Enable using an erofs filesystem as one of the filesystems needed to
boot the system. This is useful for example in image based deployments
where the Nix store is mounted read only.
[erofs](https://docs.kernel.org/filesystems/erofs.html) offers multiple
benefits over older filesystems like squashfs. Skip fsck.erofs because
it is still experimental.
Calling `eval-config.nix` without a `system` from a Nix flake fails with
`error: attribute 'currentSystem' missing` since #230523. Setting
`system = null` removes the use of `currentSystem` and instead uses the
value from the `nixpkgs` module.
Note that this does not add to the `forbiddenDependenciesRegex`
code because that code check should be unaffected as it only checks
output dependencies, not build dependencies.
Build deps are added after that check, if those are enabled in the
first place.
By adding this option indirection, a test can declare all by itself
that it needs a custom nixpkgs. This is a more convenient way of
going about this when the caller of the test framework receives a
`node.pkgs` unconditionally.
This speeds up evaluation by a factor 2.
Ballpark figures from my machine:
```
$ time nix-build nixos/release.nix -A tests.acme
/nix/store/q4fxp55k64clcarsx8xc8f6s10szlfvz-vm-test-run-acme
/nix/store/lnfqg051sxx05hclva84bcbnjfc71c8x-vm-test-run-acme
real 1m28.142s
user 1m7.474s
sys 0m7.932s
$ time nix-build nixos/release.nix -A tests.acme
/nix/store/q4fxp55k64clcarsx8xc8f6s10szlfvz-vm-test-run-acme
/nix/store/lnfqg051sxx05hclva84bcbnjfc71c8x-vm-test-run-acme
real 0m38.235s
user 0m33.814s
sys 0m2.283s
```
For this round of ZHF: #230712
Failing Hydra build: https://hydra.nixos.org/build/219234565
Not sure why this a problem now and not in the past, but routes to
the corresponding `/24`-subnet are only configured if addresses are
specified with the correct CIDR.
https://github.com/ipfs/kubo/releases/tag/v0.20.0
When creating a repository with `ipfs init`, `--empty-repo=true` is now the default according to the changelog. Modify the NixOS module to reflect this change and fix the `emptyRepo` setting to work with this change.
mkIf is unnecessary when the condition is statically known - that is
knowable before entering the module evaluation.
By changing this to a precomputed module, we support changing the
defined options to readOnly options.
This is copied from isoImage.squashfsCompression. It's useful to be
able to customise, as iteration cycles are very slow with xz, and
subjectively systems booted with less efficiently compressed squashfs
stores appear to have faster reads (although I didn't test that
scientificly so there could be other factors).
Fail pattern:
1. Unsuspecting `qemu-kvm` notice:
```
server # qemu-kvm: at most 2047 MB RAM can be simulated
```
2. Hard fail
```
self.shell.send(out_command.encode())
BrokenPipeError: [Errno 32] Broken pipe
```
(Took me a while to consider those lines are related)
Fail pattern:
1. Unsuspecting `qemu-kvm` notice:
```
server # qemu-kvm: at most 2047 MB RAM can be simulated
```
2. Hard fail
```
self.shell.send(out_command.encode())
BrokenPipeError: [Errno 32] Broken pipe
```
(Took me a while to consider those lines are related)
the non-networkd backend does not wait for slaac to finish (ie, ipv6
addresses coming out of tentative state), and that breaks the mosquitto
bind_interface test slightly. if slaac takes too long the test will run
into mosquitto restart limits and fail.
Store the definition files in the initrd instead of reading them from
the Nix store in /sysroot.
This way, the initrd has to be re-generated every time the definition
files change. When the path to the defintion files instead of the
definition files themselves are embedded in the initrd, however, the
initrd also has to be re-generated every time. In this regard, this
change does not improve the status quo.
However, now systemd-repart also works reliable when the Nix store is
mounted separately from the root partition.
This change also enables new use-cases like creating partitions
necessary to boot the system. However, by default, the root partition
cannot be created on first boot because the systemd-repart service
requires a /sysroot to be mounted. Otherwise, systemd-repart cannot
determine the device to operate on.
Since v253, systemd-repart tries to create temporary directories in
/var/tmp. However, this directory doesn't exist in the initrd. This
commit adds an enviroment variable to re-use the existing /tmp directory
instead of /var/tmp.
Previously, we hardcoded a 60 second timer to stop netdata if we didn't have any answer back.
This is wrong and can cause data loss because the SIGTERM sent by systemd can sometimes be not honored.
Which in turn becomes a SIGKILL, causing potential data loss / corruption.
Offer a flag to users and bump the deadline to 2 minutes.
Because llvmPackages_latest is used in Nixpkgs, by quite a few
packages, it's difficult to keep it up to date, because updating it
requires some level of confidence that every package that uses it is
going to keep working after the update. The result of this is that
llvmPackages_latest is not updated, and so we end up in the situation
that "latest" is two versions older than the latest version we
actually provide. This is confusing and unexpected.
"But won't this end up fragmenting our LLVM versions, if every package
previously using _latest is separately pinned to LLVM 14?", I hear you
ask. No. That fragmentation is already happening, even with an
llvmPackages_latest, because packages that actually require the
_latest_ version of LLVM (15/16), have already been decoupled from
llvmPackages_latest since it hasn't been upgraded. So like it or not,
we can't escape packages depending on specific recent LLVMs. The only
real fix is to get better at keeping the default LLVM up to
date (which I'm reasonably confident we're getting into a better
position to be feasibly better able to do).
So, unless we want to double down on providing a confusingly named
"llvmPackages_latest" attribute that refers to some arbitrary LLVM
version that's probably not the latest one (or even the latest one
available in Nixpkgs), we only have two options here: either we don't
provide such an attribute at all, or we don't use it in Nixpkgs so we
don't become scared to bump it as soon as we have a new LLVM available.
Context summary:
'vma create' can't otherwise write to tmpfs such as /dev/shm.
This is important when used from non-nixos machines which may
have /build as tmpfs.
VMA is Proxmox's virtual machine image format that wraps QEMU images,
augmenting these with proxmox-specific configuration file.
proxmox-image.nix uses the VMA tool to create vma image files.
The VMA tool exists as a patchset ontop of QEMU.
VMA writes its output with open() and O_DIRECT flag.
O_DIRECT does not work on Linux tmpfs [1]. Thus:
$ vma create ~/output.vma ... # works, assuming home isn't tmpfs.
$ vma create /dev/shm/output.vma ... # fails since /dev/shm is tmpfs
Failure results in assert(*errp == NULL).
O_DIRECT is a cache performance hint.
But it currently blocks our usage of nixos-generate -f proxmox from
Non-NixOS hosts and Docker.
The patch here simply removes O_DIRECT:
vma-writer.c later performs memalign due to O_DIRECT, but this is
safe to do with or without O_DIRECT.
Ideally, this should be fixed in upstream Proxmox: Perhaps by falling
back to open without O_DIRECT.
Another attempt to fix this SIGABRT is [2], which writes the vma file
directory to $out/ folder -- however that may still be tmpfs mounted
which it is in our case.
[1] https://lore.kernel.org/lkml/45A29EC2.8020502@tmr.com/t/
[2] https://github.com/NixOS/nixpkgs/pull/224282
This change is made for two reasons:
1. If `toString config.restartTriggers` containes `\n`, systemd unit
file will be ill-formed.
2. This change can limit length of the trigger, although it doesn't
matter in most cases.
This allows modules that declare their class to be checked.
While that's not most user modules, frameworks can take advantage
of this by setting declaring the module class for their users.
That way, the mistake of importing a module into the wrong hierarchy
can be reported more clearly in some cases.
commit fd5d7b2586 ("tests/bpf: add module BTF test") added a new test
for module BTF, but that test does not work on aarch64. (merged in
https://github.com/NixOS/nixpkgs/pull/214001 )
This is not a regression (kfuncs didn't work on bpftrace 0.16,
even if you do not use features requiring BTF like argument name
or type), so just disable the test on aarch64 until it is fixed.
* add sector size parameter to swap randomEncryption
* add key size parameter to swap randomEncryption
* allow deviceName to be overridden for encrypted swap
* create test for swap random encryption
* update release notes
When `nixpkgs.hostPlatform` != `nixpkgs.buildPlatform`, building the
top-level attribute fails since the bootspec portion of the system
builder tries to reference the host platform's `jq`. Change this to
reference the build platform's `jq`.
Add a marker file to the python outputs that tells pip and other tooling
following PEP 668 that they should not be installing things system-wide.
This provides better feedback to the user and also potentially avoids issues in
single-user installs where the /nix/store is owned by the user.
For more details, see <https://peps.python.org/pep-0668/>
Here is how it currently looks like:
$ pip install requests
error: externally-managed-environment
× This environment is externally managed
╰─> This command has been disabled as it tries to modify the immutable
`/nix/store` filesystem.
To use Python with Nix and nixpkgs, have a look at the online documentation:
<https://nixos.org/manual/nixpkgs/stable/#python>.
The `B` in bridge should be capitalized.
It currently leads to an evuluation error:
```
error: attribute 'sectionbridgeVLAN' missing
at /nix/store/7wmrwj0sgwg1iivxk43lpkqjhji57mq7-source/nixos/modules/system/boot/networkd.nix:2386:56:
2385| example = { VLAN = "10-20"; };
2386| type = types.addCheck (types.attrsOf unitOption) check.network.sectionbridgeVLAN;
| ^
2387| description = lib.mdDoc ''
Did you mean sectionBridgeVLAN?
```
these examples were turned into untitle anchors previously because at
the time supporting examples was not deemed necessary or useful. now
that we have them we can restore them though.
the nixos manual contains enough examples to support them as a proper
toc entity with specialized rendering, and if in the future the nixpkgs
wants to use nixos-render-docs we will definitely have to support them.
this also allows us to restore some examples that were lost in previous
translation steps because there were too few to add renderer support
back then.
`useEFIBoot` is somewhat misleading, but we should make it possible to
enable UEFI environment / firmware without buying into a bootloader.
This makes it possible.
The OnCalendar systemd setting is additive. To clear the setting defined
by the pre-existing unit file, it has to be set first to an empty
string, then to the desired value.
This makes it easier to for example set `datasource_list = [ "Vultr" ];`
so that cloud-init doesn't scan trough all of the datasources when you
know on which target the system is going to be deployed.
Previously, one had to copy-paste the default config and adapt it.
To reduce the danger of accidentally exposing sensitive files processed
by a restic backup to other services/users, enable the `PrivateTmp=`
feature of restic service units, which provides a per service isolation
of `/tmp` and `/var/tmp`.
Co-authored-by: Daniel Nagy <danielnagy@posteo.de>
