))));

     

       59
       57
        
       

     

       60
       58
        
         peertubeEnv = pkgs.writeShellScriptBin "peertube-env" ''

+1 -1

nixos/modules/system/boot/luksroot.nix

···

       980
       980
        
             ++ luks.cryptoModules

     

       981
       981
        
             # workaround until https://marc.info/?l=linux-crypto-vger&m=148783562211457&w=4 is merged

     

       982
       982
        
             # remove once 'modprobe --show-depends xts' shows ecb as a dependency

     

       983
       983
       -
             ++ (if builtins.elem "xts" luks.cryptoModules then ["ecb"] else []);

     

       983
       983
       +
             ++ (optional (builtins.elem "xts" luks.cryptoModules) "ecb");

     

       984
       984
        
       

     

       985
       985
        
           # copy the cryptsetup binary and it's dependencies

     

       986
       986
        
           boot.initrd.extraUtilsCommands = let