NixOS · Feb 9, 2020 · Feb 9, 2020 · Feb 9, 2020 · Feb 25, 2020 · Feb 28, 2020
Showing 465 changed files with 6,024 additions and 5,180 deletions.
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -178,6 +178,7 @@
 /nixos/tests/prometheus-exporters.nix                        @WilliButz
 
 # PHP
-/pkgs/development/interpreters/php  @etu
-/pkgs/top-level/php-packages.nix    @etu
-/pkgs/build-support/build-pecl.nix  @etu
+/doc/languages-frameworks/php.section.md @etu
+/pkgs/development/interpreters/php       @etu
+/pkgs/top-level/php-packages.nix         @etu
+/pkgs/build-support/build-pecl.nix       @etu
diff --git a/doc/languages-frameworks/android.section.md b/doc/languages-frameworks/android.section.md
@@ -186,7 +186,7 @@ with import <nixpkgs> {};
 androidenv.emulateApp {
   name = "emulate-MyAndroidApp";
   platformVersion = "28";
-  abiVersion = "x86_64"; # armeabi-v7a, mips, x86
+  abiVersion = "x86"; # armeabi-v7a, mips, x86_64
   systemImageType = "google_apis_playstore";
 }
 ```

diff --git a/doc/languages-frameworks/php.section.md b/doc/languages-frameworks/php.section.md
@@ -0,0 +1,112 @@
+# PHP
+
+## User Guide
+
+### Using PHP
+
+#### Overview
+
+Several versions of PHP are available on Nix, each of which having a
+wide variety of extensions and libraries available.
+
+The attribute `php` refers to the version of PHP considered most
+stable and thoroughly tested in nixpkgs for any given release of
+NixOS. Note that while this version of PHP may not be the latest major
+release from upstream, any version of PHP supported in nixpkgs may be
+utilized by specifying the desired attribute by version, such as
+`php74`.
+
+Only versions of PHP that are supported by upstream for the entirety
+of a given NixOS release will be included in that release of
+NixOS. See [PHP Supported
+Versions](https://www.php.net/supported-versions.php).
+
+Interactive tools built on PHP are put in `php.packages`; composer is
+for example available at `php.packages.composer`.
+
+Most extensions that come with PHP, as well as some popular
+third-party ones, are available in `php.extensions`; for example, the
+opcache extension shipped with PHP is available at
+`php.extensions.opcache` and the third-party ImageMagick extension at
+`php.extensions.imagick`.
+
+The different versions of PHP that nixpkgs provides is located under
+attributes named based on major and minor version number; e.g.,
+`php74` is PHP 7.4 with commonly used extensions installed,
+`php74base` is the same PHP runtime without extensions.
+
+#### Installing PHP with packages
+
+A PHP package with specific extensions enabled can be built using
+`php.withExtensions`. This is a function which accepts an anonymous
+function as its only argument; the function should take one argument,
+the set of all extensions, and return a list of wanted extensions. For
+example, a PHP package with the opcache and ImageMagick extensions
+enabled:
+
+```nix
+php.withExtensions (e: with e; [ imagick opcache ])
+```
+
+Note that this will give you a package with _only_ opcache and
+ImageMagick, none of the other extensions which are enabled by default
+in the `php` package will be available.
+
+To enable building on a previous PHP package, the currently enabled
+extensions are made available in its `enabledExtensions`
+attribute. For example, to generate a package with all default
+extensions enabled, except opcache, but with ImageMagick:
+
+```nix
+php.withExtensions (e:
+  (lib.filter (e: e != php.extensions.opcache) php.enabledExtensions)
+  ++ [ e.imagick ])
+```
+
+If you want a PHP build with extra configuration in the `php.ini`
+file, you can use `php.buildEnv`. This function takes two named and
+optional parameters: `extensions` and `extraConfig`. `extensions`
+takes an extension specification equivalent to that of
+`php.withExtensions`, `extraConfig` a string of additional `php.ini`
+configuration parameters. For example, a PHP package with the opcache
+and ImageMagick extensions enabled, and `memory_limit` set to `256M`:
+
+```nix
+php.buildEnv {
+  extensions = e: with e; [ imagick opcache ];
+  extraConfig = "memory_limit=256M";
+}
+```
+
+##### Example setup for `phpfpm`
+
+You can use the previous examples in a `phpfpm` pool called `foo` as
+follows:
+
+```nix
+let
+  myPhp = php.withExtensions (e: with e; [ imagick opcache ]);
+in {
+  services.phpfpm.pools."foo".phpPackage = myPhp;
+};
+```
+
+```nix
+let
+  myPhp = php.buildEnv {
+    extensions = e: with e; [ imagick opcache ];
+    extraConfig = "memory_limit=256M";
+  };
+in {
+  services.phpfpm.pools."foo".phpPackage = myPhp;
+};
+```
+
+##### Example usage with `nix-shell`
+
+This brings up a temporary environment that contains a PHP interpreter
+with the extensions `imagick` and `opcache` enabled.
+
+```sh
+nix-shell -p 'php.buildEnv { extensions = e: with e; [ imagick opcache ]; }'
+```
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
@@ -2404,6 +2404,12 @@
       fingerprint = "67FE 98F2 8C44 CF22 1828  E12F D57E FA62 5C9A 925F";
     }];
   };
+  euank = {
+    email = "euank-nixpkg@euank.com";
+    github = "euank";
+    githubId = 2147649;
+    name = "Euan Kemp";
+  };
   evanjs = {
     email = "evanjsx@gmail.com";
     github = "evanjs";

diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml
@@ -827,8 +827,8 @@ auth required pam_succeed_if.so uid >= 1000 quiet
    </listitem>
    <listitem>
     <para>
-     Predicatbly named network-interfaces get renamed in stage-1. This means that it's possible
-     to use the proper interface name for e.g. dropbear-setups.
+     Predictably named network interfaces get renamed in stage-1. This means that it is possible
+     to use the proper interface name for e.g. Dropbear setups.
     </para>
     <para>
      For further reference, please read <link xlink:href="https://github.com/NixOS/nixpkgs/pull/68953">#68953</link> or the corresponding <link xlink:href="https://discourse.nixos.org/t/predictable-network-interface-names-in-initrd/4055">discourse thread</link>.

diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -23,6 +23,9 @@
      Support is planned until the end of April 2021, handing over to 21.03.
     </para>
    </listitem>
+   <listitem>
+    <para>GNOME desktop environment was upgraded to 3.36, see its <link xlink:href="https://help.gnome.org/misc/release-notes/3.36/">release notes</link>.</para>
+   </listitem>
    <listitem>
     <para>
      PHP now defaults to PHP 7.4, updated from 7.3.
@@ -125,6 +128,73 @@
      documentation for instructions.
     </para>
    </listitem>
+   <listitem>
+     <para>
+       Since this release there's an easy way to customize your PHP install to get a much smaller
+       base PHP with only wanted extensions enabled. See the following snippet installing a smaller PHP
+       with the extensions <literal>imagick</literal>, <literal>opcache</literal> and
+       <literal>pdo_mysql</literal> loaded:
+
+       <programlisting>
+environment.systemPackages = [
+(pkgs.php.buildEnv { extensions = pp: with pp; [
+    imagick
+    opcache
+    pdo_mysql
+  ]; })
+];</programlisting>
+
+       The default <literal>php</literal> attribute hasn't lost any extensions -
+       the <literal>opcache</literal> extension was added there.
+
+       All upstream PHP extensions are available under <package><![CDATA[php.extensions.<name?>]]></package>.
+     </para>
+     <para>
+       The updated <literal>php</literal> attribute is now easily customizable to your liking
+       by using extensions instead of writing config files or changing configure flags.
+
+       Therefore we have removed the following configure flags:
+
+       <itemizedlist>
+         <title>PHP <literal>config</literal> flags that we don't read anymore:</title>
+         <listitem><para><literal>config.php.argon2</literal></para></listitem>
+         <listitem><para><literal>config.php.bcmath</literal></para></listitem>
+         <listitem><para><literal>config.php.bz2</literal></para></listitem>
+         <listitem><para><literal>config.php.calendar</literal></para></listitem>
+         <listitem><para><literal>config.php.curl</literal></para></listitem>
+         <listitem><para><literal>config.php.exif</literal></para></listitem>
+         <listitem><para><literal>config.php.ftp</literal></para></listitem>
+         <listitem><para><literal>config.php.gd</literal></para></listitem>
+         <listitem><para><literal>config.php.gettext</literal></para></listitem>
+         <listitem><para><literal>config.php.gmp</literal></para></listitem>
+         <listitem><para><literal>config.php.imap</literal></para></listitem>
+         <listitem><para><literal>config.php.intl</literal></para></listitem>
+         <listitem><para><literal>config.php.ldap</literal></para></listitem>
+         <listitem><para><literal>config.php.libxml2</literal></para></listitem>
+         <listitem><para><literal>config.php.libzip</literal></para></listitem>
+         <listitem><para><literal>config.php.mbstring</literal></para></listitem>
+         <listitem><para><literal>config.php.mysqli</literal></para></listitem>
+         <listitem><para><literal>config.php.mysqlnd</literal></para></listitem>
+         <listitem><para><literal>config.php.openssl</literal></para></listitem>
+         <listitem><para><literal>config.php.pcntl</literal></para></listitem>
+         <listitem><para><literal>config.php.pdo_mysql</literal></para></listitem>
+         <listitem><para><literal>config.php.pdo_odbc</literal></para></listitem>
+         <listitem><para><literal>config.php.pdo_pgsql</literal></para></listitem>
+         <listitem><para><literal>config.php.phpdbg</literal></para></listitem>
+         <listitem><para><literal>config.php.postgresql</literal></para></listitem>
+         <listitem><para><literal>config.php.readline</literal></para></listitem>
+         <listitem><para><literal>config.php.soap</literal></para></listitem>
+         <listitem><para><literal>config.php.sockets</literal></para></listitem>
+         <listitem><para><literal>config.php.sodium</literal></para></listitem>
+         <listitem><para><literal>config.php.sqlite</literal></para></listitem>
+         <listitem><para><literal>config.php.tidy</literal></para></listitem>
+         <listitem><para><literal>config.php.xmlrpc</literal></para></listitem>
+         <listitem><para><literal>config.php.xsl</literal></para></listitem>
+         <listitem><para><literal>config.php.zip</literal></para></listitem>
+         <listitem><para><literal>config.php.zlib</literal></para></listitem>
+       </itemizedlist>
+     </para>
+   </listitem>
   </itemizedlist>
  </section>
 

diff --git a/nixos/modules/config/gtk/gtk-icon-cache.nix b/nixos/modules/config/gtk/gtk-icon-cache.nix
@@ -77,7 +77,7 @@ with lib;
 
         if [ -w "$themedir" ]; then
           rm -f "$themedir"/icon-theme.cache
-          ${pkgs.gtk3.out}/bin/gtk-update-icon-cache --ignore-theme-index "$themedir"
+          ${pkgs.buildPackages.gtk3.out}/bin/gtk-update-icon-cache --ignore-theme-index "$themedir"
         fi
       done
     '';

diff --git a/nixos/modules/i18n/input-method/ibus.nix b/nixos/modules/i18n/input-method/ibus.nix
@@ -76,7 +76,7 @@ in
       XMODIFIERS = "@im=ibus";
     };
 
-    xdg.portal.extraPortals = mkIf xdg.portal.enable [
+    xdg.portal.extraPortals = mkIf config.xdg.portal.enable [
       ibusPackage
     ];
   };

diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix
@@ -23,8 +23,6 @@ with lib;
 
   security.allowUserNamespaces = mkDefault false;
 
-  nix.useSandbox = mkDefault false;
-
   security.protectKernelImage = mkDefault true;
 
   security.allowSimultaneousMultithreading = mkDefault false;

diff --git a/nixos/modules/services/desktops/gnome3/gnome-keyring.nix b/nixos/modules/services/desktops/gnome3/gnome-keyring.nix
@@ -39,6 +39,8 @@ with lib;
 
     services.dbus.packages = [ pkgs.gnome3.gnome-keyring pkgs.gcr ];
 
+    xdg.portal.extraPortals = [ pkgs.gnome3.gnome-keyring ];
+
     security.pam.services.login.enableGnomeKeyring = true;
 
     security.wrappers.gnome-keyring-daemon = {

diff --git a/nixos/modules/services/networking/rxe.nix b/nixos/modules/services/networking/rxe.nix
@@ -5,20 +5,6 @@ with lib;
 let
   cfg = config.networking.rxe;
 
-  runRxeCmd = cmd: ifcs:
-    concatStrings ( map (x: "${pkgs.rdma-core}/bin/rxe_cfg -n ${cmd} ${x};") ifcs);
-
-  startScript = pkgs.writeShellScriptBin "rxe-start" ''
-    ${pkgs.rdma-core}/bin/rxe_cfg -n start
-    ${runRxeCmd "add" cfg.interfaces}
-    ${pkgs.rdma-core}/bin/rxe_cfg
-  '';
-
-  stopScript = pkgs.writeShellScriptBin "rxe-stop" ''
-    ${runRxeCmd "remove" cfg.interfaces }
-    ${pkgs.rdma-core}/bin/rxe_cfg -n stop
-  '';
-
 in {
   ###### interface
 
@@ -31,9 +17,8 @@ in {
         example = [ "eth0" ];
         description = ''
           Enable RDMA on the listed interfaces. The corresponding virtual
-          RDMA interfaces will be named rxe0 ... rxeN where the ordering
-          will be as they are named in the list. UDP port 4791 must be
-          open on the respective ethernet interfaces.
+          RDMA interfaces will be named rxe_&lt;interface&gt;.
+          UDP port 4791 must be open on the respective ethernet interfaces.
         '';
       };
     };
@@ -44,7 +29,6 @@ in {
   config = mkIf cfg.enable {
 
     systemd.services.rxe = {
-      path = with pkgs; [ kmod rdma-core ];
       description = "RoCE interfaces";
 
       wantedBy = [ "multi-user.target" ];
@@ -54,8 +38,13 @@ in {
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
-        ExecStart = "${startScript}/bin/rxe-start";
-        ExecStop = "${stopScript}/bin/rxe-stop";
+        ExecStart = map ( x:
+          "${pkgs.iproute}/bin/rdma link add rxe_${x} type rxe netdev ${x}"
+          ) cfg.interfaces;
+
+        ExecStop = map ( x:
+          "${pkgs.iproute}/bin/rdma link delete rxe_${x}"
+          ) cfg.interfaces;
       };
     };
   };

diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
@@ -9,8 +9,8 @@ let
   # This middle-ground solution ensures *an* sshd can do their basic validation
   # on the configuration.
   validationPackage = if pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform
-    then [ cfgc.package ]
-    else [ pkgs.buildPackages.openssh ];
+    then cfgc.package
+    else pkgs.buildPackages.openssh;
 
   sshconf = pkgs.runCommand "sshd.conf-validated" { nativeBuildInputs = [ validationPackage ]; } ''
     cat >$out <<EOL

diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
@@ -6,27 +6,28 @@ let
   cfg = config.services.nextcloud;
   fpm = config.services.phpfpm.pools.nextcloud;
 
-  phpPackage = pkgs.php73;
-  phpPackages = pkgs.php73Packages;
+  phpPackage =
+    let
+      base = pkgs.php74;
+    in
+      base.buildEnv {
+        extensions = e: with e;
+          base.enabledExtensions ++ [
+            apcu redis memcached imagick
+          ];
+        extraConfig = phpOptionsStr;
+      };
 
   toKeyValue = generators.toKeyValue {
     mkKeyValue = generators.mkKeyValueDefault {} " = ";
   };
 
-  phpOptionsExtensions = ''
-    ${optionalString cfg.caching.apcu "extension=${phpPackages.apcu}/lib/php/extensions/apcu.so"}
-    ${optionalString cfg.caching.redis "extension=${phpPackages.redis}/lib/php/extensions/redis.so"}
-    ${optionalString cfg.caching.memcached "extension=${phpPackages.memcached}/lib/php/extensions/memcached.so"}
-    extension=${phpPackages.imagick}/lib/php/extensions/imagick.so
-    zend_extension = opcache.so
-    opcache.enable = 1
-  '';
   phpOptions = {
     upload_max_filesize = cfg.maxUploadSize;
     post_max_size = cfg.maxUploadSize;
     memory_limit = cfg.maxUploadSize;
   } // cfg.phpOptions;
-  phpOptionsStr = phpOptionsExtensions + (toKeyValue phpOptions);
+  phpOptionsStr = toKeyValue phpOptions;
 
   occ = pkgs.writeScriptBin "nextcloud-occ" ''
     #! ${pkgs.stdenv.shell}
@@ -38,7 +39,6 @@ let
     export NEXTCLOUD_CONFIG_DIR="${cfg.home}/config"
     $sudo \
       ${phpPackage}/bin/php \
-      -c ${pkgs.writeText "php.ini" phpOptionsStr}\
       occ $*
   '';