commit b95b91c956698d82935d0097bb15d27075b8c014 · pyrox.dev/nixpkgs

+3 -1

nixos/doc/manual/release-notes/rl-2511.section.md

···

       186
        
       

     

       187
        
       - `services.dependency-track` removed its configuration of the JVM heap size. This lets the JVM choose its maximum heap size automatically, which should work much better in practice for most users. For deployments on systems with little RAM, it may now be necessary to manually configure a maximum heap size using  {option}`services.dependency-track.javaArgs`.

     

       188
        
       

     

       189
       -
       - `services.dnscrypt-proxy2` gains a `package` option to specify dnscrypt-proxy package to use.

     

       0
        
       
     

       0
        
       
     

       190
        
       

     

       191
        
       - `services.nextcloud.configureRedis` now defaults to `true` in accordance with upstream recommendations to have caching for file locking. See the [upstream doc](https://docs.nextcloud.com/server/31/admin_manual/configuration_files/files_locking_transactional.html) for further details.

     

       192

···

       186
        
       

     

       187
        
       - `services.dependency-track` removed its configuration of the JVM heap size. This lets the JVM choose its maximum heap size automatically, which should work much better in practice for most users. For deployments on systems with little RAM, it may now be necessary to manually configure a maximum heap size using  {option}`services.dependency-track.javaArgs`.

     

       188
        
       

     

       189
       +
       - `services.dnscrypt-proxy2` was renamed to `services.dnscrypt-proxy` to match the package name. The systemd service is now also `dnscrypt-proxy`, but the old name is still provided as an alias for backwards compatibility.

     

       190
       +
       

     

       191
       +
       - `services.dnscrypt-proxy` gains a `package` option to specify dnscrypt-proxy package to use.

     

       192
        
       

     

       193
        
       - `services.nextcloud.configureRedis` now defaults to `true` in accordance with upstream recommendations to have caching for file locking. See the [upstream doc](https://docs.nextcloud.com/server/31/admin_manual/configuration_files/files_locking_transactional.html) for further details.

     

       194

+1 -1

nixos/modules/module-list.nix

···

       1123
        
         ./services/networking/deconz.nix

     

       1124
        
         ./services/networking/dhcpcd.nix

     

       1125
        
         ./services/networking/dnscache.nix

     

       1126
       -
         ./services/networking/dnscrypt-proxy2.nix

     

       1127
        
         ./services/networking/dnsdist.nix

     

       1128
        
         ./services/networking/dnsmasq.nix

     

       1129
        
         ./services/networking/dnsproxy.nix

···

       1123
        
         ./services/networking/deconz.nix

     

       1124
        
         ./services/networking/dhcpcd.nix

     

       1125
        
         ./services/networking/dnscache.nix

     

       1126
       +
         ./services/networking/dnscrypt-proxy.nix

     

       1127
        
         ./services/networking/dnsdist.nix

     

       1128
        
         ./services/networking/dnsmasq.nix

     

       1129
        
         ./services/networking/dnsproxy.nix

-1

nixos/modules/rename.nix

···

       131
        
             "services"

     

       132
        
             "deepin"

     

       133
        
           ] "the Deepin desktop environment has been removed from nixpkgs due to lack of maintenance.")

     

       134
       -
           (mkRemovedOptionModule [ "services" "dnscrypt-proxy" ] "Use services.dnscrypt-proxy2 instead")

     

       135
        
           (mkRemovedOptionModule [ "services" "dnscrypt-wrapper" ] ''

     

       136
        
             The dnscrypt-wrapper module was removed since the project has been effectively unmaintained since 2018;

     

       137
        
             moreover the NixOS module had to rely on an abandoned version of dnscrypt-proxy v1 for the rotation of keys.

···

       131
        
             "services"

     

       132
        
             "deepin"

     

       133
        
           ] "the Deepin desktop environment has been removed from nixpkgs due to lack of maintenance.")

     

       0
        
       
     

       134
        
           (mkRemovedOptionModule [ "services" "dnscrypt-wrapper" ] ''

     

       135
        
             The dnscrypt-wrapper module was removed since the project has been effectively unmaintained since 2018;

     

       136
        
             moreover the NixOS module had to rely on an abandoned version of dnscrypt-proxy v1 for the rotation of keys.

+12 -7

nixos/modules/services/networking/dnscrypt-proxy2.nix nixos/modules/services/networking/dnscrypt-proxy.nix

···

       7
        
       

     

       8
        
       let

     

       9
        
       

     

       10
       -
         cfg = config.services.dnscrypt-proxy2;

     

       11
        
       

     

       12
        
       in

     

       13
        
       

     

       14
        
       {

     

       15
       -
         options.services.dnscrypt-proxy2 = {

     

       16
       -
           enable = lib.mkEnableOption "dnscrypt-proxy2";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       17
        
       

     

       18
        
           package = lib.mkPackageOption pkgs "dnscrypt-proxy" { };

     

       19
        
       

     
···

       38
        
       

     

       39
        
           upstreamDefaults = lib.mkOption {

     

       40
        
             description = ''

     

       41
       -
               Whether to base the config declared in {option}`services.dnscrypt-proxy2.settings` on the upstream example config (<https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml>)

     

       42
        
       

     

       43
        
               Disable this if you want to declare your dnscrypt config from scratch.

     

       44
        
             '';

     
···

       49
        
           configFile = lib.mkOption {

     

       50
        
             description = ''

     

       51
        
               Path to TOML config file. See: <https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml>

     

       52
       -
               If this option is set, it will override any configuration done in options.services.dnscrypt-proxy2.settings.

     

       53
        
             '';

     

       54
        
             example = "/etc/dnscrypt-proxy/dnscrypt-proxy.toml";

     

       55
        
             type = lib.types.path;

     
···

       73
        
                   }

     

       74
        
                   ${pkgs.buildPackages.remarshal}/bin/json2toml < config.json > $out

     

       75
        
                 '';

     

       76
       -
             defaultText = lib.literalMD "TOML file generated from {option}`services.dnscrypt-proxy2.settings`";

     

       77
        
           };

     

       78
        
         };

     

       79
        
       

     
···

       81
        
       

     

       82
        
           networking.nameservers = lib.mkDefault [ "127.0.0.1" ];

     

       83
        
       

     

       84
       -
           systemd.services.dnscrypt-proxy2 = {

     

       85
        
             description = "DNSCrypt-proxy client";

     

       86
        
             wants = [

     

       87
        
               "network-online.target"

     
···

       93
        
             wantedBy = [

     

       94
        
               "multi-user.target"

     

       95
        
             ];

     

       0
        
       
     

       96
        
             serviceConfig = {

     

       97
        
               AmbientCapabilities = "CAP_NET_BIND_SERVICE";

     

       98
        
               CacheDirectory = "dnscrypt-proxy";

···

       7
        
       

     

       8
        
       let

     

       9
        
       

     

       10
       +
         cfg = config.services.dnscrypt-proxy;

     

       11
        
       

     

       12
        
       in

     

       13
        
       

     

       14
        
       {

     

       15
       +
         imports = [

     

       16
       +
           (lib.mkRenamedOptionModule [ "services" "dnscrypt-proxy2" ] [ "services" "dnscrypt-proxy" ])

     

       17
       +
         ];

     

       18
       +
       

     

       19
       +
         options.services.dnscrypt-proxy = {

     

       20
       +
           enable = lib.mkEnableOption "dnscrypt-proxy";

     

       21
        
       

     

       22
        
           package = lib.mkPackageOption pkgs "dnscrypt-proxy" { };

     

       23
        
       

     
···

       42
        
       

     

       43
        
           upstreamDefaults = lib.mkOption {

     

       44
        
             description = ''

     

       45
       +
               Whether to base the config declared in {option}`services.dnscrypt-proxy.settings` on the upstream example config (<https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml>)

     

       46
        
       

     

       47
        
               Disable this if you want to declare your dnscrypt config from scratch.

     

       48
        
             '';

     
···

       53
        
           configFile = lib.mkOption {

     

       54
        
             description = ''

     

       55
        
               Path to TOML config file. See: <https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml>

     

       56
       +
               If this option is set, it will override any configuration done in options.services.dnscrypt-proxy.settings.

     

       57
        
             '';

     

       58
        
             example = "/etc/dnscrypt-proxy/dnscrypt-proxy.toml";

     

       59
        
             type = lib.types.path;

     
···

       77
        
                   }

     

       78
        
                   ${pkgs.buildPackages.remarshal}/bin/json2toml < config.json > $out

     

       79
        
                 '';

     

       80
       +
             defaultText = lib.literalMD "TOML file generated from {option}`services.dnscrypt-proxy.settings`";

     

       81
        
           };

     

       82
        
         };

     

       83
        
       

     
···

       85
        
       

     

       86
        
           networking.nameservers = lib.mkDefault [ "127.0.0.1" ];

     

       87
        
       

     

       88
       +
           systemd.services.dnscrypt-proxy = {

     

       89
        
             description = "DNSCrypt-proxy client";

     

       90
        
             wants = [

     

       91
        
               "network-online.target"

     
···

       97
        
             wantedBy = [

     

       98
        
               "multi-user.target"

     

       99
        
             ];

     

       100
       +
             aliases = [ "dnscrypt-proxy2.service" ];

     

       101
        
             serviceConfig = {

     

       102
        
               AmbientCapabilities = "CAP_NET_BIND_SERVICE";

     

       103
        
               CacheDirectory = "dnscrypt-proxy";

+1 -1

nixos/tests/all-tests.nix

···

       438
        
           imports = [ ./discourse.nix ];

     

       439
        
           _module.args.package = pkgs.discourseAllPlugins;

     

       440
        
         };

     

       441
       -
         dnscrypt-proxy2 = runTestOn [ "x86_64-linux" ] ./dnscrypt-proxy2.nix;

     

       442
        
         dnsdist = import ./dnsdist.nix { inherit pkgs runTest; };

     

       443
        
         doas = runTest ./doas.nix;

     

       444
        
         docker = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./docker.nix;

···

       438
        
           imports = [ ./discourse.nix ];

     

       439
        
           _module.args.package = pkgs.discourseAllPlugins;

     

       440
        
         };

     

       441
       +
         dnscrypt-proxy = runTestOn [ "x86_64-linux" ] ./dnscrypt-proxy.nix;

     

       442
        
         dnsdist = import ./dnsdist.nix { inherit pkgs runTest; };

     

       443
        
         doas = runTest ./doas.nix;

     

       444
        
         docker = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./docker.nix;

+4 -4

nixos/tests/dnscrypt-proxy2.nix nixos/tests/dnscrypt-proxy.nix

···

       3
        
         localProxyPort = 43;

     

       4
        
       in

     

       5
        
       {

     

       6
       -
         name = "dnscrypt-proxy2";

     

       7
        
         meta.maintainers = with lib.maintainers; [ joachifm ];

     

       8
        
       

     

       9
        
         nodes = {

     
···

       14
        
             {

     

       15
        
               security.apparmor.enable = true;

     

       16
        
       

     

       17
       -
               services.dnscrypt-proxy2.enable = true;

     

       18
       -
               services.dnscrypt-proxy2.settings = {

     

       19
        
                 listen_addresses = [ "127.0.0.1:${toString localProxyPort}" ];

     

       20
        
                 sources.public-resolvers = {

     

       21
        
                   urls = [ "https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md" ];

     
···

       32
        
       

     

       33
        
         testScript = ''

     

       34
        
           client.wait_for_unit("dnsmasq")

     

       35
       -
           client.wait_for_unit("dnscrypt-proxy2")

     

       36
        
           client.wait_until_succeeds("ss --numeric --udp --listening | grep -q ${toString localProxyPort}")

     

       37
        
         '';

     

       38
        
       }

···

       3
        
         localProxyPort = 43;

     

       4
        
       in

     

       5
        
       {

     

       6
       +
         name = "dnscrypt-proxy";

     

       7
        
         meta.maintainers = with lib.maintainers; [ joachifm ];

     

       8
        
       

     

       9
        
         nodes = {

     
···

       14
        
             {

     

       15
        
               security.apparmor.enable = true;

     

       16
        
       

     

       17
       +
               services.dnscrypt-proxy.enable = true;

     

       18
       +
               services.dnscrypt-proxy.settings = {

     

       19
        
                 listen_addresses = [ "127.0.0.1:${toString localProxyPort}" ];

     

       20
        
                 sources.public-resolvers = {

     

       21
        
                   urls = [ "https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md" ];

     
···

       32
        
       

     

       33
        
         testScript = ''

     

       34
        
           client.wait_for_unit("dnsmasq")

     

       35
       +
           client.wait_for_unit("dnscrypt-proxy")

     

       36
        
           client.wait_until_succeeds("ss --numeric --udp --listening | grep -q ${toString localProxyPort}")

     

       37
        
         '';

     

       38
        
       }

+4 -4

nixos/tests/dnsdist.nix

···

       72
        
           ];

     

       73
        
       

     

       74
        
           nodes.client = {

     

       75
       -
             services.dnscrypt-proxy2.enable = true;

     

       76
       -
             services.dnscrypt-proxy2.upstreamDefaults = false;

     

       77
       -
             services.dnscrypt-proxy2.settings = {

     

       78
        
               server_names = [ "server" ];

     

       79
        
               listen_addresses = [ "[::1]:53" ];

     

       80
        
               cache = false;

     
···

       92
        
                 almost_expiration = server.succeed("date --date '14min'").strip()

     

       93
        
       

     

       94
        
             with subtest("The DNSCrypt client can connect to the server"):

     

       95
       -
                 client.wait_until_succeeds("journalctl -u dnscrypt-proxy2 --grep '\\[server\\] OK'")

     

       96
        
       

     

       97
        
             with subtest("DNS queries over UDP are working"):

     

       98
        
                 client.wait_for_open_port(53)

···

       72
        
           ];

     

       73
        
       

     

       74
        
           nodes.client = {

     

       75
       +
             services.dnscrypt-proxy.enable = true;

     

       76
       +
             services.dnscrypt-proxy.upstreamDefaults = false;

     

       77
       +
             services.dnscrypt-proxy.settings = {

     

       78
        
               server_names = [ "server" ];

     

       79
        
               listen_addresses = [ "[::1]:53" ];

     

       80
        
               cache = false;

     
···

       92
        
                 almost_expiration = server.succeed("date --date '14min'").strip()

     

       93
        
       

     

       94
        
             with subtest("The DNSCrypt client can connect to the server"):

     

       95
       +
                 client.wait_until_succeeds("journalctl -u dnscrypt-proxy --grep '\\[server\\] OK'")

     

       96
        
       

     

       97
        
             with subtest("DNS queries over UDP are working"):

     

       98
        
                 client.wait_for_open_port(53)

+1 -1

pkgs/by-name/dn/dnscrypt-proxy/package.nix

···

       20
        
           hash = "sha256-IFfhcirUGbp/pKFN/5aEpuIuhSR3ZS4K7TatBtaX5zg=";

     

       21
        
         };

     

       22
        
       

     

       23
       -
         passthru.tests = { inherit (nixosTests) dnscrypt-proxy2; };

     

       24
        
       

     

       25
        
         meta = with lib; {

     

       26
        
           description = "Tool that provides secure DNS resolution";

···

       20
        
           hash = "sha256-IFfhcirUGbp/pKFN/5aEpuIuhSR3ZS4K7TatBtaX5zg=";

     

       21
        
         };

     

       22
        
       

     

       23
       +
         passthru.tests = { inherit (nixosTests) dnscrypt-proxy; };

     

       24
        
       

     

       25
        
         meta = with lib; {

     

       26
        
           description = "Tool that provides secure DNS resolution";

+1 -1

pkgs/by-name/dn/dnsmasq/package.nix

···

       103
        
           prometheus-exporter = nixosTests.prometheus-exporters.dnsmasq;

     

       104
        
       

     

       105
        
           # these tests use dnsmasq incidentally

     

       106
       -
           inherit (nixosTests) dnscrypt-proxy2;

     

       107
        
           kubernetes-dns-single = nixosTests.kubernetes.dns-single-node;

     

       108
        
           kubernetes-dns-multi = nixosTests.kubernetes.dns-multi-node;

     

       109
        
         };

···

       103
        
           prometheus-exporter = nixosTests.prometheus-exporters.dnsmasq;

     

       104
        
       

     

       105
        
           # these tests use dnsmasq incidentally

     

       106
       +
           inherit (nixosTests) dnscrypt-proxy;

     

       107
        
           kubernetes-dns-single = nixosTests.kubernetes.dns-single-node;

     

       108
        
           kubernetes-dns-multi = nixosTests.kubernetes.dns-multi-node;

     

       109
        
         };