pkgs/kde: mkDerivation rec {} -> mkDerivation (finalAttrs: {})

.github/workflows/backport.yml

@@ -14,7 +14,7 @@ permissions: {}
 jobs:
   backport:
     name: Backport Pull Request
-    if: vars.NIXPKGS_CI_APP_ID && github.event.pull_request.merged == true && (github.event.action != 'labeled' || startsWith(github.event.label.name, 'backport'))
+    if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event.action != 'labeled' || startsWith(github.event.label.name, 'backport'))
     runs-on: ubuntu-24.04-arm
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered

.github/workflows/check-cherry-picks.yml

@@ -1,9 +1,6 @@
 name: "Check cherry-picks"
 
 on:
-  pull_request:
-    paths:
-      - .github/workflows/check-cherry-picks.yml
   pull_request_target:
     branches:
       - 'release-**'
@@ -16,6 +13,7 @@ jobs:
   check:
     name: cherry-pick-check
     runs-on: ubuntu-24.04-arm
+    if: github.repository_owner == 'NixOS'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:

.github/workflows/check-format.yml

@@ -1,10 +1,8 @@
 name: Check that files are formatted
 
 on:
-  pull_request:
-    paths:
-      - .github/workflows/check-format.yml
   pull_request_target:
+    types: [opened, synchronize, reopened, edited]
 
 permissions: {}
 

.github/workflows/check-shell.yml

@@ -1,9 +1,6 @@
 name: "Check shell"
 
 on:
-  pull_request:
-    paths:
-      - .github/workflows/check-shell.yml
   pull_request_target:
     paths:
       - 'shell.nix'

.github/workflows/codeowners-v2.yml

@@ -23,11 +23,8 @@
 name: Codeowners v2
 
 on:
-  pull_request:
-    paths:
-      - .github/workflows/codeowners-v2.yml
   pull_request_target:
-    types: [opened, ready_for_review, synchronize, reopened]
+    types: [opened, ready_for_review, synchronize, reopened, edited]
 
 permissions: {}
 
@@ -67,7 +64,6 @@ jobs:
         run: nix-build base/ci -A codeownersValidator
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_RO_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_RO_APP_ID }}
@@ -81,7 +77,6 @@ jobs:
           path: pr
 
       - name: Validate codeowners
-        if: steps.app-token.outputs.token
         run: result/bin/codeowners-validator
         env:
           OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
@@ -104,7 +99,6 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
@@ -117,7 +111,6 @@ jobs:
         run: nix-build ci -A requestReviews
 
       - name: Request reviews
-        if: steps.app-token.outputs.token
         run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/edited.yml

@@ -1,49 +0,0 @@
-# Some workflows depend on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
-# Instead it causes an `edited` event.
-# Since `edited` is also triggered when PR title/body is changed, we use this wrapper workflow, to run the other workflows conditionally only.
-# There are already feature requests for adding a `base_changed` event:
-# - https://github.com/orgs/community/discussions/35058
-# - https://github.com/orgs/community/discussions/64119
-#
-# Instead of adding this to each workflow's pull_request_target event, we trigger this in a separate workflow.
-# This has the advantage, that we can actually skip running those jobs for simple edits like changing the title or description.
-# The actual trigger happens by closing and re-opening the pull request, which triggers the default pull_request_target events.
-# This is much simpler and reliable than other approaches.
-
-name: "Edited base branch"
-
-on:
-  pull_request_target:
-    types: [edited]
-
-permissions: {}
-
-jobs:
-  base:
-    name: Trigger jobs
-    runs-on: ubuntu-24.04
-    if: github.event.changes.base.ref.from && github.event.changes.base.ref.from != github.event.pull_request.base.ref
-    steps:
-      # Use a GitHub App to create the PR so that CI gets triggered
-      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      # We only need Pull Requests: write here, but the app is also used for backports.
-      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        id: app-token
-        with:
-          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-          permission-pull-requests: write
-
-      - env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          REPOSITORY: ${{ github.repository }}
-          NUMBER: ${{ github.event.number }}
-        run: |
-          gh api \
-            --method PATCH \
-            /repos/"$REPOSITORY"/pulls/"$NUMBER" \
-            -f "state=closed"
-          gh api \
-            --method PATCH \
-            /repos/"$REPOSITORY"/pulls/"$NUMBER" \
-            -f "state=open"

.github/workflows/eval-aliases.yml

@@ -1,9 +1,6 @@
 name: Eval aliases
 
 on:
-  pull_request:
-    paths:
-      - .github/workflows/eval-aliases.yml
   pull_request_target:
 
 permissions: {}
@@ -29,7 +26,7 @@ jobs:
           extra_nix_config: sandbox = true
 
       - name: Ensure flake outputs on all systems still evaluate
-        run: nix flake check --all-systems --no-build ./nixpkgs
+        run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build ./nixpkgs
 
       - name: Query nixpkgs with aliases enabled to check for basic syntax errors
         run: |

.github/workflows/eval.yml

@@ -1,9 +1,6 @@
 name: Eval
 
 on:
-  pull_request:
-    paths:
-      - .github/workflows/eval.yml
   pull_request_target:
     types: [opened, ready_for_review, synchronize, reopened]
   push:
@@ -154,12 +151,9 @@ jobs:
             --arg beforeResultDir ./targetResult \
             --arg afterResultDir "$(realpath prResult)" \
             --arg touchedFilesJson ./touched-files.json \
-            --argstr githubAuthorId "$AUTHOR_ID" \
             -o comparison
 
           cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"
-        env:
-          AUTHOR_ID: ${{ github.event.pull_request.user.id }}
 
       - name: Upload the combined results
         if: steps.targetRunId.outputs.targetRunId
@@ -172,7 +166,7 @@ jobs:
   tag:
     name: Tag
     runs-on: ubuntu-24.04-arm
-    needs: [ get-merge-commit, process ]
+    needs: [ process ]
     if: needs.process.outputs.targetRunId
     permissions:
       pull-requests: write
@@ -181,7 +175,6 @@ jobs:
       # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
       # Can't use the token received from permissions above, because it can't get enough permissions
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
@@ -212,12 +205,11 @@ jobs:
         run: nix-build base/ci -A requestReviews
 
       - name: Labelling pull request
-        if: ${{ github.event_name == 'pull_request_target' && github.repository_owner == 'NixOS' }}
         run: |
-          # Get all currently set labels that we manage
+          # Get all currently set rebuild labels
           gh api \
             /repos/"$REPOSITORY"/issues/"$NUMBER"/labels \
-            --jq '.[].name | select(startswith("10.rebuild") or . == "11.by: package-maintainer")' \
+            --jq '.[].name | select(startswith("10.rebuild"))' \
             | sort > before
 
           # And the labels that should be there
@@ -247,7 +239,7 @@ jobs:
           NUMBER: ${{ github.event.number }}
 
       - name: Add eval summary to commit statuses
-        if: ${{ github.event_name == 'pull_request_target' && github.repository_owner == 'NixOS' }}
+        if: ${{ github.event_name == 'pull_request_target' }}
         run: |
           description=$(jq -r '
           "Package: added " + (.attrdiff.added | length | tostring) +
@@ -267,7 +259,6 @@ jobs:
           NUMBER: ${{ github.event.number }}
 
       - name: Requesting maintainer reviews
-        if: ${{ steps.app-token.outputs.token && github.repository_owner == 'NixOS' }}
         run: |
           # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
           # There appears to be no API to request reviews based on GitHub IDs

.github/workflows/get-merge-commit.yml

@@ -1,9 +1,6 @@
 name: Get merge commit
 
 on:
-  pull_request:
-    paths:
-      - .github/workflows/get-merge-commit.yml
   workflow_call:
     outputs:
       mergedSha:
@@ -41,9 +38,9 @@ jobs:
             push)
               echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
               ;;
-            pull_request*)
+            pull_request_target)
               if commits=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
-                echo -e "Checking the commits:\n$commits"
+                echo "Checking the commits:\n$commits"
                 echo "$commits" >> "$GITHUB_OUTPUT"
               else
                 # Skipping so that no notifications are sent

.github/workflows/labels.yml

@@ -7,6 +7,7 @@ name: "Label PR"
 
 on:
   pull_request_target:
+    types: [edited, opened, synchronize, reopened]
 
 permissions:
   contents: read

.github/workflows/lib-tests.yml

@@ -1,9 +1,6 @@
 name: "Building Nixpkgs lib-tests"
 
 on:
-  pull_request:
-    paths:
-      - .github/workflows/lib-tests.yml
   pull_request_target:
     paths:
       - 'lib/**'

.github/workflows/manual-nixos-v2.yml

@@ -1,9 +1,6 @@
 name: "Build NixOS manual v2"
 
 on:
-  pull_request:
-    paths:
-      - .github/workflows/manual-nixos-v2.yml
   pull_request_target:
     branches:
       - master
@@ -41,6 +38,7 @@ jobs:
           extra_nix_config: sandbox = true
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        if: github.repository_owner == 'NixOS'
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci

.github/workflows/manual-nixpkgs-v2.yml

@@ -1,9 +1,6 @@
 name: "Build Nixpkgs manual v2"
 
 on:
-  pull_request:
-    paths:
-      - .github/workflows/manual-nixpkgs-v2.yml
   pull_request_target:
     branches:
       - master
@@ -28,6 +25,7 @@ jobs:
           extra_nix_config: sandbox = true
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        if: github.repository_owner == 'NixOS'
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci

.github/workflows/nix-parse-v2.yml

@@ -1,9 +1,6 @@
 name: "Check whether nix files are parseable v2"
 
 on:
-  pull_request:
-    paths:
-      - .github/workflows/nix-parse-v2.yml
   pull_request_target:
 
 permissions: {}

.github/workflows/nixpkgs-vet.yml

@@ -6,10 +6,12 @@
 name: Vet nixpkgs
 
 on:
-  pull_request:
-    paths:
-      - .github/workflows/nixpkgs-vet.yml
   pull_request_target:
+    # This workflow depends on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
+    # Instead it causes an `edited` event, so we need to add it explicitly here.
+    # While `edited` is also triggered when the PR title/body is changed, this PR action is fairly quick, and PRs don't get edited **that** often, so it shouldn't be a problem.
+    # There is a feature request for adding a `base_changed` event: https://github.com/orgs/community/discussions/35058
+    types: [opened, synchronize, reopened, edited]
 
 permissions: {}
 

.github/workflows/no-channel.yml

@@ -1,10 +1,9 @@
 name: "No channel PR"
 
 on:
-  pull_request:
-    paths:
-      - .github/workflows/no-channel.yml
   pull_request_target:
+    # Re-run should be triggered when the base branch is updated, instead of silently failing
+    types: [opened, synchronize, reopened, edited]
 
 permissions: {}
 

.github/workflows/periodic-merge-24h.yml

@@ -31,16 +31,10 @@ jobs:
             into: staging-next-24.11
           - from: staging-next-24.11
             into: staging-24.11
-          - from: master
-            into: staging-next-25.05
-          - from: staging-next-25.05
-            into: staging-25.05
-          - name: merge-base(master,staging) → haskell-updates
-            from: master staging
+          - from: master staging
             into: haskell-updates
     uses: ./.github/workflows/periodic-merge.yml
     with:
       from: ${{ matrix.pairs.from }}
       into: ${{ matrix.pairs.into }}
-    name: ${{ matrix.pairs.name || format('{0} → {1}', matrix.pairs.from, matrix.pairs.into) }}
     secrets: inherit

.github/workflows/periodic-merge-6h.yml

@@ -35,5 +35,4 @@ jobs:
     with:
       from: ${{ matrix.pairs.from }}
       into: ${{ matrix.pairs.into }}
-    name: ${{ format('{0} → {1}', matrix.pairs.from, matrix.pairs.into) }}
     secrets: inherit

.github/workflows/periodic-merge.yml

@@ -15,6 +15,7 @@ on:
 jobs:
   merge:
     runs-on: ubuntu-24.04-arm
+    name: ${{ inputs.from }} → ${{ inputs.into }}
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs

ci/OWNERS

@@ -171,11 +171,6 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 /pkgs/top-level/python-packages.nix                     @natsukium
 /pkgs/top-level/release-python.nix                      @natsukium
 
-# CUDA
-/pkgs/top-level/cuda-packages.nix             @NixOS/cuda-maintainers
-/pkgs/top-level/release-cuda.nix              @NixOS/cuda-maintainers
-/pkgs/development/cuda-modules                @NixOS/cuda-maintainers
-
 # Haskell
 /doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @wolfgangwalther
 /maintainers/scripts/haskell                  @sternenseemann @maralorn @wolfgangwalther
@@ -309,8 +304,8 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/build-support/dlang @jtbx @TomaSajt
 
 # Dhall
-/pkgs/development/dhall-modules      @Gabriella439 @Profpatsch
-/pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch
+/pkgs/development/dhall-modules      @Gabriella439 @Profpatsch @ehmry
+/pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch @ehmry
 
 # Idris
 /pkgs/development/idris-modules @Infinisil
@@ -384,6 +379,12 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 # Xfce
 /doc/hooks/xfce4-dev-tools.section.md @NixOS/xfce
 
+# nim
+/doc/languages-frameworks/nim.section.md  @ehmry
+/pkgs/build-support/build-nim-package.nix @ehmry
+/pkgs/build-support/build-nim-sbom.nix    @ehmry
+/pkgs/top-level/nim-overrides.nix         @ehmry
+
 # terraform providers
 /pkgs/applications/networking/cluster/terraform-providers @zowoq
 
@@ -471,7 +472,7 @@ pkgs/development/interpreters/lfe/      @NixOS/beam
 pkgs/by-name/oc/octodns/ @anthonyroussel
 
 # Teleport
-pkgs/by-name/te/teleport*   @arianvp @justinas @sigma @tomberek @freezeboy @techknowlogick @JuliusFreudenberger
+pkgs/servers/teleport   @arianvp @justinas @sigma @tomberek @freezeboy @techknowlogick @JuliusFreudenberger
 
 # Warp-terminal
 pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @donteatoreo @johnrtitor

ci/default.nix

@@ -63,7 +63,10 @@ let
       fs = pkgs.lib.fileset;
       nixFilesSrc = fs.toSource {
         root = ../.;
-        fileset = fs.difference ../. (fs.maybeMissing ../.git);
+        fileset = fs.difference (fs.unions [
+          (fs.fileFilter (file: file.hasExt "nix") ../.)
+          ../.git-blame-ignore-revs
+        ]) (fs.maybeMissing ../.git);
       };
     in
     {

ci/eval/compare/default.nix

@@ -10,7 +10,6 @@
   beforeResultDir,
   afterResultDir,
   touchedFilesJson,
-  githubAuthorId,
   byName ? false,
 }:
 let
@@ -115,15 +114,7 @@ let
           # Adds "10.rebuild-*-stdenv" label if the "stdenv" attribute was changed
           ++ lib.mapAttrsToList (kernel: _: "10.rebuild-${kernel}-stdenv") (
             lib.filterAttrs (_: kernelRebuilds: kernelRebuilds ? "stdenv") rebuildsByKernel
-          )
-          # Adds the "11.by: package-maintainer" label if all of the packages directly
-          # changed are maintained by the PR's author. (https://github.com/NixOS/ofborg/blob/df400f44502d4a4a80fa283d33f2e55a4e43ee90/ofborg/src/tagger.rs#L83-L88)
-          ++ lib.optional (
-            maintainers ? ${githubAuthorId}
-            && lib.all (lib.flip lib.elem maintainers.${githubAuthorId}) (
-              lib.flatten (lib.attrValues maintainers)
-            )
-          ) "11.by: package-maintainer";
+          );
       }
     );
 

ci/eval/default.nix

@@ -8,6 +8,7 @@
   procps,
   nixVersions,
   jq,
+  sta,
   python3,
 }:
 
@@ -30,14 +31,11 @@ let
       );
     };
 
-  nix = nixVersions.latest;
+  nix = nixVersions.nix_2_24;
 
   supportedSystems = builtins.fromJSON (builtins.readFile ../supportedSystems.json);
 
   attrpathsSuperset =
-    {
-      evalSystem,
-    }:
     runCommand "attrpaths-superset.json"
       {
         src = nixpkgs;
@@ -57,7 +55,6 @@ let
             -I "$src" \
             --option restrict-eval true \
             --option allow-import-from-derivation false \
-            --option eval-system "${evalSystem}" \
             --arg enableWarnings false > $out/paths.json
       '';
 
@@ -68,7 +65,7 @@ let
       # because `--argstr system` would only be passed to the ci/default.nix file!
       evalSystem,
       # The path to the `paths.json` file from `attrpathsSuperset`
-      attrpathFile ? "${attrpathsSuperset { inherit evalSystem; }}/paths.json",
+      attrpathFile ? "${attrpathsSuperset}/paths.json",
       # The number of attributes per chunk, see ./README.md for more info.
       chunkSize,
       checkMeta ? true,
@@ -187,7 +184,10 @@ let
           rm "$chunkOutputDir"/stats/"$seq_end"
         fi
 
+        # Make sure the glob doesn't break when there's no files
+        shopt -s nullglob
         cat "$chunkOutputDir"/result/* > $out/paths
+        cat "$chunkOutputDir"/stats/* > $out/stats.jsonstream
       '';
 
   combine =
@@ -198,6 +198,7 @@ let
       {
         nativeBuildInputs = [
           jq
+          sta
         ];
       }
       ''
@@ -220,6 +221,39 @@ let
             ) | from_entries
           ' > $out/outpaths.json
 
+        # Computes min, mean, error, etc. for a list of values and outputs a JSON from that
+        statistics() {
+          local stat=$1
+          sta --transpose |
+            jq --raw-input --argjson stat "$stat" -n '
+              [
+                inputs |
+                  split("\t") |
+                  { key: .[0], value: (.[1] | fromjson) }
+              ] |
+                from_entries |
+                {
+                  key: ($stat | join(".")),
+                  value: .
+                }'
+        }
+
+        # Gets all available number stats (without .sizes because those are constant and not interesting)
+        readarray -t stats < <(jq -cs '.[0] | del(.sizes) | paths(type == "number")' ${resultsDir}/*/stats.jsonstream)
+
+        # Combines the statistics from all evaluations
+        {
+          echo "{ \"key\": \"minAvailMemory\", \"value\": $(cat ${resultsDir}/*/min-avail-memory | sta --brief --min) }"
+          echo "{ \"key\": \"minFreeSwap\", \"value\": $(cat ${resultsDir}/*/min-free-swap | sta --brief --min) }"
+          cat ${resultsDir}/*/total-time | statistics '["totalTime"]'
+          for stat in "''${stats[@]}"; do
+            cat ${resultsDir}/*/stats.jsonstream |
+              jq --argjson stat "$stat" 'getpath($stat)' |
+              statistics "$stat"
+          done
+        } |
+          jq -s from_entries > $out/stats.json
+
         mkdir -p $out/stats
 
         for d in ${resultsDir}/*; do

ci/pinned-nixpkgs.json

@@ -1,4 +1,4 @@
 {
-  "rev": "eaeed9530c76ce5f1d2d8232e08bec5e26f18ec1",
-  "sha256": "132nimgi1g88fbhddk4b8b1qk68jly494x2mnphyk3xa1d2wy9q7"
+  "rev": "573c650e8a14b2faa0041645ab18aed7e60f0c9a",
+  "sha256": "0qg99zj0gb0pc6sjlkmwhk1c1xz14qxmk6gamgfmcxpsfdp5vn72"
 }

doc/hooks/installShellFiles.section.md

@@ -99,12 +99,17 @@ failure. To prevent this, guard the completion generation commands.
 ```nix
 {
   nativeBuildInputs = [ installShellFiles ];
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    # using named fd
-    installShellCompletion --cmd foobar \
-      --bash <($out/bin/foobar --bash-completion) \
-      --fish <($out/bin/foobar --fish-completion) \
-      --zsh <($out/bin/foobar --zsh-completion)
-  '';
+  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      # using named fd
+      installShellCompletion --cmd foobar \
+        --bash <(${emulator} $out/bin/foobar --bash-completion) \
+        --fish <(${emulator} $out/bin/foobar --fish-completion) \
+        --zsh <(${emulator} $out/bin/foobar --zsh-completion)
+    ''
+  );
 }
 ```

doc/hooks/tauri.section.md

@@ -30,37 +30,35 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   # Assuming our app's frontend uses `npm` as a package manager
   npmDeps = fetchNpmDeps {
-    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
-    inherit (finalAttrs) src;
+    name = "${finalAttrs.pname}-npm-deps-${finalAttrs.version}";
+    inherit src;
     hash = "...";
   };
 
-  nativeBuildInputs =
-    [
-      # Pull in our main hook
-      cargo-tauri.hook
+  nativeBuildInputs = [
+    # Pull in our main hook
+    cargo-tauri.hook
 
-      # Setup npm
-      nodejs
-      npmHooks.npmConfigHook
+    # Setup npm
+    nodejs
+    npmHooks.npmConfigHook
 
-      # Make sure we can find our libraries
-      pkg-config
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      wrapGAppsHook4
-    ];
-
-  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
-    glib-networking # Most Tauri apps need networking
-    openssl
-    webkitgtk_4_1
+    # Make sure we can find our libraries
+    pkg-config
+    wrapGAppsHook4
   ];
 
+  buildInputs =
+    [ openssl ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      glib-networking # Most Tauri apps need networking
+      webkitgtk_4_1
+    ];
+
   # Set our Tauri source directory
   cargoRoot = "src-tauri";
   # And make sure we build there too
-  buildAndTestSubdir = finalAttrs.cargoRoot;
+  buildAndTestSubdir = cargoRoot;
 
   # ...
 })

doc/languages-frameworks/haskell.section.md

@@ -779,7 +779,7 @@ that depend on that library, you may want to use:
 
 ```nix
 haskellPackages.haskell-ci.overrideScope (self: super: {
-  Cabal = self.Cabal_3_14_2_0;
+  Cabal = self.Cabal_3_14_1_1;
 })
 ```
 

doc/redirects.json

@@ -133,8 +133,7 @@
     "release-notes.html#sec-nixpkgs-release-25.05-highlights"
   ],
   "sec-nixpkgs-release-25.05-incompatibilities": [
-    "release-notes.html#sec-nixpkgs-release-25.05-incompatibilities",
-    "release-notes.html#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded"
+    "release-notes.html#sec-nixpkgs-release-25.05-incompatibilities"
   ],
   "sec-nixpkgs-release-25.05-incompatibilities-titanium-removed": [
     "release-notes.html#sec-nixpkgs-release-25.05-incompatibilities-titanium-removed",
@@ -142,6 +141,9 @@
     "index.html#building-a-titanium-app",
     "index.html#emulating-or-simulating-the-app"
   ],
+  "sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded": [
+    "release-notes.html#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded"
+  ],
   "sec-nixpkgs-release-25.05-lib": [
     "release-notes.html#sec-nixpkgs-release-25.05-lib"
   ],

doc/release-notes/rl-2505.section.md

@@ -1,4 +1,4 @@
-# Nixpkgs 25.05 (2025.05/23) {#sec-nixpkgs-release-25.05}
+# Nixpkgs 25.05 (2025.05/??) {#sec-nixpkgs-release-25.05}
 
 ## Highlights {#sec-nixpkgs-release-25.05-highlights}
 
@@ -17,26 +17,17 @@
 
 - The default GHC version has been updated from 9.6 to 9.8.
   `haskellPackages` also uses Stackage LTS 23 (instead of LTS 22) as a baseline.
-  We aim to remove the old GHC versions 8.10, 9.0 and 9.2 in the next release in accordance with [the new GHC deprecation policy](https://discourse.nixos.org/t/nixpkgs-ghc-deprecation-policy-user-feedback-necessary/64153).
 
 - LLVM has been updated from LLVM 16 (on Darwin) and LLVM 18 (on other platforms) to LLVM 19.
   This introduces some backwards‐incompatible changes; see the [upstream release notes](https://releases.llvm.org/) for details.
 
 - The Factor programming language packages were reworked. `factor-lang-scope` is now named `factorPackages` and provides a `buildFactorApplication` function to deploy Factor programs as binaries. It has also received proper documentation in the Nixpkgs manual.
 
-- The packaging of Mesa graphics drivers has been significantly reworked, in particular:
-  - Applications linked against different Mesa versions than installed on the system should now work correctly going forward (however, applications against older Mesa, e.g. from Nixpkgs releases before 25.05, remain broken)
-  - Packages that used to depend on Mesa for libgbm or libdri should use `libgbm` or `dri-pkgconfig-stub` as inputs, respectively
-
-- OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. Additionally, we now enable a configure option by default that attempts to lock sshd into RAM to prevent it from being swapped out, which may improve performance if the system is under memory pressure. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.
-
 - Emacs has been updated to 30.1.
   This introduces some backwards‐incompatible changes; see the NEWS for details.
   NEWS can been viewed from Emacs by typing `C-h n`, or by clicking `Help->Emacs News` from the menu bar.
   It can also be browsed [online](https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-30).
 
-- The `intel` video driver for X.org (from the xf86-video-intel package, which was previously removed because it was non-functional) has been fixed and the driver has been re-introduced.
-
 - The default openexr version has been updated to 3.2.4.
 
 - The default PHP version has been updated to 8.4.
@@ -45,6 +36,8 @@
 
 - The default Elixir version has been updated to 1.18.
 
+- `buildPythonPackage`, `buildPythonApplication` and the Python building setup hooks now support both `__structuredAttrs = true` and `__structuredAttrs = false`.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Backward Incompatibilities {#sec-nixpkgs-release-25.05-incompatibilities}
@@ -64,8 +57,6 @@
   The hook can be disabled by providing `dontCheckForBrokenSymlinks = true;` as an argument to `mkDerivation`.
   For more information, [check the docs](https://nixos.org/manual/nixpkgs/unstable/#no-broken-symlinks.sh) or [see this PR](https://github.com/NixOS/nixpkgs/pull/370750).
 
-- `gkraken` has been removed. The recommended alternative is `coolercontrol`.
-
 - `opensmtpd-extras` has been deprecated by upstream and is not compatible with
   OpenSMTPD 7.6.0 or later. The package has been removed in favor of a set of new
   `opensmtpd-table-*` packages.
@@ -74,42 +65,20 @@
   configuration settings. Notably, it now defaults to listening on a socket
   rather than a port. See [Migrating from version 1.x](https://github.com/roehling/postsrsd/blob/2.0.10/README.rst#migrating-from-version-1x) and [Postfix Setup](https://github.com/roehling/postsrsd?tab=readme-ov-file#postfix-setup) for details.
 
-- `renovate` was updated to v39. See the [upstream release notes](https://docs.renovatebot.com/release-notes-for-major-versions/#version-39) for breaking changes.
-  Like upstream's docker images, renovate now runs on NodeJS 22.
-
 - The hand written `perlPackages.SearchXapian` bindings have been dropped in favor of the (mostly compatible)
   `perlPackages.Xapian`.
 
-- `varnish` was updated from 7.5.0 to 7.7.0, see [Varnish 7.6.0 upgrade guide](https://varnish-cache.org/docs/7.6/whats-new/upgrading-7.6.html) and
-[Varnish 7.7.0 upgrade guide](https://varnish-cache.org/docs/7.7/whats-new/upgrading-7.7.html#whatsnew-upgrading-7-7).
-
 - The `config` triple for `aarch64-darwin` has been changed from `aarch64-apple-darwin` to `arm64-apple-darwin` to match the Apple toolchain and LLVM’s expectations.
 
 - The `electron` packages will now provide their headers (available via `electron.headers`) in extracted form instead of in a tarball.
 
-- The udev rules of the `libjaylink` package require users to be in the `jlink` instead of `plugdev` group now, since the `plugdev` group is very uncommon for NixOS. Alternatively, access is granted to seat sessions.
-
 - The `ephemeral` package was removed due to upstream archival in early 2022.
 
-- The `gotenberg` package has been updated to 8.16.0, which brings breaking changes to the configuration from version 8.13.0. See the [upstream release notes](https://github.com/gotenberg/gotenberg/releases/tag/v8.13.0) for that release to get all the details.
-
-- `zammad` has had its support for MySQL removed, since it was never working correctly and is now deprecated upstream. Check the [migration guide](https://docs.zammad.org/en/latest/appendix/migrate-to-postgresql.html) for how to convert your database to PostgreSQL.
-
 - The `vocal` package was removed due to upstream archival. The upstream developer suggests using `gnome-podcasts` or `kasts` instead.
 
-- `timescaledb` requires manual upgrade steps.
-    After you run ALTER EXTENSION, you must run [this SQL script](https://github.com/timescale/timescaledb-extras/blob/master/utils/2.15.X-fix_hypertable_foreign_keys.sql). For more details, see the following pull requests [#6797](https://github.com/timescale/timescaledb/pull/6797).
-    PostgreSQL 13 is no longer supported in TimescaleDB v2.16.
-
-- `paperless-ngx` has been updated to minor version 2.15 which switched the web server from Gunicorn to Granian. If you set Gunicorn specific envs (usually contain GUNICORN) they must be updated.
-
 - [testers.shellcheck](https://nixos.org/manual/nixpkgs/unstable/#tester-shellcheck) now warns when `name` is not provided.
   The `name` argument will become mandatory in a future release.
 
-- `tauon` 7.9.0+ when launched for the first time, migrates its database to a new schema that is not backwards compatible. Older versions will refuse to start at all with that database afterwards. If you need to still use older tauon versions, make sure to back up `~/.local/share/TauonMusicBox`.
-
-- `aws-workspaces` has dropped support for PCoiP networking.
-
 - [GIMP 3.0](https://www.gimp.org/news/2025/03/16/gimp-3-0-released/) available as `gimp3`.
 
 - `grafana-agent` and `services.grafana-agent` have been removed in favor of
@@ -118,35 +87,10 @@
   Grafana recommends migrating to `grafana-alloy` (`services.alloy`).
   See https://grafana.com/docs/alloy/latest/set-up/migrate/ for details.
 
-- `slskd` has been updated to v0.22.3, which includes breaking changes to `script` integrations. Please review the [changelog](https://github.com/slskd/slskd/releases/tag/0.22.3)
-  and the accompanying [pull request](https://github.com/slskd/slskd/pull/1292).
-
-- `forgejo` and `forgejo-lts` have been updated to v11.
-  See upstreams [release blog post](https://forgejo.org/2025-04-release-v11-0/) for more information.
-
-- `unifi` has been updated to v9.1.
-  This version should be backward compatible with v8.x, however as a result, `unifi8` package has been removed.
-
 - `xdragon` package has been renamed to `dragon-drop`.
   `xdragon` is an alias to `dragon-drop` and the package still provides `bin/xdragon`.
   `bin/dragon` is no longer supplied.
 
-- `python3Packages.bpycv` has been removed due to being incompatible with Blender 4 and unmaintained.
-
-- `python3Packages.jaeger-client` was removed because it was deprecated upstream. [OpenTelemetry](https://opentelemetry.io) is the recommended replacement.
-
-- `rocmPackages_6` has been updated to ROCm 6.3.
-
-- `rocmPackages_5` has been removed.
-
-- `rocmPackages.rocm-thunk` has been removed and its functionality has been integrated with the ROCm CLR. Use `rocmPackages.clr` instead.
-
-- `rocmPackages.clang-ocl` has been removed. [It was deprecated by AMD in 2023.](https://github.com/ROCm/clang-ocl)
-
-- `nodePackages.meshcommander` has been removed, as the package was deprecated by Intel.
-
-- The default version of `z3` has been updated from 4.8 to 4.13. There are still a few packages that need specific older versions; those will continue to be maintained as long as other packages depend on them but may be removed in the future.
-
 - The `nixLog*` family of functions made available through the standard environment have been rewritten to prefix messages with both the debug level and the function name of the caller.
   The `nixLog` function, which logs unconditionally, was also re-introduced and modified to prefix messages with the function name of the caller.
   For more information, [see this PR](https://github.com/NixOS/nixpkgs/pull/370742).
@@ -169,10 +113,6 @@
   and the [4.2 release](https://github.com/netbox-community/netbox/releases/tag/v4.2.0),
   make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_2;` in your configuration.
 
-- `nodePackages.expo-cli` has been removed, as it was deprecated by upstream. The suggested replacement is the `npx expo` command.
-
-- The `conduwuit` matrix server implementation has officially been discontinued by upstream and the package has thus been marked as vulnerable, as it is a security-sensitive package that has reached EOL.
-
 - NetBox version 4.0.X available as `netbox_4_0` was removed. Please upgrade to `4.2`.
 
 - `golangci-lint` has reached `v2`. Please read the changes and view the migration guide [here](https://golangci-lint.run/product/changelog/#200).
@@ -187,8 +127,6 @@
 
 - Default ICU version updated from 74 to 76
 
-- The packages `signald`, `signaldctl` and `purple-signald` have been dropped as they are unmaintained upstream and have been incompatible with the official Signal servers for a long while.
-
 - Apache Kafka was updated to `>= 4.0.0`. Please note that this is the first release which operates
   entirely without Apache ZooKeeper support, and all clusters need to be migrated to KRaft mode. See
   the [release announcement](https://kafka.apache.org/blog#apache_kafka_400_release_announcement)
@@ -294,8 +232,6 @@
 
 - `dwarf-fortress-packages` now only contains one minor version for each major version since version 0.44. Saves should still be compatible, but you may have to change which minor version you were using if it was one other than the newest.
 
-- `tpm2-pkcs11` now is compiled without abrmd (Access Broker and Resource Manager Daemon) support by default, preferring the kernel resource manager. Use `tpm2-pkcs11.abrmd` if you would like a version with abrmd support. Note that the NixOS module picks the correct one automatically based on `security.tpm2.abrmd`.
-
 - `zig_0_9` and `zig_0_10` have been removed, you should upgrade to `zig_0_13` (also available as just `zig`), `zig_0_12` or `zig_0_11` instead.
 
 - `webpack-cli` was updated to major version 6, which has breaking changes from the previous version 5.1.4. See the [upstream release notes](https://github.com/webpack/webpack-cli/releases/tag/webpack-cli%406.0.0) for details on these changes.
@@ -334,7 +270,7 @@
 
 - `nodePackages.meshcommander` has been removed, as the package was deprecated by Intel.
 
-- The default version of `z3` has been updated from 4.8 to 4.15, and all old versions have been dropped. Note that `fstar` still depends on specific versions, and maintains them as overrides.
+- The default version of `z3` has been updated from 4.8 to 4.14, and all old versions have been dropped. Note that `fstar` still depends on specific versions, and maintains them as overrides.
 
 - `prometheus` has been updated from 2.55.0 to 3.1.0.
   Read the [release blog post](https://prometheus.io/blog/2024/11/14/prometheus-3-0/) and
@@ -392,22 +328,12 @@
 - `docker_24` has been removed, as it was EOL with vulnerabilities since June 08, 2024.
 
 - Emacs 28 and 29 have been removed.
-
 - Emacs 28 Macport has been removed, while CVEs of Emacs 29 Macport are patched.
 
 - `containerd` has been updated to v2, which contains breaking changes. See the [containerd
   2.0](https://github.com/containerd/containerd/blob/main/docs/containerd-2.0.md) documentation for more
   details.
 
-- The `tinycc` package now has the `dev`, `doc` and `lib` outputs, thus,
-`tinycc.out` may now only provide the tcc and cross compilers binaries.
-
-- The `testTarget` argument of `haskellPackages.mkDerivation` has been deprecated in favour of `testTargets`.
-  `testTarget` took a space separated string of targets, whereas the new `testTargets` argument takes a list of targets.
-  For instance, `testTarget = "foo bar baz"` should become `testTargets = [ "foo" "bar" "baz" ]`.
-
-- `rustPlatform.buildRustPackage` stops handling the deprecated argument `cargoSha256`. Out-of-tree packages that haven't migrated from `cargoSha256` to `cargoHash` now receive errors.
-
 - `nodePackages.stackdriver-statsd-backend` has been removed, as the StackDriver service has been discontinued by Google, and therefore the package no longer works.
 
 - `python3Packages.opentracing` has been removed due to being unmaintained upstream. [OpenTelemetry](https://opentelemetry.io/) is the recommended replacement.
@@ -448,16 +374,9 @@
   - `i18n.extraLocales` should now be the preferred way to install additional locales.
   - `i18n.supportedLocales` is now considered an implementation detail and will be hidden from the documentation. But the option will still continue to work.
   - `i18n.supportedLocales` will now trigger a warning when it omits any locale set in `i18n.defaultLocale`, `i18n.extraLocales` or `i18n.extraLocaleSettings`.
-  - The options `i18n.defaultCharset` & `i18n.localeCharsets` were added, and they complement `i18n.defaultLocale` & `i18n.extraLocaleSettings` respectively - allowing to control the character set used per locale setting.
-
-- Plasma 5 and Qt 5 based versions of associated software are deprecated in NixOS 25.05, and will be removed in NixOS 25.11. Users are encouraged to upgrade to Plasma 6.
 
 - `titaniumenv`, `titanium`, and `titanium-alloy` have been removed due to lack of maintenance in Nixpkgs []{#sec-nixpkgs-release-25.05-incompatibilities-titanium-removed}.
 
-- [Cursor](https://cursor.com/) — a vscode-based editor that uses AI to help you write code faster — has been packaged as `cursor`.
-
-- `octave` (and `octaveFull`) was updated to version `10.x`. The update broke a few `octavePackages`, and `librsb`. See [the PR's commits](https://github.com/NixOS/nixpkgs/pull/394495/commits) for more details.
-
 - androidenv has been improved:
   - All versions specified in composeAndroidPackages now track the latest. Android packages are automatically updated on unstable, and run the androidenv test suite on every update.
   - Many androidenv packages are now searchable on [search.nixos.org](https://search.nixos.org).
@@ -467,79 +386,26 @@
 
 - `gerbera` now has wavpack support.
 
-- `buildPythonPackage`, `buildPythonApplication` and the Python building setup hooks now support both `__structuredAttrs = true` and `__structuredAttrs = false`.
-
-- `buildGoModule` now supports a self-referencing `finalAttrs:` parameter
-  containing the final arguments including overrides.
-  This allows packaging configuration to be overridden in a consistent manner by
-  providing an alternative to `rec {}` syntax.
-
-- Caddy can now be built with plugins by using `caddy.withPlugins`, a `passthru` function that accepts an attribute set as a parameter. The `plugins` argument represents a list of Caddy plugins, with each Caddy plugin being a versioned module. The `hash` argument represents the `vendorHash` of the resulting Caddy source code with the plugins added.
-
-  Example:
-  ```nix
-  let
-    pkgs = import <nixpkgs> { };
-  in
-
-  pkgs.caddy.withPlugins {
-    plugins = [
-      # tagged upstream
-      "github.com/caddy-dns/powerdns@v1.0.1"
-      # pseudo-version number generated by Go
-      "github.com/caddy-dns/cloudflare@v0.0.0-20240703190432-89f16b99c18e"
-      "github.com/mholt/caddy-webdav@v0.0.0-20241008162340-42168ba04c9d"
-    ];
-    hash = "sha256-wqXSd1Ep9TVpQi570TTb96LwzNYvWL5EBJXMJfYWCAk=";
-  }
-  ```
-
-  To get the necessary hash of the vendored dependencies, omit `hash`. The build will fail and tell you the correct value.
-
-  Note that all provided plugins must have versions/tags (string after `@`), even if upstream repo does not tag each release. For untagged plugins, you can either create an empty Go project and run `go get <plugin>` and see changes in `go.mod` to get the pseudo-version number, or provide a commit hash in place of version/tag for the first run, and update the plugin string based on the error output.
-
-- The `godot-export-templates` package now has its content at `share/godot/export_templates/$version` instead of the output root. This makes it more convenient for for symlinking into `~/.local`, but scripts expecting the old layout will need to be changed.
-
 - GOverlay has been updated to 1.2, please check the [upstream changelog](https://github.com/benjamimgois/goverlay/releases) for more details.
 
 - `tpm2-pkcs11` now has the variant `tpm2-pkcs11-fapi`, which has been patched to default to the Feature API backend. It has also been split into `tpm2-pkcs11-esapi`, which _only_ supports the older Enhanced System API backend. Note the [differences](https://github.com/tpm2-software/tpm2-pkcs11/blob/1.9.1/docs/FAPI.md), and that `tpm2-pkcs11` itself still needs `TPM2_PKCS11_BACKEND=fapi` exported in order to use the Feature API, whereas `tpm2-pkcs11-fapi` does not, and `tpm2-pkcs11-esapi` just does not support fapi entirely.
 
 - For matrix homeserver Synapse we are now following the upstream recommendation to enable jemalloc as the memory allocator by default.
 
-- Mattermost, a self-hosted chat collaboration platform supporting calls, playbooks, and boards, has been updated. It now has multiple versions, disabled telemetry, and a native frontend build in nixpkgs, removing all upstream prebuilt blobs.
-  - A new `pkgs.mattermost.buildPlugin` function has been added, which allows plugins to be built from source, including webapp frontends with a supported package-lock.json. See the Mattermost NixOS test and [manual](https://nixos.org/manual/nixos/unstable#sec-mattermost-plugins-build) for an example.
-  - The Mattermost frontend is now built from source and can be overridden. Note that the Mattermost derivation containing both the webapp and server is now wrapped to allow them to be built independently, so overrides to both webapp and server look like `mattermost.overrideAttrs (prev: { webapp = prev.webapp.override { ... }; server = prev.server.override { ... }; })` now.
-  - `pkgs.mattermost` has been updated from 9.11 to 10.5 to track the latest extended support release, since 9.11 will become end-of-life during the lifetime of NixOS 25.05.
-  - `pkgs.mattermostLatest` is now an option to track the latest (non-prerelease) Mattermost release. We test upgrade migrations from ESR releases (`pkgs.mattermost`) to `pkgs.mattermostLatest`.
-
-- A new hardening flag, `nostrictaliasing` was made available, corresponding to the gcc/clang option `-fno-strict-aliasing`.
-
-- The `stackclashprotection` hardening flag has been enabled by default on compilers that support it.
-
 - In `dovecot` package removed hard coding path to module directory.
 
-- `authelia` version 4.39.0 has made some changes which deprecate older configurations.
-  They are still expected to be working until future version 5.0.0, but will generate warnings in logs.
-  Read the [release notes](https://www.authelia.com/blog/4.39-release-notes/) for human readable summaries of the changes.
-
-- `hddfancontrol` has been updated to major release 2. See the [migration guide](https://github.com/desbma/hddfancontrol/tree/master?tab=readme-ov-file#migrating-from-v1x), as there are breaking changes.
-
-- `nextcloud-news-updater` is unmaintained and was removed from nixpkgs.
-
-- KDE Partition Manager `partitionmanager`'s support for ReiserFS is removed.
-  ReiserFS has not been actively maintained for many years. It has been marked as obsolete since Linux 6.6, and
-  [is removed](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c01f664e4ca210823b7594b50669bbd9b0a3c3b0)
-  in Linux 6.13.
-
-- `gerbera` now has wavpack support.
-
 - `signal-desktop` has been migrated to a from source build. No state migration is necessary. In case there's no working source build available (like on Darwin), the the binary build is still available at `signal-desktop-bin`.
 
 - `ddclient` was updated from 3.11.2 to 4.0.0 [Release notes](https://github.com/ddclient/ddclient/releases/tag/v4.0.0)
 
+### NexusMods.App upgraded {#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded}
+
 - `nexusmods-app` has been upgraded from version 0.6.3 to 0.10.2.
+
   - Before upgrading, you **must reset all app state** (mods, games, settings, etc). NexusMods.App will crash if any state from a version older than 0.7.0 is still present.
+
   - Typically, you can can reset to a clean state by running `NexusMods.App uninstall-app`. See Nexus Mod's [how to uninstall the app](https://nexus-mods.github.io/NexusMods.App/users/Uninstall) documentation for more detail and alternative methods.
+
   - This should not be necessary going forward, because loading app state from 0.7.0 or newer is now supported. This is documented in the [0.7.1 changelog](https://github.com/Nexus-Mods/NexusMods.App/releases/tag/v0.7.1).
 
 ## Nixpkgs Library {#sec-nixpkgs-release-25.05-lib}
@@ -550,7 +416,15 @@
   - [`lib.types.enum`](https://nixos.org/manual/nixos/unstable/#sec-option-types-basic): Previously the `functor.payload` was the list of enum values directly. Now it is an attribute set containing the values in the `values` attribute.
   - [`lib.types.separatedString`](https://nixos.org/manual/nixos/unstable/#sec-option-types-string): Previously the `functor.payload` was the separator directly. Now it is an attribute set containing the separator in the `sep` attribute.
 
-- [`lib.packagesFromDirectoryRecursive`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.filesystem.packagesFromDirectoryRecursive) now rejects unknown arguments.
+- The `tinycc` package now has the `dev`, `doc` and `lib` outputs, thus,
+`tinycc.out` may now only provide the tcc and cross compilers binaries.
+
+- The `virtualisation.hypervGuest.videoMode` option has been removed. Standard tooling can now be used to configure display modes for Hyper-V VMs.
+
+- [`lib.packagesFromDirectoryRecursive`] now rejects unknown arguments.
+  [`lib.packagesFromDirectoryRecursive`]: https://nixos.org/manual/nixpkgs/stable/#function-library-lib.filesystem.packagesFromDirectoryRecursive
+
+- The `godot-export-templates` package now has its content at `share/godot/export_templates/$version` instead of the output root. This makes it more convenient for for symlinking into `~/.local`, but scripts expecting the old layout will need to be changed.
 
 ### Deprecations {#sec-nixpkgs-release-25.05-lib-deprecations}
 
@@ -564,6 +438,14 @@
     - `lib.types.coercedTo`
     - `lib.types.either`
 
+- The `testTarget` argument of `haskellPackages.mkDerivation` has been deprecated in favour of `testTargets`.
+  `testTarget` took a space separated string of targets, whereas the new `testTargets` argument takes a list of targets.
+  For instance, `testTarget = "foo bar baz"` should become `testTargets = [ "foo" "bar" "baz" ]`.
+
+- Plasma 5 and Qt 5 based versions of associated software are deprecated in NixOS 25.05, and will be removed in NixOS 25.11. Users are encouraged to upgrade to Plasma 6.
+
+- `rustPlatform.buildRustPackage` stops handling the deprecated argument `cargoSha256`. Out-of-tree packages that haven't migrated from `cargoSha256` to `cargoHash` now receive errors.
+
 ### Additions and Improvements {#sec-nixpkgs-release-25.05-lib-additions-improvements}
 
-- [`lib.packagesFromDirectoryRecursive`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.filesystem.packagesFromDirectoryRecursive) can now construct nested scopes matching the directory tree passed as input.
+- [`lib.packagesFromDirectoryRecursive`] can now construct nested scopes matching the directory tree passed as input.

doc/release-notes/rl-2511.section.md

@@ -1,37 +0,0 @@
-# Nixpkgs 25.11 (2025.11/??) {#sec-nixpkgs-release-25.11}
-
-## Highlights {#sec-nixpkgs-release-25.11-highlights}
-<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
-
-- Create the first release note entry in this section!
-
-## Backward Incompatibilities {#sec-nixpkgs-release-25.11-incompatibilities}
-
-<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
-
-- Create the first release note entry in this section!
-
-## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}
-
-<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
-
-- Create the first release note entry in this section!
-
-## Nixpkgs Library {#sec-nixpkgs-release-25.11-lib}
-
-<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
-
-### Breaking changes {#sec-nixpkgs-release-25.11-lib-breaking}
-
-- Create the first release note entry in this section!
-
-
-### Deprecations {#sec-nixpkgs-release-25.11-lib-deprecations}
-
-- Create the first release note entry in this section!
-
-
-### Additions and Improvements {#sec-nixpkgs-release-25.11-lib-additions-improvements}
-
-- Create the first release note entry in this section!
-

doc/stdenv/stdenv.chapter.md

@@ -1141,15 +1141,12 @@ They cannot be overridden without rebuilding the package.
 
 If dependencies should be resolved at runtime, use `--suffix` to append fallback values to `PATH`.
 
-There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.
+There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/build-support/setup-hooks/make-binary-wrapper/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.
 
 `wrapProgram` is a convenience function you probably want to use most of the time, implemented by both `makeWrapper` and `makeBinaryWrapper`.
 
 Using the `makeBinaryWrapper` implementation is usually preferred, as it creates a tiny _compiled_ wrapper executable, that can be used as a shebang interpreter. This is needed mostly on Darwin, where shebangs cannot point to scripts, [due to a limitation with the `execve`-syscall](https://stackoverflow.com/questions/67100831/macos-shebang-with-absolute-path-not-working). Compiled wrappers generated by `makeBinaryWrapper` can be inspected with `less <path-to-wrapper>` - by scrolling past the binary data you should be able to see the shell command that generated the executable and there see the environment variables that were injected into the wrapper.
 
-However, `makeWrapper` is more flexible and implements more arguments.
-Use `makeWrapper` if you need the wrapper to use shell features (e.g. look up environment variables) at runtime.
-
 ### `remove-references-to -t` \<storepath\> [ `-t` \<storepath\> ... ] \<file\> ... {#fun-remove-references-to}
 
 Removes the references of the specified files to the specified store files. This is done without changing the size of the file by replacing the hash by `eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee`, and should work on compiled executables. This is meant to be used to remove the dependency of the output on inputs that are known to be unnecessary at runtime. Of course, reckless usage will break the patched programs.

lib/asserts.nix

@@ -1,16 +1,5 @@
 { lib }:
 
-let
-  inherit (lib.strings)
-    concatStringsSep
-    ;
-  inherit (lib.lists)
-    filter
-    ;
-  inherit (lib.trivial)
-    showWarnings
-    ;
-in
 rec {
 
   /**
@@ -142,61 +131,4 @@ rec {
       "each element in ${name} must be one of ${lib.generators.toPretty { } xs}, but is: ${
         lib.generators.toPretty { } vals
       }";
-
-  /**
-    Wrap a value with logic that throws an error when assertions
-    fail and emits any warnings.
-
-    # Inputs
-
-    `assertions`
-
-    : A list of assertions. If any of their `assertion` attrs is `false`, their `message` attrs will be emitted in a `throw`.
-
-    `warnings`
-
-    : A list of strings to emit as warnings. This function does no filtering on this list.
-
-    `val`
-
-    : A value to return, wrapped in `warn`, if a `throw` is not necessary.
-
-    # Type
-
-    ```
-    checkAssertWarn :: [ { assertion :: Bool; message :: String } ] -> [ String ] -> Any -> Any
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.asserts.checkAssertWarn` usage example
-    ```nix
-    checkAssertWarn
-      [ { assertion = false; message = "Will fail"; } ]
-      [ ]
-      null
-    stderr>        error:
-    stderr>        Failed assertions:
-    stderr>        - Will fail
-
-    checkAssertWarn
-      [ { assertion = true; message = "Will not fail"; } ]
-      [ "Will warn" ]
-      null
-    stderr> evaluation warning: Will warn
-    null
-    ```
-
-    :::
-  */
-  checkAssertWarn =
-    assertions: warnings: val:
-    let
-      failedAssertions = map (x: x.message) (filter (x: !x.assertion) assertions);
-    in
-    if failedAssertions != [ ] then
-      throw "\nFailed assertions:\n${concatStringsSep "\n" (map (x: "- ${x}") failedAssertions)}"
-    else
-      showWarnings warnings val;
-
 }

lib/licenses.nix

@@ -651,11 +651,6 @@ lib.mapAttrs mkLicense (
       url = "https://fedoraproject.org/wiki/Licensing/GPL_Classpath_Exception";
     };
 
-    gpl2UBDLPlus = {
-      fullName = "GNU General Public License v3.0 or later (with UBDL exception)";
-      url = "https://spdx.org/licenses/UBDL-exception.html";
-    };
-
     gpl2Oss = {
       fullName = "GNU General Public License version 2 only (with OSI approved licenses linking exception)";
       url = "https://www.mysql.com/about/legal/licensing/foss-exception";

lib/meta.nix

@@ -289,7 +289,8 @@ rec {
   */
   availableOn =
     platform: pkg:
-    ((!pkg ? meta.platforms) || any (platformMatch platform) pkg.meta.platforms)
+    pkg != null
+    && ((!pkg ? meta.platforms) || any (platformMatch platform) pkg.meta.platforms)
     && all (elem: !platformMatch platform elem) (pkg.meta.badPlatforms or [ ]);
 
   /**

lib/path/default.nix

@@ -382,7 +382,7 @@ in
               (splitRoot p).root
               (splitRoot p).subpath
 
-    - Trying to get the parent directory of `root` using [`dirOf`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-dirOf) returns `root` itself:
+    - Trying to get the parent directory of `root` using [`readDir`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-readDir) returns `root` itself:
 
           dirOf (splitRoot p).root == (splitRoot p).root
 

lib/systems/default.nix

@@ -352,9 +352,21 @@ let
             else
               null;
 
-          # Handle Android SDK and NDK versions.
-          androidSdkVersion = args.androidSdkVersion or null;
-          androidNdkVersion = args.androidNdkVersion or null;
+          # Remove before 25.05
+          androidSdkVersion =
+            if (args ? sdkVer && !args ? androidSdkVersion) then
+              throw "For android `sdkVer` has been renamed to `androidSdkVersion`"
+            else if (args ? androidSdkVersion) then
+              args.androidSdkVersion
+            else
+              null;
+          androidNdkVersion =
+            if (args ? ndkVer && !args ? androidNdkVersion) then
+              throw "For android `ndkVer` has been renamed to `androidNdkVersion`"
+            else if (args ? androidSdkVersion) then
+              args.androidNdkVersion
+            else
+              null;
         }
         // (
           let

lib/systems/examples.nix

@@ -146,10 +146,6 @@ rec {
   riscv64 = riscv "64";
   riscv32 = riscv "32";
 
-  riscv64-musl = {
-    config = "riscv64-unknown-linux-musl";
-  };
-
   riscv64-embedded = {
     config = "riscv64-none-elf";
     libc = "newlib";

maintainers/maintainer-list.nix

@@ -53,7 +53,8 @@
    More fields may be added in the future, however, in order to comply with GDPR this file should stay as minimal as possible.
 
    When editing this file:
-    * keep the list alphabetically sorted
+    * keep the list alphabetically sorted, check with:
+        nix-instantiate --eval maintainers/scripts/check-maintainers-sorted.nix
     * test the validity of the format with:
         nix-build lib/tests/maintainers.nix
 
@@ -536,12 +537,6 @@
       }
     ];
   };
-  Acconut = {
-    email = "marius@transloadit.com";
-    github = "Acconut";
-    githubId = 1375043;
-    name = "Marius Kleidl";
-  };
   acesyde = {
     name = "Pierre-Emmanuel Mercier";
     email = "acesyde@gmail.com";
@@ -1859,12 +1854,6 @@
     name = "Austin Lund";
     keys = [ { fingerprint = "7083 E268 4BFD 845F 2B84  9E74 B695 8918 ED23 32CE"; } ];
   };
-  appleboblin = {
-    email = "github@appleboblin.com";
-    github = "appleboblin";
-    githubId = 16847957;
-    name = "Po-Hui Lin";
-  };
   applejag = {
     email = "applejag.luminance905@passmail.com";
     github = "applejag";
@@ -4811,12 +4800,6 @@
     name = "Coca";
     keys = [ { fingerprint = "99CB 86FF 62BB 7DA4 8903  B16D 0328 2DF8 8179 AB19"; } ];
   };
-  cococolanosugar = {
-    name = "George Xu";
-    github = "cococolanosugar";
-    githubId = 1736138;
-    email = "cococolanosugar@gmail.com";
-  };
   coconnor = {
     email = "coreyoconnor@gmail.com";
     github = "coreyoconnor";
@@ -5819,7 +5802,7 @@
     email = "me@dblsaiko.net";
     github = "2xsaiko";
     githubId = 3987560;
-    name = "Katalin Rebhan";
+    name = "Marco Rebhan";
   };
   dbohdan = {
     email = "dbohdan@dbohdan.com";
@@ -5858,11 +5841,6 @@
     githubId = 39909293;
     name = "Dominic Delabruere";
   };
-  ddogfoodd = {
-    github = "ddogfoodd";
-    githubId = 58050402;
-    name = "Jost Alemann";
-  };
   dduan = {
     email = "daniel@duan.ca";
     github = "dduan";
@@ -7195,6 +7173,7 @@
     email = "fedi.jamoussi@protonmail.ch";
     github = "eljamm";
     githubId = 83901271;
+    keys = [ { fingerprint = "FF59 E027 4EE2 E792 512B  BDC8 7630 FDF7 C8FB 1F3F"; } ];
   };
   elkowar = {
     email = "thereal.elkowar@gmail.com";
@@ -7297,13 +7276,6 @@
     githubId = 428026;
     name = "embr";
   };
-  emilia = {
-    email = "nix@emilia.codes";
-    github = "emiliaaah";
-    githubId = 55017867;
-    name = "Emilia";
-    keys = [ { fingerprint = "F772 3569 4B43 B599 73C2  A931 1EFB E941 B89B B810"; } ];
-  };
   emilioziniades = {
     email = "emilioziniades@protonmail.com";
     github = "emilioziniades";
@@ -7422,11 +7394,6 @@
     githubId = 5085029;
     name = "Emanuele Peruffo";
   };
-  epireyn = {
-    github = "epireyn";
-    githubId = 48213068;
-    name = "Edgar Pireyn";
-  };
   equirosa = {
     email = "eduardo@eduardoquiros.com";
     github = "equirosa";
@@ -8581,12 +8548,6 @@
     githubId = 21362942;
     name = "Fugi";
   };
-  fullmetalsheep = {
-    email = "fullmetalsheep@proton.me";
-    github = "fullmetalsheep";
-    githubId = 23723926;
-    name = "Dash R";
-  };
   funkeleinhorn = {
     email = "git@funkeleinhorn.com";
     github = "funkeleinhorn";
@@ -9199,12 +9160,6 @@
     githubId = 1621335;
     name = "Andrew Trachenko";
   };
-  goodylove = {
-    github = "goodylove";
-    email = "goodyc474@gmail.com";
-    githubId = 104577296;
-    name = "Nwachukwu Goodness";
-  };
   gordon-bp = {
     email = "gordy@hanakano.com";
     github = "Gordon-BP";
@@ -11392,13 +11347,6 @@
     githubId = 19669567;
     name = "Willy";
   };
-  jennifgcrl = {
-    email = "jennifer@jezh.me";
-    github = "jennifgcrl";
-    githubId = 110419915;
-    matrix = "@fgcrl:matrix.org";
-    name = "Jennifer Zhou";
-  };
   jensbin = {
     email = "jensbin+git@pm.me";
     github = "jensbin";
@@ -11443,17 +11391,6 @@
     githubId = 10786794;
     name = "Markus Hihn";
   };
-  jess = {
-    name = "Jessica";
-    email = "jess+nix@jessie.cafe";
-    github = "ttrssreal";
-    githubId = 43591752;
-    keys = [
-      {
-        fingerprint = "8092 3BD1 ECD0 E436 671D  C8E9 BA33 5068 6C91 8606";
-      }
-    ];
-  };
   jessemoore = {
     email = "jesse@jessemoore.dev";
     github = "jesseDMoore1994";
@@ -11645,12 +11582,6 @@
     githubId = 9866621;
     name = "Jack";
   };
-  jkachmar = {
-    email = "git@jkachmar.com";
-    github = "jkachmar";
-    githubId = 8461423;
-    name = "jkachmar";
-  };
   jkarlson = {
     email = "jekarlson@gmail.com";
     github = "ethorsoe";
@@ -12738,12 +12669,6 @@
     githubId = 37185887;
     name = "Calvin Kim";
   };
-  keegancsmith = {
-    email = "keegan.csmith@gmail.com";
-    name = "Keegan Carruthers-Smith";
-    github = "keegancsmith";
-    githubId = 187831;
-  };
   keenanweaver = {
     email = "keenanweaver@protonmail.com";
     name = "Keenan Weaver";
@@ -13492,12 +13417,6 @@
     githubId = 58425080;
     name = "Viktor Pocedulić";
   };
-  kvz = {
-    email = "kevin@transloadit.com";
-    github = "kvz";
-    githubId = 26752;
-    name = "Kevin van Zonneveld";
-  };
   kwaa = {
     name = "藍+85CD";
     email = "kwa@kwaa.dev";
@@ -17776,12 +17695,6 @@
     githubId = 41154684;
     name = "nokazn";
   };
-  nomaterials = {
-    email = "nomaterials@gmail.com";
-    github = "no-materials";
-    githubId = 16938952;
-    name = "nomaterials";
-  };
   nomeata = {
     email = "mail@joachim-breitner.de";
     github = "nomeata";
@@ -18222,11 +18135,10 @@
     name = "Dakota";
   };
   ohheyrj = {
-    email = "richard@ohheyrj.co.uk";
+    email = "richard+nix@ohheyrj.co.uk";
     github = "ohheyrj";
     name = "ohheyrj";
     githubId = 5339261;
-    keys = [ { fingerprint = "4258 3FE7 12E9 6071 E84D  53C7 6E1D A270 0B72 746D"; } ];
   };
   oida = {
     email = "oida@posteo.de";
@@ -18574,12 +18486,6 @@
     github = "ovlach";
     githubId = 4405107;
   };
-  owickstrom = {
-    email = "oskar@wickstrom.tech";
-    name = "Oskar Wickström";
-    github = "owickstrom";
-    githubId = 1464328;
-  };
   oxalica = {
     email = "oxalicc@pm.me";
     github = "oxalica";
@@ -20972,12 +20878,6 @@
     githubId = 807447;
     name = "Robert Scott";
   };
-  Rishabh5321 = {
-    name = "Rishabh Singh";
-    email = "rishabh98818@gmail.com";
-    github = "Rishabh5321";
-    githubId = 40533251;
-  };
   Rishik-Y = {
     name = "Rishik Yalamanchili";
     email = "202301258@daiict.ac.in";
@@ -24170,12 +24070,6 @@
     github = "tebriel";
     githubId = 821688;
   };
-  tebro = {
-    email = "git@tebro.simplelogin.com";
-    name = "Richard Weber";
-    github = "Tebro";
-    githubId = 3861339;
-  };
   techknowlogick = {
     email = "techknowlogick@gitea.com";
     github = "techknowlogick";
@@ -24580,12 +24474,6 @@
     githubId = 6579555;
     name = "Jeroen Jetten";
   };
-  thetaoofsu = {
-    email = "TheTaoOfSu@protonmail.com";
-    github = "TheTaoOfSu";
-    githubId = 45526311;
-    name = "TheTaoOfSu";
-  };
   theuni = {
     email = "ct@flyingcircus.io";
     github = "ctheune";
@@ -25101,12 +24989,6 @@
     github = "totoroot";
     githubId = 39650930;
   };
-  tournev = {
-    name = "Vincent Tourneur";
-    email = "vincent@pimoid.fr";
-    github = "vtourneur";
-    githubId = 48284424;
-  };
   ToxicFrog = {
     email = "toxicfrog@ancilla.ca";
     github = "ToxicFrog";
@@ -26956,12 +26838,6 @@
     githubId = 15948162;
     name = "Yanni Papandreou";
   };
-  yarekt = {
-    name = "Yarek T";
-    email = "yarekt+nixpkgs@gmail.com";
-    github = "yarektyshchenko";
-    githubId = 185304;
-  };
   yarny = {
     github = "Yarny0";
     githubId = 41838844;
@@ -27338,6 +27214,12 @@
     githubId = 5986078;
     name = "Zunway Liang";
   };
+  zanculmarktum = {
+    name = "Azure Zanculmarktum";
+    email = "zanculmarktum@gmail.com";
+    github = "zanculmarktum";
+    githubId = 16958511;
+  };
   zane = {
     name = "Zane van Iperen";
     email = "zane@zanevaniperen.com";

maintainers/scripts/luarocks-packages.csv

@@ -106,6 +106,7 @@ luazip,,,,,,
 lusc_luv,,,,,,
 lush.nvim,,,https://luarocks.org/dev,,,teto
 luuid,,,,20120509-2,,
+luv,,,,1.48.0-2,,
 lyaml,,,,,,lblasc
 lz.n,,,,,,mrcjkb
 lze,,,,,,birdee

maintainers/team-list.nix

@@ -843,7 +843,6 @@ with lib.maintainers;
       Gabriella439
       curran
       lf-
-      jkachmar
     ];
     scope = "Group registry for packages maintained by Mercury";
     shortName = "Mercury Employees";
@@ -869,7 +868,6 @@ with lib.maintainers;
       qyriad
       _9999years
       lf-
-      alois31
     ];
     scope = "Maintain the Lix package manager inside of Nixpkgs.";
     shortName = "Lix ecosystem";
@@ -1120,17 +1118,9 @@ with lib.maintainers;
   };
 
   sdl = {
-    members = [
-      evythedemon
-      grimmauld
-      jansol
-      marcin-serwin
-      pbsds
-    ];
-    githubTeams = [ "SDL" ];
-    scope = "Maintain core SDL libraries.";
+    members = [ ];
+    scope = "Maintain SDL libraries.";
     shortName = "SDL";
-    enableFeatureFreezePing = true;
   };
 
   sphinx = {

nixos/doc/manual/development/running-nixos-tests-interactively.section.md

@@ -71,19 +71,10 @@ An SSH-based backdoor to log into machines can be enabled with
 {
   name = "…";
   nodes.machines = { /* … */ };
-  interactive.sshBackdoor.enable = true;
+  sshBackdoor.enable = true;
 }
 ```
 
-::: {.warning}
-Make sure to only enable the backdoor for interactive tests
-(i.e. by using `interactive.sshBackdoor.enable`)! This is the only
-supported configuration.
-
-Running a test in a sandbox with this will fail because `/dev/vhost-vsock` isn't available
-in the sandbox.
-:::
-
 This creates a [vsock socket](https://man7.org/linux/man-pages/man7/vsock.7.html)
 for each VM to log in with SSH. This configures root login with an empty password.
 

nixos/doc/manual/installation/installing-virtualbox-guest.section.md

@@ -8,7 +8,7 @@ up a VirtualBox guest, follow these instructions:
 
 1.  Base Memory Size: 768 MB or higher.
 
-1.  New Hard Disk of 10 GB or higher.
+1.  New Hard Disk of 8 GB or higher.
 
 1.  Mount the CD-ROM with the NixOS ISO (by clicking on CD/DVD-ROM)
 

nixos/doc/manual/installation/upgrading.chapter.md

@@ -6,7 +6,7 @@ expressions and associated binaries. The NixOS channels are updated
 automatically from NixOS's Git repository after certain tests have
 passed and all packages have been built. These channels are:
 
--   *Stable channels*, such as [`nixos-25.05`](https://channels.nixos.org/nixos-25.05).
+-   *Stable channels*, such as [`nixos-24.11`](https://channels.nixos.org/nixos-24.11).
     These only get conservative bug fixes and package upgrades. For
     instance, a channel update may cause the Linux kernel on your system
     to be upgraded from 4.19.34 to 4.19.38 (a minor bug fix), but not
@@ -19,7 +19,7 @@ passed and all packages have been built. These channels are:
     radical changes between channel updates. It's not recommended for
     production systems.
 
--   *Small channels*, such as [`nixos-25.05-small`](https://channels.nixos.org/nixos-25.05-small)
+-   *Small channels*, such as [`nixos-24.11-small`](https://channels.nixos.org/nixos-24.11-small)
     or [`nixos-unstable-small`](https://channels.nixos.org/nixos-unstable-small).
     These are identical to the stable and unstable channels described above,
     except that they contain fewer binary packages. This means they get updated
@@ -38,8 +38,8 @@ supported stable release.
 
 When you first install NixOS, you're automatically subscribed to the
 NixOS channel that corresponds to your installation source. For
-instance, if you installed from a 25.05 ISO, you will be subscribed to
-the `nixos-25.05` channel. To see which NixOS channel you're subscribed
+instance, if you installed from a 24.11 ISO, you will be subscribed to
+the `nixos-24.11` channel. To see which NixOS channel you're subscribed
 to, run the following as root:
 
 ```ShellSession
@@ -54,16 +54,16 @@ To switch to a different NixOS channel, do
 ```
 
 (Be sure to include the `nixos` parameter at the end.) For instance, to
-use the NixOS 25.05 stable channel:
+use the NixOS 24.11 stable channel:
 
 ```ShellSession
-# nix-channel --add https://channels.nixos.org/nixos-25.05 nixos
+# nix-channel --add https://channels.nixos.org/nixos-24.11 nixos
 ```
 
 If you have a server, you may want to use the "small" channel instead:
 
 ```ShellSession
-# nix-channel --add https://channels.nixos.org/nixos-25.05-small nixos
+# nix-channel --add https://channels.nixos.org/nixos-24.11-small nixos
 ```
 
 And if you want to live on the bleeding edge:
@@ -117,6 +117,6 @@ modules. You can also specify a channel explicitly, e.g.
 
 ```nix
 {
-  system.autoUpgrade.channel = "https://channels.nixos.org/nixos-25.05";
+  system.autoUpgrade.channel = "https://channels.nixos.org/nixos-24.11";
 }
 ```

nixos/doc/manual/redirects.json

@@ -1874,9 +1874,6 @@
   "test-opt-meta.platforms": [
     "index.html#test-opt-meta.platforms"
   ],
-  "test-opt-meta.hydraPlatforms": [
-    "index.html#test-opt-meta.hydraPlatforms"
-  ],
   "test-opt-meta.timeout": [
     "index.html#test-opt-meta.timeout"
   ],
@@ -1994,15 +1991,11 @@
   "sec-release-25.05-notable-changes": [
     "release-notes.html#sec-release-25.05-notable-changes"
   ],
-  "sec-release-25.05-wiki": [
-    "release-notes.html#sec-release-25.05-wiki"
-  ],
   "sec-nixpkgs-release-25.05": [
     "release-notes.html#sec-nixpkgs-release-25.05"
   ],
   "sec-nixpkgs-release-25.05-incompatibilities": [
-    "release-notes.html#sec-nixpkgs-release-25.05-incompatibilities",
-    "release-notes.html#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded"
+    "release-notes.html#sec-nixpkgs-release-25.05-incompatibilities"
   ],
   "sec-nixpkgs-release-25.05-incompatibilities-titanium-removed": [
     "release-notes.html#sec-nixpkgs-release-25.05-incompatibilities-titanium-removed",
@@ -2010,6 +2003,9 @@
     "index.html#building-a-titanium-app",
     "index.html#emulating-or-simulating-the-app"
   ],
+  "sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded": [
+    "release-notes.html#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded"
+  ],
   "sec-nixpkgs-release-25.05-lib": [
     "release-notes.html#sec-nixpkgs-release-25.05-lib"
   ],

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -1,36 +1,42 @@
-# Release 25.05 (“Warbler”, 2025.05/23) {#sec-release-25.05}
+# Nixos 25.05 (“Warbler”, 2025.05/??) {#sec-release-25.05}
 
 ## Highlights {#sec-release-25.05-highlights}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-Alongside many enhancements to NixOS modules and general system improvements, this release features the following highlights:
-
 - NixOS now has initial support for the [**COSMIC DE**](https://system76.com/cosmic) which is currently at **Alpha 7**. COSMIC is a Rust-based Desktop Environment by System76, makers of Pop!_OS. You can use COSMIC by enabling the greeter (login manager) with [](#opt-services.displayManager.cosmic-greeter.enable), and the DE itself by enabling [](#opt-services.desktopManager.cosmic.enable). The support in NixOS/Nixpkgs is stable but still considered experimental because of the recent the addition. The COSMIC maintainers will be waiting for one more release of NixOS to determine if the experimental tag should be removed or not. Until then, please report any issues to the [COSMIC DE tracker in Nixpkgs](https://github.com/NixOS/nixpkgs/issues/259641) instead of upstream.
 
 - `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is available for testing. You can enable it by setting [](#opt-system.rebuild.enableNg) in your configuration (this will replace the old `nixos-rebuild`), or by adding `nixos-rebuild-ng` to your `environment.systemPackages` (in this case, it will live side-by-side with `nixos-rebuild` as `nixos-rebuild-ng`). It is expected that the next major version of NixOS (25.11) will enable `system.rebuild.enableNg` by default.
 
+- The `nixos-generate-config` command now supports a optional `--flake` option, which will generate a flake.nix file alongside the `configuration.nix` and `hardware-configuration.nix`, providing an easy introduction into flake-based system configurations.
+
 - A `nixos-rebuild build-image` sub-command has been added.
   It allows users to build platform-specific (disk) images from their NixOS configurations. `nixos-rebuild build-image` works similar to the popular [nix-community/nixos-generators](https://github.com/nix-community/nixos-generators) project. See new [section on image building in the NixOS manual](#sec-image-nixos-rebuild-build-image). It is also available for `nixos-rebuild-ng`.
 
 - `nixos-option` has been rewritten to a Nix expression called by a simple bash script. This lowers our maintenance threshold, makes eval errors less verbose, adds support for flake-based configurations, descending into `attrsOf` and `listOf` submodule options, and `--show-trace`.
 
-- The global Mesa version can now be managed without a mass rebuild by setting [](#opt-hardware.graphics.package).
+- The packaging of Mesa graphics drivers has been significantly reworked, in particular:
+  - Applications linked against different Mesa versions than installed on the system should now work correctly going forward (however, applications against older Mesa, e.g. from Nixpkgs releases before 25.05, remain broken)
+  - The global Mesa version can now be managed without a mass rebuild by setting [](#opt-hardware.graphics.package)
+  - Packages that used to depend on Mesa for libgbm or libdri should use `libgbm` or `dri-pkgconfig-stub` as inputs, respectively
 
-- GNOME has been updated to version 48.
+- OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. Additionally, we now enable a configure option by default that attempts to lock sshd into RAM to prevent it from being swapped out, which may improve performance if the system is under memory pressure. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.
 
-  - `decibels` music player is now installed by default. You can disable it using [](#opt-environment.gnome.excludePackages).
-  - `gnome-shell-extensions` extension collection (which included GNOME Classic extensions, Apps Menu, and User Themes, among others) are no longer installed by default. You can install them again with [](#opt-services.xserver.desktopManager.gnome.sessionPath).
-  - Option [](#opt-services.gnome.core-developer-tools.enable) now also installs `sysprof` and `d-spy`.
-  - Option `services.gnome.core-utilities.enable` has been renamed to [](#opt-services.gnome.core-apps.enable).
-  - `cantarell-fonts`, `source-code-pro` and `source-sans` fonts are no longer installed by default. They have been replaced by `adwaita-fonts`.
+- The `intel` video driver for X.org (from the xf86-video-intel package, which was previously removed because it was non-functional) has been fixed and the driver has been re-introduced.
 
-  Refer to the [GNOME release notes](https://release.gnome.org/48/) for more details.
-
-- [channels.nixos.org](https://channels.nixos.org) now supports the Lockable HTTP Tarball Protocol. This allows using the channel `nixexprs.tar` as Nix Flake input, e.g.:
-  ```
-  inputs.nixpkgs.url = "https://channels.nixos.org/nixos-25.05/nixexprs.tar.xz";
-  ```
+- The Mattermost module ([`services.mattermost`](#opt-services.mattermost.enable)) and packages (`mattermost` and `mmctl`) have been substantially updated:
+  - [](#opt-services.mattermost.preferNixConfig) now defaults to true if you advance [](#opt-system.stateVersion) to 25.05. This means that if you have [](#opt-services.mattermost.mutableConfig) set, NixOS will override your settings to those that you define in the module. It is recommended to leave this at the default, even if you used a mutable config before, because it will ensure that your Mattermost data directories are correct. If you moved your data directories, you may want to review the module changes before upgrading.
+  - Mattermost telemetry reporting is now disabled by default, though security update notifications are enabled. Look at [`services.mattermost.telemetry`](#opt-services.mattermost.telemetry.enableDiagnostics) for options to control this behavior.
+  - `pkgs.mattermost` has been updated from 9.11 to 10.5 to track the latest extended support release, since 9.11 will become end-of-life during the lifetime of NixOS 25.05.
+  - `pkgs.mattermostLatest` is now an option to track the latest (non-prerelease) Mattermost release. We test upgrade migrations from ESR releases (`pkgs.mattermost`) to `pkgs.mattermostLatest`.
+  - The Mattermost frontend is now built from source and can be overridden.
+    - Note that the Mattermost derivation containing both the webapp and server is now wrapped to allow them to be built independently, so overrides to both webapp and server look like `mattermost.overrideAttrs (prev: { webapp = prev.webapp.override { ... }; server = prev.server.override { ... }; })` now.
+  - `services.mattermost.listenAddress` has been split into [](#opt-services.mattermost.host) and [](#opt-services.mattermost.port). If your `listenAddress` contained a port, you will need to edit your configuration.
+  - Mattermost now supports peer authentication on both MySQL and Postgres database backends. Updating [](#opt-system.stateVersion) to 25.05 or later will result in peer authentication being used by default if the Mattermost server would otherwise be connecting to localhost. This is the recommended configuration.
+  - The Mattermost module will produce eval warnings if a database password would end up in the Nix store, and recommend alternatives such as peer authentication or using the environment file.
+  - We now support `mmctl` for Mattermost administration if both [](#opt-services.mattermost.socket.enable) and [](#opt-services.mattermost.socket.export) are set, which export the Mattermost control socket path into the system environment.
+  - A new `pkgs.mattermost.buildPlugin` function has been added, which allows plugins to be built from source, including webapp frontends with a supported package-lock.json. See the Mattermost NixOS test and [manual](https://nixos.org/manual/nixpkgs/unstable/#sec-mattermost-plugins-build) for an example.
+  - Note that the Mattermost module will create an account _without_ a well-known UID if the username differs from the default (`mattermost`). If you used Mattermost with a nonstandard username, you may want to review the module changes before upgrading.
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
@@ -38,11 +44,9 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- [AmneziaVPN](https://amnezia.org/en), a self-hostable open-source VPN client, is available in two variants:
-  - [programs.amnezia-vpn](#opt-programs.amnezia-vpn.enable): a GUI client which can also deploy a VPN endpoint to a remote server
-  - {option}`networking.wireguard` adds support for the [AmneziaWG](https://docs.amnezia.org/documentation/amnezia-wg/) variant of the protocol, featuring better masking against Deep Packet Inspection. The variant to be used is set per interface as `networking.wireguard.interfaces.<name>.type`, defaulting to wireguard.
+- [AmneziaVPN](https://amnezia.org/en), an open-source VPN client, with a key feature that enables you to deploy your own VPN server on your server. Available as [programs.amnezia-vpn](#opt-programs.amnezia-vpn.enable).
 
-- [Bazecor](https://github.com/Dygmalab/Bazecor), the graphical configurator for Dygma Products. Available as [programs.bazecor](#opt-programs.bazecor.enable).
+- [Bazecor](https://github.com/Dygmalab/Bazecor), the graphical configurator for Dygma Products.
 
 - [Bonsai](https://git.sr.ht/~stacyharper/bonsai), a general-purpose event mapper/state machine primarily used to create complex key shortcuts, and as part of the [SXMO](https://sxmo.org/) desktop environment. Available as [services.bonsaid](#opt-services.bonsaid.enable).
 
@@ -50,11 +54,9 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [Kimai](https://www.kimai.org/), a web-based multi-user time-tracking application. Available as [services.kimai](options.html#opt-services.kimai).
 
-- [Kismet](https://www.kismetwireless.net/), a Wi-Fi, Bluetooth, and RF monitoring application supporting a wide range of hardware. Available as [services.kismet](#opt-services.kismet.enable).
+- [Kismet](https://www.kismetwireless.net/), a Wi-Fi, Bluetooth, and RF monitoring application supporting a wide range of hardware. Available as {option}`services.kismet`.
 
-- [vwifi](https://github.com/Raizo62/vwifi), a Wi-Fi simulator daemon leveraging the `mac80211_hwsim` and `vhost_vsock` kernel modules for efficient simulation of multi-node Wi-Fi networks. Available as [services.vwifi](#opt-services.vwifi.client.enable).
-
-- [Oncall](https://oncall.tools), a web-based calendar tool designed for scheduling and managing on-call shifts. Available as [services.oncall](options.html#opt-services.oncall).
+- [vwifi](https://github.com/Raizo62/vwifi), a Wi-Fi simulator daemon leveraging the `mac80211_hwsim` and `vhost_vsock` kernel modules for efficient simulation of multi-node Wi-Fi networks. Available as {option}`services.vwifi`.
 
 - [Homer](https://homer-demo.netlify.app/), a very simple static homepage for your server. Available as [services.homer](options.html#opt-services.homer).
 
@@ -62,20 +64,18 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [Omnom](https://github.com/asciimoo/omnom), a webpage bookmarking and snapshotting service. Available as [services.omnom](options.html#opt-services.omnom.enable).
 
-- [Yggdrasil-Jumper](https://github.com/one-d-wide/yggdrasil-jumper), an independent project that aims to transparently reduce latency of a connection over Yggdrasil network, utilizing NAT traversal to automatically bypass intermediary nodes. Available as [services.yggdrasil-jumper](#opt-services.yggdrasil-jumper.enable).
+- [Yggdrasil-Jumper](https://github.com/one-d-wide/yggdrasil-jumper) is an independent project that aims to transparently reduce latency of a connection over Yggdrasil network, utilizing NAT traversal to automatically bypass intermediary nodes.
 
-- [xpad-noone](https://github.com/medusalix/xpad-noone) is the original upstream xpad driver from the Linux kernel with support for Xbox One controllers removed — especially useful for people who want to use an XBox One controller under the `xone` driver and an Xbox 360 controller under the `xpad` driver at the same time. Available as [hardware.xpad-noone](options.html#hardware.xpad-noone).
+- [xpad-noone](https://github.com/medusalix/xpad-noone) is the original upstream xpad driver from the Linux kernel with support for Xbox One controllers removed， especially useful for people who want to use an XBox One controller under the xone driver and an Xbox 360 controller under the xpad driver at the same time. Available as [hardware.xpad-noone](options.html#hardware.xpad-noone).
 
 - [uMurmur](https://umurmur.net), minimalistic Mumble server primarily targeted to run on embedded computers. Available as [services.umurmur](options.html#opt-services.umurmur).
 
-- [Zenoh](https://zenoh.io/), a pub/sub/query protocol with low overhead. The Zenoh router daemon is available as [services.zenohd](options.html#opt-services.zenohd.enable).
+- [Zenoh](https://zenoh.io/), a pub/sub/query protocol with low overhead. The Zenoh router daemon is available as [services.zenohd](options.html#opt-services.zenohd.enable)
 
 - [ytdl-sub](https://github.com/jmbannon/ytdl-sub), a tool that downloads media via yt-dlp and prepares it for your favorite media player, including Kodi, Jellyfin, Plex, Emby, and modern music players. Available as [services.ytdl-sub](options.html#opt-services.ytdl-sub.instances).
 
 - [MaryTTS](https://github.com/marytts/marytts), an open-source, multilingual text-to-speech synthesis system written in pure Java. Available as [services.marytts](options.html#opt-services.marytts).
 
-- [Continuwuity](https://continuwuity.org/), a federated chat server implementing the Matrix protocol, forked from Conduwuit. Available as [services.matrix-continuwuity](#opt-services.matrix-continuwuity.enable).
-
 - [Reposilite](https://reposilite.com), a lightweight and easy-to-use repository manager for Maven-based artifacts in the JVM ecosystem. Available as [services.reposilite](options.html#opt-services.reposilite).
 
 - [networking.modemmanager](options.html#opt-networking.modemmanager) has been split out of [networking.networkmanager](options.html#opt-networking.networkmanager). NetworkManager still enables ModemManager by default, but options exist now to run NetworkManager without ModemManager.
@@ -96,8 +96,6 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [crab-hole](https://github.com/LuckyTurtleDev/crab-hole), a cross platform Pi-hole clone written in Rust using hickory-dns/trust-dns. Available as [services.crab-hole](#opt-services.crab-hole.enable).
 
-- [agnos](https://github.com/krtab/agnos), a program that obtains TLS certificates from an ACME provider via the DNS-01 challenge without using third-party DNS provider APIs. Available as [security.agnos](#opt-security.agnos.enable).
-
 - [zwave-js-ui](https://zwave-js.github.io/zwave-js-ui/), a full featured Z-Wave Control Panel and MQTT Gateway. Available as [services.zwave-js-ui](#opt-services.zwave-js-ui.enable).
 
 - [Pinchflat](https://github.com/kieraneglin/pinchflat), a selfhosted YouTube media manager used to track channels and download videos on release. Available as [services.pinchflat](#opt-services.pinchflat.enable).
@@ -126,7 +124,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [agorakit](https://github.com/agorakit/agorakit), an organization tool for citizens' collectives. Available with [services.agorakit](options.html#opt-services.agorakit.enable).
 
-- [vivid](https://github.com/sharkdp/vivid), a generator for `LS_COLOR`. Available as [programs.vivid](#opt-programs.vivid.enable).
+- [vivid](https://github.com/sharkdp/vivid), a generator for LS_COLOR. Available as [programs.vivid](#opt-programs.vivid.enable).
 
 - [matrix-alertmanager](https://github.com/jaywink/matrix-alertmanager), a bot to receive Alertmanager webhook events and forward them to chosen Matrix rooms. Available as [services.matrix-alertmanager](options.html#opt-services.matrix-alertmanager.enable).
 
@@ -136,13 +134,13 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [grav](https://getgrav.org/), a modern flat-file CMS. Available with [services.grav](options.html#opt-services.grav.enable).
 
-- [duckdns](https://www.duckdns.org), free dynamic DNS. Available with [services.duckdns](options.html#opt-services.duckdns.enable).
+- [duckdns](https://www.duckdns.org), free dynamic DNS. Available with [services.duckdns](options.html#opt-services.duckdns.enable)
 
-- [Zoxide](https://github.com/ajeetdsouza/zoxide), a smarter cd command, inspired by z and autojump. Available as [programs.zoxide](options.html#opt-programs.zoxide.enable).
+- [Zoxide](https://github.com/ajeetdsouza/zoxide), a smarter cd command, inspired by z and autojump. Available as [programs.zoxide](options.html#opt-programs.zoxide.enable)
 
-- [victorialogs](https://docs.victoriametrics.com/victorialogs/), log database from VictoriaMetrics. Available as [services.victorialogs](#opt-services.victorialogs.enable).
+- [victorialogs](https://docs.victoriametrics.com/victorialogs/), log database from VictoriaMetrics. Available as [services.victorialogs](#opt-services.victorialogs.enable)
 
-- [gokapi](https://github.com/Forceu/Gokapi), Lightweight selfhosted Firefox Send alternative without public upload. AWS S3 supported. Available with [services.gokapi](options.html#opt-services.gokapi.enable).
+- [gokapi](https://github.com/Forceu/Gokapi), Lightweight selfhosted Firefox Send alternative without public upload. AWS S3 supported. Available with [services.gokapi](options.html#opt-services.gokapi.enable)
 
 - [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](options.html#opt-services.nostr-rs-relay.enable).
 
@@ -150,7 +148,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [strfry](https://github.com/hoytech/strfry), a relay for the nostr protocol. Available as [services.strfry](options.html#opt-services.strfry.enable).
 
-- [Prometheus Node Cert Exporter](https://github.com/amimof/node-cert-exporter), a prometheus exporter to check for SSL cert expiry. Available as [services.prometheus.exporters.node-cert](#opt-services.prometheus.exporters.node-cert.enable).
+- [Prometheus Node Cert Exporter](https://github.com/amimof/node-cert-exporter), a prometheus exporter to check for SSL cert expiry. Available under [services.prometheus.exporters.node-cert](#opt-services.prometheus.exporters.node-cert.enable).
 
 - [Actual Budget](https://actualbudget.org/), a local-first personal finance app. Available as [services.actual](#opt-services.actual.enable).
 
@@ -166,7 +164,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [alertmanager-ntfy](https://github.com/alexbakker/alertmanager-ntfy), forwards Prometheus Alertmanager notifications to ntfy.sh. Available as [services.prometheus.alertmanager-ntfy](#opt-services.prometheus.alertmanager-ntfy.enable).
 
-- [Stash](https://github.com/stashapp/stash), an organizer for your adult videos/images, written in Go. Available as [services.stash](#opt-services.stash.enable).
+- [Stash](https://github.com/stashapp/stash), An organizer for your adult videos/images, written in Go. Available as [services.stash](#opt-services.stash.enable).
 
 - [vsmartcard-vpcd](https://frankmorgner.github.io/vsmartcard/virtualsmartcard/README.html), a virtual smart card driver. Available as [services.vsmartcard-vpcd](#opt-services.vsmartcard-vpcd.enable).
 
@@ -206,7 +204,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [KanBoard](https://github.com/kanboard/kanboard), a project management tool that focuses on the Kanban methodology. Available as [services.kanboard](#opt-services.kanboard.enable).
 
-- [git-worktree-switcher](https://github.com/mateusauler/git-worktree-switcher), switch between git worktrees with speed. Available as [programs.git-worktree-switcher](#opt-programs.git-worktree-switcher.enable).
+- [git-worktree-switcher](https://github.com/mateusauler/git-worktree-switcher), switch between git worktrees with speed. Available as [programs.git-worktree-switcher](#opt-programs.git-worktree-switcher.enable)
 
 - [GLPI-Agent](https://github.com/glpi-project/glpi-agent), GLPI Agent. Available as [services.glpiAgent](options.html#opt-services.glpiAgent.enable).
 
@@ -216,23 +214,25 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [Rebuilderd](https://github.com/kpcyrd/rebuilderd) an independent verification of binary packages - Reproducible Builds. Available as [services.rebuilderd](#opt-services.rebuilderd.enable).
 
-- [Limine](https://github.com/limine-bootloader/limine) a modern, advanced, portable, multiprotocol bootloader and boot manager. Available as [boot.loader.limine](#opt-boot.loader.limine.enable).
+- [Limine](https://github.com/limine-bootloader/limine) a modern, advanced, portable, multiprotocol bootloader and boot manager. Available as [boot.loader.limine](#opt-boot.loader.limine.enable)
 
 - [Orthanc](https://orthanc.uclouvain.be/) a lightweight, RESTful DICOM server for healthcare and medical research. Available as [services.orthanc](#opt-services.orthanc.enable).
 
 - [Docling Serve](https://github.com/docling-project/docling-serve) running [Docling](https://github.com/docling-project/docling) as an API service. Available as [services.docling-serve](#opt-services.docling-serve.enable).
 
-- [Pareto Security](https://paretosecurity.com/) is an alternative to corporate compliance solutions for companies that care about security but know it doesn't have to be invasive. Available as [services.paretosecurity](#opt-services.paretosecurity.enable).
+- [Pareto Security](https://paretosecurity.com/) is an alternative to corporate compliance solutions for companies that care about security but know it doesn't have to be invasive. Available as [services.paretosecurity](#opt-services.paretosecurity.enable)
+
+- [Cursor](https://cursor.com/) is a vscode-based editor that uses AI to help you write code faster.
 
 - [GNU Rush](https://gnu.org/software/rush/) is a Restricted User Shell, designed for systems providing limited remote access to their resources. Available as [programs.rush](#opt-programs.rush.enable).
 
-- [ipfs-cluster](https://ipfscluster.io/), Pinset orchestration for IPFS. Available as [services.ipfs-cluster](#opt-services.ipfs-cluster.enable).
+- [ipfs-cluster](https://ipfscluster.io/), Pinset orchestration for IPFS. Available as [services.ipfs-cluster](#opt-services.ipfs-cluster.enable)
 
 - [bitbox-bridge](https://github.com/BitBoxSwiss/bitbox-bridge), a bridge software that connects BitBox hardware wallets to computers & web wallets like [Rabby](https://rabby.io/). Allows one to interact & transact with smart contracts, Web3 websites & financial services without storing private keys anywhere other than the hardware wallet. Available as [services.bitbox-bridge](#opt-services.bitbox-bridge.enable).
 
 - [GoDNS](https://github.com/TimothyYe/godns), a dynamic DNS client written in Go, which supports multiple DNS providers. Available as [services.godns](option.html#opt-services.godns.enable).
 
-- [CookCLI](https://cooklang.org/cli/) Server, a web UI for cooklang recipes. Available as [services.cook-cli](#opt-services.cook-cli.enable).
+- [CookCLI](https://cooklang.org/cli/) Server, a web UI for cooklang recipes.
 
 - [Prometheus eBPF Exporter](https://github.com/cloudflare/ebpf_exporter),
   Prometheus exporter for custom eBPF metrics. Available as
@@ -252,6 +252,8 @@ Alongside many enhancements to NixOS modules and general system improvements, th
   and error starting 25.05 with instructions the following instructions:
   The canonical source for NixOS AMIs is the AWS API. Please see https://nixos.org/download/#nixos-amazon or  https://nixos.github.io/amis/ for instructions.
 
+- The udev rules of the libjaylink package require users to be in the `jlink` instead of `plugdev` group now, since the `plugdev` group is very uncommon for NixOS. Alternatively, access is granted to seat sessions.
+
 - The latest available version of Nextcloud is v31 (available as `pkgs.nextcloud31`). The installation logic is as follows:
   - If [`services.nextcloud.package`](#opt-services.nextcloud.package) is specified explicitly, this package will be installed (**recommended**)
   - If [`system.stateVersion`](#opt-system.stateVersion) is >=24.11, `pkgs.nextcloud30` will be installed by default.
@@ -265,20 +267,11 @@ Alongside many enhancements to NixOS modules and general system improvements, th
   [not recommended by upstream](https://docs.nextcloud.com/server/30/admin_manual/installation/system_requirements.html)
   and thus doesn't qualify as default.
 
-- PowerDNS Recursor has been updated to version 5.1.2, which comes with a new YAML configuration format (`recursor.yml`)
-  and deprecates the previous format (`recursor.conf`). Accordingly, the NixOS option `services.pdns-recursor.settings`
-  has been renamed to [old-settings](#opt-services.pdns-recursor.old-settings) and will be provided for backward compatibility
-  until the next NixOS release. Users are asked to migrate their settings to the new [yaml-settings](#opt-services.pdns-recursor.old-settings)
-  option following this [guide](https://doc.powerdns.com/recursor/appendices/yamlconversion.html).
-  Note that options other than `services.pdns-recursor.settings` are unaffacted by this change.
-
-- The `virtualisation.hypervGuest.videoMode` option has been removed. Standard tooling can now be used to configure display modes for Hyper-V VMs.
-
 - Nextcloud's default FPM pool settings have been increased according to upstream recommentations. It's advised
   to review the new defaults and description of
   [](#opt-services.nextcloud.poolSettings).
 
-- In `users.users` subuid allocation on systems with multiple users it could happen that some users' allocated subuid ranges collided with others. Now these users get new subuid ranges assigned. When this happens, a warning is issued on the first activation. If the subuids were used (e.g. with rootless container managers like podman), please change the ownership of affected files accordingly.
+- In `users.users` allocation on systems with multiple users it could happen that collided with others. Now these users get new subuid ranges assigned. When this happens, a warning is issued on the first activation. If the subuids were used (e.g. with rootless container managers like podman), please change the ownership of affected files accordingly.
 
 - The `services.locate` module does no longer support findutil's `locate` due to its inferior performance compared to `mlocate` and `plocate`. The new default is `plocate`.
   As the `service.locate.localuser` option only applied when using findutil's `locate`, it has also been removed.
@@ -286,6 +279,12 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 - `services.paperless` now installs `paperless-manage` as a normal system package instead of creating a symlink in `/var/lib/paperless`.
   `paperless-manage` now also changes to the appropriate user when being executed.
 
+- The `gotenberg` package has been updated to 8.16.0, which brings breaking changes to the configuration from version 8.13.0. See the [upstream release notes](https://github.com/gotenberg/gotenberg/releases/tag/v8.13.0)
+  for that release to get all the details. The `services.gotenberg` module has been updated appropriately to ensure your configuration is valid with this new release.
+
+- `varnish` was updated from 7.5.0 to 7.7.0, see [Varnish 7.6.0 upgrade guide](https://varnish-cache.org/docs/7.6/whats-new/upgrading-7.6.html) and
+[Varnish 7.7.0 upgrade guide](https://varnish-cache.org/docs/7.7/whats-new/upgrading-7.7.html#whatsnew-upgrading-7-7).
+
 - `asusd` has been upgraded to version 6 which supports multiple aura devices. To account for this, the single `auraConfig` configuration option has been replaced with `auraConfigs` which is an attribute set of config options per each device. The config files may also be now specified as either source files or text strings; to account for this you will need to specify that `text` is used for your existing configs, e.g.:
   ```diff
   -services.asusd.asusdConfig = '''file contents'''
@@ -294,13 +293,19 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - `linuxPackages.nvidiaPackages.stable` now defaults to the `production` variant instead of `latest`.
 
-- `services.paperless.address` no longer accepts a domain name or Unix domain socket.
+- `paperless-ngx` has been updated to minor version 2.15 which switched the web server from Gunicorn to Granian. If you set Gunicorn specific envs (usually contain GUNICORN) they must be updated. Also `services.paperless.address` no longer accepts a domain name and Granian also does not support listening on unix domain sockets.
 
-- `networking.wireguard.enable = true` does not always add `wireguard-tools` to system packages anymore. Only when wireguard interfaces are configured, the backing implementation packages are added to system PATH.
+- `timescaledb` requires manual upgrade steps.
+    After you run ALTER EXTENSION, you must run [this SQL script](https://github.com/timescale/timescaledb-extras/blob/master/utils/2.15.X-fix_hypertable_foreign_keys.sql). For more details, see the following pull requests [#6797](https://github.com/timescale/timescaledb/pull/6797).
+    PostgreSQL 13 is no longer supported in TimescaleDB v2.16.
 
 - `virtualisation/azure-common.nix`'s filesystem and grub configurations have been moved to `virtualisation/azure-image.nix`. This makes `azure-common.nix` more generic so it could be used for users who generate Azure image using other methods (e.g. nixos-generators and disko). For existing users depending on these configurations, please also import `azure-image.nix`.
 
-- `services.signald` has been removed as `signald` is unmaintained upstream and has been incompatible to official Signal servers for a long while.
+- `zammad` has had its support for MySQL removed, since it was never working correctly and is now deprecated upstream. Check the [migration guide](https://docs.zammad.org/en/latest/appendix/migrate-to-postgresql.html) for how to convert your database to PostgreSQL.
+
+- `tauon` 7.9.0+ when launched for the first time, migrates its database to a new schema that is not backwards compatible. Older versions will refuse to start at all with that database afterwards. If you need to still use older tauon versions, make sure to back up `~/.local/share/TauonMusicBox`.
+
+- `aws-workspaces` has dropped support for PCoiP networking.
 
 - The `earlyoom` service is now using upstream systemd service, which enables
   hardening and filesystem isolation by default. If you need filesystem write
@@ -321,17 +326,47 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - `services.bird2` has been renamed to `services.bird` and the default bird package has been switched to `bird3`. `bird2` can still be chosen via the `services.bird.package` option.
 
-- The behavior of the `networking.nat.externalIP` and `networking.nat.externalIPv6` options has been changed. `networking.nat.forwardPorts` now only forwards packets destined for the specified IP addresses.
+- `renovate` was updated to v39. See the [upstream release notes](https://docs.renovatebot.com/release-notes-for-major-versions/#version-39) for breaking changes.
+  Like upstream's docker images, renovate now runs on NodeJS 22.
 
-- `gitlab` has been updated from 17.x to 18.x and requires `postgresql` >= 16, as stated in the [documentation](https://docs.gitlab.com/18.0/install/requirements/#postgresql). Check the [upgrade guide](#module-services-postgres-upgrading) in the NixOS manual on how to upgrade your PostgreSQL installation.
+- The behavior of the `networking.nat.externalIP` and `networking.nat.externalIPv6` options has been changed. `networking.nat.forwardPorts` now only forwards packets destined for the specified IP addresses.
 
 - `services.gitlab` now requires the setting of `activeRecordPrimaryKeyFile`, `activeRecordDeterministicKeyFile`, `activeRecordSaltFile` as GitLab introduced Rails ActiveRecord encryption.
 
-- The Mattermost module ([`services.mattermost`](#opt-services.mattermost.enable)) and packages (`mattermost` and `mmctl`) have been substantially updated:
-  - `services.mattermost.listenAddress` has been split into [](#opt-services.mattermost.host) and [](#opt-services.mattermost.port). If your `listenAddress` contained a port, you will need to edit your configuration. This will be the only truly breaking change in this release for most configurations.
-  - [](#opt-services.mattermost.preferNixConfig) now defaults to true if you advance [](#opt-system.stateVersion) to 25.05. This means that if you have [](#opt-services.mattermost.mutableConfig) set, NixOS will override settings set in the Admin Console to those that you define in the module configuration. It is recommended to leave this at the default, even if you used a fully mutable configuration before, because it will ensure that your Mattermost data directories are correct. If you moved your data directories, you may want to review the module changes before upgrading.
-  - Mattermost now supports peer authentication on both MySQL and Postgres database backends. Updating [](#opt-system.stateVersion) to 25.05 or later will result in peer authentication being used by default if the Mattermost server would otherwise be connecting to localhost. This is the recommended configuration.
-  - Note that the Mattermost module will create an account _without_ a well-known UID if the username differs from the default (`mattermost`). If you used Mattermost with a nonstandard username, you may want to review the module changes before upgrading.
+- `python3Packages.bpycv` has been removed due to being incompatible with Blender 4 and unmaintained.
+
+- `python3Packages.jaeger-client` was removed because it was deprecated upstream. [OpenTelemetry](https://opentelemetry.io) is the recommended replacement.
+
+- `rocmPackages.rocm-thunk` has been removed and its functionality has been integrated with the ROCm CLR. Use `rocmPackages.clr` instead.
+
+- `rocmPackages.clang-ocl` has been removed. [It was deprecated by AMD in 2023.](https://github.com/ROCm/clang-ocl)
+
+- `nodePackages.meshcommander` has been removed, as the package was deprecated by Intel.
+
+- The default version of `z3` has been updated from 4.8 to 4.13. There are still a few packages that need specific older versions; those will continue to be maintained as long as other packages depend on them but may be removed in the future.
+
+- `prometheus` has been updated from 2.55.0 to 3.1.0.
+  Read the [release blog post](https://prometheus.io/blog/2024/11/14/prometheus-3-0/) and
+  [migration guide](https://prometheus.io/docs/prometheus/3.1/migration/).
+
+- `kanata` was updated to v1.8.0, which introduces several breaking changes.
+  See the release notes of
+  [v1.7.0](https://github.com/jtroo/kanata/releases/tag/v1.7.0) and
+  [v1.8.0](https://github.com/jtroo/kanata/releases/tag/v1.8.0)
+  for more information.
+
+- `authelia` version 4.39.0 has made changes on the default claims for ID Tokens, to mirror the standard claims from the specification.
+  This change may affect some clients in unexpected ways, so manual intervention may be required.
+  Read the [release notes](https://www.authelia.com/blog/4.39-release-notes/), along with [the guide](https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter) to work around issues that may be encountered.
+
+- `ags` was updated to v2, which is just a CLI for Astal now. Components are available as a different package set `astal.*`.
+  If you want to use v1, it is available as `ags_1` package.
+
+  See the release notes of
+  [v2.0.0](https://github.com/Aylur/ags/releases/tag/v2.0.0)
+  for more information.
+
+- `nodePackages.expo-cli` has been removed, as it was deprecated by upstream. The suggested replacement is the `npx expo` command.
 
 - DokuWiki with the Caddy webserver (`services.dokuwiki.webserver = "caddy"`) now sets up sites with Caddy's automatic HTTPS instead of HTTP-only.
   To keep the old behavior for a site `example.com`, set `services.caddy.virtualHosts."example.com".hostName = "http://example.com"`.
@@ -341,10 +376,21 @@ Alongside many enhancements to NixOS modules and general system improvements, th
   Given a site example.com, http://example.com now 301 redirects to https://example.com.
   To keep the old behavior for a site `example.com`, set `services.caddy.virtualHosts."example.com".hostName = "http://example.com"`.
 
+- `slskd` has been updated to v0.22.3, which includes breaking changes to `script` integrations. Please review the [changelog](https://github.com/slskd/slskd/releases/tag/0.22.3)
+  and the accompanying [pull request](https://github.com/slskd/slskd/pull/1292).
+
+- `forgejo` and `forgejo-lts` have been updated to v11.
+  See upstreams [release blog post](https://forgejo.org/2025-04-release-v11-0/) for more information.
+
+- `unifi` has been updated to v9.1.
+  This version should be backward compatible with v8.x, however as a result, `unifi8` package has been removed.
+
 - The behavior of `services.hostapd.radios.<name>.networks.<name>.authentication.enableRecommendedPairwiseCiphers` was changed to not include `CCMP-256` anymore.
   Since all configured pairwise ciphers have to be supported by the radio, this caused startup failures on many devices which is hard to debug in hostapd.
 
-- The `hardware.gkraken` module has been removed. The recommended alternative is [`programs.coolercontrol`](#opt-programs.coolercontrol.enable).
+- The `conduwuit` matrix server implementation has officially been discontinued by upstream and the package has thus been marked as vulnerable, as it is a security-sensitive package that has reached EOL.
+
+- `gkraken` software and `hardware.gkraken.enable` option have been removed, use `coolercontrol` via `programs.coolercontrol.enable` option instead.
 
 - To avoid delaying user logins unnecessarily the `multi-user.target` is no longer ordered after `network-online.target`.
   System services requiring a connection to start correctly must explicitly state so, i.e.
@@ -375,7 +421,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
   Names are now known at evaluation time and customizable via the new options `image.baseName`, `image.extension`, `image.fileName` and `image.filePath` with the latter returning a path relative to the derivations out path (e.g. `iso/${image.fileName` for iso images).
 
   | `system.build` Option    | Old Filename                                               | New Filename                                                    |
-  | ------------------------ | ---------------------------------------------------------- | ----------------------------------------------------------------|
+  |--------------------------+------------------------------------------------------------+-----------------------------------------------------------------|
   | amazonImage              | nixos-amazon-image-25.05pre-git-x86_64-linux.vhd           | nixos-image-amazon-25.05pre-git-x86_64-linux.vhd                |
   | azureImage               | disk.vhd                                                   | nixos-image-azure-25.05pre-git-x86_64-linux.vhd                 |
   | digitalOceanImage        | nixos.qcow2.gz                                             | nixos-image-digital-ocean-25.05pre-git-x86_64-linux.qcow2.gz    |
@@ -398,10 +444,10 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - `security.apparmor.policies.<name>.enforce` and `security.apparmor.policies.<name>.enable` were removed.
   Configuring the state of apparmor policies must now be done using `security.apparmor.policies.<name>.state` tristate option.
-
 - `services.graylog.package` now defaults to `graylog-6_0` as previous default `graylog-5_1` is EOL and therefore removed.
   Check the migration guides on [5.1→5.2](https://go2docs.graylog.org/5-2/upgrading_graylog/upgrading_to_graylog_5.2.x.htm) and [5.2→6.0](https://go2docs.graylog.org/6-0/upgrading_graylog/upgrading_to_graylog_6.0.x.html) for breaking changes.
 
+
 - `programs.clash-verge.tunMode` was deprecated and removed because now service mode is necessary to start program. Without `programs.clash-verge.enable`, clash-verge-rev will refuse to start.
 - `services.discourse` now requires PostgreSQL 15 per default. Please update before upgrading.
 
@@ -440,8 +486,6 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - PAM services for `i3lock`/`i3lock-color`, `vlock`, `xlock`, and `xscreensaver` now default to disabled unless other corresponding NixOS options are set (`programs.i3lock.enable`, `console.enable`, `services.xserver.enable`, and `services.xscreensaver.enable`, respectively). If for some reason you want one of them back without setting the corresponding option, set, e.g., `security.pam.services.xlock.enable = true`.
 
-- The `nixos-generate-config` command now supports a optional `--flake` option, which will generate a flake.nix file alongside the `configuration.nix` and `hardware-configuration.nix`, providing an easy introduction into flake-based system configurations.
-
 - [`system.stateVersion`](#opt-system.stateVersion) is now validated and must be in the `"YY.MM"` format, ideally corresponding to a prior NixOS release.
 
 - [`hardware.xone`](options.html#opt-hardware.xone.enable) will also enable [`hardware.xpad-noone`](options.html#opt-hardware.xpad-noone.enable) to provide Xbox 360 driver by default.
@@ -485,15 +529,21 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - `networking.wireguard` now has an optional networkd backend. It is enabled by default when `networking.useNetworkd` is enabled, and it can be enabled alongside scripted networking with `networking.wireguard.useNetworkd`. Some `networking.wireguard` options have slightly different behavior with the networkd and script-based backends, documented in each option.
 
+- The `stackclashprotection` hardening flag has been enabled by default on compilers that support it.
+
 - `services.rss-bridge` now has a `package` option as well as support for `caddy` as reverse proxy.
 
 - `services.avahi.ipv6` now defaults to true.
 
+- A new hardening flag, `nostrictaliasing` was made available, corresponding to the gcc/clang option `-fno-strict-aliasing`.
+
 - In the `services.xserver.displayManager.startx` module, two new options [generateScript](#opt-services.xserver.displayManager.startx.generateScript) and [extraCommands](#opt-services.xserver.displayManager.startx.extraCommands) have been added to to declaratively configure the .xinitrc script.
 
 - All services that require a root certificate bundle now use the value of a new read-only option, `security.pki.caBundle`.
 
-- [`services.hddfancontrol`](#opt-services.hddfancontrol.enable) has been modified to use an attribute set for settings, enabling configurations with multiple instances of the daemon running at once (e.g., for two separate drive bays).
+- hddfancontrol has been updated to major release 2. See the [migration guide](https://github.com/desbma/hddfancontrol/tree/master?tab=readme-ov-file#migrating-from-v1x), as there are breaking changes.
+
+- `nextcloud-news-updater` is unmaintained and was removed from nixpkgs.
 
 - `services.cloudflared` now uses a dynamic user, and its `user` and `group` options have been removed. If the user or group is still necessary, they can be created manually.
 
@@ -517,34 +567,63 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - There is a new set of NixOS test tools for testing virtual Wi-Fi networks in many different topologies. See the {option}`services.vwifi` module, {option}`services.kismet` NixOS test, and [manual](https://nixos.org/manual/nixpkgs/unstable/#sec-nixos-test-wifi) for documentation and examples.
 
-- The paperless module now has an option for regular automatic export of documents data using the integrated document exporter.
-
-- Exposed the `paperless-manage` script package via the `services.paperless.manage` read-only option.
+- The paperless module now has an option for regular automatic export of
+  documents data using the integrated document exporter.
 
 - New options for the declarative configuration of the user space part of ALSA have been introduced under [hardware.alsa](options.html#opt-hardware.alsa.enable), including setting the default capture and playback device, defining sound card aliases and volume controls.
   Note: these are intended for users not running a sound server like PulseAudio or PipeWire, but having ALSA as their only sound system.
 
 - `services.k3s` now provides the `autoDeployCharts` option that allows to automatically deploy Helm charts via the k3s Helm controller.
 
-- [Mattermost](#opt-services.mattermost.enable), a self-hosted chat collaboration platform supporting calls, playbooks, and boards, has been updated. It now has multiple versions, disabled telemetry, and a native frontend build in nixpkgs, removing all upstream prebuilt blobs.
-  - Mattermost telemetry reporting is now disabled by default, though security update notifications are enabled. Look at [`services.mattermost.telemetry`](#opt-services.mattermost.telemetry.enableDiagnostics) for options to control this behavior.
-  - The Mattermost module will produce eval warnings if a database password would end up in the Nix store, and recommend alternatives such as peer authentication or using the environment file.
-  - We now support `mmctl` for Mattermost administration if both [](#opt-services.mattermost.socket.enable) and [](#opt-services.mattermost.socket.export) are set, which export the Mattermost control socket path into the system environment.
+- Caddy can now be built with plugins by using `caddy.withPlugins`, a `passthru` function that accepts an attribute set as a parameter. The `plugins` argument represents a list of Caddy plugins, with each Caddy plugin being a versioned module. The `hash` argument represents the `vendorHash` of the resulting Caddy source code with the plugins added.
+
+  Example:
+  ```nix
+  services.caddy = {
+    enable = true;
+    package = pkgs.caddy.withPlugins {
+      plugins = [
+        # tagged upstream
+        "github.com/caddy-dns/powerdns@v1.0.1"
+        # pseudo-version number generated by Go
+        "github.com/caddy-dns/cloudflare@v0.0.0-20240703190432-89f16b99c18e"
+        "github.com/mholt/caddy-webdav@v0.0.0-20241008162340-42168ba04c9d"
+      ];
+      hash = "sha256-wqXSd1Ep9TVpQi570TTb96LwzNYvWL5EBJXMJfYWCAk=";
+    };
+  };
+  ```
+
+  To get the necessary hash of the vendored dependencies, omit `hash`. The build will fail and tell you the correct value.
+
+  Note that all provided plugins must have versions/tags (string after `@`), even if upstream repo does not tag each release. For untagged plugins, you can either create an empty Go project and run `go get <plugin>` and see changes in `go.mod` to get the pseudo-version number, or provide a commit hash in place of version/tag for the first run, and update the plugin string based on the error output.
+
+- `buildGoModule` now supports a self-referencing `finalAttrs:` parameter
+  containing the final arguments including overrides.
+  This allows packaging configuration to be overridden in a consistent manner by
+  providing an alternative to `rec {}` syntax.
+
+- KDE Partition Manager `partitionmanager`'s support for ReiserFS is removed.
+  ReiserFS has not been actively maintained for many years. It has been marked as obsolete since Linux 6.6, and
+  [is removed](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c01f664e4ca210823b7594b50669bbd9b0a3c3b0)
+  in Linux 6.13.
 
 - `services.geoclue2` now uses [beaconDB](https://beacondb.net/) as a default geolocation service, replacing Mozilla Location Services which was [retired in June 2024](https://github.com/mozilla/ichnaea/issues/2065).
 
-- `security.acme` now supports renewal using CSRs (Certificate Signing Request) through the options `security.acme.*.csr` and `security.acme.*.csrKey`.
+- `authelia` version 4.39.0 has made some changes which deprecate older configurations.
+  They are still expected to be working until future version 5.0.0, but will generate warnings in logs.
+  Read the [release notes](https://www.authelia.com/blog/4.39-release-notes/) for human readable summaries of the changes.
 
 - `programs.fzf.keybindings` now supports the fish shell.
 
+- `gerbera` now has wavpack support.
+
+- `octave` (and `octaveFull`) was updated to version `10.x`. The update broke a few `octavePackages`, and `librsb`. See [the PR's commits](https://github.com/NixOS/nixpkgs/pull/394495/commits) for more details.
+
 - A toggle has been added under `users.users.<name>.enable` to allow toggling individual users conditionally. If set to false, the user account will not be created.
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-## NixOS Wiki {#sec-release-25.05-wiki}
-
-The official NixOS Wiki at [wiki.nixos.org](https://wiki.nixos.org) has new and improved articles, new contributors and some improvements in its dark theme and mobile readability.
-
 ```{=include=} sections
 ../release-notes-nixpkgs/rl-2505.section.md
 ```

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -1,25 +0,0 @@
-# Release 25.11 (2025.11/??) {#sec-release-25.11}
-
-## Highlights {#sec-release-25.11-highlights}
-
-<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
-
-- Create the first release note entry in this section!
-
-## New Modules {#sec-release-25.11-new-modules}
-
-<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
-
-- [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).
-
-## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
-
-<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
-
-- Create the first release note entry in this section!
-
-## Other Notable Changes {#sec-release-25.11-notable-changes}
-
-<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
-
-- Create the first release note entry in this section!

nixos/lib/testing/default.nix

@@ -9,13 +9,15 @@ let
     };
   runTest =
     module:
-    (evalTest (
-      { config, ... }:
-      {
-        imports = [ module ];
-        result = config.test;
-      }
-    )).config.result;
+    # Infra issue: virtualization on darwin doesn't seem to work yet.
+    lib.addMetaAttrs { hydraPlatforms = lib.platforms.linux; }
+      (evalTest (
+        { config, ... }:
+        {
+          imports = [ module ];
+          result = config.test;
+        }
+      )).config.result;
 
   testModules = [
     ./call-test.nix

nixos/lib/testing/meta.nix

@@ -1,61 +1,50 @@
 { lib, ... }:
 let
-  inherit (lib) types mkOption literalMD;
+  inherit (lib) types mkOption;
 in
 {
   options = {
-    meta = mkOption {
+    meta = lib.mkOption {
       description = ''
         The [`meta`](https://nixos.org/manual/nixpkgs/stable/#chap-meta) attributes that will be set on the returned derivations.
 
         Not all [`meta`](https://nixos.org/manual/nixpkgs/stable/#chap-meta) attributes are supported, but more can be added as desired.
       '';
       apply = lib.filterAttrs (k: v: v != null);
-      type = types.submodule (
-        { config, ... }:
-        {
-          options = {
-            maintainers = mkOption {
-              type = types.listOf types.raw;
-              default = [ ];
-              description = ''
-                The [list of maintainers](https://nixos.org/manual/nixpkgs/stable/#var-meta-maintainers) for this test.
-              '';
-            };
-            timeout = mkOption {
-              type = types.nullOr types.int;
-              default = 3600; # 1 hour
-              description = ''
-                The [{option}`test`](#test-opt-test)'s [`meta.timeout`](https://nixos.org/manual/nixpkgs/stable/#var-meta-timeout) in seconds.
-              '';
-            };
-            broken = mkOption {
-              type = types.bool;
-              default = false;
-              description = ''
-                Sets the [`meta.broken`](https://nixos.org/manual/nixpkgs/stable/#var-meta-broken) attribute on the [{option}`test`](#test-opt-test) derivation.
-              '';
-            };
-            platforms = mkOption {
-              type = types.listOf types.raw;
-              default = lib.platforms.linux ++ lib.platforms.darwin;
-              description = ''
-                Sets the [`meta.platforms`](https://nixos.org/manual/nixpkgs/stable/#var-meta-platforms) attribute on the [{option}`test`](#test-opt-test) derivation.
-              '';
-            };
-            hydraPlatforms = mkOption {
-              type = types.listOf types.raw;
-              # Ideally this would default to `platforms` again:
-              # default = config.platforms;
-              default = lib.platforms.linux;
-              defaultText = literalMD "`lib.platforms.linux` only, as the `hydra.nixos.org` build farm does not currently support virtualisation on Darwin.";
-              description = ''
-                Sets the [`meta.hydraPlatforms`](https://nixos.org/manual/nixpkgs/stable/#var-meta-hydraPlatforms) attribute on the [{option}`test`](#test-opt-test) derivation.
-              '';
-            };
+      type = types.submodule {
+        options = {
+          maintainers = lib.mkOption {
+            type = types.listOf types.raw;
+            default = [ ];
+            description = ''
+              The [list of maintainers](https://nixos.org/manual/nixpkgs/stable/#var-meta-maintainers) for this test.
+            '';
           };
-        }
-      );
+          timeout = lib.mkOption {
+            type = types.nullOr types.int;
+            default = 3600; # 1 hour
+            description = ''
+              The [{option}`test`](#test-opt-test)'s [`meta.timeout`](https://nixos.org/manual/nixpkgs/stable/#var-meta-timeout) in seconds.
+            '';
+          };
+          broken = lib.mkOption {
+            type = types.bool;
+            default = false;
+            description = ''
+              Sets the [`meta.broken`](https://nixos.org/manual/nixpkgs/stable/#var-meta-broken) attribute on the [{option}`test`](#test-opt-test) derivation.
+            '';
+          };
+          platforms = lib.mkOption {
+            type = types.listOf types.raw;
+            # darwin could be added, but it would add VM tests that don't work on Hydra.nixos.org (so far)
+            # see https://github.com/NixOS/nixpkgs/pull/303597#issuecomment-2128782362
+            default = lib.platforms.linux;
+            description = ''
+              Sets the [`meta.platforms`](https://nixos.org/manual/nixpkgs/stable/#var-meta-platforms) attribute on the [{option}`test`](#test-opt-test) derivation.
+            '';
+          };
+        };
+      };
       default = { };
     };
   };

nixos/lib/testing/run.nix

@@ -43,30 +43,27 @@ in
   };
 
   config = {
-    rawTestDerivation =
-      assert lib.assertMsg (!config.sshBackdoor.enable)
-        "The SSH backdoor is currently not supported for non-interactive testing! Please make sure to only set `interactive.sshBackdoor.enable = true;`!";
-      hostPkgs.stdenv.mkDerivation {
-        name = "vm-test-run-${config.name}";
+    rawTestDerivation = hostPkgs.stdenv.mkDerivation {
+      name = "vm-test-run-${config.name}";
 
-        requiredSystemFeatures =
-          [ "nixos-test" ]
-          ++ lib.optionals hostPkgs.stdenv.hostPlatform.isLinux [ "kvm" ]
-          ++ lib.optionals hostPkgs.stdenv.hostPlatform.isDarwin [ "apple-virt" ];
+      requiredSystemFeatures =
+        [ "nixos-test" ]
+        ++ lib.optionals hostPkgs.stdenv.hostPlatform.isLinux [ "kvm" ]
+        ++ lib.optionals hostPkgs.stdenv.hostPlatform.isDarwin [ "apple-virt" ];
 
-        buildCommand = ''
-          mkdir -p $out
+      buildCommand = ''
+        mkdir -p $out
 
-          # effectively mute the XMLLogger
-          export LOGFILE=/dev/null
+        # effectively mute the XMLLogger
+        export LOGFILE=/dev/null
 
-          ${config.driver}/bin/nixos-test-driver -o $out
-        '';
+        ${config.driver}/bin/nixos-test-driver -o $out
+      '';
 
-        passthru = config.passthru;
+      passthru = config.passthru;
 
-        meta = config.meta;
-      };
+      meta = config.meta;
+    };
     test = lib.lazyDerivation {
       # lazyDerivation improves performance when only passthru items and/or meta are used.
       derivation = config.rawTestDerivation;

nixos/maintainers/scripts/ec2/amazon-image.nix

@@ -83,7 +83,7 @@ in
 
   # Use a priority just below mkOptionDefault (1500) instead of lib.mkDefault
   # to avoid breaking existing configs using that.
-  config.virtualisation.diskSize = lib.mkOverride 1490 (4 * 1024);
+  config.virtualisation.diskSize = lib.mkOverride 1490 (3 * 1024);
   config.virtualisation.diskSizeAutoSupported = !config.ec2.zfs.enable;
 
   config.system.nixos.tags = [ "amazon" ];
@@ -140,7 +140,7 @@ in
            echo "file ${cfg.format} $rootDisk" >> $out/nix-support/hydra-build-products
 
           ${pkgs.jq}/bin/jq -n \
-            --arg system_version ${lib.escapeShellArg config.system.nixos.version} \
+            --arg system_label ${lib.escapeShellArg config.system.nixos.label} \
             --arg system ${lib.escapeShellArg pkgs.stdenv.hostPlatform.system} \
             --arg root_logical_bytes "$(${pkgs.qemu_kvm}/bin/qemu-img info --output json "$rootDisk" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
             --arg boot_logical_bytes "$(${pkgs.qemu_kvm}/bin/qemu-img info --output json "$bootDisk" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
@@ -148,7 +148,7 @@ in
             --arg root "$rootDisk" \
             --arg boot "$bootDisk" \
            '{}
-             | .label = $system_version
+             | .label = $system_label
              | .boot_mode = $boot_mode
              | .system = $system
              | .disks.boot.logical_bytes = $boot_logical_bytes
@@ -181,13 +181,13 @@ in
            echo "file ${cfg.format} $diskImage" >> $out/nix-support/hydra-build-products
 
           ${pkgs.jq}/bin/jq -n \
-            --arg system_version ${lib.escapeShellArg config.system.nixos.version} \
+            --arg system_label ${lib.escapeShellArg config.system.nixos.label} \
             --arg system ${lib.escapeShellArg pkgs.stdenv.hostPlatform.system} \
             --arg logical_bytes "$(${pkgs.qemu_kvm}/bin/qemu-img info --output json "$diskImage" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
             --arg boot_mode "${amiBootMode}" \
             --arg file "$diskImage" \
              '{}
-             | .label = $system_version
+             | .label = $system_label
              | .boot_mode = $boot_mode
              | .system = $system
              | .logical_bytes = $logical_bytes

nixos/modules/config/i18n.nix

@@ -5,21 +5,15 @@
   ...
 }:
 let
-  sanitizeUTF8Capitalization =
-    lang: (lib.replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] lang);
   aggregatedLocales =
-    [
-      "${config.i18n.defaultLocale}/${config.i18n.defaultCharset}"
-    ]
-    ++ lib.pipe config.i18n.extraLocaleSettings [
-      # See description of extraLocaleSettings for why is this ignored here.
-      (lib.filterAttrs (n: v: n != "LANGUAGE"))
-      (lib.mapAttrs (n: v: (sanitizeUTF8Capitalization v)))
-      (lib.mapAttrsToList (LCRole: lang: lang + "/" + (config.i18n.localeCharsets.${LCRole} or "UTF-8")))
-    ]
-    ++ (builtins.map sanitizeUTF8Capitalization (
-      lib.optionals (builtins.isList config.i18n.extraLocales) config.i18n.extraLocales
-    ))
+    (builtins.map
+      (l: (lib.replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] l) + "/UTF-8")
+      (
+        [ config.i18n.defaultLocale ]
+        ++ (lib.optionals (builtins.isList config.i18n.extraLocales) config.i18n.extraLocales)
+        ++ (lib.attrValues (lib.filterAttrs (n: v: n != "LANGUAGE") config.i18n.extraLocaleSettings))
+      )
+    )
     ++ (lib.optional (builtins.isString config.i18n.extraLocales) config.i18n.extraLocales);
 in
 {
@@ -54,24 +48,16 @@ in
         default = "en_US.UTF-8";
         example = "nl_NL.UTF-8";
         description = ''
-          The default locale. It determines the language for program messages,
-          the format for dates and times, sort order, and so on. Setting the
-          default character set is done via {option}`i18n.defaultCharset`.
-        '';
-      };
-      defaultCharset = lib.mkOption {
-        type = lib.types.str;
-        default = "UTF-8";
-        example = "ISO-8859-8";
-        description = ''
-          The default locale character set.
+          The default locale.  It determines the language for program
+          messages, the format for dates and times, sort order, and so on.
+          It also determines the character set, such as UTF-8.
         '';
       };
 
       extraLocales = lib.mkOption {
         type = lib.types.either (lib.types.listOf lib.types.str) (lib.types.enum [ "all" ]);
         default = [ ];
-        example = [ "nl_NL.UTF-8/UTF-8" ];
+        example = [ "nl_NL.UTF-8" ];
         description = ''
           Additional locales that the system should support, besides the ones
           configured with {option}`i18n.defaultLocale` and
@@ -88,30 +74,9 @@ in
           LC_TIME = "de_DE.UTF-8";
         };
         description = ''
-          A set of additional system-wide locale settings other than `LANG`
-          which can be configured with {option}`i18n.defaultLocale`. Note that
-          the `/UTF-8` suffix used in {option}`i18n.extraLocales` indicates a
-          character set, and it must not be added manually here. To use a
-          non-`UTF-8` character set such as ISO-XXXX-8, the
-          {option}`i18n.localeCharsets` can be used.
-
-          Note that if the [`LANGUAGE`
-          key](https://www.gnu.org/software/gettext/manual/html_node/The-LANGUAGE-variable.html)
-          is used in this option, it is ignored when computing the locales
-          required to be installed, because the possible values of this key are
-          more diverse and flexible then the others.
-        '';
-      };
-      localeCharsets = lib.mkOption {
-        type = lib.types.attrsOf lib.types.str;
-        default = { };
-        example = {
-          LC_MESSAGES = "ISO-8859-15";
-          LC_TIME = "ISO-8859-1";
-        };
-        description = ''
-          Per each {option}`i18n.extraLocaleSettings`, choose the character set
-          to use for it. Essentially defaults to UTF-8 for all of them.
+          A set of additional system-wide locale settings other than
+          `LANG` which can be configured with
+          {option}`i18n.defaultLocale`.
         '';
       };
 

nixos/modules/config/nix-channel.nix

@@ -71,7 +71,7 @@ in
       defaultChannel = mkOption {
         internal = true;
         type = types.str;
-        default = "https://nixos.org/channels/nixos-25.05";
+        default = "https://nixos.org/channels/nixos-unstable";
         description = "Default NixOS channel to which the root user is subscribed.";
       };
     };

nixos/modules/image/file-options.nix

@@ -9,7 +9,6 @@
     baseName = lib.mkOption {
       type = lib.types.str;
       default = "nixos-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}";
-      defaultText = lib.literalExpression "nixos-image-\${config.system.nixos.label}-\${pkgs.stdenv.hostPlatform.system}";
       description = ''
         Basename of the image filename without any extension (e.g. `image_1`).
       '';
@@ -30,7 +29,6 @@
     fileName = lib.mkOption {
       type = lib.types.str;
       default = "${config.image.baseName}.${config.image.extension}";
-      defaultText = lib.literalExpression "\${config.image.baseName}.\${config.image.extension}";
       description = ''
         Filename of the image including all extensions (e.g `image_1.raw` or
         `image_1.raw.zst`).
@@ -40,7 +38,6 @@
     filePath = lib.mkOption {
       type = lib.types.str;
       default = config.image.fileName;
-      defaultText = lib.literalExpression "config.image.fileName";
       description = ''
         Path of the image, relative to `$out` in `system.build.image`.
         While it defaults to `config.image.fileName`, it can be different for builders where

nixos/modules/image/repart.nix

@@ -3,7 +3,6 @@
 
 {
   config,
-  options,
   pkgs,
   lib,
   utils,
@@ -89,31 +88,6 @@ in
 {
   imports = [
     ./repart-verity-store.nix
-    ./file-options.nix
-    (lib.mkRenamedOptionModuleWith {
-      sinceRelease = 2411;
-      from = [
-        "image"
-        "repart"
-        "imageFileBasename"
-      ];
-      to = [
-        "image"
-        "baseName"
-      ];
-    })
-    (lib.mkRenamedOptionModuleWith {
-      sinceRelease = 2411;
-      from = [
-        "image"
-        "repart"
-        "imageFile"
-      ];
-      to = [
-        "image"
-        "fileName"
-      ];
-    })
   ];
 
   options.image.repart = {
@@ -121,7 +95,7 @@ in
     name = lib.mkOption {
       type = lib.types.str;
       description = ''
-          Name of the image.
+        Name of the image.
 
         If this option is unset but config.system.image.id is set,
         config.system.image.id is used as the default value.
@@ -135,6 +109,23 @@ in
       description = "Version of the image";
     };
 
+    imageFileBasename = lib.mkOption {
+      type = lib.types.str;
+      readOnly = true;
+      description = ''
+        Basename of the image filename without any extension (e.g. `image_1`).
+      '';
+    };
+
+    imageFile = lib.mkOption {
+      type = lib.types.str;
+      readOnly = true;
+      description = ''
+        Filename of the image including all extensions (e.g `image_1.raw` or
+        `image_1.raw.zst`).
+      '';
+    };
+
     compression = {
       enable = lib.mkEnableOption "Image compression";
 
@@ -259,37 +250,55 @@ in
       '';
     };
 
-    assertions = lib.mkOption {
-      type = options.assertions.type;
-      default = [ ];
-      internal = true;
-      visible = false;
-      description = ''
-        Assertions only evaluated by the repart image, not by the system toplevel.
-      '';
-    };
-
-    warnings = lib.mkOption {
-      type = options.warnings.type;
-      default = [ ];
-      internal = true;
-      visible = false;
-      description = ''
-        Warnings only evaluated by the repart image, not by the system toplevel.
-      '';
-    };
-
   };
 
   config = {
-    image.baseName =
+
+    assertions = lib.mapAttrsToList (
+      fileName: partitionConfig:
+      let
+        inherit (partitionConfig) repartConfig;
+        labelLength = builtins.stringLength repartConfig.Label;
+      in
+      {
+        assertion = repartConfig ? Label -> GPTMaxLabelLength >= labelLength;
+        message = ''
+          The partition label '${repartConfig.Label}'
+          defined for '${fileName}' is ${toString labelLength} characters long,
+          but the maximum label length supported by UEFI is ${toString GPTMaxLabelLength}.
+        '';
+      }
+    ) cfg.partitions;
+
+    warnings = lib.filter (v: v != null) (
+      lib.mapAttrsToList (
+        fileName: partitionConfig:
+        let
+          inherit (partitionConfig) repartConfig;
+          suggestedMaxLabelLength = GPTMaxLabelLength - 2;
+          labelLength = builtins.stringLength repartConfig.Label;
+        in
+        if (repartConfig ? Label && labelLength >= suggestedMaxLabelLength) then
+          ''
+            The partition label '${repartConfig.Label}'
+            defined for '${fileName}' is ${toString labelLength} characters long.
+            The suggested maximum label length is ${toString suggestedMaxLabelLength}.
+
+            If you use sytemd-sysupdate style A/B updates, this might
+            not leave enough space to increment the version number included in
+            the label in a future release. For example, if your label is
+            ${toString GPTMaxLabelLength} characters long (the maximum enforced by UEFI) and
+            you're at version 9, you cannot increment this to 10.
+          ''
+        else
+          null
+      ) cfg.partitions
+    );
+
+    image.repart =
       let
         version = config.image.repart.version;
         versionInfix = if version != null then "_${version}" else "";
-      in
-      cfg.name + versionInfix;
-    image.extension =
-      let
         compressionSuffix =
           lib.optionalString cfg.compression.enable
             {
@@ -299,11 +308,6 @@ in
             }
             ."${cfg.compression.algorithm}";
 
-      in
-      "raw" + compressionSuffix;
-
-    image.repart =
-      let
         makeClosure = paths: pkgs.closureInfo { rootPaths = paths; };
 
         # Add the closure of the provided Nix store paths to cfg.partitions so
@@ -317,6 +321,9 @@ in
       in
       {
         name = lib.mkIf (config.system.image.id != null) (lib.mkOptionDefault config.system.image.id);
+        imageFileBasename = cfg.name + versionInfix;
+        imageFile = cfg.imageFileBasename + ".raw" + compressionSuffix;
+
         compression = {
           # Generally default to slightly faster than default compression
           # levels under the assumption that most of the building will be done
@@ -332,47 +339,6 @@ in
         };
 
         finalPartitions = lib.mapAttrs addClosure cfg.partitions;
-
-        assertions = lib.mapAttrsToList (
-          fileName: partitionConfig:
-          let
-            inherit (partitionConfig) repartConfig;
-            labelLength = builtins.stringLength repartConfig.Label;
-          in
-          {
-            assertion = repartConfig ? Label -> GPTMaxLabelLength >= labelLength;
-            message = ''
-              The partition label '${repartConfig.Label}'
-              defined for '${fileName}' is ${toString labelLength} characters long,
-              but the maximum label length supported by UEFI is ${toString GPTMaxLabelLength}.
-            '';
-          }
-        ) cfg.partitions;
-
-        warnings = lib.filter (v: v != null) (
-          lib.mapAttrsToList (
-            fileName: partitionConfig:
-            let
-              inherit (partitionConfig) repartConfig;
-              suggestedMaxLabelLength = GPTMaxLabelLength - 2;
-              labelLength = builtins.stringLength repartConfig.Label;
-            in
-            if (repartConfig ? Label && labelLength >= suggestedMaxLabelLength) then
-              ''
-                The partition label '${repartConfig.Label}'
-                defined for '${fileName}' is ${toString labelLength} characters long.
-                The suggested maximum label length is ${toString suggestedMaxLabelLength}.
-
-                If you use sytemd-sysupdate style A/B updates, this might
-                not leave enough space to increment the version number included in
-                the label in a future release. For example, if your label is
-                ${toString GPTMaxLabelLength} characters long (the maximum enforced by UEFI) and
-                you're at version 9, you cannot increment this to 10.
-              ''
-            else
-              null
-          ) cfg.partitions
-        );
       };
 
     system.build.image =
@@ -388,22 +354,21 @@ in
         );
 
         mkfsEnv = mkfsOptionsToEnv cfg.mkfsOptions;
-        val = pkgs.callPackage ./repart-image.nix {
-          systemd = cfg.package;
-          imageFileBasename = config.image.baseName;
-          inherit (cfg)
-            name
-            version
-            compression
-            split
-            seed
-            sectorSize
-            finalPartitions
-            ;
-          inherit fileSystems definitionsDirectory mkfsEnv;
-        };
       in
-      lib.asserts.checkAssertWarn cfg.assertions cfg.warnings val;
+      pkgs.callPackage ./repart-image.nix {
+        systemd = cfg.package;
+        inherit (cfg)
+          name
+          version
+          imageFileBasename
+          compression
+          split
+          seed
+          sectorSize
+          finalPartitions
+          ;
+        inherit fileSystems definitionsDirectory mkfsEnv;
+      };
   };
 
   meta.maintainers = with lib.maintainers; [

nixos/modules/misc/version.nix

@@ -58,7 +58,6 @@ let
       VARIANT = optionalString (cfg.variantName != null) cfg.variantName;
       VARIANT_ID = optionalString (cfg.variant_id != null) cfg.variant_id;
       DEFAULT_HOSTNAME = config.system.nixos.distroId;
-      SUPPORT_END = "2025-12-31";
     }
     // cfg.extraOSReleaseArgs;
 

nixos/modules/module-list.nix

@@ -160,7 +160,6 @@
   ./programs/arp-scan.nix
   ./programs/atop.nix
   ./programs/ausweisapp.nix
-  ./programs/autoenv.nix
   ./programs/autojump.nix
   ./programs/bandwhich.nix
   ./programs/bash-my-aws.nix
@@ -187,6 +186,7 @@
   ./programs/corefreq.nix
   ./programs/cpu-energy-meter.nix
   ./programs/criu.nix
+  ./programs/darling.nix
   ./programs/dconf.nix
   ./programs/digitalbitbox/default.nix
   ./programs/direnv.nix
@@ -331,7 +331,6 @@
   ./programs/vivid.nix
   ./programs/wavemon.nix
   ./programs/wayland/cardboard.nix
-  ./programs/wayland/gtklock.nix
   ./programs/wayland/hyprland.nix
   ./programs/wayland/hyprlock.nix
   ./programs/wayland/labwc.nix
@@ -604,6 +603,7 @@
   ./services/games/archisteamfarm.nix
   ./services/games/armagetronad.nix
   ./services/games/crossfire-server.nix
+  ./services/games/deliantra-server.nix
   ./services/games/factorio.nix
   ./services/games/freeciv.nix
   ./services/games/mchprs.nix
@@ -752,7 +752,6 @@
   ./services/matrix/appservice-discord.nix
   ./services/matrix/appservice-irc.nix
   ./services/matrix/conduit.nix
-  ./services/matrix/continuwuity.nix
   ./services/matrix/dendrite.nix
   ./services/matrix/hebbot.nix
   ./services/matrix/hookshot.nix
@@ -904,6 +903,7 @@
   ./services/misc/servarr/whisparr.nix
   ./services/misc/serviio.nix
   ./services/misc/sickbeard.nix
+  ./services/misc/signald.nix
   ./services/misc/siproxd.nix
   ./services/misc/snapper.nix
   ./services/misc/soft-serve.nix
@@ -1076,7 +1076,6 @@
   ./services/networking/bitlbee.nix
   ./services/networking/blockbook-frontend.nix
   ./services/networking/blocky.nix
-  ./services/networking/cato-client.nix
   ./services/networking/centrifugo.nix
   ./services/networking/cgit.nix
   ./services/networking/charybdis.nix
@@ -1609,7 +1608,6 @@
   ./services/web-apps/nostr-rs-relay.nix
   ./services/web-apps/ocis.nix
   ./services/web-apps/olivetin.nix
-  ./services/web-apps/oncall.nix
   ./services/web-apps/onlyoffice.nix
   ./services/web-apps/open-web-calendar.nix
   ./services/web-apps/openvscode-server.nix

nixos/modules/profiles/nix-builder-vm.nix

@@ -126,20 +126,6 @@ in
     # TODO system.switch.enable = false;?
     system.disableInstallerTools = true;
 
-    # Allow the system derivation to be substituted, so that
-    # users are less likely to run into a state where they need
-    # the builder running to build the builder if they just want
-    # to make a tweak that only affects the macOS side of things,
-    # like changing the QEMU args.
-    #
-    # TODO(winter): Move to qemu-vm? Trying it here for now as a
-    # low impact change that'll probably improve people's experience.
-    #
-    # (I have no clue what is going on in https://github.com/nix-darwin/nix-darwin/issues/1081
-    # though, as this fix would only apply to one person in that thread... hopefully someone
-    # comes across with a reproducer if this doesn't do it.)
-    system.systemBuilderArgs.allowSubstitutes = true;
-
     nix.settings = {
       min-free = cfg.min-free;
 
@@ -177,7 +163,7 @@ in
 
         hostPkgs = config.virtualisation.host.pkgs;
 
-        add-keys = hostPkgs.writeShellScriptBin "add-keys" (
+        script = hostPkgs.writeShellScriptBin "create-builder" (
           ''
             set -euo pipefail
           ''
@@ -205,22 +191,10 @@ in
             if ! ${hostPkgs.diffutils}/bin/cmp "''${PUBLIC_KEY}" ${publicKey}; then
               (set -x; sudo --reset-timestamp ${installCredentials} "''${KEYS}")
             fi
+            KEYS="$(${hostPkgs.nix}/bin/nix-store --add "$KEYS")" ${lib.getExe config.system.build.vm}
           ''
         );
 
-        run-builder = hostPkgs.writeShellScriptBin "run-builder" (''
-          set -euo pipefail
-          KEYS="''${KEYS:-./keys}"
-          KEYS="$(${hostPkgs.nix}/bin/nix-store --add "$KEYS")" ${lib.getExe config.system.build.vm}
-        '');
-
-        script = hostPkgs.writeShellScriptBin "create-builder" (''
-          set -euo pipefail
-          export KEYS="''${KEYS:-./keys}"
-          ${lib.getExe add-keys}
-          ${lib.getExe run-builder}
-        '');
-
       in
       script.overrideAttrs (old: {
         pos = __curPos; # sets meta.position to point here; see script binding above for package definition
@@ -231,8 +205,6 @@ in
           # Let users in the repl inspect the config
           nixosConfig = config;
           nixosOptions = options;
-
-          inherit add-keys run-builder;
         };
       });
 

nixos/modules/programs/darling.nix

@@ -0,0 +1,27 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.darling;
+in
+{
+  options = {
+    programs.darling = {
+      enable = lib.mkEnableOption "Darling, a Darwin/macOS compatibility layer for Linux";
+      package = lib.mkPackageOption pkgs "darling" { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    security.wrappers.darling = {
+      source = lib.getExe cfg.package;
+      owner = "root";
+      group = "root";
+      setuid = true;
+    };
+  };
+}

nixos/modules/programs/foot/zshrc

@@ -8,6 +8,7 @@ function osc7-pwd() {
 function chpwd-osc7-pwd() {
     (( ZSH_SUBSHELL )) || osc7-pwd
 }
+add-zsh-hook -Uz chpwd chpwd-osc7-pwd
 
 precmd() {
     print -Pn "\e]133;A\e\\"
@@ -22,6 +23,3 @@ function precmd {
 function preexec {
     print -n "\e]133;C\e\\"
 }
-
-autoload -U add-zsh-hook
-add-zsh-hook -Uz chpwd chpwd-osc7-pwd

nixos/modules/programs/nm-applet.nix

@@ -28,7 +28,6 @@
       description = "Network manager applet";
       wantedBy = [ "graphical-session.target" ];
       partOf = [ "graphical-session.target" ];
-      after = [ "graphical-session.target" ];
       serviceConfig.ExecStart = "${pkgs.networkmanagerapplet}/bin/nm-applet ${lib.optionalString config.programs.nm-applet.indicator "--indicator"}";
     };
 

nixos/modules/programs/wayland/gtklock.nix

@@ -1,78 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.programs.gtklock;
-  configFormat = pkgs.formats.ini {
-    listToValue = builtins.concatStringsSep ";";
-  };
-
-  inherit (lib)
-    types
-    mkOption
-    mkEnableOption
-    mkPackageOption
-    ;
-in
-{
-  options.programs.gtklock = {
-    enable = mkEnableOption "gtklock, a GTK-based lockscreen for Wayland";
-
-    package = mkPackageOption pkgs "gtklock" { };
-
-    config = mkOption {
-      type = configFormat.type;
-      example = lib.literalExpression ''
-        {
-          main = {
-            idle-hide = true;
-            idle-timeout = 10;
-          };
-        }'';
-      description = ''
-        Configuration for gtklock.
-        See [`gtklock(1)`](https://github.com/jovanlanik/gtklock/blob/master/man/gtklock.1.scd) man page for details.
-      '';
-    };
-
-    style = mkOption {
-      type = with types; nullOr str;
-      default = null;
-      description = ''
-        CSS Stylesheet for gtklock.
-        See [gtklock's wiki](https://github.com/jovanlanik/gtklock/wiki#Styling) for details.
-      '';
-    };
-
-    modules = mkOption {
-      type = with types; listOf package;
-      default = [ ];
-      example = lib.literalExpression ''
-        with pkgs; [
-          gtklock-playerctl-module
-          gtklock-powerbar-module
-          gtklock-userinfo-module
-        ]'';
-      description = "gtklock modules to load.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    programs.gtklock.config.main = {
-      style = lib.mkIf (cfg.style != null) "${pkgs.writeText "style.css" cfg.style}";
-
-      modules = lib.mkIf (cfg.modules != [ ]) (
-        map (pkg: "${pkg}/lib/gtklock/${lib.removePrefix "gtklock-" pkg.pname}.so") cfg.modules
-      );
-    };
-
-    environment.etc."xdg/gtklock/config.ini".source = configFormat.generate "config.ini" cfg.config;
-
-    environment.systemPackages = [ cfg.package ];
-
-    security.pam.services.gtklock = { };
-  };
-}

nixos/modules/rename.nix

@@ -318,10 +318,6 @@ in
       The conduwuit project has been discontinued by upstream.
       See https://github.com/NixOS/nixpkgs/pull/397902 for more information.
     '')
-    (mkRemovedOptionModule [ "services" "signald" ] ''
-      The signald project is unmaintained and has long been incompatible with the
-      official Signal servers.
-    '')
 
     # Do NOT add any option renames here, see top of the file
   ];

nixos/modules/security/acme/default.nix

@@ -236,16 +236,13 @@ let
 
       # Create hashes for cert data directories based on configuration
       # Flags are separated to avoid collisions
-      hashData =
-        with builtins;
-        ''
-          ${lib.concatStringsSep " " data.extraLegoFlags} -
-          ${lib.concatStringsSep " " data.extraLegoRunFlags} -
-          ${lib.concatStringsSep " " data.extraLegoRenewFlags} -
-          ${toString acmeServer} ${toString data.dnsProvider}
-          ${toString data.ocspMustStaple} ${data.keyType}
-        ''
-        + (lib.optionalString (data.csr != null) (" - " + data.csr));
+      hashData = with builtins; ''
+        ${lib.concatStringsSep " " data.extraLegoFlags} -
+        ${lib.concatStringsSep " " data.extraLegoRunFlags} -
+        ${lib.concatStringsSep " " data.extraLegoRenewFlags} -
+        ${toString acmeServer} ${toString data.dnsProvider}
+        ${toString data.ocspMustStaple} ${data.keyType}
+      '';
       certDir = mkHash hashData;
       # TODO remove domainHash usage entirely. Waiting on go-acme/lego#1532
       domainHash = mkHash "${lib.concatStringsSep " " extraDomains} ${data.domain}";
@@ -289,24 +286,18 @@ let
           "--accept-tos" # Checking the option is covered by the assertions
           "--path"
           "."
+          "-d"
+          data.domain
           "--email"
           data.email
+          "--key-type"
+          data.keyType
         ]
         ++ protocolOpts
         ++ lib.optionals (acmeServer != null) [
           "--server"
           acmeServer
         ]
-        ++ lib.optionals (data.csr != null) [
-          "--csr"
-          data.csr
-        ]
-        ++ lib.optionals (data.csr == null) [
-          "--key-type"
-          data.keyType
-          "-d"
-          data.domain
-        ]
         ++ lib.concatMap (name: [
           "-d"
           name
@@ -336,8 +327,6 @@ let
       webroots = lib.remove null (
         lib.unique (builtins.map (certAttrs: certAttrs.webroot) (lib.attrValues config.security.acme.certs))
       );
-
-      certificateKey = if data.csrKey != null then "${data.csrKey}" else "certificates/${keyName}.key";
     in
     {
       inherit accountHash cert selfsignedDeps;
@@ -540,7 +529,7 @@ let
           # Check if we can renew.
           # We can only renew if the list of domains has not changed.
           # We also need an account key. Avoids #190493
-          if cmp -s domainhash.txt certificates/domainhash.txt && [ -e '${certificateKey}' ] && [ -e 'certificates/${keyName}.crt' ] && [ -n "$(find accounts -name '${data.email}.key')" ]; then
+          if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/${keyName}.key' ] && [ -e 'certificates/${keyName}.crt' ] && [ -n "$(find accounts -name '${data.email}.key')" ]; then
 
             # Even if a cert is not expired, it may be revoked by the CA.
             # Try to renew, and silently fail if the cert is not expired.
@@ -575,7 +564,7 @@ let
             touch out/renewed
             echo Installing new certificate
             cp -vp 'certificates/${keyName}.crt' out/fullchain.pem
-            cp -vp '${certificateKey}' out/key.pem
+            cp -vp 'certificates/${keyName}.key' out/key.pem
             cp -vp 'certificates/${keyName}.issuer.crt' out/chain.pem
             ln -sf fullchain.pem out/cert.pem
             cat out/key.pem out/fullchain.pem > out/full.pem
@@ -856,18 +845,6 @@ let
           description = "Domain to fetch certificate for (defaults to the entry name).";
         };
 
-        csr = lib.mkOption {
-          type = lib.types.nullOr lib.types.str;
-          default = null;
-          description = "Path to a certificate signing request to apply when fetching the certificate.";
-        };
-
-        csrKey = lib.mkOption {
-          type = lib.types.nullOr lib.types.str;
-          default = null;
-          description = "Path to the private key to the matching certificate signing request.";
-        };
-
         extraDomainNames = lib.mkOption {
           type = lib.types.listOf lib.types.str;
           default = [ ];
@@ -1136,17 +1113,6 @@ in
                 used for variables suffixed by "_FILE".
               '';
             }
-
-            {
-              assertion = lib.all (
-                certOpts:
-                (certOpts.csr == null && certOpts.csrKey == null)
-                || (certOpts.csr != null && certOpts.csrKey != null)
-              ) certs;
-              message = ''
-                When passing a certificate signing request both `security.acme.certs.${cert}.csr` and `security.acme.certs.${cert}.csrKey` need to be set.
-              '';
-            }
           ]) cfg.certs
         ));
 

nixos/modules/security/tpm2.nix

@@ -75,8 +75,8 @@ in
       package = lib.mkOption {
         description = "tpm2-pkcs11 package to use";
         type = lib.types.package;
-        default = if cfg.abrmd.enable then pkgs.tpm2-pkcs11.abrmd else pkgs.tpm2-pkcs11;
-        defaultText = lib.literalExpression "if config.security.tpm2.abrmd.enable then pkgs.tpm2-pkcs11.abrmd else pkgs.tpm2-pkcs11";
+        default = pkgs.tpm2-pkcs11;
+        defaultText = lib.literalExpression "pkgs.tpm2-pkcs11";
       };
     };
 

nixos/modules/services/accessibility/orca.nix

@@ -20,7 +20,6 @@ in
 
   config = mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
-    systemd.services.display-manager.path = [ cfg.package ];
     services.speechd.enable = true;
   };
 }

nixos/modules/services/accessibility/speechd.nix

@@ -7,6 +7,7 @@
 let
   cfg = config.services.speechd;
   inherit (lib)
+    getExe
     mkEnableOption
     mkIf
     mkPackageOption
@@ -20,12 +21,12 @@ in
     package = mkPackageOption pkgs "speechd" { };
   };
 
+  # FIXME: speechd 0.12 (or whatever the next version is)
+  # will support socket activation, so switch to that once it's out.
   config = mkIf cfg.enable {
     environment = {
       systemPackages = [ cfg.package ];
+      sessionVariables.SPEECHD_CMD = getExe cfg.package;
     };
-    systemd.packages = [ cfg.package ];
-    # have to set `wantedBy` since `systemd.packages` ignores `[Install]`
-    systemd.user.sockets.speech-dispatcher.wantedBy = [ "sockets.target" ];
   };
 }

nixos/modules/services/admin/oxidized.nix

@@ -11,8 +11,6 @@ in
   options.services.oxidized = {
     enable = lib.mkEnableOption "the oxidized configuration backup service";
 
-    package = lib.mkPackageOption pkgs "oxidized" { };
-
     user = lib.mkOption {
       type = lib.types.str;
       default = "oxidized";
@@ -72,8 +70,7 @@ in
     };
 
     routerDB = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      default = null;
+      type = lib.types.path;
       example = lib.literalExpression ''
         pkgs.writeText "oxidized-router.db" '''
           hostname-sw1:powerconnect:username1:password2
@@ -97,57 +94,18 @@ in
       isSystemUser = true;
     };
 
-    systemd.tmpfiles.settings."10-oxidized" =
-      {
-        "${cfg.dataDir}" = {
-          d = {
-            mode = "0750";
-            user = cfg.user;
-            group = cfg.group;
-          };
-        };
-
-        "${cfg.dataDir}/.config" = {
-          d = {
-            mode = "0750";
-            user = cfg.user;
-            group = cfg.group;
-          };
-        };
-
-        "${cfg.dataDir}/.config/oxidized" = {
-          d = {
-            mode = "0750";
-            user = cfg.user;
-            group = cfg.group;
-          };
-        };
-
-        "${cfg.dataDir}/.config/oxidized/config" = {
-          L = {
-            argument = "${cfg.configFile}";
-            user = cfg.user;
-            group = cfg.group;
-          };
-        };
-
-      }
-      // lib.optionalAttrs (cfg.routerDB != null) {
-        "${cfg.dataDir}/.config/oxidized/router.db" = {
-          L = {
-            argument = "${cfg.routerDB}";
-            user = cfg.user;
-            group = cfg.group;
-          };
-        };
-      };
-
     systemd.services.oxidized = {
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
 
+      preStart = ''
+        mkdir -p ${cfg.dataDir}/.config/oxidized
+        ln -f -s ${cfg.routerDB} ${cfg.dataDir}/.config/oxidized/router.db
+        ln -f -s ${cfg.configFile} ${cfg.dataDir}/.config/oxidized/config
+      '';
+
       serviceConfig = {
-        ExecStart = lib.getExe cfg.package;
+        ExecStart = "${pkgs.oxidized}/bin/oxidized";
         User = cfg.user;
         Group = cfg.group;
         UMask = "0077";

nixos/modules/services/audio/music-assistant.nix

@@ -69,9 +69,6 @@ in
       description = "Music Assistant";
       documentation = [ "https://music-assistant.io" ];
 
-      after = [ "network-online.target" ];
-      wants = [ "network-online.target" ];
-
       wantedBy = [ "multi-user.target" ];
 
       environment = {

nixos/modules/services/audio/spotifyd.nix

@@ -28,7 +28,7 @@ in
         type = lib.types.lines;
         description = ''
           (Deprecated) Configuration for Spotifyd. For syntax and directives, see
-          <https://docs.spotifyd.rs/configuration/index.html#config-file>.
+          <https://docs.spotifyd.rs/config/File.html>.
         '';
       };
 
@@ -40,7 +40,7 @@ in
         };
         description = ''
           Configuration for Spotifyd. For syntax and directives, see
-          <https://docs.spotifyd.rs/configuration/index.html#config-file>.
+          <https://docs.spotifyd.rs/config/File.html>.
         '';
       };
     };

nixos/modules/services/games/deliantra-server.nix

@@ -0,0 +1,182 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.deliantra-server;
+  serverPort = 13327;
+in
+{
+  options.services.deliantra-server = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        If enabled, the Deliantra game server will be started at boot.
+      '';
+    };
+
+    package = lib.mkPackageOption pkgs "deliantra-server" {
+      extraDescription = ''
+        ::: {.note}
+        This will also be used for map/arch data, if you don't change {option}`dataDir`
+        :::
+      '';
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.str;
+      default = "${pkgs.deliantra-data}";
+      defaultText = lib.literalExpression ''"''${pkgs.deliantra-data}"'';
+      description = ''
+        Where to store readonly data (maps, archetypes, sprites, etc).
+        Note that if you plan to use the live map editor (rather than editing
+        the maps offline and then nixos-rebuilding), THIS MUST BE WRITEABLE --
+        copy the deliantra-data someplace writeable (say,
+        /var/lib/deliantra/data) and update this option accordingly.
+      '';
+    };
+
+    stateDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/deliantra";
+      description = ''
+        Where to store runtime data (save files, persistent items, etc).
+
+        If left at the default, this will be automatically created on server
+        startup if it does not already exist. If changed, it is the admin's
+        responsibility to make sure that the directory exists and is writeable
+        by the `crossfire` user.
+      '';
+    };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to open ports in the firewall for the server.
+      '';
+    };
+
+    configFiles = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      description = ''
+        Contents of the server configuration files. These will be appended to
+        the example configurations the server comes with and overwrite any
+        default settings defined therein.
+
+        The example here is not comprehensive. See the files in
+        /etc/deliantra-server after enabling this module for full documentation.
+      '';
+      example = lib.literalExpression ''
+        {
+          dm_file = '''
+            admin:secret_password:localhost
+            alice:xyzzy:*
+          ''';
+          motd = "Welcome to Deliantra!";
+          settings = '''
+            # Settings for game mechanics.
+            stat_loss_on_death true
+            armor_max_enchant 7
+          ''';
+          config = '''
+            # Settings for the server daemon.
+            hiscore_url https://deliantra.example.net/scores/
+            max_map_reset 86400
+          ''';
+        }
+      '';
+      default = {
+        motd = "";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.deliantra = {
+      description = "Deliantra server daemon user";
+      home = cfg.stateDir;
+      createHome = false;
+      isSystemUser = true;
+      group = "deliantra";
+    };
+    users.groups.deliantra = { };
+
+    # Merge the cfg.configFiles setting with the default files shipped with
+    # Deliantra.
+    # For most files this consists of reading
+    # ${deliantra}/etc/deliantra-server/${name} and appending the user setting
+    # to it.
+    environment.etc =
+      lib.attrsets.mapAttrs'
+        (
+          name: value:
+          lib.attrsets.nameValuePair "deliantra-server/${name}" {
+            mode = "0644";
+            text =
+              # Deliantra doesn't come with a motd file, but respects it if present
+              # in /etc.
+              (lib.optionalString (name != "motd") (
+                lib.fileContents "${cfg.package}/etc/deliantra-server/${name}"
+              ))
+              + "\n${value}";
+          }
+        )
+        (
+          {
+            motd = "";
+            settings = "";
+            config = "";
+            dm_file = "";
+          }
+          // cfg.configFiles
+        );
+
+    systemd.services.deliantra-server = {
+      description = "Deliantra Server Daemon";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      environment = {
+        DELIANTRA_DATADIR = "${cfg.dataDir}";
+        DELIANTRA_LOCALDIR = "${cfg.stateDir}";
+        DELIANTRA_CONFDIR = "/etc/deliantra-server";
+      };
+
+      serviceConfig = lib.mkMerge [
+        {
+          ExecStart = "${cfg.package}/bin/deliantra-server";
+          Restart = "always";
+          User = "deliantra";
+          Group = "deliantra";
+          WorkingDirectory = cfg.stateDir;
+        }
+        (lib.mkIf (cfg.stateDir == "/var/lib/deliantra") {
+          StateDirectory = "deliantra";
+        })
+      ];
+
+      # The deliantra server needs access to a bunch of files at runtime that
+      # are not created automatically at server startup; they're meant to be
+      # installed in $PREFIX/var/deliantra-server by `make install`. And those
+      # files need to be writeable, so we can't just point at the ones in the
+      # nix store. Instead we take the approach of copying them out of the store
+      # on first run. If `bookarch` already exists, we assume the rest of the
+      # files do as well, and copy nothing -- otherwise we risk ovewriting
+      # server state information every time the server is upgraded.
+      preStart = ''
+        if [ ! -e "${cfg.stateDir}"/bookarch ]; then
+          ${pkgs.rsync}/bin/rsync -a --chmod=u=rwX,go=rX \
+            "${cfg.package}/var/deliantra-server/" "${cfg.stateDir}/"
+        fi
+      '';
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ serverPort ];
+    };
+  };
+}

nixos/modules/services/games/minecraft-server.nix

@@ -45,7 +45,7 @@ let
 
   # To be able to open the firewall, we need to read out port values in the
   # server properties, but fall back to the defaults when those don't exist.
-  # These defaults are from https://minecraft.wiki/w/Server.properties#Java_Edition
+  # These defaults are from https://minecraft.gamepedia.com/Server.properties#Java_Edition_3
   defaultServerPort = 25565;
 
   serverPort = cfg.serverProperties.server-port or defaultServerPort;
@@ -93,8 +93,10 @@ in
         type = lib.types.bool;
         default = false;
         description = ''
-          Whether you agree to [Mojangs EULA](https://www.minecraft.net/eula).
-          This option must be set to `true` to run Minecraft server.
+          Whether you agree to
+          [
+          Mojangs EULA](https://account.mojang.com/documents/minecraft_eula). This option must be set to
+          `true` to run Minecraft server.
         '';
       };
 
@@ -165,10 +167,10 @@ in
           }
         '';
         description = ''
-          Minecraft server properties forthe server.properties file. Only has
+          Minecraft server properties for the server.properties file. Only has
           an effect when {option}`services.minecraft-server.declarative`
           is set to `true`. See
-          <https://minecraft.wiki/w/Server.properties#Java_Edition>
+          <https://minecraft.gamepedia.com/Server.properties#Java_Edition_3>
           for documentation on these values.
         '';
       };
@@ -180,7 +182,7 @@ in
       jvmOpts = lib.mkOption {
         type = lib.types.separatedString " ";
         default = "-Xmx2048M -Xms2048M";
-        # Example options from https://minecraft.wiki/w/Tutorial:Server_startup_script
+        # Example options from https://minecraft.gamepedia.com/Tutorials/Server_startup_script
         example =
           "-Xms4092M -Xmx4092M -XX:+UseG1GC -XX:+CMSIncrementalPacing "
           + "-XX:+CMSClassUnloadingEnabled -XX:ParallelGCThreads=2 "

nixos/modules/services/hardware/hddfancontrol.nix

@@ -18,162 +18,64 @@ in
       "hddfancontrol"
       "smartctl"
     ] "Smartctl is now automatically used when necessary, which makes this option redundant")
-    (lib.mkRemovedOptionModule [
-      "services"
-      "hddfancontrol"
-      "disks"
-    ] "Disks should now be specified per hddfancontrol instance in its attrset")
-    (lib.mkRemovedOptionModule [
-      "services"
-      "hddfancontrol"
-      "pwmPaths"
-    ] "Pwm Paths should now be specified per hddfancontrol instance in its attrset")
-    (lib.mkRemovedOptionModule [
-      "services"
-      "hddfancontrol"
-      "logVerbosity"
-    ] "Log Verbosity should now be specified per hddfancontrol instance in its attrset")
-    (lib.mkRemovedOptionModule [
-      "services"
-      "hddfancontrol"
-      "extraArgs"
-    ] "Extra Args should now be specified per hddfancontrol instance in its attrset")
   ];
 
   options = {
     services.hddfancontrol.enable = lib.mkEnableOption "hddfancontrol daemon";
 
-    services.hddfancontrol.settings = lib.mkOption {
-      type = lib.types.attrsWith {
-        placeholder = "drive-bay-name";
-        elemType = (
-          lib.types.submodule (
-            { ... }:
-            {
-              options = {
-                disks = lib.mkOption {
-                  type = lib.types.listOf lib.types.path;
-                  default = [ ];
-                  description = ''
-                    Drive(s) to get temperature from
-                  '';
-                  example = [ "/dev/sda" ];
-                };
-
-                pwmPaths = lib.mkOption {
-                  type = lib.types.listOf lib.types.path;
-                  default = [ ];
-                  description = ''
-                    PWM filepath(s) to control fan speed (under /sys), followed by initial and fan-stop PWM values
-                  '';
-                  example = [ "/sys/class/hwmon/hwmon2/pwm1:30:10" ];
-                };
-
-                logVerbosity = lib.mkOption {
-                  type = lib.types.enum [
-                    "TRACE"
-                    "DEBUG"
-                    "INFO"
-                    "WARN"
-                    "ERROR"
-                  ];
-                  default = "INFO";
-                  description = ''
-                    Verbosity of the log level
-                  '';
-                };
-
-                extraArgs = lib.mkOption {
-                  type = lib.types.listOf lib.types.str;
-                  default = [ ];
-                  description = ''
-                    Extra commandline arguments for hddfancontrol
-                  '';
-                  example = [
-                    "--min-fan-speed-prct=10"
-                    "--interval=1min"
-                  ];
-                };
-              };
-            }
-          )
-        );
-      };
-      default = { };
+    services.hddfancontrol.disks = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
       description = ''
-        Parameter-sets for each instance of hddfancontrol.
+        Drive(s) to get temperature from
       '';
-      example = lib.literalExpression ''
-        {
-          harddrives = {
-            disks = [
-              "/dev/sda"
-              "/dev/sdb"
-              "/dev/sdc"
-            ];
-            pwmPaths = [
-              "/sys/class/hwmon/hwmon1/pwm1:25:10"
-            ];
-            logVerbosity = "DEBUG";
-          };
-          ssddrives = {
-            disks = [
-              "/dev/sdd"
-              "/dev/sde"
-              "/dev/sdf"
-            ];
-            pwmPaths = [
-              "/sys/class/hwmon/hwmon1/pwm2:25:10"
-            ];
-            extraArgs = [
-              "--interval=30s"
-            ];
-          };
-        }
+      example = [ "/dev/sda" ];
+    };
+
+    services.hddfancontrol.pwmPaths = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      description = ''
+        PWM filepath(s) to control fan speed (under /sys), followed by initial and fan-stop PWM values
       '';
+      example = [ "/sys/class/hwmon/hwmon2/pwm1:30:10" ];
+    };
+
+    services.hddfancontrol.logVerbosity = lib.mkOption {
+      type = lib.types.enum [
+        "TRACE"
+        "DEBUG"
+        "INFO"
+        "WARN"
+        "ERROR"
+      ];
+      default = "INFO";
+      description = ''
+        Verbosity of the log level
+      '';
+    };
+
+    services.hddfancontrol.extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        Extra commandline arguments for hddfancontrol
+      '';
+      example = [
+        "--min-fan-speed-prct=10"
+        "--interval=1min"
+      ];
     };
   };
 
   config = lib.mkIf cfg.enable (
     let
-      args =
-        cnf:
-        lib.concatLists [
-          [ "-d" ]
-          cnf.disks
-          [ "-p" ]
-          cnf.pwmPaths
-          cnf.extraArgs
-        ];
-
-      createService = cnf: {
-        description = "HDD fan control";
-        documentation = [ "man:hddfancontrol(1)" ];
-        after = [ "hddtemp.service" ];
-        wants = [ "hddtemp.service" ];
-        serviceConfig = {
-          ExecStart = "${lib.getExe pkgs.hddfancontrol} -v ${cnf.logVerbosity} daemon ${lib.escapeShellArgs (args cnf)}";
-
-          CPUSchedulingPolicy = "rr";
-          CPUSchedulingPriority = 49;
-
-          ProtectSystem = "strict";
-          PrivateTmp = true;
-          ProtectHome = true;
-          SystemCallArchitectures = "native";
-          MemoryDenyWriteExecute = true;
-          NoNewPrivileges = true;
-        };
-        wantedBy = [ "multi-user.target" ];
-      };
-
-      services = lib.attrsets.mergeAttrsList [
-        (lib.attrsets.mapAttrs' (
-          name: cnf: lib.nameValuePair "hddfancontrol-${name}" (createService cnf)
-        ) cfg.settings)
-        {
-          "hddfancontrol".enable = false;
-        }
+      args = lib.concatLists [
+        [ "-d" ]
+        cfg.disks
+        [ "-p" ]
+        cfg.pwmPaths
+        cfg.extraArgs
       ];
     in
     {
@@ -181,10 +83,16 @@ in
 
       hardware.sensor.hddtemp = {
         enable = true;
-        drives = lib.lists.flatten (lib.attrsets.catAttrs "disks" (lib.attrsets.attrValues cfg.settings));
+        drives = cfg.disks;
       };
 
-      systemd.services = services;
+      systemd.services.hddfancontrol = {
+        wantedBy = [ "multi-user.target" ];
+        environment = {
+          HDDFANCONTROL_LOG_LEVEL = cfg.logVerbosity;
+          HDDFANCONTROL_DAEMON_ARGS = lib.escapeShellArgs args;
+        };
+      };
     }
   );
 }

nixos/modules/services/matrix/continuwuity.nix

@@ -1,268 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.services.matrix-continuwuity;
-  defaultUser = "continuwuity";
-  defaultGroup = "continuwuity";
-
-  format = pkgs.formats.toml { };
-  configFile = format.generate "continuwuity.toml" cfg.settings;
-in
-{
-  meta.maintainers = with lib.maintainers; [
-    nyabinary
-    snaki
-  ];
-  options.services.matrix-continuwuity = {
-    enable = lib.mkEnableOption "continuwuity";
-
-    user = lib.mkOption {
-      type = lib.types.nonEmptyStr;
-      description = ''
-        The user {command}`continuwuity` is run as.
-      '';
-      default = defaultUser;
-    };
-
-    group = lib.mkOption {
-      type = lib.types.nonEmptyStr;
-      description = ''
-        The group {command}`continuwuity` is run as.
-      '';
-      default = defaultGroup;
-    };
-
-    extraEnvironment = lib.mkOption {
-      type = lib.types.attrsOf lib.types.str;
-      description = "Extra Environment variables to pass to the continuwuity server.";
-      default = { };
-      example = {
-        RUST_BACKTRACE = "yes";
-      };
-    };
-
-    package = lib.mkPackageOption pkgs "matrix-continuwuity" { };
-
-    settings = lib.mkOption {
-      type = lib.types.submodule {
-        freeformType = format.type;
-        options = {
-          global.server_name = lib.mkOption {
-            type = lib.types.nonEmptyStr;
-            example = "example.com";
-            description = "The server_name is the name of this server. It is used as a suffix for user and room ids.";
-          };
-          global.address = lib.mkOption {
-            type = lib.types.nullOr (lib.types.listOf lib.types.nonEmptyStr);
-            default = null;
-            example = [
-              "127.0.0.1"
-              "::1"
-            ];
-            description = ''
-              Addresses (IPv4 or IPv6) to listen on for connections by the reverse proxy/tls terminator.
-              If set to `null`, continuwuity will listen on IPv4 and IPv6 localhost.
-              Must be `null` if `unix_socket_path` is set.
-            '';
-          };
-          global.port = lib.mkOption {
-            type = lib.types.listOf lib.types.port;
-            default = [ 6167 ];
-            description = ''
-              The port(s) continuwuity will be running on.
-              You need to set up a reverse proxy in your web server (e.g. apache or nginx),
-              so all requests to /_matrix on port 443 and 8448 will be forwarded to the continuwuity
-              instance running on this port.
-            '';
-          };
-          global.unix_socket_path = lib.mkOption {
-            type = lib.types.nullOr lib.types.path;
-            default = null;
-            description = ''
-              Listen on a UNIX socket at the specified path. If listening on a UNIX socket,
-              listening on an address will be disabled. The `address` option must be set to
-              `null` (the default value). The option {option}`services.continuwuity.group` must
-              be set to a group your reverse proxy is part of.
-
-              This will automatically add a system user "continuwuity" to your system if
-              {option}`services.continuwuity.user` is left at the default, and a "continuwuity"
-              group if {option}`services.continuwuity.group` is left at the default.
-            '';
-          };
-          global.unix_socket_perms = lib.mkOption {
-            type = lib.types.ints.positive;
-            default = 660;
-            description = "The default permissions (in octal) to create the UNIX socket with.";
-          };
-          global.max_request_size = lib.mkOption {
-            type = lib.types.ints.positive;
-            default = 20000000;
-            description = "Max request size in bytes. Don't forget to also change it in the proxy.";
-          };
-          global.allow_registration = lib.mkOption {
-            type = lib.types.bool;
-            default = false;
-            description = ''
-              Whether new users can register on this server.
-
-              Registration with token requires `registration_token` or `registration_token_file` to be set.
-
-              If set to true without a token configured, and
-              `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse`
-              is set to true, users can freely register.
-            '';
-          };
-          global.allow_encryption = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            description = "Whether new encrypted rooms can be created. Note: existing rooms will continue to work.";
-          };
-          global.allow_federation = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            description = ''
-              Whether this server federates with other servers.
-            '';
-          };
-          global.trusted_servers = lib.mkOption {
-            type = lib.types.listOf lib.types.nonEmptyStr;
-            default = [ "matrix.org" ];
-            description = ''
-              Servers listed here will be used to gather public keys of other servers
-              (notary trusted key servers).
-
-              Currently, continuwuity doesn't support inbound batched key requests, so
-              this list should only contain other Synapse servers.
-
-              Example: `[ "matrix.org" "constellatory.net" "tchncs.de" ]`
-            '';
-          };
-          global.database_path = lib.mkOption {
-            readOnly = true;
-            type = lib.types.path;
-            default = "/var/lib/continuwuity/";
-            description = ''
-              Path to the continuwuity database, the directory where continuwuity will save its data.
-              Note that database_path cannot be edited because of the service's reliance on systemd StateDir.
-            '';
-          };
-          global.allow_announcements_check = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            description = ''
-              If enabled, continuwuity will send a simple GET request periodically to
-              <https://continuwuity.org/.well-known/continuwuity/announcements> for any new announcements made.
-            '';
-          };
-        };
-      };
-      default = { };
-      # TOML does not allow null values, so we use null to omit those fields
-      apply = lib.filterAttrsRecursive (_: v: v != null);
-      description = ''
-        Generates the continuwuity.toml configuration file. Refer to
-        <https://continuwuity.org/configuration.html>
-        for details on supported values.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = !(cfg.settings ? global.unix_socket_path) || !(cfg.settings ? global.address);
-        message = ''
-          In `services.continuwuity.settings.global`, `unix_socket_path` and `address` cannot be set at the
-          same time.
-          Leave one of the two options unset or explicitly set them to `null`.
-        '';
-      }
-      {
-        assertion = cfg.user != defaultUser -> config ? users.users.${cfg.user};
-        message = "If `services.continuwuity.user` is changed, the configured user must already exist.";
-      }
-      {
-        assertion = cfg.group != defaultGroup -> config ? users.groups.${cfg.group};
-        message = "If `services.continuwuity.group` is changed, the configured group must already exist.";
-      }
-    ];
-
-    users.users = lib.mkIf (cfg.user == defaultUser) {
-      ${defaultUser} = {
-        group = cfg.group;
-        home = cfg.settings.global.database_path;
-        isSystemUser = true;
-      };
-    };
-
-    users.groups = lib.mkIf (cfg.group == defaultGroup) {
-      ${defaultGroup} = { };
-    };
-
-    systemd.services.continuwuity = {
-      description = "Continuwuity Matrix Server";
-      documentation = [ "https://continuwuity.org/" ];
-      wantedBy = [ "multi-user.target" ];
-      wants = [ "network-online.target" ];
-      after = [ "network-online.target" ];
-      environment = lib.mkMerge [
-        { CONDUWUIT_CONFIG = configFile; }
-        cfg.extraEnvironment
-      ];
-      startLimitBurst = 5;
-      startLimitIntervalSec = 60;
-      serviceConfig = {
-        DynamicUser = true;
-        User = cfg.user;
-        Group = cfg.group;
-
-        DevicePolicy = "closed";
-        LockPersonality = true;
-        MemoryDenyWriteExecute = true;
-        NoNewPrivileges = true;
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectProc = "invisible";
-        ProtectSystem = "strict";
-        PrivateDevices = true;
-        PrivateMounts = true;
-        PrivateTmp = true;
-        PrivateUsers = true;
-        PrivateIPC = true;
-        RemoveIPC = true;
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_UNIX"
-        ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service @resources"
-          "~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc"
-        ];
-        SystemCallErrorNumber = "EPERM";
-
-        StateDirectory = "continuwuity";
-        StateDirectoryMode = "0700";
-        RuntimeDirectory = "continuwuity";
-        RuntimeDirectoryMode = "0750";
-
-        ExecStart = lib.getExe cfg.package;
-        Restart = "on-failure";
-        RestartSec = 10;
-      };
-    };
-  };
-}

nixos/modules/services/misc/gitlab.nix

@@ -1237,8 +1237,8 @@ in
         message = "services.gitlab.secrets.activeRecordSaltFile must be set!";
       }
       {
-        assertion = versionAtLeast postgresqlPackage.version "16";
-        message = "PostgreSQL >= 16 is required to run GitLab 18. Follow the instructions in the manual section for upgrading PostgreSQL here: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading";
+        assertion = versionAtLeast postgresqlPackage.version "14.9";
+        message = "PostgreSQL >= 14.9 is required to run GitLab 17. Follow the instructions in the manual section for upgrading PostgreSQL here: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading";
       }
     ];
 

nixos/modules/services/misc/paperless.nix

@@ -366,21 +366,11 @@ in
         Whether to configure Tika and Gotenberg to process Office and e-mail files with OCR.
       '';
     };
-
-    manage = lib.mkOption {
-      type = lib.types.package;
-      readOnly = true;
-      description = ''
-        The package derivation for the `paperless-manage` wrapper script.
-        Useful for other modules that need to add this specific script to a service's PATH.
-      '';
-    };
   };
 
   config = lib.mkIf cfg.enable (
     lib.mkMerge [
       {
-        services.paperless.manage = manage;
         environment.systemPackages = [ manage ];
 
         services.redis.servers.paperless.enable = lib.mkIf enableRedis true;

nixos/modules/services/misc/signald.nix

@@ -0,0 +1,116 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.signald;
+  dataDir = "/var/lib/signald";
+  defaultUser = "signald";
+in
+{
+  options.services.signald = {
+    enable = lib.mkEnableOption "signald, the unofficial daemon for interacting with Signal";
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = "User under which signald runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = "Group under which signald runs.";
+    };
+
+    socketPath = lib.mkOption {
+      type = lib.types.str;
+      default = "/run/signald/signald.sock";
+      description = "Path to the signald socket";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users = lib.optionalAttrs (cfg.user == defaultUser) {
+      ${defaultUser} = {
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = lib.optionalAttrs (cfg.group == defaultUser) {
+      ${defaultUser} = { };
+    };
+
+    systemd.services.signald = {
+      description = "A daemon for interacting with the Signal Private Messenger";
+      wants = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = "${pkgs.signald}/bin/signald -d ${dataDir} -s ${cfg.socketPath}";
+        ExecStartPre = "${pkgs.signald}/bin/signald -d ${dataDir} -s ${cfg.socketPath} --migrate-data";
+        Restart = "on-failure";
+        StateDirectory = "signald";
+        RuntimeDirectory = "signald";
+        StateDirectoryMode = "0750";
+        RuntimeDirectoryMode = "0750";
+
+        BindReadOnlyPaths = [
+          "/nix/store"
+          "-/etc/resolv.conf"
+          "-/etc/nsswitch.conf"
+          "-/etc/hosts"
+          "-/etc/localtime"
+        ];
+        CapabilityBoundingSet = "";
+        # ProtectClock= adds DeviceAllow=char-rtc r
+        DeviceAllow = "";
+        # Use a static user so other applications can access the files
+        #DynamicUser = true;
+        LockPersonality = true;
+        # Needed for java
+        #MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        # Needs network access
+        #PrivateNetwork = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        # Would re-mount paths ignored by temporary root
+        #ProtectSystem = "strict";
+        ProtectControlGroups = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged @resources @setuid @keyring"
+        ];
+        TemporaryFileSystem = "/:ro";
+        # Does not work well with the temporary root
+        #UMask = "0066";
+      };
+    };
+  };
+}

nixos/modules/services/misc/sourcehut/default.nix

@@ -97,14 +97,13 @@ let
                 # Those paths are mounted using BindPaths= or BindReadOnlyPaths=
                 # for services needing access to them.
                 "builds.sr.ht::worker".buildlogs = "/var/log/sourcehut/buildsrht-worker";
-                "git.sr.ht".post-update-script = "/usr/bin/git.sr.ht-update-hook";
+                "git.sr.ht".post-update-script = "/usr/bin/gitsrht-update-hook";
                 "git.sr.ht".repos = cfg.settings."git.sr.ht".repos;
-                "hg.sr.ht".changegroup-script = "/usr/bin/hg.sr.ht-hook-changegroup";
+                "hg.sr.ht".changegroup-script = "/usr/bin/hgsrht-hook-changegroup";
                 "hg.sr.ht".repos = cfg.settings."hg.sr.ht".repos;
                 # Making this a per service option despite being in a global section,
                 # so that it uses the redis-server used by the service.
                 "sr.ht".redis-host = cfg.${srv}.redis.host;
-                "sr.ht".assets = "${cfg.${srv}.package}/share/sourcehut";
               }
             )
         )
@@ -377,7 +376,7 @@ in
           redis = mkOption {
             description = "The Redis connection used for the Celery worker.";
             type = types.str;
-            default = "redis+socket:///run/redis-sourcehut-builds.sr.ht/redis.sock?virtual_host=2";
+            default = "redis+socket:///run/redis-sourcehut-buildsrht/redis.sock?virtual_host=2";
           };
           shell = mkOption {
             description = ''
@@ -437,8 +436,8 @@ in
               This setting is propagated to newer and existing repositories.
             '';
             type = types.path;
-            default = "${cfg.git.package}/bin/git.sr.ht-update-hook";
-            defaultText = "\${pkgs.sourcehut.gitsrht}/bin/git.sr.ht-update-hook";
+            default = "${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook";
+            defaultText = "\${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook";
           };
           repos = mkOption {
             description = ''
@@ -447,12 +446,12 @@ in
               the gitsrht's user as read and write access to it.
             '';
             type = types.str;
-            default = "/var/lib/sourcehut/git.sr.ht/repos";
+            default = "/var/lib/sourcehut/gitsrht/repos";
           };
           webhooks = mkOption {
             description = "The Redis connection used for the webhooks worker.";
             type = types.str;
-            default = "redis+socket:///run/redis-sourcehut-git.sr.ht/redis.sock?virtual_host=1";
+            default = "redis+socket:///run/redis-sourcehut-gitsrht/redis.sock?virtual_host=1";
           };
         };
         options."git.sr.ht::api" = {
@@ -478,8 +477,8 @@ in
               This setting is propagated to newer and existing repositories.
             '';
             type = types.str;
-            default = "${cfg.hg.package}/bin/hg.sr.ht-hook-changegroup";
-            defaultText = "\${pkgs.sourcehut.hgsrht}/bin/hg.sr.ht-hook-changegroup";
+            default = "${pkgs.sourcehut.hgsrht}/bin/hgsrht-hook-changegroup";
+            defaultText = "\${pkgs.sourcehut.hgsrht}/bin/hgsrht-hook-changegroup";
           };
           repos = mkOption {
             description = ''
@@ -488,7 +487,7 @@ in
               the hgsrht's user as read and write access to it.
             '';
             type = types.str;
-            default = "/var/lib/sourcehut/hg.sr.ht/repos";
+            default = "/var/lib/sourcehut/hgsrht/repos";
           };
           srhtext = mkOptionNullOrStr ''
             Path to the srht mercurial extension
@@ -508,7 +507,7 @@ in
           webhooks = mkOption {
             description = "The Redis connection used for the webhooks worker.";
             type = types.str;
-            default = "redis+socket:///run/redis-sourcehut-hg.sr.ht/redis.sock?virtual_host=1";
+            default = "redis+socket:///run/redis-sourcehut-hgsrht/redis.sock?virtual_host=1";
           };
         };
 
@@ -530,12 +529,12 @@ in
           redis = mkOption {
             description = "The Redis connection used for the Celery worker.";
             type = types.str;
-            default = "redis+socket:///run/redis-sourcehut-lists.sr.ht/redis.sock?virtual_host=2";
+            default = "redis+socket:///run/redis-sourcehut-listssrht/redis.sock?virtual_host=2";
           };
           webhooks = mkOption {
             description = "The Redis connection used for the webhooks worker.";
             type = types.str;
-            default = "redis+socket:///run/redis-sourcehut-lists.sr.ht/redis.sock?virtual_host=1";
+            default = "redis+socket:///run/redis-sourcehut-listssrht/redis.sock?virtual_host=1";
           };
         };
         options."lists.sr.ht::worker" = {
@@ -585,7 +584,7 @@ in
             webhooks = mkOption {
               description = "The Redis connection used for the webhooks worker.";
               type = types.str;
-              default = "redis+socket:///run/redis-sourcehut-meta.sr.ht/redis.sock?virtual_host=1";
+              default = "redis+socket:///run/redis-sourcehut-metasrht/redis.sock?virtual_host=1";
             };
             welcome-emails = mkEnableOption "sending stock sourcehut welcome emails after signup";
           };
@@ -692,7 +691,7 @@ in
           webhooks = mkOption {
             description = "The Redis connection used for the webhooks worker.";
             type = types.str;
-            default = "redis+socket:///run/redis-sourcehut-todo.sr.ht/redis.sock?virtual_host=1";
+            default = "redis+socket:///run/redis-sourcehut-todosrht/redis.sock?virtual_host=1";
           };
         };
         options."todo.sr.ht::mail" = {
@@ -764,7 +763,7 @@ in
     };
 
     git = {
-      gitPackage = mkPackageOption pkgs "git" {
+      package = mkPackageOption pkgs "git" {
         example = "gitFull";
       };
       fcgiwrap.preforkProcess = mkOption {
@@ -775,7 +774,7 @@ in
     };
 
     hg = {
-      mercurialPackage = mkPackageOption pkgs "mercurial" { };
+      package = mkPackageOption pkgs "mercurial" { };
       cloneBundles = mkOption {
         type = types.bool;
         default = false;
@@ -807,7 +806,6 @@ in
 
   config = mkIf cfg.enable (mkMerge [
     {
-      # TODO: make configurable
       environment.systemPackages = [ pkgs.sourcehut.coresrht ];
 
       services.sourcehut.settings = {
@@ -877,14 +875,14 @@ in
           set -e
           set -x
           cd /etc/ssh/sourcehut/subdir
-          ${cfg.git.package}/bin/git.sr.ht-dispatch "$@"
+          ${pkgs.sourcehut.gitsrht}/bin/gitsrht-dispatch "$@"
         '';
       };
       systemd.tmpfiles.settings."10-sourcehut-gitsrht" = mkIf cfg.git.enable (mkMerge [
         (builtins.listToAttrs (
           map
             (name: {
-              name = "/var/log/sourcehut/git.sr.ht-${name}";
+              name = "/var/log/sourcehut/gitsrht-${name}";
               value.f = {
                 inherit (cfg.git) user group;
                 mode = "0644";
@@ -905,7 +903,7 @@ in
       ]);
       systemd.services.sshd = {
         preStart = mkIf cfg.hg.enable ''
-          chown ${cfg.hg.user}:${cfg.hg.group} /var/log/sourcehut/hg.sr.ht-keys
+          chown ${cfg.hg.user}:${cfg.hg.group} /var/log/sourcehut/hgsrht-keys
         '';
         serviceConfig = {
           LogsDirectory = "sourcehut";
@@ -921,62 +919,62 @@ in
               "${pkgs.writeShellScript "buildsrht-keys-wrapper" ''
                 set -e
                 cd /run/sourcehut/buildsrht/subdir
-                exec -a "$0" ${cfg.builds.package}/bin/builds.sr.ht-keys "$@"
+                exec -a "$0" ${pkgs.sourcehut.buildsrht}/bin/buildsrht-keys "$@"
               ''}:/usr/bin/buildsrht-keys"
-              "${cfg.builds.package}/bin/master-shell:/usr/bin/master-shell"
-              "${cfg.builds.package}/bin/runner-shell:/usr/bin/runner-shell"
+              "${pkgs.sourcehut.buildsrht}/bin/master-shell:/usr/bin/master-shell"
+              "${pkgs.sourcehut.buildsrht}/bin/runner-shell:/usr/bin/runner-shell"
             ]
             ++ optionals cfg.git.enable [
               # /path/to/gitsrht-keys calls /path/to/gitsrht-shell,
               # or [git.sr.ht] shell= if set.
               "${pkgs.writeShellScript "gitsrht-keys-wrapper" ''
                 set -e
-                cd /run/sourcehut/git.sr.ht/subdir
-                exec -a "$0" ${cfg.git.package}/bin/git.sr.ht-keys "$@"
-              ''}:/usr/bin/git.sr.ht-keys"
+                cd /run/sourcehut/gitsrht/subdir
+                exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-keys "$@"
+              ''}:/usr/bin/gitsrht-keys"
               "${pkgs.writeShellScript "gitsrht-shell-wrapper" ''
                 set -e
-                cd /run/sourcehut/git.sr.ht/subdir
-                export PATH="${cfg.git.gitPackage}/bin:$PATH"
-                export SRHT_CONFIG=/run/sourcehut/git.sr.ht/config.ini
-                exec -a "$0" ${cfg.git.package}/bin/git.sr.ht-shell "$@"
-              ''}:/usr/bin/git.sr.ht-shell"
+                cd /run/sourcehut/gitsrht/subdir
+                export PATH="${cfg.git.package}/bin:$PATH"
+                export SRHT_CONFIG=/run/sourcehut/gitsrht/config.ini
+                exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-shell "$@"
+              ''}:/usr/bin/gitsrht-shell"
               "${pkgs.writeShellScript "gitsrht-update-hook" ''
                 set -e
-                export SRHT_CONFIG=/run/sourcehut/git.sr.ht/config.ini
+                export SRHT_CONFIG=/run/sourcehut/gitsrht/config.ini
                 # hooks/post-update calls /usr/bin/gitsrht-update-hook as hooks/stage-3
                 # but this wrapper being a bash script, it overrides $0 with /usr/bin/gitsrht-update-hook
                 # hence this hack to put hooks/stage-3 back into gitsrht-update-hook's $0
                 if test "''${STAGE3:+set}"
                 then
-                  exec -a hooks/stage-3 ${cfg.git.package}/bin/git.sr.ht-update-hook "$@"
+                  exec -a hooks/stage-3 ${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook "$@"
                 else
                   export STAGE3=set
-                  exec -a "$0" ${cfg.git.package}/bin/git.sr.ht-update-hook "$@"
+                  exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook "$@"
                 fi
-              ''}:/usr/bin/git.sr.ht-update-hook"
+              ''}:/usr/bin/gitsrht-update-hook"
             ]
             ++ optionals cfg.hg.enable [
               # /path/to/hgsrht-keys calls /path/to/hgsrht-shell,
               # or [hg.sr.ht] shell= if set.
               "${pkgs.writeShellScript "hgsrht-keys-wrapper" ''
                 set -e
-                cd /run/sourcehut/hg.sr.ht/subdir
-                exec -a "$0" ${cfg.hg.package}/bin/hg.sr.ht-keys "$@"
-              ''}:/usr/bin/hg.sr.ht-keys"
-              "${pkgs.writeShellScript "hg.sr.ht-shell-wrapper" ''
+                cd /run/sourcehut/hgsrht/subdir
+                exec -a "$0" ${pkgs.sourcehut.hgsrht}/bin/hgsrht-keys "$@"
+              ''}:/usr/bin/hgsrht-keys"
+              "${pkgs.writeShellScript "hgsrht-shell-wrapper" ''
                 set -e
-                cd /run/sourcehut/hg.sr.ht/subdir
-                exec -a "$0" ${cfg.hg.package}/bin/hg.sr.ht-shell "$@"
-              ''}:/usr/bin/hg.sr.ht-shell"
+                cd /run/sourcehut/hgsrht/subdir
+                exec -a "$0" ${pkgs.sourcehut.hgsrht}/bin/hgsrht-shell "$@"
+              ''}:/usr/bin/hgsrht-shell"
               # Mercurial's changegroup hooks are run relative to their repository's directory,
               # but hgsrht-hook-changegroup looks up ./config.ini
               "${pkgs.writeShellScript "hgsrht-hook-changegroup" ''
                 set -e
                 test -e "''$PWD"/config.ini ||
-                ln -s /run/sourcehut/hg.sr.ht/config.ini "''$PWD"/config.ini
-                exec -a "$0" ${cfg.hg.package}/bin/hg.sr.ht-hook-changegroup "$@"
-              ''}:/usr/bin/hg.sr.ht-hook-changegroup"
+                ln -s /run/sourcehut/hgsrht/config.ini "''$PWD"/config.ini
+                exec -a "$0" ${pkgs.sourcehut.hgsrht}/bin/hgsrht-hook-changegroup "$@"
+              ''}:/usr/bin/hgsrht-hook-changegroup"
             ];
         };
       };
@@ -987,17 +985,17 @@ in
 
     (import ./service.nix "builds" {
       inherit configIniOfService;
-      pkgname = "buildsrht";
+      srvsrht = "buildsrht";
       port = 5002;
-      extraServices."build.sr.ht-api" = {
+      extraServices.buildsrht-api = {
         serviceConfig.Restart = "always";
         serviceConfig.RestartSec = "5s";
-        serviceConfig.ExecStart = "${cfg.builds.package}/bin/builds.sr.ht-api -b ${cfg.listenAddress}:${
+        serviceConfig.ExecStart = "${pkgs.sourcehut.buildsrht}/bin/buildsrht-api -b ${cfg.listenAddress}:${
           toString (cfg.builds.port + 100)
         }";
       };
       # TODO: a celery worker on the master and worker are apparently needed
-      extraServices."build.sr.ht-worker" =
+      extraServices.buildsrht-worker =
         let
           qemuPackage = pkgs.qemu_kvm;
           serviceName = "buildsrht-worker";
@@ -1026,7 +1024,7 @@ in
             fi
           '';
           serviceConfig = {
-            ExecStart = "${cfg.builds.package}/bin/builds.sr.ht-worker";
+            ExecStart = "${pkgs.sourcehut.buildsrht}/bin/buildsrht-worker";
             BindPaths = [ cfg.settings."builds.sr.ht::worker".buildlogs ];
             LogsDirectory = [ "sourcehut/${serviceName}" ];
             RuntimeDirectory = [ "sourcehut/${serviceName}/subdir" ];
@@ -1057,7 +1055,7 @@ in
             name = "buildsrht-worker-images-pre";
             paths = image_dirs;
             # FIXME: not working, apparently because ubuntu/latest is a broken link
-            # ++ [ "${cfg.builds.package}/lib/images" ];
+            # ++ [ "${pkgs.sourcehut.buildsrht}/lib/images" ];
           };
           image_dir = pkgs.runCommand "buildsrht-worker-images" { } ''
             mkdir -p $out/images
@@ -1074,7 +1072,7 @@ in
               {
                 # Note that git.sr.ht::dispatch is not a typo,
                 # gitsrht-dispatch always use this section
-                "git.sr.ht::dispatch"."/usr/bin/builds.sr.ht-keys" =
+                "git.sr.ht::dispatch"."/usr/bin/buildsrht-keys" =
                   mkDefault "${cfg.builds.user}:${cfg.builds.group}";
               }
               (mkIf cfg.builds.enableWorker {
@@ -1115,10 +1113,8 @@ in
     (import ./service.nix "git" (
       let
         baseService = {
-          path = [ cfg.git.gitPackage ];
-          serviceConfig.BindPaths = [
-            "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/git.sr.ht/repos"
-          ];
+          path = [ cfg.git.package ];
+          serviceConfig.BindPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/gitsrht/repos" ];
         };
       in
       {
@@ -1127,23 +1123,23 @@ in
           baseService
           {
             serviceConfig.StateDirectory = [
-              "sourcehut/git.sr.ht"
-              "sourcehut/git.sr.ht/repos"
+              "sourcehut/gitsrht"
+              "sourcehut/gitsrht/repos"
             ];
             preStart = mkIf (versionOlder config.system.stateVersion "22.05") (mkBefore ''
               # Fix Git hooks of repositories pre-dating https://github.com/NixOS/nixpkgs/pull/133984
               (
               set +f
               shopt -s nullglob
-              for h in /var/lib/sourcehut/git.sr.ht/repos/~*/*/hooks/{pre-receive,update,post-update}
-              do ln -fnsv /usr/bin/git.sr.ht-update-hook "$h"; done
+              for h in /var/lib/sourcehut/gitsrht/repos/~*/*/hooks/{pre-receive,update,post-update}
+              do ln -fnsv /usr/bin/gitsrht-update-hook "$h"; done
               )
             '');
           }
         ];
         port = 5001;
         webhooks = true;
-        extraTimers."git.sr.ht-periodic" = {
+        extraTimers.gitsrht-periodic = {
           service = baseService;
           timerConfig.OnCalendar = [ "*:0/20" ];
         };
@@ -1153,7 +1149,7 @@ in
             # Probably could use gitsrht-shell if output is restricted to just parameters...
             users.users.${cfg.git.user}.shell = pkgs.bash;
             services.sourcehut.settings = {
-              "git.sr.ht::dispatch"."/usr/bin/git.sr.ht-keys" = mkDefault "${cfg.git.user}:${cfg.git.group}";
+              "git.sr.ht::dispatch"."/usr/bin/gitsrht-keys" = mkDefault "${cfg.git.user}:${cfg.git.group}";
             };
             systemd.services.sshd = baseService;
           }
@@ -1168,50 +1164,49 @@ in
                 '';
               };
               locations."~ ^/([^/]+)/([^/]+)/(HEAD|info/refs|objects/info/.*|git-upload-pack).*$" = {
-                root = "/var/lib/sourcehut/git.sr.ht/repos";
+                root = "/var/lib/sourcehut/gitsrht/repos";
                 fastcgiParams = {
                   GIT_HTTP_EXPORT_ALL = "";
                   GIT_PROJECT_ROOT = "$document_root";
                   PATH_INFO = "$uri";
-                  SCRIPT_FILENAME = "${cfg.git.gitPackage}/bin/git-http-backend";
+                  SCRIPT_FILENAME = "${cfg.git.package}/bin/git-http-backend";
                 };
                 extraConfig = ''
                   auth_request /authorize;
                   fastcgi_read_timeout 500s;
-                  fastcgi_pass unix:/run/git.sr.ht-fcgiwrap.sock;
+                  fastcgi_pass unix:/run/gitsrht-fcgiwrap.sock;
                   gzip off;
                 '';
               };
             };
-            systemd.sockets."git.sr.ht-fcgiwrap" = {
+            systemd.sockets.gitsrht-fcgiwrap = {
               before = [ "nginx.service" ];
               wantedBy = [
                 "sockets.target"
-                "git.sr.ht.service"
+                "gitsrht.service"
               ];
               # This path remains accessible to nginx.service, which has no RootDirectory=
-              socketConfig.ListenStream = "/run/git.sr.ht-fcgiwrap.sock";
+              socketConfig.ListenStream = "/run/gitsrht-fcgiwrap.sock";
               socketConfig.SocketUser = nginx.user;
               socketConfig.SocketMode = "600";
             };
           })
         ];
-        extraServices."git.sr.ht-api".serviceConfig = {
+        extraServices.gitsrht-api.serviceConfig = {
           Restart = "always";
           RestartSec = "5s";
-          ExecStart = "${cfg.git.package}/bin/git.sr.ht-api -b ${cfg.listenAddress}:${toString (cfg.git.port + 100)}";
-          BindPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/git.sr.ht/repos" ];
+          ExecStart = "${pkgs.sourcehut.gitsrht}/bin/gitsrht-api -b ${cfg.listenAddress}:${toString (cfg.git.port + 100)}";
+          BindPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/gitsrht/repos" ];
         };
-        extraServices."git.sr.ht-fcgiwrap" = mkIf cfg.nginx.enable {
+        extraServices.gitsrht-fcgiwrap = mkIf cfg.nginx.enable {
           serviceConfig = {
             # Socket is passed by gitsrht-fcgiwrap.socket
-            ExecStart = "${pkgs.fcgiwrap}/bin/fcgiwrap -c ${toString cfg.git.fcgiwrap.preforkProcess}";
+            ExecStart = "${pkgs.fcgiwrap}/sbin/fcgiwrap -c ${toString cfg.git.fcgiwrap.preforkProcess}";
             # No need for config.ini
             ExecStartPre = mkForce [ ];
-            # FIXME: Fails to start with dynamic user
-            # User = null;
-            # DynamicUser = true;
-            BindReadOnlyPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/git.sr.ht/repos" ];
+            User = null;
+            DynamicUser = true;
+            BindReadOnlyPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/gitsrht/repos" ];
             IPAddressDeny = "any";
             InaccessiblePaths = [
               "-+/run/postgresql"
@@ -1237,8 +1232,8 @@ in
     (import ./service.nix "hg" (
       let
         baseService = {
-          path = [ cfg.hg.mercurialPackage ];
-          serviceConfig.BindPaths = [ "${cfg.settings."hg.sr.ht".repos}:/var/lib/sourcehut/hg.sr.ht/repos" ];
+          path = [ cfg.hg.package ];
+          serviceConfig.BindPaths = [ "${cfg.settings."hg.sr.ht".repos}:/var/lib/sourcehut/hgsrht/repos" ];
         };
       in
       {
@@ -1247,26 +1242,26 @@ in
           baseService
           {
             serviceConfig.StateDirectory = [
-              "sourcehut/hg.sr.ht"
-              "sourcehut/hg.sr.ht/repos"
+              "sourcehut/hgsrht"
+              "sourcehut/hgsrht/repos"
             ];
           }
         ];
         port = 5010;
         webhooks = true;
-        extraTimers."hg.sr.ht-periodic" = {
+        extraTimers.hgsrht-periodic = {
           service = baseService;
           timerConfig.OnCalendar = [ "*:0/20" ];
         };
-        extraTimers."hg.sr.ht-clonebundles" = mkIf cfg.hg.cloneBundles {
+        extraTimers.hgsrht-clonebundles = mkIf cfg.hg.cloneBundles {
           service = baseService;
           timerConfig.OnCalendar = [ "daily" ];
           timerConfig.AccuracySec = "1h";
         };
-        extraServices."hg.sr.ht-api" = {
+        extraServices.hgsrht-api = {
           serviceConfig.Restart = "always";
           serviceConfig.RestartSec = "5s";
-          serviceConfig.ExecStart = "${cfg.hgsrht.package}/bin/hg.sr.ht-api -b ${cfg.listenAddress}:${toString (cfg.hg.port + 100)}";
+          serviceConfig.ExecStart = "${pkgs.sourcehut.hgsrht}/bin/hgsrht-api -b ${cfg.listenAddress}:${toString (cfg.hg.port + 100)}";
         };
         extraConfig = mkMerge [
           {
@@ -1274,7 +1269,7 @@ in
             services.sourcehut.settings = {
               # Note that git.sr.ht::dispatch is not a typo,
               # gitsrht-dispatch always uses this section.
-              "git.sr.ht::dispatch"."/usr/bin/hg.sr.ht-keys" = mkDefault "${cfg.hg.user}:${cfg.hg.group}";
+              "git.sr.ht::dispatch"."/usr/bin/hgsrht-keys" = mkDefault "${cfg.hg.user}:${cfg.hg.group}";
             };
             systemd.services.sshd = baseService;
           }
@@ -1295,7 +1290,7 @@ in
               # so someone would need to know or guess a SHA value to download anything.
               # TODO: proxyPass to an hg serve service?
               locations."~ ^/[~^][a-z0-9_]+/[a-zA-Z0-9_.-]+/\\.hg/bundles/.*$" = {
-                root = "/var/lib/nginx/hg.sr.ht/repos";
+                root = "/var/lib/nginx/hgsrht/repos";
                 extraConfig = ''
                   auth_request /authorize;
                   gzip off;
@@ -1304,7 +1299,7 @@ in
             };
             systemd.services.nginx = {
               serviceConfig.BindReadOnlyPaths = [
-                "${cfg.settings."hg.sr.ht".repos}:/var/lib/nginx/hg.sr.ht/repos"
+                "${cfg.settings."hg.sr.ht".repos}:/var/lib/nginx/hgsrht/repos"
               ];
             };
           })
@@ -1335,23 +1330,23 @@ in
         inherit configIniOfService;
         port = 5006;
         webhooks = true;
-        extraServices."lists.sr.ht-api" = {
+        extraServices.listssrht-api = {
           serviceConfig.Restart = "always";
           serviceConfig.RestartSec = "5s";
-          serviceConfig.ExecStart = "${cfg.lists.package}/bin/lists.sr.ht-api -b ${cfg.listenAddress}:${
+          serviceConfig.ExecStart = "${pkgs.sourcehut.listssrht}/bin/listssrht-api -b ${cfg.listenAddress}:${
             toString (cfg.lists.port + 100)
           }";
         };
         # Receive the mail from Postfix and enqueue them into Redis and PostgreSQL
-        extraServices."lists.sr.ht-lmtp" = {
+        extraServices.listssrht-lmtp = {
           wants = [ "postfix.service" ];
           unitConfig.JoinsNamespaceOf = optional cfg.postfix.enable "postfix.service";
-          serviceConfig.ExecStart = "${cfg.lists.package}/bin/lists.sr.ht-lmtp";
+          serviceConfig.ExecStart = "${pkgs.sourcehut.listssrht}/bin/listssrht-lmtp";
           # Avoid crashing: os.chown(sock, os.getuid(), sock_gid)
           serviceConfig.PrivateUsers = mkForce false;
         };
         # Dequeue the mails from Redis and dispatch them
-        extraServices."lists.sr.ht-process" = {
+        extraServices.listssrht-process = {
           serviceConfig = {
             preStart = ''
               cp ${pkgs.writeText "${srvsrht}-webhooks-celeryconfig.py" cfg.lists.process.celeryConfig} \
@@ -1397,7 +1392,7 @@ in
         OnCalendar = [ "daily" ];
         AccuracySec = "1h";
       };
-      extraServices."meta.sr.ht-api" = {
+      extraServices.metasrht-api = {
         serviceConfig.Restart = "always";
         serviceConfig.RestartSec = "5s";
         preStart =
@@ -1419,7 +1414,7 @@ in
               ) cfg.settings
             )
           );
-        serviceConfig.ExecStart = "${cfg.meta.package}/bin/meta.sr.ht-api -b ${cfg.listenAddress}:${toString (cfg.meta.port + 100)}";
+        serviceConfig.ExecStart = "${pkgs.sourcehut.metasrht}/bin/metasrht-api -b ${cfg.listenAddress}:${toString (cfg.meta.port + 100)}";
       };
       extraConfig = {
         assertions = [
@@ -1433,14 +1428,14 @@ in
           }
         ];
         environment.systemPackages = optional cfg.meta.enable (
-          pkgs.writeShellScriptBin "meta.sr.ht-manageuser" ''
+          pkgs.writeShellScriptBin "metasrht-manageuser" ''
             set -eux
             if test "$(${pkgs.coreutils}/bin/id -n -u)" != '${cfg.meta.user}'
             then exec sudo -u '${cfg.meta.user}' "$0" "$@"
             else
               # In order to load config.ini
-              if cd /run/sourcehut/meta.sr.ht
-              then exec ${cfg.meta.package}/bin/meta.sr.ht-manageuser "$@"
+              if cd /run/sourcehut/metasrht
+              then exec ${pkgs.sourcehut.metasrht}/bin/metasrht-manageuser "$@"
               else cat <<EOF
                 Please run: sudo systemctl start metasrht
             EOF
@@ -1457,9 +1452,8 @@ in
       port = 5112;
       mainService =
         let
-          package = cfg.pages.package;
           srvsrht = "pagessrht";
-          version = package.version;
+          version = pkgs.sourcehut.${srvsrht}.version;
           stateDir = "/var/lib/sourcehut/${srvsrht}";
           iniKey = "pages.sr.ht";
         in
@@ -1473,13 +1467,13 @@ in
             if test ! -e ${stateDir}/db; then
               ${postgresql.package}/bin/psql '${
                 cfg.settings.${iniKey}.connection-string
-              }' -f ${cfg.pages.package}/share/sql/schema.sql
+              }' -f ${pkgs.sourcehut.pagessrht}/share/sql/schema.sql
               echo ${version} >${stateDir}/db
             fi
 
             ${optionalString cfg.settings.${iniKey}.migrate-on-upgrade ''
               # Just try all the migrations because they're not linked to the version
-              for sql in ${package}/share/sql/migrations/*.sql; do
+              for sql in ${pkgs.sourcehut.pagessrht}/share/sql/migrations/*.sql; do
                 ${postgresql.package}/bin/psql '${cfg.settings.${iniKey}.connection-string}' -f "$sql" || true
               done
             ''}
@@ -1488,7 +1482,7 @@ in
             touch ${stateDir}/webhook
           '';
           serviceConfig = {
-            ExecStart = mkForce "${cfg.pages.package}/bin/pages.sr.ht -b ${cfg.listenAddress}:${toString cfg.pages.port}";
+            ExecStart = mkForce "${pkgs.sourcehut.pagessrht}/bin/pages.sr.ht -b ${cfg.listenAddress}:${toString cfg.pages.port}";
           };
         };
     })
@@ -1496,10 +1490,10 @@ in
     (import ./service.nix "paste" {
       inherit configIniOfService;
       port = 5011;
-      extraServices."paste.sr.ht-api" = {
+      extraServices.pastesrht-api = {
         serviceConfig.Restart = "always";
         serviceConfig.RestartSec = "5s";
-        serviceConfig.ExecStart = "${cfg.paste.package}/bin/paste.sr.ht-api -b ${cfg.listenAddress}:${
+        serviceConfig.ExecStart = "${pkgs.sourcehut.pastesrht}/bin/pastesrht-api -b ${cfg.listenAddress}:${
           toString (cfg.paste.port + 100)
         }";
       };
@@ -1509,15 +1503,15 @@ in
       inherit configIniOfService;
       port = 5003;
       webhooks = true;
-      extraServices."todo.sr.ht-api" = {
+      extraServices.todosrht-api = {
         serviceConfig.Restart = "always";
         serviceConfig.RestartSec = "5s";
-        serviceConfig.ExecStart = "${cfg.todo.package}/bin/todo.sr.ht-api -b ${cfg.listenAddress}:${toString (cfg.todo.port + 100)}";
+        serviceConfig.ExecStart = "${pkgs.sourcehut.todosrht}/bin/todosrht-api -b ${cfg.listenAddress}:${toString (cfg.todo.port + 100)}";
       };
-      extraServices."todo.sr.ht-lmtp" = {
+      extraServices.todosrht-lmtp = {
         wants = [ "postfix.service" ];
         unitConfig.JoinsNamespaceOf = optional cfg.postfix.enable "postfix.service";
-        serviceConfig.ExecStart = "${cfg.todo.package}/bin/todo.sr.ht-lmtp";
+        serviceConfig.ExecStart = "${pkgs.sourcehut.todosrht}/bin/todosrht-lmtp";
         # Avoid crashing: os.chown(sock, os.getuid(), sock_gid)
         serviceConfig.PrivateUsers = mkForce false;
       };

nixos/modules/services/misc/sourcehut/service.nix

@@ -1,8 +1,7 @@
 srv:
 {
   configIniOfService,
-  pkgname ? "${srv}srht", # Because "buildsrht" does not follow that pattern (missing an "s").
-  srvsrht ? "${srv}.sr.ht",
+  srvsrht ? "${srv}srht", # Because "buildsrht" does not follow that pattern (missing an "s").
   iniKey ? "${srv}.sr.ht",
   webhooks ? false,
   extraTimers ? { },
@@ -29,7 +28,7 @@ let
     mkIf
     mkMerge
     ;
-  inherit (lib.options) mkEnableOption mkOption mkPackageOption;
+  inherit (lib.options) mkEnableOption mkOption;
   inherit (lib.strings) concatStringsSep hasSuffix optionalString;
   inherit (config.services) postgresql;
   redis = config.services.redis.servers."sourcehut-${srvsrht}";
@@ -163,8 +162,6 @@ in
     {
       enable = mkEnableOption "${srv} service";
 
-      package = mkPackageOption pkgs [ "sourcehut" pkgname ] { };
-
       user = mkOption {
         type = types.str;
         default = srvsrht;
@@ -279,7 +276,7 @@ in
             forceSSL = mkDefault true;
             locations."/".proxyPass = "http://${cfg.listenAddress}:${toString srvCfg.port}";
             locations."/static" = {
-              root = "${srvCfg.package}/${pkgs.sourcehut.python.sitePackages}/${srvsrht}";
+              root = "${pkgs.sourcehut.${srvsrht}}/${pkgs.sourcehut.python.sitePackages}/${srvsrht}";
               extraConfig = mkDefault ''
                 expires 30d;
               '';
@@ -370,12 +367,12 @@ in
                 StateDirectory = [ "sourcehut/${srvsrht}" ];
                 StateDirectoryMode = "2750";
                 ExecStart =
-                  "${cfg.python}/bin/gunicorn ${pkgname}.app:app --name ${srvsrht} --bind ${cfg.listenAddress}:${toString srvCfg.port} "
+                  "${cfg.python}/bin/gunicorn ${srvsrht}.app:app --name ${srvsrht} --bind ${cfg.listenAddress}:${toString srvCfg.port} "
                   + concatStringsSep " " srvCfg.gunicorn.extraArgs;
               };
               preStart =
                 let
-                  package = srvCfg.package;
+                  package = pkgs.sourcehut.${srvsrht};
                   version = package.version;
                   stateDir = "/var/lib/sourcehut/${srvsrht}";
                 in
@@ -388,7 +385,7 @@ in
                   if test ! -e ${stateDir}/db; then
                     # Setup the initial database.
                     # Note that it stamps the alembic head afterward
-                    ${postgresql.package}/bin/psql -d ${srvsrht} -f ${package}/share/sourcehut/${srvsrht}-schema.sql
+                    ${package}/bin/${srvsrht}-initdb
                     echo ${version} >${stateDir}/db
                   fi
 
@@ -404,7 +401,7 @@ in
                   # See https://lists.sr.ht/~sircmpwn/sr.ht-admins/<20190302181207.GA13778%40cirno.my.domain>
                   if test ! -e ${stateDir}/webhook; then
                     # Update ${iniKey}'s users' profile copy to the latest
-                    ${cfg.python}/bin/sr.ht-update-profiles ${iniKey}
+                    ${cfg.python}/bin/srht-update-profiles ${iniKey}
                     touch ${stateDir}/webhook
                   fi
                 '';
@@ -427,7 +424,7 @@ in
               Type = "simple";
               Restart = "always";
               ExecStart =
-                "${cfg.python}/bin/celery --app ${pkgname}.webhooks worker --hostname ${srvsrht}-webhooks@%%h "
+                "${cfg.python}/bin/celery --app ${srvsrht}.webhooks worker --hostname ${srvsrht}-webhooks@%%h "
                 + concatStringsSep " " srvCfg.webhooks.extraArgs;
               # Avoid crashing: os.getloadavg()
               ProcSubset = mkForce "all";
@@ -446,7 +443,7 @@ in
               ];
               serviceConfig = {
                 Type = "oneshot";
-                ExecStart = "${srvCfg.package}/bin/${timerName}";
+                ExecStart = "${pkgs.sourcehut.${srvsrht}}/bin/${timerName}";
               };
             }
             (timer.service or { })

nixos/modules/services/monitoring/librenms.nix

@@ -596,9 +596,7 @@ in
           ${pkgs.envsubst}/bin/envsubst -i ${configJson} -o ${cfg.dataDir}/config.json
           export PHPRC=${phpIni}
 
-          INIT=false
           if [[ ! -s ${cfg.dataDir}/.env ]]; then
-            INIT=true
             # init .env file
             echo "APP_KEY=" > ${cfg.dataDir}/.env
             ${artisanWrapper}/bin/librenms-artisan key:generate --ansi
@@ -657,10 +655,6 @@ in
             echo "${package.version}" > ${cfg.dataDir}/version
           fi
 
-          if [[ $INIT == "true" ]]; then
-            ${artisanWrapper}/bin/librenms-artisan db:seed --force --no-interaction
-          fi
-
           # regenerate cache if package has changed
           if [[ $OLD_PACKAGE != "${package}" ]]; then
             ${artisanWrapper}/bin/librenms-artisan view:clear

nixos/modules/services/networking/cato-client.nix

@@ -1,75 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  inherit (lib) mkIf mkEnableOption mkPackageOption;
-
-  cfg = config.services.cato-client;
-in
-{
-  options.services.cato-client = {
-    enable = mkEnableOption "cato-client service";
-    package = mkPackageOption pkgs "cato-client" { };
-  };
-
-  config = mkIf cfg.enable {
-    users = {
-      groups.cato-client = { };
-    };
-
-    environment.systemPackages = [
-      cfg.package
-    ];
-
-    systemd.services.cato-client = {
-      enable = true;
-      description = "Cato Networks Linux client - connects tunnel to Cato cloud";
-      after = [ "network.target" ];
-
-      serviceConfig = {
-        Type = "simple";
-        User = "root"; # Note: daemon runs as root, tools sticky to group
-        Group = "cato-client";
-        ExecStart = "${cfg.package}/bin/cato-clientd systemd";
-        WorkingDirectory = "${cfg.package}";
-        Restart = "always";
-
-        # Cato client seems to do the following:
-        # - Look in each user's ~/.cato/ for configuration and keys
-        # - Write to /var/log/cato-client.log
-        # - Create and use sockets /var/run/cato-sdp.i, /var/run/cato-sdp.o
-        # - Read and Write to /opt/cato/ for runtime settings
-        # - Read /etc/systemd/resolved.conf (but fine if fails)
-        # - Restart systemd-resolved (also fine if doesn't exist)
-
-        NoNewPrivileges = true;
-        PrivateTmp = true;
-        ProtectKernelTunables = true;
-        ProtectControlGroups = true;
-        ProtectSystem = true;
-      };
-
-      wantedBy = [ "multi-user.target" ];
-    };
-
-    # set up Security wrapper Same as inteded in deb post install
-    security.wrappers.cato-clientd = {
-      source = "${cfg.package}/bin/cato-clientd";
-      owner = "root";
-      group = "cato-client";
-      permissions = "u+rwx,g+rwx"; # 770
-      setgid = true;
-    };
-
-    security.wrappers.cato-sdp = {
-      source = "${cfg.package}/bin/cato-sdp";
-      owner = "root";
-      group = "cato-client";
-      permissions = "u+rwx,g+rx,a+rx"; # 755
-      setgid = true;
-    };
-  };
-}

nixos/modules/services/networking/cloudflared.nix

@@ -369,7 +369,7 @@ in
           RuntimeDirectoryMode = "0400";
           LoadCredential = [
             "credentials.json:${tunnel.credentialsFile}"
-          ] ++ (lib.optional (certFile != null) "cert.pem:${certFile}");
+          ] ++ (lib.optional (certFile != null) "cert.pem:certFile");
 
           ExecStart = "${cfg.package}/bin/cloudflared tunnel --config=${mkConfigFile} --no-autoupdate run";
           Restart = "on-failure";

nixos/modules/services/networking/headscale.nix

@@ -164,7 +164,7 @@ in
                 '';
               };
 
-              auto_update_enabled = lib.mkOption {
+              auto_update_enable = lib.mkOption {
                 type = lib.types.bool;
                 default = true;
                 description = ''
@@ -493,11 +493,7 @@ in
   imports = with lib; [
     (mkRenamedOptionModule
       [ "services" "headscale" "derp" "autoUpdate" ]
-      [ "services" "headscale" "settings" "derp" "auto_update_enabled" ]
-    )
-    (mkRenamedOptionModule
-      [ "services" "headscale" "derp" "auto_update_enable" ]
-      [ "services" "headscale" "settings" "derp" "auto_update_enabled" ]
+      [ "services" "headscale" "settings" "derp" "auto_update_enable" ]
     )
     (mkRenamedOptionModule
       [ "services" "headscale" "derp" "paths" ]
@@ -633,7 +629,6 @@ in
         in
         {
           Restart = "always";
-          RestartSec = "5s";
           Type = "simple";
           User = cfg.user;
           Group = cfg.group;

nixos/modules/services/networking/netbird/dashboard.nix

@@ -87,7 +87,7 @@ in
     assertions = [
       {
         assertion = hasAttr "AUTH_AUTHORITY" cfg.settings;
-        message = "The setting AUTH_AUTHORITY is required for the dashboard to function.";
+        message = "The setting AUTH_AUTHORITY is required for the dasboard to function.";
       }
     ];
 

nixos/modules/services/networking/pdns-recursor.nix

@@ -38,33 +38,11 @@ let
     else
       "";
 
-  settingsFormat = pkgs.formats.yaml { };
-
-  mkDefaultAttrs = mapAttrs (n: v: mkDefault v);
-
-  mkForwardZone = mapAttrsToList (
-    zone: uri: {
-      inherit zone;
-      forwarders = [ uri ];
-    }
+  configDir = pkgs.writeTextDir "recursor.conf" (
+    concatStringsSep "\n" (flip mapAttrsToList cfg.settings (name: val: "${name}=${serialize val}"))
   );
 
-  configFile =
-    if cfg.old-settings != { } then
-      # Convert recursor.conf to recursor.yml and merge it
-      let
-        conf = pkgs.writeText "recursor.conf" (
-          concatStringsSep "\n" (mapAttrsToList (name: val: "${name}=${serialize val}") cfg.old-settings)
-        );
-
-        yaml = settingsFormat.generate "recursor.yml" cfg.yaml-settings;
-      in
-      pkgs.runCommand "recursor-merged.yml" { } ''
-        ${pkgs.pdns-recursor}/bin/rec_control show-yaml --config ${conf} > override.yml
-        ${pkgs.yq-go}/bin/yq '. *= load("override.yml")' ${yaml} > $out
-      ''
-    else
-      settingsFormat.generate "recursor.yml" cfg.yaml-settings;
+  mkDefaultAttrs = mapAttrs (n: v: mkDefault v);
 
 in
 {
@@ -197,7 +175,7 @@ in
       '';
     };
 
-    old-settings = mkOption {
+    settings = mkOption {
       type = configType;
       default = { };
       example = literalExpression ''
@@ -206,34 +184,11 @@ in
           log-common-errors = true;
         }
       '';
-      description = ''
-        Older PowerDNS Recursor settings. Use this option to configure
-        Recursor settings not exposed in a NixOS option or to bypass one.
-        See the full documentation at
-        <https://doc.powerdns.com/recursor/settings.html>
-        for the available options.
-
-        ::: {.warning}
-        This option is provided for backward compatibility only
-        and will be removed in the next release of NixOS.
-        :::
-      '';
-    };
-
-    yaml-settings = mkOption {
-      type = settingsFormat.type;
-      default = { };
-      example = literalExpression ''
-        {
-          loglevel = 8;
-          log-common-errors = true;
-        }
-      '';
       description = ''
         PowerDNS Recursor settings. Use this option to configure Recursor
         settings not exposed in a NixOS option or to bypass one.
         See the full documentation at
-        <https://doc.powerdns.com/recursor/yamlsettings.html>
+        <https://doc.powerdns.com/recursor/settings.html>
         for the available options.
       '';
     };
@@ -250,44 +205,42 @@ in
 
   config = mkIf cfg.enable {
 
-    environment.etc."/pdns-recursor/recursor.yml".source = configFile;
+    environment.etc."pdns-recursor".source = configDir;
 
-    services.pdns-recursor.yaml-settings = {
-      incoming = mkDefaultAttrs {
-        listen = cfg.dns.address;
-        port = cfg.dns.port;
-        allow_from = cfg.dns.allowFrom;
-      };
+    services.pdns-recursor.settings = mkDefaultAttrs {
+      local-address = cfg.dns.address;
+      local-port = cfg.dns.port;
+      allow-from = cfg.dns.allowFrom;
 
-      webservice = mkDefaultAttrs {
-        address = cfg.api.address;
-        port = cfg.api.port;
-        allow_from = cfg.api.allowFrom;
-      };
+      webserver-address = cfg.api.address;
+      webserver-port = cfg.api.port;
+      webserver-allow-from = cfg.api.allowFrom;
 
-      recursor = mkDefaultAttrs {
-        forward_zones = mkForwardZone cfg.forwardZones;
-        forward_zones_recurse = mkForwardZone cfg.forwardZonesRecurse;
-        export_etc_hosts = cfg.exportHosts;
-        serve_rfc1918 = cfg.serveRFC1918;
-        lua_config_file = pkgs.writeText "recursor.lua" cfg.luaConfig;
-        daemon = false;
-        write_pid = false;
-      };
+      forward-zones = mapAttrsToList (zone: uri: "${zone}.=${uri}") cfg.forwardZones;
+      forward-zones-recurse = mapAttrsToList (zone: uri: "${zone}.=${uri}") cfg.forwardZonesRecurse;
+      export-etc-hosts = cfg.exportHosts;
+      dnssec = cfg.dnssecValidation;
+      serve-rfc1918 = cfg.serveRFC1918;
+      lua-config-file = pkgs.writeText "recursor.lua" cfg.luaConfig;
 
-      dnssec = mkDefaultAttrs {
-        validation = cfg.dnssecValidation;
-      };
-
-      logging = mkDefaultAttrs {
-        timestamp = false;
-        disable_syslog = true;
-      };
+      daemon = false;
+      write-pid = false;
+      log-timestamp = false;
+      disable-syslog = true;
     };
 
     systemd.packages = [ pkgs.pdns-recursor ];
 
-    systemd.services.pdns-recursor.wantedBy = [ "multi-user.target" ];
+    systemd.services.pdns-recursor = {
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        ExecStart = [
+          ""
+          "${pkgs.pdns-recursor}/bin/pdns_recursor --config-dir=${configDir}"
+        ];
+      };
+    };
 
     users.users.pdns-recursor = {
       isSystemUser = true;
@@ -297,15 +250,6 @@ in
 
     users.groups.pdns-recursor = { };
 
-    warnings = lib.optional (cfg.old-settings != { }) ''
-      pdns-recursor has changed its configuration file format from pdns-recursor.conf
-      (mapped to `services.pdns-recursor.old-settings`) to the newer pdns-recursor.yml
-      (mapped to `services.pdns-recursor.yaml-settings`).
-
-      Support for the older format will be removed in a future version, so please migrate
-      your settings over. See <https://doc.powerdns.com/recursor/yamlsettings.html>.
-    '';
-
   };
 
   imports = [
@@ -314,19 +258,6 @@ in
       "pdns-recursor"
       "extraConfig"
     ] "To change extra Recursor settings use services.pdns-recursor.settings instead.")
-
-    (mkRenamedOptionModule
-      [
-        "services"
-        "pdns-recursor"
-        "settings"
-      ]
-      [
-        "services"
-        "pdns-recursor"
-        "old-settings"
-      ]
-    )
   ];
 
   meta.maintainers = with lib.maintainers; [ rnhmjoj ];

nixos/modules/services/networking/syncthing.nix

@@ -55,19 +55,10 @@ let
           were removed. Please use, respectively, {rescanIntervalS,fsWatcherEnabled,fsWatcherDelayS} instead.
         ''
         {
-          devices =
-            let
-              folderDevices = folder.devices;
-            in
-            map (
-              device:
-              if builtins.isString device then
-                { deviceId = cfg.settings.devices.${device}.id; }
-              else if builtins.isAttrs device then
-                { deviceId = cfg.settings.devices.${device.name}.id; } // device
-              else
-                throw "Invalid type for devices in folder '${folderName}'; expected list or attrset."
-            ) folderDevices;
+          devices = map (
+            device:
+            if builtins.isString device then { deviceId = cfg.settings.devices.${device}.id; } else device
+          ) folder.devices;
         }
   ) (filterAttrs (_: folder: folder.enable) cfg.settings.folders);
 
@@ -137,79 +128,9 @@ let
               # don't exist in the array given. That's why we use here `POST`, and
               # only if s.override == true then we DELETE the relevant folders
               # afterwards.
-              (map (
-                new_cfg:
-                let
-                  jsonPreSecretsFile = pkgs.writeTextFile {
-                    name = "${conf_type}-${new_cfg.id}-conf-pre-secrets.json";
-                    text = builtins.toJSON new_cfg;
-                  };
-                  injectSecretsJqCmd =
-                    {
-                      # There are no secrets in `devs`, so no massaging needed.
-                      "devs" = "${jq} .";
-                      "dirs" =
-                        let
-                          folder = new_cfg;
-                          devicesWithSecrets = lib.pipe folder.devices [
-                            (lib.filter (device: (builtins.isAttrs device) && device ? encryptionPasswordFile))
-                            (map (device: {
-                              deviceId = device.deviceId;
-                              variableName = "secret_${builtins.hashString "sha256" device.encryptionPasswordFile}";
-                              secretPath = device.encryptionPasswordFile;
-                            }))
-                          ];
-                          # At this point, `jsonPreSecretsFile` looks something like this:
-                          #
-                          #   {
-                          #     ...,
-                          #     "devices": [
-                          #       {
-                          #         "deviceId": "id1",
-                          #         "encryptionPasswordFile": "/etc/bar-encryption-password",
-                          #         "name": "..."
-                          #       }
-                          #     ],
-                          #   }
-                          #
-                          # We now generate a `jq` command that can replace those
-                          # `encryptionPasswordFile`s with `encryptionPassword`.
-                          # The `jq` command ends up looking like this:
-                          #
-                          #   jq --rawfile secret_DEADBEEF /etc/bar-encryption-password '
-                          #     .devices[] |= (
-                          #       if .deviceId == "id1" then
-                          #         del(.encryptionPasswordFile) |
-                          #         .encryptionPassword = $secret_DEADBEEF
-                          #       else
-                          #         .
-                          #       end
-                          #     )
-                          #   '
-                          jqUpdates = map (device: ''
-                            .devices[] |= (
-                              if .deviceId == "${device.deviceId}" then
-                                del(.encryptionPasswordFile) |
-                                .encryptionPassword = ''$${device.variableName}
-                              else
-                                .
-                              end
-                            )
-                          '') devicesWithSecrets;
-                          jqRawFiles = map (
-                            device: "--rawfile ${device.variableName} ${lib.escapeShellArg device.secretPath}"
-                          ) devicesWithSecrets;
-                        in
-                        "${jq} ${lib.concatStringsSep " " jqRawFiles} ${
-                          lib.escapeShellArg (lib.concatStringsSep "|" ([ "." ] ++ jqUpdates))
-                        }";
-                    }
-                    .${conf_type};
-                in
-                ''
-                  ${injectSecretsJqCmd} ${jsonPreSecretsFile} | curl --json @- -X POST ${s.baseAddress}
-                ''
-              ))
+              (map (new_cfg: ''
+                curl -d ${lib.escapeShellArg (builtins.toJSON new_cfg)} -X POST ${s.baseAddress}
+              ''))
               (lib.concatStringsSep "\n")
             ]
             /*
@@ -517,48 +438,11 @@ in
                       };
 
                       devices = mkOption {
-                        type = types.listOf (
-                          types.oneOf [
-                            types.str
-                            (types.submodule (
-                              { ... }:
-                              {
-                                freeformType = settingsFormat.type;
-                                options = {
-                                  name = mkOption {
-                                    type = types.str;
-                                    default = null;
-                                    description = ''
-                                      The name of a device defined in the
-                                      [devices](#opt-services.syncthing.settings.devices)
-                                      option.
-                                    '';
-                                  };
-                                  encryptionPasswordFile = mkOption {
-                                    type = types.nullOr (
-                                      types.pathWith {
-                                        inStore = false;
-                                        absolute = true;
-                                      }
-                                    );
-                                    default = null;
-                                    description = ''
-                                      Path to encryption password. If set, the file will be read during
-                                      service activation, without being embedded in derivation.
-                                    '';
-                                  };
-                                };
-                              }
-                            ))
-                          ]
-                        );
+                        type = types.listOf types.str;
                         default = [ ];
                         description = ''
                           The devices this folder should be shared with. Each device must
                           be defined in the [devices](#opt-services.syncthing.settings.devices) option.
-
-                          A list of either strings or attribute sets, where values
-                          are device names or device configurations.
                         '';
                       };
 

nixos/modules/services/search/meilisearch.nix

@@ -129,22 +129,6 @@ in
 
   config = lib.mkIf cfg.enable {
 
-    warnings = lib.optional (lib.versionOlder cfg.package.version "1.12") ''
-      Meilisearch 1.11 will be removed in NixOS 25.11. As it was the last
-      version not to support dumpless upgrades, you will have to manually
-      migrate your data before that. Instructions can be found at
-      https://www.meilisearch.com/docs/learn/update_and_migration/updating#using-a-dump
-      and afterwards, you can set `services.meilisearch.package = pkgs.meilisearch;`
-      to use the latest version.
-    '';
-
-    services.meilisearch.package = lib.mkDefault (
-      if lib.versionAtLeast config.system.stateVersion "25.05" then
-        pkgs.meilisearch
-      else
-        pkgs.meilisearch_1_11
-    );
-
     # used to restore dumps
     environment.systemPackages = [ cfg.package ];
 

nixos/modules/services/video/frigate.nix

@@ -669,11 +669,7 @@ in
 
         # Caches
         PrivateTmp = true;
-        CacheDirectory = [
-          "frigate"
-          # https://github.com/blakeblackshear/frigate/discussions/18129
-          "frigate/model_cache"
-        ];
+        CacheDirectory = "frigate";
         CacheDirectoryMode = "0750";
 
         # Sockets/IPC

nixos/modules/services/web-apps/gancio.nix

@@ -174,7 +174,7 @@ in
         if [[ "$USER" != ${cfg.user} ]]; then
           sudo="exec /run/wrappers/bin/sudo -u ${cfg.user}"
         fi
-        $sudo ${lib.getExe cfg.package} "''${@:--help}"
+        $sudo ${lib.getExe cfg.package} ''${1:--help}
         ' > $out/bin/gancio
         chmod +x $out/bin/gancio
       '')

nixos/modules/services/web-apps/kimai.nix

@@ -324,14 +324,12 @@ in
                 ${pkg hostName cfg}/bin/console lint:yaml --parse-tags \
                   ${pkg hostName cfg}/share/php/kimai/config
 
-                # Before running any further console commands, clear cache. This
-                # avoids errors due to old cache getting used with new version
-                # of Kimai.
-                ${pkg hostName cfg}/bin/console cache:clear --env=prod
-                # Then, run kimai:install to ensure database is created or updated.
+                # Run kimai:install to ensure database is created or updated.
                 # Note that kimai:update is an alias to kimai:install.
                 ${pkg hostName cfg}/bin/console kimai:install --no-cache
-                # Finally, warm up cache.
+                # Clear cache and warmup cache separately, to avoid "Cannot declare
+                # class App\Entity\Timesheet" error on first init after upgrade.
+                ${pkg hostName cfg}/bin/console cache:clear --env=prod
                 ${pkg hostName cfg}/bin/console cache:warmup --env=prod
               '';
 

nixos/modules/services/web-apps/nextcloud.nix

@@ -9,11 +9,6 @@ with lib;
 
 let
   cfg = config.services.nextcloud;
-
-  overridePackage = cfg.package.override {
-    inherit (config.security.pki) caBundle;
-  };
-
   fpm = config.services.phpfpm.pools.nextcloud;
 
   jsonFormat = pkgs.formats.json { };
@@ -56,13 +51,13 @@ let
   };
 
   webroot =
-    pkgs.runCommand "${overridePackage.name or "nextcloud"}-with-apps"
+    pkgs.runCommand "${cfg.package.name or "nextcloud"}-with-apps"
       {
         preferLocalBuild = true;
       }
       ''
         mkdir $out
-        ln -sfv "${overridePackage}"/* "$out"
+        ln -sfv "${cfg.package}"/* "$out"
         ${concatStrings (
           mapAttrsToList (
             name: store:
@@ -121,8 +116,7 @@ let
     ++ (lib.optional (cfg.config.objectstore.s3.enable) "s3_secret:${cfg.config.objectstore.s3.secretFile}")
     ++ (lib.optional (
       cfg.config.objectstore.s3.sseCKeyFile != null
-    ) "s3_sse_c_key:${cfg.config.objectstore.s3.sseCKeyFile}")
-    ++ (lib.optional (cfg.secretFile != null) "secret_file:${cfg.secretFile}");
+    ) "s3_sse_c_key:${cfg.config.objectstore.s3.sseCKeyFile}");
 
   requiresRuntimeSystemdCredentials = (lib.length runtimeSystemdCredentials) != 0;
 
@@ -190,8 +184,8 @@ let
   mysqlLocal = cfg.database.createLocally && cfg.config.dbtype == "mysql";
   pgsqlLocal = cfg.database.createLocally && cfg.config.dbtype == "pgsql";
 
-  nextcloudGreaterOrEqualThan = versionAtLeast overridePackage.version;
-  nextcloudOlderThan = versionOlder overridePackage.version;
+  nextcloudGreaterOrEqualThan = versionAtLeast cfg.package.version;
+  nextcloudOlderThan = versionOlder cfg.package.version;
 
   # https://github.com/nextcloud/documentation/pull/11179
   ocmProviderIsNotAStaticDirAnymore =
@@ -201,6 +195,7 @@ let
   overrideConfig =
     let
       c = cfg.config;
+      requiresReadSecretFunction = c.dbpassFile != null || c.objectstore.s3.enable;
       objectstoreConfig =
         let
           s3 = c.objectstore.s3;
@@ -237,7 +232,7 @@ let
     in
     pkgs.writeText "nextcloud-config.php" ''
       <?php
-      ${optionalString requiresRuntimeSystemdCredentials ''
+      ${optionalString requiresReadSecretFunction ''
         function nix_read_secret($credential_name) {
           $credentials_directory = getenv("CREDENTIALS_DIRECTORY");
           if (!$credentials_directory) {
@@ -258,19 +253,7 @@ let
           }
 
           return trim(file_get_contents($credential_path));
-        }
-
-        function nix_read_secret_and_decode_json_file($credential_name) {
-          $decoded = json_decode(nix_read_secret($credential_name), true);
-
-          if (json_last_error() !== JSON_ERROR_NONE) {
-            error_log(sprintf("Cannot decode %s, because: %s", $file, json_last_error_msg()));
-            exit(1);
-          }
-
-          return $decoded;
-        }
-      ''}
+        }''}
       function nix_decode_json_file($file, $error) {
         if (!file_exists($file)) {
           throw new \RuntimeException(sprintf($error, $file));
@@ -304,7 +287,10 @@ let
       ));
 
       ${optionalString (cfg.secretFile != null) ''
-        $CONFIG = array_replace_recursive($CONFIG, nix_read_secret_and_decode_json_file('secret_file'));
+        $CONFIG = array_replace_recursive($CONFIG, nix_decode_json_file(
+          "${cfg.secretFile}",
+          "Cannot start Nextcloud, secrets file %s set by NixOS doesn't exist!"
+        ));
       ''}
     '';
 in
@@ -1033,12 +1019,12 @@ in
           If you have an existing installation with a custom table prefix, make sure it is
           set correctly in `config.php` and remove the option from your NixOS config.
         '')
-        ++ (optional (versionOlder overridePackage.version "26") (upgradeWarning 25 "23.05"))
-        ++ (optional (versionOlder overridePackage.version "27") (upgradeWarning 26 "23.11"))
-        ++ (optional (versionOlder overridePackage.version "28") (upgradeWarning 27 "24.05"))
-        ++ (optional (versionOlder overridePackage.version "29") (upgradeWarning 28 "24.11"))
-        ++ (optional (versionOlder overridePackage.version "30") (upgradeWarning 29 "24.11"))
-        ++ (optional (versionOlder overridePackage.version "31") (upgradeWarning 30 "25.05"));
+        ++ (optional (versionOlder cfg.package.version "26") (upgradeWarning 25 "23.05"))
+        ++ (optional (versionOlder cfg.package.version "27") (upgradeWarning 26 "23.11"))
+        ++ (optional (versionOlder cfg.package.version "28") (upgradeWarning 27 "24.05"))
+        ++ (optional (versionOlder cfg.package.version "29") (upgradeWarning 28 "24.11"))
+        ++ (optional (versionOlder cfg.package.version "30") (upgradeWarning 29 "24.11"))
+        ++ (optional (versionOlder cfg.package.version "31") (upgradeWarning 30 "25.05"));
 
       services.nextcloud.package =
         with pkgs;
@@ -1391,8 +1377,6 @@ in
             datadirectory = lib.mkDefault "${datadir}/data";
             trusted_domains = [ cfg.hostName ];
             "upgrade.disable-web" = true;
-            # NixOS already provides its own integrity check and the nix store is read-only, therefore Nextcloud does not need to do its own integrity checks.
-            "integrity.check.disabled" = true;
           })
           (lib.mkIf cfg.configureRedis {
             "memcache.distributed" = ''\OC\Memcache\Redis'';

nixos/modules/services/web-apps/oncall.nix

@@ -1,203 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-
-  cfg = config.services.oncall;
-  settingsFormat = pkgs.formats.yaml { };
-  configFile = settingsFormat.generate "oncall_extra_settings.yaml" cfg.settings;
-
-in
-{
-  options.services.oncall = {
-
-    enable = lib.mkEnableOption "Oncall web app";
-
-    package = lib.mkPackageOption pkgs "oncall" { };
-
-    database.createLocally = lib.mkEnableOption "Create the database and database user locally." // {
-      default = true;
-    };
-
-    settings = lib.mkOption {
-      type = lib.types.submodule {
-        freeformType = settingsFormat.type;
-        options = {
-          oncall_host = lib.mkOption {
-            type = lib.types.str;
-            default = "localhost";
-            description = "FQDN for the Oncall instance.";
-          };
-          db.conn = {
-            kwargs = {
-              user = lib.mkOption {
-                type = lib.types.str;
-                default = "oncall";
-                description = "Database user.";
-              };
-              host = lib.mkOption {
-                type = lib.types.str;
-                default = "localhost";
-                description = "Database host.";
-              };
-              database = lib.mkOption {
-                type = lib.types.str;
-                default = "oncall";
-                description = "Database name.";
-              };
-            };
-            str = lib.mkOption {
-              type = lib.types.str;
-              default = "%(scheme)s://%(user)s@%(host)s:%(port)s/%(database)s?charset=%(charset)s&unix_socket=/run/mysqld/mysqld.sock";
-              description = ''
-                Database connection scheme. The default specifies the
-                connection through a local socket.
-              '';
-            };
-            require_auth = lib.mkOption {
-              type = lib.types.bool;
-              default = true;
-              description = ''
-                Whether authentication is required to access the web app.
-              '';
-            };
-          };
-        };
-      };
-      default = { };
-      description = ''
-        Extra configuration options to append or override.
-        For available and default option values see
-        [upstream configuration file](https://github.com/linkedin/oncall/blob/master/configs/config.yaml)
-        and the administration part in the
-        [offical documentation](https://oncall.tools/docs/admin_guide.html).
-      '';
-    };
-
-    secretFile = lib.mkOption {
-      type = lib.types.pathWith {
-        inStore = false;
-        absolute = true;
-      };
-      example = "/run/keys/oncall-dbpassword";
-      description = ''
-        A YAML file containing secrets such as database or user passwords.
-        Some variables that can be considered secrets are:
-
-        - db.conn.kwargs.password:
-          Password used to authenticate to the database.
-
-        - session.encrypt_key:
-          Key for encrypting/signing session cookies.
-          Change to random long values in production.
-
-        - session.sign_key:
-          Key for encrypting/signing session cookies.
-          Change to random long values in production.
-      '';
-    };
-
-  };
-
-  config = lib.mkIf cfg.enable {
-
-    # Disable debug, only needed for development
-    services.oncall.settings = lib.mkMerge [
-      ({
-        debug = lib.mkDefault false;
-        auth.debug = lib.mkDefault false;
-      })
-    ];
-
-    services.uwsgi = {
-      enable = true;
-      plugins = [ "python3" ];
-      user = "oncall";
-      instance = {
-        type = "emperor";
-        vassals = {
-          oncall = {
-            type = "normal";
-            env = [
-              "PYTHONPATH=${pkgs.oncall.pythonPath}"
-              (
-                "ONCALL_EXTRA_CONFIG="
-                + (lib.concatStringsSep "," (
-                  [ configFile ] ++ lib.optional (cfg.secretFile != null) cfg.secretFile
-                ))
-              )
-              "STATIC_ROOT=/var/lib/oncall"
-            ];
-            module = "oncall.app:get_wsgi_app()";
-            socket = "${config.services.uwsgi.runDir}/oncall.sock";
-            socketGroup = "nginx";
-            immediate-gid = "nginx";
-            chmod-socket = "770";
-            pyargv = "${pkgs.oncall}/share/configs/config.yaml";
-            buffer-size = 32768;
-          };
-        };
-      };
-    };
-
-    services.nginx = {
-      enable = lib.mkDefault true;
-      virtualHosts."${cfg.settings.oncall_host}".locations = {
-        "/".extraConfig = "uwsgi_pass unix://${config.services.uwsgi.runDir}/oncall.sock;";
-      };
-    };
-
-    services.mysql = lib.mkIf cfg.database.createLocally {
-      enable = true;
-      package = lib.mkDefault pkgs.mariadb;
-      ensureDatabases = [ cfg.settings.db.conn.kwargs.database ];
-      ensureUsers = [
-        {
-          name = cfg.settings.db.conn.kwargs.user;
-          ensurePermissions = {
-            "${cfg.settings.db.conn.kwargs.database}.*" = "ALL PRIVILEGES";
-          };
-        }
-      ];
-    };
-
-    users.users.oncall = {
-      group = "nginx";
-      isSystemUser = true;
-    };
-
-    systemd = {
-      services = {
-        uwsgi.serviceConfig.StateDirectory = "oncall";
-        oncall-setup-database = lib.mkIf cfg.database.createLocally {
-          description = "Set up Oncall database";
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-          };
-          requiredBy = [ "uwsgi.service" ];
-          after = [ "mysql.service" ];
-          script =
-            let
-              mysql = "${lib.getExe' config.services.mysql.package "mysql"}";
-            in
-            ''
-              if [ ! -f /var/lib/oncall/.dbexists ]; then
-                # Load database schema provided with package
-                ${mysql} ${cfg.settings.db.conn.kwargs.database} < ${cfg.package}/share/db/schema.v0.sql
-                ${mysql} ${cfg.settings.db.conn.kwargs.database} < ${cfg.package}/share/db/schema-update.v0-1602184489.sql
-                touch /var/lib/oncall/.dbexists
-              fi
-            '';
-        };
-      };
-    };
-
-  };
-
-  meta.maintainers = with lib.maintainers; [ onny ];
-
-}

nixos/modules/services/web-apps/readeck.nix

@@ -68,6 +68,7 @@ in
         ExecStart = "${lib.getExe cfg.package} serve -config ${configFile}";
         ProtectSystem = "full";
         SystemCallArchitectures = "native";
+        MemoryDenyWriteExecute = true;
         NoNewPrivileges = true;
         PrivateTmp = true;
         PrivateDevices = true;
@@ -88,6 +89,7 @@ in
         ProtectKernelTunables = true;
         LockPersonality = true;
         Restart = "on-failure";
+
       };
     };
   };

nixos/modules/services/x11/desktop-managers/gnome.md

@@ -19,7 +19,7 @@ To enable the GNOME desktop use:
 While it is not strictly necessary to use GDM as the display manager with GNOME, it is recommended, as some features such as screen lock [might not work](#sec-gnome-faq-can-i-use-lightdm-with-gnome) without it.
 :::
 
-The default applications used in NixOS are very minimal, inspired by the defaults used in [gnome-build-meta](https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/48.0/elements/core/meta-gnome-core-apps.bst).
+The default applications used in NixOS are very minimal, inspired by the defaults used in [gnome-build-meta](https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/40.0/elements/core/meta-gnome-core-utilities.bst).
 
 ### GNOME without the apps {#sec-gnome-without-the-apps}
 
@@ -27,7 +27,7 @@ If you’d like to only use the GNOME desktop and not the apps, you can disable
 
 ```nix
 {
-  services.gnome.core-apps.enable = false;
+  services.gnome.core-utilities.enable = false;
 }
 ```
 

nixos/modules/services/x11/desktop-managers/gnome.nix

@@ -84,19 +84,12 @@ in
     maintainers = lib.teams.gnome.members;
   };
 
-  imports = [
-    (lib.mkRenamedOptionModule
-      [ "services" "gnome" "core-utilities" "enable" ]
-      [ "services" "gnome" "core-apps" "enable" ]
-    )
-  ];
-
   options = {
 
     services.gnome = {
       core-os-services.enable = mkEnableOption "essential services for GNOME3";
       core-shell.enable = mkEnableOption "GNOME Shell services";
-      core-apps.enable = mkEnableOption "GNOME core apps";
+      core-utilities.enable = mkEnableOption "GNOME core utilities";
       core-developer-tools.enable = mkEnableOption "GNOME core developer tools";
       games.enable = mkEnableOption "GNOME games";
     };
@@ -220,7 +213,7 @@ in
 
       services.gnome.core-os-services.enable = true;
       services.gnome.core-shell.enable = true;
-      services.gnome.core-apps.enable = mkDefault true;
+      services.gnome.core-utilities.enable = mkDefault true;
 
       services.displayManager.sessionPackages = [ pkgs.gnome-session.sessions ];
 
@@ -333,9 +326,17 @@ in
     })
 
     (lib.mkIf serviceCfg.core-shell.enable {
-      services.xserver.desktopManager.gnome.sessionPath = [
-        pkgs.gnome-shell
-      ];
+      services.xserver.desktopManager.gnome.sessionPath =
+        let
+          mandatoryPackages = [
+            pkgs.gnome-shell
+          ];
+          optionalPackages = [
+            pkgs.gnome-shell-extensions
+          ];
+        in
+        mandatoryPackages
+        ++ utils.removePackagesByName optionalPackages config.environment.gnome.excludePackages;
 
       services.colord.enable = mkDefault true;
       services.gnome.glib-networking.enable = true;
@@ -379,11 +380,14 @@ in
 
       services.orca.enable = notExcluded pkgs.orca;
 
-      fonts.packages = utils.removePackagesByName [
-        pkgs.adwaita-fonts
-      ] config.environment.gnome.excludePackages;
+      fonts.packages = with pkgs; [
+        cantarell-fonts
+        dejavu_fonts
+        source-code-pro # Default monospace font in 3.32
+        source-sans
+      ];
 
-      # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/gnome-48/elements/core/meta-gnome-core-shell.bst
+      # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/gnome-3-38/elements/core/meta-gnome-core-shell.bst
       environment.systemPackages =
         let
           mandatoryPackages = [
@@ -396,6 +400,7 @@ in
             pkgs.gnome-bluetooth
             pkgs.gnome-color-manager
             pkgs.gnome-control-center
+            pkgs.gnome-shell-extensions
             pkgs.gnome-tour # GNOME Shell detects the .desktop file on first log-in.
             pkgs.gnome-user-docs
             pkgs.glib # for gsettings program
@@ -409,12 +414,11 @@ in
         ++ utils.removePackagesByName optionalPackages config.environment.gnome.excludePackages;
     })
 
-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-apps.bst
-    (lib.mkIf serviceCfg.core-apps.enable {
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-45/elements/core/meta-gnome-core-utilities.bst
+    (lib.mkIf serviceCfg.core-utilities.enable {
       environment.systemPackages = utils.removePackagesByName (
         [
           pkgs.baobab
-          pkgs.decibels
           pkgs.epiphany
           pkgs.gnome-text-editor
           pkgs.gnome-calculator
@@ -496,19 +500,17 @@ in
       ] config.environment.gnome.excludePackages;
     })
 
-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-developer-tools.bst
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/3.38.0/elements/core/meta-gnome-core-developer-tools.bst
     (lib.mkIf serviceCfg.core-developer-tools.enable {
       environment.systemPackages = utils.removePackagesByName [
         pkgs.dconf-editor
         pkgs.devhelp
-        pkgs.d-spy
         pkgs.gnome-builder
         # boxes would make sense in this option, however
         # it doesn't function well enough to be included
         # in default configurations.
         # https://github.com/NixOS/nixpkgs/issues/60908
         # pkgs.gnome-boxes
-        pkgs.sysprof
       ] config.environment.gnome.excludePackages;
 
       services.sysprof.enable = notExcluded pkgs.sysprof;

nixos/modules/services/x11/display-managers/gdm.nix

@@ -211,10 +211,7 @@ in
       pkgs.gnome-session
       pkgs.gnome-shell
     ];
-    environment.systemPackages = [
-      pkgs.adwaita-icon-theme
-      pkgs.gdm # For polkit rules
-    ];
+    environment.systemPackages = [ pkgs.adwaita-icon-theme ];
 
     # We dont use the upstream gdm service
     # it has to be disabled since the gdm package has it

nixos/modules/system/activation/lib/test.sh

@@ -26,7 +26,6 @@ onerr() {
 }
 trap onerr ERR
 
-# shellcheck source-path=SCRIPTDIR
 source ./lib.sh
 
 (warn hi, this works >/dev/null) 2>&1 | grep -E $'.*warning:.* hi, this works' >/dev/null

nixos/modules/system/activation/specialisation.nix

@@ -10,8 +10,6 @@
 let
   inherit (lib)
     concatStringsSep
-    escapeShellArg
-    hasInfix
     mapAttrs
     mapAttrsToList
     mkOption
@@ -86,18 +84,10 @@ in
   };
 
   config = {
-    assertions = mapAttrsToList (name: _: {
-      assertion = !hasInfix "/" name;
-      message = ''
-        Specialisation names must not contain forward slashes.
-        Invalid specialisation name: ${name}
-      '';
-    }) config.specialisation;
-
     system.systemBuilderCommands = ''
       mkdir $out/specialisation
       ${concatStringsSep "\n" (
-        mapAttrsToList (name: path: "ln -s ${path} $out/specialisation/${escapeShellArg name}") children
+        mapAttrsToList (name: path: "ln -s ${path} $out/specialisation/${name}") children
       )}
     '';
   };

nixos/modules/system/activation/top-level.nix

@@ -77,7 +77,14 @@ let
   );
 
   # Handle assertions and warnings
-  baseSystemAssertWarn = lib.asserts.checkAssertWarn config.assertions config.warnings baseSystem;
+
+  failedAssertions = map (x: x.message) (filter (x: !x.assertion) config.assertions);
+
+  baseSystemAssertWarn =
+    if failedAssertions != [ ] then
+      throw "\nFailed assertions:\n${concatStringsSep "\n" (map (x: "- ${x}") failedAssertions)}"
+    else
+      showWarnings config.warnings baseSystem;
 
   # Replace runtime dependencies
   system =

nixos/modules/system/boot/loader/limine/limine-install.py

@@ -74,7 +74,6 @@ def is_encrypted(device: str) -> bool:
 def is_fs_type_supported(fs_type: str) -> bool:
     return fs_type.startswith('vfat')
 
-paths = {}
 
 def get_copied_path_uri(path: str, target: str) -> str:
     result = ''
@@ -86,8 +85,6 @@ def get_copied_path_uri(path: str, target: str) -> str:
 
     if not os.path.exists(dest_path):
         copy_file(path, dest_path)
-    else:
-        paths[dest_path] = True
 
     path_with_prefix = os.path.join('/limine', target, dest_file)
     result = f'boot():{path_with_prefix}'
@@ -168,29 +165,14 @@ def config_entry(levels: int, bootspec: BootSpec, label: str, time: str) -> str:
     return entry
 
 
-def generate_config_entry(profile: str, gen: str, special: bool) -> str:
+def generate_config_entry(profile: str, gen: str) -> str:
     time = datetime.datetime.fromtimestamp(os.stat(get_system_path(profile,gen), follow_symlinks=False).st_mtime).strftime("%F %H:%M:%S")
     boot_json = json.load(open(os.path.join(get_system_path(profile, gen), 'boot.json'), 'r'))
     boot_spec = bootjson_to_bootspec(boot_json)
 
-    specialisation_list = boot_spec.specialisations.items()
-    depth = 2
-    entry = ""
-
-    if len(specialisation_list) > 0:
-        depth += 1
-        entry += '/' * (depth-1)
-
-        if special:
-            entry += '+'
-
-        entry += f'Generation {gen}' + '\n'
-        entry += config_entry(depth, boot_spec, f'Default', str(time))
-    else:
-        entry += config_entry(depth, boot_spec, f'Generation {gen}', str(time))
-
-    for spec, spec_boot_spec in specialisation_list:
-        entry += config_entry(depth, spec_boot_spec, f'{spec}', str(time))
+    entry = config_entry(2, boot_spec, f'Generation {gen}', time)
+    for spec, spec_boot_spec in boot_spec.specialisations.items():
+        entry += config_entry(2, spec_boot_spec, f'Generation {gen}, Specialisation {spec}', str(time))
     return entry
 
 
@@ -221,10 +203,7 @@ def copy_file(from_path: str, to_path: str):
     if not os.path.exists(dirname):
         os.makedirs(dirname)
 
-    shutil.copyfile(from_path, to_path + ".tmp")
-    os.rename(to_path + ".tmp", to_path)
-
-    paths[to_path] = True
+    shutil.copyfile(from_path, to_path)
 
 def option_from_config(name: str, config_path: List[str], conversion: Callable[[str], str] | None = None) -> str:
     if config(*config_path):
@@ -266,10 +245,12 @@ def main():
 
     if not os.path.exists(limine_dir):
         os.makedirs(limine_dir)
-    else:
-        for dir, dirs, files in os.walk(limine_dir, topdown=True):
-            for file in files:
-                paths[os.path.join(dir, file)] = False
+
+    if os.path.exists(os.path.join(limine_dir, 'kernels')):
+        print(f'nuking {os.path.join(limine_dir, "kernels")}')
+        shutil.rmtree(os.path.join(limine_dir, 'kernels'))
+
+    os.makedirs(os.path.join(limine_dir, "kernels"))
 
     profiles = [('system', get_gens())]
 
@@ -280,19 +261,22 @@ def main():
     editor_enabled = 'yes' if config('enableEditor') else 'no'
     hash_mismatch_panic = 'yes' if config('panicOnChecksumMismatch') else 'no'
 
-    last_gen = get_gens()[-1]
-    last_gen_json = json.load(open(os.path.join(get_system_path('system', last_gen), 'boot.json'), 'r'))
-    last_gen_boot_spec = bootjson_to_bootspec(last_gen_json)
-
     config_file = config('extraConfig') + '\n'
     config_file += textwrap.dedent(f'''
         timeout: {timeout}
         editor_enabled: {editor_enabled}
         hash_mismatch_panic: {hash_mismatch_panic}
         graphics: yes
-        default_entry: {3 if len(last_gen_boot_spec.specialisations.items()) > 0 else 2}
+        default_entry: 2
     ''')
 
+    if os.path.exists(os.path.join(limine_dir, 'wallpapers')):
+        print(f'nuking {os.path.join(limine_dir, "wallpapers")}')
+        shutil.rmtree(os.path.join(limine_dir, 'wallpapers'))
+
+    if len(config('style', 'wallpapers')) > 0:
+        os.makedirs(os.path.join(limine_dir, 'wallpapers'))
+
     for wallpaper in config('style', 'wallpapers'):
         config_file += f'''wallpaper: {get_copied_path_uri(wallpaper, 'wallpapers')}\n'''
 
@@ -322,11 +306,8 @@ def main():
         group_name = 'default profile' if profile == 'system' else f"profile '{profile}'"
         config_file += f'/+NixOS {group_name}\n'
 
-        isFirst = True
-
         for gen in sorted(gens, key=lambda x: x, reverse=True):
-            config_file += generate_config_entry(profile, gen, isFirst)
-            isFirst = False
+            config_file += generate_config_entry(profile, gen)
 
     config_file_path = os.path.join(limine_dir, 'limine.conf')
     config_file += '\n# NixOS boot entries end here\n\n'
@@ -337,8 +318,6 @@ def main():
         file.truncate()
         file.write(config_file.strip())
 
-    paths[config_file_path] = True
-
     for dest_path, source_path in config('additionalFiles').items():
         dest_path = os.path.join(limine_dir, dest_path)
 
@@ -384,16 +363,9 @@ def main():
                 efibootmgr = os.path.join(config('efiBootMgrPath'), 'bin', 'efibootmgr')
                 efi_partition = find_mounted_device(config('efiMountPoint'))
                 efi_disk = find_disk_device(efi_partition)
-
-                efibootmgr_output = subprocess.check_output([efibootmgr], stderr=subprocess.STDOUT, universal_newlines=True)
-                create_flag = '-c'
-                # Check the output of `efibootmgr` to find if limine is already installed and present in the boot record
-                if matches := re.findall(r'Boot[0-9a-fA-F]{4}\*? Limine', efibootmgr_output):
-                    create_flag = '-C' # if present, keep the same boot order
-
                 efibootmgr_output = subprocess.check_output([
                     efibootmgr,
-                    create_flag,
+                    '-c',
                     '-d', efi_disk,
                     '-p', efi_partition.removeprefix(efi_disk).removeprefix('p'),
                     '-l', f'\\efi\\limine\\{boot_file}',
@@ -437,9 +409,4 @@ def main():
                 'Failed to deploy BIOS stage 1 Limine bootloader!\n' +
                 'You might want to try enabling the `boot.loader.limine.forceMbr` option.')
 
-    print("removing unused boot files...")
-    for path in paths:
-        if not paths[path]:
-            os.remove(path)
-
 main()

nixos/modules/system/boot/systemd/initrd.nix

@@ -132,20 +132,13 @@ let
   initialRamdisk = pkgs.makeInitrdNG {
     name = "initrd-${kernel-name}";
     inherit (config.boot.initrd) compressor compressorArgs prepend;
+    inherit (cfg) strip;
 
     contents = lib.filter ({ source, ... }: !lib.elem source cfg.suppressedStorePaths) cfg.storePaths;
   };
 
 in
 {
-  imports = [
-    (lib.mkRemovedOptionModule [ "boot" "initrd" "systemd" "strip" ] ''
-      The option to strip ELF files in initrd has been removed.
-      It only saved ~1MiB of initramfs size, but caused a few issues
-      like unloadable kernel modules.
-    '')
-  ];
-
   options.boot.initrd.systemd = {
     enable = mkEnableOption "systemd in initrd" // {
       description = ''
@@ -215,6 +208,19 @@ in
       default = [ ];
     };
 
+    strip = mkOption {
+      description = ''
+        Whether to completely strip executables and libraries copied to the initramfs.
+
+        Setting this to false may save on the order of 30MiB on the
+        machine building the system (by avoiding a binutils
+        reference), at the cost of ~1MiB of initramfs size. This puts
+        this option firmly in the territory of micro-optimisation.
+      '';
+      type = types.bool;
+      default = true;
+    };
+
     extraBin = mkOption {
       description = ''
         Tools to add to /bin