Merge 3a43353dd5 into haskell-updates

Diff: https://github.com/DNSControl/dnscontrol/compare/v5.0.3...v5.0.4

Changelog: https://github.com/DNSControl/dnscontrol/releases/tag/v5.0.4

doc/hooks/tauri.section.md

@@ -73,7 +73,7 @@ Controls the flags passed to `cargo tauri build`.
 
 #### `tauriBundleType` {#tauri-bundle-type}
 
-The [bundle type](https://tauri.app/v1/guides/building/) to build.
+The [bundle type](https://tauri.app/reference/javascript/api/namespaceapp/#bundletype) to build.
 
 #### `dontTauriBuild` {#dont-tauri-build}
 

doc/interoperability/cyclonedx.md

@@ -39,7 +39,7 @@ The `nix:narinfo` properties should be accompanied by a `nix:store_path` propert
 | `nix:narinfo:system`      | The hardware and software platform on which this component is produced. |
 | `nix:narinfo:sig`         | Signatures claiming that this component is what it claims to be. |
 | `nix:narinfo:ca`          | Content address of this store object's file system object, used to compute its store path. |
-| `nix:narinfo:references`  | A whitespace separated array of store paths that this component references. |
+| `nix:narinfo:references`  | A whitespace-separated array of store paths that this component references. |
 
 ### `nix:fod` {#sec-interop.cylonedx-fod}
 

doc/release-notes/rl-2611.section.md

@@ -97,6 +97,8 @@
 
 - `tengine` has been removed as it has seen seriously delayed responses to security vulnerabilities.
 
+- `writeTextFile` now uses structured attributes and `passAsFile` is no longer used or supported.
+
 - `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.
 
 - Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:
@@ -114,6 +116,8 @@
   `lib.systems.{examples,platforms}.{sheevaplug,pogoplug4}` have been unified into `lib.systems.examples.armv5tel-multiplatform`.
   Note that there is no official support for ARMv5 and it is not possible to build even a simple NixOS configuration out of the box.
 
+- `tcl.mkTclDerivation` now enables `strictDeps` and `__structuredAttrs`.
+
 - `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
 
 - LibreOffice upstream switched from Fresh/Still stable branches to a single Stable branch; `libreoffice` and `libreoffice-qt` work as before, but more specific aliases like `libreoffice-fresh` should be replaced.
@@ -130,6 +134,9 @@
     Users who must continue using ingress-nginx will now need to manually provide the rke2-images-ingress-nginx tarball.
   - Future Removal: The ingress-nginx chart will not receive any additional updates and will be completely removed in v1.37 for community users.
 
+- `replaceVarsWith` now enables `strictDeps` and `__structuredAttrs` and passing these attributes to the function is no longer allowed.
+   By extension, `replaceVars` now also enables `strictDeps` and `__structuredAttrs`.
+
 - `buildFHSEnvChroot` has been removed after deprecation in 23.05.
 
 - `leafnode` has been removed, as it was an unmaintained alpha-release of leafnode 2 and has a dependency on the EOL PRCE-library. Consider using `leafnode1` instead, which is still maintained.

doc/stdenv/stdenv.chapter.md

@@ -493,7 +493,7 @@ When using native compilation, `stdenv` is lenient towards incorrect placement o
 
 While convenient for getting to a package quickly, this behavior can break cross-compilation. Adding `strictDeps = true` as a parameter to `mkDerivation` or any of its language specific wrappers disables this behavior.
 
-The specialized `build*` functions for dlang, emacs, go, nim, ocaml, python, and rust enable this option by default.
+The specialized `build*` functions for dlang, emacs, go, nim, ocaml, python, rust, and `tcl.mkTclDerivation` enable this option by default.
 
 ## Attributes {#ssec-stdenv-attributes}
 

maintainers/github-teams.json

@@ -193,7 +193,6 @@
       "Emin017": 99674037,
       "Et7f3": 29592775,
       "Guanran928": 68757440,
-      "KristijanZic": 10299892,
       "LnL7": 689294,
       "Mastermindaxe": 33257997,
       "Moraxyc": 69713071,

maintainers/maintainer-list.nix

@@ -4474,6 +4474,14 @@
     githubId = 510553;
     name = "Jos van Bakel";
   };
+  c2fc2f = {
+    name = "c2fc2f";
+    github = "c2fc2f";
+    githubId = 59392138;
+    email = "contact@c2fc2f.com";
+    matrix = "@c2fc2f:sagbot.com";
+    keys = [ { fingerprint = "6EF1 8507 76B5 ABCE 5BF0  C0F8 42E0 E1D1 0B61 1208"; } ];
+  };
   c31io = {
     email = "celiogrand@outlook.com";
     github = "c31io";
@@ -14815,6 +14823,12 @@
     githubId = 32649612;
     keys = [ { fingerprint = "65DF D21C 22A9 E4CD FD1A  0804 C3D7 16E7 29B3 C86A"; } ];
   };
+  keksnino = {
+    name = "KeksNino";
+    email = "KeksNino@proton.me";
+    github = "KeksNino";
+    githubId = 87879013;
+  };
   keldu = {
     email = "mail@keldu.de";
     github = "keldu";
@@ -19342,6 +19356,12 @@
     githubId = 708570;
     name = "Manuel Mendez";
   };
+  mmulqueen = {
+    email = "michael@mulqueen.me.uk";
+    github = "mmulqueen";
+    githubId = 6616321;
+    name = "Michael Mulqueen";
+  };
   mmusnjak = {
     email = "marko.musnjak@gmail.com";
     github = "mmusnjak";
@@ -32184,12 +32204,6 @@
     githubId = 65394961;
     name = "Yves Straten";
   };
-  yvnth = {
-    email = "yashupress@gmail.com";
-    github = "yvnth";
-    githubId = 201552597;
-    name = "Yashwanth Prasannakumar";
-  };
   yzx9 = {
     email = "yuan.zx@outlook.com";
     github = "yzx9";

maintainers/scripts/haskell/eval-pkg-sets.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash
+#!nix-shell -p jq git
+# shellcheck shell=bash
+#
+# Usage: eval-pkg-sets.sh [extra flags for nix-* commands ...]
+#
+# Must be executed in a git checkout of Nixpkgs.
+
+set -euo pipefail
+
+NIXPKGS="$(git rev-parse --show-toplevel)"
+PKGSETS="$(nix-env --readonly-mode --json --drv-path -f "$NIXPKGS" -qaP -A haskell.compiler "$@" \
+  | jq -r 'to_entries | unique_by(.value.drvPath) .[] .key | sub("^haskell.compiler";"haskell.packages")')"
+
+trap 'exit 1' SIGINT SIGTERM
+
+set +e
+
+badsets=""
+for set in $PKGSETS; do
+  # Confirm an equivalent package set to haskell.compiler.$entry exists and is usable
+  if ! nix-instantiate --readonly-mode -A "$set.ghc" "$@" > /dev/null 2>&1; then
+    echo "Skipping $set... ($set.ghc does not evaluate)"
+  else
+    echo "Evaluating $set..."
+
+    if ! nix-env --readonly-mode -f "$NIXPKGS" -qaP --drv-path -A "$set" "$@" > /dev/null; then
+      badsets+="$set "
+    fi
+  fi
+done
+
+if [ -n "$badsets" ]; then
+  echo "Found potential eval issues in the following sets:" >&2
+  # shellcheck disable=SC2086
+  printf '%s\n' $badsets
+  exit 1
+fi

maintainers/scripts/haskell/unbreak.nu

@@ -6,7 +6,7 @@
 
 # Attention: For unknown reasons, the script can't be easily cancelled and needs to be killed manually if it shouldn't run to completion.
 
-use std log
+use std/log
 
 let broken_config = "pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml"
 

maintainers/scripts/haskell/update-stackage.sh

@@ -33,7 +33,7 @@ fi
 
 # Stackage solver to use, LTS or Nightly
 # (should be capitalized like the display name)
-SOLVER=LTS
+SOLVER=Nightly
 # Stackage solver version, if any. Use latest if empty
 VERSION=
 TMP_TEMPLATE=update-stackage.XXXXXXX
@@ -105,6 +105,7 @@ sed -r \
     -e '/ hledger-ui /d' \
     -e '/ hledger-web /d' \
     -e '/ spacecookie /d' \
+    -e '/ hnix-store-core /d' \
     < "${tmpfile_new}" >> $stackage_config
 # Explanations:
 # cabal2nix, distribution-nixpkgs, jailbreak-cabal, language-nix: These are our packages and we know what we are doing.

maintainers/scripts/kde/generate-sources.py

@@ -157,15 +157,17 @@ def main(pkgset: str, version: str, nixpkgs: pathlib.Path, sources_url: str | No
         json.dump(results, fd, indent=2)
 
     for project_name in projects_to_update_rust:
-            print(f"Updating cargoDeps hash for {pkgset}/{project_name}...")
-            subprocess.run([
-                "nix-update",
-                f"kdePackages.{project_name}",
-                "--version",
-                "skip",
-                "--override-filename",
-                pkg_file
-            ])
+        print(f"Updating cargoDeps hash for {pkgset}/{project_name}...")
+        pkg_dir = set_dir / project_name
+        pkg_file = pkg_dir / "default.nix"
+        subprocess.run([
+            "nix-update",
+            f"kdePackages.{project_name}",
+            "--version",
+            "skip",
+            "--override-filename",
+            pkg_file
+        ])
 
 
 if __name__ == "__main__":

nixos/doc/manual/development/writing-nixos-tests.section.md

@@ -92,6 +92,10 @@ cd /my/git/clone/of/nixpkgs
 nix-build -A nixosTests.hostname
 ```
 
+In-tree tests run with a few changes to defaults, notably
+- The `pkgs.*` are read only by default. You can opt out with `node.pkgsReadOnly = false;` at the test level.
+- `nix.enable` defaults to `false` to reduce build closure size; in particular the reverse build closure of `nix` and its dependencies.
+
 ### Testing outside the NixOS project {#sec-call-nixos-test-outside-nixos}
 
 Outside the `nixpkgs` repository, you can use the `runNixOSTest` function from
@@ -110,6 +114,8 @@ pkgs.testers.runNixOSTest {
 
 `runNixOSTest` returns a derivation that runs the test.
 
+Out-of-tree tests evaluate with a set of defaults that balances the principle of least surprise in the general case, but has a few differences from in-tree NixOS tests. See [Testing within NixOS](#sec-call-nixos-test-in-nixos).
+
 ## Test machines {#ssec-nixos-test-machines}
 
 A NixOS test usually consists of one or more test machines. Each machine is either a

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -207,10 +207,14 @@
 
 - `fail2ban` has been updated to 1.1.1, which has a few breaking changes compared to 1.1.0 ([changelog](https://github.com/fail2ban/fail2ban/blob/1.1.1/ChangeLog))
 
+- `services.neo4j.tls.<policy_name>`: This policy is no longer enabled by default. If you rely on this policy, you must now explicitly opt-in by setting `services.neo4j.tls.<policy_name>.enable = true;`.
+
 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
 
 - `matrix-appservice-discord` was removed from nixpkgs along with its NixOS module (`services.matrix-appservice-discord`) as it is no longer actively maintained upstream. Use the actively-maintained puppeting bridge [`mautrix-discord`](#opt-services.mautrix-discord.enable) instead.
 
+- `services.logrotate.configFile` has been removed. If you still need to load a config from another directory, use `include` directives within `services.logrotate.settings`.
+
 - Home Assistant 2026.8.0 migrated its HTTP configuration from YAML into the frontend. After upgrading, any options configured under `services.home-assistant.config.http` can be removed. HTTP settings can now be configured from the Home Assistant frontend under [Settings → System → Network](https://my.home-assistant.io/redirect/network). If no HTTP settings were previously configured, Home Assistant will default to listening on all interfaces on port 8123.
 
 - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.
@@ -310,6 +314,10 @@
 
 - The `programs.fuse` module, which provides the `fusermount3` executable and the `/etc/fuse.conf` config file, is now opt-in. The obligation to enable it has been shifted to its various consumers (e.g. gvfs, flatpak, appimage, sshfs). This can break fuse consumers at runtime, that don't explicitly declare that dependency with a module, e.g the mounting functionality in various backup tools (borg, restic, rclone, ...).
 
+- The [Grav CMS][https://getgrav.org/] package `grav` is now deprecated and users are directed to `grav_2`.
+  Migrating sites to Grav 2 is a [manual process](https://learn.getgrav.org/20/migration/manual-migration) with this package since the migration plugin cannot modify the Nix store.
+  The [`services.grav.package`](#opt-services.grav.package) option defaults to `pkgs.grav_2` if [`system.stateVersion`](#opt-system.stateVersion) >=26.11.
+
 - `services.plausible` can now again seed an initial admin user declaratively via [`services.plausible.adminUser.email`](#opt-services.plausible.adminUser.email).
   This makes fully declarative deployments safer: Otherwise the user needed to either accept Plausible's unauthenticated "first launch" setup wizard, which lets anyone reaching the instance create the first admin account, or do more work (deploying with NixOS's default binding to `localhost` without exposing it publicly, going through the wizard, and then deploying Plausible exposed to the Internet).
   This option was previously removed with NixOS 25.05 due to an upstream Plausible change making declarative admin creation more difficult, but this change re-implements the admin creation directly.
@@ -340,3 +348,6 @@
 - `nix` now supports running in "daemonless" mode by setting `nix.daemon.enable = false`. Under this mode all store operations must go through the [local store type](https://nix.dev/manual/nix/latest/store/types/local-store), which typically requires root permissions.
 
 - [Hister](https://github.com/asciimoo/hister), a web history service offering blazing fast, content-based search across visited websites. Available as [services.hister](#opt-services.hister.enable).
+
+- The default of [`networking.firewall.checkReversePath`](#opt-networking.firewall.checkReversePath) changed to `"loose"` to align with upstream systemd.
+  If your environment requires strict reverse path filtering, you must now explicitly configure it with `networking.firewall.checkReversePath = "strict";`.

nixos/lib/test-driver/src/test_driver/logger.py

@@ -80,17 +80,18 @@ class JunitXMLLogger(AbstractLogger):
             self.failure = False
 
     def __init__(self, outfile: Path) -> None:
-        self.tests: dict[str, JunitXMLLogger.TestCaseState] = {
-            "main": self.TestCaseState()
-        }
-        self.currentSubtest = "main"
+        self.testsuite = JunitXMLLogger.TestCaseState()
+        self.tests: dict[str, JunitXMLLogger.TestCaseState] = {}
+        self.currentSubtest = None
         self.outfile: Path = outfile
         self._print_serial_logs = True
         self._log_level = LogLevel.INFO
         atexit.register(self.close)
 
     def log(self, message: str, attributes: dict[str, str] = {}) -> None:
-        self.tests[self.currentSubtest].stdout += message + os.linesep
+        self.testsuite.stdout += message + os.linesep
+        if self.currentSubtest:
+            self.tests[self.currentSubtest].stdout += message + os.linesep
 
     @contextmanager
     def subtest(self, name: str, attributes: dict[str, str] = {}) -> Iterator[None]:
@@ -109,19 +110,28 @@ class JunitXMLLogger(AbstractLogger):
 
     def debug(self, *args, **kwargs) -> None:
         if self._log_level <= LogLevel.DEBUG:
-            self.tests[self.currentSubtest].stdout += args[0] + os.linesep
+            self.testsuite.stdout += args[0] + os.linesep
+            if self.currentSubtest:
+                self.tests[self.currentSubtest].stdout += args[0] + os.linesep
 
     def info(self, *args, **kwargs) -> None:
         if self._log_level <= LogLevel.INFO:
-            self.tests[self.currentSubtest].stdout += args[0] + os.linesep
+            self.testsuite.stdout += args[0] + os.linesep
+            if self.currentSubtest:
+                self.tests[self.currentSubtest].stdout += args[0] + os.linesep
 
     def warning(self, *args, **kwargs) -> None:
         if self._log_level <= LogLevel.WARNING:
-            self.tests[self.currentSubtest].stdout += args[0] + os.linesep
+            self.testsuite.stdout += args[0] + os.linesep
+            if self.currentSubtest:
+                self.tests[self.currentSubtest].stdout += args[0] + os.linesep
 
     def error(self, *args, **kwargs) -> None:
-        self.tests[self.currentSubtest].stderr += args[0] + os.linesep
-        self.tests[self.currentSubtest].failure = True
+        self.testsuite.stderr += args[0] + os.linesep
+        self.testsuite.failure = True
+        if self.currentSubtest:
+            self.tests[self.currentSubtest].stderr += args[0] + os.linesep
+            self.tests[self.currentSubtest].failure = True
 
     def log_test_error(self, *args, **kwargs) -> None:
         self.error(*args, **kwargs)
@@ -141,6 +151,9 @@ class JunitXMLLogger(AbstractLogger):
     def close(self) -> None:
         with open(self.outfile, "w") as f:
             test_cases = []
+            if len(self.tests) == 0:
+                self.tests.setdefault("main", self.TestCaseState())
+                self.tests["main"].failure = self.testsuite.failure
             for name, test_case_state in self.tests.items():
                 tc = TestCase(
                     name,
@@ -151,7 +164,12 @@ class JunitXMLLogger(AbstractLogger):
                     tc.add_failure_info("test case failed")
 
                 test_cases.append(tc)
-            ts = TestSuite("NixOS integration test", test_cases)
+            ts = TestSuite(
+                "NixOS integration test",
+                test_cases,
+                stdout=self.testsuite.stdout,
+                stderr=self.testsuite.stderr,
+            )
             f.write(TestSuite.to_xml_string([ts]))
 
 

nixos/modules/image/repart-image.nix

@@ -109,6 +109,7 @@ let
     "btrfs" = [ btrfs-progs ];
     "xfs" = [ xfsprogs ];
     "swap" = [ util-linux ];
+    "empty" = [ ];
   };
 
   fileSystemTools = builtins.concatMap (f: fileSystemToolMapping."${f}") fileSystems;

nixos/modules/profiles/bashless.nix

@@ -31,8 +31,6 @@
   # Relies on bash scripts
   powerManagement.enable = lib.mkDefault false;
   users.manageLingering = lib.mkDefault false;
-  # Relies on the gzip command which depends on bash
-  services.logrotate.enable = lib.mkDefault false;
   # The resize helper pulls in bash
   services.lvm.resizeHelper.enable = false;
 

nixos/modules/programs/wayland/sway.nix

@@ -204,5 +204,5 @@ in
     ]
   );
 
-  meta.maintainers = with lib.maintainers; [ yvnth ];
+  meta.maintainers = [ ];
 }

nixos/modules/security/pam.nix

@@ -1252,7 +1252,7 @@ let
                       name = "fscrypt";
                       enable = config.security.pam.enableFscrypt;
                       control = "optional";
-                      modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so";
+                      modulePath = "${pkgs.fscrypt}/lib/security/pam_fscrypt.so";
                     }
                     {
                       name = "zfs_key";
@@ -1449,7 +1449,7 @@ let
                 name = "fscrypt";
                 enable = config.security.pam.enableFscrypt;
                 control = "optional";
-                modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so";
+                modulePath = "${pkgs.fscrypt}/lib/security/pam_fscrypt.so";
               }
               {
                 name = "zfs_key";
@@ -1610,7 +1610,7 @@ let
                 name = "fscrypt";
                 enable = config.security.pam.enableFscrypt;
                 control = "optional";
-                modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so";
+                modulePath = "${pkgs.fscrypt}/lib/security/pam_fscrypt.so";
               }
               {
                 name = "zfs_key-skip-systemd";
@@ -2663,7 +2663,7 @@ in
       ++ lib.optionals config.security.pam.enableOTPW [ pkgs.otpw ]
       ++ lib.optionals config.security.pam.oath.enable [ pkgs.oath-toolkit ]
       ++ lib.optionals config.security.pam.p11.enable [ pkgs.pam_p11 ]
-      ++ lib.optionals config.security.pam.enableFscrypt [ pkgs.fscrypt-experimental ]
+      ++ lib.optionals config.security.pam.enableFscrypt [ pkgs.fscrypt ]
       ++ lib.optionals config.security.pam.u2f.enable [ pkgs.pam_u2f ];
 
     security.wrappers = {

nixos/modules/security/polkit.nix

@@ -151,6 +151,17 @@ in
         # ~/.config/Yubico/u2f_keys (the default key file location)
         ProtectHome = "read-only";
       })
+      (mkIf config.security.pam.yubico.enable {
+        # Override upstream PrivateDevices=yes to allow access to /dev/hidraw*
+        PrivateDevices = false;
+        DeviceAllow = [ "char-hidraw rw" ];
+      })
+      (mkIf config.services.fprintd.enable {
+        # Override upstream PrivateDevices=yes to allow access to /dev/bus/usb/**
+        PrivateDevices = false;
+        DeviceAllow = [ "char-usb_device rw" ];
+        RestrictAddressFamilies = [ "AF_NETLINK" ];
+      })
       (mkIf config.security.pam.zfs.enable {
         PrivateDevices = false;
         DeviceAllow = [

nixos/modules/services/audio/mpd.nix

@@ -84,7 +84,6 @@ let
           }
         }
       '';
-      __structuredAttrs = true;
     };
     checkPhase = ''
       printf "%s" "$expectScript" | ${lib.getExe pkgs.buildPackages.expect} -f -

nixos/modules/services/backup/syncoid.nix

@@ -362,7 +362,6 @@ in
           {
             description = "Syncoid ZFS synchronization from ${c.source} to ${c.target}";
             after = [ "zfs.target" ];
-            startAt = cfg.interval;
             # syncoid may need zpool to get feature@extensible_dataset
             path = [ "/run/booted-system/sw/bin/" ];
             serviceConfig = {
@@ -473,6 +472,23 @@ in
         ]
       )
     ) cfg.commands;
+
+    systemd.timers = lib.concatMapAttrs (
+      name: c:
+      lib.optionalAttrs
+        (config.systemd.services."syncoid-${escapeUnitName name}".enable && cfg.interval != [ ])
+        {
+          "syncoid-${escapeUnitName name}" = {
+            wantedBy = [ "timers.target" ];
+            timerConfig = {
+              OnCalendar = cfg.interval;
+              # Backup timers should catch up on missed windows (e.g. the
+              # machine was powered off), like restic and btrbk do.
+              Persistent = true;
+            };
+          };
+        }
+    ) cfg.commands;
   };
 
   meta.maintainers = with lib.maintainers; [

nixos/modules/services/cluster/hadoop/hbase.nix

@@ -167,7 +167,7 @@ in
       zookeeperQuorum = lib.mkOption {
         description = ''
           This option will set "hbase.zookeeper.quorum" in hbase-site.xml.
-          Comma separated list of servers in the ZooKeeper ensemble.
+          Comma-separated list of servers in the ZooKeeper ensemble.
         '';
         type = with lib.types; nullOr commas;
         example = "zk1.internal,zk2.internal,zk3.internal";

nixos/modules/services/databases/neo4j.nix

@@ -13,6 +13,7 @@ let
     opt: lib.isOption opt && opt.type == lib.types.path && opt.highestPrio >= 1500;
 
   sslPolicies = lib.mapAttrsToList (name: conf: ''
+    dbms.ssl.policy.${name}.enabled=${lib.boolToString conf.enable}
     dbms.ssl.policy.${name}.allow_key_generation=${lib.boolToString conf.allowKeyGeneration}
     dbms.ssl.policy.${name}.base_directory=${conf.baseDirectory}
     ${lib.optionalString (conf.ciphers != null) ''
@@ -35,7 +36,7 @@ let
     dbms.ssl.policy.${name}.tls_versions=${lib.concatStringsSep "," conf.tlsVersions}
     dbms.ssl.policy.${name}.trust_all=${lib.boolToString conf.trustAll}
     dbms.ssl.policy.${name}.trusted_dir=${conf.trustedDir}
-  '') cfg.ssl.policies;
+  '') (lib.filterAttrs (_: v: v.enable) cfg.ssl.policies);
 
   serverConfig = pkgs.writeText "neo4j.conf" ''
     # General
@@ -467,6 +468,8 @@ in
             }:
             {
               options = {
+                enable = lib.mkEnableOption "this policy";
+
                 allowKeyGeneration = lib.mkOption {
                   type = lib.types.bool;
                   default = false;
@@ -714,6 +717,6 @@ in
     };
 
   meta = {
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.c2fc2f ];
   };
 }

nixos/modules/services/hardware/udev.nix

@@ -10,13 +10,6 @@ let
 
   cfg = config.services.udev;
 
-  initrdUdevRules = pkgs.runCommand "initrd-udev-rules" { } ''
-    mkdir -p $out/etc/udev/rules.d
-    for f in 60-cdrom_id 60-persistent-storage 75-net-description 80-drivers 80-net-setup-link; do
-      ln -s ${config.boot.initrd.systemd.package}/lib/udev/rules.d/$f.rules $out/etc/udev/rules.d
-    done
-  '';
-
   extraUdevRules = pkgs.writeTextFile {
     name = "extra-udev-rules";
     text = cfg.extraRules;
@@ -59,8 +52,11 @@ let
         nativeBuildInputs = [
           # We only include the out output here to avoid needing to include all
           # other outputs in the installer tests as well
-          # We only need the udevadm command anyway
-          pkgs.buildPackages.systemdMinimal.out
+          # We only need the udevadm command anyway.
+          #
+          # We cannot use systemdMinimal here because it doesn't contain all
+          # the udev builtins, most notably uacess.
+          pkgs.buildPackages.systemd.out
         ];
       }
       ''
@@ -74,7 +70,7 @@ let
         # Add the udev rules from other packages.
         for i in $packages; do
           echo "Adding rules for package $i"
-          for j in $i/{etc,lib}/udev/rules.d/*; do
+          for j in $i/{etc,lib}/udev/rules.d/*.rules; do
             echo "Copying $j to $out/$(basename $j)"
             cat $j > $out/$(basename $j)
           done
@@ -101,7 +97,9 @@ let
         run_progs=$(grep -v '^[[:space:]]*#' $out/* | grep 'RUN+="[^/$]' |
           sed -e 's/.*RUN+="\([^ "]*\)[ "].*/\1/' | uniq)
         for i in $import_progs $run_progs; do
-          if [[ ! -x ${udev}/lib/udev/$i && ! $i =~ socket:.* ]]; then
+          # Remove the check for tpm2_id when systemd v262 lands where this is
+          # correctly identified as a builtin.
+          if [[ ! -x ${udev}/lib/udev/$i && ! $i =~ socket:.* && ! $i == tpm2_id ]]; then
             echo "FAIL"
             echo "$i is called in udev rules but not installed by udev"
             exit 1
@@ -154,10 +152,15 @@ let
           exit 1
         fi
 
-        # Verify all the udev rules
-        echo "Verifying udev rules using udevadm verify..."
-        udevadm verify --resolve-names=late --no-style $out
-        echo "OK"
+        # Only run these checks if the systemd used to check is at least as new
+        # as the one configured to run on the system. This is necessary to be
+        # able to test newer systemd versions.
+        ${lib.optionalString (lib.versionAtLeast pkgs.buildPackages.systemdMinimal.version systemd.version) ''
+          # Verify all the udev rules
+          echo "Verifying udev rules using udevadm verify..."
+          udevadm verify --resolve-names=late --no-style $out
+          echo "OK"
+        ''}
 
         # If auto-configuration is disabled, then remove
         # udev's 80-drivers.rules file, which contains rules for
@@ -426,6 +429,7 @@ in
     services.udev.extraRules = nixosRules;
 
     services.udev.packages = [
+      config.systemd.package
       extraUdevRules
       extraHwdbFile
     ];
@@ -490,7 +494,7 @@ in
     };
     # Insert initrd rules
     boot.initrd.services.udev.packages = [
-      initrdUdevRules
+      config.boot.initrd.systemd.package
       (lib.mkIf (config.boot.initrd.services.udev.rules != "") (
         pkgs.writeTextFile {
           name = "initrd-udev-rules";

nixos/modules/services/logging/logrotate.nix

@@ -141,6 +141,11 @@ in
       "logrotate"
       "paths"
     ] "Add attributes to services.logrotate.settings instead")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "logrotate"
+      "configFile"
+    ] "Use services.logrotate.settings instead to specify extra configuration")
   ];
 
   options = {
@@ -255,27 +260,6 @@ in
         );
       };
 
-      configFile = lib.mkOption {
-        type = lib.types.path;
-        default = configFile;
-        defaultText = ''
-          A configuration file automatically generated by NixOS.
-        '';
-        description = ''
-          Override the configuration file used by logrotate. By default,
-          NixOS generates one automatically from [](#opt-services.logrotate.settings).
-        '';
-        example = lib.literalExpression ''
-          pkgs.writeText "logrotate.conf" '''
-            missingok
-            "/var/log/*.log" {
-              rotate 4
-              weekly
-            }
-          ''';
-        '';
-      };
-
       checkConfig = lib.mkOption {
         type = lib.types.bool;
         default = true;
@@ -306,6 +290,18 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    # logrotate config has an include directive. As such, always generate the built-in config
+    # in case it is useful to the user.
+    # Users could choose to disable it with environment.etc."logrotate.conf".enable = false;
+    environment.etc."logrotate.conf" = {
+      source = configFile;
+      # logrotate mandates that its config is always owned by root.
+      # Copy into /etc to avoid user namespacing issues.
+      mode = "0644";
+      user = "root";
+      group = "root";
+    };
+
     systemd.services.logrotate = {
       description = "Logrotate Service";
       documentation = [
@@ -316,7 +312,7 @@ in
 
       serviceConfig = {
         Type = "oneshot";
-        ExecStart = "${lib.getExe pkgs.logrotate} ${utils.escapeSystemdExecArgs cfg.extraArgs} ${mailOption} ${cfg.configFile}";
+        ExecStart = "${lib.getExe pkgs.logrotate} ${utils.escapeSystemdExecArgs cfg.extraArgs} ${mailOption} /etc/logrotate.conf";
 
         # performance
         Nice = 19;
@@ -370,7 +366,7 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
-        ExecStart = "${pkgs.logrotate}/sbin/logrotate ${utils.escapeSystemdExecArgs cfg.extraArgs} --debug ${cfg.configFile}";
+        ExecStart = "${pkgs.logrotate}/sbin/logrotate ${utils.escapeSystemdExecArgs cfg.extraArgs} --debug /etc/logrotate.conf";
       };
     };
   };

nixos/modules/services/misc/klipper.nix

@@ -298,7 +298,7 @@ in
           popd
         '';
 
-        restartTriggers = lib.optional (!cfg.mutableConfig) [ printerConfig ];
+        restartTriggers = lib.optionals (!cfg.mutableConfig) [ printerConfig ];
 
         serviceConfig = {
           ExecStart = "${cfg.package}/bin/klippy ${klippyArgs} ${cfg.configDir}/printer.cfg";

nixos/modules/services/misc/pinchflat.nix

@@ -16,6 +16,7 @@ let
     getExe
     literalExpression
     optional
+    optionals
     attrValues
     mapAttrs
     ;
@@ -158,7 +159,7 @@ in
           "LOG_LEVEL=${cfg.logLevel}"
           "PHX_SERVER=true"
         ]
-        ++ optional cfg.selfhosted [ "RUN_CONTEXT=selfhosted" ]
+        ++ optionals cfg.selfhosted [ "RUN_CONTEXT=selfhosted" ]
         ++ optional (!isNull config.time.timeZone) "TZ=${config.time.timeZone}"
         ++ attrValues (mapAttrs (name: value: name + "=" + toString value) cfg.extraConfig);
         EnvironmentFile = optional (cfg.secretsFile != null) cfg.secretsFile;

nixos/modules/services/monitoring/prometheus/exporters/restic.nix

@@ -16,7 +16,7 @@ let
     mapAttrs'
     splitString
     toUpper
-    optional
+    optionals
     optionalAttrs
     nameValuePair
     ;
@@ -145,7 +145,7 @@ in
       LoadCredential = [
         "RESTIC_PASSWORD_FILE:${cfg.passwordFile}"
       ]
-      ++ optional (cfg.repositoryFile != null) [ "RESTIC_REPOSITORY:${cfg.repositoryFile}" ];
+      ++ optionals (cfg.repositoryFile != null) [ "RESTIC_REPOSITORY:${cfg.repositoryFile}" ];
     };
     environment =
       let

nixos/modules/services/monitoring/vmagent.nix

@@ -152,7 +152,7 @@ in
           startCLIList
           ++ lib.optionals (cfg.prometheusConfig != { }) [ "-promscrape.config=${prometheusConfigYml}" ]
         );
-        LoadCredential = lib.optional (cfg.remoteWrite.basicAuthPasswordFile != null) [
+        LoadCredential = lib.optionals (cfg.remoteWrite.basicAuthPasswordFile != null) [
           "remote_write_basic_auth_password:${cfg.remoteWrite.basicAuthPasswordFile}"
         ];
       };

nixos/modules/services/networking/firewall.nix

@@ -205,8 +205,8 @@ in
             "loose"
           ]
         );
-        default = true;
-        defaultText = lib.literalMD "`true` except if the iptables based firewall is in use and the kernel lacks rpfilter support";
+        default = "loose";
+        defaultText = "loose";
         example = "loose";
         description = ''
           Performs a reverse path filter test on a packet.  If a reply

nixos/modules/services/networking/netfoil.nix

@@ -254,6 +254,7 @@ in
           wantedBy = [ "sockets.target" ];
           socketConfig = {
             ListenDatagram = "${cfg.listen.ipAddress}:${toString cfg.listen.port}";
+            ListenStream = "${cfg.listen.ipAddress}:${toString cfg.listen.port}";
             Service = "netfoil.service";
           };
         };

nixos/modules/services/networking/pihole-ftl.nix

@@ -503,9 +503,32 @@ in
 
     environment.systemPackages = [ cfg.pihole ];
 
-    services.logrotate.settings.pihole-ftl = {
-      enable = true;
-      files = [ "${cfg.logDirectory}/FTL.log" ];
+    services.logrotate.settings = {
+      pihole-dnsmasq = {
+        files = [ "${cfg.logDirectory}/pihole.log" ];
+        frequency = "daily";
+        create = "640 ${cfg.user} ${cfg.group}";
+        rotate = 5;
+        compress = true;
+        delaycompress = true;
+        # FTL keeps this log open; SIGUSR2 closes and reopens it after rotation.
+        # https://docs.pi-hole.net/ftldns/signals/#sigusr2
+        postrotate = ''
+          ${getExe' pkgs.systemd "systemctl"} kill --kill-whom=main --signal=USR2 pihole-ftl.service 2>/dev/null || true
+        '';
+      };
+
+      pihole-ftl = {
+        files = [
+          "${cfg.logDirectory}/FTL.log"
+          "${cfg.logDirectory}/webserver.log"
+        ];
+        frequency = "weekly";
+        create = "640 ${cfg.user} ${cfg.group}";
+        rotate = 3;
+        compress = true;
+        delaycompress = true;
+      };
     };
   };
 

nixos/modules/services/networking/supplicant.nix

@@ -226,7 +226,7 @@ in
         The value of this option is an attribute set. Each attribute configures a
         {command}`wpa_supplicant` service, where the attribute name specifies
         the name of the interface that {command}`wpa_supplicant` operates on.
-        The attribute name can be a space separated list of interfaces.
+        The attribute name can be a space-separated list of interfaces.
         The attribute names `WLAN`, `LAN` and `DBUS`
         have a special meaning. `WLAN` and `LAN` are
         configurations for universal {command}`wpa_supplicant` service that is

nixos/modules/services/networking/vsftpd.nix

@@ -168,7 +168,7 @@ in
         default = pkgs.writeText "userlist" (concatMapStrings (x: "${x}\n") cfg.userlist);
         defaultText = literalExpression ''pkgs.writeText "userlist" (concatMapStrings (x: "''${x}\n") cfg.userlist)'';
         description = ''
-          Newline separated list of names to be allowed/denied if {option}`userlistEnable`
+          Newline-separated list of names to be allowed/denied if {option}`userlistEnable`
           is `true`. Meaning see {option}`userlistDeny`.
 
           The default is a file containing the users from {option}`userlist`.

nixos/modules/services/web-apps/grav.nix

@@ -40,7 +40,21 @@ in
   options.services.grav = {
     enable = mkEnableOption "grav";
 
-    package = mkPackageOption pkgs "grav" { };
+    package =
+      let
+        stateVersionAtLeast = lib.versionAtLeast config.system.stateVersion;
+      in
+      mkPackageOption pkgs "grav" {
+        default = if stateVersionAtLeast "26.11" then "grav_2" else "grav";
+      }
+      // {
+        defaultText = lib.literalExpression ''
+          if versionAtLeast config.system.stateVersion "26.11" then
+            pkgs.grav_2
+          else
+            pkgs.grav
+        '';
+      };
 
     root = mkOption {
       type = types.path;

nixos/modules/services/web-servers/garage.nix

@@ -133,7 +133,7 @@ in
             # if data_dir is a list, the actual path will in in the `path` attribute of each item
             # see https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/#data_dir
             ++ lib.optional (lib.isList data_dir) (map (item: item.path) data_dir)
-            ++ lib.optional (lib.isString data_dir) [ data_dir ]
+            ++ lib.optionals (lib.isString data_dir) [ data_dir ]
           );
           isDefault = lib.hasPrefix "/var/lib/garage";
           isDefaultStateDirectory = lib.any isDefault paths;

nixos/modules/services/web-servers/nginx/default.nix

@@ -195,6 +195,11 @@ let
         error_log ${cfg.logError};
         daemon off;
 
+        # load_module is a main-context directive that must precede events{}/http{}.
+        ${optionalString (
+          (cfg.package.dynamicModules or [ ]) != [ ]
+        ) "include ${cfg.package}/etc/nginx/dynamic-modules.conf;"}
+
         ${optionalString cfg.enableQuicBPF ''
           quic_bpf on;
         ''}
@@ -1642,7 +1647,7 @@ in
           SystemCallFilter = [
             "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid"
           ]
-          ++ optional cfg.enableQuicBPF [ "bpf" ];
+          ++ optionals cfg.enableQuicBPF [ "bpf" ];
         };
       };
 

nixos/modules/services/web-servers/stargazer.nix

@@ -271,7 +271,7 @@ in
           "~CAP_SYS_BOOT"
           "~CAP_NET_ADMIN"
         ]
-        ++ lib.lists.optional (!cfg.allowCgiUser) [
+        ++ lib.lists.optionals (!cfg.allowCgiUser) [
           "~CAP_SETGID"
           "~CAP_SETUID"
         ];
@@ -279,7 +279,7 @@ in
         SystemCallFilter = [
           "~@cpu-emulation @debug @keyring @mount @obsolete"
         ]
-        ++ lib.lists.optional (!cfg.allowCgiUser) [ "@privileged @setuid" ];
+        ++ lib.lists.optionals (!cfg.allowCgiUser) [ "@privileged @setuid" ];
       };
     };
 

nixos/modules/system/boot/kernel_config.nix

@@ -70,9 +70,7 @@ let
         ];
 
     in
-    if (val == "") then
-      "\"\""
-    else if val == "y" || val == "m" || val == "n" then
+    if val == "y" || val == "m" || val == "n" then
       val
     else if all isNumber (stringToCharacters val) then
       val
@@ -87,6 +85,9 @@ let
   #       VIRTIO_BLK y
   #       VIRTIO_CONSOLE n
   #       NET_9P_VIRTIO? y
+  #       LOCALVERSION
+  #
+  # A line without a value means an empty string.
   #
   # Borrowed from copumpkin https://github.com/NixOS/nixpkgs/pull/12158
   # returns a string, expr should be an attribute set
@@ -100,9 +101,8 @@ let
         let
           val = if item.freeform != null then item.freeform else item.tristate;
         in
-        optionalString (val != null) (
-          if (item.optional) then "${key}? ${mkValue val}\n" else "${key} ${mkValue val}\n"
-        );
+        optionalString (val != null)
+          "${key}${optionalString item.optional "?"}${optionalString (val != "") " ${mkValue val}"}\n";
 
       mkConf = cfg: concatStrings (mapAttrsToList mkConfigLine cfg);
     in
@@ -119,6 +119,7 @@ in
       example = ''
         USB? y
         DEBUG n
+        LOCALVERSION
       '';
       description = ''
         The result of converting the structured kernel configuration in settings

nixos/modules/system/boot/loader/limine/limine.nix

@@ -360,7 +360,7 @@ in
           default = null;
           type = lib.types.nullOr lib.types.str;
           description = ''
-            A ; seperated array of 8 colors in the format RRGGBB:
+            A semicolon-separated array of 8 colors in the format RRGGBB:
             black, red, green, brown, blue, magenta, cyan, and gray.
           '';
         };
@@ -369,7 +369,7 @@ in
           default = null;
           type = lib.types.nullOr lib.types.str;
           description = ''
-            A ; seperated array of 8 colors in the format RRGGBB:
+            A semicolon-separated array of 8 colors in the format RRGGBB:
             dark gray, bright red, bright green, yellow, bright blue, bright magenta, bright cyan, and white.
           '';
         };

nixos/modules/virtualisation/nixos-containers.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  options,
   pkgs,
   utils,
   ...
@@ -201,8 +202,12 @@ let
       --notify-ready=yes \
       --kill-signal=SIGRTMIN+3 \
       --bind-ro=/nix/store:/nix/store$NIX_BIND_OPT \
-      --bind-ro=/nix/var/nix/db:/nix/var/nix/db$NIX_BIND_OPT \
-      --bind-ro=/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket$NIX_BIND_OPT \
+      ${optionalString config.nix.enable "--bind-ro=/nix/var/nix/db:/nix/var/nix/db$NIX_BIND_OPT"} \
+      ${
+        optionalString (
+          config.nix.enable && config.nix.daemon.enable
+        ) "--bind-ro=/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket$NIX_BIND_OPT"
+      } \
       --bind="/nix/var/nix/profiles/per-container/$INSTANCE:/nix/var/nix/profiles$NIX_BIND_OPT" \
       --bind="/nix/var/nix/gcroots/per-container/$INSTANCE:/nix/var/nix/gcroots$NIX_BIND_OPT" \
       ${optionalString (!cfg.ephemeral) "--link-journal=try-guest"} \
@@ -994,7 +999,10 @@ in
           mapper =
             name: cfg:
             optional (cfg.networkNamespace != null && (cfg.privateNetwork || cfg.interfaces != [ ]))
-              "containers.${name}.networkNamespace is mutally exclusive to containers.${name}.privateNetwork and containers.${name}.interfaces.";
+              "containers.${name}.networkNamespace is mutally exclusive to containers.${name}.privateNetwork and containers.${name}.interfaces."
+            ++
+              optional (cfg.config.nix.enable && cfg.config.nix.daemon.enable && !config.nix.daemon.enable)
+                "${options.containers}.${strings.escapeNixIdentifier name} requires a Nix daemon but the host does not provided it, as option ${options.nix.daemon.enable} is disabled";
         in
         mkMerge (mapAttrsToList mapper config.containers);
     }

nixos/modules/virtualisation/openvswitch.nix

@@ -80,6 +80,7 @@ in
         wantedBy = [ "multi-user.target" ];
         requires = [ "ovsdb.socket" ];
         after = [ "ovsdb.socket" ];
+        wants = [ "ovs-delete-transient-ports.service" ];
         path = [ cfg.package ];
         restartTriggers = [
           db
@@ -129,6 +130,19 @@ in
         '';
       };
 
+      systemd.services.ovs-delete-transient-ports = {
+        description = "Open vSwitch Delete Transient Ports";
+        after = [ "ovsdb.service" ];
+        before = [ "ovs-vswitchd.service" ];
+        path = [ cfg.package ];
+        unitConfig.AssertPathExists = "${runDir}/db.sock";
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStart = "${cfg.package}/share/openvswitch/scripts/ovs-ctl delete-transient-ports";
+        };
+      };
+
       systemd.services.ovs-vswitchd = {
         description = "Open_vSwitch Daemon";
         wantedBy = [ "multi-user.target" ];

nixos/modules/virtualisation/qemu-vm.nix

@@ -324,6 +324,24 @@ let
         ''
     )}
 
+    echo "Starting virtiofs daemons..."
+    NIX_VIRTIOFS_DIR=$(mktemp -d)
+    ${lib.concatLines (
+      lib.mapAttrsToList (tag: share: ''
+        ${lib.getExe hostPkgs.virtiofsd} \
+          --socket-path="$NIX_VIRTIOFS_DIR"/"${tag}" \
+          --shared-dir="${share.source}" \
+          ${if share.writable then "--writeback" else "--readonly"} \
+          --sandbox=none \
+          --seccomp=none \
+          --cache=always \
+          --no-announce-submounts \
+          --translate-uid=host:65534:0:1 \
+          --translate-gid=host:65534:0:1 \
+          &
+      '') cfg.sharedDirectories
+    )}
+
     # Start QEMU.
     exec ${
       qemu-common.qemuBinaryWith {
@@ -336,14 +354,6 @@ let
         -smp ${toString config.virtualisation.cores} \
         -device virtio-rng-pci \
         ${concatStringsSep " " config.virtualisation.qemu.networkingOptions} \
-        ${
-          concatStringsSep " \\\n    " (
-            mapAttrsToList (
-              tag: share:
-              "-virtfs local,path=${share.source},security_model=${share.securityModel},mount_tag=${tag}"
-            ) config.virtualisation.sharedDirectories
-          )
-        } \
         ${drivesCmdLine config.virtualisation.qemu.drives} \
         ${concatStringsSep " \\\n    " config.virtualisation.qemu.options} \
         $QEMU_OPTS \
@@ -424,6 +434,14 @@ in
       "virtualisation"
       "useSecureBoot"
     ] "The default OVMF now always supports Secure Boot.")
+    (mkRemovedOptionModule [
+      "virtualisation"
+      "msize"
+    ] "9p was replaced with virtiofs and thus this option is obsolete.")
+    (mkRemovedOptionModule [
+      "virtualisation"
+      "nixStore9pCache"
+    ] "9p was replaced with virtiofs and thus this option is obsolete.")
   ];
 
   options = {
@@ -438,16 +456,6 @@ in
       '';
     };
 
-    virtualisation.msize = mkOption {
-      type = types.ints.positive;
-      default = 16384;
-      description = ''
-        The msize (maximum packet size) option passed to 9p file systems, in
-        bytes. Increasing this should increase performance significantly,
-        at the cost of higher RAM usage.
-      '';
-    };
-
     virtualisation.diskImage = mkOption {
       type = types.nullOr types.str;
       default = "./${config.system.name}.qcow2";
@@ -570,22 +578,8 @@ in
             type = types.path;
             description = "The mount point of the directory inside the virtual machine";
           };
-          options.securityModel = mkOption {
-            type = types.enum [
-              "passthrough"
-              "mapped-xattr"
-              "mapped-file"
-              "none"
-            ];
-            default = "mapped-xattr";
-            description = ''
-              The security model to use for this share:
-
-              - `passthrough`: files are stored using the same credentials as they are created on the guest (this requires QEMU to run as root)
-              - `mapped-xattr`: some of the file attributes like uid, gid, mode bits and link target are stored as file attributes
-              - `mapped-file`: the attributes are stored in the hidden .virtfs_metadata directory. Directories exported by this security model cannot interact with other unix tools
-              - `none`: same as "passthrough" except the sever won't report failures if it fails to set file attributes like ownership
-            '';
+          options.writable = lib.mkEnableOption "" // {
+            description = "Whether the directory is writable on the host and guest.";
           };
         }
       );
@@ -610,11 +604,10 @@ in
         A list of paths whose closure should be made available to
         the VM.
 
-        When 9p is used, the closure is registered in the Nix
-        database in the VM. All other paths in the host Nix store
-        appear in the guest Nix store as well, but are considered
-        garbage (because they are not registered in the Nix
-        database of the guest).
+        When the Nix store is mounted from the host, the closure is registered
+        in the Nix database in the VM. All other paths in the host Nix store
+        appear in the guest Nix store as well, but are considered garbage
+        (because they are not registered in the Nix database of the guest).
 
         When {option}`virtualisation.useNixStoreImage` is
         set, the closure is copied to the Nix store image.
@@ -867,7 +860,7 @@ in
       default = false;
       description = ''
         Build and use a disk image for the Nix store, instead of
-        accessing the host's one through 9p.
+        accessing the host's one.
 
         For applications which do a lot of reads from the store,
         this can drastically improve performance, but at the cost of
@@ -889,24 +882,7 @@ in
       default = !cfg.useNixStoreImage && !cfg.useBootLoader;
       defaultText = literalExpression "!cfg.useNixStoreImage && !cfg.useBootLoader";
       description = ''
-        Mount the host Nix store as a 9p mount.
-      '';
-    };
-
-    virtualisation.nixStore9pCache = mkOption {
-      type = types.enum [
-        "loose"
-        "none"
-        "fscache"
-      ];
-      default = "loose";
-      description = ''
-        Type of 9p cache to use when mounting host nix store. "none" provides
-        no caching. "loose" enables Linux's local VFS cache. "fscache" uses Linux's
-        fscache subsystem.
-
-        This option is only respected when {option}`virtualisation.mountHostNixStore`
-        is enabled.
+        Mount the host Nix store via a virtual filesystem.
       '';
     };
 
@@ -1242,22 +1218,20 @@ in
         # Always mount this to /nix/.ro-store because we never want to actually
         # write to the host Nix Store.
         target = "/nix/.ro-store";
-        securityModel = "none";
       };
       xchg = {
         source = ''"$TMPDIR"/xchg'';
-        securityModel = "none";
         target = "/tmp/xchg";
+        writable = true;
       };
       shared = {
         source = ''"''${SHARED_DIR:-$TMPDIR/xchg}"'';
         target = "/tmp/shared";
-        securityModel = "none";
+        writable = true;
       };
       certs = mkIf cfg.useHostCerts {
         source = ''"$TMPDIR"/certs'';
         target = "/etc/ssl/certs";
-        securityModel = "none";
       };
     };
 
@@ -1303,6 +1277,12 @@ in
         "-object memory-backend-memfd,id=mem0,size=${toString config.virtualisation.memorySize}M,share=on"
         "-machine memory-backend=mem0"
       ])
+      (lib.flatten (
+        lib.mapAttrsToList (tag: share: [
+          "-chardev socket,id=${tag},path=$NIX_VIRTIOFS_DIR/${tag}"
+          "-device vhost-user-fs-pci,chardev=${tag},tag=${tag}"
+        ]) cfg.sharedDirectories
+      ))
       (
         let
           alphaNumericChars = lowerChars ++ upperChars ++ (map toString (range 0 9));
@@ -1388,86 +1368,78 @@ in
 
     virtualisation.diskSizeAutoSupported = false;
 
-    virtualisation.fileSystems =
-      let
-        mkSharedDir = tag: share: {
-          name = share.target;
-          value.device = tag;
-          value.fsType = "9p";
-          value.neededForBoot = true;
-          value.options = [
-            "trans=virtio"
-            "version=9p2000.L"
-            "msize=${toString cfg.msize}"
-            "x-systemd.requires=modprobe@9pnet_virtio.service"
-          ]
-          ++ lib.optional (tag == "nix-store") "cache=${cfg.nixStore9pCache}";
+    virtualisation.fileSystems = lib.mkMerge [
+      (lib.mapAttrs' (tag: share: {
+        name = share.target;
+        value = {
+          device = tag;
+          fsType = "virtiofs";
+          neededForBoot = true;
+          options = lib.mkIf (!share.writable) [ "ro" ];
         };
-      in
-      lib.mkMerge [
-        (lib.mapAttrs' mkSharedDir cfg.sharedDirectories)
-        {
-          "/" = lib.mkIf cfg.useDefaultFilesystems (
-            if cfg.diskImage == null then
-              {
-                device = "tmpfs";
-                fsType = "tmpfs";
-                options = [ "mode=755" ];
-              }
-            else
-              {
-                device = cfg.rootDevice;
-                fsType = "ext4";
-              }
-          );
-          "/tmp" = lib.mkIf config.boot.tmp.useTmpfs {
-            device = "tmpfs";
-            fsType = "tmpfs";
-            neededForBoot = true;
-            # Sync with systemd's tmp.mount;
-            options = [
-              "mode=1777"
-              "strictatime"
-              "nosuid"
-              "nodev"
-              "size=${toString config.boot.tmp.tmpfsSize}"
-            ];
-          };
-          "/nix/store" = lib.mkIf (cfg.useNixStoreImage || cfg.mountHostNixStore) (
-            if cfg.writableStore then
-              {
-                overlay = {
-                  lowerdir = [ "/nix/.ro-store" ];
-                  upperdir = "/nix/.rw-store/upper";
-                  workdir = "/nix/.rw-store/work";
-                };
-              }
-            else
-              {
-                device = "/nix/.ro-store";
-                fsType = "none";
-                options = [ "bind" ];
-              }
-          );
-          "/nix/.ro-store" = lib.mkIf cfg.useNixStoreImage {
-            device = "/dev/disk/by-label/${nixStoreFilesystemLabel}";
-            fsType = "erofs";
-            neededForBoot = true;
-            options = [ "ro" ];
-          };
-          "/nix/.rw-store" = lib.mkIf (cfg.writableStore && cfg.writableStoreUseTmpfs) {
-            fsType = "tmpfs";
-            options = [ "mode=0755" ];
-            neededForBoot = true;
-          };
-          "${config.boot.loader.efi.efiSysMountPoint}" =
-            lib.mkIf (cfg.useBootLoader && cfg.bootPartition != null)
-              {
-                device = cfg.bootPartition;
-                fsType = "vfat";
+      }) cfg.sharedDirectories)
+      {
+        "/" = lib.mkIf cfg.useDefaultFilesystems (
+          if cfg.diskImage == null then
+            {
+              device = "tmpfs";
+              fsType = "tmpfs";
+              options = [ "mode=755" ];
+            }
+          else
+            {
+              device = cfg.rootDevice;
+              fsType = "ext4";
+            }
+        );
+        "/tmp" = lib.mkIf config.boot.tmp.useTmpfs {
+          device = "tmpfs";
+          fsType = "tmpfs";
+          neededForBoot = true;
+          # Sync with systemd's tmp.mount;
+          options = [
+            "mode=1777"
+            "strictatime"
+            "nosuid"
+            "nodev"
+            "size=${toString config.boot.tmp.tmpfsSize}"
+          ];
+        };
+        "/nix/store" = lib.mkIf (cfg.useNixStoreImage || cfg.mountHostNixStore) (
+          if cfg.writableStore then
+            {
+              overlay = {
+                lowerdir = [ "/nix/.ro-store" ];
+                upperdir = "/nix/.rw-store/upper";
+                workdir = "/nix/.rw-store/work";
               };
-        }
-      ];
+            }
+          else
+            {
+              device = "/nix/.ro-store";
+              fsType = "none";
+              options = [ "bind" ];
+            }
+        );
+        "/nix/.ro-store" = lib.mkIf cfg.useNixStoreImage {
+          device = "/dev/disk/by-label/${nixStoreFilesystemLabel}";
+          fsType = "erofs";
+          neededForBoot = true;
+          options = [ "ro" ];
+        };
+        "/nix/.rw-store" = lib.mkIf (cfg.writableStore && cfg.writableStoreUseTmpfs) {
+          fsType = "tmpfs";
+          options = [ "mode=0755" ];
+          neededForBoot = true;
+        };
+        "${config.boot.loader.efi.efiSysMountPoint}" =
+          lib.mkIf (cfg.useBootLoader && cfg.bootPartition != null)
+            {
+              device = cfg.bootPartition;
+              fsType = "vfat";
+            };
+      }
+    ];
 
     swapDevices = (if cfg.useDefaultFilesystems then mkVMOverride else mkDefault) [ ];
     boot.initrd.luks.devices = (if cfg.useDefaultFilesystems then mkVMOverride else mkDefault) { };

nixos/tests/activation/nix-channel.nix

@@ -7,6 +7,10 @@
   meta.maintainers = with lib.maintainers; [ nikstur ];
 
   nodes.machine = {
+    # - nix.enable gates nix.channel.enable behaviors
+    # - disabled by default. See all-tests.nix / tag(no-nix-by-default)
+    nix.enable = true;
+
     nix.channel.enable = true;
   };
 

nixos/tests/all-tests.nix

@@ -109,6 +109,34 @@ let
       ];
     };
 
+  /**
+    The test framework as exposed through its [other entrypoints] has defaults
+    that are most suitable for external usage.
+
+    This module adjusts it for the particular, important use case of
+    NixOS *as packaged in the nixpkgs repo*.
+
+    [other entrypoints]: https://nixos.org/manual/nixos/stable/#sec-calling-nixos-tests
+  */
+  localTestOverrides =
+    { lib, ... }:
+    {
+      _class = "nixosTest";
+      # for error messages, pseudo-url in no particular format
+      _file = "nixpkgs/nixos/tests/all-tests.nix#localTestOverrides";
+      imports = [
+        ./read-only-pkgs.nix
+      ];
+      extraBaseModules = {
+        _file = "nixpkgs/nixos/tests/all-tests.nix#localTestOverrides-extraBaseModules";
+        # tag(no-nix-by-default): we exclude nix from the tests *here* to keep a
+        #   small reverse closure for nix package updates among other things.
+        #   Out-of-tree usages get nix by default as usual.
+        #   See https://nixos.org/manual/nixos/unstable/#sec-call-nixos-test-outside-nixos
+        config.nix.enable = lib.mkDefault false;
+      };
+    };
+
   inherit
     (rec {
       doRunTest =
@@ -116,7 +144,7 @@ let
         ((import ../lib/testing-python.nix { inherit system pkgs; }).evalTest {
           imports = [
             arg
-            ./read-only-pkgs.nix
+            localTestOverrides
           ];
         }).config.result;
       findTests =
@@ -175,6 +203,16 @@ in
           touch $out
         '';
     efivars = runTestOn [ "x86_64-linux" ] ./nixos-test-driver/efivars.nix;
+    junit =
+      pkgs.runCommand "junit-xml-has-correct-testcases"
+        {
+          test = runTest ./nixos-test-driver/junit.nix;
+          nativeBuildInputs = [ pkgs.yq-go ];
+        }
+        ''
+          [[ 2 = $(yq '.testsuites.testsuite.+@tests' $test/junit.xml) ]]
+          touch $out
+        '';
   };
 
   # NixOS vm tests and non-vm unit tests
@@ -422,6 +460,10 @@ in
   containers-macvlans = runTest ./containers-macvlans.nix;
   containers-names = runTest ./containers-names.nix;
   containers-nested = runTest ./containers-nested.nix;
+  containers-nested-nix = runTest {
+    imports = [ ./containers-nested.nix ];
+    params.nix = true;
+  };
   containers-physical_interfaces = runTest ./containers-physical_interfaces.nix;
   containers-portforward = runTest ./containers-portforward.nix;
   containers-reloadable = runTest ./containers-reloadable.nix;
@@ -798,9 +840,7 @@ in
   healthchecks = runTest ./web-apps/healthchecks.nix;
   hedgedoc = runTest ./hedgedoc.nix;
   herbstluftwm = runTest ./herbstluftwm.nix;
-  # 9pnet_virtio used to mount /nix partition doesn't support
-  # hibernation. This test happens to work on x86_64-linux but
-  # not on other platforms.
+  # This test happens to work on x86_64-linux but not on other platforms.
   hibernate = handleTestOn [ "x86_64-linux" ] ./hibernate.nix {
     systemdStage1 = false;
   };
@@ -1200,6 +1240,7 @@ in
   nginx = runTest ./nginx.nix;
   nginx-auth = runTest ./nginx-auth.nix;
   nginx-compression = runTest ./nginx-compression.nix;
+  nginx-dynamic-modules = runTest ./nginx-dynamic-modules.nix;
   nginx-etag = runTest ./nginx-etag.nix;
   nginx-etag-compression = runTest ./nginx-etag-compression.nix;
   nginx-globalredirect = runTest ./nginx-globalredirect.nix;

nixos/tests/appliance-repart-image.nix

@@ -90,7 +90,16 @@ in
               Minimize = "guess";
             };
           };
-        };
+        }
+        // (lib.genAttrs [ "squashfs" "erofs" "btrfs" "xfs" "swap" "empty" ] (fsType: {
+          repartConfig = {
+            Type = "linux-generic";
+            Format = fsType;
+
+            SizeMinBytes = "10M";
+            SizeMaxBytes = "10M";
+          };
+        }));
       };
     };
 

nixos/tests/atticd.nix

@@ -15,6 +15,8 @@ in
 
   nodes = {
     local = {
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+
       services.atticd = {
         enable = true;
 
@@ -27,6 +29,8 @@ in
     };
 
     s3 = {
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+
       services.atticd = {
         enable = true;
         settings = {

nixos/tests/binary-cache.nix

@@ -7,6 +7,9 @@
     { pkgs, ... }:
     {
       imports = [ ../modules/installer/cd-dvd/channel.nix ];
+
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+
       environment.systemPackages = with pkgs; [
         openssl
         python3

nixos/tests/containers-bridge.nix

@@ -49,6 +49,7 @@ in
         localAddress = containerIp;
         localAddress6 = containerIp6;
         config = {
+          nix.enable = false; # disabled by default on the host. See all-tests.nix / tag(no-nix-by-default)
           services.httpd.enable = true;
           services.httpd.adminAddr = "foo@example.org";
           networking.firewall.allowedTCPPorts = [ 80 ];
@@ -60,6 +61,7 @@ in
         privateNetwork = true;
         hostBridge = "br0";
         config = {
+          nix.enable = false; # disabled by default on the host. See all-tests.nix / tag(no-nix-by-default)
           services.httpd.enable = true;
           services.httpd.adminAddr = "foo@example.org";
           networking.firewall.allowedTCPPorts = [ 80 ];

nixos/tests/containers-custom-pkgs.nix

@@ -37,6 +37,8 @@ in
           {
             nixpkgs.pkgs = customPkgs;
             system.extraDependencies = [ pkgs.hello ];
+
+            nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
           };
       };
     };

nixos/tests/containers-ephemeral.nix

@@ -26,6 +26,7 @@
             };
           };
           networking.firewall.allowedTCPPorts = [ 80 ];
+          nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
         };
       };
     };

nixos/tests/containers-extra_veth.nix

@@ -63,6 +63,7 @@
         };
         config = {
           networking.firewall.allowedTCPPorts = [ 80 ];
+          nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
         };
       };
 

nixos/tests/containers-gateway.nix

@@ -39,9 +39,12 @@ in
       hostBridge = "br0";
       localAddress = containerIp4;
       localAddress6 = containerIp6;
-      config.networking = {
-        defaultGateway.address = hostIp4;
-        defaultGateway6.address = hostIp6;
+      config = {
+        networking = {
+          defaultGateway.address = hostIp4;
+          defaultGateway6.address = hostIp6;
+        };
+        nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
       };
     };
   };

nixos/tests/containers-hosts.nix

@@ -29,7 +29,9 @@
         localAddress = "10.10.0.1";
         hostAddress = "10.10.0.254";
 
-        config = { };
+        config = {
+          nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
+        };
       };
 
       containers.netmask = {
@@ -38,7 +40,9 @@
         hostBridge = "br0";
         localAddress = "10.11.0.1/24";
 
-        config = { };
+        config = {
+          nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
+        };
       };
     };
 

nixos/tests/containers-imperative.nix

@@ -19,6 +19,7 @@
 
       boot.enableContainers = true;
 
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
       # XXX: Sandbox setup fails while trying to hardlink files from the host's
       #      store file system into the prepared chroot directory.
       nix.settings.sandbox = false;

nixos/tests/containers-ip.nix

@@ -8,6 +8,8 @@ let
         adminAddr = "foo@example.org";
       };
       networking.firewall.allowedTCPPorts = [ 80 ];
+
+      nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
     };
   };
 

nixos/tests/containers-ipv6-slaac.nix

@@ -104,6 +104,8 @@ in
 
           services.httpd.enable = true;
           networking.firewall.allowedTCPPorts = [ 80 ];
+
+          nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
         };
       };
     };

nixos/tests/containers-macvlans.nix

@@ -47,6 +47,7 @@ in
                 }
               ];
             };
+            nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
           };
         };
 
@@ -63,6 +64,7 @@ in
                 }
               ];
             };
+            nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
           };
         };
       };

nixos/tests/containers-names.nix

@@ -19,7 +19,9 @@
             privateNetwork = true;
             hostAddress = "192.168.${subnet}.1";
             localAddress = "192.168.${subnet}.2";
-            config = { };
+            config = {
+              nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
+            };
           };
 
         in

nixos/tests/containers-nested.nix

@@ -1,27 +1,54 @@
 # Test for NixOS' container nesting.
 
-{ pkgs, ... }:
 {
-  name = "nested";
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  system = config.nodes.machine.nixpkgs.hostPlatform.system;
+in
+{
+  options = {
+    params.nix = lib.mkOption {
+      description = "Whether to enable nix on host and containers - we test both variants";
+      type = lib.types.bool;
+      default = false; # In line with all-tests.nix / tag(no-nix-by-default)
+    };
+  };
+  config.name = "nested";
 
-  meta = with pkgs.lib.maintainers; {
+  config.meta = with pkgs.lib.maintainers; {
     maintainers = [ sorki ];
   };
 
-  nodes.machine =
+  config.nodes.machine =
     { lib, ... }:
     let
       makeNested = subConf: {
+        # NOTE: outer container is also called "nested"!
         containers.nested = {
           autoStart = true;
           privateNetwork = true;
-          config = subConf;
+          config = {
+            imports = [ subConf ];
+            nix.enable = config.params.nix;
+            nix.settings.substitute = false;
+          };
         };
+        # host or level 1
+        nix.enable = config.params.nix;
       };
     in
-    makeNested (makeNested { });
+    {
+      imports = [
+        (makeNested (makeNested { }))
+      ];
+      nix.settings.substitute = false;
+    };
 
-  testScript = ''
+  config.testScript = ''
     machine.start()
     machine.wait_for_unit("container@nested.service")
     machine.succeed("systemd-run --pty --machine=nested -- machinectl list | grep nested")
@@ -30,5 +57,62 @@
             "systemd-run --pty --machine=nested -- systemd-run --pty --machine=nested -- systemctl status"
         )
     )
+
+    ${lib.optionalString config.params.nix ''
+      def check_path(path):
+          # result is available on host
+          machine.succeed(f"""
+            stat {path}
+          """)
+          # result is available on container
+          # invocation by absolute path because systemd-run is quite minimal
+          machine.succeed(f"""
+            systemd-run --machine=nested --pipe --wait -- /run/current-system/sw/bin/stat {path}
+          """)
+          # result is available on nested container
+          machine.succeed(f"""
+            systemd-run --machine=nested --pipe --wait  -- systemd-run --machine=nested --pipe --wait -- /run/current-system/sw/bin/stat {path}
+          """)
+
+      with subtest("nix store sharing"):
+          with subtest("built on host"):
+              build = machine.succeed("""
+                nix-build --expr 'derivation {
+                  name = "buildprobe-0";
+                  system = "${system}";
+                  builder = "/bin/sh";
+                  args = [ "-c" "echo ok 0 >$out" ];
+                }'
+              """)
+              check_path(build)
+
+          with subtest("built on container layer 1"):
+              build = machine.succeed("""
+                systemd-run --machine=nested --pipe --wait -- \
+                  /bin/sh -l -c 'exec $0 "$@"' \
+                  /run/current-system/sw/bin/nix-build --expr 'derivation {
+                    name = "buildprobe-1";
+                    system = "${system}";
+                    builder = "/bin/sh";
+                    args = [ "-c" "echo ok 1 >$out" ];
+                  }'
+              """)
+              check_path(build)
+
+          with subtest("built on container layer 2"):
+              build = machine.succeed("""
+                systemd-run --machine=nested --pipe --wait -- \
+                  systemd-run --machine=nested --pipe --wait -- \
+                  /bin/sh -l -c 'exec $0 "$@"' \
+                  /run/current-system/sw/bin/nix-build --expr 'derivation {
+                    name = "buildprobe-2";
+                    system = "${system}";
+                    builder = "/bin/sh";
+                    args = [ "-c" "echo ok 2 >$out" ];
+                  }'
+              """)
+              check_path(build)
+
+    ''}
   '';
 }

nixos/tests/containers-physical_interfaces.nix

@@ -22,6 +22,7 @@
               }
             ];
             networking.firewall.enable = false;
+            nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
           };
         };
       };
@@ -44,6 +45,7 @@
 
           config = {
             networking.firewall.enable = false;
+            nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
           };
         };
       };
@@ -65,6 +67,7 @@
               }
             ];
             networking.firewall.enable = false;
+            nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
           };
         };
       };
@@ -90,6 +93,7 @@
               }
             ];
             networking.firewall.enable = false;
+            nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
           };
         };
       };
@@ -116,6 +120,7 @@
               }
             ];
             networking.firewall.enable = false;
+            nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
           };
         };
       };

nixos/tests/containers-portforward.nix

@@ -36,6 +36,7 @@ in
           services.httpd.enable = true;
           services.httpd.adminAddr = "foo@example.org";
           networking.firewall.allowedTCPPorts = [ 80 ];
+          nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
         };
       };
 

nixos/tests/containers-reloadable.nix

@@ -12,6 +12,7 @@
         containers.test1 = {
           autoStart = true;
           config.environment.etc.check.text = "client_base";
+          config.nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
         };
 
         # prevent make-test-python.nix to change IP
@@ -22,6 +23,7 @@
             environment.etc.check.text = lib.mkForce "client_c1";
             services.httpd.enable = true;
             services.httpd.adminAddr = "nixos@example.com";
+            nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
           };
         };
 
@@ -29,6 +31,7 @@
           containers.test1.config = {
             environment.etc.check.text = lib.mkForce "client_c2";
             services.nginx.enable = true;
+            nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
           };
         };
       };

nixos/tests/containers-require-bind-mounts.nix

@@ -8,7 +8,9 @@
       bindMounts = {
         "/srv/data" = { };
       };
-      config = { };
+      config = {
+        nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
+      };
     };
 
     virtualisation.fileSystems = {

nixos/tests/containers-restart_networking.nix

@@ -22,6 +22,7 @@
               prefixLength = 24;
             }
           ];
+          nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
         };
       };
 

nixos/tests/containers-tmpfs.nix

@@ -23,7 +23,9 @@
           # Add a tmpfs on a path that does not exist
           "/some/random/path"
         ];
-        config = { };
+        config = {
+          nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
+        };
       };
 
       virtualisation.additionalPaths = [ pkgs.stdenv ];

nixos/tests/containers-unified-hierarchy.nix

@@ -11,7 +11,9 @@
       containers = {
         test-container = {
           autoStart = true;
-          config = { };
+          config = {
+            nix.enable = false; # disabled by default on the test's host. See all-tests.nix / tag(no-nix-by-default)
+          };
         };
       };
     };

nixos/tests/gocron.nix

@@ -34,10 +34,10 @@
       return status == 0 and int(output) == 1
 
     def start_job():
-      machine.succeed("curl -X POST http://localhost:8156/api/jobs/Test%20job")
+      machine.succeed("curl -X POST http://localhost:8156/api/jobs/test-job")
 
     def job_ran_successfully() -> bool:
-      output = machine.succeed("curl http://localhost:8156/api/runs/Test%20job | jq '.[0].status_id, .[0].logs.[2].message'")
+      output = machine.succeed("curl http://localhost:8156/api/runs/test-job | jq '.[0].status_id, .[0].logs.[2].message'")
       split_output = output.split('\n')
       ran_successfully = int(split_output[0]) == 3
       log_message_as_expected = "Job runs not successfully" in split_output[1]

nixos/tests/harmonia.nix

@@ -18,6 +18,7 @@
 
       # check that extra-allowed-users is effective for harmonia
       nix.settings.allowed-users = [ ];
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
     };
 
     client01 = {
@@ -27,6 +28,7 @@
           "cache.example.com-1:eIGQXcGQpc00x6/XFcyacLEUmC07u4RAEHt5Y8vdglo="
         ];
       };
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
     };
   };
 

nixos/tests/hibernate.nix

@@ -29,7 +29,9 @@ makeTest {
         powerManagement.resumeCommands = "systemctl --no-block restart backdoor.service";
 
         virtualisation.emptyDiskImages = [ (2 * config.virtualisation.memorySize) ];
+        # virtiofs doesn't support hibernation
         virtualisation.useNixStoreImage = true;
+        virtualisation.sharedDirectories = lib.mkForce { };
 
         swapDevices = lib.mkOverride 0 [
           {

nixos/tests/hydra/common.nix

@@ -44,5 +44,6 @@
       };
       services.postfix.enable = true;
       nix.settings.substituters = [ ];
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
     };
 }

nixos/tests/installed-tests/flatpak-builder.nix

@@ -14,6 +14,7 @@ makeInstalledTest {
       with pkgs;
       [ flatpak-builder ] ++ flatpak-builder.installedTestsDependencies;
     virtualisation.diskSize = 2048;
+    nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
   };
 
   testRunnerFlags = [

nixos/tests/installer.nix

@@ -684,6 +684,9 @@ let
       nodes =
         let
           commonConfig = {
+            # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+            nix.enable = true;
+
             # builds stuff in the VM, needs more juice
             virtualisation.diskSize = 12 * 1024;
             virtualisation.cores = 8;
@@ -772,7 +775,7 @@ let
                   # Only the out output is included here, which is what is
                   # required to build the NixOS udev rules
                   # See the comment in services/hardware/udev.nix
-                  systemdMinimal.out
+                  systemd.out
 
                   # add curl so that rather than seeing the test attempt to download
                   # curl's tarball, we see what it's trying to download

nixos/tests/iscsi-root.nix

@@ -108,6 +108,8 @@ in
 
         system.extraDependencies = [ nodes.initiatorRootDisk.system.build.toplevel ];
 
+        nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+
         nix.settings = {
           substituters = lib.mkForce [ ];
           hashed-mirrors = null;

nixos/tests/kimai.nix

@@ -4,7 +4,7 @@
   name = "kimai";
   meta.maintainers = with lib.maintainers; [ peat-psuwit ];
 
-  nodes.machine =
+  containers.machine =
     { ... }:
     {
       services.kimai.sites."localhost" = {

nixos/tests/lix.nix

@@ -2,6 +2,8 @@
   name = "lix";
 
   nodes.machine = { pkgs, ... }: {
+    nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+
     nix.package = pkgs.lix;
 
     environment.etc."test.nix".text = ''

nixos/tests/logrotate.nix

@@ -28,10 +28,7 @@ in
       {
         services.logrotate = {
           enable = true;
-          configFile = pkgs.writeText "logrotate.conf" ''
-            # self-written config file
-            su notarealuser notagroupeither
-          '';
+          settings.header.su = "notarealuser notagroupeither";
         };
       };
     machine =
@@ -115,20 +112,13 @@ in
         machine.succeed("systemctl cat logrotate.service | grep -- --mail")
     with subtest("check generated config matches expectation"):
         machine.succeed(
-            # copy conf to /tmp/logrotate.conf for easy grep
-            "conf=$(systemctl cat logrotate | grep -oE '/nix/store[^ ]*logrotate.conf'); cp $conf /tmp/logrotate.conf",
-            "! grep weekly /tmp/logrotate.conf",
-            "grep -E '^delaycompress' /tmp/logrotate.conf",
-            "tail -n 1 /tmp/logrotate.conf | grep shred",
-            "sed -ne '/\"sendmail\" {/,/}/p' /tmp/logrotate.conf | grep 'mail user@domain.tld'",
-            "sed -ne '/\"postrotate\" {/,/}/p' /tmp/logrotate.conf | grep endscript",
-            "grep '\"file1\"\n\"file2\" {' /tmp/logrotate.conf",
-            "sed -ne '/\"import\" {/,/}/p' /tmp/logrotate.conf | grep noolddir",
-        )
-        # also check configFile option
-        failingMachine.succeed(
-            "conf=$(systemctl cat logrotate | grep -oE '/nix/store[^ ]*logrotate.conf'); cp $conf /tmp/logrotate.conf",
-            "grep 'self-written config' /tmp/logrotate.conf",
+            "! grep weekly /etc/logrotate.conf",
+            "grep -E '^delaycompress' /etc/logrotate.conf",
+            "tail -n 1 /etc/logrotate.conf | grep shred",
+            "sed -ne '/\"sendmail\" {/,/}/p' /etc/logrotate.conf | grep 'mail user@domain.tld'",
+            "sed -ne '/\"postrotate\" {/,/}/p' /etc/logrotate.conf | grep endscript",
+            "grep '\"file1\"\n\"file2\" {' /etc/logrotate.conf",
+            "sed -ne '/\"import\" {/,/}/p' /etc/logrotate.conf | grep noolddir",
         )
     with subtest("Check logrotate-checkconf service"):
         machine.wait_for_unit("logrotate-checkconf.service")

nixos/tests/lorri/default.nix

@@ -6,6 +6,8 @@
     {
       imports = [ ../../modules/profiles/minimal.nix ];
       environment.systemPackages = [ pkgs.lorri ];
+
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
     };
 
   testScript = ''

nixos/tests/misc.nix

@@ -66,6 +66,7 @@ in
       boot.kernel.sysctl."vm.swappiness" = 1;
       boot.kernelParams = [ "vsyscall=emulate" ];
       system.extraDependencies = [ foo ];
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
     };
 
   testScript = ''

nixos/tests/nar-serve.nix

@@ -23,6 +23,8 @@
 
         networking.firewall.allowedTCPPorts = [ 8383 ];
 
+        nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+
         # virtualisation.diskSize = 2 * 1024;
       };
   };

nixos/tests/ncps.nix

@@ -26,6 +26,8 @@
 
       networking.firewall.allowedTCPPorts = [ 5000 ];
       system.extraDependencies = [ pkgs.emptyFile ];
+
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
     };
 
     ncps = {
@@ -50,6 +52,8 @@
       };
 
       networking.firewall.allowedTCPPorts = [ 8501 ];
+
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
     };
 
     client = {
@@ -59,6 +63,7 @@
           "ncps:UtiE6C+3Tx0kgpP34vjyX/BKK6QZ/D1OzDYX72aCPJg="
         ];
       };
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
     };
   };
 

nixos/tests/nextcloud/basic.nix

@@ -116,8 +116,8 @@ runTest (
             )
 
             # Verify the local and remote copies of the file are identical.
-            client_hash = client.succeed("nix-hash testfile.bin").strip()
-            nextcloud_hash = nextcloud.succeed("nix-hash /var/lib/nextcloud-data/data/root/files/testfile.bin").strip()
+            client_hash = client.succeed("sha256sum <testfile.bin").strip()
+            nextcloud_hash = nextcloud.succeed("sha256sum </var/lib/nextcloud-data/data/root/files/testfile.bin").strip()
             t.assertEqual(client_hash, nextcloud_hash)
 
         with subtest("secrets"):

nixos/tests/nginx-dynamic-modules.nix

@@ -0,0 +1,32 @@
+{
+  name = "nginx-dynamic-modules";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.nginx = {
+        enable = true;
+        additionalModules = [ (pkgs.nginxModules.echo // { dynamic = true; }) ];
+        virtualHosts."localhost".locations."/".extraConfig = ''
+          echo "dynamic-module-ok";
+        '';
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      cfg = nodes.machine.services.nginx;
+    in
+    ''
+      machine.wait_for_unit("nginx")
+      machine.wait_for_open_port(80)
+
+      machine.succeed("ls ${cfg.package}/modules/*.so")
+      machine.succeed("grep -F load_module ${cfg.package}/etc/nginx/dynamic-modules.conf")
+
+      # The echo directive only exists once nginx has dlopen'd the .so.
+      response = machine.wait_until_succeeds("curl -fsS http://127.0.0.1/")
+      assert "dynamic-module-ok" in response, response
+    '';
+}

nixos/tests/nix-config.nix

@@ -9,6 +9,7 @@
         extra-nix-path = [ "extra=/etc/value.nix" ];
       };
       environment.etc."value.nix".text = "42";
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
     };
   testScript = ''
     start_all()

nixos/tests/nix-daemon-firewall.nix

@@ -100,6 +100,7 @@ let
       # Gives us access inside the nix sandbox
       extra-sandbox-paths = [ "${pkgs.pkgsStatic.busybox}" ];
     };
+    nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
 
     # Easy way to get files to the system
     environment.etc = {

nixos/tests/nix-daemon-unprivileged.nix

@@ -19,6 +19,7 @@
         "auto-allocate-uids"
       ];
     };
+    nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
 
     # Easiest way to get a file onto the machine
     environment.etc."test.nix".text = ''

nixos/tests/nix-local-store.nix

@@ -7,6 +7,8 @@
       experimental-features = [ "nix-command" ];
       log-lines = 26;
     };
+    nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+
     # Easiest way to get a file onto the machine
     environment.etc."test.nix".text = ''
       derivation {

nixos/tests/nix-required-mounts/default.nix

@@ -16,6 +16,7 @@ in
       nix.settings.substituters = lib.mkForce [ ];
       nix.settings.system-features = [ "supported-feature" ];
       nix.settings.experimental-features = [ "nix-command" ];
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
       programs.nix-required-mounts.enable = true;
       programs.nix-required-mounts.allowedPatterns.supported-feature = {
         onFeatures = [ "supported-feature" ];

nixos/tests/nix-serve-ssh.nix

@@ -12,6 +12,9 @@ in
 {
   name = "nix-ssh-serve";
   meta.maintainers = [ lib.maintainers.shlevy ];
+  defaults = {
+    nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+  };
   nodes = {
     server.nix.sshServe = {
       enable = true;

nixos/tests/nix-serve.nix

@@ -8,6 +8,7 @@
       environment.systemPackages = [
         pkgs.hello
       ];
+      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
     };
   testScript =
     let

nixos/tests/nix/upgrade.nix

@@ -45,6 +45,8 @@ pkgs.testers.nixosTest {
     imports = [ nixos-module ];
 
     nix.package = nixVersions.stable;
+    nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+
     system.extraDependencies = [
       fallback-paths-external
     ];

nixos/tests/nixos-generate-config.nix

@@ -19,6 +19,8 @@
         services.desktopManager.gnome.enable = true;
       ''
     ];
+
+    nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
   };
   testScript = ''
     start_all()

nixos/tests/nixos-rebuild-specialisations.nix

@@ -20,6 +20,7 @@
           hashed-mirrors = null;
           connect-timeout = 1;
         };
+        nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
 
         system.includeBuildDependencies = true;
 

nixos/tests/nixos-rebuild-store-path.nix

@@ -20,6 +20,7 @@
           hashed-mirrors = null;
           connect-timeout = 1;
         };
+        nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
 
         system.includeBuildDependencies = true;
 

nixos/tests/nixos-rebuild-target-host.nix

@@ -5,7 +5,9 @@
   # TODO: remove overlay from  nixos/modules/profiles/installation-device.nix
   #        make it a _small package instead, then remove pkgsReadOnly = false;.
   node.pkgsReadOnly = false;
-
+  defaults = {
+    nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+  };
   nodes = {
     deployer =
       { lib, pkgs, ... }:

nixos/tests/nixos-test-driver/junit.nix

@@ -0,0 +1,25 @@
+# This tests the generation of junit files via the test driver.
+{
+  name = "junit";
+
+  extraDriverArgs = [ "--junit=junit.xml" ];
+
+  nodes.machine = {
+    # Speeds up the boot significantly
+    networking.useNetworkd = true;
+
+    environment.etc."something".text = "nothing";
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("systemd-networkd is started"):
+      machine.succeed("systemctl status systemd-networkd.service")
+
+    with subtest("/etc is populated correctly"):
+      output = machine.succeed("cat /etc/something")
+      t.assertEqual(output, "nothing")
+  '';
+}

nixos/tests/nixseparatedebuginfod2.nix

@@ -1,6 +1,9 @@
 { pkgs, lib, ... }:
 {
   name = "nixseparatedebuginfod2";
+  defaults = {
+    nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+  };
   # A binary cache with debug info and source for gnumake
   nodes.cache =
     { pkgs, ... }:

nixos/tests/openvswitch.nix

@@ -50,7 +50,8 @@
 
   testScript = # python
     ''
-      start_all()
+      node1.start(allow_reboot=True)
+      node2.start()
       node1.wait_for_unit("ovsdb.service")
       node1.wait_for_unit("ovs-vswitchd.service")
       node2.wait_for_unit("ovsdb.service")
@@ -80,5 +81,20 @@
           node1.wait_for_unit("vs0-netdev.service")
 
           check_marker_flow()
+
+      with subtest("Transient ports are removed after reboot"):
+          node1.succeed(
+              "ovs-vsctl --no-wait add-br transient-test-br"
+              " -- add-port transient-test-br transient-test-port"
+              " -- set Interface transient-test-port type=internal"
+              " -- set Port transient-test-port other_config:transient=true"
+          )
+          node1.succeed("ovs-vsctl port-to-br transient-test-port")
+
+          node1.reboot()
+          node1.wait_for_unit("ovsdb.service")
+          node1.wait_for_unit("ovs-vswitchd.service")
+
+          node1.fail("ovs-vsctl port-to-br transient-test-port")
     '';
 }

nixos/tests/portunus.nix

@@ -13,6 +13,7 @@
 
   testScript = ''
     machine.wait_for_unit("portunus.service")
-    machine.succeed("curl --fail -vvv http://localhost:8080/")
+    machine.wait_for_open_port(8080)
+    machine.wait_until_succeeds("curl --fail -vvv http://localhost:8080/")
   '';
 }

nixos/tests/qemu-vm-store.nix

@@ -5,6 +5,10 @@
 
   meta.maintainers = with lib.maintainers; [ nikstur ];
 
+  defaults = {
+    nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+  };
+
   nodes = {
     sharedWritable = {
       virtualisation.writableStore = true;
@@ -51,17 +55,16 @@
       sharedReadOnly.fail(build_derivation)
       imageReadOnly.fail(build_derivation)
 
-    # Checking whether the fs type is 9P is just a proxy to test whether the
-    # Nix Store is shared. If we switch to a different technology (e.g.
-    # virtiofs) for sharing, we need to adjust these tests.
+    # Checking whether the fs type is virtiofs is just a proxy to test whether the
+    # Nix Store is shared.
 
-    with subtest("Nix store is shared from the host via 9P"):
-      sharedWritable.succeed("findmnt --kernel --type 9P /nix/.ro-store")
-      sharedReadOnly.succeed("findmnt --kernel --type 9P /nix/.ro-store")
+    with subtest("Nix store is shared from the host via virtiofs"):
+      sharedWritable.succeed("findmnt --kernel --type virtiofs /nix/.ro-store")
+      sharedReadOnly.succeed("findmnt --kernel --type virtiofs /nix/.ro-store")
 
-    with subtest("Nix store is not shared via 9P"):
-      imageWritable.fail("findmnt --kernel --type 9P /nix/.ro-store")
-      imageReadOnly.fail("findmnt --kernel --type 9P /nix/.ro-store")
+    with subtest("Nix store is not shared via virtiofs"):
+      imageWritable.fail("findmnt --kernel --type virtiofs /nix/.ro-store")
+      imageReadOnly.fail("findmnt --kernel --type virtiofs /nix/.ro-store")
 
     with subtest("Nix store is not mounted separately"):
       rootDevice = fullDisk.succeed("stat -c %d /")

nixos/tests/repath-studio.nix

@@ -52,16 +52,28 @@
     machine.screenshot("Repath-Studio-GUI-Welcome")
     machine.send_key("kp_enter") # OK
 
-    # sleep is required it needs time to dismiss the dialog
+    # move the mouse to the "Save" icon on the toolbar
+    machine.execute("su - alice -c \"DISPLAY=:0 xdotool mousemove --sync 95 65\"")
+
+    # click the save icon until the GTK save dialog appears
+    for _ in range(30):
+        status, _ = machine.execute("su - alice -c \"DISPLAY=:0 xdotool search --name 'Save File'\"")
+        if status == 0:
+            break
+        machine.execute("su - alice -c \"DISPLAY=:0 xdotool click 1\"")
+        machine.sleep(1)
+
+    # wait for the GTK dialog to focus the text input field
+    machine.sleep(3)
+    machine.send_chars("saved.rps") # avoid using absolute path here, doesn't work for some reason
+    # wait for text to be typed
     machine.sleep(2)
-    machine.send_key("ctrl-shift-s")
-    machine.sleep(2)
-    machine.send_chars("/tmp/saved.rps")
-    machine.sleep(2)
-    machine.succeed("su - alice -c 'DISPLAY=:0 xdotool mousemove --sync 975 745 click 1'") # Save file dialog
-    machine.sleep(2)
-    print(machine.succeed("cat /tmp/saved.rps"))
-    assert "${pkgs.repath-studio.version}" in machine.succeed("cat /tmp/saved.rps")
+
+    machine.execute("su - alice -c \"DISPLAY=:0 xdotool key alt+s\"") # save file
+    machine.wait_until_succeeds("ls /home/alice/saved.rps")
+
+    machine.succeed("cat /home/alice/saved.rps")
+    assert "${pkgs.repath-studio.version}" in machine.succeed("cat /home/alice/saved.rps")
 
     machine.screenshot("Repath-Studio-GUI")
   '';