pyrox.dev
1# Release 17.09 ("Hummingbird", 2017/09/??) {#sec-release-17.09}
2
3## Highlights {#sec-release-17.09-highlights}
4
5In addition to numerous new and upgraded packages, this release has the following highlights:
6
7- The GNOME version is now 3.24. KDE Plasma was upgraded to 5.10, KDE Applications to 17.08.1 and KDE Frameworks to 5.37.
8
9- The user handling now keeps track of deallocated UIDs/GIDs. When a user or group is revived, this allows it to be allocated the UID/GID it had before. A consequence is that UIDs and GIDs are no longer reused.
10
11- The module option `services.xserver.xrandrHeads` now causes the first head specified in this list to be set as the primary head. Apart from that, it\'s now possible to also set additional options by using an attribute set, for example:
12
13 ```nix
14 { services.xserver.xrandrHeads = [
15 "HDMI-0"
16 {
17 output = "DVI-0";
18 primary = true;
19 monitorConfig = ''
20 Option "Rotate" "right"
21 '';
22 }
23 ];
24 }
25 ```
26
27 This will set the `DVI-0` output to be the primary head, even though `HDMI-0` is the first head in the list.
28
29- The handling of SSL in the `services.nginx` module has been cleaned up, renaming the misnamed `enableSSL` to `onlySSL` which reflects its original intention. This is not to be used with the already existing `forceSSL` which creates a second non-SSL virtual host redirecting to the SSL virtual host. This by chance had worked earlier due to specific implementation details. In case you had specified both please remove the `enableSSL` option to keep the previous behaviour.
30
31 Another `addSSL` option has been introduced to configure both a non-SSL virtual host and an SSL virtual host with the same configuration.
32
33 Options to configure `resolver` options and `upstream` blocks have been introduced. See their information for further details.
34
35 The `port` option has been replaced by a more generic `listen` option which makes it possible to specify multiple addresses, ports and SSL configs dependant on the new SSL handling mentioned above.
36
37## New Services {#sec-release-17.09-new-services}
38
39The following new services were added since the last release:
40
41- `config/fonts/fontconfig-penultimate.nix`
42
43- `config/fonts/fontconfig-ultimate.nix`
44
45- `config/terminfo.nix`
46
47- `hardware/sensor/iio.nix`
48
49- `hardware/nitrokey.nix`
50
51- `hardware/raid/hpsa.nix`
52
53- `programs/browserpass.nix`
54
55- `programs/gnupg.nix`
56
57- `programs/qt5ct.nix`
58
59- `programs/slock.nix`
60
61- `programs/thefuck.nix`
62
63- `security/auditd.nix`
64
65- `security/lock-kernel-modules.nix`
66
67- `service-managers/docker.nix`
68
69- `service-managers/trivial.nix`
70
71- `services/admin/salt/master.nix`
72
73- `services/admin/salt/minion.nix`
74
75- `services/audio/slimserver.nix`
76
77- `services/cluster/kubernetes/default.nix`
78
79- `services/cluster/kubernetes/dns.nix`
80
81- `services/cluster/kubernetes/dashboard.nix`
82
83- `services/continuous-integration/hail.nix`
84
85- `services/databases/clickhouse.nix`
86
87- `services/databases/postage.nix`
88
89- `services/desktops/gnome3/gnome-disks.nix`
90
91- `services/desktops/gnome3/gpaste.nix`
92
93- `services/logging/SystemdJournal2Gelf.nix`
94
95- `services/logging/heartbeat.nix`
96
97- `services/logging/journalwatch.nix`
98
99- `services/logging/syslogd.nix`
100
101- `services/mail/mailhog.nix`
102
103- `services/mail/nullmailer.nix`
104
105- `services/misc/airsonic.nix`
106
107- `services/misc/autorandr.nix`
108
109- `services/misc/exhibitor.nix`
110
111- `services/misc/fstrim.nix`
112
113- `services/misc/gollum.nix`
114
115- `services/misc/irkerd.nix`
116
117- `services/misc/jackett.nix`
118
119- `services/misc/radarr.nix`
120
121- `services/misc/snapper.nix`
122
123- `services/monitoring/osquery.nix`
124
125- `services/monitoring/prometheus/collectd-exporter.nix`
126
127- `services/monitoring/prometheus/fritzbox-exporter.nix`
128
129- `services/network-filesystems/kbfs.nix`
130
131- `services/networking/dnscache.nix`
132
133- `services/networking/fireqos.nix`
134
135- `services/networking/iwd.nix`
136
137- `services/networking/keepalived/default.nix`
138
139- `services/networking/keybase.nix`
140
141- `services/networking/lldpd.nix`
142
143- `services/networking/matterbridge.nix`
144
145- `services/networking/squid.nix`
146
147- `services/networking/tinydns.nix`
148
149- `services/networking/xrdp.nix`
150
151- `services/security/shibboleth-sp.nix`
152
153- `services/security/sks.nix`
154
155- `services/security/sshguard.nix`
156
157- `services/security/torify.nix`
158
159- `services/security/usbguard.nix`
160
161- `services/security/vault.nix`
162
163- `services/system/earlyoom.nix`
164
165- `services/system/saslauthd.nix`
166
167- `services/web-apps/nexus.nix`
168
169- `services/web-apps/pgpkeyserver-lite.nix`
170
171- `services/web-apps/piwik.nix`
172
173- `services/web-servers/lighttpd/collectd.nix`
174
175- `services/web-servers/minio.nix`
176
177- `services/x11/display-managers/xpra.nix`
178
179- `services/x11/xautolock.nix`
180
181- `tasks/filesystems/bcachefs.nix`
182
183- `tasks/powertop.nix`
184
185## Backward Incompatibilities {#sec-release-17.09-incompatibilities}
186
187When upgrading from a previous release, please be aware of the following incompatible changes:
188
189- **In an Qemu-based virtualization environment, the network interface names changed from i.e. `enp0s3` to `ens3`.**
190
191 This is due to a kernel configuration change. The new naming is consistent with those of other Linux distributions with systemd. See [\#29197](https://github.com/NixOS/nixpkgs/issues/29197) for more information.
192
193 A machine is affected if the `virt-what` tool either returns `qemu` or `kvm` _and_ has interface names used in any part of its NixOS configuration, in particular if a static network configuration with `networking.interfaces` is used.
194
195 Before rebooting affected machines, please ensure:
196
197 - Change the interface names in your NixOS configuration. The first interface will be called `ens3`, the second one `ens8` and starting from there incremented by 1.
198
199 - After changing the interface names, rebuild your system with `nixos-rebuild boot` to activate the new configuration after a reboot. If you switch to the new configuration right away you might lose network connectivity! If using `nixops`, deploy with `nixops deploy --force-reboot`.
200
201- The following changes apply if the `stateVersion` is changed to 17.09 or higher. For `stateVersion = "17.03"` or lower the old behavior is preserved.
202
203 - The `postgres` default version was changed from 9.5 to 9.6.
204
205 - The `postgres` superuser name has changed from `root` to `postgres` to more closely follow what other Linux distributions are doing.
206
207 - The `postgres` default `dataDir` has changed from `/var/db/postgres` to `/var/lib/postgresql/$psqlSchema` where \$psqlSchema is 9.6 for example.
208
209 - The `mysql` default `dataDir` has changed from `/var/mysql` to `/var/lib/mysql`.
210
211 - Radicale\'s default package has changed from 1.x to 2.x. Instructions to migrate can be found [ here ](http://radicale.org/1to2/). It is also possible to use the newer version by setting the `package` to `radicale2`, which is done automatically when `stateVersion` is 17.09 or higher. The `extraArgs` option has been added to allow passing the data migration arguments specified in the instructions; see the `radicale.nix` NixOS test for an example migration.
212
213- The `aiccu` package was removed. This is due to SixXS [ sunsetting](https://www.sixxs.net/main/) its IPv6 tunnel.
214
215- The `fanctl` package and `fan` module have been removed due to the developers not upstreaming their iproute2 patches and lagging with compatibility to recent iproute2 versions.
216
217- Top-level `idea` package collection was renamed. All JetBrains IDEs are now at `jetbrains`.
218
219- `flexget`\'s state database cannot be upgraded to its new internal format, requiring removal of any existing `db-config.sqlite` which will be automatically recreated.
220
221- The `ipfs` service now doesn\'t ignore the `dataDir` option anymore. If you\'ve ever set this option to anything other than the default you\'ll have to either unset it (so the default gets used) or migrate the old data manually with
222
223 ```ShellSession
224 dataDir=<valueOfDataDir>
225 mv /var/lib/ipfs/.ipfs/* $dataDir
226 rmdir /var/lib/ipfs/.ipfs
227 ```
228
229- The `caddy` service was previously using an extra `.caddy` directory in the data directory specified with the `dataDir` option. The contents of the `.caddy` directory are now expected to be in the `dataDir`.
230
231- The `ssh-agent` user service is not started by default anymore. Use `programs.ssh.startAgent` to enable it if needed. There is also a new `programs.gnupg.agent` module that creates a `gpg-agent` user service. It can also serve as a SSH agent if `enableSSHSupport` is set.
232
233- The `services.tinc.networks.<name>.listenAddress` option had a misleading name that did not correspond to its behavior. It now correctly defines the ip to listen for incoming connections on. To keep the previous behaviour, use `services.tinc.networks.<name>.bindToAddress` instead. Refer to the description of the options for more details.
234
235- `tlsdate` package and module were removed. This is due to the project being dead and not building with openssl 1.1.
236
237- `wvdial` package and module were removed. This is due to the project being dead and not building with openssl 1.1.
238
239- `cc-wrapper`\'s setup-hook now exports a number of environment variables corresponding to binutils binaries, (e.g. `LD`, `STRIP`, `RANLIB`, etc). This is done to prevent packages\' build systems guessing, which is harder to predict, especially when cross-compiling. However, some packages have broken due to this---their build systems either not supporting, or claiming to support without adequate testing, taking such environment variables as parameters.
240
241- `services.firefox.syncserver` now runs by default as a non-root user. To accomodate this change, the default sqlite database location has also been changed. Migration should work automatically. Refer to the description of the options for more details.
242
243- The `compiz` window manager and package was removed. The system support had been broken for several years.
244
245- Touchpad support should now be enabled through `libinput` as `synaptics` is now deprecated. See the option `services.xserver.libinput.enable`.
246
247- grsecurity/PaX support has been dropped, following upstream\'s decision to cease free support. See [ upstream\'s announcement](https://grsecurity.net/passing_the_baton.php) for more information. No complete replacement for grsecurity/PaX is available presently.
248
249- `services.mysql` now has declarative configuration of databases and users with the `ensureDatabases` and `ensureUsers` options.
250
251 These options will never delete existing databases and users, especially not when the value of the options are changed.
252
253 The MySQL users will be identified using [ Unix socket authentication](https://mariadb.com/kb/en/library/authentication-plugin-unix-socket/). This authenticates the Unix user with the same name only, and that without the need for a password.
254
255 If you have previously created a MySQL `root` user _with a password_, you will need to add `root` user for unix socket authentication before using the new options. This can be done by running the following SQL script:
256
257 ```SQL
258 CREATE USER 'root'@'%' IDENTIFIED BY '';
259 GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
260 FLUSH PRIVILEGES;
261
262 -- Optionally, delete the password-authenticated user:
263 -- DROP USER 'root'@'localhost';
264 ```
265
266- `services.mysqlBackup` now works by default without any user setup, including for users other than `mysql`.
267
268 By default, the `mysql` user is no longer the user which performs the backup. Instead a system account `mysqlbackup` is used.
269
270 The `mysqlBackup` service is also now using systemd timers instead of `cron`.
271
272 Therefore, the `services.mysqlBackup.period` option no longer exists, and has been replaced with `services.mysqlBackup.calendar`, which is in the format of [systemd.time(7)](https://www.freedesktop.org/software/systemd/man/systemd.time.html#Calendar%20Events).
273
274 If you expect to be sent an e-mail when the backup fails, consider using a script which monitors the systemd journal for errors. Regretfully, at present there is no built-in functionality for this.
275
276 You can check that backups still work by running `systemctl start mysql-backup` then `systemctl status mysql-backup`.
277
278- Templated systemd services e.g `container@name` are now handled currectly when switching to a new configuration, resulting in them being reloaded.
279
280- Steam: the `newStdcpp` parameter was removed and should not be needed anymore.
281
282- Redis has been updated to version 4 which mandates a cluster mass-restart, due to changes in the network handling, in order to ensure compatibility with networks NATing traffic.
283
284## Other Notable Changes {#sec-release-17.09-notable-changes}
285
286- Modules can now be disabled by using [ disabledModules](https://nixos.org/nixpkgs/manual/#sec-replace-modules), allowing another to take it\'s place. This can be used to import a set of modules from another channel while keeping the rest of the system on a stable release.
287
288- Updated to FreeType 2.7.1, including a new TrueType engine. The new engine replaces the Infinality engine which was the default in NixOS. The default font rendering settings are now provided by fontconfig-penultimate, replacing fontconfig-ultimate; the new defaults are less invasive and provide rendering that is more consistent with other systems and hopefully with each font designer\'s intent. Some system-wide configuration has been removed from the Fontconfig NixOS module where user Fontconfig settings are available.
289
290- ZFS/SPL have been updated to 0.7.0, `zfsUnstable, splUnstable` have therefore been removed.
291
292- The `time.timeZone` option now allows the value `null` in addition to timezone strings. This value allows changing the timezone of a system imperatively using `timedatectl set-timezone`. The default timezone is still UTC.
293
294- Nixpkgs overlays may now be specified with a file as well as a directory. The value of `<nixpkgs-overlays>` may be a file, and `~/.config/nixpkgs/overlays.nix` can be used instead of the `~/.config/nixpkgs/overlays` directory.
295
296 See the overlays chapter of the Nixpkgs manual for more details.
297
298- Definitions for `/etc/hosts` can now be specified declaratively with `networking.hosts`.
299
300- Two new options have been added to the installer loader, in addition to the default having changed. The kernel log verbosity has been lowered to the upstream default for the default options, in order to not spam the console when e.g. joining a network.
301
302 This therefore leads to adding a new `debug` option to set the log level to the previous verbose mode, to make debugging easier, but still accessible easily.
303
304 Additionally a `copytoram` option has been added, which makes it possible to remove the install medium after booting. This allows tethering from your phone after booting from it.
305
306- `services.gitlab-runner.configOptions` has been added to specify the configuration of gitlab-runners declaratively.
307
308- `services.jenkins.plugins` has been added to install plugins easily, this can be generated with jenkinsPlugins2nix.
309
310- `services.postfix.config` has been added to specify the main.cf with NixOS options. Additionally other options have been added to the postfix module and has been improved further.
311
312- The GitLab package and module have been updated to the latest 10.0 release.
313
314- The `systemd-boot` boot loader now lists the NixOS version, kernel version and build date of all bootable generations.
315
316- The dnscrypt-proxy service now defaults to using a random upstream resolver, selected from the list of public non-logging resolvers with DNSSEC support. Existing configurations can be migrated to this mode of operation by omitting the `services.dnscrypt-proxy.resolverName` option or setting it to `"random"`.