pyrox.dev
1# Release 21.11 (“Porcupine”, 2021/11/30) {#sec-release-21.11}
2
3- Support is planned until the end of June 2022, handing over to 22.05.
4
5## Highlights {#sec-release-21.11-highlights}
6
7In addition to numerous new and upgraded packages, this release has the following highlights:
8
9- Nix has been updated to version 2.4, reference its [release notes](https://discourse.nixos.org/t/nix-2-4-released/15822) for more information on what has changed. The previous version of Nix, 2.3.16, remains available for the time being in the `nix_2_3` package.
10
11- `iptables` is now using `nf_tables` under the hood, by using `iptables-nft`,
12 similar to [Debian](https://wiki.debian.org/nftables#Current_status) and
13 [Fedora](https://fedoraproject.org/wiki/Changes/iptables-nft-default).
14 This means, `ip[6]tables`, `arptables` and `ebtables` commands will actually
15 show rules from some specific tables in the `nf_tables` kernel subsystem.
16 In case you're migrating from an older release without rebooting, there might
17 be cases where you end up with iptable rules configured both in the legacy
18 `iptables` kernel backend, as well as in the `nf_tables` backend.
19 This can lead to confusing firewall behaviour. An `iptables-save` after
20 switching will complain about "iptables-legacy tables present".
21 It's probably best to reboot after the upgrade, or manually removing all
22 legacy iptables rules (via the `iptables-legacy` package).
23
24- systemd got an `nftables` backend, and configures (networkd) rules in their
25 own `io.systemd.*` tables. Check `nft list ruleset` to see these rules, not
26 `iptables-save` (which only shows `iptables`-created rules.
27
28- PHP now defaults to PHP 8.0, updated from 7.4.
29
30- kops now defaults to 1.21.1, which uses containerd as the default runtime.
31
32- `python3` now defaults to Python 3.9, updated from Python 3.8.
33
34- PostgreSQL now defaults to major version 13.
35
36- spark now defaults to spark 3, updated from 2. A [migration guide](https://spark.apache.org/docs/latest/core-migration-guide.html#upgrading-from-core-24-to-30) is available.
37
38- Improvements have been made to the Hadoop module and package:
39 - HDFS and YARN now support production-ready highly available deployments with automatic failover.
40 - Hadoop now defaults to Hadoop 3, updated from 2.
41 - JournalNode, ZKFS and HTTPFS services have been added.
42
43- Activation scripts can now, optionally, be run during a `nixos-rebuild dry-activate` and can detect the dry activation by reading `$NIXOS_ACTION`.
44 This allows activation scripts to output what they would change if the activation was really run.
45 The users/modules activation script supports this and outputs some of is actions.
46
47- KDE Plasma now finally works on Wayland.
48
49- bash now defaults to major version 5.
50
51- Systemd was updated to version 249 (from 247).
52
53- Pantheon desktop has been updated to version 6. Due to changes of screen locker, if locking doesn't work for you, please try `gsettings set org.gnome.desktop.lockdown disable-lock-screen false`.
54
55- `kubernetes-helm` now defaults to 3.7.0, which introduced some breaking changes to the experimental OCI manifest format. See [HIP 6](https://github.com/helm/community/blob/main/hips/hip-0006.md) for more details.
56 `helmfile` also defaults to 0.141.0, which is the minimum compatible version.
57
58- GNOME has been upgraded to 41. Please take a look at their [Release Notes](https://help.gnome.org/misc/release-notes/41.0/) for details.
59
60- LXD support was greatly improved:
61 - building LXD images from configurations is now directly possible with just nixpkgs
62 - hydra is now building nixOS LXD images that can be used standalone with full nixos-rebuild support
63
64- OpenSSH was updated to version 8.8p1
65 - This breaks connections to old SSH daemons as ssh-rsa host keys and ssh-rsa public keys that were signed with SHA-1 are disabled by default now
66 - These can be re-enabled, see the [OpenSSH changelog](https://www.openssh.com/txt/release-8.8) for details
67
68- ORY Kratos was updated to version 0.8.0-alpha.3
69 - This release requires you to run SQL migrations. Please, as always, create a backup of your database first!
70 - The SDKs are now generated with tag v0alpha2 to reflect that some signatures have changed in a breaking fashion. Please update your imports from v0alpha1 to v0alpha2.
71 - The SMTPS scheme used in courier config URL with cleartext/StartTLS/TLS SMTP connection types is now only supporting implicit TLS. For StartTLS and cleartext SMTP, please use the SMTP scheme instead.
72 - for more details, see [Release Notes](https://github.com/ory/kratos/releases/tag/v0.8.0-alpha.1).
73
74## New Services {#sec-release-21.11-new-services}
75
76- [btrbk](https://digint.ch/btrbk/index.html), a backup tool for btrfs subvolumes, taking advantage of btrfs specific capabilities to create atomic snapshots and transfer them incrementally to your backup locations. Available as [services.btrbk](options.html#opt-services.brtbk.instances).
77
78- [clipcat](https://github.com/xrelkd/clipcat/), an X11 clipboard manager written in Rust. Available at [services.clipcat](options.html#opt-services.clipcat.enable).
79
80- [dex](https://github.com/dexidp/dex), an OpenID Connect (OIDC) identity and OAuth 2.0 provider. Available at [services.dex](options.html#opt-services.dex.enable).
81
82- [geoipupdate](https://github.com/maxmind/geoipupdate), a GeoIP database updater from MaxMind. Available as [services.geoipupdate](options.html#opt-services.geoipupdate.enable).
83
84- [Jibri](https://github.com/jitsi/jibri), a service for recording or streaming a Jitsi Meet conference. Available as [services.jibri](options.html#opt-services.jibri.enable).
85
86- [Kea](https://www.isc.org/kea/), ISCs 2nd generation DHCP and DDNS server suite. Available at [services.kea](options.html#opt-services.kea.dhcp4).
87
88- [owncast](https://owncast.online/), self-hosted video live streaming solution. Available at [services.owncast](options.html#opt-services.owncast.enable).
89
90- [PeerTube](https://joinpeertube.org/), developed by Framasoft, is the free and decentralized alternative to video platforms. Available at [services.peertube](options.html#opt-services.peertube.enable).
91
92- [sourcehut](https://sr.ht), a collection of tools useful for software development. Available as [services.sourcehut](options.html#opt-services.sourcehut.enable).
93
94- [ucarp](https://download.pureftpd.org/pub/ucarp/README), an userspace implementation of the Common Address Redundancy Protocol (CARP). Available as [networking.ucarp](options.html#opt-networking.ucarp.enable).
95
96- Users of flashrom should migrate to [programs.flashrom.enable](options.html#opt-programs.flashrom.enable) and add themselves to the `flashrom` group to be able to access programmers supported by flashrom.
97
98- [vikunja](https://vikunja.io), a to-do list app. Available as [services.vikunja](#opt-services.vikunja.enable).
99
100- [opensnitch](https://github.com/evilsocket/opensnitch), an application firewall. Available as [services.opensnitch](#opt-services.opensnitch.enable).
101
102- [snapraid](https://www.snapraid.it/), a backup program for disk arrays.
103 Available as [snapraid](#opt-snapraid.enable).
104
105- [Hockeypuck](https://github.com/hockeypuck/hockeypuck), a OpenPGP Key Server. Available as [services.hockeypuck](#opt-services.hockeypuck.enable).
106
107- [buildkite-agent-metrics](https://github.com/buildkite/buildkite-agent-metrics), a command-line tool for collecting Buildkite agent metrics, now has a Prometheus exporter available as [services.prometheus.exporters.buildkite-agent](#opt-services.prometheus.exporters.buildkite-agent.enable).
108
109- [influxdb-exporter](https://github.com/prometheus/influxdb_exporter) a Prometheus exporter that exports metrics received on an InfluxDB compatible endpoint is now available as [services.prometheus.exporters.influxdb](#opt-services.prometheus.exporters.influxdb.enable).
110
111- [mx-puppet-discord](https://github.com/matrix-discord/mx-puppet-discord), a discord puppeting bridge for matrix. Available as [services.mx-puppet-discord](#opt-services.mx-puppet-discord.enable).
112
113- [MeshCentral](https://www.meshcommander.com/meshcentral2/overview), a remote administration service ("TeamViewer but self-hosted and with more features") is now available with a package and a module: [services.meshcentral.enable](#opt-services.meshcentral.enable)
114
115- [moonraker](https://github.com/Arksine/moonraker), an API web server for Klipper.
116 Available as [moonraker](#opt-services.moonraker.enable).
117
118- [influxdb2](https://github.com/influxdata/influxdb), a Scalable datastore for metrics, events, and real-time analytics. Available as [services.influxdb2](#opt-services.influxdb2.enable).
119
120- [isso](https://posativ.org/isso/), a commenting server similar to Disqus.
121 Available as [isso](#opt-services.isso.enable)
122
123- [navidrome](https://www.navidrome.org/), a personal music streaming server with
124 subsonic-compatible api. Available as [navidrome](#opt-services.navidrome.enable).
125
126- [fluidd](https://docs.fluidd.xyz/), a Klipper web interface for managing 3d printers using moonraker. Available as [fluidd](#opt-services.fluidd.enable).
127
128- [sx](https://github.com/earnestly/sx), a simple alternative to both xinit and startx for starting a Xorg server. Available as [services.xserver.displayManager.sx](#opt-services.xserver.displayManager.sx.enable)
129
130- [postfixadmin](https://postfixadmin.sourceforge.io/), a web based virtual user administration interface for Postfix mail servers. Available as [postfixadmin](#opt-services.postfixadmin.enable).
131
132- [prowlarr](https://wiki.servarr.com/prowlarr), an indexer manager/proxy built on the popular arr .net/reactjs base stack [services.prowlarr](#opt-services.prowlarr.enable).
133
134- [soju](https://sr.ht/~emersion/soju), a user-friendly IRC bouncer. Available as [services.soju](options.html#opt-services.soju.enable).
135
136- [nats](https://nats.io/), a high performance cloud and edge messaging system. Available as [services.nats](#opt-services.nats.enable).
137
138- [git](https://git-scm.com), a distributed version control system. Available as [programs.git](options.html#opt-programs.git.enable).
139
140- [parsedmarc](https://domainaware.github.io/parsedmarc/), a service
141 which parses incoming [DMARC](https://dmarc.org/) reports and stores
142 or sends them to a downstream service for further analysis.
143 Documented in [its manual entry](#module-services-parsedmarc).
144
145- [spark](https://spark.apache.org/), a unified analytics engine for large-scale data processing.
146
147- [touchegg](https://github.com/JoseExposito/touchegg), a multi-touch gesture recognizer. Available as [services.touchegg](#opt-services.touchegg.enable).
148
149- [pantheon-tweaks](https://github.com/pantheon-tweaks/pantheon-tweaks), an unofficial system settings panel for Pantheon. Available as [programs.pantheon-tweaks](#opt-programs.pantheon-tweaks.enable).
150
151- [joycond](https://github.com/DanielOgorchock/joycond), a service that uses `hid-nintendo` to provide nintendo joycond pairing and better nintendo switch pro controller support.
152
153- [multipath](https://github.com/opensvc/multipath-tools), the device mapper multipath (DM-MP) daemon. Available as [services.multipath](#opt-services.multipath.enable).
154
155- [seafile](https://www.seafile.com/en/home/), an open source file syncing & sharing software. Available as [services.seafile](options.html#opt-services.seafile.enable).
156
157- [rasdaemon](https://github.com/mchehab/rasdaemon), a hardware error logging daemon. Available as [hardware.rasdaemon](#opt-hardware.rasdaemon.enable).
158
159- `code-server`-module now available
160
161- [xmrig](https://github.com/xmrig/xmrig), a high performance, open source, cross platform RandomX, KawPow, CryptoNight and AstroBWT unified CPU/GPU miner and RandomX benchmark.
162
163- Auto nice daemons [ananicy](https://github.com/Nefelim4ag/Ananicy) and [ananicy-cpp](https://gitlab.com/ananicy-cpp/ananicy-cpp/). Available as [services.ananicy](#opt-services.ananicy.enable).
164
165- [smartctl_exporter](https://github.com/prometheus-community/smartctl_exporter), a Prometheus exporter for [S.M.A.R.T.](https://en.wikipedia.org/wiki/S.M.A.R.T.) data. Available as [services.prometheus.exporters.smartctl](options.html#opt-services.prometheus.exporters.smartctl.enable).
166
167## Backward Incompatibilities {#sec-release-21.11-incompatibilities}
168
169- The NixOS VM test framework, `pkgs.nixosTest`/`make-test-python.nix` (`pkgs.testers.nixosTest` since 22.05), now requires detaching commands such as `succeed("foo &")` and `succeed("foo | xclip -i")` to close stdout.
170 This can be done with a redirect such as `succeed("foo >&2 &")`. This breaking change was necessitated by a race condition causing tests to fail or hang.
171 It applies to all methods that invoke commands on the nodes, including `execute`, `succeed`, `fail`, `wait_until_succeeds`, `wait_until_fails`.
172
173- The `services.wakeonlan` option was removed, and replaced with `networking.interfaces.<name>.wakeOnLan`.
174
175- The `security.wrappers` option now requires to always specify an owner, group and whether the setuid/setgid bit should be set.
176 This is motivated by the fact that before NixOS 21.11, specifying either setuid or setgid but not owner/group resulted in wrappers owned by nobody/nogroup, which is unsafe.
177
178- Since `iptables` now uses `nf_tables` backend and `ipset` doesn't support it, some applications (ferm, shorewall, firehol) may have limited functionality.
179
180- The `paperless` module and package have been removed. All users should migrate to the
181 successor `paperless-ng` instead. The Paperless project [has been
182 archived](https://github.com/the-paperless-project/paperless/commit/9b0063c9731f7c5f65b1852cb8caff97f5e40ba4)
183 and advises all users to use `paperless-ng` instead.
184
185 Users can use the `services.paperless-ng` module as a replacement while noting the following incompatibilities:
186
187 - `services.paperless.ocrLanguages` has no replacement. Users should migrate to [`services.paperless-ng.extraConfig`](options.html#opt-services.paperless-ng.extraConfig) instead:
188
189 ```nix
190 {
191 services.paperless-ng.extraConfig = {
192 # Provide languages as ISO 639-2 codes
193 # separated by a plus (+) sign.
194 # https://en.wikipedia.org/wiki/List_of_ISO_639-2_codes
195 PAPERLESS_OCR_LANGUAGE = "deu+eng+jpn"; # German & English & Japanse
196 };
197 }
198 ```
199
200 - If you previously specified `PAPERLESS_CONSUME_MAIL_*` settings in
201 `services.paperless.extraConfig` you should remove those options now. You
202 now _must_ define those settings in the admin interface of paperless-ng.
203
204 - Option `services.paperless.manage` no longer exists.
205 Use the script at `${services.paperless-ng.dataDir}/paperless-ng-manage` instead.
206 Note that this script only exists after the `paperless-ng` service has been
207 started at least once.
208
209 - After switching to the new system configuration you should run the Django
210 management command to reindex your documents and optionally create a user,
211 if you don't have one already.
212
213 To do so, enter the data directory (the value of
214 `services.paperless-ng.dataDir`, `/var/lib/paperless` by default), switch
215 to the paperless user and execute the management command like below:
216
217 ```
218 $ cd /var/lib/paperless
219 $ su paperless -s /bin/sh
220 $ ./paperless-ng-manage document_index reindex
221 # if not already done create a user account, paperless-ng requires a login
222 $ ./paperless-ng-manage createsuperuser
223 Username (leave blank to use 'paperless'): my-user-name
224 Email address: me@example.com
225 Password: **********
226 Password (again): **********
227 Superuser created successfully.
228 ```
229
230- The `staticjinja` package has been upgraded from 1.0.4 to 4.1.1
231
232- Firefox v91 does not support addons with invalid signature anymore. Firefox ESR needs to be used for nix addon support.
233
234- The `erigon` ethereum node has moved to a new database format in `2021-05-04`, and requires a full resync
235
236- The `erigon` ethereum node has moved it's database location in `2021-08-03`, users upgrading must manually move their chaindata (see [release notes](https://github.com/ledgerwatch/erigon/releases/tag/v2021.08.03)).
237
238- [users.users.<name>.group](options.html#opt-users.users._name_.group) no longer defaults to `nogroup`, which was insecure. Out-of-tree modules are likely to require adaptation: instead of
239 ```nix
240 {
241 users.users.foo = {
242 isSystemUser = true;
243 };
244 }
245 ```
246 also create a group for your user:
247 ```nix
248 {
249 users.users.foo = {
250 isSystemUser = true;
251 group = "foo";
252 };
253 users.groups.foo = {};
254 }
255 ```
256
257- `services.geoip-updater` was broken and has been replaced by [services.geoipupdate](options.html#opt-services.geoipupdate.enable).
258
259- `ihatemoney` has been updated to version 5.1.1 ([release notes](https://github.com/spiral-project/ihatemoney/blob/5.1.1/CHANGELOG.rst)). If you serve ihatemoney by HTTP rather than HTTPS, you must set [services.ihatemoney.secureCookie](options.html#opt-services.ihatemoney.secureCookie) to `false`.
260
261- PHP 7.3 is no longer supported due to upstream not supporting this version for the entire lifecycle of the 21.11 release.
262
263- Those making use of `buildBazelPackage` will need to regenerate the fetch hashes (preferred), or set `fetchConfigured = false;`.
264
265- `consul` was upgraded to a new major release with breaking changes, see [upstream changelog](https://github.com/hashicorp/consul/releases/tag/v1.10.0).
266
267- fsharp41 has been removed in preference to use the latest dotnet-sdk
268
269- The following F#-related packages have been removed for being unmaintaned. Please use `fetchNuGet` for specific packages.
270
271 - ExtCore
272 - Fake
273 - Fantomas
274 - FsCheck
275 - FsCheck262
276 - FsCheckNunit
277 - FSharpAutoComplete
278 - FSharpCompilerCodeDom
279 - FSharpCompilerService
280 - FSharpCompilerTools
281 - FSharpCore302
282 - FSharpCore3125
283 - FSharpCore4001
284 - FSharpCore4117
285 - FSharpData
286 - FSharpData225
287 - FSharpDataSQLProvider
288 - FSharpFormatting
289 - FsLexYacc
290 - FsLexYacc706
291 - FsLexYaccRuntime
292 - FsPickler
293 - FsUnit
294 - Projekt
295 - Suave
296 - UnionArgParser
297 - ExcelDnaRegistration
298 - MathNetNumerics
299
300- `programs.x2goserver` is now `services.x2goserver`
301
302- The following dotnet-related packages have been removed for being unmaintaned. Please use `fetchNuGet` for specific packages.
303 - Autofac
304 - SystemValueTuple
305 - MicrosoftDiaSymReader
306 - MicrosoftDiaSymReaderPortablePdb
307 - SystemCollectionsImmutable
308 - SystemCollectionsImmutable131
309 - SystemReflectionMetadata
310 - NUnit350
311 - Deedle
312 - ExcelDna
313 - GitVersionTree
314 - NDeskOptions
315
316* The `antlr` package now defaults to the 4.x release instead of the
317 old 2.7.7 version.
318
319* The `pulseeffects` package updated to [version 4.x](https://github.com/wwmm/easyeffects/releases/tag/v6.0.0) and renamed to `easyeffects`.
320
321* The `libwnck` package now defaults to the 3.x release instead of the
322 old 2.31.0 version.
323
324* The `bitwarden_rs` packages and modules were renamed to `vaultwarden`
325 [following upstream](https://github.com/dani-garcia/vaultwarden/discussions/1642). More specifically,
326
327 - `pkgs.bitwarden_rs`, `pkgs.bitwarden_rs-sqlite`, `pkgs.bitwarden_rs-mysql` and
328 `pkgs.bitwarden_rs-postgresql` were renamed to `pkgs.vaultwarden`, `pkgs.vaultwarden-sqlite`,
329 `pkgs.vaultwarden-mysql` and `pkgs.vaultwarden-postgresql`, respectively.
330
331 - Old names are preserved as aliases for backwards compatibility, but may be removed in the future.
332 - The `bitwarden_rs` executable was also renamed to `vaultwarden` in all packages.
333
334 - `pkgs.bitwarden_rs-vault` was renamed to `pkgs.vaultwarden-vault`.
335
336 - `pkgs.bitwarden_rs-vault` is preserved as an alias for backwards compatibility, but may be removed in the future.
337 - The static files were moved from `/usr/share/bitwarden_rs` to `/usr/share/vaultwarden`.
338
339 - The `services.bitwarden_rs` config module was renamed to `services.vaultwarden`.
340
341 - `services.bitwarden_rs` is preserved as an alias for backwards compatibility, but may be removed in the future.
342
343 - `systemd.services.bitwarden_rs`, `systemd.services.backup-bitwarden_rs` and `systemd.timers.backup-bitwarden_rs`
344 were renamed to `systemd.services.vaultwarden`, `systemd.services.backup-vaultwarden` and
345 `systemd.timers.backup-vaultwarden`, respectively.
346
347 - Old names are preserved as aliases for backwards compatibility, but may be removed in the future.
348
349 - `users.users.bitwarden_rs` and `users.groups.bitwarden_rs` were renamed to `users.users.vaultwarden` and
350 `users.groups.vaultwarden`, respectively.
351
352 - The data directory remains located at `/var/lib/bitwarden_rs`, for backwards compatibility.
353
354- `yggdrasil` was upgraded to a new major release with breaking changes, see [upstream changelog](https://github.com/yggdrasil-network/yggdrasil-go/releases/tag/v0.4.0).
355
356- `icingaweb2` was upgraded to a new release which requires a manual database upgrade, see [upstream changelog](https://github.com/Icinga/icingaweb2/releases/tag/v2.9.0).
357
358- The `isabelle` package has been upgraded from 2020 to 2021
359
360- the `mingw-64` package has been upgraded from 6.0.0 to 9.0.0
361
362- `tt-rss` was upgraded to the commit on 2021-06-21, which has breaking changes. If you use `services.tt-rss.extraConfig` you should migrate to the `putenv`-style configuration. See [this Discourse post](https://community.tt-rss.org/t/rip-config-php-hello-classes-config-php/4337) in the tt-rss forums for more details.
363
364- The following Visual Studio Code extensions were renamed to keep the naming convention uniform.
365
366 - `bbenoist.Nix` -> `bbenoist.nix`
367 - `CoenraadS.bracket-pair-colorizer` -> `coenraads.bracket-pair-colorizer`
368 - `golang.Go` -> `golang.go`
369
370- `services.uptimed` now uses `/var/lib/uptimed` as its stateDirectory instead of `/var/spool/uptimed`. Make sure to move all files to the new directory.
371
372- Deprecated package aliases in `emacs.pkgs.*` have been removed. These aliases were remnants of the old Emacs package infrastructure. We now use exact upstream names wherever possible.
373
374- `programs.neovim.runtime` switched to a `linkFarm` internally, making it impossible to use wildcards in the `source` argument.
375
376- The `openrazer` and `openrazer-daemon` packages as well as the `hardware.openrazer` module now require users to be members of the `openrazer` group instead of `plugdev`. With this change, users no longer need be granted the entire set of `plugdev` group permissions, which can include permissions other than those required by `openrazer`. This is desirable from a security point of view. The setting [`harware.openrazer.users`](options.html#opt-services.hardware.openrazer.users) can be used to add users to the `openrazer` group.
377
378- The fontconfig service's dpi option has been removed.
379 Fontconfig should use Xft settings by default so there's no need to override one value in multiple places.
380 The user can set DPI via ~/.Xresources properly, or at the system level per monitor, or as a last resort at the system level with `services.xserver.dpi`.
381
382- The `yambar` package has been split into `yambar` and `yambar-wayland`, corresponding to the xorg and wayland backend respectively. Please switch to `yambar-wayland` if you are on wayland.
383
384- The `services.minio` module gained an additional option `consoleAddress`, that
385 configures the address and port the web UI is listening, it defaults to `:9001`.
386 To be able to access the web UI this port needs to be opened in the firewall.
387
388- The `varnish` package was upgraded from 6.3.x to 7.x. `varnish60` for the last LTS release is also still available.
389
390- The `kubernetes` package was upgraded to 1.22. The `kubernetes.apiserver.kubeletHttps` option was removed and HTTPS is always used.
391
392- The attribute `linuxPackages_latest_hardened` was dropped because the hardened patches
393 lag behind the upstream kernel which made version bumps harder. If you want to use
394 a hardened kernel, please pin it explicitly with a versioned attribute such as
395 `linuxPackages_5_10_hardened`.
396
397- The `nomad` package now defaults to a 1.1.x release instead of 1.0.x
398
399- If `exfat` is included in `boot.supportedFilesystems` and when using kernel 5.7
400 or later, the `exfatprogs` user-space utilities are used instead of `exfat`.
401
402- The `todoman` package was upgraded from 3.9.0 to 4.0.0. This introduces breaking changes in the [configuration file](https://todoman.readthedocs.io/en/stable/configure.html#configuration-file) format.
403
404- The `datadog-agent`, `datadog-integrations-core` and `datadog-process-agent` packages
405 were upgraded from 6.11.2 to 7.30.2, git-2018-09-18 to 7.30.1 and 6.11.1 to 7.30.2,
406 respectively. As a result `services.datadog-agent` has had breaking changes to the
407 configuration file. For details, see the [upstream changelog](https://github.com/DataDog/datadog-agent/blob/main/CHANGELOG.rst).
408
409- `opencv2` no longer includes the non-free libraries by default, and consequently `pfstools` no longer includes OpenCV support by default. Both packages now support an `enableUnfree` option to re-enable this functionality.
410- `services.xserver.displayManager.defaultSession = "plasma5"` does not work anymore, instead use either `"plasma"` for the Plasma X11 session or `"plasmawayland"` for the Plasma Wayland sesison.
411
412- `boot.kernelParams` now only accepts one command line parameter per string. This change is aimed to reduce common mistakes like "param = 12", which would be parsed as 3 parameters.
413
414- `nix.daemonNiceLevel` and `nix.daemonIONiceLevel` have been removed in favour of the new options [`nix.daemonCPUSchedPolicy`](options.html#opt-nix.daemonCPUSchedPolicy), [`nix.daemonIOSchedClass`](options.html#opt-nix.daemonIOSchedClass) and [`nix.daemonIOSchedPriority`](options.html#opt-nix.daemonIOSchedPriority). Please refer to the options documentation and the `sched(7)` and `ioprio_set(2)` man pages for guidance on how to use them.
415
416- The `coursier` package's binary was renamed from `coursier` to `cs`. Completions which haven't worked for a while should now work with the renamed binary. To keep using `coursier`, you can create a shell alias.
417
418- The `services.mosquitto` module has been rewritten to support multiple listeners and per-listener configuration.
419 Module configurations from previous releases will no longer work and must be updated.
420
421- The `fluidsynth_1` attribute has been removed, as this legacy version is no longer needed in nixpkgs. The actively maintained 2.x series is available as `fluidsynth` unchanged.
422
423- Nextcloud 20 (`pkgs.nextcloud20`) has been dropped because it was EOLed by upstream in 2021-10.
424
425- The `virtualisation.pathsInNixDB` option was renamed
426 [`virtualisation.additionalPaths`](options.html#opt-virtualisation.additionalPaths).
427
428- The `services.ddclient.password` option was removed, and replaced with `services.ddclient.passwordFile`.
429
430- The default GNAT version has been changed: The `gnat` attribute now points to `gnat11`
431 instead of `gnat9`.
432
433- `retroArchCores` has been removed. This means that using `nixpkgs.config.retroarch` to customize RetroArch cores is not supported anymore. Instead, use package overrides, for example: `retroarch.override { cores = with libretro; [ citra snes9x ]; };`. Also, `retroarchFull` derivation is available for those who want to have all RetroArch cores available.
434
435- The Linux kernel for security reasons now restricts access to BPF syscalls via `BPF_UNPRIV_DEFAULT_OFF=y`. Unprivileged access can be reenabled via the `kernel.unprivileged_bpf_disabled` sysctl knob.
436
437- `/usr` will always be included in the initial ramdisk. See the `fileSystems.<name>.neededForBoot` option.
438 If any files exist under `/usr` (which is not typical for NixOS), they will be included in the initial ramdisk, increasing its size to a possibly problematic extent.
439
440- `pkgs.haskell-language-server` will now by default be linked dynamically to improve TemplateHaskell compatibility. To mitigate the increased closure size it will now by default only support our current default ghc (at the moment 9.0.2). Add other ghc versions via e.g. `pkgs.haskell-language-server.override { supportedGhcVersions = [ "90" "92" ]; }`.
441
442## Other Notable Changes {#sec-release-21.11-notable-changes}
443
444
445- The linux kernel package infrastructure was moved out of `all-packages.nix`, and restructured. Linux related functions and attributes now live under the `pkgs.linuxKernel` attribute set.
446 In particular the versioned `linuxPackages_*` package sets (such as `linuxPackages_5_4`) and kernels from `pkgs` were moved there and now live under `pkgs.linuxKernel.packages.*`. The unversioned ones (such as `linuxPackages_latest`) remain untouched.
447
448- In NixOS virtual machines (QEMU), the `virtualisation` module has been updated with new options:
449 - [`forwardPorts`](options.html#opt-virtualisation.forwardPorts) to configure IPv4 port forwarding,
450 - [`sharedDirectories`](options.html#opt-virtualisation.sharedDirectories) to set up shared host directories,
451 - [`resolution`](options.html#opt-virtualisation.resolution) to set the screen resolution,
452 - [`useNixStoreImage`](options.html#opt-virtualisation.useNixStoreImage) to use a disk image for the Nix store instead of 9P.
453
454 In addition, the default [`msize`](options.html#opt-virtualisation.msize) parameter in 9P filesystems (including /nix/store and all shared directories) has been increased to 16K for improved performance.
455
456- The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets.
457
458 However, if [`services.fail2ban.enable`](options.html#opt-services.fail2ban.enable) is `true`, the `fail2ban` will override the verbosity to `"VERBOSE"`, so that `fail2ban` can observe the failed login attempts from the SSH logs.
459
460- The [`services.xserver.extraLayouts`](options.html#opt-services.xserver.extraLayouts) no longer cause additional rebuilds when a layout is added or modified.
461
462- Sway: The terminal emulator `rxvt-unicode` is no longer installed by default via `programs.sway.extraPackages`. The current default configuration uses `alacritty` (and soon `foot`) so this is only an issue when using a customized configuration and not installing `rxvt-unicode` explicitly.
463
464- `python3` now defaults to Python 3.9. Python 3.9 introduces many deprecation warnings, please look at the [What's New In Python 3.9 post](https://docs.python.org/3/whatsnew/3.9.html) for more information.
465
466- `qtile` hase been updated from '0.16.0' to '0.18.0', please check [qtile changelog](https://github.com/qtile/qtile/blob/master/CHANGELOG) for changes.
467
468- The `claws-mail` package now references the new GTK+ 3 release branch, major version 4. To use the GTK+ 2 releases, one can install the `claws-mail-gtk2` package.
469
470- The wordpress module provides a new interface which allows to use different webservers with the new option [`services.wordpress.webserver`](options.html#opt-services.wordpress.webserver). Currently `httpd`, `caddy` and `nginx` are supported. The definitions of wordpress sites should now be set in [`services.wordpress.sites`](options.html#opt-services.wordpress.sites).
471
472 Sites definitions that use the old interface are automatically migrated in the new option. This backward compatibility will be removed in 22.05.
473
474- The dokuwiki module provides a new interface which allows to use different webservers with the new option [`services.dokuwiki.webserver`](options.html#opt-services.dokuwiki.webserver). Currently `caddy` and `nginx` are supported. The definitions of dokuwiki sites should now be set in [`services.dokuwiki.sites`](options.html#opt-services.dokuwiki.sites).
475
476 Sites definitions that use the old interface are automatically migrated in the new option. This backward compatibility will be removed in 22.05.
477
478- The order of NSS (host) modules has been brought in line with upstream
479 recommendations:
480
481 - The `myhostname` module is placed before the `resolve` (optional) and `dns`
482 entries, but after `file` (to allow overriding via `/etc/hosts` /
483 `networking.extraHosts`, and prevent ISPs with catchall-DNS resolvers from
484 hijacking `.localhost` domains)
485 - The `mymachines` module, which provides hostname resolution for local
486 containers (registered with `systemd-machined`) is placed to the front, to
487 make sure its mappings are preferred over other resolvers.
488 - If systemd-networkd is enabled, the `resolve` module is placed before
489 `files` and `myhostname`, as it provides the same logic internally, with
490 caching.
491 - The `mdns(_minimal)` module has been updated to the new priorities.
492
493 If you use your own NSS host modules, make sure to update your priorities
494 according to these rules:
495
496 - NSS modules which should be queried before `resolved` DNS resolution should
497 use mkBefore.
498 - NSS modules which should be queried after `resolved`, `files` and
499 `myhostname`, but before `dns` should use the default priority
500 - NSS modules which should come after `dns` should use mkAfter.
501
502- The [networking.wireless](options.html#opt-networking.wireless.enable) module (based on wpa_supplicant) has been heavily reworked, solving a number of issues and adding useful features:
503 - The automatic discovery of wireless interfaces at boot has been made reliable again (issues [#101963](https://github.com/NixOS/nixpkgs/issues/101963), [#23196](https://github.com/NixOS/nixpkgs/issues/23196)).
504 - WPA3 and Fast BSS Transition (802.11r) are now enabled by default for all networks.
505 - Secrets like pre-shared keys and passwords can now be handled safely, meaning without including them in a world-readable file (`wpa_supplicant.conf` under /nix/store).
506 This is achieved by storing the secrets in a secured [environmentFile](options.html#opt-networking.wireless.environmentFile) and referring to them though environment variables that are expanded inside the configuration.
507 - With multiple interfaces declared, independent wpa_supplicant daemons are started, one for each interface (the services are named `wpa_supplicant-wlan0`, `wpa_supplicant-wlan1`, etc.).
508 - The generated `wpa_supplicant.conf` file is now formatted for easier reading.
509 - A new [scanOnLowSignal](options.html#opt-networking.wireless.scanOnLowSignal) option has been added to facilitate fast roaming between access points (enabled by default).
510 - A new [networks.<name>.authProtocols](options.html#opt-networking.wireless.networks._name_.authProtocols) option has been added to change the authentication protocols used when connecting to a network.
511
512- The [networking.wireless.iwd](options.html#opt-networking.wireless.iwd.enable) module has a new [networking.wireless.iwd.settings](options.html#opt-networking.wireless.iwd.settings) option.
513
514- The [services.smokeping.host](options.html#opt-services.smokeping.host) option was added and defaulted to `localhost`. Before, `smokeping` listened to all interfaces by default. NixOS defaults generally aim to provide non-Internet-exposed defaults for databases and internal monitoring tools, see e.g. [#100192](https://github.com/NixOS/nixpkgs/issues/100192). Further, the systemd service for `smokeping` got reworked defaults for increased operational stability, see [PR #144127](https://github.com/NixOS/nixpkgs/pull/144127) for details.
515
516- The [services.syncoid.enable](options.html#opt-services.syncoid.enable) module now properly drops ZFS permissions after usage. Before it delegated permissions to whole pools instead of datasets and didn't clean up after execution. You can manually look this up for your pools by running `zfs allow your-pool-name` and use `zfs unallow syncoid your-pool-name` to clean this up.
517
518- Zfs: `latestCompatibleLinuxPackages` is now exported on the zfs package. One can use `boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;` to always track the latest compatible kernel with a given version of zfs.
519
520- Nginx will use the value of `sslTrustedCertificate` if provided for a virtual host, even if `enableACME` is set. This is useful for providers not using the same certificate to sign OCSP responses and server certificates.
521
522- `lib.formats.yaml`'s `generate` will not generate JSON anymore, but instead use more of the YAML-specific syntax.
523
524- MariaDB was upgraded from 10.5.x to 10.6.x. Please read the [upstream release notes](https://mariadb.com/kb/en/changes-improvements-in-mariadb-106/) for changes and upgrade instructions.
525
526- The MariaDB C client library, also known as libmysqlclient or mariadb-connector-c, was upgraded from 3.1.x to 3.2.x. While this should hopefully not have any impact, this upgrade comes with some changes to default behavior, so you might want to review the [upstream release notes](https://mariadb.com/kb/en/changes-and-improvements-in-mariadb-connector-c-32/).
527
528- GNOME desktop environment now enables `QGnomePlatform` as the Qt platform theme, which should avoid crashes when opening file chooser dialogs in Qt apps by using XDG desktop portal. Additionally, it will make the apps fit better visually.
529
530- `rofi` has been updated from '1.6.1' to '1.7.0', one important thing is the removal of the old xresources based configuration setup. Read more [in rofi's changelog](https://github.com/davatorium/rofi/blob/cb12e6fc058f4a0f4f/Changelog#L1).
531
532- ipfs now defaults to not listening on you local network. This setting was change as server providers won't accept port scanning on their private network. If you have several ipfs instances running on a network you own, feel free to change the setting `ipfs.localDiscovery = true;`. localDiscovery enables different instances to discover each other and share data.
533
534- `lua` and `luajit` interpreters have been patched to avoid looking into /usr/lib
535 directories, thus increasing the purity of the build.
536
537- Three new options, [xdg.mime.addedAssociations](#opt-xdg.mime.addedAssociations), [xdg.mime.defaultApplications](#opt-xdg.mime.defaultApplications), and [xdg.mime.removedAssociations](#opt-xdg.mime.removedAssociations) have been added to the [xdg.mime](#opt-xdg.mime.enable) module to allow the configuration of `/etc/xdg/mimeapps.list`.
538
539- Kopia was upgraded from 0.8.x to 0.9.x. Please read the [upstream release notes](https://github.com/kopia/kopia/releases/tag/v0.9.0) for changes and upgrade instructions.
540
541- The `systemd.network` module has gained support for the FooOverUDP link type.
542
543- The `networking` module has a new `networking.fooOverUDP` option to configure Foo-over-UDP encapsulations.
544
545- `networking.sits` now supports Foo-over-UDP encapsulation.
546
547- The `virtualisation.libvirtd` module has been refactored and updated with new options:
548 - `virtualisation.libvirtd.qemu*` options (e.g.: `virtualisation.libvirtd.qemuRunAsRoot`) were moved to [`virtualisation.libvirtd.qemu`](options.html#opt-virtualisation.libvirtd.qemu) submodule,
549 - software TPM1/TPM2 support (e.g.: Windows 11 guests) ([`virtualisation.libvirtd.qemu.swtpm`](options.html#opt-virtualisation.libvirtd.qemu.swtpm)),
550 - custom OVMF package (e.g.: `pkgs.OVMFFull` with HTTP, CSM and Secure Boot support) ([`virtualisation.libvirtd.qemu.ovmf.package`](options.html#opt-virtualisation.libvirtd.qemu.ovmf.package)).
551
552- The `cawbird` Twitter client now uses its own API keys to count as different application than upstream builds. This is done to evade application-level rate limiting. While existing accounts continue to work, users may want to remove and re-register their account in the client to enjoy a better user experience and benefit from this change.
553
554- A new option `services.prometheus.enableReload` has been added which can be enabled to reload the prometheus service when its config file changes instead of restarting.
555
556- The option `services.prometheus.environmentFile` has been removed since it was causing [issues](https://github.com/NixOS/nixpkgs/issues/126083) and Prometheus now has native support for secret files, i.e. `basic_auth.password_file` and `authorization.credentials_file`.
557
558- Dokuwiki now supports caddy! However
559 - the nginx option has been removed, in the new configuration, please use the `dokuwiki.webserver = "nginx"` instead.
560 - The "${hostname}" option has been deprecated, please use `dokuwiki.sites = [ "${hostname}" ]` instead
561
562- The [services.unifi](options.html#opt-services.unifi.enable) module has been reworked, solving a number of issues. This leads to several user facing changes:
563 - The `services.unifi.dataDir` option is removed and the data is now always located under `/var/lib/unifi/data`. This is done to make better use of systemd state direcotiry and thus making the service restart more reliable.
564 - The unifi logs can now be found under: `/var/log/unifi` instead of `/var/lib/unifi/logs`.
565 - The unifi run directory can now be found under: `/run/unifi` instead of `/var/lib/unifi/run`.
566
567- `security.pam.services.<name>.makeHomeDir` now uses `umask=0077` instead of `umask=0022` when creating the home directory.
568
569- Loki has had another release. Some default values have been changed for the configuration and some configuration options have been renamed. For more details, please check [the upgrade guide](https://grafana.com/docs/loki/latest/upgrading/#240).
570
571- `julia` now refers to `julia-stable` instead of `julia-lts`. In practice this means it has been upgraded from `1.0.4` to `1.5.4`.
572
573- RetroArch has been upgraded from version `1.8.5` to `1.9.13.2`. Since the previous release was quite old, if you're having issues after the upgrade, please delete your `$XDG_CONFIG_HOME/retroarch/retroarch.cfg` file.
574
575- hydrus has been upgraded from version `438` to `463`. Since upgrading between releases this old is advised against, be sure to have a backup of your data before upgrading. For details, see [the hydrus manual](https://hydrusnetwork.github.io/hydrus/help/getting_started_installing.html#big_updates).
576
577- More jdk and jre versions are now exposed via `java-packages.compiler`.
578
579- The sets `haskell.packages` and `haskell.compiler` now contain for every ghc version an attribute with the minor version dropped. E.g. for `ghc8107` there also now exists `ghc810`. Those attributes point to the same compilers and packagesets but have the advantage that e.g. `ghc92` stays stable when we update from `ghc925` to `ghc926`.