NixOS · jmatsushita · Sep 12, 2024 · Mar 18, 2024 · Sep 19, 2024 · Sep 19, 2024
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
@@ -277,25 +277,6 @@ let
       let
         selectEmulator = pkgs:
           let
-            qemu-user = pkgs.qemu.override {
-              smartcardSupport = false;
-              spiceSupport = false;
-              openGLSupport = false;
-              virglSupport = false;
-              vncSupport = false;
-              gtkSupport = false;
-              sdlSupport = false;
-              alsaSupport = false;
-              pulseSupport = false;
-              pipewireSupport = false;
-              jackSupport = false;
-              smbdSupport = false;
-              seccompSupport = false;
-              tpmSupport = false;
-              capstoneSupport = false;
-              enableDocs = false;
-              hostCpuTargets = [ "${final.qemuArch}-linux-user" ];
-            };
             wine = (pkgs.winePackagesFor "wine${toString final.parsed.cpu.bits}").minimal;
           in
           # Note: we guarantee that the return value is either `null` or a path
@@ -306,7 +287,7 @@ let
           else if final.isWindows
           then "${wine}/bin/wine${optionalString (final.parsed.cpu.bits == 64) "64"}"
           else if final.isLinux && pkgs.stdenv.hostPlatform.isLinux && final.qemuArch != null
-          then "${qemu-user}/bin/qemu-${final.qemuArch}"
+          then "${pkgs.qemu-user}/bin/qemu-${final.qemuArch}"
           else if final.isWasi
           then "${pkgs.wasmtime}/bin/wasmtime"
           else if final.isMmix
@@ -315,6 +296,10 @@ let
       in {
         emulatorAvailable = pkgs: (selectEmulator pkgs) != null;
 
+        # whether final.emulator pkgs.pkgsStatic works
+        staticEmulatorAvailable = pkgs: final.emulatorAvailable pkgs
+          && (final.isLinux || final.isWasi || final.isMmix);
+
         emulator = pkgs:
           if (final.emulatorAvailable pkgs)
           then selectEmulator pkgs

diff --git a/lib/tests/systems.nix b/lib/tests/systems.nix
@@ -96,6 +96,7 @@ lib.runTests (
         canExecute = null;
         emulator = null;
         emulatorAvailable = null;
+        staticEmulatorAvailable = null;
         isCompatible = null;
       }?${platformAttrName};
     };

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
@@ -2041,6 +2041,12 @@
     github = "auchter";
     githubId = 1190483;
   };
+  aucub = {
+    name = "aucub";
+    email = "dr56ekgbb@mozmail.com";
+    github = "aucub";
+    githubId = 78630225;
+  };
   augustebaum = {
     email = "auguste.apple@gmail.com";
     github = "augustebaum";
@@ -14694,6 +14700,12 @@
     githubId = 6709831;
     name = "Jake Hill";
   };
+  nartsiss = {
+    name = "Daniil Nartsissov";
+    email = "nartsiss@proton.me";
+    github = "nartsisss";
+    githubId = 54633007;
+  };
   nasageek = {
     github = "NasaGeek";
     githubId = 474937;
@@ -16654,6 +16666,12 @@
     githubId = 14542417;
     name = "Sergey Ichtchenko";
   };
+  pizzapim = {
+    email = "pim@kunis.nl";
+    github = "pizzapim";
+    githubId = 23135512;
+    name = "Pim Kunis";
+  };
   pjbarnoy = {
     email = "pjbarnoy@gmail.com";
     github = "waaamb";

diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -81,7 +81,7 @@
   user management. This can be used instead of the `update-users-groups.pl`
   Perl script and instead of systemd-sysusers. To achieve a system without
   Perl, this is the now recommended tool over systemd-sysusers because it can
-  alos create normal users and change passwords. Available as
+  also create normal users and change passwords. Available as
   [services.userborn](#opt-services.userborn.enable)
 
 - [Hatsu](https://github.com/importantimport/hatsu), a self-hosted bridge that interacts with Fediverse on behalf of your static site. Available as [services.hatsu](options.html#opt-services.hatsu).
@@ -120,6 +120,8 @@
 
 - [Localsend](https://localsend.org/), an open source cross-platform alternative to AirDrop. Available as [programs.localsend](#opt-programs.localsend.enable).
 
+- [Gatus](https://github.com/TwiN/gatus), an automated developer-oriented status page. Available as [services.gatus](#opt-services.gatus.enable).
+
 - [cryptpad](https://cryptpad.org/), a privacy-oriented collaborative platform (docs/drive/etc), has been added back. Available as [services.cryptpad](#opt-services.cryptpad.enable).
 
 - [realm](https://github.com/zhboner/realm), a simple, high performance relay server written in rust. Available as [services.realm.enable](#opt-services.realm.enable).
@@ -159,6 +161,8 @@
 
 - [obs-studio](https://obsproject.com/), Free and open source software for video recording and live streaming. Available as [programs.obs-studio.enable](#opt-programs.obs-studio.enable).
 
+- [Veilid](https://veilid.com), a headless server that enables privacy-focused data sharing and messaging on a peer-to-peer network. Available as [services.veilid](#opt-services.veilid.enable).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
 
 - The `sound` options have been removed or renamed, as they had a lot of unintended side effects. See [below](#sec-release-24.11-migration-sound) for details.
@@ -487,7 +491,7 @@
 - The `services.syncplay` module now exposes all currently available command-line arguments for `syncplay-server` as options, as well as a `useACMEHost` option for easy TLS setup.
   The systemd service now uses `DynamicUser`/`StateDirectory` and the `user` and `group` options have been deprecated.
 
-- The `openlens` package got removed, suggested replacment `lens-desktop`
+- The `openlens` package got removed, suggested replacement `lens-desktop`
 
 - The `services.dnsmasq.extraConfig` option has been removed, as it had been deprecated for over 2 years. This option has been replaced by `services.dnsmasq.settings`.
 
@@ -612,7 +616,7 @@
 - `iproute2` now has libbpf support.
 
 - `nix.channel.enable = false` no longer implies `nix.settings.nix-path = []`.
-  Since Nix 2.13, a `nix-path` set in `nix.conf` cannot be overriden by the `NIX_PATH` configuration variable.
+  Since Nix 2.13, a `nix-path` set in `nix.conf` cannot be overridden by the `NIX_PATH` configuration variable.
 
 ## Detailed migration information {#sec-release-24.11-migration}
 

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
@@ -883,6 +883,7 @@
   ./services/monitoring/datadog-agent.nix
   ./services/monitoring/do-agent.nix
   ./services/monitoring/fusion-inventory.nix
+  ./services/monitoring/gatus.nix
   ./services/monitoring/goss.nix
   ./services/monitoring/grafana-agent.nix
   ./services/monitoring/grafana-image-renderer.nix

diff --git a/nixos/modules/services/monitoring/gatus.nix b/nixos/modules/services/monitoring/gatus.nix
@@ -0,0 +1,132 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.services.gatus;
+
+  settingsFormat = pkgs.formats.yaml { };
+
+  inherit (lib)
+    getExe
+    literalExpression
+    maintainers
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    ;
+
+  inherit (lib.types)
+    bool
+    int
+    nullOr
+    path
+    submodule
+    ;
+in
+{
+  options.services.gatus = {
+    enable = mkEnableOption "Gatus";
+
+    package = mkPackageOption pkgs "gatus" { };
+
+    configFile = mkOption {
+      type = path;
+      default = settingsFormat.generate "gatus.yaml" cfg.settings;
+      defaultText = literalExpression ''
+        let settingsFormat = pkgs.formats.yaml { }; in settingsFormat.generate "gatus.yaml" cfg.settings;
+      '';
+      description = ''
+        Path to the Gatus configuration file.
+        Overrides any configuration made using the `settings` option.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = nullOr path;
+      default = null;
+      description = ''
+        File to load as environment file.
+        Environmental variables from this file can be interpolated in the configuration file using `''${VARIABLE}`.
+        This is useful to avoid putting secrets into the nix store.
+      '';
+    };
+
+    settings = mkOption {
+      type = submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          web.port = mkOption {
+            type = int;
+            default = 8080;
+            description = ''
+              The TCP port to serve the Gatus service at.
+            '';
+          };
+        };
+      };
+
+      default = { };
+
+      example = literalExpression ''
+        {
+          web.port = 8080;
+          endpoints = [{
+            name = "website";
+            url = "https://twin.sh/health";
+            interval = "5m";
+            conditions = [
+              "[STATUS] == 200"
+              "[BODY].status == UP"
+              "[RESPONSE_TIME] < 300"
+            ];
+          }];
+        }
+      '';
+
+      description = ''
+        Configuration for Gatus.
+        Supported options can be found at the [docs](https://gatus.io/docs).
+      '';
+    };
+
+    openFirewall = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Whether to open the firewall for the Gatus web interface.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.gatus = {
+      description = "Automated developer-oriented status page";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        DynamicUser = true;
+        User = "gatus";
+        Group = "gatus";
+        Type = "simple";
+        Restart = "on-failure";
+        ExecStart = getExe cfg.package;
+        StateDirectory = "gatus";
+        SyslogIdentifier = "gatus";
+        EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
+      };
+
+      environment = {
+        GATUS_CONFIG_PATH = cfg.configFile;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.settings.web.port ];
+  };
+
+  meta.maintainers = with maintainers; [ pizzapim ];
+}
diff --git a/nixos/modules/services/networking/i2pd.nix b/nixos/modules/services/networking/i2pd.nix
@@ -1,8 +1,8 @@
 { config, lib, pkgs, ... }:
 
 let
-  inherit (lib) mkIf mkOption mkEnableOption types optional optionals;
-  inherit (lib.types) nullOr bool listOf str;
+  inherit (lib) mkIf mkOption mkDefault mkEnableOption types optional optionals;
+  inherit (lib.types) nullOr bool listOf str attrsOf submodule;
 
   cfg = config.services.i2pd;
 
@@ -618,7 +618,7 @@ in
 
       outTunnels = mkOption {
         default = {};
-        type = with types; attrsOf (submodule (
+        type = attrsOf (submodule (
           { name, ... }: {
             options = {
               destinationPort = mkOption {
@@ -639,7 +639,7 @@ in
 
       inTunnels = mkOption {
         default = {};
-        type = with types; attrsOf (submodule (
+        type = attrsOf (submodule (
           { name, ... }: {
             options = {
               inPort = mkOption {

diff --git a/nixos/modules/system/boot/binfmt.nix b/nixos/modules/system/boot/binfmt.nix
@@ -28,8 +28,6 @@ let
          ''
     else interpreter;
 
-  getEmulator = system: (lib.systems.elaborate { inherit system; }).emulator pkgs;
-  getQemuArch = system: (lib.systems.elaborate { inherit system; }).qemuArch;
 
   # Mapping of systems to “magicOrExtension” and “mask”. Mostly taken from:
   # - https://github.com/cleverca22/nixos-configs/blob/master/qemu.nix
@@ -280,28 +278,50 @@ in {
         '';
         type = types.listOf (types.enum (builtins.attrNames magics));
       };
+
+      preferStaticEmulators = mkOption {
+        default = false;
+        description = ''
+          Whether to use static emulators when available.
+
+          This enables the kernel to preload the emulator binaries when
+          the binfmt registrations are added, obviating the need to make
+          the emulator binaries available inside chroots and chroot-like
+          sandboxes.
+        '';
+        type = types.bool;
+      };
     };
   };
 
   config = {
+    assertions = lib.mapAttrsToList (name: reg: {
+      assertion = reg.fixBinary -> !reg.wrapInterpreterInShell;
+      message = "boot.binfmt.registrations.\"${name}\" cannot have fixBinary when the interpreter is invoked through a shell.";
+    }) cfg.registrations;
+
     boot.binfmt.registrations = builtins.listToAttrs (map (system: assert system != pkgs.stdenv.hostPlatform.system; {
       name = system;
       value = { config, ... }: let
-        interpreter = getEmulator system;
-        qemuArch = getQemuArch system;
+        elaborated = lib.systems.elaborate { inherit system; };
+        useStaticEmulator = cfg.preferStaticEmulators && elaborated.staticEmulatorAvailable pkgs;
+        interpreter = elaborated.emulator (if useStaticEmulator then pkgs.pkgsStatic else pkgs);
+
+        inherit (elaborated) qemuArch;
+        isQemu = "qemu-${qemuArch}" == baseNameOf interpreter;
 
-        preserveArgvZero = "qemu-${qemuArch}" == baseNameOf interpreter;
         interpreterReg = let
           wrapperName = "qemu-${qemuArch}-binfmt-P";
           wrapper = pkgs.wrapQemuBinfmtP wrapperName interpreter;
         in
-          if preserveArgvZero then "${wrapper}/bin/${wrapperName}"
+          if isQemu && !useStaticEmulator then "${wrapper}/bin/${wrapperName}"
           else interpreter;
       in ({
-        preserveArgvZero = mkDefault preserveArgvZero;
+        preserveArgvZero = mkDefault isQemu;
 
         interpreter = mkDefault interpreterReg;
-        wrapInterpreterInShell = mkDefault (!config.preserveArgvZero);
+        fixBinary = mkDefault useStaticEmulator;
+        wrapInterpreterInShell = mkDefault (!config.preserveArgvZero && !config.fixBinary);
         interpreterSandboxPath = mkDefault (dirOf (dirOf config.interpreter));
       } // (magics.${system} or (throw "Cannot create binfmt registration for system ${system}")));
     }) cfg.emulatedSystems);

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
@@ -367,6 +367,7 @@ in {
   mimir = handleTest ./mimir.nix {};
   gancio = handleTest ./gancio.nix {};
   garage = handleTest ./garage {};
+  gatus = runTest ./gatus.nix;
   gemstash = handleTest ./gemstash.nix {};
   geoserver = runTest ./geoserver.nix;
   gerrit = handleTest ./gerrit.nix {};
@@ -658,6 +659,7 @@ in {
   # TODO: put in networking.nix after the test becomes more complete
   networkingProxy = handleTest ./networking-proxy.nix {};
   nextcloud = handleTest ./nextcloud {};
+  nextflow = handleTestOn ["x86_64-linux"] ./nextflow.nix {};
   nextjs-ollama-llm-ui = runTest ./web-apps/nextjs-ollama-llm-ui.nix;
   nexus = handleTest ./nexus.nix {};
   # TODO: Test nfsv3 + Kerberos