Commit graph

1145 commits

Author SHA1 Message Date
Jack Rosenberg f26c52e8cf nixos/traefik: add WorkingDirectory 2025-08-11 11:03:17 +02:00
Florian Klink 9e087896d6
nixos/caddy: Make virtualHosts' logFormat optional (#392390) 2025-08-07 08:48:08 +02:00
Jhonas Wernery 92b504d2ff
nixos/garage: set LimitNOFILE (#429633)
Upstream uses 42000, see:
https://garagehq.deuxfleurs.fr/documentation/cookbook/systemd/
2025-07-30 19:55:09 +03:00
teutat3s e62971b005
nixos/nginx: sync with Mozilla Intermediate TLS configuration
- adds ssl_ecdh_curve, per https://github.com/mozilla/ssl-config-generator/issues/76
- removes ssl_stapling, after Let's Encrypt ended support for OCSP
  stapling https://letsencrypt.org/2024/12/05/ending-ocsp/, enabling ssl_stapling
  leads to warning log spam:
```
  ssl_stapling" ignored, no OCSP responder URL in the certificate "<cert-directory>
```
2025-07-26 14:26:28 +02:00
Wolfgang Walther 5a0711127c
treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
Wolfgang Walther 62fe016519
treewide: run treefmt with mdcr/nixfmt 2025-07-24 13:52:31 +02:00
Sandro Jäckel 0f964599a5
nixos/nginx: remove usage of recommendedZstdSettings and zstd settings duplication 2025-07-16 14:14:03 +02:00
Franz Pletz 9771deb49b
nixos/nginx: remove recommendedZstdSettings, add experimental option (#381678) 2025-07-16 13:03:17 +02:00
Alex Martens 5420ae11ea nixos/minio: harden service 2025-07-16 11:18:45 +02:00
Christian Theune 8046e4a6f8 nixos/varnish: turn listen addresses into structured config
Introduces `services.varnish.listen` as a list of structured
listen addresses with all allowed variations of arguments
documented in the man page.

Deprecates `services.varnish.http_address`.
2025-07-08 13:52:55 +02:00
Franz Pletz db75f90103
nixos/nginx: remove recommendedZstdSettings, add experimental option
The zstd nginx module has known bugs and upstream is currently not
maintained. We should not recommend a buggy module and configuration
to our users since we are not maintaining the module either.
2025-07-03 17:41:22 +02:00
Adam C. Stephens b0dc55b783
garage: remove 0.8, mark 0.9 eol, rename 1.0 (#419392) 2025-06-28 10:18:34 -04:00
Wolfgang Walther 41c5662cbe
nixos/postgresql: move postStart into separate unit
This avoids restarting the postgresql server, when only ensureDatabases
or ensureUsers have been changed. It will also allow to properly wait
for recovery to finish later.

To wait for "postgresql is ready" in other services, we now provide a
postgresql.target.

Resolves #400018

Co-authored-by: Marcel <me@m4rc3l.de>
2025-06-24 15:26:47 +02:00
Adam C. Stephens 2b90c413df
garage_1_x: rename to garage_1 2025-06-23 17:53:02 -04:00
Adam C. Stephens 45c0608ace
garage_0_9: mark eol 2025-06-23 17:49:22 -04:00
Ryan Yin aa9343b00e nixos/minio: add ryan4yin as a maintainer 2025-06-22 14:25:21 +08:00
Maximilian Bosch 4a2a4193f9
nixos/nginx: fix type of mapHashBucketSize
While the default is indeed 32/64/128, the option accepts any `size`[1]
including values >128, as observed in a customer project.

[1] https://nginx.org/en/docs/http/ngx_http_map_module.html
2025-06-05 14:58:17 +02:00
Bert Proesmans 4c02c43a42 nixos/nginx: fix mkDefaultListenVhost mapping for unix sockets 2025-04-03 19:57:26 +00:00
โทสฺตัล 7554581474 nixos/h2o: enable HTTP/3 via QUIC 2025-04-02 15:11:53 +07:00
โทสฺตัล 301581e073 nixos/h2o: typo 2025-04-02 15:11:53 +07:00
Florian Klink 2b0e0a9fd4
nixos/h2o: disable OCSP stapling w/ Let’s Encrypt (support sunset) (#393765) 2025-04-02 09:10:42 +01:00
Silvan Mosberger 374e6bcc40 treewide: Format all Nix files
Format all Nix files using the officially approved formatter,
making the CI check introduced in the previous commit succeed:

  nix-build ci -A fmt.check

This is the next step of the of the [implementation](https://github.com/NixOS/nixfmt/issues/153)
of the accepted [RFC 166](https://github.com/NixOS/rfcs/pull/166).

This commit will lead to merge conflicts for a number of PRs,
up to an estimated ~1100 (~33%) among the PRs with activity in the past 2
months, but that should be lower than what it would be without the previous
[partial treewide format](https://github.com/NixOS/nixpkgs/pull/322537).

Merge conflicts caused by this commit can now automatically be resolved while rebasing using the
[auto-rebase script](8616af08d9/maintainers/scripts/auto-rebase).

If you run into any problems regarding any of this, please reach out to the
[formatting team](https://nixos.org/community/teams/formatting/) by
pinging @NixOS/nix-formatting.
2025-04-01 20:10:43 +02:00
โทสฺตัล 7c8b3c88bb nixos/h2o: rename certNames → acmeCertNames
We are in agreement ðis improves the naming clarity
2025-03-29 12:31:46 +07:00
โทสฺตัล 0c67557015 nixos/h2o: disable OCSP stapling w/ Let’s Encrypt (support sunset)
It was noted in the TLS recommendations comment, but it actually should
be disabled everywhere if ACME is used as H2O has in enabled by default.

More info: <https://letsencrypt.org/2024/12/05/ending-ocsp/>
2025-03-29 12:31:46 +07:00
Felix Buehler 3546e59acc Revert "nixos/caddy: validate at build-time"
This reverts commit 63b6df42de.
2025-03-27 20:25:54 +01:00
Felix Bühler fb0fb09b5c
nixos/caddy: validate at build-time (#377075) 2025-03-25 22:53:00 +01:00
Gergely Nagy cf523f3f84
nixos/caddy: Make virtualHosts' logFormat optional
Allow `services.caddy.virtualHosts.<name>.logFormat` to be null, and in
that case, do not add a `log {}` block to the Caddy configuration. This
makes it possible to have multiple loggers declared in the global
configuration, and instruct Caddy to use a logger by name.

Signed-off-by: Gergely Nagy <me@gergo.csillger.hu>
2025-03-23 14:42:01 +01:00
Pol Dellaiera b29c5b7119
treewide: add documentation for nixos systemd units (#389283) 2025-03-15 21:30:08 +01:00
Benjamin Sparks f5e1d3bb02 nixos/uwsgi: remove support for python2 plugins 2025-03-15 00:16:01 +01:00
jopejoe1 dca7e827b3
nixos: Replace custom cfg format handling with pkgs.formats (#314933) 2025-03-14 21:08:14 +01:00
h7x4 ab0564bd10
treewide: add documentation for nixos systemd units 2025-03-12 18:00:38 +01:00
Florian Klink 9004cb4a05
nixos/h2o: add simple listen.host setting, add example (#386318) 2025-03-09 11:32:06 +07:00
โทสฺตัล 1e3e30d566 nixos/h2o: clarify/format some docs to point to upstream config 2025-03-09 11:03:48 +07:00
Philip Taron 9ab61b2537
nixos/doc: convert links to manpages (#383975) 2025-03-06 09:37:51 -08:00
Felix Buehler 63b6df42de nixos/caddy: validate at build-time 2025-03-03 21:33:45 +01:00
Felix Buehler 1ef1bcec09 nixos/caddy: use lib.getExe 2025-03-03 21:33:44 +01:00
โทสฺตัล 28aa290145 nixos/h2o: add access to listen.host 2025-03-02 15:57:09 +07:00
โทสฺตัล dcee208a31 nixos/h2o: provide a settings example 2025-03-02 15:57:09 +07:00
Maximilian Bosch 303bd80713
Merge: nixos/nginx: add locations."name".uwsgiPass option and use it (#346776) 2025-03-01 12:34:20 +01:00
โทสฺตัล b3f93d7292 nixos/h2o: TLS recommendations
From Mozilla’s ssl-config-generator project
2025-02-26 12:26:12 +07:00
โทสฺตัล 106d33952f nixos/h2o: virtual host settings default to empty 2025-02-26 10:49:06 +07:00
โทสฺตัล 093d5cfaea nixos/step-ca: add H2O test 2025-02-24 15:06:34 +07:00
โทสฺตัล 40f58bffcb nixos/h2o: basic ACME support 2025-02-24 15:06:34 +07:00
โทสฺตัล 1deab8b466 nixos/h2o: remove mode option as a potential footgun 2025-02-24 15:06:34 +07:00
โทสฺตัล e7e5ea5cee nixos/h2o: show package override that isn’t the default
The default was changed earlier this week
2025-02-24 15:06:34 +07:00
โทสฺตัล c554171c27 nixos/h2o: service name matches project 2025-02-24 15:06:34 +07:00
โทสฺตัล 14a33566d7 nixos/h2o: add virtual host serverAliases 2025-02-24 15:06:33 +07:00
โทสฺตัล 60287f0793 nixos/h2o: add missing Group to systemd 2025-02-24 15:06:33 +07:00
โทสฺตัล 760102b995 nixos/h2o: use { } for settings default 2025-02-24 15:06:33 +07:00
โทสฺตัล e7cf87f304 nixos/h2o: redo identity type to just list 2025-02-24 15:06:33 +07:00