Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[24.11] nginx changes for 24.11 #1145

Open
wants to merge 30 commits into
base: fc-24.11-dev
Choose a base branch
from
Open

[24.11] nginx changes for 24.11 #1145

wants to merge 30 commits into from

Conversation

laalsaas
Copy link
Collaborator

@laalsaas laalsaas commented Oct 30, 2024 •
edited
Loading

@flyingcircusio/release-managers
PL-131381

Release process

Impact:

Changelog:

PR release workflow (internal)

  • PR has internal ticket
  • internal issue ID (PL-…) part of branch name
  • internal issue ID mentioned in PR description text
  • ticket is on Platform 24.11 agile board
  • ticket state set to Pull request ready
  • if ticket is more urgent than within the next few days, directly contact a member of the Platform team

Design notes

  • Provide a feature toggle if the change might need to be adjusted/reverted quickly depending on context. Consider whether the default should be on or off. Example: rate limiting.
  • All customer-facing features and (NixOS) options need to be discoverable from documentation. Add or update relevant documentation such that hosted and guided customers can understand it as well.

Security implications

  • Security requirements defined? (WHERE)
    • pull in changes from upstream, keeping our reload mechanism, without breaking anything for customers
  • Security requirements tested? (EVIDENCE)
    • ran test suite for nginx.

dpausp and others added 26 commits October 30, 2024 18:58
@dpausp @ctheune
Start 24.11 development
1add6d3
@dpausp @ctheune
Switch nixpkgs to current nixos-unstable (24.11)
a81bbf7
@dpausp @ctheune
sound.enable does not exist anymore
f8436e7
@dpausp @ctheune
java test: remove obsolete openjdk19
fe82dfd
@dpausp @ctheune
Remove jitsi-meet temporarily, marked insecure
a0446a3
@dpausp @ctheune
Update vendored nix-phps
2af7413
@dpausp @ctheune
nginx, test: fix acme assert
4b6b2e1
@dpausp @ctheune
Remove outdated and unneeded packages
d63efda
@dpausp @ctheune
jitsi-meet: marked as insecure, temp disable
12393a4
@dpausp @ctheune
images.fc: fix build
fe094c6
@dpausp @ctheune
jibri: remove sound.enable
31ef8dd
@dpausp @ctheune
Make beats work
c1892ec 
- -oss seems to be broken at the moment due to a failing test relying on
  x-pack. We have to re-check this later.
- Use upstream packages.
@dpausp @ctheune
Update nixpkgs (2024-09-07)
de41629 
Pull upstream NixOS changes, security fixes and package updates:

- awscli2: 2.17.18 -> 2.17.42
- containerd: 1.7.20 -> 1.7.21
- haproxy: 3.0.3 -> 3.0.4
- imagemagick: 7.1.1-37 -> 7.1.1-38
- imagemagick: add willow to passthru.tests
- k3s_1_30: 1.30.3+k3s1 -> 1.30.4+k3s1
- libmodsecurity: 3.0.12 -> 3.0.13
- linux_5_15: 5.15.165 -> 5.15.166
- mongodb-5_0: 5.0.28 -> 5.0.29
- nss_latest: 3.103 -> 3.104
- php82: 8.2.22 -> 8.2.23
- php83: 8.3.10 -> 8.3.11
- prometheus: 2.53.1 → 2.54.1
- qemu: 9.0.2 -> 9.1.0
- roundcube: 1.6.8 -> 1.6.9
- runc: 1.1.13 -> 1.1.14
- unifi8: 8.3.32 -> 8.4.59
@dpausp @ctheune
release: add releaseSmall and releaseUntested jobs
bc74421 
This way we get to a channel faster that we can use for development.

Before, we used to disable tests and packages to keep `release` green
which is error-prone and takes away the feedback we get from failing
tests in Hydra.
@dpausp @ctheune
Replace deprecated cargoSha256
8fe4746
@dpausp @ctheune
Remove vendored opensearch service
15abaa0 
This was taken from NixOS 23.05 and is obsolete now.

Had to remove the code that depends on cfgUpstream.configFile but
it's just for informational purposes and we can fix that later.
@dpausp @ctheune
php81: fix php81 build, pick up missing patches for others
71447a7 
Our patch logic used for adding our log patch to older PHP versions
left out `patches` which skipped a patch needed for building 8.1.
@dpausp @ctheune
Downgrade slurm to 23.11, known to work with pyslurm
83bc2fe 
slurm 24.05 doesn't work with pyslurm at the moment and there's
no visible work going on in the repo to make it compatible. Go
back to slurm 23.11 in the meantime. If the problem still persists
in 1-2 months, we should think about how we can resolve this properly.
@dpausp @ctheune
Update nixpkgs
0538c27 
Pull upstream NixOS changes, security fixes and package updates:

- asterisk: 20.9.2 -> 20.9.3
- curl: enable configure flag `--enable-versioned-symbols`
- curl: enable flag `--enable-versioned-symbols` (#336712)
- nodejs_20: 20.16.0 -> 20.17.0, (#336388)
- nodejs_22: 22.6.0 -> 22.8.0, (#336556)
- podman: drop slirp4netns which has been replaced by passt
- postgresql: move dynamic modules to default output
- postgresql: move libecpq to lib output
- postgresql: refactor removal of references in bitcode files
- postgresql: refactor to simplify condition
- postgresql: remove references to llvm-dev on darwin as well
- postgresql: split dev output
- postgresql: use systemdLibs (#337441)
- unifi7: mark insecure due to CVE-2024-42025 (#340341)
- vim: 9.1.0689 -> 9.1.0707
@dpausp @ctheune
Remove unifi7 and unifi8 from important packages
94b73f1
@dpausp @ctheune
Update nixpkgs
e3fdb87 
Pull upstream NixOS changes, security fixes and package updates:

- calibre: enable tests (#338867)
- containerd: 1.7.21 -> 1.7.22, (#340887)
- gitlab-container-registry: 4.7.0 -> 4.9.0
- gitlab: 17.2.4 -> 17.2.5, (#341398)
- keycloak: 25.0.4 -> 25.0.5, (#341062)
- openssl: expose 'enable-md2' option (#337885)
- python39: 3.9.19 -> 3.9.20; python310: 3.10.14 -> 3.10.15; python313: 3.13.0rc1 -> 3.13.0rc2, (#340330)
- rabbitmq-server: 3.13.6 -> 3.13.7, (#337489)
- subversion: fix darwin (#341232)
- telegraf: 1.31.3 -> 1.32.0, (#341515)
@dpausp @ctheune
Add buildbot to important packages
77c52c8
@osnyx @ctheune
security.acme.defaults.server: customise only for stateVersion <= 24.05
1c3b0aa 
In PL-132659, we've decided to override security.acme.defaults.server from the upstream value to avoid triggering mass letsencrypt account re-registrations.

**Re-**registrations are only an issue for existing machines. Freshly bootstrapped systems won't cause any problems. As we cannot be certain that our workaround is going to work for all future NixOS releases, I propose to make this conditional on the VM state version <= 24.05. If ever necessary, this reduces the number of VMs in need of a state migration for the account in the future.

PL-133038
@osnyx @ctheune
pre-commit fixes
c09ed6c
@dpausp @ctheune
agent: log name of dropped cmd log file
3dc9261
@dpausp @ctheune
Update nixpkgs (2024-09-25)
62ba7b6 
Pull upstream NixOS changes, security fixes and package updates:

- calibre: exclude test test_websocket_basic (#341843)
- clamav: 1.4.0 -> 1.4.1 (#341437)
- curl: apply patch for CVE-2024-8096 (#342030)
- docker-compose: 2.29.2 -> 2.29.3, (#341583)
- keycloak: 25.0.5 -> 25.0.6 (#343113)
- kubernetes-helm: 3.15.4 -> 3.16.1 (#341294)
- nix: 2.18 -> 2.24 (#335342)
- strace: 6.10 -> 6.11
- tomcat9: 9.0.93 -> 9.0.94
- tomcat10: 10.1.28 -> 10.1.29 (#341440)
Philipp Neumann added 2 commits October 30, 2024 19:34
nginx: remove JSON config
8ee0207 
PL-131381
nginx: remove masterUser option
fe2f427 
The masterUser option is remove since it caused many problems and brings
us closer to upstream.

PL-131381
nginx: pull in upstream changes
a18b990 
This is done to reduce the diff once we switch to the upstream module.
It is also part of the preparations for 24.11

PL-131381
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@laalsaas @dpausp @osnyx