pyrox.dev
1# Release 22.11 (“Raccoon”, 2022.11/??) {#sec-release-22.11}
2
3Support is planned until the end of June 2023, handing over to 23.05.
4
5## Highlights {#sec-release-22.11-highlights}
6
7In addition to numerous new and upgraded packages, this release has the following highlights:
8
9- GNOME has been upgraded to 43. Please take a look at their [Release
10 Notes](https://release.gnome.org/43/) for details.
11
12- During cross-compilation, tests are now executed if the test suite can be executed
13 by the build platform. This is the case when doing “native” cross-compilation
14 where the build and host platforms are largely the same, but the nixpkgs' cross
15 compilation infrastructure is used, e.g. `pkgsStatic` and `pkgsLLVM`. Another
16 possibility is that the build platform is a superset of the host platform, e.g. when
17 cross-compiling from `x86_64-unknown-linux` to `i686-unknown-linux`.
18 The predicate gating test suite execution is the newly added `canExecute`
19 predicate: You can e.g. check if `stdenv.buildPlatform` can execute binaries
20 built for `stdenv.hostPlatform` (i.e. produced by `stdenv.cc`) by evaluating
21 `stdenv.buildPlatform.canExecute stdenv.hostPlatform`.
22
23- The `nixpkgs.hostPlatform` and `nixpkgs.buildPlatform` options have been added.
24 These cover and override the `nixpkgs.{system,localSystem,crossSystem}` options.
25
26 - `hostPlatform` is the platform or "`system`" string of the NixOS system
27 described by the configuration.
28 - `buildPlatform` is the platform that is responsible for building the NixOS
29 configuration. It defaults to the `hostPlatform`, for a non-cross
30 build configuration. To cross compile, set `buildPlatform` to a different
31 value.
32
33 The new options convey the same information, but with fewer options, and
34 following the Nixpkgs terminology.
35
36 The existing options `nixpkgs.{system,localSystem,crossSystem}` have not
37 been formally deprecated, to allow for evaluation of the change and to allow
38 for a transition period so that in time the ecosystem can switch without
39 breaking compatibility with any supported NixOS release.
40
41- `emacs` enables native compilation which means:
42 - emacs packages from nixpkgs, builtin or not, will do native compilation ahead of time so you can enjoy the benefit of native compilation without compiling them on you machine;
43 - emacs packages from somewhere else, e.g. `package-install`, will do asynchronously deferred native compilation. If you do not want this, maybe to avoid CPU consumption for compilation, you can use `(setq native-comp-deferred-compilation nil)` to disable it while still enjoy the benefit of native compilation for packages from nixpkgs.
44
45- `nixos-generate-config` now generates configurations that can be built in pure
46 mode. This is achieved by setting the new `nixpkgs.hostPlatform` option.
47
48 You may have to unset the `system` parameter in `lib.nixosSystem`, or similarly
49 remove definitions of the `nixpkgs.{system,localSystem,crossSystem}` options.
50
51 Alternatively, you can remove the `hostPlatform` line and use NixOS like you
52 would in NixOS 22.05 and earlier.
53
54- PHP now defaults to PHP 8.1, updated from 8.0.
55
56- PHP is now built `NTS` (Non-Thread Safe) style by default, for Apache and
57 `mod_php` usage we still enable `ZTS` (Zend Thread Safe). This has been a
58 common practice for a long time in other distributions.
59
60- PHP 8.2.0 RC 6 is available.
61
62- `protonup` has been aliased to and replaced by `protonup-ng` due to upstream not maintaining it.
63
64- Perl has been updated to 5.36, and its core module `HTTP::Tiny` was patched to verify SSL/TLS certificates by default.
65
66- Improved performances of `lib.closePropagation` which was previously quadratic. This is used in e.g. `ghcWithPackages`. Please see backward incompatibilities notes below.
67
68- Cinnamon has been updated to 5.4. While at it, the cinnamon module now defaults to
69 blueman as bluetooth manager and slick-greeter as lightdm greeter to match upstream.
70
71- OpenSSL now defaults to OpenSSL 3, updated from 1.1.1.
72
73- An image configuration and generator has been added for Linode images, largely based on the present GCE configuration and image.
74
75- `hardware.nvidia` has a new option `open` that can be used to opt in the opensource version of NVIDIA kernel driver. Note that the driver's support for GeForce and Workstation GPUs is still alpha quality, see [NVIDIA Releases Open-Source GPU Kernel Modules](https://developer.nvidia.com/blog/nvidia-releases-open-source-gpu-kernel-modules/) for the official announcement.
76
77<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
78
79## New Services {#sec-release-22.11-new-services}
80
81- [appvm](https://github.com/jollheef/appvm), Nix based app VMs. Available as [virtualisation.appvm](options.html#opt-virtualisation.appvm.enable).
82
83- [automatic-timezoned](https://github.com/maxbrunet/automatic-timezoned). a Linux daemon to automatically update the system timezone based on location. Available as [services.automatic-timezoned](#opt-services.automatic-timezoned.enable).
84
85- [xray] (https://github.com/XTLS/Xray-core), a fully compatible v2ray-core replacement. Features XTLS, which when enabled on server and client, brings UDP FullCone NAT to proxy setups. Available as [services.xray](options.html#opt-services.xray.enable).
86
87- [syncstorage-rs](https://github.com/mozilla-services/syncstorage-rs), a self-hostable sync server for Firefox. Available as [services.firefox-syncserver](options.html#opt-services.firefox-syncserver.enable).
88
89- [dragonflydb](https://dragonflydb.io/), a modern replacement for Redis and Memcached. Available as [services.dragonflydb](#opt-services.dragonflydb.enable).
90
91- [Komga](https://komga.org/), a free and open source comics/mangas media server. Available as [services.komga](#opt-services.komga.enable).
92
93- [Tandoor Recipes](https://tandoor.dev), a self-hosted multi-tenant recipe collection. Available as [services.tandoor-recipes](options.html#opt-services.tandoor-recipes.enable).
94
95- [HBase cluster](https://hbase.apache.org/), a distributed, scalable, big data store. Available as [services.hadoop.hbase](options.html#opt-services.hadoop.hbase.enable).
96
97- [Please](https://github.com/edneville/please), a Sudo clone written in Rust. Available as [security.please](#opt-security.please.enable)
98
99- [Sachet](https://github.com/messagebird/sachet/), an SMS alerting tool for the Prometheus Alertmanager. Available as [services.prometheus.sachet](#opt-services.prometheus.sachet.enable).
100
101- [infnoise](https://github.com/leetronics/infnoise), a hardware True Random Number Generator dongle.
102 Available as [services.infnoise](options.html#opt-services.infnoise.enable).
103
104- [kthxbye](https://github.com/prymitive/kthxbye), an alert acknowledgement management daemon for Prometheus Alertmanager. Available as [services.kthxbye](options.html#opt-services.kthxbye.enable)
105
106- [kanata](https://github.com/jtroo/kanata), a tool to improve keyboard comfort and usability with advanced customization.
107 Available as [services.kanata](options.html#opt-services.kanata.enable).
108
109- [karma](https://github.com/prymitive/karma), an alert dashboard for Prometheus Alertmanager. Available as [services.karma](options.html#opt-services.karma.enable)
110
111- [languagetool](https://languagetool.org/), a multilingual grammar, style, and spell checker.
112 Available as [services.languagetool](options.html#opt-services.languagetool.enable).
113
114- [OpenRGB](https://gitlab.com/CalcProgrammer1/OpenRGB/-/tree/master), a FOSS tool for controlling RGB lighting. Available as [services.hardware.openrgb.enable](options.html#opt-services-hardware-openrgb-enable).
115
116- [Outline](https://www.getoutline.com/), a wiki and knowledge base similar to Notion. Available as [services.outline](#opt-services.outline.enable).
117
118- [ntfy.sh](https://ntfy.sh), a push notification service. Available as [services.ntfy-sh](#opt-services.ntfy-sh.enable)
119
120- [alps](https://git.sr.ht/~migadu/alps), a simple and extensible webmail. Available as [services.alps](#opt-services.alps.enable).
121
122- [endlessh](https://github.com/skeeto/endlessh), an SSH tarpit. Available as [services.endlessh](#opt-services.endlessh.enable).
123
124- [endlessh-go](https://github.com/shizunge/endlessh-go), an SSH tarpit that exposes Prometheus metrics. Available as [services.endlessh-go](#opt-services.endlessh-go.enable).
125
126- [Garage](https://garagehq.deuxfleurs.fr/), a simple object storage server for geodistributed deployments, alternative to MinIO. Available as [services.garage](#opt-services.garage.enable).
127
128- [netbird](https://netbird.io), a zero configuration VPN.
129 Available as [services.netbird](options.html#opt-services.netbird.enable).
130
131- [persistent-evdev](https://github.com/aiberia/persistent-evdev), a daemon to add virtual proxy devices that mirror a physical input device but persist even if the underlying hardware is hot-plugged. Available as [services.persistent-evdev](#opt-services.persistent-evdev.enable).
132
133- [schleuder](https://schleuder.org/), a mailing list manager with PGP support. Enable using [services.schleuder](#opt-services.schleuder.enable).
134
135- [Dolibarr](https://www.dolibarr.org/), an enterprise resource planning and customer relationship manager. Enable using [services.dolibarr](#opt-services.dolibarr.enable).
136
137- [FreshRSS](https://freshrss.org/), a free, self-hostable RSS feed aggregator. Available as [services.freshrss](#opt-services.freshrss.enable).
138
139- [expressvpn](https://www.expressvpn.com), the CLI client for ExpressVPN. Available as [services.expressvpn](#opt-services.expressvpn.enable).
140
141- [merecat](https://troglobit.com/projects/merecat/), a small and easy HTTP server based on thttpd. Available as [services.merecat](#opt-services.merecat.enable)
142
143- [go-autoconfig](https://github.com/L11R/go-autoconfig), IMAP/SMTP autodiscover server. Available as [services.go-autoconfig](#opt-services.go-autoconfig.enable).
144
145- [tmate-ssh-server](https://github.com/tmate-io/tmate-ssh-server), server side part of [tmate](https://tmate.io/). Available as [services.tmate-ssh-server](#opt-services.tmate-ssh-server.enable).
146
147- [Grafana Tempo](https://www.grafana.com/oss/tempo/), a distributed tracing store. Available as [services.tempo](#opt-services.tempo.enable).
148
149- [AusweisApp2](https://www.ausweisapp.bund.de/), the authentication software for the German ID card. Available as [programs.ausweisapp](#opt-programs.ausweisapp.enable).
150
151- [Patroni](https://github.com/zalando/patroni), a template for PostgreSQL HA with ZooKeeper, etcd or Consul.
152Available as [services.patroni](options.html#opt-services.patroni.enable).
153
154- [Prometheus IPMI exporter](https://github.com/prometheus-community/ipmi_exporter), an IPMI exporter for Prometheus. Available as [services.prometheus.exporters.ipmi](#opt-services.prometheus.exporters.ipmi.enable).
155
156- [WriteFreely](https://writefreely.org), a simple blogging platform with ActivityPub support. Available as [services.writefreely](options.html#opt-services.writefreely.enable).
157
158- [Listmonk](https://listmonk.app), a self-hosted newsletter manager. Enable using [services.listmonk](options.html#opt-services.listmonk.enable).
159
160- [Uptime Kuma](https://uptime.kuma.pet/), a fancy self-hosted monitoring tool. Available as [services.uptime-kuma](#opt-services.uptime-kuma.enable).
161
162- [Mepo](https://mepo.milesalan.com), a fast, simple, hackable OSM map viewer for mobile and desktop Linux. Available as [programs.mepo.enable](#opt-programs.mepo.enable).
163
164<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
165
166## Backward Incompatibilities {#sec-release-22.11-incompatibilities}
167
168- Nixpkgs now requires Nix 2.3 or newer.
169
170- The `isCompatible` predicate checking CPU compatibility is no longer exposed
171 by the platform sets generated using `lib.systems.elaborate`. In most cases
172 you will want to use the new `canExecute` predicate instead which also
173 considers the kernel / syscall interface. It is briefly described in the
174 release's [highlights section](#sec-release-22.11-highlights).
175 `lib.systems.parse.isCompatible` still exists, but has changed semantically:
176 Architectures with differing endianness modes are *no longer considered compatible*.
177
178- `ngrok` has been upgraded from 2.3.40 to 3.0.4. Please see [the upgrade guide](https://ngrok.com/docs/guides/upgrade-v2-v3)
179 and [changelog](https://ngrok.com/docs/ngrok-agent/changelog). Notably, breaking changes are that the config file format has
180 changed and support for single hypen arguments was dropped.
181
182- `i18n.supportedLocales` is now by default only generated with the locales set in `i18n.defaultLocale` and `i18n.extraLocaleSettings`.
183 This got partially copied over from the minimal profile and reduces the final system size by up to 200MB.
184 If you require all locales installed set the option to ``[ "all" ]``.
185
186- Deprecated settings `logrotate.paths` and `logrotate.extraConfig` have
187 been removed. Please convert any uses to
188 [services.logrotate.settings](#opt-services.logrotate.settings) instead.
189
190- The `isPowerPC` predicate, found on `platform` attrsets (`hostPlatform`, `buildPlatform`, `targetPlatform`, etc) has been removed in order to reduce confusion. The predicate was was defined such that it matches only the 32-bit big-endian members of the POWER/PowerPC family, despite having a name which would imply a broader set of systems. If you were using this predicate, you can replace `foo.isPowerPC` with `(with foo; isPower && is32bit && isBigEndian)`.
191
192- The `fetchgit` fetcher now uses [cone mode](https://www.git-scm.com/docs/git-sparse-checkout/2.37.0#_internalscone_mode_handling) by default for sparse checkouts. [Non-cone mode](https://www.git-scm.com/docs/git-sparse-checkout/2.37.0#_internalsnon_cone_problems) can be enabled by passing `nonConeMode = true`, but note that non-cone mode is deprecated and this option may be removed alongside a future Git update without notice.
193
194- The `fetchgit` fetcher supports sparse checkouts via the `sparseCheckout` option. This used to accept a multi-line string with directories/patterns to check out, but now requires a list of strings.
195
196- `openssh` was updated to version 9.1, disabling the generation of DSA keys when using `ssh-keygen -A` as they are insecure. Also, `SetEnv` directives in `ssh_config` and `sshd_config` are now first-match-wins
197
198- `bsp-layout` no longer uses the command `cycle` to switch to other window layouts, as it got replaced by the commands `previous` and `next`.
199
200- The Barco ClickShare driver/client package `pkgs.clickshare-csc1` and the option `programs.clickshare-csc1.enable` have been removed,
201 as it requires `qt4`, which reached its end-of-life 2015 and will no longer be supported by nixpkgs.
202 [According to Barco](https://www.barco.com/de/support/knowledge-base/4380-can-i-use-linux-os-with-clickshare-base-units) many of their base unit models can be used with Google Chrome and the Google Cast extension.
203
204- `services.hbase` has been renamed to `services.hbase-standalone`.
205 For production HBase clusters, use `services.hadoop.hbase` instead.
206
207- The `p4` package now only includes the open-source Perforce Helix Core command-line client and APIs. It no longer installs the unfree Helix Core Server binaries `p4d`, `p4broker`, and `p4p`. To install the Helix Core Server binaries, use the `p4d` package instead.
208
209- The `openssl`-extension for the PHP interpreter used by Nextcloud is built against OpenSSL 1.1 if
210 [](#opt-system.stateVersion) is below `22.11`. This is to make sure that people using [server-side encryption](https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/encryption_configuration.html)
211 don't loose access to their files.
212
213 In any other case it's safe to use OpenSSL 3 for PHP's openssl extension. This can be done by setting
214 [](#opt-services.nextcloud.enableBrokenCiphersForSSE) to `false`.
215
216- The `coq` package and versioned variants starting at `coq_8_14` no
217 longer include CoqIDE, which is now available through
218 `coqPackages.coqide`. It is still possible to get CoqIDE as part of
219 the `coq` package by overriding the `buildIde` argument of the
220 derivation.
221
222- PHP 7.4 is no longer supported due to upstream not supporting this
223 version for the entire lifecycle of the 22.11 release.
224
225- The ipfs package and module were renamed to kubo. The kubo module now uses an RFC42-style `settings` option instead of `extraConfig` and the `gatewayAddress`, `apiAddress` and `swarmAddress` options were renamed. Using the old names will print a warning but still work.
226
227- `pkgs.cosign` does not provide the `cosigned` binary anymore. The `sget` binary has been moved into its own package.
228
229- Emacs now uses the Lucid toolkit by default instead of GTK because of stability and compatibility issues.
230 Users who still wish to remain using GTK can do so by using `emacs-gtk`.
231
232- riak package removed along with `services.riak` module, due to lack of maintainer to update the package.
233
234- ppd files in `pkgs.cups-drv-rastertosag-gdi` are now gzipped. If you refer to such a ppd file with its path (e.g. via [hardware.printers.ensurePrinters](options.html#opt-hardware.printers.ensurePrinters)) you will need to append `.gz` to the path.
235
236- xow package removed along with the `hardware.xow` module, due to the project being deprecated in favor of `xone`, which is available via the `hardware.xone` module.
237
238- dd-agent package removed along with the `services.dd-agent` module, due to the project being deprecated in favor of `datadog-agent`, which is available via the `services.datadog-agent` module.
239
240- `teleport` has been upgraded to major version 10. Please see upstream [upgrade instructions](https://goteleport.com/docs/ver/10.0/management/operations/upgrading/) and [release notes](https://goteleport.com/docs/ver/10.0/changelog/#1000).
241
242- `lib.closePropagation` now needs that all gathered sets have an `outPath` attribute.
243
244- lemmy module option `services.lemmy.settings.database.createLocally`
245 moved to `services.lemmy.database.createLocally`.
246
247- virtlyst package and `services.virtlyst` module removed, due to lack of maintainers.
248
249- The `nix.checkConfig` option now fully disables the config check. The new `nix.checkAllErrors` option behaves like `nix.checkConfig` previously did.
250
251- `generateOptparseApplicativeCompletions` and `generateOptparseApplicativeCompletion` from `haskell.lib.compose`
252 (and `haskell.lib`) have been deprecated in favor of `generateOptparseApplicativeCompletions` (plural!) as
253 provided by the haskell package sets (so `haskellPackages.generateOptparseApplicativeCompletions` etc.).
254 The latter allows for cross-compilation (by automatically disabling generation of completion in the cross case).
255 For it to work properly you need to make sure that the function comes from the same context as the package
256 you are trying to override, i.e. always use the same package set as your package is coming from or – even
257 better – use `self.generateOptparseApplicativeCompletions` if you are overriding a haskell package set.
258 The old functions are retained for backwards compatibility, but yield are warning.
259
260- The `services.graphite.api` and `services.graphite.beacon` NixOS options, and
261 the `python3.pkgs.graphite_api`, `python3.pkgs.graphite_beacon` and
262 `python3.pkgs.influxgraph` packages, have been removed due to lack of upstream
263 maintenance.
264
265- The `trace` binary from `perf-linux` package has been removed, due to being a duplicate of the `perf` binary.
266
267- The `aws` package has been removed due to being abandoned by the upstream. It is recommended to use `awscli` or `awscli2` instead.
268
269- The [CEmu TI-84 Plus CE emulator](https://ce-programming.github.io/CEmu) package has been renamed to `cemu-ti`. The [Cemu Wii U emulator](https://cemu.info) is now packaged as `cemu`.
270
271- `systemd-networkd` v250 deprecated, renamed, and moved some sections and settings which leads to the following breaking module changes:
272
273 * `systemd.network.networks.<name>.dhcpV6PrefixDelegationConfig` is renamed to `systemd.network.networks.<name>.dhcpPrefixDelegationConfig`.
274 * `systemd.network.networks.<name>.dhcpV6Config` no longer accepts the `ForceDHCPv6PDOtherInformation=` setting. Please use the `WithoutRA=` and `UseDelegatedPrefix=` settings in your `systemd.network.networks.<name>.dhcpV6Config` and the `DHCPv6Client=` setting in your `systemd.network.networks.<name>.ipv6AcceptRAConfig` to control when the DHCPv6 client is started and how the delegated prefixes are handled by the DHCPv6 client.
275 * `systemd.network.networks.<name>.networkConfig` no longer accepts the `IPv6Token=` setting. Use the `Token=` setting in your `systemd.network.networks.<name>.ipv6AcceptRAConfig` instead. The `systemd.network.networks.<name>.ipv6Prefixes.*.ipv6PrefixConfig` now also accepts the `Token=` setting.
276
277- `arangodb` versions 3.3, 3.4, and 3.5 have been removed because they are at EOL upstream. The default is now 3.10.0. Support for aarch64-linux has been removed since the target cannot be built reproducibly. By default `arangodb` is now built for the `haswell` architecture. If you wish to build for a different architecture, you may override the `targetArchitecture` argument with a value from [this list supported upstream](https://github.com/arangodb/arangodb/blob/207ec6937e41a46e10aea34953879341f0606841/cmake/OptimizeForArchitecture.cmake#L594). Some architecture specific optimizations are also conditionally enabled. You may alter this behavior by overriding the `asmOptimizations` parameter. You may also add additional architecture support by adding more `-DHAS_XYZ` flags to `cmakeFlags` via `overrideAttrs`.
278
279- The `meta.mainProgram` attribute of packages in `wineWowPackages` now defaults to `"wine64"`.
280
281- The `paperless` module now defaults `PAPERLESS_TIME_ZONE` to your configured system timezone.
282
283- The top-level `termonad-with-packages` alias for `termonad` has been removed.
284
285- Linux 4.9 has been removed because it will reach its end of life within the lifespan of 22.11.
286
287- (Neo)Vim can not be configured with `configure.pathogen` anymore to reduce maintainance burden.
288 Use `configure.packages` instead.
289- Neovim can not be configured with plug anymore (still works for vim).
290
291- The `adguardhome` module no longer uses `host` and `port` options, use `settings.bind_host` and `settings.bind_port` instead.
292
293- The default `kops` version is now 1.25.1 and support for 1.22 and older has been dropped.
294
295- The `zrepl` package has been updated from 0.5.0 to 0.6.0. See the [changelog](https://zrepl.github.io/changelog.html) for details.
296
297- `k3s` no longer supports docker as runtime due to upstream dropping support.
298
299- `cassandra_2_1` and `cassandra_2_2` have been removed. Please update to `cassandra_3_11` or `cassandra_3_0`. See the [changelog](https://github.com/apache/cassandra/blob/cassandra-3.11.14/NEWS.txt) for more information about the upgrade process.
300
301- `mysql57` has been removed. Please update to `mysql80` or `mariadb`. See the [upgrade guide](https://mariadb.com/kb/en/upgrading-from-mysql-to-mariadb/) for more information.
302
303- Consequently, `cqrlog` and `amorok` now use `mariadb` instead of `mysql57` for their embedded databases. Running `mysql_upgrade` may be neccesary.
304- `k3s` supports `clusterInit` option, and it is enabled by default, for servers.
305
306- `percona-server56` has been removed. Please migrate to `mysql` or `mariadb` if possible.
307
308- `obs-studio` hase been updated to version 28. If you have packaged custom plugins, check if they are compatible. `obs-websocket` has been integrated into `obs-studio`.
309
310- `signald` has been bumped to `0.23.0`. For the upgrade, a migration process is necessary. It can be
311 done by running a command like this before starting `signald.service`:
312
313 ```
314 signald -d /var/lib/signald/db \
315 --database sqlite:/var/lib/signald/db \
316 --migrate-data
317 ```
318
319 For further information, please read the upstream changelogs.
320
321- `stylua` no longer accepts `lua52Support` and `luauSupport` overrides, use `features` instead, which defaults to `[ "lua54" "luau" ]`.
322
323- `ocamlPackages.ocaml_extlib` has been renamed to `ocamlPackages.extlib`.
324
325- `pkgs.fetchNextcloudApp` has been rewritten to circumvent impurities in e.g. tarballs from GitHub and to make it easier to
326 apply patches. This means that your hashes are out-of-date and the (previously required) attributes `name` and `version`
327 are no longer accepted.
328
329- The Syncthing service now only allows absolute paths---starting with `/` or
330 `~/`---for `services.syncthing.folders.<name>.path`.
331 In a future release other paths will be allowed again and interpreted
332 relative to `services.syncthing.dataDir`.
333
334- `services.github-runner` and `services.github-runners.<name>` gained the option `serviceOverrides` which allows overriding the systemd `serviceConfig`. If you have been overriding the systemd service configuration (i.e., by defining `systemd.services.github-runner.serviceConfig`), you have to use the `serviceOverrides` option now. Example:
335
336 ```
337 services.github-runner.serviceOverrides.SupplementaryGroups = [
338 "docker"
339 ];
340 ```
341
342<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
343
344## Other Notable Changes {#sec-release-22.11-notable-changes}
345
346- `firefox`, `thunderbird` and `librewolf` come with enabled Wayland support by default. The `firefox-wayland`, `firefox-esr-wayland`, `thunderbird-wayland` and `librewolf-wayland` attributes are obsolete and have been aliased to their generic attribute.
347
348- The `xplr` package has been updated from 0.18.0 to 0.19.0, which brings some breaking changes. See the [upstream release notes](https://github.com/sayanarijit/xplr/releases/tag/v0.19.0) for more details.
349
350- Configuring multiple GitHub runners is now possible through `services.github-runners.<name>`. The option `services.github-runner` remains.
351
352- `github-runner` gained support for ephemeral runners and registrations using a personal access token (PAT) instead of a registration token. See `services.github-runner.ephemeral` and `services.github-runner.tokenFile` for details.
353
354- A new module was added for the Saleae Logic device family, providing the options `hardware.saleae-logic.enable` and `hardware.saleae-logic.package`.
355
356- ZFS module will not allow hibernation by default, this is a safety measure to prevent data loss cases like the ones described at [OpenZFS/260](https://github.com/openzfs/zfs/issues/260) and [OpenZFS/12842](https://github.com/openzfs/zfs/issues/12842). Use the `boot.zfs.allowHibernation` option to configure this behaviour.
357
358- `mastodon` now automatically removes remote media attachments older than 30 days. This is configurable through `services.mastodon.mediaAutoRemove`.
359
360- The Redis module now disables RDB persistence when `services.redis.servers.<name>.save = []` instead of using the Redis default.
361
362- Neo4j was updated from version 3 to version 4. See this [migration guide](https://neo4j.com/docs/upgrade-migration-guide/current/) on how to migrate your Neo4j instance.
363
364- The `networking.wireguard` module now can set the mtu on interfaces and tag its packets with an fwmark.
365
366- The option `overrideStrategy` was added to the different systemd unit options (`systemd.services.<name>`, `systemd.sockets.<name>`, …) to allow enforcing the creation of a dropin file, rather than the main unit file, by setting it to `asDropin`.
367 This is useful in cases where the existence of the main unit file is not known to Nix at evaluation time, for example when the main unit file is provided by adding a package to `systemd.packages`.
368 See the fix proposed in [NixOS's systemd abstraction doesn't work with systemd template units](https://github.com/NixOS/nixpkgs/issues/135557#issuecomment-1295392470) for an example.
369
370- The `polymc` package has been removed due to a rogue maintainer. It has been
371 replaced by `prismlauncher`, a fork by the rest of the maintainers. For more
372 details, see [the pull request that made this
373 change](https://github.com/NixOS/nixpkgs/pull/196624) and [this issue
374 detailing the vulnerability](https://github.com/NixOS/nixpkgs/issues/196460).
375 Users with existing installations should rename `~/.local/share/polymc` to
376 `~/.local/share/PrismLauncher`. The main config file's path has also moved
377 from `~/.local/share/polymc/polymc.cfg` to
378 `~/.local/share/PrismLauncher/prismlauncher.cfg`.
379
380- The `bloat` package has been updated from unstable-2022-03-31 to unstable-2022-10-25, which brings a breaking change. See [this upstream commit message](https://git.freesoftwareextremist.com/bloat/commit/?id=887ed241d64ba5db3fd3d87194fb5595e5ad7d73) for details.
381
382- The `services.matrix-synapse` systemd unit has been hardened.
383
384- The module `services.grafana` was refactored to be compliant with [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md). To be precise, this means that the following things have changed:
385 - The newly introduced option [](#opt-services.grafana.settings) is an attribute-set that
386 will be converted into Grafana's INI format. This means that the configuration from
387 [Grafana's configuration reference](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/)
388 can be directly written as attribute-set in Nix within this option.
389 - The option `services.grafana.extraOptions` has been removed. This option was an association
390 of environment variables for Grafana. If you had an expression like
391
392 ```nix
393 {
394 services.grafana.extraOptions.SECURITY_ADMIN_USER = "foobar";
395 }
396 ```
397
398 your Grafana instance was running with `GF_SECURITY_ADMIN_USER=foobar` in its environment.
399
400 For the migration, it is recommended to turn it into the INI format, i.e.
401 to declare
402
403 ```nix
404 {
405 services.grafana.settings.security.admin_user = "foobar";
406 }
407 ```
408
409 instead.
410
411 The keys in `services.grafana.extraOptions` have the format `<INI section name>_<Key Name>`.
412 Further details are outlined in the [configuration reference](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#override-configuration-with-environment-variables).
413
414 Alternatively you can also set all your values from `extraOptions` to
415 `systemd.services.grafana.environment`, make sure you don't forget to add
416 the `GF_` prefix though!
417 - Previously, the options [](#opt-services.grafana.provision.datasources) and
418 [](#opt-services.grafana.provision.dashboards) expected lists of datasources
419 or dashboards for the [declarative provisioning](https://grafana.com/docs/grafana/latest/administration/provisioning/).
420
421 To declare lists of
422 - **datasources**, please rename your declarations to [](#opt-services.grafana.provision.datasources.settings.datasources).
423 - **dashboards**, please rename your declarations to [](#opt-services.grafana.provision.dashboards.settings.providers).
424
425 This change was made to support more features for that:
426
427 - It's possible to declare the `apiVersion` of your dashboards and datasources
428 by [](#opt-services.grafana.provision.datasources.settings.apiVersion) (or
429 [](#opt-services.grafana.provision.dashboards.settings.apiVersion)).
430
431 - Instead of declaring datasources and dashboards in pure Nix, it's also possible
432 to specify configuration files (or directories) with YAML instead using
433 [](#opt-services.grafana.provision.datasources.path) (or
434 [](#opt-services.grafana.provision.dashboards.path). This is useful when having
435 provisioning files from non-NixOS Grafana instances that you also want to
436 deploy to NixOS.
437
438 __Note:__ secrets from these files will be leaked into the store unless you use a
439 [**file**-provider or env-var](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider) for secrets!
440
441 - [](#opt-services.grafana.provision.notifiers) is not affected by this change because
442 this feature is deprecated by Grafana and will probably removed in Grafana 10.
443 It's recommended to use `services.grafana.provision.alerting.contactPoints` instead.
444
445- The `services.grafana.provision.alerting` option was added. It includes suboptions for every alerting-related objects (with the exception of `notifiers`), which means it's now possible to configure modern Grafana alerting declaratively.
446
447- Matrix Synapse now requires entries in the `state_group_edges` table to be unique, in order to prevent accidentally introducing duplicate information (for example, because a database backup was restored multiple times). If your Synapse database already has duplicate rows in this table, this could fail with an error and require manual remediation.
448
449- The `diamond` package has been update from 0.8.36 to 2.0.15. See the [upstream release notes](https://github.com/bbuchfink/diamond/releases) for more details.
450
451- The `guake` package has been updated from 3.6.3 to 3.9.0, see the [changelog](https://github.com/Guake/guake/releases) for more details.
452
453- `dockerTools.buildImage` deprecates the misunderstood `contents` parameter, in favor of `copyToRoot`.
454 Use `copyToRoot = buildEnv { ... };` or similar if you intend to add packages to `/bin`.
455
456- memtest86+ was updated from 5.00-coreboot-002 to 6.00-beta2. It is now the upstream version from https://www.memtest.org/, as coreboot's fork is no longer available.
457
458- Option descriptions, examples, and defaults writting in DocBook are now deprecated. Using CommonMark is preferred and will become the default in a future release.
459
460- The `documentation.nixos.options.allowDocBook` option was added to ease the transition to CommonMark option documentation. Setting this option to `false` causes an error for every option included in the manual that uses DocBook documentation; it defaults to `true` to preserve the previous behavior and will be removed once the transition to CommonMark is complete.
461
462- The redis module now persists each instance's configuration file in the state directory, in order to support some more advanced use cases like sentinel.
463
464- The udisks2 service, available at `services.udisks2.enable`, is now disabled by default. It will automatically be enabled through services and desktop environments as needed.
465 This also means that polkit will now actually be disabled by default. The default for `security.polkit.enable` was already flipped in the previous release, but udisks2 being enabled by default re-enabled it.
466
467- Nextcloud has been updated to version **25**. Additionally the following things have changed
468 for Nextcloud in NixOS:
469 - For Nextcloud **>=24**, the default PHP version is 8.1.
470 - Nextcloud **23** has been removed since it will reach its [end of life in December 2022](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule/d76576a12a626d53305d480a6065b57cab705d3d).
471 - For `system.stateVersion` being **>=22.11**, Nextcloud 25 will be installed by default. For older versions,
472 Nextcloud 24 will be installed.
473 - Please ensure that you only upgrade on major release at a time! Nextcloud doesn't support
474 upgrades across multiple versions, i.e. an upgrade from **23** to **25** is only possible
475 when upgrading to **24** first.
476
477- Add udev rules for the Teensy family of microcontrollers.
478
479- The Qt QML disk cache is now disabled by default. This fixes a
480 long-standing issue where updating Qt/KDE apps would sometimes cause
481 them to crash or behave strangely without explanation. Those concerned
482 about the small (~10%) performance hit to application startup can
483 re-enable the cache (and expose themselves to gremlins) by setting the
484 envrionment variable `QML_FORCE_DISK_CACHE` to `1` using e.g. the
485 `environment.sessionVariables` NixOS option.
486
487- systemd-oomd is enabled by default. Depending on which systemd units have
488 `ManagedOOMSwap=kill` or `ManagedOOMMemoryPressure=kill`, systemd-oomd will
489 SIGKILL all the processes under the appropriate descendant cgroups when the
490 configured limits are exceeded. NixOS does currently not configure cgroups
491 with oomd by default, this can be enabled using
492 [systemd.oomd.enableRootSlice](options.html#opt-systemd.oomd.enableRootSlice),
493 [systemd.oomd.enableSystemSlice](options.html#opt-systemd.oomd.enableSystemSlice),
494 and [systemd.oomd.enableUserServices](options.html#opt-systemd.oomd.enableUserServices).
495
496- The `tt-rss` service performs two database migrations when you first use its web UI after upgrade. Consider backing up its database before updating.
497
498- The `pass-secret-service` package now includes systemd units from upstream, so adding it to the NixOS `services.dbus.packages` option will make it start automatically as a systemd user service when an application tries to talk to the libsecret D-Bus API.
499
500- There is a new module for AMD SEV CPU functionality, which grants access to the hardware.
501
502- The Wordpress module got support for installing language packs through `services.wordpress.sites.<site>.languages`.
503
504- The default package for `services.mullvad-vpn.package` was changed to `pkgs.mullvad`, allowing cross-platform usage of Mullvad. `pkgs.mullvad` only contains the Mullvad CLI tool, so users who rely on the Mullvad GUI will want to change it back to `pkgs.mullvad-vpn`, or add `pkgs.mullvad-vpn` to their environment.
505
506- PowerDNS has been updated from `4.6.x` to `4.7.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-4-7-0-or-master) provided by upstream before upgrading. Worth specifically noting is that the new Catalog Zones feature comes with a mandatory schema change for the gsql database backends, which has to be manually applied.
507
508- There is a new module for the `thunar` program (the Xfce file manager), which depends on the `xfconf` dbus service, and also has a dbus service and a systemd unit. The option `services.xserver.desktopManager.xfce.thunarPlugins` has been renamed to `programs.thunar.plugins`, and in a future release it may be removed.
509
510- There is a new module for the `xfconf` program (the Xfce configuration storage system), which has a dbus service.
511
512- The Mastodon package got upgraded from the major version 3 to 4. See the [v4.0.0 release notes](https://github.com/mastodon/mastodon/releases/tag/v4.0.0) for a list of changes. On standard setups, no manual migration steps are required. Nevertheless, a database backup is recommended.
513
514- The `nomad` package now defaults to 1.3, which no longer has a downgrade path to releases 1.2 or older.
515
516- The `nodePackages` package set now defaults to the LTS release in the `nodejs` package again, instead of being pinned to `nodejs-14_x`. Several updates to node2nix have been made for compatibility with newer Node.js and npm versions and a new `postRebuild` hook has been added for packages to perform extra build steps before the npm install step prunes dev dependencies.
517
518- `boot.kernel.sysctl` is defined as a freeformType and adds a custom merge option for "net.core.rmem_max" (taking the highest value defined to avoid conflicts between 2 services trying to set that value).
519
520- The `mame` package does not ship with its tools anymore in the default output. They were moved to a separate `tools` output instead. For convenience, `mame-tools` package was added for those who want to use it.
521
522- A NixOS module for Firefox has been added which allows preferences and [policies](https://github.com/mozilla/policy-templates/blob/master/README.md) to be set. This also allows extensions to be installed via the `ExtensionSettings` policy. The new options are under `programs.firefox`.
523
524- The option `services.picom.experimentalBackends` was removed since it is now the default and the option will cause `picom` to quit instead.
525
526<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->