.github: Bump actions/checkout from 6.0.3 to 7.0.0

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](df4cb1c069...9c091bb21b)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/backport.yml

@@ -36,7 +36,7 @@ jobs:
           permission-pull-requests: write
           permission-workflows: write
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}

.github/workflows/bot.yml

@@ -41,16 +41,19 @@ jobs:
   run:
     runs-on: ubuntu-slim
     if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
+    env:
+      # TODO: Remove after 2026-03-04, when Node 24 becomes the default.
+      # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
             ci/github-script
 
       - name: Install dependencies
-        run: npm ci --package-lock-only=false @actions/artifact bottleneck
-        working-directory: ci/github-script
+        run: npm install @actions/artifact@6.2.1 bottleneck@2.19.5
 
       # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
@@ -88,7 +91,7 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         name: Labels from touched files
         if: |
           github.event_name == 'pull_request_target' &&
@@ -98,7 +101,7 @@ jobs:
           configuration-path: .github/labeler.yml # default
           sync-labels: true
 
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         name: Labels from touched files (no sync)
         if: |
           github.event_name == 'pull_request_target' &&
@@ -108,7 +111,7 @@ jobs:
           configuration-path: .github/labeler-no-sync.yml
           sync-labels: false
 
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         name: Labels from touched files (development branches)
         # Development branches like staging-next, haskell-updates and python-updates get special labels.
         # This is to avoid the mass of labels there, which is mostly useless - and really annoying for

.github/workflows/build.yml

@@ -49,7 +49,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -59,7 +59,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true

.github/workflows/check.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           path: trusted
@@ -51,8 +51,7 @@ jobs:
             ci/github-script
 
       - name: Install dependencies
-        run: npm ci --package-lock-only=false bottleneck
-        working-directory: trusted/ci/github-script
+        run: npm install bottleneck@2.19.5
 
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         if: github.event_name != 'pull_request' && vars.NIXPKGS_COMMIT_CHECK_CLIENT_ID
@@ -96,7 +95,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           path: trusted
@@ -138,7 +137,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -148,7 +147,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

.github/workflows/comment.yml

@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 2
     if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/eval.yml

@@ -50,7 +50,7 @@ jobs:
       ciPinBumpCommit: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommit }}
       ciPinBumpCommitShort: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommitShort }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           path: trusted
@@ -58,7 +58,7 @@ jobs:
             ci/supportedVersions.nix
 
       - name: Check out the PR at the test merge commit
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: ${{ inputs.mergedSha }}
@@ -139,7 +139,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       - name: Load supported versions
         id: versions
@@ -174,7 +174,7 @@ jobs:
           sudo mkswap /swap
           sudo swapon /swap
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -187,7 +187,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -259,7 +259,7 @@ jobs:
       statuses: write # creating 'Eval Summary' commit statuses
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -277,7 +277,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       - name: Combine all output paths and eval stats
         run: |
@@ -476,7 +476,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -486,7 +486,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'

.github/workflows/lint.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -134,7 +134,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: true # Needed to run git fetch for large PRs.
           path: trusted

.github/workflows/merge-group.yml

@@ -25,7 +25,7 @@ jobs:
       targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.prepare.outputs.systems }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/periodic-merge.yml

@@ -34,7 +34,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/pull-request-target.yml

@@ -36,7 +36,7 @@ jobs:
       systems: ${{ steps.prepare.outputs.systems }}
       touched: ${{ steps.prepare.outputs.touched }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

.github/workflows/review.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/teams.yml

@@ -30,7 +30,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Fetch source
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -38,8 +38,7 @@ jobs:
             maintainers/github-teams.json
 
       - name: Install dependencies
-        run: npm ci --package-lock-only=false bottleneck
-        working-directory: ci/github-script
+        run: npm install bottleneck@2.19.5
 
       - name: Synchronise teams
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
       push: ${{ steps.files.outputs.push }}
       targetSha: ${{ steps.prepare.outputs.targetSha }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

.gitignore

@@ -27,9 +27,6 @@ tags
 .mypy_cache
 __pycache__
 
-/AGENTS.md
-/CLAUDE.md
-
 /pkgs/development/libraries/qt-5/*/tmp/
 /pkgs/desktops/kde-5/*/tmp/
 /pkgs/development/mobile/androidenv/xml/*

ci/OWNERS

@@ -41,7 +41,7 @@
 /lib/meta.nix               @alyssais @NixOS/stdenv @llakala
 /lib/meta-types.nix         @infinisil @adisbladis @NixOS/stdenv @llakala
 /lib/source-types.nix       @alyssais @NixOS/stdenv @llakala
-/lib/systems                @alyssais @NixOS/stdenv
+/lib/systems                @alyssais @NixOS/stdenv @llakala
 ## Libraries / Module system
 /lib/modules.nix            @infinisil @roberth @hsjobeki @llakala
 /lib/types.nix              @infinisil @roberth @hsjobeki @llakala
@@ -260,7 +260,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/editors/jetbrains @leona-ya @theCapypara
 
 # Licenses
-/lib/licenses @alyssais @emilazy @jopejoe1
+/lib/licenses @alyssais @emilazy @jopejoe1 @llakala
 
 # Qt
 /pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000

ci/github-script/bot.js

@@ -395,13 +395,6 @@ module.exports = async ({ github, context, core, dry }) => {
         pull_number,
         per_page: 100,
       })
-
-      // label llm-assisted PRs accordingly
-      const assistedByPattern = /Assisted-by: (?!nix-init)/i
-      evalLabels['llm-assisted'] = prCommits.some((c) =>
-        assistedByPattern.test(c.commit.message),
-      )
-
       const commitSubjects = prCommits.map(
         (c) => c.commit.message.split('\n')[0],
       )

ci/github-script/lint-commits.js

@@ -74,10 +74,8 @@ async function checkCommitMessages({ commits, core }) {
     'fix',
     'perf',
     'refactor',
-    'services',
     'style',
     'test',
-    'update',
   ]
 
   /**

ci/github-script/package-lock.json

@@ -4,6 +4,7 @@
   "requires": true,
   "packages": {
     "": {
+      "name": "github-script",
       "dependencies": {
         "@actions/artifact": "6.2.1",
         "@actions/core": "1.10.1",

ci/github-script/package.json

@@ -2,7 +2,9 @@
   "private": true,
   "//": [
     "Keep `@actions/core` and `@actions/github` in sync with",
-    "https://github.com/actions/github-script/blob/main/package.json."
+    "https://github.com/actions/github-script/blob/main/package.json.",
+    "Keep `@actions/artifact` and `bottleneck` in sync with",
+    "`.github/workflows/bot.yml`."
   ],
   "dependencies": {
     "@actions/artifact": "6.2.1",

ci/pinned.json

@@ -9,9 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "7525d999cd850b9a488817abc89c75dc733acf17",
-      "url": "https://github.com/NixOS/nixpkgs/archive/7525d999cd850b9a488817abc89c75dc733acf17.tar.gz",
-      "hash": "sha256-4IHyyLgLBdKefkljdKod4IMn023pQiDXAWJA187cmdY="
+      "revision": "6edbf1a6a03e75886a6609c088801a0856449e88",
+      "url": "https://github.com/NixOS/nixpkgs/archive/6edbf1a6a03e75886a6609c088801a0856449e88.tar.gz",
+      "hash": "sha256-0lkauQbtrljJqwtzTCILPAiHAJyMvn6XDo264moDv30="
     }
   },
   "version": 8

doc/build-helpers/fixed-point-arguments.chapter.md

@@ -143,4 +143,3 @@ lib.extendMkDerivation {
     });
 }
 ```
-:::

doc/build-helpers/testers.chapter.md

@@ -741,7 +741,7 @@ Notable attributes:
 
 Compliance suite for [modular service](https://nixos.org/manual/nixos/unstable/#modular-services) integrations.
 
-Tests that a service manager integration correctly handles the portable modular services contract: `process.argv`, `process.environment` (including `null` values that unset a variable), sub-services, assertions, and warnings.
+Tests that a service manager integration correctly handles the portable modular services contract: `process.argv`, sub-services, assertions, and warnings.
 
 ### Return value {#tester-modularServiceCompliance-return}
 
@@ -758,7 +758,6 @@ An attribute set of derivations which perform the tests during their build.
   - Output attribute `config` is the resulting evaluated services attrset (e.g., the value of the `system.services` option in NixOS).
     This attribute must be available even if `checkDrv` would fail.
   - Output attribute `checkDrv` is a representative derivation whose existence and buildability prove the eval is sound (e.g., `system.build.toplevel` in NixOS, but could perhaps be more specific in the case of another process manager integration).
-  - The generic tester only reads `config` and `checkDrv`. An integration may return additional attributes for its own integration-specific eval checks. Such extra attributes are optional.
 
 `mkTest` (function)
 
@@ -773,14 +772,6 @@ An attribute set of derivations which perform the tests during their build.
 : Path to a directory writable by service processes and readable by `testExe`.
   The integration must ensure this directory is available when the services and `testExe` run.
 
-`callReload` (function)
-
-: `path -> string`.
-  Given a service's name `path` (the list of service names from the top-level service down to the target sub-service, e.g. `[ "reload" "inner" ]`), returns a shell command that reloads that service.
-  The command is embedded in `testExe` and executed with sufficient privilege to reload the service (e.g. as root in the test VM).
-  There is no manager-agnostic reload command, so every integration must provide this; the integration joins the `path` per its own unit-naming convention (the suite does not assume one).
-  On NixOS the `path` dash-joins into the systemd unit name with a `.service` suffix, so the command is `systemctl reload ${lib.concatStringsSep "-" path}.service` (a top-level service is a single-element path `[ "svc" ]` -> `svc.service`; a nested sub-service `[ "parent" "child" ]` -> `parent-child.service`).
-
 :::{.example #ex-modularServiceCompliance-nixos}
 
 # NixOS invocation of the compliance suite
@@ -811,7 +802,6 @@ recurseIntoAttrs (
         config = machine.config.system.services;
         checkDrv = machine.config.system.build.toplevel;
       };
-    callReload = path: "systemctl reload ${lib.concatStringsSep "-" path}.service";
     mkTest =
       {
         name,

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -165,7 +165,7 @@ They are useful for creating files from Nix expressions, and are all implemented
 Each of these functions will cause a derivation to be produced.
 When you coerce the result of each of these functions to a string with [string interpolation](https://nixos.org/manual/nix/stable/language/string-interpolation) or [`toString`](https://nixos.org/manual/nix/stable/language/builtins#builtins-toString), it will evaluate to the [store path](https://nixos.org/manual/nix/stable/store/store-path) of this derivation.
 
-::: {.note}
+:::: {.note}
 Some of these functions will put the resulting files within a directory inside the [derivation output](https://nixos.org/manual/nix/stable/language/derivations#attr-outputs).
 If you need to refer to the resulting files somewhere else in a Nix expression, append their path to the derivation's store path.
 
@@ -190,7 +190,7 @@ writeShellScript "evaluate-my-file.sh" ''
   cat ${my-file}/share/my-file
 ''
 ```
-:::
+::::
 
 ### `makeDesktopItem` {#trivial-builder-makeDesktopItem}
 

doc/channels.chapter.md

@@ -1,26 +0,0 @@
-# How channels work {#how-channels-work}
-
-nixpkgs uses the [channels feature](https://nixos.org/nix/manual/#sec-channels) of nix.
-
-nixpkgs is distributed for users of Nix on non-NixOS distributions through the channel
-`nixpkgs-unstable`. Users of NixOS generally use one of the `nixos-*` channels,
-e.g. `nixos-22.11`, which includes all packages and modules for the stable NixOS
-22.11. Stable NixOS releases are generally only given
-security updates. More up to date packages and modules are available via the
-`nixos-unstable` channel.
-
-Both `nixos-unstable` and `nixpkgs-unstable` follow the `master` branch of the
-nixpkgs repository, although both do lag the `master` branch by generally
-[a couple of days](https://status.nixos.org/). Updates to a channel are
-distributed as soon as all tests for that channel pass, e.g.
-[this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
-shows the status of tests for the `nixpkgs-unstable` channel.
-
-The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
-which also builds binary packages from the Nix expressions in Nixpkgs for
-`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`.
-The binaries are made available via a [binary cache](https://cache.nixos.org).
-
-The current Nix expressions of the channels are available in the
-[nixpkgs repository](https://github.com/NixOS/nixpkgs) in branches
-that correspond to the channel names (e.g. `nixos-22.11-small`).

doc/doc-support/header.html

@@ -1,7 +0,0 @@
-<div class="manual-header">
-    <nav class="manual-header--tabs">
-        <a class="manual-header--tab manual-header--tab-active" href="#">Nixpkgs</a>
-        <a class="manual-header--tab" href="https://nixos.org/manual/nixos/stable/">NixOS</a>
-    </nav>
-    <span class="manual-header--title">Nixpkgs Manual</span>
-</div>

doc/doc-support/package.nix

@@ -119,8 +119,6 @@ stdenvNoCC.mkDerivation (
         --script ./anchor-use.js \
         --sidebar-depth 3 \
         --nav ./nav.json \
-        --header ${./header.html}\
-        --no-navheader \
         manual.md \
         out/index.html
 

doc/hooks/check-phase-thread-limit-hook.section.md

@@ -1,24 +0,0 @@
-# checkPhaseThreadLimitHook {#setup-hook-check-phase-thread-limit}
-
-This hook defaults a variety of environment variables known
-to control thread counts to 1. Many of these otherwise default
-to `$(nproc)`, which causes massive overloads on build machines
-if nix build jobs and build cores are already tuned to fully utilize
-compute capacity of a builder without additional parallelism.
-
-Currently sets the following environment variables:
-- [`OMP_NUM_THREADS`](https://www.openmp.org/spec-html/5.0/openmpse50.html)
-- [`OPENBLAS_NUM_THREADS`](https://github.com/OpenMathLib/OpenBLAS/blob/e7b45174355edec1f04de1cabcf5ca6a98ea7fbc/USAGE.md#how-can-i-use-openblas-in-multi-threaded-applications)
-- [`MKL_NUM_THREADS`](https://www.intel.com/content/www/us/en/docs/onemkl/developer-guide-linux/2023-0/mkl-domain-num-threads.html)
-- [`BLIS_NUM_THREADS`](https://github.com/flame/blis/blob/b8b75b4e19459f5d618b57aa814ca38b1d82eb82/docs/Multithreading.md#specifying-multithreading)
-- `VECLIB_MAXIMUM_THREADS`: Only affects darwin, see [`man 7 Accelerate`](https://manp.gs/mac/7/Accelerate)
-- [`NUMBA_NUM_THREADS`](https://numba.readthedocs.io/en/stable/reference/envvars.html#threading-control)
-- [`NUMEXPR_NUM_THREADS`](https://numexpr.readthedocs.io/en/latest/user_guide.html#threadpool-configuration)
-
-The `NIX_CHECK_PHASE_DEFAULT_NUM_THREADS` environment variable
-can be used to override the default thread count limit.
-`dontLimitCheckPhaseThreads = true;` can be used to disable
-thread limiting on an individual package.
-
-This hook will not attempt to override already existing
-definitions for thread count environment variables.

doc/hooks/index.md

@@ -13,7 +13,6 @@ aws-c-common.section.md
 bmake.section.md
 breakpoint.section.md
 cernlib.section.md
-check-phase-thread-limit-hook.section.md
 cmake.section.md
 desktop-file-utils.section.md
 gdk-pixbuf.section.md
@@ -35,6 +34,7 @@ nodejs-install-manuals.section.md
 npm-build-hook.section.md
 npm-config-hook.section.md
 npm-install-hook.section.md
+openmp-check-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md

doc/hooks/openmp-check-hook.section.md

@@ -0,0 +1,10 @@
+# openmpCheckPhaseHook {#setup-hook-omp-check}
+
+
+This hook can be used to setup a check phase that
+requires running a OpenMP application. It mostly
+serves to limit `OMP_NUM_THREADS` to avoid overloading
+build machines.
+
+This hook will not attempt to override an already existing
+definition of `OMP_NUM_THREADS` in the environment.

doc/hooks/pnpm.section.md

@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
-    fetcherVersion = 4;
+    fetcherversion = 4;
     hash = lib.fakeHash;
   };
 
@@ -123,7 +123,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
-    fetcherVersion = 4;
+    fetcherversion = 4;
     hash = lib.fakeHash;
   };
 

doc/languages-frameworks/lua.section.md

@@ -167,12 +167,9 @@ To add a new package without updating all packages, run
 ```sh
 
 nix-shell -p luarocks-packages-updater
-luarocks-packages-updater add [--maintainers "<maintainer>"] <package-name>
+luarocks-packages-updater add <package-name>
 ```
 
-The optional `--maintainers` argument accepts a space-separated list of nixpkgs maintainer names.
-When omitted, the package is added without maintainers.
-
 [luarocks2nix](https://github.com/nix-community/luarocks) is a tool capable of generating nix derivations from both rockspec and src.rock (and favors the src.rock).
 The automation only goes so far though and some packages need to be customized.
 These customizations go in [pkgs/development/lua-modules/overrides.nix](https://github.com/NixOS/nixpkgs/tree/master/pkgs/development/lua-modules/overrides.nix).

doc/languages-frameworks/rocq.section.md

@@ -59,7 +59,7 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
 * `releaseRev` (optional, defaults to `(v: v)`), provides a default mapping from release names to revision hashes/branch names/tags,
 * `releaseArtifact` (optional, defaults to `(v: null)`), provides a default mapping from release names to artifact names (only works for github artifact for now),
 * `displayVersion` (optional), provides a way to alter the computation of `name` from `pname`, by explaining how to display version numbers,
-* `namePrefix` (optional, defaults to `[ "rocq" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
+* `namePrefix` (optional, defaults to `[ "rocq-core" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
 * `nativeBuildInputs` (optional), is a list of executables that are required to build the current derivation, in addition to the default ones (namely `which`, `dune` and `ocaml` depending on whether `useDune`, `useDuneifVersion` and `mlPlugin` are set).
 * `extraNativeBuildInputs` (optional, deprecated), an additional list of derivation to add to `nativeBuildInputs`,
 * `overrideNativeBuildInputs` (optional) replaces the default list of derivation to which `nativeBuildInputs` and `extraNativeBuildInputs` adds extra elements,
@@ -68,14 +68,12 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
 * `overrideBuildInputs` (optional) replaces the default list of derivation to which `buildInputs` and `extraBuildInputs` adds extras elements,
 * `propagatedBuildInputs` (optional) is passed as is to `mkDerivation`, we recommend to use this for Rocq libraries and Rocq plugin dependencies, as this makes sure the paths of the compiled libraries and plugins will always be added to the build environments of subsequent derivation, which is necessary for Rocq packages to work correctly,
 * `mlPlugin` (optional, defaults to `false`). Some extensions (plugins) might require OCaml and sometimes other OCaml packages. Standard dependencies can be added by setting the current option to `true`. For a finer grain control, the `rocq-core.ocamlPackages` attribute can be used in `nativeBuildInputs`, `buildInputs`, and `propagatedBuildInputs` to depend on the same package set Rocq was built against.
-* `useDuneifVersion` (optional, default to `(x: false)`) uses Dune to build the package if the provided predicate evaluates to true on the version, e.g. `useDuneifVersion = versions.isGe "1.1"`  will use dune if the version of the package is greater or equal to `"1.1"`,
+* `useDuneifVersion` (optional, default to `(x: false)` uses Dune to build the package if the provided predicate evaluates to true on the version, e.g. `useDuneifVersion = versions.isGe "1.1"`  will use dune if the version of the package is greater or equal to `"1.1"`,
 * `useDune` (optional, defaults to `false`) uses Dune to build the package if set to true, the presence of this attribute overrides the behavior of the previous one.
 * `opam-name` (optional, defaults to concatenating with a dash separator the components of `namePrefix` and `pname`), name of the Dune package to build.
 * `enableParallelBuilding` (optional, defaults to `true`), since it is activated by default, we provide a way to disable it.
 * `extraInstallFlags` (optional), allows to extend `installFlags` which initializes the variables `COQLIBINSTALL` and `COQPLUGININSTALL` so as to install in the proper subdirectory. Indeed Rocq libraries should be installed in `$(out)/lib/coq/${rocq-core.rocq-version}/user-contrib/`. Such directories are automatically added to the `$ROCQPATH` environment variable by the hook defined in the Rocq derivation.
 * `setROCQBIN` (optional, defaults to `true`), by default, the environment variable `$ROCQBIN` is set to the current Rocq's binary, but one can disable this behavior by setting it to `false`,
-* `useCoq` (optional, defaults to `false`), adds the Coq compatibility binaries to the build environment, which is necessary for some packages that still depend on them and sets `COQBIN` to the path of the `coqc` binary (if `setROCQBIN` is also set to `true`). A wrapper `mkCoqDerivation` is provided that sets this option to `true`.
-* `useCoqifVersion` (optional, defaults to `(x: false)`), adds the Coq compatibility binaries to the build environment if the provided predicate evaluates to true on the version. This can be useful for supporting old package versions that need the Coq compatibility binaries, while newer versions do not.
 * `useMelquiondRemake` (optional, default to `null`) is an attribute set, which, if given, overloads the `preConfigurePhases`, `configureFlags`, `buildPhase`, and `installPhase` attributes of the derivation for a specific use in libraries using `remake` as set up by Guillaume Melquiond for `flocq`, `gappalib`, `interval`, and `coquelicot` (see the corresponding derivation for concrete examples of use of this option). For backward compatibility, the attribute `useMelquiondRemake.logpath` must be set to the logical root of the library (otherwise, one can pass `useMelquiondRemake = {}` to activate this without backward compatibility).
 * `dropAttrs`, `keepAttrs`, `dropDerivationAttrs` are all optional and allow to tune which attribute is added or removed from the final call to `mkDerivation`.
 

doc/languages-frameworks/texlive.section.md

@@ -32,21 +32,6 @@ There is a TeX Live packaging that lives entirely under attribute `texlive`.
   )
   ```
 
-- Packages can be overriden by passing a new package with the same `pname` to `.withPackages`. For instance, the following replaces Asymptote with the version from Nixpkgs, which is usually more up to date:
-  ```nix
-  texliveMedium.withPackages (ps: [ asymptote ])
-  ```
-
-- To exclude a package from a collection, use an empty override as below:
-  ```nix
-  texliveBasic.withPackages (
-    ps: with ps; [
-      collection-bibtexextra
-      { pname = "bib2gls"; }
-    ]
-  )
-  ```
-
 - To add the documentation for all packages in the environment, use
   ```nix
   texliveSmall.overrideAttrs { withDocs = true; }

doc/languages-frameworks/vim.section.md

@@ -149,11 +149,6 @@ Note: this is not possible anymore for Neovim.
 
 ## Adding new plugins to nixpkgs {#adding-new-plugins-to-nixpkgs}
 
-:::{.note}
-Before adding a Neovim Lua plugin, check if a release is available on [luarocks](https://luarocks.org/).
-If it is, add it as a [LuaRocks based plugin](#neovim-luarocks-based-plugins).
-:::
-
 Nix expressions for Vim plugins are stored in [pkgs/applications/editors/vim/plugins](https://github.com/NixOS/nixpkgs/tree/master/pkgs/applications/editors/vim/plugins). For the vast majority of plugins, Nix expressions are automatically generated by running [`nix-shell -p vimPluginsUpdater --run vim-plugins-updater`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/utils/updater.nix). This creates a [generated.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/generated.nix) file based on the plugins listed in [vim-plugin-names](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/vim-plugin-names).
 
 When the vim updater detects an nvim-treesitter update, it also runs [`nvim-treesitter/update.py $(nix-build -A vimPlugins.nvim-treesitter)`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/utils/update.py) to update the tree sitter grammars for `nvim-treesitter`.

doc/preface.chapter.md

@@ -1,14 +1,50 @@
-# Overview {#preface}
+# Preface {#preface}
 
-Nixpkgs is a set of packages for the [Nix package manager](https://nixos.org/nix/), released under the [MIT license](https://github.com/NixOS/nixpkgs/blob/master/COPYING).
+The Nix Packages collection (Nixpkgs) is a set of thousands of packages for the
+[Nix package manager](https://nixos.org/nix/), released under a
+[permissive MIT license](https://github.com/NixOS/nixpkgs/blob/master/COPYING).
+Packages are available for several platforms, and can be used with the Nix
+package manager on most GNU/Linux distributions as well as [NixOS](https://nixos.org/nixos).
 
-Further documentation:
+This document is the user [_reference_](https://nix.dev/contributing/documentation/diataxis#reference) manual for Nixpkgs.
+It describes the entire public interface of Nixpkgs in a concise and orderly manner, and all relevant behaviors, with examples and cross-references.
 
+To discover other kinds of documentation:
 - [nix.dev](https://nix.dev/): Tutorials and guides for getting things done with Nix
-- [NixOS Search](https://search.nixos.org)
-- [Contributing](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md): to Nixpkgs
+- [NixOS **Option Search**](https://search.nixos.org/options) and reference documentation
+- [Nixpkgs **Package Search**](https://search.nixos.org/packages)
+- [**NixOS** manual](https://nixos.org/manual/nixos/stable/): Reference documentation for the NixOS Linux distribution
+- [`CONTRIBUTING.md`](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md): Contributing to Nixpkgs, including this manual
+
+## Overview of Nixpkgs {#overview-of-nixpkgs}
 
 Nix expressions describe how to build packages from source and are collected in
-the [nixpkgs repository](https://github.com/NixOS/nixpkgs).
+the [Nixpkgs repository](https://github.com/NixOS/nixpkgs). Also included in the
+collection are Nix expressions for
+[NixOS modules](https://nixos.org/nixos/manual/index.html#sec-writing-modules).
+With these expressions the Nix package manager can build binary packages.
 
-Packages are distributed through [channels](#how-channels-work).
+Packages, including the Nix packages collection, are distributed through
+[channels](https://nixos.org/nix/manual/#sec-channels). The collection is
+distributed for users of Nix on non-NixOS distributions through the channel
+`nixpkgs-unstable`. Users of NixOS generally use one of the `nixos-*` channels,
+e.g., `nixos-22.11`, which includes all packages and modules for the stable NixOS
+22.11. Stable NixOS releases are generally only given
+security updates. More up-to-date packages and modules are available via the
+`nixos-unstable` channel.
+
+Both `nixos-unstable` and `nixpkgs-unstable` follow the `master` branch of the
+Nixpkgs repository, although both do lag the `master` branch by generally
+[a couple of days](https://status.nixos.org/). Updates to a channel are
+distributed as soon as all tests for that channel pass, e.g.,
+[this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
+shows the status of tests for the `nixpkgs-unstable` channel.
+
+The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
+which also builds binary packages from the Nix expressions in Nixpkgs for
+`x86_64-linux`, `aarch64-linux`, and `aarch64-darwin`.
+The binaries are made available via a [binary cache](https://cache.nixos.org).
+
+The current Nix expressions of the channels are available in the
+[Nixpkgs repository](https://github.com/NixOS/nixpkgs) in branches
+that correspond to the channel names (e.g., `nixos-22.11-small`).

doc/redirects.json

@@ -152,9 +152,6 @@
   "ghc-deprecation-policy": [
     "index.html#ghc-deprecation-policy"
   ],
-  "how-channels-work": [
-    "index.html#how-channels-work"
-  ],
   "inkscape-plugins": [
     "index.html#inkscape-plugins"
   ],
@@ -398,7 +395,9 @@
     "index.html#pnpm-build-hook-honored-variables"
   ],
   "preface": [
-    "index.html#preface",
+    "index.html#preface"
+  ],
+  "overview-of-nixpkgs": [
     "index.html#overview-of-nixpkgs"
   ],
   "part-using": [
@@ -2921,8 +2920,7 @@
   "setup-hook-mpi-check": [
     "index.html#setup-hook-mpi-check"
   ],
-  "setup-hook-check-phase-thread-limit": [
-    "index.html#setup-hook-check-phase-thread-limit",
+  "setup-hook-omp-check": [
     "index.html#setup-hook-omp-check"
   ],
   "ninja": [

doc/release-notes/rl-2611.section.md

@@ -31,9 +31,6 @@
   By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
   We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
 
-- `bundlerApp` now sets `__structuredAttrs = true` for its result package.
-  Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
-
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
@@ -45,21 +42,13 @@
 
 - `python3Packages.django-health-check` has been updated to major version 4. See its [migration guide](https://codingjoe.dev/django-health-check/migrate-to-v4/) and [changelog](https://github.com/codingjoe/django-health-check/releases/tag/4.0.0) for breaking changes.
 
-- `jmtpfs` has been removed due to lack of maintenance and fuse3 support.
-
 - `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.
 
-- `mcphost` has been removed, as it was archived upstream and declared unmaintained.
-
-- `fflogs` has been removed because it was no longer functional. Users should switch to `archon-lite`.
-
 - `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
   Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
 
 - `zerofs` has been updated from `1.x` to `2.x` which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.
 
-- `keycloak.plugins.keycloak-metrics-spi` has been removed. Keycloak exposes Prometheus metrics natively on its management interface; enable them with the `metrics-enabled` setting (and `event-metrics-user-enabled` for login and event counters). See [Gaining insights with metrics](https://www.keycloak.org/observability/configuration-metrics).
-
 - `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
 
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
@@ -101,8 +90,6 @@
 
 - `texlive.combine` is deprecated and scheduled for removal in 27.05. Please migrate to `texliveSmall.withPackages` (see [](#sec-language-texlive-user-guide)).
 
-- `keycloak` was updated to >= 26.7.0 and includes some breaking internal (API) changes. See the [upstream migration guide](https://www.keycloak.org/docs/latest/upgrading/#migrating-to-26-7-0) for more information.
-
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
 
 - `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.
@@ -119,7 +106,6 @@
 - Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
 - `nim1` and respective aliases have been removed due to entering EOL; please migrate to `nim` or `nim-unwrapped` (nim 2).
 - `nim-2_0` & `nim-2_2` and respective aliases have been removed; please migrate to `nim` or `nim-unwrapped` (nim 2.2.10).
-- `domoticz` has been updated from `2024.7` to `2026.x`, breaking third party applications and scripts using the old RType calls. Review the [release notes](https://github.com/domoticz/domoticz/blob/2026.2/History.txt#L398) for more information.
 
 - `vimacs` has been removed, as it has not been maintained in 10 years and was built for an old version of vim (6.0).
 
@@ -151,15 +137,15 @@
 
 ### Breaking changes {#sec-nixpkgs-release-26.11-lib-breaking}
 
-- `fittrackee` 1.0.0 now requires postgres with postgis. The [upgrade guide](https://docs.fittrackee.org/en/upgrading-to-1.0.0.html) has steps to prepare for this upgrade.
+- Create the first release note entry in this section!
+
 
 ### Deprecations {#sec-nixpkgs-release-26.11-lib-deprecations}
 
-- Setting `config.allowBrokenPredicate` is deprecated in favor of
-  using `config.problems.handlers.PackageName.broken = "warn"` (or `=
-  "ignore"`). For more information see [](#sec-allow-broken).
+- Create the first release note entry in this section!
 
 
 ### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}
 
 - Create the first release note entry in this section!
+

doc/style.css

@@ -23,14 +23,14 @@ body {
 @media screen and (min-width: 992px) {
   .book,
   .appendix {
-    max-width: 55rem;
+    max-width: 60rem;
   }
 }
 
 @media screen and (min-width: 1200px) {
   .book,
   .appendix {
-    max-width: 55rem;
+    max-width: 73rem;
   }
 }
 
@@ -156,7 +156,8 @@ body {
 }
 
 a {
-  text-decoration: underline;
+  text-decoration: none;
+  border-bottom: 1px solid;
   color: var(--link-color);
 }
 
@@ -397,7 +398,6 @@ div.appendix .variablelist .term {
 
 :root {
   --sidebar-width: 20rem;
-  --header-height: 3rem;
   --background: #fff;
   --main-text-color: #000;
   --link-color: #405d99;
@@ -479,8 +479,6 @@ div.appendix .variablelist .term {
 nav.toc-sidebar {
   height: 100%;
   padding: 0 1rem 2rem;
-  background-color: var(--background);
-  color: var(--main-text-color);
 }
 
 /* menu button, shown on mobile, hidden on desktop */
@@ -522,59 +520,6 @@ nav.toc-sidebar li {
 
 nav.toc-sidebar summary {
   cursor: pointer;
-  display: flex;
-  align-items: center;
-  list-style: none;
-}
-
-nav.toc-sidebar summary::before {
-  content: "▸";
-  flex: none;
-  font-size: 0.75em;
-}
-nav.toc-sidebar details[open] > summary::before {
-  content: "▾";
-}
-
-nav.toc-sidebar a {
-  display: block;
-  width: 100%;
-  padding: 3px 8px;
-  border-left: 3px solid transparent;
-  border-radius: 3px;
-  color: inherit;
-  transition:
-    background-color 120ms ease,
-    border-color 120ms ease;
-}
-nav.toc-sidebar a:hover {
-  background-color: #f2f2f2 !important;
-}
-
-nav.toc-sidebar a.active {
-  background-color: #d8d8d8;
-  border-left-color: #444;
-  font-weight: 600;
-}
-nav.toc-sidebar a.active-trail {
-  border-left-color: #bbb;
-  background-color: #e8e8e8;
-}
-
-@media (prefers-color-scheme: dark) {
-  nav.toc-sidebar a:hover {
-    /* hover should win over scroll selectors despite beeing less specific */
-    background-color: #606060 !important;
-  }
-  nav.toc-sidebar a.active {
-    background-color: #373737;
-    border-left-color: #eee;
-    font-weight: 600;
-  }
-  nav.toc-sidebar a.active-trail {
-    border-left-color: #eee;
-    background-color: #323232;
-  }
 }
 
 @media screen and (min-width: 768px) {
@@ -583,7 +528,7 @@ nav.toc-sidebar a.active-trail {
     min-height: 0;
     display: grid;
     grid-template-columns: minmax(0, 1fr);
-    grid-template-rows: var(--header-height) auto minmax(0, 1fr);
+    grid-template-rows: auto minmax(0, 1fr);
   }
 
   body:has(> nav.toc-sidebar) {
@@ -592,7 +537,7 @@ nav.toc-sidebar a.active-trail {
 
   .navheader {
     grid-column: 1 / -1;
-    grid-row: 2;
+    grid-row: 1;
   }
 
   nav.toc-sidebar {
@@ -603,10 +548,11 @@ nav.toc-sidebar a.active-trail {
     /*  */
     margin: 0;
     grid-column: 1;
-    grid-row: 3;
+    grid-row: 2;
     max-height: none;
     overflow-y: auto;
     border: none;
+    border-right: 0.0625rem solid #d8d8d8;
   }
 
   /* Hide the toggle button on desktop */
@@ -616,7 +562,7 @@ nav.toc-sidebar a.active-trail {
 
   main.content {
     grid-column: 1 / -1;
-    grid-row: 3;
+    grid-row: 2;
     overflow-y: auto;
     padding: 0 1rem;
   }
@@ -625,73 +571,3 @@ nav.toc-sidebar a.active-trail {
     grid-column: 2;
   }
 }
-
-.manual-header {
-  background-color: var(--background);
-  border-bottom: 0.0625rem solid #d8d8d8;
-  display: flex;
-  flex-direction: column;
-}
-
-.manual-header--title {
-  order: -1;
-  padding: 0.5rem 1rem 0;
-  font-size: 0.875rem;
-  font-weight: 500;
-  color: var(--small-heading-color);
-  text-align: center;
-}
-
-.manual-header--tabs {
-  display: flex;
-  align-items: stretch;
-  justify-content: space-around;
-  margin: 0;
-  padding: 0;
-}
-
-.manual-header--tab {
-  display: flex;
-  align-items: center;
-  padding: 0 1rem;
-  font-size: 0.875rem;
-  font-weight: 500;
-  color: var(--main-text-color);
-  text-decoration: none;
-  border-bottom: 0.1875rem solid transparent;
-  border-top: 0.1875rem solid transparent;
-  transition: border-bottom-color 0.15s ease;
-}
-
-.manual-header--tab:hover {
-  border-bottom-color: var(--heading-color);
-  color: var(--main-text-color);
-}
-
-.manual-header--tab-active {
-  border-bottom-color: var(--heading-color);
-  color: var(--heading-color);
-  font-weight: 700;
-}
-
-@media screen and (min-width: 768px) {
-  .manual-header {
-    height: var(--header-height);
-    flex-direction: row;
-    align-items: stretch;
-    grid-column: 1 / -1;
-    grid-row: 1;
-  }
-
-  .manual-header--title {
-    order: 0;
-    margin-left: auto;
-    padding: 0 1rem;
-    align-self: center;
-  }
-
-  .manual-header--tabs {
-    justify-content: flex-start;
-    padding: 0 1rem;
-  }
-}

doc/using-nixpkgs.md

@@ -1,7 +1,6 @@
 # Using Nixpkgs {#part-using}
 
 ```{=include=} chapters
-channels.chapter.md
 using/platform-support.chapter.md
 using/configuration.chapter.md
 using/overlays.chapter.md

doc/using/platform-support.chapter.md

@@ -1,16 +1,16 @@
 # Platform Support {#chap-platform-support}
 
-Packages receive varying degrees of support, both in terms of maintainer and security team attention and available computation resources for continuous integration (CI). We have 7 defined tiers denoting how well supported each platform is.
+Packages receive varying degrees of support, both in terms of maintainer attention and available computation resources for continuous integration (CI). We have 7 defined tiers denoting how well supported each platform is.
 
 ## Tiers {#sec-platform-tiers}
 
 ### Tier 1 {#sec-platform-tier1}
 
-[Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) platforms receive the highest level of support where problems can block updates, security fixes are treated with urgency, platform-specific patches are freely applied, and most packages are expected to work.
+[Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) platforms receive the highest level of support where problems can block updates, platform-specific patches are freely applied, and most packages are expected to work.
 
 ### Tier 2 {#sec-platform-tier2}
 
-[Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) platforms are expected to remain functional and secure with updates, receive platform-specific patches as needed, and have many packages built by Hydra with full ofBorg support.
+[Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) platforms are expected to remain functional with updates, receive platform-specific patches as needed, and have many packages built by Hydra with full ofBorg support.
 
 ### Tier 3 {#sec-platform-tier3}
 
@@ -22,25 +22,25 @@ Platform Tiers [4 through 7](https://github.com/NixOS/rfcs/blob/master/rfcs/0046
 
 ## Breakdown {#sec-platform-breakdown}
 
-| Triple                                | Support Tier                                                                                   | Channel Blockers | Hydra Support | Security Support | Ofborg Support | Bootstrap Tarballs | Cross Compiling Support |
-|---------------------------------------|------------------------------------------------------------------------------------------------|------------------|---------------|------------------|----------------|--------------------|-------------------------|
-| `x86_64-unknown-linux-gnu`            | [Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) | Many             | ✔️             | ✔️                | ✔️              | ✔️                  | ✔️                       |
-| `aarch64-unknown-linux-gnu`           | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some             | ✔️             | ✔️                | ✔️              | ✔️                  | ✔️                       |
-| `x86_64-unknown-linux-musl`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | Limited       | ❌               | ❌             | ✔️                  | ✔️                       |
-| `aarch64-unknown-linux-musl`          | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | Limited       | ❌               | ❌             | ✔️                  | ✔️                       |
-| `x86_64-unknown-unknown-freebsd`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some             | ✔️             | ✔️                | ✔️              | ✔️                  | ❌                      |
-| `i686-unknown-linux-gnu`              | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | Limited       | ❌               | ❌             | ✔️                  | ✔️                       |
-| `riscv32-unknown-linux-gnu`           | [Tier 4](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-4) | None             | ❌            | ❌               | ❌             | ❌                 | ✔️                       |
-| `riscv64-unknown-linux-gnu`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `loongarch64-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `armv6l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `armv6l-unknown-linux-musleabihf`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `armv7l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `armv5tel-unknown-linux-gnueabi`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `mips64el-unknown-linux-gnuabi64`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `mips64el-unknown-linux-gnuabin32`    | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `mipsel-unknown-linux-gnu`            | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `powerpc64-unknown-linux-gnuabielfv2` | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `powerpc64le-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `s390x-unknown-linux-gnu`             | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| Triple                                | Support Tier | Channel Blockers | Hydra Support | Ofborg Support | Bootstrap Tarballs | Cross Compiling Support |
+| ------------------------------------- | ------------ | ---------------- | ------------- | -------------- | ------------------ | ----------------------- |
+| `x86_64-unknown-linux-gnu`            | [Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) | Many | ✔️            | ✔️            | ✔️                 | ✔️                      |
+| `aarch64-unknown-linux-gnu`           | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ✔️                      |
+| `x86_64-unknown-linux-musl`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
+| `aarch64-unknown-linux-musl`          | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
+| `x86_64-unknown-unknown-freebsd`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ❌                       |
+| `i686-unknown-linux-gnu`              | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
+| `riscv32-unknown-linux-gnu`           | [Tier 4](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-4) | None | ❌             | ❌             | ❌                  | ✔️                      |
+| `riscv64-unknown-linux-gnu`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `loongarch64-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `armv6l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `armv6l-unknown-linux-musleabihf`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `armv7l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `armv5tel-unknown-linux-gnueabi`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `mips64el-unknown-linux-gnuabi64`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `mips64el-unknown-linux-gnuabin32`    | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `mipsel-unknown-linux-gnu`            | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `powerpc64-unknown-linux-gnuabielfv2` | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `powerpc64le-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `s390x-unknown-linux-gnu`             | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |

lib/attrsets.nix

@@ -1140,7 +1140,7 @@ rec {
 
     For a function that gives you control over what counts as a leaf, see `mapAttrsRecursiveCond`.
 
-    ::: {.example #map-attrs-recursive-example}
+    :::{#map-attrs-recursive-example .example}
     # Map over leaf attributes
 
     ```nix
@@ -1165,7 +1165,7 @@ rec {
     If the predicate returns false, `mapAttrsRecursiveCond` does not recurse, but instead applies the mapping function.
     If the predicate returns true, it does recurse, and does not apply the mapping function.
 
-    ::: {.example #map-attrs-recursive-cond-example}
+    :::{#map-attrs-recursive-cond-example .example}
     # Map over an leaf attributes defined by a condition
 
     Map derivations to their `name` attribute.

lib/customisation.nix

@@ -564,7 +564,7 @@ rec {
 
     # Examples
 
-    :::{.example #ex-makeScope}
+    :::{#ex-makeScope .example}
     # Create an interdependent package set on top of `pkgs`
 
     The functions in `foo.nix` and `bar.nix` can depend on each other, in the sense that `foo.nix` can contain a function that expects `bar` as an attribute in its argument.
@@ -593,7 +593,7 @@ rec {
     ```
     :::
 
-    :::{.example #ex-makeScope-callPackage}
+    :::{#ex-makeScope-callPackage .example}
     # Using `callPackage` from a scope
 
     ```nix

lib/licenses/licenses.nix

@@ -310,11 +310,6 @@ lib.mapAttrs mkLicense (
       redistributable = true;
     };
 
-    buddy = {
-      spdxId = "Buddy";
-      fullName = "Buddy License";
-    };
-
     bzip2 = {
       spdxId = "bzip2-1.0.6";
       fullName = "bzip2 and libbzip2 License v1.0.6";
@@ -387,13 +382,6 @@ lib.mapAttrs mkLicense (
       free = false;
     };
 
-    cc-by-nc-30-igo = {
-      # Currently does not have a spdxID will get one in the future https://github.com/spdx/license-list-XML/issues/2845
-      # spdxId = "CC-BY-NC-3.0-IGO";
-      fullName = "Creative Commons Attribution Non Commercial 3.0 IGO";
-      free = false;
-    };
-
     cc-by-nc-40 = {
       spdxId = "CC-BY-NC-4.0";
       fullName = "Creative Commons Attribution Non Commercial 4.0 International";
@@ -938,11 +926,6 @@ lib.mapAttrs mkLicense (
       free = false;
     };
 
-    jpl-image = {
-      fullName = "JPL Image Use Policy";
-      spdxId = "JPL-image";
-    };
-
     knuth = {
       fullName = "Knuth CTAN License";
       spdxId = "Knuth-CTAN";
@@ -1190,11 +1173,6 @@ lib.mapAttrs mkLicense (
       fullName = "Nethack General Public License";
     };
 
-    ngrep = {
-      spdxId = "ngrep";
-      fullName = "ngrep License";
-    };
-
     nistSoftware = {
       spdxId = "NIST-Software";
       fullName = "NIST Software License";
@@ -1628,11 +1606,6 @@ lib.mapAttrs mkLicense (
       url = "https://fedoraproject.org/wiki/Licensing:Wadalab?rd=Licensing/Wadalab";
     };
 
-    wordnet = {
-      spdxId = "WordNet";
-      fullName = "WordNet License";
-    };
-
     wtfpl = {
       spdxId = "WTFPL";
       fullName = "Do What The F*ck You Want To Public License";

lib/options.nix

@@ -90,12 +90,12 @@ rec {
       `defaultText`
       : Substitute for documenting the `default`, if evaluating the default value during documentation rendering is not possible.
       : Can be any nix value that evaluates.
-      : Usage with `lib.literalMD`, `lib.literalExpression`, or `lib.literalCode` is supported
+      : Usage with `lib.literalMD` or `lib.literalExpression` is supported
 
       `example`
       : Optional example value used in the manual.
       : Can be any nix value that evaluates.
-      : Usage with `lib.literalMD`, `lib.literalExpression`, or `lib.literalCode` is supported
+      : Usage with `lib.literalMD` or `lib.literalExpression` is supported
 
       `description`
       : Optional string describing the option. This is required if option documentation is generated.

lib/services/service.nix

@@ -7,11 +7,10 @@
 {
   lib,
   config,
-  options,
   ...
 }:
 let
-  inherit (lib) mkEnableOption mkOption types;
+  inherit (lib) mkOption types;
   pathOrStr = types.coercedTo types.path (x: "${x}") types.str;
 in
 {
@@ -41,7 +40,7 @@ in
       visible = "shallow";
     };
     process = {
-      argv = mkOption {
+      argv = lib.mkOption {
         type = types.listOf pathOrStr;
         example = lib.literalExpression ''[ (lib.getExe config.package) "--nobackground" ]'';
         description = ''
@@ -70,35 +69,18 @@ in
           Command used for reloading in the underlying service manager to reload.
         '';
       };
-
-      environment = lib.mkOption {
-        type = types.lazyAttrsOf (
-          types.nullOr (types.coercedTo (types.either types.path types.package) (x: "${x}") types.str)
-        );
-        default = { };
-        example = lib.literalExpression ''{ FOO = "bar"; PATH = null; }'';
-        description = ''
-          Environment variables passed verbatim to the service process by the
-          service manager. Entries set to `null` actively unset the variable
-          before the process starts -- backends without native unset support use
-          a wrapper (e.g. `execline`'s `unexport`) so the variable is absent
-          even when the service manager or a backend-specific override would
-          otherwise supply it.
-
-          Values appear in the rendered unit and may be world-readable. For
-          secrets, use a backend-specific mechanism such as
-          `systemd.service.serviceConfig.EnvironmentFile`.
-        '';
-      };
     };
 
     notificationProtocol = mkOption {
-      type = types.submodule {
-        options = {
-          systemd = mkEnableOption "Whether the service supports systemd-notify.";
-          s6 = mkEnableOption "Whether the service supports s6-notify.";
-        };
-      };
+      type = types.listOf (
+        types.enum [
+          "systemd"
+          "s6"
+        ]
+      );
+
+      default = [ ];
+      apply = v: lib.unique v;
       description = ''
         Notification protocol that this service supports with the underlying service manager.
       '';
@@ -108,20 +90,13 @@ in
   config = {
     assertions = [
       {
-        # `reloadSignal` derives `reloadCommand` at `mkDefault` priority below, so a
-        # conflict only exists when the user *also* set `reloadCommand` explicitly.
-        # An explicit (non-`mkDefault`) definition has `defaultOverridePriority`.
-        assertion =
-          !(
-            config.process.reloadSignal != null
-            && options.process.reloadCommand.highestPrio <= lib.modules.defaultOverridePriority
-          );
+        assertion = config.process.reloadSignal != null && config.process.reloadCommand != null;
         message = "reloadSignal conflicts with reloadCommand. Please either use reloadSignal or reloadCommand.";
       }
     ];
 
-    process.reloadCommand = lib.mkIf (config.process.reloadSignal != null) (
-      lib.mkDefault "${pkgs.coreutils}/bin/kill -${config.process.reloadSignal} $MAINPID"
+    process.reloadCommand = (lib.mkIf config.process.reloadSignal != null) (
+      lib.mkForce "${pkgs.coreutils}/bin/kill -${config.process.reloadSignal} $MAINPID"
     );
   };
 }

lib/services/test.nix

@@ -48,10 +48,6 @@ let
             (dummyPkg "cowsay.sh")
             "world"
           ];
-          environment = {
-            FOO = "bar";
-            DROPPED = null;
-          };
         };
       };
       service3 = {
@@ -114,7 +110,6 @@ let
                 "/usr/bin/echo"
                 "hello"
               ];
-              environment = { };
             };
             services = { };
             assertions = [
@@ -133,10 +128,6 @@ let
                 "${dummyPkg "cowsay.sh"}"
                 "world"
               ];
-              environment = {
-                FOO = "bar";
-                DROPPED = null;
-              };
             };
             services = { };
             assertions = [ ];
@@ -145,7 +136,6 @@ let
           service3 = {
             process = {
               argv = [ "/bin/false" ];
-              environment = { };
             };
             services.exclacow = {
               process = {
@@ -153,7 +143,6 @@ let
                   "${dummyPkg "cowsay-ng"}/bin/cowsay"
                   "!"
                 ];
-                environment = { };
               };
               services = { };
               assertions = [

maintainers/github-teams.json

@@ -65,17 +65,6 @@
     },
     "name": "Beam"
   },
-  "boot-security": {
-    "description": "Maintain support for boot security technologies like Secure Boot",
-    "id": 18686947,
-    "maintainers": {
-      "emilazy": 18535642
-    },
-    "members": {
-      "ElvishJerricco": 1365692
-    },
-    "name": "Boot security"
-  },
   "bootstrapping": {
     "description": "coordinates efforts towards bootstrappable builds (see https://bootstrappable.org/)",
     "id": 9141350,
@@ -162,7 +151,6 @@
       "samuela": 226872
     },
     "members": {
-      "ethancedwards8": 60861925,
       "prusnak": 42201
     },
     "name": "cuda-maintainers"
@@ -377,11 +365,9 @@
   "freedesktop": {
     "description": "Maintain Freedesktop.org packages for graphical desktop.",
     "id": 3806136,
-    "maintainers": {
-      "jtojnar": 705123
-    },
+    "maintainers": {},
     "members": {
-      "Hythera": 87016780
+      "jtojnar": 705123
     },
     "name": "Freedesktop"
   },

maintainers/maintainer-list.nix

@@ -93,11 +93,6 @@
     github = "0x120581f";
     githubId = 130835755;
   };
-  _0x2B = {
-    name = "0x2B";
-    github = "0x2B-bin";
-    githubId = 49249957;
-  };
   _0x3f = {
     name = "0x3f";
     github = "0x3fiona";
@@ -1294,12 +1289,6 @@
     name = "Alexandru Tocar";
     keys = [ { fingerprint = "B617 DD24 3AB0 2E3F 2E67  DBFD 1305 2A85 D7A4 2AA4"; } ];
   };
-  AlexAntonik = {
-    email = "antonikavv@gmail.com";
-    github = "AlexAntonik";
-    githubId = 55547934;
-    name = "Alex Antonik";
-  };
   alexarice = {
     email = "alexrice999@hotmail.co.uk";
     github = "alexarice";
@@ -1500,12 +1489,6 @@
     githubId = 60479013;
     name = "Alma Cemerlic";
   };
-  aln730 = {
-    email = "arnsg730@proton.me";
-    github = "aln730";
-    githubId = 94751172;
-    name = "AGawas";
-  };
   Alper-Celik = {
     email = "alper@alper-celik.dev";
     name = "Alper Çelik";
@@ -1603,12 +1586,6 @@
     githubId = 153175;
     name = "Andrew Marshall";
   };
-  ambiso = {
-    email = "ambisotopy@gmail.com";
-    github = "ambiso";
-    githubId = 3750466;
-    name = "Robin Leander Schröder";
-  };
   ambossmann = {
     email = "timogottszky+git@gmail.com";
     github = "Ambossmann";
@@ -1652,6 +1629,12 @@
     githubId = 382798;
     name = "amfl";
   };
+  amiddelk = {
+    email = "amiddelk@gmail.com";
+    github = "amiddelk";
+    githubId = 1358320;
+    name = "Arie Middelkoop";
+  };
   aminechikhaoui = {
     email = "amine.chikhaoui91@gmail.com";
     github = "AmineChikhaoui";
@@ -1960,17 +1943,6 @@
     githubId = 143312793;
     name = "Annin";
   };
-  anntnzrb = {
-    github = "anntnzrb";
-    githubId = 51257127;
-    name = "anntnzrb";
-  };
-  anntoin = {
-    email = "anntoin@gmail.com";
-    github = "Anntoin";
-    githubId = 3289027;
-    name = "Anntóin Wilkinson";
-  };
   anoa = {
     matrix = "@andrewm:amorgan.xyz";
     email = "andrew@amorgan.xyz";
@@ -2030,12 +2002,6 @@
     githubId = 14838767;
     name = "Jacopo Scannella";
   };
-  antoineco = {
-    email = "hello@acotten.com";
-    github = "antoineco";
-    githubId = 3299086;
-    name = "Antoine Cotten";
-  };
   anton-4 = {
     name = "Anton";
     github = "Anton-4";
@@ -2734,11 +2700,6 @@
     githubId = 574938;
     name = "Jonathan Glines";
   };
-  auscaster = {
-    github = "auscaster";
-    githubId = 100876;
-    name = "Kam Low";
-  };
   auscyber = {
     email = "ivyp@outlook.com.au";
     github = "auscyber";
@@ -3423,6 +3384,13 @@
     githubId = 32903896;
     keys = [ { fingerprint = "CB5C 7B3C 3E6F 2A59 A583  A90A 8A60 0376 7BE9 5976"; } ];
   };
+  benesim = {
+    name = "Benjamin Isbarn";
+    email = "benjamin.isbarn@gmail.com";
+    github = "BeneSim";
+    githubId = 29384538;
+    keys = [ { fingerprint = "D35E C9CE E631 638F F1D8  B401 6F0E 410D C3EE D02"; } ];
+  };
   bengsparks = {
     email = "benjamin.sparks@protonmail.com";
     github = "bengsparks";
@@ -4184,12 +4152,6 @@
     github = "brittonr";
     githubId = 4730485;
   };
-  BrockoliniMorgan = {
-    name = "Brock Morgan";
-    email = "brockjamesmorgan@gmail.com";
-    github = "BrockoliniMorgan";
-    githubId = 166275321;
-  };
   brodes = {
     email = "me@brod.es";
     github = "brhoades";
@@ -4465,12 +4427,6 @@
       { fingerprint = "8916 F727 734E 77AB 437F  A33A 19AB 76F5 CEE1 1392"; }
     ];
   };
-  caguiclajmg = {
-    email = "jmg.caguicla@guarandoo.me";
-    github = "caguiclajmg";
-    githubId = 32662060;
-    name = "John Mark Gabriel Caguicla";
-  };
   CaiqueFigueiredo = {
     email = "public@caiquefigueiredo.me";
     github = "caiquefigueiredo";
@@ -4684,19 +4640,6 @@
     githubId = 53847249;
     name = "Casey Avila";
   };
-  caspersonn = {
-    email = "lucakasper8@gmail.com";
-    github = "Caspersonn";
-    githubId = 96787412;
-    name = "Luca Kasper";
-  };
-  cassandracomar = {
-    name = "Cassandra Comar";
-    github = "cassandracomar";
-    githubId = 320772;
-    email = "cass@mountclare.net";
-    keys = [ { fingerprint = "104E E74E 24A0 372B EAF5  5533 B019 18F7 7E04 AC99"; } ];
-  };
   castorNova2 = {
     email = "solemnsquire@gmail.com";
     github = "castorNova2";
@@ -4776,6 +4719,12 @@
     githubId = 52760912;
     name = "Cameron Brown";
   };
+  ccellado = {
+    email = "annplague@gmail.com";
+    github = "ccellado";
+    githubId = 44584960;
+    name = "Denis Khalmatov";
+  };
   ccicnce113424 = {
     email = "ccicnce113424@gmail.com";
     matrix = "@ccicnce113424:matrix.org";
@@ -5259,12 +5208,6 @@
     githubId = 1448923;
     name = "Christian Kauhaus";
   };
-  ckgxrg = {
-    email = "ckgxrg@ckgxrg.io";
-    github = "ckgxrg-salt";
-    githubId = 165614491;
-    name = "ckgxrg";
-  };
   cko = {
     email = "christine.koppelt@gmail.com";
     github = "cko";
@@ -5652,11 +5595,6 @@
     githubId = 5953003;
     name = "Connor Nelson";
   };
-  conny = {
-    github = "ConstantConstantin";
-    githubId = 162139822;
-    name = "Constantin-Paul Hertel";
-  };
   conradmearns = {
     email = "conradmearns+github@pm.me";
     github = "ConradMearns";
@@ -6302,12 +6240,6 @@
     github = "darkyzhou";
     githubId = 7220778;
   };
-  darshancode2005 = {
-    name = "Darshan Thakare";
-    email = "darshanthakaregsoc2023@gmail.com";
-    github = "DarshanCode2005";
-    githubId = 143271270;
-  };
   daru-san = {
     name = "Daru";
     email = "zadarumaka@proton.me";
@@ -6413,12 +6345,6 @@
     github = "David-Kopczynski";
     githubId = 53194670;
   };
-  David-Moody = {
-    name = "David Moody";
-    email = "david.moody@scot.me.uk";
-    github = "David-Moody";
-    githubId = 63956662;
-  };
   david-sawatzke = {
     email = "d-nix@sawatzke.dev";
     github = "david-sawatzke";
@@ -6853,13 +6779,6 @@
     githubId = 77843198;
     name = "Vasilis Manetas";
   };
-  Deric-W = {
-    email = "robo-eric@gmx.de";
-    github = "Deric-W";
-    githubId = 42873573;
-    name = "Eric Wolf";
-    keys = [ { fingerprint = "ADAA B6F3 A955 5589 D66C  CE61 80D2 DA42 8A4A 537F"; } ];
-  };
   DerickEddington = {
     email = "derick.eddington@pm.me";
     github = "DerickEddington";
@@ -7117,6 +7036,12 @@
     github = "DimitarNestorov";
     githubId = 8790386;
   };
+  diniamo = {
+    name = "diniamo";
+    email = "diniamo53@gmail.com";
+    github = "diniamo";
+    githubId = 55629891;
+  };
   diogomdp = {
     email = "me@diogodp.dev";
     github = "diogomdp";
@@ -8922,13 +8847,6 @@
     githubId = 345808;
     name = "Jakub Okoński";
   };
-  FatBoyXPC = {
-    name = "FatBoyXPC";
-    email = "fatboyxpc@gmail.com";
-    github = "FatBoyXPC";
-    githubId = 744962;
-    keys = [ { fingerprint = "0E08 1B81 CBCA 1CF7 9568  A13F C4ED 3CA2 3211 8969"; } ];
-  };
   faukah = {
     github = "faukah";
     name = "faukah";
@@ -9109,11 +9027,6 @@
     githubId = 5198058;
     name = "Udo Sauer";
   };
-  fernvenue = {
-    github = "fernvenue";
-    githubId = 84565547;
-    name = "fernvenue";
-  };
   feyorsh = {
     email = "george@feyor.sh";
     github = "Feyorsh";
@@ -9170,12 +9083,6 @@
     githubId = 41450706;
     name = "fin-w";
   };
-  fiona = {
-    email = "mail@fiona.hamburg";
-    github = "Fiona42069";
-    githubId = 260108682;
-    name = "fiona";
-  };
   fionera = {
     email = "nix@fionera.de";
     github = "fionera";
@@ -10117,6 +10024,12 @@
     name = "Will Owens";
     keys = [ { fingerprint = "8E98 BB01 BFF8 AEA4 E303  FC4C 8074 09C9 2CE2 3033"; } ];
   };
+  ghuntley = {
+    email = "ghuntley@ghuntley.com";
+    github = "ghuntley";
+    githubId = 127353;
+    name = "Geoffrey Huntley";
+  };
   gibbert = {
     email = "gbjgms@gmail.com";
     github = "zgibberish";
@@ -10479,12 +10392,6 @@
     githubId = 273582;
     name = "greg";
   };
-  gregshuflin = {
-    email = "greg@everdayimshuflin.com";
-    github = "neunenak";
-    githubId = 311545;
-    name = "Greg Shuflin";
-  };
   greizgh = {
     email = "greizgh@ephax.org";
     github = "greizgh";
@@ -11544,18 +11451,6 @@
     githubId = 69209;
     name = "Ian Duncan";
   };
-  IanHollow = {
-    github = "IanHollow";
-    githubId = 72767437;
-    name = "Ian Holloway";
-  };
-  iank = {
-    email = "iank@iank.org";
-    github = "iank";
-    githubId = 109598;
-    name = "Ian Kilgore";
-    keys = [ { fingerprint = "21F7 244E 095F 619E 8E3E  1EB4 9F3A 4AAB 4D90 D879"; } ];
-  };
   ianliu = {
     email = "ian.liu88@gmail.com";
     github = "ianliu";
@@ -11966,6 +11861,12 @@
     name = "Silvan Mosberger";
     keys = [ { fingerprint = "6C2B 55D4 4E04 8266 6B7D  DA1A 422E 9EDA E015 7170"; } ];
   };
+  iniw = {
+    email = "git@vini.cat";
+    github = "iniw";
+    githubId = 30220881;
+    name = "Vinicius Deolindo";
+  };
   insipx = {
     email = "github@andrewplaza.dev";
     github = "insipx";
@@ -12009,12 +11910,6 @@
     githubId = 16307070;
     name = "iosmanthus";
   };
-  ipetkov = {
-    name = "Ivan Petkov";
-    github = "ipetkov";
-    githubId = 1638690;
-    email = "nixpkgs@ipetkov.dev";
-  };
   ipsavitsky = {
     email = "ipsavitsky234@gmail.com";
     github = "ipsavitsky";
@@ -12316,12 +12211,6 @@
     githubId = 67414100;
     name = "Jachym Putta";
   };
-  jack-avery = {
-    email = "jack.avery.business@gmail.com";
-    github = "jack-avery";
-    githubId = 47289484;
-    name = "Jack Avery";
-  };
   jackcres = {
     email = "crespomerchano@gmail.com";
     github = "omarcresp";
@@ -12589,12 +12478,6 @@
     github = "JaviMerino";
     githubId = 44926;
   };
-  jayadeep-km-sonarsource = {
-    email = "jayadeep.kinavoormadam@sonarsource.com";
-    name = "Jayadeep Kinavoor Madam";
-    github = "jayadeep-km-sonarsource";
-    githubId = 156662663;
-  };
   jayesh-bhoot = {
     name = "Jayesh Bhoot";
     email = "jb@jayeshbhoot.com";
@@ -12868,12 +12751,6 @@
     githubId = 5741620;
     name = "Jeremy Schlatter";
   };
-  jeremystucki = {
-    email = "dev@jeremystucki.ch";
-    github = "jeremystucki";
-    githubId = 7629727;
-    name = "Jeremy Stucki";
-  };
   jerith666 = {
     email = "github@matt.mchenryfamily.org";
     github = "jerith666";
@@ -13293,6 +13170,12 @@
     githubId = 879272;
     name = "Julio Merino";
   };
+  jn-sena = {
+    email = "jn-sena@proton.me";
+    github = "jn-sena";
+    githubId = 45771313;
+    name = "Sena";
+  };
   jnsgruk = {
     email = "jon@sgrs.uk";
     github = "jnsgruk";
@@ -14219,14 +14102,6 @@
     name = "Kenichi Kamiya";
     keys = [ { fingerprint = "9121 5D87 20CA B405 C63F  24D2 EF6E 574D 040A E2A5"; } ];
   };
-  kacper-uminski = {
-    name = "Kacper Uminski";
-    email = "kacper+nixpkgs@lysator.liu.se";
-    github = "kacper-uminski";
-    githubId = 57466578;
-    matrix = "@kacper.uminski:matrix.org";
-    keys = [ { fingerprint = "3DF9 3DEB CAA9 81FA B3E2  A7F0 87DA 201D E02F 14B1"; } ];
-  };
   kaction = {
     name = "Dmitry Bogatov";
     email = "KAction@disroot.org";
@@ -14466,12 +14341,6 @@
     github = "keller00";
     githubId = 8452750;
   };
-  kenis1108 = {
-    email = "1836362346@qq.com";
-    github = "kenis1108";
-    githubId = 45393183;
-    name = "kenis";
-  };
   kenran = {
     email = "johannes.maier@mailbox.org";
     github = "kenranunderscore";
@@ -15628,12 +15497,6 @@
     githubId = 632767;
     name = "Guillaume Maudoux";
   };
-  layzyoldman = {
-    email = "ricardopaivacampos@gmail.com";
-    github = "layzyoldman";
-    githubId = 193278607;
-    name = "Ricardo Campos";
-  };
   LazilyStableProton = {
     email = "LazilyStable@proton.me";
     github = "LazyStability";
@@ -16500,11 +16363,6 @@
     githubId = 83420438;
     name = "Lewis";
   };
-  lubsch = {
-    github = "lubsch";
-    githubId = 33580245;
-    name = "Benjamin Lohmar";
-  };
   luc65r = {
     email = "lucas@ransan.fr";
     github = "luc65r";
@@ -16717,6 +16575,12 @@
     githubId = 10746692;
     name = "Leopold Luley";
   };
+  lumi = {
+    email = "lumi@pew.im";
+    github = "lumi-me-not";
+    githubId = 26020062;
+    name = "lumi";
+  };
   luminarleaf = {
     github = "LuminarLeaf";
     githubId = 80571430;
@@ -18950,12 +18814,6 @@
     githubId = 830082;
     name = "Nathan Moos";
   };
-  mootfrost = {
-    email = "hello@mootfrost.dev";
-    github = "mootfrost";
-    githubId = 75925945;
-    name = "Andrew Semeykin";
-  };
   moraxyc = {
     name = "Moraxyc Xu";
     email = "i@qaq.li";
@@ -19315,12 +19173,6 @@
     githubId = 220262;
     name = "Ion Mudreac";
   };
-  mugaizzo = {
-    email = "mugahedman@hotmail.com";
-    github = "mugaizzo";
-    githubId = 15838537;
-    name = "Mugahed Izzeldin";
-  };
   mulatta = {
     email = "seungwon@mulatta.io";
     github = "mulatta";
@@ -19818,12 +19670,6 @@
     githubId = 364510;
     name = "Tobias Geerinckx-Rice";
   };
-  ndavd = {
-    email = "email@ndavd.com";
-    github = "ndavd";
-    githubId = 74260683;
-    name = "Nuno David";
-  };
   ndl = {
     email = "ndl@endl.ch";
     github = "ndl";
@@ -19936,12 +19782,6 @@
     name = "neo";
     email = "chojs990222@gmail.com";
   };
-  neobrain = {
-    github = "neobrain";
-    githubId = 4840017;
-    matrix = "@neobrain:matrix.org";
-    name = "Tony Wasserka";
-  };
   neonvoid = {
     email = "me@neonvoid.dev";
     github = "neonvoidx";
@@ -20244,12 +20084,6 @@
     github = "nigelgbanks";
     githubId = 487373;
   };
-  nightconcept = {
-    email = "dark@nightconcept.net";
-    github = "nightconcept";
-    githubId = 486025;
-    name = "Danny Solivan";
-  };
   nikhilmaddirala = {
     name = "Nikhil Maddirala";
     github = "nikhilmaddirala";
@@ -20475,12 +20309,6 @@
     githubId = 4242897;
     name = "Nikolai Mishin";
   };
-  nmoya = {
-    email = "nikolasmoya@gmail.com";
-    github = "nmoya";
-    githubId = 1767648;
-    name = "Nikolas Moya";
-  };
   noaccos = {
     name = "Francesco Noacco";
     email = "francesco.noacco2000@gmail.com";
@@ -20839,9 +20667,8 @@
     github = "numinit";
     githubId = 369111;
     keys = [
-      # SSH, per-machine yubikey ecdsa-sk keys
+      # SSH
       { fingerprint = "XX/0lMz82MpucPqf0KG+5EJoozzNRi8i/t59byD2kNo"; }
-      { fingerprint = "dye2C1N4RQaf+8ht5Ipd52BbnnuwBtdXxocPzk8b2mw"; }
       # GPG, >=2025, stays in one place
       { fingerprint = "FD28 F9C9 81C5 D78E 56E8  8311 5C3E B94D 198F 1491"; }
       # GPG, >=2025, travels with me
@@ -21319,6 +21146,12 @@
     githubId = 19862;
     name = "KJ Ørbekk";
   };
+  orbitz = {
+    email = "mmatalka@gmail.com";
+    github = "orbitz";
+    githubId = 75299;
+    name = "Malcolm Matalka";
+  };
   orhun = {
     email = "orhunparmaksiz@gmail.com";
     github = "orhun";
@@ -22137,12 +21970,6 @@
     githubId = 421510;
     name = "Noé Rubinstein";
   };
-  phluxjr = {
-    email = "phluxjr@phluxjr.net";
-    github = "phluxjr";
-    githubId = 185956030;
-    name = "phluxjr";
-  };
   pho = {
     email = "phofin@gmail.com";
     github = "pho";
@@ -24522,12 +24349,6 @@
     githubId = 20300874;
     name = "Mohammad Rafiq";
   };
-  rsahwe = {
-    email = "rsahwe@gmx.net";
-    github = "rsahwe";
-    githubId = 201613730;
-    name = "rsahwe";
-  };
   rseichter = {
     email = "nixos.org@seichter.de";
     github = "rseichter";
@@ -25005,12 +24826,6 @@
     githubId = 47582;
     name = "Samir Talwar";
   };
-  samiser = {
-    email = "nixos@me.samiser.xyz";
-    github = "samiser";
-    githubId = 32001364;
-    name = "Sam";
-  };
   samlich = {
     email = "nixos@samli.ch";
     github = "samlich";
@@ -25793,6 +25608,12 @@
     githubId = 106669955;
     name = "Léon Gessner";
   };
+  shardy = {
+    email = "shardul@baral.ca";
+    github = "shardulbee";
+    githubId = 16765155;
+    name = "Shardul Baral";
+  };
   sharpchen = {
     github = "sharpchen";
     githubId = 77432836;
@@ -26092,12 +25913,6 @@
     name = "Nikolay Korotkiy";
     keys = [ { fingerprint = "ADF4 C13D 0E36 1240 BD01  9B51 D1DE 6D7F 6936 63A5"; } ];
   };
-  silicalet = {
-    name = "Mr. why";
-    email = "silicalet@outlook.com";
-    github = "silicalet";
-    githubId = 188071249;
-  };
   silky = {
     name = "Noon van der Silk";
     email = "noonsilk+nixpkgs@gmail.com";
@@ -26568,14 +26383,6 @@
     githubId = 7116239;
     keys = [ { fingerprint = "E067 520F 5EF2 C175 3F60  50C0 BA46 725F 6A26 7442"; } ];
   };
-  Soliprem = {
-    email = "me@soliprem.eu";
-    matrix = "@soliprem:soliprem.eu";
-    name = "Francesco Prem Solidoro";
-    github = "Soliprem";
-    githubId = 73885403;
-    keys = [ { fingerprint = "F779 4E05 D8BB A608 73D0  1312 4FD6 B0D5 1C9A B6BD"; } ];
-  };
   solson = {
     email = "scott@solson.me";
     matrix = "@solson:matrix.org";
@@ -26768,6 +26575,12 @@
     github = "spreetin";
     githubId = 7392173;
   };
+  sprock = {
+    email = "rmason@mun.ca";
+    github = "sprock";
+    githubId = 6391601;
+    name = "Roger Mason";
+  };
   sputn1ck = {
     email = "kon@kon.ninja";
     github = "sputn1ck";
@@ -27342,13 +27155,6 @@
     githubId = 36695359;
     name = "Vasyl Solovei";
   };
-  swaggeroo = {
-    email = "swaggerooo@pm.me";
-    github = "swaggeroo";
-    githubId = 57057662;
-    name = "Swaggeroo";
-    keys = [ { fingerprint = "D221 99EC 4FFF EF4D F29D  2435 5208 74E7 3291 4E0B"; } ];
-  };
   swarren83 = {
     email = "shawn.w.warren@gmail.com";
     github = "swarren83";
@@ -29692,13 +29498,6 @@
     githubId = 116078858;
     keys = [ { fingerprint = "CDEA 7E04 69E3 0885 A754  4B05 0104 BC05 F41B 77B8"; } ];
   };
-  vherrmann = {
-    name = "Valentin Herrmann";
-    email = "me@valentin-herrmann.de";
-    github = "vherrmann";
-    githubId = 50072577;
-    keys = [ { fingerprint = "309D A29B 4070 FDFD C01A  3AB4 9E60 CB44 5C4B BC4C"; } ];
-  };
   videl = {
     email = "thibaut.smith@mailbox.org";
     github = "videl";
@@ -29853,6 +29652,12 @@
     githubId = 20145996;
     name = "Victor Fuentes";
   };
+  vlstill = {
+    email = "xstill@fi.muni.cz";
+    github = "vlstill";
+    githubId = 4070422;
+    name = "Vladimír Štill";
+  };
   vmandela = {
     email = "venkat.mandela@gmail.com";
     github = "vmandela";
@@ -29914,11 +29719,6 @@
     githubId = 7038383;
     name = "Vojta Káně";
   };
-  vokinn = {
-    github = "vokinn";
-    githubId = 113241287;
-    name = "vokin";
-  };
   volfyd = {
     email = "lb.nix@lisbethmail.com";
     github = "volfyd";
@@ -30443,12 +30243,6 @@
     githubId = 22803888;
     name = "Lu Hongxu";
   };
-  wini = {
-    email = "dev@vini.cat";
-    github = "iniw";
-    githubId = 30220881;
-    name = "Vinicius Deolindo";
-  };
   winpat = {
     email = "patrickwinter@posteo.ch";
     github = "winpat";
@@ -30927,11 +30721,6 @@
     githubId = 106241330;
     name = "Success Kingsley";
   };
-  xqtc161 = {
-    github = "xqtc161";
-    githubId = 65857432;
-    name = "tila";
-  };
   xrelkd = {
     github = "xrelkd";
     githubId = 46590321;
@@ -31224,13 +31013,6 @@
       { fingerprint = "D2A8 A906 ACA7 B6D6 575E 9A2F 3A49 5054 6EA6 9E5C"; }
     ];
   };
-  yoquec = {
-    email = "alvaro.viejo@yoquec.com";
-    github = "yoquec";
-    githubId = 59575696;
-    name = "Alvaro Viejo";
-    matrix = "@yoquec.com:matrix.org";
-  };
   yorickvp = {
     email = "yorickvanpelt@gmail.com";
     matrix = "@yorickvp:matrix.org";

maintainers/scripts/luarocks-packages.csv

@@ -6,13 +6,12 @@ basexx,,,,,,
 bcrypt,,,,,,ulysseszhan
 binaryheap,,,,,,vcunat
 bit32,,,,,5.1,lblasc
-busted,,,,,,alerque
+busted,,,,,,
 busted-htest,,,,,,mrcjkb
-canola.nvim,,,,,,saadndm
 cassowary,,,,,,alerque
 cldr,,,,,,alerque
 commons.nvim,,,,,5.1,mrcjkb
-compat53,,,,,,vcunat alerque
+compat53,,,,,,vcunat
 coop.nvim,,,,,,
 cosmo,,,,,,
 coxpcall,,,,1.17.0-1,,
@@ -38,7 +37,7 @@ inspect,,,,,,
 jsregexp,,,,0.0.7-2,,
 kulala.nvim,,,,,,
 ldbus,,,https://luarocks.org/dev,,,
-ldoc,,,,,,alerque
+ldoc,,,,,,
 lgi,,,,,,
 linenoise,https://raw.githubusercontent.com/hoelzro/lua-linenoise/master/linenoise-0.9-1.rockspec,,,,,
 ljsyscall,,,,,5.1,lblasc
@@ -62,7 +61,7 @@ lua-cjson,,,,,,
 lua-cmsgpack,,,,,,
 lua-curl,,,,,,
 lua-ffi-zlib,,,,,,
-lua-iconv,,,,7.0.0,,alerque
+lua-iconv,,,,7.0.0,,
 lua-lsp,,,,,,
 lua-messagepack,,,,,,
 lua-protobuf,,,,,,lockejan
@@ -78,10 +77,10 @@ lua-toml,,,,,,
 lua-utils.nvim,,,,,,mrcjkb
 lua-yajl,,,,,,pstn
 lua-zlib,,,,,,koral
-lua_cliargs,,,,,,alerque
+lua_cliargs,,,,,,
 luabitop,https://raw.githubusercontent.com/teto/luabitop/master/luabitop-1.0.2-3.rockspec,,,,,
-luacheck,,,,,,alerque
-luacov,,,,,,alerque
+luacheck,,,,,,
+luacov,,,,,,
 luacov-reporter-lcov,,,,,,ulysseszhan
 luadbi,,,,,,
 luadbi-mysql,,,,,,
@@ -91,7 +90,7 @@ luaepnf,,,,,,
 luaevent,,,,,,
 luaexpat,,,,,,arobyn flosse
 luaffi,,,https://luarocks.org/dev,,,
-luafilesystem,,,,,,flosse alerque
+luafilesystem,,,,,,flosse
 lualdap,,,,,,aanderse
 lualine.nvim,,,https://luarocks.org/dev,,,
 lualogging,,,,,,
@@ -104,12 +103,12 @@ luarocks-build-rust-mlua,,,,,,mrcjkb
 luarocks-build-tree-sitter-cli,,,,,,
 luarocks-build-treesitter-parser,,,,,,mrcjkb
 luarocks-build-treesitter-parser-cpp,,,,,,mrcjkb
-luasec,,,,,,flosse alerque
+luasec,,,,,,flosse
 luasnip,,,,,,
-luasocket,,,,,,alerque
+luasocket,,,,,,
 luasql-sqlite3,,,,,,
-luassert,,,,,,alerque
-luasystem,,,,,,alerque
+luassert,,,,,,
+luasystem,,,,,,
 luatext,,,,,,
 luaunbound,,,,,,
 luaunit,,,,,,lockejan
@@ -159,7 +158,7 @@ rocks-git.nvim,,,,,5.1,mrcjkb
 rocks.nvim,,,,,5.1,mrcjkb
 rtp.nvim,,,,,5.1,mrcjkb
 rustaceanvim,,,,,5.1,mrcjkb
-say,,,,,,alerque
+say,,,,,,
 serpent,,,,,,lockejan
 sofa,,,,,,f4z3r
 sqlite,,,,,,

maintainers/scripts/update.py

@@ -307,7 +307,7 @@ async def commit_changes(
             commit_message = "{attrPath}: {oldVersion} -> {newVersion}".format(**change)
             if "commitMessage" in change:
                 commit_message = change["commitMessage"]
-            if "commitBody" in change:
+            elif "commitBody" in change:
                 commit_message = commit_message + "\n\n" + change["commitBody"]
             await check_subprocess_output(
                 "git",

maintainers/team-list.nix

@@ -717,15 +717,6 @@ with lib.maintainers;
     github = "security-review";
   };
 
-  stardust-xr = {
-    members = [
-      pandapip1
-      technobaboo
-    ];
-    scope = "Maintain Stardust XR packages";
-    shortName = "StardustXR";
-  };
-
   stdenv = {
     enableFeatureFreezePing = true;
     github = "stdenv";

nixos/README-modular-services.md

@@ -43,7 +43,7 @@ When reviewing a modular service, you should check the following. Details and ra
 ### NixOS VM test
 
 See the initial [Modular Services PR](https://github.com/NixOS/nixpkgs/pull/372170) for an [example](https://github.com/NixOS/nixpkgs/pull/372170/files#diff-e7fe16489cf3cd08ecc22b2c7896039d407a329b75691c046c95447423b3153f) of a NixOS VM test.
-Best practices: keep tests minimal and focused (boot a VM, enable the service, and assert a basic request succeeds). For general guidance, see the [NixOS Tests chapter](https://nixos.org/manual/nixos/unstable/#sec-nixos-tests).
+TBD: describe best practices here.
 
 ### `_class = "service"`
 

nixos/doc/manual/configuration/file-systems.chapter.md

@@ -41,6 +41,5 @@ and non-critical by adding `options = [ "nofail" ];`.
 ```{=include=} sections
 luks-file-systems.section.md
 sshfs-file-systems.section.md
-nfs-file-systems.section.md
 overlayfs.section.md
 ```

nixos/doc/manual/configuration/nfs-file-systems.section.md

@@ -1,52 +0,0 @@
-# NFS File Systems {#sec-nfs-file-systems}
-
-[NFS][nfs] (Network File System) allows you to mount directories from remote machines over the network.
-
-[nfs]: https://en.wikipedia.org/wiki/Network_File_System
-[nfs-man]: https://man7.org/linux/man-pages/man5/nfs.5.html
-
-To mount NFS filesystems persistently, use the `fileSystems` option:
-
-```nix
-{
-  fileSystems."/mnt/data" = {
-    device = "server.example.com:/export/data";
-    fsType = "nfs";
-  };
-}
-```
-
-## Automounting {#sec-nfs-automount}
-
-To have NFS filesystems mounted on-demand instead of at boot, add the `noauto` and `x-systemd.automount` options:
-
-```nix
-{
-  fileSystems."/mnt/data" = {
-    device = "server.example.com:/export/data";
-    fsType = "nfs";
-    options = [
-      "noauto"
-      "x-systemd.automount"
-    ];
-  };
-}
-```
-
-## Ad-hoc Mounting {#sec-nfs-adhoc}
-
-To mount NFS filesystems ad-hoc using the `mount` command, enable NFS and required RPC services:
-
-```nix
-{
-  boot.supportedFilesystems = [ "nfs" ];
-}
-```
-
-Then you can mount filesystems manually:
-
-```shell
-$ sudo mount -t nfs server.example.com:/export/data /mnt/data
-```
-
-For more information on NFS mount options, see the [nfs(5) man page][nfs-man].

nixos/doc/manual/default.nix

@@ -152,16 +152,7 @@ let
   };
 
   systemdServiceOptions = buildPackages.nixosOptionsDoc {
-    inherit
-      (evalModules {
-        modules = [
-          (modules.importApply ../../modules/system/service/systemd/service.nix {
-            pkgs = throw "nixos docs / systemdServiceOptions: Do not reference pkgs in docs";
-          })
-        ];
-      })
-      options
-      ;
+    inherit (evalModules { modules = [ ../../modules/system/service/systemd/service.nix ]; }) options;
     # TODO: filter out options that are not systemd-specific, maybe also change option prefix to just `service-opt-`?
     inherit revision warningsAreErrors;
     transformOptions =
@@ -211,8 +202,6 @@ rec {
           --script ./anchor.min.js \
           --script ./anchor-use.js \
           --sidebar-depth 2 \
-          --header ${./header.html}\
-          --no-navheader \
           ./manual.md \
           $dst/${common.indexPath}
 

nixos/doc/manual/header.html

@@ -1,7 +0,0 @@
-<div class="manual-header">
-    <nav class="manual-header--tabs">
-        <a class="manual-header--tab" href="https://nixos.org/manual/nixos/stable/">Nixpkgs</a>
-        <a class="manual-header--tab manual-header--tab-active" href="#">NixOS</a>
-    </nav>
-    <span class="manual-header--title">Nixos Manual</span>
-</div>

nixos/doc/manual/installation/installing-from-other-distro.section.md

@@ -47,7 +47,7 @@ The first steps to all these are the same:
 
     Where `<version>` corresponds to the latest version available on [channels.nixos.org](https://channels.nixos.org/).
 
-    You must run `$ nix-channel --update` for the channel change to take effect.
+    You may want to throw in a `nix-channel --update` for good measure.
 
 1.  Install the NixOS installation tools:
 

nixos/doc/manual/redirects.json

@@ -619,15 +619,6 @@
   "sec-luks-file-systems-fido2-systemd": [
     "index.html#sec-luks-file-systems-fido2-systemd"
   ],
-  "sec-nfs-file-systems": [
-    "index.html#sec-nfs-file-systems"
-  ],
-  "sec-nfs-automount": [
-    "index.html#sec-nfs-automount"
-  ],
-  "sec-nfs-adhoc": [
-    "index.html#sec-nfs-adhoc"
-  ],
   "sec-sshfs-file-systems": [
     "index.html#sec-sshfs-file-systems"
   ],
@@ -1900,9 +1891,6 @@
   "sec-kubernetes": [
     "index.html#sec-kubernetes"
   ],
-  "module-services-nordvpn": [
-    "index.html#module-services-nordvpn"
-  ],
   "ch-running": [
     "index.html#ch-running"
   ],
@@ -2306,9 +2294,6 @@
   "test-opt-meta.hydraPlatforms": [
     "index.html#test-opt-meta.hydraPlatforms"
   ],
-  "test-opt-meta.teams": [
-    "index.html#test-opt-meta.teams"
-  ],
   "test-opt-meta.timeout": [
     "index.html#test-opt-meta.timeout"
   ],

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -110,8 +110,6 @@
 
 - [clevis-luks-askpass](https://github.com/latchset/clevis), automatic LUKS unlocking in initrd using clevis token bindings stored in LUKS headers. Available as [boot.initrd.clevisLuksAskpass](#opt-boot.initrd.clevisLuksAskpass.enable).
 
-- [passless](https://github.com/pando85/passless), a daemon for using Webauthn Passkeys backed by password-store.
-
 - [bentopdf](https://github.com/alam00000/bentopdf), a privacy-first PDF toolkit running completely in-browser. Available as [services.bentopdf](#opt-services.bentopdf.enable).
 
 - [hyprwhspr-rs](https://github.com/better-slop/hyprwhspr-rs), a keybind activated speech-to-text voice dictation utility built for use with Hyprland. Available as [services.hyprwhspr-rs](#opt-services.hyprwhspr-rs.enable).

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -32,8 +32,6 @@
 
 - [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable).
 
-- [Watt](https://github.com/NotAShelf/watt), a CPU frequency and power management daemon for Linux. Available as [services.watt](#opt-services.watt.enable).
-
 - [mail-tlsa-check-exporter](https://github.com/ietf-tools/mail-tlsa-check-exporter), validates SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter. Available as [services.prometheus.exporters.mail-tlsa-check](#opt-services.prometheus.exporters.mail-tlsa-check.enable).
 
 - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.
@@ -56,8 +54,6 @@
 
 - [OO7](https://github.com/linux-credentials/oo7) is a desktop-agnostic Secret Service provider. Available as [services.oo7](#opt-services.oo7.enable)
 
-- [NordVPN](https://github.com/NordSecurity/nordvpn-linux), a NordVPN client for linux. Available as [services.nordvpn](options.html#opt-services.nordvpn.enable).
-
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -77,24 +73,12 @@
 
 - A number of options for `services.llama-cpp` have been removed in favor of the structured [](#opt-services.llama-cpp.settings) option, attributes from which are used as arguments to `llama-server` executable, you can see all available options by running `llama-server --help`. Configuring model presets using Nix attribute set via `services.llama-cpp.modelsPreset` is no longer supported, please use `services.llama-cpp.settings.models-preset` with a path to an INI file containing desired options.
 
-- The `NIX_XDG_DESKTOP_PORTAL_DIR` environment variable is no longer used in the `xdg-desktop-portal` package and is therefore no longer set in `xdg.portal` module.
-  Instead the `XDG_DATA_DIRS` environment variable is used to find xdg-portals.
-
-  If you were relying on `NIX_XDG_DESKTOP_PORTAL_DIR` to point at custom portal
-  definitions, add the package providing them to `xdg.portal.extraPortals`.
-
 - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
 
 - `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.
 
 - Apache Kafka has dropped support for ZooKeeper mode. The `apacheKafka_3_9` and `apacheKafka_4_0` packages have been removed, as every remaining packaged version is KRaft-only. The `services.apache-kafka.zookeeper` option (previously an alias for `services.apache-kafka.settings."zookeeper.connect"`) has been removed; migrate your cluster to [KRaft](#module-services-apache-kafka-kraft) mode instead.
 
-- `virtualisation.registries.block` / `insecure` / `search` were deprecated,
-  because they mapped to the deprecated V1 `registries.conf` format.
-  See the new option {option}`virtualisation.registries.settings`
-  and [containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)
-  to migrate to the new configuration format.
-
 - When Avahi's mDNS resolver is enabled (`services.avahi.nssmdns4` or `services.avahi.nssmdns6`), only the minimal mDNS resolver is enabled by default to avoid adding a 5 second delay to every failed reverse hostname lookup (e.g., delaying ping by 5 seconds). The "full" mDNS resolver now remains disabled unless `services.avahi.nssmdnsFull` is also enabled. Users who have customized [`/etc/mdns.allow`](https://github.com/avahi/nss-mdns/tree/master#etcmdnsallow) to allow mDNS domains not ending `.local` must enable `services.avahi.nssmdnsFull` to continue to resolve such domains.
 
 - String values passed to `services.phpfpm.settings`, `services.phpfpm.pools.<name>.phpEnv`, and `services.phpfpm.pools.<name>.settings` are now properly quoted and escaped, except for the `${}` syntax that is left as-is. If you are manually escaping these values, please adjust accordingly.
@@ -111,8 +95,6 @@
 
 - `services.plantuml-server.packages.jetty` now supports `jetty_12`, it no longer supports `jetty_11`.
 
-- `services.komodo-periphery` has been updated to support version 2.0.0. Some options have been renamed to match the new configuration structure; compatibility aliases are provided for the renamed options. The `passkeys` and `outbound.onboardingKey` options have been removed; use `passkeyFiles`, `auth.privateKey`/`auth.corePublicKeys`, or `outbound.onboardingKeyFile` instead. New outbound mode configuration is available under `outbound.*`.
-
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -156,8 +138,6 @@
 
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
 
-- The `authelia` module now uses systemd's `LoadCredential` to load all files defined in `secrets`. As such, these files no longer need to be readable by the authelia user and group: they can for example be set to be only readable by the root user.
-
 - `zoneminder` has been updated to 1.38.x release. See [upstream release note](https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.0). While database migration should happen automatically, it's recommended that you make a backup of the database before upgrading your system.
 
 - The latest available version of Nextcloud is v34 (available as `pkgs.nextcloud34`). The installation logic is as follows:
@@ -166,5 +146,3 @@
   - If [`system.stateVersion`](#opt-system.stateVersion) is >=26.05, `pkgs.nextcloud33` will be installed by default.
   - If [`system.stateVersion`](#opt-system.stateVersion) is >=25.11, `pkgs.nextcloud32` will be installed by default.
   - Please note that Nextcloud prohibits skipping major versions while upgrading. You can upgrade to specific versions by declaring `services.nextcloud.package = pkgs.nextcloud33;`.
-
-- `trilium-desktop` and `trilium-server` have been updated to 0.104.0. This release includes security hardening fixes that may break functionality. [See upstream release note for details](https://github.com/TriliumNext/Trilium/releases/tag/v0.104.0).

nixos/lib/systemd-unit-options.nix

@@ -625,7 +625,7 @@ rec {
 
       listenStreams = mkOption {
         default = [ ];
-        type = types.listOf (types.coercedTo types.port toString types.str);
+        type = types.listOf types.str;
         example = [
           "0.0.0.0:993"
           "/run/my-socket"

nixos/lib/test-driver/src/test_driver/__init__.py

@@ -89,11 +89,6 @@ def main() -> None:
         type=Path,
         required=True,
     )
-    arg_parser.add_argument(
-        "--test-script",
-        help="path to a test script to run, taking precedence over the one defined in the config file",
-        type=Path,
-    )
     arg_parser.add_argument(
         "--keep-vm-state",
         help=argparse.SUPPRESS,
@@ -168,12 +163,8 @@ def main() -> None:
     if args.debug_hook_attach is not None:
         debugger = Debug(logger, args.debug_hook_attach)
 
-    config = load_driver_configuration(args.config)
-    if args.test_script is not None:
-        config.test_script = args.test_script
-
     with Driver(
-        config=config,
+        config=load_driver_configuration(args.config),
         out_dir=output_directory,
         logger=logger,
         keep_machine_state=args.keep_machine_state,

nixos/lib/testing/meta.nix

@@ -1,20 +1,6 @@
-{ lib, options, ... }:
+{ lib, ... }:
 let
   inherit (lib) types mkOption literalMD;
-
-  # Approximate position of meta.teams / meta.maintainers in nixos tests.
-  # Right now this assumes only one such position and ignores other definitions.
-  # FIXME allow having multiple `maintainersPosition` et al..
-  getPosition =
-    definitionsWithLocations:
-    if definitionsWithLocations == [ ] then
-      null
-    else
-      {
-        file = (lib.head definitionsWithLocations).file;
-        column = 0;
-        line = 1;
-      };
 in
 {
   options = {
@@ -26,7 +12,7 @@ in
       '';
       apply = lib.filterAttrs (k: v: v != null);
       type = types.submodule (
-        { options, config, ... }:
+        { config, ... }:
         {
           options = {
             maintainers = mkOption {
@@ -36,25 +22,6 @@ in
                 The [list of maintainers](https://nixos.org/manual/nixpkgs/stable/#var-meta-maintainers) for this test.
               '';
             };
-            maintainersPosition = mkOption {
-              internal = true;
-              readOnly = true;
-              type = types.nullOr types.attrs;
-              default = getPosition options.maintainers.definitionsWithLocations;
-            };
-            teams = mkOption {
-              type = types.listOf types.raw;
-              default = [ ];
-              description = ''
-                The [list of maintainer-teams](https://nixos.org/manual/nixpkgs/stable/#var-meta-teams) for this test.
-              '';
-            };
-            teamsPosition = mkOption {
-              internal = true;
-              readOnly = true;
-              type = types.nullOr types.attrs;
-              default = getPosition options.teams.definitionsWithLocations;
-            };
             timeout = mkOption {
               type = types.nullOr types.int;
               default = 3600; # 1 hour

nixos/modules/config/xdg/portal.nix

@@ -116,8 +116,6 @@ in
       packages = [ pkgs.xdg-desktop-portal ] ++ cfg.extraPortals;
     in
     mkIf cfg.enable {
-      programs.fuse.enable = true;
-
       warnings = lib.optional (cfg.configPackages == [ ] && cfg.config == { }) ''
         xdg-desktop-portal 1.17 reworked how portal implementations are loaded, you
         should either set `xdg.portal.config` or `xdg.portal.configPackages`
@@ -152,6 +150,7 @@ in
 
         sessionVariables = {
           NIXOS_XDG_OPEN_USE_PORTAL = mkIf cfg.xdgOpenUsePortal "1";
+          NIX_XDG_DESKTOP_PORTAL_DIR = "/run/current-system/sw/share/xdg-desktop-portal/portals";
         };
 
         etc = lib.concatMapAttrs (

nixos/modules/hardware/opentabletdriver.nix

@@ -61,27 +61,16 @@ in
       wantedBy = [ "graphical-session.target" ];
       partOf = [ "graphical-session.target" ];
 
-      unitConfig = {
-        After = "graphical-session.target";
-        ConditionEnvironment = [
-          "|WAYLAND_DISPLAY"
-          "|DISPLAY"
-        ];
-      };
-
       serviceConfig = {
         Type = "simple";
-        # workaround for https://github.com/NixOS/nixpkgs/issues/469340 and
-        # https://github.com/OpenTabletDriver/OpenTabletDriver/issues/4885
-        ExecStartPre = pkgs.writeShellScript "poll-for-non-gdm-greeter-display" ''
-          if [[ "$USER" = "gdm-greeter"* \
-              || ( "$${XDG_SESSION_TYPE}" = wayland && -z "$${WAYLAND_DISPLAY}" ) ]]; then
+        # workaround for https://github.com/NixOS/nixpkgs/issues/469340
+        ExecStartPre = pkgs.writeShellScript "disable-for-gdm-greeter" ''
+          if [[ "$USER" = "gdm-greeter"* ]]; then
             exit 1
           fi
         '';
         ExecStart = lib.getExe' cfg.package "otd-daemon";
         Restart = "on-failure";
-        RestartSec = 3;
       };
     };
   };

nixos/modules/i18n/input-method/default.nix

@@ -23,16 +23,11 @@ let
         allowSubstitutes = false;
         buildInputs = [
           cfg.package
-          pkgs.gtk2
-        ];
-
-        disallowedReferences = [
-          (lib.getDev pkgs.gtk2)
         ];
       }
       ''
         mkdir -p $out/etc/gtk-2.0/
-        GTK_PATH=${cfg.package}/lib/gtk-2.0/ ${pkgs.stdenv.hostPlatform.emulator pkgs.buildPackages} gtk-query-immodules-2.0 > $out/etc/gtk-2.0/immodules.cache
+        GTK_PATH=${cfg.package}/lib/gtk-2.0/ ${pkgs.stdenv.hostPlatform.emulator pkgs.buildPackages} ${lib.getExe' pkgs.gtk2.dev "gtk-query-immodules-2.0"} > $out/etc/gtk-2.0/immodules.cache
       '';
 
   gtk3_cache =
@@ -42,16 +37,11 @@ let
         allowSubstitutes = false;
         buildInputs = [
           cfg.package
-          pkgs.gtk3
-        ];
-
-        disallowedReferences = [
-          (lib.getDev pkgs.gtk3)
         ];
       }
       ''
         mkdir -p $out/etc/gtk-3.0/
-        GTK_PATH=${cfg.package}/lib/gtk-3.0/ ${pkgs.stdenv.hostPlatform.emulator pkgs.buildPackages} gtk-query-immodules-3.0 > $out/etc/gtk-3.0/immodules.cache
+        GTK_PATH=${cfg.package}/lib/gtk-3.0/ ${pkgs.stdenv.hostPlatform.emulator pkgs.buildPackages} ${lib.getExe' pkgs.gtk3.dev "gtk-query-immodules-3.0"} > $out/etc/gtk-3.0/immodules.cache
       '';
 
 in

nixos/modules/misc/locate.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  utils,
   pkgs,
   ...
 }:
@@ -60,7 +59,7 @@ in
     };
 
     output = lib.mkOption {
-      type = lib.types.externalPath;
+      type = lib.types.path;
       default = "/var/cache/locatedb";
       description = ''
         The database file to build.
@@ -250,35 +249,27 @@ in
     systemd.services.update-locatedb = {
       description = "Update Locate Database";
 
-      serviceConfig = {
-        # mlocate's updatedb takes flags via a configuration file or
-        # on the command line, but not by environment variable.
-        ExecStart =
-          let
-            toFlags =
-              x:
-              lib.optionals (cfg.${x} != [ ]) [
-                "--${lib.toLower x}"
-                (lib.concatStringsSep " " cfg.${x})
-              ];
-            args = lib.concatMap toFlags [
+      # mlocate's updatedb takes flags via a configuration file or
+      # on the command line, but not by environment variable.
+      script =
+        let
+          toFlags =
+            x: lib.optional (cfg.${x} != [ ]) "--${lib.toLower x} '${lib.concatStringsSep " " cfg.${x}}'";
+          args = lib.concatLists (
+            map toFlags [
               "pruneFS"
               "pruneNames"
               "prunePaths"
-            ];
-          in
-          utils.escapeSystemdExecArgs (
-            [
-              (lib.getExe' cfg.package "updatedb")
-              "--output"
-              cfg.output
-              "--prune-bind-mounts"
-              (lib.boolToYesNo cfg.pruneBindMounts)
             ]
-            ++ args
-            ++ cfg.extraFlags
           );
-
+        in
+        ''
+          exec ${cfg.package}/bin/updatedb \
+            --output ${toString cfg.output} ${lib.concatStringsSep " " args} \
+            --prune-bind-mounts ${lib.boolToYesNo cfg.pruneBindMounts} \
+            ${lib.concatStringsSep " " cfg.extraFlags}
+        '';
+      serviceConfig = {
         CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_CHOWN";
         Nice = 19;
         IOSchedulingClass = "idle";

nixos/modules/misc/version.nix

@@ -54,8 +54,7 @@ let
       BUG_REPORT_URL = optionalString isNixos "https://github.com/NixOS/nixpkgs/issues";
       ANSI_COLOR = optionalString isNixos "0;38;2;126;186;228";
       IMAGE_ID = optionalString (config.system.image.id != null) config.system.image.id;
-      ${if config.system.image.version != null then "IMAGE_VERSION" else null} =
-        config.system.image.version;
+      IMAGE_VERSION = optionalString (config.system.image.version != null) config.system.image.version;
       VARIANT = optionalString (cfg.variantName != null) cfg.variantName;
       VARIANT_ID = optionalString (cfg.variant_id != null) cfg.variant_id;
       DEFAULT_HOSTNAME = config.system.nixos.distroId;

nixos/modules/module-list.nix

@@ -296,7 +296,6 @@
   ./programs/opengamepadui.nix
   ./programs/openvpn3.nix
   ./programs/partition-manager.nix
-  ./programs/passless.nix
   ./programs/pay-respects.nix
   ./programs/plotinus.nix
   ./programs/pmount.nix
@@ -358,7 +357,6 @@
   ./programs/wayland/mangowc.nix
   ./programs/wayland/miracle-wm.nix
   ./programs/wayland/niri.nix
-  ./programs/wayland/pinnacle.nix
   ./programs/wayland/river.nix
   ./programs/wayland/sway.nix
   ./programs/wayland/uwsm.nix
@@ -732,7 +730,6 @@
   ./services/hardware/usbmuxd.nix
   ./services/hardware/usbrelayd.nix
   ./services/hardware/vdr.nix
-  ./services/hardware/watt.nix
   ./services/home-automation/deye-dummycloud.nix
   ./services/home-automation/ebusd.nix
   ./services/home-automation/esphome.nix
@@ -1344,7 +1341,6 @@
   ./services/networking/nncp.nix
   ./services/networking/nntp-proxy.nix
   ./services/networking/nomad.nix
-  ./services/networking/nordvpn.nix
   ./services/networking/nsd.nix
   ./services/networking/ntopng.nix
   ./services/networking/ntp/chrony.nix
@@ -1861,7 +1857,6 @@
   ./services/web-servers/nginx/tailscale-auth.nix
   ./services/web-servers/phpfpm/default.nix
   ./services/web-servers/pomerium.nix
-  ./services/web-servers/rustfs.nix
   ./services/web-servers/rustus.nix
   ./services/web-servers/send.nix
   ./services/web-servers/stargazer.nix

nixos/modules/programs/bat.nix

@@ -8,7 +8,6 @@ let
   inherit (builtins) isList;
   inherit (lib)
     concatMapStrings
-    escapeShellArg
     literalExpression
     maintainers
     mapAttrs'
@@ -35,7 +34,7 @@ let
     else if isBool value then
       boolToString value
     else
-      escapeShellArg (toString value);
+      toString value;
 in
 {
   options.programs.bat = {

nixos/modules/programs/corefreq.nix

@@ -12,7 +12,7 @@ in
 {
   options = {
     programs.corefreq = {
-      enable = lib.mkEnableOption "the corefreq daemon and kernel module";
+      enable = lib.mkEnableOption "Whether to enable the corefreq daemon and kernel module";
 
       package = lib.mkOption {
         type = lib.types.package;

nixos/modules/programs/passless.nix

@@ -1,134 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.programs.passless;
-  settingsFormat = pkgs.formats.toml { };
-  settingsFile = settingsFormat.generate "passless.toml" cfg.settings;
-in
-{
-
-  options.programs.passless = {
-    enable = lib.mkEnableOption "passless";
-
-    package = lib.mkPackageOption pkgs "passless" { };
-
-    users = lib.options.mkOption {
-      type = with lib.types; listOf str;
-      description = ''
-        Users that intend to use passless and should be added to the fido group.
-      '';
-      default = [ ];
-      example = [ "alice" ];
-    };
-
-    settings = lib.mkOption {
-      inherit (settingsFormat) type;
-      default = { };
-      example = {
-        pass.store-path = "/home/alice/.local/share/password-store";
-      };
-      description = ''
-        Configuration included in `config.toml`.
-
-        See <https://github.com/pando85/passless#configuration-1> for documentation or run `passless config print` to see default configuration.
-      '';
-    };
-  };
-
-  config = lib.mkIf config.programs.passless.enable {
-    users.groups.fido.members = cfg.users;
-
-    boot.kernelModules = [ "uhid" ];
-
-    services.udev.extraRules = ''
-      KERNEL=="uhid", GROUP="fido", MODE="0660"
-    '';
-
-    # From https://github.com/pando85/passless/blob/master/contrib/systemd/passless.service
-    systemd.user.services.passless = {
-      description = "Passless FIDO2 Software Authenticator";
-      documentation = [ "https://github.com/pando85/passless" ];
-      after = [ "network-online.target" ];
-      wants = [ "network-online.target" ];
-      wantedBy = [ "default.target" ];
-      path = [ config.programs.gnupg.package ];
-      serviceConfig = {
-        Type = "simple";
-        ExecStart = "${lib.getExe cfg.package} --config-path ${settingsFile}";
-        Restart = "on-failure";
-        RestartSec = "5s";
-        # Security hardening
-        # The application already handles its own memory locking and core dump prevention
-        # but we can add additional systemd protections
-        NoNewPrivileges = true;
-        LimitMEMLOCK = "2M";
-        SyslogIdentifier = "passless";
-
-        # Found with shh
-        ProtectSystem = "strict";
-        PrivateTmp = "disconnected";
-        PrivateMounts = "true";
-        ProtectKernelTunables = "true";
-        ProtectKernelModules = true;
-        ProtectKernelLogs = true;
-        LockPersonality = true;
-        RestrictRealtime = true;
-        ProtectClock = true;
-        MemoryDenyWriteExecute = true;
-        RestrictAddressFamilies = "AF_UNIX";
-        SocketBindDeny = [
-          "ipv4:tcp"
-          "ipv4:udp"
-          "ipv6:tcp"
-          "ipv6:udp"
-        ];
-        CapabilityBoundingSet = [
-          "~CAP_BLOCK_SUSPEND"
-          "CAP_BPF"
-          "CAP_CHOWN"
-          "CAP_MKNOD"
-          "CAP_NET_RAW"
-          "CAP_PERFMON"
-          "CAP_SYS_BOOT"
-          "CAP_SYS_CHROOT"
-          "CAP_SYS_MODULE"
-          "CAP_SYS_NICE"
-          "CAP_SYS_PACCT"
-          "CAP_SYS_PTRACE"
-          "CAP_SYS_TIME"
-          "CAP_SYSLOG"
-          "CAP_WAKE_ALARM"
-        ];
-        SystemCallFilter = [
-          "~@aio:EPERM"
-          "@chown:EPERM"
-          "@clock:EPERM"
-          "@cpu-emulation:EPERM"
-          "@debug:EPERM"
-          "@ipc:EPERM"
-          "@keyring:EPERM"
-          "@module:EPERM"
-          "@mount:EPERM"
-          "@obsolete:EPERM"
-          "@pkey:EPERM"
-          "@privileged:EPERM"
-          "@raw-io:EPERM"
-          "@reboot:EPERM"
-          "@resources:EPERM"
-          "@sandbox:EPERM"
-          "@setuid:EPERM"
-          "@swap:EPERM"
-          "@sync:EPERM"
-        ];
-
-      };
-    };
-  };
-
-  meta.maintainers = with lib.maintainers; [ erictapen ];
-
-}

nixos/modules/programs/regreet.nix

@@ -15,13 +15,14 @@ in
       description = ''
         Enable ReGreet, a clean and customizable greeter for greetd.
 
-        By default enables {option}`services.greetd` and configures a
-        {command}`default_session` to launch ReGreet using the
-        {command}`cage` compositor.
+        To use ReGreet, {option}`services.greetd` has to be enabled and
+        {option}`services.greetd.settings.default_session` should contain the
+        appropriate configuration to launch
+        {option}`config.programs.regreet.package`. For examples, see the
+        [ReGreet Readme](https://github.com/rharish101/ReGreet#set-as-default-session).
 
-        See the
-        [ReGreet Readme](https://github.com/rharish101/ReGreet#set-as-default-session)
-        for other examples.
+        A minimal configuration that launches ReGreet in {command}`cage` is
+        enabled by this module by default.
       '';
     };
 
@@ -47,8 +48,8 @@ in
         [ "-s" "-d" "-m" "last" ]
       '';
       description = ''
-        Arguments to be passed to [cage](https://github.com/cage-kiosk/cage)
-        when using it as the default compositor.
+        Additional arguments to be passed to
+        [cage](https://github.com/cage-kiosk/cage).
       '';
     };
 

nixos/modules/programs/wayland/pinnacle.nix

@@ -1,70 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.programs.pinnacle;
-  inherit (lib.options) mkEnableOption mkPackageOption;
-in
-{
-  options.programs.pinnacle = {
-    enable = mkEnableOption "pinnacle";
-    package = mkPackageOption pkgs "pinnacle" {
-      default = "pinnacle";
-      example = "pkgs.pinnacle";
-      extraDescription = "package containing the pinnacle server binary";
-    };
-    xdg-portals.enable = mkEnableOption "enable xdg-portals for pinnacle";
-    withUWSM = mkEnableOption ''
-      manage the pinnacle session with [UWSM](https://github.com/Vladimir-csp/uwsm) instead
-      of independent systemd services and targets.
-    '';
-  };
-
-  config = lib.mkIf cfg.enable (
-    lib.mkMerge [
-      {
-        environment.systemPackages = [
-          cfg.package
-          pkgs.protobuf
-          cfg.package.lua-client-api
-        ];
-        environment.pathsToLink = [
-          # For /run/current-system/sw/share/pinnacle protobuf files - for
-          # pinnacle to be able to launch with a non-default config out of the
-          # box.
-          "/share/pinnacle"
-        ];
-        xdg.portal = lib.mkIf cfg.xdg-portals.enable {
-          enable = true;
-          wlr.enable = true;
-          configPackages = [ cfg.package ];
-          extraPortals = [
-            pkgs.xdg-desktop-portal-wlr
-            pkgs.xdg-desktop-portal-gtk
-            pkgs.gnome-keyring
-          ];
-        };
-      }
-      (lib.mkIf (cfg.withUWSM) {
-        programs.uwsm.enable = true;
-        # Configure UWSM to launch Pinnacle from a display manager like SDDM
-        programs.uwsm.waylandCompositors = {
-          pinnacle = {
-            prettyName = "Pinnacle";
-            comment = "Pinnacle compositor managed by UWSM";
-            binPath = "/run/current-system/sw/bin/pinnacle";
-            extraArgs = [ "--session" ];
-          };
-        };
-      })
-      (lib.mkIf (!cfg.withUWSM) {
-        services.displayManager.sessionPackages = [ cfg.package ];
-      })
-    ]
-  );
-
-  meta.maintainers = with lib.maintainers; [ cassandracomar ];
-}

nixos/modules/rename.nix

@@ -403,11 +403,6 @@ in
       as the underlying package isn't being maintained. Working alternatives are
       libinput and synaptics.
     '')
-    (mkRemovedOptionModule [ "services" "xserver" "windowManager" "afterstep" ] ''
-      The services.xserver.windowManager.afterstep module and the corresponding
-      package have been removed from Nixpkgs because they were unmaintained
-      upstream.
-    '')
     (mkRemovedOptionModule [ "services" "xserver" "windowManager" "ragnarwm" ] ''
       The services.xserver.windowManager.ragnarwm module has been removed
       because the corresponding package was removed from nixpkgs.
@@ -516,7 +511,7 @@ in
       services.simplesamlphp has been vulnerable and unmaintained in nixpkgs.
     '')
     (mkRemovedOptionModule [ "security" "pam" "enableEcryptfs" ] ''
-      security.pam.enableEcryptfs was removed since it was unmaintained in nixpkgs.
+      security.pam.enableFscrypt was removed since it was unmaintained in nixpkgs.
     '')
     (mkRemovedOptionModule [ "security" "rngd" ] ''
       rngd is not necessary for any device that the kernel recognises

nixos/modules/security/account-utils.nix

@@ -6,7 +6,6 @@
 }:
 let
   cfg = config.security.account-utils;
-  format = pkgs.formats.ini { };
 in
 {
   options.security.account-utils = {
@@ -26,16 +25,6 @@ in
         :::
       '';
     };
-    pwaccessd.settings = lib.mkOption {
-      description = ''
-        Options for pwaccessd.
-        See {manpage}`pwaccessd.conf(5)` for available options.
-      '';
-      type = lib.types.submodule {
-        freeformType = format.type;
-      };
-      default = { };
-    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -55,8 +44,6 @@ in
     };
 
     environment.systemPackages = [ cfg.package ];
-    environment.etc."account-utils/pwaccessd.conf".source =
-      format.generate "pwaccessd.conf" cfg.pwaccessd.settings;
 
     security.pam.services = {
       pwupd-passwd = { };

nixos/modules/security/apparmor.nix

@@ -241,7 +241,7 @@ in
         {
           Type = "oneshot";
           RemainAfterExit = "yes";
-          ExecStartPre = lib.getExe' pkgs.apparmor-init "aa-teardown";
+          ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown";
           ExecStart = lib.mapAttrsToList (
             n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts n p}"
           ) enabledPolicies;
@@ -262,7 +262,7 @@ in
               # Optionally kill the processes which are unconfined but now have a profile loaded
               # (because AppArmor can only start to confine new processes).
               lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
-          ExecStop = lib.getExe' pkgs.apparmor-init "aa-teardown";
+          ExecStop = "${pkgs.apparmor-utils}/bin/aa-teardown";
           CacheDirectory = [
             "apparmor"
             "apparmor/logprof"

nixos/modules/security/auditd.nix

@@ -18,7 +18,7 @@ let
 
   pluginOptions = lib.types.submodule {
     options = {
-      active = lib.mkEnableOption "this plugin";
+      active = lib.mkEnableOption "Whether to enable this plugin";
       direction = lib.mkOption {
         type = lib.types.enum [
           "in"

nixos/modules/security/pam.nix

@@ -1422,6 +1422,7 @@ let
                 modulePath = config.security.pam.pam_unixModulePath;
                 settings = {
                   nullok = true;
+                  yescrypt = lib.mkIf config.security.pam.enableLegacySettings true;
                 };
               }
               {
@@ -1831,6 +1832,11 @@ let
     else
       config.users.motdFile;
 
+  makePAMService = name: service: {
+    name = "pam.d/${name}";
+    value.source = pkgs.writeText "${name}.pam" service.text;
+  };
+
   optionalSudoConfigForSSHAgentAuth =
     lib.optionalString (config.security.pam.sshAgentAuth.enable || config.security.pam.rssh.enable)
       ''
@@ -2642,26 +2648,7 @@ in
       };
     };
 
-    environment.etc =
-      let
-        # Write all pam config in a single derivation for performance
-        pamd =
-          pkgs.runCommand "pam.d"
-            {
-              __structuredAttrs = true;
-              services = lib.mapAttrs (_: svc: svc.text) enabledServices;
-            }
-            ''
-              mkdir $out
-              for i in "''${!services[@]}"; do
-                printf '%s' "''${services[$i]}" > "$out/$i"
-              done
-            '';
-      in
-      lib.mapAttrs' (name: service: {
-        name = "pam.d/${name}";
-        value.source = "${pamd}/${name}";
-      }) enabledServices;
+    environment.etc = lib.mapAttrs' makePAMService enabledServices;
 
     systemd =
       lib.mkIf (lib.any (service: service.lastlog.enable) (lib.attrValues config.security.pam.services))

nixos/modules/services/admin/komodo-periphery.nix

@@ -8,65 +8,41 @@ let
   cfg = config.services.komodo-periphery;
   settingsFormat = pkgs.formats.toml { };
 
-  actualRepoDir = if cfg.repoDir != null then cfg.repoDir else "${cfg.rootDirectory}/repos";
-  actualStackDir = if cfg.stackDir != null then cfg.stackDir else "${cfg.rootDirectory}/stacks";
-  actualBuildDir = if cfg.buildDir != null then cfg.buildDir else "${cfg.rootDirectory}/builds";
-
   genFinalSettings =
     let
-      actualServerEnabled =
-        if cfg.inbound.serverEnabled != null then
-          cfg.inbound.serverEnabled
-        else
-          (cfg.outbound.coreAddress == "");
-
-      hasAnyPrivateKey = cfg.auth.privateKey != "";
-
       baseSettings = {
-        default_terminal_command = cfg.defaultTerminalCommand;
-        disable_terminals = cfg.disableTerminals;
-        disable_container_terminals = cfg.disableContainerTerminals;
-
-        stats_polling_rate = cfg.statsPollingRate;
-        container_stats_polling_rate = cfg.containerStatsPollingRate;
-        legacy_compose_cli = cfg.legacyComposeCli;
-
-        include_disk_mounts = cfg.includeDiskMounts;
-        exclude_disk_mounts = cfg.excludeDiskMounts;
-
-        # When a private key is explicitly configured, it's passed via env var.
-        # Otherwise, use the default file path so Periphery auto-generates a key.
-        private_key = if !hasAnyPrivateKey then "file:${cfg.rootDirectory}/keys/periphery.key" else "";
-        core_public_keys = [ ];
-        passkeys = [ ];
-
-        server_enabled = actualServerEnabled;
-        port = cfg.inbound.port;
-        bind_ip = cfg.inbound.bindIp;
-        allowed_ips = cfg.inbound.allowedIps;
-        ssl_enabled = cfg.inbound.ssl.enable;
+        port = cfg.port;
+        bind_ip = cfg.bindIp;
+        root_directory = cfg.rootDirectory;
+        repo_dir = "${cfg.rootDirectory}/repos";
+        stack_dir = "${cfg.rootDirectory}/stacks";
+        ssl_enabled = cfg.ssl.enable;
       }
-      // {
-        core_address = cfg.outbound.coreAddress;
-        connect_as = cfg.outbound.connectAs;
-        onboarding_key = "";
+      // lib.optionalAttrs cfg.ssl.enable {
+        ssl_key_file = cfg.ssl.keyFile;
+        ssl_cert_file = cfg.ssl.certFile;
       }
       // {
         logging = {
           level = cfg.logging.level;
           stdio = cfg.logging.stdio;
-          opentelemetry_service_name = cfg.logging.opentelemetryServiceName;
-          opentelemetry_scope_name = cfg.logging.opentelemetryScopeName;
-          pretty = cfg.logging.pretty;
         }
         // lib.optionalAttrs (cfg.logging.otlpEndpoint != "") {
           otlp_endpoint = cfg.logging.otlpEndpoint;
         };
-        pretty_startup_config = cfg.prettyStartupConfig;
+        allowed_ips = cfg.allowedIps;
+        passkeys = cfg.passkeys;
+        disable_terminals = cfg.disableTerminals;
+        disable_container_exec = cfg.disableContainerExec;
+        stats_polling_rate = cfg.statsPollingRate;
+        container_stats_polling_rate = cfg.containerStatsPollingRate;
+        legacy_compose_cli = cfg.legacyComposeCli;
+        include_disk_mounts = cfg.includeDiskMounts;
+        exclude_disk_mounts = cfg.excludeDiskMounts;
       }
       // cfg.extraSettings;
     in
-    lib.filterAttrsRecursive (_: v: v != null && v != { } && v != [ ] && v != "") baseSettings;
+    lib.filterAttrsRecursive (_: v: v != null && v != { } && v != [ ]) baseSettings;
 
   configFile =
     if cfg.configFile == null then
@@ -75,125 +51,62 @@ let
       cfg.configFile;
 in
 {
-  imports = with lib; [
-    (mkRenamedOptionModule
-      [ "services" "komodo-periphery" "port" ]
-      [ "services" "komodo-periphery" "inbound" "port" ]
-    )
-    (mkRenamedOptionModule
-      [ "services" "komodo-periphery" "bindIp" ]
-      [ "services" "komodo-periphery" "inbound" "bindIp" ]
-    )
-    (mkRenamedOptionModule
-      [ "services" "komodo-periphery" "allowedIps" ]
-      [ "services" "komodo-periphery" "inbound" "allowedIps" ]
-    )
-    (mkRenamedOptionModule
-      [ "services" "komodo-periphery" "ssl" "enable" ]
-      [ "services" "komodo-periphery" "inbound" "ssl" "enable" ]
-    )
-    (mkRenamedOptionModule
-      [ "services" "komodo-periphery" "ssl" "keyFile" ]
-      [ "services" "komodo-periphery" "inbound" "ssl" "keyFile" ]
-    )
-    (mkRenamedOptionModule
-      [ "services" "komodo-periphery" "ssl" "certFile" ]
-      [ "services" "komodo-periphery" "inbound" "ssl" "certFile" ]
-    )
-    (mkRenamedOptionModule
-      [ "services" "komodo-periphery" "serverEnabled" ]
-      [ "services" "komodo-periphery" "inbound" "serverEnabled" ]
-    )
-    (mkRenamedOptionModule
-      [ "services" "komodo-periphery" "disableContainerExec" ]
-      [ "services" "komodo-periphery" "disableContainerTerminals" ]
-    )
-    (mkRemovedOptionModule [ "services" "komodo-periphery" "passkeys" ]
-      "services.komodo-periphery.passkeys has been removed. Use passkeyFiles for v1.X compatibility, or migrate to auth.privateKey and auth.corePublicKeys (v2.0+)."
-    )
-    (mkRemovedOptionModule [ "services" "komodo-periphery" "outbound" "onboardingKey" ]
-      "services.komodo-periphery.outbound.onboardingKey has been removed. Use outbound.onboardingKeyFile instead for better security."
-    )
-  ];
-
   options.services.komodo-periphery = {
     enable = lib.mkEnableOption "Periphery, a multi-server Docker and Git deployment agent by Komodo";
 
     package = lib.mkPackageOption pkgs "komodo" { };
 
-    dockerHost = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = ''
-        Docker host socket URI to use for container operations.
-        If null, uses the default Docker socket and automatically enables Docker.
-        Set this to use alternative container runtimes like Podman or remote Docker hosts.
-      '';
-      example = lib.literalExpression ''
-        # Podman rootless
-        "unix:///run/user/1000/podman/podman.sock"
-
-        # Podman rootful
-        "unix:///run/podman/podman.sock"
-
-        # Remote Docker
-        "tcp://192.168.1.100:2375"
-      '';
-    };
-
     configFile = lib.mkOption {
       type = lib.types.nullOr lib.types.path;
       default = null;
-      description = ''
-        Path to the Periphery configuration file.
-
-        - If `null` (default), a configuration file will be automatically generated
-          from the module options (recommended for most users).
-        - If set to a path, that file will be used directly as the configuration file.
-        - You can also use `pkgs.writeText` to write configuration inline in your NixOS configuration.
-
-        When using a custom config file, all other module options (except `package`, `user`, `group`,
-        `environment`, and `environmentFile`) will be ignored.
-      '';
+      description = "Path to the periphery configuration file. If null, a configuration file will be generated from the module options.";
       example = lib.literalExpression ''
-        # Option 1: Use an existing config file
-        "/etc/komodo/periphery.toml"
-
-        # Option 2: Write config inline using pkgs.writeText
         pkgs.writeText "periphery.toml" '''
-          root_directory = "/var/lib/komodo-periphery"
-
-          logging.level = "info"
-          logging.stdio = "standard"
+          port = 8120
+          bind_ip = "[::]"
+          ssl_enabled = true
+          [logging]
+          level = "info"
         '''
       '';
     };
 
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8120;
+      description = "Port for the Periphery agent to listen on.";
+    };
+
+    bindIp = lib.mkOption {
+      type = lib.types.str;
+      default = "[::]";
+      description = "IP address to bind to.";
+    };
+
     rootDirectory = lib.mkOption {
       type = lib.types.path;
       default = "/var/lib/komodo-periphery";
       description = "Root directory for Komodo Periphery data.";
     };
 
-    repoDir = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      default = null;
-      defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/repos"'';
-      description = "Directory for Komodo Periphery to manage repos. If null, defaults to `\${rootDirectory}/repos`.";
-    };
+    ssl = {
+      enable = lib.mkEnableOption "SSL/TLS support" // {
+        default = true;
+      };
 
-    stackDir = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      default = null;
-      defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/stacks"'';
-      description = "Directory for Komodo Periphery to manage stacks. If null, defaults to `\${rootDirectory}/stacks`.";
-    };
+      keyFile = lib.mkOption {
+        type = lib.types.path;
+        default = "${cfg.rootDirectory}/ssl/key.pem";
+        defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/key.pem"'';
+        description = "Path to SSL key file.";
+      };
 
-    buildDir = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      default = null;
-      defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/builds"'';
-      description = "Directory for Komodo Periphery to manage builds. If null, defaults to `\${rootDirectory}/builds`.";
+      certFile = lib.mkOption {
+        type = lib.types.path;
+        default = "${cfg.rootDirectory}/ssl/cert.pem";
+        defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/cert.pem"'';
+        description = "Path to SSL certificate file.";
+      };
     };
 
     logging = {
@@ -226,41 +139,26 @@ in
         description = "OpenTelemetry OTLP endpoint for traces.";
         example = "http://localhost:4317";
       };
-
-      opentelemetryServiceName = lib.mkOption {
-        type = lib.types.str;
-        default = "Periphery";
-        description = "(v2.0+) OpenTelemetry service name attached to telemetry.";
-      };
-
-      opentelemetryScopeName = lib.mkOption {
-        type = lib.types.str;
-        default = "Komodo";
-        description = "(v2.0+) OpenTelemetry scope name attached to telemetry.";
-      };
-
-      pretty = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "(v2.0+) Enable human-readable logging (multi-line).";
-      };
     };
 
-    prettyStartupConfig = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = "(v2.0+) Enable human-readable startup config log (multi-line).";
+    allowedIps = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "IP addresses or subnets allowed to call the periphery API. Empty list allows all.";
+      example = [
+        "::ffff:12.34.56.78"
+        "10.0.10.0/24"
+      ];
     };
 
-    passkeyFiles = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      default = null;
+    passkeys = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
       description = ''
-        Path to file containing passkeys (v1.X compatibility).
-        This will be passed via `PERIPHERY_PASSKEYS_FILE` environment variable.
-        Consider migrating to the new v2.0+ authentication mechanism.
+        Passkeys required to access the periphery API.
+        WARNING: These will be stored in the Nix store in plain text!
       '';
-      example = "/run/secrets/komodo-passkey";
+      example = [ "your-secure-passkey" ];
     };
 
     extraSettings = lib.mkOption {
@@ -272,23 +170,16 @@ in
       };
     };
 
-    defaultTerminalCommand = lib.mkOption {
-      type = lib.types.str;
-      default = "bash";
-      description = "(v2.0+) Default terminal command used to initialize the shell.";
-      example = "zsh";
-    };
-
     disableTerminals = lib.mkOption {
       type = lib.types.bool;
       default = false;
       description = "Disable remote shell access through Periphery.";
     };
 
-    disableContainerTerminals = lib.mkOption {
+    disableContainerExec = lib.mkOption {
       type = lib.types.bool;
       default = false;
-      description = "(v2.0+) Disable remote container shell access through Periphery.";
+      description = "Disable remote container shell access through Periphery.";
     };
 
     statsPollingRate = lib.mkOption {
@@ -331,147 +222,6 @@ in
       ];
     };
 
-    auth = {
-      privateKey = lib.mkOption {
-        type = lib.types.str;
-        default = "";
-        description = ''
-          (v2.0+) Private key used with the Noise handshake.
-
-          Use `file:/path/to/file` prefix to load from a file. If the file doesn't exist,
-          Periphery will generate and write a new key to the path.
-
-          If empty, defaults to `file:''${rootDirectory}/keys/periphery.key`.
-        '';
-        example = lib.literalExpression ''
-          # Reference a secret file
-          "file:''${config.age.secrets.komodo-private-key.path}"
-
-          # Or direct path
-          "file:/run/secrets/komodo-private-key"
-        '';
-      };
-
-      corePublicKeys = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
-        description = ''
-          (v2.0+) Accepted public keys to allow Core(s) to connect.
-          Accepts Spki base64 DER directly or can reference files using `file:/path/to/core.pub` prefix.
-          You can mix direct keys and file references.
-
-          For better security, use the `file:` prefix to reference secret files.
-        '';
-        example = lib.literalExpression ''
-          [
-            # Direct key value
-            "MCowBQYDK2VuAyEATZgrjGHeF0KJUe0+n77+qAWOg3YzEzXOmQWaRgO3OGQ="
-            # Reference secret files
-            "file:''${config.age.secrets.komodo-core1-pub.path}"
-            "file:''${config.age.secrets.komodo-core2-pub.path}"
-          ]
-        '';
-      };
-    };
-
-    inbound = {
-      serverEnabled = lib.mkOption {
-        type = lib.types.nullOr lib.types.bool;
-        default = null;
-        description = ''
-          Enable the inbound connection server for Core -> Periphery connections.
-          If null, defaults to false when `outbound.coreAddress` is defined, otherwise true.
-        '';
-      };
-
-      port = lib.mkOption {
-        type = lib.types.port;
-        default = 8120;
-        description = "Port for the inbound Periphery server to listen on.";
-      };
-
-      bindIp = lib.mkOption {
-        type = lib.types.str;
-        default = "[::]";
-        description = ''
-          IP address the periphery server will bind to.
-          The default allows external IPv4 and IPv6 connections.
-        '';
-      };
-
-      allowedIps = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
-        description = ''
-          Limit the IP addresses which can connect to Periphery.
-          Supports IPv4/IPv6 addresses and subnets.
-          Empty list allows all connections.
-        '';
-        example = [
-          "::ffff:12.34.56.78"
-          "10.0.10.0/24"
-        ];
-      };
-
-      ssl = {
-        enable = lib.mkEnableOption "(v2.0+) SSL/TLS support for inbound connections" // {
-          default = true;
-        };
-
-        keyFile = lib.mkOption {
-          type = lib.types.path;
-          default = "${cfg.rootDirectory}/ssl/key.pem";
-          defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/key.pem"'';
-          description = ''
-            Path to SSL key file.
-            If the file doesn't exist and SSL is enabled, self-signed keys will be generated using openssl.
-          '';
-        };
-
-        certFile = lib.mkOption {
-          type = lib.types.path;
-          default = "${cfg.rootDirectory}/ssl/cert.pem";
-          defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/cert.pem"'';
-          description = ''
-            Path to SSL certificate file.
-            If the file doesn't exist and SSL is enabled, self-signed certificate will be generated using openssl.
-          '';
-        };
-      };
-    };
-
-    outbound = {
-      coreAddress = lib.mkOption {
-        type = lib.types.str;
-        default = "";
-        description = ''
-          (v2.0+) The address of Komodo Core. Must be reachable from this host.
-          If provided, Periphery will operate in outbound mode.
-        '';
-        example = "demo.komo.do";
-      };
-
-      connectAs = lib.mkOption {
-        type = lib.types.str;
-        default = "";
-        description = ''
-          (v2.0+) The Server this Periphery agent should connect as.
-          Must match an existing Server name or id.
-        '';
-        example = "server-name";
-      };
-
-      onboardingKeyFile = lib.mkOption {
-        type = lib.types.nullOr lib.types.path;
-        default = null;
-        description = ''
-          (v2.0+) Path to file containing the onboarding key.
-          This will be passed via `PERIPHERY_ONBOARDING_KEY_FILE` environment variable.
-        '';
-        example = lib.literalExpression ''"''${config.age.secrets.komodo-onboarding.path}"'';
-      };
-    };
-
     user = lib.mkOption {
       type = lib.types.str;
       default = "komodo-periphery";
@@ -503,14 +253,14 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    virtualisation.docker.enable = lib.mkDefault (cfg.dockerHost == null);
+    virtualisation.docker.enable = true;
 
     users.users.${cfg.user} = lib.mkIf (cfg.user == "komodo-periphery") {
       isSystemUser = true;
       group = cfg.group;
       description = "Komodo Periphery service user";
       home = cfg.rootDirectory;
-      extraGroups = lib.optional (cfg.dockerHost == null) "docker";
+      extraGroups = [ "docker" ];
     };
 
     users.groups.${cfg.group} = lib.mkIf (cfg.group == "komodo-periphery") { };
@@ -521,26 +271,16 @@ in
         user = cfg.user;
         group = cfg.group;
       };
-      "${actualRepoDir}".d = {
+      "${cfg.rootDirectory}/repos".d = {
         mode = "0755";
         user = cfg.user;
         group = cfg.group;
       };
-      "${actualStackDir}".d = {
+      "${cfg.rootDirectory}/stacks".d = {
         mode = "0755";
         user = cfg.user;
         group = cfg.group;
       };
-      "${actualBuildDir}".d = {
-        mode = "0755";
-        user = cfg.user;
-        group = cfg.group;
-      };
-      "${cfg.rootDirectory}/keys".d = {
-        mode = "0700";
-        user = cfg.user;
-        group = cfg.group;
-      };
       "${cfg.rootDirectory}/ssl".d = {
         mode = "0700";
         user = cfg.user;
@@ -552,63 +292,35 @@ in
       description = "Komodo Periphery - Multi-server Docker and Git deployment agent";
       after = [
         "network-online.target"
-      ]
-      ++ lib.optional (cfg.dockerHost == null) "docker.service";
+        "docker.service"
+      ];
       wants = [
         "network-online.target"
-      ]
-      ++ lib.optional (cfg.dockerHost == null) "docker.service";
+        "docker.service"
+      ];
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
         Type = "simple";
         User = cfg.user;
         Group = cfg.group;
-        SupplementaryGroups = lib.mkIf (cfg.dockerHost == null) [ "docker" ];
+        SupplementaryGroups = [ "docker" ];
         Restart = "on-failure";
         RestartSec = "10s";
         WorkingDirectory = cfg.rootDirectory;
 
         ExecStart = lib.escapeShellArgs [
-          (lib.getExe' cfg.package "periphery")
+          "${lib.getExe' cfg.package "periphery"}"
           "--config-path"
-          configFile
+          (if cfg.configFile != null then cfg.configFile else configFile)
         ];
 
         Environment = lib.mapAttrsToList (name: value: "${name}=${value}") (
-          lib.optionalAttrs (cfg.configFile == null) {
-            PERIPHERY_ROOT_DIRECTORY = cfg.rootDirectory;
-            PERIPHERY_REPO_DIR = actualRepoDir;
-            PERIPHERY_STACK_DIR = actualStackDir;
-            PERIPHERY_BUILD_DIR = actualBuildDir;
+          cfg.environment
+          // lib.optionalAttrs (!cfg.disableTerminals) {
+            PATH = "/run/current-system/sw/bin:/run/wrappers/bin";
           }
-          // lib.optionalAttrs (cfg.configFile == null && cfg.inbound.ssl.enable) {
-            PERIPHERY_SSL_KEY_FILE = cfg.inbound.ssl.keyFile;
-            PERIPHERY_SSL_CERT_FILE = cfg.inbound.ssl.certFile;
-          }
-          // lib.optionalAttrs (cfg.dockerHost != null) {
-            DOCKER_HOST = cfg.dockerHost;
-          }
-          // lib.optionalAttrs (cfg.passkeyFiles != null) {
-            PERIPHERY_PASSKEYS_FILE = cfg.passkeyFiles;
-          }
-          // lib.optionalAttrs (cfg.auth.privateKey != "") {
-            PERIPHERY_PRIVATE_KEY = cfg.auth.privateKey;
-          }
-          // lib.optionalAttrs (cfg.auth.corePublicKeys != [ ]) {
-            PERIPHERY_CORE_PUBLIC_KEYS = lib.concatStringsSep "," cfg.auth.corePublicKeys;
-          }
-          // lib.optionalAttrs (cfg.outbound.onboardingKeyFile != null) {
-            PERIPHERY_ONBOARDING_KEY_FILE = cfg.outbound.onboardingKeyFile;
-          }
-          // cfg.environment
         );
-
-        ExecSearchPath = lib.mkIf (!cfg.disableTerminals) [
-          "/run/current-system/sw/bin"
-          "/run/wrappers/bin"
-        ];
-
         EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
 
         StateDirectory = "komodo-periphery";
@@ -617,7 +329,7 @@ in
         NoNewPrivileges = true;
         PrivateTmp = true;
         ProtectSystem = "full";
-        ProtectHome = "read-only";
+        ProtectHome = true;
       };
     };
   };

nixos/modules/services/desktops/oo7.nix

@@ -10,7 +10,7 @@ in
 {
   options.services.oo7 = {
     enable = lib.mkEnableOption ''
-      oo7, a service providing the Secret Service D-Bus API
+      oo7, a service providing the Secret Service D-Bus API.
     '';
   };
 

nixos/modules/services/desktops/seatd.nix

@@ -40,6 +40,7 @@ in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
       seatd
+      sdnotify-wrapper
     ];
     users.groups.seat = lib.mkIf (cfg.group == "seat") { };
 
@@ -54,7 +55,7 @@ in
         Type = "notify";
         NotifyAccess = "all";
         SyslogIdentifier = "seatd";
-        ExecStart = "${lib.getExe' pkgs.s6 "s6-notify-socket-from-fd"} ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
+        ExecStart = "${pkgs.sdnotify-wrapper}/bin/sdnotify-wrapper ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
         RestartSec = 1;
         Restart = "always";
       };

nixos/modules/services/display-managers/dms-greeter.nix

@@ -4,6 +4,7 @@
   pkgs,
   ...
 }:
+
 let
   inherit (lib)
     types
@@ -23,27 +24,13 @@ let
   cfgAutoLogin = config.services.displayManager.autoLogin;
   sessionData = config.services.displayManager.sessionData;
 
-  # Miracle WM is nested under `programs.wayland.miracle-wm` unlike the rest
-  compositorOption =
-    if cfg.compositor.name == "miracle-wm" then "wayland.miracle-wm" else "${cfg.compositor.name}";
   cacheDir = "/var/lib/dms-greeter";
 
-  # Not all compositor packages match the name they use and Miracle does not have a package option
-  compositorPkg =
-    if cfg.compositor.name == "miracle-wm" then
-      pkgs.miracle-wm
-    else
-      lib.attrByPath [
-        "programs"
-        cfg.compositor.name
-        "package"
-      ] null config;
-
   greeterScript = pkgs.writeShellScriptBin "dms-greeter-start" ''
     export PATH=$PATH:${
       makeBinPath [
         cfg.quickshell.package
-        compositorPkg
+        config.programs.${cfg.compositor.name}.package
       ]
     }
     ${
@@ -136,9 +123,6 @@ in
           "niri"
           "hyprland"
           "sway"
-          "mangowc"
-          "miracle-wm"
-          "labwc"
         ];
         example = "niri";
         description = ''
@@ -151,9 +135,6 @@ in
           - niri: A scrollable-tiling Wayland compositor
           - hyprland: A dynamic tiling Wayland compositor
           - sway: An i3-compatible Wayland compositor
-          - mango: A dwm-inspired Wayland compositor with modern config options and multiple layouts
-          - miracle-wm: A keyboard-driven Wayland compositor with smooth animations and extensibility
-          - labwc: Lightweight stacking Wayland compositor inspired by Openbox
         '';
       };
 
@@ -261,16 +242,12 @@ in
   config = mkIf cfg.enable {
     assertions = [
       {
-        assertion =
-          # Assemble the full attribute structure because miracle-wm is not nested in the same location as the others
-          lib.attrByPath (
-            [ "programs" ] ++ lib.splitString "." compositorOption ++ [ "enable" ]
-          ) false config;
+        assertion = config.programs.${cfg.compositor.name}.enable or false;
         message = ''
           DankMaterialShell greeter: The compositor "${cfg.compositor.name}" is not enabled.
 
           Please enable the compositor via:
-            programs.${compositorOption}.enable = true;
+            programs.${cfg.compositor.name}.enable = true;
         '';
       }
       {

nixos/modules/services/display-managers/gdm.nix

@@ -421,7 +421,7 @@ in
             {
               name = "unix";
               control = "sufficient";
-              modulePath = config.security.pam.pam_unixModulePath;
+              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
             }
           ];
 
@@ -567,7 +567,7 @@ in
             {
               name = "unix";
               control = "sufficient";
-              modulePath = config.security.pam.pam_unixModulePath;
+              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
             }
           ];
 
@@ -575,8 +575,9 @@ in
             {
               name = "unix";
               control = "requisite";
-              modulePath = config.security.pam.pam_unixModulePath;
+              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
               settings.nullok = true;
+              settings.yescrypt = true;
             }
           ];
 

nixos/modules/services/display-managers/greetd.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  utils,
   pkgs,
   ...
 }:
@@ -77,37 +76,9 @@ in
     services.greetd.settings.default_session.user = lib.mkDefault "greeter";
 
     security.pam.services.greetd = {
-      useDefaultRules = false;
-      rules = {
-        auth = utils.pam.autoOrderRules [
-          {
-            name = "login";
-            control = "substack";
-            modulePath = "login";
-          }
-        ];
-        account = utils.pam.autoOrderRules [
-          {
-            name = "login";
-            control = "include";
-            modulePath = "login";
-          }
-        ];
-        password = utils.pam.autoOrderRules [
-          {
-            name = "login";
-            control = "substack";
-            modulePath = "login";
-          }
-        ];
-        session = utils.pam.autoOrderRules [
-          {
-            name = "login";
-            control = "include";
-            modulePath = "login";
-          }
-        ];
-      };
+      allowNullPassword = true;
+      startSession = true;
+      enableGnomeKeyring = lib.mkDefault config.services.gnome.gnome-keyring.enable;
     };
 
     # This prevents nixos-rebuild from killing greetd by activating getty again

nixos/modules/services/display-managers/ly.nix

@@ -100,37 +100,9 @@ in
 
     security.pam.services = {
       ly = {
-        useDefaultRules = false;
-        rules = {
-          auth = utils.pam.autoOrderRules [
-            {
-              name = "login";
-              control = "substack";
-              modulePath = "login";
-            }
-          ];
-          account = utils.pam.autoOrderRules [
-            {
-              name = "login";
-              control = "include";
-              modulePath = "login";
-            }
-          ];
-          password = utils.pam.autoOrderRules [
-            {
-              name = "login";
-              control = "substack";
-              modulePath = "login";
-            }
-          ];
-          session = utils.pam.autoOrderRules [
-            {
-              name = "login";
-              control = "include";
-              modulePath = "login";
-            }
-          ];
-        };
+        startSession = true;
+        unixAuth = true;
+        enableGnomeKeyring = lib.mkDefault config.services.gnome.gnome-keyring.enable;
       };
     }
     // optionalAttrs dmcfg.autoLogin.enable {

nixos/modules/services/display-managers/plasma-login-manager.nix

@@ -201,7 +201,7 @@ in
               # Setup session
               name = "unix";
               control = "required";
-              modulePath = config.security.pam.pam_unixModulePath;
+              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
             }
             {
               name = "systemd";

nixos/modules/services/display-managers/sddm.nix

@@ -442,7 +442,7 @@ in
             {
               name = "unix";
               control = "sufficient";
-              modulePath = config.security.pam.pam_unixModulePath;
+              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
             }
           ];
 

nixos/modules/services/editors/emacs.nix

@@ -80,9 +80,6 @@ in
       unitConfig = lib.optionalAttrs cfg.startWithGraphical {
         After = "graphical-session.target";
       };
-
-      # Long-lived session that ought to only be restarted manually
-      restartIfChanged = false;
     }
     // lib.optionalAttrs cfg.enable {
       wantedBy = if cfg.startWithGraphical then [ "graphical-session.target" ] else [ "default.target" ];

nixos/modules/services/hardware/sane_extra_backends/brscan5_etc_files.nix

@@ -58,17 +58,17 @@ stdenv.mkDerivation {
   dontConfigure = true;
 
   buildPhase = ''
-    TARGET_DIR="$out/tmp"
+    TARGET_DIR="$out/etc/opt/brother/scanner/brscan5"
     mkdir -p "$TARGET_DIR"
     cp -rp "./models" "$TARGET_DIR"
     cp -rp "./brscan5.ini" "$TARGET_DIR"
     cp -rp "./brsanenetdevice.cfg" "$TARGET_DIR"
-    export NIX_REDIRECTS="/etc/opt/brother/scanner/brscan5/=$TARGET_DIR/"
-    printf '${addAllNetDev netDevices}\n'
-    ${addAllNetDev netDevices}
 
-    mkdir -p "$out/etc/opt/brother/scanner/brscan5"
-    mv -T "$TARGET_DIR" "$out/etc/opt/brother/scanner/brscan5"
+    export NIX_REDIRECTS="/etc/opt/brother/scanner/brscan5/=$TARGET_DIR/"
+
+    printf '${addAllNetDev netDevices}\n'
+
+    ${addAllNetDev netDevices}
   '';
 
   dontInstall = true;

nixos/modules/services/hardware/watt.nix

@@ -1,71 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  inherit (lib)
-    mkIf
-    mkOption
-    mkEnableOption
-    mkPackageOption
-    getExe
-    ;
-  inherit (lib.types) submodule;
-
-  cfg = config.services.watt;
-
-  format = pkgs.formats.toml { };
-  cfgFile = format.generate "watt-config.toml" cfg.settings;
-
-  conflictingServices = [
-    "power-profiles-daemon"
-    "auto-cpufreq"
-    "tlp"
-    "cpupower-gui"
-    "thermald"
-  ];
-
-in
-{
-  options.services.watt = {
-    enable = mkEnableOption "automatic CPU speed & power optimizer for Linux";
-    package = mkPackageOption pkgs "watt" { };
-
-    settings = mkOption {
-      default = { };
-      type = submodule { freeformType = format.type; };
-      description = "Configuration for Watt. Options at https://github.com/notaShelf/watt";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    assertions = map (service: {
-      assertion = !config.services.${service}.enable;
-      message = "You have set services.${service}.enable = true; which conflicts with Watt.";
-    }) conflictingServices;
-
-    environment.systemPackages = [ cfg.package ];
-
-    # This is necessary for the Watt CLI. The environment variable
-    # passed to the systemd service will take priority in read order.
-    environment.etc."watt.toml".source = cfgFile;
-
-    services.dbus.packages = [ cfg.package ];
-
-    systemd.services.watt = {
-      wantedBy = [ "multi-user.target" ];
-      conflicts = map (service: "${service}.service") conflictingServices;
-      serviceConfig = {
-        WorkingDirectory = "";
-        ExecStart = getExe cfg.package;
-        Restart = "on-failure";
-
-        RuntimeDirectory = "watt";
-        RuntimeDirectoryMode = "0755";
-      };
-    };
-
-  };
-}

nixos/modules/services/mail/postsrsd.nix

@@ -281,7 +281,7 @@ in
       environment.etc."postsrsd.conf".source = configFile;
 
       systemd.services.postsrsd = {
-        description = "Sender Rewriting Scheme daemon for Postfix";
+        description = "PostSRSd SRS rewriting server";
         after = [
           "network.target"
           "postsrsd-generate-secrets.service"
@@ -289,20 +289,14 @@ in
         before = [ "postfix.service" ];
         wantedBy = [ "multi-user.target" ];
         requires = [ "postsrsd-generate-secrets.service" ];
-        reloadTriggers = [ configFile ];
+        restartTriggers = [ configFile ];
 
         serviceConfig = {
-          Type = "notify-reload";
           ExecStart = utils.escapeSystemdExecArgs [
             (lib.getExe cfg.package)
             "-C"
             "/etc/postsrsd.conf"
           ];
-          ExecReload = toString [
-            (lib.getExe' pkgs.coreutils "kill")
-            "-SIGHUP"
-            "$MAINPID"
-          ];
           User = cfg.user;
           Group = cfg.group;
           RuntimeDirectory = "postsrsd";
@@ -325,7 +319,7 @@ in
           ProtectKernelModules = true;
           ProtectKernelTunables = true;
           ProtectSystem = "strict";
-          ProtectProc = "noaccess";
+          ProtectProc = "invisible";
           ProcSubset = "pid";
           RemoveIPC = true;
           RestrictAddressFamilies =

nixos/modules/services/mail/rspamd.nix

@@ -506,7 +506,6 @@ in
         CapabilityBoundingSet = "";
         DevicePolicy = "closed";
         LockPersonality = true;
-        MemoryDenyWriteExecute = false; # pcre2 jit
         NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateMounts = true;

nixos/modules/services/mail/stalwart.nix

@@ -57,7 +57,7 @@ in
       default = { };
       description = ''
         Configuration options for the Stalwart server.
-        See <https://stalw.art/docs/configuration> for available options.
+        See <https://stalw.art/docs/category/configuration> for available options.
 
         By default, the module is configured to store everything locally.
       '';

nixos/modules/services/matrix/dendrite.nix

@@ -13,7 +13,6 @@ in
 {
   options.services.dendrite = {
     enable = lib.mkEnableOption "matrix.org dendrite";
-    package = lib.mkPackageOption pkgs "dendrite" { };
     httpPort = lib.mkOption {
       type = lib.types.nullOr lib.types.port;
       default = 8008;
@@ -322,7 +321,7 @@ in
         ];
         ExecStart = lib.strings.concatStringsSep " " (
           [
-            (lib.getExe cfg.package)
+            "${pkgs.dendrite}/bin/dendrite"
             "--config /run/dendrite/dendrite.yaml"
           ]
           ++ lib.optionals (cfg.httpPort != null) [

nixos/modules/services/matrix/matrix-authentication-service.nix

@@ -45,9 +45,7 @@ let
       pruned;
   configFile = format.generate "config.yaml" finalSettings;
 
-  extraConfigFiles = lib.imap0 (
-    i: _: "\${CREDENTIALS_DIRECTORY}/config-${toString i}"
-  ) cfg.extraConfigFiles;
+  extraConfigFiles = lib.imap0 (i: _: "%d/config-${toString i}") cfg.extraConfigFiles;
   runtimeConfig = "/run/matrix-authentication-service/config.yaml";
 in
 {

nixos/modules/services/misc/bees.nix

@@ -17,7 +17,6 @@ let
     notice = 5;
     info = 6;
     debug = 7;
-    trace = 8;
   };
 
   fsOptions = with lib.types; {

nixos/modules/services/misc/errbot.nix

@@ -91,20 +91,6 @@ in
     };
     users.groups.errbot = { };
 
-    systemd.tmpfiles.settings = {
-      "10-errbot" = lib.mapAttrs' (
-        name: instanceCfg:
-        let
-          dataDir = if instanceCfg.dataDir != null then instanceCfg.dataDir else "/var/lib/errbot/${name}";
-        in
-        lib.nameValuePair "${dataDir}".d {
-          group = "errbot";
-          user = "errbot";
-          mode = "0755";
-        }
-      ) cfg.instances;
-    };
-
     systemd.services = lib.mapAttrs' (
       name: instanceCfg:
       lib.nameValuePair "errbot-${name}" (
@@ -117,7 +103,12 @@ in
           serviceConfig = {
             User = "errbot";
             Restart = "on-failure";
+            ExecStartPre = [
+              "${lib.getExe' pkgs.coreutils "mkdir"} -p ${dataDir}"
+              "${lib.getExe' pkgs.coreutils "chown"} -R errbot:errbot ${dataDir}"
+            ];
             ExecStart = "${pkgs.errbot}/bin/errbot -c ${mkConfigDir instanceCfg dataDir}/config.py";
+            PermissionsStartOnly = true;
           };
         }
       )

nixos/modules/services/misc/graphical-desktop.nix

@@ -22,23 +22,17 @@ in
 
   config = lib.mkIf cfg.enable {
     environment = {
-      # systemd-localed looks into 00-keyboard.conf
-      # systemd-localed does not like if Option values are ""
-      etc."X11/xorg.conf.d/00-keyboard.conf".text =
-        let
-          optionLine =
-            name: value: lib.optionalString (value != null && value != "") ''Option "${name}" "${value}"'';
-        in
-        ''
-          Section "InputClass"
-            Identifier "Keyboard catchall"
-            MatchIsKeyboard "on"
-            ${optionLine "XkbModel" xcfg.xkb.model}
-            ${optionLine "XkbLayout" xcfg.xkb.layout}
-            ${optionLine "XkbOptions" xcfg.xkb.options}
-            ${optionLine "XkbVariant" xcfg.xkb.variant}
-          EndSection
-        '';
+      # localectl looks into 00-keyboard.conf
+      etc."X11/xorg.conf.d/00-keyboard.conf".text = ''
+        Section "InputClass"
+          Identifier "Keyboard catchall"
+          MatchIsKeyboard "on"
+          Option "XkbModel" "${xcfg.xkb.model}"
+          Option "XkbLayout" "${xcfg.xkb.layout}"
+          Option "XkbOptions" "${xcfg.xkb.options}"
+          Option "XkbVariant" "${xcfg.xkb.variant}"
+        EndSection
+      '';
       systemPackages = with pkgs; [
         nixos-icons # needed for gnome and pantheon about dialog, nixos-manual and maybe more
         xdg-utils

nixos/modules/services/misc/jellyfin.nix

@@ -33,11 +33,7 @@ let
     ;
   cfg = config.services.jellyfin;
   filteredDecodingCodecs = builtins.filter (
-    c:
-    c != "hevc10bit"
-    && c != "hevcRExt10bit"
-    && c != "hevcRExt12bit"
-    && cfg.transcoding.hardwareDecodingCodecs.${c}
+    c: c != "hevcRExt10bit" && c != "hevcRExt12bit" && cfg.transcoding.hardwareDecodingCodecs.${c}
   ) (builtins.attrNames cfg.transcoding.hardwareDecodingCodecs);
   encodingXmlText = ''
     <?xml version="1.0" encoding="utf-8"?>
@@ -62,7 +58,6 @@ let
       <AllowAv1Encoding>${boolToString cfg.transcoding.hardwareEncodingCodecs.av1}</AllowAv1Encoding>
       <EnableIntelLowPowerH264HwEncoder>${boolToString cfg.transcoding.enableIntelLowPowerEncoding}</EnableIntelLowPowerH264HwEncoder>
       <EnableIntelLowPowerHevcHwEncoder>${boolToString cfg.transcoding.enableIntelLowPowerEncoding}</EnableIntelLowPowerHevcHwEncoder>
-      <EnableDecodingColorDepth10Hevc>${boolToString cfg.transcoding.hardwareDecodingCodecs.hevc10bit}</EnableDecodingColorDepth10Hevc>
       <EnableDecodingColorDepth10HevcRext>${boolToString cfg.transcoding.hardwareDecodingCodecs.hevcRExt10bit}</EnableDecodingColorDepth10HevcRext>
       <EnableDecodingColorDepth12HevcRext>${boolToString cfg.transcoding.hardwareDecodingCodecs.hevcRExt12bit}</EnableDecodingColorDepth12HevcRext>
       <HardwareDecodingCodecs>