NixOS · Jun 20, 2020 · Jun 20, 2020 · Jun 21, 2020 · Jun 23, 2020 · Jun 23, 2020
diff --git a/nixos/modules/services/networking/sslh.nix b/nixos/modules/services/networking/sslh.nix
@@ -15,7 +15,11 @@ let
 
     listen:
     (
-      { host: "${cfg.listenAddress}"; port: "${toString cfg.port}"; }
+      ${
+        concatMapStringsSep ",\n"
+        (addr: ''{ host: "${addr}"; port: "${toString cfg.port}"; }'')
+        cfg.listenAddresses
+      }
     );
 
     ${cfg.appendConfig}
@@ -33,6 +37,10 @@ let
   '';
 in
 {
+  imports = [
+    (mkRenamedOptionModule [ "services" "sslh" "listenAddress" ] [ "services" "sslh" "listenAddresses" ])
+  ];
+
   options = {
     services.sslh = {
       enable = mkEnableOption "sslh";
@@ -55,10 +63,10 @@ in
         description = "Will the services behind sslh (Apache, sshd and so on) see the external IP and ports as if the external world connected directly to them";
       };
 
-      listenAddress = mkOption {
-        type = types.str;
-        default = "0.0.0.0";
-        description = "Listening address or hostname.";
+      listenAddresses = mkOption {
+        type = types.coercedTo types.str singleton (types.listOf types.str);
+        default = [ "0.0.0.0" "[::]" ];
+        description = "Listening addresses or hostnames.";
       };
 
       port = mkOption {

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
@@ -307,6 +307,7 @@ in
   spacecookie = handleTest ./spacecookie.nix {};
   spike = handleTest ./spike.nix {};
   sonarr = handleTest ./sonarr.nix {};
+  sslh = handleTest ./sslh.nix {};
   strongswan-swanctl = handleTest ./strongswan-swanctl.nix {};
   sudo = handleTest ./sudo.nix {};
   switchTest = handleTest ./switch-test.nix {};

diff --git a/nixos/tests/sslh.nix b/nixos/tests/sslh.nix
@@ -0,0 +1,83 @@
+import ./make-test-python.nix {
+  name = "sslh";
+
+  nodes = {
+    server = { pkgs, lib, ... }: {
+      networking.firewall.allowedTCPPorts = [ 443 ];
+      networking.interfaces.eth1.ipv6.addresses = [
+        {
+          address = "fe00:aa:bb:cc::2";
+          prefixLength = 64;
+        }
+      ];
+      # sslh is really slow when reverse dns does not work
+      networking.hosts = {
+        "fe00:aa:bb:cc::2" = [ "server" ];
+        "fe00:aa:bb:cc::1" = [ "client" ];
+      };
+      services.sslh = {
+        enable = true;
+        transparent = true;
+        appendConfig = ''
+          protocols:
+          (
+            { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; probe: "builtin"; },
+            { name: "http"; host: "localhost"; port: "80"; probe: "builtin"; },
+          );
+        '';
+      };
+      services.openssh.enable = true;
+      users.users.root.openssh.authorizedKeys.keyFiles = [ ./initrd-network-ssh/id_ed25519.pub ];
+      services.nginx = {
+        enable = true;
+        virtualHosts."localhost" = {
+          addSSL = false;
+          default = true;
+          root = pkgs.runCommand "testdir" {} ''
+            mkdir "$out"
+            echo hello world > "$out/index.html"
+          '';
+        };
+      };
+    };
+    client = { ... }: {
+      networking.interfaces.eth1.ipv6.addresses = [
+        {
+          address = "fe00:aa:bb:cc::1";
+          prefixLength = 64;
+        }
+      ];
+      networking.hosts."fe00:aa:bb:cc::2" = [ "server" ];
+      environment.etc.sshKey = {
+        source = ./initrd-network-ssh/id_ed25519; # dont use this anywhere else
+        mode = "0600";
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("sslh.service")
+    server.wait_for_unit("nginx.service")
+    server.wait_for_unit("sshd.service")
+    server.wait_for_open_port(80)
+    server.wait_for_open_port(443)
+    server.wait_for_open_port(22)
+
+    for arg in ["-6", "-4"]:
+        client.wait_until_succeeds(f"ping {arg} -c1 server")
+
+        # check that ssh through sslh works
+        client.succeed(
+            f"ssh {arg} -p 443 -i /etc/sshKey -o StrictHostKeyChecking=accept-new server 'echo $SSH_CONNECTION > /tmp/foo{arg}'"
+        )
+
+        # check that 1/ the above ssh command had an effect 2/ transparent proxying really works
+        ip = "fe00:aa:bb:cc::1" if arg == "-6" else "192.168.1."
+        server.succeed(f"grep '{ip}' /tmp/foo{arg}")
+
+        # check that http through sslh works
+        assert client.succeed(f"curl {arg} http://server:443").strip() == "hello world"
+  '';
+}
diff --git a/pkgs/applications/audio/tuijam/default.nix b/pkgs/applications/audio/tuijam/default.nix
@@ -0,0 +1,46 @@
+{ buildPythonApplication
+, fetchFromGitHub
+, lib
+, python3Packages
+, youtube-dl
+}:
+
+buildPythonApplication rec {
+  pname = "tuijam";
+  version = "unstable-2020-06-05";
+
+  src = fetchFromGitHub {
+    owner = "cfangmeier";
+    repo = pname;
+    rev = "7baec6f6e80ee90da0d0363b430dd7d5695ff03b";
+    sha256 = "1l0s88jvj99jkxnczw5nfj78m8vihh29g815n4mg9jblad23mgx5";
+  };
+
+  buildInputs = [ python3Packages.Babel ];
+
+  # the package has no tests
+  doCheck = false;
+
+  propagatedBuildInputs = with python3Packages; [
+    gmusicapi
+    google_api_python_client
+    mpv
+    pydbus
+    pygobject3
+    pyyaml
+    requests
+    rsa
+    urwid
+  ];
+
+  meta = with lib; {
+    description = "A fancy TUI client for Google Play Music";
+    longDescription = ''
+      TUIJam seeks to make a simple, attractive, terminal-based interface to
+      listening to music for Google Play Music All-Access subscribers.
+    '';
+    homepage    = "https://github.com/cfangmeier/tuijam";
+    license     = licenses.mit;
+    maintainers = with maintainers; [ kalbasit ];
+  };
+}
diff --git a/pkgs/applications/misc/buku/default.nix b/pkgs/applications/misc/buku/default.nix
@@ -1,14 +1,14 @@
 { stdenv, python3, fetchFromGitHub }:
 
 with python3.pkgs; buildPythonApplication rec {
-  version = "4.3";
+  version = "4.4";
   pname = "buku";
 
   src = fetchFromGitHub {
     owner = "jarun";
     repo = "buku";
     rev = "v${version}";
-    sha256 = "1cq508ymak3g5fhi1n4bdiiqkc86s2l3k4dvzw842vv2x0441cac";
+    sha256 = "10r5f1n0vcxxmqqqsgmlvibwg1xffijrr2id6r140rgiyhprz556";
   };
 
   checkInputs = [
@@ -38,6 +38,7 @@ with python3.pkgs; buildPythonApplication rec {
     click
     html5lib
     vcrpy
+    toml
   ];
 
   postPatch = ''

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "0wsqxq8xxcafmjxsjkagysrcbr6qryiyqn6m3ysp256aam7z3d88";
-    sha256bin64 = "03jff1sdv05hbn37cw0ij0r4rils0q11lnnhxg52igg633jzwyc1";
-    version = "84.0.4147.45";
+    sha256 = "1s49qxg0gfmhm1lf5big6hprral21dbzjx0f1cp3xfvag9y61i7h";
+    sha256bin64 = "1sjvi3qmpwpr51442324a853k6s0k59k4809k8j5sjv7h6arw0sm";
+    version = "84.0.4147.56";
   };
   dev = {
-    sha256 = "16rmzyzjmxmhmr5yqbzqbwf5sq94iqcwlm04fkafiwcycd17nyhs";
-    sha256bin64 = "0wjmc1wdmwiq9d1f5gk4c9jkj1p116kaz9nb0hvhjf01iv07xl2m";
-    version = "85.0.4168.2";
+    sha256 = "1gxa0jg7xff87z7wvllp84a3ii1ypgy4vfzgxs4k7kzg5x0412vi";
+    sha256bin64 = "0swmn37rmvjvvdcrd002qg1wcvna06y14s3kx34bfr4zxhqk3lby";
+    version = "85.0.4173.0";
   };
   stable = {
-    sha256 = "0bvy17ymlih87n4ymnzvyn0m34ghmr1yasvy7gxv02qbw6i57lfg";
-    sha256bin64 = "00hjr5y0cczs6h2pxrigpmjiv24456948v32q7mr7x5ysr5kxpn6";
-    version = "83.0.4103.106";
+    sha256 = "1hravbi1lazmab2mih465alfzji1kzy38zya1visbwz9zs6pw35v";
+    sha256bin64 = "1ggyv2b50sclnqph0r40lb8p9h3pq9aq4fj1wdszhwc4rb0cj746";
+    version = "83.0.4103.116";
   };
 }
diff --git a/pkgs/applications/networking/gns3/gui.nix b/pkgs/applications/networking/gns3/gui.nix
@@ -1,9 +1,8 @@
 { stable, branch, version, sha256Hash, mkOverride, commonOverrides }:
 
-{ lib, stdenv, python3, fetchFromGitHub }:
+{ lib, stdenv, python3, pkgs, fetchFromGitHub }:
 
 let
-  # TODO: This package requires qt5Full to launch
   defaultOverrides = commonOverrides ++ [
     (mkOverride "jsonschema" "3.2.0"
       "0ykr61yiiizgvm3bzipa3l73rvj49wmrybbfwhvpgk3pscl5pa68")
@@ -27,6 +26,7 @@ in python.pkgs.buildPythonPackage rec {
     raven psutil jsonschema # tox for check
     # Runtime dependencies
     sip (pyqt5.override { withWebSockets = true; }) distro setuptools
+    pkgs.qt5Full
   ];
 
   doCheck = false; # Failing

diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -19,12 +19,12 @@ with lib;
 
 mkDerivation rec {
   pname = "telegram-desktop";
-  version = "2.1.12";
+  version = "2.1.13";
 
   # Telegram-Desktop with submodules
   src = fetchurl {
     url = "https://github.com/telegramdesktop/tdesktop/releases/download/v${version}/tdesktop-${version}-full.tar.gz";
-    sha256 = "1b9kgib9dxjcfnw2zdbqd12ikcswkl35nwy9m47x5jvy3glxg6m8";
+    sha256 = "0mq3f7faxn1hfkhv5n37y5iajjnm38s2in631046m0q7c4w3lrfi";
   };
 
   postPatch = ''

diff --git a/pkgs/development/compilers/ocaml/4.11.nix b/pkgs/development/compilers/ocaml/4.11.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
   major_version = "4";
   minor_version = "11";
-  patch_version = "0+alpha2";
-  sha256 = "131ixp5kkgk9y42vrprhc2x0gpxhkapmdmb26pwkyl58vrbr8xqg";
+  patch_version = "0+alpha3";
+  sha256 = "0c2g8ncq15nx9pdl14hnsc9342j80s7i1bsyiw98cvgic5miyw9b";
 }
diff --git a/pkgs/development/libraries/zziplib/default.nix b/pkgs/development/libraries/zziplib/default.nix
@@ -1,7 +1,6 @@
 { stdenv
-, cmake
+, perl
 , pkg-config
-, ninja
 , fetchFromGitHub
 , fetchpatch
 , zip
@@ -23,12 +22,6 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    # Fix ninja parsing
-    (fetchpatch {
-      url = "https://github.com/gdraheim/zziplib/commit/75e22f3c365b62acbad8d8645d5404242800dfba.patch";
-      sha256 = "IB0am3K0x4+Ug1CKvowTtkS8JD6zHJJ247A7guJOw80=";
-    })
-
     # Install man pages
     (fetchpatch {
       url = "https://github.com/gdraheim/zziplib/commit/5583ccc7a247ee27556ede344e93d3ac1dc72e9b.patch";
@@ -44,9 +37,8 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    cmake
+    perl
     pkg-config
-    ninja # make fails, unable to find test2.zip
     zip
     python3
     xmlto
@@ -60,10 +52,6 @@ stdenv.mkDerivation rec {
     unzip
   ];
 
-  cmakeFlags = [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF" # for tests
-  ];
-
   # tests are broken (https://github.com/gdraheim/zziplib/issues/20),
   # and test/zziptests.py requires network access
   # (https://github.com/gdraheim/zziplib/issues/24)

diff --git a/pkgs/development/python-modules/flask-admin/default.nix b/pkgs/development/python-modules/flask-admin/default.nix
@@ -8,12 +8,16 @@
 , wtf-peewee
 , sqlalchemy
 , sqlalchemy-citext
+, sqlalchemy-utils
 , flask-mongoengine
 , flask_sqlalchemy
 , flask-babelex
 , shapely
 , geoalchemy2
 , psycopg2
+, arrow
+, colour
+, email_validator
 , flask
 , wtforms
 , isPy27
@@ -22,12 +26,12 @@
 
 buildPythonPackage rec {
   pname = "flask-admin";
-  version = "1.5.3";
+  version = "1.5.6";
 
   src = fetchPypi {
     pname = "Flask-Admin";
     inherit version;
-    sha256 = "ca0be6ec11a6913b73f656c65c444ae5be416c57c75638dd3199376ce6bc7422";
+    sha256 = "1f31vzc0p2xni5mh1wvjk9jxf4ddlx2fj4r0f3vv2n9db3c63iv8";
   };
 
   checkInputs = [
@@ -38,12 +42,16 @@ buildPythonPackage rec {
     wtf-peewee
     sqlalchemy
     sqlalchemy-citext
+    sqlalchemy-utils
     flask-mongoengine
     flask_sqlalchemy
     flask-babelex
     shapely
     geoalchemy2
     psycopg2
+    arrow
+    colour
+    email_validator
   ];
 
   propagatedBuildInputs = [
@@ -52,13 +60,14 @@ buildPythonPackage rec {
   ] ++ lib.optionals isPy27 [ enum34 ];
 
   checkPhase = ''
-    # disable tests that require mongodb, postresql
+    # disable tests that require mongodb, postresql, or network
     nosetests \
      -e "mongoengine" \
      -e "pymongo" \
      -e "test_form_upload" \
      -e "test_postgres" \
      -e "geoa" \
+     -e "test_ajax_fk" \
      flask_admin/tests
   '';