Merge branch 'master' into staging

There were some larger rebuilds because of security.

15 files changed, 242 insertions, 105 deletions

diff --git a/pkgs/servers/caddy/default.nix b/pkgs/servers/caddy/default.nix
index bf0b40e1d7ba..add92f688763 100644
--- a/pkgs/servers/caddy/default.nix
+++ b/pkgs/servers/caddy/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "caddy-${version}";
-  version = "0.9.2";
+  version = "0.9.5";
 
   goPackagePath = "github.com/mholt/caddy";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "mholt";
     repo = "caddy";
     rev = "v${version}";
-    sha256 = "1nmimyykbjfnwbrka50z15d11z0fc6abpkr0cjbj678d5r9wpz33";
+    sha256 = "0z1qjmlxrsiccrl5cb0j4c48ksng4xgp5bgy11gswrijvymsbq2r";
   };
 
   buildFlagsArray = ''
diff --git a/pkgs/servers/caddy/deps.nix b/pkgs/servers/caddy/deps.nix
index d7c974ecb162..49ae8fa09e89 100644
--- a/pkgs/servers/caddy/deps.nix
+++ b/pkgs/servers/caddy/deps.nix
@@ -5,8 +5,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/dustin/go-humanize";
-      rev = "2fcb5204cdc65b4bec9fd0a87606bb0d0e3c54e8";
-      sha256 = "1m2qgn5vh5m66ggmclgikvwc05np2r7sxgpvlj2jip5d61x29j5k";
+      rev = "7a41df006ff9af79a29f0ffa9c5f21fbe6314a2d";
+      sha256 = "0055ir369kz63x9ay0fxqpx2xby8digja6ffbc35vsqjnzfwws18";
     };
   }
   {
@@ -23,8 +23,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/gorilla/websocket";
-      rev = "2d1e4548da234d9cb742cc3628556fef86aafbac";
-      sha256 = "0n7af8pjjmg5rhb3104lyvn966l1p4dfblmy3g9b0plsmnzrz6g5";
+      rev = "0674c7c7968d9fac5f0f678325161ec31df406af";
+      sha256 = "0ql8bsxcc0rjli5cxb0jf22jaq18bd6s4pja7razir3a9zcyn3km";
     };
   }
   {
@@ -32,8 +32,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/hashicorp/go-syslog";
-      rev = "315de0c1920b18b942603ffdc2229e2af4803c17";
-      sha256 = "1z0kinqp8hbl7hw856jhx41ys97rc6hflcgwrkfyxj5fdx60xis6";
+      rev = "b609c7d9de4658cded34a7336b90886c56f9dbdb";
+      sha256 = "1k0dqkizj4vwgdsb7x7fzmcgz9079sczhpn9whd0r3xcnqs7pkkb";
     };
   }
   {
@@ -59,8 +59,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/lucas-clemente/aes12";
-      rev = "8ee5b5610baca43b60ecfad586b3c40d92a96e0c";
-      sha256 = "1lnzrr7f6cyb10gqji6433fvwi8zid0k019m694xyppv4pzgrc93";
+      rev = "25700e67be5c860bcc999137275b9ef8b65932bd";
+      sha256 = "08zbfy5n6ki6fjaihk7y686dwksdglds9c8f1klkldvjbg8mw4vp";
     };
   }
   {
@@ -77,8 +77,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/lucas-clemente/quic-go";
-      rev = "8f7a96dfafd8b03eae5679702a837ed5bdf91327";
-      sha256 = "12qc7y8v3g16q3klh852f3v4yvbcp6h8am1q98ds2c1zay9jl50n";
+      rev = "86e02c4d2c459b70073cd5c39468e8a5a22db45a";
+      sha256 = "16qrkcwllx88f6623ps5p5h62168xs6mcwybbw8862pvb0zkndz0";
     };
   }
   {
@@ -91,21 +91,12 @@
     };
   }
   {
-    goPackagePath = "github.com/mholt/caddy";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mholt/caddy";
-      rev = "73916ccc3069de4720a77b6b817b0bb77bda6b44";
-      sha256 = "1nmimyykbjfnwbrka50z15d11z0fc6abpkr0cjbj678d5r9wpz33";
-    };
-  }
-  {
     goPackagePath = "github.com/miekg/dns";
     fetch = {
       type = "git";
       url = "https://github.com/miekg/dns";
-      rev = "db96a2b759cdef4f11a34506a42eb8d1290c598e";
-      sha256 = "0h5n4psd0p7q55jadgsgz2a1aj791yanrfj76avalh6aawvdpcm6";
+      rev = "ca336a1f95a6b89be9c250df26c7a41742eb4a6f";
+      sha256 = "03yh1zszhspmmq0v22ckw96q8ds2a5s3nd0c6r3p3n165w28z434";
     };
   }
   {
@@ -131,8 +122,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/russross/blackfriday";
-      rev = "35eb537633d9950afc8ae7bdf0edb6134584e9fc";
-      sha256 = "1hwi1nq5kkpcci7lf4fwhs8jj0mf6xcbdz1vgijpfyyd0zr6mphc";
+      rev = "5f33e7b7878355cd2b7e6b8eefc48a5472c69f70";
+      sha256 = "0d7faqxrxvh8hwc1r8gbasgmr8x5blxvzciwspir2yafjfbqy87k";
     };
   }
   {
@@ -149,8 +140,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/xenolf/lego";
-      rev = "82ac43327b01319544c050d5d78a4edeff9565d2";
-      sha256 = "0zs1l4dm0srkx78a7rqq1g8g4yn84c07177zbaa286jqpzgijahi";
+      rev = "f5d538caab6dc0c167d4e32990c79bbf9eff578c";
+      sha256 = "026sjqinb0j4ddfh3rwhhh7a1yjkfdmdr4yflba5syp1hrjf1f37";
     };
   }
   {
@@ -158,8 +149,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/crypto";
-      rev = "6ab629be5e31660579425a738ba8870beb5b7404";
-      sha256 = "1pk98j3wcxkns9whgazhid3if0dnaf57hmq0h6byq75aj9xbncxj";
+      rev = "41d678d1df78cd0410143162dff954e6dc09300f";
+      sha256 = "1gcw2850nghsfi3m98ibsxs8bwqzhdjsgiznrr9ymarzn58v3357";
     };
   }
   {
@@ -167,8 +158,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/net";
-      rev = "f4fe4abe3c785295ddf81c7f1823bcd3bad391b6";
-      sha256 = "0l50x533pj0sj3gnr30zxgm51y4x5a5fwc515zj93iy1z0pyf9cn";
+      rev = "f2499483f923065a842d38eb4c7f1927e6fc6e6d";
+      sha256 = "0q1ps8igfczfafk39hkp8gs57s6qxjvf2c48hiq00p873agz0x7s";
     };
   }
   {
@@ -176,8 +167,8 @@
     fetch = {
       type = "git";
       url = "https://gopkg.in/natefinch/lumberjack.v2";
-      rev = "514cbda263a734ae8caac038dadf05f8f3f9f738";
-      sha256 = "1v92v8vkip36l2fs6l5dpp655151hrijjc781cif658r8nf7xr82";
+      rev = "dd45e6a67c53f673bb49ca8a001fd3a63ceb640e";
+      sha256 = "1fla2mzbwl1lxa9na3xhjmcszn8kiw051xq7i9xzbazzpgf0csg0";
     };
   }
   {
@@ -185,8 +176,8 @@
     fetch = {
       type = "git";
       url = "https://gopkg.in/square/go-jose.v1";
-      rev = "139276ceb5afbf13e636c44e9382f0ca75c12ba3";
-      sha256 = "1f46qka0xzzkbsg01r9c9fi9zlzai7h83mp9hlwg9m5s73h8gzwj";
+      rev = "aa2e30fdd1fe9dd3394119af66451ae790d50e0d";
+      sha256 = "0drajyadd6c4m5qv0jxcv748qczg8sgxz28nva1jn39f234m02is";
     };
   }
   {
@@ -194,8 +185,8 @@
     fetch = {
       type = "git";
       url = "https://gopkg.in/yaml.v2";
-      rev = "31c299268d302dd0aa9a0dcf765a3d58971ac83f";
-      sha256 = "14jkpa8g0s448n2x5qdi05m59ncsdscby1wy2p089zxl9nqavm8h";
+      rev = "14227de293ca979cf205cd88769fe71ed96a97e2";
+      sha256 = "038hnrjcnjygyi3qidfrkpkakis82qg381sr495d2s40g2dwlzah";
     };
   }
 ]
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 9ecd6fe0b9d5..07ba9cef82fb 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -15,10 +15,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    gnutls jansson liburcu lmdb libcap_ng libidn
-    systemd nettle libedit
+    gnutls jansson liburcu lmdb libidn
+    nettle libedit
     # without sphinx &al. for developer documentation
-  ];
+  ]
+    ++ stdenv.lib.optionals stdenv.isLinux [ libcap_ng systemd ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
new file mode 100644
index 000000000000..3c84d0942e76
--- /dev/null
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -0,0 +1,70 @@
+{ stdenv, fetchurl, pkgconfig, utillinux, vimNox, which
+, knot-dns, luajit, libuv, lmdb
+, cmocka, systemd, hiredis, libmemcached
+, gnutls, nettle
+, luajitPackages, makeWrapper
+}:
+
+let
+  inherit (stdenv.lib) optional;
+in
+stdenv.mkDerivation rec {
+  name = "knot-resolver-${version}";
+  version = "1.2.0";
+
+  src = fetchurl {
+    url = "http://secure.nic.cz/files/knot-resolver/${name}.tar.xz";
+    sha256 = "b8828197dbd563e4b502571538c6d44ef2bb07dede1df884b785921f8aec77fd";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  configurePhase = ":";
+
+  nativeBuildInputs = [ pkgconfig which makeWrapper ]
+    ++ [(if stdenv.isLinux then utillinux.bin/*hexdump*/ else vimNox/*xxd*/)];
+
+  buildInputs = [ knot-dns luajit libuv gnutls ]
+    # TODO: lmdb needs lmdb.pc; embedded for now
+    ## optional dependencies
+    ++ optional doInstallCheck cmocka
+    ++ optional stdenv.isLinux systemd # socket activation
+    ++ [
+      nettle # DNS cookies
+      hiredis libmemcached # additional cache backends
+      # http://knot-resolver.readthedocs.io/en/latest/build.html#requirements
+    ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+  CFLAGS = [ "-O2" "-DNDEBUG" ];
+
+  enableParallelBuilding = true;
+
+  doInstallCheck = true;
+  installCheckTarget = "check";
+  preInstallCheck = ''
+    export LD_LIBRARY_PATH="$out/lib"
+  '';
+
+  # optional: to allow auto-bootstrapping root trust anchor via https
+  postInstall = with luajitPackages; ''
+    wrapProgram "$out/sbin/kresd" \
+      --set LUA_PATH '${
+        stdenv.lib.concatStringsSep ";"
+          (map getLuaPath [ luasec luasocket ])
+        }' \
+      --set LUA_CPATH '${
+        stdenv.lib.concatStringsSep ";"
+          (map getLuaCPath [ luasec luasocket ])
+        }'
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Caching validating DNS resolver, from .cz domain registry";
+    homepage = https://knot-resolver.cz;
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.vcunat /* upstream developer */ ];
+  };
+}
+
diff --git a/pkgs/servers/dns/pdns-recursor/default.nix b/pkgs/servers/dns/pdns-recursor/default.nix
new file mode 100644
index 000000000000..70deadb74e14
--- /dev/null
+++ b/pkgs/servers/dns/pdns-recursor/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchurl, pkgconfig, boost
+, openssl, systemd, lua, luajit, protobuf
+, enableLua ? false
+, enableProtoBuf ? false
+}:
+
+assert enableLua      -> lua != null && luajit != null;
+assert enableProtoBuf -> protobuf != null;
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+  name = "pdns-recursor-${version}";
+  version = "4.0.4";
+
+  src = fetchurl {
+    url = "https://downloads.powerdns.com/releases/pdns-recursor-${version}.tar.bz2";
+    sha256 = "0k8y9zxj2lz4rq782vgzr28yd43q0hwlnvszwq0k9l6c967pff13";
+  };
+
+  buildInputs = [
+    boost openssl pkgconfig systemd
+  ] ++ optional enableLua [ lua luajit ]
+    ++ optional enableProtoBuf protobuf;
+
+  configureFlags = [
+    "--enable-reproducible"
+    "--with-systemd"
+  ];
+
+  meta = {
+    description = "A recursive DNS server";
+    homepage = http://www.powerdns.com/;
+    platforms = platforms.linux;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ rnhmjoj ];
+  };
+}
diff --git a/pkgs/servers/freeradius/default.nix b/pkgs/servers/freeradius/default.nix
index cbafe16623ed..117fa8782c9b 100644
--- a/pkgs/servers/freeradius/default.nix
+++ b/pkgs/servers/freeradius/default.nix
@@ -2,9 +2,9 @@
 , openssl
 , linkOpenssl? true
 , openldap
-, withLdap ? false
+, withLdap ? true
 , sqlite
-, withSqlite ? false
+, withSqlite ? true
 , libpcap
 , withPcap ? true
 , libcap
@@ -40,9 +40,16 @@ assert withCollectd -> collectd != null;
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "freeradius-${version}";
-  version = "3.0.11";
+  version = "3.0.12";
 
-  buildInputs = [ autoreconfHook openssl talloc finger_bsd perl ]
+  src = fetchurl {
+    url = "ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-${version}.tar.gz";
+    sha256 = "182xnb9pdsivlyfm471l90m37q9i04h7jadhkgm0ivvzrzpzcnja";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  buildInputs = [ openssl talloc finger_bsd perl ]
     ++ optional withLdap openldap
     ++ optional withSqlite sqlite
     ++ optional withPcap libpcap
@@ -54,8 +61,6 @@ stdenv.mkDerivation rec {
     ++ optional withYubikey libyubikey
     ++ optional withCollectd collectd;
 
-  # NOTE: are the --with-{lib}-lib-dir and --with-{lib}-include-dir necessary with buildInputs ?
-
   configureFlags = [
      "--sysconfdir=/etc"
      "--localstatedir=/var"
@@ -70,11 +75,6 @@ stdenv.mkDerivation rec {
     "localstatedir=\${TMPDIR}"
   ];
 
-  src = fetchurl {
-    url = "ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-${version}.tar.gz";
-    sha256 = "0naxw9b060rbp4409904j6nr2zwl6wbjrbq1839xrwhmaf8p4yxr";
-  };
-
   meta = with stdenv.lib; {
     homepage = http://freeradius.org/;
     description = "A modular, high performance free RADIUS suite";
diff --git a/pkgs/servers/http/nginx/mainline.nix b/pkgs/servers/http/nginx/mainline.nix
index 0e688b0c0c46..5d976a33488c 100644
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix (args // {
-  version = "1.11.8";
-  sha256 = "0d3bcrgj2ykky2yk06y0ihv6832s30mqzcfwq8a560brbmqz7bjk";
+  version = "1.11.9";
+  sha256 = "0j2pcara9ir2xj3m2mjzf7wz46mdy51c0kal61cp0ldm2qgvf8nw";
 })
diff --git a/pkgs/servers/monitoring/munin/default.nix b/pkgs/servers/monitoring/munin/default.nix
index 25ff8ed25fc7..3e4e778e238b 100644
--- a/pkgs/servers/monitoring/munin/default.nix
+++ b/pkgs/servers/monitoring/munin/default.nix
@@ -1,14 +1,16 @@
-{ stdenv, fetchurl, makeWrapper, which, coreutils, rrdtool, perl, perlPackages
+{ stdenv, fetchFromGitHub, makeWrapper, which, coreutils, rrdtool, perl, perlPackages
 , python, ruby, jre, nettools
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.0.29";
+  version = "2.0.30";
   name = "munin-${version}";
 
-  src = fetchurl {
-    url = "https://github.com/munin-monitoring/munin/archive/${version}.tar.gz";
-    sha256 = "1zpv0p10iyx49z1hsqvlkk6hh46hp9dhbrdyx103hgx7p3xnxfnv";
+  src = fetchFromGitHub {
+    owner = "munin-monitoring";
+    repo = "munin";
+    rev = version;
+    sha256 = "1sxsdfq9a5d8b13jigr06gs7n4m3c95645sfyyl49bkfy0n5cxrg";
   };
 
   buildInputs = [ 
diff --git a/pkgs/servers/monitoring/nagios/plugins/official-2.x.nix b/pkgs/servers/monitoring/nagios/plugins/official-2.x.nix
index 306dee0ec627..897182fe225c 100644
--- a/pkgs/servers/monitoring/nagios/plugins/official-2.x.nix
+++ b/pkgs/servers/monitoring/nagios/plugins/official-2.x.nix
@@ -1,12 +1,12 @@
-{ stdenv, fetchurl, openssh }:
+{ stdenv, fetchurl, openssh, openssl }:
 
 stdenv.mkDerivation rec {
   name = "nagios-plugins-${version}";
-  version = "2.1.4";
+  version = "2.2.0";
 
   src = fetchurl {
     url = "http://nagios-plugins.org/download/${name}.tar.gz";
-    sha256 = "146hrpcwciz0niqsv4k5yvkhaggs9mr5v02xnnxp5yp0xpdbama3";
+    sha256 = "074yia04py5y07sbgkvri10dv8nf41kqq1x6kmwqcix5vvm9qyy3";
   };
 
   # !!! Awful hack. Grrr... this of course only works on NixOS.
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   postInstall = "ln -s libexec $out/bin";
 
   # !!! make openssh a runtime dependency only
-  buildInputs = [ openssh ];
+  buildInputs = [ openssh openssl ];
 
   meta = {
     description = "Official plugins for Nagios";
diff --git a/pkgs/servers/monitoring/riemann/default.nix b/pkgs/servers/monitoring/riemann/default.nix
index 5d6534749619..64585de51ff3 100644
--- a/pkgs/servers/monitoring/riemann/default.nix
+++ b/pkgs/servers/monitoring/riemann/default.nix
@@ -1,23 +1,27 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, makeWrapper, jre }:
 
 stdenv.mkDerivation rec {
   name = "riemann-${version}";
-  version = "0.2.9";
+  version = "0.2.12";
 
   src = fetchurl {
-    url = "http://aphyr.com/riemann/${name}.tar.bz2";
-    sha256 = "10zz92sg9ak8g7xsfc05p4kic6hzwj7nqpkjgsd8f7f3slvfjqw3";
+    url = "https://github.com/riemann/riemann/releases/download/${version}/${name}.tar.bz2";
+    sha256 = "1x57gi301rg6faxm4q5scq9dpp0v9nqiwjpsgigdb8whmjr1zwkr";
   };
 
+  nativeBuildInputs = [ makeWrapper ];
+
   phases = [ "unpackPhase" "installPhase" ];
 
   installPhase = ''
-    sed -i 's#lib/riemann.jar#$out/share/java/riemann.jar#' bin/riemann
+    substituteInPlace bin/riemann --replace '$top/lib/riemann.jar' "$out/share/java/riemann.jar"
 
     mkdir -p $out/share/java $out/bin $out/etc
     mv lib/riemann.jar $out/share/java/
     mv bin/riemann $out/bin/
     mv etc/riemann.config $out/etc/
+
+    wrapProgram "$out/bin/riemann" --prefix PATH : "${jre}/bin"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index 996c839acff9..a3c0e3c9226f 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "telegraf-${version}";
-  version = "1.1.2";
+  version = "1.2.0";
 
   goPackagePath = "github.com/influxdata/telegraf";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "${version}";
-    sha256 = "0dgrbdyz261j28wcq636125ha4xmfgh4y9shlg8m1y6jqdqd2zf2";
+    sha256 = "0kijg3j2jnz7jfybycv2scvpsfmxg83jh8wl95p2bw322ypqlks1";
   };
 
   goDeps = ./. + builtins.toPath "/deps-${version}.nix";
diff --git a/pkgs/servers/monitoring/telegraf/deps-1.1.2.nix b/pkgs/servers/monitoring/telegraf/deps-1.2.0.nix
index b62ae44dbc92..a866881e53d9 100644
--- a/pkgs/servers/monitoring/telegraf/deps-1.1.2.nix
+++ b/pkgs/servers/monitoring/telegraf/deps-1.2.0.nix
@@ -199,15 +199,6 @@
     };
   }
   {
-    goPackagePath = "github.com/gonuts/go-shellquote";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gonuts/go-shellquote";
-      rev = "e842a11b24c6abfb3dd27af69a17f482e4b483c2";
-      sha256 = "19lbz7wl241bsyzsv2ai40b2vnj8c9nl107b6jf9gid3i6h0xydg";
-    };
-  }
-  {
     goPackagePath = "github.com/gorilla/context";
     fetch = {
       type = "git";
@@ -307,6 +298,15 @@
     };
   }
   {
+    goPackagePath = "github.com/kballard/go-shellquote";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kballard/go-shellquote";
+      rev = "d8ec1a69a250a17bb0e419c386eac1f3711dc142";
+      sha256 = "1a57hm0zwyi70am670s0pkglnkk1ilddnmfxz1ba7innpkf5z6s7";
+    };
+  }
+  {
     goPackagePath = "github.com/klauspost/crc32";
     fetch = {
       type = "git";
@@ -446,8 +446,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/shirou/gopsutil";
-      rev = "4d0c402af66c78735c5ccf820dc2ca7de5e4ff08";
-      sha256 = "1wkp7chzpz6brq2y0k2mvsf0iaknns279wfsjn5gm6gvih49lqni";
+      rev = "1516eb9ddc5e61ba58874047a98f8b44b5e585e8";
+      sha256 = "1pnl1g2l1y5vmnraq97rbm0nirprqvfzxsp6h4xacn1429jdl5bv";
     };
   }
   {
@@ -491,8 +491,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/wvanbergen/kafka";
-      rev = "46f9a1cf3f670edec492029fadded9c2d9e18866";
-      sha256 = "1czmbilprffdbwnrq4wcllaqknbq91l6p0ni6b55fkaggnwck694";
+      rev = "bc265fedb9ff5b5c5d3c0fdcef4a819b3523d3ee";
+      sha256 = "0x86gnkpsr6gsc6mk2312ay8yqrzscvvdra2knhvwgaws6rzvj2l";
     };
   }
   {
diff --git a/pkgs/servers/search/groonga/default.nix b/pkgs/servers/search/groonga/default.nix
index 8dce24948fe3..6e3ab5a4eaea 100644
--- a/pkgs/servers/search/groonga/default.nix
+++ b/pkgs/servers/search/groonga/default.nix
@@ -1,46 +1,42 @@
 { stdenv, fetchurl, mecab, kytea, libedit, pkgconfig
 , suggestSupport ? false, zeromq, libevent, libmsgpack
-, lz4Support ? false, lz4
+, lz4Support  ? false, lz4
 , zlibSupport ? false, zlib
 }:
 
 stdenv.mkDerivation rec {
 
   name    = "groonga-${version}";
-  version = "6.1.1";
+  version = "6.1.5";
 
   src = fetchurl {
     url    = "http://packages.groonga.org/source/groonga/${name}.tar.gz";
-    sha256 = "03h65gycy0j2q4n5h62x3sw76ibdywdvmiciys5a7ppxb2mncabz";
+    sha256 = "0phh4qp7ky5rw8xgxv3gjzw2cadkjl604xrdyxxbpd30i354sh5x";
   };
 
-  buildInputs = with stdenv.lib; [ pkgconfig mecab kytea libedit ] ++
-    optional lz4Support lz4 ++
-    optional zlibSupport zlib ++
-    optional suggestSupport [ zeromq libevent libmsgpack ];
+  buildInputs = with stdenv.lib;
+     [ pkgconfig mecab kytea libedit ]
+    ++ optional lz4Support lz4
+    ++ optional zlibSupport zlib
+    ++ optionals suggestSupport [ zeromq libevent libmsgpack ];
 
-  configureFlags = with stdenv.lib; ''
-    ${optionalString zlibSupport "--with-zlib"}
-    ${optionalString lz4Support "--with-lz4"}
-  '';
-
-  doInstallCheck = true;
+  configureFlags = with stdenv.lib;
+       optional zlibSupport "--with-zlib"
+    ++ optional lz4Support  "--with-lz4";
 
+  doInstallCheck    = true;
   installCheckPhase = "$out/bin/groonga --version";
 
   meta = with stdenv.lib; {
-    homepage = http://groonga.org/;
+    homepage    = http://groonga.org/;
     description = "An open-source fulltext search engine and column store";
-
+    license     = licenses.lgpl21;
+    maintainers = [ maintainers.ericsagnes ];
+    platforms   = platforms.linux;
     longDescription = ''
       Groonga is an open-source fulltext search engine and column store. 
       It lets you write high-performance applications that requires fulltext search.
     '';
-
-    license = licenses.lgpl21;
-
-    maintainers = [ maintainers.ericsagnes ];
-    platforms = platforms.linux;
   };
 
 }
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index f50a97afd20d..4f64afe3d92b 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -15,11 +15,11 @@ mariadb = everything // {
 };
 
 common = rec { # attributes common to both builds
-  version = "10.1.19";
+  version = "10.1.21";
 
   src = fetchurl {
     url    = "https://downloads.mariadb.org/interstitial/mariadb-${version}/source/mariadb-${version}.tar.gz";
-    sha256 = "108s4mimdbmgmmn5pcr9a405j70cyny9adzv49s75lg22krp74sv";
+    sha256 = "144lcm5awcf0k6a7saqfr4p2kg8r5wbdhdm4cmn2m8hyg1an70as";
   };
 
   prePatch = ''
@@ -161,4 +161,3 @@ everything = stdenv.mkDerivation (common // {
 });
 
 in mariadb
-
diff --git a/pkgs/servers/squid/4.nix b/pkgs/servers/squid/4.nix
new file mode 100644
index 000000000000..52fcad7ff958
--- /dev/null
+++ b/pkgs/servers/squid/4.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchurl, perl, openldap, pam, db, cyrus_sasl, libcap
+, expat, libxml2, openssl }:
+
+stdenv.mkDerivation rec {
+  name = "squid-4.0.17";
+
+  src = fetchurl {
+    url = "http://www.squid-cache.org/Versions/v4/${name}.tar.xz";
+    sha256 = "1713fqw59r3d892p5hpbkhmfcaw6jzfnngfn5f4h46sx963k87wb";
+  };
+
+  buildInputs = [
+    perl openldap pam db cyrus_sasl libcap expat libxml2 openssl
+  ];
+
+  configureFlags = [
+    "--enable-ipv6"
+    "--disable-strict-error-checking"
+    "--disable-arch-native"
+    "--with-openssl"
+    "--enable-ssl-crtd"
+    "--enable-linux-netfilter"
+    "--enable-storeio=ufs,aufs,diskd,rock"
+    "--enable-removal-policies=lru,heap"
+    "--enable-delay-pools"
+    "--enable-x-accelerator-vary"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "A caching proxy for the Web supporting HTTP, HTTPS, FTP, and more";
+    homepage = "http://www.squid-cache.org";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ fpletz raskin ];
+  };
+}