nixos/public-inbox: use DynamicUser for readers

public-inbox-{http,nntp,imap}d only need to be able to read the
repositories, so they don't need to run as the public-inbox user,
which has write permission for /var/lib/public-inbox.

Annoyingly, confinement is currently not compatible with DynamicUser,
so we can't enable both at the same time.

.github/CODEOWNERS

@@ -305,10 +305,3 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/build-support/ocaml           @romildo @ulrikstrid
 /pkgs/development/compilers/ocaml   @romildo @ulrikstrid
 /pkgs/development/ocaml-modules     @romildo @ulrikstrid
-
-# ZFS
-pkgs/os-specific/linux/zfs                @raitobezarius
-nixos/lib/make-single-disk-zfs-image.nix  @raitobezarius
-nixos/lib/make-multi-disk-zfs-image.nix   @raitobezarius
-nixos/modules/tasks/filesystems/zfs.nix   @raitobezarius
-nixos/tests/zfs.nix                       @raitobezarius

.github/PULL_REQUEST_TEMPLATE.md

@@ -22,7 +22,7 @@ For new packages please briefly describe the package or provide a link to its ho
   - made sure NixOS tests are [linked](https://nixos.org/manual/nixpkgs/unstable/#ssec-nixos-tests-linking) to the relevant packages
 - [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"`. Note: all changes have to be committed, also see [nixpkgs-review usage](https://github.com/Mic92/nixpkgs-review#usage)
 - [ ] Tested basic functionality of all binary files (usually in `./result/bin/`)
-- [23.11 Release Notes (or backporting 23.05 Release notes)](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#generating-2305-release-notes)
+- [23.05 Release Notes (or backporting 22.11 Release notes)](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#generating-2305-release-notes)
   - [ ] (Package updates) Added a release notes entry if the change is major or breaking
   - [ ] (Module updates) Added a release notes entry if the change is significant
   - [ ] (Module addition) Added a release notes entry if adding a new NixOS module

.github/workflows/basic-eval.yml

@@ -19,7 +19,7 @@ jobs:
     # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
     steps:
     - uses: actions/checkout@v3
-    - uses: cachix/install-nix-action@v21
+    - uses: cachix/install-nix-action@v20
     - uses: cachix/cachix-action@v12
       with:
         # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.

.github/workflows/check-maintainers-sorted.yaml

@@ -16,7 +16,7 @@ jobs:
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v20
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true

.github/workflows/editorconfig.yml

@@ -28,7 +28,7 @@ jobs:
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
-    - uses: cachix/install-nix-action@v21
+    - uses: cachix/install-nix-action@v20
       with:
         # nixpkgs commit is pinned so that it doesn't break
         # editorconfig-checker 2.4.0

.github/workflows/manual-nixos.yml

@@ -18,7 +18,7 @@ jobs:
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v20
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true

.github/workflows/manual-nixpkgs.yml

@@ -19,7 +19,7 @@ jobs:
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v20
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true

.github/workflows/manual-rendering.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v20
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true

.github/workflows/update-terraform-providers.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v21
+      - uses: cachix/install-nix-action@v20
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
       - name: setup

CONTRIBUTING.md

@@ -106,17 +106,17 @@ git push origin feature --force-with-lease
 
 Follow these steps to backport a change into a release branch in compliance with the [commit policy](https://nixos.org/nixpkgs/manual/#submitting-changes-stable-release-branches).
 
-You can add a label such as `backport release-23.05` to a PR, so that merging it will
+You can add a label such as `backport release-22.11` to a PR, so that merging it will
 automatically create a backport (via [a GitHub Action](.github/workflows/backport.yml)).
-This also works for pull requests that have already been merged, and might take a couple of minutes to trigger.
+This also works for PR's that have already been merged, and might take a couple of minutes to trigger.
 
 You can also create the backport manually:
 
 1. Take note of the commits in which the change was introduced into `master` branch.
-2. Check out the target _release branch_, e.g. `release-23.05`. Do not use a _channel branch_ like `nixos-23.05` or `nixpkgs-23.05-darwin`.
+2. Check out the target _release branch_, e.g. `release-22.11`. Do not use a _channel branch_ like `nixos-22.11` or `nixpkgs-22.11-darwin`.
 3. Create a branch for your change, e.g. `git checkout -b backport`.
 4. When the reason to backport is not obvious from the original commit message, use `git cherry-pick -xe <original commit>` and add a reason. Otherwise use `git cherry-pick -x <original commit>`. That's fine for minor version updates that only include security and bug fixes, commits that fixes an otherwise broken package or similar. Please also ensure the commits exists on the master branch; in the case of squashed or rebased merges, the commit hash will change and the new commits can be found in the merge message at the bottom of the master pull request.
-5. Push to GitHub and open a backport pull request. Make sure to select the release branch (e.g. `release-23.05`) as the target branch of the pull request, and link to the pull request in which the original change was committed to `master`. The pull request title should be the commit title with the release version as prefix, e.g. `[23.05]`.
+5. Push to GitHub and open a backport pull request. Make sure to select the release branch (e.g. `release-22.11`) as the target branch of the pull request, and link to the pull request in which the original change was committed to `master`. The pull request title should be the commit title with the release version as prefix, e.g. `[22.11]`.
 6. When the backport pull request is merged and you have the necessary privileges you can also replace the label `9.needs: port to stable` with `8.has: port to stable` on the original pull request. This way maintainers can keep track of missing backports easier.
 
 ## Criteria for Backporting changes
@@ -128,7 +128,7 @@ Anything that does not cause user or downstream dependency regressions can be ba
 - Services which require a client to be up-to-date regardless. (E.g. `spotify`, `steam`, or `discord`)
 - Security critical applications (E.g. `firefox`)
 
-## Generating 23.11 Release Notes
+## Generating 23.05 Release Notes
 <!--
 note: title unchanged even though we don't need regeneration because extant
 PRs will link here. definitely change the title for 23.11 though.
@@ -136,10 +136,10 @@ PRs will link here. definitely change the title for 23.11 though.
 
 Documentation in nixpkgs is transitioning to a markdown-centric workflow. In the past release notes required a translation step to convert from markdown to a compatible docbook document, but this is no longer necessary.
 
-Steps for updating 23.11 Release notes:
+Steps for updating 23.05 Release notes:
 
-1. Edit `nixos/doc/manual/release-notes/rl-2311.section.md` with the desired changes
+1. Edit `nixos/doc/manual/release-notes/rl-2305.section.md` with the desired changes
-2. Commit changes to `rl-2311.section.md`.
+2. Commit changes to `rl-2305.section.md`.
 
 ## Reviewing contributions
 

README.md

@@ -51,9 +51,9 @@ Nixpkgs and NixOS are built and tested by our continuous integration
 system, [Hydra](https://hydra.nixos.org/).
 
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 23.05 release](https://hydra.nixos.org/jobset/nixos/release-23.05)
+* [Continuous package builds for the NixOS 22.11 release](https://hydra.nixos.org/jobset/nixos/release-22.11)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 23.05 release](https://hydra.nixos.org/job/nixos/release-23.05/tested#tabs-constituents)
+* [Tests for the NixOS 22.11 release](https://hydra.nixos.org/job/nixos/release-22.11/tested#tabs-constituents)
 
 Artifacts successfully built with Hydra are published to cache at
 https://cache.nixos.org/. When successful build and test criteria are

doc/languages-frameworks/dhall.section.md

@@ -307,12 +307,12 @@ $ nix-env --install --attr haskellPackages.dhall-nixpkgs
 
 $ nix-env --install --attr nix-prefetch-git  # Used by dhall-to-nixpkgs
 
-$ dhall-to-nixpkgs github https://github.com/Gabriella439/dhall-semver.git
+$ dhall-to-nixpkgs github https://github.com/Gabriel439/dhall-semver.git
 { buildDhallGitHubPackage, Prelude }:
   buildDhallGitHubPackage {
     name = "dhall-semver";
     githubBase = "github.com";
-    owner = "Gabriella439";
+    owner = "Gabriel439";
     repo = "dhall-semver";
     rev = "2d44ae605302ce5dc6c657a1216887fbb96392a4";
     fetchSubmodules = false;

doc/languages-frameworks/haskell.section.md

@@ -276,15 +276,6 @@ Defaults to `true`.
 : Whether to generate an index for interactive navigation of the HTML documentation.
 Defaults to `true` if supported.
 
-`doInstallIntermediates`
-: Whether to install intermediate build products (files written to `dist/build`
-by GHC during the build process). With `enableSeparateIntermediatesOutput`,
-these files are instead installed to [a separate `intermediates`
-output.][multiple-outputs] The output can then be passed into a future build of
-the same package with the `previousIntermediates` argument to support
-incremental builds. See [“Incremental builds”](#haskell-incremental-builds) for
-more information. Defaults to `false`.
-
 `enableLibraryProfiling`
 : Whether to enable [profiling][profiling] for libraries contained in the
 package. Enabled by default if supported.
@@ -380,12 +371,6 @@ Defaults to `false`.
 : Whether to install documentation to a separate `doc` output.
 Is automatically enabled if `doHaddock` is `true`.
 
-`enableSeparateIntermediatesOutput`
-: When `doInstallIntermediates` is true, whether to install intermediate build
-products to a separate `intermediates` output. See [“Incremental
-builds”](#haskell-incremental-builds) for more information. Defaults to
-`false`.
-
 `allowInconsistentDependencies`
 : If enabled, allow multiple versions of the same Haskell package in the
 dependency tree at configure time. Often in such a situation compilation would
@@ -396,11 +381,6 @@ later fail because of type mismatches. Defaults to `false`.
 when loading the library in the REPL, but requires extra build time and
 disk space. Defaults to `false`.
 
-`previousIntermediates`
-: If non-null, intermediate build artifacts are copied from this input to
-`dist/build` before performing compiling. See [“Incremental
-builds”](#haskell-incremental-builds) for more information. Defaults to `null`.
-
 `buildTarget`
 : Name of the executable or library to build and install.
 If unset, all available targets are built and installed.
@@ -516,54 +496,6 @@ the [Meta-attributes section](#chap-meta) for their documentation.
     * `broken`
     * `hydraPlatforms`
 
-### Incremental builds {#haskell-incremental-builds}
-
-`haskellPackages.mkDerivation` supports incremental builds for GHC 9.4 and
-newer with the `doInstallIntermediates`, `enableSeparateIntermediatesOutput`,
-and `previousIntermediates` arguments.
-
-The basic idea is to first perform a full build of the package in question,
-save its intermediate build products for later, and then copy those build
-products into the build directory of an incremental build performed later.
-Then, GHC will use those build artifacts to avoid recompiling unchanged
-modules.
-
-For more detail on how to store and use incremental build products, see
-[Gabriella Gonzalez’ blog post “Nixpkgs support for incremental Haskell
-builds”.][incremental-builds] motivation behind this feature.
-
-An incremental build for [the `turtle` package][turtle] can be performed like
-so:
-
-```nix
-let
-  pkgs = import <nixpkgs> {};
-  inherit (pkgs) haskell;
-  inherit (haskell.lib.compose) overrideCabal;
-
-  # Incremental builds work with GHC >=9.4.
-  turtle = haskell.packages.ghc944.turtle;
-
-  # This will do a full build of `turtle`, while writing the intermediate build products
-  # (compiled modules, etc.) to the `intermediates` output.
-  turtle-full-build-with-incremental-output = overrideCabal (drv: {
-    doInstallIntermediates = true;
-    enableSeparateIntermediatesOutput = true;
-  }) turtle;
-
-  # This will do an incremental build of `turtle` by copying the previously
-  # compiled modules and intermediate build products into the source tree
-  # before running the build.
-  #
-  # GHC will then naturally pick up and reuse these products, making this build
-  # complete much more quickly than the previous one.
-  turtle-incremental-build = overrideCabal (drv: {
-    previousIntermediates = turtle-full-build-with-incremental-output.intermediates;
-  }) turtle;
-in
-  turtle-incremental-build
-```
-
 ## Development environments {#haskell-development-environments}
 
 In addition to building and installing Haskell software, nixpkgs can also
@@ -1151,11 +1083,8 @@ on the issue linked above.
 [haskell.nix]: https://input-output-hk.github.io/haskell.nix/index.html
 [HLS user guide]: https://haskell-language-server.readthedocs.io/en/latest/configuration.html#configuring-your-editor
 [hoogle]: https://wiki.haskell.org/Hoogle
-[incremental-builds]: https://www.haskellforall.com/2022/12/nixpkgs-support-for-incremental-haskell.html
 [jailbreak-cabal]: https://github.com/NixOS/jailbreak-cabal/
-[multiple-outputs]: https://nixos.org/manual/nixpkgs/stable/#chap-multiple-output
 [optparse-applicative-completions]: https://github.com/pcapriotti/optparse-applicative/blob/7726b63796aa5d0df82e926d467f039b78ca09e2/README.md#bash-zsh-and-fish-completions
 [profiling-detail]: https://cabal.readthedocs.io/en/latest/cabal-project.html#cfg-field-profiling-detail
 [profiling]: https://downloads.haskell.org/~ghc/latest/docs/html/users_guide/profiling.html
 [search.nixos.org]: https://search.nixos.org
-[turtle]: https://hackage.haskell.org/package/turtle

doc/languages-frameworks/python.section.md

@@ -1514,6 +1514,10 @@ Note: There is a boolean value `lib.inNixShell` set to `true` if nix-shell is in
 Packages inside nixpkgs are written by hand. However many tools exist in
 community to help save time. No tool is preferred at the moment.
 
+- [pypi2nix](https://github.com/nix-community/pypi2nix): Generate Nix
+  expressions for your Python project. Note that [sharing derivations from
+  pypi2nix with nixpkgs is possible but not
+  encouraged](https://github.com/nix-community/pypi2nix/issues/222#issuecomment-443497376).
 - [nixpkgs-pytools](https://github.com/nix-community/nixpkgs-pytools)
 - [poetry2nix](https://github.com/nix-community/poetry2nix)
 

doc/stdenv/meta.chapter.md

@@ -182,7 +182,7 @@ runCommand "my-package-test" {
 
 ### `timeout` {#var-meta-timeout}
 
-A timeout (in seconds) for building the derivation. If the derivation takes longer than this time to build, Hydra will fail it due to breaking the timeout. However, all computers do not have the same computing power, hence some builders may decide to apply a multiplicative factor to this value. When filling this value in, try to keep it approximately consistent with other values already present in `nixpkgs`.
+A timeout (in seconds) for building the derivation. If the derivation takes longer than this time to build, it can fail due to breaking the timeout. However, all computers do not have the same computing power, hence some builders may decide to apply a multiplicative factor to this value. When filling this value in, try to keep it approximately consistent with other values already present in `nixpkgs`.
 
 `meta` attributes are not stored in the instantiated derivation.
 Therefore, this setting may be lost when the package is used as a dependency.

lib/attrsets.nix

@@ -123,11 +123,7 @@ rec {
          { x = "a"; y = "b"; }
        => { x = "a"; xa = "a"; y = "b"; yb = "b"; }
   */
-  concatMapAttrs = f: v:
+  concatMapAttrs = f: flip pipe [ (mapAttrs f) attrValues (foldl' mergeAttrs { }) ];
-    foldl' mergeAttrs { }
-      (attrValues
-        (mapAttrs f v)
-      );
 
 
   /* Update or set specific paths of an attribute set.

lib/derivations.nix

@@ -31,7 +31,7 @@ in
 
         (lazyDerivation { inherit derivation; meta.foo = true; }).meta
 
-    In these expressions, `derivation` _will_ be evaluated:
+    In these expressions, it `derivation` _will_ be evaluated:
 
         "${lazyDerivation { inherit derivation }}"
 

lib/systems/doubles.nix

@@ -27,9 +27,9 @@ let
     # Linux
     "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux"
     "armv7l-linux" "i686-linux" "loongarch64-linux" "m68k-linux" "microblaze-linux"
-    "microblazeel-linux" "mips-linux" "mips64-linux" "mips64el-linux"
+    "microblazeel-linux" "mipsel-linux" "mips64el-linux" "powerpc64-linux"
-    "mipsel-linux" "powerpc64-linux" "powerpc64le-linux" "riscv32-linux"
+    "powerpc64le-linux" "riscv32-linux" "riscv64-linux" "s390-linux"
-    "riscv64-linux" "s390-linux" "s390x-linux" "x86_64-linux"
+    "s390x-linux" "x86_64-linux"
 
     # MMIXware
     "mmix-mmixware"

lib/systems/examples.nix

@@ -93,14 +93,20 @@ rec {
   # can execute on 32bit chip
   mips-linux-gnu                = { config = "mips-unknown-linux-gnu";                } // platforms.gcc_mips32r2_o32;
   mipsel-linux-gnu              = { config = "mipsel-unknown-linux-gnu";              } // platforms.gcc_mips32r2_o32;
+  mipsisa32r6-linux-gnu         = { config = "mipsisa32r6-unknown-linux-gnu";         } // platforms.gcc_mips32r6_o32;
+  mipsisa32r6el-linux-gnu       = { config = "mipsisa32r6el-unknown-linux-gnu";       } // platforms.gcc_mips32r6_o32;
 
   # require 64bit chip (for more registers, 64-bit floating point, 64-bit "long long") but use 32bit pointers
   mips64-linux-gnuabin32        = { config = "mips64-unknown-linux-gnuabin32";        } // platforms.gcc_mips64r2_n32;
   mips64el-linux-gnuabin32      = { config = "mips64el-unknown-linux-gnuabin32";      } // platforms.gcc_mips64r2_n32;
+  mipsisa64r6-linux-gnuabin32   = { config = "mipsisa64r6-unknown-linux-gnuabin32";   } // platforms.gcc_mips64r6_n32;
+  mipsisa64r6el-linux-gnuabin32 = { config = "mipsisa64r6el-unknown-linux-gnuabin32"; } // platforms.gcc_mips64r6_n32;
 
   # 64bit pointers
   mips64-linux-gnuabi64         = { config = "mips64-unknown-linux-gnuabi64";         } // platforms.gcc_mips64r2_64;
   mips64el-linux-gnuabi64       = { config = "mips64el-unknown-linux-gnuabi64";       } // platforms.gcc_mips64r2_64;
+  mipsisa64r6-linux-gnuabi64    = { config = "mipsisa64r6-unknown-linux-gnuabi64";    } // platforms.gcc_mips64r6_64;
+  mipsisa64r6el-linux-gnuabi64  = { config = "mipsisa64r6el-unknown-linux-gnuabi64";  } // platforms.gcc_mips64r6_64;
 
   muslpi = raspberryPi // {
     config = "armv6l-unknown-linux-musleabihf";

lib/systems/parse.nix

@@ -93,8 +93,12 @@ rec {
 
     mips          = { bits = 32; significantByte = bigEndian;    family = "mips"; };
     mipsel        = { bits = 32; significantByte = littleEndian; family = "mips"; };
+    mipsisa32r6   = { bits = 32; significantByte = bigEndian;    family = "mips"; };
+    mipsisa32r6el = { bits = 32; significantByte = littleEndian; family = "mips"; };
     mips64        = { bits = 64; significantByte = bigEndian;    family = "mips"; };
     mips64el      = { bits = 64; significantByte = littleEndian; family = "mips"; };
+    mipsisa64r6   = { bits = 64; significantByte = bigEndian;    family = "mips"; };
+    mipsisa64r6el = { bits = 64; significantByte = littleEndian; family = "mips"; };
 
     mmix     = { bits = 64; significantByte = bigEndian;    family = "mmix"; };
 

lib/tests/filesystem.sh

@@ -35,50 +35,58 @@ touch regular
 ln -s target symlink
 mkfifo fifo
 
-expectSuccess() {
+checkPathType() {
-    local expr=$1
+    local path=$1
-    local expectedResultRegex=$2
+    local expectedPathType=$2
-    if ! result=$(nix-instantiate --eval --strict --json \
+    local actualPathType=$(nix-instantiate --eval --strict --json 2>&1 \
-        --expr "with (import <nixpkgs/lib>).filesystem; $expr"); then
+        -E '{ path }: let lib = import <nixpkgs/lib>; in lib.filesystem.pathType path' \
-        die "$expr failed to evaluate, but it was expected to succeed"
+        --argstr path "$path")
-    fi
+    if [[ "$actualPathType" != "$expectedPathType" ]]; then
-    if [[ ! "$result" =~ $expectedResultRegex ]]; then
+        die "lib.filesystem.pathType \"$path\" == $actualPathType, but $expectedPathType was expected"
-        die "$expr == $result, but $expectedResultRegex was expected"
     fi
 }
 
-expectFailure() {
+checkPathType "/" '"directory"'
-    local expr=$1
+checkPathType "$PWD/directory" '"directory"'
-    local expectedErrorRegex=$2
+checkPathType "$PWD/regular" '"regular"'
-    if result=$(nix-instantiate --eval --strict --json 2>"$work/stderr" \
+checkPathType "$PWD/symlink" '"symlink"'
-        --expr "with (import <nixpkgs/lib>).filesystem; $expr"); then
+checkPathType "$PWD/fifo" '"unknown"'
-        die "$expr evaluated successfully to $result, but it was expected to fail"
+checkPathType "$PWD/non-existent" "error: evaluation aborted with the following error message: 'lib.filesystem.pathType: Path $PWD/non-existent does not exist.'"
-    fi
+
-    if [[ ! "$(<"$work/stderr")" =~ $expectedErrorRegex ]]; then
+checkPathIsDirectory() {
-        die "Error was $(<"$work/stderr"), but $expectedErrorRegex was expected"
+    local path=$1
+    local expectedIsDirectory=$2
+    local actualIsDirectory=$(nix-instantiate --eval --strict --json 2>&1 \
+        -E '{ path }: let lib = import <nixpkgs/lib>; in lib.filesystem.pathIsDirectory path' \
+        --argstr path "$path")
+    if [[ "$actualIsDirectory" != "$expectedIsDirectory" ]]; then
+        die "lib.filesystem.pathIsDirectory \"$path\" == $actualIsDirectory, but $expectedIsDirectory was expected"
     fi
 }
 
-expectSuccess "pathType /." '"directory"'
+checkPathIsDirectory "/" "true"
-expectSuccess "pathType $PWD/directory" '"directory"'
+checkPathIsDirectory "$PWD/directory" "true"
-expectSuccess "pathType $PWD/regular" '"regular"'
+checkPathIsDirectory "$PWD/regular" "false"
-expectSuccess "pathType $PWD/symlink" '"symlink"'
+checkPathIsDirectory "$PWD/symlink" "false"
-expectSuccess "pathType $PWD/fifo" '"unknown"'
+checkPathIsDirectory "$PWD/fifo" "false"
-# Different errors depending on whether the builtins.readFilePath primop is available or not
+checkPathIsDirectory "$PWD/non-existent" "false"
-expectFailure "pathType $PWD/non-existent" "error: (evaluation aborted with the following error message: 'lib.filesystem.pathType: Path $PWD/non-existent does not exist.'|getting status of '$PWD/non-existent': No such file or directory)"
 
-expectSuccess "pathIsDirectory /." "true"
+checkPathIsRegularFile() {
-expectSuccess "pathIsDirectory $PWD/directory" "true"
+    local path=$1
-expectSuccess "pathIsDirectory $PWD/regular" "false"
+    local expectedIsRegularFile=$2
-expectSuccess "pathIsDirectory $PWD/symlink" "false"
+    local actualIsRegularFile=$(nix-instantiate --eval --strict --json 2>&1 \
-expectSuccess "pathIsDirectory $PWD/fifo" "false"
+        -E '{ path }: let lib = import <nixpkgs/lib>; in lib.filesystem.pathIsRegularFile path' \
-expectSuccess "pathIsDirectory $PWD/non-existent" "false"
+        --argstr path "$path")
+    if [[ "$actualIsRegularFile" != "$expectedIsRegularFile" ]]; then
+        die "lib.filesystem.pathIsRegularFile \"$path\" == $actualIsRegularFile, but $expectedIsRegularFile was expected"
+    fi
+}
 
-expectSuccess "pathIsRegularFile /." "false"
+checkPathIsRegularFile "/" "false"
-expectSuccess "pathIsRegularFile $PWD/directory" "false"
+checkPathIsRegularFile "$PWD/directory" "false"
-expectSuccess "pathIsRegularFile $PWD/regular" "true"
+checkPathIsRegularFile "$PWD/regular" "true"
-expectSuccess "pathIsRegularFile $PWD/symlink" "false"
+checkPathIsRegularFile "$PWD/symlink" "false"
-expectSuccess "pathIsRegularFile $PWD/fifo" "false"
+checkPathIsRegularFile "$PWD/fifo" "false"
-expectSuccess "pathIsRegularFile $PWD/non-existent" "false"
+checkPathIsRegularFile "$PWD/non-existent" "false"
 
 echo >&2 tests ok

lib/tests/modules.sh

@@ -378,7 +378,7 @@ checkConfigOutput '^{ }$' config.sub.nixosOk ./class-check.nix
 checkConfigError 'The module .*/module-class-is-darwin.nix was imported into nixos instead of darwin.' config.sub.nixosFail.config ./class-check.nix
 
 # submoduleWith type merge with different class
-checkConfigError 'A submoduleWith option is declared multiple times with conflicting class values "darwin" and "nixos".' config.sub.mergeFail.config ./class-check.nix
+checkConfigError 'error: A submoduleWith option is declared multiple times with conflicting class values "darwin" and "nixos".' config.sub.mergeFail.config ./class-check.nix
 
 # _type check
 checkConfigError 'Could not load a value as a module, because it is of type "flake", in file .*/module-imports-_type-check.nix' config.ok.config ./module-imports-_type-check.nix

lib/tests/release.nix

@@ -2,12 +2,9 @@
   # Don't test properties of pkgs.lib, but rather the lib in the parent directory
   pkgs ? import ../.. {} // { lib = throw "pkgs.lib accessed, but the lib tests should use nixpkgs' lib path directly!"; },
   nix ? pkgs.nix,
-  nixVersions ? [ pkgs.nixVersions.minimum nix pkgs.nixVersions.unstable ],
 }:
 
-let
+pkgs.runCommand "nixpkgs-lib-tests" {
-  testWithNix = nix:
-    pkgs.runCommand "nixpkgs-lib-tests-nix-${nix.version}" {
   buildInputs = [
     (import ./check-eval.nix)
     (import ./maintainers.nix {
@@ -53,12 +50,5 @@ let
     echo "Running lib/tests/sources.sh"
     TEST_LIB=$PWD/lib bash lib/tests/sources.sh
 
-      mkdir $out
+    touch $out
-      echo success > $out/${nix.version}
+''
-    '';
-
-in
-  pkgs.symlinkJoin {
-    name = "nixpkgs-lib-tests";
-    paths = map testWithNix nixVersions;
-  }

lib/tests/sources.sh

@@ -23,19 +23,14 @@ clean_up() {
 trap clean_up EXIT
 cd "$work"
 
-# Crudely unquotes a JSON string by just taking everything between the first and the second quote.
-# We're only using this for resulting /nix/store paths, which can't contain " anyways,
-# nor can they contain any other characters that would need to be escaped specially in JSON
-# This way we don't need to add a dependency on e.g. jq
-crudeUnquoteJSON() {
-    cut -d \" -f2
-}
-
 touch {README.md,module.o,foo.bar}
 
-dir="$(nix-instantiate --eval --strict --read-write-mode --json --expr '(with import <nixpkgs/lib>; "${
+# nix-instantiate doesn't write out the source, only computing the hash, so
+# this uses the experimental nix command instead.
+
+dir="$(nix eval --impure --raw --expr '(with import <nixpkgs/lib>; "${
   cleanSource ./.
-}")' | crudeUnquoteJSON)"
+}")')"
 (cd "$dir"; find) | sort -f | diff -U10 - <(cat <<EOF
 .
 ./foo.bar
@@ -44,9 +39,9 @@ EOF
 ) || die "cleanSource 1"
 
 
-dir="$(nix-instantiate --eval --strict --read-write-mode --json --expr '(with import <nixpkgs/lib>; "${
+dir="$(nix eval --impure --raw --expr '(with import <nixpkgs/lib>; "${
   cleanSourceWith { src = '"$work"'; filter = path: type: ! hasSuffix ".bar" path; }
-}")' | crudeUnquoteJSON)"
+}")')"
 (cd "$dir"; find) | sort -f | diff -U10 - <(cat <<EOF
 .
 ./module.o
@@ -54,9 +49,9 @@ dir="$(nix-instantiate --eval --strict --read-write-mode --json --expr '(with im
 EOF
 ) || die "cleanSourceWith 1"
 
-dir="$(nix-instantiate --eval --strict --read-write-mode --json --expr '(with import <nixpkgs/lib>; "${
+dir="$(nix eval --impure --raw --expr '(with import <nixpkgs/lib>; "${
   cleanSourceWith { src = cleanSource '"$work"'; filter = path: type: ! hasSuffix ".bar" path; }
-}")' | crudeUnquoteJSON)"
+}")')"
 (cd "$dir"; find) | sort -f | diff -U10 - <(cat <<EOF
 .
 ./README.md

lib/tests/systems.nix

@@ -18,7 +18,7 @@ with lib.systems.doubles; lib.runTests {
   testarm = mseteq arm [ "armv5tel-linux" "armv6l-linux" "armv6l-netbsd" "armv6l-none" "armv7a-linux" "armv7a-netbsd" "armv7l-linux" "armv7l-netbsd" "arm-none" "armv7a-darwin" ];
   testarmv7 = mseteq armv7 [ "armv7a-darwin" "armv7a-linux" "armv7l-linux" "armv7a-netbsd" "armv7l-netbsd" ];
   testi686 = mseteq i686 [ "i686-linux" "i686-freebsd13" "i686-genode" "i686-netbsd" "i686-openbsd" "i686-cygwin" "i686-windows" "i686-none" "i686-darwin" ];
-  testmips = mseteq mips [ "mips-linux" "mips64-linux" "mips64el-linux" "mipsel-linux" "mipsel-netbsd" ];
+  testmips = mseteq mips [ "mips64el-linux" "mipsel-linux" "mipsel-netbsd" ];
   testmmix = mseteq mmix [ "mmix-mmixware" ];
   testpower = mseteq power [ "powerpc-netbsd" "powerpc-none" "powerpc64-linux" "powerpc64le-linux" "powerpcle-none" ];
   testriscv = mseteq riscv [ "riscv32-linux" "riscv64-linux" "riscv32-netbsd" "riscv64-netbsd" "riscv32-none" "riscv64-none" ];
@@ -34,7 +34,7 @@ with lib.systems.doubles; lib.runTests {
   testredox = mseteq redox [ "x86_64-redox" ];
   testgnu = mseteq gnu (linux /* ++ kfreebsd ++ ... */);
   testillumos = mseteq illumos [ "x86_64-solaris" ];
-  testlinux = mseteq linux [ "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux" "armv7l-linux" "i686-linux" "loongarch64-linux" "m68k-linux" "microblaze-linux" "microblazeel-linux" "mips-linux" "mips64-linux" "mips64el-linux" "mipsel-linux" "powerpc64-linux" "powerpc64le-linux" "riscv32-linux" "riscv64-linux" "s390-linux" "s390x-linux" "x86_64-linux" ];
+  testlinux = mseteq linux [ "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux" "armv7l-linux" "i686-linux" "mips64el-linux" "mipsel-linux" "riscv32-linux" "riscv64-linux" "x86_64-linux" "powerpc64-linux" "powerpc64le-linux" "m68k-linux" "s390-linux" "s390x-linux" "microblaze-linux" "microblazeel-linux" "loongarch64-linux" ];
   testnetbsd = mseteq netbsd [ "aarch64-netbsd" "armv6l-netbsd" "armv7a-netbsd" "armv7l-netbsd" "i686-netbsd" "m68k-netbsd" "mipsel-netbsd" "powerpc-netbsd" "riscv32-netbsd" "riscv64-netbsd" "x86_64-netbsd" ];
   testopenbsd = mseteq openbsd [ "i686-openbsd" "x86_64-openbsd" ];
   testwindows = mseteq windows [ "i686-cygwin" "x86_64-cygwin" "i686-windows" "x86_64-windows" ];

maintainers/maintainer-list.nix

@@ -177,12 +177,6 @@
     githubId = 12578560;
     name = "Quinn Bohner";
   };
-  _8-bit-fox = {
-    email = "sebastian@markwaerter.de";
-    github = "8-bit-fox";
-    githubId = 43320117;
-    name = "Sebastian Marquardt";
-  };
   _9999years = {
     email = "rbt@fastmail.com";
     github = "9999years";
@@ -937,12 +931,6 @@
     githubId = 123550;
     name = "André Silva";
   };
-  andresnav = {
-    email = "nix@andresnav.com";
-    github = "andres-nav";
-    githubId = 118762770;
-    name = "Andres Navarro";
-  };
   andrestylianos = {
     email = "andre.stylianos@gmail.com";
     github = "andrestylianos";
@@ -1639,12 +1627,6 @@
       fingerprint = "2688 0377 C31D 9E81 9BDF  83A8 C8C6 BDDB 3847 F72B";
     }];
   };
-  azd325 = {
-    email = "tim.kleinschmidt@gmail.com";
-    github = "Azd325";
-    githubId = 426541;
-    name = "Tim Kleinschmidt";
-  };
   azuwis = {
     email = "azuwis@gmail.com";
     github = "azuwis";
@@ -5265,12 +5247,6 @@
     githubId = 2489598;
     name = "Felix Breidenstein";
   };
-  flemzord = {
-    email = "maxence@maireaux.fr";
-    github = "flemzord";
-    githubId = 1952914;
-    name = "Maxence Maireaux";
-  };
   flexagoon = {
     email = "flexagoon@pm.me";
     github = "flexagoon";
@@ -5422,12 +5398,6 @@
     githubId = 7551358;
     name = "Frede Emil";
   };
- Freed-Wu = {
-    email = "wuzhenyu@ustc.edu";
-    github = "Freed-Wu";
-    githubId = 32936898;
-    name = "Wu Zhenyu";
-  };
   freezeboy = {
     github = "freezeboy";
     githubId = 13279982;
@@ -5560,18 +5530,18 @@
     githubId = 606000;
     name = "Gabriel Adomnicai";
   };
+  Gabriel439 = {
+    email = "Gabriel439@gmail.com";
+    github = "Gabriella439";
+    githubId = 1313787;
+    name = "Gabriel Gonzalez";
+  };
   GabrielDougherty = {
     email = "contact@gabrieldougherty.com";
     github = "GabrielDougherty";
     githubId = 10541219;
     name = "Gabriel Dougherty";
   };
-  Gabriella439 = {
-    email = "GenuineGabriella@gmail.com";
-    github = "Gabriella439";
-    githubId = 1313787;
-    name = "Gabriella Gonzalez";
-  };
   gador = {
     email = "florian.brandes@posteo.de";
     github = "gador";
@@ -6394,12 +6364,6 @@
       fingerprint = "45A9 9917 578C D629 9F5F  B5B4 C22D 4DE4 D7B3 2D19";
     }];
   };
-  hitsmaxft = {
-    name = "Bhe Hongtyu";
-    email = "mfthits@gmail.com";
-    github = "hitsmaxft";
-    githubId = 352727;
-  };
   hjones2199 = {
     email = "hjones2199@gmail.com";
     github = "hjones2199";
@@ -6433,15 +6397,6 @@
     githubId = 6074754;
     name = "Hlodver Sigurdsson";
   };
-  hmajid2301 = {
-    name = "Haseeb Majid";
-    email = "hello@haseebmajid.dev";
-    github = "hmajid2301";
-    githubId = 998807;
-    keys = [{
-      fingerprint = "A236 785D 59F1 9076 1E9C E8EC 7828 3DB3 D233 E1F9";
-    }];
-  };
   hmenke = {
     name = "Henri Menke";
     email = "henri@henrimenke.de";
@@ -6925,12 +6880,6 @@
     githubId = 137306;
     name = "Michele Catalano";
   };
-  isaozler = {
-    email = "isaozler@gmail.com";
-    github = "isaozler";
-    githubId = 1378630;
-    name = "Isa Ozler";
-  };
   isgy = {
     name = "isgy";
     email = "isgy@teiyg.com";
@@ -7578,12 +7527,6 @@
     githubId = 8900;
     name = "Johan Magnus Jonsson";
   };
-  jmbaur = {
-    email = "jaredbaur@fastmail.com";
-    github = "jmbaur";
-    githubId = 45740526;
-    name = "Jared Baur";
-  };
   jmc-figueira = {
     email = "business+nixos@jmc-figueira.dev";
     github = "jmc-figueira";
@@ -10692,12 +10635,6 @@
     githubId = 708570;
     name = "Manuel Mendez";
   };
-  mmusnjak = {
-    email = "marko.musnjak@gmail.com";
-    github = "mmusnjak";
-    githubId = 668956;
-    name = "Marko Mušnjak";
-  };
   mnacamura = {
     email = "m.nacamura@gmail.com";
     github = "mnacamura";
@@ -11503,16 +11440,6 @@
     githubId = 26231126;
     name = "Nils ANDRÉ-CHANG";
   };
-  nim65s = {
-    email = "guilhem.saurel@laas.fr";
-    matrix = "@gsaurel:laas.fr";
-    github = "nim65s";
-    githubId = 131929;
-    name = "Guilhem Saurel";
-    keys = [{
-      fingerprint = "9B1A 7906 5D2F 2B80 6C8A  5A1C 7D2A CDAF 4653 CF28";
-    }];
-  };
   ninjatrappeur = {
     email = "felix@alternativebit.fr";
     matrix = "@ninjatrappeur:matrix.org";
@@ -11813,12 +11740,6 @@
     githubId = 30825096;
     name = "Ning Zhang";
   };
-  oaksoaj = {
-    email = "oaksoaj@riseup.net";
-    name = "Oaksoaj";
-    github = "oaksoaj";
-    githubId = 103952141;
-  };
   obadz = {
     email = "obadz-nixos@obadz.com";
     github = "obadz";
@@ -15244,12 +15165,6 @@
     githubId = 38893265;
     name = "StrikerLulu";
   };
-  stteague = {
-    email = "stteague505@yahoo.com";
-    github = "stteague";
-    githubId = 77596767;
-    name = "Scott Teague";
-  };
   stumoss = {
     email = "samoss@gmail.com";
     github = "stumoss";
@@ -16017,12 +15932,6 @@
     github = "TilCreator";
     githubId = 18621411;
   };
-  tillkruss = {
-    name = "Till Krüss";
-    email = "till@kruss.io";
-    github = "tillkruss";
-    githubId = 665029;
-  };
   tilpner = {
     name = "Till Höppner";
     email = "nixpkgs@tilpner.com";

maintainers/team-list.nix

@@ -213,7 +213,7 @@ with lib.maintainers; {
 
   dhall = {
     members = [
-      Gabriella439
+      Gabriel439
       ehmry
     ];
     scope = "Maintain Dhall and related packages.";
@@ -292,8 +292,6 @@ with lib.maintainers; {
     members = [
       imincik
       sikmir
-      nh2
-      willcohen
     ];
     scope = "Maintain geospatial packages.";
     shortName = "Geospatial";
@@ -558,15 +556,6 @@ with lib.maintainers; {
     shortName = "Minimal Bootstrap";
   };
 
-  mercury = {
-    members = [
-      _9999years
-      Gabriella439
-    ];
-    scope = "Group registry for packages maintained by Mercury";
-    shortName = "Mercury Employees";
-  };
-
   mobile = {
     members = [
       samueldr

nixos/doc/manual/installation/upgrading.chapter.md

@@ -6,7 +6,7 @@ expressions and associated binaries. The NixOS channels are updated
 automatically from NixOS's Git repository after certain tests have
 passed and all packages have been built. These channels are:
 
--   *Stable channels*, such as [`nixos-23.05`](https://channels.nixos.org/nixos-23.05).
+-   *Stable channels*, such as [`nixos-22.11`](https://nixos.org/channels/nixos-22.11).
     These only get conservative bug fixes and package upgrades. For
     instance, a channel update may cause the Linux kernel on your system
     to be upgraded from 4.19.34 to 4.19.38 (a minor bug fix), but not
@@ -14,13 +14,13 @@ passed and all packages have been built. These channels are:
     Stable channels are generally maintained until the next stable
     branch is created.
 
--   The *unstable channel*, [`nixos-unstable`](https://channels.nixos.org/nixos-unstable).
+-   The *unstable channel*, [`nixos-unstable`](https://nixos.org/channels/nixos-unstable).
     This corresponds to NixOS's main development branch, and may thus see
     radical changes between channel updates. It's not recommended for
     production systems.
 
--   *Small channels*, such as [`nixos-23.05-small`](https://channels.nixos.org/nixos-23.05-small)
+-   *Small channels*, such as [`nixos-22.11-small`](https://nixos.org/channels/nixos-22.11-small)
-    or [`nixos-unstable-small`](https://channels.nixos.org/nixos-unstable-small).
+    or [`nixos-unstable-small`](https://nixos.org/channels/nixos-unstable-small).
     These are identical to the stable and unstable channels described above,
     except that they contain fewer binary packages. This means they get updated
     faster than the regular channels (for instance, when a critical security patch
@@ -28,7 +28,7 @@ passed and all packages have been built. These channels are:
     built from source than usual. They're mostly intended for server environments
     and as such contain few GUI applications.
 
-To see what channels are available, go to <https://channels.nixos.org>.
+To see what channels are available, go to <https://nixos.org/channels>.
 (Note that the URIs of the various channels redirect to a directory that
 contains the channel's latest version and includes ISO images and
 VirtualBox appliances.) Please note that during the release process,
@@ -38,38 +38,38 @@ newest supported stable release.
 
 When you first install NixOS, you're automatically subscribed to the
 NixOS channel that corresponds to your installation source. For
-instance, if you installed from a 23.05 ISO, you will be subscribed to
+instance, if you installed from a 22.11 ISO, you will be subscribed to
-the `nixos-23.05` channel. To see which NixOS channel you're subscribed
+the `nixos-22.11` channel. To see which NixOS channel you're subscribed
 to, run the following as root:
 
 ```ShellSession
 # nix-channel --list | grep nixos
-nixos https://channels.nixos.org/nixos-unstable
+nixos https://nixos.org/channels/nixos-unstable
 ```
 
 To switch to a different NixOS channel, do
 
 ```ShellSession
-# nix-channel --add https://channels.nixos.org/channel-name nixos
+# nix-channel --add https://nixos.org/channels/channel-name nixos
 ```
 
 (Be sure to include the `nixos` parameter at the end.) For instance, to
-use the NixOS 23.05 stable channel:
+use the NixOS 22.11 stable channel:
 
 ```ShellSession
-# nix-channel --add https://channels.nixos.org/nixos-23.05 nixos
+# nix-channel --add https://nixos.org/channels/nixos-22.11 nixos
 ```
 
 If you have a server, you may want to use the "small" channel instead:
 
 ```ShellSession
-# nix-channel --add https://channels.nixos.org/nixos-23.05-small nixos
+# nix-channel --add https://nixos.org/channels/nixos-22.11-small nixos
 ```
 
 And if you want to live on the bleeding edge:
 
 ```ShellSession
-# nix-channel --add https://channels.nixos.org/nixos-unstable nixos
+# nix-channel --add https://nixos.org/channels/nixos-unstable nixos
 ```
 
 You can then upgrade NixOS to the latest version in your chosen channel
@@ -114,5 +114,5 @@ the new generation contains a different kernel, initrd or kernel
 modules. You can also specify a channel explicitly, e.g.
 
 ```nix
-system.autoUpgrade.channel = "https://channels.nixos.org/nixos-23.05";
+system.autoUpgrade.channel = https://nixos.org/channels/nixos-22.11;
 ```

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -1,81 +1,65 @@
-# Release 23.05 (“Stoat”, 2023.05/31) {#sec-release-23.05}
+# Release 23.05 (“Stoat”, 2023.05/??) {#sec-release-23.05}
 
-The NixOS release team is happy to announce a new version of NixOS. The release is called NixOS 23.05 ("Stoat").
+Support is planned until the end of December 2023, handing over to 23.11.
-
-NixOS is a Linux distribution, whose set of packages can also be used on other Linux systems and macOS.
-
-Support is planned until the end of December 2023, handing over to NixOS 23.11.
-
-To upgrade to the latest release, follow the [upgrade chapter](https://nixos.org/manual/nixos/stable/index.html#sec-upgrading).
 
 ## Highlights {#sec-release-23.05-highlights}
 
-In addition to numerous new and updated packages, this release has the following highlights:
+In addition to numerous new and upgraded packages, this release has the following highlights:
 
-- The default [Nix](https://github.com/NixOS/nix) version was updated from 2.11 to 2.13. In particular, this includes a [small language alteration](https://github.com/NixOS/nix/issues/8259) in the way floats are represented in `builtins.toJSON`. See the release notes for [2.12](https://nixos.org/manual/nix/stable/release-notes/rl-2.12.html) and [2.13](https://nixos.org/manual/nix/unstable/release-notes/rl-2.13.html) for more information.
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- The default [Linux Kernel](https://kernel.org/) was updated from version 5.15 to 6.1, see [Kernelnewbies](https://kernelnewbies.org/Linux_6.1) for what has changed. All Kernels currently shown on [kernel.org](https://kernel.org/) are available.
+- Core version changes:
 
-- [systemd](https://systemd.io) has been updated from v252 to v253, see [the release notes](https://github.com/systemd/systemd/blob/v253/NEWS#L3-L659) for more information on the changes.
+  - default linux: 5.15 -\> 6.1, all supported kernels available
-    - Updating with `nixos-rebuild boot` and rebooting is recommended, since in some rare cases the `nixos-rebuild switch` into the new generation on a live system might fail due to missing mount units.
 
-- [glibc](https://www.gnu.org/software/libc/) has been updated from version 2.35 to 2.37, see [the release notes](https://sourceware.org/glibc/wiki/Release/2.37) for what was changed.
+  - systemd has been updated to v253.1, see [the pull request](https://github.com/NixOS/nixpkgs/pull/216826) for more info.
+    It's recommended to use `nixos-rebuild boot` and `reboot`, rather than `nixos-rebuild switch` - since in some rare cases
+    the switch of a live system might fail.
 
-- [libxcrypt](https://github.com/besser82/libxcrypt), the library providing the `crypt(3)` password hashing function, is now built without support for algorithms not flagged [`strong`](https://github.com/besser82/libxcrypt/blob/v4.4.33/lib/hashes.conf#L48). This affects the availability of password hashing algorithms used for system login (`login(1)`, `passwd(1)`), but also Apache2 Basic-Auth, Samba, OpenLDAP, Dovecot, and [many other packages](https://sourcegraph.com/search?q=context:global+repo:%5Egithub%5C.com/NixOS/nixpkgs%24+libxcrypt&patternType=standard&sm=1&groupBy=path).
+  - glibc: 2.35 -\> 2.37
 
-- NixOS now defaults to using [nsncd](https://github.com/twosigma/nsncd), a non-caching reimplementation of nscd in Rust, as its NSS lookup dispatcher. This replaces the buggy and deprecated nscd implementation provided through glibc. When you find problems, you can switch back by disabling it:
+- Cinnamon has been updated to 5.6, see [the pull request](https://github.com/NixOS/nixpkgs/pull/201328#issue-1449910204) for what is changed.
-  ```nix
-  services.nscd.enableNsncd = false;
-  ```
 
-- The internal option `boot.bootspec.enable` is now enabled by default because [RFC 0125](https://github.com/NixOS/rfcs/pull/125) was merged. This means you will have a bootspec document called `boot.json` generated for each system and specialisation in the top-level. This is useful to enable advanced boot use cases in NixOS, such as Secure Boot.
+- GNOME has been upgraded to version 44. Please see the [release notes](https://release.gnome.org/44/) for details.
 
-- Two changes to `nixos-rebuild` are important to highlight as well.
+- KDE Plasma has been updated to v5.27, see [the release notes](https://kde.org/announcements/plasma/5/5.27.0/) for what is changed.
-    - Support for an extra `--specialisation` option was added that can be used to change specialisation for `switch` and `test` commands.
-    - The `--target-host` and `--build-host` options no longer treat the `localhost` value specially – to build on resp. deploy to a local machine, omit the relevant flag.
 
-- [Python](https://www.python.org) implements [PEP 668](https://peps.python.org/pep-0668/), providing better feedback to users that try to run `pip install` for system-wide or user home installations.
+- Python implements [PEP 668](https://peps.python.org/pep-0668/), providing better feedback to users that try to run `pip install` system-wide.
 
-- [Cinnamon](https://github.com/linuxmint/Cinnamon) has been updated to version 5.6, see [the pull request](https://github.com/NixOS/nixpkgs/pull/201328#issue-1449910204) for what was changed.
+- `nixos-rebuild` now supports an extra `--specialisation` option that can be used to change specialisation for `switch` and `test` commands.
 
-- [GNOME](https://www.gnome.org) has been updated to version 44, see the [the release notes](https://release.gnome.org/44/) for details.
+- `libxcrypt`, the library providing the `crypt(3)` password hashing function, is now built without support for algorithms not flagged [`strong`](https://github.com/besser82/libxcrypt/blob/v4.4.33/lib/hashes.conf#L48). This affects the availability of password hashing algorithms used for system login (`login(1)`, `passwd(1)`), but also Apache2 Basic-Auth, Samba, OpenLDAP, Dovecot, and [many other packages](https://github.com/search?q=repo%3ANixOS%2Fnixpkgs%20libxcrypt&type=code).
 
-- [KDE Plasma](https://kde.org/de/plasma-desktop/) has been updated to version 5.27, see [the release notes](https://kde.org/announcements/plasma/5/5.27.0/) for what was changed.
+- `boot.bootspec.enable` (internal option) is now enabled by default because [RFC-0125](https://github.com/NixOS/rfcs/pull/125) was merged. This means you will have a bootspec document called `boot.json` generated for each system and specialisation in the top-level. This is useful to enable advanced boot usecases in NixOS such as SecureBoot.
 
 ## New Services {#sec-release-23.05-new-services}
 
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
 - [Akkoma](https://akkoma.social), an ActivityPub microblogging server. Available as [services.akkoma](options.html#opt-services.akkoma.enable).
 
-- [alertmanager-irc-relay](https://github.com/google/alertmanager-irc-relay), a Prometheus Alertmanager IRC Relay. Available as [services.prometheus.alertmanagerIrcRelay](options.html#opt-services.prometheus.alertmanagerIrcRelay.enable).
+- [Pixelfed](https://pixelfed.org/), an Instagram-like ActivityPub server. Available as [services.pixelfed](options.html#opt-services.pixelfed.enable).
-
-- [alice-lg](github.com/alice-lg/alice-lg), a looking-glass for BGP sessions. Available as [services.alice-lg](#opt-services.alice-lg.enable).
-
-- [atuin](https://github.com/ellie/atuin), a sync server for shell history. Available as [services.atuin](#opt-services.atuin.enable).
-
-- [authelia](https://www.authelia.com/), an open-source authentication and authorization server. Available as [services.authelia](options.html#opt-services.authelia.enable).
-
-- [birdwatcher](github.com/alice-lg/birdwatcher), a small HTTP server meant to provide an API defined by Barry O'Donovan's birds-eye to the BIRD internet routing daemon. Available as [services.birdwatcher](#opt-services.birdwatcher.enable).
 
 - [blesh](https://github.com/akinomyoga/ble.sh), a line editor written in pure bash. Available as [programs.bash.blesh](#opt-programs.bash.blesh.enable).
 
-- [Budgie Desktop](https://github.com/BuddiesOfBudgie/budgie-desktop), a familiar, modern desktop environment. Available as [services.xserver.desktopManager.budgie](options.html#opt-services.xserver.desktopManager.budgie).
+- [webhook](https://github.com/adnanh/webhook), a lightweight webhook server. Available as [services.webhook](#opt-services.webhook.enable).
 
-- [clash-verge](https://github.com/zzzgydi/clash-verge), a Clash GUI based on tauri. Available as [programs.clash-verge](#opt-programs.clash-verge.enable).
+- [cups-pdf-to-pdf](https://github.com/alexivkin/CUPS-PDF-to-PDF), a pdf-generating cups backend based on [cups-pdf](https://www.cups-pdf.de/). Available as [services.printing.cups-pdf](#opt-services.printing.cups-pdf.enable).
+
+- [clash-verge](https://github.com/zzzgydi/clash-verge), A Clash GUI based on tauri. Available as [programs.clash-verge](#opt-programs.clash-verge.enable).
 
 - [Cloudlog](https://www.magicbug.co.uk/cloudlog/), a web-based Amateur Radio logging application. Available as [services.cloudlog](#opt-services.cloudlog.enable).
 
-- [consul-template](https://github.com/hashicorp/consul-template/), a template renderer, notifier, and supervisor for HashiCorp Consul and Vault data. Available as [services.consul-template](#opt-services.consul-template.instances).
-
-- [cups-pdf-to-pdf](https://github.com/alexivkin/CUPS-PDF-to-PDF), a PDF-generating CUPS backend based on [cups-pdf](https://www.cups-pdf.de/). Available as [services.printing.cups-pdf](#opt-services.printing.cups-pdf.enable).
-
 - [Deepin Desktop Environment](https://github.com/linuxdeepin/dde), an elegant, easy to use and reliable desktop environment. Available as [services.xserver.desktopManager.deepin](options.html#opt-services.xserver.desktopManager.deepin).
 
-- [esphome](https://esphome.io), a dashboard to configure ESP8266/ESP32 devices for use with Home Automation systems. Available as [services.esphome](#opt-services.esphome.enable).
+- [system-repart](https://www.freedesktop.org/software/systemd/man/systemd-repart.service.html), grow and add partitions to a partition table. Available as [systemd.repart](options.html#opt-systemd.repart) and [boot.initrd.systemd.repart](options.html#opt-boot.initrd.systemd.repart)
 
 - [frigate](https://frigate.video), an open source NVR built around real-time AI object detection. Available as [services.frigate](#opt-services.frigate.enable).
 
 - [fzf](https://github.com/junegunn/fzf), a command line fuzzyfinder. Available as [programs.fzf](#opt-programs.fzf.fuzzyCompletion).
 
+- [readarr](https://github.com/Readarr/Readarr), Book Manager and Automation (Sonarr for Ebooks). Available as [services.readarr](options.html#opt-services.readarr.enable).
+
 - [gemstash](https://github.com/rubygems/gemstash), a RubyGems.org cache and private gem server. Available as [services.gemstash](#opt-services.gemstash.enable).
 
 - [gitea-actions-runner](https://gitea.com/gitea/act_runner), a CI runner for Gitea/Forgejo Actions. Available as [services.gitea-actions-runner](#opt-services.gitea-actions-runner.instances).
@@ -84,121 +68,131 @@ In addition to numerous new and updated packages, this release has the following
 
 - [go2rtc](https://github.com/AlexxIT/go2rtc), a camera streaming appliation with support for RTSP, WebRTC, HomeKit, FFMPEG, RTMP and other protocols. Available as [services.go2rtc](options.html#opt-services.go2rtc.enable).
 
-- [goeland](https://github.com/slurdge/goeland), an alternative to rss2email written in Golang with many filters. Available as [services.goeland](#opt-services.goeland.enable).
+- [harmonia](https://github.com/nix-community/harmonia/), Nix binary cache implemented in rust using libnix-store. Available as [services.harmonia](options.html#opt-services.harmonia.enable).
-
-- [gonic](https://github.com/sentriz/gonic), a Subsonic music streaming server. Available as [services.gonic](#opt-services.gonic.enable).
-
-- [hardware.ipu6](#opt-hardware.ipu6.enable), drivers for IPU6 based webcams on Intel Tiger Lake and Alder Lake.
-
-- [harmonia](https://github.com/nix-community/harmonia/), a Nix binary cache implemented in Rust using [libnixstore](https://docs.rs/libnixstore/latest/libnixstore/). Available as [services.harmonia](options.html#opt-services.harmonia.enable).
 
 - [hyprland](https://github.com/hyprwm/hyprland), a dynamic tiling Wayland compositor that doesn't sacrifice on its looks. Available as [programs.hyprland](#opt-programs.hyprland.enable).
 
-- [imaginary](https://github.com/h2non/imaginary), a microservice for high-level image processing that Nextcloud can use to generate previews. Available as [services.imaginary](#opt-services.imaginary.enable).
-
-- [ivpn](https://www.ivpn.net/), a secure, private VPN with fast WireGuard connections. Available as [services.ivpn](#opt-services.ivpn.enable).
-
-- [vmalert](https://victoriametrics.com/), an alerting engine for VictoriaMetrics. Available as [services.vmalert](#opt-services.vmalert.enable).
-
-- [jellyseerr](https://github.com/Fallenbagel/jellyseerr), a web-based requests manager for Jellyfin, forked from Overseerr. Available as [services.jellyseerr](#opt-services.jellyseerr.enable).
-
-- [kavita](https://kavitareader.com), a self-hosted digital library. Available as [services.kavita](options.html#opt-services.kavita.enable).
-
-- [keyd](https://github.com/rvaiya/keyd), a key remapping daemon for Linux. Available as [services.keyd](#opt-services.keyd.enable).
-
-- [lldap](https://github.com/lldap/lldap), a lightweight authentication server that provides an opinionated, simplified LDAP interface for authentication. Available as [services.lldap](#opt-services.lldap.enable).
-
 - [minipro](https://gitlab.com/DavidGriffith/minipro/), an open source program for controlling the MiniPRO TL866xx series of chip programmers. Available as [programs.minipro](options.html#opt-programs.minipro.enable).
 
-- [mmsd](https://gitlab.com/kop316/mmsd), a lower level daemon that transmits and receives MMSes. Available as [services.mmsd](#opt-services.mmsd.enable).
+- [stevenblack-blocklist](https://github.com/StevenBlack/hosts), A unified hosts file with base extensions for blocking unwanted websites. Available as [networking.stevenblack](options.html#opt-networking.stevenblack.enable).
 
-- [monica](https://www.monicahq.com), an open source personal CRM. Available as [services.monica](options.html#opt-services.monica.enable).
+- [Budgie Desktop](https://github.com/BuddiesOfBudgie/budgie-desktop), a familiar, modern desktop environment. Available as [services.xserver.desktopManager.budgie](options.html#opt-services.xserver.desktopManager.budgie).
 
-- [networkd-dispatcher](https://gitlab.com/craftyguy/networkd-dispatcher), a dispatcher service for systemd-networkd connection status changes. Available as [services.networkd-dispatcher](#opt-services.networkd-dispatcher.enable).
+- [imaginary](https://github.com/h2non/imaginary), a microservice for high-level image processing that Nextcloud can use to generate previews. Available as [services.imaginary](#opt-services.imaginary.enable).
-
-- [nimdow](https://github.com/avahe-kellenberger/nimdow), a window manager written in Nim, inspired by dwm. Available as [services.xserver.windowManager.nimdow.enable](options.html#opt-services.xserver.windowManager.nimdow.enable).
 
 - [opensearch](https://opensearch.org), a search server alternative to Elasticsearch. Available as [services.opensearch](options.html#opt-services.opensearch.enable).
 
-- [openvscode-server](https://github.com/gitpod-io/openvscode-server), run VS Code on a remote machine with access through a modern web browser from any device, anywhere. Available as [services.openvscode-server](#opt-services.openvscode-server.enable).
+- [kavita](https://kavitareader.com), a self-hosted digital library. Available as [services.kavita](options.html#opt-services.kavita.enable).
 
-- [peroxide](https://github.com/ljanyst/peroxide), a fork of the official [ProtonMail bridge](https://github.com/ProtonMail/proton-bridge) that aims to be similar to [Hydroxide](https://github.com/emersion/hydroxide). Available as [services.peroxide](#opt-services.peroxide.enable).
+- [monica](https://www.monicahq.com), an open source personal CRM. Available as [services.monica](options.html#opt-services.monica.enable).
 
-- [photoprism](https://photoprism.app/), a AI-powered photos app for the decentralized web. Available as [services.photoprism](options.html#opt-services.photoprism.enable).
+- [authelia](https://www.authelia.com/), is an open-source authentication and authorization server. Available under [services.authelia](options.html#opt-services.authelia.enable).
 
-- [Pixelfed](https://pixelfed.org/), an Instagram-like ActivityPub server. Available as [services.pixelfed](options.html#opt-services.pixelfed.enable).
+- [goeland](https://github.com/slurdge/goeland), an alternative to rss2email written in golang with many filters. Available as [services.goeland](#opt-services.goeland.enable).
 
-- [PufferPanel](https://pufferpanel.com), a game server management panel designed to be easy to use. Available as [services.pufferpanel](#opt-services.pufferpanel.enable).
+- [alertmanager-irc-relay](https://github.com/google/alertmanager-irc-relay), a Prometheus Alertmanager IRC Relay. Available as [services.prometheus.alertmanagerIrcRelay](options.html#opt-services.prometheus.alertmanagerIrcRelay.enable).
-
-- [QDMR](https://dm3mat.darc.de/qdmr/), a GUI application and command line tool for programming DMR radios [programs.qdmr](#opt-programs.qdmr.enable).
-
-- [readarr](https://github.com/Readarr/Readarr), book manager and automation (Sonarr for ebooks). Available as [services.readarr](options.html#opt-services.readarr.enable).
-
-- [ReGreet](https://github.com/rharish101/ReGreet), a clean and customizable greeter for greetd. Available as [programs.regreet](#opt-programs.regreet.enable).
-
-- [rshim](https://github.com/Mellanox/rshim-user-space), the user-space rshim driver for the BlueField SoC. Available as [services.rshim](options.html#opt-services.rshim.enable).
-
-- [SFTPGo](https://github.com/drakkan/sftpgo), a fully featured and highly configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. Available as [services.sftpgo](options.html#opt-services.sftpgo.enable).
-
-- [sharing](https://github.com/parvardegr/sharing), a command-line tool to share directories and files from the CLI to iOS and Android devices without the need of an extra client app. Available as [programs.sharing](#opt-programs.sharing.enable).
-
-- [sniffnet](https://github.com/GyulyVGC/sniffnet), an application to monitor your network traffic. Available as [programs.sniffnet](#opt-programs.sniffnet.enable).
-
-- [stargazer](https://sr.ht/~zethra/stargazer/), a fast and easy to use Gemini server. Available as [services.stargazer](#opt-services.stargazer.enable).
-
-- [stevenblack-blocklist](https://github.com/StevenBlack/hosts), a unified hosts file with base extensions for blocking unwanted websites. Available as [networking.stevenblack](options.html#opt-networking.stevenblack.enable).
-
-- [systemd-repart](https://www.freedesktop.org/software/systemd/man/systemd-repart.service.html), grow and add partitions to a partition table. Available as [systemd.repart](options.html#opt-systemd.repart) and [boot.initrd.systemd.repart](options.html#opt-boot.initrd.systemd.repart)
-
-- [trippy](https://github.com/fujiapple852/trippy), a network diagnostic tool. Available as [programs.trippy](#opt-programs.trippy.enable).
 
 - [tts](https://github.com/coqui-ai/TTS), a battle-tested deep learning toolkit for Text-to-Speech. Multiple servers may be configured below [services.tts.servers](#opt-services.tts.servers).
 
-- [ulogd](https://www.netfilter.org/projects/ulogd/index.html), a userspace logging daemon for netfilter/iptables related logging. Available as [services.ulogd](options.html#opt-services.ulogd.enable).
+- [atuin](https://github.com/ellie/atuin), a sync server for shell history. Available as [services.atuin](#opt-services.atuin.enable).
+
+- [SFTPGo](https://github.com/drakkan/sftpgo), a fully featured and highly configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. Available as [services.sftpgo](options.html#opt-services.sftpgo.enable).
+
+- [esphome](https://esphome.io), a dashboard to configure ESP8266/ESP32 devices for use with Home Automation systems. Available as [services.esphome](#opt-services.esphome.enable).
+
+- [networkd-dispatcher](https://gitlab.com/craftyguy/networkd-dispatcher), a dispatcher service for systemd-networkd connection status changes. Available as [services.networkd-dispatcher](#opt-services.networkd-dispatcher.enable).
+
+- [gonic](https://github.com/sentriz/gonic), a Subsonic music streaming server. Available as [services.gonic](#opt-services.gonic.enable).
+
+- [mmsd](https://gitlab.com/kop316/mmsd), a lower level daemon that transmits and receives MMSes. Available as [services.mmsd](#opt-services.mmsd.enable).
+
+- [QDMR](https://dm3mat.darc.de/qdmr/), a GUI application and command line tool for programming DMR radios [programs.qdmr](#opt-programs.qdmr.enable)
+
+- [keyd](https://github.com/rvaiya/keyd), a key remapping daemon for linux. Available as [services.keyd](#opt-services.keyd.enable).
+
+- [consul-template](https://github.com/hashicorp/consul-template/), a template rendering, notifier, and supervisor for HashiCorp Consul and Vault data. Available as [services.consul-template](#opt-services.consul-template.instances).
+
+- [vault-agent](https://developer.hashicorp.com/vault/docs/agent), a template rendering and API auth proxy for HashiCorp Vault, similar to `consul-template`. Available as [services.vault-agent](#opt-services.vault-agent.instances).
+
+- [trippy](https://github.com/fujiapple852/trippy), a network diagnostic tool. Available as [programs.trippy](#opt-programs.trippy.enable).
 
 - [v2rayA](https://v2raya.org), a Linux web GUI client of Project V which supports V2Ray, Xray, SS, SSR, Trojan and Pingtunnel. Available as [services.v2raya](options.html#opt-services.v2raya.enable).
 
-- [v4l2-relayd](https://git.launchpad.net/v4l2-relayd), a streaming relay for v4l2loopback using gstreamer. Available as [services.v4l2-relayd](#opt-services.v4l2-relayd.instances._name_.enable).
+- [rshim](https://github.com/Mellanox/rshim-user-space), the user-space rshim driver for the BlueField SoC. Available as [services.rshim](options.html#opt-services.rshim.enable).
 
-- [vault-agent](https://developer.hashicorp.com/vault/docs/agent), a template renderer and API auth proxy for HashiCorp Vault, similar to `consul-template`. Available as [services.vault-agent](#opt-services.vault-agent.instances).
+- [wstunnel](https://github.com/erebe/wstunnel), a proxy tunnelling arbitrary TCP or UDP traffic through a WebSocket connection. Instances may be configured via [services.wstunnel](options.html#opt-services.wstunnel.enable).
 
-- [webhook](https://github.com/adnanh/webhook), a lightweight webhook server. Available as [services.webhook](#opt-services.webhook.enable).
+- [ulogd](https://www.netfilter.org/projects/ulogd/index.html), a userspace logging daemon for netfilter/iptables related logging. Available as [services.ulogd](options.html#opt-services.ulogd.enable).
+
+- [PufferPanel](https://pufferpanel.com), game server management panel designed to be easy to use. Available as [services.pufferpanel](#opt-services.pufferpanel.enable).
+
+- [jellyseerr](https://github.com/Fallenbagel/jellyseerr), a web-based requests manager for Jellyfin, forked from Overseerr. Available as [services.jellyseerr](#opt-services.jellyseerr.enable).
+
+- [stargazer](https://sr.ht/~zethra/stargazer/), a fast and easy to use Gemini server. Available as [services.stargazer](#opt-services.stargazer.enable).
+
+- [sniffnet](https://github.com/GyulyVGC/sniffnet), an application to monitor your network traffic. Available as [programs.sniffnet](#opt-programs.sniffnet.enable).
+
+- [photoprism](https://photoprism.app/), a AI-Powered Photos App for the Decentralized Web. Available as [services.photoprism](options.html#opt-services.photoprism.enable).
+
+- [alice-lg](github.com/alice-lg/alice-lg), a looking-glass for BGP sessions. Available as [services.alice-lg](#opt-services.alice-lg.enable).
+
+- [birdwatcher](github.com/alice-lg/birdwatcher), a small HTTP server meant to provide an API defined by Barry O'Donovan's birds-eye to the BIRD internet routing daemon. Available as [services.birdwatcher](#opt-services.birdwatcher.enable).
+
+- [peroxide](https://github.com/ljanyst/peroxide), a fork of the official [ProtonMail bridge](https://github.com/ProtonMail/proton-bridge) that aims to be similar to [Hydroxide](https://github.com/emersion/hydroxide). Available as [services.peroxide](#opt-services.peroxide.enable).
+
+- [autosuspend](https://github.com/languitar/autosuspend), a python daemon that suspends a system if certain conditions are met, or not met.
+
+- [sharing](https://github.com/parvardegr/sharing), a command-line tool to share directories and files from the CLI to iOS and Android devices without the need of an extra client app. Available as [programs.sharing](#opt-programs.sharing.enable).
+
+- [nimdow](https://github.com/avahe-kellenberger/nimdow), a window manager written in Nim, inspired by dwm.
+
+- [trurl](https://github.com/curl/trurl), a command line tool for URL parsing and manipulation.
 
 - [wgautomesh](https://git.deuxfleurs.fr/Deuxfleurs/wgautomesh), a simple utility to help connect wireguard nodes together in a full mesh topology. Available as [services.wgautomesh](options.html#opt-services.wgautomesh.enable).
 
-- [woodpecker](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-server](#opt-services.woodpecker-server.enable) and [services.woodpecker-agents](#opt-services.woodpecker-agents.agents._name_.enable).
+- [woodpecker-agents](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-agents](#opt-services.woodpecker-agents.agents._name_.enable).
 
-- [wstunnel](https://github.com/erebe/wstunnel), a proxy tunnelling arbitrary TCP or UDP traffic through a WebSocket connection. Available as [services.wstunnel](options.html#opt-services.wstunnel.enable).
+- [woodpecker-server](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-server](#opt-services.woodpecker-server.enable).
+
+- [lldap](https://github.com/lldap/lldap), a lightweight authentication server that provides an opinionated, simplified LDAP interface for authentication. Available as [services.lldap](#opt-services.lldap.enable).
+
+- [ReGreet](https://github.com/rharish101/ReGreet), a clean and customizable greeter for greetd. Available as [programs.regreet](#opt-programs.regreet.enable).
+
+- [v4l2-relayd](https://git.launchpad.net/v4l2-relayd), a streaming relay for v4l2loopback using gstreamer. Available as [services.v4l2-relayd](#opt-services.v4l2-relayd.instances._name_.enable).
+
+- [hardware.ipu6](#opt-hardware.ipu6.enable) adds support for ipu6 based webcams on intel tiger lake and alder lake.
+
+- [ivpn](https://www.ivpn.net/), a secure, private VPN with fast WireGuard connections. Available as [services.ivpn](#opt-services.ivpn.enable).
+
+- [openvscode-server](https://github.com/gitpod-io/openvscode-server), run VS Code on a remote machine with access through a modern web browser from any device, anywhere. Available as [services.openvscode-server](#opt-services.openvscode-server.enable).
 
 ## Backward Incompatibilities {#sec-release-23.05-incompatibilities}
 
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- `carnix` and `cratesIO` has been removed due to being unmaintained, use alternatives such as [naersk](https://github.com/nix-community/naersk) and [crate2nix](https://github.com/kolloch/crate2nix) instead.
+
 - `services.asusd` configuration now uses strings instead of structured configuration, as upstream switched to the [RON](https://github.com/ron-rs/ron) configuration format. Support for structured configuration may return when [RON](https://github.com/ron-rs/ron) generation is implemented in nixpkgs.
 
+- `checkInputs` have been renamed to `nativeCheckInputs`, because they behave the same as `nativeBuildInputs` when `doCheck` is set. `checkInputs` now denote a new type of dependencies, added to `buildInputs` when `doCheck` is set. As a rule of thumb, `nativeCheckInputs` are tools on `$PATH` used during the tests, and `checkInputs` are libraries which are linked to executables built as part of the tests. Similarly, `installCheckInputs` are renamed to `nativeInstallCheckInputs`, corresponding to `nativeBuildInputs`, and `installCheckInputs` are a new type of dependencies added to `buildInputs` when `doInstallCheck` is set. (Note that this change will not cause breakage to derivations with `strictDeps` unset, which are most packages except python, rust, ocaml and go packages).
+
+- `buildDunePackage` now defaults to `strictDeps = true` which means that any library should go into `buildInputs` or `checkInputs`. Any executable that is run on the building machine should go into `nativeBuildInputs` or `nativeCheckInputs` respectively. Example of executables are `ocaml`, `findlib` and `menhir`. PPXs are libraries which are built by dune and should therefore not go into `nativeBuildInputs`.
+
 - `borgbackup` module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep), available as [`services.borgbackup.jobs.<name>.inhibitsSleep`](#opt-services.borgbackup.jobs._name_.inhibitsSleep).
 
-- The `openssh` client now comes with the `~C` escape sequence disabled by default. It can be re-enabled by setting `EnableEscapeCommandline yes`
+- The `ssh` client tool now disables the `~C` escape sequence by default. This can be re-enabled by setting `EnableEscapeCommandline yes`
 
-- The `programs.ssh` client module does not read `/etc/ssh/ssh_known_hosts2` anymore, since this location is [deprecated since 2001](https://marc.info/?l=openssh-unix-dev&m=100508718416162&w=2).
+- Many `services.syncthing` options have been moved to `services.syncthing.settings`, as part of [RFC 42](https://github.com/NixOS/rfcs/pull/42)'s implementation, see [#226088](https://github.com/NixOS/nixpkgs/pull/226088).
 
-- The `services.openssh` server module does not read `~/.ssh/authorized_keys2` anymore, since this location is [deprecated since 2001](https://marc.info/?l=openssh-unix-dev&m=100508718416162&w=2).
+- The `ssh` module does not read `/etc/ssh/ssh_known_hosts2` anymore since this location is [deprecated since 2001](https://marc.info/?l=openssh-unix-dev&m=100508718416162&w=2).
 
-- MAC-then-encrypt algorithms were removed from the default selection of `services.openssh.settings.Macs`. If you still require these [MACs](https://en.wikipedia.org/wiki/Message_authentication_code), for example when you are relying on libssh2 (e.g. VLC) or the SSH library shipped on the iPhone, you can re-add them like this:
+- The openssh module does not read `~/.ssh/authorized_keys2` anymore since this location is [deprecated since 2001](https://marc.info/?l=openssh-unix-dev&m=100508718416162&w=2).
-
-  ```nix
-  services.openssh.settings.Macs = [
-    "hmac-sha2-512"
-    "hmac-sha2-256"
-    "umac-128@openssh.com"
-  };
-  ```
 
 - `podman` now uses the `netavark` network stack. Users will need to delete all of their local containers, images, volumes, etc, by running `podman system reset --force` once before upgrading their systems.
 
 - `git-bug` has been updated to at least version 0.8.0, which includes backwards incompatible changes. The `git-bug-migration` package can be used to upgrade existing repositories.
 
-- `graylog` has been updated to version 5, which can not be updated directly from the previously packaged version 3.3. If you had installed the previously packaged version 3.3, please follow the [upgrade path](https://go2docs.graylog.org/5-0/upgrading_graylog/upgrade_path.htm) from 3.3 to 4.0 to 4.3 to 5.0.
+- `graylog` has been updated to version 5, which can not be upgraded directly from the previously packaged version 3.3. If you had installed the previously packaged version 3.3, please follow the [upgrade path](https://go2docs.graylog.org/5-0/upgrading_graylog/upgrade_path.htm) from 3.3 to 4.0 to 4.3 to 5.0.
-
-- `buildFHSUserEnv` is now called `buildFHSEnv` and uses FlatPak's Bubblewrap sandboxing tool rather than Nixpkgs' own chrootenv. The old chrootenv-based implemenation is still available via `buildFHSEnvChrootenv` but is considered deprecated and will be removed when the remaining uses inside Nixpkgs have been migrated. If your FHSEnv-wrapped application misbehaves when using the new bubblewrap implementation, please create an issue in Nixpkgs.
 
 - `nushell` has been updated to at least version 0.77.0, which includes potential breaking changes in aliases. The old aliases are now available as `old-alias` but it is recommended you migrate to the new format. See [Reworked aliases](https://www.nushell.sh/blog/2023-03-14-nushell_0_77.html#reworked-aliases-breaking-changes-kubouch).
 
@@ -206,16 +200,16 @@ In addition to numerous new and updated packages, this release has the following
 
 - `keepassx` and `keepassx2` have been removed, due to upstream [stopping development](https://www.keepassx.org/index.html%3Fp=636.html). Consider [KeePassXC](https://keepassxc.org) as a maintained alternative.
 
-- The [services.kubo.settings](#opt-services.kubo.settings) option is now no longer stateful. If you changed any of the options in [services.kubo.settings](#opt-services.kubo.settings) in the past and then removed them from your NixOS configuration again, those changes are still in your Kubo configuration file but will now be reset to the default. If you're unsure, you may want to make a backup of your configuration file (probably `/var/lib/ipfs/config`) and compare after the update.
+- The [services.kubo.settings](#opt-services.kubo.settings) option is now no longer stateful. If you changed any of the options in [services.kubo.settings](#opt-services.kubo.settings) in the past and then removed them from your NixOS configuration again, those changes are still in your Kubo configuration file but will now be reset to the default. If you're unsure, you may want to make a backup of your configuration file (probably /var/lib/ipfs/config) and compare after the update.
 
 - The Kubo HTTP API will no longer listen on localhost and will instead only listen on a Unix domain socket by default. Read the [services.kubo.settings.Addresses.API](#opt-services.kubo.settings.Addresses.API) option description for more information.
 
 - The EC2 image module no longer fetches instance metadata in stage-1. This results in a significantly smaller initramfs, since network drivers no longer need to be included, and faster boots, since metadata fetching can happen in parallel with startup of other services.
   This breaks services which rely on metadata being present by the time stage-2 is entered. Anything which reads EC2 metadata from `/etc/ec2-metadata` should now have an `after` dependency on `fetch-ec2-metadata.service`
 
-- The mailman service now defaults to using a randomly generated REST API password instead of a hard-coded one.
+- The mailman service now defaults to using a randomly generated REST API password instead of a hardcoded one.
 
-- `minio` removed support for its legacy filesystem backend in [RELEASE.2022-10-29T06-21-33Z](https://github.com/minio/minio/releases/tag/RELEASE.2022-10-29T06-21-33Z). This means if your storage was created with the old format, minio will no longer start. Unfortunately, minio doesn't provide an automatic migration, they only provide [instructions how to manually convert the node](https://min.io/docs/minio/windows/operations/install-deploy-manage/migrate-fs-gateway.html). To facilitate this migration, we keep around the last version that still supports the old filesystem backend as `minio_legacy_fs`. Use it via `services.minio.package = minio_legacy_fs;` to export your data before switching to the new version. See the corresponding [issue](https://github.com/NixOS/nixpkgs/issues/199318) for more details.
+- `minio` removed support for its legacy filesystem backend in [RELEASE.2022-10-29T06-21-33Z](https://github.com/minio/minio/releases/tag/RELEASE.2022-10-29T06-21-33Z). This means if your storage was created with the old format, minio will no longer start. Unfortunately minio doesn't provide a an automatic migration, they only provide [instructions how to manually convert the node](https://min.io/docs/minio/windows/operations/install-deploy-manage/migrate-fs-gateway.html). To facilitate this migration we keep around the last version that still supports the old filesystem backend as `minio_legacy_fs`. Use it via `services.minio.package = minio_legacy_fs;` to export your data before switching to the new version. See the corresponding [issue](https://github.com/NixOS/nixpkgs/issues/199318) for more details.
 
 - `services.sourcehut.dispatch` and the corresponding package (`sourcehut.dispatchsrht`) have been removed due to [upstream deprecation](https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/).
 
@@ -239,20 +233,15 @@ In addition to numerous new and updated packages, this release has the following
   };
   ```
 
-- The default module options for [services.snapserver.openFirewall](#opt-services.snapserver.openFirewall), [services.tmate-ssh-server.openFirewall](#opt-services.tmate-ssh-server.openFirewall) and [services.unifi-video.openFirewall](#opt-services.unifi-video.openFirewall) have been changed from `true` to `false`. You will need to explicitly set this option to `true`, or configure your firewall.
+- The [services.snapserver.openFirewall](#opt-services.snapserver.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitly set this option to `true`, or configure your firewall.
 
-- The option `i18n.inputMethod.fcitx5.enableRimeData` has been removed. Default RIME data is now included in `fcitx5-rime` by default, and can be customized using
+- The [services.tmate-ssh-server.openFirewall](#opt-services.tmate-ssh-server.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitly set this option to `true`, or configure your firewall.
 
-  ```nix
+- The [services.unifi-video.openFirewall](#opt-services.unifi-video.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitly set this option to `true`, or configure your firewall.
-  fcitx5-rime.override {
-    rimeDataPkgs = [
-      pkgs.rime-data
-      # ...
-    ];
-  }
-  ```
 
-- The `udev` hwdb.bin file is now built with systemd-hwdb rather than the [deprecated "udevadm hwdb"](https://github.com/systemd/systemd/pull/25714). This may impact mappings where the same key is defined in multiple matching entries. The updated behavior will select the latest definition in case of conflict. In general, this should be a positive change, as the hwdb source files are designed with this ordering in mind. As an example, the mapping of the HP Dev One keyboard scan code for "mute mic" is corrected by this update. This change may impact users who have worked-around previously incorrect mappings.
+- The option `i18n.inputMethod.fcitx5.enableRimeData` has been removed. Default RIME data is now included in `fcitx5-rime` by default, and can be customized using `fcitx5-rime.override { rimeDataPkgs = [ pkgs.rime-data, package2, ... ]; }`
+
+- The udev hwdb.bin file is now built with systemd-hwdb rather than the [deprecated "udevadm hwdb"](https://github.com/systemd/systemd/pull/25714). This may impact mappings where the same key is defined in multiple matching entries. The updated behavior will select the latest definition in case of conflict. In general, this should be a positive change, as the hwdb source files are designed with this ordering in mind. As an example, the mapping of the HP Dev One keyboard scan code for "mute mic" is corrected by this update. This change may impact users who have worked-around previously incorrect mappings.
 
 - Kime has been updated from 2.5.6 to 3.0.2 and the `i18n.inputMethod.kime.config` option has been removed. Users should use `daemonModules`, `iconColor`, and `extraConfig` options under `i18n.inputMethod.kime` instead.
 
@@ -260,26 +249,28 @@ In addition to numerous new and updated packages, this release has the following
 
 - `i3status-rust` has been updated from 0.22.0 to 0.30.5, and this brings many changes to its configuration format. Additional information can be found [here](https://github.com/greshake/i3status-rust/blob/v0.30.0/NEWS.md).
 
-- The `wordpress` derivation no longer contains any built-in plugins or themes. If you need them, you have to add them back to prevent your site from breaking. You can find them in `wordpressPackages.{plugins,themes}`.
+- The `wordpress` derivation no longer contains any builtin plugins or themes. If you need them you have to add them back to prevent your site from breaking. You can find them in `wordpressPackages.{plugins,themes}`.
 
 - `llvmPackages_rocm.llvm` will not contain `clang` or `compiler-rt`. `llvmPackages_rocm.clang` will not contain `llvm`. `llvmPackages_rocm.clangNoCompilerRt` has been removed in favor of using `llvmPackages_rocm.clang-unwrapped`.
 
-- `services.xserver.desktopManager.plasma5.excludePackages` has been moved to `environment.plasma5.excludePackages`, for consistency with other Desktop Environments.
+- `services.xserver.desktopManager.plasma5.excludePackages` has been moved to `environment.plasma5.excludePackages`, for consistency with other Desktop Environments
-
-- `teleport` has been updated from major version 10 to major version 12. Please see upstream [upgrade instructions](https://goteleport.com/docs/setup/operations/upgrading/) and release notes for versions [11](https://goteleport.com/docs/changelog/#1100) and [12](https://goteleport.com/docs/changelog/#1201). Note that Teleport does not officially support upgrades across more than one major version at a time. If you're running Teleport server components, it is recommended to first upgrade to an intermediate 11.x version by setting `services.teleport.package = pkgs.teleport_11`. Afterwards, this option can be removed to upgrade to the default version (12).
 
 - The EC2 image module previously detected and automatically mounted ext3-formatted instance store devices and partitions in stage-1 (initramfs), storing `/tmp` on the first discovered device. This behaviour, which only catered to very specific use cases and could not be disabled, has been removed. Users relying on this should provide their own implementation, and probably use ext4 and perform the mount in stage-2.
 
+- `teleport` has been upgraded from major version 10 to major version 12. Please see upstream [upgrade instructions](https://goteleport.com/docs/setup/operations/upgrading/) and release notes for versions [11](https://goteleport.com/docs/changelog/#1100) and [12](https://goteleport.com/docs/changelog/#1201). Note that Teleport does not officially support upgrades across more than one major version at a time. If you're running Teleport server components, it is recommended to first upgrade to an intermediate 11.x version by setting `services.teleport.package = pkgs.teleport_11`. Afterwards, this option can be removed to upgrade to the default version (12).
+
 - The EC2 image module previously detected and activated swap-formatted instance store devices and partitions in stage-1 (initramfs). This behaviour has been removed. Users relying on this should provide their own implementation.
 
-- `gitlab` has been upgraded from major version 15 to major version 16 and requires at least PostgreSQL 13.6. Check the [upgrade guide](#module-services-postgres-upgrading) in the NixOS manual on how to upgrade your PostgreSQL installation.
-
-- `gitlab` 16 deprecates the use of external container registries, in our case `pkgs.docker-distribution`. Module users who have [`services.gitlab.registry.enable`](#opt-services.gitlab.registry.enable) set to `true` are advised to back up their state and switch to gitlab's fork by setting [`services.gitlab.registry.package`](#opt-services.gitlab.registry.package) to `pkgs.gitlab-container-registry`.
-
 - `fail2ban` has been updated to 1.0.2, which has a few breaking changes compared to 0.11.2 ([changelog for 1.0.1](https://github.com/fail2ban/fail2ban/blob/1.0.1/ChangeLog), [changelog for 1.0.2](https://github.com/fail2ban/fail2ban/blob/1.0.2/ChangeLog))
 
 - `albert` has been updated from 0.17.6 to 0.20.13, and 0.18.0 changed the config format and many plugins ([changelog for 0.18.0](https://github.com/albertlauncher/albert/blob/v0.18.0/CHANGELOG.md))
 
+- Calling `makeSetupHook` without passing a `name` argument is deprecated.
+
+- Top-level buildPlatform,hostPlatform,targetPlatform have been deprecated, use stdenv.X instead.
+
+- `lib.systems.examples.ghcjs` and consequently `pkgsCross.ghcjs` now use the target triplet `javascript-unknown-ghcjs` instead of `js-unknown-ghcjs`. This has been done to match an [upstream decision](https://gitlab.haskell.org/ghc/ghc/-/commit/6636b670233522f01d002c9b97827d00289dbf5c) to follow Cabal's platform naming more closely. Nixpkgs will also reject `js` as an architecture name.
+
 - `dokuwiki` has been updated from 2023-07-31a (Igor) to 2023-04-04 (Jack Jackrum), which has [completely removed](https://www.dokuwiki.org/changes#release_2023-04-04_jack_jackrum) the options to embed HTML and PHP for security reasons. The [htmlok plugin](https://www.dokuwiki.org/plugin:htmlok) can be used to regain this functionality.
 
 - The old unsupported version 6.x of the ELK-stack and Elastic beats have been removed. Use OpenSearch instead.
@@ -290,6 +281,10 @@ In addition to numerous new and updated packages, this release has the following
 
 - The [services.wordpress.sites.&lt;name&gt;.plugins](#opt-services.wordpress.sites._name_.plugins) and [services.wordpress.sites.&lt;name&gt;.themes](#opt-services.wordpress.sites._name_.themes) options have been converted from sets to attribute sets to allow for consumers to specify explicit install paths via attribute name.
 
+- [`services.nextcloud.database.createLocally`](#opt-services.nextcloud.database.createLocally) now uses socket authentication and is no longer compatible with password authentication.
+  - If you want the module to manage the database for you, unset [`services.nextcloud.config.dbpassFile`](#opt-services.nextcloud.config.dbpassFile) (and [`services.nextcloud.config.dbhost`](#opt-services.nextcloud.config.dbhost), if it's set).
+  - If you want to use password authentication **and** create the database locally, you will have to use [`services.mysql`](#opt-services.mysql.enable) to set it up.
+
 - `protonmail-bridge` package has been updated to major version 3.
 
 - Nebula now runs as a system user and group created for each nebula network, using the `CAP_NET_ADMIN` ambient capability on launch rather than starting as root. Ensure that any files each Nebula instance needs to access are owned by the correct user and group, by default `nebula-${networkName}`.
@@ -298,20 +293,26 @@ In addition to numerous new and updated packages, this release has the following
 
 - In `mastodon` it is now necessary to specify location of file with `PostgreSQL` database password. In `services.mastodon.database.passwordFile` parameter default value `/var/lib/mastodon/secrets/db-password` has been changed to `null`.
 
+- The `--target-host` and `--build-host` options of `nixos-rebuild` no longer treat the `localhost` value specially – to build on/deploy to local machine, omit the relevant flag.
+
 - The `nix.readOnlyStore` option has been renamed to `boot.readOnlyNixStore` to clarify that it configures the NixOS boot process, not the Nix daemon.
 
+- Deprecated `xlibsWrapper` transitional package has been removed in favour of direct use of its constituents: `xorg.libX11`, `freetype` and others.
+
 - The latest available version of Nextcloud is v26 (available as `pkgs.nextcloud26`) which uses PHP 8.2 as interpreter by default. The installation logic is as follows:
   - If `system.stateVersion` is >=23.05, `pkgs.nextcloud26` will be installed by default.
   - If `system.stateVersion` is >=22.11, `pkgs.nextcloud25` will be installed by default.
   - Please note that an upgrade from v24 (or older) to v26 directly is not possible. Please upgrade to `nextcloud25` (or earlier) first. Nextcloud prohibits skipping major versions while upgrading. You can upgrade by declaring [`services.nextcloud.package = pkgs.nextcloud25;`](options.html#opt-services.nextcloud.package).
   - It's recommended to use the latest version available (i.e. v26) and to specify that using `services.nextcloud.package`.
 
-- .NET 5.0 and .NET 3.1 were removed due to being end-of-life, use a newer, supported .NET version. Visit the  [Support Policy](https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-core) for more information.
+- .NET 5.0 and .NET 3.1 were removed due to being end-of-life, use a newer, supported .NET version - https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-core
 
 - The iputils package, which is installed by default, no longer provides the
-  `ninfod`, `rarpd` and `rdisc` tools. See [upstream's release notes](https://github.com/iputils/iputils/releases/tag/20221126) for more details and available replacements.
+  `ninfod`, `rarpd` and `rdisc` tools. See
+  [upstream's release notes](https://github.com/iputils/iputils/releases/tag/20221126)
+  for more details and available replacements.
 
-- The ppp plugin `rp-pppoe.so` has been renamed to `pppoe.so` in ppp 2.4.9. Starting from ppp 2.5.0, there is no longer an alias for backwards compatibility. Configurations that use this plugin must be updated accordingly from `plugin rp-pppoe.so` to `plugin pppoe.so`. See [upstream change](https://github.com/ppp-project/ppp/commit/610a7bd76eb1f99f22317541b35001b1e24877ed).
+- The ppp plugin `rp-pppoe.so` has been renamed to `pppoe.so` in ppp 2.4.9. Starting from ppp 2.5.0, there is no longer a alias for backwards compatibility. Configurations that use this plugin must be updated accordingly from `plugin rp-pppoe.so` to `plugin pppoe.so`. See [upstream change](https://github.com/ppp-project/ppp/commit/610a7bd76eb1f99f22317541b35001b1e24877ed).
 
 - [services.xserver.videoDrivers](options.html#opt-services.xserver.videoDrivers) now defaults to the `modesetting` driver over device-specific ones. The `radeon`, `amdgpu` and `nouveau` drivers are still available, but effectively unmaintained and not recommended for use.
 
@@ -321,7 +322,7 @@ In addition to numerous new and updated packages, this release has the following
 
 - In `services.fail2ban`, `bantime-increment.<name>` options now default to `null` (except `bantime-increment.enable`) and are used to set the corresponding option in `jail.local` only if not `null`. Also, enforce that `bantime-increment.formula` and `bantime-increment.multipliers` are not both specified.
 
-- The default `asterisk` package was changed to v20 from v19. Asterisk versions 16 and 19 have been dropped due to being EOL. You may need to update /var/lib/asterisk to match the template files in `${asterisk-20}/var/lib/asterisk`.
+- The default Asterisk package was changed to v20 from v19. Asterisk versions 16 and 19 have been dropped due to being EOL. You may need to update /var/lib/asterisk to match the template files in `${asterisk-20}/var/lib/asterisk`.
 
 - conntrack helper autodetection has been removed from kernels 6.0 and up upstream, and an assertion was added to ensure things don't silently stop working. Migrate your configuration to assign helpers explicitly or use an older LTS kernel branch as a temporary workaround.
 
@@ -339,7 +340,7 @@ In addition to numerous new and updated packages, this release has the following
 
 - The `qlandkartegt` and `garmindev` packages were removed due to being unmaintained and insecure.
 
-- The `go-ethereum` package has been updated to v1.11.5 and the `puppeth` command is no longer available as of v1.11.0.
+- `go-ethereum` package has been updated to v1.11.5 and the `puppeth` command is no longer available as of v1.11.0.
 
 - The `pnpm` package has be updated to from version 7.29.1 to version 8.1.1 and Node.js 14 support has been discontinued (though, there are workarounds if Node.js 14 is still required)
   - Migration instructions: ["Before updating pnpm to v8 in your CI, regenerate your pnpm-lock.yaml. To upgrade your lockfile, run pnpm install and commit the changes. Existing dependencies will not be updated; however, due to configuration changes in pnpm v8, some missing peer dependencies may be added to the lockfile and some packages may get deduplicated. You can commit the new lockfile even before upgrading Node.js in the CI, as pnpm v7 already supports the new lockfile format."](https://github.com/pnpm/pnpm/releases/tag/v8.0.0)
@@ -348,19 +349,21 @@ In addition to numerous new and updated packages, this release has the following
 
 - The `pict-rs` package was updated from an 0.3 alpha release to 0.3 stable, and related environment variables now require two underscores instead of one.
 
-- The `shattered-pixel-dungeon` game was updated from 1.1.2 to 2.0.2.
-  - The location of game data has changed. To migrate it, run `mv ~/.shatteredpixel ~/.local/share/.shatteredpixel`
-  - The update will delete all your in-progress games.
-
 - `espanso` has been updated to major version 2. Therefore, migration steps may need to be performed. See [the official migration instructions](https://espanso.org/docs/migration/overview/) for how to perform these migrations. Further, `espanso-wayland` can now be used for Wayland support.
 
-- Only `k3s` version 1.26 is included. Users of the `k3s_1_24` or `k3s_1_25` packages should upgrade to use the `1.26` version of the package.
-
 ## Other Notable Changes {#sec-release-23.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- To follow [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) a few options of `openssh` have been moved from `extraConfig` to the new freeform option `settings` and renamed, e.g.:
+- `vim_configurable` has been renamed to `vim-full` to avoid confusion: `vim-full`'s build-time features are configurable, but both `vim` and `vim-full` are _customizable_ (in the sense of user configuration, like vimrc).
+
+- Pantheon now defaults to Mutter 43 and GNOME settings daemon 43, all Pantheon packages are now tracking elementary OS 7 updates.
+
+- The module for the application firewall `opensnitch` got the ability to configure rules. Available as [services.opensnitch.rules](#opt-services.opensnitch.rules)
+
+- The module `usbmuxd` now has the ability to change the package used by the daemon. In case you're experiencing issues with `usbmuxd` you can try an alternative program like `usbmuxd2`. Available as [services.usbmuxd.package](#opt-services.usbmuxd.package)
+
+- A few openssh options have been moved from extraConfig to the new freeform option `settings` and renamed as follows:
   - `services.openssh.forwardX11` to `services.openssh.settings.X11Forwarding`
   - `services.openssh.kbdInteractiveAuthentication` -> `services.openssh.settings.KbdInteractiveAuthentication`
   - `services.openssh.passwordAuthentication` to `services.openssh.settings.PasswordAuthentication`
@@ -372,21 +375,18 @@ In addition to numerous new and updated packages, this release has the following
   - `services.openssh.ciphers` to `services.openssh.settings.Ciphers`
   - `services.openssh.gatewayPorts` to `services.openssh.settings.GatewayPorts`
 
-
-- `vim_configurable` has been renamed to `vim-full` to avoid confusion: `vim-full`'s build-time features are configurable, but both `vim` and `vim-full` are _customizable_ (in the sense of user configuration, like vimrc).
-
-- Pantheon now defaults to Mutter 43 and GNOME settings daemon 43, all Pantheon packages are now tracking elementary OS 7 updates.
-
-- The module for the application firewall `opensnitch` got the ability to configure rules. Available as [services.opensnitch.rules](#opt-services.opensnitch.rules)
-
-- The module `usbmuxd` now has the ability to change the package used by the daemon. In case you're experiencing issues with `usbmuxd` you can try an alternative program like `usbmuxd2`. Available as [services.usbmuxd.package](#opt-services.usbmuxd.package)
-
 - `netbox` was updated to 3.5. NixOS' `services.netbox.package` still defaults to 3.3 if `stateVersion` is earlier than 23.05. Please review upstream's breaking changes [for 3.4.0](https://github.com/netbox-community/netbox/releases/tag/v3.4.0) and [for 3.5.0](https://github.com/netbox-community/netbox/releases/tag/v3.5.0), and upgrade NetBox by changing `services.netbox.package`. Database migrations will be run automatically.
 
 - `services.netbox` now support RFC42-style options, through `services.netbox.settings`.
 
 - `services.mastodon` gained a tootctl wrapped named `mastodon-tootctl` similar to `nextcloud-occ` which can be executed from any user and switches to the configured mastodon user with sudo and sources the environment variables.
 
+- DocBook option documentation, which has been deprecated since 22.11, will now cause a warning when documentation is built. Out-of-tree modules should migrate to using CommonMark documentation as outlined in [](#sec-option-declarations) to silence this warning.
+
+  DocBook option documentation support will be removed in the next release and CommonMark will become the default. DocBook option documentation that has not been migrated until then will no longer render properly or cause errors.
+
+- NixOS now defaults to using nsncd (a non-caching reimplementation in Rust) as NSS lookup dispatcher, instead of the buggy and deprecated glibc-provided nscd. If you need to switch back, set `services.nscd.enableNsncd = false`, but please open an issue in nixpkgs so your issue can be fixed.
+
 - `services.borgmatic` now allows for multiple configurations, placed in `/etc/borgmatic.d/`, you can define them with `services.borgmatic.configurations`.
 
 - `service.openafsServer` features a new backup server `pkgs.fabs` as a
@@ -404,6 +404,8 @@ In addition to numerous new and updated packages, this release has the following
   `services.dnsmasq.extraConfig` will be deprecated when NixOS 22.11 reaches
   end of life.
 
+- `kube3d` has now been renamed to `k3d` since the 3d editor that originally took that name has been dropped from nixpkgs. `kube3d` will continue to work as an alias for now.
+
 - The `dokuwiki` service is now configured via `services.dokuwiki.sites.<name>.settings` attribute set; `extraConfig` has been removed.
   The `{aclUse,superUser,disableActions}` attributes have been renamed accordingly. `pluginsConfig` now only accepts an attribute set of booleans.
   Passing plain PHP is no longer possible.
@@ -426,84 +428,106 @@ In addition to numerous new and updated packages, this release has the following
   If undesired, the old behavior can be restored by overriding the builders with
   `{ installDocumentation = false; }`.
 
-- The nftables module now validates its ruleset at build time. The new `networking.nftables.checkRuleset` option allows disabling this check, which may fail when rules have very specific requirements, that the sandbox environment, by default, will not cover. The `networking.nftables.preCheckRuleset` option can be used to prepare the environment before the checks are run.
+- The new option `networking.nftables.checkRuleset` controls whether the ruleset is checked for syntax or not during build.  It is `true` by default.  The check might fail because it is in a sandbox environment.  To circumvent this, the ruleset file can be edited using the `networking.nftables.preCheckRuleset` option.
 
-- The `services.mastodon` module now supports connection to a remote `PostgreSQL` database.
+- `mastodon` now supports connection to a remote `PostgreSQL` database.
 
-- [`services.nextcloud.database.createLocally`](#opt-services.nextcloud.database.createLocally) now uses socket authentication and is no longer compatible with password authentication.
+- `nextcloud` has an option to enable SSE-C in S3.
-  - If you want the module to manage the database for you, unset [`services.nextcloud.config.dbpassFile`](#opt-services.nextcloud.config.dbpassFile) (and [`services.nextcloud.config.dbhost`](#opt-services.nextcloud.config.dbhost), if it's set).
-  - If you want to use password authentication **and** create the database locally, you will have to use [`services.mysql`](#opt-services.mysql.enable) to set it up.
 
-- [`services.nextcloud.config.objectstore.s3.sseCKeyFile`](#opt-services.nextcloud.config.objectstore.s3.sseCKeyFile) is a new option to enable server-side encryption with customer provided keys (SSE-C) for your S3 in Nextcloud.
+- NixOS swap partitions with random encryption can now control the sector size, cipher, and key size used to setup the plain encryption device over the
-
+  underlying block device rather than allowing them to be determined by `cryptsetup(8)`. One can use these features like so:
-- NixOS swap partitions with random encryption can now control the sector size, cipher, and key size used to set up the plain encryption device over the underlying block device rather than allowing them to be determined by `cryptsetup(8)`. One can use these features like so:
 
   ```nix
-  swapDevices = [ {
+  {
+    swapDevices = [
+      {
         device = "/dev/disk/by-partlabel/swapspace";
+
         randomEncryption = {
           enable = true;
           cipher = "aes-xts-plain64";
           keySize = 512;
           sectorSize = 4096;
         };
-  } ];
+      }
+    ];
+  }
   ```
 
 - New option `security.pam.zfs` to enable unlocking and mounting of encrypted ZFS home dataset at login.
 
-- `services.peertube` now requires you to specify the secret file `secrets.secretsFile`. It can be generated by running `openssl rand -hex 32`.  Before upgrading, check the release notes for [PeerTube v5.0.0](https://github.com/Chocobozzz/PeerTube/releases/tag/v5.0.0).And backup your data.
+- `services.peertube` now requires you to specify the secret file `secrets.secretsFile`. It can be generated by running `openssl rand -hex 32`.
+  Before upgrading, read the release notes for PeerTube:
+    - [Release v5.0.0](https://github.com/Chocobozzz/PeerTube/releases/tag/v5.0.0)
+
+  And backup your data.
 
 - `services.chronyd` is now started with additional systemd sandbox/hardening options for better security.
 
-- PostgreSQL has added opt-in support for [JIT compilation](https://www.postgresql.org/docs/current/jit-reason.html). It can be enabled like this:
+- PostgreSQL has opt-in support for [JIT compilation](https://www.postgresql.org/docs/current/jit-reason.html). It can be enabled like this:
   ```nix
-  services.postgresql.enableJIT = true;
+  {
+    services.postgresql = {
+      enable = true;
+      enableJIT = true;
+    };
+  }
   ```
 
-- `services.netdata` offers a [`services.netdata.deadlineBeforeStopSec`](#opt-services.netdata.deadlineBeforeStopSec) option which will control the deadline (in seconds) after which systemd will consider your netdata instance as dead if it didn't start in the elapsed time. It is helpful when your netdata instance takes longer to start because of a large amount of state or upgrades.
+- `services.netdata` offers a `deadlineBeforeStopSec` option which enable users who have netdata instance that takes time to initialize to not have systemd kill them for no reason.
 
-- `services.dhcpcd` service stopped soliciting or accepting IPv6 Router Advertisements on interfaces that use static IPv6 addresses.
+- `services.dhcpcd` service now don't solicit or accept IPv6 Router Advertisements on interfaces that use static IPv6 addresses.
-  If your network provides both IPv6 unique local addresses (ULA) and globally unique addresses (GUA) through autoconfiguration with SLAAC, you must add the parameter `networking.dhcpcd.IPv6rs = true;`.
+  If network uses both IPv6 Unique local addresses (ULA) and global IPv6 address auto-configuration with SLAAC, must add the parameter `networking.dhcpcd.IPv6rs = true;`.
 
 - The module `services.headscale` was refactored to be compliant with [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md). To be precise, this means that the following things have changed:
 
-  - Most settings have been migrated below [services.headscale.settings](#opt-services.headscale.settings) which is a freeform attribute-set that will be converted into headscale's YAML config format. This means that the configuration from [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml) can be directly written as attribute-set in Nix within this option.
+  - Most settings has been migrated under [services.headscale.settings](#opt-services.headscale.settings) which is an attribute-set that
+    will be converted into headscale's YAML config format. This means that the configuration from
+    [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml)
+    can be directly written as attribute-set in Nix within this option.
 
 - `services.kubo` now unmounts `ipfsMountDir` and `ipnsMountDir` even if it is killed unexpectedly when `autoMount` is enabled.
 
-- `services.grafana` listens only on localhost by default again. This was changed to the upstream default of `0.0.0.0` by accident in the freeform setting conversion.
+- `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual.
+
+- `services.grafana` listens only on localhost by default again. This was changed to upstreams default of `0.0.0.0` by accident in the freeform setting conversion.
 
 - Grafana Tempo has been updated to version 2.0. See the [upstream upgrade guide](https://grafana.com/docs/tempo/latest/release-notes/v2-0/#upgrade-considerations) for migration instructions.
 
-- A new `virtualisation.rosetta` module was added to allow running `x86_64` binaries through [Rosetta](https://developer.apple.com/documentation/apple-silicon/about-the-rosetta-translation-environment) inside virtualised NixOS guests on Apple Silicon. This feature works by default with the [UTM](https://docs.getutm.app/) virtualisation [package](https://search.nixos.org/packages?channel=23.05&show=utm&from=0&size=1&sort=relevance&type=packages&query=utm).
+- A new `virtualisation.rosetta` module was added to allow running `x86_64` binaries through [Rosetta](https://developer.apple.com/documentation/apple-silicon/about-the-rosetta-translation-environment) inside virtualised NixOS guests on Apple silicon. This feature works by default with the [UTM](https://docs.getutm.app/) virtualisation [package](https://search.nixos.org/packages?channel=unstable&show=utm&from=0&size=1&sort=relevance&type=packages&query=utm).
 
 - The new option `users.motdFile` allows configuring a Message Of The Day that can be updated dynamically.
 
 - The `root` package is now built with the `"-Dgnuinstall=ON"` CMake flag, making the output conform the `bin` `lib` `share` layout. In this layout, `tutorials` is under `share/doc/ROOT/`; `cmake`, `font`, `icons`, `js` and `macro` under `share/root`; `Makefile.comp` and `Makefile.config` under `etc/root`.
 
-- There are various new options in the `services.nginx` module:
 - Enabling global redirect in `services.nginx.virtualHosts` now allows one to add exceptions with the `locations` option.
-    - The `proxyCachePath` option has been added to `services.nginx`. It allows configuring the [`proxy_cache_path`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_path), that configures the storage path and various other settings for the cache.
-    - A new option `recommendedBrotliSettings` has been added to `services.nginx`. Learn more about compression in Brotli format [here](https://github.com/google/ngx_brotli/blob/master/README.md).
-    - `services.nginx.recommendedProxySettings` now removes the `Connection` header preventing clients from closing backend connections.
 
-- The nginx module also received an update to `services.nginx.recommendedGzipSettings`:
+- A new option `proxyCachePath` has been added to `services.nginx`. Learn more about proxy_cache_path: <https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_path>.
+
+- A new option `recommendedBrotliSettings` has been added to `services.nginx`. Learn more about compression in Brotli format [here](https://github.com/google/ngx_brotli/blob/master/README.md).
+
+- Updated recommended settings in `services.nginx.recommendedGzipSettings`:
   - Enables gzip compression for only certain proxied requests.
   - Allow checking and loading of precompressed files.
   - Updated gzip mime-types.
   - Increased the minimum length of a response that will be gzipped.
 
-- [Garage](https://garagehq.deuxfleurs.fr/) version is based on [system.stateVersion](options.html#opt-system.stateVersion), existing installations will keep using version 0.7. New installations will use version 0.8. In order to upgrade a Garage cluster, please follow [upstream instructions](https://garagehq.deuxfleurs.fr/documentation/cookbook/upgrading/) and configure [services.garage.package](options.html#opt-services.garage.package).
+- [Garage](https://garagehq.deuxfleurs.fr/) version is based on [system.stateVersion](options.html#opt-system.stateVersion), existing installations will keep using version 0.7. New installations will use version 0.8. In order to upgrade a Garage cluster, please follow [upstream instructions](https://garagehq.deuxfleurs.fr/documentation/cookbook/upgrading/) and force [services.garage.package](options.html#opt-services.garage.package) or upgrade accordingly [system.stateVersion](options.html#opt-system.stateVersion).
 
 - Nebula now supports the `services.nebula.networks.<name>.isRelay` and `services.nebula.networks.<name>.relays` configuration options for setting up or allowing traffic relaying. See the [announcement](https://www.defined.net/blog/announcing-relay-support-in-nebula/) for more details about relays.
 
+- `hip` has been separated into `hip`, `hip-common` and `hipcc`.
+
+- `services.nginx.recommendedProxySettings` now removes the `Connection` header preventing clients from closing backend connections.
+
 - Resilio sync secret keys can now be provided using a secrets file at runtime, preventing these secrets from ending up in the Nix store.
 
-- The `firewall` and `nat` modules can now optionally rely on an nftables based implementation. Enable `networking.nftables` to use it.
+- The `firewall` and `nat` module now has a nftables based implementation. Enable `networking.nftables` to use it.
 
 - The `services.fwupd` module now allows arbitrary daemon settings to be configured in a structured manner ([`services.fwupd.daemonSettings`](#opt-services.fwupd.daemonSettings)).
 
+- Nixpkgs now uses [IEEE-standard floating point arithmetic](https://github.com/NixOS/nixpkgs/pull/170215) on `powerpc64le-linux`.
+
 - `services.xserver.desktopManager.plasma5.phononBackend` now defaults to vlc according to [upstrean recommendation](https://community.kde.org/Distributions/Packaging_Recommendations#Non-Plasma_packages)
 
 - The `zramSwap` is now implemented with `zram-generator`, and the option `zramSwap.numDevices` for using ZRAM devices as general purpose ephemeral block devices has been removed.
@@ -514,13 +538,19 @@ In addition to numerous new and updated packages, this release has the following
   * `apptainer`: From `github.com/apptainer/apptainer`, which is the new repo after renaming.
   * `singularity`: From `github.com/sylabs/singularity`, which is the fork by Sylabs Inc..
 
+  `programs.singularity` got a new `package` option to specify which package to use.
+
   `singularity-tools.buildImage` got a new input argument `singularity` to specify which package to use.
 
 - The new option `programs.singularity.enableFakeroot`, if set to `true`, provides `--fakeroot` support for `apptainer` and `singularity`.
 
+- The `unifi-poller` package and corresponding NixOS module have been renamed to `unpoller` to match upstream.
+
+- The `rtsp-simple-server` package and corresponding NixOS module have been renamed to `mediamtx` to match upstream.
+
 - The new option `services.tailscale.useRoutingFeatures` controls various settings for using Tailscale features like exit nodes and subnet routers. If you wish to use your machine as an exit node, you can set this setting to `server`, otherwise if you wish to use an exit node you can set this setting to `client`. The strict RPF warning has been removed as the RPF will be loosened automatically based on the value of this setting.
 
-- `openjdk` from versioggn 11 and above is not build with `openjfx` (i.e.: JavaFX) support by default anymore. You can re-enable it by overriding, e.g.: `openjdk11.override { enableJavaFX = true; };`.
+- `openjdk` from version 11 and above is not build with `openjfx` (i.e.: JavaFX) support by default anymore. You can re-enable it by overriding, e.g.: `openjdk11.override { enableJavaFX = true; };`.
 
 - [Xastir](https://xastir.org/index.php/Main_Page) can now access AX.25 interfaces via the `libax25` package.
 
@@ -530,49 +560,24 @@ In addition to numerous new and updated packages, this release has the following
 
 - The option `services.prometheus.exporters.pihole.interval` does not exist anymore and has been removed.
 
-- The option `services.gpsd.device` has been replaced with  `services.gpsd.devices`, which supports multiple devices.
+- The option `services.gpsd.device` has been replaced with
+  `services.gpsd.devices`, which supports multiple devices.
 
-- `k3s` can now be configured with an `EnvironmentFile` for its systemd service, allowing secrets to be provided without ending up in the Nix Store.
+- `k3s` can now be configured with an EnvironmentFile for its systemd service, allowing secrets to be provided without ending up in the Nix Store.
 
-- The `gitea` module options have been moved into a freeform attribute set below `services.gitea.settings`.
+- `gitea` module options have been changed to be RFC042 conforming (i.e. some options were moved to be located under `services.gitea.settings`)
 
-- `boot.initrd.luks.device.<name>` has a new `tryEmptyPassphrase` option, this is useful for OEMs who need to install an encrypted disk with a future settable passphrase
+- `boot.initrd.luks.device.<name>` has a new `tryEmptyPassphrase` option, this is useful for OEM's who need to install an encrypted disk with a future settable passphrase
 
-- The `bind` module now allows the per-zone `allow-query` setting to be configured (previously it was hard-coded to `any`; it still defaults to `any` to retain compatibility).
+- there is a new `boot/stratisroot.nix` module that enables booting from a volume managed by the Stratis storage management daemon. Use `fileSystems.<name>.stratis.poolUuid` to configure the pool containing the fs.
-
-- The option `services.jitsi-videobridge.apis` has been renamed to `colibriRestApi` and turned into a boolean. Setting it to `true` will enable the private rest API, useful for monitoring using `services.prometheus.exporters.jitsi.enable`. Learn more about the API: "[The COLIBRI control interface (/colibri/)](https://github.com/jitsi/jitsi-videobridge/blob/v2.3/doc/rest.md)".
-
-- Booting from a volume managed by the Stratis storage management daemon is now supported. Use `fileSystems.<name>.stratis.poolUuid` to configure the pool containing the fs.
-
-## Nixpkgs internals {#sec-release-23.05-nixpkgs-internals}
-
-- `buildDunePackage` now defaults to `strictDeps = true` which means that any library should go into `buildInputs` or `checkInputs`. Any executable that is run on the building machine should go into `nativeBuildInputs` or `nativeCheckInputs` respectively. Example of executables are `ocaml`, `findlib` and `menhir`. PPXs are libraries which are built by dune and should therefore not go into `nativeBuildInputs`.
-
-- `buildFHSUserEnv` is now called `buildFHSEnv` and uses FlatPak's Bubblewrap sandboxing tool rather than Nixpkgs' own chrootenv. The old chrootenv-based implemenation is still available via `buildFHSEnvChrootenv` but is considered deprecated and will be removed when the remaining uses inside Nixpkgs have been migrated. If your FHSEnv-wrapped application misbehaves when using the new bubblewrap implementation, please create an issue in Nixpkgs.
-
-- Top-level `buildPlatform`, `hostPlatform`, `targetPlatform` have been deprecated, use `stdenv.X` instead.
-
-- `carnix` and `cratesIO` has been removed due to being unmaintained, use alternatives such as [naersk](https://github.com/nix-community/naersk) and [crate2nix](https://github.com/kolloch/crate2nix) instead.
-
-- `checkInputs` have been renamed to `nativeCheckInputs`, because they behave the same as `nativeBuildInputs` when `doCheck` is set. `checkInputs` now denote a new type of dependencies, added to `buildInputs` when `doCheck` is set. As a rule of thumb, `nativeCheckInputs` are tools on `$PATH` used during the tests, and `checkInputs` are libraries which are linked to executables built as part of the tests. Similarly, `installCheckInputs` are renamed to `nativeInstallCheckInputs`, corresponding to `nativeBuildInputs`, and `installCheckInputs` are a new type of dependencies added to `buildInputs` when `doInstallCheck` is set. (Note that this change will not cause breakage to derivations with `strictDeps` unset, which are most packages except python, rust, ocaml and go packages).
-
-- DocBook option documentation, which has been deprecated since 22.11, will now cause a warning when documentation is built. Out-of-tree modules should migrate to using CommonMark documentation as outlined in [](#sec-option-declarations) to silence this warning.
-
-  DocBook option documentation support will be removed in the next release and CommonMark will become the default. DocBook option documentation that has not been migrated until then will no longer render properly or cause errors.
-
-- `lib.systems.examples.ghcjs` and consequently `pkgsCross.ghcjs` now use the target triplet `javascript-unknown-ghcjs` instead of `js-unknown-ghcjs`. This has been done to match an [upstream decision](https://gitlab.haskell.org/ghc/ghc/-/commit/6636b670233522f01d002c9b97827d00289dbf5c) to follow Cabal's platform naming more closely. Nixpkgs will also reject `js` as an architecture name.
 
 - Lisp gained a [manual section](https://nixos.org/manual/nixpkgs/stable/#lisp), documenting a new and backwards incompatible interface. The previous interface will be removed in a future release.
 
-- Calling `makeSetupHook` without passing a `name` argument is deprecated.
+- The `bind` module now allows the per-zone `allow-query` setting to be configured (previously it was hard-coded to `any`; it still defaults to `any` to retain compatibility).
 
-- `nixos/lib/make-disk-image.nix` handles `contents` arguments that are directories better, fixing a bug where it used to put them in a subdirectory of the intended `target`.
+- `make-disk-image` handles `contents` arguments that are directories better, fixing a bug where it used to put them in a subdirectory of the intended `target`.
 
-- `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual.
+- The option `services.jitsi-videobridge.apis` has been renamed to `colibriRestApi` and turned into a boolean. Setting it to `true` will enable the private rest API, useful for monitoring using `services.prometheus.exporters.jitsi.enable`. Learn more about the API: "[The COLIBRI control interface (/colibri/)](https://github.com/jitsi/jitsi-videobridge/blob/v2.3/doc/rest.md)".
-
-- Nixpkgs now uses [IEEE-standard floating point arithmetic](https://github.com/NixOS/nixpkgs/pull/170215) on `powerpc64le-linux`.
-
-- Deprecated `xlibsWrapper` transitional package has been removed in favour of direct use of its constituents: `xorg.libX11`, `freetype` and others.
 
 ## Detailed migration information {#sec-release-23.05-migration}
 

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -8,24 +8,16 @@
 
 - Create the first release note entry in this section!
 
-- [acme-dns](https://github.com/joohoi/acme-dns), a limited DNS server to handle ACME DNS challenges easily and securely. Available as [services.acme-dns](#opt-services.acme-dns.enable).
-
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 - [river](https://github.com/riverwm/river), A dynamic tiling wayland compositor. Available as [programs.river](#opt-programs.river.enable).
 
-- [sitespeed-io](https://sitespeed.io), a tool that can generate metrics (timings, diagnostics) for websites. Available as [services.sitespeed-io](#opt-services.sitespeed-io.enable).
-
 ## Backward Incompatibilities {#sec-release-23.11-incompatibilities}
 
 - The latest version of `clonehero` now stores custom content in `~/.clonehero`. See the [migration instructions](https://clonehero.net/2022/11/29/v23-to-v1-migration-instructions.html). Typically, these content files would exist along side the binary, but the previous build used a wrapper script that would store them in `~/.config/unity3d/srylain Inc_/Clone Hero`.
 
-- `python3.pkgs.fetchPypi` (and `python3Packages.fetchPypi`) has been deprecated in favor of top-level `fetchPypi`.
-
 - `etcd` has been updated to 3.5, you will want to read the [3.3 to 3.4](https://etcd.io/docs/v3.5/upgrades/upgrade_3_4/) and [3.4 to 3.5](https://etcd.io/docs/v3.5/upgrades/upgrade_3_5/) upgrade guides
 
-- `util-linux` is now supported on Darwin and is no longer an alias to `unixtools`. Use the `unixtools.util-linux` package for access to the Apple variants of the utilities.
-
 ## Other Notable Changes {#sec-release-23.11-notable-changes}
 
 - The Cinnamon module now enables XDG desktop integration by default. If you are experiencing collisions related to xdg-desktop-portal-gtk you can safely remove `xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];` from your NixOS configuration.

nixos/modules/installer/netboot/netboot.nix

@@ -38,7 +38,10 @@ with lib;
     boot.loader.grub.enable = false;
 
     # !!! Hack - attributes expected by other modules.
-    environment.systemPackages = lib.filter (lib.meta.availableOn pkgs.stdenv.hostPlatform) [ pkgs.grub2_efi pkgs.grub2 pkgs.syslinux ];
+    environment.systemPackages = [ pkgs.grub2_efi ]
+      ++ (if pkgs.stdenv.hostPlatform.system == "aarch64-linux"
+          then []
+          else [ pkgs.grub2 pkgs.syslinux ]);
 
     fileSystems."/" = mkImageMediaOverride
       { fsType = "tmpfs";

nixos/modules/module-list.nix

@@ -777,7 +777,6 @@
   ./services/monitoring/uptime-kuma.nix
   ./services/monitoring/uptime.nix
   ./services/monitoring/vmagent.nix
-  ./services/monitoring/vmalert.nix
   ./services/monitoring/vnstat.nix
   ./services/monitoring/zabbix-agent.nix
   ./services/monitoring/zabbix-proxy.nix
@@ -808,7 +807,6 @@
   ./services/network-filesystems/xtreemfs.nix
   ./services/network-filesystems/yandex-disk.nix
   ./services/networking/3proxy.nix
-  ./services/networking/acme-dns.nix
   ./services/networking/adguardhome.nix
   ./services/networking/alice-lg.nix
   ./services/networking/amuled.nix
@@ -1010,7 +1008,6 @@
   ./services/networking/shorewall.nix
   ./services/networking/shorewall6.nix
   ./services/networking/shout.nix
-  ./services/networking/sitespeed-io.nix
   ./services/networking/skydns.nix
   ./services/networking/smartdns.nix
   ./services/networking/smokeping.nix

nixos/modules/programs/wayland/river.nix

@@ -50,7 +50,7 @@ in {
         environment.systemPackages = optional (cfg.package != null) cfg.package ++ cfg.extraPackages;
 
         # To make a river session available if a display manager like SDDM is enabled:
-        services.xserver.displayManager.sessionPackages = optionals (cfg.package != null) [ cfg.package ];
+        programs.xwayland.enable = mkDefault true;
       }
       (import ./wayland-session.nix { inherit lib pkgs; })
     ]);

nixos/modules/programs/wayland/sway.nix

@@ -49,7 +49,7 @@ in {
       description = lib.mdDoc ''
         Sway package to use. Will override the options
         'wrapperFeatures', 'extraSessionCommands', and 'extraOptions'.
-        Set to `null` to not add any Sway package to your
+        Set to <code>null</code> to not add any Sway package to your
         path. This should be done if you want to use the Home Manager Sway
         module to install Sway.
       '';

nixos/modules/services/mail/maddy.nix

@@ -335,13 +335,12 @@ in {
       };
 
       secrets = lib.mkOption {
-        type = with types; listOf path;
+        type = lib.types.path;
         description = lib.mdDoc ''
-          A list of files containing the various secrets. Should be in the format
+          A file containing the various secrets. Should be in the format
           expected by systemd's `EnvironmentFile` directory. Secrets can be
           referenced in the format `{env:VAR}`.
         '';
-        default = [ ];
       };
 
     };
@@ -380,7 +379,7 @@ in {
             User = cfg.user;
             Group = cfg.group;
             StateDirectory = [ "maddy" ];
-            EnvironmentFile = cfg.secrets;
+            EnvironmentFile = lib.mkIf (cfg.secrets != null) "${cfg.secrets}";
           };
           restartTriggers = [ config.environment.etc."maddy/maddy.conf".source ];
           wantedBy = [ "multi-user.target" ];

nixos/modules/services/mail/public-inbox.nix

@@ -53,7 +53,9 @@ let
       # if running simultaneous services.
       NonBlocking = true;
       #LimitNOFILE = 30000;
-      User = config.users.users."public-inbox".name;
+      User =
+        lib.mkIf config.systemd.services."public-inbox-${srv}".confinement.enable
+          config.users.users."public-inbox".name;
       Group = config.users.groups."public-inbox".name;
       RuntimeDirectory = [
           "public-inbox-${srv}/perl-inline"
@@ -61,9 +63,7 @@ let
       RuntimeDirectoryMode = "700";
       # This is for BindPaths= and BindReadOnlyPaths=
       # to allow traversal of directories they create inside RootDirectory=
-      UMask = "0066";
+      UMask = "0026";
-      StateDirectory = ["public-inbox"];
-      StateDirectoryMode = "0750";
       WorkingDirectory = stateDir;
       BindReadOnlyPaths = [
           "/etc"
@@ -109,7 +109,6 @@ let
       SystemCallArchitectures = "native";
 
       # The following options are redundant when confinement is enabled
-      RootDirectory = "/var/empty";
       TemporaryFileSystem = "/";
       PrivateMounts = true;
       MountAPIVFS = true;
@@ -434,8 +433,10 @@ in
       (mkIf cfg.imap.enable
         { public-inbox-imapd = mkMerge [(serviceConfig "imapd") {
           after = [ "public-inbox-init.service" "public-inbox-watch.service" ];
+          environment.PI_DIR = "/var/lib/public-inbox/.public-inbox";
           requires = [ "public-inbox-init.service" ];
           serviceConfig = {
+            DynamicUser = !config.systemd.services."public-inbox-imapd".confinement.enable;
             ExecStart = escapeShellArgs (
               [ "${cfg.package}/bin/public-inbox-imapd" ] ++
               cfg.imap.args ++
@@ -448,8 +449,10 @@ in
       (mkIf cfg.http.enable
         { public-inbox-httpd = mkMerge [(serviceConfig "httpd") {
           after = [ "public-inbox-init.service" "public-inbox-watch.service" ];
+          environment.PI_DIR = "/var/lib/public-inbox/.public-inbox";
           requires = [ "public-inbox-init.service" ];
           serviceConfig = {
+            DynamicUser = !config.systemd.services."public-inbox-httpd".confinement.enable;
             ExecStart = escapeShellArgs (
               [ "${cfg.package}/bin/public-inbox-httpd" ] ++
               cfg.http.args ++
@@ -487,8 +490,10 @@ in
       (mkIf cfg.nntp.enable
         { public-inbox-nntpd = mkMerge [(serviceConfig "nntpd") {
           after = [ "public-inbox-init.service" "public-inbox-watch.service" ];
+          environment.PI_DIR = "/var/lib/public-inbox/.public-inbox";
           requires = [ "public-inbox-init.service" ];
           serviceConfig = {
+            DynamicUser = !config.systemd.services."public-inbox-nntpd".confinement.enable;
             ExecStart = escapeShellArgs (
               [ "${cfg.package}/bin/public-inbox-nntpd" ] ++
               cfg.nntp.args ++
@@ -509,6 +514,10 @@ in
           serviceConfig = {
             ExecStart = "${cfg.package}/bin/public-inbox-watch";
             ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+            StateDirectory = ["public-inbox"];
+            StateDirectoryMode = "0750";
+            User = config.users.users."public-inbox".name;
+            Group = config.users.groups."public-inbox".name;
           };
         }];
       })
@@ -562,15 +571,22 @@ in
               ls -1 "$inbox" | grep -q '^xap' ||
               ${cfg.package}/bin/public-inbox-index "$inbox"
             done
+
+            # Older versions of the module did not make inboxes group-readable.
+            # chmod -R g+r ${stateDir}/inboxes
           '';
           serviceConfig = {
             Type = "oneshot";
             RemainAfterExit = true;
             StateDirectory = [
+              "public-inbox"
               "public-inbox/.public-inbox"
               "public-inbox/.public-inbox/emergency"
               "public-inbox/inboxes"
             ];
+            StateDirectoryMode = "0750";
+            User = config.users.users."public-inbox".name;
+            Group = config.users.groups."public-inbox".name;
           };
         }];
       })

nixos/modules/services/misc/docker-registry.nix

@@ -49,14 +49,6 @@ in {
   options.services.dockerRegistry = {
     enable = mkEnableOption (lib.mdDoc "Docker Registry");
 
-    package = mkOption {
-      type = types.package;
-      description = mdDoc "Which Docker registry package to use.";
-      default = pkgs.docker-distribution;
-      defaultText = literalExpression "pkgs.docker-distribution";
-      example = literalExpression "pkgs.gitlab-container-registry";
-    };
-
     listenAddress = mkOption {
       description = lib.mdDoc "Docker registry host or ip to bind to.";
       default = "127.0.0.1";
@@ -125,7 +117,7 @@ in {
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
       script = ''
-        ${cfg.package}/bin/registry serve ${configFile}
+        ${pkgs.docker-distribution}/bin/registry serve ${configFile}
       '';
 
       serviceConfig = {
@@ -144,7 +136,7 @@ in {
       serviceConfig.Type = "oneshot";
 
       script = ''
-        ${cfg.package}/bin/registry garbage-collect ${configFile}
+        ${pkgs.docker-distribution}/bin/registry garbage-collect ${configFile}
         /run/current-system/systemd/bin/systemctl restart docker-registry.service
       '';
 

nixos/modules/services/misc/gitea.nix

@@ -498,8 +498,7 @@ in
 
     systemd.services.gitea = {
       description = "gitea";
-      after = [ "network.target" ] ++ optional usePostgresql "postgresql.service" ++ optional useMysql "mysql.service";
+      after = [ "network.target" ] ++ lib.optional usePostgresql "postgresql.service" ++ lib.optional useMysql "mysql.service";
-      requires = optional usePostgresql "postgresql.service" ++ optional useMysql "mysql.service";
       wantedBy = [ "multi-user.target" ];
       path = [ cfg.package pkgs.git pkgs.gnupg ];
 

nixos/modules/services/misc/gitlab.nix

@@ -9,10 +9,12 @@ let
   toml = pkgs.formats.toml {};
   yaml = pkgs.formats.yaml {};
 
+  ruby = cfg.packages.gitlab.ruby;
+
   postgresqlPackage = if config.services.postgresql.enable then
                         config.services.postgresql.package
                       else
-                        pkgs.postgresql_13;
+                        pkgs.postgresql_12;
 
   gitlabSocket = "${cfg.statePath}/tmp/sockets/gitlab.socket";
   gitalySocket = "${cfg.statePath}/tmp/sockets/gitaly.socket";
@@ -45,6 +47,9 @@ let
     [git]
     bin_path = "${pkgs.git}/bin/git"
 
+    [gitaly-ruby]
+    dir = "${cfg.packages.gitaly.ruby}"
+
     [gitlab-shell]
     dir = "${cfg.packages.gitlab-shell}"
 
@@ -84,9 +89,6 @@ let
     };
   };
 
-  # Redis configuration file
-  resqueYml = pkgs.writeText "resque.yml" (builtins.toJSON redisConfig);
-
   gitlabConfig = {
     # These are the default settings from config/gitlab.example.yml
     production = flip recursiveUpdate cfg.extraConfig {
@@ -170,6 +172,7 @@ let
     SCHEMA = "${cfg.statePath}/db/structure.sql";
     GITLAB_UPLOADS_PATH = "${cfg.statePath}/uploads";
     GITLAB_LOG_PATH = "${cfg.statePath}/log";
+    GITLAB_REDIS_CONFIG_FILE = pkgs.writeText "redis.yml" (builtins.toJSON redisConfig);
     prometheus_multiproc_dir = "/run/gitlab";
     RAILS_ENV = "production";
     MALLOC_ARENA_MAX = "2";
@@ -553,20 +556,6 @@ in {
           default = false;
           description = lib.mdDoc "Enable GitLab container registry.";
         };
-        package = mkOption {
-          type = types.package;
-          default =
-            if versionAtLeast config.system.stateVersion "23.11"
-            then pkgs.gitlab-container-registry
-            else pkgs.docker-distribution;
-          defaultText = literalExpression "pkgs.docker-distribution";
-          description = lib.mdDoc ''
-            Container registry package to use.
-
-            External container registries such as `pkgs.docker-distribution` are not supported
-            anymore since GitLab 16.0.0.
-          '';
-        };
         host = mkOption {
           type = types.str;
           default = config.services.gitlab.host;
@@ -1081,13 +1070,6 @@ in {
   };
 
   config = mkIf cfg.enable {
-    warnings = [
-      (mkIf
-        (cfg.registry.enable && versionAtLeast (getVersion cfg.packages.gitlab) "16.0.0" && cfg.registry.package == pkgs.docker-distribution)
-        ''Support for container registries other than gitlab-container-registry has ended since GitLab 16.0.0 and is scheduled for removal in a future release.
-          Please back up your data and migrate to the gitlab-container-registry package.''
-      )
-    ];
 
     assertions = [
       {
@@ -1119,8 +1101,8 @@ in {
         message = "services.gitlab.secrets.jwsFile must be set!";
       }
       {
-        assertion = versionAtLeast postgresqlPackage.version "13.6.0";
+        assertion = versionAtLeast postgresqlPackage.version "12.0.0";
-        message = "PostgreSQL >=13.6 is required to run GitLab 16. Follow the instructions in the manual section for upgrading PostgreSQL here: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading";
+        message = "PostgreSQL >=12 is required to run GitLab 14. Follow the instructions in the manual section for upgrading PostgreSQL here: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading";
       }
     ];
 
@@ -1231,7 +1213,6 @@ in {
     services.dockerRegistry = optionalAttrs cfg.registry.enable {
       enable = true;
       enableDelete = true; # This must be true, otherwise GitLab won't manage it correctly
-      package = cfg.package;
       extraConfig = {
         auth.token = {
           realm = "http${optionalString (cfg.https == true) "s"}://${cfg.host}/jwt/auth";
@@ -1334,7 +1315,6 @@ in {
           cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/db/* ${cfg.statePath}/db
           ln -sf ${extraGitlabRb} ${cfg.statePath}/config/initializers/extra-gitlab.rb
           ln -sf ${cableYml} ${cfg.statePath}/config/cable.yml
-          ln -sf ${resqueYml} ${cfg.statePath}/config/resque.yml
 
           ${cfg.packages.gitlab-shell}/bin/install
 
@@ -1482,7 +1462,10 @@ in {
       partOf = [ "gitlab.target" ];
       path = with pkgs; [
         openssh
+        procps  # See https://gitlab.com/gitlab-org/gitaly/issues/1562
         git
+        cfg.packages.gitaly.rubyEnv
+        cfg.packages.gitaly.rubyEnv.wrappedRuby
         gzip
         bzip2
       ];

nixos/modules/services/misc/nitter.nix

@@ -165,14 +165,14 @@ in
         enableDebug = mkEnableOption (lib.mdDoc "request logs and debug endpoints");
 
         proxy = mkOption {
-          type = types.str;
+          type = types.nullOr types.str;
-          default = "";
+          default = null;
           description = lib.mdDoc "URL to a HTTP/HTTPS proxy.";
         };
 
         proxyAuth = mkOption {
-          type = types.str;
+          type = types.nullOr types.str;
-          default = "";
+          default = null;
           description = lib.mdDoc "Credentials for proxy.";
         };
 

nixos/modules/services/misc/ntfy-sh.nix

@@ -61,17 +61,8 @@ in
 
       services.ntfy-sh.settings = {
         auth-file = mkDefault "/var/lib/ntfy-sh/user.db";
-        listen-http = mkDefault "127.0.0.1:2586";
-        attachment-cache-dir = mkDefault "/var/lib/ntfy-sh/attachments";
-        cache-file = mkDefault "/var/lib/ntfy-sh/cache-file.db";
       };
 
-      systemd.tmpfiles.rules = [
-        "f ${cfg.settings.auth-file} 0600 ${cfg.user} ${cfg.group} - -"
-        "d ${cfg.settings.attachment-cache-dir} 0700 ${cfg.user} ${cfg.group} - -"
-        "f ${cfg.settings.cache-file} 0600 ${cfg.user} ${cfg.group} - -"
-      ];
-
       systemd.services.ntfy-sh = {
         description = "Push notifications server";
 
@@ -83,7 +74,6 @@ in
           User = cfg.user;
           StateDirectory = "ntfy-sh";
 
-          DynamicUser = true;
           AmbientCapabilities = "CAP_NET_BIND_SERVICE";
           PrivateTmp = true;
           NoNewPrivileges = true;
@@ -98,8 +88,6 @@ in
           RestrictNamespaces = true;
           RestrictRealtime = true;
           MemoryDenyWriteExecute = true;
-          # Upstream Recommandation
-          LimitNOFILE = 20500;
         };
       };
 

nixos/modules/services/misc/pufferpanel.nix

@@ -19,7 +19,7 @@ in
           services.pufferpanel = {
             enable = true;
             extraPackages = with pkgs; [ bash curl gawk gnutar gzip ];
-            package = pkgs.buildFHSEnv {
+            package = pkgs.buildFHSUserEnv {
               name = "pufferpanel-fhs";
               runScript = lib.getExe pkgs.pufferpanel;
               targetPkgs = pkgs': with pkgs'; [ icu openssl zlib ];
@@ -162,7 +162,7 @@ in
         PrivateUsers = true;
         PrivateDevices = true;
         RestrictRealtime = true;
-        RestrictNamespaces = [ "user" "mnt" ]; # allow buildFHSEnv
+        RestrictNamespaces = [ "user" "mnt" ]; # allow buildFHSUserEnv
         RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
         LockPersonality = true;
         DeviceAllow = [ "" ];

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -35,7 +35,6 @@ let
     "dovecot"
     "fastly"
     "fritzbox"
-    "graphite"
     "influxdb"
     "ipmi"
     "json"

nixos/modules/services/monitoring/prometheus/exporters/graphite.nix

@@ -1,41 +0,0 @@
-{ config, lib, pkgs, options }:
-
-let
-  cfg = config.services.prometheus.exporters.graphite;
-  format = pkgs.formats.yaml { };
-in
-{
-  port = 9108;
-  extraOpts = {
-    graphitePort = lib.mkOption {
-      type = lib.types.port;
-      default = 9109;
-      description = lib.mdDoc ''
-        Port to use for the graphite server.
-      '';
-    };
-    mappingSettings = lib.mkOption {
-      type = lib.types.submodule {
-        freeformType = format.type;
-        options = { };
-      };
-      default = { };
-      description = lib.mdDoc ''
-        Mapping configuration for the exporter, see
-        <https://github.com/prometheus/graphite_exporter#yaml-config> for
-        available options.
-      '';
-    };
-  };
-  serviceOpts = {
-    serviceConfig = {
-      ExecStart = ''
-        ${pkgs.prometheus-graphite-exporter}/bin/graphite_exporter \
-          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
-          --graphite.listen-address ${cfg.listenAddress}:${toString cfg.graphitePort} \
-          --graphite.mapping-config ${format.generate "mapping.yml" cfg.mappingSettings} \
-          ${lib.concatStringsSep " \\\n  " cfg.extraFlags}
-      '';
-    };
-  };
-}

nixos/modules/services/monitoring/vmalert.nix

@@ -1,136 +0,0 @@
-{ config, pkgs, lib, ... }: with lib;
-let
-  cfg = config.services.vmalert;
-
-  format = pkgs.formats.yaml {};
-
-  confOpts = concatStringsSep " \\\n" (mapAttrsToList mkLine (filterAttrs (_: v: v != false) cfg.settings));
-  confType = with types;
-    let
-      valueType = oneOf [ bool int path str ];
-    in
-    attrsOf (either valueType (listOf valueType));
-
-  mkLine = key: value:
-    if value == true then "-${key}"
-    else if isList value then concatMapStringsSep " " (v: "-${key}=${escapeShellArg (toString v)}") value
-    else "-${key}=${escapeShellArg (toString value)}"
-  ;
-in
-{
-  # interface
-  options.services.vmalert = {
-    enable = mkEnableOption (mdDoc "vmalert");
-
-    package = mkOption {
-      type = types.package;
-      default = pkgs.victoriametrics;
-      defaultText = "pkgs.victoriametrics";
-      description = mdDoc ''
-        The VictoriaMetrics derivation to use.
-      '';
-    };
-
-    settings = mkOption {
-      type = types.submodule {
-        freeformType = confType;
-        options = {
-
-          "datasource.url" = mkOption {
-            type = types.nonEmptyStr;
-            example = "http://localhost:8428";
-            description = mdDoc ''
-              Datasource compatible with Prometheus HTTP API.
-            '';
-          };
-
-          "notifier.url" = mkOption {
-            type = with types; listOf nonEmptyStr;
-            default = [];
-            example = [ "http://127.0.0.1:9093" ];
-            description = mdDoc ''
-              Prometheus Alertmanager URL. List all Alertmanager URLs if it runs in the cluster mode to ensure high availability.
-            '';
-          };
-
-          "rule" = mkOption {
-            type = with types; listOf path;
-            description = mdDoc ''
-              Path to the files with alerting and/or recording rules.
-
-              ::: {.note}
-              Consider using the {option}`services.vmalert.rules` option as a convenient alternative for declaring rules
-              directly in the `nix` language.
-              :::
-            '';
-          };
-
-        };
-      };
-      default = { };
-      example = {
-        "datasource.url" = "http://localhost:8428";
-        "datasource.disableKeepAlive" = true;
-        "datasource.showURL" = false;
-        "rule" = [
-          "http://<some-server-addr>/path/to/rules"
-          "dir/*.yaml"
-        ];
-      };
-      description = mdDoc ''
-        `vmalert` configuration, passed via command line flags. Refer to
-        <https://github.com/VictoriaMetrics/VictoriaMetrics/blob/master/app/vmalert/README.md#configuration>
-        for details on supported values.
-      '';
-    };
-
-    rules = mkOption {
-      type = format.type;
-      default = {};
-      example = {
-        group = [
-          { name = "TestGroup";
-            rules = [
-              { alert = "ExampleAlertAlwaysFiring";
-                expr = ''
-                  sum by(job)
-                  (up == 1)
-                '';
-              }
-            ];
-          }
-        ];
-      };
-      description = mdDoc ''
-        A list of the given alerting or recording rules against configured `"datasource.url"` compatible with
-        Prometheus HTTP API for `vmalert` to execute. Refer to
-        <https://github.com/VictoriaMetrics/VictoriaMetrics/blob/master/app/vmalert/README.md#rules>
-        for details on supported values.
-      '';
-    };
-  };
-
-  # implementation
-  config = mkIf cfg.enable {
-
-    environment.etc."vmalert/rules.yml".source = format.generate "rules.yml" cfg.rules;
-
-    services.vmalert.settings.rule = [
-      "/etc/vmalert/rules.yml"
-    ];
-
-    systemd.services.vmalert = {
-      description = "vmalert service";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-      reloadTriggers = [ config.environment.etc."vmalert/rules.yml".source ];
-
-      serviceConfig = {
-        DynamicUser = true;
-        Restart = "on-failure";
-        ExecStart = "${cfg.package}/bin/vmalert ${confOpts}";
-        ExecReload = ''${pkgs.coreutils}/bin/kill -SIGHUP "$MAINPID"'';
-      };
-    };
-  };
-}

nixos/modules/services/networking/acme-dns.nix

@@ -1,154 +0,0 @@
-{ lib
-, config
-, pkgs
-, ...
-}:
-
-let
-  cfg = config.services.acme-dns;
-  format = pkgs.formats.toml { };
-  inherit (lib)
-    literalExpression
-    mdDoc
-    mkEnableOption
-    mkOption
-    mkPackageOptionMD
-    types
-    ;
-  domain = "acme-dns.example.com";
-in
-{
-  options.services.acme-dns = {
-    enable = mkEnableOption (mdDoc "acme-dns");
-
-    package = mkPackageOptionMD pkgs "acme-dns" { };
-
-    settings = mkOption {
-      description = mdDoc ''
-        Free-form settings written directly to the `acme-dns.cfg` file.
-        Refer to <https://github.com/joohoi/acme-dns/blob/master/README.md#configuration> for supported values.
-      '';
-
-      default = { };
-
-      type = types.submodule {
-        freeformType = format.type;
-        options = {
-          general = {
-            listen = mkOption {
-              type = types.str;
-              description = mdDoc "IP+port combination to bind and serve the DNS server on.";
-              default = "[::]:53";
-              example = "127.0.0.1:53";
-            };
-
-            protocol = mkOption {
-              type = types.enum [ "both" "both4" "both6" "udp" "udp4" "udp6" "tcp" "tcp4" "tcp6" ];
-              description = mdDoc "Protocols to serve DNS responses on.";
-              default = "both";
-            };
-
-            domain = mkOption {
-              type = types.str;
-              description = mdDoc "Domain name to serve the requests off of.";
-              example = domain;
-            };
-
-            nsname = mkOption {
-              type = types.str;
-              description = mdDoc "Zone name server.";
-              example = domain;
-            };
-
-            nsadmin = mkOption {
-              type = types.str;
-              description = mdDoc "Zone admin email address for `SOA`.";
-              example = "admin.example.com";
-            };
-
-            records = mkOption {
-              type = types.listOf types.str;
-              description = mdDoc "Predefined DNS records served in addition to the `_acme-challenge` TXT records.";
-              example = literalExpression ''
-                [
-                  # replace with your acme-dns server's public IPv4
-                  "${domain}. A 198.51.100.1"
-                  # replace with your acme-dns server's public IPv6
-                  "${domain}. AAAA 2001:db8::1"
-                  # ${domain} should resolve any *.${domain} records
-                  "${domain}. NS ${domain}."
-                ]
-              '';
-            };
-          };
-
-          database = {
-            engine = mkOption {
-              type = types.enum [ "sqlite3" "postgres" ];
-              description = mdDoc "Database engine to use.";
-              default = "sqlite3";
-            };
-            connection = mkOption {
-              type = types.str;
-              description = mdDoc "Database connection string.";
-              example = "postgres://user:password@localhost/acmedns";
-              default = "/var/lib/acme-dns/acme-dns.db";
-            };
-          };
-
-          api = {
-            ip = mkOption {
-              type = types.str;
-              description = mdDoc "IP to bind the HTTP API on.";
-              default = "[::]";
-              example = "127.0.0.1";
-            };
-
-            port = mkOption {
-              type = types.port;
-              description = mdDoc "Listen port for the HTTP API.";
-              default = 8080;
-              # acme-dns expects this value to be a string
-              apply = toString;
-            };
-
-            disable_registration = mkOption {
-              type = types.bool;
-              description = mdDoc "Whether to disable the HTTP registration endpoint.";
-              default = false;
-              example = true;
-            };
-
-            tls = mkOption {
-              type = types.enum [ "letsencrypt" "letsencryptstaging" "cert" "none" ];
-              description = mdDoc "TLS backend to use.";
-              default = "none";
-            };
-          };
-
-
-          logconfig = {
-            loglevel = mkOption {
-              type = types.enum [ "error" "warning" "info" "debug" ];
-              description = mdDoc "Level to log on.";
-              default = "info";
-            };
-          };
-        };
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.packages = [ cfg.package ];
-    systemd.services.acme-dns = {
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        ExecStart = [ "" "${lib.getExe cfg.package} -c ${format.generate "acme-dns.toml" cfg.settings}" ];
-        StateDirectory = "acme-dns";
-        WorkingDirectory = "%S/acme-dns";
-        DynamicUser = true;
-      };
-    };
-  };
-}

nixos/modules/services/networking/murmur.nix

@@ -313,7 +313,7 @@ in
     systemd.services.murmur = {
       description = "Murmur Chat Service";
       wantedBy    = [ "multi-user.target" ];
-      after       = [ "network.target" ];
+      after       = [ "network-online.target" ];
       preStart    = ''
         ${pkgs.envsubst}/bin/envsubst \
           -o /run/murmur/murmurd.ini \

nixos/modules/services/networking/sitespeed-io.nix

@@ -1,122 +0,0 @@
-{ lib, config, pkgs, ... }:
-let
-  cfg = config.services.sitespeed-io;
-  format = pkgs.formats.json { };
-in
-{
-  options.services.sitespeed-io = {
-    enable = lib.mkEnableOption (lib.mdDoc "Sitespeed.io");
-
-    user = lib.mkOption {
-      type = lib.types.str;
-      default = "sitespeed-io";
-      description = lib.mdDoc "User account under which sitespeed-io runs.";
-    };
-
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.sitespeed-io;
-      defaultText = "pkgs.sitespeed-io";
-      description = lib.mdDoc "Sitespeed.io package to use.";
-    };
-
-    dataDir = lib.mkOption {
-      default = "/var/lib/sitespeed-io";
-      type = lib.types.str;
-      description = lib.mdDoc "The base sitespeed-io data directory.";
-    };
-
-    period = lib.mkOption {
-      type = lib.types.str;
-      default = "hourly";
-      description = lib.mdDoc ''
-        Systemd calendar expression when to run. See {manpage}`systemd.time(7)`.
-      '';
-    };
-
-    runs = lib.mkOption {
-      default = [ ];
-      description = lib.mdDoc ''
-        A list of run configurations. The service will call sitespeed-io once
-        for every run listed here. This lets you examine different websites
-        with different sitespeed-io settings.
-      '';
-      type = lib.types.listOf (lib.types.submodule {
-        options = {
-          urls = lib.mkOption {
-            type = with lib.types; listOf str;
-            default = [];
-            description = lib.mdDoc ''
-              URLs the service should monitor.
-            '';
-          };
-
-          settings = lib.mkOption {
-            type = lib.types.submodule {
-              freeformType = format.type;
-              options = { };
-            };
-            default = { };
-            description = lib.mdDoc ''
-              Configuration for sitespeed-io, see
-              <https://www.sitespeed.io/documentation/sitespeed.io/configuration/>
-              for available options. The value here will be directly transformed to
-              JSON and passed as `--config` to the program.
-            '';
-          };
-
-          extraArgs = lib.mkOption {
-            type = with lib.types; listOf str;
-            default = [];
-            description = lib.mdDoc ''
-              Extra command line arguments to pass to the program.
-            '';
-          };
-        };
-      });
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-    {
-      assertion = cfg.runs != [];
-      message = "At least one run must be configured.";
-    }
-    {
-      assertion = lib.all (run: run.urls != []) cfg.runs;
-      message = "All runs must have at least one url configured.";
-    }
-  ];
-
-    systemd.services.sitespeed-io = {
-      description = "Check website status";
-      startAt = cfg.period;
-      serviceConfig = {
-        WorkingDirectory = cfg.dataDir;
-        User = cfg.user;
-      };
-      preStart = "chmod u+w -R ${cfg.dataDir}"; # Make sure things are writable
-      script = (lib.concatMapStrings (run: ''
-        ${lib.getExe cfg.package} \
-          --config ${format.generate "sitespeed.json" run.settings} \
-          ${lib.escapeShellArgs run.extraArgs} \
-          ${builtins.toFile "urls.txt" (lib.concatLines run.urls)} &
-      '') cfg.runs) +
-      ''
-        wait
-      '';
-    };
-
-    users = {
-      extraUsers.${cfg.user} = {
-        isSystemUser = true;
-        group = cfg.user;
-        home = cfg.dataDir;
-        createHome = true;
-        homeMode = "755";
-      };
-      extraGroups.${cfg.user} = { };
-    };
-  };
-}

nixos/modules/services/networking/ssh/sshd.nix

@@ -570,26 +570,14 @@ in
 
     assertions = [{ assertion = if cfg.settings.X11Forwarding then cfgc.setXAuthLocation else true;
                     message = "cannot enable X11 forwarding without setting xauth location";}
-                  (let
+                  { assertion = lib.lists.unique (map (x: lib.strings.toLower x) (attrNames cfg.settings))
-                    duplicates =
+                      == (map (x: lib.strings.toLower x) (attrNames cfg.settings));
-                      # Filter out the groups with more than 1 element
+                    message = "Duplicate sshd config key; does your capitalization match the option's?"; } ]
-                      lib.filter (l: lib.length l > 1) (
-                        # Grab the groups, we don't care about the group identifiers
-                        lib.attrValues (
-                          # Group the settings that are the same in lower case
-                          lib.groupBy lib.strings.toLower (attrNames cfg.settings)
-                        )
-                      );
-                    formattedDuplicates = lib.concatMapStringsSep ", " (dupl: "(${lib.concatStringsSep ", " dupl})") duplicates;
-                  in
-                  {
-                    assertion = lib.length duplicates == 0;
-                    message = ''Duplicate sshd config key; does your capitalization match the option's? Duplicate keys: ${formattedDuplicates}'';
-                  })]
       ++ forEach cfg.listenAddresses ({ addr, ... }: {
         assertion = addr != null;
         message = "addr must be specified in each listenAddresses entry";
       });
+
   };
 
 }

nixos/modules/services/web-apps/code-server.nix

@@ -1,199 +1,107 @@
 { config, lib, pkgs, ... }:
 
+with lib;
 let
+
   cfg = config.services.code-server;
   defaultUser = "code-server";
   defaultGroup = defaultUser;
+
 in {
+  ###### interface
   options = {
     services.code-server = {
-      enable = lib.mkEnableOption (lib.mdDoc "code-server");
+      enable = mkEnableOption (lib.mdDoc "code-server");
 
-      package = lib.mkPackageOptionMD pkgs "code-server" { };
+      package = mkOption {
-
+        default = pkgs.code-server;
-      extraPackages = lib.mkOption {
+        defaultText = lib.literalExpression "pkgs.code-server";
-        default = [ ];
+        description = lib.mdDoc "Which code-server derivation to use.";
-        description = lib.mdDoc ''
+        type = types.package;
-          Additional packages to add to the code-server {env}`PATH`.
-        '';
-        example = lib.literalExpression "[ pkgs.go ]";
-        type = lib.types.listOf lib.types.package;
       };
 
-      extraEnvironment = lib.mkOption {
+      extraPackages = mkOption {
-        type = lib.types.attrsOf lib.types.str;
+        default = [ ];
-        description = lib.mdDoc ''
+        description = lib.mdDoc "Packages that are available in the PATH of code-server.";
-          Additional environment variables to pass to code-server.
+        example = "[ pkgs.go ]";
-        '';
+        type = types.listOf types.package;
+      };
+
+      extraEnvironment = mkOption {
+        type = types.attrsOf types.str;
+        description =
+          lib.mdDoc "Additional environment variables to passed to code-server.";
         default = { };
         example = { PKG_CONFIG_PATH = "/run/current-system/sw/lib/pkgconfig"; };
       };
 
-      extraArguments = lib.mkOption {
+      extraArguments = mkOption {
-        default = [ ];
+        default = [ "--disable-telemetry" ];
-        description = lib.mdDoc ''
+        description = lib.mdDoc "Additional arguments that passed to code-server";
-          Additional arguments to pass to code-server.
+        example = ''[ "--verbose" ]'';
-        '';
+        type = types.listOf types.str;
-        example = lib.literalExpression ''[ "--log=info" ]'';
-        type = lib.types.listOf lib.types.str;
       };
 
-      host = lib.mkOption {
+      host = mkOption {
-        default = "localhost";
+        default = "127.0.0.1";
-        description = lib.mdDoc ''
+        description = lib.mdDoc "The host-ip to bind to.";
-          The host name or IP address the server should listen to.
+        type = types.str;
-        '';
-        type = lib.types.str;
       };
 
-      port = lib.mkOption {
+      port = mkOption {
         default = 4444;
-        description = lib.mdDoc ''
+        description = lib.mdDoc "The port where code-server runs.";
-          The port the server should listen to.
+        type = types.port;
-        '';
-        type = lib.types.port;
       };
 
-      auth = lib.mkOption {
+      auth = mkOption {
         default = "password";
-        description = lib.mdDoc ''
+        description = lib.mdDoc "The type of authentication to use.";
-          The type of authentication to use.
+        type = types.enum [ "none" "password" ];
-        '';
-        type = lib.types.enum [ "none" "password" ];
       };
 
-      hashedPassword = lib.mkOption {
+      hashedPassword = mkOption {
         default = "";
-        description = lib.mdDoc ''
+        description =
-          Create the password with: `echo -n 'thisismypassword' | npx argon2-cli -e`.
+          lib.mdDoc "Create the password with: `echo -n 'thisismypassword' | npx argon2-cli -e`.";
-        '';
+        type = types.str;
-        type = lib.types.str;
       };
 
-      user = lib.mkOption {
+      user = mkOption {
         default = defaultUser;
         example = "yourUser";
         description = lib.mdDoc ''
           The user to run code-server as.
           By default, a user named `${defaultUser}` will be created.
         '';
-        type = lib.types.str;
+        type = types.str;
       };
 
-      group = lib.mkOption {
+      group = mkOption {
         default = defaultGroup;
         example = "yourGroup";
         description = lib.mdDoc ''
           The group to run code-server under.
           By default, a group named `${defaultGroup}` will be created.
         '';
-        type = lib.types.str;
+        type = types.str;
       };
 
-      extraGroups = lib.mkOption {
+      extraGroups = mkOption {
         default = [ ];
-        description = lib.mdDoc ''
+        description =
-          An array of additional groups for the `${defaultUser}` user.
+          lib.mdDoc "An array of additional groups for the `${defaultUser}` user.";
-        '';
         example = [ "docker" ];
-        type = lib.types.listOf lib.types.str;
+        type = types.listOf types.str;
-      };
-
-      socket = lib.mkOption {
-        default = null;
-        example = "/run/code-server/socket";
-        description = lib.mdDoc ''
-          Path to a socket (bind-addr will be ignored).
-        '';
-        type = lib.types.nullOr lib.types.str;
-      };
-
-      socketMode = lib.mkOption {
-        default = null;
-        description = lib.mdDoc ''
-           File mode of the socket.
-        '';
-        type = lib.types.nullOr lib.types.str;
-      };
-
-      userDataDir = lib.mkOption {
-        default = null;
-        description = lib.mdDoc ''
-          Path to the user data directory.
-        '';
-        type = lib.types.nullOr lib.types.str;
-      };
-
-      extensionsDir = lib.mkOption {
-        default = null;
-        description = lib.mdDoc ''
-          Path to the extensions directory.
-        '';
-        type = lib.types.nullOr lib.types.str;
-      };
-
-      proxyDomain = lib.mkOption {
-        default = null;
-        example = "code-server.lan";
-        description = lib.mdDoc ''
-          Domain used for proxying ports.
-        '';
-        type = lib.types.nullOr lib.types.str;
-      };
-
-      disableTelemetry = lib.mkOption {
-        default = false;
-        example = true;
-        description = lib.mdDoc ''
-          Disable telemetry.
-        '';
-        type = lib.types.bool;
-      };
-
-      disableUpdateCheck = lib.mkOption {
-        default = false;
-        example = true;
-        description = lib.mdDoc ''
-          Disable update check.
-          Without this flag, code-server checks every 6 hours against the latest github release and
-          then notifies you once every week that a new release is available.
-        '';
-        type = lib.types.bool;
-      };
-
-      disableFileDownloads = lib.mkOption {
-        default = false;
-        example = true;
-        description = lib.mdDoc ''
-          Disable file downloads from Code.
-        '';
-        type = lib.types.bool;
-      };
-
-      disableWorkspaceTrust = lib.mkOption {
-        default = false;
-        example = true;
-        description = lib.mdDoc ''
-          Disable Workspace Trust feature.
-        '';
-        type = lib.types.bool;
-      };
-
-      disableGettingStartedOverride = lib.mkOption {
-        default = false;
-        example = true;
-        description = lib.mdDoc ''
-          Disable the coder/coder override in the Help: Getting Started page.
-        '';
-        type = lib.types.bool;
       };
 
     };
   };
 
-  config = lib.mkIf cfg.enable {
+  ###### implementation
+  config = mkIf cfg.enable {
     systemd.services.code-server = {
-      description = "Code server";
+      description = "VSCode server";
       wantedBy = [ "multi-user.target" ];
       after = [ "network-online.target" ];
       path = cfg.extraPackages;
@@ -201,37 +109,18 @@ in {
         HASHED_PASSWORD = cfg.hashedPassword;
       } // cfg.extraEnvironment;
       serviceConfig = {
-        ExecStart = ''
+        ExecStart = "${cfg.package}/bin/code-server --bind-addr ${cfg.host}:${toString cfg.port} --auth ${cfg.auth} " + lib.escapeShellArgs cfg.extraArguments;
-          ${lib.getExe cfg.package} \
-            --auth=${cfg.auth} \
-            --bind-addr=${cfg.host}:${toString cfg.port} \
-          '' + lib.optionalString (cfg.socket != null) ''
-            --socket=${cfg.socket} \
-          '' + lib.optionalString (cfg.userDataDir != null) ''
-            --user-data-dir=${cfg.userDataDir} \
-          '' + lib.optionalString (cfg.extensionsDir != null) ''
-            --extensions-dir=${cfg.extensionsDir} \
-          '' + lib.optionalString (cfg.disableTelemetry == true) ''
-            --disable-telemetry \
-          '' + lib.optionalString (cfg.disableUpdateCheck == true) ''
-            --disable-update-check \
-          '' + lib.optionalString (cfg.disableFileDownloads == true) ''
-            --disable-file-downloads \
-          '' + lib.optionalString (cfg.disableWorkspaceTrust == true) ''
-            --disable-workspace-trust \
-          '' + lib.optionalString (cfg.disableGettingStartedOverride == true) ''
-            --disable-getting-started-override \
-          '' + lib.escapeShellArgs cfg.extraArguments;
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         RuntimeDirectory = cfg.user;
         User = cfg.user;
         Group = cfg.group;
         Restart = "on-failure";
       };
+
     };
 
-    users.users."${cfg.user}" = lib.mkMerge [
+    users.users."${cfg.user}" = mkMerge [
-      (lib.mkIf (cfg.user == defaultUser) {
+      (mkIf (cfg.user == defaultUser) {
         isNormalUser = true;
         description = "code-server user";
         inherit (cfg) group;
@@ -242,8 +131,9 @@ in {
       }
     ];
 
-    users.groups."${defaultGroup}" = lib.mkIf (cfg.group == defaultGroup) { };
+    users.groups."${defaultGroup}" = mkIf (cfg.group == defaultGroup) { };
+
   };
 
-  meta.maintainers = [ lib.maintainers.stackshadow ];
+  meta.maintainers = with maintainers; [ stackshadow ];
 }

nixos/modules/services/web-apps/pixelfed.nix

@@ -448,7 +448,7 @@ in {
         cfg.nginx
         {
           root = lib.mkForce "${pixelfed}/public/";
-          locations."/".tryFiles = "$uri $uri/ /index.php?$query_string";
+          locations."/".tryFiles = "$uri $uri/ /index.php?query_string";
           locations."/favicon.ico".extraConfig = ''
             access_log off; log_not_found off;
           '';

nixos/modules/services/web-servers/garage.nix

@@ -49,7 +49,7 @@ in
 
           replication_mode = mkOption {
             default = "none";
-            type = types.enum ([ "none" "1" "2" "3" "2-dangerous" "3-dangerous" "3-degraded" 1 2 3 ]);
+            type = types.enum ([ "none" "1" "2" "3" 1 2 3 ]);
             apply = v: toString v;
             description = lib.mdDoc "Garage replication mode, defaults to none, see: <https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/#replication-mode> for reference.";
           };
@@ -80,7 +80,6 @@ in
       after = [ "network.target" "network-online.target" ];
       wants = [ "network.target" "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
-      restartTriggers = [ configFile ];
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/garage server";
 

nixos/modules/services/x11/desktop-managers/cinnamon.nix

@@ -70,9 +70,9 @@ in
           name = mkDefault "Mint-Y-Aqua";
           package = mkDefault pkgs.cinnamon.mint-themes;
         };
-        iconTheme = mkIf (notExcluded pkgs.cinnamon.mint-y-icons) {
+        iconTheme = mkIf (notExcluded pkgs.cinnamon.mint-x-icons) {
           name = mkDefault "Mint-Y-Aqua";
-          package = mkDefault pkgs.cinnamon.mint-y-icons;
+          package = mkDefault pkgs.cinnamon.mint-x-icons;
         };
         cursorTheme = mkIf (notExcluded pkgs.cinnamon.mint-cursor-themes) {
           name = mkDefault "Bibata-Modern-Classic";

nixos/modules/services/x11/desktop-managers/pantheon.nix

@@ -227,16 +227,11 @@ in
       xdg.icons.enable = true;
 
       xdg.portal.enable = true;
-      xdg.portal.extraPortals = [
+      xdg.portal.extraPortals = with pkgs.pantheon; [
-        # Some Pantheon apps enforce portal usage, we need this for e.g. notifications.
-        # Currently we have buildPortalsInGnome enabled, if you run into issues related
-        # to https://github.com/flatpak/xdg-desktop-portal/issues/656 please report to us.
-        pkgs.xdg-desktop-portal-gtk
-      ] ++ (with pkgs.pantheon; [
         elementary-files
         elementary-settings-daemon
         xdg-desktop-portal-pantheon
-      ]);
+      ];
 
       # Override GSettings schemas
       environment.sessionVariables.NIX_GSETTINGS_OVERRIDES_DIR = "${nixos-gsettings-desktop-schemas}/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas";

nixos/modules/services/x11/display-managers/account-service-util.nix

@@ -2,7 +2,7 @@
 , glib
 , gobject-introspection
 , python3
-, wrapGAppsNoGuiHook
+, wrapGAppsHook
 , lib
 }:
 
@@ -18,7 +18,7 @@ python3.pkgs.buildPythonApplication {
   strictDeps = false;
 
   nativeBuildInputs = [
-    wrapGAppsNoGuiHook
+    wrapGAppsHook
     gobject-introspection
   ];
 

nixos/modules/services/x11/window-managers/default.nix

@@ -14,7 +14,6 @@ in
     ./bspwm.nix
     ./cwm.nix
     ./clfswm.nix
-    ./dk.nix
     ./dwm.nix
     ./e16.nix
     ./evilwm.nix

nixos/modules/services/x11/window-managers/dk.nix

@@ -1,27 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.xserver.windowManager.dk;
-in
-
-{
-  options = {
-    services.xserver.windowManager.dk = {
-      enable = lib.mkEnableOption (lib.mdDoc "dk");
-
-      package = lib.mkPackageOptionMD pkgs "dk" { };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.xserver.windowManager.session = lib.singleton {
-      name = "dk";
-      start = ''
-        export _JAVA_AWT_WM_NONREPARENTING=1
-        ${cfg.package}/bin/dk &
-        waitPID=$!
-      '';
-    };
-    environment.systemPackages = [ cfg.package ];
-  };
-}

nixos/modules/system/boot/systemd/logind.nix

@@ -11,145 +11,64 @@ let
   ];
 in
 {
-  options.services.logind = {
+  options = {
-    extraConfig = mkOption {
+    services.logind.extraConfig = mkOption {
       default = "";
       type = types.lines;
       example = "IdleAction=lock";
       description = lib.mdDoc ''
-        Extra config options for systemd-logind.
+        Extra config options for systemd-logind. See
-        See [logind.conf(5)](https://www.freedesktop.org/software/systemd/man/logind.conf.html)
+        [
-        for available options.
+        logind.conf(5)](https://www.freedesktop.org/software/systemd/man/logind.conf.html) for available options.
       '';
     };
 
-    killUserProcesses = mkOption {
+    services.logind.killUserProcesses = mkOption {
       default = false;
       type = types.bool;
       description = lib.mdDoc ''
         Specifies whether the processes of a user should be killed
         when the user logs out.  If true, the scope unit corresponding
         to the session and all processes inside that scope will be
-        terminated.  If false, the scope is "abandoned"
+        terminated.  If false, the scope is "abandoned" (see
-        (see [systemd.scope(5)](https://www.freedesktop.org/software/systemd/man/systemd.scope.html#)),
+        [systemd.scope(5)](https://www.freedesktop.org/software/systemd/man/systemd.scope.html#)), and processes are not killed.
-        and processes are not killed.
 
         See [logind.conf(5)](https://www.freedesktop.org/software/systemd/man/logind.conf.html#KillUserProcesses=)
         for more details.
       '';
     };
 
-    powerKey = mkOption {
+    services.logind.lidSwitch = mkOption {
-      default = "poweroff";
-      example = "ignore";
-      type = logindHandlerType;
-
-      description = lib.mdDoc ''
-        Specifies what to do when the power key is pressed.
-      '';
-    };
-
-    powerKeyLongPress = mkOption {
-      default = "ignore";
-      example = "reboot";
-      type = logindHandlerType;
-
-      description = lib.mdDoc ''
-        Specifies what to do when the power key is long-pressed.
-      '';
-    };
-
-    rebootKey = mkOption {
-      default = "reboot";
-      example = "ignore";
-      type = logindHandlerType;
-
-      description = lib.mdDoc ''
-        Specifies what to do when the reboot key is pressed.
-      '';
-    };
-
-    rebootKeyLongPress = mkOption {
-      default = "poweroff";
-      example = "ignore";
-      type = logindHandlerType;
-
-      description = lib.mdDoc ''
-        Specifies what to do when the reboot key is long-pressed.
-      '';
-    };
-
-    suspendKey = mkOption {
       default = "suspend";
       example = "ignore";
       type = logindHandlerType;
 
       description = lib.mdDoc ''
-        Specifies what to do when the suspend key is pressed.
+        Specifies what to be done when the laptop lid is closed.
       '';
     };
 
-    suspendKeyLongPress = mkOption {
+    services.logind.lidSwitchDocked = mkOption {
-      default = "hibernate";
-      example = "ignore";
-      type = logindHandlerType;
-
-      description = lib.mdDoc ''
-        Specifies what to do when the suspend key is long-pressed.
-      '';
-    };
-
-    hibernateKey = mkOption {
-      default = "hibernate";
-      example = "ignore";
-      type = logindHandlerType;
-
-      description = lib.mdDoc ''
-        Specifies what to do when the hibernate key is pressed.
-      '';
-    };
-
-    hibernateKeyLongPress = mkOption {
       default = "ignore";
       example = "suspend";
       type = logindHandlerType;
 
       description = lib.mdDoc ''
-        Specifies what to do when the hibernate key is long-pressed.
+        Specifies what to be done when the laptop lid is closed
+        and another screen is added.
       '';
     };
 
-    lidSwitch = mkOption {
+    services.logind.lidSwitchExternalPower = mkOption {
-      default = "suspend";
-      example = "ignore";
-      type = logindHandlerType;
-
-      description = lib.mdDoc ''
-        Specifies what to do when the laptop lid is closed.
-      '';
-    };
-
-    lidSwitchExternalPower = mkOption {
       default = cfg.lidSwitch;
       defaultText = literalExpression "services.logind.lidSwitch";
       example = "ignore";
       type = logindHandlerType;
 
       description = lib.mdDoc ''
-        Specifies what to do when the laptop lid is closed
+        Specifies what to do when the laptop lid is closed and the system is
-        and the system is on external power. By default use
+        on external power. By default use the same action as specified in
-        the same action as specified in services.logind.lidSwitch.
+        services.logind.lidSwitch.
-      '';
-    };
-
-    lidSwitchDocked = mkOption {
-      default = "ignore";
-      example = "suspend";
-      type = logindHandlerType;
-
-      description = lib.mdDoc ''
-        Specifies what to do when the laptop lid is closed
-        and another screen is added.
       '';
     };
   };
@@ -175,17 +94,9 @@ in
       "systemd/logind.conf".text = ''
         [Login]
         KillUserProcesses=${if cfg.killUserProcesses then "yes" else "no"}
-        HandlePowerKey=${cfg.powerKey}
-        HandlePowerKeyLongPress=${cfg.powerKeyLongPress}
-        HandleRebootKey=${cfg.rebootKey}
-        HandleRebootKeyLongPress=${cfg.rebootKeyLongPress}
-        HandleSuspendKey=${cfg.suspendKey}
-        HandleSuspendKeyLongPress=${cfg.suspendKeyLongPress}
-        HandleHibernateKey=${cfg.hibernateKey}
-        HandleHibernateKeyLongPress=${cfg.hibernateKeyLongPress}
         HandleLidSwitch=${cfg.lidSwitch}
-        HandleLidSwitchExternalPower=${cfg.lidSwitchExternalPower}
         HandleLidSwitchDocked=${cfg.lidSwitchDocked}
+        HandleLidSwitchExternalPower=${cfg.lidSwitchExternalPower}
         ${cfg.extraConfig}
       '';
     };

nixos/modules/tasks/network-interfaces-scripted.nix

@@ -293,7 +293,7 @@ let
             script = ''
               # Remove Dead Interfaces
               echo "Removing old bridge ${n}..."
-              ip link show dev "${n}" >/dev/null 2>&1 && ip link del "${n}"
+              ip link show "${n}" >/dev/null 2>&1 && ip link del "${n}"
 
               echo "Adding bridge ${n}..."
               ip link add name "${n}" type bridge
@@ -459,7 +459,7 @@ let
             path = [ pkgs.iproute2 ];
             script = ''
               # Remove Dead Interfaces
-              ip link show dev "${n}" >/dev/null 2>&1 && ip link delete "${n}"
+              ip link show "${n}" >/dev/null 2>&1 && ip link delete "${n}"
               ip link add link "${v.interface}" name "${n}" type macvlan \
                 ${optionalString (v.mode != null) "mode ${v.mode}"}
               ip link set "${n}" up
@@ -517,7 +517,7 @@ let
             path = [ pkgs.iproute2 ];
             script = ''
               # Remove Dead Interfaces
-              ip link show dev "${n}" >/dev/null 2>&1 && ip link delete "${n}"
+              ip link show "${n}" >/dev/null 2>&1 && ip link delete "${n}"
               ip link add name "${n}" type sit \
                 ${optionalString (v.remote != null) "remote \"${v.remote}\""} \
                 ${optionalString (v.local != null) "local \"${v.local}\""} \
@@ -551,7 +551,7 @@ let
             path = [ pkgs.iproute2 ];
             script = ''
               # Remove Dead Interfaces
-              ip link show dev "${n}" >/dev/null 2>&1 && ip link delete "${n}"
+              ip link show "${n}" >/dev/null 2>&1 && ip link delete "${n}"
               ip link add name "${n}" type ${v.type} \
                 ${optionalString (v.remote != null) "remote \"${v.remote}\""} \
                 ${optionalString (v.local != null) "local \"${v.local}\""} \
@@ -579,7 +579,7 @@ let
             path = [ pkgs.iproute2 ];
             script = ''
               # Remove Dead Interfaces
-              ip link show dev "${n}" >/dev/null 2>&1 && ip link delete "${n}"
+              ip link show "${n}" >/dev/null 2>&1 && ip link delete "${n}"
               ip link add link "${v.interface}" name "${n}" type vlan id "${toString v.id}"
 
               # We try to bring up the logical VLAN interface. If the master

nixos/modules/virtualisation/amazon-ec2-amis.nix

@@ -536,53 +536,5 @@ let self = {
   "22.11".us-west-1.aarch64-linux.hvm-ebs = "ami-052d52b9e30a18562";
   "22.11".us-west-2.aarch64-linux.hvm-ebs = "ami-07418b6a4782c9521";
 
-  # 23.05.426.afc48694f2a
+  latest = self."22.11";
-
-  "23.05".eu-west-1.x86_64-linux.hvm-ebs = "ami-0fc7825fe890f87d1";
-  "23.05".af-south-1.x86_64-linux.hvm-ebs = "ami-0df2f7b42bfbd53e5";
-  "23.05".ap-east-1.x86_64-linux.hvm-ebs = "ami-07ba84d7321f6f4bb";
-  "23.05".ap-northeast-1.x86_64-linux.hvm-ebs = "ami-0e37827874573dbbf";
-  "23.05".ap-northeast-2.x86_64-linux.hvm-ebs = "ami-0ff5b3b7738651895";
-  "23.05".ap-northeast-3.x86_64-linux.hvm-ebs = "ami-0a7861571eb44c70c";
-  "23.05".ap-south-1.x86_64-linux.hvm-ebs = "ami-05c4802ca81d7c95b";
-  "23.05".ap-southeast-1.x86_64-linux.hvm-ebs = "ami-0aee8193da16bd2db";
-  "23.05".ap-southeast-2.x86_64-linux.hvm-ebs = "ami-008be032289f60d16";
-  "23.05".ap-southeast-3.x86_64-linux.hvm-ebs = "ami-033debde7c1659c96";
-  "23.05".ca-central-1.x86_64-linux.hvm-ebs = "ami-031821b5f83896474";
-  "23.05".eu-central-1.x86_64-linux.hvm-ebs = "ami-0d6ee9d5e1c985df6";
-  "23.05".eu-north-1.x86_64-linux.hvm-ebs = "ami-0cecb1f67b2a837f6";
-  "23.05".eu-south-1.x86_64-linux.hvm-ebs = "ami-0f9fee15eb5a64ac4";
-  "23.05".eu-west-2.x86_64-linux.hvm-ebs = "ami-0e62fef78d2c4f031";
-  "23.05".eu-west-3.x86_64-linux.hvm-ebs = "ami-01a6e4c1659b08390";
-  "23.05".me-south-1.x86_64-linux.hvm-ebs = "ami-0a01a7eeffa8f0fd5";
-  "23.05".sa-east-1.x86_64-linux.hvm-ebs = "ami-09a1760227f929ccf";
-  "23.05".us-east-1.x86_64-linux.hvm-ebs = "ami-07df5833f04703a2a";
-  "23.05".us-east-2.x86_64-linux.hvm-ebs = "ami-04dd2f100d9665df5";
-  "23.05".us-west-1.x86_64-linux.hvm-ebs = "ami-0fe502361fea4216c";
-  "23.05".us-west-2.x86_64-linux.hvm-ebs = "ami-0749963dd978a57c7";
-
-  "23.05".eu-west-1.aarch64-linux.hvm-ebs = "ami-0a0609421e5638005";
-  "23.05".af-south-1.aarch64-linux.hvm-ebs = "ami-05d95a055aba9373e";
-  "23.05".ap-east-1.aarch64-linux.hvm-ebs = "ami-08ae0190b1357465b";
-  "23.05".ap-northeast-1.aarch64-linux.hvm-ebs = "ami-09418b2049c3c9533";
-  "23.05".ap-northeast-2.aarch64-linux.hvm-ebs = "ami-040713ad23b404271";
-  "23.05".ap-northeast-3.aarch64-linux.hvm-ebs = "ami-0c888d6c1d989db68";
-  "23.05".ap-south-1.aarch64-linux.hvm-ebs = "ami-02da38deb21545675";
-  "23.05".ap-southeast-1.aarch64-linux.hvm-ebs = "ami-06df0713468bea276";
-  "23.05".ap-southeast-2.aarch64-linux.hvm-ebs = "ami-0171ee37ae5104c06";
-  "23.05".ap-southeast-3.aarch64-linux.hvm-ebs = "ami-075da61f5fef1fe80";
-  "23.05".ca-central-1.aarch64-linux.hvm-ebs = "ami-0ba8bd0a3d0a596f8";
-  "23.05".eu-central-1.aarch64-linux.hvm-ebs = "ami-0891608ae66031439";
-  "23.05".eu-north-1.aarch64-linux.hvm-ebs = "ami-0a3ad7ef18d595c68";
-  "23.05".eu-south-1.aarch64-linux.hvm-ebs = "ami-0fa86b680aa9a0444";
-  "23.05".eu-west-2.aarch64-linux.hvm-ebs = "ami-0a415791078f05970";
-  "23.05".eu-west-3.aarch64-linux.hvm-ebs = "ami-05d9b146317962e3b";
-  "23.05".me-south-1.aarch64-linux.hvm-ebs = "ami-0019b591acf30aa66";
-  "23.05".sa-east-1.aarch64-linux.hvm-ebs = "ami-030d6c30d91f06cc7";
-  "23.05".us-east-1.aarch64-linux.hvm-ebs = "ami-0a061ca437b63df33";
-  "23.05".us-east-2.aarch64-linux.hvm-ebs = "ami-0bf0b2b8fdfda30e8";
-  "23.05".us-west-1.aarch64-linux.hvm-ebs = "ami-0e75c8f3deb1f842b";
-  "23.05".us-west-2.aarch64-linux.hvm-ebs = "ami-0d0979d889078d036";
-
-  latest = self."23.05";
 }; in self

nixos/modules/virtualisation/qemu-vm.nix

@@ -1,8 +1,11 @@
 # This module creates a virtual machine from the NixOS configuration.
 # Building the `config.system.build.vm' attribute gives you a command
 # that starts a KVM/QEMU VM running the NixOS configuration defined in
-# `config'. By default, the Nix store is shared read-only with the
+# `config'.  The Nix store is shared read-only with the host, which
-# host, which makes (re)building VMs very efficient.
+# makes (re)building VMs very efficient.  However, it also means you
+# can't reconfigure the guest inside the guest - you need to rebuild
+# the VM in the host.  On the other hand, the root filesystem is a
+# read/writable disk image persistent across VM reboots.
 
 { config, lib, pkgs, options, ... }:
 
@@ -775,11 +778,12 @@ in
         default = false;
         description =
           lib.mdDoc ''
-            Use a boot loader to boot the system.
+            If enabled, the virtual machine will be booted using the
-            This allows, among other things, testing the boot loader.
+            regular boot loader (i.e., GRUB 1 or 2).  This allows
-
+            testing of the boot loader.  If
-            If disabled, the kernel and initrd are directly booted,
+            disabled (the default), the VM directly boots the NixOS
-            forgoing any bootloader.
+            kernel and initial ramdisk, bypassing the boot loader
+            altogether.
           '';
       };
 
@@ -1022,6 +1026,7 @@ in
         "-netdev user,id=user.0,${forwardingOptions}${restrictNetworkOption}\"$QEMU_NET_OPTS\""
       ];
 
+    # FIXME: Consolidate this one day.
     virtualisation.qemu.options = mkMerge [
       (mkIf cfg.qemu.virtioKeyboard [
         "-device virtio-keyboard"
@@ -1073,12 +1078,14 @@ in
       }) cfg.emptyDiskImages)
     ];
 
-    # Use mkVMOverride to enable building test VMs (e.g. via `nixos-rebuild
-    # build-vm`) of a system configuration, where the regular value for the
-    # `fileSystems' attribute should be disregarded (since those filesystems
-    # don't necessarily exist in the VM).
     fileSystems = mkVMOverride cfg.fileSystems;
 
+    # Mount the host filesystem via 9P, and bind-mount the Nix store
+    # of the host into our own filesystem.  We use mkVMOverride to
+    # allow this module to be applied to "normal" NixOS system
+    # configuration, where the regular value for the `fileSystems'
+    # attribute should be disregarded for the purpose of building a VM
+    # test image (since those filesystems don't exist in the VM).
     virtualisation.fileSystems = let
       mkSharedDir = tag: share:
         {

nixos/tests/aaaaxy.nix

@@ -21,7 +21,7 @@
       "ln -s '${pkgs.aaaaxy.testing_infra}/assets/demos/benchmark.dem' '/tmp/aaaaxy/assets/demos/'",
       """
         '${pkgs.aaaaxy.testing_infra}/scripts/regression-test-demo.sh' \
-        'aaaaxy' 'on track for Any%, All Paths, No Teleports and No Coil' \
+        'aaaaxy' 'on track for Any%, All Paths and No Teleports' \
         '${pkgs.aaaaxy}/bin/aaaaxy' '/tmp/aaaaxy/assets/demos/benchmark.dem'
       """,
     )

nixos/tests/acme-dns.nix

@@ -1,50 +0,0 @@
-import ./make-test-python.nix ({ ... }: {
-  name = "acme-dns";
-
-  nodes.machine = { pkgs, ... }: {
-    services.acme-dns = {
-      enable = true;
-      settings = {
-        general = rec {
-          domain = "acme-dns.home.arpa";
-          nsname = domain;
-          nsadmin = "admin.home.arpa";
-          records = [
-            "${domain}. A 127.0.0.1"
-            "${domain}. AAAA ::1"
-            "${domain}. NS ${domain}."
-          ];
-        };
-        logconfig.loglevel = "debug";
-      };
-    };
-    environment.systemPackages = with pkgs; [ curl bind ];
-  };
-
-  testScript = ''
-    import json
-
-    machine.wait_for_unit("acme-dns.service")
-    machine.wait_for_open_port(53) # dns
-    machine.wait_for_open_port(8080) # http api
-
-    result = machine.succeed("curl --fail -X POST http://localhost:8080/register")
-    print(result)
-
-    registration = json.loads(result)
-
-    machine.succeed(f'dig -t TXT @localhost {registration["fulldomain"]} | grep "SOA" | grep "admin.home.arpa"')
-
-    # acme-dns exspects a TXT value string length of exactly 43 chars
-    txt = "___dummy_validation_token_for_txt_record___"
-
-    machine.succeed(
-      "curl --fail -X POST http://localhost:8080/update "
-      + f' -H "X-Api-User: {registration["username"]}"'
-      + f' -H "X-Api-Key: {registration["password"]}"'
-      + f' -d \'{{"subdomain":"{registration["subdomain"]}", "txt":"{txt}"}}\'''
-    )
-
-    assert txt in machine.succeed(f'dig -t TXT +short @localhost {registration["fulldomain"]}')
-  '';
-})

nixos/tests/all-tests.nix

@@ -95,7 +95,6 @@ in {
   _3proxy = runTest ./3proxy.nix;
   aaaaxy = runTest ./aaaaxy.nix;
   acme = runTest ./acme.nix;
-  acme-dns = handleTest ./acme-dns.nix {};
   adguardhome = runTest ./adguardhome.nix;
   aesmd = runTestOn ["x86_64-linux"] ./aesmd.nix;
   agate = runTest ./web-servers/agate.nix;
@@ -171,7 +170,6 @@ in {
   cntr = handleTestOn ["aarch64-linux" "x86_64-linux"] ./cntr.nix {};
   cockpit = handleTest ./cockpit.nix {};
   cockroachdb = handleTestOn ["x86_64-linux"] ./cockroachdb.nix {};
-  code-server = handleTest ./code-server.nix {};
   coder = handleTest ./coder.nix {};
   collectd = handleTest ./collectd.nix {};
   connman = handleTest ./connman.nix {};
@@ -614,7 +612,6 @@ in {
   postfix-raise-smtpd-tls-security-level = handleTest ./postfix-raise-smtpd-tls-security-level.nix {};
   postfixadmin = handleTest ./postfixadmin.nix {};
   postgis = handleTest ./postgis.nix {};
-  apache_datasketches = handleTest ./apache_datasketches.nix {};
   postgresql = handleTest ./postgresql.nix {};
   postgresql-jit = handleTest ./postgresql-jit.nix {};
   postgresql-wal-receiver = handleTest ./postgresql-wal-receiver.nix {};

nixos/tests/apache_datasketches.nix

@@ -1,29 +0,0 @@
-import ./make-test-python.nix ({ pkgs, ...} : {
-  name = "postgis";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ lsix ]; # TODO: Who's the maintener now?
-  };
-
-  nodes = {
-    master =
-      { pkgs, ... }:
-
-      {
-        services.postgresql = let mypg = pkgs.postgresql_15; in {
-            enable = true;
-            package = mypg;
-            extraPlugins = with mypg.pkgs; [
-              apache_datasketches
-            ];
-        };
-      };
-  };
-
-  testScript = ''
-    start_all()
-    master.wait_for_unit("postgresql")
-    master.sleep(10)  # Hopefully this is long enough!!
-    master.succeed("sudo -u postgres psql -c 'CREATE EXTENSION datasketches;'")
-    master.succeed("sudo -u postgres psql -c 'SELECT hll_sketch_to_string(hll_sketch_build(1));'")
-  '';
-})

nixos/tests/cinnamon.nix

@@ -3,7 +3,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
 
   meta.maintainers = lib.teams.cinnamon.members;
 
-  nodes.machine = { ... }: {
+  nodes.machine = { nodes, ... }: {
     imports = [ ./common/user-account.nix ];
     services.xserver.enable = true;
     services.xserver.desktopManager.cinnamon.enable = true;
@@ -13,7 +13,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
 
   testScript = { nodes, ... }:
     let
-      user = nodes.machine.users.users.alice;
+      user = nodes.machine.config.users.users.alice;
       uid = toString user.uid;
       bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${uid}/bus";
       display = "DISPLAY=:0.0";

nixos/tests/code-server.nix

@@ -1,22 +0,0 @@
-import ./make-test-python.nix ({pkgs, lib, ...}:
-{
-  name = "code-server";
-
-  nodes = {
-    machine = {pkgs, ...}: {
-      services.code-server = {
-        enable = true;
-        auth = "none";
-      };
-    };
-  };
-
-  testScript = ''
-    start_all()
-    machine.wait_for_unit("code-server.service")
-    machine.wait_for_open_port(4444)
-    machine.succeed("curl -k --fail http://localhost:4444", timeout=10)
-  '';
-
-  meta.maintainers = [ lib.maintainers.drupol ];
-})

nixos/tests/gitlab.nix

@@ -19,13 +19,13 @@ let
   aliceUsername = "alice";
   aliceUserId = "2";
   alicePassword = "R5twyCgU0uXC71wT9BBTCqLs6HFZ7h3L";
-  aliceProjectId = "1";
+  aliceProjectId = "2";
   aliceProjectName = "test-alice";
 
   bobUsername = "bob";
   bobUserId = "3";
   bobPassword = "XwkkBbl2SiIwabQzgcoaTbhsotijEEtF";
-  bobProjectId = "2";
+  bobProjectId = "3";
 in {
   name = "gitlab";
   meta.maintainers = with lib.maintainers; [ globin yayayayaka ];

nixos/tests/kanidm.nix

@@ -63,27 +63,12 @@ import ./make-test-python.nix ({ pkgs, ... }:
       ''
         start_all()
         server.wait_for_unit("kanidm.service")
-
-        with subtest("Test HTTP interface"):
         server.wait_until_succeeds("curl -sf https://${serverDomain} | grep Kanidm")
-
-        with subtest("Test LDAP interface"):
         server.succeed("ldapsearch -H ldaps://${serverDomain}:636 -b '${ldapBaseDN}' -x '(name=test)'")
-
+        client.succeed("kanidm login -D anonymous && kanidm self whoami | grep anonymous@${serverDomain}")
-        with subtest("Test CLI login"):
+        rv, result = server.execute("kanidmd recover_account -c ${serverConfigFile} idm_admin 2>&1 | rg -o '[A-Za-z0-9]{48}'")
-            client.succeed("kanidm login -D anonymous")
+        assert rv == 0
-            client.succeed("kanidm self whoami | grep anonymous@${serverDomain}")
-
-        with subtest("Recover idm_admin account"):
-            # Must stop the server for account recovery or else kanidmd fails with
-            # "unable to lock kanidm exclusive lock at /var/lib/kanidm/kanidm.db.klock".
-            server.succeed("systemctl stop kanidm")
-            server.succeed("su - kanidm -c 'kanidmd recover-account -c ${serverConfigFile} idm_admin 2>&1 | rg -o \'[A-Za-z0-9]{48}\' '")
-            server.succeed("systemctl start kanidm")
-
-        with subtest("Test unixd connection"):
         client.wait_for_unit("kanidm-unixd.service")
-            # TODO: client.wait_for_file("/run/kanidm-unixd/sock")
+        client.succeed("kanidm_unixd_status | grep working!")
-            client.wait_until_succeeds("kanidm-unix status | grep working!")
       '';
   })

nixos/tests/networking.nix

@@ -998,31 +998,6 @@ let
         machine.fail("ip address show wlan0 | grep -q ${testMac}")
       '';
     };
-    naughtyInterfaceNames = let
-      ifnames = [
-        # flags of ip-address
-        "home" "temporary" "optimistic"
-        "bridge_slave" "flush"
-        # flags of ip-route
-        "up" "type" "nomaster" "address"
-        # other
-        "very_loong_name" "lowerUpper" "-"
-      ];
-    in {
-      name = "naughtyInterfaceNames";
-      nodes.machine = { pkgs, ... }: {
-        networking.useNetworkd = networkd;
-        networking.bridges = listToAttrs
-          (flip map ifnames
-             (name: { inherit name; value.interfaces = []; }));
-      };
-      testScript = ''
-        machine.start()
-        machine.wait_for_unit("network.target")
-        for ifname in ${builtins.toJSON ifnames}:
-            machine.wait_until_succeeds(f"ip link show dev '{ifname}' | grep -q '{ifname}'")
-      '';
-    };
     caseSensitiveRenaming = {
       name = "CaseSensitiveRenaming";
       nodes.machine = { pkgs, ... }: {

nixos/tests/nginx-http3.nix

@@ -76,19 +76,19 @@ in
     server.wait_for_open_port(443)
 
     # Check http connections
-    client.succeed("curl --verbose --http3-only https://acme.test | grep 'Hello World!'")
+    client.succeed("curl --verbose --http3 https://acme.test | grep 'Hello World!'")
 
     # Check downloadings
-    client.succeed("curl --verbose --http3-only https://acme.test/example.txt --output /tmp/example.txt")
+    client.succeed("curl --verbose --http3 https://acme.test/example.txt --output /tmp/example.txt")
     client.succeed("cat /tmp/example.txt | grep 'Check http3 protocol.'")
 
     # Check header reading
-    client.succeed("curl --verbose --http3-only --head https://acme.test | grep 'content-type'")
+    client.succeed("curl --verbose --http3 --head https://acme.test | grep 'content-type'")
-    client.succeed("curl --verbose --http3-only --head https://acme.test | grep 'HTTP/3 200'")
+    client.succeed("curl --verbose --http3 --head https://acme.test | grep 'HTTP/3 200'")
-    client.succeed("curl --verbose --http3-only --head https://acme.test/error | grep 'HTTP/3 404'")
+    client.succeed("curl --verbose --http3 --head https://acme.test/error | grep 'HTTP/3 404'")
 
     # Check change User-Agent
-    client.succeed("curl --verbose --http3-only --user-agent 'Curl test 3.0' https://acme.test")
+    client.succeed("curl --verbose --http3 --user-agent 'Curl test 3.0' https://acme.test")
     server.succeed("cat /var/log/nginx/access.log | grep 'Curl test 3.0'")
 
     server.shutdown()

nixos/tests/ntfy-sh.nix

@@ -3,7 +3,6 @@ import ./make-test-python.nix {
 
   nodes.machine = { ... }: {
     services.ntfy-sh.enable = true;
-    services.ntfy-sh.settings.base-url = "http://localhost:2586";
   };
 
   testScript = ''
@@ -13,14 +12,12 @@ import ./make-test-python.nix {
 
     machine.wait_for_unit("multi-user.target")
 
-    machine.wait_for_open_port(2586)
+    machine.wait_for_open_port(80)
 
-    machine.succeed(f"curl -d '{msg}' localhost:2586/test")
+    machine.succeed(f"curl -d '{msg}' localhost:80/test")
 
-    notif = json.loads(machine.succeed("curl -s localhost:2586/test/json?poll=1"))
+    notif = json.loads(machine.succeed("curl -s localhost:80/test/json?poll=1"))
 
     assert msg == notif["message"], "Wrong message"
-
-    machine.succeed("ntfy user list")
   '';
 }

nixos/tests/prometheus-exporters.nix

@@ -284,29 +284,6 @@ let
       '';
     };
 
-    graphite = {
-      exporterConfig = {
-        enable = true;
-        port = 9108;
-        graphitePort = 9109;
-        mappingSettings.mappings = [{
-          match = "test.*.*";
-          name = "testing";
-          labels = {
-            protocol = "$1";
-            author = "$2";
-          };
-        }];
-      };
-      exporterTest = ''
-        wait_for_unit("prometheus-graphite-exporter.service")
-        wait_for_open_port(9108)
-        wait_for_open_port(9109)
-        succeed("echo test.tcp.foo-bar 1234 $(date +%s) | nc -w1 localhost 9109")
-        succeed("curl -sSf http://localhost:9108/metrics | grep 'testing{author=\"foo-bar\",protocol=\"tcp\"} 1234'")
-      '';
-    };
-
     influxdb = {
       exporterConfig = {
         enable = true;

nixos/tests/public-inbox.nix

@@ -201,7 +201,7 @@ in
 
       This is a testing mail.
     ''}")
-    machine.sleep(10)
+    machine.sleep(5)
     machine.succeed("curl -L 'https://machine.${domain}/inbox/repo1/repo1@root-1/T/#u' | grep 'This is a testing mail.'")
 
     # Read a mail through public-inbox-imapd

nixos/tests/shadowsocks/common.nix

@@ -69,7 +69,6 @@ import ../make-test-python.nix ({ pkgs, lib, ... }: {
       start_all()
 
       server.wait_for_unit("shadowsocks-libev.service")
-      server.wait_for_unit("nginx.service")
       client.wait_for_unit("shadowsocks-client.service")
 
       client.fail(

nixos/tests/virtualbox.nix

@@ -386,7 +386,7 @@ let
     '';
 
     meta = with pkgs.lib.maintainers; {
-      maintainers = [ aszlig ];
+      maintainers = [ aszlig cdepillabout ];
     };
   };
 

pkgs/applications/audio/flacon/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flacon";
-  version = "11.1.0";
+  version = "11.0.0";
 
   src = fetchFromGitHub {
     owner = "flacon";
     repo = "flacon";
     rev = "v${version}";
-    sha256 = "sha256-nAJKTRkx8d53v1tPnu5ARrRoESKh4jUOCcD54bhE8TU=";
+    sha256 = "sha256-xc+pp1phFtcGDCsLzzjWjZBfRJ5ss/F1Nm8/s9sWPfs=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];

pkgs/applications/audio/furnace/default.nix

@@ -10,7 +10,6 @@
 , fftw
 , fmt_8
 , libsndfile
-, libX11
 , rtmidi
 , SDL2
 , zlib
@@ -22,23 +21,16 @@
 
 stdenv.mkDerivation rec {
   pname = "furnace";
-  version = "0.6pre5";
+  version = "0.6pre4-hotfix";
 
   src = fetchFromGitHub {
     owner = "tildearrow";
     repo = "furnace";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-6KiG7nfQUdPW+EkBW3PPM141kOmolAgrrqhEGH/Azg4=";
+    sha256 = "sha256-lJtV/0GnWN5mSjv2LaPEMnkuThaNeijBMjLGFPOJX4k=";
   };
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
-    # To offer scaling detection on X11, furnace checks if libX11.so is available via dlopen and uses some of its functions
-    # But it's being linked against a versioned libX11.so.VERSION via SDL, so the unversioned one is not on the rpath
-    substituteInPlace src/gui/scaling.cpp \
-      --replace 'libX11.so' '${lib.getLib libX11}/lib/libX11.so'
-  '';
-
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -105,7 +97,6 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Multi-system chiptune tracker compatible with DefleMask modules";
     homepage = "https://github.com/tildearrow/furnace";
-    changelog = "https://github.com/tildearrow/furnace/releases/tag/v${version}";
     license = with licenses; [ gpl2Plus ];
     maintainers = with maintainers; [ OPNA2608 ];
     platforms = platforms.all;

pkgs/applications/audio/gtkcord4/default.nix

@@ -18,13 +18,13 @@
 
 buildGoModule rec {
   pname = "gtkcord4";
-  version = "0.0.11";
+  version = "0.0.10";
 
   src = fetchFromGitHub {
     owner = "diamondburned";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-0d656gjfFlgNdKbPJK+6KIU7zvp88j3bGIlGPwJNRdM=";
+    hash = "sha256-WrKZRRJAbEzcCRcFUTa7PxahQ3YADhfWaKlB4uJjVk0=";
   };
 
   nativeBuildInputs = [
@@ -57,7 +57,7 @@ buildGoModule rec {
     install -D -m 444 internal/icons/png/logo.png $out/share/icons/hicolor/256x256/apps/gtkcord4.png
   '';
 
-  vendorHash = "sha256-+zbaRaGOF6w8C7lmtd3k5Rh/0a+OnqTL9Qhg1ErTHBo=";
+  vendorHash = "sha256-8Xnu3WjaaWMRkqmnQCxSc/SD65XFMIY0xamWDx4jZbw=";
 
   meta = with lib; {
     description = "GTK4 Discord client in Go, attempt #4.";

pkgs/applications/audio/musikcube/default.nix

@@ -32,13 +32,13 @@
 
 stdenv.mkDerivation rec {
   pname = "musikcube";
-  version = "3.0.1";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "clangen";
     repo = pname;
     rev = version;
-    hash = "sha512-ahKPmChHRVpOQcgt0fOYumlsMApeN4MWwywE9F0edeN0Xr3Vp830mWGzEBJvMvGI/lnU/1rd7tREaHfm1vCJaw==";
+    hash = "sha512-W+Zug1SiOGJ+o6FBf2jeDGHFj87vudR4drtjyXiOzdoM8fUCnCj4pp7+70eZGilg6CvBi7CYkbVn53LXJf5qWA==";
   };
 
   outputs = [ "out" "dev" ];

pkgs/applications/audio/noson/default.nix

@@ -1,51 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, cmake
-, flac
-, libpulseaudio
-, qtbase
-, qtgraphicaleffects
-, qtquickcontrols2
-, wrapQtAppsHook
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "noson";
-  version = "5.4.1";
-
-  src = fetchFromGitHub {
-    owner = "janbar";
-    repo = "noson-app";
-    rev = finalAttrs.version;
-    hash = "sha256-7RrBfkUCRVzUGl+OT3OuoMlu4D3Sa7RpBefFgmfX1Fs=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    flac
-    libpulseaudio
-    qtbase
-    qtgraphicaleffects
-    qtquickcontrols2
-  ];
-
-  # wrapQtAppsHook doesn't automatically find noson-gui
-  dontWrapQtApps = true;
-  preFixup = ''
-    wrapQtApp "$out/lib/noson/noson-gui"
-  '';
-
-  meta = with lib; {
-    description = "SONOS controller for Linux (and macOS)";
-    homepage = "https://janbar.github.io/noson-app/";
-    mainProgram = "noson-app";
-    platforms = platforms.linux ++ platforms.darwin;
-    license = [ licenses.gpl3Only ];
-    maintainers = with maintainers; [ callahad ];
-  };
-})

pkgs/applications/audio/picard/default.nix

@@ -1,6 +1,7 @@
 { lib
 , python3Packages
 , fetchFromGitHub
+, fetchpatch
 , gettext
 , chromaprint
 , qt5
@@ -27,22 +28,16 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "sha256-ukqlAXGaqX89U77cM9Ux0RYquT31Ho8ri1Ue7S3+MwQ=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = [ gettext qt5.wrapQtAppsHook qt5.qtbase ]
-    gettext
+  ++ lib.optionals (pyqt5.multimediaEnabled) [
-    qt5.wrapQtAppsHook
+    qt5.qtmultimedia.bin
-  ] ++ lib.optionals (pyqt5.multimediaEnabled) [
     gst_all_1.gst-libav
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
     gst_all_1.gst-vaapi
     gst_all_1.gstreamer
-  ];
+  ]
-  buildInputs = [
+  ;
-    qt5.qtbase
-    qt5.qtwayland
-  ] ++ lib.optionals (pyqt5.multimediaEnabled) [
-    qt5.qtmultimedia.bin
-  ];
 
   propagatedBuildInputs = with pythonPackages; [
     chromaprint

pkgs/applications/audio/qmidiarp/default.nix

@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qmidiarp";
-  version = "0.7.0";
+  version = "0.6.7";
 
   src = fetchgit {
     url = "https://git.code.sf.net/p/qmidiarp/code";
-    sha256 = "sha256-oUdgff2xsXTis+C2Blv0tspWNIMGSODrKxWDpMDYnEU=";
+    sha256 = "sha256-CxElnyREXLR086xYxCQTHZumrLP52CDYvv+ougKqJz0=";
     rev = "qmidiarp-${version}";
   };
 

pkgs/applications/audio/reaper/default.nix

@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "reaper";
-  version = "6.80";
+  version = "6.79";
 
   src = fetchurl {
     url = url_for_platform version stdenv.hostPlatform.qemuArch;
     hash = {
-      x86_64-linux = "sha256-By97OxGC9YO7yEHzSjDAZHCtVaub1wNwWMOn4F+Qzpg=";
+      x86_64-linux = "sha256-Bpsc09y5R/zyVXiDAqRF6n09qKOrBTLjk84z+noeko0=";
-      aarch64-linux = "sha256-11DiFfqULIi4tespho+yOH+Qy4s+lithCt19kb4RfhI=";
+      aarch64-linux = "sha256-jbyXXeVtFmt7xoIWd4YKFu4AUM6W9LzeIiGoGyaO2lU=";
     }.${stdenv.hostPlatform.system};
   };
 

pkgs/applications/audio/spotify-player/default.nix

@@ -7,21 +7,20 @@
 , alsa-lib
 , dbus
 , fontconfig
-, libsixel
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-player";
-  version = "0.14.1";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "aome510";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-+YPtu3hsKvk2KskVSpqcFufnWL5PxN8+xbkcz/JXW6g=";
+    hash = "sha256-c+CbIDg4WlzRStiA+yBkjfSmMJ183tLBGiK340bZgnA=";
   };
 
-  cargoHash = "sha256-WgQ+v9dJyriqq7+WpXpPhjdwm2Sr0jozA1oW2inSPik=";
+  cargoHash = "sha256-nhRXFxSrzkq3SdJ4ZmWlKl7SwxwOz6ZYboIsBmgdFJ8=";
 
   nativeBuildInputs = [
     pkg-config
@@ -33,7 +32,6 @@ rustPlatform.buildRustPackage rec {
     alsa-lib
     dbus
     fontconfig
-    libsixel
   ];
 
   buildNoDefaultFeatures = true;
@@ -43,10 +41,6 @@ rustPlatform.buildRustPackage rec {
     "media-control"
     "image"
     "lyric-finder"
-    "daemon"
-    "notify"
-    "streaming"
-    "sixel"
   ];
 
   meta = with lib; {

pkgs/applications/audio/subtitlr/default.nix

@@ -1,35 +0,0 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
-
-buildGoModule rec {
-  pname = "Subtitlr";
-  version = "0.1.0";
-
-  src = fetchFromGitHub {
-    owner = "yoanbernabeu";
-    repo = pname;
-    rev = version;
-    hash = "sha256-fwDIE8DFVd7NRhi8bBmFxrmGdT2ZtSFWBaynV+xz3ms=";
-  };
-
-  vendorHash = "sha256-t92nz42sv8bE0JIkSFB2+WBz1Um8kcRSotpXcPIy3eQ=";
-
-  ldflags = [ "-s" "-w" ];
-
-  nativeBuildInputs = [
-    installShellFiles
-  ];
-
-  postInstall = ''
-    installShellCompletion --cmd Subtitlr \
-      --bash <($out/bin/Subtitlr completion bash) \
-      --fish <($out/bin/Subtitlr completion fish) \
-      --zsh <($out/bin/Subtitlr completion zsh)
-  '';
-
-  meta = with lib; {
-    description = "This application, a subtitle generator for YouTube, utilizes OpenAI's Whisper API.";
-    homepage = "https://github.com/yoanbernabeu/Subtitlr/";
-    license = licenses.mit;
-    maintainers = with maintainers; [ qjoly ];
-  };
-}

pkgs/applications/backup/urbackup-client/default.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "urbackup-client";
-  version = "2.5.24";
+  version = "2.5.20";
 
   src = fetchzip {
     url = "https://hndl.urbackup.org/Client/${version}/urbackup-client-${version}.tar.gz";
-    sha256 = "sha256-n0/NVClZz6ANgEdPCtdZxsEvllIl32vwDjC2nq5R8Z4=";
+    sha256 = "sha256-i1g3xUhspqQRfIUhy6STOWNuncK3tMFocJw652r1X9g=";
   };
 
   buildInputs = [

pkgs/applications/blockchains/besu/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "besu";
-  version = "23.4.0";
+  version = "23.1.2";
 
   src = fetchurl {
     url = "https://hyperledger.jfrog.io/artifactory/${pname}-binaries/${pname}/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ghaVsyVcn2RvTVJ+N0IZyWQW9JgjFSDy7sK+vtxT9aA=";
+    sha256 = "sha256-PTpwmjqrmToIAbQSpHGddOMZ+ULdwT+w8ws8SlTRJTg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/blockchains/btcpayserver/default.nix

@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "btcpayserver";
-  version = "1.10.0";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-UJvpEWR49m1B21eMrh0LiJ2bguM7hNux0ywDj6oJbDU=";
+    sha256 = "sha256-XcpPdlDpY/RXOK8ykZ/UUVOok2Pz3vObdp4zhy9tt7w=";
   };
 
   projectFile = "BTCPayServer/BTCPayServer.csproj";

pkgs/applications/blockchains/btcpayserver/deps.nix

@@ -8,14 +8,14 @@
   (fetchNuGet { pname = "AWSSDK.S3"; version = "3.3.110.10"; sha256 = "1lf1hfbx792dpa1hxgn0a0jrrvldd16hgbxx229dk2qcz5qlnc38"; })
   (fetchNuGet { pname = "BIP78.Sender"; version = "0.2.2"; sha256 = "12pm2s35c0qzc06099q2z1pxwq94rq85n74yz8fs8gwvm2ksgp4p"; })
   (fetchNuGet { pname = "BTCPayServer.Hwi"; version = "2.0.2"; sha256 = "0lh3n1qncqs4kbrmx65xs271f0d9c7irrs9qnsa9q51cbbqbljh9"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.All"; version = "1.4.26"; sha256 = "1mssifz3jhvk3cqpb3kiqzlsyirlxzj90mlkigdnqqxfk7fyv6wv"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.All"; version = "1.4.23"; sha256 = "11nb7ba93g51n5f5aa6sd6s3f9x82g1vbi8rcj04x5anbh2g451n"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Charge"; version = "1.3.20"; sha256 = "0nk82hkgs67mxfxkgbav8yxxd79m0xyqaan7vay00gg33pjqdjvj"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.CLightning"; version = "1.3.27"; sha256 = "14bgi3p31v8ypf1lqnc5xkpzfd2cj5a23v2wv1m38jl6ng2v6vqp"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.CLightning"; version = "1.3.26"; sha256 = "0sbcl1jdpjgjpa4cagcrppk124nkk2hxsvlj8nr6zf3fcdwllagj"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.3.16"; sha256 = "1g37736b4k0ncpyy2qycbk4l85fqvgwac3k98nbdj0dvhfghp1dn"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.3.21"; sha256 = "042xwfsxd30zgwiz0w14ynb755w5sldkplxgw1fkw68lrz66x5s4"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Eclair"; version = "1.3.20"; sha256 = "093w82mcxxxbvx66j0sp3lsfm2bkbi3igm80iz9zdghy85845kc9"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.LNBank"; version = "1.3.26"; sha256 = "1kfl88psjbsh88l98kc6dyxqjghnzyffi070v2ifkdjcdgdbawfs"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.LNBank"; version = "1.3.24"; sha256 = "0dah7q90x29rqhngxd9226pfn1k4bbhhfgnkpjpw64529m29cdks"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.LND"; version = "1.4.16"; sha256 = "1m3nb23f6c6ms2mm07sii4hkrv7illzfg32cjy2j3h6myynw1ik5"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.LND"; version = "1.4.15"; sha256 = "18qnpdxbz359ygygllsrf95fbalsfyjrf6j9wi7c8qd39jwcignx"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.LNDhub"; version = "1.0.19"; sha256 = "164c5nmsqzgz9v6fw0ml0d9m5hcp449468giakv3cihq25cd6giz"; })
   (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins"; version = "1.4.4"; sha256 = "0rk0prmb0539ji5fd33cqy3yvw51i5i8m5hb43admr5z8960dd6l"; })
   (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins.Mvc"; version = "1.4.4"; sha256 = "1kmmj5m7s41wc1akpqw1b1j7pp4c0vn6sqxb487980ibpj6hyisl"; })
@@ -158,10 +158,9 @@
   (fetchNuGet { pname = "NBitcoin"; version = "6.0.8"; sha256 = "1f90zyrd35fzx0vgvd83jhd6hczd4037h2k198xiyxj04l4m3wm5"; })
   (fetchNuGet { pname = "NBitcoin"; version = "7.0.1"; sha256 = "05kqpjyp3ckb2183g9vfsdv362y5xg5j21p36zls0x3b0jgrwxw7"; })
   (fetchNuGet { pname = "NBitcoin"; version = "7.0.24"; sha256 = "0yc6cgwp2xr2dzjsrkawyh43whixv66nvvq6rh1pi6gi14iaqmfa"; })
-  (fetchNuGet { pname = "NBitcoin"; version = "7.0.26"; sha256 = "0m50dmx7hhbxxgwpl9cxrbihpg9l10pga58b41vb0fima2y137zs"; })
+  (fetchNuGet { pname = "NBitcoin.Altcoins"; version = "3.0.18"; sha256 = "054i15qan5154iy8m13jmhnz1w5rs208i1xhlfnivwiq2v1c2qby"; })
-  (fetchNuGet { pname = "NBitcoin.Altcoins"; version = "3.0.19"; sha256 = "16bv3314flq6ildsjzxzw4ih2wbryvkjpkcwkvf2lh2smqhnvr11"; })
   (fetchNuGet { pname = "NBitpayClient"; version = "1.0.0.39"; sha256 = "1sgwradg7jnb4n3chwqfkximj1qhgl3r23p0sifmaa0kql2hlira"; })
-  (fetchNuGet { pname = "NBXplorer.Client"; version = "4.2.5"; sha256 = "0kycvnxgqrkxig8k6mp1897sqbq2xarc8429vnjh79644nakdas4"; })
+  (fetchNuGet { pname = "NBXplorer.Client"; version = "4.2.3"; sha256 = "0lf5qsf5yr5m1fx826mn47l237x5y2wkimv6klc3rvwwc7f10dmm"; })
   (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; sha256 = "1z70wvsx2d847a2cjfii7b83pjfs34q05gb037fdjikv5kbagml8"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; sha256 = "0fijg0w6iwap8gvzyjnndds0q4b8anwxxvik7y8vgq97dram4srb"; })
   (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.1"; sha256 = "1r1hvj5gjl466bya2bfl5aaj8rbwyf5x1msg710wf3k2llbci1xa"; })

pkgs/applications/blockchains/exodus/default.nix

@@ -4,11 +4,11 @@ cups, vivaldi-ffmpeg-codecs, libpulseaudio, at-spi2-core, libxkbcommon, mesa }:
 
 stdenv.mkDerivation rec {
   pname = "exodus";
-  version = "23.5.22";
+  version = "23.5.8";
 
   src = fetchzip {
     url = "https://downloads.exodus.com/releases/${pname}-linux-x64-${version}.zip";
-    sha256 = "sha256-CZuT0nlKyF7LRGqNezm98MHcQa2Uhd8y+NiKE5mi0jk=";
+    sha256 = "sha256-3mABHkxEMS985NqQBZ7HijtTiun1iSXFJmi0qOh3m7g=";
   };
 
   installPhase = ''

pkgs/applications/blockchains/ledger-live-desktop/default.nix

@@ -2,11 +2,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.60.0";
+  version = "2.58.0";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-dR6F6elUxZW3EuH71d5P9SOSDq5f5lAsYnrfWrsj2KA=";
+    hash = "sha256-y9D+RKAB/woYmnu8X0armsVaxu0CWbqZpRiEFcN7rYM=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/applications/blockchains/lightning-loop/default.nix

@@ -5,21 +5,19 @@
 
 buildGoModule rec {
   pname = "lightning-loop";
-  version = "0.24.1-beta";
+  version = "0.23.0-beta";
 
   src = fetchFromGitHub {
     owner = "lightninglabs";
     repo = "loop";
     rev = "v${version}";
-    hash = "sha256-gPWiKSwXS1eSuHss+hkiqqxqonGYSGmSh3/jL+NlqEg=";
+    sha256 = "sha256-nYDu451BS5gV4pbV9Pp+S7oKsLGzgVu1a9Df7651e4c=";
   };
 
-  vendorHash = "sha256-6bRg6is1g/eRCr82tHMXTWVFv2S0d2h/J3w1gpentjo=";
+  vendorSha256 = "sha256-6bRg6is1g/eRCr82tHMXTWVFv2S0d2h/J3w1gpentjo=";
 
   subPackages = [ "cmd/loop" "cmd/loopd" ];
 
-  ldflags = [ "-s" "-w" ];
-
   meta = with lib; {
     description = "Lightning Loop Client";
     homepage = "https://github.com/lightninglabs/loop";

pkgs/applications/blockchains/nbxplorer/default.nix

@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "nbxplorer";
-  version = "2.3.65";
+  version = "2.3.63";
 
   src = fetchFromGitHub {
     owner = "dgarage";
     repo = "NBXplorer";
     rev = "v${version}";
-    sha256 = "sha256-7m9gf+enOtE5VWuBNLFf11ofLGBRAYWvmkrekUVQQaQ=";
+    sha256 = "sha256-K3dlXwzKNzwJstp1DW5T5s5Gs0ebPNWXtzqr3rw5294=";
   };
 
   projectFile = "NBXplorer/NBXplorer.csproj";

pkgs/applications/editors/android-studio/default.nix

@@ -10,8 +10,8 @@ let
     inherit tiling_wm;
   };
   stableVersion = {
-    version = "2022.2.1.20"; # "Android Studio Flamingo (2022.2.1) Patch 2"
+    version = "2022.2.1.19"; # "Android Studio Flamingo (2022.2.1) Patch 1"
-    sha256Hash = "sha256-X+ZuH4cHKfQtfvOF0kLk+QjQ5AR3pTEparczHEUk+uY=";
+    sha256Hash = "sha256-bAtPlJI3RwqQX6xpEi7S8T2IDc/39MONU3iFpfi8v3A=";
   };
   betaVersion = {
     version = "2022.3.1.12"; # "Android Studio Giraffe (2022.3.1) Beta 1"

pkgs/applications/editors/emacs/28.nix

@@ -0,0 +1,4 @@
+import ./generic.nix (rec {
+  version = "28.2";
+  sha256 = "sha256-4oSLcUDR0MOEt53QOiZSVU8kPJ67GwugmBxdX3F15Ag=";
+})

pkgs/applications/editors/emacs/default.nix

@@ -1,65 +0,0 @@
-{ lib, pkgs }:
-
-lib.makeScope pkgs.newScope (self:
-  let
-    gconf = pkgs.gnome2.GConf;
-    inherit (self) callPackage;
-  in {
-    sources = import ./sources.nix {
-      inherit lib;
-      inherit (pkgs)
-        fetchFromBitbucket
-        fetchFromSavannah;
-    };
-
-    emacs28 = callPackage (self.sources.emacs28) {
-      inherit gconf;
-
-      inherit (pkgs.darwin) sigtool;
-      inherit (pkgs.darwin.apple_sdk.frameworks)
-        AppKit Carbon Cocoa GSS ImageCaptureCore ImageIO IOKit OSAKit Quartz
-        QuartzCore WebKit;
-    };
-
-    emacs28-gtk2 = self.emacs28.override {
-      withGTK2 = true;
-    };
-
-    emacs28-gtk3 = self.emacs28.override {
-      withGTK3 = true;
-    };
-
-    emacs28-nox = pkgs.lowPrio (self.emacs28.override {
-      noGui = true;
-    });
-
-    emacs29 = callPackage (self.sources.emacs29) {
-      inherit gconf;
-
-      inherit (pkgs.darwin) sigtool;
-      inherit (pkgs.darwin.apple_sdk.frameworks)
-        AppKit Carbon Cocoa GSS ImageCaptureCore ImageIO IOKit OSAKit Quartz
-        QuartzCore WebKit;
-    };
-
-    emacs29-gtk3 = self.emacs29.override {
-      withGTK3 = true;
-    };
-
-    emacs29-nox = self.emacs29.override {
-      noGui = true;
-    };
-
-    emacs29-pgtk = self.emacs29.override {
-      withPgtk = true;
-    };
-
-    emacs-macport = callPackage (self.sources.emacs-macport) {
-      inherit gconf;
-
-      inherit (pkgs.darwin) sigtool;
-      inherit (pkgs.darwin.apple_sdk.frameworks)
-        AppKit Carbon Cocoa GSS ImageCaptureCore ImageIO IOKit OSAKit Quartz
-        QuartzCore WebKit;
-    };
-  })

pkgs/applications/editors/emacs/elisp-packages/manual-packages/acm-terminal/default.nix

@@ -8,17 +8,17 @@
 }:
 
 let
-  rev = "0dbbd7f401da1bedd1a9146df6127233d601435b";
+  rev = "321e05fc0398a6159925b858f46608ea07ef269e";
 in
 melpaBuild {
   pname = "acm-terminal";
-  version = "20230601.1326"; # 13:26 UTC
+  version = "20230215.414"; # 4:14 UTC
 
   src = fetchFromGitHub {
     owner = "twlz0ne";
     repo = "acm-terminal";
     inherit rev;
-    sha256 = "sha256-Opouy9A6z0YUT1zxZq1yHx+r/hwNE93JDwfa1fMWNgc=";
+    sha256 = "sha256-Flw07EwH9z0E3tqXs4mStICJmoHfp60ALrP1GmUmeuU=";
   };
 
   commit = rev;

pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix

@@ -16,7 +16,7 @@
 }:
 
 let
-  rev = "8de85f9967fec6a8e447e5b5f3021e5e1f95b445";
+  rev = "7e1e6a4c349e720d75c892cd7230b29c35148342";
   python = python3.withPackages (ps: with ps; [
     epc
     orjson
@@ -26,13 +26,13 @@ let
 in
 melpaBuild {
   pname = "lsp-bridge";
-  version = "20230603.345"; # 3:45 UTC
+  version = "20230424.1642"; # 16:42 UTC
 
   src = fetchFromGitHub {
     owner = "manateelazycat";
     repo = "lsp-bridge";
     inherit rev;
-    sha256 = "sha256-08DFgZaYdlz9f9eqZuG760vpmO3D4QN9V66YqVyVsV4=";
+    sha256 = "sha256-e0XVQpsyjy8HeZN6kLRjnoTpyEefTqstsgydEKlEQ1c=";
   };
 
   commit = rev;

pkgs/applications/editors/emacs/elisp-packages/manual-packages/mind-wave/default.nix

@@ -47,14 +47,14 @@
 # ];
 melpaBuild rec {
   pname = "mind-wave";
-  version = "20230523.0332"; # 03:32 UTC
+  version = "20230322.1348"; # 13:48 UTC
   src = pkgs.fetchFromGitHub {
     owner = "manateelazycat";
     repo = "mind-wave";
-    rev = "5109162b74872091c5090a28389bef8f7020274c";
+    rev = "2d94f553a394ce73bcb91490b81e0fc042baa8d3";
-    sha256 = "sha256-ZyXrpb0GLWSGnMsVIGL9qALSBCeIWNF0UwkCFgCKnu8=";
+    sha256 = "sha256-6tmcPYAEch5bX5hEHMiQGDNYEMUOvnxF1Vq0VVpBsYo=";
   };
-  commit = "5109162b74872091c5090a28389bef8f7020274c";
+  commit = "2d94f553a394ce73bcb91490b81e0fc042baa8d3";
   # elisp dependencies
   packageRequires = [
     pkgs.emacsPackages.markdown-mode