Merge remote-tracking branch 'origin/staging-next' into staging

nixos/modules/services/databases/postgresql.md

@@ -9,7 +9,7 @@
 
 <!-- FIXME: more stuff, like maintainer? -->
 
-PostgreSQL is an advanced, free relational database.
+PostgreSQL is an advanced, free, relational database.
 <!-- MORE -->
 
 ## Configuring {#module-services-postgres-configuring}
@@ -67,7 +67,7 @@ name. This can be done with
 If the database user name equals the connecting system user name,
 postgres by default will accept a passwordless connection via unix
 domain socket. This makes it possible to run many postgres-backed
-services without creating any database secrets at all
+services without creating any database secrets at all.
 
 ### Assigning extra permissions {#module-services-postgres-initializing-extra-permissions}
 
@@ -178,7 +178,7 @@ These instructions are also applicable to other versions.
 :::
 
 Major PostgreSQL upgrades require a downtime and a few imperative steps to be called. This is the case because
-each major version has some internal changes in the databases' state during major releases. Because of that,
+each major version has some internal changes in the databases' state. Because of that,
 NixOS places the state into {file}`/var/lib/postgresql/&lt;version&gt;` where each `version`
 can be obtained like this:
 ```
@@ -203,7 +203,6 @@ For an upgrade, a script like this can be used to simplify the process:
       systemctl stop postgresql
 
       export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
-
       export NEWBIN="${newPostgres}/bin"
 
       export OLDDATA="${cfg.dataDir}"
@@ -224,11 +223,11 @@ For an upgrade, a script like this can be used to simplify the process:
 
 The upgrade process is:
 
-  1. Rebuild nixos configuration with the configuration above added to your {file}`configuration.nix`. Alternatively, add that into separate file and reference it in `imports` list.
-  2. Login as root (`sudo su -`)
-  3. Run `upgrade-pg-cluster`. It will stop old postgresql, initialize a new one and migrate the old one to the new one. You may supply arguments like `--jobs 4` and `--link` to speedup migration process. See <https://www.postgresql.org/docs/current/pgupgrade.html> for details.
-  4. Change postgresql package in NixOS configuration to the one you were upgrading to via [](#opt-services.postgresql.package). Rebuild NixOS. This should start new postgres using upgraded data directory and all services you stopped during the upgrade.
-  5. After the upgrade it's advisable to analyze the new cluster.
+  1. Add the above to your {file}`configuration.nix` and rebuild. Alternatively, add that into a separate file and reference it in the `imports` list.
+  2. Login as root (`sudo su -`).
+  3. Run `upgrade-pg-cluster`. This will stop the old postgresql cluster, initialize a new one and migrate the old one to the new one. You may supply arguments like `--jobs 4` and `--link` to speedup the migration process. See <https://www.postgresql.org/docs/current/pgupgrade.html> for details.
+  4. Change the postgresql package in NixOS configuration to the one you were upgrading to via [](#opt-services.postgresql.package). Rebuild NixOS. This should start the new postgres version using the upgraded data directory and all services you stopped during the upgrade.
+  5. After the upgrade it's advisable to analyze the new cluster:
 
        - For PostgreSQL ≥ 14, use the `vacuumdb` command printed by the upgrades script.
        - For PostgreSQL < 14, run (as `su -l postgres` in the [](#opt-services.postgresql.dataDir), in this example {file}`/var/lib/postgresql/13`):
@@ -273,7 +272,7 @@ A complete list of options for the PostgreSQL module may be found [here](#opt-se
 
 ## Plugins {#module-services-postgres-plugins}
 
-Plugins collection for each PostgreSQL version can be accessed with `.pkgs`. For example, for `pkgs.postgresql_15` package, its plugin collection is accessed by `pkgs.postgresql_15.pkgs`:
+The collection of plugins for each PostgreSQL version can be accessed with `.pkgs`. For example, for the `pkgs.postgresql_15` package, its plugin collection is accessed by `pkgs.postgresql_15.pkgs`:
 ```ShellSession
 $ nix repl '<nixpkgs>'
 
@@ -301,7 +300,7 @@ To add plugins via NixOS configuration, set `services.postgresql.extensions`:
 }
 ```
 
-You can build custom PostgreSQL-with-plugins (to be used outside of NixOS) using function `.withPackages`. For example, creating a custom PostgreSQL package in an overlay can look like:
+You can build a custom `postgresql-with-plugins` (to be used outside of NixOS) using the function `.withPackages`. For example, creating a custom PostgreSQL package in an overlay can look like this:
 ```nix
 self: super: {
   postgresql_custom = self.postgresql_17.withPackages (ps: [
@@ -362,7 +361,7 @@ This currently works for:
 ## JIT (Just-In-Time compilation) {#module-services-postgres-jit}
 
 [JIT](https://www.postgresql.org/docs/current/jit-reason.html)-support in the PostgreSQL package
-is disabled by default because of the ~300MiB closure-size increase from the LLVM dependency. It
+is disabled by default because of the ~600MiB closure-size increase from the LLVM dependency. It
 can be optionally enabled in PostgreSQL with the following config option:
 
 ```nix
@@ -415,7 +414,7 @@ several common hardening options from `systemd`, most notably:
     }
     ```
 
-The NixOS module also contains necessary adjustments for extensions from `nixpkgs`
+The NixOS module also contains necessary adjustments for extensions from `nixpkgs`,
 if these are enabled. If an extension or a postgresql feature from `nixpkgs` breaks
 with hardening, it's considered a bug.
 

nixos/modules/services/network-filesystems/ipfs-cluster.nix

@@ -0,0 +1,126 @@
+{
+  config,
+  lib,
+  pkgs,
+  options,
+  ...
+}:
+let
+  cfg = config.services.ipfs-cluster;
+
+  # secret is by envvar, not flag
+  initFlags = toString [
+    (lib.optionalString (cfg.initPeers != [ ]) "--peers")
+    (lib.strings.concatStringsSep "," cfg.initPeers)
+  ];
+in
+{
+  options = {
+
+    services.ipfs-cluster = {
+
+      enable = lib.mkEnableOption "Pinset orchestration for IPFS - requires ipfs daemon to be useful";
+
+      consensus = lib.mkOption {
+        type = lib.types.enum [
+          "raft"
+          "crdt"
+        ];
+        description = "Consensus protocol - 'raft' or 'crdt'. https://cluster.ipfs.io/documentation/guides/consensus/";
+      };
+
+      dataDir = lib.mkOption {
+        type = lib.types.str;
+        default = "/var/lib/ipfs-cluster";
+        description = "The data dir for ipfs-cluster.";
+      };
+
+      initPeers = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "Peer addresses to initialize with on first run.";
+      };
+
+      openSwarmPort = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Open swarm port, secured by the cluster secret. This does not expose the API or proxy. https://cluster.ipfs.io/documentation/guides/security/";
+      };
+
+      secretFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        description = ''
+          File containing the cluster secret in the format of EnvironmentFile as described by
+          {manpage}`systemd.exec(5)`. For example:
+          <programlisting>
+          CLUSTER_SECRET=<replaceable>...</replaceable>
+          </programlisting>
+
+          If null, a new secret will be generated on first run and stored in the data directory.
+          A secret in the correct format can also be generated by: `openssl rand -hex 32`
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.enable -> config.services.kubo.enable;
+        message = "ipfs-cluster requires ipfs - configure and enable services.kubo";
+      }
+    ];
+
+    environment.systemPackages = [ pkgs.ipfs-cluster ];
+
+    systemd.tmpfiles.rules = [
+      "d '${cfg.dataDir}' - ${config.services.kubo.user} ${config.services.kubo.group} - -"
+    ];
+
+    systemd.services.ipfs-cluster-init = {
+      path = [
+        "/run/wrappers"
+        pkgs.ipfs-cluster
+      ];
+      environment.IPFS_CLUSTER_PATH = cfg.dataDir;
+      wantedBy = [ "default.target" ];
+
+      serviceConfig = {
+        ExecStart = [
+          "${lib.getExe' pkgs.ipfs-cluster "ipfs-cluster-service"} init --consensus ${cfg.consensus} ${initFlags}"
+        ];
+        Type = "oneshot";
+        RemainAfterExit = true;
+        User = config.services.kubo.user;
+        Group = config.services.kubo.group;
+        EnvironmentFile = lib.mkIf (cfg.secretFile != null) cfg.secretFile;
+      };
+      # only run once (= when the data directory is empty)
+      unitConfig.ConditionDirectoryNotEmpty = "!${cfg.dataDir}";
+    };
+
+    systemd.services.ipfs-cluster = {
+      environment.IPFS_CLUSTER_PATH = cfg.dataDir;
+      wantedBy = [ "multi-user.target" ];
+
+      wants = [ "ipfs-cluster-init.service" ];
+      after = [ "ipfs-cluster-init.service" ];
+
+      serviceConfig = {
+        Type = "notify";
+        ExecStart = [ "${lib.getExe' pkgs.ipfs-cluster "ipfs-cluster-service"} daemon" ];
+        User = config.services.kubo.user;
+        Group = config.services.kubo.group;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openSwarmPort [ 9096 ];
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [
+      sorki
+    ];
+  };
+}

nixos/modules/services/web-apps/cryptpad.nix

@@ -195,10 +195,12 @@ in
           SystemCallFilter = [
             "@pkey"
             "@system-service"
-            "@chown"
+            # /!\ order matters: @privileged contains @chown, so we need
+            # @privileged negated before we re-list @chown for libuv copy
+            "~@privileged"
+            "~@chown:EPERM"
             "~@keyring"
             "~@memlock"
-            "~@privileged"
             "~@resources"
             "~@setuid"
             "~@timer"