diff options
| author | Alyssa Ross <hi@alyssa.is> | 2022-12-06 19:57:55 +0000 |
|---|---|---|
| committer | Alyssa Ross <hi@alyssa.is> | 2023-02-08 13:48:30 +0000 |
| commit | bf3aadfdd39aa197e18bade671fab6726349ffa4 (patch) | |
| tree | 698567af766ed441d757b57a7b21e68d4a342a2b /nixpkgs/nixos/doc | |
| parent | f4afc5a01d9539ce09e47494e679c51f80723d07 (diff) | |
| parent | 99665eb45f58d959d2cb9e49ddb960c79d596f33 (diff) | |
| download | nixlib-bf3aadfdd39aa197e18bade671fab6726349ffa4.tar nixlib-bf3aadfdd39aa197e18bade671fab6726349ffa4.tar.gz nixlib-bf3aadfdd39aa197e18bade671fab6726349ffa4.tar.bz2 nixlib-bf3aadfdd39aa197e18bade671fab6726349ffa4.tar.lz nixlib-bf3aadfdd39aa197e18bade671fab6726349ffa4.tar.xz nixlib-bf3aadfdd39aa197e18bade671fab6726349ffa4.tar.zst nixlib-bf3aadfdd39aa197e18bade671fab6726349ffa4.zip | |
Merge commit '99665eb45f58d959d2cb9e49ddb960c79d596f33'
Diffstat (limited to 'nixpkgs/nixos/doc')
47 files changed, 3166 insertions, 464 deletions
diff --git a/nixpkgs/nixos/doc/manual/administration/declarative-containers.section.md b/nixpkgs/nixos/doc/manual/administration/declarative-containers.section.md index 0d9d4017ed81..00fd244bb91f 100644 --- a/nixpkgs/nixos/doc/manual/administration/declarative-containers.section.md +++ b/nixpkgs/nixos/doc/manual/administration/declarative-containers.section.md @@ -40,7 +40,7 @@ section for details on container networking.) To disable the container, just remove it from `configuration.nix` and run `nixos-rebuild switch`. Note that this will not delete the root directory of the -container in `/var/lib/containers`. Containers can be destroyed using +container in `/var/lib/nixos-containers`. Containers can be destroyed using the imperative method: `nixos-container destroy foo`. Declarative containers can be started and stopped using the diff --git a/nixpkgs/nixos/doc/manual/administration/imperative-containers.section.md b/nixpkgs/nixos/doc/manual/administration/imperative-containers.section.md index 05196bf5d819..f45991780c4b 100644 --- a/nixpkgs/nixos/doc/manual/administration/imperative-containers.section.md +++ b/nixpkgs/nixos/doc/manual/administration/imperative-containers.section.md @@ -10,8 +10,8 @@ You create a container with identifier `foo` as follows: # nixos-container create foo ``` -This creates the container's root directory in `/var/lib/containers/foo` -and a small configuration file in `/etc/containers/foo.conf`. It also +This creates the container's root directory in `/var/lib/nixos-containers/foo` +and a small configuration file in `/etc/nixos-containers/foo.conf`. It also builds the container's initial system configuration and stores it in `/nix/var/nix/profiles/per-container/foo/system`. You can modify the initial configuration of the container on the command line. For diff --git a/nixpkgs/nixos/doc/manual/configuration/adding-custom-packages.section.md b/nixpkgs/nixos/doc/manual/configuration/adding-custom-packages.section.md index 5d1198fb0f41..9219396722f0 100644 --- a/nixpkgs/nixos/doc/manual/configuration/adding-custom-packages.section.md +++ b/nixpkgs/nixos/doc/manual/configuration/adding-custom-packages.section.md @@ -1,11 +1,18 @@ # Adding Custom Packages {#sec-custom-packages} It's possible that a package you need is not available in NixOS. In that -case, you can do two things. First, you can clone the Nixpkgs -repository, add the package to your clone, and (optionally) submit a -patch or pull request to have it accepted into the main Nixpkgs repository. -This is described in detail in the [Nixpkgs manual](https://nixos.org/nixpkgs/manual). -In short, you clone Nixpkgs: +case, you can do two things. Either you can package it with Nix, or you can try +to use prebuilt packages from upstream. Due to the peculiarities of NixOS, it +is important to note that building software from source is often easier than +using pre-built executables. + +## Building with Nix {#sec-custom-packages-nix} + +This can be done either in-tree or out-of-tree. For an in-tree build, you can +clone the Nixpkgs repository, add the package to your clone, and (optionally) +submit a patch or pull request to have it accepted into the main Nixpkgs +repository. This is described in detail in the [Nixpkgs +manual](https://nixos.org/nixpkgs/manual). In short, you clone Nixpkgs: ```ShellSession $ git clone https://github.com/NixOS/nixpkgs @@ -72,3 +79,21 @@ $ nix-build my-hello.nix $ ./result/bin/hello Hello, world! ``` + +## Using pre-built executables {#sec-custom-packages-prebuilt} + +Most pre-built executables will not work on NixOS. There are two notable +exceptions: flatpaks and AppImages. For flatpaks see the [dedicated +section](#module-services-flatpak). AppImages will not run "as-is" on NixOS. +First you need to install `appimage-run`: add to `/etc/nixos/configuration.nix` + +```nix +environment.systemPackages = [ pkgs.appimage-run ]; +``` + +Then instead of running the AppImage "as-is", run `appimage-run foo.appimage`. + +To make other pre-built executables work on NixOS, you need to package them +with Nix and special helpers like `autoPatchelfHook` or `buildFHSUserEnv`. See +the [Nixpkgs manual](https://nixos.org/nixpkgs/manual) for details. This +is complex and often doing a source build is easier. diff --git a/nixpkgs/nixos/doc/manual/configuration/gpu-accel.chapter.md b/nixpkgs/nixos/doc/manual/configuration/gpu-accel.chapter.md index 08b6af5d98ae..835cbad55485 100644 --- a/nixpkgs/nixos/doc/manual/configuration/gpu-accel.chapter.md +++ b/nixpkgs/nixos/doc/manual/configuration/gpu-accel.chapter.md @@ -169,7 +169,7 @@ configuration, GPU devices have world-read/write permissions (`/dev/dri/renderD*`) or are tagged as `uaccess` (`/dev/dri/card*`). The access control lists of devices with the `uaccess` tag will be updated automatically when a user logs in through `systemd-logind`. For example, -if the user *jane* is logged in, the access control list should look as +if the user *alice* is logged in, the access control list should look as follows: ```ShellSession @@ -178,7 +178,7 @@ $ getfacl /dev/dri/card0 # owner: root # group: video user::rw- -user:jane:rw- +user:alice:rw- group::rw- mask::rw- other::--- diff --git a/nixpkgs/nixos/doc/manual/configuration/xfce.chapter.md b/nixpkgs/nixos/doc/manual/configuration/xfce.chapter.md index b0ef6682aae8..ee60d465e3b3 100644 --- a/nixpkgs/nixos/doc/manual/configuration/xfce.chapter.md +++ b/nixpkgs/nixos/doc/manual/configuration/xfce.chapter.md @@ -24,11 +24,16 @@ Some Xfce programs are not installed automatically. To install them manually (system wide), put them into your [](#opt-environment.systemPackages) from `pkgs.xfce`. -## Thunar Plugins {#sec-xfce-thunar-plugins .unnumbered} +## Thunar {#sec-xfce-thunar-plugins .unnumbered} + +Thunar (the Xfce file manager) is automatically enabled when Xfce is +enabled. To enable Thunar without enabling Xfce, use the configuration +option [](#opt-programs.thunar.enable) instead of simply adding +`pkgs.xfce.thunar` to [](#opt-environment.systemPackages). If you\'d like to add extra plugins to Thunar, add them to -[](#opt-services.xserver.desktopManager.xfce.thunarPlugins). -You shouldn\'t just add them to [](#opt-environment.systemPackages). +[](#opt-programs.thunar.plugins). You shouldn\'t just add them to +[](#opt-environment.systemPackages). ## Troubleshooting {#sec-xfce-troubleshooting .unnumbered} diff --git a/nixpkgs/nixos/doc/manual/default.nix b/nixpkgs/nixos/doc/manual/default.nix index e96bc47b4a53..1cd769b6a544 100644 --- a/nixpkgs/nixos/doc/manual/default.nix +++ b/nixpkgs/nixos/doc/manual/default.nix @@ -14,6 +14,10 @@ with pkgs; let lib = pkgs.lib; + docbook_xsl_ns = pkgs.docbook-xsl-ns.override { + withManOptDedupPatch = true; + }; + # We need to strip references to /nix/store/* from options, # including any `extraSources` if some modules came from elsewhere, # or else the build will fail. @@ -129,12 +133,12 @@ let # ^ redirect assumes xmllint doesn’t print to stdout } - lintrng manual-combined.xml - lintrng man-pages-combined.xml - mkdir $out cp manual-combined.xml $out/ cp man-pages-combined.xml $out/ + + lintrng $out/manual-combined.xml + lintrng $out/man-pages-combined.xml ''; olinkDB = runCommand "manual-olinkdb" diff --git a/nixpkgs/nixos/doc/manual/development/activation-script.section.md b/nixpkgs/nixos/doc/manual/development/activation-script.section.md index df6836624040..1aee252fddea 100644 --- a/nixpkgs/nixos/doc/manual/development/activation-script.section.md +++ b/nixpkgs/nixos/doc/manual/development/activation-script.section.md @@ -54,7 +54,7 @@ possiblility into account that they have to create them first. ## NixOS snippets {#sec-activation-script-nixos-snippets} There are some snippets NixOS enables by default because disabling them would -most likely break you system. This section lists a few of them and what they +most likely break your system. This section lists a few of them and what they do: - `binsh` creates `/bin/sh` which points to the runtime shell diff --git a/nixpkgs/nixos/doc/manual/development/development.xml b/nixpkgs/nixos/doc/manual/development/development.xml index 21286cdbd2b4..624ee3931659 100644 --- a/nixpkgs/nixos/doc/manual/development/development.xml +++ b/nixpkgs/nixos/doc/manual/development/development.xml @@ -14,7 +14,6 @@ <xi:include href="../from_md/development/building-parts.chapter.xml" /> <xi:include href="../from_md/development/what-happens-during-a-system-switch.chapter.xml" /> <xi:include href="../from_md/development/writing-documentation.chapter.xml" /> - <xi:include href="../from_md/development/building-nixos.chapter.xml" /> <xi:include href="../from_md/development/nixos-tests.chapter.xml" /> <xi:include href="../from_md/development/testing-installer.chapter.xml" /> </part> diff --git a/nixpkgs/nixos/doc/manual/development/option-declarations.section.md b/nixpkgs/nixos/doc/manual/development/option-declarations.section.md index 53ecb9b3a624..8bf73a66456b 100644 --- a/nixpkgs/nixos/doc/manual/development/option-declarations.section.md +++ b/nixpkgs/nixos/doc/manual/development/option-declarations.section.md @@ -56,7 +56,14 @@ The function `mkOption` accepts the following arguments. `description` : A textual description of the option, in DocBook format, that will be - included in the NixOS manual. + included in the NixOS manual. During the migration process from DocBook + to CommonMark the description may also be written in CommonMark, but has + to be wrapped in `lib.mdDoc` to differentiate it from DocBook. See + the nixpkgs manual for [the list of CommonMark extensions]( + https://nixos.org/nixpkgs/manual/#sec-contributing-markup) + supported by NixOS documentation. + + New documentation should preferably be written as CommonMark. ## Utility functions for common option patterns {#sec-option-declarations-util} @@ -120,14 +127,14 @@ lib.mkOption { ```nix lib.mkPackageOption pkgs "GHC" { default = [ "ghc" ]; - example = "pkgs.haskell.package.ghc921.ghc.withPackages (hkgs: [ hkgs.primes ])"; + example = "pkgs.haskell.packages.ghc924.ghc.withPackages (hkgs: [ hkgs.primes ])"; } # is like lib.mkOption { type = lib.types.package; default = pkgs.ghc; defaultText = lib.literalExpression "pkgs.ghc"; - example = lib.literalExpression "pkgs.haskell.package.ghc921.ghc.withPackages (hkgs: [ hkgs.primes ])"; + example = lib.literalExpression "pkgs.haskell.packages.ghc924.ghc.withPackages (hkgs: [ hkgs.primes ])"; description = "The GHC package to use."; } ``` diff --git a/nixpkgs/nixos/doc/manual/development/option-types.section.md b/nixpkgs/nixos/doc/manual/development/option-types.section.md index 00f1d85bdb61..9b35e6630144 100644 --- a/nixpkgs/nixos/doc/manual/development/option-types.section.md +++ b/nixpkgs/nixos/doc/manual/development/option-types.section.md @@ -220,6 +220,25 @@ Value types are types that take a value parameter. requires using a function: `the-submodule = { ... }: { options = { ... }; }`. +`types.deferredModule` + +: Whereas `submodule` represents an option tree, `deferredModule` represents + a module value, such as a module file or a configuration. + + It can be set multiple times. + + Module authors can use its value in `imports`, in `submoduleWith`'s `modules` + or in `evalModules`' `modules` parameter, among other places. + + Note that `imports` must be evaluated before the module fixpoint. Because + of this, deferred modules can only be imported into "other" fixpoints, such + as submodules. + + One use case for this type is the type of a "default" module that allow the + user to affect all submodules in an `attrsOf submodule` at once. This is + more convenient and discoverable than expecting the module user to + type-merge with the `attrsOf submodule` option. + ## Composed Types {#sec-option-types-composed} Composed types are types that take a type as parameter. `listOf @@ -308,6 +327,10 @@ The option set can be defined directly ([Example: Directly defined submodule](#ex-submodule-direct)) or as reference ([Example: Submodule defined as a reference](#ex-submodule-reference)). +Note that even if your submodule’s options all have a default value, +you will still need to provide a default value (e.g. an empty attribute set) +if you want to allow users to leave it undefined. + ::: {#ex-submodule-direct .example} ::: {.title} **Example: Directly defined submodule** diff --git a/nixpkgs/nixos/doc/manual/development/settings-options.section.md b/nixpkgs/nixos/doc/manual/development/settings-options.section.md index f9bb6ff9cc41..d569e23adbdc 100644 --- a/nixpkgs/nixos/doc/manual/development/settings-options.section.md +++ b/nixpkgs/nixos/doc/manual/development/settings-options.section.md @@ -32,6 +32,20 @@ type of this option should represent the format. The most common formats have a predefined type and string generator already declared under `pkgs.formats`: +`pkgs.formats.javaProperties` { *`comment`* ? `"Generated with Nix"` } + +: A function taking an attribute set with values + + `comment` + + : A string to put at the start of the + file in a comment. It can have multiple + lines. + + It returns the `type`: `attrsOf str` and a function + `generate` to build a Java `.properties` file, taking + care of the correct escaping, etc. + `pkgs.formats.json` { } : A function taking an empty attribute set (for future extensibility) diff --git a/nixpkgs/nixos/doc/manual/development/writing-nixos-tests.section.md b/nixpkgs/nixos/doc/manual/development/writing-nixos-tests.section.md index 433e1906f775..6934bb0face7 100644 --- a/nixpkgs/nixos/doc/manual/development/writing-nixos-tests.section.md +++ b/nixpkgs/nixos/doc/manual/development/writing-nixos-tests.section.md @@ -5,15 +5,9 @@ A NixOS test is a Nix expression that has the following structure: ```nix import ./make-test-python.nix { - # Either the configuration of a single machine: - machine = - { config, pkgs, ... }: - { configuration… - }; - - # Or a set of machines: + # One or more machines: nodes = - { machine1 = + { machine = { config, pkgs, ... }: { … }; machine2 = { config, pkgs, ... }: { … }; @@ -29,17 +23,16 @@ import ./make-test-python.nix { The attribute `testScript` is a bit of Python code that executes the test (described below). During the test, it will start one or more -virtual machines, the configuration of which is described by the -attribute `machine` (if you need only one machine in your test) or by -the attribute `nodes` (if you need multiple machines). For instance, -[`login.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix) -only needs a single machine to test whether users can log in +virtual machines, the configuration of which is described by +the attribute `nodes`. + +An example of a single-node test is +[`login.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix). +It only needs a single machine to test whether users can log in on the virtual console, whether device ownership is correctly maintained -when switching between consoles, and so on. On the other hand, -[`nfs/simple.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nfs/simple.nix), -which tests NFS client and server functionality in the -Linux kernel (including whether locks are maintained across server -crashes), requires three machines: a server and two clients. +when switching between consoles, and so on. An interesting multi-node test is +[`nfs/simple.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nfs/simple.nix). +It uses two client nodes to test correct locking across server crashes. There are a few special NixOS configuration options for test VMs: @@ -67,8 +60,7 @@ The test script is a sequence of Python statements that perform various actions, such as starting VMs, executing commands in the VMs, and so on. Each virtual machine is represented as an object stored in the variable `name` if this is also the identifier of the machine in the declarative -config. If you didn\'t specify multiple machines using the `nodes` -attribute, it is just `machine`. The following example starts the +config. If you specified a node `nodes.machine`, the following example starts the machine, waits until it has finished booting, then executes a command and checks that the output is more-or-less correct: @@ -79,7 +71,7 @@ if not "Linux" in machine.succeed("uname"): raise Exception("Wrong OS") ``` -The first line is actually unnecessary; machines are implicitly started +The first line is technically unnecessary; machines are implicitly started when you first execute an action on them (such as `wait_for_unit` or `succeed`). If you have multiple machines, you can speed up the test by starting them in parallel: @@ -167,34 +159,42 @@ The following methods are available on machine objects: `execute` : Execute a shell command, returning a list `(status, stdout)`. + + Commands are run with `set -euo pipefail` set: + + - If several commands are separated by `;` and one fails, the + command as a whole will fail. + + - For pipelines, the last non-zero exit status will be returned + (if there is one; otherwise zero will be returned). + + - Dereferencing unset variables fails the command. + + - It will wait for stdout to be closed. + If the command detaches, it must close stdout, as `execute` will wait for this to consume all output reliably. This can be achieved by redirecting stdout to stderr `>&2`, to `/dev/console`, `/dev/null` or a file. Examples of detaching commands are `sleep 365d &`, where the shell forks a new process that can write to stdout and `xclip -i`, where the `xclip` command itself forks without closing stdout. + Takes an optional parameter `check_return` that defaults to `True`. Setting this parameter to `False` will not check for the return code and return -1 instead. This can be used for commands that shut down the VM and would therefore break the pipe that would be used for retrieving the return code. + A timeout for the command can be specified (in seconds) using the optional + `timeout` parameter, e.g., `execute(cmd, timeout=10)` or + `execute(cmd, timeout=None)`. The default is 900 seconds. + `succeed` : Execute a shell command, raising an exception if the exit status is - not zero, otherwise returning the standard output. Commands are run - with `set -euo pipefail` set: - - - If several commands are separated by `;` and one fails, the - command as a whole will fail. - - - For pipelines, the last non-zero exit status will be returned - (if there is one, zero will be returned otherwise). - - - Dereferencing unset variables fail the command. - - - It will wait for stdout to be closed. See `execute` for the - implications. + not zero, otherwise returning the standard output. Similar to `execute`, + except that the timeout is `None` by default. See `execute` for details on + command execution. `fail` @@ -204,10 +204,13 @@ The following methods are available on machine objects: `wait_until_succeeds` : Repeat a shell command with 1-second intervals until it succeeds. + Has a default timeout of 900 seconds which can be modified, e.g. + `wait_until_succeeds(cmd, timeout=10)`. See `execute` for details on + command execution. `wait_until_fails` -: Repeat a shell command with 1-second intervals until it fails. +: Like `wait_until_succeeds`, but repeating the command until it fails. `wait_for_unit` @@ -303,7 +306,7 @@ For faster dev cycles it\'s also possible to disable the code-linters ```nix import ./make-test-python.nix { skipLint = true; - machine = + nodes.machine = { config, pkgs, ... }: { configuration… }; @@ -329,9 +332,22 @@ repository): ''; ``` +Similarly, the type checking of test scripts can be disabled in the following +way: + +```nix +import ./make-test-python.nix { + skipTypeCheck = true; + nodes.machine = + { config, pkgs, ... }: + { configuration… + }; +} +``` + ## Failing tests early {#ssec-failing-tests-early} -To fail tests early when certain invariables are no longer met (instead of waiting for the build to time out), the decorator `polling_condition` is provided. For example, if we are testing a program `foo` that should not quit after being started, we might write the following: +To fail tests early when certain invariants are no longer met (instead of waiting for the build to time out), the decorator `polling_condition` is provided. For example, if we are testing a program `foo` that should not quit after being started, we might write the following: ```py @polling_condition @@ -346,7 +362,6 @@ with foo_running: ... # Put `foo` through its paces ``` - `polling_condition` takes the following (optional) arguments: `seconds_interval` @@ -354,26 +369,51 @@ with foo_running: : specifies how often the condition should be polled: - ```py - @polling_condition(seconds_interval=10) - def foo_running(): - machine.succeed("pgrep -x foo") - ``` +```py +@polling_condition(seconds_interval=10) +def foo_running(): + machine.succeed("pgrep -x foo") +``` `description` : is used in the log when the condition is checked. If this is not provided, the description is pulled from the docstring of the function. These two are therefore equivalent: - ```py - @polling_condition - def foo_running(): - "check that foo is running" - machine.succeed("pgrep -x foo") - ``` +```py +@polling_condition +def foo_running(): + "check that foo is running" + machine.succeed("pgrep -x foo") +``` - ```py - @polling_condition(description="check that foo is running") - def foo_running(): - machine.succeed("pgrep -x foo") - ``` +```py +@polling_condition(description="check that foo is running") +def foo_running(): + machine.succeed("pgrep -x foo") +``` + +## Adding Python packages to the test script {#ssec-python-packages-in-test-script} + +When additional Python libraries are required in the test script, they can be +added using the parameter `extraPythonPackages`. For example, you could add +`numpy` like this: + +```nix +import ./make-test-python.nix +{ + extraPythonPackages = p: [ p.numpy ]; + + nodes = { }; + + # Type checking on extra packages doesn't work yet + skipTypeCheck = true; + + testScript = '' + import numpy as np + assert str(np.zeros(4) == "array([0., 0., 0., 0.])") + ''; +} +``` + +In that case, `numpy` is chosen from the generic `python3Packages`. diff --git a/nixpkgs/nixos/doc/manual/from_md/administration/declarative-containers.section.xml b/nixpkgs/nixos/doc/manual/from_md/administration/declarative-containers.section.xml index 7b35520d567b..b8179dca1f8b 100644 --- a/nixpkgs/nixos/doc/manual/from_md/administration/declarative-containers.section.xml +++ b/nixpkgs/nixos/doc/manual/from_md/administration/declarative-containers.section.xml @@ -48,8 +48,8 @@ containers.database = { <literal>configuration.nix</literal> and run <literal>nixos-rebuild switch</literal>. Note that this will not delete the root directory of the container in - <literal>/var/lib/containers</literal>. Containers can be destroyed - using the imperative method: + <literal>/var/lib/nixos-containers</literal>. Containers can be + destroyed using the imperative method: <literal>nixos-container destroy foo</literal>. </para> <para> diff --git a/nixpkgs/nixos/doc/manual/from_md/administration/imperative-containers.section.xml b/nixpkgs/nixos/doc/manual/from_md/administration/imperative-containers.section.xml index 59ecfdee5af0..865fc4689398 100644 --- a/nixpkgs/nixos/doc/manual/from_md/administration/imperative-containers.section.xml +++ b/nixpkgs/nixos/doc/manual/from_md/administration/imperative-containers.section.xml @@ -14,8 +14,9 @@ </programlisting> <para> This creates the container’s root directory in - <literal>/var/lib/containers/foo</literal> and a small configuration - file in <literal>/etc/containers/foo.conf</literal>. It also builds + <literal>/var/lib/nixos-containers/foo</literal> and a small + configuration file in + <literal>/etc/nixos-containers/foo.conf</literal>. It also builds the container’s initial system configuration and stores it in <literal>/nix/var/nix/profiles/per-container/foo/system</literal>. You can modify the initial configuration of the container on the diff --git a/nixpkgs/nixos/doc/manual/from_md/configuration/adding-custom-packages.section.xml b/nixpkgs/nixos/doc/manual/from_md/configuration/adding-custom-packages.section.xml index 4fa40d61966e..07f541666cbe 100644 --- a/nixpkgs/nixos/doc/manual/from_md/configuration/adding-custom-packages.section.xml +++ b/nixpkgs/nixos/doc/manual/from_md/configuration/adding-custom-packages.section.xml @@ -2,40 +2,50 @@ <title>Adding Custom Packages</title> <para> It’s possible that a package you need is not available in NixOS. In - that case, you can do two things. First, you can clone the Nixpkgs - repository, add the package to your clone, and (optionally) submit a - patch or pull request to have it accepted into the main Nixpkgs - repository. This is described in detail in the - <link xlink:href="https://nixos.org/nixpkgs/manual">Nixpkgs - manual</link>. In short, you clone Nixpkgs: + that case, you can do two things. Either you can package it with + Nix, or you can try to use prebuilt packages from upstream. Due to + the peculiarities of NixOS, it is important to note that building + software from source is often easier than using pre-built + executables. </para> - <programlisting> + <section xml:id="sec-custom-packages-nix"> + <title>Building with Nix</title> + <para> + This can be done either in-tree or out-of-tree. For an in-tree + build, you can clone the Nixpkgs repository, add the package to + your clone, and (optionally) submit a patch or pull request to + have it accepted into the main Nixpkgs repository. This is + described in detail in the + <link xlink:href="https://nixos.org/nixpkgs/manual">Nixpkgs + manual</link>. In short, you clone Nixpkgs: + </para> + <programlisting> $ git clone https://github.com/NixOS/nixpkgs $ cd nixpkgs </programlisting> - <para> - Then you write and test the package as described in the Nixpkgs - manual. Finally, you add it to - <xref linkend="opt-environment.systemPackages" />, e.g. - </para> - <programlisting language="bash"> + <para> + Then you write and test the package as described in the Nixpkgs + manual. Finally, you add it to + <xref linkend="opt-environment.systemPackages" />, e.g. + </para> + <programlisting language="bash"> environment.systemPackages = [ pkgs.my-package ]; </programlisting> - <para> - and you run <literal>nixos-rebuild</literal>, specifying your own - Nixpkgs tree: - </para> - <programlisting> + <para> + and you run <literal>nixos-rebuild</literal>, specifying your own + Nixpkgs tree: + </para> + <programlisting> # nixos-rebuild switch -I nixpkgs=/path/to/my/nixpkgs </programlisting> - <para> - The second possibility is to add the package outside of the Nixpkgs - tree. For instance, here is how you specify a build of the - <link xlink:href="https://www.gnu.org/software/hello/">GNU - Hello</link> package directly in - <literal>configuration.nix</literal>: - </para> - <programlisting language="bash"> + <para> + The second possibility is to add the package outside of the + Nixpkgs tree. For instance, here is how you specify a build of the + <link xlink:href="https://www.gnu.org/software/hello/">GNU + Hello</link> package directly in + <literal>configuration.nix</literal>: + </para> + <programlisting language="bash"> environment.systemPackages = let my-hello = with pkgs; stdenv.mkDerivation rec { @@ -48,17 +58,17 @@ environment.systemPackages = in [ my-hello ]; </programlisting> - <para> - Of course, you can also move the definition of - <literal>my-hello</literal> into a separate Nix expression, e.g. - </para> - <programlisting language="bash"> + <para> + Of course, you can also move the definition of + <literal>my-hello</literal> into a separate Nix expression, e.g. + </para> + <programlisting language="bash"> environment.systemPackages = [ (import ./my-hello.nix) ]; </programlisting> - <para> - where <literal>my-hello.nix</literal> contains: - </para> - <programlisting language="bash"> + <para> + where <literal>my-hello.nix</literal> contains: + </para> + <programlisting language="bash"> with import <nixpkgs> {}; # bring all of Nixpkgs into scope stdenv.mkDerivation rec { @@ -69,12 +79,40 @@ stdenv.mkDerivation rec { }; } </programlisting> - <para> - This allows testing the package easily: - </para> - <programlisting> + <para> + This allows testing the package easily: + </para> + <programlisting> $ nix-build my-hello.nix $ ./result/bin/hello Hello, world! </programlisting> + </section> + <section xml:id="sec-custom-packages-prebuilt"> + <title>Using pre-built executables</title> + <para> + Most pre-built executables will not work on NixOS. There are two + notable exceptions: flatpaks and AppImages. For flatpaks see the + <link linkend="module-services-flatpak">dedicated section</link>. + AppImages will not run <quote>as-is</quote> on NixOS. First you + need to install <literal>appimage-run</literal>: add to + <literal>/etc/nixos/configuration.nix</literal> + </para> + <programlisting language="bash"> +environment.systemPackages = [ pkgs.appimage-run ]; +</programlisting> + <para> + Then instead of running the AppImage <quote>as-is</quote>, run + <literal>appimage-run foo.appimage</literal>. + </para> + <para> + To make other pre-built executables work on NixOS, you need to + package them with Nix and special helpers like + <literal>autoPatchelfHook</literal> or + <literal>buildFHSUserEnv</literal>. See the + <link xlink:href="https://nixos.org/nixpkgs/manual">Nixpkgs + manual</link> for details. This is complex and often doing a + source build is easier. + </para> + </section> </section> diff --git a/nixpkgs/nixos/doc/manual/from_md/configuration/gpu-accel.chapter.xml b/nixpkgs/nixos/doc/manual/from_md/configuration/gpu-accel.chapter.xml index 8e780c5dee95..cc559a1933d9 100644 --- a/nixpkgs/nixos/doc/manual/from_md/configuration/gpu-accel.chapter.xml +++ b/nixpkgs/nixos/doc/manual/from_md/configuration/gpu-accel.chapter.xml @@ -194,7 +194,7 @@ environment.variables.VK_ICD_FILENAMES = devices with the <literal>uaccess</literal> tag will be updated automatically when a user logs in through <literal>systemd-logind</literal>. For example, if the user - <emphasis>jane</emphasis> is logged in, the access control list + <emphasis>alice</emphasis> is logged in, the access control list should look as follows: </para> <programlisting> @@ -203,7 +203,7 @@ $ getfacl /dev/dri/card0 # owner: root # group: video user::rw- -user:jane:rw- +user:alice:rw- group::rw- mask::rw- other::--- diff --git a/nixpkgs/nixos/doc/manual/from_md/configuration/xfce.chapter.xml b/nixpkgs/nixos/doc/manual/from_md/configuration/xfce.chapter.xml index f96ef2e8c483..42e70d1d81d3 100644 --- a/nixpkgs/nixos/doc/manual/from_md/configuration/xfce.chapter.xml +++ b/nixpkgs/nixos/doc/manual/from_md/configuration/xfce.chapter.xml @@ -27,13 +27,19 @@ services.picom = { <literal>pkgs.xfce</literal>. </para> <section xml:id="sec-xfce-thunar-plugins"> - <title>Thunar Plugins</title> + <title>Thunar</title> <para> - If you'd like to add extra plugins to Thunar, add them to - <xref linkend="opt-services.xserver.desktopManager.xfce.thunarPlugins" />. - You shouldn't just add them to + Thunar (the Xfce file manager) is automatically enabled when Xfce + is enabled. To enable Thunar without enabling Xfce, use the + configuration option <xref linkend="opt-programs.thunar.enable" /> + instead of simply adding <literal>pkgs.xfce.thunar</literal> to <xref linkend="opt-environment.systemPackages" />. </para> + <para> + If you'd like to add extra plugins to Thunar, add them to + <xref linkend="opt-programs.thunar.plugins" />. You shouldn't just + add them to <xref linkend="opt-environment.systemPackages" />. + </para> </section> <section xml:id="sec-xfce-troubleshooting"> <title>Troubleshooting</title> diff --git a/nixpkgs/nixos/doc/manual/from_md/development/activation-script.section.xml b/nixpkgs/nixos/doc/manual/from_md/development/activation-script.section.xml index 0d9e911216ef..981ebf37e60f 100644 --- a/nixpkgs/nixos/doc/manual/from_md/development/activation-script.section.xml +++ b/nixpkgs/nixos/doc/manual/from_md/development/activation-script.section.xml @@ -73,7 +73,7 @@ system.activationScripts.my-activation-script = { <title>NixOS snippets</title> <para> There are some snippets NixOS enables by default because disabling - them would most likely break you system. This section lists a few + them would most likely break your system. This section lists a few of them and what they do: </para> <itemizedlist spacing="compact"> diff --git a/nixpkgs/nixos/doc/manual/from_md/development/option-declarations.section.xml b/nixpkgs/nixos/doc/manual/from_md/development/option-declarations.section.xml index 0ac5e0eeca2d..d7c7f7716bea 100644 --- a/nixpkgs/nixos/doc/manual/from_md/development/option-declarations.section.xml +++ b/nixpkgs/nixos/doc/manual/from_md/development/option-declarations.section.xml @@ -94,7 +94,17 @@ options = { <listitem> <para> A textual description of the option, in DocBook format, that - will be included in the NixOS manual. + will be included in the NixOS manual. During the migration + process from DocBook to CommonMark the description may also be + written in CommonMark, but has to be wrapped in + <literal>lib.mdDoc</literal> to differentiate it from DocBook. + See the nixpkgs manual for + <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-contributing-markup">the + list of CommonMark extensions</link> supported by NixOS + documentation. + </para> + <para> + New documentation should preferably be written as CommonMark. </para> </listitem> </varlistentry> @@ -183,14 +193,14 @@ lib.mkOption { <programlisting language="bash"> lib.mkPackageOption pkgs "GHC" { default = [ "ghc" ]; - example = "pkgs.haskell.package.ghc921.ghc.withPackages (hkgs: [ hkgs.primes ])"; + example = "pkgs.haskell.packages.ghc924.ghc.withPackages (hkgs: [ hkgs.primes ])"; } # is like lib.mkOption { type = lib.types.package; default = pkgs.ghc; defaultText = lib.literalExpression "pkgs.ghc"; - example = lib.literalExpression "pkgs.haskell.package.ghc921.ghc.withPackages (hkgs: [ hkgs.primes ])"; + example = lib.literalExpression "pkgs.haskell.packages.ghc924.ghc.withPackages (hkgs: [ hkgs.primes ])"; description = "The GHC package to use."; } </programlisting> diff --git a/nixpkgs/nixos/doc/manual/from_md/development/option-types.section.xml b/nixpkgs/nixos/doc/manual/from_md/development/option-types.section.xml index 444729292702..929d5302ed41 100644 --- a/nixpkgs/nixos/doc/manual/from_md/development/option-types.section.xml +++ b/nixpkgs/nixos/doc/manual/from_md/development/option-types.section.xml @@ -427,6 +427,43 @@ </itemizedlist> </listitem> </varlistentry> + <varlistentry> + <term> + <literal>types.deferredModule</literal> + </term> + <listitem> + <para> + Whereas <literal>submodule</literal> represents an option + tree, <literal>deferredModule</literal> represents a module + value, such as a module file or a configuration. + </para> + <para> + It can be set multiple times. + </para> + <para> + Module authors can use its value in + <literal>imports</literal>, in + <literal>submoduleWith</literal><quote>s + <literal>modules</literal> or in + <literal>evalModules</literal></quote> + <literal>modules</literal> parameter, among other places. + </para> + <para> + Note that <literal>imports</literal> must be evaluated + before the module fixpoint. Because of this, deferred + modules can only be imported into <quote>other</quote> + fixpoints, such as submodules. + </para> + <para> + One use case for this type is the type of a + <quote>default</quote> module that allow the user to affect + all submodules in an <literal>attrsOf submodule</literal> at + once. This is more convenient and discoverable than + expecting the module user to type-merge with the + <literal>attrsOf submodule</literal> option. + </para> + </listitem> + </varlistentry> </variablelist> </section> <section xml:id="sec-option-types-composed"> @@ -617,6 +654,12 @@ (<link linkend="ex-submodule-reference">Example: Submodule defined as a reference</link>). </para> + <para> + Note that even if your submodule’s options all have a default + value, you will still need to provide a default value (e.g. an + empty attribute set) if you want to allow users to leave it + undefined. + </para> <anchor xml:id="ex-submodule-direct" /> <para> <emphasis role="strong">Example: Directly defined diff --git a/nixpkgs/nixos/doc/manual/from_md/development/settings-options.section.xml b/nixpkgs/nixos/doc/manual/from_md/development/settings-options.section.xml index 746011a2d075..d26dd96243db 100644 --- a/nixpkgs/nixos/doc/manual/from_md/development/settings-options.section.xml +++ b/nixpkgs/nixos/doc/manual/from_md/development/settings-options.section.xml @@ -55,6 +55,38 @@ <variablelist> <varlistentry> <term> + <literal>pkgs.formats.javaProperties</literal> { + <emphasis><literal>comment</literal></emphasis> ? + <literal>"Generated with Nix"</literal> } + </term> + <listitem> + <para> + A function taking an attribute set with values + </para> + <variablelist> + <varlistentry> + <term> + <literal>comment</literal> + </term> + <listitem> + <para> + A string to put at the start of the file in a comment. + It can have multiple lines. + </para> + </listitem> + </varlistentry> + </variablelist> + <para> + It returns the <literal>type</literal>: + <literal>attrsOf str</literal> and a function + <literal>generate</literal> to build a Java + <literal>.properties</literal> file, taking care of the + correct escaping, etc. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term> <literal>pkgs.formats.json</literal> { } </term> <listitem> diff --git a/nixpkgs/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml b/nixpkgs/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml index 4f856f98f2a2..d6f4f61c0645 100644 --- a/nixpkgs/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml +++ b/nixpkgs/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml @@ -6,15 +6,9 @@ <programlisting language="bash"> import ./make-test-python.nix { - # Either the configuration of a single machine: - machine = - { config, pkgs, ... }: - { configuration… - }; - - # Or a set of machines: + # One or more machines: nodes = - { machine1 = + { machine = { config, pkgs, ... }: { … }; machine2 = { config, pkgs, ... }: { … }; @@ -31,18 +25,18 @@ import ./make-test-python.nix { The attribute <literal>testScript</literal> is a bit of Python code that executes the test (described below). During the test, it will start one or more virtual machines, the configuration of which is - described by the attribute <literal>machine</literal> (if you need - only one machine in your test) or by the attribute - <literal>nodes</literal> (if you need multiple machines). For - instance, - <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix"><literal>login.nix</literal></link> - only needs a single machine to test whether users can log in on the - virtual console, whether device ownership is correctly maintained - when switching between consoles, and so on. On the other hand, - <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nfs/simple.nix"><literal>nfs/simple.nix</literal></link>, - which tests NFS client and server functionality in the Linux kernel - (including whether locks are maintained across server crashes), - requires three machines: a server and two clients. + described by the attribute <literal>nodes</literal>. + </para> + <para> + An example of a single-node test is + <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix"><literal>login.nix</literal></link>. + It only needs a single machine to test whether users can log in on + the virtual console, whether device ownership is correctly + maintained when switching between consoles, and so on. An + interesting multi-node test is + <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nfs/simple.nix"><literal>nfs/simple.nix</literal></link>. + It uses two client nodes to test correct locking across server + crashes. </para> <para> There are a few special NixOS configuration options for test VMs: @@ -94,9 +88,8 @@ import ./make-test-python.nix { various actions, such as starting VMs, executing commands in the VMs, and so on. Each virtual machine is represented as an object stored in the variable <literal>name</literal> if this is also the - identifier of the machine in the declarative config. If you didn't - specify multiple machines using the <literal>nodes</literal> - attribute, it is just <literal>machine</literal>. The following + identifier of the machine in the declarative config. If you + specified a node <literal>nodes.machine</literal>, the following example starts the machine, waits until it has finished booting, then executes a command and checks that the output is more-or-less correct: @@ -108,7 +101,7 @@ if not "Linux" in machine.succeed("uname"): raise Exception("Wrong OS") </programlisting> <para> - The first line is actually unnecessary; machines are implicitly + The first line is technically unnecessary; machines are implicitly started when you first execute an action on them (such as <literal>wait_for_unit</literal> or <literal>succeed</literal>). If you have multiple machines, you can speed up the test by starting @@ -281,35 +274,9 @@ start_all() <listitem> <para> Execute a shell command, returning a list - <literal>(status, stdout)</literal>. If the command - detaches, it must close stdout, as - <literal>execute</literal> will wait for this to consume all - output reliably. This can be achieved by redirecting stdout - to stderr <literal>>&2</literal>, to - <literal>/dev/console</literal>, - <literal>/dev/null</literal> or a file. Examples of - detaching commands are <literal>sleep 365d &</literal>, - where the shell forks a new process that can write to stdout - and <literal>xclip -i</literal>, where the - <literal>xclip</literal> command itself forks without - closing stdout. Takes an optional parameter - <literal>check_return</literal> that defaults to - <literal>True</literal>. Setting this parameter to - <literal>False</literal> will not check for the return code - and return -1 instead. This can be used for commands that - shut down the VM and would therefore break the pipe that - would be used for retrieving the return code. + <literal>(status, stdout)</literal>. </para> - </listitem> - </varlistentry> - <varlistentry> - <term> - <literal>succeed</literal> - </term> - <listitem> <para> - Execute a shell command, raising an exception if the exit - status is not zero, otherwise returning the standard output. Commands are run with <literal>set -euo pipefail</literal> set: </para> @@ -324,22 +291,63 @@ start_all() <listitem> <para> For pipelines, the last non-zero exit status will be - returned (if there is one, zero will be returned - otherwise). + returned (if there is one; otherwise zero will be + returned). </para> </listitem> <listitem> <para> - Dereferencing unset variables fail the command. + Dereferencing unset variables fails the command. </para> </listitem> <listitem> <para> - It will wait for stdout to be closed. See - <literal>execute</literal> for the implications. + It will wait for stdout to be closed. </para> </listitem> </itemizedlist> + <para> + If the command detaches, it must close stdout, as + <literal>execute</literal> will wait for this to consume all + output reliably. This can be achieved by redirecting stdout + to stderr <literal>>&2</literal>, to + <literal>/dev/console</literal>, + <literal>/dev/null</literal> or a file. Examples of + detaching commands are <literal>sleep 365d &</literal>, + where the shell forks a new process that can write to stdout + and <literal>xclip -i</literal>, where the + <literal>xclip</literal> command itself forks without + closing stdout. + </para> + <para> + Takes an optional parameter <literal>check_return</literal> + that defaults to <literal>True</literal>. Setting this + parameter to <literal>False</literal> will not check for the + return code and return -1 instead. This can be used for + commands that shut down the VM and would therefore break the + pipe that would be used for retrieving the return code. + </para> + <para> + A timeout for the command can be specified (in seconds) + using the optional <literal>timeout</literal> parameter, + e.g., <literal>execute(cmd, timeout=10)</literal> or + <literal>execute(cmd, timeout=None)</literal>. The default + is 900 seconds. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <literal>succeed</literal> + </term> + <listitem> + <para> + Execute a shell command, raising an exception if the exit + status is not zero, otherwise returning the standard output. + Similar to <literal>execute</literal>, except that the + timeout is <literal>None</literal> by default. See + <literal>execute</literal> for details on command execution. + </para> </listitem> </varlistentry> <varlistentry> @@ -360,7 +368,10 @@ start_all() <listitem> <para> Repeat a shell command with 1-second intervals until it - succeeds. + succeeds. Has a default timeout of 900 seconds which can be + modified, e.g. + <literal>wait_until_succeeds(cmd, timeout=10)</literal>. See + <literal>execute</literal> for details on command execution. </para> </listitem> </varlistentry> @@ -370,8 +381,8 @@ start_all() </term> <listitem> <para> - Repeat a shell command with 1-second intervals until it - fails. + Like <literal>wait_until_succeeds</literal>, but repeating + the command until it fails. </para> </listitem> </varlistentry> @@ -554,7 +565,7 @@ machine.wait_for_unit("xautolock.service", "x-session-user") <programlisting language="bash"> import ./make-test-python.nix { skipLint = true; - machine = + nodes.machine = { config, pkgs, ... }: { configuration… }; @@ -579,11 +590,24 @@ import ./make-test-python.nix { # fmt: on ''; </programlisting> + <para> + Similarly, the type checking of test scripts can be disabled in + the following way: + </para> + <programlisting language="bash"> +import ./make-test-python.nix { + skipTypeCheck = true; + nodes.machine = + { config, pkgs, ... }: + { configuration… + }; +} +</programlisting> </section> <section xml:id="ssec-failing-tests-early"> <title>Failing tests early</title> <para> - To fail tests early when certain invariables are no longer met + To fail tests early when certain invariants are no longer met (instead of waiting for the build to time out), the decorator <literal>polling_condition</literal> is provided. For example, if we are testing a program <literal>foo</literal> that should not @@ -611,12 +635,10 @@ with foo_running: <para> : specifies how often the condition should be polled: </para> - <programlisting> -```py + <programlisting language="python"> @polling_condition(seconds_interval=10) def foo_running(): machine.succeed("pgrep -x foo") -``` </programlisting> <para> <literal>description</literal> @@ -626,19 +648,45 @@ def foo_running(): provided, the description is pulled from the docstring of the function. These two are therefore equivalent: </para> - <programlisting> -```py + <programlisting language="python"> @polling_condition def foo_running(): "check that foo is running" machine.succeed("pgrep -x foo") -``` - -```py +</programlisting> + <programlisting language="python"> @polling_condition(description="check that foo is running") def foo_running(): machine.succeed("pgrep -x foo") -``` </programlisting> </section> + <section xml:id="ssec-python-packages-in-test-script"> + <title>Adding Python packages to the test script</title> + <para> + When additional Python libraries are required in the test script, + they can be added using the parameter + <literal>extraPythonPackages</literal>. For example, you could add + <literal>numpy</literal> like this: + </para> + <programlisting language="bash"> +import ./make-test-python.nix +{ + extraPythonPackages = p: [ p.numpy ]; + + nodes = { }; + + # Type checking on extra packages doesn't work yet + skipTypeCheck = true; + + testScript = '' + import numpy as np + assert str(np.zeros(4) == "array([0., 0., 0., 0.])") + ''; +} +</programlisting> + <para> + In that case, <literal>numpy</literal> is chosen from the generic + <literal>python3Packages</literal>. + </para> + </section> </section> diff --git a/nixpkgs/nixos/doc/manual/from_md/development/building-nixos.chapter.xml b/nixpkgs/nixos/doc/manual/from_md/installation/building-nixos.chapter.xml index ad9349da0686..ea2d01bebcc2 100644 --- a/nixpkgs/nixos/doc/manual/from_md/development/building-nixos.chapter.xml +++ b/nixpkgs/nixos/doc/manual/from_md/installation/building-nixos.chapter.xml @@ -33,9 +33,14 @@ </para> <section xml:id="sec-building-image-instructions"> <title>Practical Instructions</title> + <para> + To build an ISO image for the channel + <literal>nixos-unstable</literal>: + </para> <programlisting> $ git clone https://github.com/NixOS/nixpkgs.git $ cd nixpkgs/nixos +$ git switch nixos-unstable $ nix-build -A config.system.build.isoImage -I nixos-config=modules/installer/cd-dvd/installation-cd-minimal.nix default.nix </programlisting> <para> @@ -45,6 +50,40 @@ $ nix-build -A config.system.build.isoImage -I nixos-config=modules/installer/cd # mount -o loop -t iso9660 ./result/iso/cd.iso /mnt/iso </programlisting> </section> + <section xml:id="sec-building-image-drivers"> + <title>Additional drivers or firmware</title> + <para> + If you need additional (non-distributable) drivers or firmware in + the installer, you might want to extend these configurations. + </para> + <para> + For example, to build the GNOME graphical installer ISO, but with + support for certain WiFi adapters present in some MacBooks, you + can create the following file at + <literal>modules/installer/cd-dvd/installation-cd-graphical-gnome-macbook.nix</literal>: + </para> + <programlisting language="bash"> +{ config, ... }: + +{ + imports = [ ./installation-cd-graphical-gnome.nix ]; + + boot.initrd.kernelModules = [ "wl" ]; + + boot.kernelModules = [ "kvm-intel" "wl" ]; + boot.extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ]; +} +</programlisting> + <para> + Then build it like in the example above: + </para> + <programlisting> +$ git clone https://github.com/NixOS/nixpkgs.git +$ cd nixpkgs/nixos +$ export NIXPKGS_ALLOW_UNFREE=1 +$ nix-build -A config.system.build.isoImage -I nixos-config=modules/installer/cd-dvd/installation-cd-graphical-gnome-macbook.nix default.nix +</programlisting> + </section> <section xml:id="sec-building-image-tech-notes"> <title>Technical Notes</title> <para> diff --git a/nixpkgs/nixos/doc/manual/from_md/installation/installing-from-other-distro.section.xml b/nixpkgs/nixos/doc/manual/from_md/installation/installing-from-other-distro.section.xml index 525531a47813..024a24379dd6 100644 --- a/nixpkgs/nixos/doc/manual/from_md/installation/installing-from-other-distro.section.xml +++ b/nixpkgs/nixos/doc/manual/from_md/installation/installing-from-other-distro.section.xml @@ -248,7 +248,7 @@ $ nix-env -p /nix/var/nix/profiles/system -f '<nixpkgs/nixos>' -I nixos-co (since your Nix install was probably single user): </para> <programlisting> -$ sudo chown -R 0.0 /nix +$ sudo chown -R 0:0 /nix </programlisting> </listitem> <listitem> diff --git a/nixpkgs/nixos/doc/manual/from_md/installation/installing-kexec.section.xml b/nixpkgs/nixos/doc/manual/from_md/installation/installing-kexec.section.xml new file mode 100644 index 000000000000..46ea0d59b6c3 --- /dev/null +++ b/nixpkgs/nixos/doc/manual/from_md/installation/installing-kexec.section.xml @@ -0,0 +1,94 @@ +<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-booting-via-kexec"> + <title><quote>Booting</quote> into NixOS via kexec</title> + <para> + In some cases, your system might already be booted into/preinstalled + with another Linux distribution, and booting NixOS by attaching an + installation image is quite a manual process. + </para> + <para> + This is particularly useful for (cloud) providers where you can’t + boot a custom image, but get some Debian or Ubuntu installation. + </para> + <para> + In these cases, it might be easier to use <literal>kexec</literal> + to <quote>jump into NixOS</quote> from the running system, which + only assumes <literal>bash</literal> and <literal>kexec</literal> to + be installed on the machine. + </para> + <para> + Note that kexec may not work correctly on some hardware, as devices + are not fully re-initialized in the process. In practice, this + however is rarely the case. + </para> + <para> + To build the necessary files from your current version of nixpkgs, + you can run: + </para> + <programlisting> +nix-build -A kexec.x86_64-linux '<nixpkgs/nixos/release.nix>' +</programlisting> + <para> + This will create a <literal>result</literal> directory containing + the following: + </para> + <itemizedlist spacing="compact"> + <listitem> + <para> + <literal>bzImage</literal> (the Linux kernel) + </para> + </listitem> + <listitem> + <para> + <literal>initrd</literal> (the initrd file) + </para> + </listitem> + <listitem> + <para> + <literal>kexec-boot</literal> (a shellscript invoking + <literal>kexec</literal>) + </para> + </listitem> + </itemizedlist> + <para> + These three files are meant to be copied over to the other already + running Linux Distribution. + </para> + <para> + Note it’s symlinks pointing elsewhere, so <literal>cd</literal> in, + and use <literal>scp * root@$destination</literal> to copy it over, + rather than rsync. + </para> + <para> + Once you finished copying, execute <literal>kexec-boot</literal> + <emphasis>on the destination</emphasis>, and after some seconds, the + machine should be booting into an (ephemeral) NixOS installation + medium. + </para> + <para> + In case you want to describe your own system closure to kexec into, + instead of the default installer image, you can build your own + <literal>configuration.nix</literal>: + </para> + <programlisting language="bash"> +{ modulesPath, ... }: { + imports = [ + (modulesPath + "/installer/netboot/netboot-minimal.nix") + ]; + + services.openssh.enable = true; + users.users.root.openssh.authorizedKeys.keys = [ + "my-ssh-pubkey" + ]; +} +</programlisting> + <programlisting> +nix-build '<nixpkgs/nixos>' \ + --arg configuration ./configuration.nix + --attr config.system.build.kexecTree +</programlisting> + <para> + Make sure your <literal>configuration.nix</literal> does still + import <literal>netboot-minimal.nix</literal> (or + <literal>netboot-base.nix</literal>). + </para> +</section> diff --git a/nixpkgs/nixos/doc/manual/from_md/installation/installing-usb.section.xml b/nixpkgs/nixos/doc/manual/from_md/installation/installing-usb.section.xml index b46a1d565557..df266eb16800 100644 --- a/nixpkgs/nixos/doc/manual/from_md/installation/installing-usb.section.xml +++ b/nixpkgs/nixos/doc/manual/from_md/installation/installing-usb.section.xml @@ -17,7 +17,7 @@ $ diskutil list [..] $ diskutil unmountDisk diskN Unmount of all volumes on diskN was successful -$ sudo dd if=nix.iso of=/dev/rdiskN +$ sudo dd if=nix.iso of=/dev/rdiskN bs=1M </programlisting> <para> Using the 'raw' <literal>rdiskN</literal> device instead of diff --git a/nixpkgs/nixos/doc/manual/from_md/installation/installing.chapter.xml b/nixpkgs/nixos/doc/manual/from_md/installation/installing.chapter.xml index db073fa83965..0112458674b5 100644 --- a/nixpkgs/nixos/doc/manual/from_md/installation/installing.chapter.xml +++ b/nixpkgs/nixos/doc/manual/from_md/installation/installing.chapter.xml @@ -177,17 +177,17 @@ OK the boot partition. </para> <programlisting> -# parted /dev/sda -- mkpart primary 512MiB -8GiB +# parted /dev/sda -- mkpart primary 512MB -8GB </programlisting> </listitem> <listitem> <para> Next, add a <emphasis>swap</emphasis> partition. The size - required will vary according to needs, here a 8GiB one is + required will vary according to needs, here a 8GB one is created. </para> <programlisting> -# parted /dev/sda -- mkpart primary linux-swap -8GiB 100% +# parted /dev/sda -- mkpart primary linux-swap -8GB 100% </programlisting> <note> <para> @@ -204,7 +204,7 @@ OK reserved 512MiB at the start of the disk. </para> <programlisting> -# parted /dev/sda -- mkpart ESP fat32 1MiB 512MiB +# parted /dev/sda -- mkpart ESP fat32 1MB 512MB # parted /dev/sda -- set 3 esp on </programlisting> </listitem> @@ -242,7 +242,7 @@ OK live. </para> <programlisting> -# parted /dev/sda -- mkpart primary 1MiB -8GiB +# parted /dev/sda -- mkpart primary 1MB -8GB </programlisting> </listitem> <listitem> @@ -252,7 +252,7 @@ OK created. </para> <programlisting> -# parted /dev/sda -- mkpart primary linux-swap -8GiB 100% +# parted /dev/sda -- mkpart primary linux-swap -8GB 100% </programlisting> <note> <para> @@ -411,6 +411,13 @@ OK specify on which disk the GRUB boot loader is to be installed. Without it, NixOS cannot boot. </para> + <para> + If there are other operating systems running on the + machine before installing NixOS, the + <xref linkend="opt-boot.loader.grub.useOSProber" /> + option can be set to <literal>true</literal> to + automatically add them to the grub menu. + </para> </listitem> </varlistentry> <varlistentry> @@ -419,7 +426,9 @@ OK </term> <listitem> <para> - You <emphasis>must</emphasis> set the option + You must select a boot-loader, either system-boot or + GRUB. The recommended option is systemd-boot: set the + option <xref linkend="opt-boot.loader.systemd-boot.enable" /> to <literal>true</literal>. <literal>nixos-generate-config</literal> should do this @@ -433,17 +442,27 @@ OK <link linkend="opt-boot.loader.systemd-boot.enable"><literal>boot.loader.systemd-boot</literal></link> as well. </para> + <para> + If you want to use GRUB, set + <xref linkend="opt-boot.loader.grub.device" /> to + <literal>nodev</literal> and + <xref linkend="opt-boot.loader.grub.efiSupport" /> to + <literal>true</literal>. + </para> + <para> + With system-boot, you should not need any special + configuration to detect other installed systems. With + GRUB, set + <xref linkend="opt-boot.loader.grub.useOSProber" /> to + <literal>true</literal>, but this will only detect + windows partitions, not other linux distributions. If + you dual boot another linux distribution, use + system-boot instead. + </para> </listitem> </varlistentry> </variablelist> <para> - If there are other operating systems running on the machine - before installing NixOS, the - <xref linkend="opt-boot.loader.grub.useOSProber" /> option can - be set to <literal>true</literal> to automatically add them to - the grub menu. - </para> - <para> If you need to configure networking for your machine the configuration options are described in <xref linkend="sec-networking" />. In particular, while wifi @@ -638,6 +657,7 @@ $ passwd eelco <title>Additional installation notes</title> <xi:include href="installing-usb.section.xml" /> <xi:include href="installing-pxe.section.xml" /> + <xi:include href="installing-kexec.section.xml" /> <xi:include href="installing-virtualbox-guest.section.xml" /> <xi:include href="installing-from-other-distro.section.xml" /> <xi:include href="installing-behind-a-proxy.section.xml" /> diff --git a/nixpkgs/nixos/doc/manual/from_md/installation/upgrading.chapter.xml b/nixpkgs/nixos/doc/manual/from_md/installation/upgrading.chapter.xml index e3b77d4c3650..11fe1d317ccd 100644 --- a/nixpkgs/nixos/doc/manual/from_md/installation/upgrading.chapter.xml +++ b/nixpkgs/nixos/doc/manual/from_md/installation/upgrading.chapter.xml @@ -12,7 +12,7 @@ <listitem> <para> <emphasis>Stable channels</emphasis>, such as - <link xlink:href="https://nixos.org/channels/nixos-21.11"><literal>nixos-21.11</literal></link>. + <link xlink:href="https://nixos.org/channels/nixos-22.05"><literal>nixos-22.05</literal></link>. These only get conservative bug fixes and package upgrades. For instance, a channel update may cause the Linux kernel on your system to be upgraded from 4.19.34 to 4.19.38 (a minor bug fix), @@ -33,7 +33,7 @@ <listitem> <para> <emphasis>Small channels</emphasis>, such as - <link xlink:href="https://nixos.org/channels/nixos-21.11-small"><literal>nixos-21.11-small</literal></link> + <link xlink:href="https://nixos.org/channels/nixos-22.05-small"><literal>nixos-22.05-small</literal></link> or <link xlink:href="https://nixos.org/channels/nixos-unstable-small"><literal>nixos-unstable-small</literal></link>. These are identical to the stable and unstable channels @@ -60,8 +60,8 @@ <para> When you first install NixOS, you’re automatically subscribed to the NixOS channel that corresponds to your installation source. For - instance, if you installed from a 21.11 ISO, you will be subscribed - to the <literal>nixos-21.11</literal> channel. To see which NixOS + instance, if you installed from a 22.05 ISO, you will be subscribed + to the <literal>nixos-22.05</literal> channel. To see which NixOS channel you’re subscribed to, run the following as root: </para> <programlisting> @@ -76,17 +76,17 @@ nixos https://nixos.org/channels/nixos-unstable </programlisting> <para> (Be sure to include the <literal>nixos</literal> parameter at the - end.) For instance, to use the NixOS 21.11 stable channel: + end.) For instance, to use the NixOS 22.05 stable channel: </para> <programlisting> -# nix-channel --add https://nixos.org/channels/nixos-21.11 nixos +# nix-channel --add https://nixos.org/channels/nixos-22.05 nixos </programlisting> <para> If you have a server, you may want to use the <quote>small</quote> channel instead: </para> <programlisting> -# nix-channel --add https://nixos.org/channels/nixos-21.11-small nixos +# nix-channel --add https://nixos.org/channels/nixos-22.05-small nixos </programlisting> <para> And if you want to live on the bleeding edge: @@ -146,7 +146,7 @@ system.autoUpgrade.allowReboot = true; also specify a channel explicitly, e.g. </para> <programlisting language="bash"> -system.autoUpgrade.channel = https://nixos.org/channels/nixos-21.11; +system.autoUpgrade.channel = https://nixos.org/channels/nixos-22.05; </programlisting> </section> </chapter> diff --git a/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-1803.section.xml b/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-1803.section.xml index f54f6129e0db..910cad467e9d 100644 --- a/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-1803.section.xml +++ b/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-1803.section.xml @@ -866,6 +866,14 @@ package. </para> </listitem> + <listitem> + <para> + The vim/kakoune plugin updater now reads from a CSV file: + check + <literal>pkgs/applications/editors/vim/plugins/vim-plugin-names</literal> + out to see the new format + </para> + </listitem> </itemizedlist> </section> </section> diff --git a/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml index b61a0268dee2..d9ebbe74d54f 100644 --- a/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml +++ b/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml @@ -569,8 +569,9 @@ <listitem> <para> The NixOS VM test framework, - <literal>pkgs.nixosTest</literal>/<literal>make-test-python.nix</literal>, - now requires detaching commands such as + <literal>pkgs.nixosTest</literal>/<literal>make-test-python.nix</literal> + (<literal>pkgs.testers.nixosTest</literal> since 22.05), now + requires detaching commands such as <literal>succeed("foo &")</literal> and <literal>succeed("foo | xclip -i")</literal> to close stdout. This can be done with a redirect such as diff --git a/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml index 0c5b3b4fec76..02201861234b 100644 --- a/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml +++ b/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml @@ -1,9 +1,5 @@ <section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-22.05"> - <title>Release 22.05 (“Quokka”, 2022.05/??)</title> - <para> - In addition to numerous new and upgraded packages, this release has - the following highlights: - </para> + <title>Release 22.05 (“Quokka”, 2022.05/30)</title> <itemizedlist spacing="compact"> <listitem> <para> @@ -14,70 +10,69 @@ </itemizedlist> <section xml:id="sec-release-22.05-highlights"> <title>Highlights</title> + <para> + In addition to numerous new and upgraded packages, this release + has the following highlights: + </para> <itemizedlist> <listitem> +<literallayout>Nix has been updated from 2.3 to 2.8. This mainly brings experimental support for Flakes, but also marks the <literal>nix</literal> command as experimental which now has to be enabled via the configuration explicitly. For more information and instructions for upgrades, see the relase notes for <link xlink:href="https://nixos.org/manual/nix/stable/release-notes/rl-2.4.html">nix-2.4</link>, +<link xlink:href="https://nixos.org/manual/nix/stable/release-notes/rl-2.5.html">nix-2.5</link>, <link xlink:href="https://nixos.org/manual/nix/stable/release-notes/rl-2.6.html">nix-2.6</link>, <link xlink:href="https://nixos.org/manual/nix/stable/release-notes/rl-2.7.html">nix-2.7</link> and <link xlink:href="https://nixos.org/manual/nix/stable/release-notes/rl-2.8.html">nix-2.8</link></literallayout> + </listitem> + <listitem> <para> The <literal>firefox</literal> browser on - <literal>x86_64-linux</literal> is now making use of - profile-guided optimization resulting in a much more + <literal>x86_64-linux</literal> now makes use of + profile-guided optimisation, resulting in a much more responsive browsing experience. </para> </listitem> <listitem> <para> - <literal>security.acme.defaults</literal> has been added to - simplify configuring settings for many certificates at once. - This also opens up the the option to use DNS-01 validation - when using <literal>enableACME</literal> on web server virtual - hosts (e.g. - <literal>services.nginx.virtualHosts.*.enableACME</literal>). + GNOME has been upgraded to 42. Please take a look at their + <link xlink:href="https://release.gnome.org/42/">Release + Notes</link> for details. In particular, it replaces gedit + with GNOME Text Editor, GNOME Terminal with GNOME Console + (formerly King’s Cross) and GNOME Screenshot by a tool + integrated into the Shell. </para> </listitem> <listitem> <para> - GNOME has been upgraded to 42. Please take a look at their - <link xlink:href="https://release.gnome.org/42/">Release - Notes</link> for details. Notably, it replaces gedit with - GNOME Text Editor, GNOME Terminal with GNOME Console (formerly - King’s Cross), and GNOME Screenshot with a tool built into the - Shell. + PHP 8.1 is now available. </para> </listitem> <listitem> <para> - PHP 8.1 is now available + systemd services can now set + <link linkend="opt-systemd.services">systemd.services.<name>.reloadTriggers</link> + instead of <literal>reloadIfChanged</literal> for a more + granular distinction between reloads and restarts. </para> </listitem> <listitem> <para> - Mattermost has been updated to extended support release 6.3, - as the previously packaged extended support release 5.37 is - <link xlink:href="https://docs.mattermost.com/upgrade/extended-support-release.html">reaching - its end of life</link>. Migrations may take a while, see the - <link xlink:href="https://docs.mattermost.com/install/self-managed-changelog.html#release-v6-3-extended-support-release">changelog</link> - and - <link xlink:href="https://docs.mattermost.com/upgrade/important-upgrade-notes.html">important - upgrade notes</link>. + Systemd has been upgraded to the version 250. </para> </listitem> <listitem> <para> - systemd services can now set - <link linkend="opt-systemd.services">systemd.services.<name>.reloadTriggers</link> - instead of <literal>reloadIfChanged</literal> for a more - granular distinction between reloads and restarts. + Pulseaudio has been updated to version 15.0 and now optionally + <link xlink:href="https://www.freedesktop.org/wiki/Software/PulseAudio/Notes/15.0/#supportforldacandaptxbluetoothcodecsplussbcxqsbcwithhigher-qualityparameters">supports + additional Bluetooth audio codecs</link> such as aptX or LDAC, + with codec switching available in + <literal>pavucontrol</literal>. This feature is disabled by + default, but can be enabled with the option + <literal>hardware.pulseaudio.package = pkgs.pulseaudioFull;</literal>. + Existing third-party modules that offered similar functions, + such as <literal>pulseaudio-modules-bt</literal> or + <literal>pulseaudio-hsphfpd</literal>, are obsolete and have + been removed. </para> </listitem> <listitem> <para> - <link xlink:href="https://kops.sigs.k8s.io"><literal>kops</literal></link> - defaults to 1.22.4, which will enable - <link xlink:href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html">Instance - Metadata Service Version 2</link> and require tokens on new - clusters with Kubernetes 1.22. This will increase security by - default, but may break some types of workloads. See the - <link xlink:href="https://kops.sigs.k8s.io/releases/1.22-notes/">release - notes</link> for details. + PostgreSQL now defaults to major version 14. </para> </listitem> <listitem> @@ -88,6 +83,32 @@ and their users. </para> </listitem> + <listitem> + <para> + The default GHC version has been updated from 8.10.7 to 9.0.2. + <literal>pkgs.haskellPackages</literal> and + <literal>pkgs.ghc</literal> will now use this version by + default. + </para> + </listitem> + <listitem> + <para> + The GNOME and Plasma installation CDs now use + <literal>pkgs.calamares</literal> and + <literal>pkgs.calamares-nixos-extensions</literal> to allow + users to easily install and set up NixOS with a GUI. + </para> + </listitem> + <listitem> + <para> + <literal>security.acme.defaults</literal> has been added to + simplify the configuration of settings for many certificates + at once. This also opens up the option to use DNS-01 + validation when using <literal>enableACME</literal> web server + virtual hosts (e.g. + <literal>services.nginx.virtualHosts.*.enableACME</literal>). + </para> + </listitem> </itemizedlist> </section> <section xml:id="sec-release-22.05-new-services"> @@ -95,6 +116,16 @@ <itemizedlist> <listitem> <para> + <link xlink:href="https://1password.com/">1password</link>, + command-lines and graphic interface for 1Password. Available + as + <link linkend="opt-programs._1password.enable">programs._1password</link> + and + <link linkend="opt-programs._1password.enable">programs._1password-gui</link>. + </para> + </listitem> + <listitem> + <para> <link xlink:href="https://github.com/intel/linux-sgx#install-the-intelr-sgx-psw">aesmd</link>, the Intel SGX Architectural Enclave Service Manager. Available as @@ -103,32 +134,109 @@ </listitem> <listitem> <para> - <link xlink:href="https://docs.docker.com/engine/security/rootless/">rootless - Docker</link>, a <literal>systemd --user</literal> Docker - service which runs without root permissions. Available as - <link xlink:href="options.html#opt-virtualisation.docker.rootless.enable">virtualisation.docker.rootless.enable</link>. + <link xlink:href="https://github.com/mbrubeck/agate">agate</link>, + a very simple server for the Gemini hypertext protocol. + Available as + <link linkend="opt-services.agate.enable">services.agate</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://conduit.rs/">matrix-conduit</link>, - a simple, fast and reliable chat server powered by matrix. - Available as - <link xlink:href="option.html#opt-services.matrix-conduit.enable">services.matrix-conduit</link>. + <link xlink:href="https://github.com/linux-apfs/linux-apfs-rw">apfs</link>, + a kernel module for mounting the Apple File System (APFS). </para> </listitem> <listitem> <para> - <link xlink:href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html">filebeat</link>, - a lightweight shipper for forwarding and centralizing log - data. Available as - <link linkend="opt-services.filebeat.enable">services.filebeat</link>. + <link xlink:href="https://gitlab.com/DarkElvenAngel/argononed">argonone</link>, + a replacement daemon for the Raspberry Pi Argon One power + button and cooler. Available at + <link xlink:href="options.html#opt-services.hardware.argonone.enable">services.hardware.argonone</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://github.com/linux-apfs/linux-apfs-rw">apfs</link>, - a kernel module for mounting the Apple File System (APFS). + <link xlink:href="https://github.com/JustArchiNET/ArchiSteamFarm">ArchiSteamFarm</link>, + a C# application with primary purpose of idling Steam cards + from multiple accounts simultaneously. Available as + <link linkend="opt-services.archisteamfarm.enable">services.archisteamfarm</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://loic-sharma.github.io/BaGet/">BaGet</link>, + a lightweight NuGet and symbol server. Available at + <link linkend="opt-services.baget.enable">services.baget</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/xddxdd/bird-lg-go">bird-lg</link>, + a BGP looking glass for Bird Routing. Available as + <link linkend="opt-services.bird-lg.package">services.bird-lg</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://0xerr0r.github.io/blocky/">blocky</link>, + fast and lightweight DNS proxy as ad-blocker for local network + with many features. Available as + <link linkend="opt-services.blocky.enable">services.blocky</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/kissgyorgy/cloudflare-dyndns">cloudflare-dyndns</link>, + CloudFlare Dynamic DNS client. Available as + <link linkend="opt-services.cloudflare-dyndns.enable">services.cloudflare-dyndns</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://corosync.github.io/corosync/">Corosync</link> + and + <link xlink:href="https://clusterlabs.org/pacemaker/">Pacemaker</link>, + A open-source high availability resource manager. Available as + <link linkend="opt-services.corosync.enable">services.corosync</link> + and + <link linkend="opt-services.pacemaker.enable">services.pacemaker</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/lakinduakash/linux-wifi-hotspot">create_ap</link>, + a module for creating wifi hotspots using the program + linux-wifi-hotspot. Available as + <link linkend="opt-services.create_ap.enable">services.create_ap</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://www.envoyproxy.io/">Envoy</link>, a + high-performance reverse proxy. Available as + <link linkend="opt-services.envoy.enable">services.envoy</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://ergo.chat">ergochat</link>, a modern + IRC with IRCv3 features. Available as + <link linkend="opt-services.ergochat.enable">services.ergochat</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/audreyt/ethercalc">ethercalc</link>, + an online collaborative spreadsheet. Available as + <link linkend="opt-services.ethercalc.enable">services.ethercalc</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html">filebeat</link>, + a lightweight shipper for forwarding and centralizing log + data. Available as + <link linkend="opt-services.filebeat.enable">services.filebeat</link>. </para> </listitem> <listitem> @@ -136,42 +244,46 @@ <link xlink:href="https://frrouting.org/">FRRouting</link>, a popular suite of Internet routing protocol daemons (BGP, BFD, OSPF, IS-IS, VRRP and others). Available as - <link linkend="opt-services.frr.babel.enable">services.frr</link> + <link linkend="opt-services.frr.babel.enable">services.frr</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://github.com/hifi/heisenbridge">heisenbridge</link>, - a bouncer-style Matrix IRC bridge. Available as - <link xlink:href="options.html#opt-services.heisenbridge.enable">services.heisenbridge</link>. + <link xlink:href="https://grafana.com/oss/mimir/">Grafana + Mimir</link>, an open source, horizontally scalable, highly + available, multi-tenant, long-term storage for Prometheus. + Available as + <link linkend="opt-services.mimir.enable">services.mimir</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://snowflake.torproject.org/">snowflake-proxy</link>, - a system to defeat internet censorship. Available as - <link xlink:href="options.html#opt-services.snowflake-proxy.enable">services.snowflake-proxy</link>. + <link xlink:href="https://hastebin.com/about.md">Haste</link>, + a pastebin written in node.js. Available as + <link linkend="opt-services.haste-server.enable">services.haste</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://ergo.chat">ergochat</link>, a modern - IRC with IRCv3 features. Available as - <link xlink:href="options.html#opt-services.ergochat.enable">services.ergochat</link>. + <link xlink:href="https://github.com/juanfont/headscale">headscale</link>, + an Open Source implementation of the + <link xlink:href="https://tailscale.io">Tailscale</link> + Control Server. Available as + <link linkend="opt-services.headscale.enable">services.headscale</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://github.com/ngoduykhanh/PowerDNS-Admin">PowerDNS-Admin</link>, - a web interface for the PowerDNS server. Available at - <link xlink:href="options.html#opt-services.powerdns-admin.enable">services.powerdns-admin</link>. + <link xlink:href="https://github.com/hifi/heisenbridge">heisenbridge</link>, + a bouncer-style Matrix IRC bridge. Available as + <link linkend="opt-services.heisenbridge.enable">services.heisenbridge</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://github.com/postgres/pgadmin4">pgadmin4</link>, - an admin interface for the PostgreSQL database. Available at - <link xlink:href="options.html#opt-services.pgadmin.enable">services.pgadmin</link>. + <link xlink:href="https://github.com/aarond10/https_dns_proxy">https-dns-proxy</link>, + DNS to DNS over HTTPS (DoH) proxy. Available as + <link linkend="opt-services.https-dns-proxy.enable">services.https-dns-proxy</link>. </para> </listitem> <listitem> @@ -179,7 +291,7 @@ <link xlink:href="https://github.com/sezanzeb/input-remapper">input-remapper</link>, an easy to use tool to change the mapping of your input device buttons. Available at - <link xlink:href="options.html#opt-services.input-remapper.enable">services.input-remapper</link>. + <link linkend="opt-services.input-remapper.enable">services.input-remapper</link>. </para> </listitem> <listitem> @@ -187,30 +299,125 @@ <link xlink:href="https://invoiceplane.com">InvoicePlane</link>, web application for managing and creating invoices. Available at - <link xlink:href="options.html#opt-services.invoiceplane.enable">services.invoiceplane</link>. + <link linkend="opt-services.invoiceplane.sites._name_.enable">services.invoiceplane</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://maddy.email">maddy</link>, a - composable all-in-one mail server. Available as - <link xlink:href="options.html#opt-services.maddy.enable">services.maddy</link>. + <link xlink:href="https://userbase.kde.org/K3b">k3b</link>, + the KDE disk burning application. Available as + <link linkend="opt-programs.k3b.enable">programs.k3b</link>. </para> </listitem> <listitem> <para> <link xlink:href="https://www.scorchworks.com/K40whisperer/k40whisperer.html">K40-Whisperer</link>, a program to control cheap Chinese laser cutters. Available as - <link xlink:href="options.html#opt-programs.k4-whisperer.enable">programs.k40-whisperer.enable</link>. + <link linkend="opt-programs.k40-whisperer.enable">programs.k40-whisperer.enable</link>. Users must add themselves to the <literal>k40</literal> group to be able to access the device. </para> </listitem> <listitem> <para> + <link xlink:href="https://kanidm.github.io/kanidm/stable/">kanidm</link>, + an identity management server written in Rust. Available as + <link linkend="opt-services.kanidm.enableServer">services.kanidm</link> + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://maddy.email/">Maddy</link>, a free + an open source mail server. Availabe as + <link linkend="opt-services.maddy.enable">services.maddy</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://conduit.rs/">matrix-conduit</link>, + a simple, fast and reliable chat server powered by matrix. + Available as + <link xlink:href="option.html#opt-services.matrix-conduit.enable">services.matrix-conduit</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://moosefs.com">Moosefs</link>, fault + tolerant petabyte distributed file system. Available as + <link linkend="opt-services.moosefs.master.enable">moosefs</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/mozilla-mobile/mozilla-vpn-client">mozillavpn</link>, + the client for the + <link xlink:href="https://vpn.mozilla.org/">Mozilla VPN</link> + service. Available as + <link linkend="opt-services.mozillavpn.enable">services.mozillavpn</link>. + </para> + </listitem> + <listitem> + <para> <link xlink:href="https://github.com/mgumz/mtr-exporter">mtr-exporter</link>, a Prometheus exporter for mtr metrics. Available as - <link xlink:href="options.html#opt-services.mtr-exporter.enable">services.mtr-exporter</link>. + <link linkend="opt-services.mtr-exporter.enable">services.mtr-exporter</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://nbd.sourceforge.io/">nbd</link>, a + Network Block Device server. Available as + <link linkend="opt-services.nbd.server.enable">services.nbd</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/netbox-community/netbox">netbox</link>, + infrastructure resource modeling (IRM) tool. Available as + <link linkend="opt-services.netbox.enable">services.netbox</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/vvilhonen/nethoscope">nethoscope</link>, + listen to your network traffic. Available as + <link linkend="opt-programs.nethoscope.enable">programs.nethoscope</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://nifi.apache.org">nifi</link>, an + easy to use, powerful, and reliable system to process and + distribute data. Available as + <link linkend="opt-services.nifi.enable">services.nifi</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/Mic92/nix-ld">nix-ld</link>, + Run unpatched dynamic binaries on NixOS. Available as + <link linkend="opt-programs.nix-ld.enable">programs.nix-ld</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="http://www.nncpgo.org">NNCP</link>, NNCP + (Node to Node copy) utilities and configuration, Available as + <link linkend="opt-programs.nncp.enable">programs.nncp</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/postgres/pgadmin4">pgadmin4</link>, + an admin interface for the PostgreSQL database. Available at + <link linkend="opt-services.pgadmin.enable">services.pgadmin</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/ngoduykhanh/PowerDNS-Admin">PowerDNS-Admin</link>, + a web interface for the PowerDNS server. Available at + <link linkend="opt-services.powerdns-admin.enable">services.powerdns-admin</link>. </para> </listitem> <listitem> @@ -218,61 +425,92 @@ <link xlink:href="https://github.com/prometheus-pve/prometheus-pve-exporter">prometheus-pve-exporter</link>, a tool that exposes information from the Proxmox VE API for use by Prometheus. Available as - <link xlink:href="options.html#opt-services.prometheus.exporters.pve">services.prometheus.exporters.pve</link>. + <link linkend="opt-services.prometheus.exporters.pve.enable">services.prometheus.exporters.pve</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://tetrd.app">tetrd</link>, share your - internet connection from your device to your PC and vice versa - through a USB cable. Available at - <link linkend="opt-services.tetrd.enable">services.tetrd</link>. + <link xlink:href="https://github.com/ThomasLeister/prosody-filer">prosody-filer</link>, + a server for handling XMPP HTTP Upload requests. Available at + <link linkend="opt-services.prosody-filer.enable">services.prosody-filer</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://github.com/mbrubeck/agate">agate</link>, - a very simple server for the Gemini hypertext protocol. + <link xlink:href="https://public-inbox.org">Public + Inbox</link>, an <quote>archives first</quote> approach to + mailing lists. Available as + <link linkend="opt-services.public-inbox.enable">services.public-inbox</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/fleaz/r53-ddns">r53-ddns</link>, + a small tool to run your own DDNS service via AWS Route53. Available as - <link xlink:href="options.html#opt-services.agate.enable">services.agate</link>. + <link linkend="opt-services.r53-ddns.enable">services.r53-ddns</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://github.com/JustArchiNET/ArchiSteamFarm">ArchiSteamFarm</link>, - a C# application with primary purpose of idling Steam cards - from multiple accounts simultaneously. Available as - <link xlink:href="options.html#opt-services.archisteamfarm.enable">services.archisteamfarm</link>. + <link xlink:href="https://ddvk.github.io/rmfakecloud/">rmfakecloud</link>, + a clone of the cloud sync the remarkable tablet. Available as + <link linkend="opt-services.rmfakecloud.enable">services.rmfakecloud</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://goteleport.com">teleport</link>, - allows engineers and security professionals to unify access - for SSH servers, Kubernetes clusters, web applications, and - databases across all environments. Available at - <link linkend="opt-services.teleport.enable">services.teleport</link>. + <link xlink:href="https://docs.docker.com/engine/security/rootless/">rootless + Docker</link>, a <literal>systemd --user</literal> Docker + service which runs without root permissions. Available as + <link linkend="opt-virtualisation.docker.rootless.enable">virtualisation.docker.rootless.enable</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://loic-sharma.github.io/BaGet/">BaGet</link>, - a lightweight NuGet and symbol server. Available at - <link linkend="opt-services.baget.enable">services.baget</link>. + <link xlink:href="https://www.rstudio.com/products/rstudio/#rstudio-server">rstudio-server</link>, + a browser-based version of the RStudio IDE for the R + programming language. Available as + <link linkend="opt-services.rstudio-server.enable">services.rstudio-server</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://moosefs.com">moosefs</link>, fault - tolerant petabyte distributed file system. Available as - <link linkend="opt-services.moosefs.client.enable">moosefs</link>. + <link xlink:href="https://github.com/aler9/rtsp-simple-server">rtsp-simple-server</link>, + ready-to-use RTSP / RTMP / HLS server and proxy that allows to + read, publish and proxy video and audio streams. Available as + <link linkend="opt-services.rtsp-simple-server.enable">services.rtsp-simple-server</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://github.com/ThomasLeister/prosody-filer">prosody-filer</link>, - a server for handling XMPP HTTP Upload requests. Available at - <link linkend="opt-services.prosody-filer.enable">services.prosody-filer</link>. + <link xlink:href="https://snipeitapp.com">Snipe-IT</link>, a + free open source IT asset/license management system. Available + as + <link linkend="opt-services.snipe-it.enable">services.snipe-it</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://snowflake.torproject.org/">snowflake-proxy</link>, + a system to defeat internet censorship. Available as + <link linkend="opt-services.snowflake-proxy.enable">services.snowflake-proxy</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://sslmate.com/">sslmate-agent</link>, + a daemon for managing SSL/TLS certificates on a server. + Available as + <link xlink:href="services.sslmate-agent.enable">services.sslmate-agent</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://starship.rs">starship</link>, a + minimal, blazing-fast, and infinitely customizable prompt for + any shell. Available at + <link linkend="opt-programs.starship.enable">programs.startship</link>. </para> </listitem> <listitem> @@ -288,61 +526,56 @@ </listitem> <listitem> <para> - <link xlink:href="https://github.com/audreyt/ethercalc">ethercalc</link>, - an online collaborative spreadsheet. Available as - <link xlink:href="options.html#opt-services.ethercalc.enable">services.ethercalc</link>. - </para> - </listitem> - <listitem> - <para> - <link xlink:href="https://nbd.sourceforge.io/">nbd</link>, a - Network Block Device server. Available as - <link xlink:href="options.html#opt-services.nbd.server.enable">services.nbd</link>. + <link xlink:href="https://goteleport.com">teleport</link>, + allows engineers and security professionals to unify access + for SSH servers, Kubernetes clusters, web applications, and + databases across all environments. Available at + <link linkend="opt-services.teleport.enable">services.teleport</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://github.com/Mic92/nix-ld">nix-ld</link>, - Run unpatched dynamic binaries on NixOS. Available as - <link xlink:href="options.html#opt-programs.nix-ld.enable">programs.nix-ld</link>. + <link xlink:href="https://tetrd.app">tetrd</link>, share your + internet connection from your device to your PC and vice versa + through a USB cable. Available at + <link linkend="opt-services.tetrd.enable">services.tetrd</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://timetagger.app">timetagger</link>, - an open source time-tracker with an intuitive user experience - and powerful reporting. - <link xlink:href="options.html#opt-services.timetagger.enable">services.timetagger</link>. + <link xlink:href="https://upterm.dev">uptermd</link>, an + open-source solution for sharing terminal sessions instantly + over the public internet via secure tunnels. Available at + <link linkend="opt-services.uptermd.enable">services.uptermd</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://www.rstudio.com/products/rstudio/#rstudio-server">rstudio-server</link>, - a browser-based version of the RStudio IDE for the R - programming language. Available as - <link xlink:href="options.html#opt-services.rstudio-server.enable">services.rstudio-server</link>. + <link xlink:href="https://github.com/darrylb123/usbrelay">usbrelayd</link>, + an USB Relay MQTT daemon. Available as + <link linkend="opt-services.usbrelayd.enable">services.usbrelayd</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://github.com/juanfont/headscale">headscale</link>, - an Open Source implementation of the - <link xlink:href="https://tailscale.io">Tailscale</link> - Control Server. Available as - <link xlink:href="options.html#opt-services.headscale.enable">services.headscale</link> + <link xlink:href="https://github.com/miquels/webdav-server-rs">webdav-server-rs</link>, + Webdav server in rust. Available as + <link linkend="opt-services.webdav-server-rs.enable">services.webdav-server-rs</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://0xerr0r.github.io/blocky/">blocky</link>, - fast and lightweight DNS proxy as ad-blocker for local network - with many features. + <link xlink:href="https://github.com/gin66/wg_netmanager">wg-netmanager</link>, + the Wireguard network manager. Available as + <link linkend="opt-services.wg-netmanager.enable">services.wg-netmanager</link>. </para> </listitem> <listitem> <para> - <link xlink:href="https://clusterlabs.org/pacemaker/">pacemaker</link> - cluster resource manager + <link xlink:href="https://zammad.org/">Zammad</link>, a + web-based, open source user support/ticketing solution. + Available as + <link linkend="opt-services.zammad.enable">services.zammad</link>. </para> </listitem> </itemizedlist> @@ -386,6 +619,15 @@ </listitem> <listitem> <para> + The update of the haskell package set brings with it a new + version of the <literal>xmonad</literal> module, which will + break your configuration if you use <literal>launch</literal> + as entrypoint. The example code the corresponding nixos module + was adjusted, you may want to have a look at it. + </para> + </listitem> + <listitem> + <para> The <literal>home-assistant</literal> module now requires users that don’t want their configuration to be managed declaratively to set @@ -414,6 +656,94 @@ </listitem> <listitem> <para> + The configuration and state directories used by + <literal>nixos-containers</literal> have been moved from + <literal>/etc/containers</literal> and + <literal>/var/lib/containers</literal> to + <literal>/etc/nixos-containers</literal> and + <literal>/var/lib/nixos-containers</literal>. + </para> + <para> + If you are changing <literal>system.stateVersion</literal> to + <literal>"22.05"</literal> manually on an existing + system you are responsible for migrating these directories + yourself. + </para> + <para> + This is to improve compatibility with + <literal>libcontainer</literal> based software such as Podman + and Skopeo which assumes they have ownership over + <literal>/etc/containers</literal>. + </para> + </listitem> + <listitem> + <para> + <literal>lib.systems.supported</literal> has been removed, as + it was overengineered for determining the systems to support + in the nixpkgs flake. The list of systems exposed by the + nixpkgs flake can now be accessed as + <literal>lib.systems.flakeExposed</literal>. + </para> + </listitem> + <listitem> + <para> + For new installations + <literal>virtualisation.oci-containers.backend</literal> is + now set to <literal>podman</literal> by default. If you still + want to use Docker on systems where + <literal>system.stateVersion</literal> is set to to + <literal>"22.05"</literal> set + <literal>virtualisation.oci-containers.backend = "docker";</literal>.Old + systems with older <literal>stateVersion</literal>s stay with + <quote>docker</quote>. + </para> + </listitem> + <listitem> + <para> + <literal>security.klogd</literal> was removed. Logging of + kernel messages is handled by systemd since Linux 3.5. + </para> + </listitem> + <listitem> + <para> + <literal>pkgs.ssmtp</literal> has been dropped due to the + program being unmaintained. <literal>pkgs.msmtp</literal> can + be used instead as a substitute <literal>sendmail</literal> + implementation. The corresponding options + <literal>services.ssmtp.*</literal> have been removed as well. + <literal>programs.msmtp.*</literal> can be used instead for an + equivalent setup. For example: + </para> + <programlisting language="bash"> +{ + # Original ssmtp configuration: + services.ssmtp = { + enable = true; + useTLS = true; + useSTARTTLS = true; + hostName = "smtp.example:587"; + authUser = "someone"; + authPassFile = "/secrets/password.txt"; + }; + + # Equivalent msmtp configuration: + programs.msmtp = { + enable = true; + accounts.default = { + tls = true; + tls_starttls = true; + auth = true; + host = "smtp.example"; + port = 587; + user = "someone"; + passwordeval = "cat /secrets/password.txt"; + }; + }; +} +</programlisting> + </listitem> + <listitem> + <para> <literal>services.kubernetes.addons.dashboard</literal> was removed due to it being an outdated version. </para> @@ -431,6 +761,72 @@ </listitem> <listitem> <para> + In the PowerDNS Recursor module + (<literal>services.pdns-recursor</literal>), default values of + several IP address-related NixOS options have been updated to + match the default upstream behavior. In particular, Recursor + by default will: + </para> + <itemizedlist spacing="compact"> + <listitem> + <para> + listen on (and allows connections from) both IPv4 and IPv6 + addresses + (<literal>services.pdns-recursor.dns.address</literal>, + <literal>services.pdns-recursor.dns.allowFrom</literal>); + </para> + </listitem> + <listitem> + <para> + allow only local connections to the REST API server + (<literal>services.pdns-recursor.api.allowFrom</literal>). + </para> + </listitem> + </itemizedlist> + </listitem> + <listitem> + <para> + In the ncdns module, the default value of + <literal>services.ncdns.address</literal> has been changed to + the IPv6 loopback address (<literal>::1</literal>). + </para> + </listitem> + <listitem> + <para> + <literal>openldap</literal> (and therefore the slapd LDAP + server) were updated to version 2.6.2. The project introduced + backwards-incompatible changes, namely the removal of the bdb, + hdb, ndb, and shell backends in slapd. Therefore before + updating, dump your database <literal>slapcat -n 1</literal> + in LDIF format, and reimport it after updating your + <literal>services.openldap.settings</literal>, which + represents your <literal>cn=config</literal>. + </para> + <para> + Additionally with 2.5 the argon2 module was included in the + standard distrubtion and renamed from + <literal>pw-argon2</literal> to <literal>argon2</literal>. + Remember to update your <literal>olcModuleLoad</literal> entry + in <literal>cn=config</literal>. + </para> + </listitem> + <listitem> + <para> + <literal>openssh</literal> has been update to 8.9p1, changing + the FIDO security key middleware interface. + </para> + </listitem> + <listitem> + <para> + <literal>git</literal> no longer hardcodes the path to + openssh’ ssh binary to reduce the amount of rebuilds. If you + are using git with ssh remotes and do not have a ssh binary in + your enviroment consider adding <literal>openssh</literal> to + it or switching to <literal>gitFull</literal>. + </para> + </listitem> + <listitem> + <para> <literal>services.k3s.enable</literal> no longer implies <literal>systemd.enableUnifiedCgroupHierarchy = false</literal>, and will default to the <quote>systemd</quote> cgroup driver @@ -463,6 +859,13 @@ </listitem> <listitem> <para> + <literal>services.prometheus.alertManagerTimeout</literal> has + been removed as it has been deprecated upstream and has no + effect. + </para> + </listitem> + <listitem> + <para> The DHCP server (<literal>services.dhcpd4</literal>, <literal>services.dhcpd6</literal>) has been hardened. The service is now using the systemd’s @@ -496,6 +899,24 @@ </listitem> <listitem> <para> + <literal>hbase</literal> version 0.98.24 has been removed. The + package now defaults to version 2.4.11. Versions 1.7.1 and + 3.0.0-alpha-2 are also available. + </para> + </listitem> + <listitem> + <para> + <literal>services.paperless-ng</literal> was renamed to + <literal>services.paperless</literal>. Accordingly, the + <literal>paperless-ng-manage</literal> script (located in + <literal>dataDir</literal>) was renamed to + <literal>paperless-manage</literal>. + <literal>services.paperless</literal> now uses + <literal>paperless-ngx</literal>. + </para> + </listitem> + <listitem> + <para> The <literal>matrix-synapse</literal> service (<literal>services.matrix-synapse</literal>) has been converted to use the <literal>settings</literal> option @@ -593,7 +1014,7 @@ }; extraConfigFiles = [ - /run/keys/matrix-synapse/secrets.yaml + "/run/keys/matrix-synapse/secrets.yaml" ]; }; } @@ -601,7 +1022,9 @@ <para> The secrets in your original config should be migrated into a YAML file that is included via - <literal>extraConfigFiles</literal>. + <literal>extraConfigFiles</literal>. The filename must be + quoted to prevent nix from copying it to the (world readable) + store. </para> <para> Additionally a few option defaults have been synced up with @@ -616,6 +1039,136 @@ to the new location if the <literal>stateVersion</literal> is updated. </para> + <para> + As of Synapse 1.58.0, the old groups/communities feature has + been disabled by default. It will be completely removed with + Synapse 1.61.0. + </para> + </listitem> + <listitem> + <para> + The Keycloak package (<literal>pkgs.keycloak</literal>) has + been switched from the Wildfly version, which will soon be + deprecated, to the Quarkus based version. The Keycloak service + (<literal>services.keycloak</literal>) has been updated to + accommodate the change and now differs from the previous + version in a few ways: + </para> + <itemizedlist> + <listitem> + <para> + <literal>services.keycloak.extraConfig</literal> has been + removed in favor of the new + <link xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">settings-style</link> + <link linkend="opt-services.keycloak.settings"><literal>services.keycloak.settings</literal></link> + option. The available options correspond directly to + parameters in <literal>conf/keycloak.conf</literal>. Some + of the most important parameters are documented as + suboptions, the rest can be found in the + <link xlink:href="https://www.keycloak.org/server/all-config">All + configuration section of the Keycloak Server Installation + and Configuration Guide</link>. While the new + configuration is much simpler and cleaner than the old + JBoss CLI one, this unfortunately mean that there’s no + straightforward way to convert an old configuration to the + new format and some settings may not even be available + anymore. + </para> + </listitem> + <listitem> + <para> + <literal>services.keycloak.frontendUrl</literal> was + removed and the frontend URL is now configured through the + <literal>hostname</literal> family of settings in + <link linkend="opt-services.keycloak.settings"><literal>services.keycloak.settings</literal></link> + instead. See the + <link xlink:href="https://www.keycloak.org/server/hostname">Hostname + section of the Keycloak Server Installation and + Configuration Guide</link> for more details. Additionally, + <literal>/auth</literal> was removed from the default + context path and needs to be added back in + <link linkend="opt-services.keycloak.settings.http-relative-path"><literal>services.keycloak.settings.http-relative-path</literal></link> + if you want to keep compatibility with your current + clients. + </para> + </listitem> + <listitem> + <para> + <literal>services.keycloak.bindAddress</literal>, + <literal>services.keycloak.forceBackendUrlToFrontendUrl</literal>, + <literal>services.keycloak.httpPort</literal> and + <literal>services.keycloak.httpsPort</literal> have been + removed in favor of their equivalent options in + <link linkend="opt-services.keycloak.settings"><literal>services.keycloak.settings</literal></link>. + <literal>httpPort</literal> and + <literal>httpsPort</literal> have additionally had their + types changed from <literal>str</literal> to + <literal>port</literal>. + </para> + <para> + The new names are as follows: + </para> + <itemizedlist spacing="compact"> + <listitem> + <para> + <literal>bindAddress</literal>: + <link linkend="opt-services.keycloak.settings.http-host"><literal>services.keycloak.settings.http-host</literal></link> + </para> + </listitem> + <listitem> + <para> + <literal>forceBackendUrlToFrontendUrl</literal>: + <link linkend="opt-services.keycloak.settings.hostname-strict-backchannel"><literal>services.keycloak.settings.hostname-strict-backchannel</literal></link> + </para> + </listitem> + <listitem> + <para> + <literal>httpPort</literal>: + <link linkend="opt-services.keycloak.settings.http-port"><literal>services.keycloak.settings.http-port</literal></link> + </para> + </listitem> + <listitem> + <para> + <literal>httpsPort</literal>: + <link linkend="opt-services.keycloak.settings.https-port"><literal>services.keycloak.settings.https-port</literal></link> + </para> + </listitem> + </itemizedlist> + </listitem> + </itemizedlist> + <para> + For example, when using a reverse proxy the migration could + look like this: + </para> + <para> + Before: + </para> + <programlisting language="bash"> + services.keycloak = { + enable = true; + httpPort = "8080"; + frontendUrl = "https://keycloak.example.com/auth"; + database.passwordFile = "/run/keys/db_password"; + extraConfig = { + "subsystem=undertow"."server=default-server"."http-listener=default".proxy-address-forwarding = true; + }; + }; +</programlisting> + <para> + After: + </para> + <programlisting language="bash"> + services.keycloak = { + enable = true; + settings = { + http-port = 8080; + hostname = "keycloak.example.com"; + http-relative-path = "/auth"; + proxy = "edge"; + }; + database.passwordFile = "/run/keys/db_password"; + }; +</programlisting> </listitem> <listitem> <para> @@ -753,6 +1306,14 @@ </listitem> <listitem> <para> + The <literal>taskserver</literal> module no longer implicitly + opens ports in the firewall configuration. This is now + controlled through the option + <literal>services.taskserver.openFirewall</literal>. + </para> + </listitem> + <listitem> + <para> The <literal>autorestic</literal> package has been upgraded from 1.3.0 to 1.5.0 which introduces breaking changes in config file, check @@ -762,6 +1323,16 @@ </listitem> <listitem> <para> + <literal>teleport</literal> has been upgraded to major version + 9. Please see upstream + <link xlink:href="https://goteleport.com/docs/setup/operations/upgrading/">upgrade + instructions</link> and + <link xlink:href="https://goteleport.com/docs/changelog/#900">release + notes</link>. + </para> + </listitem> + <listitem> + <para> For <literal>pkgs.python3.pkgs.ipython</literal>, its direct dependency <literal>pkgs.python3.pkgs.matplotlib-inline</literal> (which @@ -955,6 +1526,14 @@ </listitem> <listitem> <para> + <literal>systemd-shutdown</literal> is now properly linked on + shutdown to unmount all filesystems and device mapper devices + cleanly. This can be disabled using + <literal>systemd.shutdownRamfs.enable</literal>. + </para> + </listitem> + <listitem> + <para> The Tor SOCKS proxy is now actually disabled if <literal>services.tor.client.enable</literal> is set to <literal>false</literal> (the default). If you are using this @@ -965,6 +1544,15 @@ </listitem> <listitem> <para> + <literal>services.github-runner</literal> has been hardened. + Notably address families and system calls have been + restricted, which may adversely affect some kinds of testing, + e.g. using <literal>AF_BLUETOOTH</literal> to test bluetooth + devices. + </para> + </listitem> + <listitem> + <para> The terraform 0.12 compatibility has been removed and the <literal>terraform.withPlugins</literal> and <literal>terraform-providers.mkProvider</literal> @@ -1009,9 +1597,29 @@ </listitem> <listitem> <para> + <literal>services.zookeeper</literal> has a new option + <literal>jre</literal> for specifying the JRE to start + zookeeper with. It defaults to the JRE that + <literal>pkgs.zookeeper</literal> was wrapped with, instead of + <literal>pkgs.jre</literal>. This changes the JRE to + <literal>pkgs.jdk11_headless</literal> by default. + </para> + </listitem> + <listitem> + <para> <literal>pkgs.pgadmin</literal> now refers to - <literal>pkgs.pgadmin4</literal>. If you still need pgadmin3, - use <literal>pkgs.pgadmin3</literal>. + <literal>pkgs.pgadmin4</literal>. <literal>pgadmin3</literal> + has been removed. + </para> + </listitem> + <listitem> + <para> + <literal>pkgs.minetestclient_4</literal> and + <literal>pkgs.minetestserver_4</literal> have been removed, as + the last 4.x release was in 2018. + <literal>pkgs.minetestclient</literal> (equivalent to + <literal>pkgs.minetest</literal> ) and + <literal>pkgs.minetestserver</literal> can be used instead. </para> </listitem> <listitem> @@ -1170,6 +1778,19 @@ </listitem> <listitem> <para> + The default version of <literal>nextcloud</literal> is + <emphasis role="strong">nextcloud24</emphasis>. Please note + that it’s <emphasis role="strong">not</emphasis> possible to + upgrade <literal>nextcloud</literal> across multiple major + versions! This means it’s e.g. not possible to upgrade from + <literal>nextcloud22</literal> to + <literal>nextcloud24</literal> in a single deploy and most + <literal>21.11</literal> users will have to upgrade to + <literal>nextcloud23</literal> first. + </para> + </listitem> + <listitem> + <para> <literal>pkgs.vimPlugins.onedark-nvim</literal> now refers to <link xlink:href="https://github.com/navarasu/onedark.nvim">navarasu/onedark.nvim</link> (formerly refers to @@ -1253,6 +1874,51 @@ example. </para> </listitem> + <listitem> + <para> + Existing <literal>resholve*</literal> functions have been + renamed and nested under <literal>pkgs.resholve</literal>. + Update uses to: + </para> + <itemizedlist spacing="compact"> + <listitem> + <para> + <literal>resholvePackage</literal> -> + <literal>resholve.mkDerivation</literal> + </para> + </listitem> + <listitem> + <para> + <literal>resholveScript</literal> -> + <literal>resholve.writeScript</literal> + </para> + </listitem> + <listitem> + <para> + <literal>resholveScriptBin</literal> -> + <literal>resholve.writeScriptBin</literal> + </para> + </listitem> + </itemizedlist> + </listitem> + <listitem> + <para> + <literal>pkgs.cosmopolitan</literal> no longer provides the + <literal>cosmoc</literal> command. It has been moved to + <literal>pkgs.cosmoc</literal>. + </para> + </listitem> + <listitem> + <para> + <literal>pkgs.graalvmXX-ce</literal> packages no longer + provide support for Python/Ruby/WASM, instead focusing only in + Java and Native Image Support. If you need to add support + back, please see the + <literal>pkgs.graalvmCEPackages.mkGraal</literal> function to + create your own customized version of GraalVM with support for + what you need. + </para> + </listitem> </itemizedlist> </section> <section xml:id="sec-release-22.05-notable-changes"> @@ -1331,6 +1997,43 @@ </listitem> <listitem> <para> + <link xlink:href="https://kops.sigs.k8s.io"><literal>kops</literal></link> + defaults to 1.23.2, which will enable + <link xlink:href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html">Instance + Metadata Service Version 2</link> and require tokens on new + clusters with Kubernetes >= 1.22. This will increase + security by default, but may break some types of workloads. + The default behaviour for + <literal>spec.kubeDNS.nodeLocalDNS.forwardToKubeDNS</literal> + has changed from <literal>true</literal> to + <literal>false</literal>. Cilium now has + <literal>disable-cnp-status-updates: true</literal> by + default. Set this to false if you rely on the + CiliumNetworkPolicy status fields. Support for Kubernetes + 1.17, the Lyft CNI, Weave CNI on Kubernetes >= 1.23, CentOS + 7 and 8, Debian 9, RHEL 7, and Ubuntu 16.05 (Xenial) has been + removed. See the + <link xlink:href="https://kops.sigs.k8s.io/releases/1.22-notes/">1.22 + release notes</link> and + <link xlink:href="https://kops.sigs.k8s.io/releases/1.23-notes/">1.23 + release notes</link> for more details, including other + significant changes. + </para> + </listitem> + <listitem> + <para> + Mattermost has been upgraded to extended support version 6.3 + as the previously packaged extended support version 5.37 is + <link xlink:href="https://docs.mattermost.com/upgrade/extended-support-release.html">reaching + end of life</link>. Migration may take some time, see the + <link xlink:href="https://docs.mattermost.com/install/self-managed-changelog.html#release-v6-3-extended-support-release">changelog</link> + and + <link xlink:href="https://docs.mattermost.com/upgrade/important-upgrade-notes.html">important + upgrade notes</link>. + </para> + </listitem> + <listitem> + <para> The <literal>writers.writePyPy2</literal>/<literal>writers.writePyPy3</literal> and corresponding @@ -1368,6 +2071,74 @@ </listitem> <listitem> <para> + The auto-upgrade service now accepts persistent (default: + true) parameter. By default auto-upgrade will now run + immediately if it would have been triggered at least once + during the time when the timer was inactive. + </para> + </listitem> + <listitem> + <para> + Mastodon now uses <literal>services.redis.servers</literal> to + start a new redis server, instead of using a global redis + server. This improves compatibility with other services that + use redis. + </para> + <para> + Note that this will recreate the redis database, although + according to the + <link xlink:href="https://docs.joinmastodon.org/admin/backups/">Mastodon + docs</link>, this is almost harmless: + </para> + <blockquote> + <para> + Losing the Redis database is almost harmless: The only + irrecoverable data will be the contents of the Sidekiq + queues and scheduled retries of previously failed jobs. The + home and list feeds are stored in Redis, but can be + regenerated with tootctl. + </para> + </blockquote> + <para> + If you do want to save the redis database, you can use the + following commands: + </para> + <programlisting language="bash"> +redis-cli save +cp /var/lib/redis/dump.rdb "/var/lib/redis-mastodon/dump.rdb" +</programlisting> + </listitem> + <listitem> + <para> + Peertube now uses services.redis.servers to start a new redis + server, instead of using a global redis server. This improves + compatibility with other services that use redis. + </para> + <para> + Redis database is used for storage only cache and job queue. + More information can be found here - + <link xlink:href="https://docs.joinpeertube.org/contribute-architecture">Peertube + architecture</link>. + </para> + <para> + If you do want to save the redis database, you can use the + following commands before upgrade OS: + </para> + <programlisting language="bash"> +redis-cli save +sudo mkdir /var/lib/redis-peertube +sudo cp /var/lib/redis/dump.rdb /var/lib/redis-peertube/dump.rdb +</programlisting> + </listitem> + <listitem> + <para> + Added the <literal>keter</literal> NixOS module. Keter reverse + proxies requests to your loaded application based on virtual + hostnames. + </para> + </listitem> + <listitem> + <para> If you are using Wayland you can choose to use the Ozone Wayland support in Chrome and several Electron apps by setting the environment variable <literal>NIXOS_OZONE_WL=1</literal> @@ -1381,6 +2152,35 @@ </listitem> <listitem> <para> + A new option group + <literal>systemd.network.wait-online</literal> was added, with + options to configure + <literal>systemd-networkd-wait-online.service</literal>: + </para> + <itemizedlist spacing="compact"> + <listitem> + <para> + <literal>anyInterface</literal> allows specifying that the + network should be considered online when <emphasis>at + least one</emphasis> interface is online (useful on + laptops) + </para> + </listitem> + <listitem> + <para> + <literal>timeout</literal> defines how long to wait for + the network to come online + </para> + </listitem> + <listitem> + <para> + <literal>extraArgs</literal> for everything else + </para> + </listitem> + </itemizedlist> + </listitem> + <listitem> + <para> The <literal>influxdb2</literal> package was split into <literal>influxdb2-server</literal> and <literal>influxdb2-cli</literal>, matching the split that took @@ -1405,6 +2205,15 @@ </listitem> <listitem> <para> + The <literal>asterisk</literal> and + <literal>asterisk-stable</literal> packages were switched from + <literal>asterisk_18</literal> to the newly-packaged + <literal>asterisk_19</literal>. Asterisk 13 and 17 have been + removed as they have reached their end of life. + </para> + </listitem> + <listitem> + <para> The <literal>services.unifi.openPorts</literal> option default value of <literal>true</literal> is now deprecated and will be changed to <literal>false</literal> in 22.11. Configurations @@ -1461,9 +2270,11 @@ <para> <link linkend="opt-programs.ssh.knownHosts">programs.ssh.knownHosts</link> has gained an <literal>extraHostNames</literal> option to - replace <literal>hostNames</literal>. - <literal>hostNames</literal> is deprecated, but still - available for now. + augment <literal>hostNames</literal>. It is now possible to + use the attribute name of a <literal>knownHosts</literal> + entry as the primary host name and specify secondary host + names using <literal>extraHostNames</literal> without having + to duplicate the primary host name. </para> </listitem> <listitem> @@ -1476,6 +2287,29 @@ </listitem> <listitem> <para> + The option + <link linkend="opt-services.xserver.desktopManager.runXdgAutostartIfNone">services.xserver.desktopManager.runXdgAutostartIfNone</link> + was added in order to automatically run XDG autostart files + for sessions without a desktop manager. This replaces helpers + like the <literal>dex</literal> package. + </para> + </listitem> + <listitem> + <para> + When setting + <link linkend="opt-i18n.inputMethod.enabled">i18n.inputMethod.enabled</link> + to <literal>fcitx5</literal>, it no longer creates + corresponding systemd user services. It now relies on XDG + autostart files to start and work properly in your desktop + sessions. If you are using only a window manager without a + desktop manager, you need to enable + <literal>services.xserver.desktopManager.runXdgAutostartIfNone</literal> + or using the <literal>dex</literal> package to make + <literal>fcitx5</literal> work. + </para> + </listitem> + <listitem> + <para> The option <literal>services.duplicati.dataDir</literal> has been added to allow changing the location of duplicati’s files. @@ -1498,12 +2332,53 @@ </listitem> <listitem> <para> - ORY Kratos was updated to version 0.8.3-alpha.1.pre.0, which + ORY Kratos was updated to version 0.9.0-alpha.3, which introduces some breaking changes: </para> <itemizedlist spacing="compact"> <listitem> <para> + All endpoints at the Admin API are now exposed at + <literal>/admin/</literal>. For example, endpoint + <literal>https://kratos:4434/identities</literal> is now + exposed at + <literal>https://kratos:4434/admin/identities</literal> + </para> + </listitem> + <listitem> + <para> + Configuration key + <literal>selfservice.whitelisted_return_urls</literal> has + been renamed to <literal>allowed_return_urls</literal> + </para> + </listitem> + <listitem> + <para> + The <literal>password_identifier</literal> form field of + the password login strategy has been renamed to + <literal>identifier</literal> to make compatibility with + passwordless flows possible. + </para> + </listitem> + <listitem> + <para> + Instead of having a global + <literal>default_schema_url</literal> which developers + used to update their schema, you now need to define the + <literal>default_schema_id</literal> which must reference + schema ID in your config. + </para> + </listitem> + <listitem> + <para> + Calling <literal>/self-service/recovery</literal> without + flow ID or with an invalid flow ID while authenticated + will now respond with an error instead of redirecting to + the default page. + </para> + </listitem> + <listitem> + <para> If you are relying on the SQLite images, update your Docker Pull commands as follows: </para> @@ -1538,6 +2413,18 @@ Notes for v0.8.2-alpha-1</link> </para> </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/ory/kratos/releases/tag/v0.9.0-alpha.1">Release + Notes for v0.9.0-alpha-1</link> + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/ory/kratos/releases/tag/v0.9.0-alpha.3">Release + Notes for v0.9.0-alpha-3</link> + </para> + </listitem> </itemizedlist> </listitem> </itemizedlist> @@ -1553,6 +2440,13 @@ </listitem> <listitem> <para> + A module for declarative configuration of openconnect VPN + profiles was added under + <literal>networking.openconnect</literal>. + </para> + </listitem> + <listitem> + <para> The <literal>element-desktop</literal> package now has an <literal>useKeytar</literal> option (defaults to <literal>true</literal>), which allows disabling @@ -1611,15 +2505,6 @@ </listitem> <listitem> <para> - A new module was added for the - <link xlink:href="https://starship.rs/">Starship</link> shell - prompt, providing the options - <literal>programs.starship.enable</literal> and - <literal>programs.starship.settings</literal>. - </para> - </listitem> - <listitem> - <para> The <link xlink:href="https://dino.im">Dino</link> XMPP client was updated to 0.3, adding support for audio and video calls. </para> @@ -1633,9 +2518,43 @@ </listitem> <listitem> <para> - <literal>services.logrotate.enable</literal> now defaults to - true if any rotate path has been defined, and some paths have - been added by default. + <link linkend="opt-services.logrotate.enable">services.logrotate.enable</link> + now defaults to true if any rotate path has been defined, and + some paths have been added by default. + </para> + </listitem> + <listitem> + <para> + The logrotate module also has been updated to freeform syntax: + <link linkend="opt-services.logrotate.paths">services.logrotate.paths</link> + and + <link linkend="opt-services.logrotate.extraConfig">services.logrotate.extraConfig</link> + will work, but issue deprecation warnings and + <link linkend="opt-services.logrotate.settings">services.logrotate.settings</link> + should now be used instead. + </para> + </listitem> + <listitem> + <para> + <literal>security.pam.ussh</literal> has been added, which + allows authorizing PAM sessions based on SSH + <emphasis>certificates</emphasis> held within an SSH agent, + using + <link xlink:href="https://github.com/uber/pam-ussh">pam-ussh</link>. + </para> + </listitem> + <listitem> + <para> + The <literal>vscode-extensions.ionide.ionide-fsharp</literal> + package has been updated to 6.0.0 and now requires .NET 6.0. + </para> + </listitem> + <listitem> + <para> + The <literal>phpPackages.box</literal> package has been + updated from 2.7.5 to 3.16.0. See the + <link xlink:href="https://github.com/box-project/box/blob/master/UPGRADE.md#from-27-to-30">upgrade + guide</link> for more details. </para> </listitem> <listitem> @@ -1665,6 +2584,24 @@ </listitem> <listitem> <para> + The <literal>polybar</literal> package has been updated from + 3.5.7 to 3.6.2. See + <link xlink:href="https://github.com/polybar/polybar/releases/tag/3.6.0">the + changelog</link> for more details. + </para> + <itemizedlist spacing="compact"> + <listitem> + <para> + Breaking changes include changes to escaping rules in + configuration values, changes in behavior when + encountering invalid tag names, and changes to + inter-process-messaging (IPC). + </para> + </listitem> + </itemizedlist> + </listitem> + <listitem> + <para> Renamed option <literal>services.openssh.challengeResponseAuthentication</literal> to @@ -1720,6 +2657,35 @@ </listitem> <listitem> <para> + <literal>mercury</literal> was updated to 22.01.1, which has + some breaking changes + (<link xlink:href="https://dl.mercurylang.org/release/release-notes-22.01.html">Mercury + 22.01 news</link>). + </para> + </listitem> + <listitem> + <para> + xfsprogs was update to version 5.15, which enables inobtcount + and bigtime by default on filesystem creation. Support for + these features was added in kernel 5.10 and deemed stable in + kernel 5.15. If you want to be able to mount XFS filesystems + created with this release of xfsprogs on kernel releases older + than 5.10, you need to format them with + <literal>mkfs.xfs -m bigtime=0 -m inobtcount=0</literal>. + </para> + </listitem> + <listitem> + <para> + <literal>services.xserver.desktopManager.xfce</literal> now + includes Xfce’s screen locker, + <literal>xfce4-screensaver</literal> that is enabled by + default. You can disable it by setting + <literal>false</literal> to + <link linkend="opt-services.xserver.desktopManager.xfce.enableScreensaver">services.xserver.desktopManager.xfce.enableScreensaver</link>. + </para> + </listitem> + <listitem> + <para> The <literal>hadoop</literal> package has added support for <literal>aarch64-linux</literal> and <literal>aarch64-darwin</literal> as of 3.3.1 @@ -1735,6 +2701,42 @@ </listitem> <listitem> <para> + The <literal>nss</literal> package was split into + <literal>nss_esr</literal> and <literal>nss_latest</literal>, + with <literal>nss</literal> being an alias for + <literal>nss_esr</literal>. This was done to ease maintenance + of <literal>nss</literal> and dependent high-profile packages + like <literal>firefox</literal>. + </para> + </listitem> + <listitem> + <para> + The default <literal>scribus</literal> version is now 1.5, + while version 1.4 is still available as + <literal>scribus_1_4</literal> + (<link xlink:href="https://github.com/NixOS/nixpkgs/pull/172700">#172700</link>). + </para> + </listitem> + <listitem> + <para> + The Nextcloud module now supports to create a Mysql database + automatically with + <literal>services.nextcloud.database.createLocally</literal> + enabled. + </para> + </listitem> + <listitem> + <para> + The Nextcloud module now allows setting the value of the + <literal>max-age</literal> directive of the + <literal>Strict-Transport-Security</literal> HTTP header, + which is now controlled by the + <literal>services.nextcloud.https</literal> option, rather + than <literal>services.nginx.recommendedHttpHeaders</literal>. + </para> + </listitem> + <listitem> + <para> The <literal>spark3</literal> package has been updated from 3.1.2 to 3.2.1 (<link xlink:href="https://github.com/NixOS/nixpkgs/pull/160075">#160075</link>): @@ -1760,8 +2762,66 @@ </listitem> <listitem> <para> - The <literal>programs.nncp</literal> options were added for - generating host-global NNCP configuration. + The option <literal>services.snapserver.openFirewall</literal> + will no longer default to <literal>true</literal> starting + with NixOS 22.11. Enable it explicitly if you need to control + Snapserver remotely or connect streamig clients from other + hosts. + </para> + </listitem> + <listitem> + <para> + The option + <link xlink:href="options.html#opt-networking.useDHCP">networking.useDHCP</link> + isn’t deprecated anymore. When using + <link xlink:href="options.html#opt-networking.useNetworkd"><literal>systemd-networkd</literal></link>, + a generic <literal>.network</literal>-unit is added which + enables DHCP for each interface matching + <literal>en*</literal>, <literal>eth*</literal> or + <literal>wl*</literal> with priority 99 (which means that it + doesn’t have any effect if such an interface is matched by a + <literal>.network-</literal>unit with a lower priority). In + case of scripted networking, no behavior was changed. + </para> + </listitem> + <listitem> + <para> + The new + <link xlink:href="https://nixos.org/manual/nixpkgs/stable/#sec-postgresqlTestHook"><literal>postgresqlTestHook</literal></link> + runs a PostgreSQL server for the duration of package checks. + </para> + </listitem> + <listitem> + <para> + <literal>zfs</literal> was updated from 2.1.4 to 2.1.5, + enabling it to be used with Linux kernel 5.18. + </para> + </listitem> + <listitem> + <para> + <literal>stdenv.mkDerivation</literal> now supports a + self-referencing <literal>finalAttrs:</literal> parameter + containing the final <literal>mkDerivation</literal> arguments + including overrides. <literal>drv.overrideAttrs</literal> now + supports two parameters + <literal>finalAttrs: previousAttrs:</literal>. This allows + packaging configuration to be overridden in a consistent + manner by providing an alternative to + <literal>rec {}</literal> syntax. + </para> + <para> + Additionally, <literal>passthru</literal> can now reference + <literal>finalAttrs.finalPackage</literal> containing the + final package, including attributes such as the output paths + and <literal>overrideAttrs</literal>. + </para> + <para> + New language integrations can be simplified by overriding a + <quote>prototype</quote> package containing the + language-specific logic. This removes the need for a extra + layer of overriding for the <quote>generic builder</quote> + arguments, thus removing a usability problem and source of + error. </para> </listitem> </itemizedlist> diff --git a/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml new file mode 100644 index 000000000000..e8cd84783e4c --- /dev/null +++ b/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml @@ -0,0 +1,505 @@ +<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-22.11"> + <title>Release 22.11 (“Raccoon”, 2022.11/??)</title> + <para> + Support is planned until the end of June 2023, handing over to + 23.05. + </para> + <section xml:id="sec-release-22.11-highlights"> + <title>Highlights</title> + <para> + In addition to numerous new and upgraded packages, this release + has the following highlights: + </para> + <itemizedlist> + <listitem> + <para> + During cross-compilation, tests are now executed if the test + suite can be executed by the build platform. This is the case + when doing “native” cross-compilation where the build and host + platforms are largely the same, but the nixpkgs’ cross + compilation infrastructure is used, e.g. + <literal>pkgsStatic</literal> and <literal>pkgsLLVM</literal>. + Another possibility is that the build platform is a superset + of the host platform, e.g. when cross-compiling from + <literal>x86_64-unknown-linux</literal> to + <literal>i686-unknown-linux</literal>. The predicate gating + test suite execution is the newly added + <literal>canExecute</literal> predicate: You can e.g. check if + <literal>stdenv.buildPlatform</literal> can execute binaries + built for <literal>stdenv.hostPlatform</literal> (i.e. + produced by <literal>stdenv.cc</literal>) by evaluating + <literal>stdenv.buildPlatform.canExecute stdenv.hostPlatform</literal>. + </para> + </listitem> + <listitem> + <para> + The <literal>nixpkgs.hostPlatform</literal> and + <literal>nixpkgs.buildPlatform</literal> options have been + added. These cover and override the + <literal>nixpkgs.{system,localSystem,crossSystem}</literal> + options. + </para> + <itemizedlist spacing="compact"> + <listitem> + <para> + <literal>hostPlatform</literal> is the platform or + <quote><literal>system</literal></quote> string of the + NixOS system described by the configuration. + </para> + </listitem> + <listitem> + <para> + <literal>buildPlatform</literal> is the platform that is + responsible for building the NixOS configuration. It + defaults to the <literal>hostPlatform</literal>, for a + non-cross build configuration. To cross compile, set + <literal>buildPlatform</literal> to a different value. + </para> + </listitem> + </itemizedlist> + <para> + The new options convey the same information, but with fewer + options, and following the Nixpkgs terminology. + </para> + <para> + The existing options + <literal>nixpkgs.{system,localSystem,crossSystem}</literal> + have not been formally deprecated, to allow for evaluation of + the change and to allow for a transition period so that in + time the ecosystem can switch without breaking compatibility + with any supported NixOS release. + </para> + </listitem> + <listitem> + <para> + <literal>nixos-generate-config</literal> now generates + configurations that can be built in pure mode. This is + achieved by setting the new + <literal>nixpkgs.hostPlatform</literal> option. + </para> + <para> + You may have to unset the <literal>system</literal> parameter + in <literal>lib.nixosSystem</literal>, or similarly remove + definitions of the + <literal>nixpkgs.{system,localSystem,crossSystem}</literal> + options. + </para> + <para> + Alternatively, you can remove the + <literal>hostPlatform</literal> line and use NixOS like you + would in NixOS 22.05 and earlier. + </para> + </listitem> + <listitem> + <para> + PHP now defaults to PHP 8.1, updated from 8.0. + </para> + </listitem> + <listitem> + <para> + Cinnamon has been updated to 5.4. + </para> + </listitem> + <listitem> + <para> + <literal>hardware.nvidia</literal> has a new option + <literal>open</literal> that can be used to opt in the + opensource version of NVIDIA kernel driver. Note that the + driver’s support for GeForce and Workstation GPUs is still + alpha quality, see + <link xlink:href="https://developer.nvidia.com/blog/nvidia-releases-open-source-gpu-kernel-modules/">NVIDIA + Releases Open-Source GPU Kernel Modules</link> for the + official announcement. + </para> + </listitem> + </itemizedlist> + </section> + <section xml:id="sec-release-22.11-new-services"> + <title>New Services</title> + <itemizedlist> + <listitem> + <para> + <link xlink:href="https://github.com/jollheef/appvm">appvm</link>, + Nix based app VMs. Available as + <link xlink:href="options.html#opt-virtualisation.appvm.enable">virtualisation.appvm</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/mozilla-services/syncstorage-rs">syncstorage-rs</link>, + a self-hostable sync server for Firefox. Available as + <link xlink:href="options.html#opt-services.firefox-syncserver.enable">services.firefox-syncserver</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://dragonflydb.io/">dragonflydb</link>, + a modern replacement for Redis and Memcached. Available as + <link linkend="opt-services.dragonflydb.enable">services.dragonflydb</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://komga.org/">Komga</link>, a free and + open source comics/mangas media server. Available as + <link linkend="opt-services.komga.enable">services.komga</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://hbase.apache.org/">HBase + cluster</link>, a distributed, scalable, big data store. + Available as + <link xlink:href="options.html#opt-services.hadoop.hbase.enable">services.hadoop.hbase</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/leetronics/infnoise">infnoise</link>, + a hardware True Random Number Generator dongle. Available as + <link xlink:href="options.html#opt-services.infnoise.enable">services.infnoise</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/jtroo/kanata">kanata</link>, + a tool to improve keyboard comfort and usability with advanced + customization. Available as + <link xlink:href="options.html#opt-services.kanata.enable">services.kanata</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/aiberia/persistent-evdev">persistent-evdev</link>, + a daemon to add virtual proxy devices that mirror a physical + input device but persist even if the underlying hardware is + hot-plugged. Available as + <link linkend="opt-services.persistent-evdev.enable">services.persistent-evdev</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://schleuder.org/">schleuder</link>, a + mailing list manager with PGP support. Enable using + <link linkend="opt-services.schleuder.enable">services.schleuder</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://www.expressvpn.com">expressvpn</link>, + the CLI client for ExpressVPN. Available as + <link linkend="opt-services.expressvpn.enable">services.expressvpn</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://www.grafana.com/oss/tempo/">Grafana + Tempo</link>, a distributed tracing store. Available as + <link linkend="opt-services.tempo.enable">services.tempo</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/zalando/patroni">Patroni</link>, + a template for PostgreSQL HA with ZooKeeper, etcd or Consul. + Available as + <link xlink:href="options.html#opt-services.patroni.enable">services.patroni</link>. + </para> + </listitem> + </itemizedlist> + </section> + <section xml:id="sec-release-22.11-incompatibilities"> + <title>Backward Incompatibilities</title> + <itemizedlist> + <listitem> + <para> + The <literal>isCompatible</literal> predicate checking CPU + compatibility is no longer exposed by the platform sets + generated using <literal>lib.systems.elaborate</literal>. In + most cases you will want to use the new + <literal>canExecute</literal> predicate instead which also + considers the kernel / syscall interface. It is briefly + described in the release’s + <link linkend="sec-release-22.11-highlights">highlights + section</link>. + <literal>lib.systems.parse.isCompatible</literal> still + exists, but has changed semantically: Architectures with + differing endianness modes are <emphasis>no longer considered + compatible</emphasis>. + </para> + </listitem> + <listitem> + <para> + <literal>ngrok</literal> has been upgraded from 2.3.40 to + 3.0.4. Please see + <link xlink:href="https://ngrok.com/docs/guides/upgrade-v2-v3">the + upgrade guide</link> and + <link xlink:href="https://ngrok.com/docs/ngrok-agent/changelog">changelog</link>. + Notably, breaking changes are that the config file format has + changed and support for single hypen arguments was dropped. + </para> + </listitem> + <listitem> + <para> + <literal>i18n.supportedLocales</literal> is now by default + only generated with the locales set in + <literal>i18n.defaultLocale</literal> and + <literal>i18n.extraLocaleSettings</literal>. This got + partially copied over from the minimal profile and reduces the + final system size by up to 200MB. If you require all locales + installed set the option to + <literal>[ "all" ]</literal>. + </para> + </listitem> + <listitem> + <para> + The <literal>isPowerPC</literal> predicate, found on + <literal>platform</literal> attrsets + (<literal>hostPlatform</literal>, + <literal>buildPlatform</literal>, + <literal>targetPlatform</literal>, etc) has been removed in + order to reduce confusion. The predicate was was defined such + that it matches only the 32-bit big-endian members of the + POWER/PowerPC family, despite having a name which would imply + a broader set of systems. If you were using this predicate, + you can replace <literal>foo.isPowerPC</literal> with + <literal>(with foo; isPower && is32bit && isBigEndian)</literal>. + </para> + </listitem> + <listitem> + <para> + The <literal>fetchgit</literal> fetcher now uses + <link xlink:href="https://www.git-scm.com/docs/git-sparse-checkout/2.37.0#_internalscone_mode_handling">cone + mode</link> by default for sparse checkouts. + <link xlink:href="https://www.git-scm.com/docs/git-sparse-checkout/2.37.0#_internalsnon_cone_problems">Non-cone + mode</link> can be enabled by passing + <literal>nonConeMode = true</literal>, but note that non-cone + mode is deprecated and this option may be removed alongside a + future Git update without notice. + </para> + </listitem> + <listitem> + <para> + <literal>bsp-layout</literal> no longer uses the command + <literal>cycle</literal> to switch to other window layouts, as + it got replaced by the commands <literal>previous</literal> + and <literal>next</literal>. + </para> + </listitem> + <listitem> + <para> + The Barco ClickShare driver/client package + <literal>pkgs.clickshare-csc1</literal> and the option + <literal>programs.clickshare-csc1.enable</literal> have been + removed, as it requires <literal>qt4</literal>, which reached + its end-of-life 2015 and will no longer be supported by + nixpkgs. + <link xlink:href="https://www.barco.com/de/support/knowledge-base/4380-can-i-use-linux-os-with-clickshare-base-units">According + to Barco</link> many of their base unit models can be used + with Google Chrome and the Google Cast extension. + </para> + </listitem> + <listitem> + <para> + <literal>services.hbase</literal> has been renamed to + <literal>services.hbase-standalone</literal>. For production + HBase clusters, use <literal>services.hadoop.hbase</literal> + instead. + </para> + </listitem> + <listitem> + <para> + PHP 7.4 is no longer supported due to upstream not supporting + this version for the entire lifecycle of the 22.11 release. + </para> + </listitem> + <listitem> + <para> + <literal>pkgs.cosign</literal> does not provide the + <literal>cosigned</literal> binary anymore. + </para> + </listitem> + <listitem> + <para> + riak package removed along with + <literal>services.riak</literal> module, due to lack of + maintainer to update the package. + </para> + </listitem> + <listitem> + <para> + xow package removed along with the + <literal>hardware.xow</literal> module, due to the project + being deprecated in favor of <literal>xone</literal>, which is + available via the <literal>hardware.xone</literal> module. + </para> + </listitem> + <listitem> + <para> + virtlyst package and <literal>services.virtlyst</literal> + module removed, due to lack of maintainers. + </para> + </listitem> + <listitem> + <para> + The <literal>services.graphite.api</literal> and + <literal>services.graphite.beacon</literal> NixOS options, and + the <literal>python3.pkgs.graphite_api</literal>, + <literal>python3.pkgs.graphite_beacon</literal> and + <literal>python3.pkgs.influxgraph</literal> packages, have + been removed due to lack of upstream maintenance. + </para> + </listitem> + <listitem> + <para> + The <literal>meta.mainProgram</literal> attribute of packages + in <literal>wineWowPackages</literal> now defaults to + <literal>"wine64"</literal>. + </para> + </listitem> + <listitem> + <para> + (Neo)Vim can not be configured with + <literal>configure.pathogen</literal> anymore to reduce + maintainance burden. Use <literal>configure.packages</literal> + instead. + </para> + </listitem> + <listitem> + <para> + <literal>k3s</literal> no longer supports docker as runtime + due to upstream dropping support. + </para> + </listitem> + </itemizedlist> + </section> + <section xml:id="sec-release-22.11-notable-changes"> + <title>Other Notable Changes</title> + <itemizedlist> + <listitem> + <para> + The <literal>xplr</literal> package has been updated from + 0.18.0 to 0.19.0, which brings some breaking changes. See the + <link xlink:href="https://github.com/sayanarijit/xplr/releases/tag/v0.19.0">upstream + release notes</link> for more details. + </para> + </listitem> + <listitem> + <para> + <literal>github-runner</literal> gained support for ephemeral + runners and registrations using a personal access token (PAT) + instead of a registration token. See + <literal>services.github-runner.ephemeral</literal> and + <literal>services.github-runner.tokenFile</literal> for + details. + </para> + </listitem> + <listitem> + <para> + A new module was added for the Saleae Logic device family, + providing the options + <literal>hardware.saleae-logic.enable</literal> and + <literal>hardware.saleae-logic.package</literal>. + </para> + </listitem> + <listitem> + <para> + The Redis module now disables RDB persistence when + <literal>services.redis.servers.<name>.save = []</literal> + instead of using the Redis default. + </para> + </listitem> + <listitem> + <para> + Neo4j was updated from version 3 to version 4. See this + <link xlink:href="https://neo4j.com/docs/upgrade-migration-guide/current/">migration + guide</link> on how to migrate your Neo4j instance. + </para> + </listitem> + <listitem> + <para> + Matrix Synapse now requires entries in the + <literal>state_group_edges</literal> table to be unique, in + order to prevent accidentally introducing duplicate + information (for example, because a database backup was + restored multiple times). If your Synapse database already has + duplicate rows in this table, this could fail with an error + and require manual remediation. + </para> + </listitem> + <listitem> + <para> + <literal>dockerTools.buildImage</literal> deprecates the + misunderstood <literal>contents</literal> parameter, in favor + of <literal>copyToRoot</literal>. Use + <literal>copyToRoot = buildEnv { ... };</literal> or similar + if you intend to add packages to <literal>/bin</literal>. + </para> + </listitem> + <listitem> + <para> + memtest86+ was updated from 5.00-coreboot-002 to 6.00-beta2. + It is now the upstream version from https://www.memtest.org/, + as coreboot’s fork is no longer available. + </para> + </listitem> + <listitem> + <para> + The udisks2 service, available at + <literal>services.udisks2.enable</literal>, is now disabled by + default. It will automatically be enabled through services and + desktop environments as needed. This also means that polkit + will now actually be disabled by default. The default for + <literal>security.polkit.enable</literal> was already flipped + in the previous release, but udisks2 being enabled by default + re-enabled it. + </para> + </listitem> + <listitem> + <para> + Add udev rules for the Teensy family of microcontrollers. + </para> + </listitem> + <listitem> + <para> + The <literal>pass-secret-service</literal> package now + includes systemd units from upstream, so adding it to the + NixOS <literal>services.dbus.packages</literal> option will + make it start automatically as a systemd user service when an + application tries to talk to the libsecret D-Bus API. + </para> + </listitem> + <listitem> + <para> + There is a new module for AMD SEV CPU functionality, which + grants access to the hardware. + </para> + </listitem> + <listitem> + <para> + There is a new module for the <literal>thunar</literal> + program (the Xfce file manager), which depends on the + <literal>xfconf</literal> dbus service, and also has a dbus + service and a systemd unit. The option + <literal>services.xserver.desktopManager.xfce.thunarPlugins</literal> + has been renamed to + <literal>programs.thunar.plugins</literal>, and in a future + release it may be removed. + </para> + </listitem> + <listitem> + <para> + There is a new module for the <literal>xfconf</literal> + program (the Xfce configuration storage system), which has a + dbus service. + </para> + </listitem> + <listitem> + <para> + The <literal>nomad</literal> package now defaults to 1.3, + which no longer has a downgrade path to releases 1.2 or older. + </para> + </listitem> + </itemizedlist> + </section> +</section> diff --git a/nixpkgs/nixos/doc/manual/development/building-nixos.chapter.md b/nixpkgs/nixos/doc/manual/installation/building-nixos.chapter.md index 3310dee98f96..17da261fbdaa 100644 --- a/nixpkgs/nixos/doc/manual/development/building-nixos.chapter.md +++ b/nixpkgs/nixos/doc/manual/installation/building-nixos.chapter.md @@ -18,9 +18,12 @@ enforced values with `mkForce`. ## Practical Instructions {#sec-building-image-instructions} +To build an ISO image for the channel `nixos-unstable`: + ```ShellSession $ git clone https://github.com/NixOS/nixpkgs.git $ cd nixpkgs/nixos +$ git switch nixos-unstable $ nix-build -A config.system.build.isoImage -I nixos-config=modules/installer/cd-dvd/installation-cd-minimal.nix default.nix ``` @@ -30,6 +33,37 @@ To check the content of an ISO image, mount it like so: # mount -o loop -t iso9660 ./result/iso/cd.iso /mnt/iso ``` +## Additional drivers or firmware {#sec-building-image-drivers} + +If you need additional (non-distributable) drivers or firmware in the +installer, you might want to extend these configurations. + +For example, to build the GNOME graphical installer ISO, but with support for +certain WiFi adapters present in some MacBooks, you can create the following +file at `modules/installer/cd-dvd/installation-cd-graphical-gnome-macbook.nix`: + +```nix +{ config, ... }: + +{ + imports = [ ./installation-cd-graphical-gnome.nix ]; + + boot.initrd.kernelModules = [ "wl" ]; + + boot.kernelModules = [ "kvm-intel" "wl" ]; + boot.extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ]; +} +``` + +Then build it like in the example above: + +```ShellSession +$ git clone https://github.com/NixOS/nixpkgs.git +$ cd nixpkgs/nixos +$ export NIXPKGS_ALLOW_UNFREE=1 +$ nix-build -A config.system.build.isoImage -I nixos-config=modules/installer/cd-dvd/installation-cd-graphical-gnome-macbook.nix default.nix +``` + ## Technical Notes {#sec-building-image-tech-notes} The config value enforcement is implemented via `mkImageMediaOverride = mkOverride 60;` diff --git a/nixpkgs/nixos/doc/manual/installation/installation.xml b/nixpkgs/nixos/doc/manual/installation/installation.xml index 1d443bbd0ee1..ba07d71d0ca3 100644 --- a/nixpkgs/nixos/doc/manual/installation/installation.xml +++ b/nixpkgs/nixos/doc/manual/installation/installation.xml @@ -14,4 +14,5 @@ <xi:include href="../from_md/installation/installing.chapter.xml" /> <xi:include href="../from_md/installation/changing-config.chapter.xml" /> <xi:include href="../from_md/installation/upgrading.chapter.xml" /> + <xi:include href="../from_md/installation/building-nixos.chapter.xml" /> </part> diff --git a/nixpkgs/nixos/doc/manual/installation/installing-from-other-distro.section.md b/nixpkgs/nixos/doc/manual/installation/installing-from-other-distro.section.md index d9060eb89c37..fa8806f791d5 100644 --- a/nixpkgs/nixos/doc/manual/installation/installing-from-other-distro.section.md +++ b/nixpkgs/nixos/doc/manual/installation/installing-from-other-distro.section.md @@ -177,7 +177,7 @@ The first steps to all these are the same: was probably single user): ```ShellSession - $ sudo chown -R 0.0 /nix + $ sudo chown -R 0:0 /nix ``` 1. Set up the `/etc/NIXOS` and `/etc/NIXOS_LUSTRATE` files: diff --git a/nixpkgs/nixos/doc/manual/installation/installing-kexec.section.md b/nixpkgs/nixos/doc/manual/installation/installing-kexec.section.md new file mode 100644 index 000000000000..286cbbda6a69 --- /dev/null +++ b/nixpkgs/nixos/doc/manual/installation/installing-kexec.section.md @@ -0,0 +1,64 @@ +# "Booting" into NixOS via kexec {#sec-booting-via-kexec} + +In some cases, your system might already be booted into/preinstalled with +another Linux distribution, and booting NixOS by attaching an installation +image is quite a manual process. + +This is particularly useful for (cloud) providers where you can't boot a custom +image, but get some Debian or Ubuntu installation. + +In these cases, it might be easier to use `kexec` to "jump into NixOS" from the +running system, which only assumes `bash` and `kexec` to be installed on the +machine. + +Note that kexec may not work correctly on some hardware, as devices are not +fully re-initialized in the process. In practice, this however is rarely the +case. + +To build the necessary files from your current version of nixpkgs, +you can run: + +```ShellSession +nix-build -A kexec.x86_64-linux '<nixpkgs/nixos/release.nix>' +``` + +This will create a `result` directory containing the following: + - `bzImage` (the Linux kernel) + - `initrd` (the initrd file) + - `kexec-boot` (a shellscript invoking `kexec`) + +These three files are meant to be copied over to the other already running +Linux Distribution. + +Note it's symlinks pointing elsewhere, so `cd` in, and use +`scp * root@$destination` to copy it over, rather than rsync. + +Once you finished copying, execute `kexec-boot` *on the destination*, and after +some seconds, the machine should be booting into an (ephemeral) NixOS +installation medium. + +In case you want to describe your own system closure to kexec into, instead of +the default installer image, you can build your own `configuration.nix`: + +```nix +{ modulesPath, ... }: { + imports = [ + (modulesPath + "/installer/netboot/netboot-minimal.nix") + ]; + + services.openssh.enable = true; + users.users.root.openssh.authorizedKeys.keys = [ + "my-ssh-pubkey" + ]; +} +``` + + +```ShellSession +nix-build '<nixpkgs/nixos>' \ + --arg configuration ./configuration.nix + --attr config.system.build.kexecTree +``` + +Make sure your `configuration.nix` does still import `netboot-minimal.nix` (or +`netboot-base.nix`). diff --git a/nixpkgs/nixos/doc/manual/installation/installing-usb.section.md b/nixpkgs/nixos/doc/manual/installation/installing-usb.section.md index ae58c08e5237..d893e22e6381 100644 --- a/nixpkgs/nixos/doc/manual/installation/installing-usb.section.md +++ b/nixpkgs/nixos/doc/manual/installation/installing-usb.section.md @@ -18,7 +18,7 @@ $ diskutil list [..] $ diskutil unmountDisk diskN Unmount of all volumes on diskN was successful -$ sudo dd if=nix.iso of=/dev/rdiskN +$ sudo dd if=nix.iso of=/dev/rdiskN bs=1M ``` Using the \'raw\' `rdiskN` device instead of `diskN` completes in diff --git a/nixpkgs/nixos/doc/manual/installation/installing.chapter.md b/nixpkgs/nixos/doc/manual/installation/installing.chapter.md index def4f37fbcaa..7254f9d18406 100644 --- a/nixpkgs/nixos/doc/manual/installation/installing.chapter.md +++ b/nixpkgs/nixos/doc/manual/installation/installing.chapter.md @@ -133,14 +133,14 @@ update /etc/fstab. which will be used by the boot partition. ```ShellSession - # parted /dev/sda -- mkpart primary 512MiB -8GiB + # parted /dev/sda -- mkpart primary 512MB -8GB ``` 3. Next, add a *swap* partition. The size required will vary according - to needs, here a 8GiB one is created. + to needs, here a 8GB one is created. ```ShellSession - # parted /dev/sda -- mkpart primary linux-swap -8GiB 100% + # parted /dev/sda -- mkpart primary linux-swap -8GB 100% ``` ::: {.note} @@ -153,7 +153,7 @@ update /etc/fstab. reserved 512MiB at the start of the disk. ```ShellSession - # parted /dev/sda -- mkpart ESP fat32 1MiB 512MiB + # parted /dev/sda -- mkpart ESP fat32 1MB 512MB # parted /dev/sda -- set 3 esp on ``` @@ -180,14 +180,14 @@ update /etc/fstab. end part, where the swap will live. ```ShellSession - # parted /dev/sda -- mkpart primary 1MiB -8GiB + # parted /dev/sda -- mkpart primary 1MB -8GB ``` 3. Finally, add a *swap* partition. The size required will vary according to needs, here a 8GiB one is created. ```ShellSession - # parted /dev/sda -- mkpart primary linux-swap -8GiB 100% + # parted /dev/sda -- mkpart primary linux-swap -8GB 100% ``` ::: {.note} @@ -296,9 +296,15 @@ Use the following commands: specify on which disk the GRUB boot loader is to be installed. Without it, NixOS cannot boot. + : If there are other operating systems running on the machine before + installing NixOS, the [](#opt-boot.loader.grub.useOSProber) + option can be set to `true` to automatically add them to the grub + menu. + UEFI systems - : You *must* set the option [](#opt-boot.loader.systemd-boot.enable) + : You must select a boot-loader, either system-boot or GRUB. The recommended + option is systemd-boot: set the option [](#opt-boot.loader.systemd-boot.enable) to `true`. `nixos-generate-config` should do this automatically for new configurations when booted in UEFI mode. @@ -307,10 +313,14 @@ Use the following commands: [`boot.loader.systemd-boot`](#opt-boot.loader.systemd-boot.enable) as well. - If there are other operating systems running on the machine before - installing NixOS, the [](#opt-boot.loader.grub.useOSProber) - option can be set to `true` to automatically add them to the grub - menu. + : If you want to use GRUB, set [](#opt-boot.loader.grub.device) to `nodev` and + [](#opt-boot.loader.grub.efiSupport) to `true`. + + : With system-boot, you should not need any special configuration to detect + other installed systems. With GRUB, set [](#opt-boot.loader.grub.useOSProber) + to `true`, but this will only detect windows partitions, not other linux + distributions. If you dual boot another linux distribution, use system-boot + instead. If you need to configure networking for your machine the configuration options are described in [](#sec-networking). In @@ -476,6 +486,7 @@ With a partitioned disk. ```{=docbook} <xi:include href="installing-usb.section.xml" /> <xi:include href="installing-pxe.section.xml" /> +<xi:include href="installing-kexec.section.xml" /> <xi:include href="installing-virtualbox-guest.section.xml" /> <xi:include href="installing-from-other-distro.section.xml" /> <xi:include href="installing-behind-a-proxy.section.xml" /> diff --git a/nixpkgs/nixos/doc/manual/installation/upgrading.chapter.md b/nixpkgs/nixos/doc/manual/installation/upgrading.chapter.md index faeefc4451dc..2644979bc9db 100644 --- a/nixpkgs/nixos/doc/manual/installation/upgrading.chapter.md +++ b/nixpkgs/nixos/doc/manual/installation/upgrading.chapter.md @@ -6,7 +6,7 @@ expressions and associated binaries. The NixOS channels are updated automatically from NixOS's Git repository after certain tests have passed and all packages have been built. These channels are: -- *Stable channels*, such as [`nixos-21.11`](https://nixos.org/channels/nixos-21.11). +- *Stable channels*, such as [`nixos-22.05`](https://nixos.org/channels/nixos-22.05). These only get conservative bug fixes and package upgrades. For instance, a channel update may cause the Linux kernel on your system to be upgraded from 4.19.34 to 4.19.38 (a minor bug fix), but not @@ -19,7 +19,7 @@ passed and all packages have been built. These channels are: radical changes between channel updates. It's not recommended for production systems. -- *Small channels*, such as [`nixos-21.11-small`](https://nixos.org/channels/nixos-21.11-small) +- *Small channels*, such as [`nixos-22.05-small`](https://nixos.org/channels/nixos-22.05-small) or [`nixos-unstable-small`](https://nixos.org/channels/nixos-unstable-small). These are identical to the stable and unstable channels described above, except that they contain fewer binary packages. This means they get updated @@ -38,8 +38,8 @@ newest supported stable release. When you first install NixOS, you're automatically subscribed to the NixOS channel that corresponds to your installation source. For -instance, if you installed from a 21.11 ISO, you will be subscribed to -the `nixos-21.11` channel. To see which NixOS channel you're subscribed +instance, if you installed from a 22.05 ISO, you will be subscribed to +the `nixos-22.05` channel. To see which NixOS channel you're subscribed to, run the following as root: ```ShellSession @@ -54,16 +54,16 @@ To switch to a different NixOS channel, do ``` (Be sure to include the `nixos` parameter at the end.) For instance, to -use the NixOS 21.11 stable channel: +use the NixOS 22.05 stable channel: ```ShellSession -# nix-channel --add https://nixos.org/channels/nixos-21.11 nixos +# nix-channel --add https://nixos.org/channels/nixos-22.05 nixos ``` If you have a server, you may want to use the "small" channel instead: ```ShellSession -# nix-channel --add https://nixos.org/channels/nixos-21.11-small nixos +# nix-channel --add https://nixos.org/channels/nixos-22.05-small nixos ``` And if you want to live on the bleeding edge: @@ -114,5 +114,5 @@ the new generation contains a different kernel, initrd or kernel modules. You can also specify a channel explicitly, e.g. ```nix -system.autoUpgrade.channel = https://nixos.org/channels/nixos-21.11; +system.autoUpgrade.channel = https://nixos.org/channels/nixos-22.05; ``` diff --git a/nixpkgs/nixos/doc/manual/man-nixos-rebuild.xml b/nixpkgs/nixos/doc/manual/man-nixos-rebuild.xml index b2ca9f457a2b..ea96f49fa977 100644 --- a/nixpkgs/nixos/doc/manual/man-nixos-rebuild.xml +++ b/nixpkgs/nixos/doc/manual/man-nixos-rebuild.xml @@ -548,6 +548,14 @@ (<replaceable>user@host</replaceable>). You can also set ssh options by defining the <envar>NIX_SSHOPTS</envar> environment variable. </para> + + <para> + Note that <command>nixos-rebuild</command> honors the + <literal>nixpkgs.crossSystem</literal> setting of the given configuration + but disregards the true architecture of the target host. Hence the + <literal>nixpkgs.crossSystem</literal> setting has to match the target + platform or else activation will fail. + </para> </listitem> </varlistentry> diff --git a/nixpkgs/nixos/doc/manual/man-pages.xml b/nixpkgs/nixos/doc/manual/man-pages.xml index 49acfe7330b6..58f73521e94f 100644 --- a/nixpkgs/nixos/doc/manual/man-pages.xml +++ b/nixpkgs/nixos/doc/manual/man-pages.xml @@ -3,10 +3,15 @@ xmlns:xi="http://www.w3.org/2001/XInclude"> <title>NixOS Reference Pages</title> <info> - <author><personname><firstname>Eelco</firstname><surname>Dolstra</surname></personname> + <author> + <personname><firstname>Eelco</firstname><surname>Dolstra</surname></personname> <contrib>Author</contrib> </author> - <copyright><year>2007-2020</year><holder>Eelco Dolstra</holder> + <author> + <personname><othername>The Nixpkgs/NixOS contributors</othername></personname> + <contrib>Author</contrib> + </author> + <copyright><year>2007-2022</year><holder>Eelco Dolstra and the Nixpkgs/NixOS contributors</holder> </copyright> </info> <xi:include href="man-configuration.xml" /> diff --git a/nixpkgs/nixos/doc/manual/md-to-db.sh b/nixpkgs/nixos/doc/manual/md-to-db.sh index e0274f5619c7..2091f9b31cd2 100755 --- a/nixpkgs/nixos/doc/manual/md-to-db.sh +++ b/nixpkgs/nixos/doc/manual/md-to-db.sh @@ -1,5 +1,5 @@ #! /usr/bin/env nix-shell -#! nix-shell -I nixpkgs=channel:nixpkgs-unstable -i bash -p pandoc +#! nix-shell -I nixpkgs=https://github.com/NixOS/nixpkgs/tarball/21.11 -i bash -p pandoc # This script is temporarily needed while we transition the manual to # CommonMark. It converts the .md files in the regular manual folder diff --git a/nixpkgs/nixos/doc/manual/release-notes/release-notes.xml b/nixpkgs/nixos/doc/manual/release-notes/release-notes.xml index 216fea677757..ee5009faf6f4 100644 --- a/nixpkgs/nixos/doc/manual/release-notes/release-notes.xml +++ b/nixpkgs/nixos/doc/manual/release-notes/release-notes.xml @@ -8,6 +8,7 @@ This section lists the release notes for each stable version of NixOS and current unstable revision. </para> + <xi:include href="../from_md/release-notes/rl-2211.section.xml" /> <xi:include href="../from_md/release-notes/rl-2205.section.xml" /> <xi:include href="../from_md/release-notes/rl-2111.section.xml" /> <xi:include href="../from_md/release-notes/rl-2105.section.xml" /> diff --git a/nixpkgs/nixos/doc/manual/release-notes/rl-1803.section.md b/nixpkgs/nixos/doc/manual/release-notes/rl-1803.section.md index e4e467981047..c5146015d449 100644 --- a/nixpkgs/nixos/doc/manual/release-notes/rl-1803.section.md +++ b/nixpkgs/nixos/doc/manual/release-notes/rl-1803.section.md @@ -282,3 +282,5 @@ When upgrading from a previous release, please be aware of the following incompa - The NixOS test driver supports user services declared by `systemd.user.services`. The methods `waitForUnit`, `getUnitInfo`, `startJob` and `stopJob` provide an optional `$user` argument for that purpose. - Enabling bash completion on NixOS, `programs.bash.enableCompletion`, will now also enable completion for the Nix command line tools by installing the [nix-bash-completions](https://github.com/hedning/nix-bash-completions) package. + +- The vim/kakoune plugin updater now reads from a CSV file: check `pkgs/applications/editors/vim/plugins/vim-plugin-names` out to see the new format diff --git a/nixpkgs/nixos/doc/manual/release-notes/rl-2111.section.md b/nixpkgs/nixos/doc/manual/release-notes/rl-2111.section.md index 310d32cfdd72..e673d6721a38 100644 --- a/nixpkgs/nixos/doc/manual/release-notes/rl-2111.section.md +++ b/nixpkgs/nixos/doc/manual/release-notes/rl-2111.section.md @@ -166,7 +166,7 @@ In addition to numerous new and upgraded packages, this release has the followin ## Backward Incompatibilities {#sec-release-21.11-incompatibilities} -- The NixOS VM test framework, `pkgs.nixosTest`/`make-test-python.nix`, now requires detaching commands such as `succeed("foo &")` and `succeed("foo | xclip -i")` to close stdout. +- The NixOS VM test framework, `pkgs.nixosTest`/`make-test-python.nix` (`pkgs.testers.nixosTest` since 22.05), now requires detaching commands such as `succeed("foo &")` and `succeed("foo | xclip -i")` to close stdout. This can be done with a redirect such as `succeed("foo >&2 &")`. This breaking change was necessitated by a race condition causing tests to fail or hang. It applies to all methods that invoke commands on the nodes, including `execute`, `succeed`, `fail`, `wait_until_succeeds`, `wait_until_fails`. diff --git a/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md b/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md index 7cafdcabbaaf..2d2140d92d59 100644 --- a/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md +++ b/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md @@ -1,103 +1,177 @@ -# Release 22.05 (“Quokka”, 2022.05/??) {#sec-release-22.05} - -In addition to numerous new and upgraded packages, this release has the following highlights: +# Release 22.05 (“Quokka”, 2022.05/30) {#sec-release-22.05} - Support is planned until the end of December 2022, handing over to 22.11. ## Highlights {#sec-release-22.05-highlights} -- The `firefox` browser on `x86_64-linux` is now making use of - profile-guided optimization resulting in a much more responsive - browsing experience. +In addition to numerous new and upgraded packages, this release has the following highlights: -- `security.acme.defaults` has been added to simplify configuring - settings for many certificates at once. This also opens up the - the option to use DNS-01 validation when using `enableACME` on - web server virtual hosts (e.g. `services.nginx.virtualHosts.*.enableACME`). +- Nix has been updated from 2.3 to 2.8. This mainly brings experimental support + for Flakes, but also marks the `nix` command as experimental which now has to + be enabled via the configuration explicitly. For more information and + instructions for upgrades, see the + relase notes for [nix-2.4](https://nixos.org/manual/nix/stable/release-notes/rl-2.4.html), + [nix-2.5](https://nixos.org/manual/nix/stable/release-notes/rl-2.5.html), + [nix-2.6](https://nixos.org/manual/nix/stable/release-notes/rl-2.6.html), + [nix-2.7](https://nixos.org/manual/nix/stable/release-notes/rl-2.7.html) and + [nix-2.8](https://nixos.org/manual/nix/stable/release-notes/rl-2.8.html) -- GNOME has been upgraded to 42. Please take a look at their [Release Notes](https://release.gnome.org/42/) for details. Notably, it replaces gedit with GNOME Text Editor, GNOME Terminal with GNOME Console (formerly King’s Cross), and GNOME Screenshot with a tool built into the Shell. +- The `firefox` browser on `x86_64-linux` now makes use of profile-guided + optimisation, resulting in a much more responsive browsing experience. -- PHP 8.1 is now available +- GNOME has been upgraded to 42. Please take a look at their [Release + Notes](https://release.gnome.org/42/) for details. In particular, it replaces + gedit with GNOME Text Editor, GNOME Terminal with GNOME Console (formerly + King's Cross) and GNOME Screenshot by a tool integrated into the Shell. -- Mattermost has been updated to extended support release 6.3, as the previously packaged extended support release 5.37 is [reaching its end of life](https://docs.mattermost.com/upgrade/extended-support-release.html). - Migrations may take a while, see the [changelog](https://docs.mattermost.com/install/self-managed-changelog.html#release-v6-3-extended-support-release) - and [important upgrade notes](https://docs.mattermost.com/upgrade/important-upgrade-notes.html). +- PHP 8.1 is now available. - systemd services can now set [systemd.services.\<name\>.reloadTriggers](#opt-systemd.services) instead of `reloadIfChanged` for a more granular distinction between reloads and restarts. -- [`kops`](https://kops.sigs.k8s.io) defaults to 1.22.4, which will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes 1.22. This will increase security by default, but may break some types of workloads. See the [release notes](https://kops.sigs.k8s.io/releases/1.22-notes/) for details. +- Systemd has been upgraded to the version 250. + +- Pulseaudio has been updated to version 15.0 and now optionally + [supports additional Bluetooth audio codecs](https://www.freedesktop.org/wiki/Software/PulseAudio/Notes/15.0/#supportforldacandaptxbluetoothcodecsplussbcxqsbcwithhigher-qualityparameters) + such as aptX or LDAC, with codec switching available in `pavucontrol`. This + feature is disabled by default, but can be enabled with the option + `hardware.pulseaudio.package = pkgs.pulseaudioFull;`. Existing third-party + modules that offered similar functions, such as `pulseaudio-modules-bt` or + `pulseaudio-hsphfpd`, are obsolete and have been removed. + +- PostgreSQL now defaults to major version 14. - Module authors can use `mkRenamedOptionModuleWith` to automate the deprecation cycle without annoying out-of-tree module authors and their users. +- The default GHC version has been updated from 8.10.7 to 9.0.2. `pkgs.haskellPackages` and `pkgs.ghc` will now use this version by default. + +- The GNOME and Plasma installation CDs now use `pkgs.calamares` and `pkgs.calamares-nixos-extensions` to allow users to easily install and set up NixOS with a GUI. + +- `security.acme.defaults` has been added to simplify the configuration of + settings for many certificates at once. This also opens up the option to use + DNS-01 validation when using `enableACME` web server virtual hosts (e.g. + `services.nginx.virtualHosts.*.enableACME`). + ## New Services {#sec-release-22.05-new-services} +- [1password](https://1password.com/), command-lines and graphic interface for 1Password. Available as [programs._1password](#opt-programs._1password.enable) and [programs._1password-gui](#opt-programs._1password.enable). + - [aesmd](https://github.com/intel/linux-sgx#install-the-intelr-sgx-psw), the Intel SGX Architectural Enclave Service Manager. Available as [services.aesmd](#opt-services.aesmd.enable). -- [rootless Docker](https://docs.docker.com/engine/security/rootless/), a `systemd --user` Docker service which runs without root permissions. Available as [virtualisation.docker.rootless.enable](options.html#opt-virtualisation.docker.rootless.enable). +- [agate](https://github.com/mbrubeck/agate), a very simple server for the Gemini hypertext protocol. Available as [services.agate](#opt-services.agate.enable). -- [matrix-conduit](https://conduit.rs/), a simple, fast and reliable chat server powered by matrix. Available as [services.matrix-conduit](option.html#opt-services.matrix-conduit.enable). +- [apfs](https://github.com/linux-apfs/linux-apfs-rw), a kernel module for mounting the Apple File System (APFS). + +- [argonone](https://gitlab.com/DarkElvenAngel/argononed), a replacement daemon for the Raspberry Pi Argon One power button and cooler. Available at [services.hardware.argonone](options.html#opt-services.hardware.argonone.enable). + +- [ArchiSteamFarm](https://github.com/JustArchiNET/ArchiSteamFarm), a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as [services.archisteamfarm](#opt-services.archisteamfarm.enable). + +- [BaGet](https://loic-sharma.github.io/BaGet/), a lightweight NuGet and symbol server. Available at [services.baget](#opt-services.baget.enable). + +- [bird-lg](https://github.com/xddxdd/bird-lg-go), a BGP looking glass for Bird Routing. Available as [services.bird-lg](#opt-services.bird-lg.package). + +- [blocky](https://0xerr0r.github.io/blocky/), fast and lightweight DNS proxy as ad-blocker for local network with many features. Available as [services.blocky](#opt-services.blocky.enable). + +- [cloudflare-dyndns](https://github.com/kissgyorgy/cloudflare-dyndns), CloudFlare Dynamic DNS client. Available as [services.cloudflare-dyndns](#opt-services.cloudflare-dyndns.enable). + +- [Corosync](https://corosync.github.io/corosync/) and [Pacemaker](https://clusterlabs.org/pacemaker/), A open-source high availability resource manager. Available as [services.corosync](#opt-services.corosync.enable) and [services.pacemaker](#opt-services.pacemaker.enable). + +- [create_ap](https://github.com/lakinduakash/linux-wifi-hotspot), a module for creating wifi hotspots using the program linux-wifi-hotspot. Available as [services.create_ap](#opt-services.create_ap.enable). + +- [Envoy](https://www.envoyproxy.io/), a high-performance reverse proxy. Available as [services.envoy](#opt-services.envoy.enable). + +- [ergochat](https://ergo.chat), a modern IRC with IRCv3 features. Available as [services.ergochat](#opt-services.ergochat.enable). + +- [ethercalc](https://github.com/audreyt/ethercalc), an online collaborative spreadsheet. Available as [services.ethercalc](#opt-services.ethercalc.enable). - [filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html), a lightweight shipper for forwarding and centralizing log data. Available as [services.filebeat](#opt-services.filebeat.enable). -- [apfs](https://github.com/linux-apfs/linux-apfs-rw), a kernel module for mounting the Apple File System (APFS). +- [FRRouting](https://frrouting.org/), a popular suite of Internet routing protocol daemons (BGP, BFD, OSPF, IS-IS, VRRP and others). Available as [services.frr](#opt-services.frr.babel.enable). + +- [Grafana Mimir](https://grafana.com/oss/mimir/), an open source, horizontally scalable, highly available, multi-tenant, long-term storage for Prometheus. Available as [services.mimir](#opt-services.mimir.enable). -- [FRRouting](https://frrouting.org/), a popular suite of Internet routing protocol daemons (BGP, BFD, OSPF, IS-IS, VRRP and others). Available as [services.frr](#opt-services.frr.babel.enable) +- [Haste](https://hastebin.com/about.md), a pastebin written in node.js. Available as [services.haste](#opt-services.haste-server.enable). -- [heisenbridge](https://github.com/hifi/heisenbridge), a bouncer-style Matrix IRC bridge. Available as [services.heisenbridge](options.html#opt-services.heisenbridge.enable). +- [headscale](https://github.com/juanfont/headscale), an Open Source implementation of the [Tailscale](https://tailscale.io) Control Server. Available as [services.headscale](#opt-services.headscale.enable). -- [snowflake-proxy](https://snowflake.torproject.org/), a system to defeat internet censorship. Available as [services.snowflake-proxy](options.html#opt-services.snowflake-proxy.enable). +- [heisenbridge](https://github.com/hifi/heisenbridge), a bouncer-style Matrix IRC bridge. Available as [services.heisenbridge](#opt-services.heisenbridge.enable). -- [ergochat](https://ergo.chat), a modern IRC with IRCv3 features. Available as [services.ergochat](options.html#opt-services.ergochat.enable). +- [https-dns-proxy](https://github.com/aarond10/https_dns_proxy), DNS to DNS over HTTPS (DoH) proxy. Available as [services.https-dns-proxy](#opt-services.https-dns-proxy.enable). -- [PowerDNS-Admin](https://github.com/ngoduykhanh/PowerDNS-Admin), a web interface for the PowerDNS server. Available at [services.powerdns-admin](options.html#opt-services.powerdns-admin.enable). +- [input-remapper](https://github.com/sezanzeb/input-remapper), an easy to use tool to change the mapping of your input device buttons. Available at [services.input-remapper](#opt-services.input-remapper.enable). -- [pgadmin4](https://github.com/postgres/pgadmin4), an admin interface for the PostgreSQL database. Available at [services.pgadmin](options.html#opt-services.pgadmin.enable). +- [InvoicePlane](https://invoiceplane.com), web application for managing and creating invoices. Available at [services.invoiceplane](#opt-services.invoiceplane.sites._name_.enable). -- [input-remapper](https://github.com/sezanzeb/input-remapper), an easy to use tool to change the mapping of your input device buttons. Available at [services.input-remapper](options.html#opt-services.input-remapper.enable). +- [k3b](https://userbase.kde.org/K3b), the KDE disk burning application. Available as [programs.k3b](#opt-programs.k3b.enable). -- [InvoicePlane](https://invoiceplane.com), web application for managing and creating invoices. Available at [services.invoiceplane](options.html#opt-services.invoiceplane.enable). +- [K40-Whisperer](https://www.scorchworks.com/K40whisperer/k40whisperer.html), a program to control cheap Chinese laser cutters. Available as [programs.k40-whisperer.enable](#opt-programs.k40-whisperer.enable). Users must add themselves to the `k40` group to be able to access the device. -- [maddy](https://maddy.email), a composable all-in-one mail server. Available as [services.maddy](options.html#opt-services.maddy.enable). +- [kanidm](https://kanidm.github.io/kanidm/stable/), an identity management server written in Rust. Available as [services.kanidm](#opt-services.kanidm.enableServer) -- [K40-Whisperer](https://www.scorchworks.com/K40whisperer/k40whisperer.html), a program to control cheap Chinese laser cutters. Available as [programs.k40-whisperer.enable](options.html#opt-programs.k4-whisperer.enable). Users must add themselves to the `k40` group to be able to access the device. +- [Maddy](https://maddy.email/), a free an open source mail server. Availabe as [services.maddy](#opt-services.maddy.enable). -- [mtr-exporter](https://github.com/mgumz/mtr-exporter), a Prometheus exporter for mtr metrics. Available as [services.mtr-exporter](options.html#opt-services.mtr-exporter.enable). +- [matrix-conduit](https://conduit.rs/), a simple, fast and reliable chat server powered by matrix. Available as [services.matrix-conduit](option.html#opt-services.matrix-conduit.enable). -- [prometheus-pve-exporter](https://github.com/prometheus-pve/prometheus-pve-exporter), a tool that exposes information from the Proxmox VE API for use by Prometheus. Available as [services.prometheus.exporters.pve](options.html#opt-services.prometheus.exporters.pve). +- [Moosefs](https://moosefs.com), fault tolerant petabyte distributed file system. Available as [moosefs](#opt-services.moosefs.master.enable). -- [tetrd](https://tetrd.app), share your internet connection from your device to your PC and vice versa through a USB cable. Available at [services.tetrd](#opt-services.tetrd.enable). +- [mozillavpn](https://github.com/mozilla-mobile/mozilla-vpn-client), the client for the [Mozilla VPN](https://vpn.mozilla.org/) service. Available as [services.mozillavpn](#opt-services.mozillavpn.enable). -- [agate](https://github.com/mbrubeck/agate), a very simple server for the Gemini hypertext protocol. Available as [services.agate](options.html#opt-services.agate.enable). +- [mtr-exporter](https://github.com/mgumz/mtr-exporter), a Prometheus exporter for mtr metrics. Available as [services.mtr-exporter](#opt-services.mtr-exporter.enable). -- [ArchiSteamFarm](https://github.com/JustArchiNET/ArchiSteamFarm), a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as [services.archisteamfarm](options.html#opt-services.archisteamfarm.enable). +- [nbd](https://nbd.sourceforge.io/), a Network Block Device server. Available as [services.nbd](#opt-services.nbd.server.enable). -- [teleport](https://goteleport.com), allows engineers and security professionals to unify access for SSH servers, Kubernetes clusters, web applications, and databases across all environments. Available at [services.teleport](#opt-services.teleport.enable). +- [netbox](https://github.com/netbox-community/netbox), infrastructure resource modeling (IRM) tool. Available as [services.netbox](#opt-services.netbox.enable). -- [BaGet](https://loic-sharma.github.io/BaGet/), a lightweight NuGet and symbol server. Available at [services.baget](#opt-services.baget.enable). +- [nethoscope](https://github.com/vvilhonen/nethoscope), listen to your network traffic. Available as [programs.nethoscope](#opt-programs.nethoscope.enable). + +- [nifi](https://nifi.apache.org), an easy to use, powerful, and reliable system to process and distribute data. Available as [services.nifi](#opt-services.nifi.enable). + +- [nix-ld](https://github.com/Mic92/nix-ld), Run unpatched dynamic binaries on NixOS. Available as [programs.nix-ld](#opt-programs.nix-ld.enable). + +- [NNCP](http://www.nncpgo.org), NNCP (Node to Node copy) utilities and configuration, Available as [programs.nncp](#opt-programs.nncp.enable). + +- [pgadmin4](https://github.com/postgres/pgadmin4), an admin interface for the PostgreSQL database. Available at [services.pgadmin](#opt-services.pgadmin.enable). -- [moosefs](https://moosefs.com), fault tolerant petabyte distributed file system. - Available as [moosefs](#opt-services.moosefs.client.enable). +- [PowerDNS-Admin](https://github.com/ngoduykhanh/PowerDNS-Admin), a web interface for the PowerDNS server. Available at [services.powerdns-admin](#opt-services.powerdns-admin.enable). + +- [prometheus-pve-exporter](https://github.com/prometheus-pve/prometheus-pve-exporter), a tool that exposes information from the Proxmox VE API for use by Prometheus. Available as [services.prometheus.exporters.pve](#opt-services.prometheus.exporters.pve.enable). - [prosody-filer](https://github.com/ThomasLeister/prosody-filer), a server for handling XMPP HTTP Upload requests. Available at [services.prosody-filer](#opt-services.prosody-filer.enable). -- [systembus-notify](https://github.com/rfjakob/systembus-notify), allow system level notifications to reach the users. Available as [services.systembus-notify](opt-services.systembus-notify.enable). Please keep in mind that this service should only be enabled on machines with fully trusted users, as any local user is able to DoS user sessions by spamming notifications. +- [Public Inbox](https://public-inbox.org), an "archives first" approach to mailing lists. Available as [services.public-inbox](#opt-services.public-inbox.enable). + +- [r53-ddns](https://github.com/fleaz/r53-ddns), a small tool to run your own DDNS service via AWS Route53. Available as [services.r53-ddns](#opt-services.r53-ddns.enable). + +- [rmfakecloud](https://ddvk.github.io/rmfakecloud/), a clone of the cloud sync the remarkable tablet. Available as [services.rmfakecloud](#opt-services.rmfakecloud.enable). + +- [rootless Docker](https://docs.docker.com/engine/security/rootless/), a `systemd --user` Docker service which runs without root permissions. Available as [virtualisation.docker.rootless.enable](#opt-virtualisation.docker.rootless.enable). + +- [rstudio-server](https://www.rstudio.com/products/rstudio/#rstudio-server), a browser-based version of the RStudio IDE for the R programming language. Available as [services.rstudio-server](#opt-services.rstudio-server.enable). + +- [rtsp-simple-server](https://github.com/aler9/rtsp-simple-server), ready-to-use RTSP / RTMP / HLS server and proxy that allows to read, publish and proxy video and audio streams. Available as [services.rtsp-simple-server](#opt-services.rtsp-simple-server.enable). + +- [Snipe-IT](https://snipeitapp.com), a free open source IT asset/license management system. Available as [services.snipe-it](#opt-services.snipe-it.enable). -- [ethercalc](https://github.com/audreyt/ethercalc), an online collaborative - spreadsheet. Available as [services.ethercalc](options.html#opt-services.ethercalc.enable). +- [snowflake-proxy](https://snowflake.torproject.org/), a system to defeat internet censorship. Available as [services.snowflake-proxy](#opt-services.snowflake-proxy.enable). -- [nbd](https://nbd.sourceforge.io/), a Network Block Device server. Available as [services.nbd](options.html#opt-services.nbd.server.enable). +- [sslmate-agent](https://sslmate.com/), a daemon for managing SSL/TLS certificates on a server. Available as [services.sslmate-agent](services.sslmate-agent.enable). -- [nix-ld](https://github.com/Mic92/nix-ld), Run unpatched dynamic binaries on NixOS. Available as [programs.nix-ld](options.html#opt-programs.nix-ld.enable). +- [starship](https://starship.rs), a minimal, blazing-fast, and infinitely customizable prompt for any shell. Available at [programs.startship](#opt-programs.starship.enable). -- [timetagger](https://timetagger.app), an open source time-tracker with an intuitive user experience and powerful reporting. [services.timetagger](options.html#opt-services.timetagger.enable). +- [systembus-notify](https://github.com/rfjakob/systembus-notify), allow system level notifications to reach the users. Available as [services.systembus-notify](opt-services.systembus-notify.enable). Please keep in mind that this service should only be enabled on machines with fully trusted users, as any local user is able to DoS user sessions by spamming notifications. + +- [teleport](https://goteleport.com), allows engineers and security professionals to unify access for SSH servers, Kubernetes clusters, web applications, and databases across all environments. Available at [services.teleport](#opt-services.teleport.enable). + +- [tetrd](https://tetrd.app), share your internet connection from your device to your PC and vice versa through a USB cable. Available at [services.tetrd](#opt-services.tetrd.enable). + +- [uptermd](https://upterm.dev), an open-source solution for sharing terminal sessions instantly over the public internet via secure tunnels. Available at [services.uptermd](#opt-services.uptermd.enable). -- [rstudio-server](https://www.rstudio.com/products/rstudio/#rstudio-server), a browser-based version of the RStudio IDE for the R programming language. Available as [services.rstudio-server](options.html#opt-services.rstudio-server.enable). +- [usbrelayd](https://github.com/darrylb123/usbrelay), an USB Relay MQTT daemon. Available as [services.usbrelayd](#opt-services.usbrelayd.enable). -- [headscale](https://github.com/juanfont/headscale), an Open Source implementation of the [Tailscale](https://tailscale.io) Control Server. Available as [services.headscale](options.html#opt-services.headscale.enable) +- [webdav-server-rs](https://github.com/miquels/webdav-server-rs), Webdav server in rust. Available as [services.webdav-server-rs](#opt-services.webdav-server-rs.enable). -- [blocky](https://0xerr0r.github.io/blocky/), fast and lightweight DNS proxy as ad-blocker for local network with many features. +- [wg-netmanager](https://github.com/gin66/wg_netmanager), the Wireguard network manager. Available as [services.wg-netmanager](#opt-services.wg-netmanager.enable). -- [pacemaker](https://clusterlabs.org/pacemaker/) cluster resource manager +- [Zammad](https://zammad.org/), a web-based, open source user support/ticketing solution. Available as [services.zammad](#opt-services.zammad.enable). <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. --> @@ -121,6 +195,10 @@ In addition to numerous new and upgraded packages, this release has the followin `useLLVM`. So instead of `(ghc.withPackages (p: [])).override { withLLVM = true; }`, one needs to use `(ghc.withPackages.override { useLLVM = true; }) (p: [])`. +- The update of the haskell package set brings with it a new version of the `xmonad` + module, which will break your configuration if you use `launch` as entrypoint. The + example code the corresponding nixos module was adjusted, you may want to have a look at it. + - The `home-assistant` module now requires users that don't want their configuration to be managed declaratively to set `services.home-assistant.config = null;`. This is required @@ -135,10 +213,77 @@ In addition to numerous new and upgraded packages, this release has the followin org-contrib, refer to the ones in `pkgs.emacsPackages.elpaPackages` and `pkgs.emacsPackages.nongnuPackages` where the new versions will release. +- The configuration and state directories used by `nixos-containers` have been + moved from `/etc/containers` and `/var/lib/containers` to + `/etc/nixos-containers` and `/var/lib/nixos-containers`. + + If you are changing `system.stateVersion` to `"22.05"` manually on an existing + system you are responsible for migrating these directories yourself. + + This is to improve compatibility with `libcontainer` based software such as Podman and Skopeo + which assumes they have ownership over `/etc/containers`. + +- `lib.systems.supported` has been removed, as it was overengineered for determining the systems to support in the nixpkgs flake. The list of systems exposed by the nixpkgs flake can now be accessed as `lib.systems.flakeExposed`. + +- For new installations `virtualisation.oci-containers.backend` is now set to `podman` by default. + If you still want to use Docker on systems where `system.stateVersion` is set to to `"22.05"` set `virtualisation.oci-containers.backend = "docker";`.Old systems with older `stateVersion`s stay with "docker". + +- `security.klogd` was removed. Logging of kernel messages is handled + by systemd since Linux 3.5. + +- `pkgs.ssmtp` has been dropped due to the program being unmaintained. + `pkgs.msmtp` can be used instead as a substitute `sendmail` implementation. + The corresponding options `services.ssmtp.*` have been removed as well. + `programs.msmtp.*` can be used instead for an equivalent setup. For example: + + ```nix + { + # Original ssmtp configuration: + services.ssmtp = { + enable = true; + useTLS = true; + useSTARTTLS = true; + hostName = "smtp.example:587"; + authUser = "someone"; + authPassFile = "/secrets/password.txt"; + }; + + # Equivalent msmtp configuration: + programs.msmtp = { + enable = true; + accounts.default = { + tls = true; + tls_starttls = true; + auth = true; + host = "smtp.example"; + port = 587; + user = "someone"; + passwordeval = "cat /secrets/password.txt"; + }; + }; + } + ``` + - `services.kubernetes.addons.dashboard` was removed due to it being an outdated version. - `services.kubernetes.scheduler.{port,address}` now set `--secure-port` and `--bind-address` instead of `--port` and `--address`, since the former have been deprecated and are no longer functional in kubernetes>=1.23. Ensure that you are not relying on the insecure behaviour before upgrading. +- In the PowerDNS Recursor module (`services.pdns-recursor`), default values of several IP address-related NixOS options have been updated to match the default upstream behavior. + In particular, Recursor by default will: + - listen on (and allows connections from) both IPv4 and IPv6 addresses + (`services.pdns-recursor.dns.address`, `services.pdns-recursor.dns.allowFrom`); + - allow only local connections to the REST API server (`services.pdns-recursor.api.allowFrom`). + +- In the ncdns module, the default value of `services.ncdns.address` has been changed to the IPv6 loopback address (`::1`). + +- `openldap` (and therefore the slapd LDAP server) were updated to version 2.6.2. The project introduced backwards-incompatible changes, namely the removal of the bdb, hdb, ndb, and shell backends in slapd. Therefore before updating, dump your database `slapcat -n 1` in LDIF format, and reimport it after updating your `services.openldap.settings`, which represents your `cn=config`. + + Additionally with 2.5 the argon2 module was included in the standard distrubtion and renamed from `pw-argon2` to `argon2`. Remember to update your `olcModuleLoad` entry in `cn=config`. + +- `openssh` has been update to 8.9p1, changing the FIDO security key middleware interface. + +- `git` no longer hardcodes the path to openssh' ssh binary to reduce the amount of rebuilds. If you are using git with ssh remotes and do not have a ssh binary in your enviroment consider adding `openssh` to it or switching to `gitFull`. + - `services.k3s.enable` no longer implies `systemd.enableUnifiedCgroupHierarchy = false`, and will default to the 'systemd' cgroup driver when using `services.k3s.docker = true`. This change may require a reboot to take effect, and k3s may not be able to run if the boot cgroup hierarchy does not match its configuration. The previous behavior may be retained by explicitly setting `systemd.enableUnifiedCgroupHierarchy = false` in your configuration. @@ -156,6 +301,8 @@ In addition to numerous new and upgraded packages, this release has the followin } ``` +- `services.prometheus.alertManagerTimeout` has been removed as it has been deprecated upstream and has no effect. + - The DHCP server (`services.dhcpd4`, `services.dhcpd6`) has been hardened. The service is now using the systemd's `DynamicUser` mechanism to run as an unprivileged dynamically-allocated user with limited capabilities. The dhcpd state files are now always stored in `/var/lib/dhcpd{4,6}` and the `services.dhcpd4.stateDir` and `service.dhcpd6.stateDir` options have been removed. @@ -165,6 +312,10 @@ In addition to numerous new and upgraded packages, this release has the followin - `services.ipfs.extraFlags` is now escaped with `utils.escapeSystemdExecArgs`. If you rely on systemd interpolating `extraFlags` in the service `ExecStart`, this will no longer work. +- `hbase` version 0.98.24 has been removed. The package now defaults to version 2.4.11. Versions 1.7.1 and 3.0.0-alpha-2 are also available. + +- `services.paperless-ng` was renamed to `services.paperless`. Accordingly, the `paperless-ng-manage` script (located in `dataDir`) was renamed to `paperless-manage`. `services.paperless` now uses `paperless-ngx`. + - The `matrix-synapse` service (`services.matrix-synapse`) has been converted to use the `settings` option defined in RFC42. This means that options that are part of your `homeserver.yaml` configuration, and that were specified at the top-level of the module (`services.matrix-synapse`) now need to be moved into `services.matrix-synapse.settings`. And while not all options you @@ -247,18 +398,95 @@ In addition to numerous new and upgraded packages, this release has the followin }; extraConfigFiles = [ - /run/keys/matrix-synapse/secrets.yaml + "/run/keys/matrix-synapse/secrets.yaml" ]; }; } ``` - The secrets in your original config should be migrated into a YAML file that is included via `extraConfigFiles`. + The secrets in your original config should be migrated into a YAML file that is included via `extraConfigFiles`. The filename must be quoted to prevent nix from copying it to the (world readable) store. Additionally a few option defaults have been synced up with upstream default values, for example the `max_upload_size` grew from `10M` to `50M`. For the same reason, the default `media_store_path` was changed from `${dataDir}/media` to `${dataDir}/media_store` if `system.stateVersion` is at least `22.05`. Files will need to be manually moved to the new location if the `stateVersion` is updated. + As of Synapse 1.58.0, the old groups/communities feature has been disabled by default. It will be completely removed with Synapse 1.61.0. + +- The Keycloak package (`pkgs.keycloak`) has been switched from the + Wildfly version, which will soon be deprecated, to the Quarkus based + version. The Keycloak service (`services.keycloak`) has been updated + to accommodate the change and now differs from the previous version + in a few ways: + + - `services.keycloak.extraConfig` has been removed in favor of the + new [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) + [`services.keycloak.settings`](#opt-services.keycloak.settings) + option. The available options correspond directly to parameters in + `conf/keycloak.conf`. Some of the most important parameters are + documented as suboptions, the rest can be found in the [All + configuration section of the Keycloak Server Installation and + Configuration + Guide](https://www.keycloak.org/server/all-config). While the new + configuration is much simpler and cleaner than the old JBoss CLI + one, this unfortunately mean that there's no straightforward way + to convert an old configuration to the new format and some + settings may not even be available anymore. + + - `services.keycloak.frontendUrl` was removed and the frontend URL + is now configured through the `hostname` family of settings in + [`services.keycloak.settings`](#opt-services.keycloak.settings) + instead. See the [Hostname section of the Keycloak Server + Installation and Configuration + Guide](https://www.keycloak.org/server/hostname) for more + details. Additionally, `/auth` was removed from the default + context path and needs to be added back in + [`services.keycloak.settings.http-relative-path`](#opt-services.keycloak.settings.http-relative-path) + if you want to keep compatibility with your current clients. + + - `services.keycloak.bindAddress`, + `services.keycloak.forceBackendUrlToFrontendUrl`, + `services.keycloak.httpPort` and `services.keycloak.httpsPort` + have been removed in favor of their equivalent options in + [`services.keycloak.settings`](#opt-services.keycloak.settings). `httpPort` + and `httpsPort` have additionally had their types changed from + `str` to `port`. + + The new names are as follows: + - `bindAddress`: [`services.keycloak.settings.http-host`](#opt-services.keycloak.settings.http-host) + - `forceBackendUrlToFrontendUrl`: [`services.keycloak.settings.hostname-strict-backchannel`](#opt-services.keycloak.settings.hostname-strict-backchannel) + - `httpPort`: [`services.keycloak.settings.http-port`](#opt-services.keycloak.settings.http-port) + - `httpsPort`: [`services.keycloak.settings.https-port`](#opt-services.keycloak.settings.https-port) + + For example, when using a reverse proxy the migration could look + like this: + + Before: + ```nix + services.keycloak = { + enable = true; + httpPort = "8080"; + frontendUrl = "https://keycloak.example.com/auth"; + database.passwordFile = "/run/keys/db_password"; + extraConfig = { + "subsystem=undertow"."server=default-server"."http-listener=default".proxy-address-forwarding = true; + }; + }; + ``` + + After: + ```nix + services.keycloak = { + enable = true; + settings = { + http-port = 8080; + hostname = "keycloak.example.com"; + http-relative-path = "/auth"; + proxy = "edge"; + }; + database.passwordFile = "/run/keys/db_password"; + }; + ``` + - The MoinMoin wiki engine (`services.moinmoin`) has been removed, because Python 2 is being retired from nixpkgs. - Services in the `hadoop` module previously set `openFirewall` to true by default. @@ -300,8 +528,14 @@ In addition to numerous new and upgraded packages, this release has the followin - `services.miniflux.adminCredentialFiles` is now required, instead of defaulting to `admin` and `password`. +- The `taskserver` module no longer implicitly opens ports in the firewall + configuration. This is now controlled through the option + `services.taskserver.openFirewall`. + - The `autorestic` package has been upgraded from 1.3.0 to 1.5.0 which introduces breaking changes in config file, check [their migration guide](https://autorestic.vercel.app/migration/1.4_1.5) for more details. +- `teleport` has been upgraded to major version 9. Please see upstream [upgrade instructions](https://goteleport.com/docs/setup/operations/upgrading/) and [release notes](https://goteleport.com/docs/changelog/#900). + - For `pkgs.python3.pkgs.ipython`, its direct dependency `pkgs.python3.pkgs.matplotlib-inline` (which is really an adapter to integrate matplotlib in ipython if it is installed) does not depend on `pkgs.python3.pkgs.matplotlib` anymore. @@ -351,8 +585,14 @@ In addition to numerous new and upgraded packages, this release has the followin - `systemd-nspawn@.service` settings have been reverted to the default systemd behaviour. User namespaces are now activated by default. If you want to keep running nspawn containers without user namespaces you need to set `systemd.nspawn.<name>.execConfig.PrivateUsers = false` +- `systemd-shutdown` is now properly linked on shutdown to unmount all filesystems and device mapper devices cleanly. This can be disabled using `systemd.shutdownRamfs.enable`. + - The Tor SOCKS proxy is now actually disabled if `services.tor.client.enable` is set to `false` (the default). If you are using this functionality but didn't change the setting or set it to `false`, you now need to set it to `true`. +- `services.github-runner` has been hardened. Notably address families and + system calls have been restricted, which may adversely affect some kinds of + testing, e.g. using `AF_BLUETOOTH` to test bluetooth devices. + - The terraform 0.12 compatibility has been removed and the `terraform.withPlugins` and `terraform-providers.mkProvider` implementations simplified. Providers now need to be stored under `$out/libexec/terraform-providers/<registry>/<owner>/<name>/<version>/<os>_<arch>/terraform-provider-<name>_v<version>` (which mkProvider does). @@ -373,8 +613,13 @@ In addition to numerous new and upgraded packages, this release has the followin you should change the package you refer to. If you don't need them update your commands from `otelcontribcol` to `otelcorecol` and enjoy a 7x smaller binary. -- `pkgs.pgadmin` now refers to `pkgs.pgadmin4`. - If you still need pgadmin3, use `pkgs.pgadmin3`. +- `services.zookeeper` has a new option `jre` for specifying the JRE to start + zookeeper with. It defaults to the JRE that `pkgs.zookeeper` was wrapped with, + instead of `pkgs.jre`. This changes the JRE to `pkgs.jdk11_headless` by default. + +- `pkgs.pgadmin` now refers to `pkgs.pgadmin4`. `pgadmin3` has been removed. + +- `pkgs.minetestclient_4` and `pkgs.minetestserver_4` have been removed, as the last 4.x release was in 2018. `pkgs.minetestclient` (equivalent to `pkgs.minetest` ) and `pkgs.minetestserver` can be used instead. - `pkgs.noto-fonts-cjk` is now deprecated in favor of `pkgs.noto-fonts-cjk-sans` and `pkgs.noto-fonts-cjk-serif` because they each have different release @@ -425,6 +670,10 @@ In addition to numerous new and upgraded packages, this release has the followin - The `vpnc` package has been changed to use GnuTLS instead of OpenSSL by default for licensing reasons. +- The default version of `nextcloud` is **nextcloud24**. Please note that it's **not** possible to upgrade + `nextcloud` across multiple major versions! This means it's e.g. not possible to upgrade from `nextcloud22` + to `nextcloud24` in a single deploy and most `21.11` users will have to upgrade to `nextcloud23` first. + - `pkgs.vimPlugins.onedark-nvim` now refers to [navarasu/onedark.nvim](https://github.com/navarasu/onedark.nvim) (formerly refers to [olimorris/onedarkpro.nvim](https://github.com/olimorris/onedarkpro.nvim)). @@ -444,6 +693,15 @@ In addition to numerous new and upgraded packages, this release has the followin See the `vscode` package for a more detailed example. +- Existing `resholve*` functions have been renamed and nested under `pkgs.resholve`. Update uses to: + - `resholvePackage` -> `resholve.mkDerivation` + - `resholveScript` -> `resholve.writeScript` + - `resholveScriptBin` -> `resholve.writeScriptBin` + +- `pkgs.cosmopolitan` no longer provides the `cosmoc` command. It has been moved to `pkgs.cosmoc`. + +- `pkgs.graalvmXX-ce` packages no longer provide support for Python/Ruby/WASM, instead focusing only in Java and Native Image Support. If you need to add support back, please see the `pkgs.graalvmCEPackages.mkGraal` function to create your own customized version of GraalVM with support for what you need. + <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. --> ## Other Notable Changes {#sec-release-22.05-notable-changes} @@ -477,6 +735,13 @@ In addition to numerous new and upgraded packages, this release has the followin - The configuration portion of the `nix-daemon` module has been reworked and exposed as [nix.settings](options.html#opt-nix-settings): * Legacy options have been mapped to the corresponding options under under [nix.settings](options.html#opt-nix.settings) and will be deprecated when NixOS 21.11 reaches end of life. * [nix.buildMachines.publicHostKey](options.html#opt-nix.buildMachines.publicHostKey) has been added. + +- [`kops`](https://kops.sigs.k8s.io) defaults to 1.23.2, which will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes >= 1.22. This will increase security by default, but may break some types of workloads. The default behaviour for `spec.kubeDNS.nodeLocalDNS.forwardToKubeDNS` has changed from `true` to `false`. Cilium now has `disable-cnp-status-updates: true` by default. Set this to false if you rely on the CiliumNetworkPolicy status fields. Support for Kubernetes 1.17, the Lyft CNI, Weave CNI on Kubernetes >= 1.23, CentOS 7 and 8, Debian 9, RHEL 7, and Ubuntu 16.05 (Xenial) has been removed. See the [1.22 release notes](https://kops.sigs.k8s.io/releases/1.22-notes/) and [1.23 release notes](https://kops.sigs.k8s.io/releases/1.23-notes/) for more details, including other significant changes. + +- Mattermost has been upgraded to extended support version 6.3 as the previously + packaged extended support version 5.37 is [reaching end of life](https://docs.mattermost.com/upgrade/extended-support-release.html). + Migration may take some time, see the [changelog](https://docs.mattermost.com/install/self-managed-changelog.html#release-v6-3-extended-support-release) + and [important upgrade notes](https://docs.mattermost.com/upgrade/important-upgrade-notes.html). - The `writers.writePyPy2`/`writers.writePyPy3` and corresponding `writers.writePyPy2Bin`/`writers.writePyPy3Bin` convenience functions to create executable Python 2/3 scripts using the PyPy interpreter were added. @@ -485,6 +750,36 @@ In addition to numerous new and upgraded packages, this release has the followin - Support for older versions of hadoop have been added to the module - Overriding and extending site XML files has been made easier +- The auto-upgrade service now accepts persistent (default: true) parameter. + By default auto-upgrade will now run immediately if it would have been triggered at least + once during the time when the timer was inactive. + +- Mastodon now uses `services.redis.servers` to start a new redis server, instead of using a global redis server. + This improves compatibility with other services that use redis. + + Note that this will recreate the redis database, although according to the [Mastodon docs](https://docs.joinmastodon.org/admin/backups/), + this is almost harmless: + > Losing the Redis database is almost harmless: The only irrecoverable data will be the contents of the Sidekiq queues and scheduled retries of previously failed jobs. + > The home and list feeds are stored in Redis, but can be regenerated with tootctl. + + If you do want to save the redis database, you can use the following commands: + ```bash + redis-cli save + cp /var/lib/redis/dump.rdb "/var/lib/redis-mastodon/dump.rdb" + ``` +- Peertube now uses services.redis.servers to start a new redis server, instead of using a global redis server. + This improves compatibility with other services that use redis. + + Redis database is used for storage only cache and job queue. More information can be found here - [Peertube architecture](https://docs.joinpeertube.org/contribute-architecture). + + If you do want to save the redis database, you can use the following commands before upgrade OS: + ```bash + redis-cli save + sudo mkdir /var/lib/redis-peertube + sudo cp /var/lib/redis/dump.rdb /var/lib/redis-peertube/dump.rdb + ``` +- Added the `keter` NixOS module. Keter reverse proxies requests to your loaded application based on virtual hostnames. + - If you are using Wayland you can choose to use the Ozone Wayland support in Chrome and several Electron apps by setting the environment variable `NIXOS_OZONE_WL=1` (for example via @@ -493,6 +788,11 @@ In addition to numerous new and upgraded packages, this release has the followin still under heavy development and behavior is not always flawless. Furthermore, not all Electron apps use the latest Electron versions. +- A new option group `systemd.network.wait-online` was added, with options to configure `systemd-networkd-wait-online.service`: + - `anyInterface` allows specifying that the network should be considered online when *at least one* interface is online (useful on laptops) + - `timeout` defines how long to wait for the network to come online + - `extraArgs` for everything else + - The `influxdb2` package was split into `influxdb2-server` and `influxdb2-cli`, matching the split that took place upstream. A combined `influxdb2` package is still provided in this release for @@ -503,6 +803,8 @@ In addition to numerous new and upgraded packages, this release has the followin - `programs.zsh.autosuggestions.strategy` now takes a list of strings instead of a string. +- The `asterisk` and `asterisk-stable` packages were switched from `asterisk_18` to the newly-packaged `asterisk_19`. Asterisk 13 and 17 have been removed as they have reached their end of life. + - The `services.unifi.openPorts` option default value of `true` is now deprecated and will be changed to `false` in 22.11. Configurations using this default will print a warning when rebuilt. @@ -527,28 +829,52 @@ In addition to numerous new and upgraded packages, this release has the followin e.g. Wayland. - [programs.ssh.knownHosts](#opt-programs.ssh.knownHosts) has gained an `extraHostNames` - option to replace `hostNames`. `hostNames` is deprecated, but still available for now. + option to augment `hostNames`. It is now possible to use the attribute name of a `knownHosts` + entry as the primary host name and specify secondary host names using `extraHostNames` without + having to duplicate the primary host name. - The `services.stubby` module was converted to a [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration. +- The option + [services.xserver.desktopManager.runXdgAutostartIfNone](#opt-services.xserver.desktopManager.runXdgAutostartIfNone) + was added in order to automatically run XDG autostart files for sessions without a desktop manager. + This replaces helpers like the `dex` package. + +- When setting [i18n.inputMethod.enabled](#opt-i18n.inputMethod.enabled) to `fcitx5`, + it no longer creates corresponding systemd user services. + It now relies on XDG autostart files to start and work properly in your desktop sessions. + If you are using only a window manager without a desktop manager, you need to enable + `services.xserver.desktopManager.runXdgAutostartIfNone` or using the `dex` package to make `fcitx5` work. + + - The option `services.duplicati.dataDir` has been added to allow changing the location of duplicati's files. - The options `boot.extraModprobeConfig` and `boot.blacklistedKernelModules` now also take effect in the initrd by copying the file `/etc/modprobe.d/nixos.conf` into the initrd. - `nixos-generate-config` now puts the dhcp configuration in `hardware-configuration.nix` instead of `configuration.nix`. -- ORY Kratos was updated to version 0.8.3-alpha.1.pre.0, which introduces some breaking changes: +- ORY Kratos was updated to version 0.9.0-alpha.3, which introduces some breaking changes: + - All endpoints at the Admin API are now exposed at `/admin/`. For example, endpoint `https://kratos:4434/identities` is now exposed at `https://kratos:4434/admin/identities` + - Configuration key `selfservice.whitelisted_return_urls` has been renamed to `allowed_return_urls` + - The `password_identifier` form field of the password login strategy has been renamed to `identifier` to make compatibility with passwordless flows possible. + - Instead of having a global `default_schema_url` which developers used to update their schema, you now need to define the `default_schema_id` which must reference schema ID in your config. + - Calling `/self-service/recovery` without flow ID or with an invalid flow ID while authenticated will now respond with an error instead of redirecting to the default page. - If you are relying on the SQLite images, update your Docker Pull commands as follows: - `docker pull oryd/kratos:{version}` - Additionally, all passwords now have to be at least 8 characters long. - For more details, see: - [Release Notes for v0.8.1-alpha-1](https://github.com/ory/kratos/releases/tag/v0.8.1-alpha.1) - [Release Notes for v0.8.2-alpha-1](https://github.com/ory/kratos/releases/tag/v0.8.2-alpha.1) + - [Release Notes for v0.9.0-alpha-1](https://github.com/ory/kratos/releases/tag/v0.9.0-alpha.1) + - [Release Notes for v0.9.0-alpha-3](https://github.com/ory/kratos/releases/tag/v0.9.0-alpha.3) + - `fetchFromSourcehut` now allows fetching repositories recursively using `fetchgit` or `fetchhg` if the argument `fetchSubmodules` is set to `true`. +- A module for declarative configuration of openconnect VPN profiles was added under `networking.openconnect`. + - The `element-desktop` package now has an `useKeytar` option (defaults to `true`), which allows disabling `keytar` and in turn `libsecret` usage (which binds to native credential managers / keychain libraries). @@ -565,22 +891,31 @@ In addition to numerous new and upgraded packages, this release has the followin - The default value for `programs.spacefm.settings.graphical_su` got unset. It previously pointed to `gksu` which has been removed. -- A new module was added for the [Starship](https://starship.rs/) shell prompt, - providing the options `programs.starship.enable` and `programs.starship.settings`. - - The [Dino](https://dino.im) XMPP client was updated to 0.3, adding support for audio and video calls. - `services.mattermost.plugins` has been added to allow the declarative installation of Mattermost plugins. Plugins are automatically repackaged using autoPatchelf. -- `services.logrotate.enable` now defaults to true if any rotate path has +- [services.logrotate.enable](#opt-services.logrotate.enable) now defaults to true if any rotate path has been defined, and some paths have been added by default. +- The logrotate module also has been updated to freeform syntax: [services.logrotate.paths](#opt-services.logrotate.paths) + and [services.logrotate.extraConfig](#opt-services.logrotate.extraConfig) will work, but issue deprecation + warnings and [services.logrotate.settings](#opt-services.logrotate.settings) should now be used instead. + +- `security.pam.ussh` has been added, which allows authorizing PAM sessions based on SSH _certificates_ held within an SSH agent, using [pam-ussh](https://github.com/uber/pam-ussh). + +- The `vscode-extensions.ionide.ionide-fsharp` package has been updated to 6.0.0 and now requires .NET 6.0. + +- The `phpPackages.box` package has been updated from 2.7.5 to 3.16.0. See the [upgrade guide](https://github.com/box-project/box/blob/master/UPGRADE.md#from-27-to-30) for more details. - The `zrepl` package has been updated from 0.4.0 to 0.5: - The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume. - A bug involving encrypt-on-receive has been fixed. Read the [zrepl documentation](https://zrepl.github.io/configuration/sendrecvoptions.html#job-recv-options-placeholder) and check the output of `zfs get -r encryption,zrepl:placeholder PATH_TO_ROOTFS` on the receiver. +- The `polybar` package has been updated from 3.5.7 to 3.6.2. See [the changelog](https://github.com/polybar/polybar/releases/tag/3.6.0) for more details. + - Breaking changes include changes to escaping rules in configuration values, changes in behavior when encountering invalid tag names, and changes to inter-process-messaging (IPC). + - Renamed option `services.openssh.challengeResponseAuthentication` to `services.openssh.kbdInteractiveAuthentication`. Reason is that the old name has been deprecated upstream. Using the old option name will still work, but produce a warning. @@ -602,15 +937,59 @@ In addition to numerous new and upgraded packages, this release has the followin - The polkit service, available at `security.polkit.enable`, is now disabled by default. It will automatically be enabled through services and desktop environments as needed. +- `mercury` was updated to 22.01.1, which has some breaking changes ([Mercury 22.01 news](https://dl.mercurylang.org/release/release-notes-22.01.html)). + +- xfsprogs was update to version 5.15, which enables inobtcount and bigtime by default on filesystem creation. Support for these features was added in kernel 5.10 and deemed stable in kernel 5.15. + If you want to be able to mount XFS filesystems created with this release of xfsprogs on kernel releases older than 5.10, you need to format them with `mkfs.xfs -m bigtime=0 -m inobtcount=0`. + +- `services.xserver.desktopManager.xfce` now includes Xfce's screen locker, `xfce4-screensaver` that is enabled by default. You can disable it by setting `false` to [services.xserver.desktopManager.xfce.enableScreensaver](#opt-services.xserver.desktopManager.xfce.enableScreensaver). + - The `hadoop` package has added support for `aarch64-linux` and `aarch64-darwin` as of 3.3.1 ([#158613](https://github.com/NixOS/nixpkgs/pull/158613)). - The `R` package now builds again on `aarch64-darwin` ([#158992](https://github.com/NixOS/nixpkgs/pull/158992)). +- The `nss` package was split into `nss_esr` and `nss_latest`, with `nss` being an alias for `nss_esr`. This was done to ease maintenance of `nss` and dependent high-profile packages like `firefox`. + +- The default `scribus` version is now 1.5, while version 1.4 is still available as `scribus_1_4` ([#172700](https://github.com/NixOS/nixpkgs/pull/172700)). + +- The Nextcloud module now supports to create a Mysql database automatically + with `services.nextcloud.database.createLocally` enabled. + +- The Nextcloud module now allows setting the value of the `max-age` directive of the `Strict-Transport-Security` HTTP header, which is now controlled by the `services.nextcloud.https` option, rather than `services.nginx.recommendedHttpHeaders`. + - The `spark3` package has been updated from 3.1.2 to 3.2.1 ([#160075](https://github.com/NixOS/nixpkgs/pull/160075)): - Testing has been enabled for `aarch64-linux` in addition to `x86_64-linux`. - The `spark3` package is now usable on `aarch64-darwin` as a result of [#158613](https://github.com/NixOS/nixpkgs/pull/158613) and [#158992](https://github.com/NixOS/nixpkgs/pull/158992). -- The `programs.nncp` options were added for generating host-global NNCP configuration. +- The option `services.snapserver.openFirewall` will no longer default to + `true` starting with NixOS 22.11. Enable it explicitly if you need to control + Snapserver remotely or connect streamig clients from other hosts. + +- The option [networking.useDHCP](options.html#opt-networking.useDHCP) isn't deprecated anymore. + When using [`systemd-networkd`](options.html#opt-networking.useNetworkd), a generic + `.network`-unit is added which enables DHCP for each interface matching `en*`, `eth*` + or `wl*` with priority 99 (which means that it doesn't have any effect if such an interface is matched + by a `.network-`unit with a lower priority). In case of scripted networking, no behavior + was changed. + +- The new [`postgresqlTestHook`](https://nixos.org/manual/nixpkgs/stable/#sec-postgresqlTestHook) runs a PostgreSQL server for the duration of package checks. + +- `zfs` was updated from 2.1.4 to 2.1.5, enabling it to be used with Linux kernel 5.18. + +- `stdenv.mkDerivation` now supports a self-referencing `finalAttrs:` parameter + containing the final `mkDerivation` arguments including overrides. + `drv.overrideAttrs` now supports two parameters `finalAttrs: previousAttrs:`. + This allows packaging configuration to be overridden in a consistent manner by + providing an alternative to `rec {}` syntax. + + Additionally, `passthru` can now reference `finalAttrs.finalPackage` containing + the final package, including attributes such as the output paths and + `overrideAttrs`. + + New language integrations can be simplified by overriding a "prototype" + package containing the language-specific logic. This removes the need for a + extra layer of overriding for the "generic builder" arguments, thus removing a + usability problem and source of error. <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. --> diff --git a/nixpkgs/nixos/doc/manual/release-notes/rl-2211.section.md b/nixpkgs/nixos/doc/manual/release-notes/rl-2211.section.md new file mode 100644 index 000000000000..8d9d2679c8f4 --- /dev/null +++ b/nixpkgs/nixos/doc/manual/release-notes/rl-2211.section.md @@ -0,0 +1,175 @@ +# Release 22.11 (“Raccoon”, 2022.11/??) {#sec-release-22.11} + +Support is planned until the end of June 2023, handing over to 23.05. + +## Highlights {#sec-release-22.11-highlights} + +In addition to numerous new and upgraded packages, this release has the following highlights: + +- During cross-compilation, tests are now executed if the test suite can be executed + by the build platform. This is the case when doing “native” cross-compilation + where the build and host platforms are largely the same, but the nixpkgs' cross + compilation infrastructure is used, e.g. `pkgsStatic` and `pkgsLLVM`. Another + possibility is that the build platform is a superset of the host platform, e.g. when + cross-compiling from `x86_64-unknown-linux` to `i686-unknown-linux`. + The predicate gating test suite execution is the newly added `canExecute` + predicate: You can e.g. check if `stdenv.buildPlatform` can execute binaries + built for `stdenv.hostPlatform` (i.e. produced by `stdenv.cc`) by evaluating + `stdenv.buildPlatform.canExecute stdenv.hostPlatform`. + +- The `nixpkgs.hostPlatform` and `nixpkgs.buildPlatform` options have been added. + These cover and override the `nixpkgs.{system,localSystem,crossSystem}` options. + + - `hostPlatform` is the platform or "`system`" string of the NixOS system + described by the configuration. + - `buildPlatform` is the platform that is responsible for building the NixOS + configuration. It defaults to the `hostPlatform`, for a non-cross + build configuration. To cross compile, set `buildPlatform` to a different + value. + + The new options convey the same information, but with fewer options, and + following the Nixpkgs terminology. + + The existing options `nixpkgs.{system,localSystem,crossSystem}` have not + been formally deprecated, to allow for evaluation of the change and to allow + for a transition period so that in time the ecosystem can switch without + breaking compatibility with any supported NixOS release. + +- `nixos-generate-config` now generates configurations that can be built in pure + mode. This is achieved by setting the new `nixpkgs.hostPlatform` option. + + You may have to unset the `system` parameter in `lib.nixosSystem`, or similarly + remove definitions of the `nixpkgs.{system,localSystem,crossSystem}` options. + + Alternatively, you can remove the `hostPlatform` line and use NixOS like you + would in NixOS 22.05 and earlier. + +- PHP now defaults to PHP 8.1, updated from 8.0. + +- Cinnamon has been updated to 5.4. + +- `hardware.nvidia` has a new option `open` that can be used to opt in the opensource version of NVIDIA kernel driver. Note that the driver's support for GeForce and Workstation GPUs is still alpha quality, see [NVIDIA Releases Open-Source GPU Kernel Modules](https://developer.nvidia.com/blog/nvidia-releases-open-source-gpu-kernel-modules/) for the official announcement. + +<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. --> + +## New Services {#sec-release-22.11-new-services} + +- [appvm](https://github.com/jollheef/appvm), Nix based app VMs. Available as [virtualisation.appvm](options.html#opt-virtualisation.appvm.enable). +- [syncstorage-rs](https://github.com/mozilla-services/syncstorage-rs), a self-hostable sync server for Firefox. Available as [services.firefox-syncserver](options.html#opt-services.firefox-syncserver.enable). + +- [dragonflydb](https://dragonflydb.io/), a modern replacement for Redis and Memcached. Available as [services.dragonflydb](#opt-services.dragonflydb.enable). + +- [Komga](https://komga.org/), a free and open source comics/mangas media server. Available as [services.komga](#opt-services.komga.enable). + +- [HBase cluster](https://hbase.apache.org/), a distributed, scalable, big data store. Available as [services.hadoop.hbase](options.html#opt-services.hadoop.hbase.enable). + +- [infnoise](https://github.com/leetronics/infnoise), a hardware True Random Number Generator dongle. + Available as [services.infnoise](options.html#opt-services.infnoise.enable). + +- [kanata](https://github.com/jtroo/kanata), a tool to improve keyboard comfort and usability with advanced customization. + Available as [services.kanata](options.html#opt-services.kanata.enable). + +- [persistent-evdev](https://github.com/aiberia/persistent-evdev), a daemon to add virtual proxy devices that mirror a physical input device but persist even if the underlying hardware is hot-plugged. Available as [services.persistent-evdev](#opt-services.persistent-evdev.enable). + +- [schleuder](https://schleuder.org/), a mailing list manager with PGP support. Enable using [services.schleuder](#opt-services.schleuder.enable). + +- [expressvpn](https://www.expressvpn.com), the CLI client for ExpressVPN. Available as [services.expressvpn](#opt-services.expressvpn.enable). + +- [Grafana Tempo](https://www.grafana.com/oss/tempo/), a distributed tracing store. Available as [services.tempo](#opt-services.tempo.enable). + +- [Patroni](https://github.com/zalando/patroni), a template for PostgreSQL HA with ZooKeeper, etcd or Consul. +Available as [services.patroni](options.html#opt-services.patroni.enable). + +<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. --> + +## Backward Incompatibilities {#sec-release-22.11-incompatibilities} + +- The `isCompatible` predicate checking CPU compatibility is no longer exposed + by the platform sets generated using `lib.systems.elaborate`. In most cases + you will want to use the new `canExecute` predicate instead which also + considers the kernel / syscall interface. It is briefly described in the + release's [highlights section](#sec-release-22.11-highlights). + `lib.systems.parse.isCompatible` still exists, but has changed semantically: + Architectures with differing endianness modes are *no longer considered compatible*. + +- `ngrok` has been upgraded from 2.3.40 to 3.0.4. Please see [the upgrade guide](https://ngrok.com/docs/guides/upgrade-v2-v3) + and [changelog](https://ngrok.com/docs/ngrok-agent/changelog). Notably, breaking changes are that the config file format has + changed and support for single hypen arguments was dropped. + +- `i18n.supportedLocales` is now by default only generated with the locales set in `i18n.defaultLocale` and `i18n.extraLocaleSettings`. + This got partially copied over from the minimal profile and reduces the final system size by up to 200MB. + If you require all locales installed set the option to ``[ "all" ]``. + +- The `isPowerPC` predicate, found on `platform` attrsets (`hostPlatform`, `buildPlatform`, `targetPlatform`, etc) has been removed in order to reduce confusion. The predicate was was defined such that it matches only the 32-bit big-endian members of the POWER/PowerPC family, despite having a name which would imply a broader set of systems. If you were using this predicate, you can replace `foo.isPowerPC` with `(with foo; isPower && is32bit && isBigEndian)`. + +- The `fetchgit` fetcher now uses [cone mode](https://www.git-scm.com/docs/git-sparse-checkout/2.37.0#_internalscone_mode_handling) by default for sparse checkouts. [Non-cone mode](https://www.git-scm.com/docs/git-sparse-checkout/2.37.0#_internalsnon_cone_problems) can be enabled by passing `nonConeMode = true`, but note that non-cone mode is deprecated and this option may be removed alongside a future Git update without notice. + +- `bsp-layout` no longer uses the command `cycle` to switch to other window layouts, as it got replaced by the commands `previous` and `next`. + +- The Barco ClickShare driver/client package `pkgs.clickshare-csc1` and the option `programs.clickshare-csc1.enable` have been removed, + as it requires `qt4`, which reached its end-of-life 2015 and will no longer be supported by nixpkgs. + [According to Barco](https://www.barco.com/de/support/knowledge-base/4380-can-i-use-linux-os-with-clickshare-base-units) many of their base unit models can be used with Google Chrome and the Google Cast extension. + +- `services.hbase` has been renamed to `services.hbase-standalone`. + For production HBase clusters, use `services.hadoop.hbase` instead. + +- PHP 7.4 is no longer supported due to upstream not supporting this + version for the entire lifecycle of the 22.11 release. + +- `pkgs.cosign` does not provide the `cosigned` binary anymore. + +- riak package removed along with `services.riak` module, due to lack of maintainer to update the package. + +- xow package removed along with the `hardware.xow` module, due to the project being deprecated in favor of `xone`, which is available via the `hardware.xone` module. + +- virtlyst package and `services.virtlyst` module removed, due to lack of maintainers. + +- The `services.graphite.api` and `services.graphite.beacon` NixOS options, and + the `python3.pkgs.graphite_api`, `python3.pkgs.graphite_beacon` and + `python3.pkgs.influxgraph` packages, have been removed due to lack of upstream + maintenance. + +- The `meta.mainProgram` attribute of packages in `wineWowPackages` now defaults to `"wine64"`. + +- (Neo)Vim can not be configured with `configure.pathogen` anymore to reduce maintainance burden. +Use `configure.packages` instead. + +- `k3s` no longer supports docker as runtime due to upstream dropping support. + +<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. --> + +## Other Notable Changes {#sec-release-22.11-notable-changes} + +- The `xplr` package has been updated from 0.18.0 to 0.19.0, which brings some breaking changes. See the [upstream release notes](https://github.com/sayanarijit/xplr/releases/tag/v0.19.0) for more details. + +- `github-runner` gained support for ephemeral runners and registrations using a personal access token (PAT) instead of a registration token. See `services.github-runner.ephemeral` and `services.github-runner.tokenFile` for details. + +- A new module was added for the Saleae Logic device family, providing the options `hardware.saleae-logic.enable` and `hardware.saleae-logic.package`. + +- The Redis module now disables RDB persistence when `services.redis.servers.<name>.save = []` instead of using the Redis default. + +- Neo4j was updated from version 3 to version 4. See this [migration guide](https://neo4j.com/docs/upgrade-migration-guide/current/) on how to migrate your Neo4j instance. + +- Matrix Synapse now requires entries in the `state_group_edges` table to be unique, in order to prevent accidentally introducing duplicate information (for example, because a database backup was restored multiple times). If your Synapse database already has duplicate rows in this table, this could fail with an error and require manual remediation. + +- `dockerTools.buildImage` deprecates the misunderstood `contents` parameter, in favor of `copyToRoot`. + Use `copyToRoot = buildEnv { ... };` or similar if you intend to add packages to `/bin`. + +- memtest86+ was updated from 5.00-coreboot-002 to 6.00-beta2. It is now the upstream version from https://www.memtest.org/, as coreboot's fork is no longer available. + +- The udisks2 service, available at `services.udisks2.enable`, is now disabled by default. It will automatically be enabled through services and desktop environments as needed. + This also means that polkit will now actually be disabled by default. The default for `security.polkit.enable` was already flipped in the previous release, but udisks2 being enabled by default re-enabled it. + +- Add udev rules for the Teensy family of microcontrollers. + +- The `pass-secret-service` package now includes systemd units from upstream, so adding it to the NixOS `services.dbus.packages` option will make it start automatically as a systemd user service when an application tries to talk to the libsecret D-Bus API. + +- There is a new module for AMD SEV CPU functionality, which grants access to the hardware. + +- There is a new module for the `thunar` program (the Xfce file manager), which depends on the `xfconf` dbus service, and also has a dbus service and a systemd unit. The option `services.xserver.desktopManager.xfce.thunarPlugins` has been renamed to `programs.thunar.plugins`, and in a future release it may be removed. + +- There is a new module for the `xfconf` program (the Xfce configuration storage system), which has a dbus service. + +- The `nomad` package now defaults to 1.3, which no longer has a downgrade path to releases 1.2 or older. + +<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. --> |