python3Packages.pystiebeleltron: 0.9.2 -> 0.10.1

Diff: https://github.com/ThyMYthOS/python-stiebel-eltron/compare/v0.9.2...v0.10.1

Changelog: https://github.com/ThyMYthOS/python-stiebel-eltron/releases/tag/v0.10.1

doc/hooks/pkgConfigCheckHook.section.md

@@ -0,0 +1,25 @@
+# `pkgConfigCheckHook` {#pkgConfigCheckHook}
+
+This hook adds check to [`preInstallCheckHooks`](#ssec-installCheck-phase) that validates a package's `pkg-config` module(s).
+
+If this check fails, then the whole build will fail. A softer option is `testers.hasPkgConfigModules`.
+
+Use it like this:
+
+```nix
+{
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ pkgConfigCheckHook ];
+  pkgConfigModules = [
+    "xyzlib"
+    "abc"
+  ];
+}
+```
+
+The variables that this phase control are:
+
+- `dontPkgConfigCheck`: Disable adding this hook to the [`preInstallCheckHooks`](#ssec-installCheck-phase).
+- `dontPkgConfigCheckVersion`: Disable comparing the package's `.pc` version to its `$version` environment variable (passed by the derivation). Useful when upstream forgets to bump their `.pc` or uses a different version format.
+
+This check searches all outputs `lib/pkgconfig` and `share/pkgconfig` directories for `.pc` files.

doc/languages-frameworks/cuda.section.md

@@ -165,6 +165,75 @@ To illustrate: support for Blackwell (e.g., `sm_100`) was added in CUDA 12.8. As
 
 The `pkgsForCudaArch` attribute set makes it possible to access packages built for a specific architecture without needing to manually call `pkgs.extend` and supply a new `config`. As an example, `pkgsForCudaArch.sm_89.python3Packages.torch` provides PyTorch built for Ada Lovelace GPUs.
 
+### Unlocking GeForce tensor core throughput {#cuda-gpu-unlock}
+
+[gpu-unlock](https://github.com/Zagitta/gpu-unlock) removes the tensor core
+throughput cap for FP16, BF16 and TF32 operations with FP32 accumulation on
+supported GeForce GPUs. Upstream considers Ampere (RTX 30) support stable and
+Turing (RTX 20) and Ada (RTX 40) support experimental; Blackwell (RTX 50) is
+unsupported. Check the upstream supported GPU list for your exact model.
+This does not improve gaming or ordinary FP32 CUDA performance.
+
+The kernel module is available as `config.boot.kernelPackages.gpu-unlock`, with
+its firmware in the package's `firmware` attribute. The firmware is unfree; allow
+`gpu-unlock-firmware` in your `nixpkgs.config.allowUnfreePredicate`, or enable
+`nixpkgs.config.allowUnfree`. The pinned firmware version is independent of your
+installed NVIDIA driver version.
+
+Add the following to a NixOS configuration that already enables the NVIDIA driver:
+
+```nix
+{ config, ... }:
+{
+  boot.extraModulePackages = [ config.boot.kernelPackages.gpu-unlock ];
+  hardware.firmware = [ config.boot.kernelPackages.gpu-unlock.firmware ];
+  boot.initrd.availableKernelModules = [ "gpu_unlock" ];
+  boot.kernelParams = [ "gpu_unlock.targets=all" ];
+
+  boot.initrd.systemd.services.gpu-unlock = {
+    description = "Unlock NVIDIA GPU tensor core throughput";
+    wantedBy = [ "sysinit.target" ];
+    before = [
+      "sysinit.target"
+      "systemd-modules-load.service"
+      "systemd-udevd.service"
+      "systemd-udev-trigger.service"
+    ];
+    unitConfig.DefaultDependencies = false;
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = "/bin/modprobe gpu_unlock";
+    };
+  };
+}
+```
+
+The initrd service must finish before udev or the normal module loader can load
+NVIDIA or another GPU driver. Merely adding `gpu_unlock` to
+`boot.initrd.kernelModules` does not ensure this ordering. The module's firmware
+declarations cause NixOS to include the required assets in the initrd.
+
+To select individual GPUs, replace `all` with full PCI addresses from `lspci -D`,
+for example `gpu_unlock.targets=0000:01:00.0,0000:02:00.0`. Already bound or
+powered-down cards are skipped. Loading the module after the NVIDIA driver has
+bound the card is too late.
+
+Apply the configuration with `sudo nixos-rebuild boot`, then reboot. Check
+`journalctl -k -b --grep=gpu_unlock` for an `unlocked` message for each selected
+GPU. `journalctl -b -u gpu-unlock.service` shows initrd service failures; a
+successful service exit alone does not mean a GPU was unlocked.
+
+The unlock is lost when a GPU loses power. Upstream attempts to reapply it after
+suspend to RAM before NVIDIA resumes the GPU; hibernation is not covered.
+Laptop runtime power management can also reset the unlock. See upstream's
+power-management guidance and check the kernel log after resume.
+
+To disable unlocking, remove `gpu_unlock.targets=...` from `boot.kernelParams`,
+rebuild the boot configuration, and reboot. For a single boot, remove the
+parameter in the bootloader editor. To uninstall, also remove the module,
+firmware, and initrd service settings above, rebuild, and reboot.
+
 ### Running Docker or Podman containers with CUDA support {#cuda-docker-podman}
 
 It is possible to run Docker or Podman containers with CUDA support. The recommended mechanism to perform this task is to use the [NVIDIA Container Toolkit](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/index.html).

doc/languages-frameworks/ocaml.section.md

@@ -31,7 +31,7 @@ pkgs.mkShell {
 
 ## Packaging guide {#sec-language-ocaml-packaging}
 
-OCaml libraries are installed in `$out/lib/ocaml/${ocaml.version}/site-lib/`, or in the same directory of the `dev` output (see `buildDunePackage` below). Such directories are automatically added to the `$OCAMLPATH` environment variable when building another package that depends on them or when opening a `nix-shell`.
+OCaml libraries should be installed in `$(out)/lib/ocaml/${ocaml.version}/site-lib/`. Such directories are automatically added to the `$OCAMLPATH` environment variable when building another package that depends on them or when opening a `nix-shell`.
 
 Given that most of the OCaml ecosystem is now built with dune, nixpkgs includes a convenience build support function called `buildDunePackage` that will build an OCaml package using dune, OCaml and findlib and any additional dependencies provided as `buildInputs` or `propagatedBuildInputs`.
 
@@ -139,29 +139,6 @@ buildDunePackage (finalAttrs: {
 })
 ```
 
-Unless the package sets `outputs`, `buildDunePackage` builds separate outputs,
-and points `$OCAMLFIND_DESTDIR` to `dev`:
-
-- `out` contains what the package produces for use at runtime, such as
-  executables.
-- `dev` contains the OCaml libraries and the propagated dependencies needed to
-  build other packages against them. It is selected automatically when the
-  package is used as a build input.
-- `man` contains the man pages. Like `out`, it is installed by default.
-- `doc` contains the documentation, such as the README and license files.
-
-This keeps build-time only OCaml dependencies out of the runtime closure of
-executables. Code that refers to the library directory of such a package must
-use its `dev` output, for example `${lib.getDev menhirLib}/lib/ocaml` or
-`lib.makeSearchPathOutput "dev" "lib/ocaml/${ocaml.version}/site-lib"`.
-Likewise, installing the library into a profile or environment requires its
-`dev` output, e.g. `ocamlPackages.menhirLib.dev`.
-
-Toplevels and programs that load plugins need their own OCaml library at
-runtime, and the two outputs would refer to each other. Set
-`outputs = [ "out" ];` for such packages, and for packages whose custom
-`installPhase` installs everything into `$out`.
-
 The build will automatically fail if two distinct versions of the same library
 are added to `buildInputs` (which usually happens transitively because of
 `propagatedBuildInputs`). Set `dontDetectOcamlConflicts` to true to disable this

doc/languages-frameworks/python.section.md

@@ -60,7 +60,7 @@ sets are
 
 and the aliases
 
-* `pkgs.python3Packages` pointing to `pkgs.python314Packages`
+* `pkgs.python3Packages` pointing to `pkgs.python313Packages`
 * `pkgs.pypy2Packages` pointing to `pkgs.pypy27Packages`
 * `pkgs.pypy3Packages` pointing to `pkgs.pypy310Packages`
 * `pkgs.pypyPackages` pointing to `pkgs.pypy2Packages`

doc/languages-frameworks/qt.section.md

@@ -44,7 +44,12 @@ Add entries to `qtWrapperArgs` to modify the wrappers created by
 stdenv.mkDerivation {
   # ...
   nativeBuildInputs = [ qt6.wrapQtAppsHook ];
-  qtWrapperArgs = [ "--prefix PATH : /path/to/bin" ];
+  qtWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    "/path/to/bin"
+  ];
 }
 ```
 

doc/languages-frameworks/swift.section.md

@@ -246,46 +246,6 @@ To disable the SwiftPM install phase, include the following in your derivation:
 { dontUseSwiftpmInstall = true; }
 ```
 
-## Swift Macros {#ssec-swift-macros}
-
-Nixpkgs includes the stdlib macros (ObservationMacros and SwiftMacros) and FoundationMacros in the toolchain.
-Packages that need macros for Apple frameworks on Darwin have two options:
-- `open-apple-macros` provides open-source implementations of FoundationModelsMacros and SwiftUIMacros; or
-- `darwin.xcode-macros` provides macro libraries from Xcode not otherwise included in the toolchain, but they are unfree.
-
-Add the appropriate package to `depsBuildBuild` (because they are compiler plugins that run on the build platform).
-If you need to manually specify the path for a package because it or its build system invokes `swiftc` directly:
-
-### `open-apple-macros` {#ssec-swift-macros-open-apple-macros}
-```nix
-{
-  buildPhase = ''
-    runHook preBuild
-    swiftc \
-      -external-plugin-path ${open-apple-macros}/lib/swift/host/plugins#${open-apple-macros}/libexec/swift/plugins/OpenAppleMacrosServer \
-      -disable-sandbox \
-      *.swift \
-      -o the_binary
-    runHook postBuild
-  '';
-}
-```
-
-### `darwin.xcode-macros` {#ssec-swift-macros-xcode-macros}
-```nix
-{
-  # For `darwin.xcode-macros`
-  buildPhase = ''
-    runHook preBuild
-    swiftc \
-      -plugin-path ${darwin.xcode-macros}/lib/swift/host/plugins \
-      *.swift \
-      -o the_binary
-    runHook postBuild
-  '';
-}
-```
-
 ## Hooks {#ssec-swift-hooks}
 
 Swift provides the following hooks to automate builds and unpack dependencies:

doc/nav.json

@@ -557,6 +557,10 @@
                   "id": "pkg-config",
                   "file": "hooks/pkg-config.section.md"
                 },
+                {
+                  "id": "pkgconfigcheckhook",
+                  "file": "hooks/pkgConfigCheckHook.section.md"
+                },
                 {
                   "id": "postgresql-test-hook",
                   "file": "hooks/postgresql-test-hook.section.md"

doc/packages/darwin-builder.section.md

@@ -124,6 +124,14 @@ When switching an existing QEMU builder over, delete its data disk first (e.g.
 `sudo rm /var/lib/linux-builder/nixos.qcow2`): the vz builder reuses the file name
 but writes a raw image, and refuses to misread a genuine qcow2 left behind.
 
+The guest runs on demand: it boots on the first connection and keeps it on hold
+until the guest is ready (usually around 12s). If there are no connections for
+10 minutes, the guest is stopped. The data disk is kept across these reboots,
+even with nix-darwin's `nix.linux-builder.ephemeral`.
+The `ephemeral` setting wipes the disk only during the launchd service start.
+Set `virtualisation.vz.idleTimeout` to a number of seconds, or to `null` to keep
+the guest running forever.
+
 The guest console goes to the macOS unified log by default; read it with:
 
 ```ShellSession

doc/redirects.json

@@ -47,6 +47,9 @@
   "cuda-extending-cuda-package-sets": [
     "index.html#cuda-extending-cuda-package-sets"
   ],
+  "cuda-gpu-unlock": [
+    "index.html#cuda-gpu-unlock"
+  ],
   "cuda-modifying-cuda-package-sets": [
     "index.html#cuda-modifying-cuda-package-sets",
     "index.html#cuda-configuring-cuda-package-sets"
@@ -386,6 +389,9 @@
   "npm-install-hook-variables": [
     "index.html#npm-install-hook-variables"
   ],
+  "pkgConfigCheckHook": [
+    "index.html#pkgConfigCheckHook"
+  ],
   "pkgs-replacevars": [
     "index.html#pkgs-replacevars",
     "index.html#pkgs-substituteall",
@@ -1732,6 +1738,24 @@
   "sec-meta-license": [
     "index.html#sec-meta-license"
   ],
+  "sec-meta-license-multiple": [
+    "index.html#sec-meta-license-multiple"
+  ],
+  "lib.licenses.OR": [
+    "index.html#lib.licenses.OR"
+  ],
+  "lib.licenses.AND": [
+    "index.html#lib.licenses.AND"
+  ],
+  "lib.licenses.WITH": [
+    "index.html#lib.licenses.WITH"
+  ],
+  "lib.licenses.PLUS": [
+    "index.html#lib.licenses.PLUS"
+  ],
+  "sec-meta-license-generic": [
+    "index.html#sec-meta-license-generic"
+  ],
   "lib.licenses.free-free": [
     "index.html#lib.licenses.free-free"
   ],
@@ -4636,15 +4660,6 @@
   "ssec-swiftpm-install-phase": [
     "index.html#ssec-swiftpm-install-phase"
   ],
-  "ssec-swift-macros": [
-    "index.html#ssec-swift-macros"
-  ],
-  "ssec-swift-macros-open-apple-macros": [
-    "index.html#ssec-swift-macros-open-apple-macros"
-  ],
-  "ssec-swift-macros-xcode-macros": [
-    "index.html#ssec-swift-macros-xcode-macros"
-  ],
   "ssec-swift-hooks": [
     "index.html#ssec-swift-hooks"
   ],

doc/release-notes/rl-2611.section.md

@@ -29,6 +29,9 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `ccl` has been updated from 1.13 to [1.14](https://github.com/Clozure/ccl/releases/tag/v1.14), adding native support for `aarch64-linux` and `aarch64-darwin`.
+  The heap image and FASL formats have changed on all platforms; existing FASL files must be recompiled.
+
 - `pmd` has been updated from 6 to 7. Its command-line interface now uses subcommands: use `pmd check`, `pmd cpd`, `pmd cpd-gui`, `pmd designer`, and `pmd ast-dump` in place of the former standalone commands. The `bgastviewer` and `designerold` tools have been removed. See the [PMD 7 migration guide](https://docs.pmd-code.org/latest/pmd_userdocs_migrating_to_pmd7.html) for other breaking changes.
 
 - `roadrunner` has been updated from 2025.1.15 to 3.0.0, which contains several breaking changes:
@@ -56,11 +59,6 @@
 
 - `paperless-manage` now uses `runuser` instead of automatically calling `sudo` to set user/group before running. Invoke the script with `sudo paperless-manage` or an equivalent elevation tool of your choice
 
-- OpenSSL now prefers the system CA bundle at `/etc/ssl/certs/ca-certificates.crt` on both Linux and Darwin, falling back to `/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt` only when the system bundle is absent.
-  Previously, Darwin used the default Nix profile bundle directly.
-  An existing but unreadable or invalid system bundle does not trigger the fallback.
-  Explicit `NIX_SSL_CERT_FILE` and `SSL_CERT_FILE` overrides still take precedence.
-
 - `hyperfine` has been updated from 1.21.0 to 2.0.0, which contains several breaking changes:
   - Benchmarked commands are now executed directly instead of through an intermediate shell. Pass `-S`/`--shell=default` to restore the previous behavior.
   - The `--export-json` format has changed (schema version 2); tools consuming the exported JSON must be updated.
@@ -103,13 +101,6 @@
   By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
   We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
 
-- `ocamlPackages.buildDunePackage` now builds packages with `out`, `dev`, `man` and `doc` outputs by default, unless they set `outputs`.
-  The OCaml libraries are installed into `dev`, man pages into `man`, documentation into `doc`, and `out` only contains what is needed at runtime, such as executables. This removes build-time only OCaml dependencies from the closure of tools like `patdiff`.
-  Code that refers to `${ocamlPackages.foo}/lib/ocaml` must use `${lib.getDev ocamlPackages.foo}/lib/ocaml` instead.
-  Installing such a library into a profile or environment (for example with `home.packages`, `environment.systemPackages` or `nix profile add`) no longer provides its `lib/ocaml` directory; install `ocamlPackages.foo.dev` instead.
-
-- The `bin` and `lib` outputs of `ocamlPackages.odoc`, `ocamlPackages.crunch`, `ocamlPackages.mdx` and `ocamlPackages.tw` were removed. Use the package itself for the executables, and its `dev` output for the OCaml library.
-
 - `bundlerApp` now sets `__structuredAttrs = true` for its result package.
   Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
 
@@ -119,6 +110,8 @@
 
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
+- `home-assistant-custom-lovelace-modules.card-mod` has been removed in favor of its successor [UIX](https://github.com/Lint-Free-Technology/uix), which is packaged as `home-assistant-custom-components.uix`. Since UIX is an integration rather than a Lovelace module, move it from `services.home-assistant.customLovelaceModules` to `services.home-assistant.customComponents`. Existing `card_mod:` configuration keeps working.
+
 - `mermaid-cli` has been updated to 12.0.0, which changes default diagram themes and layouts.
   To keep the previous appearance, set `layout: dagre`, `theme: default`, and `look: classic` in the Mermaid configuration.
   The `--width` and `--height` options have been replaced by `--size`.
@@ -211,10 +204,6 @@
 
 - `zerofs` has been updated from `1.x` to `2.x` which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.
 
-- `python3Packages.buildPythonPackage` and `python3Packages.buildPythonApplication` now warn in the presence of `unittestFlagsArray`.
-  Please use [`unittestFlags`](#using-unittestcheckhook) instead.
-  If modifying the Nix expression is not feasible, users can remediate the warning by overriding `unittestFlagsArray` with `null` or `[ ]`.
-
 - `keycloak.plugins.keycloak-metrics-spi` has been removed. Keycloak exposes Prometheus metrics natively on its management interface; enable them with the `metrics-enabled` setting (and `event-metrics-user-enabled` for login and event counters). See [Gaining insights with metrics](https://www.keycloak.org/observability/configuration-metrics).
 
 - `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
@@ -234,6 +223,8 @@
 - `proton-cli` has been updated from `2.2.3` to `3.4.0`, and installs its command as `proton`, with `proton-cli` kept beside it as a symlink.
   `3.0.0` reworked the command line - `--output` is now the response format, secrets are no longer accepted as flag values, and several subcommands moved - so scripts need a review against the [upstream changelog](https://github.com/roman-16/proton-cli/blob/main/CHANGELOG.md).
 
+- `comodoro` has been updated from 0.1.2 to 2.0.0, which brings the breaking changes of both major releases; see the [upstream changelog](https://github.com/pimalaya/comodoro/blob/v2.0.0/CHANGELOG.md).
+
 - `tengine` has been removed as it has seen seriously delayed responses to security vulnerabilities.
 
 - `jellyfin` has been upgraded to major version 12, which contains breaking changes. See the [upstream blog post](https://jellyfin.org/posts/jellyfin-release-12.0) for more information on how to safely upgrade.
@@ -274,8 +265,6 @@
 
 - `tcl.mkTclDerivation` now enables `strictDeps` and `__structuredAttrs`.
 
-- `rustPlatform.cargoSetupHook` now forces several common C libraries to be linked to the Nixpkgs library rather than the vendored library. These include: aws-lc, openssl, libz, libsqlite3, zstd, libgit2, sodium, rustonig, libssh2, nginx, duckdb, and jemalloc. Set `dontCargoUseSystemLibs = true;` to opt out.
-
 - `rssguard` 5.x uses a new database layer. Regenerate your database after upgrading, following the [RSS Guard migration notes](https://rssguard.readthedocs.io/en/stable/contrib/migrate.html).
 
 - `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
@@ -322,6 +311,8 @@
 
 - `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
 
+- `profile-sync-daemon` has been updated from `0.6.50` to `7.0.4`. This means that tmpfs mounting options other than overlayfs are not supported anymore (breaking change in `7.0.0`).
+
 - `texlive.combine` is deprecated and scheduled for removal in 27.05. Please migrate to `texliveSmall.withPackages` (see [](#sec-language-texlive-user-guide)).
 
 - `katex` has been updated from 0.16 to 0.18 and has introduced breaking changes.  See upstream changelog for details: [0.17.0](https://github.com/KaTeX/KaTeX/releases/tag/v0.17.0), [0.18.0](https://github.com/KaTeX/KaTeX/releases/tag/v0.18.0).
@@ -486,7 +477,11 @@
 
 - Firefox wrapper now accepts an optional `appDataDir` argument, which sets `MOZ_APP_DATA` to relocate Firefox application data. This is especially useful on macOS 27 and later, where wrapped Firefox applications may be denied access to profiles in traditional application data directory.
 
-- Swift has been upgraded to Swift 6.4.0 from Swift 5.10.1.
+- The `singularity` package is deprecated following Sylabs Inc.'s announcing SingularityCE's EOL.
+  SingularityCE 4.6.0 was the last release.
+  Use Apptainer (`apptainer`) instead.
+
+- Swift has been upgraded to Swift 6.3.3 from Swift 5.10.1.
   The Swift packaging has been rewritten.
 
 ## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}

doc/stdenv/meta.chapter.md

@@ -86,6 +86,7 @@ The following are all valid examples:
   - This applies when the package directly incorporates code under another license.
 
 These compound licenses may also be combined within each other: `with lib.licenses; AND [ (OR [ mit asl20 ]) gpl3Plus ]`.
+See [Multiple Licenses](#sec-meta-license-multiple) for the full set of license operators.
 
 The list of valid licenses is defined in [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix).
 See [Licenses](#sec-meta-license) for additional generic values.
@@ -227,23 +228,76 @@ If this list is not empty, the package is marked as "insecure", meaning that it
 
 When available, use a value from `lib.licenses` defined in [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix).
 Otherwise, a custom license can be defined using `lib.licenses.mkLicense`.
-These generic options are also available:
 
-### `lib.licenses.free`, `"free"` {#lib.licenses.free-free}
+### Multiple Licenses {#sec-meta-license-multiple}
+
+If the package is covered under multiple licenses, use license operators to produce compound licenses.
+These operators model the structure of SPDX license expressions, and their semantics are defined in the [SPDX specification][spdx-spec].
+
+#### `lib.licenses.OR [ ... ]` {#lib.licenses.OR}
+
+If the user is able to choose between two or more licenses, use `OR`.
+
+```nix
+# Apache-2.0 OR MIT
+lib.licenses.OR [
+  lib.licenses.asl20
+  lib.licenses.mit
+]
+```
+
+#### `lib.licenses.AND [ ... ]` {#lib.licenses.AND}
+
+If the user must simultaneously abide by the rules of two or more licenses, use `AND`.
+
+```nix
+# GPL-2.0-only AND CC-BY-3.0
+lib.licenses.AND [
+  lib.licenses.gpl2Only
+  lib.licenses.cc-by-30
+]
+```
+
+#### `lib.licenses.WITH license exception` {#lib.licenses.WITH}
+
+If the license text is modified from the original, use `WITH`.
+Common license exceptions are included in `lib.licenses`.
+
+```nix
+# Apache-2.0 WITH LLVM-exception
+lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception
+```
+
+#### `lib.licenses.PLUS license` {#lib.licenses.PLUS}
+
+If the content is licensed under the current version of the license or any later version, use `PLUS`.
+For GPL licenses, do not use the PLUS operator.
+Instead use the "-or-later" license (ex. `GPL-3.0-or-later`, `lib.licenses.gpl3Plus`).
+
+```nix
+# CDDL-1.0+
+lib.licenses.PLUS lib.licenses.cddl
+```
+
+### Generic Licenses {#sec-meta-license-generic}
+
+Although it’s typically better to indicate the specific license, the following generic options are also available.
+
+#### `lib.licenses.free`, `"free"` {#lib.licenses.free-free}
 
 Catch-all for free software licenses not listed above.
 
-### `lib.licenses.unfreeRedistributable`, `"unfree-redistributable"` {#lib.licenses.unfreeredistributable-unfree-redistributable}
+#### `lib.licenses.unfreeRedistributable`, `"unfree-redistributable"` {#lib.licenses.unfreeredistributable-unfree-redistributable}
 
 Unfree package that can be redistributed in binary form. That is, it’s legal to redistribute the *output* of the derivation. This means that the package can be included in the Nixpkgs channel.
 
 Sometimes proprietary software can only be redistributed unmodified. Make sure the builder doesn’t actually modify the original binaries; otherwise we’re breaking the license. For instance, the NVIDIA X11 drivers can be redistributed unmodified, but our builder applies `patchelf` to make them work. Thus, its license is `"unfree"` and it cannot be included in the Nixpkgs channel.
 
-### `lib.licenses.unfree`, `"unfree"` {#lib.licenses.unfree-unfree}
+#### `lib.licenses.unfree`, `"unfree"` {#lib.licenses.unfree-unfree}
 
 Unfree package that cannot be redistributed. You can build it yourself, but you cannot redistribute the output of the derivation. Thus it cannot be included in the Nixpkgs channel.
 
-### `lib.licenses.unfreeRedistributableFirmware`, `"unfree-redistributable-firmware"` {#lib.licenses.unfreeredistributablefirmware-unfree-redistributable-firmware}
+#### `lib.licenses.unfreeRedistributableFirmware`, `"unfree-redistributable-firmware"` {#lib.licenses.unfreeredistributablefirmware-unfree-redistributable-firmware}
 
 This package supplies unfree, redistributable firmware. This is a separate value from `unfree-redistributable` because not everybody cares whether firmware is free.
 
@@ -378,3 +432,5 @@ It provides an interface for additional identifiers of `mkDerivation.src` or for
 
 Additional identifiers are generally not recommended, as they might cause maintenance overhead or diverge.
 For example, a source distribution `pkg:github` may be hard to keep correctly aligned with the corresponding binary distribution `pkg:pypi`.
+
+[spdx-spec]: https://spdx.github.io/spdx-spec/v3.0.1/annexes/spdx-license-expressions/

doc/stdenv/stdenv.chapter.md

@@ -1198,9 +1198,6 @@ They cannot be overridden without rebuilding the package.
 
 If dependencies should be resolved at runtime, use `--suffix` to append fallback values to `PATH`.
 
-`makeBinaryWrapper` refuses a `--prefix` or `--suffix` value that would introduce an empty segment (an empty value, or a leading, trailing or doubled separator), because many `PATH`-like variables interpret an empty segment as the current directory.
-For variables where an empty segment is useful and safe, such as `LUA_PATH` where `;;` stands for the default search path, use `--prefix-unchecked` or `--suffix-unchecked` instead.
-
 There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.
 
 `wrapProgram` is a convenience function you probably want to use most of the time, implemented by both `makeWrapper` and `makeBinaryWrapper`.

lib/licenses/operators.nix

@@ -30,8 +30,8 @@
   };
 
   /**
-     Create a compound licenses where the user needs to follow both licenses,
-     eqivialent of spdx `and` modifier.
+     Create a compound license where the user needs to follow both licenses,
+     equivalent to the SPDX `AND` modifier.
 
     # Inputs
 
@@ -60,8 +60,8 @@
   };
 
   /**
-     Create a licenses exception where a license has a license exception,
-     eqivialent of spdx `with` modifier.
+     Create a license in which an exception has been applied,
+     equivalent to the SPDX `WITH` modifier.
 
     # Inputs
 
@@ -94,7 +94,9 @@
 
   /**
      Create a licenses which can be upgraded to any later version of itself,
-     eqivialent of spdx `+` modifier
+     equivalent to the SPDX `+` modifier.
+     For GPL licenses, do not use the PLUS modifier: use the "-or-later"
+     license (ex. `lib.licenses.gpl3Plus`).
 
     # Inputs
 

lib/modules.nix

@@ -1056,10 +1056,11 @@ let
       (
         res: opt:
         let
+          optOptions = opt.options;
           typeSet =
-            if res ? type && opt.options ? type then
+            if res ? type && optOptions ? type then
               let
-                mergedType = res.type.typeMerge opt.options.type.functor;
+                mergedType = res.type.typeMerge optOptions.type.functor;
               in
               if mergedType != null then
                 {
@@ -1071,23 +1072,24 @@ let
                   "The option `${showOption loc}' in `${opt._file}' is already declared in ${showFiles res.declarations}."
             else
               { };
-
-          bothHave = k: res ? ${k} && opt.options ? ${k};
+          getSubModules = optOptions.type.getSubModules or null;
+          submodules =
+            if getSubModules != null then
+              map (setDefaultModuleLocation opt._file) getSubModules ++ res.options
+            else
+              res.options;
         in
-        if bothHave "default" || bothHave "example" || bothHave "description" || bothHave "apply" then
+        if
+          (res ? default && optOptions ? default)
+          || (res ? example && optOptions ? example)
+          || (res ? description && optOptions ? description)
+          || (res ? apply && optOptions ? apply)
+        then
           # Keep in sync with the same error above!
           throw
             "The option `${showOption loc}' in `${opt._file}' is already declared in ${showFiles res.declarations}."
         else
-          let
-            getSubModules = opt.options.type.getSubModules or null;
-            submodules =
-              if getSubModules != null then
-                map (setDefaultModuleLocation opt._file) getSubModules ++ res.options
-              else
-                res.options;
-          in
-          opt.options
+          optOptions
           // res
           // {
             declarations = res.declarations ++ [ opt._file ];

maintainers/github-teams.json

@@ -809,13 +809,15 @@
     "name": "nixpkgs-merge-bot"
   },
   "node": {
-    "description": "Maintains Node.js runtimes and build tooling.\r\n\r\n\"JS is hecked, thanks for coming to my TED Talk\" - @lilyinstarlight",
+    "description": "Maintains Node.js runtimes and build tooling.",
     "id": 7309872,
     "maintainers": {
-      "lilyinstarlight": 298109,
       "winterqt": 78392041
     },
-    "members": {},
+    "members": {
+      "Scrumplex": 11587657,
+      "aduh95": 14309773
+    },
     "name": "Node"
   },
   "ocaml": {
@@ -970,7 +972,9 @@
       "Mic92": 96200,
       "winterqt": 78392041
     },
-    "members": {},
+    "members": {
+      "whispersofthedawn": 78233879
+    },
     "name": "rust"
   },
   "scala": {

maintainers/maintainer-list.nix

@@ -503,12 +503,6 @@
     githubId = 806876;
     name = "Aaron Jheng";
   };
-  aaronschif = {
-    email = "aaronschif@gmail.com";
-    github = "aaronschif";
-    githubId = 2258953;
-    name = "Aaron Schif";
-  };
   aaschmid = {
     email = "service@aaschmid.de";
     github = "aaschmid";
@@ -1691,6 +1685,11 @@
     githubId = 26391003;
     name = "Amadej Kastelic";
   };
+  amaidurova = {
+    github = "amaidurova";
+    githubId = 295547583;
+    name = "An Mai";
+  };
   aman9das = {
     email = "amandas62640@gmail.com";
     github = "Aman9das";
@@ -6040,6 +6039,13 @@
     githubId = 34543609;
     name = "creator54";
   };
+  creepycode = {
+    email = "nixpkgs-jvb3dh3u@creepy.sh";
+    github = "ByteZ1337";
+    githubId = 42820438;
+    name = "creepycode";
+    keys = [ { fingerprint = "62FB 090D A7C1 2EE1 326F  B69E 94D2 598D 5A23 AD5E"; } ];
+  };
   crem = {
     email = "max@alstercaminer.com";
     github = "ItsCrem";
@@ -7090,12 +7096,6 @@
     githubId = 7504556;
     name = "Dennis Bogers";
   };
-  derchris = {
-    email = "derchris@me.com";
-    github = "derchrisuk";
-    githubId = 706758;
-    name = "Christian Gerbrandt";
-  };
   derdennisop = {
     email = "dennish@wuitz.de";
     github = "DerDennisOP";
@@ -9030,12 +9030,6 @@
     githubId = 599997;
     name = "evax";
   };
-  evck = {
-    email = "eric@evenchick.com";
-    github = "ericevenchick";
-    githubId = 195032;
-    name = "Eric Evenchick";
-  };
   eveeifyeve = {
     name = "Eveeifyeve";
     github = "eveeifyeve";
@@ -12019,6 +12013,11 @@
     githubId = 890062;
     name = "Mrinal";
   };
+  iamppborah = {
+    github = "iamppborah";
+    githubId = 96339995;
+    name = "Prasurjya Pran Borah";
+  };
   iand675 = {
     email = "ian@iankduncan.com";
     github = "iand675";
@@ -14536,6 +14535,12 @@
     githubId = 1189739;
     name = "Julio Borja Barra";
   };
+  judaew = {
+    name = "Vadym-Valdis Yudaiev";
+    github = "judaew";
+    githubId = 41125715;
+    keys = [ { fingerprint = "ABB7 9CDD 371D 1A36 AC91  B5E0 E85E F1C4 A188 CE00"; } ];
+  };
   jue89 = {
     email = "me@jue.yt";
     github = "jue89";
@@ -20161,12 +20166,6 @@
     githubId = 68467027;
     name = "Mshnwq";
   };
-  msiedlarek = {
-    email = "mikolaj@siedlarek.pl";
-    github = "msiedlarek";
-    githubId = 133448;
-    name = "Mikołaj Siedlarek";
-  };
   msladecek = {
     email = "martin.sladecek+nixpkgs@gmail.com";
     name = "Martin Sladecek";
@@ -21319,6 +21318,12 @@
     name = "Guilhem Saurel";
     keys = [ { fingerprint = "9B1A 7906 5D2F 2B80 6C8A  5A1C 7D2A CDAF 4653 CF28"; } ];
   };
+  nimakalantar = {
+    name = "Nima Kalantar";
+    email = "nima.kalantar@focusrite.com";
+    github = "nimakalantar";
+    githubId = 113363856;
+  };
   nindouja = {
     email = "nindouja@proton.me";
     github = "Nindouja";
@@ -22438,7 +22443,8 @@
     name = "Andrew Benbow";
     github = "OulipianSummer";
     githubId = 47955980;
-    email = "abmurrow@duck.com";
+    email = "andrew.benbow@posteo.com";
+    keys = [ { fingerprint = "3B46 1FF7 CEC1 6977 E3EA B1E7 2A4A D301 4C02 95F1"; } ];
   };
   outfoxxed = {
     name = "outfoxxed";
@@ -23686,6 +23692,11 @@
     github = "potb";
     githubId = 10779093;
   };
+  potoo0 = {
+    name = "potoo0";
+    github = "potoo0";
+    githubId = 34411681;
+  };
   pouya = {
     email = "me@pouyacode.net";
     github = "pouya-abbassi";
@@ -28538,12 +28549,6 @@
     githubId = 850665;
     name = "Shaw Vrana";
   };
-  svsdep = {
-    email = "svsdep@gmail.com";
-    github = "svsdep";
-    githubId = 36695359;
-    name = "Vasyl Solovei";
-  };
   swaggeroo = {
     email = "swaggerooo@pm.me";
     github = "swaggeroo";
@@ -30054,6 +30059,11 @@
     githubId = 1486805;
     name = "Toon Nolten";
   };
+  toothbrush = {
+    github = "toothbrush";
+    githubId = 423357;
+    name = "toothbrush";
+  };
   tophcodes = {
     email = "toki@toph.so";
     github = "tophcodes";
@@ -30178,12 +30188,6 @@
     githubId = 28788713;
     name = "Trevor Richards";
   };
-  trevorj = {
-    email = "nix@trevor.joynson.io";
-    github = "akatrevorjay";
-    githubId = 1312290;
-    name = "Trevor Joynson";
-  };
   treyfortmuller = {
     email = "treyunofficial@gmail.com";
     github = "treyfortmuller";
@@ -31063,6 +31067,12 @@
     githubId = 19894025;
     name = "Vinny Meller";
   };
+  vinso = {
+    email = "8vinso8@gmail.com";
+    github = "8Vinso8";
+    githubId = 44764023;
+    name = "Vinso";
+  };
   vinylen = {
     email = "victor@viclab.se";
     github = "vinylen";
@@ -31828,12 +31838,6 @@
       }
     ];
   };
-  wizeman = {
-    email = "rcorreia@wizy.org";
-    github = "wizeman";
-    githubId = 168610;
-    name = "Ricardo M. Correia";
-  };
   wjohnsto = {
     name = "Will Johnston";
     github = "wjohnsto";

maintainers/scripts/build.nix

@@ -15,20 +15,25 @@
 # nix-build build.nix --argstr maintainer <yourname> --argstr system aarch64-linux
 
 let
-  # This avoids a common situation for maintainers, where due to Git's behavior of not tracking
-  # directories, they have an empty directory somewhere in `pkgs/by-name`. Because that directory
-  # exists, `pkgs/top-level/by-name-overlay.nix` picks it up and attempts to read `package.nix` out
-  # of it... which doesn't exist, since it's empty.
-  #
-  # We don't want to run the code below on every instantiation of `nixpkgs`, as the `pkgs/by-name`
-  # eval machinery is quite performance sensitive. So we use the internals of the `by-name` overlay
-  # to implement our own way to avoid an evaluation failure for this script.
-  #
-  # See <https://github.com/NixOS/nixpkgs/issues/338227> for more motivation for this code block.
-  overlay = self: super: {
-    _internalCallByNamePackageFile =
-      file: if builtins.pathExists file then super._internalCallByNamePackageFile file else null;
-  };
+  lib = import ../../lib;
+
+  # Git doesn't track directories, so switching branches can leave a `pkgs/by-name/xx/foo` directory
+  # behind that is empty or holds only untracked files. The by-name overlay would then call its
+  # nonexistent `package.nix` and fail evaluation of this whole script. Mask such entries here,
+  # rather than in `pkgs/top-level/by-name-overlay.nix`, so that every other evaluation of Nixpkgs
+  # doesn't pay for the check. See <https://github.com/NixOS/nixpkgs/issues/338227>.
+  byNameDir = ../../pkgs/by-name;
+  missingByNamePackages = lib.concatMapAttrs (
+    shard: type:
+    lib.optionalAttrs (type == "directory") (
+      lib.concatMapAttrs (
+        name: _:
+        lib.optionalAttrs (!builtins.pathExists (byNameDir + "/${shard}/${name}/package.nix")) {
+          ${name} = null;
+        }
+      ) (builtins.readDir (byNameDir + "/${shard}"))
+    )
+  ) (builtins.readDir byNameDir);
 
   nixpkgsArgs =
     removeAttrs args [
@@ -36,7 +41,7 @@ let
       "overlays"
     ]
     // {
-      overlays = args.overlays or [ ] ++ [ overlay ];
+      overlays = [ (_: _: missingByNamePackages) ] ++ args.overlays or [ ];
     };
 
   pkgs = import ./../../default.nix nixpkgsArgs;

maintainers/scripts/haskell/regenerate-hackage-packages.sh

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -E 'with import ../../.. {}; mkShell { packages = [ bash coreutils haskellPackages.cabal2nix-unstable.bin git (import ../../../ci {}).fmt.pkg ]; }'
+#! nix-shell -i bash -I nixpkgs=. -p bash coreutils haskellPackages.cabal2nix-unstable.bin git "(import <nixpkgs/ci> {}).fmt.pkg"
 
 set -euo pipefail
 

maintainers/scripts/haskell/transitive-broken-packages.nix

@@ -14,7 +14,15 @@ let
       ) x
     );
   brokenDeps = lib.subtractLists (getEvaluating pkgs.haskellPackages) (
-    getEvaluating (nixpkgs { config.allowBroken = true; }).haskellPackages
+    getEvaluating
+      (nixpkgs {
+        config.problems.matchers = lib.mkForce [
+          {
+            kind = "broken";
+            handler = "ignore";
+          }
+        ];
+      }).haskellPackages
   );
 in
 ''

maintainers/scripts/haskell/update-cabal2nix-unstable.sh

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -E 'with import ../../.. {}; mkShell { packages = [ bash coreutils curl jq gnused haskellPackages.cabal2nix-unstable.bin nix-prefetch-scripts (import ../../../ci {}).fmt.pkg ]; }'
+#! nix-shell -i bash -I nixpkgs=. -p bash coreutils curl jq gnused haskellPackages.cabal2nix-unstable.bin nix-prefetch-scripts "(import <nixpkgs/ci> {}).fmt.pkg"
 
 # Updates cabal2nix-unstable to the latest master of the nixos/cabal2nix repository.
 # See regenerate-hackage-packages.sh for details on the purpose of this script.

maintainers/team-list.nix

@@ -433,6 +433,7 @@ with lib.maintainers;
   libretro = {
     members = [
       aanderse
+      iedame
       igorcafe
       thiagokokada
     ];
@@ -600,9 +601,7 @@ with lib.maintainers;
   };
 
   node = {
-    members = [ winter ];
-    scope = "Maintain Node.js runtimes and build tooling.";
-    shortName = "Node.js";
+    github = "node";
     enableFeatureFreezePing = true;
   };
 

nixos/doc/manual/redirects.json

@@ -1747,6 +1747,12 @@
   "module-services-flatpak": [
     "index.html#module-services-flatpak"
   ],
+  "module-services-cassandra": [
+    "index.html#module-services-cassandra"
+  ],
+  "module-services-cassandra-diagnostics": [
+    "index.html#module-services-cassandra-diagnostics"
+  ],
   "module-services-tigerbeetle": [
     "index.html#module-services-tigerbeetle"
   ],

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -18,8 +18,6 @@
   +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
   ```
 
-- GNOME has been updated to version 51. Refer to the [GNOME release notes](https://release.gnome.org/51/) for more details.
-
 - `sing-box` now supports NaïveProxy outbounds.
 
 ## New Modules {#sec-release-26.11-new-modules}
@@ -81,6 +79,8 @@
 
 - [devenv](https://devenv.sh/), fast, declarative, reproducible and composable developer environments. Available as [programs.devenv](#opt-programs.devenv.enable).
 
+- [Yopass](https://yopass.se/), a secure way to share secrets, passwords and files. Available as [services.yopass](#opt-services.yopass.enable).
+
 - [Moonlight Qt](https://moonlight-stream.org/), a client for playing your PC games on almost any device. Available as [programs.moonlight-qt](#opt-programs.moonlight-qt.enable).
 
 - [udp514-journal](https://github.com/eworm-de/udp514-journal), a service to forward remote syslog messages to systemd-journal. Available as [services.udp514-journal](#opt-services.udp514-journal.enable).
@@ -131,6 +131,8 @@
 
 - [CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI), a proxy that provides OpenAI/Gemini/Claude/Codex/Grok compatible API interfaces from OAuth-based AI CLI subscriptions. Available as [services.cliproxyapi](#opt-services.cliproxyapi.enable).
 
+- [VLC media player](https://www.videolan.org/), a free and open source cross-platform multimedia player. Available as [programs.vlc](#opt-programs.vlc.enable).
+
 - [Lix TOML remote builders](https://docs.lix.systems/manual/lix/stable/advanced-topics/distributed-builds.html#using-a-toml-configuration), remote builder configuration using lix's TOML format. Available as [lix.buildMachines](#opt-lix.buildMachines). Note: incompatible with `nix.buildMachines`.
 
 - [Forgejo Runner](https://forgejo.org/docs/latest/admin/actions/), a daemon for Forgejo Actions. Available as [services.forgejo-runner](#opt-services.forgejo-runner.instances).
@@ -211,6 +213,8 @@
 
 - [Vouch Proxy](https://github.com/vouch/vouch-proxy), an SSO and OAuth / OIDC login solution for Nginx using the auth_request module. Available as [services.vouch-proxy](#opt-services.vouch-proxy.enable).
 
+- [Grimmory](https://grimmory.org/), a self-hosted library for your ebooks, comics, and audiobooks. Available as [services.grimmory](#opt-services.grimmory.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -501,6 +505,8 @@
 
 - `services.minio` has been removed because the `minio` package was abandoned upstream and therefore dropped from nixpkgs.
 
+- The `services.scx` module has been removed. Please migrate to [`services.scx-loader`](#opt-services.scx-loader.enable) instead.
+
 - `hydra` has been updated to the Rust queue runner/evaluator:
   - `services.hydra.dbi` was replaced by [services.hydra.dbUrl](#opt-services.hydra.dbUrl), which takes a `postgres://` URL instead of a DBI string.
   - `services.hydra.buildMachinesFiles` was removed. The queue runner no longer connects to build machines over SSH. Instead each build machine (including the Hydra host itself, if it should build) must enable [services.hydra-builder](#opt-services.hydra-builder.enable) and point it at [services.hydra.queueRunner.grpc](#opt-services.hydra.queueRunner.grpc.port).
@@ -533,6 +539,10 @@
 
 - `services.k3s` and `services.rke2` now expose the images declared in `images` through a `/nix/store` directory symlinked into `/var/lib/rancher/${name}/agent/images/nixos/`. The directory's store path changes whenever any image derivation changes, which makes k3s/rke2 detect and re-import the new archives, while `/var/lib/rancher/${name}/agent/images/` itself remains a normal directory that can still be used for manually added images. Previously, each image was linked with a fixed file name directly in that directory, so the cluster would not notice image updates and old symlinks could become dangling. After upgrading, you may want to remove those dangling symlinks (that was the case already when you wanted to stop deploying an image).
 
+- `services.cassandra` now writes JVM crash logs (`hs_err_pid*.log`) to [`services.cassandra.homeDir`](#opt-services.cassandra.homeDir) instead of `/tmp`.
+
+- `services.cassandra` now runs with `PrivateTmp`. Cassandra keeps no durable or high-traffic data in `/tmp`, so this change only improves the security posture, but at the cost of ease of access to some diagnostic files. The private `/tmp` is a directory on the same file system as before, and systemd removes it when the service stops. See [](#module-services-cassandra-diagnostics) for the files that this affects, and for the commands that now need to run in the mount namespace of the service.
+
 - `programs.regreet` has been renamed to `services.displayManager.regreet`.
 
 - [`programs.hyprland`](#opt-programs.hyprland.enable) no longer installs a `cap_sys_nice` security wrapper for `Hyprland`. Since 0.57.0, Hyprland requests realtime scheduling from rtkit instead, so the module now enables [`security.rtkit`](#opt-security.rtkit.enable) by default.
@@ -593,13 +603,15 @@ The above example can be migrated via the following structured code block:
 
 - The new {option}`programs.ssh.hosts` option can be used to add `Host` blocks to the client {file}`ssh_config`, keyed by `Host` pattern, instead of writing them by hand via {option}`programs.ssh.extraConfig`. Each block declares an {option}`programs.ssh.hosts.<name>.order`, since `ssh_config` applies the first obtained value for each keyword.
 
+- `services.openssh` now generates a hybrid post-quantum ML-DSA 44/Ed25519 host key at {file}`/etc/ssh/ssh_host_mldsa44_ed25519_key` by default.
+
 - `services.esphome` has been rewritten to use the new [ESPHome Device Builder](https://github.com/esphome/device-builder) which replaces the previous ESPHome dashboard. Most settings have been converted to equivalent or comparable Device Builder settings. The option `services.esphome.usePing` has been removed since the Device Builder does not have such an option.
 
 - `services.hostapd` gained [`interfaceName`](#opt-services.hostapd.radios._name_.networks._name_.interfaceName) per network, separating the interface name emitted in the hostapd configuration from the network attribute name. Secondary BSSs on different radios can now share an interface name (for example `mld0`) when configured as links of the same Wi-Fi 7 multi-link device with `settings.mld_ap = true`, which is required for MLO support. It defaults to the attribute name, so existing configurations are unchanged.
 
 - NixOS VM tests now prefer to express durations and timeouts as `datetime.timedelta` values instead of bare numbers. Methods such as `machine.wait_until_succeeds`, `machine.sleep`, `retry`, and `polling_condition` now accept a `timedelta` (e.g., `machine.wait_for_unit("sshd.service", timeout=datetime.timedelta(minutes=1))`). Passing an `int`/`float` as seconds still works but now emits a deprecation warning. Argument names that explicitly defined units were preserved but have had `timedelta` equivalents introduced (`timeout_seconds` → `timeout`, `secs` → `duration`, `seconds_interval` → `interval`).
 
-- `darwin.linux-builder-vz` has been added: a variant of `darwin.linux-builder` that runs the builder guest on Apple's Virtualization.framework via the new `vzvm` package, translating `x86_64-linux` builds with Rosetta instead of emulating them. Apple silicon hosts only. As part of this, the `nixos/modules/profiles/nix-builder-vm.nix` profile has been split into the backend-neutral `nixos/modules/profiles/nix-builder.nix` and a QEMU-specific part. Existing imports of `nix-builder-vm.nix` keep working unchanged.
+- `darwin.linux-builder-vz` has been added: a variant of `darwin.linux-builder` that runs the builder guest on Apple's Virtualization.framework via the new `vzvm` package, translating `x86_64-linux` builds with Rosetta instead of emulating them. Apple silicon hosts only. The guest boots on demand and powers off after 10 idle minutes, see `virtualisation.vz.idleTimeout`. As part of this, the `nixos/modules/profiles/nix-builder-vm.nix` profile has been split into the backend-neutral `nixos/modules/profiles/nix-builder.nix` and a QEMU-specific part. Existing imports of `nix-builder-vm.nix` keep working unchanged.
 
 - [services.netbox](#opt-services.netbox.enable) has received a number of updates:
   - Default settings can now be introspected at [](#opt-services.netbox.settings).

nixos/lib/make-system-tarball.sh

@@ -41,8 +41,7 @@ mkdir -p $out/tarball
 
 rm env-vars
 
-# Store optimization can change hardlink topology without changing input NARs.
-time tar --hard-dereference --sort=name --mtime='@1' --owner=0 --group=0 --numeric-owner -c * $extraArgs | $compressCommand > $out/tarball/$fileName.tar${extension}
+time tar --sort=name --mtime='@1' --owner=0 --group=0 --numeric-owner -c * $extraArgs | $compressCommand > $out/tarball/$fileName.tar${extension}
 
 mkdir -p $out/nix-support
 echo $system > $out/nix-support/system

nixos/maintainers/scripts/incus/incus-container-image.nix

@@ -3,6 +3,9 @@
 {
   imports = [ ../../../modules/virtualisation/lxc-container.nix ];
 
+  # Non-nesting containers lack the namespaces needed by the Nix build sandbox.
+  system.installer.channel.disableSandbox = lib.mkDefault true;
+
   virtualisation.lxc.templates.nix = {
     enable = true;
     target = "/etc/nixos/incus.nix";

nixos/modules/config/fonts/fontconfig.nix

@@ -30,6 +30,7 @@ let
   cfg = config.fonts.fontconfig;
 
   fcBool = x: "<bool>" + (lib.boolToString x) + "</bool>";
+  pkg = pkgs.fontconfig;
 
   # configuration file to read fontconfig cache
   # priority 0
@@ -48,7 +49,7 @@ let
           inherit fontconfig;
           fontDirectories = config.fonts.packages;
         };
-      cache = makeCache cfg.package;
+      cache = makeCache pkgs.fontconfig;
       cache32 = makeCache pkgs.pkgsi686Linux.fontconfig;
     in
     pkgs.writeText "fc-00-nixos-cache.conf" ''
@@ -208,7 +209,7 @@ let
   # Replace default linked config with a different variant
   replaceDefaultConfig = defaultConfig: newConfig: ''
     rm $dst/${defaultConfig}
-    ln -s ${cfg.package.out}/share/fontconfig/conf.avail/${newConfig} \
+    ln -s ${pkg.out}/share/fontconfig/conf.avail/${newConfig} \
           $dst/
   '';
 
@@ -223,7 +224,7 @@ let
         mkdir -p $dst
 
         # fonts.conf
-        ln -s ${cfg.package.out}/etc/fonts/fonts.conf \
+        ln -s ${pkg.out}/etc/fonts/fonts.conf \
               $dst/../fonts.conf
         # TODO: remove this legacy symlink once people stop using packages built before #95358 was merged
         mkdir -p $out/etc/fonts/2.11
@@ -231,7 +232,7 @@ let
               $out/etc/fonts/2.11/fonts.conf
 
         # fontconfig default config files
-        ln -s ${cfg.package.out}/etc/fonts/conf.d/*.conf \
+        ln -s ${pkg.out}/etc/fonts/conf.d/*.conf \
               $dst/
 
         ${lib.optionalString (!cfg.antialias) (
@@ -351,8 +352,6 @@ in
           '';
         };
 
-        package = lib.mkPackageOption pkgs "fontconfig" { };
-
         confPackages = lib.mkOption {
           internal = true;
           type = with lib.types; listOf path;
@@ -628,14 +627,14 @@ in
   };
   config = lib.mkMerge [
     (lib.mkIf cfg.enable {
-      environment.systemPackages = [ cfg.package ];
+      environment.systemPackages = [ pkgs.fontconfig ];
       environment.etc.fonts.source = "${fontconfigEtc}/etc/fonts/";
       security.apparmor.includes."abstractions/fonts" = ''
         # fonts.conf
-        r ${cfg.package.out}/etc/fonts/fonts.conf,
+        r ${pkg.out}/etc/fonts/fonts.conf,
 
         # fontconfig default config files
-        r ${cfg.package.out}/etc/fonts/conf.d/*.conf,
+        r ${pkg.out}/etc/fonts/conf.d/*.conf,
 
         # 00-nixos-cache.conf
         r ${cacheConf},
@@ -645,7 +644,7 @@ in
 
         # 50-user.conf
         ${lib.optionalString cfg.includeUserConf ''
-          r ${cfg.package.out}/etc/fonts/conf.d.bak/50-user.conf,
+          r ${pkg.out}/etc/fonts/conf.d.bak/50-user.conf,
         ''}
 
         # local.conf (indirect priority 51)

nixos/modules/config/nix.nix

@@ -168,8 +168,15 @@ in
         default = pkgs.nix;
         defaultText = lib.literalExpression "pkgs.nix";
         description = ''
-          This option specifies the Nix package instance to use throughout the system.
+          This option specifies the Nix package to use throughout the system.
+          It can be used to set a specific version or alternative implementation.
         '';
+        example = [
+          "pkgs.nixVersions.git"
+          "pkgs.nixVersions.latest"
+          "pkgs.nixStatic"
+          "pkgs.lixPackageSets.git.lix"
+        ];
       };
 
       checkConfig = mkOption {

nixos/modules/hardware/video/displaylink.nix

@@ -11,7 +11,7 @@ let
   evdi = config.boot.kernelPackages.evdi;
 
   displaylink = pkgs.displaylink.override {
-    inherit evdi;
+    linuxPackages = config.boot.kernelPackages;
   };
 
 in

nixos/modules/installer/cd-dvd/channel.nix

@@ -44,6 +44,10 @@ in
     // {
       default = true;
     };
+
+  options.system.installer.channel.disableSandbox =
+    lib.mkEnableOption "disabling the Nix build sandbox when initializing the bundled channel";
+
   config = lib.mkIf config.system.installer.channel.enable {
     # Pin the nixpkgs flake in the installer to our cleaned up nixpkgs source.
     # FIXME: this might be surprising and is really only needed for offline installations,
@@ -89,7 +93,7 @@ in
           echo "unpacking the NixOS/Nixpkgs sources..."
           mkdir -p /nix/var/nix/profiles/per-user/root
           ${lib.getExe' config.nix.package.out "nix-env"} -p /nix/var/nix/profiles/per-user/root/channels \
-            -i ${channelSources} --quiet --option build-use-substitutes false
+            -i ${channelSources} --quiet --option build-use-substitutes false${lib.optionalString config.system.installer.channel.disableSandbox " --option sandbox false"}
           mkdir -m 0700 -p /root/.nix-defexpr
           ln -sfvT /nix/var/nix/profiles/per-user/root/channels /root/.nix-defexpr/channels
           mkdir -m 0755 -p /var/lib/nixos

nixos/modules/module-list.nix

@@ -226,6 +226,7 @@
   ./programs/flashrom.nix
   ./programs/flexoptix-app.nix
   ./programs/foot
+  ./programs/framework-settings.nix
   ./programs/freetds.nix
   ./programs/fuse.nix
   ./programs/fzf.nix
@@ -361,6 +362,7 @@
   ./programs/vim.nix
   ./programs/virt-manager.nix
   ./programs/vivid.nix
+  ./programs/vlc.nix
   ./programs/vscode.nix
   ./programs/wavemon.nix
   ./programs/wayland/dux-shell.nix
@@ -1551,7 +1553,6 @@
   ./services/scheduling/gocron.nix
   ./services/scheduling/prefect.nix
   ./services/scheduling/scx-loader.nix
-  ./services/scheduling/scx.nix
   ./services/search/elasticsearch-curator.nix
   ./services/search/elasticsearch.nix
   ./services/search/hound.nix
@@ -1747,6 +1748,7 @@
   ./services/web-apps/goupile.nix
   ./services/web-apps/grav.nix
   ./services/web-apps/greenlight.nix
+  ./services/web-apps/grimmory.nix
   ./services/web-apps/grist.nix
   ./services/web-apps/grocy.nix
   ./services/web-apps/guacamole-client.nix
@@ -1897,6 +1899,7 @@
   ./services/web-apps/windmill.nix
   ./services/web-apps/wordpress.nix
   ./services/web-apps/writefreely.nix
+  ./services/web-apps/yopass.nix
   ./services/web-apps/your_spotify.nix
   ./services/web-apps/youtrack.nix
   ./services/web-apps/zabbix.nix

nixos/modules/profiles/nix-builder-vm.nix

@@ -21,6 +21,7 @@
         {
           from = "host";
           guest.port = 22;
+          host.address = "127.0.0.1";
           host.port = config.virtualisation.darwin-builder.hostPort;
         }
       ];

nixos/modules/profiles/nix-builder-vz-vm.nix

@@ -40,6 +40,8 @@ in
       }
     ];
 
+    virtualisation.vz.idleTimeout = lib.mkDefault (10 * 60);
+
     # The guest console belongs where a Mac user looks for service logs. Switch to `file`
     # for a complete record: the unified log drops messages under bursts.
     virtualisation.vz.console = lib.mkDefault "log";

nixos/modules/profiles/nix-builder.nix

@@ -200,11 +200,24 @@ in
           ''
         );
 
-        run-builder = hostPkgs.writeShellScriptBin "run-builder" ''
-          set -euo pipefail
-          KEYS="''${KEYS:-./keys}"
-          KEYS="$(${hostPkgs.nix}/bin/nix-store --add "$KEYS")" ${lib.getExe config.system.build.vm}
-        '';
+        mkRunBuilder =
+          vm:
+          hostPkgs.writeShellScriptBin "run-builder" ''
+            set -euo pipefail
+            KEYS="''${KEYS:-./keys}"
+
+            temporaryDirectory="$(${hostPkgs.coreutils}/bin/mktemp -d)"
+            trap '${hostPkgs.coreutils}/bin/rm -rf "$temporaryDirectory"' EXIT
+
+            # The guest needs only the public key. Store imports are world-readable.
+            ${hostPkgs.coreutils}/bin/install -Dm444 \
+              "$KEYS/${user}_${keyType}.pub" \
+              "$temporaryDirectory/keys/${user}_${keyType}.pub"
+
+            KEYS="$(${hostPkgs.nix}/bin/nix-store --add "$temporaryDirectory/keys")" ${lib.getExe vm}
+          '';
+
+        run-builder = mkRunBuilder config.system.build.vm;
 
       in
       hostPkgs.writeTextFile {

nixos/modules/programs/browserpass.nix

@@ -27,10 +27,6 @@
         # vivaldi
         "opt/vivaldi/native-messaging-hosts/${appId}".source = source "hosts/chromium";
         "opt/vivaldi/policies/managed/${appId}".source = source "policies/chromium";
-
-        # brave
-        "opt/brave/native-messaging-hosts/${appId}".source = source "hosts/chromium";
-        "opt/brave/policies/managed/${appId}".source = source "policies/chromium";
       };
     programs.firefox.nativeMessagingHosts.packages = [ pkgs.browserpass ];
   };

nixos/modules/programs/chromium.nix

@@ -22,7 +22,7 @@ in
 
   options = {
     programs.chromium = {
-      enable = lib.mkEnableOption "policies for chromium based browsers like Chromium, Google Chrome or Brave";
+      enable = lib.mkEnableOption "policies for chromium based browsers like Chromium or Google Chrome";
 
       enablePlasmaBrowserIntegration = lib.mkEnableOption "Native Messaging Host for Plasma Browser Integration";
 
@@ -187,16 +187,6 @@ in
       "opt/chrome/policies/recommended/extra.json" = lib.mkIf (cfg.extraOptsRecommended != { }) {
         text = builtins.toJSON cfg.extraOptsRecommended;
       };
-      # for brave
-      "brave/policies/managed/default.json" = lib.mkIf (defaultProfile != { }) {
-        text = builtins.toJSON defaultProfile;
-      };
-      "brave/policies/managed/extra.json" = lib.mkIf (cfg.extraOpts != { }) {
-        text = builtins.toJSON cfg.extraOpts;
-      };
-      "brave/policies/recommended/extra.json" = lib.mkIf (cfg.extraOptsRecommended != { }) {
-        text = builtins.toJSON cfg.extraOptsRecommended;
-      };
     };
   };
 }

nixos/modules/programs/coolercontrol.nix

@@ -7,12 +7,20 @@
 
 let
   cfg = config.programs.coolercontrol;
+  pluginUser = "cc-plugin-user";
 in
 {
   ##### interface
   options = {
     programs.coolercontrol = {
       enable = lib.mkEnableOption "CoolerControl GUI & its background services";
+
+      plugins.enable = lib.mkEnableOption ''
+        support for CoolerControl service plugins.
+
+        Declares the `${pluginUser}` system user and group that unprivileged plugins run
+        as.
+      '';
     };
   };
 
@@ -39,15 +47,36 @@ in
 
           # https://github.com/NixOS/nixpkgs/issues/81138
           services = {
-            coolercontrold.wantedBy = [ "multi-user.target" ];
+            coolercontrold = {
+              wantedBy = [ "multi-user.target" ];
+
+              # The daemon writes a unit file per service plugin, then reloads and starts
+              # it. Its default target, /etc/systemd/system, is a symlink into the store
+              # here, so the write fails. /run/systemd/system is writable and systemd
+              # searches it ahead of /etc. Units there do not survive a reboot, which is
+              # fine: the daemon rewrites them for every plugin on each start.
+              environment.CC_SERVICE_DIR = "/run/systemd/system";
+            };
           };
         };
       }
+
+      # Service plugins
+      (lib.mkIf cfg.plugins.enable {
+        users.users.${pluginUser} = {
+          isSystemUser = true;
+          group = pluginUser;
+          description = "CoolerControl unprivileged plugin user";
+        };
+
+        # A plugin unit sets both User= and Group= to this name, and the daemon chowns
+        # plugin directories to `${pluginUser}:${pluginUser}`.
+        users.groups.${pluginUser} = { };
+      })
     ]
   );
 
   meta.maintainers = with lib.maintainers; [
-    OPNA2608
     codifryed
   ];
 }

nixos/modules/programs/framework-settings.nix

@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.programs.framework-settings;
+in
+{
+  options.programs.framework-settings = {
+    enable = lib.mkEnableOption "framework-settings";
+    package = lib.mkPackageOption pkgs "framework-settings" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    services.dbus.packages = [ cfg.package ];
+    security.polkit.enable = true;
+    systemd.packages = [ cfg.package ];
+    # Reapply write-only hardware settings after reboot.
+    systemd.services.frameworkd.wantedBy = [ "multi-user.target" ];
+  };
+}

nixos/modules/programs/vlc.nix

@@ -0,0 +1,57 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+let
+  cfg = config.programs.vlc;
+in
+{
+  options = {
+    programs.vlc = {
+      enable = lib.mkEnableOption "VideoLAN's VLC media player";
+      package = lib.mkPackageOption pkgs "vlc" { };
+
+      chromecast.openFirewall = lib.mkEnableOption "" // {
+        description = ''
+          Open the default port (8010) in the firewall for Chromecast to work.
+
+          Make sure to use the `vlc` package with
+          `chromecastSupport = true`, which is the default.
+        '';
+      };
+
+      plugins = lib.mkOption {
+        default = [ ];
+        # TODO: List 2 plugins in the example once there are enough in nixpkgs
+        example = lib.literalExpression "[ pkgs.vlc-bittorrent ]";
+        type = with lib.types; listOf package;
+        description = ''
+          List of VLC plugins to use.
+        '';
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    environment.variables = lib.mkIf (cfg.plugins != [ ]) {
+      # VLC_PLUGIN_PATH expects a single folder containing the user-supplied
+      # plugins, not a list of directories separated by a color (:). So we
+      # symlink the plugins together.
+      VLC_PLUGIN_PATH = pkgs.symlinkJoin {
+        name = "custom-vlc-plugins";
+        paths = cfg.plugins;
+      };
+    };
+
+    # vlc's chromecastSupport requires TCP port 8010 to be open for it to work
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.chromecast.openFirewall [
+      8010
+    ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ kintrix ];
+}

nixos/modules/rename.nix

@@ -604,6 +604,7 @@ in
     (mkRemovedOptionModule [ "services" "castopod" ] ''
       services.castopod has been removed together with pkgs.castopod.
     '')
+    (mkRemovedOptionModule [ "services" "scx" ] "Please migrate to services.scx-loader instead.")
     # Do NOT add any option renames here, see top of the file
   ];
 }

nixos/modules/services/audio/music-assistant.nix

@@ -12,6 +12,7 @@ let
     mkEnableOption
     mkOption
     mkPackageOption
+    mkDefault
     types
     ;
 
@@ -153,9 +154,10 @@ in
       avahi = lib.mkIf (lib.elem "airplay_receiver" cfg.providers) {
         enable = true;
         openFirewall = lib.mkIf cfg.openFirewall true;
-        publish = {
-          enable = true;
-          userServices = true;
+        settings.publish = {
+          disable-publishing = false;
+          disable-user-service-publishing = false;
+          publish-addresses = true;
         };
       };
 

nixos/modules/services/databases/cassandra.md

@@ -0,0 +1,45 @@
+# Apache Cassandra {#module-services-cassandra}
+
+*Source:* {file}`modules/services/databases/cassandra.nix`
+
+*Upstream documentation:* <https://cassandra.apache.org/doc/latest/>
+
+Apache Cassandra is a distributed, wide-column NoSQL database.
+
+To enable Cassandra, add the following to your {file}`configuration.nix`:
+```nix
+{ services.cassandra.enable = true; }
+```
+
+Cassandra keeps its data, commit log, saved caches and hints in subdirectories of [](#opt-services.cassandra.homeDir), {file}`/var/lib/cassandra` by default.
+
+## Diagnostics {#module-services-cassandra-diagnostics}
+
+The service has a private {file}`/tmp`, which other processes see as {file}`/proc/<pid>/root/tmp` while the service runs, where `<pid>` is the main PID of {file}`cassandra.service`:
+```shell
+systemctl show --property MainPID --value cassandra.service
+```
+systemd removes the private {file}`/tmp` when the service stops.
+
+Diagnostic files go to these places:
+
+- JVM crash logs go to {file}`hs_err_pid<pid>.log` in [](#opt-services.cassandra.homeDir).
+
+- To get heap dumps, give the JVM a directory that the `cassandra` user can write, on a file system with space for an {file}`.hprof` file as large as the heap:
+  ```nix
+  { services.cassandra.jvmOpts = [ "-XX:HeapDumpPath=/var/lib/cassandra" ]; }
+  ```
+
+- The output of the JMX operation `dumpInterArrivalTimes` goes to {file}`failuredetector-*.dat` in the private {file}`/tmp`.
+
+- Copies of commit log entries that Cassandra cannot deserialize go to {file}`mutation*dat` in the private {file}`/tmp`, and systemd removes them when the failed start stops the unit.
+
+`jcmd` is the JDK's tool to send diagnostic commands to a running JVM, for example for a thread dump, a heap dump or a Java Flight Recorder recording.
+It comes with the JDK that runs Cassandra, `services.cassandra.package.jre`.
+Run it in the mount namespace of the service, as the `cassandra` user:
+```shell
+pid=$(systemctl show --property MainPID --value cassandra.service)
+nsenter --target "$pid" --mount runuser -u cassandra -- jcmd "$pid" VM.version
+```
+
+`jps` does not show Cassandra, because the {file}`conf/jvm-server.options` that comes with Cassandra sets `-XX:+PerfDisableSharedMem` to avoid GC pauses.

nixos/modules/services/databases/cassandra.nix

@@ -98,8 +98,16 @@ let
     map (role: "${role.username} ${role.password}") cfg.jmxRoles
   );
 
+  # Ahead of jvmOpts, so that those override them.
+  defaultJvmOptions = [
+    # The working directory is not writable, so the JVM would fall back to /tmp.
+    # %% because systemd expands specifiers in Environment=.
+    "-XX:ErrorFile=${cfg.homeDir}/hs_err_pid%%p.log"
+  ];
+
   fullJvmOptions =
-    cfg.jvmOpts
+    defaultJvmOptions
+    ++ cfg.jvmOpts
     ++ [
       # Historically, we don't use a log dir, whereas the upstream scripts do
       # expect this. We override those by providing our own -Xlog:gc flag.
@@ -512,6 +520,7 @@ in
         Group = cfg.group;
         ExecStart = "${cfg.package}/bin/cassandra -f";
         SuccessExitStatus = 143;
+        PrivateTmp = true;
       };
     };
 
@@ -523,6 +532,7 @@ in
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
+        PrivateTmp = true;
         ExecStart = concatStringsSep " " (
           [
             "${cfg.package}/bin/nodetool"
@@ -552,6 +562,7 @@ in
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
+        PrivateTmp = true;
         ExecStart = concatStringsSep " " (
           [
             "${cfg.package}/bin/nodetool"
@@ -573,5 +584,6 @@ in
     };
   };
 
+  meta.doc = ./cassandra.md;
   meta.maintainers = with lib.maintainers; [ roberth ];
 }

nixos/modules/services/desktop-managers/gnome.nix

@@ -461,38 +461,35 @@ in
             pkgs.gtk3.out # for gtk-launch program
             pkgs.xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
             pkgs.xdg-user-dirs-gtk # Used to create the default bookmarks
-            pkgs.gnome-extensions-app
-            pkgs.gnome-tecla
           ];
         in
         mandatoryPackages ++ removeExcluded optionalPackages;
     })
 
-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-51/elements/core/meta-gnome-core-apps.bst
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-apps.bst
     (lib.mkIf serviceCfg.core-apps.enable {
       environment.systemPackages = removeExcluded [
         pkgs.baobab
         pkgs.decibels
         pkgs.epiphany
+        pkgs.gnome-text-editor
         pkgs.gnome-calculator
         pkgs.gnome-calendar
         pkgs.gnome-characters
         pkgs.gnome-clocks
-        pkgs.gnome-connections
         pkgs.gnome-console
         pkgs.gnome-contacts
-        # gnome-disk-utility is controlled below via `programs.gnome-disks`
         pkgs.gnome-font-viewer
         pkgs.gnome-logs
         pkgs.gnome-maps
         pkgs.gnome-music
-        # gnome-software is controlled below via `services.gnome.gnome-software`
         pkgs.gnome-system-monitor
-        pkgs.gnome-text-editor
+        pkgs.gnome-tecla
         pkgs.gnome-weather
         pkgs.loupe
         pkgs.nautilus
         pkgs.papers
+        pkgs.gnome-connections
         pkgs.showtime
         pkgs.simple-scan
         pkgs.snapshot
@@ -529,7 +526,6 @@ in
       ];
     })
 
-    # Note: This is an arbitrary list of packages, there is no "official" list of GNOME games.
     (lib.mkIf serviceCfg.games.enable {
       environment.systemPackages = removeExcluded [
         pkgs.aisleriot
@@ -555,13 +551,18 @@ in
       ];
     })
 
-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-51/elements/core/meta-gnome-core-developer-tools.bst
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-developer-tools.bst
     (lib.mkIf serviceCfg.core-developer-tools.enable {
       environment.systemPackages = removeExcluded [
         pkgs.dconf-editor
         pkgs.devhelp
         pkgs.d-spy
         pkgs.gnome-builder
+        # boxes would make sense in this option, however
+        # it doesn't function well enough to be included
+        # in default configurations.
+        # https://github.com/NixOS/nixpkgs/issues/60908
+        # pkgs.gnome-boxes
         pkgs.sysprof
       ];
 

nixos/modules/services/desktops/pipewire/pipewire.nix

@@ -393,6 +393,8 @@ in
       }
     ];
 
+    warnings = lib.optional cfg.jack.enable "`services.pipewire.jack.enable` is deprecated, because it introduces global impurity via `LD_LIBRARY_PATH`. Use the `pw-jack` wrapper from `pipewire.jack` where necessary instead.";
+
     environment.systemPackages = [ cfg.package ] ++ optional cfg.jack.enable jack-libs;
 
     systemd.packages = [ cfg.package ];

nixos/modules/services/display-managers/gdm.nix

@@ -353,26 +353,8 @@ in
           };
         }
       ]
-      ++ lib.optionals (!config.security.pam.p11.enable) [
-        {
-          settings."org/gnome/login-screen" = {
-            enable-smartcard-authentication = false;
-          };
-        }
-      ]
       ++ [ "${gdm}/share/gdm/greeter-dconf-defaults" ];
 
-    programs.dconf.profiles.user.databases = [
-      {
-        settings."org/gnome/login-screen" = {
-          enable-smartcard-authentication = config.security.pam.p11.enable;
-
-          # We currently don't provide a `gdm-switchable-auth` PAM service.
-          enable-switchable-authentication = false;
-        };
-      }
-    ];
-
     # Use AutomaticLogin if delay is zero, because it's immediate.
     # Otherwise with TimedLogin with zero seconds the prompt is still
     # presented and there's a little delay.
@@ -689,85 +671,6 @@ in
           ];
         };
       };
-
-      # Do not attempt to authenticate via smartcard when the login option
-      # "Password" is selected (gdm-password).
-      login.p11Auth = lib.mkIf config.security.pam.p11.enable false;
-
-      gdm-smartcard = lib.mkIf config.security.pam.p11.enable {
-        useDefaultRules = false;
-        rules = {
-          auth = utils.pam.autoOrderRules [
-            {
-              name = "nologin";
-              control = "requisite";
-              modulePath = "${config.security.pam.package}/lib/security/pam_nologin.so";
-            }
-            {
-              name = "faillock";
-              control = "requisite";
-              modulePath = "${config.security.pam.package}/lib/security/pam_faillock.so";
-              settings.preauth = true;
-            }
-            {
-              name = "p11";
-              control = "required";
-              modulePath = "${pkgs.pam_p11}/lib/security/pam_p11.so";
-              args = [
-                "${pkgs.opensc}/lib/opensc-pkcs11.so"
-              ];
-            }
-            {
-              name = "shells";
-              control = "required";
-              modulePath = "${config.security.pam.package}/lib/security/pam_shells.so";
-            }
-            {
-              name = "env";
-              control = "required";
-              modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
-              settings.conffile = "/etc/pam/environment";
-              settings.readenv = 0;
-            }
-            {
-              name = "gdm";
-              enable = pamLogin.enable && pamLogin.enableGnomeKeyring;
-              control = "[success=ok default=1]";
-              modulePath = "${gdm}/lib/security/pam_gdm.so";
-            }
-            {
-              name = "gnome_keyring";
-              enable = pamLogin.enable && pamLogin.enableGnomeKeyring;
-              control = "optional";
-              modulePath = "${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so";
-            }
-          ];
-
-          account = utils.pam.autoOrderRules [
-            {
-              name = "login";
-              control = "include";
-              modulePath = "login";
-            }
-          ];
-
-          password = utils.pam.autoOrderRules [
-            {
-              name = "deny";
-              control = "required";
-              modulePath = "${config.security.pam.package}/lib/security/pam_deny.so";
-            }
-          ];
-
-          session = utils.pam.autoOrderRules [
-            {
-              name = "login";
-              control = "include";
-              modulePath = "login";
-            }
-          ];
-        };
-      };
     };
 
   };

nixos/modules/services/hardware/nvidia-container-toolkit/default.nix

@@ -220,7 +220,7 @@
       ];
 
       services.udev.extraRules = ''
-        KERNEL=="nvidia", RUN+="${lib.getExe' config.systemd.package "systemctl"} --no-block restart nvidia-container-toolkit-cdi-generator.service'"
+        KERNEL=="nvidia", RUN+="${lib.getExe' config.systemd.package "systemctl"} --no-block restart nvidia-container-toolkit-cdi-generator.service"
       '';
 
       virtualisation = {

nixos/modules/services/home-automation/matterjs-server.nix

@@ -62,6 +62,8 @@ in
       after = [ "network-online.target" ];
       wants = [ "network-online.target" ];
 
+      path = [ pkgs.iputils ];
+
       serviceConfig =
         let
           bluetoothCaps = [
@@ -87,8 +89,8 @@ in
           DynamicUser = true;
 
           # Required for interaction with hci devices and bluetooth sockets
-          AmbientCapabilities = lib.optionals cfg.bluetoothSupport bluetoothCaps;
-          CapabilityBoundingSet = lib.optionals cfg.bluetoothSupport bluetoothCaps;
+          AmbientCapabilities = if cfg.bluetoothSupport then bluetoothCaps else [ "" ];
+          CapabilityBoundingSet = if cfg.bluetoothSupport then bluetoothCaps else [ "" ];
           LockPersonality = true;
           NoNewPrivileges = true;
           PrivateTmp = true;
@@ -117,6 +119,10 @@ in
           SystemCallFilter = [
             "@system-service"
             "~@privileged"
+
+            # ping from iputils (used for pinging nodes) needs this to drop privileges
+            "capset"
+            "setuid"
           ];
           UMask = "0077";
         };

nixos/modules/services/misc/tabby.nix

@@ -98,7 +98,7 @@ in
 
           - nixpkgs.config.cudaSupport
           - nixpkgs.config.rocmSupport
-          - if stdenv.hostPlatform.isDarwin
+          - if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64
 
           IFF multiple acceleration methods are found to be enabled or if you
           haven't set either `cudaSupport or rocmSupport` you will have to

nixos/modules/services/monitoring/kener.nix

@@ -115,6 +115,7 @@ in
         StateDirectoryMode = "750";
         DynamicUser = true;
         ExecStart = "${cfg.package}/bin/kener-server";
+        EnvironmentFile = cfg.environmentFile;
         Restart = "on-failure";
         AmbientCapabilities = "";
         CapabilityBoundingSet = "";

nixos/modules/services/network-filesystems/litestream/default.nix

@@ -7,6 +7,7 @@
 let
   cfg = config.services.litestream;
   settingsFormat = pkgs.formats.yaml { };
+  settingsFile = settingsFormat.generate "litestream-config.yaml" cfg.settings;
 in
 {
   options.services.litestream = {
@@ -65,16 +66,13 @@ in
 
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
-    environment.etc = {
-      "litestream.yml" = {
-        source = settingsFormat.generate "litestream-config.yaml" cfg.settings;
-      };
-    };
+    environment.etc."litestream.yml".source = settingsFile;
 
     systemd.services.litestream = {
       description = "Litestream";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
+      restartTriggers = [ settingsFile ];
       serviceConfig = {
         EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
         ExecStart = "${cfg.package}/bin/litestream replicate";

nixos/modules/services/networking/mihomo.nix

@@ -67,6 +67,25 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    security.polkit = lib.mkIf (cfg.tunMode && config.services.resolved.enable) {
+      enable = lib.mkDefault true;
+      extraConfig = ''
+        // systemd-resolved access for Mihomo TUN DNS setup
+        polkit.addRule(function(action, subject) {
+          var actions = [
+            "org.freedesktop.resolve1.revert",
+            "org.freedesktop.resolve1.set-default-route",
+            "org.freedesktop.resolve1.set-dns-servers",
+            "org.freedesktop.resolve1.set-domains",
+          ];
+
+          if (actions.indexOf(action.id) >= 0 && subject.user == "mihomo") {
+            return polkit.Result.YES;
+          }
+        });
+      '';
+    };
+
     ### systemd service
     systemd.services."mihomo" = {
       description = "Mihomo daemon, A rule-based proxy in Go.";
@@ -118,7 +137,7 @@ in
       // lib.optionalAttrs cfg.tunMode {
         PrivateDevices = false;
         PrivateUsers = false;
-        RestrictAddressFamilies = "AF_INET AF_INET6 AF_NETLINK";
+        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
       };
     };
   };

nixos/modules/services/networking/sniproxy.nix

@@ -73,7 +73,7 @@ in
 
       serviceConfig = {
         Type = "forking";
-        ExecStart = "${pkgs.sniproxy}/bin/sniproxy -c ${configFile}";
+        ExecStart = "${pkgs.sniproxy}/bin/sniproxy -i -c ${configFile}";
         LogsDirectory = "sniproxy";
         LogsDirectoryMode = "0640";
         Restart = "always";

nixos/modules/services/networking/ssh/sshd.nix

@@ -380,6 +380,10 @@ in
             type = "ed25519";
             path = "/etc/ssh/ssh_host_ed25519_key";
           }
+          {
+            type = "mldsa44-ed25519";
+            path = "/etc/ssh/ssh_host_mldsa44_ed25519_key";
+          }
         ];
         example = [
           {

nixos/modules/services/scheduling/scx-loader.nix

@@ -62,10 +62,6 @@ in
         assertion = lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.12";
         message = "SCX is only supported on kernel version 6.12 and above.";
       }
-      {
-        assertion = !config.services.scx.enable;
-        message = "services.scx and services.scx_loader cannot be enabled simultaneously. Please enable only one of them.";
-      }
       {
         assertion =
           cfg.config.default_sched == null || lib.elem cfg.config.default_sched ([ "" ] ++ schedulers);

nixos/modules/services/scheduling/scx.nix

@@ -1,107 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  utils,
-  ...
-}:
-let
-  cfg = config.services.scx;
-in
-{
-  options.services.scx = {
-    enable = lib.mkEnableOption null // {
-      description = ''
-        Whether to enable SCX service, a daemon to run schedulers from userspace.
-
-        ::: {.note}
-        This service requires a kernel with the Sched-ext feature.
-        Generally, kernel version 6.12 and later are supported.
-        :::
-      '';
-    };
-
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.scx.full;
-      defaultText = lib.literalExpression "pkgs.scx.full";
-      example = lib.literalExpression "pkgs.scx.rustscheds";
-      description = ''
-        `scx` package to use. `scx.full`, which includes all schedulers, is the default.
-        You may choose a minimal package, such as `pkgs.scx.rustscheds`.
-
-        ::: {.note}
-        Overriding this does not change the default scheduler; you should set `services.scx.scheduler` for it.
-        :::
-      '';
-    };
-
-    scheduler = lib.mkOption {
-      type = lib.types.enum cfg.package.schedulers;
-      default = "scx_rustland";
-      example = "scx_bpfland";
-      description = ''
-        Which scheduler to use. See [SCX documentation](https://github.com/sched-ext/scx/tree/main/scheds)
-        for details on each scheduler and guidance on selecting the most suitable one.
-      '';
-    };
-
-    extraArgs = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      example = [
-        "--verbose"
-        "--slice-us 5000"
-      ];
-      description = ''
-        Parameters passed to the chosen scheduler at runtime.
-
-        ::: {.note}
-        Run `chosen-scx-scheduler --help` to see the available options. Generally,
-        each scheduler has its own set of options, and they are incompatible with each other.
-        :::
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ cfg.package ];
-
-    systemd.services.scx = {
-      description = "SCX scheduler daemon";
-
-      # SCX service should be started only if the kernel supports sched-ext
-      unitConfig.ConditionPathIsDirectory = "/sys/kernel/sched_ext";
-
-      startLimitIntervalSec = 30;
-      startLimitBurst = 2;
-
-      serviceConfig = {
-        Type = "simple";
-        ExecStart = ''
-          ${pkgs.runtimeShell} -c 'exec ${cfg.package}/bin/''${SCX_SCHEDULER_OVERRIDE:-$SCX_SCHEDULER} ''${SCX_FLAGS_OVERRIDE:-$SCX_FLAGS}'
-        '';
-        Restart = "on-failure";
-      };
-
-      environment = {
-        SCX_SCHEDULER = cfg.scheduler;
-        SCX_FLAGS = lib.concatStringsSep " " cfg.extraArgs;
-      };
-
-      wantedBy = [ "multi-user.target" ];
-    };
-
-    assertions = [
-      {
-        assertion = lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.12";
-        message = "SCX is only supported on kernel version >= 6.12.";
-      }
-    ];
-  };
-
-  meta = {
-    inherit (pkgs.scx.full.meta) maintainers;
-    buildDocsInSandbox = false;
-  };
-}

nixos/modules/services/security/crowdsec/default.nix

@@ -930,7 +930,7 @@ in
               value."f+" = {
                 user = cfg.user;
                 group = cfg.group;
-                argument = content;
+                argument = lib.replaceStrings [ "%" ] [ "%%" ] content;
               };
             };
 

nixos/modules/services/web-apps/dawarich.nix

@@ -294,8 +294,9 @@ in
           attrsOf (submodule {
             options = {
               jobClasses = lib.mkOption {
-                # https://github.com/Freika/dawarich/blob/0.37.2/config/sidekiq.yml
+                # https://github.com/Freika/dawarich/blob/1.18.1/config/sidekiq.yml
                 type = listOf (enum [
+                  "achievements"
                   "app_version_checking"
                   "archival"
                   "cache"
@@ -303,6 +304,7 @@ in
                   "default"
                   "digests"
                   "exports"
+                  "extractions"
                   "families"
                   "highest_priority"
                   "imports"
@@ -312,10 +314,12 @@ in
                   "points"
                   "posters"
                   "reverse_geocoding"
+                  "route_videos"
                   "stats"
                   "tracks"
                   "trips"
                   "visit_suggesting"
+                  "webhooks"
                 ]);
                 description = ''
                   If not empty, which job classes should be executed by this process.

nixos/modules/services/web-apps/grimmory.nix

@@ -0,0 +1,351 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    literalExpression
+    mkIf
+    mkDefault
+    mkOption
+    mkEnableOption
+    mkMerge
+    mkPackageOption
+    optional
+    types
+    ;
+  cfg = config.services.grimmory;
+in
+{
+  options.services.grimmory = {
+    enable = mkEnableOption "Whether to enable Grimmory Server.";
+
+    package = mkPackageOption pkgs "grimmory" { };
+
+    host = mkOption {
+      description = "Listen address which Grimmory should listen on. (`SERVER_ADDRESS`)";
+      default = "localhost";
+      type = types.str;
+    };
+
+    port = mkOption {
+      description = "Port on which Grimmory should listen on. (`BOOKLORE_PORT`)";
+      default = 6060;
+      type = types.port;
+    };
+
+    user = mkOption {
+      description = "User account under which Grimmory runs.";
+      default = "grimmory";
+      type = types.str;
+      example = "media";
+    };
+
+    group = mkOption {
+      description = "Group under which Grimmory runs.";
+      default = "grimmory";
+      type = types.str;
+      example = "media";
+    };
+
+    stateDir = mkOption {
+      description = "State and configuration directory Grimmory will use. (`APP_PATH_CONFIG`)";
+      default = "/var/lib/grimmory";
+      type = types.str;
+      example = "/grimmory";
+    };
+
+    booksDir = mkOption {
+      description = "Path to root directory of book library.";
+      default = "${cfg.stateDir}/books";
+      defaultText = "\${cfg.stateDir}/books";
+      type = types.str;
+      example = "/books";
+    };
+
+    bookdropDir = mkOption {
+      description = "Path to directory where Grimmory watches for books to import. (`APP_BOOKDROP_FOLDER`)";
+      default = "${cfg.stateDir}/bookdrop";
+      defaultText = "\${cfg.stateDir}/bookdrop";
+      type = types.str;
+      example = "/bookdrop";
+    };
+
+    database = {
+      createLocally = mkOption {
+        description = "Create a local MariaDB database and user for Grimmory via `services.mysql`.";
+        default = true;
+        type = types.bool;
+      };
+
+      name = mkOption {
+        description = "MySQL database name that holds Grimmory's data. (`DATABASE_NAME`)";
+        default = "grimmory";
+        type = types.str;
+        example = "booklore";
+      };
+
+      host = mkOption {
+        description = "MySQL Database host (`DATABASE_HOST`)";
+        default = "localhost";
+        type = types.str;
+      };
+
+      port = mkOption {
+        description = "MySQL Database port (`DATABASE_PORT`)";
+        default = 3306;
+        type = types.port;
+      };
+
+      user = mkOption {
+        description = ''
+          Name of the user with all permissions to the Grimmory MySQL database. (`DATABASE_USERNAME`)
+        '';
+        default = "grimmory";
+        type = types.str;
+        example = "booklore";
+      };
+
+      passwordFile = mkOption {
+        description = ''
+          A file containing the password for the database named {option}`database.name`.
+
+          > A password file is currently required, but should be avoidable in a future release
+        '';
+        default = null;
+        type = types.nullOr types.path;
+        example = "/run/keys/grimmory-db-password";
+      };
+    };
+
+    environment = mkOption {
+      description = ''
+        Environment variables passed passed into the backend server.
+
+        Some variables are defined here: <https://grimmory.org/docs/installation>
+      '';
+      default = { };
+      type = types.attrsOf types.str;
+      example = {
+        FORCE_DISABLE_OIDC = "true";
+      };
+    };
+
+    environmentFile = mkOption {
+      description = "Optional path to an `EnvironmentFile` to configure or add secrets to Grimmory service.";
+      default = null;
+      type = types.nullOr types.path;
+    };
+
+    extraArgs = mkOption {
+      description = ''
+        Additional command-line arguments passed verbatim to grimmory after -jar grimmory.jar
+      '';
+      default = [ ];
+      type = types.listOf types.str;
+      example = [ "--debug" ];
+    };
+
+    domain = mkOption {
+      description = "Domain to use for the virtualhost to serve Grimmory at.";
+      type = types.str;
+      example = literalExpression "grimmory.\${config.networking.domain}";
+    };
+
+    caddy = {
+      enable = mkEnableOption "a virtualhost to serve Grimmory through caddy";
+      virtualHost = mkOption {
+        description = "Extra configuration for the caddy virtualhost for Grimmory.";
+        type = types.submodule (
+          import ../web-servers/caddy/vhost-options.nix { cfg = config.services.caddy; }
+        );
+        default = { };
+        example = literalExpression ''
+          {
+            serverAliases = [ "grimmory.''${config.networking.domain}" ];
+          }
+        '';
+      };
+    };
+
+    nginx = {
+      enable = mkEnableOption "a virtualhost to serve Grimmory through nginx";
+      virtualHost = mkOption {
+        description = "Extra configuration for the nginx virtualhost for Grimmory.";
+        type = types.submodule (import ../web-servers/nginx/vhost-options.nix { inherit config lib; });
+        default = { };
+        example = literalExpression ''
+          {
+            serverAliases = [ "grimmory.''${config.networking.domain}" ];
+          }
+        '';
+      };
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    services.grimmory.environment = {
+      SERVER_ADDRESS = mkDefault cfg.host;
+      BOOKLORE_PORT = mkDefault (toString cfg.port);
+      APP_PATH_CONFIG = mkDefault cfg.stateDir;
+      APP_BOOKDROP_FOLDER = mkDefault cfg.bookdropDir;
+      DATABASE_HOST = mkDefault cfg.database.host;
+      DATABASE_PORT = mkDefault (toString cfg.database.port);
+      DATABASE_NAME = mkDefault cfg.database.name;
+      DATABASE_USERNAME = mkDefault cfg.database.user;
+    };
+
+    users.groups = mkIf (cfg.group == "grimmory") { grimmory = { }; };
+
+    users.users = mkIf (cfg.user == "grimmory") {
+      grimmory = {
+        group = cfg.group;
+        home = cfg.stateDir;
+        description = "Grimmory Daemon user";
+        isSystemUser = true;
+      };
+    };
+
+    systemd.services.grimmory = {
+      description = "Grimmory is a self-hosted library for your ebooks, comics and audiobooks.";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [
+        "network-online.target"
+        "mysql.service"
+      ];
+      after = [
+        "network-online.target"
+        "mysql.service"
+      ];
+
+      environment = cfg.environment;
+
+      script =
+        if cfg.database.passwordFile != null then
+          ''
+            DATABASE_PASSWORD="$(cat ''${CREDENTIALS_DIRECTORY}/db-password)" ${lib.getExe cfg.package} ${lib.escapeShellArgs cfg.extraArgs}
+          ''
+        else
+          ''
+            ${lib.getExe cfg.package} ${lib.escapeShellArgs cfg.extraArgs}
+          '';
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+
+        Type = "simple";
+        Restart = "on-failure";
+
+        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+
+        LoadCredential = mkIf (cfg.database.passwordFile != null) [
+          "db-password:${cfg.database.passwordFile}"
+        ];
+
+        ExecStartPre = mkIf cfg.database.createLocally "+${pkgs.writeShellScript "update-grimmory-password" ''
+          ${lib.optionalString (cfg.database.passwordFile != null) ''
+            DATABASE_PASSWORD="$(cat ''${CREDENTIALS_DIRECTORY}/db-password)"
+          ''}
+
+          if [ -z "$DATABASE_PASSWORD" ]; then
+            echo "DATABASE_PASSWORD is empty or unset; add a password file with services.grimmory.database.passwordFile or add DATABASE_PASSWORD to services.grimmory.environmentFile" >&2
+            exit 1
+          fi
+
+          escaped_password="$(printf '%s' "$DATABASE_PASSWORD" | sed "s/'/'''/g")"
+
+          ${lib.getExe' config.services.mysql.package "mysql"} <<EOF
+          SET sql_mode = 'NO_BACKSLASH_ESCAPES';
+          ALTER USER '${cfg.database.user}'@'localhost' IDENTIFIED BY '$escaped_password';
+          FLUSH PRIVILEGES;
+          EOF
+        ''}";
+
+        StateDirectory = mkIf (cfg.stateDir == "/var/lib/grimmory") "grimmory";
+
+        # Make paths writable if not in the state directory
+        ReadWritePaths =
+          [ ]
+          ++ (optional (cfg.stateDir != "/var/lib/grimmory") cfg.stateDir)
+          ++ (optional (!(lib.hasPrefix cfg.stateDir cfg.bookdropDir)) cfg.bookdropDir)
+          ++ (optional (!(lib.hasPrefix cfg.stateDir cfg.booksDir)) cfg.booksDir);
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "all";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "full";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" ];
+      };
+    };
+
+    services.mysql = mkIf cfg.database.createLocally {
+      enable = true;
+      package = mkDefault pkgs.mariadb;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [
+        {
+          name = cfg.database.user;
+          ensurePermissions = {
+            "${cfg.database.name}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+
+    services.caddy = mkIf cfg.caddy.enable {
+      enable = lib.mkDefault true;
+      virtualHosts.${cfg.domain} = mkMerge [
+        cfg.caddy.virtualHost
+        {
+          hostName = lib.mkForce cfg.domain;
+          extraConfig = ''
+            reverse_proxy ${cfg.host}:${toString cfg.port}
+          '';
+        }
+      ];
+    };
+
+    services.nginx = mkIf cfg.nginx.enable {
+      enable = lib.mkDefault true;
+      virtualHosts.${cfg.domain} = mkMerge [
+        cfg.nginx.virtualHost
+        {
+          locations."/" = {
+            proxyPass = "http://${cfg.host}:${toString cfg.port}";
+            proxyWebsockets = true;
+            recommendedProxySettings = true;
+          };
+        }
+      ];
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ kraftnix ];
+}

nixos/modules/services/web-apps/immich.nix

@@ -50,6 +50,37 @@ let
     mkOption
     mkEnableOption
     ;
+
+  immichPostgresExtensions = [
+    "unaccent"
+    "uuid-ossp"
+    "cube"
+    "earthdistance"
+    "pg_trgm"
+    "vector"
+    "vchord"
+  ];
+
+  immichPostgresSetupSQL = pkgs.writeText "immich-pgvectors-setup.sql" ''
+    -- save previous version of vectorchord to trigger reindex on update
+    SELECT COALESCE(installed_version, ''') AS vchord_version_before FROM pg_available_extensions WHERE name = 'vchord' \gset
+
+    ${lib.concatMapStringsSep "\n" (
+      ext: "CREATE EXTENSION IF NOT EXISTS \"${ext}\";"
+    ) immichPostgresExtensions}
+    ${lib.concatMapStringsSep "\n" (ext: "ALTER EXTENSION \"${ext}\" UPDATE;") immichPostgresExtensions}
+    ALTER SCHEMA public OWNER TO ${cfg.database.user};
+
+    -- trigger reindex if vectorchord updates
+    -- https://docs.immich.app/administration/postgres-standalone/#updating-vectorchord
+    SELECT COALESCE(installed_version, ''') AS vchord_version_after FROM pg_available_extensions WHERE name = 'vchord' \gset
+
+    SELECT (:'vchord_version_before' != ''' AND :'vchord_version_before' != :'vchord_version_after') AS has_vchord_updated \gset
+    \if :has_vchord_updated
+      REINDEX INDEX face_index;
+      REINDEX INDEX clip_index;
+    \endif
+  '';
 in
 {
   imports = [
@@ -235,6 +266,17 @@ in
       createDB = mkEnableOption "the automatic creation of the database for immich" // {
         default = true;
       };
+      setupSQL = mkOption {
+        type = types.path;
+        readOnly = true;
+        default = immichPostgresSetupSQL;
+        defaultText = lib.literalMD "the generated immich PostgreSQL setup SQL";
+        description = ''
+          Path to the SQL script that installs and updates the PostgreSQL
+          extensions required by immich and reindexes VectorChord after
+          upgrades.
+        '';
+      };
       name = mkOption {
         type = types.str;
         default = "immich";
@@ -326,41 +368,11 @@ in
       };
     };
     systemd.services.postgresql-setup = mkIf cfg.database.enable {
-      serviceConfig.ExecStartPost =
-        let
-          extensions = [
-            "unaccent"
-            "uuid-ossp"
-            "cube"
-            "earthdistance"
-            "pg_trgm"
-            "vector"
-            "vchord"
-          ];
-          sqlFile = pkgs.writeText "immich-pgvectors-setup.sql" ''
-            -- save previous version of vectorchord to trigger reindex on update
-            SELECT COALESCE(installed_version, ''') AS vchord_version_before FROM pg_available_extensions WHERE name = 'vchord' \gset
-
-            ${lib.concatMapStringsSep "\n" (ext: "CREATE EXTENSION IF NOT EXISTS \"${ext}\";") extensions}
-            ${lib.concatMapStringsSep "\n" (ext: "ALTER EXTENSION \"${ext}\" UPDATE;") extensions}
-            ALTER SCHEMA public OWNER TO ${cfg.database.user};
-
-            -- trigger reindex if vectorchord updates
-            -- https://docs.immich.app/administration/postgres-standalone/#updating-vectorchord
-            SELECT COALESCE(installed_version, ''') AS vchord_version_after FROM pg_available_extensions WHERE name = 'vchord' \gset
-
-            SELECT (:'vchord_version_before' != ''' AND :'vchord_version_before' != :'vchord_version_after') AS has_vchord_updated \gset
-            \if :has_vchord_updated
-              REINDEX INDEX face_index;
-              REINDEX INDEX clip_index;
-            \endif
-          '';
-        in
-        [
-          ''
-            ${lib.getExe' cfg.database.package "psql"} -p "${toString cfg.database.port}" -d "${cfg.database.name}" -f "${sqlFile}"
-          ''
-        ];
+      serviceConfig.ExecStartPost = [
+        ''
+          ${lib.getExe' cfg.database.package "psql"} -p "${toString cfg.database.port}" -d "${cfg.database.name}" -f "${cfg.database.setupSQL}"
+        ''
+      ];
     };
 
     services.redis.servers = mkIf cfg.redis.enable {
@@ -455,8 +467,7 @@ in
 
     systemd.services.immich-machine-learning = mkIf cfg.machine-learning.enable {
       description = "immich machine learning";
-      requires = lib.mkIf cfg.database.enable [ "postgresql.target" ];
-      after = [ "network.target" ] ++ lib.optionals cfg.database.enable [ "postgresql.target" ];
+      after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       inherit (cfg.machine-learning) environment;
       serviceConfig = commonServiceConfig // {

nixos/modules/services/web-apps/netbox.nix

@@ -744,25 +744,6 @@ in
             };
           };
 
-        systemd.timers.netbox-housekeeping = {
-          description = "Run NetBox housekeeping job";
-          documentation = [ "https://netboxlabs.com/docs/netbox/" ];
-
-          wantedBy = [ "multi-user.target" ];
-
-          after = [
-            "network-online.target"
-            "netbox.service"
-          ];
-          wants = [ "network-online.target" ];
-
-          timerConfig = {
-            OnCalendar = "daily";
-            AccuracySec = "1h";
-            Persistent = true;
-          };
-        };
-
         users.users.netbox = {
           home = "${cfg.dataDir}";
           isSystemUser = true;

nixos/modules/services/web-apps/nextcloud.nix

@@ -23,7 +23,6 @@ let
     "opcache.revalidate_freq" = "1";
     "opcache.fast_shutdown" = "1";
     "openssl.cafile" = config.security.pki.caBundle;
-    catch_workers_output = "yes";
   };
 
   appStores = {
@@ -1315,6 +1314,7 @@ in
             upload_max_filesize = cfg.maxUploadSize;
             post_max_size = cfg.maxUploadSize;
             memory_limit = cfg.maxUploadSize;
+            error_log = "syslog";
           }
           (lib.mkIf cfg.caching.apcu {
             "apc.enable_cli" = "1";

nixos/modules/services/web-apps/yopass.nix

@@ -0,0 +1,159 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.yopass;
+
+  stateDirectory = "/var/lib/yopass";
+
+  # yopass-server has no config file: every flag is read from an
+  # environment variable of the same name (upstream
+  # docs/server-options.md). List-valued flags such as TRUSTED_PROXIES
+  # are parsed as comma-separated strings.
+  toEnvValue =
+    v:
+    if lib.isBool v then
+      lib.boolToString v
+    else if lib.isList v then
+      lib.concatMapStringsSep "," toString v
+    else
+      toString v;
+in
+{
+  options.services.yopass = {
+    enable = lib.mkEnableOption "Yopass, a secure way to share secrets and files";
+
+    package = lib.mkPackageOption pkgs "yopass" { };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = "/run/secrets/yopass";
+      description = ''
+        Path to a file in systemd `EnvironmentFile` format, for
+        settings that shouldn't land in the Nix store: `API_TOKEN`,
+        `WEBHOOK_SECRET`, `LICENSE_KEY`, `OIDC_CLIENT_SECRET`,
+        `OIDC_SESSION_KEY`.
+      '';
+    };
+
+    settings = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (oneOf [
+          bool
+          int
+          str
+          (listOf str)
+        ]);
+      default = { };
+      example = {
+        PORT = 8080;
+        DATABASE = "redis";
+        REDIS = "redis://127.0.0.1:6379/0";
+        MAX_FILE_SIZE = "10MB";
+        TRUSTED_PROXIES = [
+          "192.168.1.0/24"
+          "10.0.0.0/8"
+        ];
+      };
+      description = ''
+        yopass-server settings, passed as environment variables. Every
+        flag in [the upstream documentation](https://github.com/jhaals/yopass/blob/master/docs/server-options.md)
+        has an environment variable form (`--oidc-issuer` is
+        `OIDC_ISSUER`); use that name as the attribute. Booleans become
+        `true`/`false`, numbers are stringified and lists are joined
+        with commas. Anything left unset keeps yopass-server's own
+        default, except that the module binds `ADDRESS` to `127.0.0.1`
+        (expecting a reverse proxy in front) and points
+        `FILE_STORE_PATH` at `/var/lib/yopass/files` so uploads survive
+        restarts; both can be overridden here.
+
+        A `FILE_STORE_PATH` outside `/var/lib/yopass` is allow-listed
+        for writing automatically, but it must already exist and be
+        writable by the service, which runs as a dynamic user.
+
+        The module doesn't own the storage backend. With `DATABASE =
+        "redis"` pointing at a local `services.redis.servers.<name>`,
+        add `systemd.services.yopass.after = [ "redis-<name>.service" ];`
+        yourself to avoid a startup race; the memcached unit name is
+        fixed, so that ordering is handled for you.
+
+        Secrets belong in {option}`services.yopass.environmentFile`
+        rather than here, since this ends up in the Nix store.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.yopass.settings = {
+      ADDRESS = lib.mkDefault "127.0.0.1";
+      # Upstream defaults to /tmp/yopass-files, which lands on the unit's
+      # PrivateTmp and is wiped on every restart.
+      FILE_STORE_PATH = lib.mkDefault "${stateDirectory}/files";
+    };
+
+    systemd.services.yopass = {
+      description = "Yopass - Share secrets securely";
+      documentation = [ "https://github.com/jhaals/yopass" ];
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+      ]
+      ++ lib.optional ((cfg.settings.DATABASE or "memcached") == "memcached") "memcached.service";
+
+      environment = lib.mapAttrs (_: toEnvValue) cfg.settings;
+
+      serviceConfig = {
+        ExecStart = lib.getExe' cfg.package "yopass-server";
+        DynamicUser = true;
+        Restart = "on-failure";
+        EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
+        StateDirectory = baseNameOf stateDirectory;
+        # StateDirectory is writable already; anything else needs
+        # allow-listing under ProtectSystem=strict.
+        ReadWritePaths = lib.optional (
+          !lib.hasPrefix "${stateDirectory}/" cfg.settings.FILE_STORE_PATH
+        ) cfg.settings.FILE_STORE_PATH;
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged @setuid @keyring"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ fraggerfox ];
+}

nixos/modules/services/web-servers/apache-httpd/default.nix

@@ -248,6 +248,8 @@ let
       </VirtualHost>
     '';
 
+  escapeFileName = replaceString "/" "-";
+
   mkVHostCommonConf =
     hostOpts:
     let
@@ -281,8 +283,8 @@ let
     in
     ''
       ${optionalString cfg.logPerVirtualHost ''
-        ErrorLog ${cfg.logDir}/error-${hostOpts.hostName}.log
-        CustomLog ${cfg.logDir}/access-${hostOpts.hostName}.log ${hostOpts.logFormat}
+        ErrorLog ${cfg.logDir}/error-${escapeFileName hostOpts.hostName}.log
+        CustomLog ${cfg.logDir}/access-${escapeFileName hostOpts.hostName}.log ${hostOpts.logFormat}
       ''}
 
       ${optionalString (hostOpts.robotsEntries != "") ''

nixos/modules/system/boot/systemd.nix

@@ -89,7 +89,6 @@ let
     "systemd-fsck-root.service"
     "systemd-growfs@.service"
     "systemd-growfs-root.service"
-    "systemd-loop@.service"
     "systemd-remount-fs.service"
     "systemd-pstore.service"
     "local-fs.target"

nixos/modules/system/boot/systemd/initrd.nix

@@ -97,7 +97,6 @@ let
     "systemd-factory-reset-complete.service"
     "factory-reset-now.target"
     "systemd-fsck@.service"
-    "systemd-loop@.service"
     "systemd-halt.service"
     "systemd-hibernate-resume.service"
     "systemd-journald-audit.socket"
@@ -614,7 +613,6 @@ in
         "${cfg.package}/lib/systemd/systemd-bsod"
         "${cfg.package}/lib/systemd/systemd-sysroot-fstab-check"
         "${cfg.package}/lib/systemd/systemd-factory-reset"
-        "${cfg.package}/bin/systemd-dissect"
 
         # generators
         "${cfg.package}/lib/systemd/system-generators/systemd-debug-generator"

nixos/modules/virtualisation/vz-vm.nix

@@ -74,6 +74,7 @@ let
       else
         { mode = vzCfg.console; };
   }
+  // lib.optionalAttrs (vzCfg.idleTimeout != null) { idleTimeoutSeconds = vzCfg.idleTimeout; }
   // vzCfg.extraConfig;
 
   staticConfigFile = hostPkgs.writeText "vzvm-config.json" (builtins.toJSON staticConfig);
@@ -186,6 +187,25 @@ in
       '';
     };
 
+    virtualisation.vz.idleTimeout = lib.mkOption {
+      type = lib.types.nullOr (lib.types.ints.between 1 (7 * 24 * 60 * 60));
+      default = null;
+      example = 30 * 60;
+      description = ''
+        Run guest on demand: `vzvm` keeps listening on
+        {option}`virtualisation.vz.forwardPorts` and boots guest on first
+        connection. Vzvm powers it off once no forwarded connection has been
+        open for this many seconds. Next connection boots it again and keeps
+        connections on hold until it is ready (~12s).
+
+        Reboots are managed by the `vzvm` process and keep the data disk:
+        nix-darwin's `nix.linux-builder.ephemeral` wipes it when the launchd
+        service starts, not between on-demand boots.
+
+        `null` runs the guest without timeout for as long as `vzvm` runs.
+      '';
+    };
+
     virtualisation.vz.extraConfig = lib.mkOption {
       type = lib.types.attrs;
       default = { };
@@ -220,6 +240,14 @@ in
             writable store. Enable virtualisation.writableStoreUseTmpfs.
           '';
         }
+        {
+          assertion = vzCfg.idleTimeout != null -> vzCfg.forwardPorts != [ ];
+          message = ''
+            {option}`virtualisation.vz.idleTimeout` boots guest on first forwarded
+            connection but virtualisation.vz.forwardPorts is empty:
+            guest would never start.
+          '';
+        }
       ];
 
       boot.loader.grub.enable = false;

nixos/tests/all-tests.nix

@@ -419,7 +419,10 @@ in
   chhoto-url = runTest ./chhoto-url.nix;
   chipass = runTest ./chipass.nix;
   chromadb = runTest ./chromadb.nix;
-  chromium = (handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./chromium.nix { }).stable or { };
+  chromium = runTestOn [ "aarch64-linux" "x86_64-linux" ] {
+    imports = [ ./chromium.nix ];
+    _module.args.chromiumPackage = pkgs.chromium;
+  };
   chrony = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./chrony.nix;
   chrony-ptp = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./chrony-ptp.nix;
   cinnamon = runTest ./cinnamon.nix;
@@ -774,6 +777,7 @@ in
   gocd-server = runTest ./gocd-server.nix;
   gocron = runTest ./gocron.nix;
   gocryptfs = runTest ./gocryptfs.nix;
+  goeland = runTest ./goeland.nix;
   gokapi = runTest ./gokapi.nix;
   gollum = runTest ./gollum.nix;
   gonic = runTest ./gonic.nix;
@@ -795,6 +799,7 @@ in
   graylog = runTest ./graylog.nix;
   greenlight = runTest ./greenlight.nix;
   greetd-no-shadow = runTest ./greetd-no-shadow.nix;
+  grimmory = runTest ./grimmory.nix;
   grist = runTest ./grist.nix;
   grocy = runTest ./grocy.nix;
   grow-partition = runTest ./grow-partition.nix;
@@ -1657,8 +1662,7 @@ in
   schleuder = runTest ./schleuder.nix;
   scion-freestanding-deployment = runTest ./scion/freestanding-deployment;
   scrutiny = runTest ./scrutiny.nix;
-  scx = runTest ./scx/default.nix;
-  scx-loader = runTest ./scx/loader.nix;
+  scx-loader = runTest ./scx-loader.nix;
   sddm = import ./sddm.nix { inherit runTest; };
   sdl3 = runTest ./sdl3.nix;
   searx = runTest ./searx.nix;
@@ -1937,6 +1941,10 @@ in
   umami = runTest ./web-apps/umami.nix;
   umurmur = runTest ./umurmur.nix;
   unbound = runTest ./unbound.nix;
+  ungoogled-chromium = runTestOn [ "aarch64-linux" "x86_64-linux" ] {
+    imports = [ ./chromium.nix ];
+    _module.args.chromiumPackage = pkgs.ungoogled-chromium;
+  };
   unifi = runTest ./unifi.nix;
   unit-perl = runTest ./web-servers/unit-perl.nix;
   unpackerr = runTest ./unpackerr.nix;
@@ -2055,6 +2063,7 @@ in
     inherit lib runTest;
   };
   yggdrasil = runTest ./yggdrasil.nix;
+  yopass = import ./web-apps/yopass.nix { inherit pkgs runTest; };
   your_spotify = runTest ./your_spotify.nix;
   zammad = runTest ./zammad.nix;
   zapret2 = runTest ./zapret2.nix;

nixos/tests/cassandra.nix

@@ -108,6 +108,19 @@ in
         cass0.wait_until_succeeds("nodetool info -p ${jmxPortStr}")
         cass0.succeed("${checkHeapLimitCommand}")
 
+    with subtest("Private /tmp"):
+        cass0.wait_for_unit("cassandra.service")
+        pid = cass0.succeed("systemctl show --property MainPID --value cassandra.service").strip()
+        cass0.succeed(
+            "[ \"$(stat -c %d:%i /tmp)\" != \"$(stat -c %d:%i /proc/" + pid + "/root/tmp)\" ]"
+        )
+        # The JDK 11 attach client writes its trigger file to its own /tmp, so we run
+        # it in the mount namespace of the service.
+        cass0.succeed(
+            "nsenter --target " + pid + " --mount"
+            + " runuser -u cassandra -- ${testPackage.jre}/bin/jcmd " + pid + " VM.version"
+        )
+
     # Check cluster interaction
     with subtest("Bring up cluster"):
         cass1.wait_for_unit("cassandra.service")
@@ -151,6 +164,12 @@ in
         cass0.wait_until_succeeds(
             "nodetool status -p ${jmxPortStr} --resolve-ip | egrep '^UN[[:space:]]+cass2'"
         )
+
+    with subtest("JVM crash log"):
+        pid = cass0.succeed("systemctl show --property MainPID --value cassandra.service").strip()
+        cass0.succeed("kill -SEGV " + pid)
+        cass0.wait_until_fails("systemctl is-active cassandra.service")
+        cass0.succeed("test -s /var/lib/cassandra/hs_err_pid" + pid + ".log")
   '';
 
   passthru = {

nixos/tests/chromium.nix

@@ -1,289 +1,82 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
-  channelMap ? {
-    # Maps "channels" to packages
-    stable = pkgs.chromium;
-    beta = pkgs.chromiumBeta;
-    dev = pkgs.chromiumDev;
-    ungoogled = pkgs.ungoogled-chromium;
-    chrome-stable = pkgs.google-chrome;
-    chrome-beta = pkgs.google-chrome-beta;
-    chrome-dev = pkgs.google-chrome-dev;
-  },
+  lib,
+  pkgs,
+  chromiumPackage,
+  ...
 }:
 
-with import ../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
+{
+  inherit (chromiumPackage) name;
 
-let
-  user = "alice";
+  meta = {
+    inherit (chromiumPackage.meta) maintainers;
+  }
+  // lib.optionalAttrs (chromiumPackage.meta ? timeout) {
+    # https://github.com/NixOS/hydra/issues/591#issuecomment-435125621
+    inherit (chromiumPackage.meta) timeout;
+  };
 
-  startupHTML = pkgs.writeText "chromium-startup.html" ''
-    <!DOCTYPE html>
-    <html>
-    <head>
-    <meta charset="UTF-8">
-    <title>Chromium startup notifier</title>
-    </head>
-    <body onload="javascript:document.title='startup done'">
-      <img src="file://${
-        pkgs.fetchurl {
-          url = "https://nixos.org/logo/nixos-hex.svg";
-          sha256 = "07ymq6nw8kc22m7kzxjxldhiq8gzmc7f45kq2bvhbdm0w5s112s4";
-        }
-      }" />
-    </body>
-    </html>
-  '';
-in
+  containers.machine =
+    { config, ... }:
 
-mapAttrs (
-  channel: chromiumPkg:
-  makeTest {
-    name = "chromium-${channel}";
-    meta = {
-      maintainers = with maintainers; [
-        aszlig
+    {
+      imports = [
+        ./common/user-account.nix
+        ./common/x11.nix
       ];
-    }
-    // optionalAttrs (chromiumPkg.meta ? timeout) {
-      # https://github.com/NixOS/hydra/issues/591#issuecomment-435125621
-      # Note: optionalAttrs is used since meta.timeout is not set for Google Chrome
-      inherit (chromiumPkg.meta) timeout;
-    };
 
-    enableOCR = true;
-
-    nodes.machine =
-      { ... }:
-      {
-        imports = [
-          ./common/user-account.nix
-          ./common/x11.nix
-        ];
-        virtualisation.memorySize = 2047;
-        test-support.displayManager.auto.user = user;
-        environment = {
-          systemPackages = [ chromiumPkg ];
-          variables."XAUTHORITY" = "/home/alice/.Xauthority";
+      programs.chromium = {
+        enable = true;
+        extraOptsRecommended = {
+          # Set policy for Memory Saver, so we don't race against a
+          # "Make Chromium faster" in-product help promo (pop-up):
+          HighEfficiencyModeEnabled = false;
         };
       };
 
-    testScript =
-      let
-        xdo =
-          name: text:
-          let
-            xdoScript = pkgs.writeText "${name}.xdo" text;
-          in
-          "${pkgs.xdotool}/bin/xdotool ${xdoScript}";
-      in
-      ''
-        import shlex
-        import re
-        from contextlib import contextmanager
+      # chromium refuses to run as root user
+      test-support.displayManager.auto.user = "alice";
+      environment.variables."XAUTHORITY" = "${config.users.users.alice.home}/.Xauthority";
 
+      environment.systemPackages = [
+        chromiumPackage
+        pkgs.xclip
+      ];
+    };
 
-        major_version = "${versions.major (getVersion chromiumPkg.name)}"
+  testScript = ''
+    machine.wait_for_x()
 
+    with subtest("file:///"):
+        machine.execute("runuser alice chromium file:/// >&2 &")
+        machine.wait_for_window("Index of /")
+        machine.screenshot("file")
 
-        # Run as user alice
-        def ru(cmd):
-            return "su - ${user} -c " + shlex.quote(cmd)
+    with subtest("chrome://newtab"):
+        machine.send_key("ctrl-t")
+        machine.wait_for_window("New Tab")
+        machine.screenshot("newtab")
 
+    with subtest("chrome://version"):
+        machine.send_key("ctrl-l")
+        machine.send_chars("chrome://version\n")
+        machine.wait_for_window("About Version")
+        machine.screenshot("version")
 
-        def launch_browser():
-            """Launches the web browser with the correct options."""
-            # Determine the name of the binary:
-            pname = "${getName chromiumPkg.name}"
-            if pname.find("chromium") != -1:
-                binary = "chromium"  # Same name for all channels and ungoogled-chromium
-            elif pname == "google-chrome":
-                binary = "google-chrome-stable"
-            elif pname == "google-chrome-dev":
-                binary = "google-chrome-unstable"
-            else:  # For google-chrome-beta and as fallback:
-                binary = pname
-            # Add optional CLI options:
-            options = []
-            if major_version > "95" and not pname.startswith("google-chrome"):
-                # Workaround to avoid a GPU crash:
-                options.append("--use-gl=swiftshader")
-            # Launch the process:
-            options.append("file://${startupHTML}")
-            machine.succeed(ru(f'ulimit -c unlimited; {binary} {shlex.join(options)} >&2 & disown'))
-            if binary.startswith("google-chrome"):
-                # Need to click away the first window:
-                machine.wait_for_text("Make Google Chrome the default browser")
-                machine.screenshot("google_chrome_default_browser_prompt")
-                machine.send_key("ret")
+        machine.send_key("tab")
+        machine.send_key("spc")
+        clipboard = machine.succeed("xclip -out")
+        t.assertIn("${chromiumPackage.version}", clipboard)
 
+    with subtest("chrome://sandbox"):
+        machine.send_key("ctrl-t")
+        machine.send_chars("chrome://sandbox\n")
+        machine.wait_for_window("Sandbox Status")
+        machine.screenshot("sandbox")
 
-        def create_new_win():
-            """Creates a new Chromium window."""
-            with machine.nested("Creating a new Chromium window"):
-                machine.wait_until_succeeds(
-                    ru(
-                        "${xdo "create_new_win-select_main_window" ''
-                          search --onlyvisible --name "startup done"
-                          windowfocus --sync
-                          windowactivate --sync
-                        ''}"
-                    )
-                )
-                machine.send_key("ctrl-n")
-                # Wait until the new window appears:
-                machine.wait_until_succeeds(
-                    ru(
-                        "${xdo "create_new_win-wait_for_window" ''
-                          search --onlyvisible --name "New Tab"
-                          windowfocus --sync
-                          windowactivate --sync
-                        ''}"
-                    )
-                )
-
-
-        def close_new_tab_win():
-            """Closes the Chromium window with the title "New Tab"."""
-            machine.wait_until_succeeds(
-                ru(
-                    "${xdo "close_new_tab_win-select_main_window" ''
-                      search --onlyvisible --name "New Tab"
-                      windowfocus --sync
-                      windowactivate --sync
-                    ''}"
-                )
-            )
-            machine.send_key("ctrl-w")
-            # Wait until the closed window disappears:
-            machine.wait_until_fails(
-                ru(
-                    "${xdo "close_new_tab_win-wait_for_close" ''
-                      search --onlyvisible --name "New Tab"
-                    ''}"
-                )
-            )
-
-
-        @contextmanager
-        def test_new_win(description, url, window_name):
-            create_new_win()
-            machine.wait_for_window("New Tab")
-            machine.send_chars(f"{url}\n")
-            machine.wait_for_window(window_name)
-            machine.screenshot(description)
-            machine.succeed(
-                ru(
-                    "${xdo "copy-all" ''
-                      key --delay 1000 Ctrl+a Ctrl+c
-                    ''}"
-                )
-            )
-            clipboard = machine.succeed(
-                ru("${pkgs.xclip}/bin/xclip -o")
-            )
-            if url == "chrome://gpu":
-                clipboard = ""  # TODO: We cannot copy the text via Ctrl+a
-            print(f"{description} window content:\n{clipboard}")
-            with machine.nested(description):
-                yield clipboard
-            # Close the newly created window:
-            machine.send_key("ctrl-w")
-
-
-        machine.wait_for_x()
-
-        launch_browser()
-
-        machine.wait_for_text("startup done")
-        machine.wait_until_succeeds(
-            ru(
-                "${xdo "check-startup" ''
-                  search --sync --onlyvisible --name "startup done"
-                  # close first start help popup
-                  key -delay 1000 Escape
-                  windowfocus --sync
-                  windowactivate --sync
-                ''}"
-            )
-        )
-
-        create_new_win()
-        # Optional: Wait for the new tab page to fully load before taking the screenshot:
-        machine.wait_for_text("Web Store")
-        machine.screenshot("empty_windows")
-        close_new_tab_win()
-
-        machine.screenshot("startup_done")
-
-        with test_new_win("sandbox_info", "chrome://sandbox", "Sandbox Status") as clipboard:
-            filters = [
-                "layer 1 sandbox.*namespace",
-                "pid namespaces.*yes",
-                "network namespaces.*yes",
-                "seccomp.*sandbox.*yes",
-                "you are adequately sandboxed",
-            ]
-            if not all(
-                re.search(filter, clipboard, flags=re.DOTALL | re.IGNORECASE)
-                for filter in filters
-            ):
-                assert False, f"sandbox not working properly: {clipboard}"
-
-            machine.sleep(1)
-            machine.succeed(
-                ru(
-                    "${xdo "find-window-after-copy" ''
-                      search --onlyvisible --name "Sandbox Status"
-                    ''}"
-                )
-            )
-
-            clipboard = machine.succeed(
-                ru(
-                    "echo void | ${pkgs.xclip}/bin/xclip -i >&2"
-                )
-            )
-            machine.succeed(
-                ru(
-                    "${xdo "copy-sandbox-info" ''
-                      key --delay 1000 Ctrl+a Ctrl+c
-                    ''}"
-                )
-            )
-
-            clipboard = machine.succeed(
-                ru("${pkgs.xclip}/bin/xclip -o")
-            )
-            if not all(
-                re.search(filter, clipboard, flags=re.DOTALL | re.IGNORECASE)
-                for filter in filters
-            ):
-                assert False, f"copying twice in a row does not work properly: {clipboard}"
-
-            machine.screenshot("after_copy_from_chromium")
-
-
-        with test_new_win("gpu_info", "chrome://gpu", "GPU Internals"):
-            # To check the text rendering (catches regressions like #131074):
-            machine.wait_for_text("Graphics Feature Status")
-            # TODO: Fix copying all of the text to the clipboard
-
-
-        with test_new_win("version_info", "chrome://version", "About Version") as clipboard:
-            filters = [
-                r"${chromiumPkg.version} \(Official Build",
-            ]
-            if not all(
-                re.search(filter, clipboard) for filter in filters
-            ):
-                assert False, "Version info not correct."
-
-
-        machine.shutdown()
-      '';
-  }
-) channelMap
+        machine.send_key("ctrl-a")
+        machine.send_key("ctrl-c")
+        clipboard = machine.succeed("xclip -out")
+        t.assertIn("You are adequately sandboxed.", clipboard)
+  '';
+}

nixos/tests/clickhouse/default.nix

@@ -22,6 +22,12 @@
       inherit package;
     };
   };
+  mcp = runTest {
+    imports = [ ./mcp.nix ];
+    _module.args = {
+      inherit package;
+    };
+  };
   s3 = runTest {
     imports = [ ./s3.nix ];
     _module.args = {

nixos/tests/clickhouse/mcp.nix

@@ -0,0 +1,60 @@
+{ pkgs, package, ... }:
+
+{
+  name = "clickhouse-mcp";
+
+  meta.maintainers = with pkgs.lib.maintainers; [
+    jpds
+    thevar1able
+  ];
+
+  nodes.machine =
+    { config, ... }:
+    {
+      virtualisation.memorySize = 4096;
+
+      services.clickhouse = {
+        enable = true;
+        inherit package;
+      };
+
+      # Define an mcp-clickhouse systemd service
+      systemd.services.mcp-clickhouse = {
+        after = [ "clickhouse.service" ];
+        requires = [ "clickhouse.service" ];
+        wantedBy = [ "multi-user.target" ];
+
+        serviceConfig = {
+          ExecStart = pkgs.lib.getExe pkgs.mcp-clickhouse;
+          Environment = [
+            "CLICKHOUSE_HOST=127.0.0.1"
+            "CLICKHOUSE_PORT=8123"
+            "CLICKHOUSE_USER=default"
+            "CLICKHOUSE_PASSWORD="
+            "CLICKHOUSE_SECURE=false"
+            "CLICKHOUSE_VERIFY=false"
+            "CLICKHOUSE_MCP_SERVER_TRANSPORT=http"
+            "CLICKHOUSE_MCP_BIND_HOST=127.0.0.1"
+            "CLICKHOUSE_MCP_BIND_PORT=8000"
+            "CLICKHOUSE_MCP_AUTH_TOKEN=test-token"
+          ];
+          DynamicUser = true;
+          Restart = "on-failure";
+          RestartSec = "5s";
+        };
+      };
+    };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("clickhouse.service")
+    machine.wait_for_open_port(8123)
+
+    machine.wait_for_unit("mcp-clickhouse.service")
+    machine.wait_for_open_port(8000)
+
+    # /health performs a ClickHouse probe and only returns 200 OK when the
+    # connection succeeds.
+    machine.succeed("curl -fsS http://127.0.0.1:8000/health | grep -qx OK")
+  '';
+}

nixos/tests/e57inspector.nix

@@ -44,9 +44,9 @@ in
     name = "e57inspector-screenshot-analysis";
     screenshot = "${vmTest}/screen.png";
     question = ''
-      Look at this screenshot of a desktop application.
+      Look at this screenshot of the e57inspector application.
       Answer: Does the application show that a file was loaded into it successfully?
-      For this, only scans matter, as there are no images in the file.
+      For this, only scans matter, as there are no images in the file, so an image count of 0 is fine.
       The inspector on the left should show child elements below 'Data 3D'.
     '';
   };

nixos/tests/goeland.nix

@@ -0,0 +1,106 @@
+{ pkgs, ... }:
+let
+  articleTitle = "Hello from the test feed";
+
+  # goeland refuses to fetch local and private IPs:
+  # https://github.com/slurdge/goeland/blob/3eb263bcb2c6617c74326f629efa9075f1f40783/internal/goeland/httpget/httpget.go#L75-L77
+  feedAddress = "203.0.113.1";
+  machineAddress = "203.0.113.2";
+in
+{
+  name = "goeland";
+  meta.maintainers = with pkgs.lib.maintainers; [ h7x4 ];
+
+  containers = {
+    feed = {
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        useHostResolvConf = false;
+        firewall.allowedTCPPorts = [ 80 ];
+      };
+      systemd.network.networks."01-eth1" = {
+        name = "eth1";
+        networkConfig.Address = "${feedAddress}/24";
+      };
+
+      services.nginx = {
+        enable = true;
+        virtualHosts."feed.local".root = pkgs.writeTextDir "rss.xml" ''
+          <?xml version="1.0" encoding="UTF-8"?>
+          <rss version="2.0">
+            <channel>
+              <title>Dummy feed</title>
+              <link>http://feed.local/</link>
+              <description>Dummy feed for testing</description>
+              <item>
+                <title>${articleTitle}</title>
+                <link>http://feed.local/article.html</link>
+                <guid>http://feed.local/article.html</guid>
+                <description>The lazy fox jumps over the quick brown dog</description>
+              </item>
+            </channel>
+          </rss>
+        '';
+      };
+    };
+
+    machine =
+      { config, ... }:
+      {
+        imports = [ ./common/user-account.nix ];
+
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+          useHostResolvConf = false;
+          domain = "example.com";
+          hosts.${feedAddress} = [ "feed.local" ];
+        };
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "${machineAddress}/24";
+        };
+
+        services.postfix = {
+          enable = true;
+          settings.main.mydestination = [ config.networking.domain ];
+        };
+
+        services.goeland = {
+          enable = true;
+          settings = {
+            loglevel = "trace";
+            email = {
+              host = "127.0.0.1";
+              port = 25;
+              authentication = "none";
+              encryption = "none";
+            };
+            sources.feed = {
+              type = "feed";
+              url = "http://feed.local/rss.xml";
+              allow-insecure = true;
+              filters = [ "all" ];
+            };
+            pipes.feed = {
+              source = "feed";
+              destination = "email";
+              email_from = "goeland@example.com";
+              email_to = [ "alice@${config.networking.domain}" ];
+            };
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    feed.wait_for_open_port(80)
+    machine.wait_for_unit("postfix.service")
+    machine.systemctl("start goeland.service")
+
+    machine.wait_until_succeeds("grep -qr '${articleTitle}' /var/spool/mail/alice/")
+  '';
+}

nixos/tests/grimmory.nix

@@ -0,0 +1,92 @@
+{ pkgs, ... }:
+{
+  name = "grimmory";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ kraftnix ];
+  };
+
+  nodes = {
+    grimmory =
+      { config, pkgs, ... }:
+      {
+        services.grimmory = {
+          enable = true;
+          database.passwordFile = builtins.toFile "snakeoil-mysql-password" "deadbeef";
+        };
+        specialisation.caddy = {
+          inheritParentConfig = true;
+          configuration = {
+            systemd.tmpfiles.rules = [
+              "d /bookdrop 0740 grimmory grimmory -"
+              "d /books 0740 grimmory grimmory -"
+            ];
+            services.grimmory = {
+              domain = "localhost";
+              caddy.enable = true;
+              caddy.virtualHost.extraConfig = "tls internal";
+              bookdropDir = "/bookdrop";
+              booksDir = "/books";
+              database.passwordFile = pkgs.lib.mkForce null;
+              environment.DATABASE_PASSWORD = "deadbeef1";
+            };
+          };
+        };
+        specialisation.nginx = {
+          inheritParentConfig = true;
+          configuration = {
+            services.grimmory = {
+              domain = "localhost";
+              port = 8888;
+              nginx.enable = true;
+              database.passwordFile = pkgs.lib.mkForce null;
+              environmentFile = builtins.toFile "snakeoil-mysql-password" "DATABASE_PASSWORD=deadbeef2";
+            };
+          };
+        };
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      with subtest("Testing basic Grimmory config"):
+        grimmory.wait_for_unit("mysql.service")
+        grimmory.wait_for_unit("grimmory.service")
+        grimmory.wait_for_open_port(6060)
+
+        with subtest("Check Frontend accessible"):
+          grimmory.succeed("curl --fail http://localhost:6060/login")
+
+        with subtest("Check API accessible"):
+          grimmory.succeed("curl --fail http://localhost:6060/api/v1/healthcheck")
+
+        with subtest("Create an admin user"):
+          grimmory.succeed('curl --fail -X POST -H "Content-Type: application/json" --data \'{"username":"admin","password":"snakeoil-password","name":"Admin","email":"admin@localhost"}\' http://localhost:6060/api/v1/setup')
+
+      with subtest("Testing nginx Grimmory config"):
+        grimmory.succeed("${nodes.grimmory.system.build.toplevel}/specialisation/nginx/bin/switch-to-configuration test")
+        grimmory.wait_for_unit("nginx.service")
+        grimmory.wait_for_unit("mysql.service")
+        grimmory.wait_for_unit("grimmory.service")
+        grimmory.wait_for_open_port(8888)
+
+        with subtest("Check Frontend accessible via nginx"):
+          grimmory.succeed("curl --fail http://localhost/login")
+
+        with subtest("Check API accessible via nginx"):
+          grimmory.succeed("curl --fail http://localhost/api/v1/healthcheck")
+
+      with subtest("Testing caddy Grimmory config"):
+        grimmory.succeed("${nodes.grimmory.system.build.toplevel}/specialisation/caddy/bin/switch-to-configuration test")
+        grimmory.wait_for_unit("caddy.service")
+        grimmory.wait_for_unit("mysql.service")
+        grimmory.wait_for_unit("grimmory.service")
+        grimmory.wait_for_open_port(6060)
+
+        with subtest("Check Frontend accessible via caddy"):
+          grimmory.succeed("curl --fail -k https://localhost/login")
+
+        with subtest("Check API accessible via caddy"):
+          grimmory.succeed("curl --fail -k https://localhost/api/v1/healthcheck")
+    '';
+}

nixos/tests/incus/incus-tests-module.nix

@@ -136,6 +136,17 @@ in
                       } --quiet < ${jsonFormat.generate "${config.name}.json" config.incusConfig}").split(":")[1].strip()
                       server.wait_for_instance(instance_name)
 
+                ''
+                + lib.optionalString config.copyChannel ''
+                  # ensure we test this before containers enable nesting below as lxc-ci's checks are run without nesting
+                  with subtest("[${image_id}] channel initialized correctly"):
+                      server.instance_succeed(instance_name, "systemctl status nix-channel-init.service")
+                      server.instance_succeed(instance_name, "test -e /nix/var/nix/profiles/per-user/root/channels/manifest.nix")
+                      server.instance_succeed(instance_name, "test -L /nix/var/nix/profiles/per-user/root/channels/nixos")
+                      server.instance_succeed(instance_name, "nix-env --profile /nix/var/nix/profiles/per-user/root/channels --query nixos --no-name --out-path")
+                      server.instance_succeed(instance_name, "nix-env --query --available --attr-path --attr nixos.hello")
+                ''
+                + ''
                   with subtest("[${image_id}] can successfully restart"):
                       server.succeed(f"incus restart {instance_name}")
                       server.wait_for_instance(instance_name)
@@ -182,67 +193,64 @@ in
                 #
                 # container specific
                 #
-                + lib.optionalString (config.type == "container") (
-                  # python
-                  ''
-                    with subtest("[${image_id}] switch-to-configuration updates /sbin/init via installBootLoader"):
-                        # Remove /sbin/init so we can verify installBootLoader recreates it
-                        server.succeed(f"incus exec {instance_name} -- rm -f /sbin/init")
-                        server.fail(f"incus exec {instance_name} -- test -e /sbin/init")
+                +
+                  lib.optionalString (config.type == "container")
+                    # python
+                    ''
+                      with subtest("[${image_id}] switch-to-configuration updates /sbin/init via installBootLoader"):
+                          # Remove /sbin/init so we can verify installBootLoader recreates it
+                          server.succeed(f"incus exec {instance_name} -- rm -f /sbin/init")
+                          server.fail(f"incus exec {instance_name} -- test -e /sbin/init")
 
-                        server.succeed(
-                            f"incus exec {instance_name} -- /run/current-system/bin/switch-to-configuration switch"
-                        )
+                          server.succeed(
+                              f"incus exec {instance_name} -- /run/current-system/bin/switch-to-configuration switch"
+                          )
 
-                        # Verify installBootLoader recreated /sbin/init pointing to the system's init
-                        server.succeed(f"incus exec {instance_name} -- test -x /sbin/init")
-                        target = server.succeed(f"incus exec {instance_name} -- readlink -f /sbin/init").strip()
-                        current = server.succeed(f"incus exec {instance_name} -- readlink -f /run/current-system/init").strip()
-                        assert target == current, f"/sbin/init -> {target}, expected {current}"
+                          # Verify installBootLoader recreated /sbin/init pointing to the system's init
+                          server.succeed(f"incus exec {instance_name} -- test -x /sbin/init")
+                          target = server.succeed(f"incus exec {instance_name} -- readlink -f /sbin/init").strip()
+                          current = server.succeed(f"incus exec {instance_name} -- readlink -f /run/current-system/init").strip()
+                          assert target == current, f"/sbin/init -> {target}, expected {current}"
 
-                    # TODO troubleshoot VM hot memory resizing which was introduced in 6.12
-                    with subtest("[${image_id}] memory limits can be hotplug changed"):
-                        server.set_instance_config(instance_name, "limits.memory=512MB")
-                        # can't use lsmem since it sees the host's memory size
-                        server.wait_instance_exec_success(instance_name, "grep 'MemTotal:[[:space:]]*500000 kB' /proc/meminfo", timeout=1)
+                      # TODO troubleshoot VM hot memory resizing which was introduced in 6.12
+                      with subtest("[${image_id}] memory limits can be hotplug changed"):
+                          server.set_instance_config(instance_name, "limits.memory=512MB")
+                          # can't use lsmem since it sees the host's memory size
+                          server.wait_instance_exec_success(instance_name, "grep 'MemTotal:[[:space:]]*500000 kB' /proc/meminfo", timeout=1)
 
-                    # verify the patched container systemd generator from `pkgs.distrobuilder.generator`
-                    with subtest("[${image_id}] lxc-generator compatibility"):
-                        with subtest("[${image_id}] lxc-container generator configures plain container"):
-                            # default container is plain
-                            server.succeed(f"incus exec {instance_name} test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
+                      # verify the patched container systemd generator from `pkgs.distrobuilder.generator`
+                      with subtest("[${image_id}] lxc-generator compatibility"):
+                          with subtest("[${image_id}] lxc-container generator configures plain container"):
+                              # default container is plain
+                              server.succeed(f"incus exec {instance_name} test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
 
-                            server.check_instance_sysctl(instance_name)
+                              server.check_instance_sysctl(instance_name)
 
-                        with subtest("[${image_id}] lxc-container generator configures nested container"):
-                            server.set_instance_config(instance_name, "security.nesting=true", restart=True)
+                          with subtest("[${image_id}] lxc-container generator configures nested container"):
+                              server.set_instance_config(instance_name, "security.nesting=true", restart=True)
 
-                            server.fail(f"incus exec {instance_name} test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
-                            target = server.succeed(f"incus exec {instance_name} readlink -- -f /run/systemd/system/systemd-binfmt.service").strip()
-                            assert target == "/dev/null", "lxc generator did not correctly mask /run/systemd/system/systemd-binfmt.service"
+                              server.fail(f"incus exec {instance_name} test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
+                              target = server.succeed(f"incus exec {instance_name} readlink -- -f /run/systemd/system/systemd-binfmt.service").strip()
+                              assert target == "/dev/null", "lxc generator did not correctly mask /run/systemd/system/systemd-binfmt.service"
 
-                            server.check_instance_sysctl(instance_name)
+                              server.check_instance_sysctl(instance_name)
 
-                    with subtest("[${image_id}] lxcfs"):
-                        with subtest("[${image_id}] mounts lxcfs overlays"):
-                            server.succeed(f"incus exec {instance_name} mount | grep 'lxcfs on /proc/cpuinfo type fuse.lxcfs'")
-                            server.succeed(f"incus exec {instance_name} mount | grep 'lxcfs on /proc/meminfo type fuse.lxcfs'")
+                      with subtest("[${image_id}] lxcfs"):
+                          with subtest("[${image_id}] mounts lxcfs overlays"):
+                              server.succeed(f"incus exec {instance_name} mount | grep 'lxcfs on /proc/cpuinfo type fuse.lxcfs'")
+                              server.succeed(f"incus exec {instance_name} mount | grep 'lxcfs on /proc/meminfo type fuse.lxcfs'")
 
-                        with subtest("[${image_id}] supports per-instance lxcfs"):
-                            server.succeed(f"incus stop {instance_name}")
-                            server.fail(f"pgrep -a lxcfs | grep 'incus/devices/{instance_name}/lxcfs'")
+                          with subtest("[${image_id}] supports per-instance lxcfs"):
+                              server.succeed(f"incus stop {instance_name}")
+                              server.fail(f"pgrep -a lxcfs | grep 'incus/devices/{instance_name}/lxcfs'")
 
-                            server.succeed("incus config set instances.lxcfs.per_instance=true")
+                              server.succeed("incus config set instances.lxcfs.per_instance=true")
+
+                              server.succeed(f"incus start {instance_name}")
+                              server.wait_for_instance(instance_name)
+                              server.succeed(f"pgrep -a lxcfs | grep 'incus/devices/{instance_name}/lxcfs'")
+                    ''
 
-                            server.succeed(f"incus start {instance_name}")
-                            server.wait_for_instance(instance_name)
-                            server.succeed(f"pgrep -a lxcfs | grep 'incus/devices/{instance_name}/lxcfs'")
-                  ''
-                  + lib.optionalString (config.copyChannel) ''
-                    with subtest("[${image_id}] channel copied correctly"):
-                        server.succeed(f"incus exec {instance_name} -- systemctl status nix-channel-init.service")
-                  ''
-                )
                 #
                 # virtual-machine specific
                 #

nixos/tests/kanidm-provisioning.nix

@@ -18,7 +18,7 @@ in
   name = "kanidm-provisioning-${kanidmPackage.version}";
   meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];
 
-  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning_1_11;
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning_1_12;
 
   nodes.provision =
     { pkgs, lib, ... }:

nixos/tests/kanidm.nix

@@ -22,7 +22,7 @@ in
     oddlama
   ];
 
-  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm_1_11;
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm_1_12;
 
   nodes.server =
     { pkgs, ... }:

nixos/tests/lidarr.nix

@@ -1,20 +1,32 @@
-{ lib, ... }:
-
-{
+{ lib, ... }: {
   name = "lidarr";
-  meta.maintainers = [ ];
+  meta.maintainers = with lib.maintainers; [ connor-grady ];
 
-  nodes.machine =
-    { pkgs, ... }:
-    {
-      services.lidarr.enable = true;
+  nodes.machine = {
+    services.lidarr = {
+      enable = true;
+      settings.auth.apikey = "0123456789abcdef0123456789abcdef";
     };
+  };
 
-  testScript = ''
-    start_all()
+  testScript =
+    { nodes, ... }:
+    let
+      cfg = nodes.machine.services.lidarr;
+    in
+    ''
+      import json
 
-    machine.wait_for_unit("lidarr.service")
-    machine.wait_for_open_port(8686)
-    machine.succeed("curl --fail http://localhost:8686/")
-  '';
+      machine.wait_for_unit("lidarr.service")
+      machine.wait_for_open_port(${toString cfg.settings.server.port})
+      machine.wait_until_succeeds("curl --fail http://localhost:${toString cfg.settings.server.port}/")
+
+      with subtest("ping reports a healthy database"):
+          ping = json.loads(machine.succeed("curl --fail http://localhost:${toString cfg.settings.server.port}/ping"))
+          assert ping["status"] == "OK", ping
+
+      with subtest("system status reports the packaged version"):
+          status = json.loads(machine.succeed("curl --fail --header 'X-Api-Key: ${cfg.settings.auth.apikey}' http://localhost:${toString cfg.settings.server.port}/api/v1/system/status"))
+          assert status["version"] == "${cfg.package.versionForDotnet}", status
+    '';
 }

nixos/tests/lomiri-camera-app.nix

@@ -65,6 +65,8 @@ in
           qrContent = "Test";
         in
         ''
+          import datetime
+
           machine.wait_for_x()
 
           with subtest("lomiri camera launches"):
@@ -72,9 +74,9 @@ in
               # emitted twice
               machine.wait_for_console_text("updateViewfinderResolution: viewfinder resolutions is not known yet")
               machine.wait_for_console_text("updateViewfinderResolution: viewfinder resolutions is not known yet")
-              machine.sleep(10)
+              machine.sleep(datetime.timedelta(seconds=10))
               machine.send_key("alt-f10")
-              machine.sleep(5)
+              machine.sleep(datetime.timedelta(seconds=5))
               machine.wait_for_text("Cannot access")
               machine.screenshot("lomiri-camera_open")
 
@@ -85,16 +87,16 @@ in
           # Sometimes, GStreamer errors out on camera init with: CameraBin error: "Failed to allocate required memory."
           # Adding more VM memory didn't affect this. Maybe flaky in general?
           # Current assumption: Camera access gets requested in a weird/still-in-use state, so sleep abit
-          machine.sleep(10)
+          machine.sleep(datetime.timedelta(seconds=10))
 
           with subtest("lomiri camera localisation works"):
               machine.succeed("env LANG=de_DE.UTF-8 lomiri-camera-app >&2 &")
               # emitted twice
               machine.wait_for_console_text("updateViewfinderResolution: viewfinder resolutions is not known yet")
               machine.wait_for_console_text("updateViewfinderResolution: viewfinder resolutions is not known yet")
-              machine.sleep(10)
+              machine.sleep(datetime.timedelta(seconds=10))
               machine.send_key("alt-f10")
-              machine.sleep(5)
+              machine.sleep(datetime.timedelta(seconds=5))
               machine.wait_for_text("Zugriff auf")
               machine.screenshot("lomiri-camera_localised")
         '';
@@ -149,6 +151,8 @@ in
       enableOCR = true;
 
       testScript = ''
+        import datetime
+
         machine.wait_for_x()
 
         # Setup fake v4l2 camera
@@ -160,9 +164,9 @@ in
             # emitted twice
             machine.wait_for_console_text("No flash control support")
             machine.wait_for_console_text("No flash control support")
-            machine.sleep(10)
+            machine.sleep(datetime.timedelta(seconds=10))
             machine.send_key("alt-f10")
-            machine.sleep(5)
+            machine.sleep(datetime.timedelta(seconds=5))
             machine.wait_for_text("${feedLabel}")
             machine.screenshot("lomiri-camera_feed")
 
@@ -173,9 +177,9 @@ in
             machine.send_key("ctrl-alt-right")
             machine.succeed("magick /root/Pictures/camera.ubports/IMG_00000001.jpg -flop photo_flip.png")
             machine.succeed("feh photo_flip.png >&2 &")
-            machine.sleep(10)
+            machine.sleep(datetime.timedelta(seconds=10))
             machine.send_key("alt-f10")
-            machine.sleep(5)
+            machine.sleep(datetime.timedelta(seconds=5))
             machine.wait_for_text("${feedLabel}")
             machine.screenshot("lomiri-camera_photo")
       '';
@@ -229,6 +233,8 @@ in
       enableOCR = true;
 
       testScript = ''
+        import datetime
+
         machine.wait_for_x()
 
         # Setup fake v4l2 camera
@@ -240,14 +246,14 @@ in
             # emitted twice
             machine.wait_for_console_text("No flash control support")
             machine.wait_for_console_text("No flash control support")
-            machine.sleep(10)
+            machine.sleep(datetime.timedelta(seconds=10))
             machine.send_key("alt-f10")
-            machine.sleep(5)
+            machine.sleep(datetime.timedelta(seconds=5))
             machine.wait_for_text("${feedLabel}")
             machine.succeed("xdotool mousemove 510 720 click 1") # open up QR decode result
 
             # OCR is struggling to recognise the text. Click the clipboard button, check what got copied
-            machine.sleep(5)
+            machine.sleep(datetime.timedelta(seconds=5))
             machine.screenshot("lomiri-barcode_decode")
             machine.succeed("xdotool mousemove 540 640 click 1")
             machine.wait_until_succeeds("env DISPLAY=:0 xclip -selection clipboard -o | grep -q '${feedQrContent}'")

nixos/tests/lomiri.nix

@@ -665,7 +665,7 @@ in
               mouse_click(540, 80)
 
               # Expect Gallery to be brought into the foreground, with its sharing page open
-              wait_for_text("Photos")
+              wait_for_text("Events")
 
               # If lomiri-content-hub encounters a problem, it may have crashed the original application issuing the request.
               # Check that it's still alive

nixos/tests/openssh.nix

@@ -501,6 +501,8 @@ in
         )
         server_no_sshd_with_key.succeed("test -e /etc/ssh/ssh_host_ed25519_key")
         server_no_sshd_with_key.succeed("test -e /etc/ssh/ssh_host_ed25519_key.pub")
+        server_no_sshd_with_key.succeed("test -e /etc/ssh/ssh_host_mldsa44_ed25519_key")
+        server_no_sshd_with_key.succeed("test -e /etc/ssh/ssh_host_mldsa44_ed25519_key.pub")
         server_no_sshd_with_key.fail("pgrep sshd")
 
         # Validate the above check for sshd using pgrep does pass on a server

nixos/tests/scx-loader.nix

@@ -0,0 +1,63 @@
+{ pkgs, lib, ... }:
+
+{
+  name = "scx-loader";
+  meta.maintainers = with lib.maintainers; [ ccicnce113424 ] ++ pkgs.scx.full.meta.maintainers;
+
+  nodes.machine = {
+    boot.kernelPackages = pkgs.linuxPackages_latest;
+    services.scx-loader = {
+      enable = true;
+      config.default_sched = lib.mkDefault "scx_bpfland";
+    };
+
+    specialisation = {
+      beerland.configuration.services.scx-loader.config.default_sched = "scx_beerland";
+      bpfland.configuration.services.scx-loader.config.default_sched = "scx_bpfland";
+      cake.configuration.services.scx-loader.config.default_sched = "scx_cake";
+      cosmos.configuration.services.scx-loader.config.default_sched = "scx_cosmos";
+      flash.configuration.services.scx-loader.config.default_sched = "scx_flash";
+      flow.configuration.services.scx-loader.config.default_sched = "scx_flow";
+      forge.configuration.services.scx-loader.config.default_sched = "scx_forge";
+      lavd.configuration.services.scx-loader.config.default_sched = "scx_lavd";
+      mlfq.configuration.services.scx-loader.config.default_sched = "scx_mlfq";
+      p2dq.configuration.services.scx-loader.config.default_sched = "scx_p2dq";
+      pandemonium.configuration.services.scx-loader.config.default_sched = "scx_pandemonium";
+      rustland.configuration.services.scx-loader.config.default_sched = "scx_rustland";
+      rusty.configuration.services.scx-loader.config.default_sched = "scx_rusty";
+      tickless.configuration.services.scx-loader.config.default_sched = "scx_tickless";
+    };
+  };
+
+  testScript = ''
+    specialisation = [
+        "beerland",
+        "bpfland",
+        "cake",
+        "cosmos",
+        "flash",
+        "flow",
+        "forge",
+        "lavd",
+        "mlfq",
+        "p2dq",
+        "pandemonium",
+        "rustland",
+        "rusty",
+        "tickless",
+    ]
+
+    def activate_specialisation(name: str):
+        machine.succeed(f"/run/booted-system/specialisation/{name}/bin/switch-to-configuration test >&2")
+
+    machine.wait_for_unit("multi-user.target")
+    output = machine.succeed("scxctl get").strip()
+    assert output == "running Bpfland in Auto mode", f"Unexpected scxctl output: {output!r}"
+
+    for sched in specialisation:
+        with subtest(f"{sched}"):
+            activate_specialisation(sched)
+            machine.succeed("systemctl restart scx_loader.service")
+            machine.succeed(f"ps -U root -u root u | grep scx_{sched}")
+  '';
+}

nixos/tests/scx/default.nix

@@ -1,60 +0,0 @@
-{ pkgs, ... }:
-
-{
-  name = "scx_full";
-  meta = {
-    inherit (pkgs.scx.full.meta) maintainers;
-  };
-
-  nodes.machine = {
-    boot.kernelPackages = pkgs.linuxPackages_latest;
-    services.scx.enable = true;
-
-    specialisation = {
-      beerland.configuration.services.scx.scheduler = "scx_beerland";
-      bpfland.configuration.services.scx.scheduler = "scx_bpfland";
-      cake.configuration.services.scx.scheduler = "scx_cake";
-      chaos.configuration.services.scx.scheduler = "scx_chaos";
-      cosmos.configuration.services.scx.scheduler = "scx_cosmos";
-      flash.configuration.services.scx.scheduler = "scx_flash";
-      flow.configuration.services.scx.scheduler = "scx_flow";
-      forge.configuration.services.scx.scheduler = "scx_forge";
-      lavd.configuration.services.scx.scheduler = "scx_lavd";
-      p2dq.configuration.services.scx.scheduler = "scx_p2dq";
-      pandemonium.configuration.services.scx.scheduler = "scx_pandemonium";
-      rlfifo.configuration.services.scx.scheduler = "scx_rlfifo";
-      rustland.configuration.services.scx.scheduler = "scx_rustland";
-      rusty.configuration.services.scx.scheduler = "scx_rusty";
-      tickless.configuration.services.scx.scheduler = "scx_tickless";
-    };
-  };
-
-  testScript = ''
-    specialisation = [
-      "beerland",
-      "bpfland",
-      "cake",
-      "chaos",
-      "cosmos",
-      "flash",
-      "flow",
-      "forge",
-      "lavd",
-      "p2dq",
-      "pandemonium",
-      "rlfifo",
-      "rustland",
-      "rusty",
-      "tickless",
-    ]
-
-    def activate_specialisation(name: str):
-      machine.succeed(f"/run/booted-system/specialisation/{name}/bin/switch-to-configuration test >&2")
-
-    for sched in specialisation:
-      with subtest(f"{sched}"):
-        activate_specialisation(sched)
-        machine.succeed("systemctl restart scx.service")
-        machine.succeed(f"ps -U root -u root u | grep scx_{sched}")
-  '';
-}

nixos/tests/scx/loader.nix

@@ -1,20 +0,0 @@
-{ pkgs, lib, ... }:
-
-{
-  name = "scx-loader";
-  meta.maintainers = with lib.maintainers; [ ccicnce113424 ];
-
-  nodes.machine = {
-    boot.kernelPackages = pkgs.linuxPackages_latest;
-    services.scx-loader = {
-      enable = true;
-      config.default_sched = "scx_bpfland";
-    };
-  };
-
-  testScript = ''
-    machine.wait_for_unit("multi-user.target")
-    output = machine.succeed("scxctl get").strip()
-    assert output == "running Bpfland in Auto mode", f"Unexpected scxctl output: {output!r}"
-  '';
-}

nixos/tests/tandoor-recipes-script-name.nix

@@ -25,7 +25,7 @@
 
       origin_url = "http://${address}:${toString port}"
       base_url = f"{origin_url}${SCRIPT_NAME}"
-      login_path = "/admin/login/"
+      login_path = "/account/login/"
       login_url = f"{base_url}{login_path}"
 
       cookie_jar_path = "/tmp/cookies.txt"

nixos/tests/terminal-emulators.nix

@@ -41,11 +41,6 @@ let
     ghostty.pkg = p: p.ghostty;
     ghostty.cmd = "ghostty -e $command";
 
-    gnome-console.pkg = p: p.gnome-console;
-    gnome-console.executable = "kgx";
-    gnome-console.cmd = "kgx -e $command";
-    gnome-console.kill = true;
-
     gnome-terminal.pkg = p: p.gnome-terminal;
 
     guake.pkg = p: p.guake;
@@ -56,6 +51,10 @@ let
 
     kermit.pkg = p: p.kermit-terminal;
 
+    kgx.pkg = p: p.kgx;
+    kgx.cmd = "kgx -e $command";
+    kgx.kill = true;
+
     kitty.pkg = p: p.kitty;
     kitty.cmd = "kitty $command";
 

nixos/tests/vaultwarden.nix

@@ -94,7 +94,7 @@ let
               # Skip the tour on first login
               click_when_unobstructed((By.XPATH, "//button[contains(., 'Skip')]"))
 
-              click_when_unobstructed((By.XPATH, "//button[contains(., 'New item')]"))
+              click_when_unobstructed((By.XPATH, "//button[contains(., 'Add item')]"))
 
               driver.find_element(By.XPATH, '//input[@formcontrolname="name"]').send_keys(
                   'secrets'

nixos/tests/vector/caddy-clickhouse.nix

@@ -66,7 +66,7 @@
               vector_sink = {
                 type = "vector";
                 inputs = [ "caddy_logs_timestamp" ];
-                address = "clickhouse:6000";
+                address = "http://clickhouse:6000";
               };
             };
           };

nixos/tests/vector/dnstap.nix

@@ -92,7 +92,7 @@ in
               vector_dnstap_sink = {
                 type = "vector";
                 inputs = [ "dnstap" ];
-                address = "clickhouse:6000";
+                address = "http://clickhouse:6000";
               };
             };
           };
@@ -186,7 +186,7 @@ in
               vector_dnstap_sink = {
                 type = "vector";
                 inputs = [ "dnstap" ];
-                address = "clickhouse:6000";
+                address = "http://clickhouse:6000";
               };
             };
           };

nixos/tests/vector/journald-clickhouse.nix

@@ -142,7 +142,7 @@ in
               vector_sink = {
                 type = "vector";
                 inputs = [ "journald_remap" ];
-                address = "clickhouse:6000";
+                address = "http://clickhouse:6000";
               };
             };
           };

nixos/tests/vector/nginx-clickhouse.nix

@@ -64,7 +64,7 @@
               vector_sink = {
                 type = "vector";
                 inputs = [ "nginx_logs" ];
-                address = "clickhouse:6000";
+                address = "http://clickhouse:6000";
               };
             };
           };

nixos/tests/vlm-screenshot-question.nix

@@ -3,7 +3,7 @@
 # Similar to `wait_for_text()` in NixOS VM tests.
 #
 # Runs a VLM (Vision Language Model) on a screenshot and asserts that the
-# model's answer to a yes/no question ends with "YES".
+# model's answer to a yes/no question contains a bool response in a JSON field.
 #
 # This is useful to automatically test software that is otherwise
 # hard to test, e.g. "does this 3D program render the bunny correctly?".
@@ -23,6 +23,7 @@
       hash = "sha256-nEwdSKRi9/iDsomErE9C02bJxXNDTqtoVT4POL9+tQw=";
     }
   ),
+  # mmproj = "multimodal projector"
   mmproj ? (
     fetchurl {
       url = "https://huggingface.co/unsloth/gemma-4-E2B-it-GGUF/resolve/90f9618340396838ee7ff5b0ba2da27da62953d3/mmproj-F16.gguf";
@@ -35,28 +36,30 @@
   question,
 }:
 let
-
   analysisScript =
     writers.writePython3 "${name}-script" { flakeIgnore = [ "E501" ]; } # allow long lines
       ''
+        import json
         import os
-        import re
         import subprocess
+        import sys
         import time
 
+        SYSTEM_PROMPT = (
+            'Answer the user question, outputting valid JSON only.'
+            ' Schema: { "bool_answer": true | false, "explanation": "..." }'
+        )
+
         out = os.environ["out"]
-        screenshot = "${screenshot}"
-        # Using JSON here even permits preserving multi-line ASCII art questions and so on.
+        # Using JSON here safely escapes arbitrary strings into Python literals
+        # (and even permits preserving multi-line ASCII art questions and so on).
+        screenshot = ${builtins.toJSON "${screenshot}"}
         question = ${builtins.toJSON question}
 
-        # Build the full prompt with output markers for reliable extraction.
-        prompt = (
-            "Start your output with [output-start]."
-            f" {question}"
-            " Explain what you see, and your judgment."
-            " On the final line, output exactly YES or NO."
-            " Then immediately output [output-end] with nothing else after it."
-        )
+
+        def fail(message):
+            sys.exit(message)
+
 
         vlm_start = time.time()
         result = subprocess.run(
@@ -66,52 +69,87 @@ let
                 "--simple-io",  # disables the spinner whose backspace chars would corrupt captured output
                 "--reasoning", "off", "--temp", "0",
                 "--threads", "1",  # for determinism
-                "--n-gpu-layers", "0",  # force CPU-only (results on GPUs might be different and nondeterministic, see https://github.com/ggml-org/llama.cpp/pull/16016#issuecomment-3293505238)
+
+                # Force CPU-only, for both the text model and the multimodal projector
+                # (results on GPUs might be different and nondeterministic, see
+                # https://github.com/ggml-org/llama.cpp/pull/16016#issuecomment-3293505238).
+                "--device", "none",
+                "--n-gpu-layers", "0",
+                "--no-mmproj-offload",
+
                 "--model", "${model}",
                 "--mmproj", "${mmproj}",
                 "--image", screenshot,
-                "-p", prompt,
+                "-sys", SYSTEM_PROMPT,
+                "-p", question,
             ],
             capture_output=True,
             text=True,
-            # `OMP_NUM_THREADS=1` prevents OpenMP from spawning extra threads in the BLAS backend
-            # (OpenBLAS), which causes nondeterminism with `--image`; without `--image`, `--threads 1`
-            # alone is already deterministic (BLAS is not used for short text prompts).
+            # Limiting the BLAS backend (OpenBLAS) to one thread prevents nondeterminism with `--image`;
+            # without `--image`, `--threads 1` alone is already deterministic (BLAS is not used for short text prompts).
+            # Depending on how OpenBLAS is built, it spawns threads via OpenMP (`OMP_NUM_THREADS`)
+            # or its own pthreads pool (`OPENBLAS_NUM_THREADS`, legacy `GOTO_NUM_THREADS`),
+            # so set all of them.
             # Relevant code: https://github.com/ggml-org/llama.cpp/blob/80afa33aadcc4f71212b17e5e52904491c76b63e/ggml/src/ggml-blas/ggml-blas.cpp#L30-L148
             # PR to fix it in OpenBLAS: https://github.com/OpenMathLib/OpenBLAS/pull/5808
-            env={**os.environ, "OMP_NUM_THREADS": "1"},
+            env={
+                **os.environ,
+                "OMP_NUM_THREADS": "1",
+                "OPENBLAS_NUM_THREADS": "1",
+                "GOTO_NUM_THREADS": "1",
+            },
         )
         vlm_elapsed = time.time() - vlm_start
         output = result.stdout
         print(f"VLM inference took {vlm_elapsed:.1f}s")
-        print(f"VLM raw output: {repr(output)}")
+        print(f"VLM raw output: {output!r}")
         if result.returncode != 0:
             print(f"VLM stderr: {result.stderr}")
-        assert result.returncode == 0, f"llama-cli failed with exit code {result.returncode}"
+            fail(f"llama-cli failed with exit code {result.returncode}")
 
         print()
 
-        # Post-process: extract the answer between `[output-start]` and `[output-end]` markers.
-        # This is needed because llama-cli prints UI noise (banner,
-        # spinner, stats) to stdout alongside the model's response.
-        # TODO: Replace with `--quiet` once https://github.com/ggml-org/llama.cpp/pull/22848 is merged;
-        #       then also remove the markers from the prompt and the extraction below.
-        matches = re.findall(r"\[output-start\](.*?)\[output-end\]", output, re.DOTALL)
-        assert matches, (
-            f"VLM output did not contain [output-start]...[output-end] markers."
-            f" Raw output: {repr(output)}"
-        )
-        answer = matches[-1].strip()  # use last match (first may be prompt echo)
-        print("VLM answer:")
-        print(answer)
-        assert answer.upper().endswith("YES"), (
-            f"VLM did not confirm expected answer. Answer: {answer}"
-        )
+        # Post-process: extract the first JSON object that has a `bool_answer` key.
+        # This is needed because llama-cli prints UI noise (banner, stats) to stdout
+        # around the model's response, and the model may output its own decorations
+        # such as putting JSON in a Markdown code fence.
+        # `raw_decode()` ignores any trailing text after the JSON object.
+        # TODO: Simplify with `--quiet` once https://github.com/ggml-org/llama.cpp/pull/22848 is merged.
+        decoder = json.JSONDecoder()
+        j = None
+        index = output.find("{")
+        while index != -1:
+            try:
+                candidate, _ = decoder.raw_decode(output, index)
+            except json.JSONDecodeError:
+                candidate = None
+            if isinstance(candidate, dict) and "bool_answer" in candidate:
+                j = candidate
+                break
+            index = output.find("{", index + 1)
+
+        # On unexpected outputs, include the raw output in the error message on stderr
+        # (it's already included on stdout above in all cases).
+        if j is None:
+            fail(f"VLM output did not contain a valid JSON object with key 'bool_answer'. Raw output: {output!r}")
+
+        bool_answer = j.get("bool_answer")
+        explanation = j.get("explanation")
+        if not (isinstance(bool_answer, bool) and isinstance(explanation, str)):
+            fail(f'VLM output JSON was not of schema {{ "bool_answer": true | false, "explanation": "..." }}. Raw output: {output!r}')
+
+        print(f"Answer: {bool_answer}")
+        print(f"Explanation: {explanation}")
+        if not bool_answer:
+            fail(f"VLM did not confirm expected answer. Answer: {bool_answer}\nExplanation: {explanation}")
 
         os.makedirs(out, exist_ok=True)
-        with open(os.path.join(out, "vlm-answer.txt"), "w") as f:
-            f.write(answer + "\n")
-        os.symlink(screenshot, os.path.join(out, "screen.png"))
+        with open(os.path.join(out, "vlm-answer.json"), "w") as f:
+            json.dump(j, f, indent=2)
+            f.write("\n")
+        # Keep the original file extension, as the screenshot is not necessarily a PNG.
+        _, screenshot_ext = os.path.splitext(screenshot)
+        os.symlink(screenshot, os.path.join(out, f"screen{screenshot_ext}"))
       '';
 in
 runCommand name { } ''

nixos/tests/web-apps/yopass.nix

@@ -0,0 +1,74 @@
+{
+  runTest,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (pkgs) lib;
+  yopassCli = lib.getExe pkgs.yopass;
+
+  yopassTest =
+    { name, backend }:
+    runTest {
+      name = "yopass-${name}";
+      meta.maintainers = with lib.maintainers; [ fraggerfox ];
+
+      nodes.machine =
+        { ... }:
+        {
+          services.memcached.enable = backend == "memcached";
+          services.redis.servers.yopass = lib.mkIf (backend == "redis") {
+            enable = true;
+            # Named instances default to port 0 (Unix socket only); yopass
+            # connects over TCP via a redis:// URL, so this needs enabling.
+            port = 6379;
+          };
+
+          services.yopass = {
+            enable = true;
+            settings.DATABASE = backend;
+            # "localhost" resolves to the IPv6 loopback first in this VM,
+            # but services.redis.servers binds 127.0.0.1 (IPv4) only by
+            # default; point at it explicitly rather than fight DNS order.
+            settings.REDIS = lib.mkIf (backend == "redis") "redis://127.0.0.1:6379/0";
+          };
+
+          # The module can't infer this itself (see the settings
+          # description) since it doesn't own the backend -- wire it here,
+          # where the actual unit name (for this *named* redis instance)
+          # is known, to avoid a startup race.
+          systemd.services.yopass.after = lib.mkIf (backend == "redis") [ "redis-yopass.service" ];
+          systemd.services.yopass.requires = lib.mkIf (backend == "redis") [ "redis-yopass.service" ];
+        };
+
+      testScript = ''
+        start_all()
+        machine.wait_for_unit("yopass.service")
+        machine.wait_for_open_port(1337)
+        machine.succeed("curl --fail http://localhost:1337 | grep -qi yopass")
+
+        # Round-trip a secret through the real yopass CLI (ships in the
+        # same package as yopass-server), exercising create + retrieve
+        # against the running server rather than guessing the HTTP API.
+        link = machine.succeed(
+            "printf 'hello from the nixos test' |"
+            " ${yopassCli} --api http://localhost:1337 --url http://localhost:1337"
+        ).strip()
+        machine.succeed(
+            "${yopassCli} --api http://localhost:1337 --url http://localhost:1337"
+            f" --decrypt '{link}' | grep -q 'hello from the nixos test'"
+        )
+      '';
+    };
+in
+{
+  memcached = yopassTest {
+    name = "memcached";
+    backend = "memcached";
+  };
+  redis = yopassTest {
+    name = "redis";
+    backend = "redis";
+  };
+}

nixos/tests/whisparr.nix

@@ -36,9 +36,20 @@ in
           ping = json.loads(machine.succeed("curl --fail http://localhost:${toString cfg.settings.server.port}/ping"))
           assert ping["status"] == "OK", ping
     ''
-    + lib.optionalString (!isV2) ''
+    + (
+      if isV2 then
+        ''
+          initialize = json.loads(machine.succeed("curl --fail http://localhost:${toString cfg.settings.server.port}/initialize.json"))
+          api_key = initialize["apiKey"]
+        ''
+      else
+        ''
+          api_key = "${cfg.settings.auth.apikey}"
+        ''
+    )
+    + ''
       with subtest("system status reports the packaged version"):
-          status = json.loads(machine.succeed("curl --fail --header 'X-Api-Key: ${cfg.settings.auth.apikey}' http://localhost:${toString cfg.settings.server.port}/api/v3/system/status"))
+          status = json.loads(machine.succeed(f"curl --fail --header 'X-Api-Key: {api_key}' http://localhost:${toString cfg.settings.server.port}/api/v3/system/status"))
           assert status["version"] == "${cfg.package.versionForDotnet}", status
     '';
 }

pkgs/applications/editors/android-studio/default.nix

@@ -75,15 +75,15 @@ let
         }
     );
   stableVersion = {
-    version = "2026.2.1.8"; # "Android Studio Rabbit 1 | 2026.2.1"
+    version = "2026.2.2.8"; # "Android Studio Rabbit 2 | 2026.2.2"
     sources = {
       x86_64-linux = {
-        sha256Hash = "sha256-+HdcZ8+JnZEzcSotfuPvcjHgf7FtvgVExH5fW6vVkxs=";
-        url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.2.1.8/android-studio-rabbit1-linux.tar.gz";
+        sha256Hash = "sha256-tH/cwHAwGWGKev1a0YIsr8XeZr7ZhGQL4pd6D9tTgwQ=";
+        url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.2.2.8/android-studio-rabbit2-linux.tar.gz";
       };
       aarch64-darwin = {
-        sha256Hash = "sha256-FtSg+KUkE7UYafwY1b3N+c7NOGFc17t88U1RuZ0v71Q=";
-        url = "https://edgedl.me.gvt1.com/android/studio/install/2026.2.1.8/android-studio-rabbit1-mac_arm.dmg";
+        sha256Hash = "sha256-oNBnKwYRnNMEhnwVfCUklog2Je+6oh3uLYY3h5wydxM=";
+        url = "https://edgedl.me.gvt1.com/android/studio/install/2026.2.2.8/android-studio-rabbit2-mac_arm.dmg";
       };
     };
   };

pkgs/applications/editors/emacs/build-support/wrapper.nix

@@ -172,15 +172,21 @@ let
         ;; so that the wrapper-added dir is not propagated to subprocesses.
         (let ((restore-path
                (lambda (path-env-var wrapper-dir-env-var)
-                 (when-let* ((wrapper-dir (getenv wrapper-dir-env-var)))
-                   (setenv wrapper-dir-env-var nil)
-                   (when-let* ((env-path (getenv path-env-var)))
-                     (let* ((env-path-list (split-string env-path path-separator))
-                            (restored-env-path-list (remove wrapper-dir env-path-list)))
-                       (setenv path-env-var
-                               (when restored-env-path-list
-                                 (string-join restored-env-path-list
-                                              path-separator)))))))))
+                 ;; Avoid when-let* to support older Emacs (for nix-emacs-ci).
+                 (let ((wrapper-dir (getenv wrapper-dir-env-var)))
+                   (when wrapper-dir
+                     (setenv wrapper-dir-env-var nil)
+                     (let ((env-path (getenv path-env-var)))
+                       (when env-path
+                         (let* ((env-path-list (split-string env-path path-separator))
+                                (restored-env-path-list (remove wrapper-dir env-path-list)))
+                           (setenv path-env-var
+                                   (when restored-env-path-list
+                                     ;; Inline string-join to support older Emacs
+                                     ;; (for nix-emacs-ci).
+                                     (mapconcat #'identity
+                                                restored-env-path-list
+                                                path-separator)))))))))))
           (funcall restore-path
                    "EMACSLOADPATH" "emacsWithPackages_siteLisp")
           (funcall restore-path
@@ -192,9 +198,11 @@ let
                    "XDG_DATA_DIRS" "emacsWithPackages_xdgDataDir"))
 
         (let ((set-from-env (lambda (symbol env-var &optional modify)
-                              (when-let* ((value (getenv env-var)))
-                                (set symbol (funcall (or modify #'identity) value))
-                                (setenv env-var nil)))))
+                              ;; Avoid when-let* to support older Emacs (for nix-emacs-ci).
+                              (let ((value (getenv env-var)))
+                                (when value
+                                  (set symbol (funcall (or modify #'identity) value))
+                                  (setenv env-var nil))))))
           (funcall set-from-env
                    'invocation-directory "emacsWithPackages_invocationDirectory"
                    #'file-name-as-directory)

pkgs/applications/editors/emacs/elisp-packages/manual-packages/custom-css/package.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  fetchFromGitHub,
+  unstableGitUpdater,
+  melpaBuild,
+  emacs,
+  pkg-config,
+}:
+
+melpaBuild {
+  pname = "custom-css";
+  version = "0-unstable-2024-01-03";
+
+  src = fetchFromGitHub {
+    owner = "florommel";
+    repo = "custom-css";
+    rev = "dd980c8494bc4244eaff11bef3e2e62ca7aef5f2";
+    hash = "sha256-FiWdj++QK9Bov9gfe7KQH8wcD0xctaJzYb43/1XhFj0=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = lib.filter (x: x.pname == "gtk+3") emacs.buildInputs;
+
+  preBuild = ''
+    make
+  '';
+
+  files = ''
+    (:defaults "custom-css-module.so")
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    description = "Style Emacs's GTK widgets with custom CSS";
+    homepage = "https://github.com/florommel/custom-css";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ judaew ];
+  };
+}

pkgs/applications/editors/emacs/elisp-packages/manual-packages/majutsu/package.nix

@@ -11,13 +11,13 @@
 }:
 melpaBuild {
   pname = "majutsu";
-  version = "0.6.0-unstable-2026-09-14";
+  version = "0.6.0-unstable-2026-10-29";
 
   src = fetchFromGitHub {
     owner = "0WD0";
     repo = "majutsu";
-    rev = "0fdb3c2b3ab826724949cd2cc714f2eff32ec152";
-    hash = "sha256-4K5pSnSTh1GpdcQMPkhUouQQ3JM8vR22yBOBgPPo7vI=";
+    rev = "a21d0a9905a0f68d1b969b1199611e13ae9f9c40";
+    hash = "sha256-H8U1y7XKfzefZtWFABvzPHFo3lXrItivneEp0R8xTM4=";
   };
 
   packageRequires = [

pkgs/applications/editors/vim/common.nix

@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.1252";
+  version = "9.2.1164";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-k5Na69KYXb7kxajpJFv9+vBymApaio7TwHrETudAGrk=";
+    hash = "sha256-Ymtq7+egq8OydTdzHP/q14MK6p+crKlQwduJ27oDbNU=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/plugins/generated.nix

@@ -15120,6 +15120,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  pentatonic-nvim = buildVimPlugin {
+    pname = "pentatonic.nvim";
+    version = "0-unstable-2026-10-31";
+    src = fetchFromGitHub {
+      owner = "farbzen";
+      repo = "pentatonic.nvim";
+      rev = "fe3c350795baa9a7cabd1a9fa37198c6a4c30f05";
+      hash = "sha256-aahik42orj0OfyaSY43Ln14MaDosT92j8cWjUv6gyfI=";
+    };
+    meta.homepage = "https://github.com/farbzen/pentatonic.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   perfanno-nvim = buildVimPlugin {
     pname = "perfanno.nvim";
     version = "0-unstable-2026-01-20";
@@ -17433,6 +17447,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  tacho-nvim = buildVimPlugin {
+    pname = "tacho.nvim";
+    version = "0.1.0";
+    src = fetchFromGitHub {
+      owner = "farbzen";
+      repo = "tacho.nvim";
+      tag = "v0.1.0";
+      hash = "sha256-lJbf9T6EsVYSadYn1aRprFgVWtwe7CEqdnCmUUE9K1M=";
+    };
+    meta.homepage = "https://github.com/farbzen/tacho.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   tagalong-vim = buildVimPlugin {
     pname = "tagalong.vim";
     version = "0.2.2-unstable-2026-09-30";