NixOS · Mar 22, 2018 · Mar 22, 2018 · Mar 22, 2018 · Mar 27, 2018 · Apr 8, 2018
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
@@ -3984,6 +3984,11 @@
     github = "vyp";
     name = "vyp";
   };
+  wchresta = {
+    email = "wchresta.nix@chrummibei.ch";
+    github = "wchresta";
+    name = "wchresta";
+  };
   wedens = {
     email = "kirill.wedens@gmail.com";
     name = "wedens";

diff --git a/nixos/doc/manual/installation/installing-from-other-distro.xml b/nixos/doc/manual/installation/installing-from-other-distro.xml
@@ -154,7 +154,7 @@ $ sudo useradd -u 30000 -g nixbld -G nixbld nixbld</screen>
 $ sudo userdel nixbld
 $ sudo groupdel nixbld</screen>
 
-            <para>If you do not wish to keep the Nix package mananager
+            <para>If you do not wish to keep the Nix package manager
                 installed either, run something like <literal>sudo rm -rv
                     ~/.nix-* /nix</literal> and remove the line that the Nix
                 installer added to your <literal>~/.profile</literal>.</para>

diff --git a/nixos/modules/services/databases/foundationdb.nix b/nixos/modules/services/databases/foundationdb.nix
@@ -4,6 +4,7 @@ with lib;
 
 let
   cfg = config.services.foundationdb;
+  pkg = cfg.package;
 
   # used for initial cluster configuration
   initialIpAddr = if (cfg.publicAddress != "auto") then cfg.publicAddress else "127.0.0.1";
@@ -24,7 +25,7 @@ let
     group         = ${cfg.group}
 
     [fdbserver]
-    command        = ${pkgs.foundationdb}/bin/fdbserver
+    command        = ${pkg}/bin/fdbserver
     public_address = ${cfg.publicAddress}:$ID
     listen_address = ${cfg.listenAddress}
     datadir        = ${cfg.dataDir}/$ID
@@ -35,6 +36,13 @@ let
     memory         = ${cfg.memory}
     storage_memory = ${cfg.storageMemory}
 
+    ${optionalString (cfg.tls != null) ''
+      tls_plugin           = ${pkg}/libexec/plugins/FDBLibTLS.so
+      tls_certificate_file = ${cfg.tls.certificate}
+      tls_key_file         = ${cfg.tls.key}
+      tls_verify_peers     = ${cfg.tls.allowedPeers}
+    ''}
+
     ${optionalString (cfg.locality.machineId    != null) "locality_machineid=${cfg.locality.machineId}"}
     ${optionalString (cfg.locality.zoneId       != null) "locality_zoneid=${cfg.locality.zoneId}"}
     ${optionalString (cfg.locality.datacenterId != null) "locality_dcid=${cfg.locality.datacenterId}"}
@@ -43,7 +51,7 @@ let
     ${fdbServers cfg.serverProcesses}
 
     [backup_agent]
-    command = ${pkgs.foundationdb}/libexec/backup_agent
+    command = ${pkg}/libexec/backup_agent
     ${backupAgents cfg.backupProcesses}
   '';
 in
@@ -52,6 +60,14 @@ in
 
     enable = mkEnableOption "FoundationDB Server";
 
+    package = mkOption {
+      type        = types.package;
+      description = ''
+        The FoundationDB package to use for this server. This must be specified by the user
+        in order to ensure migrations and upgrades are controlled appropriately.
+      '';
+    };
+
     publicAddress = mkOption {
       type        = types.str;
       default     = "auto";
@@ -188,6 +204,43 @@ in
       '';
     };
 
+    tls = mkOption {
+      default = null;
+      description = ''
+        FoundationDB Transport Security Layer (TLS) settings.
+      '';
+
+      type = types.nullOr (types.submodule ({
+        options = {
+          certificate = mkOption {
+            type = types.str;
+            description = ''
+              Path to the TLS certificate file. This certificate will
+              be offered to, and may be verified by, clients.
+            '';
+          };
+
+          key = mkOption {
+            type = types.str;
+            description = "Private key file for the certificate.";
+          };
+
+          allowedPeers = mkOption {
+            type = types.str;
+            default = "Check.Valid=1,Check.Unexpired=1";
+            description = ''
+	      "Peer verification string". This may be used to adjust which TLS
+              client certificates a server will accept, as a form of user
+              authorization; for example, it may only accept TLS clients who
+              offer a certificate abiding by some locality or organization name.
+
+              For more information, please see the FoundationDB documentation.
+            '';
+          };
+        };
+      }));
+    };
+
     locality = mkOption {
       default = {
         machineId    = null;
@@ -270,7 +323,7 @@ in
     meta.doc         = ./foundationdb.xml;
     meta.maintainers = with lib.maintainers; [ thoughtpolice ];
 
-    environment.systemPackages = [ pkgs.foundationdb ];
+    environment.systemPackages = [ pkg ];
 
     users.extraUsers = optionalAttrs (cfg.user == "foundationdb") (singleton
       { name        = "foundationdb";
@@ -324,34 +377,37 @@ in
           ReadWritePaths        = lib.concatStringsSep " " (map (x: "-" + x) rwpaths);
         };
 
-      path = [ pkgs.foundationdb pkgs.coreutils ];
+      path = [ pkg pkgs.coreutils ];
 
       preStart = ''
         rm -f ${cfg.pidfile}   && \
           touch ${cfg.pidfile} && \
           chown -R ${cfg.user}:${cfg.group} ${cfg.pidfile}
 
-        for x in "${cfg.logDir}" "${cfg.dataDir}" /etc/foundationdb; do
-          [ ! -d "$x" ] && mkdir -m 0700 -vp "$x" && chown -R ${cfg.user}:${cfg.group} "$x";
+        for x in "${cfg.logDir}" "${cfg.dataDir}"; do
+          [ ! -d "$x" ] && mkdir -m 0700 -vp "$x";
+          chown -R ${cfg.user}:${cfg.group} "$x";
         done
 
+        [ ! -d /etc/foundationdb ] && \
+          mkdir -m 0775 -vp /etc/foundationdb && \
+          chown -R ${cfg.user}:${cfg.group} "/etc/foundationdb"
+
         if [ ! -f /etc/foundationdb/fdb.cluster ]; then
             cf=/etc/foundationdb/fdb.cluster
             desc=$(tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c8)
             rand=$(tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c8)
             echo ''${desc}:''${rand}@${initialIpAddr}:${builtins.toString cfg.listenPortStart} > $cf
-            chmod 0660 $cf && chown -R ${cfg.user}:${cfg.group} $cf
+            chmod 0664 $cf && chown -R ${cfg.user}:${cfg.group} $cf
             touch "${cfg.dataDir}/.first_startup"
         fi
       '';
 
-      script = ''
-        exec fdbmonitor --lockfile ${cfg.pidfile} --conffile ${configFile};
-      '';
+      script = "exec fdbmonitor --lockfile ${cfg.pidfile} --conffile ${configFile}";
 
       postStart = ''
         if [ -e "${cfg.dataDir}/.first_startup" ]; then
-          fdbcli --exec "configure new single ssd"
+          fdbcli --exec "configure new single memory"
           rm -f "${cfg.dataDir}/.first_startup";
         fi
       '';

diff --git a/nixos/modules/services/databases/foundationdb.xml b/nixos/modules/services/databases/foundationdb.xml
@@ -12,7 +12,7 @@
 
 <para><emphasis>Maintainer:</emphasis> Austin Seipp</para>
 
-<para><emphasis>Default version:</emphasis> 5.1.x</para>
+<para><emphasis>Available version(s):</emphasis> 5.1.x</para>
 
 <para>FoundationDB (or "FDB") is a distributed, open source, high performance,
 transactional key-value store. It can store petabytes of data and deliver
@@ -26,9 +26,17 @@ exceptional performance while maintaining consistency and ACID semantics
 
 <programlisting>
 services.foundationdb.enable = true;
+services.foundationdb.package = pkgs.foundationdb51; # FoundationDB 5.1.x
 </programlisting>
 </para>
 
+<para>The <option>services.foundationdb.package</option> option is required,
+and must always be specified. Because FoundationDB network protocols and
+on-disk storage formats may change between (major) versions, and upgrades must
+be explicitly handled by the user, you must always manually specify this
+yourself so that the NixOS module will use the proper version. Note that minor,
+bugfix releases are always compatible.</para>
+
 <para>After running <command>nixos-rebuild</command>, you can verify whether
 FoundationDB is running by executing <command>fdbcli</command> (which is added
 to <option>environment.systemPackages</option>):
@@ -192,6 +200,44 @@ to a new node in order to connect, if it is not part of the cluster.</para>
 
 </section>
 
+<section><title>Client authorization and TLS</title>
+
+<para>By default, any user who can connect to a FoundationDB process with the
+correct cluster configuration can access anything. FoundationDB uses a
+pluggable design to transport security, and out of the box it supports a
+LibreSSL-based plugin for TLS support. This plugin not only does in-flight
+encryption, but also performs client authorization based on the given
+endpoint's certificate chain. For example, a FoundationDB server may be
+configured to only accept client connections over TLS, where the client TLS
+certificate is from organization <emphasis>Acme Co</emphasis> in the
+<emphasis>Research and Development</emphasis> unit.</para>
+
+<para>Configuring TLS with FoundationDB is done using the
+<option>services.foundationdb.tls</option> options in order to control the peer
+verification string, as well as the certificate and its private key.</para>
+
+<para>Note that the certificate and its private key must be accessible to the
+FoundationDB user account that the server runs under. These files are also NOT
+managed by NixOS, as putting them into the store may reveal private
+information.</para>
+
+<para>After you have a key and certificate file in place, it is not enough to
+simply set the NixOS module options -- you must also configure the
+<command>fdb.cluster</command> file to specify that a given set of coordinators
+use TLS. This is as simple as adding the suffix <command>:tls</command> to your
+cluster coordinator configuration, after the port number. For example, assuming
+you have a coordinator on localhost with the default configuration, simply
+specifying:</para>
+
+<programlisting>
+XXXXXX:XXXXXX@127.0.0.1:4500:tls
+</programlisting>
+
+<para>will configure all clients and server processes to use TLS from now
+on.</para>
+
+</section>
+
 <section><title>Backups and Disaster Recovery</title>
 
 <para>The usual rules for doing FoundationDB backups apply on NixOS as written
@@ -245,16 +291,12 @@ FoundationDB is not new software, but the NixOS compilation and integration has
 only undergone fairly basic testing of all the available functionality.</para>
 
 <itemizedlist>
-  <listitem><para>TLS plugin support is compiled in, but it's currently not
-      possible to specify the set of TLS certificate options in
-      <command>services.foundationdb</command></para></listitem>
   <listitem><para>There is no way to specify individual parameters for
       individual <command>fdbserver</command> processes. Currently, all server
       processes inherit all the global <command>fdbmonitor</command> settings.
       </para></listitem>
   <listitem><para>Python bindings are not currently installed.</para></listitem>
   <listitem><para>Ruby bindings are not currently installed.</para></listitem>
-  <listitem><para>Java bindings are not currently installed.</para></listitem>
   <listitem><para>Go bindings are not currently installed.</para></listitem>
 </itemizedlist>
 

diff --git a/nixos/modules/virtualisation/virtualbox-host.nix b/nixos/modules/virtualisation/virtualbox-host.nix
@@ -6,7 +6,7 @@ let
   cfg = config.virtualisation.virtualbox.host;
 
   virtualbox = pkgs.virtualbox.override {
-    inherit (cfg) enableHardening headless;
+    inherit (cfg) enableExtensionPack enableHardening headless;
   };
 
   kernelModules = config.boot.kernelPackages.virtualbox.override {
@@ -17,9 +17,7 @@ in
 
 {
   options.virtualisation.virtualbox.host = {
-    enable = mkOption {
-      type = types.bool;
-      default = false;
+    enable = mkEnableOption "VirtualBox" // {
       description = ''
         Whether to enable VirtualBox.
 
@@ -30,6 +28,8 @@ in
       '';
     };
 
+    enableExtensionPack = mkEnableOption "VirtualBox extension pack";
+
     addNetworkInterface = mkOption {
       type = types.bool;
       default = true;

diff --git a/pkgs/applications/altcoins/parity/beta.nix b/pkgs/applications/altcoins/parity/beta.nix
@@ -1,7 +1,7 @@
 let
-  version     = "1.10.0";
-  sha256      = "0dmdd7qa8lww5bzcdn25nkyz6334irh8hw0y1j0yc2pmd2dny99g";
-  cargoSha256 = "0whkjbaq40mqva1ayqnmz2ppqjrg35va93cypx1al41rsp1yc37m";
+  version     = "1.10.2";
+  sha256      = "1a1rbwlwi60nfv6m1rdy5baq5lcafc8nw96y45pr1674i48gkp0l";
+  cargoSha256 = "0l3rjkinzppfq8fi8h24r35rb552fzzman5a6yk33wlsdj2lv7yh";
   patches     = [ ./patches/vendored-sources-1.10.patch ];
 in
   import ./parity.nix { inherit version sha256 cargoSha256 patches; }
diff --git a/pkgs/applications/altcoins/parity/default.nix b/pkgs/applications/altcoins/parity/default.nix
@@ -1,7 +1,7 @@
 let
-  version     = "1.9.5";
-  sha256      = "0f2x78p5bshs3678qcybqd34k83d294mp3vadp99iqhmbkhbfyy7";
-  cargoSha256 = "1irc01sva5yyhdv79cs6jk5pbmhxyvs0ja4cly4nw639m1kx7rva";
+  version     = "1.9.7";
+  sha256      = "1h9rmyqkdv2v83g12dadgqflq1n1qqgd5hrpy20ajha0qpbiv3ph";
+  cargoSha256 = "0ss5jw43850r8l34prai5vk1zd5d5fjyg4rcav1asbq6v683bww0";
   patches     = [ ./patches/vendored-sources-1.9.patch ];
 in
   import ./parity.nix { inherit version sha256 cargoSha256 patches; }
diff --git a/pkgs/applications/altcoins/parity/patches/vendored-sources-1.10.patch b/pkgs/applications/altcoins/parity/patches/vendored-sources-1.10.patch
@@ -2,7 +2,7 @@ diff --git a/.cargo/config b/.cargo/config
 index 72652ad2f..b21c6aa7b 100644
 --- a/.cargo/config
 +++ b/.cargo/config
-@@ -1,3 +1,113 @@
+@@ -1,3 +1,108 @@
  [target.x86_64-pc-windows-msvc]
  # Link the C runtime statically ; https://github.com/paritytech/parity/issues/6643
  rustflags = ["-Ctarget-feature=+crt-static"]
@@ -42,6 +42,11 @@ index 72652ad2f..b21c6aa7b 100644
 +rev = "eecaadcb9e421bce31e91680d14a20bbd38f92a2"
 +replace-with = "vendored-sources"
 +
++[source."https://github.com/paritytech/app-dirs-rs"]
++git = "https://github.com/paritytech/app-dirs-rs"
++branch = "master"
++replace-with = "vendored-sources"
++
 +[source."https://github.com/paritytech/bn"]
 +git = "https://github.com/paritytech/bn"
 +branch = "master"
@@ -97,16 +102,6 @@ index 72652ad2f..b21c6aa7b 100644
 +branch = "master"
 +replace-with = "vendored-sources"
 +
-+[source."https://github.com/paritytech/wasm-utils"]
-+git = "https://github.com/paritytech/wasm-utils"
-+branch = "master"
-+replace-with = "vendored-sources"
-+
-+[source."https://github.com/paritytech/wasmi"]
-+git = "https://github.com/paritytech/wasmi"
-+branch = "master"
-+replace-with = "vendored-sources"
-+
 +[source."https://github.com/tailhook/rotor"]
 +git = "https://github.com/tailhook/rotor"
 +branch = "master"
@@ -116,3 +111,4 @@ index 72652ad2f..b21c6aa7b 100644
 +git = "https://github.com/tomusdrw/ws-rs"
 +branch = "master"
 +replace-with = "vendored-sources"
++
diff --git a/pkgs/applications/altcoins/parity/patches/vendored-sources-1.9.patch b/pkgs/applications/altcoins/parity/patches/vendored-sources-1.9.patch
@@ -1,10 +1,9 @@
 diff --git a/.cargo/config b/.cargo/config
 new file mode 100644
 index 000000000..0efb69724
---- /dev/null
+--- /dev/null 
 +++ b/.cargo/config
-@@ -0,0 +1,100 @@
-+
+@@ -0,0 +1,94 @@
 +[source."https://github.com/alexcrichton/mio-named-pipes"]
 +git = "https://github.com/alexcrichton/mio-named-pipes"
 +branch = "master"
@@ -30,6 +29,11 @@ index 000000000..0efb69724
 +branch = "master"
 +replace-with = "vendored-sources"
 +
++[source."https://github.com/paritytech/app-dirs-rs"]
++git = "https://github.com/paritytech/app-dirs-rs"
++branch = "master"
++replace-with = "vendored-sources"
++
 +[source."https://github.com/paritytech/bn"]
 +git = "https://github.com/paritytech/bn"
 +branch = "master"
@@ -85,16 +89,6 @@ index 000000000..0efb69724
 +branch = "master"
 +replace-with = "vendored-sources"
 +
-+[source."https://github.com/paritytech/wasm-utils"]
-+git = "https://github.com/paritytech/wasm-utils"
-+branch = "master"
-+replace-with = "vendored-sources"
-+
-+[source."https://github.com/paritytech/wasmi"]
-+git = "https://github.com/paritytech/wasmi"
-+branch = "master"
-+replace-with = "vendored-sources"
-+
 +[source."https://github.com/tailhook/rotor"]
 +git = "https://github.com/tailhook/rotor"
 +branch = "master"