litestar: 2.21.1 -> 2.23.0 (#526578)

Diff: https://github.com/InfluxCommunity/influxdb3-python/compare/v0.19.0...v0.20.0

Changelog: https://github.com/InfluxCommunity/influxdb3-python/releases/tag/v0.20.0

.github/workflows/teams.yml

@@ -2,7 +2,7 @@ name: Teams
 
 on:
   schedule:
-    # Every Tuesday at 19:42 (randomly chosen)
+    # Every Monday at 19:42 (randomly chosen)
     - cron: '42 19 * * 1'
   workflow_dispatch:
 

.mailmap

@@ -17,6 +17,7 @@ jopejoe1 <nixpkgs@missing.ninja> <34899572+jopejoe1@users.noreply.github.com>
 jopejoe1 <nixpkgs@missing.ninja> <jopejoe1@missing.ninja>
 jopejoe1 <nixpkgs@missing.ninja> <jopejoe1>
 Jörg Thalheim <joerg@thalheim.io> <Mic92@users.noreply.github.com>
+Katalin Rebhan <me@dblsaiko.net>
 Lin Jian <me@linj.tech> <linj.dev@outlook.com>
 Lin Jian <me@linj.tech> <75130626+jian-lin@users.noreply.github.com>
 Martin Weinelt <hexa@darmstadt.ccc.de> <mweinelt@users.noreply.github.com>

README.md

@@ -1,9 +1,9 @@
 <p align="center">
   <a href="https://nixos.org">
     <picture>
-      <source media="(prefers-color-scheme: light)" srcset="https://brand.nixos.org/logos/nixos-logo-default-gradient-black-regular-horizontal-minimal.svg">
-      <source media="(prefers-color-scheme: dark)" srcset="https://brand.nixos.org/logos/nixos-logo-default-gradient-white-regular-horizontal-minimal.svg">
-      <img src="https://brand.nixos.org/logos/nixos-logo-default-gradient-black-regular-horizontal-minimal.svg" width="500px" alt="NixOS logo">
+      <source media="(prefers-color-scheme: light)" srcset="https://brand.nixos.org/logos/nixos-logo-rainbow-gradient-black-regular-horizontal-minimal.svg">
+      <source media="(prefers-color-scheme: dark)" srcset="https://brand.nixos.org/logos/nixos-logo-rainbow-gradient-white-regular-horizontal-minimal.svg">
+      <img src="https://brand.nixos.org/logos/nixos-logo-rainbow-gradient-black-regular-horizontal-minimal.svg" width="500px" alt="NixOS logo">
     </picture>
   </a>
 </p>

ci/OWNERS

@@ -402,18 +402,15 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/tests/docker-tools*                       @roberth @jhol
 /doc/build-helpers/images/dockertools.section.md @roberth @jhol
 
-# Blockchains
-/pkgs/applications/blockchains  @mmahut @RaghavSood
-
 # Go
 /doc/languages-frameworks/go.section.md @kalbasit @katexochen @Mic92
 /pkgs/build-support/go @kalbasit @katexochen @Mic92
 /pkgs/development/compilers/go @kalbasit @katexochen @Mic92
 
 # GNOME
-/pkgs/desktops/gnome                              @jtojnar
-/pkgs/desktops/gnome/extensions                   @jtojnar
-/pkgs/build-support/make-hardcode-gsettings-patch @jtojnar
+/pkgs/desktops/gnome                              @NixOS/gnome
+/pkgs/desktops/gnome/extensions                   @NixOS/gnome
+/pkgs/build-support/make-hardcode-gsettings-patch @NixOS/gnome
 
 # Cinnamon
 /pkgs/by-name/ci/cinnamon-*    @mkg20001

ci/eval/compare/default.nix

@@ -238,34 +238,33 @@ runCommand "compare"
       jq -r -f ${./generate-step-summary.jq} < ${changed-paths}
     } >> $out/step-summary.md
 
-    if jq -e '(.attrdiff.added | length == 0) and (.attrdiff.removed | length == 0)' "${changed-paths}" > /dev/null; then
-      # Chunks have changed between revisions
-      # We cannot generate a performance comparison
-      {
-        echo
-        echo "# Performance comparison"
-        echo
-        echo "This compares the performance of this branch against its pull request base branch (e.g., 'master')"
-        echo
-        echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
-        echo
-      } >> $out/step-summary.md
+    {
+      echo
+      echo "# Performance comparison"
+      echo
+      echo "This compares the performance of this branch against its pull request base branch (e.g., 'master')"
+      echo
+    } >> $out/step-summary.md
 
-      cmp-stats --explain ${combined}/before/stats ${combined}/after/stats >> $out/step-summary.md
-
-    else
-      # Package chunks are the same in both revisions
-      # We can use the to generate a performance comparison
+    # cmp-stats only compares the stats chunks present in both revisions, so the
+    # comparison is still produced when packages were added/removed. The paired
+    # chunks may cover different attrs in that case, so caveat the figures.
+    if ! jq -e '(.attrdiff.added | length == 0) and (.attrdiff.removed | length == 0)' "${changed-paths}" > /dev/null; then
       {
+        echo "> [!NOTE]"
+        echo "> The package sets differ between the two revisions. This comparison only"
+        echo "> covers packages evaluated in both, so treat the figures as approximate."
         echo
-        echo "# Performance Comparison"
-        echo
-        echo "Performance stats were skipped because the package sets differ between the two revisions."
-        echo
-        echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
       } >> $out/step-summary.md
     fi
 
+    {
+      echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
+      echo
+    } >> $out/step-summary.md
+
+    cmp-stats --explain ${combined}/before/stats ${combined}/after/stats >> $out/step-summary.md
+
     jq -r '.[]' "${touchedFilesJson}" > ./touched-files
     readarray -t touchedFiles < ./touched-files
     echo "This PR touches ''${#touchedFiles[@]} files"

ci/github-script/merge.js

@@ -97,7 +97,7 @@ function hasMergeCommand(body) {
   return (body ?? '')
     .replace(/<!--.*?-->/gms, '')
     .replace(/(^`{3,})[^`].*?\1/gms, '')
-    .match(/^@NixOS\/nixpkgs-merge-bot merge\s*$/m)
+    .match(/^@NixOS\/nixpkgs-merge-bot merge\s*$/im)
 }
 
 async function handleMergeComment({ github, body, node_id, reaction }) {

ci/pinned.json

@@ -9,9 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "02f3fa0374fa13707d42d55d58ecc76b091f223c",
-      "url": "https://github.com/NixOS/nixpkgs/archive/02f3fa0374fa13707d42d55d58ecc76b091f223c.tar.gz",
-      "hash": "0z8d33c5g0gk9a74ppqq77npisf9xx9c8ai9isxa2hyjx4lv1pki"
+      "revision": "cbb5cf358f50aa6acc9efd6113b7bcfbc352cd73",
+      "url": "https://github.com/NixOS/nixpkgs/archive/cbb5cf358f50aa6acc9efd6113b7bcfbc352cd73.tar.gz",
+      "hash": "sha256-IX7G1dlKrOqPOImfbo7ADDfV5yU1+j+MRChI3TL4tAA="
     },
     "treefmt-nix": {
       "type": "Git",
@@ -22,10 +22,10 @@
       },
       "branch": "main",
       "submodules": false,
-      "revision": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
-      "url": "https://github.com/numtide/treefmt-nix/archive/790751ff7fd3801feeaf96d7dc416a8d581265ba.tar.gz",
-      "hash": "1zah3dmbpn3ap5acg22kq1j19dg32gj73l43yamjcxhc38sv9kd5"
+      "revision": "db947814a175b7ca6ded66e21383d938df01c227",
+      "url": "https://github.com/numtide/treefmt-nix/archive/db947814a175b7ca6ded66e21383d938df01c227.tar.gz",
+      "hash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM="
     }
   },
-  "version": 5
+  "version": 8
 }

ci/update-pinned.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p npins
+#!nix-shell -i bash -p npins -I nixpkgs=../
 
 set -euo pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
+npins --lock-file pinned.json upgrade
 npins --lock-file pinned.json update

doc/build-helpers/testers.chapter.md

@@ -98,6 +98,14 @@ It has two modes:
 
 : The path to the files to check.
 
+`relocatable` (boolean, optional) {#tester-lycheeLinkCheck-param-relocatable}
+
+: Whether the site is expected to be relocatable, i.e. servable from any URL path prefix.
+
+  When `true` (the default), root-relative links (starting with `/`) are treated as errors, because they break when the site is served from a subpath or opened via `file://` URLs.
+
+  When `false`, root-relative links are resolved against the `site` directory.
+
 `remap` (attribute set, optional) {#tester-lycheeLinkCheck-param-remap}
 
 : An attribute set where the attribute names are regular expressions.

doc/release-notes/rl-2611.section.md

@@ -19,6 +19,13 @@
 
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
 
+- Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:
+  - `linux-kernel.name` has been removed.
+  - `linux-kernel.target` is available as the `target` parameter and passthru attribute on the kernel builders.
+  - `linux-kernel.installTarget` has been removed, as it should not be necessary to customize.
+  - `linux-kernel.DTB` is available as the `buildDTBs` parameter and passthru attribute on the kernel builders.
+  - `linux-kernel.{autoModules,preferBuiltin,extraConfig}` were already available as kernel builder parameters.
+
 - The ARMv5 Linux kernel build now uses a standard configuration and generates a standard compressed image instead of the deprecated legacy U‐Boot image format.
   `lib.systems.{examples,platforms}.{sheevaplug,pogoplug4}` have been unified into `lib.systems.examples.armv5tel-multiplatform`.
   Note that there is no official support for ARMv5 and it is not possible to build even a simple NixOS configuration out of the box.

doc/stdenv/meta.chapter.md

@@ -77,7 +77,7 @@ A link or a list of links to the location of Changelog for a package. A link may
 
 ### `license` {#var-meta-license}
 
-The license, or licenses, for the package. One from the attribute set defined in [`nixpkgs/lib/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses.nix). At this moment using both a list of licenses and a single license is valid. If the license field is in the form of a list representation, then it means that parts of the package are licensed differently. Each license should preferably be referenced by their attribute. The non-list attribute value can also be a space delimited string representation of the contained attribute `shortNames` or `spdxIds`. The following are all valid examples:
+The license, or licenses, for the package. One from the attribute set defined in [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix). At this moment using both a list of licenses and a single license is valid. If the license field is in the form of a list representation, then it means that parts of the package are licensed differently. Each license should preferably be referenced by their attribute. The non-list attribute value can also be a space delimited string representation of the contained attribute `shortNames` or `spdxIds`. The following are all valid examples:
 
 - Single license referenced by attribute (preferred) `lib.licenses.gpl3Only`.
 - Single license referenced by its attribute shortName (frowned upon) `"gpl3Only"`.
@@ -216,7 +216,7 @@ If this list is not empty, the package is marked as "insecure", meaning that it
 
 ## Licenses {#sec-meta-license}
 
-The `meta.license` attribute should preferably contain a value from `lib.licenses` defined in [`nixpkgs/lib/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses.nix), or in-place license description of the same format if the license is unlikely to be useful in another expression.
+The `meta.license` attribute should preferably contain a value from `lib.licenses` defined in [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix), or in-place license description of the same format if the license is unlikely to be useful in another expression.
 
 Although it’s typically better to indicate the specific license, a few generic options are available:
 

doc/using/configuration.chapter.md

@@ -152,7 +152,7 @@ There are several ways to tweak how Nix handles a package which has been marked
 
     Note that `allowlistedLicenses` only applies to unfree licenses unless `allowUnfree` is enabled. It is not a generic allowlist for all types of licenses. `blocklistedLicenses` applies to all licenses.
 
-A complete list of licenses can be found in the file `lib/licenses.nix` of the nixpkgs tree.
+A complete list of licenses can be found in the file [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix) of the nixpkgs tree.
 
 ## Installing insecure packages {#sec-allow-insecure}
 

lib/attrsets.nix

@@ -1612,13 +1612,15 @@ rec {
       binaryMerge =
         start: end:
         # assert start < end; # Invariant
-        if end - start >= 2 then
-          # If there's at least 2 elements, split the range in two, recurse on each part and merge the result
-          # The invariant is satisfied because each half will have at least 1 element
-          binaryMerge start (start + (end - start) / 2) // binaryMerge (start + (end - start) / 2) end
+        if end - start == 1 then
+          # Base case - there will be exactly 1 element due to the invariant, in
+          # which case we just return it directly
+          elemAt list start
         else
-          # Otherwise there will be exactly 1 element due to the invariant, in which case we just return it directly
-          elemAt list start;
+          # If there's at least 2 elements, split the range in two, recurse on each part and merge the result
+          # Relies on floor for odd results
+          # The invariant is satisfied because each half will have at least 1 element
+          binaryMerge start ((start + end) / 2) // binaryMerge ((start + end) / 2) end;
     in
     if list == [ ] then
       # Calling binaryMerge as below would not satisfy its invariant

lib/modules.nix

@@ -1018,38 +1018,16 @@ let
           mergedType = t.typeMerge t'.functor;
           typesMergeable = mergedType != null;
 
-          # TODO: Remove this when all downstream reliances of internals: 'functor.wrapped' are sufficiently migrated.
-          # A function that adds the deprecated wrapped message to a type.
-          addDeprecatedWrapped =
-            t:
-            t
-            // {
-              functor = t.functor // {
-                wrapped = t.functor.wrappedDeprecationMessage {
-                  inherit loc;
-                };
-              };
-            };
-
           typeSet =
-            if opt.options ? type then
-              if res ? type then
-                if typesMergeable then
-                  {
-                    type =
-                      if mergedType ? functor.wrappedDeprecationMessage then
-                        addDeprecatedWrapped mergedType
-                      else
-                        mergedType;
-                  }
-                else
-                  # Keep in sync with the same error below!
-                  throw
-                    "The option `${showOption loc}' in `${opt._file}' is already declared in ${showFiles res.declarations}."
-              else if opt.options.type ? functor.wrappedDeprecationMessage then
-                { type = addDeprecatedWrapped opt.options.type; }
+            if opt.options ? type && res ? type then
+              if typesMergeable then
+                {
+                  type = mergedType;
+                }
               else
-                { }
+                # Keep in sync with the same error below!
+                throw
+                  "The option `${showOption loc}' in `${opt._file}' is already declared in ${showFiles res.declarations}."
             else
               { };
 

lib/sources.nix

@@ -43,7 +43,7 @@ let
   cleanSourceFilter =
     name: type:
     let
-      baseName = baseNameOf (toString name);
+      baseName = baseNameOf name;
     in
     !(
       # Filter out version control software files/directories
@@ -270,7 +270,7 @@ let
       filter =
         name: type:
         let
-          base = baseNameOf (toString name);
+          base = baseNameOf name;
         in
         type == "directory" || lib.any (ext: lib.hasSuffix ext base) exts;
     in

lib/systems/default.nix

@@ -299,12 +299,10 @@ let
         inherit
           (
             {
-              linux-kernel = args.linux-kernel or { };
               gcc = args.gcc or { };
             }
             // platforms.select final
           )
-          linux-kernel
           gcc
           ;
 
@@ -692,6 +690,11 @@ let
         };
       };
     in
+    # TODO: Remove in 27.05.
+    assert
+      args ? linux-kernel
+      -> throw "lib.systems.elaborate: linux-kernel has been removed; see the 26.11 release notes";
+
     assert final.useAndroidPrebuilt -> final.isAndroid;
     assert foldl' (pass: { assertion, message }: if assertion final then pass else throw message) true (
       final.parsed.abi.assertions or [ ]

lib/systems/platforms.nix

@@ -3,74 +3,21 @@
 # targetPlatform, etc) containing at least the minimal set of attrs
 # required (see types.parsedPlatform in lib/systems/parse.nix).  This
 # file takes an already-valid platform and further elaborates it with
-# optional fields; currently these are: linux-kernel, gcc, and rustc.
+# optional fields; currently these are: gcc, and rustc.
 
 { lib }:
 rec {
-  pc = {
-    linux-kernel = {
-      name = "pc";
-
-      baseConfig = "defconfig";
-      # Build whatever possible as a module, if not stated in the extra config.
-      autoModules = true;
-      target = "bzImage";
-    };
-  };
-
-  ##
-  ## POWER
-  ##
-
-  powernv = {
-    linux-kernel = {
-      name = "PowerNV";
-
-      baseConfig = "powernv_defconfig";
-      target = "vmlinux";
-      autoModules = true;
-    };
-  };
-
-  ppc64 = {
-    linux-kernel = {
-      name = "powerpc64";
-
-      baseConfig = "ppc64_defconfig";
-      target = "vmlinux";
-      autoModules = true;
-    };
-  };
-
   ##
   ## ARM
   ##
 
   armv5tel-multiplatform = {
-    linux-kernel = {
-      name = "armv5tel-multiplatform";
-
-      baseConfig = "multi_v5_defconfig";
-      DTB = true;
-      autoModules = true;
-      preferBuiltin = true;
-      target = "zImage";
-    };
     gcc = {
       arch = "armv5te";
     };
   };
 
   raspberrypi = {
-    linux-kernel = {
-      name = "raspberrypi";
-
-      baseConfig = "bcm2835_defconfig";
-      DTB = true;
-      autoModules = true;
-      preferBuiltin = true;
-      target = "zImage";
-    };
     gcc = {
       # https://en.wikipedia.org/wiki/Raspberry_Pi#Specifications
       arch = "armv6kz";
@@ -105,7 +52,6 @@ rec {
 
   # https://developer.android.com/ndk/guides/abis#v7a
   armv7a-android = {
-    linux-kernel.name = "armeabi-v7a";
     gcc = {
       arch = "armv7-a";
       float-abi = "softfp";
@@ -114,14 +60,6 @@ rec {
   };
 
   armv7l-hf-multiplatform = {
-    linux-kernel = {
-      name = "armv7l-hf-multiplatform";
-      baseConfig = "defconfig";
-      DTB = true;
-      autoModules = true;
-      preferBuiltin = true;
-      target = "zImage";
-    };
     gcc = {
       # Some table about fpu flags:
       # http://community.arm.com/servlet/JiveServlet/showImage/38-1981-3827/blogentry-103749-004812900+1365712953_thumb.png
@@ -146,19 +84,6 @@ rec {
   };
 
   aarch64-multiplatform = {
-    linux-kernel = {
-      name = "aarch64-multiplatform";
-      baseConfig = "defconfig";
-      DTB = true;
-      autoModules = true;
-      preferBuiltin = true;
-      extraConfig = ''
-        # The default (=y) forces us to have the XHCI firmware available in initrd,
-        # which our initrd builder can't currently do easily.
-        USB_XHCI_TEGRA m
-      '';
-      target = "Image";
-    };
     gcc = {
       arch = "armv8-a";
     };
@@ -176,9 +101,6 @@ rec {
   ##
 
   ben_nanonote = {
-    linux-kernel = {
-      name = "ben_nanonote";
-    };
     gcc = {
       arch = "mips32";
       float = "soft";
@@ -235,17 +157,6 @@ rec {
   ## Other
   ##
 
-  riscv-multiplatform = {
-    linux-kernel = {
-      name = "riscv-multiplatform";
-      target = "Image";
-      autoModules = true;
-      preferBuiltin = true;
-      baseConfig = "defconfig";
-      DTB = true;
-    };
-  };
-
   loongarch64-multiplatform = {
     gcc = {
       # https://github.com/loongson/la-softdev-convention/blob/master/la-softdev-convention.adoc#10-operating-system-package-build-requirements
@@ -257,14 +168,6 @@ rec {
       # https://github.com/llvm/llvm-project/pull/132173
       cmodel = "medium";
     };
-    linux-kernel = {
-      name = "loongarch-multiplatform";
-      target = "vmlinuz.efi";
-      autoModules = true;
-      preferBuiltin = true;
-      baseConfig = "defconfig";
-      DTB = true;
-    };
   };
 
   # This function takes a minimally-valid "platform" and returns an
@@ -272,17 +175,13 @@ rec {
   # included in the platform in order to further elaborate it.
   select =
     platform:
-    # x86
-    if platform.isx86 then
-      pc
-
     # ARM
-    else if platform.isAarch32 then
+    if platform.isAarch32 then
       let
         version = platform.parsed.cpu.version or null;
       in
       if version == null then
-        pc
+        { }
       else if lib.versionOlder version "6" then
         armv5tel-multiplatform
       else if lib.versionOlder version "7" then
@@ -296,24 +195,9 @@ rec {
     else if platform.isLoongArch64 then
       loongarch64-multiplatform
 
-    else if platform.isRiscV then
-      riscv-multiplatform
-
     else if platform.parsed.cpu == lib.systems.parse.cpuTypes.mipsel then
       (import ./examples.nix { inherit lib; }).mipsel-linux-gnu
 
-    else if platform.isPower64 then
-      if platform.isLittleEndian then powernv else ppc64
-
-    else if platform.isSh4 then
-      {
-        linux-kernel = {
-          target = "vmlinux";
-          # SH arch doesn't have a 'make install' target.
-          installTarget = "vmlinux";
-        };
-      }
-
     else
       { };
 }

lib/tests/modules.sh

@@ -515,56 +515,6 @@ checkConfigError 'infinite recursion encountered' config.nonLazyResult ./lazy-at
 checkConfigOutput '^"mergedName.<id>.nested"$' config.result ./name-merge-attrsWith-1.nix
 checkConfigError 'The option .mergedName. in .*\.nix. is already declared in .*\.nix' config.mergedName ./name-merge-attrsWith-2.nix
 
-# Test type.functor.wrapped deprecation warning
-# should emit the warning on:
-# - merged types
-# - non-merged types
-# - nestedTypes elemType
-# attrsWith
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.attrsWith.type.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedAttrsWith.type.functor.wrapped ./deprecated-wrapped.nix
-
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.attrsWith.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedAttrsWith.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-# listOf
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.listOf.type.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedListOf.type.functor.wrapped ./deprecated-wrapped.nix
-
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.listOf.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedListOf.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-# unique / uniq
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.unique.type.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedUnique.type.functor.wrapped ./deprecated-wrapped.nix
-
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.unique.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedUnique.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-# nullOr
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.nullOr.type.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedNullOr.type.functor.wrapped ./deprecated-wrapped.nix
-
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.nullOr.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedNullOr.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-# functionTo
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.functionTo.type.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedFunctionTo.type.functor.wrapped ./deprecated-wrapped.nix
-
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.functionTo.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedFunctionTo.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-
-# coercedTo
-# Note: test 'nestedTypes.finalType' and 'nestedTypes.coercedType'
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.coercedTo.type.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.coercedTo.type.nestedTypes.finalType.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.coercedTo.type.nestedTypes.coercedType.functor.wrapped ./deprecated-wrapped.nix
-# either
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.either.type.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedEither.type.functor.wrapped ./deprecated-wrapped.nix
-
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.either.type.nestedTypes.left.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.either.type.nestedTypes.right.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedEither.type.nestedTypes.left.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedEither.type.nestedTypes.right.functor.wrapped ./deprecated-wrapped.nix
-
 # Even with multiple assignments, a type error should be thrown if any of them aren't valid
 checkConfigError 'A definition for option .* is not of type .*' \
   config.value ./declare-int-unsigned-value.nix ./define-value-list.nix ./define-value-int-positive.nix
@@ -733,9 +683,6 @@ checkConfigError 'The option .theOption.nested. in .other.nix. is already declar
 # Test that types.optionType leaves types untouched as long as they don't need to be merged
 checkConfigOutput 'ok' config.freeformItems.foo.bar ./adhoc-freeformType-survives-type-merge.nix
 
-# Test that specifying both functor.wrapped and functor.payload isn't allowed
-checkConfigError 'Type foo defines both `functor.payload` and `functor.wrapped` at the same time, which is not supported.' config.result ./default-type-merge-both.nix
-
 # Test that not including functor.wrapped is allowed
 checkConfigOutput 'ok' config.result ./default-type-merge-payload.nix
 

lib/tests/modules/default-type-merge-both.nix

@@ -1,28 +0,0 @@
-{ lib, options, ... }:
-let
-  foo = lib.mkOptionType {
-    name = "foo";
-    functor = lib.types.defaultFunctor "foo" // {
-      wrapped = lib.types.int;
-      payload = 10;
-    };
-  };
-in
-{
-  imports = [
-    {
-      options.foo = lib.mkOption {
-        type = foo;
-      };
-    }
-    {
-      options.foo = lib.mkOption {
-        type = foo;
-      };
-    }
-  ];
-
-  options.result = lib.mkOption {
-    default = builtins.seq options.foo null;
-  };
-}

lib/types.nix

@@ -99,7 +99,6 @@ let
     { elemType, ... }@payload:
     {
       inherit name payload;
-      wrappedDeprecationMessage = makeWrappedDeprecationMessage payload;
       type = types.${name};
       binOp =
         a: b:
@@ -108,14 +107,6 @@ let
         in
         if merged == null then null else { elemType = merged; };
     };
-  makeWrappedDeprecationMessage =
-    payload:
-    { loc }:
-    lib.warn ''
-      The deprecated `${lib.optionalString (loc != null) "type."}functor.wrapped` attribute ${
-        lib.optionalString (loc != null) "of the option `${showOption loc}` "
-      }is accessed, use `${lib.optionalString (loc != null) "type."}nestedTypes.elemType` instead.
-    '' payload.elemType;
 
   checkDefsForError =
     check: loc: defs:
@@ -168,21 +159,11 @@ rec {
   defaultTypeMerge =
     f: f':
     let
-      mergedWrapped = f.wrapped.typeMerge f'.wrapped.functor;
       mergedPayload = f.binOp f.payload f'.payload;
 
       hasPayload =
         assert (f'.payload != null) == (f.payload != null);
         f.payload != null;
-      hasWrapped =
-        let
-          hasWrappedNonNull = set: set ? "wrapped" && set.wrapped != null;
-        in
-        assert (hasWrappedNonNull f') == (hasWrappedNonNull f);
-        hasWrappedNonNull f;
-
-      typeFromPayload = if mergedPayload == null then null else f.type mergedPayload;
-      typeFromWrapped = if mergedWrapped == null then null else f.type mergedWrapped;
     in
     # Abort early: cannot merge different types
     if f.name != f'.name then
@@ -190,22 +171,7 @@ rec {
     else
 
     if hasPayload then
-      # Just return the payload if returning wrapped is deprecated
-      if f ? wrappedDeprecationMessage then
-        typeFromPayload
-      else if hasWrapped then
-        # Has both wrapped and payload
-        throw ''
-          Type ${f.name} defines both `functor.payload` and `functor.wrapped` at the same time, which is not supported.
-
-          Use either `functor.payload` or `functor.wrapped` but not both.
-
-          If your code worked before remove either `functor.wrapped` or `functor.payload` from the type definition.
-        ''
-      else
-        typeFromPayload
-    else if hasWrapped then
-      typeFromWrapped
+      if mergedPayload == null then null else f.type mergedPayload
     else
       f.type;
 
@@ -213,7 +179,6 @@ rec {
   defaultFunctor = name: {
     inherit name;
     type = lib.types.${name} or null;
-    wrapped = null;
     payload = null;
     binOp = a: b: null;
   };
@@ -309,17 +274,8 @@ rec {
         deprecationMessage
         nestedTypes
         descriptionClass
+        functor
         ;
-      functor =
-        if functor ? wrappedDeprecationMessage then
-          functor
-          // {
-            wrapped = functor.wrappedDeprecationMessage {
-              loc = null;
-            };
-          }
-        else
-          functor;
       description = if description == null then name else description;
     };
 
@@ -1834,9 +1790,7 @@ rec {
       getSubModules = finalType.getSubModules;
       substSubModules = m: coercedTo coercedType coerceFunc (finalType.substSubModules m);
       typeMerge = t: null;
-      functor = (defaultFunctor name) // {
-        wrappedDeprecationMessage = makeWrappedDeprecationMessage { elemType = finalType; };
-      };
+      functor = defaultFunctor name;
       nestedTypes.coercedType = coercedType;
       nestedTypes.finalType = finalType;
     };

maintainers/github-teams.json

@@ -2,10 +2,11 @@
   "acme": {
     "description": "Maintain ACME-related packages and modules.",
     "id": 3806126,
-    "maintainers": {},
+    "maintainers": {
+      "emilazy": 18535642
+    },
     "members": {
       "arianvp": 628387,
-      "emilazy": 18535642,
       "m1cr0man": 3044438
     },
     "name": "ACME"
@@ -71,11 +72,10 @@
     "description": "coordinates efforts towards bootstrappable builds (see https://bootstrappable.org/)",
     "id": 9141350,
     "maintainers": {
+      "philiptaron": 43863,
       "zeuner": 2545850
     },
-    "members": {
-      "philiptaron": 43863
-    },
+    "members": {},
     "name": "bootstrapping"
   },
   "categorization": {
@@ -176,6 +176,7 @@
     "description": "Improve Darwin-support across Nixpkgs and help maintainers without access to Darwin hardware. Apply to join through https://github.com/NixOS/nixpkgs/issues/323144 to keep the process transparent.",
     "id": 2385202,
     "maintainers": {
+      "emilazy": 18535642,
       "toonn": 1486805
     },
     "members": {
@@ -205,7 +206,6 @@
       "donn": 12652988,
       "dwt": 57199,
       "eclairevoyant": 848000,
-      "emilazy": 18535642,
       "ethancedwards8": 60861925,
       "fiddlerwoaroof": 808745,
       "fulsomenko": 14945057,
@@ -410,9 +410,7 @@
       "jtojnar": 705123
     },
     "members": {
-      "bobby285271": 20080233,
-      "dasj19": 7589338,
-      "hedning": 71978
+      "bobby285271": 20080233
     },
     "name": "GNOME"
   },
@@ -556,11 +554,12 @@
     "id": 9955829,
     "maintainers": {
       "RossComputerGuy": 19699320,
-      "alyssais": 2768870
+      "alyssais": 2768870,
+      "emilazy": 18535642
     },
     "members": {
       "Ericson2314": 1055245,
-      "emilazy": 18535642,
+      "peterwaller-arm": 52030119,
       "rrbutani": 7833358,
       "sternenseemann": 3154475
     },
@@ -695,8 +694,7 @@
     "description": "",
     "id": 174820,
     "maintainers": {
-      "Ericson2314": 1055245,
-      "tomberek": 178444
+      "Ericson2314": 1055245
     },
     "members": {
       "Mic92": 96200,
@@ -704,6 +702,7 @@
       "edolstra": 1148549,
       "lisanna-dettwyler": 72424138,
       "lovesegfault": 7243783,
+      "tomberek": 178444,
       "xokdvium": 145775305
     },
     "name": "Nix team"
@@ -852,15 +851,15 @@
     "description": "Team that is interested in reproducible builds",
     "id": 7625643,
     "maintainers": {
-      "raboof": 131856,
-      "zimbatm": 3248
+      "raboof": 131856
     },
     "members": {
       "Artturin": 56650223,
       "Atemu": 18599032,
       "RaitoBezarius": 314564,
       "davidak": 91113,
-      "mschwaig": 3856390
+      "mschwaig": 3856390,
+      "zimbatm": 3248
     },
     "name": "reproducible"
   },
@@ -964,13 +963,13 @@
     "description": "Maintain the standard environment and its surrounding logic.",
     "id": 11265412,
     "maintainers": {
-      "RossComputerGuy": 19699320
+      "RossComputerGuy": 19699320,
+      "emilazy": 18535642,
+      "philiptaron": 43863
     },
     "members": {
       "Artturin": 56650223,
       "Ericson2314": 1055245,
-      "emilazy": 18535642,
-      "philiptaron": 43863,
       "reckenrode": 7413633
     },
     "name": "stdenv"

maintainers/maintainer-list.nix

@@ -813,6 +813,13 @@
     githubId = 19290901;
     name = "Andrew Brooks";
   };
+  agentelement = {
+    email = "agentelement@agentelement.net";
+    github = "agentelement";
+    githubId = 38045210;
+    name = "AgentElement";
+    keys = [ { fingerprint = "D37E 581D AD71 2378 A622  5BC0 CD13 9E3B 4354 34F1"; } ];
+  };
   agilesteel = {
     email = "agilesteel@gmail.com";
     github = "agilesteel";
@@ -2126,6 +2133,12 @@
     githubId = 56009;
     name = "Arcadio Rubio García";
   };
+  arcayr = {
+    email = "nixpkgs@arcayr.online";
+    github = "arcayr";
+    githubId = 11192354;
+    name = "Elliot Speck";
+  };
   archer-65 = {
     email = "mario.liguori.056@gmail.com";
     github = "archer-65";
@@ -2319,6 +2332,12 @@
     githubId = 3965744;
     name = "Arthur Lee";
   };
+  arthurficial = {
+    email = "arti.ficial@fullstackoptimization.com";
+    github = "Arthur-Ficial";
+    githubId = 258112064;
+    name = "Arthur Ficial";
+  };
   arthurteisseire = {
     email = "arthurteisseire33@gmail.com";
     github = "arthurteisseire";
@@ -5150,6 +5169,13 @@
     githubId = 68239;
     name = "Christine Koppelt";
   };
+  ckruse = {
+    email = "cjk@defunct.ch";
+    github = "ckruse";
+    githubId = 175095;
+    name = "Christian Kruse";
+    keys = [ { fingerprint = "BC5D 9F4E F7FB 4382 6056  E834 B8E0 F342 A99A 9D73"; } ];
+  };
   clacke = {
     email = "claes.wallin@greatsinodevelopment.com";
     github = "clacke";
@@ -6679,6 +6705,12 @@
     githubId = 90097;
     name = "Derek Collison";
   };
+  DerGrumpf = {
+    email = "phil.keier@hotmail.com";
+    github = "DerGrumpf";
+    githubId = 17272572;
+    name = "Phil Keier";
+  };
   DerGuteMoritz = {
     email = "moritz@twoticketsplease.de";
     github = "DerGuteMoritz";
@@ -7938,6 +7970,11 @@
     githubId = 18375468;
     name = "Elliot Xu";
   };
+  elliotberman = {
+    name = "Elliot Berman";
+    github = "elliotberman";
+    githubId = 210410075;
+  };
   elliottslaughter = {
     name = "Elliott Slaughter";
     email = "elliottslaughter@gmail.com";
@@ -9632,6 +9669,11 @@
     githubId = 293586;
     name = "Adam Gamble";
   };
+  gamebeaker = {
+    github = "gamebeaker";
+    githubId = 9269847;
+    name = "gamebeaker";
+  };
   gamedungeon = {
     github = "GameDungeon";
     githubId = 60719255;
@@ -10656,6 +10698,11 @@
     githubId = 147689;
     name = "Hans-Christian Esperer";
   };
+  hchokshi = {
+    github = "hchokshi";
+    githubId = 10136407;
+    name = "Harsh Chokshi";
+  };
   hdhog = {
     name = "Serg Larchenko";
     email = "hdhog@hdhog.ru";
@@ -10669,12 +10716,6 @@
     githubId = 2427959;
     name = "Hector Jusforgues";
   };
-  hedning = {
-    email = "torhedinbronner@gmail.com";
-    github = "hedning";
-    githubId = 71978;
-    name = "Tor Hedin Brønner";
-  };
   heel = {
     email = "parizhskiy@gmail.com";
     github = "HeeL";
@@ -10900,6 +10941,11 @@
     githubId = 58676303;
     name = "hhydraa";
   };
+  hibiday = {
+    name = "Katsumi Takeuchi";
+    github = "hibiday";
+    githubId = 137286929;
+  };
   higebu = {
     name = "Yuya Kusakabe";
     email = "yuya.kusakabe@gmail.com";
@@ -12081,6 +12127,12 @@
     github = "Jaculabilis";
     githubId = 10787844;
   };
+  jadewilk = {
+    name = "Jade Wilk";
+    email = "p.wilk@student.reading.ac.uk";
+    github = "jadewilk";
+    githubId = 50517631;
+  };
   jaduff = {
     email = "jdduffpublic@proton.me";
     github = "jaduff";
@@ -13511,6 +13563,12 @@
     githubId = 5352661;
     name = "James Cleverley-Prance";
   };
+  jpz13 = {
+    email = "jp@pipekit.io";
+    github = "JPZ13";
+    githubId = 6625432;
+    name = "J.P. Zivalich";
+  };
   jqueiroz = {
     email = "nixos@johnjq.com";
     github = "jqueiroz";
@@ -16532,6 +16590,11 @@
     github = "Macbucheron1";
     githubId = 95475157;
   };
+  mach = {
+    name = "Mach";
+    github = "MachXNU";
+    githubId = 42501418;
+  };
   macronova = {
     name = "Sicheng Pan";
     email = "trivial@invariantspace.com";
@@ -18488,6 +18551,11 @@
     githubId = 3579600;
     name = "Jacob Moody";
   };
+  mooses = {
+    name = "Remu Salminen";
+    github = "RemuSalminen";
+    githubId = 85031022;
+  };
   moosingin3space = {
     email = "moosingin3space@gmail.com";
     github = "moosingin3space";
@@ -19147,6 +19215,11 @@
     githubId = 1222539;
     name = "Roman Naumann";
   };
+  NanamiNakano = {
+    name = "Nanami Nakano";
+    github = "NanamiNakano";
+    githubId = 64841155;
+  };
   nanotwerp = {
     email = "nanotwerp@gmail.com";
     github = "nanotwerp";
@@ -20975,6 +21048,12 @@
     githubId = 5948762;
     name = "Berk Özkütük";
   };
+  ozturkkl = {
+    email = "97kemalozturk@gmail.com";
+    github = "ozturkkl";
+    githubId = 51798197;
+    name = "Kemal Ozturk";
+  };
   ozwaldorf = {
     email = "self@ossian.dev";
     github = "ozwaldorf";
@@ -21576,12 +21655,6 @@
     githubId = 43863;
     name = "Philip Taron";
   };
-  philipwilk = {
-    name = "Philip Wilk";
-    email = "p.wilk@student.reading.ac.uk";
-    github = "philipwilk";
-    githubId = 50517631;
-  };
   philocalyst = {
     name = "Myles Wirth";
     email = "milestheperson@posteo.net";
@@ -23052,12 +23125,6 @@
     githubId = 7775707;
     name = "RB";
   };
-  rb2k = {
-    email = "nix@marc-seeger.com";
-    github = "rb2k";
-    githubId = 9519;
-    name = "Marc Seeger";
-  };
   rbasso = {
     email = "rbasso@sharpgeeks.net";
     github = "rbasso";
@@ -23315,6 +23382,11 @@
     github = "Reputable2772";
     githubId = 153411261;
   };
+  ReStranger = {
+    name = "ReStranger";
+    github = "ReStranger";
+    githubId = 69393944;
+  };
   ret2pop = {
     email = "ret2pop@gmail.com";
     github = "ret2pop";
@@ -25321,7 +25393,7 @@
   shelvacu = {
     name = "Shelvacu";
     email = "nix-maint@shelvacu.com";
-    matrix = "@s:consortium.chat";
+    matrix = "@s:sv.mt";
     github = "shelvacu";
     githubId = 1731537;
   };
@@ -25416,13 +25488,6 @@
     githubId = 819413;
     name = "Benedict Aas";
   };
-  shreerammodi = {
-    name = "Shreeram Modi";
-    email = "shreerammodi10@gmail.com";
-    github = "shreerammodi";
-    githubId = 67710369;
-    keys = [ { fingerprint = "EA88 EA07 26E9 6CBF 6365  3966 163B 16EE 76ED 24CE"; } ];
-  };
   shunueda = {
     name = "Shun Ueda";
     github = "shunueda";
@@ -27014,6 +27079,12 @@
     githubId = 6064962;
     name = "TakWolf";
   };
+  talal = {
+    email = "noreply@talal.ch";
+    github = "talal";
+    githubId = 3526562;
+    name = "Muhammad Talal Anwar";
+  };
   talhaHavadar = {
     email = "havadartalha@gmail.com";
     github = "talhaHavadar";
@@ -27814,6 +27885,12 @@
     github = "tie";
     githubId = 14792994;
   };
+  tiebe = {
+    name = "Tiebe Groosman";
+    email = "tiebe@groosman.nl";
+    github = "Tiebe";
+    githubId = 9307389;
+  };
   tiferrei = {
     name = "Tiago Ferreira";
     email = "me@tiferrei.com";
@@ -30124,6 +30201,12 @@
     githubId = 36407913;
     name = "Uli Baum";
   };
+  xelacodes = {
+    name = "Alex";
+    github = "itzTheMeow";
+    githubId = 50887230;
+    email = "nixpkgs@xela.codes";
+  };
   xelden = {
     email = "anpiz@protonmail.com";
     github = "Xelden";

maintainers/scripts/luarocks-packages.csv

@@ -12,6 +12,7 @@ cassowary,,,,,,alerque
 cldr,,,,,,alerque
 commons.nvim,,,,,5.1,mrcjkb
 compat53,,,,,,vcunat
+coop.nvim,,,,,,
 cosmo,,,,,,
 coxpcall,,,,1.17.0-1,,
 cqueues,,,,,,vcunat
@@ -53,8 +54,8 @@ lrexlib-pcre2,,,,,,wishstudio
 lrexlib-posix,,,,,,
 lsp-progress.nvim,,,,,5.1,gepbird
 lsqlite3,,,,,,
-ltreesitter-ts,,,,,,
 ltreesitter,,,,,,
+ltreesitter-ts,,,,,,
 lua-cjson,,,,,,
 lua-cmsgpack,,,,,,
 lua-curl,,,,,,
@@ -174,8 +175,8 @@ tree-sitter-http,,,,0.0.33-1,,
 tree-sitter-norg,,,,,5.1,mrcjkb
 tree-sitter-norg-meta,,,,,,
 tree-sitter-orgmode,,,,,5.1,
-utf8,,,,,,
 tree-sitter-teal,,,,,,
+utf8,,,,,,
 vicious,,,,,,
 vstruct,,,,,,
 vusted,,,,,,

nixos/doc/manual/redirects.json

@@ -65,6 +65,42 @@
   "module-services-keycloak-unix-socket": [
     "index.html#module-services-keycloak-unix-socket"
   ],
+  "module-services-mautrix-discord": [
+    "index.html#module-services-mautrix-discord"
+  ],
+  "module-services-mautrix-discord-advanced": [
+    "index.html#module-services-mautrix-discord-advanced"
+  ],
+  "module-services-mautrix-discord-authentication": [
+    "index.html#module-services-mautrix-discord-authentication"
+  ],
+  "module-services-mautrix-discord-backfill": [
+    "index.html#module-services-mautrix-discord-backfill"
+  ],
+  "module-services-mautrix-discord-basic-example": [
+    "index.html#module-services-mautrix-discord-basic-example"
+  ],
+  "module-services-mautrix-discord-basic-usage": [
+    "index.html#module-services-mautrix-discord-basic-usage"
+  ],
+  "module-services-mautrix-discord-double-puppet": [
+    "index.html#module-services-mautrix-discord-double-puppet"
+  ],
+  "module-services-mautrix-discord-encryption": [
+    "index.html#module-services-mautrix-discord-encryption"
+  ],
+  "module-services-mautrix-discord-server-defaults": [
+    "index.html#module-services-mautrix-discord-server-defaults"
+  ],
+  "module-services-mautrix-discord-setup": [
+    "index.html#module-services-mautrix-discord-setup"
+  ],
+  "module-services-mautrix-discord-synapse": [
+    "index.html#module-services-mautrix-discord-synapse"
+  ],
+  "module-services-mautrix-discord-troubleshooting": [
+    "index.html#module-services-mautrix-discord-troubleshooting"
+  ],
   "module-services-tandoor-recipes-migrating-media-option-move": [
     "index.html#module-services-tandoor-recipes-migrating-media-option-move",
     "index.html#module-services-tandoor-recipes-migrating-media-option-1"

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -130,6 +130,8 @@
 
 - [linkding](https://linkding.link/), a self-hosted bookmark manager designed to be minimal, fast, and easy to set up. Available as [services.linkding](#opt-services.linkding.enable).
 
+- [gs1200-exporter](https://github.com/robinelfrink/gs1200-exporter), a Prometheus exporter for Zyxel GS1200 series switches. Available as [services.gs1200-exporter](#opt-services.gs1200-exporter.enable).
+
 - [Tinyauth](https://tinyauth.app/), a simple authentication middleware for web apps, with OAuth and LDAP support. Available as [services.tinyauth](#opt-services.tinyauth.enable).
 
 - [Strichliste](https://www.strichliste.org), a digital self-service tallysheet used in hackerspaces, clubs and offices. Available as [services.strichliste](#opt-services.strichliste.enable).
@@ -358,6 +360,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
   If client certificates, keys or other files are needed, these should be stored under `/etc/wpa_supplicant` and owned by `wpa_supplicant` to ensure the daemon can read them.
 
+  Similarly, the `ctrl_interface` directory set in `wpa_supplicant`'s conf must be writeable by the `wpa_supplicant` user so that the `wpa_supplicant` daemon can start successfully. If you were changing `ctrl_interface` in [extraConfig](#opt-networking.wireless.extraConfig) or in `/etc/wpa_supplicant/imperative.conf`, please remove that line.
+
   Also, the {option}`networking.wireless.userControlled.group` option has been removed since there is now a dedicated `wpa_supplicant` group to control the daemon, and {option}`networking.wireless.userControlled.enable` has been renamed to [](#opt-networking.wireless.userControlled).
 
   No functionality should have been impacted by these changes (including controlling via `wpa_cli`, integration with NetworkManager or connman), but if you find any problems, please open an issue on GitHub.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -12,6 +12,8 @@
 
 - [tranquil](https://tangled.org/tranquil.farm/tranquil-pds) is an ATProto PDS (personal data server) implementation in Rust. A featureful, spec conscious and community driven alternative to the Bluesky reference implementation PDS. Available as [services.tranquil-pds](#opt-services.tranquil-pds.enable).
 
+- [scx_loader](https://github.com/sched-ext/scx-loader), a system daemon and DBus-based loader for sched_ext schedulers. `scxctl` is the command-line client for interacting with the loader, allowing users to switch schedulers, modes, and arguments dynamically. Available as [services.scx-loader](#opt-services.scx-loader.enable)
+
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
@@ -22,10 +24,16 @@
 
 - Support for the legacy U‐Boot image format has been removed from the initrd generators, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
 
+- `services.llama-cpp` is now configured using structured `services.llama-cpp.settings` attribute.
+
 - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
 
+- `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
+
 - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.
 
+- `services.firezone.server.provision` has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/lib/testing/driver.nix

@@ -14,7 +14,7 @@ let
 
   inherit (config) sshBackdoor;
 
-  inherit (hostPkgs.stdenv.hostPlatform) isLinux;
+  inherit (hostPkgs.stdenv.hostPlatform) isLinux isAarch64;
 
   # Reifies and correctly wraps the python test driver for
   # the respective qemu version and with or without ocr support
@@ -256,6 +256,10 @@ in
         #
         # If needed, this can still be turned off.
         virtualisation.qemu.enableSharedMemory = lib.mkDefault isLinux;
+        # Needed for screenshots to work (in e.g `nixosTests.login`)
+        virtualisation.qemu.options = lib.optionals (isLinux && isAarch64) [
+          "-device virtio-gpu-pci"
+        ];
 
         assertions = [
           {

nixos/modules/config/malloc.nix

@@ -142,10 +142,14 @@ in
         # so we can warn the user about the change.
         legacyOptionsUsed = lib.lists.filter (opt: lib.strings.hasInfix opt scudoOpts) legacyOptionNames;
       in
-      lib.optional (cfg.provider == "scudo" && legacyOptionsUsed != [ ]) ''
-        environment.variables.SCUDO_OPTIONS: ${lib.concatStringsSep ", " legacyOptionsUsed} is/are no longer valid Scudo options.
-        Use snake_case instead of CamelCase: https://llvm.org/docs/ScudoHardenedAllocator.html#options
-      '';
+      lib.optional
+        (
+          config.environment.variables ? SCUDO_OPTIONS && cfg.provider == "scudo" && legacyOptionsUsed != [ ]
+        )
+        ''
+          environment.variables.SCUDO_OPTIONS: ${lib.concatStringsSep ", " legacyOptionsUsed} is/are no longer valid Scudo options.
+          Use snake_case instead of CamelCase: https://llvm.org/docs/ScudoHardenedAllocator.html#options
+        '';
 
     environment.etc."ld-nix.so.preload".text = ''
       ${providerLibPath}

nixos/modules/config/users-groups.nix

@@ -950,32 +950,8 @@ in
         };
       };
 
-      # Warn about user accounts with deprecated password hashing schemes
-      # This does not work when the users and groups are created by
-      # systemd-sysusers because the users are created too late then.
-      system.activationScripts.hashes =
-        if !config.systemd.sysusers.enable && !config.services.userborn.enable then
-          {
-            deps = [ "users" ];
-            text = ''
-              users=()
-              while IFS=: read -r user hash _; do
-                if [[ "$hash" = "$"* && ! "$hash" =~ ^\''$${cryptSchemeIdPatternGroup}\$ ]]; then
-                  users+=("$user")
-                fi
-              done </etc/shadow
-
-              if (( "''${#users[@]}" )); then
-                echo "
-              WARNING: The following user accounts rely on password hashing algorithms
-              that have been removed. They need to be renewed as soon as possible, as
-              they do prevent their users from logging in."
-                printf ' - %s\n' "''${users[@]}"
-              fi
-            '';
-          }
-        else
-          ""; # keep around for backwards compatibility
+      # for backwards compatibility
+      system.activationScripts.hashes = stringAfter [ "users" ] "";
 
       # for backwards compatibility
       system.activationScripts.groups = stringAfter [ "users" ] "";

nixos/modules/hardware/device-tree.nix

@@ -123,7 +123,8 @@ in
   options = {
     hardware.deviceTree = {
       enable = lib.mkOption {
-        default = pkgs.stdenv.hostPlatform.linux-kernel.DTB or false;
+        default = config.boot.kernelPackages.kernel.buildDTBs;
+        defaultText = lib.literalExpression "config.boot.kernelPackages.kernel.buildDTBs";
         type = lib.types.bool;
         description = ''
           Build device tree files. These are used to describe the

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma6.nix

@@ -21,11 +21,6 @@
     };
   };
 
-  environment.systemPackages = [
-    # provide onscreen keyboard
-    pkgs.kdePackages.plasma-keyboard
-  ];
-
   environment.plasma6.excludePackages = [
     # Optional wallpapers that add 126 MiB to the graphical installer
     # closure. They will still need to be downloaded when installing a

nixos/modules/installer/netboot/netboot.nix

@@ -111,7 +111,7 @@ with lib;
       #!ipxe
       # Use the cmdline variable to allow the user to specify custom kernel params
       # when chainloading this script from other iPXE scripts like netboot.xyz
-      kernel ${pkgs.stdenv.hostPlatform.linux-kernel.target} init=${config.system.build.toplevel}/init initrd=initrd ${toString config.boot.kernelParams} ''${cmdline}
+      kernel ${config.boot.kernelPackages.kernel.target} init=${config.system.build.toplevel}/init initrd=initrd ${toString config.boot.kernelParams} ''${cmdline}
       initrd initrd
       boot
     '';

nixos/modules/module-list.nix

@@ -245,6 +245,7 @@
   ./programs/iio-hyprland.nix
   ./programs/immersed.nix
   ./programs/iotop.nix
+  ./programs/jai-jail.nix
   ./programs/java.nix
   ./programs/joycond-cemuhook.nix
   ./programs/k3b.nix
@@ -668,6 +669,7 @@
   ./services/hardware/dell-bios-fan-control.nix
   ./services/hardware/display.nix
   ./services/hardware/fancontrol.nix
+  ./services/hardware/framework-control.nix
   ./services/hardware/freefall.nix
   ./services/hardware/fwupd.nix
   ./services/hardware/g810-led.nix
@@ -1032,6 +1034,7 @@
   ./services/monitoring/grafana-to-ntfy.nix
   ./services/monitoring/grafana.nix
   ./services/monitoring/graphite.nix
+  ./services/monitoring/gs1200-exporter.nix
   ./services/monitoring/hdaps.nix
   ./services/monitoring/heapster.nix
   ./services/monitoring/incron.nix
@@ -1484,6 +1487,7 @@
   ./services/scheduling/cron.nix
   ./services/scheduling/fcron.nix
   ./services/scheduling/prefect.nix
+  ./services/scheduling/scx-loader.nix
   ./services/scheduling/scx.nix
   ./services/search/elasticsearch-curator.nix
   ./services/search/elasticsearch.nix

nixos/modules/programs/clash-verge.nix

@@ -81,6 +81,7 @@
           LockPersonality = true;
           RestrictRealtime = true;
           RuntimeDirectory = "clash-verge-rev";
+          StateDirectory = "clash-verge-service";
           ProtectClock = true;
           MemoryDenyWriteExecute = true;
           RestrictSUIDSGID = true;

nixos/modules/programs/foot/zshrc

@@ -9,14 +9,11 @@ function chpwd-osc7-pwd() {
     (( ZSH_SUBSHELL )) || osc7-pwd
 }
 
-precmd() {
-    print -Pn "\e]133;A\e\\"
-}
-
 function precmd {
     if ! builtin zle; then
         print -n "\e]133;D\e\\"
     fi
+    print -Pn "\e]133;A\e\\"
 }
 
 function preexec {

nixos/modules/programs/jai-jail.nix

@@ -0,0 +1,45 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.jai-jail;
+
+in
+{
+  options.programs.jai-jail = {
+    enable = lib.mkEnableOption "jai, a sandbox for AI agents";
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.jai-jail;
+      defaultText = lib.literalExpression "pkgs.jai-jail";
+      description = "The jai package to use.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    security.wrappers.jai = {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${cfg.package}/bin/jai";
+    };
+
+    users.users.jai = {
+      isSystemUser = true;
+      group = "jai";
+      home = "/";
+      description = "JAI sandbox untrusted user";
+    };
+
+    users.groups.jai = { };
+
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ agentelement ];
+}

nixos/modules/services/computing/boinc/client.nix

@@ -50,7 +50,7 @@ in
         only the hosts listed in {var}`dataDir`/remote_hosts.cfg will be allowed to
         connect.
 
-        See also: <https://boinc.berkeley.edu/wiki/Controlling_BOINC_remotely#Remote_access>
+        See also: <https://github.com/BOINC/boinc/wiki/Controlling_BOINC_remotely#remote-access>
       '';
     };
 

nixos/modules/services/desktop-managers/pantheon.nix

@@ -276,8 +276,7 @@ in
         ++ (with pkgs.pantheon; [
           elementary-files
           elementary-settings-daemon
-          # https://github.com/elementary/portals/issues/157
-          # xdg-desktop-portal-pantheon
+          xdg-desktop-portal-pantheon
         ])
       ) config.environment.pantheon.excludePackages;
 

nixos/modules/services/desktop-managers/plasma6.nix

@@ -169,6 +169,9 @@ in
           krdp
           kconfig # required for xdg-terminal from xdg-utils
           qtbase # for qtpaths which is required for xdg-mime from xdg-utils
+          # touch keyboard
+          plasma-keyboard
+          qtvirtualkeyboard # used by plasma-keyboard KCM
         ]
         ++ lib.optional config.networking.networkmanager.enable qrca
         ++ lib.optionals config.hardware.sensor.iio.enable [

nixos/modules/services/desktops/espanso.nix

@@ -21,6 +21,12 @@ in
       package = lib.mkPackageOption pkgs "espanso" {
         example = "pkgs.espanso-wayland";
       };
+      extraPackages = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [ ];
+        example = lib.literalExpression "with pkgs; [ bash curl python3 ];";
+        description = "Extra packages to be added to Espanso service path.";
+      };
     };
   };
 
@@ -43,6 +49,7 @@ in
         Restart = "on-failure";
       };
       wantedBy = [ "graphical-session.target" ];
+      path = cfg.extraPackages;
     };
 
     environment.systemPackages = [ cfg.package ];

nixos/modules/services/hardware/framework-control.nix

@@ -0,0 +1,48 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.framework-control;
+in
+{
+  meta.maintainers = [ lib.maintainers.ozturkkl ];
+
+  options.services.framework-control = {
+    enable = lib.mkEnableOption "Framework Control device hardware service";
+    package = lib.mkPackageOption pkgs "framework-control" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.framework-control = {
+      description = "Framework Control Service";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      # framework-control shells out to framework_tool at runtime for hardware access
+      path = [ pkgs.framework-tool ];
+
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = lib.getExe cfg.package;
+        Restart = "on-failure";
+        RestartSec = "5s";
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        LockPersonality = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        SystemCallArchitectures = "native";
+      };
+    };
+  };
+}

nixos/modules/services/hardware/fwupd.nix

@@ -35,7 +35,7 @@ let
     lib.listToAttrs (map mkEtcFile cfg.package.filesInstalledToEtc);
   extraTrustedKeys =
     let
-      mkName = p: "pki/fwupd/${baseNameOf (toString p)}";
+      mkName = p: "pki/fwupd/${baseNameOf p}";
       mkEtcFile = p: lib.nameValuePair (mkName p) { source = p; };
     in
     lib.listToAttrs (map mkEtcFile cfg.extraTrustedKeys);
@@ -202,8 +202,8 @@ in
     systemd = {
       packages = [ cfg.package ];
 
-      # fwupd-refresh expects a user that we do not create, so just run with DynamicUser
-      # instead and ensure we take ownership of /var/lib/fwupd
+      # The upstream unit runs as User=fwupd-refresh; ensure it can take
+      # ownership of /var/lib/fwupd.
       services.fwupd-refresh.serviceConfig = {
         StateDirectory = "fwupd";
         # Better for debugging, upstream sets stderr to null for some reason..
@@ -219,7 +219,21 @@ in
     };
     users.groups.fwupd-refresh = { };
 
-    security.polkit.enable = true;
+    security.polkit = {
+      enable = true;
+      # fwupd-refresh.service has no seat, so polkit denies these actions.
+      # Upstream's TrustedUids needs a static uid which we only allocate at
+      # activation time, so grant access via a rule on the user name instead.
+      extraConfig = ''
+        polkit.addRule(function(action, subject) {
+          if ((action.id == "org.freedesktop.fwupd.get-remotes" ||
+               action.id == "org.freedesktop.fwupd.refresh-remote") &&
+              subject.user == "fwupd-refresh") {
+            return polkit.Result.YES;
+          }
+        });
+      '';
+    };
   };
 
   meta = {

nixos/modules/services/hardware/hddfancontrol.nix

@@ -10,7 +10,7 @@ let
 in
 
 {
-  meta.maintainers = with lib.maintainers; [ philipwilk ];
+  meta.maintainers = with lib.maintainers; [ jadewilk ];
 
   imports = [
     (lib.mkRemovedOptionModule [

nixos/modules/services/hardware/scanservjs.nix

@@ -125,6 +125,12 @@ in
     };
     users.groups.scanservjs = { };
 
+    systemd.tmpfiles.rules = [
+      "d ${cfg.stateDir}/data 0755 scanservjs scanservjs - -"
+      "d ${cfg.stateDir}/data/preview 0755 scanservjs scanservjs - -"
+      "L+ ${cfg.stateDir}/data/preview/default.jpg - - - - ${package}/lib/data/preview/default.jpg"
+    ];
+
     systemd.services.scanservjs = {
       description = "scanservjs";
       after = [ "network.target" ];

nixos/modules/services/home-automation/home-assistant.nix

@@ -864,12 +864,19 @@ in
 
     networking.firewall.allowedTCPPorts = mkMerge [
       (mkIf cfg.openFirewall [ cfg.config.http.server_port ])
-      (mkIf cfg.openFirewallForComponents
+      (mkIf cfg.openFirewallForComponents (
+        # https://www.home-assistant.io/integrations/homekit/#firewall
+        optionals (useComponent "homekit") [ 21063 ]
         # https://www.home-assistant.io/integrations/sonos/#network-requirements
-        (optionals (useComponent "sonos") [ 1400 ])
-      )
+        ++ optionals (useComponent "sonos") [ 1400 ]
+      ))
     ];
 
+    networking.firewall.allowedUDPPorts = mkIf cfg.openFirewallForComponents (
+      # https://www.home-assistant.io/integrations/homekit/#firewall
+      optionals (useComponent "homekit") [ 5353 ]
+    );
+
     # symlink the configuration to /etc/home-assistant
     environment.etc = mkMerge [
       (mkIf (cfg.config != null && !cfg.configWritable) {

nixos/modules/services/home-automation/matterjs-server.nix

@@ -123,5 +123,8 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ kranzes ];
+  meta.maintainers = with lib.maintainers; [
+    kranzes
+    marie
+  ];
 }

nixos/modules/services/home-automation/openthread-border-router.nix

@@ -203,15 +203,6 @@ in
       ]) cfg.backboneInterfaces
     );
 
-    # OTBR uses avahi for mDNS service publishing
-    services.avahi = {
-      enable = lib.mkDefault true;
-      publish = {
-        enable = lib.mkDefault true;
-        userServices = lib.mkDefault true;
-      };
-    };
-
     # The upstream service files (src/agent/otbr-agent.service.in, src/web/otbr-web.service.in) use
     # EnvironmentFile and CMake-substituted platform scripts that don't translate to NixOS, so the
     # services are rebuilt here from typed module options instead.

nixos/modules/services/mail/stalwart.nix

@@ -304,7 +304,6 @@ in
   meta = {
     maintainers = with lib.maintainers; [
       happysalada
-      euxane
       onny
       norpol
     ];

nixos/modules/services/matrix/mautrix-discord.md

@@ -0,0 +1,156 @@
+# Mautrix-Discord {#module-services-mautrix-discord}
+
+*Source:* {file}`modules/services/matrix/mautrix-discord`
+
+*Upstream documentation:* <https://docs.mau.fi/bridges/go/discord/index.html>
+
+[Mautrix-Discord](https://github.com/mautrix/discord) is a Matrix-Discord bridge.
+
+## Basic Usage {#module-services-mautrix-discord-basic-usage}
+
+The common setup is to enable the bridge, point it at your homeserver, and set the permissions you want to allow:
+
+1. Set `services.mautrix-discord.enable` to `true`.
+2. Set `services.mautrix-discord.settings.homeserver.address` and `services.mautrix-discord.settings.homeserver.domain`.
+3. Override `services.mautrix-discord.settings.bridge.permissions` if the default relay permissions do not fit your deployment.
+
+The module provides sensible defaults for the appservice listener, registration tokens, and relay permissions.
+
+### Basic Example {#module-services-mautrix-discord-basic-example}
+
+```nix
+{
+  services.mautrix-discord = {
+    enable = true;
+    registerToSynapse = true;
+    settings = {
+      homeserver = {
+        address = "http://localhost:8008";
+        domain = "example.com";
+      };
+      bridge.permissions = {
+        "example.com" = "user";
+        "@admin:example.com" = "admin";
+      };
+    };
+  };
+}
+```
+
+### Server Defaults {#module-services-mautrix-discord-server-defaults}
+
+By default, the bridge listens on `http://localhost:29334` and generates its appservice tokens automatically.
+
+## Authentication {#module-services-mautrix-discord-authentication}
+
+If you want to store the bridge database outside the default SQLite file, set `settings.appservice.database` to use PostgreSQL instead of SQLite:
+
+```nix
+{
+  services.mautrix-discord.settings.appservice.database = {
+    type = "postgres";
+    uri = "postgresql:///mautrix-discord?host=/run/postgresql";
+  };
+}
+```
+
+If the connection needs a password, combine it with `services.mautrix-discord.environmentFile`:
+
+```nix
+{
+  services.mautrix-discord = {
+    environmentFile = "/run/secrets/mautrix-discord-env";
+    settings.appservice.database.uri = "postgresql://mautrix:$DB_PASSWORD@localhost/mautrix-discord";
+  };
+}
+```
+
+Use `services.mautrix-discord.environmentFile` for any secret you do not want in the Nix store.
+This includes database passwords, shared secrets, and similar values.
+
+Example:
+
+```nix
+{
+  services.mautrix-discord = {
+    environmentFile = "/run/secrets/mautrix-discord-env";
+    settings.bridge.login_shared_secret_map = {
+      "example.com" = "$SHARED_SECRET";
+    };
+  };
+}
+```
+
+## Bridge Setup {#module-services-mautrix-discord-setup}
+
+After the service starts, open a chat with `@discordbot:example.com`, send `login`, and follow the instructions to link your Discord account.
+
+For more detail, see the [Mautrix-Discord documentation](https://docs.mau.fi/bridges/go/discord/index.html).
+
+## Advanced Configuration {#module-services-mautrix-discord-advanced}
+
+The upstream default configuration is available at [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml). To print the generated default configuration from the package, run:
+
+```bash
+nix-shell -p mautrix-discord --run "mautrix-discord -e"
+```
+
+### Encryption {#module-services-mautrix-discord-encryption}
+
+```nix
+{
+  services.mautrix-discord.settings.bridge.encryption = {
+    allow = true;
+    default = true;
+    require = false;
+  };
+}
+```
+
+Encryption needs additional bridge-side setup. See the [bridge encryption documentation](https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html) for details.
+
+### Backfill {#module-services-mautrix-discord-backfill}
+
+```nix
+{
+  services.mautrix-discord.settings.bridge.backfill.forward_limits.initial = {
+    dm = 50;
+    channel = 50;
+    thread = 50;
+  };
+}
+```
+
+### Double Puppeting {#module-services-mautrix-discord-double-puppet}
+
+```nix
+{
+  services.mautrix-discord = {
+    environmentFile = "/run/secrets/mautrix-discord-env";
+    settings.bridge.login_shared_secret_map = {
+      "example.com" = "$SHARED_SECRET";
+    };
+  };
+}
+```
+where  `/run/secrets/mautrix-discord-env` contains
+```
+SHARED_SECRET=aProtectedSecret
+```
+
+## Synapse Integration {#module-services-mautrix-discord-synapse}
+
+When `services.mautrix-discord.registerToSynapse` is `true`, the bridge writes its registration file automatically and Synapse picks it up.
+
+If Synapse is enabled, this option defaults to `true`.
+
+## Troubleshooting {#module-services-mautrix-discord-troubleshooting}
+
+- View logs with `journalctl -u mautrix-discord.service -f`.
+- Check `systemctl status mautrix-discord` if the bridge does not start.
+- Verify the homeserver can reach the configured appservice address.
+- Ensure the registration file exists and Synapse can read it.
+
+For more help, see the
+[Mautrix-Discord documentation](https://docs.mau.fi/bridges/go/discord/index.html)
+or the support room at [#discord:maunium.net](https://matrix.to/#/#discord:maunium.net).

nixos/modules/services/matrix/mautrix-discord.nix

@@ -5,15 +5,59 @@
   ...
 }:
 let
+  defaultDataDir = "/var/lib/mautrix-discord";
   cfg = config.services.mautrix-discord;
   dataDir = cfg.dataDir;
   format = pkgs.formats.yaml { };
+  serviceDependencies = [
+    "mautrix-discord-registration.service"
+  ]
+  ++ (lib.lists.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)
+  ++ (lib.lists.optional config.services.matrix-conduit.enable "matrix-conduit.service")
+  ++ (lib.lists.optional config.services.dendrite.enable "dendrite.service");
 
   registrationFile = "${dataDir}/discord-registration.yaml";
 
   settingsFile = "${dataDir}/config.yaml";
   settingsFileUnformatted = format.generate "discord-config-unsubstituted.yaml" cfg.settings;
   default_token = "This value is generated when generating the registration";
+  settingsDefault = {
+    homeserver = {
+      address = "";
+      domain = "";
+    };
+
+    appservice = {
+      address = "http://localhost:29334";
+      hostname = "0.0.0.0";
+      port = 29334;
+      database = {
+        type = "sqlite3";
+        uri = "file:${defaultDataDir}/mautrix-discord.db?_txlock=immediate";
+      };
+      id = "discord";
+      bot = {
+        username = "discordbot";
+        displayname = "Discord bridge bot";
+        avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
+      };
+      as_token = default_token;
+      hs_token = default_token;
+    };
+
+    bridge.permissions."*" = "relay";
+
+    logging = {
+      min_level = "info";
+      writers = [
+        {
+          type = "stdout";
+          format = "pretty-colored";
+          time_format = " ";
+        }
+      ];
+    };
+  };
 in
 {
   options = {
@@ -23,238 +67,14 @@ in
       package = lib.mkPackageOption pkgs "mautrix-discord" { };
 
       settings = lib.mkOption {
-        type = lib.types.submodule {
-          freeformType = format.type;
-
-          config = {
-            _module.args = { inherit cfg lib; };
-          };
-
-          options = {
-            homeserver = lib.mkOption {
-              type = lib.types.attrs;
-              default = {
-                software = "standard";
-                status_endpoint = null;
-                message_send_checkpoint_endpoint = null;
-                async_media = false;
-                websocket = false;
-                ping_interval_seconds = 0;
-              };
-              description = ''
-                fullDataDiration.
-                                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
-                                for more information.
-              '';
-            };
-
-            appservice = lib.mkOption {
-              type = lib.types.attrs;
-              default = {
-                address = "http://localhost:29334";
-                hostname = "0.0.0.0";
-                port = 29334;
-                database = {
-                  type = "sqlite3";
-                  uri = "file:/var/lib/mautrix-discord/mautrix-discord.db?_txlock=immediate";
-                  max_open_conns = 20;
-                  max_idle_conns = 2;
-                  max_conn_idle_time = null;
-                  max_conn_lifetime = null;
-                };
-                id = "discord";
-                bot = {
-                  username = "discordbot";
-                  displayname = "Discord bridge bot";
-                  avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
-                };
-                ephemeral_events = true;
-                async_transactions = false;
-                as_token = "This value is generated when generating the registration";
-                hs_token = "This value is generated when generating the registration";
-              };
-              defaultText = lib.literalExpression ''
-                {
-                  address = "http://localhost:29334";
-                  hostname = "0.0.0.0";
-                  port = 29334;
-                  database = {
-                    type = "sqlite3";
-                    uri = "file:''${config.services.mautrix-discord.dataDir}/mautrix-discord.db?_txlock=immediate";
-                    max_open_conns = 20;
-                    max_idle_conns = 2;
-                    max_conn_idle_time = null;
-                    max_conn_lifetime = null;
-                  };
-                  id = "discord";
-                  bot = {
-                    username = "discordbot";
-                    displayname = "Discord bridge bot";
-                    avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
-                  };
-                  ephemeral_events = true;
-                  async_transactions = false;
-                  as_token = "This value is generated when generating the registration";
-                  hs_token = "This value is generated when generating the registration";
-                }
-              '';
-              description = ''
-                Appservice configuration.
-                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
-                for more information.
-              '';
-            };
-
-            bridge = lib.mkOption {
-              type = lib.types.attrs;
-              default = {
-                username_template = "discord_{{.}}";
-                displayname_template = "{{if .Webhook}}Webhook{{else}}{{or .GlobalName .Username}}{{if .Bot}} (bot){{end}}{{end}}";
-                channel_name_template = "{{if or (eq .Type 3) (eq .Type 4)}}{{.Name}}{{else}}#{{.Name}}{{end}}";
-                guild_name_template = "{{.Name}}";
-                private_chat_portal_meta = "default";
-                public_address = null;
-                avatar_proxy_key = "generate";
-                portal_message_buffer = 128;
-                startup_private_channel_create_limit = 5;
-                delivery_receipts = false;
-                message_status_events = false;
-                message_error_notices = true;
-                restricted_rooms = true;
-                autojoin_thread_on_open = true;
-                embed_fields_as_tables = true;
-                mute_channels_on_create = false;
-                sync_direct_chat_list = false;
-                resend_bridge_info = false;
-                custom_emoji_reactions = true;
-                delete_portal_on_channel_delete = false;
-                delete_guild_on_leave = true;
-                federate_rooms = true;
-                prefix_webhook_messages = true;
-                enable_webhook_avatars = false;
-                use_discord_cdn_upload = true;
-                #proxy =
-                cache_media = "unencrypted";
-                direct_media = {
-                  enabled = false;
-                  #server_name = "discord-media.example.com";
-                  #well_known_response =
-                  allow_proxy = true;
-                  server_key = "generate";
-                };
-                animated_sticker = {
-                  target = "webp";
-                  args = {
-                    width = 320;
-                    height = 320;
-                    fps = 25;
-                  };
-                };
-                double_puppet_server_map = {
-                  #"example.com" = "https://example.com";
-                };
-                double_puppet_allow_discovery = false;
-                login_shared_secret_map = {
-                  #"example.com" = "foobar";
-                };
-                command_prefix = "!discord";
-                management_room_text = {
-                  welcome = "Hello, I'm a Discord bridge bot.";
-                  welcome_connected = "Use `help` for help.";
-                  welcome_unconnected = "Use `help` for help or `login` to log in.";
-                  additional_help = "";
-                };
-                backfill = {
-                  forward_limits = {
-                    initial = {
-                      dm = 0;
-                      channel = 0;
-                      thread = 0;
-                    };
-                    missed = {
-                      dm = 0;
-                      channel = 0;
-                      thread = 0;
-                    };
-                    max_guild_members = -1;
-                  };
-                };
-                encryption = {
-                  allow = false;
-                  default = false;
-                  appservice = false;
-                  msc4190 = false;
-                  require = false;
-                  allow_key_sharing = false;
-                  plaintext_mentions = false;
-                  delete_keys = {
-                    delete_outbound_on_ack = false;
-                    dont_store_outbound = false;
-                    ratchet_on_decrypt = false;
-                    delete_fully_used_on_decrypt = false;
-                    delete_prev_on_new_session = false;
-                    delete_on_device_delete = false;
-                    periodically_delete_expired = false;
-                    delete_outdated_inbound = false;
-                  };
-                  verification_levels = {
-                    receive = "unverified";
-                    send = "unverified";
-                    share = "cross-signed-tofu";
-                  };
-                  rotation = {
-                    enable_custom = false;
-                    milliseconds = 604800000;
-                    messages = 100;
-                    disable_device_change_key_rotation = false;
-                  };
-                };
-                provisioning = {
-                  prefix = "/_matrix/provision";
-                  shared_secret = "generate";
-                  debug_endpoints = false;
-                };
-                permissions = {
-                  "*" = "relay";
-                  #"example.com" = "user";
-                  #"@admin:example.com": "admin";
-                };
-              };
-              description = ''
-                Bridge configuration.
-                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
-                for more information.
-              '';
-            };
-            logging = lib.mkOption {
-              type = lib.types.attrs;
-              default = {
-                min_level = "info";
-                writers = lib.singleton {
-                  type = "stdout";
-                  format = "pretty-colored";
-                  time_format = " ";
-                };
-              };
-              description = ''
-                Logging configuration.
-                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
-                for more information.
-              '';
-            };
-          };
-        };
-        default = { };
+        apply = lib.recursiveUpdate settingsDefault;
+        type = format.type;
+        default = settingsDefault;
         example = lib.literalExpression ''
           {
             homeserver = {
               address = "http://localhost:8008";
-              domain = "public-domain.tld";
-            };
-
-            appservice.public = {
-              prefix = "/public";
-              external = "https://public-appservice-address/public";
+              domain = "example.com";
             };
 
             bridge.permissions = {
@@ -265,8 +85,12 @@ in
         '';
         description = ''
           {file}`config.yaml` configuration as a Nix attribute set.
+
           Configuration options should match those described in
           [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml).
+
+          Secret tokens should be specified using {option}`environmentFile`
+          instead of this world-readable attribute set.
         '';
       };
 
@@ -282,12 +106,9 @@ in
 
       dataDir = lib.mkOption {
         type = lib.types.path;
-        default = "/var/lib/mautrix-discord";
-        defaultText = "/var/lib/mautrix-discord";
-        description = ''
-          Directory to store the bridge's configuration and database files.
-          This directory will be created if it does not exist.
-        '';
+        default = defaultDataDir;
+        defaultText = defaultDataDir;
+        description = "Directory to store the bridge's data.";
       };
 
       # TODO: Get upstream to add an environment File option. Refer to https://github.com/NixOS/nixpkgs/pull/404871#issuecomment-2895663652 and https://github.com/mautrix/discord/issues/187
@@ -295,92 +116,31 @@ in
         type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
-          File containing environment variables to substitute when copying the configuration
-          out of Nix store to the `services.mautrix-discord.dataDir`.
-          Can be used for storing the secrets without making them available in the Nix store.
-          For example, you can set `services.mautrix-discord.settings.appservice.as_token = "$MAUTRIX_DISCORD_APPSERVICE_AS_TOKEN"`
-          and then specify `MAUTRIX_DISCORD_APPSERVICE_AS_TOKEN="{token}"` in the environment file.
-          This value will get substituted into the configuration file as a token.
+          File containing environment variables for secret substitution.
+          Variables in the config like `$VARIABLE` will be replaced.
         '';
       };
 
-      serviceUnit = lib.mkOption {
-        type = lib.types.str;
-        readOnly = true;
-        default = "mautrix-discord.service";
-        description = ''
-          The systemd unit (a service or a target) for other services to depend on if they
-          need to be started after matrix-synapse.
-          This option is useful as the actual parent unit for all matrix-synapse processes
-          changes when configuring workers.
-        '';
-      };
-
-      registrationServiceUnit = lib.mkOption {
-        type = lib.types.str;
-        readOnly = true;
-        default = "mautrix-discord-registration.service";
-        description = ''
-          The registration service that generates the registration file.
-          Systemd unit (a service or a target) for other services to depend on if they
-          need to be started after mautrix-discord registration service.
-          This option is useful as the actual parent unit for all matrix-synapse processes
-          changes when configuring workers.
-        '';
-      };
-
-      serviceDependencies = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [
-          cfg.registrationServiceUnit
-        ]
-        ++ (lib.lists.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)
-        ++ (lib.lists.optional config.services.matrix-conduit.enable "matrix-conduit.service")
-        ++ (lib.lists.optional config.services.dendrite.enable "dendrite.service");
-
-        defaultText = ''
-          [ cfg.registrationServiceUnit ] ++
-          (lib.lists.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit) ++
-          (lib.lists.optional config.services.matrix-conduit.enable "matrix-conduit.service") ++
-          (lib.lists.optional config.services.dendrite.enable "dendrite.service");
-        '';
-        description = ''
-          List of Systemd services to require and wait for when starting the application service.
-        '';
-      };
     };
   };
   config = lib.mkIf cfg.enable {
+
     assertions = [
       {
         assertion =
-          cfg.settings.homeserver.domain or "" != "" && cfg.settings.homeserver.address or "" != "";
-        message = ''
-          The options with information about the homeserver:
-          `services.mautrix-discord.settings.homeserver.domain` and
-          `services.mautrix-discord.settings.homeserver.address` have to be set.
-        '';
-      }
-      {
-        assertion = cfg.settings.bridge.permissions or { } != { };
-        message = ''
-          The option `services.mautrix-discord.settings.bridge.permissions` has to be set.
-        '';
+          cfg.settings.homeserver.address or "" != "" && cfg.settings.homeserver.domain or "" != "";
+        message = "services.mautrix-discord.settings.homeserver.{address,domain} must be set.";
       }
     ];
 
     users.users.mautrix-discord = {
       isSystemUser = true;
       group = "mautrix-discord";
-      extraGroups = [ "mautrix-discord-registration" ];
       home = dataDir;
       description = "Mautrix-Discord bridge user";
     };
 
     users.groups.mautrix-discord = { };
-    users.groups.mautrix-discord-registration = {
-      members = lib.lists.optional config.services.matrix-synapse.enable "matrix-synapse";
-    };
 
     services.matrix-synapse = lib.mkIf cfg.registerToSynapse {
       settings.app_service_config_files = [ registrationFile ];
@@ -392,7 +152,9 @@ in
 
     systemd.services = {
       matrix-synapse = lib.mkIf cfg.registerToSynapse {
-        serviceConfig.SupplementaryGroups = [ "mautrix-discord-registration" ];
+        serviceConfig.SupplementaryGroups = [
+          "mautrix-discord"
+        ];
         # Make synapse depend on the registration service when auto-registering
         wants = [ "mautrix-discord-registration.service" ];
         after = [ "mautrix-discord-registration.service" ];
@@ -471,15 +233,18 @@ in
             '${settingsFile}' '${registrationFile}' > '${registrationFile}.tmp'
           mv '${registrationFile}.tmp' '${registrationFile}'
 
+          # Application services should not be rate limited by default.
+          yq -Y '.rate_limited = false' '${registrationFile}' > '${registrationFile}.tmp'
+          mv '${registrationFile}.tmp' '${registrationFile}'
+
           umask $old_umask
-          chown :mautrix-discord-registration '${registrationFile}'
           chmod 640 '${registrationFile}'
         '';
 
         serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;
-          UMask = 27;
+          UMask = "027";
 
           User = "mautrix-discord";
           Group = "mautrix-discord";
@@ -501,8 +266,8 @@ in
         description = "Mautrix-Discord, a Matrix-Discord puppeting/relaybot bridge";
 
         wantedBy = [ "multi-user.target" ];
-        wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
-        after = [ "network-online.target" ] ++ cfg.serviceDependencies;
+        wants = [ "network-online.target" ] ++ serviceDependencies;
+        after = [ "network-online.target" ] ++ serviceDependencies;
         path = [
           pkgs.lottieconverter
           pkgs.ffmpeg-headless
@@ -536,6 +301,8 @@ in
           ProtectHostname = true;
           ProtectClock = true;
 
+          UMask = "027";
+
           SystemCallArchitectures = "native";
           SystemCallErrorNumber = "EPERM";
           SystemCallFilter = "@system-service";
@@ -546,10 +313,12 @@ in
       };
     };
 
-    meta = {
-      maintainers = with lib.maintainers; [
-        mistyttm
-      ];
-    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [
+      mistyttm
+    ];
+    doc = ./mautrix-discord.md;
   };
 }

nixos/modules/services/misc/autorandr.nix

@@ -32,9 +32,14 @@ let
         );
       getSubModules = elemType.getSubModules;
       substSubModules = mod: matrixOf n m (elemType.substSubModules mod);
-      functor = (lib.defaultFunctor name) // {
-        wrapped = elemType;
-      };
+      functor = (
+        lib.types.elemTypeFunctor "attrsWith" {
+          inherit
+            elemType
+            name
+            ;
+        }
+      );
     };
 
   profileModule = lib.types.submodule {

nixos/modules/services/misc/inventree.nix

@@ -252,12 +252,13 @@ in
             in
             {
               "/" = {
+                # recommendedProxySettings sets the standard headers (Host, X-Forwarded-*), so
+                # don't also set them via proxy_set_header in extraConfig below. Nginx would then
+                # send Host twice and Django rejects it with DisallowedHost. Enabled per-location
+                # so it works even if the host's global recommendedProxySettings is off.
+                recommendedProxySettings = true;
                 extraConfig = ''
-                  proxy_set_header Host $host;
                   proxy_set_header X-Forwarded-By $server_addr:$server_port;
-                  proxy_set_header X-Forwarded-For $remote_addr;
-                  proxy_set_header X-Forwarded-Proto $scheme;
-                  proxy_set_header X-Real-IP $remote_addr;
                   proxy_set_header CLIENT_IP $remote_addr;
 
                   proxy_pass_request_headers on;
@@ -272,6 +273,8 @@ in
                 proxyPass = "http://unix:${unixPath}";
               };
               "/auth" = {
+                # same reasoning as "/"; this subrequest also reaches Django
+                recommendedProxySettings = true;
                 extraConfig = ''
                   internal;
                   proxy_pass_request_body off;

nixos/modules/services/misc/llama-cpp.nix

@@ -2,188 +2,173 @@
   config,
   lib,
   pkgs,
-  utils,
   ...
 }:
-
 let
   cfg = config.services.llama-cpp;
-
-  modelsPresetFile =
-    if cfg.modelsPreset != null then
-      pkgs.writeText "llama-models.ini" (lib.generators.toINI { } cfg.modelsPreset)
-    else
-      null;
 in
 {
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "llama-cpp" "host" ]
+      [ "services" "llama-cpp" "settings" "host" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "llama-cpp" "port" ]
+      [ "services" "llama-cpp" "settings" "port" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "llama-cpp" "model" ]
+      [ "services" "llama-cpp" "settings" "model" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "llama-cpp" "modelsDir" ]
+      [ "services" "llama-cpp" "settings" "models-dir" ]
+    )
+    (lib.mkRemovedOptionModule [ "services" "llama-cpp" "modelsPreset" ] ''
+      Using a Nix attribute set for configuring model presets is no longer
+      supported. However, it's possible to use
+      `services.llama-cpp.settings.models-preset` to provide a path to an INI
+      file with desired options.
+    '')
+    (lib.mkRemovedOptionModule [
+      "services"
+      "llama-cpp"
+      "extraFlags"
+    ] "Use `services.llama-cpp.settings` instead")
+  ];
 
   options = {
-
     services.llama-cpp = {
-      enable = lib.mkEnableOption "LLaMA C++ server";
+      enable = lib.mkEnableOption "llama.cpp HTTP server";
 
       package = lib.mkPackageOption pkgs "llama-cpp" { };
 
-      model = lib.mkOption {
-        type = lib.types.nullOr lib.types.path;
-        example = "/models/mistral-instruct-7b/ggml-model-q4_0.gguf";
-        description = "Model path.";
-        default = null;
-      };
-
-      modelsDir = lib.mkOption {
-        type = lib.types.nullOr lib.types.path;
-        example = "/models/";
-        description = "Models directory.";
-        default = null;
-      };
-
-      modelsPreset = lib.mkOption {
-        type = lib.types.nullOr (lib.types.attrsOf lib.types.attrs);
-        default = null;
-        description = ''
-          Models preset configuration as a Nix attribute set.
-          This is converted to an INI file and passed to llama-server via --model-preset.
-          See llama-server documentation for available options.
-        '';
-        example = lib.literalExpression ''
-          {
-            "Qwen3-Coder-Next" = {
-              hf-repo = "unsloth/Qwen3-Coder-Next-GGUF";
-              hf-file = "Qwen3-Coder-Next-UD-Q4_K_XL.gguf";
-              alias = "unsloth/Qwen3-Coder-Next";
-              fit = "on";
-              seed = "3407";
-              temp = "1.0";
-              top-p = "0.95";
-              min-p = "0.01";
-              top-k = "40";
-              jinja = "on";
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = lib.types.attrs;
+          options = {
+            host = lib.mkOption {
+              type = lib.types.str;
+              default = "127.0.0.1";
+              example = "0.0.0.0";
+              description = ''
+                IP address on which the server should listen on.
+              '';
             };
-          }
+
+            port = lib.mkOption {
+              type = lib.types.port;
+              default = 8080;
+              example = 1337;
+              description = ''
+                Port on which the server should listen on.
+              '';
+            };
+          };
+        };
+        default = { };
+        example = {
+          host = "0.0.0.0";
+          port = 1337;
+          model = "/mnt/llms/Foo3.6-27B-UD-Q4_K_XL.gguf";
+          ctx-size = 252144;
+          temp = 0.6;
+          top-k = 20;
+          top-p = 0.95;
+          batch-size = 512;
+          ubatch-size = 256;
+          spec-type = "draft-mtp";
+          spec-draft-n-max = 2;
+          flash-attn = "on";
+        };
+        description = ''
+          Command-line arguments for `llama-server`.
+
+          See <https://github.com/ggml-org/llama.cpp/blob/master/tools/server/README.md>
+          for the full list of options.
         '';
       };
 
-      extraFlags = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        description = "Extra flags passed to llama-cpp-server.";
-        example = [
-          "-c"
-          "4096"
-          "-ngl"
-          "32"
-          "--numa"
-          "numactl"
-        ];
-        default = [ ];
-      };
-
-      host = lib.mkOption {
-        type = lib.types.str;
-        default = "127.0.0.1";
-        example = "0.0.0.0";
-        description = "IP address the LLaMA C++ server listens on.";
-      };
-
-      port = lib.mkOption {
-        type = lib.types.port;
-        default = 8080;
-        description = "Listen port for LLaMA C++ server.";
-      };
-
       openFirewall = lib.mkOption {
         type = lib.types.bool;
         default = false;
-        description = "Open ports in the firewall for LLaMA C++ server.";
+        description = ''
+          Open ports in the firewall for the server.
+        '';
       };
     };
-
   };
 
   config = lib.mkIf cfg.enable {
     systemd.services.llama-cpp = {
-      description = "LLaMA C++ server";
+      description = "llama.cpp HTTP server";
+      wants = [ "network.target" ];
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
-        Type = "idle";
-        KillSignal = "SIGINT";
+        ExecStart = toString [
+          (lib.getExe' cfg.package "llama-server")
+          (lib.cli.toCommandLine (optionName: {
+            option = if builtins.stringLength optionName > 1 then "--${optionName}" else "-${optionName}";
+            sep = " ";
+            explicitBool = false;
+            formatArg = lib.generators.mkValueStringDefault { };
+          }) cfg.settings)
+        ];
+        ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID";
+        Restart = "on-failure";
+        RestartSec = 300;
+
+        DynamicUser = true;
         StateDirectory = "llama-cpp";
         CacheDirectory = "llama-cpp";
         WorkingDirectory = "/var/lib/llama-cpp";
         Environment = [ "LLAMA_CACHE=/var/cache/llama-cpp" ];
-        ExecStart =
-          let
-            args = [
-              "--host"
-              cfg.host
-              "--port"
-              (toString cfg.port)
-            ]
-            ++ lib.optionals (cfg.model != null) [
-              "-m"
-              cfg.model
-            ]
-            ++ lib.optionals (cfg.modelsDir != null) [
-              "--models-dir"
-              cfg.modelsDir
-            ]
-            ++ lib.optionals (cfg.modelsPreset != null) [
-              "--models-preset"
-              modelsPresetFile
-            ]
-            ++ cfg.extraFlags;
-          in
-          "${cfg.package}/bin/llama-server ${utils.escapeSystemdExecArgs args}";
-        Restart = "on-failure";
-        RestartSec = 300;
 
-        # for GPU acceleration
-        PrivateDevices = false;
-
-        # hardening
-        DynamicUser = true;
-        CapabilityBoundingSet = "";
+        AmbientCapabilities = [ "" ];
+        CapabilityBoundingSet = [ "" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = false; # Required for GPU support.
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
         RestrictAddressFamilies = [
           "AF_INET"
           "AF_INET6"
           "AF_UNIX"
         ];
-        NoNewPrivileges = true;
-        PrivateMounts = true;
-        PrivateTmp = true;
-        PrivateUsers = true;
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectSystem = "strict";
-        MemoryDenyWriteExecute = true;
-        LockPersonality = true;
-        RemoveIPC = true;
         RestrictNamespaces = true;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
         SystemCallFilter = [
           "@system-service"
           "~@privileged"
         ];
-        SystemCallErrorNumber = "EPERM";
-        ProtectProc = "invisible";
-        ProtectHostname = true;
-        ProcSubset = "pid";
       };
     };
 
-    networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ cfg.port ];
-    };
-
+    networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
   };
 
-  meta.maintainers = with lib.maintainers; [ newam ];
+  meta.maintainers = with lib.maintainers; [
+    azahi
+    newam
+  ];
 }

nixos/modules/services/misc/rmfakecloud.nix

@@ -146,5 +146,5 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ euxane ];
+  meta.maintainers = with lib.maintainers; [ martinetd ];
 }

nixos/modules/services/monitoring/gs1200-exporter.nix

@@ -0,0 +1,95 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.gs1200-exporter;
+in
+{
+  meta.maintainers = with lib.maintainers; [ DerGrumpf ];
+
+  options.services.gs1200-exporter = {
+    enable = lib.mkEnableOption "gs1200-exporter";
+
+    address = lib.mkOption {
+      type = lib.types.str;
+      description = "IP address or hostname of the GS1200 switch.";
+      example = "192.168.1.3";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 9934;
+      description = "Port on which to expose Prometheus metrics.";
+    };
+
+    passwordFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Path to a file containing the password to log in to the GS1200 web interface.
+        This is the recommended option as it avoids storing the password in the Nix store.
+        Compatible with sops-nix and agenix.
+      '';
+      example = "/run/secrets/gs1200-password";
+    };
+
+    debug = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Enable debug logging. Logs are accessible via journalctl -u gs1200-exporter.";
+    };
+
+    verbose = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Enable verbose logging. Logs are accessible via journalctl -u gs1200-exporter.";
+    };
+
+    json = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Output logs in JSON format. Logs are accessible via journalctl -u gs1200-exporter.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    systemd.services.gs1200-exporter = {
+      description = "Prometheus exporter for Zyxel GS1200 switches";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        DynamicUser = true;
+        Restart = "always";
+
+        # Hardening
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        CapabilityBoundingSet = "";
+      };
+
+      script =
+        let
+          args = lib.concatStringsSep " " (
+            [
+              "--address ${cfg.address}"
+              "--port ${toString cfg.port}"
+            ]
+            ++ lib.optional cfg.debug "--debug"
+            ++ lib.optional cfg.verbose "--verbose"
+            ++ lib.optional cfg.json "--json"
+          );
+        in
+        ''
+          export GS1200_PASSWORD=$(cat ${cfg.passwordFile})
+          exec ${lib.getExe pkgs.gs1200-exporter} ${args}
+        '';
+    };
+  };
+}

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -62,6 +62,7 @@ let
         "domain"
         "dovecot"
         "ebpf"
+        "elasticsearch"
         "fail2ban"
         "fastly"
         "flow"

nixos/modules/services/monitoring/prometheus/exporters/elasticsearch.nix

@@ -0,0 +1,62 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkIf
+    mkOption
+    types
+    ;
+
+  inherit (utils) escapeSystemdExecArgs;
+
+  cfg = config.services.prometheus.exporters.elasticsearch;
+in
+{
+  port = 9114;
+  extraOpts = {
+    package = lib.mkPackageOption pkgs "prometheus-elasticsearch-exporter" { };
+
+    url = mkOption {
+      type = types.str;
+      default = "http://localhost:9200";
+      example = "https://localhost:9200";
+      description = ''
+        URI of the Elasticsearch (or OpenSearch) node to scrape, passed as
+        `--es.uri`. Any credentials embedded here are overridden by the
+        `ES_USERNAME`/`ES_PASSWORD` or `ES_API_KEY` environment variables when
+        {option}`environmentFile` is set.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/elasticsearch-exporter.env";
+      description = ''
+        Path to an environment file, as defined in {manpage}`systemd.exec(5)`,
+        used to pass credentials to the exporter without exposing them in the
+        process arguments. It should contain either `ES_USERNAME` and
+        `ES_PASSWORD`, or `ES_API_KEY`.
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+      ExecStart = escapeSystemdExecArgs (
+        [
+          (lib.getExe cfg.package)
+          "--web.listen-address=${cfg.listenAddress}:${toString cfg.port}"
+          "--es.uri=${cfg.url}"
+        ]
+        ++ cfg.extraFlags
+      );
+    };
+  };
+}

nixos/modules/services/networking/firezone/provision.exs

@@ -1,709 +0,0 @@
-defmodule Provision do
-  alias Domain.{Repo, Accounts, Auth, Actors, Resources, Tokens, Gateways, Relays, Policies}
-  require Logger
-
-  # UUID Mapping handling
-  defmodule UuidMapping do
-    @mapping_file "provision-uuids.json"
-
-    # Loads the mapping from file
-    def load do
-      mappings = case File.read(@mapping_file) do
-        {:ok, content} ->
-          case Jason.decode(content) do
-            {:ok, mapping} -> mapping
-            _ -> %{"accounts" => %{}}
-          end
-
-        _ -> %{"accounts" => %{}}
-      end
-      Process.put(:uuid_mappings, mappings)
-      mappings
-    end
-
-    # Saves the current mapping (defaulting to the one in the process dictionary)
-    def save(mapping \\ Process.get(:uuid_mappings)) do
-      File.write!(@mapping_file, Jason.encode!(mapping))
-    end
-
-    # Retrieves the account-level mapping from a given mapping (or from Process)
-    def get_account(mapping \\ Process.get(:uuid_mappings), account_slug) do
-      get_in(mapping, ["accounts", account_slug]) || %{}
-    end
-
-    # Retrieves the entity mapping for a specific account and type
-    def get_entities(mapping \\ Process.get(:uuid_mappings), account_slug, type) do
-      get_in(mapping, ["accounts", account_slug, type]) || %{}
-    end
-
-    # Retrieves an entity mapping for a specific account, type and external_id
-    def get_entity(mapping \\ Process.get(:uuid_mappings), account_slug, type, external_id) do
-      get_in(mapping, ["accounts", account_slug, type, external_id])
-    end
-
-    # Updates (or creates) the account UUID mapping and stores it in the process dictionary.
-    def update_account(account_slug, uuid) do
-      mapping = Process.get(:uuid_mappings) || load()
-      mapping = ensure_account_exists(mapping, account_slug)
-      mapping = put_in(mapping, ["accounts", account_slug, "id"], uuid)
-      Process.put(:uuid_mappings, mapping)
-      mapping
-    end
-
-    # Ensures that the given account exists in the mapping.
-    def ensure_account_exists(mapping, account_slug) do
-      if not Map.has_key?(mapping["accounts"], account_slug) do
-        put_in(mapping, ["accounts", account_slug], %{})
-      else
-        mapping
-      end
-    end
-
-    # Updates (or creates) the mapping for entities of a given type for the account.
-    def update_entities(account_slug, type, new_entries) do
-      mapping = Process.get(:uuid_mappings) || load()
-      mapping = ensure_account_exists(mapping, account_slug)
-      current = get_entities(mapping, account_slug, type)
-      mapping = put_in(mapping, ["accounts", account_slug, type], Map.merge(current, new_entries))
-      Process.put(:uuid_mappings, mapping)
-      mapping
-    end
-
-    # Removes an entire account from the mapping.
-    def remove_account(account_slug) do
-      mapping = Process.get(:uuid_mappings) || load()
-      mapping = update_in(mapping, ["accounts"], fn accounts ->
-        Map.delete(accounts, account_slug)
-      end)
-      Process.put(:uuid_mappings, mapping)
-      mapping
-    end
-
-    # Removes a specific entity mapping for the account.
-    def remove_entity(account_slug, type, key) do
-      mapping = Process.get(:uuid_mappings) || load()
-      mapping = update_in(mapping, ["accounts", account_slug, type], fn entities ->
-        Map.delete(entities || %{}, key)
-      end)
-      Process.put(:uuid_mappings, mapping)
-      mapping
-    end
-  end
-
-  defp resolve_references(value) when is_map(value) do
-    Enum.into(value, %{}, fn {k, v} -> {k, resolve_references(v)} end)
-  end
-
-  defp resolve_references(value) when is_list(value) do
-    Enum.map(value, &resolve_references/1)
-  end
-
-  defp resolve_references(value) when is_binary(value) do
-    Regex.replace(~r/\{env:([^}]+)\}/, value, fn _, var ->
-      System.get_env(var) || raise "Environment variable #{var} not set"
-    end)
-  end
-
-  defp resolve_references(value), do: value
-
-  defp atomize_keys(map) when is_map(map) do
-    Enum.into(map, %{}, fn {k, v} ->
-      {
-        if(is_binary(k), do: String.to_atom(k), else: k),
-        if(is_map(v), do: atomize_keys(v), else: v)
-      }
-    end)
-  end
-
-  defp cleanup_account(uuid) do
-    case Accounts.fetch_account_by_id_or_slug(uuid) do
-      {:ok, value} when value.deleted_at == nil ->
-        Logger.info("Deleting removed account #{value.slug}")
-        value |> Ecto.Changeset.change(%{ deleted_at: DateTime.utc_now() }) |> Repo.update!()
-      _ -> :ok
-    end
-  end
-
-  defp cleanup_actor(uuid, subject) do
-    case Actors.fetch_actor_by_id(uuid, subject) do
-      {:ok, value} ->
-        Logger.info("Deleting removed actor #{value.name}")
-        {:ok, _} = Actors.delete_actor(value, subject)
-      _ -> :ok
-    end
-  end
-
-  defp cleanup_provider(uuid, subject) do
-    case Auth.fetch_provider_by_id(uuid, subject) do
-      {:ok, value} ->
-        Logger.info("Deleting removed provider #{value.name}")
-        {:ok, _} = Auth.delete_provider(value, subject)
-      _ -> :ok
-    end
-  end
-
-  defp cleanup_gateway_group(uuid, subject) do
-    case Gateways.fetch_group_by_id(uuid, subject) do
-      {:ok, value} ->
-        Logger.info("Deleting removed gateway group #{value.name}")
-        {:ok, _} = Gateways.delete_group(value, subject)
-      _ -> :ok
-    end
-  end
-
-  defp cleanup_relay_group(uuid, subject) do
-    case Relays.fetch_group_by_id(uuid, subject) do
-      {:ok, value} ->
-        Logger.info("Deleting removed relay group #{value.name}")
-        {:ok, _} = Relays.delete_group(value, subject)
-      _ -> :ok
-    end
-  end
-
-  defp cleanup_actor_group(uuid, subject) do
-    case Actors.fetch_group_by_id(uuid, subject) do
-      {:ok, value} ->
-        Logger.info("Deleting removed actor group #{value.name}")
-        {:ok, _} = Actors.delete_group(value, subject)
-      _ -> :ok
-    end
-  end
-
-  # Fetch resource by uuid, but follow the chain of replacements if any
-  defp fetch_resource(uuid, subject) do
-    case Resources.fetch_resource_by_id(uuid, subject) do
-      {:ok, resource} when resource.replaced_by_resource_id != nil -> fetch_resource(resource.replaced_by_resource_id, subject)
-      v -> v
-    end
-  end
-
-  defp cleanup_resource(uuid, subject) do
-    case fetch_resource(uuid, subject) do
-      {:ok, value} when value.deleted_at == nil ->
-        Logger.info("Deleting removed resource #{value.name}")
-        {:ok, _} = Resources.delete_resource(value, subject)
-      _ -> :ok
-    end
-  end
-
-  # Fetch policy by uuid, but follow the chain of replacements if any
-  defp fetch_policy(uuid, subject) do
-    case Policies.fetch_policy_by_id(uuid, subject) do
-      {:ok, policy} when policy.replaced_by_policy_id != nil -> fetch_policy(policy.replaced_by_policy_id, subject)
-      v -> v
-    end
-  end
-
-  defp cleanup_policy(uuid, subject) do
-    case fetch_policy(uuid, subject) do
-      {:ok, value} when value.deleted_at == nil ->
-        Logger.info("Deleting removed policy #{value.description}")
-        {:ok, _} = Policies.delete_policy(value, subject)
-      _ -> :ok
-    end
-  end
-
-  defp cleanup_entity_type(account_slug, entity_type, cleanup_fn, temp_admin_subject) do
-    # Get mapping for this entity type
-    existing_entities = UuidMapping.get_entities(account_slug, entity_type)
-    # Get current entities from account data
-    current_entities = Process.get(:current_entities)
-    # Determine which ones to remove
-    removed_entity_ids = Map.keys(existing_entities) -- (current_entities[entity_type] || [])
-
-    # Process each entity to remove
-    Enum.each(removed_entity_ids, fn entity_id ->
-      case existing_entities[entity_id] do
-        nil -> :ok
-        uuid ->
-          cleanup_fn.(uuid, temp_admin_subject)
-          UuidMapping.remove_entity(account_slug, entity_type, entity_id)
-      end
-    end)
-  end
-
-  defp collect_current_entities(account_data) do
-    %{
-      "actors" => Map.keys(account_data["actors"] || %{}),
-      "providers" => Map.keys(account_data["auth"] || %{}),
-      "gateway_groups" => Map.keys(account_data["gatewayGroups"] || %{}),
-      "relay_groups" => Map.keys(account_data["relayGroups"] || %{}),
-      "actor_groups" => Map.keys(account_data["groups"] || %{}) ++ ["everyone"],
-      "resources" => Map.keys(account_data["resources"] || %{}),
-      "policies" => Map.keys(account_data["policies"] || %{})
-    }
-  end
-
-  defp nil_if_deleted_or_not_found(value) do
-    case value do
-      nil -> nil
-      {:error, :not_found} -> nil
-      {:ok, value} when value.deleted_at != nil -> nil
-      v -> v
-    end
-  end
-
-  defp create_temp_admin(account, email_provider) do
-    temp_admin_actor_email = "firezone-provision@localhost.local"
-    temp_admin_actor_context = %Auth.Context{
-      type: :browser,
-      user_agent: "Unspecified/0.0",
-      remote_ip: {127, 0, 0, 1},
-      remote_ip_location_region: "N/A",
-      remote_ip_location_city: "N/A",
-      remote_ip_location_lat: 0.0,
-      remote_ip_location_lon: 0.0
-    }
-
-    {:ok, temp_admin_actor} =
-      Actors.create_actor(account, %{
-        type: :account_admin_user,
-        name: "Provisioning"
-      })
-
-    {:ok, temp_admin_actor_email_identity} =
-      Auth.create_identity(temp_admin_actor, email_provider, %{
-        provider_identifier: temp_admin_actor_email,
-        provider_identifier_confirmation: temp_admin_actor_email
-      })
-
-    {:ok, temp_admin_actor_token} =
-      Auth.create_token(temp_admin_actor_email_identity, temp_admin_actor_context, "temporarynonce", DateTime.utc_now() |> DateTime.add(1, :hour))
-
-    {:ok, temp_admin_subject} =
-      Auth.build_subject(temp_admin_actor_token, temp_admin_actor_context)
-
-    {temp_admin_subject, temp_admin_actor, temp_admin_actor_email_identity, temp_admin_actor_token}
-  end
-
-  defp cleanup_temp_admin(temp_admin_actor, temp_admin_actor_email_identity, temp_admin_actor_token, subject) do
-    Logger.info("Cleaning up temporary admin actor")
-    {:ok, _} = Tokens.delete_token(temp_admin_actor_token, subject)
-    {:ok, _} = Auth.delete_identity(temp_admin_actor_email_identity, subject)
-    {:ok, _} = Actors.delete_actor(temp_admin_actor, subject)
-  end
-
-  def provision() do
-    Logger.info("Starting provisioning")
-
-    # Load desired state
-    json_file = "provision-state.json"
-    {:ok, raw_json} = File.read(json_file)
-    {:ok, %{"accounts" => accounts}} = Jason.decode(raw_json)
-    accounts = resolve_references(accounts)
-
-    # Load existing UUID mappings into the process dictionary.
-    UuidMapping.load()
-
-    # Clean up removed accounts first
-    current_account_slugs = Map.keys(accounts)
-    existing_accounts = Map.keys(Process.get(:uuid_mappings)["accounts"])
-    removed_accounts = existing_accounts -- current_account_slugs
-
-    Enum.each(removed_accounts, fn slug ->
-      if uuid = get_in(Process.get(:uuid_mappings), ["accounts", slug, "id"]) do
-        cleanup_account(uuid)
-        # Remove the account from the UUID mapping.
-        UuidMapping.remove_account(slug)
-      end
-    end)
-
-    multi = Enum.reduce(accounts, Ecto.Multi.new(), fn {slug, account_data}, multi ->
-      account_attrs = atomize_keys(%{
-        name: account_data["name"],
-        slug: slug,
-        features: Map.get(account_data, "features", %{}),
-        metadata: Map.get(account_data, "metadata", %{}),
-        limits: Map.get(account_data, "limits", %{})
-      })
-
-      multi = multi
-        |> Ecto.Multi.run({:account, slug}, fn repo, _changes ->
-          case Accounts.fetch_account_by_id_or_slug(slug) do
-            {:ok, acc} ->
-              Logger.info("Updating existing account #{slug}")
-              updated_acc = acc |> Ecto.Changeset.change(account_attrs) |> repo.update!()
-              {:ok, {:existing, updated_acc}}
-            _ ->
-              Logger.info("Creating new account #{slug}")
-              {:ok, account} = Accounts.create_account(account_attrs)
-
-              Logger.info("Creating internet gateway group")
-              {:ok, internet_site} = Gateways.create_internet_group(account)
-
-              Logger.info("Creating internet resource")
-              {:ok, _internet_resource} = Resources.create_internet_resource(account, internet_site)
-
-              # Store mapping of slug to UUID
-              UuidMapping.update_account(slug, account.id)
-              {:ok, {:new, account}}
-          end
-        end)
-        |> Ecto.Multi.run({:everyone_group, slug}, fn _repo, changes ->
-          case Map.get(changes, {:account, slug}) do
-            {:new, account} ->
-              Logger.info("Creating everyone group for new account")
-              {:ok, actor_group} = Actors.create_managed_group(account, %{name: "Everyone"})
-              UuidMapping.update_entities(slug, "actor_groups", %{"everyone" => actor_group.id})
-              {:ok, actor_group}
-            {:existing, _account} ->
-              {:ok, :skipped}
-          end
-        end)
-        |> Ecto.Multi.run({:email_provider, slug}, fn _repo, changes ->
-          case Map.get(changes, {:account, slug}) do
-            {:new, account} ->
-              Logger.info("Creating default email provider for new account")
-              Auth.create_provider(account, %{name: "Email", adapter: :email, adapter_config: %{}})
-            {:existing, account} ->
-              Auth.Provider.Query.not_disabled()
-              |> Auth.Provider.Query.by_adapter(:email)
-              |> Auth.Provider.Query.by_account_id(account.id)
-              |> Repo.fetch(Auth.Provider.Query, [])
-          end
-        end)
-        |> Ecto.Multi.run({:temp_admin, slug}, fn _repo, changes ->
-          {_, account} = changes[{:account, slug}]
-          email_provider = changes[{:email_provider, slug}]
-          {:ok, create_temp_admin(account, email_provider)}
-        end)
-
-      # Clean up removed entities for this account after we have an admin subject
-      multi = multi
-        |> Ecto.Multi.run({:cleanup_entities, slug}, fn _repo, changes ->
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-
-          # Store current entities in process dictionary for our helper function
-          current_entities = collect_current_entities(account_data)
-          Process.put(:current_entities, current_entities)
-
-          # Define entity types and their cleanup functions
-          entity_types = [
-            {"actors", &cleanup_actor/2},
-            {"providers", &cleanup_provider/2},
-            {"gateway_groups", &cleanup_gateway_group/2},
-            {"relay_groups", &cleanup_relay_group/2},
-            {"actor_groups", &cleanup_actor_group/2},
-            {"resources", &cleanup_resource/2},
-            {"policies", &cleanup_policy/2}
-          ]
-
-          # Clean up each entity type
-          Enum.each(entity_types, fn {entity_type, cleanup_fn} ->
-            cleanup_entity_type(slug, entity_type, cleanup_fn, temp_admin_subject)
-          end)
-
-          {:ok, :cleaned}
-        end)
-
-      # Create or update actors
-      multi = Enum.reduce(account_data["actors"] || %{}, multi, fn {external_id, actor_data}, multi ->
-        actor_attrs = atomize_keys(%{
-          name: actor_data["name"],
-          type: String.to_atom(actor_data["type"])
-        })
-
-        Ecto.Multi.run(multi, {:actor, slug, external_id}, fn _repo, changes ->
-          {_, account} = changes[{:account, slug}]
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-          uuid = UuidMapping.get_entity(slug, "actors", external_id)
-          case uuid && Actors.fetch_actor_by_id(uuid, temp_admin_subject) |> nil_if_deleted_or_not_found() do
-            nil ->
-              Logger.info("Creating new actor #{actor_data["name"]}")
-              {:ok, actor} = Actors.create_actor(account, actor_attrs)
-              # Update the mapping without manually handling Process.get/put.
-              UuidMapping.update_entities(slug, "actors", %{external_id => actor.id})
-              {:ok, {:new, actor}}
-            {:ok, existing_actor} ->
-              Logger.info("Updating existing actor #{actor_data["name"]}")
-              {:ok, updated_act} = Actors.update_actor(existing_actor, actor_attrs, temp_admin_subject)
-              {:ok, {:existing, updated_act}}
-          end
-        end)
-        |> Ecto.Multi.run({:actor_identity, slug, external_id}, fn repo, changes ->
-          email_provider = changes[{:email_provider, slug}]
-          case Map.get(changes, {:actor, slug, external_id}) do
-            {:new, actor} ->
-              Logger.info("Creating actor email identity")
-              Auth.create_identity(actor, email_provider, %{
-                provider_identifier: actor_data["email"],
-                provider_identifier_confirmation: actor_data["email"]
-              })
-            {:existing, actor} ->
-              Logger.info("Updating actor email identity")
-              {:ok, identity} = Auth.Identity.Query.not_deleted()
-              |> Auth.Identity.Query.by_actor_id(actor.id)
-              |> Auth.Identity.Query.by_provider_id(email_provider.id)
-              |> Repo.fetch(Auth.Identity.Query, [])
-
-              {:ok, identity |> Ecto.Changeset.change(%{
-                provider_identifier: actor_data["email"]
-              }) |> repo.update!()}
-          end
-        end)
-      end)
-
-      # Create or update providers
-      multi = Enum.reduce(account_data["auth"] || %{}, multi, fn {external_id, provider_data}, multi ->
-        Ecto.Multi.run(multi, {:provider, slug, external_id}, fn repo, changes ->
-          provider_attrs = %{
-            name: provider_data["name"],
-            adapter: String.to_atom(provider_data["adapter"]),
-            adapter_config: provider_data["adapter_config"]
-          }
-
-          {_, account} = changes[{:account, slug}]
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-          uuid = UuidMapping.get_entity(slug, "providers", external_id)
-          case uuid && Auth.fetch_provider_by_id(uuid, temp_admin_subject) |> nil_if_deleted_or_not_found() do
-            nil ->
-              Logger.info("Creating new provider #{provider_data["name"]}")
-              {:ok, provider} = Auth.create_provider(account, provider_attrs)
-              UuidMapping.update_entities(slug, "providers", %{external_id => provider.id})
-              {:ok, provider}
-            {:ok, existing} ->
-              Logger.info("Updating existing provider #{provider_data["name"]}")
-              {:ok, existing |> Ecto.Changeset.change(provider_attrs) |> repo.update!()}
-          end
-        end)
-      end)
-
-      # Create or update gateway_groups
-      multi = Enum.reduce(account_data["gatewayGroups"] || %{}, multi, fn {external_id, gateway_group_data}, multi ->
-        Ecto.Multi.run(multi, {:gateway_group, slug, external_id}, fn _repo, changes ->
-          gateway_group_attrs = %{
-            name: gateway_group_data["name"],
-            tokens: [%{}]
-          }
-
-          {_, account} = changes[{:account, slug}]
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-          uuid = UuidMapping.get_entity(slug, "gateway_groups", external_id)
-          case uuid && Gateways.fetch_group_by_id(uuid, temp_admin_subject) |> nil_if_deleted_or_not_found() do
-            nil ->
-              Logger.info("Creating new gateway group #{gateway_group_data["name"]}")
-              gateway_group = account
-                |> Gateways.Group.Changeset.create(gateway_group_attrs, temp_admin_subject)
-                |> Repo.insert!()
-              UuidMapping.update_entities(slug, "gateway_groups", %{external_id => gateway_group.id})
-              {:ok, gateway_group}
-            {:ok, existing} ->
-              # Nothing to update
-              {:ok, existing}
-          end
-        end)
-      end)
-
-      # Create or update relay_groups
-      multi = Enum.reduce(account_data["relayGroups"] || %{}, multi, fn {external_id, relay_group_data}, multi ->
-        Ecto.Multi.run(multi, {:relay_group, slug, external_id}, fn _repo, changes ->
-          relay_group_attrs = %{
-            name: relay_group_data["name"]
-          }
-
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-          uuid = UuidMapping.get_entity(slug, "relay_groups", external_id)
-          existing_relay_group = uuid && Relays.fetch_group_by_id(uuid, temp_admin_subject)
-          case existing_relay_group do
-            v when v in [nil, {:error, :not_found}] ->
-              Logger.info("Creating new relay group #{relay_group_data["name"]}")
-              {:ok, relay_group} = Relays.create_group(relay_group_attrs, temp_admin_subject)
-              UuidMapping.update_entities(slug, "relay_groups", %{external_id => relay_group.id})
-              {:ok, relay_group}
-            {:ok, existing} ->
-              # Nothing to update
-              {:ok, existing}
-          end
-        end)
-      end)
-
-      # Create or update actor_groups
-      multi = Enum.reduce(account_data["groups"] || %{}, multi, fn {external_id, actor_group_data}, multi ->
-        Ecto.Multi.run(multi, {:actor_group, slug, external_id}, fn _repo, changes ->
-          actor_group_attrs = %{
-            name: actor_group_data["name"],
-            type: :static
-          }
-
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-          uuid = UuidMapping.get_entity(slug, "actor_groups", external_id)
-          case uuid && Actors.fetch_group_by_id(uuid, temp_admin_subject) |> nil_if_deleted_or_not_found() do
-            nil ->
-              Logger.info("Creating new actor group #{actor_group_data["name"]}")
-              {:ok, actor_group} = Actors.create_group(actor_group_attrs, temp_admin_subject)
-              UuidMapping.update_entities(slug, "actor_groups", %{external_id => actor_group.id})
-              {:ok, actor_group}
-            {:ok, existing} ->
-              # Nothing to update
-              {:ok, existing}
-          end
-        end)
-        |> Ecto.Multi.run({:actor_group_members, slug, external_id}, fn repo, changes ->
-          {_, account} = changes[{:account, slug}]
-          group_uuid = UuidMapping.get_entity(slug, "actor_groups", external_id)
-
-          memberships =
-            Actors.Membership.Query.all()
-            |> Actors.Membership.Query.by_group_id(group_uuid)
-            |> Actors.Membership.Query.returning_all()
-            |> Repo.all()
-
-          existing_members = Enum.map(memberships, fn membership -> membership.actor_id end)
-          desired_members = Enum.map(actor_group_data["members"] || [], fn member ->
-            uuid = UuidMapping.get_entity(slug, "actors", member)
-            if uuid == nil do
-              raise "Cannot find provisioned actor #{member} to add to group"
-            end
-            uuid
-          end)
-
-          missing_members = desired_members -- existing_members
-          untracked_members = existing_members -- desired_members
-
-          Logger.info("Updating members for actor group #{external_id}")
-          Enum.each(missing_members || [], fn actor_uuid ->
-            Logger.info("Adding member #{external_id}")
-            Actors.Membership.Changeset.upsert(account.id, %Actors.Membership{}, %{
-              group_id: group_uuid,
-              actor_id: actor_uuid
-            })
-            |> repo.insert!()
-          end)
-
-          if actor_group_data["forceMembers"] == true do
-            # Remove untracked members
-            to_delete = Enum.map(untracked_members, fn actor_uuid -> {group_uuid, actor_uuid} end)
-            if to_delete != [] do
-              Actors.Membership.Query.by_group_id_and_actor_id({:in, to_delete})
-                |> repo.delete_all()
-            end
-          end
-
-          {:ok, nil}
-        end)
-      end)
-
-      # Create or update resources
-      multi = Enum.reduce(account_data["resources"] || %{}, multi, fn {external_id, resource_data}, multi ->
-        Ecto.Multi.run(multi, {:resource, slug, external_id}, fn _repo, changes ->
-          resource_attrs = %{
-            type: String.to_atom(resource_data["type"]),
-            name: resource_data["name"],
-            address: resource_data["address"],
-            address_description: resource_data["address_description"],
-            connections: Enum.map(resource_data["gatewayGroups"] || [], fn group ->
-              %{gateway_group_id: UuidMapping.get_entity(slug, "gateway_groups", group)}
-            end),
-            filters: Enum.map(resource_data["filters"] || [], fn filter ->
-              %{
-                ports: filter["ports"] || [],
-                protocol: String.to_atom(filter["protocol"])
-              }
-            end)
-          }
-
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-          uuid = UuidMapping.get_entity(slug, "resources", external_id)
-          case uuid && fetch_resource(uuid, temp_admin_subject) |> nil_if_deleted_or_not_found() do
-            nil ->
-              Logger.info("Creating new resource #{resource_data["name"]}")
-              {:ok, resource} = Resources.create_resource(resource_attrs, temp_admin_subject)
-              UuidMapping.update_entities(slug, "resources", %{external_id => resource.id})
-              {:ok, resource}
-            {:ok, existing} ->
-              existing = Repo.preload(existing, :connections)
-              Logger.info("Updating existing resource #{resource_data["name"]}")
-              only_updated_attrs = resource_attrs
-                |> Enum.reject(fn {key, value} ->
-                  case key do
-                    # Compare connections by gateway_group_id only
-                    :connections -> value == Enum.map(existing.connections || [], fn conn -> Map.take(conn, [:gateway_group_id]) end)
-                    # Compare filters by ports and protocol only
-                    :filters -> value == Enum.map(existing.filters || [], fn filter -> Map.take(filter, [:ports, :protocol]) end)
-                    _ -> Map.get(existing, key) == value
-                  end
-                end)
-                |> Enum.into(%{})
-
-              if only_updated_attrs == %{} do
-                {:ok, existing}
-              else
-                resource = case existing |> Resources.update_resource(resource_attrs, temp_admin_subject) do
-                  {:replaced, _old, new} ->
-                    UuidMapping.update_entities(slug, "resources", %{external_id => new.id})
-                    new
-                  {:updated, value} -> value
-                  x -> x
-                end
-
-                {:ok, resource}
-              end
-          end
-        end)
-      end)
-
-      # Create or update policies
-      multi = Enum.reduce(account_data["policies"] || %{}, multi, fn {external_id, policy_data}, multi ->
-        Ecto.Multi.run(multi, {:policy, slug, external_id}, fn _repo, changes ->
-          policy_attrs = %{
-            description: policy_data["description"],
-            actor_group_id: UuidMapping.get_entity(slug, "actor_groups", policy_data["group"]),
-            resource_id: UuidMapping.get_entity(slug, "resources", policy_data["resource"])
-          }
-
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-          uuid = UuidMapping.get_entity(slug, "policies", external_id)
-          case uuid && fetch_policy(uuid, temp_admin_subject) |> nil_if_deleted_or_not_found() do
-            nil ->
-              Logger.info("Creating new policy #{policy_data["name"]}")
-              {:ok, policy} = Policies.create_policy(policy_attrs, temp_admin_subject)
-              UuidMapping.update_entities(slug, "policies", %{external_id => policy.id})
-              {:ok, policy}
-            {:ok, existing} ->
-              Logger.info("Updating existing policy #{policy_data["name"]}")
-              only_updated_attrs = policy_attrs
-                |> Enum.reject(fn {key, value} -> Map.get(existing, key) == value end)
-                |> Enum.into(%{})
-
-              if only_updated_attrs == %{} do
-                {:ok, existing}
-              else
-                policy = case existing |> Policies.update_policy(policy_attrs, temp_admin_subject) do
-                  {:replaced, _old, new} ->
-                    UuidMapping.update_entities(slug, "policies", %{external_id => new.id})
-                    new
-                  {:updated, value} -> value
-                  x -> x
-                end
-
-                {:ok, policy}
-              end
-          end
-        end)
-      end)
-
-      # Clean up temporary admin after all operations
-      multi |> Ecto.Multi.run({:cleanup_temp_admin, slug}, fn _repo, changes ->
-        {temp_admin_subject, temp_admin_actor, temp_admin_actor_email_identity, temp_admin_actor_token} =
-          changes[{:temp_admin, slug}]
-
-        cleanup_temp_admin(temp_admin_actor, temp_admin_actor_email_identity, temp_admin_actor_token, temp_admin_subject)
-        {:ok, :cleaned}
-      end)
-    end)
-    |> Ecto.Multi.run({:save_state}, fn _repo, _changes ->
-      # Save all UUID mappings to disk.
-      UuidMapping.save()
-      {:ok, :saved}
-    end)
-
-    case Repo.transaction(multi) do
-      {:ok, _result} ->
-        Logger.info("Provisioning completed successfully")
-      {:error, step, reason, _changes} ->
-        Logger.error("Provisioning failed at step #{inspect(step)}, no changes were applied: #{inspect(reason)}")
-    end
-  end
-end
-
-Provision.provision()

nixos/modules/services/networking/firezone/server.nix

@@ -9,12 +9,8 @@ let
     attrNames
     boolToString
     concatLines
-    concatLists
-    concatMapAttrs
     concatStringsSep
     filterAttrs
-    filterAttrsRecursive
-    flip
     forEach
     getExe
     isBool
@@ -26,16 +22,11 @@ let
     mkMerge
     mkOption
     mkPackageOption
-    optionalAttrs
-    optionalString
-    recursiveUpdate
     subtractLists
-    toUpper
     types
     ;
 
   cfg = config.services.firezone.server;
-  jsonFormat = pkgs.formats.json { };
   availableAuthAdapters = [
     "email"
     "openid_connect"
@@ -47,28 +38,6 @@ let
     "jumpcloud"
   ];
 
-  typePortRange =
-    types.coercedTo types.port
-      (x: {
-        from = x;
-        to = x;
-      })
-      (
-        types.submodule {
-          options = {
-            from = mkOption {
-              type = types.port;
-              description = "The start of the port range, inclusive.";
-            };
-
-            to = mkOption {
-              type = types.port;
-              description = "The end of the port range, inclusive.";
-            };
-          };
-        }
-      );
-
   # All non-secret environment variables or the given component
   collectEnvironment =
     component:
@@ -119,29 +88,6 @@ let
       )
     );
 
-  provisionStateJson =
-    let
-      # Convert clientSecretFile options into the real counterpart
-      augmentedAccounts = flip mapAttrs cfg.provision.accounts (
-        accountName: account:
-        account
-        // {
-          auth = flip mapAttrs account.auth (
-            authName: auth:
-            recursiveUpdate auth (
-              optionalAttrs (auth.adapter_config.clientSecretFile != null) {
-                adapter_config.client_secret = "{env:AUTH_CLIENT_SECRET_${toUpper accountName}_${toUpper authName}}";
-              }
-            )
-          );
-        }
-      );
-    in
-    jsonFormat.generate "provision-state.json" {
-      # Do not include any clientSecretFile attributes in the resulting json
-      accounts = filterAttrsRecursive (k: _: k != "clientSecretFile") augmentedAccounts;
-    };
-
   commonServiceConfig = {
     AmbientCapabilities = [ ];
     CapabilityBoundingSet = [ ];
@@ -222,6 +168,12 @@ let
   };
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "firezone" "server" "provision" ] ''
+      Firezone provisioning support has been removed due to outsized maintenance efforts. See https://github.com/NixOS/nixpkgs/pull/529428.
+    '')
+  ];
+
   options.services.firezone.server = {
     enable = mkEnableOption "all Firezone components";
     enableLocalDB = mkEnableOption "a local postgresql database for Firezone";
@@ -521,393 +473,9 @@ in
         description = "A list of trusted proxies";
       };
     };
-
-    provision = {
-      enable = mkEnableOption "provisioning of the Firezone domain server";
-      accounts = mkOption {
-        type = types.attrsOf (
-          types.submodule {
-            freeformType = jsonFormat.type;
-            options = {
-              name = mkOption {
-                type = types.str;
-                description = "The account name";
-                example = "My Organization";
-              };
-
-              features =
-                let
-                  mkFeatureOption =
-                    name: default:
-                    mkOption {
-                      type = types.bool;
-                      inherit default;
-                      description = "Whether to enable the `${name}` feature for this account.";
-                    };
-                in
-                {
-                  policy_conditions = mkFeatureOption "policy_conditions" true;
-                  multi_site_resources = mkFeatureOption "multi_site_resources" true;
-                  traffic_filters = mkFeatureOption "traffic_filters" true;
-                  self_hosted_relays = mkFeatureOption "self_hosted_relays" true;
-                  idp_sync = mkFeatureOption "idp_sync" true;
-                  rest_api = mkFeatureOption "rest_api" true;
-                  internet_resource = mkFeatureOption "internet_resource" true;
-                };
-
-              actors = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    options = {
-                      type = mkOption {
-                        type = types.enum [
-                          "account_admin_user"
-                          "account_user"
-                          "service_account"
-                          "api_client"
-                        ];
-                        description = "The account type";
-                      };
-
-                      name = mkOption {
-                        type = types.str;
-                        description = "The name of this actor";
-                      };
-
-                      email = mkOption {
-                        type = types.str;
-                        description = "The email address used to authenticate as this account";
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  admin = {
-                    type = "account_admin_user";
-                    name = "Admin";
-                    email = "admin@myorg.example.com";
-                  };
-                };
-                description = ''
-                  All actors (users) to provision. The attribute name will only
-                  be used to track the actor and does not have any significance
-                  for Firezone.
-                '';
-              };
-
-              auth = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    freeformType = jsonFormat.type;
-                    options = {
-                      name = mkOption {
-                        type = types.str;
-                        description = "The name of this authentication provider";
-                      };
-
-                      adapter = mkOption {
-                        type = types.enum availableAuthAdapters;
-                        description = "The auth adapter type";
-                      };
-
-                      adapter_config.clientSecretFile = mkOption {
-                        type = types.nullOr types.path;
-                        default = null;
-                        description = ''
-                          A file containing a the client secret for an openid_connect adapter.
-                          You only need to set this if this is an openid_connect provider.
-                        '';
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  myoidcprovider = {
-                    adapter = "openid_connect";
-                    adapter_config = {
-                      client_id = "clientid";
-                      clientSecretFile = "/run/secrets/oidc-client-secret";
-                      response_type = "code";
-                      scope = "openid email name";
-                      discovery_document_uri = "https://auth.example.com/.well-known/openid-configuration";
-                    };
-                  };
-                };
-                description = ''
-                  All authentication providers to provision. The attribute name
-                  will only be used to track the provider and does not have any
-                  significance for Firezone.
-                '';
-              };
-
-              resources = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    options = {
-                      type = mkOption {
-                        type = types.enum [
-                          "dns"
-                          "cidr"
-                          "ip"
-                        ];
-                        description = "The resource type";
-                      };
-
-                      name = mkOption {
-                        type = types.str;
-                        description = "The name of this resource";
-                      };
-
-                      address = mkOption {
-                        type = types.str;
-                        description = "The address of this resource. Depending on the resource type, this should be an ip, ip with cidr mask or a domain.";
-                      };
-
-                      addressDescription = mkOption {
-                        type = types.nullOr types.str;
-                        default = null;
-                        description = "An optional description for resource address, usually a full link to the resource including a schema.";
-                      };
-
-                      gatewayGroups = mkOption {
-                        type = types.nonEmptyListOf types.str;
-                        description = "A list of gateway groups (sites) which can reach the resource and may be used to connect to it.";
-                      };
-
-                      filters = mkOption {
-                        type = types.listOf (
-                          types.submodule {
-                            options = {
-                              protocol = mkOption {
-                                type = types.enum [
-                                  "icmp"
-                                  "tcp"
-                                  "udp"
-                                ];
-                                description = "The protocol to allow";
-                              };
-
-                              ports = mkOption {
-                                type = types.listOf typePortRange;
-                                example = [
-                                  443
-                                  {
-                                    from = 8080;
-                                    to = 8100;
-                                  }
-                                ];
-                                default = [ ];
-                                apply =
-                                  xs: map (x: if x.from == x.to then toString x.from else "${toString x.from} - ${toString x.to}") xs;
-                                description = "Either a single port or port range to allow. Both bounds are inclusive.";
-                              };
-                            };
-                          }
-                        );
-                        default = [ ];
-                        description = "A list of filter to restrict traffic. If no filters are given, all traffic is allowed.";
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  vaultwarden = {
-                    type = "dns";
-                    name = "Vaultwarden";
-                    address = "vault.example.com";
-                    address_description = "https://vault.example.com";
-                    gatewayGroups = [ "my-site" ];
-                    filters = [
-                      { protocol = "icmp"; }
-                      {
-                        protocol = "tcp";
-                        ports = [
-                          80
-                          443
-                        ];
-                      }
-                    ];
-                  };
-                };
-                description = ''
-                  All resources to provision. The attribute name will only be used to
-                  track the resource and does not have any significance for Firezone.
-                '';
-              };
-
-              policies = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    options = {
-                      description = mkOption {
-                        type = types.nullOr types.str;
-                        description = "The description of this policy";
-                      };
-
-                      group = mkOption {
-                        type = types.str;
-                        description = "The group which should be allowed access to the given resource.";
-                      };
-
-                      resource = mkOption {
-                        type = types.str;
-                        description = "The resource to which access should be allowed.";
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  access_vaultwarden = {
-                    name = "Allow anyone to access vaultwarden";
-                    group = "everyone";
-                    resource = "vaultwarden";
-                  };
-                };
-                description = ''
-                  All policies to provision. The attribute name will only be used to
-                  track the policy and does not have any significance for Firezone.
-                '';
-              };
-
-              groups = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    options = {
-                      name = mkOption {
-                        type = types.str;
-                        description = "The name of this group";
-                      };
-
-                      members = mkOption {
-                        type = types.listOf types.str;
-                        default = [ ];
-                        description = "The members of this group";
-                      };
-
-                      forceMembers = mkOption {
-                        type = types.bool;
-                        default = false;
-                        description = "Ensure that only the given members are part of this group at every server start.";
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  users = {
-                    name = "Users";
-                  };
-                };
-                description = ''
-                  All groups to provision. The attribute name will only be used
-                  to track the group and does not have any significance for
-                  Firezone.
-
-                  A group named `everyone` will automatically be managed by Firezone.
-                '';
-              };
-
-              relayGroups = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    options = {
-                      name = mkOption {
-                        type = types.str;
-                        description = "The name of this relay group";
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  my-relays = {
-                    name = "My Relays";
-                  };
-                };
-                description = ''
-                  All relay groups to provision. The attribute name
-                  will only be used to track the relay group and does not have any
-                  significance for Firezone.
-                '';
-              };
-
-              gatewayGroups = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    options = {
-                      name = mkOption {
-                        type = types.str;
-                        description = "The name of this gateway group";
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  my-gateways = {
-                    name = "My Gateways";
-                  };
-                };
-                description = ''
-                  All gateway groups (sites) to provision. The attribute name
-                  will only be used to track the gateway group and does not have any
-                  significance for Firezone.
-                '';
-              };
-            };
-          }
-        );
-        default = { };
-        example = {
-          main = {
-            name = "My Account / Organization";
-            metadata.stripe.billing_email = "org@myorg.example.com";
-            features.rest_api = false;
-          };
-        };
-        description = ''
-          All accounts to provision. The attribute name specified here will
-          become the account slug. By using `"{file:/path/to/file}"` as a
-          string value anywhere in these settings, the provisioning script will
-          replace that value with the content of the given file at runtime.
-
-          Please refer to the [Firezone source code](https://github.com/firezone/firezone/blob/main/elixir/apps/domain/lib/domain/accounts/account.ex)
-          for all available properties.
-        '';
-      };
-    };
   };
 
   config = mkMerge [
-    {
-      assertions = [
-        {
-          assertion = cfg.provision.enable -> cfg.domain.enable;
-          message = "Provisioning must be done on a machine running the firezone domain server";
-        }
-      ]
-      ++ concatLists (
-        flip mapAttrsToList cfg.provision.accounts (
-          accountName: accountCfg:
-          [
-            {
-              assertion = (builtins.match "^[[:lower:]_-]+$" accountName) != null;
-              message = "An account name must contain only lowercase characters and underscores, as it will be used as the URL slug for this account.";
-            }
-          ]
-          ++ flip mapAttrsToList accountCfg.auth (
-            authName: _: {
-              assertion = (builtins.match "^[[:alnum:]_-]+$" authName) != null;
-              message = "The authentication provider attribute key must contain only letters, numbers, underscores or dashes.";
-            }
-          )
-        )
-      );
-    }
     # Enable all components if the main server is enabled
     (mkIf cfg.enable {
       services.firezone.server.domain.enable = true;
@@ -1015,7 +583,7 @@ in
           FEATURE_INTERNET_RESOURCE_ENABLED = mkDefault true;
           FEATURE_TRAFFIC_FILTERS_ENABLED = mkDefault true;
 
-          FEATURE_SIGN_UP_ENABLED = mkDefault (!cfg.provision.enable);
+          FEATURE_SIGN_UP_ENABLED = mkDefault true;
 
           WEB_EXTERNAL_URL = mkDefault cfg.web.externalUrl;
           API_EXTERNAL_URL = mkDefault cfg.api.externalUrl;
@@ -1066,19 +634,6 @@ in
         OUTBOUND_EMAIL_SMTP_PASSWORD = cfg.smtp.passwordFile;
       };
     })
-    (mkIf cfg.provision.enable {
-      # Load client secrets from authentication providers
-      services.firezone.server.settingsSecret = flip concatMapAttrs cfg.provision.accounts (
-        accountName: accountCfg:
-        flip concatMapAttrs accountCfg.auth (
-          authName: authCfg:
-          optionalAttrs (authCfg.adapter_config.clientSecretFile != null) {
-            "AUTH_CLIENT_SECRET_${toUpper accountName}_${toUpper authName}" =
-              authCfg.adapter_config.clientSecretFile;
-          }
-        )
-      );
-    })
     (mkIf (cfg.openClusterFirewall && cfg.domain.enable) {
       networking.firewall.allowedTCPPorts = [
         cfg.domain.settings.ERLANG_DISTRIBUTION_PORT
@@ -1156,14 +711,6 @@ in
             fi
             count=$((count++))
           done
-        ''
-        + optionalString cfg.provision.enable ''
-          # Wait for server to fully come up. Not ideal to use sleep, but at least it works.
-          sleep 1
-
-          ${loadSecretEnvironment "domain"}
-          ln -sTf ${provisionStateJson} provision-state.json
-          ${getExe cfg.domain.package} rpc 'Code.eval_file("${./provision.exs}")'
         '';
 
         environment = collectEnvironment "domain";

nixos/modules/services/networking/ssh/sshd.nix

@@ -26,6 +26,8 @@ let
           toString v
         else if lib.isString v then
           v
+        else if lib.isPath v then
+          v
         else if true == v then
           "yes"
         else if false == v then

nixos/modules/services/networking/wpa_supplicant.nix

@@ -128,7 +128,7 @@ let
           ]
           ++ lib.optionals cfg.userControlled [
             # set up client sockets directory
-            "+${pkgs.coreutils}/bin/mkdir /run/wpa_supplicant/client"
+            "+${pkgs.coreutils}/bin/mkdir -p /run/wpa_supplicant/client"
             "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /run/wpa_supplicant/client"
             "+${pkgs.coreutils}/bin/chmod g=u /run/wpa_supplicant/client"
           ];
@@ -565,9 +565,9 @@ in
           coercedTo attrs (
             val:
             if builtins.isAttrs val && val ? enable then
-              trace "Obsolete option `networking.wireless.userControlled.enable' is used. It was renamed to networking.wireless.userControlled" val.enable
+              warn "Obsolete option `networking.wireless.userControlled.enable' is used. It was renamed to networking.wireless.userControlled" val.enable
             else if builtins.isAttrs val && val ? group then
-              trace
+              warn
                 "The option definition `networking.wireless.userControlled.group' no longer has any effect. The group is now fixed to `wpa_supplicant'."
                 (val.enable or false)
             else if builtins.isBool val then

nixos/modules/services/scheduling/scx-loader.nix

@@ -0,0 +1,95 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  cfg = config.services.scx-loader;
+  settingsFormat = pkgs.formats.toml { };
+  configFile = settingsFormat.generate "scx_loader.toml" (
+    lib.filterAttrsRecursive (_: v: v != null) cfg.config
+  );
+
+  schedulers = builtins.concatMap (
+    x: x.passthru.schedulers or (throw "Scheduler not found in package ${x.name}")
+  ) cfg.schedsPackages;
+in
+{
+  options.services.scx-loader = {
+    enable = lib.mkEnableOption "SCX Loader service, a daemon to run schedulers from userspace using dbus. This requires kernel version 6.12 and later.";
+
+    package = lib.mkPackageOption pkgs "scx-loader" { };
+
+    schedsPackages = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = [ pkgs.scx.rustscheds ];
+      defaultText = lib.literalExpression "[ pkgs.scx.rustscheds ]";
+      example = lib.literalExpression "[ pkgs.scx.full ]";
+      description = ''
+        `scx` package to use. Defaults to `scx.rustscheds`, which includes all currently by `scx_loader` supported schedulers.
+      '';
+    };
+
+    config = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+
+        options = {
+          default_sched = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "scx_bpfland";
+            description = ''
+              Default scheduler that will be started automatically when `scx_loader` starts.
+              If not set or set to an empty string, `scx_loader` will not start any scheduler by default.
+            '';
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Configuration for `scx_loader`.
+
+        See <https://github.com/sched-ext/scx-loader/blob/main/crates/scx_loader/configuration.md> for the full list of options.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.12";
+        message = "SCX is only supported on kernel version 6.12 and above.";
+      }
+      {
+        assertion = !config.services.scx.enable;
+        message = "services.scx and services.scx_loader cannot be enabled simultaneously. Please enable only one of them.";
+      }
+      {
+        assertion =
+          cfg.config.default_sched == null || lib.elem cfg.config.default_sched ([ "" ] ++ schedulers);
+        message = ''
+          Invalid default scheduler: ${cfg.config.default_sched}. It must be one of: ${lib.concatStringsSep ", " schedulers}.
+        '';
+      }
+    ];
+
+    environment.systemPackages = [ cfg.package ] ++ cfg.schedsPackages;
+    systemd.packages = [ cfg.package ];
+    services.dbus.packages = [ cfg.package ];
+
+    security.polkit.enable = true;
+
+    systemd.services.scx_loader = {
+      path = cfg.schedsPackages;
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        TemporaryFileSystem = [ "/etc" ];
+        BindReadOnlyPaths = [ "${configFile.outPath}:/etc/scx_loader.toml" ];
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ ccicnce113424 ];
+}

nixos/modules/services/security/opensnitch.nix

@@ -13,6 +13,7 @@ let
       file = pkgs.writeText "rule" (builtins.toJSON cfg);
     }
   );
+  stateDir = lib.strings.match "/var/lib/([^/]+)/.+" cfg.settings.Rules.Path;
 in
 {
   options = {
@@ -105,10 +106,9 @@ in
                 "iptables"
                 "nftables"
               ];
-              default = if config.networking.nftables.enable then "nftables" else "iptables";
-              defaultText = lib.literalExpression ''if config.networking.nftables.enable then "nftables" else "iptables"'';
+              default = "nftables";
               description = ''
-                Which firewall backend to use.
+                Which firewall backend to use. `nftables` ruleset can be used for `iptables` firewall too, if `iptables` is built with nftables compatibility.
               '';
             };
             Ebpf.ModulesPath = lib.mkOption {
@@ -139,7 +139,10 @@ in
             };
 
             Rules.Path = lib.mkOption {
-              type = lib.types.path;
+              type = lib.types.pathWith {
+                inStore = false;
+                absolute = true;
+              };
               default = "/var/lib/opensnitch/rules";
               description = ''
                 Path to the directory where firewall rules can be found and will
@@ -158,6 +161,12 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = stateDir != null;
+        message = "`config.services.opensnitch.settings.Rules.Path` must be a sub-directory of /var/lib/, currently is ${cfg.settings.Rules.Path}";
+      }
+    ];
 
     security.auditd = lib.mkIf (cfg.settings.ProcMonitorMethod == "audit") {
       enable = true;
@@ -174,8 +183,14 @@ in
             ""
             "${lib.getExe' cfg.package "opensnitchd"} --config-file ${cfg.configFile}"
           ];
+          StateDirectory = builtins.head stateDir; # match produces a list. Null case covered by assertion.
         };
-        preStart = lib.mkIf (cfg.rules != { }) (
+        preStart = ''
+          # assert rules directory exists before service starts
+          # will be in StateDirectory due to assertion
+          mkdir -p ${cfg.settings.Rules.Path}
+        ''
+        + lib.optionalString (cfg.rules != { }) (
           let
             rules = lib.flip lib.mapAttrsToList predefinedRules (
               file: content: {
@@ -205,13 +220,12 @@ in
           ''
         );
       };
-      tmpfiles.rules = [
-        "d ${cfg.settings.Rules.Path} 0750 root root - -"
-        "L+ /etc/opensnitchd/network_aliases.json - - - - ${cfg.package}/etc/opensnitchd/network_aliases.json"
-        "L+ /etc/opensnitchd/system-fw.json - - - - ${cfg.package}/etc/opensnitchd/system-fw.json"
-      ];
     };
 
+    environment.etc."opensnitchd/network_aliases.json".source =
+      "${cfg.package}/etc/opensnitchd/network_aliases.json";
+    environment.etc."opensnitchd/system-fw.json".source =
+      "${cfg.package}/etc/opensnitchd/system-fw.json";
   };
 
   meta.maintainers = with lib.maintainers; [

nixos/modules/services/web-apps/lauti.nix

@@ -17,8 +17,6 @@ in
 {
 
   imports = [
-    # since 0.12.0 (2025-05-26) release, upstream re-branded project to 'stalwart' due to inclusion of collaboration features (CalDAV, CardDAV, and WebDAV)
-    #  https://github.com/stalwartlabs/stalwart/releases/tag/v0.12.0
     (lib.mkRenamedOptionModule [ "services" "eintopf" ] [ "services" "lauti" ])
   ];
 
@@ -74,7 +72,7 @@ in
         ExecStart = lib.getExe pkgs.lauti;
         WorkingDirectory = cfg.dataDir;
         StateDirectory = default;
-        EnvironmentFile = [ cfg.secrets ];
+        EnvironmentFile = cfg.secrets;
 
         # hardening
         AmbientCapabilities = "";

nixos/modules/services/web-apps/wakapi.nix

@@ -196,14 +196,12 @@ in
       }
     ];
 
-    warnings = [
-      (lib.optionalString (cfg.database.createLocally && cfg.settings.db.dialect != "postgres") ''
-        You have enabled automatic database configuration, but the database dialect is not set to "posgres".
+    warnings = lib.optional (cfg.database.createLocally && cfg.settings.db.dialect != "postgres") ''
+      You have enabled automatic database configuration, but the database dialect is not set to "postgres".
 
-        The Wakapi module only supports PostgreSQL. Please set `services.wakapi.database.createLocally`
-        to `false`, or switch to "postgres" as your database dialect.
-      '')
-    ];
+      The Wakapi module only supports PostgreSQL. Please set `services.wakapi.database.createLocally`
+      to `false`, or switch to "postgres" as your database dialect.
+    '';
 
     users = {
       users.wakapi = {

nixos/modules/services/x11/desktop-managers/cde.nix

@@ -71,10 +71,12 @@ in
       };
     };
 
-    system.activationScripts.setup-cde = ''
-      mkdir -p /var/dt/{tmp,appconfig/appmanager}
-      chmod a+w+t /var/dt/{tmp,appconfig/appmanager}
-    '';
+    systemd.tmpfiles.settings."10-cde" = {
+      "/var/dt".d.mode = "0755";
+      "/var/dt/tmp".d.mode = "1777";
+      "/var/dt/appconfig".d.mode = "0755";
+      "/var/dt/appconfig/appmanager".d.mode = "1777";
+    };
 
     services.xserver.desktopManager.session = [
       {

nixos/modules/system/activation/bootspec.nix

@@ -26,9 +26,11 @@ let
             // {
               "org.nixos.bootspec.v1" = {
                 system = config.boot.kernelPackages.stdenv.hostPlatform.system;
+                label = "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})";
+              }
+              // lib.optionalAttrs config.boot.kernel.enable {
                 kernel = "${config.boot.kernelPackages.kernel}/${config.system.boot.loader.kernelFile}";
                 kernelParams = config.boot.kernelParams;
-                label = "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})";
               }
               // lib.optionalAttrs config.boot.initrd.enable {
                 initrd = "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
@@ -97,13 +99,13 @@ let
   };
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "boot" "bootspec" "enable" ] ''
+      Bootspec is now always generated and can no longer be disabled.
+    '')
+  ];
+
   options.boot.bootspec = {
-    enable =
-      lib.mkEnableOption "the generation of RFC-0125 bootspec in $system/boot.json, e.g. /run/current-system/boot.json"
-      // {
-        default = true;
-        internal = true;
-      };
     enableValidation = lib.mkEnableOption ''
       the validation of bootspec documents for each build.
             This will introduce Go in the build-time closure as we are relying on [Cuelang](https://cuelang.org/) for schema validation.

nixos/modules/system/activation/top-level.nix

@@ -44,7 +44,7 @@ let
 
     printf "%s " "''${extraDependencies[@]}" > "$out/extra-dependencies"
 
-    ${optionalString (!config.boot.isContainer && config.boot.bootspec.enable) ''
+    ${optionalString (!config.boot.isContainer) ''
       ${config.boot.bootspec.writer}
       ${optionalString config.boot.bootspec.enableValidation ''${config.boot.bootspec.validator} "$out/${config.boot.bootspec.filename}"''}
     ''}
@@ -139,8 +139,8 @@ in
 
     system.boot.loader.kernelFile = mkOption {
       internal = true;
-      default = pkgs.stdenv.hostPlatform.linux-kernel.target;
-      defaultText = literalExpression "pkgs.stdenv.hostPlatform.linux-kernel.target";
+      default = config.boot.kernelPackages.kernel.target;
+      defaultText = literalExpression "config.boot.kernelPackages.kernel.target";
       type = types.str;
       description = ''
         Name of the kernel file to be passed to the bootloader.

nixos/modules/system/boot/loader/generations-dir/generations-dir.nix

@@ -66,7 +66,6 @@ in
 
     system.build.installBootLoader = generationsDirBuilder;
     system.boot.loader.id = "generationsDir";
-    system.boot.loader.kernelFile = pkgs.stdenv.hostPlatform.linux-kernel.target;
 
   };
 }

nixos/modules/system/boot/loader/limine/limine.nix

@@ -503,7 +503,9 @@ in
 
         script = ''
           fwupd_efi=(${config.services.fwupd.package.fwupd-efi}/libexec/fwupd/efi/fwupd*.efi)
-          ${lib.getExe cfg.secureBoot.sbctl} sign -o /run/fwupd-efi/$(basename "$fwupd_efi").signed "$fwupd_efi"
+          for efi in "''${fwupd_efi[@]}"; do
+            ${lib.getExe cfg.secureBoot.sbctl} sign -o "/run/fwupd-efi/$(basename "$efi").signed" "$efi"
+          done
         '';
       };
 

nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py

@@ -27,7 +27,6 @@ NIXOS_DIR = Path(
 TIMEOUT = "@timeout@"
 EDITOR = "@editor@" == "1"  # noqa: PLR0133
 CONSOLE_MODE = "@consoleMode@"
-BOOTSPEC_TOOLS = "@bootspecTools@"
 DISTRO_NAME = "@distroName@"
 NIX = "@nix@"
 SYSTEMD = "@systemd@"
@@ -291,31 +290,26 @@ def write_loader_conf(default_entry_id: str | None) -> None:
     os.rename(tmp, LOADER_CONF)
 
 
-def get_bootspec(profile: str | None, generation: int) -> BootSpec:
+def get_bootspec(profile: str | None, generation: int) -> BootSpec | None:
     system_directory = system_dir(profile, generation, None)
     boot_json_path = (system_directory / "boot.json").resolve()
-    if boot_json_path.is_file():
-        with boot_json_path.open("r") as f:
-            # check if json is well-formed, else throw error with filepath
-            try:
-                bootspec_json = json.load(f)
-            except ValueError as e:
-                print(
-                    f"error: Malformed Json: {e}, in {boot_json_path}", file=sys.stderr
-                )
-                sys.exit(1)
-    else:
-        boot_json_str = run(
-            [
-                f"{BOOTSPEC_TOOLS}/bin/synthesize",
-                "--version",
-                "1",
-                system_directory,
-                "/dev/stdout",
-            ],
-            stdout=subprocess.PIPE,
-        ).stdout
-        bootspec_json = json.loads(boot_json_str)
+    if not boot_json_path.is_file():
+        print(
+            f"warning: skipping generation {generation}"
+            + (f" of profile {profile}" if profile else "")
+            + f": {boot_json_path} does not exist",
+            file=sys.stderr,
+        )
+        return None
+    with boot_json_path.open("r") as f:
+        # check if json is well-formed, else throw error with filepath
+        try:
+            bootspec_json = json.load(f)
+        except ValueError as e:
+            print(
+                f"error: Malformed Json: {e}, in {boot_json_path}", file=sys.stderr
+            )
+            sys.exit(1)
     return bootspec_from_json(bootspec_json)
 
 
@@ -551,6 +545,8 @@ def install_bootloader(args: argparse.Namespace) -> None:
 
     for gen in gens:
         bootspec = get_bootspec(gen.profile, gen.generation)
+        if bootspec is None:
+            continue
         is_default = Path(bootspec.init).parent == default_config
         new_boot_files, new_bootctl_id = boot_file(*gen, machine_id, bootspec)
         boot_files.extend(new_boot_files)

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix

@@ -47,8 +47,6 @@ let
 
       systemd = config.systemd.package;
 
-      bootspecTools = config.boot.bootspec.package;
-
       nix = config.nix.package.out;
 
       timeout = if config.boot.loader.timeout == null then "menu-force" else config.boot.loader.timeout;

nixos/modules/system/boot/systemd.nix

@@ -40,6 +40,7 @@ let
     "network-online.target"
     "nss-lookup.target"
     "nss-user-lookup.target"
+    "time-set.target"
     "time-sync.target"
     "first-boot-complete.target"
   ]
@@ -808,7 +809,7 @@ in
     systemd.targets.remote-fs.unitConfig.X-StopOnReconfiguration = true;
     systemd.services.systemd-importd = lib.mkIf cfg.package.withImportd {
       environment = proxy_env;
-      path = [ pkgs.gnupg ];
+      path = [ pkgs.gnupgMinimal ];
     };
     systemd.services.systemd-pstore.wantedBy = [ "sysinit.target" ]; # see #81138
 

nixos/modules/system/boot/systemd/logind.nix

@@ -64,13 +64,13 @@
     environment.etc."systemd/logind.conf".text =
       utils.systemdUtils.lib.settingsToSections config.services.logind.settings;
 
-    # Restarting systemd-logind breaks X11
+    # Restarting systemd-logind breaks X11 and other user sessions.
+    # However, reloading the service seems to do the trick of loading new configuration without breaking anything.
     # - upstream commit: https://cgit.freedesktop.org/xorg/xserver/commit/?id=dc48bd653c7e101
     # - systemd announcement: https://github.com/systemd/systemd/blob/22043e4317ecd2bc7834b48a6d364de76bb26d91/NEWS#L103-L112
     # - this might be addressed in the future by xorg
     #systemd.services.systemd-logind.restartTriggers = [ config.environment.etc."systemd/logind.conf".source ];
-    systemd.services.systemd-logind.restartIfChanged = false;
-    systemd.services.systemd-logind.stopIfChanged = false;
+    systemd.services.systemd-logind.reloadIfChanged = true;
 
     # The user-runtime-dir@ service is managed by systemd-logind we should not touch it or else we break the users' sessions.
     systemd.services."user-runtime-dir@".stopIfChanged = false;

nixos/modules/system/boot/systemd/sysupdate.nix

@@ -138,7 +138,7 @@ in
 
     systemd.services.systemd-sysupdated = {
       aliases = [ "dbus-org.freedesktop.sysupdate1.service" ];
-      path = [ pkgs.gnupg ];
+      path = [ pkgs.gnupgMinimal ];
     };
 
     systemd.timers = {

nixos/modules/system/boot/systemd/user.nix

@@ -5,16 +5,13 @@
   utils,
   ...
 }:
-with utils;
-with systemdUtils.unitOptions;
-with lib;
 
 let
   cfg = config.systemd.user;
 
   systemd = config.systemd.package;
 
-  inherit (systemdUtils.lib)
+  inherit (utils.systemdUtils.lib)
     generateUnits
     targetToUnit
     serviceToUnit
@@ -53,7 +50,7 @@ let
       user ? null,
     }:
     let
-      suffix = optionalString (user != null) "-${user}";
+      suffix = lib.optionalString (user != null) "-${user}";
     in
     pkgs.writeTextFile {
       name = "nixos-user-tmpfiles.d${suffix}";
@@ -61,74 +58,86 @@ let
       text = ''
         # This file is created automatically and should not be modified.
         # Please change the options ‘systemd.user.tmpfiles’ instead.
-        ${concatStringsSep "\n" rules}
+        ${lib.concatStringsSep "\n" rules}
       '';
     };
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "systemd"
+      "user"
+      "extraConfig"
+    ] "Use systemd.user.settings.Manager instead.")
+  ];
+
   options = {
-    systemd.user.extraConfig = mkOption {
-      default = "";
-      type = types.lines;
-      example = "DefaultTimeoutStartSec=60";
+    systemd.user.settings.Manager = lib.mkOption {
+      default = { };
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf utils.systemdUtils.unitOptions.unitOption;
+      };
+      example = {
+        DefaultTimeoutStartSec = 60;
+      };
       description = ''
-        Extra config options for systemd user instances. See {manpage}`systemd-user.conf(5)` for
-        available options.
+        Settings for systemd user instances. See {manpage}`systemd-user.conf(5)`
+        for available options.
       '';
     };
 
-    systemd.user.units = mkOption {
+    systemd.user.units = lib.mkOption {
       description = "Definition of systemd per-user units.";
       default = { };
-      type = systemdUtils.types.units;
+      type = utils.systemdUtils.types.units;
     };
 
-    systemd.user.paths = mkOption {
+    systemd.user.paths = lib.mkOption {
       default = { };
-      type = systemdUtils.types.paths;
+      type = utils.systemdUtils.types.paths;
       description = "Definition of systemd per-user path units.";
     };
 
-    systemd.user.services = mkOption {
+    systemd.user.services = lib.mkOption {
       default = { };
-      type = systemdUtils.types.services;
+      type = utils.systemdUtils.types.services;
       description = "Definition of systemd per-user service units.";
     };
 
-    systemd.user.slices = mkOption {
+    systemd.user.slices = lib.mkOption {
       default = { };
-      type = systemdUtils.types.slices;
+      type = utils.systemdUtils.types.slices;
       description = "Definition of systemd per-user slice units.";
     };
 
-    systemd.user.sockets = mkOption {
+    systemd.user.sockets = lib.mkOption {
       default = { };
-      type = systemdUtils.types.sockets;
+      type = utils.systemdUtils.types.sockets;
       description = "Definition of systemd per-user socket units.";
     };
 
-    systemd.user.targets = mkOption {
+    systemd.user.targets = lib.mkOption {
       default = { };
-      type = systemdUtils.types.targets;
+      type = utils.systemdUtils.types.targets;
       description = "Definition of systemd per-user target units.";
     };
 
-    systemd.user.timers = mkOption {
+    systemd.user.timers = lib.mkOption {
       default = { };
-      type = systemdUtils.types.timers;
+      type = utils.systemdUtils.types.timers;
       description = "Definition of systemd per-user timer units.";
     };
 
     systemd.user.tmpfiles = {
       enable =
-        (mkEnableOption "systemd user units systemd-tmpfiles-setup.service and systemd-tmpfiles-clean.timer")
+        (lib.mkEnableOption "systemd user units systemd-tmpfiles-setup.service and systemd-tmpfiles-clean.timer")
         // {
           default = true;
           example = false;
         };
 
-      rules = mkOption {
-        type = types.listOf types.str;
+      rules = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         example = [ "D %C - - - 7d" ];
         description = ''
@@ -139,17 +148,17 @@ in
         '';
       };
 
-      users = mkOption {
+      users = lib.mkOption {
         description = ''
           Per-user rules for creation, deletion and cleaning of volatile and
           temporary files automatically.
         '';
         default = { };
-        type = types.attrsOf (
-          types.submodule {
+        type = lib.types.attrsOf (
+          lib.types.submodule {
             options = {
-              rules = mkOption {
-                type = types.listOf types.str;
+              rules = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
                 default = [ ];
                 example = [ "D %C - - - 7d" ];
                 description = ''
@@ -165,8 +174,8 @@ in
       };
     };
 
-    systemd.user.generators = mkOption {
-      type = types.attrsOf types.path;
+    systemd.user.generators = lib.mkOption {
+      type = lib.types.attrsOf lib.types.path;
       default = { };
       example = {
         systemd-gpt-auto-generator = "/dev/null";
@@ -179,9 +188,9 @@ in
       '';
     };
 
-    systemd.additionalUpstreamUserUnits = mkOption {
+    systemd.additionalUpstreamUserUnits = lib.mkOption {
       default = [ ];
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
       example = [ ];
       description = ''
         Additional units shipped with systemd that should be enabled for per-user systemd instances.
@@ -203,29 +212,26 @@ in
         upstreamWants = [ ];
       };
 
-      "systemd/user.conf".text = ''
-        [Manager]
-        ${cfg.extraConfig}
-      '';
+      "systemd/user.conf".text = utils.systemdUtils.lib.settingsToSections cfg.settings;
     };
 
     systemd.user.units =
-      mapAttrs' (n: v: nameValuePair "${n}.path" (pathToUnit v)) cfg.paths
-      // mapAttrs' (n: v: nameValuePair "${n}.service" (serviceToUnit v)) cfg.services
-      // mapAttrs' (n: v: nameValuePair "${n}.slice" (sliceToUnit v)) cfg.slices
-      // mapAttrs' (n: v: nameValuePair "${n}.socket" (socketToUnit v)) cfg.sockets
-      // mapAttrs' (n: v: nameValuePair "${n}.target" (targetToUnit v)) cfg.targets
-      // mapAttrs' (n: v: nameValuePair "${n}.timer" (timerToUnit v)) cfg.timers;
+      lib.mapAttrs' (n: v: lib.nameValuePair "${n}.path" (pathToUnit v)) cfg.paths
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.service" (serviceToUnit v)) cfg.services
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.slice" (sliceToUnit v)) cfg.slices
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.socket" (socketToUnit v)) cfg.sockets
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.target" (targetToUnit v)) cfg.targets
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.timer" (timerToUnit v)) cfg.timers;
 
     systemd.user.timers = {
       # enable systemd user tmpfiles
-      systemd-tmpfiles-clean.wantedBy = optional cfg.tmpfiles.enable "timers.target";
+      systemd-tmpfiles-clean.wantedBy = lib.optional cfg.tmpfiles.enable "timers.target";
     }
     # Generate timer units for all services that have a ‘startAt’ value.
-    // (mapAttrs (name: service: {
+    // (lib.mapAttrs (name: service: {
       wantedBy = [ "timers.target" ];
       timerConfig.OnCalendar = service.startAt;
-    }) (filterAttrs (name: service: service.startAt != [ ]) cfg.services));
+    }) (lib.filterAttrs (name: service: service.startAt != [ ]) cfg.services));
 
     # Provide the systemd-user PAM service, required to run systemd
     # user instances.
@@ -244,18 +250,19 @@ in
     systemd.services.systemd-user-sessions.restartIfChanged = false; # Restart kills all active sessions.
 
     # enable systemd user tmpfiles
-    systemd.user.services.systemd-tmpfiles-setup.wantedBy = optional cfg.tmpfiles.enable "basic.target";
+    systemd.user.services.systemd-tmpfiles-setup.wantedBy =
+      lib.optional cfg.tmpfiles.enable "basic.target";
 
     # /run/current-system/sw/etc/xdg is in systemd's $XDG_CONFIG_DIRS so we can
     # write the tmpfiles.d rules for everyone there
-    environment.systemPackages = optional (cfg.tmpfiles.rules != [ ]) (writeTmpfiles {
+    environment.systemPackages = lib.optional (cfg.tmpfiles.rules != [ ]) (writeTmpfiles {
       inherit (cfg.tmpfiles) rules;
     });
 
     # /etc/profiles/per-user/$USER/etc/xdg is in systemd's $XDG_CONFIG_DIRS so
     # we can write a single user's tmpfiles.d rules there
-    users.users = mapAttrs (user: cfg': {
-      packages = optional (cfg'.rules != [ ]) (writeTmpfiles {
+    users.users = lib.mapAttrs (user: cfg': {
+      packages = lib.optional (cfg'.rules != [ ]) (writeTmpfiles {
         inherit (cfg') rules;
         inherit user;
       });

nixos/modules/testing/test-instrumentation.nix

@@ -238,11 +238,11 @@ in
     '';
 
     systemd.settings.Manager = managerSettings;
-    systemd.user.extraConfig = ''
+    systemd.user.settings.Manager = {
       # Allow very slow start
-      DefaultTimeoutStartSec=300
-      DefaultDeviceTimeoutSec=300
-    '';
+      DefaultTimeoutStartSec = 300;
+      DefaultDeviceTimeoutSec = 300;
+    };
 
     boot.consoleLogLevel = 7;
 

nixos/modules/virtualisation/qemu-vm.nix

@@ -1307,6 +1307,8 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
+        User = lib.mkIf (config.nix.daemonUser != "root") config.nix.daemonUser;
+        Group = lib.mkIf (config.nix.daemonGroup != "root") config.nix.daemonGroup;
       };
       script = ''
         if [[ "$(cat /proc/cmdline)" =~ regInfo=([^ ]*) ]]; then
@@ -1379,7 +1381,6 @@ in
         "-device usb-tablet,bus=usb-bus.0"
       ])
       (mkIf pkgs.stdenv.hostPlatform.isAarch [
-        "-device virtio-gpu-pci"
         "-device usb-ehci,id=usb0"
         "-device usb-kbd"
         "-device usb-tablet"

nixos/release.nix

@@ -152,7 +152,7 @@ let
     tarball
     // {
       meta = {
-        description = "NixOS system tarball for ${system} - ${stdenv.hostPlatform.linux-kernel.name}";
+        description = "NixOS system tarball for ${system}";
         maintainers = map (x: lib.maintainers.${x}) maintainers;
       };
       inherit config;
@@ -188,7 +188,7 @@ let
         modules = makeModules module { };
       };
       build = configEvaled.config.system.build;
-      kernelTarget = configEvaled.pkgs.stdenv.hostPlatform.linux-kernel.target;
+      kernelTarget = build.kernel.target;
     in
     configEvaled.pkgs.symlinkJoin {
       name = "netboot";

nixos/tests/all-tests.nix

@@ -695,6 +695,7 @@ in
   grocy = runTest ./grocy.nix;
   grow-partition = runTest ./grow-partition.nix;
   grub = runTest ./grub.nix;
+  gs1200-exporter = runTest ./gs1200-exporter.nix;
   guacamole-server = runTest ./guacamole-server.nix;
   guix = handleTest ./guix { };
   gvisor = runTest ./gvisor.nix;
@@ -1489,11 +1490,13 @@ in
   sane = runTest ./sane.nix;
   sanoid = runTest ./sanoid.nix;
   saunafs = runTest ./saunafs.nix;
+  scanservjs = runTest ./scanservjs.nix;
   scaphandre = runTest ./scaphandre.nix;
   schleuder = runTest ./schleuder.nix;
   scion-freestanding-deployment = runTest ./scion/freestanding-deployment;
   scrutiny = runTest ./scrutiny.nix;
   scx = runTest ./scx/default.nix;
+  scx-loader = runTest ./scx/loader.nix;
   sddm = import ./sddm.nix { inherit runTest; };
   sdl3 = runTest ./sdl3.nix;
   searx = runTest ./searx.nix;
@@ -1670,6 +1673,7 @@ in
   systemd-timesyncd-nscd-dnssec = runTest ./systemd-timesyncd-nscd-dnssec.nix;
   systemd-user-linger = runTest ./systemd-user-linger.nix;
   systemd-user-linger-purge = runTest ./systemd-user-linger-purge.nix;
+  systemd-user-settings = runTest ./systemd-user-settings.nix;
   systemd-user-tmpfiles-rules = runTest ./systemd-user-tmpfiles-rules.nix;
   systemd-userdbd = runTest ./systemd-userdbd.nix;
   systemtap = handleTest ./systemtap.nix { };

nixos/tests/bootspec.nix

@@ -24,8 +24,6 @@ let
     environment.systemPackages = [ pkgs.efibootmgr ];
   };
   standard = {
-    boot.bootspec.enable = true;
-
     imports = [
       baseline
       systemd-boot
@@ -53,8 +51,6 @@ in
     meta.maintainers = with pkgs.lib.maintainers; [ raitobezarius ];
 
     nodes.machine = {
-      boot.bootspec.enable = true;
-
       imports = [
         baseline
         grub
@@ -75,8 +71,6 @@ in
     meta.maintainers = with pkgs.lib.maintainers; [ raitobezarius ];
 
     nodes.machine = {
-      boot.bootspec.enable = true;
-
       imports = [
         baseline
         grub

nixos/tests/firezone/create-tokens.exs

@@ -1,86 +0,0 @@
-alias Domain.{Repo, Accounts, Auth, Actors, Tokens}
-
-mappings = case File.read("provision-uuids.json") do
-{:ok, content} ->
-  case Jason.decode(content) do
-    {:ok, mapping} -> mapping
-    _ -> %{"accounts" => %{}}
-  end
-_ -> %{"accounts" => %{}}
-end
-
-IO.puts("INFO: Fetching account")
-{:ok, account} = Accounts.fetch_account_by_id_or_slug("main")
-
-IO.puts("INFO: Fetching email provider")
-{:ok, email_provider} = Auth.Provider.Query.not_disabled()
-  |> Auth.Provider.Query.by_adapter(:email)
-  |> Auth.Provider.Query.by_account_id(account.id)
-  |> Repo.fetch(Auth.Provider.Query, [])
-
-temp_admin_actor_email = "firezone-provision@localhost.local"
-temp_admin_actor_context = %Auth.Context{
-  type: :browser,
-  user_agent: "Unspecified/0.0",
-  remote_ip: {127, 0, 0, 1},
-  remote_ip_location_region: "N/A",
-  remote_ip_location_city: "N/A",
-  remote_ip_location_lat: 0.0,
-  remote_ip_location_lon: 0.0
-}
-
-{:ok, temp_admin_actor} =
-  Actors.create_actor(account, %{
-    type: :account_admin_user,
-    name: "Token Provisioning"
-  })
-
-{:ok, temp_admin_actor_email_identity} =
-  Auth.create_identity(temp_admin_actor, email_provider, %{
-    provider_identifier: temp_admin_actor_email,
-    provider_identifier_confirmation: temp_admin_actor_email
-  })
-
-{:ok, temp_admin_actor_token} =
-  Auth.create_token(temp_admin_actor_email_identity, temp_admin_actor_context, "temporarynonce", DateTime.utc_now() |> DateTime.add(1, :hour))
-
-{:ok, temp_admin_subject} =
-  Auth.build_subject(temp_admin_actor_token, temp_admin_actor_context)
-
-{:ok, relay_group_token} =
-  Tokens.create_token(%{
-    "type" => :relay_group,
-	"expires_at" => DateTime.utc_now() |> DateTime.add(1, :hour),
-    "secret_fragment" => Domain.Crypto.random_token(32, encoder: :hex32),
-    "relay_group_id" => get_in(mappings, ["accounts", "main", "relay_groups", "my-relays"])
-  })
-
-relay_group_encoded_token = Tokens.encode_fragment!(relay_group_token)
-IO.puts("Created relay token: #{relay_group_encoded_token}")
-File.write("relay_token.txt", relay_group_encoded_token)
-
-{:ok, gateway_group_token} =
-  Tokens.create_token(%{
-    "type" => :gateway_group,
-    "expires_at" => DateTime.utc_now() |> DateTime.add(1, :hour),
-    "secret_fragment" => Domain.Crypto.random_token(32, encoder: :hex32),
-    "account_id" => get_in(mappings, ["accounts", "main", "id"]),
-    "gateway_group_id" => get_in(mappings, ["accounts", "main", "gateway_groups", "site"])
-  }, temp_admin_subject)
-
-gateway_group_encoded_token = Tokens.encode_fragment!(gateway_group_token)
-IO.puts("Created gateway group token: #{gateway_group_encoded_token}")
-File.write("gateway_token.txt", gateway_group_encoded_token)
-
-{:ok, service_account_actor_token} =
-  Tokens.create_token(%{
-    "type" => :client,
-    "expires_at" => DateTime.utc_now() |> DateTime.add(1, :hour),
-    "secret_fragment" => Domain.Crypto.random_token(32, encoder: :hex32),
-    "account_id" => get_in(mappings, ["accounts", "main", "id"]),
-    "actor_id" => get_in(mappings, ["accounts", "main", "actors", "client"])
-  })
-
-service_account_actor_encoded_token = Tokens.encode_fragment!(service_account_actor_token)
-IO.puts("Created service actor token: #{service_account_actor_encoded_token}")
-File.write("client_token.txt", service_account_actor_encoded_token)

nixos/tests/firezone/firezone.nix

@@ -84,89 +84,15 @@ in
             passwordFile = pkgs.writeText "tmpmailpasswd" "verysecurepassword";
           };
 
-          provision = {
-            enable = true;
-            accounts.main = {
-              name = "My Account";
-              relayGroups.my-relays.name = "Relays";
-              gatewayGroups.site.name = "Site";
-              actors = {
-                admin = {
-                  type = "account_admin_user";
-                  name = "Admin";
-                  email = "admin@localhost.localdomain";
-                };
-                client = {
-                  type = "service_account";
-                  name = "A client";
-                  email = "client@example.com";
-                };
-              };
-              # service accounts aren't members of 'Everyone' so we need to add a separate group
-              groups.main = {
-                name = "main";
-                members = [
-                  "client"
-                  "admin"
-                ];
-              };
-              resources.res1 = {
-                type = "dns";
-                name = "Dns Resource";
-                address = "resource.example.com";
-                gatewayGroups = [ "site" ];
-                filters = [
-                  { protocol = "icmp"; }
-                  {
-                    protocol = "tcp";
-                    ports = [ 80 ];
-                  }
-                ];
-              };
-              resources.res2 = {
-                type = "ip";
-                name = "Ip Resource";
-                address = "172.20.2.1";
-                gatewayGroups = [ "site" ];
-              };
-              resources.res3 = {
-                type = "cidr";
-                name = "Cidr Resource";
-                address = "172.20.1.0/24";
-                gatewayGroups = [ "site" ];
-              };
-              policies.pol1 = {
-                description = "Allow anyone res1 access";
-                group = "main";
-                resource = "res1";
-              };
-              policies.pol2 = {
-                description = "Allow anyone res2 access";
-                group = "main";
-                resource = "res2";
-              };
-              policies.pol3 = {
-                description = "Allow anyone res3 access";
-                group = "main";
-                resource = "res3";
-              };
-            };
-          };
-
           api.externalUrl = "https://${domain}/api/";
           web.externalUrl = "https://${domain}/";
         };
-
-        systemd.services.firezone-server-domain.postStart = lib.mkAfter ''
-          ${lib.getExe config.services.firezone.server.domain.package} rpc 'Code.eval_file("${./create-tokens.exs}")'
-        '';
       };
 
     relay =
       {
         nodes,
         config,
-        lib,
         ...
       }:
       {
@@ -181,14 +107,11 @@ in
           logLevel = "debug";
           name = "test-relay";
           apiUrl = "wss://${domain}/api/";
-          tokenFile = "/tmp/shared/relay_token.txt";
+          tokenFile = pkgs.writeText "token" "token";
           publicIpv4 = config.networking.primaryIPAddress;
           publicIpv6 = config.networking.primaryIPv6Address;
           openFirewall = true;
         };
-
-        # Don't auto-start so we can wait until the token was provisioned
-        systemd.services.firezone-relay.wantedBy = lib.mkForce [ ];
       };
 
     # A resource that is only connected to the gateway,
@@ -300,11 +223,8 @@ in
           logLevel = "debug";
           name = "test-gateway";
           apiUrl = "wss://${domain}/api/";
-          tokenFile = "/tmp/shared/gateway_token.txt";
+          tokenFile = pkgs.writeText "token" "token";
         };
-
-        # Don't auto-start so we can wait until the token was provisioned
-        systemd.services.firezone-gateway.wantedBy = lib.mkForce [ ];
       };
 
     client =
@@ -326,11 +246,8 @@ in
           logLevel = "debug";
           name = "test-client-somebody";
           apiUrl = "wss://${domain}/api/";
-          tokenFile = "/tmp/shared/client_token.txt";
+          tokenFile = pkgs.writeText "token" "token";
         };
-
-        # Don't auto-start so we can wait until the token was provisioned
-        systemd.services.firezone-headless-client.wantedBy = lib.mkForce [ ];
       };
   };
 
@@ -344,43 +261,13 @@ in
           server.wait_until_succeeds("curl -Lsf https://${domain} | grep 'Welcome to Firezone'")
           server.wait_until_succeeds("curl -Ls https://${domain}/api | grep 'Not Found'")
 
-          # Wait for tokens and copy them to shared folder
-          server.wait_for_file("/var/lib/private/firezone/relay_token.txt")
-          server.wait_for_file("/var/lib/private/firezone/gateway_token.txt")
-          server.wait_for_file("/var/lib/private/firezone/client_token.txt")
-          server.succeed("cp /var/lib/private/firezone/*_token.txt /tmp/shared")
-
       with subtest("Connect relay"):
-          relay.succeed("systemctl start firezone-relay")
           relay.wait_for_unit("firezone-relay.service")
-          relay.wait_until_succeeds("journalctl --since -2m --unit firezone-relay.service --grep 'Connected to portal.*${domain}'", timeout=30)
 
       with subtest("Connect gateway"):
-          gateway.succeed("systemctl start firezone-gateway")
           gateway.wait_for_unit("firezone-gateway.service")
-          gateway.wait_until_succeeds("journalctl --since -2m --unit firezone-gateway.service --grep 'Connected to portal.*${domain}'", timeout=30)
-          relay.wait_until_succeeds("journalctl --since -2m --unit firezone-relay.service --grep 'Created allocation.*IPv4'", timeout=30)
-          relay.wait_until_succeeds("journalctl --since -2m --unit firezone-relay.service --grep 'Created allocation.*IPv6'", timeout=30)
-
-          # Assert both relay ips are known
-          gateway.wait_until_succeeds("journalctl --since -2m --unit firezone-gateway.service --grep 'Updated allocation.*relay_ip4.*Some.*relay_ip6.*Some'", timeout=30)
 
       with subtest("Connect headless-client"):
-          client.succeed("systemctl start firezone-headless-client")
           client.wait_for_unit("firezone-headless-client.service")
-          client.wait_until_succeeds("journalctl --since -2m --unit firezone-headless-client.service --grep 'Connected to portal.*${domain}'", timeout=30)
-          client.wait_until_succeeds("journalctl --since -2m --unit firezone-headless-client.service --grep 'Tunnel ready'", timeout=30)
-
-      with subtest("Check DNS based access"):
-          # Check that we can access the resource through the VPN via DNS
-          client.wait_until_succeeds("curl -4 -Lsf http://resource.example.com | grep 'greetings from the resource'")
-
-      with subtest("Check CIDR based access"):
-          # Check that we can access the resource through the VPN via CIDR
-          client.wait_until_succeeds("ping -c1 -W1 172.20.1.1")
-
-      with subtest("Check IP based access"):
-          # Check that we can access the resource through the VPN via IP
-          client.wait_until_succeeds("ping -c1 -W1 172.20.2.1")
     '';
 }

nixos/tests/gs1200-exporter.nix

@@ -0,0 +1,20 @@
+{ lib, ... }:
+{
+  name = "gs1200-exporter";
+  meta.maintainers = with lib.maintainers; [ DerGrumpf ];
+  nodes.machine = _: {
+    services.gs1200-exporter = {
+      enable = true;
+      address = "192.168.2.4";
+      passwordFile = "/run/secrets/gs1200-password";
+    };
+    systemd.tmpfiles.rules = [
+      "f /run/secrets/gs1200-password 0400 root root - testpassword"
+    ];
+  };
+  testScript = ''
+    machine.wait_for_unit("gs1200-exporter.service")
+    machine.wait_for_open_port(9934)
+    machine.succeed("curl -f http://localhost:9934/metrics")
+  '';
+}

nixos/tests/installer.nix

@@ -793,7 +793,6 @@ let
                 ++ optionals (bootLoader == "systemd-boot") [
                   pkgs.zstd.bin
                   pkgs.mypy
-                  config.boot.bootspec.package
                 ]
                 ++ optionals clevisTest [ pkgs.klibc ]
                 ++ optional systemdStage1 config.system.nixos-init.package;

nixos/tests/matrix/mautrix-discord.nix

@@ -1,4 +1,4 @@
-{ pkgs, lib, ... }:
+{ pkgs, ... }:
 let
   homeserverUrl = "http://homeserver:8008";
 in
@@ -53,6 +53,7 @@ in
 
             appservice = {
               address = "http://homeserver:8009";
+              hostname = "0.0.0.0";
               port = 8009;
               id = "discord";
               bot = {
@@ -60,8 +61,6 @@ in
                 displayname = "Discord bridge bot";
                 avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
               };
-              # Don't override as_token/hs_token - let them use the default placeholder
-              # which will trigger automatic generation
 
               database = {
                 type = "sqlite3";
@@ -75,6 +74,17 @@ in
                 "*" = "relay";
               };
             };
+
+            logging = {
+              min_level = "info";
+              writers = [
+                {
+                  type = "stdout";
+                  format = "pretty-colored";
+                  time_format = " ";
+                }
+              ];
+            };
           };
         };
 
@@ -157,6 +167,57 @@ in
     with subtest("verify registration file was created"):
         homeserver.wait_until_succeeds("test -f /var/lib/mautrix-discord/discord-registration.yaml")
 
+        # Verify the module wrote the expected bridge configuration.
+        config_homeserver_address = homeserver.succeed("yq -r '.homeserver.address' /var/lib/mautrix-discord/config.yaml").strip()
+        config_homeserver_domain = homeserver.succeed("yq -r '.homeserver.domain' /var/lib/mautrix-discord/config.yaml").strip()
+        config_appservice_address = homeserver.succeed("yq -r '.appservice.address' /var/lib/mautrix-discord/config.yaml").strip()
+        config_appservice_hostname = homeserver.succeed("yq -r '.appservice.hostname' /var/lib/mautrix-discord/config.yaml").strip()
+        config_appservice_port = homeserver.succeed("yq -r '.appservice.port' /var/lib/mautrix-discord/config.yaml").strip()
+        config_appservice_id = homeserver.succeed("yq -r '.appservice.id' /var/lib/mautrix-discord/config.yaml").strip()
+        config_bot_username = homeserver.succeed("yq -r '.appservice.bot.username' /var/lib/mautrix-discord/config.yaml").strip()
+        config_bot_displayname = homeserver.succeed("yq -r '.appservice.bot.displayname' /var/lib/mautrix-discord/config.yaml").strip()
+        config_bot_avatar = homeserver.succeed("yq -r '.appservice.bot.avatar' /var/lib/mautrix-discord/config.yaml").strip()
+        config_database_type = homeserver.succeed("yq -r '.appservice.database.type' /var/lib/mautrix-discord/config.yaml").strip()
+        config_database_uri = homeserver.succeed("yq -r '.appservice.database.uri' /var/lib/mautrix-discord/config.yaml").strip()
+        config_permission = homeserver.succeed("yq -r '.bridge.permissions[\"*\"]' /var/lib/mautrix-discord/config.yaml").strip()
+        config_logging_min_level = homeserver.succeed("yq -r '.logging.min_level' /var/lib/mautrix-discord/config.yaml").strip()
+        config_logging_writer_type = homeserver.succeed("yq -r '.logging.writers[0].type' /var/lib/mautrix-discord/config.yaml").strip()
+        config_logging_writer_format = homeserver.succeed("yq -r '.logging.writers[0].format' /var/lib/mautrix-discord/config.yaml").strip()
+        reg_rate_limited = homeserver.succeed("yq -r '.rate_limited' /var/lib/mautrix-discord/discord-registration.yaml").strip()
+
+        assert config_homeserver_address == "http://homeserver:8008", \
+          f"Unexpected homeserver address: {config_homeserver_address}"
+        assert config_homeserver_domain == "homeserver", \
+          f"Unexpected homeserver domain: {config_homeserver_domain}"
+        assert config_appservice_address == "http://homeserver:8009", \
+          f"Unexpected appservice address: {config_appservice_address}"
+        assert config_appservice_hostname == "0.0.0.0", \
+          f"Unexpected appservice hostname: {config_appservice_hostname}"
+        assert config_appservice_port == "8009", \
+          f"Unexpected appservice port: {config_appservice_port}"
+        assert config_appservice_id == "discord", \
+          f"Unexpected appservice id: {config_appservice_id}"
+        assert config_bot_username == "discordbot", \
+          f"Unexpected bot username: {config_bot_username}"
+        assert config_bot_displayname == "Discord bridge bot", \
+          f"Unexpected bot displayname: {config_bot_displayname}"
+        assert config_bot_avatar == "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC", \
+          f"Unexpected bot avatar: {config_bot_avatar}"
+        assert config_database_type == "sqlite3-fk-wal", \
+          f"Unexpected database type: {config_database_type}"
+        assert config_database_uri == "file:/var/lib/mautrix-discord/mautrix-discord.db?_txlock=immediate", \
+          f"Unexpected database uri: {config_database_uri}"
+        assert config_permission == "relay", \
+          f"Unexpected default permission mapping: {config_permission}"
+        assert config_logging_min_level == "info", \
+          f"Unexpected logging min_level: {config_logging_min_level}"
+        assert config_logging_writer_type == "stdout", \
+          f"Unexpected logging writer type: {config_logging_writer_type}"
+        assert config_logging_writer_format == "pretty-colored", \
+          f"Unexpected logging writer format: {config_logging_writer_format}"
+        assert reg_rate_limited == "false", \
+          f"Registration file should disable rate limiting by default, got: {reg_rate_limited}"
+
         # Verify tokens were generated and are not default values
         config_as_token = homeserver.succeed("yq -r '.appservice.as_token' /var/lib/mautrix-discord/config.yaml").strip()
         config_hs_token = homeserver.succeed("yq -r '.appservice.hs_token' /var/lib/mautrix-discord/config.yaml").strip()

nixos/tests/opensnitch.nix

@@ -1,17 +1,23 @@
 { pkgs, lib, ... }:
 let
+  # opensnitch ebpf seems to handle non-x86 syscalls incorrectly
+  test_ebpf = pkgs.stdenv.hostPlatform.isx86;
+
   monitorMethods = [
-    "ebpf"
     "proc"
     "ftrace"
     "audit"
-  ];
+  ]
+  ++ lib.optional test_ebpf "ebpf";
 in
 {
   name = "opensnitch";
 
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ onny ];
+    maintainers = [
+      onny
+      grimmauld
+    ];
   };
 
   nodes = {
@@ -88,13 +94,13 @@ in
     lib.concatLines (
       map (m: ''
         client_blocked_${m}.wait_for_unit("opensnitchd.service")
-        client_blocked_${m}.fail("curl http://server")
+        client_blocked_${m}.fail("curl --connect-timeout 3 http://server")
 
         client_allowed_${m}.wait_for_unit("opensnitchd.service")
-        client_allowed_${m}.succeed("curl http://server")
+        client_allowed_${m}.succeed("curl --connect-timeout 3 http://server")
       '') monitorMethods
     )
-    + ''
+    + lib.optionalString test_ebpf ''
       # make sure the kernel modules were actually properly loaded
       client_blocked_ebpf.succeed(r"journalctl -u opensnitchd --grep '\[eBPF\] module loaded: /nix/store/.*/etc/opensnitchd/opensnitch\.o'")
       client_blocked_ebpf.succeed(r"journalctl -u opensnitchd --grep '\[eBPF\] module loaded: /nix/store/.*/etc/opensnitchd/opensnitch-procs\.o'")

nixos/tests/prometheus-exporters.nix

@@ -436,6 +436,30 @@ let
         '';
       };
 
+    elasticsearch =
+      { ... }:
+      {
+        exporterConfig = {
+          enable = true;
+          url = "http://localhost:9200";
+        };
+        metricProvider = {
+          # `services.elasticsearch` is unmaintained; OpenSearch is the same
+          # engine class and is explicitly supported by the exporter.
+          services.opensearch.enable = true;
+          virtualisation.memorySize = 2048;
+        };
+        exporterTest = ''
+          wait_for_unit("opensearch.service")
+          wait_for_open_port(9200)
+          wait_for_unit("prometheus-elasticsearch-exporter.service")
+          wait_for_open_port(9114)
+          succeed(
+              "curl -sSf localhost:9114/metrics | grep 'elasticsearch_cluster_health_status'"
+          )
+        '';
+      };
+
     fail2ban =
       { ... }:
       {

nixos/tests/qgis.nix

@@ -56,7 +56,7 @@ import ./make-test-python.nix (
               StandardError = "journal";
               StandardInput = "socket";
               Environment = [
-                "QT_QPA_PLATFORM_PLUGIN_PATH=${pkgs.libsForQt5.qt5.qtbase}/${pkgs.libsForQt5.qt5.qtbase.qtPluginPrefix}/platforms"
+                "QT_QPA_PLATFORM_PLUGIN_PATH=${pkgs.qt5.qtbase}/${pkgs.qt5.qtbase.qtPluginPrefix}/platforms"
                 "QGIS_SERVER_LOG_LEVEL=0"
                 "QGIS_SERVER_LOG_STDERR=1"
               ];

nixos/tests/scanservjs.nix

@@ -0,0 +1,23 @@
+let
+  port = 1234;
+in
+{
+  name = "scanservjs";
+
+  nodes.machine =
+    { ... }:
+    {
+      services.scanservjs = {
+        enable = true;
+        settings.host = "0.0.0.0";
+        settings.port = port;
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("scanservjs.service")
+    machine.wait_until_succeeds(
+        "curl --silent --fail --show-error --location http://localhost:${toString port}"
+    )
+  '';
+}

nixos/tests/scx/loader.nix

@@ -0,0 +1,20 @@
+{ pkgs, lib, ... }:
+
+{
+  name = "scx-loader";
+  meta.maintainers = with lib.maintainers; [ ccicnce113424 ];
+
+  nodes.machine = {
+    boot.kernelPackages = pkgs.linuxPackages_latest;
+    services.scx-loader = {
+      enable = true;
+      config.default_sched = "scx_bpfland";
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    output = machine.succeed("scxctl get").strip()
+    assert output == "running Bpfland in Auto mode", f"Unexpected scxctl output: {output!r}"
+  '';
+}

nixos/tests/shadps4.nix

@@ -88,6 +88,9 @@
 
         machine.succeed("shadps4 /etc/openorbis-sample-packages/OpenOrbis-PNG-Sample/uroot/eboot.bin >&2 &")
 
+        machine.wait_for_text("Save Migration")
+        machine.succeed("xdotool mousemove 879 182 click 1")
+
         # Look for logo
         with machine.nested("Waiting for the screen to have openorbisColor {} on it:".format(openorbisColor)):
             retry(check_for_color(openorbisColor))

nixos/tests/stalwart/stalwart.nix

@@ -79,7 +79,6 @@ in
   meta = {
     maintainers = with lib.maintainers; [
       happysalada
-      euxane
       onny
     ];
   };

nixos/tests/systemd-boot.nix

@@ -772,26 +772,6 @@ in
     }
   );
 
-  no-bootspec = runTest (
-    { lib, ... }:
-    {
-      name = "systemd-boot-no-bootspec";
-      meta.maintainers = with lib.maintainers; [ julienmalka ];
-
-      nodes.machine = {
-        imports = [ common ];
-        boot.bootspec.enable = false;
-      };
-
-      testScript =
-        # python
-        ''
-          machine.start()
-          machine.wait_for_unit("multi-user.target")
-        '';
-    }
-  );
-
   bootCounting =
     let
       baseConfig = {

nixos/tests/systemd-initrd-luks-fido2.nix

@@ -38,7 +38,6 @@
           };
         };
         virtualisation.rootDevice = "/dev/mapper/cryptroot";
-        virtualisation.fileSystems."/".autoFormat = true;
       };
     };
 
@@ -52,6 +51,8 @@
       # Create encrypted volume
       machine.wait_for_unit("multi-user.target")
       machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+      machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdb cryptroot")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
       machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --fido2-device=auto /dev/vdb |& systemd-cat")
 
       # Boot from the encrypted disk

nixos/tests/systemd-initrd-luks-unl0kr.nix

@@ -73,7 +73,6 @@ in
           cryptroot2.device = "/dev/vdc";
         };
         virtualisation.rootDevice = "/dev/mapper/cryptroot";
-        virtualisation.fileSystems."/".autoFormat = true;
         # test mounting device unlocked in initrd after switching root
         virtualisation.fileSystems."/cryptroot2" = {
           device = "/dev/mapper/cryptroot2";
@@ -100,7 +99,7 @@ in
       machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
 
       # Boot from the encrypted disk
-        machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
+      machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
       machine.succeed("sync")
       machine.crash()
 

nixos/tests/systemd-user-settings.nix

@@ -0,0 +1,24 @@
+{
+  name = "systemd-user-settings";
+  meta = {
+    maintainers = [ ];
+  };
+
+  nodes.machine =
+    { lib, ... }:
+    {
+      systemd.user.settings.Manager = {
+        DefaultTimeoutStartSec = lib.mkForce "60";
+        DefaultEnvironment = "FOO=bar";
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("settings.Manager renders user.conf"):
+      machine.succeed("grep -F '[Manager]' /etc/systemd/user.conf")
+      machine.succeed("grep -F 'DefaultTimeoutStartSec=60' /etc/systemd/user.conf")
+      machine.succeed("grep -F 'DefaultEnvironment=FOO=bar' /etc/systemd/user.conf")
+  '';
+}

nixos/tests/systemd.nix

@@ -34,7 +34,7 @@
         RebootWatchdogSec = "10min";
         KExecWatchdogSec = "5min";
       };
-      systemd.user.extraConfig = "DefaultEnvironment=\"XXX_USER=bar\"";
+      systemd.user.settings.Manager.DefaultEnvironment = "\"XXX_USER=bar\"";
       services.journald.extraConfig = "Storage=volatile";
       test-support.displayManager.auto.user = "alice";
 

nixos/tests/wordpress.nix

@@ -87,9 +87,9 @@ rec {
       )
       { }
       [
-        "6_7"
         "6_8"
         "6_9"
+        "7_0"
       ];
 
   testScript = ''

nixos/tests/wpa_supplicant.nix

@@ -283,18 +283,22 @@ in
         enable = lib.mkOverride 0 true;
         userControlled = true;
         allowAuxiliaryImperativeNetworks = true;
-        interfaces = [ "wlan1" ];
+        interfaces = [
+          "wlan0"
+          "wlan1"
+        ];
       };
     };
 
     testScript = ''
       wpa_cli = "sudo -u alice -g wpa_supplicant wpa_cli"
 
-      with subtest("Daemon is running and accepting connections"):
-          machine.wait_for_unit("wpa_supplicant-wlan1.service")
-          status = machine.wait_until_succeeds(f"{wpa_cli} -i wlan1 status")
-          assert "Failed to connect" not in status, \
-                 "Failed to connect to the daemon"
+      with subtest("Daemons are running and accepting connections"):
+          for iface in ["wlan0", "wlan1"]:
+            machine.wait_for_unit(f"wpa_supplicant-{iface}.service")
+            status = machine.wait_until_succeeds(f"{wpa_cli} -i {iface} status")
+            assert "Failed to connect" not in status, \
+                   f"Failed to connect to the daemon for {iface}"
 
       with subtest("Daemon can be configured imperatively"):
           machine.succeed(f"{wpa_cli} -i wlan1 add_network")