I tested the previous "version" and found my environment to be exactly the same.
Let's start discussing possible extensions/improvements somewhere else. For now it's a nice improvement.
This change does two things:
* "NixOSizes" environment variables generation. This allows some more
error-checking and opens possibilities for a modular environment
configuration. From now on the most of environment variables are
generated directly by the nix code. Generating sh code that
generates environment variables is left in a few places where
nontrivial access to a local environment state is needed.
* By doing the first change this patch untangles bash from the
environment configuration and makes it trivial to add a support for
other non bash-compatible shells.
Now to the sad part. This change is quite large (and I'm not sure it's
possible to split it) and yet is not quite complete, it needs some
changes to nixpkgs to be perfect.
See !!! comments in modules/config/shells-environment.nix.
Main principle behind this change is "change environment generation
and nothing else". In particular, shell configuration principles stay
exactly the same as before.
This didn't work reliably because it raced with the remounting of /.
So if you were unlucky, then / was read-only by the time we ran
"alsactl store". Now the sound card state is saved before anything is
unmounted/remounted.
The services systemd-random-seed-save.service and
systemd-update-utmp-shutdown.service from systemd 203 don't work,
because they have a RequiresMountFor dependency on /var/lib and
/var/log. Such a dependency produces a cycle, causing systemd to drop
those services:
Fixing conflicting jobs by deleting job poweroff.target/stop
Deleting job systemd-poweroff.service/stop as dependency of job poweroff.target/stop
Deleting job umount.target/stop as dependency of job systemd-poweroff.service/stop
Deleting job -.mount/start as dependency of job umount.target/stop
Deleting job systemd-random-seed-save.service/start as dependency of job -.mount/start
Deleting job systemd-update-utmp-shutdown.service/start as dependency of job -.mount/start
Dropping the RequiresMountFor doesn't work either, because then
/var/... may have meen unmounted or remounted read-only.
Upstream systemd fixes this by doing the actual work from an ExecStop
action in an already-running service than conflicts with
shutdown.target. So I backported that here. The main consequence is
that wtmp shutdown records now get written properly.
The main lesson: shutdown.target is useless for pulling in services
during shutdown if they need to write anywhere.
You can now do a fast reboot (bypassing the BIOS, which may take
several minutes on servers) by running ‘systemctl kexec’.
Unfortunately the QEMU test for this is unreliable due to a QEMU bug
(it randomly crashes with a message like ‘Guest moved used index from
8 to 0’), so it's commented out.
Aspell can only handle one dict-dir directive and currently we hardocde
that to
ASPELL_CONF="dict-dir $HOME/.nix-profile/lib/aspell"
This means that aspell doesn't work if it is installed to the system or
default nix profile -- it only works in the user profile.
With this change, aspell can be installed to any of the nix profiles. If
it is installed in more than one profile, the most "local" profile wins
(i.e. sysadmin can set up a default, users can override it).
This reduces code duplication, but more importantly means that the
DRI modules can be found by X enabling hardware acceleration.
Close#249; the PR also refers to more about DRI modules.
Set "networking.tcpcrypt.enable = true;" to enable opportunistic TCP encryption
based on the user-space tools available from <http://tcpcrypt.org>.
Network attackers come in two varieties: passive and active (man-in-the-middle).
Passive attacks are much simpler to execute because they just require listening
on the network. Active attacks are much harder as they require listening and
modifying network traffic, often requiring very precise timing that can make
some attacks impractical.
Opportunistic encryption cannot protect against active attackers, but it *does*
protect against passive attackers. Furthermore, Tcpcrypt is powerful enough to
stop active attacks, too, if the application using it performs authentication.
A complete description of the protocol extension can be found at
<http://tools.ietf.org/html/draft-bittau-tcp-crypt-00>.
I.e., modules that use "require = [options]". Nowadays that should be
written as
{
options = { ... };
config = { ... };
};
Also, use "imports" instead of "require" in places where we actually
import another module.
Previously, the zfs binaries were put in $out/sbin where the stage-1
patchelf wouldn't fix them up. This would fail the allowedReferences
test.
Move the zfs binaries to $out/bin.
The NixOS config need not be $NIXOS_CONFIG, it can also be set through
-I nixos-config=... or not exist in a separate file at all (e.g. in a
NixOps deployment).
Issue #212.
dramatically speeds up my boot time because it was the last
service (for me) that depended on udev-settle.service
udev-settle isn't needed for modern system initialization but some
oldschool services (mdadm/lvm/cryptsetup) depend on it so they can
just enumerate devices instead of having to react to changes
dynamically. In NixOS these things are usually already taken care of
during stage 1 (early ramdisk) if you use them.
