Merge staging-next into staging

This release series has reached its projected end of life.

.github/workflows/lint.yml

@@ -130,7 +130,7 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
-            const { default: checkCommitMessages } = await import('${{ github.workspace }}/trusted/ci/github-script/lint-commits.js')
+            const { default: checkCommitMessages } = await import('${{ github.workspace }}/trusted/ci/github-script/lint-commits.ts')
 
             await checkCommitMessages({
               github,

.github/workflows/merge-group.yml

@@ -38,8 +38,8 @@ jobs:
           TARGET_SHA: ${{ inputs.targetSha }}
         with:
           script: |
-            const { classify } = await import('${{ github.workspace }}/ci/github-script/supportedBranches.js')
-            const { default: supportedSystems } = await import('${{ github.workspace }}/ci/github-script/supportedSystems.js')
+            const { classify } = await import('${{ github.workspace }}/ci/github-script/supportedBranches.ts')
+            const { default: supportedSystems } = await import('${{ github.workspace }}/ci/github-script/supportedSystems.ts')
 
             const baseBranch = (
               context.payload.merge_group?.base_ref ??

.github/workflows/test.yml

@@ -64,8 +64,8 @@ jobs:
               '.github/workflows/test.yml',
               'ci/github-script/package.json',
               'ci/github-script/package-lock.json',
-              'ci/github-script/supportedBranches.js',
-              'ci/github-script/supportedSystems.js',
+              'ci/github-script/supportedBranches.ts',
+              'ci/github-script/supportedSystems.ts',
               'ci/pinned.json',
               'pkgs/top-level/release-supported-systems.json',
             ].includes(file))) core.setOutput('merge-group', true)
@@ -82,8 +82,8 @@ jobs:
               'ci/github-script/bot.js',
               'ci/github-script/check-target-branch.ts',
               'ci/github-script/commits.ts',
-              'ci/github-script/get-pr-commit-details.js',
-              'ci/github-script/lint-commits.js',
+              'ci/github-script/get-pr-commit-details.ts',
+              'ci/github-script/lint-commits.ts',
               'ci/github-script/manual-file-edits.ts',
               'ci/github-script/merge.js',
               'ci/github-script/package.json',
@@ -91,9 +91,9 @@ jobs:
               'ci/github-script/prepare.js',
               'ci/github-script/reminders.ts',
               'ci/github-script/reviewers.js',
-              'ci/github-script/reviews.js',
-              'ci/github-script/supportedBranches.js',
-              'ci/github-script/supportedSystems.js',
+              'ci/github-script/reviews.ts',
+              'ci/github-script/supportedBranches.ts',
+              'ci/github-script/supportedSystems.ts',
               'ci/github-script/withRateLimit.js',
               'ci/pinned.json',
               'pkgs/top-level/release-supported-systems.json',

ci/OWNERS

@@ -444,9 +444,9 @@ nixos/tests/forgejo.nix               @adamcstephens @bendlas @christoph-heiss @
 /doc/hooks/zig.section.md       @RossComputerGuy
 
 # Buildbot
-nixos/modules/services/continuous-integration/buildbot @Mic92 @zowoq
-nixos/tests/buildbot.nix                               @Mic92 @zowoq
-pkgs/development/tools/continuous-integration/buildbot @Mic92 @zowoq
+nixos/modules/services/continuous-integration/buildbot @Mic92
+nixos/tests/buildbot.nix                               @Mic92
+pkgs/development/tools/continuous-integration/buildbot @Mic92
 
 # Pretix
 pkgs/by-name/pr/pretix/ @mweinelt

ci/README.md

@@ -104,7 +104,7 @@ For the purposes of CI, branches in the NixOS/nixpkgs repository are classified
 
 Some branches also have a version component, which is either `unstable` or `YY.MM`.
 
-`ci/github-script/supportedBranches.js` is a script imported by CI to classify the base and head branches of a Pull Request.
+`ci/github-script/supportedBranches.ts` is a script imported by CI to classify the base and head branches of a Pull Request.
 This classification will then be used to skip certain jobs.
 This script can also be run locally to print basic test cases.
 

ci/github-script/bot.js

@@ -4,7 +4,7 @@ import path from 'node:path'
 import { DefaultArtifactClient } from '@actions/artifact'
 import { handleMerge } from './merge.js'
 import { handleReviewers } from './reviewers.js'
-import { classify } from './supportedBranches.js'
+import { classify } from './supportedBranches.ts'
 import withRateLimit from './withRateLimit.js'
 
 export default async ({ github, context, core, dry }) => {

ci/github-script/check-target-branch-policy.ts

@@ -1,4 +1,4 @@
-import { classify, split } from './supportedBranches.js'
+import { classify, split } from './supportedBranches.ts'
 
 type TargetBranchPolicyFacts = {
   base: string

ci/github-script/check-target-branch.ts

@@ -6,8 +6,8 @@ import {
   evaluateTargetBranchPolicy,
   getTargetBranchPolicy,
 } from './check-target-branch-policy.ts'
-import { dismissReviews, postReview } from './reviews.js'
-import { split } from './supportedBranches.js'
+import { dismissReviews, postReview } from './reviews.ts'
+import { split } from './supportedBranches.ts'
 
 // TODO: should this be combined with the branch checks in prepare.js?
 // They do seem quite similar, but this needs to run after eval,

ci/github-script/commits.ts

@@ -2,8 +2,8 @@ import { execFileSync } from 'node:child_process'
 import type * as actionsCore from '@actions/core'
 import type { context as actionsContext } from '@actions/github'
 import type { GitHub } from '@actions/github/lib/utils'
-import { dismissReviews, postReview } from './reviews.js'
-import { classify } from './supportedBranches.js'
+import { dismissReviews, postReview } from './reviews.ts'
+import { classify } from './supportedBranches.ts'
 import withRateLimit from './withRateLimit.js'
 
 const dirname = import.meta.dirname

ci/github-script/get-pr-commit-details.ts

@@ -3,26 +3,23 @@ import { promisify } from 'node:util'
 
 const execFile = promisify(nodeExecFile)
 
-/**
- * @typedef {{
- *  subject: string,
- *  sha: string,
- *  author: { name: string, email: string },
- *  committer: { name: string, email: string}
- *  changedPaths: string[],
- *  changedPathSegments: Set<string>,
- * }} Commit
- */
+export type Commit = {
+  subject: string
+  sha: string
+  author: { name: string; email: string }
+  committer: { name: string; email: string }
+  changedPaths: string[]
+  changedPathSegments: Set<string>
+}
 
-/**
- * @param {{
- *  args: string[]
- *  core: typeof import('@actions/core'),
- *  quiet?: boolean,
- *  repoPath?: string,
- * }} RunGitProps
- */
-async function runGit({ args, repoPath, core, quiet }) {
+interface RunGitProps {
+  args: string[]
+  core: typeof import('@actions/core')
+  quiet?: boolean
+  repoPath?: string
+}
+
+async function runGit({ args, repoPath, core, quiet }: RunGitProps) {
   if (repoPath) {
     args = ['-C', repoPath, ...args]
   }
@@ -34,21 +31,29 @@ async function runGit({ args, repoPath, core, quiet }) {
   return await execFile('git', args)
 }
 
+interface GetCommitMessagesForPRProps {
+  core: typeof import('@actions/core')
+  pr: Awaited<
+    ReturnType<
+      InstanceType<
+        typeof import('@actions/github/lib/utils').GitHub
+      >['rest']['pulls']['get']
+    >
+  >['data']
+  repoPath?: string
+}
+
 /**
  * Gets the SHA, subject and changed files for each commit in the given PR.
  *
  * Don't use GitHub API at all: the "list commits on PR" endpoint has a limit
  * of 250 commits and doesn't return the changed files.
- *
- * @param {{
- *  core: typeof import('@actions/core'),
- *  pr: Awaited<ReturnType<InstanceType<typeof import('@actions/github/lib/utils').GitHub>["rest"]["pulls"]["get"]>>["data"]
- *  repoPath?: string,
- * }} GetCommitMessagesForPRProps
- *
- * @returns {Promise<Commit[]>}
  */
-export async function getCommitDetailsForPR({ core, pr, repoPath }) {
+export async function getCommitDetailsForPR({
+  core,
+  pr,
+  repoPath,
+}: GetCommitMessagesForPRProps): Promise<Commit[]> {
   await runGit({
     args: ['fetch', `--depth=1`, 'origin', pr.base.sha],
     repoPath,

ci/github-script/lint-commits.ts

@@ -1,17 +1,23 @@
-import { getCommitDetailsForPR } from './get-pr-commit-details.js'
-import { classify } from './supportedBranches.js'
+import { type Commit, getCommitDetailsForPR } from './get-pr-commit-details.ts'
+import { classify } from './supportedBranches.ts'
 
-/** @typedef {import('./get-pr-commit-details.js').Commit} Commit */
+type GitHub = InstanceType<typeof import('@actions/github/lib/utils').GitHub>
+type Context = typeof import('@actions/github').context
+type Core = typeof import('@actions/core')
 
-/**
- * @param {{
- *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
- *  context: typeof import('@actions/github').context,
- *  core: typeof import('@actions/core'),
- *  repoPath?: string,
- * }} LintCommitsProps
- */
-export default async function lintCommits({ github, context, core, repoPath }) {
+interface LintCommitsProps {
+  github: GitHub
+  context: Context
+  core: Core
+  repoPath?: string
+}
+
+export default async function lintCommits({
+  github,
+  context,
+  core,
+  repoPath,
+}: LintCommitsProps) {
   // This check should only be run when we have the pull_request context.
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
@@ -53,13 +59,15 @@ export default async function lintCommits({ github, context, core, repoPath }) {
   await checkCommitMetadata({ commits, core })
 }
 
-/**
- * @param {{
- *  commits: Commit[],
- *  core: typeof import('@actions/core'),
- * }} CheckCommitMessagesProps
- */
-async function checkCommitMessages({ commits, core }) {
+interface CheckCommitMessagesProps {
+  commits: Commit[]
+  core: Core
+}
+
+async function checkCommitMessages({
+  commits,
+  core,
+}: CheckCommitMessagesProps) {
   const failures = new Set()
 
   const conventionalCommitTypes = [
@@ -80,10 +88,13 @@ async function checkCommitMessages({ commits, core }) {
   ]
 
   /**
-   * @param {string[]} types e.g. ["fix", "feat"]
-   * @param {string?} sha commit hash
+   * @param types e.g. ["fix", "feat"]
+   * @param sha commit hash
    */
-  function makeConventionalCommitRegex(types, sha = null) {
+  function makeConventionalCommitRegex(
+    types: string[],
+    sha: string | null = null,
+  ) {
     core.info(
       `${
         sha
@@ -166,17 +177,15 @@ async function checkCommitMessages({ commits, core }) {
   }
 }
 
-/**
- * @param {{
- *  commits: Commit[],
- *  core: typeof import('@actions/core'),
- * }} CheckGitFieldsProps
- */
-async function checkCommitMetadata({ commits, core }) {
+interface CheckGitFieldsProps {
+  commits: Commit[]
+  core: Core
+}
+
+async function checkCommitMetadata({ commits, core }: CheckGitFieldsProps) {
   const failures = new Set()
 
-  /** @type {(s: string) => boolean} */
-  const isEmail = (s) => /^.+@.*$/.test(s)
+  const isEmail = (s: string) => /^.+@.*$/.test(s)
 
   for (const commit of commits) {
     if (!commit.author.name) {

ci/github-script/manual-file-edits.ts

@@ -1,6 +1,6 @@
-import { getCommitDetailsForPR } from './get-pr-commit-details.js'
-import { dismissReviews, postReview } from './reviews.js'
-import { classify } from './supportedBranches.js'
+import { getCommitDetailsForPR } from './get-pr-commit-details.ts'
+import { dismissReviews, postReview } from './reviews.ts'
+import { classify } from './supportedBranches.ts'
 
 export default async function checkManualFileEdits({
   github,

ci/github-script/merge.js

@@ -1,5 +1,5 @@
 // @ts-nocheck
-import { classify } from './supportedBranches.js'
+import { classify } from './supportedBranches.ts'
 
 function runChecklist({
   committers,

ci/github-script/prepare.js

@@ -1,7 +1,7 @@
 // @ts-nocheck
-import { dismissReviews, postReview } from './reviews.js'
-import { classify } from './supportedBranches.js'
-import supportedSystems from './supportedSystems.js'
+import { dismissReviews, postReview } from './reviews.ts'
+import { classify } from './supportedBranches.ts'
+import supportedSystems from './supportedSystems.ts'
 
 const reviewKey = 'prepare'
 
@@ -66,7 +66,7 @@ export default async ({ github, context, core, dry }) => {
       // commits between that base and head is the real base. We can query for this via GitHub's
       // REST API. There can be multiple candidates for the real base with the same number of
       // commits. In this case we pick the "best" candidate by a fixed ordering of branches,
-      // as defined in ci/github-script/supportedBranches.js.
+      // as defined in ci/github-script/supportedBranches.ts.
       //
       // These requests take a while, when comparing against the wrong release - they need
       // to look at way more than 10k commits in that case. Thus, we try to minimize the

ci/github-script/reminders.ts

@@ -3,9 +3,9 @@ import path from 'node:path'
 import type * as actionsCore from '@actions/core'
 import type { context as actionsContext } from '@actions/github'
 import type { GitHub } from '@actions/github/lib/utils'
-import { getCommitDetailsForPR } from './get-pr-commit-details.js'
-import { dismissReviews, postReview } from './reviews.js'
-import { classify } from './supportedBranches.js'
+import { getCommitDetailsForPR } from './get-pr-commit-details.ts'
+import { dismissReviews, postReview } from './reviews.ts'
+import { classify } from './supportedBranches.ts'
 
 /**
  * Reminders to post as a non-blocking review when a pull request touches

ci/github-script/reminders/docs-styleguide.md

@@ -1,6 +1,6 @@
 Thanks for contributing to the documentation
 
-Make sure you follow the [documentation styleguide](https://github.com/NixOS/nixpkgs/blob/master/doc/styleguide.md), most notably:
+Make sure you follow the [documentation style guide](https://github.com/NixOS/nixpkgs/blob/master/doc/styleguide.md), most notably:
 
 - Show, don't tell: lead with a minimal working example; explanation follows the code.
 - No meta-commentary: don't write "This section explains how to…", just do it.

ci/github-script/reviews.ts

@@ -13,30 +13,28 @@ const reviewUsers = [
   'manual-edit',
 ]
 
-/**
- * @typedef {InstanceType<typeof import('@actions/github/lib/utils').GitHub>} GitHub
- * @typedef {typeof import('@actions/github').context} Context
- *
- * @typedef {Awaited<ReturnType<GitHub['rest']['pulls']['listReviews']>>['data'][number]} Review
- * @typedef {Review & { user: NonNullable<Review['user']> }} ReviewWithNonNullUser
- */
+type GitHub = InstanceType<typeof import('@actions/github/lib/utils').GitHub>
+type Context = typeof import('@actions/github').context
+type Review = Awaited<
+  ReturnType<GitHub['rest']['pulls']['listReviews']>
+>['data'][number]
+type ReviewWithNonNullUser = Review & { user: NonNullable<Review['user']> }
+
+interface DismissReviewsProps {
+  github: GitHub
+  context: Context
+  core: typeof import('@actions/core')
+  dry: boolean
+  reviewKey?: string
+}
 
-/**
- * @param {{
- *  github: GitHub,
- *  context: Context,
- *  core: typeof import('@actions/core'),
- *  dry: boolean,
- *  reviewKey?: string,
- * }} DismissReviewsProps
- */
 export async function dismissReviews({
   github,
   context,
   core,
   dry,
   reviewKey,
-}) {
+}: DismissReviewsProps) {
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
     core.warning('dismissReviews called outside of pull_request context')
@@ -47,23 +45,29 @@ export async function dismissReviews({
     return
   }
 
-  const allReviews = await github.paginate(github.rest.pulls.listReviews, {
-    ...context.repo,
-    pull_number,
-  })
+  const allReviews: Review[] = await github.paginate(
+    github.rest.pulls.listReviews,
+    {
+      ...context.repo,
+      pull_number,
+    },
+  )
 
-  const reviews = /** @type {ReviewWithNonNullUser[]} */ (
-    allReviews.filter(
+  const reviews = allReviews
+    .filter((review): review is ReviewWithNonNullUser => !!review.user)
+    .filter(
       (review) =>
-        review.user &&
         review.state !== 'DISMISSED' &&
         review.user.login.endsWith('[bot]') &&
         reviewUsers.some((substr) => review.user?.login.includes(substr)),
     )
-  )
 
   const reviewsByUser = reviews.reduce(
     (prev, curr) => {
+      if (!curr.user) {
+        return prev
+      }
+
       if (!(curr.user.login in prev)) {
         prev[curr.user.login] = []
       }
@@ -72,7 +76,7 @@ export async function dismissReviews({
 
       return prev
     },
-    /** @type {Record<string, ReviewWithNonNullUser[]> } */ ({}),
+    {} as Record<string, ReviewWithNonNullUser[]>,
   )
 
   const commentRegex = new RegExp(
@@ -86,8 +90,8 @@ export async function dismissReviews({
   )
 
   let reviewsToMinimize = reviews
-  const /** @type {ReviewWithNonNullUser[]} */ reviewsToDismiss = []
-  const /** @type {ReviewWithNonNullUser[]} */ reviewsToResolve = []
+  const reviewsToDismiss: ReviewWithNonNullUser[] = []
+  const reviewsToResolve: ReviewWithNonNullUser[] = []
 
   if (reviewKey && reviews.every((review) => commentRegex.test(review.body))) {
     reviewsToMinimize = reviews.filter((review) =>
@@ -165,17 +169,16 @@ export async function dismissReviews({
   ])
 }
 
-/**
- * @param {{
- *  github: GitHub,
- *  context: Context,
- *  core: typeof import('@actions/core'),
- *  dry: boolean,
- *  body: string,
- *  event: keyof typeof eventToState,
- *  reviewKey: string,
- * }} PostReviewProps
- */
+interface PostReviewProps {
+  github: GitHub
+  context: Context
+  core: typeof import('@actions/core')
+  dry: boolean
+  body: string
+  event: keyof typeof eventToState
+  reviewKey: string
+}
+
 export async function postReview({
   github,
   context,
@@ -184,7 +187,7 @@ export async function postReview({
   body,
   event = 'REQUEST_CHANGES',
   reviewKey,
-}) {
+}: PostReviewProps) {
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
     core.warning('postReview called outside of pull_request context')
@@ -210,8 +213,7 @@ export async function postReview({
       reviewUsers.some((substr) => review.user?.login.includes(substr)),
   )
 
-  /** @type {null | Review} */
-  let pendingReview
+  let pendingReview: null | Review
   const matchingReviews = reviews.filter((review) =>
     reviewKeyRegex.test(review.body),
   )

ci/github-script/run

@@ -101,7 +101,7 @@ program
   .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
   .argument('<pr>', 'Number of the Pull Request to run on')
   .action(async (owner, repo, pr, options) => {
-    const checkCommitMessages = (await import('./lint-commits.js')).default
+    const checkCommitMessages = (await import('./lint-commits.ts')).default
     await run(checkCommitMessages, owner, repo, pr, options)
   })
 

ci/github-script/supportedBranches.ts

@@ -2,11 +2,12 @@
 /*
 #!nix-shell -i node -p nodejs
 */
-// @ts-nocheck
 import { resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-const typeConfig = {
+type BranchType = 'channel' | 'development' | 'primary' | 'secondary'
+
+const typeConfig: Record<string, BranchType[]> = {
   master: ['development', 'primary'],
   release: ['development', 'primary'],
   staging: ['development', 'secondary'],
@@ -19,7 +20,7 @@ const typeConfig = {
 
 // "order" ranks the development branches by how likely they are the intended base branch
 // when they are an otherwise equally good fit according to ci/github-script/prepare.js.
-const orderConfig = {
+const orderConfig: Record<string, number> = {
   master: 0,
   release: 1,
   staging: 2,
@@ -28,15 +29,30 @@ const orderConfig = {
   'staging-next': 4,
 }
 
-function split(branch) {
-  return {
-    ...branch.match(
-      /(?<prefix>.+?)(-(?<version>\d{2}\.\d{2}|unstable)(?:-(?<suffix>.*))?)?$/,
-    ).groups,
-  }
+type Digit = 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9
+type Version = `${Digit}${Digit}.${Digit}${Digit}` | 'unstable'
+interface SplitResult {
+  prefix: string
+  version: Version
+  suffix?: string
 }
 
-function classify(branch) {
+function split(branch: string) {
+  const groups = branch.match(
+    /(?<prefix>.+?)(-(?<version>\d{2}\.\d{2}|unstable)(?:-(?<suffix>.*))?)?$/,
+  )!.groups!
+  return groups as unknown as SplitResult
+}
+
+interface BranchClassification {
+  branch: string
+  order: number
+  stable: boolean
+  type: BranchType[]
+  version: Version
+}
+
+function classify(branch: string): BranchClassification {
   const { prefix, version } = split(branch)
   return {
     branch,
@@ -55,7 +71,7 @@ if (
   fileURLToPath(import.meta.url) === resolve(process.argv[1])
 ) {
   console.log('split(branch)')
-  function testSplit(branch) {
+  function testSplit(branch: string) {
     console.log(branch, split(branch))
   }
   testSplit('master')
@@ -72,7 +88,7 @@ if (
   console.log('')
 
   console.log('classify(branch)')
-  function testClassify(branch) {
+  function testClassify(branch: string) {
     console.log(branch, classify(branch))
   }
   testClassify('master')

ci/github-script/supportedSystems.js

@@ -1,11 +0,0 @@
-// @ts-nocheck
-export default async ({ github, context, targetSha }) => {
-  const { content, encoding } = (
-    await github.rest.repos.getContent({
-      ...context.repo,
-      path: 'pkgs/top-level/release-supported-systems.json',
-      ref: targetSha,
-    })
-  ).data
-  return JSON.parse(Buffer.from(content, encoding).toString())
-}

ci/github-script/supportedSystems.ts

@@ -0,0 +1,30 @@
+interface SupportedSystemsProps {
+  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>
+  context: typeof import('@actions/github').context
+  targetSha: string
+}
+
+export default async ({
+  github,
+  context,
+  targetSha,
+}: SupportedSystemsProps) => {
+  const contentObject = (
+    await github.rest.repos.getContent({
+      ...context.repo,
+      path: 'pkgs/top-level/release-supported-systems.json',
+      ref: targetSha,
+    })
+  ).data
+
+  if ('type' in contentObject && contentObject.type === 'file') {
+    const { content, encoding } = contentObject
+    return JSON.parse(
+      Buffer.from(content, encoding as BufferEncoding).toString(),
+    )
+  } else {
+    throw new Error(
+      'Fetched pkgs/top-level/release-supported-systems.json is not a file',
+    )
+  }
+}

doc/README.md

@@ -7,19 +7,26 @@ This directory houses the source files for the Nixpkgs manual.
 > We are actively restructuring our documentation to be more beginner friendly.
 >
 
-When writing new docs use **Progressive Disclosure**
+When writing new docs use **Progressive Disclosure:**
 
-Start simple, pick up beginners.
-Use **examples** first to show how to get something done. Keep **Explanation** lean.
+- Start simple, pick up beginners.
+- Use **examples** first to show how to get something done.
+- Keep **explanation** lean.
 
-Use our [styleguide](./styleguide.md) for more in depth guidance on writing good documentation.
+Use our [style guide](./styleguide.md) for more in depth guidance on writing good documentation.
 
-Documentation about Nixpkgs belongs here, this includes 'getting-started'-guides and 'onboarding-guides' for *using* Nixpkgs and the language frameworks it ships.
+Documentation about Nixpkgs belongs here.
+This includes getting started guides and onboarding guides for *using* Nixpkgs and the language frameworks it ships.
 
 Write **guides** task-first: lead with a working example, then explain in prose.
 Write **reference** as the specification of functions and attributes.
 
-We are actively working to generate reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code, which also lets you view it locally with `:doc` in `nix repl`.
+We are actively working to generate reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code, which also lets you view it locally with the `:doc` command in `nix repl`, e.g.:
+
+```
+nix-repl> :l <nixpkgs>
+nix-repl> :doc lib.mapAttrsToList
+```
 
 See [Document structure](#document-structure) for a structural template.
 
@@ -42,23 +49,23 @@ If the build succeeds, the manual will be in `./result/share/doc/nixpkgs/manual.
 
 ### Development environment
 
-To reduce repetition, consider using tools from the provided development environment:
-
-Load it from the Nixpkgs documentation directory with
+To reduce repetition, consider using tools from the documentation development environment:
 
 ```ShellSession
 $ cd /path/to/nixpkgs/doc
 $ nix-shell
 ```
 
-To load the development utilities automatically when entering that directory, [set up `nix-direnv`](https://nix.dev/guides/recipes/direnv).
+To load the documentation development environment automatically when entering that directory:
 
-Make sure that your local files aren't added to Git history by adding the following lines to `.git/info/exclude` at the root of the Nixpkgs repository:
+1. Install [`nix-direnv`](https://search.nixos.org/packages?channel=unstable&query=nix-direnv#show=nix-direnv)
+1. Set up direnv in the documentation directory:
 
-```
-/**/.envrc
-/**/.direnv
-```
+   ```ShellSession
+   $ cd doc
+   $ echo "use nix" > .envrc
+   $ direnv allow
+   ```
 
 #### Live preview
 
@@ -133,14 +140,12 @@ A few markups for other kinds of literals are also available:
 - `` {env}`XDG_DATA_DIRS` ``
 - `` {file}`/etc/passwd` ``
 - `` {option}`networking.useDHCP` ``
-- `` {var}`/etc/passwd` ``
+- `` {var}`pkgs` ``
+
+The values will be formatted as inline `<code>` elements.
 
 These literal kinds are used mostly in NixOS option documentation.
 
-This syntax is taken from [MyST](https://myst-parser.readthedocs.io/en/latest/syntax/syntax.html#roles-an-in-line-extension-point).
-Though, the feature originates from [reStructuredText](https://www.sphinx-doc.org/en/master/usage/restructuredtext/roles.html#role-manpage) with slightly different syntax.
-They are handled by `myst_role` defined per renderer. <!-- reverse references in code -->
-
 #### Admonitions
 
 Set off from the text to bring attention to something.
@@ -163,7 +168,7 @@ The following are supported:
 - `example`
 
 Example admonitions require a title to work.
-If you don't provide one, the manual won't be built.
+If you don't provide one, the manual won't build.
 
 ```markdown
 ::: {.example #ex-showing-an-example}
@@ -179,11 +184,11 @@ Text for the example.
 For defining a group of terms:
 
 ```markdown
-pear
-:   green or yellow bulbous fruit
+Pear
+:   Green or yellow bulbous fruit
 
-watermelon
-:   green fruit with red flesh
+Watermelon
+:   Green fruit with red flesh
 ```
 
 ## Commit conventions
@@ -215,7 +220,7 @@ When needed, each convention explains why it exists, so you can make a decision
 Note that these conventions are about the **structure** of the manual (and its source files), not about the content that goes in it.
 You, as the writer of documentation, are still in charge of its content.
 
-**For prose style, see the [documentation styleguide](./styleguide.md).**
+**For prose style, see the [documentation style guide](./styleguide.md).**
 
 ### Document structure
 
@@ -285,7 +290,7 @@ When changing existing content, update formatting if possible, but avoid excessi
 
 ### Examples first
 
-Put examples before detailed explanations (see the [styleguide](./styleguide.md) for the rationale).
+Put examples before detailed explanations (see the [style guide](./styleguide.md) for the rationale).
 
 Use this structure for each documented item:
 

doc/getting-started/dev-environments.md

@@ -5,7 +5,7 @@ Create a `shell.nix` with the following:
 ```nix
 # shell.nix
 let
-  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
+  nixpkgs = fetchTarball "https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst";
   pkgs = import nixpkgs { };
 in
 pkgs.mkShell {
@@ -25,7 +25,7 @@ nix-shell
 This activates your `shell.nix` and you should see:
 
 ```sh
-unpacking 'https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz' into the Git cache...
+unpacking 'https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst' into the Git cache...
 Welcome in your nix shell
 ```
 

doc/getting-started/first-package.chapter.md

@@ -53,7 +53,7 @@ Pin Nixpkgs and call the package from `default.nix`:
 ```nix
 # default.nix
 let
-  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
+  nixpkgs = fetchTarball "https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst";
   pkgs = import nixpkgs { };
 in
 pkgs.callPackage ./package.nix { }

doc/hooks/check-phase-thread-limit-hook.section.md

@@ -3,7 +3,7 @@
 This hook defaults a variety of environment variables known
 to control thread counts to 1. Many of these otherwise default
 to `$(nproc)`, which causes massive overloads on build machines
-if nix build jobs and build cores are already tuned to fully utilize
+if nix build jobs and build cores are already tuned to fully use
 compute capacity of a builder without additional parallelism.
 
 Currently sets the following environment variables:

doc/hooks/guileImportsCheckHook.section.md

@@ -0,0 +1,28 @@
+# `guileImportsCheckHook` {#guileImportsCheckHook}
+
+This hook checks if a guile package can be imported. The hook is automatically
+propagated by `guile`, so using it is as simple as:
+
+```nix
+{
+  lib,
+  stdenv,
+  guile,
+  # ...
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  # ...
+
+  nativeBuildInputs = [ guile ];
+
+  guileImportsCheck = [
+    "package"
+  ];
+
+  # ...
+})
+```
+
+The `guileImportsCheckHook` package can also included manually in
+`nativeBuildInputs` if one desires.

doc/hooks/meson.section.md

@@ -92,3 +92,10 @@ Meson setup hook.
 - `prefixKey`
 - `enableParallelBuilding`
 - `enableParallelChecking`
+- `disabledTests`
+
+#### `disabledTests` {#meson-disabled-tests}
+
+Specifies a list of tests to skip in `mesonCheckPhase`.
+You can optionally specify a subproject using a colon prefix, e.g. `subproject:test_name`.
+Meson will pick up the main project name as a default if no subproject is specified.

doc/languages-frameworks/cosmic.section.md

@@ -5,7 +5,7 @@
 COSMIC (Computer Operating System Main Interface Components) is a desktop environment developed by
 System76, primarily for the Pop!_OS Linux distribution. Applications in the COSMIC ecosystem are
 written in Rust and use libcosmic, which builds on the Iced GUI framework. This section explains
-how to properly package and integrate COSMIC applications within Nix.
+how to package and integrate COSMIC applications within Nix.
 
 ### libcosmicAppHook {#ssec-cosmic-libcosmic-app-hook}
 
@@ -17,7 +17,7 @@ and wrapping applications based on libcosmic. It handles many common requirement
 - Managing Vergen environment variables for build-time information
 - Setting up Rust linker flags for specific libraries
 
-To use the hook, simply add it to your package's `nativeBuildInputs`:
+Add the hook to your package's `nativeBuildInputs`:
 
 ```nix
 {
@@ -61,8 +61,9 @@ rustPlatform.buildRustPackage {
 }
 ```
 
-Note that `cosmic-settings` is a separate application and not a part of the libcosmic settings
-system itself. It's included by default in `libcosmicAppHook` only to provide these fallback theme
+> [!Note]
+> `cosmic-settings` is a separate application and not a part of the libcosmic settings
+> system itself. It's included by default in `libcosmicAppHook` only to provide these fallback theme
 settings.
 
 ### Icons {#ssec-cosmic-icons}

doc/languages-frameworks/neovim.section.md

@@ -63,7 +63,7 @@ For instance, `sqlite-lua` needs `g:sqlite_clib_path` to be set to work. Nixpkgs
 - `wrapperArgs`: Extra arguments forwarded to the `makeWrapper` call.
 - `wrapRc`: Nix, not being able to write in your `$HOME`, loads the
   generated Neovim configuration via the `$VIMINIT` environment variable, i.e. : `export VIMINIT='lua dofile("/nix/store/…-init.lua")'`. This has side effects like preventing Neovim from sourcing your `init.lua` in `$XDG_CONFIG_HOME/nvim` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#startup) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse the generated vimscript init code via `neovim.passthru.initRc`.
-- `plugins`: A list of plugins to add to the wrapper.
+- `plugins`: A list of plugins to add to the wrapper. If a plugin is not available in nixpkgs, you can [package it yourself](#what-if-your-favourite-vim-plugin-isnt-already-packaged).
 - `extraLuaPackages`: A function passed on to `lua.withPackages`.
 - `extraPython3Packages`: A function passed on to `python3.withPackages`.
 - `withPython3`, `withNodeJs`, `withRuby`, `withPerl` control when to enable neovim

doc/languages-frameworks/swift.section.md

@@ -11,47 +11,86 @@ nix-shell -p swift --run 'swiftc -' <<< 'print("Hello world!")'
 
 The `swift` package also provides the `swift` command, with some caveats:
 
-- Swift Package Manager (SwiftPM) is packaged separately as `swiftpm`. If you
-  need functionality like `swift build`, `swift run`, `swift test`, you must
-  also add the `swiftpm` package to your closure.
-- On Darwin, the `swift repl` command requires an Xcode installation. This is
-  because it uses the system LLDB debugserver, which has special entitlements.
+- Swift Package Manager (SwiftPM) is packaged separately as `swiftpm`.
+  If you need functionality like `swift build`, `swift run`, `swift test`, you must also add the `swiftpm` package to your closure.
+- On Darwin, the `swift repl` command requires an Xcode installation.
+  This is because it uses the system LLDB debugserver, which has special entitlements.
 
 ## Module search paths {#ssec-swift-module-search-paths}
 
-Like other toolchains in Nixpkgs, the Swift compiler executables are wrapped
-to help Swift find your application's dependencies in the Nix store. These
-wrappers scan the `buildInputs` of your package derivation for specific
-directories where Swift modules are placed by convention, and automatically
-add those directories to the Swift compiler search paths.
+The Swift compiler executables are patched to find the C and C++ standard libraries associated with its target platform, but they are not wrapped.
+They will not find your application’s dependencies automatically in the Nix store.
+Your build system is expected to handle this for you.
 
-Swift follows different conventions depending on the platform. The wrappers
-look for the following directories:
+SwiftPM provides a hook that scans the `buildInputs` of your package derivation for specific directories where the Swift modules are placed by convention.
+These directories are added automatically to `swiftpmFlags` when the hook runs.
+Swift in Nixpkgs follows a few conventions when installing dependencies:
 
-- On Darwin platforms: `lib/swift/macosx`
-  (If not targeting macOS, replace `macosx` with the Xcode platform name.)
-- On other platforms: `lib/swift/linux/x86_64`
-  (Where `linux` and `x86_64` are from lowercase `uname -sm`.)
-- For convenience, Nixpkgs also adds `lib/swift` to the search path.
-  This can save a bit of work packaging Swift modules, because many Nix builds
-  will produce output for just one target anyway.
+- Libraries (both shared and static) are installed to `lib`.
+  This differs from upstream packaging, but it matches how other langauges are packaged in Nixpkgs.
+  This allows Swift packages to take advantage of existing tooling that expects libraries to be installed in this standard location.
+- Modules are installed to `lib/swift/<platform>` where `<platform>` is the Swift platform for your host platform (e.g., `lib/swift/macosx` or `lib/swift/linux`).
+  Note that Linux modules may be installed in a directory specific to the target architecture(e.g., `lib/swift/linux/x86_64`), but this is uncommon.
+  Upstream Swift appears to be moving away from this convention.
 
 ## Core libraries {#ssec-swift-core-libraries}
 
-In addition to the standard library, the Swift toolchain contains some
-additional 'core libraries' that, on Apple platforms, are normally distributed
-as part of the OS or Xcode. These are packaged separately in Nixpkgs and can
-be found (for use in `buildInputs`) as:
+The `swift` package contains a complete toolchain with the Swift stdlib, Dispatch, Foundation, XCTest, and Swift Testing.
+These packages do not need to  be added to `buildInputs` when packaging applications.
+The Swift compiler will  find them automatically in the `swift` toolchain.
 
-- `swiftPackages.Dispatch`
-- `swiftPackages.Foundation`
-- `swiftPackages.XCTest`
+If you do need to use these packages outside of the Swift toolchain, they are  available in the following packages:
+
+- `swiftPackages.stdlib` contains the Swift stdlib and backdeployment dylibs.
+- `swiftPackages.swift-corelibs-libdispatch` contains the Dispatch framework.
+- `swiftPackages.swift-corelibs-foundation` contains the Foundation framework.
+- `swiftPackages.swift-corelibs-xctest` and `swiftPackages.swift-testing` contain the XCTest and Swift Testing frameworks respectively.
+
+Note: On Darwin, the Swift stdlib has been removed from the SDK.
+The Swift toolchain contains the stubs and modules required to build Swift applications with the following exceptions:
+
+- Swift Differentiation is shipped as a dylib in Nixpkgs because it is no longer shipped with the OS (as of macOS 26.4).
+  This allows packages using Swift Differentiation to work regardless of OS version.
+- The Span back-deployment dylib is shipped with the stdlib.
+- This is expected because back-deployment dylibs are normally shipped with the toolchain.
+- FoundationMacros is built and shipped as a dylib in `swiftPackages.swift-foundation` and included in the toolchain.
+  Macros are actually compiler plugins executed at build time.
+  Without this, FoundationMacros would not work on Darwin.
 
 ## Packaging with SwiftPM {#ssec-swift-packaging-with-swiftpm}
 
-Nixpkgs includes a small helper `swiftpm2nix` that can fetch your SwiftPM
-dependencies for you, when you need to write a Nix expression to package your
-application.
+Nixpkgs includes two ways to package dependencies for Swift applications: `fetchSwiftPMDeps` and `swiftpm2nix`.
+While `swiftpm2nix` is not deprecated, using `fetchSwiftPMDeps` is preferred because it is easier to use and does not (usually) require shipping extra files with your package.
+
+### Packaging with `fetchSwiftPMDeps` {#ssec-swift-packaging-with-fetch-swiftpm-deps}
+
+Swift provides a fetcher that will download all of your dependencies based on the `Package.resolved` shipped by your package.
+If your package does not ship one, you will have to generate it yourself and provide it with your package.
+Otherwise, set `swiftpmDeps` as follows:
+
+```nix
+{
+  swiftpmDeps = fetchSwiftPMDeps {
+    inherit src;
+    hash = "sha256-1KfyrQXE1HaO9WsuskzgiiEZxM/oelp40Jwzr8xJEL4=";
+  };
+}
+```
+
+The `src` attribute is required as is the `hash`.
+The first time you build your  package, you will need to set `hash` to an empty value by using `lib.fakeHash` to get the hash for your dependencies.
+The following optional attributes can also be used:
+
+- `name`: Sets the name of the vendored dependencies fixed-output derivation.
+  You can also use `pname` and `version` to set the `name`.
+  This is often easier because you can inherit them from `finalAttrs`.
+- `sourceRoot`: Sets the path where `Package.swift` and `Package.resolved` can be found if they are not in their default, top-level location.
+- `patches`: Can be used to apply patches to your project before the dependencies are vendored.
+  This is useful to update `Package.swift` or `Package.resolved`.
+- `postPatch`: Can be used to perform extra steps after patching.
+  You can copy a custom `Package.resolved` in `postPatch`.
+
+### Packaging with `swiftpm2nix` {#ssec-swift-packaging-with-swiftpm2nix}
 
 The first step is to run the generator:
 
@@ -65,8 +104,8 @@ swift package resolve
 swiftpm2nix
 ```
 
-This produces some files in a directory `nix`, which will be part of your Nix
-expression. The next step is to write that expression:
+This produces some files in a directory `nix`, which will be part of your Nix  expression.
+The next step is to write that expression:
 
 ```nix
 {
@@ -126,45 +165,13 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
-### Custom build flags {#ssec-swiftpm-custom-build-flags}
+#### Patching dependencies {#ssec-swiftpm-patching-dependencies}
 
-If you'd like to build a different configuration than `release`:
+In some cases, it may be necessary to patch a SwiftPM dependency.
+SwiftPM dependencies are located in `.build/checkouts`, but the `swiftpm2nix` helper provides these as symlinks to read-only `/nix/store` paths.
+To patch them, we need to make them writable.
 
-```nix
-{ swiftpmBuildConfig = "debug"; }
-```
-
-It is also possible to provide additional flags to `swift build`:
-
-```nix
-{ swiftpmFlags = [ "--disable-dead-strip" ]; }
-```
-
-The default `buildPhase` already passes `-j` for parallel building.
-
-If these two customization options are insufficient, provide your own
-`buildPhase` that invokes `swift build`.
-
-### Running tests {#ssec-swiftpm-running-tests}
-
-Including `swiftpm` in your `nativeBuildInputs` also provides a default
-`checkPhase`, but it must be enabled with:
-
-```nix
-{ doCheck = true; }
-```
-
-This essentially runs: `swift test -c release`
-
-### Patching dependencies {#ssec-swiftpm-patching-dependencies}
-
-In some cases, it may be necessary to patch a SwiftPM dependency. SwiftPM
-dependencies are located in `.build/checkouts`, but the `swiftpm2nix` helper
-provides these as symlinks to read-only `/nix/store` paths. To patch
-them, we need to make them writable.
-
-A special function `swiftpmMakeMutable` is available to replace the symlink
-with a writable copy:
+A special function `swiftpmMakeMutable` is available to replace the symlink with a writable copy:
 
 ```nix
 {
@@ -183,21 +190,76 @@ with a writable copy:
 }
 ```
 
+### Custom build flags {#ssec-swiftpm-custom-build-flags}
+
+If you'd like to build a different configuration than `release`:
+
+```nix
+{ swiftpmBuildConfig = "debug"; }
+```
+
+It is also possible to provide additional flags to `swift build`:
+
+```nix
+{ swiftpmFlags = [ "--disable-dead-strip" ]; }
+```
+
+The default `buildPhase` already passes `-j` for parallel building.
+
+If these two customization options are insufficient, provide your own `buildPhase` that invokes `swift build`.
+
+### Running tests {#ssec-swiftpm-running-tests}
+
+Including `swiftpm` in your `nativeBuildInputs` also provides a default `checkPhase`, but it must be enabled with:
+
+```nix
+{ doCheck = true; }
+```
+
+This essentially runs: `swift test -c release`
+
+### Installing packages {#ssec-swiftpm-install-phase}
+
+SwiftPM provides a default install phase that installs any products specified in your package’s `Package.swift`.
+If your package does not specify any products, which is not uncommon, you will have to manually install them to `out`.
+To disable the SwiftPM install phase, include the following in your derivation:
+
+```nix
+{ dontUseSwiftpmInstall = true; }
+```
+
+## Hooks {#ssec-swift-hooks}
+
+Swift provides the following hooks to automate builds and unpack dependencies:
+
+- `swiftpmHook`: Propagated by `swiftpm`.
+  Also propagates `swiftpmUnpackHook`.
+  Provides build, install, and check phases. It also adds any dependencies found in `buildInputs` to `swiftpmFlags`.
+- `swiftpmUnpackHook`: Sets up `workspace-state.json` and links vendored dependencies to the top-level `Packages` directory in the build environment.
+
+Swift also provides a hook with the toolchain to replace rpath references to  the toolchain with references to the stdlib package.
+This hook is used automatically by the `swift` package.
+This avoids pulling the entire toolchain into the closure of your package.
+
 ## Considerations for custom build tools {#ssec-swift-considerations-for-custom-build-tools}
 
 ### Linking the standard library {#ssec-swift-linking-the-standard-library}
 
-The `swift` package has a separate `lib` output containing just the Swift
-standard library, to prevent Swift applications needing a dependency on the
-full Swift compiler at runtime. Linking with the Nixpkgs Swift toolchain
-already ensures binaries correctly reference the `lib` output.
+The Swift stdlib is packaged separately as `swiftPackages.stdlib`.
+The shared and static libraries are installed to `lib`.
+Most tooling in Nixpkgs should find them automatically when linking.
+The stdlib provides a hook to change any rpaths pointing to the toolchain to point to the stdlib instead.
 
-Sometimes, Swift is used only to compile part of a mixed codebase, and the
-link step is manual. Custom build tools often locate the standard library
-relative to the `swift` compiler executable, and while the result will work,
-when this path ends up in the binary, it will have the Swift compiler as an
-unintended dependency.
+The stdlib modules are installed to `lib/swift/<platform>` in the `dev` output of the stdlib package.
+These are symlinked together into the `swift` toolchain.
+If your build tools locate the modules relative to the `swift` compiler  executable, it should do the right thing automatically.
 
-In this case, you should investigate how your build process discovers the
-standard library, and override the path. The correct path will be something
-like: `"${swift.swift.lib}/${swift.swiftModuleSubdir}"`
+### Accessing properties of the Swift platform {#ssec-swift-platform-properties}
+
+The architecture, platform, and triple used by Swift is available as attributes on the build/host/targetPlatform for the `stdenv`.
+
+- `stdenv.<platform>.swift.platform`: The Swift platform (e.g., `macosx` for macOS, `linux` for Linux, etc).
+- `stdenv.<platform>.swift.arch`: The Swift architecture (e.g., `arm64` for Darwin or `aarch64` for Linux, `x86_64`, etc).
+- `stdenv.<platform>.swift.triple`: The triple used by Swift.
+  This is the same as `stdenv.<platform>.config` except on Darwin.
+  On Darwin, it uses the OS name instead of `darwin` and includes the deployment target (e.g., `arm64-apple-macosx14.0`).

doc/nav.json

@@ -364,6 +364,9 @@
                 {
                   "file": "hooks/gnome.section.md"
                 },
+                {
+                  "file": "hooks/guileImportsCheckHook.section.md"
+                },
                 {
                   "file": "hooks/haredo.section.md"
                 },

doc/redirects.json

@@ -164,6 +164,9 @@
   "ghc-deprecation-policy": [
     "index.html#ghc-deprecation-policy"
   ],
+  "guileImportsCheckHook": [
+    "index.html#guileImportsCheckHook"
+  ],
   "how-channels-work": [
     "index.html#how-channels-work"
   ],
@@ -1981,6 +1984,9 @@
   "sec-darwin-troubleshooting-xcodebuild-absolute-paths": [
     "index.html#sec-darwin-troubleshooting-xcodebuild-absolute-paths"
   ],
+  "sec-darwin-missing-macros": [
+    "index.html#sec-darwin-missing-macros"
+  ],
   "sec-darwin-troubleshooting-libiconv": [
     "index.html#sec-darwin-troubleshooting-libiconv"
   ],
@@ -2978,6 +2984,9 @@
   "meson-honored-variables": [
     "index.html#meson-honored-variables"
   ],
+  "meson-disabled-tests": [
+    "index.html#meson-disabled-tests"
+  ],
   "setup-hook-mpi-check": [
     "index.html#setup-hook-mpi-check"
   ],
@@ -4593,14 +4602,26 @@
   "ssec-swift-packaging-with-swiftpm": [
     "index.html#ssec-swift-packaging-with-swiftpm"
   ],
+  "ssec-swift-packaging-with-fetch-swiftpm-deps": [
+    "index.html#ssec-swift-packaging-with-fetch-swiftpm-deps"
+  ],
+  "ssec-swift-packaging-with-swiftpm2nix": [
+    "index.html#ssec-swift-packaging-with-swiftpm2nix"
+  ],
+  "ssec-swiftpm-patching-dependencies": [
+    "index.html#ssec-swiftpm-patching-dependencies"
+  ],
   "ssec-swiftpm-custom-build-flags": [
     "index.html#ssec-swiftpm-custom-build-flags"
   ],
   "ssec-swiftpm-running-tests": [
     "index.html#ssec-swiftpm-running-tests"
   ],
-  "ssec-swiftpm-patching-dependencies": [
-    "index.html#ssec-swiftpm-patching-dependencies"
+  "ssec-swiftpm-install-phase": [
+    "index.html#ssec-swiftpm-install-phase"
+  ],
+  "ssec-swift-hooks": [
+    "index.html#ssec-swift-hooks"
   ],
   "ssec-swift-considerations-for-custom-build-tools": [
     "index.html#ssec-swift-considerations-for-custom-build-tools"
@@ -4608,6 +4629,9 @@
   "ssec-swift-linking-the-standard-library": [
     "index.html#ssec-swift-linking-the-standard-library"
   ],
+  "ssec-swift-platform-properties": [
+    "index.html#ssec-swift-platform-properties"
+  ],
   "sec-language-tcl": [
     "index.html#sec-language-tcl"
   ],

doc/release-notes/rl-2611.section.md

@@ -16,6 +16,8 @@
   +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
   ```
 
+- GCC has been updated from GCC 15 to GCC 16. This introduces some backwards-incompatible changes. Refer to the [upstream porting guide](https://gcc.gnu.org/gcc-16/porting_to.html) for details.
+
 - Emacs has been updated to 31.
   This introduces some backwards‐incompatible changes; see the NEWS for details.
   NEWS can be viewed from Emacs by typing `C-h n`, or by clicking `Help->Emacs News` from the menu bar.
@@ -36,6 +38,10 @@
 - `zabbix.<package>` now defaults to version 7.4. If you want to keep using Zabbix 6.0, use `pkgs.zabbix60.<package>`.
   Note that Zabbix 6.0 is in limited support, and will be deprecated on February 28, 2027. Consider upgrading.
 
+- `zabbix-agent2-plugin-postgresql` is now moved to `zabbix{60,70,74}.plugins.postgresql`.
+
+- Official Zabbix plugins (ember-plus, mongodb, and mssql) have been added under `zabbix{60,70,74}.plugins.<plugin>`.
+
 - `perlPackages.NetOAuth` has been updated from 0.28 to 0.33.
   Callers that verify messages must now set `allowed_signature_methods` per message or configure `@Net::OAuth::ALLOWED_SIGNATURE_METHODS`; `verify` otherwise throws an exception.
   See the [upstream changelog](https://metacpan.org/dist/Net-OAuth/changes) for details.
@@ -117,6 +123,9 @@
 
 - `himalaya` has been updated from `v1.2.0` to `v2.0.0`, which introduces breaking changes. See the [release notes](https://github.com/pimalaya/himalaya/releases/tag/v2.0.0) and the [migration guide](https://github.com/pimalaya/himalaya/blob/master/MIGRATION.md).
 
+- `proton-cli` has been updated from `2.2.3` to `3.4.0`, and installs its command as `proton`, with `proton-cli` kept beside it as a symlink.
+  `3.0.0` reworked the command line - `--output` is now the response format, secrets are no longer accepted as flag values, and several subcommands moved - so scripts need a review against the [upstream changelog](https://github.com/roman-16/proton-cli/blob/main/CHANGELOG.md).
+
 - `tengine` has been removed as it has seen seriously delayed responses to security vulnerabilities.
 
 - `jellyfin` has been upgraded to major version 12, which contains breaking changes. See the [upstream blog post](https://jellyfin.org/posts/jellyfin-release-12.0) for more information on how to safely upgrade.
@@ -171,6 +180,8 @@
 - `replaceVarsWith` now enables `strictDeps` and `__structuredAttrs` and passing these attributes to the function is no longer allowed.
    By extension, `replaceVars` now also enables `strictDeps` and `__structuredAttrs`.
 
+- `nginx` / `nginxStable` is now built without the `rtmp` nginx module by default. You can enable it again using `nginx.override { modules = [ pkgs.nginxModules.rtmp ]; }`
+
 - `buildFHSEnvChroot` has been removed after deprecation in 23.05.
 
 - `leafnode` has been removed, as it was an unmaintained alpha-release of leafnode 2 and has a dependency on the EOL PRCE-library. Consider using `leafnode1` instead, which is still maintained.
@@ -193,6 +204,11 @@
 
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
 
+- `secretspec-ffi` has been renamed to `libsecretspec` and updated to 0.21.0.
+  The old package attribute remains an alias, but native consumers must rebuild
+  against the new `libsecretspec` library and pkg-config module. The separate
+  `libsecretspec-resolver` package provides a C client for `secretspec serve`.
+
 - `luaPackages.lrexlib-pcre` has been removed as part of the process to fully migrate from the end-of-life PRCE library to PCRE2. `luaPackages.lrexlib-pcre2` and multiple other versions of lrexlib can be used instead.
 
 - `hostapd` was upgraded to version 2.12+, which moves move supported, basic, and beacon transmission rate configuration to be at BSS level instead of per-radio for all BSSs. Refer to the [upstream example config](https://git.w1.fi/cgit/hostap/plain/hostapd/hostapd.conf) for details.
@@ -225,6 +241,16 @@
 - `nim-2_0` & `nim-2_2` and respective aliases have been removed; please migrate to `nim` or `nim-unwrapped` (nim 2.2.10).
 - `domoticz` has been updated from `2024.7` to `2026.x`, breaking third party applications and scripts using the old RType calls. Review the [release notes](https://github.com/domoticz/domoticz/blob/2026.2/History.txt#L398) for more information.
 
+- `swift` is no longer wrapped.
+  The `NIX_SWIFTFLAGS_COMPILE` variable is no longer supported.
+  If you need to pass custom flags to the Swift compiler, you must add them via your package’s build system.
+  The default target version used by `swiftc` on Darwin is the operating system major version.
+  This value may be overridden by the build system (e.g., SwiftPM defaults to 10.13 instead).
+  See the Swift documentation in Nixpkgs for details.
+
+- `swiftpm` is no longer wrapped to include Git to fetch dependencies.
+  Users with Git-based dependencies will need to add `git` to their dev shells or include it in their environment if they weren’t already.
+
 - `vimacs` has been removed, as it has not been maintained in 10 years and was built for an old version of vim (6.0).
 
 - The deprecated `appimageTools.extractType1`, `appimageTools.extractType2`, and `appimageTools.wrapType1` aliases now emit warnings. Use `appimageTools.extract` and `appimageTools.wrapType2` instead.
@@ -261,18 +287,27 @@
 
 - `nextpnr` introduced support for the nexus and gatemate architectures. Building support for each individual architecture can be configured using the package parameters.
 
+- `mastodon` has been updated to 4.7. The [4.7.0 release notes](https://github.com/mastodon/mastodon/releases/tag/v4.7.0) mention some unusually long running migrations.
+
 - Emacs loads the `early-default` library after `early-init.el`.
   Users can add `early-init.el` via `emacs.pkgs.withPackages`
   by packaging `early-init.el` into a library named `early-default`.
   To prevent loading the `early-default` library,
   set `inhibit-early-default-init` in `early-init.el`.
 
+- Ceph has a vulnerability in old generated CephX keys.
+  The project recommends to rotate old keys.
+  This is a manual process, see https://ceph.io/en/news/blog/2026/v20-2-4-v19-2-6-combo-released
+
 - `services.ceph` enabled the generation of Ceph log files at `/var/log/ceph/`.
   They were missing before because Ceph omitted logs when this directory was missing.
   Ceph logs can grow large, so you may want to configure rotation of these logs.
 
 - Firefox wrapper now accepts an optional `appDataDir` argument, which sets `MOZ_APP_DATA` to relocate Firefox application data. This is especially useful on macOS 27 and later, where wrapped Firefox applications may be denied access to profiles in traditional application data directory.
 
+- Swift has been upgraded to Swift 6.2.4 from Swift 5.10.1.
+  The Swift packaging has been rewritten.
+
 ## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

doc/stdenv/platform-notes.chapter.md

@@ -121,7 +121,8 @@ Generally, only the last SDK release for a major version is packaged.
 |---------------|-------------|------------------------------|
 | 15.0–15.4     | 14.4        | `apple-sdk_14` / `apple-sdk` |
 | 16.0          | 15.0        | `apple-sdk_15`               |
-| 26.0+         | 26.0+       | `apple-sdk_26`, etc          |
+| 26.0          | 26.0        | `apple-sdk_26`               |
+| 27.0+         | 27.0+       | `apple-sdk_27`, etc          |
 
 
 #### Darwin Default SDK versions {#sec-darwin-troubleshooting-darwin-defaults}
@@ -192,6 +193,13 @@ stdenv.mkDerivation {
 }
 ```
 
+### Macro library not available {#sec-darwin-missing-macros}
+
+Some frameworks provide macros that are only shipped with Xcode.
+For example, the AppleIntelligence framework, Swift Data, and SwiftUI (as of the 27.0 SDK).
+A non-free package making these available will be added at a later date.
+Until then, they are unfortunately not available in Nixpkgs.
+
 #### How to use libiconv on Darwin {#sec-darwin-troubleshooting-libiconv}
 
 The libiconv package is included in the SDK by default along with libresolv and libsbuf.

doc/styleguide.md

@@ -1,4 +1,4 @@
-# Styleguide
+# Style guide
 
 Use this page as a reference and style guide for our internal and external documentation.
 
@@ -22,7 +22,7 @@ Write for someone who knows a great deal — up to but not including this projec
 
 If specific knowledge is required, mention it at the start of the page.
 
-### Show, Don't Tell
+### Show, don't tell
 
 The fastest path to understanding is a working example.
 People learn by doing, not by reading about doing.
@@ -34,7 +34,7 @@ People learn by doing, not by reading about doing.
 - Cover edge cases or variations
 - Link to further information instead of including it
 
-### Grammar and Style
+### Grammar and style
 
 **Sentence structure:**
 
@@ -54,7 +54,7 @@ Users care about *detecting hardware*, not *the tool that does it*.
 
 > This command detects your hardware and saves the configuration.
 
-### Content Organization
+### Content organization
 
 Lead with value. State what the reader will accomplish before explaining how.
 
@@ -83,21 +83,23 @@ Use **progressive disclosure**. Introduce concepts only when needed.
 3. Explain concepts if needed
 4. Provide advanced options separately or link to the reference
 
-### No Meta-commentary
+### No meta-commentary
 
 Don't describe what the documentation does. Just do it.
 
 **Don't:**
 
 > This section explains how to configure networking.
+
 > The following guide walks you through setting up a web server.
 
 **Do:**
 
 > Configure networking by setting:
+
 > Set up a web server:
 
-### Code Examples
+### Code examples
 
 **Keep examples focused:**
 
@@ -130,7 +132,7 @@ Paste code examples directly and without further alteration.
 }
 ```
 
-### Lead with Practical Examples
+### Lead with practical examples
 
 Don't front-load theory. Readers want to accomplish something first, then understand why it works.
 
@@ -166,7 +168,7 @@ Users learn the NixOS module system by seeing patterns first.
 - Link deeper concepts instead of inlining them
 - Link to `nix.dev` for optional learning
 
-### General Rules
+### General rules
 
 - Abbreviate keys like `ssh-ed25519 AAAAC3NzaC…`
 - Abbreviate IP addresses like `192.168.XXX.XXX`
@@ -200,7 +202,7 @@ Use sentence case. A reader scanning only headings should understand the page.
 > Configure networking
 > Add a user to the system
 
-### Imperative Mood, Voice, and Person
+### Imperative mood, voice, and person
 
 Use imperative mood for instructions. Address the reader as "you", not "the user". Use active voice; in other words, make the subject do the action.
 
@@ -230,7 +232,7 @@ Use present tense for descriptions. Future tense makes documentation feel tentat
 > This creates a new folder.
 > Running this command installs the package.
 
-### Be Confident
+### Be confident
 
 State facts. Don't hedge with "should," "might," "typically," or "usually" unless the behavior genuinely varies.
 
@@ -244,7 +246,7 @@ State facts. Don't hedge with "should," "might," "typically," or "usually" unles
 > This creates the configuration file.
 > The service starts automatically.
 
-### Avoid Nominalizations
+### Avoid nominalizations
 
 A nominalization is a verb turned into a noun, often by adding *-tion*, *-meant*, or *-ance* (e.g. "explanation", "selection"). The fix: find the hidden verb and use it directly.
 
@@ -258,7 +260,7 @@ A nominalization is a verb turned into a noun, often by adding *-tion*, *-meant*
 > Select from the list.
 > Explain the error.
 
-### Plain Words
+### Plain words
 
 Technical precision for technical terms; plain language for everything else.
 
@@ -270,7 +272,7 @@ Technical precision for technical terms; plain language for everything else.
 - "set up" not "establish"
 - "find out" not "ascertain"
 
-### Filler Words and Weak Phrases
+### Filler words and weak phrases
 
 Cut words and phrases that add length without meaning.
 
@@ -296,7 +298,7 @@ Delete on sight:
 
 Every word must earn its place.
 
-### Writing Procedures
+### Writing procedures
 
 One instruction per sentence. Don't pack multiple actions into one sentence.
 
@@ -320,7 +322,7 @@ Don't bury the negative. Key limitations should be prominent, not a footnote aft
 
 > This service does not support multiple instances.
 
-### Consistent Terminology
+### Consistent terminology
 
 Pick a term and stick to it. Don't swap synonyms to avoid repetition. In technical documentation, repetition is clarity.
 
@@ -359,7 +361,7 @@ Only link when the destination is directly relevant, not for generic background
 
 > See `[database schema](url)` for the full table structure.
 
-### UI Language
+### UI language
 
 Match UI element names exactly: wording, casing, and spacing (even if a label seems oddly worded).
 

doc/toolchains/llvm.chapter.md

@@ -22,7 +22,7 @@ import <nixpkgs> {
 }
 ```
 
-Note that we set `linker` to `lld`. This is because LLVM has its own linker, called "lld". By setting it, we utilize Clang and lld within this new instance of Nixpkgs. There is a shorthand method for building everything with LLVM: `pkgsLLVM`. This is easier to use with `nix-build` (or `nix build`):
+Note that we set `linker` to `lld`. This is because LLVM has its own linker, called "lld". By setting it, we use Clang and lld within this new instance of Nixpkgs. There is a shorthand method for building everything with LLVM: `pkgsLLVM`. This is easier to use with `nix-build` (or `nix build`):
 
 ```bash
 nix-build -A pkgsLLVM.hello

doc/using/configuration.chapter.md

@@ -105,27 +105,48 @@ There are several ways to tweak how Nix handles a package which has been marked
     $ export NIXPKGS_ALLOW_UNFREE=1
     ```
 
--   It is possible to permanently allow individual unfree packages, while still blocking unfree packages by default using the `allowUnfreePredicate` configuration option in the user configuration file.
-
-    This option is a function which accepts a package as a parameter, and returns a boolean. The following example configuration accepts a package and always returns false:
-
-    ```nix
-    { allowUnfreePredicate = (pkg: false); }
-    ```
-
-    For a more useful example, try the following. This configuration only allows unfree packages named roon-server and Visual Studio Code:
+-   To allow specific unfree packages, add their names to your Nixpkgs configuration file:
 
     ```nix
     {
-      allowUnfreePredicate =
-        pkg:
-        builtins.elem (lib.getName pkg) [
-          "roon-server"
-          "vscode"
-        ];
+      allowUnfreePackages = [
+        "fence"
+        "roon-server"
+        "vscode"
+      ];
     }
     ```
 
+    `allowUnfreePackages` permits the listed unfree packages.
+
+    In NixOS modules, lists set through `nixpkgs.config.allowUnfreePackages` merge additively across modules. This allows you to declare your unfree exceptions in the same modules that triggered them.
+
+    To allow unfree packages programmatically:
+
+    ```nix
+    { lib, ... }:
+    {
+      allowUnfreePredicate = pkg: lib.hasPrefix "roon" (lib.getName pkg);
+    }
+    ```
+
+    This permits packages such as `roon-bridge` and `roon-server`.
+
+    To combine the list and predicate, set both options:
+
+    ```nix
+    { lib, ... }:
+    {
+      allowUnfreePackages = [
+        "fence"
+        "vscode"
+      ];
+      allowUnfreePredicate = pkg: lib.hasPrefix "roon" (lib.getName pkg);
+    }
+    ```
+
+    This permits unfree packages that match either option.
+
 -   It is also possible to allow and block licenses that are specifically acceptable or not acceptable, using `allowlistedLicenses` and `blocklistedLicenses`, respectively.
 
     The following example configuration allowlists the licenses `amd` and `wtfpl`:

lib/licenses/licenses.nix

@@ -703,11 +703,6 @@ lib.mapAttrs mkLicense (
       url = "https://www.schristiancollins.com/generaluser.php"; # license included in sources
     };
 
-    gfl = {
-      fullName = "GUST Font License";
-      url = "https://www.gust.org.pl/projects/e-foundry/licenses/GUST-FONT-LICENSE.txt";
-    };
-
     gfsl = {
       fullName = "GUST Font Source License";
       url = "https://www.gust.org.pl/projects/e-foundry/licenses/GUST-FONT-SOURCE-LICENSE.txt";

lib/modules.nix

@@ -1595,17 +1595,76 @@ let
   */
   mkDefinition = args@{ file, value, ... }: args // { _type = "definition"; };
 
+  /**
+    Labels a definition with a priority.
+    See the documentation of `filterOverrides` for the interpretation of the priority value.
+    Nesting this function usually leads to an invalid definition.
+    `mkDefault`, `mkOptionDefault`, and `mkForce` partially apply `mkOverride` with common priorities used in the NixOS module system.
+
+    # Inputs
+
+    `priority`
+
+    : A numeric value representing the precedence.
+      See the documentation of `filterOverrides` for the interpretation of this value.
+
+    `content`
+
+    : The definition to be labeled with a given priority.
+
+    # Examples
+    :::{.example}
+    ## `lib.modules.mkOverride` usage example
+
+    ```nix
+    mkOverride 1000 "hello, world!"
+    => { _type = "override"; content = "hello, world!"; priority = 1000; }
+    ```
+
+    ```nix
+    (lib.evalModules {
+      modules = [
+        { options.foo = lib.mkOption { }; }
+        { config.foo = lib.mkOverride 20 1; }
+        { config.foo = lib.mkOverride 10 2; }
+      ];
+    }).config
+    => { foo = 2; }
+    ```
+    :::
+  */
   mkOverride = priority: content: {
     _type = "override";
     inherit priority content;
   };
 
-  mkOptionDefault = mkOverride 1500; # priority of option defaults
-  mkDefault = mkOverride 1000; # used in config sections of non-user modules to set a default
+  /**
+    Labels a definition with the priority of option declaration defaults.
+  */
+  mkOptionDefault = mkOverride 1500;
+
+  /**
+    Labels a definition with the priority used in config sections of non-user modules to set a default.
+  */
+  mkDefault = mkOverride 1000;
+
   defaultOverridePriority = 100;
-  mkImageMediaOverride = mkOverride 60; # image media profiles can be derived by inclusion into host config, hence needing to override host config, but do allow user to mkForce
+
+  /**
+    Labels a definition with the priority used in image media profiles.
+    Image media profiles can be derived by inclusion into host config, hence needing to override host config, but do allow users to `mkForce`.
+  */
+  mkImageMediaOverride = mkOverride 60;
+
+  /**
+    Labels a definition with a high priority (low value).
+  */
   mkForce = mkOverride 50;
-  mkVMOverride = mkOverride 10; # used by ‘nixos-rebuild build-vm’
+
+  /**
+    Labels a definition with used by {command}`nixos-rebuild build-vm`.
+  */
+  mkVMOverride = mkOverride 10;
 
   mkFixStrictness = warn "lib.mkFixStrictness has no effect and will be removed. It returns its argument unmodified, so you can just remove any calls." id;
 

lib/systems/default.nix

@@ -719,6 +719,26 @@ let
             else
               null;
         };
+        swift = {
+          arch = final.uname.processor;
+          platform =
+            if final.isMacOS then
+              "macosx"
+            else if final.isiOS then
+              "iphoneos"
+            else if final.isLinux then
+              "linux"
+            else if final.isWindows then
+              "windows"
+            else
+              null;
+          triple =
+            if final.isDarwin then
+              # FIXME: Can this be done a better way?
+              "${final.swift.arch}-${final.parsed.vendor.name}-${final.swift.platform}${final.darwinMinVersion}"
+            else
+              final.config;
+        };
       };
     in
     # Platforms elaborated by pre-26.11 Nixpkgs will include the `linux-kernel` attr,

maintainers/github-teams.json

@@ -445,8 +445,7 @@
     "id": 4020424,
     "maintainers": {
       "Mic92": 96200,
-      "kalbasit": 87115,
-      "katexochen": 49727155
+      "kalbasit": 87115
     },
     "members": {
       "mfrw": 4929861,

maintainers/maintainer-list.nix

@@ -251,7 +251,7 @@
   };
   _365tuwe = {
     name = "Uwe Schlifkowitz";
-    email = "supertuwe@gmail.com";
+    email = "uwe.schlifkowitz@secunet.com";
     github = "365tuwe";
     githubId = 10263091;
   };
@@ -460,6 +460,7 @@
     name = "aaravrav";
     github = "aaravrav";
     githubId = 37036762;
+    matrix = "@hepara:matrix.org";
   };
   aarnphm = {
     email = "contact@aarnphm.xyz";
@@ -5090,6 +5091,12 @@
     githubId = 1689801;
     name = "Mikhail Chekan";
   };
+  chemonke = {
+    email = "nixpkgs@chemonke.ch";
+    github = "chemonke";
+    githubId = 183837749;
+    name = "Curdin Bosshart";
+  };
   chen = {
     email = "i@cuichen.cc";
     github = "cu1ch3n";
@@ -10805,6 +10812,12 @@
     githubId = 273582;
     name = "greg";
   };
+  gregl83 = {
+    email = "general+nixpkgs@gregorylanglais.com";
+    github = "gregl83";
+    githubId = 1258023;
+    name = "gregory langlais";
+  };
   gregshuflin = {
     email = "greg@everdayimshuflin.com";
     github = "neunenak";
@@ -11513,6 +11526,13 @@
     githubId = 58676303;
     name = "hhydraa";
   };
+  hideyosh1 = {
+    email = "penelope.zhong@proton.me";
+    keys = [ { fingerprint = "01E9 0D3E 815F 84CA 1003  E7D7 2F75 2D18 C2C1 7AF8"; } ];
+    name = "Penelope Zhong";
+    github = "hideyosh1";
+    githubId = 64223175;
+  };
   higebu = {
     name = "Yuya Kusakabe";
     email = "yuya.kusakabe@gmail.com";
@@ -12143,6 +12163,12 @@
     githubId = 71074737;
     name = "Simon Wick";
   };
+  ilovelinux = {
+    email = "nix+nixpkgs@ilovelinux.dev";
+    github = "ilovelinux";
+    githubId = 9268789;
+    name = "Antonio Spadaro";
+  };
   ilya-epifanov = {
     email = "mail@ilya.network";
     github = "ilya-epifanov";
@@ -12637,6 +12663,12 @@
     github = "j0hax";
     githubId = 3802620;
   };
+  j0schu = {
+    name = "Jonas";
+    email = "Joschu2015@t-online.de";
+    github = "J0schu";
+    githubId = 56407950;
+  };
   j0xaf = {
     email = "j0xaf@j0xaf.de";
     name = "Jörn Gersdorf";
@@ -14087,6 +14119,12 @@
     github = "jooooscha";
     githubId = 57965027;
   };
+  joseg313 = {
+    name = "Jose Garcia";
+    email = "501jag3@gmail.com";
+    github = "joseg313";
+    githubId = 215610619;
+  };
   josephschmitt = {
     name = "Joseph Schmitt";
     email = "dev@joe.sh";
@@ -20094,6 +20132,12 @@
     githubId = 52401682;
     name = "myul";
   };
+  Myxogastria0808 = {
+    email = "r.rstudio.c@gmail.com";
+    github = "Myxogastria0808";
+    githubId = 78744619;
+    name = "Yuki Osada";
+  };
   myypo = {
     email = "nikirsmcgl@gmail.com";
     github = "myypo";
@@ -28978,6 +29022,13 @@
     github = "thelissimus";
     githubId = 70096720;
   };
+  thelolcoder2007 = {
+    name = "thelolcoder2007";
+    github = "thelolcoder2007";
+    githubId = 52106896;
+    matrix = "@erents:dapperepoging.nl";
+    keys = [ { fingerprint = "E374 815F C754 462B 1C34  3562 FDC3 99DE 8F7E 200B"; } ];
+  };
   themadbit = {
     name = "Mark Tanui";
     email = "marktanui75@gmail.com";
@@ -31571,10 +31622,10 @@
     ];
   };
   wrench-exile-legacy = {
-    email = "user@wrench-exile-legacy.site";
+    email = "hello@wrenchd.dev";
     github = "wrench-exile-legacy";
     githubId = 280737824;
-    name = "wrench";
+    name = "wrenchd";
   };
   wrmilling = {
     name = "Winston R. Milling";

maintainers/team-list.nix

@@ -108,7 +108,6 @@ with lib.maintainers;
     members = [
       lopsided98
       mic92
-      zowoq
     ];
     scope = "Maintain Buildbot CI framework";
     shortName = "Buildbot";
@@ -751,6 +750,7 @@ with lib.maintainers;
 
   swift = {
     members = [
+      reckenrode
       samasaur
       stephank
     ];

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -302,9 +302,11 @@
 
 - `chatgpt` has been retargeted to OpenAI's new ChatGPT desktop app, while the previous app has been renamed to `chatgpt-classic`.
 
-- NetBox was updated to `>= 4.6.8`. Have a look at the breaking changes
-  of the [4.6 release](https://github.com/netbox-community/netbox/releases/tag/v4.6.0),
-  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_6;` in your configuration.
+- NetBox was updated to `>= 4.7.0`. Have a look at the breaking changes
+  of the [4.6 release](https://github.com/netbox-community/netbox/releases/tag/v4.6.0)
+  and the [4.7 release](https://github.com/netbox-community/netbox/releases/tag/v4.7.0),
+  make the required changes to your configuration and database, if needed,
+  before you upgrade to NixOS 26.11.
 
 - The COSMIC desktop module now enables by default `system76-power` and `system76-scheduler` following upstream recommended packages. The previous power managment service can be enabled back by setting `services.power-profiles-daemon.enable = true`.
 
@@ -356,6 +358,8 @@
 
 - `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.
 
+- The Wordpress module now supports auto database migrations using wp-cli, which gets triggered after every package version update.
+
 - `services.nginx` gained a [`lua`](#opt-services.nginx.lua.enable) option to enable Lua scripting via OpenResty's lua-nginx-module on a stock nginx, configuring `lua_package_path`/`lua_package_cpath` from the packages listed in [`services.nginx.lua.extraPackages`](#opt-services.nginx.lua.extraPackages). Use this to add Lua to a regular nginx; for the full OpenResty platform (libraries that rely on its bundled lualib, such as `lua-resty-openidc`), set `services.nginx.package` to `pkgs.openresty` instead — the option configures the Lua search path for it too.
 
 - `services.nginx.virtualHosts.<name>.locations.<name>` gained a new `useGrpcErrorPages` option. If enabled, it sets up error pages that are valid gRPC messages. This is useful if you proxy gRPC and want to emit errors from nginx, for example when adding authentication on top.

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -335,7 +335,7 @@ class BaseMachine(ABC):
         ...
 
     @abstractmethod
-    def wait_for_shutdown(self) -> None:
+    def wait_for_shutdown(self, timeout: dt.timedelta | None = None) -> None:
         """Wait for the machine to power off. This does *not* initiate a shutdown;
         that's usually done via `shutdown()`.
         """
@@ -1061,7 +1061,7 @@ class QemuMachine(BaseMachine):
                 break
             self.send_console(char.decode())
 
-    def wait_for_shutdown(self) -> None:
+    def wait_for_shutdown(self, timeout: dt.timedelta | None = None) -> None:
         """
         Wait for the VM to power off. This does *not* initiate a shutdown;
         that's usually done via `shutdown()`.
@@ -1072,7 +1072,9 @@ class QemuMachine(BaseMachine):
         with self.nested("waiting for the VM to power off"):
             sys.stdout.flush()
             assert self.process
-            self.process.wait()
+            self.process.wait(
+                timeout=timeout.total_seconds() if timeout is not None else None
+            )
 
             self.pid = None
             self.booted = False
@@ -1903,7 +1905,7 @@ class NspawnMachine(BaseMachine):
         self.systemctl("poweroff")
         self.wait_for_shutdown()
 
-    def wait_for_shutdown(self) -> None:
+    def wait_for_shutdown(self, timeout: dt.timedelta | None = None) -> None:
         """
         Wait for the container to power off. This does *not* initiate a shutdown;
         that's usually done via `shutdown()`.
@@ -1912,7 +1914,9 @@ class NspawnMachine(BaseMachine):
             return
 
         with self.nested("waiting for the container to power off"):
-            self.process.wait()
+            self.process.wait(
+                timeout=timeout.total_seconds() if timeout is not None else None
+            )
             self.process = None
 
 

nixos/modules/config/nix-channel.nix

@@ -42,7 +42,7 @@ in
         };
       };
 
-      nixPath = mkOption {
+      settings.nix-path = mkOption {
         type = types.listOf types.str;
         default =
           if cfg.channel.enable then
@@ -80,8 +80,11 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  imports = [
+    (lib.mkRenamedOptionModule [ "nix" "nixPath" ] [ "nix" "settings" "nix-path" ])
+  ];
 
+  config = mkIf cfg.enable {
     environment.extraInit = mkIf cfg.channel.enable ''
       if [ -e "$HOME/.nix-defexpr/channels" ]; then
         export NIX_PATH="$HOME/.nix-defexpr/channels''${NIX_PATH:+:$NIX_PATH}"
@@ -95,7 +98,7 @@ in
     # NIX_PATH has a non-empty default according to Nix docs, so we don't unset
     # it when empty.
     environment.sessionVariables = {
-      NIX_PATH = cfg.nixPath;
+      NIX_PATH = cfg.settings.nix-path;
     };
 
     systemd.tmpfiles.rules = lib.mkIf cfg.channel.enable [

nixos/modules/installer/tools/manpages/nixos-version.8

@@ -72,6 +72,20 @@ $ nixos-version --configuration-revision
 aa314ebd1592f6cdd53cb5bba8bcae97d9323de8
 .Ed
 .
+.It Fl -kernel-version
+Show the kernel version, e.g.
+.Bd -literal -offset indent
+$ nixos-version --kernel-version
+7.2.5
+.Ed
+.
+.It Fl -specialisations
+Show specialisations, separated by spaces, if available, e.g.
+.Bd -literal -offset indent
+$ nixos-version --specialisations
+foo bar
+.Ed
+.
 .It Fl -json
 Print a JSON representation of the versions of NixOS and the top-level
 configuration flake.

nixos/modules/installer/tools/nixos-version.sh

@@ -20,8 +20,23 @@ case "$1" in
     fi
     echo "@configurationRevision@"
     ;;
+  --kernel-version)
+    if [[ "@kernelVersion@" =~ "@" ]]; then
+      echo "$0: kernel version is unknown" >&2
+      exit 1
+    fi
+    echo "@kernelVersion@"
+    ;;
+  --specialisations)
+    specialisations=@specialisations@
+    if [[ -z "$specialisations" ]]; then
+      echo "$0: no specialisations found" >&2
+      exit 1
+    fi
+    printf '%s\n' "$specialisations"
+    ;;
   --json)
-    cat <<EOF
+    cat <<'EOF'
 @json@
 EOF
     ;;

nixos/modules/installer/tools/tools.nix

@@ -53,13 +53,27 @@ let
   nixos-version = makeProg {
     name = "nixos-version";
     src = ./nixos-version.sh;
-    replacements = {
+    replacements = rec {
       inherit (pkgs) runtimeShell;
       inherit (config.system.nixos) version codeName revision;
       inherit (config.system) configurationRevision;
+      kernelVersion =
+        if config.boot.kernel.enable then
+          # modDirVersion returns 6.18.54-xanmod1 instead of 6.18.54
+          config.boot.kernelPackages.kernel.modDirVersion or config.boot.kernelPackages.kernel.version
+        else
+          null;
+      specialisations = lib.escapeShellArg (
+        lib.concatStringsSep " " (lib.attrNames config.specialisation)
+      );
+
       json = builtins.toJSON (
         {
           nixosVersion = config.system.nixos.version;
+          specialisations = lib.attrNames config.specialisation;
+        }
+        // lib.optionalAttrs (kernelVersion != null) {
+          inherit kernelVersion;
         }
         // lib.optionalAttrs (config.system.nixos.revision != null) {
           nixpkgsRevision = config.system.nixos.revision;
@@ -292,7 +306,7 @@ in
         {
           options.system.tools.${name}.enable = lib.mkEnableOption "${name} script" // {
             default = config.nix.enable && !config.system.disableInstallerTools;
-            defaultText = "config.nix.enable && !config.system.disableInstallerTools";
+            defaultText = lib.literalExpression "config.nix.enable && !config.system.disableInstallerTools";
           };
 
           config = lib.mkIf config.system.tools.${name}.enable {

nixos/modules/misc/nixpkgs-flake.nix

@@ -102,7 +102,7 @@ in
         # because we would need some kind of evil shim taking the *calling* flake's self path,
         # perhaps, to ever make that work (in order to know where the Nix expr for the system came
         # from and how to call it).
-        nix.nixPath = lib.mkDefault (
+        nix.settings.nix-path = lib.mkDefault (
           [ "nixpkgs=flake:nixpkgs" ]
           ++ lib.optional config.nix.channel.enable "/nix/var/nix/profiles/per-user/root/channels"
         );

nixos/modules/module-list.nix

@@ -1258,7 +1258,6 @@
   ./services/networking/gnunet.nix
   ./services/networking/go-autoconfig.nix
   ./services/networking/go-camo.nix
-  ./services/networking/go-neb.nix
   ./services/networking/go-shadowsocks2.nix
   ./services/networking/gobgpd.nix
   ./services/networking/godns.nix

nixos/modules/programs/wayland/noctalia.nix

@@ -33,7 +33,13 @@ in
   config = lib.mkIf cfg.enable (
     lib.mkMerge [
       {
-        environment.systemPackages = [ cfg.package ];
+        environment.systemPackages = [
+          cfg.package
+        ];
+
+        # Needed to add the freedesktop sound theme
+        # It's only a runtime dependency for noctalia, so it's not made a package dependency.
+        xdg.sounds.enable = true;
 
         systemd.user.services.noctalia = lib.mkIf cfg.systemd.enable {
           description = "Noctalia Wayland desktop shell";

nixos/modules/rename.nix

@@ -486,6 +486,10 @@ in
       See https://www.isc.org/blogs/isc-dhcp-eol/ for details.
       Please switch to a different implementation like kea or dnsmasq.
     '')
+    (lib.mkRemovedOptionModule [ "services" "go-neb" ] ''
+      The Go-NEB project was discontinued by Matrix.org and archived in June
+      2023. Use matrix-hookshot or another maintained Matrix bot instead.
+    '')
     (mkRemovedOptionModule [ "services" "gsignond" ] ''
       The corresponding package was unmaintained, abandoned upstream, used outdated library and thus removed from nixpkgs.
     '')

nixos/modules/security/account-utils.nix

@@ -51,7 +51,10 @@ in
       sockets.pwupdd.wantedBy = lib.optional config.users.mutableUsers "sockets.target"; # immutable users do not need password updating
       sockets.newidmapd.wantedBy = [ "sockets.target" ];
       services."pwupdd@".environment.PWUPDD_OPTS = lib.escapeShellArgs cfg.extraArgs;
-      services."pwaccessd".environment.PWACCESSD_OPTS = lib.escapeShellArgs cfg.extraArgs;
+      services."pwaccessd".environment = {
+        LD_LIBRARY_PATH = config.system.nssModules.path;
+        PWACCESSD_OPTS = lib.escapeShellArgs cfg.extraArgs;
+      };
     };
 
     environment.systemPackages = [ cfg.package ];

nixos/modules/services/desktops/accountsservice.nix

@@ -48,6 +48,7 @@
 
           # Accounts daemon looks for dbus interfaces in $XDG_DATA_DIRS/accountsservice
           environment.XDG_DATA_DIRS = "${config.system.path}/share";
+          environment.LD_LIBRARY_PATH = config.system.nssModules.path;
 
         }
         (

nixos/modules/services/matrix/mjolnir.nix

@@ -20,11 +20,16 @@ let
     rawHomeserverUrl = cfg.homeserverUrl;
 
     pantalaimon = {
-      inherit (cfg.pantalaimon) username;
-
       use = cfg.pantalaimon.enable;
+    }
+    // lib.optionalAttrs cfg.pantalaimon.enable {
+      inherit (cfg.pantalaimon) username;
       password = "@PANTALAIMON_PASSWORD@"; # will be replaced in "generateConfig"
     };
+    encryption = {
+      inherit (cfg.settings.encryption) username;
+      password = "@ENCRYPTION_PASSWORD@"; # will be replaced in "generateConfig"
+    };
   };
 
   moduleConfigFile = pkgs.writeText "module-config.yaml" (
@@ -72,6 +77,9 @@ let
       ${lib.optionalString (cfg.pantalaimon.passwordFile != null) ''
         ${pkgs.replace-secret}/bin/replace-secret '@PANTALAIMON_PASSWORD@' '${cfg.pantalaimon.passwordFile}' ${cfg.dataPath}/config/default.yaml
       ''}
+      ${lib.optionalString (cfg.encryption.passwordFile != null) ''
+        ${pkgs.replace-secret}/bin/replace-secret '@ENCRYPTION_PASSWORD@' '${cfg.encryption.passwordFile}' ${cfg.dataPath}/config/default.yaml
+      ''}
     ''
   );
 in
@@ -98,6 +106,14 @@ in
       '';
     };
 
+    encryption.passwordFile = lib.mkOption {
+      type = with lib.types; nullOr path;
+      default = null;
+      description = ''
+        File containing the matrix password for the `mjolnir` user.
+      '';
+    };
+
     pantalaimon = lib.mkOption {
       description = ''
         `pantalaimon` options (enables E2E Encryption support).
@@ -186,17 +202,22 @@ in
 
   config = lib.mkIf config.services.mjolnir.enable {
     assertions = [
+      {
+        assertion = !(cfg.settings.encryption.use && cfg.encryption.passwordFile == null);
+        message = "encryption.passwordFile must be specified when native encryption is used.";
+      }
       {
         assertion = !(cfg.pantalaimon.enable && cfg.pantalaimon.passwordFile == null);
-        message = "Specify pantalaimon.passwordFile";
+        message = "pantalaimon.passwordFile must be specified when pantalaimon is enabled.";
       }
       {
-        assertion = !(cfg.pantalaimon.enable && cfg.accessTokenFile != null);
-        message = "Do not specify accessTokenFile when using pantalaimon";
+        assertion = cfg.accessTokenFile == null -> cfg.pantalaimon.enable || cfg.settings.encryption.use;
+        message = "Do not specify accessTokenFile when using native encryption or pantalaimon";
       }
       {
-        assertion = !(!cfg.pantalaimon.enable && cfg.accessTokenFile == null);
-        message = "Specify accessTokenFile when not using pantalaimon";
+        assertion =
+          !(!cfg.pantalaimon.enable && !cfg.settings.encryption.use && cfg.accessTokenFile == null);
+        message = "Specify accessTokenFile when not using pantalaimon or native encryption.";
       }
     ];
 

nixos/modules/services/misc/paperless.nix

@@ -38,12 +38,8 @@ let
     PAPERLESS_REDIS = "unix://${redisServer.unixSocket}";
   }
   // lib.optionalAttrs (cfg.settings.PAPERLESS_AI_ENABLED or true) {
-    NLTK_DATA = cfg.package.nltkDataDir;
     TIKTOKEN_CACHE_DIR = cfg.package.tiktokenCacheDir;
   }
-  // lib.optionalAttrs (cfg.settings.PAPERLESS_ENABLE_NLTK or true) {
-    PAPERLESS_NLTK_DIR = cfg.package.nltkDataDir;
-  }
   // lib.optionalAttrs (cfg.openMPThreadingWorkaround) {
     OMP_NUM_THREADS = "1";
   }
@@ -717,7 +713,9 @@ in
           "d '${cfg.exporter.directory}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
         ];
 
-        services.paperless.exporter.settings = options.services.paperless.exporter.settings.default;
+        services.paperless.exporter.settings = lib.mapAttrs (
+          _: v: lib.mkDefault v
+        ) options.services.paperless.exporter.settings.default;
 
         systemd.services.paperless-exporter = {
           startAt = lib.defaultTo [ ] cfg.exporter.onCalendar;

nixos/modules/services/monitoring/beszel-agent.nix

@@ -6,6 +6,76 @@
 }:
 let
   cfg = config.services.beszel.agent;
+
+  hasVideoDriver = driver: builtins.elem driver config.services.xserver.videoDrivers;
+
+  # Collector names must match `isValidCollectorSource` in upstream's agent/gpu.go.
+  # macmon and powermetrics are macOS-only and omitted here.
+  gpuCollectors = {
+    # read sysfs directly, need no package or device access
+    "amd_sysfs" = { };
+    "intel_sysfs" = { };
+    "intel_gpu_top" = {
+      package = lib.getBin pkgs.intel-gpu-tools;
+      deviceAllow = [ "char-drm rw" ];
+      capabilities = [ "CAP_PERFMON" ];
+      # perf_event_open is in @debug, not @system-service
+      systemCalls = [ "perf_event_open" ];
+    };
+    "nvidia-smi" = {
+      package = lib.getBin config.hardware.nvidia.package;
+      deviceAllow = [ "char-nvidia* rw" ];
+    };
+    "nvml" = {
+      deviceAllow = [ "char-nvidia* rw" ];
+    };
+    "nvtop" = {
+      package = lib.getBin pkgs.nvtopPackages.full;
+      deviceAllow = [
+        "char-nvidia* rw"
+        "char-drm rw"
+      ];
+    };
+    "rocm-smi" = {
+      package = lib.getBin pkgs.rocmPackages.rocm-smi;
+      deviceAllow = [
+        "char-drm rw"
+        "char-kfd rw"
+      ];
+    };
+  };
+
+  activeCollectors = lib.optionals (!cfg.environment.SKIP_GPU) cfg.environment.GPU_COLLECTOR;
+
+  collectorAttrs =
+    attr: lib.unique (lib.concatMap (name: gpuCollectors.${name}.${attr} or [ ]) activeCollectors);
+
+  gpuPackages = map (name: gpuCollectors.${name}.package) (
+    lib.filter (name: gpuCollectors.${name} ? package) activeCollectors
+  );
+
+  gpuNeedsDevices = collectorAttrs "deviceAllow" != [ ];
+
+  # capabilities granted under PrivateUsers are void on the host, see
+  # systemd.exec(5), so these collectors also need the user namespace disabled
+  gpuNeedsCapabilities = collectorAttrs "capabilities" != [ ];
+
+  # Any explicit DeviceAllow turns DevicePolicy=auto into an allow-list, so the GPU
+  # devices are omitted when smartmon relies on full /dev access.
+  deviceAllowList =
+    lib.optionals (cfg.smartmon.enable && cfg.smartmon.deviceAllow != [ ]) (
+      map (device: "${device} r") cfg.smartmon.deviceAllow
+    )
+    ++ lib.optionals (!cfg.smartmon.enable || cfg.smartmon.deviceAllow != [ ]) (
+      collectorAttrs "deviceAllow" ++ lib.optionals config.boot.zfs.enabled [ "/dev/zfs rw" ]
+    );
+
+  serviceCapabilities =
+    lib.optionals cfg.smartmon.enable [
+      "CAP_SYS_RAWIO"
+      "CAP_SYS_ADMIN"
+    ]
+    ++ collectorAttrs "capabilities";
 in
 {
   meta.maintainers = with lib.maintainers; [
@@ -60,6 +130,45 @@ in
               Enabling this option will skip systemd tracking and its setup in NixOS.
             '';
           };
+          SKIP_GPU = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              Whether to disable GPU monitoring.
+              Enabling this option will skip GPU tracking.
+            '';
+          };
+          GPU_COLLECTOR = lib.mkOption {
+            # upstream takes a comma-separated string, which used to be passed through as is
+            type =
+              with lib.types;
+              coercedTo str (value: map lib.trim (lib.splitString "," value)) (
+                listOf (enum (lib.attrNames gpuCollectors))
+              );
+            default =
+              lib.optionals (hasVideoDriver "nvidia") [ "nvidia-smi" ]
+              ++ lib.optionals (hasVideoDriver "amdgpu") [ "amd_sysfs" ]
+              ++ lib.optionals (hasVideoDriver "intel") [ "intel_sysfs" ];
+            defaultText = lib.literalMD ''
+              derived from {option}`services.xserver.videoDrivers`
+            '';
+            example = [
+              "nvidia-smi"
+              "intel_gpu_top"
+            ];
+            description = ''
+              GPU collectors to use, in priority order. Overrides the agent's
+              auto-detection; the packages needed by the selected collectors are added
+              to the service path. If empty, the agent auto-detects available
+              collectors. `rocm-smi` is deprecated upstream in favour of `amd_sysfs`,
+              and `intel_gpu_top` is not used on the xe driver, where `intel_sysfs` is
+              preferred.
+
+              Access to GPU device nodes is only granted for the collectors listed
+              here, so a collector provided through
+              {option}`services.beszel.agent.extraPath` has to be listed as well.
+            '';
+          };
         };
       };
       default = { };
@@ -129,22 +238,22 @@ in
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
 
+      # drop empty lists so an unset GPU_COLLECTOR keeps upstream auto-detection
       environment = lib.mapAttrs (
-        _: value: if lib.isBool value then (lib.boolToString value) else value
-      ) (cfg.environment // { DATA_DIR = cfg.dataDir; });
+        _: value:
+        if lib.isBool value then
+          (lib.boolToString value)
+        else if lib.isList value then
+          lib.concatStringsSep "," value
+        else
+          value
+      ) (lib.filterAttrs (_: value: value != [ ]) (cfg.environment // { DATA_DIR = cfg.dataDir; }));
 
       path =
         cfg.extraPath
         ++ lib.optionals cfg.smartmon.enable [ cfg.smartmon.package ]
-        ++ lib.optionals (builtins.elem "nvidia" config.services.xserver.videoDrivers) [
-          (lib.getBin config.hardware.nvidia.package)
-        ]
-        ++ lib.optionals (builtins.elem "amdgpu" config.services.xserver.videoDrivers) [
-          (lib.getBin pkgs.rocmPackages.rocm-smi)
-        ]
-        ++ lib.optionals (builtins.elem "intel" config.services.xserver.videoDrivers) [
-          (lib.getBin pkgs.intel-gpu-tools)
-        ];
+        ++ lib.optionals config.boot.zfs.enabled [ config.boot.zfs.package ]
+        ++ gpuPackages;
 
       serviceConfig = {
         ExecStart = ''
@@ -165,26 +274,22 @@ in
         DynamicUser = true;
         User = "beszel-agent";
 
-        # Capabilities needed for SMART monitoring
-        AmbientCapabilities = lib.mkIf cfg.smartmon.enable [
-          "CAP_SYS_RAWIO"
-          "CAP_SYS_ADMIN"
-        ];
-        CapabilityBoundingSet = lib.mkIf cfg.smartmon.enable [
-          "CAP_SYS_RAWIO"
-          "CAP_SYS_ADMIN"
-        ];
+        # Capabilities needed for SMART monitoring and GPU performance counters
+        AmbientCapabilities = serviceCapabilities;
+        CapabilityBoundingSet = serviceCapabilities;
 
-        # Device access for SMART monitoring
-        DeviceAllow = lib.mkIf (cfg.smartmon.enable && cfg.smartmon.deviceAllow != [ ]) (
-          map (device: "${device} r") cfg.smartmon.deviceAllow
-        );
+        DeviceAllow = lib.mkIf (deviceAllowList != [ ]) deviceAllowList;
 
         LockPersonality = true;
         NoNewPrivileges = !cfg.smartmon.enable;
-        PrivateDevices = !cfg.smartmon.enable;
+        PrivateDevices = !cfg.smartmon.enable && !gpuNeedsDevices;
         PrivateTmp = true;
-        PrivateUsers = !cfg.smartmon.enable && !cfg.environment.SKIP_SYSTEMD;
+        # zfs commands fail inside a user namespace since zfs 2.2, see syncoid.nix
+        PrivateUsers =
+          !cfg.smartmon.enable
+          && !config.boot.zfs.enabled
+          && !cfg.environment.SKIP_SYSTEMD
+          && !gpuNeedsCapabilities;
         ProtectClock = true;
         ProtectControlGroups = "strict";
         ProtectHome = "read-only";
@@ -199,7 +304,7 @@ in
         RestrictSUIDSGID = true;
         SystemCallArchitectures = "native";
         SystemCallErrorNumber = "EPERM";
-        SystemCallFilter = [ "@system-service" ];
+        SystemCallFilter = [ "@system-service" ] ++ collectorAttrs "systemCalls";
         Type = "simple";
         UMask = 27;
       };

nixos/modules/services/monitoring/glpi-agent.nix

@@ -95,8 +95,8 @@ in
 
         DynamicUser = true;
         StateDirectory = "glpi-agent";
-        CapabilityBoundingSet = [ "CAP_SYS_ADMIN" ];
-        AmbientCapabilities = [ "CAP_SYS_ADMIN" ];
+        CapabilityBoundingSet = [ "CAP_DAC_READ_SEARCH" ];
+        AmbientCapabilities = [ "CAP_DAC_READ_SEARCH" ];
 
         LimitCORE = 0;
         LimitNOFILE = 65535;
@@ -104,7 +104,7 @@ in
         MemorySwapMax = 0;
         MemoryZSwapMax = 0;
         PrivateTmp = true;
-        ProcSubset = "pid";
+        ProcSubset = "all";
         ProtectClock = true;
         ProtectControlGroups = true;
         ProtectHome = true;

nixos/modules/services/monitoring/librenms.nix

@@ -32,10 +32,14 @@ let
         inherit (package) phpPackage;
         phpOptions = toKeyValue cfg.phpOptions;
         preferLocalBuild = true;
-        passAsFile = [ "phpOptions" ];
+        strictDeps = true;
+        __structuredAttrs = true;
       }
       ''
-        cat $phpPackage/etc/php.ini $phpOptionsPath > $out
+        (
+          cat $phpPackage/etc/php.ini
+          printf "%s" "$phpOptions"
+        ) > $out
       '';
 
   artisanWrapper = pkgs.writeShellScriptBin "librenms-artisan" ''

nixos/modules/services/networking/adguardhome.nix

@@ -240,6 +240,8 @@ in
           "AF_INET"
           "AF_INET6"
         ]
+        # AF_UNIX to be able to connect to e.g. /dev/log
+        ++ lib.optionals (cfg.settings.log.file or "" == "syslog") [ "AF_UNIX" ]
         ++ lib.optionals cfg.allowDHCP [ "AF_PACKET" ];
         RestrictNamespaces = true;
         RestrictRealtime = true;

nixos/modules/services/networking/fedimintd.nix

@@ -13,7 +13,6 @@ let
     mkEnableOption
     mkIf
     mkOption
-    mkOverride
     mkPackageOption
     nameValuePair
     recursiveUpdate
@@ -351,13 +350,11 @@ in
         fedimintdName: cfg:
         (nameValuePair cfg.nginx.fqdn (
           lib.mkMerge [
-            cfg.nginx.config
+            (lib.mapAttrsRecursive (_: lib.mkDefault) cfg.nginx.config)
 
             {
-              # Note: we want by default to enable OpenSSL, but it seems anything 100 and above is
-              # overridden by default value from vhost-options.nix
-              enableACME = mkOverride 99 true;
-              forceSSL = mkOverride 99 true;
+              enableACME = true;
+              forceSSL = true;
               locations.${cfg.nginx.path_ws} = {
                 proxyPass = "http://127.0.0.1:${toString cfg.api_ws.port}/";
                 proxyWebsockets = true;

nixos/modules/services/networking/go-neb.nix

@@ -1,10 +0,0 @@
-{ lib, ... }:
-
-{
-  imports = [
-    (lib.mkRemovedOptionModule [ "services" "go-neb" ] ''
-      The Go-NEB project was discontinued by Matrix.org and archived in June
-      2023. Use matrix-hookshot or another maintained Matrix bot instead.
-    '')
-  ];
-}

nixos/modules/services/networking/nebula.nix

@@ -292,7 +292,7 @@ in
     assertions = lib.mapAttrsToList (netName: netCfg: {
       # IFNAMSIZ caps network device names to 16 chars (including NULL terminator).
       # Without this check, users might end up with a truncated interface name.
-      assertion = !netCfg.tun.disable && builtins.stringLength netCfg.tun.device <= 15;
+      assertion = netCfg.tun.disable || builtins.stringLength netCfg.tun.device <= 15;
       message = ''
         Network device names can't be longer than 15 chars.
         `config.services.nebula.networks.${netName}.tun.device` is set to "${netCfg.tun.device}" which is above the limit.

nixos/modules/services/video/frigate.nix

@@ -405,7 +405,9 @@ in
             extraConfig = nginxAuthRequest + ''
               types {
                   video/mp4 mp4;
-                  image/jpeg jpg;
+                  image/jpeg jpg jpeg;
+                  image/png png;
+                  image/webp webp;
               }
 
               expires 7d;
@@ -493,19 +495,6 @@ in
                 }
               '';
           };
-          # frontend uses this to fetch the version
-          "/api/go2rtc/api" = {
-            proxyPass = "http://frigate-go2rtc/api";
-            recommendedProxySettings = true;
-            extraConfig =
-              nginxAuthRequest
-              + nginxProxySettings
-              + ''
-                limit_except GET {
-                    deny  all;
-                }
-              '';
-          };
           # integrationn uses this to add webrtc candidate
           "/api/go2rtc/webrtc" = {
             proxyPass = "http://frigate-go2rtc/api/webrtc";
@@ -541,6 +530,7 @@ in
                 expires off;
 
                 proxy_cache frigate_api_cache;
+                proxy_cache_key "$scheme$proxy_host$request_uri|$role|$groups|$user";
                 proxy_cache_lock on;
                 proxy_cache_use_stale updating;
                 proxy_cache_valid 200 5s;
@@ -563,6 +553,13 @@ in
                     ${nginxProxySettings}
                 }
 
+                location /api/logout {
+                    auth_request off;
+                    rewrite ^/api(/.*)$ $1 break;
+                    proxy_pass http://frigate-api;
+                    ${nginxProxySettings}
+                }
+
                 location /api/auth/first_time_login {
                     auth_request off;
                     limit_except GET {
@@ -747,7 +744,6 @@ in
         ]
         ++ optionals (!stdenv.hostPlatform.isAarch64) [
           # not available on aarch64-linux
-          intel-gpu-tools
           rocmPackages.rocminfo
         ];
       serviceConfig = {
@@ -775,11 +771,10 @@ in
         Group = "frigate";
         SupplementaryGroups = [ "render" ] ++ optionals withCoral [ "coral" ];
 
-        AmbientCapabilities = optionals (elem cfg.vaapiDriver [
-          "i965"
-          "iHD"
-        ]) [ "CAP_PERFMON" ]; # for intel_gpu_top
+        # No capabilities
+        CapabilityBoundingSet = [ "" ];
 
+        # Allow delegating access
         UMask = "0027";
 
         StateDirectory = "frigate";
@@ -797,9 +792,53 @@ in
 
         # Sockets/IPC
         RuntimeDirectory = "frigate";
+        RemoveIPC = true;
 
         # Reduce visible process scope to cgroup
         ProtectProc = "invisible";
+
+        # Allow wide /proc inspection, e.g. for cpuinfo
+        ProcSubset = "all";
+
+        # Protect various system locations/interfaces
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+
+        # No JIT compilation
+        MemoryDenyWriteExecute = true;
+
+        # No ABI personality changes
+        LockPersonality = true;
+
+        # Only IP/Unix sockets
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+
+        # Deny namespace creation
+        RestrictNamespaces = true;
+
+        # No privilege escalation
+        NoNewPrivileges = true;
+        RestrictSUIDSGID = true;
+
+        # No realtime schedulign
+        RestrictRealtime = true;
+
+        # Restrict allowed syscalls
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
       };
     };
 

nixos/modules/services/web-apps/changedetection-io.nix

@@ -202,7 +202,7 @@ in
 
         (mkIf cfg.playwrightSupport {
           changedetection-io-playwright = {
-            image = "browserless/chrome";
+            image = "docker.io/browserless/chrome";
             environment = {
               SCREEN_WIDTH = "1920";
               SCREEN_HEIGHT = "1024";

nixos/modules/services/web-apps/engelsystem.nix

@@ -116,7 +116,7 @@ in
 
     services.phpfpm.pools.engelsystem = {
       user = "engelsystem";
-      settings = {
+      settings = lib.mapAttrs (_: v: lib.mkDefault v) {
         "listen.owner" = config.services.nginx.user;
         "pm" = "dynamic";
         "pm.max_children" = 32;

nixos/modules/services/web-apps/homebox.nix

@@ -43,7 +43,7 @@ in
       type = types.submodule { freeformType = types.attrsOf (types.nullOr types.str); };
       defaultText = lib.literalExpression ''
         {
-          HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox";
+          HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox?no_tmp_dir=1";
           HBOX_STORAGE_PREFIX_PATH = "data";
           HBOX_DATABASE_DRIVER = "sqlite3";
           HBOX_DATABASE_SQLITE_PATH = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
@@ -51,7 +51,6 @@ in
           HBOX_OPTIONS_GITHUB_RELEASE_CHECK = "false";
           HBOX_MODE = "production";
           HOME = "/var/lib/homebox";
-          TMPDIR = "/var/lib/homebox/tmp";
         }
       '';
       description = ''
@@ -125,7 +124,9 @@ in
 
     services.homebox.settings = lib.mkMerge [
       (lib.mapAttrs (_: mkDefault) {
-        HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox";
+        # We cannot use a tempdir as homebox wants to rename the file, which does not work across filesystem boundaries
+        # also see: https://github.com/google/go-cloud/issues/3294 and https://pkg.go.dev/gocloud.dev/blob/fileblob#URLOpener
+        HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox?no_tmp_dir=1";
         HBOX_STORAGE_PREFIX_PATH = "data";
         HBOX_DATABASE_DRIVER = "sqlite3";
         HBOX_DATABASE_SQLITE_PATH = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
@@ -134,10 +135,8 @@ in
         HBOX_MODE = "production";
         # Fix this startup issue:
         #   failed to create modcache index dir: mkdir /var/empty/.cache: read-only file system
+        # TODO: remove once https://github.com/golang/tools/commit/03cb4551c662c0e078502fe5f317ca4114b89cd8 is available
         HOME = "/var/lib/homebox";
-        # Fix uploading/saving attachments/images:
-        # [...] rename /tmp/ced4804c80b1ed1f6e88060f6d829db421e6dbf3a189715265900b5d6b0243ed.1889b3d16ab36e22.tmp /var/lib/homebox/data/5f42f81b-e9ad-4495-b6a6-9e9f704db30e/documents/ced4804c80b1ed1f6e88060f6d829db421e6dbf3a189715265900b5d6b0243ed: invalid cross-device link" [...]
-        TMPDIR = "/var/lib/homebox/tmp";
       })
 
       (mkIf cfg.database.createLocally {

nixos/modules/services/web-apps/netbox.nix

@@ -434,10 +434,10 @@ in
     package = lib.mkOption {
       type = types.package;
       default =
-        if lib.versionAtLeast config.system.stateVersion "26.11" then pkgs.netbox_4_6 else pkgs.netbox_4_5;
+        if lib.versionAtLeast config.system.stateVersion "26.11" then pkgs.netbox_4_7 else pkgs.netbox_4_5;
       defaultText = lib.literalExpression ''
         if lib.versionAtLeast config.system.stateVersion "26.11" then
-          pkgs.netbox_4_6
+          pkgs.netbox_4_7
         else
           pkgs.netbox_4_5;
       '';
@@ -563,6 +563,15 @@ in
   config = lib.mkIf cfg.enable (
     lib.mkMerge [
       {
+        assertions = [
+          {
+            assertion =
+              cfg.postgresql.createLocally
+              -> lib.versionAtLeast config.services.postgresql.finalPackage.version "15";
+            message = "NetBox requires PostgreSQL >= 15. Please read the NixOS manual to upgrade your PostgreSQL version.";
+          }
+        ];
+
         services.netbox.plugins = lib.mkIf enableLDAP (ps: [ ps.django-auth-ldap ]);
 
         services.redis.servers.netbox.enable = cfg.redis.createLocally;
@@ -733,26 +742,6 @@ in
                 PrivateTmp = true;
               };
             };
-
-            netbox-housekeeping = defaultUnitConfig // {
-              description = "NetBox housekeeping job";
-
-              wantedBy = [ "multi-user.target" ];
-
-              after = [
-                "network-online.target"
-                "netbox.service"
-              ];
-              wants = [ "network-online.target" ];
-
-              serviceConfig = defaultServiceConfig // {
-                Type = "oneshot";
-                ExecStart = toString [
-                  (lib.getExe finalPackage)
-                  "housekeeping"
-                ];
-              };
-            };
           };
 
         systemd.timers.netbox-housekeeping = {

nixos/modules/services/web-apps/rundeck.nix

@@ -12,6 +12,13 @@ let
   scheme = if cfg.ssl.enable then "https" else "http";
 
   configFile = settingsFormat.generate "rundeck-config.properties" cfg.settings;
+
+  jaasLoginModuleClass =
+    if lib.versionAtLeast cfg.package.version "6" then
+      "org.rundeck.jaas.PropertyFileLoginModule"
+    else
+      "org.eclipse.jetty.jaas.spi.PropertyFileLoginModule";
+
   frameworkFile = settingsFormat.generate "framework.properties" cfg.frameworkSettings;
 
   realmFile = pkgs.writeText "realm.properties" ''
@@ -133,7 +140,43 @@ in
 
       aclPolicies = lib.mkOption {
         type = lib.types.attrsOf lib.types.str;
-        default = { };
+        default = {
+          "admin.aclpolicy" = ''
+            description: Admin, all access.
+            context:
+              project: '.*'
+            for:
+              resource:
+                - allow: '*'
+              adhoc:
+                - allow: '*'
+              job:
+                - allow: '*'
+              node:
+                - allow: '*'
+              runner:
+                - allow: '*'
+            by:
+              group: admin
+
+            ---
+
+            description: Admin, all access.
+            context:
+              application: 'rundeck'
+            for:
+              resource:
+                - allow: '*'
+              project:
+                - allow: '*'
+              project_acl:
+                - allow: '*'
+              storage:
+                - allow: '*'
+            by:
+              group: admin
+          '';
+        };
         description = "ACL policies for Rundeck, where the attribute name is the filename and the value is the policy content";
         example = lib.literalExpression ''
           {
@@ -493,9 +536,9 @@ in
       group = cfg.group;
       text = ''
         RDpropertyfilelogin {
-          org.eclipse.jetty.jaas.spi.PropertyFileLoginModule required
+          ${jaasLoginModuleClass} required
           debug="true"
-          file="/etc/rundeck/realm.properties";
+          file="${cfg.configDir}/realm.properties";
         };
       '';
     };
@@ -631,9 +674,7 @@ in
           replaceSecret "@SERVER_UUID@" "${cfg.dataDir}/.uuid" "${cfg.configDir}/framework.properties"
         )}
 
-        if [ -f ${cfg.dataDir}/etc/framework.properties ]; then
-          install -m 0640 ${cfg.configDir}/framework.properties ${cfg.dataDir}/etc/framework.properties
-        fi
+        install -C -m 0640 ${cfg.configDir}/framework.properties ${cfg.dataDir}/etc/framework.properties
 
         ${lib.concatStringsSep "\n" (
           lib.mapAttrsToList (

nixos/modules/services/web-apps/wordpress.nix

@@ -555,7 +555,33 @@ in
             before = [ "phpfpm-wordpress-${hostName}.service" ];
             after = optional cfg.database.createLocally "mysql.service";
             script = secretsScript (stateDir hostName);
+            serviceConfig = {
+              Type = "oneshot";
+              User = user;
+              Group = webserver.group;
+            };
+          })
+        ) eachSite)
 
+        (mapAttrs' (
+          hostName: cfg:
+          (nameValuePair "wordpress-migrate-database-${hostName}" {
+            wantedBy = [ "multi-user.target" ];
+            after = [
+              "phpfpm-wordpress-${hostName}.service"
+            ]
+            ++ optional cfg.database.createLocally "mysql.service";
+            script = ''
+              # Auto migrate database after version update
+              versionFile="${stateDir hostName}/src-version"
+              version=$(cat "$versionFile" 2>/dev/null || echo 0)
+              if [[ $version != 0 && $version != ${cfg.package.version} ]]; then
+                echo "Executing database migration"
+                ${lib.getExe pkgs.wp-cli} --path="${cfg.finalPackage}/share/wordpress" \
+                  --skip-plugins --skip-themes core update-db
+              fi
+              echo ${cfg.package.version} > "$versionFile"
+            '';
             serviceConfig = {
               Type = "oneshot";
               User = user;

nixos/modules/system/boot/kexec.nix

@@ -9,6 +9,10 @@ let
   cfg = config.boot.kexec;
 in
 {
+  meta = {
+    inherit (pkgs.kexec-tools.meta) maintainers;
+  };
+
   options.boot.kexec = {
     enable = lib.mkEnableOption "kexec" // {
       default = lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.kexec-tools;

nixos/tests/adguardhome.nix

@@ -22,6 +22,14 @@
       };
     };
 
+    syslogConf = {
+      services.adguardhome = {
+        enable = true;
+
+        settings.log.file = "syslog";
+      };
+    };
+
     declarativeConf = {
       services.adguardhome = {
         enable = true;
@@ -127,6 +135,12 @@
       schemaVersionBefore23.wait_for_unit("adguardhome.service")
       schemaVersionBefore23.wait_for_open_port(3000)
 
+    with subtest("Logging to syslog test"):
+      # AdGuard is expected to fail when it cannot connect to syslog
+      # hence its sufficient to look whether the service starts at all
+      syslogConf.wait_for_unit("adguardhome.service")
+      syslogConf.wait_for_open_port(3000)
+
     with subtest("Declarative config test, DNS will be reachable"):
       declarativeConf.wait_for_unit("adguardhome.service")
       declarativeConf.wait_for_open_port(53)

nixos/tests/all-tests.nix

@@ -402,22 +402,10 @@ in
   ceph-multi-node-bluestore-cephfs = runTestOn [ "aarch64-linux" "x86_64-linux" ] (
     import ./ceph-multi-node-bluestore.nix { withCephfs = true; }
   );
-  ceph-multi-node-deprecated-filestore = runTestOn [
-    "aarch64-linux"
-    "x86_64-linux"
-  ] ./ceph-multi-node-deprecated-filestore.nix;
   ceph-single-node-bluestore = runTestOn [
     "aarch64-linux"
     "x86_64-linux"
   ] ./ceph-single-node-bluestore.nix;
-  ceph-single-node-bluestore-dmcrypt = runTestOn [
-    "aarch64-linux"
-    "x86_64-linux"
-  ] ./ceph-single-node-bluestore-dmcrypt.nix;
-  ceph-single-node-deprecated-filestore = runTestOn [
-    "aarch64-linux"
-    "x86_64-linux"
-  ] ./ceph-single-node-deprecated-filestore.nix;
   certmgr = import ./certmgr.nix { inherit pkgs runTest; };
   cfssl = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./cfssl.nix;
   cgit = runTest ./cgit.nix;
@@ -659,10 +647,6 @@ in
     imports = [ ./firefox.nix ];
     _module.args.firefoxPackage = pkgs.firefox;
   };
-  firefox-beta = runTest {
-    imports = [ ./firefox.nix ];
-    _module.args.firefoxPackage = pkgs.firefox-beta;
-  };
   firefox-devedition = runTest {
     imports = [ ./firefox.nix ];
     _module.args.firefoxPackage = pkgs.firefox-devedition;
@@ -672,10 +656,6 @@ in
     imports = [ ./firefox.nix ];
     _module.args.firefoxPackage = pkgs.firefox-esr;
   };
-  firefox-esr-140 = runTest {
-    imports = [ ./firefox.nix ];
-    _module.args.firefoxPackage = pkgs.firefox-esr-140;
-  };
   firefox-esr-153 = runTest {
     imports = [ ./firefox.nix ];
     _module.args.firefoxPackage = pkgs.firefox-esr-153;
@@ -1282,6 +1262,7 @@ in
   nginx-modsecurity = runTest ./nginx-modsecurity.nix;
   nginx-moreheaders = runTest ./nginx-moreheaders.nix;
   nginx-njs = runTest ./nginx-njs.nix;
+  nginx-otel = runTest ./nginx-otel.nix;
   nginx-proxyprotocol = runTest ./nginx-proxyprotocol/default.nix;
   nginx-pubhtml = runTest ./nginx-pubhtml.nix;
   nginx-redirectcode = runTest ./nginx-redirectcode.nix;
@@ -1322,6 +1303,9 @@ in
   nixos-rebuild-target-host = runTest {
     imports = [ ./nixos-rebuild-target-host.nix ];
   };
+  nixos-rebuild-target-host-interrupted = runTest {
+    imports = [ ./nixos-rebuild-target-host-interrupted.nix ];
+  };
   nixpkgs = pkgs.callPackage ../modules/misc/nixpkgs/test.nix { inherit evalMinimalConfig; };
   nixpkgs-config-allow-unfree =
     pkgs.callPackage ../modules/misc/nixpkgs/test-nixpkgs-config-allow-unfree.nix

nixos/tests/beszel.nix

@@ -59,6 +59,50 @@
             openFirewall = true;
           };
         };
+
+        # Only inspected by the test script, never activated: the VM has no GPU,
+        # but the generated units can still be checked.
+        specialisation."gpu-sysfs".configuration = {
+          services.beszel.agent = {
+            enable = true;
+            environment.GPU_COLLECTOR = [ "amd_sysfs" ];
+          };
+        };
+
+        specialisation."gpu-devices".configuration = {
+          services.beszel.agent = {
+            enable = true;
+            environment.GPU_COLLECTOR = [ "intel_gpu_top" ];
+          };
+        };
+
+        specialisation."gpu-smartmon".configuration = {
+          services.beszel.agent = {
+            enable = true;
+            # upstream's comma-separated form is accepted as well
+            environment.GPU_COLLECTOR = "intel_gpu_top";
+            smartmon = {
+              enable = true;
+              deviceAllow = [ "/dev/nvme0" ];
+            };
+          };
+        };
+
+        specialisation."zfs".configuration = {
+          networking.hostId = "8425e349";
+          boot.supportedFilesystems = [ "zfs" ];
+          services.beszel.agent.enable = true;
+        };
+
+        specialisation."gpu-skipped".configuration = {
+          services.beszel.agent = {
+            enable = true;
+            environment = {
+              SKIP_GPU = true;
+              GPU_COLLECTOR = [ "intel_gpu_top" ];
+            };
+          };
+        };
       };
   };
 
@@ -67,6 +111,13 @@
     let
       hubCfg = nodes.hubHost.services.beszel.hub;
       agentCfg = nodes.agentHost.specialisation."agent".configuration.services.beszel.agent;
+      # /run/current-system points at the "agent" specialisation after the switch,
+      # so the units are read from the store directly.
+      gpuUnit =
+        name:
+        "${
+          nodes.agentHost.specialisation.${name}.configuration.system.build.toplevel
+        }/etc/systemd/system/beszel-agent.service";
     in
     ''
       import json
@@ -115,5 +166,41 @@
         agentHost.wait_for_unit("beszel-agent.service")
         agentHost.wait_until_succeeds("journalctl -eu beszel-agent --grep 'SSH connection established'")
         agentHost.wait_until_succeeds(f'curl -H \'Authorization: {user["token"]}\' -f ${agentCfg.environment.HUB_URL}/api/collections/systems/records | jq -e \'.items[].status == "up"\' ')
+
+      with subtest("Agent stays sandboxed without a GPU"):
+        agentHost.succeed("systemctl show beszel-agent -p PrivateDevices --value | grep -qx yes")
+        agentHost.succeed("systemctl show beszel-agent -p PrivateUsers --value | grep -qx yes")
+
+      with subtest("GPU collectors shape the unit"):
+        # sysfs-only collector keeps the sandbox
+        sysfs = agentHost.succeed("cat ${gpuUnit "gpu-sysfs"}")
+        assert "PrivateDevices=true" in sysfs, sysfs
+        assert "PrivateUsers=true" in sysfs, sysfs
+        assert "intel-gpu-tools" not in sysfs, sysfs
+
+        # device-based collector gets its devices as an allow-list, and
+        # CAP_PERFMON/perf_event_open with the user namespace disabled
+        devices = agentHost.succeed("cat ${gpuUnit "gpu-devices"}")
+        assert "PrivateDevices=false" in devices, devices
+        assert "PrivateUsers=false" in devices, devices
+        assert "DeviceAllow=char-drm rw" in devices, devices
+        assert "CAP_PERFMON" in devices, devices
+        assert "perf_event_open" in devices, devices
+
+        # GPU devices must survive smartmon's DeviceAllow list
+        smartmon = agentHost.succeed("cat ${gpuUnit "gpu-smartmon"}")
+        assert "DeviceAllow=/dev/nvme0 r" in smartmon, smartmon
+        assert "DeviceAllow=char-drm rw" in smartmon, smartmon
+
+        # zfs only gets /dev/zfs, but needs the host user namespace
+        zfs = agentHost.succeed("cat ${gpuUnit "zfs"}")
+        assert "PrivateDevices=true" in zfs, zfs
+        assert "DeviceAllow=/dev/zfs rw" in zfs, zfs
+        assert "PrivateUsers=false" in zfs, zfs
+
+        # SKIP_GPU wins over an explicitly configured collector
+        skipped = agentHost.succeed("cat ${gpuUnit "gpu-skipped"}")
+        assert "PrivateDevices=true" in skipped, skipped
+        assert "intel-gpu-tools" not in skipped, skipped
     '';
 }

nixos/tests/ceph-multi-node-bluestore.nix

@@ -25,19 +25,16 @@ let
     osd0 = {
       name = "0";
       ip = "192.168.1.2";
-      key = "AQBCEJNa3s8nHRAANvdsr93KqzBznuIWm2gOGg==";
       uuid = "55ba2294-3e24-478f-bee0-9dca4c231dd9";
     };
     osd1 = {
       name = "1";
       ip = "192.168.1.3";
-      key = "AQBEEJNac00kExAAXEgy943BGyOpVH1LLlHafQ==";
       uuid = "5e97a838-85b6-43b0-8950-cb56d554d1e5";
     };
     osd2 = {
       name = "2";
       ip = "192.168.1.4";
-      key = "AQAdyhZeIaUlARAAGRoidDAmS6Vkp546UFEf5w==";
       uuid = "ea999274-13d0-4dd5-9af9-ad25a324f72f";
     };
     # Client that mounts CephFS using the in-kernel client.
@@ -58,6 +55,14 @@ let
         monHost = cfg.monA.ip;
         monInitialMembers = cfg.monA.name;
       };
+      extraConfig = {
+        log_to_syslog = "false";
+        log_to_file = "false";
+        log_to_stderr = "true";
+        debug_rocksdb = "1/5";
+        debug_mgr = "1/5";
+        mon_host = "v2:${cfg.monA.ip}:3300 v1:${cfg.monA.ip}:6789";
+      };
     }
     // daemonConfig;
 
@@ -81,6 +86,7 @@ let
         bash
         sudo
         ceph
+        cryptsetup
         netcat
       ];
 
@@ -145,6 +151,11 @@ let
         enable = true;
         daemons = [ cfg.monA.name ];
       };
+      # TODO: move this to a separate machine
+      rgw = {
+        enable = true;
+        daemons = [ cfg.monA.name ];
+      };
     }
     # The MDS daemon (which provides CephFS) is only configured in the CephFS
     # variant of this test.
@@ -209,6 +220,11 @@ let
         vlans = [ 1 ];
       };
 
+      # Ceph 20.2.4 introduced the aes256k cipher for authentication.
+      # Linux started supporting these in kernel version 7.0.
+      # Remove this line at the earliest convenience (i.e. when tests are run by 7.0 or higher by default).
+      boot.kernelPackages = pkgs.linuxPackages_latest;
+
       networking = networkConfig;
 
       environment.systemPackages = with pkgs; [
@@ -285,6 +301,8 @@ let
   # Based on the "manual deployment" approach from:
   # https://docs.ceph.com/en/tentacle/install/manual-deployment/
   baseScript = ''
+    import json
+
     start_all()
 
     monA.wait_for_unit("network.target")
@@ -297,14 +315,15 @@ let
         "sudo -u ceph ceph-authtool --create-keyring /tmp/ceph.mon.keyring --gen-key -n mon. --cap mon 'allow *'",
         "sudo -u ceph ceph-authtool --create-keyring /etc/ceph/ceph.client.admin.keyring --gen-key -n client.admin --cap mon 'allow *' --cap osd 'allow *' --cap mds 'allow *' --cap mgr 'allow *'",
         "sudo -u ceph ceph-authtool /tmp/ceph.mon.keyring --import-keyring /etc/ceph/ceph.client.admin.keyring",
-        "monmaptool --create --add ${cfg.monA.name} ${cfg.monA.ip} --fsid ${cfg.clusterId} /tmp/monmap",
+        # Creating the mon with v2 (and a legacy v1) address right away removes the need for running `enable-msgr2` later on.
+        # It is also makes the test more consistent by fixing the address to a known value instead of letting it derive the address.
+        "monmaptool --create --addv ${cfg.monA.name} '[v2:${cfg.monA.ip}:3300,v1:${cfg.monA.ip}:6789]' --auth-allowed-ciphers aes256k --auth-preferred-cipher aes256k --auth-service-cipher aes256k --fsid ${cfg.clusterId} /tmp/monmap",
         "sudo -u ceph ceph-mon --mkfs -i ${cfg.monA.name} --monmap /tmp/monmap --keyring /tmp/ceph.mon.keyring",
         "sudo -u ceph mkdir -p /var/lib/ceph/mgr/ceph-${cfg.monA.name}/",
         "sudo -u ceph touch /var/lib/ceph/mon/ceph-${cfg.monA.name}/done",
         "systemctl start ceph-mon-${cfg.monA.name}",
     )
     monA.wait_for_unit("ceph-mon-${cfg.monA.name}")
-    monA.succeed("ceph mon enable-msgr2")
     monA.succeed("ceph config set mon auth_allow_insecure_global_id_reclaim false")
 
     # Can't check ceph status until a mon is up
@@ -320,59 +339,63 @@ let
     monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
     monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
 
-    # Send the admin keyring to the OSD machines.
-    monA.succeed("cp /etc/ceph/ceph.client.admin.keyring /tmp/shared")
-    osd0.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
-    osd1.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
-    osd2.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
+    # Send the bootstrap-osd keyring to the OSD machines.
+    monA.succeed("ceph auth get client.bootstrap-osd -o /etc/ceph/ceph.client.bootstrap-osd.keyring")
+    monA.succeed("cp /etc/ceph/ceph.client.bootstrap-osd.keyring /tmp/shared")
 
     # Bootstrap the BlueStore OSDs.
-    osd0.succeed(
-        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd0.name}",
-        "echo bluestore > /var/lib/ceph/osd/ceph-${cfg.osd0.name}/type",
-        "ln -sf /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd0.name}/block",
-        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd0.name}/keyring --name osd.${cfg.osd0.name} --add-key ${cfg.osd0.key}",
-        'echo \'{"cephx_secret": "${cfg.osd0.key}"}\' | ceph osd new ${cfg.osd0.uuid} -i -',
-    )
-    osd1.succeed(
-        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd1.name}",
-        "echo bluestore > /var/lib/ceph/osd/ceph-${cfg.osd1.name}/type",
-        "ln -sf /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd1.name}/block",
-        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd1.name}/keyring --name osd.${cfg.osd1.name} --add-key ${cfg.osd1.key}",
-        'echo \'{"cephx_secret": "${cfg.osd1.key}"}\' | ceph osd new ${cfg.osd1.uuid} -i -',
-    )
-    osd2.succeed(
-        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
-        "echo bluestore > /var/lib/ceph/osd/ceph-${cfg.osd2.name}/type",
-        "ln -sf /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd2.name}/block",
-        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd2.name}/keyring --name osd.${cfg.osd2.name} --add-key ${cfg.osd2.key}",
-        'echo \'{"cephx_secret": "${cfg.osd2.key}"}\' | ceph osd new ${cfg.osd2.uuid} -i -',
-    )
+    #
+    # The steps for this are roughly the same for all OSDs:
+    # 1. get the bootstrap-osd keyring
+    # 2. prepare the osd via ceph-volume lvm, the second line contains the OSD specific configuration
+    # 3. deactivate it to unmount the tmpfs
+    # 4. activate it without a tmpfs for persistent data
+    # 5. sync, so the osd has at least one consistent state saved
+    # 6. start it
 
-    # We `sync` so that the config survives the forced crashes below.
+    # osd.0: plain
     osd0.succeed(
-        "ceph-osd -i ${cfg.osd0.name} --mkfs --osd-uuid ${cfg.osd0.uuid}",
-        "chown -R ceph:ceph /var/lib/ceph/osd",
+        "mkdir -p /var/lib/ceph/bootstrap-osd",
+        "cp /tmp/shared/ceph.client.bootstrap-osd.keyring /var/lib/ceph/bootstrap-osd/ceph.keyring",
+        "ceph-volume lvm prepare --objectstore bluestore --no-systemd --osd-id ${cfg.osd0.name} --osd-fsid ${cfg.osd0.uuid} "
+          "--data /dev/vdb",
+        "ceph-volume lvm deactivate ${cfg.osd0.name} ${cfg.osd0.uuid}",
+        "ceph-volume lvm activate --no-tmpfs --no-systemd ${cfg.osd0.name} ${cfg.osd0.uuid}",
         "sync",
         "systemctl start ceph-osd-${cfg.osd0.name}",
     )
+    # osd.1: plain
     osd1.succeed(
-        "ceph-osd -i ${cfg.osd1.name} --mkfs --osd-uuid ${cfg.osd1.uuid}",
-        "chown -R ceph:ceph /var/lib/ceph/osd",
+        "mkdir -p /var/lib/ceph/bootstrap-osd",
+        "cp /tmp/shared/ceph.client.bootstrap-osd.keyring /var/lib/ceph/bootstrap-osd/ceph.keyring",
+        "ceph-volume lvm prepare --objectstore bluestore --no-systemd --osd-id ${cfg.osd1.name} --osd-fsid ${cfg.osd1.uuid} "
+          "--data /dev/vdb --dmcrypt",
+        "ceph-volume lvm deactivate ${cfg.osd1.name} ${cfg.osd1.uuid}",
+        "ceph-volume lvm activate --no-tmpfs --no-systemd ${cfg.osd1.name} ${cfg.osd1.uuid}",
         "sync",
         "systemctl start ceph-osd-${cfg.osd1.name}",
     )
+    # osd.2: plain
     osd2.succeed(
-        "ceph-osd -i ${cfg.osd2.name} --mkfs --osd-uuid ${cfg.osd2.uuid}",
-        "chown -R ceph:ceph /var/lib/ceph/osd",
+        "mkdir -p /var/lib/ceph/bootstrap-osd",
+        "cp /tmp/shared/ceph.client.bootstrap-osd.keyring /var/lib/ceph/bootstrap-osd/ceph.keyring",
+        "ceph-volume lvm prepare --objectstore bluestore --no-systemd --osd-fsid ${cfg.osd2.uuid} --osd-id ${cfg.osd2.name} "
+          "--data /dev/vdb",
+        "ceph-volume lvm deactivate ${cfg.osd2.name} ${cfg.osd2.uuid}",
+        "ceph-volume lvm activate --no-tmpfs --no-systemd ${cfg.osd2.name} ${cfg.osd2.uuid}",
         "sync",
         "systemctl start ceph-osd-${cfg.osd2.name}",
     )
+
+
     monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
     monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
     monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
 
     monA.succeed(
+        # Autoscaling will cause PGs to be peering, causing the tests to become flakey.
+        "ceph osd pool set noautoscale",
+
         "ceph osd pool create multi-node-test 32 32",
         "ceph osd pool ls | grep 'multi-node-test'",
 
@@ -389,6 +412,7 @@ let
         "ceph osd pool ls | grep 'multi-node-other-test'",
     )
     monA.succeed("ceph osd pool set multi-node-other-test size 2")
+    # TODO: actually write to the pool using rados directly
     monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
     monA.wait_until_succeeds("! ceph -s | grep -e 'unknown' -e 'pgs inactive'")
     monA.fail(
@@ -396,23 +420,100 @@ let
         "ceph osd pool delete multi-node-other-test multi-node-other-test --yes-i-really-really-mean-it",
     )
 
+    # Bootstrap RGW
+    monA.succeed(
+        "sudo -u ceph mkdir -p /var/lib/ceph/radosgw/ceph-${cfg.monA.name}",
+        "ceph auth get-or-create client.${cfg.monA.name} osd 'allow rwx' mon 'allow rw' > /var/lib/ceph/radosgw/ceph-${cfg.monA.name}/keyring",
+        "chown ceph:ceph /var/lib/ceph/radosgw/ceph-${cfg.monA.name}/keyring",
+        "systemctl start ceph-rgw-${cfg.monA.name}",
+    )
+    monA.wait_for_unit("ceph-rgw-${cfg.monA.name}")
+    monA.wait_for_open_port(7480)
+
+    # Enable the dashboard and recheck health
+    monA.succeed(
+        "ceph mgr module enable dashboard",
+        "ceph config set mgr mgr/dashboard/ssl false",
+        # default is 8080 but it's better to be explicit
+        "ceph config set mgr mgr/dashboard/server_port 8080",
+    )
+
+    # The dashboard does not listen on localhost:
+    # `server_addr` defaults to the wildcard address, but the dashboard module
+    # resolves that to the active mgr's own IP and binds only to it,
+    # so loopback is never bound.
+    # See https://github.com/ceph/ceph/blob/v20.2.2/src/pybind/mgr/dashboard/module.py#L213-L214
+    # Therefore address the dashboard via the mgr's IP instead of localhost.
+    dashboard = "http://${cfg.monA.ip}:8080"
+
+    monA.wait_for_open_port(8080, addr="${cfg.monA.ip}")
+    monA.wait_until_succeeds(f"curl -s --fail {dashboard}")
+    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
+
+    # Initialize dashboard creds.
+    # In a the query below, we test the Dashboard's `/api/rgw/daemon`,
+    # which needs that the dashboard can talk to RGW.
+    # `set-rgw-credentials` needs a running RGW daemon.
+    monA.succeed(
+        "echo 'foo bar baz qux' > /tmp/dashboard_pw",
+        "ceph dashboard ac-user-create admin -i /tmp/dashboard_pw administrator",
+        "ceph dashboard set-rgw-credentials",
+        "sync",
+    )
+
+    # Get dashboard auth token
+    auth_payload = json.dumps({"username": "admin", "password": "foo bar baz qux"})
+    auth_response = json.loads(monA.succeed(
+        f"curl --fail -s -X POST -H 'Accept: application/vnd.ceph.api.v1.0+json' -H 'Content-Type: application/json' -d '{auth_payload}' {dashboard}/api/auth",
+    ))
+    token = auth_response["token"]
+
+    # Check cluster health via dashboard API
+    health = json.loads(monA.succeed(
+        f"curl --fail -s -H 'Accept: application/vnd.ceph.api.v1.0+json' -H 'Authorization: Bearer {token}' {dashboard}/api/health/minimal",
+    ))
+    assert health["health"]["status"] == "HEALTH_OK"
+
+    # List daemons via REST API.
+    # This also requires a running RGW daemon, as it asserts on the first one.
+    rgw_daemons = json.loads(monA.succeed(
+        f"curl --fail -s -H 'Accept: application/vnd.ceph.api.v1.0+json' -H 'Authorization: Bearer {token}' {dashboard}/api/rgw/daemon",
+    ))
+    assert rgw_daemons[0]["id"] == "${cfg.monA.name}"
+
     # Shut down ceph on all machines in a very unpolite way
     monA.crash()
     osd0.crash()
     osd1.crash()
     osd2.crash()
 
-    # Start it up
+    # Start the mon first and mark the OSDs as down.
+    # Since the heartbeats are pretty high by default, the OSDs would otherwise be marked as up still.
+    # However we do not want to lower the heartbeats since this might cause flakey tests.
+    monA.start()
+    monA.wait_for_unit("ceph-mon-${cfg.monA.name}")
+    monA.wait_until_succeeds("ceph osd down all")
+    # Then start the OSDs as normal.
     osd0.start()
     osd1.start()
     osd2.start()
-    monA.start()
+    # Ensure they are all up.
+    osd0.wait_for_unit("network.target")
+    osd1.wait_for_unit("network.target")
+    osd2.wait_for_unit("network.target")
 
-    # Ensure the cluster comes back up again.
+    # FIXME: dmcrypt OSDs currently do not work out of the box.
+    # For a potential long-term fix see: https://github.com/NixOS/nixpkgs/pull/512912#discussion_r3140295546
+    osd1.succeed(
+        "ceph-volume lvm activate --no-tmpfs --no-systemd ${cfg.osd1.name} ${cfg.osd1.uuid}",
+        "systemctl start ceph-osd-${cfg.osd1.name}",
+    )
+
+    # Test the cluster state thoroughly.
     monA.wait_until_succeeds("ceph -s | grep 'mon: 1 daemons'")
     monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
-    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
     monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
     monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
 
     # Verify the recovery.
@@ -444,45 +545,50 @@ let
 
     # Create a CephFS.
     monA.succeed(
-        "ceph osd pool create cephfs-data 32 32",
-        "ceph osd pool create cephfs-metadata 32 32",
-        "ceph fs new cephfs cephfs-metadata cephfs-data",
+        "ceph fs volume create testing",
+        "ceph osd pool set cephfs.testing.data pg_num 32",
+        "ceph osd pool set cephfs.testing.meta pg_num 32",
     )
     # Wait for the MDS to claim the filesystem and become active.
-    monA.wait_until_succeeds("ceph fs status cephfs | grep -e 'active'", timeout=60)
+    monA.wait_until_succeeds("ceph fs status testing | grep -e 'active'", timeout=60)
 
-    # Distribute the admin keyring (and a plain secret file for the kernel
-    # client) to both client machines, so that they can authenticate.
+    # Create a subvolume, issue credentials, then distribute those credentials.
     monA.succeed(
-        "cp /etc/ceph/ceph.client.admin.keyring /tmp/shared",
-        "ceph-authtool -p /etc/ceph/ceph.client.admin.keyring > /tmp/shared/admin.secret",
+        "ceph fs subvolumegroup create testing group",
+        "ceph fs subvolume create testing subvolume --group_name group",
+        "ceph fs subvolume authorize testing subvolume kclient group",
+        "ceph fs subvolume authorize testing subvolume fuseclient group",
+        "ceph auth get client.kclient -o /tmp/shared/ceph.client.kclient.keyring",
+        "ceph auth get client.fuseclient -o /tmp/shared/ceph.client.fuseclient.keyring",
     )
-    kclient.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
-    fuseclient.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
-    kclient.succeed("cp /tmp/shared/admin.secret /etc/ceph/admin.secret")
+    kclient.succeed("cp /tmp/shared/ceph.client.kclient.keyring /etc/ceph")
+    fuseclient.succeed("cp /tmp/shared/ceph.client.fuseclient.keyring /etc/ceph")
+
+    # Get the volume path generated by Ceph.
+    volume_path = monA.succeed("ceph fs subvolume getpath testing subvolume group | tee /dev/stderr").strip()
 
     # Mount CephFS on the kernel client.
     # We force the messenger v2 protocol via "ms_mode=secure"; the cluster
-    # has msgr2 enabled (see "ceph mon enable-msgr2" above) and the legacy v1
+    # has msgr2 enabled (the monmap is created with a v2 address above) and the legacy v1
     # protocol apparently does not reconnect reliably after the servers are restarted.
     # The msgr2 monitor listens on port 3300 (instead of legacy v1 port 6789),
     # so we have to point the device string at that port explicitly.
     # `recover_session=clean` makes the kernel client automatically reconnect
     # (discarding its stale session) after the whole cluster has been down,
-    # which would otherwise leave the mount blocklisted and hanging forever.
+    # which would otherwise leave the mount blocklisted and hanging.
     # Real CephFS use may not prefer hanging `recover_session=clean`, and
     # prefer manual de-blocklisting to avoid any failed OS syscalls,
     # but for this test, discarding stale sessions is good enough.
     kclient.succeed("mkdir -p /mnt/cephfs")
     kclient.wait_until_succeeds(
-        "mount -t ceph ${cfg.monA.ip}:3300:/ /mnt/cephfs -o name=admin,secretfile=/etc/ceph/admin.secret,ms_mode=secure,recover_session=clean"
+        f"mount -t ceph kclient@.testing={volume_path} /mnt/cephfs -o ms_mode=secure,recover_session=clean"
     )
     kclient.succeed("mountpoint /mnt/cephfs")
 
     # Mount CephFS on the FUSE client using ceph-fuse.
     fuseclient.succeed("mkdir -p /mnt/cephfs")
     fuseclient.wait_until_succeeds(
-        "ceph-fuse --id admin -m ${cfg.monA.ip}:6789 /mnt/cephfs"
+        f"ceph-fuse --id fuseclient -m ${cfg.monA.ip}:3300 -r {volume_path} /mnt/cephfs"
     )
     fuseclient.succeed("mountpoint /mnt/cephfs")
 
@@ -510,24 +616,40 @@ let
     osd1.crash()
     osd2.crash()
 
-    # Start it up
+    # Start the mon first and mark the OSDs as down.
+    # Since the heartbeats are pretty high by default, the OSDs would otherwise be marked as up still.
+    # However we do not want to lower the heartbeats since this might cause flakey tests.
+    monA.start()
+    monA.wait_for_unit("ceph-mon-${cfg.monA.name}")
+    monA.wait_until_succeeds("ceph osd down all")
+    # Then start the OSDs as normal.
     osd0.start()
     osd1.start()
     osd2.start()
-    monA.start()
+    # Ensure they are all up.
+    osd0.wait_for_unit("network.target")
+    osd1.wait_for_unit("network.target")
+    osd2.wait_for_unit("network.target")
+
+    # FIXME: dmcrypt OSDs currently do not work out of the box.
+    # For a potential long-term fix see: https://github.com/NixOS/nixpkgs/pull/512912#discussion_r3140295546
+    osd1.succeed(
+        "ceph-volume lvm activate --no-tmpfs --no-systemd ${cfg.osd1.name} ${cfg.osd1.uuid}",
+        "systemctl start ceph-osd-${cfg.osd1.name}",
+    )
 
     # Ensure the cluster comes back up again.
     # See the note above on why this uses `wait_until_succeeds`.
     monA.wait_until_succeeds("ceph -s | grep 'mon: 1 daemons'")
     monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
-    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
     monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
 
     monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'", timeout=60)
 
     # Ensure the MDS/CephFS comes back up again, too.
     monA.wait_for_unit("ceph-mds-${cfg.monA.name}")
-    monA.wait_until_succeeds("ceph fs status cephfs | grep -e 'active'", timeout=60)
+    monA.wait_until_succeeds("ceph fs status testing | grep -e 'active'", timeout=60)
     monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
 
     # The clients kept running across the outage, so their CephFS mounts

nixos/tests/ceph-multi-node-deprecated-filestore.nix

@@ -1,291 +0,0 @@
-# Tests the legacy FileStore OSD backend.
-{ lib, ... }:
-let
-  cfg = {
-    clusterId = "066ae264-2a5d-4729-8001-6ad265f50b03";
-    monA = {
-      name = "a";
-      ip = "192.168.1.1";
-    };
-    osd0 = {
-      name = "0";
-      ip = "192.168.1.2";
-      key = "AQBCEJNa3s8nHRAANvdsr93KqzBznuIWm2gOGg==";
-      uuid = "55ba2294-3e24-478f-bee0-9dca4c231dd9";
-    };
-    osd1 = {
-      name = "1";
-      ip = "192.168.1.3";
-      key = "AQBEEJNac00kExAAXEgy943BGyOpVH1LLlHafQ==";
-      uuid = "5e97a838-85b6-43b0-8950-cb56d554d1e5";
-    };
-    osd2 = {
-      name = "2";
-      ip = "192.168.1.4";
-      key = "AQAdyhZeIaUlARAAGRoidDAmS6Vkp546UFEf5w==";
-      uuid = "ea999274-13d0-4dd5-9af9-ad25a324f72f";
-    };
-  };
-  generateCephConfig =
-    { daemonConfig }:
-    {
-      enable = true;
-      global = {
-        fsid = cfg.clusterId;
-        monHost = cfg.monA.ip;
-        monInitialMembers = cfg.monA.name;
-      };
-    }
-    // daemonConfig;
-
-  generateHost =
-    { cephConfig, networkConfig }:
-    { pkgs, ... }:
-    {
-      virtualisation = {
-        emptyDiskImages = [ 20480 ];
-        vlans = [ 1 ];
-      };
-
-      networking = networkConfig;
-
-      environment.systemPackages = with pkgs; [
-        bash
-        sudo
-        ceph
-        xfsprogs
-        netcat
-      ];
-
-      boot.kernelModules = [ "xfs" ];
-
-      services.ceph = cephConfig;
-    };
-
-  networkMonA = {
-    dhcpcd.enable = false;
-    interfaces.eth1.ipv4.addresses = lib.mkOverride 0 [
-      {
-        address = cfg.monA.ip;
-        prefixLength = 24;
-      }
-    ];
-    firewall = {
-      allowedTCPPorts = [
-        6789
-        3300
-      ];
-      allowedTCPPortRanges = [
-        {
-          from = 6800;
-          to = 7300;
-        }
-      ];
-    };
-  };
-  cephConfigMonA = generateCephConfig {
-    daemonConfig = {
-      mon = {
-        enable = true;
-        daemons = [ cfg.monA.name ];
-      };
-      mgr = {
-        enable = true;
-        daemons = [ cfg.monA.name ];
-      };
-    };
-  };
-
-  networkOsd = osd: {
-    dhcpcd.enable = false;
-    interfaces.eth1.ipv4.addresses = lib.mkOverride 0 [
-      {
-        address = osd.ip;
-        prefixLength = 24;
-      }
-    ];
-    firewall = {
-      allowedTCPPortRanges = [
-        {
-          from = 6800;
-          to = 7300;
-        }
-      ];
-    };
-  };
-
-  cephConfigOsd =
-    osd:
-    generateCephConfig {
-      daemonConfig = {
-        osd = {
-          enable = true;
-          daemons = [ osd.name ];
-        };
-      };
-    };
-
-  # Following deployment is based on the manual deployment described here:
-  # https://docs.ceph.com/docs/master/install/manual-deployment/
-  # For other ways to deploy a ceph cluster, look at the documentation at
-  # https://docs.ceph.com/docs/master/
-  testscript =
-    { ... }:
-    ''
-      start_all()
-
-      monA.wait_for_unit("network.target")
-      osd0.wait_for_unit("network.target")
-      osd1.wait_for_unit("network.target")
-      osd2.wait_for_unit("network.target")
-
-      # Bootstrap ceph-mon daemon
-      monA.succeed(
-          "sudo -u ceph ceph-authtool --create-keyring /tmp/ceph.mon.keyring --gen-key -n mon. --cap mon 'allow *'",
-          "sudo -u ceph ceph-authtool --create-keyring /etc/ceph/ceph.client.admin.keyring --gen-key -n client.admin --cap mon 'allow *' --cap osd 'allow *' --cap mds 'allow *' --cap mgr 'allow *'",
-          "sudo -u ceph ceph-authtool /tmp/ceph.mon.keyring --import-keyring /etc/ceph/ceph.client.admin.keyring",
-          "monmaptool --create --add ${cfg.monA.name} ${cfg.monA.ip} --fsid ${cfg.clusterId} /tmp/monmap",
-          "sudo -u ceph ceph-mon --mkfs -i ${cfg.monA.name} --monmap /tmp/monmap --keyring /tmp/ceph.mon.keyring",
-          "sudo -u ceph mkdir -p /var/lib/ceph/mgr/ceph-${cfg.monA.name}/",
-          "sudo -u ceph touch /var/lib/ceph/mon/ceph-${cfg.monA.name}/done",
-          "systemctl start ceph-mon-${cfg.monA.name}",
-      )
-      monA.wait_for_unit("ceph-mon-${cfg.monA.name}")
-      monA.succeed("ceph mon enable-msgr2")
-      monA.succeed("ceph config set mon auth_allow_insecure_global_id_reclaim false")
-
-      # Can't check ceph status until a mon is up
-      monA.succeed("ceph -s | grep 'mon: 1 daemons'")
-
-      # Start the ceph-mgr daemon, it has no deps and hardly any setup
-      monA.succeed(
-          "ceph auth get-or-create mgr.${cfg.monA.name} mon 'allow profile mgr' osd 'allow *' mds 'allow *' > /var/lib/ceph/mgr/ceph-${cfg.monA.name}/keyring",
-          "sync",  # to ensure shell redirection above is durable
-          "systemctl start ceph-mgr-${cfg.monA.name}",
-      )
-      monA.wait_for_unit("ceph-mgr-a")
-      monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
-      monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
-
-      # Send the admin keyring to the OSD machines
-      monA.succeed("cp /etc/ceph/ceph.client.admin.keyring /tmp/shared")
-      osd0.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
-      osd1.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
-      osd2.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
-
-      # Bootstrap OSDs
-      osd0.succeed(
-          "mkfs.xfs /dev/vdb",
-          "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd0.name}",
-          "mount /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd0.name}",
-          "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd0.name}/keyring --name osd.${cfg.osd0.name} --add-key ${cfg.osd0.key}",
-          'echo \'{"cephx_secret": "${cfg.osd0.key}"}\' | ceph osd new ${cfg.osd0.uuid} -i -',
-      )
-      osd1.succeed(
-          "mkfs.xfs /dev/vdb",
-          "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd1.name}",
-          "mount /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd1.name}",
-          "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd1.name}/keyring --name osd.${cfg.osd1.name} --add-key ${cfg.osd1.key}",
-          'echo \'{"cephx_secret": "${cfg.osd1.key}"}\' | ceph osd new ${cfg.osd1.uuid} -i -',
-      )
-      osd2.succeed(
-          "mkfs.xfs /dev/vdb",
-          "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
-          "mount /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
-          "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd2.name}/keyring --name osd.${cfg.osd2.name} --add-key ${cfg.osd2.key}",
-          'echo \'{"cephx_secret": "${cfg.osd2.key}"}\' | ceph osd new ${cfg.osd2.uuid} -i -',
-      )
-
-      # We `sync` so that the config survives the forced crashes below.
-      osd0.succeed(
-          "ceph-osd -i ${cfg.osd0.name} --mkfs --osd-uuid ${cfg.osd0.uuid}",
-          "chown -R ceph:ceph /var/lib/ceph/osd",
-          "sync",
-          "systemctl start ceph-osd-${cfg.osd0.name}",
-      )
-      osd1.succeed(
-          "ceph-osd -i ${cfg.osd1.name} --mkfs --osd-uuid ${cfg.osd1.uuid}",
-          "chown -R ceph:ceph /var/lib/ceph/osd",
-          "sync",
-          "systemctl start ceph-osd-${cfg.osd1.name}",
-      )
-      osd2.succeed(
-          "ceph-osd -i ${cfg.osd2.name} --mkfs --osd-uuid ${cfg.osd2.uuid}",
-          "chown -R ceph:ceph /var/lib/ceph/osd",
-          "sync",
-          "systemctl start ceph-osd-${cfg.osd2.name}",
-      )
-      monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
-      monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
-      monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
-
-      monA.succeed(
-          "ceph osd pool create multi-node-test 32 32",
-          "ceph osd pool ls | grep 'multi-node-test'",
-
-          # We need to enable an application on the pool, otherwise it will
-          # stay unhealthy in state POOL_APP_NOT_ENABLED.
-          # Creating a CephFS would do this automatically, but we haven't done that here.
-          # See: https://docs.ceph.com/en/reef/rados/operations/pools/#associating-a-pool-with-an-application
-          # We use the custom application name "nixos-test" for this.
-          "ceph osd pool application enable multi-node-test nixos-test",
-
-          "ceph osd pool rename multi-node-test multi-node-other-test",
-          "ceph osd pool ls | grep 'multi-node-other-test'",
-      )
-      monA.wait_until_succeeds("ceph -s | grep '2 pools, 33 pgs'")
-      monA.succeed("ceph osd pool set multi-node-other-test size 2")
-      monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
-      monA.wait_until_succeeds("ceph -s | grep '33 active+clean'")
-      monA.fail(
-          "ceph osd pool ls | grep 'multi-node-test'",
-          "ceph osd pool delete multi-node-other-test multi-node-other-test --yes-i-really-really-mean-it",
-      )
-
-      # Shut down ceph on all machines in a very unpolite way
-      monA.crash()
-      osd0.crash()
-      osd1.crash()
-      osd2.crash()
-
-      # Start it up
-      osd0.start()
-      osd1.start()
-      osd2.start()
-      monA.start()
-
-      # Ensure the cluster comes back up again
-      monA.succeed("ceph -s | grep 'mon: 1 daemons'")
-      monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
-      monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
-      monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
-      monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
-    '';
-in
-{
-  name = "basic-multi-node-ceph-cluster-deprecated-filestore";
-  meta = with lib.maintainers; {
-    maintainers = [ lejonet ];
-  };
-
-  nodes = {
-    monA = generateHost {
-      cephConfig = cephConfigMonA;
-      networkConfig = networkMonA;
-    };
-    osd0 = generateHost {
-      cephConfig = cephConfigOsd cfg.osd0;
-      networkConfig = networkOsd cfg.osd0;
-    };
-    osd1 = generateHost {
-      cephConfig = cephConfigOsd cfg.osd1;
-      networkConfig = networkOsd cfg.osd1;
-    };
-    osd2 = generateHost {
-      cephConfig = cephConfigOsd cfg.osd2;
-      networkConfig = networkOsd cfg.osd2;
-    };
-  };
-
-  testScript = testscript;
-}

nixos/tests/ceph-single-node-bluestore-dmcrypt.nix

@@ -1,269 +0,0 @@
-{ lib, ... }:
-
-let
-  # the single node ipv6 address
-  ip = "2001:db8:ffff::";
-  # the global ceph cluster id
-  cluster = "54465b37-b9d8-4539-a1f9-dd33c75ee45a";
-  # the fsids of OSDs
-  osd-fsid-map = {
-    "0" = "1c1b7ea9-06bf-4d30-9a01-37ac3a0254aa";
-    "1" = "bd5a6f49-69d5-428c-ac25-a99f0c44375c";
-    "2" = "c90de6c7-86c6-41da-9694-e794096dfc5c";
-  };
-in
-{
-  name = "basic-single-node-ceph-cluster-bluestore-dmcrypt";
-  meta.maintainers = with lib.maintainers; [
-    benaryorg
-    nh2
-  ];
-
-  nodes.ceph =
-    {
-      lib,
-      pkgs,
-      config,
-      ...
-    }:
-    {
-      # disks for bluestore
-      virtualisation.emptyDiskImages = [
-        20480
-        20480
-        20480
-      ];
-
-      # networking setup (no external connectivity required, only local IPv6)
-      networking.useDHCP = false;
-      systemd.network = {
-        enable = true;
-        wait-online.extraArgs = [
-          "-i"
-          "lo"
-        ];
-        networks = {
-          "40-loopback" = {
-            enable = true;
-            name = "lo";
-            DHCP = "no";
-            addresses = [ { Address = "${ip}/128"; } ];
-          };
-        };
-      };
-
-      # do not start the ceph target by default so we can format the disks first
-      systemd.targets.ceph.wantedBy = lib.mkForce [ ];
-
-      # add the packages to systemPackages so the testscript doesn't run into any unexpected issues
-      # this shouldn't be required on production systems which have their required packages in the unit paths only
-      # but it helps in case one needs to actually run the tooling anyway
-      environment.systemPackages = with pkgs; [
-        ceph
-        cryptsetup
-        lvm2
-      ];
-
-      services.ceph = {
-        enable = true;
-        client.enable = true;
-        extraConfig = {
-          public_addr = ip;
-          cluster_addr = ip;
-          # ipv6
-          ms_bind_ipv4 = "false";
-          ms_bind_ipv6 = "true";
-          # msgr2 settings
-          ms_cluster_mode = "secure";
-          ms_service_mode = "secure";
-          ms_client_mode = "secure";
-          ms_mon_cluster_mode = "secure";
-          ms_mon_service_mode = "secure";
-          ms_mon_client_mode = "secure";
-          # less default modules, cuts down on memory and startup time in the tests
-          mgr_initial_modules = "";
-          # distribute by OSD, not by host, as per https://docs.ceph.com/en/reef/cephadm/install/#single-host
-          osd_crush_chooseleaf_type = "0";
-        };
-        client.extraConfig."mon.0" = {
-          host = "ceph";
-          mon_addr = "v2:[${ip}]:3300";
-          public_addr = "v2:[${ip}]:3300";
-        };
-        global = {
-          fsid = cluster;
-          clusterNetwork = "${ip}/64";
-          publicNetwork = "${ip}/64";
-          monInitialMembers = "0";
-        };
-
-        mon = {
-          enable = true;
-          daemons = [ "0" ];
-        };
-
-        osd = {
-          enable = true;
-          daemons = builtins.attrNames osd-fsid-map;
-        };
-
-        mgr = {
-          enable = true;
-          daemons = [ "ceph" ];
-        };
-      };
-
-      systemd.services =
-        let
-          osd-name = id: "ceph-osd-${id}";
-          osd-pre-start = id: [
-            "!${config.services.ceph.osd.package.out}/bin/ceph-volume lvm activate --bluestore ${id} ${osd-fsid-map.${id}} --no-systemd"
-            "${config.services.ceph.osd.package.lib}/libexec/ceph/ceph-osd-prestart.sh --id ${id} --cluster ${config.services.ceph.global.clusterName}"
-          ];
-          osd-post-stop = id: [
-            "!${config.services.ceph.osd.package.out}/bin/ceph-volume lvm deactivate ${id}"
-          ];
-          map-osd = id: {
-            name = osd-name id;
-            value = {
-              serviceConfig.ExecStartPre = lib.mkForce (osd-pre-start id);
-              serviceConfig.ExecStopPost = osd-post-stop id;
-              unitConfig.ConditionPathExists = lib.mkForce [ ];
-              unitConfig.StartLimitBurst = lib.mkForce 4;
-              path = with pkgs; [
-                util-linux
-                lvm2
-                cryptsetup
-              ];
-            };
-          };
-        in
-        lib.pipe config.services.ceph.osd.daemons [
-          (map map-osd)
-          builtins.listToAttrs
-        ];
-    };
-
-  testScript = ''
-    start_all()
-
-    ceph.wait_for_unit("default.target")
-
-    # Bootstrap ceph-mon daemon
-    ceph.succeed(
-        "mkdir -p /var/lib/ceph/bootstrap-osd",
-        "ceph-authtool --create-keyring /tmp/ceph.mon.keyring --gen-key -n mon. --cap mon 'allow *'",
-        "ceph-authtool --create-keyring /etc/ceph/ceph.client.admin.keyring --gen-key -n client.admin --cap mon 'allow *' --cap osd 'allow *' --cap mds 'allow *' --cap mgr 'allow *'",
-        "ceph-authtool --create-keyring /var/lib/ceph/bootstrap-osd/ceph.keyring --gen-key -n client.bootstrap-osd --cap mon 'profile bootstrap-osd' --cap mgr 'allow r'",
-        "ceph-authtool /tmp/ceph.mon.keyring --import-keyring /etc/ceph/ceph.client.admin.keyring",
-        "ceph-authtool /tmp/ceph.mon.keyring --import-keyring /var/lib/ceph/bootstrap-osd/ceph.keyring",
-        "monmaptool --create --fsid ${cluster} --addv 0 'v2:[${ip}]:3300/0' --clobber /tmp/ceph.initial-monmap",
-        "mkdir -p /var/lib/ceph/mon/ceph-0",
-        "ceph-mon --mkfs -i 0 --monmap /tmp/ceph.initial-monmap --keyring /tmp/ceph.mon.keyring",
-        "chown ceph:ceph -R /tmp/ceph.mon.keyring /var/lib/ceph",
-        "systemctl start ceph-mon-0.service",
-    )
-
-    ceph.wait_for_unit("ceph-mon-0.service")
-    # should the mon not start or bind for some reason this gives us a better error message than the config commands running into a timeout
-    ceph.wait_for_open_port(3300, "${ip}")
-    ceph.succeed(
-        # required for HEALTH_OK
-        "ceph config set mon auth_allow_insecure_global_id_reclaim false",
-        # IPv6
-        "ceph config set global ms_bind_ipv4 false",
-        "ceph config set global ms_bind_ipv6 true",
-        # the new (secure) protocol
-        "ceph config set global ms_bind_msgr1 false",
-        "ceph config set global ms_bind_msgr2 true",
-        # just a small little thing
-        "ceph config set mon mon_compact_on_start true",
-    )
-
-    # Can't check ceph status until a mon is up
-    ceph.succeed("ceph -s | grep 'mon: 1 daemons'")
-
-    # Bootstrap OSDs (do this before starting the mgr because cryptsetup and the mgr both eat a lot of memory)
-    ceph.succeed(
-        # this will automatically do what's required for LVM, cryptsetup, and stores all the data in Ceph's internal databases
-        "ceph-volume lvm prepare --bluestore --data /dev/vdb --dmcrypt --no-systemd --osd-id 0 --osd-fsid ${osd-fsid-map."0"}",
-        "ceph-volume lvm prepare --bluestore --data /dev/vdc --dmcrypt --no-systemd --osd-id 1 --osd-fsid ${osd-fsid-map."1"}",
-        "ceph-volume lvm prepare --bluestore --data /dev/vdd --dmcrypt --no-systemd --osd-id 2 --osd-fsid ${osd-fsid-map."2"}",
-        "sudo ceph-volume lvm deactivate 0",
-        "sudo ceph-volume lvm deactivate 1",
-        "sudo ceph-volume lvm deactivate 2",
-        "chown -R ceph:ceph /var/lib/ceph",
-    )
-
-    # Start OSDs (again, argon2id eats memory, so this happens before starting the mgr)
-    ceph.succeed(
-        "systemctl start ceph-osd-0.service",
-        "systemctl start ceph-osd-1.service",
-        "systemctl start ceph-osd-2.service",
-    )
-    ceph.wait_until_succeeds("ceph -s | grep 'quorum 0'")
-    ceph.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
-
-    # Start the ceph-mgr daemon, after copying in the keyring
-    ceph.succeed(
-        "mkdir -p /var/lib/ceph/mgr/ceph-ceph/",
-        "ceph auth get-or-create -o /var/lib/ceph/mgr/ceph-ceph/keyring mgr.ceph mon 'allow profile mgr' osd 'allow *' mds 'allow *'",
-        "chown -R ceph:ceph /var/lib/ceph/mgr/ceph-ceph/",
-        "systemctl start ceph-mgr-ceph.service",
-    )
-    ceph.wait_for_unit("ceph-mgr-ceph")
-    ceph.wait_until_succeeds("ceph -s | grep 'quorum 0'")
-    ceph.wait_until_succeeds("ceph -s | grep 'mgr: ceph(active,'")
-    ceph.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
-    ceph.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
-
-    # test the actual storage
-    ceph.succeed(
-        "ceph osd pool create single-node-test 32 32",
-        "ceph osd pool ls | grep 'single-node-test'",
-
-        # We need to enable an application on the pool, otherwise it will
-        # stay unhealthy in state POOL_APP_NOT_ENABLED.
-        # Creating a CephFS would do this automatically, but we haven't done that here.
-        # See: https://docs.ceph.com/en/reef/rados/operations/pools/#associating-a-pool-with-an-application
-        # We use the custom application name "nixos-test" for this.
-        "ceph osd pool application enable single-node-test nixos-test",
-
-        "ceph osd pool rename single-node-test single-node-other-test",
-        "ceph osd pool ls | grep 'single-node-other-test'",
-    )
-    ceph.wait_until_succeeds("ceph -s | grep '2 pools, 33 pgs'")
-    ceph.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
-    ceph.wait_until_succeeds("ceph -s | grep '33 active+clean'")
-    ceph.fail(
-        # the old pool should be gone
-        "ceph osd pool ls | grep 'multi-node-test'",
-        # deleting the pool should fail without setting mon_allow_pool_delete
-        "ceph osd pool delete single-node-other-test single-node-other-test --yes-i-really-really-mean-it",
-    )
-
-    # rebooting gets rid of any potential tmpfs mounts or device-mapper devices
-    ceph.shutdown()
-    ceph.start()
-    ceph.wait_for_unit("default.target")
-
-    # Start it up (again OSDs first due to memory constraints of cryptsetup and mgr)
-    ceph.systemctl("start ceph-mon-0.service")
-    ceph.wait_for_unit("ceph-mon-0")
-    ceph.systemctl("start ceph-osd-0.service")
-    ceph.wait_for_unit("ceph-osd-0")
-    ceph.systemctl("start ceph-osd-1.service")
-    ceph.wait_for_unit("ceph-osd-1")
-    ceph.systemctl("start ceph-osd-2.service")
-    ceph.wait_for_unit("ceph-osd-2")
-    ceph.systemctl("start ceph-mgr-ceph.service")
-    ceph.wait_for_unit("ceph-mgr-ceph")
-
-    # Ensure the cluster comes back up again
-    ceph.succeed("ceph -s | grep 'mon: 1 daemons'")
-    ceph.wait_until_succeeds("ceph -s | grep 'quorum 0'")
-    ceph.wait_until_succeeds("ceph osd stat | grep -E '3 osds: 3 up[^,]*, 3 in'")
-    ceph.wait_until_succeeds("ceph -s | grep 'mgr: ceph(active,'")
-    ceph.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
-  '';
-}

nixos/tests/ceph-single-node-bluestore.nix

@@ -9,17 +9,14 @@ let
     };
     osd0 = {
       name = "0";
-      key = "AQBCEJNa3s8nHRAANvdsr93KqzBznuIWm2gOGg==";
       uuid = "55ba2294-3e24-478f-bee0-9dca4c231dd9";
     };
     osd1 = {
       name = "1";
-      key = "AQBEEJNac00kExAAXEgy943BGyOpVH1LLlHafQ==";
       uuid = "5e97a838-85b6-43b0-8950-cb56d554d1e5";
     };
     osd2 = {
       name = "2";
-      key = "AQAdyhZeIaUlARAAGRoidDAmS6Vkp546UFEf5w==";
       uuid = "ea999274-13d0-4dd5-9af9-ad25a324f72f";
     };
   };
@@ -51,6 +48,11 @@ let
         vlans = [ 1 ];
       };
 
+      # Ceph 20.2.4 introduced the aes256k cipher for authentication.
+      # Linux started supporting these in kernel version 7.0.
+      # Remove this line at the earliest convenience (i.e. when tests are run by 7.0 or higher by default).
+      boot.kernelPackages = pkgs.linuxPackages_latest;
+
       networking = networkConfig;
 
       environment.systemPackages = with pkgs; [
@@ -115,13 +117,18 @@ let
         "sudo -u ceph ceph-authtool --create-keyring /tmp/ceph.mon.keyring --gen-key -n mon. --cap mon 'allow *'",
         "sudo -u ceph ceph-authtool --create-keyring /etc/ceph/ceph.client.admin.keyring --gen-key -n client.admin --cap mon 'allow *' --cap osd 'allow *' --cap mds 'allow *' --cap mgr 'allow *'",
         "sudo -u ceph ceph-authtool /tmp/ceph.mon.keyring --import-keyring /etc/ceph/ceph.client.admin.keyring",
-        "monmaptool --create --add ${cfg.monA.name} ${cfg.monA.ip} --fsid ${cfg.clusterId} /tmp/monmap",
+        # Create the monmap with both a msgr2 (v2) and a legacy (v1) address.
+        # Using plain `--add` yields a v1-only monmap, which leaves the cluster
+        # in HEALTH_WARN with MON_MSGR2_NOT_ENABLED. Running `ceph mon
+        # enable-msgr2` afterwards is not enough: it rewrites the monmap (a
+        # subsequent `ceph mon dump` does show the v2 address), but the health
+        # check keeps reporting the mon as v1-only indefinitely.
+        "monmaptool --create --addv ${cfg.monA.name} '[v2:${cfg.monA.ip}:3300,v1:${cfg.monA.ip}:6789]' --fsid ${cfg.clusterId} /tmp/monmap",
         "sudo -u ceph ceph-mon --mkfs -i ${cfg.monA.name} --monmap /tmp/monmap --keyring /tmp/ceph.mon.keyring",
         "sudo -u ceph touch /var/lib/ceph/mon/ceph-${cfg.monA.name}/done",
         "systemctl start ceph-mon-${cfg.monA.name}",
     )
     monA.wait_for_unit("ceph-mon-${cfg.monA.name}")
-    monA.succeed("ceph mon enable-msgr2")
     monA.succeed("ceph config set mon auth_allow_insecure_global_id_reclaim false")
 
     # Can't check ceph status until a mon is up
@@ -148,14 +155,24 @@ let
         "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
         "echo bluestore > /var/lib/ceph/osd/ceph-${cfg.osd2.name}/type",
         "ln -sf /dev/vdd /var/lib/ceph/osd/ceph-${cfg.osd2.name}/block",
-        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd0.name}/keyring --name osd.${cfg.osd0.name} --add-key ${cfg.osd0.key}",
-        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd1.name}/keyring --name osd.${cfg.osd1.name} --add-key ${cfg.osd1.key}",
-        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd2.name}/keyring --name osd.${cfg.osd2.name} --add-key ${cfg.osd2.key}",
-        'echo \'{"cephx_secret": "${cfg.osd0.key}"}\' | ceph osd new ${cfg.osd0.uuid} -i -',
-        'echo \'{"cephx_secret": "${cfg.osd1.key}"}\' | ceph osd new ${cfg.osd1.uuid} -i -',
-        'echo \'{"cephx_secret": "${cfg.osd2.key}"}\' | ceph osd new ${cfg.osd2.uuid} -i -',
+        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd0.name}/keyring --name osd.${cfg.osd0.name} --gen-key",
+        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd1.name}/keyring --name osd.${cfg.osd1.name} --gen-key",
+        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd2.name}/keyring --name osd.${cfg.osd2.name} --gen-key",
     )
 
+    # Register the OSDs with the generated keys read back from their keyrings.
+    for osd_name, osd_uuid in [
+        ("${cfg.osd0.name}", "${cfg.osd0.uuid}"),
+        ("${cfg.osd1.name}", "${cfg.osd1.uuid}"),
+        ("${cfg.osd2.name}", "${cfg.osd2.uuid}"),
+    ]:
+        key = monA.succeed(
+            f"ceph-authtool --print-key /var/lib/ceph/osd/ceph-{osd_name}/keyring --name osd.{osd_name}"
+        ).strip()
+        monA.succeed(
+            f"echo '{{\"cephx_secret\": \"{key}\"}}' | ceph osd new {osd_uuid} -i -"
+        )
+
     # Initialize the OSDs with regular filestore
     monA.succeed(
         "ceph-osd -i ${cfg.osd0.name} --mkfs --osd-uuid ${cfg.osd0.uuid}",

nixos/tests/ceph-single-node-deprecated-filestore.nix

@@ -1,249 +0,0 @@
-{ lib, ... }:
-
-let
-  cfg = {
-    clusterId = "066ae264-2a5d-4729-8001-6ad265f50b03";
-    monA = {
-      name = "a";
-      ip = "192.168.1.1";
-    };
-    osd0 = {
-      name = "0";
-      key = "AQBCEJNa3s8nHRAANvdsr93KqzBznuIWm2gOGg==";
-      uuid = "55ba2294-3e24-478f-bee0-9dca4c231dd9";
-    };
-    osd1 = {
-      name = "1";
-      key = "AQBEEJNac00kExAAXEgy943BGyOpVH1LLlHafQ==";
-      uuid = "5e97a838-85b6-43b0-8950-cb56d554d1e5";
-    };
-    osd2 = {
-      name = "2";
-      key = "AQAdyhZeIaUlARAAGRoidDAmS6Vkp546UFEf5w==";
-      uuid = "ea999274-13d0-4dd5-9af9-ad25a324f72f";
-    };
-  };
-  generateCephConfig =
-    { daemonConfig }:
-    {
-      enable = true;
-      global = {
-        fsid = cfg.clusterId;
-        monHost = cfg.monA.ip;
-        monInitialMembers = cfg.monA.name;
-      };
-    }
-    // daemonConfig;
-
-  generateHost =
-    {
-      cephConfig,
-      networkConfig,
-    }:
-    { pkgs, ... }:
-    {
-      virtualisation = {
-        memorySize = 2048;
-        emptyDiskImages = [
-          20480
-          20480
-          20480
-        ];
-        vlans = [ 1 ];
-      };
-
-      networking = networkConfig;
-
-      environment.systemPackages = with pkgs; [
-        bash
-        sudo
-        ceph
-        xfsprogs
-      ];
-
-      boot.kernelModules = [ "xfs" ];
-
-      services.ceph = cephConfig;
-    };
-
-  networkMonA = {
-    dhcpcd.enable = false;
-    interfaces.eth1.ipv4.addresses = lib.mkOverride 0 [
-      {
-        address = cfg.monA.ip;
-        prefixLength = 24;
-      }
-    ];
-  };
-  cephConfigMonA = generateCephConfig {
-    daemonConfig = {
-      mon = {
-        enable = true;
-        daemons = [ cfg.monA.name ];
-      };
-      mgr = {
-        enable = true;
-        daemons = [ cfg.monA.name ];
-      };
-      osd = {
-        enable = true;
-        daemons = [
-          cfg.osd0.name
-          cfg.osd1.name
-          cfg.osd2.name
-        ];
-      };
-      rgw = {
-        enable = true;
-        daemons = [ cfg.monA.name ];
-      };
-    };
-  };
-
-  # Following deployment is based on the manual deployment described here:
-  # https://docs.ceph.com/docs/master/install/manual-deployment/
-  # For other ways to deploy a ceph cluster, look at the documentation at
-  # https://docs.ceph.com/docs/master/
-  testScript = ''
-    start_all()
-
-    monA.wait_for_unit("network.target")
-
-    # Bootstrap ceph-mon daemon
-    monA.succeed(
-        "sudo -u ceph ceph-authtool --create-keyring /tmp/ceph.mon.keyring --gen-key -n mon. --cap mon 'allow *'",
-        "sudo -u ceph ceph-authtool --create-keyring /etc/ceph/ceph.client.admin.keyring --gen-key -n client.admin --cap mon 'allow *' --cap osd 'allow *' --cap mds 'allow *' --cap mgr 'allow *'",
-        "sudo -u ceph ceph-authtool /tmp/ceph.mon.keyring --import-keyring /etc/ceph/ceph.client.admin.keyring",
-        "monmaptool --create --add ${cfg.monA.name} ${cfg.monA.ip} --fsid ${cfg.clusterId} /tmp/monmap",
-        "sudo -u ceph ceph-mon --mkfs -i ${cfg.monA.name} --monmap /tmp/monmap --keyring /tmp/ceph.mon.keyring",
-        "sudo -u ceph touch /var/lib/ceph/mon/ceph-${cfg.monA.name}/done",
-        "systemctl start ceph-mon-${cfg.monA.name}",
-    )
-    monA.wait_for_unit("ceph-mon-${cfg.monA.name}")
-    monA.succeed("ceph mon enable-msgr2")
-    monA.succeed("ceph config set mon auth_allow_insecure_global_id_reclaim false")
-
-    # Can't check ceph status until a mon is up
-    monA.succeed("ceph -s | grep 'mon: 1 daemons'")
-
-    # Start the ceph-mgr daemon, after copying in the keyring
-    monA.succeed(
-        "sudo -u ceph mkdir -p /var/lib/ceph/mgr/ceph-${cfg.monA.name}/",
-        "ceph auth get-or-create mgr.${cfg.monA.name} mon 'allow profile mgr' osd 'allow *' mds 'allow *' > /var/lib/ceph/mgr/ceph-${cfg.monA.name}/keyring",
-        "systemctl start ceph-mgr-${cfg.monA.name}",
-    )
-    monA.wait_for_unit("ceph-mgr-a")
-    monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
-    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
-
-    # Bootstrap OSDs
-    monA.succeed(
-        "mkfs.xfs /dev/vdb",
-        "mkfs.xfs /dev/vdc",
-        "mkfs.xfs /dev/vdd",
-        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd0.name}",
-        "mount /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd0.name}",
-        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd1.name}",
-        "mount /dev/vdc /var/lib/ceph/osd/ceph-${cfg.osd1.name}",
-        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
-        "mount /dev/vdd /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
-        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd0.name}/keyring --name osd.${cfg.osd0.name} --add-key ${cfg.osd0.key}",
-        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd1.name}/keyring --name osd.${cfg.osd1.name} --add-key ${cfg.osd1.key}",
-        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd2.name}/keyring --name osd.${cfg.osd2.name} --add-key ${cfg.osd2.key}",
-        'echo \'{"cephx_secret": "${cfg.osd0.key}"}\' | ceph osd new ${cfg.osd0.uuid} -i -',
-        'echo \'{"cephx_secret": "${cfg.osd1.key}"}\' | ceph osd new ${cfg.osd1.uuid} -i -',
-        'echo \'{"cephx_secret": "${cfg.osd2.key}"}\' | ceph osd new ${cfg.osd2.uuid} -i -',
-    )
-
-    # Initialize the OSDs with regular filestore
-    monA.succeed(
-        "ceph-osd -i ${cfg.osd0.name} --mkfs --osd-uuid ${cfg.osd0.uuid}",
-        "ceph-osd -i ${cfg.osd1.name} --mkfs --osd-uuid ${cfg.osd1.uuid}",
-        "ceph-osd -i ${cfg.osd2.name} --mkfs --osd-uuid ${cfg.osd2.uuid}",
-        "chown -R ceph:ceph /var/lib/ceph/osd",
-        "systemctl start ceph-osd-${cfg.osd0.name}",
-        "systemctl start ceph-osd-${cfg.osd1.name}",
-        "systemctl start ceph-osd-${cfg.osd2.name}",
-    )
-    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
-    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
-    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
-
-    monA.succeed(
-        "ceph osd pool create single-node-test 32 32",
-        "ceph osd pool ls | grep 'single-node-test'",
-
-        # We need to enable an application on the pool, otherwise it will
-        # stay unhealthy in state POOL_APP_NOT_ENABLED.
-        # Creating a CephFS would do this automatically, but we haven't done that here.
-        # See: https://docs.ceph.com/en/reef/rados/operations/pools/#associating-a-pool-with-an-application
-        # We use the custom application name "nixos-test" for this.
-        "ceph osd pool application enable single-node-test nixos-test",
-
-        "ceph osd pool rename single-node-test single-node-other-test",
-        "ceph osd pool ls | grep 'single-node-other-test'",
-    )
-    monA.wait_until_succeeds("ceph -s | grep '2 pools, 33 pgs'")
-    monA.succeed(
-        "ceph osd getcrushmap -o crush",
-        "crushtool -d crush -o decrushed",
-        "sed 's/step chooseleaf firstn 0 type host/step chooseleaf firstn 0 type osd/' decrushed > modcrush",
-        "crushtool -c modcrush -o recrushed",
-        "ceph osd setcrushmap -i recrushed",
-        "ceph osd pool set single-node-other-test size 2",
-    )
-    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
-    monA.wait_until_succeeds("ceph -s | grep '33 active+clean'")
-    monA.fail(
-        "ceph osd pool ls | grep 'multi-node-test'",
-        "ceph osd pool delete single-node-other-test single-node-other-test --yes-i-really-really-mean-it",
-    )
-
-    # Bootstrap RGW
-    monA.succeed(
-        "sudo -u ceph mkdir -p /var/lib/ceph/radosgw/ceph-${cfg.monA.name}",
-        "ceph auth get-or-create client.${cfg.monA.name} osd 'allow rwx' mon 'allow rw' > /var/lib/ceph/radosgw/ceph-${cfg.monA.name}/keyring",
-        "chown ceph:ceph /var/lib/ceph/radosgw/ceph-${cfg.monA.name}/keyring",
-        "systemctl start ceph-rgw-${cfg.monA.name}",
-    )
-    monA.wait_for_unit("ceph-rgw-${cfg.monA.name}")
-    monA.wait_for_open_port(7480)
-
-    # Shut down ceph by stopping ceph.target.
-    monA.succeed("systemctl stop ceph.target")
-
-    # Start it up
-    monA.succeed("systemctl start ceph.target")
-    monA.wait_for_unit("ceph-mon-${cfg.monA.name}")
-    monA.wait_for_unit("ceph-mgr-${cfg.monA.name}")
-    monA.wait_for_unit("ceph-osd-${cfg.osd0.name}")
-    monA.wait_for_unit("ceph-osd-${cfg.osd1.name}")
-    monA.wait_for_unit("ceph-osd-${cfg.osd2.name}")
-    monA.wait_for_unit("ceph-rgw-${cfg.monA.name}")
-
-    # Ensure the cluster comes back up again
-    monA.succeed("ceph -s | grep 'mon: 1 daemons'")
-    monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
-    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
-    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
-    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
-  '';
-in
-{
-  name = "basic-single-node-ceph-cluster-deprecated-filestore";
-  meta = with lib.maintainers; {
-    maintainers = [
-      lejonet
-      johanot
-    ];
-  };
-
-  nodes = {
-    monA = generateHost {
-      cephConfig = cephConfigMonA;
-      networkConfig = networkMonA;
-    };
-  };
-
-  inherit testScript;
-}

nixos/tests/flaresolverr.nix

@@ -10,11 +10,30 @@
         enable = true;
         port = 8888;
       };
+
+      services.nginx = {
+        enable = true;
+        virtualHosts.localhost = {
+          locations."/" = {
+            return = "200 'hello world'";
+            extraConfig = ''
+              default_type text/plain;
+            '';
+          };
+        };
+      };
     };
 
-  testScript = ''
+  testScript = /* python */ ''
+    import json
+
     machine.wait_for_unit("flaresolverr.service")
     machine.wait_for_open_port(8888)
     machine.succeed("curl --fail http://localhost:8888/")
+
+    res = machine.succeed("""curl --fail http://localhost:8888/v1 -X POST --json '{ "cmd": "request.get", "url": "http://localhost/", "maxTimeout": 10000 }'""")
+    res = json.loads(res)
+    response = res["solution"]["response"]
+    assert "hello world" in response, f"Could not find 'hello world' in response: {response}"
   '';
 }

nixos/tests/frigate.nix

@@ -77,5 +77,7 @@
 
     # wait for a recording to appear
     machine.wait_for_file("/var/cache/frigate/test@*.mp4")
+
+    machine.log(machine.execute("systemd-analyze security frigate.service | grep -v ✓")[1])
   '';
 }

nixos/tests/homebox.nix

@@ -14,6 +14,8 @@ in
           services.homebox = {
             enable = true;
             settings.HBOX_WEB_PORT = port;
+            settings.HBOX_OPTIONS_ALLOW_REGISTRATION = "true";
+            settings.HBOX_LOG_LEVEL = "trace";
           };
         };
 
@@ -50,6 +52,7 @@ in
     in
     self;
   testScript = ''
+    import json
     def test_homebox(node):
       node.wait_for_unit("homebox.service")
       node.wait_for_open_port(${port})
@@ -57,6 +60,29 @@ in
       node.succeed("curl --fail -X GET 'http://localhost:${port}/'")
       out = node.succeed("curl --fail 'http://localhost:${port}/api/v1/status'")
       assert '"health":true' in out
+      node.succeed("curl --request POST --fail 'http://localhost:${port}/api/v1/users/register' \
+        --data '{\"email\":\"a@b.c\",\"name\":\"test\",\"password\":\"password\"}' \
+      ")
+      login = node.succeed("curl --request POST --fail 'http://localhost:${port}/api/v1/users/login' \
+        --data-urlencode 'password=password' \
+        --data-urlencode 'username=a@b.c' \
+      ")
+      login_data = json.loads(login)
+      token = login_data["token"]
+      locations = node.succeed(f"curl --request GET --fail 'http://localhost:${port}/api/v1/entities?isLocation=true' \
+        --header 'Authorization: {token}' \
+      ")
+      location_id = json.loads(locations)["items"][0]["id"]
+      item = node.succeed(f"curl --request POST --fail 'http://localhost:${port}/api/v1/entities' \
+        --header 'Authorization: {token}' \
+        --data '{{\"name\":\"testitem\",\"parentId\":\"{location_id}\"}}' \
+      ")
+      item_id = json.loads(item)["id"]
+      node.succeed(f"curl --request POST --fail 'http://localhost:${port}/api/v1/entities/{item_id}/attachments' \
+        --header 'Authorization: {token}' \
+        --form 'file=test;type=text/plain;filename=test.txt' \
+        --form name=test.txt \
+      ")
 
     test_homebox(simple)
     simple.send_monitor_command("quit")

nixos/tests/kexec.nix

@@ -2,7 +2,7 @@
 {
   name = "kexec";
   meta = with lib.maintainers; {
-    maintainers = [
+    maintainers = pkgs.kexec-tools.meta.maintainers ++ [
       flokli
       lassulus
     ];

nixos/tests/music-assistant.nix

@@ -1,11 +1,11 @@
 {
-  lib,
+  pkgs,
   ...
 }:
 
 {
   name = "music-assistant";
-  meta.maintainers = with lib.maintainers; [ hexa ];
+  meta = { inherit (pkgs.music-assistant.meta) maintainers; };
 
   containers.machine = {
     services.music-assistant = {

nixos/tests/nebula/connectivity.nix

@@ -1,6 +1,9 @@
-{ pkgs, lib, ... }:
+{
+  pkgs,
+  lib,
+  ...
+}:
 let
-
   # We'll need to be able to trade cert files between nodes via scp.
   inherit (import ../ssh-keys.nix pkgs)
     snakeOilPrivateKey
@@ -44,13 +47,11 @@ let
       }
       extraConfig
     ];
-
 in
 {
   name = "nebula";
 
   nodes = {
-
     lighthouse =
       { ... }@args:
       makeNebulaNode args "lighthouse" {
@@ -97,6 +98,24 @@ in
             };
           };
         };
+
+        # A lighthouse can run without a tun interface, no device name = skip length check pr 565501
+        services.nebula.networks.tunless = {
+          ca = "/etc/nebula/ca.crt";
+          cert = "/etc/nebula/lighthouse.crt";
+          key = "/etc/nebula/lighthouse.key";
+          isLighthouse = true;
+          listen = {
+            host = "0.0.0.0";
+            port = 4243;
+          };
+          tun = {
+            disable = true;
+            device = "nebula.tunless-too-long";
+          };
+          user = "nebula-smoke";
+          group = "nebula-smoke";
+        };
       };
 
     allowAny =
@@ -265,12 +284,10 @@ in
           };
         };
       };
-
   };
 
   testScript =
     let
-
       setUpPrivateKey = name: ''
         ${name}.start()
         ${name}.succeed(
@@ -379,6 +396,11 @@ in
       lighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.1", timeout=10)
       lighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::1", timeout=10)
 
+      # The tunless network starts without a tun device despite its (deliberately over-long) configured device name. pr 565501
+      lighthouse.wait_for_unit("nebula@tunless.service")
+      lighthouse.wait_until_succeeds("ss -lun | grep -q ':4243'", timeout=10)
+      lighthouse.fail("ip link show nebula.tunless-too-long")
+
       # Start all the machines to be set up
       allowAny.start()
       allowFromLighthouse.start()

nixos/tests/nginx-otel.nix

@@ -0,0 +1,56 @@
+{
+  name = "nginx-otel";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.opentelemetry-collector = {
+        enable = true;
+        settings = {
+          receivers.otlp.protocols.grpc.endpoint = "127.0.0.1:4317";
+          exporters.debug.verbosity = "detailed";
+          service.pipelines.traces = {
+            receivers = [ "otlp" ];
+            exporters = [ "debug" ];
+          };
+        };
+      };
+      services.nginx = {
+        enable = true;
+        additionalModules = [ pkgs.nginxModules.otel ];
+        commonHttpConfig = ''
+          otel_exporter {
+            endpoint localhost:4317;
+          }
+          otel_service_name "nginx-test";
+          otel_trace on;
+        '';
+        virtualHosts."localhost".locations."/".extraConfig = ''
+          otel_trace_context propagate;
+          otel_span_name "handle";
+          return 200 "otel-ok";
+        '';
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      cfg = nodes.machine.services.nginx;
+    in
+    ''
+      machine.wait_for_unit("opentelemetry-collector")
+      machine.wait_for_open_port(4317)
+      machine.wait_for_unit("nginx")
+      machine.wait_for_open_port(80)
+
+      machine.succeed("test -e ${cfg.package}/modules/ngx_otel_module.so")
+      machine.succeed("grep -F ngx_otel_module.so ${cfg.package}/etc/nginx/dynamic-modules.conf")
+
+      response = machine.wait_until_succeeds("curl -fsS http://127.0.0.1/")
+      t.assertIn("otel-ok", response)
+
+      machine.wait_until_succeeds("journalctl -u opentelemetry-collector --grep 'service.name: Str\\(nginx-test\\)'")
+      machine.wait_until_succeeds("journalctl -u opentelemetry-collector --grep 'Name +: handle'")
+    '';
+}

nixos/tests/nix-required-mounts/default.nix

@@ -12,10 +12,12 @@ in
     {
       virtualisation.writableStore = true;
       system.extraDependencies = [ (pkgs.runCommand "deps" { } "mkdir $out").inputDerivation ];
-      nix.nixPath = [ "nixpkgs=${../../..}" ];
-      nix.settings.substituters = lib.mkForce [ ];
-      nix.settings.system-features = [ "supported-feature" ];
-      nix.settings.experimental-features = [ "nix-command" ];
+      nix.settings = {
+        experimental-features = [ "nix-command" ];
+        nix-path = [ "nixpkgs=${../../..}" ];
+        substituters = lib.mkForce [ ];
+        system-features = [ "supported-feature" ];
+      };
       nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
       programs.nix-required-mounts.enable = true;
       programs.nix-required-mounts.allowedPatterns.supported-feature = {

nixos/tests/nixos-rebuild-target-host-interrupted.nix

@@ -0,0 +1,236 @@
+{ hostPkgs, ... }:
+
+# This test recreates a remote deployment scenario where the connection
+# between deployer and target is closed during the deployment - in this
+# case because the connection goes over a 'reverse ssh' tunnel service
+# that has changes that are being deployed.
+
+# This is not seamless (the deployer doesn't get to see the logs after
+# the disconnect), but is a lot better than the old behaviour, where
+# the switch was aborted and the connection never restored.
+
+{
+  name = "nixos-rebuild-target-host-interrupted";
+
+  # TODO: remove overlay from  nixos/modules/profiles/installation-device.nix
+  #        make it a _small package instead, then remove pkgsReadOnly = false;.
+  node.pkgsReadOnly = false;
+
+  # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+  defaults.nix.enable = true;
+
+  nodes = {
+    deployer =
+      {
+        nodes,
+        lib,
+        pkgs,
+        ...
+      }:
+      let
+        inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+      in
+      {
+        imports = [
+          ../modules/profiles/installation-device.nix
+        ];
+
+        nix.settings = {
+          substituters = lib.mkForce [ ];
+          hashed-mirrors = null;
+          connect-timeout = 1;
+        };
+
+        system.includeBuildDependencies = true;
+
+        virtualisation = {
+          cores = 2;
+          memorySize = 3072;
+        };
+
+        services.openssh.enable = true;
+        users.users.root.openssh.authorizedKeys.keys = [ nodes.target.system.build.publicKey ];
+
+        system.build.privateKey = snakeOilPrivateKey;
+        system.build.publicKey = snakeOilPublicKey;
+        system.switch.enable = true;
+
+        services.getty.autologinUser = lib.mkForce "root";
+      };
+
+    target =
+      {
+        nodes,
+        lib,
+        pkgs,
+        ...
+      }:
+      let
+        inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+        targetConfig = {
+          documentation.enable = false;
+          services.openssh.enable = true;
+          system.build.privateKey = snakeOilPrivateKey;
+          system.build.publicKey = snakeOilPublicKey;
+
+          users.users.root.openssh.authorizedKeys.keys = [ nodes.deployer.system.build.publicKey ];
+          users.users.alice.openssh.authorizedKeys.keys = [ nodes.deployer.system.build.publicKey ];
+          users.users.bob.openssh.authorizedKeys.keys = [ nodes.deployer.system.build.publicKey ];
+
+          users.users.alice.extraGroups = [ "wheel" ];
+          users.users.bob.extraGroups = [ "wheel" ];
+
+          # Disable sudo for root to ensure sudo isn't called without `--sudo`
+          security.sudo.extraRules = lib.mkForce [
+            {
+              groups = [ "wheel" ];
+              commands = [ { command = "ALL"; } ];
+            }
+            {
+              users = [ "alice" ];
+              commands = [
+                {
+                  command = "ALL";
+                  options = [ "NOPASSWD" ];
+                }
+              ];
+            }
+          ];
+
+          nix.settings.trusted-users = [ "@wheel" ];
+
+          environment.etc."autossh-identity.key" = {
+            source = nodes.target.system.build.privateKey;
+            mode = "0600";
+          };
+
+          services.autossh-ng.sessions.will-be-interrupted-by-rebuild = {
+            user = "root";
+            destination = "deployer";
+            extraArguments = "-R2222:localhost:22 -i/etc/autossh-identity.key";
+            hostKeyChecking = false;
+          };
+          # Faster retry to avoid slow test
+          systemd.services.autossh-ng-will-be-interrupted-by-rebuild.serviceConfig.RestartSec =
+            lib.mkForce "1s";
+        };
+      in
+      {
+        imports = [ ./common/user-account.nix ];
+
+        config = lib.mkMerge [
+          targetConfig
+          {
+            system.build = {
+              inherit targetConfig;
+            };
+            system.switch.enable = true;
+
+            networking.hostName = "target";
+          }
+        ];
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      sshConfig = builtins.toFile "ssh.conf" ''
+        UserKnownHostsFile=/dev/null
+        StrictHostKeyChecking=no
+      '';
+
+      targetConfigJSON = hostPkgs.writeText "target-configuration.json" (
+        builtins.toJSON nodes.target.system.build.targetConfig
+      );
+
+      targetNetworkJSON = hostPkgs.writeText "target-network.json" (
+        builtins.toJSON nodes.target.system.build.networkConfig
+      );
+
+      configFile =
+        hostname:
+        hostPkgs.writeText "configuration.nix" # nix
+          ''
+            { lib, pkgs, modulesPath, ... }: {
+              imports = [
+                (modulesPath + "/virtualisation/qemu-vm.nix")
+                (modulesPath + "/virtualisation/guest-networking-options.nix")
+                (modulesPath + "/testing/test-instrumentation.nix")
+                (modulesPath + "/../tests/common/user-account.nix")
+                (lib.modules.importJSON ./target-configuration.json)
+                (lib.modules.importJSON ./target-network.json)
+                ./hardware-configuration.nix
+              ];
+
+              boot.loader.grub = {
+                enable = true;
+                device = "/dev/vda";
+                forceInstall = true;
+              };
+
+              # We're changing the '-E' parameter to the new hostname here,
+              # not because we care about the logs, but because we want to
+              # force the scenario where the connection is broken during the
+              # deployment (because the autossh-ng service is stopped and
+              # started):
+              services.autossh-ng.sessions.will-be-interrupted-by-rebuild.extraArguments = "-R2222:localhost:22 -i/etc/autossh-identity.key -E ${hostname}";
+
+              # this will be asserted to validate the switch happened:
+              networking.hostName = "${hostname}";
+            }
+          '';
+    in
+    # python
+    ''
+      start_all()
+      target.wait_for_open_port(22)
+
+      deployer.wait_until_succeeds("ping -c1 target")
+      deployer.succeed("install -Dm 600 ${nodes.deployer.system.build.privateKey} ~root/.ssh/id_ecdsa")
+      deployer.succeed("install ${sshConfig} ~root/.ssh/config")
+
+      target.succeed("nixos-generate-config")
+      deployer.succeed("scp alice@target:/etc/nixos/hardware-configuration.nix /root/hardware-configuration.nix")
+      target.wait_for_unit("autossh-ng-will-be-interrupted-by-rebuild.service")
+
+      deployer.copy_from_host("${configFile "config-1-deployed"}", "/root/configuration-1.nix")
+      deployer.copy_from_host("${configFile "config-2-deployed"}", "/root/configuration-2.nix")
+      deployer.copy_from_host("${targetNetworkJSON}", "/root/target-network.json")
+      deployer.copy_from_host("${targetConfigJSON}", "/root/target-configuration.json")
+
+      with subtest("Deploy to alice@target via reverse ssh"):
+        deployer.wait_for_unit("multi-user.target")
+        # Uses TTY/send_chars instead of deployer.succeed to set NIX_SSHOPTS
+        deployer.send_chars("NIX_SSHOPTS=\"-p 2222\" nixos-rebuild switch -I nixos-config=/root/configuration-1.nix --target-host alice@localhost --sudo\n")
+
+        # the connection breaks, but the 'switch' should now continue in the background:
+        deployer.wait_until_tty_matches("1", "error: while running command with remote sudo")
+
+        def deployed(last_try: bool) -> bool:
+            target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname", timeout=20).rstrip()
+            if last_try:
+                print(f"Still seeing hostname {target_hostname}")
+            return target_hostname == "config-1-deployed"
+        retry(deployed)
+
+      with subtest("Deploy to bob@target via reverse ssh with password-based sudo"):
+        deployer.wait_for_unit("multi-user.target")
+        # Uses TTY/send_chars instead of deployer.succeed to set NIX_SSHOPTS and for ask-sudo-password
+        deployer.send_chars("""NIX_SSHOPTS="-p 2222" nixos-rebuild switch -I nixos-config=/root/configuration-2.nix --target-host bob@localhost --ask-sudo-password; printf '%s\\n' "$?" > /tmp/bob-rebuild-status\n""")
+        deployer.wait_until_tty_matches("1", "password for bob")
+        deployer.send_chars("${nodes.target.users.users.bob.password}\n")
+
+        # the connection breaks, but the 'switch' should now continue in the background:
+        deployer.wait_for_file("/tmp/bob-rebuild-status")
+        status = deployer.succeed("cat /tmp/bob-rebuild-status").strip()
+        assert status != "0", "Expected the interrupted SSH deployment to report failure"
+
+        def deployed(last_try: bool) -> bool:
+            target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname", timeout=20).rstrip()
+            if last_try:
+                print(f"Still seeing hostname {target_hostname}")
+            return target_hostname == "config-2-deployed"
+        retry(deployed)
+    '';
+}

nixos/tests/pocket-id.nix

@@ -36,13 +36,18 @@ in
           enable = true;
           settings = {
             PORT = 10001;
-            DB_CONNECTION_STRING = "host=/run/postgresql user=${username} database=${username}";
+            DB_CONNECTION_STRING = "postgresql:///${username}?host=/run/postgresql";
           };
           credentials = {
             inherit ENCRYPTION_KEY;
           };
         };
 
+        systemd.services.pocket-id = {
+          after = [ "postgresql.target" ];
+          requires = [ "postgresql.target" ];
+        };
+
         services.postgresql = {
           enable = true;
           ensureUsers = [

nixos/tests/postgresql/wal2json.nix

@@ -22,6 +22,7 @@ let
               wal_level = "logical";
               max_replication_slots = "10";
               max_wal_senders = "10";
+              output_plugin_libraries = "wal2json";
             };
           };
         };

nixos/tests/qgis.nix

@@ -90,7 +90,6 @@ import ./make-test-python.nix (
       # test server
       machine.succeed("${qgisPackage}/bin/qgis_mapserver --version | grep 'QGIS ${qgisPackage.version}'")
 
-      machine.succeed("curl --head http://localhost | grep 'Server:.*${qgisPackage.version}'")
       machine.succeed("curl http://localhost/index.json | grep 'Landing page as JSON'")
     '';
   }

nixos/tests/rundeck.nix

@@ -12,6 +12,13 @@
           group = "rundeck";
         };
 
+        environment.etc."rundeck-tokens.properties" = {
+          text = "testadmin: nixostesttoken,admin";
+          mode = "0400";
+          user = "rundeck";
+          group = "rundeck";
+        };
+
         services.rundeck = {
           enable = true;
           serverHostname = "rundeck";
@@ -20,6 +27,7 @@
           serverPort = 4441;
           database.type = "h2";
           openFirewall = true;
+          frameworkSettings."rundeck.tokens.file" = "/etc/rundeck-tokens.properties";
         };
 
         environment.systemPackages = with pkgs; [
@@ -32,17 +40,8 @@
   testScript = ''
     start_all()
 
-    def login_and_verify_api(machine, host, port, user, password, timeout=300):
-        """Authenticate via Rundeck form login and verify API access."""
-        machine.wait_until_succeeds(
-            f"curl -s -c /tmp/cookies -L"
-            f" -d 'j_username={user}&j_password={password}'"
-            f" http://{host}:{port}/j_security_check -o /dev/null"
-            f" && curl -s -b /tmp/cookies -H 'Accept: application/json'"
-            f" http://{host}:{port}/api/26/system/info"
-            f" | jq -e '.system.rundeck.version'",
-            timeout=timeout,
-        )
+    api = "http://rundeck:4441/api/26"
+    token = "-H 'X-Rundeck-Auth-Token: nixostesttoken' -H 'Accept: application/json'"
 
     def properties(machine, path):
         return machine.succeed(f"cat {path}").replace("\\", "").replace(" = ", "=")
@@ -90,21 +89,32 @@
             "[ \"$(stat -c %U /etc/rundeck/realm.properties)\" = rundeck ]"
         )
 
-    with subtest("API authentication via form login"):
-        login_and_verify_api(rundeck, "rundeck", 4441, "testadmin", "testpassword")
+    with subtest("Form login accepts realm credentials"):
+        rundeck.wait_until_succeeds(
+            "curl -s -o /dev/null -w '%{url_effective}' -c /tmp/login-cookies -L"
+            " -d 'j_username=testadmin&j_password=testpassword'"
+            " http://rundeck:4441/j_security_check"
+            " | grep -qvE 'error|login'",
+            timeout=300,
+        )
+
+    with subtest("API authentication via static token"):
+        rundeck.wait_until_succeeds(
+            f"curl -s {token} {api}/system/info"
+            " | jq -e '.system.rundeck.version'",
+            timeout=300,
+        )
 
         rundeck.succeed(
-            "curl -s -b /tmp/cookies -X POST"
-            " -H 'Accept: application/json'"
+            f"curl -s {token} -X POST"
             " -H 'Content-Type: application/json'"
             " -d '{\"name\":\"test-project\",\"config\":{}}'"
-            " http://rundeck:4441/api/26/projects"
+            f" {api}/projects"
             " | jq -e '.name == \"test-project\"'"
         )
 
         rundeck.succeed(
-            "curl -s -b /tmp/cookies -H 'Accept: application/json'"
-            " http://rundeck:4441/api/26/projects"
+            f"curl -s {token} {api}/projects"
             " | jq -e 'any(.[]; .name == \"test-project\")'"
         )
   '';

nixos/tests/syncthing/folders.nix

@@ -1,148 +1,197 @@
 { lib, pkgs, ... }:
 let
-  genNodeId =
-    name:
-    pkgs.runCommand "syncthing-test-certs-${name}" { } ''
-      mkdir -p $out
-      ${pkgs.syncthing}/bin/syncthing generate --home=$out
-      ${pkgs.libxml2}/bin/xmllint --xpath 'string(configuration/device/@id)' $out/config.xml > $out/id
-    '';
-  idA = genNodeId "a";
-  idB = genNodeId "b";
-  idC = genNodeId "c";
-  testPassword = "it's a secret";
-in
-{
-  name = "syncthing";
-  meta.maintainers = with pkgs.lib.maintainers; [ zarelit ];
+  nodeNames = [
+    "a"
+    "b"
+    "c"
+  ];
+  nodeDirs = lib.genAttrs nodeNames (n: ./test-nodes + "/${n}");
+  nodeData = lib.mapAttrs (n: v: {
+    cert = "${v}/cert.pem";
+    key = "${v}/key.pem";
+    id = lib.fileContents (v + "/id");
+  }) nodeDirs;
 
-  nodes = {
-    a =
-      { config, ... }:
-      {
-        environment.etc.bar-encryption-password.text = testPassword;
-        services.syncthing = {
-          enable = true;
-          openDefaultPorts = true;
-          cert = "${idA}/cert.pem";
-          key = "${idA}/key.pem";
-          guiAddress = "unix:///run/syncthing/syncthing.sock";
-          settings = {
-            devices.b.id = lib.fileContents "${idB}/id";
-            devices.c.id = lib.fileContents "${idC}/id";
-            folders.foo = {
-              path = "/var/lib/syncthing/foo";
-              devices = [ "b" ];
-            };
-            folders.bar = {
-              path = "/var/lib/syncthing/bar";
-              devices = [
-                {
-                  name = "c";
-                  encryptionPasswordFile = "/etc/${config.environment.etc.bar-encryption-password.target}";
-                }
-              ];
-            };
-            folders.baz = {
-              path = "/var/lib/syncthing/baz";
-              devices = [
-                "b"
-                "c"
-              ];
-              ignorePatterns = [ ];
-            };
-            folders."foo bar" = {
-              path = "/var/lib/syncthing/foo-bar";
-              devices = [
-                "b"
-              ];
-            };
-          };
-        };
-      };
-    b =
-      { config, ... }:
-      {
-        environment.etc.bar-encryption-password.text = testPassword;
-        services.syncthing = {
-          enable = true;
-          openDefaultPorts = true;
-          cert = "${idB}/cert.pem";
-          key = "${idB}/key.pem";
-          settings = {
-            devices.a.id = lib.fileContents "${idA}/id";
-            devices.c.id = lib.fileContents "${idC}/id";
-            folders.foo = {
-              path = "/var/lib/syncthing/foo";
-              devices = [ "a" ];
-            };
-            folders.bar = {
-              path = "/var/lib/syncthing/bar";
-              devices = [
-                {
-                  name = "c";
-                  encryptionPasswordFile = "/etc/${config.environment.etc.bar-encryption-password.target}";
-                }
-              ];
-            };
-            folders.baz = {
-              path = "/var/lib/syncthing/baz";
-              devices = [
-                "a"
-                "c"
-              ];
-              ignorePatterns = [
-                "notB"
-              ];
-            };
-            # Test how we handle white spaces in folder IDs
-            folders."foo bar" = {
-              path = "/var/lib/syncthing/foo-bar";
-              devices = [
-                "a"
-              ];
-              ignorePatterns = [
-                "notB"
-                # Just test that an apostrophe doesn't break the curl config
-                # commands. See: https://github.com/NixOS/nixpkgs/issues/554744
-                "apostrophe'"
-              ];
-            };
-          };
-        };
-      };
-    c = {
-      services.syncthing = {
-        enable = true;
-        openDefaultPorts = true;
-        cert = "${idC}/cert.pem";
-        key = "${idC}/key.pem";
-        settings = {
-          devices.a.id = lib.fileContents "${idA}/id";
-          devices.b.id = lib.fileContents "${idB}/id";
-          folders.bar = {
-            path = "/var/lib/syncthing/bar";
-            devices = [
-              "a"
-              "b"
-            ];
-            type = "receiveencrypted";
-          };
-          folders.baz = {
-            path = "/var/lib/syncthing/baz";
-            devices = [
-              "a"
-              "b"
-            ];
-            ignorePatterns = [
-              "notC"
-            ];
-          };
-        };
-      };
+  testPassword = "it's a secret";
+
+  commonNodeConfigModule = {
+    services.syncthing = {
+      enable = true;
+      openDefaultPorts = true;
+      settings.devices = lib.mapAttrs (n: v: { inherit (v) id; }) nodeData;
     };
   };
 
+  nodeConfigModules = {
+    a = {
+      services.syncthing = {
+        inherit (nodeData.a) cert key;
+        guiAddress = "unix:///run/syncthing/syncthing.sock";
+      };
+    };
+    b = {
+      services.syncthing = { inherit (nodeData.b) cert key; };
+    };
+    c = {
+      services.syncthing = { inherit (nodeData.c) cert key; };
+    };
+  };
+
+  nodeFolderConfigModules = [
+    # "foo" is a folder that is synchronised only between nodes a and b.
+    rec {
+      a = {
+        services.syncthing.settings.folders.foo = {
+          path = "/var/lib/syncthing/foo";
+          devices = [
+            "a"
+            "b"
+          ];
+        };
+      };
+
+      b = a;
+
+      c = { };
+    }
+
+    # "bar" is synchronised between a and c, and between b and c, but c only
+    # gets an encrypted copy, and a and b never synchronise directly to each
+    # other.
+    rec {
+      a =
+        { config, ... }:
+        {
+          environment.etc.bar-encryption-password.text = testPassword;
+
+          services.syncthing.settings.folders.bar = {
+            path = "/var/lib/syncthing/bar";
+            devices = [
+              {
+                name = "c";
+                encryptionPasswordFile = "/etc/${config.environment.etc.bar-encryption-password.target}";
+              }
+            ];
+          };
+        };
+
+      b = a;
+
+      c = {
+        services.syncthing.settings.folders.bar = {
+          path = "/var/lib/syncthing/bar";
+          devices = [
+            "a"
+            "b"
+          ];
+          type = "receiveencrypted";
+        };
+      };
+    }
+
+    # "baz" is synchronised between all three nodes, but has filters on b and c
+    # that mean they shouldn't receive certain files.
+    {
+      a = {
+        services.syncthing.settings.folders.baz = {
+          path = "/var/lib/syncthing/baz";
+          devices = [
+            "b"
+            "c"
+          ];
+          ignorePatterns = [ ];
+        };
+      };
+
+      b = {
+        services.syncthing.settings.folders.baz = {
+          path = "/var/lib/syncthing/baz";
+          devices = [
+            "a"
+            "c"
+          ];
+          ignorePatterns = [
+            "notB"
+            # Just test that an apostrophe doesn't break the curl config
+            # commands.  See: https://github.com/NixOS/nixpkgs/issues/554744
+            "apostrophe'"
+          ];
+        };
+      };
+
+      c = {
+        services.syncthing.settings.folders.baz = {
+          path = "/var/lib/syncthing/baz";
+          devices = [
+            "a"
+            "b"
+          ];
+          ignorePatterns = [ "notC" ];
+        };
+      };
+    }
+
+    # "foo bar" tests handling whitespace in folder IDs.
+    {
+      a = {
+        services.syncthing.settings.folders."foo bar" = {
+          path = "/var/lib/syncthing/foo-bar";
+          devices = [ "b" ];
+        };
+      };
+
+      b = {
+        services.syncthing.settings.folders."foo bar" = {
+          path = "/var/lib/syncthing/foo-bar";
+          devices = [ "a" ];
+          ignorePatterns = [ "notB" ];
+        };
+      };
+
+      c = { };
+    }
+  ];
+in
+{
+  name = "syncthing-folders";
+  meta.maintainers = with pkgs.lib.maintainers; [ zarelit ];
+
+  # Run from the root of the nixpkgs repository with
+  #
+  #     nix-build -A nixosTests.syncthing-folders.genNodeData &&
+  #       ./result/bin/genNodeData.sh
+  #
+  # This generates new keys, certificates, and overall Syncthing config, and
+  # updates the certificate and key files and the ID file extracted from the
+  # overall Syncthing config file.
+  passthru.genNodeData = pkgs.writeShellApplication {
+    name = "genNodeData.sh";
+    runtimeInputs = with pkgs; [
+      syncthing
+      libxml2
+    ];
+    text = ''
+      rm -r nixos/tests/syncthing/test-nodes
+      mkdir nixos/tests/syncthing/test-nodes
+      cd nixos/tests/syncthing/test-nodes
+
+      for d in ${lib.escapeShellArgs nodeNames}; do
+        mkdir -- "$d"
+        syncthing generate --home="$d"
+        xmllint --xpath 'string(configuration/device/@id)' "$d"/config.xml >"$d"/id
+        rm -f -- "$d"/.syncthing.tmp.* "$d"/config.xml
+      done
+    '';
+  };
+
+  nodes = lib.genAttrs nodeNames (n: {
+    imports = [
+      commonNodeConfigModule
+      nodeConfigModules."${n}"
+    ]
+    ++ map (builtins.getAttr n) nodeFolderConfigModules;
+  });
+
   testScript = ''
     start_all()
 

nixos/tests/syncthing/no-settings.nix

@@ -1,6 +1,6 @@
 { lib, pkgs, ... }:
 {
-  name = "syncthing";
+  name = "syncthing-no-settings";
   meta.maintainers = with pkgs.lib.maintainers; [ chkno ];
 
   nodes = {

nixos/tests/syncthing/test-nodes/a/cert.pem

@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBoDCCAVKgAwIBAgIJAJ7l/z0JF6aOMAUGAytlcDBKMRIwEAYDVQQKEwlTeW5j
+dGhpbmcxIDAeBgNVBAsTF0F1dG9tYXRpY2FsbHkgR2VuZXJhdGVkMRIwEAYDVQQD
+EwlzeW5jdGhpbmcwHhcNMjYwNDAyMDAwMDAwWhcNNDYwMzI4MDAwMDAwWjBKMRIw
+EAYDVQQKEwlTeW5jdGhpbmcxIDAeBgNVBAsTF0F1dG9tYXRpY2FsbHkgR2VuZXJh
+dGVkMRIwEAYDVQQDEwlzeW5jdGhpbmcwKjAFBgMrZXADIQBCsJ1O6QrxxFP/YKKj
+WAjdZp07AiTIIC0/p/mHGbmyraNVMFMwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQW
+MBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuC
+CXN5bmN0aGluZzAFBgMrZXADQQBqGFXpwvEoAc7N6mT9evXI3++STiTE6Lu3Z2z3
+ecp5vU3fS5U+b0fO4BEUrNoaDdXurfOal6+LoydAnJcFamwN
+-----END CERTIFICATE-----

nixos/tests/syncthing/test-nodes/a/id

@@ -0,0 +1 @@
+F2ACIUG-FML5RHY-ATV55ZN-5KGVUIV-RWFG3Y6-QPLTKZB-NWUZAGD-7QRCWAP

nixos/tests/syncthing/test-nodes/a/key.pem

@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+MC4CAQAwBQYDK2VwBCIEIE2ls259KcQgtizG7hwP3aBhlYBNuPJwSBG8d4uVBFOh
+-----END PRIVATE KEY-----

nixos/tests/syncthing/test-nodes/b/cert.pem

@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBnzCCAVGgAwIBAgIIKyLKAcqLWn4wBQYDK2VwMEoxEjAQBgNVBAoTCVN5bmN0
+aGluZzEgMB4GA1UECxMXQXV0b21hdGljYWxseSBHZW5lcmF0ZWQxEjAQBgNVBAMT
+CXN5bmN0aGluZzAeFw0yNjA0MDIwMDAwMDBaFw00NjAzMjgwMDAwMDBaMEoxEjAQ
+BgNVBAoTCVN5bmN0aGluZzEgMB4GA1UECxMXQXV0b21hdGljYWxseSBHZW5lcmF0
+ZWQxEjAQBgNVBAMTCXN5bmN0aGluZzAqMAUGAytlcAMhABoahydRmwpbCII6mz9i
+E8FeGH7YdHqgMeAmLiFZu2wMo1UwUzAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYw
+FAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwFAYDVR0RBA0wC4IJ
+c3luY3RoaW5nMAUGAytlcANBADFVKB2vF16j0gc/h71x3vUi042FbmXTPk9kMb2O
+9O0NnWSoMuOGPFDEoHWBFuUuixQ/3cw45zw+fea28m95gQo=
+-----END CERTIFICATE-----

nixos/tests/syncthing/test-nodes/b/id

@@ -0,0 +1 @@
+LOB4D2H-OYG64QZ-NDX43LJ-NYR4HQU-BRNXCNI-ERACWFP-OVURLBI-63MR5QP