cargo-seek: 0.1.0 -> 0.2.0 (#543291)

This reverts commit 5cefe928ee.

.github/workflows/backport.yml

@@ -36,7 +36,7 @@ jobs:
           permission-pull-requests: write
           permission-workflows: write
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}

.github/workflows/bot.yml

@@ -41,12 +41,8 @@ jobs:
   run:
     runs-on: ubuntu-slim
     if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
-    env:
-      # TODO: Remove after 2026-03-04, when Node 24 becomes the default.
-      # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/build.yml

@@ -49,7 +49,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -59,7 +59,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true

.github/workflows/check.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -95,7 +95,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -137,7 +137,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -147,7 +147,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

.github/workflows/comment.yml

@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 2
     if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/eval.yml

@@ -50,7 +50,7 @@ jobs:
       ciPinBumpCommit: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommit }}
       ciPinBumpCommitShort: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommitShort }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -58,7 +58,7 @@ jobs:
             ci/supportedVersions.nix
 
       - name: Check out the PR at the test merge commit
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           ref: ${{ inputs.mergedSha }}
@@ -139,7 +139,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Load supported versions
         id: versions
@@ -174,7 +174,7 @@ jobs:
           sudo mkswap /swap
           sudo swapon /swap
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -187,7 +187,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -259,7 +259,7 @@ jobs:
       statuses: write # creating 'Eval Summary' commit statuses
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -277,7 +277,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Combine all output paths and eval stats
         run: |
@@ -476,7 +476,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -486,7 +486,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'

.github/workflows/lint.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -134,7 +134,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: true # Needed to run git fetch for large PRs.
           path: trusted

.github/workflows/merge-group.yml

@@ -25,7 +25,7 @@ jobs:
       targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.prepare.outputs.systems }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/periodic-merge.yml

@@ -34,7 +34,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

.github/workflows/pull-request-target.yml

@@ -36,7 +36,7 @@ jobs:
       systems: ${{ steps.prepare.outputs.systems }}
       touched: ${{ steps.prepare.outputs.touched }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

.github/workflows/review.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/teams.yml

@@ -30,7 +30,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Fetch source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
       push: ${{ steps.files.outputs.push }}
       targetSha: ${{ steps.prepare.outputs.targetSha }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

ci/OWNERS

@@ -41,7 +41,7 @@
 /lib/meta.nix               @alyssais @NixOS/stdenv @llakala
 /lib/meta-types.nix         @infinisil @adisbladis @NixOS/stdenv @llakala
 /lib/source-types.nix       @alyssais @NixOS/stdenv @llakala
-/lib/systems                @alyssais @NixOS/stdenv @llakala
+/lib/systems                @alyssais @NixOS/stdenv
 ## Libraries / Module system
 /lib/modules.nix            @infinisil @roberth @hsjobeki @llakala
 /lib/types.nix              @infinisil @roberth @hsjobeki @llakala
@@ -260,7 +260,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/editors/jetbrains @leona-ya @theCapypara
 
 # Licenses
-/lib/licenses @alyssais @emilazy @jopejoe1 @llakala
+/lib/licenses @alyssais @emilazy @jopejoe1
 
 # Qt
 /pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000

ci/github-script/bot.js

@@ -395,6 +395,13 @@ module.exports = async ({ github, context, core, dry }) => {
         pull_number,
         per_page: 100,
       })
+
+      // label llm-assisted PRs accordingly
+      const assistedByPattern = /Assisted-by: (?!nix-init)/i
+      evalLabels['llm-assisted'] = prCommits.some((c) =>
+        assistedByPattern.test(c.commit.message),
+      )
+
       const commitSubjects = prCommits.map(
         (c) => c.commit.message.split('\n')[0],
       )

doc/build-helpers/fixed-point-arguments.chapter.md

@@ -143,3 +143,4 @@ lib.extendMkDerivation {
     });
 }
 ```
+:::

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -165,7 +165,7 @@ They are useful for creating files from Nix expressions, and are all implemented
 Each of these functions will cause a derivation to be produced.
 When you coerce the result of each of these functions to a string with [string interpolation](https://nixos.org/manual/nix/stable/language/string-interpolation) or [`toString`](https://nixos.org/manual/nix/stable/language/builtins#builtins-toString), it will evaluate to the [store path](https://nixos.org/manual/nix/stable/store/store-path) of this derivation.
 
-:::: {.note}
+::: {.note}
 Some of these functions will put the resulting files within a directory inside the [derivation output](https://nixos.org/manual/nix/stable/language/derivations#attr-outputs).
 If you need to refer to the resulting files somewhere else in a Nix expression, append their path to the derivation's store path.
 
@@ -190,7 +190,7 @@ writeShellScript "evaluate-my-file.sh" ''
   cat ${my-file}/share/my-file
 ''
 ```
-::::
+:::
 
 ### `makeDesktopItem` {#trivial-builder-makeDesktopItem}
 

doc/channels.chapter.md

@@ -0,0 +1,26 @@
+# How channels work {#how-channels-work}
+
+nixpkgs uses the [channels feature](https://nixos.org/nix/manual/#sec-channels) of nix.
+
+nixpkgs is distributed for users of Nix on non-NixOS distributions through the channel
+`nixpkgs-unstable`. Users of NixOS generally use one of the `nixos-*` channels,
+e.g. `nixos-22.11`, which includes all packages and modules for the stable NixOS
+22.11. Stable NixOS releases are generally only given
+security updates. More up to date packages and modules are available via the
+`nixos-unstable` channel.
+
+Both `nixos-unstable` and `nixpkgs-unstable` follow the `master` branch of the
+nixpkgs repository, although both do lag the `master` branch by generally
+[a couple of days](https://status.nixos.org/). Updates to a channel are
+distributed as soon as all tests for that channel pass, e.g.
+[this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
+shows the status of tests for the `nixpkgs-unstable` channel.
+
+The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
+which also builds binary packages from the Nix expressions in Nixpkgs for
+`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`.
+The binaries are made available via a [binary cache](https://cache.nixos.org).
+
+The current Nix expressions of the channels are available in the
+[nixpkgs repository](https://github.com/NixOS/nixpkgs) in branches
+that correspond to the channel names (e.g. `nixos-22.11-small`).

doc/doc-support/header.html

@@ -0,0 +1,7 @@
+<div class="manual-header">
+    <nav class="manual-header--tabs">
+        <a class="manual-header--tab manual-header--tab-active" href="#">Nixpkgs</a>
+        <a class="manual-header--tab" href="https://nixos.org/manual/nixos/stable/">NixOS</a>
+    </nav>
+    <span class="manual-header--title">Nixpkgs Manual</span>
+</div>

doc/doc-support/package.nix

@@ -119,6 +119,8 @@ stdenvNoCC.mkDerivation (
         --script ./anchor-use.js \
         --sidebar-depth 3 \
         --nav ./nav.json \
+        --header ${./header.html}\
+        --no-navheader \
         manual.md \
         out/index.html
 

doc/hooks/check-phase-thread-limit-hook.section.md

@@ -0,0 +1,24 @@
+# checkPhaseThreadLimitHook {#setup-hook-check-phase-thread-limit}
+
+This hook defaults a variety of environment variables known
+to control thread counts to 1. Many of these otherwise default
+to `$(nproc)`, which causes massive overloads on build machines
+if nix build jobs and build cores are already tuned to fully utilize
+compute capacity of a builder without additional parallelism.
+
+Currently sets the following environment variables:
+- [`OMP_NUM_THREADS`](https://www.openmp.org/spec-html/5.0/openmpse50.html)
+- [`OPENBLAS_NUM_THREADS`](https://github.com/OpenMathLib/OpenBLAS/blob/e7b45174355edec1f04de1cabcf5ca6a98ea7fbc/USAGE.md#how-can-i-use-openblas-in-multi-threaded-applications)
+- [`MKL_NUM_THREADS`](https://www.intel.com/content/www/us/en/docs/onemkl/developer-guide-linux/2023-0/mkl-domain-num-threads.html)
+- [`BLIS_NUM_THREADS`](https://github.com/flame/blis/blob/b8b75b4e19459f5d618b57aa814ca38b1d82eb82/docs/Multithreading.md#specifying-multithreading)
+- `VECLIB_MAXIMUM_THREADS`: Only affects darwin, see [`man 7 Accelerate`](https://manp.gs/mac/7/Accelerate)
+- [`NUMBA_NUM_THREADS`](https://numba.readthedocs.io/en/stable/reference/envvars.html#threading-control)
+- [`NUMEXPR_NUM_THREADS`](https://numexpr.readthedocs.io/en/latest/user_guide.html#threadpool-configuration)
+
+The `NIX_CHECK_PHASE_DEFAULT_NUM_THREADS` environment variable
+can be used to override the default thread count limit.
+`dontLimitCheckPhaseThreads = true;` can be used to disable
+thread limiting on an individual package.
+
+This hook will not attempt to override already existing
+definitions for thread count environment variables.

doc/hooks/index.md

@@ -13,6 +13,7 @@ aws-c-common.section.md
 bmake.section.md
 breakpoint.section.md
 cernlib.section.md
+check-phase-thread-limit-hook.section.md
 cmake.section.md
 desktop-file-utils.section.md
 gdk-pixbuf.section.md
@@ -34,7 +35,6 @@ nodejs-install-manuals.section.md
 npm-build-hook.section.md
 npm-config-hook.section.md
 npm-install-hook.section.md
-openmp-check-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md

doc/hooks/openmp-check-hook.section.md

@@ -1,10 +0,0 @@
-# openmpCheckPhaseHook {#setup-hook-omp-check}
-
-
-This hook can be used to setup a check phase that
-requires running a OpenMP application. It mostly
-serves to limit `OMP_NUM_THREADS` to avoid overloading
-build machines.
-
-This hook will not attempt to override an already existing
-definition of `OMP_NUM_THREADS` in the environment.

doc/languages-frameworks/rocq.section.md

@@ -59,7 +59,7 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
 * `releaseRev` (optional, defaults to `(v: v)`), provides a default mapping from release names to revision hashes/branch names/tags,
 * `releaseArtifact` (optional, defaults to `(v: null)`), provides a default mapping from release names to artifact names (only works for github artifact for now),
 * `displayVersion` (optional), provides a way to alter the computation of `name` from `pname`, by explaining how to display version numbers,
-* `namePrefix` (optional, defaults to `[ "rocq-core" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
+* `namePrefix` (optional, defaults to `[ "rocq" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
 * `nativeBuildInputs` (optional), is a list of executables that are required to build the current derivation, in addition to the default ones (namely `which`, `dune` and `ocaml` depending on whether `useDune`, `useDuneifVersion` and `mlPlugin` are set).
 * `extraNativeBuildInputs` (optional, deprecated), an additional list of derivation to add to `nativeBuildInputs`,
 * `overrideNativeBuildInputs` (optional) replaces the default list of derivation to which `nativeBuildInputs` and `extraNativeBuildInputs` adds extra elements,
@@ -68,12 +68,14 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
 * `overrideBuildInputs` (optional) replaces the default list of derivation to which `buildInputs` and `extraBuildInputs` adds extras elements,
 * `propagatedBuildInputs` (optional) is passed as is to `mkDerivation`, we recommend to use this for Rocq libraries and Rocq plugin dependencies, as this makes sure the paths of the compiled libraries and plugins will always be added to the build environments of subsequent derivation, which is necessary for Rocq packages to work correctly,
 * `mlPlugin` (optional, defaults to `false`). Some extensions (plugins) might require OCaml and sometimes other OCaml packages. Standard dependencies can be added by setting the current option to `true`. For a finer grain control, the `rocq-core.ocamlPackages` attribute can be used in `nativeBuildInputs`, `buildInputs`, and `propagatedBuildInputs` to depend on the same package set Rocq was built against.
-* `useDuneifVersion` (optional, default to `(x: false)` uses Dune to build the package if the provided predicate evaluates to true on the version, e.g. `useDuneifVersion = versions.isGe "1.1"`  will use dune if the version of the package is greater or equal to `"1.1"`,
+* `useDuneifVersion` (optional, default to `(x: false)`) uses Dune to build the package if the provided predicate evaluates to true on the version, e.g. `useDuneifVersion = versions.isGe "1.1"`  will use dune if the version of the package is greater or equal to `"1.1"`,
 * `useDune` (optional, defaults to `false`) uses Dune to build the package if set to true, the presence of this attribute overrides the behavior of the previous one.
 * `opam-name` (optional, defaults to concatenating with a dash separator the components of `namePrefix` and `pname`), name of the Dune package to build.
 * `enableParallelBuilding` (optional, defaults to `true`), since it is activated by default, we provide a way to disable it.
 * `extraInstallFlags` (optional), allows to extend `installFlags` which initializes the variables `COQLIBINSTALL` and `COQPLUGININSTALL` so as to install in the proper subdirectory. Indeed Rocq libraries should be installed in `$(out)/lib/coq/${rocq-core.rocq-version}/user-contrib/`. Such directories are automatically added to the `$ROCQPATH` environment variable by the hook defined in the Rocq derivation.
 * `setROCQBIN` (optional, defaults to `true`), by default, the environment variable `$ROCQBIN` is set to the current Rocq's binary, but one can disable this behavior by setting it to `false`,
+* `useCoq` (optional, defaults to `false`), adds the Coq compatibility binaries to the build environment, which is necessary for some packages that still depend on them and sets `COQBIN` to the path of the `coqc` binary (if `setROCQBIN` is also set to `true`). A wrapper `mkCoqDerivation` is provided that sets this option to `true`.
+* `useCoqifVersion` (optional, defaults to `(x: false)`), adds the Coq compatibility binaries to the build environment if the provided predicate evaluates to true on the version. This can be useful for supporting old package versions that need the Coq compatibility binaries, while newer versions do not.
 * `useMelquiondRemake` (optional, default to `null`) is an attribute set, which, if given, overloads the `preConfigurePhases`, `configureFlags`, `buildPhase`, and `installPhase` attributes of the derivation for a specific use in libraries using `remake` as set up by Guillaume Melquiond for `flocq`, `gappalib`, `interval`, and `coquelicot` (see the corresponding derivation for concrete examples of use of this option). For backward compatibility, the attribute `useMelquiondRemake.logpath` must be set to the logical root of the library (otherwise, one can pass `useMelquiondRemake = {}` to activate this without backward compatibility).
 * `dropAttrs`, `keepAttrs`, `dropDerivationAttrs` are all optional and allow to tune which attribute is added or removed from the final call to `mkDerivation`.
 

doc/languages-frameworks/texlive.section.md

@@ -32,6 +32,21 @@ There is a TeX Live packaging that lives entirely under attribute `texlive`.
   )
   ```
 
+- Packages can be overriden by passing a new package with the same `pname` to `.withPackages`. For instance, the following replaces Asymptote with the version from Nixpkgs, which is usually more up to date:
+  ```nix
+  texliveMedium.withPackages (ps: [ asymptote ])
+  ```
+
+- To exclude a package from a collection, use an empty override as below:
+  ```nix
+  texliveBasic.withPackages (
+    ps: with ps; [
+      collection-bibtexextra
+      { pname = "bib2gls"; }
+    ]
+  )
+  ```
+
 - To add the documentation for all packages in the environment, use
   ```nix
   texliveSmall.overrideAttrs { withDocs = true; }

doc/languages-frameworks/vim.section.md

@@ -149,6 +149,11 @@ Note: this is not possible anymore for Neovim.
 
 ## Adding new plugins to nixpkgs {#adding-new-plugins-to-nixpkgs}
 
+:::{.note}
+Before adding a Neovim Lua plugin, check if a release is available on [luarocks](https://luarocks.org/).
+If it is, add it as a [LuaRocks based plugin](#neovim-luarocks-based-plugins).
+:::
+
 Nix expressions for Vim plugins are stored in [pkgs/applications/editors/vim/plugins](https://github.com/NixOS/nixpkgs/tree/master/pkgs/applications/editors/vim/plugins). For the vast majority of plugins, Nix expressions are automatically generated by running [`nix-shell -p vimPluginsUpdater --run vim-plugins-updater`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/utils/updater.nix). This creates a [generated.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/generated.nix) file based on the plugins listed in [vim-plugin-names](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/vim-plugin-names).
 
 When the vim updater detects an nvim-treesitter update, it also runs [`nvim-treesitter/update.py $(nix-build -A vimPlugins.nvim-treesitter)`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/utils/update.py) to update the tree sitter grammars for `nvim-treesitter`.

doc/preface.chapter.md

@@ -1,50 +1,14 @@
-# Preface {#preface}
+# Overview {#preface}
 
-The Nix Packages collection (Nixpkgs) is a set of thousands of packages for the
-[Nix package manager](https://nixos.org/nix/), released under a
-[permissive MIT license](https://github.com/NixOS/nixpkgs/blob/master/COPYING).
-Packages are available for several platforms, and can be used with the Nix
-package manager on most GNU/Linux distributions as well as [NixOS](https://nixos.org/nixos).
+Nixpkgs is a set of packages for the [Nix package manager](https://nixos.org/nix/), released under the [MIT license](https://github.com/NixOS/nixpkgs/blob/master/COPYING).
 
-This document is the user [_reference_](https://nix.dev/contributing/documentation/diataxis#reference) manual for Nixpkgs.
-It describes the entire public interface of Nixpkgs in a concise and orderly manner, and all relevant behaviors, with examples and cross-references.
+Further documentation:
 
-To discover other kinds of documentation:
 - [nix.dev](https://nix.dev/): Tutorials and guides for getting things done with Nix
-- [NixOS **Option Search**](https://search.nixos.org/options) and reference documentation
-- [Nixpkgs **Package Search**](https://search.nixos.org/packages)
-- [**NixOS** manual](https://nixos.org/manual/nixos/stable/): Reference documentation for the NixOS Linux distribution
-- [`CONTRIBUTING.md`](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md): Contributing to Nixpkgs, including this manual
-
-## Overview of Nixpkgs {#overview-of-nixpkgs}
+- [NixOS Search](https://search.nixos.org)
+- [Contributing](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md): to Nixpkgs
 
 Nix expressions describe how to build packages from source and are collected in
-the [Nixpkgs repository](https://github.com/NixOS/nixpkgs). Also included in the
-collection are Nix expressions for
-[NixOS modules](https://nixos.org/nixos/manual/index.html#sec-writing-modules).
-With these expressions the Nix package manager can build binary packages.
+the [nixpkgs repository](https://github.com/NixOS/nixpkgs).
 
-Packages, including the Nix packages collection, are distributed through
-[channels](https://nixos.org/nix/manual/#sec-channels). The collection is
-distributed for users of Nix on non-NixOS distributions through the channel
-`nixpkgs-unstable`. Users of NixOS generally use one of the `nixos-*` channels,
-e.g., `nixos-22.11`, which includes all packages and modules for the stable NixOS
-22.11. Stable NixOS releases are generally only given
-security updates. More up-to-date packages and modules are available via the
-`nixos-unstable` channel.
-
-Both `nixos-unstable` and `nixpkgs-unstable` follow the `master` branch of the
-Nixpkgs repository, although both do lag the `master` branch by generally
-[a couple of days](https://status.nixos.org/). Updates to a channel are
-distributed as soon as all tests for that channel pass, e.g.,
-[this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
-shows the status of tests for the `nixpkgs-unstable` channel.
-
-The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
-which also builds binary packages from the Nix expressions in Nixpkgs for
-`x86_64-linux`, `aarch64-linux`, and `aarch64-darwin`.
-The binaries are made available via a [binary cache](https://cache.nixos.org).
-
-The current Nix expressions of the channels are available in the
-[Nixpkgs repository](https://github.com/NixOS/nixpkgs) in branches
-that correspond to the channel names (e.g., `nixos-22.11-small`).
+Packages are distributed through [channels](#how-channels-work).

doc/redirects.json

@@ -152,6 +152,9 @@
   "ghc-deprecation-policy": [
     "index.html#ghc-deprecation-policy"
   ],
+  "how-channels-work": [
+    "index.html#how-channels-work"
+  ],
   "inkscape-plugins": [
     "index.html#inkscape-plugins"
   ],
@@ -395,9 +398,7 @@
     "index.html#pnpm-build-hook-honored-variables"
   ],
   "preface": [
-    "index.html#preface"
-  ],
-  "overview-of-nixpkgs": [
+    "index.html#preface",
     "index.html#overview-of-nixpkgs"
   ],
   "part-using": [
@@ -2920,7 +2921,8 @@
   "setup-hook-mpi-check": [
     "index.html#setup-hook-mpi-check"
   ],
-  "setup-hook-omp-check": [
+  "setup-hook-check-phase-thread-limit": [
+    "index.html#setup-hook-check-phase-thread-limit",
     "index.html#setup-hook-omp-check"
   ],
   "ninja": [

doc/release-notes/rl-2611.section.md

@@ -31,6 +31,9 @@
   By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
   We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
 
+- `bundlerApp` now sets `__structuredAttrs = true` for its result package.
+  Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
+
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
@@ -42,13 +45,21 @@
 
 - `python3Packages.django-health-check` has been updated to major version 4. See its [migration guide](https://codingjoe.dev/django-health-check/migrate-to-v4/) and [changelog](https://github.com/codingjoe/django-health-check/releases/tag/4.0.0) for breaking changes.
 
+- `jmtpfs` has been removed due to lack of maintenance and fuse3 support.
+
 - `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.
 
+- `mcphost` has been removed, as it was archived upstream and declared unmaintained.
+
+- `fflogs` has been removed because it was no longer functional. Users should switch to `archon-lite`.
+
 - `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
   Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
 
 - `zerofs` has been updated from `1.x` to `2.x` which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.
 
+- `keycloak.plugins.keycloak-metrics-spi` has been removed. Keycloak exposes Prometheus metrics natively on its management interface; enable them with the `metrics-enabled` setting (and `event-metrics-user-enabled` for login and event counters). See [Gaining insights with metrics](https://www.keycloak.org/observability/configuration-metrics).
+
 - `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
 
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
@@ -90,6 +101,8 @@
 
 - `texlive.combine` is deprecated and scheduled for removal in 27.05. Please migrate to `texliveSmall.withPackages` (see [](#sec-language-texlive-user-guide)).
 
+- `keycloak` was updated to >= 26.7.0 and includes some breaking internal (API) changes. See the [upstream migration guide](https://www.keycloak.org/docs/latest/upgrading/#migrating-to-26-7-0) for more information.
+
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
 
 - `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.
@@ -106,6 +119,7 @@
 - Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
 - `nim1` and respective aliases have been removed due to entering EOL; please migrate to `nim` or `nim-unwrapped` (nim 2).
 - `nim-2_0` & `nim-2_2` and respective aliases have been removed; please migrate to `nim` or `nim-unwrapped` (nim 2.2.10).
+- `domoticz` has been updated from `2024.7` to `2026.x`, breaking third party applications and scripts using the old RType calls. Review the [release notes](https://github.com/domoticz/domoticz/blob/2026.2/History.txt#L398) for more information.
 
 - `vimacs` has been removed, as it has not been maintained in 10 years and was built for an old version of vim (6.0).
 
@@ -137,15 +151,15 @@
 
 ### Breaking changes {#sec-nixpkgs-release-26.11-lib-breaking}
 
-- Create the first release note entry in this section!
-
+- `fittrackee` 1.0.0 now requires postgres with postgis. The [upgrade guide](https://docs.fittrackee.org/en/upgrading-to-1.0.0.html) has steps to prepare for this upgrade.
 
 ### Deprecations {#sec-nixpkgs-release-26.11-lib-deprecations}
 
-- Create the first release note entry in this section!
+- Setting `config.allowBrokenPredicate` is deprecated in favor of
+  using `config.problems.handlers.PackageName.broken = "warn"` (or `=
+  "ignore"`). For more information see [](#sec-allow-broken).
 
 
 ### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}
 
 - Create the first release note entry in this section!
-

doc/style.css

@@ -23,14 +23,14 @@ body {
 @media screen and (min-width: 992px) {
   .book,
   .appendix {
-    max-width: 60rem;
+    max-width: 55rem;
   }
 }
 
 @media screen and (min-width: 1200px) {
   .book,
   .appendix {
-    max-width: 73rem;
+    max-width: 55rem;
   }
 }
 
@@ -156,8 +156,7 @@ body {
 }
 
 a {
-  text-decoration: none;
-  border-bottom: 1px solid;
+  text-decoration: underline;
   color: var(--link-color);
 }
 
@@ -398,6 +397,7 @@ div.appendix .variablelist .term {
 
 :root {
   --sidebar-width: 20rem;
+  --header-height: 3rem;
   --background: #fff;
   --main-text-color: #000;
   --link-color: #405d99;
@@ -479,6 +479,8 @@ div.appendix .variablelist .term {
 nav.toc-sidebar {
   height: 100%;
   padding: 0 1rem 2rem;
+  background-color: var(--background);
+  color: var(--main-text-color);
 }
 
 /* menu button, shown on mobile, hidden on desktop */
@@ -520,6 +522,59 @@ nav.toc-sidebar li {
 
 nav.toc-sidebar summary {
   cursor: pointer;
+  display: flex;
+  align-items: center;
+  list-style: none;
+}
+
+nav.toc-sidebar summary::before {
+  content: "▸";
+  flex: none;
+  font-size: 0.75em;
+}
+nav.toc-sidebar details[open] > summary::before {
+  content: "▾";
+}
+
+nav.toc-sidebar a {
+  display: block;
+  width: 100%;
+  padding: 3px 8px;
+  border-left: 3px solid transparent;
+  border-radius: 3px;
+  color: inherit;
+  transition:
+    background-color 120ms ease,
+    border-color 120ms ease;
+}
+nav.toc-sidebar a:hover {
+  background-color: #f2f2f2 !important;
+}
+
+nav.toc-sidebar a.active {
+  background-color: #d8d8d8;
+  border-left-color: #444;
+  font-weight: 600;
+}
+nav.toc-sidebar a.active-trail {
+  border-left-color: #bbb;
+  background-color: #e8e8e8;
+}
+
+@media (prefers-color-scheme: dark) {
+  nav.toc-sidebar a:hover {
+    /* hover should win over scroll selectors despite beeing less specific */
+    background-color: #606060 !important;
+  }
+  nav.toc-sidebar a.active {
+    background-color: #373737;
+    border-left-color: #eee;
+    font-weight: 600;
+  }
+  nav.toc-sidebar a.active-trail {
+    border-left-color: #eee;
+    background-color: #323232;
+  }
 }
 
 @media screen and (min-width: 768px) {
@@ -528,7 +583,7 @@ nav.toc-sidebar summary {
     min-height: 0;
     display: grid;
     grid-template-columns: minmax(0, 1fr);
-    grid-template-rows: auto minmax(0, 1fr);
+    grid-template-rows: var(--header-height) auto minmax(0, 1fr);
   }
 
   body:has(> nav.toc-sidebar) {
@@ -537,7 +592,7 @@ nav.toc-sidebar summary {
 
   .navheader {
     grid-column: 1 / -1;
-    grid-row: 1;
+    grid-row: 2;
   }
 
   nav.toc-sidebar {
@@ -548,11 +603,10 @@ nav.toc-sidebar summary {
     /*  */
     margin: 0;
     grid-column: 1;
-    grid-row: 2;
+    grid-row: 3;
     max-height: none;
     overflow-y: auto;
     border: none;
-    border-right: 0.0625rem solid #d8d8d8;
   }
 
   /* Hide the toggle button on desktop */
@@ -562,7 +616,7 @@ nav.toc-sidebar summary {
 
   main.content {
     grid-column: 1 / -1;
-    grid-row: 2;
+    grid-row: 3;
     overflow-y: auto;
     padding: 0 1rem;
   }
@@ -571,3 +625,73 @@ nav.toc-sidebar summary {
     grid-column: 2;
   }
 }
+
+.manual-header {
+  background-color: var(--background);
+  border-bottom: 0.0625rem solid #d8d8d8;
+  display: flex;
+  flex-direction: column;
+}
+
+.manual-header--title {
+  order: -1;
+  padding: 0.5rem 1rem 0;
+  font-size: 0.875rem;
+  font-weight: 500;
+  color: var(--small-heading-color);
+  text-align: center;
+}
+
+.manual-header--tabs {
+  display: flex;
+  align-items: stretch;
+  justify-content: space-around;
+  margin: 0;
+  padding: 0;
+}
+
+.manual-header--tab {
+  display: flex;
+  align-items: center;
+  padding: 0 1rem;
+  font-size: 0.875rem;
+  font-weight: 500;
+  color: var(--main-text-color);
+  text-decoration: none;
+  border-bottom: 0.1875rem solid transparent;
+  border-top: 0.1875rem solid transparent;
+  transition: border-bottom-color 0.15s ease;
+}
+
+.manual-header--tab:hover {
+  border-bottom-color: var(--heading-color);
+  color: var(--main-text-color);
+}
+
+.manual-header--tab-active {
+  border-bottom-color: var(--heading-color);
+  color: var(--heading-color);
+  font-weight: 700;
+}
+
+@media screen and (min-width: 768px) {
+  .manual-header {
+    height: var(--header-height);
+    flex-direction: row;
+    align-items: stretch;
+    grid-column: 1 / -1;
+    grid-row: 1;
+  }
+
+  .manual-header--title {
+    order: 0;
+    margin-left: auto;
+    padding: 0 1rem;
+    align-self: center;
+  }
+
+  .manual-header--tabs {
+    justify-content: flex-start;
+    padding: 0 1rem;
+  }
+}

doc/using-nixpkgs.md

@@ -1,6 +1,7 @@
 # Using Nixpkgs {#part-using}
 
 ```{=include=} chapters
+channels.chapter.md
 using/platform-support.chapter.md
 using/configuration.chapter.md
 using/overlays.chapter.md

doc/using/platform-support.chapter.md

@@ -1,16 +1,16 @@
 # Platform Support {#chap-platform-support}
 
-Packages receive varying degrees of support, both in terms of maintainer attention and available computation resources for continuous integration (CI). We have 7 defined tiers denoting how well supported each platform is.
+Packages receive varying degrees of support, both in terms of maintainer and security team attention and available computation resources for continuous integration (CI). We have 7 defined tiers denoting how well supported each platform is.
 
 ## Tiers {#sec-platform-tiers}
 
 ### Tier 1 {#sec-platform-tier1}
 
-[Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) platforms receive the highest level of support where problems can block updates, platform-specific patches are freely applied, and most packages are expected to work.
+[Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) platforms receive the highest level of support where problems can block updates, security fixes are treated with urgency, platform-specific patches are freely applied, and most packages are expected to work.
 
 ### Tier 2 {#sec-platform-tier2}
 
-[Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) platforms are expected to remain functional with updates, receive platform-specific patches as needed, and have many packages built by Hydra with full ofBorg support.
+[Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) platforms are expected to remain functional and secure with updates, receive platform-specific patches as needed, and have many packages built by Hydra with full ofBorg support.
 
 ### Tier 3 {#sec-platform-tier3}
 
@@ -22,25 +22,25 @@ Platform Tiers [4 through 7](https://github.com/NixOS/rfcs/blob/master/rfcs/0046
 
 ## Breakdown {#sec-platform-breakdown}
 
-| Triple                                | Support Tier | Channel Blockers | Hydra Support | Ofborg Support | Bootstrap Tarballs | Cross Compiling Support |
-| ------------------------------------- | ------------ | ---------------- | ------------- | -------------- | ------------------ | ----------------------- |
-| `x86_64-unknown-linux-gnu`            | [Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) | Many | ✔️            | ✔️            | ✔️                 | ✔️                      |
-| `aarch64-unknown-linux-gnu`           | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ✔️                      |
-| `x86_64-unknown-linux-musl`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
-| `aarch64-unknown-linux-musl`          | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
-| `x86_64-unknown-unknown-freebsd`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ❌                       |
-| `i686-unknown-linux-gnu`              | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
-| `riscv32-unknown-linux-gnu`           | [Tier 4](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-4) | None | ❌             | ❌             | ❌                  | ✔️                      |
-| `riscv64-unknown-linux-gnu`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `loongarch64-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `armv6l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `armv6l-unknown-linux-musleabihf`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `armv7l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `armv5tel-unknown-linux-gnueabi`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `mips64el-unknown-linux-gnuabi64`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `mips64el-unknown-linux-gnuabin32`    | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `mipsel-unknown-linux-gnu`            | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `powerpc64-unknown-linux-gnuabielfv2` | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `powerpc64le-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `s390x-unknown-linux-gnu`             | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| Triple                                | Support Tier                                                                                   | Channel Blockers | Hydra Support | Security Support | Ofborg Support | Bootstrap Tarballs | Cross Compiling Support |
+|---------------------------------------|------------------------------------------------------------------------------------------------|------------------|---------------|------------------|----------------|--------------------|-------------------------|
+| `x86_64-unknown-linux-gnu`            | [Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) | Many             | ✔️             | ✔️                | ✔️              | ✔️                  | ✔️                       |
+| `aarch64-unknown-linux-gnu`           | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some             | ✔️             | ✔️                | ✔️              | ✔️                  | ✔️                       |
+| `x86_64-unknown-linux-musl`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | Limited       | ❌               | ❌             | ✔️                  | ✔️                       |
+| `aarch64-unknown-linux-musl`          | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | Limited       | ❌               | ❌             | ✔️                  | ✔️                       |
+| `x86_64-unknown-unknown-freebsd`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some             | ✔️             | ✔️                | ✔️              | ✔️                  | ❌                      |
+| `i686-unknown-linux-gnu`              | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | Limited       | ❌               | ❌             | ✔️                  | ✔️                       |
+| `riscv32-unknown-linux-gnu`           | [Tier 4](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-4) | None             | ❌            | ❌               | ❌             | ❌                 | ✔️                       |
+| `riscv64-unknown-linux-gnu`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `loongarch64-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `armv6l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `armv6l-unknown-linux-musleabihf`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `armv7l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `armv5tel-unknown-linux-gnueabi`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `mips64el-unknown-linux-gnuabi64`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `mips64el-unknown-linux-gnuabin32`    | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `mipsel-unknown-linux-gnu`            | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `powerpc64-unknown-linux-gnuabielfv2` | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `powerpc64le-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `s390x-unknown-linux-gnu`             | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |

lib/attrsets.nix

@@ -1140,7 +1140,7 @@ rec {
 
     For a function that gives you control over what counts as a leaf, see `mapAttrsRecursiveCond`.
 
-    :::{#map-attrs-recursive-example .example}
+    ::: {.example #map-attrs-recursive-example}
     # Map over leaf attributes
 
     ```nix
@@ -1165,7 +1165,7 @@ rec {
     If the predicate returns false, `mapAttrsRecursiveCond` does not recurse, but instead applies the mapping function.
     If the predicate returns true, it does recurse, and does not apply the mapping function.
 
-    :::{#map-attrs-recursive-cond-example .example}
+    ::: {.example #map-attrs-recursive-cond-example}
     # Map over an leaf attributes defined by a condition
 
     Map derivations to their `name` attribute.

lib/customisation.nix

@@ -564,7 +564,7 @@ rec {
 
     # Examples
 
-    :::{#ex-makeScope .example}
+    :::{.example #ex-makeScope}
     # Create an interdependent package set on top of `pkgs`
 
     The functions in `foo.nix` and `bar.nix` can depend on each other, in the sense that `foo.nix` can contain a function that expects `bar` as an attribute in its argument.
@@ -593,7 +593,7 @@ rec {
     ```
     :::
 
-    :::{#ex-makeScope-callPackage .example}
+    :::{.example #ex-makeScope-callPackage}
     # Using `callPackage` from a scope
 
     ```nix

lib/licenses/licenses.nix

@@ -310,6 +310,11 @@ lib.mapAttrs mkLicense (
       redistributable = true;
     };
 
+    buddy = {
+      spdxId = "Buddy";
+      fullName = "Buddy License";
+    };
+
     bzip2 = {
       spdxId = "bzip2-1.0.6";
       fullName = "bzip2 and libbzip2 License v1.0.6";
@@ -382,6 +387,13 @@ lib.mapAttrs mkLicense (
       free = false;
     };
 
+    cc-by-nc-30-igo = {
+      # Currently does not have a spdxID will get one in the future https://github.com/spdx/license-list-XML/issues/2845
+      # spdxId = "CC-BY-NC-3.0-IGO";
+      fullName = "Creative Commons Attribution Non Commercial 3.0 IGO";
+      free = false;
+    };
+
     cc-by-nc-40 = {
       spdxId = "CC-BY-NC-4.0";
       fullName = "Creative Commons Attribution Non Commercial 4.0 International";
@@ -926,6 +938,11 @@ lib.mapAttrs mkLicense (
       free = false;
     };
 
+    jpl-image = {
+      fullName = "JPL Image Use Policy";
+      spdxId = "JPL-image";
+    };
+
     knuth = {
       fullName = "Knuth CTAN License";
       spdxId = "Knuth-CTAN";
@@ -1173,6 +1190,11 @@ lib.mapAttrs mkLicense (
       fullName = "Nethack General Public License";
     };
 
+    ngrep = {
+      spdxId = "ngrep";
+      fullName = "ngrep License";
+    };
+
     nistSoftware = {
       spdxId = "NIST-Software";
       fullName = "NIST Software License";
@@ -1606,6 +1628,11 @@ lib.mapAttrs mkLicense (
       url = "https://fedoraproject.org/wiki/Licensing:Wadalab?rd=Licensing/Wadalab";
     };
 
+    wordnet = {
+      spdxId = "WordNet";
+      fullName = "WordNet License";
+    };
+
     wtfpl = {
       spdxId = "WTFPL";
       fullName = "Do What The F*ck You Want To Public License";

lib/options.nix

@@ -90,12 +90,12 @@ rec {
       `defaultText`
       : Substitute for documenting the `default`, if evaluating the default value during documentation rendering is not possible.
       : Can be any nix value that evaluates.
-      : Usage with `lib.literalMD` or `lib.literalExpression` is supported
+      : Usage with `lib.literalMD`, `lib.literalExpression`, or `lib.literalCode` is supported
 
       `example`
       : Optional example value used in the manual.
       : Can be any nix value that evaluates.
-      : Usage with `lib.literalMD` or `lib.literalExpression` is supported
+      : Usage with `lib.literalMD`, `lib.literalExpression`, or `lib.literalCode` is supported
 
       `description`
       : Optional string describing the option. This is required if option documentation is generated.

maintainers/github-teams.json

@@ -151,6 +151,7 @@
       "samuela": 226872
     },
     "members": {
+      "ethancedwards8": 60861925,
       "prusnak": 42201
     },
     "name": "cuda-maintainers"
@@ -365,10 +366,10 @@
   "freedesktop": {
     "description": "Maintain Freedesktop.org packages for graphical desktop.",
     "id": 3806136,
-    "maintainers": {},
-    "members": {
+    "maintainers": {
       "jtojnar": 705123
     },
+    "members": {},
     "name": "Freedesktop"
   },
   "geospatial": {

maintainers/maintainer-list.nix

@@ -1289,6 +1289,12 @@
     name = "Alexandru Tocar";
     keys = [ { fingerprint = "B617 DD24 3AB0 2E3F 2E67  DBFD 1305 2A85 D7A4 2AA4"; } ];
   };
+  AlexAntonik = {
+    email = "antonikavv@gmail.com";
+    github = "AlexAntonik";
+    githubId = 55547934;
+    name = "Alex Antonik";
+  };
   alexarice = {
     email = "alexrice999@hotmail.co.uk";
     github = "alexarice";
@@ -1489,6 +1495,12 @@
     githubId = 60479013;
     name = "Alma Cemerlic";
   };
+  aln730 = {
+    email = "arnsg730@proton.me";
+    github = "aln730";
+    githubId = 94751172;
+    name = "AGawas";
+  };
   Alper-Celik = {
     email = "alper@alper-celik.dev";
     name = "Alper Çelik";
@@ -1586,6 +1598,12 @@
     githubId = 153175;
     name = "Andrew Marshall";
   };
+  ambiso = {
+    email = "ambisotopy@gmail.com";
+    github = "ambiso";
+    githubId = 3750466;
+    name = "Robin Leander Schröder";
+  };
   ambossmann = {
     email = "timogottszky+git@gmail.com";
     github = "Ambossmann";
@@ -1629,12 +1647,6 @@
     githubId = 382798;
     name = "amfl";
   };
-  amiddelk = {
-    email = "amiddelk@gmail.com";
-    github = "amiddelk";
-    githubId = 1358320;
-    name = "Arie Middelkoop";
-  };
   aminechikhaoui = {
     email = "amine.chikhaoui91@gmail.com";
     github = "AmineChikhaoui";
@@ -1943,6 +1955,17 @@
     githubId = 143312793;
     name = "Annin";
   };
+  anntnzrb = {
+    github = "anntnzrb";
+    githubId = 51257127;
+    name = "anntnzrb";
+  };
+  anntoin = {
+    email = "anntoin@gmail.com";
+    github = "Anntoin";
+    githubId = 3289027;
+    name = "Anntóin Wilkinson";
+  };
   anoa = {
     matrix = "@andrewm:amorgan.xyz";
     email = "andrew@amorgan.xyz";
@@ -2002,6 +2025,12 @@
     githubId = 14838767;
     name = "Jacopo Scannella";
   };
+  antoineco = {
+    email = "hello@acotten.com";
+    github = "antoineco";
+    githubId = 3299086;
+    name = "Antoine Cotten";
+  };
   anton-4 = {
     name = "Anton";
     github = "Anton-4";
@@ -4427,6 +4456,12 @@
       { fingerprint = "8916 F727 734E 77AB 437F  A33A 19AB 76F5 CEE1 1392"; }
     ];
   };
+  caguiclajmg = {
+    email = "jmg.caguicla@guarandoo.me";
+    github = "caguiclajmg";
+    githubId = 32662060;
+    name = "John Mark Gabriel Caguicla";
+  };
   CaiqueFigueiredo = {
     email = "public@caiquefigueiredo.me";
     github = "caiquefigueiredo";
@@ -4640,6 +4675,13 @@
     githubId = 53847249;
     name = "Casey Avila";
   };
+  cassandracomar = {
+    name = "Cassandra Comar";
+    github = "cassandracomar";
+    githubId = 320772;
+    email = "cass@mountclare.net";
+    keys = [ { fingerprint = "104E E74E 24A0 372B EAF5  5533 B019 18F7 7E04 AC99"; } ];
+  };
   castorNova2 = {
     email = "solemnsquire@gmail.com";
     github = "castorNova2";
@@ -4719,12 +4761,6 @@
     githubId = 52760912;
     name = "Cameron Brown";
   };
-  ccellado = {
-    email = "annplague@gmail.com";
-    github = "ccellado";
-    githubId = 44584960;
-    name = "Denis Khalmatov";
-  };
   ccicnce113424 = {
     email = "ccicnce113424@gmail.com";
     matrix = "@ccicnce113424:matrix.org";
@@ -5208,6 +5244,12 @@
     githubId = 1448923;
     name = "Christian Kauhaus";
   };
+  ckgxrg = {
+    email = "ckgxrg@ckgxrg.io";
+    github = "ckgxrg-salt";
+    githubId = 165614491;
+    name = "ckgxrg";
+  };
   cko = {
     email = "christine.koppelt@gmail.com";
     github = "cko";
@@ -5595,6 +5637,11 @@
     githubId = 5953003;
     name = "Connor Nelson";
   };
+  conny = {
+    github = "ConstantConstantin";
+    githubId = 162139822;
+    name = "Constantin-Paul Hertel";
+  };
   conradmearns = {
     email = "conradmearns+github@pm.me";
     github = "ConradMearns";
@@ -6240,6 +6287,12 @@
     github = "darkyzhou";
     githubId = 7220778;
   };
+  darshancode2005 = {
+    name = "Darshan Thakare";
+    email = "darshanthakaregsoc2023@gmail.com";
+    github = "DarshanCode2005";
+    githubId = 143271270;
+  };
   daru-san = {
     name = "Daru";
     email = "zadarumaka@proton.me";
@@ -6345,6 +6398,12 @@
     github = "David-Kopczynski";
     githubId = 53194670;
   };
+  David-Moody = {
+    name = "David Moody";
+    email = "david.moody@scot.me.uk";
+    github = "David-Moody";
+    githubId = 63956662;
+  };
   david-sawatzke = {
     email = "d-nix@sawatzke.dev";
     github = "david-sawatzke";
@@ -6779,6 +6838,13 @@
     githubId = 77843198;
     name = "Vasilis Manetas";
   };
+  Deric-W = {
+    email = "robo-eric@gmx.de";
+    github = "Deric-W";
+    githubId = 42873573;
+    name = "Eric Wolf";
+    keys = [ { fingerprint = "ADAA B6F3 A955 5589 D66C  CE61 80D2 DA42 8A4A 537F"; } ];
+  };
   DerickEddington = {
     email = "derick.eddington@pm.me";
     github = "DerickEddington";
@@ -7036,12 +7102,6 @@
     github = "DimitarNestorov";
     githubId = 8790386;
   };
-  diniamo = {
-    name = "diniamo";
-    email = "diniamo53@gmail.com";
-    github = "diniamo";
-    githubId = 55629891;
-  };
   diogomdp = {
     email = "me@diogodp.dev";
     github = "diogomdp";
@@ -8847,6 +8907,13 @@
     githubId = 345808;
     name = "Jakub Okoński";
   };
+  FatBoyXPC = {
+    name = "FatBoyXPC";
+    email = "fatboyxpc@gmail.com";
+    github = "FatBoyXPC";
+    githubId = 744962;
+    keys = [ { fingerprint = "0E08 1B81 CBCA 1CF7 9568  A13F C4ED 3CA2 3211 8969"; } ];
+  };
   faukah = {
     github = "faukah";
     name = "faukah";
@@ -9027,6 +9094,11 @@
     githubId = 5198058;
     name = "Udo Sauer";
   };
+  fernvenue = {
+    github = "fernvenue";
+    githubId = 84565547;
+    name = "fernvenue";
+  };
   feyorsh = {
     email = "george@feyor.sh";
     github = "Feyorsh";
@@ -9083,6 +9155,12 @@
     githubId = 41450706;
     name = "fin-w";
   };
+  fiona = {
+    email = "mail@fiona.hamburg";
+    github = "Fiona42069";
+    githubId = 260108682;
+    name = "fiona";
+  };
   fionera = {
     email = "nix@fionera.de";
     github = "fionera";
@@ -10024,12 +10102,6 @@
     name = "Will Owens";
     keys = [ { fingerprint = "8E98 BB01 BFF8 AEA4 E303  FC4C 8074 09C9 2CE2 3033"; } ];
   };
-  ghuntley = {
-    email = "ghuntley@ghuntley.com";
-    github = "ghuntley";
-    githubId = 127353;
-    name = "Geoffrey Huntley";
-  };
   gibbert = {
     email = "gbjgms@gmail.com";
     github = "zgibberish";
@@ -10392,6 +10464,12 @@
     githubId = 273582;
     name = "greg";
   };
+  gregshuflin = {
+    email = "greg@everdayimshuflin.com";
+    github = "neunenak";
+    githubId = 311545;
+    name = "Greg Shuflin";
+  };
   greizgh = {
     email = "greizgh@ephax.org";
     github = "greizgh";
@@ -11451,6 +11529,18 @@
     githubId = 69209;
     name = "Ian Duncan";
   };
+  IanHollow = {
+    github = "IanHollow";
+    githubId = 72767437;
+    name = "Ian Holloway";
+  };
+  iank = {
+    email = "iank@iank.org";
+    github = "iank";
+    githubId = 109598;
+    name = "Ian Kilgore";
+    keys = [ { fingerprint = "21F7 244E 095F 619E 8E3E  1EB4 9F3A 4AAB 4D90 D879"; } ];
+  };
   ianliu = {
     email = "ian.liu88@gmail.com";
     github = "ianliu";
@@ -11861,12 +11951,6 @@
     name = "Silvan Mosberger";
     keys = [ { fingerprint = "6C2B 55D4 4E04 8266 6B7D  DA1A 422E 9EDA E015 7170"; } ];
   };
-  iniw = {
-    email = "git@vini.cat";
-    github = "iniw";
-    githubId = 30220881;
-    name = "Vinicius Deolindo";
-  };
   insipx = {
     email = "github@andrewplaza.dev";
     github = "insipx";
@@ -11910,6 +11994,12 @@
     githubId = 16307070;
     name = "iosmanthus";
   };
+  ipetkov = {
+    name = "Ivan Petkov";
+    github = "ipetkov";
+    githubId = 1638690;
+    email = "nixpkgs@ipetkov.dev";
+  };
   ipsavitsky = {
     email = "ipsavitsky234@gmail.com";
     github = "ipsavitsky";
@@ -12478,6 +12568,12 @@
     github = "JaviMerino";
     githubId = 44926;
   };
+  jayadeep-km-sonarsource = {
+    email = "jayadeep.kinavoormadam@sonarsource.com";
+    name = "Jayadeep Kinavoor Madam";
+    github = "jayadeep-km-sonarsource";
+    githubId = 156662663;
+  };
   jayesh-bhoot = {
     name = "Jayesh Bhoot";
     email = "jb@jayeshbhoot.com";
@@ -12751,6 +12847,12 @@
     githubId = 5741620;
     name = "Jeremy Schlatter";
   };
+  jeremystucki = {
+    email = "dev@jeremystucki.ch";
+    github = "jeremystucki";
+    githubId = 7629727;
+    name = "Jeremy Stucki";
+  };
   jerith666 = {
     email = "github@matt.mchenryfamily.org";
     github = "jerith666";
@@ -13170,12 +13272,6 @@
     githubId = 879272;
     name = "Julio Merino";
   };
-  jn-sena = {
-    email = "jn-sena@proton.me";
-    github = "jn-sena";
-    githubId = 45771313;
-    name = "Sena";
-  };
   jnsgruk = {
     email = "jon@sgrs.uk";
     github = "jnsgruk";
@@ -14102,6 +14198,14 @@
     name = "Kenichi Kamiya";
     keys = [ { fingerprint = "9121 5D87 20CA B405 C63F  24D2 EF6E 574D 040A E2A5"; } ];
   };
+  kacper-uminski = {
+    name = "Kacper Uminski";
+    email = "kacper+nixpkgs@lysator.liu.se";
+    github = "kacper-uminski";
+    githubId = 57466578;
+    matrix = "@kacper.uminski:matrix.org";
+    keys = [ { fingerprint = "3DF9 3DEB CAA9 81FA B3E2  A7F0 87DA 201D E02F 14B1"; } ];
+  };
   kaction = {
     name = "Dmitry Bogatov";
     email = "KAction@disroot.org";
@@ -14341,6 +14445,12 @@
     github = "keller00";
     githubId = 8452750;
   };
+  kenis1108 = {
+    email = "1836362346@qq.com";
+    github = "kenis1108";
+    githubId = 45393183;
+    name = "kenis";
+  };
   kenran = {
     email = "johannes.maier@mailbox.org";
     github = "kenranunderscore";
@@ -16363,6 +16473,11 @@
     githubId = 83420438;
     name = "Lewis";
   };
+  lubsch = {
+    github = "lubsch";
+    githubId = 33580245;
+    name = "Benjamin Lohmar";
+  };
   luc65r = {
     email = "lucas@ransan.fr";
     github = "luc65r";
@@ -16575,12 +16690,6 @@
     githubId = 10746692;
     name = "Leopold Luley";
   };
-  lumi = {
-    email = "lumi@pew.im";
-    github = "lumi-me-not";
-    githubId = 26020062;
-    name = "lumi";
-  };
   luminarleaf = {
     github = "LuminarLeaf";
     githubId = 80571430;
@@ -18814,6 +18923,12 @@
     githubId = 830082;
     name = "Nathan Moos";
   };
+  mootfrost = {
+    email = "hello@mootfrost.dev";
+    github = "mootfrost";
+    githubId = 75925945;
+    name = "Andrew Semeykin";
+  };
   moraxyc = {
     name = "Moraxyc Xu";
     email = "i@qaq.li";
@@ -20084,6 +20199,12 @@
     github = "nigelgbanks";
     githubId = 487373;
   };
+  nightconcept = {
+    email = "dark@nightconcept.net";
+    github = "nightconcept";
+    githubId = 486025;
+    name = "Danny Solivan";
+  };
   nikhilmaddirala = {
     name = "Nikhil Maddirala";
     github = "nikhilmaddirala";
@@ -20309,6 +20430,12 @@
     githubId = 4242897;
     name = "Nikolai Mishin";
   };
+  nmoya = {
+    email = "nikolasmoya@gmail.com";
+    github = "nmoya";
+    githubId = 1767648;
+    name = "Nikolas Moya";
+  };
   noaccos = {
     name = "Francesco Noacco";
     email = "francesco.noacco2000@gmail.com";
@@ -20667,8 +20794,9 @@
     github = "numinit";
     githubId = 369111;
     keys = [
-      # SSH
+      # SSH, per-machine yubikey ecdsa-sk keys
       { fingerprint = "XX/0lMz82MpucPqf0KG+5EJoozzNRi8i/t59byD2kNo"; }
+      { fingerprint = "dye2C1N4RQaf+8ht5Ipd52BbnnuwBtdXxocPzk8b2mw"; }
       # GPG, >=2025, stays in one place
       { fingerprint = "FD28 F9C9 81C5 D78E 56E8  8311 5C3E B94D 198F 1491"; }
       # GPG, >=2025, travels with me
@@ -21146,12 +21274,6 @@
     githubId = 19862;
     name = "KJ Ørbekk";
   };
-  orbitz = {
-    email = "mmatalka@gmail.com";
-    github = "orbitz";
-    githubId = 75299;
-    name = "Malcolm Matalka";
-  };
   orhun = {
     email = "orhunparmaksiz@gmail.com";
     github = "orhun";
@@ -21970,6 +22092,12 @@
     githubId = 421510;
     name = "Noé Rubinstein";
   };
+  phluxjr = {
+    email = "phluxjr@phluxjr.net";
+    github = "phluxjr";
+    githubId = 185956030;
+    name = "phluxjr";
+  };
   pho = {
     email = "phofin@gmail.com";
     github = "pho";
@@ -24349,6 +24477,12 @@
     githubId = 20300874;
     name = "Mohammad Rafiq";
   };
+  rsahwe = {
+    email = "rsahwe@gmx.net";
+    github = "rsahwe";
+    githubId = 201613730;
+    name = "rsahwe";
+  };
   rseichter = {
     email = "nixos.org@seichter.de";
     github = "rseichter";
@@ -25608,12 +25742,6 @@
     githubId = 106669955;
     name = "Léon Gessner";
   };
-  shardy = {
-    email = "shardul@baral.ca";
-    github = "shardulbee";
-    githubId = 16765155;
-    name = "Shardul Baral";
-  };
   sharpchen = {
     github = "sharpchen";
     githubId = 77432836;
@@ -25913,6 +26041,12 @@
     name = "Nikolay Korotkiy";
     keys = [ { fingerprint = "ADF4 C13D 0E36 1240 BD01  9B51 D1DE 6D7F 6936 63A5"; } ];
   };
+  silicalet = {
+    name = "Mr. why";
+    email = "silicalet@outlook.com";
+    github = "silicalet";
+    githubId = 188071249;
+  };
   silky = {
     name = "Noon van der Silk";
     email = "noonsilk+nixpkgs@gmail.com";
@@ -26383,6 +26517,14 @@
     githubId = 7116239;
     keys = [ { fingerprint = "E067 520F 5EF2 C175 3F60  50C0 BA46 725F 6A26 7442"; } ];
   };
+  Soliprem = {
+    email = "me@soliprem.eu";
+    matrix = "@soliprem:soliprem.eu";
+    name = "Francesco Prem Solidoro";
+    github = "Soliprem";
+    githubId = 73885403;
+    keys = [ { fingerprint = "F779 4E05 D8BB A608 73D0  1312 4FD6 B0D5 1C9A B6BD"; } ];
+  };
   solson = {
     email = "scott@solson.me";
     matrix = "@solson:matrix.org";
@@ -26575,12 +26717,6 @@
     github = "spreetin";
     githubId = 7392173;
   };
-  sprock = {
-    email = "rmason@mun.ca";
-    github = "sprock";
-    githubId = 6391601;
-    name = "Roger Mason";
-  };
   sputn1ck = {
     email = "kon@kon.ninja";
     github = "sputn1ck";
@@ -27155,6 +27291,13 @@
     githubId = 36695359;
     name = "Vasyl Solovei";
   };
+  swaggeroo = {
+    email = "swaggerooo@pm.me";
+    github = "swaggeroo";
+    githubId = 57057662;
+    name = "Swaggeroo";
+    keys = [ { fingerprint = "D221 99EC 4FFF EF4D F29D  2435 5208 74E7 3291 4E0B"; } ];
+  };
   swarren83 = {
     email = "shawn.w.warren@gmail.com";
     github = "swarren83";
@@ -29652,12 +29795,6 @@
     githubId = 20145996;
     name = "Victor Fuentes";
   };
-  vlstill = {
-    email = "xstill@fi.muni.cz";
-    github = "vlstill";
-    githubId = 4070422;
-    name = "Vladimír Štill";
-  };
   vmandela = {
     email = "venkat.mandela@gmail.com";
     github = "vmandela";
@@ -30243,6 +30380,12 @@
     githubId = 22803888;
     name = "Lu Hongxu";
   };
+  wini = {
+    email = "dev@vini.cat";
+    github = "iniw";
+    githubId = 30220881;
+    name = "Vinicius Deolindo";
+  };
   winpat = {
     email = "patrickwinter@posteo.ch";
     github = "winpat";
@@ -31013,6 +31156,13 @@
       { fingerprint = "D2A8 A906 ACA7 B6D6 575E 9A2F 3A49 5054 6EA6 9E5C"; }
     ];
   };
+  yoquec = {
+    email = "alvaro.viejo@yoquec.com";
+    github = "yoquec";
+    githubId = 59575696;
+    name = "Alvaro Viejo";
+    matrix = "@yoquec.com:matrix.org";
+  };
   yorickvp = {
     email = "yorickvanpelt@gmail.com";
     matrix = "@yorickvp:matrix.org";

maintainers/scripts/luarocks-packages.csv

@@ -6,12 +6,13 @@ basexx,,,,,,
 bcrypt,,,,,,ulysseszhan
 binaryheap,,,,,,vcunat
 bit32,,,,,5.1,lblasc
-busted,,,,,,
+busted,,,,,,alerque
 busted-htest,,,,,,mrcjkb
+canola.nvim,,,,,,saadndm
 cassowary,,,,,,alerque
 cldr,,,,,,alerque
 commons.nvim,,,,,5.1,mrcjkb
-compat53,,,,,,vcunat
+compat53,,,,,,vcunat alerque
 coop.nvim,,,,,,
 cosmo,,,,,,
 coxpcall,,,,1.17.0-1,,
@@ -37,7 +38,7 @@ inspect,,,,,,
 jsregexp,,,,0.0.7-2,,
 kulala.nvim,,,,,,
 ldbus,,,https://luarocks.org/dev,,,
-ldoc,,,,,,
+ldoc,,,,,,alerque
 lgi,,,,,,
 linenoise,https://raw.githubusercontent.com/hoelzro/lua-linenoise/master/linenoise-0.9-1.rockspec,,,,,
 ljsyscall,,,,,5.1,lblasc
@@ -61,7 +62,7 @@ lua-cjson,,,,,,
 lua-cmsgpack,,,,,,
 lua-curl,,,,,,
 lua-ffi-zlib,,,,,,
-lua-iconv,,,,7.0.0,,
+lua-iconv,,,,7.0.0,,alerque
 lua-lsp,,,,,,
 lua-messagepack,,,,,,
 lua-protobuf,,,,,,lockejan
@@ -77,10 +78,10 @@ lua-toml,,,,,,
 lua-utils.nvim,,,,,,mrcjkb
 lua-yajl,,,,,,pstn
 lua-zlib,,,,,,koral
-lua_cliargs,,,,,,
+lua_cliargs,,,,,,alerque
 luabitop,https://raw.githubusercontent.com/teto/luabitop/master/luabitop-1.0.2-3.rockspec,,,,,
-luacheck,,,,,,
-luacov,,,,,,
+luacheck,,,,,,alerque
+luacov,,,,,,alerque
 luacov-reporter-lcov,,,,,,ulysseszhan
 luadbi,,,,,,
 luadbi-mysql,,,,,,
@@ -90,7 +91,7 @@ luaepnf,,,,,,
 luaevent,,,,,,
 luaexpat,,,,,,arobyn flosse
 luaffi,,,https://luarocks.org/dev,,,
-luafilesystem,,,,,,flosse
+luafilesystem,,,,,,flosse alerque
 lualdap,,,,,,aanderse
 lualine.nvim,,,https://luarocks.org/dev,,,
 lualogging,,,,,,
@@ -103,12 +104,12 @@ luarocks-build-rust-mlua,,,,,,mrcjkb
 luarocks-build-tree-sitter-cli,,,,,,
 luarocks-build-treesitter-parser,,,,,,mrcjkb
 luarocks-build-treesitter-parser-cpp,,,,,,mrcjkb
-luasec,,,,,,flosse
+luasec,,,,,,flosse alerque
 luasnip,,,,,,
-luasocket,,,,,,
+luasocket,,,,,,alerque
 luasql-sqlite3,,,,,,
-luassert,,,,,,
-luasystem,,,,,,
+luassert,,,,,,alerque
+luasystem,,,,,,alerque
 luatext,,,,,,
 luaunbound,,,,,,
 luaunit,,,,,,lockejan
@@ -158,7 +159,7 @@ rocks-git.nvim,,,,,5.1,mrcjkb
 rocks.nvim,,,,,5.1,mrcjkb
 rtp.nvim,,,,,5.1,mrcjkb
 rustaceanvim,,,,,5.1,mrcjkb
-say,,,,,,
+say,,,,,,alerque
 serpent,,,,,,lockejan
 sofa,,,,,,f4z3r
 sqlite,,,,,,

maintainers/scripts/update.py

@@ -307,7 +307,7 @@ async def commit_changes(
             commit_message = "{attrPath}: {oldVersion} -> {newVersion}".format(**change)
             if "commitMessage" in change:
                 commit_message = change["commitMessage"]
-            elif "commitBody" in change:
+            if "commitBody" in change:
                 commit_message = commit_message + "\n\n" + change["commitBody"]
             await check_subprocess_output(
                 "git",

maintainers/team-list.nix

@@ -717,6 +717,15 @@ with lib.maintainers;
     github = "security-review";
   };
 
+  stardust-xr = {
+    members = [
+      pandapip1
+      technobaboo
+    ];
+    scope = "Maintain Stardust XR packages";
+    shortName = "StardustXR";
+  };
+
   stdenv = {
     enableFeatureFreezePing = true;
     github = "stdenv";

nixos/doc/manual/configuration/file-systems.chapter.md

@@ -41,5 +41,6 @@ and non-critical by adding `options = [ "nofail" ];`.
 ```{=include=} sections
 luks-file-systems.section.md
 sshfs-file-systems.section.md
+nfs-file-systems.section.md
 overlayfs.section.md
 ```

nixos/doc/manual/configuration/nfs-file-systems.section.md

@@ -0,0 +1,52 @@
+# NFS File Systems {#sec-nfs-file-systems}
+
+[NFS][nfs] (Network File System) allows you to mount directories from remote machines over the network.
+
+[nfs]: https://en.wikipedia.org/wiki/Network_File_System
+[nfs-man]: https://man7.org/linux/man-pages/man5/nfs.5.html
+
+To mount NFS filesystems persistently, use the `fileSystems` option:
+
+```nix
+{
+  fileSystems."/mnt/data" = {
+    device = "server.example.com:/export/data";
+    fsType = "nfs";
+  };
+}
+```
+
+## Automounting {#sec-nfs-automount}
+
+To have NFS filesystems mounted on-demand instead of at boot, add the `noauto` and `x-systemd.automount` options:
+
+```nix
+{
+  fileSystems."/mnt/data" = {
+    device = "server.example.com:/export/data";
+    fsType = "nfs";
+    options = [
+      "noauto"
+      "x-systemd.automount"
+    ];
+  };
+}
+```
+
+## Ad-hoc Mounting {#sec-nfs-adhoc}
+
+To mount NFS filesystems ad-hoc using the `mount` command, enable NFS and required RPC services:
+
+```nix
+{
+  boot.supportedFilesystems = [ "nfs" ];
+}
+```
+
+Then you can mount filesystems manually:
+
+```shell
+$ sudo mount -t nfs server.example.com:/export/data /mnt/data
+```
+
+For more information on NFS mount options, see the [nfs(5) man page][nfs-man].

nixos/doc/manual/default.nix

@@ -202,6 +202,8 @@ rec {
           --script ./anchor.min.js \
           --script ./anchor-use.js \
           --sidebar-depth 2 \
+          --header ${./header.html}\
+          --no-navheader \
           ./manual.md \
           $dst/${common.indexPath}
 

nixos/doc/manual/header.html

@@ -0,0 +1,7 @@
+<div class="manual-header">
+    <nav class="manual-header--tabs">
+        <a class="manual-header--tab" href="https://nixos.org/manual/nixos/stable/">Nixpkgs</a>
+        <a class="manual-header--tab manual-header--tab-active" href="#">NixOS</a>
+    </nav>
+    <span class="manual-header--title">Nixos Manual</span>
+</div>

nixos/doc/manual/installation/installing-from-other-distro.section.md

@@ -47,7 +47,7 @@ The first steps to all these are the same:
 
     Where `<version>` corresponds to the latest version available on [channels.nixos.org](https://channels.nixos.org/).
 
-    You may want to throw in a `nix-channel --update` for good measure.
+    You must run `$ nix-channel --update` for the channel change to take effect.
 
 1.  Install the NixOS installation tools:
 

nixos/doc/manual/redirects.json

@@ -619,6 +619,15 @@
   "sec-luks-file-systems-fido2-systemd": [
     "index.html#sec-luks-file-systems-fido2-systemd"
   ],
+  "sec-nfs-file-systems": [
+    "index.html#sec-nfs-file-systems"
+  ],
+  "sec-nfs-automount": [
+    "index.html#sec-nfs-automount"
+  ],
+  "sec-nfs-adhoc": [
+    "index.html#sec-nfs-adhoc"
+  ],
   "sec-sshfs-file-systems": [
     "index.html#sec-sshfs-file-systems"
   ],
@@ -1891,6 +1900,9 @@
   "sec-kubernetes": [
     "index.html#sec-kubernetes"
   ],
+  "module-services-nordvpn": [
+    "index.html#module-services-nordvpn"
+  ],
   "ch-running": [
     "index.html#ch-running"
   ],
@@ -2294,6 +2306,9 @@
   "test-opt-meta.hydraPlatforms": [
     "index.html#test-opt-meta.hydraPlatforms"
   ],
+  "test-opt-meta.teams": [
+    "index.html#test-opt-meta.teams"
+  ],
   "test-opt-meta.timeout": [
     "index.html#test-opt-meta.timeout"
   ],

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -110,6 +110,8 @@
 
 - [clevis-luks-askpass](https://github.com/latchset/clevis), automatic LUKS unlocking in initrd using clevis token bindings stored in LUKS headers. Available as [boot.initrd.clevisLuksAskpass](#opt-boot.initrd.clevisLuksAskpass.enable).
 
+- [passless](https://github.com/pando85/passless), a daemon for using Webauthn Passkeys backed by password-store.
+
 - [bentopdf](https://github.com/alam00000/bentopdf), a privacy-first PDF toolkit running completely in-browser. Available as [services.bentopdf](#opt-services.bentopdf.enable).
 
 - [hyprwhspr-rs](https://github.com/better-slop/hyprwhspr-rs), a keybind activated speech-to-text voice dictation utility built for use with Hyprland. Available as [services.hyprwhspr-rs](#opt-services.hyprwhspr-rs.enable).

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -32,6 +32,8 @@
 
 - [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable).
 
+- [Watt](https://github.com/NotAShelf/watt), a CPU frequency and power management daemon for Linux. Available as [services.watt](#opt-services.watt.enable).
+
 - [mail-tlsa-check-exporter](https://github.com/ietf-tools/mail-tlsa-check-exporter), validates SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter. Available as [services.prometheus.exporters.mail-tlsa-check](#opt-services.prometheus.exporters.mail-tlsa-check.enable).
 
 - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.
@@ -54,6 +56,8 @@
 
 - [OO7](https://github.com/linux-credentials/oo7) is a desktop-agnostic Secret Service provider. Available as [services.oo7](#opt-services.oo7.enable)
 
+- [NordVPN](https://github.com/NordSecurity/nordvpn-linux), a NordVPN client for linux. Available as [services.nordvpn](options.html#opt-services.nordvpn.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -95,6 +99,8 @@
 
 - `services.plantuml-server.packages.jetty` now supports `jetty_12`, it no longer supports `jetty_11`.
 
+- `services.komodo-periphery` has been updated to support version 2.0.0. Some options have been renamed to match the new configuration structure; compatibility aliases are provided for the renamed options. The `passkeys` and `outbound.onboardingKey` options have been removed; use `passkeyFiles`, `auth.privateKey`/`auth.corePublicKeys`, or `outbound.onboardingKeyFile` instead. New outbound mode configuration is available under `outbound.*`.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -138,6 +144,8 @@
 
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
 
+- The `authelia` module now uses systemd's `LoadCredential` to load all files defined in `secrets`. As such, these files no longer need to be readable by the authelia user and group: they can for example be set to be only readable by the root user.
+
 - `zoneminder` has been updated to 1.38.x release. See [upstream release note](https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.0). While database migration should happen automatically, it's recommended that you make a backup of the database before upgrading your system.
 
 - The latest available version of Nextcloud is v34 (available as `pkgs.nextcloud34`). The installation logic is as follows:
@@ -146,3 +154,5 @@
   - If [`system.stateVersion`](#opt-system.stateVersion) is >=26.05, `pkgs.nextcloud33` will be installed by default.
   - If [`system.stateVersion`](#opt-system.stateVersion) is >=25.11, `pkgs.nextcloud32` will be installed by default.
   - Please note that Nextcloud prohibits skipping major versions while upgrading. You can upgrade to specific versions by declaring `services.nextcloud.package = pkgs.nextcloud33;`.
+
+- `trilium-desktop` and `trilium-server` have been updated to 0.104.0. This release includes security hardening fixes that may break functionality. [See upstream release note for details](https://github.com/TriliumNext/Trilium/releases/tag/v0.104.0).

nixos/lib/systemd-unit-options.nix

@@ -625,7 +625,7 @@ rec {
 
       listenStreams = mkOption {
         default = [ ];
-        type = types.listOf types.str;
+        type = types.listOf (types.coercedTo types.port toString types.str);
         example = [
           "0.0.0.0:993"
           "/run/my-socket"

nixos/lib/testing/meta.nix

@@ -1,6 +1,20 @@
-{ lib, ... }:
+{ lib, options, ... }:
 let
   inherit (lib) types mkOption literalMD;
+
+  # Approximate position of meta.teams / meta.maintainers in nixos tests.
+  # Right now this assumes only one such position and ignores other definitions.
+  # FIXME allow having multiple `maintainersPosition` et al..
+  getPosition =
+    definitionsWithLocations:
+    if definitionsWithLocations == [ ] then
+      null
+    else
+      {
+        file = (lib.head definitionsWithLocations).file;
+        column = 0;
+        line = 1;
+      };
 in
 {
   options = {
@@ -12,7 +26,7 @@ in
       '';
       apply = lib.filterAttrs (k: v: v != null);
       type = types.submodule (
-        { config, ... }:
+        { options, config, ... }:
         {
           options = {
             maintainers = mkOption {
@@ -22,6 +36,25 @@ in
                 The [list of maintainers](https://nixos.org/manual/nixpkgs/stable/#var-meta-maintainers) for this test.
               '';
             };
+            maintainersPosition = mkOption {
+              internal = true;
+              readOnly = true;
+              type = types.nullOr types.attrs;
+              default = getPosition options.maintainers.definitionsWithLocations;
+            };
+            teams = mkOption {
+              type = types.listOf types.raw;
+              default = [ ];
+              description = ''
+                The [list of maintainer-teams](https://nixos.org/manual/nixpkgs/stable/#var-meta-teams) for this test.
+              '';
+            };
+            teamsPosition = mkOption {
+              internal = true;
+              readOnly = true;
+              type = types.nullOr types.attrs;
+              default = getPosition options.teams.definitionsWithLocations;
+            };
             timeout = mkOption {
               type = types.nullOr types.int;
               default = 3600; # 1 hour

nixos/modules/hardware/opentabletdriver.nix

@@ -61,16 +61,27 @@ in
       wantedBy = [ "graphical-session.target" ];
       partOf = [ "graphical-session.target" ];
 
+      unitConfig = {
+        After = "graphical-session.target";
+        ConditionEnvironment = [
+          "|WAYLAND_DISPLAY"
+          "|DISPLAY"
+        ];
+      };
+
       serviceConfig = {
         Type = "simple";
-        # workaround for https://github.com/NixOS/nixpkgs/issues/469340
-        ExecStartPre = pkgs.writeShellScript "disable-for-gdm-greeter" ''
-          if [[ "$USER" = "gdm-greeter"* ]]; then
+        # workaround for https://github.com/NixOS/nixpkgs/issues/469340 and
+        # https://github.com/OpenTabletDriver/OpenTabletDriver/issues/4885
+        ExecStartPre = pkgs.writeShellScript "poll-for-non-gdm-greeter-display" ''
+          if [[ "$USER" = "gdm-greeter"* \
+              || ( "$${XDG_SESSION_TYPE}" = wayland && -z "$${WAYLAND_DISPLAY}" ) ]]; then
             exit 1
           fi
         '';
         ExecStart = lib.getExe' cfg.package "otd-daemon";
         Restart = "on-failure";
+        RestartSec = 3;
       };
     };
   };

nixos/modules/misc/locate.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  utils,
   pkgs,
   ...
 }:
@@ -59,7 +60,7 @@ in
     };
 
     output = lib.mkOption {
-      type = lib.types.path;
+      type = lib.types.externalPath;
       default = "/var/cache/locatedb";
       description = ''
         The database file to build.
@@ -249,27 +250,35 @@ in
     systemd.services.update-locatedb = {
       description = "Update Locate Database";
 
-      # mlocate's updatedb takes flags via a configuration file or
-      # on the command line, but not by environment variable.
-      script =
-        let
-          toFlags =
-            x: lib.optional (cfg.${x} != [ ]) "--${lib.toLower x} '${lib.concatStringsSep " " cfg.${x}}'";
-          args = lib.concatLists (
-            map toFlags [
+      serviceConfig = {
+        # mlocate's updatedb takes flags via a configuration file or
+        # on the command line, but not by environment variable.
+        ExecStart =
+          let
+            toFlags =
+              x:
+              lib.optionals (cfg.${x} != [ ]) [
+                "--${lib.toLower x}"
+                (lib.concatStringsSep " " cfg.${x})
+              ];
+            args = lib.concatMap toFlags [
               "pruneFS"
               "pruneNames"
               "prunePaths"
+            ];
+          in
+          utils.escapeSystemdExecArgs (
+            [
+              (lib.getExe' cfg.package "updatedb")
+              "--output"
+              cfg.output
+              "--prune-bind-mounts"
+              (lib.boolToYesNo cfg.pruneBindMounts)
             ]
+            ++ args
+            ++ cfg.extraFlags
           );
-        in
-        ''
-          exec ${cfg.package}/bin/updatedb \
-            --output ${toString cfg.output} ${lib.concatStringsSep " " args} \
-            --prune-bind-mounts ${lib.boolToYesNo cfg.pruneBindMounts} \
-            ${lib.concatStringsSep " " cfg.extraFlags}
-        '';
-      serviceConfig = {
+
         CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_CHOWN";
         Nice = 19;
         IOSchedulingClass = "idle";

nixos/modules/misc/version.nix

@@ -54,7 +54,8 @@ let
       BUG_REPORT_URL = optionalString isNixos "https://github.com/NixOS/nixpkgs/issues";
       ANSI_COLOR = optionalString isNixos "0;38;2;126;186;228";
       IMAGE_ID = optionalString (config.system.image.id != null) config.system.image.id;
-      IMAGE_VERSION = optionalString (config.system.image.version != null) config.system.image.version;
+      ${if config.system.image.version != null then "IMAGE_VERSION" else null} =
+        config.system.image.version;
       VARIANT = optionalString (cfg.variantName != null) cfg.variantName;
       VARIANT_ID = optionalString (cfg.variant_id != null) cfg.variant_id;
       DEFAULT_HOSTNAME = config.system.nixos.distroId;

nixos/modules/module-list.nix

@@ -296,6 +296,7 @@
   ./programs/opengamepadui.nix
   ./programs/openvpn3.nix
   ./programs/partition-manager.nix
+  ./programs/passless.nix
   ./programs/pay-respects.nix
   ./programs/plotinus.nix
   ./programs/pmount.nix
@@ -357,6 +358,7 @@
   ./programs/wayland/mangowc.nix
   ./programs/wayland/miracle-wm.nix
   ./programs/wayland/niri.nix
+  ./programs/wayland/pinnacle.nix
   ./programs/wayland/river.nix
   ./programs/wayland/sway.nix
   ./programs/wayland/uwsm.nix
@@ -730,6 +732,7 @@
   ./services/hardware/usbmuxd.nix
   ./services/hardware/usbrelayd.nix
   ./services/hardware/vdr.nix
+  ./services/hardware/watt.nix
   ./services/home-automation/deye-dummycloud.nix
   ./services/home-automation/ebusd.nix
   ./services/home-automation/esphome.nix
@@ -1341,6 +1344,7 @@
   ./services/networking/nncp.nix
   ./services/networking/nntp-proxy.nix
   ./services/networking/nomad.nix
+  ./services/networking/nordvpn.nix
   ./services/networking/nsd.nix
   ./services/networking/ntopng.nix
   ./services/networking/ntp/chrony.nix
@@ -1857,6 +1861,7 @@
   ./services/web-servers/nginx/tailscale-auth.nix
   ./services/web-servers/phpfpm/default.nix
   ./services/web-servers/pomerium.nix
+  ./services/web-servers/rustfs.nix
   ./services/web-servers/rustus.nix
   ./services/web-servers/send.nix
   ./services/web-servers/stargazer.nix

nixos/modules/programs/passless.nix

@@ -0,0 +1,134 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.programs.passless;
+  settingsFormat = pkgs.formats.toml { };
+  settingsFile = settingsFormat.generate "passless.toml" cfg.settings;
+in
+{
+
+  options.programs.passless = {
+    enable = lib.mkEnableOption "passless";
+
+    package = lib.mkPackageOption pkgs "passless" { };
+
+    users = lib.options.mkOption {
+      type = with lib.types; listOf str;
+      description = ''
+        Users that intend to use passless and should be added to the fido group.
+      '';
+      default = [ ];
+      example = [ "alice" ];
+    };
+
+    settings = lib.mkOption {
+      inherit (settingsFormat) type;
+      default = { };
+      example = {
+        pass.store-path = "/home/alice/.local/share/password-store";
+      };
+      description = ''
+        Configuration included in `config.toml`.
+
+        See <https://github.com/pando85/passless#configuration-1> for documentation or run `passless config print` to see default configuration.
+      '';
+    };
+  };
+
+  config = lib.mkIf config.programs.passless.enable {
+    users.groups.fido.members = cfg.users;
+
+    boot.kernelModules = [ "uhid" ];
+
+    services.udev.extraRules = ''
+      KERNEL=="uhid", GROUP="fido", MODE="0660"
+    '';
+
+    # From https://github.com/pando85/passless/blob/master/contrib/systemd/passless.service
+    systemd.user.services.passless = {
+      description = "Passless FIDO2 Software Authenticator";
+      documentation = [ "https://github.com/pando85/passless" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "default.target" ];
+      path = [ config.programs.gnupg.package ];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${lib.getExe cfg.package} --config-path ${settingsFile}";
+        Restart = "on-failure";
+        RestartSec = "5s";
+        # Security hardening
+        # The application already handles its own memory locking and core dump prevention
+        # but we can add additional systemd protections
+        NoNewPrivileges = true;
+        LimitMEMLOCK = "2M";
+        SyslogIdentifier = "passless";
+
+        # Found with shh
+        ProtectSystem = "strict";
+        PrivateTmp = "disconnected";
+        PrivateMounts = "true";
+        ProtectKernelTunables = "true";
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        LockPersonality = true;
+        RestrictRealtime = true;
+        ProtectClock = true;
+        MemoryDenyWriteExecute = true;
+        RestrictAddressFamilies = "AF_UNIX";
+        SocketBindDeny = [
+          "ipv4:tcp"
+          "ipv4:udp"
+          "ipv6:tcp"
+          "ipv6:udp"
+        ];
+        CapabilityBoundingSet = [
+          "~CAP_BLOCK_SUSPEND"
+          "CAP_BPF"
+          "CAP_CHOWN"
+          "CAP_MKNOD"
+          "CAP_NET_RAW"
+          "CAP_PERFMON"
+          "CAP_SYS_BOOT"
+          "CAP_SYS_CHROOT"
+          "CAP_SYS_MODULE"
+          "CAP_SYS_NICE"
+          "CAP_SYS_PACCT"
+          "CAP_SYS_PTRACE"
+          "CAP_SYS_TIME"
+          "CAP_SYSLOG"
+          "CAP_WAKE_ALARM"
+        ];
+        SystemCallFilter = [
+          "~@aio:EPERM"
+          "@chown:EPERM"
+          "@clock:EPERM"
+          "@cpu-emulation:EPERM"
+          "@debug:EPERM"
+          "@ipc:EPERM"
+          "@keyring:EPERM"
+          "@module:EPERM"
+          "@mount:EPERM"
+          "@obsolete:EPERM"
+          "@pkey:EPERM"
+          "@privileged:EPERM"
+          "@raw-io:EPERM"
+          "@reboot:EPERM"
+          "@resources:EPERM"
+          "@sandbox:EPERM"
+          "@setuid:EPERM"
+          "@swap:EPERM"
+          "@sync:EPERM"
+        ];
+
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ erictapen ];
+
+}

nixos/modules/programs/wayland/pinnacle.nix

@@ -0,0 +1,70 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.programs.pinnacle;
+  inherit (lib.options) mkEnableOption mkPackageOption;
+in
+{
+  options.programs.pinnacle = {
+    enable = mkEnableOption "pinnacle";
+    package = mkPackageOption pkgs "pinnacle" {
+      default = "pinnacle";
+      example = "pkgs.pinnacle";
+      extraDescription = "package containing the pinnacle server binary";
+    };
+    xdg-portals.enable = mkEnableOption "enable xdg-portals for pinnacle";
+    withUWSM = mkEnableOption ''
+      manage the pinnacle session with [UWSM](https://github.com/Vladimir-csp/uwsm) instead
+      of independent systemd services and targets.
+    '';
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = [
+          cfg.package
+          pkgs.protobuf
+          cfg.package.lua-client-api
+        ];
+        environment.pathsToLink = [
+          # For /run/current-system/sw/share/pinnacle protobuf files - for
+          # pinnacle to be able to launch with a non-default config out of the
+          # box.
+          "/share/pinnacle"
+        ];
+        xdg.portal = lib.mkIf cfg.xdg-portals.enable {
+          enable = true;
+          wlr.enable = true;
+          configPackages = [ cfg.package ];
+          extraPortals = [
+            pkgs.xdg-desktop-portal-wlr
+            pkgs.xdg-desktop-portal-gtk
+            pkgs.gnome-keyring
+          ];
+        };
+      }
+      (lib.mkIf (cfg.withUWSM) {
+        programs.uwsm.enable = true;
+        # Configure UWSM to launch Pinnacle from a display manager like SDDM
+        programs.uwsm.waylandCompositors = {
+          pinnacle = {
+            prettyName = "Pinnacle";
+            comment = "Pinnacle compositor managed by UWSM";
+            binPath = "/run/current-system/sw/bin/pinnacle";
+            extraArgs = [ "--session" ];
+          };
+        };
+      })
+      (lib.mkIf (!cfg.withUWSM) {
+        services.displayManager.sessionPackages = [ cfg.package ];
+      })
+    ]
+  );
+
+  meta.maintainers = with lib.maintainers; [ cassandracomar ];
+}

nixos/modules/rename.nix

@@ -511,7 +511,7 @@ in
       services.simplesamlphp has been vulnerable and unmaintained in nixpkgs.
     '')
     (mkRemovedOptionModule [ "security" "pam" "enableEcryptfs" ] ''
-      security.pam.enableFscrypt was removed since it was unmaintained in nixpkgs.
+      security.pam.enableEcryptfs was removed since it was unmaintained in nixpkgs.
     '')
     (mkRemovedOptionModule [ "security" "rngd" ] ''
       rngd is not necessary for any device that the kernel recognises

nixos/modules/security/account-utils.nix

@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.security.account-utils;
+  format = pkgs.formats.ini { };
 in
 {
   options.security.account-utils = {
@@ -25,6 +26,16 @@ in
         :::
       '';
     };
+    pwaccessd.settings = lib.mkOption {
+      description = ''
+        Options for pwaccessd.
+        See {manpage}`pwaccessd.conf(5)` for available options.
+      '';
+      type = lib.types.submodule {
+        freeformType = format.type;
+      };
+      default = { };
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -44,6 +55,8 @@ in
     };
 
     environment.systemPackages = [ cfg.package ];
+    environment.etc."account-utils/pwaccessd.conf".source =
+      format.generate "pwaccessd.conf" cfg.pwaccessd.settings;
 
     security.pam.services = {
       pwupd-passwd = { };

nixos/modules/security/apparmor.nix

@@ -241,7 +241,7 @@ in
         {
           Type = "oneshot";
           RemainAfterExit = "yes";
-          ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown";
+          ExecStartPre = lib.getExe' pkgs.apparmor-init "aa-teardown";
           ExecStart = lib.mapAttrsToList (
             n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts n p}"
           ) enabledPolicies;
@@ -262,7 +262,7 @@ in
               # Optionally kill the processes which are unconfined but now have a profile loaded
               # (because AppArmor can only start to confine new processes).
               lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
-          ExecStop = "${pkgs.apparmor-utils}/bin/aa-teardown";
+          ExecStop = lib.getExe' pkgs.apparmor-init "aa-teardown";
           CacheDirectory = [
             "apparmor"
             "apparmor/logprof"

nixos/modules/security/pam.nix

@@ -1832,11 +1832,6 @@ let
     else
       config.users.motdFile;
 
-  makePAMService = name: service: {
-    name = "pam.d/${name}";
-    value.source = pkgs.writeText "${name}.pam" service.text;
-  };
-
   optionalSudoConfigForSSHAgentAuth =
     lib.optionalString (config.security.pam.sshAgentAuth.enable || config.security.pam.rssh.enable)
       ''
@@ -2648,7 +2643,26 @@ in
       };
     };
 
-    environment.etc = lib.mapAttrs' makePAMService enabledServices;
+    environment.etc =
+      let
+        # Write all pam config in a single derivation for performance
+        pamd =
+          pkgs.runCommand "pam.d"
+            {
+              __structuredAttrs = true;
+              services = lib.mapAttrs (_: svc: svc.text) enabledServices;
+            }
+            ''
+              mkdir $out
+              for i in "''${!services[@]}"; do
+                printf '%s' "''${services[$i]}" > "$out/$i"
+              done
+            '';
+      in
+      lib.mapAttrs' (name: service: {
+        name = "pam.d/${name}";
+        value.source = "${pamd}/${name}";
+      }) enabledServices;
 
     systemd =
       lib.mkIf (lib.any (service: service.lastlog.enable) (lib.attrValues config.security.pam.services))

nixos/modules/services/admin/komodo-periphery.nix

@@ -8,41 +8,65 @@ let
   cfg = config.services.komodo-periphery;
   settingsFormat = pkgs.formats.toml { };
 
+  actualRepoDir = if cfg.repoDir != null then cfg.repoDir else "${cfg.rootDirectory}/repos";
+  actualStackDir = if cfg.stackDir != null then cfg.stackDir else "${cfg.rootDirectory}/stacks";
+  actualBuildDir = if cfg.buildDir != null then cfg.buildDir else "${cfg.rootDirectory}/builds";
+
   genFinalSettings =
     let
+      actualServerEnabled =
+        if cfg.inbound.serverEnabled != null then
+          cfg.inbound.serverEnabled
+        else
+          (cfg.outbound.coreAddress == "");
+
+      hasAnyPrivateKey = cfg.auth.privateKey != "";
+
       baseSettings = {
-        port = cfg.port;
-        bind_ip = cfg.bindIp;
-        root_directory = cfg.rootDirectory;
-        repo_dir = "${cfg.rootDirectory}/repos";
-        stack_dir = "${cfg.rootDirectory}/stacks";
-        ssl_enabled = cfg.ssl.enable;
+        default_terminal_command = cfg.defaultTerminalCommand;
+        disable_terminals = cfg.disableTerminals;
+        disable_container_terminals = cfg.disableContainerTerminals;
+
+        stats_polling_rate = cfg.statsPollingRate;
+        container_stats_polling_rate = cfg.containerStatsPollingRate;
+        legacy_compose_cli = cfg.legacyComposeCli;
+
+        include_disk_mounts = cfg.includeDiskMounts;
+        exclude_disk_mounts = cfg.excludeDiskMounts;
+
+        # When a private key is explicitly configured, it's passed via env var.
+        # Otherwise, use the default file path so Periphery auto-generates a key.
+        private_key = if !hasAnyPrivateKey then "file:${cfg.rootDirectory}/keys/periphery.key" else "";
+        core_public_keys = [ ];
+        passkeys = [ ];
+
+        server_enabled = actualServerEnabled;
+        port = cfg.inbound.port;
+        bind_ip = cfg.inbound.bindIp;
+        allowed_ips = cfg.inbound.allowedIps;
+        ssl_enabled = cfg.inbound.ssl.enable;
       }
-      // lib.optionalAttrs cfg.ssl.enable {
-        ssl_key_file = cfg.ssl.keyFile;
-        ssl_cert_file = cfg.ssl.certFile;
+      // {
+        core_address = cfg.outbound.coreAddress;
+        connect_as = cfg.outbound.connectAs;
+        onboarding_key = "";
       }
       // {
         logging = {
           level = cfg.logging.level;
           stdio = cfg.logging.stdio;
+          opentelemetry_service_name = cfg.logging.opentelemetryServiceName;
+          opentelemetry_scope_name = cfg.logging.opentelemetryScopeName;
+          pretty = cfg.logging.pretty;
         }
         // lib.optionalAttrs (cfg.logging.otlpEndpoint != "") {
           otlp_endpoint = cfg.logging.otlpEndpoint;
         };
-        allowed_ips = cfg.allowedIps;
-        passkeys = cfg.passkeys;
-        disable_terminals = cfg.disableTerminals;
-        disable_container_exec = cfg.disableContainerExec;
-        stats_polling_rate = cfg.statsPollingRate;
-        container_stats_polling_rate = cfg.containerStatsPollingRate;
-        legacy_compose_cli = cfg.legacyComposeCli;
-        include_disk_mounts = cfg.includeDiskMounts;
-        exclude_disk_mounts = cfg.excludeDiskMounts;
+        pretty_startup_config = cfg.prettyStartupConfig;
       }
       // cfg.extraSettings;
     in
-    lib.filterAttrsRecursive (_: v: v != null && v != { } && v != [ ]) baseSettings;
+    lib.filterAttrsRecursive (_: v: v != null && v != { } && v != [ ] && v != "") baseSettings;
 
   configFile =
     if cfg.configFile == null then
@@ -51,36 +75,98 @@ let
       cfg.configFile;
 in
 {
+  imports = with lib; [
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "port" ]
+      [ "services" "komodo-periphery" "inbound" "port" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "bindIp" ]
+      [ "services" "komodo-periphery" "inbound" "bindIp" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "allowedIps" ]
+      [ "services" "komodo-periphery" "inbound" "allowedIps" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "ssl" "enable" ]
+      [ "services" "komodo-periphery" "inbound" "ssl" "enable" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "ssl" "keyFile" ]
+      [ "services" "komodo-periphery" "inbound" "ssl" "keyFile" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "ssl" "certFile" ]
+      [ "services" "komodo-periphery" "inbound" "ssl" "certFile" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "serverEnabled" ]
+      [ "services" "komodo-periphery" "inbound" "serverEnabled" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "disableContainerExec" ]
+      [ "services" "komodo-periphery" "disableContainerTerminals" ]
+    )
+    (mkRemovedOptionModule [ "services" "komodo-periphery" "passkeys" ]
+      "services.komodo-periphery.passkeys has been removed. Use passkeyFiles for v1.X compatibility, or migrate to auth.privateKey and auth.corePublicKeys (v2.0+)."
+    )
+    (mkRemovedOptionModule [ "services" "komodo-periphery" "outbound" "onboardingKey" ]
+      "services.komodo-periphery.outbound.onboardingKey has been removed. Use outbound.onboardingKeyFile instead for better security."
+    )
+  ];
+
   options.services.komodo-periphery = {
     enable = lib.mkEnableOption "Periphery, a multi-server Docker and Git deployment agent by Komodo";
 
     package = lib.mkPackageOption pkgs "komodo" { };
 
-    configFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
+    dockerHost = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
-      description = "Path to the periphery configuration file. If null, a configuration file will be generated from the module options.";
+      description = ''
+        Docker host socket URI to use for container operations.
+        If null, uses the default Docker socket and automatically enables Docker.
+        Set this to use alternative container runtimes like Podman or remote Docker hosts.
+      '';
       example = lib.literalExpression ''
-        pkgs.writeText "periphery.toml" '''
-          port = 8120
-          bind_ip = "[::]"
-          ssl_enabled = true
-          [logging]
-          level = "info"
-        '''
+        # Podman rootless
+        "unix:///run/user/1000/podman/podman.sock"
+
+        # Podman rootful
+        "unix:///run/podman/podman.sock"
+
+        # Remote Docker
+        "tcp://192.168.1.100:2375"
       '';
     };
 
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 8120;
-      description = "Port for the Periphery agent to listen on.";
-    };
+    configFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Path to the Periphery configuration file.
 
-    bindIp = lib.mkOption {
-      type = lib.types.str;
-      default = "[::]";
-      description = "IP address to bind to.";
+        - If `null` (default), a configuration file will be automatically generated
+          from the module options (recommended for most users).
+        - If set to a path, that file will be used directly as the configuration file.
+        - You can also use `pkgs.writeText` to write configuration inline in your NixOS configuration.
+
+        When using a custom config file, all other module options (except `package`, `user`, `group`,
+        `environment`, and `environmentFile`) will be ignored.
+      '';
+      example = lib.literalExpression ''
+        # Option 1: Use an existing config file
+        "/etc/komodo/periphery.toml"
+
+        # Option 2: Write config inline using pkgs.writeText
+        pkgs.writeText "periphery.toml" '''
+          root_directory = "/var/lib/komodo-periphery"
+
+          logging.level = "info"
+          logging.stdio = "standard"
+        '''
+      '';
     };
 
     rootDirectory = lib.mkOption {
@@ -89,24 +175,25 @@ in
       description = "Root directory for Komodo Periphery data.";
     };
 
-    ssl = {
-      enable = lib.mkEnableOption "SSL/TLS support" // {
-        default = true;
-      };
+    repoDir = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/repos"'';
+      description = "Directory for Komodo Periphery to manage repos. If null, defaults to `\${rootDirectory}/repos`.";
+    };
 
-      keyFile = lib.mkOption {
-        type = lib.types.path;
-        default = "${cfg.rootDirectory}/ssl/key.pem";
-        defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/key.pem"'';
-        description = "Path to SSL key file.";
-      };
+    stackDir = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/stacks"'';
+      description = "Directory for Komodo Periphery to manage stacks. If null, defaults to `\${rootDirectory}/stacks`.";
+    };
 
-      certFile = lib.mkOption {
-        type = lib.types.path;
-        default = "${cfg.rootDirectory}/ssl/cert.pem";
-        defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/cert.pem"'';
-        description = "Path to SSL certificate file.";
-      };
+    buildDir = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/builds"'';
+      description = "Directory for Komodo Periphery to manage builds. If null, defaults to `\${rootDirectory}/builds`.";
     };
 
     logging = {
@@ -139,26 +226,41 @@ in
         description = "OpenTelemetry OTLP endpoint for traces.";
         example = "http://localhost:4317";
       };
+
+      opentelemetryServiceName = lib.mkOption {
+        type = lib.types.str;
+        default = "Periphery";
+        description = "(v2.0+) OpenTelemetry service name attached to telemetry.";
+      };
+
+      opentelemetryScopeName = lib.mkOption {
+        type = lib.types.str;
+        default = "Komodo";
+        description = "(v2.0+) OpenTelemetry scope name attached to telemetry.";
+      };
+
+      pretty = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "(v2.0+) Enable human-readable logging (multi-line).";
+      };
     };
 
-    allowedIps = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      description = "IP addresses or subnets allowed to call the periphery API. Empty list allows all.";
-      example = [
-        "::ffff:12.34.56.78"
-        "10.0.10.0/24"
-      ];
+    prettyStartupConfig = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "(v2.0+) Enable human-readable startup config log (multi-line).";
     };
 
-    passkeys = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
+    passkeyFiles = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
       description = ''
-        Passkeys required to access the periphery API.
-        WARNING: These will be stored in the Nix store in plain text!
+        Path to file containing passkeys (v1.X compatibility).
+        This will be passed via `PERIPHERY_PASSKEYS_FILE` environment variable.
+        Consider migrating to the new v2.0+ authentication mechanism.
       '';
-      example = [ "your-secure-passkey" ];
+      example = "/run/secrets/komodo-passkey";
     };
 
     extraSettings = lib.mkOption {
@@ -170,16 +272,23 @@ in
       };
     };
 
+    defaultTerminalCommand = lib.mkOption {
+      type = lib.types.str;
+      default = "bash";
+      description = "(v2.0+) Default terminal command used to initialize the shell.";
+      example = "zsh";
+    };
+
     disableTerminals = lib.mkOption {
       type = lib.types.bool;
       default = false;
       description = "Disable remote shell access through Periphery.";
     };
 
-    disableContainerExec = lib.mkOption {
+    disableContainerTerminals = lib.mkOption {
       type = lib.types.bool;
       default = false;
-      description = "Disable remote container shell access through Periphery.";
+      description = "(v2.0+) Disable remote container shell access through Periphery.";
     };
 
     statsPollingRate = lib.mkOption {
@@ -222,6 +331,147 @@ in
       ];
     };
 
+    auth = {
+      privateKey = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          (v2.0+) Private key used with the Noise handshake.
+
+          Use `file:/path/to/file` prefix to load from a file. If the file doesn't exist,
+          Periphery will generate and write a new key to the path.
+
+          If empty, defaults to `file:''${rootDirectory}/keys/periphery.key`.
+        '';
+        example = lib.literalExpression ''
+          # Reference a secret file
+          "file:''${config.age.secrets.komodo-private-key.path}"
+
+          # Or direct path
+          "file:/run/secrets/komodo-private-key"
+        '';
+      };
+
+      corePublicKeys = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = ''
+          (v2.0+) Accepted public keys to allow Core(s) to connect.
+          Accepts Spki base64 DER directly or can reference files using `file:/path/to/core.pub` prefix.
+          You can mix direct keys and file references.
+
+          For better security, use the `file:` prefix to reference secret files.
+        '';
+        example = lib.literalExpression ''
+          [
+            # Direct key value
+            "MCowBQYDK2VuAyEATZgrjGHeF0KJUe0+n77+qAWOg3YzEzXOmQWaRgO3OGQ="
+            # Reference secret files
+            "file:''${config.age.secrets.komodo-core1-pub.path}"
+            "file:''${config.age.secrets.komodo-core2-pub.path}"
+          ]
+        '';
+      };
+    };
+
+    inbound = {
+      serverEnabled = lib.mkOption {
+        type = lib.types.nullOr lib.types.bool;
+        default = null;
+        description = ''
+          Enable the inbound connection server for Core -> Periphery connections.
+          If null, defaults to false when `outbound.coreAddress` is defined, otherwise true.
+        '';
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 8120;
+        description = "Port for the inbound Periphery server to listen on.";
+      };
+
+      bindIp = lib.mkOption {
+        type = lib.types.str;
+        default = "[::]";
+        description = ''
+          IP address the periphery server will bind to.
+          The default allows external IPv4 and IPv6 connections.
+        '';
+      };
+
+      allowedIps = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = ''
+          Limit the IP addresses which can connect to Periphery.
+          Supports IPv4/IPv6 addresses and subnets.
+          Empty list allows all connections.
+        '';
+        example = [
+          "::ffff:12.34.56.78"
+          "10.0.10.0/24"
+        ];
+      };
+
+      ssl = {
+        enable = lib.mkEnableOption "(v2.0+) SSL/TLS support for inbound connections" // {
+          default = true;
+        };
+
+        keyFile = lib.mkOption {
+          type = lib.types.path;
+          default = "${cfg.rootDirectory}/ssl/key.pem";
+          defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/key.pem"'';
+          description = ''
+            Path to SSL key file.
+            If the file doesn't exist and SSL is enabled, self-signed keys will be generated using openssl.
+          '';
+        };
+
+        certFile = lib.mkOption {
+          type = lib.types.path;
+          default = "${cfg.rootDirectory}/ssl/cert.pem";
+          defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/cert.pem"'';
+          description = ''
+            Path to SSL certificate file.
+            If the file doesn't exist and SSL is enabled, self-signed certificate will be generated using openssl.
+          '';
+        };
+      };
+    };
+
+    outbound = {
+      coreAddress = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          (v2.0+) The address of Komodo Core. Must be reachable from this host.
+          If provided, Periphery will operate in outbound mode.
+        '';
+        example = "demo.komo.do";
+      };
+
+      connectAs = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          (v2.0+) The Server this Periphery agent should connect as.
+          Must match an existing Server name or id.
+        '';
+        example = "server-name";
+      };
+
+      onboardingKeyFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        description = ''
+          (v2.0+) Path to file containing the onboarding key.
+          This will be passed via `PERIPHERY_ONBOARDING_KEY_FILE` environment variable.
+        '';
+        example = lib.literalExpression ''"''${config.age.secrets.komodo-onboarding.path}"'';
+      };
+    };
+
     user = lib.mkOption {
       type = lib.types.str;
       default = "komodo-periphery";
@@ -253,14 +503,14 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    virtualisation.docker.enable = true;
+    virtualisation.docker.enable = lib.mkDefault (cfg.dockerHost == null);
 
     users.users.${cfg.user} = lib.mkIf (cfg.user == "komodo-periphery") {
       isSystemUser = true;
       group = cfg.group;
       description = "Komodo Periphery service user";
       home = cfg.rootDirectory;
-      extraGroups = [ "docker" ];
+      extraGroups = lib.optional (cfg.dockerHost == null) "docker";
     };
 
     users.groups.${cfg.group} = lib.mkIf (cfg.group == "komodo-periphery") { };
@@ -271,16 +521,26 @@ in
         user = cfg.user;
         group = cfg.group;
       };
-      "${cfg.rootDirectory}/repos".d = {
+      "${actualRepoDir}".d = {
         mode = "0755";
         user = cfg.user;
         group = cfg.group;
       };
-      "${cfg.rootDirectory}/stacks".d = {
+      "${actualStackDir}".d = {
         mode = "0755";
         user = cfg.user;
         group = cfg.group;
       };
+      "${actualBuildDir}".d = {
+        mode = "0755";
+        user = cfg.user;
+        group = cfg.group;
+      };
+      "${cfg.rootDirectory}/keys".d = {
+        mode = "0700";
+        user = cfg.user;
+        group = cfg.group;
+      };
       "${cfg.rootDirectory}/ssl".d = {
         mode = "0700";
         user = cfg.user;
@@ -292,35 +552,63 @@ in
       description = "Komodo Periphery - Multi-server Docker and Git deployment agent";
       after = [
         "network-online.target"
-        "docker.service"
-      ];
+      ]
+      ++ lib.optional (cfg.dockerHost == null) "docker.service";
       wants = [
         "network-online.target"
-        "docker.service"
-      ];
+      ]
+      ++ lib.optional (cfg.dockerHost == null) "docker.service";
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
         Type = "simple";
         User = cfg.user;
         Group = cfg.group;
-        SupplementaryGroups = [ "docker" ];
+        SupplementaryGroups = lib.mkIf (cfg.dockerHost == null) [ "docker" ];
         Restart = "on-failure";
         RestartSec = "10s";
         WorkingDirectory = cfg.rootDirectory;
 
         ExecStart = lib.escapeShellArgs [
-          "${lib.getExe' cfg.package "periphery"}"
+          (lib.getExe' cfg.package "periphery")
           "--config-path"
-          (if cfg.configFile != null then cfg.configFile else configFile)
+          configFile
         ];
 
         Environment = lib.mapAttrsToList (name: value: "${name}=${value}") (
-          cfg.environment
-          // lib.optionalAttrs (!cfg.disableTerminals) {
-            PATH = "/run/current-system/sw/bin:/run/wrappers/bin";
+          lib.optionalAttrs (cfg.configFile == null) {
+            PERIPHERY_ROOT_DIRECTORY = cfg.rootDirectory;
+            PERIPHERY_REPO_DIR = actualRepoDir;
+            PERIPHERY_STACK_DIR = actualStackDir;
+            PERIPHERY_BUILD_DIR = actualBuildDir;
           }
+          // lib.optionalAttrs (cfg.configFile == null && cfg.inbound.ssl.enable) {
+            PERIPHERY_SSL_KEY_FILE = cfg.inbound.ssl.keyFile;
+            PERIPHERY_SSL_CERT_FILE = cfg.inbound.ssl.certFile;
+          }
+          // lib.optionalAttrs (cfg.dockerHost != null) {
+            DOCKER_HOST = cfg.dockerHost;
+          }
+          // lib.optionalAttrs (cfg.passkeyFiles != null) {
+            PERIPHERY_PASSKEYS_FILE = cfg.passkeyFiles;
+          }
+          // lib.optionalAttrs (cfg.auth.privateKey != "") {
+            PERIPHERY_PRIVATE_KEY = cfg.auth.privateKey;
+          }
+          // lib.optionalAttrs (cfg.auth.corePublicKeys != [ ]) {
+            PERIPHERY_CORE_PUBLIC_KEYS = lib.concatStringsSep "," cfg.auth.corePublicKeys;
+          }
+          // lib.optionalAttrs (cfg.outbound.onboardingKeyFile != null) {
+            PERIPHERY_ONBOARDING_KEY_FILE = cfg.outbound.onboardingKeyFile;
+          }
+          // cfg.environment
         );
+
+        ExecSearchPath = lib.mkIf (!cfg.disableTerminals) [
+          "/run/current-system/sw/bin"
+          "/run/wrappers/bin"
+        ];
+
         EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
 
         StateDirectory = "komodo-periphery";
@@ -329,7 +617,7 @@ in
         NoNewPrivileges = true;
         PrivateTmp = true;
         ProtectSystem = "full";
-        ProtectHome = true;
+        ProtectHome = "read-only";
       };
     };
   };

nixos/modules/services/desktops/oo7.nix

@@ -10,7 +10,7 @@ in
 {
   options.services.oo7 = {
     enable = lib.mkEnableOption ''
-      oo7, a service providing the Secret Service D-Bus API.
+      oo7, a service providing the Secret Service D-Bus API
     '';
   };
 

nixos/modules/services/desktops/seatd.nix

@@ -40,7 +40,6 @@ in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
       seatd
-      sdnotify-wrapper
     ];
     users.groups.seat = lib.mkIf (cfg.group == "seat") { };
 
@@ -55,7 +54,7 @@ in
         Type = "notify";
         NotifyAccess = "all";
         SyslogIdentifier = "seatd";
-        ExecStart = "${pkgs.sdnotify-wrapper}/bin/sdnotify-wrapper ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
+        ExecStart = "${lib.getExe' pkgs.s6 "s6-notify-socket-from-fd"} ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
         RestartSec = 1;
         Restart = "always";
       };

nixos/modules/services/display-managers/gdm.nix

@@ -421,7 +421,7 @@ in
             {
               name = "unix";
               control = "sufficient";
-              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+              modulePath = config.security.pam.pam_unixModulePath;
             }
           ];
 
@@ -567,7 +567,7 @@ in
             {
               name = "unix";
               control = "sufficient";
-              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+              modulePath = config.security.pam.pam_unixModulePath;
             }
           ];
 
@@ -575,7 +575,7 @@ in
             {
               name = "unix";
               control = "requisite";
-              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+              modulePath = config.security.pam.pam_unixModulePath;
               settings.nullok = true;
               settings.yescrypt = true;
             }

nixos/modules/services/display-managers/plasma-login-manager.nix

@@ -201,7 +201,7 @@ in
               # Setup session
               name = "unix";
               control = "required";
-              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+              modulePath = config.security.pam.pam_unixModulePath;
             }
             {
               name = "systemd";

nixos/modules/services/display-managers/sddm.nix

@@ -442,7 +442,7 @@ in
             {
               name = "unix";
               control = "sufficient";
-              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+              modulePath = config.security.pam.pam_unixModulePath;
             }
           ];
 

nixos/modules/services/editors/emacs.nix

@@ -80,6 +80,9 @@ in
       unitConfig = lib.optionalAttrs cfg.startWithGraphical {
         After = "graphical-session.target";
       };
+
+      # Long-lived session that ought to only be restarted manually
+      restartIfChanged = false;
     }
     // lib.optionalAttrs cfg.enable {
       wantedBy = if cfg.startWithGraphical then [ "graphical-session.target" ] else [ "default.target" ];

nixos/modules/services/hardware/sane_extra_backends/brscan5_etc_files.nix

@@ -58,17 +58,17 @@ stdenv.mkDerivation {
   dontConfigure = true;
 
   buildPhase = ''
-    TARGET_DIR="$out/etc/opt/brother/scanner/brscan5"
+    TARGET_DIR="$out/tmp"
     mkdir -p "$TARGET_DIR"
     cp -rp "./models" "$TARGET_DIR"
     cp -rp "./brscan5.ini" "$TARGET_DIR"
     cp -rp "./brsanenetdevice.cfg" "$TARGET_DIR"
-
     export NIX_REDIRECTS="/etc/opt/brother/scanner/brscan5/=$TARGET_DIR/"
-
     printf '${addAllNetDev netDevices}\n'
-
     ${addAllNetDev netDevices}
+
+    mkdir -p "$out/etc/opt/brother/scanner/brscan5"
+    mv -T "$TARGET_DIR" "$out/etc/opt/brother/scanner/brscan5"
   '';
 
   dontInstall = true;

nixos/modules/services/hardware/watt.nix

@@ -0,0 +1,71 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (lib)
+    mkIf
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    getExe
+    ;
+  inherit (lib.types) submodule;
+
+  cfg = config.services.watt;
+
+  format = pkgs.formats.toml { };
+  cfgFile = format.generate "watt-config.toml" cfg.settings;
+
+  conflictingServices = [
+    "power-profiles-daemon"
+    "auto-cpufreq"
+    "tlp"
+    "cpupower-gui"
+    "thermald"
+  ];
+
+in
+{
+  options.services.watt = {
+    enable = mkEnableOption "automatic CPU speed & power optimizer for Linux";
+    package = mkPackageOption pkgs "watt" { };
+
+    settings = mkOption {
+      default = { };
+      type = submodule { freeformType = format.type; };
+      description = "Configuration for Watt. Options at https://github.com/notaShelf/watt";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = map (service: {
+      assertion = !config.services.${service}.enable;
+      message = "You have set services.${service}.enable = true; which conflicts with Watt.";
+    }) conflictingServices;
+
+    environment.systemPackages = [ cfg.package ];
+
+    # This is necessary for the Watt CLI. The environment variable
+    # passed to the systemd service will take priority in read order.
+    environment.etc."watt.toml".source = cfgFile;
+
+    services.dbus.packages = [ cfg.package ];
+
+    systemd.services.watt = {
+      wantedBy = [ "multi-user.target" ];
+      conflicts = map (service: "${service}.service") conflictingServices;
+      serviceConfig = {
+        WorkingDirectory = "";
+        ExecStart = getExe cfg.package;
+        Restart = "on-failure";
+
+        RuntimeDirectory = "watt";
+        RuntimeDirectoryMode = "0755";
+      };
+    };
+
+  };
+}

nixos/modules/services/mail/postsrsd.nix

@@ -281,7 +281,7 @@ in
       environment.etc."postsrsd.conf".source = configFile;
 
       systemd.services.postsrsd = {
-        description = "PostSRSd SRS rewriting server";
+        description = "Sender Rewriting Scheme daemon for Postfix";
         after = [
           "network.target"
           "postsrsd-generate-secrets.service"
@@ -289,14 +289,20 @@ in
         before = [ "postfix.service" ];
         wantedBy = [ "multi-user.target" ];
         requires = [ "postsrsd-generate-secrets.service" ];
-        restartTriggers = [ configFile ];
+        reloadTriggers = [ configFile ];
 
         serviceConfig = {
+          Type = "notify-reload";
           ExecStart = utils.escapeSystemdExecArgs [
             (lib.getExe cfg.package)
             "-C"
             "/etc/postsrsd.conf"
           ];
+          ExecReload = toString [
+            (lib.getExe' pkgs.coreutils "kill")
+            "-SIGHUP"
+            "$MAINPID"
+          ];
           User = cfg.user;
           Group = cfg.group;
           RuntimeDirectory = "postsrsd";
@@ -319,7 +325,7 @@ in
           ProtectKernelModules = true;
           ProtectKernelTunables = true;
           ProtectSystem = "strict";
-          ProtectProc = "invisible";
+          ProtectProc = "noaccess";
           ProcSubset = "pid";
           RemoveIPC = true;
           RestrictAddressFamilies =

nixos/modules/services/mail/stalwart.nix

@@ -57,7 +57,7 @@ in
       default = { };
       description = ''
         Configuration options for the Stalwart server.
-        See <https://stalw.art/docs/category/configuration> for available options.
+        See <https://stalw.art/docs/configuration> for available options.
 
         By default, the module is configured to store everything locally.
       '';

nixos/modules/services/matrix/dendrite.nix

@@ -13,6 +13,7 @@ in
 {
   options.services.dendrite = {
     enable = lib.mkEnableOption "matrix.org dendrite";
+    package = lib.mkPackageOption pkgs "dendrite" { };
     httpPort = lib.mkOption {
       type = lib.types.nullOr lib.types.port;
       default = 8008;
@@ -321,7 +322,7 @@ in
         ];
         ExecStart = lib.strings.concatStringsSep " " (
           [
-            "${pkgs.dendrite}/bin/dendrite"
+            (lib.getExe cfg.package)
             "--config /run/dendrite/dendrite.yaml"
           ]
           ++ lib.optionals (cfg.httpPort != null) [

nixos/modules/services/matrix/matrix-authentication-service.nix

@@ -45,7 +45,9 @@ let
       pruned;
   configFile = format.generate "config.yaml" finalSettings;
 
-  extraConfigFiles = lib.imap0 (i: _: "%d/config-${toString i}") cfg.extraConfigFiles;
+  extraConfigFiles = lib.imap0 (
+    i: _: "\${CREDENTIALS_DIRECTORY}/config-${toString i}"
+  ) cfg.extraConfigFiles;
   runtimeConfig = "/run/matrix-authentication-service/config.yaml";
 in
 {

nixos/modules/services/misc/errbot.nix

@@ -91,6 +91,20 @@ in
     };
     users.groups.errbot = { };
 
+    systemd.tmpfiles.settings = {
+      "10-errbot" = lib.mapAttrs' (
+        name: instanceCfg:
+        let
+          dataDir = if instanceCfg.dataDir != null then instanceCfg.dataDir else "/var/lib/errbot/${name}";
+        in
+        lib.nameValuePair "${dataDir}".d {
+          group = "errbot";
+          user = "errbot";
+          mode = "0755";
+        }
+      ) cfg.instances;
+    };
+
     systemd.services = lib.mapAttrs' (
       name: instanceCfg:
       lib.nameValuePair "errbot-${name}" (
@@ -103,12 +117,7 @@ in
           serviceConfig = {
             User = "errbot";
             Restart = "on-failure";
-            ExecStartPre = [
-              "${lib.getExe' pkgs.coreutils "mkdir"} -p ${dataDir}"
-              "${lib.getExe' pkgs.coreutils "chown"} -R errbot:errbot ${dataDir}"
-            ];
             ExecStart = "${pkgs.errbot}/bin/errbot -c ${mkConfigDir instanceCfg dataDir}/config.py";
-            PermissionsStartOnly = true;
           };
         }
       )

nixos/modules/services/misc/graphical-desktop.nix

@@ -22,17 +22,23 @@ in
 
   config = lib.mkIf cfg.enable {
     environment = {
-      # localectl looks into 00-keyboard.conf
-      etc."X11/xorg.conf.d/00-keyboard.conf".text = ''
-        Section "InputClass"
-          Identifier "Keyboard catchall"
-          MatchIsKeyboard "on"
-          Option "XkbModel" "${xcfg.xkb.model}"
-          Option "XkbLayout" "${xcfg.xkb.layout}"
-          Option "XkbOptions" "${xcfg.xkb.options}"
-          Option "XkbVariant" "${xcfg.xkb.variant}"
-        EndSection
-      '';
+      # systemd-localed looks into 00-keyboard.conf
+      # systemd-localed does not like if Option values are ""
+      etc."X11/xorg.conf.d/00-keyboard.conf".text =
+        let
+          optionLine =
+            name: value: lib.optionalString (value != null && value != "") ''Option "${name}" "${value}"'';
+        in
+        ''
+          Section "InputClass"
+            Identifier "Keyboard catchall"
+            MatchIsKeyboard "on"
+            ${optionLine "XkbModel" xcfg.xkb.model}
+            ${optionLine "XkbLayout" xcfg.xkb.layout}
+            ${optionLine "XkbOptions" xcfg.xkb.options}
+            ${optionLine "XkbVariant" xcfg.xkb.variant}
+          EndSection
+        '';
       systemPackages = with pkgs; [
         nixos-icons # needed for gnome and pantheon about dialog, nixos-manual and maybe more
         xdg-utils

nixos/modules/services/misc/redmine.nix

@@ -245,19 +245,19 @@ in
       };
 
       components = {
-        subversion = lib.mkEnableOption "Subversion integration.";
+        subversion = lib.mkEnableOption "Subversion integration";
 
-        mercurial = lib.mkEnableOption "Mercurial integration.";
+        mercurial = lib.mkEnableOption "Mercurial integration";
 
-        git = lib.mkEnableOption "git integration.";
+        git = lib.mkEnableOption "git integration";
 
-        cvs = lib.mkEnableOption "cvs integration.";
+        cvs = lib.mkEnableOption "cvs integration";
 
-        breezy = lib.mkEnableOption "bazaar integration.";
+        breezy = lib.mkEnableOption "bazaar integration";
 
-        imagemagick = lib.mkEnableOption "exporting Gant diagrams as PNG.";
+        imagemagick = lib.mkEnableOption "exporting Gant diagrams as PNG";
 
-        ghostscript = lib.mkEnableOption "exporting Gant diagrams as PDF.";
+        ghostscript = lib.mkEnableOption "exporting Gant diagrams as PDF";
 
         minimagick_font_path = lib.mkOption {
           type = lib.types.str;
@@ -265,6 +265,8 @@ in
           description = "MiniMagick font path";
           example = "/run/current-system/sw/share/X11/fonts/LiberationSans-Regular.ttf";
         };
+
+        pandoc = lib.mkEnableOption "pandoc integration for previewing LibreOffice and Microsoft Office documents";
       };
     };
   };
@@ -310,6 +312,7 @@ in
         imagemagick_convert_command = lib.optionalString cfg.components.imagemagick "${pkgs.imagemagick}/bin/convert";
         gs_command = lib.optionalString cfg.components.ghostscript "${pkgs.ghostscript}/bin/gs";
         minimagick_font_path = "${cfg.components.minimagick_font_path}";
+        pandoc_command = lib.optionalString cfg.components.pandoc "${pkgs.pandoc}/bin/pandoc";
       };
     };
 
@@ -457,7 +460,7 @@ in
         Group = cfg.group;
         TimeoutSec = "300";
         WorkingDirectory = "${cfg.package}/share/redmine";
-        ExecStart = "${bundle} exec rails server -u webrick -e production -b ${toString cfg.address} -p ${toString cfg.port} -P '${cfg.stateDir}/redmine.pid'";
+        ExecStart = "${bundle} exec rails server -u webrick -e production -b ${toString cfg.address} -p ${toString cfg.port}";
         RuntimeDirectory = "redmine";
         RuntimeDirectoryMode = "0750";
         AmbientCapabilities = "";

nixos/modules/services/misc/shoko.nix

@@ -90,8 +90,5 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [
-    diniamo
-    nanoyaki
-  ];
+  meta.maintainers = with lib.maintainers; [ nanoyaki ];
 }

nixos/modules/services/monitoring/prometheus/exporters/imap-mailstat.nix

@@ -94,8 +94,8 @@ in
     serviceConfig = {
       ExecStart = ''
         ${pkgs.prometheus-imap-mailstat-exporter}/bin/imap-mailstat-exporter \
-          -config ${createConfigFile cfg.accounts} \
-          ${optionalString cfg.oldestUnseenDate "-oldestunseendate"} \
+          --config.file="${createConfigFile cfg.accounts}" \
+          ${optionalString cfg.oldestUnseenDate "--oldestunseen.feature"} \
           ${concatStringsSep " \\\n  " cfg.extraFlags}
       '';
     };

nixos/modules/services/monitoring/traccar.nix

@@ -102,7 +102,7 @@ in
           ${lib.getExe pkgs.envsubst} \
             -i ${configuration} \
             -o ${configFilePath}
-          umask $old_umask
+          umask "$old_umask"
         '';
 
         serviceConfig = {

nixos/modules/services/monitoring/vnstat.nix

@@ -6,17 +6,32 @@
 }:
 let
   cfg = config.services.vnstat;
+  settingsFormat = pkgs.formats.keyValue { };
 in
 {
   options.services.vnstat = {
     enable = lib.mkEnableOption "update of network usage statistics via vnstatd";
     package = lib.mkPackageOption pkgs "vnstat" { };
+    settings = lib.mkOption {
+      type = lib.types.submodule { freeformType = settingsFormat.type; };
+      default = { };
+      description = ''
+        Configuration for vnstat. Refer to
+        [https://humdi.net/vnstat/man/vnstat.conf.html]
+        or {manpage}`vnstat.conf(5)` for more information.
+      '';
+      example = {
+        AlwaysAddNewInterfaces = 1;
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ cfg.package ];
 
+    environment.etc."vnstat.conf".source = settingsFormat.generate "vnstat.conf" cfg.settings;
+
     users = {
       groups.vnstatd = { };
 
@@ -59,4 +74,8 @@ in
       };
     };
   };
+
+  meta = {
+    maintainers = with lib.maintainers; [ hmenke ];
+  };
 }

nixos/modules/services/network-filesystems/rsyncd.nix

@@ -132,7 +132,7 @@ in
           description = "socket for fast remote file copy program daemon";
           conflicts = [ "rsync.service" ];
 
-          listenStreams = [ (toString cfg.port) ];
+          listenStreams = [ cfg.port ];
           socketConfig.Accept = true;
 
           wantedBy = [ "sockets.target" ];

nixos/modules/services/networking/anubis.nix

@@ -374,6 +374,10 @@ in
       anubis = { };
     };
 
+    systemd.slices.system-anubis = {
+      description = "Anubis AI Firewall System Slice";
+      documentation = [ "https://anubis.techaro.lol" ];
+    };
     systemd.services = lib.mapAttrs' (
       name: instance:
       lib.nameValuePair "${instanceName name}" {
@@ -396,6 +400,7 @@ in
         );
 
         serviceConfig = {
+          Slice = "system-anubis.slice";
           User = instance.user;
           Group = instance.group;
           DynamicUser = true;

nixos/modules/services/networking/headplane.nix

@@ -44,7 +44,7 @@ in
     settings = mkOption {
       description = ''
         Headplane configuration options. Generates a YAML config file.
-        See: https://github.com/tale/headplane/blob/main/config.example.yaml
+        See <https://github.com/tale/headplane/blob/main/config.example.yaml>.
       '';
       type = types.submodule {
         options = {
@@ -129,6 +129,16 @@ in
           headscale = mkOption {
             type = types.submodule {
               options = {
+                api_key_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    Path to a file containing a Headscale API key.
+                    This is required for OIDC authentication aswell for the Headplane agent.
+                  '';
+                  example = lib.literalExpression "config.sops.secrets.headplane_pre_authkey.path";
+                };
+
                 url = mkOption {
                   type = types.str;
                   default = "http://127.0.0.1:${toString config.services.headscale.port}";
@@ -211,15 +221,6 @@ in
                           '';
                         };
 
-                        pre_authkey_path = mkOption {
-                          type = types.nullOr types.path;
-                          default = null;
-                          description = ''
-                            Path to a file containing a Headscale pre-auth key for the agent.
-                          '';
-                          example = lib.literalExpression "config.sops.secrets.headplane_pre_authkey.path";
-                        };
-
                         executable_path = mkOption {
                           type = types.path;
                           readOnly = true;
@@ -237,20 +238,14 @@ in
                         };
 
                         cache_ttl = mkOption {
-                          type = types.nullOr types.int;
-                          default = null;
+                          type = types.ints.positive;
+                          default = 180000;
                           description = ''
-                            Deprecated cache TTL for the agent. This option is accepted
-                            by Headplane 0.6.2 but has no effect.
+                            How long to cache agent information (in milliseconds).
+                            If you want data to update faster, reduce the TTL, but this will increase the frequency of requests to Headscale.
                           '';
                         };
 
-                        cache_path = mkOption {
-                          type = types.path;
-                          default = "/var/lib/headplane/agent_cache.json";
-                          description = "The path to store the agent's cache.";
-                        };
-
                         work_dir = mkOption {
                           type = types.path;
                           default = "/var/lib/headplane/agent";
@@ -325,16 +320,6 @@ in
                     example = lib.literalExpression "config.sops.secrets.oidc_client_secret.path";
                   };
 
-                  headscale_api_key_path = mkOption {
-                    type = types.nullOr types.path;
-                    default = null;
-                    description = ''
-                      Path to a file containing the Headscale API key.
-                      Required for OIDC authentication.
-                    '';
-                    example = lib.literalExpression "config.sops.secrets.headscale_api_key.path";
-                  };
-
                   disable_api_key_login = mkOption {
                     type = types.bool;
                     default = false;
@@ -366,25 +351,6 @@ in
                     '';
                   };
 
-                  redirect_uri = mkOption {
-                    type = types.nullOr types.str;
-                    default = null;
-                    description = ''
-                      Deprecated OIDC redirect URI. Use services.headplane.settings.server.base_url
-                      instead; Headplane derives the callback URL from it.
-                    '';
-                    example = "https://headplane.example.com/admin/oidc/callback";
-                  };
-
-                  strict_validation = mkOption {
-                    type = types.nullOr types.bool;
-                    default = null;
-                    description = ''
-                      Deprecated OIDC validation setting. This option is accepted
-                      by Headplane 0.6.2 but has no effect.
-                    '';
-                  };
-
                   profile_picture_source = mkOption {
                     type = types.enum [
                       "oidc"
@@ -429,16 +395,6 @@ in
                     description = "Custom userinfo endpoint URL.";
                     example = "https://provider.example.com/userinfo";
                   };
-
-                  user_storage_file = mkOption {
-                    type = types.nullOr types.path;
-                    default = null;
-                    description = ''
-                      Deprecated path to the pre-0.6.2 JSON user database.
-                      Headplane uses this once to migrate users into its internal database.
-                    '';
-                    example = "/var/lib/headplane/users.json";
-                  };
                 };
               }
             );
@@ -452,33 +408,6 @@ in
   };
 
   config = mkIf cfg.enable {
-    warnings =
-      lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.redirect_uri != null) [
-        ''
-          services.headplane.settings.oidc.redirect_uri is deprecated by Headplane 0.6.2.
-          Use services.headplane.settings.server.base_url instead; Headplane derives
-          the OIDC callback URL from it.
-        ''
-      ]
-      ++ lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.strict_validation != null) [
-        ''
-          services.headplane.settings.oidc.strict_validation is deprecated and has no effect
-          in Headplane 0.6.2.
-        ''
-      ]
-      ++ lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.user_storage_file != null) [
-        ''
-          services.headplane.settings.oidc.user_storage_file is deprecated. Headplane 0.6.2
-          uses it only to migrate the pre-0.6.2 JSON user database into the internal database.
-        ''
-      ]
-      ++ lib.optionals (agentSettings != null && agentSettings.cache_ttl != null) [
-        ''
-          services.headplane.settings.integration.agent.cache_ttl is deprecated and has no
-          effect in Headplane 0.6.2.
-        ''
-      ];
-
     assertions = [
       {
         assertion = config.services.headscale.enable;
@@ -502,26 +431,25 @@ in
         '';
       }
       {
-        assertion = cfg.settings.oidc == null || cfg.settings.oidc.headscale_api_key_path != null;
+        assertion = cfg.settings.oidc == null || cfg.settings.headscale.api_key_path != null;
         message = ''
-          services.headplane.settings.oidc.headscale_api_key_path must be set
-          when services.headplane.settings.oidc is non-null. Headplane's OIDC
-          flow requires a Headscale API key to mint sessions.
+          services.headplane.settings.headscale.api_key_path must be set
+          when services.headplane.settings.oidc is non-null.
+          Headplane's OIDC flow requires a Headscale API key to mint sessions.
         '';
       }
       {
         assertion =
-          agentSettings == null || !agentSettings.enabled || agentSettings.pre_authkey_path != null;
+          agentSettings == null || !agentSettings.enabled || cfg.settings.headscale.api_key_path != null;
         message = ''
-          services.headplane.settings.integration.agent.pre_authkey_path must be set
-          when the agent is enabled.
+          services.headplane.settings.headscale.api_key_path must be set when the agent is enabled.
         '';
       }
     ];
 
     environment = {
       systemPackages = [ cfg.package ];
-      etc."headplane/config.yaml".source = "${settingsFile}";
+      etc."headplane/config.yaml".source = settingsFile;
     };
 
     systemd.services.headplane = {
@@ -534,6 +462,7 @@ in
         config.systemd.services.headscale.name
       ];
       requires = [ config.systemd.services.headscale.name ];
+      restartTriggers = [ settingsFile ];
 
       environment = {
         HEADPLANE_DEBUG_LOG = toString cfg.debug;

nixos/modules/services/networking/llama-swap.nix

@@ -42,6 +42,15 @@ in
       '';
     };
 
+    useLlamaCppCacheDir = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to use {file}`/var/cache/llama-cpp` as {env}`LLAMA_CACHE` instead
+        of {file}`/var/cache/llama-swap` to share models and other cache with {option}`services.llama-cpp`.
+      '';
+    };
+
     tls = {
       enable = lib.mkEnableOption "TLS encryption";
 
@@ -113,6 +122,10 @@ in
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
+      environment = {
+        LLAMA_CACHE = lib.mkDefault "/var/cache/${config.systemd.services.llama-swap.serviceConfig.CacheDirectory}";
+      };
+
       serviceConfig = {
         Type = "exec";
         ExecStart = "${lib.getExe cfg.package} ${
@@ -130,6 +143,12 @@ in
         Restart = "on-failure";
         RestartSec = 3;
 
+        CacheDirectory =
+          if cfg.useLlamaCppCacheDir then
+            config.systemd.services.llama-cpp.serviceConfig.CacheDirectory
+          else
+            "llama-swap";
+
         # for GPU acceleration
         PrivateDevices = false;
 

nixos/modules/services/networking/networkd-dispatcher.nix

@@ -93,6 +93,10 @@ in
 
   config = mkIf cfg.enable {
 
+    warnings = mkIf (!config.systemd.network.enable) [
+      "services.networkd-dispatcher will not execute any scripts unless networkd is enabled, either via `systemd.network.enable` or via `networking.useNetworkd`."
+    ];
+
     systemd = {
       packages = [ pkgs.networkd-dispatcher ];
       services.networkd-dispatcher = {

nixos/modules/services/networking/nordvpn.md

@@ -0,0 +1,65 @@
+# NordVPN {#module-services-nordvpn}
+
+*Source:* {file}`modules/services/networking/nordvpn.nix`
+
+*Upstream documentation:* <https://github.com/NordSecurity/nordvpn-linux>
+
+NordVPN offers a paid virtual private network (VPN) service.
+The service operates as closed-source,
+but the Linux client uses open-source code licensed under GPLv3.
+A minimal configuration in NixOS appears as follows:
+
+```nix
+{
+  services.nordvpn.enable = true;
+  networking.firewall.enable = true;
+  networking.firewall.checkReversePath = "loose";
+}
+```
+
+When using a firewall, set `networking.firewall.checkReversePath` to `"loose"` or `false`.
+NordVPN includes a `kill-switch` feature that blocks all packets not associated with the VPN connection.
+
+Additionally, add your user to the `nordvpn` group.
+
+```nix
+{
+  users.users.yourUser = {
+    #..
+    extraGroups = [
+      #..
+      "nordvpn"
+    ];
+  };
+}
+```
+
+If you prefer to use your own user and group, you can do so using
+
+```nix
+{
+  services.nordvpn.user = "SOME-USER";
+  services.nordvpn.group = "SOME-GROUP";
+}
+```
+
+NordVPN provides several useful CLI commands, including:
+
+```bash
+nordvpn login  # Log in using an OAuth URL
+nordvpn login --token <token>  # Log in with a token obtained from your NordVPN account
+nordvpn c  # Connect to the VPN
+nordvpn c ie  # Connect to a NordVPN server in Ireland
+nordvpn d  # Disconnect from the VPN
+nordvpn set technology openvpn  # Switch to OpenVPN technology
+nordvpn c  # Reconnect after changing technology
+```
+
+Additionally, if you prefer to use the friendly GUI,
+
+```bash
+nordvpn-gui
+```
+
+**Disclaimer:** NixOS currently does not support meshnet.
+Contributions welcome!

nixos/modules/services/networking/nordvpn.nix

@@ -0,0 +1,171 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.nordvpn;
+  defaultUser = "nordvpn";
+  defaultGroup = "nordvpn";
+
+  nordvpn =
+    let
+      cli = cfg.package.cli.overrideAttrs (old: {
+        preBuild =
+          let
+            extraPreBuild = lib.optionalString (cfg.group != defaultGroup) ''
+              substituteInPlace internal/permissions.go \
+                --replace-fail \
+                      'string{"nordvpn"}' \
+                      'string{"${cfg.group}"}'
+
+              substituteInPlace internal/constants.go \
+                  --replace-fail \
+                      'NordvpnGroup = "nordvpn"' \
+                      'NordvpnGroup = "${cfg.group}"'
+            '';
+          in
+          extraPreBuild + (old.preBuild or "");
+
+        # postFixup wraps nordvpnd so that it can find binaries that it calls.
+        # here, instead, use systemd to update the path to those binaries.
+        postFixup = "";
+      });
+    in
+    pkgs.symlinkJoin {
+      inherit (cfg.package) pname version meta;
+      paths = [
+        cli
+        cfg.package.gui
+      ];
+    };
+in
+{
+  options.services.nordvpn = {
+    enable = lib.mkEnableOption "Enable NordVPN";
+    package = lib.mkPackageOption pkgs "nordvpn" { };
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = ''
+        The User that owns the `nordvpnd` systemd process.
+        If overriding the default, a user with the same name must exist.
+      '';
+    };
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = defaultGroup;
+      description = ''
+        The Group that owns the `nordvpnd` systemd process.
+        If overriding the default, a group with the same name must exist.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    # create the default user if that's the one used
+    users.users = lib.mkIf (cfg.user == defaultUser) {
+      ${defaultUser} = {
+        description = "User that runs `nordvpnd`.";
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+
+    # create the default group if that's the one used
+    users.groups = lib.mkIf (cfg.group == defaultGroup) {
+      ${defaultGroup} = { };
+    };
+
+    # nordvpnd uses resolved to configure dns
+    services.resolved.enable = true;
+
+    # policy that allows nordvpnd to configure dns
+    security.polkit = {
+      enable = true;
+      extraConfig = ''
+        polkit.addRule(function(action, subject) {
+          if (action.id == "org.freedesktop.resolve1.set-dns-servers"
+              && subject.isInGroup("${cfg.group}")) {
+            return polkit.Result.YES;
+          }
+        });
+      '';
+    };
+
+    environment.systemPackages = [
+      nordvpn
+    ];
+
+    systemd.services.nordvpnd = {
+      after = [ "network-online.target" ];
+      description = "NordVPN daemon.";
+      path = (
+        with pkgs;
+        [
+          e2fsprogs
+          iproute2
+          libxslt
+          nftables
+          procps
+          wireguard-tools
+        ]
+        ++ [ nordvpn ]
+      );
+      serviceConfig = {
+        # nordvpnd needs CAP_NET_ADMIN to configure network interfaces
+        AmbientCapabilities = "CAP_NET_ADMIN";
+        CapabilityBoundingSet = "CAP_NET_ADMIN";
+        ExecStart = lib.getExe' nordvpn "nordvpnd";
+        Group = cfg.group;
+        KillMode = "process";
+        NonBlocking = true;
+        Requires = "nordvpnd.socket";
+        Restart = "on-failure";
+        RestartSec = 5;
+        RuntimeDirectory = "nordvpn";
+        RuntimeDirectoryMode = "0750";
+        StateDirectory = "nordvpn";
+        StateDirectoryMode = "0750";
+        User = cfg.user;
+      };
+      wantedBy = [ "default.target" ];
+      wants = [ "network-online.target" ];
+    };
+
+    systemd.sockets.nordvpnd = {
+      description = "NordVPN Daemon Socket";
+      listenStreams = [ "/run/nordvpn/nordvpnd.sock" ];
+      partOf = [ "nordvpnd.service" ];
+      socketConfig = {
+        DirectoryMode = "0750";
+        NoDelay = true;
+        SocketGroup = cfg.group;
+        SocketMode = "0770";
+        SocketUser = cfg.user;
+      };
+      wantedBy = [ "sockets.target" ];
+    };
+
+    systemd.user.services.norduserd = {
+      after = [ "network-online.target" ];
+      description = "NordUserD Service";
+      serviceConfig = {
+        ExecStart = lib.getExe' nordvpn "norduserd";
+        NonBlocking = true;
+        Restart = "on-failure";
+        RestartSec = 5;
+      };
+      wantedBy = [ "graphical-session.target" ];
+      wants = [ "network-online.target" ];
+    };
+
+  };
+
+  meta = {
+    doc = ./nordvpn.md;
+    maintainers = with lib.maintainers; [ different-error ];
+  };
+}

nixos/modules/services/networking/ssh/sshd.nix

@@ -232,6 +232,10 @@ in
       "openssh"
       "banner"
     ] "Use services.openssh.settings.Banner instead.")
+    (lib.mkRenamedOptionModule
+      [ "services" "openssh" "moduliFile" ]
+      [ "services" "openssh" "settings" "ModuliFile" ]
+    )
   ];
 
   ###### interface
@@ -729,6 +733,14 @@ in
                 '';
                 example = "/etc/ssh/banner";
               };
+              ModuliFile = lib.mkOption {
+                type = lib.types.path;
+                default = "${config.services.openssh.package}/etc/ssh/moduli";
+                defaultText = lib.literalExpression ''"''${config.services.openssh.package}/etc/ssh/moduli"'';
+                description = ''
+                  Specifies the {manpage}`moduli(5)` file to use for Diffie-Hellman key exchange.
+                '';
+              };
             };
           }
         );
@@ -740,16 +752,6 @@ in
         description = "Verbatim contents of {file}`sshd_config`.";
       };
 
-      moduliFile = lib.mkOption {
-        example = "/etc/my-local-ssh-moduli;";
-        type = lib.types.path;
-        description = ''
-          Path to `moduli` file to install in
-          `/etc/ssh/moduli`. If this option is unset, then
-          the `moduli` file shipped with OpenSSH will be used.
-        '';
-      };
-
     };
 
     users.users = lib.mkOption {
@@ -770,14 +772,12 @@ in
       };
       users.groups.sshd = { };
 
-      services.openssh.moduliFile = lib.mkDefault "${cfg.package}/etc/ssh/moduli";
       services.openssh.sftpServerExecutable = lib.mkDefault "${cfg.package}/libexec/sftp-server";
 
       environment.etc =
         authKeysFiles
         // authPrincipalsFiles
         // {
-          "ssh/moduli".source = cfg.moduliFile;
           "ssh/sshd_config".source = sshconf;
         };
 

nixos/modules/services/networking/technitium-dns-server.nix

@@ -65,6 +65,7 @@ in
         DynamicUser = true;
 
         StateDirectory = "technitium-dns-server";
+        LogsDirectory = "technitium";
 
         Restart = "always";
         RestartSec = 10;
@@ -102,5 +103,8 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ fabianrig ];
+  meta.maintainers = with lib.maintainers; [
+    fabianrig
+    awildleon
+  ];
 }

nixos/modules/services/networking/tetrd.nix

@@ -5,13 +5,19 @@
   ...
 }:
 
+let
+  cfg = config.services.tetrd;
+in
 {
-  options.services.tetrd.enable = lib.mkEnableOption "tetrd";
+  options.services.tetrd = {
+    enable = lib.mkEnableOption "tetrd";
+    package = lib.mkPackageOption pkgs "tetrd" { };
+  };
 
-  config = lib.mkIf config.services.tetrd.enable {
+  config = lib.mkIf cfg.enable {
     environment = {
-      systemPackages = [ pkgs.tetrd ];
-      etc."resolv.conf".source = "/etc/tetrd/resolv.conf";
+      systemPackages = [ cfg.package ];
+      # etc."resolv.conf".source = "/etc/tetrd/resolv.conf"; # Disabled overwriting of resolve.conf since otherwise tetrd disables your dns when its not connected to a device.
     };
 
     # Our resolv.conf will override resolvconf's version.
@@ -21,11 +27,11 @@
       tmpfiles.rules = [ "f /etc/tetrd/resolv.conf - - -" ];
 
       services.tetrd = {
-        description = pkgs.tetrd.meta.description;
+        description = cfg.package.meta.description;
         wantedBy = [ "multi-user.target" ];
 
         serviceConfig = {
-          ExecStart = "${pkgs.tetrd}/opt/Tetrd/bin/tetrd";
+          ExecStart = "${cfg.package}/opt/Tetrd/bin/tetrd";
           Restart = "always";
           RuntimeDirectory = "tetrd";
           RootDirectory = "/run/tetrd";

nixos/modules/services/networking/zeronet.nix

@@ -96,13 +96,13 @@ with lib;
   config = mkIf cfg.enable {
     services.tor = mkIf cfg.tor {
       enable = true;
-      controlPort = 9051;
 
-      extraConfig = ''
-        CacheDirectoryGroupReadable 1
-        CookieAuthentication 1
-        CookieAuthFileGroupReadable 1
-      '';
+      settings = {
+        ControlPort = 9051;
+        CacheDirectoryGroupReadable = true;
+        CookieAuthentication = true;
+        CookieAuthFileGroupReadable = true;
+      };
     };
 
     systemd.services.zeronet = {

nixos/modules/services/security/authelia.nix

@@ -268,15 +268,6 @@ let
       };
     };
 
-  writeOidcJwksConfigFile =
-    oidcIssuerPrivateKeyFile:
-    pkgs.writeText "oidc-jwks.yaml" ''
-      identity_providers:
-        oidc:
-          jwks:
-            - key: {{ secret "${oidcIssuerPrivateKeyFile}" | mindent 10 "|" | msquote }}
-    '';
-
   # Remove an attribute in a nested set
   # https://discourse.nixos.org/t/modify-an-attrset-in-nix/29919/5
   removeAttrByPath =
@@ -362,7 +353,12 @@ in
           execCommand = "${instance.package}/bin/authelia";
           configFile = format.generate "config.yml" cleanedSettings;
           oidcJwksConfigFile = lib.optional (instance.secrets.oidcIssuerPrivateKeyFile != null) (
-            writeOidcJwksConfigFile instance.secrets.oidcIssuerPrivateKeyFile
+            pkgs.writeText "oidc-jwks.yaml" ''
+              identity_providers:
+                oidc:
+                  jwks:
+                    - key: {{ mustEnv "CREDENTIALS_DIRECTORY" | printf "%s/oidcIssuerPrivateKeyFile" | secret | mindent 10 "|" | msquote }}
+            ''
           );
           configArg = "--config ${
             builtins.concatStringsSep "," (
@@ -373,21 +369,25 @@ in
               ]
             )
           }";
+          # Mapping between the Authelia env variables and the secret keys defined in the module
+          envSecretsMap = {
+            AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE = "jwtSecretFile";
+            AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = "storageEncryptionKeyFile";
+            AUTHELIA_SESSION_SECRET_FILE = "sessionSecretFile";
+            AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = "oidcHmacSecretFile";
+          };
+          nonNullEnvSecretsMap = lib.filterAttrs (_: v: instance.secrets.${v} != null) envSecretsMap;
         in
         {
           description = "Authelia authentication and authorization server";
           wantedBy = [ "multi-user.target" ];
           after = [ "network-online.target" ]; # Checks SMTP notifier creds during startup
           wants = [ "network-online.target" ];
-          environment =
-            (lib.filterAttrs (_: v: v != null) {
-              X_AUTHELIA_CONFIG_FILTERS = lib.mkIf (oidcJwksConfigFile != [ ]) "template";
-              AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE = instance.secrets.jwtSecretFile;
-              AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = instance.secrets.storageEncryptionKeyFile;
-              AUTHELIA_SESSION_SECRET_FILE = instance.secrets.sessionSecretFile;
-              AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = instance.secrets.oidcHmacSecretFile;
-            })
-            // instance.environmentVariables;
+          environment = {
+            X_AUTHELIA_CONFIG_FILTERS = lib.mkIf (oidcJwksConfigFile != [ ]) "template";
+          }
+          // lib.mapAttrs (_: v: "%d/${v}") nonNullEnvSecretsMap
+          // instance.environmentVariables;
 
           preStart = "${execCommand} ${configArg} validate-config";
           serviceConfig = {
@@ -399,6 +399,12 @@ in
             StateDirectory = autheliaName instance.name;
             StateDirectoryMode = "0700";
 
+            LoadCredential =
+              lib.optional (
+                instance.secrets.oidcIssuerPrivateKeyFile != null
+              ) "oidcIssuerPrivateKeyFile:${instance.secrets.oidcIssuerPrivateKeyFile}"
+              ++ lib.mapAttrsToList (_: v: "${v}:${instance.secrets.${v}}") nonNullEnvSecretsMap;
+
             # Security options:
             AmbientCapabilities = "";
             CapabilityBoundingSet = "";

nixos/modules/services/security/vaultwarden/default.nix

@@ -173,6 +173,7 @@ in
     domain = lib.mkOption {
       type = with lib.types; nullOr str;
       default = null;
+      example = "bitwarden.example.com";
       description = "The domain under which VaultWarden will be reachable.";
     };
 

nixos/modules/services/system/userborn.nix

@@ -86,7 +86,7 @@ in
         The primary motivation for this is an immutable `/etc`, where we cannot
         write the files directly to `/etc`.
 
-        However this an also serve other use cases, e.g. when `/etc` is on a `tmpfs`.
+        However this can also serve other use cases, e.g. when `/etc` is on a `tmpfs`.
       '';
     };
 

nixos/modules/services/torrent/rtorrent.nix

@@ -149,13 +149,6 @@ in
 
       protocol.encryption.set = allow_incoming,try_outgoing,enable_retry
 
-      # Limits for file handle resources, this is optimized for
-      # an `ulimit` of 1024 (a common default). You MUST leave
-      # a ceiling of handles reserved for rTorrent's internal needs!
-      network.http.max_open.set = 50
-      network.max_open_files.set = 600
-      network.max_open_sockets.set = 3000
-
       # Memory resource usage (increase if you have a large number of items loaded,
       # and/or the available resources to spend)
       pieces.memory.max.set = 1800M
@@ -169,15 +162,14 @@ in
       execute.nothrow = sh, -c, (cat, "echo >", (session.path), "rtorrent.pid", " ", (system.pid))
 
       # Other operational settings (check & adapt)
-      encoding.add = utf8
       system.umask.set = 0027
       system.cwd.set = (cfg.basedir)
       network.http.dns_cache_timeout.set = 25
-      schedule2 = monitor_diskspace, 15, 60, ((close_low_diskspace, 1000M))
+      schedule = monitor_diskspace, 15, 60, ((close_low_diskspace, 1000M))
 
       # Watch directories (add more as you like, but use unique schedule names)
-      #schedule2 = watch_start, 10, 10, ((load.start, (cat, (cfg.watch), "start/*.torrent")))
-      #schedule2 = watch_load, 11, 10, ((load.normal, (cat, (cfg.watch), "load/*.torrent")))
+      #schedule = watch_start, 10, 10, ((load.start, (cat, (cfg.watch), "start/*.torrent")))
+      #schedule = watch_load, 11, 10, ((load.normal, (cat, (cfg.watch), "load/*.torrent")))
 
       # Logging:
       #   Levels = critical error warn notice info debug
@@ -218,6 +210,10 @@ in
               RuntimeDirectory = "rtorrent";
               RuntimeDirectoryMode = 750;
 
+              # rtorrent derives socket limits from this value since 0.16.15; see table in
+              # https://github.com/rakshasa/rtorrent/wiki/Socket-Manager-and-Resource-Allocation
+              LimitNOFILE = lib.mkDefault 16384;
+
               CapabilityBoundingSet = [ "" ];
               LockPersonality = true;
               NoNewPrivileges = true;

nixos/modules/services/ttys/kmscon.nix

@@ -214,7 +214,7 @@ in
           {
             name = "unix";
             control = "required";
-            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+            modulePath = config.security.pam.pam_unixModulePath;
           }
         ];
         session = utils.pam.autoOrderRules [
@@ -230,7 +230,7 @@ in
           {
             name = "unix";
             control = "required";
-            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+            modulePath = config.security.pam.pam_unixModulePath;
           }
           {
             name = "systemd";

nixos/modules/services/wayland/cage.nix

@@ -113,7 +113,7 @@ in
           {
             name = "unix";
             control = "required";
-            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+            modulePath = config.security.pam.pam_unixModulePath;
             settings.nullok = true;
           }
         ];
@@ -121,14 +121,14 @@ in
           {
             name = "unix";
             control = "required";
-            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+            modulePath = config.security.pam.pam_unixModulePath;
           }
         ];
         session = utils.pam.autoOrderRules [
           {
             name = "unix";
             control = "required";
-            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
+            modulePath = config.security.pam.pam_unixModulePath;
           }
           {
             name = "env";

nixos/modules/services/web-apps/bentopdf.nix

@@ -60,7 +60,7 @@ in
     services.nginx = lib.mkIf cfg.nginx.enable {
       enable = lib.mkDefault true;
       virtualHosts."${cfg.domain}" = lib.mkMerge [
-        cfg.nginx.virtualHost
+        (lib.mapAttrsRecursive (_: lib.mkDefault) cfg.nginx.virtualHost)
         {
           root = lib.mkForce "${cfg.package}";
 
@@ -82,7 +82,7 @@ in
     services.caddy = lib.mkIf cfg.caddy.enable {
       enable = lib.mkDefault true;
       virtualHosts."${cfg.domain}" = lib.mkMerge [
-        cfg.caddy.virtualHost
+        (lib.mapAttrsRecursive (_: lib.mkDefault) cfg.caddy.virtualHost)
         {
           hostName = lib.mkForce cfg.domain;
           extraConfig = ''

nixos/modules/services/web-apps/flarum.nix

@@ -10,16 +10,23 @@ with lib;
 let
   cfg = config.services.flarum;
 
+  # Only placeholders reach the world-readable Nix store; the install
+  # script substitutes the real secrets at runtime.
   flarumInstallConfig = pkgs.writeText "config.json" (
     builtins.toJSON {
       debug = false;
       offline = false;
 
       baseUrl = cfg.baseUrl;
-      databaseConfiguration = cfg.database;
+      databaseConfiguration =
+        cfg.database
+        // optionalAttrs (cfg.databasePasswordFile != null) {
+          password = "@databasePassword@";
+        };
       adminUser = {
         username = cfg.adminUser;
-        password = cfg.initialAdminPassword;
+        password =
+          if cfg.initialAdminPasswordFile != null then "@adminPassword@" else cfg.initialAdminPassword;
         email = cfg.adminEmail;
       };
       settings = {
@@ -69,7 +76,26 @@ in
     initialAdminPassword = mkOption {
       type = types.str;
       default = "flarum";
-      description = "Initial password for the adminUser";
+      description = ''
+        Initial password for the adminUser.
+
+        WARNING: This is stored world-readable in the Nix store.
+        Use {option}`initialAdminPasswordFile` instead.
+      '';
+    };
+
+    initialAdminPasswordFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/flarum-admin-password";
+      description = ''
+        File containing the initial password for adminUser.
+        Must be readable by the flarum user.
+        Takes precedence over {option}`initialAdminPassword`.
+
+        The password must not contain `"` or `\` characters, as it is
+        substituted into a JSON installation config verbatim.
+      '';
     };
 
     user = mkOption {
@@ -98,7 +124,12 @@ in
           bool
           int
         ]);
-      description = "MySQL database parameters";
+      description = ''
+        MySQL database parameters.
+
+        WARNING: A `password` set here is stored world-readable in the
+        Nix store. Use {option}`databasePasswordFile` instead.
+      '';
       default = {
         # the database driver; i.e. MySQL; MariaDB...
         driver = "mysql";
@@ -118,6 +149,20 @@ in
       };
     };
 
+    databasePasswordFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/flarum-db-password";
+      description = ''
+        File containing the database password.
+        Must be readable by the flarum user.
+        Takes precedence over `database.password`.
+
+        The password must not contain `"` or `\` characters, as it is
+        substituted into a JSON installation config verbatim.
+      '';
+    };
+
     createDatabaseLocally = mkOption {
       type = types.bool;
       default = false;
@@ -210,6 +255,8 @@ in
         Type = "oneshot";
         User = cfg.user;
         Group = cfg.group;
+        # The secret-filled install config is staged in /tmp
+        PrivateTmp = true;
       };
       path = [ config.services.phpfpm.phpPackage ];
       script = ''
@@ -222,7 +269,18 @@ in
       ''
       + optionalString (cfg.createDatabaseLocally && cfg.database.driver == "mysql") ''
         if [ ! -f config.php ]; then
-          php flarum install --file=${flarumInstallConfig}
+          install -m 0600 ${flarumInstallConfig} /tmp/flarum-install.json
+          ${optionalString (cfg.initialAdminPasswordFile != null) ''
+            ${pkgs.replace-secret}/bin/replace-secret '@adminPassword@' \
+              ${escapeShellArg cfg.initialAdminPasswordFile} /tmp/flarum-install.json
+          ''}
+          ${optionalString (cfg.databasePasswordFile != null) ''
+            ${pkgs.replace-secret}/bin/replace-secret '@databasePassword@' \
+              ${escapeShellArg cfg.databasePasswordFile} /tmp/flarum-install.json
+          ''}
+          php flarum install --file=/tmp/flarum-install.json
+          # config.php contains the database password; stateDir is world-readable
+          chmod 600 config.php
         fi
       ''
       + ''