24.05 beta release

.git-blame-ignore-revs

@@ -109,10 +109,6 @@ fb0e5be84331188a69b3edd31679ca6576edb75a
 # postgresql: move packages.nix to ext/default.nix
 719034f6f6749d624faa28dff259309fc0e3e730
 
-# php ecosystem: reformat with nixfmt-rfc-style
-75ae7621330ff8db944ce4dff4374e182d5d151f
-c759efa5e7f825913f9a69ef20f025f50f56dc4d
-
 # pkgs/os-specific/bsd: Reformat with nixfmt-rfc-style 2024-03-01
 3fe3b055adfc020e6a923c466b6bcd978a13069a
 
@@ -121,6 +117,3 @@ c759efa5e7f825913f9a69ef20f025f50f56dc4d
 
 # python3Packages: format with nixfmt
 59b1aef59071cae6e87859dc65de973d2cc595c0
-
-# pkgs/development/compilers/llvm/common: Reformat with nixfmt-rfc-style
-65e2d797a234feb71c787ad3ef0cafc52299bb37

.github/CODEOWNERS

@@ -306,8 +306,8 @@ nixos/modules/services/networking/networkmanager.nix @Janik-Haag
 /pkgs/applications/networking/cluster/terraform-providers @zowoq
 
 # Forgejo
-nixos/modules/services/misc/forgejo.nix @adamcstephens @bendlas @emilylange
-pkgs/by-name/fo/forgejo/package.nix     @adamcstephens @bendlas @emilylange
+nixos/modules/services/misc/forgejo.nix      @bendlas @emilylange
+pkgs/applications/version-management/forgejo @bendlas @emilylange
 
 # Dotnet
 /pkgs/build-support/dotnet                  @IvarWithoutBones

.github/PULL_REQUEST_TEMPLATE.md

@@ -24,7 +24,7 @@ For new packages please briefly describe the package or provide a link to its ho
   - made sure NixOS tests are [linked](https://nixos.org/manual/nixpkgs/unstable/#ssec-nixos-tests-linking) to the relevant packages
 - [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"`. Note: all changes have to be committed, also see [nixpkgs-review usage](https://github.com/Mic92/nixpkgs-review#usage)
 - [ ] Tested basic functionality of all binary files (usually in `./result/bin/`)
-- [24.11 Release Notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2411.section.md) (or backporting [23.11](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2311.section.md) and [24.05](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2405.section.md) Release notes)
+- [24.05 Release Notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2405.section.md) (or backporting [23.05](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2305.section.md) and [23.11](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2311.section.md) Release notes)
   - [ ] (Package updates) Added a release notes entry if the change is major or breaking
   - [ ] (Module updates) Added a release notes entry if the change is significant
   - [ ] (Module addition) Added a release notes entry if adding a new NixOS module

.github/workflows/check-by-name.yml

@@ -14,16 +14,16 @@ on:
     # While `edited` is also triggered when the PR title/body is changed,
     # this PR action is fairly quick, and PR's don't get edited that often,
     # so it shouldn't be a problem
-    # There is a feature request for adding a `base_changed` event:
-    # https://github.com/orgs/community/discussions/35058
     types: [opened, synchronize, reopened, edited]
 
 permissions: {}
 
-# We don't use a concurrency group here, because the action is triggered quite often (due to the PR edit
-# trigger), and contributers would get notified on any canceled run.
-# There is a feature request for supressing notifications on concurrency-canceled runs:
-# https://github.com/orgs/community/discussions/13015
+# Create a check-by-name concurrency group based on the pull request number. if
+# an event triggers a run on the same PR while a previous run is still in
+# progress, the previous run will be canceled and the new one will start.
+concurrency:
+  group: check-by-name-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 jobs:
   check:

.github/workflows/check-nix-format.yml

@@ -43,7 +43,6 @@ jobs:
             nixos/modules/services/cluster/k3s
             nixos/tests/k3s
             pkgs/applications/networking/cluster/k3s
-          NIX_FMT_PATHS_LLVM_COMMON: pkgs/development/compilers/llvm/common
           NIX_FMT_PATHS_VSCODE_EXTS: pkgs/applications/editors/vscode/extensions
           NIX_FMT_PATHS_PHP_PACKAGES: pkgs/development/php-packages
           NIX_FMT_PATHS_BUILD_SUPPORT_PHP: pkgs/build-support/php

.github/workflows/periodic-merge-24h.yml

@@ -39,10 +39,6 @@ jobs:
             into: staging-next-23.11
           - from: staging-next-23.11
             into: staging-23.11
-          - from: release-24.05
-            into: staging-next-24.05
-          - from: staging-next-24.05
-            into: staging-24.05
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
       - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5

CONTRIBUTING.md

@@ -330,14 +330,7 @@ Container system, boot system and library changes are some examples of the pull
 ## How to merge pull requests
 [pr-merge]: #how-to-merge-pull-requests
 
-To streamline automated updates, leverage the nixpkgs-merge-bot by simply commenting `@NixOS/nixpkgs-merge-bot merge`. The bot will verify if the following conditions are met, refusing to merge otherwise:
-
-- the commenter that issued the command should be among the package maintainers;
-- the package should reside in `pkgs/by-name`.
-
-Further, nixpkgs-merge-bot will ensure all ofBorg checks (except the Darwin-related ones) are successfully completed before merging the pull request. Should the checks still be underway, the bot patiently waits for ofBorg to finish before attempting the merge again.
-
-For other pull requests, the *Nixpkgs committers* are people who have been given
+The *Nixpkgs committers* are people who have been given
 permission to merge.
 
 It is possible for community members that have enough knowledge and experience on a special topic to contribute by merging pull requests.
@@ -366,7 +359,7 @@ See [Nix Channel Status](https://status.nixos.org/) for the current channels and
 Here's a brief overview of the main Git branches and what channels they're used for:
 
 - `master`: The main branch, used for the unstable channels such as `nixpkgs-unstable`, `nixos-unstable` and `nixos-unstable-small`.
-- `release-YY.MM` (e.g. `release-24.05`): The NixOS release branches, used for the stable channels such as `nixos-24.05`, `nixos-24.05-small` and `nixpkgs-24.05-darwin`.
+- `release-YY.MM` (e.g. `release-23.11`): The NixOS release branches, used for the stable channels such as `nixos-23.11`, `nixos-23.11-small` and `nixpkgs-23.11-darwin`.
 
 When a channel is updated, a corresponding Git branch is also updated to point to the corresponding commit.
 So e.g. the [`nixpkgs-unstable` branch](https://github.com/nixos/nixpkgs/tree/nixpkgs-unstable) corresponds to the Git commit from the [`nixpkgs-unstable` channel](https://channels.nixos.org/nixpkgs-unstable).

doc/build-helpers/testers.chapter.md

@@ -40,82 +40,6 @@ If the `moduleNames` argument is omitted, `hasPkgConfigModules` will use `meta.p
 
 :::
 
-## `lycheeLinkCheck` {#tester-lycheeLinkCheck}
-
-Check a packaged static site's links with the [`lychee` package](https://search.nixos.org/packages?show=lychee&type=packages&query=lychee).
-
-You may use Nix to reproducibly build static websites, such as for software documentation.
-Some packages will install documentation in their `out` or `doc` outputs, or maybe you have dedicated package where you've made your static site reproducible by running a generator, such as [Hugo](https://gohugo.io/) or [mdBook](https://rust-lang.github.io/mdBook/), in a derivation.
-
-If you have a static site that can be built with Nix, you can use `lycheeLinkCheck` to check that the hyperlinks in your site are correct, and do so as part of your Nix workflow and CI.
-
-:::{.example #ex-lycheelinkcheck}
-
-# Check hyperlinks in the `nix` documentation
-
-```nix
-testers.lycheeLinkCheck {
-  site = nix.doc + "/share/doc/nix/manual";
-}
-```
-
-:::
-
-### Return value {#tester-lycheeLinkCheck-return}
-
-This tester produces a package that does not produce useful outputs, but only succeeds if the hyperlinks in your site are correct. The build log will list the broken links.
-
-It has two modes:
-
-- Build the returned derivation; its build process will check that internal hyperlinks are correct. This runs in the sandbox, so it will not check external hyperlinks, but it is quick and reliable.
-
-- Invoke the `.online` attribute with [`nix run`](https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3-run) ([experimental](https://nixos.org/manual/nix/stable/contributing/experimental-features#xp-feature-nix-command)). This runs outside the sandbox, and checks that both internal and external hyperlinks are correct.
-  Example:
-
-  ```shell
-  nix run nixpkgs#lychee.tests.ok.online
-  ```
-
-### Inputs {#tester-lycheeLinkCheck-inputs}
-
-`site` (path or derivation) {#tester-lycheeLinkCheck-param-site}
-
-: The path to the files to check.
-
-`remap` (attribe set, optional) {#tester-lycheeLinkCheck-param-remap}
-
-: An attribute set where the attribute names are regular expressions.
-  The values should be strings, derivations, or path values.
-
-  In the returned check's default configuration, external URLs are only checked when you run the `.online` attribute.
-
-  By adding remappings, you can check offline that URLs to external resources are correct, by providing a stand-in from the file system.
-
-  Before checking the existence of a URL, the regular expressions are matched and replaced by their corresponding values.
-
-  Example:
-
-  ```nix
-  {
-    "https://nix\\.dev/manual/nix/[a-z0-9.-]*" = "${nix.doc}/share/doc/nix/manual";
-    "https://nixos\\.org/manual/nix/(un)?stable" = "${emptyDirectory}/placeholder-to-disallow-old-nix-docs-urls";
-  }
-  ```
-
-  Store paths in the attribute values are automatically prefixed with `file://`, because lychee requires this for paths in the file system.
-  If this is a problem, or if you need to control the order in which replacements are performed, use `extraConfig.remap` instead.
-
-`extraConfig` (attribute set) {#tester-lycheeLinkCheck-param-extraConfig}
-
-: Extra configuration to pass to `lychee` in its [configuration file](https://github.com/lycheeverse/lychee/blob/master/lychee.example.toml).
-  It is automatically [translated](https://nixos.org/manual/nixos/stable/index.html#sec-settings-nix-representable) to TOML.
-
-  Example: `{ "include_verbatim" = true; }`
-
-`lychee` (derivation, optional) {#tester-lycheeLinkCheck-param-lychee}
-
-: The `lychee` package to use.
-
 ## `testVersion` {#tester-testVersion}
 
 Checks that the output from running a command contains the specified version string in it as a whole word.

doc/default.nix

@@ -105,15 +105,7 @@ in pkgs.stdenv.mkDerivation {
     ln -s ${optionsDoc.optionsJSON}/share/doc/nixos/options.json ./config-options.json
   '';
 
-  buildPhase = let
-    pythonInterpreterTable = pkgs.callPackage ./doc-support/python-interpreter-table.nix {};
-    pythonSection = with lib.strings; replaceStrings
-      [ "@python-interpreter-table@" ]
-      [ pythonInterpreterTable ]
-      (readFile ./languages-frameworks/python.section.md);
-  in ''
-    cp ${builtins.toFile "python.section.md" pythonSection} ./languages-frameworks/python.section.md
-
+  buildPhase = ''
     cat \
       ./functions/library.md.in \
       ${lib-docs}/index.md \

doc/doc-support/python-interpreter-table.nix

@@ -1,63 +0,0 @@
-# For debugging, run in this directory:
-#     nix eval --impure --raw --expr 'import ./python-interpreter-table.nix {}'
-{ pkgs ? (import ../.. { config = { }; overlays = []; }) }:
-let
-  lib = pkgs.lib;
-  inherit (lib.attrsets) attrNames filterAttrs;
-  inherit (lib.lists) elem filter map naturalSort reverseList;
-  inherit (lib.strings) concatStringsSep;
-
-  isPythonInterpreter = name:
-    /* NB: Package names that don't follow the regular expression:
-      - `python-cosmopolitan` is not part of `pkgs.pythonInterpreters`.
-      - `_prebuilt` interpreters are used for bootstrapping internally.
-      - `python3Minimal` contains python packages, left behind conservatively.
-      - `rustpython` lacks `pythonVersion` and `implementation`.
-    */
-    (lib.strings.match "(pypy|python)([[:digit:]]*)" name) != null;
-
-  interpreterName = pname:
-    let
-      cuteName = {
-        cpython = "CPython";
-        pypy = "PyPy";
-      };
-      interpreter = pkgs.${pname};
-    in
-    "${cuteName.${interpreter.implementation}} ${interpreter.pythonVersion}";
-
-  interpreters = reverseList (naturalSort (
-    filter isPythonInterpreter (attrNames pkgs.pythonInterpreters)
-  ));
-
-  aliases = pname:
-    attrNames (
-      filterAttrs (name: value:
-        isPythonInterpreter name
-        && name != pname
-        && interpreterName name == interpreterName pname
-      ) pkgs
-    );
-
-  result = map (pname: {
-    inherit pname;
-    aliases = aliases pname;
-    interpreter = interpreterName pname;
-  }) interpreters;
-
-  toMarkdown = data:
-    let
-      line = package: ''
-        | ${package.pname} | ${join ", " package.aliases or [ ]} | ${package.interpreter} |
-      '';
-    in
-    join "" (map line data);
-
-  join = lib.strings.concatStringsSep;
-
-in
-''
-  | Package | Aliases | Interpeter |
-  |---------|---------|------------|
-  ${toMarkdown result}
-''

doc/hooks/waf.section.md

@@ -20,6 +20,10 @@ If `wafPath` doesn't exist, then `wafHook` will copy the `waf` provided from Nix
 
 Controls the flags passed to waf tool during build and install phases. For settings specific to build or install phases, use `wafBuildFlags` or `wafInstallFlags` respectively.
 
+#### `dontAddWafCrossFlags` {#dont-add-waf-cross-flags}
+
+When set to `true`, don't add cross compilation flags during configure phase.
+
 #### `dontUseWafConfigure` {#dont-use-waf-configure}
 
 When set to true, don't use the predefined `wafConfigurePhase`.

doc/languages-frameworks/dotnet.section.md

@@ -117,6 +117,7 @@ For more detail about managing the `deps.nix` file, see [Generating and updating
 * `useDotnetFromEnv` will change the binary wrapper so that it uses the .NET from the environment. The runtime specified by `dotnet-runtime` is given as a fallback in case no .NET is installed in the user's environment. This is most useful for .NET global tools and LSP servers, which often extend the .NET CLI and their runtime should match the users' .NET runtime.
 * `dotnet-sdk` is useful in cases where you need to change what dotnet SDK is being used. You can also set this to the result of `dotnetSdkPackages.combinePackages`, if the project uses multiple SDKs to build.
 * `dotnet-runtime` is useful in cases where you need to change what dotnet runtime is being used. This can be either a regular dotnet runtime, or an aspnetcore.
+* `dotnet-test-sdk` is useful in cases where unit tests expect a different dotnet SDK. By default, this is set to the `dotnet-sdk` attribute.
 * `testProjectFile` is useful in cases where the regular project file does not contain the unit tests. It gets restored and build, but not installed. You may need to regenerate your nuget lockfile after setting this. Note that if set, only tests from this project are executed.
 * `disabledTests` is used to disable running specific unit tests. This gets passed as: `dotnet test --filter "FullyQualifiedName!={}"`, to ensure compatibility with all unit test frameworks.
 * `dotnetRestoreFlags` can be used to pass flags to `dotnet restore`.

doc/languages-frameworks/python.section.md

@@ -4,7 +4,16 @@
 
 ### Interpreters {#interpreters}
 
-@python-interpreter-table@
+| Package    | Aliases         | Interpreter |
+|------------|-----------------|-------------|
+| python27   | python2, python | CPython 2.7 |
+| python39   |                 | CPython 3.9 |
+| python310  |                 | CPython 3.10 |
+| python311  | python3         | CPython 3.11 |
+| python312  |                 | CPython 3.12 |
+| python313  |                 | CPython 3.13 |
+| pypy27     | pypy2, pypy     | PyPy2.7 |
+| pypy39     | pypy3           | PyPy 3.9 |
 
 The Nix expressions for the interpreters can be found in
 `pkgs/development/interpreters/python`.

lib/.version

@@ -1 +1 @@
-24.11
+24.05

lib/cli.nix

@@ -90,16 +90,7 @@ rec {
     mkOption ?
       k: v: if v == null
             then []
-            else if optionValueSeparator == null then
-              [ (mkOptionName k) (lib.generators.mkValueStringDefault {} v) ]
-            else
-              [ "${mkOptionName k}${optionValueSeparator}${lib.generators.mkValueStringDefault {} v}" ],
-
-    # how to separate an option from its flag;
-    # by default, there is no separator, so option `-c` and value `5`
-    # would become ["-c" "5"].
-    # This is useful if the command requires equals, for example, `-c=5`.
-    optionValueSeparator ? null
+            else [ (mkOptionName k) (lib.generators.mkValueStringDefault {} v) ]
     }:
     options:
       let

lib/fixed-points.nix

@@ -1,6 +1,6 @@
 { lib, ... }:
 rec {
-  /**
+  /*
     `fix f` computes the fixed point of the given function `f`. In other words, the return value is `x` in `x = f x`.
 
     `f` must be a lazy function.
@@ -63,52 +63,27 @@ rec {
     See [`extends`](#function-library-lib.fixedPoints.extends) for an example use case.
     There `self` is also often called `final`.
 
+    Type: fix :: (a -> a) -> a
 
-    # Inputs
+    Example:
+      fix (self: { foo = "foo"; bar = "bar"; foobar = self.foo + self.bar; })
+      => { bar = "bar"; foo = "foo"; foobar = "foobar"; }
 
-    `f`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    fix :: (a -> a) -> a
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.fixedPoints.fix` usage example
-
-    ```nix
-    fix (self: { foo = "foo"; bar = "bar"; foobar = self.foo + self.bar; })
-    => { bar = "bar"; foo = "foo"; foobar = "foobar"; }
-
-    fix (self: [ 1 2 (elemAt self 0 + elemAt self 1) ])
-    => [ 1 2 3 ]
-    ```
-
-    :::
+      fix (self: [ 1 2 (elemAt self 0 + elemAt self 1) ])
+      => [ 1 2 3 ]
   */
   fix = f: let x = f x; in x;
 
-  /**
+  /*
     A variant of `fix` that records the original recursive attribute set in the
     result, in an attribute named `__unfix__`.
 
     This is useful in combination with the `extends` function to
     implement deep overriding.
-
-
-    # Inputs
-
-    `f`
-
-    : 1\. Function argument
   */
   fix' = f: let x = f x // { __unfix__ = f; }; in x;
 
-  /**
+  /*
     Return the fixpoint that `f` converges to when called iteratively, starting
     with the input `x`.
 
@@ -117,22 +92,7 @@ rec {
     0
     ```
 
-
-    # Inputs
-
-    `f`
-
-    : 1\. Function argument
-
-    `x`
-
-    : 2\. Function argument
-
-    # Type
-
-    ```
-    (a -> a) -> a -> a
-    ```
+    Type: (a -> a) -> a -> a
   */
   converge = f: x:
     let
@@ -142,7 +102,7 @@ rec {
       then x
       else converge f x';
 
-  /**
+  /*
     Extend a function using an overlay.
 
     Overlays allow modifying and extending fixed-point functions, specifically ones returning attribute sets.
@@ -257,50 +217,32 @@ rec {
     ```
     :::
 
+    Type:
+      extends :: (Attrs -> Attrs -> Attrs) # The overlay to apply to the fixed-point function
+              -> (Attrs -> Attrs) # A fixed-point function
+              -> (Attrs -> Attrs) # The resulting fixed-point function
 
-    # Inputs
+    Example:
+      f = final: { a = 1; b = final.a + 2; }
 
-    `overlay`
+      fix f
+      => { a = 1; b = 3; }
 
-    : The overlay to apply to the fixed-point function
+      fix (extends (final: prev: { a = prev.a + 10; }) f)
+      => { a = 11; b = 13; }
 
-    `f`
+      fix (extends (final: prev: { b = final.a + 5; }) f)
+      => { a = 1; b = 6; }
 
-    : The fixed-point function
-
-    # Type
-
-    ```
-    extends :: (Attrs -> Attrs -> Attrs) # The overlay to apply to the fixed-point function
-            -> (Attrs -> Attrs) # A fixed-point function
-            -> (Attrs -> Attrs) # The resulting fixed-point function
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.fixedPoints.extends` usage example
-
-    ```nix
-    f = final: { a = 1; b = final.a + 2; }
-
-    fix f
-    => { a = 1; b = 3; }
-
-    fix (extends (final: prev: { a = prev.a + 10; }) f)
-    => { a = 11; b = 13; }
-
-    fix (extends (final: prev: { b = final.a + 5; }) f)
-    => { a = 1; b = 6; }
-
-    fix (extends (final: prev: { c = final.a + final.b; }) f)
-    => { a = 1; b = 3; c = 4; }
-    ```
-
-    :::
+      fix (extends (final: prev: { c = final.a + final.b; }) f)
+      => { a = 1; b = 3; c = 4; }
   */
   extends =
+    # The overlay to apply to the fixed-point function
     overlay:
+    # The fixed-point function
     f:
+    # Wrap with parenthesis to prevent nixdoc from rendering the `final` argument in the documentation
     # The result should be thought of as a function, the argument of that function is not an argument to `extends` itself
     (
       final:
@@ -310,29 +252,10 @@ rec {
       prev // overlay final prev
     );
 
-  /**
+  /*
     Compose two extending functions of the type expected by 'extends'
     into one where changes made in the first are available in the
     'super' of the second
-
-
-    # Inputs
-
-    `f`
-
-    : 1\. Function argument
-
-    `g`
-
-    : 2\. Function argument
-
-    `final`
-
-    : 3\. Function argument
-
-    `prev`
-
-    : 4\. Function argument
   */
   composeExtensions =
     f: g: final: prev:
@@ -340,7 +263,7 @@ rec {
           prev' = prev // fApplied;
       in fApplied // g final prev';
 
-  /**
+  /*
     Compose several extending functions of the type expected by 'extends' into
     one where changes made in preceding functions are made available to
     subsequent ones.
@@ -353,7 +276,7 @@ rec {
   composeManyExtensions =
     lib.foldr (x: y: composeExtensions x y) (final: prev: {});
 
-  /**
+  /*
     Create an overridable, recursive attribute set. For example:
 
     ```
@@ -375,20 +298,9 @@ rec {
   */
   makeExtensible = makeExtensibleWithCustomName "extend";
 
-  /**
+  /*
     Same as `makeExtensible` but the name of the extending attribute is
     customized.
-
-
-    # Inputs
-
-    `extenderName`
-
-    : 1\. Function argument
-
-    `rattrs`
-
-    : 2\. Function argument
   */
   makeExtensibleWithCustomName = extenderName: rattrs:
     fix' (self: (rattrs self) // {

lib/licenses.nix

@@ -902,17 +902,6 @@ in mkLicense lset) ({
     free = false;
   };
 
-  ncbiPd = {
-    spdxId = "NCBI-PD";
-    fullname = "NCBI Public Domain Notice";
-    # Due to United States copyright law, anything with this "license" does not have a copyright in the
-    # jurisdiction of the United States. However, other jurisdictions may assign the United States
-    # government copyright to the work, and the license explicitly states that in such a case, no license
-    # is granted. This is nonfree and nonredistributable in most jurisdictions other than the United States.
-    free = false;
-    redistributable = false;
-  };
-
   ncsa = {
     spdxId = "NCSA";
     fullName = "University of Illinois/NCSA Open Source License";

lib/meta.nix

@@ -26,12 +26,8 @@ rec {
   dontDistribute = drv: addMetaAttrs { hydraPlatforms = []; } drv;
 
 
-  /*
-  Change the [symbolic name of a derivation](https://nixos.org/manual/nix/stable/language/derivations.html#attr-name).
-
-  :::{.warning}
-  Dependent derivations will be rebuilt when the symbolic name is changed.
-  :::
+  /* Change the symbolic name of a package for presentation purposes
+     (i.e., so that nix-env users can tell them apart).
   */
   setName = name: drv: drv // {inherit name;};
 

lib/tests/misc.nix

@@ -1639,27 +1639,6 @@ runTests {
     ];
   };
 
-  testToGNUCommandLineSeparator = {
-    expr = cli.toGNUCommandLine { optionValueSeparator = "="; } {
-      data = builtins.toJSON { id = 0; };
-      X = "PUT";
-      retry = 3;
-      retry-delay = null;
-      url = [ "https://example.com/foo" "https://example.com/bar" ];
-      silent = false;
-      verbose = true;
-    };
-
-    expected = [
-      "-X=PUT"
-      "--data={\"id\":0}"
-      "--retry=3"
-      "--url=https://example.com/foo"
-      "--url=https://example.com/bar"
-      "--verbose"
-    ];
-  };
-
   testToGNUCommandLineShell = {
     expr = cli.toGNUCommandLineShell {} {
       data = builtins.toJSON { id = 0; };

lib/trivial.nix

@@ -403,7 +403,7 @@ in {
     On each release the first letter is bumped and a new animal is chosen
     starting with that new letter.
   */
-  codeName = "Vicuña";
+  codeName = "Uakari";
 
   /**
     Returns the current nixpkgs version suffix as string.

maintainers/maintainer-list.nix

@@ -1787,12 +1787,6 @@
     githubId = 816777;
     name = "Ashley Gillman";
   };
-  ashgoldofficial = {
-    email = "ashley.goldwater@gmail.com";
-    github = "ASHGOLDOFFICIAL";
-    githubId = 104313094;
-    name = "Andrey Shaat";
-  };
   ashkitten = {
     email = "ashlea@protonmail.com";
     github = "ashkitten";
@@ -1882,12 +1876,6 @@
       fingerprint = "BF47 81E1 F304 1ADF 18CE  C401 DE16 C7D1 536D A72F";
     }];
   };
-  astronaut0212 = {
-    email = "goatastronaut0212@proton.me";
-    github = "goatastronaut0212";
-    githubId = 119769817;
-    name = "goatastronaut0212";
-  };
   astsmtl = {
     email = "astsmtl@yandex.ru";
     github = "astsmtl";
@@ -3774,12 +3762,6 @@
     githubId = 136485;
     name = "Chad Jablonski";
   };
-  cjshearer = {
-    email = "cjshearer@live.com";
-    github = "cjshearer";
-    githubId = 7173077;
-    name = "Cody Shearer";
-  };
   ck3d = {
     email = "ck3d@gmx.de";
     github = "ck3d";
@@ -3814,15 +3796,6 @@
     githubId = 199180;
     name = "Claes Wallin";
   };
-  clebs = {
-    email = "borja.clemente@gmail.com";
-    github = "clebs";
-    githubId = 1059661;
-    name = "Borja Clemente";
-    keys = [{
-      fingerprint = "C4E1 58BD FD33 3C77 B6C7  178E 2539 757E F64C 60DD";
-    }];
-  };
   cleeyv = {
     email = "cleeyv@riseup.net";
     github = "cleeyv";
@@ -4595,14 +4568,9 @@
     github = "DataHearth";
     githubId = 28595242;
     name = "DataHearth";
-    keys = [
-      {
-        fingerprint = "A129 2547 0298 BFEE 7EE0 92B3 946E 2D0C 410C 7B3D";
-      }
-      {
-        fingerprint = "FFC4 92C1 5320 B05D 0F8D 7D58 ABF6 737C 6339 6D35";
-      }
-    ];
+    keys = [{
+      fingerprint = "A129 2547 0298 BFEE 7EE0  92B3 946E 2D0C 410C 7B3D";
+    }];
   };
   davegallant = {
     name = "Dave Gallant";
@@ -7763,14 +7731,6 @@
       fingerprint = "7FC7 98AB 390E 1646 ED4D  8F1F 797F 6238 68CD 00C2";
     }];
   };
-  greaka = {
-    email = "git@greaka.de";
-    github = "greaka";
-    githubId = 2805834;
-    name = "Greaka";
-    keys =
-      [{ fingerprint = "6275 FB5C C9AC 9D85 FF9E  44C5 EE92 A5CD C367 118C"; }];
-  };
   greg = {
     email = "greg.hellings@gmail.com";
     github = "greg-hellings";
@@ -10003,12 +9963,6 @@
     githubId = 8580434;
     name = "Jonny Bolton";
   };
-  jonochang = {
-    name = "Jono Chang";
-    email = "j.g.chang@gmail.com";
-    github = "jonochang";
-    githubId = 13179;
-  };
   jonringer = {
     email = "jonringer117@gmail.com";
     matrix = "@jonringer:matrix.org";
@@ -11966,14 +11920,6 @@
     githubId = 10626;
     name = "Andreas Wagner";
   };
-  lpostula = {
-    email = "lois@postu.la";
-    github = "loispostula";
-    githubId = 1423612;
-    name = "Loïs Postula";
-    keys =
-      [{ fingerprint = "0B4A E7C7 D3B7 53F5 3B3D  774C 3819 3C6A 09C3 9ED1"; }];
-  };
   lrewega = {
     email = "lrewega@c32.ca";
     github = "lrewega";
@@ -12469,11 +12415,6 @@
     githubId = 18661391;
     name = "Malte Janz";
   };
-  malteneuss = {
-    github = "malteneuss";
-    githubId = 5301202;
-    name = "Malte Neuss";
-  };
   malte-v = {
     email = "nixpkgs@mal.tc";
     github = "malte-v";
@@ -13077,12 +13018,6 @@
     githubId = 14259816;
     name = "Abin Simon";
   };
-  me-and = {
-    name = "Adam Dinwoodie";
-    email = "nix.thunder.wayne@post.dinwoodie.org";
-    github = "me-and";
-    githubId = 1397507;
-  };
   meatcar = {
     email = "nixpkgs@denys.me";
     github = "meatcar";
@@ -17131,15 +17066,6 @@
     githubId = 52847440;
     name = "Ryan Burns";
   };
-  rconybea = {
-    email = "n1xpkgs@hushmail.com";
-    github = "rconybea";
-    githubId = 8570969;
-    name = "Roland Conybeare";
-    keys = [{
-      fingerprint = "bw5Cr/4ul1C2UvxopphbZbFI1i5PCSnOmPID7mJ/Ogo";
-    }];
-  };
   rdnetto = {
     email = "rdnetto@gmail.com";
     github = "rdnetto";
@@ -18479,11 +18405,6 @@
     github = "sei40kr";
     githubId = 11665236;
   };
-  seineeloquenz = {
-    name = "Alexander Linder";
-    github = "SeineEloquenz";
-    githubId = 34923333;
-  };
   seirl = {
     name = "Antoine Pietri";
     email = "antoine.pietri1@gmail.com";
@@ -19786,6 +19707,12 @@
     githubId = 36031171;
     name = "Supa";
   };
+  superbo = {
+    email = "supernbo@gmail.com";
+    github = "SuperBo";
+    githubId = 2666479;
+    name = "Y Nguyen";
+  };
   superherointj = {
     email = "sergiomarcelo@yandex.com";
     github = "superherointj";
@@ -20770,12 +20697,6 @@
     githubId = 858790;
     name = "Tobias Mayer";
   };
-  tobz619 = {
-    email = "toloke@yahoo.co.uk";
-    github = "tobz619";
-    githubId = 93312805;
-    name = "Tobi Oloke";
-  };
   tochiaha = {
     email = "tochiahan@proton.me";
     github = "Tochiaha";

maintainers/scripts/kde/collect-missing-deps.py

@@ -80,11 +80,6 @@ OK_MISSING_BY_PACKAGE = {
     "plasma-desktop": {
         "scim",  # upstream is dead, not packaged in Nixpkgs
     },
-    "poppler-qt6": {
-        "gobject-introspection-1.0",  # we don't actually want to build the GTK variant
-        "gdk-pixbuf-2.0",
-        "gtk+-3.0",
-    },
     "powerdevil": {
         "DDCUtil",  # cursed, intentionally disabled
     },
@@ -92,9 +87,6 @@ OK_MISSING_BY_PACKAGE = {
         "Qt6Qml",  # tests only
         "Qt6Quick",
     },
-    "skladnik": {
-        "POVRay",  # too expensive to rerender all the assets
-    },
     "syntax-highlighting": {
         "XercesC",  # only used for extra validation at build time
     }

maintainers/scripts/luarocks-packages.csv

@@ -112,7 +112,6 @@ nvim-nio,,,,,,mrcjkb
 pathlib.nvim,,,,,,
 penlight,,,,,,alerque
 plenary.nvim,https://raw.githubusercontent.com/nvim-lua/plenary.nvim/master/plenary.nvim-scm-1.rockspec,,,,5.1,
-psl,,,,0.3,,
 rapidjson,,,,,,
 rest.nvim,,,,,5.1,teto
 rocks.nvim,,,,,,mrcjkb

maintainers/team-list.nix

@@ -345,16 +345,6 @@ with lib.maintainers; {
     shortName = "freedesktop.org packaging";
   };
 
-  fslabs = {
-    # Verify additions to this team with at least one already existing member of the team.
-    members = [
-      greaka
-      lpostula
-    ];
-    scope = "Group registration for packages maintained by Foresight Spatial Labs.";
-    shortName = "Foresight Spatial Labs employees";
-  };
-
   gcc = {
     members = [
       synthetica

nixos/doc/manual/release-notes/release-notes.md

@@ -3,7 +3,6 @@
 This section lists the release notes for each stable version of NixOS and current unstable revision.
 
 ```{=include=} sections
-rl-2411.section.md
 rl-2405.section.md
 rl-2311.section.md
 rl-2305.section.md

nixos/doc/manual/release-notes/rl-2111.section.md

@@ -146,7 +146,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [touchegg](https://github.com/JoseExposito/touchegg), a multi-touch gesture recognizer. Available as [services.touchegg](#opt-services.touchegg.enable).
 
-- [pantheon-tweaks](https://github.com/pantheon-tweaks/pantheon-tweaks), an unofficial system settings panel for Pantheon. Available as `programs.pantheon-tweaks`.
+- [pantheon-tweaks](https://github.com/pantheon-tweaks/pantheon-tweaks), an unofficial system settings panel for Pantheon. Available as [programs.pantheon-tweaks](#opt-programs.pantheon-tweaks.enable).
 
 - [joycond](https://github.com/DanielOgorchock/joycond), a service that uses `hid-nintendo` to provide nintendo joycond pairing and better nintendo switch pro controller support.
 

nixos/doc/manual/release-notes/rl-2211.section.md

@@ -366,7 +366,7 @@ In addition to numerous new and upgraded packages, this release includes the fol
       __Note:__ secrets from these files will be leaked into the store unless you use a
       [**file**-provider or env-var](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider) for secrets!
 
-    - `services.grafana.provision.notifiers` is not affected by this change because
+    - [services.grafana.provision.notifiers](#opt-services.grafana.provision.notifiers) is not affected by this change because
       this feature is deprecated by Grafana and will probably be removed in Grafana 10.
       It's recommended to use `services.grafana.provision.alerting.contactPoints` instead.
 

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -6,11 +6,11 @@ Support is planned until the end of December 2024, handing over to 24.11.
 
 In addition to numerous new and upgraded packages, this release has the following highlights:
 
-<!-- Please keep entries alphabetically sorted. -->
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 - The default kernel package has been updated from 6.1 to 6.6. All supported kernels remain available.
 
-- For each supporting version of the Linux kernel, firmware blobs
+- For each supporting version of the Linux kernel firmware blobs
   are compressed with zstd. For firmware blobs this means an increase of 4.4% in size, however
   a significantly higher decompression speed.
 
@@ -53,7 +53,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 ## New Services {#sec-release-24.05-new-services}
 
-<!-- Please keep entries alphabetically sorted. -->
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 - [Anki Sync Server](https://docs.ankiweb.net/sync-server.html), the official sync server built into recent versions of Anki. Available as [services.anki-sync-server](#opt-services.anki-sync-server.enable).
 The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the anki-sync-server software.
@@ -75,7 +75,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [Clevis](https://github.com/latchset/clevis), a pluggable framework for automated decryption, used to unlock encrypted devices in initrd. Available as [boot.initrd.clevis.enable](#opt-boot.initrd.clevis.enable).
 
-- [CommaFeed](https://github.com/Athou/commafeed), a Google Reader-inspired self-hosted RSS reader. Available as [services.commafeed](#opt-services.commafeed.enable).
+- [CommaFeed](https://github.com/Athou/commafeed), a Google Reader inspired self-hosted RSS reader. Available as [services.commafeed](#opt-services.commafeed.enable).
 
 - [davis](https://github.com/tchapi/davis), a simple CardDav and CalDav server inspired by Baïkal. Available as [services.davis](#opt-services.davis.enable).
 
@@ -85,8 +85,6 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [FCast Receiver](https://fcast.org), an open-source alternative to Chromecast and AirPlay. Available as [programs.fcast-receiver](#opt-programs.fcast-receiver.enable).
 
-- [FileSender](https://filesender.org/), a file sharing software. Available as [services.filesender](#opt-services.filesender.enable).
-
 - [Firefly-iii](https://www.firefly-iii.org), a free and open source personal finance manager. Available as [services.firefly-iii](#opt-services.firefly-iii.enable).
 
 - [Flarum](https://flarum.org/), a delightfully simple discussion platform for your website. Available as [services.flarum](#opt-services.flarum.enable).
@@ -135,12 +133,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [nh](https://github.com/viperML/nh), yet another Nix CLI helper. Available as [programs.nh](#opt-programs.nh.enable).
 
-- [oink](https://github.com/rlado/oink), a dynamic DNS client for Porkbun. Available as [services.oink](#opt-services.oink.enable).
-
 - [ollama](https://ollama.ai), server for running large language models locally.
 
-- [nextjs-ollama-llm-ui](https://github.com/jakobhoeg/nextjs-ollama-llm-ui), light-weight frontend server to chat with Ollama models through a web app.
-
 - [ownCloud Infinite Scale Stack](https://owncloud.com/infinite-scale-4-0/), a modern and scalable rewrite of ownCloud.
 
 - [PhotonVision](https://photonvision.org/), a free, fast, and easy-to-use computer vision solution for the FIRST® Robotics Competition.
@@ -193,8 +187,6 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [wastebin](https://github.com/matze/wastebin), a pastebin server written in rust. Available as [services.wastebin](#opt-services.wastebin.enable).
 
-- [watchdogd](https://troglobit.com/projects/watchdogd/), a system and process supervisor using watchdog timers. Available as [services.watchdogd](#opt-services.watchdogd.enable).
-
 - [Workout-tracker](https://github.com/jovandeginste/workout-tracker), a workout tracking web application for personal use.
 
 - [wyoming-satellite](https://github.com/rhasspy/wyoming-satellite), a voice assistant satellite for Home Assistant using the Wyoming protocol. Available as [services.wyoming.satellite](#opt-services.wyoming.satellite.enable).
@@ -205,6 +197,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [your_spotify](https://github.com/Yooooomi/your_spotify), a self hosted Spotify tracking dashboard. Available as [services.your_spotify](#opt-services.your_spotify.enable)
 
+- [FileSender](https://filesender.org/), a file sharing software. Available as [services.filesender](#opt-services.filesender.enable).
+
 ## Backward Incompatibilities {#sec-release-24.05-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -229,10 +223,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `buildGoModule` now throws an error when `vendorHash` is not specified. `vendorSha256`, deprecated in Nixpkgs 23.11, is now ignored and is no longer a `vendorHash` alias.
 
-- `chromium` and `ungoogled-chromium` had a long-standing issue regarding Widevine DRM handling in nixpkgs fixed.
+- `chromium` and `ungoogled-chromium` had a long standing issue regarding Widevine DRM handling in nixpkgs fixed.
   `chromium` now no longer automatically downloads Widevine when encountering DRM protected content.
   To be able to play DRM protected content in `chromium` now, you have to explicitly opt-in as originally intended using `chromium.override { enableWideVine = true; }`.
-  This override was added almost 10 years ago.
+  This override has been added almost 10 years ago.
 
 - `craftos-pc` package has been updated to v2.8, which includes [breaking changes](https://github.com/MCJack123/craftos2/releases/tag/v2.8).
   - Files are now handled in binary mode; this could break programs with embedded UTF-8 characters.
@@ -254,16 +248,16 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - `cudaPackages.cudatoolkit` has been deprecated and replaced with a
   symlink-based wrapper for the splayed redistributable CUDA packages. The
   wrapper only includes tools and libraries necessary to build common packages
-  such as tensorflow. The original runfile-based `cudatoolkit` is still
+  like e.g. tensorflow. The original runfile-based `cudatoolkit` is still
   available as `cudatoolkit-legacy-runfile`.
 
-- `cudaPackages.nsight_systems` now has most vendored third party-libraries removed, though we now only ship it for `cudaPackages_11_8` and later, due to outdated dependencies. Users comfortable with the vendored dependencies may use `overrideAttrs` to amend the `postPatch` phase and the `meta.broken` correspondingly. Alternatively, one could package the deprecated `boost170` locally, as required for `cudaPackages_11_4.nsight_systems`.
+- `cudaPackages.nsight_systems` now has most vendored third party libraries removed, though we now only ship it for `cudaPackages_11_8` and later due to outdated dependencies. Users comfortable with the vendored dependencies may use `overrideAttrs` to amend the `postPatch` phase and the `meta.broken` correspondingly. Alternatively, one could package the deprecated `boost170` locally, as required for `cudaPackages_11_4.nsight_systems`.
 
 - `cudaPackages.autoFixElfFiles` has been deprecated for `pkgs.autoFixElfFiles`. Functionality has not changed, but the setuphook has been renamed and moved to the top-level package scope.
 
-- `davfs2`'s `services.davfs2.extraConfig` setting has been deprecated and converted to the free-form type option named `services.davfs2.settings` according to RFC42.
+- `davfs2`' `services.davfs2.extraConfig` setting has been deprecated and converted to the free-form type option named `services.davfs2.settings` according to RFC42.
 
-- `dwarf-fortress` has been updated to version 50, and its derivations continue to menace with spikes of Nix and bash [TODO what does this mean?]. Version 50 is identical to the version on Steam, but without the paid elements like tilepacks.
+- `dwarf-fortress` has been updated to version 50, and its derivations continue to menace with spikes of Nix and bash. Version 50 is identical to the version on Steam, but without the paid elements like tilepacks.
   dfhack and Dwarf Therapist still work, and older versions are still packaged in case you'd like to roll back. Note that DF 50 saves will not be compatible with DF 0.47 and earlier.
   See [Bay 12 Games](http://www.bay12games.com/dwarves/) for more details on what's new in Dwarf Fortress.
 
@@ -340,12 +334,12 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `livebook` package is now built as a `mix release` instead of an `escript`.
   This means that configuration now has to be done using [environment variables](https://hexdocs.pm/livebook/readme.html#environment-variables) instead of command line arguments.
-  This has the further implication that the `livebook` service configuration has changed.
+  This has the further implication that the `livebook` service configuration has changed:
 
 - `lua` interpreters default LUA_PATH and LUA_CPATH are not overriden by nixpkgs
   anymore, we patch LUA_ROOT instead which is more respectful to upstream.
 
-- `luarocks-packages-updater`'s .csv format used to define lua packages to be updated, has changed: `src` (URL of a git repository) has now become `rockspec` (URL of a rockspec) to remove ambiguity regarding which rockspec to use and simplify implementation.
+- `luarocks-packages-updater` has changed the .csv format used to define lua packages updates: `src` (URL towards a git repository) has now become `rockspec` (URL towards a rockspec) to remove ambiguity regarding which rockspec to use and simplify implementation.
 
 - `mkosi` was updated to v22. Parts of the user interface have changed. Consult the
   release notes of [v19](https://github.com/systemd/mkosi/releases/tag/v19),
@@ -394,7 +388,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
   - `nomad_1_4` has been removed, as it is now unsupported upstream.
 
-- `nvtop` family of packages was reorganized into a nested attrset. `nvtop` has been renamed to `nvtopPackages.full`, and all `nvtop-{amd,nvidia,intel,msm}` packages are renamed to `nvtopPackages.{amd,nvidia,intel,msm}`.
+- `nvtop` family of packages was reorganized into nested attrset. `nvtop` has been renamed to `nvtopPackages.full`, and all `nvtop-{amd,nvidia,intel,msm}` packages are now named as `nvtopPackages.{amd,nvidia,intel,msm}`.
 
 - `openssh`, `openssh_hpn` and `openssh_gssapi` are now compiled without support for the DSA signature algorithm as it is being deprecated upstream. Users still relying on DSA keys should consider upgrading
   to another signature algorithm. However, for the time being it is possible to restore DSA key support using `override` to set `dsaKeysSupport = true`.
@@ -450,12 +444,12 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
   "mysecret"` becomes `services.aria2.rpcSecretFile = "/path/to/secret_file"`
   where the file `secret_file` contains the string `mysecret`.
 
-- `services.avahi.nssmdns` was split into `services.avahi.nssmdns4` and `services.avahi.nssmdns6` which enable the mDNS NSS switches for IPv4 and IPv6 respectively.
+- `services.avahi.nssmdns` got split into `services.avahi.nssmdns4` and `services.avahi.nssmdns6` which enable the mDNS NSS switch for IPv4 and IPv6 respectively.
   Since most mDNS responders only register IPv4 addresses, most users want to keep the IPv6 support disabled to avoid long timeouts.
 
-- `services.frp.settings` now generates the frp configuration file in TOML format as [recommended by upstream](https://github.com/fatedier/frp#configuration-files), instead of the legacy INI format. This has also introduced other changes in the configuration file structure and options:
-  - The `settings.common` section in the configuration is no longer valid and all the options form inside it now go directly under `settings`.
-  - Configuration option names have been changed from snake_case to camelCase. For example: `server_addr` becomes `serverAddr`, `server_port` becomes `serverPort` etc.
+- `services.frp.settings` now generates the frp configuration file in TOML format as [recommended by upstream](https://github.com/fatedier/frp#configuration-files), instead of the legacy INI format. This has also introduced other changes in the configuration file structure and options.
+  - The `settings.common` section in the configuration is no longer valid and all the options form inside it now goes directly under `settings`.
+  - The `_` separating words in the configuration options is removed so the options are now in camel case. For example: `server_addr` becomes `serverAddr`, `server_port` becomes `serverPort` etc.
   - Proxies are now defined with a new option `settings.proxies` which takes a list of proxies.
   - Consult the [upstream documentation](https://github.com/fatedier/frp#example-usage) for more details on the changes.
 
@@ -511,16 +505,11 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 
 - `services.redis.vmOverCommit` now defaults to `true` and no longer enforces Transparent Hugepages (THP) to be disabled. Redis only works with THP configured to `madvise` which is the kernel's default.
 
-- `services.resolved.fallbackDns`
-  - can now be used to disable the upstream fallback servers entirely by setting it to `[]`
-  - to get previous behaviour of upstream defaults, set it to `null`
-  - default value has changed from `[]` to `null`, in order to preserve default behaviour
-
-can now be used to disable the upstream fallback servers entirely by setting it to an empty list. To get the previous behaviour of the upstream defaults set it to null, the new default, instead.
+- `services.resolved.fallbackDns` can now be used to disable the upstream fallback servers entirely by setting it to an empty list. To get the previous behaviour of the upstream defaults set it to null, the new default, instead.
 
 - `services.vikunja` systemd service now uses `vikunja` as dynamic user instead of `vikunja-api`. Database users might need to be changed.
 
-- `services.vikunja.setupNginx` setting has been removed. Users now need to set up the webserver configuration on their own with a proxy pass to the vikunja service.
+- `services.vikunja.setupNginx` setting has been removed. Users now need to setup the webserver configuration on their own with a proxy pass to the vikunja service.
 
 - `services.vmagent` module deprecates `dataDir`, `group` and `user` setting in favor of systemd provided CacheDirectory and DynamicUser.
 
@@ -537,14 +526,14 @@ can now be used to disable the upstream fallback servers entirely by setting it
 
 - `system.forbiddenDependenciesRegex` has been renamed to `system.forbiddenDependenciesRegexes` and now has the type of `listOf string` instead of `string` to accept multiple regexes.
 
-- `systemd.oomd` module behavior has changed:
+- `systemd.oomd` module behavior is changed as:
 
   - Raise ManagedOOMMemoryPressureLimit from 50% to 80%. This should make systemd-oomd kill things less often, and fix issues like [this](https://pagure.io/fedora-workstation/issue/358).
     Reference: [commit](https://src.fedoraproject.org/rpms/systemd/c/806c95e1c70af18f81d499b24cd7acfa4c36ffd6?branch=806c95e1c70af18f81d499b24cd7acfa4c36ffd6).
 
   - Remove swap policy. This helps prevent killing processes when user's swap is small.
 
-  - Expand the memory pressure policy to `system.slice`, `user-.slice`, and all user owned slices. Reference: [commit](https://src.fedoraproject.org/rpms/systemd/c/7665e1796f915dedbf8e014f0a78f4f576d609bb).
+  - Expand the memory pressure policy to system.slice, user-.slice, and all user owned slices. Reference: [commit](https://src.fedoraproject.org/rpms/systemd/c/7665e1796f915dedbf8e014f0a78f4f576d609bb).
 
   - `systemd.oomd.enableUserServices` is renamed to `systemd.oomd.enableUserSlices`.
 
@@ -563,6 +552,8 @@ can now be used to disable the upstream fallback servers entirely by setting it
 
 - `virtialisation.incus` now defaults to the newly-added `incus-lts` release (v6.0.x). Users who wish to continue using the non-LTS release will need to set `virtualisation.incus.package = pkgs.incus`. Stable release users are encouraged to stay on the LTS release as non-LTS releases will by default not be backported.
 
+- [watchdogd](https://troglobit.com/projects/watchdogd/), a system and process supervisor using watchdog timers. Available as [services.watchdogd](#opt-services.watchdogd.enable).
+
 - `woodpecker-*` packages have been updated to v2 which includes [breaking changes](https://woodpecker-ci.org/docs/next/migrations#200).
 
 - `wpaperd` has been updated to 1.0.1, which has a breaking change: previous version 0.3.0 had 2 different configuration files, one for wpaperd and one for the wallpapers. Remove the former and move the latter (`wallpaper.toml`) to `config.toml`.
@@ -592,7 +583,7 @@ can now be used to disable the upstream fallback servers entirely by setting it
   allows to restart multiple services that are ordered before sysinit.target
   and respect the ordering between the services.
 
-- `services.prometheus.exporters.snmp`'s configuration format changed with release 0.23.0.
+- The configuration format for `services.prometheus.exporters.snmp` changed with release 0.23.0.
   The module now includes an optional config check, that is enabled by default, to make the change obvious before any deployment.
   More information about the configuration syntax change is available in the [upstream repository](https://github.com/prometheus/snmp_exporter/blob/b75fc6b839ee3f3ccbee68bee55f1ae99555084a/auth-split-migration.md).
 
@@ -602,7 +593,7 @@ can now be used to disable the upstream fallback servers entirely by setting it
 
 - `addDriverRunpath` has been added to facilitate the deprecation of the old `addOpenGLRunpath` setuphook. This change is motivated by the evolution of the setuphook to include all hardware acceleration.
 
-- `appimage`, `appimageTools.wrapAppImage` and `buildFHSEnvBubblewrap` now properly accept `pname` and `version`.
+- `appimage`, `appimageTools.wrapAppImage` and `buildFHSEnvBubblewrap` now properly accepts `pname` and `version`.
 
 - `bacula` now allows to configure `TLS` for encrypted communication.
 
@@ -617,11 +608,11 @@ can now be used to disable the upstream fallback servers entirely by setting it
 - `buildDubPackage` can now be used to build Programs written in [D](https://dlang.org/) using the `dub` build system and package manager.
   See the [D section](https://nixos.org/manual/nixpkgs/unstable#dlang) in the manual for more information.
 
-- `castopod` has some migration actions to be taken in case of a S3 setup. Some new features may also need some manual migration actions. See [https://code.castopod.org/adaures/castopod/-/releases](https://code.castopod.org/adaures/castopod/-/releases) for more information.
+- `castopod` has some migration actions to be taken in case of a S3 setup. Some new features may also need some manual migration actions. See [https://code.castopod.org/adaures/castopod/-/releases](https://code.castopod.org/adaures/castopod/-/releases) for more informations.
 
 - `cinnamon` has been updated to 6.0. Please beware that the [Wayland session](https://blog.linuxmint.com/?p=4591) is still experimental in this release and could potentially [affect Xorg sessions](https://blog.linuxmint.com/?p=4639). We suggest a reboot when switching between sessions.
 
-- `documentation.man.mandoc` now uses `MANPATH` by defaultwas to set the directories where mandoc will search for manual pages.
+- `documentation.man.mandoc` now by default uses `MANPATH` to set the directories where mandoc will search for manual pages.
   This enables mandoc to find manual pages in Nix profiles. To set the manual search paths via the `mandoc.conf` configuration file like before, use `documentation.man.mandoc.settings.manpath` instead.
 
 - `drbd` out-of-tree Linux kernel driver has been added in version 9.2.7. With it the DRBD 9.x features can be used instead of the 8.x features provided by the 8.4.11 in-tree driver.
@@ -672,7 +663,7 @@ can now be used to disable the upstream fallback servers entirely by setting it
 
 - `services.github-runner` module has been removed. To configure a single GitHub Actions Runner refer to `services.github-runners.*`. Note that this will trigger a new runner registration.
 
-- `services.networkmanager.extraConfig` was renamed to `services.networkmanager.settings` and changed to use the ini type instead of using a multiline string.
+- `services.networkmanager.extraConfig` was renamed to `services.networkmanager.settings` and was changed to use the ini type instead of using a multiline string.
 
 - `services.nextcloud.config.dbport` option of the Nextcloud module was removed to match upstream.
   The port can be specified in [`services.nextcloud.config.dbhost`](#opt-services.nextcloud.config.dbhost).
@@ -700,7 +691,7 @@ can now be used to disable the upstream fallback servers entirely by setting it
 
 - `services.paperless` module no longer uses the previously downloaded NLTK data stored in `/var/cache/paperless/nltk`. This directory can be removed.
 
-- `services.postgresql.extraPlugins`' type has expanded. Previously it was a list of packages, now it can also be a function that returns such a list.
+- `services.postgresql.extraPlugins` changed its type from just a list of packages to also a function that returns such a list.
   For example a config line like ``services.postgresql.extraPlugins = with pkgs.postgresql_11.pkgs; [ postgis ];`` is recommended to be changed to ``services.postgresql.extraPlugins = ps: with ps; [ postgis ];``;
 
 - `services.slskd` has been refactored to include more configuation options in
@@ -750,8 +741,8 @@ can now be used to disable the upstream fallback servers entirely by setting it
 
 - A new hardening flag, `trivialautovarinit` was made available, corresponding to the gcc/clang option `-ftrivial-auto-var-init=pattern`.
 
-- `dnsdist` has new options to enable and configure a DNSCrypt endpoint (see `services.dnsdist.dnscrypt.enable`, etc.).
-  The module can generate the DNSCrypt provider key pair and certificates, and also rotates them automatically with no downtime.
+- New options were added to the dnsdist module to enable and configure a DNSCrypt endpoint (see `services.dnsdist.dnscrypt.enable`, etc.).
+  The module can generate the DNSCrypt provider key pair, certificates and also performs their rotation automatically with no downtime.
 
 - The kernel Yama LSM is now enabled by default, which prevents ptracing
   non-child processes. This means you will not be able to attach gdb to an

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -1,30 +0,0 @@
-# Release 24.11 (“Vicuña”, 2024.11/??) {#sec-release-24.11}
-
-<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
-
-## Highlights {#sec-release-24.11-highlights}
-
-- Create the first release note entry in this section!
-
-## New Services {#sec-release-24.11-new-services}
-
-- Create the first release note entry in this section!
-
-## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
-
-- `nginx` package no longer includes `gd` and `geoip` dependencies. For enabling it, override `nginx` package with the optionals `withImageFilter` and `withGeoIP`.
-
-- `nvimpager` was updated to version 0.13.0, which changes the order of user and
-  nvimpager settings: user commands in `-c` and `--cmd` now override the
-  respective default settings because they are executed later.
-
-- Legacy package `stalwart-mail_0_6` was dropped, please note the
-  [manual upgrade process](https://github.com/stalwartlabs/mail-server/blob/main/UPGRADING.md)
-  before changing the package to `pkgs.stalwart-mail` in
-  [`services.stalwart-mail.package`](#opt-services.stalwart-mail.package).
-
-## Other Notable Changes {#sec-release-24.11-notable-changes}
-
-- Create the first release note entry in this section!
-
-<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/lib/test-driver/test_driver/logger.py

@@ -53,6 +53,7 @@ class AbstractLogger(ABC):
 
 
 class JunitXMLLogger(AbstractLogger):
+
     class TestCaseState:
         def __init__(self) -> None:
             self.stdout = ""
@@ -226,7 +227,7 @@ class XMLLogger(AbstractLogger):
     def __init__(self, outfile: str) -> None:
         self.logfile_handle = codecs.open(outfile, "wb")
         self.xml = XMLGenerator(self.logfile_handle, encoding="utf-8")
-        self.queue: Queue[dict[str, str]] = Queue()
+        self.queue: "Queue[Dict[str, str]]" = Queue()
 
         self._print_serial_logs = True
 

nixos/maintainers/scripts/ec2/README.md

@@ -1,36 +1,7 @@
 # Amazon images
 
-AMIs are regularly uploaded from Hydra. This automation lives in
-https://github.com/NixOS/amis
+* The `create-amis.sh` script will be replaced by https://github.com/NixOS/amis which will regularly upload AMIs per NixOS channel bump.
 
-
-## How to upload an AMI for testing
-
-If you want to upload an AMI from changes in a local nixpkgs checkout.
-
-```bash
-nix-build nixos/release.nix -A amazonImage
-
-export AWS_REGION=us-west-2
-export AWS_PROFILE=my-profile
-nix run nixpkgs#upload-ami -- --image-info ./result/nix-support/image-info.json
-```
-
-## How to build your own NixOS config into an AMI
-
-I suggest looking at https://github.com/nix-community/nixos-generators for a user-friendly interface.
-
-```bash
-nixos-generate -c ./my-config.nix -f amazon
-
-export AWS_REGION=us-west-2
-export AWS_PROFILE=my-profile
-nix run github:NixOS/amis#upload-ami -- --image-info ./result/nix-support/image-info.json
-```
-
-## Roadmap
-
-* @arianvp is planning to drop zfs support unless someone else picks it up
+* @arianvp is planning to drop zfs support
 * @arianvp is planning to rewrite the image builder to use the repart-based image builder.
-* @arianvp is planning to perhaps rewrite `upload-ami` to use coldnsap
-* @arianvp is planning to move `upload-ami` tooling into nixpkgs once it has stabilized. And only keep the Github Action in separate repo
+

nixos/maintainers/scripts/ec2/create-amis.sh

@@ -0,0 +1,368 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -p awscli -p jq -p qemu -i bash
+# shellcheck shell=bash
+#
+# Future Deprecation?
+# This entire thing should probably be replaced with a generic terraform config
+
+# Uploads and registers NixOS images built from the
+# <nixos/release.nix> amazonImage attribute. Images are uploaded and
+# registered via a home region, and then copied to other regions.
+
+# The home region requires an s3 bucket, and an IAM role named "vmimport"
+# (by default) with access to the S3 bucket. The name can be
+# configured with the "service_role_name" variable. Configuration of the
+# vmimport role is documented in
+# https://docs.aws.amazon.com/vm-import/latest/userguide/vmimport-image-import.html
+
+# set -x
+set -euo pipefail
+
+var () { true; }
+
+# configuration
+var ${state_dir:=$HOME/amis/ec2-images}
+var ${home_region:=eu-west-1}
+var ${bucket:=nixos-amis}
+var ${service_role_name:=vmimport}
+
+# Output of the command:
+# $ nix-shell -I nixpkgs=. -p awscli --run 'aws ec2 describe-regions --region us-east-1 --all-regions --query "Regions[].{Name:RegionName}" --output text | sort | sed -e s/^/\ \ /'
+var ${regions:=
+  af-south-1
+  ap-east-1
+  ap-northeast-1
+  ap-northeast-2
+  ap-northeast-3
+  ap-south-1
+  ap-south-2
+  ap-southeast-1
+  ap-southeast-2
+  ap-southeast-3
+  ap-southeast-4
+  ca-central-1
+  eu-central-1
+  eu-central-2
+  eu-north-1
+  eu-south-1
+  eu-south-2
+  eu-west-1
+  eu-west-2
+  eu-west-3
+  il-central-1
+  me-central-1
+  me-south-1
+  sa-east-1
+  us-east-1
+  us-east-2
+  us-west-1
+  us-west-2
+}
+
+regions=($regions)
+
+log() {
+    echo "$@" >&2
+}
+
+if [ "$#" -ne 1 ]; then
+    log "Usage: ./upload-amazon-image.sh IMAGE_OUTPUT"
+    exit 1
+fi
+
+# result of the amazon-image from nixos/release.nix
+store_path=$1
+
+if [ ! -e "$store_path" ]; then
+    log "Store path: $store_path does not exist, fetching..."
+    nix-store --realise "$store_path"
+fi
+
+if [ ! -d "$store_path" ]; then
+    log "store_path: $store_path is not a directory. aborting"
+    exit 1
+fi
+
+read_image_info() {
+    if [ ! -e "$store_path/nix-support/image-info.json" ]; then
+        log "Image missing metadata"
+        exit 1
+    fi
+    jq -r "$1" "$store_path/nix-support/image-info.json"
+}
+
+# We handle a single image per invocation, store all attributes in
+# globals for convenience.
+zfs_disks=$(read_image_info .disks)
+is_zfs_image=
+if jq -e .boot <<< "$zfs_disks"; then
+  is_zfs_image=1
+  zfs_boot=".disks.boot"
+fi
+image_label="$(read_image_info .label)${is_zfs_image:+-ZFS}"
+image_system=$(read_image_info .system)
+image_files=( $(read_image_info ".disks.root.file") )
+
+image_logical_bytes=$(read_image_info "${zfs_boot:-.disks.root}.logical_bytes")
+
+if [[ -n "$is_zfs_image" ]]; then
+  image_files+=( $(read_image_info .disks.boot.file) )
+fi
+
+# Derived attributes
+
+image_logical_gigabytes=$(((image_logical_bytes-1)/1024/1024/1024+1)) # Round to the next GB
+
+case "$image_system" in
+    aarch64-linux)
+        amazon_arch=arm64
+        ;;
+    x86_64-linux)
+        amazon_arch=x86_64
+        ;;
+    *)
+        log "Unknown system: $image_system"
+        exit 1
+esac
+
+image_name="NixOS-${image_label}-${image_system}"
+image_description="NixOS ${image_label} ${image_system}"
+
+log "Image Details:"
+log " Name: $image_name"
+log " Description: $image_description"
+log " Size (gigabytes): $image_logical_gigabytes"
+log " System: $image_system"
+log " Amazon Arch: $amazon_arch"
+
+read_state() {
+    local state_key=$1
+    local type=$2
+
+    cat "$state_dir/$state_key.$type" 2>/dev/null || true
+}
+
+write_state() {
+    local state_key=$1
+    local type=$2
+    local val=$3
+
+    mkdir -p "$state_dir"
+    echo "$val" > "$state_dir/$state_key.$type"
+}
+
+wait_for_import() {
+    local region=$1
+    local task_id=$2
+    local state snapshot_id
+    log "Waiting for import task $task_id to be completed"
+    while true; do
+        read -r state message snapshot_id < <(
+            aws ec2 describe-import-snapshot-tasks --region "$region" --import-task-ids "$task_id" | \
+                jq -r '.ImportSnapshotTasks[].SnapshotTaskDetail | "\(.Status) \(.StatusMessage) \(.SnapshotId)"'
+        )
+        log " ... state=$state message=$message snapshot_id=$snapshot_id"
+        case "$state" in
+            active)
+                sleep 10
+                ;;
+            completed)
+                echo "$snapshot_id"
+                return
+                ;;
+            *)
+                log "Unexpected snapshot import state: '${state}'"
+                log "Full response: "
+                aws ec2 describe-import-snapshot-tasks --region "$region" --import-task-ids "$task_id" >&2
+                exit 1
+                ;;
+        esac
+    done
+}
+
+wait_for_image() {
+    local region=$1
+    local ami_id=$2
+    local state
+    log "Waiting for image $ami_id to be available"
+
+    while true; do
+        read -r state < <(
+            aws ec2 describe-images --image-ids "$ami_id" --region "$region" | \
+                jq -r ".Images[].State"
+        )
+        log " ... state=$state"
+        case "$state" in
+            pending)
+                sleep 10
+                ;;
+            available)
+                return
+                ;;
+            *)
+                log "Unexpected AMI state: '${state}'"
+                exit 1
+                ;;
+        esac
+    done
+}
+
+
+make_image_public() {
+    local region=$1
+    local ami_id=$2
+
+    wait_for_image "$region" "$ami_id"
+
+    log "Making image $ami_id public"
+
+    aws ec2 modify-image-attribute \
+        --image-id "$ami_id" --region "$region" --launch-permission 'Add={Group=all}' >&2
+}
+
+upload_image() {
+    local region=$1
+
+    for image_file in "${image_files[@]}"; do
+        local aws_path=${image_file#/}
+
+        if [[ -n "$is_zfs_image" ]]; then
+            local suffix=${image_file%.*}
+            suffix=${suffix##*.}
+        fi
+
+        local state_key="$region.$image_label${suffix:+.${suffix}}.$image_system"
+        local task_id
+        task_id=$(read_state "$state_key" task_id)
+        local snapshot_id
+        snapshot_id=$(read_state "$state_key" snapshot_id)
+        local ami_id
+        ami_id=$(read_state "$state_key" ami_id)
+
+        if [ -z "$task_id" ]; then
+            log "Checking for image on S3"
+            if ! aws s3 ls --region "$region" "s3://${bucket}/${aws_path}" >&2; then
+                log "Image missing from aws, uploading"
+                aws s3 cp --region "$region" "$image_file" "s3://${bucket}/${aws_path}" >&2
+            fi
+
+            log "Importing image from S3 path s3://$bucket/$aws_path"
+
+            task_id=$(aws ec2 import-snapshot --role-name "$service_role_name" --disk-container "{
+              \"Description\": \"nixos-image-${image_label}-${image_system}\",
+              \"Format\": \"vhd\",
+              \"UserBucket\": {
+                  \"S3Bucket\": \"$bucket\",
+                  \"S3Key\": \"$aws_path\"
+              }
+            }" --region "$region" | jq -r '.ImportTaskId')
+
+            write_state "$state_key" task_id "$task_id"
+        fi
+
+        if [ -z "$snapshot_id" ]; then
+            snapshot_id=$(wait_for_import "$region" "$task_id")
+            write_state "$state_key" snapshot_id "$snapshot_id"
+        fi
+    done
+
+    if [ -z "$ami_id" ]; then
+        log "Registering snapshot $snapshot_id as AMI"
+
+        local block_device_mappings=(
+            "DeviceName=/dev/xvda,Ebs={SnapshotId=$snapshot_id,VolumeSize=$image_logical_gigabytes,DeleteOnTermination=true,VolumeType=gp3}"
+        )
+
+        if [[ -n "$is_zfs_image" ]]; then
+            local root_snapshot_id=$(read_state "$region.$image_label.root.$image_system" snapshot_id)
+
+            local root_image_logical_bytes=$(read_image_info ".disks.root.logical_bytes")
+            local root_image_logical_gigabytes=$(((root_image_logical_bytes-1)/1024/1024/1024+1)) # Round to the next GB
+
+            block_device_mappings+=(
+                "DeviceName=/dev/xvdb,Ebs={SnapshotId=$root_snapshot_id,VolumeSize=$root_image_logical_gigabytes,DeleteOnTermination=true,VolumeType=gp3}"
+            )
+        fi
+
+
+        local extra_flags=(
+            --root-device-name /dev/xvda
+            --sriov-net-support simple
+            --ena-support
+            --virtualization-type hvm
+        )
+
+        block_device_mappings+=("DeviceName=/dev/sdb,VirtualName=ephemeral0")
+        block_device_mappings+=("DeviceName=/dev/sdc,VirtualName=ephemeral1")
+        block_device_mappings+=("DeviceName=/dev/sdd,VirtualName=ephemeral2")
+        block_device_mappings+=("DeviceName=/dev/sde,VirtualName=ephemeral3")
+
+        ami_id=$(
+            aws ec2 register-image \
+                --name "$image_name" \
+                --description "$image_description" \
+                --region "$region" \
+                --architecture $amazon_arch \
+                --block-device-mappings "${block_device_mappings[@]}" \
+                --boot-mode $(read_image_info .boot_mode) \
+                "${extra_flags[@]}" \
+                | jq -r '.ImageId'
+              )
+
+        write_state "$state_key" ami_id "$ami_id"
+    fi
+
+    [[ -v PRIVATE ]] || make_image_public "$region" "$ami_id"
+
+    echo "$ami_id"
+}
+
+copy_to_region() {
+    local region=$1
+    local from_region=$2
+    local from_ami_id=$3
+
+    state_key="$region.$image_label.$image_system"
+    ami_id=$(read_state "$state_key" ami_id)
+
+    if [ -z "$ami_id" ]; then
+        log "Copying $from_ami_id to $region"
+        ami_id=$(
+            aws ec2 copy-image \
+                --region "$region" \
+                --source-region "$from_region" \
+                --source-image-id "$from_ami_id" \
+                --name "$image_name" \
+                --description "$image_description" \
+                | jq -r '.ImageId'
+              )
+
+        write_state "$state_key" ami_id "$ami_id"
+    fi
+
+    [[ -v PRIVATE ]] || make_image_public "$region" "$ami_id"
+
+    echo "$ami_id"
+}
+
+upload_all() {
+    home_image_id=$(upload_image "$home_region")
+    jq -n \
+       --arg key "$home_region.$image_system" \
+       --arg value "$home_image_id" \
+       '$ARGS.named'
+
+    for region in "${regions[@]}"; do
+        if [ "$region" = "$home_region" ]; then
+            continue
+        fi
+        copied_image_id=$(copy_to_region "$region" "$home_region" "$home_image_id")
+
+        jq -n \
+           --arg key "$region.$image_system" \
+           --arg value "$copied_image_id" \
+           '$ARGS.named'
+    done
+}
+
+upload_all | jq --slurp from_entries

nixos/modules/config/nix-channel.nix

@@ -69,7 +69,7 @@ in
       defaultChannel = mkOption {
         internal = true;
         type = types.str;
-        default = "https://nixos.org/channels/nixos-unstable";
+        default = "https://nixos.org/channels/nixos-24.05";
         description = "Default NixOS channel to which the root user is subscribed.";
       };
     };

nixos/modules/config/no-x-libs.nix

@@ -54,11 +54,10 @@ with lib;
       intel-vaapi-driver = super.intel-vaapi-driver.override { enableGui = false; };
       libdevil = super.libdevil-nox;
       libextractor = super.libextractor.override { gtkSupport = false; };
-      libplacebo = super.libplacebo.override { vulkanSupport = false; };
       libva = super.libva-minimal;
       limesuite = super.limesuite.override { withGui = false; };
       mc = super.mc.override { x11Support = false; };
-      mpv-unwrapped = super.mpv-unwrapped.override { drmSupport = false; screenSaverSupport = false; sdl2Support = false; vulkanSupport = false; waylandSupport = false; x11Support = false; };
+      mpv-unwrapped = super.mpv-unwrapped.override { sdl2Support = false; x11Support = false; waylandSupport = false; };
       msmtp = super.msmtp.override { withKeyring = false; };
       mupdf = super.mupdf.override { enableGL = false; enableX11 = false; };
       neofetch = super.neofetch.override { x11Support = false; };
@@ -71,7 +70,6 @@ with lib;
       networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
       pango = super.pango.override { x11Support = false; };
       pinentry-curses = super.pinentry-curses.override { withLibsecret = false; };
-      pinentry-tty = super.pinentry-tty.override { withLibsecret = false; };
       pipewire = super.pipewire.override { vulkanSupport = false; x11Support = false; };
       pythonPackagesExtensions = super.pythonPackagesExtensions ++ [
         (python-final: python-prev: {

nixos/modules/hardware/video/nvidia.nix

@@ -3,10 +3,12 @@
   lib,
   pkgs,
   ...
-}:
-let
+}: let
   nvidiaEnabled = (lib.elem "nvidia" config.services.xserver.videoDrivers);
-  nvidia_x11 = if nvidiaEnabled || cfg.datacenter.enable then cfg.package else null;
+  nvidia_x11 =
+    if nvidiaEnabled || cfg.datacenter.enable
+    then cfg.package
+    else null;
 
   cfg = config.hardware.nvidia;
 
@@ -17,9 +19,8 @@ let
   primeEnabled = syncCfg.enable || reverseSyncCfg.enable || offloadCfg.enable;
   busIDType = lib.types.strMatching "([[:print:]]+[\:\@][0-9]{1,3}\:[0-9]{1,2}\:[0-9])?";
   ibtSupport = cfg.open || (nvidia_x11.ibtSupport or false);
-  settingsFormat = pkgs.formats.keyValue { };
-in
-{
+  settingsFormat = pkgs.formats.keyValue {};
+in {
   options = {
     hardware.nvidia = {
       datacenter.enable = lib.mkEnableOption ''
@@ -28,50 +29,50 @@ in
       datacenter.settings = lib.mkOption {
         type = settingsFormat.type;
         default = {
-          LOG_LEVEL = 4;
-          LOG_FILE_NAME = "/var/log/fabricmanager.log";
-          LOG_APPEND_TO_LOG = 1;
-          LOG_FILE_MAX_SIZE = 1024;
-          LOG_USE_SYSLOG = 0;
-          DAEMONIZE = 1;
-          BIND_INTERFACE_IP = "127.0.0.1";
-          STARTING_TCP_PORT = 16000;
-          FABRIC_MODE = 0;
-          FABRIC_MODE_RESTART = 0;
-          STATE_FILE_NAME = "/var/tmp/fabricmanager.state";
-          FM_CMD_BIND_INTERFACE = "127.0.0.1";
-          FM_CMD_PORT_NUMBER = 6666;
-          FM_STAY_RESIDENT_ON_FAILURES = 0;
-          ACCESS_LINK_FAILURE_MODE = 0;
-          TRUNK_LINK_FAILURE_MODE = 0;
-          NVSWITCH_FAILURE_MODE = 0;
-          ABORT_CUDA_JOBS_ON_FM_EXIT = 1;
-          TOPOLOGY_FILE_PATH = "${nvidia_x11.fabricmanager}/share/nvidia-fabricmanager/nvidia/nvswitch";
-          DATABASE_PATH = "${nvidia_x11.fabricmanager}/share/nvidia-fabricmanager/nvidia/nvswitch";
+          LOG_LEVEL=4;
+          LOG_FILE_NAME="/var/log/fabricmanager.log";
+          LOG_APPEND_TO_LOG=1;
+          LOG_FILE_MAX_SIZE=1024;
+          LOG_USE_SYSLOG=0;
+          DAEMONIZE=1;
+          BIND_INTERFACE_IP="127.0.0.1";
+          STARTING_TCP_PORT=16000;
+          FABRIC_MODE=0;
+          FABRIC_MODE_RESTART=0;
+          STATE_FILE_NAME="/var/tmp/fabricmanager.state";
+          FM_CMD_BIND_INTERFACE="127.0.0.1";
+          FM_CMD_PORT_NUMBER=6666;
+          FM_STAY_RESIDENT_ON_FAILURES=0;
+          ACCESS_LINK_FAILURE_MODE=0;
+          TRUNK_LINK_FAILURE_MODE=0;
+          NVSWITCH_FAILURE_MODE=0;
+          ABORT_CUDA_JOBS_ON_FM_EXIT=1;
+          TOPOLOGY_FILE_PATH="${nvidia_x11.fabricmanager}/share/nvidia-fabricmanager/nvidia/nvswitch";
+          DATABASE_PATH="${nvidia_x11.fabricmanager}/share/nvidia-fabricmanager/nvidia/nvswitch";
         };
         defaultText = lib.literalExpression ''
-          {
-            LOG_LEVEL=4;
-            LOG_FILE_NAME="/var/log/fabricmanager.log";
-            LOG_APPEND_TO_LOG=1;
-            LOG_FILE_MAX_SIZE=1024;
-            LOG_USE_SYSLOG=0;
-            DAEMONIZE=1;
-            BIND_INTERFACE_IP="127.0.0.1";
-            STARTING_TCP_PORT=16000;
-            FABRIC_MODE=0;
-            FABRIC_MODE_RESTART=0;
-            STATE_FILE_NAME="/var/tmp/fabricmanager.state";
-            FM_CMD_BIND_INTERFACE="127.0.0.1";
-            FM_CMD_PORT_NUMBER=6666;
-            FM_STAY_RESIDENT_ON_FAILURES=0;
-            ACCESS_LINK_FAILURE_MODE=0;
-            TRUNK_LINK_FAILURE_MODE=0;
-            NVSWITCH_FAILURE_MODE=0;
-            ABORT_CUDA_JOBS_ON_FM_EXIT=1;
-            TOPOLOGY_FILE_PATH="''${nvidia_x11.fabricmanager}/share/nvidia-fabricmanager/nvidia/nvswitch";
-            DATABASE_PATH="''${nvidia_x11.fabricmanager}/share/nvidia-fabricmanager/nvidia/nvswitch";
-          }
+        {
+          LOG_LEVEL=4;
+          LOG_FILE_NAME="/var/log/fabricmanager.log";
+          LOG_APPEND_TO_LOG=1;
+          LOG_FILE_MAX_SIZE=1024;
+          LOG_USE_SYSLOG=0;
+          DAEMONIZE=1;
+          BIND_INTERFACE_IP="127.0.0.1";
+          STARTING_TCP_PORT=16000;
+          FABRIC_MODE=0;
+          FABRIC_MODE_RESTART=0;
+          STATE_FILE_NAME="/var/tmp/fabricmanager.state";
+          FM_CMD_BIND_INTERFACE="127.0.0.1";
+          FM_CMD_PORT_NUMBER=6666;
+          FM_STAY_RESIDENT_ON_FAILURES=0;
+          ACCESS_LINK_FAILURE_MODE=0;
+          TRUNK_LINK_FAILURE_MODE=0;
+          NVSWITCH_FAILURE_MODE=0;
+          ABORT_CUDA_JOBS_ON_FM_EXIT=1;
+          TOPOLOGY_FILE_PATH="''${nvidia_x11.fabricmanager}/share/nvidia-fabricmanager/nvidia/nvswitch";
+          DATABASE_PATH="''${nvidia_x11.fabricmanager}/share/nvidia-fabricmanager/nvidia/nvswitch";
+        }
         '';
         description = ''
           Additional configuration options for fabricmanager.
@@ -210,9 +211,7 @@ in
         (lib.mkEnableOption ''
           nvidia-settings, NVIDIA's GUI configuration tool
         '')
-        // {
-          default = true;
-        };
+        // {default = true;};
 
       nvidiaPersistenced = lib.mkEnableOption ''
         nvidia-persistenced a update for NVIDIA GPU headless mode, i.e.
@@ -227,8 +226,7 @@ in
       '';
 
       package = lib.mkOption {
-        default =
-          config.boot.kernelPackages.nvidiaPackages."${if cfg.datacenter.enable then "dc" else "stable"}";
+        default = config.boot.kernelPackages.nvidiaPackages."${if cfg.datacenter.enable then "dc" else "stable"}";
         defaultText = lib.literalExpression ''
           config.boot.kernelPackages.nvidiaPackages."\$\{if cfg.datacenter.enable then "dc" else "stable"}"
         '';
@@ -244,404 +242,403 @@ in
     };
   };
 
-  config =
-    let
-      igpuDriver = if pCfg.intelBusId != "" then "modesetting" else "amdgpu";
-      igpuBusId = if pCfg.intelBusId != "" then pCfg.intelBusId else pCfg.amdgpuBusId;
-    in
-    lib.mkIf (nvidia_x11 != null) (
-      lib.mkMerge [
-        # Common
-        ({
-          assertions = [
-            {
-              assertion = !(nvidiaEnabled && cfg.datacenter.enable);
-              message = "You cannot configure both X11 and Data Center drivers at the same time.";
-            }
-          ];
-          boot = {
-            blacklistedKernelModules = [
-              "nouveau"
-              "nvidiafb"
-            ];
+  config = let
+    igpuDriver =
+      if pCfg.intelBusId != ""
+      then "modesetting"
+      else "amdgpu";
+    igpuBusId =
+      if pCfg.intelBusId != ""
+      then pCfg.intelBusId
+      else pCfg.amdgpuBusId;
+  in
+    lib.mkIf (nvidia_x11 != null) (lib.mkMerge [
+      # Common
+      ({
+        assertions = [
+          {
+            assertion = !(nvidiaEnabled && cfg.datacenter.enable);
+            message = "You cannot configure both X11 and Data Center drivers at the same time.";
+          }
+        ];
+        boot = {
+          blacklistedKernelModules = ["nouveau" "nvidiafb"];
 
-            # Don't add `nvidia-uvm` to `kernelModules`, because we want
-            # `nvidia-uvm` be loaded only after `udev` rules for `nvidia` kernel
-            # module are applied.
-            #
-            # Instead, we use `softdep` to lazily load `nvidia-uvm` kernel module
-            # after `nvidia` kernel module is loaded and `udev` rules are applied.
-            extraModprobeConfig = ''
-              softdep nvidia post: nvidia-uvm
-            '';
-          };
-          systemd.tmpfiles.rules = lib.optional config.virtualisation.docker.enableNvidia "L+ /run/nvidia-docker/bin - - - - ${nvidia_x11.bin}/origBin";
-          services.udev.extraRules = ''
-            # Create /dev/nvidia-uvm when the nvidia-uvm module is loaded.
-            KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidiactl c 195 255'"
-            KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'for i in $$(cat /proc/driver/nvidia/gpus/*/information | grep Minor | cut -d \  -f 4); do mknod -m 666 /dev/nvidia$${i} c 195 $${i}; done'"
-            KERNEL=="nvidia_modeset", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-modeset c 195 254'"
-            KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 0'"
-            KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm-tools c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 1'"
+          # Don't add `nvidia-uvm` to `kernelModules`, because we want
+          # `nvidia-uvm` be loaded only after `udev` rules for `nvidia` kernel
+          # module are applied.
+          #
+          # Instead, we use `softdep` to lazily load `nvidia-uvm` kernel module
+          # after `nvidia` kernel module is loaded and `udev` rules are applied.
+          extraModprobeConfig = ''
+            softdep nvidia post: nvidia-uvm
           '';
-          hardware.opengl = {
-            extraPackages = [ nvidia_x11.out nvidia_x11.settings.libXNVCtrl ];
-            extraPackages32 = [ nvidia_x11.lib32 ];
-          };
-          environment.systemPackages = [ nvidia_x11.bin ];
-        })
-        # X11
-        (lib.mkIf nvidiaEnabled {
-          assertions = [
-            {
-              assertion = primeEnabled -> pCfg.intelBusId == "" || pCfg.amdgpuBusId == "";
-              message = "You cannot configure both an Intel iGPU and an AMD APU. Pick the one corresponding to your processor.";
-            }
-
-            {
-              assertion = offloadCfg.enableOffloadCmd -> offloadCfg.enable || reverseSyncCfg.enable;
-              message = "Offload command requires offloading or reverse prime sync to be enabled.";
-            }
-
-            {
-              assertion =
-                primeEnabled -> pCfg.nvidiaBusId != "" && (pCfg.intelBusId != "" || pCfg.amdgpuBusId != "");
-              message = "When NVIDIA PRIME is enabled, the GPU bus IDs must be configured.";
-            }
-
-            {
-              assertion = offloadCfg.enable -> lib.versionAtLeast nvidia_x11.version "435.21";
-              message = "NVIDIA PRIME render offload is currently only supported on versions >= 435.21.";
-            }
-
-            {
-              assertion =
-                (reverseSyncCfg.enable && pCfg.amdgpuBusId != "") -> lib.versionAtLeast nvidia_x11.version "470.0";
-              message = "NVIDIA PRIME render offload for AMD APUs is currently only supported on versions >= 470 beta.";
-            }
-
-            {
-              assertion = !(syncCfg.enable && offloadCfg.enable);
-              message = "PRIME Sync and Offload cannot be both enabled";
-            }
-
-            {
-              assertion = !(syncCfg.enable && reverseSyncCfg.enable);
-              message = "PRIME Sync and PRIME Reverse Sync cannot be both enabled";
-            }
-
-            {
-              assertion = !(syncCfg.enable && cfg.powerManagement.finegrained);
-              message = "Sync precludes powering down the NVIDIA GPU.";
-            }
-
-            {
-              assertion = cfg.powerManagement.finegrained -> offloadCfg.enable;
-              message = "Fine-grained power management requires offload to be enabled.";
-            }
-
-            {
-              assertion = cfg.powerManagement.enable -> lib.versionAtLeast nvidia_x11.version "430.09";
-              message = "Required files for driver based power management only exist on versions >= 430.09.";
-            }
-
-            {
-              assertion = cfg.open -> (cfg.package ? open && cfg.package ? firmware);
-              message = "This version of NVIDIA driver does not provide a corresponding opensource kernel driver";
-            }
-
-            {
-              assertion = cfg.dynamicBoost.enable -> lib.versionAtLeast nvidia_x11.version "510.39.01";
-              message = "NVIDIA's Dynamic Boost feature only exists on versions >= 510.39.01";
-            }
+        };
+        systemd.tmpfiles.rules =
+          lib.optional config.virtualisation.docker.enableNvidia
+            "L+ /run/nvidia-docker/bin - - - - ${nvidia_x11.bin}/origBin";
+        services.udev.extraRules =
+        ''
+          # Create /dev/nvidia-uvm when the nvidia-uvm module is loaded.
+          KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidiactl c 195 255'"
+          KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'for i in $$(cat /proc/driver/nvidia/gpus/*/information | grep Minor | cut -d \  -f 4); do mknod -m 666 /dev/nvidia$${i} c 195 $${i}; done'"
+          KERNEL=="nvidia_modeset", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-modeset c 195 254'"
+          KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 0'"
+          KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm-tools c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 1'"
+        '';
+        hardware.opengl = {
+          extraPackages = [
+            nvidia_x11.out
           ];
+          extraPackages32 = [
+            nvidia_x11.lib32
+          ];
+        };
+        environment.systemPackages = [
+          nvidia_x11.bin
+        ];
+      })
+      # X11
+      (lib.mkIf nvidiaEnabled {
+        assertions = [
+        {
+          assertion = primeEnabled -> pCfg.intelBusId == "" || pCfg.amdgpuBusId == "";
+          message = "You cannot configure both an Intel iGPU and an AMD APU. Pick the one corresponding to your processor.";
+        }
 
-          # If Optimus/PRIME is enabled, we:
-          # - Specify the configured NVIDIA GPU bus ID in the Device section for the
-          #   "nvidia" driver.
-          # - Add the AllowEmptyInitialConfiguration option to the Screen section for the
-          #   "nvidia" driver, in order to allow the X server to start without any outputs.
-          # - Add a separate Device section for the Intel GPU, using the "modesetting"
-          #   driver and with the configured BusID.
-          # - OR add a separate Device section for the AMD APU, using the "amdgpu"
-          #   driver and with the configures BusID.
-          # - Reference that Device section from the ServerLayout section as an inactive
-          #   device.
-          # - Configure the display manager to run specific `xrandr` commands which will
-          #   configure/enable displays connected to the Intel iGPU / AMD APU.
+        {
+          assertion = offloadCfg.enableOffloadCmd -> offloadCfg.enable || reverseSyncCfg.enable;
+          message = "Offload command requires offloading or reverse prime sync to be enabled.";
+        }
 
-          # reverse sync implies offloading
-          hardware.nvidia.prime.offload.enable = lib.mkDefault reverseSyncCfg.enable;
+        {
+          assertion = primeEnabled -> pCfg.nvidiaBusId != "" && (pCfg.intelBusId != "" || pCfg.amdgpuBusId != "");
+          message = "When NVIDIA PRIME is enabled, the GPU bus IDs must be configured.";
+        }
 
-          services.xserver.drivers =
-            lib.optional primeEnabled {
-              name = igpuDriver;
-              display = offloadCfg.enable;
-              modules = lib.optional (igpuDriver == "amdgpu") pkgs.xorg.xf86videoamdgpu;
-              deviceSection =
-                ''
-                  BusID "${igpuBusId}"
-                ''
-                + lib.optionalString (syncCfg.enable && igpuDriver != "amdgpu") ''
-                  Option "AccelMethod" "none"
-                '';
-            }
-            ++ lib.singleton {
-              name = "nvidia";
-              modules = [ nvidia_x11.bin ];
-              display = !offloadCfg.enable;
-              deviceSection =
-                ''
-                  Option "SidebandSocketPath" "/run/nvidia-xdriver/"
-                ''
-                + lib.optionalString primeEnabled ''
-                  BusID "${pCfg.nvidiaBusId}"
-                ''
-                + lib.optionalString pCfg.allowExternalGpu ''
-                  Option "AllowExternalGpus"
-                '';
-              screenSection =
-                ''
-                  Option "RandRRotation" "on"
-                ''
-                + lib.optionalString syncCfg.enable ''
-                  Option "AllowEmptyInitialConfiguration"
-                ''
-                + lib.optionalString cfg.forceFullCompositionPipeline ''
-                  Option         "metamodes" "nvidia-auto-select +0+0 {ForceFullCompositionPipeline=On}"
-                  Option         "AllowIndirectGLXProtocol" "off"
-                  Option         "TripleBuffer" "on"
-                '';
-            };
+        {
+          assertion = offloadCfg.enable -> lib.versionAtLeast nvidia_x11.version "435.21";
+          message = "NVIDIA PRIME render offload is currently only supported on versions >= 435.21.";
+        }
 
-          services.xserver.serverLayoutSection =
-            lib.optionalString syncCfg.enable ''
-              Inactive "Device-${igpuDriver}[0]"
-            ''
-            + lib.optionalString reverseSyncCfg.enable ''
-              Inactive "Device-nvidia[0]"
-            ''
-            + lib.optionalString offloadCfg.enable ''
-              Option "AllowNVIDIAGPUScreens"
-            '';
+        {
+          assertion = (reverseSyncCfg.enable && pCfg.amdgpuBusId != "") -> lib.versionAtLeast nvidia_x11.version "470.0";
+          message = "NVIDIA PRIME render offload for AMD APUs is currently only supported on versions >= 470 beta.";
+        }
 
-          services.xserver.displayManager.setupCommands =
-            let
-              gpuProviderName =
-                if igpuDriver == "amdgpu" then
-                  # find the name of the provider if amdgpu
-                  "`${lib.getExe pkgs.xorg.xrandr} --listproviders | ${lib.getExe pkgs.gnugrep} -i AMD | ${lib.getExe pkgs.gnused} -n 's/^.*name://p'`"
-                else
-                  igpuDriver;
-              providerCmdParams =
-                if syncCfg.enable then "\"${gpuProviderName}\" NVIDIA-0" else "NVIDIA-G0 \"${gpuProviderName}\"";
-            in
-            lib.optionalString (syncCfg.enable || reverseSyncCfg.enable) ''
-              # Added by nvidia configuration module for Optimus/PRIME.
-              ${lib.getExe pkgs.xorg.xrandr} --setprovideroutputsource ${providerCmdParams}
-              ${lib.getExe pkgs.xorg.xrandr} --auto
-            '';
+        {
+          assertion = !(syncCfg.enable && offloadCfg.enable);
+          message = "PRIME Sync and Offload cannot be both enabled";
+        }
 
-          environment.etc = {
-            "nvidia/nvidia-application-profiles-rc" = lib.mkIf nvidia_x11.useProfiles {
-              source = "${nvidia_x11.bin}/share/nvidia/nvidia-application-profiles-rc";
-            };
+        {
+          assertion = !(syncCfg.enable && reverseSyncCfg.enable);
+          message = "PRIME Sync and PRIME Reverse Sync cannot be both enabled";
+        }
 
-            # 'nvidia_x11' installs it's files to /run/opengl-driver/...
-            "egl/egl_external_platform.d".source = "/run/opengl-driver/share/egl/egl_external_platform.d/";
-          };
+        {
+          assertion = !(syncCfg.enable && cfg.powerManagement.finegrained);
+          message = "Sync precludes powering down the NVIDIA GPU.";
+        }
 
-          hardware.opengl = {
-            extraPackages = [ pkgs.nvidia-vaapi-driver ];
-            extraPackages32 = [ pkgs.pkgsi686Linux.nvidia-vaapi-driver ];
-          };
-          environment.systemPackages =
-            lib.optional cfg.nvidiaSettings nvidia_x11.settings
-            ++ lib.optional cfg.nvidiaPersistenced nvidia_x11.persistenced
-            ++ lib.optional offloadCfg.enableOffloadCmd (
-              pkgs.writeShellScriptBin "nvidia-offload" ''
-                export __NV_PRIME_RENDER_OFFLOAD=1
-                export __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0
-                export __GLX_VENDOR_LIBRARY_NAME=nvidia
-                export __VK_LAYER_NV_optimus=NVIDIA_only
-                exec "$@"
+        {
+          assertion = cfg.powerManagement.finegrained -> offloadCfg.enable;
+          message = "Fine-grained power management requires offload to be enabled.";
+        }
+
+        {
+          assertion = cfg.powerManagement.enable -> lib.versionAtLeast nvidia_x11.version "430.09";
+          message = "Required files for driver based power management only exist on versions >= 430.09.";
+        }
+
+        {
+          assertion = cfg.open -> (cfg.package ? open && cfg.package ? firmware);
+          message = "This version of NVIDIA driver does not provide a corresponding opensource kernel driver";
+        }
+
+        {
+          assertion = cfg.dynamicBoost.enable -> lib.versionAtLeast nvidia_x11.version "510.39.01";
+          message = "NVIDIA's Dynamic Boost feature only exists on versions >= 510.39.01";
+        }];
+
+        # If Optimus/PRIME is enabled, we:
+        # - Specify the configured NVIDIA GPU bus ID in the Device section for the
+        #   "nvidia" driver.
+        # - Add the AllowEmptyInitialConfiguration option to the Screen section for the
+        #   "nvidia" driver, in order to allow the X server to start without any outputs.
+        # - Add a separate Device section for the Intel GPU, using the "modesetting"
+        #   driver and with the configured BusID.
+        # - OR add a separate Device section for the AMD APU, using the "amdgpu"
+        #   driver and with the configures BusID.
+        # - Reference that Device section from the ServerLayout section as an inactive
+        #   device.
+        # - Configure the display manager to run specific `xrandr` commands which will
+        #   configure/enable displays connected to the Intel iGPU / AMD APU.
+
+        # reverse sync implies offloading
+        hardware.nvidia.prime.offload.enable = lib.mkDefault reverseSyncCfg.enable;
+
+        services.xserver.drivers =
+          lib.optional primeEnabled {
+            name = igpuDriver;
+            display = offloadCfg.enable;
+            modules = lib.optional (igpuDriver == "amdgpu") pkgs.xorg.xf86videoamdgpu;
+            deviceSection =
               ''
-            );
+                BusID "${igpuBusId}"
+              ''
+              + lib.optionalString (syncCfg.enable && igpuDriver != "amdgpu") ''
+                Option "AccelMethod" "none"
+              '';
+          }
+          ++ lib.singleton {
+            name = "nvidia";
+            modules = [nvidia_x11.bin];
+            display = !offloadCfg.enable;
+            deviceSection =
+              ''
+                Option "SidebandSocketPath" "/run/nvidia-xdriver/"
+              '' +
+              lib.optionalString primeEnabled
+              ''
+                BusID "${pCfg.nvidiaBusId}"
+              ''
+              + lib.optionalString pCfg.allowExternalGpu ''
+                Option "AllowExternalGpus"
+              '';
+            screenSection =
+              ''
+                Option "RandRRotation" "on"
+              ''
+              + lib.optionalString syncCfg.enable ''
+                Option "AllowEmptyInitialConfiguration"
+              ''
+              + lib.optionalString cfg.forceFullCompositionPipeline ''
+                Option         "metamodes" "nvidia-auto-select +0+0 {ForceFullCompositionPipeline=On}"
+                Option         "AllowIndirectGLXProtocol" "off"
+                Option         "TripleBuffer" "on"
+              '';
+          };
 
-          systemd.packages = lib.optional cfg.powerManagement.enable nvidia_x11.out;
+        services.xserver.serverLayoutSection =
+          lib.optionalString syncCfg.enable ''
+            Inactive "Device-${igpuDriver}[0]"
+          ''
+          + lib.optionalString reverseSyncCfg.enable ''
+            Inactive "Device-nvidia[0]"
+          ''
+          + lib.optionalString offloadCfg.enable ''
+            Option "AllowNVIDIAGPUScreens"
+          '';
 
-          systemd.services =
-            let
-              nvidiaService = state: {
-                description = "NVIDIA system ${state} actions";
-                path = [ pkgs.kbd ];
+        services.xserver.displayManager.setupCommands = let
+          gpuProviderName =
+            if igpuDriver == "amdgpu"
+            then
+              # find the name of the provider if amdgpu
+              "`${lib.getExe pkgs.xorg.xrandr} --listproviders | ${lib.getExe pkgs.gnugrep} -i AMD | ${lib.getExe pkgs.gnused} -n 's/^.*name://p'`"
+            else igpuDriver;
+          providerCmdParams =
+            if syncCfg.enable
+            then "\"${gpuProviderName}\" NVIDIA-0"
+            else "NVIDIA-G0 \"${gpuProviderName}\"";
+        in
+          lib.optionalString (syncCfg.enable || reverseSyncCfg.enable) ''
+            # Added by nvidia configuration module for Optimus/PRIME.
+            ${lib.getExe pkgs.xorg.xrandr} --setprovideroutputsource ${providerCmdParams}
+            ${lib.getExe pkgs.xorg.xrandr} --auto
+          '';
+
+        environment.etc = {
+          "nvidia/nvidia-application-profiles-rc" = lib.mkIf nvidia_x11.useProfiles {source = "${nvidia_x11.bin}/share/nvidia/nvidia-application-profiles-rc";};
+
+          # 'nvidia_x11' installs it's files to /run/opengl-driver/...
+          "egl/egl_external_platform.d".source = "/run/opengl-driver/share/egl/egl_external_platform.d/";
+        };
+
+        hardware.opengl = {
+          extraPackages = [
+            pkgs.nvidia-vaapi-driver
+          ];
+          extraPackages32 = [
+            pkgs.pkgsi686Linux.nvidia-vaapi-driver
+          ];
+        };
+        environment.systemPackages =
+          lib.optional cfg.nvidiaSettings nvidia_x11.settings
+          ++ lib.optional cfg.nvidiaPersistenced nvidia_x11.persistenced
+          ++ lib.optional offloadCfg.enableOffloadCmd
+          (pkgs.writeShellScriptBin "nvidia-offload" ''
+            export __NV_PRIME_RENDER_OFFLOAD=1
+            export __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0
+            export __GLX_VENDOR_LIBRARY_NAME=nvidia
+            export __VK_LAYER_NV_optimus=NVIDIA_only
+            exec "$@"
+          '');
+
+        systemd.packages = lib.optional cfg.powerManagement.enable nvidia_x11.out;
+
+        systemd.services = let
+          nvidiaService = state: {
+            description = "NVIDIA system ${state} actions";
+            path = [pkgs.kbd];
+            serviceConfig = {
+              Type = "oneshot";
+              ExecStart = "${nvidia_x11.out}/bin/nvidia-sleep.sh '${state}'";
+            };
+            before = ["systemd-${state}.service"];
+            requiredBy = ["systemd-${state}.service"];
+          };
+        in
+          lib.mkMerge [
+            (lib.mkIf cfg.powerManagement.enable {
+              nvidia-suspend = nvidiaService "suspend";
+              nvidia-hibernate = nvidiaService "hibernate";
+              nvidia-resume =
+                (nvidiaService "resume")
+                // {
+                  before = [];
+                  after = ["systemd-suspend.service" "systemd-hibernate.service"];
+                  requiredBy = ["systemd-suspend.service" "systemd-hibernate.service"];
+                };
+            })
+            (lib.mkIf cfg.nvidiaPersistenced {
+              "nvidia-persistenced" = {
+                description = "NVIDIA Persistence Daemon";
+                wantedBy = ["multi-user.target"];
                 serviceConfig = {
-                  Type = "oneshot";
-                  ExecStart = "${nvidia_x11.out}/bin/nvidia-sleep.sh '${state}'";
+                  Type = "forking";
+                  Restart = "always";
+                  PIDFile = "/var/run/nvidia-persistenced/nvidia-persistenced.pid";
+                  ExecStart = "${lib.getExe nvidia_x11.persistenced} --verbose";
+                  ExecStopPost = "${pkgs.coreutils}/bin/rm -rf /var/run/nvidia-persistenced";
                 };
-                before = [ "systemd-${state}.service" ];
-                requiredBy = [ "systemd-${state}.service" ];
               };
-            in
-            lib.mkMerge [
-              (lib.mkIf cfg.powerManagement.enable {
-                nvidia-suspend = nvidiaService "suspend";
-                nvidia-hibernate = nvidiaService "hibernate";
-                nvidia-resume = (nvidiaService "resume") // {
-                  before = [ ];
-                  after = [
-                    "systemd-suspend.service"
-                    "systemd-hibernate.service"
-                  ];
-                  requiredBy = [
-                    "systemd-suspend.service"
-                    "systemd-hibernate.service"
-                  ];
+            })
+            (lib.mkIf cfg.dynamicBoost.enable {
+              "nvidia-powerd" = {
+                description = "nvidia-powerd service";
+                path = [
+                  pkgs.util-linux # nvidia-powerd wants lscpu
+                ];
+                wantedBy = ["multi-user.target"];
+                serviceConfig = {
+                  Type = "dbus";
+                  BusName = "nvidia.powerd.server";
+                  ExecStart = "${nvidia_x11.bin}/bin/nvidia-powerd";
                 };
-              })
-              (lib.mkIf cfg.nvidiaPersistenced {
-                "nvidia-persistenced" = {
-                  description = "NVIDIA Persistence Daemon";
-                  wantedBy = [ "multi-user.target" ];
-                  serviceConfig = {
-                    Type = "forking";
-                    Restart = "always";
-                    PIDFile = "/var/run/nvidia-persistenced/nvidia-persistenced.pid";
-                    ExecStart = "${lib.getExe nvidia_x11.persistenced} --verbose";
-                    ExecStopPost = "${pkgs.coreutils}/bin/rm -rf /var/run/nvidia-persistenced";
-                  };
-                };
-              })
-              (lib.mkIf cfg.dynamicBoost.enable {
-                "nvidia-powerd" = {
-                  description = "nvidia-powerd service";
-                  path = [
-                    pkgs.util-linux # nvidia-powerd wants lscpu
-                  ];
-                  wantedBy = [ "multi-user.target" ];
-                  serviceConfig = {
-                    Type = "dbus";
-                    BusName = "nvidia.powerd.server";
-                    ExecStart = "${nvidia_x11.bin}/bin/nvidia-powerd";
-                  };
-                };
-              })
-            ];
-          services.acpid.enable = true;
+              };
+            })
+          ];
+        services.acpid.enable = true;
 
-          services.dbus.packages = lib.optional cfg.dynamicBoost.enable nvidia_x11.bin;
+        services.dbus.packages = lib.optional cfg.dynamicBoost.enable nvidia_x11.bin;
 
-          hardware.firmware =
-            let
-              isOpen = cfg.open;
-              isNewUnfree = lib.versionAtLeast nvidia_x11.version "555";
-            in
-            lib.optional (isOpen || isNewUnfree) nvidia_x11.firmware;
+        hardware.firmware = lib.optional cfg.open nvidia_x11.firmware;
 
-          systemd.tmpfiles.rules =
-            [
-              # Remove the following log message:
-              #    (WW) NVIDIA: Failed to bind sideband socket to
-              #    (WW) NVIDIA:     '/var/run/nvidia-xdriver-b4f69129' Permission denied
-              #
-              # https://bbs.archlinux.org/viewtopic.php?pid=1909115#p1909115
-              "d /run/nvidia-xdriver 0770 root users"
-            ]
-            ++ lib.optional (nvidia_x11.persistenced != null && config.virtualisation.docker.enableNvidia)
-              "L+ /run/nvidia-docker/extras/bin/nvidia-persistenced - - - - ${nvidia_x11.persistenced}/origBin/nvidia-persistenced";
+        systemd.tmpfiles.rules = [
+          # Remove the following log message:
+          #    (WW) NVIDIA: Failed to bind sideband socket to
+          #    (WW) NVIDIA:     '/var/run/nvidia-xdriver-b4f69129' Permission denied
+          #
+          # https://bbs.archlinux.org/viewtopic.php?pid=1909115#p1909115
+          "d /run/nvidia-xdriver 0770 root users"
+        ] ++ lib.optional (nvidia_x11.persistenced != null && config.virtualisation.docker.enableNvidia)
+          "L+ /run/nvidia-docker/extras/bin/nvidia-persistenced - - - - ${nvidia_x11.persistenced}/origBin/nvidia-persistenced";
 
-          boot = {
-            extraModulePackages = if cfg.open then [ nvidia_x11.open ] else [ nvidia_x11.bin ];
-            # nvidia-uvm is required by CUDA applications.
-            kernelModules = lib.optionals config.services.xserver.enable [
-              "nvidia"
-              "nvidia_modeset"
-              "nvidia_drm"
-            ];
+        boot = {
+          extraModulePackages =
+            if cfg.open
+            then [nvidia_x11.open]
+            else [nvidia_x11.bin];
+          # nvidia-uvm is required by CUDA applications.
+          kernelModules =
+            lib.optionals config.services.xserver.enable ["nvidia" "nvidia_modeset" "nvidia_drm"];
 
-            # If requested enable modesetting via kernel parameter.
-            kernelParams =
-              lib.optional (offloadCfg.enable || cfg.modesetting.enable) "nvidia-drm.modeset=1"
-              ++ lib.optional cfg.powerManagement.enable "nvidia.NVreg_PreserveVideoMemoryAllocations=1"
-              ++ lib.optional cfg.open "nvidia.NVreg_OpenRmEnableUnsupportedGpus=1"
-              ++ lib.optional (config.boot.kernelPackages.kernel.kernelAtLeast "6.2" && !ibtSupport) "ibt=off";
+          # If requested enable modesetting via kernel parameter.
+          kernelParams =
+            lib.optional (offloadCfg.enable || cfg.modesetting.enable) "nvidia-drm.modeset=1"
+            ++ lib.optional cfg.powerManagement.enable "nvidia.NVreg_PreserveVideoMemoryAllocations=1"
+            ++ lib.optional cfg.open "nvidia.NVreg_OpenRmEnableUnsupportedGpus=1"
+            ++ lib.optional (config.boot.kernelPackages.kernel.kernelAtLeast "6.2" && !ibtSupport) "ibt=off";
 
-            # enable finegrained power management
-            extraModprobeConfig = lib.optionalString cfg.powerManagement.finegrained ''
-              options nvidia "NVreg_DynamicPowerManagement=0x02"
-            '';
-          };
-          services.udev.extraRules = lib.optionalString cfg.powerManagement.finegrained (
-            lib.optionalString (lib.versionOlder config.boot.kernelPackages.kernel.version "5.5") ''
-              # Remove NVIDIA USB xHCI Host Controller devices, if present
-              ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x0c0330", ATTR{remove}="1"
+          # enable finegrained power management
+          extraModprobeConfig = lib.optionalString cfg.powerManagement.finegrained ''
+            options nvidia "NVreg_DynamicPowerManagement=0x02"
+          '';
+        };
+        services.udev.extraRules =
+          lib.optionalString cfg.powerManagement.finegrained (
+          lib.optionalString (lib.versionOlder config.boot.kernelPackages.kernel.version "5.5") ''
+            # Remove NVIDIA USB xHCI Host Controller devices, if present
+            ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x0c0330", ATTR{remove}="1"
 
-              # Remove NVIDIA USB Type-C UCSI devices, if present
-              ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x0c8000", ATTR{remove}="1"
+            # Remove NVIDIA USB Type-C UCSI devices, if present
+            ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x0c8000", ATTR{remove}="1"
 
-              # Remove NVIDIA Audio devices, if present
-              ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x040300", ATTR{remove}="1"
-            ''
-            + ''
-              # Enable runtime PM for NVIDIA VGA/3D controller devices on driver bind
-              ACTION=="bind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030000", TEST=="power/control", ATTR{power/control}="auto"
-              ACTION=="bind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030200", TEST=="power/control", ATTR{power/control}="auto"
+            # Remove NVIDIA Audio devices, if present
+            ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x040300", ATTR{remove}="1"
+          ''
+          + ''
+            # Enable runtime PM for NVIDIA VGA/3D controller devices on driver bind
+            ACTION=="bind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030000", TEST=="power/control", ATTR{power/control}="auto"
+            ACTION=="bind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030200", TEST=="power/control", ATTR{power/control}="auto"
 
-              # Disable runtime PM for NVIDIA VGA/3D controller devices on driver unbind
-              ACTION=="unbind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030000", TEST=="power/control", ATTR{power/control}="on"
-              ACTION=="unbind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030200", TEST=="power/control", ATTR{power/control}="on"
-            ''
-          );
-        })
-        # Data Center
-        (lib.mkIf (cfg.datacenter.enable) {
-          boot.extraModulePackages = [ nvidia_x11.bin ];
+            # Disable runtime PM for NVIDIA VGA/3D controller devices on driver unbind
+            ACTION=="unbind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030000", TEST=="power/control", ATTR{power/control}="on"
+            ACTION=="unbind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030200", TEST=="power/control", ATTR{power/control}="on"
+          ''
+        );
+      })
+      # Data Center
+      (lib.mkIf (cfg.datacenter.enable) {
+        boot.extraModulePackages = [
+          nvidia_x11.bin
+        ];
 
-          systemd = {
-            tmpfiles.rules =
-              lib.optional (nvidia_x11.persistenced != null && config.virtualisation.docker.enableNvidia)
-                "L+ /run/nvidia-docker/extras/bin/nvidia-persistenced - - - - ${nvidia_x11.persistenced}/origBin/nvidia-persistenced";
+        systemd = {
+          tmpfiles.rules =
+            lib.optional (nvidia_x11.persistenced != null && config.virtualisation.docker.enableNvidia)
+            "L+ /run/nvidia-docker/extras/bin/nvidia-persistenced - - - - ${nvidia_x11.persistenced}/origBin/nvidia-persistenced";
 
-            services = lib.mkMerge [
-              ({
-                nvidia-fabricmanager = {
-                  enable = true;
-                  description = "Start NVIDIA NVLink Management";
-                  wantedBy = [ "multi-user.target" ];
-                  unitConfig.After = [ "network-online.target" ];
-                  unitConfig.Requires = [ "network-online.target" ];
-                  serviceConfig = {
-                    Type = "forking";
-                    TimeoutStartSec = 240;
-                    ExecStart =
-                      let
-                        nv-fab-conf = settingsFormat.generate "fabricmanager.conf" cfg.datacenter.settings;
-                      in
+          services = lib.mkMerge [
+            ({
+              nvidia-fabricmanager = {
+                enable = true;
+                description = "Start NVIDIA NVLink Management";
+                wantedBy = [ "multi-user.target" ];
+                unitConfig.After = [ "network-online.target" ];
+                unitConfig.Requires = [ "network-online.target" ];
+                serviceConfig = {
+                  Type = "forking";
+                  TimeoutStartSec = 240;
+                  ExecStart = let
+                    nv-fab-conf = settingsFormat.generate "fabricmanager.conf" cfg.datacenter.settings;
+                    in
                       "${lib.getExe nvidia_x11.fabricmanager} -c ${nv-fab-conf}";
-                    LimitCORE = "infinity";
-                  };
+                  LimitCORE="infinity";
                 };
-              })
-              (lib.mkIf cfg.nvidiaPersistenced {
-                "nvidia-persistenced" = {
-                  description = "NVIDIA Persistence Daemon";
-                  wantedBy = [ "multi-user.target" ];
-                  serviceConfig = {
-                    Type = "forking";
-                    Restart = "always";
-                    PIDFile = "/var/run/nvidia-persistenced/nvidia-persistenced.pid";
-                    ExecStart = "${lib.getExe nvidia_x11.persistenced} --verbose";
-                    ExecStopPost = "${pkgs.coreutils}/bin/rm -rf /var/run/nvidia-persistenced";
-                  };
+              };
+            })
+            (lib.mkIf cfg.nvidiaPersistenced {
+              "nvidia-persistenced" = {
+                description = "NVIDIA Persistence Daemon";
+                wantedBy = ["multi-user.target"];
+                serviceConfig = {
+                  Type = "forking";
+                  Restart = "always";
+                  PIDFile = "/var/run/nvidia-persistenced/nvidia-persistenced.pid";
+                  ExecStart = "${lib.getExe nvidia_x11.persistenced} --verbose";
+                  ExecStopPost = "${pkgs.coreutils}/bin/rm -rf /var/run/nvidia-persistenced";
                 };
-              })
-            ];
-          };
+              };
+            })
+          ];
+      };
 
-          environment.systemPackages =
-            lib.optional cfg.datacenter.enable nvidia_x11.fabricmanager
-            ++ lib.optional cfg.nvidiaPersistenced nvidia_x11.persistenced;
-        })
-      ]
-    );
+      environment.systemPackages =
+        lib.optional cfg.datacenter.enable nvidia_x11.fabricmanager
+        ++ lib.optional cfg.nvidiaPersistenced nvidia_x11.persistenced;
+    })
+  ]);
 }

nixos/modules/misc/version.nix

@@ -31,6 +31,7 @@ let
       HOME_URL = optionalString isNixos "https://nixos.org/";
       DOCUMENTATION_URL = optionalString isNixos "https://nixos.org/learn.html";
       SUPPORT_URL = optionalString isNixos "https://nixos.org/community.html";
+      SUPPORT_END = "2024-12-31";
       BUG_REPORT_URL = optionalString isNixos "https://github.com/NixOS/nixpkgs/issues";
       ANSI_COLOR = optionalString isNixos "1;34";
       IMAGE_ID = optionalString (config.system.image.id != null) config.system.image.id;

nixos/modules/module-list.nix

@@ -249,6 +249,7 @@
   ./programs/oblogout.nix
   ./programs/oddjobd.nix
   ./programs/openvpn3.nix
+  ./programs/pantheon-tweaks.nix
   ./programs/partition-manager.nix
   ./programs/plotinus.nix
   ./programs/pqos-wrapper.nix
@@ -1108,7 +1109,6 @@
   ./services/networking/ocserv.nix
   ./services/networking/ofono.nix
   ./services/networking/oidentd.nix
-  ./services/networking/oink.nix
   ./services/networking/onedrive.nix
   ./services/networking/openconnect.nix
   ./services/networking/openvpn.nix
@@ -1399,7 +1399,6 @@
   ./services/web-apps/netbox.nix
   ./services/web-apps/nextcloud.nix
   ./services/web-apps/nextcloud-notify_push.nix
-  ./services/web-apps/nextjs-ollama-llm-ui.nix
   ./services/web-apps/nexus.nix
   ./services/web-apps/nifi.nix
   ./services/web-apps/node-red.nix

nixos/modules/programs/pantheon-tweaks.nix

@@ -0,0 +1,17 @@
+{ config, lib, pkgs, ... }:
+
+{
+  meta = {
+    maintainers = lib.teams.pantheon.members;
+  };
+
+  ###### interface
+  options = {
+    programs.pantheon-tweaks.enable = lib.mkEnableOption "Pantheon Tweaks, an unofficial system settings panel for Pantheon";
+  };
+
+  ###### implementation
+  config = lib.mkIf config.programs.pantheon-tweaks.enable {
+    services.xserver.desktopManager.pantheon.extraSwitchboardPlugs = [ pkgs.pantheon-tweaks ];
+  };
+}

nixos/modules/programs/steam.nix

@@ -4,8 +4,6 @@ let
   cfg = config.programs.steam;
   gamescopeCfg = config.programs.gamescope;
 
-  extraCompatPaths = lib.makeSearchPathOutput "steamcompattool" "" cfg.extraCompatPackages;
-
   steam-gamescope = let
     exports = builtins.attrValues (builtins.mapAttrs (n: v: "export ${n}=${v}") cfg.gamescopeSession.env);
   in
@@ -44,7 +42,7 @@ in {
       '';
       apply = steam: steam.override (prev: {
         extraEnv = (lib.optionalAttrs (cfg.extraCompatPackages != [ ]) {
-          STEAM_EXTRA_COMPAT_TOOLS_PATHS = extraCompatPaths;
+          STEAM_EXTRA_COMPAT_TOOLS_PATHS = lib.makeSearchPathOutput "steamcompattool" "" cfg.extraCompatPackages;
         }) // (lib.optionalAttrs cfg.extest.enable {
           LD_PRELOAD = "${pkgs.pkgsi686Linux.extest}/lib/libextest.so";
         }) // (prev.extraEnv or {});
@@ -55,7 +53,6 @@ in {
             then [ package ] ++ extraPackages
             else [ package32 ] ++ extraPackages32;
         in prevLibs ++ additionalLibs;
-        extraPkgs = p: (cfg.extraPackages ++ lib.optionals (prev ? extraPkgs) (prev.extraPkgs p));
       } // lib.optionalAttrs (cfg.gamescopeSession.enable && gamescopeCfg.capSysNice)
       {
         buildFHSEnv = pkgs.buildFHSEnv.override {
@@ -72,19 +69,6 @@ in {
       '';
     };
 
-    extraPackages = lib.mkOption {
-      type = lib.types.listOf lib.types.package;
-      default = [ ];
-      example = lib.literalExpression ''
-        with pkgs; [
-          gamescope
-        ]
-      '';
-      description = ''
-        Additional packages to add to the Steam environment.
-      '';
-    };
-
     extraCompatPackages = lib.mkOption {
       type = lib.types.listOf lib.types.package;
       default = [ ];
@@ -102,18 +86,6 @@ in {
       '';
     };
 
-    fontPackages = lib.mkOption {
-      type = lib.types.listOf lib.types.package;
-      default = config.fonts.packages;
-      defaultText = lib.literalExpression "fonts.packages";
-      example = lib.literalExpression "with pkgs; [ source-han-sans ]";
-      description = ''
-        Font packages to use in Steam.
-
-        Defaults to system fonts, but could be overridden to use other fonts — useful for users who would like to customize CJK fonts used in Steam. According to the [upstream issue](https://github.com/ValveSoftware/steam-for-linux/issues/10422#issuecomment-1944396010), Steam only follows the per-user fontconfig configuration.
-      '';
-    };
-
     remotePlay.openFirewall = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -167,11 +139,6 @@ in {
       Load the extest library into Steam, to translate X11 input events to
       uinput events (e.g. for using Steam Input on Wayland)
     '';
-
-    protontricks = {
-      enable = lib.mkEnableOption "protontricks, a simple wrapper for running Winetricks commands for Proton-enabled games";
-      package = lib.mkPackageOption pkgs "protontricks" { };
-    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -191,8 +158,6 @@ in {
       };
     };
 
-    programs.steam.extraPackages = cfg.fontPackages;
-
     programs.gamescope.enable = lib.mkDefault cfg.gamescopeSession.enable;
     services.displayManager.sessionPackages = lib.mkIf cfg.gamescopeSession.enable [ gamescopeSessionFile ];
 
@@ -204,8 +169,7 @@ in {
     environment.systemPackages = [
       cfg.package
       cfg.package.run
-    ] ++ lib.optional cfg.gamescopeSession.enable steam-gamescope
-    ++ lib.optional cfg.protontricks.enable (cfg.protontricks.package.override { inherit extraCompatPaths; });
+    ] ++ lib.optional cfg.gamescopeSession.enable steam-gamescope;
 
     networking.firewall = lib.mkMerge [
       (lib.mkIf (cfg.remotePlay.openFirewall || cfg.localNetworkGameTransfers.openFirewall) {

nixos/modules/programs/wayland/hyprland.nix

@@ -1,41 +1,46 @@
-{ config, lib, pkgs, ... }:
-
+{ config
+, lib
+, pkgs
+, ...
+}:
 let
   cfg = config.programs.hyprland;
 
-  wayland-lib = import ./lib.nix { inherit lib; };
+  finalPortalPackage = cfg.portalPackage.override {
+    hyprland = cfg.finalPackage;
+  };
 in
 {
   options.programs.hyprland = {
-    enable = lib.mkEnableOption ''
-      Hyprland, the dynamic tiling Wayland compositor that doesn't sacrifice on its looks.
-      You can manually launch Hyprland by executing {command}`Hyprland` on a TTY.
-      A configuration file will be generated in {file}`~/.config/hypr/hyprland.conf`.
-      See <https://wiki.hyprland.org> for more information'';
+    enable = lib.mkEnableOption null // {
+      description = ''
+        Whether to enable Hyprland, the dynamic tiling Wayland compositor that doesn't sacrifice on its looks.
 
-    package = lib.mkPackageOption pkgs "hyprland" {
-      extraDescription = ''
-        If the package is not overridable with `enableXWayland`, then the module option
-        {option}`xwayland` will have no effect.
+        You can manually launch Hyprland by executing {command}`Hyprland` on a TTY.
+
+        A configuration file will be generated in {file}`~/.config/hypr/hyprland.conf`.
+        See <https://wiki.hyprland.org> for more information.
       '';
-    } // {
-      apply = p: wayland-lib.genFinalPackage p {
+    };
+
+    package = lib.mkPackageOption pkgs "hyprland" { };
+
+    finalPackage = lib.mkOption {
+      type = lib.types.package;
+      readOnly = true;
+      default = cfg.package.override {
         enableXWayland = cfg.xwayland.enable;
       };
-    };
-
-    portalPackage = lib.mkPackageOption pkgs "xdg-desktop-portal-hyprland" {
-      extraDescription = ''
-        If the package is not overridable with `hyprland`, then the Hyprland package
-        used by the portal may differ from the one set in the module option {option}`package`.
+      defaultText = lib.literalExpression
+        "`programs.hyprland.package` with applied configuration";
+      description = ''
+        The Hyprland package after applying configuration.
       '';
-    } // {
-      apply = p: wayland-lib.genFinalPackage p {
-        hyprland = cfg.package;
-      };
     };
 
-    xwayland.enable = lib.mkEnableOption "XWayland" // { default = true; };
+    portalPackage = lib.mkPackageOption pkgs "xdg-desktop-portal-hyprland" { };
+
+    xwayland.enable = lib.mkEnableOption ("XWayland") // { default = true; };
 
     systemd.setPath.enable = lib.mkEnableOption null // {
       default = true;
@@ -48,30 +53,33 @@ in
     };
   };
 
-  config = lib.mkIf cfg.enable (lib.mkMerge [
-    {
-      environment.systemPackages = [ cfg.package ];
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.finalPackage ];
 
-      # To make a Hyprland session available if a display manager like SDDM is enabled:
-      services.displayManager.sessionPackages = [ cfg.package ];
+    fonts.enableDefaultPackages = lib.mkDefault true;
+    hardware.opengl.enable = lib.mkDefault true;
 
-      xdg.portal = {
-        extraPortals = [ cfg.portalPackage ];
-        configPackages = lib.mkDefault [ cfg.package ];
-      };
+    programs = {
+      dconf.enable = lib.mkDefault true;
+      xwayland.enable = lib.mkDefault cfg.xwayland.enable;
+    };
 
-      systemd = lib.mkIf cfg.systemd.setPath.enable {
-        user.extraConfig = ''
-          DefaultEnvironment="PATH=$PATH:/run/current-system/sw/bin:/etc/profiles/per-user/%u/bin:/run/wrappers/bin"
-        '';
-      };
-    }
+    security.polkit.enable = true;
 
-    (import ./wayland-session.nix {
-      inherit lib pkgs;
-      xwayland = cfg.xwayland.enable;
-    })
-  ]);
+    services.displayManager.sessionPackages = [ cfg.finalPackage ];
+
+    xdg.portal = {
+      enable = lib.mkDefault true;
+      extraPortals = [ finalPortalPackage ];
+      configPackages = lib.mkDefault [ cfg.finalPackage ];
+    };
+
+    systemd = lib.mkIf cfg.systemd.setPath.enable {
+      user.extraConfig = ''
+        DefaultEnvironment="PATH=$PATH:/run/current-system/sw/bin:/etc/profiles/per-user/%u/bin:/run/wrappers/bin"
+      '';
+    };
+  };
 
   imports = [
     (lib.mkRemovedOptionModule

nixos/modules/programs/wayland/lib.nix

@@ -1,12 +0,0 @@
-{ lib }:
-
-{
-  genFinalPackage = pkg: args:
-    let
-      expectedArgs = with lib;
-        lib.naturalSort (lib.attrNames args);
-      existingArgs = with lib;
-        naturalSort (intersectLists expectedArgs (attrNames (functionArgs pkg.override)));
-    in
-      if existingArgs != expectedArgs then pkg else pkg.override args;
-}

nixos/modules/programs/wayland/river.nix

@@ -1,40 +1,37 @@
-{ config, lib, pkgs, ... }:
-
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   cfg = config.programs.river;
-
-  wayland-lib = import ./lib.nix { inherit lib; };
-in
-{
+in {
   options.programs.river = {
     enable = lib.mkEnableOption "river, a dynamic tiling Wayland compositor";
 
     package = lib.mkPackageOption pkgs "river" {
       nullable = true;
       extraDescription = ''
-        If the package is not overridable with `xwaylandSupport`, then the module option
-        {option}`xwayland` will have no effect.
-
         Set to `null` to not add any River package to your path.
         This should be done if you want to use the Home Manager River module to install River.
       '';
-    } // {
-      apply = p: if p == null then null else
-        wayland-lib.genFinalPackage p {
-          xwaylandSupport = cfg.xwayland.enable;
-        };
     };
 
-    xwayland.enable = lib.mkEnableOption "XWayland" // { default = true; };
-
     extraPackages = lib.mkOption {
       type = with lib.types; listOf package;
-      default = with pkgs; [ swaylock foot dmenu ];
+      default = with pkgs; [
+        swaylock
+        foot
+        dmenu
+      ];
       defaultText = lib.literalExpression ''
         with pkgs; [ swaylock foot dmenu ];
       '';
       example = lib.literalExpression ''
-        with pkgs; [ termite rofi light ]
+        with pkgs; [
+          termite rofi light
+        ]
       '';
       description = ''
         Extra packages to be installed system wide. See
@@ -44,22 +41,19 @@ in
     };
   };
 
-  config = lib.mkIf cfg.enable (lib.mkMerge [
-    {
-      environment.systemPackages = lib.optional (cfg.package != null) cfg.package ++ cfg.extraPackages;
+  config =
+    lib.mkIf cfg.enable (lib.mkMerge [
+      {
+        environment.systemPackages = lib.optional (cfg.package != null) cfg.package ++ cfg.extraPackages;
 
-      # To make a river session available if a display manager like SDDM is enabled:
-      services.displayManager.sessionPackages = lib.optional (cfg.package != null) cfg.package;
+        # To make a river session available if a display manager like SDDM is enabled:
+        services.displayManager.sessionPackages = lib.optionals (cfg.package != null) [ cfg.package ];
 
-      # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1050913
-      xdg.portal.config.river.default = lib.mkDefault [ "wlr" "gtk" ];
-    }
-
-    (import ./wayland-session.nix {
-      inherit lib pkgs;
-      xwayland = cfg.xwayland.enable;
-    })
-  ]);
+        # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1050913
+        xdg.portal.config.river.default = lib.mkDefault [ "wlr" "gtk" ];
+      }
+      (import ./wayland-session.nix { inherit lib pkgs; })
+    ]);
 
   meta.maintainers = with lib.maintainers; [ GaetanLepage ];
 }

nixos/modules/programs/wayland/sway.nix

@@ -1,11 +1,52 @@
-{ config, lib, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 let
   cfg = config.programs.sway;
 
-  wayland-lib = import ./lib.nix { inherit lib; };
-in
-{
+  wrapperOptions = lib.types.submodule {
+    options =
+      let
+        mkWrapperFeature  = default: description: lib.mkOption {
+          type = lib.types.bool;
+          inherit default;
+          example = !default;
+          description = "Whether to make use of the ${description}";
+        };
+      in {
+        base = mkWrapperFeature true ''
+          base wrapper to execute extra session commands and prepend a
+          dbus-run-session to the sway command.
+        '';
+        gtk = mkWrapperFeature false ''
+          wrapGAppsHook wrapper to execute sway with required environment
+          variables for GTK applications.
+        '';
+    };
+  };
+
+  genFinalPackage = pkg:
+    let
+      expectedArgs = lib.naturalSort [
+        "extraSessionCommands"
+        "extraOptions"
+        "withBaseWrapper"
+        "withGtkWrapper"
+        "isNixOS"
+      ];
+      existedArgs = with lib;
+        naturalSort
+        (intersectLists expectedArgs (attrNames (functionArgs pkg.override)));
+    in if existedArgs != expectedArgs then
+      pkg
+    else
+      pkg.override {
+        extraSessionCommands = cfg.extraSessionCommands;
+        extraOptions = cfg.extraOptions;
+        withBaseWrapper = cfg.wrapperFeatures.base;
+        withGtkWrapper = cfg.wrapperFeatures.gtk;
+        isNixOS = true;
+      };
+in {
   options.programs.sway = {
     enable = lib.mkEnableOption ''
       Sway, the i3-compatible tiling Wayland compositor. You can manually launch
@@ -14,36 +55,28 @@ in
       <https://github.com/swaywm/sway/wiki> and
       "man 5 sway" for more information'';
 
-    package = lib.mkPackageOption pkgs "sway" {
-      nullable = true;
-      extraDescription = ''
-        If the package is not overridable with `extraSessionCommands`, `extraOptions`,
-        `withBaseWrapper`, `withGtkWrapper`, `enableXWayland` and `isNixOS`,
-        then the module options {option}`wrapperFeatures`, {option}`extraSessionCommands`,
-        {option}`extraOptions` and {option}`xwayland` will have no effect.
-
-        Set to `null` to not add any Sway package to your path.
-        This should be done if you want to use the Home Manager Sway module to install Sway.
+    package = lib.mkOption {
+      type = with lib.types; nullOr package;
+      default = pkgs.sway;
+      apply = p: if p == null then null else genFinalPackage p;
+      defaultText = lib.literalExpression "pkgs.sway";
+      description = ''
+        Sway package to use. If the package does not contain the override arguments
+        `extraSessionCommands`, `extraOptions`, `withBaseWrapper`, `withGtkWrapper`,
+        `isNixOS`, then the module options {option}`wrapperFeatures`,
+        {option}`wrapperFeatures` and {option}`wrapperFeatures` will have no effect.
+        Set to `null` to not add any Sway package to your path. This should be done if
+        you want to use the Home Manager Sway module to install Sway.
       '';
-    } // {
-      apply = p: if p == null then null else
-        wayland-lib.genFinalPackage p {
-          extraSessionCommands = cfg.extraSessionCommands;
-          extraOptions = cfg.extraOptions;
-          withBaseWrapper = cfg.wrapperFeatures.base;
-          withGtkWrapper = cfg.wrapperFeatures.gtk;
-          enableXWayland = cfg.xwayland.enable;
-          isNixOS = true;
-        };
     };
 
-    wrapperFeatures = {
-      base = lib.mkEnableOption ''
-        the base wrapper to execute extra session commands and prepend a
-        dbus-run-session to the sway command'' // { default = true; };
-      gtk = lib.mkEnableOption ''
-        the wrapGAppsHook wrapper to execute sway with required environment
-        variables for GTK applications'';
+    wrapperFeatures = lib.mkOption {
+      type = wrapperOptions;
+      default = { };
+      example = { gtk = true; };
+      description = ''
+        Attribute set of features to enable in the wrapper.
+      '';
     };
 
     extraSessionCommands = lib.mkOption {
@@ -81,16 +114,19 @@ in
       '';
     };
 
-    xwayland.enable = lib.mkEnableOption "XWayland" // { default = true; };
-
     extraPackages = lib.mkOption {
       type = with lib.types; listOf package;
-      default = with pkgs; [ swaylock swayidle foot dmenu wmenu ];
+      default = with pkgs; [
+        swaylock swayidle foot dmenu wmenu
+      ];
       defaultText = lib.literalExpression ''
         with pkgs; [ swaylock swayidle foot dmenu wmenu ];
       '';
       example = lib.literalExpression ''
-        with pkgs; [ i3status i3status-rust termite rofi light ]
+        with pkgs; [
+          i3status i3status-rust
+          termite rofi light
+        ]
       '';
       description = ''
         Extra packages to be installed system wide. See
@@ -99,50 +135,46 @@ in
         for a list of useful software.
       '';
     };
+
   };
 
-  config = lib.mkIf cfg.enable (lib.mkMerge [
-    {
-      assertions = [
-        {
-          assertion = cfg.extraSessionCommands != "" -> cfg.wrapperFeatures.base;
-          message = ''
-            The extraSessionCommands for Sway will not be run if wrapperFeatures.base is disabled.
-          '';
-        }
-      ];
+  config = lib.mkIf cfg.enable
+    (lib.mkMerge [
+      {
+        assertions = [
+          {
+            assertion = cfg.extraSessionCommands != "" -> cfg.wrapperFeatures.base;
+            message = ''
+              The extraSessionCommands for Sway will not be run if
+              wrapperFeatures.base is disabled.
+            '';
+          }
+        ];
 
-      environment = {
-        systemPackages = lib.optional (cfg.package != null) cfg.package ++ cfg.extraPackages;
-
-        # Needed for the default wallpaper:
-        pathsToLink = lib.optional (cfg.package != null) "/share/backgrounds/sway";
-
-        etc = {
-          "sway/config.d/nixos.conf".source = pkgs.writeText "nixos.conf" ''
-            # Import the most important environment variables into the D-Bus and systemd
-            # user environments (e.g. required for screen sharing and Pinentry prompts):
-            exec dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY SWAYSOCK XDG_CURRENT_DESKTOP
-          '';
-        } // lib.optionalAttrs (cfg.package != null) {
-          "sway/config".source = lib.mkOptionDefault "${cfg.package}/etc/sway/config";
+        environment = {
+          systemPackages = lib.optional (cfg.package != null) cfg.package ++ cfg.extraPackages;
+          # Needed for the default wallpaper:
+          pathsToLink = lib.optionals (cfg.package != null) [ "/share/backgrounds/sway" ];
+          etc = {
+            "sway/config.d/nixos.conf".source = pkgs.writeText "nixos.conf" ''
+              # Import the most important environment variables into the D-Bus and systemd
+              # user environments (e.g. required for screen sharing and Pinentry prompts):
+              exec dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY SWAYSOCK XDG_CURRENT_DESKTOP
+            '';
+          } // lib.optionalAttrs (cfg.package != null) {
+            "sway/config".source = lib.mkOptionDefault "${cfg.package}/etc/sway/config";
+          };
         };
-      };
 
-      programs.gnupg.agent.pinentryPackage = lib.mkDefault pkgs.pinentry-gnome3;
+        programs.gnupg.agent.pinentryPackage = lib.mkDefault pkgs.pinentry-gnome3;
 
-      # To make a Sway session available if a display manager like SDDM is enabled:
-      services.displayManager.sessionPackages = lib.optional (cfg.package != null) cfg.package;
+        # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1050913
+        xdg.portal.config.sway.default = lib.mkDefault [ "wlr" "gtk" ];
 
-      # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1050913
-      xdg.portal.config.sway.default = lib.mkDefault [ "wlr" "gtk" ];
-    }
-
-    (import ./wayland-session.nix {
-      inherit lib pkgs;
-      xwayland = cfg.xwayland.enable;
-    })
-  ]);
+        # To make a Sway session available if a display manager like SDDM is enabled:
+        services.displayManager.sessionPackages = lib.optionals (cfg.package != null) [ cfg.package ]; }
+      (import ./wayland-session.nix { inherit lib pkgs; })
+    ]);
 
   meta.maintainers = with lib.maintainers; [ primeos colemickens ];
 }

nixos/modules/programs/wayland/wayland-session.nix

@@ -1,18 +1,23 @@
-{ lib, pkgs, xwayland ? true }:
+{ lib, pkgs, ... }: {
+    security = {
+      polkit.enable = true;
+      pam.services.swaylock = {};
+    };
 
-{
-  security = {
-    polkit.enable = true;
-    pam.services.swaylock = {};
-  };
+    hardware.opengl.enable = lib.mkDefault true;
+    fonts.enableDefaultPackages = lib.mkDefault true;
 
-  hardware.opengl.enable = lib.mkDefault true;
-  fonts.enableDefaultPackages = lib.mkDefault true;
+    programs = {
+      dconf.enable = lib.mkDefault true;
+      xwayland.enable = lib.mkDefault true;
+    };
 
-  programs = {
-    dconf.enable = lib.mkDefault true;
-    xwayland.enable = lib.mkDefault xwayland;
-  };
+    xdg.portal = {
+      enable = lib.mkDefault true;
 
-  xdg.portal.wlr.enable = lib.mkDefault true;
+      extraPortals = [
+        # For screen sharing
+        pkgs.xdg-desktop-portal-wlr
+      ];
+    };
 }

nixos/modules/rename.nix

@@ -40,16 +40,12 @@ in
     (mkRemovedOptionModule [ "networking" "vpnc" ] "Use environment.etc.\"vpnc/service.conf\" instead.")
     (mkRemovedOptionModule [ "networking" "wicd" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "programs" "gnome-documents" ] "The corresponding package was removed from nixpkgs.")
-    (mkRemovedOptionModule [ "programs" "pantheon-tweaks" ] ''
-      pantheon-tweaks is no longer a switchboard plugin but an independent app,
-      adding the package to environment.systemPackages is sufficient.
-    '')
     (mkRemovedOptionModule [ "programs" "tilp2" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "programs" "way-cooler" ] ("way-cooler is abandoned by its author: " +
       "https://way-cooler.org/blog/2020/01/09/way-cooler-post-mortem.html"))
     (mkRemovedOptionModule [ "security" "hideProcessInformation" ] ''
-      The hidepid module was removed, since the underlying machinery
-      is broken when using cgroups-v2.
+        The hidepid module was removed, since the underlying machinery
+        is broken when using cgroups-v2.
     '')
     (mkRemovedOptionModule [ "services" "baget" "enable" ] "The baget module was removed due to the upstream package being unmaintained.")
     (mkRemovedOptionModule [ "services" "beegfs" ] "The BeeGFS module has been removed")

nixos/modules/services/backup/borgbackup.nix

@@ -361,7 +361,7 @@ in {
             type = types.bool;
             example = true;
             description = ''
-              Set the `Persistent` option for the
+              Set the `persistentTimer` option for the
               {manpage}`systemd.timer(5)`
               which triggers the backup immediately if the last trigger
               was missed (e.g. if the system was powered down).

nixos/modules/services/continuous-integration/hydra/default.nix

@@ -335,7 +335,7 @@ in
           mkdir -m 0700 -p ${baseDir}/queue-runner
           mkdir -m 0750 -p ${baseDir}/build-logs
           mkdir -m 0750 -p ${baseDir}/runcommand-logs
-          chown hydra-queue-runner:hydra \
+          chown hydra-queue-runner.hydra \
             ${baseDir}/queue-runner \
             ${baseDir}/build-logs \
             ${baseDir}/runcommand-logs

nixos/modules/services/desktop-managers/lomiri.nix

@@ -38,7 +38,6 @@ in {
       ]);
     };
 
-    hardware.pulseaudio.enable = lib.mkDefault true;
     networking.networkmanager.enable = lib.mkDefault true;
 
     systemd.packages = with pkgs.lomiri; [
@@ -72,12 +71,9 @@ in {
       enable = true;
       packages = (with pkgs; [
         ayatana-indicator-datetime
-        ayatana-indicator-display
         ayatana-indicator-messages
         ayatana-indicator-power
         ayatana-indicator-session
-      ] ++ lib.optionals (config.hardware.pulseaudio.enable || config.services.pipewire.pulse.enable) [
-        ayatana-indicator-sound
       ]) ++ (with pkgs.lomiri; [
         telephony-service
       ] ++ lib.optionals config.networking.networkmanager.enable [

nixos/modules/services/games/archisteamfarm.nix

@@ -164,11 +164,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    services.archisteamfarm = {
-      # TODO: drop with 24.11
-      dataDir = lib.mkIf (lib.versionAtLeast config.system.stateVersion "24.05") (lib.mkDefault "/var/lib/asf");
-      settings.IPC = lib.mkIf (!cfg.web-ui.enable) false;
-    };
+    # TODO: drop with 24.11
+    services.archisteamfarm.dataDir = lib.mkIf (lib.versionAtLeast config.system.stateVersion "24.05") (lib.mkDefault "/var/lib/asf");
 
     users = {
       users.archisteamfarm = {

nixos/modules/services/hardware/kanata.nix

@@ -7,7 +7,7 @@ let
 
   upstreamDoc = "See [the upstream documentation](https://github.com/jtroo/kanata/blob/main/docs/config.adoc) and [example config files](https://github.com/jtroo/kanata/tree/main/cfg_samples) for more information.";
 
-  keyboard = { name, config, ... }: {
+  keyboard = {
     options = {
       devices = mkOption {
         type = types.listOf types.str;
@@ -48,21 +48,6 @@ let
           ${upstreamDoc}
         '';
       };
-      configFile = mkOption {
-        type = types.path;
-        default = mkConfig name config;
-        defaultText =
-          "A config file generated by values from other kanata module options.";
-        description = ''
-          The config file.
-
-          By default, it is generated by values from other kanata
-          module options.
-
-          You can also set it to your own full config file which
-          overrides all other kanata module options.  ${upstreamDoc}
-        '';
-      };
       extraArgs = mkOption {
         type = types.listOf types.str;
         default = [ ];
@@ -100,10 +85,6 @@ let
 
       ${keyboard.config}
     '';
-    # Only the config file generated by this module is checked.  A
-    # user-provided one is not checked because it may not be available
-    # at build time.  I think this is a good balance between module
-    # complexity and functionality.
     checkPhase = ''
       ${getExe cfg.package} --cfg "$target" --check --debug
     '';
@@ -115,7 +96,7 @@ let
       Type = "notify";
       ExecStart = ''
         ${getExe cfg.package} \
-          --cfg ${keyboard.configFile} \
+          --cfg ${mkConfig name keyboard} \
           --symlink-path ''${RUNTIME_DIRECTORY}/${name} \
           ${optionalString (keyboard.port != null) "--port ${toString keyboard.port}"} \
           ${utils.escapeSystemdExecArgs keyboard.extraArgs}

nixos/modules/services/home-automation/ebusd.nix

@@ -138,7 +138,7 @@ in
       after = [ "network.target" ];
       serviceConfig = {
         ExecStart = let
-          args = cli.toGNUCommandLineShell { optionValueSeparator = "="; } (foldr (a: b: a // b) { } [
+          args = cli.toGNUCommandLineShell { } (foldr (a: b: a // b) { } [
             {
               inherit (cfg) device port configpath scanconfig readonly;
               foreground = true;

nixos/modules/services/home-automation/wyoming/faster-whisper.nix

@@ -113,9 +113,6 @@ in
       nameValuePair "wyoming-faster-whisper-${server}" {
         inherit (options) enable;
         description = "Wyoming faster-whisper server instance ${server}";
-        wants = [
-          "network-online.target"
-        ];
         after = [
           "network-online.target"
         ];

nixos/modules/services/home-automation/wyoming/openwakeword.nix

@@ -108,9 +108,6 @@ in
   config = mkIf cfg.enable {
     systemd.services."wyoming-openwakeword" = {
       description = "Wyoming openWakeWord server";
-      wants = [
-        "network-online.target"
-      ];
       after = [
         "network-online.target"
       ];

nixos/modules/services/home-automation/wyoming/piper.nix

@@ -117,9 +117,6 @@ in
       nameValuePair "wyoming-piper-${server}" {
         inherit (options) enable;
         description = "Wyoming Piper server instance ${server}";
-        wants = [
-          "network-online.target"
-        ];
         after = [
           "network-online.target"
         ];

nixos/modules/services/mail/stalwart-mail.nix

@@ -7,12 +7,28 @@ let
   configFormat = pkgs.formats.toml { };
   configFile = configFormat.generate "stalwart-mail.toml" cfg.settings;
   dataDir = "/var/lib/stalwart-mail";
+  stalwartAtLeast = versionAtLeast cfg.package.version;
 
 in {
   options.services.stalwart-mail = {
     enable = mkEnableOption "the Stalwart all-in-one email server";
 
-    package = mkPackageOption pkgs "stalwart-mail" { };
+    package = mkOption {
+      type = types.package;
+      description = ''
+        Which package to use for the Stalwart mail server.
+
+        ::: {.note}
+        Upgrading from version 0.6.0 to version 0.7.0 or higher requires manual
+        intervention. See <https://github.com/stalwartlabs/mail-server/blob/main/UPGRADING.md>
+        for upgrade instructions.
+        :::
+      '';
+      default = pkgs.stalwart-mail_0_6;
+      defaultText = lib.literalExpression "pkgs.stalwart-mail_0_6";
+      example = lib.literalExpression "pkgs.stalwart-mail";
+      relatedPackages = [ "stalwart-mail_0_6" "stalwart-mail" ];
+    };
 
     settings = mkOption {
       inherit (configFormat) type;
@@ -28,6 +44,17 @@ in {
 
   config = mkIf cfg.enable {
 
+    warnings = lib.optionals (!stalwartAtLeast "0.7.0") [
+      ''
+        Versions of stalwart-mail < 0.7.0 will get deprecated in NixOS 24.11.
+        Please set services.stalwart-mail.package to pkgs.stalwart-mail to
+        upgrade to the latest version.
+        Please note that upgrading to version >= 0.7 requires manual
+        intervention, see <https://github.com/stalwartlabs/mail-server/blob/main/UPGRADING.md>
+        for upgrade instructions.
+      ''
+    ];
+
     # Default config: all local
     services.stalwart-mail.settings = {
       global.tracing.method = mkDefault "stdout";
@@ -43,9 +70,7 @@ in {
       storage.lookup = mkDefault "db";
       storage.blob = mkDefault "blob";
       resolver.type = mkDefault "system";
-      resolver.public-suffix = lib.mkDefault [
-        "file://${pkgs.publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
-      ];
+      resolver.public-suffix = mkDefault ["https://publicsuffix.org/list/public_suffix_list.dat"];
     };
 
     systemd.services.stalwart-mail = {
@@ -111,6 +136,6 @@ in {
   };
 
   meta = {
-    maintainers = with maintainers; [ happysalada pacien onny ];
+    maintainers = with maintainers; [ happysalada pacien ];
   };
 }

nixos/modules/services/misc/invidious-router.nix

@@ -8,7 +8,7 @@
   settingsFormat = pkgs.formats.yaml {};
   configFile = settingsFormat.generate "config.yaml" cfg.settings;
 in {
-  meta.maintainers = [lib.maintainers.sils];
+  meta.maintainers = [lib.maintainers.s1ls];
 
   options.services.invidious-router = {
     enable = lib.mkEnableOption "Enables the invidious-router service";

nixos/modules/services/misc/portunus.nix

@@ -98,10 +98,6 @@ in
 
           The OIDC secret must be set as the `DEX_CLIENT_''${id}` environment variable
           in the [](#opt-services.dex.environmentFile) setting.
-
-          ::: {.note}
-          Make sure the id only contains characters that are allowed in an environment variable name, e.g. no -.
-          :::
         '';
       };
 

nixos/modules/services/misc/snapper.nix

@@ -108,7 +108,7 @@ in
       type = types.bool;
       example = true;
       description = ''
-        Set the `Persistent` option for the
+        Set the `persistentTimer` option for the
         {manpage}`systemd.timer(5)`
         which triggers the snapshot immediately if the last trigger
         was missed (e.g. if the system was powered down).

nixos/modules/services/monitoring/grafana.nix

@@ -47,6 +47,13 @@ let
   datasourceFileOrDir = mkProvisionCfg "datasource" "datasources" cfg.provision.datasources;
   dashboardFileOrDir = mkProvisionCfg "dashboard" "providers" cfg.provision.dashboards;
 
+  notifierConfiguration = {
+    apiVersion = 1;
+    notifiers = cfg.provision.notifiers;
+  };
+
+  notifierFileOrDir = pkgs.writeText "notifier.yaml" (builtins.toJSON notifierConfiguration);
+
   generateAlertingProvisioningYaml = x:
     if (cfg.provision.alerting."${x}".path == null)
     then provisioningSettingsFormat.generate "${x}.yaml" cfg.provision.alerting."${x}".settings
@@ -67,9 +74,10 @@ let
     fi
   '';
   provisionConfDir = pkgs.runCommand "grafana-provisioning" { nativeBuildInputs = [ pkgs.xorg.lndir ]; } ''
-    mkdir -p $out/{alerting,datasources,dashboards,plugins}
+    mkdir -p $out/{alerting,datasources,dashboards,notifiers,plugins}
     ${ln { src = datasourceFileOrDir;    dir = "datasources"; filename = "datasource"; }}
     ${ln { src = dashboardFileOrDir;     dir = "dashboards";  filename = "dashboard"; }}
+    ${ln { src = notifierFileOrDir;      dir = "notifiers";   filename = "notifier"; }}
     ${ln { src = rulesFileOrDir;         dir = "alerting";    filename = "rules"; }}
     ${ln { src = contactPointsFileOrDir; dir = "alerting";    filename = "contactPoints"; }}
     ${ln { src = policiesFileOrDir;      dir = "alerting";    filename = "policies"; }}
@@ -153,13 +161,73 @@ let
       };
     };
   };
+
+  grafanaTypes.notifierConfig = types.submodule {
+    options = {
+      name = mkOption {
+        type = types.str;
+        default = "default";
+        description = "Notifier name.";
+      };
+      type = mkOption {
+        type = types.enum [ "dingding" "discord" "email" "googlechat" "hipchat" "kafka" "line" "teams" "opsgenie" "pagerduty" "prometheus-alertmanager" "pushover" "sensu" "sensugo" "slack" "telegram" "threema" "victorops" "webhook" ];
+        description = "Notifier type.";
+      };
+      uid = mkOption {
+        type = types.str;
+        description = "Unique notifier identifier.";
+      };
+      org_id = mkOption {
+        type = types.int;
+        default = 1;
+        description = "Organization ID.";
+      };
+      org_name = mkOption {
+        type = types.str;
+        default = "Main Org.";
+        description = "Organization name.";
+      };
+      is_default = mkOption {
+        type = types.bool;
+        description = "Is the default notifier.";
+        default = false;
+      };
+      send_reminder = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Should the notifier be sent reminder notifications while alerts continue to fire.";
+      };
+      frequency = mkOption {
+        type = types.str;
+        default = "5m";
+        description = "How frequently should the notifier be sent reminders.";
+      };
+      disable_resolve_message = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Turn off the message that sends when an alert returns to OK.";
+      };
+      settings = mkOption {
+        type = types.nullOr types.attrs;
+        default = null;
+        description = "Settings for the notifier type.";
+      };
+      secure_settings = mkOption {
+        type = types.nullOr types.attrs;
+        default = null;
+        description = ''
+          Secure settings for the notifier type. Please note that the contents of this option
+          will end up in a world-readable Nix store. Use the file provider
+          pointing at a reasonably secured file in the local filesystem
+          to work around that. Look at the documentation for details:
+          <https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider>
+        '';
+      };
+    };
+  };
 in
 {
   imports = [
-    (mkRemovedOptionModule [ "services" "grafana" "provision" "notifiers" ] ''
-      Notifiers (services.grafana.provision.notifiers) were removed in Grafana 11.
-    '')
-
     (mkRenamedOptionModule [ "services" "grafana" "protocol" ] [ "services" "grafana" "settings" "server" "protocol" ])
     (mkRenamedOptionModule [ "services" "grafana" "addr" ] [ "services" "grafana" "settings" "server" "http_addr" ])
     (mkRenamedOptionModule [ "services" "grafana" "port" ] [ "services" "grafana" "settings" "server" "http_port" ])
@@ -1188,6 +1256,15 @@ in
         };
       };
 
+
+      notifiers = mkOption {
+        description = "Grafana notifier configuration.";
+        default = [ ];
+        type = types.listOf grafanaTypes.notifierConfig;
+        apply = x: map _filter x;
+      };
+
+
       alerting = {
         rules = {
           path = mkOption {
@@ -1669,6 +1746,12 @@ in
             Use file provider or an env-var instead.
           '';
 
+        # Warn about deprecated notifiers.
+        deprecatedNotifiers = optional (cfg.provision.notifiers != [ ]) ''
+          Notifiers are deprecated upstream and will be removed in Grafana 11.
+          Use `services.grafana.provision.alerting.contactPoints` instead.
+        '';
+
         # Ensure that `secureJsonData` of datasources provisioned via `datasources.settings`
         # only uses file/env providers.
         secureJsonDataWithoutFileProvider = optional
@@ -1687,10 +1770,15 @@ in
             Declarations in the `secureJsonData`-block of a datasource will be leaked to the
             Nix store unless a file-provider or an env-var is used!
           '';
+
+        notifierSecureSettingsWithoutFileProvider = optional
+          (any (x: x.secure_settings != null) cfg.provision.notifiers)
+          "Notifier secure settings will be stored as plaintext in the Nix store! Use file provider instead.";
       in
       passwordWithoutFileProvider
+      ++ deprecatedNotifiers
       ++ secureJsonDataWithoutFileProvider
-      ;
+      ++ notifierSecureSettingsWithoutFileProvider;
 
     environment.systemPackages = [ cfg.package ];
 

nixos/modules/services/networking/kea.nix

@@ -278,9 +278,6 @@ in
         "https://kea.readthedocs.io/en/kea-${package.version}/arm/agent.html"
       ];
 
-      wants = [
-        "network-online.target"
-      ];
       after = [
         "network-online.target"
         "time-sync.target"

nixos/modules/services/networking/oink.nix

@@ -1,84 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.oink;
-  makeOinkConfig = attrs: (pkgs.formats.json { }).generate
-    "oink.json" (mapAttrs' (k: v: nameValuePair (toLower k) v) attrs);
-  oinkConfig = makeOinkConfig {
-    global = cfg.settings;
-    domains = cfg.domains;
-  };
-in
-{
-  options.services.oink = {
-    enable = mkEnableOption "Oink, a dynamic DNS client for Porkbun";
-    package = mkPackageOption pkgs "oink" { };
-    settings = {
-      apiKey = mkOption {
-        type = types.str;
-        description = "API key to use when modifying DNS records.";
-      };
-      secretApiKey = mkOption {
-        type = types.str;
-        description = "Secret API key to use when modifying DNS records.";
-      };
-      interval = mkOption {
-        # https://github.com/rlado/oink/blob/v1.1.1/src/main.go#L364
-        type = types.ints.between 60 172800; # 48 hours
-        default = 900;
-        description = "Seconds to wait before sending another request.";
-      };
-      ttl = mkOption {
-        type = types.ints.between 600 172800;
-        default = 600;
-        description = ''
-          The TTL ("Time to Live") value to set for your DNS records.
-
-          The TTL controls how long in seconds your records will be cached
-          for. A smaller value will allow the record to update quicker.
-        '';
-      };
-    };
-    domains = mkOption {
-      type = with types; listOf (attrsOf anything);
-      default = [];
-      example = [
-        {
-          domain = "nixos.org";
-          subdomain = "";
-          ttl = 1200;
-        }
-        {
-          domain = "nixos.org";
-          subdomain = "hydra";
-        }
-      ];
-      description = ''
-        List of attribute sets containing configuration for each domain.
-
-        Each attribute set must have two attributes, one named *domain*
-        and another named *subdomain*. The domain attribute must specify
-        the root domain that you want to configure, and the subdomain
-        attribute must specify its subdomain if any. If you want to
-        configure the root domain rather than a subdomain, leave the
-        subdomain attribute as an empty string.
-
-        Additionally, you can use attributes from *services.oink.settings*
-        to override settings per-domain.
-
-        Every domain listed here *must* have API access enabled in
-        Porkbun's control panel.
-      '';
-    };
-  };
-
-  config = mkIf cfg.enable {
-    systemd.services.oink = {
-      description = "Dynamic DNS client for Porkbun";
-      wantedBy = [ "multi-user.target" ];
-      script = "${cfg.package}/bin/oink -c ${oinkConfig}";
-    };
-  };
-}

nixos/modules/services/networking/ssh/sshd.nix

@@ -5,11 +5,11 @@ with lib;
 let
 
   # The splicing information needed for nativeBuildInputs isn't available
-  # on the derivations likely to be used as `cfg.package`.
+  # on the derivations likely to be used as `cfgc.package`.
   # This middle-ground solution ensures *an* sshd can do their basic validation
   # on the configuration.
   validationPackage = if pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform
-    then cfg.package
+    then cfgc.package
     else pkgs.buildPackages.openssh;
 
   # dont use the "=" operator
@@ -169,13 +169,6 @@ in
         '';
       };
 
-      package = mkOption {
-        type = types.package;
-        default = config.programs.ssh.package;
-        defaultText = literalExpression "programs.ssh.package";
-        description = "OpenSSH package to use for sshd.";
-      };
-
       startWhenNeeded = mkOption {
         type = types.bool;
         default = false;
@@ -551,8 +544,8 @@ in
       };
     users.groups.sshd = {};
 
-    services.openssh.moduliFile = mkDefault "${cfg.package}/etc/ssh/moduli";
-    services.openssh.sftpServerExecutable = mkDefault "${cfg.package}/libexec/sftp-server";
+    services.openssh.moduliFile = mkDefault "${cfgc.package}/etc/ssh/moduli";
+    services.openssh.sftpServerExecutable = mkDefault "${cfgc.package}/libexec/sftp-server";
 
     environment.etc = authKeysFiles // authPrincipalsFiles //
       { "ssh/moduli".source = cfg.moduliFile;
@@ -566,7 +559,7 @@ in
             wantedBy = optional (!cfg.startWhenNeeded) "multi-user.target";
             after = [ "network.target" ];
             stopIfChanged = false;
-            path = [ cfg.package pkgs.gawk ];
+            path = [ cfgc.package pkgs.gawk ];
             environment.LD_LIBRARY_PATH = nssModulesPath;
 
             restartTriggers = optionals (!cfg.startWhenNeeded) [
@@ -600,7 +593,7 @@ in
             serviceConfig =
               { ExecStart =
                   (optionalString cfg.startWhenNeeded "-") +
-                  "${cfg.package}/bin/sshd " + (optionalString cfg.startWhenNeeded "-i ") +
+                  "${cfgc.package}/bin/sshd " + (optionalString cfg.startWhenNeeded "-i ") +
                   "-D " +  # don't detach into a daemon process
                   "-f /etc/ssh/sshd_config";
                 KillMode = "process";

nixos/modules/services/networking/wireguard.nix

@@ -80,15 +80,6 @@ let
         description = "Commands called at the end of the interface setup.";
       };
 
-      preShutdown = mkOption {
-        example = literalExpression ''"''${pkgs.iproute2}/bin/ip netns del foo"'';
-        default = "";
-        type = with types; coercedTo (listOf str) (concatStringsSep "\n") lines;
-        description = ''
-          Commands called before shutting down the interface.
-        '';
-      };
-
       postShutdown = mkOption {
         example = literalExpression ''"''${pkgs.openresolv}/bin/resolvconf -d wg0"'';
         default = "";
@@ -506,7 +497,6 @@ let
         '';
 
         postStop = ''
-          ${values.preShutdown}
           ${ipPostMove} link del dev "${name}"
           ${values.postShutdown}
         '';

nixos/modules/services/security/bitwarden-directory-connector-cli.nix

@@ -260,7 +260,6 @@ in {
         description = "Sync timer for Bitwarden Directory Connector";
         wantedBy = ["timers.target"];
         after = ["network-online.target"];
-        wants = ["network-online.target"];
         timerConfig = {
           OnCalendar = cfg.interval;
           Unit = "bitwarden-directory-connector-cli.service";

nixos/modules/services/security/oauth2-proxy-nginx.nix

@@ -83,15 +83,6 @@ in
   } ++ (lib.mapAttrsToList (vhost: conf: {
     virtualHosts.${vhost} = {
       locations = {
-        "/".extraConfig = ''
-          # pass information via X-User and X-Email headers to backend, requires running with --set-xauthrequest flag
-          proxy_set_header X-User  $user;
-          proxy_set_header X-Email $email;
-
-          # if you enabled --cookie-refresh, this is needed for it to work with auth_request
-          add_header Set-Cookie $auth_cookie;
-        '';
-
         "/oauth2/auth" = let
           maybeQueryArg = name: value:
             if value == null then null
@@ -111,7 +102,6 @@ in
             proxy_pass_request_body           off;
           '';
         };
-
         "@redirectToAuth2ProxyLogin" = {
           return = "307 https://${cfg.domain}/oauth2/start?rd=$scheme://$host$request_uri";
           extraConfig = ''
@@ -124,10 +114,16 @@ in
         auth_request /oauth2/auth;
         error_page 401 = @redirectToAuth2ProxyLogin;
 
-        # set variables being used in locations."/".extraConfig
+        # pass information via X-User and X-Email headers to backend,
+        # requires running with --set-xauthrequest flag
         auth_request_set $user   $upstream_http_x_auth_request_user;
         auth_request_set $email  $upstream_http_x_auth_request_email;
+        proxy_set_header X-User  $user;
+        proxy_set_header X-Email $email;
+
+        # if you enabled --cookie-refresh, this is needed for it to work with auth_request
         auth_request_set $auth_cookie $upstream_http_set_cookie;
+        add_header Set-Cookie $auth_cookie;
       '';
     };
   }) cfg.virtualHosts)));

nixos/modules/services/system/dbus.nix

@@ -128,14 +128,10 @@ in
         contents."/etc/dbus-1".source = pkgs.makeDBusConf {
           inherit (cfg) apparmor;
           suidHelper = "/bin/false";
-          serviceDirectories = [ pkgs.dbus config.boot.initrd.systemd.package ];
+          serviceDirectories = [ pkgs.dbus ];
         };
         packages = [ pkgs.dbus ];
-        storePaths = [
-          "${pkgs.dbus}/bin/dbus-daemon"
-          "${config.boot.initrd.systemd.package}/share/dbus-1/system-services"
-          "${config.boot.initrd.systemd.package}/share/dbus-1/system.d"
-        ];
+        storePaths = [ "${pkgs.dbus}/bin/dbus-daemon" ];
         targets.sockets.wants = [ "dbus.socket" ];
       };
     })

nixos/modules/services/video/frigate.nix

@@ -427,6 +427,10 @@ in
         PrivateTmp = true;
         CacheDirectory = "frigate";
         CacheDirectoryMode = "0750";
+
+        BindPaths = [
+          "/migrations:${cfg.package}/share/frigate/migrations:ro"
+        ];
       };
     };
   };

nixos/modules/services/web-apps/firefly-iii.nix

@@ -3,8 +3,8 @@
 let
   inherit (lib) optionalString mkDefault mkIf mkOption mkEnableOption literalExpression;
   inherit (lib.types) nullOr attrsOf oneOf str int bool path package enum submodule;
-  inherit (lib.strings) concatLines removePrefix toShellVars removeSuffix hasSuffix;
-  inherit (lib.attrsets) mapAttrsToList attrValues genAttrs filterAttrs mapAttrs' nameValuePair;
+  inherit (lib.strings) concatMapStringsSep removePrefix toShellVars removeSuffix hasSuffix;
+  inherit (lib.attrsets) attrValues genAttrs filterAttrs mapAttrs' nameValuePair;
   inherit (builtins) isInt isString toString typeOf;
 
   cfg = config.services.firefly-iii;
@@ -21,10 +21,18 @@ let
     (filterAttrs (n: v: hasSuffix "_FILE" n) cfg.settings);
   env-nonfile-values = filterAttrs (n: v: ! hasSuffix "_FILE" n) cfg.settings;
 
-  fileenv-func = ''
-    set -a
+  envfile = pkgs.writeText "firefly-iii-env" ''
+    ${toShellVars env-file-values}
     ${toShellVars env-nonfile-values}
-    ${concatLines (mapAttrsToList (n: v: "${n}=\"$(< ${v})\"") env-file-values)}
+  '';
+
+  fileenv-func = ''
+    cp --no-preserve=mode ${envfile} /tmp/firefly-iii-env
+    ${concatMapStringsSep "\n"
+      (n: "${pkgs.replace-secret}/bin/replace-secret ${n} ${n} /tmp/firefly-iii-env")
+      (attrValues env-file-values)}
+    set -a
+    . /tmp/firefly-iii-env
     set +a
   '';
 
@@ -33,13 +41,15 @@ let
 
     ${optionalString (cfg.settings.DB_CONNECTION == "sqlite")
       "touch ${cfg.dataDir}/storage/database/database.sqlite"}
-    ${artisan} package:discover
+    ${artisan} migrate --seed --no-interaction --force
+    ${artisan} firefly-iii:decrypt-all
     ${artisan} firefly-iii:upgrade-database
+    ${artisan} firefly-iii:correct-database
+    ${artisan} firefly-iii:report-integrity
     ${artisan} firefly-iii:laravel-passport-keys
     ${artisan} cache:clear
-    ${artisan} view:cache
-    ${artisan} route:cache
-    ${artisan} config:cache
+
+    mv /tmp/firefly-iii-env /run/phpfpm/firefly-iii-env
   '';
 
   commonServiceConfig = {
@@ -136,7 +146,6 @@ in {
 
     virtualHost = mkOption {
       type = str;
-      default = "localhost";
       description = ''
         The hostname at which you wish firefly-iii to be served. If you have
         enabled nginx using `services.firefly-iii.enableNginx` then this will
@@ -161,15 +170,14 @@ in {
     };
 
     settings = mkOption {
-      default = {};
       description = ''
         Options for firefly-iii configuration. Refer to
         <https://github.com/firefly-iii/firefly-iii/blob/main/.env.example> for
         details on supported values. All <option>_FILE values supported by
         upstream are supported here.
 
-        APP_URL will be the same as `services.firefly-iii.virtualHost` if the
-        former is unset in `services.firefly-iii.settings`.
+        APP_URL will be set by `services.firefly-iii.virtualHost`, do not
+        redefine it here.
       '';
       example = literalExpression ''
         {
@@ -184,6 +192,7 @@ in {
           DB_PASSWORD_FILE = "/var/secrets/firefly-iii-mysql-password.txt;
         }
       '';
+      default = {};
       type = submodule {
         freeformType = attrsOf (oneOf [str int bool]);
         options = {
@@ -207,9 +216,9 @@ in {
           };
           DB_PORT = mkOption {
             type = nullOr int;
-            default = if cfg.settings.DB_CONNECTION == "pgsql" then 5432
+            default = if cfg.settings.DB_CONNECTION == "sqlite" then null
                       else if cfg.settings.DB_CONNECTION == "mysql" then 3306
-                      else null;
+                      else 5432;
             defaultText = ''
               `null` if DB_CONNECTION is "sqlite", `3306` if "mysql", `5432` if "pgsql"
             '';
@@ -218,21 +227,6 @@ in {
               this value to be filled.
             '';
           };
-          DB_HOST = mkOption {
-            type = str;
-            default = if cfg.settings.DB_CONNECTION == "pgsql" then "/run/postgresql"
-                      else "localhost";
-            defaultText = ''
-              "localhost" if DB_CONNECTION is "sqlite" or "mysql", "/run/postgresql" if "pgsql".
-            '';
-            description = ''
-              The machine which hosts your database. This is left at the
-              default value for "mysql" because we use the "DB_SOCKET" option
-              to connect to a unix socket instead. "pgsql" requires that the
-              unix socket location be specified here instead of at "DB_SOCKET".
-              This option does not affect "sqlite".
-            '';
-          };
           APP_KEY_FILE = mkOption {
             type = path;
             description = ''
@@ -241,20 +235,6 @@ in {
               /dev/urandom | base64)" > /path/to/key-file`.
             '';
           };
-          APP_URL = mkOption {
-            type = str;
-            default = if cfg.virtualHost == "localhost" then "http://${cfg.virtualHost}"
-                      else "https://${cfg.virtualHost}";
-            defaultText = ''
-              http(s)://''${config.services.firefly-iii.virtualHost}
-            '';
-            description = ''
-              The APP_URL used by firefly-iii internally. Please make sure this
-              URL matches the external URL of your Firefly III installation. It
-              is used to validate specific requests and to generate URLs in
-              emails.
-            '';
-          };
         };
       };
     };
@@ -262,6 +242,12 @@ in {
 
   config = mkIf cfg.enable {
 
+    services.firefly-iii = {
+      settings = {
+        APP_URL = cfg.virtualHost;
+      };
+    };
+
     services.phpfpm.pools.firefly-iii = {
       inherit user group;
       phpPackage = cfg.package.phpPackage;
@@ -276,27 +262,29 @@ in {
       } // cfg.poolConfig;
     };
 
+    systemd.services.phpfpm-firefly-iii.serviceConfig = {
+      EnvironmentFile = "/run/phpfpm/firefly-iii-env";
+      ExecStartPost = "${pkgs.coreutils}/bin/rm /run/phpfpm/firefly-iii-env";
+    };
+
     systemd.services.firefly-iii-setup = {
-      after = [ "postgresql.service" "mysql.service" ];
       requiredBy = [ "phpfpm-firefly-iii.service" ];
       before = [ "phpfpm-firefly-iii.service" ];
       serviceConfig = {
         ExecStart = firefly-iii-maintenance;
         RuntimeDirectory = "phpfpm";
         RuntimeDirectoryPreserve = true;
-        RemainAfterExit = true;
       } // commonServiceConfig;
       unitConfig.JoinsNamespaceOf = "phpfpm-firefly-iii.service";
-      restartTriggers = [ cfg.package ];
     };
 
     systemd.services.firefly-iii-cron = {
-      after = [ "firefly-iii-setup.service" "postgresql.service" "mysql.service" ];
-      wants = [ "firefly-iii-setup.service" ];
       description = "Daily Firefly III cron job";
-      serviceConfig = {
-        ExecStart = "${artisan} firefly-iii:cron";
-      } // commonServiceConfig;
+      script = ''
+        ${fileenv-func}
+        ${artisan} firefly-iii:cron
+      '';
+      serviceConfig = commonServiceConfig;
     };
 
     systemd.timers.firefly-iii-cron = {
@@ -307,7 +295,6 @@ in {
         Persistent = true;
       };
       wantedBy = [ "timers.target" ];
-      restartTriggers = [ cfg.package ];
     };
 
     services.nginx = mkIf cfg.enableNginx {

nixos/modules/services/web-apps/nextjs-ollama-llm-ui.nix

@@ -1,87 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  cfg = config.services.nextjs-ollama-llm-ui;
-  # we have to override the URL to a Ollama service here, because it gets baked into the web app.
-  nextjs-ollama-llm-ui = cfg.package.override { ollamaUrl = "https://ollama.lambdablob.com"; };
-in
-{
-  options = {
-    services.nextjs-ollama-llm-ui = {
-      enable = lib.mkEnableOption ''
-        Simple Ollama web UI service; an easy to use web frontend for a Ollama backend service.
-        Run state-of-the-art AI large language models (LLM) similar to ChatGPT locally with privacy
-        on your personal computer.
-        This service is stateless and doesn't store any data on the server; all data is kept
-        locally in your web browser.
-        See https://github.com/jakobhoeg/nextjs-ollama-llm-ui.
-
-        Required: You need the Ollama backend service running by having
-        "services.nextjs-ollama-llm-ui.ollamaUrl" point to the correct url.
-        You can host such a backend service with NixOS through "services.ollama".
-      '';
-      package = lib.mkPackageOption pkgs "nextjs-ollama-llm-ui" { };
-
-      hostname = lib.mkOption {
-        type = lib.types.str;
-        default = "127.0.0.1";
-        example = "ui.example.org";
-        description = ''
-          The hostname under which the Ollama UI interface should be accessible.
-          By default it uses localhost/127.0.0.1 to be accessible only from the local machine.
-          Change to "0.0.0.0" to make it directly accessible from the local network.
-
-          Note: You should keep it at 127.0.0.1 and only serve to the local
-          network or internet from a (home) server behind a reverse-proxy and secured encryption.
-          See https://wiki.nixos.org/wiki/Nginx for instructions on how to set up a reverse-proxy.
-        '';
-      };
-
-      port = lib.mkOption {
-        type = lib.types.port;
-        default = 3000;
-        example = 3000;
-        description = ''
-          The port under which the Ollama UI interface should be accessible.
-        '';
-      };
-
-      ollamaUrl = lib.mkOption {
-        type = lib.types.str;
-        default = "127.0.0.1:11434";
-        example = "https://ollama.example.org";
-        description = ''
-          The address (including host and port) under which we can access the Ollama backend server.
-          !Note that if the the UI service is running under a domain "https://ui.example.org",
-          the Ollama backend service must allow "CORS" requests from this domain, e.g. by adding
-          "services.ollama.environment.OLLAMA_ORIGINS = [ ... "https://ui.example.org" ];"!
-        '';
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services = {
-
-      nextjs-ollama-llm-ui = {
-        wantedBy = [ "multi-user.target" ];
-        description = "Nextjs Ollama LLM Ui.";
-        after = [ "network.target" ];
-        environment = {
-          HOSTNAME = cfg.hostname;
-          PORT = toString cfg.port;
-          NEXT_PUBLIC_OLLAMA_URL = cfg.ollamaUrl;
-        };
-        serviceConfig = {
-          ExecStart = "${lib.getExe nextjs-ollama-llm-ui}";
-          DynamicUser = true;
-        };
-      };
-    };
-  };
-  meta.maintainers = with lib.maintainers; [ malteneuss ];
-}

nixos/modules/system/boot/resolved.nix

@@ -7,20 +7,6 @@ let
   dnsmasqResolve = config.services.dnsmasq.enable &&
                    config.services.dnsmasq.resolveLocalQueries;
 
-  resolvedConf = ''
-    [Resolve]
-    ${optionalString (config.networking.nameservers != [])
-      "DNS=${concatStringsSep " " config.networking.nameservers}"}
-    ${optionalString (cfg.fallbackDns != null)
-      "FallbackDNS=${concatStringsSep " " cfg.fallbackDns}"}
-    ${optionalString (cfg.domains != [])
-      "Domains=${concatStringsSep " " cfg.domains}"}
-    LLMNR=${cfg.llmnr}
-    DNSSEC=${cfg.dnssec}
-    DNSOverTLS=${cfg.dnsovertls}
-    ${config.services.resolved.extraConfig}
-  '';
-
 in
 {
 
@@ -140,87 +126,60 @@ in
       '';
     };
 
-    boot.initrd.services.resolved.enable = mkOption {
-      default = config.boot.initrd.systemd.network.enable;
-      defaultText = "config.boot.initrd.systemd.network.enable";
-      description = ''
-        Whether to enable resolved for stage 1 networking.
-        Uses the toplevel 'services.resolved' options for 'resolved.conf'
-      '';
+  };
+
+  config = mkIf cfg.enable {
+
+    assertions = [
+      { assertion = !config.networking.useHostResolvConf;
+        message = "Using host resolv.conf is not supported with systemd-resolved";
+      }
+    ];
+
+    users.users.systemd-resolve.group = "systemd-resolve";
+
+    # add resolve to nss hosts database if enabled and nscd enabled
+    # system.nssModules is configured in nixos/modules/system/boot/systemd.nix
+    # added with order 501 to allow modules to go before with mkBefore
+    system.nssDatabases.hosts = (mkOrder 501 ["resolve [!UNAVAIL=return]"]);
+
+    systemd.additionalUpstreamSystemUnits = [
+      "systemd-resolved.service"
+    ];
+
+    systemd.services.systemd-resolved = {
+      wantedBy = [ "multi-user.target" ];
+      aliases = [ "dbus-org.freedesktop.resolve1.service" ];
+      restartTriggers = [ config.environment.etc."systemd/resolved.conf".source ];
     };
 
+    environment.etc = {
+      "systemd/resolved.conf".text = ''
+        [Resolve]
+        ${optionalString (config.networking.nameservers != [])
+          "DNS=${concatStringsSep " " config.networking.nameservers}"}
+        ${optionalString (cfg.fallbackDns != null)
+          "FallbackDNS=${concatStringsSep " " cfg.fallbackDns}"}
+        ${optionalString (cfg.domains != [])
+          "Domains=${concatStringsSep " " cfg.domains}"}
+        LLMNR=${cfg.llmnr}
+        DNSSEC=${cfg.dnssec}
+        DNSOverTLS=${cfg.dnsovertls}
+        ${config.services.resolved.extraConfig}
+      '';
+
+      # symlink the dynamic stub resolver of resolv.conf as recommended by upstream:
+      # https://www.freedesktop.org/software/systemd/man/systemd-resolved.html#/etc/resolv.conf
+      "resolv.conf".source = "/run/systemd/resolve/stub-resolv.conf";
+    } // optionalAttrs dnsmasqResolve {
+      "dnsmasq-resolv.conf".source = "/run/systemd/resolve/resolv.conf";
+    };
+
+    # If networkmanager is enabled, ask it to interface with resolved.
+    networking.networkmanager.dns = "systemd-resolved";
+
+    networking.resolvconf.package = pkgs.systemd;
+
   };
 
-  config = mkMerge [
-    (mkIf cfg.enable {
-
-      assertions = [
-        { assertion = !config.networking.useHostResolvConf;
-          message = "Using host resolv.conf is not supported with systemd-resolved";
-        }
-      ];
-
-      users.users.systemd-resolve.group = "systemd-resolve";
-
-      # add resolve to nss hosts database if enabled and nscd enabled
-      # system.nssModules is configured in nixos/modules/system/boot/systemd.nix
-      # added with order 501 to allow modules to go before with mkBefore
-      system.nssDatabases.hosts = (mkOrder 501 ["resolve [!UNAVAIL=return]"]);
-
-      systemd.additionalUpstreamSystemUnits = [
-        "systemd-resolved.service"
-      ];
-
-      systemd.services.systemd-resolved = {
-        wantedBy = [ "sysinit.target" ];
-        aliases = [ "dbus-org.freedesktop.resolve1.service" ];
-        restartTriggers = [ config.environment.etc."systemd/resolved.conf".source ];
-      };
-
-      environment.etc = {
-        "systemd/resolved.conf".text = resolvedConf;
-
-        # symlink the dynamic stub resolver of resolv.conf as recommended by upstream:
-        # https://www.freedesktop.org/software/systemd/man/systemd-resolved.html#/etc/resolv.conf
-        "resolv.conf".source = "/run/systemd/resolve/stub-resolv.conf";
-      } // optionalAttrs dnsmasqResolve {
-        "dnsmasq-resolv.conf".source = "/run/systemd/resolve/resolv.conf";
-      };
-
-      # If networkmanager is enabled, ask it to interface with resolved.
-      networking.networkmanager.dns = "systemd-resolved";
-
-      networking.resolvconf.package = pkgs.systemd;
-
-    })
-
-    (mkIf config.boot.initrd.services.resolved.enable {
-
-      assertions = [
-        {
-          assertion = config.boot.initrd.systemd.enable;
-          message = "'boot.initrd.services.resolved.enable' can only be enabled with systemd stage 1.";
-        }
-      ];
-
-      boot.initrd.systemd = {
-        contents = {
-          "/etc/tmpfiles.d/resolv.conf".text =
-            "L /etc/resolv.conf - - - - /run/systemd/resolve/stub-resolv.conf";
-          "/etc/systemd/resolved.conf".text = resolvedConf;
-        };
-
-        additionalUpstreamUnits = ["systemd-resolved.service"];
-        users.systemd-resolve = {};
-        groups.systemd-resolve = {};
-        storePaths = ["${config.boot.initrd.systemd.package}/lib/systemd/systemd-resolved"];
-        services.systemd-resolved = {
-          wantedBy = ["sysinit.target"];
-          aliases = [ "dbus-org.freedesktop.resolve1.service" ];
-        };
-      };
-
-    })
-  ];
-
 }

nixos/modules/system/boot/systemd/sysusers.nix

@@ -12,7 +12,7 @@ let
     ${lib.concatLines (lib.mapAttrsToList
       (username: opts:
         let
-          uid = if opts.uid == null then "/var/lib/nixos/uid/${username}" else toString opts.uid;
+          uid = if opts.uid == null then "-" else toString opts.uid;
         in
           ''u ${username} ${uid}:${opts.group} "${opts.description}" ${opts.home} ${utils.toShellPath opts.shell}''
       )
@@ -21,7 +21,7 @@ let
 
     # Groups
     ${lib.concatLines (lib.mapAttrsToList
-      (groupname: opts: ''g ${groupname} ${if opts.gid == null then "/var/lib/nixos/gid/${groupname}" else toString opts.gid}'') userCfg.groups)
+      (groupname: opts: ''g ${groupname} ${if opts.gid == null then "-" else toString opts.gid}'') userCfg.groups)
     }
 
     # Group membership
@@ -106,23 +106,6 @@ in
             };
           })
           (lib.filterAttrs (_username: opts: opts.home != "/var/empty") userCfg.users);
-
-        # Create uid/gid marker files for those without an explicit id
-        tmpfiles.settings.nixos-uid = lib.mapAttrs'
-          (username: opts: lib.nameValuePair "/var/lib/nixos/uid/${username}" {
-            f = {
-              user = username;
-            };
-          })
-          (lib.filterAttrs (_username: opts: opts.uid == null) userCfg.users);
-
-        tmpfiles.settings.nixos-gid = lib.mapAttrs'
-          (groupname: opts: lib.nameValuePair "/var/lib/nixos/gid/${groupname}" {
-            f = {
-              group = groupname;
-            };
-          })
-          (lib.filterAttrs (_groupname: opts: opts.gid == null) userCfg.groups);
       })
 
       (lib.mkIf config.users.mutableUsers {

nixos/release.nix

@@ -12,7 +12,7 @@ let
 
   version = fileContents ../.version;
   versionSuffix =
-    (if stableBranch then "." else "pre") + "${toString nixpkgs.revCount}.${nixpkgs.shortRev}";
+    (if stableBranch then "." else "beta") + "${toString (nixpkgs.revCount - 630170)}.${nixpkgs.shortRev}";
 
   # Run the tests for each platform.  You can run a test by doing
   # e.g. ‘nix-build release.nix -A tests.login.x86_64-linux’,

nixos/tests/all-tests.nix

@@ -616,7 +616,6 @@ in {
   # TODO: put in networking.nix after the test becomes more complete
   networkingProxy = handleTest ./networking-proxy.nix {};
   nextcloud = handleTest ./nextcloud {};
-  nextjs-ollama-llm-ui = runTest ./web-apps/nextjs-ollama-llm-ui.nix;
   nexus = handleTest ./nexus.nix {};
   # TODO: Test nfsv3 + Kerberos
   nfs3 = handleTest ./nfs { version = 3; };
@@ -931,7 +930,6 @@ in {
   systemd-oomd = handleTest ./systemd-oomd.nix {};
   systemd-portabled = handleTest ./systemd-portabled.nix {};
   systemd-repart = handleTest ./systemd-repart.nix {};
-  systemd-resolved = handleTest ./systemd-resolved.nix {};
   systemd-shutdown = handleTest ./systemd-shutdown.nix {};
   systemd-sysupdate = runTest ./systemd-sysupdate.nix;
   systemd-sysusers-mutable = runTest ./systemd-sysusers-mutable.nix;

nixos/tests/ayatana-indicators.nix

@@ -28,11 +28,9 @@ in {
       enable = true;
       packages = with pkgs; [
         ayatana-indicator-datetime
-        ayatana-indicator-display
         ayatana-indicator-messages
         ayatana-indicator-power
         ayatana-indicator-session
-        ayatana-indicator-sound
       ] ++ (with pkgs.lomiri; [
         lomiri-indicator-network
         telephony-service
@@ -43,8 +41,6 @@ in {
 
     services.accounts-daemon.enable = true; # messages
 
-    hardware.pulseaudio.enable = true; # sound
-
     # Lomiri-ish setup for Lomiri indicators
     # TODO move into a Lomiri module, once the package set is far enough for the DE to start
 
@@ -96,7 +92,7 @@ in {
 
     # Now check if all indicators were brought up successfully, and kill them for later
   '' + (runCommandOverAyatanaIndicators (service: let serviceExec = builtins.replaceStrings [ "." ] [ "-" ] service; in ''
-    machine.wait_until_succeeds("pgrep -u ${user} -f ${serviceExec}")
+    machine.succeed("pgrep -u ${user} -f ${serviceExec}")
     machine.succeed("pkill -f ${serviceExec}")
   '')) + ''
 

nixos/tests/firefly-iii.nix

@@ -1,19 +1,14 @@
-import ./make-test-python.nix ({ lib, ... }:
-
-let
-  db-pass = "Test2Test2";
-  app-key = "TestTestTestTestTestTestTestTest";
-in
-{
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
   name = "firefly-iii";
   meta.maintainers = [ lib.maintainers.savyajha ];
 
-  nodes.fireflySqlite = { config, ... }: {
+  nodes.machine = { config, ... }: {
     environment.etc = {
-      "firefly-iii-appkey".text = app-key;
+      "firefly-iii-appkey".text = "TestTestTestTestTestTestTestTest";
     };
     services.firefly-iii = {
       enable = true;
+      virtualHost = "http://localhost";
       enableNginx = true;
       settings = {
         APP_KEY_FILE = "/etc/firefly-iii-appkey";
@@ -23,87 +18,9 @@ in
     };
   };
 
-  nodes.fireflyPostgresql = { config, pkgs, ... }: {
-    environment.etc = {
-      "firefly-iii-appkey".text = app-key;
-      "postgres-pass".text = db-pass;
-    };
-    services.firefly-iii = {
-      enable = true;
-      enableNginx = true;
-      settings = {
-        APP_KEY_FILE = "/etc/firefly-iii-appkey";
-        LOG_CHANNEL = "stdout";
-        SITE_OWNER = "mail@example.com";
-        DB_CONNECTION = "pgsql";
-        DB_DATABASE = "firefly";
-        DB_USERNAME = "firefly";
-        DB_PASSWORD_FILE = "/etc/postgres-pass";
-      };
-    };
-
-    services.postgresql = {
-      enable = true;
-      package = pkgs.postgresql_15;
-      authentication = ''
-        local all postgres peer
-        local firefly firefly password
-      '';
-      initialScript = pkgs.writeText "firefly-init.sql" ''
-        CREATE USER "firefly" WITH LOGIN PASSWORD '${db-pass}';
-        CREATE DATABASE "firefly" WITH OWNER "firefly";
-        CREATE SCHEMA AUTHORIZATION firefly;
-      '';
-    };
-  };
-
-  nodes.fireflyMysql = { config, pkgs, ... }: {
-    environment.etc = {
-      "firefly-iii-appkey".text = app-key;
-      "mysql-pass".text = db-pass;
-    };
-    services.firefly-iii = {
-      enable = true;
-      enableNginx = true;
-      settings = {
-        APP_KEY_FILE = "/etc/firefly-iii-appkey";
-        LOG_CHANNEL = "stdout";
-        SITE_OWNER = "mail@example.com";
-        DB_CONNECTION = "mysql";
-        DB_DATABASE = "firefly";
-        DB_USERNAME = "firefly";
-        DB_PASSWORD_FILE = "/etc/mysql-pass";
-        DB_SOCKET = "/run/mysqld/mysqld.sock";
-      };
-    };
-
-    services.mysql = {
-      enable = true;
-      package = pkgs.mariadb;
-      initialScript = pkgs.writeText "firefly-init.sql" ''
-        create database firefly DEFAULT CHARACTER SET utf8mb4;
-        create user 'firefly'@'localhost' identified by '${db-pass}';
-        grant all on firefly.* to 'firefly'@'localhost';
-      '';
-      settings.mysqld.character-set-server = "utf8mb4";
-    };
-  };
-
   testScript = ''
-    fireflySqlite.wait_for_unit("phpfpm-firefly-iii.service")
-    fireflySqlite.wait_for_unit("nginx.service")
-    fireflySqlite.succeed("curl -fvvv -Ls http://localhost/ | grep 'Firefly III'")
-    fireflySqlite.succeed("curl -fvvv -Ls http://localhost/v1/js/app.js")
-    fireflySqlite.succeed("systemctl start firefly-iii-cron.service")
-    fireflyPostgresql.wait_for_unit("phpfpm-firefly-iii.service")
-    fireflyPostgresql.wait_for_unit("nginx.service")
-    fireflyPostgresql.wait_for_unit("postgresql.service")
-    fireflyPostgresql.succeed("curl -fvvv -Ls http://localhost/ | grep 'Firefly III'")
-    fireflyPostgresql.succeed("systemctl start firefly-iii-cron.service")
-    fireflyMysql.wait_for_unit("phpfpm-firefly-iii.service")
-    fireflyMysql.wait_for_unit("nginx.service")
-    fireflyMysql.wait_for_unit("mysql.service")
-    fireflyMysql.succeed("curl -fvvv -Ls http://localhost/ | grep 'Firefly III'")
-    fireflyMysql.succeed("systemctl start firefly-iii-cron.service")
+    machine.wait_for_unit("phpfpm-firefly-iii.service")
+    machine.wait_for_unit("nginx.service")
+    machine.succeed("curl -fvvv -Ls http://localhost/ | grep 'Firefly III'")
   '';
 })

nixos/tests/grafana/provision/default.nix

@@ -1,7 +1,7 @@
 import ../../make-test-python.nix ({ lib, pkgs, ... }:
 
 let
-  inherit (lib) mkMerge maintainers;
+  inherit (lib) mkMerge nameValuePair maintainers;
 
   baseGrafanaConf = {
     services.grafana = {
@@ -33,6 +33,35 @@ let
   };
 
   extraNodeConfs = {
+    provisionLegacyNotifiers = {
+      services.grafana.provision = {
+        datasources.settings = {
+          apiVersion = 1;
+          datasources = [{
+            name = "Test Datasource";
+            type = "testdata";
+            access = "proxy";
+            uid = "test_datasource";
+          }];
+        };
+        dashboards.settings = {
+          apiVersion = 1;
+          providers = [{
+            name = "default";
+            options.path = "/var/lib/grafana/dashboards";
+          }];
+        };
+        notifiers = [{
+          uid = "test_notifiers";
+          name = "Test Notifiers";
+          type = "email";
+          settings = {
+            singleEmail = true;
+            addresses = "test@test.com";
+          };
+        }];
+      };
+    };
     provisionNix = {
       services.grafana.provision = {
         datasources.settings = {
@@ -213,5 +242,15 @@ in {
             machine.succeed(
                 "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/v1/provisioning/mute-timings | grep Test\ Mute\ Timing"
             )
+
+    with subtest("Successful notifiers provision"):
+        provisionLegacyNotifiers.wait_for_unit("grafana.service")
+        provisionLegacyNotifiers.wait_for_open_port(3000)
+        print(provisionLegacyNotifiers.succeed(
+            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/alert-notifications/uid/test_notifiers"
+        ))
+        provisionLegacyNotifiers.succeed(
+            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/alert-notifications/uid/test_notifiers | grep Test\ Notifiers"
+        )
   '';
 })

nixos/tests/lomiri.nix

@@ -290,7 +290,7 @@ in {
     # There's a test app we could use that also displays their contents, but it's abit inconsistent.
     with subtest("ayatana indicators work"):
         mouse_click(735, 0) # the cog in the top-right, for the session indicator
-        machine.wait_for_text(r"(Notifications|Rotation|Battery|Sound|Time|Date|System)")
+        machine.wait_for_text(r"(Notifications|Battery|Time|Date|System)")
         machine.screenshot("indicators_open")
 
         # Indicator order within the menus *should* be fixed based on per-indicator order setting
@@ -298,25 +298,13 @@ in {
         machine.send_key("left")
         machine.send_key("left")
         machine.send_key("left")
-        machine.send_key("left")
-        machine.send_key("left")
         # Notifications are usually empty, nothing to check there
 
-        with subtest("ayatana indicator display works"):
-            # We start on this, don't go right
-            machine.wait_for_text("Lock")
-            machine.screenshot("indicators_display")
-
         with subtest("lomiri indicator network works"):
-            machine.send_key("right")
+            # We start on this, don't go right
             machine.wait_for_text(r"(Flight|Wi-Fi)")
             machine.screenshot("indicators_network")
 
-        with subtest("ayatana indicator sound works"):
-            machine.send_key("right")
-            machine.wait_for_text(r"(Silent|Volume)")
-            machine.screenshot("indicators_sound")
-
         with subtest("ayatana indicator power works"):
             machine.send_key("right")
             machine.wait_for_text(r"(Charge|Battery settings)")

nixos/tests/openssh.nix

@@ -111,11 +111,11 @@ in {
     server-no-openssl =
       { ... }:
       {
+        programs.ssh.package = pkgs.opensshPackages.openssh.override {
+          linkOpenssl = false;
+        };
         services.openssh = {
           enable = true;
-          package = pkgs.opensshPackages.openssh.override {
-            linkOpenssl = false;
-          };
           hostKeys = [
             { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
           ];
@@ -136,11 +136,11 @@ in {
     server-no-pam =
       { pkgs, ... }:
       {
+        programs.ssh.package = pkgs.opensshPackages.openssh.override {
+          withPAM = false;
+        };
         services.openssh = {
           enable = true;
-          package = pkgs.opensshPackages.openssh.override {
-            withPAM = false;
-          };
           settings = {
             UsePAM = false;
           };

nixos/tests/stalwart-mail.nix

@@ -18,8 +18,8 @@ in import ./make-test-python.nix ({ lib, ... }: {
         server.hostname = domain;
 
         certificate."snakeoil" = {
-          cert = "%{file:${certs.${domain}.cert}}%";
-          private-key = "%{file:${certs.${domain}.key}}%";
+          cert = "file://${certs.${domain}.cert}";
+          private-key = "file://${certs.${domain}.key}";
         };
 
         server.tls = {
@@ -40,6 +40,8 @@ in import ./make-test-python.nix ({ lib, ... }: {
           };
         };
 
+        resolver.public-suffix = [ ];  # do not fetch from web in sandbox
+
         session.auth.mechanisms = "[plain]";
         session.auth.directory = "'in-memory'";
         storage.directory = "in-memory";
@@ -51,13 +53,13 @@ in import ./make-test-python.nix ({ lib, ... }: {
           type = "memory";
           principals = [
             {
-              class = "individual";
+              type = "individual";
               name = "alice";
               secret = "foobar";
               email = [ "alice@${domain}" ];
             }
             {
-              class = "individual";
+              type = "individual";
               name = "bob";
               secret = "foobar";
               email = [ "bob@${domain}" ];
@@ -115,6 +117,6 @@ in import ./make-test-python.nix ({ lib, ... }: {
   '';
 
   meta = {
-    maintainers = with lib.maintainers; [ happysalada pacien onny ];
+    maintainers = with lib.maintainers; [ happysalada pacien ];
   };
 })

nixos/tests/systemd-initrd-luks-fido2.nix

@@ -9,6 +9,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
       # Booting off the encrypted disk requires having a Nix store available for the init script
       mountHostNixStore = true;
       useEFIBoot = true;
+      qemu.package = lib.mkForce (pkgs.qemu_test.override { canokeySupport = true; });
       qemu.options = [ "-device canokey,file=/tmp/canokey-file" ];
     };
     boot.loader.systemd-boot.enable = true;

nixos/tests/systemd-resolved.nix

@@ -1,75 +0,0 @@
-import ./make-test-python.nix ({ pkgs, lib, ... }: {
-  name = "systemd-resolved";
-  meta.maintainers = [ lib.maintainers.elvishjerricco ];
-
-  nodes.server = { lib, config, ... }: let
-    exampleZone = pkgs.writeTextDir "example.com.zone" ''
-      @ SOA ns.example.com. noc.example.com. 2019031301 86400 7200 3600000 172800
-      @       A       ${(lib.head config.networking.interfaces.eth1.ipv4.addresses).address}
-      @       AAAA    ${(lib.head config.networking.interfaces.eth1.ipv6.addresses).address}
-    '';
-  in {
-    networking.firewall.enable = false;
-    networking.useDHCP = false;
-
-    networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
-      { address = "fd00::1"; prefixLength = 64; }
-    ];
-
-    services.knot = {
-      enable = true;
-      settings = {
-        server.listen = [
-          "0.0.0.0@53"
-          "::@53"
-        ];
-        template.default.storage = exampleZone;
-        zone."example.com".file = "example.com.zone";
-      };
-    };
-  };
-
-  nodes.client = { nodes, ... }: let
-    inherit (lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses) address;
-  in {
-    networking.nameservers = [ address ];
-    networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
-      { address = "fd00::2"; prefixLength = 64; }
-    ];
-    services.resolved.enable = true;
-    services.resolved.fallbackDns = [ ];
-    networking.useNetworkd = true;
-    networking.useDHCP = false;
-    systemd.network.networks."40-eth0".enable = false;
-
-    testing.initrdBackdoor = true;
-    boot.initrd = {
-      systemd.enable = true;
-      systemd.initrdBin = [ pkgs.iputils ];
-      network.enable = true;
-      services.resolved.enable = true;
-    };
-  };
-
-  testScript = { nodes, ... }: let
-    address4 = (lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address;
-    address6 = (lib.head nodes.server.networking.interfaces.eth1.ipv6.addresses).address;
-  in ''
-    start_all()
-    server.wait_for_unit("multi-user.target")
-
-    def test_client():
-        query = client.succeed("resolvectl query example.com")
-        assert "${address4}" in query
-        assert "${address6}" in query
-        client.succeed("ping -4 -c 1 example.com")
-        client.succeed("ping -6 -c 1 example.com")
-
-    client.wait_for_unit("initrd.target")
-    test_client()
-    client.switch_root()
-
-    client.wait_for_unit("multi-user.target")
-    test_client()
-  '';
-})

nixos/tests/teleport.nix

@@ -9,6 +9,7 @@ with import ../lib/testing-python.nix { inherit system pkgs; };
 let
   packages = with pkgs; {
     "default" = teleport;
+    "13" = teleport_13;
     "14" = teleport_14;
   };
 

nixos/tests/web-apps/nextjs-ollama-llm-ui.nix

@@ -1,22 +0,0 @@
-{ lib, ... }:
-
-{
-  name = "nextjs-ollama-llm-ui";
-  meta.maintainers = with lib.maintainers; [ malteneuss ];
-
-  nodes.machine =
-    { pkgs, ... }:
-    {
-      services.nextjs-ollama-llm-ui = {
-        enable = true;
-        port = 8080;
-      };
-    };
-
-  testScript = ''
-    # Ensure the service is started and reachable
-    machine.wait_for_unit("nextjs-ollama-llm-ui.service")
-    machine.wait_for_open_port(8080)
-    machine.succeed("curl --fail http://127.0.0.1:8080")
-  '';
-}

pkgs/applications/accessibility/espeakup/default.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     owner = "linux-speakup";
     repo = "espeakup";
     rev = "v${version}";
-    hash = "sha256-Qjdg1kParsnpb8Lv51wXLdrLufxtbBTsP8B3t53islI=";
+    sha256 = "0lmjwafvfxy07zn18v3dzjwwpnid2xffgvy2dzlwkbns8gb60ds2";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/amarok/default.nix

@@ -1,23 +1,23 @@
-{ stdenv, fetchurl, lib
+{ mkDerivation, fetchurl, lib
 , extra-cmake-modules, kdoctools
 , qca-qt5, qjson, qtquickcontrols2, qtscript, qtwebengine
 , karchive, kcmutils, kconfig, kdnssd, kguiaddons, kinit, kirigami2, knewstuff, knotifyconfig, ktexteditor, kwindowsystem
-, fftw, phonon, plasma-framework, threadweaver, breeze-icons, wrapQtAppsHook
+, fftw, phonon, plasma-framework, threadweaver, breeze-icons
 , curl, ffmpeg, gdk-pixbuf, libaio, liblastfm, libmtp, loudmouth, lzo, lz4, mariadb-embedded, pcre, snappy, taglib, taglib_extras
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+mkDerivation rec {
   pname = "amarok";
-  version = "3.0.0";
+  version = "2.9.71";
 
   src = fetchurl {
-    url = "mirror://kde/stable/amarok/${finalAttrs.version}/amarok-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-FKh2eDBfrXagodrKVVpndf+mQuXrvMzs2R9JcJOZLBw=";
+    url = "mirror://kde/unstable/${pname}/${version}/${pname}-${version}.tar.xz";
+    sha256 = "0kz8wixjmy4yxq2gk11ybswryxb6alfymd3bzcar9xinscllhh3a";
   };
 
   outputs = [ "out" "doc" ];
 
-  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapQtAppsHook ];
+  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
 
   propagatedBuildInputs = [
     qca-qt5 qjson qtquickcontrols2 qtscript qtwebengine
@@ -35,4 +35,4 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ peterhoeg ];
   };
-})
+}

pkgs/applications/audio/cardinal/default.nix

@@ -27,11 +27,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cardinal";
-  version = "24.05";
+  version = "24.04";
 
   src = fetchurl {
     url = "https://github.com/DISTRHO/Cardinal/releases/download/${version}/cardinal+deps-${version}.tar.xz";
-    hash = "sha256-ZUJI5utUtST+idlL7WKBIs850EpK98cnmO47g8/iZcI=";
+    hash = "sha256-vowDdHAXVZ+HSMoQsvJdzghsJzH+OrSpx6MxPRAgtJA=";
   };
 
   prePatch = ''

pkgs/applications/audio/g4music/default.nix

@@ -15,14 +15,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "g4music";
-  version = "3.6";
+  version = "3.5.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "neithern";
     repo = "g4music";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-RDz3QwjbzYS4JllxpSA59cs2S3dNTmNcOoxu4JFC8oM=";
+    hash = "sha256-ljSXTEp+f4HMXhGWDGHdX6whm90Vo5KWOQunU2hHwo8=";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/ledfx/default.nix

@@ -6,12 +6,12 @@
 
 python3.pkgs.buildPythonPackage rec {
   pname = "ledfx";
-  version = "2.0.99";
+  version = "2.0.96";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pwrAVcIwZ3RDYFMDk80q5aVSqLTQ5weZqgB3GRRu2ig=";
+    hash = "sha256-nvPHAnoD5j1rneeuMufQkXj8YWXau2zJYug+Avpe87I=";
   };
 
   pythonRelaxDeps = true;
@@ -58,7 +58,6 @@ python3.pkgs.buildPythonPackage rec {
     sounddevice
     stupidartnet
     uvloop
-    vnoise
     voluptuous
     zeroconf
   ];
@@ -72,6 +71,5 @@ python3.pkgs.buildPythonPackage rec {
     changelog = "https://github.com/LedFx/LedFx/blob/${version}/CHANGELOG.rst";
     license = licenses.gpl3Only;
     maintainers = teams.c3d2.members;
-    mainProgram = "ledfx";
   };
 }

pkgs/applications/audio/lsp-plugins/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lsp-plugins";
-  version = "1.2.16";
+  version = "1.2.15";
 
   src = fetchurl {
     url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-    sha256 = "sha256-w2BUIF44z78syLroQk2asVXA5bt9P9POiuwxpnlkc8o=";
+    sha256 = "sha256-krku+jFGOvLwixNGd+0jBzE/17k/OU0zAePLhnxd864=";
   };
 
   outputs = [ "out" "dev" "doc" ];

pkgs/applications/audio/mixxx/default.nix

@@ -57,13 +57,13 @@
 
 mkDerivation rec {
   pname = "mixxx";
-  version = "2.4.1";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "mixxxdj";
     repo = "mixxx";
     rev = version;
-    hash = "sha256-BOdXgA+z3sFE4ngAEhSbp1gDbsti1STJY2Yy6Hp+zTE=";
+    hash = "sha256-JSWUzerm7D6AKq6g/9eRrt3EE2movRdM+VLUg07sLHo=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapGAppsHook3 ];
@@ -147,7 +147,7 @@ mkDerivation rec {
     description = "Digital DJ mixing software";
     mainProgram = "mixxx";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ goibhniu bfortz benley ];
+    maintainers = with maintainers; [ goibhniu bfortz ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/audio/mpdevil/default.nix

@@ -0,0 +1,56 @@
+{ lib, fetchFromGitHub
+, pkg-config, meson ,ninja
+, python3Packages
+, gdk-pixbuf, glib, gobject-introspection, gtk3
+, libnotify
+, wrapGAppsHook3 }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "mpdevil";
+  version = "1.11.0";
+
+  src = fetchFromGitHub {
+    owner = "SoongNoonien";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-ooNZSsVtIeueqgj9hR9OZp08qm8gGokiq8IU3U/ZV5w=";
+  };
+
+  format = "other";
+
+  nativeBuildInputs = [
+    glib.dev gobject-introspection gtk3 pkg-config meson ninja wrapGAppsHook3
+  ];
+
+  buildInputs = [
+    gdk-pixbuf glib libnotify
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    beautifulsoup4 distutils-extra mpd2 notify-py pygobject3 requests
+  ];
+
+  postInstall = ''
+    glib-compile-schemas $out/share/glib-2.0/schemas
+  '';
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  # Prevent double wrapping.
+  dontWrapGApps = true;
+  # Otherwise wrapGAppsHook3 do not pick up the dependencies correctly.
+  strictDeps = false;
+  # There aren't any checks.
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A simple music browser for MPD";
+    homepage = "https://github.com/SoongNoonien/mpdevil";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ apfelkuchen6 ];
+    mainProgram = "mpdevil";
+  };
+}

pkgs/applications/audio/pyradio/default.nix

@@ -6,13 +6,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyradio";
-  version = "0.9.3.7";
+  version = "0.9.3.6";
 
   src = fetchFromGitHub {
     owner = "coderholic";
     repo = "pyradio";
     rev = "refs/tags/${version}";
-    hash = "sha256-NwDVytD6nIM++ixGmLh02FIE+hLKHBwwD3aEAXVZn7I=";
+    hash = "sha256-As4xjwJtEKlnFuBigC7nN0kAPe0+99rE9KZ0F6i7qIQ=";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/spotify-player/default.nix

@@ -33,16 +33,16 @@ assert lib.assertOneOf "withAudioBackend" withAudioBackend [ "" "alsa" "pulseaud
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-player";
-  version = "0.18.2";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "aome510";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-bLUPQgqSsE9tF5YiFj5B+Ylyy96DhWFNjwqXbQ9H8uc=";
+    hash = "sha256-3nPESnBWaxWjWMvRG7gbXt8FzuPlx2soOonCKom+tzA=";
   };
 
-  cargoHash = "sha256-rptGA7J63rHdmxuPIguhZYYs8tZbpidJ0fXroBBoEIM=";
+  cargoHash = "sha256-9HroNMHvmNjGPnEO4kTDalHBXe5MH7btEwk6maLh05E=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/audio/squeezelite/default.nix

@@ -1,31 +1,35 @@
-{
-  lib,
-  stdenv,
-  darwin,
-  fetchFromGitHub,
-  flac,
-  libgpiod,
-  libmad,
-  libpulseaudio,
-  libvorbis,
-  mpg123,
-  audioBackend ? if stdenv.isLinux then "alsa" else "portaudio",
-  alsaSupport ? stdenv.isLinux,
-  alsa-lib,
-  dsdSupport ? true,
-  faad2Support ? true,
-  faad2,
-  ffmpegSupport ? true,
-  ffmpeg,
-  opusSupport ? true,
-  opusfile,
-  resampleSupport ? true,
-  soxr,
-  sslSupport ? true,
-  openssl,
-  portaudioSupport ? stdenv.isDarwin,
-  portaudio,
-  slimserver,
+{ lib
+, stdenv
+, fetchFromGitHub
+, flac
+, libgpiod
+, libmad
+, libpulseaudio
+, libvorbis
+, mpg123
+, audioBackend ? if stdenv.isLinux then "alsa" else "portaudio"
+, alsaSupport ? stdenv.isLinux
+, alsa-lib
+, dsdSupport ? true
+, faad2Support ? true
+, faad2
+, ffmpegSupport ? true
+, ffmpeg
+, opusSupport ? true
+, opusfile
+, resampleSupport ? true
+, soxr
+, sslSupport ? true
+, openssl
+, portaudioSupport ? stdenv.isDarwin
+, portaudio
+, slimserver
+, AudioToolbox
+, AudioUnit
+, Carbon
+, CoreAudio
+, CoreVideo
+, VideoDecodeAcceleration
 }:
 
 let
@@ -34,6 +38,7 @@ let
   pulseSupport = audioBackend == "pulse";
 
   binName = "squeezelite${optionalString pulseSupport "-pulse"}";
+
 in
 stdenv.mkDerivation {
   # the nixos module uses the pname as the binary name
@@ -49,27 +54,11 @@ stdenv.mkDerivation {
     hash = "sha256-FGqo/c74JN000w/iRnvYUejqnYGDzHNZu9pEmR7yR3s=";
   };
 
-  buildInputs =
-    [
-      flac
-      libmad
-      libvorbis
-      mpg123
-    ]
+  buildInputs = [ flac libmad libvorbis mpg123 ]
     ++ optional pulseSupport libpulseaudio
     ++ optional alsaSupport alsa-lib
     ++ optional portaudioSupport portaudio
-    ++ optionals stdenv.isDarwin (
-      with darwin.apple_sdk_11_0.frameworks;
-      [
-        CoreVideo
-        VideoDecodeAcceleration
-        CoreAudio
-        AudioToolbox
-        AudioUnit
-        Carbon
-      ]
-    )
+    ++ optionals stdenv.isDarwin [ CoreVideo VideoDecodeAcceleration CoreAudio AudioToolbox AudioUnit Carbon ]
     ++ optional faad2Support faad2
     ++ optional ffmpegSupport ffmpeg
     ++ optional opusSupport opusfile
@@ -86,11 +75,7 @@ stdenv.mkDerivation {
 
   EXECUTABLE = binName;
 
-  OPTS =
-    [
-      "-DLINKALL"
-      "-DGPIO"
-    ]
+  OPTS = [ "-DLINKALL" "-DGPIO" ]
     ++ optional dsdSupport "-DDSD"
     ++ optional (!faad2Support) "-DNO_FAAD"
     ++ optional ffmpegSupport "-DFFMPEG"
@@ -101,13 +86,15 @@ stdenv.mkDerivation {
     ++ optional sslSupport "-DUSE_SSL"
     ++ optional (stdenv.isAarch32 or stdenv.isAarch64) "-DRPI";
 
-  env = lib.optionalAttrs stdenv.isDarwin { LDADD = "-lportaudio -lpthread"; };
+  env = lib.optionalAttrs stdenv.isDarwin {
+    LDADD = "-lportaudio -lpthread";
+  };
 
   installPhase = ''
     runHook preInstall
 
     install -Dm555 -t $out/bin                   ${binName}
-    install -Dm444 -t $out/share/man/man1 doc/squeezelite.1
+    install -Dm444 -t $out/share/doc/squeezelite *.txt *.md
 
     runHook postInstall
   '';
@@ -123,7 +110,6 @@ stdenv.mkDerivation {
     license = with licenses; [ gpl3Plus ] ++ optional dsdSupport bsd2;
     mainProgram = binName;
     maintainers = with maintainers; [ adamcstephens ];
-    platforms =
-      if (audioBackend == "pulse") then platforms.linux else platforms.linux ++ platforms.darwin;
+    platforms = if (audioBackend == "pulse") then platforms.linux else platforms.linux ++ platforms.darwin;
   };
 }

pkgs/applications/audio/tidal-hifi/default.nix

@@ -36,11 +36,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tidal-hifi";
-  version = "5.13.0";
+  version = "5.12.0";
 
   src = fetchurl {
     url = "https://github.com/Mastermindzh/tidal-hifi/releases/download/${finalAttrs.version}/tidal-hifi_${finalAttrs.version}_amd64.deb";
-    sha256 = "sha256-d7JAvpZKdhG9BzCdfwyPlmXcqE49heVLskusaB0uOhg=";
+    sha256 = "sha256-DwUKoDaXA99ILxlyay5dRL/ewnzyqSSR6fxPxkr8X34=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper ];

pkgs/applications/blockchains/besu/default.nix

@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchurl, makeWrapper, jemalloc, jre, runCommand, testers }:
+{ lib, stdenv, fetchurl, makeWrapper, jre }:
 
-stdenv.mkDerivation (finalAttrs: rec {
+stdenv.mkDerivation rec {
   pname = "besu";
   version = "24.1.2";
 
@@ -9,7 +9,6 @@ stdenv.mkDerivation (finalAttrs: rec {
     sha256 = "sha256-CC24z0+2dSeqDddX5dJUs7SX9QJ8Iyh/nAp0pqdDvwg=";
   };
 
-  buildInputs = lib.optionals stdenv.isLinux [ jemalloc ];
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
@@ -17,27 +16,9 @@ stdenv.mkDerivation (finalAttrs: rec {
     cp -r bin $out/
     mkdir -p $out/lib
     cp -r lib $out/
-    wrapProgram $out/bin/${pname} \
-      --set JAVA_HOME "${jre}" \
-      --suffix ${if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH"} : ${lib.makeLibraryPath buildInputs}
+    wrapProgram $out/bin/${pname} --set JAVA_HOME "${jre}"
   '';
 
-  passthru.tests = {
-    version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-      version = "v${version}";
-    };
-    jemalloc = runCommand "${pname}-test-jemalloc"
-      {
-        nativeBuildInputs = [ finalAttrs.finalPackage ];
-        meta.platforms = with lib.platforms; linux;
-      } ''
-      # Expect to find this string in the output, ignore other failures.
-      (besu 2>&1 || true) | grep -q "# jemalloc: ${jemalloc.version}"
-      mkdir $out
-    '';
-  };
-
   meta = with lib; {
     description = "An enterprise-grade Java-based, Apache 2.0 licensed Ethereum client";
     homepage = "https://www.hyperledger.org/projects/besu";
@@ -46,4 +27,4 @@ stdenv.mkDerivation (finalAttrs: rec {
     platforms = platforms.all;
     maintainers = with maintainers; [ mmahut ];
   };
-})
+}

pkgs/applications/blockchains/ledger-live-desktop/default.nix

@@ -2,11 +2,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.81.2";
+  version = "2.80.0";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-dnlIIOOYmCN209avQFMcoekB7nJpc2dJnS2OBI+dq7E=";
+    hash = "sha256-mtvLrA2wQM1om9En16/4AQFeddcRDoEyOwrefo5tOkk=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/applications/blockchains/optimism/default.nix

@@ -6,19 +6,19 @@
 
 buildGoModule rec {
   pname = "optimism";
-  version = "1.7.6";
+  version = "1.7.4";
 
   src = fetchFromGitHub {
     owner = "ethereum-optimism";
     repo = "optimism";
     rev = "op-node/v${version}";
-    hash = "sha256-LpkmNJqPe73qbTNvqxlDDTh9hD/H39ll3Rn2NEFEcg8=";
+    hash = "sha256-220fnMJDgvdGJtN0XkKtqNP94KfbmN5qhghfjHJaAxQ=";
     fetchSubmodules = true;
   };
 
   subPackages = [ "op-node/cmd" "op-proposer/cmd" "op-batcher/cmd" ];
 
-  vendorHash = "sha256-2eVwGWw/z6ct3PA8fC0rBwkNaICd20llVE/9essF95Q=";
+  vendorHash = "sha256-yG910xpk2MHCD2LHh7aD09KMCux1X252fOHCsyUc/ks=";
 
   buildInputs = [
     libpcap

pkgs/applications/display-managers/lemurs/default.nix

@@ -19,6 +19,9 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-uuHPJe+1VsnLRGbHtgTMrib6Tk359cwTDVfvtHnDToo=";
 
+  # Fixes a lock issue
+  preConfigure = "cargo update --offline";
+
   buildInputs = [
     linux-pam
   ];