Add 'nixpkgs/' from commit 'abf060725d7614bd3b9f96764262dfbc2f9c2199'

git-subtree-dir: nixpkgs
git-subtree-mainline: 4e31070265257dc67d120c27e0f75c2344fdfa9a
git-subtree-split: abf060725d7614bd3b9f96764262dfbc2f9c2199

1 files changed, 899 insertions, 0 deletions

diff --git a/nixpkgs/nixos/doc/manual/release-notes/rl-1709.xml b/nixpkgs/nixos/doc/manual/release-notes/rl-1709.xml
new file mode 100644
index 000000000000..795c51d2923d
--- /dev/null
+++ b/nixpkgs/nixos/doc/manual/release-notes/rl-1709.xml
@@ -0,0 +1,899 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-17.09">
+ <title>Release 17.09 (“Hummingbird”, 2017/09/??)</title>
+
+ <section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-17.09-highlights">
+  <title>Highlights</title>
+
+  <para>
+   In addition to numerous new and upgraded packages, this release has the
+   following highlights:
+  </para>
+
+  <itemizedlist>
+   <listitem>
+    <para>
+     The GNOME version is now 3.24. KDE Plasma was upgraded to 5.10, KDE
+     Applications to 17.08.1 and KDE Frameworks to 5.37.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The user handling now keeps track of deallocated UIDs/GIDs. When a user or
+     group is revived, this allows it to be allocated the UID/GID it had
+     before. A consequence is that UIDs and GIDs are no longer reused.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The module option <option>services.xserver.xrandrHeads</option> now causes
+     the first head specified in this list to be set as the primary head. Apart
+     from that, it's now possible to also set additional options by using an
+     attribute set, for example:
+<programlisting>
+{ services.xserver.xrandrHeads = [
+    "HDMI-0"
+    {
+      output = &quot;DVI-0&quot;;
+      primary = true;
+      monitorConfig = ''
+        Option &quot;Rotate&quot; &quot;right&quot;
+      '';
+    }
+  ];
+}
+</programlisting>
+     This will set the <literal>DVI-0</literal> output to be the primary head,
+     even though <literal>HDMI-0</literal> is the first head in the list.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The handling of SSL in the <literal>services.nginx</literal> module has
+     been cleaned up, renaming the misnamed <literal>enableSSL</literal> to
+     <literal>onlySSL</literal> which reflects its original intention. This is
+     not to be used with the already existing <literal>forceSSL</literal> which
+     creates a second non-SSL virtual host redirecting to the SSL virtual host.
+     This by chance had worked earlier due to specific implementation details.
+     In case you had specified both please remove the
+     <literal>enableSSL</literal> option to keep the previous behaviour.
+    </para>
+    <para>
+     Another <literal>addSSL</literal> option has been introduced to configure
+     both a non-SSL virtual host and an SSL virtual host with the same
+     configuration.
+    </para>
+    <para>
+     Options to configure <literal>resolver</literal> options and
+     <literal>upstream</literal> blocks have been introduced. See their
+     information for further details.
+    </para>
+    <para>
+     The <literal>port</literal> option has been replaced by a more generic
+     <literal>listen</literal> option which makes it possible to specify
+     multiple addresses, ports and SSL configs dependant on the new SSL
+     handling mentioned above.
+    </para>
+   </listitem>
+  </itemizedlist>
+ </section>
+
+ <section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-17.09-new-services">
+  <title>New Services</title>
+
+  <para>
+   The following new services were added since the last release:
+  </para>
+
+  <itemizedlist>
+   <listitem>
+    <para>
+     <literal>config/fonts/fontconfig-penultimate.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>config/fonts/fontconfig-ultimate.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>config/terminfo.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>hardware/sensor/iio.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>hardware/nitrokey.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>hardware/raid/hpsa.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>programs/browserpass.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>programs/gnupg.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>programs/qt5ct.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>programs/slock.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>programs/thefuck.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>security/auditd.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>security/lock-kernel-modules.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>service-managers/docker.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>service-managers/trivial.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/admin/salt/master.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/admin/salt/minion.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/audio/slimserver.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/cluster/kubernetes/default.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/cluster/kubernetes/dns.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/cluster/kubernetes/dashboard.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/continuous-integration/hail.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/databases/clickhouse.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/databases/postage.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/desktops/gnome3/gnome-disks.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/desktops/gnome3/gpaste.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/logging/SystemdJournal2Gelf.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/logging/heartbeat.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/logging/journalwatch.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/logging/syslogd.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/mail/mailhog.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/mail/nullmailer.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/misc/airsonic.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/misc/autorandr.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/misc/exhibitor.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/misc/fstrim.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/misc/gollum.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/misc/irkerd.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/misc/jackett.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/misc/radarr.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/misc/snapper.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/monitoring/osquery.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/monitoring/prometheus/collectd-exporter.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/monitoring/prometheus/fritzbox-exporter.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/network-filesystems/kbfs.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/networking/dnscache.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/networking/fireqos.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/networking/iwd.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/networking/keepalived/default.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/networking/keybase.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/networking/lldpd.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/networking/matterbridge.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/networking/squid.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/networking/tinydns.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/networking/xrdp.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/security/shibboleth-sp.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/security/sks.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/security/sshguard.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/security/torify.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/security/usbguard.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/security/vault.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/system/earlyoom.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/system/saslauthd.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/web-apps/nexus.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/web-apps/pgpkeyserver-lite.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/web-apps/piwik.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/web-servers/lighttpd/collectd.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/web-servers/minio.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/x11/display-managers/xpra.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services/x11/xautolock.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>tasks/filesystems/bcachefs.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>tasks/powertop.nix</literal>
+    </para>
+   </listitem>
+  </itemizedlist>
+ </section>
+
+ <section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-17.09-incompatibilities">
+  <title>Backward Incompatibilities</title>
+
+  <para>
+   When upgrading from a previous release, please be aware of the following
+   incompatible changes:
+  </para>
+
+  <itemizedlist>
+   <listitem>
+    <para>
+     <emphasis role="strong"> In an Qemu-based virtualization environment, the
+     network interface names changed from i.e. <literal>enp0s3</literal> to
+     <literal>ens3</literal>. </emphasis>
+    </para>
+    <para>
+     This is due to a kernel configuration change. The new naming is consistent
+     with those of other Linux distributions with systemd. See
+     <link xlink:href="https://github.com/NixOS/nixpkgs/issues/29197">#29197</link>
+     for more information.
+    </para>
+    <para>
+     A machine is affected if the <literal>virt-what</literal> tool either
+     returns <literal>qemu</literal> or <literal>kvm</literal>
+     <emphasis>and</emphasis> has interface names used in any part of its NixOS
+     configuration, in particular if a static network configuration with
+     <literal>networking.interfaces</literal> is used.
+    </para>
+    <para>
+     Before rebooting affected machines, please ensure:
+     <itemizedlist>
+      <listitem>
+       <para>
+        Change the interface names in your NixOS configuration. The first
+        interface will be called <literal>ens3</literal>, the second one
+        <literal>ens8</literal> and starting from there incremented by 1.
+       </para>
+      </listitem>
+      <listitem>
+       <para>
+        After changing the interface names, rebuild your system with
+        <literal>nixos-rebuild boot</literal> to activate the new configuration
+        after a reboot. If you switch to the new configuration right away you
+        might lose network connectivity! If using <literal>nixops</literal>,
+        deploy with <literal>nixops deploy --force-reboot</literal>.
+       </para>
+      </listitem>
+     </itemizedlist>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The following changes apply if the <literal>stateVersion</literal> is
+     changed to 17.09 or higher. For <literal>stateVersion = "17.03"</literal>
+     or lower the old behavior is preserved.
+    </para>
+    <itemizedlist>
+     <listitem>
+      <para>
+       The <literal>postgres</literal> default version was changed from 9.5 to
+       9.6.
+      </para>
+     </listitem>
+     <listitem>
+      <para>
+       The <literal>postgres</literal> superuser name has changed from
+       <literal>root</literal> to <literal>postgres</literal> to more closely
+       follow what other Linux distributions are doing.
+      </para>
+     </listitem>
+     <listitem>
+      <para>
+       The <literal>postgres</literal> default <literal>dataDir</literal> has
+       changed from <literal>/var/db/postgres</literal> to
+       <literal>/var/lib/postgresql/$psqlSchema</literal> where $psqlSchema is
+       9.6 for example.
+      </para>
+     </listitem>
+     <listitem>
+      <para>
+       The <literal>mysql</literal> default <literal>dataDir</literal> has
+       changed from <literal>/var/mysql</literal> to
+       <literal>/var/lib/mysql</literal>.
+      </para>
+     </listitem>
+     <listitem>
+      <para>
+       Radicale's default package has changed from 1.x to 2.x. Instructions to
+       migrate can be found <link xlink:href="http://radicale.org/1to2/"> here
+       </link>. It is also possible to use the newer version by setting the
+       <literal>package</literal> to <literal>radicale2</literal>, which is
+       done automatically when <literal>stateVersion</literal> is 17.09 or
+       higher. The <literal>extraArgs</literal> option has been added to allow
+       passing the data migration arguments specified in the instructions; see
+       the
+       <filename xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/radicale.nix">radicale.nix</filename>
+       NixOS test for an example migration.
+      </para>
+     </listitem>
+    </itemizedlist>
+   </listitem>
+   <listitem>
+    <para>
+     The <literal>aiccu</literal> package was removed. This is due to SixXS
+     <link xlink:href="https://www.sixxs.net/main/"> sunsetting</link> its IPv6
+     tunnel.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <literal>fanctl</literal> package and <literal>fan</literal> module
+     have been removed due to the developers not upstreaming their iproute2
+     patches and lagging with compatibility to recent iproute2 versions.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Top-level <literal>idea</literal> package collection was renamed. All
+     JetBrains IDEs are now at <literal>jetbrains</literal>.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>flexget</literal>'s state database cannot be upgraded to its new
+     internal format, requiring removal of any existing
+     <literal>db-config.sqlite</literal> which will be automatically recreated.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <literal>ipfs</literal> service now doesn't ignore the
+     <literal>dataDir</literal> option anymore. If you've ever set this option
+     to anything other than the default you'll have to either unset it (so the
+     default gets used) or migrate the old data manually with
+<programlisting>
+dataDir=&lt;valueOfDataDir&gt;
+mv /var/lib/ipfs/.ipfs/* $dataDir
+rmdir /var/lib/ipfs/.ipfs
+</programlisting>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <literal>caddy</literal> service was previously using an extra
+     <literal>.caddy</literal> directory in the data directory specified with
+     the <literal>dataDir</literal> option. The contents of the
+     <literal>.caddy</literal> directory are now expected to be in the
+     <literal>dataDir</literal>.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <literal>ssh-agent</literal> user service is not started by default
+     anymore. Use <literal>programs.ssh.startAgent</literal> to enable it if
+     needed. There is also a new <literal>programs.gnupg.agent</literal> module
+     that creates a <literal>gpg-agent</literal> user service. It can also
+     serve as a SSH agent if <literal>enableSSHSupport</literal> is set.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <literal>services.tinc.networks.&lt;name&gt;.listenAddress</literal>
+     option had a misleading name that did not correspond to its behavior. It
+     now correctly defines the ip to listen for incoming connections on. To
+     keep the previous behaviour, use
+     <literal>services.tinc.networks.&lt;name&gt;.bindToAddress</literal>
+     instead. Refer to the description of the options for more details.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>tlsdate</literal> package and module were removed. This is due to
+     the project being dead and not building with openssl 1.1.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>wvdial</literal> package and module were removed. This is due to
+     the project being dead and not building with openssl 1.1.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>cc-wrapper</literal>'s setup-hook now exports a number of
+     environment variables corresponding to binutils binaries, (e.g.
+     <envar>LD</envar>, <envar>STRIP</envar>, <envar>RANLIB</envar>, etc). This
+     is done to prevent packages' build systems guessing, which is harder to
+     predict, especially when cross-compiling. However, some packages have
+     broken due to this—their build systems either not supporting, or
+     claiming to support without adequate testing, taking such environment
+     variables as parameters.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services.firefox.syncserver</literal> now runs by default as a
+     non-root user. To accomodate this change, the default sqlite database
+     location has also been changed. Migration should work automatically. Refer
+     to the description of the options for more details.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <literal>compiz</literal> window manager and package was removed. The
+     system support had been broken for several years.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Touchpad support should now be enabled through <literal>libinput</literal>
+     as <literal>synaptics</literal> is now deprecated. See the option
+     <literal>services.xserver.libinput.enable</literal>.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     grsecurity/PaX support has been dropped, following upstream's decision to
+     cease free support. See
+     <link xlink:href="https://grsecurity.net/passing_the_baton.php">
+     upstream's announcement</link> for more information. No complete
+     replacement for grsecurity/PaX is available presently.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services.mysql</literal> now has declarative configuration of
+     databases and users with the <literal>ensureDatabases</literal> and
+     <literal>ensureUsers</literal> options.
+    </para>
+    <para>
+     These options will never delete existing databases and users, especially
+     not when the value of the options are changed.
+    </para>
+    <para>
+     The MySQL users will be identified using
+     <link xlink:href="https://mariadb.com/kb/en/library/authentication-plugin-unix-socket/">
+     Unix socket authentication</link>. This authenticates the Unix user with
+     the same name only, and that without the need for a password.
+    </para>
+    <para>
+     If you have previously created a MySQL <literal>root</literal> user
+     <emphasis>with a password</emphasis>, you will need to add
+     <literal>root</literal> user for unix socket authentication before using
+     the new options. This can be done by running the following SQL script:
+<programlisting language="sql">
+CREATE USER 'root'@'%' IDENTIFIED BY '';
+GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
+FLUSH PRIVILEGES;
+
+-- Optionally, delete the password-authenticated user:
+-- DROP USER 'root'@'localhost';
+</programlisting>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services.mysqlBackup</literal> now works by default without any
+     user setup, including for users other than <literal>mysql</literal>.
+    </para>
+    <para>
+     By default, the <literal>mysql</literal> user is no longer the user which
+     performs the backup. Instead a system account
+     <literal>mysqlbackup</literal> is used.
+    </para>
+    <para>
+     The <literal>mysqlBackup</literal> service is also now using systemd
+     timers instead of <literal>cron</literal>.
+    </para>
+    <para>
+     Therefore, the <literal>services.mysqlBackup.period</literal> option no
+     longer exists, and has been replaced with
+     <literal>services.mysqlBackup.calendar</literal>, which is in the format
+     of
+     <link
+      xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.time.html#Calendar%20Events">systemd.time(7)</link>.
+    </para>
+    <para>
+     If you expect to be sent an e-mail when the backup fails, consider using a
+     script which monitors the systemd journal for errors. Regretfully, at
+     present there is no built-in functionality for this.
+    </para>
+    <para>
+     You can check that backups still work by running <command>systemctl start
+     mysql-backup</command> then <command>systemctl status
+     mysql-backup</command>.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Templated systemd services e.g <literal>container@name</literal> are now
+     handled currectly when switching to a new configuration, resulting in them
+     being reloaded.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Steam: the <literal>newStdcpp</literal> parameter was removed and should
+     not be needed anymore.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Redis has been updated to version 4 which mandates a cluster mass-restart,
+     due to changes in the network handling, in order to ensure compatibility
+     with networks NATing traffic.
+    </para>
+   </listitem>
+  </itemizedlist>
+ </section>
+
+ <section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-17.09-notable-changes">
+  <title>Other Notable Changes</title>
+
+  <itemizedlist>
+   <listitem>
+    <para>
+     Modules can now be disabled by using
+     <link
+      xlink:href="https://nixos.org/nixpkgs/manual/#sec-replace-modules">
+     disabledModules</link>, allowing another to take it's place. This can be
+     used to import a set of modules from another channel while keeping the
+     rest of the system on a stable release.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Updated to FreeType 2.7.1, including a new TrueType engine. The new engine
+     replaces the Infinality engine which was the default in NixOS. The default
+     font rendering settings are now provided by fontconfig-penultimate,
+     replacing fontconfig-ultimate; the new defaults are less invasive and
+     provide rendering that is more consistent with other systems and hopefully
+     with each font designer's intent. Some system-wide configuration has been
+     removed from the Fontconfig NixOS module where user Fontconfig settings
+     are available.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     ZFS/SPL have been updated to 0.7.0, <literal>zfsUnstable,
+     splUnstable</literal> have therefore been removed.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <option>time.timeZone</option> option now allows the value
+     <literal>null</literal> in addition to timezone strings. This value allows
+     changing the timezone of a system imperatively using <command>timedatectl
+     set-timezone</command>. The default timezone is still UTC.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Nixpkgs overlays may now be specified with a file as well as a directory.
+     The value of <literal>&lt;nixpkgs-overlays></literal> may be a file, and
+     <filename>~/.config/nixpkgs/overlays.nix</filename> can be used instead of
+     the <filename>~/.config/nixpkgs/overlays</filename> directory.
+    </para>
+    <para>
+     See the overlays chapter of the Nixpkgs manual for more details.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Definitions for <filename>/etc/hosts</filename> can now be specified
+     declaratively with <literal>networking.hosts</literal>.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Two new options have been added to the installer loader, in addition to
+     the default having changed. The kernel log verbosity has been lowered to
+     the upstream default for the default options, in order to not spam the
+     console when e.g. joining a network.
+    </para>
+    <para>
+     This therefore leads to adding a new <literal>debug</literal> option to
+     set the log level to the previous verbose mode, to make debugging easier,
+     but still accessible easily.
+    </para>
+    <para>
+     Additionally a <literal>copytoram</literal> option has been added, which
+     makes it possible to remove the install medium after booting. This allows
+     tethering from your phone after booting from it.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services.gitlab-runner.configOptions</literal> has been added to
+     specify the configuration of gitlab-runners declaratively.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services.jenkins.plugins</literal> has been added to install
+     plugins easily, this can be generated with jenkinsPlugins2nix.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>services.postfix.config</literal> has been added to specify the
+     main.cf with NixOS options. Additionally other options have been added to
+     the postfix module and has been improved further.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The GitLab package and module have been updated to the latest 10.0
+     release.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <literal>systemd-boot</literal> boot loader now lists the NixOS
+     version, kernel version and build date of all bootable generations.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The dnscrypt-proxy service now defaults to using a random upstream
+     resolver, selected from the list of public non-logging resolvers with
+     DNSSEC support. Existing configurations can be migrated to this mode of
+     operation by omitting the
+     <option>services.dnscrypt-proxy.resolverName</option> option or setting it
+     to <literal>"random"</literal>.
+    </para>
+   </listitem>
+  </itemizedlist>
+ </section>
+</section>