Unverified Commit 6c9a78c0 authored by Vladimír Čunát's avatar Vladimír Čunát Committed by GitHub
Browse files

Revert #493445: initrd secrets refactor (#501963)

parents ac86bfcc d6acf1b5

nixos/doc/manual/release-notes/rl-2605.section.md

+0 −2
Original line number Diff line number Diff line
@@ -247,8 +247,6 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>. 


- `services.caddy` now supports setting `httpPort` and `httpsPort` and opening them in the firewall via `openFirewall`.



- `boot.initrd.secrets` is now deprecated in favour of `boot.initrd.secretPaths` and `boot.initrd.extraSecretsHook`.



- The latest available version of Nextcloud is v33 (available as `pkgs.nextcloud33`). The installation logic is as follows:

  - If [`services.nextcloud.package`](#opt-services.nextcloud.package) is specified explicitly, this package will be installed (**recommended**)

  - If [`system.stateVersion`](#opt-system.stateVersion) is >=26.05, `pkgs.nextcloud33` will be installed by default.

nixos/modules/services/networking/iscsi/root-initiator.nix

+1 −1
Original line number Diff line number Diff line
@@ -86,7 +86,7 @@ in 
      description = ''

        Append an additional file's contents to `/etc/iscsid.conf`. Use a non-store path

        and store passwords in this file. Note: the file specified here must be available

        in the initrd, see: `boot.initrd.secretPaths`.

        in the initrd, see: `boot.initrd.secrets`.

      '';

      default = null;

      type = nullOr str;

nixos/modules/system/activation/bootspec.nix

+2 −4
Original line number Diff line number Diff line
@@ -14,9 +14,7 @@ let 
  children = lib.mapAttrs (

    childName: childConfig: childConfig.configuration.system.build.toplevel

  ) config.specialisation;

  hasInitrdSecrets =

    (lib.length (lib.attrNames config.boot.initrd.secretPaths) > 0)

    || (config.boot.initrd.extraSecretsHook != "");

  hasAtLeastOneInitrdSecret = lib.length (lib.attrNames config.boot.initrd.secrets) > 0;

  schemas = {

    v1 = rec {

      filename = "boot.json";
@@ -35,7 +33,7 @@ let 
              // lib.optionalAttrs config.boot.initrd.enable {

                initrd = "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";

              }

              // lib.optionalAttrs hasInitrdSecrets {

              // lib.optionalAttrs hasAtLeastOneInitrdSecret {

                initrdSecrets = "${config.system.build.initialRamdiskSecretAppender}/bin/append-initrd-secrets";

              };

            }

nixos/modules/system/boot/clevis.nix

+2 −2
Original line number Diff line number Diff line
@@ -99,8 +99,8 @@ in 
        sed -i $out/bin/clevis-decrypt-tpm2 -e 's,tpm2_,tpm2 ,'

      '';



      secretPaths = lib.mapAttrs' (

        name: value: lib.nameValuePair "/etc/clevis/${name}.jwe" { source = value.secretFile; }

      secrets = lib.mapAttrs' (

        name: value: lib.nameValuePair "/etc/clevis/${name}.jwe" value.secretFile

      ) cfg.devices;



      systemd = {

nixos/modules/system/boot/initrd-openvpn.nix

+3 −3
Original line number Diff line number Diff line
@@ -29,7 +29,7 @@ in 
    };



    boot.initrd.network.openvpn.configuration = mkOption {

      type = types.path; # Same type as boot.initrd.secretPaths.*.source

      type = types.path; # Same type as boot.initrd.secrets

      description = ''

        The configuration file for OpenVPN.
@@ -74,8 +74,8 @@ in 
      "${pkgs.glibc}/lib/libnss_dns.so.2"

    ];



    boot.initrd.secretPaths = {

      "/etc/initrd.ovpn".source = cfg.configuration;

    boot.initrd.secrets = {

      "/etc/initrd.ovpn" = cfg.configuration;

    };



    # openvpn --version would exit with 1 instead of 0