rPackages.{BayesPET,GapAnalysis}: fix build (#544264)

This is a bug-fix release with a security fix for ACL evaluation.
https://gitlab.nic.cz/knot/knot-dns/-/releases/v3.5.6
https://lists.nic.cz/hyperkitty/list/knot-dns-users@lists.nic.cz/thread/ONBP3THCXE2QJBOHLM7U2OUR6BIHML7J/

.github/workflows/build.yml

@@ -59,7 +59,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true

.github/workflows/check.yml

@@ -147,7 +147,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

.github/workflows/eval.yml

@@ -139,7 +139,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Load supported versions
         id: versions
@@ -187,7 +187,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -277,7 +277,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Combine all output paths and eval stats
         run: |
@@ -486,7 +486,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'

.github/workflows/lint.yml

@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

ci/OWNERS

@@ -41,7 +41,7 @@
 /lib/meta.nix               @alyssais @NixOS/stdenv @llakala
 /lib/meta-types.nix         @infinisil @adisbladis @NixOS/stdenv @llakala
 /lib/source-types.nix       @alyssais @NixOS/stdenv @llakala
-/lib/systems                @alyssais @NixOS/stdenv @llakala
+/lib/systems                @alyssais @NixOS/stdenv
 ## Libraries / Module system
 /lib/modules.nix            @infinisil @roberth @hsjobeki @llakala
 /lib/types.nix              @infinisil @roberth @hsjobeki @llakala
@@ -211,7 +211,7 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/development/perl-modules      @stigtsp @marcusramberg
 
 # R
-/pkgs/applications/science/math/R   @jbedo
+/pkgs/by-name/r/R   @jbedo
 /pkgs/development/r-modules         @jbedo
 
 # Rust
@@ -260,7 +260,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/editors/jetbrains @leona-ya @theCapypara
 
 # Licenses
-/lib/licenses @alyssais @emilazy @jopejoe1 @llakala
+/lib/licenses @alyssais @emilazy @jopejoe1
 
 # Qt
 /pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000

ci/github-script/bot.js

@@ -395,6 +395,13 @@ module.exports = async ({ github, context, core, dry }) => {
         pull_number,
         per_page: 100,
       })
+
+      // label llm-assisted PRs accordingly
+      const assistedByPattern = /Assisted-by: (?!nix-init)/i
+      evalLabels['llm-assisted'] = prCommits.some((c) =>
+        assistedByPattern.test(c.commit.message),
+      )
+
       const commitSubjects = prCommits.map(
         (c) => c.commit.message.split('\n')[0],
       )

doc/build-helpers/fixed-point-arguments.chapter.md

@@ -143,3 +143,4 @@ lib.extendMkDerivation {
     });
 }
 ```
+:::

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -165,7 +165,7 @@ They are useful for creating files from Nix expressions, and are all implemented
 Each of these functions will cause a derivation to be produced.
 When you coerce the result of each of these functions to a string with [string interpolation](https://nixos.org/manual/nix/stable/language/string-interpolation) or [`toString`](https://nixos.org/manual/nix/stable/language/builtins#builtins-toString), it will evaluate to the [store path](https://nixos.org/manual/nix/stable/store/store-path) of this derivation.
 
-:::: {.note}
+::: {.note}
 Some of these functions will put the resulting files within a directory inside the [derivation output](https://nixos.org/manual/nix/stable/language/derivations#attr-outputs).
 If you need to refer to the resulting files somewhere else in a Nix expression, append their path to the derivation's store path.
 
@@ -190,7 +190,7 @@ writeShellScript "evaluate-my-file.sh" ''
   cat ${my-file}/share/my-file
 ''
 ```
-::::
+:::
 
 ### `makeDesktopItem` {#trivial-builder-makeDesktopItem}
 

doc/languages-frameworks/rocq.section.md

@@ -59,7 +59,7 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
 * `releaseRev` (optional, defaults to `(v: v)`), provides a default mapping from release names to revision hashes/branch names/tags,
 * `releaseArtifact` (optional, defaults to `(v: null)`), provides a default mapping from release names to artifact names (only works for github artifact for now),
 * `displayVersion` (optional), provides a way to alter the computation of `name` from `pname`, by explaining how to display version numbers,
-* `namePrefix` (optional, defaults to `[ "rocq-core" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
+* `namePrefix` (optional, defaults to `[ "rocq" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
 * `nativeBuildInputs` (optional), is a list of executables that are required to build the current derivation, in addition to the default ones (namely `which`, `dune` and `ocaml` depending on whether `useDune`, `useDuneifVersion` and `mlPlugin` are set).
 * `extraNativeBuildInputs` (optional, deprecated), an additional list of derivation to add to `nativeBuildInputs`,
 * `overrideNativeBuildInputs` (optional) replaces the default list of derivation to which `nativeBuildInputs` and `extraNativeBuildInputs` adds extra elements,

doc/languages-frameworks/texlive.section.md

@@ -32,6 +32,21 @@ There is a TeX Live packaging that lives entirely under attribute `texlive`.
   )
   ```
 
+- Packages can be overriden by passing a new package with the same `pname` to `.withPackages`. For instance, the following replaces Asymptote with the version from Nixpkgs, which is usually more up to date:
+  ```nix
+  texliveMedium.withPackages (ps: [ asymptote ])
+  ```
+
+- To exclude a package from a collection, use an empty override as below:
+  ```nix
+  texliveBasic.withPackages (
+    ps: with ps; [
+      collection-bibtexextra
+      { pname = "bib2gls"; }
+    ]
+  )
+  ```
+
 - To add the documentation for all packages in the environment, use
   ```nix
   texliveSmall.overrideAttrs { withDocs = true; }

doc/release-notes/rl-2611.section.md

@@ -45,10 +45,14 @@
 
 - `python3Packages.django-health-check` has been updated to major version 4. See its [migration guide](https://codingjoe.dev/django-health-check/migrate-to-v4/) and [changelog](https://github.com/codingjoe/django-health-check/releases/tag/4.0.0) for breaking changes.
 
+- `jmtpfs` has been removed due to lack of maintenance and fuse3 support.
+
 - `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.
 
 - `mcphost` has been removed, as it was archived upstream and declared unmaintained.
 
+- `fflogs` has been removed because it was no longer functional. Users should switch to `archon-lite`.
+
 - `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
   Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
 
@@ -147,8 +151,7 @@
 
 ### Breaking changes {#sec-nixpkgs-release-26.11-lib-breaking}
 
-- Create the first release note entry in this section!
-
+- `fittrackee` 1.0.0 now requires postgres with postgis. The [upgrade guide](https://docs.fittrackee.org/en/upgrading-to-1.0.0.html) has steps to prepare for this upgrade.
 
 ### Deprecations {#sec-nixpkgs-release-26.11-lib-deprecations}
 

doc/style.css

@@ -156,8 +156,7 @@ body {
 }
 
 a {
-  text-decoration: none;
-  border-bottom: 1px solid;
+  text-decoration: underline;
   color: var(--link-color);
 }
 
@@ -480,6 +479,8 @@ div.appendix .variablelist .term {
 nav.toc-sidebar {
   height: 100%;
   padding: 0 1rem 2rem;
+  background-color: var(--background);
+  color: var(--main-text-color);
 }
 
 /* menu button, shown on mobile, hidden on desktop */
@@ -521,6 +522,59 @@ nav.toc-sidebar li {
 
 nav.toc-sidebar summary {
   cursor: pointer;
+  display: flex;
+  align-items: center;
+  list-style: none;
+}
+
+nav.toc-sidebar summary::before {
+  content: "▸";
+  flex: none;
+  font-size: 0.75em;
+}
+nav.toc-sidebar details[open] > summary::before {
+  content: "▾";
+}
+
+nav.toc-sidebar a {
+  display: block;
+  width: 100%;
+  padding: 3px 8px;
+  border-left: 3px solid transparent;
+  border-radius: 3px;
+  color: inherit;
+  transition:
+    background-color 120ms ease,
+    border-color 120ms ease;
+}
+nav.toc-sidebar a:hover {
+  background-color: #f2f2f2 !important;
+}
+
+nav.toc-sidebar a.active {
+  background-color: #d8d8d8;
+  border-left-color: #444;
+  font-weight: 600;
+}
+nav.toc-sidebar a.active-trail {
+  border-left-color: #bbb;
+  background-color: #e8e8e8;
+}
+
+@media (prefers-color-scheme: dark) {
+  nav.toc-sidebar a:hover {
+    /* hover should win over scroll selectors despite beeing less specific */
+    background-color: #606060 !important;
+  }
+  nav.toc-sidebar a.active {
+    background-color: #373737;
+    border-left-color: #eee;
+    font-weight: 600;
+  }
+  nav.toc-sidebar a.active-trail {
+    border-left-color: #eee;
+    background-color: #323232;
+  }
 }
 
 @media screen and (min-width: 768px) {
@@ -553,7 +607,6 @@ nav.toc-sidebar summary {
     max-height: none;
     overflow-y: auto;
     border: none;
-    border-right: 0.0625rem solid #d8d8d8;
   }
 
   /* Hide the toggle button on desktop */

doc/using/platform-support.chapter.md

@@ -1,16 +1,16 @@
 # Platform Support {#chap-platform-support}
 
-Packages receive varying degrees of support, both in terms of maintainer attention and available computation resources for continuous integration (CI). We have 7 defined tiers denoting how well supported each platform is.
+Packages receive varying degrees of support, both in terms of maintainer and security team attention and available computation resources for continuous integration (CI). We have 7 defined tiers denoting how well supported each platform is.
 
 ## Tiers {#sec-platform-tiers}
 
 ### Tier 1 {#sec-platform-tier1}
 
-[Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) platforms receive the highest level of support where problems can block updates, platform-specific patches are freely applied, and most packages are expected to work.
+[Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) platforms receive the highest level of support where problems can block updates, security fixes are treated with urgency, platform-specific patches are freely applied, and most packages are expected to work.
 
 ### Tier 2 {#sec-platform-tier2}
 
-[Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) platforms are expected to remain functional with updates, receive platform-specific patches as needed, and have many packages built by Hydra with full ofBorg support.
+[Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) platforms are expected to remain functional and secure with updates, receive platform-specific patches as needed, and have many packages built by Hydra with full ofBorg support.
 
 ### Tier 3 {#sec-platform-tier3}
 
@@ -22,25 +22,25 @@ Platform Tiers [4 through 7](https://github.com/NixOS/rfcs/blob/master/rfcs/0046
 
 ## Breakdown {#sec-platform-breakdown}
 
-| Triple                                | Support Tier | Channel Blockers | Hydra Support | Ofborg Support | Bootstrap Tarballs | Cross Compiling Support |
-| ------------------------------------- | ------------ | ---------------- | ------------- | -------------- | ------------------ | ----------------------- |
-| `x86_64-unknown-linux-gnu`            | [Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) | Many | ✔️            | ✔️            | ✔️                 | ✔️                      |
-| `aarch64-unknown-linux-gnu`           | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ✔️                      |
-| `x86_64-unknown-linux-musl`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
-| `aarch64-unknown-linux-musl`          | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
-| `x86_64-unknown-unknown-freebsd`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ❌                       |
-| `i686-unknown-linux-gnu`              | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
-| `riscv32-unknown-linux-gnu`           | [Tier 4](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-4) | None | ❌             | ❌             | ❌                  | ✔️                      |
-| `riscv64-unknown-linux-gnu`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `loongarch64-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `armv6l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `armv6l-unknown-linux-musleabihf`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `armv7l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `armv5tel-unknown-linux-gnueabi`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `mips64el-unknown-linux-gnuabi64`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `mips64el-unknown-linux-gnuabin32`    | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `mipsel-unknown-linux-gnu`            | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `powerpc64-unknown-linux-gnuabielfv2` | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `powerpc64le-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `s390x-unknown-linux-gnu`             | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| Triple                                | Support Tier                                                                                   | Channel Blockers | Hydra Support | Security Support | Ofborg Support | Bootstrap Tarballs | Cross Compiling Support |
+|---------------------------------------|------------------------------------------------------------------------------------------------|------------------|---------------|------------------|----------------|--------------------|-------------------------|
+| `x86_64-unknown-linux-gnu`            | [Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) | Many             | ✔️             | ✔️                | ✔️              | ✔️                  | ✔️                       |
+| `aarch64-unknown-linux-gnu`           | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some             | ✔️             | ✔️                | ✔️              | ✔️                  | ✔️                       |
+| `x86_64-unknown-linux-musl`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | Limited       | ❌               | ❌             | ✔️                  | ✔️                       |
+| `aarch64-unknown-linux-musl`          | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | Limited       | ❌               | ❌             | ✔️                  | ✔️                       |
+| `x86_64-unknown-unknown-freebsd`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some             | ✔️             | ✔️                | ✔️              | ✔️                  | ❌                      |
+| `i686-unknown-linux-gnu`              | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | Limited       | ❌               | ❌             | ✔️                  | ✔️                       |
+| `riscv32-unknown-linux-gnu`           | [Tier 4](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-4) | None             | ❌            | ❌               | ❌             | ❌                 | ✔️                       |
+| `riscv64-unknown-linux-gnu`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `loongarch64-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `armv6l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `armv6l-unknown-linux-musleabihf`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `armv7l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `armv5tel-unknown-linux-gnueabi`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `mips64el-unknown-linux-gnuabi64`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `mips64el-unknown-linux-gnuabin32`    | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `mipsel-unknown-linux-gnu`            | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `powerpc64-unknown-linux-gnuabielfv2` | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `powerpc64le-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| `s390x-unknown-linux-gnu`             | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |

lib/attrsets.nix

@@ -1140,7 +1140,7 @@ rec {
 
     For a function that gives you control over what counts as a leaf, see `mapAttrsRecursiveCond`.
 
-    :::{#map-attrs-recursive-example .example}
+    ::: {.example #map-attrs-recursive-example}
     # Map over leaf attributes
 
     ```nix
@@ -1165,7 +1165,7 @@ rec {
     If the predicate returns false, `mapAttrsRecursiveCond` does not recurse, but instead applies the mapping function.
     If the predicate returns true, it does recurse, and does not apply the mapping function.
 
-    :::{#map-attrs-recursive-cond-example .example}
+    ::: {.example #map-attrs-recursive-cond-example}
     # Map over an leaf attributes defined by a condition
 
     Map derivations to their `name` attribute.

lib/customisation.nix

@@ -564,7 +564,7 @@ rec {
 
     # Examples
 
-    :::{#ex-makeScope .example}
+    :::{.example #ex-makeScope}
     # Create an interdependent package set on top of `pkgs`
 
     The functions in `foo.nix` and `bar.nix` can depend on each other, in the sense that `foo.nix` can contain a function that expects `bar` as an attribute in its argument.
@@ -593,7 +593,7 @@ rec {
     ```
     :::
 
-    :::{#ex-makeScope-callPackage .example}
+    :::{.example #ex-makeScope-callPackage}
     # Using `callPackage` from a scope
 
     ```nix

lib/licenses/licenses.nix

@@ -310,6 +310,11 @@ lib.mapAttrs mkLicense (
       redistributable = true;
     };
 
+    buddy = {
+      spdxId = "Buddy";
+      fullName = "Buddy License";
+    };
+
     bzip2 = {
       spdxId = "bzip2-1.0.6";
       fullName = "bzip2 and libbzip2 License v1.0.6";
@@ -382,6 +387,13 @@ lib.mapAttrs mkLicense (
       free = false;
     };
 
+    cc-by-nc-30-igo = {
+      # Currently does not have a spdxID will get one in the future https://github.com/spdx/license-list-XML/issues/2845
+      # spdxId = "CC-BY-NC-3.0-IGO";
+      fullName = "Creative Commons Attribution Non Commercial 3.0 IGO";
+      free = false;
+    };
+
     cc-by-nc-40 = {
       spdxId = "CC-BY-NC-4.0";
       fullName = "Creative Commons Attribution Non Commercial 4.0 International";
@@ -926,6 +938,11 @@ lib.mapAttrs mkLicense (
       free = false;
     };
 
+    jpl-image = {
+      fullName = "JPL Image Use Policy";
+      spdxId = "JPL-image";
+    };
+
     knuth = {
       fullName = "Knuth CTAN License";
       spdxId = "Knuth-CTAN";
@@ -1611,6 +1628,11 @@ lib.mapAttrs mkLicense (
       url = "https://fedoraproject.org/wiki/Licensing:Wadalab?rd=Licensing/Wadalab";
     };
 
+    wordnet = {
+      spdxId = "WordNet";
+      fullName = "WordNet License";
+    };
+
     wtfpl = {
       spdxId = "WTFPL";
       fullName = "Do What The F*ck You Want To Public License";

maintainers/maintainer-list.nix

@@ -1289,6 +1289,12 @@
     name = "Alexandru Tocar";
     keys = [ { fingerprint = "B617 DD24 3AB0 2E3F 2E67  DBFD 1305 2A85 D7A4 2AA4"; } ];
   };
+  AlexAntonik = {
+    email = "antonikavv@gmail.com";
+    github = "AlexAntonik";
+    githubId = 55547934;
+    name = "Alex Antonik";
+  };
   alexarice = {
     email = "alexrice999@hotmail.co.uk";
     github = "alexarice";
@@ -1489,6 +1495,12 @@
     githubId = 60479013;
     name = "Alma Cemerlic";
   };
+  aln730 = {
+    email = "arnsg730@proton.me";
+    github = "aln730";
+    githubId = 94751172;
+    name = "AGawas";
+  };
   Alper-Celik = {
     email = "alper@alper-celik.dev";
     name = "Alper Çelik";
@@ -1629,12 +1641,6 @@
     githubId = 382798;
     name = "amfl";
   };
-  amiddelk = {
-    email = "amiddelk@gmail.com";
-    github = "amiddelk";
-    githubId = 1358320;
-    name = "Arie Middelkoop";
-  };
   aminechikhaoui = {
     email = "amine.chikhaoui91@gmail.com";
     github = "AmineChikhaoui";
@@ -1948,6 +1954,12 @@
     githubId = 51257127;
     name = "anntnzrb";
   };
+  anntoin = {
+    email = "anntoin@gmail.com";
+    github = "Anntoin";
+    githubId = 3289027;
+    name = "Anntóin Wilkinson";
+  };
   anoa = {
     matrix = "@andrewm:amorgan.xyz";
     email = "andrew@amorgan.xyz";
@@ -2007,6 +2019,12 @@
     githubId = 14838767;
     name = "Jacopo Scannella";
   };
+  antoineco = {
+    email = "hello@acotten.com";
+    github = "antoineco";
+    githubId = 3299086;
+    name = "Antoine Cotten";
+  };
   anton-4 = {
     name = "Anton";
     github = "Anton-4";
@@ -4432,6 +4450,12 @@
       { fingerprint = "8916 F727 734E 77AB 437F  A33A 19AB 76F5 CEE1 1392"; }
     ];
   };
+  caguiclajmg = {
+    email = "jmg.caguicla@guarandoo.me";
+    github = "caguiclajmg";
+    githubId = 32662060;
+    name = "John Mark Gabriel Caguicla";
+  };
   CaiqueFigueiredo = {
     email = "public@caiquefigueiredo.me";
     github = "caiquefigueiredo";
@@ -4731,12 +4755,6 @@
     githubId = 52760912;
     name = "Cameron Brown";
   };
-  ccellado = {
-    email = "annplague@gmail.com";
-    github = "ccellado";
-    githubId = 44584960;
-    name = "Denis Khalmatov";
-  };
   ccicnce113424 = {
     email = "ccicnce113424@gmail.com";
     matrix = "@ccicnce113424:matrix.org";
@@ -5607,6 +5625,11 @@
     githubId = 5953003;
     name = "Connor Nelson";
   };
+  conny = {
+    github = "ConstantConstantin";
+    githubId = 162139822;
+    name = "Constantin-Paul Hertel";
+  };
   conradmearns = {
     email = "conradmearns+github@pm.me";
     github = "ConradMearns";
@@ -6363,6 +6386,12 @@
     github = "David-Kopczynski";
     githubId = 53194670;
   };
+  David-Moody = {
+    name = "David Moody";
+    email = "david.moody@scot.me.uk";
+    github = "David-Moody";
+    githubId = 63956662;
+  };
   david-sawatzke = {
     email = "d-nix@sawatzke.dev";
     github = "david-sawatzke";
@@ -6797,6 +6826,13 @@
     githubId = 77843198;
     name = "Vasilis Manetas";
   };
+  Deric-W = {
+    email = "robo-eric@gmx.de";
+    github = "Deric-W";
+    githubId = 42873573;
+    name = "Eric Wolf";
+    keys = [ { fingerprint = "ADAA B6F3 A955 5589 D66C  CE61 80D2 DA42 8A4A 537F"; } ];
+  };
   DerickEddington = {
     email = "derick.eddington@pm.me";
     github = "DerickEddington";
@@ -9107,6 +9143,12 @@
     githubId = 41450706;
     name = "fin-w";
   };
+  fiona = {
+    email = "mail@fiona.hamburg";
+    github = "Fiona42069";
+    githubId = 260108682;
+    name = "fiona";
+  };
   fionera = {
     email = "nix@fionera.de";
     github = "fionera";
@@ -11480,6 +11522,13 @@
     githubId = 72767437;
     name = "Ian Holloway";
   };
+  iank = {
+    email = "iank@iank.org";
+    github = "iank";
+    githubId = 109598;
+    name = "Ian Kilgore";
+    keys = [ { fingerprint = "21F7 244E 095F 619E 8E3E  1EB4 9F3A 4AAB 4D90 D879"; } ];
+  };
   ianliu = {
     email = "ian.liu88@gmail.com";
     github = "ianliu";
@@ -11933,6 +11982,12 @@
     githubId = 16307070;
     name = "iosmanthus";
   };
+  ipetkov = {
+    name = "Ivan Petkov";
+    github = "ipetkov";
+    githubId = 1638690;
+    email = "nixpkgs@ipetkov.dev";
+  };
   ipsavitsky = {
     email = "ipsavitsky234@gmail.com";
     github = "ipsavitsky";
@@ -12501,6 +12556,12 @@
     github = "JaviMerino";
     githubId = 44926;
   };
+  jayadeep-km-sonarsource = {
+    email = "jayadeep.kinavoormadam@sonarsource.com";
+    name = "Jayadeep Kinavoor Madam";
+    github = "jayadeep-km-sonarsource";
+    githubId = 156662663;
+  };
   jayesh-bhoot = {
     name = "Jayesh Bhoot";
     email = "jb@jayeshbhoot.com";
@@ -14378,6 +14439,12 @@
     github = "keller00";
     githubId = 8452750;
   };
+  kenis1108 = {
+    email = "1836362346@qq.com";
+    github = "kenis1108";
+    githubId = 45393183;
+    name = "kenis";
+  };
   kenran = {
     email = "johannes.maier@mailbox.org";
     github = "kenranunderscore";
@@ -16400,6 +16467,11 @@
     githubId = 83420438;
     name = "Lewis";
   };
+  lubsch = {
+    github = "lubsch";
+    githubId = 33580245;
+    name = "Benjamin Lohmar";
+  };
   luc65r = {
     email = "lucas@ransan.fr";
     github = "luc65r";
@@ -16612,12 +16684,6 @@
     githubId = 10746692;
     name = "Leopold Luley";
   };
-  lumi = {
-    email = "lumi@pew.im";
-    github = "lumi-me-not";
-    githubId = 26020062;
-    name = "lumi";
-  };
   luminarleaf = {
     github = "LuminarLeaf";
     githubId = 80571430;
@@ -20127,6 +20193,12 @@
     github = "nigelgbanks";
     githubId = 487373;
   };
+  nightconcept = {
+    email = "dark@nightconcept.net";
+    github = "nightconcept";
+    githubId = 486025;
+    name = "Danny Solivan";
+  };
   nikhilmaddirala = {
     name = "Nikhil Maddirala";
     github = "nikhilmaddirala";
@@ -20716,8 +20788,9 @@
     github = "numinit";
     githubId = 369111;
     keys = [
-      # SSH
+      # SSH, per-machine yubikey ecdsa-sk keys
       { fingerprint = "XX/0lMz82MpucPqf0KG+5EJoozzNRi8i/t59byD2kNo"; }
+      { fingerprint = "dye2C1N4RQaf+8ht5Ipd52BbnnuwBtdXxocPzk8b2mw"; }
       # GPG, >=2025, stays in one place
       { fingerprint = "FD28 F9C9 81C5 D78E 56E8  8311 5C3E B94D 198F 1491"; }
       # GPG, >=2025, travels with me
@@ -21195,12 +21268,6 @@
     githubId = 19862;
     name = "KJ Ørbekk";
   };
-  orbitz = {
-    email = "mmatalka@gmail.com";
-    github = "orbitz";
-    githubId = 75299;
-    name = "Malcolm Matalka";
-  };
   orhun = {
     email = "orhunparmaksiz@gmail.com";
     github = "orhun";
@@ -22019,6 +22086,12 @@
     githubId = 421510;
     name = "Noé Rubinstein";
   };
+  phluxjr = {
+    email = "phluxjr@phluxjr.net";
+    github = "phluxjr";
+    githubId = 185956030;
+    name = "phluxjr";
+  };
   pho = {
     email = "phofin@gmail.com";
     github = "pho";
@@ -25962,6 +26035,12 @@
     name = "Nikolay Korotkiy";
     keys = [ { fingerprint = "ADF4 C13D 0E36 1240 BD01  9B51 D1DE 6D7F 6936 63A5"; } ];
   };
+  silicalet = {
+    name = "Mr. why";
+    email = "silicalet@outlook.com";
+    github = "silicalet";
+    githubId = 188071249;
+  };
   silky = {
     name = "Noon van der Silk";
     email = "noonsilk+nixpkgs@gmail.com";
@@ -26632,12 +26711,6 @@
     github = "spreetin";
     githubId = 7392173;
   };
-  sprock = {
-    email = "rmason@mun.ca";
-    github = "sprock";
-    githubId = 6391601;
-    name = "Roger Mason";
-  };
   sputn1ck = {
     email = "kon@kon.ninja";
     github = "sputn1ck";
@@ -27212,6 +27285,13 @@
     githubId = 36695359;
     name = "Vasyl Solovei";
   };
+  swaggeroo = {
+    email = "swaggerooo@pm.me";
+    github = "swaggeroo";
+    githubId = 57057662;
+    name = "Swaggeroo";
+    keys = [ { fingerprint = "D221 99EC 4FFF EF4D F29D  2435 5208 74E7 3291 4E0B"; } ];
+  };
   swarren83 = {
     email = "shawn.w.warren@gmail.com";
     github = "swarren83";
@@ -29709,12 +29789,6 @@
     githubId = 20145996;
     name = "Victor Fuentes";
   };
-  vlstill = {
-    email = "xstill@fi.muni.cz";
-    github = "vlstill";
-    githubId = 4070422;
-    name = "Vladimír Štill";
-  };
   vmandela = {
     email = "venkat.mandela@gmail.com";
     github = "vmandela";
@@ -31076,6 +31150,13 @@
       { fingerprint = "D2A8 A906 ACA7 B6D6 575E 9A2F 3A49 5054 6EA6 9E5C"; }
     ];
   };
+  yoquec = {
+    email = "alvaro.viejo@yoquec.com";
+    github = "yoquec";
+    githubId = 59575696;
+    name = "Alvaro Viejo";
+    matrix = "@yoquec.com:matrix.org";
+  };
   yorickvp = {
     email = "yorickvanpelt@gmail.com";
     matrix = "@yorickvp:matrix.org";

maintainers/scripts/luarocks-packages.csv

@@ -8,6 +8,7 @@ binaryheap,,,,,,vcunat
 bit32,,,,,5.1,lblasc
 busted,,,,,,
 busted-htest,,,,,,mrcjkb
+canola.nvim,,,,,,saadndm
 cassowary,,,,,,alerque
 cldr,,,,,,alerque
 commons.nvim,,,,,5.1,mrcjkb

maintainers/scripts/update.py

@@ -307,7 +307,7 @@ async def commit_changes(
             commit_message = "{attrPath}: {oldVersion} -> {newVersion}".format(**change)
             if "commitMessage" in change:
                 commit_message = change["commitMessage"]
-            elif "commitBody" in change:
+            if "commitBody" in change:
                 commit_message = commit_message + "\n\n" + change["commitBody"]
             await check_subprocess_output(
                 "git",

maintainers/team-list.nix

@@ -717,6 +717,15 @@ with lib.maintainers;
     github = "security-review";
   };
 
+  stardust-xr = {
+    members = [
+      pandapip1
+      technobaboo
+    ];
+    scope = "Maintain Stardust XR packages";
+    shortName = "StardustXR";
+  };
+
   stdenv = {
     enableFeatureFreezePing = true;
     github = "stdenv";

nixos/doc/manual/configuration/file-systems.chapter.md

@@ -41,5 +41,6 @@ and non-critical by adding `options = [ "nofail" ];`.
 ```{=include=} sections
 luks-file-systems.section.md
 sshfs-file-systems.section.md
+nfs-file-systems.section.md
 overlayfs.section.md
 ```

nixos/doc/manual/configuration/nfs-file-systems.section.md

@@ -0,0 +1,52 @@
+# NFS File Systems {#sec-nfs-file-systems}
+
+[NFS][nfs] (Network File System) allows you to mount directories from remote machines over the network.
+
+[nfs]: https://en.wikipedia.org/wiki/Network_File_System
+[nfs-man]: https://man7.org/linux/man-pages/man5/nfs.5.html
+
+To mount NFS filesystems persistently, use the `fileSystems` option:
+
+```nix
+{
+  fileSystems."/mnt/data" = {
+    device = "server.example.com:/export/data";
+    fsType = "nfs";
+  };
+}
+```
+
+## Automounting {#sec-nfs-automount}
+
+To have NFS filesystems mounted on-demand instead of at boot, add the `noauto` and `x-systemd.automount` options:
+
+```nix
+{
+  fileSystems."/mnt/data" = {
+    device = "server.example.com:/export/data";
+    fsType = "nfs";
+    options = [
+      "noauto"
+      "x-systemd.automount"
+    ];
+  };
+}
+```
+
+## Ad-hoc Mounting {#sec-nfs-adhoc}
+
+To mount NFS filesystems ad-hoc using the `mount` command, enable NFS and required RPC services:
+
+```nix
+{
+  boot.supportedFilesystems = [ "nfs" ];
+}
+```
+
+Then you can mount filesystems manually:
+
+```shell
+$ sudo mount -t nfs server.example.com:/export/data /mnt/data
+```
+
+For more information on NFS mount options, see the [nfs(5) man page][nfs-man].

nixos/doc/manual/installation/installing-from-other-distro.section.md

@@ -47,7 +47,7 @@ The first steps to all these are the same:
 
     Where `<version>` corresponds to the latest version available on [channels.nixos.org](https://channels.nixos.org/).
 
-    You may want to throw in a `nix-channel --update` for good measure.
+    You must run `$ nix-channel --update` for the channel change to take effect.
 
 1.  Install the NixOS installation tools:
 

nixos/doc/manual/redirects.json

@@ -619,6 +619,15 @@
   "sec-luks-file-systems-fido2-systemd": [
     "index.html#sec-luks-file-systems-fido2-systemd"
   ],
+  "sec-nfs-file-systems": [
+    "index.html#sec-nfs-file-systems"
+  ],
+  "sec-nfs-automount": [
+    "index.html#sec-nfs-automount"
+  ],
+  "sec-nfs-adhoc": [
+    "index.html#sec-nfs-adhoc"
+  ],
   "sec-sshfs-file-systems": [
     "index.html#sec-sshfs-file-systems"
   ],

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -99,6 +99,8 @@
 
 - `services.plantuml-server.packages.jetty` now supports `jetty_12`, it no longer supports `jetty_11`.
 
+- `services.komodo-periphery` has been updated to support version 2.0.0. Some options have been renamed to match the new configuration structure; compatibility aliases are provided for the renamed options. The `passkeys` and `outbound.onboardingKey` options have been removed; use `passkeyFiles`, `auth.privateKey`/`auth.corePublicKeys`, or `outbound.onboardingKeyFile` instead. New outbound mode configuration is available under `outbound.*`.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -142,6 +144,8 @@
 
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
 
+- The `authelia` module now uses systemd's `LoadCredential` to load all files defined in `secrets`. As such, these files no longer need to be readable by the authelia user and group: they can for example be set to be only readable by the root user.
+
 - `zoneminder` has been updated to 1.38.x release. See [upstream release note](https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.0). While database migration should happen automatically, it's recommended that you make a backup of the database before upgrading your system.
 
 - The latest available version of Nextcloud is v34 (available as `pkgs.nextcloud34`). The installation logic is as follows:

nixos/lib/systemd-unit-options.nix

@@ -625,7 +625,7 @@ rec {
 
       listenStreams = mkOption {
         default = [ ];
-        type = types.listOf types.str;
+        type = types.listOf (types.coercedTo types.port toString types.str);
         example = [
           "0.0.0.0:993"
           "/run/my-socket"

nixos/modules/hardware/opentabletdriver.nix

@@ -61,16 +61,27 @@ in
       wantedBy = [ "graphical-session.target" ];
       partOf = [ "graphical-session.target" ];
 
+      unitConfig = {
+        After = "graphical-session.target";
+        ConditionEnvironment = [
+          "|WAYLAND_DISPLAY"
+          "|DISPLAY"
+        ];
+      };
+
       serviceConfig = {
         Type = "simple";
-        # workaround for https://github.com/NixOS/nixpkgs/issues/469340
-        ExecStartPre = pkgs.writeShellScript "disable-for-gdm-greeter" ''
-          if [[ "$USER" = "gdm-greeter"* ]]; then
+        # workaround for https://github.com/NixOS/nixpkgs/issues/469340 and
+        # https://github.com/OpenTabletDriver/OpenTabletDriver/issues/4885
+        ExecStartPre = pkgs.writeShellScript "poll-for-non-gdm-greeter-display" ''
+          if [[ "$USER" = "gdm-greeter"* \
+              || ( "$${XDG_SESSION_TYPE}" = wayland && -z "$${WAYLAND_DISPLAY}" ) ]]; then
             exit 1
           fi
         '';
         ExecStart = lib.getExe' cfg.package "otd-daemon";
         Restart = "on-failure";
+        RestartSec = 3;
       };
     };
   };

nixos/modules/module-list.nix

@@ -1861,6 +1861,7 @@
   ./services/web-servers/nginx/tailscale-auth.nix
   ./services/web-servers/phpfpm/default.nix
   ./services/web-servers/pomerium.nix
+  ./services/web-servers/rustfs.nix
   ./services/web-servers/rustus.nix
   ./services/web-servers/send.nix
   ./services/web-servers/stargazer.nix

nixos/modules/rename.nix

@@ -511,7 +511,7 @@ in
       services.simplesamlphp has been vulnerable and unmaintained in nixpkgs.
     '')
     (mkRemovedOptionModule [ "security" "pam" "enableEcryptfs" ] ''
-      security.pam.enableFscrypt was removed since it was unmaintained in nixpkgs.
+      security.pam.enableEcryptfs was removed since it was unmaintained in nixpkgs.
     '')
     (mkRemovedOptionModule [ "security" "rngd" ] ''
       rngd is not necessary for any device that the kernel recognises

nixos/modules/security/pam.nix

@@ -1832,11 +1832,6 @@ let
     else
       config.users.motdFile;
 
-  makePAMService = name: service: {
-    name = "pam.d/${name}";
-    value.source = pkgs.writeText "${name}.pam" service.text;
-  };
-
   optionalSudoConfigForSSHAgentAuth =
     lib.optionalString (config.security.pam.sshAgentAuth.enable || config.security.pam.rssh.enable)
       ''
@@ -2648,7 +2643,26 @@ in
       };
     };
 
-    environment.etc = lib.mapAttrs' makePAMService enabledServices;
+    environment.etc =
+      let
+        # Write all pam config in a single derivation for performance
+        pamd =
+          pkgs.runCommand "pam.d"
+            {
+              __structuredAttrs = true;
+              services = lib.mapAttrs (_: svc: svc.text) enabledServices;
+            }
+            ''
+              mkdir $out
+              for i in "''${!services[@]}"; do
+                printf '%s' "''${services[$i]}" > "$out/$i"
+              done
+            '';
+      in
+      lib.mapAttrs' (name: service: {
+        name = "pam.d/${name}";
+        value.source = "${pamd}/${name}";
+      }) enabledServices;
 
     systemd =
       lib.mkIf (lib.any (service: service.lastlog.enable) (lib.attrValues config.security.pam.services))

nixos/modules/services/admin/komodo-periphery.nix

@@ -8,41 +8,65 @@ let
   cfg = config.services.komodo-periphery;
   settingsFormat = pkgs.formats.toml { };
 
+  actualRepoDir = if cfg.repoDir != null then cfg.repoDir else "${cfg.rootDirectory}/repos";
+  actualStackDir = if cfg.stackDir != null then cfg.stackDir else "${cfg.rootDirectory}/stacks";
+  actualBuildDir = if cfg.buildDir != null then cfg.buildDir else "${cfg.rootDirectory}/builds";
+
   genFinalSettings =
     let
+      actualServerEnabled =
+        if cfg.inbound.serverEnabled != null then
+          cfg.inbound.serverEnabled
+        else
+          (cfg.outbound.coreAddress == "");
+
+      hasAnyPrivateKey = cfg.auth.privateKey != "";
+
       baseSettings = {
-        port = cfg.port;
-        bind_ip = cfg.bindIp;
-        root_directory = cfg.rootDirectory;
-        repo_dir = "${cfg.rootDirectory}/repos";
-        stack_dir = "${cfg.rootDirectory}/stacks";
-        ssl_enabled = cfg.ssl.enable;
+        default_terminal_command = cfg.defaultTerminalCommand;
+        disable_terminals = cfg.disableTerminals;
+        disable_container_terminals = cfg.disableContainerTerminals;
+
+        stats_polling_rate = cfg.statsPollingRate;
+        container_stats_polling_rate = cfg.containerStatsPollingRate;
+        legacy_compose_cli = cfg.legacyComposeCli;
+
+        include_disk_mounts = cfg.includeDiskMounts;
+        exclude_disk_mounts = cfg.excludeDiskMounts;
+
+        # When a private key is explicitly configured, it's passed via env var.
+        # Otherwise, use the default file path so Periphery auto-generates a key.
+        private_key = if !hasAnyPrivateKey then "file:${cfg.rootDirectory}/keys/periphery.key" else "";
+        core_public_keys = [ ];
+        passkeys = [ ];
+
+        server_enabled = actualServerEnabled;
+        port = cfg.inbound.port;
+        bind_ip = cfg.inbound.bindIp;
+        allowed_ips = cfg.inbound.allowedIps;
+        ssl_enabled = cfg.inbound.ssl.enable;
       }
-      // lib.optionalAttrs cfg.ssl.enable {
-        ssl_key_file = cfg.ssl.keyFile;
-        ssl_cert_file = cfg.ssl.certFile;
+      // {
+        core_address = cfg.outbound.coreAddress;
+        connect_as = cfg.outbound.connectAs;
+        onboarding_key = "";
       }
       // {
         logging = {
           level = cfg.logging.level;
           stdio = cfg.logging.stdio;
+          opentelemetry_service_name = cfg.logging.opentelemetryServiceName;
+          opentelemetry_scope_name = cfg.logging.opentelemetryScopeName;
+          pretty = cfg.logging.pretty;
         }
         // lib.optionalAttrs (cfg.logging.otlpEndpoint != "") {
           otlp_endpoint = cfg.logging.otlpEndpoint;
         };
-        allowed_ips = cfg.allowedIps;
-        passkeys = cfg.passkeys;
-        disable_terminals = cfg.disableTerminals;
-        disable_container_exec = cfg.disableContainerExec;
-        stats_polling_rate = cfg.statsPollingRate;
-        container_stats_polling_rate = cfg.containerStatsPollingRate;
-        legacy_compose_cli = cfg.legacyComposeCli;
-        include_disk_mounts = cfg.includeDiskMounts;
-        exclude_disk_mounts = cfg.excludeDiskMounts;
+        pretty_startup_config = cfg.prettyStartupConfig;
       }
       // cfg.extraSettings;
     in
-    lib.filterAttrsRecursive (_: v: v != null && v != { } && v != [ ]) baseSettings;
+    lib.filterAttrsRecursive (_: v: v != null && v != { } && v != [ ] && v != "") baseSettings;
 
   configFile =
     if cfg.configFile == null then
@@ -51,36 +75,98 @@ let
       cfg.configFile;
 in
 {
+  imports = with lib; [
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "port" ]
+      [ "services" "komodo-periphery" "inbound" "port" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "bindIp" ]
+      [ "services" "komodo-periphery" "inbound" "bindIp" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "allowedIps" ]
+      [ "services" "komodo-periphery" "inbound" "allowedIps" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "ssl" "enable" ]
+      [ "services" "komodo-periphery" "inbound" "ssl" "enable" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "ssl" "keyFile" ]
+      [ "services" "komodo-periphery" "inbound" "ssl" "keyFile" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "ssl" "certFile" ]
+      [ "services" "komodo-periphery" "inbound" "ssl" "certFile" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "serverEnabled" ]
+      [ "services" "komodo-periphery" "inbound" "serverEnabled" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "disableContainerExec" ]
+      [ "services" "komodo-periphery" "disableContainerTerminals" ]
+    )
+    (mkRemovedOptionModule [ "services" "komodo-periphery" "passkeys" ]
+      "services.komodo-periphery.passkeys has been removed. Use passkeyFiles for v1.X compatibility, or migrate to auth.privateKey and auth.corePublicKeys (v2.0+)."
+    )
+    (mkRemovedOptionModule [ "services" "komodo-periphery" "outbound" "onboardingKey" ]
+      "services.komodo-periphery.outbound.onboardingKey has been removed. Use outbound.onboardingKeyFile instead for better security."
+    )
+  ];
+
   options.services.komodo-periphery = {
     enable = lib.mkEnableOption "Periphery, a multi-server Docker and Git deployment agent by Komodo";
 
     package = lib.mkPackageOption pkgs "komodo" { };
 
-    configFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
+    dockerHost = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
-      description = "Path to the periphery configuration file. If null, a configuration file will be generated from the module options.";
+      description = ''
+        Docker host socket URI to use for container operations.
+        If null, uses the default Docker socket and automatically enables Docker.
+        Set this to use alternative container runtimes like Podman or remote Docker hosts.
+      '';
       example = lib.literalExpression ''
-        pkgs.writeText "periphery.toml" '''
-          port = 8120
-          bind_ip = "[::]"
-          ssl_enabled = true
-          [logging]
-          level = "info"
-        '''
+        # Podman rootless
+        "unix:///run/user/1000/podman/podman.sock"
+
+        # Podman rootful
+        "unix:///run/podman/podman.sock"
+
+        # Remote Docker
+        "tcp://192.168.1.100:2375"
       '';
     };
 
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 8120;
-      description = "Port for the Periphery agent to listen on.";
-    };
+    configFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Path to the Periphery configuration file.
 
-    bindIp = lib.mkOption {
-      type = lib.types.str;
-      default = "[::]";
-      description = "IP address to bind to.";
+        - If `null` (default), a configuration file will be automatically generated
+          from the module options (recommended for most users).
+        - If set to a path, that file will be used directly as the configuration file.
+        - You can also use `pkgs.writeText` to write configuration inline in your NixOS configuration.
+
+        When using a custom config file, all other module options (except `package`, `user`, `group`,
+        `environment`, and `environmentFile`) will be ignored.
+      '';
+      example = lib.literalExpression ''
+        # Option 1: Use an existing config file
+        "/etc/komodo/periphery.toml"
+
+        # Option 2: Write config inline using pkgs.writeText
+        pkgs.writeText "periphery.toml" '''
+          root_directory = "/var/lib/komodo-periphery"
+
+          logging.level = "info"
+          logging.stdio = "standard"
+        '''
+      '';
     };
 
     rootDirectory = lib.mkOption {
@@ -89,24 +175,25 @@ in
       description = "Root directory for Komodo Periphery data.";
     };
 
-    ssl = {
-      enable = lib.mkEnableOption "SSL/TLS support" // {
-        default = true;
-      };
+    repoDir = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/repos"'';
+      description = "Directory for Komodo Periphery to manage repos. If null, defaults to `\${rootDirectory}/repos`.";
+    };
 
-      keyFile = lib.mkOption {
-        type = lib.types.path;
-        default = "${cfg.rootDirectory}/ssl/key.pem";
-        defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/key.pem"'';
-        description = "Path to SSL key file.";
-      };
+    stackDir = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/stacks"'';
+      description = "Directory for Komodo Periphery to manage stacks. If null, defaults to `\${rootDirectory}/stacks`.";
+    };
 
-      certFile = lib.mkOption {
-        type = lib.types.path;
-        default = "${cfg.rootDirectory}/ssl/cert.pem";
-        defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/cert.pem"'';
-        description = "Path to SSL certificate file.";
-      };
+    buildDir = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/builds"'';
+      description = "Directory for Komodo Periphery to manage builds. If null, defaults to `\${rootDirectory}/builds`.";
     };
 
     logging = {
@@ -139,26 +226,41 @@ in
         description = "OpenTelemetry OTLP endpoint for traces.";
         example = "http://localhost:4317";
       };
+
+      opentelemetryServiceName = lib.mkOption {
+        type = lib.types.str;
+        default = "Periphery";
+        description = "(v2.0+) OpenTelemetry service name attached to telemetry.";
+      };
+
+      opentelemetryScopeName = lib.mkOption {
+        type = lib.types.str;
+        default = "Komodo";
+        description = "(v2.0+) OpenTelemetry scope name attached to telemetry.";
+      };
+
+      pretty = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "(v2.0+) Enable human-readable logging (multi-line).";
+      };
     };
 
-    allowedIps = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      description = "IP addresses or subnets allowed to call the periphery API. Empty list allows all.";
-      example = [
-        "::ffff:12.34.56.78"
-        "10.0.10.0/24"
-      ];
+    prettyStartupConfig = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "(v2.0+) Enable human-readable startup config log (multi-line).";
     };
 
-    passkeys = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
+    passkeyFiles = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
       description = ''
-        Passkeys required to access the periphery API.
-        WARNING: These will be stored in the Nix store in plain text!
+        Path to file containing passkeys (v1.X compatibility).
+        This will be passed via `PERIPHERY_PASSKEYS_FILE` environment variable.
+        Consider migrating to the new v2.0+ authentication mechanism.
       '';
-      example = [ "your-secure-passkey" ];
+      example = "/run/secrets/komodo-passkey";
     };
 
     extraSettings = lib.mkOption {
@@ -170,16 +272,23 @@ in
       };
     };
 
+    defaultTerminalCommand = lib.mkOption {
+      type = lib.types.str;
+      default = "bash";
+      description = "(v2.0+) Default terminal command used to initialize the shell.";
+      example = "zsh";
+    };
+
     disableTerminals = lib.mkOption {
       type = lib.types.bool;
       default = false;
       description = "Disable remote shell access through Periphery.";
     };
 
-    disableContainerExec = lib.mkOption {
+    disableContainerTerminals = lib.mkOption {
       type = lib.types.bool;
       default = false;
-      description = "Disable remote container shell access through Periphery.";
+      description = "(v2.0+) Disable remote container shell access through Periphery.";
     };
 
     statsPollingRate = lib.mkOption {
@@ -222,6 +331,147 @@ in
       ];
     };
 
+    auth = {
+      privateKey = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          (v2.0+) Private key used with the Noise handshake.
+
+          Use `file:/path/to/file` prefix to load from a file. If the file doesn't exist,
+          Periphery will generate and write a new key to the path.
+
+          If empty, defaults to `file:''${rootDirectory}/keys/periphery.key`.
+        '';
+        example = lib.literalExpression ''
+          # Reference a secret file
+          "file:''${config.age.secrets.komodo-private-key.path}"
+
+          # Or direct path
+          "file:/run/secrets/komodo-private-key"
+        '';
+      };
+
+      corePublicKeys = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = ''
+          (v2.0+) Accepted public keys to allow Core(s) to connect.
+          Accepts Spki base64 DER directly or can reference files using `file:/path/to/core.pub` prefix.
+          You can mix direct keys and file references.
+
+          For better security, use the `file:` prefix to reference secret files.
+        '';
+        example = lib.literalExpression ''
+          [
+            # Direct key value
+            "MCowBQYDK2VuAyEATZgrjGHeF0KJUe0+n77+qAWOg3YzEzXOmQWaRgO3OGQ="
+            # Reference secret files
+            "file:''${config.age.secrets.komodo-core1-pub.path}"
+            "file:''${config.age.secrets.komodo-core2-pub.path}"
+          ]
+        '';
+      };
+    };
+
+    inbound = {
+      serverEnabled = lib.mkOption {
+        type = lib.types.nullOr lib.types.bool;
+        default = null;
+        description = ''
+          Enable the inbound connection server for Core -> Periphery connections.
+          If null, defaults to false when `outbound.coreAddress` is defined, otherwise true.
+        '';
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 8120;
+        description = "Port for the inbound Periphery server to listen on.";
+      };
+
+      bindIp = lib.mkOption {
+        type = lib.types.str;
+        default = "[::]";
+        description = ''
+          IP address the periphery server will bind to.
+          The default allows external IPv4 and IPv6 connections.
+        '';
+      };
+
+      allowedIps = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = ''
+          Limit the IP addresses which can connect to Periphery.
+          Supports IPv4/IPv6 addresses and subnets.
+          Empty list allows all connections.
+        '';
+        example = [
+          "::ffff:12.34.56.78"
+          "10.0.10.0/24"
+        ];
+      };
+
+      ssl = {
+        enable = lib.mkEnableOption "(v2.0+) SSL/TLS support for inbound connections" // {
+          default = true;
+        };
+
+        keyFile = lib.mkOption {
+          type = lib.types.path;
+          default = "${cfg.rootDirectory}/ssl/key.pem";
+          defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/key.pem"'';
+          description = ''
+            Path to SSL key file.
+            If the file doesn't exist and SSL is enabled, self-signed keys will be generated using openssl.
+          '';
+        };
+
+        certFile = lib.mkOption {
+          type = lib.types.path;
+          default = "${cfg.rootDirectory}/ssl/cert.pem";
+          defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/cert.pem"'';
+          description = ''
+            Path to SSL certificate file.
+            If the file doesn't exist and SSL is enabled, self-signed certificate will be generated using openssl.
+          '';
+        };
+      };
+    };
+
+    outbound = {
+      coreAddress = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          (v2.0+) The address of Komodo Core. Must be reachable from this host.
+          If provided, Periphery will operate in outbound mode.
+        '';
+        example = "demo.komo.do";
+      };
+
+      connectAs = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          (v2.0+) The Server this Periphery agent should connect as.
+          Must match an existing Server name or id.
+        '';
+        example = "server-name";
+      };
+
+      onboardingKeyFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        description = ''
+          (v2.0+) Path to file containing the onboarding key.
+          This will be passed via `PERIPHERY_ONBOARDING_KEY_FILE` environment variable.
+        '';
+        example = lib.literalExpression ''"''${config.age.secrets.komodo-onboarding.path}"'';
+      };
+    };
+
     user = lib.mkOption {
       type = lib.types.str;
       default = "komodo-periphery";
@@ -253,14 +503,14 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    virtualisation.docker.enable = true;
+    virtualisation.docker.enable = lib.mkDefault (cfg.dockerHost == null);
 
     users.users.${cfg.user} = lib.mkIf (cfg.user == "komodo-periphery") {
       isSystemUser = true;
       group = cfg.group;
       description = "Komodo Periphery service user";
       home = cfg.rootDirectory;
-      extraGroups = [ "docker" ];
+      extraGroups = lib.optional (cfg.dockerHost == null) "docker";
     };
 
     users.groups.${cfg.group} = lib.mkIf (cfg.group == "komodo-periphery") { };
@@ -271,16 +521,26 @@ in
         user = cfg.user;
         group = cfg.group;
       };
-      "${cfg.rootDirectory}/repos".d = {
+      "${actualRepoDir}".d = {
         mode = "0755";
         user = cfg.user;
         group = cfg.group;
       };
-      "${cfg.rootDirectory}/stacks".d = {
+      "${actualStackDir}".d = {
         mode = "0755";
         user = cfg.user;
         group = cfg.group;
       };
+      "${actualBuildDir}".d = {
+        mode = "0755";
+        user = cfg.user;
+        group = cfg.group;
+      };
+      "${cfg.rootDirectory}/keys".d = {
+        mode = "0700";
+        user = cfg.user;
+        group = cfg.group;
+      };
       "${cfg.rootDirectory}/ssl".d = {
         mode = "0700";
         user = cfg.user;
@@ -292,35 +552,63 @@ in
       description = "Komodo Periphery - Multi-server Docker and Git deployment agent";
       after = [
         "network-online.target"
-        "docker.service"
-      ];
+      ]
+      ++ lib.optional (cfg.dockerHost == null) "docker.service";
       wants = [
         "network-online.target"
-        "docker.service"
-      ];
+      ]
+      ++ lib.optional (cfg.dockerHost == null) "docker.service";
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
         Type = "simple";
         User = cfg.user;
         Group = cfg.group;
-        SupplementaryGroups = [ "docker" ];
+        SupplementaryGroups = lib.mkIf (cfg.dockerHost == null) [ "docker" ];
         Restart = "on-failure";
         RestartSec = "10s";
         WorkingDirectory = cfg.rootDirectory;
 
         ExecStart = lib.escapeShellArgs [
-          "${lib.getExe' cfg.package "periphery"}"
+          (lib.getExe' cfg.package "periphery")
           "--config-path"
-          (if cfg.configFile != null then cfg.configFile else configFile)
+          configFile
         ];
 
         Environment = lib.mapAttrsToList (name: value: "${name}=${value}") (
-          cfg.environment
-          // lib.optionalAttrs (!cfg.disableTerminals) {
-            PATH = "/run/current-system/sw/bin:/run/wrappers/bin";
+          lib.optionalAttrs (cfg.configFile == null) {
+            PERIPHERY_ROOT_DIRECTORY = cfg.rootDirectory;
+            PERIPHERY_REPO_DIR = actualRepoDir;
+            PERIPHERY_STACK_DIR = actualStackDir;
+            PERIPHERY_BUILD_DIR = actualBuildDir;
           }
+          // lib.optionalAttrs (cfg.configFile == null && cfg.inbound.ssl.enable) {
+            PERIPHERY_SSL_KEY_FILE = cfg.inbound.ssl.keyFile;
+            PERIPHERY_SSL_CERT_FILE = cfg.inbound.ssl.certFile;
+          }
+          // lib.optionalAttrs (cfg.dockerHost != null) {
+            DOCKER_HOST = cfg.dockerHost;
+          }
+          // lib.optionalAttrs (cfg.passkeyFiles != null) {
+            PERIPHERY_PASSKEYS_FILE = cfg.passkeyFiles;
+          }
+          // lib.optionalAttrs (cfg.auth.privateKey != "") {
+            PERIPHERY_PRIVATE_KEY = cfg.auth.privateKey;
+          }
+          // lib.optionalAttrs (cfg.auth.corePublicKeys != [ ]) {
+            PERIPHERY_CORE_PUBLIC_KEYS = lib.concatStringsSep "," cfg.auth.corePublicKeys;
+          }
+          // lib.optionalAttrs (cfg.outbound.onboardingKeyFile != null) {
+            PERIPHERY_ONBOARDING_KEY_FILE = cfg.outbound.onboardingKeyFile;
+          }
+          // cfg.environment
         );
+
+        ExecSearchPath = lib.mkIf (!cfg.disableTerminals) [
+          "/run/current-system/sw/bin"
+          "/run/wrappers/bin"
+        ];
+
         EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
 
         StateDirectory = "komodo-periphery";
@@ -329,7 +617,7 @@ in
         NoNewPrivileges = true;
         PrivateTmp = true;
         ProtectSystem = "full";
-        ProtectHome = true;
+        ProtectHome = "read-only";
       };
     };
   };

nixos/modules/services/desktops/seatd.nix

@@ -40,7 +40,6 @@ in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
       seatd
-      sdnotify-wrapper
     ];
     users.groups.seat = lib.mkIf (cfg.group == "seat") { };
 
@@ -55,7 +54,7 @@ in
         Type = "notify";
         NotifyAccess = "all";
         SyslogIdentifier = "seatd";
-        ExecStart = "${pkgs.sdnotify-wrapper}/bin/sdnotify-wrapper ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
+        ExecStart = "${lib.getExe' pkgs.s6 "s6-notify-socket-from-fd"} ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
         RestartSec = 1;
         Restart = "always";
       };

nixos/modules/services/hardware/sane_extra_backends/brscan5_etc_files.nix

@@ -58,17 +58,17 @@ stdenv.mkDerivation {
   dontConfigure = true;
 
   buildPhase = ''
-    TARGET_DIR="$out/etc/opt/brother/scanner/brscan5"
+    TARGET_DIR="$out/tmp"
     mkdir -p "$TARGET_DIR"
     cp -rp "./models" "$TARGET_DIR"
     cp -rp "./brscan5.ini" "$TARGET_DIR"
     cp -rp "./brsanenetdevice.cfg" "$TARGET_DIR"
-
     export NIX_REDIRECTS="/etc/opt/brother/scanner/brscan5/=$TARGET_DIR/"
-
     printf '${addAllNetDev netDevices}\n'
-
     ${addAllNetDev netDevices}
+
+    mkdir -p "$out/etc/opt/brother/scanner/brscan5"
+    mv -T "$TARGET_DIR" "$out/etc/opt/brother/scanner/brscan5"
   '';
 
   dontInstall = true;

nixos/modules/services/mail/stalwart.nix

@@ -57,7 +57,7 @@ in
       default = { };
       description = ''
         Configuration options for the Stalwart server.
-        See <https://stalw.art/docs/category/configuration> for available options.
+        See <https://stalw.art/docs/configuration> for available options.
 
         By default, the module is configured to store everything locally.
       '';

nixos/modules/services/misc/errbot.nix

@@ -91,6 +91,20 @@ in
     };
     users.groups.errbot = { };
 
+    systemd.tmpfiles.settings = {
+      "10-errbot" = lib.mapAttrs' (
+        name: instanceCfg:
+        let
+          dataDir = if instanceCfg.dataDir != null then instanceCfg.dataDir else "/var/lib/errbot/${name}";
+        in
+        lib.nameValuePair "${dataDir}".d {
+          group = "errbot";
+          user = "errbot";
+          mode = "0755";
+        }
+      ) cfg.instances;
+    };
+
     systemd.services = lib.mapAttrs' (
       name: instanceCfg:
       lib.nameValuePair "errbot-${name}" (
@@ -103,12 +117,7 @@ in
           serviceConfig = {
             User = "errbot";
             Restart = "on-failure";
-            ExecStartPre = [
-              "${lib.getExe' pkgs.coreutils "mkdir"} -p ${dataDir}"
-              "${lib.getExe' pkgs.coreutils "chown"} -R errbot:errbot ${dataDir}"
-            ];
             ExecStart = "${pkgs.errbot}/bin/errbot -c ${mkConfigDir instanceCfg dataDir}/config.py";
-            PermissionsStartOnly = true;
           };
         }
       )

nixos/modules/services/misc/graphical-desktop.nix

@@ -22,17 +22,23 @@ in
 
   config = lib.mkIf cfg.enable {
     environment = {
-      # localectl looks into 00-keyboard.conf
-      etc."X11/xorg.conf.d/00-keyboard.conf".text = ''
-        Section "InputClass"
-          Identifier "Keyboard catchall"
-          MatchIsKeyboard "on"
-          Option "XkbModel" "${xcfg.xkb.model}"
-          Option "XkbLayout" "${xcfg.xkb.layout}"
-          Option "XkbOptions" "${xcfg.xkb.options}"
-          Option "XkbVariant" "${xcfg.xkb.variant}"
-        EndSection
-      '';
+      # systemd-localed looks into 00-keyboard.conf
+      # systemd-localed does not like if Option values are ""
+      etc."X11/xorg.conf.d/00-keyboard.conf".text =
+        let
+          optionLine =
+            name: value: lib.optionalString (value != null && value != "") ''Option "${name}" "${value}"'';
+        in
+        ''
+          Section "InputClass"
+            Identifier "Keyboard catchall"
+            MatchIsKeyboard "on"
+            ${optionLine "XkbModel" xcfg.xkb.model}
+            ${optionLine "XkbLayout" xcfg.xkb.layout}
+            ${optionLine "XkbOptions" xcfg.xkb.options}
+            ${optionLine "XkbVariant" xcfg.xkb.variant}
+          EndSection
+        '';
       systemPackages = with pkgs; [
         nixos-icons # needed for gnome and pantheon about dialog, nixos-manual and maybe more
         xdg-utils

nixos/modules/services/misc/redmine.nix

@@ -460,7 +460,7 @@ in
         Group = cfg.group;
         TimeoutSec = "300";
         WorkingDirectory = "${cfg.package}/share/redmine";
-        ExecStart = "${bundle} exec rails server -u webrick -e production -b ${toString cfg.address} -p ${toString cfg.port} -P '${cfg.stateDir}/redmine.pid'";
+        ExecStart = "${bundle} exec rails server -u webrick -e production -b ${toString cfg.address} -p ${toString cfg.port}";
         RuntimeDirectory = "redmine";
         RuntimeDirectoryMode = "0750";
         AmbientCapabilities = "";

nixos/modules/services/monitoring/prometheus/exporters/imap-mailstat.nix

@@ -94,8 +94,8 @@ in
     serviceConfig = {
       ExecStart = ''
         ${pkgs.prometheus-imap-mailstat-exporter}/bin/imap-mailstat-exporter \
-          -config ${createConfigFile cfg.accounts} \
-          ${optionalString cfg.oldestUnseenDate "-oldestunseendate"} \
+          --config.file="${createConfigFile cfg.accounts}" \
+          ${optionalString cfg.oldestUnseenDate "--oldestunseen.feature"} \
           ${concatStringsSep " \\\n  " cfg.extraFlags}
       '';
     };

nixos/modules/services/monitoring/traccar.nix

@@ -102,7 +102,7 @@ in
           ${lib.getExe pkgs.envsubst} \
             -i ${configuration} \
             -o ${configFilePath}
-          umask $old_umask
+          umask "$old_umask"
         '';
 
         serviceConfig = {

nixos/modules/services/monitoring/vnstat.nix

@@ -6,17 +6,32 @@
 }:
 let
   cfg = config.services.vnstat;
+  settingsFormat = pkgs.formats.keyValue { };
 in
 {
   options.services.vnstat = {
     enable = lib.mkEnableOption "update of network usage statistics via vnstatd";
     package = lib.mkPackageOption pkgs "vnstat" { };
+    settings = lib.mkOption {
+      type = lib.types.submodule { freeformType = settingsFormat.type; };
+      default = { };
+      description = ''
+        Configuration for vnstat. Refer to
+        [https://humdi.net/vnstat/man/vnstat.conf.html]
+        or {manpage}`vnstat.conf(5)` for more information.
+      '';
+      example = {
+        AlwaysAddNewInterfaces = 1;
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ cfg.package ];
 
+    environment.etc."vnstat.conf".source = settingsFormat.generate "vnstat.conf" cfg.settings;
+
     users = {
       groups.vnstatd = { };
 
@@ -59,4 +74,8 @@ in
       };
     };
   };
+
+  meta = {
+    maintainers = with lib.maintainers; [ hmenke ];
+  };
 }

nixos/modules/services/network-filesystems/rsyncd.nix

@@ -132,7 +132,7 @@ in
           description = "socket for fast remote file copy program daemon";
           conflicts = [ "rsync.service" ];
 
-          listenStreams = [ (toString cfg.port) ];
+          listenStreams = [ cfg.port ];
           socketConfig.Accept = true;
 
           wantedBy = [ "sockets.target" ];

nixos/modules/services/networking/anubis.nix

@@ -374,6 +374,10 @@ in
       anubis = { };
     };
 
+    systemd.slices.system-anubis = {
+      description = "Anubis AI Firewall System Slice";
+      documentation = [ "https://anubis.techaro.lol" ];
+    };
     systemd.services = lib.mapAttrs' (
       name: instance:
       lib.nameValuePair "${instanceName name}" {
@@ -396,6 +400,7 @@ in
         );
 
         serviceConfig = {
+          Slice = "system-anubis.slice";
           User = instance.user;
           Group = instance.group;
           DynamicUser = true;

nixos/modules/services/networking/headplane.nix

@@ -44,7 +44,7 @@ in
     settings = mkOption {
       description = ''
         Headplane configuration options. Generates a YAML config file.
-        See: https://github.com/tale/headplane/blob/main/config.example.yaml
+        See <https://github.com/tale/headplane/blob/main/config.example.yaml>.
       '';
       type = types.submodule {
         options = {
@@ -129,6 +129,16 @@ in
           headscale = mkOption {
             type = types.submodule {
               options = {
+                api_key_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    Path to a file containing a Headscale API key.
+                    This is required for OIDC authentication aswell for the Headplane agent.
+                  '';
+                  example = lib.literalExpression "config.sops.secrets.headplane_pre_authkey.path";
+                };
+
                 url = mkOption {
                   type = types.str;
                   default = "http://127.0.0.1:${toString config.services.headscale.port}";
@@ -211,15 +221,6 @@ in
                           '';
                         };
 
-                        pre_authkey_path = mkOption {
-                          type = types.nullOr types.path;
-                          default = null;
-                          description = ''
-                            Path to a file containing a Headscale pre-auth key for the agent.
-                          '';
-                          example = lib.literalExpression "config.sops.secrets.headplane_pre_authkey.path";
-                        };
-
                         executable_path = mkOption {
                           type = types.path;
                           readOnly = true;
@@ -237,20 +238,14 @@ in
                         };
 
                         cache_ttl = mkOption {
-                          type = types.nullOr types.int;
-                          default = null;
+                          type = types.ints.positive;
+                          default = 180000;
                           description = ''
-                            Deprecated cache TTL for the agent. This option is accepted
-                            by Headplane 0.6.2 but has no effect.
+                            How long to cache agent information (in milliseconds).
+                            If you want data to update faster, reduce the TTL, but this will increase the frequency of requests to Headscale.
                           '';
                         };
 
-                        cache_path = mkOption {
-                          type = types.path;
-                          default = "/var/lib/headplane/agent_cache.json";
-                          description = "The path to store the agent's cache.";
-                        };
-
                         work_dir = mkOption {
                           type = types.path;
                           default = "/var/lib/headplane/agent";
@@ -325,16 +320,6 @@ in
                     example = lib.literalExpression "config.sops.secrets.oidc_client_secret.path";
                   };
 
-                  headscale_api_key_path = mkOption {
-                    type = types.nullOr types.path;
-                    default = null;
-                    description = ''
-                      Path to a file containing the Headscale API key.
-                      Required for OIDC authentication.
-                    '';
-                    example = lib.literalExpression "config.sops.secrets.headscale_api_key.path";
-                  };
-
                   disable_api_key_login = mkOption {
                     type = types.bool;
                     default = false;
@@ -366,25 +351,6 @@ in
                     '';
                   };
 
-                  redirect_uri = mkOption {
-                    type = types.nullOr types.str;
-                    default = null;
-                    description = ''
-                      Deprecated OIDC redirect URI. Use services.headplane.settings.server.base_url
-                      instead; Headplane derives the callback URL from it.
-                    '';
-                    example = "https://headplane.example.com/admin/oidc/callback";
-                  };
-
-                  strict_validation = mkOption {
-                    type = types.nullOr types.bool;
-                    default = null;
-                    description = ''
-                      Deprecated OIDC validation setting. This option is accepted
-                      by Headplane 0.6.2 but has no effect.
-                    '';
-                  };
-
                   profile_picture_source = mkOption {
                     type = types.enum [
                       "oidc"
@@ -429,16 +395,6 @@ in
                     description = "Custom userinfo endpoint URL.";
                     example = "https://provider.example.com/userinfo";
                   };
-
-                  user_storage_file = mkOption {
-                    type = types.nullOr types.path;
-                    default = null;
-                    description = ''
-                      Deprecated path to the pre-0.6.2 JSON user database.
-                      Headplane uses this once to migrate users into its internal database.
-                    '';
-                    example = "/var/lib/headplane/users.json";
-                  };
                 };
               }
             );
@@ -452,33 +408,6 @@ in
   };
 
   config = mkIf cfg.enable {
-    warnings =
-      lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.redirect_uri != null) [
-        ''
-          services.headplane.settings.oidc.redirect_uri is deprecated by Headplane 0.6.2.
-          Use services.headplane.settings.server.base_url instead; Headplane derives
-          the OIDC callback URL from it.
-        ''
-      ]
-      ++ lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.strict_validation != null) [
-        ''
-          services.headplane.settings.oidc.strict_validation is deprecated and has no effect
-          in Headplane 0.6.2.
-        ''
-      ]
-      ++ lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.user_storage_file != null) [
-        ''
-          services.headplane.settings.oidc.user_storage_file is deprecated. Headplane 0.6.2
-          uses it only to migrate the pre-0.6.2 JSON user database into the internal database.
-        ''
-      ]
-      ++ lib.optionals (agentSettings != null && agentSettings.cache_ttl != null) [
-        ''
-          services.headplane.settings.integration.agent.cache_ttl is deprecated and has no
-          effect in Headplane 0.6.2.
-        ''
-      ];
-
     assertions = [
       {
         assertion = config.services.headscale.enable;
@@ -502,26 +431,25 @@ in
         '';
       }
       {
-        assertion = cfg.settings.oidc == null || cfg.settings.oidc.headscale_api_key_path != null;
+        assertion = cfg.settings.oidc == null || cfg.settings.headscale.api_key_path != null;
         message = ''
-          services.headplane.settings.oidc.headscale_api_key_path must be set
-          when services.headplane.settings.oidc is non-null. Headplane's OIDC
-          flow requires a Headscale API key to mint sessions.
+          services.headplane.settings.headscale.api_key_path must be set
+          when services.headplane.settings.oidc is non-null.
+          Headplane's OIDC flow requires a Headscale API key to mint sessions.
         '';
       }
       {
         assertion =
-          agentSettings == null || !agentSettings.enabled || agentSettings.pre_authkey_path != null;
+          agentSettings == null || !agentSettings.enabled || cfg.settings.headscale.api_key_path != null;
         message = ''
-          services.headplane.settings.integration.agent.pre_authkey_path must be set
-          when the agent is enabled.
+          services.headplane.settings.headscale.api_key_path must be set when the agent is enabled.
         '';
       }
     ];
 
     environment = {
       systemPackages = [ cfg.package ];
-      etc."headplane/config.yaml".source = "${settingsFile}";
+      etc."headplane/config.yaml".source = settingsFile;
     };
 
     systemd.services.headplane = {
@@ -534,6 +462,7 @@ in
         config.systemd.services.headscale.name
       ];
       requires = [ config.systemd.services.headscale.name ];
+      restartTriggers = [ settingsFile ];
 
       environment = {
         HEADPLANE_DEBUG_LOG = toString cfg.debug;

nixos/modules/services/networking/networkd-dispatcher.nix

@@ -93,8 +93,8 @@ in
 
   config = mkIf cfg.enable {
 
-    warnings = mkIf (!config.networking.useNetworkd) [
-      "services.networkd-dispatcher will not execute any scripts unless networking.useNetworkd is enabled."
+    warnings = mkIf (!config.systemd.network.enable) [
+      "services.networkd-dispatcher will not execute any scripts unless networkd is enabled, either via `systemd.network.enable` or via `networking.useNetworkd`."
     ];
 
     systemd = {

nixos/modules/services/networking/ssh/sshd.nix

@@ -232,6 +232,10 @@ in
       "openssh"
       "banner"
     ] "Use services.openssh.settings.Banner instead.")
+    (lib.mkRenamedOptionModule
+      [ "services" "openssh" "moduliFile" ]
+      [ "services" "openssh" "settings" "ModuliFile" ]
+    )
   ];
 
   ###### interface
@@ -729,6 +733,14 @@ in
                 '';
                 example = "/etc/ssh/banner";
               };
+              ModuliFile = lib.mkOption {
+                type = lib.types.path;
+                default = "${config.services.openssh.package}/etc/ssh/moduli";
+                defaultText = lib.literalExpression ''"''${config.services.openssh.package}/etc/ssh/moduli"'';
+                description = ''
+                  Specifies the {manpage}`moduli(5)` file to use for Diffie-Hellman key exchange.
+                '';
+              };
             };
           }
         );
@@ -740,16 +752,6 @@ in
         description = "Verbatim contents of {file}`sshd_config`.";
       };
 
-      moduliFile = lib.mkOption {
-        example = "/etc/my-local-ssh-moduli;";
-        type = lib.types.path;
-        description = ''
-          Path to `moduli` file to install in
-          `/etc/ssh/moduli`. If this option is unset, then
-          the `moduli` file shipped with OpenSSH will be used.
-        '';
-      };
-
     };
 
     users.users = lib.mkOption {
@@ -770,14 +772,12 @@ in
       };
       users.groups.sshd = { };
 
-      services.openssh.moduliFile = lib.mkDefault "${cfg.package}/etc/ssh/moduli";
       services.openssh.sftpServerExecutable = lib.mkDefault "${cfg.package}/libexec/sftp-server";
 
       environment.etc =
         authKeysFiles
         // authPrincipalsFiles
         // {
-          "ssh/moduli".source = cfg.moduliFile;
           "ssh/sshd_config".source = sshconf;
         };
 

nixos/modules/services/security/authelia.nix

@@ -268,15 +268,6 @@ let
       };
     };
 
-  writeOidcJwksConfigFile =
-    oidcIssuerPrivateKeyFile:
-    pkgs.writeText "oidc-jwks.yaml" ''
-      identity_providers:
-        oidc:
-          jwks:
-            - key: {{ secret "${oidcIssuerPrivateKeyFile}" | mindent 10 "|" | msquote }}
-    '';
-
   # Remove an attribute in a nested set
   # https://discourse.nixos.org/t/modify-an-attrset-in-nix/29919/5
   removeAttrByPath =
@@ -362,7 +353,12 @@ in
           execCommand = "${instance.package}/bin/authelia";
           configFile = format.generate "config.yml" cleanedSettings;
           oidcJwksConfigFile = lib.optional (instance.secrets.oidcIssuerPrivateKeyFile != null) (
-            writeOidcJwksConfigFile instance.secrets.oidcIssuerPrivateKeyFile
+            pkgs.writeText "oidc-jwks.yaml" ''
+              identity_providers:
+                oidc:
+                  jwks:
+                    - key: {{ mustEnv "CREDENTIALS_DIRECTORY" | printf "%s/oidcIssuerPrivateKeyFile" | secret | mindent 10 "|" | msquote }}
+            ''
           );
           configArg = "--config ${
             builtins.concatStringsSep "," (
@@ -373,21 +369,25 @@ in
               ]
             )
           }";
+          # Mapping between the Authelia env variables and the secret keys defined in the module
+          envSecretsMap = {
+            AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE = "jwtSecretFile";
+            AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = "storageEncryptionKeyFile";
+            AUTHELIA_SESSION_SECRET_FILE = "sessionSecretFile";
+            AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = "oidcHmacSecretFile";
+          };
+          nonNullEnvSecretsMap = lib.filterAttrs (_: v: instance.secrets.${v} != null) envSecretsMap;
         in
         {
           description = "Authelia authentication and authorization server";
           wantedBy = [ "multi-user.target" ];
           after = [ "network-online.target" ]; # Checks SMTP notifier creds during startup
           wants = [ "network-online.target" ];
-          environment =
-            (lib.filterAttrs (_: v: v != null) {
-              X_AUTHELIA_CONFIG_FILTERS = lib.mkIf (oidcJwksConfigFile != [ ]) "template";
-              AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE = instance.secrets.jwtSecretFile;
-              AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = instance.secrets.storageEncryptionKeyFile;
-              AUTHELIA_SESSION_SECRET_FILE = instance.secrets.sessionSecretFile;
-              AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = instance.secrets.oidcHmacSecretFile;
-            })
-            // instance.environmentVariables;
+          environment = {
+            X_AUTHELIA_CONFIG_FILTERS = lib.mkIf (oidcJwksConfigFile != [ ]) "template";
+          }
+          // lib.mapAttrs (_: v: "%d/${v}") nonNullEnvSecretsMap
+          // instance.environmentVariables;
 
           preStart = "${execCommand} ${configArg} validate-config";
           serviceConfig = {
@@ -399,6 +399,12 @@ in
             StateDirectory = autheliaName instance.name;
             StateDirectoryMode = "0700";
 
+            LoadCredential =
+              lib.optional (
+                instance.secrets.oidcIssuerPrivateKeyFile != null
+              ) "oidcIssuerPrivateKeyFile:${instance.secrets.oidcIssuerPrivateKeyFile}"
+              ++ lib.mapAttrsToList (_: v: "${v}:${instance.secrets.${v}}") nonNullEnvSecretsMap;
+
             # Security options:
             AmbientCapabilities = "";
             CapabilityBoundingSet = "";

nixos/modules/services/security/vaultwarden/default.nix

@@ -173,6 +173,7 @@ in
     domain = lib.mkOption {
       type = with lib.types; nullOr str;
       default = null;
+      example = "bitwarden.example.com";
       description = "The domain under which VaultWarden will be reachable.";
     };
 

nixos/modules/services/system/userborn.nix

@@ -86,7 +86,7 @@ in
         The primary motivation for this is an immutable `/etc`, where we cannot
         write the files directly to `/etc`.
 
-        However this an also serve other use cases, e.g. when `/etc` is on a `tmpfs`.
+        However this can also serve other use cases, e.g. when `/etc` is on a `tmpfs`.
       '';
     };
 

nixos/modules/services/torrent/rtorrent.nix

@@ -149,13 +149,6 @@ in
 
       protocol.encryption.set = allow_incoming,try_outgoing,enable_retry
 
-      # Limits for file handle resources, this is optimized for
-      # an `ulimit` of 1024 (a common default). You MUST leave
-      # a ceiling of handles reserved for rTorrent's internal needs!
-      network.http.max_open.set = 50
-      network.max_open_files.set = 600
-      network.max_open_sockets.set = 3000
-
       # Memory resource usage (increase if you have a large number of items loaded,
       # and/or the available resources to spend)
       pieces.memory.max.set = 1800M
@@ -169,15 +162,14 @@ in
       execute.nothrow = sh, -c, (cat, "echo >", (session.path), "rtorrent.pid", " ", (system.pid))
 
       # Other operational settings (check & adapt)
-      encoding.add = utf8
       system.umask.set = 0027
       system.cwd.set = (cfg.basedir)
       network.http.dns_cache_timeout.set = 25
-      schedule2 = monitor_diskspace, 15, 60, ((close_low_diskspace, 1000M))
+      schedule = monitor_diskspace, 15, 60, ((close_low_diskspace, 1000M))
 
       # Watch directories (add more as you like, but use unique schedule names)
-      #schedule2 = watch_start, 10, 10, ((load.start, (cat, (cfg.watch), "start/*.torrent")))
-      #schedule2 = watch_load, 11, 10, ((load.normal, (cat, (cfg.watch), "load/*.torrent")))
+      #schedule = watch_start, 10, 10, ((load.start, (cat, (cfg.watch), "start/*.torrent")))
+      #schedule = watch_load, 11, 10, ((load.normal, (cat, (cfg.watch), "load/*.torrent")))
 
       # Logging:
       #   Levels = critical error warn notice info debug
@@ -218,6 +210,10 @@ in
               RuntimeDirectory = "rtorrent";
               RuntimeDirectoryMode = 750;
 
+              # rtorrent derives socket limits from this value since 0.16.15; see table in
+              # https://github.com/rakshasa/rtorrent/wiki/Socket-Manager-and-Resource-Allocation
+              LimitNOFILE = lib.mkDefault 16384;
+
               CapabilityBoundingSet = [ "" ];
               LockPersonality = true;
               NoNewPrivileges = true;

nixos/modules/services/web-apps/homer.nix

@@ -169,11 +169,25 @@ in
       enable = true;
       virtualHosts."${cfg.virtualHost.domain}".extraConfig = ''
         root * ${cfg.package}
-        file_server
+        encode zstd gzip
+
+        @immutable path /resources/*
+        header @immutable Cache-Control "public, max-age=31536000, immutable"
+
+        @html not path /resources/*
+        header @html Cache-Control "no-store"
+
+        header {
+          -ETag
+          -Last-Modified
+        }
+
         handle_path /assets/config.yml {
           root * ${configFile}
           file_server
         }
+
+        file_server
       '';
     };
   };

nixos/modules/services/web-apps/immichframe.nix

@@ -134,6 +134,40 @@ in
           Type = "simple";
           Restart = "on-failure";
           RestartSec = 3;
+
+          # systemd hardening, based on jellyfin (also .NET) but stricter
+          CapabilityBoundingSet = [ "" ];
+          DevicePolicy = "closed";
+          LockPersonality = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = !config.boot.isContainer;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = !config.boot.isContainer;
+          ProtectKernelTunables = !config.boot.isContainer;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          # no AF_NETLINK here since there's no network connection monitoring
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          RestrictNamespaces = !config.boot.isContainer;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallErrorNumber = "EPERM";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+          ];
+          UMask = "0077";
         };
       };
   };

nixos/modules/services/web-apps/tabbyapi.nix

@@ -34,7 +34,7 @@ in
             host = lib.mkOption {
               type = lib.types.str;
               default = "127.0.0.1";
-              description = "The IP to host on. Use 0.0.0.0 to expose on all adapters.";
+              description = "The IP to host on. Use 0.0.0.0 to expose on all network adapters.";
             };
 
             port = lib.mkOption {
@@ -46,13 +46,22 @@ in
             disable_auth = lib.mkOption {
               type = lib.types.bool;
               default = false;
-              description = "Disable HTTP token authentication. WARNING: Vulnerable if exposed.";
+              description = ''
+                Disable HTTP token authentication with requests.
+                WARNING: This will make your instance vulnerable! Only turn this on if you are ONLY connecting from localhost.
+              '';
+            };
+
+            disable_fetch_requests = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = "Disable fetching external content in response to requests, such as images from URLs.";
             };
 
             api_servers = lib.mkOption {
               type = lib.types.listOf lib.types.str;
               default = [ "OAI" ];
-              description = "Select API servers to enable. Options: OAI, Kobold.";
+              description = "Select API servers to enable. Possible values: OAI, Kobold.";
             };
           };
 
@@ -66,7 +75,18 @@ in
             log_requests = lib.mkOption {
               type = lib.types.bool;
               default = false;
-              description = "Enable request logging. Only use for debug.";
+              description = "Enable request logging. NOTE: Only use this for debugging!";
+            };
+
+            log_chat_completion_requests = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = ''
+                Write every /v1/chat/completions request to logs/debug/ as JSON.
+                PRIVACY WARNING: Enabling this creates a comprehensive request log, including the
+                full message history and generation parameters. API keys are redacted, but prompts
+                and user-provided content are preserved for bug-report reproduction.
+              '';
             };
           };
 
@@ -111,35 +131,94 @@ in
               '';
             };
 
+            inline_model_loading = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = ''
+                Allow direct loading of models from a completion or chat completion request.
+                This method of loading is strict by default; enable dummy models to add
+                exceptions for invalid model names.
+              '';
+            };
+
             model_name = lib.mkOption {
               type = lib.types.nullOr lib.types.str;
               default = null;
-              description = "The initial model to load on startup. Must exist in model_dir.";
+              description = ''
+                An initial model to load. Make sure the model is located in the model directory!
+                REQUIRED: This must be filled out to load a model on startup.
+              '';
               example = "Qwen3_5-9B";
             };
 
             max_seq_len = lib.mkOption {
               type = lib.types.nullOr lib.types.int;
               default = null;
-              description = "Max sequence length. Set null to use model defaults.";
+              description = ''
+                Max sequence length (default: min(max_position_embeddings, cache_size)).
+                Set to -1 to fetch from the model's config.json.
+              '';
             };
 
             cache_mode = lib.mkOption {
               type = lib.types.str;
               default = "FP16";
-              description = "Cache mode for VRAM savings. ExLlamaV2: FP16, Q8, Q6, Q4. ExLlamaV3: specific pair string (e.g., '8,8').";
+              description = ''
+                Enable different cache modes for VRAM savings.
+                Specify the pair k_bits,v_bits where k_bits and v_bits are integers from 2-8 (e.g. '8,8').
+                The legacy values 'FP16', 'Q8', 'Q6', 'Q4' are also accepted.
+              '';
+            };
+
+            tensor_parallel = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = ''
+                Load model with tensor parallelism.
+                Falls back to autosplit if GPU split isn't provided. This ignores the gpu_split_auto value.
+              '';
             };
 
             gpu_split_auto = lib.mkOption {
               type = lib.types.bool;
               default = true;
-              description = "Automatically allocate resources to GPUs.";
+              description = "Automatically allocate resources to GPUs. Not parsed for single GPU users.";
             };
 
             dummy_model_names = lib.mkOption {
               type = lib.types.listOf lib.types.str;
               default = [ "gpt-3.5-turbo" ];
-              description = "List of fake model names sent via the /v1/models endpoint.";
+              description = ''
+                A list of fake model names that are sent via the /v1/models endpoint.
+                Also used as bypasses for strict mode if inline_model_loading is true.
+              '';
+            };
+
+            vision = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = "Enables vision support if the model supports it.";
+            };
+
+            reasoning = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = ''
+                Enable reasoning parser.
+                Do NOT enable this if the model is not a reasoning model (e.g. deepseek-r1 series).
+              '';
+            };
+
+            reasoning_start_token = lib.mkOption {
+              type = lib.types.str;
+              default = "<think>";
+              description = "The start token for reasoning content.";
+            };
+
+            reasoning_end_token = lib.mkOption {
+              type = lib.types.str;
+              default = "</think>";
+              description = "The end token for reasoning content.";
             };
           };
         };

nixos/modules/services/web-servers/rustfs.nix

@@ -0,0 +1,151 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.rustfs;
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    marcel
+  ];
+
+  options.services.rustfs = {
+    enable = lib.mkEnableOption "RustFS Object Storage Server";
+
+    package = lib.mkPackageOption pkgs "rustfs" { };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "rustfs";
+      description = "The user RustFS should run as.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "rustfs";
+      description = "The group RustFS should run as.";
+    };
+
+    settings = lib.mkOption {
+      default = { };
+      description = ''
+        Options for RustFS configuration. Refer to
+        <https://docs.rustfs.com/installation/linux/single-node-single-disk.html#_5-configure-environment-variables>
+        for details on supported values.
+      '';
+      example = lib.literalExpression ''
+        {
+          RUSTFS_CONSOLE_ENABLE = "true";
+          RUSTFS_VOLUMES = "/mnt/rustfs";
+        }
+      '';
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (
+          lib.types.oneOf [
+            lib.types.str
+            lib.types.int
+          ]
+        );
+        options = {
+          RUSTFS_VOLUMES = lib.mkOption {
+            type = lib.types.path;
+            default = "/var/lib/rustfs";
+            description = "The directory where RustFS stores it's data.";
+          };
+        };
+      };
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.str;
+      description = "Path to environment file containing secrets like RUSTFS_ACCESS_KEY or RUSTFS_SECRET_KEY.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !(cfg.settings ? RUSTFS_ACCESS_KEY);
+        message = "RUSTFS_ACCESS_KEY must not be set in services.rustfs.settings. Use environmentFile instead.";
+      }
+      {
+        assertion = !(cfg.settings ? RUSTFS_SECRET_KEY);
+        message = "RUSTFS_SECRET_KEY must not be set in services.rustfs.settings. Use environmentFile instead.";
+      }
+    ];
+
+    systemd = {
+      tmpfiles.settings."10-rustfs".${cfg.settings.RUSTFS_VOLUMES}.d = {
+        inherit (cfg) user group;
+      };
+
+      # https://docs.rustfs.com/installation/linux/single-node-single-disk.html#_6-configure-system-service
+      services.rustfs = {
+        description = "RustFS Object Storage Server";
+        documentation = [ "https://rustfs.com/docs/" ];
+
+        after = [ "network-online.target" ];
+        wants = [ "network-online.target" ];
+
+        wantedBy = [ "multi-user.target" ];
+
+        environment = cfg.settings;
+
+        preStart = ''
+          if [ -z "$RUSTFS_ACCESS_KEY" ] || [ -z "$RUSTFS_SECRET_KEY" ]; then
+            echo "RustFS uses well-known default values for RUSTFS_ACCESS_KEY and RUSTFS_SECRET_KEY,"
+            echo "please configure them using services.rustfs.environmentFile."
+            exit 1
+          fi
+        '';
+
+        serviceConfig = {
+          Type = "notify";
+          NotifyAccess = "main";
+          User = cfg.user;
+          Group = cfg.group;
+
+          EnvironmentFile = cfg.environmentFile;
+          ExecStart = lib.getExe cfg.package;
+
+          LimitNOFILE = 1048576;
+          LimitNPROC = 32768;
+          TasksMax = "infinity";
+
+          Restart = "always";
+          RestartSec = "10s";
+
+          OOMScoreAdjust = "-1000";
+          SendSIGKILL = false;
+
+          TimeoutStartSec = "30s";
+          TimeoutStopSec = "30s";
+
+          NoNewPrivileges = true;
+
+          ProtectHome = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectClock = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectControlGroups = true;
+          RestrictSUIDSGID = true;
+          RestrictRealtime = true;
+        };
+      };
+    };
+
+    users = {
+      users.${cfg.user} = {
+        isSystemUser = true;
+        inherit (cfg) group;
+      };
+      groups.${cfg.group} = { };
+    };
+  };
+}

nixos/modules/system/boot/plymouth.nix

@@ -68,7 +68,7 @@ let
 
   configFile = pkgs.writeText "plymouthd.conf" ''
     [Daemon]
-    ShowDelay=0
+    ShowDelay=${toString cfg.showDelay}
     DeviceTimeout=8
     Theme=${cfg.theme}
     ${cfg.extraConfig}
@@ -166,6 +166,15 @@ in
         '';
       };
 
+      showDelay = mkOption {
+        type = types.numbers.nonnegative;
+        default = 0;
+        example = 0.5;
+        description = ''
+          Time (in seconds) to delay the splash screen.
+        '';
+      };
+
       extraConfig = mkOption {
         type = types.lines;
         default = "";

nixos/modules/system/boot/systemd/fido2.nix

@@ -27,6 +27,8 @@ in
       "${cfg.package}/lib/udev/fido_id"
       "${cfg.package}/lib/cryptsetup/libcryptsetup-token-systemd-fido2.so"
       "${pkgs.libfido2}/lib/libfido2.so.1"
+      # dlopened by the libpcsclite.so.1 shim, invisible to make-initrd-ng
+      "${lib.getLib pkgs.pcsclite}/lib/libpcsclite_real.so.1"
     ];
   };
 }

nixos/modules/system/boot/systemd/tpm2.nix

@@ -45,6 +45,7 @@
           "systemd-tpm2-setup.service"
           "systemd-pcrextend.socket"
           "systemd-pcrextend@.service"
+          "systemd-pcrlogin@.service"
         ];
       }
     )

nixos/release-combined.nix

@@ -201,7 +201,7 @@ rec {
         (onFullSupported "nixos.tests.printing-socket")
         (onFullSupported "nixos.tests.proxy")
         (onFullSupported "nixos.tests.sddm.default")
-        (onFullSupported "nixos.tests.shadow")
+        (onFullSupported "nixos.tests.shadow.login")
         (onFullSupported "nixos.tests.simple-container")
         (onFullSupported "nixos.tests.simple-vm")
         (onFullSupported "nixos.tests.sway")

nixos/tests/all-tests.nix

@@ -604,6 +604,10 @@ in
     imports = [ ./firefox.nix ];
     _module.args.firefoxPackage = pkgs.firefox-esr-140;
   };
+  firefox-esr-153 = runTest {
+    imports = [ ./firefox.nix ];
+    _module.args.firefoxPackage = pkgs.firefox-esr-153;
+  };
   firefox-syncserver = runTest ./firefox-syncserver.nix;
   firefox_decrypt = runTest ./firefox_decrypt.nix;
   firefoxpwa = runTest ./firefoxpwa.nix;
@@ -1512,6 +1516,7 @@ in
   rtkit = runTest ./rtkit.nix;
   rtorrent = runTest ./rtorrent.nix;
   rush = runTest ./rush.nix;
+  rustfs = runTest ./rustfs.nix;
   rustical = runTest ./web-apps/rustical.nix;
   rustls-libssl = runTest ./rustls-libssl.nix;
   rxe = runTest ./rxe.nix;
@@ -1539,7 +1544,7 @@ in
   sftpgo = runTest ./sftpgo.nix;
   sfxr-qt = runTest ./sfxr-qt.nix;
   sgt-puzzles = runTest ./sgt-puzzles.nix;
-  shadow = runTest ./shadow.nix;
+  shadow = import ./shadow { inherit runTest; };
   shadowsocks = handleTest ./shadowsocks { };
   shadps4 = runTest ./shadps4.nix;
   sharkey = runTest ./web-apps/sharkey.nix;
@@ -1585,6 +1590,8 @@ in
   sssd-ldap = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-ldap.nix { };
   sssd-legacy-config = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-legacy-config.nix { };
   stalwart = runTest ./stalwart/stalwart.nix;
+  stardust-xr-atmosphere = runTest ./stardust-xr/atmosphere.nix;
+  stardust-xr-flatland = runTest ./stardust-xr/flatland.nix;
   stargazer = runTest ./web-servers/stargazer.nix;
   starship = runTest ./starship.nix;
   startx = import ./startx.nix { inherit pkgs runTest; };
@@ -1684,6 +1691,7 @@ in
   systemd-journal = runTest ./systemd-journal.nix;
   systemd-journal-gateway = runTest ./systemd-journal-gateway.nix;
   systemd-journal-upload = runTest ./systemd-journal-upload.nix;
+  systemd-localed = runTest ./systemd-localed.nix;
   systemd-lock-handler = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./systemd-lock-handler.nix;
   systemd-machinectl = runTest ./systemd-machinectl.nix;
   systemd-misc = runTest ./systemd-misc.nix;
@@ -1842,6 +1850,7 @@ in
   };
   virtualbox = handleTestOn [ "x86_64-linux" ] ./virtualbox.nix { };
   vm-variant = handleTest ./vm-variant.nix { };
+  vnstat = runTest ./vnstat.nix;
   vscode-remote-ssh = handleTestOn [ "x86_64-linux" ] ./vscode-remote-ssh.nix { };
   vscodium = import ./vscodium.nix { inherit runTest; };
   vsftpd = runTest ./vsftpd.nix;

nixos/tests/authelia.nix

@@ -28,12 +28,10 @@
         # This is purely for testing purposes!
         environment.etc."authelia/storageEncryptionKeyFile" = {
           mode = "0400";
-          user = "authelia-testing";
           text = "you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this";
         };
         environment.etc."authelia/jwtSecretFile" = {
           mode = "0400";
-          user = "authelia-testing";
           text = "a_very_important_secret";
         };
         environment.etc."authelia/users_database.yml" = {

nixos/tests/cockpit.nix

@@ -102,7 +102,6 @@ in
                   from selenium.webdriver.firefox.options import Options
                   from selenium.webdriver.support.ui import WebDriverWait
                   from selenium.webdriver.support import expected_conditions as EC
-                  from time import sleep
 
 
                   def log(msg):
@@ -129,7 +128,7 @@ in
                       wait.until(EC.presence_of_element_located((by, query)))
 
 
-                  def wait_title_contains(title, timeout=10):
+                  def wait_title_contains(title, timeout=30):
                       wait = WebDriverWait(driver, timeout)
                       wait.until(EC.title_contains(title))
 
@@ -138,11 +137,6 @@ in
                       return driver.find_element(by, query)
 
 
-                  def set_value(elem, value):
-                      script = 'arguments[0].value = arguments[1]'
-                      return driver.execute_script(script, elem, value)
-
-
                   log("Waiting for the homepage to load")
 
                   # cockpit sets initial title as hostname
@@ -151,36 +145,45 @@ in
 
                   log("Homepage loaded!")
 
+                  # Prefer send_keys over setting .value via JS: Cockpit's login
+                  # form (and PatternFly widgets) do not always react to the latter.
                   log("Filling out username")
                   login_input = find_element(By.CSS_SELECTOR, 'input#login-user-input')
-                  set_value(login_input, "${user}")
+                  login_input.clear()
+                  login_input.send_keys("${user}")
 
                   log("Filling out password")
-                  password_input = find_element(By.CSS_SELECTOR, 'input#login-password-input')
-                  set_value(password_input, "${password}")
+                  password_input = find_element(
+                      By.CSS_SELECTOR, 'input#login-password-input'
+                  )
+                  password_input.clear()
+                  password_input.send_keys("${password}")
 
                   log("Submitting credentials for login")
                   driver.find_element(By.CSS_SELECTOR, 'button#login-button').click()
 
-                  # driver.implicitly_wait(1)
-                  # driver.get("https://server:7890/system")
-
                   log("Waiting dashboard to load")
                   wait_title_contains("${user}@server")
 
-                  log("Waiting for the frontend to initialize")
-                  sleep(1)
-
                   log("Looking for that banner that tells about limited access")
-                  container_iframe = find_element(By.CSS_SELECTOR, 'iframe.container-frame')
+                  wait_elem(By.CSS_SELECTOR, 'iframe.container-frame', timeout=30)
+                  container_iframe = find_element(
+                      By.CSS_SELECTOR, 'iframe.container-frame'
+                  )
                   driver.switch_to.frame(container_iframe)
-
-                  assert "Web console is running in limited access mode" in driver.page_source
+                  # Wait for the overview iframe to render the limited-access alert.
+                  # Fixed sleeps were flaky after Cockpit 364 (slower SPA init).
+                  phrase = "Web console is running in limited access mode"
+                  WebDriverWait(driver, 30).until(
+                      lambda d: phrase in d.page_source
+                  )
 
                   log("Clicking the sudo button")
+                  # Button label is "Turn on administrative access"
                   for button in driver.find_elements(By.TAG_NAME, "button"):
-                      if 'admin' in button.text:
+                      if 'admin' in button.text.casefold():
                           button.click()
+                          break
                   driver.switch_to.default_content()
 
                   log("Checking that /nonexistent is not a thing")
@@ -189,13 +192,17 @@ in
 
                   log("Checking plugin path")
                   driver.get("https://server:7890/hello-test")
-                  sleep(2)
+                  wait_elem(By.CSS_SELECTOR, 'iframe.container-frame', timeout=30)
                   for iframe in driver.find_elements(By.TAG_NAME, "iframe"):
                       if "hello-test" in (iframe.get_attribute("src") or ""):
                           driver.switch_to.frame(iframe)
                           break
-                  text = driver.find_element(By.ID, "output").text
-                  sleep(1)
+                  output = find_element(By.ID, "output")
+                  WebDriverWait(driver, 30).until(
+                      lambda d: "SUCCESS: Hello, world!" in output.text
+                      or output.text.startswith("FAILED:")
+                  )
+                  text = output.text
                   assert "SUCCESS: Hello, world!" in text, f"Plugin failed: {text}"
 
                   driver.close()
@@ -215,8 +222,10 @@ in
 
     server.wait_for_unit("sockets.target")
     server.wait_for_open_port(7890)
+    # Port open is not enough: cockpit-ws may still be finishing startup.
+    server.wait_until_succeeds("curl -k https://127.0.0.1:7890 -o /dev/null")
 
-    client.succeed("curl -k https://server:7890 -o /dev/stderr")
+    client.wait_until_succeeds("curl -k https://server:7890 -o /dev/stderr")
     print(client.succeed("whoami"))
     client.succeed('PYTHONUNBUFFERED=1 selenium-script')
   '';

nixos/tests/common/openxr.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+{
+  imports = [
+    ./user-account.nix
+    ./x11.nix
+  ];
+  test-support.displayManager.auto.user = "alice";
+  systemd.user.targets.xdg-desktop-autostart = {
+    wantedBy = [ "graphical-session.target" ];
+    after = [ "graphical-session.target" ];
+  };
+
+  hardware.graphics.enable = true;
+
+  services.monado = {
+    enable = true;
+    defaultRuntime = true;
+    forceDefaultRuntime = true;
+  };
+  systemd.user.services.monado = {
+    requires = [ "graphical-session.target" ];
+    environment = {
+      # Stop Monado from probing for any hardware
+      SIMULATED_ENABLE = "1";
+      SIMULATED_LEFT = "simple";
+      SIMULATED_RIGHT = "simple";
+      # Run as X11 client rather than using direct mode
+      XRT_COMPOSITOR_FORCE_XCB = "1";
+      # And run fullscreen so that we can hide the DE
+      XRT_COMPOSITOR_XCB_FULLSCREEN = "1";
+    };
+  };
+}

nixos/tests/croc.nix

@@ -12,8 +12,8 @@ in
   meta = with pkgs.lib.maintainers; {
     maintainers = [
       equirosa
-      SuperSandro2000
       ryan4yin
+      kaynetik
     ];
   };
 

nixos/tests/komodo-periphery.nix

@@ -5,22 +5,63 @@
     maintainers = with lib.maintainers; [ channinghe ];
   };
 
-  nodes.machine =
-    { config, pkgs, ... }:
-    {
-      virtualisation.docker.enable = true;
-      services.komodo-periphery = {
-        enable = true;
-        bindIp = "127.0.0.1";
-        port = 8120;
-        ssl.enable = false;
-        passkeys = [ "test-passkey" ];
+  nodes = {
+    periphery =
+      { ... }:
+      {
+        virtualisation.docker.enable = true;
+        services.komodo-periphery = {
+          enable = true;
+          inbound.bindIp = "127.0.0.1";
+          inbound.port = 8120;
+          inbound.ssl.enable = false;
+          inbound.serverEnabled = true;
+          disableTerminals = true;
+          disableContainerTerminals = true;
+          statsPollingRate = "10-sec";
+          containerStatsPollingRate = "1-min";
+          logging.level = "debug";
+          extraSettings = {
+            secrets.TEST_SECRET = "test-value";
+          };
+          auth.privateKey = "file:/var/lib/komodo-periphery/keys/test.key";
+          auth.corePublicKeys = [ "MCowBQYDK2VuAyEATZgrjGHeF0KJUe0+n77+qAWOg3YzEzXOmQWaRgO3OGQ=" ];
+        };
       };
-    };
+
+    peripheryOutbound =
+      { ... }:
+      {
+        virtualisation.docker.enable = true;
+        services.komodo-periphery = {
+          enable = true;
+          inbound.ssl.enable = false;
+          logging.level = "debug";
+          outbound.coreAddress = "core.invalid";
+          outbound.connectAs = "test-server";
+        };
+      };
+  };
 
   testScript = ''
-    machine.wait_for_unit("komodo-periphery.service")
-    machine.wait_for_open_port(8120)
-    machine.succeed("systemctl status komodo-periphery.service")
+    start_all()
+
+    with subtest("Inbound periphery starts and serves /version"):
+        periphery.wait_for_unit("komodo-periphery.service")
+        periphery.wait_for_open_port(8120)
+        periphery.succeed("curl -fsS --max-time 10 http://127.0.0.1:8120/version")
+
+    with subtest("Periphery creates managed directories"):
+        periphery.succeed("test -d /var/lib/komodo-periphery")
+        periphery.succeed("test -d /var/lib/komodo-periphery/repos")
+        periphery.succeed("test -d /var/lib/komodo-periphery/stacks")
+        periphery.succeed("test -d /var/lib/komodo-periphery/builds")
+        periphery.succeed("test -d /var/lib/komodo-periphery/keys")
+        periphery.succeed("test -d /var/lib/komodo-periphery/ssl")
+
+    with subtest("Outbound periphery stays active despite unreachable core"):
+        peripheryOutbound.wait_for_unit("komodo-periphery.service")
+        peripheryOutbound.sleep(15)
+        peripheryOutbound.succeed("systemctl is-active komodo-periphery")
   '';
 }

nixos/tests/monado.nix

@@ -3,47 +3,57 @@
   name = "monado";
 
   nodes.machine =
-    { pkgs, ... }:
+    {
+      lib,
+      pkgs,
+      config,
+      ...
+    }:
 
     {
-      hardware.graphics.enable = true;
-      users.users.alice = {
-        isNormalUser = true;
-        uid = 1000;
+      imports = [ ./common/openxr.nix ];
+
+      systemd.user.services.print-openxr-info = {
+        wantedBy = [ "xdg-desktop-autostart.target" ];
+        requires = [ "monado.service" ];
+        script = lib.getExe' pkgs.openxr-loader "openxr_runtime_list";
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
       };
 
-      services.monado = {
-        enable = true;
-        defaultRuntime = true;
-
-        forceDefaultRuntime = true;
+      systemd.user.services.xrgears = {
+        wantedBy = [ "xdg-desktop-autostart.target" ];
+        requires = [ "monado.service" ];
+        script = lib.getExe pkgs.xrgears;
       };
-      # Stop Monado from probing for any hardware
-      systemd.user.services.monado.environment.SIMULATED_ENABLE = "1";
-
-      environment.systemPackages = with pkgs; [ openxr-loader ];
     };
 
   testScript =
     { nodes, ... }:
-    let
-      userId = toString nodes.machine.users.users.alice.uid;
-      runtimePath = "/run/user/${userId}";
-    in
     ''
-      # for defaultRuntime
-      machine.succeed("stat /etc/xdg/openxr/1/active_runtime.json")
+      with subtest("Ensure X11 starts"):
+        start_all()
+        machine.succeed("loginctl enable-linger alice")
+        machine.wait_for_x()
 
-      machine.succeed("loginctl enable-linger alice")
-      machine.wait_for_unit("user@${userId}.service")
+      with subtest("Ensure default runtime present"):
+        machine.succeed("stat /etc/xdg/openxr/1/active_runtime.json")
 
-      machine.wait_for_unit("monado.socket", "alice")
-      machine.systemctl("start monado.service", "alice")
-      machine.wait_for_unit("monado.service", "alice")
+      with subtest("Ensure forced runtime present"):
+        # Monado needs to be started to create the forced runtime file
+        machine.systemctl("start monado.service", "alice")
+        machine.wait_for_unit("monado.service", "alice")
+        machine.succeed("stat /home/alice/.config/openxr/1/active_runtime.json")
 
-      # for forceDefaultRuntime
-      machine.succeed("stat /home/alice/.config/openxr/1/active_runtime.json")
+      with subtest("Ensure openxr_runtime_list can find runtime"):
+        machine.wait_for_unit("print-openxr-info.service", "alice")
 
-      machine.succeed("su -- alice -c env XDG_RUNTIME_DIR=${runtimePath} openxr_runtime_list")
+      with subtest("Ensure xrgears launches"):
+        machine.wait_for_unit("xrgears.service", "alice")
+        # TODO: 10 seconds should be long enough for anything, but this is theoretically flaky
+        machine.sleep(10)
+        machine.screenshot("screen")
     '';
 }

nixos/tests/mtp.nix

@@ -23,7 +23,6 @@
         environment.systemPackages = with pkgs; [
           usbutils
           glib
-          jmtpfs
           tree
         ];
         services.gvfs.enable = true;
@@ -88,22 +87,6 @@
           ${unmountAllMtpDevices}
         '';
       };
-      jmtpfs = {
-        # jmtpfsTest:
-        # 1. Mounts the device on a dir named `phone` using jmtpfs
-        # 2. Puts the current Nixpkgs libmtp version into a file
-        # 3. Checks for corruption with `diff`
-        # 4. Prints the directory tree
-        jmtpfsTest = pkgs.writeScript "jmtpfsTest.sh" ''
-          set -e
-          mkdir phone
-          jmtpfs phone
-          echo "${pkgs.libmtp.version}" > phone/tmp/testFile
-          echo "${pkgs.libmtp.version}" > testFile
-          diff phone/tmp/testFile testFile
-          tree phone
-        '';
-      };
     in
     # Using >&2 allows the results of the scripts to be printed to the terminal
     # when building this test with Nix. Scripts would otherwise complete
@@ -113,6 +96,5 @@
       client.wait_for_unit("multi-user.target")
       client.wait_for_unit("dbus.service")
       client.succeed("${gvfs.gvfsTest} >&2")
-      client.succeed("${jmtpfs.jmtpfsTest} >&2")
     '';
 }

nixos/tests/optee.nix

@@ -4,7 +4,6 @@
 
   meta = {
     maintainers = with lib.maintainers; [ jmbaur ];
-    broken = pkgs.stdenv.hostPlatform.isAarch64;
   };
 
   nodes.machine =
@@ -17,7 +16,8 @@
       uboot = ubootQemuAarch64.overrideAttrs (old: {
         postPatch = (old.postPatch or "") + ''
           substituteInPlace board/emulation/qemu-arm/qemu-arm.env \
-            --replace-fail "ramdisk_addr_r=0x44000000" "ramdisk_addr_r=0x46000000"
+            --replace-fail "kernel_addr_r=0x40400000" "kernel_addr_r=0x50000000" \
+            --replace-fail "ramdisk_addr_r=0x44000000" "ramdisk_addr_r=0x58000000"
         '';
       });
 
@@ -53,6 +53,7 @@
 
       # VM boots up via qfw
       boot.loader.grub.enable = false;
+      boot.kernelModules = [ "optee" ];
 
       services.tee-supplicant = {
         enable = true;

nixos/tests/rustfs.nix

@@ -0,0 +1,69 @@
+{ pkgs, ... }:
+
+let
+  accessKey = "BKIKJAA5BMMU2RHO6IBB";
+  secretKey = "V7f1CwQqAcwo80UEIJEjc5gVQUSSx5ohQ9GSrr12";
+
+  rustfsPythonScript =
+    pkgs.writers.writePython3 "rustfs-test" { libraries = with pkgs.python3Packages; [ minio ]; }
+      /* python */ ''
+        import io
+        import os
+        from minio import Minio
+
+        minioClient = Minio(
+          'localhost:9000',
+          access_key='${accessKey}',
+          secret_key='${secretKey}',
+          secure=False
+        )
+        sio = io.BytesIO()
+        sio.write(b'Test from Python')
+        sio.seek(0, os.SEEK_END)
+        sio_len = sio.tell()
+        sio.seek(0)
+        minioClient.put_object(
+          'test-bucket',
+          'test.txt',
+          sio,
+          sio_len,
+          content_type='text/plain'
+        )
+      '';
+
+in
+{
+  name = "rustfs";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      marcel
+    ];
+  };
+
+  containers.machine =
+    { pkgs, ... }:
+    {
+      services.rustfs = {
+        enable = true;
+        environmentFile = builtins.toString (
+          pkgs.writeText "rustfs-secrets.env" ''
+            RUSTFS_ACCESS_KEY=${accessKey}
+            RUSTFS_SECRET_KEY=${secretKey}
+          ''
+        );
+      };
+
+      environment.systemPackages = with pkgs; [ minio-client ];
+    };
+
+  testScript = /* python */ ''
+    machine.wait_for_unit("rustfs.service")
+
+    machine.succeed("mc alias set rustfs http://localhost:9000 ${accessKey} ${secretKey} --api s3v4")
+    machine.succeed("mc mb rustfs/test-bucket")
+    machine.succeed("${rustfsPythonScript}")
+    assert "test-bucket" in machine.succeed("mc ls rustfs")
+    assert "Test from Python" in machine.succeed("mc cat rustfs/test-bucket/test.txt")
+    machine.succeed("mc rb --force rustfs/test-bucket")
+  '';
+}

nixos/tests/shadow/default.nix

@@ -0,0 +1,5 @@
+{ runTest }:
+{
+  login = runTest ./login.nix;
+  system = runTest ./system.nix;
+}

nixos/tests/shadow/system.nix

@@ -0,0 +1,147 @@
+{ pkgs, ... }:
+let
+  # Create a Python environment for the controller with all necessary test framework dependencies
+  controllerPython = pkgs.python3.withPackages (ps: [
+    ps.flaky
+    ps.jc
+    ps.pytest
+    ps.pytest-mh
+    ps.pytest-ticket
+  ]);
+
+  shadowHostName = "shadowhost";
+in
+{
+  name = "shadow-system-tests";
+
+  meta.maintainers = with pkgs.lib.maintainers; [ joaosreis ];
+
+  nodes = {
+    # The target host: runs sshd, has shadow and other test dependencies installed, mutable users, and some specific settings to match the expectations of the test suite
+    shadowhost =
+      { pkgs, ... }:
+      {
+        networking.hostName = shadowHostName;
+        services.openssh = {
+          enable = true;
+          settings = {
+            PermitRootLogin = "yes";
+            PasswordAuthentication = false;
+          };
+        };
+
+        users.mutableUsers = true;
+
+        environment.systemPackages = with pkgs; [
+          shadow
+          expect
+        ];
+
+        users.defaultUserShell = "/bin/sh";
+
+        security.loginDefs.settings = {
+          PASS_MAX_DAYS = 99999;
+          PASS_MIN_DAYS = 0;
+          PASS_WARN_AGE = 7;
+          USERGROUPS_ENAB = "yes";
+          CREATE_HOME = "yes";
+          UID_MIN = 1001;
+          GID_MIN = 1001;
+        };
+
+        security.pam.services = {
+          newusers.text = ''
+            auth    required    pam_permit.so
+            account required    pam_permit.so
+            password required   pam_permit.so
+            session required    pam_permit.so
+          '';
+        };
+
+        services.envfs.enable = true;
+      };
+
+    # The controller: runs pytest-mh against the shadow host
+    controller =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          controllerPython
+          pkgs.openssh
+        ];
+      };
+
+  };
+
+  testScript = ''
+    import textwrap
+
+    start_all()
+
+    # ------------------------------------------------------------------
+    # 1. Generate an SSH keypair on the controller and authorise it
+    #    on the shadow host
+    # ------------------------------------------------------------------
+    controller.succeed("mkdir -p /root/.ssh && chmod 700 /root/.ssh")
+    controller.succeed(
+        "ssh-keygen -t ed25519 -N \'\' -f /root/.ssh/id_ed25519 2>&1"
+    )
+    pub_key = controller.succeed("cat /root/.ssh/id_ed25519.pub").strip()
+
+    # Inject the generated public key into the shadow host at runtime
+    shadowhost.succeed("mkdir -p /root/.ssh && chmod 700 /root/.ssh")
+    shadowhost.succeed(
+        f"echo '{pub_key}' >> /root/.ssh/authorized_keys && "
+        "chmod 600 /root/.ssh/authorized_keys"
+    )
+
+    # ------------------------------------------------------------------
+    # 2. Make sure the shadow host has a writable /etc/login.defs,
+    #    since the test framework expects to be able to write to it.
+    # ------------------------------------------------------------------
+    shadowhost.succeed(
+        "cp --remove-destination $(readlink -f /etc/login.defs) /etc/login.defs && "
+        "chmod 644 /etc/login.defs"
+    )
+
+    # ------------------------------------------------------------------
+    # 3. Copy the upstream test suite onto the controller
+    # ------------------------------------------------------------------
+    controller.succeed(
+        "cp -r ${pkgs.shadow.passthru.testFramework} /root/shadow-tests && "
+        "chmod -R u+w /root/shadow-tests"
+    )
+
+    # ------------------------------------------------------------------
+    # 4. Write the mhc.yaml topology config
+    #    This tells pytest-mh where the shadow host is and which role
+    #    it plays. The hostname must match the NixOS node name.
+    # ------------------------------------------------------------------
+    controller.succeed(textwrap.dedent("""
+        cat > /root/shadow-tests/mhc.yaml << 'EOF'
+        domains:
+          - id: shadow
+            hosts:
+              - hostname: ${shadowHostName}
+                role: shadow
+                ssh:
+                  user: root
+                  private_key: /root/.ssh/id_ed25519
+        EOF
+    """))
+
+
+    # ------------------------------------------------------------------
+    # 5. Run the upstream pytest-mh test suite from the controller
+    # ------------------------------------------------------------------
+    shadowhost.wait_for_unit("sshd.service")
+    # gpasswd tests are disabled, since they rely on specific behavior of the gpasswd command that is not applicable to NixOS
+    controller.succeed(
+        "cd /root/shadow-tests && "
+        "${controllerPython}/bin/pytest "
+        "--mh-config=mhc.yaml "
+        "--deselect=tests/test_gpasswd.py "
+        "-v tests/"
+    )
+  '';
+}

nixos/tests/stardust-xr/atmosphere.nix

@@ -0,0 +1,54 @@
+{ ... }:
+{
+  name = "stardust-xr-atmosphere";
+
+  # Doesn't understand @polling_condition
+  skipTypeCheck = true;
+
+  nodes.machine =
+    {
+      lib,
+      pkgs,
+      config,
+      ...
+    }:
+
+    {
+      imports = [ ./common.nix ];
+
+      virtualisation.memorySize = 4096;
+
+      systemd.user.services.stardust-xr-atmosphere = {
+        wantedBy = [ "xdg-desktop-autostart.target" ];
+        requires = [ "stardust-xr-server.service" ];
+        after = [ "stardust-xr-server.service" ];
+        script = ''
+          set -eufx pipefail
+          ${lib.getExe pkgs.stardust-xr-atmosphere} install ${pkgs.stardust-xr-atmosphere}/share/atmosphere/default_envs/the_grid
+          ${lib.getExe pkgs.stardust-xr-atmosphere} set-default the_grid
+          ${lib.getExe pkgs.stardust-xr-atmosphere} show
+        '';
+        environment.RUST_BACKTRACE = "full";
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      @polling_condition()
+      def atmosphere_running():
+        machine.wait_for_unit("stardust-xr-atmosphere.service", "alice")
+
+      with subtest("Ensure X11 starts"):
+        start_all()
+        machine.succeed("loginctl enable-linger alice")
+        machine.wait_for_x()
+
+      with subtest("Ensure system works"):
+        with atmosphere_running:
+          # TODO(@Pandapip1): 20 seconds should be long enough for anything, but this is theoretically flaky
+          # Adding systemd notify support to stardust-xr-atmosphere should resolve this
+          machine.sleep(20)
+          machine.screenshot("screen")
+    '';
+}

nixos/tests/stardust-xr/common.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ../common/openxr.nix ];
+
+  # TODO(@Pandapip1): For the time being, Stardust doesn't like controllers rather than hand tracking
+  services.monado.enable = lib.mkForce false;
+
+  systemd.user.services.stardust-xr-server = {
+    wantedBy = [ "xdg-desktop-autostart.target" ];
+    # requires = [ "monado.service" ];
+    serviceConfig = {
+      Type = "notify";
+      NotifyAccess = "all";
+      ExecStart = "${lib.getExe pkgs.stardust-xr-server} -e ${pkgs.writeShellScript "notifyReady" "systemd-notify --ready"}";
+    };
+    environment.RUST_BACKTRACE = "full";
+  };
+}

nixos/tests/stardust-xr/flatland.nix

@@ -0,0 +1,57 @@
+{ ... }:
+{
+  name = "stardust-xr-flatland";
+
+  # Doesn't understand @polling_condition
+  skipTypeCheck = true;
+
+  nodes.machine =
+    {
+      lib,
+      pkgs,
+      config,
+      ...
+    }:
+
+    {
+      imports = [ ./common.nix ];
+
+      systemd.user.services.stardust-xr-flatland = {
+        wantedBy = [ "xdg-desktop-autostart.target" ];
+        requires = [ "stardust-xr-server.service" ];
+        after = [ "stardust-xr-server.service" ];
+        script = lib.getExe pkgs.stardust-xr-flatland;
+        environment.RUST_BACKTRACE = "full";
+      };
+
+      systemd.user.services.test-wayland-app = {
+        wantedBy = [ "xdg-desktop-autostart.target" ];
+        requires = [ "stardust-xr-flatland.service" ];
+        after = [ "stardust-xr-flatland.service" ];
+        script = lib.getExe pkgs.wayland-colorbar;
+        environment = {
+          DISPLAY = "";
+          WAYLAND_DISPLAY = "wayland-0";
+        };
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      @polling_condition()
+      def wayland_client_running():
+        machine.wait_for_unit("test-wayland-app.service", "alice")
+
+      with subtest("Ensure X11 starts"):
+        start_all()
+        machine.succeed("loginctl enable-linger alice")
+        machine.wait_for_x()
+
+      with subtest("Ensure system works"):
+        with wayland_client_running:
+          # TODO: 20 seconds should be long enough for anything, but this is theoretically flaky
+          machine.sleep(20)
+          machine.screenshot("screen")
+    '';
+}

nixos/tests/systemd-localed.nix

@@ -0,0 +1,23 @@
+{ lib, ... }:
+{
+  name = "systemd-localed";
+  meta.maintainers = [ lib.maintainers.haansn08 ];
+
+  nodes.machine = { ... }: {
+    # we don't use services.xserver.enable because some window managers like
+    # niri rely on systemd-localed for the keyboard layout:
+    # https://niri-wm.github.io/niri/Configuration%3A-Input.html#layout
+    services.graphical-desktop.enable = true;
+
+    services.xserver.xkb.layout = "jp";
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("default.target")
+    machine.wait_for_unit("dbus.socket")
+
+    status, stdout = machine.execute("localectl")
+    t.assertIn("X11 Layout: jp", stdout)
+  '';
+}

nixos/tests/vnstat.nix

@@ -0,0 +1,26 @@
+{ lib, ... }:
+{
+  name = "vnstat";
+  meta.maintainers = with lib.maintainers; [ hmenke ];
+
+  containers.machine = {
+    services.vnstat = {
+      enable = true;
+      settings = {
+        AlwaysAddNewInterfaces = 1;
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("vnstat.service")
+
+    machine.succeed("vnstat --iflist")
+    machine.fail("vnstat -i dummy0")
+    machine.succeed("ip link add dummy0 type dummy")
+    machine.succeed("ip link set dummy0 up")
+    machine.wait_until_succeeds("vnstat -i dummy0", timeout=10)
+  '';
+}

nixos/tests/web-apps/immichframe.nix

@@ -1,10 +1,21 @@
+{
+  lib,
+  ...
+}:
+
 let
   apiKeyFile = "/tmp/immich-api.key";
   customInterval = 5;
+  user = "alice";
 in
 {
   name = "immichframe";
 
+  meta.maintainers = with lib.maintainers; [
+    numinit
+    jfly
+  ];
+
   enableOCR = true;
 
   nodes.machine =
@@ -15,11 +26,22 @@ in
       ...
     }:
     {
-      imports = [ ../common/x11.nix ];
+      imports = [
+        ../common/user-account.nix
+        ../common/x11.nix
+      ];
 
-      # When setting this to 2500 I got "Kernel panic - not syncing: Out of
+      # When setting memory to 2500 I got "Kernel panic - not syncing: Out of
       # memory: compulsory panic_on_oom is enabled".
-      virtualisation.memorySize = 3000;
+      # Setting cores to 1 (the default) also makes immich take a long time to start up.
+      # If this breaks, keep synced with the immich test.
+      virtualisation = {
+        memorySize = 4096;
+        cores = 2;
+      };
+      hardware.graphics.enable = true;
+      environment.variables.XAUTHORITY = "/home/${user}/.Xauthority";
+      test-support.displayManager.auto.user = user;
 
       environment.systemPackages = with pkgs; [
         imagemagick
@@ -69,6 +91,7 @@ in
 
     custom_interval = ${toString customInterval}
 
+    machine.wait_for_x()
     machine.wait_for_unit("immich-server.service")
     machine.wait_for_open_port(2283)
 
@@ -133,11 +156,7 @@ in
     assert len(assets) == 2, assets
 
     # Wait for a photo to be displayed.
-    machine.wait_for_x()
-    machine.execute("xterm -e 'firefox --kiosk http://localhost:8002' >&2 &")
-    machine.wait_for_window("immichFrame")
-    _, active_window = machine.execute("xdotool getactivewindow")
-    machine.succeed(f"xdotool windowsize {quote(active_window.strip())} 100% 100%")
+    machine.execute("su - ${user} -c 'firefox --kiosk http://localhost:8002' >&2 & disown")
     machine.wait_for_text('reproduce this moment')
     machine.wait_for_text('with NixOS tests')
     machine.screenshot("screen")

pkgs/applications/audio/mopidy/mopidy.nix

@@ -51,7 +51,9 @@ pythonPackages.buildPythonApplication (finalAttrs: {
       pygobject3
       pykka
       requests
-      setuptools
+      # Provides pkg_resources required by Mopidy 3 and affected extensions.
+      # Remove when updating to Mopidy 4.
+      setuptools_80
       tornado
     ]
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ dbus-python ];

pkgs/applications/editors/android-studio/default.nix

@@ -21,14 +21,14 @@ let
     url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.10/android-studio-quail1-patch2-linux.tar.gz";
   };
   betaVersion = {
-    version = "2026.1.2.9"; # "Android Studio Quail 2 | 2026.1.2 RC 2"
-    sha256Hash = "sha256-QzNhbE8Ryv0VGQY/VzhJhqeS0c6rrUpgXXVOoBV+NHE=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.9/android-studio-quail2-rc2-linux.tar.gz";
+    version = "2026.1.3.5"; # "Android Studio Quail 3 | 2026.1.3 RC 1"
+    sha256Hash = "sha256-P8YoUnG4YtCOPkbHLFBHfteZg8cJJeXuDgty+kmgbSw=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.3.5/android-studio-quail3-rc1-linux.tar.gz";
   };
   latestVersion = {
-    version = "2026.1.3.3"; # "Android Studio Quail 3 | 2026.1.3 Canary 3"
-    sha256Hash = "sha256-C8rbR+0iGNzsr7HtiNiFw++ZG9/t00/c1Ozr9ngssPs=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.3.3/android-studio-quail3-canary3-linux.tar.gz";
+    version = "2026.1.4.1"; # "Android Studio Quail 4 | 2026.1.4 Canary 1"
+    sha256Hash = "sha256-ynHUoMDsTNgKKRAU948k37ktAIlIm9A+md8KyVBTjl4=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.4.1/android-studio-quail4-canary1-linux.tar.gz";
   };
 in
 {

pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix

@@ -47,7 +47,6 @@ melpaBuild (finalAttrs: {
     platforms = [
       "aarch64-darwin"
       "aarch64-linux"
-      "x86_64-darwin"
       "x86_64-linux"
       "x86_64-windows"
     ];

pkgs/applications/editors/emacs/make-emacs.nix

@@ -116,8 +116,6 @@
 
   # test
   callPackage,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 assert (withGTK3 && !withNS && variant != "macport") -> withX || withPgtk;
@@ -254,11 +252,7 @@ stdenv.mkDerivation (finalAttrs: {
     autoreconfHook
   ]
   ++ lib.optionals (withPgtk || withX && (withGTK3 || withXwidgets)) [ wrapGAppsHook3 ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    sigtool
-    # TODO: Clean up on `staging`
-    llvmPackages.lld
-  ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ sigtool ];
 
   buildInputs = [
     gnutls
@@ -424,15 +418,10 @@ stdenv.mkDerivation (finalAttrs: {
       NATIVE_FULL_AOT = "1";
       LIBRARY_PATH = lib.concatStringsSep ":" libGccJitLibraryPaths;
     }
-    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-      # workaround for ld64 hardening issue
-      #
-      # TODO: Clean up on `staging`
-      NIX_CFLAGS_COMPILE =
-        "-fuse-ld=lld"
-        # Fixes intermittent segfaults when compiled with LLVM >= 7.0.
-        # See https://github.com/NixOS/nixpkgs/issues/127902
-        + lib.optionalString (variant == "macport") " -isystem ${./macport-noescape-noop}";
+    // lib.optionalAttrs (variant == "macport") {
+      # Fixes intermittent segfaults when compiled with LLVM >= 7.0.
+      # See https://github.com/NixOS/nixpkgs/issues/127902
+      NIX_CFLAGS_COMPILE = "-isystem ${./macport-noescape-noop}";
     };
 
   enableParallelBuilding = true;

pkgs/applications/editors/jetbrains/ides/clion.nix

@@ -28,10 +28,6 @@ let
       url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.tar.gz";
       hash = "sha256-I6IKQng4lNtRlQIq08K5bueqgKI/q1awX4EuRnyAnOk=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.4.dmg";
-      hash = "sha256-AJt+K1zv4eyjdzubUeFGwB9mqzvOeb3ffA2k0MajPBs=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.dmg";
       hash = "sha256-i3stX7dyRgSOJkFTMD9/hkw6e2mGNqn13S7X/vJ66RQ=";

pkgs/applications/editors/jetbrains/ides/datagrip.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3-aarch64.tar.gz";
       hash = "sha256-G+tinD/+qM5HVR4u2E0cNXtdVsbwgK8/PdZ3ic6hf4M=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3.dmg";
-      hash = "sha256-vW2LEonl0D9S0VxbeJX4jRrwhELGBwlOXwiHslvh06E=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3-aarch64.dmg";
       hash = "sha256-Kyt3fYPXzwTVxPFVKd+atiHWb/i7gjGahz1MJ4iXxy8=";

pkgs/applications/editors/jetbrains/ides/dataspell.nix

@@ -21,10 +21,6 @@ let
       url = "https://download.jetbrains.com/python/dataspell-2026.1.2-aarch64.tar.gz";
       hash = "sha256-SSmIPF0pDMolxeXL21UaHMbZdtYbChWVxTKZOsPhH+I=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/python/dataspell-2026.1.2.dmg";
-      hash = "sha256-2qzwzGMYuy1qEuTprxwNa5gOPgCZq2MadSKN8FT8w8c=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/python/dataspell-2026.1.2-aarch64.dmg";
       hash = "sha256-MGWufS0nlswdqhACNQWtlXJwfPiYw8wUx7olIxPS15k=";

pkgs/applications/editors/jetbrains/ides/gateway.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3-aarch64.tar.gz";
       hash = "sha256-CSe04BBo4jS1cIhu4NfZqaSHMaNue2eFUPa+1gOxuoo=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3.dmg";
-      hash = "sha256-WKwIP19y5EKO98JgEm468ofaRp/JO5z8lqNhtpsH4tY=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3-aarch64.dmg";
       hash = "sha256-AHY/lY0ARkW0VoSgy0t7LLNXA965PLooWBSWxBKBV5M=";

pkgs/applications/editors/jetbrains/ides/goland.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.tar.gz";
       hash = "sha256-7s98kY08aKjdRGQLDkffeVhgj1FWurLmTTYmtb5Qx6c=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.4.dmg";
-      hash = "sha256-RbvcLpLVyeL4B1DJ2/9Ub/6Cz6fJGXMPCHsJ705GsAo=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.dmg";
       hash = "sha256-y7mEke0z0MvQs+kMtrmrq7EeAtJUbgo6sGZrOB0MraM=";

pkgs/applications/editors/jetbrains/ides/idea.nix

@@ -22,10 +22,6 @@ let
       url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.tar.gz";
       hash = "sha256-MDZFuLrUxcCIc0Zhi4QhgKPeU7Pgs9oJ/FxQH1n3gBM=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4.dmg";
-      hash = "sha256-8K+LiewiINP4S9eqV0kGWtfy2Ff/zvBwX89iX7mYZ78=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.dmg";
       hash = "sha256-XIBK/+Lxaz9dX+Lxl7HXsl+Z3Z7GBzSuDxNssb/4A2s=";

pkgs/applications/editors/jetbrains/ides/mps.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3.tar.gz";
       hash = "sha256-xAI+UrTheCTWHSdoI4YZvhTlrlc121M+OVFkfzd7a3k=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3-macos.dmg";
-      hash = "sha256-whYAjKkF79mrknHflZnvOOy2bLosYUguelZDSuPt3uY=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3-macos-aarch64.dmg";
       hash = "sha256-3HnEHOhRRI9IYjBhc5FO7h5j4jBBDtZTVkmO/S1fBEQ=";

pkgs/applications/editors/jetbrains/ides/phpstorm.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.tar.gz";
       hash = "sha256-T9q3/nxv/AA6y7CHWtOhUibR7bnKN8OZmfN3NWYTsIQ=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4.dmg";
-      hash = "sha256-W7EwYu7S3hs1564tXq8H1Uok/Gwx/8QJO4brUGOfFY4=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.dmg";
       hash = "sha256-XGcfEWHHeLugvkT/WlQDsVRN33F46b1PCNhINQitqSY=";

pkgs/applications/editors/jetbrains/ides/pycharm.nix

@@ -20,10 +20,6 @@ let
       url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.tar.gz";
       hash = "sha256-71FbYpN0seJ5k/yZA7aoXgU4W/N1BhjtKl7W7Hic9UE=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.4.dmg";
-      hash = "sha256-Q5hTcYoNUzmAxwcsXJNS4medQjFKWc/Sgkybt4PQPfg=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.dmg";
       hash = "sha256-qxSgp8r4S0KXjCCTIoAiEZFCn3uBE/0pWLLA6td0Fq0=";

pkgs/applications/editors/jetbrains/ides/rider.nix

@@ -31,10 +31,6 @@ let
       url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.tar.gz";
       hash = "sha256-GXmyBrqxUpwK4djjwllvK+pnfktDrDHpLJKoe4D2xFo=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4.dmg";
-      hash = "sha256-GfQ5WpKunJ+JhE1VcArm3UxZ5udCbfnS1Kw3D4gZorA=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.dmg";
       hash = "sha256-cfwT22BN1jzKZzrZHMQqYFJPGuRwta/sqoOJOp+PfBE=";

pkgs/applications/editors/jetbrains/ides/ruby-mine.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.tar.gz";
       hash = "sha256-oSu19pkGVWt31vWBdAffSZsu4QzsUznVbUSwDy98nug=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4.dmg";
-      hash = "sha256-BLo2weIJK8gQAcMtAiETM7FMdhw9aoFIGh5Yqjv3k7s=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.dmg";
       hash = "sha256-4wEnwcPRtwp0wxePUMiLow6sMxirwndRMdmJL8LBh9k=";

pkgs/applications/editors/jetbrains/ides/rust-rover.nix

@@ -25,10 +25,6 @@ let
       url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.tar.gz";
       hash = "sha256-KpF3jCnLKCEeEXkBdB8ZsPPqP9FOVRTwRV/FQLKyh1Q=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4.dmg";
-      hash = "sha256-2BwgAD0xF9IxRJh+gW4vLzBW13rFQSzQPbEwdmQGvLU=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.dmg";
       hash = "sha256-Hly4NBv9mg/RMmxCM6m9w5eS/CQ7ycxp7V2VQZwyGQE=";

pkgs/applications/editors/jetbrains/ides/webstorm.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4-aarch64.tar.gz";
       hash = "sha256-f9KenMq1gtldzpBraSBwOb/186WQwh1ps5Ypj5JoOU0=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4.dmg";
-      hash = "sha256-SGdo6WYMCcCBuZUjvURcMTbJUqhZ4MzFlSLg6Zjr84I=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4-aarch64.dmg";
       hash = "sha256-ZYen6Ew0GYbBAmuGCDACPBsygxZ6sT787o6gqF9DJzw=";

pkgs/applications/editors/jetbrains/readme.md

@@ -78,7 +78,5 @@ Any comments or other manual changes between these markers will be removed when
  - on `aarch64-linux`:
    - from source build
    - see if build (binary or source) works without expat
- - on `x86_64-darwin`:
-   - from source build
  - on `aarch64-darwin`:
    - from source build

pkgs/applications/editors/jetbrains/updater/jetbrains_nix_updater/config.py

@@ -3,7 +3,7 @@ import os
 import dataclasses
 from pathlib import Path
 
-SUPPORTED_SYSTEMS = ["x86_64-linux", "aarch64-linux", "x86_64-darwin", "aarch64-darwin"]
+SUPPORTED_SYSTEMS = ["x86_64-linux", "aarch64-linux", "aarch64-darwin"]
 
 
 def find_nixpkgs(current_path: Path) -> Path:

pkgs/applications/editors/jetbrains/updater/updateInfo.json

@@ -4,7 +4,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/cpp/CLion-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/cpp/CLion-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.dmg"
     }
   },
@@ -13,7 +12,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/datagrip/datagrip-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/datagrip/datagrip-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.dmg"
     }
   },
@@ -22,7 +20,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/python/dataspell-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/python/dataspell-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/python/dataspell-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/python/dataspell-{version}-aarch64.dmg"
     }
   },
@@ -31,7 +28,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}-aarch64.dmg"
     }
   },
@@ -40,7 +36,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/go/goland-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/go/goland-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/go/goland-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/go/goland-{version}-aarch64.dmg"
     }
   },
@@ -49,7 +44,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/idea/ideaIU-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/idea/ideaIU-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/idea/ideaIU-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/idea/ideaIU-{version}-aarch64.dmg"
     }
   },
@@ -62,7 +56,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}-macos.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}-macos-aarch64.dmg"
     }
   },
@@ -71,7 +64,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/webide/PhpStorm-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/webide/PhpStorm-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.dmg"
     }
   },
@@ -80,7 +72,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/python/pycharm-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/python/pycharm-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/python/pycharm-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/python/pycharm-{version}-aarch64.dmg"
     }
   },
@@ -93,7 +84,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.dmg"
     }
   },
@@ -102,7 +92,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/ruby/RubyMine-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/ruby/RubyMine-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/ruby/RubyMine-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/ruby/RubyMine-{version}-aarch64.dmg"
     }
   },
@@ -111,7 +100,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/rustrover/RustRover-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/rustrover/RustRover-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.dmg"
     }
   },
@@ -120,7 +108,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/webstorm/WebStorm-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/webstorm/WebStorm-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/webstorm/WebStorm-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/webstorm/WebStorm-{version}-aarch64.dmg"
     }
   }

pkgs/applications/editors/jupyter-kernels/clojupyter/default.nix

@@ -13,7 +13,7 @@
 # nix run --impure --expr 'with import <nixpkgs> {}; jupyter-console.withSingleKernel clojupyter.definition'
 
 # Jupyter notebook:
-# nix run --impure --expr 'with import <nixpkgs> {}; jupyter.override { definitions.clojure = clojupyter.definition; }'
+# nix shell --impure --expr 'with import <nixpkgs> {}; [ (jupyter.override { definitions.clojure = clojupyter.definition; }) ]' -c jupyter-notebook
 
 let
   cljdeps = import ./deps.nix { inherit pkgs; };

pkgs/applications/editors/jupyter-kernels/octave/default.nix

@@ -12,7 +12,7 @@
 # nix run --impure --expr 'with import <nixpkgs> {}; jupyter-console.withSingleKernel octave-kernel.definition'
 
 # Jupyter notebook:
-# nix run --impure --expr 'with import <nixpkgs> {}; jupyter.override { definitions.octave = octave-kernel.definition; }'
+# nix shell --impure --expr 'with import <nixpkgs> {}; [ (jupyter.override { definitions.octave = octave-kernel.definition; }) ]' -c jupyter-notebook
 
 let
   kernel = callPackage ./kernel.nix {

pkgs/applications/editors/jupyter-kernels/wolfram/default.nix

@@ -7,7 +7,7 @@
 # nix run --impure --expr 'with import <nixpkgs> {}; jupyter-console.withSingleKernel wolfram-for-jupyter-kernel.definition'
 
 # Jupyter notebook:
-# nix run --impure --expr 'with import <nixpkgs> {}; jupyter.override { definitions.wolfram = wolfram-for-jupyter-kernel.definition; }'
+# nix shell --impure --expr 'with import <nixpkgs> {}; [ (jupyter.override { definitions.wolfram = wolfram-for-jupyter-kernel.definition; }) ]' -c jupyter-notebook
 
 let
   kernel = callPackage ./kernel.nix { };

pkgs/applications/editors/vim/default.nix

@@ -14,8 +14,6 @@
     url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/68f6d131750aa778807119e03eed70286a17b1cb/trunk/archlinux.vim";
     sha256 = "18ifhv5q9prd175q3vxbqf6qyvkk6bc7d2lhqdk0q78i68kv9y0c";
   },
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 let
@@ -39,10 +37,6 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     gettext
     pkg-config
-  ]
-  # TODO: Clean up on `staging`.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
   buildInputs = [
     ncurses
@@ -50,13 +44,6 @@ stdenv.mkDerivation {
     gawk
   ];
 
-  # workaround for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_COMPILE = "-fuse-ld=lld";
-  };
-
   strictDeps = true;
 
   configureFlags = [