doc/as-a-function: Command line us of system and crossSystem are ok

This new interface has already been applied successfully in NixOS.
`nixos-generate-hardware` has been generating the "default" hostPlatform
in `hardware-configuration.nix` for over a year now [without much trouble],
and with the benefit of not having to specify `system` (or similar) in
`nixosSystem` anymore.
Furthermore, the `hostPlatform` option is always defined and reliably
produces the host platform for users who don't use the legacy options.
This is in contrast to `nixpkgs.crossSystem`, which is usually not
even defined, and `nixpkgs.localSystem` which is usually the wrong
platform to refer to in a config file.

Ideally we'd clean up the `nixpkgs.{system,localSystem,crossSystem}`
options to reduce complexity and confusion. But the interface in
Nixpkgs is still based on the old terminology and behavior.
By introducing these parameters also in Nixpkgs, the users' experience
with NixOS carries over to Nixpkgs as well.

Further simplifications in the code base are now possible, specifically

- stage.nix and related files still work with {local,cross}System,
  and have logic like

      ${if stdenv.hostPlatform == stdenv.buildPlatform
        then "localSystem" else "crossSystem"} = <...>

  ... which is really just

      hostPlatform = <...>

  This can now be simplified by refactoring this code to work with
  {host,build}Platform variables instead.

- NixOS can forward its platform options directly to its Nixpkgs call.
  This pays off when the `*[sS]ystem` options are removed.

[without much trouble]: https://github.com/NixOS/nixpkgs/pull/237218

.git-blame-ignore-revs

@@ -171,3 +171,6 @@ cffc27daf06c77c0d76bc35d24b929cb9d68c3c9
 
 # nixos/kanidm: inherit lib, nixfmt
 8f18393d380079904d072007fb19dc64baef0a3a
+
+# fetchurl: nixfmt-rfc-style
+ce21e97a1f20dee15da85c084f9d1148d84f853b

.github/CODEOWNERS

@@ -100,8 +100,6 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 /nixos/lib/eval-config.nix                            @infinisil
 /nixos/modules/system/activation/bootspec.nix         @grahamc @cole-h @raitobezarius
 /nixos/modules/system/activation/bootspec.cue         @grahamc @cole-h @raitobezarius
-/nixos/modules/misc/nixpkgs.nix                       @roberth
-/nixos/modules/misc/nixpkgs/read-only.nix             @roberth
 
 # NixOS integration test driver
 /nixos/lib/test-driver  @tfc
@@ -122,7 +120,8 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 /nixos/modules/system/boot/loader/systemd-boot      @JulienMalka
 
 # Images and installer media
-/nixos/modules/installer/cd-dvd/
+/nixos/modules/profiles/installation-device.nix @ElvishJerricco
+/nixos/modules/installer/cd-dvd/                @ElvishJerricco
 /nixos/modules/installer/sd-card/
 
 # Updaters
@@ -164,7 +163,7 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 
 # C compilers
 /pkgs/development/compilers/gcc
-/pkgs/development/compilers/llvm @RossComputerGuy
+/pkgs/development/compilers/llvm @alyssais @RossComputerGuy
 /pkgs/development/compilers/emscripten @raitobezarius
 /doc/languages-frameworks/emscripten.section.md @raitobezarius
 
@@ -338,9 +337,6 @@ pkgs/by-name/fo/forgejo/                @adamcstephens @bendlas @emilylange
 /pkgs/build-support/node/fetch-npm-deps         @winterqt
 /doc/languages-frameworks/javascript.section.md @winterqt
 
-# environment.noXlibs option aka NoX
-/nixos/modules/config/no-x-libs.nix  @SuperSandro2000
-
 # OCaml
 /pkgs/build-support/ocaml           @ulrikstrid
 /pkgs/development/compilers/ocaml   @ulrikstrid

.github/labeler.yml

@@ -380,6 +380,17 @@
       - any-glob-to-any-file:
         - pkgs/applications/editors/vscode/**/*
 
+"6.topic: xen-project":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - nixos/modules/virtualisation/xen*
+        - pkgs/applications/virtualization/xen/**
+        - pkgs/by-name/xe/xen-guest-agent/*
+        - pkgs/by-name/xt/xtf/*
+        - pkgs/development/ocaml-modules/xen*/*
+        - pkgs/development/ocaml-modules/vchan/*
+
 "6.topic: xfce":
   - any:
     - changed-files:

.mailmap

@@ -1,6 +1,9 @@
 ajs124 <git@ajs124.de> <ajs124@users.noreply.github.com>
 Anderson Torres <torres.anderson.85@protonmail.com>
 Atemu <git@atemu.net> <atemu.main@gmail.com>
+Christina Sørensen <christina@cafkafk.com>
+Christina Sørensen <christina@cafkafk.com> <christinaafk@gmail.com>
+Christina Sørensen <christina@cafkafk.com> <89321978+cafkafk@users.noreply.github.com>
 Daniel Løvbrøtte Olsen <me@dandellion.xyz> <daniel.olsen99@gmail.com>
 Fabian Affolter <mail@fabian-affolter.ch> <fabian@affolter-engineering.ch>
 goatastronaut0212 <goatastronaut0212@outlook.com> <goatastronaut0212@proton.me>

doc/build-helpers/images/dockertools.section.md

@@ -453,7 +453,7 @@ See [](#ex-dockerTools-streamLayeredImage-exploringlayers) to understand how the
 `streamLayeredImage` allows scripts to be run when creating the additional layer with symlinks, allowing custom behaviour to affect the final results of the image (see the documentation of the `extraCommands` and `fakeRootCommands` attributes).
 
 The resulting repository tarball will list a single image as specified by the `name` and `tag` attributes.
-By default, that image will use a static creation date (see documentation for the `created` attribute).
+By default, that image will use a static creation date (see documentation for the `created` and `mtime` attributes).
 This allows the function to produce reproducible images.
 
 ### Inputs {#ssec-pkgs-dockerTools-streamLayeredImage-inputs}
@@ -516,6 +516,7 @@ This allows the function to produce reproducible images.
 `created` (String; _optional_)
 
 : Specifies the time of creation of the generated image.
+  This date will be used for the image metadata.
   This should be either a date and time formatted according to [ISO-8601](https://en.wikipedia.org/wiki/ISO_8601) or `"now"`, in which case the current date will be used.
 
   :::{.caution}
@@ -524,6 +525,18 @@ This allows the function to produce reproducible images.
 
   _Default value:_ `"1970-01-01T00:00:01Z"`.
 
+`mtime` (String; _optional_)
+
+: Specifies the time used for the modification timestamp of files within the layers of the generated image.
+  This should be either a date and time formatted according to [ISO-8601](https://en.wikipedia.org/wiki/ISO_8601) or `"now"`, in which case the current date will be used.
+
+  :::{.caution}
+  Using a non-constant date will cause built layers to have a different hash each time, preventing deduplication.
+  Using `"now"` also means that the generated image will not be reproducible anymore (because the date will always change whenever it's built).
+  :::
+
+  _Default value:_ `"1970-01-01T00:00:01Z"`.
+
 `uid` (Number; _optional_) []{#dockerTools-buildLayeredImage-arg-uid}
 `gid` (Number; _optional_) []{#dockerTools-buildLayeredImage-arg-gid}
 `uname` (String; _optional_) []{#dockerTools-buildLayeredImage-arg-uname}

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -501,7 +501,7 @@ writeTextFile {
   text = ''
     Contents of File
   '';
-  destination = "share/my-file";
+  destination = "/share/my-file";
 }
 ```
 
@@ -586,7 +586,7 @@ writeTextFile {
     echo "hi"
   '';
   executable = true;
-  destination = "bin/my-script";
+  destination = "/bin/my-script";
 }
 ```
 
@@ -674,7 +674,7 @@ writeTextFile {
     echo "hi"
   '';
   executable = true;
-  destination = "bin/my-script";
+  destination = "/bin/my-script";
 }
 ```
 

doc/languages-frameworks/coq.section.md

@@ -23,12 +23,13 @@ The recommended way of defining a derivation for a Coq library, is to use the `c
   * if it is a string of the form `owner:branch` then it tries to download the `branch` of owner `owner` for a project of the same name using the same vcs, and the `version` attribute of the resulting derivation is set to `"dev"`, additionally if the owner is not provided (i.e. if the `owner:` prefix is missing), it defaults to the original owner of the package (see below),
   * if it is a string of the form `"#N"`, and the domain is github, then it tries to download the current head of the pull request `#N` from github,
 * `defaultVersion` (optional). Coq libraries may be compatible with some specific versions of Coq only. The `defaultVersion` attribute is used when no `version` is provided (or if `version = null`) to select the version of the library to use by default, depending on the context. This selection will mainly depend on a `coq` version number but also possibly on other packages versions (e.g. `mathcomp`). If its value ends up to be `null`, the package is marked for removal in end-user `coqPackages` attribute set.
-* `release` (optional, defaults to `{}`), lists all the known releases of the library and for each of them provides an attribute set with at least a `hash` attribute (you may put the empty string `""` in order to automatically insert a fake hash, this will trigger an error which will allow you to find the correct hash), each attribute set of the list of releases also takes optional overloading arguments for the fetcher as below (i.e.`domain`, `owner`, `repo`, `rev` assuming the default fetcher is used) and optional overrides for the result of the fetcher (i.e. `version` and `src`).
+* `release` (optional, defaults to `{}`), lists all the known releases of the library and for each of them provides an attribute set with at least a `hash` attribute (you may put the empty string `""` in order to automatically insert a fake hash, this will trigger an error which will allow you to find the correct hash), each attribute set of the list of releases also takes optional overloading arguments for the fetcher as below (i.e.`domain`, `owner`, `repo`, `rev`, `artifact` assuming the default fetcher is used) and optional overrides for the result of the fetcher (i.e. `version` and `src`).
 * `fetcher` (optional, defaults to a generic fetching mechanism supporting github or gitlab based infrastructures), is a function that takes at least an `owner`, a `repo`, a `rev`, and a `hash` and returns an attribute set with a `version` and `src`.
 * `repo` (optional, defaults to the value of `pname`),
 * `owner` (optional, defaults to `"coq-community"`).
 * `domain` (optional, defaults to `"github.com"`), domains including the strings `"github"` or `"gitlab"` in their names are automatically supported, otherwise, one must change the `fetcher` argument to support them (cf `pkgs/development/coq-modules/heq/default.nix` for an example),
 * `releaseRev` (optional, defaults to `(v: v)`), provides a default mapping from release names to revision hashes/branch names/tags,
+* `releaseArtifact` (optional, defaults to `(v: null)`), provides a default mapping from release names to artifact names (only works for github artifact for now),
 * `displayVersion` (optional), provides a way to alter the computation of `name` from `pname`, by explaining how to display version numbers,
 * `namePrefix` (optional, defaults to `[ "coq" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
 * `nativeBuildInputs` (optional), is a list of executables that are required to build the current derivation, in addition to the default ones (namely `which`, `dune` and `ocaml` depending on whether `useDune`, `useDuneifVersion` and `mlPlugin` are set).

doc/languages-frameworks/javascript.section.md

@@ -524,8 +524,8 @@ An example usage of the above attributes is:
   fetchYarnDeps,
   yarnConfigHook,
   yarnBuildHook,
+  yarnInstallHook,
   nodejs,
-  npmHooks,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -541,7 +541,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-mo8urQaWIHu33+r0Y7mL9mJ/aSe/5CihuIetTeDHEUQ=";
+    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
   };
 
   nativeBuildInputs = [

doc/using-nixpkgs.md

@@ -2,6 +2,7 @@
 
 ```{=include=} chapters
 using/platform-support.chapter.md
+using/as-a-function.chapter.md
 using/configuration.chapter.md
 using/overlays.chapter.md
 using/overrides.chapter.md

doc/using/as-a-function.chapter.md

@@ -0,0 +1,156 @@
+# Nixpkgs as a Function {#sec-nixpkgs-function}
+
+Depending on how you use Nixpkgs, you may interact with it as a [Nix function].
+The Nixpkgs function returns an attribute set containing mostly packages, but also other things, such as more package sets, and functions.
+This return value is often referred to with the identifier `pkgs`, and it has a marker attribute, `_type = "pkgs";`.
+
+The Nixpkgs function can be retrieved in multiple ways.
+
+In a setup with [Nix channels], you may look up the Nixpkgs files with [`<nixpkgs>`][Nix lookup path]; for example
+
+```console
+$ nix repl -f '<nixpkgs>'
+Added 21938 variables.
+nix-repl>
+```
+
+<!-- -f: abbreviated form because it is very frequently used -->
+[`nix repl`] [`-f`][`nix repl -f`] automatically imports the Nixpkgs function and invokes it for you.
+
+Most Nix commands accept [`--arg`] and [`--argstr`] options to pass arguments to the Nixpkgs function.
+
+In an expression, you can use the `import <nixpkgs> { }` syntax to import the Nixpkgs function, and immmediately [apply] it.
+
+```nix
+let
+  pkgs = import <nixpkgs> {
+    config = { allowUnfree = true; };
+  };
+in
+```
+
+Note that these examples so far have relied on the implicit, [impure] [`builtins.currentSystem`] variable to configure the package set to be able to run on your system.
+
+If you wish not to accidentally rely on the implicit [`builtins.currentSystem`] variable, and you'd like to avoid configuration in `~/.config/nixpkgs`, you may invoke `<nixpkgs/pkgs/top-level>` instead.
+
+To make sure you can reproduce your evaluations, you may use [pinning] or locking, such as provided by [`npins`] or [Flakes].
+
+## Arguments {#sec-nixpkgs-arguments}
+
+For historical reasons, the platform and cross compilation parameters can be specified in multiple ways.
+
+If you run Nix in pure mode, or if you work with expressions for multiple host platforms, you are recommended to use `hostPlatform` for native compilation (locally or on a remote machine), and both `hostPlatform` and `buildPlatform` for cross compilation.
+
+### `hostPlatform` and `buildPlatform` {#sec-nixpkgs-arguments-platforms}
+
+- `hostPlatform` is the platform for which the package set is built. This means that the binaries in the outputs are compatible with `hostPlatform`.
+
+  You may specify this as a cpu-os string, such as `"x86_64-linux"`, or `aarch64-darwin`, or you can pass a more details platform object produced with `lib.systems`.
+
+- `buildPlatform` (default: `hostPlatform`) is the platform on which the derivations will run. The derivations produced by Nixpkgs will have a [`system` attribute] that matches `buildPlatform`, so that builds are sent to a machine that is capable of running the `builder` command, which is also configured to be compatible with `buildPlatform`.
+
+  Values are specified in the same formats as `hostPlatform`.
+
+::: {.example #ex-nixpkgs-pure-native}
+
+# Natively compiled packages
+
+This shows how to explicitly request packages that are built for a specific platform, not relying on [`builtins.currentSystem`].
+The packages will be built natively.
+
+If you request to build this on a host that is not compatible, you need a remote builder.
+
+```nix
+let
+  pkgs = imports <nixpkgs> {
+    hostPlatform = "x86_64-linux";
+  };
+in pkgs.hello
+```
+
+:::
+
+::: {.example #ex-nixpkgs-pure-cross}
+
+# Cross compiled packages
+
+This expression will produce packages that are built on `x86_64-linux` machines, but whose outputs can run on `riscv64-linux`.
+
+The expression is pure, so it will produce the same outcome even if run on e.g. an `aarch64-darwin` machine. For that to work, the macOS machine needs the packages to be available in a cache or it needs a remote builder that can build `x86_64-linux` derivations.
+
+If you were to use [`builtins.currentSystem`] for `buildPlatform`, you would be able to build the packages directly on any machine, but the resulting store paths will be different, depending on the current system.
+Especially if you are in a team that doesn't run a single CPU architecture and operating system or you use Nix on machines of more than one platform, you might notice that equivalent deployments would have different store paths, resulting in unnecessary rebuilds, more store path copying, and unnecessary updates to equivalent configurations with different `buildPlatform`s.
+For these reason, it is recommended to use pure configurations where the platform parameters are set to fixed values for each deployment target.
+
+```nix
+let
+  pkgs = imports <nixpkgs> {
+    hostPlatform = "riscv64-linux";
+    buildPlatform = "x86_64-linux";
+  };
+in pkgs.hello
+```
+
+:::
+
+### Legacy arguments `system`, `localSystem` and `crossSystem` {#sec-nixpkgs-arguments-systems-legacy}
+
+`crossSystem` and `system` (or `localSystem`) are ok to use on the command line, but are not recommended for pure Nix code (such as Nix flakes), or Nix code that manages the invocation of the Nixpkgs function.
+
+These parameters existed before [`hostPlatform` and `buildPlatform`](#sec-nixpkgs-arguments-platforms) were introduced.
+They are still supported, but are not recommended for new code.
+
+The main difference is that these parameters default to [`builtins.currentSystem`], which does not work for pure code.
+
+Furthermore, their design is optimized for impure command line use.
+
+The term "local" is misleading, because it need not match the platform where the Nix command is run.
+
+The term "cross" is also misleading because its value may equal `localSystem`.
+
+Finally `crossSystem` may have to be unset as an input, complicating some code that calls the Nixpkgs function.
+<!-- This example transgresses the guidelines a bit, but we have an audience here that needs answers, because who likes change. Without explanation, this comes across as a superficial, unnecessary and annoying change. Remove this example in 2026 when it is irrelevant. -->
+For example, [`nixos-generate-config`] wasn't initially able to set the platform in `hardware-configuration.nix` without making assumptions about cross versus native compilation, resulting in a need for you to manually specify `system` when Flakes were introduced.
+
+### `config` {#sec-nixpkgs-arguments-config}
+
+Example:
+
+```nix
+import <nixpkgs> { config = { allowUnfree = true; }; }
+```
+
+See [Configuration](#sec-config-options-reference) for details.
+
+### `overlays` {#sec-nixpkgs-arguments-overlays}
+
+Overlays are expressions that modify the package set.
+
+See [Overlays](#chap-overlays) for more information.
+
+### `crossOverlays` {#sec-nixpkgs-arguments-crossOverlays}
+
+<!-- Source: https://matthewbauer.us/slides/always-be-cross-compiling.pdf -->
+Cross overlays apply only to the final package set in cross compilation.
+This means that [`buildPackages`] and [`nativeBuildInputs`] are unaffected by these overlays and this increases the number of build dependencies that can be retrieved from the cache, or can be reused from a previous build.
+
+[Nix function]: https://nix.dev/manual/nix/latest/language/constructs.html#functions
+[Nix channels]: https://nix.dev/manual/nix/latest/command-ref/nix-channel.html
+[Nix lookup path]: https://nix.dev/manual/nix/latest/language/constructs/lookup-path.html
+[`builtins.currentSystem`]: https://nix.dev/manual/nix/latest/language/builtin-constants.html#builtins-currentSystem
+[`system` attribute]: https://nix.dev/manual/nix/latest/language/derivations#attr-system
+[`--arg`]: https://nix.dev/manual/nix/latest/command-ref/opt-common.html?highlight=--arg#opt-arg
+[`--argstr`]: https://nix.dev/manual/nix/latest/command-ref/opt-common.html?highlight=--argstr#opt-argstr
+[apply]: https://nix.dev/manual/nix/latest/language/operators
+[impure]: https://nix.dev/manual/nix/latest/command-ref/conf-file.html?highlight=pure-eval#conf-pure-eval
+[`npins`]: https://nix.dev/guides/recipes/dependency-management.html
+[Flakes]: https://nix.dev/concepts/flakes.html#flakes
+[pinning]: https://nix.dev/reference/pinning-nixpkgs.html
+<!-- TODO: publish NixOS man pages -->
+[`nixos-generate-config`]: https://nixos.org/manual/nixos/stable/#sec-installation
+<!-- TODO: make more specific -->
+[`buildPackages`]: #ssec-cross-dependency-implementation
+<!-- TODO: make more specific -->
+[`nativeBuildInputs`]: #ssec-stdenv-dependencies-propagated
+[`nix repl`]: https://nix.dev/manual/nix/latest/command-ref/new-cli/nix3-repl.html
+[`nix repl -f`]: https://nix.dev/manual/nix/latest/command-ref/new-cli/nix3-repl?highlight=--file#opt-file

flake.nix

@@ -16,10 +16,44 @@
       });
     in
     {
+      /**
+        `nixpkgs.lib` is a combination of the [Nixpkgs library](https://nixos.org/manual/nixpkgs/unstable/#id-1.4), and other attributes
+        that are _not_ part of the Nixpkgs library, but part of the Nixpkgs flake:
+
+        - `lib.nixosSystem` for creating a NixOS system configuration
+
+        - `lib.nixos` for other NixOS-provided functionality, such as [`runTest`](https://nixos.org/manual/nixos/unstable/#sec-call-nixos-test-outside-nixos)
+      */
       lib = lib.extend (final: prev: {
 
+        /**
+          Other NixOS-provided functionality, such as [`runTest`](https://nixos.org/manual/nixos/unstable/#sec-call-nixos-test-outside-nixos).
+          See also `lib.nixosSystem`.
+        */
         nixos = import ./nixos/lib { lib = final; };
 
+        /**
+          Create a NixOS system configuration.
+
+          Example:
+
+              lib.nixosSystem {
+                modules = [ ./configuration.nix ];
+              }
+
+          Inputs:
+
+          - `modules` (list of paths or inline modules): The NixOS modules to include in the system configuration.
+
+          - `specialArgs` (attribute set): Extra arguments to pass to all modules, that are available in `imports` but can not be extended or overridden by the `modules`.
+
+          - `modulesLocation` (path): A default location for modules that aren't passed by path, used for error messages.
+
+          Legacy inputs:
+
+          - `system`: Legacy alias for `nixpkgs.hostPlatform`, but this is already set in the generated `hardware-configuration.nix`, included by `configuration.nix`.
+          - `pkgs`: Legacy alias for `nixpkgs.pkgs`; use `nixpkgs.pkgs` and `nixosModules.readOnlyPkgs` instead.
+        */
         nixosSystem = args:
           import ./nixos/lib/eval-config.nix (
             {
@@ -47,7 +81,7 @@
       checks = forAllSystems (system: {
         tarball = jobs.${system}.tarball;
         # Exclude power64 due to "libressl is not available on the requested hostPlatform" with hostPlatform being power64
-      } // lib.optionalAttrs (self.legacyPackages.${system}.stdenv.isLinux && !self.legacyPackages.${system}.targetPlatform.isPower64) {
+      } // lib.optionalAttrs (self.legacyPackages.${system}.stdenv.hostPlatform.isLinux && !self.legacyPackages.${system}.targetPlatform.isPower64) {
         # Test that ensures that the nixosSystem function can accept a lib argument
         # Note: prefer not to extend or modify `lib`, especially if you want to share reusable modules
         #       alternatives include: `import` a file, or put a custom library in an option or in `_module.args.<libname>`
@@ -64,7 +98,7 @@
               boot.loader.grub.enable = false;
               fileSystems."/".device = "nodev";
               # See https://search.nixos.org/options?show=system.stateVersion&query=stateversion
-              system.stateVersion = lib.versions.majorMinor lib.version; # DON'T do this in real configs!
+              system.stateVersion = lib.trivial.release; # DON'T do this in real configs!
             })
           ];
         }).config.system.build.toplevel;
@@ -78,28 +112,56 @@
       };
 
       devShells = forAllSystems (system: {
+        /** A shell to get tooling for Nixpkgs development. See nixpkgs/shell.nix. */
         default = import ./shell.nix { inherit system; };
       });
 
-      # The "legacy" in `legacyPackages` doesn't imply that the packages exposed
-      # through this attribute are "legacy" packages. Instead, `legacyPackages`
-      # is used here as a substitute attribute name for `packages`. The problem
-      # with `packages` is that it makes operations like `nix flake show
-      # nixpkgs` unusably slow due to the sheer number of packages the Nix CLI
-      # needs to evaluate. But when the Nix CLI sees a `legacyPackages`
-      # attribute it displays `omitted` instead of evaluating all packages,
-      # which keeps `nix flake show` on Nixpkgs reasonably fast, though less
-      # information rich.
+      /**
+        A nested structure of [packages](https://nix.dev/manual/nix/latest/glossary#package-attribute-set) and other values.
+
+        The "legacy" in `legacyPackages` doesn't imply that the packages exposed
+        through this attribute are "legacy" packages. Instead, `legacyPackages`
+        is used here as a substitute attribute name for `packages`. The problem
+        with `packages` is that it makes operations like `nix flake show
+        nixpkgs` unusably slow due to the sheer number of packages the Nix CLI
+        needs to evaluate. But when the Nix CLI sees a `legacyPackages`
+        attribute it displays `omitted` instead of evaluating all packages,
+        which keeps `nix flake show` on Nixpkgs reasonably fast, though less
+        information rich.
+
+        The reason why finding the tree structure of `legacyPackages` is slow,
+        is that for each attribute in the tree, it is necessary to check whether
+        the attribute value is a package or a package set that needs further
+        evaluation. Evaluating the attribute value tends to require a significant
+        amount of computation, even considering lazy evaluation.
+      */
       legacyPackages = forAllSystems (system:
         (import ./. { inherit system; }).extend (final: prev: {
           lib = prev.lib.extend libVersionInfoOverlay;
         })
       );
 
+      /**
+        Optional modules that can be imported into a NixOS configuration.
+
+        Example:
+
+            # flake.nix
+            outputs = { nixpkgs, ... }: {
+              nixosConfigurations = {
+                foo = nixpkgs.lib.nixosSystem {
+                  modules = [
+                    ./foo/configuration.nix
+                    nixpkgs.nixosModules.notDetected
+                  ];
+                };
+              };
+            };
+        */
       nixosModules = {
         notDetected = ./nixos/modules/installer/scan/not-detected.nix;
 
-        /*
+        /**
           Make the `nixpkgs.*` configuration read-only. Guarantees that `pkgs`
           is the way you initialize it.
 

lib/licenses.nix

@@ -92,6 +92,11 @@ lib.mapAttrs mkLicense ({
     free = false;
   };
 
+  ampas = {
+    spdxId = "AMPAS";
+    fullName = "Academy of Motion Picture Arts and Sciences BSD";
+  };
+
   aom = {
     fullName = "Alliance for Open Media Patent License 1.0";
     url = "https://aomedia.org/license/patent-license/";

lib/tests/test-with-nix.nix

@@ -33,7 +33,7 @@ pkgs.runCommand "nixpkgs-lib-tests-nix-${nix.version}" {
   nativeBuildInputs = [
     nix
     pkgs.gitMinimal
-  ] ++ lib.optional pkgs.stdenv.isLinux pkgs.inotify-tools;
+  ] ++ lib.optional pkgs.stdenv.hostPlatform.isLinux pkgs.inotify-tools;
   strictDeps = true;
 } ''
   datadir="${nix}/share"

maintainers/maintainer-list.nix

@@ -1016,6 +1016,12 @@
     githubId = 50754358;
     name = "Alex Winter";
   };
+  alfarel = {
+    email = "alfarelcynthesis@proton.me";
+    github = "alfarelcynthesis";
+    githubId = 104072649;
+    name = "Cynth";
+  };
   algram = {
     email = "aliasgram@gmail.com";
     github = "Algram";
@@ -1028,12 +1034,6 @@
     githubId = 30437811;
     name = "Alex Andrews";
   };
-  alibabzo = {
-    email = "alistair.bill@gmail.com";
-    github = "alistairbill";
-    githubId = 2822871;
-    name = "Alistair Bill";
-  };
   alirezameskin = {
     email = "alireza.meskin@gmail.com";
     github = "alirezameskin";
@@ -2028,6 +2028,13 @@
     github = "Atry";
     githubId = 601530;
   };
+  attila = {
+    name = "Attila Oláh";
+    email = "attila@dorn.haus";
+    github = "attilaolah";
+    githubId = 196617;
+    keys = [ { fingerprint = "BF2E 4759 74D3 88E0 E30C  9604 07E6 C064 3FD1 42C3"; } ];
+  };
   auchter = {
     name = "Michael Auchter";
     email = "a@phire.org";
@@ -2514,6 +2521,12 @@
     githubId = 6145260;
     keys = [ { fingerprint = "804B 6CB8 AED5 61D9 3DAD  4DC5 E2F2 2C5E DF20 119D"; } ];
   };
+  benchand = {
+    name = "Ben Chand";
+    email = "BenChand1995@gmail.com";
+    github = "BenChand";
+    githubId = 3618457;
+  };
   bendlas = {
     email = "herwig@bendlas.net";
     matrix = "@bendlas:matrix.org";
@@ -2661,6 +2674,13 @@
     githubId = 7346933;
     name = "betaboon";
   };
+  beviu = {
+    name = "beviu";
+    email = "nixpkgs@beviu.com";
+    github = "beviu";
+    githubId = 56923875;
+    keys = [ { fingerprint = "30D6 A755 E3C3 5797 CBBB  05B6 CD20 2E66 5CAD 7D06"; } ];
+  };
   bew = {
     email = "benoit.dechezelles@gmail.com";
     github = "bew";
@@ -2733,6 +2753,13 @@
     githubId = 19915050;
     name = "binarycat";
   };
+  binary-eater = {
+    email = "sergeantsagara@protonmail.com";
+    github = "Binary-Eater";
+    githubId = 10691440;
+    name = "Rahul Rameshbabu";
+    keys = [ { fingerprint = "678A 8DF1 D9F2 B51B 7110  BE53 FF24 7B3E 5411 387B"; } ];
+  };
   binsky = {
     email = "timo@binsky.org";
     github = "binsky08";
@@ -2750,6 +2777,12 @@
     githubId = 10164833;
     name = "Birk Bohne";
   };
+  bjesus = {
+    email = "nixpkgs@yoavmoshe.com";
+    github = "bjesus";
+    githubId = 55081;
+    name = "Yo'av Moshe";
+  };
   bjornfor = {
     email = "bjorn.forsman@gmail.com";
     github = "bjornfor";
@@ -3306,6 +3339,12 @@
     githubId = 141733;
     name = "Andrew Bruce";
   };
+  camerondugan = {
+    email = "cameron.dugan@protonmail.com";
+    github = "camerondugan";
+    githubId = 54632731;
+    name = "Cameron Dugan";
+  };
   cameronfyfe = {
     email = "cameron.j.fyfe@gmail.com";
     github = "cameronfyfe";
@@ -3422,6 +3461,12 @@
     githubId = 5241813;
     name = "Carter Sande";
   };
+  casaca = {
+    name = "J McNutt";
+    email = "jmacasac@hotmail.com";
+    github = "casaca24";
+    githubId = 87252279;
+  };
   casey = {
     email = "casey@rodarmor.net";
     github = "casey";
@@ -6545,6 +6590,13 @@
     githubId = 195032;
     name = "Eric Evenchick";
   };
+  eveeifyeve = {
+    name = "Eveeifyeve";
+    github = "eveeifyeve";
+    githubId = 88671402;
+    matrix = "@eveeifyeve:matrix.org";
+    email = "eveeg1971@gmail.com";
+  };
   evenbrenden = {
     email = "packages@anythingexternal.com";
     github = "evenbrenden";
@@ -6881,6 +6933,12 @@
       { fingerprint = "elY15tXap1tddxbBVoUoAioe1u0RDWti5rc9cauSmwo"; }
     ];
   };
+  figboy9 = {
+    email = "figboy9@tuta.io";
+    github = "figboy9";
+    githubId = 52276064;
+    name = "figboy9";
+  };
   figsoda = {
     email = "figsoda@pm.me";
     matrix = "@figsoda:matrix.org";
@@ -7047,6 +7105,13 @@
     githubId = 5918766;
     name = "Franz Thoma";
   };
+  fnune = {
+    email = "fausto.nunez@mailbox.org";
+    github = "fnune";
+    githubId = 16181067;
+    name = "Fausto Núñez Alberro";
+    keys = [ { fingerprint = "668E 01D1 B129 3F42 0A0F  933A C880 6451 94A2 D562"; } ];
+  };
   foo-dogsquared = {
     email = "foodogsquared@foodogsquared.one";
     github = "foo-dogsquared";
@@ -8311,6 +8376,12 @@
     githubId = 287769;
     name = "Sergii Paryzhskyi";
   };
+  hehongbo = {
+    name = "Hongbo";
+    github = "hehongbo";
+    githubId = 665472;
+    matrix = "@hehongbo:matrix.org";
+  };
   heijligen = {
     email = "src@posteo.de";
     github = "heijligen";
@@ -9085,6 +9156,12 @@
     githubId = 54999;
     name = "Ariel Nunez";
   };
+  interdependence = {
+    email = "git@williamvandervalk.com";
+    github = "interdependence";
+    githubId = 45567423;
+    name = "William Vandervalk";
+  };
   Intuinewin = {
     email = "antoinelabarussias@gmail.com";
     github = "Intuinewin";
@@ -9116,6 +9193,12 @@
     githubId = 1817528;
     name = "Igor Polyakov";
   };
+  iosmanthus = {
+    email = "myosmanthustree@gmail.com";
+    github = "iosmanthus";
+    githubId = 16307070;
+    name = "iosmanthus";
+  };
   iquerejeta = {
     github = "iquerejeta";
     githubId = 31273774;
@@ -9313,6 +9396,13 @@
     github = "jacbart";
     githubId = 7909687;
   };
+  jacekpoz = {
+    name = "Jacek Poziemski";
+    email = "jacekpoz@proton.me";
+    matrix = "@jacekpoz:jacekpoz.pl";
+    github = "jacekpoz";
+    githubId = 64381190;
+  };
   jacfal = {
     name = "Jakub Pravda";
     email = "me@jakubpravda.net";
@@ -9853,6 +9943,11 @@
     githubId = 1061229;
     name = "Jiehong Ma";
   };
+  jigglycrumb = {
+    github = "jigglycrumb";
+    githubId = 1476865;
+    name = "jigglycrumb";
+  };
   jirkamarsik = {
     email = "jiri.marsik89@gmail.com";
     github = "jirkamarsik";
@@ -11823,6 +11918,12 @@
     githubId = 13804737;
     keys = [ { fingerprint = "7FE2 113A A08B 695A C8B8  DDE6 AE53 B4C2 E58E DD45"; } ];
   };
+  lgbishop = {
+    email = "lachlan.bishop@hotmail.com";
+    github = "lgbishop";
+    githubId = 125634066;
+    name = "Lachlan Bishop";
+  };
   lgcl = {
     email = "dev@lgcl.de";
     name = "Leon Vack";
@@ -12213,6 +12314,12 @@
     githubId = 8555953;
     name = "Laure Tavard";
   };
+  ltrump = {
+    email = "ltrump@163.com";
+    github = "L-Trump";
+    githubId = 37738631;
+    name = "Luo Chen";
+  };
   ltstf1re = {
     email = "ltstf1re@disroot.org";
     github = "lsf1re";
@@ -12258,6 +12365,12 @@
     githubId = 15693688;
     name = "Lucas Eduardo Wendt";
   };
+  lucastso10 = {
+    email = "lucastso10@gmail.com";
+    github = "lucastso10";
+    githubId = 84486266;
+    name = "Lucas Teixeira Soares";
+  };
   lucc = {
     email = "lucc+nix@posteo.de";
     github = "lucc";
@@ -13421,6 +13534,12 @@
     github = "Mephistophiles";
     githubId = 4850908;
   };
+  merrkry = {
+    email = "merrkry@tsubasa.moe";
+    name = "merrkry";
+    github = "merrkry";
+    githubId = 124278440;
+  };
   mevatron = {
     email = "mevatron@gmail.com";
     name = "mevatron";
@@ -13863,6 +13982,12 @@
     githubId = 4587373;
     name = "Mitchell Nordine";
   };
+  mithicspirit = {
+    email = "rpc01234@gmail.com";
+    github = "MithicSpirit";
+    githubId = 24192522;
+    name = "MithicSpirit";
+  };
   mjanczyk = {
     email = "m@dragonvr.pl";
     github = "mjanczyk";
@@ -13901,7 +14026,7 @@
     name = "Maciej Kazulak";
   };
   mkez = {
-    email = "matias.zwinger+nix@protonmail.com";
+    email = "matias+nix@zwinger.fi";
     github = "mk3z";
     githubId = 52108954;
     name = "Matias Zwinger";
@@ -15316,6 +15441,12 @@
     githubId = 5047052;
     name = "Niclas Hirschfeld";
   };
+  nwjsmith = {
+    email = "nate@theinternate.com";
+    github = "nwjsmith";
+    githubId = 1348;
+    name = "Nate Smith";
+  };
   nyabinary = {
     name = "Niko Cantero";
     email = "nyanbinary@keemail.me";
@@ -16200,6 +16331,12 @@
     githubId = 29493551;
     name = "Josh Peters";
   };
+  petertriho = {
+    email = "mail@petertriho.com";
+    github = "petertriho";
+    githubId = 7420227;
+    name = "Peter Tri Ho";
+  };
   peterwilli = {
     email = "peter@codebuffet.co";
     github = "peterwilli";
@@ -16569,6 +16706,12 @@
     githubId = 358550;
     name = "Philip Lykke Carlsen";
   };
+  plebhash = {
+    name = "plebhash";
+    email = "plebhash@proton.me";
+    github = "plebhash";
+    githubId = 147345153;
+  };
   pleshevskiy = {
     email = "dmitriy@pleshevski.ru";
     github = "pleshevskiy";
@@ -17373,6 +17516,12 @@
     githubId = 5653911;
     name = "Rampoina";
   };
+  rane = {
+    email = "rane+nix@junkyard.systems";
+    github = "digitalrane";
+    githubId = 1829286;
+    name = "Rane";
+  };
   ranfdev = {
     email = "ranfdev@gmail.com";
     name = "Lorenzo Miglietta";
@@ -18049,6 +18198,12 @@
     githubId = 17805516;
     name = "Rohan Rao";
   };
+  rolfschr = {
+    email = "rolf.schr@posteo.de";
+    github = "rolfschr";
+    githubId = 1188465;
+    name = "Rolf Schröder";
+  };
   rollf = {
     email = "rolf.schroeder@limbus-medtec.com";
     github = "rollf";
@@ -18111,12 +18266,6 @@
     github = "rosehobgoblin";
     githubId = 84164410;
   };
-  roshaen = {
-    name = "Roshan Kumar";
-    email = "roshaen09@gmail.com";
-    github = "roshaen";
-    githubId = 58213083;
-  };
   RossComputerGuy = {
     name = "Tristan Ross";
     email = "tristan.ross@midstall.com";
@@ -18604,6 +18753,13 @@
     githubId = 34161949;
     keys = [ { fingerprint = "155C F413 0129 C058 9A5F  5524 3658 73F2 F0C6 153B"; } ];
   };
+  sanana = {
+    email = "asya@waifu.club";
+    github = "AsyaTheAbove";
+    githubId = 40492846;
+    keys = [ { fingerprint = "B766 7717 1644 5ABC DE82  94AA 4679 BF7D CC04 4783"; } ];
+    name = "sanana the skenana";
+  };
   sander = {
     email = "s.vanderburg@tudelft.nl";
     github = "svanderburg";
@@ -19245,6 +19401,12 @@
     github = "kf5grd";
     githubId = 18297490;
   };
+  shogo = {
+    email = "shouryagoel10000@gmail.com";
+    github = "Sh0g0-1758";
+    githubId = 114918019;
+    name = "Shourya Goel";
+  };
   shortcord = {
     name = "Short Cord";
     email = "short@shortcord.com";
@@ -19911,6 +20073,12 @@
     github = "srounce";
     githubId = 60792;
   };
+  sshine = {
+    email = "simon@simonshine.dk";
+    github = "sshine";
+    githubId = 50879;
+    name = "Simon Shine";
+  };
   SShrike = {
     email = "severen@shrike.me";
     github = "severen";
@@ -22487,6 +22655,12 @@
     githubId = 24979302;
     name = "Vladimír Zahradník";
   };
+  wgunderwood = {
+    email = "wg.underwood13@gmail.com";
+    github = "WGUNDERWOOD";
+    githubId = 42812654;
+    name = "William Underwood";
+  };
   wheelsandmetal = {
     email = "jakob@schmutz.co.uk";
     github = "wheelsandmetal";
@@ -23189,6 +23363,12 @@
     github = "YoshiRulz";
     githubId = 13409956;
   };
+  youhaveme9 = {
+    name = "Roshan Kumar";
+    email = "roshaen09@gmail.com";
+    github = "youhaveme9";
+    githubId = 58213083;
+  };
   yrashk = {
     email = "yrashk@gmail.com";
     github = "yrashk";

maintainers/scripts/convert-to-import-cargo-lock/shell.nix

@@ -13,5 +13,5 @@ mkShell {
       clippy
       rustfmt
     ]
-    ++ lib.optional stdenv.isDarwin pkgs.libiconv;
+    ++ lib.optional stdenv.hostPlatform.isDarwin pkgs.libiconv;
 }

maintainers/scripts/luarocks-packages.csv

@@ -114,6 +114,7 @@ middleclass,,,,,,
 mimetypes,,,,,,
 mpack,,,,,,
 moonscript,https://raw.githubusercontent.com/leafo/moonscript/master/moonscript-dev-1.rockspec,,,,,arobyn
+neorg,,,,,,GaetanLepage
 neotest,,,,,,mrcjkb
 nlua,,,,,,teto
 nui.nvim,,,,,,mrcjkb

maintainers/team-list.nix

@@ -565,6 +565,7 @@ with lib.maintainers;
   linux-kernel = {
     members = [
       TredwellGit
+      k900
       ma27
       nequissimus
       qyliss
@@ -1021,6 +1022,19 @@ with lib.maintainers;
     shortName = "WDZ GmbH";
   };
 
+  xen = {
+    members = [
+      hehongbo
+      lach
+      rane
+      sigmasquadron
+    ];
+    scope = "Maintain the Xen Project Hypervisor and the related tooling ecosystem.";
+    shortName = "Xen Project Hypervisor";
+    enableFeatureFreezePing = true;
+    githubTeams = [ "xen-project" ];
+  };
+
   xfce = {
     members = [
       bobby285271

nixos/README.md

@@ -80,6 +80,7 @@ Reviewing process:
 
 - Ensure that all file paths [fit the guidelines](../CONTRIBUTING.md#file-naming-and-organisation).
 - Ensure that the module tests, if any, are succeeding.
+- Ensure that new module tests are added to the package `passthru.tests`.
 - Ensure that the introduced options are correct.
   - Type should be appropriate (string related types differs in their merging capabilities, `loaOf` and `string` types are deprecated).
   - Description, default and example should be provided.
@@ -95,7 +96,8 @@ Sample template for a new module review is provided below.
 ##### Reviewed points
 
 - [ ] module path fits the guidelines
-- [ ] module tests succeed on ARCHITECTURE
+- [ ] module tests, if any, succeed on ARCHITECTURE
+- [ ] module tests, if any, are added to package `passthru.tests`
 - [ ] options have appropriate types
 - [ ] options have default
 - [ ] options have example

nixos/doc/manual/configuration/linux-kernel.chapter.md

@@ -133,20 +133,3 @@ This section was moved to the [Nixpkgs manual](https://nixos.org/nixpkgs/manual#
 It's a common issue that the latest stable version of ZFS doesn't support the latest
 available Linux kernel. It is recommended to use the latest available LTS that's compatible
 with ZFS. Usually this is the default kernel provided by nixpkgs (i.e. `pkgs.linuxPackages`).
-
-Alternatively, it's possible to pin the system to the latest available kernel
-version _that is supported by ZFS_ like this:
-
-```nix
-{
-  boot.kernelPackages = pkgs.zfs.latestCompatibleLinuxPackages;
-}
-```
-
-Please note that the version this attribute points to isn't monotonic because the latest kernel
-version only refers to kernel versions supported by the Linux developers. In other words,
-the latest kernel version that ZFS is compatible with may decrease over time.
-
-An example: the latest version ZFS is compatible with is 5.19 which is a non-longterm version. When 5.19
-is out of maintenance, the latest supported kernel version is 5.15 because it's longterm and the versions
-5.16, 5.17 and 5.18 are already out of maintenance because they're non-longterm.

nixos/doc/manual/configuration/profiles/minimal.section.md

@@ -1,8 +1,6 @@
 # Minimal {#sec-profile-minimal}
 
 This profile defines a small NixOS configuration. It does not contain any
-graphical stuff. It's a very short file that enables
-[noXlibs](#opt-environment.noXlibs), sets
-[](#opt-i18n.supportedLocales) to
-only support the user-selected locale,
-and [disables packages' documentation](#opt-documentation.enable).
+graphical stuff. It's a very short file that sets [](#opt-i18n.supportedLocales)
+to only support the user-selected locale, and
+[disables packages' documentation](#opt-documentation.enable).

nixos/doc/manual/development/testing-installer.chapter.md

@@ -6,13 +6,13 @@ tedious, so here is a quick way to see if the installer works properly:
 ```ShellSession
 # mount -t tmpfs none /mnt
 # nixos-generate-config --root /mnt
-$ nix-build '<nixpkgs/nixos>' -A config.system.build.nixos-install
+$ nix-build '<nixpkgs>' -A nixos-install
 # ./result/bin/nixos-install
 ```
 
 To start a login shell in the new NixOS installation in `/mnt`:
 
 ```ShellSession
-$ nix-build '<nixpkgs/nixos>' -A config.system.build.nixos-enter
+$ nix-build '<nixpkgs>' -A nixos-enter
 # ./result/bin/nixos-enter
 ```

nixos/doc/manual/installation/installing.chapter.md

@@ -220,6 +220,8 @@ The NixOS installer ships with multiple partitioning tools. The examples
 below use `parted`, but also provides `fdisk`, `gdisk`, `cfdisk`, and
 `cgdisk`.
 
+Use the command 'lsblk' to find the name of your 'disk' device.
+
 The recommended partition scheme differs depending if the computer uses
 *Legacy Boot* or *UEFI*.
 

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -46,19 +46,22 @@
   If you experience any issues, please report them.
   The original Perl script can still be used for now by setting `system.switch.enableNg` to `false`.
 
-- The [Xen Hypervisor](https://xenproject.org) is once again available as a virtualisation option under [`virtualisation.xen`](#opt-virtualisation.xen.enable).
+- Support for mounting filesystems from block devices protected with [dm-verity](https://docs.kernel.org/admin-guide/device-mapper/verity.html)
+  was added through the `boot.initrd.systemd.dmVerity` option.
+
+- The [Xen Project Hypervisor](https://xenproject.org) is once again available as a virtualisation option under [`virtualisation.xen`](#opt-virtualisation.xen.enable).
   - This release includes Xen [4.17.5](https://wiki.xenproject.org/wiki/Xen_Project_4.17_Release_Notes), [4.18.3](https://wiki.xenproject.org/wiki/Xen_Project_4.18_Release_Notes) and [4.19.0](https://wiki.xenproject.org/wiki/Xen_Project_4.19_Release_Notes), as well as support for booting the hypervisor on EFI systems.
   ::: {.warning}
-      Booting into Xen through a legacy BIOS bootloader or with the legacy script-based Stage 1 initrd have been **deprecated**. Only EFI booting and the new systemd-based Stage 1 initrd are supported.
+    Booting into the Xen Project Hypervisor through a legacy BIOS bootloader or with the legacy script-based Stage 1 initrd have been **deprecated**. Only EFI booting and the new systemd-based Stage 1 initrd are supported.
   :::
   - There are two flavours of Xen available by default: `xen`, which includes all built-in components, and `xen-slim`, which replaces the built-in components with their Nixpkgs equivalents.
-    - The `qemu-xen-traditional` component has been deprecated by upstream Xen, and is no longer available in any of the Xen packages.
+    - The `qemu-xen-traditional` component has been deprecated by the upstream Xen Project, and is no longer available in any of the Xen Project Hypervisor packages.
   - The OCaml-based Xen Store can now be configured using  [`virtualisation.xen.store.settings`](#opt-virtualisation.xen.store.settings).
   - The `virtualisation.xen.bridge` options have been deprecated in this release cycle. Users who need network bridges are encouraged to set up their own networking configurations.
 
 ## New Modules {#sec-release-24.11-new-modules}
 
-- [TaskChampion Sync-Server](https://github.com/GothenburgBitFactory/taskchampion-sync-server), a [Taskwariror 3](https://taskwarrior.org/docs/upgrade-3/) sync server, replacing Taskwarrior 2's sync server named [`taskserver`](https://github.com/GothenburgBitFactory/taskserver).
+- [TaskChampion Sync-Server](https://github.com/GothenburgBitFactory/taskchampion-sync-server), a [Taskwarrior 3](https://taskwarrior.org/docs/upgrade-3/) sync server, replacing Taskwarrior 2's sync server named [`taskserver`](https://github.com/GothenburgBitFactory/taskserver).
 
 - [FlareSolverr](https://github.com/FlareSolverr/FlareSolverr), proxy server to bypass Cloudflare protection. Available as [services.flaresolverr](#opt-services.flaresolverr.enable) service.
 
@@ -105,6 +108,8 @@
 
 - [zeronsd](https://github.com/zerotier/zeronsd), a DNS server for ZeroTier users. Available with [services.zeronsd.servedNetworks](#opt-services.zeronsd.servedNetworks).
 
+- [Collabora Online](https://www.collaboraonline.com/), a collaborative online office suite based on LibreOffice technology. Available as [services.collabora-online](options.html#opt-services.collabora-online.enable).
+
 - [wg-access-server](https://github.com/freifunkMUC/wg-access-server/), an all-in-one WireGuard VPN solution with a web ui for connecting devices. Available at [services.wg-access-server](#opt-services.wg-access-server.enable).
 
 - [Pingvin Share](https://github.com/stonith404/pingvin-share), a self-hosted file sharing platform and an alternative for WeTransfer. Available as [services.pingvin-share](#opt-services.pingvin-share.enable).
@@ -146,8 +151,22 @@
 
 - [ToDesk](https://www.todesk.com/linux.html), a remote desktop applicaton. Available as [services.todesk.enable](#opt-services.todesk.enable).
 
+- [Dependency Track](https://dependencytrack.org/), an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Available as [services.dependency-track](option.html#opt-services.dependency-track).
+
+- [Immich](https://github.com/immich-app/immich), a self-hosted photo and video backup solution. Available as [services.immich](#opt-services.immich.enable).
+
+- [obs-studio](https://obsproject.com/), Free and open source software for video recording and live streaming. Available as [programs.obs-studio.enable](#opt-programs.obs-studio.enable).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
 
+- The `sound` options have been removed or renamed, as they had a lot of unintended side effects. See [below](#sec-release-24.11-migration-sound) for details.
+
+- The nvidia driver no longer defaults to the proprietary driver starting with version 560. You will need to manually set `hardware.nvidia.open` to select the proprietary or open driver.
+
+- All Cinnamon and XApp packages have been moved to top-level (i.e., `cinnamon.nemo` is now `nemo`).
+
+- All GNOME packages have been moved to top-level (i.e., `gnome.nautilus` is now `nautilus`).
+
 - `transmission` package has been aliased with a `trace` warning to `transmission_3`. Since [Transmission 4 has been released last year](https://github.com/transmission/transmission/releases/tag/4.0.0), and Transmission 3 will eventually go away, it was decided perform this warning alias to make people aware of the new version. The `services.transmission.package` defaults to `transmission_3` as well because the upgrade can cause data loss in certain specific usage patterns (examples: [#5153](https://github.com/transmission/transmission/issues/5153), [#6796](https://github.com/transmission/transmission/issues/6796)). Please make sure to back up to your data directory per your usage:
   - `transmission-gtk`: `~/.config/transmission`
   - `transmission-daemon` using NixOS module: `${config.services.transmission.home}/.config/transmission-daemon` (defaults to `/var/lib/transmission/.config/transmission-daemon`)
@@ -160,6 +179,8 @@
 
 - `services.kubernetes.kubelet.clusterDns` now accepts a list of DNS resolvers rather than a single string, bringing the module more in line with the upstream Kubelet configuration schema.
 
+- `bluemap` has changed the format used to store map tiles, and the database layout has been heavily modified. Upstream recommends a clean reinstallation: <https://github.com/BlueMap-Minecraft/BlueMap/releases/tag/v5.2>. Unless you are using an SQL storage backend, this should only entail deleting the contents of `config.services.bluemap.coreSettings.data` (defaults to `/var/lib/bluemap`) and `config.services.bluemap.webRoot` (defaults to `/var/lib/bluemap/web`).
+
 - `wstunnel` has had a major version upgrade that entailed rewriting the program in Rust.
   The module was updated to accommodate for breaking changes.
   Breaking changes to the module API were minimised as much as possible,
@@ -194,6 +215,8 @@
 
 - The `MSMTP_QUEUE` and `MSMTP_LOG` environment variables accepted by `msmtpq` have now been renamed to `MSMTPQ_Q` and `MSMTPQ_LOG` respectively.
 
+- The logrotate service has received hardening and now requires enabling `allowNetworking`, if logrotate needs to access the network.
+
 - The fcgiwrap module now allows multiple instances running as distinct users.
   The option `services.fgciwrap` now takes an attribute set of the
   configuration of each individual instance.
@@ -207,8 +230,6 @@
 - The `mautrix-signal` module was adapted to incorporate the configuration rearrangement that resulted from the update to the mautrix bridgev2 architecture. Pre-0.7.0 configurations should continue to work.
   In case you want to update your configuration make sure to check the NixOS manual.
 
-- The nvidia driver no longer defaults to the proprietary driver starting with version 560. You will need to manually set `hardware.nvidia.open` to select the proprietary or open driver.
-
 - `singularity-tools` have the `storeDir` argument removed from its override interface and use `builtins.storeDir` instead.
 
 - Two build helpers in `singularity-tools`, i.e., `mkLayer` and `shellScript`, are deprecated, as they are no longer involved in image-building. Maintainers will remove them in future releases.
@@ -222,10 +243,6 @@
 - The method to safely handle secrets in the `networking.wireless` module has been changed to benefit from a [new feature](https://w1.fi/cgit/hostap/commit/?id=e680a51e94a33591f61edb210926bcb71217a21a) of wpa_supplicant.
   The syntax to refer to secrets has changed slightly and the option `networking.wireless.environmentFile` has been replaced by `networking.wireless.secretsFile`; see the description of the latter for how to upgrade.
 
-- All Cinnamon and XApp packages have been moved to top-level (i.e., `cinnamon.nemo` is now `nemo`).
-
-- All GNOME packages have been moved to top-level (i.e., `gnome.nautilus` is now `nautilus`).
-
 - `services.cgit` now runs as the cgit user by default instead of root.
   This change requires granting access to the repositories to this user or
   setting the appropriate one through `services.cgit.some-instance.user`.
@@ -254,6 +271,9 @@
 
 - `pkgs.nextcloud27` has been removed since it's EOL.
 
+- The `environment.noXlibs` option has been removed. It was a common source of unexpected rebuilds and breakage that was often hard to diagnose.
+  If you need to disable certain libraries, you're encouraged to add your own overlay to your configuration that targets the packages you care about.
+
 - `frigate` was updated past 0.14.0. This release includes various breaking changes, so please go read the [release notes](https://github.com/blakeblackshear/frigate/releases/tag/v0.14.0).
    Most prominently access to the webinterface and API are now protected by authentication. Retrieve the auto-created
    admin account from the `frigate.service` journal after upgrading.
@@ -420,8 +440,6 @@
 
 - `services.roundcube.maxAttachmentSize` will multiply the value set with `1.37` to offset overhead introduced by the base64 encoding applied to attachments.
 
-- The `sound` options have been removed or renamed, as they had a lot of unintended side effects. See [below](#sec-release-24.11-migration-sound) for details.
-
 - The `services.mxisd` module has been removed as both [mxisd](https://github.com/kamax-matrix/mxisd) and [ma1sd](https://github.com/ma1uta/ma1sd) are not maintained any longer.
   Consequently the package `pkgs.ma1sd` has also been removed.
 
@@ -460,6 +478,8 @@
 
 - The `openlens` package got removed, suggested replacment `lens-desktop`
 
+- The `services.dnsmasq.extraConfig` option has been removed, as it had been deprecated for over 2 years. This option has been replaced by `services.dnsmasq.settings`.
+
 - The NixOS installation media no longer support the ReiserFS or JFS file systems by default.
 
 - Minimal installer ISOs are no longer built on the small channel.
@@ -467,6 +487,14 @@
 
 - The `isync` package has been updated to version `1.5.0`, which introduces some breaking changes. See the [compatibility concerns](https://sourceforge.net/projects/isync/files/isync/1.5.0/) for more details.
 
+- Legacy package `globalprotect-openconnect` 1.x and related module
+  `globalprotect-vpn` were dropped. Two new packages `gpauth` and `gpclient`
+  from the 2.x version of the GlobalProtect-openconnect project are added in its
+  place. The GUI components related to the project are non-free and not
+  packaged.
+
+- Compatible string matching for `hardware.deviceTree.overlays` has been changed to a more correct behavior. See [below](#sec-release-24.11-migration-dto-compatible) for details.
+
 ## Other Notable Changes {#sec-release-24.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -494,6 +522,9 @@
 
 - `lib.misc.mapAttrsFlatten` is now formally deprecated and will be removed in future releases; use the identical [`lib.attrsets.mapAttrsToList`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.attrsets.mapAttrsToList) instead.
 
+- Tailscale's `authKeyFile` can now have its corresponding parameters set through `config.services.tailscale.authKeyParameters`, allowing for non-ephemeral unsupervised deployment and more.
+  See [Registering new nodes using OAuth credentials](https://tailscale.com/kb/1215/oauth-clients#registering-new-nodes-using-oauth-credentials) for the supported options.
+
 - `nixosTests` now provide a working IPv6 setup for VLAN 1 by default.
 
 - Kanidm can now be provisioned using the new [`services.kanidm.provision`] option, but requires using a patched version available via `pkgs.kanidm.withSecretProvisioning`.
@@ -506,6 +537,8 @@
   The derivation now installs "impl" headers selectively instead of by a wildcard.
   Use `imgui.src` if you just want to access the unpacked sources.
 
+- Linux 4.19 has been removed because it will reach its end of life within the lifespan of 24.11
+
 - Unprivileged access to the kernel syslog via `dmesg` is now restricted by default. Users wanting to keep an
   unrestricted access to it can set `boot.kernel.sysctl."kernel.dmesg_restrict" = false`.
 
@@ -589,3 +622,22 @@ in {
   ];
 };
 ```
+
+### `hardware.deviceTree.overlays` compatible string matching {#sec-release-24.11-migration-dto-compatible}
+
+The original compatible string implementation in older NixOS versions relied on substring matching,
+which is incorrect for overlays with multiple compatible strings and other cases.
+
+The new behavior is consistent with what other tools already do - the overlay is considered applicable if,
+and only if, _any_ of the compatible strings in the overlay match _any_ of the compatible strings in the DT.
+
+To provide some examples:
+
+| Overlay `compatible` | DT `compatible` | Pre-24.11 behavior | Correct behavior | Notes                                      |
+|----------------------|-----------------|--------------------|------------------|--------------------------------------------|
+| `"foo"`              | `"foo", "bar"`  | match              | match            | Most common use case does not change       |
+| `"foo"`              | `"foobar"`      | match              | no match         | Substrings should not be matched           |
+| `"foo bar"`          | `"foo", "bar"`  | match              | no match         | Separators should not be matched to spaces |
+| `"foo", "bar"`       | `"baz", "bar"`  | no match           | match            | One compatible string matching is enough   |
+
+Note that this also allows writing overlays that explicitly apply to multiple boards.

nixos/lib/eval-config-minimal.nix

@@ -37,10 +37,7 @@ let
   #       In other words, only the public interface of nixos.evalModules
   #       is experimental.
   lib.evalModules {
-    inherit prefix;
-    modules = [
-      ../modules/misc/meta.nix
-    ] ++ modules;
+    inherit prefix modules;
     class = "nixos";
     specialArgs = {
       modulesPath = builtins.toString ../modules;

nixos/lib/make-disk-image.nix

@@ -321,7 +321,7 @@ let format' = format; in let
       e2fsprogs
       lkl
       config.system.build.nixos-install
-      config.system.build.nixos-enter
+      nixos-enter
       nix
       systemdMinimal
     ]

nixos/lib/make-multi-disk-zfs-image.nix

@@ -124,7 +124,7 @@ let
 
   tools = lib.makeBinPath (
     with pkgs; [
-      config.system.build.nixos-enter
+      nixos-enter
       config.system.build.nixos-install
       dosfstools
       e2fsprogs

nixos/lib/make-single-disk-zfs-image.nix

@@ -112,7 +112,7 @@ let
 
   tools = lib.makeBinPath (
     with pkgs; [
-      config.system.build.nixos-enter
+      nixos-enter
       config.system.build.nixos-install
       dosfstools
       e2fsprogs

nixos/modules/config/fonts/fontconfig.nix

@@ -52,7 +52,7 @@ let
         ${lib.optionalString (pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform) ''
         <!-- Pre-generated font caches -->
         <cachedir>${cache}</cachedir>
-        ${lib.optionalString (pkgs.stdenv.isx86_64 && cfg.cache32Bit) ''
+        ${lib.optionalString (pkgs.stdenv.hostPlatform.isx86_64 && cfg.cache32Bit) ''
           <cachedir>${cache32}</cachedir>
         ''}
         ''}

nixos/modules/config/ldso.nix

@@ -32,7 +32,7 @@ in {
 
   config = {
     assertions = [
-      { assertion = isNull config.environment.ldso32 || pkgs.stdenv.isx86_64;
+      { assertion = isNull config.environment.ldso32 || pkgs.stdenv.hostPlatform.isx86_64;
         message = "Option environment.ldso32 currently only works on x86_64.";
       }
     ];
@@ -44,7 +44,7 @@ in {
         "d /${libDir} 0755 root root - -"
         "L+ /${libDir}/${ldsoBasename} - - - - ${config.environment.ldso}"
       ]
-    ) ++ optionals pkgs.stdenv.isx86_64 (
+    ) ++ optionals pkgs.stdenv.hostPlatform.isx86_64 (
       if isNull config.environment.ldso32 then [
         "r /${libDir32}/${ldsoBasename32} - - - - -"
       ] else [

nixos/modules/config/no-x-libs.nix

@@ -1,91 +0,0 @@
-# This module gets rid of all dependencies on X11 client libraries
-# (including fontconfig).
-{ config, lib, ... }:
-{
-  options = {
-    environment.noXlibs = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = ''
-        Switch off the options in the default configuration that
-        require X11 libraries. This includes client-side font
-        configuration and SSH forwarding of X11 authentication
-        in. Thus, you probably do not want to enable this option if
-        you want to run X11 programs on this machine via SSH.
-      '';
-    };
-  };
-
-  config = lib.mkIf config.environment.noXlibs {
-    programs.ssh.setXAuthLocation = false;
-    security.pam.services.su.forwardXAuth = lib.mkForce false;
-
-    fonts.fontconfig.enable = false;
-
-    nixpkgs.overlays = lib.singleton (lib.const (super: {
-      beam = super.beam_nox;
-      cairo = super.cairo.override { x11Support = false; };
-      dbus = super.dbus.override { x11Support = false; };
-      fastfetch = super.fastfetch.override { vulkanSupport = false; waylandSupport = false; x11Support = false; };
-      ffmpeg = super.ffmpeg.override { ffmpegVariant = "headless"; };
-      ffmpeg_4 = super.ffmpeg_4.override { ffmpegVariant = "headless"; };
-      ffmpeg_6 = super.ffmpeg_6.override { ffmpegVariant = "headless"; };
-      ffmpeg_7 = super.ffmpeg_7.override { ffmpegVariant = "headless"; };
-      # dep of graphviz, libXpm is optional for Xpm support
-      gd = super.gd.override { withXorg = false; };
-      ghostscript = super.ghostscript.override { cupsSupport = false; x11Support = false; };
-      gjs = (super.gjs.override { installTests = false; }).overrideAttrs { doCheck = false; }; # avoid test dependency on gtk3
-      gobject-introspection = super.gobject-introspection.override { x11Support = false; };
-      gpg-tui = super.gpg-tui.override { x11Support = false; };
-      gpsd = super.gpsd.override { guiSupport = false; };
-      graphviz = super.graphviz-nox;
-      gst_all_1 = super.gst_all_1 // {
-        gst-plugins-bad = super.gst_all_1.gst-plugins-bad.override { guiSupport = false; };
-        gst-plugins-base = super.gst_all_1.gst-plugins-base.override { enableGl = false; enableWayland = false; enableX11 = false; };
-        gst-plugins-good = super.gst_all_1.gst-plugins-good.override { enableWayland = false; enableX11 = false; gtkSupport = false; qt5Support = false; qt6Support = false; };
-        gst-plugins-rs = super.gst_all_1.gst-plugins-rs.override { withGtkPlugins = false; };
-      };
-      imagemagick = super.imagemagick.override { libX11Support = false; libXtSupport = false; };
-      imagemagickBig = super.imagemagickBig.override { libX11Support = false; libXtSupport = false; };
-      intel-vaapi-driver = super.intel-vaapi-driver.override { enableGui = false; };
-      libdevil = super.libdevil-nox;
-      libextractor = super.libextractor.override { gtkSupport = false; };
-      libplacebo = super.libplacebo.override { vulkanSupport = false; };
-      libva = super.libva-minimal;
-      limesuite = super.limesuite.override { withGui = false; };
-      mc = super.mc.override { x11Support = false; };
-      mpv-unwrapped = super.mpv-unwrapped.override { drmSupport = false; screenSaverSupport = false; sdl2Support = false; vulkanSupport = false; waylandSupport = false; x11Support = false; };
-      msmtp = super.msmtp.override { withKeyring = false; };
-      mupdf = super.mupdf.override { enableGL = false; enableX11 = false; };
-      neofetch = super.neofetch.override { x11Support = false; };
-      networkmanager-fortisslvpn = super.networkmanager-fortisslvpn.override { withGnome = false; };
-      networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
-      networkmanager-l2tp = super.networkmanager-l2tp.override { withGnome = false; };
-      networkmanager-openconnect = super.networkmanager-openconnect.override { withGnome = false; };
-      networkmanager-openvpn = super.networkmanager-openvpn.override { withGnome = false; };
-      networkmanager-sstp = super.networkmanager-vpnc.override { withGnome = false; };
-      networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
-      pango = super.pango.override { x11Support = false; };
-      pinentry-curses = super.pinentry-curses.override { withLibsecret = false; };
-      pinentry-tty = super.pinentry-tty.override { withLibsecret = false; };
-      pipewire = super.pipewire.override { vulkanSupport = false; x11Support = false; };
-      pythonPackagesExtensions = super.pythonPackagesExtensions ++ [
-        (python-final: python-prev: {
-          # tk feature requires wayland which fails to compile
-          matplotlib = python-prev.matplotlib.override { enableTk = false; };
-        })
-      ];
-      qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; };
-      qrencode = super.qrencode.overrideAttrs (_: { doCheck = false; });
-      qt5 = super.qt5.overrideScope (lib.const (super': {
-        qtbase = super'.qtbase.override { withGtk3 = false; withQttranslation = false; };
-      }));
-      stoken = super.stoken.override { withGTK3 = false; };
-      # translateManpages -> perlPackages.po4a -> texlive-combined-basic -> texlive-core-big -> libX11
-      util-linux = super.util-linux.override { translateManpages = false; };
-      vim-full = super.vim-full.override { guiSupport = false; };
-      vte = super.vte.override { gtkVersion = null; };
-      zbar = super.zbar.override { enableVideo = false; withXorg = false; };
-    }));
-  };
-}

nixos/modules/config/pulseaudio.nix

@@ -12,7 +12,7 @@ let
 
   # Forces 32bit pulseaudio and alsa-plugins to be built/supported for apps
   # using 32bit alsa on 64bit linux.
-  enable32BitAlsaPlugins = cfg.support32Bit && pkgs.stdenv.isx86_64 && (pkgs.pkgsi686Linux.alsa-lib != null && pkgs.pkgsi686Linux.libpulseaudio != null);
+  enable32BitAlsaPlugins = cfg.support32Bit && pkgs.stdenv.hostPlatform.isx86_64 && (pkgs.pkgsi686Linux.alsa-lib != null && pkgs.pkgsi686Linux.libpulseaudio != null);
 
 
   myConfigFile =

nixos/modules/config/stub-ld.nix

@@ -49,7 +49,7 @@ in {
 
   config = mkIf cfg.enable {
     environment.ldso = mkDefault stub-ld;
-    environment.ldso32 = mkIf pkgs.stdenv.isx86_64 (mkDefault stub-ld32);
+    environment.ldso32 = mkIf pkgs.stdenv.hostPlatform.isx86_64 (mkDefault stub-ld32);
   };
 
   meta.maintainers = with lib.maintainers; [ tejing ];

nixos/modules/config/xdg/icons.nix

@@ -13,6 +13,14 @@
         [XDG Icon Theme specification](https://specifications.freedesktop.org/icon-theme-spec/icon-theme-spec-latest.html).
       '';
     };
+    xdg.icons.fallbackCursorThemes = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [];
+      description = ''
+        Names of the fallback cursor themes, in order of preference, to be used when no other icon source can be found.
+        Set to `[]` to disable the fallback entirely.
+      '';
+    };
   };
 
   config = lib.mkIf config.xdg.icons.enable {
@@ -25,6 +33,15 @@
       # Empty icon theme that contains index.theme file describing directories
       # where toolkits should look for icons installed by apps.
       pkgs.hicolor-icon-theme
+    ] ++ lib.optionals (config.xdg.icons.fallbackCursorThemes != []) [
+      (pkgs.writeTextFile {
+        name = "fallback-cursor-theme";
+        text = ''
+          [Icon Theme]
+          Inherits=${lib.concatStringsSep "," config.xdg.icons.fallbackCursorThemes}
+        '';
+        destination = "/share/icons/default/index.theme";
+      })
     ];
 
     # libXcursor looks for cursors in XCURSOR_PATH

nixos/modules/hardware/graphics.nix

@@ -14,7 +14,7 @@ let
 in
 {
   imports = [
-    (lib.mkRenamedOptionModule [ "services" "xserver" "vaapiDrivers" ] [ "hardware" "opengl" "extraPackages" ])
+    (lib.mkRenamedOptionModule [ "services" "xserver" "vaapiDrivers" ] [ "hardware" "graphics" "extraPackages" ])
     (lib.mkRemovedOptionModule [ "hardware" "opengl" "s3tcSupport" ] "S3TC support is now always enabled in Mesa.")
     (lib.mkRemovedOptionModule [ "hardware" "opengl" "driSupport"] "The setting can be removed.")
 
@@ -100,7 +100,7 @@ in
   config = lib.mkIf cfg.enable {
     assertions = [
       {
-        assertion = cfg.enable32Bit -> pkgs.stdenv.isx86_64;
+        assertion = cfg.enable32Bit -> pkgs.stdenv.hostPlatform.isx86_64;
         message = "`hardware.graphics.enable32Bit` only makes sense on a 64-bit system.";
       }
       {
@@ -112,7 +112,7 @@ in
     systemd.tmpfiles.settings.graphics-driver = {
       "/run/opengl-driver"."L+".argument = toString driversEnv;
       "/run/opengl-driver-32" =
-        if pkgs.stdenv.isi686 then
+        if pkgs.stdenv.hostPlatform.isi686 then
           { "L+".argument = "opengl-driver"; }
         else if cfg.enable32Bit then
           { "L+".argument = toString driversEnv32; }

nixos/modules/image/assert_uki_repart_match.py

@@ -0,0 +1,78 @@
+import json
+import sys
+
+store_verity_type = "@NIX_STORE_VERITY@"  # replaced at import by Nix
+
+
+def extract_uki_cmdline_params(ukify_json: dict) -> dict[str, str]:
+    """
+    Return a dict of the parameters in the .cmdline section of the UKI
+    Exits early if "usrhash" is not included.
+    """
+    cmdline = ukify_json.get(".cmdline", {}).get("text")
+    if cmdline is None:
+        print("Failed to get cmdline from ukify output")
+
+    params = {}
+    for param in cmdline.split():
+        key, val = param.partition("=")[::2]
+        params[key] = val
+
+    if "usrhash" not in params:
+        print(
+            f"UKI cmdline does not contain a usrhash:\n{cmdline}"
+        )
+        exit(1)
+
+    return params
+
+
+def hashes_match(partition: dict[str, str], expected: str) -> bool:
+    """
+    Checks if the value of the "roothash" key in the passed partition object matches `expected`.
+    """
+    if partition.get("roothash") != expected:
+        pretty_part = json.dumps(partition, indent=2)
+        print(
+            f"hash mismatch, expected to find roothash {expected} in:\n{pretty_part}"
+        )
+        return False
+    else:
+        return True
+
+
+def check_partitions(
+    partitions: list[dict], uki_params: dict[str, str]
+) -> bool:
+    """
+    Checks if the usrhash from `uki_params` has a matching roothash
+    for the corresponding partition in `partitions`.
+    """
+    for part in partitions:
+        if part.get("type") == store_verity_type:
+            expected = uki_params["usrhash"]
+            return hashes_match(part, expected)
+
+    return False
+
+
+def main() -> None:
+    ukify_json = json.load(sys.stdin)
+    repart_json_output = sys.argv[1]
+
+    with open(repart_json_output, "r") as r:
+        repart_json = json.load(r)
+
+    uki_params = extract_uki_cmdline_params(ukify_json)
+
+    if check_partitions(repart_json, uki_params):
+        print("UKI and repart verity hashes match")
+    else:
+        print("Compatibility check for UKI and image failed!")
+        print(f"UKI cmdline parameters:\n{uki_params}")
+        print(f"repart config: {repart_json_output}")
+        exit(1)
+
+
+if __name__ == "__main__":
+    main()

nixos/modules/image/repart-verity-store.nix

@@ -0,0 +1,209 @@
+# opinionated module that can be used to build nixos images with
+# a dm-verity protected nix store
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.image.repart.verityStore;
+
+  verityMatchKey = "store";
+
+  # TODO: make these and other arch mappings available from systemd-lib for example
+  partitionTypes = {
+    usr =
+      {
+        "x86_64" = "usr-x86-64";
+        "arm64" = "usr-arm64";
+      }
+      ."${pkgs.stdenv.hostPlatform.linuxArch}";
+
+    usr-verity =
+      {
+        "x86_64" = "usr-x86-64-verity";
+        "arm64" = "usr-arm64-verity";
+      }
+      ."${pkgs.stdenv.hostPlatform.linuxArch}";
+  };
+
+  verityHashCheck =
+    pkgs.buildPackages.writers.writePython3Bin "assert_uki_repart_match.py"
+      {
+        flakeIgnore = [ "E501" ]; # ignores PEP8's line length limit of 79 (black defaults to 88 characters)
+      }
+      (
+        builtins.replaceStrings [ "@NIX_STORE_VERITY@" ] [
+          partitionTypes.usr-verity
+        ] (builtins.readFile ./assert_uki_repart_match.py)
+      );
+in
+{
+  options.image.repart.verityStore = {
+    enable = lib.mkEnableOption "building images with a dm-verity protected nix store";
+
+    ukiPath = lib.mkOption {
+      type = lib.types.str;
+      default = "/EFI/Linux/${config.system.boot.loader.ukiFile}";
+      defaultText = "/EFI/Linux/\${config.system.boot.loader.ukiFile}";
+      description = ''
+        Specify the location on the ESP where the UKI is placed.
+      '';
+    };
+
+    partitionIds = {
+      esp = lib.mkOption {
+        type = lib.types.str;
+        default = "00-esp";
+        description = ''
+          Specify the attribute name of the ESP.
+        '';
+      };
+      store-verity = lib.mkOption {
+        type = lib.types.str;
+        default = "10-store-verity";
+        description = ''
+          Specify the attribute name of the store's dm-verity hash partition.
+        '';
+      };
+      store = lib.mkOption {
+        type = lib.types.str;
+        default = "20-store";
+        description = ''
+          Specify the attribute name of the store partition.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.initrd.systemd.dmVerity.enable = true;
+
+    image.repart.partitions = {
+      # dm-verity hash partition
+      ${cfg.partitionIds.store-verity}.repartConfig = {
+        Type = partitionTypes.usr-verity;
+        Verity = "hash";
+        VerityMatchKey = lib.mkDefault verityMatchKey;
+        Label = lib.mkDefault "store-verity";
+      };
+      # dm-verity data partition that contains the nix store
+      ${cfg.partitionIds.store} = {
+        storePaths = [ config.system.build.toplevel ];
+        repartConfig = {
+          Type = partitionTypes.usr;
+          Verity = "data";
+          Format = lib.mkDefault "erofs";
+          VerityMatchKey = lib.mkDefault verityMatchKey;
+          Label = lib.mkDefault "store";
+        };
+      };
+
+    };
+
+    system.build = {
+
+      # intermediate system image without ESP
+      intermediateImage =
+        (config.system.build.image.override {
+          # always disable compression for the intermediate image
+          compression.enable = false;
+        }).overrideAttrs
+          (
+            _: previousAttrs: {
+              # make it easier to identify the intermediate image in build logs
+              pname = "${previousAttrs.pname}-intermediate";
+
+              # do not prepare the ESP, this is done in the final image
+              systemdRepartFlags = previousAttrs.systemdRepartFlags ++ [ "--defer-partitions=esp" ];
+
+              # the image will be self-contained so we can drop references
+              # to the closure that was used to build it
+              unsafeDiscardReferences.out = true;
+            }
+          );
+
+      # UKI with embedded usrhash from intermediateImage
+      uki =
+        let
+          inherit (config.system.boot.loader) ukiFile;
+          cmdline = "init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}";
+        in
+        # override the default UKI
+        lib.mkOverride 99 (
+          pkgs.runCommand ukiFile
+            {
+              nativeBuildInputs = [
+                pkgs.jq
+                pkgs.systemdUkify
+              ];
+            }
+            ''
+              mkdir -p $out
+
+              # Extract the usrhash from the output of the systemd-repart invocation for the intermediate image.
+              usrhash=$(jq -r \
+                '.[] | select(.type=="${partitionTypes.usr-verity}") | .roothash' \
+                ${config.system.build.intermediateImage}/repart-output.json
+              )
+
+              # Build UKI with the embedded usrhash.
+              ukify build \
+                  --config=${config.boot.uki.configFile} \
+                  --cmdline="${cmdline} usrhash=$usrhash" \
+                  --output="$out/${ukiFile}"
+            ''
+        );
+
+      # final system image that is created from the intermediate image by injecting the UKI from above
+      finalImage =
+        (config.system.build.image.override {
+          # continue building with existing intermediate image
+          createEmpty = false;
+        }).overrideAttrs
+          (
+            finalAttrs: previousAttrs:
+            let
+              copyUki = "CopyFiles=${config.system.build.uki}/${config.system.boot.loader.ukiFile}:${cfg.ukiPath}";
+            in
+            {
+              nativeBuildInputs = previousAttrs.nativeBuildInputs ++ [
+                pkgs.systemdUkify
+                verityHashCheck
+              ];
+
+              postPatch = ''
+                # add entry to inject UKI into ESP
+                echo '${copyUki}' >> $finalRepartDefinitions/${cfg.partitionIds.esp}.conf
+              '';
+
+              preBuild = ''
+                # check that we build the final image with the same intermediate image for
+                # which the injected UKI was built by comparing the UKI cmdline with the repart output
+                # of the intermediate image
+                #
+                # This is necessary to notice incompatible substitutions of
+                # non-reproducible store paths, for example when working with distributed
+                # builds, or when offline-signing the UKI.
+                ukify --json=short inspect ${config.system.build.uki}/${config.system.boot.loader.ukiFile} \
+                  | assert_uki_repart_match.py "${config.system.build.intermediateImage}/repart-output.json"
+
+                # copy the uncompressed intermediate image, so that systemd-repart picks it up
+                cp -v ${config.system.build.intermediateImage}/${config.image.repart.imageFileBasename}.raw .
+                chmod +w ${config.image.repart.imageFileBasename}.raw
+              '';
+
+              # the image will be self-contained so we can drop references
+              # to the closure that was used to build it
+              unsafeDiscardReferences.out = true;
+            }
+          );
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    nikstur
+    willibutz
+  ];
+}

nixos/modules/image/repart.nix

@@ -69,6 +69,10 @@ let
   }) opts;
 in
 {
+  imports = [
+    ./repart-verity-store.nix
+  ];
+
   options.image.repart = {
 
     name = lib.mkOption {

nixos/modules/installer/cd-dvd/iso-image.nix

@@ -772,9 +772,10 @@ in
     # here and it causes a cyclic dependency.
     boot.loader.grub.enable = false;
 
-    environment.systemPackages =  [ grubPkgs.grub2 grubPkgs.grub2_efi ]
+    environment.systemPackages =  [ grubPkgs.grub2 ]
       ++ lib.optional (config.isoImage.makeBiosBootable) pkgs.syslinux
     ;
+    system.extraDependencies = [ grubPkgs.grub2_efi ];
 
     # In stage 1 of the boot, mount the CD as the root FS by label so
     # that we don't need to know its device.  We pass the label of the

nixos/modules/installer/sd-card/sd-image.nix

@@ -150,6 +150,15 @@ in
         Whether to configure the sd image to expand it's partition on boot.
       '';
     };
+
+    nixPathRegistrationFile = mkOption {
+      type = types.str;
+      default = "/nix-path-registration";
+      description = ''
+        Location of the file containing the input for nix-store --load-db once the machine has booted.
+        If overriding fileSystems."/" then you should to set this to the root mount + /nix-path-registration
+      '';
+    };
   };
 
   config = {
@@ -255,11 +264,8 @@ in
       '';
     }) {};
 
-    boot.postBootCommands = lib.mkIf config.sdImage.expandOnBoot ''
-      # On the first boot do some maintenance tasks
-      if [ -f /nix-path-registration ]; then
-        set -euo pipefail
-        set -x
+    boot.postBootCommands = let
+      expandOnBoot = lib.optionalString config.sdImage.expandOnBoot ''
         # Figure out device names for the boot device and root filesystem.
         rootPart=$(${pkgs.util-linux}/bin/findmnt -n -o SOURCE /)
         bootDevice=$(lsblk -npo PKNAME $rootPart)
@@ -269,16 +275,25 @@ in
         echo ",+," | sfdisk -N$partNum --no-reread $bootDevice
         ${pkgs.parted}/bin/partprobe
         ${pkgs.e2fsprogs}/bin/resize2fs $rootPart
+      '';
+      nixPathRegistrationFile = config.sdImage.nixPathRegistrationFile;
+    in ''
+      # On the first boot do some maintenance tasks
+      if [ -f ${nixPathRegistrationFile} ]; then
+        set -euo pipefail
+        set -x
+
+        ${expandOnBoot}
 
         # Register the contents of the initial Nix store
-        ${config.nix.package.out}/bin/nix-store --load-db < /nix-path-registration
+        ${config.nix.package.out}/bin/nix-store --load-db < ${nixPathRegistrationFile}
 
         # nixos-rebuild also requires a "system" profile and an /etc/NIXOS tag.
         touch /etc/NIXOS
         ${config.nix.package.out}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
 
         # Prevents this from running on later boots.
-        rm -f /nix-path-registration
+        rm -f ${nixPathRegistrationFile}
       fi
     '';
   };

nixos/modules/installer/tools/nix-fallback-paths.nix

@@ -1,7 +1,7 @@
 {
-  x86_64-linux = "/nix/store/f409bhlpp0xkzvdz95qr2yvfjfi8r9jc-nix-2.18.5";
-  i686-linux = "/nix/store/ra39jzrxq3bcpf55aahwv5037akvylf5-nix-2.18.5";
-  aarch64-linux = "/nix/store/xiw8a4jbnw18svgdb04hyqzg5bsjspqf-nix-2.18.5";
-  x86_64-darwin = "/nix/store/k2gzx7i90x3h2c8g6xdi1jkwbl6ic895-nix-2.18.5";
-  aarch64-darwin = "/nix/store/rqwymbndaqxma6p8s5brcl9k32n5xx54-nix-2.18.5";
+  x86_64-linux = "/nix/store/vhv7ckr0winivvwfqxd54d6pgq2hx1is-nix-2.18.8";
+  i686-linux = "/nix/store/8x7rmgi225r5kygpf17swvk3vll0c61y-nix-2.18.8";
+  aarch64-linux = "/nix/store/sbyj0rb1wd314zfxpf834d0clvxrxmv3-nix-2.18.8";
+  x86_64-darwin = "/nix/store/vsy1wl865md71qv177nchj0aj5p26pkl-nix-2.18.8";
+  aarch64-darwin = "/nix/store/54kqc2da3fjyjgzab4vaszxjmdvii6yk-nix-2.18.8";
 }

nixos/modules/installer/tools/tools.nix

@@ -3,8 +3,6 @@
 
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
   makeProg = args: pkgs.substituteAll (args // {
     dir = "bin";
@@ -17,11 +15,6 @@ let
     '';
   });
 
-  inherit (pkgs) nixos-build-vms;
-
-  nixos-install = pkgs.nixos-install.override { nix = config.nix.package; };
-  nixos-rebuild = pkgs.nixos-rebuild.override { nix = config.nix.package.out; };
-
   nixos-generate-config = makeProg {
     name = "nixos-generate-config";
     src = ./nixos-generate-config.pl;
@@ -34,8 +27,6 @@ let
     manPage = ./manpages/nixos-generate-config.8;
   };
 
-  inherit (pkgs) nixos-option;
-
   nixos-version = makeProg {
     name = "nixos-version";
     src = ./nixos-version.sh;
@@ -44,23 +35,141 @@ let
     inherit (config.system) configurationRevision;
     json = builtins.toJSON ({
       nixosVersion = config.system.nixos.version;
-    } // optionalAttrs (config.system.nixos.revision != null) {
+    } // lib.optionalAttrs (config.system.nixos.revision != null) {
       nixpkgsRevision = config.system.nixos.revision;
-    } // optionalAttrs (config.system.configurationRevision != null) {
+    } // lib.optionalAttrs (config.system.configurationRevision != null) {
       configurationRevision = config.system.configurationRevision;
     });
     manPage = ./manpages/nixos-version.8;
   };
 
-  inherit (pkgs) nixos-enter;
+  nixos-install = pkgs.nixos-install.override { nix = config.nix.package; };
+  nixos-rebuild = pkgs.nixos-rebuild.override { nix = config.nix.package; };
+
+  defaultConfigTemplate = ''
+    # Edit this configuration file to define what should be installed on
+    # your system. Help is available in the configuration.nix(5) man page, on
+    # https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+    { config, lib, pkgs, ... }:
+
+    {
+      imports =
+        [ # Include the results of the hardware scan.
+          ./hardware-configuration.nix
+        ];
+
+    $bootLoaderConfig
+      # networking.hostName = "nixos"; # Define your hostname.
+      # Pick only one of the below networking options.
+      # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+      # networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
+
+      # Set your time zone.
+      # time.timeZone = "Europe/Amsterdam";
+
+      # Configure network proxy if necessary
+      # networking.proxy.default = "http://user:password\@proxy:port/";
+      # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+      # Select internationalisation properties.
+      # i18n.defaultLocale = "en_US.UTF-8";
+      # console = {
+      #   font = "Lat2-Terminus16";
+      #   keyMap = "us";
+      #   useXkbConfig = true; # use xkb.options in tty.
+      # };
+
+    $xserverConfig
+
+    $desktopConfiguration
+      # Configure keymap in X11
+      # services.xserver.xkb.layout = "us";
+      # services.xserver.xkb.options = "eurosign:e,caps:escape";
+
+      # Enable CUPS to print documents.
+      # services.printing.enable = true;
+
+      # Enable sound.
+      # hardware.pulseaudio.enable = true;
+      # OR
+      # services.pipewire = {
+      #   enable = true;
+      #   pulse.enable = true;
+      # };
+
+      # Enable touchpad support (enabled default in most desktopManager).
+      # services.libinput.enable = true;
+
+      # Define a user account. Don't forget to set a password with ‘passwd’.
+      # users.users.alice = {
+      #   isNormalUser = true;
+      #   extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+      #   packages = with pkgs; [
+      #     firefox
+      #     tree
+      #   ];
+      # };
+
+      # List packages installed in system profile. To search, run:
+      # \$ nix search wget
+      # environment.systemPackages = with pkgs; [
+      #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+      #   wget
+      # ];
+
+      # Some programs need SUID wrappers, can be configured further or are
+      # started in user sessions.
+      # programs.mtr.enable = true;
+      # programs.gnupg.agent = {
+      #   enable = true;
+      #   enableSSHSupport = true;
+      # };
+
+      # List services that you want to enable:
+
+      # Enable the OpenSSH daemon.
+      # services.openssh.enable = true;
+
+      # Open ports in the firewall.
+      # networking.firewall.allowedTCPPorts = [ ... ];
+      # networking.firewall.allowedUDPPorts = [ ... ];
+      # Or disable the firewall altogether.
+      # networking.firewall.enable = false;
+
+      # Copy the NixOS configuration file and link it from the resulting system
+      # (/run/current-system/configuration.nix). This is useful in case you
+      # accidentally delete configuration.nix.
+      # system.copySystemConfiguration = true;
+
+      # This option defines the first version of NixOS you have installed on this particular machine,
+      # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+      #
+      # Most users should NEVER change this value after the initial install, for any reason,
+      # even if you've upgraded your system to a new NixOS release.
+      #
+      # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+      # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+      # to actually do that.
+      #
+      # This value being lower than the current NixOS release does NOT mean your system is
+      # out of date, out of support, or vulnerable.
+      #
+      # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+      # and migrated your data accordingly.
+      #
+      # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+      system.stateVersion = "${config.system.nixos.release}"; # Did you read the comment?
+
+    }
+  '';
 in
-
 {
-
   options.system.nixos-generate-config = {
-    configuration = mkOption {
+    configuration = lib.mkOption {
       internal = true;
-      type = types.str;
+      type = lib.types.str;
+      default = defaultConfigTemplate;
       description = ''
         The NixOS module that `nixos-generate-config`
         saves to `/etc/nixos/configuration.nix`.
@@ -74,9 +183,9 @@ in
       '';
     };
 
-    desktopConfiguration = mkOption {
+    desktopConfiguration = lib.mkOption {
       internal = true;
-      type = types.listOf types.lines;
+      type = lib.types.listOf lib.types.lines;
       default = [];
       description = ''
         Text to preseed the desktop configuration that `nixos-generate-config`
@@ -92,9 +201,9 @@ in
     };
   };
 
-  options.system.disableInstallerTools = mkOption {
+  options.system.disableInstallerTools = lib.mkOption {
     internal = true;
-    type = types.bool;
+    type = lib.types.bool;
     default = false;
     description = ''
       Disable nixos-rebuild, nixos-generate-config, nixos-installer
@@ -104,145 +213,48 @@ in
     '';
   };
 
-  config = lib.mkMerge [ (lib.mkIf (config.nix.enable && !config.system.disableInstallerTools) {
+  imports = let
+    mkToolModule = { name, package ? pkgs.${name} }: { config, ... }: {
+      options.system.tools.${name}.enable = lib.mkEnableOption "${name} script" // {
+        default = config.nix.enable;
+        internal = true;
+      };
 
-    system.nixos-generate-config.configuration = mkDefault ''
-      # Edit this configuration file to define what should be installed on
-      # your system. Help is available in the configuration.nix(5) man page, on
-      # https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
-
-      { config, lib, pkgs, ... }:
-
-      {
-        imports =
-          [ # Include the results of the hardware scan.
-            ./hardware-configuration.nix
-          ];
-
-      $bootLoaderConfig
-        # networking.hostName = "nixos"; # Define your hostname.
-        # Pick only one of the below networking options.
-        # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-        # networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
-
-        # Set your time zone.
-        # time.timeZone = "Europe/Amsterdam";
-
-        # Configure network proxy if necessary
-        # networking.proxy.default = "http://user:password\@proxy:port/";
-        # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
-
-        # Select internationalisation properties.
-        # i18n.defaultLocale = "en_US.UTF-8";
-        # console = {
-        #   font = "Lat2-Terminus16";
-        #   keyMap = "us";
-        #   useXkbConfig = true; # use xkb.options in tty.
-        # };
-
-      $xserverConfig
-
-      $desktopConfiguration
-        # Configure keymap in X11
-        # services.xserver.xkb.layout = "us";
-        # services.xserver.xkb.options = "eurosign:e,caps:escape";
-
-        # Enable CUPS to print documents.
-        # services.printing.enable = true;
-
-        # Enable sound.
-        # hardware.pulseaudio.enable = true;
-        # OR
-        # services.pipewire = {
-        #   enable = true;
-        #   pulse.enable = true;
-        # };
-
-        # Enable touchpad support (enabled default in most desktopManager).
-        # services.libinput.enable = true;
-
-        # Define a user account. Don't forget to set a password with ‘passwd’.
-        # users.users.alice = {
-        #   isNormalUser = true;
-        #   extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
-        #   packages = with pkgs; [
-        #     firefox
-        #     tree
-        #   ];
-        # };
-
-        # List packages installed in system profile. To search, run:
-        # \$ nix search wget
-        # environment.systemPackages = with pkgs; [
-        #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
-        #   wget
-        # ];
-
-        # Some programs need SUID wrappers, can be configured further or are
-        # started in user sessions.
-        # programs.mtr.enable = true;
-        # programs.gnupg.agent = {
-        #   enable = true;
-        #   enableSSHSupport = true;
-        # };
-
-        # List services that you want to enable:
-
-        # Enable the OpenSSH daemon.
-        # services.openssh.enable = true;
-
-        # Open ports in the firewall.
-        # networking.firewall.allowedTCPPorts = [ ... ];
-        # networking.firewall.allowedUDPPorts = [ ... ];
-        # Or disable the firewall altogether.
-        # networking.firewall.enable = false;
-
-        # Copy the NixOS configuration file and link it from the resulting system
-        # (/run/current-system/configuration.nix). This is useful in case you
-        # accidentally delete configuration.nix.
-        # system.copySystemConfiguration = true;
-
-        # This option defines the first version of NixOS you have installed on this particular machine,
-        # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
-        #
-        # Most users should NEVER change this value after the initial install, for any reason,
-        # even if you've upgraded your system to a new NixOS release.
-        #
-        # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
-        # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
-        # to actually do that.
-        #
-        # This value being lower than the current NixOS release does NOT mean your system is
-        # out of date, out of support, or vulnerable.
-        #
-        # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
-        # and migrated your data accordingly.
-        #
-        # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
-        system.stateVersion = "${config.system.nixos.release}"; # Did you read the comment?
-
-      }
-    '';
-
-    environment.systemPackages =
-      [ nixos-build-vms
-        nixos-install
-        nixos-rebuild
-        nixos-generate-config
-        nixos-option
-        nixos-version
-        nixos-enter
-      ];
-
-    documentation.man.man-db.skipPackages = [ nixos-version ];
-
-  })
-
-  # These may be used in auxiliary scripts (ie not part of toplevel), so they are defined unconditionally.
-  ({
-    system.build = {
-      inherit nixos-install nixos-generate-config nixos-option nixos-rebuild nixos-enter;
+      config = lib.mkIf config.system.tools.${name}.enable {
+        environment.systemPackages = [ package ];
+      };
     };
-  })];
+  in [
+    (mkToolModule { name = "nixos-build-vms"; })
+    (mkToolModule { name = "nixos-enter"; })
+    (mkToolModule { name = "nixos-generate-config"; package = nixos-generate-config; })
+    (mkToolModule { name = "nixos-install"; package = nixos-install; })
+    (mkToolModule { name = "nixos-option"; })
+    (mkToolModule { name = "nixos-rebuild"; package = nixos-rebuild; })
+    (mkToolModule { name = "nixos-version"; package = nixos-version; })
+  ];
 
+  config = lib.mkMerge [
+    (lib.mkIf config.system.disableInstallerTools {
+      system.tools = {
+        nixos-build-vms.enable = false;
+        nixos-enter.enable = false;
+        nixos-generate-config.enable = false;
+        nixos-install.enable = false;
+        nixos-option.enable = false;
+        nixos-rebuild.enable = false;
+        nixos-version.enable = false;
+      };
+    })
+    {
+      documentation.man.man-db.skipPackages = [ nixos-version ];
+
+      # These may be used in auxiliary scripts (ie not part of toplevel), so they are defined unconditionally.
+      system.build = {
+        inherit nixos-generate-config nixos-install nixos-rebuild;
+        nixos-option = lib.warn "Accessing nixos-option through `config.system.build` is deprecated, use `pkgs.nixos-option` instead." pkgs.nixos-option;
+        nixos-enter = lib.warn "Accessing nixos-enter through `config.system.build` is deprecated, use `pkgs.nixos-enter` instead." pkgs.nixos-enter;
+      };
+    }
+  ];
 }

nixos/modules/misc/nixpkgs.nix

@@ -397,7 +397,4 @@ in
 
   # needs a full nixpkgs path to import nixpkgs
   meta.buildDocsInSandbox = false;
-  meta.maintainers = [
-    lib.maintainers.roberth
-  ];
 }

nixos/modules/misc/nixpkgs/read-only.nix

@@ -71,7 +71,4 @@ in
     nixpkgs.hostPlatform = cfg.pkgs.stdenv.hostPlatform;
     nixpkgs.buildPlatform = cfg.pkgs.stdenv.buildPlatform;
   };
-  meta.maintainers = [
-    lib.maintainers.roberth
-  ];
 }

nixos/modules/module-list.nix

@@ -20,7 +20,6 @@
   ./config/nix-channel.nix
   ./config/nix-flakes.nix
   ./config/nix-remote-build.nix
-  ./config/no-x-libs.nix
   ./config/nsswitch.nix
   ./config/power-management.nix
   ./config/pulseaudio.nix
@@ -260,6 +259,7 @@
   ./programs/oblogout.nix
   ./programs/oddjobd.nix
   ./programs/openvpn3.nix
+  ./programs/obs-studio.nix
   ./programs/partition-manager.nix
   ./programs/plotinus.nix
   ./programs/pqos-wrapper.nix
@@ -1045,7 +1045,6 @@
   ./services/networking/gdomap.nix
   ./services/networking/ghostunnel.nix
   ./services/networking/git-daemon.nix
-  ./services/networking/globalprotect-vpn.nix
   ./services/networking/gns3-server.nix
   ./services/networking/gnunet.nix
   ./services/networking/go-autoconfig.nix
@@ -1194,6 +1193,7 @@
   ./services/networking/scion/scion-daemon.nix
   ./services/networking/scion/scion-dispatcher.nix
   ./services/networking/scion/scion-router.nix
+  ./services/networking/scion/scion-ip-gateway.nix
   ./services/networking/seafile.nix
   ./services/networking/searx.nix
   ./services/networking/shadowsocks.nix
@@ -1252,6 +1252,7 @@
   ./services/networking/uptermd.nix
   ./services/networking/v2ray.nix
   ./services/networking/v2raya.nix
+  ./services/networking/veilid.nix
   ./services/networking/vdirsyncer.nix
   ./services/networking/vsftpd.nix
   ./services/networking/wasabibackend.nix
@@ -1393,11 +1394,13 @@
   ./services/web-apps/chatgpt-retrieval-plugin.nix
   ./services/web-apps/cloudlog.nix
   ./services/web-apps/code-server.nix
+  ./services/web-apps/collabora-online.nix
   ./services/web-apps/commafeed.nix
   ./services/web-apps/convos.nix
   ./services/web-apps/crabfit.nix
   ./services/web-apps/davis.nix
   ./services/web-apps/cryptpad.nix
+  ./services/web-apps/dependency-track.nix
   ./services/web-apps/dex.nix
   ./services/web-apps/discourse.nix
   ./services/web-apps/documize.nix
@@ -1431,6 +1434,7 @@
   ./services/web-apps/icingaweb2/icingaweb2.nix
   ./services/web-apps/icingaweb2/module-monitoring.nix
   ./services/web-apps/ifm.nix
+  ./services/web-apps/immich.nix
   ./services/web-apps/invidious.nix
   ./services/web-apps/invoiceplane.nix
   ./services/web-apps/isso.nix
@@ -1625,6 +1629,7 @@
   ./system/boot/stage-2.nix
   ./system/boot/systemd.nix
   ./system/boot/systemd/coredump.nix
+  ./system/boot/systemd/dm-verity.nix
   ./system/boot/systemd/initrd-secrets.nix
   ./system/boot/systemd/initrd.nix
   ./system/boot/systemd/journald.nix
@@ -1639,6 +1644,7 @@
   ./system/boot/systemd/sysupdate.nix
   ./system/boot/systemd/sysusers.nix
   ./system/boot/systemd/tmpfiles.nix
+  ./system/boot/systemd/tpm2.nix
   ./system/boot/systemd/user.nix
   ./system/boot/systemd/userdbd.nix
   ./system/boot/systemd/homed.nix

nixos/modules/profiles/all-hardware.nix

@@ -52,7 +52,7 @@ in
       # VMware support.
       "mptspi" "vmxnet3" "vsock"
     ] ++ lib.optional platform.isx86 "vmw_balloon"
-    ++ lib.optionals (pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) [
+    ++ lib.optionals (pkgs.stdenv.hostPlatform.isi686 || pkgs.stdenv.hostPlatform.isx86_64) [
       "vmw_vmci" "vmwgfx" "vmw_vsock_vmci_transport"
 
       # Hyper-V support.
@@ -68,7 +68,7 @@ in
 
       # Broadcom
       "vc4"
-    ] ++ lib.optionals pkgs.stdenv.isAarch64 [
+    ] ++ lib.optionals pkgs.stdenv.hostPlatform.isAarch64 [
       # Most of the following falls into two categories:
       #  - early KMS / early display
       #  - early storage (e.g. USB) support

nixos/modules/profiles/base.nix

@@ -19,13 +19,7 @@
     pkgs.cryptsetup # needed for dm-crypt volumes
 
     # Some text editors.
-    (pkgs.vim.customize {
-      name = "vim";
-      vimrcConfig.packages.default = {
-        start = [ pkgs.vimPlugins.vim-nix ];
-      };
-      vimrcConfig.customRC = "syntax on";
-    })
+    pkgs.vim
 
     # Some networking tools.
     pkgs.fuse

nixos/modules/profiles/minimal.nix

@@ -19,7 +19,7 @@ with lib;
   # Perl is a default package.
   environment.defaultPackages = mkDefault [ ];
 
-  environment.stub-ld.enable = false;
+  environment.stub-ld.enable = mkDefault false;
 
   # The lessopen package pulls in Perl.
   programs.less.lessopen = mkDefault null;
@@ -29,6 +29,8 @@ with lib;
 
   programs.command-not-found.enable = mkDefault false;
 
+  programs.ssh.setXAuthLocation = mkDefault false;
+
   services.logrotate.enable = mkDefault false;
 
   services.udisks2.enable = mkDefault false;

nixos/modules/programs/clash-verge.nix

@@ -1,9 +1,22 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
   options.programs.clash-verge = {
     enable = lib.mkEnableOption "Clash Verge";
-    package = lib.mkPackageOption pkgs "clash-verge" {};
+    package = lib.mkOption {
+      type = lib.types.package;
+      description = ''
+        The clash-verge package to use. Available options are
+        clash-verge-rev and clash-nyanpasu, both are forks of
+        the original clash-verge project.
+      '';
+      example = "pkgs.clash-verge-rev";
+    };
     autoStart = lib.mkEnableOption "Clash Verge auto launch";
     tunMode = lib.mkEnableOption "Clash Verge TUN mode";
   };
@@ -16,10 +29,12 @@
 
       environment.systemPackages = [
         cfg.package
-        (lib.mkIf cfg.autoStart (pkgs.makeAutostartItem {
-          name = "clash-verge";
-          package = cfg.package;
-        }))
+        (lib.mkIf cfg.autoStart (
+          pkgs.makeAutostartItem {
+            name = "clash-verge";
+            package = cfg.package;
+          }
+        ))
       ];
 
       security.wrappers.clash-verge = lib.mkIf cfg.tunMode {

nixos/modules/programs/firefox.nix

@@ -1,4 +1,9 @@
-{ pkgs, config, lib, ... }:
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
 
 let
   cfg = config.programs.firefox;
@@ -78,7 +83,7 @@ in
 
     wrapperConfig = lib.mkOption {
       type = lib.types.attrs;
-      default = {};
+      default = { };
       description = "Arguments to pass to Firefox wrapper";
     };
 
@@ -99,7 +104,13 @@ in
     };
 
     preferences = lib.mkOption {
-      type = with lib.types; attrsOf (oneOf [ bool int str ]);
+      type =
+        with lib.types;
+        attrsOf (oneOf [
+          bool
+          int
+          str
+        ]);
       default = { };
       description = ''
         Preferences to set from `about:config`.
@@ -112,7 +123,12 @@ in
     };
 
     preferencesStatus = lib.mkOption {
-      type = lib.types.enum [ "default" "locked" "user" "clear" ];
+      type = lib.types.enum [
+        "default"
+        "locked"
+        "user"
+        "clear"
+      ];
       default = "locked";
       description = ''
         The status of `firefox.preferences`.
@@ -127,111 +143,113 @@ in
 
     languagePacks = lib.mkOption {
       # Available languages can be found in https://releases.mozilla.org/pub/firefox/releases/${cfg.package.version}/linux-x86_64/xpi/
-      type = lib.types.listOf (lib.types.enum ([
-        "ach"
-        "af"
-        "an"
-        "ar"
-        "ast"
-        "az"
-        "be"
-        "bg"
-        "bn"
-        "br"
-        "bs"
-        "ca-valencia"
-        "ca"
-        "cak"
-        "cs"
-        "cy"
-        "da"
-        "de"
-        "dsb"
-        "el"
-        "en-CA"
-        "en-GB"
-        "en-US"
-        "eo"
-        "es-AR"
-        "es-CL"
-        "es-ES"
-        "es-MX"
-        "et"
-        "eu"
-        "fa"
-        "ff"
-        "fi"
-        "fr"
-        "fur"
-        "fy-NL"
-        "ga-IE"
-        "gd"
-        "gl"
-        "gn"
-        "gu-IN"
-        "he"
-        "hi-IN"
-        "hr"
-        "hsb"
-        "hu"
-        "hy-AM"
-        "ia"
-        "id"
-        "is"
-        "it"
-        "ja"
-        "ka"
-        "kab"
-        "kk"
-        "km"
-        "kn"
-        "ko"
-        "lij"
-        "lt"
-        "lv"
-        "mk"
-        "mr"
-        "ms"
-        "my"
-        "nb-NO"
-        "ne-NP"
-        "nl"
-        "nn-NO"
-        "oc"
-        "pa-IN"
-        "pl"
-        "pt-BR"
-        "pt-PT"
-        "rm"
-        "ro"
-        "ru"
-        "sat"
-        "sc"
-        "sco"
-        "si"
-        "sk"
-        "skr"
-        "sl"
-        "son"
-        "sq"
-        "sr"
-        "sv-SE"
-        "szl"
-        "ta"
-        "te"
-        "tg"
-        "th"
-        "tl"
-        "tr"
-        "trs"
-        "uk"
-        "ur"
-        "uz"
-        "vi"
-        "xh"
-        "zh-CN"
-        "zh-TW"
-      ]));
+      type = lib.types.listOf (
+        lib.types.enum ([
+          "ach"
+          "af"
+          "an"
+          "ar"
+          "ast"
+          "az"
+          "be"
+          "bg"
+          "bn"
+          "br"
+          "bs"
+          "ca-valencia"
+          "ca"
+          "cak"
+          "cs"
+          "cy"
+          "da"
+          "de"
+          "dsb"
+          "el"
+          "en-CA"
+          "en-GB"
+          "en-US"
+          "eo"
+          "es-AR"
+          "es-CL"
+          "es-ES"
+          "es-MX"
+          "et"
+          "eu"
+          "fa"
+          "ff"
+          "fi"
+          "fr"
+          "fur"
+          "fy-NL"
+          "ga-IE"
+          "gd"
+          "gl"
+          "gn"
+          "gu-IN"
+          "he"
+          "hi-IN"
+          "hr"
+          "hsb"
+          "hu"
+          "hy-AM"
+          "ia"
+          "id"
+          "is"
+          "it"
+          "ja"
+          "ka"
+          "kab"
+          "kk"
+          "km"
+          "kn"
+          "ko"
+          "lij"
+          "lt"
+          "lv"
+          "mk"
+          "mr"
+          "ms"
+          "my"
+          "nb-NO"
+          "ne-NP"
+          "nl"
+          "nn-NO"
+          "oc"
+          "pa-IN"
+          "pl"
+          "pt-BR"
+          "pt-PT"
+          "rm"
+          "ro"
+          "ru"
+          "sat"
+          "sc"
+          "sco"
+          "si"
+          "sk"
+          "skr"
+          "sl"
+          "son"
+          "sq"
+          "sr"
+          "sv-SE"
+          "szl"
+          "ta"
+          "te"
+          "tg"
+          "th"
+          "tl"
+          "tr"
+          "trs"
+          "uk"
+          "ur"
+          "uz"
+          "vi"
+          "xh"
+          "zh-CN"
+          "zh-TW"
+        ])
+      );
       default = [ ];
       description = ''
         The language packs to install.
@@ -249,10 +267,23 @@ in
       '';
     };
 
+    autoConfigFiles = lib.mkOption {
+      type = with lib.types; listOf path;
+      default = [ ];
+      description = ''
+        AutoConfig files can be used to set and lock preferences that are not covered
+        by the policies.json for Mac and Linux. This method can be used to automatically
+        change user preferences or prevent the end user from modifiying specific
+        preferences by locking them. More info can be found in https://support.mozilla.org/en-US/kb/customizing-firefox-using-autoconfig.
+
+        Files are concated and autoConfig is appended.
+      '';
+    };
+
     nativeMessagingHosts = ({
       packages = lib.mkOption {
         type = lib.types.listOf lib.types.package;
-        default = [];
+        default = [ ];
         description = ''
           Additional packages containing native messaging hosts that should be made available to Firefox extensions.
         '';
@@ -260,48 +291,64 @@ in
     }) // (builtins.mapAttrs (k: v: lib.mkEnableOption "${v.name} support") nmhOptions);
   };
 
-  config = let
-    forEachEnabledNmh = fn: lib.flatten (lib.mapAttrsToList (k: v: lib.optional cfg.nativeMessagingHosts.${k} (fn k v)) nmhOptions);
-  in lib.mkIf cfg.enable {
-    warnings = forEachEnabledNmh (k: v:
-      "The `programs.firefox.nativeMessagingHosts.${k}` option is deprecated, " +
-      "please add `${v.package.pname}` to `programs.firefox.nativeMessagingHosts.packages` instead."
-    );
-    programs.firefox.nativeMessagingHosts.packages = forEachEnabledNmh (_: v: v.package);
+  config =
+    let
+      forEachEnabledNmh =
+        fn:
+        lib.flatten (
+          lib.mapAttrsToList (k: v: lib.optional cfg.nativeMessagingHosts.${k} (fn k v)) nmhOptions
+        );
+    in
+    lib.mkIf cfg.enable {
+      warnings = forEachEnabledNmh (
+        k: v:
+        "The `programs.firefox.nativeMessagingHosts.${k}` option is deprecated, "
+        + "please add `${v.package.pname}` to `programs.firefox.nativeMessagingHosts.packages` instead."
+      );
+      programs.firefox.nativeMessagingHosts.packages = forEachEnabledNmh (_: v: v.package);
 
-    environment.systemPackages = [
-      (cfg.package.override (old: {
-        extraPrefsFiles = old.extraPrefsFiles or [] ++ [(pkgs.writeText "firefox-autoconfig.js" cfg.autoConfig)];
-        nativeMessagingHosts = old.nativeMessagingHosts or [] ++ cfg.nativeMessagingHosts.packages;
-        cfg = (old.cfg or {}) // cfg.wrapperConfig;
-      }))
-    ];
+      environment.systemPackages = [
+        (cfg.package.override (old: {
+          extraPrefsFiles =
+            old.extraPrefsFiles or [ ]
+            ++ cfg.autoConfigFiles
+            ++ [ (pkgs.writeText "firefox-autoconfig.js" cfg.autoConfig) ];
+          nativeMessagingHosts = old.nativeMessagingHosts or [ ] ++ cfg.nativeMessagingHosts.packages;
+          cfg = (old.cfg or { }) // cfg.wrapperConfig;
+        }))
+      ];
 
-    environment.etc =
-      let
-        policiesJSON = policyFormat.generate "firefox-policies.json" { inherit (cfg) policies; };
-      in
-      lib.mkIf (cfg.policies != { }) {
-        "firefox/policies/policies.json".source = "${policiesJSON}";
+      environment.etc =
+        let
+          policiesJSON = policyFormat.generate "firefox-policies.json" { inherit (cfg) policies; };
+        in
+        lib.mkIf (cfg.policies != { }) {
+          "firefox/policies/policies.json".source = "${policiesJSON}";
+        };
+
+      # Preferences are converted into a policy
+      programs.firefox.policies = {
+        DisableAppUpdate = true;
+        Preferences = (
+          builtins.mapAttrs (_: value: {
+            Value = value;
+            Status = cfg.preferencesStatus;
+          }) cfg.preferences
+        );
+        ExtensionSettings = builtins.listToAttrs (
+          builtins.map (
+            lang:
+            lib.attrsets.nameValuePair "langpack-${lang}@firefox.mozilla.org" {
+              installation_mode = "normal_installed";
+              install_url = "https://releases.mozilla.org/pub/firefox/releases/${cfg.package.version}/linux-x86_64/xpi/${lang}.xpi";
+            }
+          ) cfg.languagePacks
+        );
       };
-
-    # Preferences are converted into a policy
-    programs.firefox.policies = {
-      DisableAppUpdate = true;
-      Preferences = (builtins.mapAttrs
-        (_: value: { Value = value; Status = cfg.preferencesStatus; })
-        cfg.preferences);
-      ExtensionSettings = builtins.listToAttrs (builtins.map
-        (lang: lib.attrsets.nameValuePair
-          "langpack-${lang}@firefox.mozilla.org"
-          {
-            installation_mode = "normal_installed";
-            install_url = "https://releases.mozilla.org/pub/firefox/releases/${cfg.package.version}/linux-x86_64/xpi/${lang}.xpi";
-          }
-        )
-        cfg.languagePacks);
     };
-  };
 
-  meta.maintainers = with lib.maintainers; [ danth ];
+  meta.maintainers = with lib.maintainers; [
+    danth
+    linsui
+  ];
 }

nixos/modules/programs/nautilus-open-any-terminal.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.programs.nautilus-open-any-terminal;
@@ -23,20 +28,28 @@ in
       nautilus-open-any-terminal
     ];
 
-    environment.sessionVariables.NAUTILUS_4_EXTENSION_DIR = "${pkgs.nautilus-python}/lib/nautilus/extensions-4";
+    environment.sessionVariables = lib.mkIf (!config.services.xserver.desktopManager.gnome.enable) {
+      NAUTILUS_4_EXTENSION_DIR = "${pkgs.nautilus-python}/lib/nautilus/extensions-4";
+    };
+
     environment.pathsToLink = [
       "/share/nautilus-python/extensions"
     ];
 
     programs.dconf = lib.optionalAttrs (cfg.terminal != null) {
       enable = true;
-      profiles.user.databases = [{
-        settings."com/github/stunkymonkey/nautilus-open-any-terminal".terminal = cfg.terminal;
-        lockAll = true;
-      }];
+      profiles.user.databases = [
+        {
+          settings."com/github/stunkymonkey/nautilus-open-any-terminal".terminal = cfg.terminal;
+          lockAll = true;
+        }
+      ];
     };
   };
   meta = {
-    maintainers = with lib.maintainers; [ stunkymonkey linsui ];
+    maintainers = with lib.maintainers; [
+      stunkymonkey
+      linsui
+    ];
   };
 }

nixos/modules/programs/obs-studio.nix

@@ -0,0 +1,64 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+let
+  cfg = config.programs.obs-studio;
+in
+{
+  options.programs.obs-studio = {
+    enable = lib.mkEnableOption "Free and open source software for video recording and live streaming";
+
+    package = lib.mkPackageOption pkgs "obs-studio" { example = "obs-studio"; };
+
+    finalPackage = lib.mkOption {
+      type = lib.types.package;
+      visible = false;
+      readOnly = true;
+      description = "Resulting customized OBS Studio package.";
+    };
+
+    plugins = lib.mkOption {
+      default = [ ];
+      example = lib.literalExpression "[ pkgs.obs-studio-plugins.wlrobs ]";
+      description = "Optional OBS plugins.";
+      type = lib.types.listOf lib.types.package;
+    };
+
+    enableVirtualCamera = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Installs and sets up the v4l2loopback kernel module, necessary for OBS
+        to start a virtual camera.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs.obs-studio.finalPackage = pkgs.wrapOBS.override { obs-studio = cfg.package; } {
+      plugins = cfg.plugins;
+    };
+
+    environment.systemPackages = [ cfg.finalPackage ];
+
+    boot = lib.mkIf cfg.enableVirtualCamera {
+      kernelModules = [ "v4l2loopback" ];
+      extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
+
+      extraModprobeConfig = ''
+        options v4l2loopback devices=1 video_nr=1 card_label="OBS Cam" exclusive_caps=1
+      '';
+    };
+
+    security.polkit.enable = lib.mkIf cfg.enableVirtualCamera true;
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    CaptainJawZ
+    GaetanLepage
+  ];
+}

nixos/modules/programs/wayland/waybar.nix

@@ -1,4 +1,9 @@
-{ lib, pkgs, config, ... }:
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
 
 let
   cfg = config.programs.waybar;
@@ -6,16 +11,18 @@ in
 {
   options.programs.waybar = {
     enable = lib.mkEnableOption "waybar, a highly customizable Wayland bar for Sway and Wlroots based compositors";
-    package = lib.mkPackageOption pkgs "waybar" { };
+    package =
+      lib.mkPackageOption pkgs "waybar" { }
+      // lib.mkOption {
+        apply = pkg: pkg.override { systemdSupport = true; };
+      };
   };
 
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
-    systemd.user.services.waybar = {
-      description = "Waybar as systemd service";
-      wantedBy = [ "graphical-session.target" ];
-      partOf = [ "graphical-session.target" ];
-      script = "${cfg.package}/bin/waybar";
+    systemd = {
+      packages = [ cfg.package ];
+      user.services.waybar.wantedBy = [ "graphical-session.target" ];
     };
   };
 

nixos/modules/rename.nix

@@ -21,6 +21,10 @@ in
 
     # Completely removed modules
     (mkRemovedOptionModule [ "environment" "blcr" "enable" ] "The BLCR module has been removed")
+    (mkRemovedOptionModule [ "environment" "noXlibs" ] ''
+      The environment.noXlibs option was removed, as it often caused surprising breakages for new users.
+      If you need its functionality, you can apply similar overlays in your own config.
+    '')
     (mkRemovedOptionModule [ "fonts" "fontconfig" "penultimate" ] "The corresponding package has removed from nixpkgs.")
     (mkRemovedOptionModule [ "hardware" "brightnessctl" ] ''
       The brightnessctl module was removed because newer versions of
@@ -74,6 +78,7 @@ in
     (mkRemovedOptionModule [ "services" "fourStoreEndpoint" ] "The fourStoreEndpoint module has been removed")
     (mkRemovedOptionModule [ "services" "fprot" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "frab" ] "The frab module has been removed")
+    (mkRemovedOptionModule [ "services" "globalprotect"] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "homeassistant-satellite"] "The `services.homeassistant-satellite` module has been replaced by `services.wyoming-satellite`.")
     (mkRemovedOptionModule [ "services" "hydron" ] "The `services.hydron` module has been removed as the project has been archived upstream since 2022 and is affected by a severe remote code execution vulnerability.")
     (mkRemovedOptionModule [ "services" "ihatemoney" ] "The ihatemoney module has been removed for lack of downstream maintainer")

nixos/modules/services/audio/jack.nix

@@ -8,7 +8,7 @@ let
   pcmPlugin = cfg.jackd.enable && cfg.alsa.enable;
   loopback = cfg.jackd.enable && cfg.loopback.enable;
 
-  enable32BitAlsaPlugins = cfg.alsa.support32Bit && pkgs.stdenv.isx86_64 && pkgs.pkgsi686Linux.alsa-lib != null;
+  enable32BitAlsaPlugins = cfg.alsa.support32Bit && pkgs.stdenv.hostPlatform.isx86_64 && pkgs.pkgsi686Linux.alsa-lib != null;
 
   umaskNeeded = versionOlder cfg.jackd.package.version "1.9.12";
   bridgeNeeded = versionAtLeast cfg.jackd.package.version "1.9.12";

nixos/modules/services/audio/snapserver.nix

@@ -30,12 +30,12 @@ let
         lib.optionalString (val != null) "${val}";
       os' = prefix: val:
         lib.optionalString (val != null) (prefix + "${val}");
-      flatten = key: value:
+      toQueryString = key: value:
         "&${key}=${value}";
     in
       "--stream.stream=\"${opt.type}://" + os opt.location + "?" + os' "name=" name
         + os' "&sampleformat=" opt.sampleFormat + os' "&codec=" opt.codec
-        + lib.concatStrings (lib.mapAttrsToList lib.flatten opt.query) + "\"";
+        + lib.concatStrings (lib.mapAttrsToList toQueryString opt.query) + "\"";
 
   optionalNull = val: ret:
     lib.optional (val != null) ret;

nixos/modules/services/backup/automysqlbackup.nix

@@ -118,15 +118,6 @@ in
       name = user;
       ensurePermissions = {
         "*.*" = "SELECT, SHOW VIEW, TRIGGER, LOCK TABLES, EVENT";
-
-        # https://forums.mysql.com/read.php?10,668311,668315#msg-668315
-        "function sys.extract_table_from_file_name" = "execute";
-        "function sys.format_path" = "execute";
-        "function sys.format_statement" = "execute";
-        "function sys.extract_schema_from_file_name" = "execute";
-        "function sys.ps_thread_account" = "execute";
-        "function sys.format_time" = "execute";
-        "function sys.format_bytes" = "execute";
       };
     };
 

nixos/modules/services/backup/bacula.nix

@@ -656,6 +656,11 @@ in {
   };
 
   config = mkIf (fd_cfg.enable || sd_cfg.enable || dir_cfg.enable) {
+    systemd.slices.system-bacula = {
+      description = "Bacula Slice";
+      documentation = [ "man:bacula(8)" "https://www.bacula.org/" ];
+    };
+
     systemd.services.bacula-fd = mkIf fd_cfg.enable {
       after = [ "network.target" ];
       description = "Bacula File Daemon";
@@ -666,6 +671,7 @@ in {
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         LogsDirectory = "bacula";
         StateDirectory = "bacula";
+        Slice = "system-bacula.slice";
       };
     };
 
@@ -679,6 +685,7 @@ in {
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         LogsDirectory = "bacula";
         StateDirectory = "bacula";
+        Slice = "system-bacula.slice";
       };
     };
 
@@ -694,6 +701,7 @@ in {
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         LogsDirectory = "bacula";
         StateDirectory = "bacula";
+        Slice = "system-bacula.slice";
       };
       preStart = ''
         if ! test -e "${libDir}/db-created"; then

nixos/modules/services/blockchain/ethereum/geth.nix

@@ -103,7 +103,7 @@ let
       };
 
       network = lib.mkOption {
-        type = lib.types.nullOr (lib.types.enum [ "goerli" "rinkeby" "yolov2" "ropsten" ]);
+        type = lib.types.nullOr (lib.types.enum [ "goerli" "holesky" "rinkeby" "yolov2" "ropsten" ]);
         default = null;
         description = "The network to connect to. Mainnet (null) is the default ethereum network.";
       };

nixos/modules/services/continuous-integration/hydra/default.nix

@@ -515,10 +515,12 @@ in
           ''
             set -eou pipefail
             compression=$(sed -nr 's/compress_build_logs_compression = ()/\1/p' ${baseDir}/hydra.conf)
-            if [[ $compression == zstd ]]; then
+            if [[ $compression == "" ]]; then
+              compression="bzip2"
+            elif [[ $compression == zstd ]]; then
               compression="zstd --rm"
             fi
-            find ${baseDir}/build-logs -type f -name "*.drv" -mtime +3 -size +0c | xargs -r $compression --force --quiet
+            find ${baseDir}/build-logs -type f -name "*.drv" -mtime +3 -size +0c | xargs -r "$compression" --force --quiet
           '';
         startAt = "Sun 01:45";
         serviceConfig.Slice = "system-hydra.slice";

nixos/modules/services/continuous-integration/jenkins/slave.nix

@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
-with lib;
+
 let
+  inherit (lib) mkIf mkOption types;
   cfg = config.services.jenkinsSlave;
   masterCfg = config.services.jenkins;
 in {
@@ -47,16 +48,16 @@ in {
         '';
       };
 
-      javaPackage = mkPackageOption pkgs "jdk" { };
+      javaPackage = lib.mkPackageOption pkgs "jdk" { };
     };
   };
 
   config = mkIf (cfg.enable && !masterCfg.enable) {
-    users.groups = optionalAttrs (cfg.group == "jenkins") {
+    users.groups = lib.optionalAttrs (cfg.group == "jenkins") {
       jenkins.gid = config.ids.gids.jenkins;
     };
 
-    users.users = optionalAttrs (cfg.user == "jenkins") {
+    users.users = lib.optionalAttrs (cfg.user == "jenkins") {
       jenkins = {
         description = "jenkins user";
         createHome = true;

nixos/modules/services/databases/influxdb2.nix

@@ -67,16 +67,16 @@ let
     inherit (cfg.provision) organizations users;
   });
 
-  provisioningScript = pkgs.writeShellScript "post-start-provision" ''
-    set -euo pipefail
-    export INFLUX_HOST="http://"${escapeShellArg (
+  influxHost = "http://${escapeShellArg (
       if ! hasAttr "http-bind-address" cfg.settings
         || hasInfix "0.0.0.0" cfg.settings.http-bind-address
       then "localhost:8086"
       else cfg.settings.http-bind-address
-    )}
+    )}";
 
-    # Wait for the influxdb server to come online
+  waitUntilServiceIsReady = pkgs.writeShellScript "wait-until-service-is-ready" ''
+    set -euo pipefail
+    export INFLUX_HOST=${influxHost}
     count=0
     while ! influx ping &>/dev/null; do
       if [ "$count" -eq 300 ]; then
@@ -92,6 +92,11 @@ let
       sleep 0.1
       count=$((count++))
     done
+  '';
+
+  provisioningScript = pkgs.writeShellScript "post-start-provision" ''
+    set -euo pipefail
+    export INFLUX_HOST=${influxHost}
 
     # Do the initial database setup. Pass /dev/null as configs-path to
     # avoid saving the token as the active config.
@@ -433,6 +438,7 @@ in
         ZONEINFO = "${pkgs.tzdata}/share/zoneinfo";
       };
       serviceConfig = {
+        Type = "exec"; # When credentials are used with systemd before v257 this is necessary to make the service start reliably (see systemd/systemd#33953)
         ExecStart = "${cfg.package}/bin/influxd --bolt-path \${STATE_DIRECTORY}/influxd.bolt --engine-path \${STATE_DIRECTORY}/engine";
         StateDirectory = "influxdb2";
         User = "influxdb2";
@@ -447,11 +453,13 @@ in
           "admin-token:${cfg.provision.initialSetup.tokenFile}"
         ];
 
-        ExecStartPost = mkIf cfg.provision.enable (
+        ExecStartPost = [
+          waitUntilServiceIsReady
+        ] ++ (lib.optionals cfg.provision.enable (
           [provisioningScript] ++
           # Only the restarter runs with elevated privileges
           optional anyAuthDefined "+${restarterScript}"
-        );
+        ));
       };
 
       path = [

nixos/modules/services/databases/postgresql.md

@@ -196,6 +196,7 @@ For an upgrade, a script like this can be used to simplify the process:
       newPostgres = pkgs.postgresql_13.withPackages (pp: [
         # pp.plv8
       ]);
+      cfg = config.services.postgresql;
     in pkgs.writeScriptBin "upgrade-pg-cluster" ''
       set -eux
       # XXX it's perhaps advisable to stop all services that depend on postgresql
@@ -205,12 +206,12 @@ For an upgrade, a script like this can be used to simplify the process:
 
       export NEWBIN="${newPostgres}/bin"
 
-      export OLDDATA="${config.services.postgresql.dataDir}"
-      export OLDBIN="${config.services.postgresql.package}/bin"
+      export OLDDATA="${cfg.dataDir}"
+      export OLDBIN="${cfg.package}/bin"
 
       install -d -m 0700 -o postgres -g postgres "$NEWDATA"
       cd "$NEWDATA"
-      sudo -u postgres $NEWBIN/initdb -D "$NEWDATA"
+      sudo -u postgres $NEWBIN/initdb -D "$NEWDATA" ${builtins.concatStringsSep " " cfg.initdbArgs}
 
       sudo -u postgres $NEWBIN/pg_upgrade \
         --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \

nixos/modules/services/databases/tigerbeetle.md

@@ -35,3 +35,10 @@ Note that the TigerBeetle module won't open any firewall ports automatically, so
 
 A complete list of options for TigerBeetle can be found [here](#opt-services.tigerbeetle.enable).
 
+## Upgrading {#module-services-tigerbeetle-upgrading}
+
+Usually, TigerBeetle's [upgrade process](https://docs.tigerbeetle.com/operating/upgrading) only requires replacing the binary used for the servers.
+This is not directly possible with NixOS since the new binary will be located at a different place in the Nix store.
+
+However, since TigerBeetle is managed through systemd on NixOS, the only action you need to take when upgrading is to make sure the version of TigerBeetle you're upgrading to supports upgrades from the version you're currently running.
+This information will be on the [release notes](https://github.com/tigerbeetle/tigerbeetle/releases) for the version you're upgrading to.

nixos/modules/services/databases/tigerbeetle.nix

@@ -42,8 +42,8 @@ in
       };
 
       cacheGridSize = mkOption {
-        type = types.strMatching "[0-9]+(K|M|G)B";
-        default = "1GB";
+        type = types.strMatching "[0-9]+(K|M|G)iB";
+        default = "1GiB";
         description = ''
           The grid cache size.
           The grid cache acts like a page cache for TigerBeetle.
@@ -97,16 +97,26 @@ in
         '';
 
         serviceConfig = {
-          Type = "exec";
-
-          DynamicUser = true;
-          ProtectHome = true;
           DevicePolicy = "closed";
-
+          DynamicUser = true;
+          ExecStart = "${lib.getExe cfg.package} start --cache-grid=${cfg.cacheGridSize} --addresses=${lib.escapeShellArg (builtins.concatStringsSep "," cfg.addresses)} ${replicaDataPath}";
+          LockPersonality = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "noaccess";
+          ProtectSystem = "strict";
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
           StateDirectory = "tigerbeetle";
           StateDirectoryMode = 700;
-
-          ExecStart = "${lib.getExe cfg.package} start --cache-grid=${cfg.cacheGridSize} --addresses=${lib.escapeShellArg (builtins.concatStringsSep "," cfg.addresses)} ${replicaDataPath}";
+          Type = "exec";
         };
       };
 

nixos/modules/services/desktop-managers/plasma6.nix

@@ -58,6 +58,7 @@ in {
     ];
 
     qt.enable = true;
+    programs.xwayland.enable = true;
     environment.systemPackages = with kdePackages; let
       requiredPackages = [
         qtwayland # Hack? To make everything run on Wayland
@@ -87,7 +88,6 @@ in {
 
         # Core Plasma parts
         kwin
-        pkgs.xwayland
         kscreen
         libkscreen
         kscreenlocker
@@ -143,10 +143,12 @@ in {
         kate
         khelpcenter
         dolphin
+        baloo-widgets  # baloo information in Dolphin
         dolphin-plugins
         spectacle
         ffmpegthumbs
         krdp
+        xwaylandvideobridge  # exposes Wayland windows to X11 screen capture
       ] ++ lib.optionals config.services.flatpak.enable [
         # Since PackageKit Nix support is not there yet,
         # only install discover if flatpak is enabled.
@@ -243,9 +245,13 @@ in {
     systemd.services."drkonqi-coredump-processor@".wantedBy = ["systemd-coredump@.service"];
 
     xdg.icons.enable = true;
+    xdg.icons.fallbackCursorThemes = mkDefault ["breeze_cursors"];
 
     xdg.portal.enable = true;
-    xdg.portal.extraPortals = [kdePackages.xdg-desktop-portal-kde];
+    xdg.portal.extraPortals = [
+      kdePackages.xdg-desktop-portal-kde
+      pkgs.xdg-desktop-portal-gtk
+    ];
     xdg.portal.configPackages = mkDefault [kdePackages.xdg-desktop-portal-kde];
     services.pipewire.enable = mkDefault true;
 

nixos/modules/services/desktops/pipewire/pipewire.nix

@@ -19,7 +19,7 @@ let
   '';
   cfg = config.services.pipewire;
   enable32BitAlsaPlugins = cfg.alsa.support32Bit
-                           && pkgs.stdenv.isx86_64
+                           && pkgs.stdenv.hostPlatform.isx86_64
                            && pkgs.pkgsi686Linux.pipewire != null;
 
   # The package doesn't output to $out/lib/pipewire directly so that the

nixos/modules/services/hardware/iptsd.nix

@@ -18,15 +18,15 @@ in {
       type = lib.types.submodule {
         freeformType = format.type;
         options = {
-          Touch = {
+          Touchscreen = {
             DisableOnPalm = lib.mkOption {
               default = false;
-              description = "Ignore all touch inputs if a palm was registered on the display.";
+              description = "Ignore all touchscreen inputs if a palm was registered on the display.";
               type = lib.types.bool;
             };
             DisableOnStylus = lib.mkOption {
               default = false;
-              description = "Ignore all touch inputs if a stylus is in proximity.";
+              description = "Ignore all touchscreen inputs if a stylus is in proximity.";
               type = lib.types.bool;
             };
           };
@@ -43,6 +43,10 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
+    warnings = lib.optional (lib.hasAttr "Touch" cfg.config) ''
+      The option `services.iptsd.config.Touch` has been renamed to `services.iptsd.config.Touchscreen`.
+    '';
+
     systemd.packages = [ pkgs.iptsd ];
     environment.etc."iptsd.conf".source = configFile;
     systemd.services."iptsd@".restartTriggers = [ configFile ];

nixos/modules/services/hardware/upower.nix

@@ -85,7 +85,7 @@ in
 
       percentageLow = lib.mkOption {
         type = lib.types.ints.unsigned;
-        default = 10;
+        default = 20;
         description = ''
           When `usePercentageForPolicy` is
           `true`, the levels at which UPower will consider the
@@ -103,7 +103,7 @@ in
 
       percentageCritical = lib.mkOption {
         type = lib.types.ints.unsigned;
-        default = 3;
+        default = 5;
         description = ''
           When `usePercentageForPolicy` is
           `true`, the levels at which UPower will consider the

nixos/modules/services/logging/logrotate.nix

@@ -97,6 +97,8 @@ in
         defaultText = lib.literalExpression "cfg.settings != {}";
       };
 
+      allowNetworking = lib.mkEnableOption "network access for logrotate";
+
       settings = lib.mkOption {
         default = { };
         description = ''
@@ -240,12 +242,57 @@ in
   config = lib.mkIf cfg.enable {
     systemd.services.logrotate = {
       description = "Logrotate Service";
+      documentation = [
+        "man:logrotate(8)"
+        "man:logrotate(5)"
+      ];
       startAt = "hourly";
 
       serviceConfig = {
-        Restart = "no";
-        User = "root";
-        ExecStart = "${pkgs.logrotate}/sbin/logrotate ${utils.escapeSystemdExecArgs cfg.extraArgs} ${mailOption} ${cfg.configFile}";
+        Type = "oneshot";
+        ExecStart = "${lib.getExe pkgs.logrotate} ${utils.escapeSystemdExecArgs cfg.extraArgs} ${mailOption} ${cfg.configFile}";
+
+        # performance
+        Nice = 19;
+        IOSchedulingClass = "best-effort";
+        IOSchedulingPriority = 7;
+
+        # hardening
+        CapabilityBoundingSet = [
+          "CAP_CHOWN"
+          "CAP_DAC_OVERRIDE"
+          "CAP_SETUID"
+          "CAP_SETGID"
+        ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "full";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = false; # can create sgid directories
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service @setuid"
+          "~@privileged @resources"
+          "@chown"
+        ];
+        UMask = "0027";
+      } // lib.optionalAttrs (!cfg.allowNetworking) {
+        PrivateNetwork = true; # e.g. mail delivery
+        RestrictAddressFamilies = "none";
       };
     };
     systemd.services.logrotate-checkconf = {

nixos/modules/services/logging/promtail.nix

@@ -80,7 +80,7 @@ in {
         PrivateUsers = true;
 
         SupplementaryGroups = lib.optional (allowSystemdJournal) "systemd-journal";
-      } // (optionalAttrs (!pkgs.stdenv.isAarch64) { # FIXME: figure out why this breaks on aarch64
+      } // (optionalAttrs (!pkgs.stdenv.hostPlatform.isAarch64) { # FIXME: figure out why this breaks on aarch64
         SystemCallFilter = "@system-service";
       });
     };

nixos/modules/services/mail/mailman.nix

@@ -30,6 +30,10 @@ let
       ENGINE = "haystack.backends.whoosh_backend.WhooshEngine";
       PATH = "/var/lib/mailman-web/fulltext-index";
     };
+  } // lib.optionalAttrs cfg.enablePostfix {
+    EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend";
+    EMAIL_HOST = "127.0.0.1";
+    EMAIL_PORT = 25;
   } // cfg.webSettings;
 
   webSettingsJSON = pkgs.writeText "settings.json" (builtins.toJSON webSettings);

nixos/modules/services/misc/fstrim.nix

@@ -8,7 +8,9 @@ in {
   options = {
 
     services.fstrim = {
-      enable = lib.mkEnableOption "periodic SSD TRIM of mounted partitions in background";
+      enable = (lib.mkEnableOption "periodic SSD TRIM of mounted partitions in background" // {
+        default = true;
+      });
 
       interval = lib.mkOption {
         type = lib.types.str;

nixos/modules/services/misc/gitlab.nix

@@ -1127,6 +1127,11 @@ in {
 
     environment.systemPackages = [ gitlab-rake gitlab-rails cfg.packages.gitlab-shell ];
 
+    systemd.slices.system-gitlab = {
+      description = "GitLab DevOps Platform Slice";
+      documentation = [ "https://docs.gitlab.com/" ];
+    };
+
     systemd.targets.gitlab = {
       description = "Common target for all GitLab services.";
       wantedBy = [ "multi-user.target" ];
@@ -1197,6 +1202,7 @@ in {
       '';
 
       serviceConfig = {
+        Slice = "system-gitlab.slice";
         User = pgsql.superUser;
         Type = "oneshot";
         RemainAfterExit = true;
@@ -1220,6 +1226,9 @@ in {
       unitConfig = {
         ConditionPathExists = "!${cfg.registry.certFile}";
       };
+      serviceConfig = {
+        Slice = "system-gitlab.slice";
+      };
     };
 
     # Ensure Docker Registry launches after the certificate generation job
@@ -1308,6 +1317,7 @@ in {
         TimeoutSec = "infinity";
         Restart = "on-failure";
         WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab";
+        Slice = "system-gitlab.slice";
         RemainAfterExit = true;
 
         ExecStartPre = let
@@ -1424,6 +1434,7 @@ in {
         TimeoutSec = "infinity";
         Restart = "on-failure";
         WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab";
+        Slice = "system-gitlab.slice";
         RemainAfterExit = true;
 
         ExecStart = pkgs.writeShellScript "gitlab-db-config" ''
@@ -1480,6 +1491,7 @@ in {
         TimeoutSec = "infinity";
         Restart = "always";
         WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab";
+        Slice = "system-gitlab.slice";
         ExecStart = utils.escapeSystemdExecArgs (
           [
             "${cfg.packages.gitlab}/share/gitlab/bin/sidekiq-cluster"
@@ -1512,6 +1524,7 @@ in {
         Restart = "on-failure";
         WorkingDirectory = gitlabEnv.HOME;
         RuntimeDirectory = "gitaly";
+        Slice = "system-gitlab.slice";
         ExecStart = "${cfg.packages.gitaly}/bin/gitaly ${gitalyToml}";
       };
     };
@@ -1573,6 +1586,7 @@ in {
             WorkingDirectory = gitlabEnv.HOME;
             RuntimeDirectory = "gitlab-pages";
             RuntimeDirectoryMode = "0700";
+            Slice = "system-gitlab.slice";
           };
         };
 
@@ -1596,6 +1610,7 @@ in {
         TimeoutSec = "infinity";
         Restart = "on-failure";
         WorkingDirectory = gitlabEnv.HOME;
+        Slice = "system-gitlab.slice";
         ExecStartPre = pkgs.writeShellScript "gitlab-workhorse-pre-start" ''
           set -o errexit -o pipefail -o nounset
           shopt -s dotglob nullglob inherit_errexit
@@ -1637,6 +1652,7 @@ in {
         Group = cfg.group;
         ExecStart = "${cfg.packages.gitlab.rubyEnv}/bin/bundle exec mail_room -c ${cfg.statePath}/config/mail_room.yml";
         WorkingDirectory = gitlabEnv.HOME;
+        Slice = "system-gitlab.slice";
       };
     };
 
@@ -1671,6 +1687,7 @@ in {
         TimeoutSec = "infinity";
         Restart = "on-failure";
         WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab";
+        Slice = "system-gitlab.slice";
         ExecStart = concatStringsSep " " [
           "${cfg.packages.gitlab.rubyEnv}/bin/bundle" "exec" "puma"
           "-e production"
@@ -1695,6 +1712,7 @@ in {
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
+        Slice = "system-gitlab.slice";
         ExecStart = "${gitlab-rake}/bin/gitlab-rake gitlab:backup:create";
       };
     };

nixos/modules/services/misc/gotenberg.nix

@@ -244,7 +244,6 @@ in
 
         SystemCallFilter = [
           "@system-service"
-          "~@resources"
           "~@privileged"
         ];
         SystemCallArchitectures = "native";

nixos/modules/services/misc/mame.nix

@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 let
   cfg = config.services.mame;
-  mame = "mame${lib.optionalString pkgs.stdenv.is64bit "64"}";
+  mame = "mame${lib.optionalString pkgs.stdenv.hostPlatform.is64bit "64"}";
 in
 {
   options = {

nixos/modules/services/misc/redmine.nix

@@ -448,4 +448,5 @@ in
 
   };
 
+  meta.maintainers = with lib.maintainers; [ felixsinger ];
 }

nixos/modules/services/misc/snapper.nix

@@ -35,6 +35,14 @@ let
     descriptionClass = "conjunction";
   };
 
+  intOrNumberOrRange = lib.types.either lib.types.ints.unsigned (
+    lib.types.strMatching "[[:digit:]]+(\-[[:digit:]]+)?"
+    // {
+      description = "string containing either a number or a range";
+      descriptionClass = "conjunction";
+    }
+  );
+
   configOptions = {
     SUBVOLUME = lib.mkOption {
       type = lib.types.path;
@@ -93,7 +101,7 @@ let
     };
 
     TIMELINE_LIMIT_HOURLY = lib.mkOption {
-      type = lib.types.int;
+      type = intOrNumberOrRange;
       default = 10;
       description = ''
         Limits for timeline cleanup.
@@ -101,7 +109,7 @@ let
     };
 
     TIMELINE_LIMIT_DAILY = lib.mkOption {
-      type = lib.types.int;
+      type = intOrNumberOrRange;
       default = 10;
       description = ''
         Limits for timeline cleanup.
@@ -109,7 +117,7 @@ let
     };
 
     TIMELINE_LIMIT_WEEKLY = lib.mkOption {
-      type = lib.types.int;
+      type = intOrNumberOrRange;
       default = 0;
       description = ''
         Limits for timeline cleanup.
@@ -117,7 +125,7 @@ let
     };
 
     TIMELINE_LIMIT_MONTHLY = lib.mkOption {
-      type = lib.types.int;
+      type = intOrNumberOrRange;
       default = 10;
       description = ''
         Limits for timeline cleanup.
@@ -125,7 +133,7 @@ let
     };
 
     TIMELINE_LIMIT_QUARTERLY = lib.mkOption {
-      type = lib.types.int;
+      type = intOrNumberOrRange;
       default = 0;
       description = ''
         Limits for timeline cleanup.
@@ -133,7 +141,7 @@ let
     };
 
     TIMELINE_LIMIT_YEARLY = lib.mkOption {
-      type = lib.types.int;
+      type = intOrNumberOrRange;
       default = 10;
       description = ''
         Limits for timeline cleanup.

nixos/modules/services/misc/tabby.nix

@@ -71,7 +71,7 @@ in
 
           - nixpkgs.config.cudaSupport
           - nixpkgs.config.rocmSupport
-          - if stdenv.isDarwin && stdenv.isAarch64
+          - if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64
 
           IFF multiple acceleration methods are found to be enabled or if you
           haven't set either `cudaSupport or rocmSupport` you will have to

nixos/modules/services/misc/tzupdate.nix

@@ -30,16 +30,15 @@ in {
       description = "tzupdate timezone update service";
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
+      script = ''
+        timedatectl set-timezone $(${lib.getExe pkgs.tzupdate} --print-only)
+      '';
 
       serviceConfig = {
         Type = "oneshot";
-        # We could link directly into pkgs.tzdata, but at least timedatectl seems
-        # to expect the symlink to point directly to a file in etc.
-        # Setting the "debian timezone file" to point at /dev/null stops it doing anything.
-        ExecStart = "${pkgs.tzupdate}/bin/tzupdate -z /etc/zoneinfo -d /dev/null";
       };
     };
   };
 
-  meta.maintainers = [ ];
+  meta.maintainers = with lib.maintainers; [ doronbehar ];
 }

nixos/modules/services/monitoring/ups.nix

@@ -509,6 +509,11 @@ in
         else lib.unique (lib.forEach cfg.upsd.listen (listen: listen.port));
     };
 
+    systemd.slices.system-ups = {
+      description = "Network UPS Tools (NUT) Slice";
+      documentation = [ "https://networkupstools.org/" ];
+    };
+
     systemd.services.upsmon = let
       secrets = lib.mapAttrsToList (name: monitor: "upsmon_password_${name}") cfg.upsmon.monitor;
       createUpsmonConf = installSecrets upsmonConf "/run/nut/upsmon.conf" secrets;
@@ -523,6 +528,7 @@ in
         ExecStart = "${pkgs.nut}/sbin/upsmon";
         ExecReload = "${pkgs.nut}/sbin/upsmon -c reload";
         LoadCredential = lib.mapAttrsToList (name: monitor: "upsmon_password_${name}:${monitor.passwordFile}") cfg.upsmon.monitor;
+        Slice = "system-ups.slice";
       };
       environment = envVars;
     };
@@ -542,6 +548,7 @@ in
         ExecStart = "${pkgs.nut}/sbin/upsd -u root";
         ExecReload = "${pkgs.nut}/sbin/upsd -c reload";
         LoadCredential = lib.mapAttrsToList (name: user: "upsdusers_password_${name}:${user.passwordFile}") cfg.users;
+        Slice = "system-ups.slice";
       };
       environment = envVars;
       restartTriggers = [
@@ -559,6 +566,7 @@ in
         RemainAfterExit = true;
         # TODO: replace 'root' by another username.
         ExecStart = "${pkgs.nut}/bin/upsdrvctl -u root start";
+        Slice = "system-ups.slice";
       };
       environment = envVars;
       restartTriggers = [

nixos/modules/services/networking/cjdns.nix

@@ -274,7 +274,7 @@ in
         CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW CAP_SETUID";
         ProtectSystem = true;
         # Doesn't work on i686, causing service to fail
-        MemoryDenyWriteExecute = !pkgs.stdenv.isi686;
+        MemoryDenyWriteExecute = !pkgs.stdenv.hostPlatform.isi686;
         ProtectHome = true;
         PrivateTmp = true;
       };

nixos/modules/services/networking/dnsmasq.nix

@@ -20,13 +20,7 @@ let
     listsAsDuplicateKeys = true;
   };
 
-  # Because formats.generate is outputting a file, we use of conf-file. Once
-  # `extraConfig` is deprecated we can just use
-  # `dnsmasqConf = format.generate "dnsmasq.conf" cfg.settings`
-  dnsmasqConf = pkgs.writeText "dnsmasq.conf" ''
-    conf-file=${settingsFormat.generate "dnsmasq.conf" cfg.settings}
-    ${cfg.extraConfig}
-  '';
+  dnsmasqConf = settingsFormat.generate "dnsmasq.conf" cfg.settings;
 
 in
 
@@ -34,6 +28,7 @@ in
 
   imports = [
     (lib.mkRenamedOptionModule [ "services" "dnsmasq" "servers" ] [ "services" "dnsmasq" "settings" "server" ])
+    (lib.mkRemovedOptionModule [ "services" "dnsmasq" "extraConfig" ] "This option has been replaced by `services.dnsmasq.settings`")
   ];
 
   ###### interface
@@ -104,17 +99,6 @@ in
         '';
       };
 
-      extraConfig = lib.mkOption {
-        type = lib.types.lines;
-        default = "";
-        description = ''
-          Extra configuration directives that should be added to
-          `dnsmasq.conf`.
-
-          This option is deprecated, please use {option}`settings` instead.
-        '';
-      };
-
     };
 
   };
@@ -124,8 +108,6 @@ in
 
   config = lib.mkIf cfg.enable {
 
-    warnings = lib.optional (cfg.extraConfig != "") "Text based config is deprecated, dnsmasq now supports `services.dnsmasq.settings` for an attribute-set based config";
-
     services.dnsmasq.settings = {
       dhcp-leasefile = lib.mkDefault "${stateDir}/dnsmasq.leases";
       conf-file = lib.mkDefault (lib.optional cfg.resolveLocalQueries "/etc/dnsmasq-conf.conf");

nixos/modules/services/networking/freeradius.nix

@@ -10,14 +10,14 @@ let
     after = ["network.target"];
     wants = ["network.target"];
     preStart = ''
-      ${pkgs.freeradius}/bin/radiusd -C -d ${cfg.configDir} -l stdout
+      ${cfg.package}/bin/radiusd -C -d ${cfg.configDir} -l stdout
     '';
 
     serviceConfig = {
-        ExecStart = "${pkgs.freeradius}/bin/radiusd -f -d ${cfg.configDir} -l stdout" +
+        ExecStart = "${cfg.package}/bin/radiusd -f -d ${cfg.configDir} -l stdout" +
                     lib.optionalString cfg.debug " -xx";
         ExecReload = [
-          "${pkgs.freeradius}/bin/radiusd -C -d ${cfg.configDir} -l stdout"
+          "${cfg.package}/bin/radiusd -C -d ${cfg.configDir} -l stdout"
           "${pkgs.coreutils}/bin/kill -HUP $MAINPID"
         ];
         User = "radius";
@@ -32,6 +32,8 @@ let
   freeradiusConfig = {
     enable = lib.mkEnableOption "the freeradius server";
 
+    package = lib.mkPackageOption pkgs "freeradius" { };
+
     configDir = lib.mkOption {
       type = lib.types.path;
       default = "/etc/raddb";
@@ -72,7 +74,9 @@ in
         /*uid = config.ids.uids.radius;*/
         description = "Radius daemon user";
         isSystemUser = true;
+        groups = "radius";
       };
+      groups.radius = {};
     };
 
     systemd.services.freeradius = freeradiusService cfg;

nixos/modules/services/networking/globalprotect-vpn.nix

@@ -1,57 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.globalprotect;
-
-  execStart =
-    if cfg.csdWrapper == null then
-      "${pkgs.globalprotect-openconnect}/bin/gpservice"
-    else
-      "${pkgs.globalprotect-openconnect}/bin/gpservice --csd-wrapper=${cfg.csdWrapper}";
-in
-
-{
-  options.services.globalprotect = {
-    enable = lib.mkEnableOption "globalprotect";
-
-    settings = lib.mkOption {
-      description = ''
-        GlobalProtect-openconnect configuration. For more information, visit
-        <https://github.com/yuezk/GlobalProtect-openconnect/wiki/Configuration>.
-      '';
-      default = { };
-      example = {
-        "vpn1.company.com" = {
-          openconnect-args = "--script=/path/to/vpnc-script";
-        };
-      };
-      type = lib.types.attrs;
-    };
-
-    csdWrapper = lib.mkOption {
-      description = ''
-        A script that will produce a Host Integrity Protection (HIP) report,
-        as described at <https://www.infradead.org/openconnect/hip.html>
-      '';
-      default = null;
-      example = lib.literalExpression ''"''${pkgs.openconnect}/libexec/openconnect/hipreport.sh"'';
-      type = lib.types.nullOr lib.types.path;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.dbus.packages = [ pkgs.globalprotect-openconnect ];
-
-    environment.etc."gpservice/gp.conf".text = lib.generators.toINI { } cfg.settings;
-
-    systemd.services.gpservice = {
-      description = "GlobalProtect openconnect DBus service";
-      serviceConfig = {
-        Type = "dbus";
-        BusName = "com.yuezk.qt.GPService";
-        ExecStart = execStart;
-      };
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-    };
-  };
-}

nixos/modules/services/networking/i2pd.nix

@@ -1,17 +1,17 @@
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
+  inherit (lib) mkIf mkOption mkEnableOption types optional optionals;
+  inherit (lib.types) nullOr bool listOf str;
 
   cfg = config.services.i2pd;
 
   homeDir = "/var/lib/i2pd";
 
   strOpt = k: v: k + " = " + v;
-  boolOpt = k: v: k + " = " + boolToString v;
+  boolOpt = k: v: k + " = " + lib.boolToString v;
   intOpt = k: v: k + " = " + toString v;
-  lstOpt = k: xs: k + " = " + concatStringsSep "," xs;
+  lstOpt = k: xs: k + " = " + lib.concatStringsSep "," xs;
   optionalNullString = o: s: optional (s != null) (strOpt o s);
   optionalNullBool = o: b: optional (b != null) (boolOpt o b);
   optionalNullInt = o: i: optional (i != null) (intOpt o i);
@@ -54,7 +54,7 @@ let
   mkKeyedEndpointOpt = name: addr: port: keyloc:
     (mkEndpointOpt name addr port) // {
       keys = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = keyloc;
         description = ''
           File to persist ${lib.toUpper name} keys.
@@ -162,8 +162,8 @@ let
       (sec "meshnets")
       (boolOpt "yggdrasil" cfg.yggdrasil.enable)
     ] ++ (optionalNullString "yggaddress" cfg.yggdrasil.address)
-      ++ (flip map
-      (collect (proto: proto ? port && proto ? address) cfg.proto)
+      ++ (lib.flip map
+      (lib.collect (proto: proto ? port && proto ? address) cfg.proto)
       (proto: let protoOpts = [
         (sec proto.name)
         (boolOpt "enabled" proto.enable)
@@ -178,10 +178,10 @@ let
         ++ (optionals (proto ? outproxy) (optionalNullString "outproxy" proto.outproxy))
         ++ (optionals (proto ? outproxyPort) (optionalNullInt "outproxyport" proto.outproxyPort))
         ++ (optionals (proto ? outproxyEnable) (optionalNullBool "outproxy.enabled" proto.outproxyEnable));
-        in (concatStringsSep "\n" protoOpts)
+        in (lib.concatStringsSep "\n" protoOpts)
       ));
   in
-    pkgs.writeText "i2pd.conf" (concatStringsSep "\n" opts);
+    pkgs.writeText "i2pd.conf" (lib.concatStringsSep "\n" opts);
 
   tunnelConf = let
     mkOutTunnel = tun:
@@ -200,7 +200,7 @@ let
           ++ (optionals (tun ? outbound.quantity) (optionalNullInt "outbound.quantity" tun.outbound.quantity))
           ++ (optionals (tun ? crypto.tagsToSend) (optionalNullInt "crypto.tagstosend" tun.crypto.tagsToSend));
       in
-        concatStringsSep "\n" outTunOpts;
+        lib.concatStringsSep "\n" outTunOpts;
 
     mkInTunnel = tun:
       let
@@ -214,16 +214,16 @@ let
           ++ (optionals (tun ? inPort) (optionalNullInt "inport" tun.inPort))
           ++ (optionals (tun ? accessList) (optionalEmptyList "accesslist" tun.accessList));
       in
-        concatStringsSep "\n" inTunOpts;
+        lib.concatStringsSep "\n" inTunOpts;
 
-    allOutTunnels = collect (tun: tun ? port && tun ? destination) cfg.outTunnels;
-    allInTunnels = collect (tun: tun ? port && tun ? address) cfg.inTunnels;
+    allOutTunnels = lib.collect (tun: tun ? port && tun ? destination) cfg.outTunnels;
+    allInTunnels = lib.collect (tun: tun ? port && tun ? address) cfg.inTunnels;
 
     opts = [ notice ] ++ (map mkOutTunnel allOutTunnels) ++ (map mkInTunnel allInTunnels);
   in
-    pkgs.writeText "i2pd-tunnels.conf" (concatStringsSep "\n" opts);
+    pkgs.writeText "i2pd-tunnels.conf" (lib.concatStringsSep "\n" opts);
 
-  i2pdFlags = concatStringsSep " " (
+  i2pdFlags = lib.concatStringsSep " " (
     optional (cfg.address != null) ("--host=" + cfg.address) ++ [
     "--service"
     ("--conf=" + i2pdConf)
@@ -235,7 +235,7 @@ in
 {
 
   imports = [
-    (mkRenamedOptionModule [ "services" "i2pd" "extIp" ] [ "services" "i2pd" "address" ])
+    (lib.mkRenamedOptionModule [ "services" "i2pd" "extIp" ] [ "services" "i2pd" "address" ])
   ];
 
   ###### interface
@@ -252,7 +252,7 @@ in
         '';
       };
 
-      package = mkPackageOption pkgs "i2pd" { };
+      package = lib.mkPackageOption pkgs "i2pd" { };
 
       logLevel = mkOption {
         type = types.enum ["debug" "info" "warn" "error"];
@@ -269,7 +269,7 @@ in
       logCLFTime = mkEnableOption "full CLF-formatted date and time to log";
 
       address = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Your external IP or hostname.
@@ -277,7 +277,7 @@ in
       };
 
       family = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Specify a family the router belongs to.
@@ -285,7 +285,7 @@ in
       };
 
       dataDir = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Alternative path to storage of i2pd data (RI, keys, peer profiles, ...)
@@ -301,7 +301,7 @@ in
       };
 
       ifname = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Network interface to bind to.
@@ -309,7 +309,7 @@ in
       };
 
       ifname4 = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           IPv4 interface to bind to.
@@ -317,7 +317,7 @@ in
       };
 
       ifname6 = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           IPv6 interface to bind to.
@@ -325,7 +325,7 @@ in
       };
 
       ntcpProxy = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Proxy URL for NTCP transport.
@@ -399,7 +399,7 @@ in
       reseed.verify = mkEnableOption "SU3 signature verification";
 
       reseed.file = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Full path to SU3 file to reseed from.
@@ -407,7 +407,7 @@ in
       };
 
       reseed.urls = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         default = [];
         description = ''
           Reseed URLs.
@@ -415,7 +415,7 @@ in
       };
 
       reseed.floodfill = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Path to router info of floodfill to reseed from.
@@ -423,7 +423,7 @@ in
       };
 
       reseed.zipfile = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Path to local .zip file to reseed from.
@@ -431,7 +431,7 @@ in
       };
 
       reseed.proxy = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           URL for reseed proxy, supports http/socks.
@@ -446,7 +446,7 @@ in
         '';
       };
      addressbook.subscriptions = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         default = [
           "http://inr.i2p/export/alive-hosts.txt"
           "http://i2p-projekt.i2p/hosts.txt"
@@ -460,7 +460,7 @@ in
       trust.enable = mkEnableOption "explicit trust options";
 
       trust.family = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Router Family to trust for first hops.
@@ -468,7 +468,7 @@ in
       };
 
       trust.routers = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         default = [];
         description = ''
           Only connect to the listed routers.
@@ -543,7 +543,7 @@ in
       yggdrasil.enable = mkEnableOption "Yggdrasil";
 
       yggdrasil.address = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Your local yggdrasil address. Specify it if you want to bind your router to a
@@ -572,7 +572,7 @@ in
         };
 
         strictHeaders = mkOption {
-          type = with types; nullOr bool;
+          type = nullOr bool;
           default = null;
           description = ''
             Enable strict host checking on WebUI.
@@ -580,7 +580,7 @@ in
         };
 
         hostname = mkOption {
-          type = with types; nullOr str;
+          type = nullOr str;
           default = null;
           description = ''
             Expected hostname for WebUI.
@@ -591,7 +591,7 @@ in
       proto.httpProxy = (mkKeyedEndpointOpt "httpproxy" "127.0.0.1" 4444 "httpproxy-keys.dat")
       // {
         outproxy = mkOption {
-          type = with types; nullOr str;
+          type = nullOr str;
           default = null;
           description = "Upstream outproxy bind address.";
         };
@@ -648,7 +648,7 @@ in
                 description = "Service port. Default to the tunnel's listen port.";
               };
               accessList = mkOption {
-                type = with types; listOf str;
+                type = listOf str;
                 default = [];
                 description = "I2P nodes that are allowed to connect to this service.";
               };

nixos/modules/services/networking/monero.nix

@@ -1,12 +1,10 @@
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
   cfg     = config.services.monero;
 
   listToConf = option: list:
-    concatMapStrings (value: "${option}=${value}\n") list;
+    lib.concatMapStrings (value: "${option}=${value}\n") list;
 
   login = (cfg.rpc.user != null && cfg.rpc.password != null);
 
@@ -14,17 +12,17 @@ let
     log-file=/dev/stdout
     data-dir=${dataDir}
 
-    ${optionalString mining.enable ''
+    ${lib.optionalString mining.enable ''
       start-mining=${mining.address}
       mining-threads=${toString mining.threads}
     ''}
 
     rpc-bind-ip=${rpc.address}
     rpc-bind-port=${toString rpc.port}
-    ${optionalString login ''
+    ${lib.optionalString login ''
       rpc-login=${rpc.user}:${rpc.password}
     ''}
-    ${optionalString rpc.restricted ''
+    ${lib.optionalString rpc.restricted ''
       restricted-rpc=1
     ''}
 
@@ -50,34 +48,34 @@ in
 
     services.monero = {
 
-      enable = mkEnableOption "Monero node daemon";
+      enable = lib.mkEnableOption "Monero node daemon";
 
-      dataDir = mkOption {
-        type = types.str;
+      dataDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/lib/monero";
         description = ''
           The directory where Monero stores its data files.
         '';
       };
 
-      mining.enable = mkOption {
-        type = types.bool;
+      mining.enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to mine monero.
         '';
       };
 
-      mining.address = mkOption {
-        type = types.str;
+      mining.address = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           Monero address where to send mining rewards.
         '';
       };
 
-      mining.threads = mkOption {
-        type = types.addCheck types.int (x: x>=0);
+      mining.threads = lib.mkOption {
+        type = lib.types.addCheck lib.types.int (x: x>=0);
         default = 0;
         description = ''
           Number of threads used for mining.
@@ -85,48 +83,48 @@ in
         '';
       };
 
-      rpc.user = mkOption {
-        type = types.nullOr types.str;
+      rpc.user = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           User name for RPC connections.
         '';
       };
 
-      rpc.password = mkOption {
-        type = types.nullOr types.str;
+      rpc.password = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Password for RPC connections.
         '';
       };
 
-      rpc.address = mkOption {
-        type = types.str;
+      rpc.address = lib.mkOption {
+        type = lib.types.str;
         default = "127.0.0.1";
         description = ''
           IP address the RPC server will bind to.
         '';
       };
 
-      rpc.port = mkOption {
-        type = types.port;
+      rpc.port = lib.mkOption {
+        type = lib.types.port;
         default = 18081;
         description = ''
           Port the RPC server will bind to.
         '';
       };
 
-      rpc.restricted = mkOption {
-        type = types.bool;
+      rpc.restricted = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to restrict RPC to view only commands.
         '';
       };
 
-      limits.upload = mkOption {
-        type = types.addCheck types.int (x: x>=-1);
+      limits.upload = lib.mkOption {
+        type = lib.types.addCheck lib.types.int (x: x>=-1);
         default = -1;
         description = ''
           Limit of the upload rate in kB/s.
@@ -134,8 +132,8 @@ in
         '';
       };
 
-      limits.download = mkOption {
-        type = types.addCheck types.int (x: x>=-1);
+      limits.download = lib.mkOption {
+        type = lib.types.addCheck lib.types.int (x: x>=-1);
         default = -1;
         description = ''
           Limit of the download rate in kB/s.
@@ -143,8 +141,8 @@ in
         '';
       };
 
-      limits.threads = mkOption {
-        type = types.addCheck types.int (x: x>=0);
+      limits.threads = lib.mkOption {
+        type = lib.types.addCheck lib.types.int (x: x>=0);
         default = 0;
         description = ''
           Maximum number of threads used for a parallel job.
@@ -152,8 +150,8 @@ in
         '';
       };
 
-      limits.syncSize = mkOption {
-        type = types.addCheck types.int (x: x>=0);
+      limits.syncSize = lib.mkOption {
+        type = lib.types.addCheck lib.types.int (x: x>=0);
         default = 0;
         description = ''
           Maximum number of blocks to sync at once.
@@ -161,16 +159,16 @@ in
         '';
       };
 
-      extraNodes = mkOption {
-        type = types.listOf types.str;
+      extraNodes = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         description = ''
           List of additional peer IP addresses to add to the local list.
         '';
       };
 
-      priorityNodes = mkOption {
-        type = types.listOf types.str;
+      priorityNodes = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         description = ''
           List of peer IP addresses to connect to and
@@ -178,8 +176,8 @@ in
         '';
       };
 
-      exclusiveNodes = mkOption {
-        type = types.listOf types.str;
+      exclusiveNodes = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         description = ''
           List of peer IP addresses to connect to *only*.
@@ -187,8 +185,8 @@ in
         '';
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = ''
           Extra lines to be added verbatim to monerod configuration.
@@ -202,7 +200,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     users.users.monero = {
       isSystemUser = true;
@@ -228,7 +226,7 @@ in
       };
     };
 
-    assertions = singleton {
+    assertions = lib.singleton {
       assertion = cfg.mining.enable -> cfg.mining.address != "";
       message   = ''
        You need a Monero address to receive mining rewards:

nixos/modules/services/networking/murmur.nix

@@ -406,4 +406,6 @@ in
       }
     '';
   };
+
+  meta.maintainers = with lib.maintainers; [ felixsinger ];
 }

nixos/modules/services/networking/nar-serve.nix

@@ -1,18 +1,18 @@
 { config, pkgs, lib, ... }:
 
-with lib;
 let
+  inherit (lib) mkOption types;
   cfg = config.services.nar-serve;
 in
 {
   meta = {
-    maintainers = [ maintainers.rizary maintainers.zimbatm ];
+    maintainers = with lib.maintainers; [ rizary zimbatm ];
   };
   options = {
     services.nar-serve = {
-      enable = mkEnableOption "serving NAR file contents via HTTP";
+      enable = lib.mkEnableOption "serving NAR file contents via HTTP";
 
-      package = mkPackageOption pkgs "nar-serve" { };
+      package = lib.mkPackageOption pkgs "nar-serve" { };
 
       port = mkOption {
         type = types.port;
@@ -48,7 +48,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.nar-serve = {
       description = "NAR server";
       after = [ "network.target" ];

nixos/modules/services/networking/networkmanager.nix

@@ -514,6 +514,12 @@ in
 
     environment.etc = {
       "NetworkManager/NetworkManager.conf".source = configFile;
+
+      # The networkmanager-l2tp plugin expects /etc/ipsec.secrets to include /etc/ipsec.d/ipsec.nm-l2tp.secrets;
+      # see https://github.com/NixOS/nixpkgs/issues/64965
+      "ipsec.secrets".text = ''
+        include ipsec.d/ipsec.nm-l2tp.secrets
+      '';
     }
     // builtins.listToAttrs (map
       (pkg: nameValuePair "NetworkManager/${pkg.networkManagerPlugin}" {

nixos/modules/services/networking/nixops-dns.nix

@@ -68,10 +68,10 @@ in
       servers = [
         "/${cfg.domain}/127.0.0.1#5300"
       ];
-      extraConfig = ''
-        bind-interfaces
-        listen-address=127.0.0.1
-      '';
+      settings = {
+        bind-interfaces = true;
+        listen-address = "127.0.0.1";
+      };
     };
 
   };

nixos/modules/services/networking/nsd.nix

@@ -603,8 +603,8 @@ in
 
     reuseport = mkOption {
       type = types.bool;
-      default = pkgs.stdenv.isLinux;
-      defaultText = literalExpression "pkgs.stdenv.isLinux";
+      default = pkgs.stdenv.hostPlatform.isLinux;
+      defaultText = literalExpression "pkgs.stdenv.hostPlatform.isLinux";
       description = ''
         Whether to enable SO_REUSEPORT on all used sockets. This lets multiple
         processes bind to the same port. This speeds up operation especially

nixos/modules/services/networking/pleroma.nix

@@ -1,7 +1,13 @@
-{ config, options, lib, pkgs, stdenv, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.services.pleroma;
-in {
+in
+{
   options = {
     services.pleroma = with lib; {
       enable = mkEnableOption "pleroma";
@@ -48,7 +54,7 @@ in {
 
           Have a look to Pleroma section in the NixOS manual for more
           information.
-          '';
+        '';
       };
 
       secretConfigFile = mkOption {
@@ -73,7 +79,7 @@ in {
         group = cfg.group;
         isSystemUser = true;
       };
-      groups."${cfg.group}" = {};
+      groups."${cfg.group}" = { };
     };
 
     environment.systemPackages = [ cfg.package ];
@@ -90,57 +96,79 @@ in {
       import_config "${cfg.secretConfigFile}"
     '';
 
-    systemd.services.pleroma = {
-      description = "Pleroma social network";
-      wants = [ "network-online.target" ];
-      after = [ "network-online.target" "postgresql.service" ];
-      wantedBy = [ "multi-user.target" ];
-      restartTriggers = [ config.environment.etc."/pleroma/config.exs".source ];
-      environment.RELEASE_COOKIE = "/var/lib/pleroma/.cookie";
-      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
-        Type = "exec";
-        WorkingDirectory = "~";
-        StateDirectory = "pleroma pleroma/static pleroma/uploads";
-        StateDirectoryMode = "700";
+    systemd.services =
+      let
+        commonSystemdServiceConfig = {
+          User = cfg.user;
+          Group = cfg.group;
+          WorkingDirectory = "~";
+          StateDirectory = "pleroma pleroma/static pleroma/uploads";
+          StateDirectoryMode = "700";
+          # Systemd sandboxing directives.
+          # Taken from the upstream contrib systemd service at
+          # pleroma/installation/pleroma.service
+          PrivateTmp = true;
+          ProtectHome = true;
+          ProtectSystem = "full";
+          PrivateDevices = false;
+          NoNewPrivileges = true;
+          CapabilityBoundingSet = "~CAP_SYS_ADMIN";
+        };
 
-        # Checking the conf file is there then running the database
-        # migration before each service start, just in case there are
-        # some pending ones.
-        #
-        # It's sub-optimal as we'll always run this, even if pleroma
-        # has not been updated. But the no-op process is pretty fast.
-        # Better be safe than sorry migration-wise.
-        ExecStartPre =
-          let preScript = pkgs.writers.writeBashBin "pleromaStartPre" ''
-            if [ ! -f /var/lib/pleroma/.cookie ]
-            then
-              echo "Creating cookie file"
-              dd if=/dev/urandom bs=1 count=16 | hexdump -e '16/1 "%02x"' > /var/lib/pleroma/.cookie
-            fi
-            ${cfg.package}/bin/pleroma_ctl migrate
-          '';
-          in "${preScript}/bin/pleromaStartPre";
+      in
+      {
+        pleroma-migrations = {
+          description = "Pleroma social network migrations";
+          wants = [ "network-online.target" ];
+          after = [
+            "network-online.target"
+            "postgresql.service"
+          ];
+          wantedBy = [ "pleroma.service" ];
+          environment.RELEASE_COOKIE = "/var/lib/pleroma/.cookie";
+          serviceConfig = commonSystemdServiceConfig // {
+            Type = "oneshot";
+            # Checking the conf file is there then running the database
+            # migration before each service start, just in case there are
+            # some pending ones.
+            #
+            # It's sub-optimal as we'll always run this, even if pleroma
+            # has not been updated. But the no-op process is pretty fast.
+            # Better be safe than sorry migration-wise.
+            ExecStart =
+              let
+                preScript = pkgs.writers.writeBashBin "pleroma-migrations" ''
+                  if [ ! -f /var/lib/pleroma/.cookie ]
+                  then
+                    echo "Creating cookie file"
+                    dd if=/dev/urandom bs=1 count=16 | hexdump -e '16/1 "%02x"' > /var/lib/pleroma/.cookie
+                  fi
+                  ${cfg.package}/bin/pleroma_ctl migrate
+                '';
+              in
+              "${preScript}/bin/pleroma-migrations";
+          };
+          # disksup requires bash
+          path = [ pkgs.bash ];
+        };
 
-        ExecStart = "${cfg.package}/bin/pleroma start";
-        ExecStop = "${cfg.package}/bin/pleroma stop";
-        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-
-        # Systemd sandboxing directives.
-        # Taken from the upstream contrib systemd service at
-        # pleroma/installation/pleroma.service
-        PrivateTmp = true;
-        ProtectHome = true;
-        ProtectSystem = "full";
-        PrivateDevices = false;
-        NoNewPrivileges = true;
-        CapabilityBoundingSet = "~CAP_SYS_ADMIN";
+        pleroma = {
+          description = "Pleroma social network";
+          wants = [ "pleroma-migrations.service" ];
+          after = [ "pleroma-migrations.service" ];
+          wantedBy = [ "multi-user.target" ];
+          restartTriggers = [ config.environment.etc."/pleroma/config.exs".source ];
+          environment.RELEASE_COOKIE = "/var/lib/pleroma/.cookie";
+          serviceConfig = commonSystemdServiceConfig // {
+            Type = "exec";
+            ExecStart = "${cfg.package}/bin/pleroma start";
+            ExecStop = "${cfg.package}/bin/pleroma stop";
+            ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+          };
+          # disksup requires bash
+          path = [ pkgs.bash ];
+        };
       };
-      # disksup requires bash
-      path = [ pkgs.bash ];
-    };
-
   };
   meta.maintainers = with lib.maintainers; [ picnoir ];
   meta.doc = ./pleroma.md;

nixos/modules/services/networking/scion/scion-ip-gateway.nix

@@ -0,0 +1,92 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+
+let
+  globalCfg = config.services.scion;
+  cfg = config.services.scion.scion-ip-gateway;
+  toml = pkgs.formats.toml { };
+  json = pkgs.formats.json { };
+  connectionDir = if globalCfg.stateless then "/run" else "/var/lib";
+  defaultConfig = {
+    tunnel = { };
+    gateway = {
+      traffic_policy_file = "${trafficConfigFile}";
+    };
+  };
+  defaultTrafficConfig = {
+    ASes = { };
+    ConfigVersion = 9001;
+  };
+  configFile = toml.generate "scion-ip-gateway.toml" (recursiveUpdate defaultConfig cfg.config);
+  trafficConfigFile = json.generate "scion-ip-gateway-traffic.json" (
+    recursiveUpdate defaultTrafficConfig cfg.trafficConfig
+  );
+in
+{
+  options.services.scion.scion-ip-gateway = {
+    enable = mkEnableOption "the scion-ip-gateway service";
+    config = mkOption {
+      default = { };
+      type = toml.type;
+      example = literalExpression ''
+        {
+          tunnel = {
+            src_ipv4 = "172.16.100.1";
+          };
+        }
+      '';
+      description = ''
+        scion-ip-gateway daemon configuration
+      '';
+    };
+    trafficConfig = mkOption {
+      default = { };
+      type = json.type;
+      example = literalExpression ''
+        {
+          ASes = {
+            "2-ffaa:0:b" = {
+              Nets = [
+                  "172.16.1.0/24"
+              ];
+            };
+          };
+          ConfigVersion = 9001;
+        }
+      '';
+      description = ''
+        scion-ip-gateway traffic configuration
+      '';
+    };
+  };
+  config = mkIf cfg.enable {
+    systemd.services.scion-ip-gateway = {
+      description = "SCION IP Gateway Service";
+      after = [
+        "network-online.target"
+        "scion-dispatcher.service"
+      ];
+      wants = [
+        "network-online.target"
+        "scion-dispatcher.service"
+      ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        Group = if (config.services.scion.scion-dispatcher.enable == true) then "scion" else null;
+        ExecStart = "${globalCfg.package}/bin/scion-ip-gateway --config ${configFile}";
+        DynamicUser = true;
+        AmbientCapabilities = [ "CAP_NET_ADMIN" ];
+        Restart = "on-failure";
+        KillMode = "control-group";
+        RemainAfterExit = false;
+      };
+    };
+  };
+}

nixos/modules/services/networking/scion/scion.nix

@@ -42,6 +42,7 @@ in
       scion-daemon.enable = true;
       scion-router.enable = true;
       scion-control.enable = true;
+      scion-ip-gateway.enable = true;
     };
     assertions = [
       { assertion = cfg.bypassBootstrapWarning == true;

nixos/modules/services/networking/ssh/sshd.nix

@@ -585,7 +585,8 @@ in
                       if ! [ -h "${k.path}" ]; then
                           rm -f "${k.path}"
                       fi
-                      mkdir -m 0755 -p "$(dirname '${k.path}')"
+                      mkdir -p "$(dirname '${k.path}')"
+                      chmod 0755 "$(dirname '${k.path}')"
                       ssh-keygen \
                         -t "${k.type}" \
                         ${lib.optionalString (k ? bits) "-b ${toString k.bits}"} \

nixos/modules/services/networking/strongswan.nix

@@ -3,14 +3,12 @@
 let
 
   inherit (builtins) toFile;
-  inherit (lib) concatMapStringsSep concatStringsSep mapAttrsToList
+  inherit (lib) concatMapStrings concatStringsSep mapAttrsToList
                 mkIf mkEnableOption mkOption types literalExpression optionalString;
 
   cfg = config.services.strongswan;
 
-  ipsecSecrets = secrets: toFile "ipsec.secrets" (
-    concatMapStringsSep "\n" (f: "include ${f}") secrets
-  );
+  ipsecSecrets = secrets: concatMapStrings (f: "include ${f}\n") secrets;
 
   ipsecConf = {setup, connections, ca}:
     let
@@ -138,16 +136,12 @@ in
   };
 
 
-  config = with cfg;
-  let
-    secretsFile = ipsecSecrets cfg.secrets;
-  in
-  mkIf enable
+  config = with cfg; mkIf enable
     {
 
     # here we should use the default strongswan ipsec.secrets and
     # append to it (default one is empty so not a pb for now)
-    environment.etc."ipsec.secrets".source = secretsFile;
+    environment.etc."ipsec.secrets".text = ipsecSecrets cfg.secrets;
 
     systemd.services.strongswan = {
       description = "strongSwan IPSec Service";
@@ -156,7 +150,10 @@ in
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       environment = {
-        STRONGSWAN_CONF = strongswanConf { inherit setup connections ca secretsFile managePlugins enabledPlugins; };
+        STRONGSWAN_CONF = strongswanConf {
+          inherit setup connections ca managePlugins enabledPlugins;
+          secretsFile = "/etc/ipsec.secrets";
+        };
       };
       serviceConfig = {
         ExecStart  = "${pkgs.strongswan}/sbin/ipsec start --nofork";

nixos/modules/services/networking/tailscale.nix

@@ -60,6 +60,33 @@ in {
       '';
     };
 
+    authKeyParameters = mkOption {
+      type = types.submodule {
+        options = {
+          ephemeral = mkOption {
+            type = types.nullOr types.bool;
+            default = null;
+            description = "Whether to register as an ephemeral node.";
+          };
+          preauthorized = mkOption {
+            type = types.nullOr types.bool;
+            default = null;
+            description = "Whether to skip manual device approval.";
+          };
+          baseURL = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = "Base URL for the Tailscale API.";
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Extra parameters to pass after the auth key.
+        See https://tailscale.com/kb/1215/oauth-clients#registering-new-nodes-using-oauth-credentials
+      '';
+    };
+
     extraUpFlags = mkOption {
       description = ''
         Extra flags to pass to {command}`tailscale up`. Only applied if `authKeyFile` is specified.";
@@ -88,8 +115,10 @@ in {
     environment.systemPackages = [ cfg.package ]; # for the CLI
     systemd.packages = [ cfg.package ];
     systemd.services.tailscaled = {
+      after = lib.mkIf (config.networking.networkmanager.enable) [ "NetworkManager-wait-online.service" ];
       wantedBy = [ "multi-user.target" ];
       path = [
+        (builtins.dirOf config.security.wrapperDir) # for `su` to use taildrive with correct access rights
         pkgs.procps     # for collecting running services (opt-in feature)
         pkgs.getent     # for `getent` to look up user shells
         pkgs.kmod       # required to pass tailscale's v6nat check
@@ -121,10 +150,25 @@ in {
       serviceConfig = {
         Type = "oneshot";
       };
-      script = ''
-        status=$(${config.systemd.package}/bin/systemctl show -P StatusText tailscaled.service)
-        if [[ $status != Connected* ]]; then
-          ${cfg.package}/bin/tailscale up --auth-key 'file:${cfg.authKeyFile}' ${escapeShellArgs cfg.extraUpFlags}
+      # https://github.com/tailscale/tailscale/blob/v1.72.1/ipn/backend.go#L24-L32
+      script = let
+        statusCommand = "${lib.getExe cfg.package} status --json --peers=false | ${lib.getExe pkgs.jq} -r '.BackendState'";
+        paramToString = v:
+          if (builtins.isBool v) then (lib.boolToString v)
+          else (toString v);
+        params = lib.pipe cfg.authKeyParameters [
+          (lib.filterAttrs (_: v: v != null))
+          (lib.mapAttrsToList (k: v: "${k}=${paramToString v}"))
+          (builtins.concatStringsSep "&")
+          (params: if params != "" then "?${params}" else "")
+        ];
+      in ''
+        while [[ "$(${statusCommand})" == "NoState" ]]; do
+          sleep 0.5
+        done
+        status=$(${statusCommand})
+        if [[ "$status" == "NeedsLogin" || "$status" == "NeedsMachineAuth" ]]; then
+          ${lib.getExe cfg.package} up --auth-key "$(cat ${cfg.authKeyFile})${params}" ${escapeShellArgs cfg.extraUpFlags}
         fi
       '';
     };
@@ -137,7 +181,7 @@ in {
         Type = "oneshot";
       };
       script = ''
-        ${cfg.package}/bin/tailscale set ${escapeShellArgs cfg.extraSetFlags}
+        ${lib.getExe cfg.package} set ${escapeShellArgs cfg.extraSetFlags}
       '';
     };
 

nixos/modules/services/networking/veilid.nix

@@ -0,0 +1,227 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+with lib;
+let
+  cfg = config.services.veilid;
+  dataDir = "/var/db/veilid-server";
+
+  settingsFormat = pkgs.formats.yaml { };
+  configFile = settingsFormat.generate "veilid-server.conf" cfg.settings;
+in
+{
+  config = mkIf cfg.enable {
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ 5150 ];
+      allowedUDPPorts = [ 5150 ];
+    };
+
+    # Based on https://gitlab.com/veilid/veilid/-/blob/main/package/systemd/veilid-server.service?ref_type=heads
+    systemd.services.veilid = {
+      enable = true;
+      description = "Veilid Headless Node";
+      wants = [ "network-online.target" ];
+      before = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [ configFile ];
+      environment = {
+        RUST_BACKTRACE = "1";
+      };
+      serviceConfig = {
+        ExecStart = "${pkgs.veilid}/bin/veilid-server -c ${configFile}";
+        ExecReload = "${pkgs.coreutils}/bin/kill -s HUP $MAINPID";
+        KillSignal = "SIGQUIT";
+        TimeoutStopSec = 5;
+        WorkingDirectory = "/";
+        User = "veilid";
+        Group = "veilid";
+        UMask = "0002";
+
+        CapabilityBoundingSet = "";
+        SystemCallFilter = [ "@system-service" ];
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectHome = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ReadWritePaths = dataDir;
+
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        LockPersonality = true;
+        RestrictSUIDSGID = true;
+      };
+    };
+    users.users.veilid = {
+      isSystemUser = true;
+      group = "veilid";
+      home = dataDir;
+      createHome = true;
+    };
+    users.groups.veilid = { };
+
+    environment = {
+      systemPackages = [ pkgs.veilid ];
+    };
+    services.veilid.settings = { };
+  };
+
+  options.services.veilid = {
+    enable = mkEnableOption "Veilid Headless Node";
+    openFirewall = mkOption {
+      default = false;
+      type = types.bool;
+      description = "Whether to open firewall on ports 5150/tcp, 5150/udp";
+    };
+    settings = mkOption {
+      description = ''
+        Build veilid-server.conf with nix expression.
+        Check <link xlink:href="https://veilid.gitlab.io/developer-book/admin/config.html#configuration-keys">Configuration Keys</link>.
+      '';
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+
+        options = {
+          client_api = {
+            ipc_enabled = mkOption {
+              type = types.bool;
+              default = true;
+              description = "veilid-server will respond to Python and other JSON client requests.";
+            };
+            ipc_directory = mkOption {
+              type = types.str;
+              default = "${dataDir}/ipc";
+              description = "IPC directory where file sockets are stored.";
+            };
+          };
+          logging = {
+            system = {
+              enabled = mkOption {
+                type = types.bool;
+                default = true;
+                description = "Events of type 'system' will be logged.";
+              };
+              level = mkOption {
+                type = types.str;
+                default = "info";
+                example = "debug";
+                description = "The minimum priority of system events to be logged.";
+              };
+            };
+            terminal = {
+              enabled = mkOption {
+                type = types.bool;
+                default = false;
+                description = "Events of type 'terminal' will be logged.";
+              };
+              level = mkOption {
+                type = types.str;
+                default = "info";
+                example = "debug";
+                description = "The minimum priority of terminal events to be logged.";
+              };
+            };
+            api = {
+              enabled = mkOption {
+                type = types.bool;
+                default = false;
+                description = "Events of type 'api' will be logged.";
+              };
+              level = mkOption {
+                type = types.str;
+                default = "info";
+                example = "debug";
+                description = "The minimum priority of api events to be logged.";
+              };
+            };
+          };
+          core = {
+            capabilities = {
+              disable = mkOption {
+                type = types.listOf types.str;
+                default = [ ];
+                example = [ "APPM" ];
+                description = "A list of capabilities to disable (for example, DHTV to say you cannot store DHT information).";
+              };
+            };
+            protected_store = {
+              allow_insecure_fallback = mkOption {
+                type = types.bool;
+                default = true;
+                description = "If we can't use system-provided secure storage, should we proceed anyway?";
+              };
+              always_use_insecure_storage = mkOption {
+                type = types.bool;
+                default = true;
+                description = "Should we bypass any attempt to use system-provided secure storage?";
+              };
+              directory = mkOption {
+                type = types.str;
+                default = "${dataDir}/protected_store";
+                description = "The filesystem directory to store your protected store in.";
+              };
+            };
+            table_store = {
+              directory = mkOption {
+                type = types.str;
+                default = "${dataDir}/table_store";
+                description = "The filesystem directory to store your table store within.";
+              };
+            };
+            block_store = {
+              directory = mkOption {
+                type = types.nullOr types.str;
+                default = "${dataDir}/block_store";
+                description = "The filesystem directory to store blocks for the block store.";
+              };
+            };
+            network = {
+              routing_table = {
+                bootstrap = mkOption {
+                  type = types.listOf types.str;
+                  default = [ "bootstrap.veilid.net" ];
+                  description = "Host name of existing well-known Veilid bootstrap servers for the network to connect to.";
+                };
+                node_id = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                  description = "Base64-encoded public key for the node, used as the node's ID.";
+                };
+              };
+              dht = {
+                min_peer_count = mkOption {
+                  type = types.number;
+                  default = 20;
+                  description = "Minimum number of nodes to keep in the peer table.";
+                };
+              };
+              upnp = mkOption {
+                type = types.bool;
+                default = true;
+                description = "Should the app try to improve its incoming network connectivity using UPnP?";
+              };
+              detect_address_changes = mkOption {
+                type = types.bool;
+                default = true;
+                description = "Should veilid-core detect and notify on network address changes?";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ figboy9 ];
+}