argyllcms: gcc5 compat

nixos-container: Add bash completion for "nixos-container" command

.version

@@ -1 +1 @@
-15.08
+16.03

README.md

@@ -33,8 +33,10 @@ For pull-requests, please rebase onto nixpkgs `master`.
 * [Manual (NixOS)](https://nixos.org/nixos/manual/)
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
 * [Continuous package builds for 14.12 release](https://hydra.nixos.org/jobset/nixos/release-14.12)
+* [Continuous package builds for 15.09 release](https://hydra.nixos.org/jobset/nixos/release-15.09)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
 * [Tests for 14.12 release](https://hydra.nixos.org/job/nixos/release-14.12/tested#tabs-constituents)
+* [Tests for 15.09 release](https://hydra.nixos.org/job/nixos/release-15.09/tested#tabs-constituents)
 
 Communication:
 

doc/haskell-users-guide.xml

@@ -95,7 +95,7 @@ $ nix-env -qaP coreutils
 nixos.coreutils  coreutils-8.23
 </programlisting>
   <para>
-    If your system responds like that (most NixOS installatios will),
+    If your system responds like that (most NixOS installations will),
     then the attribute path to <literal>haskellPackages</literal> is
     <literal>nixos.haskellPackages</literal>. Thus, if you want to
     use <literal>nix-env</literal> without giving an explicit
@@ -119,7 +119,7 @@ $ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A haskell.packages.ghc763
 </programlisting>
   <para>
     The name <literal>haskellPackages</literal> is really just a synonym
-    for <literal>haskell.packages.ghc7101</literal>, because we prefer
+    for <literal>haskell.packages.ghc7102</literal>, because we prefer
     that package set internally and recommend it to our users as their
     default choice, but ultimately you are free to compile your Haskell
     packages with any GHC version you please. The following command
@@ -134,7 +134,7 @@ haskell.compiler.ghc722         ghc-7.2.2
 haskell.compiler.ghc742         ghc-7.4.2
 haskell.compiler.ghc763         ghc-7.6.3
 haskell.compiler.ghc784         ghc-7.8.4
-haskell.compiler.ghc7101        ghc-7.10.1
+haskell.compiler.ghc7102        ghc-7.10.2
 haskell.compiler.ghcHEAD        ghc-7.11.20150402
 haskell.compiler.ghcNokinds     ghc-nokinds-7.11.20150704
 haskell.compiler.ghcjs          ghcjs-0.1.0
@@ -167,7 +167,7 @@ $ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskellPackages.ghc haskellPackages
     <para>
       Instead of the default package set
       <literal>haskellPackages</literal>, you can also use the more
-      precise name <literal>haskell.compiler.ghc7101</literal>, which
+      precise name <literal>haskell.compiler.ghc7102</literal>, which
       has the advantage that it refers to the same GHC version
       regardless of what Nixpkgs considers &quot;default&quot; at any
       given time.
@@ -254,7 +254,7 @@ $ nix-shell -p haskell.compiler.ghc784 --command &quot;cabal configure&quot;
 $ nix-shell -p &quot;haskellPackages.ghcWithPackages (pkgs: [pkgs.mtl])&quot;
 
 [nix-shell:~]$ ghc-pkg list mtl
-/nix/store/zy79...-ghc-7.10.1/lib/ghc-7.10.1/package.conf.d:
+/nix/store/zy79...-ghc-7.10.2/lib/ghc-7.10.2/package.conf.d:
     mtl-2.2.1
 </programlisting>
     <para>
@@ -266,7 +266,7 @@ $ nix-shell -p &quot;haskellPackages.ghcWithPackages (pkgs: [pkgs.mtl])&quot;
 {
   packageOverrides = super: let self = super.pkgs; in
   {
-    myHaskellEnv = self.haskell.packages.ghc7101.ghcWithPackages
+    myHaskellEnv = self.haskell.packages.ghc7102.ghcWithPackages
                      (haskellPackages: with haskellPackages; [
                        # libraries
                        arrows async cgi criterion
@@ -281,7 +281,7 @@ $ nix-shell -p &quot;haskellPackages.ghcWithPackages (pkgs: [pkgs.mtl])&quot;
       <literal>nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA myHaskellEnv</literal>.
       If you'd like to switch that development environment to a
       different version of GHC, just replace the
-      <literal>ghc7101</literal> bit in the previous definition with the
+      <literal>ghc7102</literal> bit in the previous definition with the
       appropriate name. Of course, it's also possible to define any
       number of these development environments! (You can't install two
       of them into the same profile at the same time, though, because
@@ -296,11 +296,11 @@ $ nix-shell -p &quot;haskellPackages.ghcWithPackages (pkgs: [pkgs.mtl])&quot;
     <programlisting>
 $ cat $(type -p ghc)
 #! /nix/store/xlxj...-bash-4.3-p33/bin/bash -e
-export NIX_GHC=/nix/store/19sm...-ghc-7.10.1/bin/ghc
-export NIX_GHCPKG=/nix/store/19sm...-ghc-7.10.1/bin/ghc-pkg
-export NIX_GHC_DOCDIR=/nix/store/19sm...-ghc-7.10.1/share/doc/ghc/html
-export NIX_GHC_LIBDIR=/nix/store/19sm...-ghc-7.10.1/lib/ghc-7.10.1
-exec /nix/store/j50p...-ghc-7.10.1/bin/ghc &quot;-B$NIX_GHC_LIBDIR&quot; &quot;$@&quot;
+export NIX_GHC=/nix/store/19sm...-ghc-7.10.2/bin/ghc
+export NIX_GHCPKG=/nix/store/19sm...-ghc-7.10.2/bin/ghc-pkg
+export NIX_GHC_DOCDIR=/nix/store/19sm...-ghc-7.10.2/share/doc/ghc/html
+export NIX_GHC_LIBDIR=/nix/store/19sm...-ghc-7.10.2/lib/ghc-7.10.2
+exec /nix/store/j50p...-ghc-7.10.2/bin/ghc &quot;-B$NIX_GHC_LIBDIR&quot; &quot;$@&quot;
 </programlisting>
     <para>
       The variables <literal>$NIX_GHC</literal>,
@@ -371,7 +371,7 @@ nix-shell -p &quot;haskellPackages.ghcWithPackages (pkgs: with pkgs; [mtl pandoc
       <literal>shell.nix</literal> that looks like this:
     </para>
     <programlisting>
-{ nixpkgs ? import &lt;nixpkgs&gt; {}, compiler ? &quot;ghc7101&quot; }:
+{ nixpkgs ? import &lt;nixpkgs&gt; {}, compiler ? &quot;ghc7102&quot; }:
 let
   inherit (nixpkgs) pkgs;
   ghc = pkgs.haskell.packages.${compiler}.ghcWithPackages (ps: with ps; [
@@ -451,7 +451,7 @@ $ cabal2nix . &gt;foo.nix
       <literal>default.nix</literal>:
     </para>
     <programlisting>
-{ nixpkgs ? import &lt;nixpkgs&gt; {}, compiler ? &quot;ghc7101&quot; }:
+{ nixpkgs ? import &lt;nixpkgs&gt; {}, compiler ? &quot;ghc7102&quot; }:
 nixpkgs.pkgs.haskell.packages.${compiler}.callPackage ./foo.nix { }
 </programlisting>
     <para>
@@ -459,7 +459,7 @@ nixpkgs.pkgs.haskell.packages.${compiler}.callPackage ./foo.nix { }
       <literal>shell.nix</literal>:
     </para>
     <programlisting>
-{ nixpkgs ? import &lt;nixpkgs&gt; {}, compiler ? &quot;ghc7101&quot; }:
+{ nixpkgs ? import &lt;nixpkgs&gt; {}, compiler ? &quot;ghc7102&quot; }:
 (import ./default.nix { inherit nixpkgs compiler; }).env
 </programlisting>
     <para>
@@ -600,6 +600,12 @@ $ nix-shell &quot;&lt;nixpkgs&gt;&quot; -A haskellPackages.bar.env
   };
 }
 </programlisting>
+    <para>
+        Then, replace instances of <literal>haskellPackages</literal> in the
+        <literal>cabal2nix</literal>-generated <literal>default.nix</literal>
+        or <literal>shell.nix</literal> files with
+        <literal>profiledHaskellPackages</literal>.
+    </para>
   </section>
   <section xml:id="how-to-override-package-versions-in-a-compiler-specific-package-set">
     <title>How to override package versions in a compiler-specific
@@ -755,4 +761,69 @@ export NIX_CFLAGS_LINK=&quot;-L/usr/lib&quot;
   </section>
 </section>
 
+<section xml:id="other-resources">
+  <title>Other resources</title>
+  <itemizedlist>
+    <listitem>
+      <para>
+        The Youtube video
+        <link xlink:href="https://www.youtube.com/watch?v=BsBhi_r-OeE">Nix
+        Loves Haskell</link> provides an introduction into Haskell NG
+        aimed at beginners. The slides are available at
+        http://cryp.to/nixos-meetup-3-slides.pdf and also -- in a form
+        ready for cut &amp; paste -- at
+        https://github.com/NixOS/cabal2nix/blob/master/doc/nixos-meetup-3-slides.md.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Another Youtube video is
+        <link xlink:href="https://www.youtube.com/watch?v=mQd3s57n_2Y">Escaping
+        Cabal Hell with Nix</link>, which discusses the subject of
+        Haskell development with Nix but also provides a basic
+        introduction to Nix as well, i.e. it's suitable for viewers with
+        almost no prior Nix experience.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Oliver Charles wrote a very nice
+        <link xlink:href="http://wiki.ocharles.org.uk/Nix">Tutorial how to
+        develop Haskell packages with Nix</link>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        The <emphasis>Journey into the Haskell NG
+        infrastructure</emphasis> series of postings describe the new
+        Haskell infrastructure in great detail:
+      </para>
+      <itemizedlist>
+        <listitem>
+          <para>
+            <link xlink:href="http://lists.science.uu.nl/pipermail/nix-dev/2015-January/015591.html">Part
+            1</link> explains the differences between the old and the
+            new code and gives instructions how to migrate to the new
+            setup.
+          </para>
+        </listitem>
+        <listitem>
+          <para>
+            <link xlink:href="http://lists.science.uu.nl/pipermail/nix-dev/2015-January/015608.html">Part
+            2</link> looks in-depth at how to tweak and configure your
+            setup by means of overrides.
+          </para>
+        </listitem>
+        <listitem>
+          <para>
+            <link xlink:href="http://lists.science.uu.nl/pipermail/nix-dev/2015-April/016912.html">Part
+            3</link> describes the infrastructure that keeps the
+            Haskell package set in Nixpkgs up-to-date.
+          </para>
+        </listitem>
+      </itemizedlist>
+    </listitem>
+  </itemizedlist>
+</section>
+
 </chapter>

lib/maintainers.nix

@@ -7,6 +7,7 @@
      so it's easy to ping a package @maintainer.
   */
 
+  a1russell = "Adam Russell <adamlr6+pub@gmail.com>";
   abaldeau = "Andreas Baldeau <andreas@baldeau.net>";
   abbradar = "Nikolay Amiantov <ab@fmap.me>";
   adev	   = "Adrien Devresse <adev@adev.name>";
@@ -14,6 +15,7 @@
   aflatter = "Alexander Flatter <flatter@fastmail.fm>";
   aherrmann = "Andreas Herrmann <andreash87@gmx.ch>";
   ak = "Alexander Kjeldaas <ak@formalprivacy.com>";
+  akaWolf = "Artjom Vejsel <akawolf0@gmail.com>";
   akc = "Anders Claesson <akc@akc.is>";
   algorith = "Dries Van Daele <dries_van_daele@telenet.be>";
   all = "Nix Committers <nix-commits@lists.science.uu.nl>";
@@ -67,7 +69,7 @@
   couchemar = "Andrey Pavlov <couchemar@yandex.ru>";
   cstrahan = "Charles Strahan <charles.c.strahan@gmail.com>";
   cwoac = "Oliver Matthews <oliver@codersoffortune.net>";
-  DamienCassou = "Damien Cassou <damien.cassou@gmail.com>";
+  DamienCassou = "Damien Cassou <damien@cassou.me>";
   davidrusu = "David Rusu <davidrusu.me@gmail.com>";
   dbohdan = "Danyil Bohdan <danyil.bohdan@gmail.com>";
   DerGuteMoritz = "Moritz Heidkamp <moritz@twoticketsplease.de>";
@@ -78,6 +80,7 @@
   dfoxfranke = "Daniel Fox Franke <dfoxfranke@gmail.com>";
   dmalikov = "Dmitry Malikov <malikov.d.y@gmail.com>";
   doublec = "Chris Double <chris.double@double.co.nz>";
+  ebzzry = "Rommel Martinez <ebzzry@gmail.com>";
   ederoyd46 = "Matthew Brown <matt@ederoyd.co.uk>";
   eduarrrd = "Eduard Bachmakov <e.bachmakov@gmail.com>";
   edwtjo = "Edward Tjörnhammar <ed@cflags.cc>";
@@ -94,6 +97,7 @@
   fluffynukeit = "Daniel Austin <dan@fluffynukeit.com>";
   forkk = "Andrew Okin <forkk@forkk.net>";
   fpletz = "Franz Pletz <fpletz@fnordicwalking.de>";
+  fridh = "Frederik Rietdijk <fridh@fridh.nl>";
   fro_ozen = "fro_ozen <fro_ozen@gmx.de>";
   ftrvxmtrx = "Siarhei Zirukin <ftrvxmtrx@gmail.com>";
   funfunctor = "Edward O'Callaghan <eocallaghan@alterapraxis.com>";
@@ -103,6 +107,7 @@
   garrison = "Jim Garrison <jim@garrison.cc>";
   gavin = "Gavin Rogers <gavin@praxeology.co.uk>";
   gebner = "Gabriel Ebner <gebner@gebner.org>";
+  gfxmonk = "Tim Cuthbertson <tim@gfxmonk.net>";
   giogadi = "Luis G. Torres <lgtorres42@gmail.com>";
   globin = "Robin Gloster <robin@glob.in>";
   goibhniu = "Cillian de Róiste <cillian.deroiste@gmail.com>";
@@ -123,6 +128,7 @@
   jagajaga = "Arseniy Seroka <ars.seroka@gmail.com>";
   jb55 = "William Casarin <bill@casarin.me>";
   jcumming = "Jack Cummings <jack@mudshark.org>";
+  jefdaj = "Jeffrey David Johnson <jefdaj@gmail.com>";
   jfb = "James Felix Black <james@yamtime.com>";
   jgeerds = "Jascha Geerds <jg@ekby.de>";
   jirkamarsik = "Jirka Marsik <jiri.marsik89@gmail.com>";
@@ -135,12 +141,14 @@
   jwilberding = "Jordan Wilberding <jwilberding@afiniate.com>";
   jzellner = "Jeff Zellner <jeffz@eml.cc>";
   kamilchm = "Kamil Chmielewski <kamil.chm@gmail.com>";
+  khumba = "Bryan Gardiner <bog@khumba.net>";
   kkallio = "Karn Kallio <tierpluspluslists@gmail.com>";
   koral = "Koral <koral@mailoo.org>";
   kovirobi = "Kovacsics Robert <kovirobi@gmail.com>";
   kragniz = "Louis Taylor <kragniz@gmail.com>";
   ktosiek = "Tomasz Kontusz <tomasz.kontusz@gmail.com>";
   lassulus = "Lassulus <lassulus@gmail.com>";
+  layus = "Guillaume Maudoux <layus.on@gmail.com>";
   lebastr = "Alexander Lebedev <lebastr@gmail.com>";
   leonardoce = "Leonardo Cecchi <leonardo.cecchi@gmail.com>";
   lethalman = "Luca Bruno <lucabru@src.gnome.org>";
@@ -150,6 +158,7 @@
   linus = "Linus Arver <linusarver@gmail.com>";
   lnl7 = "Daiderd Jordan <daiderd@gmail.com>";
   lovek323 = "Jason O'Conal <jason@oconal.id.au>";
+  lowfatcomputing = "Andreas Wagner <andreas.wagner@lowfatcomputing.org>";
   lsix = "Lancelot SIX <lsix@lancelotsix.com>";
   ludo = "Ludovic Courtès <ludo@gnu.org>";
   madjar = "Georges Dubus <georges.dubus@compiletoi.net>";
@@ -204,6 +213,7 @@
   pmahoney = "Patrick Mahoney <pat@polycrystal.org>";
   pmiddend = "Philipp Middendorf <pmidden@secure.mailbox.org>";
   prikhi = "Pavan Rikhi <pavan.rikhi@gmail.com>";
+  psibi = "Sibi <sibi@psibi.in>";
   pSub = "Pascal Wittmann <mail@pascal-wittmann.de>";
   puffnfresh = "Brian McKenna <brian@brianmckenna.org>";
   qknight = "Joachim Schiele <js@lastlog.de>";
@@ -224,6 +234,7 @@
   rszibele = "Richard Szibele <richard_szibele@hotmail.com>";
   rushmorem = "Rushmore Mushambi <rushmore@webenchanter.com>";
   rycee = "Robert Helgesson <robert@rycee.net>";
+  samuelrivas = "Samuel Rivas <samuelrivas@gmail.com>";
   sander = "Sander van der Burg <s.vanderburg@tudelft.nl>";
   schmitthenner = "Fabian Schmitthenner <development@schmitthenner.eu>";
   schristo = "Scott Christopher <schristopher@konputa.com>";

nixos/doc/manual/configuration/x-windows.xml

@@ -61,6 +61,12 @@ by default because it’s not free software.  You can enable it as follows:
 <programlisting>
 services.xserver.videoDrivers = [ "nvidia" ];
 </programlisting>
+Or if you have an older card, you may have to use one of the legacy drivers:
+<programlisting>
+services.xserver.videoDrivers = [ "nvidiaLegacy340" ];
+services.xserver.videoDrivers = [ "nvidiaLegacy304" ];
+services.xserver.videoDrivers = [ "nvidiaLegacy173" ];
+</programlisting>
 You may need to reboot after enabling this driver to prevent a clash
 with other kernel modules.</para>
 

nixos/doc/manual/installation/upgrading.xml

@@ -107,4 +107,30 @@ newer Nix version, which may involve an upgrade of Nix’s database
 schema.  This cannot be undone easily, so in that case you will not be
 able to go back to your original channel.</para></warning>
 
+
+<section><title>Automatic Upgrades</title>
+
+<para>You can keep a NixOS system up-to-date automatically by adding
+the following to <filename>configuration.nix</filename>:
+
+<programlisting>
+system.autoUpgrade.enable = true;
+</programlisting>
+
+This enables a periodically executed systemd service named
+<literal>nixos-upgrade.service</literal>. It runs
+<command>nixos-rebuild switch --upgrade</command> to upgrade NixOS to
+the latest version in the current channel. (To see when the service
+runs, see <command>systemctl list-timers</command>.)  You can also
+specify a channel explicitly, e.g.
+
+<programlisting>
+system.autoUpgrade.channel = https://nixos.org/channels/nixos-15.09;
+</programlisting>
+
+</para>
+
+</section>
+
+
 </chapter>

nixos/doc/manual/release-notes/release-notes.xml

@@ -10,6 +10,7 @@
 and current unstable revision.</para>
 
 <xi:include href="rl-unstable.xml" />
+<xi:include href="rl-1509.xml" />
 <xi:include href="rl-1412.xml" />
 <xi:include href="rl-1404.xml" />
 <xi:include href="rl-1310.xml" />

nixos/doc/manual/release-notes/rl-1509.xml

@@ -0,0 +1,231 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-15.09">
+
+<title>Release 15.09 (“Dingo”, 2015/09/??)</title>
+
+<para>In addition to numerous new and upgraded packages, this release has the following highlights:
+
+  <itemizedlist>
+    <listitem>
+      <para>
+        The Haskell packages infrastructure has been re-designed from the ground up.
+        NixOS now distributes the latest version of every single package registered on
+        <link xlink:href="http://hackage.haskell.org/">Hackage</link>, i.e. well over
+        8000 Haskell packages. Further information and usage instructions for the
+        improved infrastructure are available at <link
+        xlink:href="https://nixos.org/wiki/Haskell">https://nixos.org/wiki/Haskell</link>.
+        Users migrating from an earlier release will find also find helpful information
+        below, in the list of backwards-incompatible changes.
+      </para>
+    </listitem>
+
+    <listitem>
+      <para>
+        Users running an SSH server who worry about the quality of their
+        <literal>/etc/ssh/moduli</literal> file with respect to the <link
+        xlink:href="https://stribika.github.io/2015/01/04/secure-secure-shell.html">vulnerabilities
+        discovered in the Diffie-Hellman key exchange</link> can now replace OpenSSH's
+        default version with one they generated themselves using the new
+        <literal>services.openssh.moduliFile</literal> option.
+      </para>
+    </listitem>
+  </itemizedlist>
+
+</para>
+
+
+<para>When upgrading from a previous release, please be aware of the
+following incompatible changes:
+
+<itemizedlist>
+
+<listitem><para><command>sshd</command> no longer supports DSA and ECDSA
+host keys by default. If you have existing systems with such host keys
+and want to continue to use them, please set
+
+<programlisting>
+system.stateVersion = "14.12";
+</programlisting>
+
+(The new option <option>system.stateVersion</option> ensures that
+certain configuration changes that could break existing systems (such
+as the <command>sshd</command> host key setting) will maintain
+compatibility with the specified NixOS release.)</para></listitem>
+
+<listitem><para><command>cron</command> is no longer enabled by
+default, unless you have a non-empty
+<option>services.cron.systemCronJobs</option>. To force
+<command>cron</command> to be enabled, set
+<option>services.cron.enable = true</option>.</para></listitem>
+
+<listitem><para>Nix now requires binary caches to be cryptographically
+signed. If you have unsigned binary caches that you want to continue
+to use, you should set <option>nix.requireSignedBinaryCaches =
+false</option>.</para></listitem>
+
+<listitem><para>Steam now doesn't need root rights to work. Instead of using
+<literal>*-steam-chrootenv</literal>, you should now just run <literal>steam</literal>.
+<literal>steamChrootEnv</literal> package was renamed to <literal>steam</literal>,
+and old <literal>steam</literal> package -- to <literal>steamOriginal</literal>.
+</para></listitem>
+
+<listitem><para>CMPlayer has been renamed to bomi upstream. Package <literal>cmplayer</literal>
+was accordingly renamed to <literal>bomi</literal>
+</para></listitem>
+
+<listitem><para>Atom Shell has been renamed to Electron upstream.  Package <literal>atom-shell</literal>
+was accordingly renamed to <literal>electron</literal>
+</para></listitem>
+
+<listitem><para>Elm is not released on Hackage anymore. You should now use <literal>elmPackages.elm</literal>
+which contains the latest Elm platform.</para></listitem>
+
+<listitem>
+  <para>
+	The CUPS printing service has been updated to version <literal>2.0.2</literal>.
+	Furthermore its systemd service has been renamed to <literal>cups.service</literal>.
+  </para>
+  <para>
+	Local printers are no longer shared or advertised by default. This behavior
+	can be changed by enabling <literal>services.printing.defaultShared</literal>
+	or <literal>services.printing.browsing</literal> respectively.
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    The VirtualBox host and guest options have been moved/renamed more
+    consistently and less confusing to be now found in
+    <literal>virtualisation.virtualbox.host.*</literal> instead of
+    <literal>services.virtualboxHost.*</literal> and
+    <literal>virtualisation.virtualbox.guest.*</literal> instead of
+    <literal>services.virtualboxGuest.*</literal>.
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    Haskell packages can no longer be found by name, i.e. the commands
+    <literal>nix-env -qa cabal-install</literal> and <literal>nix-env -i
+    ghc</literal> will fail, even though we <emphasis>do</emphasis> ship
+    both <literal>cabal-install</literal> and <literal>ghc</literal>.
+    The reason for this inconvenience is the sheer size of the Haskell
+    package set: name-based lookups such as these would become much
+    slower than they are today if we'd add the entire Hackage database
+    into the top level attribute set. Instead, the list of Haskell
+    packages can be displayed by
+  </para>
+  <programlisting>
+nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A haskellPackages
+</programlisting>
+  <para>
+    and packages can be installed with:
+  </para>
+  <programlisting>
+nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskellPackages.cabal-install
+</programlisting>
+</listitem>
+
+<listitem>
+  <para>
+    Previous versions of NixOS came with a feature called
+    <literal>ghc-wrapper</literal>, a small wrapper script that allows
+    GHC to transparently pick up on libraries installed in the user's
+    profile. This feature has been deprecated;
+    <literal>ghc-wrapper</literal> was removed from the distribution.
+    The proper way to register Haskell libraries with the compiler now
+    is the <literal>haskellPackages.ghcWithPackages</literal>
+    function.
+    <link xlink:href="https://nixos.org/wiki/Haskell">https://nixos.org/wiki/Haskell</link>
+    provides much information about this subject.
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    All Haskell builds that have been generated with version 1.x of
+    the <literal>cabal2nix</literal> utility are now invalid and need
+    to be re-generated with a current version of
+    <literal>cabal2nix</literal> to function. The most recent version
+    of this tool can be installed by running
+    <literal>nix-env -i cabal2nix</literal>.
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    The <literal>haskellPackages</literal> set in Nixpkgs used to have a
+    function attribute called <literal>extension</literal> that users
+    could override in their <literal>~/.nixpkgs/config.nix</literal>
+    files to configure additional attributes, etc. That function still
+    exists, but it's now called <literal>overrides</literal>.
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    The OpenBLAS library has been updated to version
+    <literal>0.2.14</literal>. Support for the
+    <literal>x86_64-darwin</literal> platform was added. Dynamic
+    architecture detection was enabled; OpenBLAS now selects
+    microarchitecture-optimized routines at runtime, so optimal
+    performance is achieved without the need to rebuild OpenBLAS
+    locally. OpenBLAS has replaced ATLAS in most packages which use an
+    optimized BLAS or LAPACK implementation.
+ </para>
+</listitem>
+
+<listitem>
+  <para>
+    The <literal>phpfpm</literal> is now using the default PHP version
+    (<literal>pkgs.php</literal>) instead of PHP 5.4 (<literal>pkgs.php54</literal>).
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    The <literal>locate</literal> service no longer indexes the Nix store
+    by default, preventing packages with potentially numerous versions from
+    cluttering the output. Indexing the store can be activated by setting
+    <literal>services.locate.includeStore = true</literal>.
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    The Nix expression search path (<envar>NIX_PATH</envar>) no longer
+    contains <filename>/etc/nixos/nixpkgs</filename> by default. You
+    can override <envar>NIX_PATH</envar> by setting
+    <option>nix.nixPath</option>.
+  </para>
+</listitem>
+
+</itemizedlist>
+</para>
+
+
+<para>The following new services were added since the last release:
+
+<itemizedlist>
+<listitem><para><literal>brltty</literal></para></listitem>
+<listitem><para><literal>marathon</literal></para></listitem>
+<listitem><para><literal>tvheadend</literal></para></listitem>
+</itemizedlist>
+</para>
+
+
+<para>Other notable improvements:
+
+<itemizedlist>
+  <listitem><para>The nixos and nixpkgs channels were unified,
+    so one <emphasis>can</emphasis> use <literal>nix-env -iA nixos.bash</literal>
+    instead of <literal>nix-env -iA nixos.pkgs.bash</literal>.
+    See <link xlink:href="https://github.com/NixOS/nixpkgs/commit/2cd7c1f198">the commit</link> for details.
+  </para></listitem>
+</itemizedlist>
+</para>
+
+</section>

nixos/doc/manual/release-notes/rl-unstable.xml

@@ -4,228 +4,24 @@
          version="5.0"
          xml:id="sec-release-unstable">
 
-<title>Release 15.07 (“Dingo”, 2015/07/??)</title>
-
-<para>In addition to numerous new and upgraded packages, this release has the following highlights:
-
-  <itemizedlist>
-    <listitem>
-      <para>
-        The Haskell packages infrastructure has been re-designed from the ground up.
-        NixOS now distributes the latest version of every single package registered on
-        <link xlink:href="http://hackage.haskell.org/">Hackage</link>, i.e. well over
-        8000 Haskell packages. Further information and usage instructions for the
-        improved infrastructure are available at <link
-        xlink:href="https://nixos.org/wiki/Haskell">https://nixos.org/wiki/Haskell</link>.
-        Users migrating from an earlier release will find also find helpful information
-        below, in the list of backwards-incompatible changes.
-      </para>
-    </listitem>
-
-    <listitem>
-      <para>
-        Users running an SSH server who worry about the quality of their
-        <literal>/etc/ssh/moduli</literal> file with respect to the <link
-        xlink:href="https://stribika.github.io/2015/01/04/secure-secure-shell.html">vulnerabilities
-        discovered in the Diffie-Hellman key exchange</link> can now replace OpenSSH's
-        default version with one they generated themselves using the new
-        <literal>services.openssh.moduliFile</literal> option.
-      </para>
-    </listitem>
-  </itemizedlist>
-
-</para>
-
+<title>Unstable</title>
 
 <para>When upgrading from a previous release, please be aware of the
-following incompatible changes:
+  following incompatible changes:
 
-<itemizedlist>
-
-<listitem><para><command>sshd</command> no longer supports DSA and ECDSA
-host keys by default. If you have existing systems with such host keys
-and want to continue to use them, please set
-
-<programlisting>
-system.stateVersion = "14.12";
-</programlisting>
-
-(The new option <option>system.stateVersion</option> ensures that
-certain configuration changes that could break existing systems (such
-as the <command>sshd</command> host key setting) will maintain
-compatibility with the specified NixOS release.)</para></listitem>
-
-<listitem><para><command>cron</command> is no longer enabled by
-default, unless you have a non-empty
-<option>services.cron.systemCronJobs</option>. To force
-<command>cron</command> to be enabled, set
-<option>services.cron.enable = true</option>.</para></listitem>
-
-<listitem><para>Nix now requires binary caches to be cryptographically
-signed. If you have unsigned binary caches that you want to continue
-to use, you should set <option>nix.requireSignedBinaryCaches =
-false</option>.</para></listitem>
-
-<listitem><para>Steam now doesn't need root rights to work. Instead of using
-<literal>*-steam-chrootenv</literal>, you should now just run <literal>steam</literal>.
-<literal>steamChrootEnv</literal> package was renamed to <literal>steam</literal>,
-and old <literal>steam</literal> package -- to <literal>steamOriginal</literal>.
-</para></listitem>
-
-<listitem><para>CMPlayer has been renamed to bomi upstream. Package <literal>cmplayer</literal>
-was accordingly renamed to <literal>bomi</literal>
-</para></listitem>
-
-<listitem><para>Atom Shell has been renamed to Electron upstream.  Package <literal>atom-shell</literal>
-was accordingly renamed to <literal>electron</literal>
-</para></listitem>
-
-<listitem><para>Elm is not released on Hackage anymore. You should now use <literal>elmPackages.elm</literal>
-which contains the latest Elm platform.</para></listitem>
-
-<listitem>
-  <para>
-	The CUPS printing service has been updated to version <literal>2.0.2</literal>.
-	Furthermore its systemd service has been renamed to <literal>cups.service</literal>.
-  </para>
-  <para>
-	Local printers are no longer shared or advertised by default. This behavior
-	can be changed by enabling <literal>services.printing.defaultShared</literal>
-	or <literal>services.printing.browsing</literal> respectively.
-  </para>
-</listitem>
-
-<listitem>
-  <para>
-    The VirtualBox host and guest options have been moved/renamed more
-    consistently and less confusing to be now found in
-    <literal>virtualisation.virtualbox.host.*</literal> instead of
-    <literal>services.virtualboxHost.*</literal> and
-    <literal>virtualisation.virtualbox.guest.*</literal> instead of
-    <literal>services.virtualboxGuest.*</literal>.
-  </para>
-</listitem>
-
-<listitem>
-  <para>
-    Haskell packages can no longer be found by name, i.e. the commands
-    <literal>nix-env -qa cabal-install</literal> and <literal>nix-env -i
-    ghc</literal> will fail, even though we <emphasis>do</emphasis> ship
-    both <literal>cabal-install</literal> and <literal>ghc</literal>.
-    The reason for this inconvenience is the sheer size of the Haskell
-    package set: name-based lookups such as these would become much
-    slower than they are today if we'd add the entire Hackage database
-    into the top level attribute set. Instead, the list of Haskell
-    packages can be displayed by
-  </para>
-  <programlisting>
-nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A haskellPackages
-</programlisting>
-  <para>
-    and packages can be installed with:
-  </para>
-  <programlisting>
-nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskellPackages.cabal-install
-</programlisting>
-</listitem>
-
-<listitem>
-  <para>
-    Previous versions of NixOS came with a feature called
-    <literal>ghc-wrapper</literal>, a small wrapper script that allows
-    GHC to transparently pick up on libraries installed in the user's
-    profile. This feature has been deprecated;
-    <literal>ghc-wrapper</literal> was removed from the distribution.
-    The proper way to register Haskell libraries with the compiler now
-    is the <literal>haskellPackages.ghcWithPackages</literal>
-    function.
-    <link xlink:href="https://nixos.org/wiki/Haskell">https://nixos.org/wiki/Haskell</link>
-    provides much information about this subject.
-  </para>
-</listitem>
-
-<listitem>
-  <para>
-    All Haskell builds that have been generated with version 1.x of
-    the <literal>cabal2nix</literal> utility are now invalid and need
-    to be re-generated with a current version of
-    <literal>cabal2nix</literal> to function. The most recent version
-    of this tool can be installed by running
-    <literal>nix-env -i cabal2nix</literal>.
-  </para>
-</listitem>
-
-<listitem>
-  <para>
-    The <literal>haskellPackages</literal> set in Nixpkgs used to have a
-    function attribute called <literal>extension</literal> that users
-    could override in their <literal>~/.nixpkgs/config.nix</literal>
-    files to configure additional attributes, etc. That function still
-    exists, but it's now called <literal>overrides</literal>.
-  </para>
-</listitem>
-
-<listitem>
-  <para>
-    The OpenBLAS library has been updated to version
-    <literal>0.2.14</literal>. Support for the
-    <literal>x86_64-darwin</literal> platform was added. Dynamic
-    architecture detection was enabled; OpenBLAS now selects
-    microarchitecture-optimized routines at runtime, so optimal
-    performance is achieved without the need to rebuild OpenBLAS
-    locally. OpenBLAS has replaced ATLAS in most packages which use an
-    optimized BLAS or LAPACK implementation.
- </para>
-</listitem>
-
-<listitem>
-  <para>
-    The <literal>phpfpm</literal> is now using the default PHP version
-    (<literal>pkgs.php</literal>) instead of PHP 5.4 (<literal>pkgs.php54</literal>).
-  </para>
-</listitem>
-
-<listitem>
-  <para>
-    The <literal>locate</literal> service no longer indexes the Nix store
-    by default, preventing packages with potentially numerous versions from
-    cluttering the output. Indexing the store can be activated by setting
-    <literal>services.locate.includeStore = true</literal>.
-  </para>
-</listitem>
-
-<listitem>
-  <para>
-    The Nix expression search path (<envar>NIX_PATH</envar>) no longer
-    contains <filename>/etc/nixos/nixpkgs</filename> by default. You
-    can override <envar>NIX_PATH</envar> by setting
-    <option>nix.nixPath</option>.
-  </para>
-</listitem>
-
-</itemizedlist>
+  <itemizedlist>
+    <listitem><para>
+        <command>wmiiSnap</command> has been replaced with
+        <command>wmii_hg</command>, but
+        <command>services.xserver.windowManager.wmii.enable</command>
+        has been updated respectively so this only affects you if you
+        have explicitly installed <command>wmiiSnap</command>.
+    </para></listitem>
+    <listitem><para>
+        <command>wmiimenu</command> is removed, as it has been removed by
+        the developers upstream. Use <command>wimenu</command> from the
+        <command>wmii-hg</command> package.
+    </para></listitem>
+  </itemizedlist>
 </para>
-
-
-<para>The following new services were added since the last release:
-
-<itemizedlist>
-<listitem><para><literal>brltty</literal></para></listitem>
-<listitem><para><literal>marathon</literal></para></listitem>
-<listitem><para><literal>tvheadend</literal></para></listitem>
-</itemizedlist>
-</para>
-
-
-<para>Other notable improvements:
-
-<itemizedlist>
-  <listitem><para>The nixos and nixpkgs channels were unified,
-    so one <emphasis>can</emphasis> use <literal>nix-env -iA nixos.bash</literal>
-    instead of <literal>nix-env -iA nixos.pkgs.bash</literal>.
-    See <link xlink:href="https://github.com/NixOS/nixpkgs/commit/2cd7c1f198">the commit</link> for details.
-  </para></listitem>
-</itemizedlist>
-</para>
-
 </section>

nixos/lib/eval-config.nix

@@ -54,11 +54,6 @@ in rec {
 
   # These are the extra arguments passed to every module.  In
   # particular, Nixpkgs is passed through the "pkgs" argument.
-  # FIXME: we enable config.allowUnfree to make packages like
-  # nvidia-x11 available. This isn't a problem because if the user has
-  # ‘nixpkgs.config.allowUnfree = false’, then evaluation will fail on
-  # the 64-bit package anyway. However, it would be cleaner to respect
-  # nixpkgs.config here.
   extraArgs = extraArgs_ // {
     inherit modules baseModules;
   };

nixos/modules/config/i18n.nix

@@ -52,6 +52,15 @@ in
         '';
       };
 
+      consoleUseXkbConfig = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          If set, configure the console keymap from the xserver keyboard
+          settings.
+        '';
+      };
+
       consoleKeyMap = mkOption {
         type = mkOptionType {
           name = "string or path";
@@ -74,6 +83,13 @@ in
 
   config = {
 
+    i18n.consoleKeyMap = with config.services.xserver;
+      mkIf config.i18n.consoleUseXkbConfig
+        (pkgs.runCommand "xkb-console-keymap" { preferLocalBuild = true; } ''
+          '${pkgs.ckbcomp}/bin/ckbcomp' -model '${xkbModel}' -layout '${layout}' \
+            -option '${xkbOptions}' -variant '${xkbVariant}' > "$out"
+        '');
+
     environment.systemPackages =
       optional (config.i18n.supportedLocales != []) glibcLocales;
 

nixos/modules/config/system-path.nix

@@ -106,13 +106,19 @@ in
         "/lib"
         "/man"
         "/sbin"
+        "/share/applications"
+        "/share/desktop-directories"
         "/share/doc"
         "/share/emacs"
+        "/share/icons"
         "/share/info"
         "/share/man"
+        "/share/menus"
+        "/share/mime"
         "/share/nano"
         "/share/org"
         "/share/terminfo"
+        "/share/themes"
         "/share/vim-plugins"
       ];
 

nixos/modules/config/users-groups.nix

@@ -216,7 +216,7 @@ let
           exist. If <option>users.mutableUsers</option> is true, the
           password can be changed subsequently using the
           <command>passwd</command> command. Otherwise, it's
-          equivalent to setting the <option>password</option> option.
+          equivalent to setting the <option>hashedPassword</option> option.
 
           ${hashedPasswordDescription}
         '';
@@ -336,13 +336,13 @@ let
     map (range: "${user.name}:${toString range.startUid}:${toString range.count}\n")
       user.subUidRanges);
 
-  subuidFile = concatStrings (map mkSubuidEntry (attrValues cfg.extraUsers));
+  subuidFile = concatStrings (map mkSubuidEntry (attrValues cfg.users));
 
   mkSubgidEntry = user: concatStrings (
     map (range: "${user.name}:${toString range.startGid}:${toString range.count}\n")
         user.subGidRanges);
 
-  subgidFile = concatStrings (map mkSubgidEntry (attrValues cfg.extraUsers));
+  subgidFile = concatStrings (map mkSubgidEntry (attrValues cfg.users));
 
   idsAreUnique = set: idAttr: !(fold (name: args@{ dup, acc }:
     let
@@ -354,8 +354,8 @@ let
       else { dup = false; acc = newAcc; }
     ) { dup = false; acc = {}; } (builtins.attrNames set)).dup;
 
-  uidsAreUnique = idsAreUnique (filterAttrs (n: u: u.uid != null) cfg.extraUsers) "uid";
-  gidsAreUnique = idsAreUnique (filterAttrs (n: g: g.gid != null) cfg.extraGroups) "gid";
+  uidsAreUnique = idsAreUnique (filterAttrs (n: u: u.uid != null) cfg.users) "uid";
+  gidsAreUnique = idsAreUnique (filterAttrs (n: g: g.gid != null) cfg.groups) "gid";
 
   spec = pkgs.writeText "users-groups.json" (builtins.toJSON {
     inherit (cfg) mutableUsers;
@@ -364,13 +364,13 @@ let
           name uid group description home shell createHome isSystemUser
           password passwordFile hashedPassword
           initialPassword initialHashedPassword;
-      }) cfg.extraUsers;
+      }) cfg.users;
     groups = mapAttrsToList (n: g:
       { inherit (g) name gid;
         members = g.members ++ (mapAttrsToList (n: u: u.name) (
-          filterAttrs (n: u: elem g.name u.extraGroups) cfg.extraUsers
+          filterAttrs (n: u: elem g.name u.extraGroups) cfg.users
         ));
-      }) cfg.extraGroups;
+      }) cfg.groups;
   });
 
 in {
@@ -388,10 +388,10 @@ in {
         <literal>groupadd</literal> commands. On system activation, the
         existing contents of the <literal>/etc/passwd</literal> and
         <literal>/etc/group</literal> files will be merged with the
-        contents generated from the <literal>users.extraUsers</literal> and
-        <literal>users.extraGroups</literal> options.
+        contents generated from the <literal>users.users</literal> and
+        <literal>users.groups</literal> options.
         The initial password for a user will be set
-        according to <literal>users.extraUsers</literal>, but existing passwords
+        according to <literal>users.users</literal>, but existing passwords
         will not be changed.
 
         <warning><para>
@@ -399,7 +399,7 @@ in {
         group files will simply be replaced on system activation. This also
         holds for the user passwords; all changed
         passwords will be reset according to the
-        <literal>users.extraUsers</literal> configuration on activation.
+        <literal>users.users</literal> configuration on activation.
         </para></warning>
       '';
     };
@@ -412,7 +412,7 @@ in {
       '';
     };
 
-    users.extraUsers = mkOption {
+    users.users = mkOption {
       default = {};
       type = types.loaOf types.optionSet;
       example = {
@@ -433,7 +433,7 @@ in {
       options = [ userOpts ];
     };
 
-    users.extraGroups = mkOption {
+    users.groups = mkOption {
       default = {};
       example =
         { students.gid = 1001;
@@ -461,7 +461,7 @@ in {
 
   config = {
 
-    users.extraUsers = {
+    users.users = {
       root = {
         uid = ids.uids.root;
         description = "System administrator";
@@ -478,7 +478,7 @@ in {
       };
     };
 
-    users.extraGroups = {
+    users.groups = {
       root.gid = ids.gids.root;
       wheel.gid = ids.gids.wheel;
       disk.gid = ids.gids.disk;
@@ -525,6 +525,27 @@ in {
       { assertion = !cfg.enforceIdUniqueness || (uidsAreUnique && gidsAreUnique);
         message = "UIDs and GIDs must be unique!";
       }
+      { # If mutableUsers is false, to prevent users creating a
+        # configuration that locks them out of the system, ensure that
+        # there is at least one "privileged" account that has a
+        # password or an SSH authorized key. Privileged accounts are
+        # root and users in the wheel group.
+        assertion = !cfg.mutableUsers ->
+          any id (mapAttrsToList (name: cfg:
+            (name == "root"
+             || cfg.group == "wheel"
+             || elem "wheel" cfg.extraGroups)
+            &&
+            ((cfg.hashedPassword != null && cfg.hashedPassword != "!")
+             || cfg.password != null
+             || cfg.passwordFile != null
+             || cfg.openssh.authorizedKeys.keys != []
+             || cfg.openssh.authorizedKeys.keyFiles != [])
+          ) cfg.users);
+        message = ''
+          Neither the root account nor any wheel user has a password or SSH authorized key.
+          You must set one to prevent being locked out of your system.'';
+      }
     ];
 
   };

nixos/modules/misc/extra-arguments.nix

@@ -4,6 +4,11 @@
   _module.args = {
     pkgs_i686 = import ../../.. {
       system = "i686-linux";
+      # FIXME: we enable config.allowUnfree to make packages like
+      # nvidia-x11 available. This isn't a problem because if the user has
+      # ‘nixpkgs.config.allowUnfree = false’, then evaluation will fail on
+      # the 64-bit package anyway. However, it would be cleaner to respect
+      # nixpkgs.config here.
       config.allowUnfree = true;
     };
 

nixos/modules/misc/ids.nix

@@ -229,6 +229,9 @@
       riak = 205;
       shout = 206;
       gateone = 207;
+      namecoin = 208;
+      dnschain = 209;
+      #lxd = 210; # unused
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -436,6 +439,9 @@
       riak = 205;
       #shout = 206; #unused
       gateone = 207;
+      namecoin = 208;
+      #dnschain = 209; #unused
+      lxd = 210; # unused
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal

nixos/modules/misc/version.nix

@@ -75,7 +75,7 @@ with lib;
       mkDefault (if pathExists fn then readFile fn else "master");
 
     # Note: code names must only increase in alphabetical order.
-    system.nixosCodeName = "Dingo";
+    system.nixosCodeName = "Emu";
 
     # Generate /etc/os-release.  See
     # http://0pointer.de/public/systemd-man/os-release.html for the

nixos/modules/module-list.nix

@@ -275,6 +275,7 @@
   ./services/networking/ddclient.nix
   ./services/networking/dhcpcd.nix
   ./services/networking/dhcpd.nix
+  ./services/networking/dnschain.nix
   ./services/networking/dnscrypt-proxy.nix
   ./services/networking/dnsmasq.nix
   ./services/networking/docker-registry-server.nix
@@ -303,6 +304,7 @@
   ./services/networking/minidlna.nix
   ./services/networking/mstpd.nix
   ./services/networking/murmur.nix
+  ./services/networking/namecoind.nix
   ./services/networking/nat.nix
   ./services/networking/networkmanager.nix
   ./services/networking/ngircd.nix
@@ -485,6 +487,7 @@
   ./virtualisation/docker.nix
   ./virtualisation/libvirtd.nix
   ./virtualisation/lxc.nix
+  ./virtualisation/lxd.nix
   ./virtualisation/amazon-options.nix
   ./virtualisation/openvswitch.nix
   ./virtualisation/parallels-guest.nix

nixos/modules/programs/cdemu.nix

@@ -9,19 +9,28 @@ in {
     programs.cdemu = {
       enable = mkOption {
         default = false;
-        description = "Whether to enable cdemu for users of appropriate group (default cdrom)";
+        description = ''
+          <command>cdemu</command> for members of
+          <option>programs.cdemu.group</option>.
+        '';
       };
       group = mkOption {
         default = "cdrom";
-        description = "Required group for users of cdemu";
+        description = ''
+          Group that users must be in to use <command>cdemu</command>.
+        '';
       };
       gui = mkOption {
         default = true;
-        description = "Whether to install cdemu GUI (gCDEmu)";
+        description = ''
+          Whether to install the <command>cdemu</command> GUI (gCDEmu).
+        '';
       };
       image-analyzer = mkOption {
         default = true;
-        description = "Whether to install image analyzer";
+        description = ''
+          Whether to install the image analyzer.
+        '';
       };
     };
   };

nixos/modules/programs/command-not-found/command-not-found.nix

@@ -57,9 +57,9 @@ in
           if [ $? = 126 ]; then
             "$@"
           fi
-	else
+        else
           # Indicate than there was an error so ZSH falls back to its default handler
-	  return 127
+          return 127
         fi
       }
     '';

nixos/modules/programs/command-not-found/command-not-found.pl

@@ -30,11 +30,11 @@ The program ‘$program’ is currently not installed. It is provided by
 the package ‘$package’, which I will now install for you.
 EOF
         ;
-        exit 126 if system("nix-env", "-i", $package) == 0;
+        exit 126 if system("nix-env", "-iA", "nixos.$package") == 0;
     } else {
         print STDERR <<EOF;
 The program ‘$program’ is currently not installed. You can install it by typing:
-  nix-env -i $package
+  nix-env -iA nixos.$package
 EOF
     }
 } else {
@@ -42,7 +42,7 @@ EOF
 The program ‘$program’ is currently not installed. It is provided by
 several packages. You can install it by typing one of the following:
 EOF
-    print STDERR "  nix-env -i $_->{package}\n" foreach @$res;
+    print STDERR "  nix-env -iA nixos.$_->{package}\n" foreach @$res;
 }
 
 exit 127;

nixos/modules/programs/ssh.nix

@@ -18,6 +18,14 @@ let
       exec ${askPassword}
     '';
 
+  knownHosts = map (h: getAttr h cfg.knownHosts) (attrNames cfg.knownHosts);
+
+  knownHostsText = flip (concatMapStringsSep "\n") knownHosts
+    (h: assert h.hostNames != [];
+      concatStringsSep "," h.hostNames + " "
+      + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
+    );
+
 in
 {
   ###### interface
@@ -92,16 +100,76 @@ in
         '';
       };
 
+      knownHosts = mkOption {
+        default = {};
+        type = types.loaOf (types.submodule ({ name, ... }: {
+          options = {
+            hostNames = mkOption {
+              type = types.listOf types.str;
+              default = [];
+              description = ''
+                A list of host names and/or IP numbers used for accessing
+                the host's ssh service.
+              '';
+            };
+            publicKey = mkOption {
+              default = null;
+              type = types.nullOr types.str;
+              example = "ecdsa-sha2-nistp521 AAAAE2VjZHN...UEPg==";
+              description = ''
+                The public key data for the host. You can fetch a public key
+                from a running SSH server with the <command>ssh-keyscan</command>
+                command. The public key should not include any host names, only
+                the key type and the key itself.
+              '';
+            };
+            publicKeyFile = mkOption {
+              default = null;
+              type = types.nullOr types.path;
+              description = ''
+                The path to the public key file for the host. The public
+                key file is read at build time and saved in the Nix store.
+                You can fetch a public key file from a running SSH server
+                with the <command>ssh-keyscan</command> command. The content
+                of the file should follow the same format as described for
+                the <literal>publicKey</literal> option.
+              '';
+            };
+          };
+          config = {
+            hostNames = mkDefault [ name ];
+          };
+        }));
+        description = ''
+          The set of system-wide known SSH hosts.
+        '';
+        example = [
+          {
+            hostNames = [ "myhost" "myhost.mydomain.com" "10.10.1.4" ];
+            publicKeyFile = literalExample "./pubkeys/myhost_ssh_host_dsa_key.pub";
+          }
+          {
+            hostNames = [ "myhost2" ];
+            publicKeyFile = literalExample "./pubkeys/myhost2_ssh_host_dsa_key.pub";
+          }
+        ];
+      };
+
     };
 
   };
 
   config = {
 
-    assertions = singleton
-      { assertion = cfg.forwardX11 -> cfg.setXAuthLocation;
-        message = "cannot enable X11 forwarding without setting XAuth location";
-      };
+    assertions =
+      [ { assertion = cfg.forwardX11 -> cfg.setXAuthLocation;
+          message = "cannot enable X11 forwarding without setting XAuth location";
+        }
+      ] ++ flip mapAttrsToList cfg.knownHosts (name: data: {
+        assertion = (data.publicKey == null && data.publicKeyFile != null) ||
+                    (data.publicKey != null && data.publicKeyFile == null);
+        message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
+      });
 
     # SSH configuration. Slight duplication of the sshd_config
     # generation in the sshd service.
@@ -118,6 +186,8 @@ in
         ${cfg.extraConfig}
       '';
 
+    environment.etc."ssh/ssh_known_hosts".text = knownHostsText;
+
     # FIXME: this should really be socket-activated for über-awesomeness.
     systemd.user.services.ssh-agent =
       { enable = cfg.startAgent;

nixos/modules/rename.nix

@@ -77,6 +77,8 @@ in zipModules ([]
 ++ obsolete [ "environment" "nix" ] [ "nix" "package" ]
 ++ obsolete [ "fonts" "enableFontConfig" ] [ "fonts" "fontconfig" "enable" ]
 ++ obsolete [ "fonts" "extraFonts" ] [ "fonts" "fonts" ]
+++ alias [ "users" "extraUsers" ] [ "users" "users" ]
+++ alias [ "users" "extraGroups" ] [ "users" "groups" ]
 
 ++ obsolete [ "security" "extraSetuidPrograms" ] [ "security" "setuidPrograms" ]
 ++ obsolete [ "networking" "enableWLAN" ] [ "networking" "wireless" "enable" ]
@@ -110,6 +112,7 @@ in zipModules ([]
 ++ obsolete [ "services" "sshd" "permitRootLogin" ] [ "services" "openssh" "permitRootLogin" ]
 ++ obsolete [ "services" "xserver" "startSSHAgent" ] [ "services" "xserver" "startOpenSSHAgent" ]
 ++ obsolete [ "services" "xserver" "startOpenSSHAgent" ] [ "programs" "ssh" "startAgent" ]
+++ alias [ "services" "openssh" "knownHosts" ] [ "programs" "ssh" "knownHosts" ]
 
 # VirtualBox
 ++ obsolete [ "services" "virtualbox" "enable" ] [ "virtualisation" "virtualbox" "guest" "enable" ]
@@ -162,5 +165,6 @@ in zipModules ([]
 ++ obsolete' [ "services" "syslog-ng" "serviceName" ]
 ++ obsolete' [ "services" "syslog-ng" "listenToJournal" ]
 ++ obsolete' [ "ec2" "metadata" ]
+++ obsolete' [ "services" "openvpn" "enable" ]
 
 )

nixos/modules/security/apparmor.nix

@@ -37,13 +37,5 @@ in
          ) cfg.profiles;
        };
      };
-
-     security.pam.services.apparmor.text = ''
-       ## AppArmor changes hats according to `order`: first try user, then
-       ## group, and finally fall back to a hat called "DEFAULT"
-       ##
-       ## For now, enable debugging as this is an experimental feature.
-       session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug
-     '';
    };
 }

nixos/modules/security/pam.nix

@@ -192,6 +192,16 @@ let
         description = "Whether to log authentication failures in <filename>/var/log/faillog</filename>.";
       };
 
+      enableAppArmor = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Enable support for attaching AppArmor profiles at the
+          user/group level, e.g., as part of a role based access
+          control scheme.
+        '';
+      };
+
       text = mkOption {
         type = types.nullOr types.lines;
         description = "Contents of the PAM service file.";
@@ -294,6 +304,8 @@ let
               "session optional ${pkgs.pam}/lib/security/pam_motd.so motd=${motd}"}
           ${optionalString cfg.pamMount
               "session optional ${pkgs.pam_mount}/lib/security/pam_mount.so"}
+          ${optionalString (cfg.enableAppArmor && config.security.apparmor.enable)
+              "session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug"}
         '';
     };
 

nixos/modules/security/prey.nix

@@ -16,19 +16,28 @@ in {
         default = false;
         type = types.bool;
         description = ''
-          Enables http://preyproject.com/ bash client. Be sure to specify api and device keys.
-          Once setup, cronjob will run evert 15 minutes and report status.
+          Enables the <link xlink:href="http://preyproject.com/" />
+          shell client. Be sure to specify both API and device keys.
+          Once enabled, a <command>cron</command> job will run every 15
+          minutes to report status information.
         '';
       };
 
       deviceKey = mkOption {
         type = types.string;
-        description = "Device Key obtained from https://panel.preyproject.com/devices (and clicking on the device)";
+        description = ''
+          <literal>Device key</literal> obtained by visiting
+          <link xlink:href="https://panel.preyproject.com/devices" />
+          and clicking on your device.
+        '';
       };
 
       apiKey = mkOption {
         type = types.string;
-        description = "API key obtained from https://panel.preyproject.com/profile";
+        description = ''
+          <literal>API key</literal> obtained from
+          <link xlink:href="https://panel.preyproject.com/profile" />.
+        '';
       };
     };
 

nixos/modules/services/backup/bacula.nix

@@ -169,14 +169,17 @@ in {
         type = types.bool;
         default = false;
         description = ''
-          Whether to enable Bacula File Daemon.
+          Whether to enable the Bacula File Daemon.
         '';
       };
  
       name = mkOption {
         default = "${config.networking.hostName}-fd";
         description = ''
-        	The client name that must be used by the Director when connecting. Generally, it is a good idea to use a name related to the machine so that error messages can be easily identified if you have multiple Clients. This directive is required.
+          The client name that must be used by the Director when connecting.
+          Generally, it is a good idea to use a name related to the machine
+          so that error messages can be easily identified if you have multiple
+          Clients. This directive is required.
         '';
       };
  
@@ -184,7 +187,9 @@ in {
         default = 9102;
         type = types.int;
         description = ''
-        	This specifies the port number on which the Client listens for Director connections. It must agree with the FDPort specified in the Client resource of the Director's configuration file. The default is 9102.
+          This specifies the port number on which the Client listens for
+          Director connections. It must agree with the FDPort specified in
+          the Client resource of the Director's configuration file.
         '';
       };
  
@@ -202,7 +207,7 @@ in {
         description = ''
           Extra configuration to be passed in Client directive.
         '';
-        example = ''
+        example = literalExample ''
           Maximum Concurrent Jobs = 20;
           Heartbeat Interval = 30;
         '';
@@ -213,7 +218,7 @@ in {
         description = ''
           Extra configuration to be passed in Messages directive.
         '';
-        example = ''
+        example = literalExample ''
           console = all
         '';
       };

nixos/modules/services/backup/sitecopy-backup.nix

@@ -21,15 +21,16 @@ in
       enable = mkOption {
         default = false;
         description = ''
-          Whether to enable sitecopy backups of specified directories.
+          Whether to enable <command>sitecopy</command> backups of specified
+          directories.
         '';
       };
 
       period = mkOption {
         default = "15 04 * * *";
         description = ''
-          This option defines (in the format used by cron) when the
-          sitecopy backup are being run.
+          This option defines (in the format used by <command>cron</command>)
+          when the <command>sitecopy</command> backups are to be run.
           The default is to update at 04:15 (at night) every day.
         '';
       };
@@ -47,9 +48,10 @@ in
         ];
         default = [];
         description = ''
-           List of attributesets describing the backups.
+           List of attribute sets describing the backups.
 
-           Username/password are extracted from <filename>${stateDir}/sitecopy.secrets</filename> at activation
+           Username/password are extracted from
+           <filename>${stateDir}/sitecopy.secrets</filename> at activation
            time. The secrets file lines should have the following structure:
            <screen>
              server username password

nixos/modules/services/cluster/kubernetes.nix

@@ -73,7 +73,7 @@ in {
       };
 
       port = mkOption {
-        description = "Kubernets apiserver listening port.";
+        description = "Kubernetes apiserver listening port.";
         default = 8080;
         type = types.int;
       };
@@ -105,7 +105,7 @@ in {
       tokenAuth = mkOption {
         description = ''
           Kubernetes apiserver token authentication file. See
-          <link xlink:href="https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/authentication.md"/>
+          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/authentication.html"/>
         '';
         default = {};
         example = literalExample ''
@@ -120,7 +120,7 @@ in {
       authorizationMode = mkOption {
         description = ''
           Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC). See
-          <link xlink:href="https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/authorization.md"/>
+          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/authorization.html"/>
         '';
         default = "AlwaysAllow";
         type = types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC"];
@@ -129,7 +129,7 @@ in {
       authorizationPolicy = mkOption {
         description = ''
           Kubernetes apiserver authorization policy file. See
-          <link xlink:href="https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/authorization.md"/>
+          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/authorization.html"/>
         '';
         default = [];
         example = literalExample ''
@@ -159,18 +159,37 @@ in {
       };
 
       runtimeConfig = mkOption {
-        description = "Api runtime configuration";
+        description = ''
+          Api runtime configuration. See
+          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/cluster-management.html"/>
+        '';
         default = "";
         example = "api/all=false,api/v1=true";
         type = types.str;
       };
 
       admissionControl = mkOption {
-        description = "Kubernetes admission control plugins to use.";
+        description = ''
+          Kubernetes admission control plugins to use. See
+          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/admission-controllers.html"/>
+        '';
         default = ["AlwaysAdmit"];
+        example = [
+          "NamespaceLifecycle" "NamespaceExists" "LimitRanger"
+          "SecurityContextDeny" "ServiceAccount" "ResourceQuota"
+        ];
         type = types.listOf types.str;
       };
 
+      serviceAccountKey = mkOption {
+        description = ''
+          Kubernetes apiserver PEM-encoded x509 RSA private or public key file,
+          used to verify ServiceAccount tokens.
+        '';
+        default = null;
+        type = types.nullOr types.path;
+      };
+
       extraOpts = mkOption {
         description = "Kubernetes apiserver extra command line options.";
         default = "";
@@ -192,7 +211,7 @@ in {
       };
 
       port = mkOption {
-        description = "Kubernets scheduler listening port.";
+        description = "Kubernetes scheduler listening port.";
         default = 10251;
         type = types.int;
       };
@@ -224,7 +243,7 @@ in {
       };
 
       port = mkOption {
-        description = "Kubernets controller manager listening port.";
+        description = "Kubernetes controller manager listening port.";
         default = 10252;
         type = types.int;
       };
@@ -235,8 +254,26 @@ in {
         type = types.str;
       };
 
+      serviceAccountPrivateKey = mkOption {
+        description = ''
+          Kubernetes controller manager PEM-encoded private RSA key file used to
+          sign service account tokens
+        '';
+        default = null;
+        type = types.nullOr types.path;
+      };
+
+      rootCaFile = mkOption {
+        description = ''
+          Kubernetes controller manager certificate authority file included in
+          service account's token secret.
+        '';
+        default = null;
+        type = types.nullOr types.path;
+      };
+
       extraOpts = mkOption {
-        description = "Kubernetes controller extra command line options.";
+        description = "Kubernetes controller manager extra command line options.";
         default = "";
         type = types.str;
       };
@@ -262,7 +299,7 @@ in {
       };
 
       port = mkOption {
-        description = "Kubernets kubelet info server listening port.";
+        description = "Kubernetes kubelet info server listening port.";
         default = 10250;
         type = types.int;
       };
@@ -294,7 +331,10 @@ in {
       };
 
       apiServers = mkOption {
-        description = "Kubernetes kubelet list of Kubernetes API servers for publishing events, and reading pods and services.";
+        description = ''
+          Kubernetes kubelet list of Kubernetes API servers for publishing events,
+          and reading pods and services.
+        '';
         default = ["${cfg.apiserver.address}:${toString cfg.apiserver.port}"];
         type = types.listOf types.str;
       };
@@ -413,17 +453,14 @@ in {
             ${optionalString (cfg.apiserver.runtimeConfig!="")
               "--runtime-config=${cfg.apiserver.runtimeConfig}"} \
             --admission_control=${concatStringsSep "," cfg.apiserver.admissionControl} \
+            ${optionalString (cfg.apiserver.serviceAccountKey!=null)
+              "--service-account-key-file=${cfg.apiserver.serviceAccountKey}"} \
             --logtostderr=true \
             ${optionalString cfg.verbose "--v=6 --log-flush-frequency=1s"} \
             ${cfg.apiserver.extraOpts}
           '';
           User = "kubernetes";
         };
-        postStart = ''
-          until ${pkgs.curl}/bin/curl -s -o /dev/null 'http://${cfg.apiserver.address}:${toString cfg.apiserver.port}/'; do
-            sleep 1;
-          done
-        '';
       };
     })
 
@@ -456,6 +493,10 @@ in {
             --address=${cfg.controllerManager.address} \
             --port=${toString cfg.controllerManager.port} \
             --master=${cfg.controllerManager.master} \
+            ${optionalString (cfg.controllerManager.serviceAccountPrivateKey!=null)
+              "--service-account-private-key-file=${cfg.controllerManager.serviceAccountPrivateKey}"} \
+            ${optionalString (cfg.controllerManager.rootCaFile!=null)
+              "--root-ca-file=${cfg.controllerManager.rootCaFile}"} \
             --logtostderr=true \
             ${optionalString cfg.verbose "--v=6 --log-flush-frequency=1s"} \
             ${cfg.controllerManager.extraOpts}
@@ -509,6 +550,8 @@ in {
             ${optionalString cfg.verbose "--v=6 --log-flush-frequency=1s"} \
             ${cfg.proxy.extraOpts}
           '';
+          Restart = "always"; # Retry connection
+          RestartSec = "5s";
         };
       };
     })

nixos/modules/services/databases/mysql.nix

@@ -167,6 +167,12 @@ in
 
         unitConfig.RequiresMountsFor = "${cfg.dataDir}";
 
+        path = [
+          # Needed for the mysql_install_db command in the preStart script
+          # which calls the hostname command.
+          pkgs.nettools
+        ];
+
         preStart =
           ''
             if ! test -e ${cfg.dataDir}/mysql; then

nixos/modules/services/hardware/brltty.nix

@@ -4,10 +4,6 @@ with lib;
 
 let
   cfg = config.services.brltty;
-  
-  stateDir = "/run/brltty";
-
-  pidFile = "${stateDir}/brltty.pid";
 
 in {
 
@@ -24,14 +20,24 @@ in {
   config = mkIf cfg.enable {
 
     systemd.services.brltty = {
-      description = "Braille console driver";
-      preStart = ''
-        mkdir -p ${stateDir}
-      '';
+      description = "Braille Device Support";
+      unitConfig = {
+        Documentation = "http://mielke.cc/brltty/";
+        DefaultDependencies = "no";
+        RequiresMountsFor = "${pkgs.brltty}/var/lib/brltty";
+      };
       serviceConfig = {
-        ExecStart = "${pkgs.brltty}/bin/brltty --pid-file=${pidFile}";
-        Type = "forking";
-        PIDFile = pidFile;
+        ExecStart = "${pkgs.brltty}/bin/brltty --no-daemon";
+        Type = "simple";        # Change to notidy after next releae
+        TimeoutStartSec = 5;
+        TimeoutStopSec = 10;
+        Restart = "always";
+        RestartSec = 30;
+        Nice = -10;
+        OOMScoreAdjust = -900;
+        ProtectHome = "read-only";
+        ProtectSystem = "full";
+        SystemCallArchitectures = "native";
       };
       before = [ "sysinit.target" ];
       wantedBy = [ "sysinit.target" ];

nixos/modules/services/hardware/freefall.nix

@@ -2,40 +2,42 @@
 
 with lib;
 
-{
+let
 
-  ###### interface
+  cfg = config.services.freefall;
 
-  options = with types; {
+in {
 
-    services.freefall = {
+  options.services.freefall = {
 
-      enable = mkOption {
-        default = false;
-        description = ''
-          Whether to protect HP/Dell laptop hard drives (not SSDs) in free fall.
-        '';
-        type = bool;
-      };
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to protect HP/Dell laptop hard drives (not SSDs) in free fall.
+      '';
+    };
 
-      devices = mkOption {
-        default = [ "/dev/sda" ];
-        description = ''
-          Device paths to all internal spinning hard drives.
-        '';
-        type = listOf string;
-      };
+    package = mkOption {
+      type = types.package;
+      default = pkgs.freefall;
+      description = ''
+        freefall derivation to use.
+      '';
+    };
 
+    devices = mkOption {
+      type = types.listOf types.string;
+      default = [ "/dev/sda" ];
+      description = ''
+        Device paths to all internal spinning hard drives.
+      '';
     };
 
   };
 
-  ###### implementation
-
   config = let
 
-    cfg = config.services.freefall;
-
     mkService = dev:
       assert dev != "";
       let dev' = utils.escapeSystemdPath dev; in
@@ -43,12 +45,8 @@ with lib;
         description = "Free-fall protection for ${dev}";
         after = [ "${dev'}.device" ];
         wantedBy = [ "${dev'}.device" ];
-        path = [ pkgs.freefall ];
-        unitConfig = {
-          DefaultDependencies = false;
-        };
         serviceConfig = {
-          ExecStart = "${pkgs.freefall}/bin/freefall ${dev}";
+          ExecStart = "${cfg.package}/bin/freefall ${dev}";
           Restart = "on-failure";
           Type = "forking";
         };
@@ -56,9 +54,9 @@ with lib;
 
   in mkIf cfg.enable {
 
-    environment.systemPackages = [ pkgs.freefall ];
+    environment.systemPackages = [ cfg.package ];
 
-    systemd.services = listToAttrs (map mkService cfg.devices);
+    systemd.services = builtins.listToAttrs (map mkService cfg.devices);
 
   };
 

nixos/modules/services/hardware/udev.nix

@@ -180,9 +180,7 @@ in
         firmware to function).  If multiple packages contain firmware
         files with the same name, the first package in the list takes
         precedence.  Note that you must rebuild your system if you add
-        files to any of these directories.  For quick testing,
-        put firmware files in <filename>/root/test-firmware</filename>
-        and add that directory to the list.
+        files to any of these directories.
       '';
       apply = list: pkgs.buildEnv {
         name = "firmware";

nixos/modules/services/logging/logstash.nix

@@ -132,6 +132,7 @@ in
       description = "Logstash Daemon";
       wantedBy = [ "multi-user.target" ];
       environment = { JAVA_HOME = jre; };
+      path = [ pkgs.bash ];
       serviceConfig = {
         ExecStart =
           "${cfg.package}/bin/logstash agent " +

nixos/modules/services/mail/mlmmj.nix

@@ -14,7 +14,7 @@ let
   alias = domain: list: "${list}: \"|${pkgs.mlmmj}/bin/mlmmj-receive -L ${listDir domain list}/\"";
   subjectPrefix = list: "[${list}]";
   listAddress = domain: list: "${list}@${domain}";
-  customHeaders = list: domain: [ "List-Id: ${list}" "Reply-To: ${list}@${domain}" ];
+  customHeaders = domain: list: [ "List-Id: ${list}" "Reply-To: ${list}@${domain}" ];
   footer = domain: list: "To unsubscribe send a mail to ${list}+unsubscribe@${domain}";
   createList = d: l: ''
     ${pkgs.coreutils}/bin/mkdir -p ${listCtl d l}
@@ -90,14 +90,15 @@ in
       enable = true;
       recipientDelimiter= "+";
       extraMasterConf = ''
-        mlmmj unix - n n - - pipe flags=ORhu user=mlmmj argv=${pkgs.mlmmj}/bin/mlmmj-receive -F -L ${spoolDir}/$nextHop
+        mlmmj unix - n n - - pipe flags=ORhu user=mlmmj argv=${pkgs.mlmmj}/bin/mlmmj-receive -F -L ${spoolDir}/$nexthop
       '';
 
       extraAliases = concatMapStrings (alias cfg.listDomain) cfg.mailLists;
 
       extraConfig = ''
-        transport = hash:${stateDir}/transports
-        virtual = hash:${stateDir}/virtuals
+        transport_maps = hash:${stateDir}/transports
+        virtual_alias_maps = hash:${stateDir}/virtuals
+        propagate_unmatched_extensions = virtual
       '';
     };
 
@@ -108,9 +109,10 @@ in
           ${pkgs.coreutils}/bin/chown -R ${cfg.user}:${cfg.group} ${spoolDir}
           ${lib.concatMapStrings (createList cfg.listDomain) cfg.mailLists}
           echo ${lib.concatMapStrings (virtual cfg.listDomain) cfg.mailLists} > ${stateDir}/virtuals
-          echo ${cfg.listDomain} mailman: > ${stateDir}/transports
-          echo ${lib.concatMapStrings (transport cfg.listDomain) cfg.mailLists} >> ${stateDir}/transports
-    '';
+          echo ${lib.concatMapStrings (transport cfg.listDomain) cfg.mailLists} > ${stateDir}/transports
+          ${pkgs.postfix}/bin/postmap ${stateDir}/virtuals
+          ${pkgs.postfix}/bin/postmap ${stateDir}/transports
+      '';
 
     systemd.services."mlmmj-maintd" = {
       description = "mlmmj maintenance daemon";

nixos/modules/services/misc/confd.nix

@@ -63,7 +63,7 @@ in {
 
     package = mkOption {
       description = "Confd package to use.";
-      default = pkgs.goPackages.confd;
+      default = pkgs.confd;
       type = types.package;
     };
   };

nixos/modules/services/misc/gitit.nix

@@ -99,7 +99,7 @@ let
       };
 
       authenticationMethod = mkOption {
-        type = types.enum [ "form" "http" "generic"];
+        type = types.enum [ "form" "http" "generic" "github" ];
         default = "form";
         description = ''
           'form' means that users will be logged in and registered using forms
@@ -537,6 +537,42 @@ video/x-ms-wmx  wmx
           through xss-sanitize.  Set to no only if you trust all of your users.
         '';
       };
+
+      oauthClientId = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = "OAuth client ID";
+      };
+
+      oauthClientSecret = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = "OAuth client secret";
+      };
+
+      oauthCallback = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = "OAuth callback URL";
+      };
+
+      oauthAuthorizeEndpoint = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = "OAuth authorize endpoint";
+      };
+
+      oauthAccessTokenEndpoint = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = "OAuth access token endpoint";
+      };
+
+      githubOrg = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = "Github organization";
+      };
   };
 
   configFile = pkgs.writeText "gitit.conf" ''
@@ -587,6 +623,14 @@ video/x-ms-wmx  wmx
     pdf-export: ${toYesNo cfg.pdfExport}
     pandoc-user-data: ${toString cfg.pandocUserData}
     xss-sanitize: ${toYesNo cfg.xssSanitize}
+
+    [Github]
+    oauthclientid: ${toString cfg.oauthClientId}
+    oauthclientsecret: ${toString cfg.oauthClientSecret}
+    oauthcallback: ${toString cfg.oauthCallback}
+    oauthauthorizeendpoint: ${toString cfg.oauthAuthorizeEndpoint}
+    oauthaccesstokenendpoint: ${toString cfg.oauthAccessTokenEndpoint}
+    github-org: ${toString cfg.githubOrg}
   '';
 
 in
@@ -681,4 +725,3 @@ NAMED
     };
   };
 }
-

nixos/modules/services/misc/nix-gc.nix

@@ -52,7 +52,7 @@ in
 
     systemd.services.nix-gc =
       { description = "Nix Garbage Collector";
-        script = "exec ${config.nix.package}/bin/nix-store --gc ${cfg.options}";
+        script = "exec ${config.nix.package}/bin/nix-collect-garbage ${cfg.options}";
         startAt = optionalString cfg.automatic cfg.dates;
       };
 

nixos/modules/services/monitoring/bosun.nix

@@ -30,6 +30,7 @@ in {
 
       package = mkOption {
         type = types.package;
+        default = pkgs.bosun;
         example = literalExample "pkgs.bosun";
         description = ''
           bosun binary to use.
@@ -95,8 +96,6 @@ in {
 
   config = mkIf cfg.enable {
   
-    services.bosun.package = mkDefault pkgs.bosun; 
-
     systemd.services.bosun = {
       description = "bosun metrics collector (part of Bosun)";
       wantedBy = [ "multi-user.target" ];

nixos/modules/services/monitoring/grafana.nix

@@ -200,13 +200,13 @@ in {
 
     staticRootPath = mkOption {
       description = "Root path for static assets.";
-      default = "${cfg.package}/share/go/src/github.com/grafana/grafana/public";
+      default = "${cfg.package.out}/share/go/src/github.com/grafana/grafana/public";
       type = types.str;
     };
 
     package = mkOption {
       description = "Package to use.";
-      default = pkgs.goPackages.grafana;
+      default = pkgs.grafana;
       type = types.package;
     };
 
@@ -319,7 +319,7 @@ in {
       wantedBy = ["multi-user.target"];
       after = ["networking.target"];
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/grafana --config ${cfgFile} web";
+        ExecStart = "${cfg.package-backend}/bin/grafana --config ${cfgFile} web";
         WorkingDirectory = cfg.dataDir;
         User = "grafana";
       };

nixos/modules/services/network-filesystems/nfsd.nix

@@ -88,10 +88,7 @@ in
 
     environment.systemPackages = [ pkgs.nfs-utils ];
 
-    environment.etc = singleton
-      { source = exports;
-        target = "exports";
-      };
+    environment.etc.exports.source = exports;
 
     boot.kernelModules = [ "nfsd" ];
 

nixos/modules/services/network-filesystems/samba.nix

@@ -97,8 +97,8 @@ in
         description = ''
           Enabling this will add a line directly after pam_unix.so.
           Whenever a password is changed the samba password will be updated as well.
-          However you still yave to add the samba password once using smbpasswd -a user
-          If you don't want to maintain an extra pwd database you still can send plain text
+          However, you still have to add the samba password once, using smbpasswd -a user.
+          If you don't want to maintain an extra password database, you still can send plain text
           passwords which is not secure.
         '';
       };

nixos/modules/services/networking/bitlbee.nix

@@ -16,11 +16,12 @@ let
     ''
     [settings]
     RunMode = Daemon
-    User = bitlbee  
+    User = bitlbee
     ConfigDir = ${cfg.configDir}
     DaemonInterface = ${cfg.interface}
     DaemonPort = ${toString cfg.portNumber}
     AuthMode = ${cfg.authMode}
+    Plugindir = ${pkgs.bitlbee-plugins cfg.plugins}/lib/bitlbee
     ${lib.optionalString (cfg.hostName != "") "HostName = ${cfg.hostName}"}
     ${lib.optionalString (cfg.protocols != "") "Protocols = ${cfg.protocols}"}
     ${cfg.extraSettings}
@@ -72,7 +73,7 @@ in
             Open -- Accept connections from anyone, use NickServ for user authentication.
             Closed -- Require authorization (using the PASS command during login) before allowing the user to connect at all.
             Registered -- Only allow registered users to use this server; this disables the register- and the account command until the user identifies himself.
-        ''; 
+        '';
       };
 
       hostName = mkOption {
@@ -85,6 +86,15 @@ in
         '';
       };
 
+      plugins = mkOption {
+        type = types.listOf types.package;
+        default = [];
+        example = literalExample "[ pkgs.bitlbee-facebook ]";
+        description = ''
+          The list of bitlbee plugins to install.
+        '';
+      };
+
       configDir = mkOption {
         default = "/var/lib/bitlbee";
         type = types.path;
@@ -107,14 +117,14 @@ in
         default = "";
         description = ''
           Will be inserted in the Settings section of the config file.
-        ''; 
+        '';
       };
 
       extraDefaults = mkOption {
         default = "";
         description = ''
           Will be inserted in the Default section of the config file.
-        ''; 
+        '';
       };
 
     };
@@ -138,7 +148,7 @@ in
         gid = config.ids.gids.bitlbee;
       };
 
-    systemd.services.bitlbee = 
+    systemd.services.bitlbee =
       { description = "BitlBee IRC to other chat networks gateway";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];

nixos/modules/services/networking/connman.nix

@@ -5,7 +5,12 @@ with lib;
 
 let
   cfg = config.networking.connman;
+  configFile = pkgs.writeText "connman.conf" ''
+    [General]
+    NetworkInterfaceBlacklist=${concatStringsSep "," cfg.networkInterfaceBlacklist}
 
+    ${cfg.extraConfig}
+  '';
 in {
 
   ###### interface
@@ -22,6 +27,23 @@ in {
         '';
       };
 
+      extraConfig = mkOption {
+        type = types.lines;
+        default = ''
+        '';
+        description = ''
+          Configuration lines appended to the generated connman configuration file.
+        '';
+      };
+
+      networkInterfaceBlacklist = mkOption {
+        type = with types; listOf string;
+        default = [ "vmnet" "vboxnet" "virbr" "ifb" "ve" ];
+        description = ''
+          Default blacklisted interfaces, this includes NixOS containers interfaces (ve).
+        '';
+      };
+
     };
 
   };
@@ -51,7 +73,7 @@ in {
         Type = "dbus";
         BusName = "net.connman";
         Restart = "on-failure";
-        ExecStart = "${pkgs.connman}/sbin/connmand --nodaemon";
+        ExecStart = "${pkgs.connman}/sbin/connmand --config=${configFile} --nodaemon";
         StandardOutput = "null";
       };
     };

nixos/modules/services/networking/dnschain.nix

@@ -0,0 +1,110 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services;
+
+  dnschainConf = pkgs.writeText "dnschain.conf" ''
+    [log]
+    level=info
+
+    [dns]
+    host = 127.0.0.1
+    port = 5333
+    oldDNSMethod = NO_OLD_DNS
+    # TODO: check what that address is acutally used for
+    externalIP = 127.0.0.1
+
+    [http]
+    host = 127.0.0.1
+    port=8088
+    tlsPort=4443
+  '';
+
+in
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.dnschain = {
+
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to run dnschain. That implies running
+          namecoind as well, so make sure to configure
+          it appropriately.
+        '';
+      };
+
+    };
+
+    services.dnsmasq = {
+      resolveDnschainQueries = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Resolve <literal>.bit</literal> top-level domains
+          with dnschain and namecoind.
+        '';
+      };
+
+    };
+
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.dnschain.enable {
+
+    services.namecoind.enable = true;
+
+    services.dnsmasq.servers = optionals cfg.dnsmasq.resolveDnschainQueries [ "/.bit/127.0.0.1#5333" ];
+
+    users.extraUsers = singleton
+      { name = "dnschain";
+        uid = config.ids.uids.dnschain;
+        extraGroups = [ "namecoin" ];
+        description = "Dnschain daemon user";
+        home = "/var/lib/dnschain";
+        createHome = true;
+      };
+
+    systemd.services.dnschain = {
+        description = "Dnschain Daemon";
+        after = [ "namecoind.target" ];
+        wantedBy = [ "multi-user.target" ];
+        path = [ pkgs.openssl ];
+        preStart = ''
+          # Link configuration file into dnschain HOME directory
+          if [ "$(${pkgs.coreutils}/bin/realpath /var/lib/dnschain/.dnschain.conf)" != "${dnschainConf}" ]; then
+              rm -rf /var/lib/dnschain/.dnschain.conf
+              ln -s ${dnschainConf} /var/lib/dnschain/.dnschain.conf
+          fi
+
+          # Create empty namecoin.conf so that dnschain is not
+          # searching for /etc/namecoin/namecoin.conf
+          if [ ! -e /var/lib/dnschain/.namecoin/namecoin.conf ]; then
+              mkdir -p /var/lib/dnschain/.namecoin
+              touch /var/lib/dnschain/.namecoin/namecoin.conf
+          fi
+        '';
+        serviceConfig = {
+          Type = "simple";
+          User = "dnschain";
+          EnvironmentFile = config.services.namecoind.userFile;
+          ExecStart = "${pkgs.dnschain}/bin/dnschain --rpcuser=\${USER} --rpcpassword=\${PASSWORD} --rpcport=8336";
+          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+          ExecStop = "${pkgs.coreutils}/bin/kill -KILL $MAINPID";
+        };
+    };
+
+  };
+
+}

nixos/modules/services/networking/dnsmasq.nix

@@ -96,7 +96,7 @@ in
           Type = "dbus";
           BusName = "uk.org.thekelleys.dnsmasq";
           ExecStart = "${dnsmasq}/bin/dnsmasq -k --enable-dbus --user=dnsmasq -C ${dnsmasqConf}";
-          ExecReload = "${dnsmasq}/bin/kill -HUP $MAINPID";
+          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         };
         restartTriggers = [ config.environment.etc.hosts.source ];
     };

nixos/modules/services/networking/namecoind.nix

@@ -0,0 +1,150 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.namecoind;
+
+  namecoinConf =
+  let
+    useSSL = (cfg.rpcCertificate != null) && (cfg.rpcKey != null);
+  in
+  pkgs.writeText "namecoin.conf" ''
+    server=1
+    daemon=0
+    rpcallowip=127.0.0.1
+    walletpath=${cfg.wallet}
+    gen=${if cfg.generate then "1" else "0"}
+    rpcssl=${if useSSL then "1" else "0"}
+    ${optionalString useSSL "rpcsslcertificatechainfile=${cfg.rpcCertificate}"}
+    ${optionalString useSSL "rpcsslprivatekeyfile=${cfg.rpcKey}"}
+    ${optionalString useSSL "rpcsslciphers=TLSv1.2+HIGH:TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH"}
+    txindex=1
+    txprevcache=1
+  '';
+
+in
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.namecoind = {
+
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to run namecoind.
+        '';
+      };
+
+      wallet = mkOption {
+        type = types.path;
+        example = "/etc/namecoin/wallet.dat";
+        description = ''
+          Wallet file. The ownership of the file has to be
+          namecoin:namecoin, and the permissions must be 0640.
+        '';
+      };
+
+      userFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/etc/namecoin/user";
+        description = ''
+          File containing the user name and user password to
+          authenticate RPC connections to namecoind.
+          The content of the file is of the form:
+          <literal>
+          USER=namecoin
+          PASSWORD=secret
+          </literal>
+          The ownership of the file has to be namecoin:namecoin,
+          and the permissions must be 0640.
+        '';
+      };
+
+      generate = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to generate (mine) Namecoins.
+        '';
+      };
+
+      rpcCertificate = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/etc/namecoin/server.cert";
+        description = ''
+          Certificate file for securing RPC connections.
+        '';
+      };
+
+      rpcKey = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/etc/namecoin/server.pem";
+        description = ''
+          Key file for securing RPC connections.
+        '';
+      };
+
+    };
+
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    users.extraUsers = singleton
+      { name = "namecoin";
+        uid = config.ids.uids.namecoin;
+        description = "Namecoin daemon user";
+        home = "/var/lib/namecoin";
+        createHome = true;
+      };
+
+    users.extraGroups = singleton
+      { name = "namecoin";
+        gid = config.ids.gids.namecoin;
+      };
+
+    systemd.services.namecoind = {
+        description = "Namecoind Daemon";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        preStart = ''
+          if [  "$(stat --printf '%u' ${cfg.userFile})" != "${toString config.ids.uids.namecoin}" \
+             -o "$(stat --printf '%g' ${cfg.userFile})" != "${toString config.ids.gids.namecoin}" \
+             -o "$(stat --printf '%a' ${cfg.userFile})" != "640" ]; then
+             echo "ERROR: bad ownership or rights on ${cfg.userFile}" >&2
+             exit 1
+          fi
+          if [  "$(stat --printf '%u' ${cfg.wallet})" != "${toString config.ids.uids.namecoin}" \
+             -o "$(stat --printf '%g' ${cfg.wallet})" != "${toString config.ids.gids.namecoin}" \
+             -o "$(stat --printf '%a' ${cfg.wallet})" != "640" ]; then
+             echo "ERROR: bad ownership or rights on ${cfg.wallet}" >&2
+             exit 1
+          fi
+        '';
+        serviceConfig = {
+          Type = "simple";
+          User = "namecoin";
+          EnvironmentFile = cfg.userFile;
+          ExecStart = "${pkgs.altcoins.namecoind}/bin/namecoind -conf=${namecoinConf} -rpcuser=\${USER} -rpcpassword=\${PASSWORD} -printtoconsole";
+          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+          ExecStop = "${pkgs.coreutils}/bin/kill -KILL $MAINPID";
+          StandardOutput = "null";
+          Nice = "10";
+        };
+    };
+
+  };
+
+}

nixos/modules/services/networking/ntpd.nix

@@ -6,6 +6,8 @@ let
 
   inherit (pkgs) ntp;
 
+  cfg = config.services.ntp;
+
   stateDir = "/var/lib/ntp";
 
   ntpUser = "ntp";
@@ -16,10 +18,10 @@ let
     restrict 127.0.0.1
     restrict -6 ::1
 
-    ${toString (map (server: "server " + server + " iburst\n") config.services.ntp.servers)}
+    ${toString (map (server: "server " + server + " iburst\n") cfg.servers)}
   '';
 
-  ntpFlags = "-c ${configFile} -u ${ntpUser}:nogroup";
+  ntpFlags = "-c ${configFile} -u ${ntpUser}:nogroup ${toString cfg.extraFlags}";
 
 in
 
@@ -51,6 +53,12 @@ in
         '';
       };
 
+      extraFlags = mkOption {
+        type = types.listOf types.str;
+        description = "Extra flags passed to the ntpd command.";
+        default = [];
+      };
+
     };
 
   };

nixos/modules/services/networking/openvpn.nix

@@ -67,12 +67,6 @@ in
 
   options = {
 
-    /* !!! Obsolete. */
-    services.openvpn.enable = mkOption {
-      default = true;
-      description = "Whether to enable OpenVPN.";
-    };
-
     services.openvpn.servers = mkOption {
       default = {};
 

nixos/modules/services/networking/ssh/sshd.nix

@@ -9,14 +9,6 @@ let
 
   nssModulesPath = config.system.nssModules.path;
 
-  knownHosts = map (h: getAttr h cfg.knownHosts) (attrNames cfg.knownHosts);
-
-  knownHostsText = flip (concatMapStringsSep "\n") knownHosts
-    (h:
-      concatStringsSep "," h.hostNames + " "
-      + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
-    );
-
   userOptions = {
 
     openssh.authorizedKeys = {
@@ -48,8 +40,7 @@ let
   };
 
   authKeysFiles = let
-    mkAuthKeyFile = u: {
-      target = "ssh/authorized_keys.d/${u.name}";
+    mkAuthKeyFile = u: nameValuePair "ssh/authorized_keys.d/${u.name}" {
       mode = "0444";
       source = pkgs.writeText "${u.name}-authorized_keys" ''
         ${concatStringsSep "\n" u.openssh.authorizedKeys.keys}
@@ -59,7 +50,7 @@ let
     usersWithKeys = attrValues (flip filterAttrs config.users.extraUsers (n: u:
       length u.openssh.authorizedKeys.keys != 0 || length u.openssh.authorizedKeys.keyFiles != 0
     ));
-  in map mkAuthKeyFile usersWithKeys;
+  in listToAttrs (map mkAuthKeyFile usersWithKeys);
 
 in
 
@@ -211,57 +202,6 @@ in
         description = "Verbatim contents of <filename>sshd_config</filename>.";
       };
 
-      knownHosts = mkOption {
-        default = {};
-        type = types.loaOf types.optionSet;
-        description = ''
-          The set of system-wide known SSH hosts.
-        '';
-        example = [
-          {
-            hostNames = [ "myhost" "myhost.mydomain.com" "10.10.1.4" ];
-            publicKeyFile = literalExample "./pubkeys/myhost_ssh_host_dsa_key.pub";
-          }
-          {
-            hostNames = [ "myhost2" ];
-            publicKeyFile = literalExample "./pubkeys/myhost2_ssh_host_dsa_key.pub";
-          }
-        ];
-        options = {
-          hostNames = mkOption {
-            type = types.listOf types.str;
-            default = [];
-            description = ''
-              A list of host names and/or IP numbers used for accessing
-              the host's ssh service.
-            '';
-          };
-          publicKey = mkOption {
-            default = null;
-            type = types.nullOr types.str;
-            example = "ecdsa-sha2-nistp521 AAAAE2VjZHN...UEPg==";
-            description = ''
-              The public key data for the host. You can fetch a public key
-              from a running SSH server with the <command>ssh-keyscan</command>
-              command. The public key should not include any host names, only
-              the key type and the key itself.
-            '';
-          };
-          publicKeyFile = mkOption {
-            default = null;
-            type = types.nullOr types.path;
-            description = ''
-              The path to the public key file for the host. The public
-              key file is read at build time and saved in the Nix store.
-              You can fetch a public key file from a running SSH server
-              with the <command>ssh-keyscan</command> command. The content
-              of the file should follow the same format as described for
-              the <literal>publicKey</literal> option.
-            '';
-          };
-        };
-      };
-
       moduliFile = mkOption {
         example = "services.openssh.moduliFile = /etc/my-local-ssh-moduli;";
         type = types.path;
@@ -274,7 +214,7 @@ in
 
     };
 
-    users.extraUsers = mkOption {
+    users.users = mkOption {
       options = [ userOptions ];
     };
 
@@ -292,14 +232,8 @@ in
 
     services.openssh.moduliFile = mkDefault "${cfgc.package}/etc/ssh/moduli";
 
-    environment.etc = authKeysFiles ++ [
-      { source = cfg.moduliFile;
-        target = "ssh/moduli";
-      }
-      { text = knownHostsText;
-        target = "ssh/ssh_known_hosts";
-      }
-    ];
+    environment.etc = authKeysFiles //
+      { "ssh/moduli".source = cfg.moduliFile; };
 
     systemd =
       let
@@ -417,11 +351,6 @@ in
 
     assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true;
                     message = "cannot enable X11 forwarding without setting xauth location";}]
-      ++ flip mapAttrsToList cfg.knownHosts (name: data: {
-        assertion = (data.publicKey == null && data.publicKeyFile != null) ||
-                    (data.publicKey != null && data.publicKeyFile == null);
-        message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
-      })
       ++ flip map cfg.listenAddresses ({ addr, port, ... }: {
         assertion = addr != null;
         message = "addr must be specified in each listenAddresses entry";

nixos/modules/services/networking/syncthing.nix

@@ -36,9 +36,7 @@ in
       dataDir = mkOption {
         default = "/var/lib/syncthing";
         description = ''
-          Path where the `.syncthing` (settings and keys) and `Sync`
-          (your synced files) directories will exist. This can be your home
-          directory.
+          Path where the settings and keys will exist.
         '';
       };
 
@@ -57,18 +55,12 @@ in
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
         environment.STNORESTART = "placeholder";  # do not self-restart
-        environment.HOME = "${cfg.dataDir}";
         serviceConfig = {
           User = "${cfg.user}";
           PermissionsStartOnly = true;
           Restart = "always";
-          ExecStart = "${pkgs.syncthing}/bin/syncthing -home=${cfg.dataDir}/.syncthing";
+          ExecStart = "${pkgs.syncthing}/bin/syncthing -no-browser -home=${cfg.dataDir}";
         };
-        preStart = ''
-          mkdir -p ${cfg.dataDir}
-          chown ${cfg.user} ${cfg.dataDir}
-        '';
-
       };
 
     environment.systemPackages = [ pkgs.syncthing ];

nixos/modules/services/search/elasticsearch.nix

@@ -37,6 +37,12 @@ in {
       type = types.bool;
     };
 
+    package = mkOption {
+      description = "Elasticsearch package to use.";
+      default = pkgs.elasticsearch;
+      type = types.package;
+    };
+
     host = mkOption {
       description = "Elasticsearch listen address.";
       default = "127.0.0.1";
@@ -123,7 +129,7 @@ in {
       after = [ "network-interfaces.target" ];
       environment = { ES_HOME = cfg.dataDir; };
       serviceConfig = {
-        ExecStart = "${pkgs.elasticsearch}/bin/elasticsearch -Des.path.conf=${configDir} ${toString cfg.extraCmdLineOptions}";
+        ExecStart = "${cfg.package}/bin/elasticsearch -Des.path.conf=${configDir} ${toString cfg.extraCmdLineOptions}";
         User = "elasticsearch";
         PermissionsStartOnly = true;
       };
@@ -142,7 +148,7 @@ in {
       '';
     };
 
-    environment.systemPackages = [ pkgs.elasticsearch ];
+    environment.systemPackages = [ cfg.package ];
 
     users.extraUsers = singleton {
       name = "elasticsearch";

nixos/modules/services/security/hologram.nix

@@ -95,7 +95,7 @@ in {
       wantedBy    = [ "multi-user.target" ];
 
       serviceConfig = {
-        ExecStart = "${pkgs.goPackages.hologram}/bin/hologram-server --debug --conf ${cfgFile}";
+        ExecStart = "${pkgs.hologram}/bin/hologram-server --debug --conf ${cfgFile}";
       };
     };
   };

nixos/modules/services/torrent/deluge.nix

@@ -36,6 +36,8 @@ in {
       wantedBy = [ "multi-user.target" ];
       path = [ pkgs.pythonPackages.deluge ];
       serviceConfig.ExecStart = "${pkgs.pythonPackages.deluge}/bin/deluged -d";
+      # To prevent "Quit & shutdown daemon" from working; we want systemd to manage it!
+      serviceConfig.Restart = "on-success";
       serviceConfig.User = "deluge";
       serviceConfig.Group = "deluge";
     };

nixos/modules/services/web-servers/apache-httpd/default.nix

@@ -117,7 +117,6 @@ let
     ]
     ++ (if mainCfg.multiProcessingModule == "prefork" then [ "cgi" ] else [ "cgid" ])
     ++ optional enableSSL "ssl"
-    ++ optional mainCfg.enableCompression "deflate"
     ++ extraApacheModules;
 
 
@@ -177,27 +176,6 @@ let
     SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!EXP
   '';
 
-  # From http://paulstamatiou.com/how-to-optimize-your-apache-site-with-mod-deflate/
-  compressConf = ''
-    SetOutputFilter DEFLATE
-
-    # Don't compress binaries
-    SetEnvIfNoCase Request_URI .(?:exe|t?gz|zip|iso|tar|bz2|sit|rar) no-gzip dont-vary
-    # Don't compress images
-    SetEnvIfNoCase Request_URI .(?:gif|jpe?g|jpg|ico|png)  no-gzip dont-vary
-    # Don't compress PDFs
-    SetEnvIfNoCase Request_URI .pdf no-gzip dont-vary
-    # Don't compress flash files (only relevant if you host your own videos)
-    SetEnvIfNoCase Request_URI .flv no-gzip dont-vary
-    # Netscape 4.X has some problems
-    BrowserMatch ^Mozilla/4 gzip-only-text/html
-    # Netscape 4.06-4.08 have some more problems
-    BrowserMatch ^Mozilla/4.0[678] no-gzip
-    # MSIE masquerades as Netscape, but it is fine
-    BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
-    # Make sure proxies don't deliver the wrong content
-    Header append Vary User-Agent env=!dont-vary
-  '';
 
   mimeConf = ''
     TypesConfig ${httpd}/conf/mime.types
@@ -373,7 +351,6 @@ let
     ${mimeConf}
     ${loggingConf}
     ${browserHacks}
-    ${optionalString mainCfg.enableCompression compressConf}
 
     Include ${httpd}/conf/extra/httpd-default.conf
     Include ${httpd}/conf/extra/httpd-autoindex.conf
@@ -446,7 +423,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Enable the Apache HTTP Server.";
+        description = "Whether to enable the Apache HTTP Server.";
       };
 
       package = mkOption {
@@ -609,12 +586,6 @@ in
         description =
           "Maximum number of httpd requests answered per httpd child (prefork), 0 means unlimited";
       };
-
-      enableCompression = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Enable compression of responses using mod_deflate.";
-      };
     }
 
     # Include the options shared between the main server and virtual hosts.

nixos/modules/services/web-servers/apache-httpd/wordpress.nix

@@ -5,8 +5,8 @@ with lib;
 
 let
 
-  version = "4.2";
-  fullversion = "${version}.2";
+  version = "4.3";
+  fullversion = "${version}";
 
   # Our bare-bones wp-config.php file using the above settings
   wordpressConfig = pkgs.writeText "wp-config.php" ''
@@ -40,6 +40,8 @@ let
     RewriteRule ^(.*\.php)$ $1 [L]
     RewriteRule . index.php [L]
     </IfModule>
+
+    ${config.extraHtaccess}
   '';
 
   # WP translation can be found here:
@@ -72,7 +74,7 @@ let
       owner = "WordPress";
       repo = "WordPress";
       rev = "${fullversion}";
-      sha256 = "0gq1j9b0d0rykql3jzdb2yn4adj0rrcsvqrmj3dzx11ir57ilsgc";
+      sha256 = "0sz5jjhjpwqis8336gyq9a77cr4sf8zahd1y4pzmpvpzn9cn503y";
     };
     installPhase = ''
       mkdir -p $out
@@ -220,7 +222,18 @@ in
         settings, see <link xlink:href='http://codex.wordpress.org/Editing_wp-config.php'/>.
       '';
     };
-  }; 
+    extraHtaccess = mkOption {
+      default = "";
+      example =
+        ''
+          php_value upload_max_filesize 20M
+          php_value post_max_size 20M
+        '';
+      description = ''
+        Any additional text to be appended to Wordpress's .htaccess file.
+      '';
+    };
+  };
 
   documentRoot = wordpressRoot;
 

nixos/modules/services/web-servers/nginx/default.nix

@@ -8,9 +8,12 @@ let
   configFile = pkgs.writeText "nginx.conf" ''
     user ${cfg.user} ${cfg.group};
     daemon off;
+
     ${cfg.config}
+
     ${optionalString (cfg.httpConfig != "") ''
     http {
+      include ${cfg.package}/conf/mime.types;
       ${cfg.httpConfig}
     }
     ''}

nixos/modules/services/x11/desktop-managers/gnome3.nix

@@ -99,7 +99,6 @@ in {
     networking.networkmanager.enable = mkDefault true;
     services.upower.enable = config.powerManagement.enable;
     hardware.bluetooth.enable = mkDefault true;
-    services.xserver.displayManager.desktopManagerHandlesLidAndPower = false; # true doesn't make sense here, GNOME just doesn't handle it anymore
 
     fonts.fonts = [ pkgs.dejavu_fonts pkgs.cantarell_fonts ];
 

nixos/modules/services/x11/desktop-managers/kodi.nix

@@ -28,4 +28,4 @@ in
 
     environment.systemPackages = [ pkgs.kodi ];
   };
-}
+}

nixos/modules/services/x11/display-managers/default.nix

@@ -62,7 +62,7 @@ let
         if [ -z "$_INHIBITION_LOCK_TAKEN" ]; then
           export _INHIBITION_LOCK_TAKEN=1
           if ! ${config.systemd.package}/bin/loginctl show-session $XDG_SESSION_ID | grep -q '^RemoteHost='; then
-            exec ${config.systemd.package}/bin/systemd-inhibit --what=handle-lid-switch:handle-power-key --why="See NixOS configuration option 'services.xserver.displayManager.desktopManagerHandlesLidAndPower' for more information." "$0" "$sessionType"
+            exec ${config.systemd.package}/bin/systemd-inhibit --what=handle-lid-switch:handle-power-key --why="Desktop environment handles power events" "$0" "$sessionType"
           fi
         fi
 
@@ -161,7 +161,11 @@ let
       exit 0
     '';
 
-  mkDesktops = names: pkgs.runCommand "desktops" {}
+  mkDesktops = names: pkgs.runCommand "desktops"
+    { # trivial derivation
+      preferLocalBuild = true;
+      allowSubstitutes = false;
+    }
     ''
       mkdir -p $out
       ${concatMapStrings (n: ''
@@ -225,7 +229,7 @@ in
 
       desktopManagerHandlesLidAndPower = mkOption {
         type = types.bool;
-        default = true;
+        default = false;
         description = ''
           Whether the display manager should prevent systemd from handling
           lid and power events. This is normally handled by the desktop

nixos/modules/services/x11/display-managers/gdm.nix

@@ -18,14 +18,49 @@ in
 
     services.xserver.displayManager.gdm = {
 
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        example = true;
+      enable = mkEnableOption ''
+        GDM as the display manager.
+        <emphasis>GDM is very experimental and may render system unusable.</emphasis>
+      '';
+
+      debug = mkEnableOption ''
+        debugging messages in GDM
+      '';
+
+      autoLogin = mkOption {
+        default = {};
         description = ''
-          Whether to enable GDM as the display manager.
-          <emphasis>GDM is very experimental and may render system unusable.</emphasis>
+          Auto login configuration attrset.
         '';
+
+        type = types.submodule {
+          options = {
+            enable = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Automatically log in as the sepecified <option>autoLogin.user</option>.
+              '';
+            };
+
+            user = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = ''
+                User to be used for the autologin.
+              '';
+            };
+
+            delay = mkOption {
+              type = types.int;
+              default = 0;
+              description = ''
+                Seconds of inactivity after which the autologin will be performed.
+              '';
+            };
+
+          };
+        };
       };
 
     };
@@ -37,6 +72,12 @@ in
 
   config = mkIf cfg.gdm.enable {
 
+    assertions = [
+      { assertion = cfg.gdm.autoLogin.enable -> cfg.gdm.autoLogin.user != null;
+        message = "GDM auto-login requires services.xserver.displayManager.gdm.autoLogin.user to be set";
+      }
+    ];
+
     services.xserver.displayManager.slim.enable = false;
 
     users.extraUsers.gdm =
@@ -50,7 +91,7 @@ in
     users.extraGroups.gdm.gid = config.ids.gids.gdm;
 
     services.xserver.displayManager.job =
-      { 
+      {
         environment = {
           GDM_X_SERVER = "${cfg.xserverBin} ${cfg.xserverArgs}";
           GDM_SESSIONS_DIR = "${cfg.session.desktops}";
@@ -71,6 +112,34 @@ in
 
     programs.dconf.profiles.gdm = "${gdm}/share/dconf/profile/gdm";
 
+    # Use AutomaticLogin if delay is zero, because it's immediate.
+    # Otherwise with TimedLogin with zero seconds the prompt is still
+    # presented and there's a little delay.
+    environment.etc."gdm/custom.conf".text = ''
+      [daemon]
+      ${optionalString cfg.gdm.autoLogin.enable (
+        if cfg.gdm.autoLogin.delay > 0 then ''
+          TimedLoginEnable=true
+          TimedLogin=${cfg.gdm.autoLogin.user}
+          TimedLoginDelay=${toString cfg.gdm.autoLogin.delay}
+        '' else ''
+          AutomaticLoginEnable=true
+          AutomaticLogin=${cfg.gdm.autoLogin.user}
+        '')
+      }
+
+      [security]
+
+      [xdmcp]
+
+      [greeter]
+
+      [chooser]
+
+      [debug]
+      ${optionalString cfg.gdm.debug "Enable=true"}
+    '';
+
     # GDM LFS PAM modules, adapted somehow to NixOS
     security.pam.services = {
       gdm-launch-environment.text = ''
@@ -89,7 +158,7 @@ in
         session  optional       pam_permit.so
       '';
 
-     gdm.text = ''
+      gdm.text = ''
         auth     requisite      pam_nologin.so
         auth     required       pam_env.so
 
@@ -130,7 +199,7 @@ in
           "auth     required       pam_deny.so"}
 
         account  sufficient     pam_unix.so
-        
+
         password requisite      pam_unix.so nullok sha512
         ${optionalString config.security.pam.enableEcryptfs
           "password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"}

nixos/modules/services/x11/redshift.nix

@@ -1,58 +1,90 @@
 { config, lib, pkgs, ... }:
+
 with lib;
+
 let
+
   cfg = config.services.redshift;
 
 in {
-  options = {
-    services.redshift.enable = mkOption {
+
+  options.services.redshift = {
+    enable = mkOption {
       type = types.bool;
       default = false;
       example = true;
-      description = "Enable Redshift to change your screen's colour temperature depending on the time of day";
+      description = ''
+        Enable Redshift to change your screen's colour temperature depending on
+        the time of day.
+      '';
     };
 
-    services.redshift.latitude = mkOption {
-      description = "Your current latitude";
+    latitude = mkOption {
       type = types.str;
+      description = ''
+        Your current latitude.
+      '';
     };
 
-    services.redshift.longitude = mkOption {
-      description = "Your current longitude";
+    longitude = mkOption {
       type = types.str;
+      description = ''
+        Your current longitude.
+      '';
     };
 
-    services.redshift.temperature = {
+    temperature = {
       day = mkOption {
-        description = "Colour temperature to use during day time";
+        type = types.int;
         default = 5500;
-        type = types.int;
+        description = ''
+          Colour temperature to use during the day.
+        '';
       };
       night = mkOption {
-        description = "Colour temperature to use during night time";
+        type = types.int;
         default = 3700;
-        type = types.int;
+        description = ''
+          Colour temperature to use at night.
+        '';
       };
     };
 
-    services.redshift.brightness = {
+    brightness = {
       day = mkOption {
-        description = "Screen brightness to apply during the day (between 0.1 and 1.0)";
-        default = "1";
         type = types.str;
+        default = "1";
+        description = ''
+          Screen brightness to apply during the day,
+          between <literal>0.1</literal> and <literal>1.0</literal>.
+        '';
       };
       night = mkOption {
-        description = "Screen brightness to apply during the night (between 0.1 and 1.0)";
-        default = "1";
         type = types.str;
+        default = "1";
+        description = ''
+          Screen brightness to apply during the night,
+          between <literal>0.1</literal> and <literal>1.0</literal>.
+        '';
       };
     };
 
-    services.redshift.extraOptions = mkOption {
+    package = mkOption {
+      type = types.package;
+      default = pkgs.redshift;
+      description = ''
+        redshift derivation to use.
+      '';
+    };
+
+    extraOptions = mkOption {
       type = types.listOf types.str;
       default = [];
       example = [ "-v" "-m randr" ];
-      description = "Additional command-line arguments to pass to the redshift(1) command";
+      description = ''
+        Additional command-line arguments to pass to
+        <command>redshift</command>.
+      '';
     };
   };
 
@@ -63,7 +95,7 @@ in {
       after = [ "display-manager.service" ];
       wantedBy = [ "graphical.target" ];
       serviceConfig.ExecStart = ''
-        ${pkgs.redshift}/bin/redshift \
+        ${cfg.package}/bin/redshift \
           -l ${cfg.latitude}:${cfg.longitude} \
           -t ${toString cfg.temperature.day}:${toString cfg.temperature.night} \
           -b ${toString cfg.brightness.day}:${toString cfg.brightness.night} \
@@ -73,4 +105,5 @@ in {
       serviceConfig.Restart = "always";
     };
   };
+
 }

nixos/modules/services/x11/window-managers/wmii.nix

@@ -1,47 +1,43 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
+{ config, lib, pkgs, options, modulesPath }:
 
 let
-
+  inherit (lib) mkOption mkIf singleton;
   cfg = config.services.xserver.windowManager.wmii;
-
+  wmii = pkgs.wmii_hg;
 in
-
 {
   options = {
-
     services.xserver.windowManager.wmii.enable = mkOption {
       default = false;
       example = true;
       description = "Enable the wmii window manager.";
     };
-
   };
 
   config = mkIf cfg.enable {
-
     services.xserver.windowManager.session = singleton
       # stop wmii by
       #   $wmiir xwrite /ctl quit
       # this will cause wmii exiting with exit code 0
+      # (or "mod+a quit", which is bound to do the same thing in wmiirc
+      # by default)
       #
       # why this loop?
       # wmii crashes once a month here. That doesn't matter that much
-      # wmii can recover very well. However without loop the x session terminates and then your workspace setup is
-      # lost and all applications running on X will terminate.
+      # wmii can recover very well. However without loop the X session
+      # terminates and then your workspace setup is lost and all
+      # applications running on X will terminate.
       # Another use case is kill -9 wmii; after rotating screen.
-      # Note: we don't like kill for that purpose. But it works (-> subject "wmii and xrandr" on mailinglist)
+      # Note: we don't like kill for that purpose. But it works (->
+      # subject "wmii and xrandr" on mailinglist)
       { name = "wmii";
         start = ''
           while :; do
-            ${pkgs.wmiiSnap}/bin/wmii && break
+            ${wmii}/bin/wmii && break
           done
         '';
       };
 
-    environment.systemPackages = [ pkgs.wmiiSnap ];
-
+    environment.systemPackages = [ wmii ];
   };
-
 }

nixos/modules/system/boot/modprobe.nix

@@ -85,11 +85,7 @@ with lib;
         '')}
         ${config.boot.extraModprobeConfig}
       '';
-    environment.etc."modprobe.d/usb-load-ehci-first.conf".text =
-      ''
-        softdep uhci_hcd pre: ehci_hcd
-        softdep ohci_hcd pre: ehci_hcd
-      '';
+    environment.etc."modprobe.d/debian.conf".source = pkgs.kmod-debian-aliases;
 
     environment.systemPackages = [ config.system.sbin.modprobe pkgs.kmod ];
 

nixos/modules/system/boot/stage-1.nix

@@ -241,6 +241,9 @@ let
           };
           symlink = "/etc/modprobe.d/ubuntu.conf";
         }
+        { object = pkgs.kmod-debian-aliases;
+          symlink = "/etc/modprobe.d/debian.conf";
+        }
       ];
   };
 

nixos/modules/system/boot/systemd.nix

@@ -643,6 +643,10 @@ in
         if ! [ -e /etc/machine-id ]; then
           ${systemd}/bin/systemd-machine-id-setup
         fi
+
+        # Keep a persistent journal. Note that systemd-tmpfiles will
+        # set proper ownership/permissions.
+        mkdir -m 0700 -p /var/log/journal
       '';
 
     users.extraUsers.systemd-network.uid = config.ids.uids.systemd-network;

nixos/modules/virtualisation/containers.nix

@@ -12,6 +12,12 @@ let
     perl = "${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl";
     su = "${pkgs.shadow.su}/bin/su";
     inherit (pkgs) utillinux;
+
+    postInstall = ''
+      t=$out/etc/bash_completion.d
+      mkdir -p $t
+      cp ${./nixos-container-completion.sh} $t/nixos-container
+    '';
   };
 
   # The container's init script, a small wrapper around the regular
@@ -299,7 +305,7 @@ in
             ''
               #! ${pkgs.stdenv.shell} -e
               ${nixos-container}/bin/nixos-container run "$INSTANCE" -- \
-                bash --login -c "/nix/var/nix/profiles/system/bin/switch-to-configuration test"
+                bash --login -c "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test"
             '';
 
           SyslogIdentifier = "container %i";

nixos/modules/virtualisation/docker.nix

@@ -43,6 +43,17 @@ in
             in future.  So set this option explicitly to false if you wish.
           '';
       };
+    storageDriver =
+      mkOption {
+        type = types.enum ["aufs" "btrfs" "devicemapper" "overlay" "zfs"];
+        description =
+          ''
+            This option determines which Docker storage driver to use.
+            It is required but lacks a default value as its most
+            suitable value will depend the filesystems available on the
+            host.
+          '';
+      };
     extraOptions =
       mkOption {
         type = types.separatedString " ";
@@ -85,7 +96,7 @@ in
         after = [ "network.target" "docker.socket" ];
         requires = [ "docker.socket" ];
         serviceConfig = {
-          ExecStart = "${pkgs.docker}/bin/docker --daemon=true --host=fd:// --group=docker ${cfg.extraOptions}";
+          ExecStart = "${pkgs.docker}/bin/docker daemon --host=fd:// --group=docker --storage-driver=${cfg.storageDriver} ${cfg.extraOptions}";
           #  I'm not sure if that limits aren't too high, but it's what
           #  goes in config bundled with docker itself
           LimitNOFILE = 1048576;
@@ -111,7 +122,7 @@ in
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
         serviceConfig = {
-          ExecStart = "${pkgs.docker}/bin/docker --daemon=true --group=docker ${cfg.extraOptions}";
+          ExecStart = "${pkgs.docker}/bin/docker daemon --group=docker --storage-driver=${cfg.storageDriver} ${cfg.extraOptions}";
           #  I'm not sure if that limits aren't too high, but it's what
           #  goes in config bundled with docker itself
           LimitNOFILE = 1048576;

nixos/modules/virtualisation/lxd.nix

@@ -0,0 +1,64 @@
+# Systemd services for lxd.
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.virtualisation.lxd;
+
+in
+
+{
+  ###### interface
+
+  options = {
+
+    virtualisation.lxd.enable =
+      mkOption {
+        type = types.bool;
+        default = false;
+        description =
+          ''
+            This option enables lxd, a daemon that manages
+            containers. Users in the "lxd" group can interact with
+            the daemon (e.g. to start or stop containers) using the
+            <command>lxc</command> command line tool, among others.
+          '';
+      };
+
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    environment.systemPackages =
+      [ pkgs.lxd ];
+
+    systemd.services.lxd =
+      { description = "LXD Container Management Daemon";
+
+        wantedBy = [ "multi-user.target" ];
+        after = [ "systemd-udev-settle.service" ];
+
+        # TODO(wkennington): Add lvm2 and thin-provisioning-tools
+        path = with pkgs; [ acl rsync gnutar xz btrfsProgs ];
+
+        serviceConfig.ExecStart = "@${pkgs.lxd}/bin/lxd lxd --syslog --group lxd";
+        serviceConfig.Type = "simple";
+        serviceConfig.KillMode = "process"; # when stopping, leave the containers alone
+      };
+
+    users.extraGroups.lxd.gid = config.ids.gids.lxd;
+
+    users.extraUsers.root = {
+      subUidRanges = [ { startUid = 1000000; count = 65536; } ];
+      subGidRanges = [ { startGid = 1000000; count = 65536; } ];
+    };
+
+  };
+
+}

nixos/modules/virtualisation/nixos-container-completion.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+_nixos-container() {
+    local cur prev opts
+    COMPREPLY=()
+    cur="${COMP_WORDS[COMP_CWORD]}"
+    prev="${COMP_WORDS[COMP_CWORD-1]}"
+    opts="list create destroy start stop status update login root-login run show-ip show-host-key"
+    startstop_opts=$(nixos-container list)
+    update_opts="--config"
+
+    if [[ "$prev" == "nixos-container" ]]
+    then
+        COMPREPLY=( $(compgen -W "${opts}" -- ${cur}) )
+        return 0
+    fi
+
+    if [[ $(echo "$opts" | grep "$prev") ]]
+    then
+        if [[ "$prev" == "start" || "$prev" == "stop" ]]
+        then
+            COMPREPLY=( $(compgen -W "${startstop_opts}" -- ${cur}) )
+            return 0
+        elif [[ "$prev" == "update" ]]
+        then
+            COMPREPLY=( $(compgen -W "${update_opts}" -- ${cur}) )
+            return 0
+        fi
+    fi
+}
+
+complete -F _nixos-container nixos-container
+

nixos/modules/virtualisation/nixos-container.pl

@@ -290,7 +290,8 @@ elsif ($action eq "show-ip") {
 }
 
 elsif ($action eq "show-host-key") {
-    my $fn = "$root/etc/ssh/ssh_host_ecdsa_key.pub";
+    my $fn = "$root/etc/ssh/ssh_host_ed25519_key.pub";
+    $fn = "$root/etc/ssh/ssh_host_ecdsa_key.pub" unless -e $fn;
     exit 1 if ! -f $fn;
     print read_file($fn);
 }

nixos/modules/virtualisation/openvswitch.nix

@@ -67,7 +67,6 @@ in {
       description = "Open_vSwitch Database Server";
       wantedBy = [ "multi-user.target" ];
       after = [ "systemd-udev-settle.service" ];
-      wants = [ "vswitchd.service" ];
       path = [ cfg.package ];
       restartTriggers = [ db cfg.package ];
       # Create the config database
@@ -108,6 +107,7 @@ in {
 
     systemd.services.vswitchd = {
       description = "Open_vSwitch Daemon";
+      wantedBy = [ "multi-user.target" ];
       bindsTo = [ "ovsdb.service" ];
       after = [ "ovsdb.service" ];
       path = [ cfg.package ];
@@ -135,8 +135,8 @@ in {
     systemd.services.ovs-monitor-ipsec = {
       description = "Open_vSwitch Ipsec Daemon";
       wantedBy = [ "multi-user.target" ];
-      requires = [ "racoon.service" ];
-      after = [ "vswitchd.service" ];
+      requires = [ "ovsdb.service" ];
+      before = [ "vswitchd.service" "racoon.service" ];
       environment.UNIXCTLPATH = "/tmp/ovsdb.ctl.sock";
       serviceConfig = {
         ExecStart = ''

nixos/modules/virtualisation/parallels-guest.nix

@@ -17,7 +17,7 @@ in
         type = types.bool;
         default = false;
         description = ''
-          This enables Parallel Tools for Linux guests, along with provided
+          This enables Parallels Tools for Linux guests, along with provided
           video, mouse and other hardware drivers.
         '';
       };

nixos/modules/virtualisation/virtualbox-image.nix

@@ -128,6 +128,6 @@ in {
     boot.loader.grub.version = 2;
     boot.loader.grub.device = "/dev/sda";
   
-    services.virtualboxGuest.enable = true;
+    virtualisation.virtualbox.guest.enable = true;
   };
 }

nixos/release.nix

@@ -226,6 +226,7 @@ in rec {
   tests.fleet = hydraJob (import tests/fleet.nix { system = "x86_64-linux"; });
   #tests.gitlab = callTest tests/gitlab.nix {};
   tests.gnome3 = callTest tests/gnome3.nix {};
+  tests.gnome3-gdm = callTest tests/gnome3-gdm.nix {};
   tests.i3wm = callTest tests/i3wm.nix {};
   tests.installer.grub1 = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).grub1.test);
   tests.installer.lvm = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).lvm.test);

nixos/tests/chromium.nix

@@ -44,6 +44,8 @@ import ./make-test.nix (
           search --onlyvisible --name "startup done"
           windowfocus --sync
           windowactivate --sync
+        ''}");
+        $machine->execute("${xdo "new-window" ''
           key Ctrl+n
         ''}");
       });
@@ -55,6 +57,8 @@ import ./make-test.nix (
           search --onlyvisible --name "new tab"
           windowfocus --sync
           windowactivate --sync
+        ''}");
+        $machine->execute("${xdo "close-window" ''
           key Ctrl+w
         ''}");
         for (1..20) {
@@ -155,6 +159,8 @@ import ./make-test.nix (
           $machine->succeed("${xdo "submit-url" ''
             search --sync --onlyvisible --name "sandbox status"
             windowfocus --sync
+          ''}");
+          $machine->succeed("${xdo "submit-url" ''
             key --delay 1000 Ctrl+a Ctrl+c
           ''}");
 

nixos/tests/docker.nix

@@ -11,6 +11,7 @@ import ./make-test.nix ({ pkgs, ...} : {
       { config, pkgs, ... }:
         {
           virtualisation.docker.enable = true;
+          virtualisation.docker.storageDriver = "overlay";
         };
     };
 

nixos/tests/etcd.nix

@@ -82,7 +82,7 @@ import ./make-test.nix ({ pkgs, ... } : {
     subtest "single node", sub {
       $simple->start();
       $simple->waitForUnit("etcd.service");
-      $simple->succeed("etcdctl set /foo/bar 'Hello world'");
+      $simple->waitUntilSucceeds("etcdctl set /foo/bar 'Hello world'");
       $simple->waitUntilSucceeds("etcdctl get /foo/bar | grep 'Hello world'");
     };
 
@@ -91,7 +91,7 @@ import ./make-test.nix ({ pkgs, ... } : {
       $node2->start();
       $node1->waitForUnit("etcd.service");
       $node2->waitForUnit("etcd.service");
-      $node1->succeed("etcdctl set /foo/bar 'Hello world'");
+      $node1->waitUntilSucceeds("etcdctl set /foo/bar 'Hello world'");
       $node2->waitUntilSucceeds("etcdctl get /foo/bar | grep 'Hello world'");
       $node1->shutdown();
       $node2->shutdown();
@@ -104,7 +104,7 @@ import ./make-test.nix ({ pkgs, ... } : {
       $discovery2->start();
       $discovery1->waitForUnit("etcd.service");
       $discovery2->waitForUnit("etcd.service");
-      $discovery1->succeed("etcdctl set /foo/bar 'Hello world'");
+      $discovery1->waitUntilSucceeds("etcdctl set /foo/bar 'Hello world'");
       $discovery2->waitUntilSucceeds("etcdctl get /foo/bar | grep 'Hello world'");
     };
   '';

nixos/tests/firefox.nix

@@ -14,7 +14,7 @@ import ./make-test.nix ({ pkgs, ... }: {
   testScript =
     ''
       $machine->waitForX;
-      $machine->execute("firefox file://${pkgs.valgrind}/share/doc/valgrind/html/index.html &");
+      $machine->execute("firefox file://${pkgs.valgrind.doc}/share/doc/valgrind/html/index.html &");
       $machine->waitForWindow(qr/Valgrind/);
       $machine->sleep(40); # wait until Firefox has finished loading the page
       $machine->screenshot("screen");

nixos/tests/gnome3-gdm.nix

@@ -0,0 +1,39 @@
+import ./make-test.nix ({ pkgs, ...} : {
+  name = "gnome3-gdm";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ lethalman ];
+  };
+
+  machine =
+    { config, pkgs, ... }:
+
+    { imports = [ ./common/user-account.nix ];
+
+      services.xserver.enable = true;
+
+      services.xserver.displayManager.gdm = {
+        enable = true;
+        autoLogin = {
+          enable = true;
+          user = "alice";
+        };
+      };
+      services.xserver.desktopManager.gnome3.enable = true;
+
+      virtualisation.memorySize = 512;
+    };
+
+  testScript =
+    ''
+      $machine->waitForX;
+      $machine->sleep(15);
+
+      # Check that logging in has given the user ownership of devices.
+      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+
+      $machine->succeed("su - alice -c 'DISPLAY=:0.0 gnome-terminal &'");
+      $machine->waitForWindow(qr/Terminal/);
+      $machine->sleep(20);
+      $machine->screenshot("screen");
+    '';
+})

nixos/tests/kde4.nix

@@ -15,7 +15,7 @@ import ./make-test.nix ({ pkgs, ... }: {
 
       services.httpd.enable = true;
       services.httpd.adminAddr = "foo@example.org";
-      services.httpd.documentRoot = "${pkgs.valgrind}/share/doc/valgrind/html";
+      services.httpd.documentRoot = "${pkgs.valgrind.doc}/share/doc/valgrind/html";
 
       services.xserver.displayManager.kdm.enable = true;
       services.xserver.displayManager.kdm.extraConfig =

nixos/tests/logstash.nix

@@ -19,8 +19,8 @@ import ./make-test.nix ({ pkgs, ...} : {
                 exec { command => "echo dragons" interval => 1 type => "test" }
               '';
               filterConfig = ''
-                if [type] == "test" {
-                  grep { match => ["message", "flowers"] drop => true }
+                if [message] =~ /dragons/ {
+                  drop {}
                 }
               '';
               outputConfig = ''

nixos/tests/nfs.nix

@@ -6,7 +6,7 @@ let
     { config, pkgs, ... }:
     { fileSystems = pkgs.lib.mkVMOverride
         [ { mountPoint = "/data";
-            device = "server:${if version == 4 then "/" else "/data"}";
+            device = "server:/data";
             fsType = "nfs";
             options = "vers=${toString version}";
           }

nixos/tests/printing.nix

@@ -63,7 +63,7 @@ import ./make-test.nix ({pkgs, ... }: {
       foreach my $file ("${pkgs.groff.doc}/share/doc/*/examples/mom/penguin.pdf",
                         "${pkgs.groff.doc}/share/doc/*/meref.ps",
                         "${pkgs.cups}/share/doc/cups/images/cups.png",
-                        "${pkgs.pcre}/share/doc/pcre/pcre.txt")
+                        "${pkgs.pcre.doc}/share/doc/pcre/pcre.txt")
       {
           $file =~ /([^\/]*)$/; my $fn = $1;
 

nixos/tests/proxy.nix

@@ -7,7 +7,7 @@ let
 
     { services.httpd.enable = true;
       services.httpd.adminAddr = "foo@example.org";
-      services.httpd.documentRoot = "${pkgs.valgrind}/share/doc/valgrind/html";
+      services.httpd.documentRoot = "${pkgs.valgrind.doc}/share/doc/valgrind/html";
       networking.firewall.allowedTCPPorts = [ 80 ];
     };
 
@@ -67,6 +67,7 @@ in
       $proxy->waitForUnit("httpd");
       $backend1->waitForUnit("httpd");
       $backend2->waitForUnit("httpd");
+      $client->waitForUnit("network.target");
 
       # With the back-ends up, the proxy should work.
       $client->succeed("curl --fail http://proxy/");

nixos/tests/virtualbox.nix

@@ -8,6 +8,19 @@ import ./make-test.nix ({ pkgs, ... }: with pkgs.lib; let
         #!${pkgs.stdenv.shell} -xe
         export PATH="${pkgs.coreutils}/bin:${pkgs.utillinux}/bin"
 
+        mkdir -p /etc/dbus-1 /var/run/dbus
+        cat > /etc/passwd <<EOF
+        root:x:0:0::/root:/bin/false
+        messagebus:x:1:1::/var/run/dbus:/bin/false
+        EOF
+        cat > /etc/group <<EOF
+        root:x:0:
+        messagebus:x:1:
+        EOF
+        cp -v "${pkgs.dbus.daemon}/etc/dbus-1/system.conf" \
+          /etc/dbus-1/system.conf
+        "${pkgs.dbus.daemon}/bin/dbus-daemon" --fork --system
+
         ${pkgs.linuxPackages.virtualboxGuestAdditions}/bin/VBoxService
         ${(attrs.vmScript or (const "")) pkgs}
 
@@ -307,7 +320,7 @@ in {
       mkVMConf = name: val: val.machine // { key = "${name}-config"; };
       vmConfigs = mapAttrsToList mkVMConf vboxVMs;
     in [ ./common/user-account.nix ./common/x11.nix ] ++ vmConfigs;
-    virtualisation.memorySize = 768;
+    virtualisation.memorySize = 1024;
     virtualisation.virtualbox.host.enable = true;
     users.extraUsers.alice.extraGroups = let
       inherit (config.virtualisation.virtualbox.host) enableHardening;

pkgs/applications/altcoins/bitcoin-xt.nix

@@ -0,0 +1,39 @@
+{ stdenv, fetchurl, pkgconfig, autoreconfHook, openssl, db48, boost
+, zlib, miniupnpc, qt4, utillinux, protobuf, qrencode, curl
+, withGui }:
+
+with stdenv.lib;
+stdenv.mkDerivation rec{
+
+  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-xt-" + version;
+  xt_version = "0.11A";
+  version = xt_version;
+
+  src = fetchurl {
+    url = "https://github.com/bitcoinxt/bitcoinxt/archive/v0.11A.tar.gz";
+    sha256 = "129cbqf6bln6rhdk70c6nfwdjk6afvsaaw4xdyp0pnfand8idz7n";
+  };
+
+  buildInputs = [ pkgconfig autoreconfHook openssl db48 boost zlib
+                  miniupnpc utillinux protobuf curl ]
+                  ++ optionals withGui [ qt4 qrencode ];
+
+  configureFlags = [
+    "--with-boost-libdir=${boost.lib}/lib"
+    "--with-libcurl-headers=${curl}/include"
+  ] ++ optionals withGui [ "--with-gui=qt4" ];
+
+  meta = {
+    description = "Peer-to-peer electronic cash system";
+    longDescription= ''
+       Bitcoin XT is an implementation of a Bitcoin full node, based upon the
+       source code of Bitcoin Core. It is built by taking the latest stable
+       Core release, applying a series of patches, and then doing deterministic
+       builds so anyone can check the downloads correspond to the source code. 
+    '';
+    homepage = "https://bitcoinxt.software/";
+    maintainers = with maintainers; [ jefdaj ];
+    license = licenses.mit;
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/altcoins/default.nix

@@ -5,6 +5,9 @@ rec {
   bitcoin  = callPackage ./bitcoin.nix { withGui = true; };
   bitcoind = callPackage ./bitcoin.nix { withGui = false; };
 
+  bitcoin-xt  = callPackage ./bitcoin-xt.nix { withGui = true; };
+  bitcoind-xt = callPackage ./bitcoin-xt.nix { withGui = false; };
+
   darkcoin  = callPackage ./darkcoin.nix { withGui = true; };
   darkcoind = callPackage ./darkcoin.nix { withGui = false; };
 

pkgs/applications/audio/calf/default.nix

@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
   version = "0.0.60";
 
   src = fetchurl {
-    url = "mirror://sourceforge/calf/${name}.tar.gz";
+    url = "http://calf-studio-gear.org/files/${name}.tar.gz";
     sha256 = "019fwg00jv217a5r767z7szh7vdrarybac0pr2sk26xp81kibrx9";
   };
 

pkgs/applications/audio/deadbeef/default.nix

@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
 
   patches = [ (fetchpatch {
                 url = "https://github.com/Alexey-Yakovenko/deadbeef/commit/e7725ea73fa1bd279a3651704870156bca8efea8.patch";
-                sha256 = "0a04l2607y3swcq9b1apffl1chdwj38jwfiizxcfmdbia4a0qlyg";
+                sha256 = "1530w968zyvcm9c8k57889n125k7a1kk3ydinjm398n07gypd599";
               })
             ];
 

pkgs/applications/audio/dfasma/default.nix

@@ -1,16 +1,58 @@
 { stdenv, fetchFromGitHub, fftw, libsndfile, qt5 }:
 
-let version = "1.1.2"; in
-stdenv.mkDerivation {
+let
+
+  version = "1.2.5";
+  rev = "v${version}";
+  sha256 = "0mgy2bkmyp7lvaqsr7hkndwdgjf26mlpsj6smrmn1vp0cqyrw72d";
+
+  reaperFork = {
+    src = fetchFromGitHub {
+      sha256 = "07m2wf2gqyya95b65gawrnr4pvc9jyzmg6h8sinzgxlpskz93wwc";
+      rev = "39053e8896eedd7b3e8a9e9a9ffd80f1fc6ceb16";
+      repo = "reaper";
+      owner = "gillesdegottex";
+    };
+    meta = with stdenv.lib; {
+     license = licenses.asl20;
+    };
+  };
+
+  libqaudioextra = {
+    src = fetchFromGitHub {
+      sha256 = "17pvlij8cc4lwzf6f1cnygj3m3ci6xfa3lv5bgcr5i1gzyjxqpq1";
+      rev = "b7d187cd9a1fd76ea94151e2e02453508d0151d3";
+      repo = "libqaudioextra";
+      owner = "gillesdegottex";
+    };
+    meta = with stdenv.lib; {
+     license = licenses.gpl3Plus;
+    };
+  };
+
+in stdenv.mkDerivation {
   name = "dfasma-${version}";
 
   src = fetchFromGitHub {
-    sha256 = "0xqam5hm4kvfksdlyz1rviijv386fk3px4lhz6glfsimbcvvzl0r";
-    rev = "v${version}";
+    inherit sha256 rev;
     repo = "dfasma";
     owner = "gillesdegottex";
   };
 
+  buildInputs = [ fftw libsndfile qt5.base qt5.multimedia ];
+
+  postPatch = ''
+    substituteInPlace dfasma.pro --replace '$$DFASMAVERSIONGITPRO' '${version}'
+    cp -Rv "${reaperFork.src}"/* external/REAPER
+    cp -Rv "${libqaudioextra.src}"/* external/libqaudioextra
+  '';
+
+  configurePhase = ''
+    qmake PREFIX=$out PREFIXSHORTCUT=$out dfasma.pro
+  '';
+
+  enableParallelBuilding = true;
+
   meta = with stdenv.lib; {
     inherit version;
     description = "Analyse and compare audio files in time and frequency";
@@ -23,25 +65,8 @@ stdenv.mkDerivation {
       amplitude, this software does not aim to be an audio editor.
     '';
     homepage = http://gillesdegottex.github.io/dfasma/;
-    license = licenses.gpl3Plus;
-    platforms = with platforms; linux;
+    license = [ licenses.gpl3Plus reaperFork.meta.license ];
+    platforms = platforms.linux;
     maintainers = with maintainers; [ nckx ];
   };
-
-  buildInputs = [ fftw libsndfile qt5.base qt5.multimedia ];
-
-  postPatch = ''
-    substituteInPlace dfasma.pro --replace '$$DFASMAVERSIONGITPRO' '${version}'
-  '';
-
-  configurePhase = ''
-    qmake DESTDIR=$out/bin dfasma.pro
-  '';
-
-  enableParallelBuilding = true;
-
-  postInstall = ''
-    install -Dm644 distrib/dfasma.desktop $out/share/applications/dfasma.desktop
-    install -Dm644 icons/dfasma.png $out/share/pixmaps/dfasma.png
-  '';
 }

pkgs/applications/audio/fmit/default.nix

@@ -1,11 +1,11 @@
-# FIXME: upgrading qt5Full (Qt 5.3) to qt5.{base,multimedia} (Qt 5.4) breaks
-# the default Qt audio capture source!
-{ stdenv, fetchFromGitHub, fftw, freeglut, qt5Full
-, alsaSupport ? false, alsaLib ? null
-, jackSupport ? false, libjack2 ? null }:
+{ stdenv, fetchFromGitHub, fftw, freeglut, qt5
+, alsaSupport ? true, alsaLib ? null
+, jackSupport ? false, libjack2 ? null
+, portaudioSupport ? false, portaudio ? null }:
 
 assert alsaSupport -> alsaLib != null;
 assert jackSupport -> libjack2 != null;
+assert portaudioSupport -> portaudio != null;
 
 let version = "1.0.8"; in
 stdenv.mkDerivation {
@@ -18,9 +18,10 @@ stdenv.mkDerivation {
     owner = "gillesdegottex";
   };
 
-  buildInputs = [ fftw freeglut qt5Full ]
+  buildInputs = [ fftw freeglut qt5.base qt5.multimedia ]
     ++ stdenv.lib.optional alsaSupport [ alsaLib ]
-    ++ stdenv.lib.optional jackSupport [ libjack2 ];
+    ++ stdenv.lib.optional jackSupport [ libjack2 ]
+    ++ stdenv.lib.optional portaudioSupport [ portaudio ];
 
   configurePhase = ''
     mkdir build
@@ -28,6 +29,7 @@ stdenv.mkDerivation {
     qmake \
       CONFIG+=${stdenv.lib.optionalString alsaSupport "acs_alsa"} \
       CONFIG+=${stdenv.lib.optionalString jackSupport "acs_jack"} \
+      CONFIG+=${stdenv.lib.optionalString portaudioSupport "acs_portaudio"} \
       PREFIX="$out" PREFIXSHORTCUT="$out" \
       ../fmit.pro
   '';

pkgs/applications/audio/keyfinder-cli/default.nix

@@ -1,16 +1,22 @@
-{ stdenv, fetchFromGitHub, libav, libkeyfinder_0_11 }:
+{ stdenv, fetchFromGitHub, libav, libkeyfinder }:
 
-let version = "20150201"; in
+let version = "2015-09-13"; in
 stdenv.mkDerivation rec {
   name = "keyfinder-cli-${version}";
 
   src = fetchFromGitHub {
     repo = "keyfinder-cli";
     owner = "EvanPurkhiser";
-    rev = "e8a20e73f8a465a6c3c9e71dabf4b636244a9b0c";
-    sha256 = "0x198ijr6wgzq24642s4pz5zxn4gvcc7dxmb6d1bfn3dwzi3j8lp";
+    rev = "8579282f15ab3ebad937fed398ec5c88843be03d";
+    sha256 = "0jylykigxmsqvdny265k58vpxa4cqs1hq2f7mph1nl3apfx2shrh";
   };
 
+  buildInputs = [ libav libkeyfinder ];
+
+  makeFlagsArray = "PREFIX=$(out)";
+
+  enableParallelBuilding = true;
+
   meta = with stdenv.lib; {
     inherit version;
     inherit (src.meta) homepage;
@@ -21,13 +27,7 @@ stdenv.mkDerivation rec {
       used to estimate the musical key of many different audio formats.
     '';
     license = licenses.gpl3Plus;
-    platforms = with platforms; linux;
+    platforms = platforms.linux;
     maintainers = with maintainers; [ nckx ];
   };
-
-  buildInputs = [ libav libkeyfinder_0_11 ];
-
-  makeFlagsArray = "PREFIX=$(out)";
-
-  enableParallelBuilding = true;
 }

pkgs/applications/audio/pd-plugins/helmholtz/default.nix

@@ -6,6 +6,7 @@ stdenv.mkDerivation rec {
   src = fetchurl {
     url = "http://www.katjaas.nl/helmholtz/helmholtz~.zip";
     name = "helmholtz.zip";
+    curlOpts = "--user-agent ''";
     sha256 = "0h1fj7lmvq9j6rmw33rb8k0byxb898bi2xhcwkqalb84avhywgvs";
   };
 

pkgs/applications/audio/petrifoo/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, alsaLib, cmake, gtk, libjack2, libgnomecanvas
 , libpthreadstubs, libsamplerate, libsndfile, libtool, libxml2
-, pkgconfig }:
+, pkgconfig, openssl }:
 
 stdenv.mkDerivation  rec {
   name = "petri-foo-${version}";
@@ -13,7 +13,7 @@ stdenv.mkDerivation  rec {
 
   buildInputs =
    [ alsaLib cmake  gtk libjack2 libgnomecanvas libpthreadstubs
-     libsamplerate libsndfile libtool libxml2 pkgconfig
+     libsamplerate libsndfile libtool libxml2 pkgconfig openssl
    ];
 
   meta = with stdenv.lib; {

pkgs/applications/audio/praat/default.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchurl, alsaLib, gtk, pkgconfig }:
 
-let version = "5401"; in
+let version = "5417"; in
 stdenv.mkDerivation {
   name = "praat-${version}";
 
   src = fetchurl {
     url = "http://www.fon.hum.uva.nl/praat/praat${version}_sources.tar.gz";
-    sha256 = "1hx0simc0hp5w5scyaiw8h8lrpafra4h1zy1jn1kzb0299yd06n3";
+    sha256 = "1bspl963pb1s6k3cd9p3g5j518pxg6hkrann945lqsrvbzaa20kl";
   };
 
   configurePhase = ''

pkgs/applications/audio/qmidiroute/default.nix

@@ -0,0 +1,29 @@
+{ stdenv, fetchurl, pkgconfig, qt4, alsaLib }:
+
+stdenv.mkDerivation rec {
+  version = "0.3.0";
+  name = "qmidiroute-${version}";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/project/alsamodular/QMidiRoute/${version}/${name}.tar.gz";
+    sha256 = "11bfjz14z37v6hk2xyg4vrw423b5h3qgcbviv07g00ws1fgjygm2";
+  };
+
+  buildInputs = [ pkgconfig qt4 alsaLib ];
+
+  meta = with stdenv.lib; {
+    description = "MIDI event processor and router";
+    longDescription = ''
+    qmidiroute is a versatile MIDI event processor and router for the ALSA
+    sequencer.  The graphical  interface  is  based  on  the  Qt4  toolkit.
+    qmidiroute permits setting up an unlimited number of MIDI maps in which
+    incoming events are selected, modified or even changed in  type  before
+    being  directed  to  a  dedicated  ALSA  output  port. The maps work in
+    parallel, and they are organized in tabs.
+    '';
+
+    license = licenses.gpl2;
+    maintainers = [ maintainers.lebastr ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}

pkgs/applications/audio/renoise/default.nix

@@ -0,0 +1,61 @@
+{ stdenv, lib, requireFile, demo, fetchurl, libX11, libXext, libXcursor, libXrandr, libjack2, alsaLib, ... }:
+
+stdenv.mkDerivation rec {
+  name = "renoise";
+
+  buildInputs = [ libX11 libXext libXcursor libXrandr alsaLib libjack2 ];
+
+  src =
+    if builtins.currentSystem == "x86_64-linux" then
+        if demo then
+        fetchurl {
+            url = "http://files.renoise.com/demo/Renoise_3_0_1_Demo_x86_64.tar.bz2";
+            sha256 = "1q7f94wz2dbz659kpp53a3n1qyndsk0pkb29lxdff4pc3ddqwykg";
+        }
+        else
+        requireFile {
+            url = "http://backstage.renoise.com/frontend/app/index.html#/login";
+            name = "rns_3_0_1_reg_x86_64.tar.gz";
+            sha256 = "1swax2jz0gswdpzz8alwjfd8rhigc2yfspj7p8wvdvylqrf7n8q7";
+        }
+    else if builtins.currentSystem == "i686-linux" then
+        if demo then
+        fetchurl {
+            url = "http://files.renoise.com/demo/Renoise_3_0_1_Demo_x86.tar.bz2";
+            sha256 = "0dgqvib4xh2yhgh2wajj11wsb6xiiwgfkhyz32g8vnyaij5q8f58";
+        }
+        else
+        requireFile {
+            url = "http://backstage.renoise.com/frontend/app/index.html#/login";
+            name = "rns_3_0_1_reg_x86.tar.gz";
+            sha256 = "1swax2jz0gswdpzz8alwjfd8rhigc2yfspj7p8wvdvylqrf7n8q7";
+        }
+    else throw "platform is not suppored by Renoise";
+
+  installPhase = ''
+    cp -r Resources $out
+
+    mkdir -p $out/lib/
+
+    mv $out/AudioPluginServer* $out/lib/
+
+    cp renoise $out/renoise
+
+    for path in ${toString buildInputs}; do
+      ln -s $path/lib/*.so* $out/lib/
+    done
+
+    ln -s ${stdenv.cc.cc}/lib/libstdc++.so.6 $out/lib/
+
+    mkdir $out/bin
+    ln -s $out/renoise $out/bin/renoise
+
+    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) --set-rpath $out/lib $out/renoise
+  '';
+
+  meta = {
+    description = "modern tracker-based DAW";
+    homepage = http://www.renoise.com/;
+    license = stdenv.lib.licenses.unfree;
+  };
+}

pkgs/applications/audio/rosegarden/default.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation (rec {
                   libsndfile libsamplerate perl makedepend libjack2 ]
 		++ stdenv.lib.optional withLirc [ lirc ];
   
-  enableParallelBuilding = true;
+  #enableParallelBuilding = true; issues on hydra
   
   meta = with stdenv.lib; {
     homepage = http://www.rosegardenmusic.com/;

pkgs/applications/editors/atom/default.nix

@@ -16,11 +16,11 @@ let
   };
 in stdenv.mkDerivation rec {
   name = "atom-${version}";
-  version = "1.0.0";
+  version = "1.0.4";
 
   src = fetchurl {
     url = "https://github.com/atom/atom/releases/download/v${version}/atom-amd64.deb";
-    sha256 = "434be52726fed9804ddb8c07dba200d774d145d0a870d2a013b5f95eb882fa7e";
+    sha256 = "0jki2ca12mazvszy05xc7zy8nfpavl0rnzcyksvvic32l3w2yxj7";
     name = "${name}.deb";
   };
 

pkgs/applications/editors/codeblocks/default.nix

@@ -23,6 +23,10 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--enable-pch=no" ]
     ++ optional contribPlugins "--with-contrib-plugins";
 
+  # Fix boost 1.59 compat
+  # Try removing in the next version
+  CPPFLAGS = "-DBOOST_ERROR_CODE_HEADER_ONLY -DBOOST_SYSTEM_NO_DEPRECATED";
+
   meta = with stdenv.lib; {
     maintainers = [ maintainers.linquize ];
     platforms = platforms.all;