pyrox.dev
1# Release 22.05 (“Quokka”, 2022.05/30) {#sec-release-22.05}
2
3- Support is planned until the end of December 2022, handing over to 22.11.
4
5## Highlights {#sec-release-22.05-highlights}
6
7In addition to numerous new and upgraded packages, this release has the following highlights:
8
9- Nix has been updated from 2.3 to 2.8. This mainly brings experimental support
10 for Flakes, but also marks the `nix` command as experimental which now has to
11 be enabled via the configuration explicitly. For more information and
12 instructions for upgrades, see the
13 release notes for [nix-2.4](https://nixos.org/manual/nix/stable/release-notes/rl-2.4.html),
14 [nix-2.5](https://nixos.org/manual/nix/stable/release-notes/rl-2.5.html),
15 [nix-2.6](https://nixos.org/manual/nix/stable/release-notes/rl-2.6.html),
16 [nix-2.7](https://nixos.org/manual/nix/stable/release-notes/rl-2.7.html) and
17 [nix-2.8](https://nixos.org/manual/nix/stable/release-notes/rl-2.8.html)
18
19- The `firefox` browser on `x86_64-linux` now makes use of profile-guided
20 optimisation, resulting in a much more responsive browsing experience.
21
22- GNOME has been upgraded to 42. Please take a look at their [Release
23 Notes](https://release.gnome.org/42/) for details. In particular, it replaces
24 gedit with GNOME Text Editor, GNOME Terminal with GNOME Console (formerly
25 King's Cross) and GNOME Screenshot by a tool integrated into the Shell.
26
27- PHP 8.1 is now available.
28
29- systemd services can now set [systemd.services.\<name\>.reloadTriggers](#opt-systemd.services) instead of `reloadIfChanged` for a more granular distinction between reloads and restarts.
30
31- Systemd has been upgraded to the version 250.
32
33- Pulseaudio has been updated to version 15.0 and now optionally
34 [supports additional Bluetooth audio codecs](https://www.freedesktop.org/wiki/Software/PulseAudio/Notes/15.0/#supportforldacandaptxbluetoothcodecsplussbcxqsbcwithhigher-qualityparameters)
35 such as aptX or LDAC, with codec switching available in `pavucontrol`. This
36 feature is disabled by default, but can be enabled with the option
37 `hardware.pulseaudio.package = pkgs.pulseaudioFull;`. Existing third-party
38 modules that offered similar functions, such as `pulseaudio-modules-bt` or
39 `pulseaudio-hsphfpd`, are obsolete and have been removed.
40
41- PostgreSQL now defaults to major version 14.
42
43- Module authors can use `mkRenamedOptionModuleWith` to automate the deprecation cycle without annoying out-of-tree module authors and their users.
44
45- The default GHC version has been updated from 8.10.7 to 9.0.2. `pkgs.haskellPackages` and `pkgs.ghc` will now use this version by default.
46
47- The GNOME and Plasma installation CDs now use `pkgs.calamares` and `pkgs.calamares-nixos-extensions` to allow users to easily install and set up NixOS with a GUI.
48
49- `security.acme.defaults` has been added to simplify the configuration of
50 settings for many certificates at once. This also opens up the option to use
51 DNS-01 validation when using `enableACME` web server virtual hosts (e.g.
52 `services.nginx.virtualHosts.*.enableACME`).
53
54## New Services {#sec-release-22.05-new-services}
55
56- [1password](https://1password.com/), command-lines and graphic interface for 1Password. Available as [programs._1password](#opt-programs._1password.enable) and [programs._1password-gui](#opt-programs._1password.enable).
57
58- [aesmd](https://github.com/intel/linux-sgx#install-the-intelr-sgx-psw), the Intel SGX Architectural Enclave Service Manager. Available as [services.aesmd](#opt-services.aesmd.enable).
59
60- [agate](https://github.com/mbrubeck/agate), a very simple server for the Gemini hypertext protocol. Available as [services.agate](#opt-services.agate.enable).
61
62- [apfs](https://github.com/linux-apfs/linux-apfs-rw), a kernel module for mounting the Apple File System (APFS).
63
64- [argonone](https://gitlab.com/DarkElvenAngel/argononed), a replacement daemon for the Raspberry Pi Argon One power button and cooler. Available at [services.hardware.argonone](options.html#opt-services.hardware.argonone.enable).
65
66- [ArchiSteamFarm](https://github.com/JustArchiNET/ArchiSteamFarm), a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as [services.archisteamfarm](#opt-services.archisteamfarm.enable).
67
68- [BaGet](https://loic-sharma.github.io/BaGet/), a lightweight NuGet and symbol server. Available at services.baget.
69
70- [bird-lg](https://github.com/xddxdd/bird-lg-go), a BGP looking glass for Bird Routing. Available as [services.bird-lg](#opt-services.bird-lg.package).
71
72- [blocky](https://0xerr0r.github.io/blocky/), fast and lightweight DNS proxy as ad-blocker for local network with many features. Available as [services.blocky](#opt-services.blocky.enable).
73
74- [cloudflare-dyndns](https://github.com/kissgyorgy/cloudflare-dyndns), CloudFlare Dynamic DNS client. Available as [services.cloudflare-dyndns](#opt-services.cloudflare-dyndns.enable).
75
76- [Corosync](https://corosync.github.io/corosync/) and [Pacemaker](https://clusterlabs.org/pacemaker/), A open-source high availability resource manager. Available as [services.corosync](#opt-services.corosync.enable) and [services.pacemaker](#opt-services.pacemaker.enable).
77
78- [create_ap](https://github.com/lakinduakash/linux-wifi-hotspot), a module for creating wifi hotspots using the program linux-wifi-hotspot. Available as [services.create_ap](#opt-services.create_ap.enable).
79
80- [Envoy](https://www.envoyproxy.io/), a high-performance reverse proxy. Available as [services.envoy](#opt-services.envoy.enable).
81
82- [ergochat](https://ergo.chat), a modern IRC with IRCv3 features. Available as [services.ergochat](#opt-services.ergochat.enable).
83
84- [ethercalc](https://github.com/audreyt/ethercalc), an online collaborative spreadsheet. Available as [services.ethercalc](#opt-services.ethercalc.enable).
85
86- [filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html), a lightweight shipper for forwarding and centralizing log data. Available as [services.filebeat](#opt-services.filebeat.enable).
87
88- [FRRouting](https://frrouting.org/), a popular suite of Internet routing protocol daemons (BGP, BFD, OSPF, IS-IS, VRRP and others). Available as [services.frr](#opt-services.frr.babeld.enable).
89
90- [Grafana Mimir](https://grafana.com/oss/mimir/), an open source, horizontally scalable, highly available, multi-tenant, long-term storage for Prometheus. Available as [services.mimir](#opt-services.mimir.enable).
91
92- [Haste](https://hastebin.com/about.md), a pastebin written in node.js. Available as [services.haste](#opt-services.haste-server.enable).
93
94- [headscale](https://github.com/juanfont/headscale), an Open Source implementation of the [Tailscale](https://tailscale.io) Control Server. Available as [services.headscale](#opt-services.headscale.enable).
95
96- [heisenbridge](https://github.com/hifi/heisenbridge), a bouncer-style Matrix IRC bridge. Available as [services.heisenbridge](#opt-services.heisenbridge.enable).
97
98- [https-dns-proxy](https://github.com/aarond10/https_dns_proxy), DNS to DNS over HTTPS (DoH) proxy. Available as [services.https-dns-proxy](#opt-services.https-dns-proxy.enable).
99
100- [input-remapper](https://github.com/sezanzeb/input-remapper), an easy to use tool to change the mapping of your input device buttons. Available at [services.input-remapper](#opt-services.input-remapper.enable).
101
102- [InvoicePlane](https://invoiceplane.com), web application for managing and creating invoices. Available at [services.invoiceplane](#opt-services.invoiceplane.sites._name_.enable).
103
104- [k3b](https://userbase.kde.org/K3b), the KDE disk burning application. Available as [programs.k3b](#opt-programs.k3b.enable).
105
106- [K40-Whisperer](https://www.scorchworks.com/K40whisperer/k40whisperer.html), a program to control cheap Chinese laser cutters. Available as [programs.k40-whisperer.enable](#opt-programs.k40-whisperer.enable). Users must add themselves to the `k40` group to be able to access the device.
107
108- [kanidm](https://kanidm.github.io/kanidm/stable/), an identity management server written in Rust. Available as [services.kanidm](#opt-services.kanidm.enableServer)
109
110- [Maddy](https://maddy.email/), a free an open source mail server. Available as [services.maddy](#opt-services.maddy.enable).
111
112- [matrix-conduit](https://conduit.rs/), a simple, fast and reliable chat server powered by matrix. Available as [services.matrix-conduit](options.html#opt-services.matrix-conduit.enable).
113
114- [Moosefs](https://moosefs.com), fault tolerant petabyte distributed file system. Available as [moosefs](#opt-services.moosefs.master.enable).
115
116- [mozillavpn](https://github.com/mozilla-mobile/mozilla-vpn-client), the client for the [Mozilla VPN](https://vpn.mozilla.org/) service. Available as [services.mozillavpn](#opt-services.mozillavpn.enable).
117
118- [mtr-exporter](https://github.com/mgumz/mtr-exporter), a Prometheus exporter for mtr metrics. Available as [services.mtr-exporter](#opt-services.mtr-exporter.enable).
119
120- [nbd](https://nbd.sourceforge.io/), a Network Block Device server. Available as [services.nbd](#opt-services.nbd.server.enable).
121
122- [netbox](https://github.com/netbox-community/netbox), infrastructure resource modeling (IRM) tool. Available as [services.netbox](#opt-services.netbox.enable).
123
124- [nethoscope](https://github.com/vvilhonen/nethoscope), listen to your network traffic. Available as [programs.nethoscope](#opt-programs.nethoscope.enable).
125
126- [nifi](https://nifi.apache.org), an easy to use, powerful, and reliable system to process and distribute data. Available as [services.nifi](#opt-services.nifi.enable).
127
128- [nix-ld](https://github.com/Mic92/nix-ld), Run unpatched dynamic binaries on NixOS. Available as [programs.nix-ld](#opt-programs.nix-ld.enable).
129
130- [NNCP](http://www.nncpgo.org), NNCP (Node to Node copy) utilities and configuration, Available as [programs.nncp](#opt-programs.nncp.enable).
131
132- [pgadmin4](https://github.com/postgres/pgadmin4), an admin interface for the PostgreSQL database. Available at [services.pgadmin](#opt-services.pgadmin.enable).
133
134- [PowerDNS-Admin](https://github.com/ngoduykhanh/PowerDNS-Admin), a web interface for the PowerDNS server. Available at [services.powerdns-admin](#opt-services.powerdns-admin.enable).
135
136- [prometheus-pve-exporter](https://github.com/prometheus-pve/prometheus-pve-exporter), a tool that exposes information from the Proxmox VE API for use by Prometheus. Available as [services.prometheus.exporters.pve](#opt-services.prometheus.exporters.pve.enable).
137
138- [prosody-filer](https://github.com/ThomasLeister/prosody-filer), a server for handling XMPP HTTP Upload requests. Available at [services.prosody-filer](#opt-services.prosody-filer.enable).
139
140- [Public Inbox](https://public-inbox.org), an "archives first" approach to mailing lists. Available as [services.public-inbox](#opt-services.public-inbox.enable).
141
142- [r53-ddns](https://github.com/fleaz/r53-ddns), a small tool to run your own DDNS service via AWS Route53. Available as [services.r53-ddns](#opt-services.r53-ddns.enable).
143
144- [rmfakecloud](https://ddvk.github.io/rmfakecloud/), a clone of the cloud sync the remarkable tablet. Available as [services.rmfakecloud](#opt-services.rmfakecloud.enable).
145
146- [rootless Docker](https://docs.docker.com/engine/security/rootless/), a `systemd --user` Docker service which runs without root permissions. Available as [virtualisation.docker.rootless.enable](#opt-virtualisation.docker.rootless.enable).
147
148- [rstudio-server](https://www.rstudio.com/products/rstudio/#rstudio-server), a browser-based version of the RStudio IDE for the R programming language. Available as [services.rstudio-server](#opt-services.rstudio-server.enable).
149
150- [mediamtx](https://github.com/aler9/mediamtx), ready-to-use RTSP / RTMP / HLS server and proxy that allows to read, publish and proxy video and audio streams. Available as [services.mediamtx](#opt-services.mediamtx.enable).
151
152- [Snipe-IT](https://snipeitapp.com), a free open source IT asset/license management system. Available as [services.snipe-it](#opt-services.snipe-it.enable).
153
154- [snowflake-proxy](https://snowflake.torproject.org/), a system to defeat internet censorship. Available as [services.snowflake-proxy](#opt-services.snowflake-proxy.enable).
155
156- [sslmate-agent](https://sslmate.com/), a daemon for managing SSL/TLS certificates on a server. Available as [services.sslmate-agent](services.sslmate-agent.enable).
157
158- [starship](https://starship.rs), a minimal, blazing-fast, and infinitely customizable prompt for any shell. Available at [programs.startship](#opt-programs.starship.enable).
159
160- [systembus-notify](https://github.com/rfjakob/systembus-notify), allow system level notifications to reach the users. Available as [services.systembus-notify](opt-services.systembus-notify.enable). Please keep in mind that this service should only be enabled on machines with fully trusted users, as any local user is able to DoS user sessions by spamming notifications.
161
162- [teleport](https://goteleport.com), allows engineers and security professionals to unify access for SSH servers, Kubernetes clusters, web applications, and databases across all environments. Available at [services.teleport](#opt-services.teleport.enable).
163
164- [tetrd](https://tetrd.app), share your internet connection from your device to your PC and vice versa through a USB cable. Available at [services.tetrd](#opt-services.tetrd.enable).
165
166- [uptermd](https://upterm.dev), an open-source solution for sharing terminal sessions instantly over the public internet via secure tunnels. Available at [services.uptermd](#opt-services.uptermd.enable).
167
168- [usbrelayd](https://github.com/darrylb123/usbrelay), an USB Relay MQTT daemon. Available as [services.usbrelayd](#opt-services.usbrelayd.enable).
169
170- [webdav-server-rs](https://github.com/miquels/webdav-server-rs), Webdav server in rust. Available as [services.webdav-server-rs](#opt-services.webdav-server-rs.enable).
171
172- [wg-netmanager](https://github.com/gin66/wg_netmanager), the Wireguard network manager. Available as [services.wg-netmanager](#opt-services.wg-netmanager.enable).
173
174- [Zammad](https://zammad.org/), a web-based, open source user support/ticketing solution. Available as [services.zammad](#opt-services.zammad.enable).
175
176<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
177
178## Backward Incompatibilities {#sec-release-22.05-incompatibilities}
179
180- `pkgs.ghc` now refers to `pkgs.targetPackages.haskellPackages.ghc`.
181 This _only_ makes a difference if you are cross-compiling and will
182 ensure that `pkgs.ghc` always runs on the host platform and compiles
183 for the target platform (similar to `pkgs.gcc` for example).
184 `haskellPackages.ghc` still behaves as before, running on the build
185 platform and compiling for the host platform (similar to `stdenv.cc`).
186 This means you don't have to adjust your derivations if you use
187 `haskellPackages.callPackage`, but when using `pkgs.callPackage` and
188 taking `ghc` as an input, you should now use `buildPackages.ghc`
189 instead to ensure cross compilation keeps working (or switch to
190 `haskellPackages.callPackage`).
191
192- `pkgs.ghc.withPackages` as well as `haskellPackages.ghcWithPackages` etc.
193 now needs be overridden directly, as opposed to overriding the result of
194 calling it. Additionally, the `withLLVM` parameter has been renamed to
195 `useLLVM`. So instead of `(ghc.withPackages (p: [])).override { withLLVM = true; }`,
196 one needs to use `(ghc.withPackages.override { useLLVM = true; }) (p: [])`.
197
198- The update of the haskell package set brings with it a new version of the `xmonad`
199 module, which will break your configuration if you use `launch` as entrypoint. The
200 example code the corresponding nixos module was adjusted, you may want to have a look at it.
201
202- The `home-assistant` module now requires users that don't want their
203 configuration to be managed declaratively to set
204 `services.home-assistant.config = null;`. This is required
205 due to the way default settings are handled with the new settings style.
206
207 Additionally the default list of `extraComponents` now includes the minimal
208 dependencies to successfully complete the [onboarding](https://www.home-assistant.io/getting-started/onboarding/)
209 procedure.
210
211- `pkgs.emacsPackages.orgPackages` is removed because org elpa is deprecated.
212 The packages in the top level of `pkgs.emacsPackages`, such as org and
213 org-contrib, refer to the ones in `pkgs.emacsPackages.elpaPackages` and
214 `pkgs.emacsPackages.nongnuPackages` where the new versions will release.
215
216- The configuration and state directories used by `nixos-containers` have been
217 moved from `/etc/containers` and `/var/lib/containers` to
218 `/etc/nixos-containers` and `/var/lib/nixos-containers`.
219
220 If you are changing `system.stateVersion` to `"22.05"` manually on an existing
221 system you are responsible for migrating these directories yourself.
222
223 This is to improve compatibility with `libcontainer` based software such as Podman and Skopeo
224 which assumes they have ownership over `/etc/containers`.
225
226- `lib.systems.supported` has been removed, as it was overengineered for determining the systems to support in the nixpkgs flake. The list of systems exposed by the nixpkgs flake can now be accessed as `lib.systems.flakeExposed`.
227
228- For new installations `virtualisation.oci-containers.backend` is now set to `podman` by default.
229 If you still want to use Docker on systems where `system.stateVersion` is set to to `"22.05"` set `virtualisation.oci-containers.backend = "docker";`.Old systems with older `stateVersion`s stay with "docker".
230
231- `security.klogd` was removed. Logging of kernel messages is handled
232 by systemd since Linux 3.5.
233
234- `pkgs.ssmtp` has been dropped due to the program being unmaintained.
235 `pkgs.msmtp` can be used instead as a substitute `sendmail` implementation.
236 The corresponding options `services.ssmtp.*` have been removed as well.
237 `programs.msmtp.*` can be used instead for an equivalent setup. For example:
238
239 ```nix
240 {
241 # Original ssmtp configuration:
242 services.ssmtp = {
243 enable = true;
244 useTLS = true;
245 useSTARTTLS = true;
246 hostName = "smtp.example:587";
247 authUser = "someone";
248 authPassFile = "/secrets/password.txt";
249 };
250
251 # Equivalent msmtp configuration:
252 programs.msmtp = {
253 enable = true;
254 accounts.default = {
255 tls = true;
256 tls_starttls = true;
257 auth = true;
258 host = "smtp.example";
259 port = 587;
260 user = "someone";
261 passwordeval = "cat /secrets/password.txt";
262 };
263 };
264 }
265 ```
266
267- `services.kubernetes.addons.dashboard` was removed due to it being an outdated version.
268
269- `services.kubernetes.scheduler.{port,address}` now set `--secure-port` and `--bind-address` instead of `--port` and `--address`, since the former have been deprecated and are no longer functional in kubernetes>=1.23. Ensure that you are not relying on the insecure behaviour before upgrading.
270
271- In the PowerDNS Recursor module (`services.pdns-recursor`), default values of several IP address-related NixOS options have been updated to match the default upstream behavior.
272 In particular, Recursor by default will:
273 - listen on (and allows connections from) both IPv4 and IPv6 addresses
274 (`services.pdns-recursor.dns.address`, `services.pdns-recursor.dns.allowFrom`);
275 - allow only local connections to the REST API server (`services.pdns-recursor.api.allowFrom`).
276
277- In the ncdns module, the default value of `services.ncdns.address` has been changed to the IPv6 loopback address (`::1`).
278
279- `openldap` (and therefore the slapd LDAP server) were updated to version 2.6.2. The project introduced backwards-incompatible changes, namely the removal of the bdb, hdb, ndb, and shell backends in slapd. Therefore before updating, dump your database `slapcat -n 1` in LDIF format, and reimport it after updating your `services.openldap.settings`, which represents your `cn=config`.
280
281 Additionally with 2.5 the argon2 module was included in the standard distribution and renamed from `pw-argon2` to `argon2`. Remember to update your `olcModuleLoad` entry in `cn=config`.
282
283- `openssh` has been update to 8.9p1, changing the FIDO security key middleware interface.
284
285- `git` no longer hardcodes the path to openssh' ssh binary to reduce the amount of rebuilds. If you are using git with ssh remotes and do not have a ssh binary in your environment consider adding `openssh` to it or switching to `gitFull`.
286
287- `services.k3s.enable` no longer implies `systemd.enableUnifiedCgroupHierarchy = false`, and will default to the 'systemd' cgroup driver when using `services.k3s.docker = true`.
288 This change may require a reboot to take effect, and k3s may not be able to run if the boot cgroup hierarchy does not match its configuration.
289 The previous behavior may be retained by explicitly setting `systemd.enableUnifiedCgroupHierarchy = false` in your configuration.
290
291- `fonts.fonts` no longer includes ancient bitmap fonts when both `config.services.xserver.enable` and `config.nixpkgs.config.allowUnfree` are enabled.
292 If you still want these fonts, use:
293
294 ```nix
295 {
296 fonts.fonts = [
297 pkgs.xorg.fontbhlucidatypewriter100dpi
298 pkgs.xorg.fontbhlucidatypewriter75dpi
299 pkgs.xorg.fontbh100dpi
300 ];
301 }
302 ```
303
304- `services.prometheus.alertManagerTimeout` has been removed as it has been deprecated upstream and has no effect.
305
306- The DHCP server (`services.dhcpd4`, `services.dhcpd6`) has been hardened.
307 The service is now using the systemd's `DynamicUser` mechanism to run as an unprivileged dynamically-allocated user with limited capabilities.
308 The dhcpd state files are now always stored in `/var/lib/dhcpd{4,6}` and the `services.dhcpd4.stateDir` and `service.dhcpd6.stateDir` options have been removed.
309 If you were depending on root privileges or set{uid,gid,cap} binaries in dhcpd shell hooks, you may give dhcpd more capabilities with e.g. `systemd.services.dhcpd6.serviceConfig.AmbientCapabilities`.
310
311- The `mailpile` email webclient (`services.mailpile`) has been removed due to its reliance on python2.
312
313- `services.ipfs.extraFlags` is now escaped with `utils.escapeSystemdExecArgs`. If you rely on systemd interpolating `extraFlags` in the service `ExecStart`, this will no longer work.
314
315- `hbase` version 0.98.24 has been removed. The package now defaults to version 2.4.11. Versions 1.7.1 and 3.0.0-alpha-2 are also available.
316
317- `services.paperless-ng` was renamed to `services.paperless`. Accordingly, the `paperless-ng-manage` script (located in `dataDir`) was renamed to `paperless-manage`. `services.paperless` now uses `paperless-ngx`.
318
319- The `matrix-synapse` service (`services.matrix-synapse`) has been converted to use the `settings` option defined in RFC42.
320 This means that options that are part of your `homeserver.yaml` configuration, and that were specified at the top-level of the
321 module (`services.matrix-synapse`) now need to be moved into `services.matrix-synapse.settings`. And while not all options you
322 may use are defined in there, they are still supported, because you can set arbitrary values in this freeform type.
323
324 The `listeners.*.bind_address` option was renamed to `bind_addresses` in order to match the upstream `homeserver.yaml` option
325 name. It is now also a list of strings instead of a string.
326
327 An example to make the required migration clearer:
328
329 Before:
330 ```nix
331 {
332 services.matrix-synapse = {
333 enable = true;
334
335 server_name = "example.com";
336 public_baseurl = "https://example.com:8448";
337
338 enable_registration = false;
339 registration_shared_secret = "xohshaeyui8jic7uutuDogahkee3aehuaf6ei3Xouz4iicie5thie6nohNahceut";
340 macaroon_secret_key = "xoo8eder9seivukaiPh1cheikohquuw8Yooreid0The4aifahth3Ou0aiShaiz4l";
341
342 tls_certificate_path = "/var/lib/acme/example.com/fullchain.pem";
343 tls_certificate_path = "/var/lib/acme/example.com/fullchain.pem";
344
345 listeners = [ {
346 port = 8448;
347 bind_address = "";
348 type = "http";
349 tls = true;
350 resources = [ {
351 names = [ "client" ];
352 compress = true;
353 } {
354 names = [ "federation" ];
355 compress = false;
356 } ];
357 } ];
358
359 };
360 }
361 ```
362
363 After:
364 ```nix
365 {
366 services.matrix-synapse = {
367 enable = true;
368
369 # this attribute set holds all values that go into your homeserver.yaml configuration
370 # See https://github.com/matrix-org/synapse/blob/develop/docs/sample_config.yaml for
371 # possible values.
372 settings = {
373 server_name = "example.com";
374 public_baseurl = "https://example.com:8448";
375
376 enable_registration = false;
377 # pass `registration_shared_secret` and `macaroon_secret_key` via `extraConfigFiles` instead
378
379 tls_certificate_path = "/var/lib/acme/example.com/fullchain.pem";
380 tls_certificate_path = "/var/lib/acme/example.com/fullchain.pem";
381
382 listeners = [ {
383 port = 8448;
384 bind_addresses = [
385 "::"
386 "0.0.0.0"
387 ];
388 type = "http";
389 tls = true;
390 resources = [ {
391 names = [ "client" ];
392 compress = true;
393 } {
394 names = [ "federation" ];
395 compress = false;
396 } ];
397 } ];
398 };
399
400 extraConfigFiles = [
401 "/run/keys/matrix-synapse/secrets.yaml"
402 ];
403 };
404 }
405 ```
406
407 The secrets in your original config should be migrated into a YAML file that is included via `extraConfigFiles`. The filename must be quoted to prevent nix from copying it to the (world readable) store.
408
409 Additionally a few option defaults have been synced up with upstream default values, for example the `max_upload_size` grew from `10M` to `50M`. For the same reason, the default
410 `media_store_path` was changed from `${dataDir}/media` to `${dataDir}/media_store` if `system.stateVersion` is at least `22.05`. Files will need to be manually moved to the new
411 location if the `stateVersion` is updated.
412
413 As of Synapse 1.58.0, the old groups/communities feature has been disabled by default. It will be completely removed with Synapse 1.61.0.
414
415- The Keycloak package (`pkgs.keycloak`) has been switched from the
416 Wildfly version, which will soon be deprecated, to the Quarkus based
417 version. The Keycloak service (`services.keycloak`) has been updated
418 to accommodate the change and now differs from the previous version
419 in a few ways:
420
421 - `services.keycloak.extraConfig` has been removed in favor of the
422 new [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)
423 [`services.keycloak.settings`](#opt-services.keycloak.settings)
424 option. The available options correspond directly to parameters in
425 `conf/keycloak.conf`. Some of the most important parameters are
426 documented as suboptions, the rest can be found in the [All
427 configuration section of the Keycloak Server Installation and
428 Configuration
429 Guide](https://www.keycloak.org/server/all-config). While the new
430 configuration is much simpler and cleaner than the old JBoss CLI
431 one, this unfortunately mean that there's no straightforward way
432 to convert an old configuration to the new format and some
433 settings may not even be available anymore.
434
435 - `services.keycloak.frontendUrl` was removed and the frontend URL
436 is now configured through the `hostname` family of settings in
437 [`services.keycloak.settings`](#opt-services.keycloak.settings)
438 instead. See the [Hostname section of the Keycloak Server
439 Installation and Configuration
440 Guide](https://www.keycloak.org/server/hostname) for more
441 details. Additionally, `/auth` was removed from the default
442 context path and needs to be added back in
443 [`services.keycloak.settings.http-relative-path`](#opt-services.keycloak.settings.http-relative-path)
444 if you want to keep compatibility with your current clients.
445
446 - `services.keycloak.bindAddress`,
447 `services.keycloak.forceBackendUrlToFrontendUrl`,
448 `services.keycloak.httpPort` and `services.keycloak.httpsPort`
449 have been removed in favor of their equivalent options in
450 [`services.keycloak.settings`](#opt-services.keycloak.settings). `httpPort`
451 and `httpsPort` have additionally had their types changed from
452 `str` to `port`.
453
454 The new names are as follows:
455 - `bindAddress`: [`services.keycloak.settings.http-host`](#opt-services.keycloak.settings.http-host)
456 - `forceBackendUrlToFrontendUrl`: `services.keycloak.settings.hostname-strict-backchannel`
457 - `httpPort`: [`services.keycloak.settings.http-port`](#opt-services.keycloak.settings.http-port)
458 - `httpsPort`: [`services.keycloak.settings.https-port`](#opt-services.keycloak.settings.https-port)
459
460 For example, when using a reverse proxy the migration could look
461 like this:
462
463 Before:
464 ```nix
465 {
466 services.keycloak = {
467 enable = true;
468 httpPort = "8080";
469 frontendUrl = "https://keycloak.example.com/auth";
470 database.passwordFile = "/run/keys/db_password";
471 extraConfig = {
472 "subsystem=undertow"."server=default-server"."http-listener=default".proxy-address-forwarding = true;
473 };
474 };
475 }
476 ```
477
478 After:
479 ```nix
480 {
481 services.keycloak = {
482 enable = true;
483 settings = {
484 http-port = 8080;
485 hostname = "keycloak.example.com";
486 http-relative-path = "/auth";
487 proxy = "edge";
488 };
489 database.passwordFile = "/run/keys/db_password";
490 };
491 }
492 ```
493
494- The MoinMoin wiki engine (`services.moinmoin`) has been removed, because Python 2 is being retired from nixpkgs.
495
496- Services in the `hadoop` module previously set `openFirewall` to true by default.
497 This has now been changed to false. Node definitions for multi-node clusters would need
498 `openFirewall = true;` to be added to to hadoop services when upgrading from NixOS 21.11.
499
500- `services.hadoop.yarn.nodemanager` now uses cgroup-based CPU limit enforcement by default.
501 Additionally, the option `useCGroups` was added to nodemanagers as an easy way to switch
502 back to the old behavior.
503
504- The `wafHook` hook now honors `NIX_BUILD_CORES` when `enableParallelBuilding` is not set explicitly. Packages can restore the old behaviour by setting `enableParallelBuilding=false`.
505
506- `pkgs.claws-mail-gtk2`, representing Claws Mail's older release version three, was removed in order to get rid of Python 2.
507 Please switch to `claws-mail`, which is Claws Mail's latest release based on GTK+3 and Python 3.
508
509- The `writers.writePython2` and corresponding `writers.writePython2Bin` convenience functions to create executable Python 2 scripts in the store were removed in preparation of removal of the Python 2 interpreter.
510 Scripts have to be converted to Python 3 for use with `writers.writePython3` or `writers.writePyPy2` needs to be used.
511
512- `buildGoModule` was updated to use `go_1_17`, third party derivations that specify >= go 1.17 in the main `go.mod` will need to regenerate their `vendorSha256` hash.
513
514- The `gnome-passwordsafe` package updated to [version 6.x](https://gitlab.gnome.org/World/secrets/-/tags/6.0) and renamed to `gnome-secrets`.
515
516- `services.gnome.experimental-features.realtime-scheduling` option has been removed, as GNOME Shell now [uses rtkit](https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/2060). Use `security.rtkit.enable = true;` instead. As before, you will need to have it enabled using GSettings.
517
518- `services.telepathy` will no longer be enabled by default for GNOME desktops, one should enable it in their configs if using Empathy or Polari.
519
520- If you previously used `/etc/docker/daemon.json`, you need to incorporate the changes into the new option `virtualisation.docker.daemon.settings`.
521
522- Ntopng (`services.ntopng`) is updated to 5.2.1 and uses a separate Redis instance if `system.stateVersion` is at least `22.05`. Existing setups shouldn't be affected.
523
524- The backward compatibility in `services.wordpress` to configure sites with
525 the old interface has been removed. Please use `services.wordpress.sites`
526 instead.
527
528- The backward compatibility in `services.dokuwiki` to configure sites with the
529 old interface has been removed. Please use `services.dokuwiki.sites` instead.
530
531- opensmtpd-extras is no longer build with python2 scripting support due to python2 deprecation in nixpkgs
532
533- `services.miniflux.adminCredentialFiles` is now required, instead of defaulting to `admin` and `password`.
534
535- The `taskserver` module no longer implicitly opens ports in the firewall
536 configuration. This is now controlled through the option
537 `services.taskserver.openFirewall`.
538
539- The `autorestic` package has been upgraded from 1.3.0 to 1.5.0 which introduces breaking changes in config file, check [their migration guide](https://autorestic.vercel.app/migration/1.4_1.5) for more details.
540
541- `teleport` has been upgraded to major version 9. Please see upstream [upgrade instructions](https://goteleport.com/docs/setup/operations/upgrading/) and [release notes](https://goteleport.com/docs/changelog/#900).
542
543- For `pkgs.python3.pkgs.ipython`, its direct dependency `pkgs.python3.pkgs.matplotlib-inline`
544 (which is really an adapter to integrate matplotlib in ipython if it is installed) does
545 not depend on `pkgs.python3.pkgs.matplotlib` anymore.
546 This is closer to a non-Nix install of ipython.
547 This has the added benefit to reduce the closure size of `ipython` from ~400MB to ~160MB
548 (including ~100MB for python itself).
549
550- `documentation.man` has been refactored to support choosing a man implementation other than GNU's `man-db`. For this, `documentation.man.manualPages` has been renamed to `documentation.man.man-db.manualPages`. If you want to use the new alternative man implementation `mandoc`, add `documentation.man = { enable = true; man-db.enable = false; mandoc.enable = true; }` to your configuration.
551
552- Normal users (with `isNormalUser = true`) which have non-empty `subUidRanges` or `subGidRanges` set no longer have additional implicit ranges allocated. To enable automatic allocation back set `autoSubUidGidRange = true`.
553
554- `idris2` now requires `--package` when using packages `contrib` and `network`, while previously these idris2 packages were automatically loaded.
555
556- The iputils package, which is installed by default, no longer provides the
557 legacy tools `tftpd` and `traceroute6`. More tools (`ninfod`, `rarpd`, and
558 `rdisc`) are going to be removed in the next release. See
559 [upstream's release notes](https://github.com/iputils/iputils/releases/tag/20211215)
560 for more details and available replacements.
561
562- `services.thelounge.private` was removed in favor of `services.thelounge.public`, to follow with upstream changes.
563
564- `pkgs.docbookrx` was removed since it's unmaintained
565
566- `pkgs._7zz` is now correctly licensed as LGPL3+ and BSD3 with optional unfree unRAR licensed code
567
568- The `vim.customize` function produced by `vimUtils.makeCustomizable` now has a slightly different interface:
569 * The wrapper now includes everything in the given Vim derivation if `name` is `"vim"` (the default). This makes the `wrapManual` argument obsolete, but this behavior can be overridden by setting the `standalone` argument.
570 * All the executables present in the given derivation (or, in `standalone` mode, only the `*vim` ones) are wrapped. This makes the `wrapGui` argument obsolete.
571 * The `vimExecutableName` and `gvimExecutableName` arguments were replaced by a single `executableName` argument in which the shell variable `$exe` can be used to refer to the wrapped executable's name.
572
573 See the comments in `pkgs/applications/editors/vim/plugins/vim-utils.nix` for more details.
574
575 `vimUtils.vimWithRC` was removed. You should instead use `customize` on a Vim derivation, which now accepts `vimrcFile` and `gvimrcFile` arguments.
576
577- `tilp2` was removed together with its module
578
579- The F-PROT antivirus (`fprot` package) and its service module were removed because it
580 reached [end-of-life](https://kb.cyren.com/av-support/index.php?/Knowledgebase/Article/View/434/0/end-of-sale--end-of-life-for-f-prot-and-csam).
581
582- `bird1` and its modules `services.bird` as well as `services.bird6` have been removed. Upgrade to `services.bird2`.
583
584- The options `networking.interfaces.<name>.ipv4.routes` and `networking.interfaces.<name>.ipv6.routes` are no longer ignored when using networkd instead of the default scripted network backend by setting `networking.useNetworkd` to `true`.
585
586- The `miller` package has been upgraded from 5.10.3 to [6.2.0](https://github.com/johnkerl/miller/releases/tag/v6.2.0). See [What's new in Miller 6](https://miller.readthedocs.io/en/latest/new-in-miller-6).
587
588- MultiMC has been replaced with the fork PrismLauncher due to upstream
589 developers being hostile to 3rd party package maintainers. PrismLauncher
590 removes all MultiMC branding and is aimed at providing proper 3rd party
591 packages like the one contained in Nixpkgs. This change affects the data
592 folder where game instances and other save and configuration files are stored.
593 Users with existing installations should rename `~/.local/share/multimc` to
594 `~/.local/share/PrismLauncher`. The main config file's path has also moved
595 from `~/.local/share/multimc/multimc.cfg` to
596 `~/.local/share/PrismLauncher/prismlauncher.cfg`.
597
598- `systemd-nspawn@.service` settings have been reverted to the default systemd behaviour. User namespaces are now activated by default. If you want to keep running nspawn containers without user namespaces you need to set `systemd.nspawn.<name>.execConfig.PrivateUsers = false`
599
600- `systemd-shutdown` is now properly linked on shutdown to unmount all filesystems and device mapper devices cleanly. This can be disabled using `systemd.shutdownRamfs.enable`.
601
602- The Tor SOCKS proxy is now actually disabled if `services.tor.client.enable` is set to `false` (the default). If you are using this functionality but didn't change the setting or set it to `false`, you now need to set it to `true`.
603
604- `services.github-runner` has been hardened. Notably address families and
605 system calls have been restricted, which may adversely affect some kinds of
606 testing, e.g. using `AF_BLUETOOTH` to test bluetooth devices.
607
608- The terraform 0.12 compatibility has been removed and the `terraform.withPlugins` and `terraform-providers.mkProvider` implementations simplified. Providers now need to be stored under
609`$out/libexec/terraform-providers/<registry>/<owner>/<name>/<version>/<os>_<arch>/terraform-provider-<name>_v<version>` (which mkProvider does).
610
611 This breaks back-compat so it's not possible to mix-and-match with previous versions of nixpkgs. In exchange, it now becomes possible to use the providers from [nixpkgs-terraform-providers-bin](https://github.com/numtide/nixpkgs-terraform-providers-bin) directly.
612
613- The `dendrite` package has been upgraded from 0.5.1 to
614 [0.6.5](https://github.com/matrix-org/dendrite/releases/tag/v0.6.5). Instances
615 configured with split sqlite databases, which has been the default
616 in NixOS, require merging of the federation sender and signing key
617 databases. See upstream [release
618 notes](https://github.com/matrix-org/dendrite/releases/tag/v0.6.0)
619 on version 0.6.0 for details on database changes.
620
621- The existing `pkgs.opentelemetry-collector` has been moved to
622 `pkgs.opentelemetry-collector-contrib` to match the actual source being the
623 "contrib" edition. `pkgs.opentelemetry-collector` is now the actual core
624 release of opentelemetry-collector. If you use the community contributions
625 you should change the package you refer to. If you don't need them update your
626 commands from `otelcontribcol` to `otelcorecol` and enjoy a 7x smaller binary.
627
628- `services.zookeeper` has a new option `jre` for specifying the JRE to start
629 zookeeper with. It defaults to the JRE that `pkgs.zookeeper` was wrapped with,
630 instead of `pkgs.jre`. This changes the JRE to `pkgs.jdk11_headless` by default.
631
632- `pkgs.pgadmin` now refers to `pkgs.pgadmin4`. `pgadmin3` has been removed.
633
634- `pkgs.minetestclient_4` and `pkgs.minetestserver_4` have been removed, as the last 4.x release was in 2018. `pkgs.minetestclient` (equivalent to `pkgs.minetest` ) and `pkgs.minetestserver` can be used instead.
635
636- `pkgs.noto-fonts-cjk` is now deprecated in favor of `pkgs.noto-fonts-cjk-sans`
637 and `pkgs.noto-fonts-cjk-serif` because they each have different release
638 schedules. To maintain compatibility with prior releases of Nixpkgs,
639 `pkgs.noto-fonts-cjk` is currently an alias of `pkgs.noto-fonts-cjk-sans` and
640 doesn't include serif fonts.
641
642- `pkgs.epgstation` has been upgraded from v1 to v2, resulting in incompatible
643 changes in the database scheme and configuration format.
644
645- Some top-level settings under [services.epgstation](#opt-services.epgstation.enable)
646 is now deprecated because it was redundant due to the same options being
647 present in [services.epgstation.settings](#opt-services.epgstation.settings).
648
649- The option `services.epgstation.basicAuth` was removed because basic
650 authentication support was dropped by upstream.
651
652- The option [services.epgstation.database.passwordFile](#opt-services.epgstation.database.passwordFile)
653 no longer has a default value. Make sure to set this option explicitly before
654 upgrading. Change the database password if necessary.
655
656- The [services.epgstation.settings](#opt-services.epgstation.settings)
657 option now expects options for `config.yml` in EPGStation v2.
658
659- Existing data for the [services.epgstation](#opt-services.epgstation.enable)
660 module would have to be backed up prior to the upgrade. To back up existing
661 data to `/tmp/epgstation.bak`, run
662 `sudo -u epgstation epgstation run backup /tmp/epgstation.bak`.
663 To import that data after to the upgrade, run
664 `sudo -u epgstation epgstation run v1migrate /tmp/epgstation.bak`
665
666- `switch-to-configuration` (the script that is run when running `nixos-rebuild switch` for example) has been reworked
667 * The interface that allows activation scripts to restart units has been streamlined. Restarting and reloading is now done by a single file `/run/nixos/activation-restart-list` that honors `restartIfChanged` and `reloadIfChanged` of the units.
668 * Preferring to reload instead of restarting can still be achieved using `/run/nixos/activation-reload-list`.
669 * The script now uses a proper ini-file parser to parse systemd units. Some values are now only searched in one section instead of in the entire unit. This is only relevant for units that don't use the NixOS systemd moule.
670 * `RefuseManualStop`, `X-OnlyManualStart`, `X-StopOnRemoval`, `X-StopOnReconfiguration` are only searched in the `[Unit]` section
671 * `X-ReloadIfChanged`, `X-RestartIfChanged`, `X-StopIfChanged` are only searched in the `[Service]` section
672
673- The `services.bookstack.cacheDir` option has been removed, since the
674 cache directory is now handled by systemd.
675
676- The `services.bookstack.extraConfig` option has been replaced by
677 `services.bookstack.config` which implements a
678 [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)
679 configuration.
680
681- `lib.assertMsg` and `lib.assertOneOf` no longer return `false` if the passed condition is `false`, `throw`ing the given error message instead (which makes the resulting error message less cluttered). This will not impact the behaviour of code using these functions as intended, namely as top-level wrapper for `assert` conditions.
682
683- The `vpnc` package has been changed to use GnuTLS instead of OpenSSL by default for licensing reasons.
684
685- The default version of `nextcloud` is **nextcloud24**. Please note that it's **not** possible to upgrade
686 `nextcloud` across multiple major versions! This means it's e.g. not possible to upgrade from `nextcloud22`
687 to `nextcloud24` in a single deploy and most `21.11` users will have to upgrade to `nextcloud23` first.
688
689- `pkgs.vimPlugins.onedark-nvim` now refers to [navarasu/onedark.nvim](https://github.com/navarasu/onedark.nvim)
690 (formerly refers to [olimorris/onedarkpro.nvim](https://github.com/olimorris/onedarkpro.nvim)).
691
692- `services.pipewire.enable` will default to enabling the WirePlumber session manager instead of pipewire-media-session.
693 pipewire-media-session is deprecated by upstream and not recommended, but can still be manually enabled by setting
694 `services.pipewire.media-session.enable` to `true` and `services.pipewire.wireplumber.enable` to `false`.
695
696- `pkgs.makeDesktopItem` has been refactored to provide a more idiomatic API. Specifically:
697 - All valid options as of FDO Desktop Entry specification version 1.4 can now be passed in as explicit arguments
698 - `exec` can now be null, for entries that are not of type Application
699 - `mimeType` argument is renamed to `mimeTypes` for consistency
700 - `mimeTypes`, `categories`, `implements`, `keywords`, `onlyShowIn` and `notShowIn` take lists of strings instead of one string with semicolon separators
701 - `extraDesktopEntries` renamed to `extraConfig` for consistency
702 - Actions should now be provided as an attrset `actions`, the `Actions` line will be autogenerated.
703 - `extraEntries` is removed.
704 - Additional validation is added both at eval time and at build time.
705
706 See the `vscode` package for a more detailed example.
707
708- Existing `resholve*` functions have been renamed and nested under `pkgs.resholve`. Update uses to:
709 - `resholvePackage` -> `resholve.mkDerivation`
710 - `resholveScript` -> `resholve.writeScript`
711 - `resholveScriptBin` -> `resholve.writeScriptBin`
712
713- `pkgs.cosmopolitan` no longer provides the `cosmoc` command. It has been moved to `pkgs.cosmoc`.
714
715- `pkgs.graalvmXX-ce` packages no longer provide support for Python/Ruby/WASM, instead focusing only in Java and Native Image Support. If you need to add support back, please see the `pkgs.graalvmCEPackages.mkGraal` function to create your own customized version of GraalVM with support for what you need.
716
717<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
718
719## Other Notable Changes {#sec-release-22.05-notable-changes}
720
721- The option [services.redis.servers](#opt-services.redis.servers) was added
722 to support per-application `redis-server` which is more secure since Redis databases
723 are only mere key prefixes without any configuration or ACL of their own.
724 Backward-compatibility is preserved by mapping old `services.redis.settings`
725 to `services.redis.servers."".settings`, but you are strongly encouraged
726 to name each `redis-server` instance after the application using it,
727 instead of keeping that nameless one.
728 Except for the nameless `services.redis.servers.""`
729 still accessible at `127.0.0.1:6379`,
730 and to the members of the Unix group `redis`
731 through the Unix socket `/run/redis/redis.sock`,
732 all other `services.redis.servers.${serverName}`
733 are only accessible by default
734 to the members of the Unix group `redis-${serverName}`
735 through the Unix socket `/run/redis-${serverName}/redis.sock`.
736
737- The option [virtualisation.vmVariant](#opt-virtualisation.vmVariant) was added
738 to allow users to make changes to the `nixos-rebuild build-vm` configuration
739 that do not apply to their normal system.
740
741 The `config.system.build.vm` attribute now always exists and defaults to the
742 value from `vmVariant`. Configurations that import the `virtualisation/qemu-vm.nix`
743 module themselves will override this value, such that `vmVariant` is not used.
744
745 Similarly [virtualisation.vmVariantWithBootloader](#opt-virtualisation.vmVariantWithBootLoader) was added.
746
747- The configuration portion of the `nix-daemon` module has been reworked and exposed as [nix.settings](options.html#opt-nix-settings):
748 * Legacy options have been mapped to the corresponding options under under [nix.settings](options.html#opt-nix.settings) and will be deprecated when NixOS 21.11 reaches end of life.
749 * [nix.buildMachines.publicHostKey](options.html#opt-nix.buildMachines.publicHostKey) has been added.
750
751- [`kops`](https://kops.sigs.k8s.io) defaults to 1.23.2, which will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes >= 1.22. This will increase security by default, but may break some types of workloads. The default behaviour for `spec.kubeDNS.nodeLocalDNS.forwardToKubeDNS` has changed from `true` to `false`. Cilium now has `disable-cnp-status-updates: true` by default. Set this to false if you rely on the CiliumNetworkPolicy status fields. Support for Kubernetes 1.17, the Lyft CNI, Weave CNI on Kubernetes >= 1.23, CentOS 7 and 8, Debian 9, RHEL 7, and Ubuntu 16.05 (Xenial) has been removed. See the [1.22 release notes](https://kops.sigs.k8s.io/releases/1.22-notes/) and [1.23 release notes](https://kops.sigs.k8s.io/releases/1.23-notes/) for more details, including other significant changes.
752
753- Mattermost has been upgraded to extended support version 6.3 as the previously
754 packaged extended support version 5.37 is [reaching end of life](https://docs.mattermost.com/upgrade/extended-support-release.html).
755 Migration may take some time, see the [changelog](https://docs.mattermost.com/install/self-managed-changelog.html#release-v6-3-extended-support-release)
756 and [important upgrade notes](https://docs.mattermost.com/upgrade/important-upgrade-notes.html).
757
758- The `writers.writePyPy2`/`writers.writePyPy3` and corresponding `writers.writePyPy2Bin`/`writers.writePyPy3Bin` convenience functions to create executable Python 2/3 scripts using the PyPy interpreter were added.
759
760- Some improvements have been made to the `hadoop` module:
761 - A `gatewayRole` option has been added, for deploying hadoop cluster configuration files to a node that does not have any active services
762 - Support for older versions of hadoop have been added to the module
763 - Overriding and extending site XML files has been made easier
764
765- The auto-upgrade service now accepts persistent (default: true) parameter.
766 By default auto-upgrade will now run immediately if it would have been triggered at least
767 once during the time when the timer was inactive.
768
769- Mastodon now uses `services.redis.servers` to start a new redis server, instead of using a global redis server.
770 This improves compatibility with other services that use redis.
771
772 Note that this will recreate the redis database, although according to the [Mastodon docs](https://docs.joinmastodon.org/admin/backups/),
773 this is almost harmless:
774 > Losing the Redis database is almost harmless: The only irrecoverable data will be the contents of the Sidekiq queues and scheduled retries of previously failed jobs.
775 > The home and list feeds are stored in Redis, but can be regenerated with tootctl.
776
777 If you do want to save the redis database, you can use the following commands:
778 ```bash
779 redis-cli save
780 cp /var/lib/redis/dump.rdb "/var/lib/redis-mastodon/dump.rdb"
781 ```
782- Peertube now uses services.redis.servers to start a new redis server, instead of using a global redis server.
783 This improves compatibility with other services that use redis.
784
785 Redis database is used for storage only cache and job queue. More information can be found here - [Peertube architecture](https://docs.joinpeertube.org/contribute-architecture).
786
787 If you do want to save the redis database, you can use the following commands before upgrade OS:
788 ```bash
789 redis-cli save
790 sudo mkdir /var/lib/redis-peertube
791 sudo cp /var/lib/redis/dump.rdb /var/lib/redis-peertube/dump.rdb
792 ```
793- Added the `keter` NixOS module. Keter reverse proxies requests to your loaded application based on virtual hostnames.
794
795- If you are using Wayland you can choose to use the Ozone Wayland support
796 in Chrome and several Electron apps by setting the environment variable
797 `NIXOS_OZONE_WL=1` (for example via
798 `environment.sessionVariables.NIXOS_OZONE_WL = "1"`).
799 This is not enabled by default because Ozone Wayland is
800 still under heavy development and behavior is not always flawless.
801 Furthermore, not all Electron apps use the latest Electron versions.
802
803- A new option group `systemd.network.wait-online` was added, with options to configure `systemd-networkd-wait-online.service`:
804 - `anyInterface` allows specifying that the network should be considered online when *at least one* interface is online (useful on laptops)
805 - `timeout` defines how long to wait for the network to come online
806 - `extraArgs` for everything else
807
808- The `influxdb2` package was split into `influxdb2-server` and
809 `influxdb2-cli`, matching the split that took place upstream. A
810 combined `influxdb2` package is still provided in this release for
811 backwards compatibility, but will be removed at a later date.
812
813- The `unifi` package was switched from `unifi6` to `unifi7`.
814 Direct downgrades from Unifi 7 to Unifi 6 are not possible and require restoring from a backup made by Unifi 6.
815
816- `programs.zsh.autosuggestions.strategy` now takes a list of strings instead of a string.
817
818- The `asterisk` and `asterisk-stable` packages were switched from `asterisk_18` to the newly-packaged `asterisk_19`. Asterisk 13 and 17 have been removed as they have reached their end of life.
819
820- The `services.unifi.openPorts` option default value of `true` is now deprecated and will be changed to `false` in 22.11.
821 Configurations using this default will print a warning when rebuilt.
822
823- The `services.unifi-video.openPorts` option default value of `true` is now deprecated and will be changed to `false` in 22.11.
824 Configurations using this default will print a warning when rebuilt.
825
826- `security.acme` certificates will now correctly check for CA
827 revocation before reaching their minimum age.
828
829- Removing domains from `security.acme.certs._name_.extraDomainNames`
830 will now correctly remove those domains during rebuild/renew.
831
832- MariaDB is now offered in several versions, not just the newest one.
833 So if you have a need for running MariaDB 10.4 for example, you can now just set `services.mysql.package = pkgs.mariadb_104;`.
834 In general, it is recommended to run the newest version, to get the newest features, while sticking with an LTS version will most likely provide a more stable experience.
835 Sometimes software is also incompatible with the newest version of MariaDB.
836
837- The option
838 [programs.ssh.enableAskPassword](#opt-programs.ssh.enableAskPassword) was
839 added, decoupling the setting of `SSH_ASKPASS` from
840 `services.xserver.enable`. This allows easy usage in non-X11 environments,
841 e.g. Wayland.
842
843- [programs.ssh.knownHosts](#opt-programs.ssh.knownHosts) has gained an `extraHostNames`
844 option to augment `hostNames`. It is now possible to use the attribute name of a `knownHosts`
845 entry as the primary host name and specify secondary host names using `extraHostNames` without
846 having to duplicate the primary host name.
847
848- The `services.stubby` module was converted to a [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.
849
850- The option
851 [services.xserver.desktopManager.runXdgAutostartIfNone](#opt-services.xserver.desktopManager.runXdgAutostartIfNone)
852 was added in order to automatically run XDG autostart files for sessions without a desktop manager.
853 This replaces helpers like the `dex` package.
854
855- When setting [i18n.inputMethod.enabled](#opt-i18n.inputMethod.enabled) to `fcitx5`,
856 it no longer creates corresponding systemd user services.
857 It now relies on XDG autostart files to start and work properly in your desktop sessions.
858 If you are using only a window manager without a desktop manager, you need to enable
859 `services.xserver.desktopManager.runXdgAutostartIfNone` or using the `dex` package to make `fcitx5` work.
860
861
862- The option `services.duplicati.dataDir` has been added to allow changing the location of duplicati's files.
863
864- The options `boot.extraModprobeConfig` and `boot.blacklistedKernelModules` now also take effect in the initrd by copying the file `/etc/modprobe.d/nixos.conf` into the initrd.
865
866- `nixos-generate-config` now puts the dhcp configuration in `hardware-configuration.nix` instead of `configuration.nix`.
867
868- ORY Kratos was updated to version 0.9.0-alpha.3, which introduces some breaking changes:
869 - All endpoints at the Admin API are now exposed at `/admin/`. For example, endpoint `https://kratos:4434/identities` is now exposed at `https://kratos:4434/admin/identities`
870 - Configuration key `selfservice.whitelisted_return_urls` has been renamed to `allowed_return_urls`
871 - The `password_identifier` form field of the password login strategy has been renamed to `identifier` to make compatibility with passwordless flows possible.
872 - Instead of having a global `default_schema_url` which developers used to update their schema, you now need to define the `default_schema_id` which must reference schema ID in your config.
873 - Calling `/self-service/recovery` without flow ID or with an invalid flow ID while authenticated will now respond with an error instead of redirecting to the default page.
874 - If you are relying on the SQLite images, update your Docker Pull commands as follows:
875 - `docker pull oryd/kratos:{version}`
876 - Additionally, all passwords now have to be at least 8 characters long.
877 - For more details, see:
878 - [Release Notes for v0.8.1-alpha-1](https://github.com/ory/kratos/releases/tag/v0.8.1-alpha.1)
879 - [Release Notes for v0.8.2-alpha-1](https://github.com/ory/kratos/releases/tag/v0.8.2-alpha.1)
880 - [Release Notes for v0.9.0-alpha-1](https://github.com/ory/kratos/releases/tag/v0.9.0-alpha.1)
881 - [Release Notes for v0.9.0-alpha-3](https://github.com/ory/kratos/releases/tag/v0.9.0-alpha.3)
882
883
884- `fetchFromSourcehut` now allows fetching repositories recursively
885 using `fetchgit` or `fetchhg` if the argument `fetchSubmodules`
886 is set to `true`.
887
888- A module for declarative configuration of openconnect VPN profiles was added under `networking.openconnect`.
889
890- The `element-desktop` package now has an `useKeytar` option (defaults to `true`),
891 which allows disabling `keytar` and in turn `libsecret` usage
892 (which binds to native credential managers / keychain libraries).
893
894- The option `services.thelounge.plugins` has been added to allow installing plugins for The Lounge. Plugins can be found in `pkgs.theLoungePlugins.plugins` and `pkgs.theLoungePlugins.themes`.
895
896- The option `services.xserver.videoDriver = [ "nvidia" ];` will now also install [nvidia VA-API drivers](https://github.com/elFarto/nvidia-vaapi-driver) by default.
897
898- The `firmwareLinuxNonfree` package has been renamed to `linux-firmware`.
899
900- It is now possible to specify wordlists to include as handy to access environment variables using the `config.environment.wordlist` configuration options.
901
902- The `services.mbpfan` module was converted to a [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.
903
904- The default value for `programs.spacefm.settings.graphical_su` got unset. It previously pointed to `gksu` which has been removed.
905
906- The [Dino](https://dino.im) XMPP client was updated to 0.3, adding support for audio and video calls.
907
908- `services.mattermost.plugins` has been added to allow the declarative installation of Mattermost plugins.
909 Plugins are automatically repackaged using autoPatchelf.
910
911- [services.logrotate.enable](#opt-services.logrotate.enable) now defaults to true if any rotate path has
912 been defined, and some paths have been added by default.
913- The logrotate module also has been updated to freeform syntax: `services.logrotate.paths`
914 and `services.logrotate.extraConfig` will work, but issue deprecation
915 warnings and [services.logrotate.settings](#opt-services.logrotate.settings) should now be used instead.
916
917- `security.pam.ussh` has been added, which allows authorizing PAM sessions based on SSH _certificates_ held within an SSH agent, using [pam-ussh](https://github.com/uber/pam-ussh).
918
919- The `vscode-extensions.ionide.ionide-fsharp` package has been updated to 6.0.0 and now requires .NET 6.0.
920
921- The `phpPackages.box` package has been updated from 2.7.5 to 3.16.0. See the [upgrade guide](https://github.com/box-project/box/blob/master/UPGRADE.md#from-27-to-30) for more details.
922
923- The `zrepl` package has been updated from 0.4.0 to 0.5:
924
925 - The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume.
926 - A bug involving encrypt-on-receive has been fixed. Read the [zrepl documentation](https://zrepl.github.io/configuration/sendrecvoptions.html#job-recv-options-placeholder) and check the output of `zfs get -r encryption,zrepl:placeholder PATH_TO_ROOTFS` on the receiver.
927
928- The `polybar` package has been updated from 3.5.7 to 3.6.2. See [the changelog](https://github.com/polybar/polybar/releases/tag/3.6.0) for more details.
929 - Breaking changes include changes to escaping rules in configuration values, changes in behavior when encountering invalid tag names, and changes to inter-process-messaging (IPC).
930
931- Renamed option `services.openssh.challengeResponseAuthentication` to `services.openssh.kbdInteractiveAuthentication`.
932 Reason is that the old name has been deprecated upstream.
933 Using the old option name will still work, but produce a warning.
934
935- `services.autorandr` now allows for adding hooks and profiles declaratively.
936
937- The `pomerium-cli` command has been moved out of the `pomerium` package into
938 the `pomerium-cli` package, following upstream's repository split. If you are
939 using the `pomerium-cli` command, you should now install the `pomerium-cli`
940 package.
941
942- The option `services.networking.networkmanager.enableFccUnlock`
943 was added to support FCC unlock procedures. Since release 1.18.4, the ModemManager
944 daemon no longer automatically performs the FCC unlock procedure by default. See
945 [the docs](https://modemmanager.org/docs/modemmanager/fcc-unlock/) for more details.
946
947- `programs.tmux` has a new option `plugins` that accepts a list of packages from the `tmuxPlugins` group. The specified packages are added to the system and loaded by `tmux`.
948
949- The polkit service, available at `security.polkit.enable`, is now disabled by default. It will automatically be enabled through services and desktop environments as needed.
950
951- `mercury` was updated to 22.01.1, which has some breaking changes ([Mercury 22.01 news](https://dl.mercurylang.org/release/release-notes-22.01.html)).
952
953- xfsprogs was update to version 5.15, which enables inobtcount and bigtime by default on filesystem creation. Support for these features was added in kernel 5.10 and deemed stable in kernel 5.15.
954 If you want to be able to mount XFS filesystems created with this release of xfsprogs on kernel releases older than 5.10, you need to format them with `mkfs.xfs -m bigtime=0 -m inobtcount=0`.
955
956- `services.xserver.desktopManager.xfce` now includes Xfce's screen locker, `xfce4-screensaver` that is enabled by default. You can disable it by setting `false` to [services.xserver.desktopManager.xfce.enableScreensaver](#opt-services.xserver.desktopManager.xfce.enableScreensaver).
957
958- The `hadoop` package has added support for `aarch64-linux` and `aarch64-darwin` as of 3.3.1 ([#158613](https://github.com/NixOS/nixpkgs/pull/158613)).
959
960- The `R` package now builds again on `aarch64-darwin` ([#158992](https://github.com/NixOS/nixpkgs/pull/158992)).
961
962- The `nss` package was split into `nss_esr` and `nss_latest`, with `nss` being an alias for `nss_esr`. This was done to ease maintenance of `nss` and dependent high-profile packages like `firefox`.
963
964- The default `scribus` version is now 1.5, while version 1.4 is still available as `scribus_1_4` ([#172700](https://github.com/NixOS/nixpkgs/pull/172700)).
965
966- The Nextcloud module now supports to create a Mysql database automatically
967 with `services.nextcloud.database.createLocally` enabled.
968
969- The Nextcloud module now allows setting the value of the `max-age` directive of the `Strict-Transport-Security` HTTP header, which is now controlled by the `services.nextcloud.https` option, rather than `services.nginx.recommendedHttpHeaders`.
970
971- The `spark3` package has been updated from 3.1.2 to 3.2.1 ([#160075](https://github.com/NixOS/nixpkgs/pull/160075)):
972
973 - Testing has been enabled for `aarch64-linux` in addition to `x86_64-linux`.
974 - The `spark3` package is now usable on `aarch64-darwin` as a result of [#158613](https://github.com/NixOS/nixpkgs/pull/158613) and [#158992](https://github.com/NixOS/nixpkgs/pull/158992).
975
976- The option `services.snapserver.openFirewall` will no longer default to
977 `true` starting with NixOS 22.11. Enable it explicitly if you need to control
978 Snapserver remotely or connect streamig clients from other hosts.
979
980- The option [networking.useDHCP](options.html#opt-networking.useDHCP) isn't deprecated anymore.
981 When using [`systemd-networkd`](options.html#opt-networking.useNetworkd), a generic
982 `.network`-unit is added which enables DHCP for each interface matching `en*`, `eth*`
983 or `wl*` with priority 99 (which means that it doesn't have any effect if such an interface is matched
984 by a `.network-`unit with a lower priority). In case of scripted networking, no behavior
985 was changed.
986
987- The new [`postgresqlTestHook`](https://nixos.org/manual/nixpkgs/stable/#sec-postgresqlTestHook) runs a PostgreSQL server for the duration of package checks.
988
989- `zfs` was updated from 2.1.4 to 2.1.5, enabling it to be used with Linux kernel 5.18.
990
991- `stdenv.mkDerivation` now supports a self-referencing `finalAttrs:` parameter
992 containing the final `mkDerivation` arguments including overrides.
993 `drv.overrideAttrs` now supports two parameters `finalAttrs: previousAttrs:`.
994 This allows packaging configuration to be overridden in a consistent manner by
995 providing an alternative to `rec {}` syntax.
996
997 Additionally, `passthru` can now reference `finalAttrs.finalPackage` containing
998 the final package, including attributes such as the output paths and
999 `overrideAttrs`.
1000
1001 New language integrations can be simplified by overriding a "prototype"
1002 package containing the language-specific logic. This removes the need for a
1003 extra layer of overriding for the "generic builder" arguments, thus removing a
1004 usability problem and source of error.
1005
1006<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->