haskellPackages.hie-bios: restrict to 0.19 (#543505)

Changes: https://github.com/glauth/glauth/compare/GLAuth-v2.5.0...GLAuth-v2.5.1

.github/workflows/build.yml

@@ -59,7 +59,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true

.github/workflows/check.yml

@@ -147,7 +147,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

.github/workflows/eval.yml

@@ -139,7 +139,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Load supported versions
         id: versions
@@ -187,7 +187,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -277,7 +277,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Combine all output paths and eval stats
         run: |
@@ -486,7 +486,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'

.github/workflows/lint.yml

@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

ci/OWNERS

@@ -41,7 +41,7 @@
 /lib/meta.nix               @alyssais @NixOS/stdenv @llakala
 /lib/meta-types.nix         @infinisil @adisbladis @NixOS/stdenv @llakala
 /lib/source-types.nix       @alyssais @NixOS/stdenv @llakala
-/lib/systems                @alyssais @NixOS/stdenv @llakala
+/lib/systems                @alyssais @NixOS/stdenv
 ## Libraries / Module system
 /lib/modules.nix            @infinisil @roberth @hsjobeki @llakala
 /lib/types.nix              @infinisil @roberth @hsjobeki @llakala
@@ -260,7 +260,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/editors/jetbrains @leona-ya @theCapypara
 
 # Licenses
-/lib/licenses @alyssais @emilazy @jopejoe1 @llakala
+/lib/licenses @alyssais @emilazy @jopejoe1
 
 # Qt
 /pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000

ci/github-script/bot.js

@@ -395,6 +395,13 @@ module.exports = async ({ github, context, core, dry }) => {
         pull_number,
         per_page: 100,
       })
+
+      // label llm-assisted PRs accordingly
+      const assistedByPattern = /Assisted-by: (?!nix-init)/i
+      evalLabels['llm-assisted'] = prCommits.some((c) =>
+        assistedByPattern.test(c.commit.message),
+      )
+
       const commitSubjects = prCommits.map(
         (c) => c.commit.message.split('\n')[0],
       )

doc/build-helpers/fixed-point-arguments.chapter.md

@@ -143,3 +143,4 @@ lib.extendMkDerivation {
     });
 }
 ```
+:::

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -165,7 +165,7 @@ They are useful for creating files from Nix expressions, and are all implemented
 Each of these functions will cause a derivation to be produced.
 When you coerce the result of each of these functions to a string with [string interpolation](https://nixos.org/manual/nix/stable/language/string-interpolation) or [`toString`](https://nixos.org/manual/nix/stable/language/builtins#builtins-toString), it will evaluate to the [store path](https://nixos.org/manual/nix/stable/store/store-path) of this derivation.
 
-:::: {.note}
+::: {.note}
 Some of these functions will put the resulting files within a directory inside the [derivation output](https://nixos.org/manual/nix/stable/language/derivations#attr-outputs).
 If you need to refer to the resulting files somewhere else in a Nix expression, append their path to the derivation's store path.
 
@@ -190,7 +190,7 @@ writeShellScript "evaluate-my-file.sh" ''
   cat ${my-file}/share/my-file
 ''
 ```
-::::
+:::
 
 ### `makeDesktopItem` {#trivial-builder-makeDesktopItem}
 

doc/doc-support/header.html

@@ -0,0 +1,7 @@
+<div class="manual-header">
+    <nav class="manual-header--tabs">
+        <a class="manual-header--tab manual-header--tab-active" href="#">Nixpkgs</a>
+        <a class="manual-header--tab" href="https://nixos.org/manual/nixos/stable/">NixOS</a>
+    </nav>
+    <span class="manual-header--title">Nixpkgs Manual</span>
+</div>

doc/doc-support/package.nix

@@ -119,6 +119,8 @@ stdenvNoCC.mkDerivation (
         --script ./anchor-use.js \
         --sidebar-depth 3 \
         --nav ./nav.json \
+        --header ${./header.html}\
+        --no-navheader \
         manual.md \
         out/index.html
 

doc/languages-frameworks/rocq.section.md

@@ -59,7 +59,7 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
 * `releaseRev` (optional, defaults to `(v: v)`), provides a default mapping from release names to revision hashes/branch names/tags,
 * `releaseArtifact` (optional, defaults to `(v: null)`), provides a default mapping from release names to artifact names (only works for github artifact for now),
 * `displayVersion` (optional), provides a way to alter the computation of `name` from `pname`, by explaining how to display version numbers,
-* `namePrefix` (optional, defaults to `[ "rocq-core" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
+* `namePrefix` (optional, defaults to `[ "rocq" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
 * `nativeBuildInputs` (optional), is a list of executables that are required to build the current derivation, in addition to the default ones (namely `which`, `dune` and `ocaml` depending on whether `useDune`, `useDuneifVersion` and `mlPlugin` are set).
 * `extraNativeBuildInputs` (optional, deprecated), an additional list of derivation to add to `nativeBuildInputs`,
 * `overrideNativeBuildInputs` (optional) replaces the default list of derivation to which `nativeBuildInputs` and `extraNativeBuildInputs` adds extra elements,
@@ -74,6 +74,8 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
 * `enableParallelBuilding` (optional, defaults to `true`), since it is activated by default, we provide a way to disable it.
 * `extraInstallFlags` (optional), allows to extend `installFlags` which initializes the variables `COQLIBINSTALL` and `COQPLUGININSTALL` so as to install in the proper subdirectory. Indeed Rocq libraries should be installed in `$(out)/lib/coq/${rocq-core.rocq-version}/user-contrib/`. Such directories are automatically added to the `$ROCQPATH` environment variable by the hook defined in the Rocq derivation.
 * `setROCQBIN` (optional, defaults to `true`), by default, the environment variable `$ROCQBIN` is set to the current Rocq's binary, but one can disable this behavior by setting it to `false`,
+* `useCoq` (optional, defaults to `false`), adds the Coq compatibility binaries to the build environment, which is necessary for some packages that still depend on them and sets `COQBIN` to the path of the `coqc` binary (if `setROCQBIN` is also set to `true`). A wrapper `mkCoqDerivation` is provided that sets this option to `true`.
+* `useCoqifVersion` (optional, defaults to `(x: false)`), adds the Coq compatibility binaries to the build environment if the provided predicate evaluates to true on the version. This can be useful for supporting old package versions that need the Coq compatibility binaries, while newer versions do not.
 * `useMelquiondRemake` (optional, default to `null`) is an attribute set, which, if given, overloads the `preConfigurePhases`, `configureFlags`, `buildPhase`, and `installPhase` attributes of the derivation for a specific use in libraries using `remake` as set up by Guillaume Melquiond for `flocq`, `gappalib`, `interval`, and `coquelicot` (see the corresponding derivation for concrete examples of use of this option). For backward compatibility, the attribute `useMelquiondRemake.logpath` must be set to the logical root of the library (otherwise, one can pass `useMelquiondRemake = {}` to activate this without backward compatibility).
 * `dropAttrs`, `keepAttrs`, `dropDerivationAttrs` are all optional and allow to tune which attribute is added or removed from the final call to `mkDerivation`.
 

doc/release-notes/rl-2611.section.md

@@ -42,13 +42,21 @@
 
 - `python3Packages.django-health-check` has been updated to major version 4. See its [migration guide](https://codingjoe.dev/django-health-check/migrate-to-v4/) and [changelog](https://github.com/codingjoe/django-health-check/releases/tag/4.0.0) for breaking changes.
 
+- `jmtpfs` has been removed due to lack of maintenance and fuse3 support.
+
 - `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.
 
+- `mcphost` has been removed, as it was archived upstream and declared unmaintained.
+
+- `fflogs` has been removed because it was no longer functional. Users should switch to `archon-lite`.
+
 - `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
   Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
 
 - `zerofs` has been updated from `1.x` to `2.x` which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.
 
+- `keycloak.plugins.keycloak-metrics-spi` has been removed. Keycloak exposes Prometheus metrics natively on its management interface; enable them with the `metrics-enabled` setting (and `event-metrics-user-enabled` for login and event counters). See [Gaining insights with metrics](https://www.keycloak.org/observability/configuration-metrics).
+
 - `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
 
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
@@ -90,6 +98,8 @@
 
 - `texlive.combine` is deprecated and scheduled for removal in 27.05. Please migrate to `texliveSmall.withPackages` (see [](#sec-language-texlive-user-guide)).
 
+- `keycloak` was updated to >= 26.7.0 and includes some breaking internal (API) changes. See the [upstream migration guide](https://www.keycloak.org/docs/latest/upgrading/#migrating-to-26-7-0) for more information.
+
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
 
 - `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.
@@ -106,6 +116,7 @@
 - Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
 - `nim1` and respective aliases have been removed due to entering EOL; please migrate to `nim` or `nim-unwrapped` (nim 2).
 - `nim-2_0` & `nim-2_2` and respective aliases have been removed; please migrate to `nim` or `nim-unwrapped` (nim 2.2.10).
+- `domoticz` has been updated from `2024.7` to `2026.x`, breaking third party applications and scripts using the old RType calls. Review the [release notes](https://github.com/domoticz/domoticz/blob/2026.2/History.txt#L398) for more information.
 
 - `vimacs` has been removed, as it has not been maintained in 10 years and was built for an old version of vim (6.0).
 
@@ -137,15 +148,15 @@
 
 ### Breaking changes {#sec-nixpkgs-release-26.11-lib-breaking}
 
-- Create the first release note entry in this section!
-
+- `fittrackee` 1.0.0 now requires postgres with postgis. The [upgrade guide](https://docs.fittrackee.org/en/upgrading-to-1.0.0.html) has steps to prepare for this upgrade.
 
 ### Deprecations {#sec-nixpkgs-release-26.11-lib-deprecations}
 
-- Create the first release note entry in this section!
+- Setting `config.allowBrokenPredicate` is deprecated in favor of
+  using `config.problems.handlers.PackageName.broken = "warn"` (or `=
+  "ignore"`). For more information see [](#sec-allow-broken).
 
 
 ### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}
 
 - Create the first release note entry in this section!
-

doc/style.css

@@ -23,14 +23,14 @@ body {
 @media screen and (min-width: 992px) {
   .book,
   .appendix {
-    max-width: 60rem;
+    max-width: 55rem;
   }
 }
 
 @media screen and (min-width: 1200px) {
   .book,
   .appendix {
-    max-width: 73rem;
+    max-width: 55rem;
   }
 }
 
@@ -156,8 +156,7 @@ body {
 }
 
 a {
-  text-decoration: none;
-  border-bottom: 1px solid;
+  text-decoration: underline;
   color: var(--link-color);
 }
 
@@ -398,6 +397,7 @@ div.appendix .variablelist .term {
 
 :root {
   --sidebar-width: 20rem;
+  --header-height: 3rem;
   --background: #fff;
   --main-text-color: #000;
   --link-color: #405d99;
@@ -479,6 +479,8 @@ div.appendix .variablelist .term {
 nav.toc-sidebar {
   height: 100%;
   padding: 0 1rem 2rem;
+  background-color: var(--background);
+  color: var(--main-text-color);
 }
 
 /* menu button, shown on mobile, hidden on desktop */
@@ -520,6 +522,59 @@ nav.toc-sidebar li {
 
 nav.toc-sidebar summary {
   cursor: pointer;
+  display: flex;
+  align-items: center;
+  list-style: none;
+}
+
+nav.toc-sidebar summary::before {
+  content: "▸";
+  flex: none;
+  font-size: 0.75em;
+}
+nav.toc-sidebar details[open] > summary::before {
+  content: "▾";
+}
+
+nav.toc-sidebar a {
+  display: block;
+  width: 100%;
+  padding: 3px 8px;
+  border-left: 3px solid transparent;
+  border-radius: 3px;
+  color: inherit;
+  transition:
+    background-color 120ms ease,
+    border-color 120ms ease;
+}
+nav.toc-sidebar a:hover {
+  background-color: #f2f2f2 !important;
+}
+
+nav.toc-sidebar a.active {
+  background-color: #d8d8d8;
+  border-left-color: #444;
+  font-weight: 600;
+}
+nav.toc-sidebar a.active-trail {
+  border-left-color: #bbb;
+  background-color: #e8e8e8;
+}
+
+@media (prefers-color-scheme: dark) {
+  nav.toc-sidebar a:hover {
+    /* hover should win over scroll selectors despite beeing less specific */
+    background-color: #606060 !important;
+  }
+  nav.toc-sidebar a.active {
+    background-color: #373737;
+    border-left-color: #eee;
+    font-weight: 600;
+  }
+  nav.toc-sidebar a.active-trail {
+    border-left-color: #eee;
+    background-color: #323232;
+  }
 }
 
 @media screen and (min-width: 768px) {
@@ -528,7 +583,7 @@ nav.toc-sidebar summary {
     min-height: 0;
     display: grid;
     grid-template-columns: minmax(0, 1fr);
-    grid-template-rows: auto minmax(0, 1fr);
+    grid-template-rows: var(--header-height) auto minmax(0, 1fr);
   }
 
   body:has(> nav.toc-sidebar) {
@@ -537,7 +592,7 @@ nav.toc-sidebar summary {
 
   .navheader {
     grid-column: 1 / -1;
-    grid-row: 1;
+    grid-row: 2;
   }
 
   nav.toc-sidebar {
@@ -548,11 +603,10 @@ nav.toc-sidebar summary {
     /*  */
     margin: 0;
     grid-column: 1;
-    grid-row: 2;
+    grid-row: 3;
     max-height: none;
     overflow-y: auto;
     border: none;
-    border-right: 0.0625rem solid #d8d8d8;
   }
 
   /* Hide the toggle button on desktop */
@@ -562,7 +616,7 @@ nav.toc-sidebar summary {
 
   main.content {
     grid-column: 1 / -1;
-    grid-row: 2;
+    grid-row: 3;
     overflow-y: auto;
     padding: 0 1rem;
   }
@@ -571,3 +625,73 @@ nav.toc-sidebar summary {
     grid-column: 2;
   }
 }
+
+.manual-header {
+  background-color: var(--background);
+  border-bottom: 0.0625rem solid #d8d8d8;
+  display: flex;
+  flex-direction: column;
+}
+
+.manual-header--title {
+  order: -1;
+  padding: 0.5rem 1rem 0;
+  font-size: 0.875rem;
+  font-weight: 500;
+  color: var(--small-heading-color);
+  text-align: center;
+}
+
+.manual-header--tabs {
+  display: flex;
+  align-items: stretch;
+  justify-content: space-around;
+  margin: 0;
+  padding: 0;
+}
+
+.manual-header--tab {
+  display: flex;
+  align-items: center;
+  padding: 0 1rem;
+  font-size: 0.875rem;
+  font-weight: 500;
+  color: var(--main-text-color);
+  text-decoration: none;
+  border-bottom: 0.1875rem solid transparent;
+  border-top: 0.1875rem solid transparent;
+  transition: border-bottom-color 0.15s ease;
+}
+
+.manual-header--tab:hover {
+  border-bottom-color: var(--heading-color);
+  color: var(--main-text-color);
+}
+
+.manual-header--tab-active {
+  border-bottom-color: var(--heading-color);
+  color: var(--heading-color);
+  font-weight: 700;
+}
+
+@media screen and (min-width: 768px) {
+  .manual-header {
+    height: var(--header-height);
+    flex-direction: row;
+    align-items: stretch;
+    grid-column: 1 / -1;
+    grid-row: 1;
+  }
+
+  .manual-header--title {
+    order: 0;
+    margin-left: auto;
+    padding: 0 1rem;
+    align-self: center;
+  }
+
+  .manual-header--tabs {
+    justify-content: flex-start;
+    padding: 0 1rem;
+  }
+}

doc/using/platform-support.chapter.md

@@ -1,16 +1,16 @@
 # Platform Support {#chap-platform-support}
 
-Packages receive varying degrees of support, both in terms of maintainer attention and available computation resources for continuous integration (CI). We have 7 defined tiers denoting how well supported each platform is.
+Packages receive varying degrees of support, both in terms of maintainer and security team attention and available computation resources for continuous integration (CI). We have 7 defined tiers denoting how well supported each platform is.
 
 ## Tiers {#sec-platform-tiers}
 
 ### Tier 1 {#sec-platform-tier1}
 
-[Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) platforms receive the highest level of support where problems can block updates, platform-specific patches are freely applied, and most packages are expected to work.
+[Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) platforms receive the highest level of support where problems can block updates, security fixes are treated with urgency, platform-specific patches are freely applied, and most packages are expected to work.
 
 ### Tier 2 {#sec-platform-tier2}
 
-[Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) platforms are expected to remain functional with updates, receive platform-specific patches as needed, and have many packages built by Hydra with full ofBorg support.
+[Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) platforms are expected to remain functional and secure with updates, receive platform-specific patches as needed, and have many packages built by Hydra with full ofBorg support.
 
 ### Tier 3 {#sec-platform-tier3}
 
@@ -22,25 +22,25 @@ Platform Tiers [4 through 7](https://github.com/NixOS/rfcs/blob/master/rfcs/0046
 
 ## Breakdown {#sec-platform-breakdown}
 
-| Triple                                | Support Tier | Channel Blockers | Hydra Support | Ofborg Support | Bootstrap Tarballs | Cross Compiling Support |
-| ------------------------------------- | ------------ | ---------------- | ------------- | -------------- | ------------------ | ----------------------- |
-| `x86_64-unknown-linux-gnu`            | [Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) | Many | ✔️            | ✔️            | ✔️                 | ✔️                      |
-| `aarch64-unknown-linux-gnu`           | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ✔️                      |
-| `x86_64-unknown-linux-musl`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
-| `aarch64-unknown-linux-musl`          | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
-| `x86_64-unknown-unknown-freebsd`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ❌                       |
-| `i686-unknown-linux-gnu`              | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
-| `riscv32-unknown-linux-gnu`           | [Tier 4](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-4) | None | ❌             | ❌             | ❌                  | ✔️                      |
-| `riscv64-unknown-linux-gnu`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `loongarch64-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `armv6l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `armv6l-unknown-linux-musleabihf`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `armv7l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `armv5tel-unknown-linux-gnueabi`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `mips64el-unknown-linux-gnuabi64`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `mips64el-unknown-linux-gnuabin32`    | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `mipsel-unknown-linux-gnu`            | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `powerpc64-unknown-linux-gnuabielfv2` | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `powerpc64le-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `s390x-unknown-linux-gnu`             | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| Triple                                | Support Tier                                                                                   | Channel Blockers | Hydra Support | Security Support | Ofborg Support | Bootstrap Tarballs | Cross Compiling Support |
+|---------------------------------------|------------------------------------------------------------------------------------------------|------------------|---------------|------------------|----------------|--------------------|-------------------------|
+| `x86_64-unknown-linux-gnu`            | [Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) | Many             | ✔️             | ✔️                | ✔️              | ✔️                  | ✔️                       |
+| `aarch64-unknown-linux-gnu`           | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some             | ✔️             | ✔️                | ✔️              | ✔️                  | ✔️                       |
+| `x86_64-unknown-linux-musl`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | Limited       | ❌               | ❌             | ✔️                  | ✔️                       |
+| `aarch64-unknown-linux-musl`          | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | Limited       | ❌               | ❌             | ✔️                  | ✔️                       |
+| `x86_64-unknown-unknown-freebsd`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some             | ✔️             | ✔️                | ✔️              | ✔️                  | ❌                      |
+| `i686-unknown-linux-gnu`              | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | Limited       | ❌               | ❌             | ✔️                  | ✔️                       |
+| `riscv32-unknown-linux-gnu`           | [Tier 4](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-4) | None             | ❌            | ❌               | ❌             | ❌                 | ✔️                       |
+| `riscv64-unknown-linux-gnu`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `loongarch64-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `armv6l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `armv6l-unknown-linux-musleabihf`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `armv7l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `armv5tel-unknown-linux-gnueabi`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `mips64el-unknown-linux-gnuabi64`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `mips64el-unknown-linux-gnuabin32`    | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `mipsel-unknown-linux-gnu`            | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `powerpc64-unknown-linux-gnuabielfv2` | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `powerpc64le-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `s390x-unknown-linux-gnu`             | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |

lib/attrsets.nix

@@ -1140,7 +1140,7 @@ rec {
 
     For a function that gives you control over what counts as a leaf, see `mapAttrsRecursiveCond`.
 
-    :::{#map-attrs-recursive-example .example}
+    ::: {.example #map-attrs-recursive-example}
     # Map over leaf attributes
 
     ```nix
@@ -1165,7 +1165,7 @@ rec {
     If the predicate returns false, `mapAttrsRecursiveCond` does not recurse, but instead applies the mapping function.
     If the predicate returns true, it does recurse, and does not apply the mapping function.
 
-    :::{#map-attrs-recursive-cond-example .example}
+    ::: {.example #map-attrs-recursive-cond-example}
     # Map over an leaf attributes defined by a condition
 
     Map derivations to their `name` attribute.

lib/customisation.nix

@@ -564,7 +564,7 @@ rec {
 
     # Examples
 
-    :::{#ex-makeScope .example}
+    :::{.example #ex-makeScope}
     # Create an interdependent package set on top of `pkgs`
 
     The functions in `foo.nix` and `bar.nix` can depend on each other, in the sense that `foo.nix` can contain a function that expects `bar` as an attribute in its argument.
@@ -593,7 +593,7 @@ rec {
     ```
     :::
 
-    :::{#ex-makeScope-callPackage .example}
+    :::{.example #ex-makeScope-callPackage}
     # Using `callPackage` from a scope
 
     ```nix

lib/licenses/licenses.nix

@@ -310,6 +310,11 @@ lib.mapAttrs mkLicense (
       redistributable = true;
     };
 
+    buddy = {
+      spdxId = "Buddy";
+      fullName = "Buddy License";
+    };
+
     bzip2 = {
       spdxId = "bzip2-1.0.6";
       fullName = "bzip2 and libbzip2 License v1.0.6";
@@ -382,6 +387,13 @@ lib.mapAttrs mkLicense (
       free = false;
     };
 
+    cc-by-nc-30-igo = {
+      # Currently does not have a spdxID will get one in the future https://github.com/spdx/license-list-XML/issues/2845
+      # spdxId = "CC-BY-NC-3.0-IGO";
+      fullName = "Creative Commons Attribution Non Commercial 3.0 IGO";
+      free = false;
+    };
+
     cc-by-nc-40 = {
       spdxId = "CC-BY-NC-4.0";
       fullName = "Creative Commons Attribution Non Commercial 4.0 International";
@@ -926,6 +938,11 @@ lib.mapAttrs mkLicense (
       free = false;
     };
 
+    jpl-image = {
+      fullName = "JPL Image Use Policy";
+      spdxId = "JPL-image";
+    };
+
     knuth = {
       fullName = "Knuth CTAN License";
       spdxId = "Knuth-CTAN";
@@ -1173,6 +1190,11 @@ lib.mapAttrs mkLicense (
       fullName = "Nethack General Public License";
     };
 
+    ngrep = {
+      spdxId = "ngrep";
+      fullName = "ngrep License";
+    };
+
     nistSoftware = {
       spdxId = "NIST-Software";
       fullName = "NIST Software License";
@@ -1606,6 +1628,11 @@ lib.mapAttrs mkLicense (
       url = "https://fedoraproject.org/wiki/Licensing:Wadalab?rd=Licensing/Wadalab";
     };
 
+    wordnet = {
+      spdxId = "WordNet";
+      fullName = "WordNet License";
+    };
+
     wtfpl = {
       spdxId = "WTFPL";
       fullName = "Do What The F*ck You Want To Public License";

lib/options.nix

@@ -90,12 +90,12 @@ rec {
       `defaultText`
       : Substitute for documenting the `default`, if evaluating the default value during documentation rendering is not possible.
       : Can be any nix value that evaluates.
-      : Usage with `lib.literalMD` or `lib.literalExpression` is supported
+      : Usage with `lib.literalMD`, `lib.literalExpression`, or `lib.literalCode` is supported
 
       `example`
       : Optional example value used in the manual.
       : Can be any nix value that evaluates.
-      : Usage with `lib.literalMD` or `lib.literalExpression` is supported
+      : Usage with `lib.literalMD`, `lib.literalExpression`, or `lib.literalCode` is supported
 
       `description`
       : Optional string describing the option. This is required if option documentation is generated.

maintainers/github-teams.json

@@ -151,6 +151,7 @@
       "samuela": 226872
     },
     "members": {
+      "ethancedwards8": 60861925,
       "prusnak": 42201
     },
     "name": "cuda-maintainers"
@@ -365,10 +366,10 @@
   "freedesktop": {
     "description": "Maintain Freedesktop.org packages for graphical desktop.",
     "id": 3806136,
-    "maintainers": {},
-    "members": {
+    "maintainers": {
       "jtojnar": 705123
     },
+    "members": {},
     "name": "Freedesktop"
   },
   "geospatial": {

maintainers/maintainer-list.nix

@@ -1289,6 +1289,12 @@
     name = "Alexandru Tocar";
     keys = [ { fingerprint = "B617 DD24 3AB0 2E3F 2E67  DBFD 1305 2A85 D7A4 2AA4"; } ];
   };
+  AlexAntonik = {
+    email = "antonikavv@gmail.com";
+    github = "AlexAntonik";
+    githubId = 55547934;
+    name = "Alex Antonik";
+  };
   alexarice = {
     email = "alexrice999@hotmail.co.uk";
     github = "alexarice";
@@ -1629,12 +1635,6 @@
     githubId = 382798;
     name = "amfl";
   };
-  amiddelk = {
-    email = "amiddelk@gmail.com";
-    github = "amiddelk";
-    githubId = 1358320;
-    name = "Arie Middelkoop";
-  };
   aminechikhaoui = {
     email = "amine.chikhaoui91@gmail.com";
     github = "AmineChikhaoui";
@@ -1943,6 +1943,17 @@
     githubId = 143312793;
     name = "Annin";
   };
+  anntnzrb = {
+    github = "anntnzrb";
+    githubId = 51257127;
+    name = "anntnzrb";
+  };
+  anntoin = {
+    email = "anntoin@gmail.com";
+    github = "Anntoin";
+    githubId = 3289027;
+    name = "Anntóin Wilkinson";
+  };
   anoa = {
     matrix = "@andrewm:amorgan.xyz";
     email = "andrew@amorgan.xyz";
@@ -2002,6 +2013,12 @@
     githubId = 14838767;
     name = "Jacopo Scannella";
   };
+  antoineco = {
+    email = "hello@acotten.com";
+    github = "antoineco";
+    githubId = 3299086;
+    name = "Antoine Cotten";
+  };
   anton-4 = {
     name = "Anton";
     github = "Anton-4";
@@ -4427,6 +4444,12 @@
       { fingerprint = "8916 F727 734E 77AB 437F  A33A 19AB 76F5 CEE1 1392"; }
     ];
   };
+  caguiclajmg = {
+    email = "jmg.caguicla@guarandoo.me";
+    github = "caguiclajmg";
+    githubId = 32662060;
+    name = "John Mark Gabriel Caguicla";
+  };
   CaiqueFigueiredo = {
     email = "public@caiquefigueiredo.me";
     github = "caiquefigueiredo";
@@ -4640,6 +4663,13 @@
     githubId = 53847249;
     name = "Casey Avila";
   };
+  cassandracomar = {
+    name = "Cassandra Comar";
+    github = "cassandracomar";
+    githubId = 320772;
+    email = "cass@mountclare.net";
+    keys = [ { fingerprint = "104E E74E 24A0 372B EAF5  5533 B019 18F7 7E04 AC99"; } ];
+  };
   castorNova2 = {
     email = "solemnsquire@gmail.com";
     github = "castorNova2";
@@ -4719,12 +4749,6 @@
     githubId = 52760912;
     name = "Cameron Brown";
   };
-  ccellado = {
-    email = "annplague@gmail.com";
-    github = "ccellado";
-    githubId = 44584960;
-    name = "Denis Khalmatov";
-  };
   ccicnce113424 = {
     email = "ccicnce113424@gmail.com";
     matrix = "@ccicnce113424:matrix.org";
@@ -5595,6 +5619,11 @@
     githubId = 5953003;
     name = "Connor Nelson";
   };
+  conny = {
+    github = "ConstantConstantin";
+    githubId = 162139822;
+    name = "Constantin-Paul Hertel";
+  };
   conradmearns = {
     email = "conradmearns+github@pm.me";
     github = "ConradMearns";
@@ -6240,6 +6269,12 @@
     github = "darkyzhou";
     githubId = 7220778;
   };
+  darshancode2005 = {
+    name = "Darshan Thakare";
+    email = "darshanthakaregsoc2023@gmail.com";
+    github = "DarshanCode2005";
+    githubId = 143271270;
+  };
   daru-san = {
     name = "Daru";
     email = "zadarumaka@proton.me";
@@ -6345,6 +6380,12 @@
     github = "David-Kopczynski";
     githubId = 53194670;
   };
+  David-Moody = {
+    name = "David Moody";
+    email = "david.moody@scot.me.uk";
+    github = "David-Moody";
+    githubId = 63956662;
+  };
   david-sawatzke = {
     email = "d-nix@sawatzke.dev";
     github = "david-sawatzke";
@@ -6779,6 +6820,13 @@
     githubId = 77843198;
     name = "Vasilis Manetas";
   };
+  Deric-W = {
+    email = "robo-eric@gmx.de";
+    github = "Deric-W";
+    githubId = 42873573;
+    name = "Eric Wolf";
+    keys = [ { fingerprint = "ADAA B6F3 A955 5589 D66C  CE61 80D2 DA42 8A4A 537F"; } ];
+  };
   DerickEddington = {
     email = "derick.eddington@pm.me";
     github = "DerickEddington";
@@ -7036,12 +7084,6 @@
     github = "DimitarNestorov";
     githubId = 8790386;
   };
-  diniamo = {
-    name = "diniamo";
-    email = "diniamo53@gmail.com";
-    github = "diniamo";
-    githubId = 55629891;
-  };
   diogomdp = {
     email = "me@diogodp.dev";
     github = "diogomdp";
@@ -8847,6 +8889,13 @@
     githubId = 345808;
     name = "Jakub Okoński";
   };
+  FatBoyXPC = {
+    name = "FatBoyXPC";
+    email = "fatboyxpc@gmail.com";
+    github = "FatBoyXPC";
+    githubId = 744962;
+    keys = [ { fingerprint = "0E08 1B81 CBCA 1CF7 9568  A13F C4ED 3CA2 3211 8969"; } ];
+  };
   faukah = {
     github = "faukah";
     name = "faukah";
@@ -9027,6 +9076,11 @@
     githubId = 5198058;
     name = "Udo Sauer";
   };
+  fernvenue = {
+    github = "fernvenue";
+    githubId = 84565547;
+    name = "fernvenue";
+  };
   feyorsh = {
     email = "george@feyor.sh";
     github = "Feyorsh";
@@ -9083,6 +9137,12 @@
     githubId = 41450706;
     name = "fin-w";
   };
+  fiona = {
+    email = "mail@fiona.hamburg";
+    github = "Fiona42069";
+    githubId = 260108682;
+    name = "fiona";
+  };
   fionera = {
     email = "nix@fionera.de";
     github = "fionera";
@@ -10024,12 +10084,6 @@
     name = "Will Owens";
     keys = [ { fingerprint = "8E98 BB01 BFF8 AEA4 E303  FC4C 8074 09C9 2CE2 3033"; } ];
   };
-  ghuntley = {
-    email = "ghuntley@ghuntley.com";
-    github = "ghuntley";
-    githubId = 127353;
-    name = "Geoffrey Huntley";
-  };
   gibbert = {
     email = "gbjgms@gmail.com";
     github = "zgibberish";
@@ -10392,6 +10446,12 @@
     githubId = 273582;
     name = "greg";
   };
+  gregshuflin = {
+    email = "greg@everdayimshuflin.com";
+    github = "neunenak";
+    githubId = 311545;
+    name = "Greg Shuflin";
+  };
   greizgh = {
     email = "greizgh@ephax.org";
     github = "greizgh";
@@ -11451,6 +11511,18 @@
     githubId = 69209;
     name = "Ian Duncan";
   };
+  IanHollow = {
+    github = "IanHollow";
+    githubId = 72767437;
+    name = "Ian Holloway";
+  };
+  iank = {
+    email = "iank@iank.org";
+    github = "iank";
+    githubId = 109598;
+    name = "Ian Kilgore";
+    keys = [ { fingerprint = "21F7 244E 095F 619E 8E3E  1EB4 9F3A 4AAB 4D90 D879"; } ];
+  };
   ianliu = {
     email = "ian.liu88@gmail.com";
     github = "ianliu";
@@ -11861,12 +11933,6 @@
     name = "Silvan Mosberger";
     keys = [ { fingerprint = "6C2B 55D4 4E04 8266 6B7D  DA1A 422E 9EDA E015 7170"; } ];
   };
-  iniw = {
-    email = "git@vini.cat";
-    github = "iniw";
-    githubId = 30220881;
-    name = "Vinicius Deolindo";
-  };
   insipx = {
     email = "github@andrewplaza.dev";
     github = "insipx";
@@ -11910,6 +11976,12 @@
     githubId = 16307070;
     name = "iosmanthus";
   };
+  ipetkov = {
+    name = "Ivan Petkov";
+    github = "ipetkov";
+    githubId = 1638690;
+    email = "nixpkgs@ipetkov.dev";
+  };
   ipsavitsky = {
     email = "ipsavitsky234@gmail.com";
     github = "ipsavitsky";
@@ -12478,6 +12550,12 @@
     github = "JaviMerino";
     githubId = 44926;
   };
+  jayadeep-km-sonarsource = {
+    email = "jayadeep.kinavoormadam@sonarsource.com";
+    name = "Jayadeep Kinavoor Madam";
+    github = "jayadeep-km-sonarsource";
+    githubId = 156662663;
+  };
   jayesh-bhoot = {
     name = "Jayesh Bhoot";
     email = "jb@jayeshbhoot.com";
@@ -12751,6 +12829,12 @@
     githubId = 5741620;
     name = "Jeremy Schlatter";
   };
+  jeremystucki = {
+    email = "dev@jeremystucki.ch";
+    github = "jeremystucki";
+    githubId = 7629727;
+    name = "Jeremy Stucki";
+  };
   jerith666 = {
     email = "github@matt.mchenryfamily.org";
     github = "jerith666";
@@ -14102,6 +14186,14 @@
     name = "Kenichi Kamiya";
     keys = [ { fingerprint = "9121 5D87 20CA B405 C63F  24D2 EF6E 574D 040A E2A5"; } ];
   };
+  kacper-uminski = {
+    name = "Kacper Uminski";
+    email = "kacper+nixpkgs@lysator.liu.se";
+    github = "kacper-uminski";
+    githubId = 57466578;
+    matrix = "@kacper.uminski:matrix.org";
+    keys = [ { fingerprint = "3DF9 3DEB CAA9 81FA B3E2  A7F0 87DA 201D E02F 14B1"; } ];
+  };
   kaction = {
     name = "Dmitry Bogatov";
     email = "KAction@disroot.org";
@@ -14341,6 +14433,12 @@
     github = "keller00";
     githubId = 8452750;
   };
+  kenis1108 = {
+    email = "1836362346@qq.com";
+    github = "kenis1108";
+    githubId = 45393183;
+    name = "kenis";
+  };
   kenran = {
     email = "johannes.maier@mailbox.org";
     github = "kenranunderscore";
@@ -16363,6 +16461,11 @@
     githubId = 83420438;
     name = "Lewis";
   };
+  lubsch = {
+    github = "lubsch";
+    githubId = 33580245;
+    name = "Benjamin Lohmar";
+  };
   luc65r = {
     email = "lucas@ransan.fr";
     github = "luc65r";
@@ -18814,6 +18917,12 @@
     githubId = 830082;
     name = "Nathan Moos";
   };
+  mootfrost = {
+    email = "hello@mootfrost.dev";
+    github = "mootfrost";
+    githubId = 75925945;
+    name = "Andrew Semeykin";
+  };
   moraxyc = {
     name = "Moraxyc Xu";
     email = "i@qaq.li";
@@ -20084,6 +20193,12 @@
     github = "nigelgbanks";
     githubId = 487373;
   };
+  nightconcept = {
+    email = "dark@nightconcept.net";
+    github = "nightconcept";
+    githubId = 486025;
+    name = "Danny Solivan";
+  };
   nikhilmaddirala = {
     name = "Nikhil Maddirala";
     github = "nikhilmaddirala";
@@ -20309,6 +20424,12 @@
     githubId = 4242897;
     name = "Nikolai Mishin";
   };
+  nmoya = {
+    email = "nikolasmoya@gmail.com";
+    github = "nmoya";
+    githubId = 1767648;
+    name = "Nikolas Moya";
+  };
   noaccos = {
     name = "Francesco Noacco";
     email = "francesco.noacco2000@gmail.com";
@@ -21146,12 +21267,6 @@
     githubId = 19862;
     name = "KJ Ørbekk";
   };
-  orbitz = {
-    email = "mmatalka@gmail.com";
-    github = "orbitz";
-    githubId = 75299;
-    name = "Malcolm Matalka";
-  };
   orhun = {
     email = "orhunparmaksiz@gmail.com";
     github = "orhun";
@@ -24349,6 +24464,12 @@
     githubId = 20300874;
     name = "Mohammad Rafiq";
   };
+  rsahwe = {
+    email = "rsahwe@gmx.net";
+    github = "rsahwe";
+    githubId = 201613730;
+    name = "rsahwe";
+  };
   rseichter = {
     email = "nixos.org@seichter.de";
     github = "rseichter";
@@ -25608,12 +25729,6 @@
     githubId = 106669955;
     name = "Léon Gessner";
   };
-  shardy = {
-    email = "shardul@baral.ca";
-    github = "shardulbee";
-    githubId = 16765155;
-    name = "Shardul Baral";
-  };
   sharpchen = {
     github = "sharpchen";
     githubId = 77432836;
@@ -25913,6 +26028,12 @@
     name = "Nikolay Korotkiy";
     keys = [ { fingerprint = "ADF4 C13D 0E36 1240 BD01  9B51 D1DE 6D7F 6936 63A5"; } ];
   };
+  silicalet = {
+    name = "Mr. why";
+    email = "silicalet@outlook.com";
+    github = "silicalet";
+    githubId = 188071249;
+  };
   silky = {
     name = "Noon van der Silk";
     email = "noonsilk+nixpkgs@gmail.com";
@@ -26383,6 +26504,14 @@
     githubId = 7116239;
     keys = [ { fingerprint = "E067 520F 5EF2 C175 3F60  50C0 BA46 725F 6A26 7442"; } ];
   };
+  Soliprem = {
+    email = "me@soliprem.eu";
+    matrix = "@soliprem:soliprem.eu";
+    name = "Francesco Prem Solidoro";
+    github = "Soliprem";
+    githubId = 73885403;
+    keys = [ { fingerprint = "F779 4E05 D8BB A608 73D0  1312 4FD6 B0D5 1C9A B6BD"; } ];
+  };
   solson = {
     email = "scott@solson.me";
     matrix = "@solson:matrix.org";
@@ -26575,12 +26704,6 @@
     github = "spreetin";
     githubId = 7392173;
   };
-  sprock = {
-    email = "rmason@mun.ca";
-    github = "sprock";
-    githubId = 6391601;
-    name = "Roger Mason";
-  };
   sputn1ck = {
     email = "kon@kon.ninja";
     github = "sputn1ck";
@@ -27155,6 +27278,13 @@
     githubId = 36695359;
     name = "Vasyl Solovei";
   };
+  swaggeroo = {
+    email = "swaggerooo@pm.me";
+    github = "swaggeroo";
+    githubId = 57057662;
+    name = "Swaggeroo";
+    keys = [ { fingerprint = "D221 99EC 4FFF EF4D F29D  2435 5208 74E7 3291 4E0B"; } ];
+  };
   swarren83 = {
     email = "shawn.w.warren@gmail.com";
     github = "swarren83";
@@ -29652,12 +29782,6 @@
     githubId = 20145996;
     name = "Victor Fuentes";
   };
-  vlstill = {
-    email = "xstill@fi.muni.cz";
-    github = "vlstill";
-    githubId = 4070422;
-    name = "Vladimír Štill";
-  };
   vmandela = {
     email = "venkat.mandela@gmail.com";
     github = "vmandela";
@@ -30243,6 +30367,12 @@
     githubId = 22803888;
     name = "Lu Hongxu";
   };
+  wini = {
+    email = "dev@vini.cat";
+    github = "iniw";
+    githubId = 30220881;
+    name = "Vinicius Deolindo";
+  };
   winpat = {
     email = "patrickwinter@posteo.ch";
     github = "winpat";
@@ -31013,6 +31143,13 @@
       { fingerprint = "D2A8 A906 ACA7 B6D6 575E 9A2F 3A49 5054 6EA6 9E5C"; }
     ];
   };
+  yoquec = {
+    email = "alvaro.viejo@yoquec.com";
+    github = "yoquec";
+    githubId = 59575696;
+    name = "Alvaro Viejo";
+    matrix = "@yoquec.com:matrix.org";
+  };
   yorickvp = {
     email = "yorickvanpelt@gmail.com";
     matrix = "@yorickvp:matrix.org";

maintainers/scripts/haskell/eval-pkg-sets.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash
+#!nix-shell -p jq git
+# shellcheck shell=bash
+#
+# Usage: eval-pkg-sets.sh [extra flags for nix-* commands ...]
+#
+# Must be executed in a git checkout of Nixpkgs.
+
+set -euo pipefail
+
+NIXPKGS="$(git rev-parse --show-toplevel)"
+PKGSETS="$(nix-env --readonly-mode --json --drv-path -f "$NIXPKGS" -qaP -A haskell.compiler "$@" \
+  | jq -r 'to_entries | unique_by(.value.drvPath) .[] .key | sub("^haskell.compiler";"haskell.packages")')"
+
+trap 'exit 1' SIGINT SIGTERM
+
+set +e
+
+badsets=""
+for set in $PKGSETS; do
+  # Confirm an equivalent package set to haskell.compiler.$entry exists and is usable
+  if ! nix-instantiate --readonly-mode -A "$set.ghc" "$@" > /dev/null 2>&1; then
+    echo "Skipping $set... ($set.ghc does not evaluate)"
+  else
+    echo "Evaluating $set..."
+
+    if ! nix-env --readonly-mode -f "$NIXPKGS" -qaP --drv-path -A "$set" "$@" > /dev/null; then
+      badsets+="$set "
+    fi
+  fi
+done
+
+if [ -n "$badsets" ]; then
+  echo "Found potential eval issues in the following sets:" >&2
+  # shellcheck disable=SC2086
+  printf '%s\n' $badsets
+  exit 1
+fi

maintainers/scripts/haskell/update-stackage.sh

@@ -33,7 +33,7 @@ fi
 
 # Stackage solver to use, LTS or Nightly
 # (should be capitalized like the display name)
-SOLVER=LTS
+SOLVER=Nightly
 # Stackage solver verson, if any. Use latest if empty
 VERSION=
 TMP_TEMPLATE=update-stackage.XXXXXXX
@@ -105,6 +105,7 @@ sed -r \
     -e '/ hledger-ui /d' \
     -e '/ hledger-web /d' \
     -e '/ spacecookie /d' \
+    -e '/ hnix-store-core /d' \
     < "${tmpfile_new}" >> $stackage_config
 # Explanations:
 # cabal2nix, distribution-nixpkgs, jailbreak-cabal, language-nix: These are our packages and we know what we are doing.

maintainers/scripts/luarocks-packages.csv

@@ -8,6 +8,7 @@ binaryheap,,,,,,vcunat
 bit32,,,,,5.1,lblasc
 busted,,,,,,
 busted-htest,,,,,,mrcjkb
+canola.nvim,,,,,,saadndm
 cassowary,,,,,,alerque
 cldr,,,,,,alerque
 commons.nvim,,,,,5.1,mrcjkb

maintainers/scripts/update.py

@@ -307,7 +307,7 @@ async def commit_changes(
             commit_message = "{attrPath}: {oldVersion} -> {newVersion}".format(**change)
             if "commitMessage" in change:
                 commit_message = change["commitMessage"]
-            elif "commitBody" in change:
+            if "commitBody" in change:
                 commit_message = commit_message + "\n\n" + change["commitBody"]
             await check_subprocess_output(
                 "git",

maintainers/team-list.nix

@@ -717,6 +717,15 @@ with lib.maintainers;
     github = "security-review";
   };
 
+  stardust-xr = {
+    members = [
+      pandapip1
+      technobaboo
+    ];
+    scope = "Maintain Stardust XR packages";
+    shortName = "StardustXR";
+  };
+
   stdenv = {
     enableFeatureFreezePing = true;
     github = "stdenv";

nixos/doc/manual/configuration/file-systems.chapter.md

@@ -41,5 +41,6 @@ and non-critical by adding `options = [ "nofail" ];`.
 ```{=include=} sections
 luks-file-systems.section.md
 sshfs-file-systems.section.md
+nfs-file-systems.section.md
 overlayfs.section.md
 ```

nixos/doc/manual/configuration/nfs-file-systems.section.md

@@ -0,0 +1,52 @@
+# NFS File Systems {#sec-nfs-file-systems}
+
+[NFS][nfs] (Network File System) allows you to mount directories from remote machines over the network.
+
+[nfs]: https://en.wikipedia.org/wiki/Network_File_System
+[nfs-man]: https://man7.org/linux/man-pages/man5/nfs.5.html
+
+To mount NFS filesystems persistently, use the `fileSystems` option:
+
+```nix
+{
+  fileSystems."/mnt/data" = {
+    device = "server.example.com:/export/data";
+    fsType = "nfs";
+  };
+}
+```
+
+## Automounting {#sec-nfs-automount}
+
+To have NFS filesystems mounted on-demand instead of at boot, add the `noauto` and `x-systemd.automount` options:
+
+```nix
+{
+  fileSystems."/mnt/data" = {
+    device = "server.example.com:/export/data";
+    fsType = "nfs";
+    options = [
+      "noauto"
+      "x-systemd.automount"
+    ];
+  };
+}
+```
+
+## Ad-hoc Mounting {#sec-nfs-adhoc}
+
+To mount NFS filesystems ad-hoc using the `mount` command, enable NFS and required RPC services:
+
+```nix
+{
+  boot.supportedFilesystems = [ "nfs" ];
+}
+```
+
+Then you can mount filesystems manually:
+
+```shell
+$ sudo mount -t nfs server.example.com:/export/data /mnt/data
+```
+
+For more information on NFS mount options, see the [nfs(5) man page][nfs-man].

nixos/doc/manual/default.nix

@@ -202,6 +202,8 @@ rec {
           --script ./anchor.min.js \
           --script ./anchor-use.js \
           --sidebar-depth 2 \
+          --header ${./header.html}\
+          --no-navheader \
           ./manual.md \
           $dst/${common.indexPath}
 

nixos/doc/manual/header.html

@@ -0,0 +1,7 @@
+<div class="manual-header">
+    <nav class="manual-header--tabs">
+        <a class="manual-header--tab" href="https://nixos.org/manual/nixos/stable/">Nixpkgs</a>
+        <a class="manual-header--tab manual-header--tab-active" href="#">NixOS</a>
+    </nav>
+    <span class="manual-header--title">Nixos Manual</span>
+</div>

nixos/doc/manual/installation/installing-from-other-distro.section.md

@@ -47,7 +47,7 @@ The first steps to all these are the same:
 
     Where `<version>` corresponds to the latest version available on [channels.nixos.org](https://channels.nixos.org/).
 
-    You may want to throw in a `nix-channel --update` for good measure.
+    You must run `$ nix-channel --update` for the channel change to take effect.
 
 1.  Install the NixOS installation tools:
 

nixos/doc/manual/redirects.json

@@ -619,6 +619,15 @@
   "sec-luks-file-systems-fido2-systemd": [
     "index.html#sec-luks-file-systems-fido2-systemd"
   ],
+  "sec-nfs-file-systems": [
+    "index.html#sec-nfs-file-systems"
+  ],
+  "sec-nfs-automount": [
+    "index.html#sec-nfs-automount"
+  ],
+  "sec-nfs-adhoc": [
+    "index.html#sec-nfs-adhoc"
+  ],
   "sec-sshfs-file-systems": [
     "index.html#sec-sshfs-file-systems"
   ],
@@ -1891,6 +1900,9 @@
   "sec-kubernetes": [
     "index.html#sec-kubernetes"
   ],
+  "module-services-nordvpn": [
+    "index.html#module-services-nordvpn"
+  ],
   "ch-running": [
     "index.html#ch-running"
   ],

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -110,6 +110,8 @@
 
 - [clevis-luks-askpass](https://github.com/latchset/clevis), automatic LUKS unlocking in initrd using clevis token bindings stored in LUKS headers. Available as [boot.initrd.clevisLuksAskpass](#opt-boot.initrd.clevisLuksAskpass.enable).
 
+- [passless](https://github.com/pando85/passless), a daemon for using Webauthn Passkeys backed by password-store.
+
 - [bentopdf](https://github.com/alam00000/bentopdf), a privacy-first PDF toolkit running completely in-browser. Available as [services.bentopdf](#opt-services.bentopdf.enable).
 
 - [hyprwhspr-rs](https://github.com/better-slop/hyprwhspr-rs), a keybind activated speech-to-text voice dictation utility built for use with Hyprland. Available as [services.hyprwhspr-rs](#opt-services.hyprwhspr-rs.enable).

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -32,6 +32,8 @@
 
 - [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable).
 
+- [Watt](https://github.com/NotAShelf/watt), a CPU frequency and power management daemon for Linux. Available as [services.watt](#opt-services.watt.enable).
+
 - [mail-tlsa-check-exporter](https://github.com/ietf-tools/mail-tlsa-check-exporter), validates SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter. Available as [services.prometheus.exporters.mail-tlsa-check](#opt-services.prometheus.exporters.mail-tlsa-check.enable).
 
 - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.
@@ -54,6 +56,8 @@
 
 - [OO7](https://github.com/linux-credentials/oo7) is a desktop-agnostic Secret Service provider. Available as [services.oo7](#opt-services.oo7.enable)
 
+- [NordVPN](https://github.com/NordSecurity/nordvpn-linux), a NordVPN client for linux. Available as [services.nordvpn](options.html#opt-services.nordvpn.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -95,6 +99,8 @@
 
 - `services.plantuml-server.packages.jetty` now supports `jetty_12`, it no longer supports `jetty_11`.
 
+- `services.komodo-periphery` has been updated to support version 2.0.0. Some options have been renamed to match the new configuration structure; compatibility aliases are provided for the renamed options. The `passkeys` and `outbound.onboardingKey` options have been removed; use `passkeyFiles`, `auth.privateKey`/`auth.corePublicKeys`, or `outbound.onboardingKeyFile` instead. New outbound mode configuration is available under `outbound.*`.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -138,6 +144,8 @@
 
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
 
+- The `authelia` module now uses systemd's `LoadCredential` to load all files defined in `secrets`. As such, these files no longer need to be readable by the authelia user and group: they can for example be set to be only readable by the root user.
+
 - `zoneminder` has been updated to 1.38.x release. See [upstream release note](https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.0). While database migration should happen automatically, it's recommended that you make a backup of the database before upgrading your system.
 
 - The latest available version of Nextcloud is v34 (available as `pkgs.nextcloud34`). The installation logic is as follows:

nixos/lib/systemd-unit-options.nix

@@ -625,7 +625,7 @@ rec {
 
       listenStreams = mkOption {
         default = [ ];
-        type = types.listOf types.str;
+        type = types.listOf (types.coercedTo types.port toString types.str);
         example = [
           "0.0.0.0:993"
           "/run/my-socket"

nixos/modules/misc/locate.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  utils,
   pkgs,
   ...
 }:
@@ -59,7 +60,7 @@ in
     };
 
     output = lib.mkOption {
-      type = lib.types.path;
+      type = lib.types.externalPath;
       default = "/var/cache/locatedb";
       description = ''
         The database file to build.
@@ -249,27 +250,35 @@ in
     systemd.services.update-locatedb = {
       description = "Update Locate Database";
 
-      # mlocate's updatedb takes flags via a configuration file or
-      # on the command line, but not by environment variable.
-      script =
-        let
-          toFlags =
-            x: lib.optional (cfg.${x} != [ ]) "--${lib.toLower x} '${lib.concatStringsSep " " cfg.${x}}'";
-          args = lib.concatLists (
-            map toFlags [
+      serviceConfig = {
+        # mlocate's updatedb takes flags via a configuration file or
+        # on the command line, but not by environment variable.
+        ExecStart =
+          let
+            toFlags =
+              x:
+              lib.optionals (cfg.${x} != [ ]) [
+                "--${lib.toLower x}"
+                (lib.concatStringsSep " " cfg.${x})
+              ];
+            args = lib.concatMap toFlags [
               "pruneFS"
               "pruneNames"
               "prunePaths"
+            ];
+          in
+          utils.escapeSystemdExecArgs (
+            [
+              (lib.getExe' cfg.package "updatedb")
+              "--output"
+              cfg.output
+              "--prune-bind-mounts"
+              (lib.boolToYesNo cfg.pruneBindMounts)
             ]
+            ++ args
+            ++ cfg.extraFlags
           );
-        in
-        ''
-          exec ${cfg.package}/bin/updatedb \
-            --output ${toString cfg.output} ${lib.concatStringsSep " " args} \
-            --prune-bind-mounts ${lib.boolToYesNo cfg.pruneBindMounts} \
-            ${lib.concatStringsSep " " cfg.extraFlags}
-        '';
-      serviceConfig = {
+
         CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_CHOWN";
         Nice = 19;
         IOSchedulingClass = "idle";

nixos/modules/misc/version.nix

@@ -54,7 +54,8 @@ let
       BUG_REPORT_URL = optionalString isNixos "https://github.com/NixOS/nixpkgs/issues";
       ANSI_COLOR = optionalString isNixos "0;38;2;126;186;228";
       IMAGE_ID = optionalString (config.system.image.id != null) config.system.image.id;
-      IMAGE_VERSION = optionalString (config.system.image.version != null) config.system.image.version;
+      ${if config.system.image.version != null then "IMAGE_VERSION" else null} =
+        config.system.image.version;
       VARIANT = optionalString (cfg.variantName != null) cfg.variantName;
       VARIANT_ID = optionalString (cfg.variant_id != null) cfg.variant_id;
       DEFAULT_HOSTNAME = config.system.nixos.distroId;

nixos/modules/module-list.nix

@@ -296,6 +296,7 @@
   ./programs/opengamepadui.nix
   ./programs/openvpn3.nix
   ./programs/partition-manager.nix
+  ./programs/passless.nix
   ./programs/pay-respects.nix
   ./programs/plotinus.nix
   ./programs/pmount.nix
@@ -357,6 +358,7 @@
   ./programs/wayland/mangowc.nix
   ./programs/wayland/miracle-wm.nix
   ./programs/wayland/niri.nix
+  ./programs/wayland/pinnacle.nix
   ./programs/wayland/river.nix
   ./programs/wayland/sway.nix
   ./programs/wayland/uwsm.nix
@@ -730,6 +732,7 @@
   ./services/hardware/usbmuxd.nix
   ./services/hardware/usbrelayd.nix
   ./services/hardware/vdr.nix
+  ./services/hardware/watt.nix
   ./services/home-automation/deye-dummycloud.nix
   ./services/home-automation/ebusd.nix
   ./services/home-automation/esphome.nix
@@ -1341,6 +1344,7 @@
   ./services/networking/nncp.nix
   ./services/networking/nntp-proxy.nix
   ./services/networking/nomad.nix
+  ./services/networking/nordvpn.nix
   ./services/networking/nsd.nix
   ./services/networking/ntopng.nix
   ./services/networking/ntp/chrony.nix
@@ -1857,6 +1861,7 @@
   ./services/web-servers/nginx/tailscale-auth.nix
   ./services/web-servers/phpfpm/default.nix
   ./services/web-servers/pomerium.nix
+  ./services/web-servers/rustfs.nix
   ./services/web-servers/rustus.nix
   ./services/web-servers/send.nix
   ./services/web-servers/stargazer.nix

nixos/modules/programs/passless.nix

@@ -0,0 +1,134 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.programs.passless;
+  settingsFormat = pkgs.formats.toml { };
+  settingsFile = settingsFormat.generate "passless.toml" cfg.settings;
+in
+{
+
+  options.programs.passless = {
+    enable = lib.mkEnableOption "passless";
+
+    package = lib.mkPackageOption pkgs "passless" { };
+
+    users = lib.options.mkOption {
+      type = with lib.types; listOf str;
+      description = ''
+        Users that intend to use passless and should be added to the fido group.
+      '';
+      default = [ ];
+      example = [ "alice" ];
+    };
+
+    settings = lib.mkOption {
+      inherit (settingsFormat) type;
+      default = { };
+      example = {
+        pass.store-path = "/home/alice/.local/share/password-store";
+      };
+      description = ''
+        Configuration included in `config.toml`.
+
+        See <https://github.com/pando85/passless#configuration-1> for documentation or run `passless config print` to see default configuration.
+      '';
+    };
+  };
+
+  config = lib.mkIf config.programs.passless.enable {
+    users.groups.fido.members = cfg.users;
+
+    boot.kernelModules = [ "uhid" ];
+
+    services.udev.extraRules = ''
+      KERNEL=="uhid", GROUP="fido", MODE="0660"
+    '';
+
+    # From https://github.com/pando85/passless/blob/master/contrib/systemd/passless.service
+    systemd.user.services.passless = {
+      description = "Passless FIDO2 Software Authenticator";
+      documentation = [ "https://github.com/pando85/passless" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "default.target" ];
+      path = [ config.programs.gnupg.package ];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${lib.getExe cfg.package} --config-path ${settingsFile}";
+        Restart = "on-failure";
+        RestartSec = "5s";
+        # Security hardening
+        # The application already handles its own memory locking and core dump prevention
+        # but we can add additional systemd protections
+        NoNewPrivileges = true;
+        LimitMEMLOCK = "2M";
+        SyslogIdentifier = "passless";
+
+        # Found with shh
+        ProtectSystem = "strict";
+        PrivateTmp = "disconnected";
+        PrivateMounts = "true";
+        ProtectKernelTunables = "true";
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        LockPersonality = true;
+        RestrictRealtime = true;
+        ProtectClock = true;
+        MemoryDenyWriteExecute = true;
+        RestrictAddressFamilies = "AF_UNIX";
+        SocketBindDeny = [
+          "ipv4:tcp"
+          "ipv4:udp"
+          "ipv6:tcp"
+          "ipv6:udp"
+        ];
+        CapabilityBoundingSet = [
+          "~CAP_BLOCK_SUSPEND"
+          "CAP_BPF"
+          "CAP_CHOWN"
+          "CAP_MKNOD"
+          "CAP_NET_RAW"
+          "CAP_PERFMON"
+          "CAP_SYS_BOOT"
+          "CAP_SYS_CHROOT"
+          "CAP_SYS_MODULE"
+          "CAP_SYS_NICE"
+          "CAP_SYS_PACCT"
+          "CAP_SYS_PTRACE"
+          "CAP_SYS_TIME"
+          "CAP_SYSLOG"
+          "CAP_WAKE_ALARM"
+        ];
+        SystemCallFilter = [
+          "~@aio:EPERM"
+          "@chown:EPERM"
+          "@clock:EPERM"
+          "@cpu-emulation:EPERM"
+          "@debug:EPERM"
+          "@ipc:EPERM"
+          "@keyring:EPERM"
+          "@module:EPERM"
+          "@mount:EPERM"
+          "@obsolete:EPERM"
+          "@pkey:EPERM"
+          "@privileged:EPERM"
+          "@raw-io:EPERM"
+          "@reboot:EPERM"
+          "@resources:EPERM"
+          "@sandbox:EPERM"
+          "@setuid:EPERM"
+          "@swap:EPERM"
+          "@sync:EPERM"
+        ];
+
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ erictapen ];
+
+}

nixos/modules/programs/wayland/pinnacle.nix

@@ -0,0 +1,70 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.programs.pinnacle;
+  inherit (lib.options) mkEnableOption mkPackageOption;
+in
+{
+  options.programs.pinnacle = {
+    enable = mkEnableOption "pinnacle";
+    package = mkPackageOption pkgs "pinnacle" {
+      default = "pinnacle";
+      example = "pkgs.pinnacle";
+      extraDescription = "package containing the pinnacle server binary";
+    };
+    xdg-portals.enable = mkEnableOption "enable xdg-portals for pinnacle";
+    withUWSM = mkEnableOption ''
+      manage the pinnacle session with [UWSM](https://github.com/Vladimir-csp/uwsm) instead
+      of independent systemd services and targets.
+    '';
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = [
+          cfg.package
+          pkgs.protobuf
+          cfg.package.lua-client-api
+        ];
+        environment.pathsToLink = [
+          # For /run/current-system/sw/share/pinnacle protobuf files - for
+          # pinnacle to be able to launch with a non-default config out of the
+          # box.
+          "/share/pinnacle"
+        ];
+        xdg.portal = lib.mkIf cfg.xdg-portals.enable {
+          enable = true;
+          wlr.enable = true;
+          configPackages = [ cfg.package ];
+          extraPortals = [
+            pkgs.xdg-desktop-portal-wlr
+            pkgs.xdg-desktop-portal-gtk
+            pkgs.gnome-keyring
+          ];
+        };
+      }
+      (lib.mkIf (cfg.withUWSM) {
+        programs.uwsm.enable = true;
+        # Configure UWSM to launch Pinnacle from a display manager like SDDM
+        programs.uwsm.waylandCompositors = {
+          pinnacle = {
+            prettyName = "Pinnacle";
+            comment = "Pinnacle compositor managed by UWSM";
+            binPath = "/run/current-system/sw/bin/pinnacle";
+            extraArgs = [ "--session" ];
+          };
+        };
+      })
+      (lib.mkIf (!cfg.withUWSM) {
+        services.displayManager.sessionPackages = [ cfg.package ];
+      })
+    ]
+  );
+
+  meta.maintainers = with lib.maintainers; [ cassandracomar ];
+}

nixos/modules/rename.nix

@@ -511,7 +511,7 @@ in
       services.simplesamlphp has been vulnerable and unmaintained in nixpkgs.
     '')
     (mkRemovedOptionModule [ "security" "pam" "enableEcryptfs" ] ''
-      security.pam.enableFscrypt was removed since it was unmaintained in nixpkgs.
+      security.pam.enableEcryptfs was removed since it was unmaintained in nixpkgs.
     '')
     (mkRemovedOptionModule [ "security" "rngd" ] ''
       rngd is not necessary for any device that the kernel recognises

nixos/modules/security/apparmor.nix

@@ -241,7 +241,7 @@ in
         {
           Type = "oneshot";
           RemainAfterExit = "yes";
-          ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown";
+          ExecStartPre = lib.getExe' pkgs.apparmor-init "aa-teardown";
           ExecStart = lib.mapAttrsToList (
             n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts n p}"
           ) enabledPolicies;
@@ -262,7 +262,7 @@ in
               # Optionally kill the processes which are unconfined but now have a profile loaded
               # (because AppArmor can only start to confine new processes).
               lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
-          ExecStop = "${pkgs.apparmor-utils}/bin/aa-teardown";
+          ExecStop = lib.getExe' pkgs.apparmor-init "aa-teardown";
           CacheDirectory = [
             "apparmor"
             "apparmor/logprof"

nixos/modules/security/pam.nix

@@ -1832,11 +1832,6 @@ let
     else
       config.users.motdFile;
 
-  makePAMService = name: service: {
-    name = "pam.d/${name}";
-    value.source = pkgs.writeText "${name}.pam" service.text;
-  };
-
   optionalSudoConfigForSSHAgentAuth =
     lib.optionalString (config.security.pam.sshAgentAuth.enable || config.security.pam.rssh.enable)
       ''
@@ -2648,7 +2643,26 @@ in
       };
     };
 
-    environment.etc = lib.mapAttrs' makePAMService enabledServices;
+    environment.etc =
+      let
+        # Write all pam config in a single derivation for performance
+        pamd =
+          pkgs.runCommand "pam.d"
+            {
+              __structuredAttrs = true;
+              services = lib.mapAttrs (_: svc: svc.text) enabledServices;
+            }
+            ''
+              mkdir $out
+              for i in "''${!services[@]}"; do
+                printf '%s' "''${services[$i]}" > "$out/$i"
+              done
+            '';
+      in
+      lib.mapAttrs' (name: service: {
+        name = "pam.d/${name}";
+        value.source = "${pamd}/${name}";
+      }) enabledServices;
 
     systemd =
       lib.mkIf (lib.any (service: service.lastlog.enable) (lib.attrValues config.security.pam.services))

nixos/modules/services/admin/komodo-periphery.nix

@@ -8,41 +8,65 @@ let
   cfg = config.services.komodo-periphery;
   settingsFormat = pkgs.formats.toml { };
 
+  actualRepoDir = if cfg.repoDir != null then cfg.repoDir else "${cfg.rootDirectory}/repos";
+  actualStackDir = if cfg.stackDir != null then cfg.stackDir else "${cfg.rootDirectory}/stacks";
+  actualBuildDir = if cfg.buildDir != null then cfg.buildDir else "${cfg.rootDirectory}/builds";
+
   genFinalSettings =
     let
+      actualServerEnabled =
+        if cfg.inbound.serverEnabled != null then
+          cfg.inbound.serverEnabled
+        else
+          (cfg.outbound.coreAddress == "");
+
+      hasAnyPrivateKey = cfg.auth.privateKey != "";
+
       baseSettings = {
-        port = cfg.port;
-        bind_ip = cfg.bindIp;
-        root_directory = cfg.rootDirectory;
-        repo_dir = "${cfg.rootDirectory}/repos";
-        stack_dir = "${cfg.rootDirectory}/stacks";
-        ssl_enabled = cfg.ssl.enable;
+        default_terminal_command = cfg.defaultTerminalCommand;
+        disable_terminals = cfg.disableTerminals;
+        disable_container_terminals = cfg.disableContainerTerminals;
+
+        stats_polling_rate = cfg.statsPollingRate;
+        container_stats_polling_rate = cfg.containerStatsPollingRate;
+        legacy_compose_cli = cfg.legacyComposeCli;
+
+        include_disk_mounts = cfg.includeDiskMounts;
+        exclude_disk_mounts = cfg.excludeDiskMounts;
+
+        # When a private key is explicitly configured, it's passed via env var.
+        # Otherwise, use the default file path so Periphery auto-generates a key.
+        private_key = if !hasAnyPrivateKey then "file:${cfg.rootDirectory}/keys/periphery.key" else "";
+        core_public_keys = [ ];
+        passkeys = [ ];
+
+        server_enabled = actualServerEnabled;
+        port = cfg.inbound.port;
+        bind_ip = cfg.inbound.bindIp;
+        allowed_ips = cfg.inbound.allowedIps;
+        ssl_enabled = cfg.inbound.ssl.enable;
       }
-      // lib.optionalAttrs cfg.ssl.enable {
-        ssl_key_file = cfg.ssl.keyFile;
-        ssl_cert_file = cfg.ssl.certFile;
+      // {
+        core_address = cfg.outbound.coreAddress;
+        connect_as = cfg.outbound.connectAs;
+        onboarding_key = "";
       }
       // {
         logging = {
           level = cfg.logging.level;
           stdio = cfg.logging.stdio;
+          opentelemetry_service_name = cfg.logging.opentelemetryServiceName;
+          opentelemetry_scope_name = cfg.logging.opentelemetryScopeName;
+          pretty = cfg.logging.pretty;
         }
         // lib.optionalAttrs (cfg.logging.otlpEndpoint != "") {
           otlp_endpoint = cfg.logging.otlpEndpoint;
         };
-        allowed_ips = cfg.allowedIps;
-        passkeys = cfg.passkeys;
-        disable_terminals = cfg.disableTerminals;
-        disable_container_exec = cfg.disableContainerExec;
-        stats_polling_rate = cfg.statsPollingRate;
-        container_stats_polling_rate = cfg.containerStatsPollingRate;
-        legacy_compose_cli = cfg.legacyComposeCli;
-        include_disk_mounts = cfg.includeDiskMounts;
-        exclude_disk_mounts = cfg.excludeDiskMounts;
+        pretty_startup_config = cfg.prettyStartupConfig;
       }
       // cfg.extraSettings;
     in
-    lib.filterAttrsRecursive (_: v: v != null && v != { } && v != [ ]) baseSettings;
+    lib.filterAttrsRecursive (_: v: v != null && v != { } && v != [ ] && v != "") baseSettings;
 
   configFile =
     if cfg.configFile == null then
@@ -51,36 +75,98 @@ let
       cfg.configFile;
 in
 {
+  imports = with lib; [
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "port" ]
+      [ "services" "komodo-periphery" "inbound" "port" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "bindIp" ]
+      [ "services" "komodo-periphery" "inbound" "bindIp" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "allowedIps" ]
+      [ "services" "komodo-periphery" "inbound" "allowedIps" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "ssl" "enable" ]
+      [ "services" "komodo-periphery" "inbound" "ssl" "enable" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "ssl" "keyFile" ]
+      [ "services" "komodo-periphery" "inbound" "ssl" "keyFile" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "ssl" "certFile" ]
+      [ "services" "komodo-periphery" "inbound" "ssl" "certFile" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "serverEnabled" ]
+      [ "services" "komodo-periphery" "inbound" "serverEnabled" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "disableContainerExec" ]
+      [ "services" "komodo-periphery" "disableContainerTerminals" ]
+    )
+    (mkRemovedOptionModule [ "services" "komodo-periphery" "passkeys" ]
+      "services.komodo-periphery.passkeys has been removed. Use passkeyFiles for v1.X compatibility, or migrate to auth.privateKey and auth.corePublicKeys (v2.0+)."
+    )
+    (mkRemovedOptionModule [ "services" "komodo-periphery" "outbound" "onboardingKey" ]
+      "services.komodo-periphery.outbound.onboardingKey has been removed. Use outbound.onboardingKeyFile instead for better security."
+    )
+  ];
+
   options.services.komodo-periphery = {
     enable = lib.mkEnableOption "Periphery, a multi-server Docker and Git deployment agent by Komodo";
 
     package = lib.mkPackageOption pkgs "komodo" { };
 
-    configFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
+    dockerHost = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
-      description = "Path to the periphery configuration file. If null, a configuration file will be generated from the module options.";
+      description = ''
+        Docker host socket URI to use for container operations.
+        If null, uses the default Docker socket and automatically enables Docker.
+        Set this to use alternative container runtimes like Podman or remote Docker hosts.
+      '';
       example = lib.literalExpression ''
-        pkgs.writeText "periphery.toml" '''
-          port = 8120
-          bind_ip = "[::]"
-          ssl_enabled = true
-          [logging]
-          level = "info"
-        '''
+        # Podman rootless
+        "unix:///run/user/1000/podman/podman.sock"
+
+        # Podman rootful
+        "unix:///run/podman/podman.sock"
+
+        # Remote Docker
+        "tcp://192.168.1.100:2375"
       '';
     };
 
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 8120;
-      description = "Port for the Periphery agent to listen on.";
-    };
+    configFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Path to the Periphery configuration file.
 
-    bindIp = lib.mkOption {
-      type = lib.types.str;
-      default = "[::]";
-      description = "IP address to bind to.";
+        - If `null` (default), a configuration file will be automatically generated
+          from the module options (recommended for most users).
+        - If set to a path, that file will be used directly as the configuration file.
+        - You can also use `pkgs.writeText` to write configuration inline in your NixOS configuration.
+
+        When using a custom config file, all other module options (except `package`, `user`, `group`,
+        `environment`, and `environmentFile`) will be ignored.
+      '';
+      example = lib.literalExpression ''
+        # Option 1: Use an existing config file
+        "/etc/komodo/periphery.toml"
+
+        # Option 2: Write config inline using pkgs.writeText
+        pkgs.writeText "periphery.toml" '''
+          root_directory = "/var/lib/komodo-periphery"
+
+          logging.level = "info"
+          logging.stdio = "standard"
+        '''
+      '';
     };
 
     rootDirectory = lib.mkOption {
@@ -89,24 +175,25 @@ in
       description = "Root directory for Komodo Periphery data.";
     };
 
-    ssl = {
-      enable = lib.mkEnableOption "SSL/TLS support" // {
-        default = true;
-      };
+    repoDir = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/repos"'';
+      description = "Directory for Komodo Periphery to manage repos. If null, defaults to `\${rootDirectory}/repos`.";
+    };
 
-      keyFile = lib.mkOption {
-        type = lib.types.path;
-        default = "${cfg.rootDirectory}/ssl/key.pem";
-        defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/key.pem"'';
-        description = "Path to SSL key file.";
-      };
+    stackDir = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/stacks"'';
+      description = "Directory for Komodo Periphery to manage stacks. If null, defaults to `\${rootDirectory}/stacks`.";
+    };
 
-      certFile = lib.mkOption {
-        type = lib.types.path;
-        default = "${cfg.rootDirectory}/ssl/cert.pem";
-        defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/cert.pem"'';
-        description = "Path to SSL certificate file.";
-      };
+    buildDir = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/builds"'';
+      description = "Directory for Komodo Periphery to manage builds. If null, defaults to `\${rootDirectory}/builds`.";
     };
 
     logging = {
@@ -139,26 +226,41 @@ in
         description = "OpenTelemetry OTLP endpoint for traces.";
         example = "http://localhost:4317";
       };
+
+      opentelemetryServiceName = lib.mkOption {
+        type = lib.types.str;
+        default = "Periphery";
+        description = "(v2.0+) OpenTelemetry service name attached to telemetry.";
+      };
+
+      opentelemetryScopeName = lib.mkOption {
+        type = lib.types.str;
+        default = "Komodo";
+        description = "(v2.0+) OpenTelemetry scope name attached to telemetry.";
+      };
+
+      pretty = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "(v2.0+) Enable human-readable logging (multi-line).";
+      };
     };
 
-    allowedIps = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      description = "IP addresses or subnets allowed to call the periphery API. Empty list allows all.";
-      example = [
-        "::ffff:12.34.56.78"
-        "10.0.10.0/24"
-      ];
+    prettyStartupConfig = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "(v2.0+) Enable human-readable startup config log (multi-line).";
     };
 
-    passkeys = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
+    passkeyFiles = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
       description = ''
-        Passkeys required to access the periphery API.
-        WARNING: These will be stored in the Nix store in plain text!
+        Path to file containing passkeys (v1.X compatibility).
+        This will be passed via `PERIPHERY_PASSKEYS_FILE` environment variable.
+        Consider migrating to the new v2.0+ authentication mechanism.
       '';
-      example = [ "your-secure-passkey" ];
+      example = "/run/secrets/komodo-passkey";
     };
 
     extraSettings = lib.mkOption {
@@ -170,16 +272,23 @@ in
       };
     };
 
+    defaultTerminalCommand = lib.mkOption {
+      type = lib.types.str;
+      default = "bash";
+      description = "(v2.0+) Default terminal command used to initialize the shell.";
+      example = "zsh";
+    };
+
     disableTerminals = lib.mkOption {
       type = lib.types.bool;
       default = false;
       description = "Disable remote shell access through Periphery.";
     };
 
-    disableContainerExec = lib.mkOption {
+    disableContainerTerminals = lib.mkOption {
       type = lib.types.bool;
       default = false;
-      description = "Disable remote container shell access through Periphery.";
+      description = "(v2.0+) Disable remote container shell access through Periphery.";
     };
 
     statsPollingRate = lib.mkOption {
@@ -222,6 +331,147 @@ in
       ];
     };
 
+    auth = {
+      privateKey = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          (v2.0+) Private key used with the Noise handshake.
+
+          Use `file:/path/to/file` prefix to load from a file. If the file doesn't exist,
+          Periphery will generate and write a new key to the path.
+
+          If empty, defaults to `file:''${rootDirectory}/keys/periphery.key`.
+        '';
+        example = lib.literalExpression ''
+          # Reference a secret file
+          "file:''${config.age.secrets.komodo-private-key.path}"
+
+          # Or direct path
+          "file:/run/secrets/komodo-private-key"
+        '';
+      };
+
+      corePublicKeys = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = ''
+          (v2.0+) Accepted public keys to allow Core(s) to connect.
+          Accepts Spki base64 DER directly or can reference files using `file:/path/to/core.pub` prefix.
+          You can mix direct keys and file references.
+
+          For better security, use the `file:` prefix to reference secret files.
+        '';
+        example = lib.literalExpression ''
+          [
+            # Direct key value
+            "MCowBQYDK2VuAyEATZgrjGHeF0KJUe0+n77+qAWOg3YzEzXOmQWaRgO3OGQ="
+            # Reference secret files
+            "file:''${config.age.secrets.komodo-core1-pub.path}"
+            "file:''${config.age.secrets.komodo-core2-pub.path}"
+          ]
+        '';
+      };
+    };
+
+    inbound = {
+      serverEnabled = lib.mkOption {
+        type = lib.types.nullOr lib.types.bool;
+        default = null;
+        description = ''
+          Enable the inbound connection server for Core -> Periphery connections.
+          If null, defaults to false when `outbound.coreAddress` is defined, otherwise true.
+        '';
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 8120;
+        description = "Port for the inbound Periphery server to listen on.";
+      };
+
+      bindIp = lib.mkOption {
+        type = lib.types.str;
+        default = "[::]";
+        description = ''
+          IP address the periphery server will bind to.
+          The default allows external IPv4 and IPv6 connections.
+        '';
+      };
+
+      allowedIps = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = ''
+          Limit the IP addresses which can connect to Periphery.
+          Supports IPv4/IPv6 addresses and subnets.
+          Empty list allows all connections.
+        '';
+        example = [
+          "::ffff:12.34.56.78"
+          "10.0.10.0/24"
+        ];
+      };
+
+      ssl = {
+        enable = lib.mkEnableOption "(v2.0+) SSL/TLS support for inbound connections" // {
+          default = true;
+        };
+
+        keyFile = lib.mkOption {
+          type = lib.types.path;
+          default = "${cfg.rootDirectory}/ssl/key.pem";
+          defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/key.pem"'';
+          description = ''
+            Path to SSL key file.
+            If the file doesn't exist and SSL is enabled, self-signed keys will be generated using openssl.
+          '';
+        };
+
+        certFile = lib.mkOption {
+          type = lib.types.path;
+          default = "${cfg.rootDirectory}/ssl/cert.pem";
+          defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/cert.pem"'';
+          description = ''
+            Path to SSL certificate file.
+            If the file doesn't exist and SSL is enabled, self-signed certificate will be generated using openssl.
+          '';
+        };
+      };
+    };
+
+    outbound = {
+      coreAddress = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          (v2.0+) The address of Komodo Core. Must be reachable from this host.
+          If provided, Periphery will operate in outbound mode.
+        '';
+        example = "demo.komo.do";
+      };
+
+      connectAs = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          (v2.0+) The Server this Periphery agent should connect as.
+          Must match an existing Server name or id.
+        '';
+        example = "server-name";
+      };
+
+      onboardingKeyFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        description = ''
+          (v2.0+) Path to file containing the onboarding key.
+          This will be passed via `PERIPHERY_ONBOARDING_KEY_FILE` environment variable.
+        '';
+        example = lib.literalExpression ''"''${config.age.secrets.komodo-onboarding.path}"'';
+      };
+    };
+
     user = lib.mkOption {
       type = lib.types.str;
       default = "komodo-periphery";
@@ -253,14 +503,14 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    virtualisation.docker.enable = true;
+    virtualisation.docker.enable = lib.mkDefault (cfg.dockerHost == null);
 
     users.users.${cfg.user} = lib.mkIf (cfg.user == "komodo-periphery") {
       isSystemUser = true;
       group = cfg.group;
       description = "Komodo Periphery service user";
       home = cfg.rootDirectory;
-      extraGroups = [ "docker" ];
+      extraGroups = lib.optional (cfg.dockerHost == null) "docker";
     };
 
     users.groups.${cfg.group} = lib.mkIf (cfg.group == "komodo-periphery") { };
@@ -271,16 +521,26 @@ in
         user = cfg.user;
         group = cfg.group;
       };
-      "${cfg.rootDirectory}/repos".d = {
+      "${actualRepoDir}".d = {
         mode = "0755";
         user = cfg.user;
         group = cfg.group;
       };
-      "${cfg.rootDirectory}/stacks".d = {
+      "${actualStackDir}".d = {
         mode = "0755";
         user = cfg.user;
         group = cfg.group;
       };
+      "${actualBuildDir}".d = {
+        mode = "0755";
+        user = cfg.user;
+        group = cfg.group;
+      };
+      "${cfg.rootDirectory}/keys".d = {
+        mode = "0700";
+        user = cfg.user;
+        group = cfg.group;
+      };
       "${cfg.rootDirectory}/ssl".d = {
         mode = "0700";
         user = cfg.user;
@@ -292,35 +552,63 @@ in
       description = "Komodo Periphery - Multi-server Docker and Git deployment agent";
       after = [
         "network-online.target"
-        "docker.service"
-      ];
+      ]
+      ++ lib.optional (cfg.dockerHost == null) "docker.service";
       wants = [
         "network-online.target"
-        "docker.service"
-      ];
+      ]
+      ++ lib.optional (cfg.dockerHost == null) "docker.service";
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
         Type = "simple";
         User = cfg.user;
         Group = cfg.group;
-        SupplementaryGroups = [ "docker" ];
+        SupplementaryGroups = lib.mkIf (cfg.dockerHost == null) [ "docker" ];
         Restart = "on-failure";
         RestartSec = "10s";
         WorkingDirectory = cfg.rootDirectory;
 
         ExecStart = lib.escapeShellArgs [
-          "${lib.getExe' cfg.package "periphery"}"
+          (lib.getExe' cfg.package "periphery")
           "--config-path"
-          (if cfg.configFile != null then cfg.configFile else configFile)
+          configFile
         ];
 
         Environment = lib.mapAttrsToList (name: value: "${name}=${value}") (
-          cfg.environment
-          // lib.optionalAttrs (!cfg.disableTerminals) {
-            PATH = "/run/current-system/sw/bin:/run/wrappers/bin";
+          lib.optionalAttrs (cfg.configFile == null) {
+            PERIPHERY_ROOT_DIRECTORY = cfg.rootDirectory;
+            PERIPHERY_REPO_DIR = actualRepoDir;
+            PERIPHERY_STACK_DIR = actualStackDir;
+            PERIPHERY_BUILD_DIR = actualBuildDir;
           }
+          // lib.optionalAttrs (cfg.configFile == null && cfg.inbound.ssl.enable) {
+            PERIPHERY_SSL_KEY_FILE = cfg.inbound.ssl.keyFile;
+            PERIPHERY_SSL_CERT_FILE = cfg.inbound.ssl.certFile;
+          }
+          // lib.optionalAttrs (cfg.dockerHost != null) {
+            DOCKER_HOST = cfg.dockerHost;
+          }
+          // lib.optionalAttrs (cfg.passkeyFiles != null) {
+            PERIPHERY_PASSKEYS_FILE = cfg.passkeyFiles;
+          }
+          // lib.optionalAttrs (cfg.auth.privateKey != "") {
+            PERIPHERY_PRIVATE_KEY = cfg.auth.privateKey;
+          }
+          // lib.optionalAttrs (cfg.auth.corePublicKeys != [ ]) {
+            PERIPHERY_CORE_PUBLIC_KEYS = lib.concatStringsSep "," cfg.auth.corePublicKeys;
+          }
+          // lib.optionalAttrs (cfg.outbound.onboardingKeyFile != null) {
+            PERIPHERY_ONBOARDING_KEY_FILE = cfg.outbound.onboardingKeyFile;
+          }
+          // cfg.environment
         );
+
+        ExecSearchPath = lib.mkIf (!cfg.disableTerminals) [
+          "/run/current-system/sw/bin"
+          "/run/wrappers/bin"
+        ];
+
         EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
 
         StateDirectory = "komodo-periphery";
@@ -329,7 +617,7 @@ in
         NoNewPrivileges = true;
         PrivateTmp = true;
         ProtectSystem = "full";
-        ProtectHome = true;
+        ProtectHome = "read-only";
       };
     };
   };

nixos/modules/services/desktops/oo7.nix

@@ -10,7 +10,7 @@ in
 {
   options.services.oo7 = {
     enable = lib.mkEnableOption ''
-      oo7, a service providing the Secret Service D-Bus API.
+      oo7, a service providing the Secret Service D-Bus API
     '';
   };
 

nixos/modules/services/desktops/seatd.nix

@@ -40,7 +40,6 @@ in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
       seatd
-      sdnotify-wrapper
     ];
     users.groups.seat = lib.mkIf (cfg.group == "seat") { };
 
@@ -55,7 +54,7 @@ in
         Type = "notify";
         NotifyAccess = "all";
         SyslogIdentifier = "seatd";
-        ExecStart = "${pkgs.sdnotify-wrapper}/bin/sdnotify-wrapper ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
+        ExecStart = "${lib.getExe' pkgs.s6 "s6-notify-socket-from-fd"} ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
         RestartSec = 1;
         Restart = "always";
       };

nixos/modules/services/editors/emacs.nix

@@ -80,6 +80,9 @@ in
       unitConfig = lib.optionalAttrs cfg.startWithGraphical {
         After = "graphical-session.target";
       };
+
+      # Long-lived session that ought to only be restarted manually
+      restartIfChanged = false;
     }
     // lib.optionalAttrs cfg.enable {
       wantedBy = if cfg.startWithGraphical then [ "graphical-session.target" ] else [ "default.target" ];

nixos/modules/services/hardware/sane_extra_backends/brscan5_etc_files.nix

@@ -58,17 +58,17 @@ stdenv.mkDerivation {
   dontConfigure = true;
 
   buildPhase = ''
-    TARGET_DIR="$out/etc/opt/brother/scanner/brscan5"
+    TARGET_DIR="$out/tmp"
     mkdir -p "$TARGET_DIR"
     cp -rp "./models" "$TARGET_DIR"
     cp -rp "./brscan5.ini" "$TARGET_DIR"
     cp -rp "./brsanenetdevice.cfg" "$TARGET_DIR"
-
     export NIX_REDIRECTS="/etc/opt/brother/scanner/brscan5/=$TARGET_DIR/"
-
     printf '${addAllNetDev netDevices}\n'
-
     ${addAllNetDev netDevices}
+
+    mkdir -p "$out/etc/opt/brother/scanner/brscan5"
+    mv -T "$TARGET_DIR" "$out/etc/opt/brother/scanner/brscan5"
   '';
 
   dontInstall = true;

nixos/modules/services/hardware/watt.nix

@@ -0,0 +1,71 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (lib)
+    mkIf
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    getExe
+    ;
+  inherit (lib.types) submodule;
+
+  cfg = config.services.watt;
+
+  format = pkgs.formats.toml { };
+  cfgFile = format.generate "watt-config.toml" cfg.settings;
+
+  conflictingServices = [
+    "power-profiles-daemon"
+    "auto-cpufreq"
+    "tlp"
+    "cpupower-gui"
+    "thermald"
+  ];
+
+in
+{
+  options.services.watt = {
+    enable = mkEnableOption "automatic CPU speed & power optimizer for Linux";
+    package = mkPackageOption pkgs "watt" { };
+
+    settings = mkOption {
+      default = { };
+      type = submodule { freeformType = format.type; };
+      description = "Configuration for Watt. Options at https://github.com/notaShelf/watt";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = map (service: {
+      assertion = !config.services.${service}.enable;
+      message = "You have set services.${service}.enable = true; which conflicts with Watt.";
+    }) conflictingServices;
+
+    environment.systemPackages = [ cfg.package ];
+
+    # This is necessary for the Watt CLI. The environment variable
+    # passed to the systemd service will take priority in read order.
+    environment.etc."watt.toml".source = cfgFile;
+
+    services.dbus.packages = [ cfg.package ];
+
+    systemd.services.watt = {
+      wantedBy = [ "multi-user.target" ];
+      conflicts = map (service: "${service}.service") conflictingServices;
+      serviceConfig = {
+        WorkingDirectory = "";
+        ExecStart = getExe cfg.package;
+        Restart = "on-failure";
+
+        RuntimeDirectory = "watt";
+        RuntimeDirectoryMode = "0755";
+      };
+    };
+
+  };
+}

nixos/modules/services/mail/postsrsd.nix

@@ -281,7 +281,7 @@ in
       environment.etc."postsrsd.conf".source = configFile;
 
       systemd.services.postsrsd = {
-        description = "PostSRSd SRS rewriting server";
+        description = "Sender Rewriting Scheme daemon for Postfix";
         after = [
           "network.target"
           "postsrsd-generate-secrets.service"
@@ -289,14 +289,20 @@ in
         before = [ "postfix.service" ];
         wantedBy = [ "multi-user.target" ];
         requires = [ "postsrsd-generate-secrets.service" ];
-        restartTriggers = [ configFile ];
+        reloadTriggers = [ configFile ];
 
         serviceConfig = {
+          Type = "notify-reload";
           ExecStart = utils.escapeSystemdExecArgs [
             (lib.getExe cfg.package)
             "-C"
             "/etc/postsrsd.conf"
           ];
+          ExecReload = toString [
+            (lib.getExe' pkgs.coreutils "kill")
+            "-SIGHUP"
+            "$MAINPID"
+          ];
           User = cfg.user;
           Group = cfg.group;
           RuntimeDirectory = "postsrsd";
@@ -319,7 +325,7 @@ in
           ProtectKernelModules = true;
           ProtectKernelTunables = true;
           ProtectSystem = "strict";
-          ProtectProc = "invisible";
+          ProtectProc = "noaccess";
           ProcSubset = "pid";
           RemoveIPC = true;
           RestrictAddressFamilies =

nixos/modules/services/mail/stalwart.nix

@@ -57,7 +57,7 @@ in
       default = { };
       description = ''
         Configuration options for the Stalwart server.
-        See <https://stalw.art/docs/category/configuration> for available options.
+        See <https://stalw.art/docs/configuration> for available options.
 
         By default, the module is configured to store everything locally.
       '';

nixos/modules/services/matrix/dendrite.nix

@@ -13,6 +13,7 @@ in
 {
   options.services.dendrite = {
     enable = lib.mkEnableOption "matrix.org dendrite";
+    package = lib.mkPackageOption pkgs "dendrite" { };
     httpPort = lib.mkOption {
       type = lib.types.nullOr lib.types.port;
       default = 8008;
@@ -321,7 +322,7 @@ in
         ];
         ExecStart = lib.strings.concatStringsSep " " (
           [
-            "${pkgs.dendrite}/bin/dendrite"
+            (lib.getExe cfg.package)
             "--config /run/dendrite/dendrite.yaml"
           ]
           ++ lib.optionals (cfg.httpPort != null) [

nixos/modules/services/matrix/matrix-authentication-service.nix

@@ -45,7 +45,9 @@ let
       pruned;
   configFile = format.generate "config.yaml" finalSettings;
 
-  extraConfigFiles = lib.imap0 (i: _: "%d/config-${toString i}") cfg.extraConfigFiles;
+  extraConfigFiles = lib.imap0 (
+    i: _: "\${CREDENTIALS_DIRECTORY}/config-${toString i}"
+  ) cfg.extraConfigFiles;
   runtimeConfig = "/run/matrix-authentication-service/config.yaml";
 in
 {

nixos/modules/services/misc/graphical-desktop.nix

@@ -22,17 +22,23 @@ in
 
   config = lib.mkIf cfg.enable {
     environment = {
-      # localectl looks into 00-keyboard.conf
-      etc."X11/xorg.conf.d/00-keyboard.conf".text = ''
-        Section "InputClass"
-          Identifier "Keyboard catchall"
-          MatchIsKeyboard "on"
-          Option "XkbModel" "${xcfg.xkb.model}"
-          Option "XkbLayout" "${xcfg.xkb.layout}"
-          Option "XkbOptions" "${xcfg.xkb.options}"
-          Option "XkbVariant" "${xcfg.xkb.variant}"
-        EndSection
-      '';
+      # systemd-localed looks into 00-keyboard.conf
+      # systemd-localed does not like if Option values are ""
+      etc."X11/xorg.conf.d/00-keyboard.conf".text =
+        let
+          optionLine =
+            name: value: lib.optionalString (value != null && value != "") ''Option "${name}" "${value}"'';
+        in
+        ''
+          Section "InputClass"
+            Identifier "Keyboard catchall"
+            MatchIsKeyboard "on"
+            ${optionLine "XkbModel" xcfg.xkb.model}
+            ${optionLine "XkbLayout" xcfg.xkb.layout}
+            ${optionLine "XkbOptions" xcfg.xkb.options}
+            ${optionLine "XkbVariant" xcfg.xkb.variant}
+          EndSection
+        '';
       systemPackages = with pkgs; [
         nixos-icons # needed for gnome and pantheon about dialog, nixos-manual and maybe more
         xdg-utils

nixos/modules/services/misc/redmine.nix

@@ -245,19 +245,19 @@ in
       };
 
       components = {
-        subversion = lib.mkEnableOption "Subversion integration.";
+        subversion = lib.mkEnableOption "Subversion integration";
 
-        mercurial = lib.mkEnableOption "Mercurial integration.";
+        mercurial = lib.mkEnableOption "Mercurial integration";
 
-        git = lib.mkEnableOption "git integration.";
+        git = lib.mkEnableOption "git integration";
 
-        cvs = lib.mkEnableOption "cvs integration.";
+        cvs = lib.mkEnableOption "cvs integration";
 
-        breezy = lib.mkEnableOption "bazaar integration.";
+        breezy = lib.mkEnableOption "bazaar integration";
 
-        imagemagick = lib.mkEnableOption "exporting Gant diagrams as PNG.";
+        imagemagick = lib.mkEnableOption "exporting Gant diagrams as PNG";
 
-        ghostscript = lib.mkEnableOption "exporting Gant diagrams as PDF.";
+        ghostscript = lib.mkEnableOption "exporting Gant diagrams as PDF";
 
         minimagick_font_path = lib.mkOption {
           type = lib.types.str;
@@ -265,6 +265,8 @@ in
           description = "MiniMagick font path";
           example = "/run/current-system/sw/share/X11/fonts/LiberationSans-Regular.ttf";
         };
+
+        pandoc = lib.mkEnableOption "pandoc integration for previewing LibreOffice and Microsoft Office documents";
       };
     };
   };
@@ -310,6 +312,7 @@ in
         imagemagick_convert_command = lib.optionalString cfg.components.imagemagick "${pkgs.imagemagick}/bin/convert";
         gs_command = lib.optionalString cfg.components.ghostscript "${pkgs.ghostscript}/bin/gs";
         minimagick_font_path = "${cfg.components.minimagick_font_path}";
+        pandoc_command = lib.optionalString cfg.components.pandoc "${pkgs.pandoc}/bin/pandoc";
       };
     };
 
@@ -457,7 +460,7 @@ in
         Group = cfg.group;
         TimeoutSec = "300";
         WorkingDirectory = "${cfg.package}/share/redmine";
-        ExecStart = "${bundle} exec rails server -u webrick -e production -b ${toString cfg.address} -p ${toString cfg.port} -P '${cfg.stateDir}/redmine.pid'";
+        ExecStart = "${bundle} exec rails server -u webrick -e production -b ${toString cfg.address} -p ${toString cfg.port}";
         RuntimeDirectory = "redmine";
         RuntimeDirectoryMode = "0750";
         AmbientCapabilities = "";

nixos/modules/services/misc/shoko.nix

@@ -90,8 +90,5 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [
-    diniamo
-    nanoyaki
-  ];
+  meta.maintainers = with lib.maintainers; [ nanoyaki ];
 }

nixos/modules/services/monitoring/prometheus/exporters/imap-mailstat.nix

@@ -94,8 +94,8 @@ in
     serviceConfig = {
       ExecStart = ''
         ${pkgs.prometheus-imap-mailstat-exporter}/bin/imap-mailstat-exporter \
-          -config ${createConfigFile cfg.accounts} \
-          ${optionalString cfg.oldestUnseenDate "-oldestunseendate"} \
+          --config.file="${createConfigFile cfg.accounts}" \
+          ${optionalString cfg.oldestUnseenDate "--oldestunseen.feature"} \
           ${concatStringsSep " \\\n  " cfg.extraFlags}
       '';
     };

nixos/modules/services/monitoring/traccar.nix

@@ -102,7 +102,7 @@ in
           ${lib.getExe pkgs.envsubst} \
             -i ${configuration} \
             -o ${configFilePath}
-          umask $old_umask
+          umask "$old_umask"
         '';
 
         serviceConfig = {

nixos/modules/services/monitoring/vnstat.nix

@@ -6,17 +6,32 @@
 }:
 let
   cfg = config.services.vnstat;
+  settingsFormat = pkgs.formats.keyValue { };
 in
 {
   options.services.vnstat = {
     enable = lib.mkEnableOption "update of network usage statistics via vnstatd";
     package = lib.mkPackageOption pkgs "vnstat" { };
+    settings = lib.mkOption {
+      type = lib.types.submodule { freeformType = settingsFormat.type; };
+      default = { };
+      description = ''
+        Configuration for vnstat. Refer to
+        [https://humdi.net/vnstat/man/vnstat.conf.html]
+        or {manpage}`vnstat.conf(5)` for more information.
+      '';
+      example = {
+        AlwaysAddNewInterfaces = 1;
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ cfg.package ];
 
+    environment.etc."vnstat.conf".source = settingsFormat.generate "vnstat.conf" cfg.settings;
+
     users = {
       groups.vnstatd = { };
 
@@ -59,4 +74,8 @@ in
       };
     };
   };
+
+  meta = {
+    maintainers = with lib.maintainers; [ hmenke ];
+  };
 }

nixos/modules/services/network-filesystems/rsyncd.nix

@@ -132,7 +132,7 @@ in
           description = "socket for fast remote file copy program daemon";
           conflicts = [ "rsync.service" ];
 
-          listenStreams = [ (toString cfg.port) ];
+          listenStreams = [ cfg.port ];
           socketConfig.Accept = true;
 
           wantedBy = [ "sockets.target" ];

nixos/modules/services/networking/headplane.nix

@@ -44,7 +44,7 @@ in
     settings = mkOption {
       description = ''
         Headplane configuration options. Generates a YAML config file.
-        See: https://github.com/tale/headplane/blob/main/config.example.yaml
+        See <https://github.com/tale/headplane/blob/main/config.example.yaml>.
       '';
       type = types.submodule {
         options = {
@@ -129,6 +129,16 @@ in
           headscale = mkOption {
             type = types.submodule {
               options = {
+                api_key_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    Path to a file containing a Headscale API key.
+                    This is required for OIDC authentication aswell for the Headplane agent.
+                  '';
+                  example = lib.literalExpression "config.sops.secrets.headplane_pre_authkey.path";
+                };
+
                 url = mkOption {
                   type = types.str;
                   default = "http://127.0.0.1:${toString config.services.headscale.port}";
@@ -211,15 +221,6 @@ in
                           '';
                         };
 
-                        pre_authkey_path = mkOption {
-                          type = types.nullOr types.path;
-                          default = null;
-                          description = ''
-                            Path to a file containing a Headscale pre-auth key for the agent.
-                          '';
-                          example = lib.literalExpression "config.sops.secrets.headplane_pre_authkey.path";
-                        };
-
                         executable_path = mkOption {
                           type = types.path;
                           readOnly = true;
@@ -237,20 +238,14 @@ in
                         };
 
                         cache_ttl = mkOption {
-                          type = types.nullOr types.int;
-                          default = null;
+                          type = types.ints.positive;
+                          default = 180000;
                           description = ''
-                            Deprecated cache TTL for the agent. This option is accepted
-                            by Headplane 0.6.2 but has no effect.
+                            How long to cache agent information (in milliseconds).
+                            If you want data to update faster, reduce the TTL, but this will increase the frequency of requests to Headscale.
                           '';
                         };
 
-                        cache_path = mkOption {
-                          type = types.path;
-                          default = "/var/lib/headplane/agent_cache.json";
-                          description = "The path to store the agent's cache.";
-                        };
-
                         work_dir = mkOption {
                           type = types.path;
                           default = "/var/lib/headplane/agent";
@@ -325,16 +320,6 @@ in
                     example = lib.literalExpression "config.sops.secrets.oidc_client_secret.path";
                   };
 
-                  headscale_api_key_path = mkOption {
-                    type = types.nullOr types.path;
-                    default = null;
-                    description = ''
-                      Path to a file containing the Headscale API key.
-                      Required for OIDC authentication.
-                    '';
-                    example = lib.literalExpression "config.sops.secrets.headscale_api_key.path";
-                  };
-
                   disable_api_key_login = mkOption {
                     type = types.bool;
                     default = false;
@@ -366,25 +351,6 @@ in
                     '';
                   };
 
-                  redirect_uri = mkOption {
-                    type = types.nullOr types.str;
-                    default = null;
-                    description = ''
-                      Deprecated OIDC redirect URI. Use services.headplane.settings.server.base_url
-                      instead; Headplane derives the callback URL from it.
-                    '';
-                    example = "https://headplane.example.com/admin/oidc/callback";
-                  };
-
-                  strict_validation = mkOption {
-                    type = types.nullOr types.bool;
-                    default = null;
-                    description = ''
-                      Deprecated OIDC validation setting. This option is accepted
-                      by Headplane 0.6.2 but has no effect.
-                    '';
-                  };
-
                   profile_picture_source = mkOption {
                     type = types.enum [
                       "oidc"
@@ -429,16 +395,6 @@ in
                     description = "Custom userinfo endpoint URL.";
                     example = "https://provider.example.com/userinfo";
                   };
-
-                  user_storage_file = mkOption {
-                    type = types.nullOr types.path;
-                    default = null;
-                    description = ''
-                      Deprecated path to the pre-0.6.2 JSON user database.
-                      Headplane uses this once to migrate users into its internal database.
-                    '';
-                    example = "/var/lib/headplane/users.json";
-                  };
                 };
               }
             );
@@ -452,33 +408,6 @@ in
   };
 
   config = mkIf cfg.enable {
-    warnings =
-      lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.redirect_uri != null) [
-        ''
-          services.headplane.settings.oidc.redirect_uri is deprecated by Headplane 0.6.2.
-          Use services.headplane.settings.server.base_url instead; Headplane derives
-          the OIDC callback URL from it.
-        ''
-      ]
-      ++ lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.strict_validation != null) [
-        ''
-          services.headplane.settings.oidc.strict_validation is deprecated and has no effect
-          in Headplane 0.6.2.
-        ''
-      ]
-      ++ lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.user_storage_file != null) [
-        ''
-          services.headplane.settings.oidc.user_storage_file is deprecated. Headplane 0.6.2
-          uses it only to migrate the pre-0.6.2 JSON user database into the internal database.
-        ''
-      ]
-      ++ lib.optionals (agentSettings != null && agentSettings.cache_ttl != null) [
-        ''
-          services.headplane.settings.integration.agent.cache_ttl is deprecated and has no
-          effect in Headplane 0.6.2.
-        ''
-      ];
-
     assertions = [
       {
         assertion = config.services.headscale.enable;
@@ -502,26 +431,25 @@ in
         '';
       }
       {
-        assertion = cfg.settings.oidc == null || cfg.settings.oidc.headscale_api_key_path != null;
+        assertion = cfg.settings.oidc == null || cfg.settings.headscale.api_key_path != null;
         message = ''
-          services.headplane.settings.oidc.headscale_api_key_path must be set
-          when services.headplane.settings.oidc is non-null. Headplane's OIDC
-          flow requires a Headscale API key to mint sessions.
+          services.headplane.settings.headscale.api_key_path must be set
+          when services.headplane.settings.oidc is non-null.
+          Headplane's OIDC flow requires a Headscale API key to mint sessions.
         '';
       }
       {
         assertion =
-          agentSettings == null || !agentSettings.enabled || agentSettings.pre_authkey_path != null;
+          agentSettings == null || !agentSettings.enabled || cfg.settings.headscale.api_key_path != null;
         message = ''
-          services.headplane.settings.integration.agent.pre_authkey_path must be set
-          when the agent is enabled.
+          services.headplane.settings.headscale.api_key_path must be set when the agent is enabled.
         '';
       }
     ];
 
     environment = {
       systemPackages = [ cfg.package ];
-      etc."headplane/config.yaml".source = "${settingsFile}";
+      etc."headplane/config.yaml".source = settingsFile;
     };
 
     systemd.services.headplane = {
@@ -534,6 +462,7 @@ in
         config.systemd.services.headscale.name
       ];
       requires = [ config.systemd.services.headscale.name ];
+      restartTriggers = [ settingsFile ];
 
       environment = {
         HEADPLANE_DEBUG_LOG = toString cfg.debug;

nixos/modules/services/networking/networkd-dispatcher.nix

@@ -93,6 +93,10 @@ in
 
   config = mkIf cfg.enable {
 
+    warnings = mkIf (!config.systemd.network.enable) [
+      "services.networkd-dispatcher will not execute any scripts unless networkd is enabled, either via `systemd.network.enable` or via `networking.useNetworkd`."
+    ];
+
     systemd = {
       packages = [ pkgs.networkd-dispatcher ];
       services.networkd-dispatcher = {

nixos/modules/services/networking/nordvpn.md

@@ -0,0 +1,65 @@
+# NordVPN {#module-services-nordvpn}
+
+*Source:* {file}`modules/services/networking/nordvpn.nix`
+
+*Upstream documentation:* <https://github.com/NordSecurity/nordvpn-linux>
+
+NordVPN offers a paid virtual private network (VPN) service.
+The service operates as closed-source,
+but the Linux client uses open-source code licensed under GPLv3.
+A minimal configuration in NixOS appears as follows:
+
+```nix
+{
+  services.nordvpn.enable = true;
+  networking.firewall.enable = true;
+  networking.firewall.checkReversePath = "loose";
+}
+```
+
+When using a firewall, set `networking.firewall.checkReversePath` to `"loose"` or `false`.
+NordVPN includes a `kill-switch` feature that blocks all packets not associated with the VPN connection.
+
+Additionally, add your user to the `nordvpn` group.
+
+```nix
+{
+  users.users.yourUser = {
+    #..
+    extraGroups = [
+      #..
+      "nordvpn"
+    ];
+  };
+}
+```
+
+If you prefer to use your own user and group, you can do so using
+
+```nix
+{
+  services.nordvpn.user = "SOME-USER";
+  services.nordvpn.group = "SOME-GROUP";
+}
+```
+
+NordVPN provides several useful CLI commands, including:
+
+```bash
+nordvpn login  # Log in using an OAuth URL
+nordvpn login --token <token>  # Log in with a token obtained from your NordVPN account
+nordvpn c  # Connect to the VPN
+nordvpn c ie  # Connect to a NordVPN server in Ireland
+nordvpn d  # Disconnect from the VPN
+nordvpn set technology openvpn  # Switch to OpenVPN technology
+nordvpn c  # Reconnect after changing technology
+```
+
+Additionally, if you prefer to use the friendly GUI,
+
+```bash
+nordvpn-gui
+```
+
+**Disclaimer:** NixOS currently does not support meshnet.
+Contributions welcome!

nixos/modules/services/networking/nordvpn.nix

@@ -0,0 +1,171 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.nordvpn;
+  defaultUser = "nordvpn";
+  defaultGroup = "nordvpn";
+
+  nordvpn =
+    let
+      cli = cfg.package.cli.overrideAttrs (old: {
+        preBuild =
+          let
+            extraPreBuild = lib.optionalString (cfg.group != defaultGroup) ''
+              substituteInPlace internal/permissions.go \
+                --replace-fail \
+                      'string{"nordvpn"}' \
+                      'string{"${cfg.group}"}'
+
+              substituteInPlace internal/constants.go \
+                  --replace-fail \
+                      'NordvpnGroup = "nordvpn"' \
+                      'NordvpnGroup = "${cfg.group}"'
+            '';
+          in
+          extraPreBuild + (old.preBuild or "");
+
+        # postFixup wraps nordvpnd so that it can find binaries that it calls.
+        # here, instead, use systemd to update the path to those binaries.
+        postFixup = "";
+      });
+    in
+    pkgs.symlinkJoin {
+      inherit (cfg.package) pname version meta;
+      paths = [
+        cli
+        cfg.package.gui
+      ];
+    };
+in
+{
+  options.services.nordvpn = {
+    enable = lib.mkEnableOption "Enable NordVPN";
+    package = lib.mkPackageOption pkgs "nordvpn" { };
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = ''
+        The User that owns the `nordvpnd` systemd process.
+        If overriding the default, a user with the same name must exist.
+      '';
+    };
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = defaultGroup;
+      description = ''
+        The Group that owns the `nordvpnd` systemd process.
+        If overriding the default, a group with the same name must exist.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    # create the default user if that's the one used
+    users.users = lib.mkIf (cfg.user == defaultUser) {
+      ${defaultUser} = {
+        description = "User that runs `nordvpnd`.";
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+
+    # create the default group if that's the one used
+    users.groups = lib.mkIf (cfg.group == defaultGroup) {
+      ${defaultGroup} = { };
+    };
+
+    # nordvpnd uses resolved to configure dns
+    services.resolved.enable = true;
+
+    # policy that allows nordvpnd to configure dns
+    security.polkit = {
+      enable = true;
+      extraConfig = ''
+        polkit.addRule(function(action, subject) {
+          if (action.id == "org.freedesktop.resolve1.set-dns-servers"
+              && subject.isInGroup("${cfg.group}")) {
+            return polkit.Result.YES;
+          }
+        });
+      '';
+    };
+
+    environment.systemPackages = [
+      nordvpn
+    ];
+
+    systemd.services.nordvpnd = {
+      after = [ "network-online.target" ];
+      description = "NordVPN daemon.";
+      path = (
+        with pkgs;
+        [
+          e2fsprogs
+          iproute2
+          libxslt
+          nftables
+          procps
+          wireguard-tools
+        ]
+        ++ [ nordvpn ]
+      );
+      serviceConfig = {
+        # nordvpnd needs CAP_NET_ADMIN to configure network interfaces
+        AmbientCapabilities = "CAP_NET_ADMIN";
+        CapabilityBoundingSet = "CAP_NET_ADMIN";
+        ExecStart = lib.getExe' nordvpn "nordvpnd";
+        Group = cfg.group;
+        KillMode = "process";
+        NonBlocking = true;
+        Requires = "nordvpnd.socket";
+        Restart = "on-failure";
+        RestartSec = 5;
+        RuntimeDirectory = "nordvpn";
+        RuntimeDirectoryMode = "0750";
+        StateDirectory = "nordvpn";
+        StateDirectoryMode = "0750";
+        User = cfg.user;
+      };
+      wantedBy = [ "default.target" ];
+      wants = [ "network-online.target" ];
+    };
+
+    systemd.sockets.nordvpnd = {
+      description = "NordVPN Daemon Socket";
+      listenStreams = [ "/run/nordvpn/nordvpnd.sock" ];
+      partOf = [ "nordvpnd.service" ];
+      socketConfig = {
+        DirectoryMode = "0750";
+        NoDelay = true;
+        SocketGroup = cfg.group;
+        SocketMode = "0770";
+        SocketUser = cfg.user;
+      };
+      wantedBy = [ "sockets.target" ];
+    };
+
+    systemd.user.services.norduserd = {
+      after = [ "network-online.target" ];
+      description = "NordUserD Service";
+      serviceConfig = {
+        ExecStart = lib.getExe' nordvpn "norduserd";
+        NonBlocking = true;
+        Restart = "on-failure";
+        RestartSec = 5;
+      };
+      wantedBy = [ "graphical-session.target" ];
+      wants = [ "network-online.target" ];
+    };
+
+  };
+
+  meta = {
+    doc = ./nordvpn.md;
+    maintainers = with lib.maintainers; [ different-error ];
+  };
+}

nixos/modules/services/networking/ssh/sshd.nix

@@ -232,6 +232,10 @@ in
       "openssh"
       "banner"
     ] "Use services.openssh.settings.Banner instead.")
+    (lib.mkRenamedOptionModule
+      [ "services" "openssh" "moduliFile" ]
+      [ "services" "openssh" "settings" "ModuliFile" ]
+    )
   ];
 
   ###### interface
@@ -729,6 +733,14 @@ in
                 '';
                 example = "/etc/ssh/banner";
               };
+              ModuliFile = lib.mkOption {
+                type = lib.types.path;
+                default = "${config.services.openssh.package}/etc/ssh/moduli";
+                defaultText = lib.literalExpression ''"''${config.services.openssh.package}/etc/ssh/moduli"'';
+                description = ''
+                  Specifies the {manpage}`moduli(5)` file to use for Diffie-Hellman key exchange.
+                '';
+              };
             };
           }
         );
@@ -740,16 +752,6 @@ in
         description = "Verbatim contents of {file}`sshd_config`.";
       };
 
-      moduliFile = lib.mkOption {
-        example = "/etc/my-local-ssh-moduli;";
-        type = lib.types.path;
-        description = ''
-          Path to `moduli` file to install in
-          `/etc/ssh/moduli`. If this option is unset, then
-          the `moduli` file shipped with OpenSSH will be used.
-        '';
-      };
-
     };
 
     users.users = lib.mkOption {
@@ -770,14 +772,12 @@ in
       };
       users.groups.sshd = { };
 
-      services.openssh.moduliFile = lib.mkDefault "${cfg.package}/etc/ssh/moduli";
       services.openssh.sftpServerExecutable = lib.mkDefault "${cfg.package}/libexec/sftp-server";
 
       environment.etc =
         authKeysFiles
         // authPrincipalsFiles
         // {
-          "ssh/moduli".source = cfg.moduliFile;
           "ssh/sshd_config".source = sshconf;
         };
 

nixos/modules/services/networking/technitium-dns-server.nix

@@ -65,6 +65,7 @@ in
         DynamicUser = true;
 
         StateDirectory = "technitium-dns-server";
+        LogsDirectory = "technitium";
 
         Restart = "always";
         RestartSec = 10;
@@ -102,5 +103,8 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ fabianrig ];
+  meta.maintainers = with lib.maintainers; [
+    fabianrig
+    awildleon
+  ];
 }

nixos/modules/services/networking/zeronet.nix

@@ -96,13 +96,13 @@ with lib;
   config = mkIf cfg.enable {
     services.tor = mkIf cfg.tor {
       enable = true;
-      controlPort = 9051;
 
-      extraConfig = ''
-        CacheDirectoryGroupReadable 1
-        CookieAuthentication 1
-        CookieAuthFileGroupReadable 1
-      '';
+      settings = {
+        ControlPort = 9051;
+        CacheDirectoryGroupReadable = true;
+        CookieAuthentication = true;
+        CookieAuthFileGroupReadable = true;
+      };
     };
 
     systemd.services.zeronet = {

nixos/modules/services/security/authelia.nix

@@ -268,15 +268,6 @@ let
       };
     };
 
-  writeOidcJwksConfigFile =
-    oidcIssuerPrivateKeyFile:
-    pkgs.writeText "oidc-jwks.yaml" ''
-      identity_providers:
-        oidc:
-          jwks:
-            - key: {{ secret "${oidcIssuerPrivateKeyFile}" | mindent 10 "|" | msquote }}
-    '';
-
   # Remove an attribute in a nested set
   # https://discourse.nixos.org/t/modify-an-attrset-in-nix/29919/5
   removeAttrByPath =
@@ -362,7 +353,12 @@ in
           execCommand = "${instance.package}/bin/authelia";
           configFile = format.generate "config.yml" cleanedSettings;
           oidcJwksConfigFile = lib.optional (instance.secrets.oidcIssuerPrivateKeyFile != null) (
-            writeOidcJwksConfigFile instance.secrets.oidcIssuerPrivateKeyFile
+            pkgs.writeText "oidc-jwks.yaml" ''
+              identity_providers:
+                oidc:
+                  jwks:
+                    - key: {{ mustEnv "CREDENTIALS_DIRECTORY" | printf "%s/oidcIssuerPrivateKeyFile" | secret | mindent 10 "|" | msquote }}
+            ''
           );
           configArg = "--config ${
             builtins.concatStringsSep "," (
@@ -373,21 +369,25 @@ in
               ]
             )
           }";
+          # Mapping between the Authelia env variables and the secret keys defined in the module
+          envSecretsMap = {
+            AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE = "jwtSecretFile";
+            AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = "storageEncryptionKeyFile";
+            AUTHELIA_SESSION_SECRET_FILE = "sessionSecretFile";
+            AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = "oidcHmacSecretFile";
+          };
+          nonNullEnvSecretsMap = lib.filterAttrs (_: v: instance.secrets.${v} != null) envSecretsMap;
         in
         {
           description = "Authelia authentication and authorization server";
           wantedBy = [ "multi-user.target" ];
           after = [ "network-online.target" ]; # Checks SMTP notifier creds during startup
           wants = [ "network-online.target" ];
-          environment =
-            (lib.filterAttrs (_: v: v != null) {
-              X_AUTHELIA_CONFIG_FILTERS = lib.mkIf (oidcJwksConfigFile != [ ]) "template";
-              AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE = instance.secrets.jwtSecretFile;
-              AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = instance.secrets.storageEncryptionKeyFile;
-              AUTHELIA_SESSION_SECRET_FILE = instance.secrets.sessionSecretFile;
-              AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = instance.secrets.oidcHmacSecretFile;
-            })
-            // instance.environmentVariables;
+          environment = {
+            X_AUTHELIA_CONFIG_FILTERS = lib.mkIf (oidcJwksConfigFile != [ ]) "template";
+          }
+          // lib.mapAttrs (_: v: "%d/${v}") nonNullEnvSecretsMap
+          // instance.environmentVariables;
 
           preStart = "${execCommand} ${configArg} validate-config";
           serviceConfig = {
@@ -399,6 +399,12 @@ in
             StateDirectory = autheliaName instance.name;
             StateDirectoryMode = "0700";
 
+            LoadCredential =
+              lib.optional (
+                instance.secrets.oidcIssuerPrivateKeyFile != null
+              ) "oidcIssuerPrivateKeyFile:${instance.secrets.oidcIssuerPrivateKeyFile}"
+              ++ lib.mapAttrsToList (_: v: "${v}:${instance.secrets.${v}}") nonNullEnvSecretsMap;
+
             # Security options:
             AmbientCapabilities = "";
             CapabilityBoundingSet = "";

nixos/modules/services/system/userborn.nix

@@ -86,7 +86,7 @@ in
         The primary motivation for this is an immutable `/etc`, where we cannot
         write the files directly to `/etc`.
 
-        However this an also serve other use cases, e.g. when `/etc` is on a `tmpfs`.
+        However this can also serve other use cases, e.g. when `/etc` is on a `tmpfs`.
       '';
     };
 

nixos/modules/services/torrent/rtorrent.nix

@@ -149,13 +149,6 @@ in
 
       protocol.encryption.set = allow_incoming,try_outgoing,enable_retry
 
-      # Limits for file handle resources, this is optimized for
-      # an `ulimit` of 1024 (a common default). You MUST leave
-      # a ceiling of handles reserved for rTorrent's internal needs!
-      network.http.max_open.set = 50
-      network.max_open_files.set = 600
-      network.max_open_sockets.set = 3000
-
       # Memory resource usage (increase if you have a large number of items loaded,
       # and/or the available resources to spend)
       pieces.memory.max.set = 1800M
@@ -169,15 +162,14 @@ in
       execute.nothrow = sh, -c, (cat, "echo >", (session.path), "rtorrent.pid", " ", (system.pid))
 
       # Other operational settings (check & adapt)
-      encoding.add = utf8
       system.umask.set = 0027
       system.cwd.set = (cfg.basedir)
       network.http.dns_cache_timeout.set = 25
-      schedule2 = monitor_diskspace, 15, 60, ((close_low_diskspace, 1000M))
+      schedule = monitor_diskspace, 15, 60, ((close_low_diskspace, 1000M))
 
       # Watch directories (add more as you like, but use unique schedule names)
-      #schedule2 = watch_start, 10, 10, ((load.start, (cat, (cfg.watch), "start/*.torrent")))
-      #schedule2 = watch_load, 11, 10, ((load.normal, (cat, (cfg.watch), "load/*.torrent")))
+      #schedule = watch_start, 10, 10, ((load.start, (cat, (cfg.watch), "start/*.torrent")))
+      #schedule = watch_load, 11, 10, ((load.normal, (cat, (cfg.watch), "load/*.torrent")))
 
       # Logging:
       #   Levels = critical error warn notice info debug
@@ -218,6 +210,10 @@ in
               RuntimeDirectory = "rtorrent";
               RuntimeDirectoryMode = 750;
 
+              # rtorrent derives socket limits from this value since 0.16.15; see table in
+              # https://github.com/rakshasa/rtorrent/wiki/Socket-Manager-and-Resource-Allocation
+              LimitNOFILE = lib.mkDefault 16384;
+
               CapabilityBoundingSet = [ "" ];
               LockPersonality = true;
               NoNewPrivileges = true;

nixos/modules/services/web-apps/homer.nix

@@ -169,11 +169,25 @@ in
       enable = true;
       virtualHosts."${cfg.virtualHost.domain}".extraConfig = ''
         root * ${cfg.package}
-        file_server
+        encode zstd gzip
+
+        @immutable path /resources/*
+        header @immutable Cache-Control "public, max-age=31536000, immutable"
+
+        @html not path /resources/*
+        header @html Cache-Control "no-store"
+
+        header {
+          -ETag
+          -Last-Modified
+        }
+
         handle_path /assets/config.yml {
           root * ${configFile}
           file_server
         }
+
+        file_server
       '';
     };
   };

nixos/modules/services/web-apps/immichframe.nix

@@ -134,6 +134,40 @@ in
           Type = "simple";
           Restart = "on-failure";
           RestartSec = 3;
+
+          # systemd hardening, based on jellyfin (also .NET) but stricter
+          CapabilityBoundingSet = [ "" ];
+          DevicePolicy = "closed";
+          LockPersonality = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = !config.boot.isContainer;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = !config.boot.isContainer;
+          ProtectKernelTunables = !config.boot.isContainer;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          # no AF_NETLINK here since there's no network connection monitoring
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          RestrictNamespaces = !config.boot.isContainer;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallErrorNumber = "EPERM";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+          ];
+          UMask = "0077";
         };
       };
   };

nixos/modules/services/web-apps/isso.nix

@@ -37,6 +37,8 @@ in
 
           See [Isso Server Configuration](https://posativ.org/isso/docs/configuration/server/)
           for supported values.
+          You can set secrets using the secretFile option with environment variables following
+          [the documentation](https://isso-comments.de/docs/reference/server-config/#environment-variables).
         '';
 
         type = types.submodule {
@@ -51,6 +53,16 @@ in
           }
         '';
       };
+
+      secretFile = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          A file containing secrets as environment variables that will be used in the configuration.
+          See [the documentation](https://isso-comments.de/docs/reference/server-config/#environment-variables) for details.
+        '';
+        example = "/run/secrets/isso.env";
+      };
     };
   };
 
@@ -65,6 +77,8 @@ in
         User = "isso";
         Group = "isso";
 
+        EnvironmentFile = mkIf (cfg.secretFile != null) [ cfg.secretFile ];
+
         DynamicUser = true;
 
         StateDirectory = "isso";

nixos/modules/services/web-apps/lasuite-meet.nix

@@ -50,7 +50,6 @@ let
     environment = pythonEnvironment;
 
     serviceConfig = {
-      RuntimeDirectory = "lasuite-meet";
       StateDirectory = "lasuite-meet";
       WorkingDirectory = "/var/lib/lasuite-meet";
 
@@ -382,6 +381,8 @@ in
         '';
 
         serviceConfig = {
+          # needs to be here so that cronjobs don't nuke it
+          RuntimeDirectory = "lasuite-meet";
           BindReadOnlyPaths = "${cfg.package}/share/static:/var/lib/lasuite-meet/static";
 
           ExecStart = utils.escapeSystemdExecArgs (

nixos/modules/services/web-servers/nginx/default.nix

@@ -1617,8 +1617,7 @@ in
           MemoryDenyWriteExecute =
             !(
               (builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules)
-              || cfg.lua.enable
-              || (cfg.package == pkgs.openresty)
+              || (lib.getName cfg.package == "openresty")
             );
           RestrictRealtime = true;
           RestrictSUIDSGID = true;

nixos/modules/services/web-servers/rustfs.nix

@@ -0,0 +1,151 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.rustfs;
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    marcel
+  ];
+
+  options.services.rustfs = {
+    enable = lib.mkEnableOption "RustFS Object Storage Server";
+
+    package = lib.mkPackageOption pkgs "rustfs" { };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "rustfs";
+      description = "The user RustFS should run as.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "rustfs";
+      description = "The group RustFS should run as.";
+    };
+
+    settings = lib.mkOption {
+      default = { };
+      description = ''
+        Options for RustFS configuration. Refer to
+        <https://docs.rustfs.com/installation/linux/single-node-single-disk.html#_5-configure-environment-variables>
+        for details on supported values.
+      '';
+      example = lib.literalExpression ''
+        {
+          RUSTFS_CONSOLE_ENABLE = "true";
+          RUSTFS_VOLUMES = "/mnt/rustfs";
+        }
+      '';
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (
+          lib.types.oneOf [
+            lib.types.str
+            lib.types.int
+          ]
+        );
+        options = {
+          RUSTFS_VOLUMES = lib.mkOption {
+            type = lib.types.path;
+            default = "/var/lib/rustfs";
+            description = "The directory where RustFS stores it's data.";
+          };
+        };
+      };
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.str;
+      description = "Path to environment file containing secrets like RUSTFS_ACCESS_KEY or RUSTFS_SECRET_KEY.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !(cfg.settings ? RUSTFS_ACCESS_KEY);
+        message = "RUSTFS_ACCESS_KEY must not be set in services.rustfs.settings. Use environmentFile instead.";
+      }
+      {
+        assertion = !(cfg.settings ? RUSTFS_SECRET_KEY);
+        message = "RUSTFS_SECRET_KEY must not be set in services.rustfs.settings. Use environmentFile instead.";
+      }
+    ];
+
+    systemd = {
+      tmpfiles.settings."10-rustfs".${cfg.settings.RUSTFS_VOLUMES}.d = {
+        inherit (cfg) user group;
+      };
+
+      # https://docs.rustfs.com/installation/linux/single-node-single-disk.html#_6-configure-system-service
+      services.rustfs = {
+        description = "RustFS Object Storage Server";
+        documentation = [ "https://rustfs.com/docs/" ];
+
+        after = [ "network-online.target" ];
+        wants = [ "network-online.target" ];
+
+        wantedBy = [ "multi-user.target" ];
+
+        environment = cfg.settings;
+
+        preStart = ''
+          if [ -z "$RUSTFS_ACCESS_KEY" ] || [ -z "$RUSTFS_SECRET_KEY" ]; then
+            echo "RustFS uses well-known default values for RUSTFS_ACCESS_KEY and RUSTFS_SECRET_KEY,"
+            echo "please configure them using services.rustfs.environmentFile."
+            exit 1
+          fi
+        '';
+
+        serviceConfig = {
+          Type = "notify";
+          NotifyAccess = "main";
+          User = cfg.user;
+          Group = cfg.group;
+
+          EnvironmentFile = cfg.environmentFile;
+          ExecStart = lib.getExe cfg.package;
+
+          LimitNOFILE = 1048576;
+          LimitNPROC = 32768;
+          TasksMax = "infinity";
+
+          Restart = "always";
+          RestartSec = "10s";
+
+          OOMScoreAdjust = "-1000";
+          SendSIGKILL = false;
+
+          TimeoutStartSec = "30s";
+          TimeoutStopSec = "30s";
+
+          NoNewPrivileges = true;
+
+          ProtectHome = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectClock = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectControlGroups = true;
+          RestrictSUIDSGID = true;
+          RestrictRealtime = true;
+        };
+      };
+    };
+
+    users = {
+      users.${cfg.user} = {
+        isSystemUser = true;
+        inherit (cfg) group;
+      };
+      groups.${cfg.group} = { };
+    };
+  };
+}

nixos/modules/services/x11/desktop-managers/mate.nix

@@ -141,6 +141,10 @@ in
       services.libinput.enable = mkDefault true;
 
       security.pam.services.mate-screensaver.unixAuth = true;
+      security.polkit = {
+        enable = true;
+        enablePkexecWrapper = mkDefault true;
+      };
 
       xdg.portal.configPackages = mkDefault [ pkgs.mate-desktop ];
 

nixos/modules/system/boot/loader/limine/limine-install.py

@@ -347,7 +347,7 @@ def config_entry(levels: int, bootspec: BootSpec, label: str, time: str) -> str:
             os.path.basename(bootspec.toplevel) + "-secrets"
         )
 
-        if os.system(bootspec.initrdSecrets + " " + initrd_secrets_path_temp) != 0:
+        if subprocess.run([bootspec.initrdSecrets, initrd_secrets_path_temp]).returncode != 0:
             print(
                 f'warning: failed to create initrd secrets for "{label}"',
                 file=sys.stderr,

nixos/modules/system/boot/plymouth.nix

@@ -68,7 +68,7 @@ let
 
   configFile = pkgs.writeText "plymouthd.conf" ''
     [Daemon]
-    ShowDelay=0
+    ShowDelay=${toString cfg.showDelay}
     DeviceTimeout=8
     Theme=${cfg.theme}
     ${cfg.extraConfig}
@@ -166,6 +166,15 @@ in
         '';
       };
 
+      showDelay = mkOption {
+        type = types.numbers.nonnegative;
+        default = 0;
+        example = 0.5;
+        description = ''
+          Time (in seconds) to delay the splash screen.
+        '';
+      };
+
       extraConfig = mkOption {
         type = types.lines;
         default = "";

nixos/modules/system/boot/systemd/fido2.nix

@@ -27,6 +27,8 @@ in
       "${cfg.package}/lib/udev/fido_id"
       "${cfg.package}/lib/cryptsetup/libcryptsetup-token-systemd-fido2.so"
       "${pkgs.libfido2}/lib/libfido2.so.1"
+      # dlopened by the libpcsclite.so.1 shim, invisible to make-initrd-ng
+      "${lib.getLib pkgs.pcsclite}/lib/libpcsclite_real.so.1"
     ];
   };
 }

nixos/modules/system/boot/systemd/tpm2.nix

@@ -45,6 +45,7 @@
           "systemd-tpm2-setup.service"
           "systemd-pcrextend.socket"
           "systemd-pcrextend@.service"
+          "systemd-pcrlogin@.service"
         ];
       }
     )

nixos/modules/virtualisation/incus.nix

@@ -396,7 +396,7 @@ in
           abi <abi/4.0>,
           include <tunables/global>
 
-          include "/var/lib/incus/security/apparmor/profiles"
+          include if exists "/var/lib/incus/security/apparmor/profiles"
         '';
       };
       includes."abstractions/base" = ''

nixos/modules/virtualisation/nspawn-container/default.nix

@@ -81,34 +81,6 @@ in
           which is prohibited within the Nix build sandbox where the test is run.
         '';
       }
-      {
-        # Check every interface defined in allInterfaces.
-        # Containers try to create a bridge "${config.system.name}-${interfaceName}"
-        assertion = lib.all (
-          iface:
-          let
-            hostName = "${config.system.name}-${iface.name}";
-          in
-          lib.stringLength hostName <= 15
-        ) (lib.attrValues cfg.allInterfaces);
-
-        message =
-          let
-            offendingInterfaces = lib.filter (
-              iface: lib.stringLength "${config.system.name}-${iface.name}" > 15
-            ) (lib.attrValues cfg.allInterfaces);
-            offenderList = map (
-              i:
-              "${config.system.name}-${i.name} (${toString (lib.stringLength "${config.system.name}-${i.name}")} chars)"
-            ) offendingInterfaces;
-          in
-          ''
-            The following generated host interface names exceed the Linux 15-character limit:
-              ${lib.concatStringsSep "\n            " offenderList}
-
-            Please shorten 'config.system.name' or the interface names in 'virtualisation.interfaces'.
-          '';
-      }
     ];
 
     virtualisation.systemd-nspawn.options = [

nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py

@@ -1,6 +1,7 @@
 import contextlib
 import dataclasses
 import fcntl
+import hashlib
 import logging
 import os
 import signal
@@ -124,6 +125,13 @@ def mk_veth(
     vlan: int,
 ) -> typing.Generator[None, None, None]:
     host_intf_name = f"{container_name}-{container_intf_name}"
+    # If the names for systemd-nspawn containers are too long,
+    # the generated bridge interface names will surpass the
+    # kernel limit IFNAMSIZ (15 characters + '\0').
+    if len(host_intf_name) > 15:
+        hashed = hashlib.sha256(host_intf_name.encode()).hexdigest()[:6]
+        host_intf_name = f"{host_intf_name[:8]}-{hashed}"
+
     with ensure_vlan_bridge(vlan) as bridge_name:
         logger.info("creating interface %s", host_intf_name)
         run_ip(

nixos/release-combined.nix

@@ -201,7 +201,7 @@ rec {
         (onFullSupported "nixos.tests.printing-socket")
         (onFullSupported "nixos.tests.proxy")
         (onFullSupported "nixos.tests.sddm.default")
-        (onFullSupported "nixos.tests.shadow")
+        (onFullSupported "nixos.tests.shadow.login")
         (onFullSupported "nixos.tests.simple-container")
         (onFullSupported "nixos.tests.simple-vm")
         (onFullSupported "nixos.tests.sway")

nixos/tests/all-tests.nix

@@ -63,7 +63,7 @@ let
       - `config.node.pkgs.<name>` or `config.nodes.foo.nixpkgs.pkgs.<name>` to refer
         to the Nixpkgs used on the VM guest(s).
       - `hostPkgs.<name>` when invoking commands on the VM host (e.g. in Python
-        `os.system("foo")`)
+        `subprocess.run(["foo"])`)
     - Since the runTest argument is a module instead of a function, arguments
       must be passed as option definitions.
       You may declare explicit `options` for the test parameter(s), or use the
@@ -1205,6 +1205,7 @@ in
   nominatim = runTest ./nominatim.nix;
   non-default-filesystems = handleTest ./non-default-filesystems.nix { };
   non-switchable-system = runTest ./non-switchable-system.nix;
+  nordvpn = runTest ./nordvpn.nix;
   noto-fonts = runTest ./noto-fonts.nix;
   noto-fonts-cjk-qt-default-weight = runTest ./noto-fonts-cjk-qt-default-weight.nix;
   novacomd = handleTestOn [ "x86_64-linux" ] ./novacomd.nix { };
@@ -1511,6 +1512,7 @@ in
   rtkit = runTest ./rtkit.nix;
   rtorrent = runTest ./rtorrent.nix;
   rush = runTest ./rush.nix;
+  rustfs = runTest ./rustfs.nix;
   rustical = runTest ./web-apps/rustical.nix;
   rustls-libssl = runTest ./rustls-libssl.nix;
   rxe = runTest ./rxe.nix;
@@ -1538,7 +1540,7 @@ in
   sftpgo = runTest ./sftpgo.nix;
   sfxr-qt = runTest ./sfxr-qt.nix;
   sgt-puzzles = runTest ./sgt-puzzles.nix;
-  shadow = runTest ./shadow.nix;
+  shadow = import ./shadow { inherit runTest; };
   shadowsocks = handleTest ./shadowsocks { };
   shadps4 = runTest ./shadps4.nix;
   sharkey = runTest ./web-apps/sharkey.nix;
@@ -1584,6 +1586,8 @@ in
   sssd-ldap = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-ldap.nix { };
   sssd-legacy-config = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-legacy-config.nix { };
   stalwart = runTest ./stalwart/stalwart.nix;
+  stardust-xr-atmosphere = runTest ./stardust-xr/atmosphere.nix;
+  stardust-xr-flatland = runTest ./stardust-xr/flatland.nix;
   stargazer = runTest ./web-servers/stargazer.nix;
   starship = runTest ./starship.nix;
   startx = import ./startx.nix { inherit pkgs runTest; };
@@ -1683,6 +1687,7 @@ in
   systemd-journal = runTest ./systemd-journal.nix;
   systemd-journal-gateway = runTest ./systemd-journal-gateway.nix;
   systemd-journal-upload = runTest ./systemd-journal-upload.nix;
+  systemd-localed = runTest ./systemd-localed.nix;
   systemd-lock-handler = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./systemd-lock-handler.nix;
   systemd-machinectl = runTest ./systemd-machinectl.nix;
   systemd-misc = runTest ./systemd-misc.nix;
@@ -1841,6 +1846,7 @@ in
   };
   virtualbox = handleTestOn [ "x86_64-linux" ] ./virtualbox.nix { };
   vm-variant = handleTest ./vm-variant.nix { };
+  vnstat = runTest ./vnstat.nix;
   vscode-remote-ssh = handleTestOn [ "x86_64-linux" ] ./vscode-remote-ssh.nix { };
   vscodium = import ./vscodium.nix { inherit runTest; };
   vsftpd = runTest ./vsftpd.nix;
@@ -1851,6 +1857,7 @@ in
   wasabibackend = runTest ./wasabibackend.nix;
   wastebin = runTest ./wastebin.nix;
   watchdogd = runTest ./watchdogd.nix;
+  watt = runTest ./watt.nix;
   webhook = runTest ./webhook.nix;
   weblate = runTest ./web-apps/weblate.nix;
   wg-access-server = runTest ./wg-access-server.nix;

nixos/tests/authelia.nix

@@ -28,12 +28,10 @@
         # This is purely for testing purposes!
         environment.etc."authelia/storageEncryptionKeyFile" = {
           mode = "0400";
-          user = "authelia-testing";
           text = "you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this";
         };
         environment.etc."authelia/jwtSecretFile" = {
           mode = "0400";
-          user = "authelia-testing";
           text = "a_very_important_secret";
         };
         environment.etc."authelia/users_database.yml" = {

nixos/tests/blint.nix

@@ -14,7 +14,7 @@
     ]
     ++ teams.ngi.members;
 
-  nodes.machine = {
+  containers.machine = {
     environment.systemPackages = with pkgs; [
       blint
       jq

nixos/tests/bluesky-pds.nix

@@ -2,7 +2,7 @@
 {
   name = "PDS";
 
-  nodes.machine = {
+  containers.machine = {
     services.bluesky-pds = {
       enable = true;
       settings = {

nixos/tests/boot.nix

@@ -203,11 +203,26 @@ in
     makeTest {
       name = "boot-uboot-extlinux";
       nodes = { };
-      testScript = ''
-        import os
+      testScript = /* py */ ''
+        import subprocess
 
         # Create a mutable linked image backed by the read-only SD image
-        if os.system("${pkgs.qemu}/bin/qemu-img create -f qcow2 -F raw -b ${sdImage} ${mutableImage}") != 0:
+        if (
+            subprocess.run(
+                [
+                    "${pkgs.qemu}/bin/qemu-img",
+                    "create",
+                    "-f",
+                    "qcow2",
+                    "-F",
+                    "raw",
+                    "-b",
+                    "${sdImage}",
+                    "${mutableImage}",
+                ]
+            ).returncode
+            != 0
+        ):
             raise RuntimeError("Could not create mutable linked image")
 
         machine = create_machine("${startCommand}")

nixos/tests/cockpit.nix

@@ -102,7 +102,6 @@ in
                   from selenium.webdriver.firefox.options import Options
                   from selenium.webdriver.support.ui import WebDriverWait
                   from selenium.webdriver.support import expected_conditions as EC
-                  from time import sleep
 
 
                   def log(msg):
@@ -129,7 +128,7 @@ in
                       wait.until(EC.presence_of_element_located((by, query)))
 
 
-                  def wait_title_contains(title, timeout=10):
+                  def wait_title_contains(title, timeout=30):
                       wait = WebDriverWait(driver, timeout)
                       wait.until(EC.title_contains(title))
 
@@ -138,11 +137,6 @@ in
                       return driver.find_element(by, query)
 
 
-                  def set_value(elem, value):
-                      script = 'arguments[0].value = arguments[1]'
-                      return driver.execute_script(script, elem, value)
-
-
                   log("Waiting for the homepage to load")
 
                   # cockpit sets initial title as hostname
@@ -151,36 +145,45 @@ in
 
                   log("Homepage loaded!")
 
+                  # Prefer send_keys over setting .value via JS: Cockpit's login
+                  # form (and PatternFly widgets) do not always react to the latter.
                   log("Filling out username")
                   login_input = find_element(By.CSS_SELECTOR, 'input#login-user-input')
-                  set_value(login_input, "${user}")
+                  login_input.clear()
+                  login_input.send_keys("${user}")
 
                   log("Filling out password")
-                  password_input = find_element(By.CSS_SELECTOR, 'input#login-password-input')
-                  set_value(password_input, "${password}")
+                  password_input = find_element(
+                      By.CSS_SELECTOR, 'input#login-password-input'
+                  )
+                  password_input.clear()
+                  password_input.send_keys("${password}")
 
                   log("Submitting credentials for login")
                   driver.find_element(By.CSS_SELECTOR, 'button#login-button').click()
 
-                  # driver.implicitly_wait(1)
-                  # driver.get("https://server:7890/system")
-
                   log("Waiting dashboard to load")
                   wait_title_contains("${user}@server")
 
-                  log("Waiting for the frontend to initialize")
-                  sleep(1)
-
                   log("Looking for that banner that tells about limited access")
-                  container_iframe = find_element(By.CSS_SELECTOR, 'iframe.container-frame')
+                  wait_elem(By.CSS_SELECTOR, 'iframe.container-frame', timeout=30)
+                  container_iframe = find_element(
+                      By.CSS_SELECTOR, 'iframe.container-frame'
+                  )
                   driver.switch_to.frame(container_iframe)
-
-                  assert "Web console is running in limited access mode" in driver.page_source
+                  # Wait for the overview iframe to render the limited-access alert.
+                  # Fixed sleeps were flaky after Cockpit 364 (slower SPA init).
+                  phrase = "Web console is running in limited access mode"
+                  WebDriverWait(driver, 30).until(
+                      lambda d: phrase in d.page_source
+                  )
 
                   log("Clicking the sudo button")
+                  # Button label is "Turn on administrative access"
                   for button in driver.find_elements(By.TAG_NAME, "button"):
-                      if 'admin' in button.text:
+                      if 'admin' in button.text.casefold():
                           button.click()
+                          break
                   driver.switch_to.default_content()
 
                   log("Checking that /nonexistent is not a thing")
@@ -189,13 +192,17 @@ in
 
                   log("Checking plugin path")
                   driver.get("https://server:7890/hello-test")
-                  sleep(2)
+                  wait_elem(By.CSS_SELECTOR, 'iframe.container-frame', timeout=30)
                   for iframe in driver.find_elements(By.TAG_NAME, "iframe"):
                       if "hello-test" in (iframe.get_attribute("src") or ""):
                           driver.switch_to.frame(iframe)
                           break
-                  text = driver.find_element(By.ID, "output").text
-                  sleep(1)
+                  output = find_element(By.ID, "output")
+                  WebDriverWait(driver, 30).until(
+                      lambda d: "SUCCESS: Hello, world!" in output.text
+                      or output.text.startswith("FAILED:")
+                  )
+                  text = output.text
                   assert "SUCCESS: Hello, world!" in text, f"Plugin failed: {text}"
 
                   driver.close()
@@ -215,8 +222,10 @@ in
 
     server.wait_for_unit("sockets.target")
     server.wait_for_open_port(7890)
+    # Port open is not enough: cockpit-ws may still be finishing startup.
+    server.wait_until_succeeds("curl -k https://127.0.0.1:7890 -o /dev/null")
 
-    client.succeed("curl -k https://server:7890 -o /dev/stderr")
+    client.wait_until_succeeds("curl -k https://server:7890 -o /dev/stderr")
     print(client.succeed("whoami"))
     client.succeed('PYTHONUNBUFFERED=1 selenium-script')
   '';

nixos/tests/common/openxr.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+{
+  imports = [
+    ./user-account.nix
+    ./x11.nix
+  ];
+  test-support.displayManager.auto.user = "alice";
+  systemd.user.targets.xdg-desktop-autostart = {
+    wantedBy = [ "graphical-session.target" ];
+    after = [ "graphical-session.target" ];
+  };
+
+  hardware.graphics.enable = true;
+
+  services.monado = {
+    enable = true;
+    defaultRuntime = true;
+    forceDefaultRuntime = true;
+  };
+  systemd.user.services.monado = {
+    requires = [ "graphical-session.target" ];
+    environment = {
+      # Stop Monado from probing for any hardware
+      SIMULATED_ENABLE = "1";
+      SIMULATED_LEFT = "simple";
+      SIMULATED_RIGHT = "simple";
+      # Run as X11 client rather than using direct mode
+      XRT_COMPOSITOR_FORCE_XCB = "1";
+      # And run fullscreen so that we can hide the DE
+      XRT_COMPOSITOR_XCB_FULLSCREEN = "1";
+    };
+  };
+}

nixos/tests/ec2-image.nix

@@ -135,7 +135,17 @@ in
               public_key = os.path.join(key_dir, "id_ed25519.pub")
 
               # Generate key pair using host SSH tools
-              ret = os.system(f"${hostPkgs.openssh}/bin/ssh-keygen -t ed25519 -f {private_key} -N \"\"")
+              ret = subprocess.run(
+                  [
+                      "${hostPkgs.openssh}/bin/ssh-keygen",
+                      "-t",
+                      "ed25519",
+                      "-f",
+                      private_key,
+                      "-N",
+                      ""
+                  ]
+              ).returncode
               if ret != 0:
                   raise Exception("Failed to generate SSH key pair")
 

nixos/tests/ghostunnel-modular.nix

@@ -54,13 +54,13 @@
   };
 
   testScript = ''
-    import os
+    import subprocess
 
     # prepare certificates
 
     def cmd(command):
       print(f"+{command}")
-      r = os.system(command)
+      r = subprocess.run(command, shell=True).returncode
       if r != 0:
         raise Exception(f"Command {command} failed with exit code {r}")
 

nixos/tests/ghostunnel.nix

@@ -48,13 +48,13 @@
   };
 
   testScript = ''
-    import os
+    import subprocess
 
     # prepare certificates
 
     def cmd(command):
       print(f"+{command}")
-      r = os.system(command)
+      r = subprocess.run(command, shell=True).returncode
       if r != 0:
         raise Exception(f"Command {command} failed with exit code {r}")
 

nixos/tests/grafana/basic.nix

@@ -84,7 +84,7 @@ import ../make-test-python.nix (
       };
     };
 
-    nodes = builtins.mapAttrs (
+    containers = builtins.mapAttrs (
       _: val:
       mkMerge [
         val
@@ -97,7 +97,7 @@ import ../make-test-python.nix (
 
     meta.maintainers = [ ];
 
-    inherit nodes;
+    inherit containers;
 
     testScript = ''
       start_all()

nixos/tests/grafana/provision/default.nix

@@ -183,7 +183,7 @@ import ../../make-test-python.nix (
         };
     };
 
-    nodes = builtins.mapAttrs (
+    containers = builtins.mapAttrs (
       _: val:
       mkMerge [
         val
@@ -196,7 +196,7 @@ import ../../make-test-python.nix (
 
     meta.maintainers = [ ];
 
-    inherit nodes;
+    inherit containers;
 
     testScript = ''
       start_all()

nixos/tests/haproxy.nix

@@ -69,12 +69,12 @@
       };
   };
   testScript = ''
-    import os
+    import subprocess
 
     # Helpers
     def cmd(command):
       print(f"+{command}")
-      r = os.system(command)
+      r = subprocess.run(command, shell=True).returncode
       if r != 0:
         raise Exception(f"Command {command} failed with exit code {r}")
 

nixos/tests/keycloak.nix

@@ -38,6 +38,7 @@ let
                 enable = true;
                 settings = {
                   hostname = certs.domain;
+                  metrics-enabled = true;
                 };
                 inherit initialAdminPassword;
                 sslCertificate = "${certs.${certs.domain}.cert}";
@@ -50,7 +51,6 @@ let
                 };
                 plugins = with config.services.keycloak.package.plugins; [
                   keycloak-discord
-                  keycloak-metrics-spi
                 ];
               };
               environment.systemPackages = with pkgs; [
@@ -131,13 +131,7 @@ let
                      | jq -r '"Authorization: bearer " + .access_token' >admin_auth_header
             """)
 
-            # Register the metrics SPI
-            keycloak.succeed(
-                """${pkgs.jre}/bin/keytool -import -alias snakeoil -file ${certs.ca.cert} -storepass aaaaaa -keystore cacert.jks -noprompt""",
-                """KC_OPTS='-Djavax.net.ssl.trustStore=cacert.jks -Djavax.net.ssl.trustStorePassword=aaaaaa' kcadm.sh config credentials --server '${frontendUrl}' --realm master --user admin --password "$(<${adminPasswordFile})" """,
-                """KC_OPTS='-Djavax.net.ssl.trustStore=cacert.jks -Djavax.net.ssl.trustStorePassword=aaaaaa' kcadm.sh update events/config -s 'eventsEnabled=true' -s 'adminEventsEnabled=true' -s 'eventsListeners+=metrics-listener'""",
-                """curl -sSf '${frontendUrl}/realms/master/metrics' | grep '^keycloak_admin_event_UPDATE'"""
-            )
+            keycloak.succeed("curl -sSf https://${certs.domain}:9000/metrics | grep '^jvm_'")
 
             # Publish the realm, including a test OIDC client and user
             keycloak.succeed(

nixos/tests/komodo-periphery.nix

@@ -5,22 +5,63 @@
     maintainers = with lib.maintainers; [ channinghe ];
   };
 
-  nodes.machine =
-    { config, pkgs, ... }:
-    {
-      virtualisation.docker.enable = true;
-      services.komodo-periphery = {
-        enable = true;
-        bindIp = "127.0.0.1";
-        port = 8120;
-        ssl.enable = false;
-        passkeys = [ "test-passkey" ];
+  nodes = {
+    periphery =
+      { ... }:
+      {
+        virtualisation.docker.enable = true;
+        services.komodo-periphery = {
+          enable = true;
+          inbound.bindIp = "127.0.0.1";
+          inbound.port = 8120;
+          inbound.ssl.enable = false;
+          inbound.serverEnabled = true;
+          disableTerminals = true;
+          disableContainerTerminals = true;
+          statsPollingRate = "10-sec";
+          containerStatsPollingRate = "1-min";
+          logging.level = "debug";
+          extraSettings = {
+            secrets.TEST_SECRET = "test-value";
+          };
+          auth.privateKey = "file:/var/lib/komodo-periphery/keys/test.key";
+          auth.corePublicKeys = [ "MCowBQYDK2VuAyEATZgrjGHeF0KJUe0+n77+qAWOg3YzEzXOmQWaRgO3OGQ=" ];
+        };
       };
-    };
+
+    peripheryOutbound =
+      { ... }:
+      {
+        virtualisation.docker.enable = true;
+        services.komodo-periphery = {
+          enable = true;
+          inbound.ssl.enable = false;
+          logging.level = "debug";
+          outbound.coreAddress = "core.invalid";
+          outbound.connectAs = "test-server";
+        };
+      };
+  };
 
   testScript = ''
-    machine.wait_for_unit("komodo-periphery.service")
-    machine.wait_for_open_port(8120)
-    machine.succeed("systemctl status komodo-periphery.service")
+    start_all()
+
+    with subtest("Inbound periphery starts and serves /version"):
+        periphery.wait_for_unit("komodo-periphery.service")
+        periphery.wait_for_open_port(8120)
+        periphery.succeed("curl -fsS --max-time 10 http://127.0.0.1:8120/version")
+
+    with subtest("Periphery creates managed directories"):
+        periphery.succeed("test -d /var/lib/komodo-periphery")
+        periphery.succeed("test -d /var/lib/komodo-periphery/repos")
+        periphery.succeed("test -d /var/lib/komodo-periphery/stacks")
+        periphery.succeed("test -d /var/lib/komodo-periphery/builds")
+        periphery.succeed("test -d /var/lib/komodo-periphery/keys")
+        periphery.succeed("test -d /var/lib/komodo-periphery/ssl")
+
+    with subtest("Outbound periphery stays active despite unreachable core"):
+        peripheryOutbound.wait_for_unit("komodo-periphery.service")
+        peripheryOutbound.sleep(15)
+        peripheryOutbound.succeed("systemctl is-active komodo-periphery")
   '';
 }

nixos/tests/matrix/continuwuity.nix

@@ -20,61 +20,66 @@ in
       };
       networking.firewall.allowedTCPPorts = [ 6167 ];
     };
+
     client =
       { pkgs, ... }:
       {
         environment.systemPackages = [
-          (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
+          (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.mautrix ]; } ''
             import asyncio
-            import nio
+
+            from mautrix.client import Client
+            from mautrix.types import EventType, RoomFilter
 
 
             async def main() -> None:
                 # Connect to continuwuity
-                client = nio.AsyncClient("http://continuwuity:6167", "${user}")
+                client = Client(
+                    mxid="@${user}:${name}",
+                    base_url="http://continuwuity:6167",
+                )
 
                 # Log in as user alice
-                response = await client.login("${pass}")
+                await client.login(password="${pass}")
 
                 # Create a new room
-                response = await client.room_create(federate=False)
-                print("Matrix room create response:", response)
-                assert isinstance(response, nio.RoomCreateResponse)
-                room_id = response.room_id
+                room_id = await client.create_room()
+                print("Created room:", room_id)
 
                 # Join the room
-                response = await client.join(room_id)
-                print("Matrix join response:", response)
-                assert isinstance(response, nio.JoinResponse)
+                await client.join_room_by_id(room_id)
+                print("Joined room")
 
                 # Send a message to the room
-                response = await client.room_send(
-                    room_id=room_id,
-                    message_type="m.room.message",
-                    content={
-                        "msgtype": "m.text",
-                        "body": "Hello continuwuity!"
-                    }
-                )
-                print("Matrix room send response:", response)
-                assert isinstance(response, nio.RoomSendResponse)
+                received = asyncio.Event()
+                msg = "Hello continuwuity!"
 
-                # Sync responses
-                response = await client.sync(timeout=30000)
-                print("Matrix sync response:", response)
-                assert isinstance(response, nio.SyncResponse)
+                async def on_message(evt):
+                    if (
+                        evt.room_id != room_id
+                        or evt.sender != client.mxid
+                        or evt.type != EventType.ROOM_MESSAGE
+                    ):
+                        return
 
-                # Check the message was received by continuwuity
-                last_message = response.rooms.join[room_id].timeline.events[-1].body
-                assert last_message == "Hello continuwuity!"
+                    assert evt.content.body == msg
+                    received.set()
+
+                client.add_event_handler(EventType.ROOM_MESSAGE, on_message)
+                sync_task = client.start(RoomFilter(rooms=[room_id]))
+
+                await client.send_text(room_id, msg)
+
+                # Sync until message is received
+                await asyncio.wait_for(received.wait(), timeout=30)
 
                 # Leave the room
-                response = await client.room_leave(room_id)
-                print("Matrix room leave response:", response)
-                assert isinstance(response, nio.RoomLeaveResponse)
+                await client.leave_room(room_id)
+                print("Left room")
 
                 # Close the client
-                await client.close()
+                client.stop()
+                await sync_task
 
 
             if __name__ == "__main__":
@@ -96,6 +101,7 @@ in
   '';
 
   meta.maintainers = with lib.maintainers; [
+    bartoostveen
     nyabinary
     snaki
   ];