Unverified Commit 91256b82 authored by github-actions[bot]'s avatar github-actions[bot] Committed by GitHub
Browse files

Merge master into staging-next

parents aa239dc2 7a252443

maintainers/maintainer-list.nix

+6 −0
Original line number Diff line number Diff line
@@ -1520,6 +1520,12 @@ 
    githubId = 12958979;

    name = "Mika Naylor";

  };

  autrimpo = {

    email = "michal@koutensky.net";

    github = "autrimpo";

    githubId = 5968483;

    name = "Michal Koutenský";

  };

  autumnal = {

    name = "Sven Friedrich";

    email = "sven@autumnal.de";

nixos/doc/manual/release-notes/rl-2305.section.md

+2 −0
Original line number Diff line number Diff line
@@ -88,6 +88,8 @@ In addition to numerous new and upgraded packages, this release has the followin 


- [networkd-dispatcher](https://gitlab.com/craftyguy/networkd-dispatcher), a dispatcher service for systemd-networkd connection status changes. Available as [services.networkd-dispatcher](#opt-services.networkd-dispatcher.enable).



- [gonic](https://github.com/sentriz/gonic), a Subsonic music streaming server. Available as [services.gonic](#opt-services.gonic.enable).



- [mmsd](https://gitlab.com/kop316/mmsd), a lower level daemon that transmits and recieves MMSes. Available as [services.mmsd](#opt-services.mmsd.enable).



- [QDMR](https://dm3mat.darc.de/qdmr/), a GUI application and command line tool for programming DMR radios [programs.qdmr](#opt-programs.qdmr.enable)

nixos/modules/module-list.nix

+2 −0
Original line number Diff line number Diff line
@@ -153,6 +153,7 @@ 
  ./programs/cnping.nix

  ./programs/command-not-found/command-not-found.nix

  ./programs/criu.nix

  ./programs/darling.nix

  ./programs/dconf.nix

  ./programs/digitalbitbox/default.nix

  ./programs/dmrconfig.nix
@@ -306,6 +307,7 @@ 
  ./services/audio/alsa.nix

  ./services/audio/botamusique.nix

  ./services/audio/gmediarender.nix

  ./services/audio/gonic.nix

  ./services/audio/hqplayerd.nix

  ./services/audio/icecast.nix

  ./services/audio/jack.nix

nixos/modules/programs/darling.nix

0 → 100644
+21 −0
Original line number Diff line number Diff line 
{ config, lib, pkgs, ... }:



let

  cfg = config.programs.darling;

in {

  options = {

    programs.darling = {

      enable = lib.mkEnableOption (lib.mdDoc "Darling, a Darwin/macOS compatibility layer for Linux");

      package = lib.mkPackageOptionMD pkgs "darling" {};

    };

  };



  config = lib.mkIf cfg.enable {

    security.wrappers.darling = {

      source = lib.getExe cfg.package;

      owner = "root";

      group = "root";

      setuid = true;

    };

  };

}

nixos/modules/services/audio/gonic.nix

0 → 100644
+89 −0
Original line number Diff line number Diff line 
{ config, lib, pkgs, ... }:



with lib;



let

  cfg = config.services.gonic;

  settingsFormat = pkgs.formats.keyValue {

    mkKeyValue = lib.generators.mkKeyValueDefault { } " ";

    listsAsDuplicateKeys = true;

  };

in

{

  options = {

    services.gonic = {



      enable = mkEnableOption (lib.mdDoc "Gonic music server");



      settings = mkOption rec {

        type = settingsFormat.type;

        apply = recursiveUpdate default;

        default = {

          listen-addr = "127.0.0.1:4747";

          cache-path = "/var/cache/gonic";

          tls-cert = null;

          tls-key = null;

        };

        example = {

          music-path = [ "/mnt/music" ];

          podcast-path = "/mnt/podcasts";

        };

        description = lib.mdDoc ''

          Configuration for Gonic, see <https://github.com/sentriz/gonic#configuration-options> for supported values.

        '';

      };



    };

  };



  config = mkIf cfg.enable {

    systemd.services.gonic = {

      description = "Gonic Media Server";

      after = [ "network.target" ];

      wantedBy = [ "multi-user.target" ];

      serviceConfig = {

        ExecStart =

          let

            # these values are null by default but should not appear in the final config

            filteredSettings = filterAttrs (n: v: !((n == "tls-cert" || n == "tls-key") && v == null)) cfg.settings;

          in

          "${pkgs.gonic}/bin/gonic -config-path ${settingsFormat.generate "gonic" filteredSettings}";

        DynamicUser = true;

        StateDirectory = "gonic";

        CacheDirectory = "gonic";

        WorkingDirectory = "/var/lib/gonic";

        RuntimeDirectory = "gonic";

        RootDirectory = "/run/gonic";

        ReadWritePaths = "";

        BindReadOnlyPaths = [

          # gonic can access scrobbling services

          "-/etc/ssl/certs/ca-certificates.crt"

          builtins.storeDir

          cfg.settings.podcast-path

        ] ++ cfg.settings.music-path

        ++ lib.optional (cfg.settings.tls-cert != null) cfg.settings.tls-cert

        ++ lib.optional (cfg.settings.tls-key != null) cfg.settings.tls-key;

        CapabilityBoundingSet = "";

        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];

        RestrictNamespaces = true;

        PrivateDevices = true;

        PrivateUsers = true;

        ProtectClock = true;

        ProtectControlGroups = true;

        ProtectHome = true;

        ProtectKernelLogs = true;

        ProtectKernelModules = true;

        ProtectKernelTunables = true;

        SystemCallArchitectures = "native";

        SystemCallFilter = [ "@system-service" "~@privileged" ];

        RestrictRealtime = true;

        LockPersonality = true;

        MemoryDenyWriteExecute = true;

        UMask = "0066";

        ProtectHostname = true;

      };

    };

  };



  meta.maintainers = [ maintainers.autrimpo ];

}