python3Packages.jupyter-docprovider: 2.4.0 -> 2.4.1 (#529674)

Changelog: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html

.github/workflows/teams.yml

@@ -2,7 +2,7 @@ name: Teams
 
 on:
   schedule:
-    # Every Tuesday at 19:42 (randomly chosen)
+    # Every Monday at 19:42 (randomly chosen)
     - cron: '42 19 * * 1'
   workflow_dispatch:
 

.mailmap

@@ -17,6 +17,7 @@ jopejoe1 <nixpkgs@missing.ninja> <34899572+jopejoe1@users.noreply.github.com>
 jopejoe1 <nixpkgs@missing.ninja> <jopejoe1@missing.ninja>
 jopejoe1 <nixpkgs@missing.ninja> <jopejoe1>
 Jörg Thalheim <joerg@thalheim.io> <Mic92@users.noreply.github.com>
+Katalin Rebhan <me@dblsaiko.net>
 Lin Jian <me@linj.tech> <linj.dev@outlook.com>
 Lin Jian <me@linj.tech> <75130626+jian-lin@users.noreply.github.com>
 Martin Weinelt <hexa@darmstadt.ccc.de> <mweinelt@users.noreply.github.com>

README.md

@@ -1,9 +1,9 @@
 <p align="center">
   <a href="https://nixos.org">
     <picture>
-      <source media="(prefers-color-scheme: light)" srcset="https://brand.nixos.org/logos/nixos-logo-default-gradient-black-regular-horizontal-minimal.svg">
-      <source media="(prefers-color-scheme: dark)" srcset="https://brand.nixos.org/logos/nixos-logo-default-gradient-white-regular-horizontal-minimal.svg">
-      <img src="https://brand.nixos.org/logos/nixos-logo-default-gradient-black-regular-horizontal-minimal.svg" width="500px" alt="NixOS logo">
+      <source media="(prefers-color-scheme: light)" srcset="https://brand.nixos.org/logos/nixos-logo-rainbow-gradient-black-regular-horizontal-minimal.svg">
+      <source media="(prefers-color-scheme: dark)" srcset="https://brand.nixos.org/logos/nixos-logo-rainbow-gradient-white-regular-horizontal-minimal.svg">
+      <img src="https://brand.nixos.org/logos/nixos-logo-rainbow-gradient-black-regular-horizontal-minimal.svg" width="500px" alt="NixOS logo">
     </picture>
   </a>
 </p>

ci/eval/compare/default.nix

@@ -238,34 +238,33 @@ runCommand "compare"
       jq -r -f ${./generate-step-summary.jq} < ${changed-paths}
     } >> $out/step-summary.md
 
-    if jq -e '(.attrdiff.added | length == 0) and (.attrdiff.removed | length == 0)' "${changed-paths}" > /dev/null; then
-      # Chunks have changed between revisions
-      # We cannot generate a performance comparison
-      {
-        echo
-        echo "# Performance comparison"
-        echo
-        echo "This compares the performance of this branch against its pull request base branch (e.g., 'master')"
-        echo
-        echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
-        echo
-      } >> $out/step-summary.md
+    {
+      echo
+      echo "# Performance comparison"
+      echo
+      echo "This compares the performance of this branch against its pull request base branch (e.g., 'master')"
+      echo
+    } >> $out/step-summary.md
 
-      cmp-stats --explain ${combined}/before/stats ${combined}/after/stats >> $out/step-summary.md
-
-    else
-      # Package chunks are the same in both revisions
-      # We can use the to generate a performance comparison
+    # cmp-stats only compares the stats chunks present in both revisions, so the
+    # comparison is still produced when packages were added/removed. The paired
+    # chunks may cover different attrs in that case, so caveat the figures.
+    if ! jq -e '(.attrdiff.added | length == 0) and (.attrdiff.removed | length == 0)' "${changed-paths}" > /dev/null; then
       {
+        echo "> [!NOTE]"
+        echo "> The package sets differ between the two revisions. This comparison only"
+        echo "> covers packages evaluated in both, so treat the figures as approximate."
         echo
-        echo "# Performance Comparison"
-        echo
-        echo "Performance stats were skipped because the package sets differ between the two revisions."
-        echo
-        echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
       } >> $out/step-summary.md
     fi
 
+    {
+      echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
+      echo
+    } >> $out/step-summary.md
+
+    cmp-stats --explain ${combined}/before/stats ${combined}/after/stats >> $out/step-summary.md
+
     jq -r '.[]' "${touchedFilesJson}" > ./touched-files
     readarray -t touchedFiles < ./touched-files
     echo "This PR touches ''${#touchedFiles[@]} files"

ci/github-script/merge.js

@@ -97,7 +97,7 @@ function hasMergeCommand(body) {
   return (body ?? '')
     .replace(/<!--.*?-->/gms, '')
     .replace(/(^`{3,})[^`].*?\1/gms, '')
-    .match(/^@NixOS\/nixpkgs-merge-bot merge\s*$/m)
+    .match(/^@NixOS\/nixpkgs-merge-bot merge\s*$/im)
 }
 
 async function handleMergeComment({ github, body, node_id, reaction }) {

ci/pinned.json

@@ -9,9 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "02f3fa0374fa13707d42d55d58ecc76b091f223c",
-      "url": "https://github.com/NixOS/nixpkgs/archive/02f3fa0374fa13707d42d55d58ecc76b091f223c.tar.gz",
-      "hash": "0z8d33c5g0gk9a74ppqq77npisf9xx9c8ai9isxa2hyjx4lv1pki"
+      "revision": "cbb5cf358f50aa6acc9efd6113b7bcfbc352cd73",
+      "url": "https://github.com/NixOS/nixpkgs/archive/cbb5cf358f50aa6acc9efd6113b7bcfbc352cd73.tar.gz",
+      "hash": "sha256-IX7G1dlKrOqPOImfbo7ADDfV5yU1+j+MRChI3TL4tAA="
     },
     "treefmt-nix": {
       "type": "Git",
@@ -22,10 +22,10 @@
       },
       "branch": "main",
       "submodules": false,
-      "revision": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
-      "url": "https://github.com/numtide/treefmt-nix/archive/790751ff7fd3801feeaf96d7dc416a8d581265ba.tar.gz",
-      "hash": "1zah3dmbpn3ap5acg22kq1j19dg32gj73l43yamjcxhc38sv9kd5"
+      "revision": "db947814a175b7ca6ded66e21383d938df01c227",
+      "url": "https://github.com/numtide/treefmt-nix/archive/db947814a175b7ca6ded66e21383d938df01c227.tar.gz",
+      "hash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM="
     }
   },
-  "version": 5
+  "version": 8
 }

ci/update-pinned.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p npins
+#!nix-shell -i bash -p npins -I nixpkgs=../
 
 set -euo pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
+npins --lock-file pinned.json upgrade
 npins --lock-file pinned.json update

doc/stdenv/meta.chapter.md

@@ -77,7 +77,7 @@ A link or a list of links to the location of Changelog for a package. A link may
 
 ### `license` {#var-meta-license}
 
-The license, or licenses, for the package. One from the attribute set defined in [`nixpkgs/lib/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses.nix). At this moment using both a list of licenses and a single license is valid. If the license field is in the form of a list representation, then it means that parts of the package are licensed differently. Each license should preferably be referenced by their attribute. The non-list attribute value can also be a space delimited string representation of the contained attribute `shortNames` or `spdxIds`. The following are all valid examples:
+The license, or licenses, for the package. One from the attribute set defined in [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix). At this moment using both a list of licenses and a single license is valid. If the license field is in the form of a list representation, then it means that parts of the package are licensed differently. Each license should preferably be referenced by their attribute. The non-list attribute value can also be a space delimited string representation of the contained attribute `shortNames` or `spdxIds`. The following are all valid examples:
 
 - Single license referenced by attribute (preferred) `lib.licenses.gpl3Only`.
 - Single license referenced by its attribute shortName (frowned upon) `"gpl3Only"`.
@@ -216,7 +216,7 @@ If this list is not empty, the package is marked as "insecure", meaning that it
 
 ## Licenses {#sec-meta-license}
 
-The `meta.license` attribute should preferably contain a value from `lib.licenses` defined in [`nixpkgs/lib/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses.nix), or in-place license description of the same format if the license is unlikely to be useful in another expression.
+The `meta.license` attribute should preferably contain a value from `lib.licenses` defined in [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix), or in-place license description of the same format if the license is unlikely to be useful in another expression.
 
 Although it’s typically better to indicate the specific license, a few generic options are available:
 

doc/using/configuration.chapter.md

@@ -152,7 +152,7 @@ There are several ways to tweak how Nix handles a package which has been marked
 
     Note that `allowlistedLicenses` only applies to unfree licenses unless `allowUnfree` is enabled. It is not a generic allowlist for all types of licenses. `blocklistedLicenses` applies to all licenses.
 
-A complete list of licenses can be found in the file `lib/licenses.nix` of the nixpkgs tree.
+A complete list of licenses can be found in the file [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix) of the nixpkgs tree.
 
 ## Installing insecure packages {#sec-allow-insecure}
 

lib/sources.nix

@@ -43,7 +43,7 @@ let
   cleanSourceFilter =
     name: type:
     let
-      baseName = baseNameOf (toString name);
+      baseName = baseNameOf name;
     in
     !(
       # Filter out version control software files/directories
@@ -270,7 +270,7 @@ let
       filter =
         name: type:
         let
-          base = baseNameOf (toString name);
+          base = baseNameOf name;
         in
         type == "directory" || lib.any (ext: lib.hasSuffix ext base) exts;
     in

lib/systems/platforms.nix

@@ -152,11 +152,6 @@ rec {
       DTB = true;
       autoModules = true;
       preferBuiltin = true;
-      extraConfig = ''
-        # The default (=y) forces us to have the XHCI firmware available in initrd,
-        # which our initrd builder can't currently do easily.
-        USB_XHCI_TEGRA m
-      '';
       target = "Image";
     };
     gcc = {

maintainers/github-teams.json

@@ -2,10 +2,11 @@
   "acme": {
     "description": "Maintain ACME-related packages and modules.",
     "id": 3806126,
-    "maintainers": {},
+    "maintainers": {
+      "emilazy": 18535642
+    },
     "members": {
       "arianvp": 628387,
-      "emilazy": 18535642,
       "m1cr0man": 3044438
     },
     "name": "ACME"
@@ -71,11 +72,10 @@
     "description": "coordinates efforts towards bootstrappable builds (see https://bootstrappable.org/)",
     "id": 9141350,
     "maintainers": {
+      "philiptaron": 43863,
       "zeuner": 2545850
     },
-    "members": {
-      "philiptaron": 43863
-    },
+    "members": {},
     "name": "bootstrapping"
   },
   "categorization": {
@@ -176,6 +176,7 @@
     "description": "Improve Darwin-support across Nixpkgs and help maintainers without access to Darwin hardware. Apply to join through https://github.com/NixOS/nixpkgs/issues/323144 to keep the process transparent.",
     "id": 2385202,
     "maintainers": {
+      "emilazy": 18535642,
       "toonn": 1486805
     },
     "members": {
@@ -205,7 +206,6 @@
       "donn": 12652988,
       "dwt": 57199,
       "eclairevoyant": 848000,
-      "emilazy": 18535642,
       "ethancedwards8": 60861925,
       "fiddlerwoaroof": 808745,
       "fulsomenko": 14945057,
@@ -410,9 +410,7 @@
       "jtojnar": 705123
     },
     "members": {
-      "bobby285271": 20080233,
-      "dasj19": 7589338,
-      "hedning": 71978
+      "bobby285271": 20080233
     },
     "name": "GNOME"
   },
@@ -556,11 +554,12 @@
     "id": 9955829,
     "maintainers": {
       "RossComputerGuy": 19699320,
-      "alyssais": 2768870
+      "alyssais": 2768870,
+      "emilazy": 18535642
     },
     "members": {
       "Ericson2314": 1055245,
-      "emilazy": 18535642,
+      "peterwaller-arm": 52030119,
       "rrbutani": 7833358,
       "sternenseemann": 3154475
     },
@@ -695,8 +694,7 @@
     "description": "",
     "id": 174820,
     "maintainers": {
-      "Ericson2314": 1055245,
-      "tomberek": 178444
+      "Ericson2314": 1055245
     },
     "members": {
       "Mic92": 96200,
@@ -704,6 +702,7 @@
       "edolstra": 1148549,
       "lisanna-dettwyler": 72424138,
       "lovesegfault": 7243783,
+      "tomberek": 178444,
       "xokdvium": 145775305
     },
     "name": "Nix team"
@@ -852,15 +851,15 @@
     "description": "Team that is interested in reproducible builds",
     "id": 7625643,
     "maintainers": {
-      "raboof": 131856,
-      "zimbatm": 3248
+      "raboof": 131856
     },
     "members": {
       "Artturin": 56650223,
       "Atemu": 18599032,
       "RaitoBezarius": 314564,
       "davidak": 91113,
-      "mschwaig": 3856390
+      "mschwaig": 3856390,
+      "zimbatm": 3248
     },
     "name": "reproducible"
   },
@@ -964,13 +963,13 @@
     "description": "Maintain the standard environment and its surrounding logic.",
     "id": 11265412,
     "maintainers": {
-      "RossComputerGuy": 19699320
+      "RossComputerGuy": 19699320,
+      "emilazy": 18535642,
+      "philiptaron": 43863
     },
     "members": {
       "Artturin": 56650223,
       "Ericson2314": 1055245,
-      "emilazy": 18535642,
-      "philiptaron": 43863,
       "reckenrode": 7413633
     },
     "name": "stdenv"

maintainers/maintainer-list.nix

@@ -813,6 +813,13 @@
     githubId = 19290901;
     name = "Andrew Brooks";
   };
+  agentelement = {
+    email = "agentelement@agentelement.net";
+    github = "agentelement";
+    githubId = 38045210;
+    name = "AgentElement";
+    keys = [ { fingerprint = "D37E 581D AD71 2378 A622  5BC0 CD13 9E3B 4354 34F1"; } ];
+  };
   agilesteel = {
     email = "agilesteel@gmail.com";
     github = "agilesteel";
@@ -2319,6 +2326,12 @@
     githubId = 3965744;
     name = "Arthur Lee";
   };
+  arthurficial = {
+    email = "arti.ficial@fullstackoptimization.com";
+    github = "Arthur-Ficial";
+    githubId = 258112064;
+    name = "Arthur Ficial";
+  };
   arthurteisseire = {
     email = "arthurteisseire33@gmail.com";
     github = "arthurteisseire";
@@ -5150,6 +5163,13 @@
     githubId = 68239;
     name = "Christine Koppelt";
   };
+  ckruse = {
+    email = "cjk@defunct.ch";
+    github = "ckruse";
+    githubId = 175095;
+    name = "Christian Kruse";
+    keys = [ { fingerprint = "BC5D 9F4E F7FB 4382 6056  E834 B8E0 F342 A99A 9D73"; } ];
+  };
   clacke = {
     email = "claes.wallin@greatsinodevelopment.com";
     github = "clacke";
@@ -6679,6 +6699,12 @@
     githubId = 90097;
     name = "Derek Collison";
   };
+  DerGrumpf = {
+    email = "phil.keier@hotmail.com";
+    github = "DerGrumpf";
+    githubId = 17272572;
+    name = "Phil Keier";
+  };
   DerGuteMoritz = {
     email = "moritz@twoticketsplease.de";
     github = "DerGuteMoritz";
@@ -7938,6 +7964,11 @@
     githubId = 18375468;
     name = "Elliot Xu";
   };
+  elliotberman = {
+    name = "Elliot Berman";
+    github = "elliotberman";
+    githubId = 210410075;
+  };
   elliottslaughter = {
     name = "Elliott Slaughter";
     email = "elliottslaughter@gmail.com";
@@ -10656,6 +10687,11 @@
     githubId = 147689;
     name = "Hans-Christian Esperer";
   };
+  hchokshi = {
+    github = "hchokshi";
+    githubId = 10136407;
+    name = "Harsh Chokshi";
+  };
   hdhog = {
     name = "Serg Larchenko";
     email = "hdhog@hdhog.ru";
@@ -10669,12 +10705,6 @@
     githubId = 2427959;
     name = "Hector Jusforgues";
   };
-  hedning = {
-    email = "torhedinbronner@gmail.com";
-    github = "hedning";
-    githubId = 71978;
-    name = "Tor Hedin Brønner";
-  };
   heel = {
     email = "parizhskiy@gmail.com";
     github = "HeeL";
@@ -13511,6 +13541,12 @@
     githubId = 5352661;
     name = "James Cleverley-Prance";
   };
+  jpz13 = {
+    email = "jp@pipekit.io";
+    github = "JPZ13";
+    githubId = 6625432;
+    name = "J.P. Zivalich";
+  };
   jqueiroz = {
     email = "nixos@johnjq.com";
     github = "jqueiroz";
@@ -16532,6 +16568,11 @@
     github = "Macbucheron1";
     githubId = 95475157;
   };
+  mach = {
+    name = "Mach";
+    github = "MachXNU";
+    githubId = 42501418;
+  };
   macronova = {
     name = "Sicheng Pan";
     email = "trivial@invariantspace.com";
@@ -18488,6 +18529,11 @@
     githubId = 3579600;
     name = "Jacob Moody";
   };
+  mooses = {
+    name = "Remu Salminen";
+    github = "RemuSalminen";
+    githubId = 85031022;
+  };
   moosingin3space = {
     email = "moosingin3space@gmail.com";
     github = "moosingin3space";
@@ -19147,6 +19193,11 @@
     githubId = 1222539;
     name = "Roman Naumann";
   };
+  NanamiNakano = {
+    name = "Nanami Nakano";
+    github = "NanamiNakano";
+    githubId = 64841155;
+  };
   nanotwerp = {
     email = "nanotwerp@gmail.com";
     github = "nanotwerp";
@@ -20975,6 +21026,12 @@
     githubId = 5948762;
     name = "Berk Özkütük";
   };
+  ozturkkl = {
+    email = "97kemalozturk@gmail.com";
+    github = "ozturkkl";
+    githubId = 51798197;
+    name = "Kemal Ozturk";
+  };
   ozwaldorf = {
     email = "self@ossian.dev";
     github = "ozwaldorf";
@@ -23052,12 +23109,6 @@
     githubId = 7775707;
     name = "RB";
   };
-  rb2k = {
-    email = "nix@marc-seeger.com";
-    github = "rb2k";
-    githubId = 9519;
-    name = "Marc Seeger";
-  };
   rbasso = {
     email = "rbasso@sharpgeeks.net";
     github = "rbasso";
@@ -23315,6 +23366,11 @@
     github = "Reputable2772";
     githubId = 153411261;
   };
+  ReStranger = {
+    name = "ReStranger";
+    github = "ReStranger";
+    githubId = 69393944;
+  };
   ret2pop = {
     email = "ret2pop@gmail.com";
     github = "ret2pop";
@@ -25321,7 +25377,7 @@
   shelvacu = {
     name = "Shelvacu";
     email = "nix-maint@shelvacu.com";
-    matrix = "@s:consortium.chat";
+    matrix = "@s:sv.mt";
     github = "shelvacu";
     githubId = 1731537;
   };
@@ -25416,13 +25472,6 @@
     githubId = 819413;
     name = "Benedict Aas";
   };
-  shreerammodi = {
-    name = "Shreeram Modi";
-    email = "shreerammodi10@gmail.com";
-    github = "shreerammodi";
-    githubId = 67710369;
-    keys = [ { fingerprint = "EA88 EA07 26E9 6CBF 6365  3966 163B 16EE 76ED 24CE"; } ];
-  };
   shunueda = {
     name = "Shun Ueda";
     github = "shunueda";
@@ -27014,6 +27063,12 @@
     githubId = 6064962;
     name = "TakWolf";
   };
+  talal = {
+    email = "noreply@talal.ch";
+    github = "talal";
+    githubId = 3526562;
+    name = "Muhammad Talal Anwar";
+  };
   talhaHavadar = {
     email = "havadartalha@gmail.com";
     github = "talhaHavadar";
@@ -27814,6 +27869,12 @@
     github = "tie";
     githubId = 14792994;
   };
+  tiebe = {
+    name = "Tiebe Groosman";
+    email = "tiebe@groosman.nl";
+    github = "Tiebe";
+    githubId = 9307389;
+  };
   tiferrei = {
     name = "Tiago Ferreira";
     email = "me@tiferrei.com";
@@ -30124,6 +30185,12 @@
     githubId = 36407913;
     name = "Uli Baum";
   };
+  xelacodes = {
+    name = "Alex";
+    github = "itzTheMeow";
+    githubId = 50887230;
+    email = "nixpkgs@xela.codes";
+  };
   xelden = {
     email = "anpiz@protonmail.com";
     github = "Xelden";

maintainers/scripts/luarocks-packages.csv

@@ -12,6 +12,7 @@ cassowary,,,,,,alerque
 cldr,,,,,,alerque
 commons.nvim,,,,,5.1,mrcjkb
 compat53,,,,,,vcunat
+coop.nvim,,,,,,
 cosmo,,,,,,
 coxpcall,,,,1.17.0-1,,
 cqueues,,,,,,vcunat
@@ -53,8 +54,8 @@ lrexlib-pcre2,,,,,,wishstudio
 lrexlib-posix,,,,,,
 lsp-progress.nvim,,,,,5.1,gepbird
 lsqlite3,,,,,,
-ltreesitter-ts,,,,,,
 ltreesitter,,,,,,
+ltreesitter-ts,,,,,,
 lua-cjson,,,,,,
 lua-cmsgpack,,,,,,
 lua-curl,,,,,,
@@ -174,8 +175,8 @@ tree-sitter-http,,,,0.0.33-1,,
 tree-sitter-norg,,,,,5.1,mrcjkb
 tree-sitter-norg-meta,,,,,,
 tree-sitter-orgmode,,,,,5.1,
-utf8,,,,,,
 tree-sitter-teal,,,,,,
+utf8,,,,,,
 vicious,,,,,,
 vstruct,,,,,,
 vusted,,,,,,

nixos/doc/manual/redirects.json

@@ -65,6 +65,42 @@
   "module-services-keycloak-unix-socket": [
     "index.html#module-services-keycloak-unix-socket"
   ],
+  "module-services-mautrix-discord": [
+    "index.html#module-services-mautrix-discord"
+  ],
+  "module-services-mautrix-discord-advanced": [
+    "index.html#module-services-mautrix-discord-advanced"
+  ],
+  "module-services-mautrix-discord-authentication": [
+    "index.html#module-services-mautrix-discord-authentication"
+  ],
+  "module-services-mautrix-discord-backfill": [
+    "index.html#module-services-mautrix-discord-backfill"
+  ],
+  "module-services-mautrix-discord-basic-example": [
+    "index.html#module-services-mautrix-discord-basic-example"
+  ],
+  "module-services-mautrix-discord-basic-usage": [
+    "index.html#module-services-mautrix-discord-basic-usage"
+  ],
+  "module-services-mautrix-discord-double-puppet": [
+    "index.html#module-services-mautrix-discord-double-puppet"
+  ],
+  "module-services-mautrix-discord-encryption": [
+    "index.html#module-services-mautrix-discord-encryption"
+  ],
+  "module-services-mautrix-discord-server-defaults": [
+    "index.html#module-services-mautrix-discord-server-defaults"
+  ],
+  "module-services-mautrix-discord-setup": [
+    "index.html#module-services-mautrix-discord-setup"
+  ],
+  "module-services-mautrix-discord-synapse": [
+    "index.html#module-services-mautrix-discord-synapse"
+  ],
+  "module-services-mautrix-discord-troubleshooting": [
+    "index.html#module-services-mautrix-discord-troubleshooting"
+  ],
   "module-services-tandoor-recipes-migrating-media-option-move": [
     "index.html#module-services-tandoor-recipes-migrating-media-option-move",
     "index.html#module-services-tandoor-recipes-migrating-media-option-1"

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -130,6 +130,8 @@
 
 - [linkding](https://linkding.link/), a self-hosted bookmark manager designed to be minimal, fast, and easy to set up. Available as [services.linkding](#opt-services.linkding.enable).
 
+- [gs1200-exporter](https://github.com/robinelfrink/gs1200-exporter), a Prometheus exporter for Zyxel GS1200 series switches. Available as [services.gs1200-exporter](#opt-services.gs1200-exporter.enable).
+
 - [Tinyauth](https://tinyauth.app/), a simple authentication middleware for web apps, with OAuth and LDAP support. Available as [services.tinyauth](#opt-services.tinyauth.enable).
 
 - [Strichliste](https://www.strichliste.org), a digital self-service tallysheet used in hackerspaces, clubs and offices. Available as [services.strichliste](#opt-services.strichliste.enable).

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -22,10 +22,16 @@
 
 - Support for the legacy U‐Boot image format has been removed from the initrd generators, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
 
+- `services.llama-cpp` is now configured using structured `services.llama-cpp.settings` attribute.
+
 - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
 
+- `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
+
 - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.
 
+- `services.firezone.server.provision` has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/lib/testing/driver.nix

@@ -14,7 +14,7 @@ let
 
   inherit (config) sshBackdoor;
 
-  inherit (hostPkgs.stdenv.hostPlatform) isLinux;
+  inherit (hostPkgs.stdenv.hostPlatform) isLinux isAarch64;
 
   # Reifies and correctly wraps the python test driver for
   # the respective qemu version and with or without ocr support
@@ -256,6 +256,10 @@ in
         #
         # If needed, this can still be turned off.
         virtualisation.qemu.enableSharedMemory = lib.mkDefault isLinux;
+        # Needed for screenshots to work (in e.g `nixosTests.login`)
+        virtualisation.qemu.options = lib.optionals (isLinux && isAarch64) [
+          "-device virtio-gpu-pci"
+        ];
 
         assertions = [
           {

nixos/modules/config/users-groups.nix

@@ -950,32 +950,8 @@ in
         };
       };
 
-      # Warn about user accounts with deprecated password hashing schemes
-      # This does not work when the users and groups are created by
-      # systemd-sysusers because the users are created too late then.
-      system.activationScripts.hashes =
-        if !config.systemd.sysusers.enable && !config.services.userborn.enable then
-          {
-            deps = [ "users" ];
-            text = ''
-              users=()
-              while IFS=: read -r user hash _; do
-                if [[ "$hash" = "$"* && ! "$hash" =~ ^\''$${cryptSchemeIdPatternGroup}\$ ]]; then
-                  users+=("$user")
-                fi
-              done </etc/shadow
-
-              if (( "''${#users[@]}" )); then
-                echo "
-              WARNING: The following user accounts rely on password hashing algorithms
-              that have been removed. They need to be renewed as soon as possible, as
-              they do prevent their users from logging in."
-                printf ' - %s\n' "''${users[@]}"
-              fi
-            '';
-          }
-        else
-          ""; # keep around for backwards compatibility
+      # for backwards compatibility
+      system.activationScripts.hashes = stringAfter [ "users" ] "";
 
       # for backwards compatibility
       system.activationScripts.groups = stringAfter [ "users" ] "";

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma6.nix

@@ -21,11 +21,6 @@
     };
   };
 
-  environment.systemPackages = [
-    # provide onscreen keyboard
-    pkgs.kdePackages.plasma-keyboard
-  ];
-
   environment.plasma6.excludePackages = [
     # Optional wallpapers that add 126 MiB to the graphical installer
     # closure. They will still need to be downloaded when installing a

nixos/modules/module-list.nix

@@ -245,6 +245,7 @@
   ./programs/iio-hyprland.nix
   ./programs/immersed.nix
   ./programs/iotop.nix
+  ./programs/jai-jail.nix
   ./programs/java.nix
   ./programs/joycond-cemuhook.nix
   ./programs/k3b.nix
@@ -668,6 +669,7 @@
   ./services/hardware/dell-bios-fan-control.nix
   ./services/hardware/display.nix
   ./services/hardware/fancontrol.nix
+  ./services/hardware/framework-control.nix
   ./services/hardware/freefall.nix
   ./services/hardware/fwupd.nix
   ./services/hardware/g810-led.nix
@@ -1032,6 +1034,7 @@
   ./services/monitoring/grafana-to-ntfy.nix
   ./services/monitoring/grafana.nix
   ./services/monitoring/graphite.nix
+  ./services/monitoring/gs1200-exporter.nix
   ./services/monitoring/hdaps.nix
   ./services/monitoring/heapster.nix
   ./services/monitoring/incron.nix

nixos/modules/programs/jai-jail.nix

@@ -0,0 +1,45 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.jai-jail;
+
+in
+{
+  options.programs.jai-jail = {
+    enable = lib.mkEnableOption "jai, a sandbox for AI agents";
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.jai-jail;
+      defaultText = lib.literalExpression "pkgs.jai-jail";
+      description = "The jai package to use.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    security.wrappers.jai = {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${cfg.package}/bin/jai";
+    };
+
+    users.users.jai = {
+      isSystemUser = true;
+      group = "jai";
+      home = "/";
+      description = "JAI sandbox untrusted user";
+    };
+
+    users.groups.jai = { };
+
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ agentelement ];
+}

nixos/modules/services/computing/boinc/client.nix

@@ -50,7 +50,7 @@ in
         only the hosts listed in {var}`dataDir`/remote_hosts.cfg will be allowed to
         connect.
 
-        See also: <https://boinc.berkeley.edu/wiki/Controlling_BOINC_remotely#Remote_access>
+        See also: <https://github.com/BOINC/boinc/wiki/Controlling_BOINC_remotely#remote-access>
       '';
     };
 

nixos/modules/services/desktop-managers/pantheon.nix

@@ -276,8 +276,7 @@ in
         ++ (with pkgs.pantheon; [
           elementary-files
           elementary-settings-daemon
-          # https://github.com/elementary/portals/issues/157
-          # xdg-desktop-portal-pantheon
+          xdg-desktop-portal-pantheon
         ])
       ) config.environment.pantheon.excludePackages;
 

nixos/modules/services/desktop-managers/plasma6.nix

@@ -169,6 +169,9 @@ in
           krdp
           kconfig # required for xdg-terminal from xdg-utils
           qtbase # for qtpaths which is required for xdg-mime from xdg-utils
+          # touch keyboard
+          plasma-keyboard
+          qtvirtualkeyboard # used by plasma-keyboard KCM
         ]
         ++ lib.optional config.networking.networkmanager.enable qrca
         ++ lib.optionals config.hardware.sensor.iio.enable [

nixos/modules/services/hardware/framework-control.nix

@@ -0,0 +1,48 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.framework-control;
+in
+{
+  meta.maintainers = [ lib.maintainers.ozturkkl ];
+
+  options.services.framework-control = {
+    enable = lib.mkEnableOption "Framework Control device hardware service";
+    package = lib.mkPackageOption pkgs "framework-control" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.framework-control = {
+      description = "Framework Control Service";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      # framework-control shells out to framework_tool at runtime for hardware access
+      path = [ pkgs.framework-tool ];
+
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = lib.getExe cfg.package;
+        Restart = "on-failure";
+        RestartSec = "5s";
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        LockPersonality = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        SystemCallArchitectures = "native";
+      };
+    };
+  };
+}

nixos/modules/services/hardware/fwupd.nix

@@ -35,7 +35,7 @@ let
     lib.listToAttrs (map mkEtcFile cfg.package.filesInstalledToEtc);
   extraTrustedKeys =
     let
-      mkName = p: "pki/fwupd/${baseNameOf (toString p)}";
+      mkName = p: "pki/fwupd/${baseNameOf p}";
       mkEtcFile = p: lib.nameValuePair (mkName p) { source = p; };
     in
     lib.listToAttrs (map mkEtcFile cfg.extraTrustedKeys);
@@ -202,8 +202,8 @@ in
     systemd = {
       packages = [ cfg.package ];
 
-      # fwupd-refresh expects a user that we do not create, so just run with DynamicUser
-      # instead and ensure we take ownership of /var/lib/fwupd
+      # The upstream unit runs as User=fwupd-refresh; ensure it can take
+      # ownership of /var/lib/fwupd.
       services.fwupd-refresh.serviceConfig = {
         StateDirectory = "fwupd";
         # Better for debugging, upstream sets stderr to null for some reason..
@@ -219,7 +219,21 @@ in
     };
     users.groups.fwupd-refresh = { };
 
-    security.polkit.enable = true;
+    security.polkit = {
+      enable = true;
+      # fwupd-refresh.service has no seat, so polkit denies these actions.
+      # Upstream's TrustedUids needs a static uid which we only allocate at
+      # activation time, so grant access via a rule on the user name instead.
+      extraConfig = ''
+        polkit.addRule(function(action, subject) {
+          if ((action.id == "org.freedesktop.fwupd.get-remotes" ||
+               action.id == "org.freedesktop.fwupd.refresh-remote") &&
+              subject.user == "fwupd-refresh") {
+            return polkit.Result.YES;
+          }
+        });
+      '';
+    };
   };
 
   meta = {

nixos/modules/services/hardware/scanservjs.nix

@@ -125,6 +125,12 @@ in
     };
     users.groups.scanservjs = { };
 
+    systemd.tmpfiles.rules = [
+      "d ${cfg.stateDir}/data 0755 scanservjs scanservjs - -"
+      "d ${cfg.stateDir}/data/preview 0755 scanservjs scanservjs - -"
+      "L+ ${cfg.stateDir}/data/preview/default.jpg - - - - ${package}/lib/data/preview/default.jpg"
+    ];
+
     systemd.services.scanservjs = {
       description = "scanservjs";
       after = [ "network.target" ];

nixos/modules/services/home-automation/home-assistant.nix

@@ -864,12 +864,19 @@ in
 
     networking.firewall.allowedTCPPorts = mkMerge [
       (mkIf cfg.openFirewall [ cfg.config.http.server_port ])
-      (mkIf cfg.openFirewallForComponents
+      (mkIf cfg.openFirewallForComponents (
+        # https://www.home-assistant.io/integrations/homekit/#firewall
+        optionals (useComponent "homekit") [ 21063 ]
         # https://www.home-assistant.io/integrations/sonos/#network-requirements
-        (optionals (useComponent "sonos") [ 1400 ])
-      )
+        ++ optionals (useComponent "sonos") [ 1400 ]
+      ))
     ];
 
+    networking.firewall.allowedUDPPorts = mkIf cfg.openFirewallForComponents (
+      # https://www.home-assistant.io/integrations/homekit/#firewall
+      optionals (useComponent "homekit") [ 5353 ]
+    );
+
     # symlink the configuration to /etc/home-assistant
     environment.etc = mkMerge [
       (mkIf (cfg.config != null && !cfg.configWritable) {

nixos/modules/services/home-automation/matterjs-server.nix

@@ -123,5 +123,8 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ kranzes ];
+  meta.maintainers = with lib.maintainers; [
+    kranzes
+    marie
+  ];
 }

nixos/modules/services/home-automation/openthread-border-router.nix

@@ -203,15 +203,6 @@ in
       ]) cfg.backboneInterfaces
     );
 
-    # OTBR uses avahi for mDNS service publishing
-    services.avahi = {
-      enable = lib.mkDefault true;
-      publish = {
-        enable = lib.mkDefault true;
-        userServices = lib.mkDefault true;
-      };
-    };
-
     # The upstream service files (src/agent/otbr-agent.service.in, src/web/otbr-web.service.in) use
     # EnvironmentFile and CMake-substituted platform scripts that don't translate to NixOS, so the
     # services are rebuilt here from typed module options instead.

nixos/modules/services/mail/stalwart.nix

@@ -304,7 +304,6 @@ in
   meta = {
     maintainers = with lib.maintainers; [
       happysalada
-      euxane
       onny
       norpol
     ];

nixos/modules/services/matrix/mautrix-discord.md

@@ -0,0 +1,156 @@
+# Mautrix-Discord {#module-services-mautrix-discord}
+
+*Source:* {file}`modules/services/matrix/mautrix-discord`
+
+*Upstream documentation:* <https://docs.mau.fi/bridges/go/discord/index.html>
+
+[Mautrix-Discord](https://github.com/mautrix/discord) is a Matrix-Discord bridge.
+
+## Basic Usage {#module-services-mautrix-discord-basic-usage}
+
+The common setup is to enable the bridge, point it at your homeserver, and set the permissions you want to allow:
+
+1. Set `services.mautrix-discord.enable` to `true`.
+2. Set `services.mautrix-discord.settings.homeserver.address` and `services.mautrix-discord.settings.homeserver.domain`.
+3. Override `services.mautrix-discord.settings.bridge.permissions` if the default relay permissions do not fit your deployment.
+
+The module provides sensible defaults for the appservice listener, registration tokens, and relay permissions.
+
+### Basic Example {#module-services-mautrix-discord-basic-example}
+
+```nix
+{
+  services.mautrix-discord = {
+    enable = true;
+    registerToSynapse = true;
+    settings = {
+      homeserver = {
+        address = "http://localhost:8008";
+        domain = "example.com";
+      };
+      bridge.permissions = {
+        "example.com" = "user";
+        "@admin:example.com" = "admin";
+      };
+    };
+  };
+}
+```
+
+### Server Defaults {#module-services-mautrix-discord-server-defaults}
+
+By default, the bridge listens on `http://localhost:29334` and generates its appservice tokens automatically.
+
+## Authentication {#module-services-mautrix-discord-authentication}
+
+If you want to store the bridge database outside the default SQLite file, set `settings.appservice.database` to use PostgreSQL instead of SQLite:
+
+```nix
+{
+  services.mautrix-discord.settings.appservice.database = {
+    type = "postgres";
+    uri = "postgresql:///mautrix-discord?host=/run/postgresql";
+  };
+}
+```
+
+If the connection needs a password, combine it with `services.mautrix-discord.environmentFile`:
+
+```nix
+{
+  services.mautrix-discord = {
+    environmentFile = "/run/secrets/mautrix-discord-env";
+    settings.appservice.database.uri = "postgresql://mautrix:$DB_PASSWORD@localhost/mautrix-discord";
+  };
+}
+```
+
+Use `services.mautrix-discord.environmentFile` for any secret you do not want in the Nix store.
+This includes database passwords, shared secrets, and similar values.
+
+Example:
+
+```nix
+{
+  services.mautrix-discord = {
+    environmentFile = "/run/secrets/mautrix-discord-env";
+    settings.bridge.login_shared_secret_map = {
+      "example.com" = "$SHARED_SECRET";
+    };
+  };
+}
+```
+
+## Bridge Setup {#module-services-mautrix-discord-setup}
+
+After the service starts, open a chat with `@discordbot:example.com`, send `login`, and follow the instructions to link your Discord account.
+
+For more detail, see the [Mautrix-Discord documentation](https://docs.mau.fi/bridges/go/discord/index.html).
+
+## Advanced Configuration {#module-services-mautrix-discord-advanced}
+
+The upstream default configuration is available at [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml). To print the generated default configuration from the package, run:
+
+```bash
+nix-shell -p mautrix-discord --run "mautrix-discord -e"
+```
+
+### Encryption {#module-services-mautrix-discord-encryption}
+
+```nix
+{
+  services.mautrix-discord.settings.bridge.encryption = {
+    allow = true;
+    default = true;
+    require = false;
+  };
+}
+```
+
+Encryption needs additional bridge-side setup. See the [bridge encryption documentation](https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html) for details.
+
+### Backfill {#module-services-mautrix-discord-backfill}
+
+```nix
+{
+  services.mautrix-discord.settings.bridge.backfill.forward_limits.initial = {
+    dm = 50;
+    channel = 50;
+    thread = 50;
+  };
+}
+```
+
+### Double Puppeting {#module-services-mautrix-discord-double-puppet}
+
+```nix
+{
+  services.mautrix-discord = {
+    environmentFile = "/run/secrets/mautrix-discord-env";
+    settings.bridge.login_shared_secret_map = {
+      "example.com" = "$SHARED_SECRET";
+    };
+  };
+}
+```
+where  `/run/secrets/mautrix-discord-env` contains
+```
+SHARED_SECRET=aProtectedSecret
+```
+
+## Synapse Integration {#module-services-mautrix-discord-synapse}
+
+When `services.mautrix-discord.registerToSynapse` is `true`, the bridge writes its registration file automatically and Synapse picks it up.
+
+If Synapse is enabled, this option defaults to `true`.
+
+## Troubleshooting {#module-services-mautrix-discord-troubleshooting}
+
+- View logs with `journalctl -u mautrix-discord.service -f`.
+- Check `systemctl status mautrix-discord` if the bridge does not start.
+- Verify the homeserver can reach the configured appservice address.
+- Ensure the registration file exists and Synapse can read it.
+
+For more help, see the
+[Mautrix-Discord documentation](https://docs.mau.fi/bridges/go/discord/index.html)
+or the support room at [#discord:maunium.net](https://matrix.to/#/#discord:maunium.net).

nixos/modules/services/matrix/mautrix-discord.nix

@@ -5,15 +5,59 @@
   ...
 }:
 let
+  defaultDataDir = "/var/lib/mautrix-discord";
   cfg = config.services.mautrix-discord;
   dataDir = cfg.dataDir;
   format = pkgs.formats.yaml { };
+  serviceDependencies = [
+    "mautrix-discord-registration.service"
+  ]
+  ++ (lib.lists.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)
+  ++ (lib.lists.optional config.services.matrix-conduit.enable "matrix-conduit.service")
+  ++ (lib.lists.optional config.services.dendrite.enable "dendrite.service");
 
   registrationFile = "${dataDir}/discord-registration.yaml";
 
   settingsFile = "${dataDir}/config.yaml";
   settingsFileUnformatted = format.generate "discord-config-unsubstituted.yaml" cfg.settings;
   default_token = "This value is generated when generating the registration";
+  settingsDefault = {
+    homeserver = {
+      address = "";
+      domain = "";
+    };
+
+    appservice = {
+      address = "http://localhost:29334";
+      hostname = "0.0.0.0";
+      port = 29334;
+      database = {
+        type = "sqlite3";
+        uri = "file:${defaultDataDir}/mautrix-discord.db?_txlock=immediate";
+      };
+      id = "discord";
+      bot = {
+        username = "discordbot";
+        displayname = "Discord bridge bot";
+        avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
+      };
+      as_token = default_token;
+      hs_token = default_token;
+    };
+
+    bridge.permissions."*" = "relay";
+
+    logging = {
+      min_level = "info";
+      writers = [
+        {
+          type = "stdout";
+          format = "pretty-colored";
+          time_format = " ";
+        }
+      ];
+    };
+  };
 in
 {
   options = {
@@ -23,238 +67,14 @@ in
       package = lib.mkPackageOption pkgs "mautrix-discord" { };
 
       settings = lib.mkOption {
-        type = lib.types.submodule {
-          freeformType = format.type;
-
-          config = {
-            _module.args = { inherit cfg lib; };
-          };
-
-          options = {
-            homeserver = lib.mkOption {
-              type = lib.types.attrs;
-              default = {
-                software = "standard";
-                status_endpoint = null;
-                message_send_checkpoint_endpoint = null;
-                async_media = false;
-                websocket = false;
-                ping_interval_seconds = 0;
-              };
-              description = ''
-                fullDataDiration.
-                                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
-                                for more information.
-              '';
-            };
-
-            appservice = lib.mkOption {
-              type = lib.types.attrs;
-              default = {
-                address = "http://localhost:29334";
-                hostname = "0.0.0.0";
-                port = 29334;
-                database = {
-                  type = "sqlite3";
-                  uri = "file:/var/lib/mautrix-discord/mautrix-discord.db?_txlock=immediate";
-                  max_open_conns = 20;
-                  max_idle_conns = 2;
-                  max_conn_idle_time = null;
-                  max_conn_lifetime = null;
-                };
-                id = "discord";
-                bot = {
-                  username = "discordbot";
-                  displayname = "Discord bridge bot";
-                  avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
-                };
-                ephemeral_events = true;
-                async_transactions = false;
-                as_token = "This value is generated when generating the registration";
-                hs_token = "This value is generated when generating the registration";
-              };
-              defaultText = lib.literalExpression ''
-                {
-                  address = "http://localhost:29334";
-                  hostname = "0.0.0.0";
-                  port = 29334;
-                  database = {
-                    type = "sqlite3";
-                    uri = "file:''${config.services.mautrix-discord.dataDir}/mautrix-discord.db?_txlock=immediate";
-                    max_open_conns = 20;
-                    max_idle_conns = 2;
-                    max_conn_idle_time = null;
-                    max_conn_lifetime = null;
-                  };
-                  id = "discord";
-                  bot = {
-                    username = "discordbot";
-                    displayname = "Discord bridge bot";
-                    avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
-                  };
-                  ephemeral_events = true;
-                  async_transactions = false;
-                  as_token = "This value is generated when generating the registration";
-                  hs_token = "This value is generated when generating the registration";
-                }
-              '';
-              description = ''
-                Appservice configuration.
-                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
-                for more information.
-              '';
-            };
-
-            bridge = lib.mkOption {
-              type = lib.types.attrs;
-              default = {
-                username_template = "discord_{{.}}";
-                displayname_template = "{{if .Webhook}}Webhook{{else}}{{or .GlobalName .Username}}{{if .Bot}} (bot){{end}}{{end}}";
-                channel_name_template = "{{if or (eq .Type 3) (eq .Type 4)}}{{.Name}}{{else}}#{{.Name}}{{end}}";
-                guild_name_template = "{{.Name}}";
-                private_chat_portal_meta = "default";
-                public_address = null;
-                avatar_proxy_key = "generate";
-                portal_message_buffer = 128;
-                startup_private_channel_create_limit = 5;
-                delivery_receipts = false;
-                message_status_events = false;
-                message_error_notices = true;
-                restricted_rooms = true;
-                autojoin_thread_on_open = true;
-                embed_fields_as_tables = true;
-                mute_channels_on_create = false;
-                sync_direct_chat_list = false;
-                resend_bridge_info = false;
-                custom_emoji_reactions = true;
-                delete_portal_on_channel_delete = false;
-                delete_guild_on_leave = true;
-                federate_rooms = true;
-                prefix_webhook_messages = true;
-                enable_webhook_avatars = false;
-                use_discord_cdn_upload = true;
-                #proxy =
-                cache_media = "unencrypted";
-                direct_media = {
-                  enabled = false;
-                  #server_name = "discord-media.example.com";
-                  #well_known_response =
-                  allow_proxy = true;
-                  server_key = "generate";
-                };
-                animated_sticker = {
-                  target = "webp";
-                  args = {
-                    width = 320;
-                    height = 320;
-                    fps = 25;
-                  };
-                };
-                double_puppet_server_map = {
-                  #"example.com" = "https://example.com";
-                };
-                double_puppet_allow_discovery = false;
-                login_shared_secret_map = {
-                  #"example.com" = "foobar";
-                };
-                command_prefix = "!discord";
-                management_room_text = {
-                  welcome = "Hello, I'm a Discord bridge bot.";
-                  welcome_connected = "Use `help` for help.";
-                  welcome_unconnected = "Use `help` for help or `login` to log in.";
-                  additional_help = "";
-                };
-                backfill = {
-                  forward_limits = {
-                    initial = {
-                      dm = 0;
-                      channel = 0;
-                      thread = 0;
-                    };
-                    missed = {
-                      dm = 0;
-                      channel = 0;
-                      thread = 0;
-                    };
-                    max_guild_members = -1;
-                  };
-                };
-                encryption = {
-                  allow = false;
-                  default = false;
-                  appservice = false;
-                  msc4190 = false;
-                  require = false;
-                  allow_key_sharing = false;
-                  plaintext_mentions = false;
-                  delete_keys = {
-                    delete_outbound_on_ack = false;
-                    dont_store_outbound = false;
-                    ratchet_on_decrypt = false;
-                    delete_fully_used_on_decrypt = false;
-                    delete_prev_on_new_session = false;
-                    delete_on_device_delete = false;
-                    periodically_delete_expired = false;
-                    delete_outdated_inbound = false;
-                  };
-                  verification_levels = {
-                    receive = "unverified";
-                    send = "unverified";
-                    share = "cross-signed-tofu";
-                  };
-                  rotation = {
-                    enable_custom = false;
-                    milliseconds = 604800000;
-                    messages = 100;
-                    disable_device_change_key_rotation = false;
-                  };
-                };
-                provisioning = {
-                  prefix = "/_matrix/provision";
-                  shared_secret = "generate";
-                  debug_endpoints = false;
-                };
-                permissions = {
-                  "*" = "relay";
-                  #"example.com" = "user";
-                  #"@admin:example.com": "admin";
-                };
-              };
-              description = ''
-                Bridge configuration.
-                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
-                for more information.
-              '';
-            };
-            logging = lib.mkOption {
-              type = lib.types.attrs;
-              default = {
-                min_level = "info";
-                writers = lib.singleton {
-                  type = "stdout";
-                  format = "pretty-colored";
-                  time_format = " ";
-                };
-              };
-              description = ''
-                Logging configuration.
-                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
-                for more information.
-              '';
-            };
-          };
-        };
-        default = { };
+        apply = lib.recursiveUpdate settingsDefault;
+        type = format.type;
+        default = settingsDefault;
         example = lib.literalExpression ''
           {
             homeserver = {
               address = "http://localhost:8008";
-              domain = "public-domain.tld";
-            };
-
-            appservice.public = {
-              prefix = "/public";
-              external = "https://public-appservice-address/public";
+              domain = "example.com";
             };
 
             bridge.permissions = {
@@ -265,8 +85,12 @@ in
         '';
         description = ''
           {file}`config.yaml` configuration as a Nix attribute set.
+
           Configuration options should match those described in
           [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml).
+
+          Secret tokens should be specified using {option}`environmentFile`
+          instead of this world-readable attribute set.
         '';
       };
 
@@ -282,12 +106,9 @@ in
 
       dataDir = lib.mkOption {
         type = lib.types.path;
-        default = "/var/lib/mautrix-discord";
-        defaultText = "/var/lib/mautrix-discord";
-        description = ''
-          Directory to store the bridge's configuration and database files.
-          This directory will be created if it does not exist.
-        '';
+        default = defaultDataDir;
+        defaultText = defaultDataDir;
+        description = "Directory to store the bridge's data.";
       };
 
       # TODO: Get upstream to add an environment File option. Refer to https://github.com/NixOS/nixpkgs/pull/404871#issuecomment-2895663652 and https://github.com/mautrix/discord/issues/187
@@ -295,92 +116,31 @@ in
         type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
-          File containing environment variables to substitute when copying the configuration
-          out of Nix store to the `services.mautrix-discord.dataDir`.
-          Can be used for storing the secrets without making them available in the Nix store.
-          For example, you can set `services.mautrix-discord.settings.appservice.as_token = "$MAUTRIX_DISCORD_APPSERVICE_AS_TOKEN"`
-          and then specify `MAUTRIX_DISCORD_APPSERVICE_AS_TOKEN="{token}"` in the environment file.
-          This value will get substituted into the configuration file as a token.
+          File containing environment variables for secret substitution.
+          Variables in the config like `$VARIABLE` will be replaced.
         '';
       };
 
-      serviceUnit = lib.mkOption {
-        type = lib.types.str;
-        readOnly = true;
-        default = "mautrix-discord.service";
-        description = ''
-          The systemd unit (a service or a target) for other services to depend on if they
-          need to be started after matrix-synapse.
-          This option is useful as the actual parent unit for all matrix-synapse processes
-          changes when configuring workers.
-        '';
-      };
-
-      registrationServiceUnit = lib.mkOption {
-        type = lib.types.str;
-        readOnly = true;
-        default = "mautrix-discord-registration.service";
-        description = ''
-          The registration service that generates the registration file.
-          Systemd unit (a service or a target) for other services to depend on if they
-          need to be started after mautrix-discord registration service.
-          This option is useful as the actual parent unit for all matrix-synapse processes
-          changes when configuring workers.
-        '';
-      };
-
-      serviceDependencies = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [
-          cfg.registrationServiceUnit
-        ]
-        ++ (lib.lists.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)
-        ++ (lib.lists.optional config.services.matrix-conduit.enable "matrix-conduit.service")
-        ++ (lib.lists.optional config.services.dendrite.enable "dendrite.service");
-
-        defaultText = ''
-          [ cfg.registrationServiceUnit ] ++
-          (lib.lists.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit) ++
-          (lib.lists.optional config.services.matrix-conduit.enable "matrix-conduit.service") ++
-          (lib.lists.optional config.services.dendrite.enable "dendrite.service");
-        '';
-        description = ''
-          List of Systemd services to require and wait for when starting the application service.
-        '';
-      };
     };
   };
   config = lib.mkIf cfg.enable {
+
     assertions = [
       {
         assertion =
-          cfg.settings.homeserver.domain or "" != "" && cfg.settings.homeserver.address or "" != "";
-        message = ''
-          The options with information about the homeserver:
-          `services.mautrix-discord.settings.homeserver.domain` and
-          `services.mautrix-discord.settings.homeserver.address` have to be set.
-        '';
-      }
-      {
-        assertion = cfg.settings.bridge.permissions or { } != { };
-        message = ''
-          The option `services.mautrix-discord.settings.bridge.permissions` has to be set.
-        '';
+          cfg.settings.homeserver.address or "" != "" && cfg.settings.homeserver.domain or "" != "";
+        message = "services.mautrix-discord.settings.homeserver.{address,domain} must be set.";
       }
     ];
 
     users.users.mautrix-discord = {
       isSystemUser = true;
       group = "mautrix-discord";
-      extraGroups = [ "mautrix-discord-registration" ];
       home = dataDir;
       description = "Mautrix-Discord bridge user";
     };
 
     users.groups.mautrix-discord = { };
-    users.groups.mautrix-discord-registration = {
-      members = lib.lists.optional config.services.matrix-synapse.enable "matrix-synapse";
-    };
 
     services.matrix-synapse = lib.mkIf cfg.registerToSynapse {
       settings.app_service_config_files = [ registrationFile ];
@@ -392,7 +152,9 @@ in
 
     systemd.services = {
       matrix-synapse = lib.mkIf cfg.registerToSynapse {
-        serviceConfig.SupplementaryGroups = [ "mautrix-discord-registration" ];
+        serviceConfig.SupplementaryGroups = [
+          "mautrix-discord"
+        ];
         # Make synapse depend on the registration service when auto-registering
         wants = [ "mautrix-discord-registration.service" ];
         after = [ "mautrix-discord-registration.service" ];
@@ -471,15 +233,18 @@ in
             '${settingsFile}' '${registrationFile}' > '${registrationFile}.tmp'
           mv '${registrationFile}.tmp' '${registrationFile}'
 
+          # Application services should not be rate limited by default.
+          yq -Y '.rate_limited = false' '${registrationFile}' > '${registrationFile}.tmp'
+          mv '${registrationFile}.tmp' '${registrationFile}'
+
           umask $old_umask
-          chown :mautrix-discord-registration '${registrationFile}'
           chmod 640 '${registrationFile}'
         '';
 
         serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;
-          UMask = 27;
+          UMask = "027";
 
           User = "mautrix-discord";
           Group = "mautrix-discord";
@@ -501,8 +266,8 @@ in
         description = "Mautrix-Discord, a Matrix-Discord puppeting/relaybot bridge";
 
         wantedBy = [ "multi-user.target" ];
-        wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
-        after = [ "network-online.target" ] ++ cfg.serviceDependencies;
+        wants = [ "network-online.target" ] ++ serviceDependencies;
+        after = [ "network-online.target" ] ++ serviceDependencies;
         path = [
           pkgs.lottieconverter
           pkgs.ffmpeg-headless
@@ -536,6 +301,8 @@ in
           ProtectHostname = true;
           ProtectClock = true;
 
+          UMask = "027";
+
           SystemCallArchitectures = "native";
           SystemCallErrorNumber = "EPERM";
           SystemCallFilter = "@system-service";
@@ -546,10 +313,12 @@ in
       };
     };
 
-    meta = {
-      maintainers = with lib.maintainers; [
-        mistyttm
-      ];
-    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [
+      mistyttm
+    ];
+    doc = ./mautrix-discord.md;
   };
 }

nixos/modules/services/misc/inventree.nix

@@ -252,12 +252,13 @@ in
             in
             {
               "/" = {
+                # recommendedProxySettings sets the standard headers (Host, X-Forwarded-*), so
+                # don't also set them via proxy_set_header in extraConfig below. Nginx would then
+                # send Host twice and Django rejects it with DisallowedHost. Enabled per-location
+                # so it works even if the host's global recommendedProxySettings is off.
+                recommendedProxySettings = true;
                 extraConfig = ''
-                  proxy_set_header Host $host;
                   proxy_set_header X-Forwarded-By $server_addr:$server_port;
-                  proxy_set_header X-Forwarded-For $remote_addr;
-                  proxy_set_header X-Forwarded-Proto $scheme;
-                  proxy_set_header X-Real-IP $remote_addr;
                   proxy_set_header CLIENT_IP $remote_addr;
 
                   proxy_pass_request_headers on;
@@ -272,6 +273,8 @@ in
                 proxyPass = "http://unix:${unixPath}";
               };
               "/auth" = {
+                # same reasoning as "/"; this subrequest also reaches Django
+                recommendedProxySettings = true;
                 extraConfig = ''
                   internal;
                   proxy_pass_request_body off;

nixos/modules/services/misc/llama-cpp.nix

@@ -2,188 +2,173 @@
   config,
   lib,
   pkgs,
-  utils,
   ...
 }:
-
 let
   cfg = config.services.llama-cpp;
-
-  modelsPresetFile =
-    if cfg.modelsPreset != null then
-      pkgs.writeText "llama-models.ini" (lib.generators.toINI { } cfg.modelsPreset)
-    else
-      null;
 in
 {
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "llama-cpp" "host" ]
+      [ "services" "llama-cpp" "settings" "host" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "llama-cpp" "port" ]
+      [ "services" "llama-cpp" "settings" "port" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "llama-cpp" "model" ]
+      [ "services" "llama-cpp" "settings" "model" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "llama-cpp" "modelsDir" ]
+      [ "services" "llama-cpp" "settings" "models-dir" ]
+    )
+    (lib.mkRemovedOptionModule [ "services" "llama-cpp" "modelsPreset" ] ''
+      Using a Nix attribute set for configuring model presets is no longer
+      supported. However, it's possible to use
+      `services.llama-cpp.settings.models-preset` to provide a path to an INI
+      file with desired options.
+    '')
+    (lib.mkRemovedOptionModule [
+      "services"
+      "llama-cpp"
+      "extraFlags"
+    ] "Use `services.llama-cpp.settings` instead")
+  ];
 
   options = {
-
     services.llama-cpp = {
-      enable = lib.mkEnableOption "LLaMA C++ server";
+      enable = lib.mkEnableOption "llama.cpp HTTP server";
 
       package = lib.mkPackageOption pkgs "llama-cpp" { };
 
-      model = lib.mkOption {
-        type = lib.types.nullOr lib.types.path;
-        example = "/models/mistral-instruct-7b/ggml-model-q4_0.gguf";
-        description = "Model path.";
-        default = null;
-      };
-
-      modelsDir = lib.mkOption {
-        type = lib.types.nullOr lib.types.path;
-        example = "/models/";
-        description = "Models directory.";
-        default = null;
-      };
-
-      modelsPreset = lib.mkOption {
-        type = lib.types.nullOr (lib.types.attrsOf lib.types.attrs);
-        default = null;
-        description = ''
-          Models preset configuration as a Nix attribute set.
-          This is converted to an INI file and passed to llama-server via --model-preset.
-          See llama-server documentation for available options.
-        '';
-        example = lib.literalExpression ''
-          {
-            "Qwen3-Coder-Next" = {
-              hf-repo = "unsloth/Qwen3-Coder-Next-GGUF";
-              hf-file = "Qwen3-Coder-Next-UD-Q4_K_XL.gguf";
-              alias = "unsloth/Qwen3-Coder-Next";
-              fit = "on";
-              seed = "3407";
-              temp = "1.0";
-              top-p = "0.95";
-              min-p = "0.01";
-              top-k = "40";
-              jinja = "on";
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = lib.types.attrs;
+          options = {
+            host = lib.mkOption {
+              type = lib.types.str;
+              default = "127.0.0.1";
+              example = "0.0.0.0";
+              description = ''
+                IP address on which the server should listen on.
+              '';
             };
-          }
+
+            port = lib.mkOption {
+              type = lib.types.port;
+              default = 8080;
+              example = 1337;
+              description = ''
+                Port on which the server should listen on.
+              '';
+            };
+          };
+        };
+        default = { };
+        example = {
+          host = "0.0.0.0";
+          port = 1337;
+          model = "/mnt/llms/Foo3.6-27B-UD-Q4_K_XL.gguf";
+          ctx-size = 252144;
+          temp = 0.6;
+          top-k = 20;
+          top-p = 0.95;
+          batch-size = 512;
+          ubatch-size = 256;
+          spec-type = "draft-mtp";
+          spec-draft-n-max = 2;
+          flash-attn = "on";
+        };
+        description = ''
+          Command-line arguments for `llama-server`.
+
+          See <https://github.com/ggml-org/llama.cpp/blob/master/tools/server/README.md>
+          for the full list of options.
         '';
       };
 
-      extraFlags = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        description = "Extra flags passed to llama-cpp-server.";
-        example = [
-          "-c"
-          "4096"
-          "-ngl"
-          "32"
-          "--numa"
-          "numactl"
-        ];
-        default = [ ];
-      };
-
-      host = lib.mkOption {
-        type = lib.types.str;
-        default = "127.0.0.1";
-        example = "0.0.0.0";
-        description = "IP address the LLaMA C++ server listens on.";
-      };
-
-      port = lib.mkOption {
-        type = lib.types.port;
-        default = 8080;
-        description = "Listen port for LLaMA C++ server.";
-      };
-
       openFirewall = lib.mkOption {
         type = lib.types.bool;
         default = false;
-        description = "Open ports in the firewall for LLaMA C++ server.";
+        description = ''
+          Open ports in the firewall for the server.
+        '';
       };
     };
-
   };
 
   config = lib.mkIf cfg.enable {
     systemd.services.llama-cpp = {
-      description = "LLaMA C++ server";
+      description = "llama.cpp HTTP server";
+      wants = [ "network.target" ];
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
-        Type = "idle";
-        KillSignal = "SIGINT";
+        ExecStart = toString [
+          (lib.getExe' cfg.package "llama-server")
+          (lib.cli.toCommandLine (optionName: {
+            option = if builtins.stringLength optionName > 1 then "--${optionName}" else "-${optionName}";
+            sep = " ";
+            explicitBool = false;
+            formatArg = lib.generators.mkValueStringDefault { };
+          }) cfg.settings)
+        ];
+        ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID";
+        Restart = "on-failure";
+        RestartSec = 300;
+
+        DynamicUser = true;
         StateDirectory = "llama-cpp";
         CacheDirectory = "llama-cpp";
         WorkingDirectory = "/var/lib/llama-cpp";
         Environment = [ "LLAMA_CACHE=/var/cache/llama-cpp" ];
-        ExecStart =
-          let
-            args = [
-              "--host"
-              cfg.host
-              "--port"
-              (toString cfg.port)
-            ]
-            ++ lib.optionals (cfg.model != null) [
-              "-m"
-              cfg.model
-            ]
-            ++ lib.optionals (cfg.modelsDir != null) [
-              "--models-dir"
-              cfg.modelsDir
-            ]
-            ++ lib.optionals (cfg.modelsPreset != null) [
-              "--models-preset"
-              modelsPresetFile
-            ]
-            ++ cfg.extraFlags;
-          in
-          "${cfg.package}/bin/llama-server ${utils.escapeSystemdExecArgs args}";
-        Restart = "on-failure";
-        RestartSec = 300;
 
-        # for GPU acceleration
-        PrivateDevices = false;
-
-        # hardening
-        DynamicUser = true;
-        CapabilityBoundingSet = "";
+        AmbientCapabilities = [ "" ];
+        CapabilityBoundingSet = [ "" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = false; # Required for GPU support.
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
         RestrictAddressFamilies = [
           "AF_INET"
           "AF_INET6"
           "AF_UNIX"
         ];
-        NoNewPrivileges = true;
-        PrivateMounts = true;
-        PrivateTmp = true;
-        PrivateUsers = true;
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectSystem = "strict";
-        MemoryDenyWriteExecute = true;
-        LockPersonality = true;
-        RemoveIPC = true;
         RestrictNamespaces = true;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
         SystemCallFilter = [
           "@system-service"
           "~@privileged"
         ];
-        SystemCallErrorNumber = "EPERM";
-        ProtectProc = "invisible";
-        ProtectHostname = true;
-        ProcSubset = "pid";
       };
     };
 
-    networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ cfg.port ];
-    };
-
+    networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
   };
 
-  meta.maintainers = with lib.maintainers; [ newam ];
+  meta.maintainers = with lib.maintainers; [
+    azahi
+    newam
+  ];
 }

nixos/modules/services/misc/rmfakecloud.nix

@@ -146,5 +146,5 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ euxane ];
+  meta.maintainers = with lib.maintainers; [ martinetd ];
 }

nixos/modules/services/monitoring/gs1200-exporter.nix

@@ -0,0 +1,95 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.gs1200-exporter;
+in
+{
+  meta.maintainers = with lib.maintainers; [ DerGrumpf ];
+
+  options.services.gs1200-exporter = {
+    enable = lib.mkEnableOption "gs1200-exporter";
+
+    address = lib.mkOption {
+      type = lib.types.str;
+      description = "IP address or hostname of the GS1200 switch.";
+      example = "192.168.1.3";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 9934;
+      description = "Port on which to expose Prometheus metrics.";
+    };
+
+    passwordFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Path to a file containing the password to log in to the GS1200 web interface.
+        This is the recommended option as it avoids storing the password in the Nix store.
+        Compatible with sops-nix and agenix.
+      '';
+      example = "/run/secrets/gs1200-password";
+    };
+
+    debug = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Enable debug logging. Logs are accessible via journalctl -u gs1200-exporter.";
+    };
+
+    verbose = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Enable verbose logging. Logs are accessible via journalctl -u gs1200-exporter.";
+    };
+
+    json = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Output logs in JSON format. Logs are accessible via journalctl -u gs1200-exporter.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    systemd.services.gs1200-exporter = {
+      description = "Prometheus exporter for Zyxel GS1200 switches";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        DynamicUser = true;
+        Restart = "always";
+
+        # Hardening
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        CapabilityBoundingSet = "";
+      };
+
+      script =
+        let
+          args = lib.concatStringsSep " " (
+            [
+              "--address ${cfg.address}"
+              "--port ${toString cfg.port}"
+            ]
+            ++ lib.optional cfg.debug "--debug"
+            ++ lib.optional cfg.verbose "--verbose"
+            ++ lib.optional cfg.json "--json"
+          );
+        in
+        ''
+          export GS1200_PASSWORD=$(cat ${cfg.passwordFile})
+          exec ${lib.getExe pkgs.gs1200-exporter} ${args}
+        '';
+    };
+  };
+}

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -62,6 +62,7 @@ let
         "domain"
         "dovecot"
         "ebpf"
+        "elasticsearch"
         "fail2ban"
         "fastly"
         "flow"

nixos/modules/services/monitoring/prometheus/exporters/elasticsearch.nix

@@ -0,0 +1,62 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkIf
+    mkOption
+    types
+    ;
+
+  inherit (utils) escapeSystemdExecArgs;
+
+  cfg = config.services.prometheus.exporters.elasticsearch;
+in
+{
+  port = 9114;
+  extraOpts = {
+    package = lib.mkPackageOption pkgs "prometheus-elasticsearch-exporter" { };
+
+    url = mkOption {
+      type = types.str;
+      default = "http://localhost:9200";
+      example = "https://localhost:9200";
+      description = ''
+        URI of the Elasticsearch (or OpenSearch) node to scrape, passed as
+        `--es.uri`. Any credentials embedded here are overridden by the
+        `ES_USERNAME`/`ES_PASSWORD` or `ES_API_KEY` environment variables when
+        {option}`environmentFile` is set.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/elasticsearch-exporter.env";
+      description = ''
+        Path to an environment file, as defined in {manpage}`systemd.exec(5)`,
+        used to pass credentials to the exporter without exposing them in the
+        process arguments. It should contain either `ES_USERNAME` and
+        `ES_PASSWORD`, or `ES_API_KEY`.
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+      ExecStart = escapeSystemdExecArgs (
+        [
+          (lib.getExe cfg.package)
+          "--web.listen-address=${cfg.listenAddress}:${toString cfg.port}"
+          "--es.uri=${cfg.url}"
+        ]
+        ++ cfg.extraFlags
+      );
+    };
+  };
+}

nixos/modules/services/networking/firezone/provision.exs

@@ -1,709 +0,0 @@
-defmodule Provision do
-  alias Domain.{Repo, Accounts, Auth, Actors, Resources, Tokens, Gateways, Relays, Policies}
-  require Logger
-
-  # UUID Mapping handling
-  defmodule UuidMapping do
-    @mapping_file "provision-uuids.json"
-
-    # Loads the mapping from file
-    def load do
-      mappings = case File.read(@mapping_file) do
-        {:ok, content} ->
-          case Jason.decode(content) do
-            {:ok, mapping} -> mapping
-            _ -> %{"accounts" => %{}}
-          end
-
-        _ -> %{"accounts" => %{}}
-      end
-      Process.put(:uuid_mappings, mappings)
-      mappings
-    end
-
-    # Saves the current mapping (defaulting to the one in the process dictionary)
-    def save(mapping \\ Process.get(:uuid_mappings)) do
-      File.write!(@mapping_file, Jason.encode!(mapping))
-    end
-
-    # Retrieves the account-level mapping from a given mapping (or from Process)
-    def get_account(mapping \\ Process.get(:uuid_mappings), account_slug) do
-      get_in(mapping, ["accounts", account_slug]) || %{}
-    end
-
-    # Retrieves the entity mapping for a specific account and type
-    def get_entities(mapping \\ Process.get(:uuid_mappings), account_slug, type) do
-      get_in(mapping, ["accounts", account_slug, type]) || %{}
-    end
-
-    # Retrieves an entity mapping for a specific account, type and external_id
-    def get_entity(mapping \\ Process.get(:uuid_mappings), account_slug, type, external_id) do
-      get_in(mapping, ["accounts", account_slug, type, external_id])
-    end
-
-    # Updates (or creates) the account UUID mapping and stores it in the process dictionary.
-    def update_account(account_slug, uuid) do
-      mapping = Process.get(:uuid_mappings) || load()
-      mapping = ensure_account_exists(mapping, account_slug)
-      mapping = put_in(mapping, ["accounts", account_slug, "id"], uuid)
-      Process.put(:uuid_mappings, mapping)
-      mapping
-    end
-
-    # Ensures that the given account exists in the mapping.
-    def ensure_account_exists(mapping, account_slug) do
-      if not Map.has_key?(mapping["accounts"], account_slug) do
-        put_in(mapping, ["accounts", account_slug], %{})
-      else
-        mapping
-      end
-    end
-
-    # Updates (or creates) the mapping for entities of a given type for the account.
-    def update_entities(account_slug, type, new_entries) do
-      mapping = Process.get(:uuid_mappings) || load()
-      mapping = ensure_account_exists(mapping, account_slug)
-      current = get_entities(mapping, account_slug, type)
-      mapping = put_in(mapping, ["accounts", account_slug, type], Map.merge(current, new_entries))
-      Process.put(:uuid_mappings, mapping)
-      mapping
-    end
-
-    # Removes an entire account from the mapping.
-    def remove_account(account_slug) do
-      mapping = Process.get(:uuid_mappings) || load()
-      mapping = update_in(mapping, ["accounts"], fn accounts ->
-        Map.delete(accounts, account_slug)
-      end)
-      Process.put(:uuid_mappings, mapping)
-      mapping
-    end
-
-    # Removes a specific entity mapping for the account.
-    def remove_entity(account_slug, type, key) do
-      mapping = Process.get(:uuid_mappings) || load()
-      mapping = update_in(mapping, ["accounts", account_slug, type], fn entities ->
-        Map.delete(entities || %{}, key)
-      end)
-      Process.put(:uuid_mappings, mapping)
-      mapping
-    end
-  end
-
-  defp resolve_references(value) when is_map(value) do
-    Enum.into(value, %{}, fn {k, v} -> {k, resolve_references(v)} end)
-  end
-
-  defp resolve_references(value) when is_list(value) do
-    Enum.map(value, &resolve_references/1)
-  end
-
-  defp resolve_references(value) when is_binary(value) do
-    Regex.replace(~r/\{env:([^}]+)\}/, value, fn _, var ->
-      System.get_env(var) || raise "Environment variable #{var} not set"
-    end)
-  end
-
-  defp resolve_references(value), do: value
-
-  defp atomize_keys(map) when is_map(map) do
-    Enum.into(map, %{}, fn {k, v} ->
-      {
-        if(is_binary(k), do: String.to_atom(k), else: k),
-        if(is_map(v), do: atomize_keys(v), else: v)
-      }
-    end)
-  end
-
-  defp cleanup_account(uuid) do
-    case Accounts.fetch_account_by_id_or_slug(uuid) do
-      {:ok, value} when value.deleted_at == nil ->
-        Logger.info("Deleting removed account #{value.slug}")
-        value |> Ecto.Changeset.change(%{ deleted_at: DateTime.utc_now() }) |> Repo.update!()
-      _ -> :ok
-    end
-  end
-
-  defp cleanup_actor(uuid, subject) do
-    case Actors.fetch_actor_by_id(uuid, subject) do
-      {:ok, value} ->
-        Logger.info("Deleting removed actor #{value.name}")
-        {:ok, _} = Actors.delete_actor(value, subject)
-      _ -> :ok
-    end
-  end
-
-  defp cleanup_provider(uuid, subject) do
-    case Auth.fetch_provider_by_id(uuid, subject) do
-      {:ok, value} ->
-        Logger.info("Deleting removed provider #{value.name}")
-        {:ok, _} = Auth.delete_provider(value, subject)
-      _ -> :ok
-    end
-  end
-
-  defp cleanup_gateway_group(uuid, subject) do
-    case Gateways.fetch_group_by_id(uuid, subject) do
-      {:ok, value} ->
-        Logger.info("Deleting removed gateway group #{value.name}")
-        {:ok, _} = Gateways.delete_group(value, subject)
-      _ -> :ok
-    end
-  end
-
-  defp cleanup_relay_group(uuid, subject) do
-    case Relays.fetch_group_by_id(uuid, subject) do
-      {:ok, value} ->
-        Logger.info("Deleting removed relay group #{value.name}")
-        {:ok, _} = Relays.delete_group(value, subject)
-      _ -> :ok
-    end
-  end
-
-  defp cleanup_actor_group(uuid, subject) do
-    case Actors.fetch_group_by_id(uuid, subject) do
-      {:ok, value} ->
-        Logger.info("Deleting removed actor group #{value.name}")
-        {:ok, _} = Actors.delete_group(value, subject)
-      _ -> :ok
-    end
-  end
-
-  # Fetch resource by uuid, but follow the chain of replacements if any
-  defp fetch_resource(uuid, subject) do
-    case Resources.fetch_resource_by_id(uuid, subject) do
-      {:ok, resource} when resource.replaced_by_resource_id != nil -> fetch_resource(resource.replaced_by_resource_id, subject)
-      v -> v
-    end
-  end
-
-  defp cleanup_resource(uuid, subject) do
-    case fetch_resource(uuid, subject) do
-      {:ok, value} when value.deleted_at == nil ->
-        Logger.info("Deleting removed resource #{value.name}")
-        {:ok, _} = Resources.delete_resource(value, subject)
-      _ -> :ok
-    end
-  end
-
-  # Fetch policy by uuid, but follow the chain of replacements if any
-  defp fetch_policy(uuid, subject) do
-    case Policies.fetch_policy_by_id(uuid, subject) do
-      {:ok, policy} when policy.replaced_by_policy_id != nil -> fetch_policy(policy.replaced_by_policy_id, subject)
-      v -> v
-    end
-  end
-
-  defp cleanup_policy(uuid, subject) do
-    case fetch_policy(uuid, subject) do
-      {:ok, value} when value.deleted_at == nil ->
-        Logger.info("Deleting removed policy #{value.description}")
-        {:ok, _} = Policies.delete_policy(value, subject)
-      _ -> :ok
-    end
-  end
-
-  defp cleanup_entity_type(account_slug, entity_type, cleanup_fn, temp_admin_subject) do
-    # Get mapping for this entity type
-    existing_entities = UuidMapping.get_entities(account_slug, entity_type)
-    # Get current entities from account data
-    current_entities = Process.get(:current_entities)
-    # Determine which ones to remove
-    removed_entity_ids = Map.keys(existing_entities) -- (current_entities[entity_type] || [])
-
-    # Process each entity to remove
-    Enum.each(removed_entity_ids, fn entity_id ->
-      case existing_entities[entity_id] do
-        nil -> :ok
-        uuid ->
-          cleanup_fn.(uuid, temp_admin_subject)
-          UuidMapping.remove_entity(account_slug, entity_type, entity_id)
-      end
-    end)
-  end
-
-  defp collect_current_entities(account_data) do
-    %{
-      "actors" => Map.keys(account_data["actors"] || %{}),
-      "providers" => Map.keys(account_data["auth"] || %{}),
-      "gateway_groups" => Map.keys(account_data["gatewayGroups"] || %{}),
-      "relay_groups" => Map.keys(account_data["relayGroups"] || %{}),
-      "actor_groups" => Map.keys(account_data["groups"] || %{}) ++ ["everyone"],
-      "resources" => Map.keys(account_data["resources"] || %{}),
-      "policies" => Map.keys(account_data["policies"] || %{})
-    }
-  end
-
-  defp nil_if_deleted_or_not_found(value) do
-    case value do
-      nil -> nil
-      {:error, :not_found} -> nil
-      {:ok, value} when value.deleted_at != nil -> nil
-      v -> v
-    end
-  end
-
-  defp create_temp_admin(account, email_provider) do
-    temp_admin_actor_email = "firezone-provision@localhost.local"
-    temp_admin_actor_context = %Auth.Context{
-      type: :browser,
-      user_agent: "Unspecified/0.0",
-      remote_ip: {127, 0, 0, 1},
-      remote_ip_location_region: "N/A",
-      remote_ip_location_city: "N/A",
-      remote_ip_location_lat: 0.0,
-      remote_ip_location_lon: 0.0
-    }
-
-    {:ok, temp_admin_actor} =
-      Actors.create_actor(account, %{
-        type: :account_admin_user,
-        name: "Provisioning"
-      })
-
-    {:ok, temp_admin_actor_email_identity} =
-      Auth.create_identity(temp_admin_actor, email_provider, %{
-        provider_identifier: temp_admin_actor_email,
-        provider_identifier_confirmation: temp_admin_actor_email
-      })
-
-    {:ok, temp_admin_actor_token} =
-      Auth.create_token(temp_admin_actor_email_identity, temp_admin_actor_context, "temporarynonce", DateTime.utc_now() |> DateTime.add(1, :hour))
-
-    {:ok, temp_admin_subject} =
-      Auth.build_subject(temp_admin_actor_token, temp_admin_actor_context)
-
-    {temp_admin_subject, temp_admin_actor, temp_admin_actor_email_identity, temp_admin_actor_token}
-  end
-
-  defp cleanup_temp_admin(temp_admin_actor, temp_admin_actor_email_identity, temp_admin_actor_token, subject) do
-    Logger.info("Cleaning up temporary admin actor")
-    {:ok, _} = Tokens.delete_token(temp_admin_actor_token, subject)
-    {:ok, _} = Auth.delete_identity(temp_admin_actor_email_identity, subject)
-    {:ok, _} = Actors.delete_actor(temp_admin_actor, subject)
-  end
-
-  def provision() do
-    Logger.info("Starting provisioning")
-
-    # Load desired state
-    json_file = "provision-state.json"
-    {:ok, raw_json} = File.read(json_file)
-    {:ok, %{"accounts" => accounts}} = Jason.decode(raw_json)
-    accounts = resolve_references(accounts)
-
-    # Load existing UUID mappings into the process dictionary.
-    UuidMapping.load()
-
-    # Clean up removed accounts first
-    current_account_slugs = Map.keys(accounts)
-    existing_accounts = Map.keys(Process.get(:uuid_mappings)["accounts"])
-    removed_accounts = existing_accounts -- current_account_slugs
-
-    Enum.each(removed_accounts, fn slug ->
-      if uuid = get_in(Process.get(:uuid_mappings), ["accounts", slug, "id"]) do
-        cleanup_account(uuid)
-        # Remove the account from the UUID mapping.
-        UuidMapping.remove_account(slug)
-      end
-    end)
-
-    multi = Enum.reduce(accounts, Ecto.Multi.new(), fn {slug, account_data}, multi ->
-      account_attrs = atomize_keys(%{
-        name: account_data["name"],
-        slug: slug,
-        features: Map.get(account_data, "features", %{}),
-        metadata: Map.get(account_data, "metadata", %{}),
-        limits: Map.get(account_data, "limits", %{})
-      })
-
-      multi = multi
-        |> Ecto.Multi.run({:account, slug}, fn repo, _changes ->
-          case Accounts.fetch_account_by_id_or_slug(slug) do
-            {:ok, acc} ->
-              Logger.info("Updating existing account #{slug}")
-              updated_acc = acc |> Ecto.Changeset.change(account_attrs) |> repo.update!()
-              {:ok, {:existing, updated_acc}}
-            _ ->
-              Logger.info("Creating new account #{slug}")
-              {:ok, account} = Accounts.create_account(account_attrs)
-
-              Logger.info("Creating internet gateway group")
-              {:ok, internet_site} = Gateways.create_internet_group(account)
-
-              Logger.info("Creating internet resource")
-              {:ok, _internet_resource} = Resources.create_internet_resource(account, internet_site)
-
-              # Store mapping of slug to UUID
-              UuidMapping.update_account(slug, account.id)
-              {:ok, {:new, account}}
-          end
-        end)
-        |> Ecto.Multi.run({:everyone_group, slug}, fn _repo, changes ->
-          case Map.get(changes, {:account, slug}) do
-            {:new, account} ->
-              Logger.info("Creating everyone group for new account")
-              {:ok, actor_group} = Actors.create_managed_group(account, %{name: "Everyone"})
-              UuidMapping.update_entities(slug, "actor_groups", %{"everyone" => actor_group.id})
-              {:ok, actor_group}
-            {:existing, _account} ->
-              {:ok, :skipped}
-          end
-        end)
-        |> Ecto.Multi.run({:email_provider, slug}, fn _repo, changes ->
-          case Map.get(changes, {:account, slug}) do
-            {:new, account} ->
-              Logger.info("Creating default email provider for new account")
-              Auth.create_provider(account, %{name: "Email", adapter: :email, adapter_config: %{}})
-            {:existing, account} ->
-              Auth.Provider.Query.not_disabled()
-              |> Auth.Provider.Query.by_adapter(:email)
-              |> Auth.Provider.Query.by_account_id(account.id)
-              |> Repo.fetch(Auth.Provider.Query, [])
-          end
-        end)
-        |> Ecto.Multi.run({:temp_admin, slug}, fn _repo, changes ->
-          {_, account} = changes[{:account, slug}]
-          email_provider = changes[{:email_provider, slug}]
-          {:ok, create_temp_admin(account, email_provider)}
-        end)
-
-      # Clean up removed entities for this account after we have an admin subject
-      multi = multi
-        |> Ecto.Multi.run({:cleanup_entities, slug}, fn _repo, changes ->
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-
-          # Store current entities in process dictionary for our helper function
-          current_entities = collect_current_entities(account_data)
-          Process.put(:current_entities, current_entities)
-
-          # Define entity types and their cleanup functions
-          entity_types = [
-            {"actors", &cleanup_actor/2},
-            {"providers", &cleanup_provider/2},
-            {"gateway_groups", &cleanup_gateway_group/2},
-            {"relay_groups", &cleanup_relay_group/2},
-            {"actor_groups", &cleanup_actor_group/2},
-            {"resources", &cleanup_resource/2},
-            {"policies", &cleanup_policy/2}
-          ]
-
-          # Clean up each entity type
-          Enum.each(entity_types, fn {entity_type, cleanup_fn} ->
-            cleanup_entity_type(slug, entity_type, cleanup_fn, temp_admin_subject)
-          end)
-
-          {:ok, :cleaned}
-        end)
-
-      # Create or update actors
-      multi = Enum.reduce(account_data["actors"] || %{}, multi, fn {external_id, actor_data}, multi ->
-        actor_attrs = atomize_keys(%{
-          name: actor_data["name"],
-          type: String.to_atom(actor_data["type"])
-        })
-
-        Ecto.Multi.run(multi, {:actor, slug, external_id}, fn _repo, changes ->
-          {_, account} = changes[{:account, slug}]
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-          uuid = UuidMapping.get_entity(slug, "actors", external_id)
-          case uuid && Actors.fetch_actor_by_id(uuid, temp_admin_subject) |> nil_if_deleted_or_not_found() do
-            nil ->
-              Logger.info("Creating new actor #{actor_data["name"]}")
-              {:ok, actor} = Actors.create_actor(account, actor_attrs)
-              # Update the mapping without manually handling Process.get/put.
-              UuidMapping.update_entities(slug, "actors", %{external_id => actor.id})
-              {:ok, {:new, actor}}
-            {:ok, existing_actor} ->
-              Logger.info("Updating existing actor #{actor_data["name"]}")
-              {:ok, updated_act} = Actors.update_actor(existing_actor, actor_attrs, temp_admin_subject)
-              {:ok, {:existing, updated_act}}
-          end
-        end)
-        |> Ecto.Multi.run({:actor_identity, slug, external_id}, fn repo, changes ->
-          email_provider = changes[{:email_provider, slug}]
-          case Map.get(changes, {:actor, slug, external_id}) do
-            {:new, actor} ->
-              Logger.info("Creating actor email identity")
-              Auth.create_identity(actor, email_provider, %{
-                provider_identifier: actor_data["email"],
-                provider_identifier_confirmation: actor_data["email"]
-              })
-            {:existing, actor} ->
-              Logger.info("Updating actor email identity")
-              {:ok, identity} = Auth.Identity.Query.not_deleted()
-              |> Auth.Identity.Query.by_actor_id(actor.id)
-              |> Auth.Identity.Query.by_provider_id(email_provider.id)
-              |> Repo.fetch(Auth.Identity.Query, [])
-
-              {:ok, identity |> Ecto.Changeset.change(%{
-                provider_identifier: actor_data["email"]
-              }) |> repo.update!()}
-          end
-        end)
-      end)
-
-      # Create or update providers
-      multi = Enum.reduce(account_data["auth"] || %{}, multi, fn {external_id, provider_data}, multi ->
-        Ecto.Multi.run(multi, {:provider, slug, external_id}, fn repo, changes ->
-          provider_attrs = %{
-            name: provider_data["name"],
-            adapter: String.to_atom(provider_data["adapter"]),
-            adapter_config: provider_data["adapter_config"]
-          }
-
-          {_, account} = changes[{:account, slug}]
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-          uuid = UuidMapping.get_entity(slug, "providers", external_id)
-          case uuid && Auth.fetch_provider_by_id(uuid, temp_admin_subject) |> nil_if_deleted_or_not_found() do
-            nil ->
-              Logger.info("Creating new provider #{provider_data["name"]}")
-              {:ok, provider} = Auth.create_provider(account, provider_attrs)
-              UuidMapping.update_entities(slug, "providers", %{external_id => provider.id})
-              {:ok, provider}
-            {:ok, existing} ->
-              Logger.info("Updating existing provider #{provider_data["name"]}")
-              {:ok, existing |> Ecto.Changeset.change(provider_attrs) |> repo.update!()}
-          end
-        end)
-      end)
-
-      # Create or update gateway_groups
-      multi = Enum.reduce(account_data["gatewayGroups"] || %{}, multi, fn {external_id, gateway_group_data}, multi ->
-        Ecto.Multi.run(multi, {:gateway_group, slug, external_id}, fn _repo, changes ->
-          gateway_group_attrs = %{
-            name: gateway_group_data["name"],
-            tokens: [%{}]
-          }
-
-          {_, account} = changes[{:account, slug}]
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-          uuid = UuidMapping.get_entity(slug, "gateway_groups", external_id)
-          case uuid && Gateways.fetch_group_by_id(uuid, temp_admin_subject) |> nil_if_deleted_or_not_found() do
-            nil ->
-              Logger.info("Creating new gateway group #{gateway_group_data["name"]}")
-              gateway_group = account
-                |> Gateways.Group.Changeset.create(gateway_group_attrs, temp_admin_subject)
-                |> Repo.insert!()
-              UuidMapping.update_entities(slug, "gateway_groups", %{external_id => gateway_group.id})
-              {:ok, gateway_group}
-            {:ok, existing} ->
-              # Nothing to update
-              {:ok, existing}
-          end
-        end)
-      end)
-
-      # Create or update relay_groups
-      multi = Enum.reduce(account_data["relayGroups"] || %{}, multi, fn {external_id, relay_group_data}, multi ->
-        Ecto.Multi.run(multi, {:relay_group, slug, external_id}, fn _repo, changes ->
-          relay_group_attrs = %{
-            name: relay_group_data["name"]
-          }
-
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-          uuid = UuidMapping.get_entity(slug, "relay_groups", external_id)
-          existing_relay_group = uuid && Relays.fetch_group_by_id(uuid, temp_admin_subject)
-          case existing_relay_group do
-            v when v in [nil, {:error, :not_found}] ->
-              Logger.info("Creating new relay group #{relay_group_data["name"]}")
-              {:ok, relay_group} = Relays.create_group(relay_group_attrs, temp_admin_subject)
-              UuidMapping.update_entities(slug, "relay_groups", %{external_id => relay_group.id})
-              {:ok, relay_group}
-            {:ok, existing} ->
-              # Nothing to update
-              {:ok, existing}
-          end
-        end)
-      end)
-
-      # Create or update actor_groups
-      multi = Enum.reduce(account_data["groups"] || %{}, multi, fn {external_id, actor_group_data}, multi ->
-        Ecto.Multi.run(multi, {:actor_group, slug, external_id}, fn _repo, changes ->
-          actor_group_attrs = %{
-            name: actor_group_data["name"],
-            type: :static
-          }
-
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-          uuid = UuidMapping.get_entity(slug, "actor_groups", external_id)
-          case uuid && Actors.fetch_group_by_id(uuid, temp_admin_subject) |> nil_if_deleted_or_not_found() do
-            nil ->
-              Logger.info("Creating new actor group #{actor_group_data["name"]}")
-              {:ok, actor_group} = Actors.create_group(actor_group_attrs, temp_admin_subject)
-              UuidMapping.update_entities(slug, "actor_groups", %{external_id => actor_group.id})
-              {:ok, actor_group}
-            {:ok, existing} ->
-              # Nothing to update
-              {:ok, existing}
-          end
-        end)
-        |> Ecto.Multi.run({:actor_group_members, slug, external_id}, fn repo, changes ->
-          {_, account} = changes[{:account, slug}]
-          group_uuid = UuidMapping.get_entity(slug, "actor_groups", external_id)
-
-          memberships =
-            Actors.Membership.Query.all()
-            |> Actors.Membership.Query.by_group_id(group_uuid)
-            |> Actors.Membership.Query.returning_all()
-            |> Repo.all()
-
-          existing_members = Enum.map(memberships, fn membership -> membership.actor_id end)
-          desired_members = Enum.map(actor_group_data["members"] || [], fn member ->
-            uuid = UuidMapping.get_entity(slug, "actors", member)
-            if uuid == nil do
-              raise "Cannot find provisioned actor #{member} to add to group"
-            end
-            uuid
-          end)
-
-          missing_members = desired_members -- existing_members
-          untracked_members = existing_members -- desired_members
-
-          Logger.info("Updating members for actor group #{external_id}")
-          Enum.each(missing_members || [], fn actor_uuid ->
-            Logger.info("Adding member #{external_id}")
-            Actors.Membership.Changeset.upsert(account.id, %Actors.Membership{}, %{
-              group_id: group_uuid,
-              actor_id: actor_uuid
-            })
-            |> repo.insert!()
-          end)
-
-          if actor_group_data["forceMembers"] == true do
-            # Remove untracked members
-            to_delete = Enum.map(untracked_members, fn actor_uuid -> {group_uuid, actor_uuid} end)
-            if to_delete != [] do
-              Actors.Membership.Query.by_group_id_and_actor_id({:in, to_delete})
-                |> repo.delete_all()
-            end
-          end
-
-          {:ok, nil}
-        end)
-      end)
-
-      # Create or update resources
-      multi = Enum.reduce(account_data["resources"] || %{}, multi, fn {external_id, resource_data}, multi ->
-        Ecto.Multi.run(multi, {:resource, slug, external_id}, fn _repo, changes ->
-          resource_attrs = %{
-            type: String.to_atom(resource_data["type"]),
-            name: resource_data["name"],
-            address: resource_data["address"],
-            address_description: resource_data["address_description"],
-            connections: Enum.map(resource_data["gatewayGroups"] || [], fn group ->
-              %{gateway_group_id: UuidMapping.get_entity(slug, "gateway_groups", group)}
-            end),
-            filters: Enum.map(resource_data["filters"] || [], fn filter ->
-              %{
-                ports: filter["ports"] || [],
-                protocol: String.to_atom(filter["protocol"])
-              }
-            end)
-          }
-
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-          uuid = UuidMapping.get_entity(slug, "resources", external_id)
-          case uuid && fetch_resource(uuid, temp_admin_subject) |> nil_if_deleted_or_not_found() do
-            nil ->
-              Logger.info("Creating new resource #{resource_data["name"]}")
-              {:ok, resource} = Resources.create_resource(resource_attrs, temp_admin_subject)
-              UuidMapping.update_entities(slug, "resources", %{external_id => resource.id})
-              {:ok, resource}
-            {:ok, existing} ->
-              existing = Repo.preload(existing, :connections)
-              Logger.info("Updating existing resource #{resource_data["name"]}")
-              only_updated_attrs = resource_attrs
-                |> Enum.reject(fn {key, value} ->
-                  case key do
-                    # Compare connections by gateway_group_id only
-                    :connections -> value == Enum.map(existing.connections || [], fn conn -> Map.take(conn, [:gateway_group_id]) end)
-                    # Compare filters by ports and protocol only
-                    :filters -> value == Enum.map(existing.filters || [], fn filter -> Map.take(filter, [:ports, :protocol]) end)
-                    _ -> Map.get(existing, key) == value
-                  end
-                end)
-                |> Enum.into(%{})
-
-              if only_updated_attrs == %{} do
-                {:ok, existing}
-              else
-                resource = case existing |> Resources.update_resource(resource_attrs, temp_admin_subject) do
-                  {:replaced, _old, new} ->
-                    UuidMapping.update_entities(slug, "resources", %{external_id => new.id})
-                    new
-                  {:updated, value} -> value
-                  x -> x
-                end
-
-                {:ok, resource}
-              end
-          end
-        end)
-      end)
-
-      # Create or update policies
-      multi = Enum.reduce(account_data["policies"] || %{}, multi, fn {external_id, policy_data}, multi ->
-        Ecto.Multi.run(multi, {:policy, slug, external_id}, fn _repo, changes ->
-          policy_attrs = %{
-            description: policy_data["description"],
-            actor_group_id: UuidMapping.get_entity(slug, "actor_groups", policy_data["group"]),
-            resource_id: UuidMapping.get_entity(slug, "resources", policy_data["resource"])
-          }
-
-          {temp_admin_subject, _, _, _} = changes[{:temp_admin, slug}]
-          uuid = UuidMapping.get_entity(slug, "policies", external_id)
-          case uuid && fetch_policy(uuid, temp_admin_subject) |> nil_if_deleted_or_not_found() do
-            nil ->
-              Logger.info("Creating new policy #{policy_data["name"]}")
-              {:ok, policy} = Policies.create_policy(policy_attrs, temp_admin_subject)
-              UuidMapping.update_entities(slug, "policies", %{external_id => policy.id})
-              {:ok, policy}
-            {:ok, existing} ->
-              Logger.info("Updating existing policy #{policy_data["name"]}")
-              only_updated_attrs = policy_attrs
-                |> Enum.reject(fn {key, value} -> Map.get(existing, key) == value end)
-                |> Enum.into(%{})
-
-              if only_updated_attrs == %{} do
-                {:ok, existing}
-              else
-                policy = case existing |> Policies.update_policy(policy_attrs, temp_admin_subject) do
-                  {:replaced, _old, new} ->
-                    UuidMapping.update_entities(slug, "policies", %{external_id => new.id})
-                    new
-                  {:updated, value} -> value
-                  x -> x
-                end
-
-                {:ok, policy}
-              end
-          end
-        end)
-      end)
-
-      # Clean up temporary admin after all operations
-      multi |> Ecto.Multi.run({:cleanup_temp_admin, slug}, fn _repo, changes ->
-        {temp_admin_subject, temp_admin_actor, temp_admin_actor_email_identity, temp_admin_actor_token} =
-          changes[{:temp_admin, slug}]
-
-        cleanup_temp_admin(temp_admin_actor, temp_admin_actor_email_identity, temp_admin_actor_token, temp_admin_subject)
-        {:ok, :cleaned}
-      end)
-    end)
-    |> Ecto.Multi.run({:save_state}, fn _repo, _changes ->
-      # Save all UUID mappings to disk.
-      UuidMapping.save()
-      {:ok, :saved}
-    end)
-
-    case Repo.transaction(multi) do
-      {:ok, _result} ->
-        Logger.info("Provisioning completed successfully")
-      {:error, step, reason, _changes} ->
-        Logger.error("Provisioning failed at step #{inspect(step)}, no changes were applied: #{inspect(reason)}")
-    end
-  end
-end
-
-Provision.provision()

nixos/modules/services/networking/firezone/server.nix

@@ -9,12 +9,8 @@ let
     attrNames
     boolToString
     concatLines
-    concatLists
-    concatMapAttrs
     concatStringsSep
     filterAttrs
-    filterAttrsRecursive
-    flip
     forEach
     getExe
     isBool
@@ -26,16 +22,11 @@ let
     mkMerge
     mkOption
     mkPackageOption
-    optionalAttrs
-    optionalString
-    recursiveUpdate
     subtractLists
-    toUpper
     types
     ;
 
   cfg = config.services.firezone.server;
-  jsonFormat = pkgs.formats.json { };
   availableAuthAdapters = [
     "email"
     "openid_connect"
@@ -47,28 +38,6 @@ let
     "jumpcloud"
   ];
 
-  typePortRange =
-    types.coercedTo types.port
-      (x: {
-        from = x;
-        to = x;
-      })
-      (
-        types.submodule {
-          options = {
-            from = mkOption {
-              type = types.port;
-              description = "The start of the port range, inclusive.";
-            };
-
-            to = mkOption {
-              type = types.port;
-              description = "The end of the port range, inclusive.";
-            };
-          };
-        }
-      );
-
   # All non-secret environment variables or the given component
   collectEnvironment =
     component:
@@ -119,29 +88,6 @@ let
       )
     );
 
-  provisionStateJson =
-    let
-      # Convert clientSecretFile options into the real counterpart
-      augmentedAccounts = flip mapAttrs cfg.provision.accounts (
-        accountName: account:
-        account
-        // {
-          auth = flip mapAttrs account.auth (
-            authName: auth:
-            recursiveUpdate auth (
-              optionalAttrs (auth.adapter_config.clientSecretFile != null) {
-                adapter_config.client_secret = "{env:AUTH_CLIENT_SECRET_${toUpper accountName}_${toUpper authName}}";
-              }
-            )
-          );
-        }
-      );
-    in
-    jsonFormat.generate "provision-state.json" {
-      # Do not include any clientSecretFile attributes in the resulting json
-      accounts = filterAttrsRecursive (k: _: k != "clientSecretFile") augmentedAccounts;
-    };
-
   commonServiceConfig = {
     AmbientCapabilities = [ ];
     CapabilityBoundingSet = [ ];
@@ -222,6 +168,12 @@ let
   };
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "firezone" "server" "provision" ] ''
+      Firezone provisioning support has been removed due to outsized maintenance efforts. See https://github.com/NixOS/nixpkgs/pull/529428.
+    '')
+  ];
+
   options.services.firezone.server = {
     enable = mkEnableOption "all Firezone components";
     enableLocalDB = mkEnableOption "a local postgresql database for Firezone";
@@ -521,393 +473,9 @@ in
         description = "A list of trusted proxies";
       };
     };
-
-    provision = {
-      enable = mkEnableOption "provisioning of the Firezone domain server";
-      accounts = mkOption {
-        type = types.attrsOf (
-          types.submodule {
-            freeformType = jsonFormat.type;
-            options = {
-              name = mkOption {
-                type = types.str;
-                description = "The account name";
-                example = "My Organization";
-              };
-
-              features =
-                let
-                  mkFeatureOption =
-                    name: default:
-                    mkOption {
-                      type = types.bool;
-                      inherit default;
-                      description = "Whether to enable the `${name}` feature for this account.";
-                    };
-                in
-                {
-                  policy_conditions = mkFeatureOption "policy_conditions" true;
-                  multi_site_resources = mkFeatureOption "multi_site_resources" true;
-                  traffic_filters = mkFeatureOption "traffic_filters" true;
-                  self_hosted_relays = mkFeatureOption "self_hosted_relays" true;
-                  idp_sync = mkFeatureOption "idp_sync" true;
-                  rest_api = mkFeatureOption "rest_api" true;
-                  internet_resource = mkFeatureOption "internet_resource" true;
-                };
-
-              actors = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    options = {
-                      type = mkOption {
-                        type = types.enum [
-                          "account_admin_user"
-                          "account_user"
-                          "service_account"
-                          "api_client"
-                        ];
-                        description = "The account type";
-                      };
-
-                      name = mkOption {
-                        type = types.str;
-                        description = "The name of this actor";
-                      };
-
-                      email = mkOption {
-                        type = types.str;
-                        description = "The email address used to authenticate as this account";
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  admin = {
-                    type = "account_admin_user";
-                    name = "Admin";
-                    email = "admin@myorg.example.com";
-                  };
-                };
-                description = ''
-                  All actors (users) to provision. The attribute name will only
-                  be used to track the actor and does not have any significance
-                  for Firezone.
-                '';
-              };
-
-              auth = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    freeformType = jsonFormat.type;
-                    options = {
-                      name = mkOption {
-                        type = types.str;
-                        description = "The name of this authentication provider";
-                      };
-
-                      adapter = mkOption {
-                        type = types.enum availableAuthAdapters;
-                        description = "The auth adapter type";
-                      };
-
-                      adapter_config.clientSecretFile = mkOption {
-                        type = types.nullOr types.path;
-                        default = null;
-                        description = ''
-                          A file containing a the client secret for an openid_connect adapter.
-                          You only need to set this if this is an openid_connect provider.
-                        '';
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  myoidcprovider = {
-                    adapter = "openid_connect";
-                    adapter_config = {
-                      client_id = "clientid";
-                      clientSecretFile = "/run/secrets/oidc-client-secret";
-                      response_type = "code";
-                      scope = "openid email name";
-                      discovery_document_uri = "https://auth.example.com/.well-known/openid-configuration";
-                    };
-                  };
-                };
-                description = ''
-                  All authentication providers to provision. The attribute name
-                  will only be used to track the provider and does not have any
-                  significance for Firezone.
-                '';
-              };
-
-              resources = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    options = {
-                      type = mkOption {
-                        type = types.enum [
-                          "dns"
-                          "cidr"
-                          "ip"
-                        ];
-                        description = "The resource type";
-                      };
-
-                      name = mkOption {
-                        type = types.str;
-                        description = "The name of this resource";
-                      };
-
-                      address = mkOption {
-                        type = types.str;
-                        description = "The address of this resource. Depending on the resource type, this should be an ip, ip with cidr mask or a domain.";
-                      };
-
-                      addressDescription = mkOption {
-                        type = types.nullOr types.str;
-                        default = null;
-                        description = "An optional description for resource address, usually a full link to the resource including a schema.";
-                      };
-
-                      gatewayGroups = mkOption {
-                        type = types.nonEmptyListOf types.str;
-                        description = "A list of gateway groups (sites) which can reach the resource and may be used to connect to it.";
-                      };
-
-                      filters = mkOption {
-                        type = types.listOf (
-                          types.submodule {
-                            options = {
-                              protocol = mkOption {
-                                type = types.enum [
-                                  "icmp"
-                                  "tcp"
-                                  "udp"
-                                ];
-                                description = "The protocol to allow";
-                              };
-
-                              ports = mkOption {
-                                type = types.listOf typePortRange;
-                                example = [
-                                  443
-                                  {
-                                    from = 8080;
-                                    to = 8100;
-                                  }
-                                ];
-                                default = [ ];
-                                apply =
-                                  xs: map (x: if x.from == x.to then toString x.from else "${toString x.from} - ${toString x.to}") xs;
-                                description = "Either a single port or port range to allow. Both bounds are inclusive.";
-                              };
-                            };
-                          }
-                        );
-                        default = [ ];
-                        description = "A list of filter to restrict traffic. If no filters are given, all traffic is allowed.";
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  vaultwarden = {
-                    type = "dns";
-                    name = "Vaultwarden";
-                    address = "vault.example.com";
-                    address_description = "https://vault.example.com";
-                    gatewayGroups = [ "my-site" ];
-                    filters = [
-                      { protocol = "icmp"; }
-                      {
-                        protocol = "tcp";
-                        ports = [
-                          80
-                          443
-                        ];
-                      }
-                    ];
-                  };
-                };
-                description = ''
-                  All resources to provision. The attribute name will only be used to
-                  track the resource and does not have any significance for Firezone.
-                '';
-              };
-
-              policies = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    options = {
-                      description = mkOption {
-                        type = types.nullOr types.str;
-                        description = "The description of this policy";
-                      };
-
-                      group = mkOption {
-                        type = types.str;
-                        description = "The group which should be allowed access to the given resource.";
-                      };
-
-                      resource = mkOption {
-                        type = types.str;
-                        description = "The resource to which access should be allowed.";
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  access_vaultwarden = {
-                    name = "Allow anyone to access vaultwarden";
-                    group = "everyone";
-                    resource = "vaultwarden";
-                  };
-                };
-                description = ''
-                  All policies to provision. The attribute name will only be used to
-                  track the policy and does not have any significance for Firezone.
-                '';
-              };
-
-              groups = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    options = {
-                      name = mkOption {
-                        type = types.str;
-                        description = "The name of this group";
-                      };
-
-                      members = mkOption {
-                        type = types.listOf types.str;
-                        default = [ ];
-                        description = "The members of this group";
-                      };
-
-                      forceMembers = mkOption {
-                        type = types.bool;
-                        default = false;
-                        description = "Ensure that only the given members are part of this group at every server start.";
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  users = {
-                    name = "Users";
-                  };
-                };
-                description = ''
-                  All groups to provision. The attribute name will only be used
-                  to track the group and does not have any significance for
-                  Firezone.
-
-                  A group named `everyone` will automatically be managed by Firezone.
-                '';
-              };
-
-              relayGroups = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    options = {
-                      name = mkOption {
-                        type = types.str;
-                        description = "The name of this relay group";
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  my-relays = {
-                    name = "My Relays";
-                  };
-                };
-                description = ''
-                  All relay groups to provision. The attribute name
-                  will only be used to track the relay group and does not have any
-                  significance for Firezone.
-                '';
-              };
-
-              gatewayGroups = mkOption {
-                type = types.attrsOf (
-                  types.submodule {
-                    options = {
-                      name = mkOption {
-                        type = types.str;
-                        description = "The name of this gateway group";
-                      };
-                    };
-                  }
-                );
-                default = { };
-                example = {
-                  my-gateways = {
-                    name = "My Gateways";
-                  };
-                };
-                description = ''
-                  All gateway groups (sites) to provision. The attribute name
-                  will only be used to track the gateway group and does not have any
-                  significance for Firezone.
-                '';
-              };
-            };
-          }
-        );
-        default = { };
-        example = {
-          main = {
-            name = "My Account / Organization";
-            metadata.stripe.billing_email = "org@myorg.example.com";
-            features.rest_api = false;
-          };
-        };
-        description = ''
-          All accounts to provision. The attribute name specified here will
-          become the account slug. By using `"{file:/path/to/file}"` as a
-          string value anywhere in these settings, the provisioning script will
-          replace that value with the content of the given file at runtime.
-
-          Please refer to the [Firezone source code](https://github.com/firezone/firezone/blob/main/elixir/apps/domain/lib/domain/accounts/account.ex)
-          for all available properties.
-        '';
-      };
-    };
   };
 
   config = mkMerge [
-    {
-      assertions = [
-        {
-          assertion = cfg.provision.enable -> cfg.domain.enable;
-          message = "Provisioning must be done on a machine running the firezone domain server";
-        }
-      ]
-      ++ concatLists (
-        flip mapAttrsToList cfg.provision.accounts (
-          accountName: accountCfg:
-          [
-            {
-              assertion = (builtins.match "^[[:lower:]_-]+$" accountName) != null;
-              message = "An account name must contain only lowercase characters and underscores, as it will be used as the URL slug for this account.";
-            }
-          ]
-          ++ flip mapAttrsToList accountCfg.auth (
-            authName: _: {
-              assertion = (builtins.match "^[[:alnum:]_-]+$" authName) != null;
-              message = "The authentication provider attribute key must contain only letters, numbers, underscores or dashes.";
-            }
-          )
-        )
-      );
-    }
     # Enable all components if the main server is enabled
     (mkIf cfg.enable {
       services.firezone.server.domain.enable = true;
@@ -1015,7 +583,7 @@ in
           FEATURE_INTERNET_RESOURCE_ENABLED = mkDefault true;
           FEATURE_TRAFFIC_FILTERS_ENABLED = mkDefault true;
 
-          FEATURE_SIGN_UP_ENABLED = mkDefault (!cfg.provision.enable);
+          FEATURE_SIGN_UP_ENABLED = mkDefault true;
 
           WEB_EXTERNAL_URL = mkDefault cfg.web.externalUrl;
           API_EXTERNAL_URL = mkDefault cfg.api.externalUrl;
@@ -1066,19 +634,6 @@ in
         OUTBOUND_EMAIL_SMTP_PASSWORD = cfg.smtp.passwordFile;
       };
     })
-    (mkIf cfg.provision.enable {
-      # Load client secrets from authentication providers
-      services.firezone.server.settingsSecret = flip concatMapAttrs cfg.provision.accounts (
-        accountName: accountCfg:
-        flip concatMapAttrs accountCfg.auth (
-          authName: authCfg:
-          optionalAttrs (authCfg.adapter_config.clientSecretFile != null) {
-            "AUTH_CLIENT_SECRET_${toUpper accountName}_${toUpper authName}" =
-              authCfg.adapter_config.clientSecretFile;
-          }
-        )
-      );
-    })
     (mkIf (cfg.openClusterFirewall && cfg.domain.enable) {
       networking.firewall.allowedTCPPorts = [
         cfg.domain.settings.ERLANG_DISTRIBUTION_PORT
@@ -1156,14 +711,6 @@ in
             fi
             count=$((count++))
           done
-        ''
-        + optionalString cfg.provision.enable ''
-          # Wait for server to fully come up. Not ideal to use sleep, but at least it works.
-          sleep 1
-
-          ${loadSecretEnvironment "domain"}
-          ln -sTf ${provisionStateJson} provision-state.json
-          ${getExe cfg.domain.package} rpc 'Code.eval_file("${./provision.exs}")'
         '';
 
         environment = collectEnvironment "domain";

nixos/modules/services/networking/wpa_supplicant.nix

@@ -565,9 +565,9 @@ in
           coercedTo attrs (
             val:
             if builtins.isAttrs val && val ? enable then
-              trace "Obsolete option `networking.wireless.userControlled.enable' is used. It was renamed to networking.wireless.userControlled" val.enable
+              warn "Obsolete option `networking.wireless.userControlled.enable' is used. It was renamed to networking.wireless.userControlled" val.enable
             else if builtins.isAttrs val && val ? group then
-              trace
+              warn
                 "The option definition `networking.wireless.userControlled.group' no longer has any effect. The group is now fixed to `wpa_supplicant'."
                 (val.enable or false)
             else if builtins.isBool val then

nixos/modules/services/web-apps/lauti.nix

@@ -17,8 +17,6 @@ in
 {
 
   imports = [
-    # since 0.12.0 (2025-05-26) release, upstream re-branded project to 'stalwart' due to inclusion of collaboration features (CalDAV, CardDAV, and WebDAV)
-    #  https://github.com/stalwartlabs/stalwart/releases/tag/v0.12.0
     (lib.mkRenamedOptionModule [ "services" "eintopf" ] [ "services" "lauti" ])
   ];
 

nixos/modules/services/web-apps/wakapi.nix

@@ -196,14 +196,12 @@ in
       }
     ];
 
-    warnings = [
-      (lib.optionalString (cfg.database.createLocally && cfg.settings.db.dialect != "postgres") ''
-        You have enabled automatic database configuration, but the database dialect is not set to "posgres".
+    warnings = lib.optional (cfg.database.createLocally && cfg.settings.db.dialect != "postgres") ''
+      You have enabled automatic database configuration, but the database dialect is not set to "postgres".
 
-        The Wakapi module only supports PostgreSQL. Please set `services.wakapi.database.createLocally`
-        to `false`, or switch to "postgres" as your database dialect.
-      '')
-    ];
+      The Wakapi module only supports PostgreSQL. Please set `services.wakapi.database.createLocally`
+      to `false`, or switch to "postgres" as your database dialect.
+    '';
 
     users = {
       users.wakapi = {

nixos/modules/services/x11/desktop-managers/cde.nix

@@ -71,10 +71,12 @@ in
       };
     };
 
-    system.activationScripts.setup-cde = ''
-      mkdir -p /var/dt/{tmp,appconfig/appmanager}
-      chmod a+w+t /var/dt/{tmp,appconfig/appmanager}
-    '';
+    systemd.tmpfiles.settings."10-cde" = {
+      "/var/dt".d.mode = "0755";
+      "/var/dt/tmp".d.mode = "1777";
+      "/var/dt/appconfig".d.mode = "0755";
+      "/var/dt/appconfig/appmanager".d.mode = "1777";
+    };
 
     services.xserver.desktopManager.session = [
       {

nixos/modules/system/boot/loader/limine/limine.nix

@@ -503,7 +503,9 @@ in
 
         script = ''
           fwupd_efi=(${config.services.fwupd.package.fwupd-efi}/libexec/fwupd/efi/fwupd*.efi)
-          ${lib.getExe cfg.secureBoot.sbctl} sign -o /run/fwupd-efi/$(basename "$fwupd_efi").signed "$fwupd_efi"
+          for efi in "''${fwupd_efi[@]}"; do
+            ${lib.getExe cfg.secureBoot.sbctl} sign -o "/run/fwupd-efi/$(basename "$efi").signed" "$efi"
+          done
         '';
       };
 

nixos/modules/system/boot/systemd.nix

@@ -40,6 +40,7 @@ let
     "network-online.target"
     "nss-lookup.target"
     "nss-user-lookup.target"
+    "time-set.target"
     "time-sync.target"
     "first-boot-complete.target"
   ]
@@ -808,7 +809,7 @@ in
     systemd.targets.remote-fs.unitConfig.X-StopOnReconfiguration = true;
     systemd.services.systemd-importd = lib.mkIf cfg.package.withImportd {
       environment = proxy_env;
-      path = [ pkgs.gnupg ];
+      path = [ pkgs.gnupgMinimal ];
     };
     systemd.services.systemd-pstore.wantedBy = [ "sysinit.target" ]; # see #81138
 

nixos/modules/system/boot/systemd/logind.nix

@@ -64,13 +64,13 @@
     environment.etc."systemd/logind.conf".text =
       utils.systemdUtils.lib.settingsToSections config.services.logind.settings;
 
-    # Restarting systemd-logind breaks X11
+    # Restarting systemd-logind breaks X11 and other user sessions.
+    # However, reloading the service seems to do the trick of loading new configuration without breaking anything.
     # - upstream commit: https://cgit.freedesktop.org/xorg/xserver/commit/?id=dc48bd653c7e101
     # - systemd announcement: https://github.com/systemd/systemd/blob/22043e4317ecd2bc7834b48a6d364de76bb26d91/NEWS#L103-L112
     # - this might be addressed in the future by xorg
     #systemd.services.systemd-logind.restartTriggers = [ config.environment.etc."systemd/logind.conf".source ];
-    systemd.services.systemd-logind.restartIfChanged = false;
-    systemd.services.systemd-logind.stopIfChanged = false;
+    systemd.services.systemd-logind.reloadIfChanged = true;
 
     # The user-runtime-dir@ service is managed by systemd-logind we should not touch it or else we break the users' sessions.
     systemd.services."user-runtime-dir@".stopIfChanged = false;

nixos/modules/system/boot/systemd/sysupdate.nix

@@ -138,7 +138,7 @@ in
 
     systemd.services.systemd-sysupdated = {
       aliases = [ "dbus-org.freedesktop.sysupdate1.service" ];
-      path = [ pkgs.gnupg ];
+      path = [ pkgs.gnupgMinimal ];
     };
 
     systemd.timers = {

nixos/modules/system/boot/systemd/user.nix

@@ -5,16 +5,13 @@
   utils,
   ...
 }:
-with utils;
-with systemdUtils.unitOptions;
-with lib;
 
 let
   cfg = config.systemd.user;
 
   systemd = config.systemd.package;
 
-  inherit (systemdUtils.lib)
+  inherit (utils.systemdUtils.lib)
     generateUnits
     targetToUnit
     serviceToUnit
@@ -53,7 +50,7 @@ let
       user ? null,
     }:
     let
-      suffix = optionalString (user != null) "-${user}";
+      suffix = lib.optionalString (user != null) "-${user}";
     in
     pkgs.writeTextFile {
       name = "nixos-user-tmpfiles.d${suffix}";
@@ -61,74 +58,86 @@ let
       text = ''
         # This file is created automatically and should not be modified.
         # Please change the options ‘systemd.user.tmpfiles’ instead.
-        ${concatStringsSep "\n" rules}
+        ${lib.concatStringsSep "\n" rules}
       '';
     };
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "systemd"
+      "user"
+      "extraConfig"
+    ] "Use systemd.user.settings.Manager instead.")
+  ];
+
   options = {
-    systemd.user.extraConfig = mkOption {
-      default = "";
-      type = types.lines;
-      example = "DefaultTimeoutStartSec=60";
+    systemd.user.settings.Manager = lib.mkOption {
+      default = { };
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf utils.systemdUtils.unitOptions.unitOption;
+      };
+      example = {
+        DefaultTimeoutStartSec = 60;
+      };
       description = ''
-        Extra config options for systemd user instances. See {manpage}`systemd-user.conf(5)` for
-        available options.
+        Settings for systemd user instances. See {manpage}`systemd-user.conf(5)`
+        for available options.
       '';
     };
 
-    systemd.user.units = mkOption {
+    systemd.user.units = lib.mkOption {
       description = "Definition of systemd per-user units.";
       default = { };
-      type = systemdUtils.types.units;
+      type = utils.systemdUtils.types.units;
     };
 
-    systemd.user.paths = mkOption {
+    systemd.user.paths = lib.mkOption {
       default = { };
-      type = systemdUtils.types.paths;
+      type = utils.systemdUtils.types.paths;
       description = "Definition of systemd per-user path units.";
     };
 
-    systemd.user.services = mkOption {
+    systemd.user.services = lib.mkOption {
       default = { };
-      type = systemdUtils.types.services;
+      type = utils.systemdUtils.types.services;
       description = "Definition of systemd per-user service units.";
     };
 
-    systemd.user.slices = mkOption {
+    systemd.user.slices = lib.mkOption {
       default = { };
-      type = systemdUtils.types.slices;
+      type = utils.systemdUtils.types.slices;
       description = "Definition of systemd per-user slice units.";
     };
 
-    systemd.user.sockets = mkOption {
+    systemd.user.sockets = lib.mkOption {
       default = { };
-      type = systemdUtils.types.sockets;
+      type = utils.systemdUtils.types.sockets;
       description = "Definition of systemd per-user socket units.";
     };
 
-    systemd.user.targets = mkOption {
+    systemd.user.targets = lib.mkOption {
       default = { };
-      type = systemdUtils.types.targets;
+      type = utils.systemdUtils.types.targets;
       description = "Definition of systemd per-user target units.";
     };
 
-    systemd.user.timers = mkOption {
+    systemd.user.timers = lib.mkOption {
       default = { };
-      type = systemdUtils.types.timers;
+      type = utils.systemdUtils.types.timers;
       description = "Definition of systemd per-user timer units.";
     };
 
     systemd.user.tmpfiles = {
       enable =
-        (mkEnableOption "systemd user units systemd-tmpfiles-setup.service and systemd-tmpfiles-clean.timer")
+        (lib.mkEnableOption "systemd user units systemd-tmpfiles-setup.service and systemd-tmpfiles-clean.timer")
         // {
           default = true;
           example = false;
         };
 
-      rules = mkOption {
-        type = types.listOf types.str;
+      rules = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         example = [ "D %C - - - 7d" ];
         description = ''
@@ -139,17 +148,17 @@ in
         '';
       };
 
-      users = mkOption {
+      users = lib.mkOption {
         description = ''
           Per-user rules for creation, deletion and cleaning of volatile and
           temporary files automatically.
         '';
         default = { };
-        type = types.attrsOf (
-          types.submodule {
+        type = lib.types.attrsOf (
+          lib.types.submodule {
             options = {
-              rules = mkOption {
-                type = types.listOf types.str;
+              rules = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
                 default = [ ];
                 example = [ "D %C - - - 7d" ];
                 description = ''
@@ -165,8 +174,8 @@ in
       };
     };
 
-    systemd.user.generators = mkOption {
-      type = types.attrsOf types.path;
+    systemd.user.generators = lib.mkOption {
+      type = lib.types.attrsOf lib.types.path;
       default = { };
       example = {
         systemd-gpt-auto-generator = "/dev/null";
@@ -179,9 +188,9 @@ in
       '';
     };
 
-    systemd.additionalUpstreamUserUnits = mkOption {
+    systemd.additionalUpstreamUserUnits = lib.mkOption {
       default = [ ];
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
       example = [ ];
       description = ''
         Additional units shipped with systemd that should be enabled for per-user systemd instances.
@@ -203,29 +212,26 @@ in
         upstreamWants = [ ];
       };
 
-      "systemd/user.conf".text = ''
-        [Manager]
-        ${cfg.extraConfig}
-      '';
+      "systemd/user.conf".text = utils.systemdUtils.lib.settingsToSections cfg.settings;
     };
 
     systemd.user.units =
-      mapAttrs' (n: v: nameValuePair "${n}.path" (pathToUnit v)) cfg.paths
-      // mapAttrs' (n: v: nameValuePair "${n}.service" (serviceToUnit v)) cfg.services
-      // mapAttrs' (n: v: nameValuePair "${n}.slice" (sliceToUnit v)) cfg.slices
-      // mapAttrs' (n: v: nameValuePair "${n}.socket" (socketToUnit v)) cfg.sockets
-      // mapAttrs' (n: v: nameValuePair "${n}.target" (targetToUnit v)) cfg.targets
-      // mapAttrs' (n: v: nameValuePair "${n}.timer" (timerToUnit v)) cfg.timers;
+      lib.mapAttrs' (n: v: lib.nameValuePair "${n}.path" (pathToUnit v)) cfg.paths
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.service" (serviceToUnit v)) cfg.services
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.slice" (sliceToUnit v)) cfg.slices
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.socket" (socketToUnit v)) cfg.sockets
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.target" (targetToUnit v)) cfg.targets
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.timer" (timerToUnit v)) cfg.timers;
 
     systemd.user.timers = {
       # enable systemd user tmpfiles
-      systemd-tmpfiles-clean.wantedBy = optional cfg.tmpfiles.enable "timers.target";
+      systemd-tmpfiles-clean.wantedBy = lib.optional cfg.tmpfiles.enable "timers.target";
     }
     # Generate timer units for all services that have a ‘startAt’ value.
-    // (mapAttrs (name: service: {
+    // (lib.mapAttrs (name: service: {
       wantedBy = [ "timers.target" ];
       timerConfig.OnCalendar = service.startAt;
-    }) (filterAttrs (name: service: service.startAt != [ ]) cfg.services));
+    }) (lib.filterAttrs (name: service: service.startAt != [ ]) cfg.services));
 
     # Provide the systemd-user PAM service, required to run systemd
     # user instances.
@@ -244,18 +250,19 @@ in
     systemd.services.systemd-user-sessions.restartIfChanged = false; # Restart kills all active sessions.
 
     # enable systemd user tmpfiles
-    systemd.user.services.systemd-tmpfiles-setup.wantedBy = optional cfg.tmpfiles.enable "basic.target";
+    systemd.user.services.systemd-tmpfiles-setup.wantedBy =
+      lib.optional cfg.tmpfiles.enable "basic.target";
 
     # /run/current-system/sw/etc/xdg is in systemd's $XDG_CONFIG_DIRS so we can
     # write the tmpfiles.d rules for everyone there
-    environment.systemPackages = optional (cfg.tmpfiles.rules != [ ]) (writeTmpfiles {
+    environment.systemPackages = lib.optional (cfg.tmpfiles.rules != [ ]) (writeTmpfiles {
       inherit (cfg.tmpfiles) rules;
     });
 
     # /etc/profiles/per-user/$USER/etc/xdg is in systemd's $XDG_CONFIG_DIRS so
     # we can write a single user's tmpfiles.d rules there
-    users.users = mapAttrs (user: cfg': {
-      packages = optional (cfg'.rules != [ ]) (writeTmpfiles {
+    users.users = lib.mapAttrs (user: cfg': {
+      packages = lib.optional (cfg'.rules != [ ]) (writeTmpfiles {
         inherit (cfg') rules;
         inherit user;
       });

nixos/modules/testing/test-instrumentation.nix

@@ -238,11 +238,11 @@ in
     '';
 
     systemd.settings.Manager = managerSettings;
-    systemd.user.extraConfig = ''
+    systemd.user.settings.Manager = {
       # Allow very slow start
-      DefaultTimeoutStartSec=300
-      DefaultDeviceTimeoutSec=300
-    '';
+      DefaultTimeoutStartSec = 300;
+      DefaultDeviceTimeoutSec = 300;
+    };
 
     boot.consoleLogLevel = 7;
 

nixos/modules/virtualisation/qemu-vm.nix

@@ -1379,7 +1379,6 @@ in
         "-device usb-tablet,bus=usb-bus.0"
       ])
       (mkIf pkgs.stdenv.hostPlatform.isAarch [
-        "-device virtio-gpu-pci"
         "-device usb-ehci,id=usb0"
         "-device usb-kbd"
         "-device usb-tablet"

nixos/tests/all-tests.nix

@@ -695,6 +695,7 @@ in
   grocy = runTest ./grocy.nix;
   grow-partition = runTest ./grow-partition.nix;
   grub = runTest ./grub.nix;
+  gs1200-exporter = runTest ./gs1200-exporter.nix;
   guacamole-server = runTest ./guacamole-server.nix;
   guix = handleTest ./guix { };
   gvisor = runTest ./gvisor.nix;
@@ -1489,6 +1490,7 @@ in
   sane = runTest ./sane.nix;
   sanoid = runTest ./sanoid.nix;
   saunafs = runTest ./saunafs.nix;
+  scanservjs = runTest ./scanservjs.nix;
   scaphandre = runTest ./scaphandre.nix;
   schleuder = runTest ./schleuder.nix;
   scion-freestanding-deployment = runTest ./scion/freestanding-deployment;
@@ -1670,6 +1672,7 @@ in
   systemd-timesyncd-nscd-dnssec = runTest ./systemd-timesyncd-nscd-dnssec.nix;
   systemd-user-linger = runTest ./systemd-user-linger.nix;
   systemd-user-linger-purge = runTest ./systemd-user-linger-purge.nix;
+  systemd-user-settings = runTest ./systemd-user-settings.nix;
   systemd-user-tmpfiles-rules = runTest ./systemd-user-tmpfiles-rules.nix;
   systemd-userdbd = runTest ./systemd-userdbd.nix;
   systemtap = handleTest ./systemtap.nix { };

nixos/tests/firezone/create-tokens.exs

@@ -1,86 +0,0 @@
-alias Domain.{Repo, Accounts, Auth, Actors, Tokens}
-
-mappings = case File.read("provision-uuids.json") do
-{:ok, content} ->
-  case Jason.decode(content) do
-    {:ok, mapping} -> mapping
-    _ -> %{"accounts" => %{}}
-  end
-_ -> %{"accounts" => %{}}
-end
-
-IO.puts("INFO: Fetching account")
-{:ok, account} = Accounts.fetch_account_by_id_or_slug("main")
-
-IO.puts("INFO: Fetching email provider")
-{:ok, email_provider} = Auth.Provider.Query.not_disabled()
-  |> Auth.Provider.Query.by_adapter(:email)
-  |> Auth.Provider.Query.by_account_id(account.id)
-  |> Repo.fetch(Auth.Provider.Query, [])
-
-temp_admin_actor_email = "firezone-provision@localhost.local"
-temp_admin_actor_context = %Auth.Context{
-  type: :browser,
-  user_agent: "Unspecified/0.0",
-  remote_ip: {127, 0, 0, 1},
-  remote_ip_location_region: "N/A",
-  remote_ip_location_city: "N/A",
-  remote_ip_location_lat: 0.0,
-  remote_ip_location_lon: 0.0
-}
-
-{:ok, temp_admin_actor} =
-  Actors.create_actor(account, %{
-    type: :account_admin_user,
-    name: "Token Provisioning"
-  })
-
-{:ok, temp_admin_actor_email_identity} =
-  Auth.create_identity(temp_admin_actor, email_provider, %{
-    provider_identifier: temp_admin_actor_email,
-    provider_identifier_confirmation: temp_admin_actor_email
-  })
-
-{:ok, temp_admin_actor_token} =
-  Auth.create_token(temp_admin_actor_email_identity, temp_admin_actor_context, "temporarynonce", DateTime.utc_now() |> DateTime.add(1, :hour))
-
-{:ok, temp_admin_subject} =
-  Auth.build_subject(temp_admin_actor_token, temp_admin_actor_context)
-
-{:ok, relay_group_token} =
-  Tokens.create_token(%{
-    "type" => :relay_group,
-	"expires_at" => DateTime.utc_now() |> DateTime.add(1, :hour),
-    "secret_fragment" => Domain.Crypto.random_token(32, encoder: :hex32),
-    "relay_group_id" => get_in(mappings, ["accounts", "main", "relay_groups", "my-relays"])
-  })
-
-relay_group_encoded_token = Tokens.encode_fragment!(relay_group_token)
-IO.puts("Created relay token: #{relay_group_encoded_token}")
-File.write("relay_token.txt", relay_group_encoded_token)
-
-{:ok, gateway_group_token} =
-  Tokens.create_token(%{
-    "type" => :gateway_group,
-    "expires_at" => DateTime.utc_now() |> DateTime.add(1, :hour),
-    "secret_fragment" => Domain.Crypto.random_token(32, encoder: :hex32),
-    "account_id" => get_in(mappings, ["accounts", "main", "id"]),
-    "gateway_group_id" => get_in(mappings, ["accounts", "main", "gateway_groups", "site"])
-  }, temp_admin_subject)
-
-gateway_group_encoded_token = Tokens.encode_fragment!(gateway_group_token)
-IO.puts("Created gateway group token: #{gateway_group_encoded_token}")
-File.write("gateway_token.txt", gateway_group_encoded_token)
-
-{:ok, service_account_actor_token} =
-  Tokens.create_token(%{
-    "type" => :client,
-    "expires_at" => DateTime.utc_now() |> DateTime.add(1, :hour),
-    "secret_fragment" => Domain.Crypto.random_token(32, encoder: :hex32),
-    "account_id" => get_in(mappings, ["accounts", "main", "id"]),
-    "actor_id" => get_in(mappings, ["accounts", "main", "actors", "client"])
-  })
-
-service_account_actor_encoded_token = Tokens.encode_fragment!(service_account_actor_token)
-IO.puts("Created service actor token: #{service_account_actor_encoded_token}")
-File.write("client_token.txt", service_account_actor_encoded_token)

nixos/tests/firezone/firezone.nix

@@ -84,89 +84,15 @@ in
             passwordFile = pkgs.writeText "tmpmailpasswd" "verysecurepassword";
           };
 
-          provision = {
-            enable = true;
-            accounts.main = {
-              name = "My Account";
-              relayGroups.my-relays.name = "Relays";
-              gatewayGroups.site.name = "Site";
-              actors = {
-                admin = {
-                  type = "account_admin_user";
-                  name = "Admin";
-                  email = "admin@localhost.localdomain";
-                };
-                client = {
-                  type = "service_account";
-                  name = "A client";
-                  email = "client@example.com";
-                };
-              };
-              # service accounts aren't members of 'Everyone' so we need to add a separate group
-              groups.main = {
-                name = "main";
-                members = [
-                  "client"
-                  "admin"
-                ];
-              };
-              resources.res1 = {
-                type = "dns";
-                name = "Dns Resource";
-                address = "resource.example.com";
-                gatewayGroups = [ "site" ];
-                filters = [
-                  { protocol = "icmp"; }
-                  {
-                    protocol = "tcp";
-                    ports = [ 80 ];
-                  }
-                ];
-              };
-              resources.res2 = {
-                type = "ip";
-                name = "Ip Resource";
-                address = "172.20.2.1";
-                gatewayGroups = [ "site" ];
-              };
-              resources.res3 = {
-                type = "cidr";
-                name = "Cidr Resource";
-                address = "172.20.1.0/24";
-                gatewayGroups = [ "site" ];
-              };
-              policies.pol1 = {
-                description = "Allow anyone res1 access";
-                group = "main";
-                resource = "res1";
-              };
-              policies.pol2 = {
-                description = "Allow anyone res2 access";
-                group = "main";
-                resource = "res2";
-              };
-              policies.pol3 = {
-                description = "Allow anyone res3 access";
-                group = "main";
-                resource = "res3";
-              };
-            };
-          };
-
           api.externalUrl = "https://${domain}/api/";
           web.externalUrl = "https://${domain}/";
         };
-
-        systemd.services.firezone-server-domain.postStart = lib.mkAfter ''
-          ${lib.getExe config.services.firezone.server.domain.package} rpc 'Code.eval_file("${./create-tokens.exs}")'
-        '';
       };
 
     relay =
       {
         nodes,
         config,
-        lib,
         ...
       }:
       {
@@ -181,14 +107,11 @@ in
           logLevel = "debug";
           name = "test-relay";
           apiUrl = "wss://${domain}/api/";
-          tokenFile = "/tmp/shared/relay_token.txt";
+          tokenFile = pkgs.writeText "token" "token";
           publicIpv4 = config.networking.primaryIPAddress;
           publicIpv6 = config.networking.primaryIPv6Address;
           openFirewall = true;
         };
-
-        # Don't auto-start so we can wait until the token was provisioned
-        systemd.services.firezone-relay.wantedBy = lib.mkForce [ ];
       };
 
     # A resource that is only connected to the gateway,
@@ -300,11 +223,8 @@ in
           logLevel = "debug";
           name = "test-gateway";
           apiUrl = "wss://${domain}/api/";
-          tokenFile = "/tmp/shared/gateway_token.txt";
+          tokenFile = pkgs.writeText "token" "token";
         };
-
-        # Don't auto-start so we can wait until the token was provisioned
-        systemd.services.firezone-gateway.wantedBy = lib.mkForce [ ];
       };
 
     client =
@@ -326,11 +246,8 @@ in
           logLevel = "debug";
           name = "test-client-somebody";
           apiUrl = "wss://${domain}/api/";
-          tokenFile = "/tmp/shared/client_token.txt";
+          tokenFile = pkgs.writeText "token" "token";
         };
-
-        # Don't auto-start so we can wait until the token was provisioned
-        systemd.services.firezone-headless-client.wantedBy = lib.mkForce [ ];
       };
   };
 
@@ -344,43 +261,13 @@ in
           server.wait_until_succeeds("curl -Lsf https://${domain} | grep 'Welcome to Firezone'")
           server.wait_until_succeeds("curl -Ls https://${domain}/api | grep 'Not Found'")
 
-          # Wait for tokens and copy them to shared folder
-          server.wait_for_file("/var/lib/private/firezone/relay_token.txt")
-          server.wait_for_file("/var/lib/private/firezone/gateway_token.txt")
-          server.wait_for_file("/var/lib/private/firezone/client_token.txt")
-          server.succeed("cp /var/lib/private/firezone/*_token.txt /tmp/shared")
-
       with subtest("Connect relay"):
-          relay.succeed("systemctl start firezone-relay")
           relay.wait_for_unit("firezone-relay.service")
-          relay.wait_until_succeeds("journalctl --since -2m --unit firezone-relay.service --grep 'Connected to portal.*${domain}'", timeout=30)
 
       with subtest("Connect gateway"):
-          gateway.succeed("systemctl start firezone-gateway")
           gateway.wait_for_unit("firezone-gateway.service")
-          gateway.wait_until_succeeds("journalctl --since -2m --unit firezone-gateway.service --grep 'Connected to portal.*${domain}'", timeout=30)
-          relay.wait_until_succeeds("journalctl --since -2m --unit firezone-relay.service --grep 'Created allocation.*IPv4'", timeout=30)
-          relay.wait_until_succeeds("journalctl --since -2m --unit firezone-relay.service --grep 'Created allocation.*IPv6'", timeout=30)
-
-          # Assert both relay ips are known
-          gateway.wait_until_succeeds("journalctl --since -2m --unit firezone-gateway.service --grep 'Updated allocation.*relay_ip4.*Some.*relay_ip6.*Some'", timeout=30)
 
       with subtest("Connect headless-client"):
-          client.succeed("systemctl start firezone-headless-client")
           client.wait_for_unit("firezone-headless-client.service")
-          client.wait_until_succeeds("journalctl --since -2m --unit firezone-headless-client.service --grep 'Connected to portal.*${domain}'", timeout=30)
-          client.wait_until_succeeds("journalctl --since -2m --unit firezone-headless-client.service --grep 'Tunnel ready'", timeout=30)
-
-      with subtest("Check DNS based access"):
-          # Check that we can access the resource through the VPN via DNS
-          client.wait_until_succeeds("curl -4 -Lsf http://resource.example.com | grep 'greetings from the resource'")
-
-      with subtest("Check CIDR based access"):
-          # Check that we can access the resource through the VPN via CIDR
-          client.wait_until_succeeds("ping -c1 -W1 172.20.1.1")
-
-      with subtest("Check IP based access"):
-          # Check that we can access the resource through the VPN via IP
-          client.wait_until_succeeds("ping -c1 -W1 172.20.2.1")
     '';
 }

nixos/tests/gs1200-exporter.nix

@@ -0,0 +1,20 @@
+{ lib, ... }:
+{
+  name = "gs1200-exporter";
+  meta.maintainers = with lib.maintainers; [ DerGrumpf ];
+  nodes.machine = _: {
+    services.gs1200-exporter = {
+      enable = true;
+      address = "192.168.2.4";
+      passwordFile = "/run/secrets/gs1200-password";
+    };
+    systemd.tmpfiles.rules = [
+      "f /run/secrets/gs1200-password 0400 root root - testpassword"
+    ];
+  };
+  testScript = ''
+    machine.wait_for_unit("gs1200-exporter.service")
+    machine.wait_for_open_port(9934)
+    machine.succeed("curl -f http://localhost:9934/metrics")
+  '';
+}

nixos/tests/matrix/mautrix-discord.nix

@@ -1,4 +1,4 @@
-{ pkgs, lib, ... }:
+{ pkgs, ... }:
 let
   homeserverUrl = "http://homeserver:8008";
 in
@@ -53,6 +53,7 @@ in
 
             appservice = {
               address = "http://homeserver:8009";
+              hostname = "0.0.0.0";
               port = 8009;
               id = "discord";
               bot = {
@@ -60,8 +61,6 @@ in
                 displayname = "Discord bridge bot";
                 avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
               };
-              # Don't override as_token/hs_token - let them use the default placeholder
-              # which will trigger automatic generation
 
               database = {
                 type = "sqlite3";
@@ -75,6 +74,17 @@ in
                 "*" = "relay";
               };
             };
+
+            logging = {
+              min_level = "info";
+              writers = [
+                {
+                  type = "stdout";
+                  format = "pretty-colored";
+                  time_format = " ";
+                }
+              ];
+            };
           };
         };
 
@@ -157,6 +167,57 @@ in
     with subtest("verify registration file was created"):
         homeserver.wait_until_succeeds("test -f /var/lib/mautrix-discord/discord-registration.yaml")
 
+        # Verify the module wrote the expected bridge configuration.
+        config_homeserver_address = homeserver.succeed("yq -r '.homeserver.address' /var/lib/mautrix-discord/config.yaml").strip()
+        config_homeserver_domain = homeserver.succeed("yq -r '.homeserver.domain' /var/lib/mautrix-discord/config.yaml").strip()
+        config_appservice_address = homeserver.succeed("yq -r '.appservice.address' /var/lib/mautrix-discord/config.yaml").strip()
+        config_appservice_hostname = homeserver.succeed("yq -r '.appservice.hostname' /var/lib/mautrix-discord/config.yaml").strip()
+        config_appservice_port = homeserver.succeed("yq -r '.appservice.port' /var/lib/mautrix-discord/config.yaml").strip()
+        config_appservice_id = homeserver.succeed("yq -r '.appservice.id' /var/lib/mautrix-discord/config.yaml").strip()
+        config_bot_username = homeserver.succeed("yq -r '.appservice.bot.username' /var/lib/mautrix-discord/config.yaml").strip()
+        config_bot_displayname = homeserver.succeed("yq -r '.appservice.bot.displayname' /var/lib/mautrix-discord/config.yaml").strip()
+        config_bot_avatar = homeserver.succeed("yq -r '.appservice.bot.avatar' /var/lib/mautrix-discord/config.yaml").strip()
+        config_database_type = homeserver.succeed("yq -r '.appservice.database.type' /var/lib/mautrix-discord/config.yaml").strip()
+        config_database_uri = homeserver.succeed("yq -r '.appservice.database.uri' /var/lib/mautrix-discord/config.yaml").strip()
+        config_permission = homeserver.succeed("yq -r '.bridge.permissions[\"*\"]' /var/lib/mautrix-discord/config.yaml").strip()
+        config_logging_min_level = homeserver.succeed("yq -r '.logging.min_level' /var/lib/mautrix-discord/config.yaml").strip()
+        config_logging_writer_type = homeserver.succeed("yq -r '.logging.writers[0].type' /var/lib/mautrix-discord/config.yaml").strip()
+        config_logging_writer_format = homeserver.succeed("yq -r '.logging.writers[0].format' /var/lib/mautrix-discord/config.yaml").strip()
+        reg_rate_limited = homeserver.succeed("yq -r '.rate_limited' /var/lib/mautrix-discord/discord-registration.yaml").strip()
+
+        assert config_homeserver_address == "http://homeserver:8008", \
+          f"Unexpected homeserver address: {config_homeserver_address}"
+        assert config_homeserver_domain == "homeserver", \
+          f"Unexpected homeserver domain: {config_homeserver_domain}"
+        assert config_appservice_address == "http://homeserver:8009", \
+          f"Unexpected appservice address: {config_appservice_address}"
+        assert config_appservice_hostname == "0.0.0.0", \
+          f"Unexpected appservice hostname: {config_appservice_hostname}"
+        assert config_appservice_port == "8009", \
+          f"Unexpected appservice port: {config_appservice_port}"
+        assert config_appservice_id == "discord", \
+          f"Unexpected appservice id: {config_appservice_id}"
+        assert config_bot_username == "discordbot", \
+          f"Unexpected bot username: {config_bot_username}"
+        assert config_bot_displayname == "Discord bridge bot", \
+          f"Unexpected bot displayname: {config_bot_displayname}"
+        assert config_bot_avatar == "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC", \
+          f"Unexpected bot avatar: {config_bot_avatar}"
+        assert config_database_type == "sqlite3-fk-wal", \
+          f"Unexpected database type: {config_database_type}"
+        assert config_database_uri == "file:/var/lib/mautrix-discord/mautrix-discord.db?_txlock=immediate", \
+          f"Unexpected database uri: {config_database_uri}"
+        assert config_permission == "relay", \
+          f"Unexpected default permission mapping: {config_permission}"
+        assert config_logging_min_level == "info", \
+          f"Unexpected logging min_level: {config_logging_min_level}"
+        assert config_logging_writer_type == "stdout", \
+          f"Unexpected logging writer type: {config_logging_writer_type}"
+        assert config_logging_writer_format == "pretty-colored", \
+          f"Unexpected logging writer format: {config_logging_writer_format}"
+        assert reg_rate_limited == "false", \
+          f"Registration file should disable rate limiting by default, got: {reg_rate_limited}"
+
         # Verify tokens were generated and are not default values
         config_as_token = homeserver.succeed("yq -r '.appservice.as_token' /var/lib/mautrix-discord/config.yaml").strip()
         config_hs_token = homeserver.succeed("yq -r '.appservice.hs_token' /var/lib/mautrix-discord/config.yaml").strip()

nixos/tests/prometheus-exporters.nix

@@ -436,6 +436,30 @@ let
         '';
       };
 
+    elasticsearch =
+      { ... }:
+      {
+        exporterConfig = {
+          enable = true;
+          url = "http://localhost:9200";
+        };
+        metricProvider = {
+          # `services.elasticsearch` is unmaintained; OpenSearch is the same
+          # engine class and is explicitly supported by the exporter.
+          services.opensearch.enable = true;
+          virtualisation.memorySize = 2048;
+        };
+        exporterTest = ''
+          wait_for_unit("opensearch.service")
+          wait_for_open_port(9200)
+          wait_for_unit("prometheus-elasticsearch-exporter.service")
+          wait_for_open_port(9114)
+          succeed(
+              "curl -sSf localhost:9114/metrics | grep 'elasticsearch_cluster_health_status'"
+          )
+        '';
+      };
+
     fail2ban =
       { ... }:
       {

nixos/tests/qgis.nix

@@ -56,7 +56,7 @@ import ./make-test-python.nix (
               StandardError = "journal";
               StandardInput = "socket";
               Environment = [
-                "QT_QPA_PLATFORM_PLUGIN_PATH=${pkgs.libsForQt5.qt5.qtbase}/${pkgs.libsForQt5.qt5.qtbase.qtPluginPrefix}/platforms"
+                "QT_QPA_PLATFORM_PLUGIN_PATH=${pkgs.qt5.qtbase}/${pkgs.qt5.qtbase.qtPluginPrefix}/platforms"
                 "QGIS_SERVER_LOG_LEVEL=0"
                 "QGIS_SERVER_LOG_STDERR=1"
               ];

nixos/tests/scanservjs.nix

@@ -0,0 +1,23 @@
+let
+  port = 1234;
+in
+{
+  name = "scanservjs";
+
+  nodes.machine =
+    { ... }:
+    {
+      services.scanservjs = {
+        enable = true;
+        settings.host = "0.0.0.0";
+        settings.port = port;
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("scanservjs.service")
+    machine.wait_until_succeeds(
+        "curl --silent --fail --show-error --location http://localhost:${toString port}"
+    )
+  '';
+}

nixos/tests/shadps4.nix

@@ -88,6 +88,9 @@
 
         machine.succeed("shadps4 /etc/openorbis-sample-packages/OpenOrbis-PNG-Sample/uroot/eboot.bin >&2 &")
 
+        machine.wait_for_text("Save Migration")
+        machine.succeed("xdotool mousemove 879 182 click 1")
+
         # Look for logo
         with machine.nested("Waiting for the screen to have openorbisColor {} on it:".format(openorbisColor)):
             retry(check_for_color(openorbisColor))

nixos/tests/stalwart/stalwart.nix

@@ -79,7 +79,6 @@ in
   meta = {
     maintainers = with lib.maintainers; [
       happysalada
-      euxane
       onny
     ];
   };

nixos/tests/systemd-initrd-luks-fido2.nix

@@ -38,7 +38,6 @@
           };
         };
         virtualisation.rootDevice = "/dev/mapper/cryptroot";
-        virtualisation.fileSystems."/".autoFormat = true;
       };
     };
 
@@ -52,6 +51,8 @@
       # Create encrypted volume
       machine.wait_for_unit("multi-user.target")
       machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+      machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdb cryptroot")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
       machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --fido2-device=auto /dev/vdb |& systemd-cat")
 
       # Boot from the encrypted disk

nixos/tests/systemd-initrd-luks-unl0kr.nix

@@ -73,7 +73,6 @@ in
           cryptroot2.device = "/dev/vdc";
         };
         virtualisation.rootDevice = "/dev/mapper/cryptroot";
-        virtualisation.fileSystems."/".autoFormat = true;
         # test mounting device unlocked in initrd after switching root
         virtualisation.fileSystems."/cryptroot2" = {
           device = "/dev/mapper/cryptroot2";
@@ -100,7 +99,7 @@ in
       machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
 
       # Boot from the encrypted disk
-        machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
+      machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
       machine.succeed("sync")
       machine.crash()
 

nixos/tests/systemd-user-settings.nix

@@ -0,0 +1,24 @@
+{
+  name = "systemd-user-settings";
+  meta = {
+    maintainers = [ ];
+  };
+
+  nodes.machine =
+    { lib, ... }:
+    {
+      systemd.user.settings.Manager = {
+        DefaultTimeoutStartSec = lib.mkForce "60";
+        DefaultEnvironment = "FOO=bar";
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("settings.Manager renders user.conf"):
+      machine.succeed("grep -F '[Manager]' /etc/systemd/user.conf")
+      machine.succeed("grep -F 'DefaultTimeoutStartSec=60' /etc/systemd/user.conf")
+      machine.succeed("grep -F 'DefaultEnvironment=FOO=bar' /etc/systemd/user.conf")
+  '';
+}

nixos/tests/systemd.nix

@@ -34,7 +34,7 @@
         RebootWatchdogSec = "10min";
         KExecWatchdogSec = "5min";
       };
-      systemd.user.extraConfig = "DefaultEnvironment=\"XXX_USER=bar\"";
+      systemd.user.settings.Manager.DefaultEnvironment = "\"XXX_USER=bar\"";
       services.journald.extraConfig = "Storage=volatile";
       test-support.displayManager.auto.user = "alice";
 

nixos/tests/wordpress.nix

@@ -87,9 +87,9 @@ rec {
       )
       { }
       [
-        "6_7"
         "6_8"
         "6_9"
+        "7_0"
       ];
 
   testScript = ''

pkgs/applications/editors/android-studio/default.nix

@@ -16,9 +16,9 @@ let
       inherit tiling_wm;
     };
   stableVersion = {
-    version = "2025.3.4.7"; # "Android Studio Panda 4 | 2025.3.4 Patch 1"
-    sha256Hash = "sha256-qujzMvEkr9I8pJXcdwkVpFbadIDI+FngFTWtQvy0ygY=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.4.7/android-studio-panda4-patch1-linux.tar.gz";
+    version = "2026.1.1.8"; # "Android Studio Quail 1 | 2026.1.1"
+    sha256Hash = "sha256-DB+kujz6vQfkipDgCl+i6iqCzVhwgz2tpbApDIF9g9M=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.8/android-studio-quail1-linux.tar.gz";
   };
   betaVersion = {
     version = "2026.1.1.7"; # "Android Studio Quail 1 | 2026.1.1 RC 2"

pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix

@@ -13,13 +13,13 @@ let
 
   pname = "ghostel";
 
-  version = "0.31.0-unstable-2026-06-01";
+  version = "0.33.0-unstable-2026-06-06";
 
   src = fetchFromGitHub {
     owner = "dakra";
     repo = "ghostel";
-    rev = "09aad9fefffce6370256a9888a1ed4f77535fcfd";
-    hash = "sha256-CKN0m+DVvxJhLkr/Hi/44w0m+kJVrx28axLCKLogIQs=";
+    rev = "a614f0f30d8a65da928a840e62cc9b2c6a1381af";
+    hash = "sha256-vG7JfgXUm6b1zf0WgyDlvy29wpTvcI/X74NP8s66c/4=";
   };
 
   module = stdenv.mkDerivation (finalAttrs: {
@@ -28,7 +28,7 @@ let
     deps = zig.fetchDeps {
       inherit (finalAttrs) src pname version;
       fetchAll = true;
-      hash = "sha256-ghN/UMACgkFQQEr4nH5gbbJbt/+2bz6tL2bJpbw9mGE=";
+      hash = "sha256-CTsG3dXu3DECDbklBAtr2fYou82WNvQ1Q3JET0TmuyM=";
     };
 
     nativeBuildInputs = [ zig ];

pkgs/applications/editors/emacs/make-emacs.nix

@@ -238,6 +238,8 @@ stdenv.mkDerivation (finalAttrs: {
     ""
   ];
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     makeWrapper
     pkg-config
@@ -246,10 +248,10 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals srcRepo [
     autoreconfHook
   ]
-  ++ lib.optionals (withPgtk || withX && (withGTK3 || withXwidgets)) [ wrapGAppsHook3 ];
+  ++ lib.optionals (withPgtk || withX && (withGTK3 || withXwidgets)) [ wrapGAppsHook3 ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ sigtool ];
 
   buildInputs = [
-    gettext
     gnutls
     (lib.getDev harfbuzz)
   ]
@@ -339,9 +341,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals withWebkitgtk [
     webkitgtk_4_1
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    sigtool
-  ]
   ++ lib.optionals withNS [
     librsvg
   ]
@@ -409,6 +408,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.withFeature withSelinux "selinux")
   ];
 
+  __structuredAttrs = true;
+
   env =
     lib.optionalAttrs withNativeCompilation {
       NATIVE_FULL_AOT = "1";

pkgs/applications/editors/jetbrains/ides/datagrip.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.2.tar.gz";
-      hash = "sha256-DaAqg6Xce1RkvEM6++7CxC72AvB1SHKFBWOzJD9RIuY=";
+      url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3.tar.gz";
+      hash = "sha256-XxwvXiaWAfK318BjbzKPLVDeMBlOr5BFuD2bqU8+12o=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.2-aarch64.tar.gz";
-      hash = "sha256-QY7ZX4OiON7km4wjBEDCIcD8HxALAW9PRAHJNZ0t+YM=";
+      url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3-aarch64.tar.gz";
+      hash = "sha256-G+tinD/+qM5HVR4u2E0cNXtdVsbwgK8/PdZ3ic6hf4M=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.2.dmg";
-      hash = "sha256-CdhVxjc7wbvTSA/RU39bnek6kU3/G8z9Tj2uEadsZKA=";
+      url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3.dmg";
+      hash = "sha256-vW2LEonl0D9S0VxbeJX4jRrwhELGBwlOXwiHslvh06E=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.2-aarch64.dmg";
-      hash = "sha256-rMiVEmkbJIIeBfOXpPVXFBFLmkW6TLnzsPCheQWszhc=";
+      url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3-aarch64.dmg";
+      hash = "sha256-Kyt3fYPXzwTVxPFVKd+atiHWb/i7gjGahz1MJ4iXxy8=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
   product = "DataGrip";
 
   # update-script-start: version
-  version = "2026.1.2";
-  buildNumber = "261.23567.23";
+  version = "2026.1.3";
+  buildNumber = "261.24374.56";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/dataspell.nix

@@ -14,20 +14,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/python/dataspell-2026.1.tar.gz";
-      hash = "sha256-FcbflBzHsSWvkXVtrlltvb3PjihP91s0gm3wmV3zuRA=";
+      url = "https://download.jetbrains.com/python/dataspell-2026.1.2.tar.gz";
+      hash = "sha256-D5eONrO+5EL1cuskUU4cRYLgcbG7RCvlucnmw9t2COM=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/python/dataspell-2026.1-aarch64.tar.gz";
-      hash = "sha256-JKAW0YtwNDjk3Un4e/cWipreAI8pJaJgLNvx7oOw4RQ=";
+      url = "https://download.jetbrains.com/python/dataspell-2026.1.2-aarch64.tar.gz";
+      hash = "sha256-SSmIPF0pDMolxeXL21UaHMbZdtYbChWVxTKZOsPhH+I=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/python/dataspell-2026.1.dmg";
-      hash = "sha256-w/nFLddHi/l7VqQKngxhYm/LL49eiawXhK+xGBU6Ej0=";
+      url = "https://download.jetbrains.com/python/dataspell-2026.1.2.dmg";
+      hash = "sha256-2qzwzGMYuy1qEuTprxwNa5gOPgCZq2MadSKN8FT8w8c=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/python/dataspell-2026.1-aarch64.dmg";
-      hash = "sha256-/yZpE2aY07AedubVG6yarO4uObdaIZ4KCtKl9DaRU4c=";
+      url = "https://download.jetbrains.com/python/dataspell-2026.1.2-aarch64.dmg";
+      hash = "sha256-MGWufS0nlswdqhACNQWtlXJwfPiYw8wUx7olIxPS15k=";
     };
   };
   # update-script-end: urls
@@ -41,8 +41,8 @@ mkJetBrainsProduct {
   product = "DataSpell";
 
   # update-script-start: version
-  version = "2026.1";
-  buildNumber = "261.22158.332";
+  version = "2026.1.2";
+  buildNumber = "261.25134.18";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/gateway.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.2.tar.gz";
-      hash = "sha256-9NEHD9FXekwjRHTrPMeK4xU4sHnXPge+wRXyCFMmPBk=";
+      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3.tar.gz";
+      hash = "sha256-HizogKH6goX1NdcI/Fj4YsCRzDWfFvQGYSaMM9wVDCA=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.2-aarch64.tar.gz";
-      hash = "sha256-M7XiLlIl7JFKbARb9Zli0c3cHUo2X0nPVrGhs3pK2bQ=";
+      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3-aarch64.tar.gz";
+      hash = "sha256-CSe04BBo4jS1cIhu4NfZqaSHMaNue2eFUPa+1gOxuoo=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.2.dmg";
-      hash = "sha256-Wuuj6/K/5xoM9+d59IGzBo19iOJusbIMigoflPLQ+ts=";
+      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3.dmg";
+      hash = "sha256-WKwIP19y5EKO98JgEm468ofaRp/JO5z8lqNhtpsH4tY=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.2-aarch64.dmg";
-      hash = "sha256-ADWFPMC4ptj2mZk4RJgtIQjOT2xwOkL67UahoKte6mQ=";
+      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3-aarch64.dmg";
+      hash = "sha256-AHY/lY0ARkW0VoSgy0t7LLNXA965PLooWBSWxBKBV5M=";
     };
   };
   # update-script-end: urls
@@ -40,8 +40,8 @@ mkJetBrainsProduct {
   productShort = "Gateway";
 
   # update-script-start: version
-  version = "2026.1.2";
-  buildNumber = "261.24374.120";
+  version = "2026.1.3";
+  buildNumber = "261.25134.98";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/idea.nix

@@ -15,20 +15,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.1.tar.gz";
-      hash = "sha256-eljThvKi5ajNfkWRZXtP5ZmurCLZYMesz1+SeEZQe/s=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.3.tar.gz";
+      hash = "sha256-pvBJcW2h0J2eDsFQDGC/AaX/ig/iQZF43R/y/bK3dWM=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.1-aarch64.tar.gz";
-      hash = "sha256-jnVqDCmBix3njTxDga0aG89C9fvDW70gnE3I/nvHtXA=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.3-aarch64.tar.gz";
+      hash = "sha256-dlnnkWCSM8Pmv2fBv8yG9foRdkd8pYFa5hJbDq6EqIs=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.1.dmg";
-      hash = "sha256-lPNwVLPSrmlQVFY9AD3+xzYeMG7JZnUTMl43rXjvtWM=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.3.dmg";
+      hash = "sha256-Sv6A37Y5yIkaE+qnFEGDBq/q9fSSSZPjJC59NB2Fsns=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.1-aarch64.dmg";
-      hash = "sha256-0nOcHiGOHS9QoncuJwtD6cl4v34mp9cOx2oOB0tFIOM=";
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.3-aarch64.dmg";
+      hash = "sha256-LRyg2DLmTgChdFKR8NMGGjWDZTAWnjQpoTp3NIBvYrI=";
     };
   };
   # update-script-end: urls
@@ -43,8 +43,8 @@ mkJetBrainsProduct {
   productShort = "IDEA";
 
   # update-script-start: version
-  version = "2026.1.1";
-  buildNumber = "261.23567.138";
+  version = "2026.1.3";
+  buildNumber = "261.25134.95";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/phpstorm.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.2.tar.gz";
-      hash = "sha256-VbXsfKahp1X4AwAC10VghE+ZkxThovnYHHYyvkOTtFc=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.3.tar.gz";
+      hash = "sha256-hXb2KcCaNKIJOGbN0ZUDxMKuX++dO1FRoxvC580VIHQ=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.2-aarch64.tar.gz";
-      hash = "sha256-f0Owuq0OjVwnp4Gj/diiPFn9F1Hf4gm/MwHzkabIH2w=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.3-aarch64.tar.gz";
+      hash = "sha256-+As41qcyCvAICIttMEi30b8mBTZoWKK4rjxjkVx4TXs=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.2.dmg";
-      hash = "sha256-XzYv58bR8ts6MTREUjqQinCzHvTdrLVEDH5vg1vQ3so=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.3.dmg";
+      hash = "sha256-Q9m/XIgDg4F4yH0P35IaInk/se5CXqewvp248VqA4uc=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.2-aarch64.dmg";
-      hash = "sha256-dJOqdY+D5FssDAvocMOXk9O22qk+QLxwDm2MHK2Wggg=";
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.3-aarch64.dmg";
+      hash = "sha256-Yo50EhVQDg7c/C3JZ9utZxpsOY0DuZfgYzYtBN9Nmwk=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
   product = "PhpStorm";
 
   # update-script-start: version
-  version = "2026.1.2";
-  buildNumber = "261.24374.185";
+  version = "2026.1.3";
+  buildNumber = "261.25134.104";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/pycharm.nix

@@ -13,20 +13,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.1.tar.gz";
-      hash = "sha256-b4HFh0Q4ll8lZgAa0mXnJ8AuTbfQtXKH2G80ef1keJE=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.1.2.tar.gz";
+      hash = "sha256-kcd1vhb7CFn5sY69RW2I4THK3zN7DOn52O0YeIZWGWY=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.1-aarch64.tar.gz";
-      hash = "sha256-13cDbgcmKL6sb1MAFJ/e8m6DNR29hMOZR2uo2iCaDqo=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.1.2-aarch64.tar.gz";
+      hash = "sha256-5rTyUmevreBL5nZPa7FuodFhWcrjSQ+7T1jMFo7P/uM=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.1.dmg";
-      hash = "sha256-noy9KK6nVN/dldf4wUV+er/44aB/5xjHawAAvt5WkZw=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.1.2.dmg";
+      hash = "sha256-Fej8KylKSFKVxCMrBAcUIDwb0v5B5r1RysMAvcBVgh8=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.1-aarch64.dmg";
-      hash = "sha256-3cYWkYcwHM+BiRpogcc8v9JaRoNZZKz/UpnhWBB1MD4=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.1.2-aarch64.dmg";
+      hash = "sha256-oau/wa9spYnn7XE07NGsINyqof3Mu9t9WQLuPAQ4TDc=";
     };
   };
   # update-script-end: urls
@@ -40,8 +40,8 @@ in
   product = "PyCharm";
 
   # update-script-start: version
-  version = "2026.1.1";
-  buildNumber = "261.23567.174";
+  version = "2026.1.2";
+  buildNumber = "261.24374.152";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/ruby-mine.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.2.tar.gz";
-      hash = "sha256-6rvtK1TsZsuuVqfya9eh7fHk7LJyyxg4SYrU/yXnK1I=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.3.tar.gz";
+      hash = "sha256-0KF/IEVRT8kgHpULEmqMy9gOf06IIDA4vEV3RujjQoE=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.2-aarch64.tar.gz";
-      hash = "sha256-EvKpY3zbUHT03GVIT/HJxVkOtJgsCG+jYNcKfiX0mTI=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.3-aarch64.tar.gz";
+      hash = "sha256-kiuRp9JhdS0aUFPX1brI1T9ik/iWhglIckHvv4bdPWk=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.2.dmg";
-      hash = "sha256-KWbysSPVHM0BS09rntD78i8BuP3v26zha8GatFMZtg0=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.3.dmg";
+      hash = "sha256-UjpwMCXhI+bMOvyyEbRBoNW3GGCDpi7aF6hUxffW/h0=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.2-aarch64.dmg";
-      hash = "sha256-NEmps3wxao9cb2wgbmIndXPs78Tmona4wC9+8DBv7cI=";
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.3-aarch64.dmg";
+      hash = "sha256-lqa3L+rBiEH/hPmFcevWBumvvyBBzoUR3ttvA8s0uT0=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
   product = "RubyMine";
 
   # update-script-start: version
-  version = "2026.1.2";
-  buildNumber = "261.24374.145";
+  version = "2026.1.3";
+  buildNumber = "261.25134.97";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/neovim/tests/default.nix

@@ -558,4 +558,25 @@ pkgs.lib.recurseIntoAttrs rec {
       EOF
     '';
   };
+
+  nvim_require_check_rtp_no_duplicate = vimUtils.buildVimPlugin {
+    pname = "neovim-require-check-rtp-no-duplicate-test";
+    version = "0";
+    src = runCommandLocal "neovim-require-check-rtp-no-duplicate-src" { } ''
+      mkdir -p "$out/lua/require-check-rtp-dedup"
+      cat > "$out/lua/require-check-rtp-dedup/init.lua" <<'EOF'
+      local target = "lua/require-check-rtp-dedup/init.lua"
+      local matches = vim.api.nvim_get_runtime_file(target, true)
+      if #matches ~= 1 then
+        error(
+          ("expected plugin on runtimepath exactly once, found %d:\n%s"):format(
+            #matches,
+            table.concat(matches, "\n")
+          )
+        )
+      end
+      return {}
+      EOF
+    '';
+  };
 }

pkgs/applications/editors/rednotebook/default.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
   gdk-pixbuf,
   glib,
@@ -9,12 +9,9 @@
   gtksourceview,
   pango,
   webkitgtk_4_1,
-  pygobject3,
-  pyyaml,
-  setuptools,
 }:
 
-buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "rednotebook";
   version = "2.42";
   pyproject = true;
@@ -31,7 +28,7 @@ buildPythonApplication (finalAttrs: {
 
   nativeBuildInputs = [ gobject-introspection ];
 
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
   propagatedBuildInputs = [
     gdk-pixbuf
@@ -40,9 +37,11 @@ buildPythonApplication (finalAttrs: {
     gtksourceview
     pango
     webkitgtk_4_1
+  ]
+  ++ (with python3Packages; [
     pygobject3
     pyyaml
-  ];
+  ]);
 
   makeWrapperArgs = [
     "--set GI_TYPELIB_PATH $GI_TYPELIB_PATH"

pkgs/applications/editors/vim/plugins/generated.nix

@@ -7071,6 +7071,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  guh-nvim = buildVimPlugin {
+    pname = "guh.nvim";
+    version = "2026-06-09";
+    src = fetchFromGitHub {
+      owner = "justinmk";
+      repo = "guh.nvim";
+      rev = "e8d8df780eb13da78a992fdc387bbc5f1401dd6f";
+      hash = "sha256-vkBP9TvNbUsChtntdgFkHaT01R84HfUAjGXk+SbZUng=";
+    };
+    meta.homepage = "https://github.com/justinmk/guh.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   guihua-lua = buildVimPlugin {
     pname = "guihua.lua";
     version = "0.1-unstable-2026-05-26";
@@ -7311,14 +7325,15 @@ final: prev: {
 
   heirline-components-nvim = buildVimPlugin {
     pname = "heirline-components.nvim";
-    version = "2026-02-25";
+    version = "3.3.5";
     src = fetchFromGitHub {
       owner = "Zeioth";
       repo = "heirline-components.nvim";
-      rev = "5ea9a16286c01b7c36d58c91903d1f8ff0b7ddeb";
-      sha256 = "0gij9c9qgmqc99fnqnvp6icxp32q0wkz536ric2x5vpbqlzsdkik";
+      tag = "v3.3.5";
+      hash = "sha256-M86mP8Xr7tIFi9mM8icHWIzbWTR3W2xdSgzXhxNLMj4=";
     };
     meta.homepage = "https://github.com/Zeioth/heirline-components.nvim/";
+    meta.license = getLicenseFromSpdxId "GPL-3.0-only";
     meta.hydraPlatforms = [ ];
   };
 
@@ -10137,6 +10152,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  mini-input = buildVimPlugin {
+    pname = "mini.input";
+    version = "0-unstable-2026-06-06";
+    src = fetchFromGitHub {
+      owner = "nvim-mini";
+      repo = "mini.input";
+      rev = "73a50edd8d0350feb8c018fe367121a241fd7c56";
+      hash = "sha256-6IC7krZ5pIKoR8t75h+z5yq3mKdyEaZ4iVl/dyc5Yis=";
+    };
+    meta.homepage = "https://github.com/nvim-mini/mini.input/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   mini-jump = buildVimPlugin {
     pname = "mini.jump";
     version = "0.17.0-unstable-2026-05-19";

pkgs/applications/editors/vim/plugins/hooks/neovim-require-check-hook.sh

@@ -98,9 +98,9 @@ run_require_checks() {
         if [ "$skip" = false ]; then
             echo "Attempting to require module: $name"
             if @nvimBinary@ -es --headless -n -u NONE -i NONE --clean -V1 \
-                --cmd "set rtp+=$out,${deps// /,}" \
-                --cmd "set rtp+=$out,${nativeCheckInputs// /,}" \
-                --cmd "set rtp+=$out,${checkInputs// /,}" \
+                --cmd "set rtp+=${deps// /,}" \
+                --cmd "set rtp+=${nativeCheckInputs// /,}" \
+                --cmd "set rtp+=${checkInputs// /,}" \
                 "${luaPathArgs[@]}" \
                 --cmd "set packpath^=$packPathDir" \
                 --cmd "packadd testPlugin" \

pkgs/applications/editors/vim/plugins/non-generated/fff-nvim/default.nix

@@ -13,18 +13,18 @@
   writableTmpDirAsHomeHook,
 }:
 let
-  version = "0.8.4";
+  version = "0.9.3";
   src = fetchFromGitHub {
     owner = "dmtrKovalenko";
     repo = "fff.nvim";
     tag = "v${version}";
-    hash = "sha256-w88NovzYVTiUVZmgvvmRvRq1didlbxMJYtKj1A3VB/Y=";
+    hash = "sha256-9k1XWnHzBjy7dABCzZ0yxCHqgX1bsWkkxksLVLDqdmc=";
   };
   fff-nvim-lib = rustPlatform.buildRustPackage {
     pname = "fff-nvim-lib";
     inherit version src;
 
-    cargoHash = "sha256-2LGrohseOYdroUFY3cHy57HzgfS34CBuIbN1AFuYTUg=";
+    cargoHash = "sha256-R/w3Km9LTqWQ2NFbwYbTCld72av26BdXtxC/K0sqdlQ=";
 
     cargoBuildFlags = [
       "-p"
@@ -92,7 +92,7 @@ vimUtils.buildVimPlugin {
         "return '${fff-nvim-lib}/lib'"
   '';
 
-  nvimSkipModule = [
+  nvimSkipModules = [
     # Skip single file dev config for testing fff.nvim locally
     "empty_config"
   ];

pkgs/applications/editors/vim/plugins/non-generated/notmuch-vim/default.nix

@@ -1 +1,17 @@
-{ notmuch }: notmuch.vim
+{
+  vimUtils,
+  notmuch,
+}:
+vimUtils.buildVimPlugin {
+  inherit (notmuch) pname version;
+  src = notmuch.vim;
+  meta = {
+    inherit (notmuch.meta)
+      changelog
+      description
+      homepage
+      license
+      platforms
+      ;
+  };
+}

pkgs/applications/editors/vim/plugins/non-generated/parinfer-rust/default.nix

@@ -1 +1,8 @@
-{ parinfer-rust }: parinfer-rust
+{
+  vimUtils,
+  parinfer-rust,
+}:
+vimUtils.buildVimPlugin {
+  inherit (parinfer-rust) pname version meta;
+  src = parinfer-rust;
+}

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -478,21 +478,23 @@ assertNoAdditions {
     nvimSkipModules = [ "ccc.kit.Thread.Server._bootstrap" ];
   };
 
-  chadtree = super.chadtree.overrideAttrs {
+  chadtree = super.chadtree.overrideAttrs (old: {
     # > E5108: Error executing lua ...implugin-chadtree-0-unstable-2026-01-18/lua/chadtree.lua:162: Vim:Failed to start server: address already in use
     doCheck = stdenv.hostPlatform.isLinux;
     buildInputs = [
       python3
     ];
-    passthru.python3Dependencies =
-      ps: with ps; [
-        pynvim-pp
-        pyyaml
-        std2
-      ];
+    passthru = old.passthru // {
+      python3Dependencies =
+        ps: with ps; [
+          pynvim-pp
+          pyyaml
+          std2
+        ];
+    };
     # We need some patches so it stops complaining about not being in a venv
     patches = [ ./patches/chadtree/emulate-venv.patch ];
-  };
+  });
 
   ChatGPT-nvim = super.ChatGPT-nvim.overrideAttrs {
     dependencies = with self; [
@@ -720,7 +722,7 @@ assertNoAdditions {
     checkInputs = [ self.nvim-cmp ];
   };
 
-  cmp-latex-symbols = super.cmp-look.overrideAttrs {
+  cmp-latex-symbols = super.cmp-latex-symbols.overrideAttrs {
     checkInputs = [ self.nvim-cmp ];
   };
 
@@ -1053,13 +1055,15 @@ assertNoAdditions {
     };
   });
 
-  coq_nvim = super.coq_nvim.overrideAttrs {
-    passthru.python3Dependencies =
-      ps: with ps; [
-        pynvim-pp
-        pyyaml
-        std2
-      ];
+  coq_nvim = super.coq_nvim.overrideAttrs (old: {
+    passthru = old.passthru // {
+      python3Dependencies =
+        ps: with ps; [
+          pynvim-pp
+          pyyaml
+          std2
+        ];
+    };
 
     # We need some patches so it stops complaining about not being in a venv
     patches = [ ./patches/coq_nvim/emulate-venv.patch ];
@@ -1068,7 +1072,7 @@ assertNoAdditions {
       # Other modules require global variables
       "coq"
     ];
-  };
+  });
 
   cornelis = super.cornelis.overrideAttrs {
     dependencies = [ self.vim-textobj-user ];
@@ -1265,7 +1269,9 @@ assertNoAdditions {
 
   deoplete-khard = super.deoplete-khard.overrideAttrs (old: {
     dependencies = [ self.deoplete-nvim ];
-    passthru.python3Dependencies = ps: [ (ps.toPythonModule khard) ];
+    passthru = old.passthru // {
+      python3Dependencies = ps: [ (ps.toPythonModule khard) ];
+    };
     meta = old.meta // {
       description = "Address-completion for khard via deoplete";
       homepage = "https://github.com/nicoe/deoplete-khard";
@@ -1446,7 +1452,9 @@ assertNoAdditions {
   };
 
   fcitx-vim = super.fcitx-vim.overrideAttrs (old: {
-    passthru.python3Dependencies = ps: with ps; [ dbus-python ];
+    passthru = old.passthru // {
+      python3Dependencies = ps: with ps; [ dbus-python ];
+    };
     meta = old.meta // {
       description = "Keep and restore fcitx state when leaving/re-entering insert mode or search mode";
       license = lib.licenses.mit;
@@ -1858,7 +1866,7 @@ assertNoAdditions {
 
   indent-blankline-nvim = super.indent-blankline-nvim.overrideAttrs {
     # Meta file
-    nvimSkipModules = "ibl.config.types";
+    nvimSkipModules = [ "ibl.config.types" ];
   };
 
   indent-tools-nvim = super.indent-tools-nvim.overrideAttrs {
@@ -1969,9 +1977,11 @@ assertNoAdditions {
     };
   });
 
-  jupytext-nvim = super.jupytext-nvim.overrideAttrs {
-    passthru.python3Dependencies = ps: [ ps.jupytext ];
-  };
+  jupytext-nvim = super.jupytext-nvim.overrideAttrs (old: {
+    passthru = old.passthru // {
+      python3Dependencies = ps: [ ps.jupytext ];
+    };
+  });
 
   just-nvim = super.just-nvim.overrideAttrs {
     checkInputs = with self; [
@@ -2366,20 +2376,22 @@ assertNoAdditions {
     runtimeDeps = [ luau-lsp ];
   };
 
-  magma-nvim = super.magma-nvim.overrideAttrs {
-    passthru.python3Dependencies =
-      ps: with ps; [
-        pynvim
-        jupyter-client
-        ueberzug
-        pillow
-        cairosvg
-        plotly
-        ipykernel
-        pyperclip
-        pnglatex
-      ];
-  };
+  magma-nvim = super.magma-nvim.overrideAttrs (old: {
+    passthru = old.passthru // {
+      python3Dependencies =
+        ps: with ps; [
+          pynvim
+          jupyter-client
+          ueberzug
+          pillow
+          cairosvg
+          plotly
+          ipykernel
+          pyperclip
+          pnglatex
+        ];
+    };
+  });
 
   maple-nvim = super.maple-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
@@ -2544,7 +2556,7 @@ assertNoAdditions {
 
   modicator-nvim = super.modicator-nvim.overrideAttrs {
     # Optional lualine integration
-    nvimSkipModules = "modicator.integration.lualine.init";
+    nvimSkipModules = [ "modicator.integration.lualine.init" ];
   };
 
   molokai = super.molokai.overrideAttrs (old: {
@@ -2597,13 +2609,15 @@ assertNoAdditions {
     };
   });
 
-  ncm2-jedi = super.ncm2-jedi.overrideAttrs {
+  ncm2-jedi = super.ncm2-jedi.overrideAttrs (old: {
     dependencies = with self; [
       nvim-yarp
       ncm2
     ];
-    passthru.python3Dependencies = ps: with ps; [ jedi ];
-  };
+    passthru = old.passthru // {
+      python3Dependencies = ps: with ps; [ jedi ];
+    };
+  });
 
   ncm2-neoinclude = super.ncm2-neoinclude.overrideAttrs {
     dependencies = [ self.neoinclude-vim ];
@@ -2648,7 +2662,7 @@ assertNoAdditions {
       plenary-nvim
       nui-nvim
     ];
-    nvimSkipModule = [
+    nvimSkipModules = [
       "neo-tree.types.fixes.compat-0.10"
     ];
   };
@@ -2855,7 +2869,7 @@ assertNoAdditions {
       nvim-nio
     ];
     # Unit test assert
-    nvimSkipModules = "neotest-jest-assertions";
+    nvimSkipModules = [ "neotest-jest-assertions" ];
   };
 
   neotest-minitest = super.neotest-minitest.overrideAttrs {
@@ -2904,7 +2918,7 @@ assertNoAdditions {
       plenary-nvim
     ];
     # Unit test assert
-    nvimSkipModules = "neotest-playwright-assertions";
+    nvimSkipModules = [ "neotest-playwright-assertions" ];
   };
 
   neotest-plenary = super.neotest-plenary.overrideAttrs {
@@ -2965,7 +2979,7 @@ assertNoAdditions {
       plenary-nvim
     ];
     # Unit test assert
-    nvimSkipModules = "neotest-vitest-assertions";
+    nvimSkipModules = [ "neotest-vitest-assertions" ];
   };
 
   neotest-zig = super.neotest-zig.overrideAttrs {
@@ -3206,7 +3220,7 @@ assertNoAdditions {
   nvim-fzf-commands = super.nvim-fzf-commands.overrideAttrs {
     dependencies = [ self.nvim-fzf ];
     # Requires global variable setup nvim_fzf_directory
-    nvimSkipModules = "fzf-commands.rg";
+    nvimSkipModules = [ "fzf-commands.rg" ];
   };
 
   nvim-genghis = super.nvim-genghis.overrideAttrs {
@@ -3280,7 +3294,7 @@ assertNoAdditions {
   };
 
   nvim-lilypond-suite = super.nvim-lilypond-suite.overrideAttrs {
-    nvimSkipModule = [
+    nvimSkipModules = [
       # Option not set immediately
       "nvls.errors.lilypond-book"
       "nvls.tex"
@@ -3591,7 +3605,7 @@ assertNoAdditions {
 
   omni-vim = super.omni-vim.overrideAttrs {
     # Optional lightline integration
-    nvimSkipModules = "omni-lightline";
+    nvimSkipModules = [ "omni-lightline" ];
   };
 
   omnisharp-extended-lsp-nvim = super.omnisharp-extended-lsp-nvim.overrideAttrs (old: {
@@ -3676,7 +3690,7 @@ assertNoAdditions {
 
   outline-nvim = super.outline-nvim.overrideAttrs {
     # Requires setup call
-    nvimSkipModules = "outline.providers.norg";
+    nvimSkipModules = [ "outline.providers.norg" ];
   };
 
   overseer-nvim = super.overseer-nvim.overrideAttrs {
@@ -3768,7 +3782,7 @@ assertNoAdditions {
 
   poimandres-nvim = super.poimandres-nvim.overrideAttrs {
     # Optional treesitter support
-    nvimSkipModules = "poimandres.highlights";
+    nvimSkipModules = [ "poimandres.highlights" ];
   };
 
   popup-nvim = super.popup-nvim.overrideAttrs {
@@ -3829,7 +3843,7 @@ assertNoAdditions {
 
   pywal-nvim = super.pywal-nvim.overrideAttrs {
     # Optional feline integration
-    nvimSkipModules = "pywal.feline";
+    nvimSkipModules = [ "pywal.feline" ];
   };
 
   QFEnter = super.QFEnter.overrideAttrs (old: {
@@ -4121,7 +4135,7 @@ assertNoAdditions {
 
   spaceman-nvim = super.spaceman-nvim.overrideAttrs {
     # Optional telescope integration
-    nvimSkipModules = "spaceman.adapters.telescope";
+    nvimSkipModules = [ "spaceman.adapters.telescope" ];
   };
 
   sqlite-lua = super.sqlite-lua.overrideAttrs (
@@ -4140,6 +4154,8 @@ assertNoAdditions {
       };
 
       nvimSkipModules = [
+        # Example seeds and edits a database during require.
+        "sqlite.examples.bookmarks"
         # Require "sql.utils" ?
         "sqlite.tbl.cache"
       ];
@@ -4327,7 +4343,7 @@ assertNoAdditions {
       plenary-nvim
     ];
     # Meta
-    nvimSkipModules = "frecency.types";
+    nvimSkipModules = [ "frecency.types" ];
   };
 
   telescope-fzf-native-nvim = super.telescope-fzf-native-nvim.overrideAttrs (old: {
@@ -4548,7 +4564,7 @@ assertNoAdditions {
 
   trouble-nvim = super.trouble-nvim.overrideAttrs {
     # Meta file
-    nvimSkipModules = "trouble.docs";
+    nvimSkipModules = [ "trouble.docs" ];
   };
 
   trust-vim = super.trust-vim.overrideAttrs (old: {
@@ -4567,7 +4583,7 @@ assertNoAdditions {
     '';
 
     # Unit test
-    nvimSkipModules = "tsc.better-messages-test";
+    nvimSkipModules = [ "tsc.better-messages-test" ];
   };
 
   tslime-vim = super.tslime-vim.overrideAttrs (old: {
@@ -4817,7 +4833,9 @@ assertNoAdditions {
   });
 
   vim-beancount = super.vim-beancount.overrideAttrs (old: {
-    passthru.python3Dependencies = ps: with ps; [ beancount ];
+    passthru = old.passthru // {
+      python3Dependencies = ps: with ps; [ beancount ];
+    };
     meta = old.meta // {
       license = lib.licenses.vim;
     };
@@ -5069,7 +5087,7 @@ assertNoAdditions {
 
   vim-flog = super.vim-flog.overrideAttrs (old: {
     # Not intended to be required, used by vim plugin
-    nvimSkipModules = "flog.graph_bin";
+    nvimSkipModules = [ "flog.graph_bin" ];
     meta = old.meta // {
       license = lib.licenses.vim;
     };
@@ -5300,9 +5318,11 @@ assertNoAdditions {
     };
   });
 
-  vim-mediawiki-editor = super.vim-mediawiki-editor.overrideAttrs {
-    passthru.python3Dependencies = [ python3.pkgs.mwclient ];
-  };
+  vim-mediawiki-editor = super.vim-mediawiki-editor.overrideAttrs (old: {
+    passthru = old.passthru // {
+      python3Dependencies = ps: [ ps.mwclient ];
+    };
+  });
 
   vim-merginal = super.vim-merginal.overrideAttrs (old: {
     meta = old.meta // {
@@ -5652,7 +5672,7 @@ assertNoAdditions {
 
   vim-tpipeline = super.vim-tpipeline.overrideAttrs {
     # Requires global variable
-    nvimSkipModules = "tpipeline.main";
+    nvimSkipModules = [ "tpipeline.main" ];
   };
 
   vim-twiggy = super.vim-twiggy.overrideAttrs (old: {
@@ -5860,7 +5880,7 @@ assertNoAdditions {
 
   virt-column-nvim = super.virt-column-nvim.overrideAttrs {
     # Meta file
-    nvimSkipModules = "virt-column.config.types";
+    nvimSkipModules = [ "virt-column.config.types" ];
   };
 
   vis = super.vis.overrideAttrs (old: {
@@ -5948,7 +5968,7 @@ assertNoAdditions {
   });
 
   xmake-nvim = super.xmake-nvim.overrideAttrs {
-    nvimSkipModule = [
+    nvimSkipModules = [
       # attempt to index upvalue 'options' (a nil value)
       "xmake.action"
       "xmake.command"

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -503,6 +503,7 @@ https://github.com/ellisonleao/gruvbox.nvim/,,
 https://github.com/nvimdev/guard-collection/,,
 https://github.com/nvimdev/guard.nvim/,,
 https://github.com/nmac427/guess-indent.nvim/,,
+https://github.com/justinmk/guh.nvim/,main,
 https://github.com/ray-x/guihua.lua/,,
 https://github.com/sjl/gundo.vim/,,
 https://github.com/junegunn/gv.vim/,,
@@ -520,8 +521,8 @@ https://github.com/wenzel-hoffman/haskell-with-unicode.vim/,,
 https://github.com/travitch/hasksyn/,,
 https://github.com/StackInTheWild/headhunter.nvim/,,
 https://github.com/lukas-reineke/headlines.nvim/,,
-https://github.com/rebelot/heirline.nvim/,,
 https://github.com/Zeioth/heirline-components.nvim/,,
+https://github.com/rebelot/heirline.nvim/,,
 https://github.com/qvalentin/helm-ls.nvim/,,
 https://github.com/OXY2DEV/helpview.nvim/,,
 https://github.com/RaafatTurki/hex.nvim/,,
@@ -722,6 +723,7 @@ https://github.com/nvim-mini/mini.hipatterns/,,
 https://github.com/nvim-mini/mini.hues/,,
 https://github.com/nvim-mini/mini.icons/,,
 https://github.com/nvim-mini/mini.indentscope/,,
+https://github.com/nvim-mini/mini.input/,,
 https://github.com/nvim-mini/mini.jump/,,
 https://github.com/nvim-mini/mini.jump2d/,,
 https://github.com/nvim-mini/mini.keymap/,,

pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix

@@ -12,7 +12,7 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
   };
 
   meta = {
-    changelog = "https://github.com/aws/aws-toolkit-vscode/releases/tag/amazonq%2Fv${finalAttrs.version}";
+    # changelog = "https://github.com/aws/aws-toolkit-vscode/releases/tag/amazonq%2Fv${finalAttrs.version}";
     description = "Amazon Q, CodeCatalyst, Local Lambda debug, SAM/CFN syntax, ECS Terminal, AWS resources";
     downloadPage = "https://marketplace.visualstudio.com/items?itemName=AmazonWebServices.amazon-q-vscode";
     homepage = "https://github.com/aws/aws-toolkit-vscode";

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-q5j8Ip/ew3oHGIakJm/CTeKcW4O9FR062f4rILXbQrQ=";
+          hash = "sha256-792UABRtJEpG4ipQsoiN1lkGeaNqHyg69Sv3g26BZBA=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-viZxHDA8SfsIVB5R9I/8SB8EEWRvt1kpZPDA4w0sD54=";
+          hash = "sha256-NDiCBtQ/BWPPOAbDs/ACZ68at0gAqJJMPBLCsILnBho=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-kL0bab7BT45EEh17jKFVHqaMQEYkxLlsDKtK1deoS4M=";
+          hash = "sha256-j81bcYqopNTAO/faiugARwAaVZ8s+1Atf8oHDTS8fR4=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-fJW6fTGRWLBWB1yZ1pGb3p4KkFLhrDXqw+0wjOv71Vo=";
+          hash = "sha256-Y6M110iwzKdzJoHb6zEKWyR4NyxyQtuvNJ4ucOrUYdY=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.161";
+      version = "2.1.170";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix

@@ -12,26 +12,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-l1bwzuEi8sCBsdad2a5UDPN12QtlHhhgXBfsNxP5GwA=";
+          hash = "sha256-qXGdFXx8Vr9oVStBjaeWEsQjhQUbp9MnLUfJtyhgwkA=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-31Sj5KlZnRKa0sR2J4A4CRuDF8fwXlzikukH+OX/GpU=";
+          hash = "sha256-Bd3ool5Ep8I5iiTMUHF48r/sf3F1dROx6Umns0pDGzE=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-7m9or/105/YIjhMlwMFLcN9tP9hj/4NU85Y3/5DDuDw=";
+          hash = "sha256-Jv2lrdvY0tthJM2fifUlCW/QBzEZAa8QDHj4o+a4KxY=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-q7mGGv/L9N7hwM0EIKF7d+lxcl0V00a6I/CK8j5E8SE=";
+          hash = "sha256-VooAoTyysIFH1AaidcoRs7fJpID0LbmWnLdivGZfdrM=";
         };
       };
     in
     {
       name = "ruff";
       publisher = "charliermarsh";
-      version = "2026.46.0";
+      version = "2026.48.0";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1215,8 +1215,8 @@ let
         mktplcRef = {
           name = "flutter";
           publisher = "dart-code";
-          version = "3.134.0";
-          hash = "sha256-wWANxBh9Tg3VkfbcrR0NgOIC8cpeZJCNfOevT7E4zKY=";
+          version = "3.136.0";
+          hash = "sha256-RK493qHjEK/k8oy/OIzO3bvNnFo+ZftQhZMIAmBCaJk=";
         };
 
         meta.license = lib.licenses.mit;
@@ -1375,8 +1375,8 @@ let
         mktplcRef = {
           name = "competitive-programming-helper";
           publisher = "DivyanshuAgrawal";
-          version = "2026.5.1779885478";
-          hash = "sha256-8RU6JWHeYOAxof2TXpeXlXSVD9+0e0E46X85A11l4Pk=";
+          version = "2026.6.1780508121";
+          hash = "sha256-4kb7Nk+gctECMQM/cko+q1Bta1EKPXPEqyCQLBMkbEo=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DivyanshuAgrawal.competitive-programming-helper/changelog";
@@ -2324,8 +2324,8 @@ let
         mktplcRef = {
           name = "vscode-vibrancy-continued";
           publisher = "illixion";
-          version = "1.1.77";
-          hash = "sha256-khxajorzIntF2YwKVd6aZ1+doEr2oN4OliBpc7TTB7o=";
+          version = "1.1.78";
+          hash = "sha256-w0i0Gmqj2atCtEYW+0XvZech37qQaTjkt8MJRdHamxs=";
         };
         meta = {
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";
@@ -3865,8 +3865,8 @@ let
         mktplcRef = {
           name = "ansible";
           publisher = "redhat";
-          version = "26.5.0";
-          hash = "sha256-gKe+LC0OOZi5I1Tei64JtQUR1gpWyTex9MoLGT6jgWU=";
+          version = "26.6.0";
+          hash = "sha256-pCq9niQQIBkiJL6q90W6ecSkGPHttiOAECAyrPgBeqg=";
         };
         meta = {
           description = "Ansible language support";
@@ -3997,8 +3997,8 @@ let
         mktplcRef = {
           name = "wikitext";
           publisher = "RoweWilsonFrederiskHolme";
-          version = "4.0.4";
-          hash = "sha256-IEnWoRQfWx4TbysSQlOxG0c8kiqtR4fOhaV1JxDkRCw=";
+          version = "4.0.5";
+          hash = "sha256-VyrcgS93B5Xd4s101lnTw9o27ffcvmxkShCKJ+6H+2w=";
         };
         meta = {
           description = "Extension that helps users view and write MediaWiki's Wikitext files";

pkgs/applications/editors/vscode/extensions/ms-python.black-formatter/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-python";
     name = "black-formatter";
-    version = "2026.4.0";
-    hash = "sha256-lt/68RWEpoBFTBWEsSSb/KL6BRmdt8mELBA1ypb5Pm0=";
+    version = "2026.6.0";
+    hash = "sha256-jTq5cpP3QwyAOF1VihAJA5ZYCpb3qbmeNIUPFr9Xph8=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/oracle.oracle-java/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   mktplcRef = {
     name = "oracle-java";
     publisher = "oracle";
-    version = "25.1.0";
-    hash = "sha256-HjDSlvG6khFJA/3ukjVCrPqbQiAKVhgP6KcCfC/jUrc=";
+    version = "26.0.0";
+    hash = "sha256-SfZMOiSuABXcYVi4CmxUUUIeAUmp6s45jjyy4HXoe24=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix

@@ -7,19 +7,19 @@
 let
   supported = {
     x86_64-linux = {
-      hash = "sha256-HECflrFni3eWxMs+BpjWBhU3pqF5jjMIEjkp9ibx784=";
+      hash = "sha256-7uZZuEijg1Aca1h2NrBwFU9iFnfhG17waXxqVlAKzTA=";
       arch = "linux-x64";
     };
     x86_64-darwin = {
-      hash = "sha256-dCkSOClWWq3DGU9psrinI5f5oC69K+AhdHdXwKIQsFw=";
+      hash = "sha256-NPh3Sxf2k/Nj4vt0SGsa5H6QOI1IBaL20g79Pl4/iPg=";
       arch = "darwin-x64";
     };
     aarch64-linux = {
-      hash = "sha256-XNIx2ibOe1/1lo8RkYkAv+oBDYpqnmMcIjpoulbrr+w=";
+      hash = "sha256-tszcouaPUGTH1MpGJfU0RiLvBN7qIhH1vC3XiAmHFK8=";
       arch = "linux-arm64";
     };
     aarch64-darwin = {
-      hash = "sha256-rXVuQN0SDmymQNncFZzyD4H+j6hxp1yoiaNXnbzrlo0=";
+      hash = "sha256-JV9pZqq48q00GM0cg3Wu00qrrkn2fczbHBVqnCM84lI=";
       arch = "darwin-arm64";
     };
   };
@@ -34,7 +34,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = base // {
     name = "tombi";
     publisher = "tombi-toml";
-    version = "1.1.1";
+    version = "1.1.2";
   };
   meta = {
     description = "TOML Language Server";

pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix

@@ -37,6 +37,9 @@ vscode-utils.buildVscodeMarketplaceExtension {
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [
     autoPatchelfHook
   ];

pkgs/applications/editors/vscode/vscode.nix

@@ -35,17 +35,17 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-t26YN3E5XaSJ7gki8nm06hVh4ZvXDEU77M749ZrqfAo=";
-      x86_64-darwin = "sha256-jOnwhiDJmU+EqU30wg1+frqDDxJgfngETx414i2YTIg=";
-      aarch64-linux = "sha256-8sYanI12qDMPgVG7S0QKLEkU0i/SICkJ5wz/OwhP+i4=";
-      aarch64-darwin = "sha256-oXeZZWAvpUn5KItEOR8yX9iQ0Fp6EzXGux0jvYbZqtU=";
-      armv7l-linux = "sha256-16cUu1C389edf0aHxXxTLJwjxmpHxM8mv1YFnPDLgP4=";
+      x86_64-linux = "sha256-L975R3F779LgaFTL4B6ZtImPd1LyXhImnDgCPmO5PI8=";
+      x86_64-darwin = "sha256-Sygw/VkIiyV+iABylgFpTiHs0f5dS6NYPWSm5BNh9tQ=";
+      aarch64-linux = "sha256-jcFC668WKAjlYju33RI6poAKnhm3fL1hO16alUwjwv4=";
+      aarch64-darwin = "sha256-AY6WeDzGEH5zXRosN1H/osxC3e5j0Hs9s2Ys2xe1UxI=";
+      armv7l-linux = "sha256-LqofnnZid/I0lVTyhC7yHD+Fxz4dSBxKJ8n+lp2uucQ=";
     }
     .${system} or throwSystem;
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.122.1";
+  version = "1.123.0";
 
   # The update server (update.code.visualstudio.com) expects the version path
   # segment in X.Y.Z form, so we normalize X.Y to X.Y.0 (e.g. "1.110" → "1.110.0").
@@ -53,7 +53,7 @@ let
   downloadVersion = lib.versions.pad 3 version;
 
   # This is used for VS Code - Remote SSH test
-  rev = "8761a5560cfd65fdd19ce7e2bd18dab5c0a4d84e";
+  rev = "6a44c352bd24569c417e530095901b649960f9f8";
 in
 buildVscode {
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
@@ -86,7 +86,7 @@ buildVscode {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-7n8KvIYEDYO8qqJjfbuUsgUwCxq9FJ6i/EuDBd1HQDk=";
+      hash = "sha256-i034bIsaPlxlVFNY5cKf/ftWPy17SFokbFUMa+zeLng=";
     };
     stdenv = stdenvNoCC;
   };
@@ -113,6 +113,9 @@ buildVscode {
     '';
     homepage = "https://code.visualstudio.com/";
     downloadPage = "https://code.visualstudio.com/Updates";
+    changelog = "https://code.visualstudio.com/updates/v${
+      lib.replaceString "." "_" (lib.versions.majorMinor version)
+    }";
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [
       eadwu

pkgs/applications/editors/vscode/vscodium.nix

@@ -27,12 +27,12 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-gscXPWqnQV9nd9XWbL5YkCdyxxnDDEY4WpFAgx5G7a0=";
-      x86_64-darwin = "sha256-H6sKVtQi++U7NvSkKWipjDDJQsTu0Zg3tp9kijL85eU=";
-      aarch64-linux = "sha256-09C5ER/nZBphWHZRRAf9o/hyB6qc2mqIuxOLNdlVSfU=";
-      aarch64-darwin = "sha256-utDPI80JCPcXTFvK65UR5CBlyb+EsocpHM0KWeojaUI=";
-      armv7l-linux = "sha256-voNvX40YWm7oYrgNAIhoRE/9zZlIq/MgaGVlumDUaz4=";
-      loongarch64-linux = "sha256-T7QGiIilEL2lR01yUZ70ubQ2XGgnL7NQ4xkt0MeDD3s=";
+      x86_64-linux = "sha256-LJsGc11MH6zlcJNfSWjTWPn2Jp9dkjeBPQuCXH1woUM=";
+      x86_64-darwin = "sha256-bC7AfH2eKmmsWIOHifNGKD/kVQCYyuMfU3SUil0DXkM=";
+      aarch64-linux = "sha256-mT5dvw8GOZ0GnZaKRS/TAzQDEEYDOgcj6w6lNLy5kQ0=";
+      aarch64-darwin = "sha256-c8K17XKpRG1ji2mUfoyg2+cRF+qc1KVMYVkaQoUIz7Y=";
+      armv7l-linux = "sha256-91ZHhEUDVoDiRBLwMHVLhzKmb9gWcPBUsVRZVLhCA4M=";
+      loongarch64-linux = "sha256-7iUdsIyJkIi40Xn+/PWdCVgahQxbZtiMw0QLMisN+sg=";
     }
     .${system} or throwSystem;
 
@@ -43,8 +43,8 @@ buildVscode rec {
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.116.02821";
-  vscodeVersion = "1.116.0";
+  version = "1.121.03429";
+  vscodeVersion = "1.121.0";
   pname = "vscodium";
 
   executableName = "codium";
@@ -79,6 +79,7 @@ buildVscode rec {
     '';
     homepage = "https://github.com/VSCodium/vscodium";
     downloadPage = "https://github.com/VSCodium/vscodium/releases";
+    changelog = "https://github.com/VSCodium/vscodium/releases/tag/${version}";
     license = lib.licenses.mit;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [

pkgs/applications/emulators/cdemu/analyzer.nix

@@ -1,54 +0,0 @@
-{
-  cmake,
-  pkg-config,
-  callPackage,
-  gobject-introspection,
-  wrapGAppsHook3,
-  python3Packages,
-  libxml2,
-  gnuplot,
-  adwaita-icon-theme,
-  gdk-pixbuf,
-  intltool,
-  libmirage,
-}:
-python3Packages.buildPythonApplication {
-
-  inherit
-    (callPackage ./common-drv-attrs.nix {
-      version = "3.2.6";
-      pname = "image-analyzer";
-      hash = "sha256-7I8RUgd+k3cEzskJGbziv1f0/eo5QQXn62wGh/Y5ozc=";
-    })
-    pname
-    version
-    src
-    meta
-    ;
-
-  buildInputs = [
-    libxml2
-    gnuplot
-    libmirage
-    adwaita-icon-theme
-    gdk-pixbuf
-  ];
-  propagatedBuildInputs = with python3Packages; [
-    pygobject3
-    matplotlib
-  ];
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    wrapGAppsHook3
-    intltool
-    gobject-introspection
-  ];
-
-  pyproject = false;
-  dontWrapGApps = true;
-  preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
-
-}

pkgs/applications/emulators/cdemu/client.nix

@@ -1,42 +0,0 @@
-{
-  callPackage,
-  python3Packages,
-  cmake,
-  pkg-config,
-  intltool,
-  wrapGAppsNoGuiHook,
-  gobject-introspection,
-}:
-python3Packages.buildPythonApplication {
-
-  inherit
-    (callPackage ./common-drv-attrs.nix {
-      version = "3.2.5";
-      pname = "cdemu-client";
-      hash = "sha256-py2F61v8vO0BCM18GCflAiD48deZjbMM6wqoCDZsOd8=";
-    })
-    pname
-    version
-    src
-    meta
-    ;
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    intltool
-    wrapGAppsNoGuiHook
-    gobject-introspection
-  ];
-  propagatedBuildInputs = with python3Packages; [
-    dbus-python
-    pygobject3
-  ];
-
-  pyproject = false;
-  dontWrapGApps = true;
-  preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
-
-}

pkgs/applications/emulators/cdemu/common-drv-attrs.nix

@@ -1,33 +0,0 @@
-{
-  lib,
-  fetchurl,
-  pname,
-  version,
-  hash,
-}:
-
-{
-  inherit pname version;
-  src = fetchurl {
-    url = "mirror://sourceforge/cdemu/${pname}-${version}.tar.xz";
-    inherit hash;
-  };
-  meta = {
-    description = "Suite of tools for emulating optical drives and discs";
-    longDescription = ''
-      CDEmu consists of:
-
-      - a kernel module implementing a virtual drive-controller
-      - libmirage which is a software library for interpreting optical disc images
-      - a daemon which emulates the functionality of an optical drive+disc
-      - textmode and GTK clients for controlling the emulator
-      - an image analyzer to view the structure of image files
-
-      Optical media emulated by CDemu can be mounted within Linux. Automounting is also allowed.
-    '';
-    homepage = "https://cdemu.sourceforge.io/";
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ bendlas ];
-  };
-}