add vim-vanilla changes to vim_configurable

asterisk: fix service installation and upgrade to 13.6.0

.version

@@ -1 +1 @@
-15.08
+16.03

README.md

@@ -14,12 +14,12 @@ build daemon as so-called channels. To get channel information via git, add
 ```
 
 For stability and maximum binary package support, it is recommended to maintain
-custom changes on top of one of the channels, e.g. `nixos-14.12` for the latest
+custom changes on top of one of the channels, e.g. `nixos-15.09` for the latest
 release and `nixos-unstable` for the latest successful build of master:
 
 ```
 % git remote update channels
-% git rebase channels/nixos-14.12
+% git rebase channels/nixos-15.09
 ```
 
 For pull-requests, please rebase onto nixpkgs `master`.
@@ -33,8 +33,10 @@ For pull-requests, please rebase onto nixpkgs `master`.
 * [Manual (NixOS)](https://nixos.org/nixos/manual/)
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
 * [Continuous package builds for 14.12 release](https://hydra.nixos.org/jobset/nixos/release-14.12)
+* [Continuous package builds for 15.09 release](https://hydra.nixos.org/jobset/nixos/release-15.09)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
 * [Tests for 14.12 release](https://hydra.nixos.org/job/nixos/release-14.12/tested#tabs-constituents)
+* [Tests for 15.09 release](https://hydra.nixos.org/job/nixos/release-15.09/tested#tabs-constituents)
 
 Communication:
 

default.nix

@@ -1,6 +1,8 @@
-if ! builtins ? nixVersion || builtins.compareVersions "1.8" builtins.nixVersion == 1 then
+let requiredVersion = "1.10"; in
 
-  abort "This version of Nixpkgs requires Nix >= 1.8, please upgrade! See https://nixos.org/wiki/How_to_update_when_nix_is_too_old_to_evaluate_nixpkgs"
+if ! builtins ? nixVersion || builtins.compareVersions requiredVersion builtins.nixVersion == 1 then
+
+  abort "This version of Nixpkgs requires Nix >= ${requiredVersion}, please upgrade! See https://nixos.org/wiki/How_to_update_when_Nix_is_too_old_to_evaluate_Nixpkgs"
 
 else
 

doc/default.nix

@@ -6,7 +6,7 @@ stdenv.mkDerivation {
 
   sources = sourceFilesBySuffices ./. [".xml"];
 
-  buildInputs = [ libxml2 libxslt ];
+  buildInputs = [ pandoc libxml2 libxslt ];
 
   xsltFlags = ''
     --param section.autolabel 1
@@ -19,7 +19,23 @@ stdenv.mkDerivation {
   '';
 
   buildCommand = ''
-    ln -s $sources/*.xml . # */
+    {
+      echo "<chapter xmlns=\"http://docbook.org/ns/docbook\""
+      echo "         xmlns:xlink=\"http://www.w3.org/1999/xlink\""
+      echo "         xml:id=\"users-guide-to-the-haskell-infrastructure\">"
+      echo ""
+      echo "<title>User's Guide to the Haskell Infrastructure</title>"
+      echo ""
+      pandoc ${./haskell-users-guide.md} -w docbook | \
+        sed -e 's|<ulink url=|<link xlink:href=|' \
+            -e 's|</ulink>|</link>|' \
+            -e 's|<sect. id=|<section xml:id=|' \
+            -e 's|</sect[0-9]>|</section>|'
+      echo ""
+      echo "</chapter>"
+    } >haskell-users-guide.xml
+
+    ln -s "$sources/"*.xml .
 
     echo ${nixpkgsVersion} > .version
 
@@ -37,7 +53,7 @@ stdenv.mkDerivation {
     cp ${./style.css} $dst/style.css
 
     mkdir -p $dst/images/callouts
-    cp ${docbook5_xsl}/xml/xsl/docbook/images/callouts/*.gif $dst/images/callouts/
+    cp "${docbook5_xsl}/xml/xsl/docbook/images/callouts/"*.gif $dst/images/callouts/
 
     mkdir -p $out/nix-support
     echo "doc manual $dst manual.html" >> $out/nix-support/hydra-build-products

doc/functions.xml

@@ -127,7 +127,7 @@ in ...</programlisting>
   <title>lib.makeOverridable</title>
 
   <para>
-    The function <varname>lib.makeOverridable</varname> is used make the result
+    The function <varname>lib.makeOverridable</varname> is used to make the result
     of a function easily customizable. This utility only makes sense for functions
     that accept an argument set and return an attribute set.
   </para>
@@ -236,6 +236,20 @@ c = lib.makeOverridable f { a = 1; b = 2; }</programlisting>
     <literal>runScript</literal> parameter, which is a command that would be
     executed inside the sandbox and passed all the command line arguments. It
     default to <literal>bash</literal>.
+  </para>
+  <para>
+    It also uses <literal>CHROOTENV_EXTRA_BINDS</literal> environment variable
+    for binding extra directories in the sandbox to outside places. The format of
+    the variable is <literal>/mnt=test-mnt:/data</literal>, where
+    <literal>/mnt</literal> would be mounted as <literal>/test-mnt</literal>
+    and <literal>/data</literal> would be mounted as <literal>/data</literal>.
+    <literal>extraBindMounts</literal> array argument to
+    <function>buildFHSUserEnv</function> function is prepended to this variable.
+    Latter entries take priority if defined several times -- i.e. in case of
+    <literal>/data=data1:/data=data2</literal> the actual bind path would be
+    <literal>/data2</literal>.
+  </para>
+  <para>
     One can create a simple environment using a <literal>shell.nix</literal>
     like that:
   </para>
@@ -248,7 +262,7 @@ c = lib.makeOverridable f { a = 1; b = 2; }</programlisting>
   targetPkgs = pkgs: (with pkgs;
     [ udev
       alsaLib
-    ]) ++ (with pkgs.xlibs;
+    ]) ++ (with pkgs.xorg;
     [ libX11
       libXcursor
       libXrandr

doc/haskell-users-guide.md

@@ -0,0 +1,719 @@
+---
+title: User's Guide for Haskell in Nixpkgs
+author: Peter Simons
+date: 2015-06-01
+---
+
+# How to install Haskell packages
+
+Nixpkgs distributes build instructions for all Haskell packages registered on
+[Hackage](http://hackage.haskell.org/), but strangely enough normal Nix package
+lookups don't seem to discover any of them, except for the default version of ghc, cabal-install, and stack:
+
+    $ nix-env -i alex
+    error: selector ‘alex’ matches no derivations
+    $ nix-env -qa ghc
+    ghc-7.10.2
+
+The Haskell package set is not registered in the top-level namespace because it
+is *huge*. If all Haskell packages were visible to these commands, then
+name-based search/install operations would be much slower than they are now. We
+avoided that by keeping all Haskell-related packages in a separate attribute
+set called `haskellPackages`, which the following command will list:
+
+    $ nix-env -f "<nixpkgs>" -qaP -A haskellPackages
+    haskellPackages.a50         a50-0.5
+    haskellPackages.abacate     haskell-abacate-0.0.0.0
+    haskellPackages.abcBridge   haskell-abcBridge-0.12
+    haskellPackages.afv         afv-0.1.1
+    haskellPackages.alex        alex-3.1.4
+    haskellPackages.Allure      Allure-0.4.101.1
+    haskellPackages.alms        alms-0.6.7
+    [... some 8000 entries omitted  ...]
+
+To install any of those packages into your profile, refer to them by their
+attribute path (first column):
+
+    $ nix-env -f "<nixpkgs>" -iA haskellPackages.Allure ...
+
+The attribute path of any Haskell packages corresponds to the name of that
+particular package on Hackage: the package `cabal-install` has the attribute
+`haskellPackages.cabal-install`, and so on. (Actually, this convention causes
+trouble with packages like `3dmodels` and `4Blocks`, because these names are
+invalid identifiers in the Nix language. The issue of how to deal with these
+rare corner cases is currently unresolved.)
+
+Haskell packages who's Nix name (second column) begins with a `haskell-` prefix
+are packages that provide a library whereas packages without that prefix
+provide just executables. Libraries may provide executables too, though: the
+package `haskell-pandoc`, for example, installs both a library and an
+application. You can install and use Haskell executables just like any other
+program in Nixpkgs, but using Haskell libraries for development is a bit
+trickier and we'll address that subject in great detail in section [How to
+create a development environment].
+
+Attribute paths are deterministic inside of Nixpkgs, but the path necessary to
+reach Nixpkgs varies from system to system. We dodged that problem by giving
+`nix-env` an explicit `-f "<nixpkgs>"` parameter, but if you call `nix-env`
+without that flag, then chances are the invocation fails:
+
+    $ nix-env -iA haskellPackages.cabal-install
+    error: attribute ‘haskellPackages’ in selection path
+           ‘haskellPackages.cabal-install’ not found
+
+On NixOS, for example, Nixpkgs does *not* exist in the top-level namespace by
+default. To figure out the proper attribute path, it's easiest to query for the
+path of a well-known Nixpkgs package, i.e.:
+
+    $ nix-env -qaP coreutils
+    nixos.coreutils  coreutils-8.23
+
+If your system responds like that (most NixOS installations will), then the
+attribute path to `haskellPackages` is `nixos.haskellPackages`. Thus, if you
+want to use `nix-env` without giving an explicit `-f` flag, then that's the way
+to do it:
+
+    $ nix-env -qaP -A nixos.haskellPackages
+    $ nix-env -iA nixos.haskellPackages.cabal-install
+
+Our current default compiler is GHC 7.10.x and the `haskellPackages` set
+contains packages built with that particular version. Nixpkgs contains the
+latest major release of every GHC since 6.10.4, however, and there is a whole
+family of package sets available that defines Hackage packages built with each
+of those compilers, too:
+
+    $ nix-env -f "<nixpkgs>" -qaP -A haskell.packages.ghc6123
+    $ nix-env -f "<nixpkgs>" -qaP -A haskell.packages.ghc763
+
+The name `haskellPackages` is really just a synonym for
+`haskell.packages.ghc7102`, because we prefer that package set internally and
+recommend it to our users as their default choice, but ultimately you are free
+to compile your Haskell packages with any GHC version you please. The following
+command displays the complete list of available compilers:
+
+    $ nix-env -f "<nixpkgs>" -qaP -A haskell.compiler
+    haskell.compiler.ghc6104        ghc-6.10.4
+    haskell.compiler.ghc6123        ghc-6.12.3
+    haskell.compiler.ghc704         ghc-7.0.4
+    haskell.compiler.ghc722         ghc-7.2.2
+    haskell.compiler.ghc742         ghc-7.4.2
+    haskell.compiler.ghc763         ghc-7.6.3
+    haskell.compiler.ghc784         ghc-7.8.4
+    haskell.compiler.ghc7102        ghc-7.10.2
+    haskell.compiler.ghcHEAD        ghc-7.11.20150402
+    haskell.compiler.ghcNokinds     ghc-nokinds-7.11.20150704
+    haskell.compiler.ghcjs          ghcjs-0.1.0
+    haskell.compiler.jhc            jhc-0.8.2
+    haskell.compiler.uhc            uhc-1.1.9.0
+
+We have no package sets for `jhc` or `uhc` yet, unfortunately, but for every
+version of GHC listed above, there exists a package set based on that compiler.
+Also, the attributes `haskell.compiler.ghcXYC` and
+`haskell.packages.ghcXYC.ghc` are synonymous for the sake of convenience.
+
+# How to create a development environment
+
+## How to install a compiler
+
+A simple development environment consists of a Haskell compiler and the tool
+`cabal-install`, and we saw in section [How to install Haskell packages] how
+you can install those programs into your user profile:
+
+    $ nix-env -f "<nixpkgs>" -iA haskellPackages.ghc haskellPackages.cabal-install
+
+Instead of the default package set `haskellPackages`, you can also use the more
+precise name `haskell.compiler.ghc7102`, which has the advantage that it refers
+to the same GHC version regardless of what Nixpkgs considers "default" at any
+given time.
+
+Once you've made those tools available in `$PATH`, it's possible to build
+Hackage packages the same way people without access to Nix do it all the time:
+
+    $ cabal get lens-4.11 && cd lens-4.11
+    $ cabal install -j --dependencies-only
+    $ cabal configure
+    $ cabal build
+
+If you enjoy working with Cabal sandboxes, then that's entirely possible too:
+just execute the command
+
+    $ cabal sandbox init
+
+before installing the required dependencies.
+
+The `nix-shell` utility makes it easy to switch to a different compiler
+version; just enter the Nix shell environment with the command
+
+    $ nix-shell -p haskell.compiler.ghc784
+
+to bring GHC 7.8.4 into `$PATH`. Re-running `cabal configure` switches your
+build to use that compiler instead. If you're working on a project that doesn't
+depend on any additional system libraries outside of GHC, then it's sufficient
+even to run the `cabal configure` command inside of the shell:
+
+    $ nix-shell -p haskell.compiler.ghc784 --command "cabal configure"
+
+Afterwards, all other commands like `cabal build` work just fine in any shell
+environment, because the configure phase recorded the absolute paths to all
+required tools like GHC in its build configuration inside of the `dist/`
+directory. Please note, however, that `nix-collect-garbage` can break such an
+environment because the Nix store paths created by `nix-shell` aren't "alive"
+anymore once `nix-shell` has terminated. If you find that your Haskell builds
+no longer work after garbage collection, then you'll have to re-run `cabal
+configure` inside of a new `nix-shell` environment.
+
+## How to install a compiler with libraries
+
+GHC expects to find all installed libraries inside of its own `lib` directory.
+This approach works fine on traditional Unix systems, but it doesn't work for
+Nix, because GHC's store path is immutable once it's built. We cannot install
+additional libraries into that location. As a consequence, our copies of GHC
+don't know any packages except their own core libraries, like `base`,
+`containers`, `Cabal`, etc.
+
+We can register additional libraries to GHC, however, using a special build
+function called `ghcWithPackages`. That function expects one argument: a
+function that maps from an attribute set of Haskell packages to a list of
+packages, which determines the libraries known to that particular version of
+GHC. For example, the Nix expression `ghcWithPackages (pkgs: [pkgs.mtl])`
+generates a copy of GHC that has the `mtl` library registered in addition to
+its normal core packages:
+
+    $ nix-shell -p "haskellPackages.ghcWithPackages (pkgs: [pkgs.mtl])"
+
+    [nix-shell:~]$ ghc-pkg list mtl
+    /nix/store/zy79...-ghc-7.10.2/lib/ghc-7.10.2/package.conf.d:
+        mtl-2.2.1
+
+This function allows users to define their own development environment by means
+of an override. After adding the following snippet to `~/.nixpkgs/config.nix`,
+
+    {
+      packageOverrides = super: let self = super.pkgs; in
+      {
+        myHaskellEnv = self.haskell.packages.ghc7102.ghcWithPackages
+                         (haskellPackages: with haskellPackages; [
+                           # libraries
+                           arrows async cgi criterion
+                           # tools
+                           cabal-install haskintex
+                         ]);
+      };
+    }
+
+it's possible to install that compiler with `nix-env -f "<nixpkgs>" -iA
+myHaskellEnv`. If you'd like to switch that development environment to a
+different version of GHC, just replace the `ghc7102` bit in the previous
+definition with the appropriate name. Of course, it's also possible to define
+any number of these development environments! (You can't install two of them
+into the same profile at the same time, though, because that would result in
+file conflicts.)
+
+The generated `ghc` program is a wrapper script that re-directs the real
+GHC executable to use a new `lib` directory --- one that we specifically
+constructed to contain all those packages the user requested:
+
+    $ cat $(type -p ghc)
+    #! /nix/store/xlxj...-bash-4.3-p33/bin/bash -e
+    export NIX_GHC=/nix/store/19sm...-ghc-7.10.2/bin/ghc
+    export NIX_GHCPKG=/nix/store/19sm...-ghc-7.10.2/bin/ghc-pkg
+    export NIX_GHC_DOCDIR=/nix/store/19sm...-ghc-7.10.2/share/doc/ghc/html
+    export NIX_GHC_LIBDIR=/nix/store/19sm...-ghc-7.10.2/lib/ghc-7.10.2
+    exec /nix/store/j50p...-ghc-7.10.2/bin/ghc "-B$NIX_GHC_LIBDIR" "$@"
+
+The variables `$NIX_GHC`, `$NIX_GHCPKG`, etc. point to the *new* store path
+`ghcWithPackages` constructed specifically for this environment. The last line
+of the wrapper script then executes the real `ghc`, but passes the path to the
+new `lib` directory using GHC's `-B` flag.
+
+The purpose of those environment variables is to work around an impurity in the
+popular [ghc-paths](http://hackage.haskell.org/package/ghc-paths) library. That
+library promises to give its users access to GHC's installation paths. Only,
+the library can't possible know that path when it's compiled, because the path
+GHC considers its own is determined only much later, when the user configures
+it through `ghcWithPackages`. So we [patched
+ghc-paths](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/haskell-modules/ghc-paths-nix.patch)
+to return the paths found in those environment variables at run-time rather
+than trying to guess them at compile-time.
+
+To make sure that mechanism works properly all the time, we recommend that you
+set those variables to meaningful values in your shell environment, too, i.e.
+by adding the following code to your `~/.bashrc`:
+
+    if type >/dev/null 2>&1 -p ghc; then
+      eval "$(egrep ^export "$(type -p ghc)")"
+    fi
+
+If you are certain that you'll use only one GHC environment which is located in
+your user profile, then you can use the following code, too, which has the
+advantage that it doesn't contain any paths from the Nix store, i.e. those
+settings always remain valid even if a `nix-env -u` operation updates the GHC
+environment in your profile:
+
+    if [ -e ~/.nix-profile/bin/ghc ]; then
+      export NIX_GHC="$HOME/.nix-profile/bin/ghc"
+      export NIX_GHCPKG="$HOME/.nix-profile/bin/ghc-pkg"
+      export NIX_GHC_DOCDIR="$HOME/.nix-profile/share/doc/ghc/html"
+      export NIX_GHC_LIBDIR="$HOME/.nix-profile/lib/ghc-$($NIX_GHC --numeric-version)"
+    fi
+
+## How to install a compiler with libraries, hoogle and documentation indexes
+
+If you plan to use your environment for interactive programming, not just
+compiling random Haskell code, you might want to replace `ghcWithPackages` in
+all the listings above with `ghcWithHoogle`.
+
+This environment generator not only produces an environment with GHC and all
+the specified libraries, but also generates a `hoogle` and `haddock` indexes
+for all the packages, and provides a wrapper script around `hoogle` binary that
+uses all those things. A precise name for this thing would be
+"`ghcWithPackagesAndHoogleAndDocumentationIndexes`", which is, regrettably, too
+long and scary.
+
+For example, installing the following environment
+
+    {
+      packageOverrides = super: let self = super.pkgs; in
+      {
+        myHaskellEnv = self.haskellPackages.ghcWithHoogle
+                         (haskellPackages: with haskellPackages; [
+                           # libraries
+                           arrows async cgi criterion
+                           # tools
+                           cabal-install haskintex
+                         ]);
+      };
+    }
+
+allows one to browse module documentation index [not too dissimilar to
+this](https://downloads.haskell.org/~ghc/latest/docs/html/libraries/index.html)
+for all the specified packages and their dependencies by directing a browser of
+choice to `~/.nix-profiles/share/doc/hoogle/index.html` (or
+`/run/current-system/sw/share/doc/hoogle/index.html` in case you put it in
+`environment.systemPackages` in NixOS).
+
+After you've marveled enough at that try adding the following to your
+`~/.ghc/ghci.conf`
+
+    :def hoogle \s -> return $ ":! hoogle search -cl --count=15 \"" ++ s ++ "\""
+    :def doc \s -> return $ ":! hoogle search -cl --info \"" ++ s ++ "\""
+
+and test it by typing into `ghci`:
+
+    :hoogle a -> a
+    :doc a -> a
+
+Be sure to note the links to `haddock` files in the output. With any modern and
+properly configured terminal emulator you can just click those links to
+navigate there.
+
+Finally, you can run
+
+    hoogle server -p 8080
+
+and navigate to http://localhost:8080/ for your own local
+[Hoogle](https://www.haskell.org/hoogle/). Note, however, that Firefox and
+possibly other browsers disallow navigation from `http:` to `file:` URIs for
+security reasons, which might be quite an inconvenience. See [this
+page](http://kb.mozillazine.org/Links_to_local_pages_do_not_work) for
+workarounds.
+
+
+## How to create ad hoc environments for `nix-shell`
+
+The easiest way to create an ad hoc development environment is to run
+`nix-shell` with the appropriate GHC environment given on the command-line:
+
+    nix-shell -p "haskellPackages.ghcWithPackages (pkgs: with pkgs; [mtl pandoc])"
+
+For more sophisticated use-cases, however, it's more convenient to save the
+desired configuration in a file called `shell.nix` that looks like this:
+
+    { nixpkgs ? import <nixpkgs> {}, compiler ? "ghc7102" }:
+    let
+      inherit (nixpkgs) pkgs;
+      ghc = pkgs.haskell.packages.${compiler}.ghcWithPackages (ps: with ps; [
+              monad-par mtl
+            ]);
+    in
+    pkgs.stdenv.mkDerivation {
+      name = "my-haskell-env-0";
+      buildInputs = [ ghc ];
+      shellHook = "eval $(egrep ^export ${ghc}/bin/ghc)";
+    }
+
+Now run `nix-shell` --- or even `nix-shell --pure` --- to enter a shell
+environment that has the appropriate compiler in `$PATH`. If you use `--pure`,
+then add all other packages that your development environment needs into the
+`buildInputs` attribute. If you'd like to switch to a different compiler
+version, then pass an appropriate `compiler` argument to the expression, i.e.
+`nix-shell --argstr compiler ghc784`.
+
+If you need such an environment because you'd like to compile a Hackage package
+outside of Nix --- i.e. because you're hacking on the latest version from Git
+---, then the package set provides suitable nix-shell environments for you
+already! Every Haskell package has an `env` attribute that provides a shell
+environment suitable for compiling that particular package. If you'd like to
+hack the `lens` library, for example, then you just have to check out the
+source code and enter the appropriate environment:
+
+      $ cabal get lens-4.11 && cd lens-4.11
+      Downloading lens-4.11...
+      Unpacking to lens-4.11/
+
+      $ nix-shell "<nixpkgs>" -A haskellPackages.lens.env
+      [nix-shell:/tmp/lens-4.11]$
+
+At point, you can run `cabal configure`, `cabal build`, and all the other
+development commands. Note that you need `cabal-install` installed in your
+`$PATH` already to use it here --- the `nix-shell` environment does not provide
+it.
+
+# How to create Nix builds for your own private Haskell packages
+
+If your own Haskell packages have build instructions for Cabal, then you can
+convert those automatically into build instructions for Nix using the
+`cabal2nix` utility, which you can install into your profile by running
+`nix-env -i cabal2nix`.
+
+## How to build a stand-alone project
+
+For example, let's assume that you're working on a private project called
+`foo`. To generate a Nix build expression for it, change into the project's
+top-level directory and run the command:
+
+    $ cabal2nix . >foo.nix
+
+Then write the following snippet into a file called `default.nix`:
+
+    { nixpkgs ? import <nixpkgs> {}, compiler ? "ghc7102" }:
+    nixpkgs.pkgs.haskell.packages.${compiler}.callPackage ./foo.nix { }
+
+Finally, store the following code in a file called `shell.nix`:
+
+    { nixpkgs ? import <nixpkgs> {}, compiler ? "ghc7102" }:
+    (import ./default.nix { inherit nixpkgs compiler; }).env
+
+At this point, you can run `nix-build` to have Nix compile your project and
+install it into a Nix store path. The local directory will contain a symlink
+called `result` after `nix-build` returns that points into that location. Of
+course, passing the flag `--argstr compiler ghc763` allows switching the build
+to any version of GHC currently supported.
+
+Furthermore, you can call `nix-shell` to enter an interactive development
+environment in which you can use `cabal configure` and `cabal build` to develop
+your code. That environment will automatically contain a proper GHC derivation
+with all the required libraries registered as well as all the system-level
+libraries your package might need.
+
+If your package does not depend on any system-level libraries, then it's
+sufficient to run
+
+    $ nix-shell --command "cabal configure"
+
+once to set up your build. `cabal-install` determines the absolute paths to all
+resources required for the build and writes them into a config file in the
+`dist/` directory. Once that's done, you can run `cabal build` and any other
+command for that project even outside of the `nix-shell` environment. This
+feature is particularly nice for those of us who like to edit their code with
+an IDE, like Emacs' `haskell-mode`, because it's not necessary to start Emacs
+inside of nix-shell just to make it find out the necessary settings for
+building the project; `cabal-install` has already done that for us.
+
+If you want to do some quick-and-dirty hacking and don't want to bother setting
+up a `default.nix` and `shell.nix` file manually, then you can use the
+`--shell` flag offered by `cabal2nix` to have it generate a stand-alone
+`nix-shell` environment for you. With that feature, running
+
+    $ cabal2nix --shell . >shell.nix
+    $ nix-shell --command "cabal configure"
+
+is usually enough to set up a build environment for any given Haskell package.
+You can even use that generated file to run `nix-build`, too:
+
+    $ nix-build shell.nix
+
+## How to build projects that depend on each other
+
+If you have multiple private Haskell packages that depend on each other, then
+you'll have to register those packages in the Nixpkgs set to make them visible
+for the dependency resolution performed by `callPackage`. First of all, change
+into each of your projects top-level directories and generate a `default.nix`
+file with `cabal2nix`:
+
+    $ cd ~/src/foo && cabal2nix . >default.nix
+    $ cd ~/src/bar && cabal2nix . >default.nix
+
+Then edit your `~/.nixpkgs/config.nix` file to register those builds in the
+default Haskell package set:
+
+      {
+        packageOverrides = super: let self = super.pkgs; in
+        {
+          haskellPackages = super.haskellPackages.override {
+            overrides = self: super: {
+              foo = self.callPackage ../src/foo {};
+              bar = self.callPackage ../src/bar {};
+            };
+          };
+        };
+      }
+
+Once that's accomplished, `nix-env -f "<nixpkgs>" -qA haskellPackages` will
+show your packages like any other package from Hackage, and you can build them
+
+    $ nix-build "<nixpkgs>" -A haskellPackages.foo
+
+or enter an interactive shell environment suitable for building them:
+
+    $ nix-shell "<nixpkgs>" -A haskellPackages.bar.env
+
+# Miscellaneous Topics
+
+## How to build with profiling enabled
+
+Every Haskell package set takes a function called `overrides` that you can use
+to manipulate the package as much as you please. One useful application of this
+feature is to replace the default `mkDerivation` function with one that enables
+library profiling for all packages. To accomplish that, add configure the
+following snippet in your `~/.nixpkgs/config.nix` file:
+
+    {
+      packageOverrides = super: let self = super.pkgs; in
+      {
+        profiledHaskellPackages = self.haskellPackages.override {
+          overrides = self: super: {
+            mkDerivation = args: super.mkDerivation (args // {
+              enableLibraryProfiling = true;
+            });
+          };
+        };
+      };
+    }
+
+Then, replace instances of `haskellPackages` in the `cabal2nix`-generated
+`default.nix` or `shell.nix` files with `profiledHaskellPackages`.
+
+## How to override package versions in a compiler-specific package set
+
+Nixpkgs provides the latest version of
+[`ghc-events`](http://hackage.haskell.org/package/ghc-events), which is 0.4.4.0
+at the time of this writing. This is fine for users of GHC 7.10.x, but GHC
+7.8.4 cannot compile that binary. Now, one way to solve that problem is to
+register an older version of `ghc-events` in the 7.8.x-specific package set.
+The first step is to generate Nix build instructions with `cabal2nix`:
+
+    $ cabal2nix cabal://ghc-events-0.4.3.0 >~/.nixpkgs/ghc-events-0.4.3.0.nix
+
+Then add the override in `~/.nixpkgs/config.nix`:
+
+    {
+      packageOverrides = super: let self = super.pkgs; in
+      {
+        haskell = super.haskell // {
+          packages = super.haskell.packages // {
+            ghc784 = super.haskell.packages.ghc784.override {
+              overrides = self: super: {
+                ghc-events = self.callPackage ./ghc-events-0.4.3.0.nix {};
+              };
+            };
+          };
+        };
+      };
+    }
+
+This code is a little crazy, no doubt, but it's necessary because the intuitive
+version
+
+    haskell.packages.ghc784 = super.haskell.packages.ghc784.override {
+      overrides = self: super: {
+        ghc-events = self.callPackage ./ghc-events-0.4.3.0.nix {};
+      };
+    };
+
+doesn't do what we want it to: that code replaces the `haskell` package set in
+Nixpkgs with one that contains only one entry,`packages`, which contains only
+one entry `ghc784`. This override loses the `haskell.compiler` set, and it
+loses the `haskell.packages.ghcXYZ` sets for all compilers but GHC 7.8.4. To
+avoid that problem, we have to perform the convoluted little dance from above,
+iterating over each step in hierarchy.
+
+Once it's accomplished, however, we can install a variant of `ghc-events`
+that's compiled with GHC 7.8.4:
+
+    nix-env -f "<nixpkgs>" -iA haskell.packages.ghc784.ghc-events
+
+Unfortunately, it turns out that this build fails again while executing the
+test suite! Apparently, the release archive on Hackage is missing some data
+files that the test suite requires, so we cannot run it. We accomplish that by
+re-generating the Nix expression with the `--no-check` flag:
+
+    $ cabal2nix --no-check cabal://ghc-events-0.4.3.0 >~/.nixpkgs/ghc-events-0.4.3.0.nix
+
+Now the builds succeeds.
+
+Of course, in the concrete example of `ghc-events` this whole exercise is not
+an ideal solution, because `ghc-events` can analyze the output emitted by any
+version of GHC later than 6.12 regardless of the compiler version that was used
+to build the `ghc-events' executable, so strictly speaking there's no reason to
+prefer one built with GHC 7.8.x in the first place. However, for users who
+cannot use GHC 7.10.x at all for some reason, the approach of downgrading to an
+older version might be useful.
+
+## How to recover from GHC's infamous non-deterministic library ID bug
+
+GHC and distributed build farms don't get along well:
+
+    https://ghc.haskell.org/trac/ghc/ticket/4012
+
+When you see an error like this one
+
+    package foo-0.7.1.0 is broken due to missing package
+    text-1.2.0.4-98506efb1b9ada233bb5c2b2db516d91
+
+then you have to download and re-install `foo` and all its dependents from
+scratch:
+
+    # nix-store -q --referrers /nix/store/*-haskell-text-1.2.0.4 \
+      | xargs -L 1 nix-store --repair-path --option binary-caches http://hydra.nixos.org
+
+If you're using additional Hydra servers other than `hydra.nixos.org`, then it
+might be necessary to purge the local caches that store data from those
+machines to disable these binary channels for the duration of the previous
+command, i.e. by running:
+
+    rm /nix/var/nix/binary-cache-v3.sqlite
+    rm /nix/var/nix/manifests/*
+    rm /nix/var/nix/channel-cache/*
+
+## Builds on Darwin fail with `math.h` not found
+
+Users of GHC on Darwin have occasionally reported that builds fail, because the
+compiler complains about a missing include file:
+
+    fatal error: 'math.h' file not found
+
+The issue has been discussed at length in [ticket
+6390](https://github.com/NixOS/nixpkgs/issues/6390), and so far no good
+solution has been proposed. As a work-around, users who run into this problem
+can configure the environment variables
+
+    export NIX_CFLAGS_COMPILE="-idirafter /usr/include"
+    export NIX_CFLAGS_LINK="-L/usr/lib"
+
+in their `~/.bashrc` file to avoid the compiler error.
+
+## Using Stack together with Nix
+
+    --  While building package zlib-0.5.4.2 using:
+      runhaskell -package=Cabal-1.22.4.0 -clear-package-db [... lots of flags ...]
+    Process exited with code: ExitFailure 1
+    Logs have been written to: /home/foo/src/stack-ide/.stack-work/logs/zlib-0.5.4.2.log
+
+    Configuring zlib-0.5.4.2...
+    Setup.hs: Missing dependency on a foreign library:
+    * Missing (or bad) header file: zlib.h
+    This problem can usually be solved by installing the system package that
+    provides this library (you may need the "-dev" version). If the library is
+    already installed but in a non-standard location then you can use the flags
+    --extra-include-dirs= and --extra-lib-dirs= to specify where it is.
+    If the header file does exist, it may contain errors that are caught by the C
+    compiler at the preprocessing stage. In this case you can re-run configure
+    with the verbosity flag -v3 to see the error messages.
+
+When you run the build inside of the nix-shell environment, the system
+is configured to find libz.so without any special flags -- the compiler
+and linker "just know" how to find it. Consequently, Cabal won't record
+any search paths for libz.so in the package description, which means
+that the package works fine inside of nix-shell, but once you leave the
+shell the shared object can no longer be found. That issue is by no
+means specific to Stack: you'll have that problem with any other
+Haskell package that's built inside of nix-shell but run outside of that
+environment.
+
+I suppose we could try to remedy the issue by wrapping `stack` or
+`cabal` with a script that tries to find those kind of implicit search
+paths and makes them explicit on the "cabal configure" command line. I
+don't think anyone is working on that subject yet, though, because the
+problem doesn't seem so bad in practice.
+
+You can remedy that issue in several ways. First of all, run
+
+    $ nix-build --no-out-link "<nixpkgs>" -A zlib
+    /nix/store/alsvwzkiw4b7ip38l4nlfjijdvg3fvzn-zlib-1.2.8
+
+to find out the store path of the system's zlib library. Now, you can
+
+1) add that path (plus a "/lib" suffix) to your $LD_LIBRARY_PATH
+   environment variable to make sure your system linker finds libz.so
+   automatically. It's no pretty solution, but it will work.
+
+2) As a variant of (1), you can also install any number of system
+   libraries into your user's profile (or some other profile) and point
+   $LD_LIBRARY_PATH to that profile instead, so that you don't have to
+   list dozens of those store paths all over the place.
+
+3) The solution I prefer is to call stack with an appropriate
+   --extra-lib-dirs flag like so:
+
+    $ stack --extra-lib-dirs=/nix/store/alsvwzkiw4b7ip38l4nlfjijdvg3fvzn-zlib-1.2.8/lib build
+
+   Typically, you'll need --extra-include-dirs as well. It's possible
+   to add those flag to the project's "stack.yaml" or your user's
+   global "~/.stack/global/stack.yaml" file so that you don't have to
+   specify them manually every time.
+
+   The same thing applies to `cabal configure`, of course, if you're
+   building with `cabal-install` instead of Stack.
+
+## Creating statically linked binaries
+
+There are two levels of static linking. The first option is to configure the
+build with the Cabal flag `--disable-executable-dynamic`. In Nix expressions,
+this can be achieved by setting the attribute:
+
+    enableSharedExecutables = false;
+
+That gives you a binary with statically linked Haskell libraries and
+dynamically linked system libraries.
+
+To link both Haskell libraries and system libraries statically, the additional
+flags `--ghc-option=-optl=-static --ghc-option=-optl=-pthread` need to be used.
+In Nix, this is accomplished with:
+
+    configureFlags = [ "--ghc-option=-optl=-static" "--ghc-option=-optl=-pthread" ];
+
+It's important to realize, however, that most system libraries in Nix are built
+as shared libraries only, i.e. there is just no static library available that
+Cabal could link!
+
+
+# Other resources
+
+- The Youtube video [Nix Loves Haskell](https://www.youtube.com/watch?v=BsBhi_r-OeE)
+  provides an introduction into Haskell NG aimed at beginners. The slides are
+  available at http://cryp.to/nixos-meetup-3-slides.pdf and also -- in a form
+  ready for cut & paste -- at
+  https://github.com/NixOS/cabal2nix/blob/master/doc/nixos-meetup-3-slides.md.
+
+- Another Youtube video is [Escaping Cabal Hell with Nix](https://www.youtube.com/watch?v=mQd3s57n_2Y),
+  which discusses the subject of Haskell development with Nix but also provides
+  a basic introduction to Nix as well, i.e. it's suitable for viewers with
+  almost no prior Nix experience.
+
+- Oliver Charles wrote a very nice [Tutorial how to develop Haskell packages with Nix](http://wiki.ocharles.org.uk/Nix).
+
+- The *Journey into the Haskell NG infrastructure* series of postings
+  describe the new Haskell infrastructure in great detail:
+
+    - [Part 1](http://lists.science.uu.nl/pipermail/nix-dev/2015-January/015591.html)
+      explains the differences between the old and the new code and gives
+      instructions how to migrate to the new setup.
+
+    - [Part 2](http://lists.science.uu.nl/pipermail/nix-dev/2015-January/015608.html)
+      looks in-depth at how to tweak and configure your setup by means of
+      overrides.
+
+    - [Part 3](http://lists.science.uu.nl/pipermail/nix-dev/2015-April/016912.html)
+      describes the infrastructure that keeps the Haskell package set in Nixpkgs
+      up-to-date.

doc/haskell-users-guide.xml

@@ -1,758 +0,0 @@
-<chapter xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="users-guide-to-the-haskell-infrastructure">
-
-<title>User's Guide to the Haskell Infrastructure</title>
-
-<section xml:id="how-to-install-haskell-packages">
-  <title>How to install Haskell packages</title>
-  <para>
-    Nixpkgs distributes build instructions for all Haskell packages
-    registered on
-    <link xlink:href="http://hackage.haskell.org/">Hackage</link>, but
-    strangely enough normal Nix package lookups don't seem to discover
-    any of them:
-  </para>
-  <programlisting>
-$ nix-env -qa cabal-install
-error: selector ‘cabal-install’ matches no derivations
-
-$ nix-env -i ghc
-error: selector ‘ghc’ matches no derivations
-</programlisting>
-  <para>
-    The Haskell package set is not registered in the top-level namespace
-    because it is <emphasis>huge</emphasis>. If all Haskell packages
-    were visible to these commands, then name-based search/install
-    operations would be much slower than they are now. We avoided that
-    by keeping all Haskell-related packages in a separate attribute set
-    called <literal>haskellPackages</literal>, which the following
-    command will list:
-  </para>
-  <programlisting>
-$ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A haskellPackages
-haskellPackages.a50         a50-0.5
-haskellPackages.abacate     haskell-abacate-0.0.0.0
-haskellPackages.abcBridge   haskell-abcBridge-0.12
-haskellPackages.afv         afv-0.1.1
-haskellPackages.alex        alex-3.1.4
-haskellPackages.Allure      Allure-0.4.101.1
-haskellPackages.alms        alms-0.6.7
-[... some 8000 entries omitted  ...]
-</programlisting>
-  <para>
-    To install any of those packages into your profile, refer to them by
-    their attribute path (first column):
-  </para>
-  <programlisting>
-$ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskellPackages.Allure ...
-</programlisting>
-  <para>
-    The attribute path of any Haskell packages corresponds to the name
-    of that particular package on Hackage: the package
-    <literal>cabal-install</literal> has the attribute
-    <literal>haskellPackages.cabal-install</literal>, and so on.
-    (Actually, this convention causes trouble with packages like
-    <literal>3dmodels</literal> and <literal>4Blocks</literal>, because
-    these names are invalid identifiers in the Nix language. The issue
-    of how to deal with these rare corner cases is currently
-    unresolved.)
-  </para>
-  <para>
-    Haskell packages who's Nix name (second column) begins with a
-    <literal>haskell-</literal> prefix are packages that provide a
-    library whereas packages without that prefix provide just
-    executables. Libraries may provide executables too, though: the
-    package <literal>haskell-pandoc</literal>, for example, installs
-    both a library and an application. You can install and use Haskell
-    executables just like any other program in Nixpkgs, but using
-    Haskell libraries for development is a bit trickier and we'll
-    address that subject in great detail in section
-    <link linkend="how-to-create-a-development-environment">How to
-    create a development environment</link>.
-  </para>
-  <para>
-    Attribute paths are deterministic inside of Nixpkgs, but the path
-    necessary to reach Nixpkgs varies from system to system. We dodged
-    that problem by giving <literal>nix-env</literal> an explicit
-    <literal>-f &quot;&lt;nixpkgs&gt;&quot;</literal> parameter, but if
-    you call <literal>nix-env</literal> without that flag, then chances
-    are the invocation fails:
-  </para>
-  <programlisting>
-$ nix-env -iA haskellPackages.cabal-install
-error: attribute ‘haskellPackages’ in selection path
-       ‘haskellPackages.cabal-install’ not found
-</programlisting>
-  <para>
-    On NixOS, for example, Nixpkgs does <emphasis>not</emphasis> exist
-    in the top-level namespace by default. To figure out the proper
-    attribute path, it's easiest to query for the path of a well-known
-    Nixpkgs package, i.e.:
-  </para>
-  <programlisting>
-$ nix-env -qaP coreutils
-nixos.coreutils  coreutils-8.23
-</programlisting>
-  <para>
-    If your system responds like that (most NixOS installatios will),
-    then the attribute path to <literal>haskellPackages</literal> is
-    <literal>nixos.haskellPackages</literal>. Thus, if you want to
-    use <literal>nix-env</literal> without giving an explicit
-    <literal>-f</literal> flag, then that's the way to do it:
-  </para>
-  <programlisting>
-$ nix-env -qaP -A nixos.haskellPackages
-$ nix-env -iA nixos.haskellPackages.cabal-install
-</programlisting>
-  <para>
-    Our current default compiler is GHC 7.10.x and the
-    <literal>haskellPackages</literal> set contains packages built with
-    that particular version. Nixpkgs contains the latest major release
-    of every GHC since 6.10.4, however, and there is a whole family of
-    package sets available that defines Hackage packages built with each
-    of those compilers, too:
-  </para>
-  <programlisting>
-$ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A haskell.packages.ghc6123
-$ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A haskell.packages.ghc763
-</programlisting>
-  <para>
-    The name <literal>haskellPackages</literal> is really just a synonym
-    for <literal>haskell.packages.ghc7101</literal>, because we prefer
-    that package set internally and recommend it to our users as their
-    default choice, but ultimately you are free to compile your Haskell
-    packages with any GHC version you please. The following command
-    displays the complete list of available compilers:
-  </para>
-  <programlisting>
-$ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A haskell.compiler
-haskell.compiler.ghc6104        ghc-6.10.4
-haskell.compiler.ghc6123        ghc-6.12.3
-haskell.compiler.ghc704         ghc-7.0.4
-haskell.compiler.ghc722         ghc-7.2.2
-haskell.compiler.ghc742         ghc-7.4.2
-haskell.compiler.ghc763         ghc-7.6.3
-haskell.compiler.ghc784         ghc-7.8.4
-haskell.compiler.ghc7101        ghc-7.10.1
-haskell.compiler.ghcHEAD        ghc-7.11.20150402
-haskell.compiler.ghcNokinds     ghc-nokinds-7.11.20150704
-haskell.compiler.ghcjs          ghcjs-0.1.0
-haskell.compiler.jhc            jhc-0.8.2
-haskell.compiler.uhc            uhc-1.1.9.0
-</programlisting>
-  <para>
-    We have no package sets for <literal>jhc</literal> or
-    <literal>uhc</literal> yet, unfortunately, but for every version of
-    GHC listed above, there exists a package set based on that compiler.
-    Also, the attributes <literal>haskell.compiler.ghcXYC</literal> and
-    <literal>haskell.packages.ghcXYC.ghc</literal> are synonymous for
-    the sake of convenience.
-  </para>
-</section>
-<section xml:id="how-to-create-a-development-environment">
-  <title>How to create a development environment</title>
-  <section xml:id="how-to-install-a-compiler">
-    <title>How to install a compiler</title>
-    <para>
-      A simple development environment consists of a Haskell compiler
-      and the tool <literal>cabal-install</literal>, and we saw in
-      section <link linkend="how-to-install-haskell-packages">How to
-      install Haskell packages</link> how you can install those programs
-      into your user profile:
-    </para>
-    <programlisting>
-$ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskellPackages.ghc haskellPackages.cabal-install
-</programlisting>
-    <para>
-      Instead of the default package set
-      <literal>haskellPackages</literal>, you can also use the more
-      precise name <literal>haskell.compiler.ghc7101</literal>, which
-      has the advantage that it refers to the same GHC version
-      regardless of what Nixpkgs considers &quot;default&quot; at any
-      given time.
-    </para>
-    <para>
-      Once you've made those tools available in
-      <literal>$PATH</literal>, it's possible to build Hackage packages
-      the same way people without access to Nix do it all the time:
-    </para>
-    <programlisting>
-$ cabal get lens-4.11 &amp;&amp; cd lens-4.11
-$ cabal install -j --dependencies-only
-$ cabal configure
-$ cabal build
-</programlisting>
-    <para>
-      If you enjoy working with Cabal sandboxes, then that's entirely
-      possible too: just execute the command
-    </para>
-    <programlisting>
-$ cabal sandbox init
-</programlisting>
-    <para>
-      before installing the required dependencies.
-    </para>
-    <para>
-      The <literal>nix-shell</literal> utility makes it easy to switch
-      to a different compiler version; just enter the Nix shell
-      environment with the command
-    </para>
-    <programlisting>
-$ nix-shell -p haskell.compiler.ghc784
-</programlisting>
-    <para>
-      to bring GHC 7.8.4 into <literal>$PATH</literal>. Re-running
-      <literal>cabal configure</literal> switches your build to use that
-      compiler instead. If you're working on a project that doesn't
-      depend on any additional system libraries outside of GHC, then
-      it's sufficient even to run the <literal>cabal configure</literal>
-      command inside of the shell:
-    </para>
-    <programlisting>
-$ nix-shell -p haskell.compiler.ghc784 --command &quot;cabal configure&quot;
-</programlisting>
-    <para>
-      Afterwards, all other commands like <literal>cabal build</literal>
-      work just fine in any shell environment, because the configure
-      phase recorded the absolute paths to all required tools like GHC
-      in its build configuration inside of the <literal>dist/</literal>
-      directory. Please note, however, that
-      <literal>nix-collect-garbage</literal> can break such an
-      environment because the Nix store paths created by
-      <literal>nix-shell</literal> aren't &quot;alive&quot; anymore once
-      <literal>nix-shell</literal> has terminated. If you find that your
-      Haskell builds no longer work after garbage collection, then
-      you'll have to re-run <literal>cabal configure</literal> inside of
-      a new <literal>nix-shell</literal> environment.
-    </para>
-  </section>
-  <section xml:id="how-to-install-a-compiler-with-libraries">
-    <title>How to install a compiler with libraries</title>
-    <para>
-      GHC expects to find all installed libraries inside of its own
-      <literal>lib</literal> directory. This approach works fine on
-      traditional Unix systems, but it doesn't work for Nix, because
-      GHC's store path is immutable once it's built. We cannot install
-      additional libraries into that location. As a consequence, our
-      copies of GHC don't know any packages except their own core
-      libraries, like <literal>base</literal>,
-      <literal>containers</literal>, <literal>Cabal</literal>, etc.
-    </para>
-    <para>
-      We can register additional libraries to GHC, however, using a
-      special build function called <literal>ghcWithPackages</literal>.
-      That function expects one argument: a function that maps from an
-      attribute set of Haskell packages to a list of packages, which
-      determines the libraries known to that particular version of GHC.
-      For example, the Nix expression
-      <literal>ghcWithPackages (pkgs: [pkgs.mtl])</literal> generates a
-      copy of GHC that has the <literal>mtl</literal> library registered
-      in addition to its normal core packages:
-    </para>
-    <programlisting>
-$ nix-shell -p &quot;haskellPackages.ghcWithPackages (pkgs: [pkgs.mtl])&quot;
-
-[nix-shell:~]$ ghc-pkg list mtl
-/nix/store/zy79...-ghc-7.10.1/lib/ghc-7.10.1/package.conf.d:
-    mtl-2.2.1
-</programlisting>
-    <para>
-      This function allows users to define their own development
-      environment by means of an override. After adding the following
-      snippet to <literal>~/.nixpkgs/config.nix</literal>,
-    </para>
-    <programlisting>
-{
-  packageOverrides = super: let self = super.pkgs; in
-  {
-    myHaskellEnv = self.haskell.packages.ghc7101.ghcWithPackages
-                     (haskellPackages: with haskellPackages; [
-                       # libraries
-                       arrows async cgi criterion
-                       # tools
-                       cabal-install haskintex
-                     ]);
-  };
-}
-</programlisting>
-    <para>
-      it's possible to install that compiler with
-      <literal>nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA myHaskellEnv</literal>.
-      If you'd like to switch that development environment to a
-      different version of GHC, just replace the
-      <literal>ghc7101</literal> bit in the previous definition with the
-      appropriate name. Of course, it's also possible to define any
-      number of these development environments! (You can't install two
-      of them into the same profile at the same time, though, because
-      that would result in file conflicts.)
-    </para>
-    <para>
-      The generated <literal>ghc</literal> program is a wrapper script
-      that re-directs the real GHC executable to use a new
-      <literal>lib</literal> directory --- one that we specifically
-      constructed to contain all those packages the user requested:
-    </para>
-    <programlisting>
-$ cat $(type -p ghc)
-#! /nix/store/xlxj...-bash-4.3-p33/bin/bash -e
-export NIX_GHC=/nix/store/19sm...-ghc-7.10.1/bin/ghc
-export NIX_GHCPKG=/nix/store/19sm...-ghc-7.10.1/bin/ghc-pkg
-export NIX_GHC_DOCDIR=/nix/store/19sm...-ghc-7.10.1/share/doc/ghc/html
-export NIX_GHC_LIBDIR=/nix/store/19sm...-ghc-7.10.1/lib/ghc-7.10.1
-exec /nix/store/j50p...-ghc-7.10.1/bin/ghc &quot;-B$NIX_GHC_LIBDIR&quot; &quot;$@&quot;
-</programlisting>
-    <para>
-      The variables <literal>$NIX_GHC</literal>,
-      <literal>$NIX_GHCPKG</literal>, etc. point to the
-      <emphasis>new</emphasis> store path
-      <literal>ghcWithPackages</literal> constructed specifically for
-      this environment. The last line of the wrapper script then
-      executes the real <literal>ghc</literal>, but passes the path to
-      the new <literal>lib</literal> directory using GHC's
-      <literal>-B</literal> flag.
-    </para>
-    <para>
-      The purpose of those environment variables is to work around an
-      impurity in the popular
-      <link xlink:href="http://hackage.haskell.org/package/ghc-paths">ghc-paths</link>
-      library. That library promises to give its users access to GHC's
-      installation paths. Only, the library can't possible know that
-      path when it's compiled, because the path GHC considers its own is
-      determined only much later, when the user configures it through
-      <literal>ghcWithPackages</literal>. So we
-      <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/haskell-modules/ghc-paths-nix.patch">patched
-      ghc-paths</link> to return the paths found in those environment
-      variables at run-time rather than trying to guess them at
-      compile-time.
-    </para>
-    <para>
-      To make sure that mechanism works properly all the time, we
-      recommend that you set those variables to meaningful values in
-      your shell environment, too, i.e. by adding the following code to
-      your <literal>~/.bashrc</literal>:
-    </para>
-    <programlisting>
-if type &gt;/dev/null 2&gt;&amp;1 -p ghc; then
-  eval &quot;$(egrep ^export &quot;$(type -p ghc)&quot;)&quot;
-fi
-</programlisting>
-    <para>
-      If you are certain that you'll use only one GHC environment which
-      is located in your user profile, then you can use the following
-      code, too, which has the advantage that it doesn't contain any
-      paths from the Nix store, i.e. those settings always remain valid
-      even if a <literal>nix-env -u</literal> operation updates the GHC
-      environment in your profile:
-    </para>
-    <programlisting>
-if [ -e ~/.nix-profile/bin/ghc ]; then
-  export NIX_GHC=&quot;$HOME/.nix-profile/bin/ghc&quot;
-  export NIX_GHCPKG=&quot;$HOME/.nix-profile/bin/ghc-pkg&quot;
-  export NIX_GHC_DOCDIR=&quot;$HOME/.nix-profile/share/doc/ghc/html&quot;
-  export NIX_GHC_LIBDIR=&quot;$HOME/.nix-profile/lib/ghc-$($NIX_GHC --numeric-version)&quot;
-fi
-</programlisting>
-  </section>
-  <section xml:id="how-to-create-ad-hoc-environments-for-nix-shell">
-    <title>How to create ad hoc environments for
-    <literal>nix-shell</literal></title>
-    <para>
-      The easiest way to create an ad hoc development environment is to
-      run <literal>nix-shell</literal> with the appropriate GHC
-      environment given on the command-line:
-    </para>
-    <programlisting>
-nix-shell -p &quot;haskellPackages.ghcWithPackages (pkgs: with pkgs; [mtl pandoc])&quot;
-</programlisting>
-    <para>
-      For more sophisticated use-cases, however, it's more convenient to
-      save the desired configuration in a file called
-      <literal>shell.nix</literal> that looks like this:
-    </para>
-    <programlisting>
-{ nixpkgs ? import &lt;nixpkgs&gt; {}, compiler ? &quot;ghc7101&quot; }:
-let
-  inherit (nixpkgs) pkgs;
-  ghc = pkgs.haskell.packages.${compiler}.ghcWithPackages (ps: with ps; [
-          monad-par mtl
-        ]);
-in
-pkgs.stdenv.mkDerivation {
-  name = &quot;my-haskell-env-0&quot;;
-  buildInputs = [ ghc ];
-  shellHook = &quot;eval $(egrep ^export ${ghc}/bin/ghc)&quot;;
-}
-</programlisting>
-    <para>
-      Now run <literal>nix-shell</literal> --- or even
-      <literal>nix-shell --pure</literal> --- to enter a shell
-      environment that has the appropriate compiler in
-      <literal>$PATH</literal>. If you use <literal>--pure</literal>,
-      then add all other packages that your development environment
-      needs into the <literal>buildInputs</literal> attribute. If you'd
-      like to switch to a different compiler version, then pass an
-      appropriate <literal>compiler</literal> argument to the
-      expression, i.e.
-      <literal>nix-shell --argstr compiler ghc784</literal>.
-    </para>
-    <para>
-      If you need such an environment because you'd like to compile a
-      Hackage package outside of Nix --- i.e. because you're hacking on
-      the latest version from Git ---, then the package set provides
-      suitable nix-shell environments for you already! Every Haskell
-      package has an <literal>env</literal> attribute that provides a
-      shell environment suitable for compiling that particular package.
-      If you'd like to hack the <literal>lens</literal> library, for
-      example, then you just have to check out the source code and enter
-      the appropriate environment:
-    </para>
-    <programlisting>
-  $ cabal get lens-4.11 &amp;&amp; cd lens-4.11
-  Downloading lens-4.11...
-  Unpacking to lens-4.11/
-
-  $ nix-shell &quot;&lt;nixpkgs&gt;&quot; -A haskellPackages.lens.env
-  [nix-shell:/tmp/lens-4.11]$
-</programlisting>
-    <para>
-      At point, you can run <literal>cabal configure</literal>,
-      <literal>cabal build</literal>, and all the other development
-      commands. Note that you need <literal>cabal-install</literal>
-      installed in your <literal>$PATH</literal> already to use it here
-      --- the <literal>nix-shell</literal> environment does not provide
-      it.
-    </para>
-  </section>
-</section>
-<section xml:id="how-to-create-nix-builds-for-your-own-private-haskell-packages">
-  <title>How to create Nix builds for your own private Haskell
-  packages</title>
-  <para>
-    If your own Haskell packages have build instructions for Cabal, then
-    you can convert those automatically into build instructions for Nix
-    using the <literal>cabal2nix</literal> utility, which you can
-    install into your profile by running
-    <literal>nix-env -i cabal2nix</literal>.
-  </para>
-  <section xml:id="how-to-build-a-stand-alone-project">
-    <title>How to build a stand-alone project</title>
-    <para>
-      For example, let's assume that you're working on a private project
-      called <literal>foo</literal>. To generate a Nix build expression
-      for it, change into the project's top-level directory and run the
-      command:
-    </para>
-    <programlisting>
-$ cabal2nix . &gt;foo.nix
-</programlisting>
-    <para>
-      Then write the following snippet into a file called
-      <literal>default.nix</literal>:
-    </para>
-    <programlisting>
-{ nixpkgs ? import &lt;nixpkgs&gt; {}, compiler ? &quot;ghc7101&quot; }:
-nixpkgs.pkgs.haskell.packages.${compiler}.callPackage ./foo.nix { }
-</programlisting>
-    <para>
-      Finally, store the following code in a file called
-      <literal>shell.nix</literal>:
-    </para>
-    <programlisting>
-{ nixpkgs ? import &lt;nixpkgs&gt; {}, compiler ? &quot;ghc7101&quot; }:
-(import ./default.nix { inherit nixpkgs compiler; }).env
-</programlisting>
-    <para>
-      At this point, you can run <literal>nix-build</literal> to have
-      Nix compile your project and install it into a Nix store path. The
-      local directory will contain a symlink called
-      <literal>result</literal> after <literal>nix-build</literal>
-      returns that points into that location. Of course, passing the
-      flag <literal>--argstr compiler ghc763</literal> allows switching
-      the build to any version of GHC currently supported.
-    </para>
-    <para>
-      Furthermore, you can call <literal>nix-shell</literal> to enter an
-      interactive development environment in which you can use
-      <literal>cabal configure</literal> and
-      <literal>cabal build</literal> to develop your code. That
-      environment will automatically contain a proper GHC derivation
-      with all the required libraries registered as well as all the
-      system-level libraries your package might need.
-    </para>
-    <para>
-      If your package does not depend on any system-level libraries,
-      then it's sufficient to run
-    </para>
-    <programlisting>
-$ nix-shell --command &quot;cabal configure&quot;
-</programlisting>
-    <para>
-      once to set up your build. <literal>cabal-install</literal>
-      determines the absolute paths to all resources required for the
-      build and writes them into a config file in the
-      <literal>dist/</literal> directory. Once that's done, you can run
-      <literal>cabal build</literal> and any other command for that
-      project even outside of the <literal>nix-shell</literal>
-      environment. This feature is particularly nice for those of us who
-      like to edit their code with an IDE, like Emacs'
-      <literal>haskell-mode</literal>, because it's not necessary to
-      start Emacs inside of nix-shell just to make it find out the
-      necessary settings for building the project;
-      <literal>cabal-install</literal> has already done that for us.
-    </para>
-    <para>
-      If you want to do some quick-and-dirty hacking and don't want to
-      bother setting up a <literal>default.nix</literal> and
-      <literal>shell.nix</literal> file manually, then you can use the
-      <literal>--shell</literal> flag offered by
-      <literal>cabal2nix</literal> to have it generate a stand-alone
-      <literal>nix-shell</literal> environment for you. With that
-      feature, running
-    </para>
-    <programlisting>
-$ cabal2nix --shell . &gt;shell.nix
-$ nix-shell --command &quot;cabal configure&quot;
-</programlisting>
-    <para>
-      is usually enough to set up a build environment for any given
-      Haskell package. You can even use that generated file to run
-      <literal>nix-build</literal>, too:
-    </para>
-    <programlisting>
-$ nix-build shell.nix
-</programlisting>
-  </section>
-  <section xml:id="how-to-build-projects-that-depend-on-each-other">
-    <title>How to build projects that depend on each other</title>
-    <para>
-      If you have multiple private Haskell packages that depend on each
-      other, then you'll have to register those packages in the Nixpkgs
-      set to make them visible for the dependency resolution performed
-      by <literal>callPackage</literal>. First of all, change into each
-      of your projects top-level directories and generate a
-      <literal>default.nix</literal> file with
-      <literal>cabal2nix</literal>:
-    </para>
-    <programlisting>
-$ cd ~/src/foo &amp;&amp; cabal2nix . &gt;default.nix
-$ cd ~/src/bar &amp;&amp; cabal2nix . &gt;default.nix
-</programlisting>
-    <para>
-      Then edit your <literal>~/.nixpkgs/config.nix</literal> file to
-      register those builds in the default Haskell package set:
-    </para>
-    <programlisting>
-  {
-    packageOverrides = super: let self = super.pkgs; in
-    {
-      haskellPackages = super.haskellPackages.override {
-        overrides = self: super: {
-          foo = self.callPackage ../src/foo {};
-          bar = self.callPackage ../src/bar {};
-        };
-      };
-    };
-  }
-</programlisting>
-    <para>
-      Once that's accomplished,
-      <literal>nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qA haskellPackages</literal>
-      will show your packages like any other package from Hackage, and
-      you can build them
-    </para>
-    <programlisting>
-$ nix-build &quot;&lt;nixpkgs&gt;&quot; -A haskellPackages.foo
-</programlisting>
-    <para>
-      or enter an interactive shell environment suitable for building
-      them:
-    </para>
-    <programlisting>
-$ nix-shell &quot;&lt;nixpkgs&gt;&quot; -A haskellPackages.bar.env
-</programlisting>
-  </section>
-</section>
-<section xml:id="miscellaneous-topics">
-  <title>Miscellaneous Topics</title>
-  <section xml:id="how-to-build-with-profiling-enabled">
-    <title>How to build with profiling enabled</title>
-    <para>
-      Every Haskell package set takes a function called
-      <literal>overrides</literal> that you can use to manipulate the
-      package as much as you please. One useful application of this
-      feature is to replace the default <literal>mkDerivation</literal>
-      function with one that enables library profiling for all packages.
-      To accomplish that, add configure the following snippet in your
-      <literal>~/.nixpkgs/config.nix</literal> file:
-    </para>
-    <programlisting>
-{
-  packageOverrides = super: let self = super.pkgs; in
-  {
-    profiledHaskellPackages = self.haskellPackages.override {
-      overrides = self: super: {
-        mkDerivation = args: super.mkDerivation (args // {
-          enableLibraryProfiling = true;
-        });
-      };
-    };
-  };
-}
-</programlisting>
-  </section>
-  <section xml:id="how-to-override-package-versions-in-a-compiler-specific-package-set">
-    <title>How to override package versions in a compiler-specific
-    package set</title>
-    <para>
-      Nixpkgs provides the latest version of
-      <link xlink:href="http://hackage.haskell.org/package/ghc-events"><literal>ghc-events</literal></link>,
-      which is 0.4.4.0 at the time of this writing. This is fine for
-      users of GHC 7.10.x, but GHC 7.8.4 cannot compile that binary.
-      Now, one way to solve that problem is to register an older version
-      of <literal>ghc-events</literal> in the 7.8.x-specific package
-      set. The first step is to generate Nix build instructions with
-      <literal>cabal2nix</literal>:
-    </para>
-    <programlisting>
-$ cabal2nix cabal://ghc-events-0.4.3.0 &gt;~/.nixpkgs/ghc-events-0.4.3.0.nix
-</programlisting>
-    <para>
-      Then add the override in <literal>~/.nixpkgs/config.nix</literal>:
-    </para>
-    <programlisting>
-{
-  packageOverrides = super: let self = super.pkgs; in
-  {
-    haskell = super.haskell // {
-      packages = super.haskell.packages // {
-        ghc784 = super.haskell.packages.ghc784.override {
-          overrides = self: super: {
-            ghc-events = self.callPackage ./ghc-events-0.4.3.0.nix {};
-          };
-        };
-      };
-    };
-  };
-}
-</programlisting>
-    <para>
-      This code is a little crazy, no doubt, but it's necessary because
-      the intuitive version
-    </para>
-    <programlisting>
-haskell.packages.ghc784 = super.haskell.packages.ghc784.override {
-  overrides = self: super: {
-    ghc-events = self.callPackage ./ghc-events-0.4.3.0.nix {};
-  };
-};
-</programlisting>
-    <para>
-      doesn't do what we want it to: that code replaces the
-      <literal>haskell</literal> package set in Nixpkgs with one that
-      contains only one entry,<literal>packages</literal>, which
-      contains only one entry <literal>ghc784</literal>. This override
-      loses the <literal>haskell.compiler</literal> set, and it loses
-      the <literal>haskell.packages.ghcXYZ</literal> sets for all
-      compilers but GHC 7.8.4. To avoid that problem, we have to perform
-      the convoluted little dance from above, iterating over each step
-      in hierarchy.
-    </para>
-    <para>
-      Once it's accomplished, however, we can install a variant of
-      <literal>ghc-events</literal> that's compiled with GHC 7.8.4:
-    </para>
-    <programlisting>
-nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskell.packages.ghc784.ghc-events
-</programlisting>
-    <para>
-      Unfortunately, it turns out that this build fails again while
-      executing the test suite! Apparently, the release archive on
-      Hackage is missing some data files that the test suite requires,
-      so we cannot run it. We accomplish that by re-generating the Nix
-      expression with the <literal>--no-check</literal> flag:
-    </para>
-    <programlisting>
-$ cabal2nix --no-check cabal://ghc-events-0.4.3.0 &gt;~/.nixpkgs/ghc-events-0.4.3.0.nix
-</programlisting>
-    <para>
-      Now the builds succeeds.
-    </para>
-    <para>
-      Of course, in the concrete example of
-      <literal>ghc-events</literal> this whole exercise is not an ideal
-      solution, because <literal>ghc-events</literal> can analyze the
-      output emitted by any version of GHC later than 6.12 regardless of
-      the compiler version that was used to build the `ghc-events'
-      executable, so strictly speaking there's no reason to prefer one
-      built with GHC 7.8.x in the first place. However, for users who
-      cannot use GHC 7.10.x at all for some reason, the approach of
-      downgrading to an older version might be useful.
-    </para>
-  </section>
-  <section xml:id="how-to-recover-from-ghcs-infamous-non-deterministic-library-id-bug">
-    <title>How to recover from GHC's infamous non-deterministic library
-    ID bug</title>
-    <para>
-      GHC and distributed build farms don't get along well:
-    </para>
-    <programlisting>
-https://ghc.haskell.org/trac/ghc/ticket/4012
-</programlisting>
-    <para>
-      When you see an error like this one
-    </para>
-    <programlisting>
-package foo-0.7.1.0 is broken due to missing package
-text-1.2.0.4-98506efb1b9ada233bb5c2b2db516d91
-</programlisting>
-    <para>
-      then you have to download and re-install <literal>foo</literal>
-      and all its dependents from scratch:
-    </para>
-    <programlisting>
-# nix-store -q --referrers /nix/store/*-haskell-text-1.2.0.4 \
-  | xargs -L 1 nix-store --repair-path --option binary-caches http://hydra.nixos.org
-</programlisting>
-    <para>
-      If you're using additional Hydra servers other than
-      <literal>hydra.nixos.org</literal>, then it might be necessary to
-      purge the local caches that store data from those machines to
-      disable these binary channels for the duration of the previous
-      command, i.e. by running:
-    </para>
-    <programlisting>
-rm /nix/var/nix/binary-cache-v3.sqlite
-rm /nix/var/nix/manifests/*
-rm /nix/var/nix/channel-cache/*
-</programlisting>
-  </section>
-  <section xml:id="builds-on-darwin-fail-with-math.h-not-found">
-    <title>Builds on Darwin fail with <literal>math.h</literal> not
-    found</title>
-    <para>
-      Users of GHC on Darwin have occasionally reported that builds
-      fail, because the compiler complains about a missing include file:
-    </para>
-    <programlisting>
-fatal error: 'math.h' file not found
-</programlisting>
-    <para>
-      The issue has been discussed at length in
-      <link xlink:href="https://github.com/NixOS/nixpkgs/issues/6390">ticket
-      6390</link>, and so far no good solution has been proposed. As a
-      work-around, users who run into this problem can configure the
-      environment variables
-    </para>
-    <programlisting>
-export NIX_CFLAGS_COMPILE=&quot;-idirafter /usr/include&quot;
-export NIX_CFLAGS_LINK=&quot;-L/usr/lib&quot;
-</programlisting>
-    <para>
-      in their <literal>~/.bashrc</literal> file to avoid the compiler
-      error.
-    </para>
-  </section>
-</section>
-
-</chapter>

doc/language-support.xml

@@ -981,6 +981,72 @@ stdenv.mkDerivation {
 </programlisting>
 </section>
 
+<section xml:id="sec-language-qt"><title>Qt</title>
+
+<para>The information in this section applies to Qt 5.5 and later.</para>
+
+<para>Qt is an application development toolkit for C++. Although it is
+not a distinct programming language, there are special considerations
+for packaging Qt-based programs and libraries. A small set of tools
+and conventions has grown out of these considerations.</para>
+
+<section xml:id="ssec-qt-libraries"><title>Libraries</title>
+
+<para>Packages that provide libraries should be listed in
+<varname>qt5LibsFun</varname> so that the library is built with each
+Qt version. A set of packages is provided for each version of Qt; for
+example, <varname>qt5Libs</varname> always provides libraries built
+with the latest version, <varname>qt55Libs</varname> provides
+libraries built with Qt 5.5, and so on. To avoid version conflicts, no
+top-level attributes are created for these packages.</para>
+
+</section>
+
+<section xml:id="ssec-qt-programs"><title>Programs</title>
+
+<para>Application packages do not need to be built with every Qt
+version. To ensure consistency between the package's dependencies,
+call the package with <literal>qt5Libs.callPackage</literal> instead
+of the usual <literal>callPackage</literal>. An older version may be
+selected in case of incompatibility. For example, to build with Qt
+5.5, call the package with
+<literal>qt55Libs.callPackage</literal>.</para>
+
+<para>Several environment variables must be set at runtime for Qt
+applications to function correctly, including:</para>
+
+<itemizedlist>
+  <listitem><para><envar>QT_PLUGIN_PATH</envar></para></listitem>
+  <listitem><para><envar>QML_IMPORT_PATH</envar></para></listitem>
+  <listitem><para><envar>QML2_IMPORT_PATH</envar></para></listitem>
+  <listitem><para><envar>XDG_DATA_DIRS</envar></para></listitem>
+</itemizedlist>
+
+<para>To ensure that these are set correctly, the program must be wrapped by
+invoking <literal>wrapQtProgram <replaceable>program</replaceable></literal>
+during installation (for example, during
+<literal>fixupPhase</literal>). <literal>wrapQtProgram</literal>
+accepts the same options as <literal>makeWrapper</literal>.
+</para>
+
+</section>
+
+<section xml:id="ssec-qt-kde"><title>KDE</title>
+
+<para>Many of the considerations above also apply to KDE packages,
+especially the need to set the correct environment variables at
+runtime. To ensure that this is done, invoke <literal>wrapKDEProgram
+<replaceable>program</replaceable></literal> during
+installation. <literal>wrapKDEProgram</literal> also generates a
+<literal>ksycoca</literal> database so that required data and services
+can be found. Like its Qt counterpart,
+<literal>wrapKDEProgram</literal> accepts the same options as
+<literal>makeWrapper</literal>.</para>
+
+</section>
+
+</section>
+
 <!--
 <section><title>Haskell</title>
 

doc/meta.xml

@@ -61,7 +61,7 @@ $ nix-env -qa hello --meta --json
                 "i686-openbsd",
                 "x86_64-openbsd"
             ],
-            "position": "/home/user/dev/nixpkgs/pkgs/applications/misc/hello/ex-2/default.nix:14"
+            "position": "/home/user/dev/nixpkgs/pkgs/applications/misc/hello/default.nix:14"
         },
         "name": "hello-2.9",
         "system": "x86_64-linux"

doc/quick-start.xml

@@ -56,7 +56,7 @@ $ git add pkgs/development/libraries/libfoo/default.nix</screen>
 
         <listitem>
           <para>GNU Hello: <link
-          xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/misc/hello/ex-2/default.nix"><filename>pkgs/applications/misc/hello/ex-2/default.nix</filename></link>.
+          xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/misc/hello/default.nix"><filename>pkgs/applications/misc/hello/default.nix</filename></link>.
           Trivial package, which specifies some <varname>meta</varname>
           attributes which is good practice.</para>
         </listitem>

doc/stdenv.xml

@@ -899,6 +899,34 @@ following:
     phase.</para></listitem>
   </varlistentry>
 
+  <varlistentry>
+    <term><varname>separateDebugInfo</varname></term>
+    <listitem><para>If set to <literal>true</literal>, the standard
+    environment will enable debug information in C/C++ builds. After
+    installation, the debug information will be separated from the
+    executables and stored in the output named
+    <literal>debug</literal>. (This output is enabled automatically;
+    you don’t need to set the <varname>outputs</varname> attribute
+    explicitly.) To be precise, the debug information is stored in
+    <filename><replaceable>debug</replaceable>/lib/debug/.build-id/<replaceable>XX</replaceable>/<replaceable>YYYY…</replaceable></filename>,
+    where <replaceable>XXYYYY…</replaceable> is the <replaceable>build
+    ID</replaceable> of the binary — a SHA-1 hash of the contents of
+    the binary. Debuggers like GDB use the build ID to look up the
+    separated debug information.</para>
+
+    <para>For example, with GDB, you can add
+
+<programlisting>
+set debug-file-directory ~/.nix-profile/lib/debug
+</programlisting>
+
+    to <filename>~/.gdbinit</filename>. GDB will then be able to find
+    debug information installed via <literal>nix-env
+    -i</literal>.</para>
+
+    </listitem>
+  </varlistentry>
+
 </variablelist>
 
 </section>
@@ -1176,7 +1204,7 @@ echo @foo@
   </varlistentry>
 
   <varlistentry>
-    <term>Qt</term>
+    <term>Qt 4</term>
     <listitem><para>Sets the <envar>QTDIR</envar> environment variable
     to Qt’s path.</para></listitem>
   </varlistentry>

lib/attrsets.nix

@@ -78,6 +78,26 @@ rec {
     listToAttrs (concatMap (name: let v = set.${name}; in if pred name v then [(nameValuePair name v)] else []) (attrNames set));
 
 
+  /* Filter an attribute set recursivelly by removing all attributes for
+     which the given predicate return false.
+
+     Example:
+       filterAttrsRecursive (n: v: v != null) { foo = { bar = null; }; }
+       => { foo = {}; }
+  */
+  filterAttrsRecursive = pred: set:
+    listToAttrs (
+      concatMap (name:
+        let v = set.${name}; in
+        if pred name v then [
+          (nameValuePair name (
+            if isAttrs v then filterAttrsRecursive pred v
+            else v
+          ))
+        ] else []
+      ) (attrNames set)
+    );
+
   /* foldAttrs: apply fold functions to values grouped by key. Eg accumulate values as list:
      foldAttrs (n: a: [n] ++ a) [] [{ a = 2; } { a = 3; }]
      => { a = [ 2 3 ]; }

lib/customisation.nix

@@ -164,4 +164,23 @@ rec {
       drv' = (lib.head outputsList).value;
     in lib.deepSeq drv' drv';
 
+  /* Make a set of packages with a common scope. All packages called
+     with the provided `callPackage' will be evaluated with the same
+     arguments. Any package in the set may depend on any other. The
+     `override' function allows subsequent modification of the package
+     set in a consistent way, i.e. all packages in the set will be
+     called with the overridden packages. The package sets may be
+     hierarchical: the packages in the set are called with the scope
+     provided by `newScope' and the set provides a `newScope' attribute
+     which can form the parent scope for later package sets. */
+  makeScope = newScope: f:
+    let self = f self // {
+          newScope = scope: newScope (self // scope);
+          callPackage = self.newScope {};
+          override = g: makeScope newScope (self_:
+            let super = f self_;
+            in super // g super self_);
+        };
+    in self;
+
 }

lib/licenses.nix

@@ -155,6 +155,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     fullName = "GNU Free Documentation License v1.2";
   };
 
+  fdl13 = spdx {
+    spdxId = "GFDL-1.3";
+    fullName = "GNU Free Documentation License v1.2";
+  };
+
   free = {
     fullName = "Unspecified free software license";
   };

lib/maintainers.nix

@@ -7,6 +7,7 @@
      so it's easy to ping a package @maintainer.
   */
 
+  a1russell = "Adam Russell <adamlr6+pub@gmail.com>";
   abaldeau = "Andreas Baldeau <andreas@baldeau.net>";
   abbradar = "Nikolay Amiantov <ab@fmap.me>";
   adev	   = "Adrien Devresse <adev@adev.name>";
@@ -14,9 +15,11 @@
   aflatter = "Alexander Flatter <flatter@fastmail.fm>";
   aherrmann = "Andreas Herrmann <andreash87@gmx.ch>";
   ak = "Alexander Kjeldaas <ak@formalprivacy.com>";
+  akaWolf = "Artjom Vejsel <akawolf0@gmail.com>";
   akc = "Anders Claesson <akc@akc.is>";
   algorith = "Dries Van Daele <dries_van_daele@telenet.be>";
   all = "Nix Committers <nix-commits@lists.science.uu.nl>";
+  ambrop72 = "Ambroz Bizjak <ambrop7@gmail.com>";
   amiddelk = "Arie Middelkoop <amiddelk@gmail.com>";
   amorsillo = "Andrew Morsillo <andrew.morsillo@gmail.com>";
   AndersonTorres = "Anderson Torres <torres.anderson.85@gmail.com>";
@@ -67,7 +70,8 @@
   couchemar = "Andrey Pavlov <couchemar@yandex.ru>";
   cstrahan = "Charles Strahan <charles.c.strahan@gmail.com>";
   cwoac = "Oliver Matthews <oliver@codersoffortune.net>";
-  DamienCassou = "Damien Cassou <damien.cassou@gmail.com>";
+  DamienCassou = "Damien Cassou <damien@cassou.me>";
+  davidak = "David Kleuker <post@davidak.de>";
   davidrusu = "David Rusu <davidrusu.me@gmail.com>";
   dbohdan = "Danyil Bohdan <danyil.bohdan@gmail.com>";
   DerGuteMoritz = "Moritz Heidkamp <moritz@twoticketsplease.de>";
@@ -77,7 +81,9 @@
   dezgeg = "Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>";
   dfoxfranke = "Daniel Fox Franke <dfoxfranke@gmail.com>";
   dmalikov = "Dmitry Malikov <malikov.d.y@gmail.com>";
+  dochang = "Desmond O. Chang <dochang@gmail.com>";
   doublec = "Chris Double <chris.double@double.co.nz>";
+  ebzzry = "Rommel Martinez <ebzzry@gmail.com>";
   ederoyd46 = "Matthew Brown <matt@ederoyd.co.uk>";
   eduarrrd = "Eduard Bachmakov <e.bachmakov@gmail.com>";
   edwtjo = "Edward Tjörnhammar <ed@cflags.cc>";
@@ -85,8 +91,10 @@
   eikek = "Eike Kettner <eike.kettner@posteo.de>";
   ellis = "Ellis Whitehead <nixos@ellisw.net>";
   emery = "Emery Hemingway <emery@vfemail.net>";
+  enolan = "Echo Nolan <echo@echonolan.net>";
   epitrochoid = "Mabry Cervin <mpcervin@uncg.edu>";
   ericbmerritt = "Eric Merritt <eric@afiniate.com>";
+  erikryb = "Erik Rybakken <erik.rybakken@math.ntnu.no>";
   ertes = "Ertugrul Söylemez <ertesx@gmx.de>";
   exlevan = "Alexey Levan <exlevan@gmail.com>";
   falsifian = "James Cook <james.cook@utoronto.ca>";
@@ -94,6 +102,8 @@
   fluffynukeit = "Daniel Austin <dan@fluffynukeit.com>";
   forkk = "Andrew Okin <forkk@forkk.net>";
   fpletz = "Franz Pletz <fpletz@fnordicwalking.de>";
+  fps = "Florian Paul Schmidt <mista.tapas@gmx.net>";
+  fridh = "Frederik Rietdijk <fridh@fridh.nl>";
   fro_ozen = "fro_ozen <fro_ozen@gmx.de>";
   ftrvxmtrx = "Siarhei Zirukin <ftrvxmtrx@gmail.com>";
   funfunctor = "Edward O'Callaghan <eocallaghan@alterapraxis.com>";
@@ -103,6 +113,7 @@
   garrison = "Jim Garrison <jim@garrison.cc>";
   gavin = "Gavin Rogers <gavin@praxeology.co.uk>";
   gebner = "Gabriel Ebner <gebner@gebner.org>";
+  gfxmonk = "Tim Cuthbertson <tim@gfxmonk.net>";
   giogadi = "Luis G. Torres <lgtorres42@gmail.com>";
   globin = "Robin Gloster <robin@glob.in>";
   goibhniu = "Cillian de Róiste <cillian.deroiste@gmail.com>";
@@ -121,8 +132,10 @@
   iyzsong = "Song Wenwu <iyzsong@gmail.com>";
   j-keck = "Jürgen Keck <jhyphenkeck@gmail.com>";
   jagajaga = "Arseniy Seroka <ars.seroka@gmail.com>";
+  javaguirre = "Javier Aguirre <contacto@javaguirre.net>";
   jb55 = "William Casarin <bill@casarin.me>";
   jcumming = "Jack Cummings <jack@mudshark.org>";
+  jefdaj = "Jeffrey David Johnson <jefdaj@gmail.com>";
   jfb = "James Felix Black <james@yamtime.com>";
   jgeerds = "Jascha Geerds <jg@ekby.de>";
   jirkamarsik = "Jirka Marsik <jiri.marsik89@gmail.com>";
@@ -135,12 +148,15 @@
   jwilberding = "Jordan Wilberding <jwilberding@afiniate.com>";
   jzellner = "Jeff Zellner <jeffz@eml.cc>";
   kamilchm = "Kamil Chmielewski <kamil.chm@gmail.com>";
+  kampfschlaefer = "Arnold Krille <arnold@arnoldarts.de>";
+  khumba = "Bryan Gardiner <bog@khumba.net>";
   kkallio = "Karn Kallio <tierpluspluslists@gmail.com>";
   koral = "Koral <koral@mailoo.org>";
   kovirobi = "Kovacsics Robert <kovirobi@gmail.com>";
-  kragniz = "Louis Taylor <kragniz@gmail.com>";
+  kragniz = "Louis Taylor <louis@kragniz.eu>";
   ktosiek = "Tomasz Kontusz <tomasz.kontusz@gmail.com>";
   lassulus = "Lassulus <lassulus@gmail.com>";
+  layus = "Guillaume Maudoux <layus.on@gmail.com>";
   lebastr = "Alexander Lebedev <lebastr@gmail.com>";
   leonardoce = "Leonardo Cecchi <leonardo.cecchi@gmail.com>";
   lethalman = "Luca Bruno <lucabru@src.gnome.org>";
@@ -150,8 +166,10 @@
   linus = "Linus Arver <linusarver@gmail.com>";
   lnl7 = "Daiderd Jordan <daiderd@gmail.com>";
   lovek323 = "Jason O'Conal <jason@oconal.id.au>";
+  lowfatcomputing = "Andreas Wagner <andreas.wagner@lowfatcomputing.org>";
   lsix = "Lancelot SIX <lsix@lancelotsix.com>";
   ludo = "Ludovic Courtès <ludo@gnu.org>";
+  lukego = "Luke Gorrie <luke@snabb.co>";
   madjar = "Georges Dubus <georges.dubus@compiletoi.net>";
   magnetophon = "Bart Brouns <bart@magnetophon.nl>";
   mahe = "Matthias Herrmann <matthias.mh.herrmann@gmail.com>";
@@ -167,6 +185,7 @@
   meditans = "Carlo Nucera <meditans@gmail.com>";
   meisternu = "Matt Miemiec <meister@krutt.org>";
   michelk = "Michel Kuhlmann <michel@kuhlmanns.info>";
+  michaelpj = "Michael Peyton Jones <michaelpj@gmail.com>";
   mirdhyn = "Merlin Gaillard <mirdhyn@gmail.com>";
   mschristiansen = "Mikkel Christiansen <mikkel@rheosystems.com>";
   modulistic = "Pablo Costa <modulistic@gmail.com>";
@@ -178,6 +197,7 @@
   muflax = "Stefan Dorn <mail@muflax.com>";
   nathan-gs = "Nathan Bijnens <nathan@nathan.gs>";
   nckx = "Tobias Geerinckx-Rice <tobias.geerinckx.rice@gmail.com>";
+  nico202 = "Nicolò Balzarotti <anothersms@gmail.com>";
   notthemessiah = "Brian Cohen <brian.cohen.88@gmail.com>";
   np = "Nicolas Pouillard <np.nix@nicolaspouillard.fr>";
   nslqqq = "Nikita Mikhailov <nslqqq@gmail.com>";
@@ -204,6 +224,7 @@
   pmahoney = "Patrick Mahoney <pat@polycrystal.org>";
   pmiddend = "Philipp Middendorf <pmidden@secure.mailbox.org>";
   prikhi = "Pavan Rikhi <pavan.rikhi@gmail.com>";
+  psibi = "Sibi <sibi@psibi.in>";
   pSub = "Pascal Wittmann <mail@pascal-wittmann.de>";
   puffnfresh = "Brian McKenna <brian@brianmckenna.org>";
   qknight = "Joachim Schiele <js@lastlog.de>";
@@ -224,6 +245,7 @@
   rszibele = "Richard Szibele <richard_szibele@hotmail.com>";
   rushmorem = "Rushmore Mushambi <rushmore@webenchanter.com>";
   rycee = "Robert Helgesson <robert@rycee.net>";
+  samuelrivas = "Samuel Rivas <samuelrivas@gmail.com>";
   sander = "Sander van der Burg <s.vanderburg@tudelft.nl>";
   schmitthenner = "Fabian Schmitthenner <development@schmitthenner.eu>";
   schristo = "Scott Christopher <schristopher@konputa.com>";

lib/modules.nix

@@ -469,6 +469,7 @@ rec {
   mkBefore = mkOrder 500;
   mkAfter = mkOrder 1500;
 
+
   # Convenient property used to transfer all definitions and their
   # properties from one option to another. This property is useful for
   # renaming options, and also for including properties from another module
@@ -498,4 +499,68 @@ rec {
   /* Compatibility. */
   fixMergeModules = modules: args: evalModules { inherit modules args; check = false; };
 
+
+  /* Return a module that causes a warning to be shown if the
+     specified option is defined. For example,
+
+       mkRemovedOptionModule [ "boot" "loader" "grub" "bootDevice" ]
+
+     causes a warning if the user defines boot.loader.grub.bootDevice.
+  */
+  mkRemovedOptionModule = optionName:
+    { options, ... }:
+    { options = setAttrByPath optionName (mkOption {
+        visible = false;
+      });
+      config.warnings =
+        let opt = getAttrFromPath optionName options; in
+        optional opt.isDefined
+          "The option definition `${showOption optionName}' in ${showFiles opt.files} no longer has any effect; please remove it.";
+    };
+
+  /* Return a module that causes a warning to be shown if the
+     specified "from" option is defined; the defined value is however
+     forwarded to the "to" option. This can be used to rename options
+     while providing backward compatibility. For example,
+
+       mkRenamedOptionModule [ "boot" "copyKernels" ] [ "boot" "loader" "grub" "copyKernels" ]
+
+     forwards any definitions of boot.copyKernels to
+     boot.loader.grub.copyKernels while printing a warning.
+  */
+  mkRenamedOptionModule = from: to: doRename {
+    inherit from to;
+    visible = false;
+    warn = true;
+    use = builtins.trace "Obsolete option `${showOption from}' is used. It was renamed to `${showOption to}'.";
+  };
+
+  /* Like ‘mkRenamedOptionModule’, but doesn't show a warning. */
+  mkAliasOptionModule = from: to: doRename {
+    inherit from to;
+    visible = true;
+    warn = false;
+    use = id;
+  };
+
+  doRename = { from, to, visible, warn, use }:
+    let
+      toOf = attrByPath to
+        (abort "Renaming error: option `${showOption to}' does not exists.");
+    in
+      { config, options, ... }:
+      { options = setAttrByPath from (mkOption {
+          description = "Alias of <option>${showOption to}</option>.";
+          apply = x: use (toOf config);
+        });
+        config = {
+        /*
+          warnings =
+            let opt = getAttrFromPath from options; in
+            optional (warn && opt.isDefined)
+              "The option `${showOption from}' defined in ${showFiles opt.files} has been renamed to `${showOption to}'.";
+              */
+        } // setAttrByPath to (mkAliasDefinitions (getAttrFromPath from options));
+      };
+
 }

lib/types.nix

@@ -6,7 +6,7 @@ with import ./attrsets.nix;
 with import ./options.nix;
 with import ./trivial.nix;
 with import ./strings.nix;
-with {inherit (import ./modules.nix) mergeDefinitions; };
+with {inherit (import ./modules.nix) mergeDefinitions filterOverrides; };
 
 rec {
 
@@ -166,6 +166,23 @@ rec {
         substSubModules = m: loaOf (elemType.substSubModules m);
       };
 
+    # List or element of ...
+    loeOf = elemType: mkOptionType {
+      name = "element or list of ${elemType.name}s";
+      check = x: isList x || elemType.check x;
+      merge = loc: defs:
+        let
+          defs' = filterOverrides defs;
+          res = (head defs').value;
+        in
+        if isList res then concatLists (getValues defs')
+        else if lessThan 1 (length defs') then
+          throw "The option `${showOption loc}' is defined multiple times, in ${showFiles (getFiles defs)}."
+        else if !isString res then
+          throw "The option `${showOption loc}' does not have a string value, in ${showFiles (getFiles defs)}."
+        else res;
+    };
+
     uniq = elemType: mkOptionType {
       inherit (elemType) name check;
       merge = mergeOneOption;

maintainers/scripts/gnome-latest.sh

@@ -1,95 +0,0 @@
-#!/usr/bin/env bash
-
-GNOME_FTP="ftp.gnome.org/pub/GNOME/sources"
-
-project=$1
-
-if [ "$project" == "--help" ]; then
-  echo "Usage: $0 project [major.minor]"
-  exit 0
-fi
-
-baseVersion=$2
-
-if [ -z "$project" ]; then
-  echo "No project specified, exiting"
-  exit 1
-fi
-
-# curl -l ftp://... doesn't work from my office in HSE, and I don't want to have
-# any conversations with sysadmin. Somehow lftp works.
-if [ "$FTP_CLIENT" = "lftp" ]; then
-  ls_ftp() {
-    lftp -c "open $1; cls"
-  }
-else
-  ls_ftp() {
-    curl -l "$1"/
-  }
-fi
-
-if [ -z "$baseVersion" ]; then
-  echo "Looking for available versions..." >&2
-  available_baseversions=( `ls_ftp ftp://${GNOME_FTP}/${project} | grep '[0-9]\.[0-9]' | sort -t. -k1,1n -k 2,2n` )
-  echo -e "The following versions are available:\n ${available_baseversions[@]}" >&2
-  echo -en "Choose one of them: " >&2
-  read baseVersion
-fi
-
-FTPDIR="${GNOME_FTP}/${project}/${baseVersion}"
-
-#version=`curl -l ${FTPDIR}/ 2>/dev/null | grep LATEST-IS | sed -e s/LATEST-IS-//`
-# gnome's LATEST-IS is broken. Do not trust it.
-
-files=$(ls_ftp "${FTPDIR}")
-declare -A versions
-
-for f in $files; do
-  case $f in
-    (LATEST-IS-*|*.news|*.changes|*.sha256sum|*.diff*):
-      ;;
-    ($project-*.*.9*.tar.*):
-      tmp=${f#$project-}
-      tmp=${tmp%.tar*}
-      echo "Ignored unstable version ${tmp}" >&2
-      ;;
-    ($project-*.tar.*):
-      tmp=${f#$project-}
-      tmp=${tmp%.tar*}
-      versions[${tmp}]=1
-      ;;
-    (*):
-      echo "UNKNOWN FILE $f"
-      ;;
-  esac
-done
-echo "Found versions ${!versions[@]}" >&2
-version=`echo ${!versions[@]} | sed -e 's/ /\n/g' | sort -t. -k1,1n -k 2,2n -k 3,3n | tail -n1`
-echo "Latest version is: ${version}" >&2
-
-name=${project}-${version}
-echo "Fetching .sha256 file" >&2
-curl -O http://${FTPDIR}/${name}.sha256sum
-
-extensions=( "xz" "bz2" "gz" )
-echo "Choosing archive extension (known are ${extensions[@]})..." >&2
-for ext in ${extensions[@]}; do
-  if grep "\\.tar\\.${ext}$" ${name}.sha256sum >& /dev/null; then
-    ext_pref=$ext
-    sha256=$(grep "\\.tar\\.${ext}$" ${name}.sha256sum | cut -f1 -d\ )
-    break
-  fi
-done
-sha256=`nix-hash --to-base32 --type sha256 $sha256`
-echo "Chosen ${ext_pref}, hash is ${sha256}" >&2
-
-cat <<EOF
-  name = "${project}-${version}";
-
-  src = fetchurl {
-    url = mirror://gnome/sources/${project}/${baseVersion}/${project}-${version}.tar.${ext_pref};
-    sha256 = "${sha256}";
-  };
-EOF
-
-rm -v ${name}.sha256sum >&2

maintainers/scripts/gnome.sh

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+
+set -o pipefail
+
+GNOME_FTP="ftp.gnome.org/pub/GNOME/sources"
+
+usage() {
+  echo "Usage: $0 show|update project [major.minor]" >&2
+  exit 0
+}
+
+if [ "$#" -lt 1 ]; then
+  usage
+fi
+
+action="$1"
+project="$2"
+majorVersion="$3"
+
+if [ "$action" != "show" ] && [ "$action" != "update" ]; then
+  echo "Unknown action $action" >&2
+  usage
+fi
+
+if [ -z "$project" ]; then
+  echo "No project specified, exiting"
+  exit 1
+fi
+
+# curl -l ftp://... doesn't work from my office in HSE, and I don't want to have
+# any conversations with sysadmin. Somehow lftp works.
+if [ "$FTP_CLIENT" = "lftp" ]; then
+  ls_ftp() {
+    lftp -c "open $1; cls"
+  }
+else
+  ls_ftp() {
+    curl -s -l "$1"/
+  }
+fi
+
+if [ -z "$majorVersion" ]; then
+  echo "Looking for available versions..." >&2
+  available_baseversions=( `ls_ftp ftp://${GNOME_FTP}/${project} | grep '[0-9]\.[0-9]' | sort -t. -k1,1n -k 2,2n` )
+  if [ "$?" -ne "0" ]; then
+    echo "Project $project not found" >&2
+    exit 1
+  fi
+  
+  echo -e "The following versions are available:\n ${available_baseversions[@]}" >&2
+  echo -en "Choose one of them: " >&2
+  read majorVersion
+fi
+
+if echo "$majorVersion" | grep -q "[0-9]\+\.[0-9]\+\.[0-9]\+"; then
+	# not a major version
+	version="$majorVersion"
+	majorVersion=$(echo "$majorVersion" | cut -d '.' -f 1,2)
+fi
+
+FTPDIR="${GNOME_FTP}/${project}/${majorVersion}"
+
+#version=`curl -l ${FTPDIR}/ 2>/dev/null | grep LATEST-IS | sed -e s/LATEST-IS-//`
+# gnome's LATEST-IS is broken. Do not trust it.
+
+if [ -z "$version" ]; then
+	files=$(ls_ftp "${FTPDIR}")
+	declare -A versions
+	
+	for f in $files; do
+		case $f in
+    (LATEST-IS-*|*.news|*.changes|*.sha256sum|*.diff*):
+		;;
+    ($project-*.*.9*.tar.*):
+		tmp=${f#$project-}
+		tmp=${tmp%.tar*}
+		echo "Ignored unstable version ${tmp}" >&2
+		;;
+    ($project-*.tar.*):
+		tmp=${f#$project-}
+		tmp=${tmp%.tar*}
+		versions[${tmp}]=1
+		;;
+    (*):
+		echo "UNKNOWN FILE $f"
+		;;
+		esac
+	done
+	echo "Found versions ${!versions[@]}" >&2
+	version=`echo ${!versions[@]} | sed -e 's/ /\n/g' | sort -t. -k1,1n -k 2,2n -k 3,3n | tail -n1`
+	echo "Latest version is: ${version}" >&2
+fi
+
+name=${project}-${version}
+echo "Fetching .sha256 file" >&2
+sha256out=$(curl -s -f http://${FTPDIR}/${name}.sha256sum)
+
+if [ "$?" -ne "0" ]; then
+	echo "Version not found" >&2
+	exit 1
+fi
+
+extensions=( "xz" "bz2" "gz" )
+echo "Choosing archive extension (known are ${extensions[@]})..." >&2
+for ext in ${extensions[@]}; do
+  if echo -e "$sha256out" | grep -q "\\.tar\\.${ext}$"; then
+    ext_pref=$ext
+    sha256=$(echo -e "$sha256out" | grep "\\.tar\\.${ext}$" | cut -f1 -d\ )
+    break
+  fi
+done
+echo "Chosen ${ext_pref}, hash is ${sha256}" >&2
+
+src="# Autogenerated by maintainers/scripts/gnome.sh update
+
+fetchurl: {
+  name = \"${project}-${version}\";
+
+  src = fetchurl {
+    url = mirror://gnome/sources/${project}/${majorVersion}/${project}-${version}.tar.${ext_pref};
+    sha256 = \"${sha256}\";
+  };
+}"
+
+if [ "$action" == "update" ]; then
+  # find project in nixpkgs tree
+  GNOME_TOP=$(readlink -e $(dirname "${BASH_SOURCE[0]}")"/../../pkgs/desktops/gnome-3/")
+  projectPath=$(find "$GNOME_TOP" -name "$project" -print)
+  if [ -z "$projectPath" ]; then
+    echo "Project $project not found under $GNOME_TOP"
+    exit 1
+  fi
+
+  echo "Updating $projectPath/src.nix"
+  echo -e "$src" > "$projectPath/src.nix"
+else
+  echo -e "\n$src"
+fi

nixos/doc/manual/configuration/x-windows.xml

@@ -61,6 +61,12 @@ by default because it’s not free software.  You can enable it as follows:
 <programlisting>
 services.xserver.videoDrivers = [ "nvidia" ];
 </programlisting>
+Or if you have an older card, you may have to use one of the legacy drivers:
+<programlisting>
+services.xserver.videoDrivers = [ "nvidiaLegacy340" ];
+services.xserver.videoDrivers = [ "nvidiaLegacy304" ];
+services.xserver.videoDrivers = [ "nvidiaLegacy173" ];
+</programlisting>
 You may need to reboot after enabling this driver to prevent a clash
 with other kernel modules.</para>
 

nixos/doc/manual/default.nix

@@ -31,10 +31,8 @@ let
     else
       fn;
 
-  # Convert the list of options into an XML file.  The builtin
-  # unsafeDiscardStringContext is used to prevent the realisation of
-  # the store paths which are used in options definitions.
-  optionsXML = builtins.toFile "options.xml" (builtins.unsafeDiscardStringContext (builtins.toXML optionsList'));
+  # Convert the list of options into an XML file.
+  optionsXML = builtins.toFile "options.xml" (builtins.toXML optionsList');
 
   optionsDocBook = runCommand "options-db.xml" {} ''
     optionsXML=${optionsXML}
@@ -139,6 +137,8 @@ in rec {
     ''; # */
 
     meta.description = "The NixOS manual in HTML format";
+
+    allowedReferences = ["out"];
   };
 
   manualPDF = stdenv.mkDerivation {
@@ -146,12 +146,9 @@ in rec {
 
     inherit sources;
 
-    buildInputs = [ libxml2 libxslt dblatex tetex ];
+    buildInputs = [ libxml2 libxslt dblatex dblatex.tex ];
 
     buildCommand = ''
-      # TeX needs a writable font cache.
-      export VARTEXFONTS=$TMPDIR/texfonts
-
       ${copySources}
 
       dst=$out/share/doc/nixos
@@ -162,7 +159,7 @@ in rec {
 
       mkdir -p $out/nix-support
       echo "doc-pdf manual $dst/manual.pdf" >> $out/nix-support/hydra-build-products
-    ''; # */
+    '';
   };
 
   # Generate the NixOS manpages.
@@ -190,6 +187,8 @@ in rec {
         ${docbook5_xsl}/xml/xsl/docbook/manpages/docbook.xsl \
         ./man-pages.xml
     '';
+
+    allowedReferences = ["out"];
   };
 
 }

nixos/doc/manual/installation/installing.xml

@@ -18,8 +18,8 @@
   <listitem><para>The NixOS manual is available on virtual console 8
   (press Alt+F8 to access).</para></listitem>
 
-  <listitem><para>Login as <literal>root</literal> and the empty
-  password.</para></listitem>
+  <listitem><para>You get logged in as <literal>root</literal>
+  (with empty password).</para></listitem>
 
   <listitem><para>If you downloaded the graphical ISO image, you can
   run <command>start display-manager</command> to start KDE.</para></listitem>

nixos/doc/manual/installation/upgrading.xml

@@ -107,4 +107,30 @@ newer Nix version, which may involve an upgrade of Nix’s database
 schema.  This cannot be undone easily, so in that case you will not be
 able to go back to your original channel.</para></warning>
 
+
+<section><title>Automatic Upgrades</title>
+
+<para>You can keep a NixOS system up-to-date automatically by adding
+the following to <filename>configuration.nix</filename>:
+
+<programlisting>
+system.autoUpgrade.enable = true;
+</programlisting>
+
+This enables a periodically executed systemd service named
+<literal>nixos-upgrade.service</literal>. It runs
+<command>nixos-rebuild switch --upgrade</command> to upgrade NixOS to
+the latest version in the current channel. (To see when the service
+runs, see <command>systemctl list-timers</command>.)  You can also
+specify a channel explicitly, e.g.
+
+<programlisting>
+system.autoUpgrade.channel = https://nixos.org/channels/nixos-15.09;
+</programlisting>
+
+</para>
+
+</section>
+
+
 </chapter>

nixos/doc/manual/release-notes/release-notes.xml

@@ -10,6 +10,7 @@
 and current unstable revision.</para>
 
 <xi:include href="rl-unstable.xml" />
+<xi:include href="rl-1509.xml" />
 <xi:include href="rl-1412.xml" />
 <xi:include href="rl-1404.xml" />
 <xi:include href="rl-1310.xml" />

nixos/doc/manual/release-notes/rl-1509.xml

@@ -0,0 +1,491 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-15.09">
+
+<title>Release 15.09 (“Dingo”, 2015/09/30)</title>
+
+<para>In addition to numerous new and upgraded packages, this release
+has the following highlights:</para>
+
+<itemizedlist>
+
+  <listitem>
+    <para>The <link xlink:href="http://haskell.org/">Haskell</link>
+    packages infrastructure has been re-designed from the ground up
+    (&quot;Haskell NG&quot;). NixOS now distributes the latest version
+    of every single package registered on <link
+    xlink:href="http://hackage.haskell.org/">Hackage</link> -- well in
+    excess of 8,000 Haskell packages. Detailed instructions on how to
+    use that infrastructure can be found in the <link
+    xlink:href="http://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
+    Guide to the Haskell Infrastructure</link>. Users migrating from an
+    earlier release may find helpful information below, in the list of
+    backwards-incompatible changes. Furthermore, we distribute 51(!)
+    additional Haskell package sets that provide every single <link
+    xlink:href="http://www.stackage.org/">LTS Haskell</link> release
+    since version 0.0 as well as the most recent <link
+    xlink:href="http://www.stackage.org/">Stackage Nightly</link>
+    snapshot. The announcement <link
+    xlink:href="http://lists.science.uu.nl/pipermail/nix-dev/2015-September/018138.html">&quot;Full
+    Stackage Support in Nixpkgs&quot;</link> gives additional
+    details.</para>
+  </listitem>
+
+  <listitem>
+    <para>Nix has been updated to version 1.10, which among other
+    improvements enables cryptographic signatures on binary caches for
+    improved security.</para>
+  </listitem>
+
+  <listitem>
+    <para>You can now keep your NixOS system up to date automatically
+    by setting
+
+<programlisting>
+system.autoUpgrade.enable = true;
+</programlisting>
+
+    This will cause the system to periodically check for updates in
+    your current channel and run <command>nixos-rebuild</command>.</para>
+  </listitem>
+
+  <listitem>
+    <para>This release is based on Glibc 2.21, GCC 4.9 and Linux
+    3.18.</para>
+  </listitem>
+
+  <listitem>
+    <para>GNOME has been upgraded to 3.16.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para>Xfce has been upgraded to 4.12.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para>KDE 5 has been upgraded to KDE Frameworks 5.10,
+      Plasma 5.3.2 and Applications 15.04.3.
+      KDE 4 has been updated to kdelibs-4.14.10.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para>E19 has been upgraded to 0.16.8.15.
+    </para>
+  </listitem>
+
+</itemizedlist>
+
+
+<para>The following new services were added since the last release:
+
+  <itemizedlist>
+    <listitem><para><literal>services/mail/exim.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/apache-kafka.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/canto-daemon.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/confd.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/devmon.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/gitit.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/ihaskell.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/mbpfan.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/mediatomb.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/mwlib.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/parsoid.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/plex.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/ripple-rest.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/ripple-data-api.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/subsonic.nix</literal></para></listitem>
+    <listitem><para><literal>services/misc/sundtek.nix</literal></para></listitem>
+    <listitem><para><literal>services/monitoring/cadvisor.nix</literal></para></listitem>
+    <listitem><para><literal>services/monitoring/das_watchdog.nix</literal></para></listitem>
+    <listitem><para><literal>services/monitoring/grafana.nix</literal></para></listitem>
+    <listitem><para><literal>services/monitoring/riemann-tools.nix</literal></para></listitem>
+    <listitem><para><literal>services/monitoring/teamviewer.nix</literal></para></listitem>
+    <listitem><para><literal>services/network-filesystems/u9fs.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/aiccu.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/asterisk.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/bird.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/charybdis.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/docker-registry-server.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/fan.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/firefox/sync-server.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/gateone.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/heyefi.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/i2p.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/lambdabot.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/mstpd.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/nix-serve.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/nylon.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/racoon.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/skydns.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/shout.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/softether.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/sslh.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/tinc.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/tlsdated.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/tox-bootstrapd.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/tvheadend.nix</literal></para></listitem>
+    <listitem><para><literal>services/networking/zerotierone.nix</literal></para></listitem>
+    <listitem><para><literal>services/scheduling/marathon.nix</literal></para></listitem>
+    <listitem><para><literal>services/security/fprintd.nix</literal></para></listitem>
+    <listitem><para><literal>services/security/hologram.nix</literal></para></listitem>
+    <listitem><para><literal>services/security/munge.nix</literal></para></listitem>
+    <listitem><para><literal>services/system/cloud-init.nix</literal></para></listitem>
+    <listitem><para><literal>services/web-servers/shellinabox.nix</literal></para></listitem>
+    <listitem><para><literal>services/web-servers/uwsgi.nix</literal></para></listitem>
+    <listitem><para><literal>services/x11/unclutter.nix</literal></para></listitem>
+    <listitem><para><literal>services/x11/display-managers/sddm.nix</literal></para></listitem>
+    <listitem><para><literal>system/boot/coredump.nix</literal></para></listitem>
+    <listitem><para><literal>system/boot/loader/loader.nix</literal></para></listitem>
+    <listitem><para><literal>system/boot/loader/generic-extlinux-compatible</literal></para></listitem>
+    <listitem><para><literal>system/boot/networkd.nix</literal></para></listitem>
+    <listitem><para><literal>system/boot/resolved.nix</literal></para></listitem>
+    <listitem><para><literal>system/boot/timesyncd.nix</literal></para></listitem>
+    <listitem><para><literal>tasks/filesystems/exfat.nix</literal></para></listitem>
+    <listitem><para><literal>tasks/filesystems/ntfs.nix</literal></para></listitem>
+    <listitem><para><literal>tasks/filesystems/vboxsf.nix</literal></para></listitem>
+    <listitem><para><literal>virtualisation/virtualbox-host.nix</literal></para></listitem>
+    <listitem><para><literal>virtualisation/vmware-guest.nix</literal></para></listitem>
+    <listitem><para><literal>virtualisation/xen-dom0.nix</literal></para></listitem>
+  </itemizedlist>
+</para>
+
+
+<para>When upgrading from a previous release, please be aware of the
+following incompatible changes:
+
+<itemizedlist>
+
+<listitem><para><command>sshd</command> no longer supports DSA and ECDSA
+host keys by default. If you have existing systems with such host keys
+and want to continue to use them, please set
+
+<programlisting>
+system.stateVersion = "14.12";
+</programlisting>
+
+The new option <option>system.stateVersion</option> ensures that
+certain configuration changes that could break existing systems (such
+as the <command>sshd</command> host key setting) will maintain
+compatibility with the specified NixOS release. NixOps sets the state
+version of existing deployments automatically.</para></listitem>
+
+<listitem><para><command>cron</command> is no longer enabled by
+default, unless you have a non-empty
+<option>services.cron.systemCronJobs</option>. To force
+<command>cron</command> to be enabled, set
+<option>services.cron.enable = true</option>.</para></listitem>
+
+<listitem><para>Nix now requires binary caches to be cryptographically
+signed. If you have unsigned binary caches that you want to continue
+to use, you should set <option>nix.requireSignedBinaryCaches =
+false</option>.</para></listitem>
+
+<listitem><para>Steam now doesn't need root rights to work. Instead of using
+<literal>*-steam-chrootenv</literal>, you should now just run <literal>steam</literal>.
+<literal>steamChrootEnv</literal> package was renamed to <literal>steam</literal>,
+and old <literal>steam</literal> package -- to <literal>steamOriginal</literal>.
+</para></listitem>
+
+<listitem><para>CMPlayer has been renamed to bomi upstream. Package
+<literal>cmplayer</literal> was accordingly renamed to
+<literal>bomi</literal> </para></listitem>
+
+<listitem><para>Atom Shell has been renamed to Electron upstream.  Package <literal>atom-shell</literal>
+was accordingly renamed to <literal>electron</literal>
+</para></listitem>
+
+<listitem><para>Elm is not released on Hackage anymore. You should now use <literal>elmPackages.elm</literal>
+which contains the latest Elm platform.</para></listitem>
+
+<listitem>
+  <para>The CUPS printing service has been updated to version
+  <literal>2.0.2</literal>.  Furthermore its systemd service has been
+  renamed to <literal>cups.service</literal>.</para>
+
+  <para>Local printers are no longer shared or advertised by
+  default. This behavior can be changed by enabling
+  <option>services.printing.defaultShared</option> or
+  <option>services.printing.browsing</option> respectively.</para>
+</listitem>
+
+<listitem>
+  <para>
+    The VirtualBox host and guest options have been named more
+    consistently. They can now found in
+    <option>virtualisation.virtualbox.host.*</option> instead of
+    <option>services.virtualboxHost.*</option> and
+    <option>virtualisation.virtualbox.guest.*</option> instead of
+    <option>services.virtualboxGuest.*</option>.
+  </para>
+
+  <para>
+    Also, there now is support for the <literal>vboxsf</literal> file
+    system using the <option>fileSystems</option> configuration
+    attribute. An example of how this can be used in a configuration:
+
+<programlisting>
+fileSystems."/shiny" = {
+  device = "myshinysharedfolder";
+  fsType = "vboxsf";
+};
+</programlisting>
+
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    &quot;<literal>nix-env -qa</literal>&quot; no longer discovers
+    Haskell packages by name. The only packages visible in the global
+    scope are <literal>ghc</literal>, <literal>cabal-install</literal>,
+    and <literal>stack</literal>, but all other packages are hidden. The
+    reason for this inconvenience is the sheer size of the Haskell
+    package set. Name-based lookups are expensive, and most
+    <literal>nix-env -qa</literal> operations would become much slower
+    if we'd add the entire Hackage database into the top level attribute
+    set. Instead, the list of Haskell packages can be displayed by
+    running:
+  </para>
+  <programlisting>
+nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A haskellPackages
+</programlisting>
+  <para>
+    Executable programs written in Haskell can be installed with:
+  </para>
+  <programlisting>
+nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskellPackages.pandoc
+</programlisting>
+  <para>
+    Installing Haskell <emphasis>libraries</emphasis> this way, however, is no
+    longer supported. See the next item for more details.
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    Previous versions of NixOS came with a feature called
+    <literal>ghc-wrapper</literal>, a small script that allowed GHC to
+    transparently pick up on libraries installed in the user's profile. This
+    feature has been deprecated; <literal>ghc-wrapper</literal> was removed
+    from the distribution. The proper way to register Haskell libraries with
+    the compiler now is the <literal>haskellPackages.ghcWithPackages</literal>
+    function. The <link
+    xlink:href="http://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
+    Guide to the Haskell Infrastructure</link> provides more information about
+    this subject.
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    All Haskell builds that have been generated with version 1.x of
+    the <literal>cabal2nix</literal> utility are now invalid and need
+    to be re-generated with a current version of
+    <literal>cabal2nix</literal> to function. The most recent version
+    of this tool can be installed by running
+    <literal>nix-env -i cabal2nix</literal>.
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    The <literal>haskellPackages</literal> set in Nixpkgs used to have a
+    function attribute called <literal>extension</literal> that users
+    could override in their <literal>~/.nixpkgs/config.nix</literal>
+    files to configure additional attributes, etc. That function still
+    exists, but it's now called <literal>overrides</literal>.
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    The OpenBLAS library has been updated to version
+    <literal>0.2.14</literal>. Support for the
+    <literal>x86_64-darwin</literal> platform was added. Dynamic
+    architecture detection was enabled; OpenBLAS now selects
+    microarchitecture-optimized routines at runtime, so optimal
+    performance is achieved without the need to rebuild OpenBLAS
+    locally. OpenBLAS has replaced ATLAS in most packages which use an
+    optimized BLAS or LAPACK implementation.
+ </para>
+</listitem>
+
+<listitem>
+  <para>
+    The <literal>phpfpm</literal> is now using the default PHP version
+    (<literal>pkgs.php</literal>) instead of PHP 5.4 (<literal>pkgs.php54</literal>).
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    The <literal>locate</literal> service no longer indexes the Nix store
+    by default, preventing packages with potentially numerous versions from
+    cluttering the output. Indexing the store can be activated by setting
+    <option>services.locate.includeStore = true</option>.
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    The Nix expression search path (<envar>NIX_PATH</envar>) no longer
+    contains <filename>/etc/nixos/nixpkgs</filename> by default. You
+    can override <envar>NIX_PATH</envar> by setting
+    <option>nix.nixPath</option>.
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    Python 2.6 has been marked as broken (as it no longer recieves
+    security updates from upstream).
+  </para>
+</listitem>
+
+<listitem>
+  <para>
+    Any use of module arguments such as <varname>pkgs</varname> to access
+    library functions, or to define <literal>imports</literal> attributes
+    will now lead to an infinite loop at the time of the evaluation.
+  </para>
+
+  <para>
+    In case of an infinite loop, use the <command>--show-trace</command>
+    command line argument and read the line just above the error message.
+
+<screen>
+$ nixos-rebuild build --show-trace
+…
+while evaluating the module argument `pkgs' in "/etc/nixos/my-module.nix":
+infinite recursion encountered
+</screen>
+  </para>
+
+
+  <para>
+    Any use of <literal>pkgs.lib</literal>, should be replaced by
+    <varname>lib</varname>, after adding it as argument of the module.  The
+    following module
+
+<programlisting>
+{ config, pkgs, ... }:
+
+with pkgs.lib;
+
+{
+  options = {
+    foo = mkOption { … };
+  };
+  config = mkIf config.foo { … };
+}
+</programlisting>
+
+   should be modified to look like:
+
+<programlisting>
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+{
+  options = {
+    foo = mkOption { <replaceable>option declaration</replaceable> };
+  };
+  config = mkIf config.foo { <replaceable>option definition</replaceable> };
+}
+</programlisting>
+  </para>
+
+  <para>
+    When <varname>pkgs</varname> is used to download other projects to
+    import their modules, and only in such cases, it should be replaced by
+    <literal>(import &lt;nixpkgs&gt; {})</literal>.  The following module
+
+<programlisting>
+{ config, pkgs, ... }:
+
+let
+  myProject = pkgs.fetchurl {
+    src = <replaceable>url</replaceable>;
+    sha256 = <replaceable>hash</replaceable>;
+  };
+in
+
+{
+  imports = [ "${myProject}/module.nix" ];
+}
+</programlisting>
+
+    should be modified to look like:
+
+<programlisting>
+{ config, pkgs, ... }:
+
+let
+  myProject = (import &lt;nixpkgs&gt; {}).fetchurl {
+    src = <replaceable>url</replaceable>;
+    sha256 = <replaceable>hash</replaceable>;
+  };
+in
+
+{
+  imports = [ "${myProject}/module.nix" ];
+}
+</programlisting>
+  </para>
+
+</listitem>
+
+</itemizedlist>
+</para>
+
+
+<para>Other notable improvements:
+
+<itemizedlist>
+
+  <listitem><para>The nixos and nixpkgs channels were unified,
+    so one <emphasis>can</emphasis> use <literal>nix-env -iA nixos.bash</literal>
+    instead of <literal>nix-env -iA nixos.pkgs.bash</literal>.
+    See <link xlink:href="https://github.com/NixOS/nixpkgs/commit/2cd7c1f198">the commit</link> for details.
+  </para></listitem>
+
+  <listitem>
+    <para>
+      Users running an SSH server who worry about the quality of their
+      <literal>/etc/ssh/moduli</literal> file with respect to the
+      <link
+      xlink:href="https://stribika.github.io/2015/01/04/secure-secure-shell.html">vulnerabilities
+      discovered in the Diffie-Hellman key exchange</link> can now
+      replace OpenSSH's default version with one they generated
+      themselves using the new
+      <option>services.openssh.moduliFile</option> option.
+      </para>
+  </listitem>
+
+  <listitem> <para>
+    A newly packaged TeX Live 2015 is provided in <literal>pkgs.texlive</literal>,
+    split into 6500 nix packages. For basic user documentation see
+    <link xlink:href="https://github.com/NixOS/nixpkgs/blob/release-15.09/pkgs/tools/typesetting/tex/texlive-new/default.nix#L1"
+      >the source</link>.
+    Beware of <link xlink:href="https://github.com/NixOS/nixpkgs/issues/9757"
+      >an issue</link> when installing a too large package set.
+
+    The plan is to deprecate and maybe delete the original TeX packages
+    until the next release.
+  </para> </listitem>
+
+  <listitem><para>
+    <option>buildEnv.env</option> on all Python interpreters
+    is now available for nix-shell interoperability.
+  </para> </listitem>
+</itemizedlist>
+
+</para>
+
+</section>

nixos/doc/manual/release-notes/rl-unstable.xml

@@ -4,228 +4,42 @@
          version="5.0"
          xml:id="sec-release-unstable">
 
-<title>Release 15.07 (“Dingo”, 2015/07/??)</title>
-
-<para>In addition to numerous new and upgraded packages, this release has the following highlights:
-
-  <itemizedlist>
-    <listitem>
-      <para>
-        The Haskell packages infrastructure has been re-designed from the ground up.
-        NixOS now distributes the latest version of every single package registered on
-        <link xlink:href="http://hackage.haskell.org/">Hackage</link>, i.e. well over
-        8000 Haskell packages. Further information and usage instructions for the
-        improved infrastructure are available at <link
-        xlink:href="https://nixos.org/wiki/Haskell">https://nixos.org/wiki/Haskell</link>.
-        Users migrating from an earlier release will find also find helpful information
-        below, in the list of backwards-incompatible changes.
-      </para>
-    </listitem>
-
-    <listitem>
-      <para>
-        Users running an SSH server who worry about the quality of their
-        <literal>/etc/ssh/moduli</literal> file with respect to the <link
-        xlink:href="https://stribika.github.io/2015/01/04/secure-secure-shell.html">vulnerabilities
-        discovered in the Diffie-Hellman key exchange</link> can now replace OpenSSH's
-        default version with one they generated themselves using the new
-        <literal>services.openssh.moduliFile</literal> option.
-      </para>
-    </listitem>
-  </itemizedlist>
-
-</para>
-
+<title>Unstable</title>
 
 <para>When upgrading from a previous release, please be aware of the
-following incompatible changes:
+following incompatible changes:</para>
 
 <itemizedlist>
+  <listitem>
+    <para><command>wmiiSnap</command> has been replaced with
+    <command>wmii_hg</command>, but
+    <command>services.xserver.windowManager.wmii.enable</command> has
+    been updated respectively so this only affects you if you have
+    explicitly installed <command>wmiiSnap</command>.
+    </para>
+  </listitem>
 
-<listitem><para><command>sshd</command> no longer supports DSA and ECDSA
-host keys by default. If you have existing systems with such host keys
-and want to continue to use them, please set
+  <listitem>
+    <para><command>wmiimenu</command> is removed, as it has been
+    removed by the developers upstream. Use <command>wimenu</command>
+    from the <command>wmii-hg</command> package.</para>
+  </listitem>
 
-<programlisting>
-system.stateVersion = "14.12";
-</programlisting>
+  <listitem>
+    <para>Gitit is no longer automatically added to the module list in
+    NixOS and as such there will not be any manual entries for it. You
+    will need to add an import statement to your NixOS configuration
+    in order to use it, e.g.
 
-(The new option <option>system.stateVersion</option> ensures that
-certain configuration changes that could break existing systems (such
-as the <command>sshd</command> host key setting) will maintain
-compatibility with the specified NixOS release.)</para></listitem>
+<programlisting><![CDATA[
+{
+  imports = [ <nixos/modules/services/misc/gitit.nix> ];
+}
+]]></programlisting>
 
-<listitem><para><command>cron</command> is no longer enabled by
-default, unless you have a non-empty
-<option>services.cron.systemCronJobs</option>. To force
-<command>cron</command> to be enabled, set
-<option>services.cron.enable = true</option>.</para></listitem>
-
-<listitem><para>Nix now requires binary caches to be cryptographically
-signed. If you have unsigned binary caches that you want to continue
-to use, you should set <option>nix.requireSignedBinaryCaches =
-false</option>.</para></listitem>
-
-<listitem><para>Steam now doesn't need root rights to work. Instead of using
-<literal>*-steam-chrootenv</literal>, you should now just run <literal>steam</literal>.
-<literal>steamChrootEnv</literal> package was renamed to <literal>steam</literal>,
-and old <literal>steam</literal> package -- to <literal>steamOriginal</literal>.
-</para></listitem>
-
-<listitem><para>CMPlayer has been renamed to bomi upstream. Package <literal>cmplayer</literal>
-was accordingly renamed to <literal>bomi</literal>
-</para></listitem>
-
-<listitem><para>Atom Shell has been renamed to Electron upstream.  Package <literal>atom-shell</literal>
-was accordingly renamed to <literal>electron</literal>
-</para></listitem>
-
-<listitem><para>Elm is not released on Hackage anymore. You should now use <literal>elmPackages.elm</literal>
-which contains the latest Elm platform.</para></listitem>
-
-<listitem>
-  <para>
-	The CUPS printing service has been updated to version <literal>2.0.2</literal>.
-	Furthermore its systemd service has been renamed to <literal>cups.service</literal>.
-  </para>
-  <para>
-	Local printers are no longer shared or advertised by default. This behavior
-	can be changed by enabling <literal>services.printing.defaultShared</literal>
-	or <literal>services.printing.browsing</literal> respectively.
-  </para>
-</listitem>
-
-<listitem>
-  <para>
-    The VirtualBox host and guest options have been moved/renamed more
-    consistently and less confusing to be now found in
-    <literal>virtualisation.virtualbox.host.*</literal> instead of
-    <literal>services.virtualboxHost.*</literal> and
-    <literal>virtualisation.virtualbox.guest.*</literal> instead of
-    <literal>services.virtualboxGuest.*</literal>.
-  </para>
-</listitem>
-
-<listitem>
-  <para>
-    Haskell packages can no longer be found by name, i.e. the commands
-    <literal>nix-env -qa cabal-install</literal> and <literal>nix-env -i
-    ghc</literal> will fail, even though we <emphasis>do</emphasis> ship
-    both <literal>cabal-install</literal> and <literal>ghc</literal>.
-    The reason for this inconvenience is the sheer size of the Haskell
-    package set: name-based lookups such as these would become much
-    slower than they are today if we'd add the entire Hackage database
-    into the top level attribute set. Instead, the list of Haskell
-    packages can be displayed by
-  </para>
-  <programlisting>
-nix-env -f &quot;&lt;nixpkgs&gt;&quot; -qaP -A haskellPackages
-</programlisting>
-  <para>
-    and packages can be installed with:
-  </para>
-  <programlisting>
-nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskellPackages.cabal-install
-</programlisting>
-</listitem>
-
-<listitem>
-  <para>
-    Previous versions of NixOS came with a feature called
-    <literal>ghc-wrapper</literal>, a small wrapper script that allows
-    GHC to transparently pick up on libraries installed in the user's
-    profile. This feature has been deprecated;
-    <literal>ghc-wrapper</literal> was removed from the distribution.
-    The proper way to register Haskell libraries with the compiler now
-    is the <literal>haskellPackages.ghcWithPackages</literal>
-    function.
-    <link xlink:href="https://nixos.org/wiki/Haskell">https://nixos.org/wiki/Haskell</link>
-    provides much information about this subject.
-  </para>
-</listitem>
-
-<listitem>
-  <para>
-    All Haskell builds that have been generated with version 1.x of
-    the <literal>cabal2nix</literal> utility are now invalid and need
-    to be re-generated with a current version of
-    <literal>cabal2nix</literal> to function. The most recent version
-    of this tool can be installed by running
-    <literal>nix-env -i cabal2nix</literal>.
-  </para>
-</listitem>
-
-<listitem>
-  <para>
-    The <literal>haskellPackages</literal> set in Nixpkgs used to have a
-    function attribute called <literal>extension</literal> that users
-    could override in their <literal>~/.nixpkgs/config.nix</literal>
-    files to configure additional attributes, etc. That function still
-    exists, but it's now called <literal>overrides</literal>.
-  </para>
-</listitem>
-
-<listitem>
-  <para>
-    The OpenBLAS library has been updated to version
-    <literal>0.2.14</literal>. Support for the
-    <literal>x86_64-darwin</literal> platform was added. Dynamic
-    architecture detection was enabled; OpenBLAS now selects
-    microarchitecture-optimized routines at runtime, so optimal
-    performance is achieved without the need to rebuild OpenBLAS
-    locally. OpenBLAS has replaced ATLAS in most packages which use an
-    optimized BLAS or LAPACK implementation.
- </para>
-</listitem>
-
-<listitem>
-  <para>
-    The <literal>phpfpm</literal> is now using the default PHP version
-    (<literal>pkgs.php</literal>) instead of PHP 5.4 (<literal>pkgs.php54</literal>).
-  </para>
-</listitem>
-
-<listitem>
-  <para>
-    The <literal>locate</literal> service no longer indexes the Nix store
-    by default, preventing packages with potentially numerous versions from
-    cluttering the output. Indexing the store can be activated by setting
-    <literal>services.locate.includeStore = true</literal>.
-  </para>
-</listitem>
-
-<listitem>
-  <para>
-    The Nix expression search path (<envar>NIX_PATH</envar>) no longer
-    contains <filename>/etc/nixos/nixpkgs</filename> by default. You
-    can override <envar>NIX_PATH</envar> by setting
-    <option>nix.nixPath</option>.
-  </para>
-</listitem>
+    will include the Gitit service configuration options.</para>
+  </listitem>
 
 </itemizedlist>
-</para>
-
-
-<para>The following new services were added since the last release:
-
-<itemizedlist>
-<listitem><para><literal>brltty</literal></para></listitem>
-<listitem><para><literal>marathon</literal></para></listitem>
-<listitem><para><literal>tvheadend</literal></para></listitem>
-</itemizedlist>
-</para>
-
-
-<para>Other notable improvements:
-
-<itemizedlist>
-  <listitem><para>The nixos and nixpkgs channels were unified,
-    so one <emphasis>can</emphasis> use <literal>nix-env -iA nixos.bash</literal>
-    instead of <literal>nix-env -iA nixos.pkgs.bash</literal>.
-    See <link xlink:href="https://github.com/NixOS/nixpkgs/commit/2cd7c1f198">the commit</link> for details.
-  </para></listitem>
-</itemizedlist>
-</para>
 
 </section>

nixos/lib/eval-config.nix

@@ -54,11 +54,6 @@ in rec {
 
   # These are the extra arguments passed to every module.  In
   # particular, Nixpkgs is passed through the "pkgs" argument.
-  # FIXME: we enable config.allowUnfree to make packages like
-  # nvidia-x11 available. This isn't a problem because if the user has
-  # ‘nixpkgs.config.allowUnfree = false’, then evaluation will fail on
-  # the 64-bit package anyway. However, it would be cleaner to respect
-  # nixpkgs.config here.
   extraArgs = extraArgs_ // {
     inherit modules baseModules;
   };

nixos/lib/make-disk-image.nix

@@ -0,0 +1,116 @@
+{ pkgs
+, lib
+
+, # The NixOS configuration to be installed onto the disk image.
+  config
+
+, # The size of the disk, in megabytes.
+  diskSize
+
+, # Whether the disk should be partitioned (with a single partition
+  # containing the root filesystem) or contain the root filesystem
+  # directly.
+  partitioned ? true
+
+, # The root file system type.
+  fsType ? "ext4"
+
+, # The initial NixOS configuration file to be copied to
+  # /etc/nixos/configuration.nix.
+  configFile ? null
+
+, # Shell code executed after the VM has finished.
+  postVM ? ""
+
+}:
+
+with lib;
+
+pkgs.vmTools.runInLinuxVM (
+  pkgs.runCommand "nixos-disk-image"
+    { preVM =
+        ''
+          mkdir $out
+          diskImage=$out/nixos.img
+          ${pkgs.vmTools.qemu}/bin/qemu-img create -f raw $diskImage "${toString diskSize}M"
+          mv closure xchg/
+        '';
+      buildInputs = [ pkgs.utillinux pkgs.perl pkgs.e2fsprogs pkgs.parted ];
+      exportReferencesGraph =
+        [ "closure" config.system.build.toplevel ];
+      inherit postVM;
+      memSize = 1024;
+    }
+    ''
+      ${if partitioned then ''
+        # Create a single / partition.
+        parted /dev/vda mklabel msdos
+        parted /dev/vda -- mkpart primary ext2 1M -1s
+        . /sys/class/block/vda1/uevent
+        mknod /dev/vda1 b $MAJOR $MINOR
+        rootDisk=/dev/vda1
+      '' else ''
+        rootDisk=/dev/vda
+      ''}
+
+      # Create an empty filesystem and mount it.
+      mkfs.${fsType} -L nixos $rootDisk
+      ${optionalString (fsType == "ext4") ''
+        tune2fs -c 0 -i 0 $rootDisk
+      ''}
+      mkdir /mnt
+      mount $rootDisk /mnt
+
+      # The initrd expects these directories to exist.
+      mkdir /mnt/dev /mnt/proc /mnt/sys
+
+      mount -o bind /proc /mnt/proc
+      mount -o bind /dev /mnt/dev
+      mount -o bind /sys /mnt/sys
+
+      # Copy all paths in the closure to the filesystem.
+      storePaths=$(perl ${pkgs.pathsFromGraph} /tmp/xchg/closure)
+
+      mkdir -p /mnt/nix/store
+      echo "copying everything (will take a while)..."
+      set -f
+      cp -prd $storePaths /mnt/nix/store/
+
+      # Register the paths in the Nix database.
+      printRegistration=1 perl ${pkgs.pathsFromGraph} /tmp/xchg/closure | \
+          chroot /mnt ${config.nix.package}/bin/nix-store --load-db --option build-users-group ""
+
+      # Add missing size/hash fields to the database. FIXME:
+      # exportReferencesGraph should provide these directly.
+      chroot /mnt ${config.nix.package}/bin/nix-store --verify --check-contents
+
+      # Create the system profile to allow nixos-rebuild to work.
+      chroot /mnt ${config.nix.package}/bin/nix-env --option build-users-group "" \
+          -p /nix/var/nix/profiles/system --set ${config.system.build.toplevel}
+
+      # `nixos-rebuild' requires an /etc/NIXOS.
+      mkdir -p /mnt/etc
+      touch /mnt/etc/NIXOS
+
+      # `switch-to-configuration' requires a /bin/sh
+      mkdir -p /mnt/bin
+      ln -s ${config.system.build.binsh}/bin/sh /mnt/bin/sh
+
+      # Install a configuration.nix.
+      mkdir -p /mnt/etc/nixos
+      ${optionalString (configFile != null) ''
+        cp ${configFile} /mnt/etc/nixos/configuration.nix
+      ''}
+
+      # Generate the GRUB menu.
+      ln -s vda /dev/xvda
+      ln -s vda /dev/sda
+      chroot /mnt ${config.system.build.toplevel}/bin/switch-to-configuration boot
+
+      umount /mnt/proc /mnt/dev /mnt/sys
+      umount /mnt
+
+      # Do an fsck to make sure resize2fs works.
+      fsck.${fsType} -f -y $rootDisk
+    ''
+)

nixos/maintainers/scripts/ec2/amazon-base-config.nix

@@ -1,5 +0,0 @@
-{ modulesPath, ...}:
-{
-  imports = [ "${modulesPath}/virtualisation/amazon-init.nix" ];
-  services.journald.rateLimitBurst = 0;
-}

nixos/maintainers/scripts/ec2/amazon-hvm-config.nix

@@ -1,5 +0,0 @@
-{ config, pkgs, ...}:
-{
-  imports = [ ./amazon-base-config.nix ];
-  ec2.hvm = true;
-}

nixos/maintainers/scripts/ec2/amazon-hvm-install-config.nix

@@ -1,34 +0,0 @@
-{ config, pkgs, lib, ...}:
-let
-  cloudUtils = pkgs.fetchurl {
-    url = "https://launchpad.net/cloud-utils/trunk/0.27/+download/cloud-utils-0.27.tar.gz";
-    sha256 = "16shlmg36lidp614km41y6qk3xccil02f5n3r4wf6d1zr5n4v8vd";
-  };
-  growpart = pkgs.stdenv.mkDerivation {
-    name = "growpart";
-    src = cloudUtils;
-    buildPhase = ''
-      cp bin/growpart $out
-      sed -i 's|awk|gawk|' $out
-      sed -i 's|sed|gnused|' $out
-    '';
-    dontInstall = true;
-    dontPatchShebangs = true;
-  };
-in
-{
-  imports = [ ./amazon-base-config.nix ];
-  ec2.hvm = true;
-  boot.loader.grub.device = lib.mkOverride 0 "/dev/xvdg";
-  boot.kernelParams = [ "console=ttyS0" ];
-
-  boot.initrd.extraUtilsCommands = ''
-    copy_bin_and_libs ${pkgs.gawk}/bin/gawk
-    copy_bin_and_libs ${pkgs.gnused}/bin/sed
-    copy_bin_and_libs ${pkgs.utillinux}/sbin/sfdisk
-    cp -v ${growpart} $out/bin/growpart
-  '';
-  boot.initrd.postDeviceCommands = ''
-    [ -e /dev/xvda ] && [ -e /dev/xvda1 ] && TMPDIR=/run sh $(type -P growpart) /dev/xvda 1
-  '';
-}

nixos/maintainers/scripts/ec2/amazon-image.nix

@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+
+  imports =
+    [ ../../../modules/installer/cd-dvd/channel.nix
+      ../../../modules/virtualisation/amazon-image.nix
+    ];
+
+  system.build.amazonImage = import ../../../lib/make-disk-image.nix {
+    inherit pkgs lib config;
+    partitioned = config.ec2.hvm;
+    diskSize = if config.ec2.hvm then 2048 else 8192;
+    configFile = pkgs.writeText "configuration.nix"
+      ''
+        {
+          imports = [ <nixpkgs/nixos/modules/virtualisation/amazon-image.nix> ];
+          ${optionalString config.ec2.hvm ''
+            ec2.hvm = true;
+          ''}
+        }
+      '';
+  };
+
+}

nixos/maintainers/scripts/ec2/create-amis.sh

@@ -0,0 +1,217 @@
+#! /bin/sh -e
+
+set -o pipefail
+#set -x
+
+stateDir=${TMPDIR:-/tmp}/ec2-image
+echo "keeping state in $stateDir"
+mkdir -p $stateDir
+
+version=$(nix-instantiate --eval --strict '<nixpkgs>' -A lib.nixpkgsVersion | sed s/'"'//g)
+echo "NixOS version is $version"
+
+rm -f ec2-amis.nix
+
+
+for type in hvm pv; do
+    link=$stateDir/$type
+    imageFile=$link/nixos.img
+    system=x86_64-linux
+    arch=x86_64
+
+    # Build the image.
+    if ! [ -L $link ]; then
+        if [ $type = pv ]; then hvmFlag=false; else hvmFlag=true; fi
+
+        echo "building image type '$type'..."
+        nix-build -o $link \
+            '<nixpkgs/nixos>' \
+            -A config.system.build.amazonImage \
+            --arg configuration "{ imports = [ <nixpkgs/nixos/maintainers/scripts/ec2/amazon-image.nix> ]; ec2.hvm = $hvmFlag; }"
+    fi
+
+    for store in ebs s3; do
+
+        bucket=nixos-amis
+        bucketDir="$version-$type-$store"
+
+        prevAmi=
+        prevRegion=
+
+        for region in eu-west-1 eu-central-1 us-east-1 us-west-1 us-west-2 ap-southeast-1 ap-southeast-2 ap-northeast-1 sa-east-1; do
+
+            name=nixos-$version-$arch-$type-$store
+            description="NixOS $system $version ($type-$store)"
+
+            amiFile=$stateDir/$region.$type.$store.ami-id
+
+            if ! [ -e $amiFile ]; then
+
+                echo "doing $name in $region..."
+
+                if [ -n "$prevAmi" ]; then
+                    ami=$(ec2-copy-image \
+                        --region "$region" \
+                        --source-region "$prevRegion" --source-ami-id "$prevAmi" \
+                        --name "$name" --description "$description" | cut -f 2)
+                else
+
+                    if [ $store = s3 ]; then
+
+                        # Bundle the image.
+                        imageDir=$stateDir/$type-bundled
+
+                        if ! [ -d $imageDir ]; then
+                            rm -rf $imageDir.tmp
+                            mkdir -p $imageDir.tmp
+                            ec2-bundle-image \
+                                -d $imageDir.tmp \
+                                -i $imageFile --arch $arch \
+                                --user "$AWS_ACCOUNT" -c "$EC2_CERT" -k "$EC2_PRIVATE_KEY"
+                            mv $imageDir.tmp $imageDir
+                        fi
+
+                        # Upload the bundle to S3.
+                        if ! [ -e $imageDir/uploaded ]; then
+                            echo "uploading bundle to S3..."
+                            ec2-upload-bundle \
+                                -m $imageDir/nixos.img.manifest.xml \
+                                -b "$bucket/$bucketDir" \
+                                -a "$EC2_ACCESS_KEY" -s "$EC2_SECRET_KEY" \
+                                --location EU
+                            touch $imageDir/uploaded
+                        fi
+
+                        extraFlags="$bucket/$bucketDir/nixos.img.manifest.xml"
+
+                    else
+
+                        # Convert the image to vhd format so we don't have
+                        # to upload a huge raw image.
+                        vhdFile=$stateDir/$type.vhd
+                        if ! [ -e $vhdFile ]; then
+                            qemu-img convert -O vpc $imageFile $vhdFile.tmp
+                            mv $vhdFile.tmp $vhdFile
+                        fi
+
+                        taskId=$(cat $stateDir/$region.$type.task-id 2> /dev/null || true)
+                        volId=$(cat $stateDir/$region.$type.vol-id 2> /dev/null || true)
+                        snapId=$(cat $stateDir/$region.$type.snap-id 2> /dev/null || true)
+
+                        # Import the VHD file.
+                        if [ -z "$snapId" -a -z "$volId" -a -z "$taskId" ]; then
+                            echo "importing $vhdFile..."
+                            taskId=$(ec2-import-volume $vhdFile --no-upload -f vhd \
+                                -o "$EC2_ACCESS_KEY" -w "$EC2_SECRET_KEY" \
+                                --region "$region" -z "${region}a" \
+                                --bucket "$bucket" --prefix "$bucketDir/" \
+                                | tee /dev/stderr \
+                                | sed 's/.*\(import-vol-[0-9a-z]\+\).*/\1/ ; t ; d')
+                            echo -n "$taskId" > $stateDir/$region.$type.task-id
+                        fi
+
+                        if [ -z "$snapId" -a -z "$volId" ]; then
+                            ec2-resume-import  $vhdFile -t "$taskId" --region "$region" \
+                                -o "$EC2_ACCESS_KEY" -w "$EC2_SECRET_KEY"
+                        fi
+
+                        # Wait for the volume creation to finish.
+                        if [ -z "$snapId" -a -z "$volId" ]; then
+                            echo "waiting for import to finish..."
+                            while true; do
+                                volId=$(ec2-describe-conversion-tasks "$taskId" --region "$region" | sed 's/.*VolumeId.*\(vol-[0-9a-f]\+\).*/\1/ ; t ; d')
+                                if [ -n "$volId" ]; then break; fi
+                                sleep 10
+                            done
+
+                            echo -n "$volId" > $stateDir/$region.$type.vol-id
+                        fi
+
+                        # Delete the import task.
+                        if [ -n "$volId" -a -n "$taskId" ]; then
+                            echo "removing import task..."
+                            ec2-delete-disk-image -t "$taskId" --region "$region" -o "$EC2_ACCESS_KEY" -w "$EC2_SECRET_KEY" || true
+                            rm -f $stateDir/$region.$type.task-id
+                        fi
+
+                        # Create a snapshot.
+                        if [ -z "$snapId" ]; then
+                            echo "creating snapshot..."
+                            snapId=$(ec2-create-snapshot "$volId" --region "$region" | cut -f 2)
+                            echo -n "$snapId" > $stateDir/$region.$type.snap-id
+                            ec2-create-tags "$snapId" -t "Name=$description" --region "$region"
+                        fi
+
+                        # Wait for the snapshot to finish.
+                        echo "waiting for snapshot to finish..."
+                        while true; do
+                            status=$(ec2-describe-snapshots "$snapId" --region "$region" | head -n1 | cut -f 4)
+                            if [ "$status" = completed ]; then break; fi
+                            sleep 10
+                        done
+
+                        # Delete the volume.
+                        if [ -n "$volId" ]; then
+                            echo "deleting volume..."
+                            ec2-delete-volume "$volId" --region "$region" || true
+                            rm -f $stateDir/$region.$type.vol-id
+                        fi
+
+                        extraFlags="-b /dev/sda1=$snapId:20:true:gp2"
+
+                        if [ $type = pv ]; then
+                            extraFlags+=" --root-device-name=/dev/sda1"
+                        fi
+
+                        extraFlags+=" -b /dev/sdb=ephemeral0 -b /dev/sdc=ephemeral1 -b /dev/sdd=ephemeral2 -b /dev/sde=ephemeral3"
+                    fi
+
+                    # Register the AMI.
+                    if [ $type = pv ]; then
+                        kernel=$(ec2-describe-images -o amazon --filter "manifest-location=*pv-grub-hd0_1.04-$arch*" --region "$region" | cut -f 2)
+                        [ -n "$kernel" ]
+                        echo "using PV-GRUB kernel $kernel"
+                        extraFlags+=" --virtualization-type paravirtual --kernel $kernel"
+                    else
+                        extraFlags+=" --virtualization-type hvm"
+                    fi
+
+                    ami=$(ec2-register \
+                        -n "$name" \
+                        -d "$description" \
+                        --region "$region" \
+                        --architecture "$arch" \
+                        $extraFlags | cut -f 2)
+                fi
+
+                echo -n "$ami" > $amiFile
+                echo "created AMI $ami of type '$type' in $region..."
+
+            else
+                ami=$(cat $amiFile)
+            fi
+
+            if [ -z "$NO_WAIT" -o -z "$prevAmi" ]; then
+                echo "waiting for AMI..."
+                while true; do
+                    status=$(ec2-describe-images "$ami" --region "$region" | head -n1 | cut -f 5)
+                    if [ "$status" = available ]; then break; fi
+                    sleep 10
+                done
+
+                ec2-modify-image-attribute \
+                    --region "$region" "$ami" -l -a all
+            fi
+
+            echo "region = $region, type = $type, store = $store, ami = $ami"
+            if [ -z "$prevAmi" ]; then
+                prevAmi="$ami"
+                prevRegion="$region"
+            fi
+
+            echo "  \"15.09\".$region.$type-$store = \"$ami\";" >> ec2-amis.nix
+        done
+
+    done
+
+done

nixos/maintainers/scripts/ec2/create-ebs-amis.py

@@ -1,216 +0,0 @@
-#! /usr/bin/env python
-
-import os
-import sys
-import time
-import argparse
-import nixops.util
-from nixops import deployment
-from boto.ec2.blockdevicemapping import BlockDeviceMapping, BlockDeviceType
-import boto.ec2
-from nixops.statefile import StateFile, get_default_state_file
-
-parser = argparse.ArgumentParser(description='Create an EBS-backed NixOS AMI')
-parser.add_argument('--region', dest='region', required=True, help='EC2 region to create the image in')
-parser.add_argument('--channel', dest='channel', default="14.12", help='Channel to use')
-parser.add_argument('--keep', dest='keep', action='store_true', help='Keep NixOps machine after use')
-parser.add_argument('--hvm', dest='hvm', action='store_true', help='Create HVM image')
-parser.add_argument('--key', dest='key_name', action='store_true', help='Keypair used for HVM instance creation', default="rob")
-args = parser.parse_args()
-
-instance_type = "m3.medium" if args.hvm else "m1.small"
-
-if args.hvm:
-    virtualization_type = "hvm"
-    root_block = "/dev/sda1"
-    image_type = 'hvm'
-else:
-    virtualization_type = "paravirtual"
-    root_block = "/dev/sda"
-    image_type = 'ebs'
-
-ebs_size = 20
-
-# Start a NixOS machine in the given region.
-f = open("ebs-creator-config.nix", "w")
-f.write('''{{
-  resources.ec2KeyPairs.keypair.accessKeyId = "lb-nixos";
-  resources.ec2KeyPairs.keypair.region = "{0}";
-
-  machine =
-    {{ pkgs, ... }}:
-    {{
-      deployment.ec2.accessKeyId = "lb-nixos";
-      deployment.ec2.region = "{0}";
-      deployment.ec2.blockDeviceMapping."/dev/xvdg".size = pkgs.lib.mkOverride 10 {1};
-    }};
-}}
-'''.format(args.region, ebs_size))
-f.close()
-
-db = StateFile(get_default_state_file())
-try:
-    depl = db.open_deployment("ebs-creator")
-except Exception:
-    depl = db.create_deployment()
-    depl.name = "ebs-creator"
-depl.logger.set_autoresponse("y")
-depl.nix_exprs = [os.path.abspath("./ebs-creator.nix"), os.path.abspath("./ebs-creator-config.nix")]
-if not args.keep: depl.destroy_resources()
-depl.deploy(allow_reboot=True)
-
-m = depl.machines['machine']
-
-# Do the installation.
-device="/dev/xvdg"
-if args.hvm:
-    m.run_command('parted -s /dev/xvdg -- mklabel msdos')
-    m.run_command('parted -s /dev/xvdg -- mkpart primary ext2 1M -1s')
-    device="/dev/xvdg1"
-
-m.run_command("if mountpoint -q /mnt; then umount /mnt; fi")
-m.run_command("mkfs.ext4 -L nixos {0}".format(device))
-m.run_command("mkdir -p /mnt")
-m.run_command("mount {0} /mnt".format(device))
-m.run_command("touch /mnt/.ebs")
-m.run_command("mkdir -p /mnt/etc/nixos")
-
-m.run_command("nix-channel --add https://nixos.org/channels/nixos-{} nixos".format(args.channel))
-m.run_command("nix-channel --update")
-
-version = m.run_command("nix-instantiate --eval-only -A lib.nixpkgsVersion '<nixpkgs>'", capture_stdout=True).split(' ')[0].replace('"','').strip()
-print >> sys.stderr, "NixOS version is {0}".format(version)
-if args.hvm:
-    m.upload_file("./amazon-base-config.nix", "/mnt/etc/nixos/amazon-base-config.nix")
-    m.upload_file("./amazon-hvm-config.nix", "/mnt/etc/nixos/configuration.nix")
-    m.upload_file("./amazon-hvm-install-config.nix", "/mnt/etc/nixos/amazon-hvm-install-config.nix")
-    m.run_command("NIXOS_CONFIG=/etc/nixos/amazon-hvm-install-config.nix nixos-install")
-else:
-    m.upload_file("./amazon-base-config.nix", "/mnt/etc/nixos/configuration.nix")
-    m.run_command("nixos-install")
-
-m.run_command("umount /mnt")
-
-if args.hvm:
-    ami_name = "nixos-{0}-x86_64-hvm".format(version)
-    description = "NixOS {0} (x86_64; EBS root; hvm)".format(version)
-else:
-    ami_name = "nixos-{0}-x86_64-ebs".format(version)
-    description = "NixOS {0} (x86_64; EBS root)".format(version)
-
-
-# Wait for the snapshot to finish.
-def check():
-    status = snapshot.update()
-    print >> sys.stderr, "snapshot status is {0}".format(status)
-    return status == '100%'
-
-m.connect()
-volume = m._conn.get_all_volumes([], filters={'attachment.instance-id': m.resource_id, 'attachment.device': "/dev/sdg"})[0]
-
-# Create a snapshot.
-snapshot = volume.create_snapshot(description=description)
-print >> sys.stderr, "created snapshot {0}".format(snapshot.id)
-
-nixops.util.check_wait(check, max_tries=120)
-
-m._conn.create_tags([snapshot.id], {'Name': ami_name})
-
-if not args.keep: depl.destroy_resources()
-
-# Register the image.
-aki = m._conn.get_all_images(filters={'manifest-location': 'ec2*pv-grub-hd0_1.03-x86_64*'})[0]
-print >> sys.stderr, "using kernel image {0} - {1}".format(aki.id, aki.location)
-
-block_map = BlockDeviceMapping()
-block_map[root_block] = BlockDeviceType(snapshot_id=snapshot.id, delete_on_termination=True, size=ebs_size, volume_type="gp2")
-block_map['/dev/sdb'] = BlockDeviceType(ephemeral_name="ephemeral0")
-block_map['/dev/sdc'] = BlockDeviceType(ephemeral_name="ephemeral1")
-block_map['/dev/sdd'] = BlockDeviceType(ephemeral_name="ephemeral2")
-block_map['/dev/sde'] = BlockDeviceType(ephemeral_name="ephemeral3")
-
-common_args = dict(
-        name=ami_name,
-        description=description,
-        architecture="x86_64",
-        root_device_name=root_block,
-        block_device_map=block_map,
-        virtualization_type=virtualization_type,
-        delete_root_volume_on_termination=True
-        )
-if not args.hvm:
-    common_args['kernel_id']=aki.id
-
-ami_id = m._conn.register_image(**common_args)
-
-print >> sys.stderr, "registered AMI {0}".format(ami_id)
-
-print >> sys.stderr, "sleeping a bit..."
-time.sleep(30)
-
-print >> sys.stderr, "setting image name..."
-m._conn.create_tags([ami_id], {'Name': ami_name})
-
-print >> sys.stderr, "making image public..."
-image = m._conn.get_all_images(image_ids=[ami_id])[0]
-image.set_launch_permissions(user_ids=[], group_names=["all"])
-
-# Do a test deployment to make sure that the AMI works.
-f = open("ebs-test.nix", "w")
-f.write(
-    '''
-    {{
-      network.description = "NixOS EBS test";
-
-      resources.ec2KeyPairs.keypair.accessKeyId = "lb-nixos";
-      resources.ec2KeyPairs.keypair.region = "{0}";
-
-      machine = {{ config, pkgs, resources, ... }}: {{
-        deployment.targetEnv = "ec2";
-        deployment.ec2.accessKeyId = "lb-nixos";
-        deployment.ec2.region = "{0}";
-        deployment.ec2.instanceType = "{2}";
-        deployment.ec2.keyPair = resources.ec2KeyPairs.keypair.name;
-        deployment.ec2.securityGroups = [ "public-ssh" ];
-        deployment.ec2.ami = "{1}";
-      }};
-    }}
-    '''.format(args.region, ami_id, instance_type))
-f.close()
-
-test_depl = db.create_deployment()
-test_depl.auto_response = "y"
-test_depl.name = "ebs-creator-test"
-test_depl.nix_exprs = [os.path.abspath("./ebs-test.nix")]
-test_depl.deploy(create_only=True)
-test_depl.machines['machine'].run_command("nixos-version")
-
-# Log the AMI ID.
-f = open("ec2-amis.nix".format(args.region, image_type), "w")
-f.write("{\n")
-
-for dest in [ 'us-east-1', 'us-west-1', 'us-west-2', 'eu-west-1', 'eu-central-1', 'ap-southeast-1', 'ap-southeast-2', 'ap-northeast-1', 'sa-east-1']:
-    copy_image = None
-    if args.region != dest:
-        try:
-            print >> sys.stderr, "copying image from region {0} to {1}".format(args.region, dest)
-            conn = boto.ec2.connect_to_region(dest)
-            copy_image = conn.copy_image(args.region, ami_id, ami_name, description=None, client_token=None)
-        except :
-            print >> sys.stderr, "FAILED!"
-
-        # Log the AMI ID.
-        if copy_image != None:
-            f.write('  "{0}"."{1}".{2} = "{3}";\n'.format(args.channel,dest,"hvm" if args.hvm else "ebs",copy_image.image_id))
-    else:
-        f.write('  "{0}"."{1}".{2} = "{3}";\n'.format(args.channel,args.region,"hvm" if args.hvm else "ebs",ami_id))
-
-
-f.write("}\n")
-f.close()
-
-if not args.keep:
-    test_depl.logger.set_autoresponse("y")
-    test_depl.destroy_resources()
-    test_depl.delete()
-

nixos/maintainers/scripts/ec2/create-s3-amis.sh

@@ -1,53 +0,0 @@
-#! /bin/sh -e
-
-export NIXOS_CONFIG=$(dirname $(readlink -f $0))/amazon-base-config.nix
-
-version=$(nix-instantiate --eval-only '<nixpkgs/nixos>' -A config.system.nixosVersion | sed s/'"'//g)
-echo "NixOS version is $version"
-
-buildAndUploadFor() {
-    system="$1"
-    arch="$2"
-
-    echo "building $system image..."
-    nix-build '<nixpkgs/nixos>' \
-        -A config.system.build.amazonImage --argstr system "$system" -o ec2-ami
-
-    ec2-bundle-image -i ./ec2-ami/nixos.img --user "$AWS_ACCOUNT" --arch "$arch" \
-        -c "$EC2_CERT" -k "$EC2_PRIVATE_KEY"
-
-    for region in eu-west-1; do
-        echo "uploading $system image for $region..."
-
-        name=nixos-$version-$arch-s3
-        bucket="$(echo $name-$region | tr '[A-Z]_' '[a-z]-')"
-
-        if [ "$region" = eu-west-1 ]; then s3location=EU;
-        elif [ "$region" = us-east-1 ]; then s3location=US;
-        else s3location="$region"
-        fi
-
-        ec2-upload-bundle -b "$bucket" -m /tmp/nixos.img.manifest.xml \
-            -a "$EC2_ACCESS_KEY" -s "$EC2_SECRET_KEY" --location "$s3location" \
-            --url http://s3.amazonaws.com
-
-        kernel=$(ec2-describe-images -o amazon --filter "manifest-location=*pv-grub-hd0_1.04-$arch*" --region "$region" | cut -f 2)
-        echo "using PV-GRUB kernel $kernel"
-
-        ami=$(ec2-register "$bucket/nixos.img.manifest.xml" -n "$name" -d "NixOS $system r$revision" -O "$EC2_ACCESS_KEY" -W "$EC2_SECRET_KEY" \
-            --region "$region" --kernel "$kernel" | cut -f 2)
-
-        echo "AMI ID is $ami"
-
-        echo "  \"14.12\".\"$region\".s3 = \"$ami\";" >> ec2-amis.nix
-
-        ec2-modify-image-attribute --region "$region" "$ami" -l -a all -O "$EC2_ACCESS_KEY" -W "$EC2_SECRET_KEY"
-
-        for cp_region in us-east-1 us-west-1 us-west-2 eu-central-1 ap-southeast-1 ap-southeast-2 ap-northeast-1 sa-east-1; do
-          new_ami=$(aws ec2 copy-image --source-image-id $ami --source-region $region --region $cp_region --name "$name" | json ImageId)
-          echo "  \"14.12\".\"$cp_region\".s3 = \"$new_ami\";" >> ec2-amis.nix  
-        done
-    done
-}
-
-buildAndUploadFor x86_64-linux x86_64

nixos/maintainers/scripts/ec2/ebs-creator.nix

@@ -1,13 +0,0 @@
-{
-  network.description = "NixOS EBS creator";
-
-  machine =
-    { config, pkgs, resources, ... }:
-    { deployment.targetEnv = "ec2";
-      deployment.ec2.instanceType = "c3.large";
-      deployment.ec2.securityGroups = [ "public-ssh" ];
-      deployment.ec2.ebsBoot = false;
-      deployment.ec2.keyPair = resources.ec2KeyPairs.keypair.name;
-      environment.systemPackages = [ pkgs.parted ];
-    };
-}

nixos/modules/config/fonts/fontconfig.nix

@@ -108,10 +108,8 @@ with lib;
         subpixel = {
 
           rgba = mkOption {
-            type = types.string // {
-              check = flip elem ["rgb" "bgr" "vrgb" "vbgr" "none"];
-            };
             default = "rgb";
+            type = types.enum ["rgb" "bgr" "vrgb" "vbgr" "none"];
             description = ''
               Subpixel order, one of <literal>none</literal>,
               <literal>rgb</literal>, <literal>bgr</literal>,
@@ -120,10 +118,8 @@ with lib;
           };
 
           lcdfilter = mkOption {
-            type = types.str // {
-              check = flip elem ["none" "default" "light" "legacy"];
-            };
             default = "default";
+            type = types.enum ["none" "default" "light" "legacy"];
             description = ''
               FreeType LCD filter, one of <literal>none</literal>,
               <literal>default</literal>, <literal>light</literal>, or

nixos/modules/config/fonts/fonts.nix

@@ -31,6 +31,7 @@ with lib;
         pkgs.xorg.fontbh100dpi
         pkgs.xorg.fontmiscmisc
         pkgs.xorg.fontcursormisc
+        pkgs.unifont
       ];
 
   };

nixos/modules/config/i18n.nix

@@ -52,6 +52,15 @@ in
         '';
       };
 
+      consoleUseXkbConfig = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          If set, configure the console keymap from the xserver keyboard
+          settings.
+        '';
+      };
+
       consoleKeyMap = mkOption {
         type = mkOptionType {
           name = "string or path";
@@ -74,6 +83,13 @@ in
 
   config = {
 
+    i18n.consoleKeyMap = with config.services.xserver;
+      mkIf config.i18n.consoleUseXkbConfig
+        (pkgs.runCommand "xkb-console-keymap" { preferLocalBuild = true; } ''
+          '${pkgs.ckbcomp}/bin/ckbcomp' -model '${xkbModel}' -layout '${layout}' \
+            -option '${xkbOptions}' -variant '${xkbVariant}' > "$out"
+        '');
+
     environment.systemPackages =
       optional (config.i18n.supportedLocales != []) glibcLocales;
 

nixos/modules/config/ldap.nix

@@ -108,7 +108,7 @@ in
 
         extraConfig = mkOption {
           default =  "";
-          type = types.string;
+          type = types.lines;
           description = ''
             Extra configuration options that will be added verbatim at
             the end of the nslcd configuration file (nslcd.conf).
@@ -120,7 +120,7 @@ in
         distinguishedName = mkOption {
           default = "";
           example = "cn=admin,dc=example,dc=com";
-          type = types.string;
+          type = types.str;
           description = ''
             The distinguished name to bind to the LDAP server with. If this
             is not specified, an anonymous bind will be done.
@@ -129,7 +129,7 @@ in
 
         password = mkOption {
           default = "/etc/ldap/bind.password";
-          type = types.string;
+          type = types.str;
           description = ''
             The path to a file containing the credentials to use when binding
             to the LDAP server (if not binding anonymously).
@@ -149,7 +149,7 @@ in
 
         policy = mkOption {
           default = "hard_open";
-          type = types.string;
+          type = types.enum [ "hard_open" "hard_init" "soft" ];
           description = ''
             Specifies the policy to use for reconnecting to an unavailable
             LDAP server. The default is <literal>hard_open</literal>, which
@@ -168,7 +168,7 @@ in
 
       extraConfig = mkOption {
         default = "";
-        type = types.string;
+        type = types.lines;
         description = ''
           Extra configuration options that will be added verbatim at
           the end of the ldap configuration file (ldap.conf).

nixos/modules/config/networking.nix

@@ -39,6 +39,16 @@ in
       '';
     };
 
+    networking.extraResolvconfConf = lib.mkOption {
+      type = types.lines;
+      default = "";
+      example = "libc=NO";
+      description = ''
+        Extra configuration to append to <filename>resolvconf.conf</filename>.
+      '';
+    };
+
+
     networking.proxy = {
 
       default = lib.mkOption {
@@ -150,6 +160,7 @@ in
             '' + optionalString dnsmasqResolve ''
               dnsmasq_conf=/etc/dnsmasq-conf.conf
               dnsmasq_resolv=/etc/dnsmasq-resolv.conf
+            '' + cfg.extraResolvconfConf + ''
             '';
 
       } // (optionalAttrs config.services.resolved.enable (

nixos/modules/config/power-management.nix

@@ -98,6 +98,7 @@ in
         after = [ "suspend.target" "hibernate.target" "hybrid-sleep.target" ];
         script =
           ''
+            ${config.systemd.package}/bin/systemctl try-restart post-resume.target
             ${cfg.resumeCommands}
             ${cfg.powerUpCommands}
           '';

nixos/modules/config/shells-environment.nix

@@ -41,20 +41,7 @@ in
         strings.  The latter is concatenated, interspersed with colon
         characters.
       '';
-      type = types.attrsOf (mkOptionType {
-        name = "a string or a list of strings";
-        merge = loc: defs:
-          let
-            defs' = filterOverrides defs;
-            res = (head defs').value;
-          in
-          if isList res then concatLists (getValues defs')
-          else if lessThan 1 (length defs') then
-            throw "The option `${showOption loc}' is defined multiple times, in ${showFiles (getFiles defs)}."
-          else if !isString res then
-            throw "The option `${showOption loc}' does not have a string value, in ${showFiles (getFiles defs)}."
-          else res;
-      });
+      type = types.attrsOf (types.loeOf types.str);
       apply = mapAttrs (n: v: if isList v then concatStringsSep ":" v else v);
     };
 
@@ -70,8 +57,8 @@ in
       type = types.attrsOf (types.listOf types.str);
       example = { PATH = [ "/bin" "/sbin" ]; MANPATH = [ "/man" "/share/man" ]; };
       description = ''
-	Attribute set of environment variable.  Each attribute maps to a list
-	of relative paths.  Each relative path is appended to the each profile
+        Attribute set of environment variable.  Each attribute maps to a list
+        of relative paths.  Each relative path is appended to the each profile
         of <option>environment.profiles</option> to form the content of the
         corresponding environment variable.
       '';
@@ -136,6 +123,7 @@ in
         "''${pkgs.dash}/bin/dash"
       '';
       type = types.path;
+      visible = false;
       description = ''
         The shell executable that is linked system-wide to
         <literal>/bin/sh</literal>. Please note that NixOS assumes all

nixos/modules/config/system-environment.nix

@@ -23,20 +23,7 @@ in
         strings.  The latter is concatenated, interspersed with colon
         characters.
       '';
-      type = types.attrsOf (mkOptionType {
-        name = "a string or a list of strings";
-        merge = loc: defs:
-          let
-            defs' = filterOverrides defs;
-            res = (head defs').value;
-          in
-          if isList res then concatLists (getValues defs')
-          else if lessThan 1 (length defs') then
-            throw "The option `${showOption loc}' is defined multiple times, in ${showFiles (getFiles defs)}."
-          else if !isString res then
-            throw "The option `${showOption loc}' does not have a string value, in ${showFiles (getFiles defs)}."
-          else res;
-      });
+      type = types.attrsOf (types.loeOf types.str);
       apply = mapAttrs (n: v: if isList v then concatStringsSep ":" v else v);
     };
 

nixos/modules/config/system-path.nix

@@ -103,16 +103,23 @@ in
       [ "/bin"
         "/etc/xdg"
         "/info"
-        "/lib"
+        "/lib" # FIXME: remove
+        #"/lib/debug/.build-id" # enables GDB to find separated debug info
         "/man"
         "/sbin"
+        "/share/applications"
+        "/share/desktop-directories"
         "/share/doc"
         "/share/emacs"
+        "/share/icons"
         "/share/info"
         "/share/man"
+        "/share/menus"
+        "/share/mime"
         "/share/nano"
         "/share/org"
         "/share/terminfo"
+        "/share/themes"
         "/share/vim-plugins"
       ];
 

nixos/modules/config/users-groups.nix

@@ -216,7 +216,7 @@ let
           exist. If <option>users.mutableUsers</option> is true, the
           password can be changed subsequently using the
           <command>passwd</command> command. Otherwise, it's
-          equivalent to setting the <option>password</option> option.
+          equivalent to setting the <option>hashedPassword</option> option.
 
           ${hashedPasswordDescription}
         '';
@@ -336,13 +336,13 @@ let
     map (range: "${user.name}:${toString range.startUid}:${toString range.count}\n")
       user.subUidRanges);
 
-  subuidFile = concatStrings (map mkSubuidEntry (attrValues cfg.extraUsers));
+  subuidFile = concatStrings (map mkSubuidEntry (attrValues cfg.users));
 
   mkSubgidEntry = user: concatStrings (
     map (range: "${user.name}:${toString range.startGid}:${toString range.count}\n")
         user.subGidRanges);
 
-  subgidFile = concatStrings (map mkSubgidEntry (attrValues cfg.extraUsers));
+  subgidFile = concatStrings (map mkSubgidEntry (attrValues cfg.users));
 
   idsAreUnique = set: idAttr: !(fold (name: args@{ dup, acc }:
     let
@@ -354,8 +354,8 @@ let
       else { dup = false; acc = newAcc; }
     ) { dup = false; acc = {}; } (builtins.attrNames set)).dup;
 
-  uidsAreUnique = idsAreUnique (filterAttrs (n: u: u.uid != null) cfg.extraUsers) "uid";
-  gidsAreUnique = idsAreUnique (filterAttrs (n: g: g.gid != null) cfg.extraGroups) "gid";
+  uidsAreUnique = idsAreUnique (filterAttrs (n: u: u.uid != null) cfg.users) "uid";
+  gidsAreUnique = idsAreUnique (filterAttrs (n: g: g.gid != null) cfg.groups) "gid";
 
   spec = pkgs.writeText "users-groups.json" (builtins.toJSON {
     inherit (cfg) mutableUsers;
@@ -364,13 +364,13 @@ let
           name uid group description home shell createHome isSystemUser
           password passwordFile hashedPassword
           initialPassword initialHashedPassword;
-      }) cfg.extraUsers;
+      }) cfg.users;
     groups = mapAttrsToList (n: g:
       { inherit (g) name gid;
         members = g.members ++ (mapAttrsToList (n: u: u.name) (
-          filterAttrs (n: u: elem g.name u.extraGroups) cfg.extraUsers
+          filterAttrs (n: u: elem g.name u.extraGroups) cfg.users
         ));
-      }) cfg.extraGroups;
+      }) cfg.groups;
   });
 
 in {
@@ -388,10 +388,10 @@ in {
         <literal>groupadd</literal> commands. On system activation, the
         existing contents of the <literal>/etc/passwd</literal> and
         <literal>/etc/group</literal> files will be merged with the
-        contents generated from the <literal>users.extraUsers</literal> and
-        <literal>users.extraGroups</literal> options.
+        contents generated from the <literal>users.users</literal> and
+        <literal>users.groups</literal> options.
         The initial password for a user will be set
-        according to <literal>users.extraUsers</literal>, but existing passwords
+        according to <literal>users.users</literal>, but existing passwords
         will not be changed.
 
         <warning><para>
@@ -399,7 +399,7 @@ in {
         group files will simply be replaced on system activation. This also
         holds for the user passwords; all changed
         passwords will be reset according to the
-        <literal>users.extraUsers</literal> configuration on activation.
+        <literal>users.users</literal> configuration on activation.
         </para></warning>
       '';
     };
@@ -412,7 +412,7 @@ in {
       '';
     };
 
-    users.extraUsers = mkOption {
+    users.users = mkOption {
       default = {};
       type = types.loaOf types.optionSet;
       example = {
@@ -433,7 +433,7 @@ in {
       options = [ userOpts ];
     };
 
-    users.extraGroups = mkOption {
+    users.groups = mkOption {
       default = {};
       example =
         { students.gid = 1001;
@@ -461,7 +461,7 @@ in {
 
   config = {
 
-    users.extraUsers = {
+    users.users = {
       root = {
         uid = ids.uids.root;
         description = "System administrator";
@@ -478,7 +478,7 @@ in {
       };
     };
 
-    users.extraGroups = {
+    users.groups = {
       root.gid = ids.gids.root;
       wheel.gid = ids.gids.wheel;
       disk.gid = ids.gids.disk;
@@ -525,8 +525,33 @@ in {
       { assertion = !cfg.enforceIdUniqueness || (uidsAreUnique && gidsAreUnique);
         message = "UIDs and GIDs must be unique!";
       }
+      { # If mutableUsers is false, to prevent users creating a
+        # configuration that locks them out of the system, ensure that
+        # there is at least one "privileged" account that has a
+        # password or an SSH authorized key. Privileged accounts are
+        # root and users in the wheel group.
+        assertion = !cfg.mutableUsers ->
+          any id (mapAttrsToList (name: cfg:
+            (name == "root"
+             || cfg.group == "wheel"
+             || elem "wheel" cfg.extraGroups)
+            &&
+            ((cfg.hashedPassword != null && cfg.hashedPassword != "!")
+             || cfg.password != null
+             || cfg.passwordFile != null
+             || cfg.openssh.authorizedKeys.keys != []
+             || cfg.openssh.authorizedKeys.keyFiles != [])
+          ) cfg.users);
+        message = ''
+          Neither the root account nor any wheel user has a password or SSH authorized key.
+          You must set one to prevent being locked out of your system.'';
+      }
     ];
 
   };
 
+  imports =
+    [ (mkAliasOptionModule [ "users" "extraUsers" ] [ "users" "users" ])
+      (mkAliasOptionModule [ "users" "extraGroups" ] [ "users" "groups" ])
+    ];
 }

nixos/modules/installer/cd-dvd/channel.nix

@@ -33,7 +33,7 @@ in
         echo "unpacking the NixOS/Nixpkgs sources..."
         mkdir -p /nix/var/nix/profiles/per-user/root
         ${config.nix.package}/bin/nix-env -p /nix/var/nix/profiles/per-user/root/channels \
-          -i ${channelSources} --quiet --option use-substitutes false
+          -i ${channelSources} --quiet --option build-use-substitutes false
         mkdir -m 0700 -p /root/.nix-defexpr
         ln -s /nix/var/nix/profiles/per-user/root/channels /root/.nix-defexpr/channels
         mkdir -m 0755 -p /var/lib/nixos

nixos/modules/installer/tools/auto-upgrade.nix

@@ -70,7 +70,7 @@ let cfg = config.system.autoUpgrade; in
       path = [ pkgs.gnutar pkgs.xz config.nix.package ];
 
       script = ''
-        ${config.system.build.nixos-rebuild}/bin/nixos-rebuild test ${toString cfg.flags}
+        ${config.system.build.nixos-rebuild}/bin/nixos-rebuild switch ${toString cfg.flags}
       '';
 
       startAt = mkIf cfg.enable "04:40";

nixos/modules/installer/tools/nixos-generate-config.pl

@@ -152,6 +152,22 @@ sub pciCheck {
         push @kernelModules, "wl";
      }
 
+    # broadcom FullMac driver
+    # list taken from
+    # https://wireless.wiki.kernel.org/en/users/Drivers/brcm80211#brcmfmac
+    if ($vendor eq "0x14e4" &&
+        ($device eq "0x43a3" || $device eq "0x43df" || $device eq "0x43ec" ||
+         $device eq "0x43d3" || $device eq "0x43d9" || $device eq "0x43e9" ||
+         $device eq "0x43ba" || $device eq "0x43bb" || $device eq "0x43bc" ||
+         $device eq "0xaa52" || $device eq "0x43ca" || $device eq "0x43cb" ||
+         $device eq "0x43cc" || $device eq "0x43c3" || $device eq "0x43c4" ||
+         $device eq "0x43c5"
+        ) )
+    {
+        # we need e.g. brcmfmac43602-pcie.bin
+        push @imports, "<nixos/modules/hardware/network/broadcom-43xx.nix>";
+    }
+
     # Can't rely on $module here, since the module may not be loaded
     # due to missing firmware.  Ideally we would check modules.pcimap
     # here.
@@ -217,8 +233,8 @@ foreach my $path (glob "/sys/bus/usb/devices/*") {
 }
 
 
-# Add the modules for all block devices.
-foreach my $path (glob "/sys/class/block/*") {
+# Add the modules for all block and MMC devices.
+foreach my $path (glob "/sys/class/{block,mmc_host}/*") {
     my $module;
     if (-e "$path/device/driver/module") {
         $module = basename `readlink -f $path/device/driver/module`;

nixos/modules/installer/tools/nixos-install.sh

@@ -188,6 +188,9 @@ mkdir -m 0755 -p $mountPoint/bin
 ln -sf @shell@ $mountPoint/bin/sh
 
 
+# Build hooks likely won't function correctly in the minimal chroot; just disable them.
+unset NIX_BUILD_HOOK
+
 # Make the build below copy paths from the CD if possible.  Note that
 # /tmp/root in the chroot is the root of the CD.
 export NIX_OTHER_STORES=/tmp/root/nix:$NIX_OTHER_STORES

nixos/modules/installer/tools/nixos-rebuild.sh

@@ -157,9 +157,9 @@ if [ -n "$buildNix" ]; then
             if ! nix-build '<nixpkgs>' -A nix -o $tmpDir/nix "${extraBuildFlags[@]}" > /dev/null; then
                 machine="$(uname -m)"
                 if [ "$machine" = x86_64 ]; then
-                    nixStorePath=/nix/store/664kxr14kfgx4dl095crvmr7pbh9xlh5-nix-1.9
+                    nixStorePath=/nix/store/xryr9g56h8yjddp89d6dw12anyb4ch7c-nix-1.10
                 elif [[ "$machine" =~ i.86 ]]; then
-                    nixStorePath=/nix/store/p7xdvz72xx3rhm121jclsbdmmcds7xh6-nix-1.9
+                    nixStorePath=/nix/store/2w92k5wlpspf0q2k9mnf2z42prx3bwmv-nix-1.10
                 else
                     echo "$0: unsupported platform"
                     exit 1

nixos/modules/misc/extra-arguments.nix

@@ -4,6 +4,11 @@
   _module.args = {
     pkgs_i686 = import ../../.. {
       system = "i686-linux";
+      # FIXME: we enable config.allowUnfree to make packages like
+      # nvidia-x11 available. This isn't a problem because if the user has
+      # ‘nixpkgs.config.allowUnfree = false’, then evaluation will fail on
+      # the 64-bit package anyway. However, it would be cleaner to respect
+      # nixpkgs.config here.
       config.allowUnfree = true;
     };
 

nixos/modules/misc/ids.nix

@@ -229,6 +229,11 @@
       riak = 205;
       shout = 206;
       gateone = 207;
+      namecoin = 208;
+      dnschain = 209;
+      #lxd = 210; # unused
+      kibana = 211;
+      xtreemfs = 212;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -436,6 +441,11 @@
       riak = 205;
       #shout = 206; #unused
       gateone = 207;
+      namecoin = 208;
+      #dnschain = 209; #unused
+      lxd = 210; # unused
+      #kibana = 211;
+      xtreemfs = 212;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal

nixos/modules/misc/version.nix

@@ -75,7 +75,7 @@ with lib;
       mkDefault (if pathExists fn then readFile fn else "master");
 
     # Note: code names must only increase in alphabetical order.
-    system.nixosCodeName = "Dingo";
+    system.nixosCodeName = "Emu";
 
     # Generate /etc/os-release.  See
     # http://0pointer.de/public/systemd-man/os-release.html for the

nixos/modules/module-list.nix

@@ -197,7 +197,7 @@
   ./services/misc/etcd.nix
   ./services/misc/felix.nix
   ./services/misc/folding-at-home.nix
-  ./services/misc/gitit.nix
+  #./services/misc/gitit.nix
   ./services/misc/gitlab.nix
   ./services/misc/gitolite.nix
   ./services/misc/gpsd.nix
@@ -257,6 +257,7 @@
   ./services/network-filesystems/diod.nix
   ./services/network-filesystems/u9fs.nix
   ./services/network-filesystems/yandex-disk.nix
+  ./services/network-filesystems/xtreemfs.nix
   ./services/networking/aiccu.nix
   ./services/networking/amuled.nix
   ./services/networking/asterisk.nix
@@ -275,6 +276,7 @@
   ./services/networking/ddclient.nix
   ./services/networking/dhcpcd.nix
   ./services/networking/dhcpd.nix
+  ./services/networking/dnschain.nix
   ./services/networking/dnscrypt-proxy.nix
   ./services/networking/dnsmasq.nix
   ./services/networking/docker-registry-server.nix
@@ -303,6 +305,7 @@
   ./services/networking/minidlna.nix
   ./services/networking/mstpd.nix
   ./services/networking/murmur.nix
+  ./services/networking/namecoind.nix
   ./services/networking/nat.nix
   ./services/networking/networkmanager.nix
   ./services/networking/ngircd.nix
@@ -337,6 +340,7 @@
   ./services/networking/ssh/lshd.nix
   ./services/networking/ssh/sshd.nix
   ./services/networking/strongswan.nix
+  ./services/networking/supplicant.nix
   ./services/networking/supybot.nix
   ./services/networking/syncthing.nix
   ./services/networking/tcpcrypt.nix
@@ -363,6 +367,7 @@
   ./services/scheduling/fcron.nix
   ./services/scheduling/marathon.nix
   ./services/search/elasticsearch.nix
+  ./services/search/kibana.nix
   ./services/search/solr.nix
   ./services/security/clamav.nix
   ./services/security/fail2ban.nix
@@ -372,6 +377,7 @@
   ./services/security/haveged.nix
   ./services/security/hologram.nix
   ./services/security/munge.nix
+  ./services/security/physlock.nix
   ./services/security/torify.nix
   ./services/security/tor.nix
   ./services/security/torsocks.nix
@@ -468,6 +474,7 @@
   ./tasks/filesystems/ntfs.nix
   ./tasks/filesystems/reiserfs.nix
   ./tasks/filesystems/unionfs-fuse.nix
+  ./tasks/filesystems/vboxsf.nix
   ./tasks/filesystems/vfat.nix
   ./tasks/filesystems/xfs.nix
   ./tasks/filesystems/zfs.nix
@@ -485,6 +492,7 @@
   ./virtualisation/docker.nix
   ./virtualisation/libvirtd.nix
   ./virtualisation/lxc.nix
+  ./virtualisation/lxd.nix
   ./virtualisation/amazon-options.nix
   ./virtualisation/openvswitch.nix
   ./virtualisation/parallels-guest.nix

nixos/modules/profiles/base.nix

@@ -47,7 +47,7 @@
   ];
 
   # Include support for various filesystems.
-  boot.supportedFilesystems = [ "btrfs" "reiserfs" "vfat" "f2fs" "zfs" "ntfs" "cifs" ];
+  boot.supportedFilesystems = [ "btrfs" "reiserfs" "vfat" "f2fs" "xfs" "zfs" "ntfs" "cifs" ];
 
   # Configure host id for ZFS to work
   networking.hostId = "8425e349";

nixos/modules/programs/cdemu.nix

@@ -9,19 +9,28 @@ in {
     programs.cdemu = {
       enable = mkOption {
         default = false;
-        description = "Whether to enable cdemu for users of appropriate group (default cdrom)";
+        description = ''
+          <command>cdemu</command> for members of
+          <option>programs.cdemu.group</option>.
+        '';
       };
       group = mkOption {
         default = "cdrom";
-        description = "Required group for users of cdemu";
+        description = ''
+          Group that users must be in to use <command>cdemu</command>.
+        '';
       };
       gui = mkOption {
         default = true;
-        description = "Whether to install cdemu GUI (gCDEmu)";
+        description = ''
+          Whether to install the <command>cdemu</command> GUI (gCDEmu).
+        '';
       };
       image-analyzer = mkOption {
         default = true;
-        description = "Whether to install image analyzer";
+        description = ''
+          Whether to install the image analyzer.
+        '';
       };
     };
   };

nixos/modules/programs/command-not-found/command-not-found.nix

@@ -57,9 +57,9 @@ in
           if [ $? = 126 ]; then
             "$@"
           fi
-	else
+        else
           # Indicate than there was an error so ZSH falls back to its default handler
-	  return 127
+          return 127
         fi
       }
     '';

nixos/modules/programs/command-not-found/command-not-found.pl

@@ -30,11 +30,11 @@ The program ‘$program’ is currently not installed. It is provided by
 the package ‘$package’, which I will now install for you.
 EOF
         ;
-        exit 126 if system("nix-env", "-i", $package) == 0;
+        exit 126 if system("nix-env", "-iA", "nixos.$package") == 0;
     } else {
         print STDERR <<EOF;
 The program ‘$program’ is currently not installed. You can install it by typing:
-  nix-env -i $package
+  nix-env -iA nixos.$package
 EOF
     }
 } else {
@@ -42,7 +42,7 @@ EOF
 The program ‘$program’ is currently not installed. It is provided by
 several packages. You can install it by typing one of the following:
 EOF
-    print STDERR "  nix-env -i $_->{package}\n" foreach @$res;
+    print STDERR "  nix-env -iA nixos.$_->{package}\n" foreach @$res;
 }
 
 exit 127;

nixos/modules/programs/ssh.nix

@@ -18,6 +18,14 @@ let
       exec ${askPassword}
     '';
 
+  knownHosts = map (h: getAttr h cfg.knownHosts) (attrNames cfg.knownHosts);
+
+  knownHostsText = flip (concatMapStringsSep "\n") knownHosts
+    (h: assert h.hostNames != [];
+      concatStringsSep "," h.hostNames + " "
+      + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
+    );
+
 in
 {
   ###### interface
@@ -28,7 +36,6 @@ in
 
       askPassword = mkOption {
         type = types.str;
-        default = "${pkgs.x11_ssh_askpass}/libexec/x11-ssh-askpass";
         description = ''Program used by SSH to ask for passwords.'';
       };
 
@@ -92,16 +99,76 @@ in
         '';
       };
 
+      knownHosts = mkOption {
+        default = {};
+        type = types.loaOf (types.submodule ({ name, ... }: {
+          options = {
+            hostNames = mkOption {
+              type = types.listOf types.str;
+              default = [];
+              description = ''
+                A list of host names and/or IP numbers used for accessing
+                the host's ssh service.
+              '';
+            };
+            publicKey = mkOption {
+              default = null;
+              type = types.nullOr types.str;
+              example = "ecdsa-sha2-nistp521 AAAAE2VjZHN...UEPg==";
+              description = ''
+                The public key data for the host. You can fetch a public key
+                from a running SSH server with the <command>ssh-keyscan</command>
+                command. The public key should not include any host names, only
+                the key type and the key itself.
+              '';
+            };
+            publicKeyFile = mkOption {
+              default = null;
+              type = types.nullOr types.path;
+              description = ''
+                The path to the public key file for the host. The public
+                key file is read at build time and saved in the Nix store.
+                You can fetch a public key file from a running SSH server
+                with the <command>ssh-keyscan</command> command. The content
+                of the file should follow the same format as described for
+                the <literal>publicKey</literal> option.
+              '';
+            };
+          };
+          config = {
+            hostNames = mkDefault [ name ];
+          };
+        }));
+        description = ''
+          The set of system-wide known SSH hosts.
+        '';
+        example = [
+          {
+            hostNames = [ "myhost" "myhost.mydomain.com" "10.10.1.4" ];
+            publicKeyFile = literalExample "./pubkeys/myhost_ssh_host_dsa_key.pub";
+          }
+          {
+            hostNames = [ "myhost2" ];
+            publicKeyFile = literalExample "./pubkeys/myhost2_ssh_host_dsa_key.pub";
+          }
+        ];
+      };
+
     };
 
   };
 
   config = {
 
-    assertions = singleton
-      { assertion = cfg.forwardX11 -> cfg.setXAuthLocation;
-        message = "cannot enable X11 forwarding without setting XAuth location";
-      };
+    assertions =
+      [ { assertion = cfg.forwardX11 -> cfg.setXAuthLocation;
+          message = "cannot enable X11 forwarding without setting XAuth location";
+        }
+      ] ++ flip mapAttrsToList cfg.knownHosts (name: data: {
+        assertion = (data.publicKey == null && data.publicKeyFile != null) ||
+                    (data.publicKey != null && data.publicKeyFile == null);
+        message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
+      });
 
     # SSH configuration. Slight duplication of the sshd_config
     # generation in the sshd service.
@@ -118,6 +185,8 @@ in
         ${cfg.extraConfig}
       '';
 
+    environment.etc."ssh/ssh_known_hosts".text = knownHostsText;
+
     # FIXME: this should really be socket-activated for über-awesomeness.
     systemd.user.services.ssh-agent =
       { enable = cfg.startAgent;
@@ -153,5 +222,7 @@ in
         export SSH_ASKPASS=${askPassword}
       '';
 
+    programs.ssh.askPassword = mkDefault "${pkgs.x11_ssh_askpass}/libexec/x11-ssh-askpass";
+
   };
 }

nixos/modules/programs/venus.nix

@@ -41,7 +41,7 @@ in
 
       dates = mkOption {
         default = "*:0/15";
-        type = types.string;
+        type = types.str;
         description = ''
           Specification (in the format described by
           <citerefentry><refentrytitle>systemd.time</refentrytitle>
@@ -52,7 +52,7 @@ in
 
       user = mkOption {
         default = "root";
-        type = types.string;
+        type = types.str;
         description = ''
           User for running venus script.
         '';
@@ -60,7 +60,7 @@ in
 
       group = mkOption {
         default = "root";
-        type = types.string;
+        type = types.str;
         description = ''
           Group for running venus script.
         '';
@@ -68,7 +68,7 @@ in
 
       name = mkOption {
         default = "NixOS Planet";
-        type = types.string;
+        type = types.str;
         description = ''
           Your planet's name.
         '';
@@ -76,7 +76,7 @@ in
 
       link = mkOption {
         default = "http://planet.nixos.org";
-        type = types.string;
+        type = types.str;
         description = ''
           Link to the main page.
         '';
@@ -84,7 +84,7 @@ in
 
       ownerName = mkOption {
         default = "Rok Garbas";
-        type = types.string;
+        type = types.str;
         description = ''
           Your name.
         '';
@@ -92,14 +92,13 @@ in
 
       ownerEmail = mkOption {
         default = "some@example.com";
-        type = types.string;
+        type = types.str;
         description = ''
           Your e-mail address.
         '';
       };
 
       outputTheme = mkOption {
-        default = "${pkgs.venus}/themes/classic_fancy";
         type = types.path;
         description = ''
           Directory containing a config.ini file which is merged with this one.
@@ -170,5 +169,7 @@ in
         startAt = cfg.dates;
       };
 
+    services.venus.outputTheme = mkDefault "${pkgs.venus}/themes/classic_fancy";
+
   };
 }

nixos/modules/programs/wvdial.nix

@@ -24,7 +24,7 @@ in
 
       dialerDefaults = mkOption {
         default = "";
-        type = types.string;
+        type = types.str;
         example = ''Init1 = AT+CGDCONT=1,"IP","internet.t-mobile"'';
         description = ''
           Contents of the "Dialer Defaults" section of
@@ -40,7 +40,7 @@ in
           persist
           noauth
         '';
-        type = types.string;
+        type = types.str;
         description = "Default ppp settings for wvdial.";
       };
 

nixos/modules/programs/xfs_quota.nix

@@ -32,25 +32,25 @@ in
             };
 
             fileSystem = mkOption {
-              type = types.string;
+              type = types.str;
               description = "XFS filesystem hosting the xfs_quota project.";
               default = "/";
             };
 
             path = mkOption {
-              type = types.string;
+              type = types.str;
               description = "Project directory.";
             };
 
             sizeSoftLimit = mkOption {
-              type = types.nullOr types.string;
+              type = types.nullOr types.str;
               default = null;
               example = "30g";
               description = "Soft limit of the project size";
             };
 
             sizeHardLimit = mkOption {
-              type = types.nullOr types.string;
+              type = types.nullOr types.str;
               default = null;
               example = "50g";
               description = "Hard limit of the project size.";

nixos/modules/rename.nix

@@ -1,166 +1,88 @@
-{ config, lib, options, ... }:
+{ lib, ... }:
 
 with lib;
 
-let
+{
+  imports = [
+    (mkRenamedOptionModule [ "environment" "x11Packages" ] [ "environment" "systemPackages" ])
+    (mkRenamedOptionModule [ "environment" "enableBashCompletion" ] [ "programs" "bash" "enableCompletion" ])
+    (mkRenamedOptionModule [ "environment" "nix" ] [ "nix" "package" ])
+    (mkRenamedOptionModule [ "fonts" "enableFontConfig" ] [ "fonts" "fontconfig" "enable" ])
+    (mkRenamedOptionModule [ "fonts" "extraFonts" ] [ "fonts" "fonts" ])
 
-  alias = from: to: rename {
-    inherit from to;
-    name = "Alias";
-    use = id;
-    define = id;
-    visible = true;
-  };
+    (mkRenamedOptionModule [ "security" "extraSetuidPrograms" ] [ "security" "setuidPrograms" ])
+    (mkRenamedOptionModule [ "networking" "enableWLAN" ] [ "networking" "wireless" "enable" ])
+    (mkRenamedOptionModule [ "networking" "enableRT73Firmware" ] [ "networking" "enableRalinkFirmware" ])
 
-  # warn option was renamed
-  obsolete = from: to: rename {
-    inherit from to;
-    name = "Obsolete name";
-    use = x: builtins.trace "Obsolete option `${showOption from}' is used. It was renamed to `${showOption to}'." x;
-    define = x: builtins.trace "Obsolete option `${showOption from}' is used. It was renamed to `${showOption to}'." x;
-  };
+    # Old Grub-related options.
+    (mkRenamedOptionModule [ "boot" "initrd" "extraKernelModules" ] [ "boot" "initrd" "kernelModules" ])
+    (mkRenamedOptionModule [ "boot" "extraKernelParams" ] [ "boot" "kernelParams" ])
 
-  # abort if deprecated option is used
-  deprecated = from: to: rename {
-    inherit from to;
-    name = "Deprecated name";
-    use = x: abort "Deprecated option `${showOption from}' is used. It was renamed to `${showOption to}'.";
-    define = x: abort "Deprecated option `${showOption from}' is used. It was renamed to `${showOption to}'.";
-  };
+    # smartd
+    (mkRenamedOptionModule [ "services" "smartd" "deviceOpts" ] [ "services" "smartd" "defaults" "monitored" ])
 
-  showOption = concatStringsSep ".";
+    # OpenSSH
+    (mkRenamedOptionModule [ "services" "sshd" "ports" ] [ "services" "openssh" "ports" ])
+    (mkAliasOptionModule [ "services" "sshd" "enable" ] [ "services" "openssh" "enable" ])
+    (mkRenamedOptionModule [ "services" "sshd" "allowSFTP" ] [ "services" "openssh" "allowSFTP" ])
+    (mkRenamedOptionModule [ "services" "sshd" "forwardX11" ] [ "services" "openssh" "forwardX11" ])
+    (mkRenamedOptionModule [ "services" "sshd" "gatewayPorts" ] [ "services" "openssh" "gatewayPorts" ])
+    (mkRenamedOptionModule [ "services" "sshd" "permitRootLogin" ] [ "services" "openssh" "permitRootLogin" ])
+    (mkRenamedOptionModule [ "services" "xserver" "startSSHAgent" ] [ "services" "xserver" "startOpenSSHAgent" ])
+    (mkRenamedOptionModule [ "services" "xserver" "startOpenSSHAgent" ] [ "programs" "ssh" "startAgent" ])
+    (mkAliasOptionModule [ "services" "openssh" "knownHosts" ] [ "programs" "ssh" "knownHosts" ])
 
-  zipModules = list:
-    zipAttrsWith (n: v:
-      if tail v != [] then
-        if all (o: isAttrs o && o ? _type) v then mkMerge v
-        else if n == "_type" then head v
-        else if n == "warnings" then concatLists v
-        else if n == "description" || n == "apply" then
-          abort "Cannot rename an option to multiple options."
-        else zipModules v
-      else head v
-    ) list;
+    # VirtualBox
+    (mkRenamedOptionModule [ "services" "virtualbox" "enable" ] [ "virtualisation" "virtualbox" "guest" "enable" ])
+    (mkRenamedOptionModule [ "services" "virtualboxGuest" "enable" ] [ "virtualisation" "virtualbox" "guest" "enable" ])
+    (mkRenamedOptionModule [ "programs" "virtualbox" "enable" ] [ "virtualisation" "virtualbox" "host" "enable" ])
+    (mkRenamedOptionModule [ "programs" "virtualbox" "addNetworkInterface" ] [ "virtualisation" "virtualbox" "host" "addNetworkInterface" ])
+    (mkRenamedOptionModule [ "programs" "virtualbox" "enableHardening" ] [ "virtualisation" "virtualbox" "host" "enableHardening" ])
+    (mkRenamedOptionModule [ "services" "virtualboxHost" "enable" ] [ "virtualisation" "virtualbox" "host" "enable" ])
+    (mkRenamedOptionModule [ "services" "virtualboxHost" "addNetworkInterface" ] [ "virtualisation" "virtualbox" "host" "addNetworkInterface" ])
+    (mkRenamedOptionModule [ "services" "virtualboxHost" "enableHardening" ] [ "virtualisation" "virtualbox" "host" "enableHardening" ])
 
-  rename = { from, to, name, use, define, visible ? false }:
-    let
-      setTo = setAttrByPath to;
-      setFrom = setAttrByPath from;
-      toOf = attrByPath to
-        (abort "Renaming error: option `${showOption to}' does not exists.");
-      fromOf = attrByPath from
-        (abort "Internal error: option `${showOption from}' should be declared.");
-    in
-      [ { options = setFrom (mkOption {
-            description = "${name} of <option>${showOption to}</option>.";
-            apply = x: use (toOf config);
-            inherit visible;
-          });
+    # Tarsnap
+    (mkRenamedOptionModule [ "services" "tarsnap" "config" ] [ "services" "tarsnap" "archives" ])
 
-          config = setTo (mkAliasAndWrapDefinitions define (fromOf options));
-        }
-      ];
+    # proxy
+    (mkRenamedOptionModule [ "nix" "proxy" ] [ "networking" "proxy" "default" ])
 
-  obsolete' = option: singleton
-    { options = setAttrByPath option (mkOption {
-        default = null;
-        visible = false;
-      });
-      config.warnings = optional (getAttrFromPath option config != null)
-        "The option `${showOption option}' defined in your configuration no longer has any effect; please remove it.";
-    };
+    # KDE
+    (mkRenamedOptionModule [ "kde" "extraPackages" ] [ "environment" "systemPackages" ])
+    (mkRenamedOptionModule [ "environment" "kdePackages" ] [ "environment" "systemPackages" ])
 
-in zipModules ([]
+    # Multiple efi bootloaders now
+    (mkRenamedOptionModule [ "boot" "loader" "efi" "efibootmgr" "enable" ] [ "boot" "loader" "efi" "canTouchEfiVariables" ])
 
-++ obsolete [ "environment" "x11Packages" ] [ "environment" "systemPackages" ]
-++ obsolete [ "environment" "enableBashCompletion" ] [ "programs" "bash" "enableCompletion" ]
-++ obsolete [ "environment" "nix" ] [ "nix" "package" ]
-++ obsolete [ "fonts" "enableFontConfig" ] [ "fonts" "fontconfig" "enable" ]
-++ obsolete [ "fonts" "extraFonts" ] [ "fonts" "fonts" ]
+    # NixOS environment changes
+    # !!! this hardcodes bash, could we detect from config which shell is actually used?
+    (mkRenamedOptionModule [ "environment" "promptInit" ] [ "programs" "bash" "promptInit" ])
 
-++ obsolete [ "security" "extraSetuidPrograms" ] [ "security" "setuidPrograms" ]
-++ obsolete [ "networking" "enableWLAN" ] [ "networking" "wireless" "enable" ]
-++ obsolete [ "networking" "enableRT73Firmware" ] [ "networking" "enableRalinkFirmware" ]
+    (mkRenamedOptionModule [ "services" "xserver" "driSupport" ] [ "hardware" "opengl" "driSupport" ])
+    (mkRenamedOptionModule [ "services" "xserver" "driSupport32Bit" ] [ "hardware" "opengl" "driSupport32Bit" ])
+    (mkRenamedOptionModule [ "services" "xserver" "s3tcSupport" ] [ "hardware" "opengl" "s3tcSupport" ])
+    (mkRenamedOptionModule [ "hardware" "opengl" "videoDrivers" ] [ "services" "xserver" "videoDrivers" ])
 
-# FIXME: Remove these eventually.
-++ obsolete [ "boot" "systemd" "sockets" ] [ "systemd" "sockets" ]
-++ obsolete [ "boot" "systemd" "targets" ] [ "systemd" "targets" ]
-++ obsolete [ "boot" "systemd" "services" ] [ "systemd" "services" ]
+    (mkRenamedOptionModule [ "services" "mysql55" ] [ "services" "mysql" ])
 
-# Old Grub-related options.
-++ obsolete [ "boot" "copyKernels" ] [ "boot" "loader" "grub" "copyKernels" ]
-++ obsolete [ "boot" "extraGrubEntries" ] [ "boot" "loader" "grub" "extraEntries" ]
-++ obsolete [ "boot" "extraGrubEntriesBeforeNixos" ] [ "boot" "loader" "grub" "extraEntriesBeforeNixOS" ]
-++ obsolete [ "boot" "grubDevice" ] [ "boot" "loader" "grub" "device" ]
-++ obsolete [ "boot" "bootMount" ] [ "boot" "loader" "grub" "bootDevice" ]
-++ obsolete [ "boot" "grubSplashImage" ] [ "boot" "loader" "grub" "splashImage" ]
+    (mkAliasOptionModule [ "environment" "checkConfigurationOptions" ] [ "_module" "check" ])
 
-++ obsolete [ "boot" "initrd" "extraKernelModules" ] [ "boot" "initrd" "kernelModules" ]
-++ obsolete [ "boot" "extraKernelParams" ] [ "boot" "kernelParams" ]
+    # XBMC
+    (mkRenamedOptionModule [ "services" "xserver" "windowManager" "xbmc" ] [ "services" "xserver" "desktopManager" "kodi" ])
+    (mkRenamedOptionModule [ "services" "xserver" "desktopManager" "xbmc" ] [ "services" "xserver" "desktopManager" "kodi" ])
 
-# smartd
-++ obsolete [ "services" "smartd" "deviceOpts" ] [ "services" "smartd" "defaults" "monitored" ]
+    # DNSCrypt-proxy
+    (mkRenamedOptionModule [ "services" "dnscrypt-proxy" "port" ] [ "services" "dnscrypt-proxy" "localPort" ])
 
-# OpenSSH
-++ obsolete [ "services" "sshd" "ports" ] [ "services" "openssh" "ports" ]
-++ alias [ "services" "sshd" "enable" ] [ "services" "openssh" "enable" ]
-++ obsolete [ "services" "sshd" "allowSFTP" ] [ "services" "openssh" "allowSFTP" ]
-++ obsolete [ "services" "sshd" "forwardX11" ] [ "services" "openssh" "forwardX11" ]
-++ obsolete [ "services" "sshd" "gatewayPorts" ] [ "services" "openssh" "gatewayPorts" ]
-++ obsolete [ "services" "sshd" "permitRootLogin" ] [ "services" "openssh" "permitRootLogin" ]
-++ obsolete [ "services" "xserver" "startSSHAgent" ] [ "services" "xserver" "startOpenSSHAgent" ]
-++ obsolete [ "services" "xserver" "startOpenSSHAgent" ] [ "programs" "ssh" "startAgent" ]
+    # Options that are obsolete and have no replacement.
+    (mkRemovedOptionModule [ "boot" "initrd" "luks" "enable" ])
+    (mkRemovedOptionModule [ "programs" "bash" "enable" ])
+    (mkRemovedOptionModule [ "services" "samba" "defaultShare" ])
+    (mkRemovedOptionModule [ "services" "syslog-ng" "serviceName" ])
+    (mkRemovedOptionModule [ "services" "syslog-ng" "listenToJournal" ])
+    (mkRemovedOptionModule [ "ec2" "metadata" ])
+    (mkRemovedOptionModule [ "services" "openvpn" "enable" ])
 
-# VirtualBox
-++ obsolete [ "services" "virtualbox" "enable" ] [ "virtualisation" "virtualbox" "guest" "enable" ]
-++ obsolete [ "services" "virtualboxGuest" "enable" ] [ "virtualisation" "virtualbox" "guest" "enable" ]
-++ obsolete [ "programs" "virtualbox" "enable" ] [ "virtualisation" "virtualbox" "host" "enable" ]
-++ obsolete [ "programs" "virtualbox" "addNetworkInterface" ] [ "virtualisation" "virtualbox" "host" "addNetworkInterface" ]
-++ obsolete [ "programs" "virtualbox" "enableHardening" ] [ "virtualisation" "virtualbox" "host" "enableHardening" ]
-++ obsolete [ "services" "virtualboxHost" "enable" ] [ "virtualisation" "virtualbox" "host" "enable" ]
-++ obsolete [ "services" "virtualboxHost" "addNetworkInterface" ] [ "virtualisation" "virtualbox" "host" "addNetworkInterface" ]
-++ obsolete [ "services" "virtualboxHost" "enableHardening" ] [ "virtualisation" "virtualbox" "host" "enableHardening" ]
-
-# Tarsnap
-++ obsolete [ "services" "tarsnap" "config" ] [ "services" "tarsnap" "archives" ]
-
-# proxy
-++ obsolete [ "nix" "proxy" ] [ "networking" "proxy" "default" ]
-
-# KDE
-++ deprecated [ "kde" "extraPackages" ] [ "environment" "systemPackages" ]
-++ obsolete [ "environment" "kdePackages" ] [ "environment" "systemPackages" ]
-
-# Multiple efi bootloaders now
-++ obsolete [ "boot" "loader" "efi" "efibootmgr" "enable" ] [ "boot" "loader" "efi" "canTouchEfiVariables" ]
-
-# NixOS environment changes
-# !!! this hardcodes bash, could we detect from config which shell is actually used?
-++ obsolete [ "environment" "promptInit" ] [ "programs" "bash" "promptInit" ]
-
-++ obsolete [ "services" "xserver" "driSupport" ] [ "hardware" "opengl" "driSupport" ]
-++ obsolete [ "services" "xserver" "driSupport32Bit" ] [ "hardware" "opengl" "driSupport32Bit" ]
-++ obsolete [ "services" "xserver" "s3tcSupport" ] [ "hardware" "opengl" "s3tcSupport" ]
-++ obsolete [ "hardware" "opengl" "videoDrivers" ] [ "services" "xserver" "videoDrivers" ]
-
-++ obsolete [ "services" "mysql55" ] [ "services" "mysql" ]
-
-++ alias    [ "environment" "checkConfigurationOptions" ] [ "_module" "check" ]
-
-# XBMC
-++ obsolete [ "services" "xserver" "windowManager" "xbmc" ] [ "services" "xserver" "desktopManager" "kodi" ]
-++ obsolete [ "services" "xserver" "desktopManager" "xbmc" ] [ "services" "xserver" "desktopManager" "kodi" ]
-
-# DNSCrypt-proxy
-++ obsolete [ "services" "dnscrypt-proxy" "port" ] [ "services" "dnscrypt-proxy" "localPort" ]
-
-# Options that are obsolete and have no replacement.
-++ obsolete' [ "boot" "loader" "grub" "bootDevice" ]
-++ obsolete' [ "boot" "initrd" "luks" "enable" ]
-++ obsolete' [ "programs" "bash" "enable" ]
-++ obsolete' [ "services" "samba" "defaultShare" ]
-++ obsolete' [ "services" "syslog-ng" "serviceName" ]
-++ obsolete' [ "services" "syslog-ng" "listenToJournal" ]
-++ obsolete' [ "ec2" "metadata" ]
-
-)
+  ];
+}

nixos/modules/security/apparmor.nix

@@ -37,13 +37,5 @@ in
          ) cfg.profiles;
        };
      };
-
-     security.pam.services.apparmor.text = ''
-       ## AppArmor changes hats according to `order`: first try user, then
-       ## group, and finally fall back to a hat called "DEFAULT"
-       ##
-       ## For now, enable debugging as this is an experimental feature.
-       session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug
-     '';
    };
 }

nixos/modules/security/pam.nix

@@ -192,6 +192,16 @@ let
         description = "Whether to log authentication failures in <filename>/var/log/faillog</filename>.";
       };
 
+      enableAppArmor = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Enable support for attaching AppArmor profiles at the
+          user/group level, e.g., as part of a role based access
+          control scheme.
+        '';
+      };
+
       text = mkOption {
         type = types.nullOr types.lines;
         description = "Contents of the PAM service file.";
@@ -294,6 +304,8 @@ let
               "session optional ${pkgs.pam}/lib/security/pam_motd.so motd=${motd}"}
           ${optionalString cfg.pamMount
               "session optional ${pkgs.pam_mount}/lib/security/pam_mount.so"}
+          ${optionalString (cfg.enableAppArmor && config.security.apparmor.enable)
+              "session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug"}
         '';
     };
 
@@ -407,7 +419,7 @@ in
     users.motd = mkOption {
       default = null;
       example = "Today is Sweetmorn, the 4th day of The Aftermath in the YOLD 3178.";
-      type = types.nullOr types.string;
+      type = types.nullOr types.lines;
       description = "Message of the day shown to users when they log in.";
     };
 

nixos/modules/security/prey.nix

@@ -16,19 +16,28 @@ in {
         default = false;
         type = types.bool;
         description = ''
-          Enables http://preyproject.com/ bash client. Be sure to specify api and device keys.
-          Once setup, cronjob will run evert 15 minutes and report status.
+          Enables the <link xlink:href="http://preyproject.com/" />
+          shell client. Be sure to specify both API and device keys.
+          Once enabled, a <command>cron</command> job will run every 15
+          minutes to report status information.
         '';
       };
 
       deviceKey = mkOption {
-        type = types.string;
-        description = "Device Key obtained from https://panel.preyproject.com/devices (and clicking on the device)";
+        type = types.str;
+        description = ''
+          <literal>Device key</literal> obtained by visiting
+          <link xlink:href="https://panel.preyproject.com/devices" />
+          and clicking on your device.
+        '';
       };
 
       apiKey = mkOption {
-        type = types.string;
-        description = "API key obtained from https://panel.preyproject.com/profile";
+        type = types.str;
+        description = ''
+          <literal>API key</literal> obtained from
+          <link xlink:href="https://panel.preyproject.com/profile" />.
+        '';
       };
     };
 

nixos/modules/services/amqp/activemq/default.nix

@@ -32,7 +32,6 @@ in {
         '';
       };
       configurationDir = mkOption {
-        default = "${activemq}/conf";
         description = ''
           The base directory for ActiveMQ's configuration.
           By default, this directory is searched for a file named activemq.xml,
@@ -126,6 +125,8 @@ in {
       '';
     };
 
+    services.activemq.configurationDir = mkDefault "${activemq}/conf";
+
   };
 
 }

nixos/modules/services/backup/bacula.nix

@@ -169,14 +169,17 @@ in {
         type = types.bool;
         default = false;
         description = ''
-          Whether to enable Bacula File Daemon.
+          Whether to enable the Bacula File Daemon.
         '';
       };
  
       name = mkOption {
         default = "${config.networking.hostName}-fd";
         description = ''
-        	The client name that must be used by the Director when connecting. Generally, it is a good idea to use a name related to the machine so that error messages can be easily identified if you have multiple Clients. This directive is required.
+          The client name that must be used by the Director when connecting.
+          Generally, it is a good idea to use a name related to the machine
+          so that error messages can be easily identified if you have multiple
+          Clients. This directive is required.
         '';
       };
  
@@ -184,7 +187,9 @@ in {
         default = 9102;
         type = types.int;
         description = ''
-        	This specifies the port number on which the Client listens for Director connections. It must agree with the FDPort specified in the Client resource of the Director's configuration file. The default is 9102.
+          This specifies the port number on which the Client listens for
+          Director connections. It must agree with the FDPort specified in
+          the Client resource of the Director's configuration file.
         '';
       };
  
@@ -202,7 +207,7 @@ in {
         description = ''
           Extra configuration to be passed in Client directive.
         '';
-        example = ''
+        example = literalExample ''
           Maximum Concurrent Jobs = 20;
           Heartbeat Interval = 30;
         '';
@@ -213,7 +218,7 @@ in {
         description = ''
           Extra configuration to be passed in Messages directive.
         '';
-        example = ''
+        example = literalExample ''
           console = all
         '';
       };

nixos/modules/services/backup/sitecopy-backup.nix

@@ -21,15 +21,16 @@ in
       enable = mkOption {
         default = false;
         description = ''
-          Whether to enable sitecopy backups of specified directories.
+          Whether to enable <command>sitecopy</command> backups of specified
+          directories.
         '';
       };
 
       period = mkOption {
         default = "15 04 * * *";
         description = ''
-          This option defines (in the format used by cron) when the
-          sitecopy backup are being run.
+          This option defines (in the format used by <command>cron</command>)
+          when the <command>sitecopy</command> backups are to be run.
           The default is to update at 04:15 (at night) every day.
         '';
       };
@@ -47,9 +48,10 @@ in
         ];
         default = [];
         description = ''
-           List of attributesets describing the backups.
+           List of attribute sets describing the backups.
 
-           Username/password are extracted from <filename>${stateDir}/sitecopy.secrets</filename> at activation
+           Username/password are extracted from
+           <filename>${stateDir}/sitecopy.secrets</filename> at activation
            time. The secrets file lines should have the following structure:
            <screen>
              server username password

nixos/modules/services/cluster/kubernetes.nix

@@ -73,7 +73,7 @@ in {
       };
 
       port = mkOption {
-        description = "Kubernets apiserver listening port.";
+        description = "Kubernetes apiserver listening port.";
         default = 8080;
         type = types.int;
       };
@@ -105,7 +105,7 @@ in {
       tokenAuth = mkOption {
         description = ''
           Kubernetes apiserver token authentication file. See
-          <link xlink:href="https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/authentication.md"/>
+          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/authentication.html"/>
         '';
         default = {};
         example = literalExample ''
@@ -120,7 +120,7 @@ in {
       authorizationMode = mkOption {
         description = ''
           Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC). See
-          <link xlink:href="https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/authorization.md"/>
+          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/authorization.html"/>
         '';
         default = "AlwaysAllow";
         type = types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC"];
@@ -129,7 +129,7 @@ in {
       authorizationPolicy = mkOption {
         description = ''
           Kubernetes apiserver authorization policy file. See
-          <link xlink:href="https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/authorization.md"/>
+          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/authorization.html"/>
         '';
         default = [];
         example = literalExample ''
@@ -159,18 +159,37 @@ in {
       };
 
       runtimeConfig = mkOption {
-        description = "Api runtime configuration";
+        description = ''
+          Api runtime configuration. See
+          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/cluster-management.html"/>
+        '';
         default = "";
         example = "api/all=false,api/v1=true";
         type = types.str;
       };
 
       admissionControl = mkOption {
-        description = "Kubernetes admission control plugins to use.";
+        description = ''
+          Kubernetes admission control plugins to use. See
+          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/admission-controllers.html"/>
+        '';
         default = ["AlwaysAdmit"];
+        example = [
+          "NamespaceLifecycle" "NamespaceExists" "LimitRanger"
+          "SecurityContextDeny" "ServiceAccount" "ResourceQuota"
+        ];
         type = types.listOf types.str;
       };
 
+      serviceAccountKey = mkOption {
+        description = ''
+          Kubernetes apiserver PEM-encoded x509 RSA private or public key file,
+          used to verify ServiceAccount tokens.
+        '';
+        default = null;
+        type = types.nullOr types.path;
+      };
+
       extraOpts = mkOption {
         description = "Kubernetes apiserver extra command line options.";
         default = "";
@@ -192,7 +211,7 @@ in {
       };
 
       port = mkOption {
-        description = "Kubernets scheduler listening port.";
+        description = "Kubernetes scheduler listening port.";
         default = 10251;
         type = types.int;
       };
@@ -224,7 +243,7 @@ in {
       };
 
       port = mkOption {
-        description = "Kubernets controller manager listening port.";
+        description = "Kubernetes controller manager listening port.";
         default = 10252;
         type = types.int;
       };
@@ -235,8 +254,26 @@ in {
         type = types.str;
       };
 
+      serviceAccountPrivateKey = mkOption {
+        description = ''
+          Kubernetes controller manager PEM-encoded private RSA key file used to
+          sign service account tokens
+        '';
+        default = null;
+        type = types.nullOr types.path;
+      };
+
+      rootCaFile = mkOption {
+        description = ''
+          Kubernetes controller manager certificate authority file included in
+          service account's token secret.
+        '';
+        default = null;
+        type = types.nullOr types.path;
+      };
+
       extraOpts = mkOption {
-        description = "Kubernetes controller extra command line options.";
+        description = "Kubernetes controller manager extra command line options.";
         default = "";
         type = types.str;
       };
@@ -262,7 +299,7 @@ in {
       };
 
       port = mkOption {
-        description = "Kubernets kubelet info server listening port.";
+        description = "Kubernetes kubelet info server listening port.";
         default = 10250;
         type = types.int;
       };
@@ -294,7 +331,10 @@ in {
       };
 
       apiServers = mkOption {
-        description = "Kubernetes kubelet list of Kubernetes API servers for publishing events, and reading pods and services.";
+        description = ''
+          Kubernetes kubelet list of Kubernetes API servers for publishing events,
+          and reading pods and services.
+        '';
         default = ["${cfg.apiserver.address}:${toString cfg.apiserver.port}"];
         type = types.listOf types.str;
       };
@@ -413,17 +453,14 @@ in {
             ${optionalString (cfg.apiserver.runtimeConfig!="")
               "--runtime-config=${cfg.apiserver.runtimeConfig}"} \
             --admission_control=${concatStringsSep "," cfg.apiserver.admissionControl} \
+            ${optionalString (cfg.apiserver.serviceAccountKey!=null)
+              "--service-account-key-file=${cfg.apiserver.serviceAccountKey}"} \
             --logtostderr=true \
             ${optionalString cfg.verbose "--v=6 --log-flush-frequency=1s"} \
             ${cfg.apiserver.extraOpts}
           '';
           User = "kubernetes";
         };
-        postStart = ''
-          until ${pkgs.curl}/bin/curl -s -o /dev/null 'http://${cfg.apiserver.address}:${toString cfg.apiserver.port}/'; do
-            sleep 1;
-          done
-        '';
       };
     })
 
@@ -456,6 +493,10 @@ in {
             --address=${cfg.controllerManager.address} \
             --port=${toString cfg.controllerManager.port} \
             --master=${cfg.controllerManager.master} \
+            ${optionalString (cfg.controllerManager.serviceAccountPrivateKey!=null)
+              "--service-account-private-key-file=${cfg.controllerManager.serviceAccountPrivateKey}"} \
+            ${optionalString (cfg.controllerManager.rootCaFile!=null)
+              "--root-ca-file=${cfg.controllerManager.rootCaFile}"} \
             --logtostderr=true \
             ${optionalString cfg.verbose "--v=6 --log-flush-frequency=1s"} \
             ${cfg.controllerManager.extraOpts}
@@ -509,6 +550,8 @@ in {
             ${optionalString cfg.verbose "--v=6 --log-flush-frequency=1s"} \
             ${cfg.proxy.extraOpts}
           '';
+          Restart = "always"; # Retry connection
+          RestartSec = "5s";
         };
       };
     })

nixos/modules/services/continuous-integration/jenkins/default.nix

@@ -65,11 +65,15 @@ in {
       };
 
       environment = mkOption {
-        default = { NIX_REMOTE = "daemon"; };
+        default = { };
         type = with types; attrsOf str;
         description = ''
           Additional environment variables to be passed to the jenkins process.
-          The environment will always include JENKINS_HOME.
+          As a base environment, jenkins receives NIX_PATH, SSL_CERT_FILE and
+          GIT_SSL_CAINFO from <option>environment.sessionVariables</option>,
+          NIX_REMOTE is set to "daemon" and JENKINS_HOME is set to
+          the value of <option>services.jenkins.home</option>. This option has
+          precedence and can be used to override those mentioned variables.
         '';
       };
 
@@ -106,9 +110,21 @@ in {
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
-      environment = {
-        JENKINS_HOME = cfg.home;
-      } // cfg.environment;
+      environment =
+        let
+          selectedSessionVars =
+            lib.filterAttrs (n: v: builtins.elem n
+                [ "NIX_PATH"
+                  "SSL_CERT_FILE"
+                  "GIT_SSL_CAINFO"
+                ])
+              config.environment.sessionVariables;
+        in
+          selectedSessionVars //
+          { JENKINS_HOME = cfg.home;
+            NIX_REMOTE = "daemon";
+          } //
+          cfg.environment;
 
       path = cfg.packages;
 

nixos/modules/services/databases/mysql.nix

@@ -167,6 +167,12 @@ in
 
         unitConfig.RequiresMountsFor = "${cfg.dataDir}";
 
+        path = [
+          # Needed for the mysql_install_db command in the preStart script
+          # which calls the hostname command.
+          pkgs.nettools
+        ];
+
         preStart =
           ''
             if ! test -e ${cfg.dataDir}/mysql; then

nixos/modules/services/databases/opentsdb.nix

@@ -5,10 +5,7 @@ with lib;
 let
   cfg = config.services.opentsdb;
 
-  configFile = pkgs.writeText "opentsdb.conf" ''
-    tsd.core.auto_create_metrics = true
-    tsd.http.request.enable_chunked  = true
-  '';
+  configFile = pkgs.writeText "opentsdb.conf" cfg.config;
 
 in {
 
@@ -59,6 +56,17 @@ in {
         '';
       };
 
+      config = mkOption {
+        type = types.lines;
+        default = ''
+          tsd.core.auto_create_metrics = true
+          tsd.http.request.enable_chunked  = true
+        '';
+        description = ''
+          The contents of OpenTSDB's configuration file
+        '';
+      };
+
     };
 
   };

nixos/modules/services/hardware/brltty.nix

@@ -4,10 +4,6 @@ with lib;
 
 let
   cfg = config.services.brltty;
-  
-  stateDir = "/run/brltty";
-
-  pidFile = "${stateDir}/brltty.pid";
 
 in {
 
@@ -24,14 +20,24 @@ in {
   config = mkIf cfg.enable {
 
     systemd.services.brltty = {
-      description = "Braille console driver";
-      preStart = ''
-        mkdir -p ${stateDir}
-      '';
+      description = "Braille Device Support";
+      unitConfig = {
+        Documentation = "http://mielke.cc/brltty/";
+        DefaultDependencies = "no";
+        RequiresMountsFor = "${pkgs.brltty}/var/lib/brltty";
+      };
       serviceConfig = {
-        ExecStart = "${pkgs.brltty}/bin/brltty --pid-file=${pidFile}";
-        Type = "forking";
-        PIDFile = pidFile;
+        ExecStart = "${pkgs.brltty}/bin/brltty --no-daemon";
+        Type = "simple";        # Change to notidy after next releae
+        TimeoutStartSec = 5;
+        TimeoutStopSec = 10;
+        Restart = "always";
+        RestartSec = 30;
+        Nice = -10;
+        OOMScoreAdjust = -900;
+        ProtectHome = "read-only";
+        ProtectSystem = "full";
+        SystemCallArchitectures = "native";
       };
       before = [ "sysinit.target" ];
       wantedBy = [ "sysinit.target" ];

nixos/modules/services/hardware/freefall.nix

@@ -2,40 +2,42 @@
 
 with lib;
 
-{
+let
 
-  ###### interface
+  cfg = config.services.freefall;
 
-  options = with types; {
+in {
 
-    services.freefall = {
+  options.services.freefall = {
 
-      enable = mkOption {
-        default = false;
-        description = ''
-          Whether to protect HP/Dell laptop hard drives (not SSDs) in free fall.
-        '';
-        type = bool;
-      };
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to protect HP/Dell laptop hard drives (not SSDs) in free fall.
+      '';
+    };
 
-      devices = mkOption {
-        default = [ "/dev/sda" ];
-        description = ''
-          Device paths to all internal spinning hard drives.
-        '';
-        type = listOf string;
-      };
+    package = mkOption {
+      type = types.package;
+      default = pkgs.freefall;
+      description = ''
+        freefall derivation to use.
+      '';
+    };
 
+    devices = mkOption {
+      type = types.listOf types.string;
+      default = [ "/dev/sda" ];
+      description = ''
+        Device paths to all internal spinning hard drives.
+      '';
     };
 
   };
 
-  ###### implementation
-
   config = let
 
-    cfg = config.services.freefall;
-
     mkService = dev:
       assert dev != "";
       let dev' = utils.escapeSystemdPath dev; in
@@ -43,12 +45,8 @@ with lib;
         description = "Free-fall protection for ${dev}";
         after = [ "${dev'}.device" ];
         wantedBy = [ "${dev'}.device" ];
-        path = [ pkgs.freefall ];
-        unitConfig = {
-          DefaultDependencies = false;
-        };
         serviceConfig = {
-          ExecStart = "${pkgs.freefall}/bin/freefall ${dev}";
+          ExecStart = "${cfg.package}/bin/freefall ${dev}";
           Restart = "on-failure";
           Type = "forking";
         };
@@ -56,9 +54,9 @@ with lib;
 
   in mkIf cfg.enable {
 
-    environment.systemPackages = [ pkgs.freefall ];
+    environment.systemPackages = [ cfg.package ];
 
-    systemd.services = listToAttrs (map mkService cfg.devices);
+    systemd.services = builtins.listToAttrs (map mkService cfg.devices);
 
   };
 

nixos/modules/services/hardware/sane.nix

@@ -36,7 +36,6 @@ in
 
     hardware.sane.configDir = mkOption {
       type = types.string;
-      default = "${saneConfig}/etc/sane.d";
       description = "The value of SANE_CONFIG_DIR.";
     };
 
@@ -47,6 +46,8 @@ in
 
   config = mkIf config.hardware.sane.enable {
 
+    hardware.sane.configDir = mkDefault "${saneConfig}/etc/sane.d";
+
     environment.systemPackages = backends;
     environment.sessionVariables = {
       SANE_CONFIG_DIR = config.hardware.sane.configDir;

nixos/modules/services/hardware/udev.nix

@@ -180,9 +180,7 @@ in
         firmware to function).  If multiple packages contain firmware
         files with the same name, the first package in the list takes
         precedence.  Note that you must rebuild your system if you add
-        files to any of these directories.  For quick testing,
-        put firmware files in <filename>/root/test-firmware</filename>
-        and add that directory to the list.
+        files to any of these directories.
       '';
       apply = list: pkgs.buildEnv {
         name = "firmware";

nixos/modules/services/logging/logstash.nix

@@ -84,10 +84,10 @@ in
         type = types.lines;
         default = ''stdin { type => "example" }'';
         description = "Logstash input configuration.";
-        example = ''
+        example = literalExample ''
           # Read from journal
           pipe {
-            command => "${pkgs.systemd}/bin/journalctl -f -o json"
+            command => "''${pkgs.systemd}/bin/journalctl -f -o json"
             type => "syslog" codec => json {}
           }
         '';
@@ -132,6 +132,7 @@ in
       description = "Logstash Daemon";
       wantedBy = [ "multi-user.target" ];
       environment = { JAVA_HOME = jre; };
+      path = [ pkgs.bash ];
       serviceConfig = {
         ExecStart =
           "${cfg.package}/bin/logstash agent " +

nixos/modules/services/mail/mlmmj.nix

@@ -14,7 +14,7 @@ let
   alias = domain: list: "${list}: \"|${pkgs.mlmmj}/bin/mlmmj-receive -L ${listDir domain list}/\"";
   subjectPrefix = list: "[${list}]";
   listAddress = domain: list: "${list}@${domain}";
-  customHeaders = list: domain: [ "List-Id: ${list}" "Reply-To: ${list}@${domain}" ];
+  customHeaders = domain: list: [ "List-Id: ${list}" "Reply-To: ${list}@${domain}" ];
   footer = domain: list: "To unsubscribe send a mail to ${list}+unsubscribe@${domain}";
   createList = d: l: ''
     ${pkgs.coreutils}/bin/mkdir -p ${listCtl d l}
@@ -90,14 +90,15 @@ in
       enable = true;
       recipientDelimiter= "+";
       extraMasterConf = ''
-        mlmmj unix - n n - - pipe flags=ORhu user=mlmmj argv=${pkgs.mlmmj}/bin/mlmmj-receive -F -L ${spoolDir}/$nextHop
+        mlmmj unix - n n - - pipe flags=ORhu user=mlmmj argv=${pkgs.mlmmj}/bin/mlmmj-receive -F -L ${spoolDir}/$nexthop
       '';
 
       extraAliases = concatMapStrings (alias cfg.listDomain) cfg.mailLists;
 
       extraConfig = ''
-        transport = hash:${stateDir}/transports
-        virtual = hash:${stateDir}/virtuals
+        transport_maps = hash:${stateDir}/transports
+        virtual_alias_maps = hash:${stateDir}/virtuals
+        propagate_unmatched_extensions = virtual
       '';
     };
 
@@ -108,9 +109,10 @@ in
           ${pkgs.coreutils}/bin/chown -R ${cfg.user}:${cfg.group} ${spoolDir}
           ${lib.concatMapStrings (createList cfg.listDomain) cfg.mailLists}
           echo ${lib.concatMapStrings (virtual cfg.listDomain) cfg.mailLists} > ${stateDir}/virtuals
-          echo ${cfg.listDomain} mailman: > ${stateDir}/transports
-          echo ${lib.concatMapStrings (transport cfg.listDomain) cfg.mailLists} >> ${stateDir}/transports
-    '';
+          echo ${lib.concatMapStrings (transport cfg.listDomain) cfg.mailLists} > ${stateDir}/transports
+          ${pkgs.postfix}/bin/postmap ${stateDir}/virtuals
+          ${pkgs.postfix}/bin/postmap ${stateDir}/transports
+      '';
 
     systemd.services."mlmmj-maintd" = {
       description = "mlmmj maintenance daemon";

nixos/modules/services/mail/opensmtpd.nix

@@ -46,6 +46,17 @@ in {
           is left empty, the OpenSMTPD server will not start.
         '';
       };
+
+      procPackages = mkOption {
+        type = types.listOf types.path;
+        default = [];
+        description = ''
+          Packages to search for filters, tables, queues, and schedulers.
+
+          Add OpenSMTPD-extras here if you want to use the filters, etc. from
+          that package.
+        '';
+      };
     };
 
   };
@@ -72,12 +83,19 @@ in {
       };
     };
 
-    systemd.services.opensmtpd = {
+    systemd.services.opensmtpd = let
+      procEnv = pkgs.buildEnv {
+        name = "opensmtpd-procs";
+        paths = [ opensmtpd ] ++ cfg.procPackages;
+        pathsToLink = [ "/libexec/opensmtpd" ];
+      };
+    in {
       wantedBy = [ "multi-user.target" ];
       wants = [ "network.target" ];
       after = [ "network.target" ];
       preStart = "mkdir -p /var/spool";
       serviceConfig.ExecStart = "${opensmtpd}/sbin/smtpd -d -f ${conf} ${args}";
+      environment.OPENSMTPD_PROC_PATH = "${procEnv}/libexec/opensmtpd";
     };
 
     environment.systemPackages = [ (pkgs.runCommand "opensmtpd-sendmail" {} ''

nixos/modules/services/mail/postfix.nix

@@ -77,7 +77,8 @@ let
       smtpd_tls_key_file = ${cfg.sslKey}
 
       smtpd_use_tls = yes
-
+    ''
+    + optionalString (cfg.recipientDelimiter != "") ''
       recipient_delimiter = ${cfg.recipientDelimiter}
     ''
     + optionalString (cfg.virtual != "") ''

nixos/modules/services/misc/confd.nix

@@ -63,7 +63,7 @@ in {
 
     package = mkOption {
       description = "Confd package to use.";
-      default = pkgs.goPackages.confd;
+      default = pkgs.confd;
       type = types.package;
     };
   };

nixos/modules/services/misc/gitit.nix

@@ -35,6 +35,7 @@ let
       };
 
       haskellPackages = mkOption {
+        default = pkgs.haskellPackages;
         defaultText = "pkgs.haskellPackages";
         example = literalExample "pkgs.haskell.packages.ghc784";
         description = "haskellPackages used to build gitit and plugins.";
@@ -99,7 +100,7 @@ let
       };
 
       authenticationMethod = mkOption {
-        type = types.enum [ "form" "http" "generic"];
+        type = types.enum [ "form" "http" "generic" "github" ];
         default = "form";
         description = ''
           'form' means that users will be logged in and registered using forms
@@ -137,6 +138,7 @@ let
 
       staticDir = mkOption {
         type = types.path;
+        default = gititShared + "/data/static";
         description = ''
           Specifies the path of the static directory (containing javascript,
           css, and images).  If it does not exist, gitit will create it and
@@ -207,6 +209,7 @@ let
 
       templatesDir = mkOption {
         type = types.path;
+        default = gititShared + "/data/templates";
         description = ''
           Specifies the path of the directory containing page templates.  If it
           does not exist, gitit will create it with default templates.  Users
@@ -288,6 +291,7 @@ let
 
       plugins = mkOption {
         type = with types; listOf str;
+        default = [ (gititShared + "/plugins/Dot.hs") ];
         description = ''
           Specifies a list of plugins to load. Plugins may be specified either
           by their path or by their module name. If the plugin name starts
@@ -537,6 +541,42 @@ video/x-ms-wmx  wmx
           through xss-sanitize.  Set to no only if you trust all of your users.
         '';
       };
+
+      oauthClientId = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = "OAuth client ID";
+      };
+
+      oauthClientSecret = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = "OAuth client secret";
+      };
+
+      oauthCallback = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = "OAuth callback URL";
+      };
+
+      oauthAuthorizeEndpoint = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = "OAuth authorize endpoint";
+      };
+
+      oauthAccessTokenEndpoint = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = "OAuth access token endpoint";
+      };
+
+      githubOrg = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = "Github organization";
+      };
   };
 
   configFile = pkgs.writeText "gitit.conf" ''
@@ -587,6 +627,14 @@ video/x-ms-wmx  wmx
     pdf-export: ${toYesNo cfg.pdfExport}
     pandoc-user-data: ${toString cfg.pandocUserData}
     xss-sanitize: ${toYesNo cfg.xssSanitize}
+
+    [Github]
+    oauthclientid: ${toString cfg.oauthClientId}
+    oauthclientsecret: ${toString cfg.oauthClientSecret}
+    oauthcallback: ${toString cfg.oauthCallback}
+    oauthauthorizeendpoint: ${toString cfg.oauthAuthorizeEndpoint}
+    oauthaccesstokenendpoint: ${toString cfg.oauthAccessTokenEndpoint}
+    github-org: ${toString cfg.githubOrg}
   '';
 
 in
@@ -597,13 +645,6 @@ in
 
   config = mkIf cfg.enable {
 
-    services.gitit = {
-      haskellPackages = mkDefault pkgs.haskellPackages;
-      staticDir = gititShared + "/data/static";
-      templatesDir = gititShared + "/data/templates";
-      plugins = [ ];
-    };
-
     users.extraUsers.gitit = {
       group = config.users.extraGroups.gitit.name;
       description = "Gitit user";
@@ -681,4 +722,3 @@ NAMED
     };
   };
 }
-

nixos/modules/services/misc/nix-gc.nix

@@ -52,7 +52,7 @@ in
 
     systemd.services.nix-gc =
       { description = "Nix Garbage Collector";
-        script = "exec ${config.nix.package}/bin/nix-store --gc ${cfg.options}";
+        script = "exec ${config.nix.package}/bin/nix-collect-garbage ${cfg.options}";
         startAt = optionalString cfg.automatic cfg.dates;
       };
 

nixos/modules/services/misc/nixos-manual.nix

@@ -80,7 +80,6 @@ in
 
     services.nixosManual.browser = mkOption {
       type = types.path;
-      default = "${pkgs.w3m}/bin/w3m";
       description = ''
         Browser used to show the manual.
       '';
@@ -93,7 +92,7 @@ in
 
     system.build.manual = manual;
 
-    environment.systemPackages = [ manual.manpages help ];
+    environment.systemPackages = [ manual.manpages manual.manual help ];
 
     boot.extraTTYs = mkIf cfg.showManual ["tty${cfg.ttyNumber}"];
 
@@ -116,6 +115,8 @@ in
     services.mingetty.helpLine = mkIf cfg.showManual
       "\nPress <Alt-F${toString cfg.ttyNumber}> for the NixOS manual.";
 
+    services.nixosManual.browser = mkDefault "${pkgs.w3m}/bin/w3m";
+
   };
 
 }

nixos/modules/services/misc/subsonic.nix

@@ -97,7 +97,6 @@ in
 
       transcoders = mkOption {
         type = types.listOf types.path;
-        default = [ "${pkgs.ffmpeg}/bin/ffmpeg" ];
         description = ''
           List of paths to transcoder executables that should be accessible
           from Subsonic. Symlinks will be created to each executable inside
@@ -153,5 +152,8 @@ in
     };
 
     users.extraGroups.subsonic.gid = config.ids.gids.subsonic;
+
+    services.subsonic.transcoders = mkDefault [ "${pkgs.ffmpeg}/bin/ffmpeg" ];
+
   };
 }

nixos/modules/services/misc/synergy.nix

@@ -89,6 +89,7 @@ in
         wantedBy = optional cfgC.autoStart "multi-user.target";
         path = [ pkgs.synergy ];
         serviceConfig.ExecStart = ''${pkgs.synergy}/bin/synergyc -f ${optionalString (cfgC.screenName != "") "-n ${cfgC.screenName}"} ${cfgC.serverAddress}'';
+        serviceConfig.Restart = "on-failure";
       };
     })
     (mkIf cfgS.enable {
@@ -98,6 +99,7 @@ in
         wantedBy = optional cfgS.autoStart "multi-user.target";
         path = [ pkgs.synergy ];
         serviceConfig.ExecStart = ''${pkgs.synergy}/bin/synergys -c ${cfgS.configFile} -f ${optionalString (cfgS.address != "") "-a ${cfgS.address}"} ${optionalString (cfgS.screenName != "") "-n ${cfgS.screenName}" }'';
+        serviceConfig.Restart = "on-failure";
       };
     })
   ];

nixos/modules/services/monitoring/bosun.nix

@@ -30,6 +30,7 @@ in {
 
       package = mkOption {
         type = types.package;
+        default = pkgs.bosun;
         example = literalExample "pkgs.bosun";
         description = ''
           bosun binary to use.
@@ -95,8 +96,6 @@ in {
 
   config = mkIf cfg.enable {
   
-    services.bosun.package = mkDefault pkgs.bosun; 
-
     systemd.services.bosun = {
       description = "bosun metrics collector (part of Bosun)";
       wantedBy = [ "multi-user.target" ];

nixos/modules/services/monitoring/grafana.nix

@@ -200,13 +200,12 @@ in {
 
     staticRootPath = mkOption {
       description = "Root path for static assets.";
-      default = "${cfg.package}/share/go/src/github.com/grafana/grafana/public";
       type = types.str;
     };
 
     package = mkOption {
       description = "Package to use.";
-      default = pkgs.goPackages.grafana;
+      default = pkgs.grafana;
       type = types.package;
     };
 
@@ -311,7 +310,7 @@ in {
 
   config = mkIf cfg.enable {
     warnings = [
-      "Grafana passwords will be stored as plaintext in nix store!"
+      "Grafana passwords will be stored as plaintext in the Nix store!"
     ];
 
     systemd.services.grafana = {
@@ -331,5 +330,8 @@ in {
       home = cfg.dataDir;
       createHome = true;
     };
+
+    services.grafana.staticRootPath = mkDefault "${cfg.package.out}/share/go/src/github.com/grafana/grafana/public";
+
   };
 }

nixos/modules/services/monitoring/smartd.nix

@@ -119,7 +119,7 @@ in
 
           recipient = mkOption {
             default = "root";
-            type = types.string;
+            type = types.str;
             description = "Recipient of the notification messages.";
           };
 
@@ -153,7 +153,7 @@ in
 
           display = mkOption {
             default = ":${toString config.services.xserver.display}";
-            type = types.string;
+            type = types.str;
             description = "DISPLAY to send X11 notifications to.";
           };
         };

nixos/modules/services/network-filesystems/nfsd.nix

@@ -88,10 +88,7 @@ in
 
     environment.systemPackages = [ pkgs.nfs-utils ];
 
-    environment.etc = singleton
-      { source = exports;
-        target = "exports";
-      };
+    environment.etc.exports.source = exports;
 
     boot.kernelModules = [ "nfsd" ];
 

nixos/modules/services/network-filesystems/samba.nix

@@ -97,8 +97,8 @@ in
         description = ''
           Enabling this will add a line directly after pam_unix.so.
           Whenever a password is changed the samba password will be updated as well.
-          However you still yave to add the samba password once using smbpasswd -a user
-          If you don't want to maintain an extra pwd database you still can send plain text
+          However, you still have to add the samba password once, using smbpasswd -a user.
+          If you don't want to maintain an extra password database, you still can send plain text
           passwords which is not secure.
         '';
       };

nixos/modules/services/network-filesystems/xtreemfs.nix

@@ -0,0 +1,469 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.xtreemfs;
+
+  xtreemfs = pkgs.xtreemfs;
+
+  home = cfg.homeDir;
+
+  startupScript = class: configPath: pkgs.writeScript "xtreemfs-osd.sh" ''
+    #! ${pkgs.stdenv.shell}
+    JAVA_HOME="${pkgs.jdk}"
+    JAVADIR="${xtreemfs}/share/java"
+    JAVA_CALL="$JAVA_HOME/bin/java -ea -cp $JAVADIR/XtreemFS.jar:$JAVADIR/BabuDB.jar:$JAVADIR/Flease.jar:$JAVADIR/protobuf-java-2.5.0.jar:$JAVADIR/Foundation.jar:$JAVADIR/jdmkrt.jar:$JAVADIR/jdmktk.jar:$JAVADIR/commons-codec-1.3.jar"
+    $JAVA_CALL ${class} ${configPath}
+  '';
+
+  dirReplicationConfig = pkgs.writeText "xtreemfs-dir-replication-plugin.properties" ''
+    babudb.repl.backupDir = ${home}/server-repl-dir
+    plugin.jar = ${xtreemfs}/share/java/BabuDB_replication_plugin.jar
+    babudb.repl.dependency.0 = ${xtreemfs}/share/java/Flease.jar
+
+    ${cfg.dir.replication.extraConfig}
+  '';
+
+  dirConfig = pkgs.writeText "xtreemfs-dir-config.properties" ''
+    uuid = ${cfg.dir.uuid}
+    listen.port = ${toString cfg.dir.port}
+    ${optionalString (cfg.dir.address != "") "listen.address = ${cfg.dir.address}"}
+    http_port = ${toString cfg.dir.httpPort}
+    babudb.baseDir = ${home}/dir/database
+    babudb.logDir = ${home}/dir/db-log
+    babudb.sync = ${if cfg.dir.replication.enable then "FDATASYNC" else cfg.dir.syncMode}
+
+    ${optionalString cfg.dir.replication.enable "babudb.plugin.0 = ${dirReplicationConfig}"}
+
+    ${cfg.dir.extraConfig}
+  '';
+
+  mrcReplicationConfig = pkgs.writeText "xtreemfs-mrc-replication-plugin.properties" ''
+    babudb.repl.backupDir = ${home}/server-repl-mrc
+    plugin.jar = ${xtreemfs}/share/java/BabuDB_replication_plugin.jar
+    babudb.repl.dependency.0 = ${xtreemfs}/share/java/Flease.jar
+
+    ${cfg.mrc.replication.extraConfig}
+  '';
+
+  mrcConfig = pkgs.writeText "xtreemfs-mrc-config.properties" ''
+    uuid = ${cfg.mrc.uuid}
+    listen.port = ${toString cfg.mrc.port}
+    ${optionalString (cfg.mrc.address != "") "listen.address = ${cfg.mrc.address}"}
+    http_port = ${toString cfg.mrc.httpPort}
+    babudb.baseDir = ${home}/mrc/database
+    babudb.logDir = ${home}/mrc/db-log
+    babudb.sync = ${if cfg.mrc.replication.enable then "FDATASYNC" else cfg.mrc.syncMode}
+
+    ${optionalString cfg.mrc.replication.enable "babudb.plugin.0 = ${mrcReplicationConfig}"}
+
+    ${cfg.mrc.extraConfig}
+  '';
+
+  osdConfig = pkgs.writeText "xtreemfs-osd-config.properties" ''
+    uuid = ${cfg.osd.uuid}
+    listen.port = ${toString cfg.osd.port}
+    ${optionalString (cfg.osd.address != "") "listen.address = ${cfg.osd.address}"}
+    http_port = ${toString cfg.osd.httpPort}
+    object_dir = ${home}/osd/
+
+    ${cfg.osd.extraConfig}
+  '';
+
+  optionalDir = optionals cfg.dir.enable ["xtreemfs-dir.service"];
+
+  systemdOptionalDependencies = {
+    after = [ "network.target" ] ++ optionalDir;
+    wantedBy = [ "multi-user.target" ] ++ optionalDir;
+  };
+
+in
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.xtreemfs = {
+
+      enable = mkEnableOption "XtreemFS";
+
+      homeDir = mkOption {
+        default = "/var/lib/xtreemfs";
+        description = ''
+          XtreemFS home dir for the xtreemfs user.
+        '';
+      };
+
+      dir = {
+        enable = mkOption {
+          default = true;
+          description = ''
+            Whether to enable XtreemFS DIR service.
+          '';
+        };
+        uuid = mkOption {
+          example = "eacb6bab-f444-4ebf-a06a-3f72d7465e40";
+          description = ''
+            Must be set to a unique identifier, preferably a UUID according to
+            RFC 4122. UUIDs can be generated with `uuidgen` command, found in
+            the `utillinux` package.
+          '';
+        };
+        port = mkOption {
+          default = 32638;
+          description = ''
+            The port to listen on for incoming connections (TCP).
+          '';
+        };
+        address = mkOption {
+          example = "127.0.0.1";
+          default = "";
+          description = ''
+            If specified, it defines the interface to listen on. If not
+            specified, the service will listen on all interfaces (any).
+          '';
+        };
+        httpPort = mkOption {
+          default = 30638;
+          description = ''
+            Specifies the listen port for the HTTP service that returns the
+            status page.
+          '';
+        };
+        syncMode = mkOption {
+          default = "FSYNC";
+          example = "FDATASYNC";
+          description = ''
+            The sync mode influences how operations are committed to the disk
+            log before the operation is acknowledged to the caller.
+
+            -ASYNC mode the writes to the disk log are buffered in memory by the operating system. This is the fastest mode but will lead to data loss in case of a crash, kernel panic or power failure.
+            -SYNC_WRITE_METADATA opens the file with O_SYNC, the system will not buffer any writes. The operation will be acknowledged when data has been safely written to disk. This mode is slow but offers maximum data safety. However, BabuDB cannot influence the disk drive caches, this depends on the OS and hard disk model.
+            -SYNC_WRITE similar to SYNC_WRITE_METADATA but opens file with O_DSYNC which means that only the data is commit to disk. This can lead to some data loss depending on the implementation of the underlying file system. Linux does not implement this mode.
+            -FDATASYNC is similar to SYNC_WRITE but opens the file in asynchronous mode and calls fdatasync() after writing the data to disk.
+            -FSYNC is similar to SYNC_WRITE_METADATA but opens the file in asynchronous mode and calls fsync() after writing the data to disk.
+
+            For best throughput use ASYNC, for maximum data safety use FSYNC.
+
+            (If xtreemfs.dir.replication.enable is true then FDATASYNC is forced)
+          '';
+        };
+        extraConfig = mkOption {
+          default = "";
+          example = ''
+            # specify whether SSL is required
+            ssl.enabled = true
+            ssl.service_creds.pw = passphrase
+            ssl.service_creds.container = pkcs12
+            ssl.service_creds = /etc/xos/xtreemfs/truststore/certs/dir.p12
+            ssl.trusted_certs = /etc/xos/xtreemfs/truststore/certs/trusted.jks
+            ssl.trusted_certs.pw = jks_passphrase
+            ssl.trusted_certs.container = jks
+          '';
+          description = ''
+            Configuration of XtreemFS DIR service.
+            WARNING: configuration is saved as plaintext inside nix store.
+            For more options: http://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
+          '';
+        };
+        replication = {
+          enable = mkEnableOption "XtreemFS DIR replication plugin";
+          extraConfig = mkOption {
+            example = ''
+              # participants of the replication including this replica
+              babudb.repl.participant.0 = 192.168.0.10
+              babudb.repl.participant.0.port = 35676
+              babudb.repl.participant.1 = 192.168.0.11
+              babudb.repl.participant.1.port = 35676
+              babudb.repl.participant.2 = 192.168.0.12
+              babudb.repl.participant.2.port = 35676
+
+              # number of servers that at least have to be up to date
+              # To have a fault-tolerant system, this value has to be set to the
+              # majority of nodes i.e., if you have three replicas, set this to 2
+              # Please note that a setup with two nodes provides no fault-tolerance.
+              babudb.repl.sync.n = 2
+
+              # specify whether SSL is required
+              babudb.ssl.enabled = true
+
+              babudb.ssl.protocol = tlsv12
+
+              # server credentials for SSL handshakes
+              babudb.ssl.service_creds = /etc/xos/xtreemfs/truststore/certs/osd.p12
+              babudb.ssl.service_creds.pw = passphrase
+              babudb.ssl.service_creds.container = pkcs12
+
+              # trusted certificates for SSL handshakes
+              babudb.ssl.trusted_certs = /etc/xos/xtreemfs/truststore/certs/trusted.jks
+              babudb.ssl.trusted_certs.pw = jks_passphrase
+              babudb.ssl.trusted_certs.container = jks
+
+              babudb.ssl.authenticationWithoutEncryption = false
+            '';
+            description = ''
+              Configuration of XtreemFS DIR replication plugin.
+              WARNING: configuration is saved as plaintext inside nix store.
+              For more options: http://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
+            '';
+          };
+        };
+      };
+
+      mrc = {
+        enable = mkOption {
+          default = true;
+          description = ''
+            Whether to enable XtreemFS MRC service.
+          '';
+        };
+        uuid = mkOption {
+          example = "eacb6bab-f444-4ebf-a06a-3f72d7465e41";
+          description = ''
+            Must be set to a unique identifier, preferably a UUID according to
+            RFC 4122. UUIDs can be generated with `uuidgen` command, found in
+            the `utillinux` package.
+          '';
+        };
+        port = mkOption {
+          default = 32636;
+          description = ''
+            The port to listen on for incoming connections (TCP).
+          '';
+        };
+        address = mkOption {
+          example = "127.0.0.1";
+          default = "";
+          description = ''
+            If specified, it defines the interface to listen on. If not
+            specified, the service will listen on all interfaces (any).
+          '';
+        };
+        httpPort = mkOption {
+          default = 30636;
+          description = ''
+            Specifies the listen port for the HTTP service that returns the
+            status page.
+          '';
+        };
+        syncMode = mkOption {
+          default = "FSYNC";
+          example = "FDATASYNC";
+          description = ''
+            The sync mode influences how operations are committed to the disk
+            log before the operation is acknowledged to the caller.
+
+            -ASYNC mode the writes to the disk log are buffered in memory by the operating system. This is the fastest mode but will lead to data loss in case of a crash, kernel panic or power failure.
+            -SYNC_WRITE_METADATA opens the file with O_SYNC, the system will not buffer any writes. The operation will be acknowledged when data has been safely written to disk. This mode is slow but offers maximum data safety. However, BabuDB cannot influence the disk drive caches, this depends on the OS and hard disk model.
+            -SYNC_WRITE similar to SYNC_WRITE_METADATA but opens file with O_DSYNC which means that only the data is commit to disk. This can lead to some data loss depending on the implementation of the underlying file system. Linux does not implement this mode.
+            -FDATASYNC is similar to SYNC_WRITE but opens the file in asynchronous mode and calls fdatasync() after writing the data to disk.
+            -FSYNC is similar to SYNC_WRITE_METADATA but opens the file in asynchronous mode and calls fsync() after writing the data to disk.
+
+            For best throughput use ASYNC, for maximum data safety use FSYNC.
+
+            (If xtreemfs.mrc.replication.enable is true then FDATASYNC is forced)
+          '';
+        };
+        extraConfig = mkOption {
+          example = ''
+            osd_check_interval = 300
+            no_atime = true
+            local_clock_renewal = 0
+            remote_time_sync = 30000
+            authentication_provider = org.xtreemfs.common.auth.NullAuthProvider
+
+            # shared secret between the MRC and all OSDs
+            capability_secret = iNG8UuQJrJ6XVDTe
+
+            dir_service.host = 192.168.0.10
+            dir_service.port = 32638
+
+            # if replication is enabled
+            dir_service.1.host = 192.168.0.11
+            dir_service.1.port = 32638
+            dir_service.2.host = 192.168.0.12
+            dir_service.2.port = 32638
+
+            # specify whether SSL is required
+            ssl.enabled = true
+            ssl.protocol = tlsv12
+            ssl.service_creds.pw = passphrase
+            ssl.service_creds.container = pkcs12
+            ssl.service_creds = /etc/xos/xtreemfs/truststore/certs/mrc.p12
+            ssl.trusted_certs = /etc/xos/xtreemfs/truststore/certs/trusted.jks
+            ssl.trusted_certs.pw = jks_passphrase
+            ssl.trusted_certs.container = jks
+          '';
+          description = ''
+            Configuration of XtreemFS MRC service.
+            WARNING: configuration is saved as plaintext inside nix store.
+            For more options: http://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
+          '';
+        };
+        replication = {
+          enable = mkEnableOption "XtreemFS MRC replication plugin";
+          extraConfig = mkOption {
+            example = ''
+              # participants of the replication including this replica
+              babudb.repl.participant.0 = 192.168.0.10
+              babudb.repl.participant.0.port = 35678
+              babudb.repl.participant.1 = 192.168.0.11
+              babudb.repl.participant.1.port = 35678
+              babudb.repl.participant.2 = 192.168.0.12
+              babudb.repl.participant.2.port = 35678
+
+              # number of servers that at least have to be up to date
+              # To have a fault-tolerant system, this value has to be set to the
+              # majority of nodes i.e., if you have three replicas, set this to 2
+              # Please note that a setup with two nodes provides no fault-tolerance.
+              babudb.repl.sync.n = 2
+
+              # specify whether SSL is required
+              babudb.ssl.enabled = true
+
+              babudb.ssl.protocol = tlsv12
+
+              # server credentials for SSL handshakes
+              babudb.ssl.service_creds = /etc/xos/xtreemfs/truststore/certs/osd.p12
+              babudb.ssl.service_creds.pw = passphrase
+              babudb.ssl.service_creds.container = pkcs12
+
+              # trusted certificates for SSL handshakes
+              babudb.ssl.trusted_certs = /etc/xos/xtreemfs/truststore/certs/trusted.jks
+              babudb.ssl.trusted_certs.pw = jks_passphrase
+              babudb.ssl.trusted_certs.container = jks
+
+              babudb.ssl.authenticationWithoutEncryption = false
+            '';
+            description = ''
+              Configuration of XtreemFS MRC replication plugin.
+              WARNING: configuration is saved as plaintext inside nix store.
+              For more options: http://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
+            '';
+          };
+        };
+      };
+
+      osd = {
+        enable = mkOption {
+          default = true;
+          description = ''
+            Whether to enable XtreemFS OSD service.
+          '';
+        };
+        uuid = mkOption {
+          example = "eacb6bab-f444-4ebf-a06a-3f72d7465e42";
+          description = ''
+            Must be set to a unique identifier, preferably a UUID according to
+            RFC 4122. UUIDs can be generated with `uuidgen` command, found in
+            the `utillinux` package.
+          '';
+        };
+        port = mkOption {
+          default = 32640;
+          description = ''
+            The port to listen on for incoming connections (TCP and UDP).
+          '';
+        };
+        address = mkOption {
+          example = "127.0.0.1";
+          default = "";
+          description = ''
+            If specified, it defines the interface to listen on. If not
+            specified, the service will listen on all interfaces (any).
+          '';
+        };
+        httpPort = mkOption {
+          default = 30640;
+          description = ''
+            Specifies the listen port for the HTTP service that returns the
+            status page.
+          '';
+        };
+        extraConfig = mkOption {
+          example = ''
+            local_clock_renewal = 0
+            remote_time_sync = 30000
+            report_free_space = true
+            capability_secret = iNG8UuQJrJ6XVDTe
+
+            dir_service.host = 192.168.0.10
+            dir_service.port = 32638
+
+            # if replication is used
+            dir_service.1.host = 192.168.0.11
+            dir_service.1.port = 32638
+            dir_service.2.host = 192.168.0.12
+            dir_service.2.port = 32638
+
+            # specify whether SSL is required
+            ssl.enabled = true
+            ssl.service_creds.pw = passphrase
+            ssl.service_creds.container = pkcs12
+            ssl.service_creds = /etc/xos/xtreemfs/truststore/certs/osd.p12
+            ssl.trusted_certs = /etc/xos/xtreemfs/truststore/certs/trusted.jks
+            ssl.trusted_certs.pw = jks_passphrase
+            ssl.trusted_certs.container = jks
+          '';
+          description = ''
+            Configuration of XtreemFS OSD service.
+            WARNING: configuration is saved as plaintext inside nix store.
+            For more options: http://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
+          '';
+        };
+      };
+    };
+
+  };
+
+
+  ###### implementation
+
+  config = lib.mkIf cfg.enable {
+
+    environment.systemPackages = [ xtreemfs ];
+
+    users.extraUsers.xtreemfs =
+      { uid = config.ids.uids.xtreemfs;
+        description = "XtreemFS user";
+        createHome = true;
+        home = home;
+      };
+
+    users.extraGroups.xtreemfs =
+      { gid = config.ids.gids.xtreemfs;
+      };
+
+    systemd.services.xtreemfs-dir = mkIf cfg.dir.enable {
+      description = "XtreemFS-DIR Server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        User = "xtreemfs";
+        ExecStart = "${startupScript "org.xtreemfs.dir.DIR" dirConfig}";
+      };
+    };
+
+    systemd.services.xtreemfs-mrc = mkIf cfg.mrc.enable ({
+      description = "XtreemFS-MRC Server";
+      serviceConfig = {
+        User = "xtreemfs";
+        ExecStart = "${startupScript "org.xtreemfs.mrc.MRC" mrcConfig}";
+      };
+    } // systemdOptionalDependencies);
+
+    systemd.services.xtreemfs-osd = mkIf cfg.osd.enable ({
+      description = "XtreemFS-OSD Server";
+      serviceConfig = {
+        User = "xtreemfs";
+        ExecStart = "${startupScript "org.xtreemfs.osd.OSD" osdConfig}";
+      };
+    } // systemdOptionalDependencies);
+
+  };
+
+}

nixos/modules/services/networking/asterisk.nix

@@ -201,6 +201,7 @@ in
         for d in '${varlibdir}' '${spooldir}' '${logdir}'; do
           # TODO: Make exceptions for /var directories that likely should be updated
           if [ ! -e "$d" ]; then
+            mkdir -p "$d"
             cp --recursive ${pkgs.asterisk}/"$d" "$d"
             chown --recursive ${asteriskUser} "$d"
             find "$d" -type d | xargs chmod 0755

nixos/modules/services/networking/bind.nix

@@ -24,6 +24,8 @@ let
         pid-file "/var/run/named/named.pid";
       };
 
+      ${cfg.extraConfig}
+
       ${ concatMapStrings
           ({ name, file, master ? true, slaves ? [], masters ? [] }:
             ''
@@ -110,6 +112,13 @@ in
         }];
       };
 
+      extraConfig = mkOption {
+        default = "";
+        description = "
+          Extra lines to be added verbatim to the generated named configuration file.
+        ";
+      };
+
       configFile = mkOption {
         default = confFile;
         description = "

nixos/modules/services/networking/bitlbee.nix

@@ -16,11 +16,12 @@ let
     ''
     [settings]
     RunMode = Daemon
-    User = bitlbee  
+    User = bitlbee
     ConfigDir = ${cfg.configDir}
     DaemonInterface = ${cfg.interface}
     DaemonPort = ${toString cfg.portNumber}
     AuthMode = ${cfg.authMode}
+    Plugindir = ${pkgs.bitlbee-plugins cfg.plugins}/lib/bitlbee
     ${lib.optionalString (cfg.hostName != "") "HostName = ${cfg.hostName}"}
     ${lib.optionalString (cfg.protocols != "") "Protocols = ${cfg.protocols}"}
     ${cfg.extraSettings}
@@ -72,7 +73,7 @@ in
             Open -- Accept connections from anyone, use NickServ for user authentication.
             Closed -- Require authorization (using the PASS command during login) before allowing the user to connect at all.
             Registered -- Only allow registered users to use this server; this disables the register- and the account command until the user identifies himself.
-        ''; 
+        '';
       };
 
       hostName = mkOption {
@@ -85,6 +86,15 @@ in
         '';
       };
 
+      plugins = mkOption {
+        type = types.listOf types.package;
+        default = [];
+        example = literalExample "[ pkgs.bitlbee-facebook ]";
+        description = ''
+          The list of bitlbee plugins to install.
+        '';
+      };
+
       configDir = mkOption {
         default = "/var/lib/bitlbee";
         type = types.path;
@@ -107,14 +117,14 @@ in
         default = "";
         description = ''
           Will be inserted in the Settings section of the config file.
-        ''; 
+        '';
       };
 
       extraDefaults = mkOption {
         default = "";
         description = ''
           Will be inserted in the Default section of the config file.
-        ''; 
+        '';
       };
 
     };
@@ -138,7 +148,7 @@ in
         gid = config.ids.gids.bitlbee;
       };
 
-    systemd.services.bitlbee = 
+    systemd.services.bitlbee =
       { description = "BitlBee IRC to other chat networks gateway";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];

nixos/modules/services/networking/connman.nix

@@ -5,7 +5,12 @@ with lib;
 
 let
   cfg = config.networking.connman;
+  configFile = pkgs.writeText "connman.conf" ''
+    [General]
+    NetworkInterfaceBlacklist=${concatStringsSep "," cfg.networkInterfaceBlacklist}
 
+    ${cfg.extraConfig}
+  '';
 in {
 
   ###### interface
@@ -22,6 +27,23 @@ in {
         '';
       };
 
+      extraConfig = mkOption {
+        type = types.lines;
+        default = ''
+        '';
+        description = ''
+          Configuration lines appended to the generated connman configuration file.
+        '';
+      };
+
+      networkInterfaceBlacklist = mkOption {
+        type = with types; listOf string;
+        default = [ "vmnet" "vboxnet" "virbr" "ifb" "ve" ];
+        description = ''
+          Default blacklisted interfaces, this includes NixOS containers interfaces (ve).
+        '';
+      };
+
     };
 
   };
@@ -51,7 +73,7 @@ in {
         Type = "dbus";
         BusName = "net.connman";
         Restart = "on-failure";
-        ExecStart = "${pkgs.connman}/sbin/connmand --nodaemon";
+        ExecStart = "${pkgs.connman}/sbin/connmand --config=${configFile} --nodaemon";
         StandardOutput = "null";
       };
     };

nixos/modules/services/networking/copy-com.nix

@@ -39,7 +39,8 @@ in
 
     systemd.services."copy-com-${cfg.user}" = {
       description = "Copy.com client";
-      after = [ "network.target" "local-fs.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" "local-fs.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         ExecStart = "${pkgs.copy-com}/bin/CopyConsole ${if cfg.debug then "-consoleOutput -debugToConsole=dirwatch,path-watch,csm_path,csm -debug -console" else ""}";

nixos/modules/services/networking/dhcpcd.nix

@@ -18,6 +18,7 @@ let
     map (i: i.name) (filter (i: if i.useDHCP != null then !i.useDHCP else i.ip4 != [ ] || i.ipAddress != null) interfaces)
     ++ mapAttrsToList (i: _: i) config.networking.sits
     ++ concatLists (attrValues (mapAttrs (n: v: v.interfaces) config.networking.bridges))
+    ++ concatLists (attrValues (mapAttrs (n: v: v.interfaces) config.networking.vswitches))
     ++ concatLists (attrValues (mapAttrs (n: v: v.interfaces) config.networking.bonds))
     ++ config.networking.dhcpcd.denyInterfaces;