1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-08 19:45:42 +03:00
Commit graph

1327 commits

Author SHA1 Message Date
Maximilian Bosch
48459567ae nixos/postgresql: drop ensurePermissions, fix ensureUsers for postgresql15
Closes #216989

First of all, a bit of context: in PostgreSQL, newly created users don't
have the CREATE privilege on the public schema of a database even with
`ALL PRIVILEGES` granted via `ensurePermissions` which is how most of
the DB users are currently set up "declaratively"[1]. This means e.g. a
freshly deployed Nextcloud service will break early because Nextcloud
itself cannot CREATE any tables in the public schema anymore.

The other issue here is that `ensurePermissions` is a mere hack. It's
effectively a mixture of SQL code (e.g. `DATABASE foo` is relying on how
a value is substituted in a query. You'd have to parse a subset of SQL
to actually know which object are permissions granted to for a user).

After analyzing the existing modules I realized that in every case with
a single exception[2] the UNIX system user is equal to the db user is
equal to the db name and I don't see a compelling reason why people
would change that in 99% of the cases. In fact, some modules would even
break if you'd change that because the declarations of the system user &
the db user are mixed up[3].

So I decided to go with something new which restricts the ways to use
`ensure*` options rather than expanding those[4]. Effectively this means
that

* The DB user _must_ be equal to the DB name.
* Permissions are granted via `ensureDBOwnerhip` for an attribute-set in
  `ensureUsers`. That way, the user is actually the owner and can
  perform `CREATE`.
* For such a postgres user, a database must be declared in
  `ensureDatabases`.

For anything else, a custom state management should be implemented. This
can either be `initialScript`, doing it manual, outside of the module or
by implementing proper state management for postgresql[5], but the
current state of `ensure*` isn't even declarative, but a convergent tool
which is what Nix actually claims to _not_ do.

Regarding existing setups: there are effectively two options:

* Leave everything as-is (assuming that system user == db user == db
  name): then the DB user will automatically become the DB owner and
  everything else stays the same.

* Drop the `createDatabase = true;` declarations: nothing will change
  because a removal of `ensure*` statements is ignored, so it doesn't
  matter at all whether this option is kept after the first deploy (and
  later on you'd usually restore from backups anyways).

  The DB user isn't the owner of the DB then, but for an existing setup
  this is irrelevant because CREATE on the public schema isn't revoked
  from existing users (only not granted for new users).

[1] not really declarative though because removals of these statements
    are simply ignored for instance: https://github.com/NixOS/nixpkgs/issues/206467
[2] `services.invidious`: I removed the `ensure*` part temporarily
    because it IMHO falls into the category "manage the state on your
    own" (see the commit message). See also
    https://github.com/NixOS/nixpkgs/pull/265857
[3] e.g. roundcube had `"DATABASE ${cfg.database.username}" = "ALL PRIVILEGES";`
[4] As opposed to other changes that are considered a potential fix, but
    also add more things like collation for DBs or passwords that are
    _never_ touched again when changing those.
[5] As suggested in e.g. https://github.com/NixOS/nixpkgs/issues/206467
2023-11-13 17:16:25 +01:00
Anthony Roussel
d4d6602ce3
nixos/thanos: remove with lib; notation
https://nix.dev/guides/best-practices#with-scopes
2023-11-12 11:21:47 +01:00
Anthony Roussel
65be712043
nixos/thanos: use mkPackageOptionMD 2023-11-12 11:08:53 +01:00
Anthony Roussel
9abb2a2116
nixos/thanos: remove deprecations
* replaced store.grpc.series-sample-limit by store.limits.request-samples
* replaced query.replica-label by query.replica-labels
* replaced store.addresses by endpoints
* removed block-sync-concurrency (removed upstream)
2023-11-12 11:08:52 +01:00
Anthony Roussel
abed24c0d6
nixos/thanos: fix documentation 2023-11-12 11:08:52 +01:00
Anthony Roussel
312e7f8ae0
nixos/thanos: add ExecReload command to SystemD services 2023-11-12 11:08:52 +01:00
Anthony Roussel
0d9bef343b
nixos/thanos: fix services.thanos.receive.labels config 2023-11-12 11:08:51 +01:00
Anthony Roussel
2074409c86
nixos/thanos: add query-frontend SystemD service 2023-11-12 11:08:51 +01:00
Anthony Roussel
e30f48be94
treewide: fix redirected and broken URLs
Using the script in maintainers/scripts/update-redirected-urls.sh
2023-11-11 10:49:01 +01:00
Ryan Lahfa
bc2b72df73
Merge pull request #264234 from guiguid/guiguid-patch-netdata-systemd-journal
netdata: 1.43.0 -> 1.43.2 and add systemd-journal plugin
2023-11-08 13:30:43 +01:00
Felix Buehler
4d1680ccc7 nixos/exportarr: init 2023-11-07 20:56:32 +01:00
Ryan Lahfa
0cd6f66fb7
Merge pull request #247376 from RageKnify/fix/smartd-mail 2023-11-07 18:00:56 +01:00
Maximilian Bosch
dbb68f0b49
Merge pull request #263558 from Ma27/fix-image-renderer-callback
nixos/grafana-image-renderer: use Grafana's http_addr rather than localhost
2023-11-02 15:49:23 +01:00
Anthony Roussel
efdbdab8b5
nixos/ocsinventory-agent: init 2023-11-02 14:20:45 +01:00
Guillaume DELVIT
043522789b nixos/services/netdata: add systemd-journald plugin as a privileged wrapper
https://learn.netdata.cloud/docs/logs/systemd-journal/
need acces to

    Kernel Logs (dmesg):
        Capability: CAP_SYSLOG
        Description: This capability allows the program to read kernel logs using the dmesg command or by reading the /dev/kmsg file.

    System Logs (e.g., /var/log/syslog):
        Capability: CAP_DAC_READ_SEARCH
        Description: This capability allows the program to read system logs located in directories such as /var/log/.

    User Logs (e.g., /var/log/auth.log):
        Capability: CAP_DAC_READ_SEARCH
        Description: This capability allows the program to read user logs located in directories such as /var/log/.
2023-11-01 00:16:30 +01:00
Peder Bergebakken Sundt
37c7104f53
Merge pull request #262915 from chayleaf/certspotter
certspotter: init at 0.17.0; nixos/certspotter: init
2023-10-29 05:10:04 +01:00
Linus Heckemann
8670794565
Merge pull request #263203 from nikstur/replace-activation
Replace simple activationScripts
2023-10-28 10:17:15 +02:00
chayleaf
f4aeeb9e81
nixos/certspotter: init 2023-10-28 14:19:36 +07:00
Anthony Roussel
3a2d3bc3d8
nixos/goss: init 2023-10-27 08:00:48 +02:00
Maximilian Bosch
15e17917fc
nixos/grafana-image-renderer: use Grafana's http_addr rather than localhost
Otherwise the callback won't work Grafana is configured to listen on a
different IP address by default.
2023-10-26 12:57:39 +02:00
nikstur
1b2b1364de nixos/ups: replace activationScript via tmpfiles 2023-10-25 23:44:01 +02:00
chayleaf
413011ddf4 kea: use separate runtime directories for each service
Kea may clean the runtime directory when starting (or maybe systemd does
it). I ran into this issue when restarting Kea after changing its
configuration, so I think the fact it normally doesn't clean it is a
race condition (it's cleaned on service start, and normally all Kea
services start at roughly the same time).
2023-10-26 02:51:43 +07:00
Rebecca Kelly
855223de8f nixos/munin: fix internAndFixPlugins mangling store paths
The previous implementation works fine when the plugins do not already
contain store paths, which is the case for stuff from munin-contrib.
However, for plugins generated via nix (e.g. with writeShellScriptBin),
it tries to fix the paths in it which already point to the nix store,
ruining everything.
2023-10-25 09:00:45 +02:00
Rebecca Kelly
0f7fb5cdcf nixos/munin: fix key-context error when using extraAutoPlugins
If extraAutoPlugins contains values that carry context (e.g. it comes
from a flake input), the keys generated from them using baseNameOf
inherit that context and the config doesn't compile.

This doesn't actually need to be an attrset anyways, so a bit of
internal refactoring lets us fix this without changing the visible API.
2023-10-25 09:00:45 +02:00
Martin Weinelt
589ccfdac1
nixos/prometheus-exporters/knot: update for new exporter
The new exporter has proper console scripts definition, that sets up
another executable name.

The package now also shells out to pidof, which is why we require procps
in the unit PATH.
2023-10-23 13:19:52 +02:00
Bjørn Forsman
142074c2a8 nixos: fix bad mkEnableOption descriptions
Fix descriptions that don't account for (1) the "Whether to enable"
prefix or (2) the automatically added trailing dot.
2023-10-20 16:22:40 +01:00
Jennifer Graul
e94820dfb2 nixos/librenms: init 2023-10-16 13:28:22 +02:00
Alexandre Iooss
925a8806dc nixos/prometheus: fix cross-compilation 2023-10-14 16:45:18 +02:00
Arnout Engelen
6071292b2a
Merge pull request #243338 from raboof/prometheus-imap-mailstat-exporter-init-at-2023-06-20
prometheus-imap-mailstat-exporter: init at 0.0.1
2023-10-11 17:33:25 -03:00
1000101
3b094812b1 prometheus-pgbouncer-exporter: init at 0.7.0 2023-10-07 11:44:40 +02:00
WilliButz
2d30a37d9f
Merge pull request #248925 from FugiMuffi/prometheus-sabnzbd-exporter
prometheus-sabnzbd-exporter: init at 0.1.70
2023-09-25 12:09:36 +02:00
hexchen
8ec182e570 nixos/prometheus: fix blackbox exporter 2023-09-21 08:49:10 +02:00
Arnout Engelen
69ecad6acb
Merge pull request #254563 from raboof/prometheus-exporter-nextcloud-fixup
prometheus-exporter-nextcloud: require either tokenFile or passwordFile
2023-09-20 22:33:10 +02:00
Arnout Engelen
81daaece83
prometheus-imap-mailstat-exporter: init at 0.0.1
To be able to monitor the number of (unread) mails in mailboxes
2023-09-20 22:29:57 +02:00
Arnout Engelen
1bf360af28
prometheus-exporter-nextcloud: require either tokenFile or passwordFile
follow-up on 28b3156bc6 which broke
when tokenFile was left empty.

Making both options nullable also allows us to provide a more meaningful
error message when neither authentication method is configured.
2023-09-19 13:19:54 +02:00
Maximilian Bosch
b4dbea193a
Merge pull request #255179 from Ma27/rm-grafana-migration-error
nixos/grafana: remove hacky deprecation helper from dashbaords & datasources
2023-09-17 13:44:33 +02:00
Maximilian Bosch
698c640e77
nixos/grafana: remove hacky deprecation helper from dashbaords & datasources
The problem we had back then was that `mkRenamedOptionModule` doesn't
work if an option will be moved a level depper, i.e.

    services.grafana.provision.dashboards

became

    services.grafana.provision.dashboards.settings.provider

I actually planned to remove this before 23.05 (since the change was
already released in 22.11), but as you can see that didn't happen ;-)

I think the grace-period was quite long already. And if someone is
migrating from <22.11 to a current NixOS now, there are very precise
instructions on how to upgrade in the 22.11 release notes.
2023-09-14 22:12:53 +02:00
nicoo
46a0c5ebbe nixos/below: Document maintainer 2023-09-13 10:25:28 +00:00
tilpner
6e8591a8d1 nixos/mimir: add extraFlags option 2023-09-04 20:26:02 +00:00
tilpner
8562dc924d
nixos/prometheus: add remote{Read, Write}.headers options 2023-09-03 23:36:49 +02:00
Martin Weinelt
73c5a5a778
nixos/prometheus/unbound-exporter: update for new package
The command line interface changed slightly, but still supports the TCP
as well as the UDS control interface.
2023-08-28 23:21:52 +02:00
Janik
321734bc2b
Merge pull request #251157 from NetaliDev/vmagent-extra-options 2023-08-26 21:21:11 +02:00
Franz Pletz
fe907aa37e
Merge pull request #242365 from h7x4/add-mysqld-exporter
services/prometheus/exporters: add mysqld
2023-08-25 23:56:22 +02:00
Arnout Engelen
4dcaa04151
Merge pull request #242942 from raboof/prometheus-nextcloud-auth-token
prometheus-exporter-nextcloud: support for auth tokens
2023-08-25 09:54:23 +02:00
Jennifer Graul
f0b76e7d10
nixos/vmagent: add extraOptions option 2023-08-24 15:09:29 +02:00
h7x4
8981783b60
services/prometheus/exporters: add mysqld
Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
2023-08-13 19:46:30 +02:00
Fugi
5e75b36302
nixos/prometheus-sabnzbd-exporter: init 2023-08-13 16:31:52 +02:00
Mario Rodas
d8001aae54
Merge pull request #242116 from flurie/fix-datadog-agent
datadog-agent: 7.38.1 -> 7.45.1
2023-08-10 20:53:27 -05:00
Franz Pletz
8e372c19d1
Merge pull request #245286 from codec/add-prometheus-idrac-exporter
prometheus-idrac-exporter: init at unstable-2023-06-29
2023-08-10 00:58:03 +02:00
DDoSolitary
d410464c5d
nixos/netdata: fix position of NETDATA_PIPENAME
It was accidentally placed in a condition-guarded block, making the
setting only take effect when enableAnalyticsReporting = false.
2023-08-09 19:22:20 +08:00