Commit 2f9e98cc authored by Weijia Wang's avatar Weijia Wang
Browse files

Merge branch 'master' into staging-next

parents 1bd03328 0373b68d

maintainers/maintainer-list.nix

+12 −0
Original line number Diff line number Diff line
@@ -14994,6 +14994,12 @@ 
    githubId = 18549627;

    name = "Proglodyte";

  };

  proglottis = {

    email = "proglottis@gmail.com";

    github = "proglottis";

    githubId = 74465;

    name = "James Fargher";

  };

  progval = {

    email = "progval+nix@progval.net";

    github = "progval";
@@ -18184,6 +18190,12 @@ 
    githubId = 2389333;

    name = "Andy Tockman";

  };

  teatwig = {

    email = "nix@teatwig.net";

    name = "tea";

    github = "teatwig";

    githubId = 18734648;

  };

  techknowlogick = {

    email = "techknowlogick@gitea.com";

    github = "techknowlogick";

nixos/doc/manual/release-notes/rl-2405.section.md

+2 −0
Original line number Diff line number Diff line
@@ -160,6 +160,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m 
- `services.zfs.zed.enableMail` now uses the global `sendmail` wrapper defined by an email module

  (such as msmtp or Postfix). It no longer requires using a special ZFS build with email support.



- The `krb5` module has been rewritten and moved to `security.krb5`, moving all options but `security.krb5.enable` and `security.krb5.package` into `security.krb5.settings`.



- Gitea 1.21 upgrade has several breaking changes, including:

  - Custom themes and other assets that were previously stored in `custom/public/*` now belong in `custom/public/assets/*`

  - New instances of Gitea using MySQL now ignore the `[database].CHARSET` config option and always use the `utf8mb4` charset, existing instances should migrate via the `gitea doctor convert` CLI command.

nixos/modules/config/krb5/default.nix

deleted100644 → 0
+0 −369
Original line number Diff line number Diff line 
{ config, lib, pkgs, ... }:



with lib;



let



  cfg = config.krb5;



  # This is to provide support for old configuration options (as much as is

  # reasonable). This can be removed after 18.03 was released.

  defaultConfig = {

    libdefaults = optionalAttrs (cfg.defaultRealm != null)

      { default_realm = cfg.defaultRealm; };



    realms = optionalAttrs (lib.all (value: value != null) [

      cfg.defaultRealm cfg.kdc cfg.kerberosAdminServer

    ]) {

      ${cfg.defaultRealm} = {

        kdc = cfg.kdc;

        admin_server = cfg.kerberosAdminServer;

      };

    };



    domain_realm = optionalAttrs (lib.all (value: value != null) [

      cfg.domainRealm cfg.defaultRealm

    ]) {

      ".${cfg.domainRealm}" = cfg.defaultRealm;

      ${cfg.domainRealm} = cfg.defaultRealm;

    };

  };



  mergedConfig = (recursiveUpdate defaultConfig {

    inherit (config.krb5)

      kerberos libdefaults realms domain_realm capaths appdefaults plugins

      extraConfig config;

  });



  filterEmbeddedMetadata = value: if isAttrs value then

    (filterAttrs

      (attrName: attrValue: attrName != "_module" && attrValue != null)

        value)

    else value;



  indent = "  ";



  mkRelation = name: value:

    if (isList value) then

      concatMapStringsSep "\n" (mkRelation name) value

    else "${name} = ${mkVal value}";



  mkVal = value:

    if (value == true) then "true"

    else if (value == false) then "false"

    else if (isInt value) then (toString value)

    else if (isAttrs value) then

      let configLines = concatLists

        (map (splitString "\n")

          (mapAttrsToList mkRelation value));

      in

      (concatStringsSep "\n${indent}"

        ([ "{" ] ++ configLines))

      + "\n}"

    else value;



  mkMappedAttrsOrString = value: concatMapStringsSep "\n"

    (line: if builtins.stringLength line > 0

      then "${indent}${line}"

      else line)

    (splitString "\n"

      (if isAttrs value then

        concatStringsSep "\n"

            (mapAttrsToList mkRelation value)

        else value));



in {



  ###### interface



  options = {

    krb5 = {

      enable = mkEnableOption (lib.mdDoc "building krb5.conf, configuration file for Kerberos V");



      kerberos = mkOption {

        type = types.package;

        default = pkgs.krb5;

        defaultText = literalExpression "pkgs.krb5";

        example = literalExpression "pkgs.heimdal";

        description = lib.mdDoc ''

          The Kerberos implementation that will be present in

          `environment.systemPackages` after enabling this

          service.

        '';

      };



      libdefaults = mkOption {

        type = with types; either attrs lines;

        default = {};

        apply = attrs: filterEmbeddedMetadata attrs;

        example = literalExpression ''

          {

            default_realm = "ATHENA.MIT.EDU";

          };

        '';

        description = lib.mdDoc ''

          Settings used by the Kerberos V5 library.

        '';

      };



      realms = mkOption {

        type = with types; either attrs lines;

        default = {};

        example = literalExpression ''

          {

            "ATHENA.MIT.EDU" = {

              admin_server = "athena.mit.edu";

              kdc = [

                "athena01.mit.edu"

                "athena02.mit.edu"

              ];

            };

          };

        '';

        apply = attrs: filterEmbeddedMetadata attrs;

        description = lib.mdDoc "Realm-specific contact information and settings.";

      };



      domain_realm = mkOption {

        type = with types; either attrs lines;

        default = {};

        example = literalExpression ''

          {

            "example.com" = "EXAMPLE.COM";

            ".example.com" = "EXAMPLE.COM";

          };

        '';

        apply = attrs: filterEmbeddedMetadata attrs;

        description = lib.mdDoc ''

          Map of server hostnames to Kerberos realms.

        '';

      };



      capaths = mkOption {

        type = with types; either attrs lines;

        default = {};

        example = literalExpression ''

          {

            "ATHENA.MIT.EDU" = {

              "EXAMPLE.COM" = ".";

            };

            "EXAMPLE.COM" = {

              "ATHENA.MIT.EDU" = ".";

            };

          };

        '';

        apply = attrs: filterEmbeddedMetadata attrs;

        description = lib.mdDoc ''

          Authentication paths for non-hierarchical cross-realm authentication.

        '';

      };



      appdefaults = mkOption {

        type = with types; either attrs lines;

        default = {};

        example = literalExpression ''

          {

            pam = {

              debug = false;

              ticket_lifetime = 36000;

              renew_lifetime = 36000;

              max_timeout = 30;

              timeout_shift = 2;

              initial_timeout = 1;

            };

          };

        '';

        apply = attrs: filterEmbeddedMetadata attrs;

        description = lib.mdDoc ''

          Settings used by some Kerberos V5 applications.

        '';

      };



      plugins = mkOption {

        type = with types; either attrs lines;

        default = {};

        example = literalExpression ''

          {

            ccselect = {

              disable = "k5identity";

            };

          };

        '';

        apply = attrs: filterEmbeddedMetadata attrs;

        description = lib.mdDoc ''

          Controls plugin module registration.

        '';

      };



      extraConfig = mkOption {

        type = with types; nullOr lines;

        default = null;

        example = ''

          [logging]

            kdc          = SYSLOG:NOTICE

            admin_server = SYSLOG:NOTICE

            default      = SYSLOG:NOTICE

        '';

        description = lib.mdDoc ''

          These lines go to the end of `krb5.conf` verbatim.

          `krb5.conf` may include any of the relations that are

          valid for `kdc.conf` (see `man kdc.conf`),

          but it is not a recommended practice.

        '';

      };



      config = mkOption {

        type = with types; nullOr lines;

        default = null;

        example = ''

          [libdefaults]

            default_realm = EXAMPLE.COM



          [realms]

            EXAMPLE.COM = {

              admin_server = kerberos.example.com

              kdc = kerberos.example.com

              default_principal_flags = +preauth

            }



          [domain_realm]

            example.com  = EXAMPLE.COM

            .example.com = EXAMPLE.COM



          [logging]

            kdc          = SYSLOG:NOTICE

            admin_server = SYSLOG:NOTICE

            default      = SYSLOG:NOTICE

        '';

        description = lib.mdDoc ''

          Verbatim `krb5.conf` configuration.  Note that this

          is mutually exclusive with configuration via

          `libdefaults`, `realms`,

          `domain_realm`, `capaths`,

          `appdefaults`, `plugins` and

          `extraConfig` configuration options.  Consult

          `man krb5.conf` for documentation.

        '';

      };



      defaultRealm = mkOption {

        type = with types; nullOr str;

        default = null;

        example = "ATHENA.MIT.EDU";

        description = lib.mdDoc ''

          DEPRECATED, please use

          `krb5.libdefaults.default_realm`.

        '';

      };



      domainRealm = mkOption {

        type = with types; nullOr str;

        default = null;

        example = "athena.mit.edu";

        description = lib.mdDoc ''

          DEPRECATED, please create a map of server hostnames to Kerberos realms

          in `krb5.domain_realm`.

        '';

      };



      kdc = mkOption {

        type = with types; nullOr str;

        default = null;

        example = "kerberos.mit.edu";

        description = lib.mdDoc ''

          DEPRECATED, please pass a `kdc` attribute to a realm

          in `krb5.realms`.

        '';

      };



      kerberosAdminServer = mkOption {

        type = with types; nullOr str;

        default = null;

        example = "kerberos.mit.edu";

        description = lib.mdDoc ''

          DEPRECATED, please pass an `admin_server` attribute

          to a realm in `krb5.realms`.

        '';

      };

    };

  };



  ###### implementation



  config = mkIf cfg.enable {



    environment.systemPackages = [ cfg.kerberos ];



    environment.etc."krb5.conf".text = if isString cfg.config

      then cfg.config

      else (''

        [libdefaults]

        ${mkMappedAttrsOrString mergedConfig.libdefaults}



        [realms]

        ${mkMappedAttrsOrString mergedConfig.realms}



        [domain_realm]

        ${mkMappedAttrsOrString mergedConfig.domain_realm}



        [capaths]

        ${mkMappedAttrsOrString mergedConfig.capaths}



        [appdefaults]

        ${mkMappedAttrsOrString mergedConfig.appdefaults}



        [plugins]

        ${mkMappedAttrsOrString mergedConfig.plugins}

      '' + optionalString (mergedConfig.extraConfig != null)

          ("\n" + mergedConfig.extraConfig));



    warnings = flatten [

      (optional (cfg.defaultRealm != null) ''

        The option krb5.defaultRealm is deprecated, please use

        krb5.libdefaults.default_realm.

      '')

      (optional (cfg.domainRealm != null) ''

        The option krb5.domainRealm is deprecated, please use krb5.domain_realm.

      '')

      (optional (cfg.kdc != null) ''

        The option krb5.kdc is deprecated, please pass a kdc attribute to a

        realm in krb5.realms.

      '')

      (optional (cfg.kerberosAdminServer != null) ''

        The option krb5.kerberosAdminServer is deprecated, please pass an

        admin_server attribute to a realm in krb5.realms.

      '')

    ];



    assertions = [

      { assertion = !((builtins.any (value: value != null) [

            cfg.defaultRealm cfg.domainRealm cfg.kdc cfg.kerberosAdminServer

          ]) && ((builtins.any (value: value != {}) [

              cfg.libdefaults cfg.realms cfg.domain_realm cfg.capaths

              cfg.appdefaults cfg.plugins

            ]) || (builtins.any (value: value != null) [

              cfg.config cfg.extraConfig

            ])));

        message = ''

          Configuration of krb5.conf by deprecated options is mutually exclusive

          with configuration by section.  Please migrate your config using the

          attributes suggested in the warnings.

        '';

      }

      { assertion = !(cfg.config != null

          && ((builtins.any (value: value != {}) [

              cfg.libdefaults cfg.realms cfg.domain_realm cfg.capaths

              cfg.appdefaults cfg.plugins

            ]) || (builtins.any (value: value != null) [

              cfg.extraConfig cfg.defaultRealm cfg.domainRealm cfg.kdc

              cfg.kerberosAdminServer

            ])));

        message = ''

          Configuration of krb5.conf using krb.config is mutually exclusive with

          configuration by section.  If you want to mix the two, you can pass

          lines to any configuration section or lines to krb5.extraConfig.

        '';

      }

    ];

  };

}

nixos/modules/installer/tools/nix-fallback-paths.nix

+5 −5
Original line number Diff line number Diff line 
{

  x86_64-linux = "/nix/store/azvn85cras6xv4z5j85fiy406f24r1q0-nix-2.18.1";

  i686-linux = "/nix/store/9bnwy7f9h0kzdzmcnjjsjg0aak5waj40-nix-2.18.1";

  aarch64-linux = "/nix/store/hh65xwqm9s040s3cgn9vzcmrxj0sf5ij-nix-2.18.1";

  x86_64-darwin = "/nix/store/6zi5fqzn9n17wrk8r41rhdw4j7jqqsi3-nix-2.18.1";

  aarch64-darwin = "/nix/store/0pbq6wzr2f1jgpn5212knyxpwmkjgjah-nix-2.18.1";

  x86_64-linux = "/nix/store/smfmnz0ylx80wkbqbjibj7zcw4q668xp-nix-2.19.2";

  i686-linux = "/nix/store/knp0akbpj2k0rf26fmysmxdysmayihax-nix-2.19.2";

  aarch64-linux = "/nix/store/761hq0abn07nrydrf6mls61bscx2vz2i-nix-2.19.2";

  x86_64-darwin = "/nix/store/zlqvxis1dfcfgmy5fza4hllg6h03vhpb-nix-2.19.2";

  aarch64-darwin = "/nix/store/53r8ay20mygy2sifn7j2p8wjqlx2kxik-nix-2.19.2";

}

nixos/modules/module-list.nix

+1 −1
Original line number Diff line number Diff line
@@ -10,7 +10,6 @@ 
  ./config/gtk/gtk-icon-cache.nix

  ./config/i18n.nix

  ./config/iproute2.nix

  ./config/krb5/default.nix

  ./config/ldap.nix

  ./config/ldso.nix

  ./config/locale.nix
@@ -309,6 +308,7 @@ 
  ./security/duosec.nix

  ./security/google_oslogin.nix

  ./security/ipa.nix

  ./security/krb5

  ./security/lock-kernel-modules.nix

  ./security/misc.nix

  ./security/oath.nix