pyrox.dev
1# Release 22.05 (“Quokka”, 2022.05/30) {#sec-release-22.05}
2
3- Support is planned until the end of December 2022, handing over to 22.11.
4
5## Highlights {#sec-release-22.05-highlights}
6
7In addition to numerous new and upgraded packages, this release has the following highlights:
8
9- Nix has been updated from 2.3 to 2.8. This mainly brings experimental support
10 for Flakes, but also marks the `nix` command as experimental which now has to
11 be enabled via the configuration explicitly. For more information and
12 instructions for upgrades, see the
13 release notes for [nix-2.4](https://nixos.org/manual/nix/stable/release-notes/rl-2.4.html),
14 [nix-2.5](https://nixos.org/manual/nix/stable/release-notes/rl-2.5.html),
15 [nix-2.6](https://nixos.org/manual/nix/stable/release-notes/rl-2.6.html),
16 [nix-2.7](https://nixos.org/manual/nix/stable/release-notes/rl-2.7.html) and
17 [nix-2.8](https://nixos.org/manual/nix/stable/release-notes/rl-2.8.html)
18
19- The `firefox` browser on `x86_64-linux` now makes use of profile-guided
20 optimisation, resulting in a much more responsive browsing experience.
21
22- GNOME has been upgraded to 42. Please take a look at their [Release
23 Notes](https://release.gnome.org/42/) for details. In particular, it replaces
24 gedit with GNOME Text Editor, GNOME Terminal with GNOME Console (formerly
25 King's Cross) and GNOME Screenshot by a tool integrated into the Shell.
26
27- PHP 8.1 is now available.
28
29- systemd services can now set [systemd.services.\<name\>.reloadTriggers](#opt-systemd.services) instead of `reloadIfChanged` for a more granular distinction between reloads and restarts.
30
31- Systemd has been upgraded to the version 250.
32
33- Pulseaudio has been updated to version 15.0 and now optionally
34 [supports additional Bluetooth audio codecs](https://www.freedesktop.org/wiki/Software/PulseAudio/Notes/15.0/#supportforldacandaptxbluetoothcodecsplussbcxqsbcwithhigher-qualityparameters)
35 such as aptX or LDAC, with codec switching available in `pavucontrol`. This
36 feature is disabled by default, but can be enabled with the option
37 `hardware.pulseaudio.package = pkgs.pulseaudioFull;`. Existing third-party
38 modules that offered similar functions, such as `pulseaudio-modules-bt` or
39 `pulseaudio-hsphfpd`, are obsolete and have been removed.
40
41- PostgreSQL now defaults to major version 14.
42
43- Module authors can use `mkRenamedOptionModuleWith` to automate the deprecation cycle without annoying out-of-tree module authors and their users.
44
45- The default GHC version has been updated from 8.10.7 to 9.0.2. `pkgs.haskellPackages` and `pkgs.ghc` will now use this version by default.
46
47- The GNOME and Plasma installation CDs now use `pkgs.calamares` and `pkgs.calamares-nixos-extensions` to allow users to easily install and set up NixOS with a GUI.
48
49- `security.acme.defaults` has been added to simplify the configuration of
50 settings for many certificates at once. This also opens up the option to use
51 DNS-01 validation when using `enableACME` web server virtual hosts (e.g.
52 `services.nginx.virtualHosts.*.enableACME`).
53
54## New Services {#sec-release-22.05-new-services}
55
56- [1password](https://1password.com/), command-lines and graphic interface for 1Password. Available as [programs._1password](#opt-programs._1password.enable) and [programs._1password-gui](#opt-programs._1password.enable).
57
58- [aesmd](https://github.com/intel/linux-sgx#install-the-intelr-sgx-psw), the Intel SGX Architectural Enclave Service Manager. Available as [services.aesmd](#opt-services.aesmd.enable).
59
60- [agate](https://github.com/mbrubeck/agate), a very simple server for the Gemini hypertext protocol. Available as [services.agate](#opt-services.agate.enable).
61
62- [apfs](https://github.com/linux-apfs/linux-apfs-rw), a kernel module for mounting the Apple File System (APFS).
63
64- [argonone](https://gitlab.com/DarkElvenAngel/argononed), a replacement daemon for the Raspberry Pi Argon One power button and cooler. Available at [services.hardware.argonone](options.html#opt-services.hardware.argonone.enable).
65
66- [ArchiSteamFarm](https://github.com/JustArchiNET/ArchiSteamFarm), a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as [services.archisteamfarm](#opt-services.archisteamfarm.enable).
67
68- [BaGet](https://loic-sharma.github.io/BaGet/), a lightweight NuGet and symbol server. Available at services.baget.
69
70- [bird-lg](https://github.com/xddxdd/bird-lg-go), a BGP looking glass for Bird Routing. Available as [services.bird-lg](#opt-services.bird-lg.package).
71
72- [blocky](https://0xerr0r.github.io/blocky/), fast and lightweight DNS proxy as ad-blocker for local network with many features. Available as [services.blocky](#opt-services.blocky.enable).
73
74- [cloudflare-dyndns](https://github.com/kissgyorgy/cloudflare-dyndns), CloudFlare Dynamic DNS client. Available as [services.cloudflare-dyndns](#opt-services.cloudflare-dyndns.enable).
75
76- [Corosync](https://corosync.github.io/corosync/) and [Pacemaker](https://clusterlabs.org/pacemaker/), A open-source high availability resource manager. Available as [services.corosync](#opt-services.corosync.enable) and [services.pacemaker](#opt-services.pacemaker.enable).
77
78- [create_ap](https://github.com/lakinduakash/linux-wifi-hotspot), a module for creating wifi hotspots using the program linux-wifi-hotspot. Available as [services.create_ap](#opt-services.create_ap.enable).
79
80- [Envoy](https://www.envoyproxy.io/), a high-performance reverse proxy. Available as [services.envoy](#opt-services.envoy.enable).
81
82- [ergochat](https://ergo.chat), a modern IRC with IRCv3 features. Available as [services.ergochat](#opt-services.ergochat.enable).
83
84- [ethercalc](https://github.com/audreyt/ethercalc), an online collaborative spreadsheet. Available as [services.ethercalc](#opt-services.ethercalc.enable).
85
86- [filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html), a lightweight shipper for forwarding and centralizing log data. Available as [services.filebeat](#opt-services.filebeat.enable).
87
88- [FRRouting](https://frrouting.org/), a popular suite of Internet routing protocol daemons (BGP, BFD, OSPF, IS-IS, VRRP and others). Available as [services.frr](#opt-services.frr.babel.enable).
89
90- [Grafana Mimir](https://grafana.com/oss/mimir/), an open source, horizontally scalable, highly available, multi-tenant, long-term storage for Prometheus. Available as [services.mimir](#opt-services.mimir.enable).
91
92- [Haste](https://hastebin.com/about.md), a pastebin written in node.js. Available as [services.haste](#opt-services.haste-server.enable).
93
94- [headscale](https://github.com/juanfont/headscale), an Open Source implementation of the [Tailscale](https://tailscale.io) Control Server. Available as [services.headscale](#opt-services.headscale.enable).
95
96- [heisenbridge](https://github.com/hifi/heisenbridge), a bouncer-style Matrix IRC bridge. Available as [services.heisenbridge](#opt-services.heisenbridge.enable).
97
98- [https-dns-proxy](https://github.com/aarond10/https_dns_proxy), DNS to DNS over HTTPS (DoH) proxy. Available as [services.https-dns-proxy](#opt-services.https-dns-proxy.enable).
99
100- [input-remapper](https://github.com/sezanzeb/input-remapper), an easy to use tool to change the mapping of your input device buttons. Available at [services.input-remapper](#opt-services.input-remapper.enable).
101
102- [InvoicePlane](https://invoiceplane.com), web application for managing and creating invoices. Available at [services.invoiceplane](#opt-services.invoiceplane.sites._name_.enable).
103
104- [k3b](https://userbase.kde.org/K3b), the KDE disk burning application. Available as [programs.k3b](#opt-programs.k3b.enable).
105
106- [K40-Whisperer](https://www.scorchworks.com/K40whisperer/k40whisperer.html), a program to control cheap Chinese laser cutters. Available as [programs.k40-whisperer.enable](#opt-programs.k40-whisperer.enable). Users must add themselves to the `k40` group to be able to access the device.
107
108- [kanidm](https://kanidm.github.io/kanidm/stable/), an identity management server written in Rust. Available as [services.kanidm](#opt-services.kanidm.enableServer)
109
110- [Maddy](https://maddy.email/), a free an open source mail server. Available as [services.maddy](#opt-services.maddy.enable).
111
112- [matrix-conduit](https://conduit.rs/), a simple, fast and reliable chat server powered by matrix. Available as [services.matrix-conduit](option.html#opt-services.matrix-conduit.enable).
113
114- [Moosefs](https://moosefs.com), fault tolerant petabyte distributed file system. Available as [moosefs](#opt-services.moosefs.master.enable).
115
116- [mozillavpn](https://github.com/mozilla-mobile/mozilla-vpn-client), the client for the [Mozilla VPN](https://vpn.mozilla.org/) service. Available as [services.mozillavpn](#opt-services.mozillavpn.enable).
117
118- [mtr-exporter](https://github.com/mgumz/mtr-exporter), a Prometheus exporter for mtr metrics. Available as [services.mtr-exporter](#opt-services.mtr-exporter.enable).
119
120- [nbd](https://nbd.sourceforge.io/), a Network Block Device server. Available as [services.nbd](#opt-services.nbd.server.enable).
121
122- [netbox](https://github.com/netbox-community/netbox), infrastructure resource modeling (IRM) tool. Available as [services.netbox](#opt-services.netbox.enable).
123
124- [nethoscope](https://github.com/vvilhonen/nethoscope), listen to your network traffic. Available as [programs.nethoscope](#opt-programs.nethoscope.enable).
125
126- [nifi](https://nifi.apache.org), an easy to use, powerful, and reliable system to process and distribute data. Available as [services.nifi](#opt-services.nifi.enable).
127
128- [nix-ld](https://github.com/Mic92/nix-ld), Run unpatched dynamic binaries on NixOS. Available as [programs.nix-ld](#opt-programs.nix-ld.enable).
129
130- [NNCP](http://www.nncpgo.org), NNCP (Node to Node copy) utilities and configuration, Available as [programs.nncp](#opt-programs.nncp.enable).
131
132- [pgadmin4](https://github.com/postgres/pgadmin4), an admin interface for the PostgreSQL database. Available at [services.pgadmin](#opt-services.pgadmin.enable).
133
134- [PowerDNS-Admin](https://github.com/ngoduykhanh/PowerDNS-Admin), a web interface for the PowerDNS server. Available at [services.powerdns-admin](#opt-services.powerdns-admin.enable).
135
136- [prometheus-pve-exporter](https://github.com/prometheus-pve/prometheus-pve-exporter), a tool that exposes information from the Proxmox VE API for use by Prometheus. Available as [services.prometheus.exporters.pve](#opt-services.prometheus.exporters.pve.enable).
137
138- [prosody-filer](https://github.com/ThomasLeister/prosody-filer), a server for handling XMPP HTTP Upload requests. Available at [services.prosody-filer](#opt-services.prosody-filer.enable).
139
140- [Public Inbox](https://public-inbox.org), an "archives first" approach to mailing lists. Available as [services.public-inbox](#opt-services.public-inbox.enable).
141
142- [r53-ddns](https://github.com/fleaz/r53-ddns), a small tool to run your own DDNS service via AWS Route53. Available as [services.r53-ddns](#opt-services.r53-ddns.enable).
143
144- [rmfakecloud](https://ddvk.github.io/rmfakecloud/), a clone of the cloud sync the remarkable tablet. Available as [services.rmfakecloud](#opt-services.rmfakecloud.enable).
145
146- [rootless Docker](https://docs.docker.com/engine/security/rootless/), a `systemd --user` Docker service which runs without root permissions. Available as [virtualisation.docker.rootless.enable](#opt-virtualisation.docker.rootless.enable).
147
148- [rstudio-server](https://www.rstudio.com/products/rstudio/#rstudio-server), a browser-based version of the RStudio IDE for the R programming language. Available as [services.rstudio-server](#opt-services.rstudio-server.enable).
149
150- [mediamtx](https://github.com/aler9/mediamtx), ready-to-use RTSP / RTMP / HLS server and proxy that allows to read, publish and proxy video and audio streams. Available as [services.mediamtx](#opt-services.mediamtx.enable).
151
152- [Snipe-IT](https://snipeitapp.com), a free open source IT asset/license management system. Available as [services.snipe-it](#opt-services.snipe-it.enable).
153
154- [snowflake-proxy](https://snowflake.torproject.org/), a system to defeat internet censorship. Available as [services.snowflake-proxy](#opt-services.snowflake-proxy.enable).
155
156- [sslmate-agent](https://sslmate.com/), a daemon for managing SSL/TLS certificates on a server. Available as [services.sslmate-agent](services.sslmate-agent.enable).
157
158- [starship](https://starship.rs), a minimal, blazing-fast, and infinitely customizable prompt for any shell. Available at [programs.startship](#opt-programs.starship.enable).
159
160- [systembus-notify](https://github.com/rfjakob/systembus-notify), allow system level notifications to reach the users. Available as [services.systembus-notify](opt-services.systembus-notify.enable). Please keep in mind that this service should only be enabled on machines with fully trusted users, as any local user is able to DoS user sessions by spamming notifications.
161
162- [teleport](https://goteleport.com), allows engineers and security professionals to unify access for SSH servers, Kubernetes clusters, web applications, and databases across all environments. Available at [services.teleport](#opt-services.teleport.enable).
163
164- [tetrd](https://tetrd.app), share your internet connection from your device to your PC and vice versa through a USB cable. Available at [services.tetrd](#opt-services.tetrd.enable).
165
166- [uptermd](https://upterm.dev), an open-source solution for sharing terminal sessions instantly over the public internet via secure tunnels. Available at [services.uptermd](#opt-services.uptermd.enable).
167
168- [usbrelayd](https://github.com/darrylb123/usbrelay), an USB Relay MQTT daemon. Available as [services.usbrelayd](#opt-services.usbrelayd.enable).
169
170- [webdav-server-rs](https://github.com/miquels/webdav-server-rs), Webdav server in rust. Available as [services.webdav-server-rs](#opt-services.webdav-server-rs.enable).
171
172- [wg-netmanager](https://github.com/gin66/wg_netmanager), the Wireguard network manager. Available as [services.wg-netmanager](#opt-services.wg-netmanager.enable).
173
174- [Zammad](https://zammad.org/), a web-based, open source user support/ticketing solution. Available as [services.zammad](#opt-services.zammad.enable).
175
176<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
177
178## Backward Incompatibilities {#sec-release-22.05-incompatibilities}
179
180- `pkgs.ghc` now refers to `pkgs.targetPackages.haskellPackages.ghc`.
181 This _only_ makes a difference if you are cross-compiling and will
182 ensure that `pkgs.ghc` always runs on the host platform and compiles
183 for the target platform (similar to `pkgs.gcc` for example).
184 `haskellPackages.ghc` still behaves as before, running on the build
185 platform and compiling for the host platform (similar to `stdenv.cc`).
186 This means you don't have to adjust your derivations if you use
187 `haskellPackages.callPackage`, but when using `pkgs.callPackage` and
188 taking `ghc` as an input, you should now use `buildPackages.ghc`
189 instead to ensure cross compilation keeps working (or switch to
190 `haskellPackages.callPackage`).
191
192- `pkgs.ghc.withPackages` as well as `haskellPackages.ghcWithPackages` etc.
193 now needs be overridden directly, as opposed to overriding the result of
194 calling it. Additionally, the `withLLVM` parameter has been renamed to
195 `useLLVM`. So instead of `(ghc.withPackages (p: [])).override { withLLVM = true; }`,
196 one needs to use `(ghc.withPackages.override { useLLVM = true; }) (p: [])`.
197
198- The update of the haskell package set brings with it a new version of the `xmonad`
199 module, which will break your configuration if you use `launch` as entrypoint. The
200 example code the corresponding nixos module was adjusted, you may want to have a look at it.
201
202- The `home-assistant` module now requires users that don't want their
203 configuration to be managed declaratively to set
204 `services.home-assistant.config = null;`. This is required
205 due to the way default settings are handled with the new settings style.
206
207 Additionally the default list of `extraComponents` now includes the minimal
208 dependencies to successfully complete the [onboarding](https://www.home-assistant.io/getting-started/onboarding/)
209 procedure.
210
211- `pkgs.emacsPackages.orgPackages` is removed because org elpa is deprecated.
212 The packages in the top level of `pkgs.emacsPackages`, such as org and
213 org-contrib, refer to the ones in `pkgs.emacsPackages.elpaPackages` and
214 `pkgs.emacsPackages.nongnuPackages` where the new versions will release.
215
216- The configuration and state directories used by `nixos-containers` have been
217 moved from `/etc/containers` and `/var/lib/containers` to
218 `/etc/nixos-containers` and `/var/lib/nixos-containers`.
219
220 If you are changing `system.stateVersion` to `"22.05"` manually on an existing
221 system you are responsible for migrating these directories yourself.
222
223 This is to improve compatibility with `libcontainer` based software such as Podman and Skopeo
224 which assumes they have ownership over `/etc/containers`.
225
226- `lib.systems.supported` has been removed, as it was overengineered for determining the systems to support in the nixpkgs flake. The list of systems exposed by the nixpkgs flake can now be accessed as `lib.systems.flakeExposed`.
227
228- For new installations `virtualisation.oci-containers.backend` is now set to `podman` by default.
229 If you still want to use Docker on systems where `system.stateVersion` is set to to `"22.05"` set `virtualisation.oci-containers.backend = "docker";`.Old systems with older `stateVersion`s stay with "docker".
230
231- `security.klogd` was removed. Logging of kernel messages is handled
232 by systemd since Linux 3.5.
233
234- `pkgs.ssmtp` has been dropped due to the program being unmaintained.
235 `pkgs.msmtp` can be used instead as a substitute `sendmail` implementation.
236 The corresponding options `services.ssmtp.*` have been removed as well.
237 `programs.msmtp.*` can be used instead for an equivalent setup. For example:
238
239 ```nix
240 {
241 # Original ssmtp configuration:
242 services.ssmtp = {
243 enable = true;
244 useTLS = true;
245 useSTARTTLS = true;
246 hostName = "smtp.example:587";
247 authUser = "someone";
248 authPassFile = "/secrets/password.txt";
249 };
250
251 # Equivalent msmtp configuration:
252 programs.msmtp = {
253 enable = true;
254 accounts.default = {
255 tls = true;
256 tls_starttls = true;
257 auth = true;
258 host = "smtp.example";
259 port = 587;
260 user = "someone";
261 passwordeval = "cat /secrets/password.txt";
262 };
263 };
264 }
265 ```
266
267- `services.kubernetes.addons.dashboard` was removed due to it being an outdated version.
268
269- `services.kubernetes.scheduler.{port,address}` now set `--secure-port` and `--bind-address` instead of `--port` and `--address`, since the former have been deprecated and are no longer functional in kubernetes>=1.23. Ensure that you are not relying on the insecure behaviour before upgrading.
270
271- In the PowerDNS Recursor module (`services.pdns-recursor`), default values of several IP address-related NixOS options have been updated to match the default upstream behavior.
272 In particular, Recursor by default will:
273 - listen on (and allows connections from) both IPv4 and IPv6 addresses
274 (`services.pdns-recursor.dns.address`, `services.pdns-recursor.dns.allowFrom`);
275 - allow only local connections to the REST API server (`services.pdns-recursor.api.allowFrom`).
276
277- In the ncdns module, the default value of `services.ncdns.address` has been changed to the IPv6 loopback address (`::1`).
278
279- `openldap` (and therefore the slapd LDAP server) were updated to version 2.6.2. The project introduced backwards-incompatible changes, namely the removal of the bdb, hdb, ndb, and shell backends in slapd. Therefore before updating, dump your database `slapcat -n 1` in LDIF format, and reimport it after updating your `services.openldap.settings`, which represents your `cn=config`.
280
281 Additionally with 2.5 the argon2 module was included in the standard distribution and renamed from `pw-argon2` to `argon2`. Remember to update your `olcModuleLoad` entry in `cn=config`.
282
283- `openssh` has been update to 8.9p1, changing the FIDO security key middleware interface.
284
285- `git` no longer hardcodes the path to openssh' ssh binary to reduce the amount of rebuilds. If you are using git with ssh remotes and do not have a ssh binary in your environment consider adding `openssh` to it or switching to `gitFull`.
286
287- `services.k3s.enable` no longer implies `systemd.enableUnifiedCgroupHierarchy = false`, and will default to the 'systemd' cgroup driver when using `services.k3s.docker = true`.
288 This change may require a reboot to take effect, and k3s may not be able to run if the boot cgroup hierarchy does not match its configuration.
289 The previous behavior may be retained by explicitly setting `systemd.enableUnifiedCgroupHierarchy = false` in your configuration.
290
291- `fonts.fonts` no longer includes ancient bitmap fonts when both `config.services.xserver.enable` and `config.nixpkgs.config.allowUnfree` are enabled.
292 If you still want these fonts, use:
293
294 ```nix
295 {
296 fonts.fonts = [
297 pkgs.xorg.fontbhlucidatypewriter100dpi
298 pkgs.xorg.fontbhlucidatypewriter75dpi
299 pkgs.xorg.fontbh100dpi
300 ];
301 }
302 ```
303
304- `services.prometheus.alertManagerTimeout` has been removed as it has been deprecated upstream and has no effect.
305
306- The DHCP server (`services.dhcpd4`, `services.dhcpd6`) has been hardened.
307 The service is now using the systemd's `DynamicUser` mechanism to run as an unprivileged dynamically-allocated user with limited capabilities.
308 The dhcpd state files are now always stored in `/var/lib/dhcpd{4,6}` and the `services.dhcpd4.stateDir` and `service.dhcpd6.stateDir` options have been removed.
309 If you were depending on root privileges or set{uid,gid,cap} binaries in dhcpd shell hooks, you may give dhcpd more capabilities with e.g. `systemd.services.dhcpd6.serviceConfig.AmbientCapabilities`.
310
311- The `mailpile` email webclient (`services.mailpile`) has been removed due to its reliance on python2.
312
313- `services.ipfs.extraFlags` is now escaped with `utils.escapeSystemdExecArgs`. If you rely on systemd interpolating `extraFlags` in the service `ExecStart`, this will no longer work.
314
315- `hbase` version 0.98.24 has been removed. The package now defaults to version 2.4.11. Versions 1.7.1 and 3.0.0-alpha-2 are also available.
316
317- `services.paperless-ng` was renamed to `services.paperless`. Accordingly, the `paperless-ng-manage` script (located in `dataDir`) was renamed to `paperless-manage`. `services.paperless` now uses `paperless-ngx`.
318
319- The `matrix-synapse` service (`services.matrix-synapse`) has been converted to use the `settings` option defined in RFC42.
320 This means that options that are part of your `homeserver.yaml` configuration, and that were specified at the top-level of the
321 module (`services.matrix-synapse`) now need to be moved into `services.matrix-synapse.settings`. And while not all options you
322 may use are defined in there, they are still supported, because you can set arbitrary values in this freeform type.
323
324 The `listeners.*.bind_address` option was renamed to `bind_addresses` in order to match the upstream `homeserver.yaml` option
325 name. It is now also a list of strings instead of a string.
326
327 An example to make the required migration clearer:
328
329 Before:
330 ```nix
331 {
332 services.matrix-synapse = {
333 enable = true;
334
335 server_name = "example.com";
336 public_baseurl = "https://example.com:8448";
337
338 enable_registration = false;
339 registration_shared_secret = "xohshaeyui8jic7uutuDogahkee3aehuaf6ei3Xouz4iicie5thie6nohNahceut";
340 macaroon_secret_key = "xoo8eder9seivukaiPh1cheikohquuw8Yooreid0The4aifahth3Ou0aiShaiz4l";
341
342 tls_certificate_path = "/var/lib/acme/example.com/fullchain.pem";
343 tls_certificate_path = "/var/lib/acme/example.com/fullchain.pem";
344
345 listeners = [ {
346 port = 8448;
347 bind_address = "";
348 type = "http";
349 tls = true;
350 resources = [ {
351 names = [ "client" ];
352 compress = true;
353 } {
354 names = [ "federation" ];
355 compress = false;
356 } ];
357 } ];
358
359 };
360 }
361 ```
362
363 After:
364 ```nix
365 {
366 services.matrix-synapse = {
367 enable = true;
368
369 # this attribute set holds all values that go into your homeserver.yaml configuration
370 # See https://github.com/matrix-org/synapse/blob/develop/docs/sample_config.yaml for
371 # possible values.
372 settings = {
373 server_name = "example.com";
374 public_baseurl = "https://example.com:8448";
375
376 enable_registration = false;
377 # pass `registration_shared_secret` and `macaroon_secret_key` via `extraConfigFiles` instead
378
379 tls_certificate_path = "/var/lib/acme/example.com/fullchain.pem";
380 tls_certificate_path = "/var/lib/acme/example.com/fullchain.pem";
381
382 listeners = [ {
383 port = 8448;
384 bind_addresses = [
385 "::"
386 "0.0.0.0"
387 ];
388 type = "http";
389 tls = true;
390 resources = [ {
391 names = [ "client" ];
392 compress = true;
393 } {
394 names = [ "federation" ];
395 compress = false;
396 } ];
397 } ];
398 };
399
400 extraConfigFiles = [
401 "/run/keys/matrix-synapse/secrets.yaml"
402 ];
403 };
404 }
405 ```
406
407 The secrets in your original config should be migrated into a YAML file that is included via `extraConfigFiles`. The filename must be quoted to prevent nix from copying it to the (world readable) store.
408
409 Additionally a few option defaults have been synced up with upstream default values, for example the `max_upload_size` grew from `10M` to `50M`. For the same reason, the default
410 `media_store_path` was changed from `${dataDir}/media` to `${dataDir}/media_store` if `system.stateVersion` is at least `22.05`. Files will need to be manually moved to the new
411 location if the `stateVersion` is updated.
412
413 As of Synapse 1.58.0, the old groups/communities feature has been disabled by default. It will be completely removed with Synapse 1.61.0.
414
415- The Keycloak package (`pkgs.keycloak`) has been switched from the
416 Wildfly version, which will soon be deprecated, to the Quarkus based
417 version. The Keycloak service (`services.keycloak`) has been updated
418 to accommodate the change and now differs from the previous version
419 in a few ways:
420
421 - `services.keycloak.extraConfig` has been removed in favor of the
422 new [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)
423 [`services.keycloak.settings`](#opt-services.keycloak.settings)
424 option. The available options correspond directly to parameters in
425 `conf/keycloak.conf`. Some of the most important parameters are
426 documented as suboptions, the rest can be found in the [All
427 configuration section of the Keycloak Server Installation and
428 Configuration
429 Guide](https://www.keycloak.org/server/all-config). While the new
430 configuration is much simpler and cleaner than the old JBoss CLI
431 one, this unfortunately mean that there's no straightforward way
432 to convert an old configuration to the new format and some
433 settings may not even be available anymore.
434
435 - `services.keycloak.frontendUrl` was removed and the frontend URL
436 is now configured through the `hostname` family of settings in
437 [`services.keycloak.settings`](#opt-services.keycloak.settings)
438 instead. See the [Hostname section of the Keycloak Server
439 Installation and Configuration
440 Guide](https://www.keycloak.org/server/hostname) for more
441 details. Additionally, `/auth` was removed from the default
442 context path and needs to be added back in
443 [`services.keycloak.settings.http-relative-path`](#opt-services.keycloak.settings.http-relative-path)
444 if you want to keep compatibility with your current clients.
445
446 - `services.keycloak.bindAddress`,
447 `services.keycloak.forceBackendUrlToFrontendUrl`,
448 `services.keycloak.httpPort` and `services.keycloak.httpsPort`
449 have been removed in favor of their equivalent options in
450 [`services.keycloak.settings`](#opt-services.keycloak.settings). `httpPort`
451 and `httpsPort` have additionally had their types changed from
452 `str` to `port`.
453
454 The new names are as follows:
455 - `bindAddress`: [`services.keycloak.settings.http-host`](#opt-services.keycloak.settings.http-host)
456 - `forceBackendUrlToFrontendUrl`: [`services.keycloak.settings.hostname-strict-backchannel`](#opt-services.keycloak.settings.hostname-strict-backchannel)
457 - `httpPort`: [`services.keycloak.settings.http-port`](#opt-services.keycloak.settings.http-port)
458 - `httpsPort`: [`services.keycloak.settings.https-port`](#opt-services.keycloak.settings.https-port)
459
460 For example, when using a reverse proxy the migration could look
461 like this:
462
463 Before:
464 ```nix
465 services.keycloak = {
466 enable = true;
467 httpPort = "8080";
468 frontendUrl = "https://keycloak.example.com/auth";
469 database.passwordFile = "/run/keys/db_password";
470 extraConfig = {
471 "subsystem=undertow"."server=default-server"."http-listener=default".proxy-address-forwarding = true;
472 };
473 };
474 ```
475
476 After:
477 ```nix
478 services.keycloak = {
479 enable = true;
480 settings = {
481 http-port = 8080;
482 hostname = "keycloak.example.com";
483 http-relative-path = "/auth";
484 proxy = "edge";
485 };
486 database.passwordFile = "/run/keys/db_password";
487 };
488 ```
489
490- The MoinMoin wiki engine (`services.moinmoin`) has been removed, because Python 2 is being retired from nixpkgs.
491
492- Services in the `hadoop` module previously set `openFirewall` to true by default.
493 This has now been changed to false. Node definitions for multi-node clusters would need
494 `openFirewall = true;` to be added to to hadoop services when upgrading from NixOS 21.11.
495
496- `services.hadoop.yarn.nodemanager` now uses cgroup-based CPU limit enforcement by default.
497 Additionally, the option `useCGroups` was added to nodemanagers as an easy way to switch
498 back to the old behavior.
499
500- The `wafHook` hook now honors `NIX_BUILD_CORES` when `enableParallelBuilding` is not set explicitly. Packages can restore the old behaviour by setting `enableParallelBuilding=false`.
501
502- `pkgs.claws-mail-gtk2`, representing Claws Mail's older release version three, was removed in order to get rid of Python 2.
503 Please switch to `claws-mail`, which is Claws Mail's latest release based on GTK+3 and Python 3.
504
505- The `writers.writePython2` and corresponding `writers.writePython2Bin` convenience functions to create executable Python 2 scripts in the store were removed in preparation of removal of the Python 2 interpreter.
506 Scripts have to be converted to Python 3 for use with `writers.writePython3` or `writers.writePyPy2` needs to be used.
507
508- `buildGoModule` was updated to use `go_1_17`, third party derivations that specify >= go 1.17 in the main `go.mod` will need to regenerate their `vendorSha256` hash.
509
510- The `gnome-passwordsafe` package updated to [version 6.x](https://gitlab.gnome.org/World/secrets/-/tags/6.0) and renamed to `gnome-secrets`.
511
512- `services.gnome.experimental-features.realtime-scheduling` option has been removed, as GNOME Shell now [uses rtkit](https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/2060). Use `security.rtkit.enable = true;` instead. As before, you will need to have it enabled using GSettings.
513
514- `services.telepathy` will no longer be enabled by default for GNOME desktops, one should enable it in their configs if using Empathy or Polari.
515
516- If you previously used `/etc/docker/daemon.json`, you need to incorporate the changes into the new option `virtualisation.docker.daemon.settings`.
517
518- Ntopng (`services.ntopng`) is updated to 5.2.1 and uses a separate Redis instance if `system.stateVersion` is at least `22.05`. Existing setups shouldn't be affected.
519
520- The backward compatibility in `services.wordpress` to configure sites with
521 the old interface has been removed. Please use `services.wordpress.sites`
522 instead.
523
524- The backward compatibility in `services.dokuwiki` to configure sites with the
525 old interface has been removed. Please use `services.dokuwiki.sites` instead.
526
527- opensmtpd-extras is no longer build with python2 scripting support due to python2 deprecation in nixpkgs
528
529- `services.miniflux.adminCredentialFiles` is now required, instead of defaulting to `admin` and `password`.
530
531- The `taskserver` module no longer implicitly opens ports in the firewall
532 configuration. This is now controlled through the option
533 `services.taskserver.openFirewall`.
534
535- The `autorestic` package has been upgraded from 1.3.0 to 1.5.0 which introduces breaking changes in config file, check [their migration guide](https://autorestic.vercel.app/migration/1.4_1.5) for more details.
536
537- `teleport` has been upgraded to major version 9. Please see upstream [upgrade instructions](https://goteleport.com/docs/setup/operations/upgrading/) and [release notes](https://goteleport.com/docs/changelog/#900).
538
539- For `pkgs.python3.pkgs.ipython`, its direct dependency `pkgs.python3.pkgs.matplotlib-inline`
540 (which is really an adapter to integrate matplotlib in ipython if it is installed) does
541 not depend on `pkgs.python3.pkgs.matplotlib` anymore.
542 This is closer to a non-Nix install of ipython.
543 This has the added benefit to reduce the closure size of `ipython` from ~400MB to ~160MB
544 (including ~100MB for python itself).
545
546- `documentation.man` has been refactored to support choosing a man implementation other than GNU's `man-db`. For this, `documentation.man.manualPages` has been renamed to `documentation.man.man-db.manualPages`. If you want to use the new alternative man implementation `mandoc`, add `documentation.man = { enable = true; man-db.enable = false; mandoc.enable = true; }` to your configuration.
547
548- Normal users (with `isNormalUser = true`) which have non-empty `subUidRanges` or `subGidRanges` set no longer have additional implicit ranges allocated. To enable automatic allocation back set `autoSubUidGidRange = true`.
549
550- `idris2` now requires `--package` when using packages `contrib` and `network`, while previously these idris2 packages were automatically loaded.
551
552- The iputils package, which is installed by default, no longer provides the
553 legacy tools `tftpd` and `traceroute6`. More tools (`ninfod`, `rarpd`, and
554 `rdisc`) are going to be removed in the next release. See
555 [upstream's release notes](https://github.com/iputils/iputils/releases/tag/20211215)
556 for more details and available replacements.
557
558- `services.thelounge.private` was removed in favor of `services.thelounge.public`, to follow with upstream changes.
559
560- `pkgs.docbookrx` was removed since it's unmaintained
561
562- `pkgs._7zz` is now correctly licensed as LGPL3+ and BSD3 with optional unfree unRAR licensed code
563
564- The `vim.customize` function produced by `vimUtils.makeCustomizable` now has a slightly different interface:
565 * The wrapper now includes everything in the given Vim derivation if `name` is `"vim"` (the default). This makes the `wrapManual` argument obsolete, but this behavior can be overridden by setting the `standalone` argument.
566 * All the executables present in the given derivation (or, in `standalone` mode, only the `*vim` ones) are wrapped. This makes the `wrapGui` argument obsolete.
567 * The `vimExecutableName` and `gvimExecutableName` arguments were replaced by a single `executableName` argument in which the shell variable `$exe` can be used to refer to the wrapped executable's name.
568
569 See the comments in `pkgs/applications/editors/vim/plugins/vim-utils.nix` for more details.
570
571 `vimUtils.vimWithRC` was removed. You should instead use `customize` on a Vim derivation, which now accepts `vimrcFile` and `gvimrcFile` arguments.
572
573- `tilp2` was removed together with its module
574
575- The F-PROT antivirus (`fprot` package) and its service module were removed because it
576 reached [end-of-life](https://kb.cyren.com/av-support/index.php?/Knowledgebase/Article/View/434/0/end-of-sale--end-of-life-for-f-prot-and-csam).
577
578- `bird1` and its modules `services.bird` as well as `services.bird6` have been removed. Upgrade to `services.bird2`.
579
580- The options `networking.interfaces.<name>.ipv4.routes` and `networking.interfaces.<name>.ipv6.routes` are no longer ignored when using networkd instead of the default scripted network backend by setting `networking.useNetworkd` to `true`.
581
582- The `miller` package has been upgraded from 5.10.3 to [6.2.0](https://github.com/johnkerl/miller/releases/tag/v6.2.0). See [What's new in Miller 6](https://miller.readthedocs.io/en/latest/new-in-miller-6).
583
584- MultiMC has been replaced with the fork PrismLauncher due to upstream
585 developers being hostile to 3rd party package maintainers. PrismLauncher
586 removes all MultiMC branding and is aimed at providing proper 3rd party
587 packages like the one contained in Nixpkgs. This change affects the data
588 folder where game instances and other save and configuration files are stored.
589 Users with existing installations should rename `~/.local/share/multimc` to
590 `~/.local/share/PrismLauncher`. The main config file's path has also moved
591 from `~/.local/share/multimc/multimc.cfg` to
592 `~/.local/share/PrismLauncher/prismlauncher.cfg`.
593
594- `systemd-nspawn@.service` settings have been reverted to the default systemd behaviour. User namespaces are now activated by default. If you want to keep running nspawn containers without user namespaces you need to set `systemd.nspawn.<name>.execConfig.PrivateUsers = false`
595
596- `systemd-shutdown` is now properly linked on shutdown to unmount all filesystems and device mapper devices cleanly. This can be disabled using `systemd.shutdownRamfs.enable`.
597
598- The Tor SOCKS proxy is now actually disabled if `services.tor.client.enable` is set to `false` (the default). If you are using this functionality but didn't change the setting or set it to `false`, you now need to set it to `true`.
599
600- `services.github-runner` has been hardened. Notably address families and
601 system calls have been restricted, which may adversely affect some kinds of
602 testing, e.g. using `AF_BLUETOOTH` to test bluetooth devices.
603
604- The terraform 0.12 compatibility has been removed and the `terraform.withPlugins` and `terraform-providers.mkProvider` implementations simplified. Providers now need to be stored under
605`$out/libexec/terraform-providers/<registry>/<owner>/<name>/<version>/<os>_<arch>/terraform-provider-<name>_v<version>` (which mkProvider does).
606
607 This breaks back-compat so it's not possible to mix-and-match with previous versions of nixpkgs. In exchange, it now becomes possible to use the providers from [nixpkgs-terraform-providers-bin](https://github.com/numtide/nixpkgs-terraform-providers-bin) directly.
608
609- The `dendrite` package has been upgraded from 0.5.1 to
610 [0.6.5](https://github.com/matrix-org/dendrite/releases/tag/v0.6.5). Instances
611 configured with split sqlite databases, which has been the default
612 in NixOS, require merging of the federation sender and signing key
613 databases. See upstream [release
614 notes](https://github.com/matrix-org/dendrite/releases/tag/v0.6.0)
615 on version 0.6.0 for details on database changes.
616
617- The existing `pkgs.opentelemetry-collector` has been moved to
618 `pkgs.opentelemetry-collector-contrib` to match the actual source being the
619 "contrib" edition. `pkgs.opentelemetry-collector` is now the actual core
620 release of opentelemetry-collector. If you use the community contributions
621 you should change the package you refer to. If you don't need them update your
622 commands from `otelcontribcol` to `otelcorecol` and enjoy a 7x smaller binary.
623
624- `services.zookeeper` has a new option `jre` for specifying the JRE to start
625 zookeeper with. It defaults to the JRE that `pkgs.zookeeper` was wrapped with,
626 instead of `pkgs.jre`. This changes the JRE to `pkgs.jdk11_headless` by default.
627
628- `pkgs.pgadmin` now refers to `pkgs.pgadmin4`. `pgadmin3` has been removed.
629
630- `pkgs.minetestclient_4` and `pkgs.minetestserver_4` have been removed, as the last 4.x release was in 2018. `pkgs.minetestclient` (equivalent to `pkgs.minetest` ) and `pkgs.minetestserver` can be used instead.
631
632- `pkgs.noto-fonts-cjk` is now deprecated in favor of `pkgs.noto-fonts-cjk-sans`
633 and `pkgs.noto-fonts-cjk-serif` because they each have different release
634 schedules. To maintain compatibility with prior releases of Nixpkgs,
635 `pkgs.noto-fonts-cjk` is currently an alias of `pkgs.noto-fonts-cjk-sans` and
636 doesn't include serif fonts.
637
638- `pkgs.epgstation` has been upgraded from v1 to v2, resulting in incompatible
639 changes in the database scheme and configuration format.
640
641- Some top-level settings under [services.epgstation](#opt-services.epgstation.enable)
642 is now deprecated because it was redundant due to the same options being
643 present in [services.epgstation.settings](#opt-services.epgstation.settings).
644
645- The option `services.epgstation.basicAuth` was removed because basic
646 authentication support was dropped by upstream.
647
648- The option [services.epgstation.database.passwordFile](#opt-services.epgstation.database.passwordFile)
649 no longer has a default value. Make sure to set this option explicitly before
650 upgrading. Change the database password if necessary.
651
652- The [services.epgstation.settings](#opt-services.epgstation.settings)
653 option now expects options for `config.yml` in EPGStation v2.
654
655- Existing data for the [services.epgstation](#opt-services.epgstation.enable)
656 module would have to be backed up prior to the upgrade. To back up existing
657 data to `/tmp/epgstation.bak`, run
658 `sudo -u epgstation epgstation run backup /tmp/epgstation.bak`.
659 To import that data after to the upgrade, run
660 `sudo -u epgstation epgstation run v1migrate /tmp/epgstation.bak`
661
662- `switch-to-configuration` (the script that is run when running `nixos-rebuild switch` for example) has been reworked
663 * The interface that allows activation scripts to restart units has been streamlined. Restarting and reloading is now done by a single file `/run/nixos/activation-restart-list` that honors `restartIfChanged` and `reloadIfChanged` of the units.
664 * Preferring to reload instead of restarting can still be achieved using `/run/nixos/activation-reload-list`.
665 * The script now uses a proper ini-file parser to parse systemd units. Some values are now only searched in one section instead of in the entire unit. This is only relevant for units that don't use the NixOS systemd moule.
666 * `RefuseManualStop`, `X-OnlyManualStart`, `X-StopOnRemoval`, `X-StopOnReconfiguration` are only searched in the `[Unit]` section
667 * `X-ReloadIfChanged`, `X-RestartIfChanged`, `X-StopIfChanged` are only searched in the `[Service]` section
668
669- The `services.bookstack.cacheDir` option has been removed, since the
670 cache directory is now handled by systemd.
671
672- The `services.bookstack.extraConfig` option has been replaced by
673 `services.bookstack.config` which implements a
674 [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)
675 configuration.
676
677- `lib.assertMsg` and `lib.assertOneOf` no longer return `false` if the passed condition is `false`, `throw`ing the given error message instead (which makes the resulting error message less cluttered). This will not impact the behaviour of code using these functions as intended, namely as top-level wrapper for `assert` conditions.
678
679- The `vpnc` package has been changed to use GnuTLS instead of OpenSSL by default for licensing reasons.
680
681- The default version of `nextcloud` is **nextcloud24**. Please note that it's **not** possible to upgrade
682 `nextcloud` across multiple major versions! This means it's e.g. not possible to upgrade from `nextcloud22`
683 to `nextcloud24` in a single deploy and most `21.11` users will have to upgrade to `nextcloud23` first.
684
685- `pkgs.vimPlugins.onedark-nvim` now refers to [navarasu/onedark.nvim](https://github.com/navarasu/onedark.nvim)
686 (formerly refers to [olimorris/onedarkpro.nvim](https://github.com/olimorris/onedarkpro.nvim)).
687
688- `services.pipewire.enable` will default to enabling the WirePlumber session manager instead of pipewire-media-session.
689 pipewire-media-session is deprecated by upstream and not recommended, but can still be manually enabled by setting
690 `services.pipewire.media-session.enable` to `true` and `services.pipewire.wireplumber.enable` to `false`.
691
692- `pkgs.makeDesktopItem` has been refactored to provide a more idiomatic API. Specifically:
693 - All valid options as of FDO Desktop Entry specification version 1.4 can now be passed in as explicit arguments
694 - `exec` can now be null, for entries that are not of type Application
695 - `mimeType` argument is renamed to `mimeTypes` for consistency
696 - `mimeTypes`, `categories`, `implements`, `keywords`, `onlyShowIn` and `notShowIn` take lists of strings instead of one string with semicolon separators
697 - `extraDesktopEntries` renamed to `extraConfig` for consistency
698 - Actions should now be provided as an attrset `actions`, the `Actions` line will be autogenerated.
699 - `extraEntries` is removed.
700 - Additional validation is added both at eval time and at build time.
701
702 See the `vscode` package for a more detailed example.
703
704- Existing `resholve*` functions have been renamed and nested under `pkgs.resholve`. Update uses to:
705 - `resholvePackage` -> `resholve.mkDerivation`
706 - `resholveScript` -> `resholve.writeScript`
707 - `resholveScriptBin` -> `resholve.writeScriptBin`
708
709- `pkgs.cosmopolitan` no longer provides the `cosmoc` command. It has been moved to `pkgs.cosmoc`.
710
711- `pkgs.graalvmXX-ce` packages no longer provide support for Python/Ruby/WASM, instead focusing only in Java and Native Image Support. If you need to add support back, please see the `pkgs.graalvmCEPackages.mkGraal` function to create your own customized version of GraalVM with support for what you need.
712
713<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
714
715## Other Notable Changes {#sec-release-22.05-notable-changes}
716
717- The option [services.redis.servers](#opt-services.redis.servers) was added
718 to support per-application `redis-server` which is more secure since Redis databases
719 are only mere key prefixes without any configuration or ACL of their own.
720 Backward-compatibility is preserved by mapping old `services.redis.settings`
721 to `services.redis.servers."".settings`, but you are strongly encouraged
722 to name each `redis-server` instance after the application using it,
723 instead of keeping that nameless one.
724 Except for the nameless `services.redis.servers.""`
725 still accessible at `127.0.0.1:6379`,
726 and to the members of the Unix group `redis`
727 through the Unix socket `/run/redis/redis.sock`,
728 all other `services.redis.servers.${serverName}`
729 are only accessible by default
730 to the members of the Unix group `redis-${serverName}`
731 through the Unix socket `/run/redis-${serverName}/redis.sock`.
732
733- The option [virtualisation.vmVariant](#opt-virtualisation.vmVariant) was added
734 to allow users to make changes to the `nixos-rebuild build-vm` configuration
735 that do not apply to their normal system.
736
737 The `config.system.build.vm` attribute now always exists and defaults to the
738 value from `vmVariant`. Configurations that import the `virtualisation/qemu-vm.nix`
739 module themselves will override this value, such that `vmVariant` is not used.
740
741 Similarly [virtualisation.vmVariantWithBootloader](#opt-virtualisation.vmVariantWithBootLoader) was added.
742
743- The configuration portion of the `nix-daemon` module has been reworked and exposed as [nix.settings](options.html#opt-nix-settings):
744 * Legacy options have been mapped to the corresponding options under under [nix.settings](options.html#opt-nix.settings) and will be deprecated when NixOS 21.11 reaches end of life.
745 * [nix.buildMachines.publicHostKey](options.html#opt-nix.buildMachines.publicHostKey) has been added.
746
747- [`kops`](https://kops.sigs.k8s.io) defaults to 1.23.2, which will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes >= 1.22. This will increase security by default, but may break some types of workloads. The default behaviour for `spec.kubeDNS.nodeLocalDNS.forwardToKubeDNS` has changed from `true` to `false`. Cilium now has `disable-cnp-status-updates: true` by default. Set this to false if you rely on the CiliumNetworkPolicy status fields. Support for Kubernetes 1.17, the Lyft CNI, Weave CNI on Kubernetes >= 1.23, CentOS 7 and 8, Debian 9, RHEL 7, and Ubuntu 16.05 (Xenial) has been removed. See the [1.22 release notes](https://kops.sigs.k8s.io/releases/1.22-notes/) and [1.23 release notes](https://kops.sigs.k8s.io/releases/1.23-notes/) for more details, including other significant changes.
748
749- Mattermost has been upgraded to extended support version 6.3 as the previously
750 packaged extended support version 5.37 is [reaching end of life](https://docs.mattermost.com/upgrade/extended-support-release.html).
751 Migration may take some time, see the [changelog](https://docs.mattermost.com/install/self-managed-changelog.html#release-v6-3-extended-support-release)
752 and [important upgrade notes](https://docs.mattermost.com/upgrade/important-upgrade-notes.html).
753
754- The `writers.writePyPy2`/`writers.writePyPy3` and corresponding `writers.writePyPy2Bin`/`writers.writePyPy3Bin` convenience functions to create executable Python 2/3 scripts using the PyPy interpreter were added.
755
756- Some improvements have been made to the `hadoop` module:
757 - A `gatewayRole` option has been added, for deploying hadoop cluster configuration files to a node that does not have any active services
758 - Support for older versions of hadoop have been added to the module
759 - Overriding and extending site XML files has been made easier
760
761- The auto-upgrade service now accepts persistent (default: true) parameter.
762 By default auto-upgrade will now run immediately if it would have been triggered at least
763 once during the time when the timer was inactive.
764
765- Mastodon now uses `services.redis.servers` to start a new redis server, instead of using a global redis server.
766 This improves compatibility with other services that use redis.
767
768 Note that this will recreate the redis database, although according to the [Mastodon docs](https://docs.joinmastodon.org/admin/backups/),
769 this is almost harmless:
770 > Losing the Redis database is almost harmless: The only irrecoverable data will be the contents of the Sidekiq queues and scheduled retries of previously failed jobs.
771 > The home and list feeds are stored in Redis, but can be regenerated with tootctl.
772
773 If you do want to save the redis database, you can use the following commands:
774 ```bash
775 redis-cli save
776 cp /var/lib/redis/dump.rdb "/var/lib/redis-mastodon/dump.rdb"
777 ```
778- Peertube now uses services.redis.servers to start a new redis server, instead of using a global redis server.
779 This improves compatibility with other services that use redis.
780
781 Redis database is used for storage only cache and job queue. More information can be found here - [Peertube architecture](https://docs.joinpeertube.org/contribute-architecture).
782
783 If you do want to save the redis database, you can use the following commands before upgrade OS:
784 ```bash
785 redis-cli save
786 sudo mkdir /var/lib/redis-peertube
787 sudo cp /var/lib/redis/dump.rdb /var/lib/redis-peertube/dump.rdb
788 ```
789- Added the `keter` NixOS module. Keter reverse proxies requests to your loaded application based on virtual hostnames.
790
791- If you are using Wayland you can choose to use the Ozone Wayland support
792 in Chrome and several Electron apps by setting the environment variable
793 `NIXOS_OZONE_WL=1` (for example via
794 `environment.sessionVariables.NIXOS_OZONE_WL = "1"`).
795 This is not enabled by default because Ozone Wayland is
796 still under heavy development and behavior is not always flawless.
797 Furthermore, not all Electron apps use the latest Electron versions.
798
799- A new option group `systemd.network.wait-online` was added, with options to configure `systemd-networkd-wait-online.service`:
800 - `anyInterface` allows specifying that the network should be considered online when *at least one* interface is online (useful on laptops)
801 - `timeout` defines how long to wait for the network to come online
802 - `extraArgs` for everything else
803
804- The `influxdb2` package was split into `influxdb2-server` and
805 `influxdb2-cli`, matching the split that took place upstream. A
806 combined `influxdb2` package is still provided in this release for
807 backwards compatibility, but will be removed at a later date.
808
809- The `unifi` package was switched from `unifi6` to `unifi7`.
810 Direct downgrades from Unifi 7 to Unifi 6 are not possible and require restoring from a backup made by Unifi 6.
811
812- `programs.zsh.autosuggestions.strategy` now takes a list of strings instead of a string.
813
814- The `asterisk` and `asterisk-stable` packages were switched from `asterisk_18` to the newly-packaged `asterisk_19`. Asterisk 13 and 17 have been removed as they have reached their end of life.
815
816- The `services.unifi.openPorts` option default value of `true` is now deprecated and will be changed to `false` in 22.11.
817 Configurations using this default will print a warning when rebuilt.
818
819- The `services.unifi-video.openPorts` option default value of `true` is now deprecated and will be changed to `false` in 22.11.
820 Configurations using this default will print a warning when rebuilt.
821
822- `security.acme` certificates will now correctly check for CA
823 revokation before reaching their minimum age.
824
825- Removing domains from `security.acme.certs._name_.extraDomainNames`
826 will now correctly remove those domains during rebuild/renew.
827
828- MariaDB is now offered in several versions, not just the newest one.
829 So if you have a need for running MariaDB 10.4 for example, you can now just set `services.mysql.package = pkgs.mariadb_104;`.
830 In general, it is recommended to run the newest version, to get the newest features, while sticking with an LTS version will most likely provide a more stable experience.
831 Sometimes software is also incompatible with the newest version of MariaDB.
832
833- The option
834 [programs.ssh.enableAskPassword](#opt-programs.ssh.enableAskPassword) was
835 added, decoupling the setting of `SSH_ASKPASS` from
836 `services.xserver.enable`. This allows easy usage in non-X11 environments,
837 e.g. Wayland.
838
839- [programs.ssh.knownHosts](#opt-programs.ssh.knownHosts) has gained an `extraHostNames`
840 option to augment `hostNames`. It is now possible to use the attribute name of a `knownHosts`
841 entry as the primary host name and specify secondary host names using `extraHostNames` without
842 having to duplicate the primary host name.
843
844- The `services.stubby` module was converted to a [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.
845
846- The option
847 [services.xserver.desktopManager.runXdgAutostartIfNone](#opt-services.xserver.desktopManager.runXdgAutostartIfNone)
848 was added in order to automatically run XDG autostart files for sessions without a desktop manager.
849 This replaces helpers like the `dex` package.
850
851- When setting [i18n.inputMethod.enabled](#opt-i18n.inputMethod.enabled) to `fcitx5`,
852 it no longer creates corresponding systemd user services.
853 It now relies on XDG autostart files to start and work properly in your desktop sessions.
854 If you are using only a window manager without a desktop manager, you need to enable
855 `services.xserver.desktopManager.runXdgAutostartIfNone` or using the `dex` package to make `fcitx5` work.
856
857
858- The option `services.duplicati.dataDir` has been added to allow changing the location of duplicati's files.
859
860- The options `boot.extraModprobeConfig` and `boot.blacklistedKernelModules` now also take effect in the initrd by copying the file `/etc/modprobe.d/nixos.conf` into the initrd.
861
862- `nixos-generate-config` now puts the dhcp configuration in `hardware-configuration.nix` instead of `configuration.nix`.
863
864- ORY Kratos was updated to version 0.9.0-alpha.3, which introduces some breaking changes:
865 - All endpoints at the Admin API are now exposed at `/admin/`. For example, endpoint `https://kratos:4434/identities` is now exposed at `https://kratos:4434/admin/identities`
866 - Configuration key `selfservice.whitelisted_return_urls` has been renamed to `allowed_return_urls`
867 - The `password_identifier` form field of the password login strategy has been renamed to `identifier` to make compatibility with passwordless flows possible.
868 - Instead of having a global `default_schema_url` which developers used to update their schema, you now need to define the `default_schema_id` which must reference schema ID in your config.
869 - Calling `/self-service/recovery` without flow ID or with an invalid flow ID while authenticated will now respond with an error instead of redirecting to the default page.
870 - If you are relying on the SQLite images, update your Docker Pull commands as follows:
871 - `docker pull oryd/kratos:{version}`
872 - Additionally, all passwords now have to be at least 8 characters long.
873 - For more details, see:
874 - [Release Notes for v0.8.1-alpha-1](https://github.com/ory/kratos/releases/tag/v0.8.1-alpha.1)
875 - [Release Notes for v0.8.2-alpha-1](https://github.com/ory/kratos/releases/tag/v0.8.2-alpha.1)
876 - [Release Notes for v0.9.0-alpha-1](https://github.com/ory/kratos/releases/tag/v0.9.0-alpha.1)
877 - [Release Notes for v0.9.0-alpha-3](https://github.com/ory/kratos/releases/tag/v0.9.0-alpha.3)
878
879
880- `fetchFromSourcehut` now allows fetching repositories recursively
881 using `fetchgit` or `fetchhg` if the argument `fetchSubmodules`
882 is set to `true`.
883
884- A module for declarative configuration of openconnect VPN profiles was added under `networking.openconnect`.
885
886- The `element-desktop` package now has an `useKeytar` option (defaults to `true`),
887 which allows disabling `keytar` and in turn `libsecret` usage
888 (which binds to native credential managers / keychain libraries).
889
890- The option `services.thelounge.plugins` has been added to allow installing plugins for The Lounge. Plugins can be found in `pkgs.theLoungePlugins.plugins` and `pkgs.theLoungePlugins.themes`.
891
892- The option `services.xserver.videoDriver = [ "nvidia" ];` will now also install [nvidia VA-API drivers](https://github.com/elFarto/nvidia-vaapi-driver) by default.
893
894- The `firmwareLinuxNonfree` package has been renamed to `linux-firmware`.
895
896- It is now possible to specify wordlists to include as handy to access environment variables using the `config.environment.wordlist` configuration options.
897
898- The `services.mbpfan` module was converted to a [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.
899
900- The default value for `programs.spacefm.settings.graphical_su` got unset. It previously pointed to `gksu` which has been removed.
901
902- The [Dino](https://dino.im) XMPP client was updated to 0.3, adding support for audio and video calls.
903
904- `services.mattermost.plugins` has been added to allow the declarative installation of Mattermost plugins.
905 Plugins are automatically repackaged using autoPatchelf.
906
907- [services.logrotate.enable](#opt-services.logrotate.enable) now defaults to true if any rotate path has
908 been defined, and some paths have been added by default.
909- The logrotate module also has been updated to freeform syntax: `services.logrotate.paths`
910 and `services.logrotate.extraConfig` will work, but issue deprecation
911 warnings and [services.logrotate.settings](#opt-services.logrotate.settings) should now be used instead.
912
913- `security.pam.ussh` has been added, which allows authorizing PAM sessions based on SSH _certificates_ held within an SSH agent, using [pam-ussh](https://github.com/uber/pam-ussh).
914
915- The `vscode-extensions.ionide.ionide-fsharp` package has been updated to 6.0.0 and now requires .NET 6.0.
916
917- The `phpPackages.box` package has been updated from 2.7.5 to 3.16.0. See the [upgrade guide](https://github.com/box-project/box/blob/master/UPGRADE.md#from-27-to-30) for more details.
918
919- The `zrepl` package has been updated from 0.4.0 to 0.5:
920
921 - The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume.
922 - A bug involving encrypt-on-receive has been fixed. Read the [zrepl documentation](https://zrepl.github.io/configuration/sendrecvoptions.html#job-recv-options-placeholder) and check the output of `zfs get -r encryption,zrepl:placeholder PATH_TO_ROOTFS` on the receiver.
923
924- The `polybar` package has been updated from 3.5.7 to 3.6.2. See [the changelog](https://github.com/polybar/polybar/releases/tag/3.6.0) for more details.
925 - Breaking changes include changes to escaping rules in configuration values, changes in behavior when encountering invalid tag names, and changes to inter-process-messaging (IPC).
926
927- Renamed option `services.openssh.challengeResponseAuthentication` to `services.openssh.kbdInteractiveAuthentication`.
928 Reason is that the old name has been deprecated upstream.
929 Using the old option name will still work, but produce a warning.
930
931- `services.autorandr` now allows for adding hooks and profiles declaratively.
932
933- The `pomerium-cli` command has been moved out of the `pomerium` package into
934 the `pomerium-cli` package, following upstream's repository split. If you are
935 using the `pomerium-cli` command, you should now install the `pomerium-cli`
936 package.
937
938- The option
939 [services.networking.networkmanager.enableFccUnlock](#opt-networking.networkmanager.enableFccUnlock)
940 was added to support FCC unlock procedures. Since release 1.18.4, the ModemManager
941 daemon no longer automatically performs the FCC unlock procedure by default. See
942 [the docs](https://modemmanager.org/docs/modemmanager/fcc-unlock/) for more details.
943
944- `programs.tmux` has a new option `plugins` that accepts a list of packages from the `tmuxPlugins` group. The specified packages are added to the system and loaded by `tmux`.
945
946- The polkit service, available at `security.polkit.enable`, is now disabled by default. It will automatically be enabled through services and desktop environments as needed.
947
948- `mercury` was updated to 22.01.1, which has some breaking changes ([Mercury 22.01 news](https://dl.mercurylang.org/release/release-notes-22.01.html)).
949
950- xfsprogs was update to version 5.15, which enables inobtcount and bigtime by default on filesystem creation. Support for these features was added in kernel 5.10 and deemed stable in kernel 5.15.
951 If you want to be able to mount XFS filesystems created with this release of xfsprogs on kernel releases older than 5.10, you need to format them with `mkfs.xfs -m bigtime=0 -m inobtcount=0`.
952
953- `services.xserver.desktopManager.xfce` now includes Xfce's screen locker, `xfce4-screensaver` that is enabled by default. You can disable it by setting `false` to [services.xserver.desktopManager.xfce.enableScreensaver](#opt-services.xserver.desktopManager.xfce.enableScreensaver).
954
955- The `hadoop` package has added support for `aarch64-linux` and `aarch64-darwin` as of 3.3.1 ([#158613](https://github.com/NixOS/nixpkgs/pull/158613)).
956
957- The `R` package now builds again on `aarch64-darwin` ([#158992](https://github.com/NixOS/nixpkgs/pull/158992)).
958
959- The `nss` package was split into `nss_esr` and `nss_latest`, with `nss` being an alias for `nss_esr`. This was done to ease maintenance of `nss` and dependent high-profile packages like `firefox`.
960
961- The default `scribus` version is now 1.5, while version 1.4 is still available as `scribus_1_4` ([#172700](https://github.com/NixOS/nixpkgs/pull/172700)).
962
963- The Nextcloud module now supports to create a Mysql database automatically
964 with `services.nextcloud.database.createLocally` enabled.
965
966- The Nextcloud module now allows setting the value of the `max-age` directive of the `Strict-Transport-Security` HTTP header, which is now controlled by the `services.nextcloud.https` option, rather than `services.nginx.recommendedHttpHeaders`.
967
968- The `spark3` package has been updated from 3.1.2 to 3.2.1 ([#160075](https://github.com/NixOS/nixpkgs/pull/160075)):
969
970 - Testing has been enabled for `aarch64-linux` in addition to `x86_64-linux`.
971 - The `spark3` package is now usable on `aarch64-darwin` as a result of [#158613](https://github.com/NixOS/nixpkgs/pull/158613) and [#158992](https://github.com/NixOS/nixpkgs/pull/158992).
972
973- The option `services.snapserver.openFirewall` will no longer default to
974 `true` starting with NixOS 22.11. Enable it explicitly if you need to control
975 Snapserver remotely or connect streamig clients from other hosts.
976
977- The option [networking.useDHCP](options.html#opt-networking.useDHCP) isn't deprecated anymore.
978 When using [`systemd-networkd`](options.html#opt-networking.useNetworkd), a generic
979 `.network`-unit is added which enables DHCP for each interface matching `en*`, `eth*`
980 or `wl*` with priority 99 (which means that it doesn't have any effect if such an interface is matched
981 by a `.network-`unit with a lower priority). In case of scripted networking, no behavior
982 was changed.
983
984- The new [`postgresqlTestHook`](https://nixos.org/manual/nixpkgs/stable/#sec-postgresqlTestHook) runs a PostgreSQL server for the duration of package checks.
985
986- `zfs` was updated from 2.1.4 to 2.1.5, enabling it to be used with Linux kernel 5.18.
987
988- `stdenv.mkDerivation` now supports a self-referencing `finalAttrs:` parameter
989 containing the final `mkDerivation` arguments including overrides.
990 `drv.overrideAttrs` now supports two parameters `finalAttrs: previousAttrs:`.
991 This allows packaging configuration to be overridden in a consistent manner by
992 providing an alternative to `rec {}` syntax.
993
994 Additionally, `passthru` can now reference `finalAttrs.finalPackage` containing
995 the final package, including attributes such as the output paths and
996 `overrideAttrs`.
997
998 New language integrations can be simplified by overriding a "prototype"
999 package containing the language-specific logic. This removes the need for a
1000 extra layer of overriding for the "generic builder" arguments, thus removing a
1001 usability problem and source of error.
1002
1003<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->