maintainers/github-teams.json: Automated sync

The `find_a_program`/`for_each_path` machine-prefix patch series has now
landed on gcc `master`, so point the `fetchpatch` entries at the
`gcc-mirror/gcc` commit `.diff`s rather than the v5 mailing-list `raw`
URLs (matching the existing `for_each_path` rework patch).

Linking the approving mailing list posts, along with the commit hash
each of the 4 commits (by title) landed as.

- <https://inbox.sourceware.org/gcc-patches/6c3a085d-fa62-4b24-b4ca-ee5c6ac11be0@oss.qualcomm.com/>

  Approved the first two patches together.

  1. `find_a_program: Separate from find_a_file` → 948eb02800777d0318ee2a38bf32076afee739f2
  2. `driver: Simplify find_a_program and find_a_file` → 073b4656d07e40f83a1db7f4462ab2d68b1875a2

- <https://inbox.sourceware.org/gcc-patches/324798d3-effb-4dc5-86ab-a1c461390d64@oss.qualcomm.com/>

  3. `for_each_path: Pass to callback whether dir is machine-disambiguated` → f62f68e7c4bde0385fbd2dba3e926586dd2f1281

- <https://inbox.sourceware.org/gcc-patches/ae270a41-fae9-4442-a276-0433ea752f2e@oss.qualcomm.com/>

  4. `find_a_program: Search with machine prefix in some cases` → a514707ffd7d58b140686036c2dece43ecb7d33c

We also include an additional commit,
6b008944e7bc3a342a734c4fcf1001d63fd0a6f8, a one-line `for_each_path` fix
against a mistake that I made in the previous commit. It is applied as a
prerequisite both so we also have the fix, and because without the
latter patches would have conflicts.

ci/OWNERS

@@ -402,9 +402,6 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/tests/docker-tools*                       @roberth @jhol
 /doc/build-helpers/images/dockertools.section.md @roberth @jhol
 
-# Blockchains
-/pkgs/applications/blockchains  @mmahut @RaghavSood
-
 # Go
 /doc/languages-frameworks/go.section.md @kalbasit @katexochen @Mic92
 /pkgs/build-support/go @kalbasit @katexochen @Mic92

ci/default.nix

@@ -30,128 +30,7 @@ let
         inherit (pinned.treefmt-nix) url;
         sha256 = pinned.treefmt-nix.hash;
       };
-      treefmtEval = (import treefmtNixSrc).evalModule pkgs {
-        # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
-        # which creates trees within the Git repository under `.git-rewrite/t`,
-        # notably without having a `.git` themselves.
-        # So if this projectRootFile were the default `.git/config`,
-        # having the auto-rebase script use treefmt on such a tree would make it
-        # format all files in the _parent_ Git tree as well.
-        projectRootFile = ".git-blame-ignore-revs";
-
-        # Be a bit more verbose by default, so we can see progress happening
-        settings.verbose = 1;
-
-        # By default it's info, which is too noisy since we have many unmatched files
-        settings.on-unmatched = "debug";
-
-        programs.actionlint.enable = true;
-
-        programs.biome = {
-          enable = true;
-          # Disable settings validation because its inputs are liable to hash mismatch
-          validate.enable = false;
-          settings.formatter = {
-            useEditorconfig = true;
-          };
-          settings.javascript.formatter = {
-            quoteStyle = "single";
-            semicolons = "asNeeded";
-          };
-          settings.json.formatter.enabled = false;
-        };
-        settings.formatter.biome.excludes = [
-          "*.min.js"
-          "pkgs/*"
-        ];
-
-        programs.keep-sorted.enable = true;
-
-        # This uses nixfmt underneath, the default formatter for Nix code.
-        # See https://github.com/NixOS/nixfmt
-        programs.nixfmt = {
-          enable = true;
-          package = pkgs.nixfmt;
-        };
-
-        programs.yamlfmt = {
-          enable = true;
-          settings.formatter = {
-            retain_line_breaks = true;
-          };
-        };
-        settings.formatter.yamlfmt.excludes = [
-          # Aligns comments with whitespace
-          "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
-          # TODO: Fix formatting for auto-generated file
-          "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
-        ];
-
-        programs.nixf-diagnose = {
-          enable = true;
-          ignore = [
-            # Rule names can currently be looked up here:
-            # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
-            # TODO: Remove the following and fix things.
-            "sema-unused-def-lambda-noarg-formal"
-            "sema-unused-def-lambda-witharg-arg"
-            "sema-unused-def-lambda-witharg-formal"
-            "sema-unused-def-let"
-            # Keep this rule, because we have `lib.or`.
-            "or-identifier"
-            # TODO: remove after outstanding prelude diagnostics issues are fixed:
-            # https://github.com/nix-community/nixd/issues/761
-            # https://github.com/nix-community/nixd/issues/762
-            "sema-primop-removed-prefix"
-            "sema-primop-overridden"
-            "sema-constant-overridden"
-            "sema-primop-unknown"
-          ];
-        };
-        settings.formatter.nixf-diagnose = {
-          # Ensure nixfmt cleans up after nixf-diagnose.
-          priority = -1;
-          excludes = [
-            # Auto-generated; violates sema-extra-with
-            # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
-            # https://github.com/inclyc/nixf-diagnose/issues/13
-            "pkgs/servers/home-assistant/component-packages.nix"
-            # https://github.com/nix-community/nixd/issues/708
-            "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
-          ];
-        };
-
-        settings.formatter.editorconfig-checker = {
-          command = "${pkgs.lib.getExe pkgs.editorconfig-checker}";
-          options = [
-            "-disable-indent-size"
-            # TODO: Remove this once this upstream issue is fixed:
-            #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
-            "-disable-charset"
-          ];
-          includes = [ "*" ];
-          priority = 1;
-        };
-
-        # TODO: Upstream this into treefmt-nix eventually:
-        #   https://github.com/numtide/treefmt-nix/issues/387
-        settings.formatter.markdown-code-runner = {
-          command = pkgs.lib.getExe pkgs.markdown-code-runner;
-          options =
-            let
-              config = pkgs.writers.writeTOML "markdown-code-runner-config" {
-                presets.nixfmt = {
-                  language = "nix";
-                  command = [ (pkgs.lib.getExe pkgs.nixfmt) ];
-                };
-              };
-            in
-            [ "--config=${config}" ];
-          includes = [ "*.md" ];
-        };
-
-        programs.zizmor.enable = true;
-      };
+      treefmtEval = (import treefmtNixSrc).evalModule pkgs ./treefmt.nix;
       fs = pkgs.lib.fileset;
       nixFilesSrc = fs.toSource {
         root = ../.;

ci/pinned.json

@@ -9,9 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "cbb5cf358f50aa6acc9efd6113b7bcfbc352cd73",
-      "url": "https://github.com/NixOS/nixpkgs/archive/cbb5cf358f50aa6acc9efd6113b7bcfbc352cd73.tar.gz",
-      "hash": "sha256-IX7G1dlKrOqPOImfbo7ADDfV5yU1+j+MRChI3TL4tAA="
+      "revision": "8c91a71d13451abc40eb9dae8910f972f979852f",
+      "url": "https://github.com/NixOS/nixpkgs/archive/8c91a71d13451abc40eb9dae8910f972f979852f.tar.gz",
+      "hash": "sha256-fnzKKPvS+oieI/pTzotA5tkoM47EB1NpaBcgk4R97hE="
     },
     "treefmt-nix": {
       "type": "Git",

ci/treefmt.nix

@@ -0,0 +1,122 @@
+{ pkgs, ... }: {
+  # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
+  # which creates trees within the Git repository under `.git-rewrite/t`,
+  # notably without having a `.git` themselves.
+  # So if this projectRootFile were the default `.git/config`,
+  # having the auto-rebase script use treefmt on such a tree would make it
+  # format all files in the _parent_ Git tree as well.
+  projectRootFile = ".git-blame-ignore-revs";
+
+  # Be a bit more verbose by default, so we can see progress happening
+  settings.verbose = 1;
+
+  # By default it's info, which is too noisy since we have many unmatched files
+  settings.on-unmatched = "debug";
+
+  programs.actionlint.enable = true;
+
+  programs.biome = {
+    enable = true;
+    # Disable settings validation because its inputs are liable to hash mismatch
+    validate.enable = false;
+    settings.formatter = {
+      useEditorconfig = true;
+    };
+    settings.javascript.formatter = {
+      quoteStyle = "single";
+      semicolons = "asNeeded";
+    };
+    settings.json.formatter.enabled = false;
+  };
+  settings.formatter.biome.excludes = [
+    "*.min.js"
+    "pkgs/*"
+  ];
+
+  programs.keep-sorted.enable = true;
+
+  # This uses nixfmt underneath, the default formatter for Nix code.
+  # See https://github.com/NixOS/nixfmt
+  programs.nixfmt = {
+    enable = true;
+    package = pkgs.nixfmt;
+  };
+
+  programs.yamlfmt = {
+    enable = true;
+    settings.formatter = {
+      retain_line_breaks = true;
+    };
+  };
+  settings.formatter.yamlfmt.excludes = [
+    # Aligns comments with whitespace
+    "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
+    # TODO: Fix formatting for auto-generated file
+    "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
+  ];
+
+  programs.nixf-diagnose = {
+    enable = true;
+    ignore = [
+      # Rule names can currently be looked up here:
+      # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
+      # TODO: Remove the following and fix things.
+      "sema-unused-def-lambda-noarg-formal"
+      "sema-unused-def-lambda-witharg-arg"
+      "sema-unused-def-lambda-witharg-formal"
+      "sema-unused-def-let"
+      # Keep this rule, because we have `lib.or`.
+      "or-identifier"
+      # TODO: remove after outstanding prelude diagnostics issues are fixed:
+      # https://github.com/nix-community/nixd/issues/761
+      # https://github.com/nix-community/nixd/issues/762
+      "sema-primop-removed-prefix"
+      "sema-primop-overridden"
+      "sema-constant-overridden"
+      "sema-primop-unknown"
+    ];
+  };
+  settings.formatter.nixf-diagnose = {
+    # Ensure nixfmt cleans up after nixf-diagnose.
+    priority = -1;
+    excludes = [
+      # Auto-generated; violates sema-extra-with
+      # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
+      # https://github.com/inclyc/nixf-diagnose/issues/13
+      "pkgs/servers/home-assistant/component-packages.nix"
+      # https://github.com/nix-community/nixd/issues/708
+      "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
+    ];
+  };
+
+  settings.formatter.editorconfig-checker = {
+    command = "${pkgs.lib.getExe pkgs.editorconfig-checker}";
+    options = [
+      "-disable-indent-size"
+      # TODO: Remove this once this upstream issue is fixed:
+      #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
+      "-disable-charset"
+    ];
+    includes = [ "*" ];
+    priority = 1;
+  };
+
+  # TODO: Upstream this into treefmt-nix eventually:
+  #   https://github.com/numtide/treefmt-nix/issues/387
+  settings.formatter.markdown-code-runner = {
+    command = pkgs.lib.getExe pkgs.markdown-code-runner;
+    options =
+      let
+        config = pkgs.writers.writeTOML "markdown-code-runner-config" {
+          presets.nixfmt = {
+            language = "nix";
+            command = [ (pkgs.lib.getExe pkgs.nixfmt) ];
+          };
+        };
+      in
+      [ "--config=${config}" ];
+    includes = [ "*.md" ];
+  };
+
+  programs.zizmor.enable = true;
+}

doc/build-helpers/testers.chapter.md

@@ -98,6 +98,14 @@ It has two modes:
 
 : The path to the files to check.
 
+`relocatable` (boolean, optional) {#tester-lycheeLinkCheck-param-relocatable}
+
+: Whether the site is expected to be relocatable, i.e. servable from any URL path prefix.
+
+  When `true` (the default), root-relative links (starting with `/`) are treated as errors, because they break when the site is served from a subpath or opened via `file://` URLs.
+
+  When `false`, root-relative links are resolved against the `site` directory.
+
 `remap` (attribute set, optional) {#tester-lycheeLinkCheck-param-remap}
 
 : An attribute set where the attribute names are regular expressions.

doc/release-notes/rl-2611.section.md

@@ -19,12 +19,29 @@
 
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
 
+- Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:
+  - `linux-kernel.name` has been removed.
+  - `linux-kernel.target` is available as the `target` parameter and passthru attribute on the kernel builders.
+  - `linux-kernel.installTarget` has been removed, as it should not be necessary to customize.
+  - `linux-kernel.DTB` is available as the `buildDTBs` parameter and passthru attribute on the kernel builders.
+  - `linux-kernel.{autoModules,preferBuiltin,extraConfig}` were already available as kernel builder parameters.
+
+- The `img` argument of `vmTools` has been renamed to `kernelImage`, as it collided with the top-level `img` package.
+  Additionally, the kernel module tree used inside the VM has been split out of the `kernel` argument into a new `kernelModules` argument (defaulting to `kernel`).
+  Callers that overrode `kernel` with a module tree (e.g. from `pkgs.aggregateModules`) to make extra modules available must now pass it via `kernelModules` instead, keeping `kernel` pointing at a bootable kernel derivation.
+
 - The ARMv5 Linux kernel build now uses a standard configuration and generates a standard compressed image instead of the deprecated legacy U‐Boot image format.
   `lib.systems.{examples,platforms}.{sheevaplug,pogoplug4}` have been unified into `lib.systems.examples.armv5tel-multiplatform`.
   Note that there is no official support for ARMv5 and it is not possible to build even a simple NixOS configuration out of the box.
 
 - Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
 
+- `rke2` retires ingress-nginx and transitions to Traefik starting in `rke2_1_36`. Because ingress-nginx was retired upstream as of March 2026, Traefik is now the default
+  for new clusters starting in v1.36 (existing clusters will keep their current ingress upon upgrade to avoid breakage). This transition brings the following structural changes:
+  - Airgapped Environments: The rke2-images-core tarball now contains Traefik images instead of ingress-nginx. The standalone rke2-images-traefik tarball has been removed.
+    Users who must continue using ingress-nginx will now need to manually provide the rke2-images-ingress-nginx tarball.
+  - Future Removal: The ingress-nginx chart will not receive any additional updates and will be completely removed in v1.37 for community users.
+
 - `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
 
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
@@ -63,4 +80,3 @@
 ### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}
 
 - Create the first release note entry in this section!
-

lib/attrsets.nix

@@ -1612,13 +1612,15 @@ rec {
       binaryMerge =
         start: end:
         # assert start < end; # Invariant
-        if end - start >= 2 then
-          # If there's at least 2 elements, split the range in two, recurse on each part and merge the result
-          # The invariant is satisfied because each half will have at least 1 element
-          binaryMerge start (start + (end - start) / 2) // binaryMerge (start + (end - start) / 2) end
+        if end - start == 1 then
+          # Base case - there will be exactly 1 element due to the invariant, in
+          # which case we just return it directly
+          elemAt list start
         else
-          # Otherwise there will be exactly 1 element due to the invariant, in which case we just return it directly
-          elemAt list start;
+          # If there's at least 2 elements, split the range in two, recurse on each part and merge the result
+          # Relies on floor for odd results
+          # The invariant is satisfied because each half will have at least 1 element
+          binaryMerge start ((start + end) / 2) // binaryMerge ((start + end) / 2) end;
     in
     if list == [ ] then
       # Calling binaryMerge as below would not satisfy its invariant

lib/modules.nix

@@ -1018,38 +1018,16 @@ let
           mergedType = t.typeMerge t'.functor;
           typesMergeable = mergedType != null;
 
-          # TODO: Remove this when all downstream reliances of internals: 'functor.wrapped' are sufficiently migrated.
-          # A function that adds the deprecated wrapped message to a type.
-          addDeprecatedWrapped =
-            t:
-            t
-            // {
-              functor = t.functor // {
-                wrapped = t.functor.wrappedDeprecationMessage {
-                  inherit loc;
-                };
-              };
-            };
-
           typeSet =
-            if opt.options ? type then
-              if res ? type then
-                if typesMergeable then
-                  {
-                    type =
-                      if mergedType ? functor.wrappedDeprecationMessage then
-                        addDeprecatedWrapped mergedType
-                      else
-                        mergedType;
-                  }
-                else
-                  # Keep in sync with the same error below!
-                  throw
-                    "The option `${showOption loc}' in `${opt._file}' is already declared in ${showFiles res.declarations}."
-              else if opt.options.type ? functor.wrappedDeprecationMessage then
-                { type = addDeprecatedWrapped opt.options.type; }
+            if opt.options ? type && res ? type then
+              if typesMergeable then
+                {
+                  type = mergedType;
+                }
               else
-                { }
+                # Keep in sync with the same error below!
+                throw
+                  "The option `${showOption loc}' in `${opt._file}' is already declared in ${showFiles res.declarations}."
             else
               { };
 

lib/systems/default.nix

@@ -299,12 +299,10 @@ let
         inherit
           (
             {
-              linux-kernel = args.linux-kernel or { };
               gcc = args.gcc or { };
             }
             // platforms.select final
           )
-          linux-kernel
           gcc
           ;
 
@@ -692,6 +690,11 @@ let
         };
       };
     in
+    # TODO: Remove in 27.05.
+    assert
+      args ? linux-kernel
+      -> throw "lib.systems.elaborate: linux-kernel has been removed; see the 26.11 release notes";
+
     assert final.useAndroidPrebuilt -> final.isAndroid;
     assert foldl' (pass: { assertion, message }: if assertion final then pass else throw message) true (
       final.parsed.abi.assertions or [ ]

lib/systems/platforms.nix

@@ -3,74 +3,21 @@
 # targetPlatform, etc) containing at least the minimal set of attrs
 # required (see types.parsedPlatform in lib/systems/parse.nix).  This
 # file takes an already-valid platform and further elaborates it with
-# optional fields; currently these are: linux-kernel, gcc, and rustc.
+# optional fields; currently these are: gcc, and rustc.
 
 { lib }:
 rec {
-  pc = {
-    linux-kernel = {
-      name = "pc";
-
-      baseConfig = "defconfig";
-      # Build whatever possible as a module, if not stated in the extra config.
-      autoModules = true;
-      target = "bzImage";
-    };
-  };
-
-  ##
-  ## POWER
-  ##
-
-  powernv = {
-    linux-kernel = {
-      name = "PowerNV";
-
-      baseConfig = "powernv_defconfig";
-      target = "vmlinux";
-      autoModules = true;
-    };
-  };
-
-  ppc64 = {
-    linux-kernel = {
-      name = "powerpc64";
-
-      baseConfig = "ppc64_defconfig";
-      target = "vmlinux";
-      autoModules = true;
-    };
-  };
-
   ##
   ## ARM
   ##
 
   armv5tel-multiplatform = {
-    linux-kernel = {
-      name = "armv5tel-multiplatform";
-
-      baseConfig = "multi_v5_defconfig";
-      DTB = true;
-      autoModules = true;
-      preferBuiltin = true;
-      target = "zImage";
-    };
     gcc = {
       arch = "armv5te";
     };
   };
 
   raspberrypi = {
-    linux-kernel = {
-      name = "raspberrypi";
-
-      baseConfig = "bcm2835_defconfig";
-      DTB = true;
-      autoModules = true;
-      preferBuiltin = true;
-      target = "zImage";
-    };
     gcc = {
       # https://en.wikipedia.org/wiki/Raspberry_Pi#Specifications
       arch = "armv6kz";
@@ -105,7 +52,6 @@ rec {
 
   # https://developer.android.com/ndk/guides/abis#v7a
   armv7a-android = {
-    linux-kernel.name = "armeabi-v7a";
     gcc = {
       arch = "armv7-a";
       float-abi = "softfp";
@@ -114,14 +60,6 @@ rec {
   };
 
   armv7l-hf-multiplatform = {
-    linux-kernel = {
-      name = "armv7l-hf-multiplatform";
-      baseConfig = "defconfig";
-      DTB = true;
-      autoModules = true;
-      preferBuiltin = true;
-      target = "zImage";
-    };
     gcc = {
       # Some table about fpu flags:
       # http://community.arm.com/servlet/JiveServlet/showImage/38-1981-3827/blogentry-103749-004812900+1365712953_thumb.png
@@ -146,14 +84,6 @@ rec {
   };
 
   aarch64-multiplatform = {
-    linux-kernel = {
-      name = "aarch64-multiplatform";
-      baseConfig = "defconfig";
-      DTB = true;
-      autoModules = true;
-      preferBuiltin = true;
-      target = "Image";
-    };
     gcc = {
       arch = "armv8-a";
     };
@@ -171,9 +101,6 @@ rec {
   ##
 
   ben_nanonote = {
-    linux-kernel = {
-      name = "ben_nanonote";
-    };
     gcc = {
       arch = "mips32";
       float = "soft";
@@ -230,17 +157,6 @@ rec {
   ## Other
   ##
 
-  riscv-multiplatform = {
-    linux-kernel = {
-      name = "riscv-multiplatform";
-      target = "Image";
-      autoModules = true;
-      preferBuiltin = true;
-      baseConfig = "defconfig";
-      DTB = true;
-    };
-  };
-
   loongarch64-multiplatform = {
     gcc = {
       # https://github.com/loongson/la-softdev-convention/blob/master/la-softdev-convention.adoc#10-operating-system-package-build-requirements
@@ -252,14 +168,6 @@ rec {
       # https://github.com/llvm/llvm-project/pull/132173
       cmodel = "medium";
     };
-    linux-kernel = {
-      name = "loongarch-multiplatform";
-      target = "vmlinuz.efi";
-      autoModules = true;
-      preferBuiltin = true;
-      baseConfig = "defconfig";
-      DTB = true;
-    };
   };
 
   # This function takes a minimally-valid "platform" and returns an
@@ -267,17 +175,13 @@ rec {
   # included in the platform in order to further elaborate it.
   select =
     platform:
-    # x86
-    if platform.isx86 then
-      pc
-
     # ARM
-    else if platform.isAarch32 then
+    if platform.isAarch32 then
       let
         version = platform.parsed.cpu.version or null;
       in
       if version == null then
-        pc
+        { }
       else if lib.versionOlder version "6" then
         armv5tel-multiplatform
       else if lib.versionOlder version "7" then
@@ -291,24 +195,9 @@ rec {
     else if platform.isLoongArch64 then
       loongarch64-multiplatform
 
-    else if platform.isRiscV then
-      riscv-multiplatform
-
     else if platform.parsed.cpu == lib.systems.parse.cpuTypes.mipsel then
       (import ./examples.nix { inherit lib; }).mipsel-linux-gnu
 
-    else if platform.isPower64 then
-      if platform.isLittleEndian then powernv else ppc64
-
-    else if platform.isSh4 then
-      {
-        linux-kernel = {
-          target = "vmlinux";
-          # SH arch doesn't have a 'make install' target.
-          installTarget = "vmlinux";
-        };
-      }
-
     else
       { };
 }

lib/tests/modules.sh

@@ -515,56 +515,6 @@ checkConfigError 'infinite recursion encountered' config.nonLazyResult ./lazy-at
 checkConfigOutput '^"mergedName.<id>.nested"$' config.result ./name-merge-attrsWith-1.nix
 checkConfigError 'The option .mergedName. in .*\.nix. is already declared in .*\.nix' config.mergedName ./name-merge-attrsWith-2.nix
 
-# Test type.functor.wrapped deprecation warning
-# should emit the warning on:
-# - merged types
-# - non-merged types
-# - nestedTypes elemType
-# attrsWith
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.attrsWith.type.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedAttrsWith.type.functor.wrapped ./deprecated-wrapped.nix
-
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.attrsWith.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedAttrsWith.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-# listOf
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.listOf.type.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedListOf.type.functor.wrapped ./deprecated-wrapped.nix
-
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.listOf.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedListOf.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-# unique / uniq
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.unique.type.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedUnique.type.functor.wrapped ./deprecated-wrapped.nix
-
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.unique.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedUnique.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-# nullOr
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.nullOr.type.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedNullOr.type.functor.wrapped ./deprecated-wrapped.nix
-
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.nullOr.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedNullOr.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-# functionTo
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.functionTo.type.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedFunctionTo.type.functor.wrapped ./deprecated-wrapped.nix
-
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.functionTo.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedFunctionTo.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
-
-# coercedTo
-# Note: test 'nestedTypes.finalType' and 'nestedTypes.coercedType'
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.coercedTo.type.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.coercedTo.type.nestedTypes.finalType.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.coercedTo.type.nestedTypes.coercedType.functor.wrapped ./deprecated-wrapped.nix
-# either
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.either.type.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedEither.type.functor.wrapped ./deprecated-wrapped.nix
-
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.either.type.nestedTypes.left.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.either.type.nestedTypes.right.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedEither.type.nestedTypes.left.functor.wrapped ./deprecated-wrapped.nix
-ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedEither.type.nestedTypes.right.functor.wrapped ./deprecated-wrapped.nix
-
 # Even with multiple assignments, a type error should be thrown if any of them aren't valid
 checkConfigError 'A definition for option .* is not of type .*' \
   config.value ./declare-int-unsigned-value.nix ./define-value-list.nix ./define-value-int-positive.nix
@@ -733,9 +683,6 @@ checkConfigError 'The option .theOption.nested. in .other.nix. is already declar
 # Test that types.optionType leaves types untouched as long as they don't need to be merged
 checkConfigOutput 'ok' config.freeformItems.foo.bar ./adhoc-freeformType-survives-type-merge.nix
 
-# Test that specifying both functor.wrapped and functor.payload isn't allowed
-checkConfigError 'Type foo defines both `functor.payload` and `functor.wrapped` at the same time, which is not supported.' config.result ./default-type-merge-both.nix
-
 # Test that not including functor.wrapped is allowed
 checkConfigOutput 'ok' config.result ./default-type-merge-payload.nix
 

lib/tests/modules/default-type-merge-both.nix

@@ -1,28 +0,0 @@
-{ lib, options, ... }:
-let
-  foo = lib.mkOptionType {
-    name = "foo";
-    functor = lib.types.defaultFunctor "foo" // {
-      wrapped = lib.types.int;
-      payload = 10;
-    };
-  };
-in
-{
-  imports = [
-    {
-      options.foo = lib.mkOption {
-        type = foo;
-      };
-    }
-    {
-      options.foo = lib.mkOption {
-        type = foo;
-      };
-    }
-  ];
-
-  options.result = lib.mkOption {
-    default = builtins.seq options.foo null;
-  };
-}

lib/types.nix

@@ -99,7 +99,6 @@ let
     { elemType, ... }@payload:
     {
       inherit name payload;
-      wrappedDeprecationMessage = makeWrappedDeprecationMessage payload;
       type = types.${name};
       binOp =
         a: b:
@@ -108,14 +107,6 @@ let
         in
         if merged == null then null else { elemType = merged; };
     };
-  makeWrappedDeprecationMessage =
-    payload:
-    { loc }:
-    lib.warn ''
-      The deprecated `${lib.optionalString (loc != null) "type."}functor.wrapped` attribute ${
-        lib.optionalString (loc != null) "of the option `${showOption loc}` "
-      }is accessed, use `${lib.optionalString (loc != null) "type."}nestedTypes.elemType` instead.
-    '' payload.elemType;
 
   checkDefsForError =
     check: loc: defs:
@@ -168,21 +159,11 @@ rec {
   defaultTypeMerge =
     f: f':
     let
-      mergedWrapped = f.wrapped.typeMerge f'.wrapped.functor;
       mergedPayload = f.binOp f.payload f'.payload;
 
       hasPayload =
         assert (f'.payload != null) == (f.payload != null);
         f.payload != null;
-      hasWrapped =
-        let
-          hasWrappedNonNull = set: set ? "wrapped" && set.wrapped != null;
-        in
-        assert (hasWrappedNonNull f') == (hasWrappedNonNull f);
-        hasWrappedNonNull f;
-
-      typeFromPayload = if mergedPayload == null then null else f.type mergedPayload;
-      typeFromWrapped = if mergedWrapped == null then null else f.type mergedWrapped;
     in
     # Abort early: cannot merge different types
     if f.name != f'.name then
@@ -190,22 +171,7 @@ rec {
     else
 
     if hasPayload then
-      # Just return the payload if returning wrapped is deprecated
-      if f ? wrappedDeprecationMessage then
-        typeFromPayload
-      else if hasWrapped then
-        # Has both wrapped and payload
-        throw ''
-          Type ${f.name} defines both `functor.payload` and `functor.wrapped` at the same time, which is not supported.
-
-          Use either `functor.payload` or `functor.wrapped` but not both.
-
-          If your code worked before remove either `functor.wrapped` or `functor.payload` from the type definition.
-        ''
-      else
-        typeFromPayload
-    else if hasWrapped then
-      typeFromWrapped
+      if mergedPayload == null then null else f.type mergedPayload
     else
       f.type;
 
@@ -213,7 +179,6 @@ rec {
   defaultFunctor = name: {
     inherit name;
     type = lib.types.${name} or null;
-    wrapped = null;
     payload = null;
     binOp = a: b: null;
   };
@@ -309,17 +274,8 @@ rec {
         deprecationMessage
         nestedTypes
         descriptionClass
+        functor
         ;
-      functor =
-        if functor ? wrappedDeprecationMessage then
-          functor
-          // {
-            wrapped = functor.wrappedDeprecationMessage {
-              loc = null;
-            };
-          }
-        else
-          functor;
       description = if description == null then name else description;
     };
 
@@ -1834,9 +1790,7 @@ rec {
       getSubModules = finalType.getSubModules;
       substSubModules = m: coercedTo coercedType coerceFunc (finalType.substSubModules m);
       typeMerge = t: null;
-      functor = (defaultFunctor name) // {
-        wrappedDeprecationMessage = makeWrappedDeprecationMessage { elemType = finalType; };
-      };
+      functor = defaultFunctor name;
       nestedTypes.coercedType = coercedType;
       nestedTypes.finalType = finalType;
     };

maintainers/github-teams.json

@@ -128,7 +128,6 @@
       "Pandapip1": 45835846,
       "a-kenji": 65275785,
       "drakon64": 6444703,
-      "michaelBelsanti": 62124625,
       "thefossguy": 44400303
     },
     "name": "COSMIC"
@@ -847,6 +846,18 @@
     },
     "name": "Radicle"
   },
+  "redis": {
+    "description": "Maintain Redis, related packages, module, and tests.",
+    "id": 17932473,
+    "maintainers": {
+      "Hythera": 87016780,
+      "MiniHarinn": 52773156,
+      "debtquity": 225436867,
+      "kybe236": 118068228
+    },
+    "members": {},
+    "name": "Redis"
+  },
   "reproducible": {
     "description": "Team that is interested in reproducible builds",
     "id": 7625643,

maintainers/maintainer-list.nix

@@ -157,6 +157,12 @@
     githubId = 105598867;
     matrix = "@0xmrtt:envs.net";
   };
+  _0xSA7 = {
+    name = "Saleh Diaa Ahmed";
+    github = "0xSA7";
+    githubId = 109046494;
+    email = "salehdiaaahmed@gmail.com";
+  };
   _1000101 = {
     email = "b1000101@pm.me";
     github = "1000101";
@@ -329,12 +335,6 @@
     githubId = 381298;
     name = "9R";
   };
-  _9yokuro = {
-    email = "xzstd099@protonmail.com";
-    github = "9yokuro";
-    githubId = 119095935;
-    name = "9yokuro";
-  };
   a-camarillo = {
     name = "Anthony Camarillo";
     email = "anthony.camarillo.96@gmail.com";
@@ -2133,6 +2133,12 @@
     githubId = 56009;
     name = "Arcadio Rubio García";
   };
+  arcayr = {
+    email = "nixpkgs@arcayr.online";
+    github = "arcayr";
+    githubId = 11192354;
+    name = "Elliot Speck";
+  };
   archer-65 = {
     email = "mario.liguori.056@gmail.com";
     github = "archer-65";
@@ -3438,12 +3444,6 @@
     githubId = 20448408;
     keys = [ { fingerprint = "D446 E58D 87A0 31C7 EC15  88D7 B461 2924 45C6 E696"; } ];
   };
-  berce = {
-    email = "bert.moens@gmail.com";
-    github = "berce";
-    githubId = 10439709;
-    name = "Bert Moens";
-  };
   bergey = {
     email = "bergey@teallabs.org";
     github = "bergey";
@@ -4439,12 +4439,6 @@
     githubId = 54632731;
     name = "Cameron Dugan";
   };
-  cameronfyfe = {
-    email = "cameron.j.fyfe@gmail.com";
-    github = "cameronfyfe";
-    githubId = 21013281;
-    name = "Cameron Fyfe";
-  };
   cameronnemo = {
     email = "cnemo@tutanota.com";
     github = "CameronNemo";
@@ -5097,12 +5091,6 @@
     githubId = 68112;
     name = "Simon";
   };
-  cirno-999 = {
-    email = "reverene@protonmail.com";
-    github = "cirno-999";
-    githubId = 73712874;
-    name = "cirno-999";
-  };
   citadelcore = {
     email = "alex@arctarus.co.uk";
     github = "RealityAnomaly";
@@ -7859,12 +7847,6 @@
     githubId = 27162016;
     name = "Ramdip Gill";
   };
-  elasticdog = {
-    email = "aaron@elasticdog.com";
-    github = "elasticdog";
-    githubId = 4742;
-    name = "Aaron Bull Schaefer";
-  };
   elatov = {
     email = "elatov@gmail.com";
     github = "elatov";
@@ -8387,11 +8369,6 @@
     githubId = 16175276;
     keys = [ { fingerprint = "E4CE B0F0 B2EC 09A3 9678  F294 CC7A 7E3C 6CF3 1343"; } ];
   };
-  EstebanMacanek = {
-    name = "Esteban Macanek";
-    github = "EstebanMacanek";
-    githubId = 75503218;
-  };
   esteve = {
     name = "Esteve Fernandez";
     email = "nixpkgs@nara.ac";
@@ -9663,6 +9640,11 @@
     githubId = 293586;
     name = "Adam Gamble";
   };
+  gamebeaker = {
+    github = "gamebeaker";
+    githubId = 9269847;
+    name = "gamebeaker";
+  };
   gamedungeon = {
     github = "GameDungeon";
     githubId = 60719255;
@@ -10930,6 +10912,11 @@
     githubId = 58676303;
     name = "hhydraa";
   };
+  hibiday = {
+    name = "Katsumi Takeuchi";
+    github = "hibiday";
+    githubId = 137286929;
+  };
   higebu = {
     name = "Yuya Kusakabe";
     email = "yuya.kusakabe@gmail.com";
@@ -11890,12 +11877,6 @@
     github = "ivan-timokhin";
     githubId = 9802104;
   };
-  ivan-tkatchev = {
-    email = "tkatchev@gmail.com";
-    github = "ivan-tkatchev";
-    githubId = 650601;
-    name = "Ivan Tkatchev";
-  };
   ivan770 = {
     email = "ivan@ivan770.me";
     github = "ivan770";
@@ -12111,6 +12092,12 @@
     github = "Jaculabilis";
     githubId = 10787844;
   };
+  jadewilk = {
+    name = "Jade Wilk";
+    email = "p.wilk@student.reading.ac.uk";
+    github = "jadewilk";
+    githubId = 50517631;
+  };
   jaduff = {
     email = "jdduffpublic@proton.me";
     github = "jaduff";
@@ -13058,6 +13045,13 @@
     name = "João Moreira";
     keys = [ { fingerprint = "F457 0A3A 5F89 22F8 F572  E075 EF8B F2C8 C5F4 097D"; } ];
   };
+  joaosreis = {
+    email = "joaosreis@outlook.pt";
+    github = "joaosreis";
+    githubId = 3420596;
+    name = "João Santos Reis";
+    keys = [ { fingerprint = "9BEB F137 4CAC 96D6 A4ED  EC49 BA2E 05BD B7F8 C0EE"; } ];
+  };
   joaquintrinanes = {
     email = "hi@joaquint.io";
     github = "JoaquinTrinanes";
@@ -13447,12 +13441,6 @@
     github = "joshprk";
     githubId = 123624726;
   };
-  joshuafern = {
-    name = "Joshua Fern";
-    email = "joshuafern@protonmail.com";
-    github = "JoshuaFern";
-    githubId = 4300747;
-  };
   joshvanl = {
     email = " me@joshvanl.dev ";
     github = "JoshVanL";
@@ -18485,13 +18473,6 @@
     github = "mohe2015";
     githubId = 13287984;
   };
-  momeemt = {
-    name = "Mutsuha Asada";
-    email = "me@momee.mt";
-    github = "momeemt";
-    githubId = 43488453;
-    keys = [ { fingerprint = "D94F EA9F 5B08 F6A1 7B8F  EB8B ACB5 4F0C BC6A A7C6"; } ];
-  };
   monaaraj = {
     name = "Mon Aaraj";
     email = "owo69uwu69@gmail.com";
@@ -19249,12 +19230,6 @@
     name = "Nasir Hussain";
     keys = [ { fingerprint = "7A10 AB8E 0BEC 566B 090C  9BE3 D812 6E55 9CE7 C35D"; } ];
   };
-  nasrally = {
-    email = "suffer.ring@ya.ru";
-    github = "nasrally";
-    githubId = 50599445;
-    name = "Nikita Grishko";
-  };
   nat-418 = {
     github = "nat-418";
     githubId = 93013864;
@@ -19389,6 +19364,12 @@
     githubId = 137805;
     name = "Alexander Tsvyashchenko";
   };
+  ndom91 = {
+    email = "nix@ndo.dev";
+    github = "ndom91";
+    githubId = 7415984;
+    name = "Nico Domino";
+  };
   nealfennimore = {
     email = "hi@neal.codes";
     github = "nealfennimore";
@@ -19786,6 +19767,11 @@
     github = "nigelgbanks";
     githubId = 487373;
   };
+  nikhilmaddirala = {
+    name = "Nikhil Maddirala";
+    github = "nikhilmaddirala";
+    githubId = 4138581;
+  };
   nikitavoloboev = {
     email = "nikita.voloboev@gmail.com";
     github = "nikivdev";
@@ -21633,12 +21619,6 @@
     githubId = 43863;
     name = "Philip Taron";
   };
-  philipwilk = {
-    name = "Philip Wilk";
-    email = "p.wilk@student.reading.ac.uk";
-    github = "philipwilk";
-    githubId = 50517631;
-  };
   philocalyst = {
     name = "Myles Wirth";
     email = "milestheperson@posteo.net";
@@ -22323,12 +22303,6 @@
     githubId = 6314611;
     keys = [ { fingerprint = "EEC7 53FC EAAA FD9E 4DC0  9BB5 CAEB 4185 C226 D76B"; } ];
   };
-  prominentretail = {
-    email = "me@jakepark.me";
-    github = "ProminentRetail";
-    githubId = 94048404;
-    name = "Jake Park";
-  };
   proofconstruction = {
     email = "source@proof.construction";
     github = "proofconstruction";
@@ -22777,11 +22751,6 @@
     matrix = "@qyriad:katesiria.org";
     name = "Qyriad";
   };
-  qzylinra = {
-    github = "qzylinra";
-    githubId = 225773816;
-    name = "qzylinra";
-  };
   r-aizawa = {
     github = "Xantibody";
     githubId = 109563705;
@@ -27110,7 +27079,7 @@
     email = "taranarmo@gmail.com";
     github = "taranarmo";
     githubId = 11619234;
-    name = "Sergey Volkov";
+    name = "Sergei Volkov";
   };
   tarantoj = {
     email = "taranto.james@gmail.com";
@@ -28987,6 +28956,14 @@
     githubId = 110242808;
     name = "Vasilii Pustovoit";
   };
+  vavakado = {
+    email = "xor@vavakado.xyz";
+    github = "vavakado";
+    githubId = 80159210;
+    name = "Vladimir Rubin";
+    matrix = "@vavakado:imagisphe.re";
+    keys = [ { fingerprint = "A054 0374 CD37 2C71 FE6D  E0CF CAB7 4472 7F36 B524"; } ];
+  };
   vbgl = {
     email = "Vincent.Laporte@gmail.com";
     github = "vbgl";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -360,6 +360,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
   If client certificates, keys or other files are needed, these should be stored under `/etc/wpa_supplicant` and owned by `wpa_supplicant` to ensure the daemon can read them.
 
+  Similarly, the `ctrl_interface` directory set in `wpa_supplicant`'s conf must be writeable by the `wpa_supplicant` user so that the `wpa_supplicant` daemon can start successfully. If you were changing `ctrl_interface` in [extraConfig](#opt-networking.wireless.extraConfig) or in `/etc/wpa_supplicant/imperative.conf`, please remove that line.
+
   Also, the {option}`networking.wireless.userControlled.group` option has been removed since there is now a dedicated `wpa_supplicant` group to control the daemon, and {option}`networking.wireless.userControlled.enable` has been renamed to [](#opt-networking.wireless.userControlled).
 
   No functionality should have been impacted by these changes (including controlling via `wpa_cli`, integration with NetworkManager or connman), but if you find any problems, please open an issue on GitHub.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -24,20 +24,28 @@
 
 - Support for the legacy U‐Boot image format has been removed from the initrd generators, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
 
+- Rustical migrates from `settings.http.host` and `settings.http.port` to `settings.http.bind` to support UNIX domain sockets as well as TCP sockets in one setting.
+
 - `services.llama-cpp` is now configured using structured `services.llama-cpp.settings` attribute.
 
 - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
 
+- `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.
+
 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
 
 - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.
 
 - `services.firezone.server.provision` has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone.
 
+- The `services.syncthing` module now updates the Syncthing REST API using partial updates (`PATCH`) instead of full replacements (`PUT`) for general settings. Updating these settings was broken and prone to errors after updates, see [#428808](https://github.com/NixOS/nixpkgs/issues/428808) and [#528889](https://github.com/NixOS/nixpkgs/issues/528889). As a result, settings modified manually through the Syncthing Web UI that are not explicitly defined in your Nix configuration will now persist across rebuilds.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `komodo` has been updated to the v2 release line (2.x). See the [upstream v1 → v2 upgrade guide](https://github.com/moghtech/komodo/releases/tag/v2.0.0).
+
 - `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.
 
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.

nixos/lib/make-multi-disk-zfs-image.nix

@@ -262,7 +262,8 @@ let
         "virtiofs"
         "zfs"
       ];
-      kernel = modulesTree;
+      kernel = config.boot.kernelPackages.kernel;
+      kernelModules = modulesTree;
     }).runInLinuxVM
       (
         pkgs.runCommand name

nixos/lib/make-single-disk-zfs-image.nix

@@ -250,7 +250,8 @@ let
         "virtiofs"
         "zfs"
       ];
-      kernel = modulesTree;
+      kernel = config.boot.kernelPackages.kernel;
+      kernelModules = modulesTree;
     }).runInLinuxVM
       (
         pkgs.runCommand name

nixos/lib/utils.nix

@@ -14,6 +14,7 @@ let
     escapeShellArg
     filter
     flatten
+    foldl'
     getName
     hasPrefix
     hasSuffix
@@ -31,13 +32,13 @@ let
     nameValuePair
     optionalString
     removePrefix
-    removeSuffix
     replaceStrings
+    splitString
     stringToCharacters
     types
     ;
 
-  inherit (lib.strings) toJSON normalizePath escapeC;
+  inherit (lib.strings) toJSON escapeC;
 in
 
 let
@@ -98,26 +99,60 @@ let
       || hasPrefix a'.mountPoint b'.mountPoint
       || any (hasPrefix a'.mountPoint) b'.depends;
 
-    # Escape a path according to the systemd rules. FIXME: slow
+    # Escape a path according to the systemd rules.
     # The rules are described in systemd.unit(5) as follows:
     # The escaping algorithm operates as follows: given a string, any "/" character is replaced by "-", and all other characters which are not ASCII alphanumerics, ":", "_" or "." are replaced by C-style "\x2d" escapes. In addition, "." is replaced with such a C-style escape when it would appear as the first character in the escaped string.
     # When the input qualifies as absolute file system path, this algorithm is extended slightly: the path to the root directory "/" is encoded as single dash "-". In addition, any leading, trailing or duplicate "/" characters are removed from the string before transformation. Example: /foo//bar/baz/ becomes "foo-bar-baz".
     escapeSystemdPath =
-      s:
       let
+        # These don't depend on the path being escaped, so build them once
+        # rather than on every call.
+        escapeChar = escapeC (stringToCharacters " !\"#$%&'()*+,;<=>?@[\\]^`{|}~-");
+        escapeLeadingDot = escapeC [ "." ] ".";
+        slashesToDashes = replaceStrings [ "/" ] [ "-" ];
         replacePrefix =
           p: r: s:
-          (if (hasPrefix p s) then r + (removePrefix p s) else s);
-        trim = s: removeSuffix "/" (removePrefix "/" s);
-        normalizedPath = normalizePath s;
+          (if hasPrefix p s then r + removePrefix p s else s);
       in
-      replaceStrings [ "/" ] [ "-" ] (
-        replacePrefix "." (escapeC [ "." ] ".") (
-          escapeC (stringToCharacters " !\"#$%&'()*+,;<=>=@[\\]^`{|}~-") (
-            if normalizedPath == "/" then normalizedPath else trim normalizedPath
-          )
-        )
-      );
+      s:
+      let
+        isAbsolute = hasPrefix "/" s;
+        # path_simplify(): collapse duplicate slashes and drop "." components.
+        rawComponents = filter (c: c != "" && c != ".") (splitString "/" s);
+        # systemd accepts ".." only where it is redundant: a leading ".." in an
+        # absolute path refers to the root's parent, i.e. the root itself, and is
+        # dropped. Any other ".." cannot be resolved without the filesystem, so
+        # the path is not normalized and systemd-escape errors on it.
+        simplified =
+          foldl'
+            (
+              acc: c:
+              if c == ".." then
+                # A leading ".." in an absolute path is the only redundant case.
+                if isAbsolute && acc.components == [ ] then acc else acc // { normalized = false; }
+              else
+                acc // { components = acc.components ++ [ c ]; }
+            )
+            {
+              components = [ ];
+              normalized = true;
+            }
+            rawComponents;
+        notNormalized = throw "escapeSystemdPath: ${s} is not a normalized path";
+        simplifiedPath =
+          if !simplified.normalized then
+            notNormalized
+          else if simplified.components != [ ] then
+            concatStringsSep "/" simplified.components
+          # The root directory, and - matching systemd-escape - the empty string.
+          else if isAbsolute || s == "" then
+            "/"
+          # A relative path that reduces to nothing (e.g. "."), which has no
+          # valid escaping.
+          else
+            notNormalized;
+      in
+      slashesToDashes (replacePrefix "." escapeLeadingDot (escapeChar simplifiedPath));
 
     # Quotes an argument for use in Exec* service lines.
     # systemd accepts "-quoted strings with escape sequences, toJSON produces

nixos/modules/config/fonts/fontconfig.nix

@@ -127,6 +127,38 @@ let
       </fontconfig>
     '';
 
+  # user defined font aliases
+  # priority 53
+  aliases =
+    let
+      mkFontBlock =
+        key: fonts:
+        lib.optionalString ((builtins.length fonts) > 0) ''
+          <${key}>
+          ${lib.concatMapStrings (font: "<family>${font}</family>") fonts}
+          </${key}>
+        '';
+
+      mkAliasBlock = family: opts: ''
+        <alias binding="${opts.binding}">
+          <family>${family}</family>
+          ${mkFontBlock "prefer" opts.prefer}
+          ${mkFontBlock "accept" opts.accept}
+          ${mkFontBlock "default" opts.default}
+        </alias>
+      '';
+    in
+    pkgs.writeText "fc-53-user-aliases.conf" ''
+      <?xml version='1.0'?>
+      <!DOCTYPE fontconfig SYSTEM 'urn:fontconfig:fonts.dtd'>
+      <fontconfig>
+
+        <!-- User defined aliases -->
+        ${lib.concatStrings (lib.mapAttrsToList mkAliasBlock cfg.aliases)}
+
+      </fontconfig>
+    '';
+
   # bitmap font options
   # priority 53
   rejectBitmaps = pkgs.writeText "fc-53-no-bitmaps.conf" ''
@@ -245,6 +277,9 @@ let
         # 53-no-bitmaps.conf
         ln -s ${rejectBitmaps} $dst/53-no-bitmaps.conf
 
+        # 53-user-aliases.conf
+        ln -s ${aliases} $dst/53-user-aliases.conf
+
         ${lib.optionalString (!cfg.allowType1) ''
           # 53-nixos-reject-type1.conf
           ln -s ${rejectType1} $dst/53-nixos-reject-type1.conf
@@ -522,6 +557,69 @@ in
           description = "Use embedded bitmaps in fonts like Calibri.";
         };
 
+        aliases = lib.mkOption {
+          type = lib.types.attrsOf (
+            lib.types.submodule {
+              options = {
+                binding = lib.mkOption {
+                  type = lib.types.enum [
+                    "same"
+                    "weak"
+                    "strong"
+                  ];
+                  default = "same";
+                  description = ''
+                    Binding precedence for this font family. See
+                    fontconfig "Font Matching" section for details.
+                  '';
+                };
+
+                prefer = lib.mkOption {
+                  type = lib.types.listOf lib.types.str;
+                  default = [ ];
+                  description = ''
+                    Fonts whose glyphs are chosen preferentially prior
+                    to fonts which match the alias family.
+                  '';
+                };
+
+                accept = lib.mkOption {
+                  type = lib.types.listOf lib.types.str;
+                  default = [ ];
+                  description = ''
+                    Fonts that are chosen if none of the preferred
+                    fonts, nor the alias family could provide the
+                    desired glyph.
+                  '';
+                };
+
+                default = lib.mkOption {
+                  type = lib.types.listOf lib.types.str;
+                  default = [ ];
+                  description = ''
+                    Last chance fallback fonts which are chosen by
+                    default if none of the other options could
+                    provide the desired glyph.
+                  '';
+                };
+              };
+            }
+          );
+          default = { };
+          example = lib.literalExpression ''
+            {
+                # use FreeSans for Greek symbols missing in Helvetica
+                "Helvetica" = {
+                    default = [ "FreeSans" ];
+                };
+            };
+          '';
+          description = ''
+            Font aliases that can substitute preferential fonts,
+            or specify custom fallback fonts.
+          '';
+        };
+
       };
 
     };
@@ -557,6 +655,9 @@ in
         # 52-nixos-default-fonts.conf
         r ${defaultFontsConf},
 
+        # 53-user-aliases.conf
+        r ${aliases},
+
         # 53-no-bitmaps.conf
         r ${rejectBitmaps},
 

nixos/modules/config/malloc.nix

@@ -142,10 +142,14 @@ in
         # so we can warn the user about the change.
         legacyOptionsUsed = lib.lists.filter (opt: lib.strings.hasInfix opt scudoOpts) legacyOptionNames;
       in
-      lib.optional (cfg.provider == "scudo" && legacyOptionsUsed != [ ]) ''
-        environment.variables.SCUDO_OPTIONS: ${lib.concatStringsSep ", " legacyOptionsUsed} is/are no longer valid Scudo options.
-        Use snake_case instead of CamelCase: https://llvm.org/docs/ScudoHardenedAllocator.html#options
-      '';
+      lib.optional
+        (
+          config.environment.variables ? SCUDO_OPTIONS && cfg.provider == "scudo" && legacyOptionsUsed != [ ]
+        )
+        ''
+          environment.variables.SCUDO_OPTIONS: ${lib.concatStringsSep ", " legacyOptionsUsed} is/are no longer valid Scudo options.
+          Use snake_case instead of CamelCase: https://llvm.org/docs/ScudoHardenedAllocator.html#options
+        '';
 
     environment.etc."ld-nix.so.preload".text = ''
       ${providerLibPath}

nixos/modules/config/xdg/autostart.nix

@@ -4,21 +4,33 @@
     teams = [ lib.teams.freedesktop ];
   };
 
-  options = {
-    xdg.autostart.enable = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = ''
-        Whether to install files to support the
-        [XDG Autostart specification](https://specifications.freedesktop.org/autostart-spec/latest).
-      '';
-    };
+  options.xdg.autostart = {
+    enable =
+      lib.mkEnableOption "auto-starting of desktop applications according to the [XDG Autostart specification](https://specifications.freedesktop.org/autostart-spec/latest)."
+      // lib.mkOption {
+        default = true;
+      };
+    install =
+      lib.mkEnableOption ''
+        install desktop files following the [XDG Autostart specification](https://specifications.freedesktop.org/autostart-spec/latest) into `/etc/xdg/autostart/`.
+
+        These are handled by your desktop environment or [`systemd-xdg-autostart-generator`](https://www.freedesktop.org/software/systemd/man/latest/systemd-xdg-autostart-generator.html).
+      ''
+      // lib.mkOption {
+        default = true;
+      };
   };
 
-  config = lib.mkIf config.xdg.autostart.enable {
-    environment.pathsToLink = [
+  config = {
+    # FIXME this does not actually work because "/etc/xdg" is linked
+    # unconditionally in `nixos/modules/config/system-path.nix`
+    environment.pathsToLink = lib.mkIf config.xdg.autostart.install [
       "/etc/xdg/autostart"
     ];
-  };
 
+    # On by default
+    systemd.user.generators.systemd-xdg-autostart-generator = lib.mkIf (!config.xdg.autostart.enable) (
+      lib.mkDefault "/dev/null"
+    );
+  };
 }

nixos/modules/hardware/device-tree.nix

@@ -123,7 +123,8 @@ in
   options = {
     hardware.deviceTree = {
       enable = lib.mkOption {
-        default = pkgs.stdenv.hostPlatform.linux-kernel.DTB or false;
+        default = config.boot.kernelPackages.kernel.buildDTBs;
+        defaultText = lib.literalExpression "config.boot.kernelPackages.kernel.buildDTBs";
         type = lib.types.bool;
         description = ''
           Build device tree files. These are used to describe the

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares.nix

@@ -11,6 +11,9 @@ in
 {
   imports = [ ./installation-cd-graphical-base.nix ];
 
+  # required for calamares
+  security.polkit.enablePkexecWrapper = true;
+
   # required for kpmcore to work correctly
   programs.partition-manager.enable = true;
 

nixos/modules/installer/cd-dvd/sd-image-aarch64-new-kernel.nix

@@ -1,14 +0,0 @@
-{ config, ... }:
-{
-  imports = [
-    ../sd-card/sd-image-aarch64-new-kernel-installer.nix
-  ];
-  config = {
-    warnings = [
-      ''
-        .../cd-dvd/sd-image-aarch64-new-kernel.nix is deprecated and will eventually be removed.
-        Please switch to .../sd-card/sd-image-aarch64-new-kernel-installer.nix, instead.
-      ''
-    ];
-  };
-}

nixos/modules/installer/cd-dvd/sd-image-aarch64.nix

@@ -1,14 +0,0 @@
-{ config, ... }:
-{
-  imports = [
-    ../sd-card/sd-image-aarch64-installer.nix
-  ];
-  config = {
-    warnings = [
-      ''
-        .../cd-dvd/sd-image-aarch64.nix is deprecated and will eventually be removed.
-        Please switch to .../sd-card/sd-image-aarch64-installer.nix, instead.
-      ''
-    ];
-  };
-}

nixos/modules/installer/cd-dvd/sd-image-armv7l-multiplatform.nix

@@ -1,14 +0,0 @@
-{ config, ... }:
-{
-  imports = [
-    ../sd-card/sd-image-armv7l-multiplatform-installer.nix
-  ];
-  config = {
-    warnings = [
-      ''
-        .../cd-dvd/sd-image-armv7l-multiplatform.nix is deprecated and will eventually be removed.
-        Please switch to .../sd-card/sd-image-armv7l-multiplatform-installer.nix, instead.
-      ''
-    ];
-  };
-}

nixos/modules/installer/cd-dvd/sd-image-raspberrypi.nix

@@ -1,14 +0,0 @@
-{ config, ... }:
-{
-  imports = [
-    ../sd-card/sd-image-raspberrypi-installer.nix
-  ];
-  config = {
-    warnings = [
-      ''
-        .../cd-dvd/sd-image-raspberrypi.nix is deprecated and will eventually be removed.
-        Please switch to .../sd-card/sd-image-raspberrypi-installer.nix, instead.
-      ''
-    ];
-  };
-}

nixos/modules/installer/cd-dvd/sd-image.nix

@@ -1,14 +0,0 @@
-{ config, ... }:
-{
-  imports = [
-    ../sd-card/sd-image.nix
-  ];
-  config = {
-    warnings = [
-      ''
-        .../cd-dvd/sd-image.nix is deprecated and will eventually be removed.
-        Please switch to .../sd-card/sd-image.nix, instead.
-      ''
-    ];
-  };
-}

nixos/modules/installer/netboot/netboot.nix

@@ -111,7 +111,7 @@ with lib;
       #!ipxe
       # Use the cmdline variable to allow the user to specify custom kernel params
       # when chainloading this script from other iPXE scripts like netboot.xyz
-      kernel ${pkgs.stdenv.hostPlatform.linux-kernel.target} init=${config.system.build.toplevel}/init initrd=initrd ${toString config.boot.kernelParams} ''${cmdline}
+      kernel ${config.boot.kernelPackages.kernel.target} init=${config.system.build.toplevel}/init initrd=initrd ${toString config.boot.kernelParams} ''${cmdline}
       initrd initrd
       boot
     '';

nixos/modules/installer/tools/tools.nix

@@ -330,7 +330,7 @@ in
           '';
 
           config = lib.mkIf config.system.tools.nixos-rebuild.enableRun0Elevation {
-            security.polkit.enable = lib.mkDefault true;
+            security.run0.enable = lib.mkDefault true;
             environment.systemPackages = [ pkgs.polkit-stdin-agent ];
           };
         }

nixos/modules/module-list.nix

@@ -1961,6 +1961,7 @@
   ./system/boot/systemd/userdbd.nix
   ./system/boot/timesyncd.nix
   ./system/boot/tmp.nix
+  ./system/boot/tzpfms.nix
   ./system/boot/uki.nix
   ./system/boot/unl0kr.nix
   ./system/boot/uvesafb.nix

nixos/modules/programs/clash-verge.nix

@@ -81,6 +81,7 @@
           LockPersonality = true;
           RestrictRealtime = true;
           RuntimeDirectory = "clash-verge-rev";
+          StateDirectory = "clash-verge-service";
           ProtectClock = true;
           MemoryDenyWriteExecute = true;
           RestrictSUIDSGID = true;

nixos/modules/programs/gamemode.nix

@@ -60,7 +60,10 @@ in
     };
 
     security = {
-      polkit.enable = true;
+      polkit = {
+        enable = true;
+        enablePkexecWrapper = lib.mkDefault true;
+      };
       wrappers = lib.mkIf cfg.enableRenice {
         gamemoded = {
           owner = "root";

nixos/modules/programs/throne.nix

@@ -64,32 +64,36 @@ in
     # 3. Put ThroneCore into a systemd service, and let polkit check service name.
     #    This is the most secure and convenient way but requires heavy modification
     #    to Throne source code. Would be good to let upstream support that eventually.
-    security.polkit.extraConfig =
-      lib.mkIf (cfg.tunMode.enable && (!cfg.tunMode.setuid) && config.services.resolved.enable)
-        ''
-          polkit.addRule(function(action, subject) {
-            const allowedActionIds = [
-              "org.freedesktop.resolve1.revert",
-              "org.freedesktop.resolve1.set-domains",
-              "org.freedesktop.resolve1.set-default-route",
-              "org.freedesktop.resolve1.set-dns-servers"
-            ];
+    security.polkit = {
+      enable = true;
+      enablePkexecWrapper = lib.mkDefault true;
+      extraConfig =
+        lib.mkIf (cfg.tunMode.enable && (!cfg.tunMode.setuid) && config.services.resolved.enable)
+          ''
+            polkit.addRule(function(action, subject) {
+              const allowedActionIds = [
+                "org.freedesktop.resolve1.revert",
+                "org.freedesktop.resolve1.set-domains",
+                "org.freedesktop.resolve1.set-default-route",
+                "org.freedesktop.resolve1.set-dns-servers"
+              ];
 
-            if (allowedActionIds.indexOf(action.id) !== -1) {
-              try {
-                var parentPid = polkit.spawn(["${lib.getExe' pkgs.procps "ps"}", "-o", "ppid=", subject.pid]).trim();
-                var parentCap = polkit.spawn(["${lib.getExe' pkgs.libcap "getpcaps"}", parentPid]).trim();
-                if (parentCap.includes("cap_net_admin") && parentCap.includes("cap_net_raw")) {
-                  return polkit.Result.YES;
-                } else {
+              if (allowedActionIds.indexOf(action.id) !== -1) {
+                try {
+                  var parentPid = polkit.spawn(["${lib.getExe' pkgs.procps "ps"}", "-o", "ppid=", subject.pid]).trim();
+                  var parentCap = polkit.spawn(["${lib.getExe' pkgs.libcap "getpcaps"}", parentPid]).trim();
+                  if (parentCap.includes("cap_net_admin") && parentCap.includes("cap_net_raw")) {
+                    return polkit.Result.YES;
+                  } else {
+                    return polkit.Result.NOT_HANDLED;
+                  }
+                } catch (e) {
                   return polkit.Result.NOT_HANDLED;
                 }
-              } catch (e) {
-                return polkit.Result.NOT_HANDLED;
               }
-            }
-          })
-        '';
+            })
+          '';
+    };
   };
 
   meta.maintainers = with lib.maintainers; [ aleksana ];

nixos/modules/programs/wayland/hyprland.nix

@@ -107,9 +107,9 @@ in
         services.displayManager.sessionPackages = [ cfg.package ];
 
         systemd = lib.mkIf cfg.systemd.setPath.enable {
-          user.extraConfig = ''
-            DefaultEnvironment="PATH=/run/wrappers/bin:/etc/profiles/per-user/%u/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:$PATH"
-          '';
+          user.settings.Manager = {
+            DefaultEnvironment = "PATH=/run/wrappers/bin:/etc/profiles/per-user/%u/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:$PATH";
+          };
         };
       }
 

nixos/modules/security/polkit.nix

@@ -6,27 +6,52 @@
 }:
 let
 
-  cfg = config.security.polkit;
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    mkIf
+    mkPackageOption
+    mkRemovedOptionModule
+    types
+    ;
 
+  cfg = config.security.polkit;
 in
 
 {
+  imports = [
+    (mkRemovedOptionModule [ "security" "polkit" "debug" ] "Use security.polkit.extraArgs instead")
+  ];
 
-  options = {
+  options.security.polkit = {
+    enable = mkEnableOption "polkit";
 
-    security.polkit.enable = lib.mkEnableOption "polkit";
+    enablePkexecWrapper = mkEnableOption "the setuid pkexec wrapper";
 
-    security.polkit.package = lib.mkPackageOption pkgs "polkit" { };
+    package = mkPackageOption pkgs "polkit" { };
 
-    security.polkit.debug = lib.mkEnableOption "debug logs from polkit. This is required in order to see log messages from rule definitions";
+    extraArgs = mkOption {
+      type = types.listOf types.str;
+      default = [
+        "--no-debug"
+        "--log-level=notice"
+      ];
+      description = ''
+        List of arguments to pass to the polkitd executable.
 
-    security.polkit.extraConfig = lib.mkOption {
-      type = lib.types.lines;
+        ::: {.note}
+        To see debug logs you need to negate the default `--no-debug` setting.
+        :::
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
       default = "";
       example = ''
         /* Log authorization checks. */
         polkit.addRule(function(action, subject) {
-          // Make sure to set { security.polkit.debug = true; } in configuration.nix
+          // Make sure to negate --no-debug in services.polkit.extraArgs: { security.polkit.extraArgs = [ "--log-level=notice" ]; }
           polkit.log("user " +  subject.user + " is attempting action " + action.id + " from PID " + subject.pid);
         });
 
@@ -41,8 +66,8 @@ in
       '';
     };
 
-    security.polkit.adminIdentities = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
+    adminIdentities = mkOption {
+      type = with types; listOf str;
       default = [ "unix-group:wheel" ];
       example = [
         "unix-user:alice"
@@ -58,25 +83,34 @@ in
 
   };
 
-  config = lib.mkIf cfg.enable {
+  config = mkIf cfg.enable {
 
     environment.systemPackages = [
       cfg.package.bin
       cfg.package.out
     ];
 
+    services.dbus.packages = [ cfg.package.out ];
+
     systemd.packages = [ cfg.package.out ];
 
-    systemd.services.polkit.serviceConfig.ExecStart = [
-      ""
-      "${cfg.package.out}/lib/polkit-1/polkitd ${lib.optionalString (!cfg.debug) "--no-debug"}"
-    ];
-
-    systemd.services.polkit.restartTriggers = [ config.system.path ];
-    systemd.services.polkit.reloadTriggers = [
-      config.environment.etc."polkit-1/rules.d/10-nixos.rules".source
-    ];
-    systemd.services.polkit.stopIfChanged = false;
+    systemd.services.polkit = {
+      restartTriggers = [ config.system.path ];
+      reloadTriggers = [
+        config.environment.etc."polkit-1/rules.d/10-nixos.rules".source
+      ];
+      serviceConfig.ExecStart = [
+        # nuke default ExecStart
+        ""
+        # provide our own instead
+        (toString (
+          [
+            "${lib.getLib cfg.package}/lib/polkit-1/polkitd"
+          ]
+          ++ cfg.extraArgs
+        ))
+      ];
+    };
 
     systemd.sockets."polkit-agent-helper".wantedBy = [ "sockets.target" ];
 
@@ -89,7 +123,7 @@ in
       # The upstream unit uses PrivateDevices=yes and ProtectHome=yes,
       # which prevents PAM modules from accessing hardware (e.g. FIDO
       # tokens via /dev/hidraw*) or reading key files from home directories.
-      (lib.mkIf config.security.pam.u2f.enable {
+      (mkIf config.security.pam.u2f.enable {
         # Override upstream PrivateDevices=yes to allow access to /dev/hidraw*
         PrivateDevices = false;
         DeviceAllow = [
@@ -100,7 +134,7 @@ in
         # ~/.config/Yubico/u2f_keys (the default key file location)
         ProtectHome = "read-only";
       })
-      (lib.mkIf config.security.pam.zfs.enable {
+      (mkIf config.security.pam.zfs.enable {
         PrivateDevices = false;
         DeviceAllow = [
           "/dev/zfs rw"
@@ -120,23 +154,16 @@ in
       ${cfg.extraConfig}
     ''; # TODO: validation on compilation (at least against typos)
 
-    services.dbus.packages = [ cfg.package.out ];
-
     security.pam.services.polkit-1 = { };
 
     security.wrappers.pkexec = {
+      enable = cfg.enablePkexecWrapper;
       setuid = true;
       owner = "root";
       group = "root";
-      source = "${cfg.package.bin}/bin/pkexec";
+      source = lib.getExe' cfg.package "pkexec";
     };
 
-    systemd.tmpfiles.rules = [
-      # Probably no more needed, clean up
-      "R /var/lib/polkit-1"
-      "R /var/lib/PolicyKit"
-    ];
-
     users.users.polkituser = {
       description = "PolKit daemon";
       uid = config.ids.uids.polkituser;

nixos/modules/security/run0.nix

@@ -6,6 +6,13 @@
 }:
 
 let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkMerge
+    mkOption
+    ;
+
   cfg = config.security.run0;
 
   sudoAlias = pkgs.writeShellScriptBin "sudo" ''
@@ -18,7 +25,9 @@ let
 in
 {
   options.security.run0 = {
-    wheelNeedsPassword = lib.mkOption {
+    enable = mkEnableOption "support for run0";
+
+    wheelNeedsPassword = mkOption {
       type = lib.types.bool;
       default = true;
       description = ''
@@ -27,26 +36,45 @@ in
       '';
     };
 
-    enableSudoAlias = lib.mkEnableOption "make {command}`sudo` an alias to {command}`run0`.";
+    enableSudoAlias = mkEnableOption "make {command}`sudo` an alias to {command}`run0`.";
   };
 
-  config = {
-    assertions = [
-      {
-        assertion =
-          cfg.enableSudoAlias -> (!config.security.sudo.enable && !config.security.sudo-rs.enable);
-        message = "`security.run0.enableSudoAlias` cannot be enabled if `security.sudo` or `security.sudo-rs` are enabled.";
-      }
-    ];
-
-    security.polkit.extraConfig = lib.mkIf (!cfg.wheelNeedsPassword) ''
-      polkit.addRule(function(action, subject) {
-        if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
-          return polkit.Result.YES;
+  config = mkMerge [
+    {
+      # Late introduction of the enable toggle, this should help during migration.
+      # TODO: Remove after 26.11 release
+      assertions = [
+        {
+          assertion = !cfg.wheelNeedsPassword -> cfg.enable;
+          message = "`security.run0.enable` is currently disabled, but is required for the `security.run0.wheelNeedsPassword` option to take effect";
         }
-      });
-    '';
+        {
+          assertion = cfg.enableSudoAlias -> cfg.enable;
+          message = "`security.run0.enableSudoAlias` depends on `security.run0.enable`, which is disabled.";
+        }
+      ];
+    }
+    (mkIf cfg.enable {
+      assertions = [
+        {
+          assertion =
+            cfg.enableSudoAlias -> (!config.security.sudo.enable && !config.security.sudo-rs.enable);
+          message = "`security.run0.enableSudoAlias` cannot be enabled if `security.sudo` or `security.sudo-rs` are enabled.";
+        }
+      ];
 
-    environment.systemPackages = lib.optional cfg.enableSudoAlias sudoAlias;
-  };
+      security.polkit = {
+        enable = true;
+        extraConfig = mkIf (!cfg.wheelNeedsPassword) ''
+          polkit.addRule(function(action, subject) {
+            if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
+              return polkit.Result.YES;
+            }
+          });
+        '';
+      };
+
+      environment.systemPackages = lib.optional cfg.enableSudoAlias sudoAlias;
+    })
+  ];
 }

nixos/modules/services/audio/music-assistant.nix

@@ -83,7 +83,18 @@ in
         lib.optional cfg.enable 8097 # Music Assistant stream port
         ++ lib.optional (lib.elem "airplay" cfg.providers) 7000
         ++ lib.optional (lib.elem "sendspin" cfg.providers) 8927
-        ++ lib.optional (lib.elem "snapcast" cfg.providers) 1780;
+        ++ lib.optional (lib.elem "snapcast" cfg.providers) 1780
+        ++ lib.optionals (lib.elem "squeezelite" cfg.providers) [
+          # https://lyrion.org/reference/slimproto-protocol/
+          3483 # Slimproto control
+          # https://lyrion.org/reference/cli/using-the-cli/
+          9000 # Slimproto JSON-RPC
+          9090 # Slimproto CLI
+        ];
+      allowedUDPPorts = lib.optionals (lib.elem "squeezelite" cfg.providers) [
+        # https://lyrion.org/reference/slimproto-protocol/
+        3483 # Slimproto discovery
+      ];
       # The information published by Apple 1 seem to not apply to libraop.
       # The closest we could find that represents the port range being used as observed by tcpdump is the ephemeral port range.
       # 1: https://support.apple.com/en-us/103229#:~:text=49152%E2%80%93-,65535,-TCP%2C%20UDP

nixos/modules/services/databases/postgresql.md

@@ -194,7 +194,7 @@ For an upgrade, a script like this can be used to simplify the process:
         # XXX specify the postgresql package you'd like to upgrade to.
         # Do not forget to list the extensions you need.
         newPostgres = pkgs.postgresql_15.withPackages (pp: [
-          # pp.plv8
+          # pp.pl_cron
         ]);
         cfg = config.services.postgresql;
       in

nixos/modules/services/databases/postgresql.nix

@@ -705,9 +705,6 @@ in
         "~@privileged" = true;
         "~@resources" = true;
       })
-      (mkIf (any extensionInstalled [ "plv8" ]) {
-        "@pkey" = true;
-      })
       (mkIf (any extensionInstalled [ "citus" ]) {
         "getpriority" = true;
         "setpriority" = true;
@@ -807,9 +804,7 @@ in
           PrivateTmp = true;
           ProtectHome = true;
           ProtectSystem = "strict";
-          MemoryDenyWriteExecute = lib.mkDefault (
-            cfg.settings.jit == "off" && (!any extensionInstalled [ "plv8" ])
-          );
+          MemoryDenyWriteExecute = lib.mkDefault (cfg.settings.jit == "off");
           NoNewPrivileges = true;
           LockPersonality = true;
           PrivateDevices = true;

nixos/modules/services/desktop-managers/budgie.nix

@@ -243,6 +243,8 @@ in
 
     # Required by Budgie's Polkit Dialog.
     security.polkit.enable = mkDefault true;
+    # Required by Budige's Control Center and Desktop
+    security.polkit.enablePkexecWrapper = mkDefault true;
 
     # Required by Budgie Panel plugins and/or Budgie Control Center panels.
     networking.networkmanager.enable = mkDefault true; # for BCC's Network panel.

nixos/modules/services/desktop-managers/cosmic.nix

@@ -146,7 +146,10 @@ in
     environment.sessionVariables.X11_EXTRA_RULES_XML = "${config.services.xserver.xkb.dir}/rules/base.extras.xml";
     programs.dconf.enable = true;
     programs.dconf.packages = [ pkgs.cosmic-session ];
-    security.polkit.enable = true;
+    security.polkit = {
+      enable = true;
+      enablePkexecWrapper = lib.mkDefault true;
+    };
     security.rtkit.enable = true;
     services.accounts-daemon.enable = true;
     services.displayManager.sessionPackages = [ pkgs.cosmic-session ];

nixos/modules/services/desktop-managers/gnome.nix

@@ -325,7 +325,11 @@ in
       i18n.inputMethod.enable = mkDefault true;
       i18n.inputMethod.type = mkDefault "ibus";
       programs.dconf.enable = true;
-      security.polkit.enable = true;
+      security.polkit = {
+        enable = true;
+        # Required by gnome-initial-setup, gnome-system-monitor, gvfs for admin://
+        enablePkexecWrapper = lib.mkDefault true;
+      };
       security.rtkit.enable = mkDefault true;
       services.accounts-daemon.enable = true;
       services.dleyna.enable = mkDefault true;

nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix

@@ -22,6 +22,10 @@
   config = lib.mkIf config.services.gnome.gnome-remote-desktop.enable {
     services.pipewire.enable = true;
     services.dbus.packages = [ pkgs.gnome-remote-desktop ];
+    security.polkit = {
+      enable = true;
+      enablePkexecWrapper = lib.mkDefault true;
+    };
 
     environment.systemPackages = [ pkgs.gnome-remote-desktop ];
 

nixos/modules/services/hardware/hddfancontrol.nix

@@ -10,7 +10,7 @@ let
 in
 
 {
-  meta.maintainers = with lib.maintainers; [ philipwilk ];
+  meta.maintainers = with lib.maintainers; [ jadewilk ];
 
   imports = [
     (lib.mkRemovedOptionModule [

nixos/modules/services/hardware/tuned.nix

@@ -246,7 +246,10 @@ in
       systemPackages = [ cfg.package ];
     };
 
-    security.polkit.enable = lib.mkDefault true;
+    security.polkit = {
+      enable = lib.mkDefault true;
+      enablePkexecWrapper = lib.mkDefault true;
+    };
 
     services = {
       dbus.packages = [ cfg.package ];

nixos/modules/services/misc/autorandr.nix

@@ -32,9 +32,14 @@ let
         );
       getSubModules = elemType.getSubModules;
       substSubModules = mod: matrixOf n m (elemType.substSubModules mod);
-      functor = (lib.defaultFunctor name) // {
-        wrapped = elemType;
-      };
+      functor = (
+        lib.types.elemTypeFunctor "attrsWith" {
+          inherit
+            elemType
+            name
+            ;
+        }
+      );
     };
 
   profileModule = lib.types.submodule {

nixos/modules/services/misc/llama-cpp.nix

@@ -164,7 +164,7 @@ in
       };
     };
 
-    networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
+    networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.settings.port;
   };
 
   meta.maintainers = with lib.maintainers; [

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -114,7 +114,6 @@ let
         "restic"
         "rtl_433"
         "sabnzbd"
-        "scaphandre"
         "script"
         "shelly"
         "smartctl"
@@ -133,6 +132,7 @@ let
         "v2ray"
         "varnish"
         "wireguard"
+        "xray"
         "zfs-siebenmann"
         "zfs"
       ]
@@ -520,26 +520,6 @@ in
                 'services.prometheus.exporters.sql.configFile'
             '';
           }
-          {
-            assertion = cfg.scaphandre.enable -> (pkgs.stdenv.targetPlatform.isx86_64 == true);
-            message = ''
-              Scaphandre only support x86_64 architectures.
-            '';
-          }
-          {
-            assertion =
-              cfg.scaphandre.enable
-              -> ((lib.kernel.whenHelpers pkgs.linux.version).whenOlder "5.11" true).condition == false;
-            message = ''
-              Scaphandre requires a kernel version newer than '5.11', '${pkgs.linux.version}' given.
-            '';
-          }
-          {
-            assertion = cfg.scaphandre.enable -> (builtins.elem "intel_rapl_common" config.boot.kernelModules);
-            message = ''
-              Scaphandre needs 'intel_rapl_common' kernel module to be enabled. Please add it in 'boot.kernelModules'.
-            '';
-          }
           {
             assertion =
               cfg.idrac.enable -> ((cfg.idrac.configurationPath == null) != (cfg.idrac.configuration == null));

nixos/modules/services/monitoring/prometheus/exporters/scaphandre.nix

@@ -1,36 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  options,
-  ...
-}:
-
-let
-  logPrefix = "services.prometheus.exporter.scaphandre";
-  cfg = config.services.prometheus.exporters.scaphandre;
-in
-{
-  port = 8080;
-  extraOpts = {
-    telemetryPath = lib.mkOption {
-      type = lib.types.str;
-      default = "/metrics";
-      description = ''
-        Path under which to expose metrics.
-      '';
-    };
-  };
-
-  serviceOpts = {
-    serviceConfig = {
-      ExecStart = ''
-        ${pkgs.scaphandre}/bin/scaphandre prometheus \
-          --address ${cfg.listenAddress} \
-          --port ${toString cfg.port} \
-          --suffix ${cfg.telemetryPath} \
-          ${lib.concatStringsSep " \\\n  " cfg.extraFlags}
-      '';
-    };
-  };
-}

nixos/modules/services/monitoring/prometheus/exporters/xray.nix

@@ -0,0 +1,86 @@
+{
+  config,
+  lib,
+  pkgs,
+  options,
+  ...
+}:
+
+let
+  cfg = config.services.prometheus.exporters.xray;
+  inherit (lib)
+    mkOption
+    types
+    concatStringsSep
+    optionalString
+    ;
+in
+{
+  port = 9550;
+
+  extraOpts = {
+    xrayEndpoint = mkOption {
+      type = types.str;
+      default = "127.0.0.1:8080";
+      description = ''
+        Xray gRPC API endpoint.
+      '';
+    };
+
+    metricsPath = mkOption {
+      type = types.str;
+      default = "/scrape";
+      description = ''
+        Path under which to expose metrics.
+      '';
+    };
+
+    scrapeTimeout = mkOption {
+      type = types.int;
+      default = 5;
+      description = ''
+        Timeout in seconds for every individual scrape.
+      '';
+    };
+
+    logPath = mkOption {
+      type = types.str;
+      default = "/var/log/xray/access.log";
+      description = ''
+        Path to Xray access log file. Set to empty string to disable user metrics.
+      '';
+    };
+
+    logTimeWindow = mkOption {
+      type = types.int;
+      default = 5;
+      description = ''
+        Time window in minutes for user metrics.
+      '';
+    };
+
+    withUserMetrics = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Collect user metrics from the Xray access log.
+      '';
+    };
+  };
+
+  serviceOpts = {
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.prometheus-xray-exporter}/bin/xray-exporter \
+          --listen ${cfg.listenAddress}:${toString cfg.port} \
+          --metrics-path ${cfg.metricsPath} \
+          --xray-endpoint ${cfg.xrayEndpoint} \
+          --scrape-timeout ${toString cfg.scrapeTimeout} \
+          ${optionalString (cfg.logPath != "") "--log-path ${cfg.logPath}"} \
+          --log-time-window ${toString cfg.logTimeWindow} \
+          ${optionalString cfg.withUserMetrics "--with-user-metrics"} \
+          ${concatStringsSep " \\\n  " cfg.extraFlags}
+      '';
+    };
+  };
+}

nixos/modules/services/networking/haproxy.nix

@@ -68,13 +68,10 @@ in
           # when the master process receives USR2, it reloads itself using exec(argv[0]),
           # so we create a symlink there and update it before reloading
           "${pkgs.coreutils}/bin/ln -sf ${lib.getExe cfg.package} /run/haproxy/haproxy"
-          # when running the config test, don't be quiet so we can see what goes wrong
-          "/run/haproxy/haproxy -c -f ${haproxyCfg}"
         ];
         ExecStart = "/run/haproxy/haproxy -Ws -f /etc/haproxy.cfg -p /run/haproxy/haproxy.pid";
         # support reloading
         ExecReload = [
-          "${lib.getExe cfg.package} -c -f ${haproxyCfg}"
           "${pkgs.coreutils}/bin/ln -sf ${lib.getExe cfg.package} /run/haproxy/haproxy"
           "${pkgs.coreutils}/bin/kill -USR2 $MAINPID"
         ];

nixos/modules/services/networking/networkmanager.nix

@@ -24,6 +24,9 @@ let
       rc-manager = if config.networking.resolvconf.enable then "resolvconf" else "unmanaged";
     };
     keyfile = {
+      # NM's compiled-in default; made explicit so the tmpfiles rule below
+      # can follow it when the user redirects the keyfile store elsewhere.
+      path = "/etc/NetworkManager/system-connections";
       unmanaged-devices = if cfg.unmanaged == [ ] then null else lib.concatStringsSep ";" cfg.unmanaged;
     };
     logging = {
@@ -601,13 +604,27 @@ in
 
     systemd.packages = packages;
 
-    systemd.tmpfiles.rules = [
-      "d /etc/NetworkManager/system-connections 0700 root root -"
-      "d /var/lib/misc 0755 root root -" # for dnsmasq.leases
+    systemd.tmpfiles.settings.networkmanager = {
+      ${configAttrs.keyfile.path}.d = {
+        mode = "0700";
+        user = "root";
+        group = "root";
+      };
+      # for dnsmasq.leases
+      "/var/lib/misc".d = {
+        mode = "0755";
+        user = "root";
+        group = "root";
+      };
       # ppp isn't able to mkdir that directory at runtime
-      "d /run/pppd/lock 0700 root root -"
-    ]
-    ++ pluginTmpfilesRules;
+      "/run/pppd/lock".d = {
+        mode = "0700";
+        user = "root";
+        group = "root";
+      };
+    };
+
+    systemd.tmpfiles.rules = pluginTmpfilesRules;
 
     systemd.services.NetworkManager = {
       wantedBy = [ "multi-user.target" ];

nixos/modules/services/networking/syncthing.nix

@@ -6,15 +6,13 @@
   ...
 }:
 
-with lib;
-
 let
   cfg = config.services.syncthing;
   opt = options.services.syncthing;
   defaultUser = "syncthing";
   defaultGroup = defaultUser;
   settingsFormat = pkgs.formats.json { };
-  cleanedConfig = converge (filterAttrsRecursive (_: v: v != null && v != { })) cfg.settings;
+  cleanedConfig = lib.converge (lib.filterAttrsRecursive (_: v: v != null && v != { })) cfg.settings;
 
   isUnixGui = lib.strings.hasPrefix "unix://" cfg.guiAddress;
 
@@ -35,7 +33,7 @@ let
     else
       "${cfg.guiAddress}${path}";
 
-  devices = mapAttrsToList (
+  devices = lib.mapAttrsToList (
     _: device:
     device
     // {
@@ -45,31 +43,23 @@ let
 
   anyAutoAccept = builtins.any (dev: dev.autoAcceptFolders) devices;
 
-  folders = mapAttrsToList (
-    _: folder:
-    folder
-    //
-      throwIf (folder ? rescanInterval || folder ? watch || folder ? watchDelay)
-        ''
-          The options services.syncthing.settings.folders.<name>.{rescanInterval,watch,watchDelay}
-          were removed. Please use, respectively, {rescanIntervalS,fsWatcherEnabled,fsWatcherDelayS} instead.
-        ''
-        {
-          devices =
-            let
-              folderDevices = folder.devices;
-            in
-            map (
-              device:
-              if builtins.isString device then
-                { deviceId = cfg.settings.devices.${device}.id; }
-              else if builtins.isAttrs device then
-                { deviceId = cfg.settings.devices.${device.name}.id; } // device
-              else
-                throw "Invalid type for devices in folder '${folderName}'; expected list or attrset."
-            ) folderDevices;
-        }
-  ) (filterAttrs (_: folder: folder.enable) cfg.settings.folders);
+  folders = lib.pipe cfg.settings.folders [
+    (lib.filterAttrs (_: folder: folder.enable))
+    builtins.attrValues
+    (map (
+      folder:
+      folder
+      // {
+        devices = map (
+          device:
+          if builtins.isString device then
+            { deviceId = cfg.settings.devices.${device}.id; }
+          else
+            { deviceId = cfg.settings.devices.${device.name}.id; } // device
+        ) folder.devices;
+      }
+    ))
+  ];
 
   jq = "${pkgs.jq}/bin/jq";
   grep = lib.getExe pkgs.gnugrep;
@@ -179,7 +169,7 @@ let
         [
           # Now for each of these attributes, write the curl commands that are
           # identical to both folders and devices.
-          (mapAttrs (
+          (lib.mapAttrs (
             conf_type: s:
             # We iterate the `conf` list now, and run a curl -X POST command for each, that
             # should update that device/folder only.
@@ -301,7 +291,7 @@ let
     +
       /*
         Now we update the other settings defined in cleanedConfig which are not
-        "folders", "devices", or "guiPasswordFile".
+        "folders", "devices", "guiPasswordFile", or "defaults".
       */
       (lib.pipe cleanedConfig [
         builtins.attrNames
@@ -309,14 +299,35 @@ let
           "folders"
           "devices"
           "guiPasswordFile"
+          "defaults"
         ])
         (map (subOption: ''
-          curl -X PUT -d ${
+          curl -X PATCH -d ${
             lib.escapeShellArg (builtins.toJSON cleanedConfig.${subOption})
           } ${curlAddressArgs "/rest/config/${subOption}"}
         ''))
         (lib.concatStringsSep "\n")
       ])
+    +
+      # Handle the "defaults" option separately, as it has multiple sub-endpoints.
+      (lib.optionalString (cleanedConfig ? defaults) (
+        lib.pipe cleanedConfig.defaults [
+          builtins.attrNames
+          (map (
+            subOption:
+            let
+              # /rest/config/defaults/ignores only supports PUT
+              method = if subOption == "ignores" then "PUT" else "PATCH";
+            in
+            ''
+              curl -X ${method} -d ${
+                lib.escapeShellArg (builtins.toJSON cleanedConfig.defaults.${subOption})
+              } ${curlAddressArgs "/rest/config/defaults/${subOption}"}
+            ''
+          ))
+          (lib.concatStringsSep "\n")
+        ]
+      ))
     +
       # Now we hash the contents of guiPasswordFile and use the result to update the gui password
       (lib.optionalString (cfg.guiPasswordFile != null) ''
@@ -337,10 +348,10 @@ in
   options = {
     services.syncthing = {
 
-      enable = mkEnableOption "Syncthing, a self-hosted open-source alternative to Dropbox and Bittorrent Sync";
+      enable = lib.mkEnableOption "Syncthing, a self-hosted open-source alternative to Dropbox and Bittorrent Sync";
 
-      cert = mkOption {
-        type = types.nullOr types.str;
+      cert = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Path to the `cert.pem` file, which will be copied into Syncthing's
@@ -348,8 +359,8 @@ in
         '';
       };
 
-      key = mkOption {
-        type = types.nullOr types.str;
+      key = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Path to the `key.pem` file, which will be copied into Syncthing's
@@ -357,16 +368,16 @@ in
         '';
       };
 
-      guiPasswordFile = mkOption {
-        type = types.nullOr types.str;
+      guiPasswordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Path to file containing the plaintext password for Syncthing's GUI.
         '';
       };
 
-      overrideDevices = mkOption {
-        type = types.bool;
+      overrideDevices = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Whether to delete the devices which are not configured via the
@@ -376,10 +387,10 @@ in
         '';
       };
 
-      overrideFolders = mkOption {
-        type = types.bool;
+      overrideFolders = lib.mkOption {
+        type = lib.types.bool;
         default = !anyAutoAccept;
-        defaultText = literalMD ''
+        defaultText = lib.literalMD ''
           `true` unless any device has the
           [autoAcceptFolders](#opt-services.syncthing.settings.devices._name_.autoAcceptFolders)
           option set to `true`.
@@ -392,47 +403,47 @@ in
         '';
       };
 
-      settings = mkOption {
-        type = types.submodule {
+      settings = lib.mkOption {
+        type = lib.types.submodule {
           freeformType = settingsFormat.type;
           options = {
             # global options
-            options = mkOption {
+            options = lib.mkOption {
               default = { };
               description = ''
                 The options element contains all other global configuration options
               '';
-              type = types.submodule (
-                { name, ... }:
+              type = lib.types.submodule (
+                { ... }:
                 {
                   freeformType = settingsFormat.type;
                   options = {
-                    localAnnounceEnabled = mkOption {
-                      type = types.nullOr types.bool;
+                    localAnnounceEnabled = lib.mkOption {
+                      type = lib.types.nullOr lib.types.bool;
                       default = null;
                       description = ''
                         Whether to send announcements to the local LAN, also use such announcements to find other devices.
                       '';
                     };
 
-                    localAnnouncePort = mkOption {
-                      type = types.nullOr types.port;
+                    localAnnouncePort = lib.mkOption {
+                      type = lib.types.nullOr lib.types.port;
                       default = null;
                       description = ''
                         The port on which to listen and send IPv4 broadcast announcements to.
                       '';
                     };
 
-                    relaysEnabled = mkOption {
-                      type = types.nullOr types.bool;
+                    relaysEnabled = lib.mkOption {
+                      type = lib.types.nullOr lib.types.bool;
                       default = null;
                       description = ''
                         When true, relays will be connected to and potentially used for device to device connections.
                       '';
                     };
 
-                    urAccepted = mkOption {
-                      type = types.nullOr types.int;
+                    urAccepted = lib.mkOption {
+                      type = lib.types.nullOr lib.types.int;
                       default = null;
                       description = ''
                         Whether the user has accepted to submit anonymous usage data.
@@ -441,16 +452,16 @@ in
                       '';
                     };
 
-                    limitBandwidthInLan = mkOption {
-                      type = types.nullOr types.bool;
+                    limitBandwidthInLan = lib.mkOption {
+                      type = lib.types.nullOr lib.types.bool;
                       default = null;
                       description = ''
                         Whether to apply bandwidth limits to devices in the same broadcast domain as the local device.
                       '';
                     };
 
-                    maxFolderConcurrency = mkOption {
-                      type = types.nullOr types.int;
+                    maxFolderConcurrency = lib.mkOption {
+                      type = lib.types.nullOr lib.types.int;
                       default = null;
                       description = ''
                         This option controls how many folders may concurrently be in I/O-intensive operations such as syncing or scanning.
@@ -463,7 +474,7 @@ in
             };
 
             # device settings
-            devices = mkOption {
+            devices = lib.mkOption {
               default = { };
               description = ''
                 Peers/devices which Syncthing should communicate with.
@@ -478,30 +489,30 @@ in
                   addresses = [ "tcp://192.168.0.10:51820" ];
                 };
               };
-              type = types.attrsOf (
-                types.submodule (
+              type = lib.types.attrsOf (
+                lib.types.submodule (
                   { name, ... }:
                   {
                     freeformType = settingsFormat.type;
                     options = {
 
-                      name = mkOption {
-                        type = types.str;
+                      name = lib.mkOption {
+                        type = lib.types.str;
                         default = name;
                         description = ''
                           The name of the device.
                         '';
                       };
 
-                      id = mkOption {
-                        type = types.str;
+                      id = lib.mkOption {
+                        type = lib.types.str;
                         description = ''
                           The device ID. See <https://docs.syncthing.net/dev/device-ids.html>.
                         '';
                       };
 
-                      autoAcceptFolders = mkOption {
-                        type = types.bool;
+                      autoAcceptFolders = lib.mkOption {
+                        type = lib.types.bool;
                         default = false;
                         description = ''
                           Automatically create or share folders that this device advertises at the default path.
@@ -516,7 +527,7 @@ in
             };
 
             # folder settings
-            folders = mkOption {
+            folders = lib.mkOption {
               default = { };
               description = ''
                 Folders which should be shared by Syncthing.
@@ -525,7 +536,7 @@ in
                 will be reverted on restart if [overrideFolders](#opt-services.syncthing.overrideFolders)
                 is enabled.
               '';
-              example = literalExpression ''
+              example = lib.literalExpression ''
                 {
                   "/home/user/sync" = {
                     id = "syncme";
@@ -533,15 +544,15 @@ in
                   };
                 }
               '';
-              type = types.attrsOf (
-                types.submodule (
+              type = lib.types.attrsOf (
+                lib.types.submodule (
                   { name, ... }:
                   {
                     freeformType = settingsFormat.type;
                     options = {
 
-                      enable = mkOption {
-                        type = types.bool;
+                      enable = lib.mkOption {
+                        type = lib.types.bool;
                         default = true;
                         description = ''
                           Whether to share this folder.
@@ -550,12 +561,12 @@ in
                         '';
                       };
 
-                      path = mkOption {
+                      path = lib.mkOption {
                         # TODO for release 23.05: allow relative paths again and set
                         # working directory to cfg.dataDir
-                        type = types.str // {
-                          check = x: types.str.check x && (substring 0 1 x == "/" || substring 0 2 x == "~/");
-                          description = types.str.description + " starting with / or ~/";
+                        type = lib.types.str // {
+                          check = x: lib.types.str.check x && (lib.substring 0 1 x == "/" || lib.substring 0 2 x == "~/");
+                          description = lib.types.str.description + " starting with / or ~/";
                         };
                         default = name;
                         description = ''
@@ -566,24 +577,24 @@ in
                         '';
                       };
 
-                      id = mkOption {
-                        type = types.str;
+                      id = lib.mkOption {
+                        type = lib.types.str;
                         default = name;
                         description = ''
                           The ID of the folder. Must be the same on all devices.
                         '';
                       };
 
-                      label = mkOption {
-                        type = types.str;
+                      label = lib.mkOption {
+                        type = lib.types.str;
                         default = name;
                         description = ''
                           The label of the folder.
                         '';
                       };
 
-                      type = mkOption {
-                        type = types.enum [
+                      type = lib.mkOption {
+                        type = lib.types.enum [
                           "sendreceive"
                           "sendonly"
                           "receiveonly"
@@ -596,17 +607,17 @@ in
                         '';
                       };
 
-                      devices = mkOption {
-                        type = types.listOf (
-                          types.oneOf [
-                            types.str
-                            (types.submodule (
+                      devices = lib.mkOption {
+                        type = lib.types.listOf (
+                          lib.types.oneOf [
+                            lib.types.str
+                            (lib.types.submodule (
                               { ... }:
                               {
                                 freeformType = settingsFormat.type;
                                 options = {
-                                  name = mkOption {
-                                    type = types.str;
+                                  name = lib.mkOption {
+                                    type = lib.types.str;
                                     default = null;
                                     description = ''
                                       The name of a device defined in the
@@ -614,8 +625,8 @@ in
                                       option.
                                     '';
                                   };
-                                  encryptionPasswordFile = mkOption {
-                                    type = types.nullOr types.externalPath;
+                                  encryptionPasswordFile = lib.mkOption {
+                                    type = lib.types.nullOr lib.types.externalPath;
                                     default = null;
                                     description = ''
                                       Path to encryption password. If set, the file will be read during
@@ -637,14 +648,14 @@ in
                         '';
                       };
 
-                      versioning = mkOption {
+                      versioning = lib.mkOption {
                         default = null;
                         description = ''
                           How to keep changed/deleted files with Syncthing.
                           There are 4 different types of versioning with different parameters.
                           See <https://docs.syncthing.net/users/versioning.html>.
                         '';
-                        example = literalExpression ''
+                        example = lib.literalExpression ''
                           [
                             {
                               versioning = {
@@ -680,13 +691,12 @@ in
                             }
                           ]
                         '';
-                        type =
-                          with types;
-                          nullOr (submodule {
+                        type = lib.types.nullOr (
+                          lib.types.submodule {
                             freeformType = settingsFormat.type;
                             options = {
-                              type = mkOption {
-                                type = enum [
+                              type = lib.mkOption {
+                                type = lib.types.enum [
                                   "external"
                                   "simple"
                                   "staggered"
@@ -698,11 +708,12 @@ in
                                 '';
                               };
                             };
-                          });
+                          }
+                        );
                       };
 
-                      copyOwnershipFromParent = mkOption {
-                        type = types.bool;
+                      copyOwnershipFromParent = lib.mkOption {
+                        type = lib.types.bool;
                         default = false;
                         description = ''
                           On Unix systems, tries to copy file/folder ownership from the parent directory (the directory it’s located in).
@@ -710,8 +721,8 @@ in
                         '';
                       };
 
-                      ignorePatterns = mkOption {
-                        type = types.nullOr (types.listOf types.str);
+                      ignorePatterns = lib.mkOption {
+                        type = lib.types.nullOr (lib.types.listOf lib.types.str);
                         default = null;
                         description = ''
                           Syncthing can be configured to ignore certain files in a folder using ignore patterns.
@@ -771,8 +782,8 @@ in
         };
       };
 
-      guiAddress = mkOption {
-        type = types.str;
+      guiAddress = lib.mkOption {
+        type = lib.types.str;
         default = "127.0.0.1:8384";
         apply = x: if lib.strings.hasPrefix "/" x then "unix://${x}" else x;
         description = ''
@@ -780,16 +791,16 @@ in
         '';
       };
 
-      systemService = mkOption {
-        type = types.bool;
+      systemService = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Whether to auto-launch Syncthing as a system service.
         '';
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = defaultUser;
         example = "yourUser";
         description = ''
@@ -799,8 +810,8 @@ in
         '';
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = defaultGroup;
         example = "yourGroup";
         description = ''
@@ -809,8 +820,8 @@ in
         '';
       };
 
-      all_proxy = mkOption {
-        type = with types; nullOr str;
+      all_proxy = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "socks5://address.com:1234";
         description = ''
@@ -821,8 +832,8 @@ in
         '';
       };
 
-      dataDir = mkOption {
-        type = types.path;
+      dataDir = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/syncthing";
         example = "/home/yourUser";
         description = ''
@@ -832,15 +843,15 @@ in
 
       configDir =
         let
-          cond = versionAtLeast config.system.stateVersion "19.03";
+          cond = lib.versionAtLeast config.system.stateVersion "19.03";
         in
-        mkOption {
-          type = types.path;
+        lib.mkOption {
+          type = lib.types.path;
           description = ''
             The path where the settings and keys will exist.
           '';
-          default = cfg.dataDir + optionalString cond "/.config/syncthing";
-          defaultText = literalMD ''
+          default = cfg.dataDir + lib.optionalString cond "/.config/syncthing";
+          defaultText = lib.literalMD ''
             * if `stateVersion >= 19.03`:
 
                   config.${opt.dataDir} + "/.config/syncthing"
@@ -850,17 +861,17 @@ in
           '';
         };
 
-      databaseDir = mkOption {
-        type = types.path;
+      databaseDir = lib.mkOption {
+        type = lib.types.path;
         description = ''
           The directory containing the database and logs.
         '';
         default = cfg.configDir;
-        defaultText = literalExpression "config.${opt.configDir}";
+        defaultText = lib.literalExpression "config.${opt.configDir}";
       };
 
-      extraFlags = mkOption {
-        type = types.listOf types.str;
+      extraFlags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         example = [ "--reset-deltas" ];
         description = ''
@@ -868,8 +879,8 @@ in
         '';
       };
 
-      openDefaultPorts = mkOption {
-        type = types.bool;
+      openDefaultPorts = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         example = true;
         description = ''
@@ -883,35 +894,37 @@ in
         '';
       };
 
-      package = mkPackageOption pkgs "syncthing" { };
+      package = lib.mkPackageOption pkgs "syncthing" { };
     };
   };
 
   imports = [
-    (mkRemovedOptionModule [ "services" "syncthing" "useInotify" ] ''
+    (lib.mkRemovedOptionModule [ "services" "syncthing" "useInotify" ] ''
       This option was removed because Syncthing now has the inotify functionality included under the name "fswatcher".
       It can be enabled on a per-folder basis through the web interface.
     '')
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "syncthing" "extraOptions" ]
       [ "services" "syncthing" "settings" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "syncthing" "folders" ]
       [ "services" "syncthing" "settings" "folders" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "syncthing" "devices" ]
       [ "services" "syncthing" "settings" "devices" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "syncthing" "options" ]
       [ "services" "syncthing" "settings" "options" ]
     )
   ]
   ++
     map
-      (o: mkRenamedOptionModule [ "services" "syncthing" "declarative" o ] [ "services" "syncthing" o ])
+      (
+        o: lib.mkRenamedOptionModule [ "services" "syncthing" "declarative" o ] [ "services" "syncthing" o ]
+      )
       [
         "cert"
         "key"
@@ -924,7 +937,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions = [
       {
         assertion = !(cfg.overrideFolders && anyAutoAccept);
@@ -941,7 +954,7 @@ in
       }
     ];
 
-    networking.firewall = mkIf cfg.openDefaultPorts {
+    networking.firewall = lib.mkIf cfg.openDefaultPorts {
       allowedTCPPorts = [ 22000 ];
       allowedUDPPorts = [
         21027
@@ -952,7 +965,7 @@ in
     environment.systemPackages = [ cfg.package ];
     systemd.packages = [ cfg.package ];
 
-    users.users = mkIf (cfg.systemService && cfg.user == defaultUser) {
+    users.users = lib.mkIf (cfg.systemService && cfg.user == defaultUser) {
       ${defaultUser} = {
         group = cfg.group;
         home = cfg.dataDir;
@@ -962,14 +975,14 @@ in
       };
     };
 
-    users.groups = mkIf (cfg.systemService && cfg.group == defaultGroup) {
+    users.groups = lib.mkIf (cfg.systemService && cfg.group == defaultGroup) {
       ${defaultGroup}.gid = config.ids.gids.syncthing;
     };
 
     systemd.services = {
       # upstream reference:
       # https://github.com/syncthing/syncthing/blob/main/etc/linux-systemd/system/syncthing%40.service
-      syncthing = mkIf cfg.systemService {
+      syncthing = lib.mkIf cfg.systemService {
         description = "Syncthing service";
         after = [ "network.target" ];
         environment = {
@@ -986,13 +999,13 @@ in
           User = cfg.user;
           Group = cfg.group;
           ExecStartPre =
-            mkIf (cfg.cert != null || cfg.key != null)
+            lib.mkIf (cfg.cert != null || cfg.key != null)
               "+${pkgs.writers.writeBash "syncthing-copy-keys" ''
                 install -dm700 -o ${cfg.user} -g ${cfg.group} ${cfg.configDir}
-                ${optionalString (cfg.cert != null) ''
+                ${lib.optionalString (cfg.cert != null) ''
                   install -Dm644 -o ${cfg.user} -g ${cfg.group} ${toString cfg.cert} ${cfg.configDir}/cert.pem
                 ''}
-                ${optionalString (cfg.key != null) ''
+                ${lib.optionalString (cfg.key != null) ''
                   install -Dm600 -o ${cfg.user} -g ${cfg.group} ${toString cfg.key} ${cfg.configDir}/key.pem
                 ''}
               ''}";
@@ -1034,7 +1047,7 @@ in
           ];
         };
       };
-      syncthing-init = mkIf (cleanedConfig != { }) {
+      syncthing-init = lib.mkIf (cleanedConfig != { }) {
         description = "Syncthing configuration updater";
         requisite = [ "syncthing.service" ];
         after = [ "syncthing.service" ];
@@ -1050,4 +1063,9 @@ in
       };
     };
   };
+
+  meta.maintainers = with lib.maintainers; [
+    doronbehar
+    seudonym
+  ];
 }

nixos/modules/services/networking/wpa_supplicant.nix

@@ -128,7 +128,7 @@ let
           ]
           ++ lib.optionals cfg.userControlled [
             # set up client sockets directory
-            "+${pkgs.coreutils}/bin/mkdir /run/wpa_supplicant/client"
+            "+${pkgs.coreutils}/bin/mkdir -p /run/wpa_supplicant/client"
             "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /run/wpa_supplicant/client"
             "+${pkgs.coreutils}/bin/chmod g=u /run/wpa_supplicant/client"
           ];

nixos/modules/services/networking/xrdp.nix

@@ -19,7 +19,7 @@ let
     cat > $out/startwm.sh <<EOF
     #!/bin/sh
     . /etc/profile
-    ${lib.optionalString cfg.audio.enable "${cfg.audio.package}/libexec/pulsaudio-xrdp-module/pulseaudio_xrdp_init"}
+    ${lib.optionalString cfg.audio.enable "${cfg.audio.package}/libexec/pulseaudio-xrdp-module/pulseaudio_xrdp_init"}
     ${cfg.defaultWindowManager}
     EOF
     chmod +x $out/startwm.sh

nixos/modules/services/scheduling/scx-loader.nix

@@ -75,7 +75,11 @@ in
       }
     ];
 
-    environment.systemPackages = [ cfg.package ] ++ cfg.schedsPackages;
+    environment = {
+      systemPackages = [ cfg.package ] ++ cfg.schedsPackages;
+      etc."scx_loader.toml".source = configFile;
+    };
+
     systemd.packages = [ cfg.package ];
     services.dbus.packages = [ cfg.package ];
 
@@ -84,10 +88,6 @@ in
     systemd.services.scx_loader = {
       path = cfg.schedsPackages;
       wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        TemporaryFileSystem = [ "/etc" ];
-        BindReadOnlyPaths = [ "${configFile.outPath}:/etc/scx_loader.toml" ];
-      };
     };
   };
 

nixos/modules/services/security/opensnitch.nix

@@ -13,6 +13,7 @@ let
       file = pkgs.writeText "rule" (builtins.toJSON cfg);
     }
   );
+  stateDir = lib.strings.match "/var/lib/([^/]+)/.+" cfg.settings.Rules.Path;
 in
 {
   options = {
@@ -105,10 +106,9 @@ in
                 "iptables"
                 "nftables"
               ];
-              default = if config.networking.nftables.enable then "nftables" else "iptables";
-              defaultText = lib.literalExpression ''if config.networking.nftables.enable then "nftables" else "iptables"'';
+              default = "nftables";
               description = ''
-                Which firewall backend to use.
+                Which firewall backend to use. `nftables` ruleset can be used for `iptables` firewall too, if `iptables` is built with nftables compatibility.
               '';
             };
             Ebpf.ModulesPath = lib.mkOption {
@@ -139,7 +139,10 @@ in
             };
 
             Rules.Path = lib.mkOption {
-              type = lib.types.path;
+              type = lib.types.pathWith {
+                inStore = false;
+                absolute = true;
+              };
               default = "/var/lib/opensnitch/rules";
               description = ''
                 Path to the directory where firewall rules can be found and will
@@ -158,6 +161,12 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = stateDir != null;
+        message = "`config.services.opensnitch.settings.Rules.Path` must be a sub-directory of /var/lib/, currently is ${cfg.settings.Rules.Path}";
+      }
+    ];
 
     security.auditd = lib.mkIf (cfg.settings.ProcMonitorMethod == "audit") {
       enable = true;
@@ -174,8 +183,14 @@ in
             ""
             "${lib.getExe' cfg.package "opensnitchd"} --config-file ${cfg.configFile}"
           ];
+          StateDirectory = builtins.head stateDir; # match produces a list. Null case covered by assertion.
         };
-        preStart = lib.mkIf (cfg.rules != { }) (
+        preStart = ''
+          # assert rules directory exists before service starts
+          # will be in StateDirectory due to assertion
+          mkdir -p ${cfg.settings.Rules.Path}
+        ''
+        + lib.optionalString (cfg.rules != { }) (
           let
             rules = lib.flip lib.mapAttrsToList predefinedRules (
               file: content: {
@@ -205,13 +220,12 @@ in
           ''
         );
       };
-      tmpfiles.rules = [
-        "d ${cfg.settings.Rules.Path} 0750 root root - -"
-        "L+ /etc/opensnitchd/network_aliases.json - - - - ${cfg.package}/etc/opensnitchd/network_aliases.json"
-        "L+ /etc/opensnitchd/system-fw.json - - - - ${cfg.package}/etc/opensnitchd/system-fw.json"
-      ];
     };
 
+    environment.etc."opensnitchd/network_aliases.json".source =
+      "${cfg.package}/etc/opensnitchd/network_aliases.json";
+    environment.etc."opensnitchd/system-fw.json".source =
+      "${cfg.package}/etc/opensnitchd/system-fw.json";
   };
 
   meta.maintainers = with lib.maintainers; [

nixos/modules/services/web-apps/lauti.nix

@@ -72,7 +72,7 @@ in
         ExecStart = lib.getExe pkgs.lauti;
         WorkingDirectory = cfg.dataDir;
         StateDirectory = default;
-        EnvironmentFile = [ cfg.secrets ];
+        EnvironmentFile = cfg.secrets;
 
         # hardening
         AmbientCapabilities = "";

nixos/modules/services/web-apps/plausible.nix

@@ -330,9 +330,6 @@ in
     ];
   };
 
-  meta.maintainers = with lib.maintainers; [
-    e1mo
-    xanderio
-  ];
+  meta.maintainers = [ ];
   meta.doc = ./plausible.md;
 }

nixos/modules/services/web-apps/pretalx.nix

@@ -27,6 +27,28 @@ let
         cfg.settings.database.backend == "postgresql"
       ) finalPackage.optional-dependencies.postgres;
   };
+
+  pretalxManageWrapper = pkgs.writeShellApplication {
+    name = "pretalx-manage";
+    runtimeInputs = with pkgs; [
+      util-linux
+    ];
+    text = ''
+      cd ${cfg.settings.filesystem.data}
+      set -a
+      ${lib.concatMapStringsSep "\n" (file: ''
+        . ${lib.escapeShellArg file}
+      '') cfg.environmentFiles}
+      set +a
+      export PRETALX_CONFIG_FILE=${configFile}
+      exec runuser ${
+        lib.cli.toCommandLineShellGNU { } {
+          inherit (cfg) user;
+          preserve-environment = true;
+        }
+      } -- ${lib.getExe' pythonEnv "pretalx-manage"} "$@"
+    '';
+  };
 in
 
 {
@@ -325,18 +347,7 @@ in
     # https://docs.pretalx.org/administrator/installation/
 
     environment.systemPackages = [
-      (pkgs.writeScriptBin "pretalx-manage" ''
-        cd ${cfg.settings.filesystem.data}
-        sudo=exec
-        if [[ "$USER" != ${cfg.user} ]]; then
-          sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} --preserve-env=PRETALX_CONFIG_FILE'
-        fi
-        set -a
-        ${lib.concatMapStringsSep "\n" (file: ". ${lib.escapeShellArg file}") cfg.environmentFiles}
-        set +a
-        export PRETALX_CONFIG_FILE=${configFile}
-        $sudo ${lib.getExe' pythonEnv "pretalx-manage"} "$@"
-      '')
+      pretalxManageWrapper
     ];
 
     services.logrotate.settings.pretalx = {

nixos/modules/services/web-apps/pretix.nix

@@ -24,7 +24,6 @@ let
     mkOption
     mkPackageOption
     optionals
-    optionalString
     recursiveUpdate
     types
     ;
@@ -60,6 +59,24 @@ let
   };
 
   withRedis = cfg.settings.redis.location != null;
+
+  pretixManageWrapper = pkgs.writeShellApplication {
+    name = "pretix-manage";
+    runtimeInputs = with pkgs; [
+      util-linux
+    ];
+    text = ''
+      cd ${cfg.settings.pretix.datadir}
+      export PRETIX_CONFIG_FILE=${configFile}
+      exec runuser ${
+        lib.cli.toCommandLineShellGNU { } {
+          inherit (cfg) user;
+          supp-group = if withRedis then config.services.redis.servers.pretix.group else null;
+          whitelist-environment = "PRETIX_CONFIG_FILE";
+        }
+      } -- ${getExe' pythonEnv "pretix-manage"} "$@"
+    '';
+  };
 in
 {
   meta = {
@@ -396,15 +413,7 @@ in
     # https://docs.pretix.eu/en/latest/admin/installation/index.html
 
     environment.systemPackages = [
-      (pkgs.writeScriptBin "pretix-manage" ''
-        cd ${cfg.settings.pretix.datadir}
-        sudo=exec
-        if [[ "$USER" != ${cfg.user} ]]; then
-          sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} ${optionalString withRedis "-g redis-pretix"} --preserve-env=PRETIX_CONFIG_FILE'
-        fi
-        export PRETIX_CONFIG_FILE=${configFile}
-        $sudo ${getExe' pythonEnv "pretix-manage"} "$@"
-      '')
+      pretixManageWrapper
     ];
 
     services.logrotate.settings.pretix = {

nixos/modules/services/web-apps/rustical.nix

@@ -55,12 +55,12 @@ in
           };
 
           http = {
-            host = mkOption {
+            bind = mkOption {
               type = types.str;
-              default = "[::1]";
-              example = "[::]";
+              default = "unix:/run/rustical/sock";
+              example = "[::]:4000";
               description = ''
-                Host address to bind the HTTP service to.
+                Address and port or UNIX socket path to bind the HTTP service to.
 
                 :::{.note}
                 Rustical expects to be hosted behind a reverse proxy that
@@ -69,14 +69,6 @@ in
                 :::
               '';
             };
-
-            port = mkOption {
-              type = types.port;
-              default = 4000;
-              description = ''
-                Port to bind the HTTP service to.
-              '';
-            };
           };
 
           dav_push.enabled = mkOption {
@@ -126,6 +118,19 @@ in
   };
 
   config = mkIf cfg.enable {
+    warnings = lib.optionals (cfg.settings.http ? host || cfg.settings.http ? port) [
+      ''
+        Rustical 0.13 deprecations
+
+        The following options are now deprecated and will be removed in a
+        future release:
+        - `services.rustical.settings.http.host`
+        - `services.rustical.settings.http.port`
+
+        Migrate to `services.rustical.settings.http.bind` instead.
+      ''
+    ];
+
     # install the config at a path where the cli will find it
     environment.etc."rustical/config.toml".source = configFile;
 

nixos/modules/services/x11/desktop-managers/cinnamon.nix

@@ -111,7 +111,10 @@ in
       services.blueman.enable = mkDefault (notExcluded pkgs.blueman);
       services.hardware.bolt.enable = mkDefault (notExcluded pkgs.bolt);
       hardware.bluetooth.enable = mkDefault true;
-      security.polkit.enable = true;
+      security.polkit = {
+        enable = true;
+        enablePkexecWrapper = lib.mkDefault true;
+      };
       services.accounts-daemon.enable = true;
       services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
       services.dbus.packages = with pkgs; [

nixos/modules/services/x11/desktop-managers/xfce.nix

@@ -220,7 +220,10 @@ in
 
     # Enable helpful DBus services.
     services.udisks2.enable = true;
-    security.polkit.enable = true;
+    security.polkit = {
+      enable = true;
+      enablePkexecWrapper = lib.mkDefault true;
+    };
     services.accounts-daemon.enable = true;
     services.upower.enable = config.powerManagement.enable;
     services.gnome.glib-networking.enable = true;

nixos/modules/system/activation/bootspec.nix

@@ -26,9 +26,11 @@ let
             // {
               "org.nixos.bootspec.v1" = {
                 system = config.boot.kernelPackages.stdenv.hostPlatform.system;
+                label = "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})";
+              }
+              // lib.optionalAttrs config.boot.kernel.enable {
                 kernel = "${config.boot.kernelPackages.kernel}/${config.system.boot.loader.kernelFile}";
                 kernelParams = config.boot.kernelParams;
-                label = "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})";
               }
               // lib.optionalAttrs config.boot.initrd.enable {
                 initrd = "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
@@ -97,13 +99,13 @@ let
   };
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "boot" "bootspec" "enable" ] ''
+      Bootspec is now always generated and can no longer be disabled.
+    '')
+  ];
+
   options.boot.bootspec = {
-    enable =
-      lib.mkEnableOption "the generation of RFC-0125 bootspec in $system/boot.json, e.g. /run/current-system/boot.json"
-      // {
-        default = true;
-        internal = true;
-      };
     enableValidation = lib.mkEnableOption ''
       the validation of bootspec documents for each build.
             This will introduce Go in the build-time closure as we are relying on [Cuelang](https://cuelang.org/) for schema validation.

nixos/modules/system/activation/top-level.nix

@@ -44,7 +44,7 @@ let
 
     printf "%s " "''${extraDependencies[@]}" > "$out/extra-dependencies"
 
-    ${optionalString (!config.boot.isContainer && config.boot.bootspec.enable) ''
+    ${optionalString (!config.boot.isContainer) ''
       ${config.boot.bootspec.writer}
       ${optionalString config.boot.bootspec.enableValidation ''${config.boot.bootspec.validator} "$out/${config.boot.bootspec.filename}"''}
     ''}
@@ -139,8 +139,8 @@ in
 
     system.boot.loader.kernelFile = mkOption {
       internal = true;
-      default = pkgs.stdenv.hostPlatform.linux-kernel.target;
-      defaultText = literalExpression "pkgs.stdenv.hostPlatform.linux-kernel.target";
+      default = config.boot.kernelPackages.kernel.target;
+      defaultText = literalExpression "config.boot.kernelPackages.kernel.target";
       type = types.str;
       description = ''
         Name of the kernel file to be passed to the bootloader.

nixos/modules/system/boot/loader/generations-dir/generations-dir.nix

@@ -66,7 +66,6 @@ in
 
     system.build.installBootLoader = generationsDirBuilder;
     system.boot.loader.id = "generationsDir";
-    system.boot.loader.kernelFile = pkgs.stdenv.hostPlatform.linux-kernel.target;
 
   };
 }

nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py

@@ -27,7 +27,6 @@ NIXOS_DIR = Path(
 TIMEOUT = "@timeout@"
 EDITOR = "@editor@" == "1"  # noqa: PLR0133
 CONSOLE_MODE = "@consoleMode@"
-BOOTSPEC_TOOLS = "@bootspecTools@"
 DISTRO_NAME = "@distroName@"
 NIX = "@nix@"
 SYSTEMD = "@systemd@"
@@ -291,31 +290,26 @@ def write_loader_conf(default_entry_id: str | None) -> None:
     os.rename(tmp, LOADER_CONF)
 
 
-def get_bootspec(profile: str | None, generation: int) -> BootSpec:
+def get_bootspec(profile: str | None, generation: int) -> BootSpec | None:
     system_directory = system_dir(profile, generation, None)
     boot_json_path = (system_directory / "boot.json").resolve()
-    if boot_json_path.is_file():
-        with boot_json_path.open("r") as f:
-            # check if json is well-formed, else throw error with filepath
-            try:
-                bootspec_json = json.load(f)
-            except ValueError as e:
-                print(
-                    f"error: Malformed Json: {e}, in {boot_json_path}", file=sys.stderr
-                )
-                sys.exit(1)
-    else:
-        boot_json_str = run(
-            [
-                f"{BOOTSPEC_TOOLS}/bin/synthesize",
-                "--version",
-                "1",
-                system_directory,
-                "/dev/stdout",
-            ],
-            stdout=subprocess.PIPE,
-        ).stdout
-        bootspec_json = json.loads(boot_json_str)
+    if not boot_json_path.is_file():
+        print(
+            f"warning: skipping generation {generation}"
+            + (f" of profile {profile}" if profile else "")
+            + f": {boot_json_path} does not exist",
+            file=sys.stderr,
+        )
+        return None
+    with boot_json_path.open("r") as f:
+        # check if json is well-formed, else throw error with filepath
+        try:
+            bootspec_json = json.load(f)
+        except ValueError as e:
+            print(
+                f"error: Malformed Json: {e}, in {boot_json_path}", file=sys.stderr
+            )
+            sys.exit(1)
     return bootspec_from_json(bootspec_json)
 
 
@@ -551,6 +545,8 @@ def install_bootloader(args: argparse.Namespace) -> None:
 
     for gen in gens:
         bootspec = get_bootspec(gen.profile, gen.generation)
+        if bootspec is None:
+            continue
         is_default = Path(bootspec.init).parent == default_config
         new_boot_files, new_bootctl_id = boot_file(*gen, machine_id, bootspec)
         boot_files.extend(new_boot_files)

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix

@@ -47,8 +47,6 @@ let
 
       systemd = config.systemd.package;
 
-      bootspecTools = config.boot.bootspec.package;
-
       nix = config.nix.package.out;
 
       timeout = if config.boot.loader.timeout == null then "menu-force" else config.boot.loader.timeout;

nixos/modules/system/boot/tzpfms.nix

@@ -0,0 +1,247 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+# NOTE: the loading of keys is done in separate tzpfms systemd services
+# defined below rather than inline in the ZFS import scripts.
+
+let
+  cfgZFS = config.boot.zfs;
+  cfg = cfgZFS.tzpfms;
+
+  datasetToPool = x: lib.elemAt (lib.splitString "/" x) 0;
+
+  pools = lib.unique (map datasetToPool cfg.datasets);
+
+  # All ZFS filesystems
+  zfsFilesystems = lib.filter (x: x.fsType == "zfs") config.system.build.fileSystems;
+
+  # Pools that are already imported in initrd (have neededForBoot filesystems)
+  fsToPool = fs: lib.elemAt (lib.splitString "/" fs.device) 0;
+  rootPools = lib.unique (map fsToPool (lib.filter utils.fsNeededForBoot zfsFilesystems));
+
+  # Only include initrd resources if datasets belong to pools that need initrd import.
+  # A pool needs initrd import if it has neededForBoot filesystems.
+  initrdPools = lib.filter (pool: lib.elem pool rootPools) pools;
+  systemPools = lib.filter (pool: !(lib.elem pool rootPools)) pools;
+
+  needsInitrd = initrdPools != [ ];
+
+  datasetsByPool = lib.groupBy datasetToPool cfg.datasets;
+
+  # Goup neededForBoot filesystems by pool → initrd mount units
+  initrdMountsByPool = lib.foldl' (
+    acc: fs:
+    let
+      p = lib.elemAt (lib.splitString "/" fs.device) 0;
+      mount = "${utils.escapeSystemdPath ("/sysroot" + (lib.removeSuffix "/" fs.mountPoint))}.mount";
+    in
+    if utils.fsNeededForBoot fs then acc // { ${p} = (acc.${p} or [ ]) ++ [ mount ]; } else acc
+  ) { } zfsFilesystems;
+
+  # Group all ZFS filesystems by pool → system mount units
+  systemMountsByPool = lib.foldl' (
+    acc: fs:
+    let
+      pool = lib.elemAt (lib.splitString "/" fs.device) 0;
+      mount = "${utils.escapeSystemdPath (lib.removeSuffix "/" fs.mountPoint)}.mount";
+    in
+    acc // { ${pool} = (acc.${pool} or [ ]) ++ [ mount ]; }
+  ) { } zfsFilesystems;
+
+  # Generate tzpfms key-loading bash script
+  mkTzpfmsScript = datasets: /* bash */ ''
+    tzpfms_load_key() {
+      zfs-tpm-list -H ${backendArgs} "$@" 2>/dev/null | while IFS=$'\t' read -r name backend status _; do
+        case "$backend" in
+          ${lib.optionalString (lib.elem "TPM2" cfg.backends) /* bash */ ''
+            TPM2)
+              zfs-tpm2-load-key "$name" || true
+              ;;
+          ''}
+          ${lib.optionalString (lib.elem "TPM1.X" cfg.backends) /* bash */ ''
+            TPM1.X)
+              zfs-tpm1x-load-key "$name" || true
+              ;;
+          ''}
+          *)
+            echo "[WARN] boot.zfs.tzpfms: Unsupported tzpfms backend: “$backend”; “$name” not unlocked" >&2
+            ;;
+        esac
+      done
+    }
+
+    ${lib.concatMapStringsSep "\n" (ds: "tzpfms_load_key -u ${lib.escapeShellArg ds}") datasets}
+  '';
+
+  mkTzpfmsService =
+    {
+      pool,
+      mountUnits,
+      script,
+    }:
+    {
+      description = "Load TPM keys for ZFS pool “${pool}”";
+      after = [ "zfs-import-${pool}.service" ];
+      before = mountUnits ++ [ "zfs-import.target" ];
+      requiredBy = mountUnits ++ [ "zfs-import.target" ];
+      unitConfig.DefaultDependencies = "no";
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+      inherit script;
+    };
+
+  backendArgs = lib.escapeShellArgs (
+    lib.concatMap (b: [
+      "-b"
+      b
+    ]) cfg.backends
+  );
+in
+{
+  meta.maintainers = with lib.maintainers; [ toastal ];
+
+  options = {
+    boot.zfs.tzpfms = {
+      enable = lib.mkEnableOption ''
+        TPM-backed ZFS encryption using tzpfms.
+        Supports both TPM 2.0 & TPM 1.x.
+      '';
+
+      package = lib.mkPackageOption pkgs "tzpfms" { };
+
+      backends = lib.mkOption {
+        type =
+          with lib.types;
+          nonEmptyListOf (enum [
+            "TPM2"
+            "TPM1.X"
+          ]);
+        default = [
+          "TPM2"
+        ];
+        description = ''
+          TPM backends to include in for tzpfms.
+        '';
+      };
+
+      datasets = lib.mkOption {
+        # Needs to be explicit so we can build thy systemd services
+        type = with lib.types; nonEmptyListOf str;
+        example = [
+          "tank/root"
+          "tank/var"
+        ];
+        description = ''
+          Explicit list of ZFS datasets to unlock with TPM at boot.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          config.boot.supportedFilesystems.zfs or config.boot.initrd.supportedFilesystems.zfs or false;
+        message = "ZFS filesystem support needs to be enabled for boot.tzpfms to work";
+      }
+      {
+        assertion = initrdPools != { } -> config.boot.initrd.systemd.enable;
+        message = "boot.zfs.tzpfms requires boot.initrd.systemd.enable = true";
+      }
+      {
+        assertion =
+          !(cfgZFS.requestEncryptionCredentials == true) || cfgZFS.requestEncryptionCredentials == [ ];
+        message = ''
+          boot.zfs.requestEncryptionCredentials = true would prompt for all
+          encrypted dataset passphrases at boot, which conflicts with automatic
+          TPM unlock via tzpfms. Either set it to false, or explicitly list the
+          datasets that still need passphrase prompting.
+        '';
+      }
+      (
+        let
+          intersected = lib.intersectLists cfg.datasets (
+            if lib.isList cfgZFS.requestEncryptionCredentials then cfgZFS.requestEncryptionCredentials else [ ]
+          );
+        in
+        {
+          assertion = builtins.length intersected == 0;
+          message = ''
+            The following datasets are listed in both boot.zfs.tzpfms.datasets
+            & boot.zfs.requestEncryptionCredentials, which would cause a
+            passphrase prompt to block boot before tzpfms can unlock them via
+            TPM:
+
+            ${lib.concatMapStringsSep "\n" (d: "• ${d}") intersected}
+
+            Remove them from boot.zfs.requestEncryptionCredentials to allow
+            automatic TPM unlock.
+          '';
+        }
+      )
+    ];
+
+    environment.systemPackages = [ cfg.package ];
+
+    # Automatically register pools from tzpfms datasets as extraPools
+    boot.zfs.extraPools = pools;
+
+    boot.initrd = lib.mkMerge [
+      (lib.mkIf cfg.enable {
+        availableKernelModules = [
+          "tpm_tis"
+          "tpm_crb"
+        ];
+      })
+      (lib.mkIf needsInitrd (
+        lib.mkMerge [
+          (lib.mkIf config.boot.initrd.systemd.enable {
+            systemd.extraBin = {
+              zfs-tpm-list = "${lib.getBin cfg.package}/bin/zfs-tpm-list";
+            }
+            // lib.optionalAttrs (lib.elem "TPM2" cfg.backends) {
+              zfs-tpm2-load-key = "${lib.getBin cfg.package}/bin/zfs-tpm2-load-key";
+            }
+            // lib.optionalAttrs (lib.elem "TPM1.X" cfg.backends) {
+              zfs-tpm1x-load-key = "${lib.getBin cfg.package}/bin/zfs-tpm1x-load-key";
+            };
+            systemd.storePaths =
+              lib.optional (lib.elem "TPM2" cfg.backends) pkgs.tpm2-tss
+              ++ lib.optional (lib.elem "TPM1.X" cfg.backends) pkgs.trousers;
+            systemd.services = lib.genAttrs' initrdPools (pool: {
+              name = "tzpfms-load-${pool}";
+              value = mkTzpfmsService {
+                inherit pool;
+                mountUnits = initrdMountsByPool.${pool} or [ ];
+                script = mkTzpfmsScript (datasetsByPool.${pool} or [ ]);
+              };
+            });
+          })
+        ]
+      ))
+    ];
+
+    systemd.services = lib.genAttrs' systemPools (
+      pool:
+      let
+        mnts = systemMountsByPool.${pool} or [ ];
+      in
+      {
+        name = "tzpfms-load-${pool}";
+        value = mkTzpfmsService {
+          inherit pool;
+          mountUnits = mnts;
+          script = mkTzpfmsScript (datasetsByPool.${pool} or [ ]);
+        };
+      }
+    );
+  };
+}

nixos/modules/tasks/filesystems/bcachefs.nix

@@ -370,12 +370,16 @@ in
                   "sleep.target"
                 ];
 
-                script = "${lib.getExe cfg.package} data scrub ${fs}";
-
                 serviceConfig = {
                   Type = "oneshot";
                   Nice = 19;
                   IOSchedulingClass = "idle";
+
+                  ExecStart = lib.join " " [
+                    (lib.getExe cfg.package)
+                    (if lib.versionOlder cfg.package.version "v1.34.0" then "data scrub" else "scrub")
+                    (utils.escapeSystemdExecArg fs)
+                  ];
                 };
               };
           in

nixos/modules/virtualisation/qemu-vm.nix

@@ -1307,6 +1307,8 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
+        User = lib.mkIf (config.nix.daemonUser != "root") config.nix.daemonUser;
+        Group = lib.mkIf (config.nix.daemonGroup != "root") config.nix.daemonGroup;
       };
       script = ''
         if [[ "$(cat /proc/cmdline)" =~ regInfo=([^ ]*) ]]; then

nixos/release.nix

@@ -111,7 +111,7 @@ let
     with import ./.. { inherit system; };
 
     hydraJob (
-      (import lib/eval-config.nix {
+      (import ./lib/eval-config.nix {
         inherit system;
         modules = makeModules module { };
       }).config.system.build.isoImage
@@ -123,7 +123,7 @@ let
     with import ./.. { inherit system; };
 
     hydraJob (
-      (import lib/eval-config.nix {
+      (import ./lib/eval-config.nix {
         inherit system;
         modules = makeModules module { };
       }).config.system.build.sdImage
@@ -141,7 +141,7 @@ let
     let
 
       config =
-        (import lib/eval-config.nix {
+        (import ./lib/eval-config.nix {
           inherit system;
           modules = makeModules module { };
         }).config;
@@ -152,7 +152,7 @@ let
     tarball
     // {
       meta = {
-        description = "NixOS system tarball for ${system} - ${stdenv.hostPlatform.linux-kernel.name}";
+        description = "NixOS system tarball for ${system}";
         maintainers = map (x: lib.maintainers.${x}) maintainers;
       };
       inherit config;
@@ -183,12 +183,12 @@ let
   makeNetboot =
     { module, system, ... }:
     let
-      configEvaled = import lib/eval-config.nix {
+      configEvaled = import ./lib/eval-config.nix {
         inherit system;
         modules = makeModules module { };
       };
       build = configEvaled.config.system.build;
-      kernelTarget = configEvaled.pkgs.stdenv.hostPlatform.linux-kernel.target;
+      kernelTarget = build.kernel.target;
     in
     configEvaled.pkgs.symlinkJoin {
       name = "netboot";
@@ -209,7 +209,7 @@ let
 in
 rec {
 
-  channel = import lib/make-channel.nix {
+  channel = import ./lib/make-channel.nix {
     inherit
       pkgs
       nixpkgs
@@ -232,7 +232,7 @@ rec {
 
   kexec = forMatchingSystems supportedSystems (
     system:
-    (import lib/eval-config.nix {
+    (import ./lib/eval-config.nix {
       inherit system;
       modules = [
         ./modules/installer/netboot/netboot-minimal.nix
@@ -312,7 +312,7 @@ rec {
     with import ./.. { inherit system; };
 
     hydraJob (
-      (import lib/eval-config.nix {
+      (import ./lib/eval-config.nix {
         inherit system;
         modules = [
           ./modules/virtualisation/proxmox-image.nix
@@ -331,7 +331,7 @@ rec {
     with import ./.. { inherit system; };
 
     hydraJob (
-      (import lib/eval-config.nix {
+      (import ./lib/eval-config.nix {
         inherit system;
         modules = [
           ./modules/virtualisation/proxmox-image.nix
@@ -346,7 +346,7 @@ rec {
     with import ./.. { inherit system; };
 
     hydraJob (
-      (import lib/eval-config.nix {
+      (import ./lib/eval-config.nix {
         inherit system;
         modules = [
           ./modules/virtualisation/proxmox-lxc.nix
@@ -362,7 +362,7 @@ rec {
     with import ./.. { inherit system; };
 
     hydraJob (
-      (import lib/eval-config.nix {
+      (import ./lib/eval-config.nix {
         inherit system;
         modules = [
           configuration
@@ -379,7 +379,7 @@ rec {
     with import ./.. { inherit system; };
 
     hydraJob (
-      (import lib/eval-config.nix {
+      (import ./lib/eval-config.nix {
         inherit system;
         modules = [
           configuration
@@ -403,7 +403,7 @@ rec {
         with import ./.. { inherit system; };
 
         hydraJob (
-          (import lib/eval-config.nix {
+          (import ./lib/eval-config.nix {
             inherit system;
             modules = [
               configuration
@@ -427,7 +427,7 @@ rec {
         with import ./.. { inherit system; };
 
         hydraJob (
-          (import lib/eval-config.nix {
+          (import ./lib/eval-config.nix {
             inherit system;
             modules = [
               configuration
@@ -451,7 +451,7 @@ rec {
         with import ./.. { inherit system; };
 
         hydraJob (
-          (import lib/eval-config.nix {
+          (import ./lib/eval-config.nix {
             inherit system;
             modules = [
               configuration
@@ -475,7 +475,7 @@ rec {
         with import ./.. { inherit system; };
 
         hydraJob (
-          (import lib/eval-config.nix {
+          (import ./lib/eval-config.nix {
             inherit system;
             modules = [
               configuration
@@ -491,7 +491,7 @@ rec {
     system:
     pkgs.runCommand "dummy" {
       toplevel =
-        (import lib/eval-config.nix {
+        (import ./lib/eval-config.nix {
           inherit system;
           modules = singleton (
             { ... }:
@@ -539,14 +539,14 @@ rec {
       { ... }:
       {
         boot.isContainer = true;
-        imports = [ modules/profiles/minimal.nix ];
+        imports = [ ./modules/profiles/minimal.nix ];
       }
     );
 
     ec2 = makeClosure (
       { ... }:
       {
-        imports = [ modules/virtualisation/amazon-image.nix ];
+        imports = [ ./modules/virtualisation/amazon-image.nix ];
       }
     );
 

nixos/tests/all-tests.nix

@@ -1491,7 +1491,6 @@ in
   sanoid = runTest ./sanoid.nix;
   saunafs = runTest ./saunafs.nix;
   scanservjs = runTest ./scanservjs.nix;
-  scaphandre = runTest ./scaphandre.nix;
   schleuder = runTest ./schleuder.nix;
   scion-freestanding-deployment = runTest ./scion/freestanding-deployment;
   scrutiny = runTest ./scrutiny.nix;
@@ -1585,6 +1584,7 @@ in
   sx = runTest ./sx.nix;
   sympa = runTest ./sympa.nix;
   syncthing = runTest ./syncthing/main.nix;
+  syncthing-defaults = runTest ./syncthing/defaults.nix;
   syncthing-folders = runTest ./syncthing/folders.nix;
   syncthing-guiPassword = runTest ./syncthing/guiPassword.nix;
   syncthing-guiPasswordFile = runTest ./syncthing/guiPasswordFile.nix;
@@ -1700,6 +1700,7 @@ in
   tiddlywiki = runTest ./tiddlywiki.nix;
   tigervnc = handleTest ./tigervnc.nix { };
   tika = runTest ./tika.nix;
+  timekpr = runTest ./timekpr.nix;
   timezone = runTest ./timezone.nix;
   timidity = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./timidity { };
   tinc = handleTest ./tinc { };
@@ -1739,6 +1740,7 @@ in
   twingate = runTest ./twingate.nix;
   txredisapi = runTest ./txredisapi.nix;
   typesense = runTest ./typesense.nix;
+  tzpfms = runTest ./tzpfms.nix;
   tzupdate = runTest ./tzupdate.nix;
   ucarp = runTest ./ucarp.nix;
   udisks2 = runTest ./udisks2.nix;

nixos/tests/bootspec.nix

@@ -24,8 +24,6 @@ let
     environment.systemPackages = [ pkgs.efibootmgr ];
   };
   standard = {
-    boot.bootspec.enable = true;
-
     imports = [
       baseline
       systemd-boot
@@ -53,8 +51,6 @@ in
     meta.maintainers = with pkgs.lib.maintainers; [ raitobezarius ];
 
     nodes.machine = {
-      boot.bootspec.enable = true;
-
       imports = [
         baseline
         grub
@@ -75,8 +71,6 @@ in
     meta.maintainers = with pkgs.lib.maintainers; [ raitobezarius ];
 
     nodes.machine = {
-      boot.bootspec.enable = true;
-
       imports = [
         baseline
         grub

nixos/tests/firewall.nix

@@ -89,12 +89,17 @@
         else
           "nixos-firewall-tool open tcp 80";
       reset = if backend == "firewalld" then "firewall-cmd --reload" else "nixos-firewall-tool reset";
+      # https://github.com/firewalld/firewalld/issues/1571
+      waitForFirewalld = lib.optionalString (backend == "firewalld") ''
+        walled.wait_until_succeeds("firewall-cmd --state")
+      '';
     in
     ''
       start_all()
 
       walled.wait_for_unit("${unit}")
       walled.wait_for_unit("httpd")
+      ${waitForFirewalld}
       attacker.wait_for_unit("network.target")
 
       # Local connections should still work.

nixos/tests/firewalld.nix

@@ -29,6 +29,8 @@
 
     walled.wait_for_unit("firewalld")
     walled.wait_for_unit("httpd")
+    # https://github.com/firewalld/firewalld/issues/1571
+    walled.wait_until_succeeds("firewall-cmd --state")
 
     open.wait_for_unit("network.target")
 

nixos/tests/installer.nix

@@ -793,7 +793,6 @@ let
                 ++ optionals (bootLoader == "systemd-boot") [
                   pkgs.zstd.bin
                   pkgs.mypy
-                  config.boot.bootspec.package
                 ]
                 ++ optionals clevisTest [ pkgs.klibc ]
                 ++ optional systemdStage1 config.system.nixos-init.package;

nixos/tests/kea.nix

@@ -6,7 +6,6 @@
 # address.
 
 {
-  pkgs,
   lib,
   ...
 }:
@@ -15,7 +14,7 @@
 
   name = "kea";
 
-  nodes = {
+  containers = {
     router =
       { config, pkgs, ... }:
       {
@@ -26,6 +25,7 @@
           firewall.allowedUDPPorts = [ 67 ];
         };
 
+        services.resolved.enable = false;
         systemd.network = {
           enable = true;
           networks = {
@@ -141,6 +141,7 @@
           firewall.allowedUDPPorts = [ 53 ];
         };
 
+        services.resolved.enable = false;
         systemd.network = {
           enable = true;
           networks = {
@@ -153,8 +154,6 @@
           };
         };
 
-        services.resolved.enable = false;
-
         # Set up an authoritative nameserver, serving the `lan.nixos.test`
         # zone and configure an ACL that allows dynamic updates from
         # the router's ip address.
@@ -213,6 +212,7 @@
       {
         virtualisation.vlans = [ 1 ];
         systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
+        services.resolved.enable = false;
         networking = {
           useNetworkd = true;
           useDHCP = false;
@@ -222,16 +222,23 @@
       };
   };
   testScript =
-    { ... }:
+    # python
     ''
       start_all()
+
       router.wait_for_unit("kea-dhcp4-server.service")
-      client.systemctl("start systemd-networkd-wait-online.service")
-      client.wait_for_unit("systemd-networkd-wait-online.service")
-      client.wait_until_succeeds("ping -c 5 10.0.0.1")
-      router.wait_until_succeeds("ping -c 5 10.0.0.3")
-      nameserver.wait_until_succeeds("kdig +short client.lan.nixos.test @10.0.0.2 | grep -q 10.0.0.3")
-      router.log(router.execute("curl 127.0.0.1:9547")[1])
-      router.succeed("curl --no-buffer 127.0.0.1:9547 | grep -qE '^kea_dhcp4_addresses_assigned_total.*1.0$'")
+
+      with subtest("DHCPv4"):
+          client.systemctl("start systemd-networkd-wait-online.service")
+          client.wait_for_unit("systemd-networkd-wait-online.service")
+          client.wait_until_succeeds("ping -c 5 10.0.0.1")
+          router.wait_until_succeeds("ping -c 5 10.0.0.3")
+
+      with subtest("DDNS"):
+          nameserver.wait_until_succeeds("kdig +short client.lan.nixos.test @10.0.0.2 | grep -q 10.0.0.3")
+
+      with subtest("Prometheus Exporter"):
+          router.log(router.execute("curl 127.0.0.1:9547")[1])
+          router.succeed("curl --silent 127.0.0.1:9547 | grep -qE '^kea_dhcp4_addresses_assigned_total.*1.0$'")
     '';
 }

nixos/tests/lomiri.nix

@@ -669,7 +669,7 @@ in
 
               # Doing this here, since we need an in-session shell & separately starting a terminal again wastes time
               with subtest("polkit agent works"):
-                  machine.send_chars("pkexec touch /tmp/polkit-test\n")
+                  machine.send_chars("run0 touch /tmp/polkit-test\n")
                   # There's an authentication notification here that gains focus, but we struggle with OCRing it
                   # Just hope that it's up after a short wait
                   machine.sleep(10)

nixos/tests/opensnitch.nix

@@ -1,17 +1,23 @@
 { pkgs, lib, ... }:
 let
+  # opensnitch ebpf seems to handle non-x86 syscalls incorrectly
+  test_ebpf = pkgs.stdenv.hostPlatform.isx86;
+
   monitorMethods = [
-    "ebpf"
     "proc"
     "ftrace"
     "audit"
-  ];
+  ]
+  ++ lib.optional test_ebpf "ebpf";
 in
 {
   name = "opensnitch";
 
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ onny ];
+    maintainers = [
+      onny
+      grimmauld
+    ];
   };
 
   nodes = {
@@ -88,13 +94,13 @@ in
     lib.concatLines (
       map (m: ''
         client_blocked_${m}.wait_for_unit("opensnitchd.service")
-        client_blocked_${m}.fail("curl http://server")
+        client_blocked_${m}.fail("curl --connect-timeout 3 http://server")
 
         client_allowed_${m}.wait_for_unit("opensnitchd.service")
-        client_allowed_${m}.succeed("curl http://server")
+        client_allowed_${m}.succeed("curl --connect-timeout 3 http://server")
       '') monitorMethods
     )
-    + ''
+    + lib.optionalString test_ebpf ''
       # make sure the kernel modules were actually properly loaded
       client_blocked_ebpf.succeed(r"journalctl -u opensnitchd --grep '\[eBPF\] module loaded: /nix/store/.*/etc/opensnitchd/opensnitch\.o'")
       client_blocked_ebpf.succeed(r"journalctl -u opensnitchd --grep '\[eBPF\] module loaded: /nix/store/.*/etc/opensnitchd/opensnitch-procs\.o'")

nixos/tests/plausible.nix

@@ -2,10 +2,7 @@
 {
   name = "plausible";
   meta = {
-    maintainers = with lib.maintainers; [
-      e1mo
-      xanderio
-    ];
+    maintainers = [ ];
   };
 
   nodes.machine =

nixos/tests/postgresql/postgresql.nix

@@ -31,17 +31,6 @@ let
           INSERT INTO sth (id) VALUES (1);
           CREATE TABLE xmltest ( doc xml );
           INSERT INTO xmltest (doc) VALUES ('<test>ok</test>'); -- check if libxml2 enabled
-
-          -- check if hardening gets relaxed
-          CREATE EXTENSION plv8;
-          -- try to trigger the V8 JIT, which requires MemoryDenyWriteExecute
-          DO $$
-            let xs = [];
-            for (let i = 0, n = 400000; i < n; i++) {
-                xs.push(Math.round(Math.random() * n))
-            }
-            console.log(xs.reduce((acc, x) => acc + x, 0));
-          $$ LANGUAGE plv8;
         '';
 
       in
@@ -60,9 +49,6 @@ let
               identMap = ''
                 postgres root postgres
               '';
-              # TODO(@Ma27) split this off into its own VM test and move a few other
-              # extension tests to use postgresqlTestExtension.
-              extensions = ps: with ps; [ plv8 ];
             };
 
             services.postgresqlBackup = {

nixos/tests/prometheus-exporters.nix

@@ -21,6 +21,9 @@ let
     *  `nodeName` (optional)
     *    override an incompatible testnode name
     *
+    *  `testBackend` (optional)
+    *    whether to run in `containers` (default) or `nodes` scope
+    *
     *  Example:
     *    exporterTests.<exporterName> = {
     *      exporterConfig = {
@@ -168,6 +171,7 @@ let
     blackbox =
       { pkgs, ... }:
       {
+        testBackend = "nodes";
         exporterConfig = {
           enable = true;
           configFile = pkgs.writeText "config.yml" (
@@ -373,16 +377,23 @@ let
       };
 
     dovecot =
-      { ... }:
+      { pkgs, ... }:
       {
+        testBackend = "nodes";
         exporterConfig = {
           enable = true;
           scopes = [ "global" ];
-          socketPath = "/var/run/dovecot2/old-stats";
+          socketPath = "/var/run/dovecot2/stats-reader";
           user = "root"; # <- don't use user root in production
         };
         metricProvider = {
-          services.dovecot2.enable = true;
+          services.dovecot2 = {
+            enable = true;
+            settings = {
+              dovecot_config_version = pkgs.dovecot.version;
+              dovecot_storage_version = pkgs.dovecot.version;
+            };
+          };
         };
         exporterTest = ''
           wait_for_unit("prometheus-dovecot-exporter.service")
@@ -423,6 +434,7 @@ let
     ebpf =
       { ... }:
       {
+        testBackend = "nodes";
         exporterConfig = {
           enable = true;
           names = [ "timers" ];
@@ -447,7 +459,6 @@ let
           # `services.elasticsearch` is unmaintained; OpenSearch is the same
           # engine class and is explicitly supported by the exporter.
           services.opensearch.enable = true;
-          virtualisation.memorySize = 2048;
         };
         exporterTest = ''
           wait_for_unit("opensearch.service")
@@ -463,6 +474,7 @@ let
     fail2ban =
       { ... }:
       {
+        testBackend = "nodes"; # setfacl
         exporterConfig = {
           enable = true;
           exitOnError = true;
@@ -964,6 +976,7 @@ let
     modemmanager =
       { ... }:
       {
+        testBackend = "nodes";
         exporterConfig = {
           enable = true;
           refreshRate = "10s";
@@ -1099,7 +1112,7 @@ let
           wait_for_unit("nginx.service")
           wait_for_unit("prometheus-nextcloud-exporter.service")
           wait_for_open_port(9205)
-          succeed("curl -sSf http://localhost:9205/metrics | grep 'nextcloud_up 1'")
+          wait_until_succeeds("curl -sSf http://localhost:9205/metrics | grep 'nextcloud_up 1'")
         '';
       };
 
@@ -1658,24 +1671,6 @@ let
         '';
       };
 
-    scaphandre =
-      { ... }:
-      {
-        exporterConfig = {
-          enable = true;
-        };
-        metricProvider = {
-          boot.kernelModules = [ "intel_rapl_common" ];
-        };
-        exporterTest = ''
-          wait_for_unit("prometheus-scaphandre-exporter.service")
-          wait_for_open_port(8080)
-          wait_until_succeeds(
-              "curl -sSf 'localhost:8080/metrics'"
-          )
-        '';
-      };
-
     shelly =
       { pkgs, ... }:
       {
@@ -2143,6 +2138,7 @@ let
     zfs =
       { ... }:
       {
+        testBackend = "nodes"; # zfs kmod
         exporterConfig = {
           enable = true;
         };
@@ -2165,13 +2161,14 @@ lib.mapAttrs (
     { pkgs, lib, ... }:
     let
       testConfig = testConfigFun { inherit pkgs lib; };
-      nodeName = testConfig.nodeName or exporter;
+      testBackend = testConfig.testBackend or "containers";
+      nodeName = "machine";
     in
     {
       name = "prometheus-${exporter}-exporter";
       node.pkgsReadOnly = testConfig.pkgsReadOnly or true;
 
-      nodes.${nodeName} = lib.mkMerge [
+      ${testBackend}.${nodeName} = lib.mkMerge [
         {
           services.prometheus.exporters.${exporter} = testConfig.exporterConfig;
         }
@@ -2196,7 +2193,6 @@ lib.mapAttrs (
               "${nodeName}.${line}"
           ) (lib.splitString "\n" (lib.removeSuffix "\n" testConfig.exporterTest))
         )}
-        ${nodeName}.shutdown()
       '';
 
       meta.maintainers = [ ];

nixos/tests/restic.nix

@@ -122,7 +122,7 @@ in
             ];
           };
           remote-from-file-backup = {
-            inherit passwordFile exclude pruneOpts;
+            inherit passwordFile pruneOpts;
             initialize = true;
             repositoryFile = pkgs.writeText "repositoryFile" remoteFromFileRepository;
             paths = [
@@ -130,7 +130,8 @@ in
               "/opt/a_dir/a_file_2"
             ];
             dynamicFilesFrom = ''
-              find /opt -mindepth 1 -maxdepth 1 ! -name a_dir # all files in /opt except for a_dir
+              # all files in /opt except for a_dir and excluded_file_*
+              find /opt -mindepth 1 -maxdepth 1 ! -name a_dir ! -name excluded_file_*
             '';
           };
           remote-from-command-backup = {

nixos/tests/rtkit.nix

@@ -55,7 +55,7 @@
 
       # Provide a little logging of polkit checks - otherwise it's
       # impossible to know what's going on.
-      security.polkit.debug = true;
+      security.polkit.extraArgs = [ "--log-level=notice" ];
       security.polkit.extraConfig = ''
         polkit.addRule(function(action, subject) {
           const ns = "org.freedesktop.RealtimeKit1.";

nixos/tests/scaphandre.nix

@@ -1,18 +0,0 @@
-{
-  name = "scaphandre";
-
-  nodes.scaphandre =
-    { pkgs, ... }:
-    {
-      boot.kernelModules = [ "intel_rapl_common" ];
-
-      environment.systemPackages = [ pkgs.scaphandre ];
-    };
-
-  testScript = ''
-    scaphandre.start()
-    scaphandre.wait_until_succeeds(
-        "scaphandre stdout -t 4",
-    )
-  '';
-}

nixos/tests/syncthing/defaults.nix

@@ -0,0 +1,42 @@
+{ lib, pkgs, ... }:
+let
+  expectedPath = "/tmp/syncthing-default";
+in
+{
+  name = "syncthing-defaults";
+  meta.maintainers = with pkgs.lib.maintainers; [ seudonym ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [
+        pkgs.libxml2
+        pkgs.curl
+      ];
+      services.syncthing = {
+        enable = true;
+        settings.defaults.folder.path = expectedPath;
+      };
+    };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("syncthing.service")
+    machine.wait_for_unit("syncthing-init.service")
+
+    # Get the API key by parsing the config.xml
+    api_key = machine.succeed(
+        "xmllint --xpath 'string(configuration/gui/apikey)' /var/lib/syncthing/.config/syncthing/config.xml"
+    ).strip()
+
+    # Query the defaults/folder endpoint via Syncthing's REST API
+    config = json.loads(machine.succeed(
+        f"curl -Ssf -H 'X-API-Key: {api_key}' http://127.0.0.1:8384/rest/config/defaults/folder"
+    ))
+
+    actual_path = config.get('path')
+    assert actual_path == "${expectedPath}", f"Default folder path is '{actual_path}', but expected '${expectedPath}'"
+    machine.log(f"Success: Default folder path is correctly set to '{actual_path}'")
+  '';
+}

nixos/tests/systemd-boot.nix

@@ -772,26 +772,6 @@ in
     }
   );
 
-  no-bootspec = runTest (
-    { lib, ... }:
-    {
-      name = "systemd-boot-no-bootspec";
-      meta.maintainers = with lib.maintainers; [ julienmalka ];
-
-      nodes.machine = {
-        imports = [ common ];
-        boot.bootspec.enable = false;
-      };
-
-      testScript =
-        # python
-        ''
-          machine.start()
-          machine.wait_for_unit("multi-user.target")
-        '';
-    }
-  );
-
   bootCounting =
     let
       baseConfig = {

nixos/tests/systemd-escaping.nix

@@ -36,6 +36,19 @@ in
         assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ null ])).success;
         assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ false ])).success;
         assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ (_: _) ])).success;
+        # escapeSystemdPath simplifies the path like systemd-escape --path does:
+        # "." components are dropped and duplicate/leading/trailing slashes removed.
+        assert utils.escapeSystemdPath "/mnt/./foo" == "mnt-foo";
+        assert utils.escapeSystemdPath "/foo//bar/baz/" == "foo-bar-baz";
+        assert utils.escapeSystemdPath "/" == "-";
+        assert utils.escapeSystemdPath "" == "-";
+        assert utils.escapeSystemdPath "/.hidden/x" == "\\x2ehidden-x";
+        assert utils.escapeSystemdPath "/foo?bar" == "foo\\x3fbar";
+        # A leading ".." in an absolute path is the root's parent, i.e. the root.
+        assert utils.escapeSystemdPath "/../foo" == "foo";
+        # Non-normalized paths can't be escaped, matching systemd-escape.
+        assert !(builtins.tryEval (utils.escapeSystemdPath "/mnt/../foo")).success;
+        assert !(builtins.tryEval (utils.escapeSystemdPath ".")).success;
         {
           description = "Echo to the journal";
           serviceConfig.Type = "oneshot";

nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix

@@ -17,7 +17,7 @@ import ./make-test-python.nix (
         hexa
       ];
     };
-    nodes = {
+    containers = {
 
       # The ISP's routers job is to delegate IPv6 prefixes via DHCPv6. Like with
       # regular IPv6 auto-configuration it will also emit IPv6 router
@@ -38,6 +38,7 @@ import ./make-test-python.nix (
             interfaces.eth1 = lib.mkForce { }; # Don't use scripted networking
           };
 
+          services.resolved.enable = false;
           systemd.network = {
             enable = true;
 
@@ -204,6 +205,7 @@ import ./make-test-python.nix (
           interfaces.eth1.ipv6.addresses = lib.mkForce [ ];
         };
 
+        services.resolved.enable = false;
         systemd.network = {
           networks = {
             # systemd-networkd will load the first network unit file
@@ -300,6 +302,7 @@ import ./make-test-python.nix (
       client = {
         virtualisation.vlans = [ 2 ];
         systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
+        services.resolved.enable = false;
         networking = {
           useNetworkd = true;
           useDHCP = false;

nixos/tests/timekpr.nix

@@ -1,13 +1,15 @@
-{ pkgs, lib, ... }:
+{
+  lib,
+  ...
+}:
+
 {
   name = "timekpr";
   meta.maintainers = [ lib.maintainers.atry ];
 
-  nodes.machine =
-    { pkgs, lib, ... }:
-    {
-      services.timekpr.enable = true;
-    };
+  containers.machine = {
+    services.timekpr.enable = true;
+  };
 
   testScript = ''
     start_all()

nixos/tests/tzpfms.nix

@@ -0,0 +1,135 @@
+{ lib, ... }:
+
+{
+  name = "tzpfms";
+
+  meta = {
+    maintainers = with lib.maintainers; [ toastal ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [
+        pkgs.jq
+        pkgs.parted
+        pkgs.tzpfms
+      ];
+
+      boot = {
+        initrd.systemd.enable = true;
+        loader = {
+          systemd-boot.enable = true;
+          timeout = 0;
+          efi.canTouchEfiVariables = true;
+        };
+        supportedFilesystems = [ "zfs" ];
+        zfs = {
+          devNodes = "/dev";
+          forceImportRoot = lib.mkDefault false;
+          requestEncryptionCredentials = false;
+        };
+      };
+
+      networking.hostId = "deadbeef";
+
+      virtualisation = {
+        emptyDiskImages = [ 1024 ];
+        mountHostNixStore = true;
+        useBootLoader = true;
+        useEFIBoot = true;
+        tpm.enable = true;
+      };
+
+      specialisation.tzpfms-unlock.configuration = {
+        boot = {
+          kernelParams = [
+            "rd.debug"
+            "rd.log=all"
+          ];
+          zfs = {
+            devNodes = "/dev";
+            requestEncryptionCredentials = false;
+            tzpfms = {
+              enable = true;
+              datasets = [
+                "tpmpool/boot"
+                "tpmpool/data"
+              ];
+            };
+          };
+        };
+
+        virtualisation.fileSystems = {
+          "/bootz" = {
+            device = "tpmpool/boot";
+            fsType = "zfs";
+            options = [ "zfsutil" ];
+            neededForBoot = true;
+          };
+          "/dataz" = {
+            device = "tpmpool/data";
+            fsType = "zfs";
+            options = [ "zfsutil" ];
+            neededForBoot = false;
+          };
+        };
+      };
+    };
+
+  testScript = /* python */ ''
+    datasets = ["boot", "data"]
+
+    machine.start(allow_reboot=True)
+
+    machine.wait_for_unit("multi-user.target")
+
+    machine.succeed("test -e /dev/tpm0")
+    machine.succeed("test -e /dev/tpmrm0")
+
+    machine.succeed("parted --script /dev/vdb mklabel gpt")
+    machine.succeed("parted --script /dev/vdb -- mkpart primary 1M 100%")
+
+    with subtest("Create encrypted ZFS datasets"):
+        machine.succeed("zpool create -O mountpoint=none tpmpool /dev/vdb1")
+        for ds in datasets:
+          machine.succeed("echo aoeuhtns | zfs create -o encryption=aes-128-gcm -o keyformat=passphrase -o mountpoint=/" + ds + "z tpmpool/" + ds)
+
+    with subtest("Wrap keys to TPM with backup"):
+        for ds in datasets:
+          machine.succeed("printf '\\n\\n' | zfs-tpm2-change-key -b /tmp/tzpfms-backup-" + ds + ".key tpmpool/" + ds)
+          machine.succeed("test -f /tmp/tzpfms-backup-" + ds + ".key")
+        list = machine.succeed("zfs-tpm-list -H")
+        for ds in datasets:
+          assert "tpmpool/" + ds in list
+
+    with subtest("Verify backup keys work"):
+        for ds in datasets:
+          machine.succeed("zfs unmount tpmpool/" + ds + " || true")
+          machine.succeed("zfs unload-key tpmpool/" + ds)
+          machine.succeed("zfs load-key tpmpool/" + ds + " </tmp/tzpfms-backup-" + ds + ".key")
+          assert "available" in machine.succeed("zfs get -Ho value keystatus tpmpool/" + ds)
+
+    with subtest("Verify loading key"):
+        # Assertion that the key is loadable, as suggested in the manpage
+        for ds in datasets:
+          assert "OK" in machine.succeed("zfs-tpm2-load-key -n tpmpool/" + ds)
+
+    with subtest("Switch to tzpfms configuration & reboot"):
+        machine.succeed("zpool export tpmpool || true")
+        # Set the specialization as the default boot entry
+        entry_id = machine.succeed("bootctl list --json=short | jq -r '.[] | select(.title | test(\"tzpfms-unlock\")) | .id'")
+        assert id != "", "Missing boot entry"
+        machine.succeed("bootctl set-default " + entry_id)
+        machine.succeed("sync")
+        machine.reboot()
+
+    with subtest("Verify automatic TPM unlock at boot"):
+        machine.wait_for_unit("multi-user.target")
+
+        for ds in datasets:
+          status = machine.succeed("zfs get -Ho value keystatus tpmpool/" + ds).strip()
+          print("tpmpool/" + ds + ": " + status)
+          assert status == "available", ds + " key must be auto-loaded"
+  '';
+}

nixos/tests/web-apps/pretalx.nix

@@ -4,37 +4,38 @@
   name = "pretalx";
   meta.maintainers = pkgs.pretalx.meta.maintainers;
 
-  nodes = {
-    pretalx =
-      { config, ... }:
-      {
-        networking.extraHosts = ''
-          127.0.0.1 talks.local
-        '';
+  containers.pretalx =
+    { config, ... }:
+    {
+      networking.extraHosts = ''
+        127.0.0.1 talks.local
+      '';
 
-        services.pretalx = {
-          enable = true;
-          plugins = with config.services.pretalx.package.plugins; [
-            pages
-          ];
-          nginx.domain = "talks.local";
-          settings = {
-            site.url = "http://talks.local";
-          };
+      services.pretalx = {
+        enable = true;
+        plugins = with config.services.pretalx.package.plugins; [
+          pages
+        ];
+        nginx.domain = "talks.local";
+        settings = {
+          site.url = "http://talks.local";
         };
       };
-  };
+    };
 
-  testScript = ''
-    start_all()
+  testScript =
+    # python
+    ''
+      start_all()
 
-    pretalx.wait_for_unit("pretalx-web.service")
-    pretalx.wait_for_unit("pretalx-worker.service")
+      pretalx.wait_for_unit("pretalx-web.service")
+      pretalx.wait_for_unit("pretalx-worker.service")
 
-    pretalx.wait_until_succeeds("curl -q --fail http://talks.local/orga/")
+      pretalx.wait_until_succeeds("curl -q --fail http://talks.local/orga/")
 
-    pretalx.succeed("pretalx-manage --help")
+      pretalx.log(pretalx.succeed("id"))
+      pretalx.succeed("pretalx-manage --help | grep -q 'createsuperuser'")
 
-    pretalx.log(pretalx.succeed("systemd-analyze security pretalx-web.service"))
-  '';
+      pretalx.log(pretalx.succeed("systemd-analyze security pretalx-web.service"))
+    '';
 }

nixos/tests/web-apps/pretix.nix

@@ -1,50 +1,47 @@
 {
-  lib,
   pkgs,
   ...
 }:
 
 {
   name = "pretix";
-  meta.maintainers = with lib.maintainers; [ hexa ];
+  meta.maintainers = pkgs.pretix.meta.maintainers;
 
-  nodes = {
-    pretix = {
-      virtualisation.memorySize = 2048;
+  containers.pretix = {
+    networking.extraHosts = ''
+      127.0.0.1 tickets.local
+    '';
 
-      networking.extraHosts = ''
-        127.0.0.1 tickets.local
-      '';
-
-      services.pretix = {
-        enable = true;
-        nginx.domain = "tickets.local";
-        plugins = with pkgs.pretix.plugins; [
-          passbook
-          pages
-          zugferd
-        ];
-        settings = {
-          pretix = {
-            instance_name = "NixOS Test";
-            url = "http://tickets.local";
-          };
-          mail.from = "hello@tickets.local";
+    services.pretix = {
+      enable = true;
+      nginx.domain = "tickets.local";
+      plugins = with pkgs.pretix.plugins; [
+        passbook
+        pages
+        zugferd
+      ];
+      settings = {
+        pretix = {
+          instance_name = "NixOS Test";
+          url = "http://tickets.local";
         };
+        mail.from = "hello@tickets.local";
       };
     };
   };
 
-  testScript = ''
-    start_all()
+  testScript =
+    # python
+    ''
+      start_all()
 
-    pretix.wait_for_unit("pretix-web.service")
-    pretix.wait_for_unit("pretix-worker.service")
+      pretix.wait_for_unit("pretix-web.service")
+      pretix.wait_for_unit("pretix-worker.service")
 
-    pretix.wait_until_succeeds("curl -q --fail http://tickets.local")
+      pretix.wait_until_succeeds("curl -q --fail http://tickets.local")
 
-    pretix.succeed("pretix-manage --help")
+      pretix.succeed("pretix-manage --help | grep -q 'createsuperuser'")
 
-    pretix.log(pretix.succeed("systemd-analyze security pretix-web.service"))
-  '';
+      pretix.log(pretix.succeed("systemd-analyze security pretix-web.service"))
+    '';
 }

nixos/tests/web-apps/rustical.nix

@@ -3,28 +3,35 @@
   lib,
   ...
 }:
+
+let
+  port = "4000";
+in
+
 {
   name = "rustical";
 
   meta.maintainers = pkgs.rustical.meta.maintainers;
 
-  nodes.machine =
+  containers.machine =
     {
       pkgs,
       ...
     }:
     {
-      services.rustical.enable = true;
+      services.rustical = {
+        enable = true;
+        settings.http.bind = "[::]:${port}";
+      };
       environment.systemPackages = with pkgs; [ calendar-cli ];
     };
 
   testScript =
     {
-      nodes,
+      containers,
       ...
     }:
     let
-      port = toString nodes.machine.services.rustical.settings.http.port;
       url = "http://localhost:${toString port}";
 
       createPrincipalScript = pkgs.writeScript "rustical-create-principal" ''

nixos/tests/wpa_supplicant.nix

@@ -283,18 +283,22 @@ in
         enable = lib.mkOverride 0 true;
         userControlled = true;
         allowAuxiliaryImperativeNetworks = true;
-        interfaces = [ "wlan1" ];
+        interfaces = [
+          "wlan0"
+          "wlan1"
+        ];
       };
     };
 
     testScript = ''
       wpa_cli = "sudo -u alice -g wpa_supplicant wpa_cli"
 
-      with subtest("Daemon is running and accepting connections"):
-          machine.wait_for_unit("wpa_supplicant-wlan1.service")
-          status = machine.wait_until_succeeds(f"{wpa_cli} -i wlan1 status")
-          assert "Failed to connect" not in status, \
-                 "Failed to connect to the daemon"
+      with subtest("Daemons are running and accepting connections"):
+          for iface in ["wlan0", "wlan1"]:
+            machine.wait_for_unit(f"wpa_supplicant-{iface}.service")
+            status = machine.wait_until_succeeds(f"{wpa_cli} -i {iface} status")
+            assert "Failed to connect" not in status, \
+                   f"Failed to connect to the daemon for {iface}"
 
       with subtest("Daemon can be configured imperatively"):
           machine.succeed(f"{wpa_cli} -i wlan1 add_network")