pyrox.dev
1# Release 22.11 (“Raccoon”, 2022.11/30) {#sec-release-22.11}
2
3The NixOS release team is happy to announce a new version of NixOS 22.11. NixOS is a Linux distribution, whose set of packages can also be used on other Linux systems and macOS.
4
5This release is supported until the end of June 2023, handing over to NixOS 23.05.
6
7To upgrade to the latest release follow the [upgrade chapter](#sec-upgrading).
8
9## Highlights {#sec-release-22.11-highlights}
10
11In addition to numerous new and upgraded packages, this release includes the following highlights:
12
13- Software that uses the `crypt` password hashing API is now using the implementation provided by [`libxcrypt`](https://github.com/besser82/libxcrypt) instead of glibc's, which enables support for more secure algorithms.
14 - Support for algorithms that `libxcrypt` [does not consider strong](https://github.com/besser82/libxcrypt/blob/v4.4.28/lib/hashes.conf#L41) are **deprecated** as of this release, and will be removed in NixOS 23.05.
15 - This includes system login passwords. Given this, we **strongly encourage** all users to update their system passwords, as you will be unable to login if password hashes are not migrated by the time their support is removed.
16 - When using `users.users.<name>.hashedPassword` to configure user passwords, run `mkpasswd`, and use the yescrypt hash that is provided as the new value.
17 - On the other hand, for interactively configured user passwords, re-set the passwords for all users with `passwd`.
18 - This release introduces warnings for the use of deprecated hash algorithms for both methods of configuring passwords. To make sure you migrated correctly, run `nixos-rebuild switch`.
19
20- The NixOS documentation is now generated from markdown. While docbook is still part of the documentation build process, it's a big step towards the full migration.
21
22- `aarch64-linux` is now included in the `nixos-22.11` and `nixos-22.11-small` channels. This means that when those channel update, both `x86_64-linux` and `aarch64-linux` will be available in the binary cache.
23
24- `aarch64-linux` ISOs are now available on the [downloads page](https://nixos.org/download.html).
25
26- `nsncd` is now available as a replacement of `nscd`.
27
28 `nscd` is responsible for resolving hostnames, users and more in NixOS and has been a long standing source of bugs, such as sporadic network freezes.
29
30 More context in this [issue](https://github.com/NixOS/nixpkgs/issues/135888).
31
32 Help us test the new implementation by setting `services.nscd.enableNsncd` to `true`.
33
34 We plan to use `nsncd` by default in NixOS 23.05.
35
36- Linode cloud images are now supported by importing `${modulesPath}/virtualisation/linode-image.nix` and accessing `system.build.linodeImage` on the output.
37
38- `hardware.nvidia` has a new option, `hardware.nvidia.open`, that can be used to enable the usage of NVIDIA's open-source kernel driver. Note that the driver's support for GeForce and Workstation GPUs is still alpha quality, see [the release announcement](https://developer.nvidia.com/blog/nvidia-releases-open-source-gpu-kernel-modules/) for more information.
39
40- The `emacs` package now makes use of native compilation which means:
41 - Emacs packages from Nixpkgs, builtin or not, will do native compilation ahead of time so you can enjoy the benefit of native compilation without compiling them on you machine;
42 - Emacs packages from somewhere else, e.g. `package-install`, will perform asynchronously deferred native compilation. If you do not want this, maybe to avoid CPU consumption for compilation, you can use `(setq native-comp-deferred-compilation nil)` to disable it while still benefiting from native compilation for packages from Nixpkgs.
43
44## Internal changes {#sec-release-22.11-internal}
45
46- Haskell `ghcWithPackages` is now up to 15 times faster to evaluate, thanks to changing `lib.closePropagation` from a quadratic to linear complexity. Please see backward incompatibilities notes below. <https://github.com/NixOS/nixpkgs/pull/194391>
47
48- For cross-compilation targets that can also run on the building machine, we now run tests. This, for example, is the case for the `pkgsStatic` and `pkgsLLVM` package sets or i686 packages on `x86_64` machines.
49
50- To simplify cross-compilation in NixOS, this release introduces the `nixpkgs.hostPlatform` and `nixpkgs.buildPlatform` options. These cover and override the `nixpkgs.{system,localSystem,crossSystem}` options.
51
52 - `hostPlatform` is the platform or "`system`" string of the NixOS system
53 described by the configuration.
54 - `buildPlatform` is the platform that is responsible for building the NixOS
55 configuration. It defaults to the `hostPlatform`, for a non-cross
56 build configuration. To cross compile, set `buildPlatform` to a different
57 value.
58
59 The new options convey the same information, but with fewer options, and
60 following the Nixpkgs terminology.
61
62 The existing options `nixpkgs.{system,localSystem,crossSystem}` have not
63 been formally deprecated, to allow for evaluation of the change and to allow
64 for a transition period so that in time the ecosystem can switch without
65 breaking compatibility with any supported NixOS release.
66
67## Notable version updates {#sec-release-22.11-version-updates}
68
69- Nix has been upgraded from v2.8.1 to v2.11.0. For more information, please see the release notes for [2.9](https://nixos.org/manual/nix/stable/release-notes/rl-2.9.html), [2.10](https://nixos.org/manual/nix/stable/release-notes/rl-2.10.html) and [2.11](https://nixos.org/manual/nix/stable/release-notes/rl-2.11.html).
70
71- OpenSSL now defaults to OpenSSL 3, updated from 1.1.1.
72
73- GNOME has been upgraded to version 43. Please see the [release notes](https://release.gnome.org/43/) for details.
74
75- KDE Plasma has been upgraded from v5.24 to v5.26. Please see the release notes for [v5.25](https://kde.org/announcements/plasma/5/5.25.0/) and [v5.26](https://kde.org/announcements/plasma/5/5.26.0/) for more details on the included changes.
76
77- Cinnamon has been updated to 5.4, and the Cinnamon module now defaults to
78 Blueman as the Bluetooth manager and slick-greeter as the LightDM greeter, to match upstream.
79
80- PHP now defaults to PHP 8.1, updated from 8.0.
81
82- Perl has been updated to 5.36, and its core module `HTTP::Tiny` was patched to verify SSL/TLS certificates by default.
83
84- Python now defaults to 3.10, updated from 3.9.
85
86## Backward Incompatibilities {#sec-release-22.11-incompatibilities}
87
88- Nixpkgs now requires Nix 2.3 or newer.
89
90- The `isCompatible` predicate checking CPU compatibility is no longer exposed
91 by the platform sets generated using `lib.systems.elaborate`. In most cases
92 you will want to use the new `canExecute` predicate instead which also
93 takes the kernel / syscall interface into account.
94 `lib.systems.parse.isCompatible` still exists, but has changed semantically:
95 Architectures with differing endianness modes are *no longer considered compatible*.
96
97- `ngrok` has been upgraded from 2.3.40 to 3.0.4. Please see [the upgrade guide](https://ngrok.com/docs/guides/upgrade-v2-v3)
98 and [changelog](https://ngrok.com/docs/ngrok-agent/changelog). Notably, breaking changes are that the config file format has
99 changed and support for single hyphen arguments was dropped.
100
101- `i18n.supportedLocales` is now only generated with the locales set in `i18n.defaultLocale` and `i18n.extraLocaleSettings`.
102 - This reduces the final system closure size by up to 200MB.
103 - If you require all locales installed, set the option to ``[ "all" ]``.
104
105- Deprecated settings `logrotate.paths` and `logrotate.extraConfig` have
106 been removed. Please convert any uses to
107 [services.logrotate.settings](#opt-services.logrotate.settings) instead.
108
109- The `isPowerPC` predicate, found on `platform` attrsets (`hostPlatform`, `buildPlatform`, `targetPlatform`, etc) has been removed in order to reduce confusion. The predicate was was defined such that it matches only the 32-bit big-endian members of the POWER/PowerPC family, despite having a name which would imply a broader set of systems. If you were using this predicate, you can replace `foo.isPowerPC` with `(with foo; isPower && is32bit && isBigEndian)`.
110
111- The `fetchgit` fetcher now uses [cone mode](https://www.git-scm.com/docs/git-sparse-checkout/2.37.0#_internalscone_mode_handling) by default for sparse checkouts. [Non-cone mode](https://www.git-scm.com/docs/git-sparse-checkout/2.37.0#_internalsnon_cone_problems) can be enabled by passing `nonConeMode = true`, but note that non-cone mode is deprecated and this option may be removed alongside a future Git update without notice.
112
113- The `fetchgit` fetcher supports sparse checkouts via the `sparseCheckout` option. This used to accept a multi-line string with directories/patterns to check out, but now requires a list of strings.
114
115- `openssh` was updated to version 9.1, disabling the generation of DSA keys when using `ssh-keygen -A` as they are insecure. Also, `SetEnv` directives in `ssh_config` and `sshd_config` are now first-match-wins.
116
117- `bsp-layout` no longer uses the command `cycle` to switch to other window layouts, as it got replaced by the commands `previous` and `next`.
118
119- The Barco ClickShare driver/client package `pkgs.clickshare-csc1` and the option `programs.clickshare-csc1.enable` have been removed,
120 as it requires `qt4`, which reached its end-of-life 2015 and will no longer be supported by nixpkgs.
121 [According to Barco](https://www.barco.com/de/support/knowledge-base/4380-can-i-use-linux-os-with-clickshare-base-units) many of their base unit models can be used with Google Chrome and the Google Cast extension.
122
123- `services.hbase` has been renamed to `services.hbase-standalone`.
124 For production HBase clusters, use `services.hadoop.hbase` instead.
125
126- The `p4` package now only includes the open-source Perforce Helix Core command-line client and APIs. It no longer installs the unfree Helix Core Server binaries `p4d`, `p4broker`, and `p4p`. To install the Helix Core Server binaries, use the `p4d` package instead.
127
128- The OpenSSL extension for the PHP interpreter used by Nextcloud is built against OpenSSL 1.1 if
129 [](#opt-system.stateVersion) is below `22.11`. This is to make sure that people using [server-side encryption](https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/encryption_configuration.html)
130 don't lose access to their files.
131
132 In any other case, it's safe to use OpenSSL 3 for PHP's OpenSSL extension. This can be done by setting
133 `services.nextcloud.enableBrokenCiphersForSSE` to `false`.
134
135- The `coq` package and versioned variants starting at `coq_8_14` no
136 longer include CoqIDE, which is now available through
137 `coqPackages.coqide`. It is still possible to get CoqIDE as part of
138 the `coq` package by overriding the `buildIde` argument of the
139 derivation.
140
141- PHP 7.4 is no longer supported due to upstream not supporting this
142 version for the entire lifecycle of the 22.11 release.
143
144- The ipfs package and module were renamed to kubo. The kubo module now uses an RFC42-style `settings` option instead of `extraConfig` and the `gatewayAddress`, `apiAddress` and `swarmAddress` options were renamed. Using the old names will print a warning but still work.
145
146- `pkgs.cosign` does not provide the `cosigned` binary anymore. The `sget` binary has been moved into its own package.
147
148- Emacs now uses the Lucid toolkit by default instead of GTK because of stability and compatibility issues.
149 Users who still wish to remain using GTK can do so by using `emacs-gtk`.
150
151- `kanidm` has been updated to 1.1.0-alpha.10 and now requires a TLS certificate and key. It will always start `https` and-–-if enabled-–-an LDAPS server and no HTTP and LDAP server anymore.
152
153- riak package removed along with `services.riak` module, due to lack of maintainer to update the package.
154
155- ppd files in `pkgs.cups-drv-rastertosag-gdi` are now gzipped. If you refer to such a ppd file with its path (e.g. via [hardware.printers.ensurePrinters](options.html#opt-hardware.printers.ensurePrinters)) you will need to append `.gz` to the path.
156
157- xow package removed along with the `hardware.xow` module, due to the project being deprecated in favor of `xone`, which is available via the `hardware.xone` module.
158
159- dd-agent package removed along with the `services.dd-agent` module, due to the project being deprecated in favor of `datadog-agent`, which is available via the `services.datadog-agent` module.
160
161- `teleport` has been upgraded to major version 10. Please see upstream [upgrade instructions](https://goteleport.com/docs/ver/10.0/management/operations/upgrading/) and [release notes](https://goteleport.com/docs/ver/10.0/changelog/#1000).
162
163- `lib.closePropagation` now needs that all gathered sets have an `outPath` attribute.
164
165- lemmy module option `services.lemmy.settings.database.createLocally`
166 moved to `services.lemmy.database.createLocally`.
167
168- virtlyst package and `services.virtlyst` module removed, due to lack of maintainers.
169
170- The `nix.checkConfig` option now fully disables the config check. The new `nix.checkAllErrors` option behaves like `nix.checkConfig` previously did.
171
172- `generateOptparseApplicativeCompletions` and `generateOptparseApplicativeCompletion` from `haskell.lib.compose`
173 (and `haskell.lib`) have been deprecated in favor of `generateOptparseApplicativeCompletions` (plural!) as
174 provided by the haskell package sets (so `haskellPackages.generateOptparseApplicativeCompletions` etc.).
175 The latter allows for cross-compilation (by automatically disabling generation of completion in the cross case).
176 For it to work properly you need to make sure that the function comes from the same context as the package
177 you are trying to override, i.e. always use the same package set as your package is coming from or – even
178 better – use `self.generateOptparseApplicativeCompletions` if you are overriding a haskell package set.
179 The old functions are retained for backwards compatibility, but yield are warning.
180
181- The `services.graphite.api` and `services.graphite.beacon` NixOS options, and
182 the `python3.pkgs.graphite_api`, `python3.pkgs.graphite_beacon` and
183 `python3.pkgs.influxgraph` packages, have been removed due to lack of upstream
184 maintenance.
185
186- The `trace` binary from `perf-linux` package has been removed, due to being a duplicate of the `perf` binary.
187
188- The `aws` package has been removed due to being abandoned by the upstream. It is recommended to use `awscli` or `awscli2` instead.
189
190- The [CEmu TI-84 Plus CE emulator](https://ce-programming.github.io/CEmu) package has been renamed to `cemu-ti`. The [Cemu Wii U emulator](https://cemu.info) is now packaged as `cemu`.
191
192- `systemd-networkd` v250 deprecated, renamed, and moved some sections and settings which leads to the following breaking module changes:
193
194 * `systemd.network.networks.<name>.dhcpV6PrefixDelegationConfig` is renamed to `systemd.network.networks.<name>.dhcpPrefixDelegationConfig`.
195 * `systemd.network.networks.<name>.dhcpV6Config` no longer accepts the `ForceDHCPv6PDOtherInformation=` setting. Please use the `WithoutRA=` and `UseDelegatedPrefix=` settings in your `systemd.network.networks.<name>.dhcpV6Config` and the `DHCPv6Client=` setting in your `systemd.network.networks.<name>.ipv6AcceptRAConfig` to control when the DHCPv6 client is started and how the delegated prefixes are handled by the DHCPv6 client.
196 * `systemd.network.networks.<name>.networkConfig` no longer accepts the `IPv6Token=` setting. Use the `Token=` setting in your `systemd.network.networks.<name>.ipv6AcceptRAConfig` instead. The `systemd.network.networks.<name>.ipv6Prefixes.*.ipv6PrefixConfig` now also accepts the `Token=` setting.
197
198- `arangodb` versions 3.3, 3.4, and 3.5 have been removed because they are at EOL upstream. The default is now 3.10.0. Support for aarch64-linux has been removed since the target cannot be built reproducibly. By default `arangodb` is now built for the `haswell` architecture. If you wish to build for a different architecture, you may override the `targetArchitecture` argument with a value from [this list supported upstream](https://github.com/arangodb/arangodb/blob/207ec6937e41a46e10aea34953879341f0606841/cmake/OptimizeForArchitecture.cmake#L594). Some architecture specific optimizations are also conditionally enabled. You may alter this behavior by overriding the `asmOptimizations` parameter. You may also add additional architecture support by adding more `-DHAS_XYZ` flags to `cmakeFlags` via `overrideAttrs`.
199
200- The `meta.mainProgram` attribute of packages in `wineWowPackages` now defaults to `"wine64"`.
201
202- The `paperless` module now defaults `PAPERLESS_TIME_ZONE` to your configured system timezone.
203
204- The top-level `termonad-with-packages` alias for `termonad` has been removed.
205
206- Linux 4.9 has been removed because it will reach its end of life within the lifespan of 22.11.
207
208- (Neo)Vim can not be configured with `configure.pathogen` anymore to reduce maintenance burden.
209 Use `configure.packages` instead.
210- Neovim can not be configured with plug anymore (still works for vim).
211
212- The `adguardhome` module no longer uses `host` and `port` options, use `settings.bind_host` and `settings.bind_port` instead.
213
214- The default `kops` version is now 1.25.1 and support for 1.22 and older has been dropped.
215
216- The `zrepl` package has been updated from 0.5.0 to 0.6.0. See the [changelog](https://zrepl.github.io/changelog.html) for details.
217
218- `k3s` no longer supports Docker as runtime due to upstream dropping support.
219
220- `cassandra_2_1` and `cassandra_2_2` have been removed. Please update to `cassandra_3_11` or `cassandra_3_0`. See the [changelog](https://github.com/apache/cassandra/blob/cassandra-3.11.14/NEWS.txt) for more information about the upgrade process.
221
222- `mysql57` has been removed. Please update to `mysql80` or `mariadb`. See the [upgrade guide](https://mariadb.com/kb/en/upgrading-from-mysql-to-mariadb/) for more information.
223
224- Consequently, `cqrlog` and `amorok` now use `mariadb` instead of `mysql57` for their embedded databases. Running `mysql_upgrade` may be necessary.
225- `k3s` supports `clusterInit` option, and it is enabled by default, for servers.
226
227- `percona-server56` has been removed. Please migrate to `mysql` or `mariadb` if possible.
228
229- `obs-studio` hase been updated to version 28. If you have packaged custom plugins, check if they are compatible. `obs-websocket` has been integrated into `obs-studio`.
230
231- `signald` has been bumped to `0.23.0`. For the upgrade, a migration process is necessary. It can be
232 done by running a command like this before starting `signald.service`:
233
234 ```
235 signald -d /var/lib/signald/db \
236 --database sqlite:/var/lib/signald/db \
237 --migrate-data
238 ```
239
240 For further information, please read the upstream changelogs.
241
242- `stylua` no longer accepts `lua52Support` and `luauSupport` overrides. Use `features` instead, which defaults to `[ "lua54" "luau" ]`.
243
244- `ocamlPackages.ocaml_extlib` has been renamed to `ocamlPackages.extlib`.
245
246- `pkgs.fetchNextcloudApp` has been rewritten to circumvent impurities in e.g. tarballs from GitHub and to make it easier to
247 apply patches. This means that your hashes are out-of-date and the (previously required) attributes `name` and `version`
248 are no longer accepted.
249
250- The Syncthing service now only allows absolute paths---starting with `/` or
251 `~/`---for `services.syncthing.folders.<name>.path`.
252 In a future release other paths will be allowed again and interpreted
253 relative to `services.syncthing.dataDir`.
254
255- `services.github-runner` and `services.github-runners.<name>` gained the option `serviceOverrides` which allows overriding the systemd `serviceConfig`. If you have been overriding the systemd service configuration (i.e., by defining `systemd.services.github-runner.serviceConfig`), you have to use the `serviceOverrides` option now. Example:
256
257 ```nix
258 { services.github-runner.serviceOverrides.SupplementaryGroups = [ "docker" ]; }
259 ```
260
261<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
262
263## Other Notable Changes {#sec-release-22.11-notable-changes}
264
265- PHP is now built in `NTS` (Non-Thread Safe) mode by default.
266 - For Apache and `mod_php` usage, we enable `ZTS` (Zend Thread Safe) mode. This has been a
267 common practice for a long time in other distributions.
268
269- `firefox`, `thunderbird` and `librewolf` now come with Wayland support by default. The `firefox-wayland`, `firefox-esr-wayland`, `thunderbird-wayland` and `librewolf-wayland` attributes are obsolete and have been aliased to their generic attribute.
270
271- The `xplr` package has been updated from 0.18.0 to 0.19.0, which brings some breaking changes. See the [upstream release notes](https://github.com/sayanarijit/xplr/releases/tag/v0.19.0) for more details.
272
273- Configuring multiple GitHub runners is now possible through `services.github-runners.<name>`. The options under `services.github-runner` remain, to configure a single runner.
274
275- `github-runner` gained support for ephemeral runners and registrations using a personal access token (PAT) instead of a registration token. See `services.github-runner.ephemeral` and `services.github-runner.tokenFile` for details.
276
277- A new module was added to provide hardware support for the Saleae Logic device family, providing the options `hardware.saleae-logic.enable` and `hardware.saleae-logic.package`.
278
279- ZFS module will no longer allow hibernation by default.
280 - This is a safety measure to prevent data loss cases like the ones described at [OpenZFS/260](https://github.com/openzfs/zfs/issues/260) and [OpenZFS/12842](https://github.com/openzfs/zfs/issues/12842).
281 - Use the `boot.zfs.allowHibernation` option to configure this behaviour.
282
283- Mastodon now automatically removes remote media attachments older than 30 days. This is configurable through `services.mastodon.mediaAutoRemove`.
284
285- The Redis module now disables RDB persistence when `services.redis.servers.<name>.save = []` instead of using the Redis default.
286
287- Neo4j was updated from version 3 to version 4. See upstream's [migration guide](https://neo4j.com/docs/upgrade-migration-guide/current/) for information on how to migrate your instance.
288
289- The `networking.wireguard` module now can set the mtu on interfaces and tag its packets with an fwmark.
290
291- The option `overrideStrategy` was added to the different systemd unit options (`systemd.services.<name>`, `systemd.sockets.<name>`, …) to allow enforcing the creation of a dropin file, rather than the main unit file, by setting it to `asDropin`.
292 This is useful in cases where the existence of the main unit file is not known to Nix at evaluation time, for example when the main unit file is provided by adding a package to `systemd.packages`.
293 See the fix proposed in [NixOS's systemd abstraction doesn't work with systemd template units](https://github.com/NixOS/nixpkgs/issues/135557#issuecomment-1295392470) for an example.
294
295- The `polymc` package has been removed due to a rogue maintainer. It has been
296 replaced by `prismlauncher`, a fork by the rest of the maintainers. For more
297 details, see [the PR that made this change](https://github.com/NixOS/nixpkgs/pull/196624) and
298 [the issue detailing the vulnerability](https://github.com/NixOS/nixpkgs/issues/196460).
299 Users with existing installations should rename `~/.local/share/polymc` to
300 `~/.local/share/PrismLauncher`. The main config file's path has also moved
301 from `~/.local/share/polymc/polymc.cfg` to
302 `~/.local/share/PrismLauncher/prismlauncher.cfg`.
303
304- The `bloat` package has been updated from unstable-2022-03-31 to unstable-2022-10-25, which brings a breaking change. See [this upstream commit message](https://git.freesoftwareextremist.com/bloat/commit/?id=887ed241d64ba5db3fd3d87194fb5595e5ad7d73) for details.
305
306- Synapse's systemd unit has been hardened.
307
308- The module `services.grafana` was refactored to be compliant with [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md). To be precise, this means that the following things have changed:
309 - The newly introduced option [](#opt-services.grafana.settings) is an attribute-set that
310 will be converted into Grafana's INI format. This means that the configuration from
311 [Grafana's configuration reference](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/)
312 can be directly written as attribute-set in Nix within this option.
313 - The option `services.grafana.extraOptions` has been removed. This option was an association
314 of environment variables for Grafana. If you had an expression like
315
316 ```nix
317 { services.grafana.extraOptions.SECURITY_ADMIN_USER = "foobar"; }
318 ```
319
320 your Grafana instance was running with `GF_SECURITY_ADMIN_USER=foobar` in its environment.
321
322 For the migration, it is recommended to turn it into the INI format, i.e.
323 to declare
324
325 ```nix
326 { services.grafana.settings.security.admin_user = "foobar"; }
327 ```
328
329 instead.
330
331 The keys in `services.grafana.extraOptions` have the format `<INI section name>_<Key Name>`.
332 Further details are outlined in the [configuration reference](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#override-configuration-with-environment-variables).
333
334 Alternatively you can also set all your values from `extraOptions` to
335 `systemd.services.grafana.environment`, make sure you don't forget to add
336 the `GF_` prefix though!
337 - Previously, the options [services.grafana.provision.datasources](#opt-services.grafana.provision.datasources) and
338 [services.grafana.provision.dashboards](#opt-services.grafana.provision.dashboards) expected lists of datasources
339 or dashboards for the [declarative provisioning](https://grafana.com/docs/grafana/latest/administration/provisioning/).
340
341 To declare lists of
342 - **datasources**, please rename your declarations to [services.grafana.provision.datasources.settings.datasources](#opt-services.grafana.provision.datasources.settings.datasources).
343 - **dashboards**, please rename your declarations to [services.grafana.provision.dashboards.settings.providers](#opt-services.grafana.provision.dashboards.settings.providers).
344
345 This change was made to support more features for that:
346
347 - It's possible to declare the `apiVersion` of your dashboards and datasources
348 by [services.grafana.provision.datasources.settings.apiVersion](#opt-services.grafana.provision.datasources.settings.apiVersion) (or
349 [services.grafana.provision.dashboards.settings.apiVersion](#opt-services.grafana.provision.dashboards.settings.apiVersion)).
350
351 - Instead of declaring datasources and dashboards in pure Nix, it's also possible
352 to specify configuration files (or directories) with YAML instead using
353 [services.grafana.provision.datasources.path](#opt-services.grafana.provision.datasources.path) (or
354 [services.grafana.provision.dashboards.path](#opt-services.grafana.provision.dashboards.path). This is useful when having
355 provisioning files from non-NixOS Grafana instances that you also want to
356 deploy to NixOS.
357
358 __Note:__ secrets from these files will be leaked into the store unless you use a
359 [**file**-provider or env-var](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider) for secrets!
360
361 - `services.grafana.provision.notifiers` is not affected by this change because
362 this feature is deprecated by Grafana and will probably be removed in Grafana 10.
363 It's recommended to use `services.grafana.provision.alerting.contactPoints` instead.
364
365- The `services.grafana.provision.alerting` option was added. It includes suboptions for every alerting-related objects (with the exception of `notifiers`), which means it's now possible to configure modern Grafana alerting declaratively.
366
367- Synapse now requires entries in the `state_group_edges` table to be unique, in order to prevent accidentally introducing duplicate information (for example, because a database backup was restored multiple times). If your Synapse database already has duplicate rows in this table, this could fail with an error and require manual remediation.
368
369- The `diamond` package has been update from 0.8.36 to 2.0.15. See the [upstream release notes](https://github.com/bbuchfink/diamond/releases) for more details.
370
371- The `guake` package has been updated from 3.6.3 to 3.9.0, see the [changelog](https://github.com/Guake/guake/releases) for more details.
372
373- The `netlify-cli` package has been updated from 6.13.2 to 12.2.4, see the [changelog](https://github.com/netlify/cli/releases) for more details.
374
375- `dockerTools.buildImage`'s `contents` parameter has been deprecated in favor of `copyToRoot`.
376 Use `copyToRoot = buildEnv { ... };` or similar if you intend to add packages to `/bin`.
377
378- The `proxmox.qemuConf.bios` option was added, it corresponds to `Hardware->BIOS` field in Proxmox web interface. Use `"ovmf"` value to build UEFI image, default value remains `"bios"`. New option `proxmox.partitionTableType` defaults to either `"legacy"` or `"efi"`, depending on the `bios` value. Setting `partitionTableType` to `"hybrid"` results in an image, which supports both methods (`"bios"` and `"ovmf"`), thereby remaining bootable after change to Proxmox `Hardware->BIOS` field.
379
380- memtest86+ was updated from 5.00-coreboot-002 to 6.00-beta2. It is now the upstream version from https://www.memtest.org/, as coreboot's fork is no longer available.
381
382- Option descriptions, examples, and defaults writing in DocBook are now deprecated. Using CommonMark is preferred and will become the default in a future release.
383
384- The `documentation.nixos.options.allowDocBook` option was added to ease the transition to CommonMark option documentation. Setting this option to `false` causes an error for every option included in the manual that uses DocBook documentation; it defaults to `true` to preserve the previous behavior and will be removed once the transition to CommonMark is complete.
385
386- The Redis module now persists each instance's configuration file in the state directory, in order to support some more advanced use cases like Sentinel.
387
388- `protonup` has been aliased to and replaced by `protonup-ng` due to upstream not maintaining it.
389
390- The udisks2 service, available at `services.udisks2.enable`, is now disabled by default. It will automatically be enabled through services and desktop environments as needed.
391 This also means that polkit will now actually be disabled by default. The default for `security.polkit.enable` was already flipped in the previous release, but udisks2 being enabled by default re-enabled it.
392
393- Nextcloud has been updated to version **25**. Additionally the following things have changed
394 for Nextcloud in NixOS:
395 - For Nextcloud **>=24**, the default PHP version is 8.1.
396 - Nextcloud **23** has been removed since it will reach its [end of life in December 2022](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule/d76576a12a626d53305d480a6065b57cab705d3d).
397 - If `system.stateVersion` is **>=22.11**, Nextcloud 25 will be installed by default. For older versions,
398 Nextcloud 24 will be installed.
399 - Please ensure that you only upgrade one major release at a time! Nextcloud doesn't support
400 upgrades across multiple versions, i.e. an upgrade from **23** to **25** is only possible
401 when upgrading to **24** first.
402
403- systemd-oomd is enabled by default. Depending on which systemd units have
404 `ManagedOOMSwap=kill` or `ManagedOOMMemoryPressure=kill`, systemd-oomd will
405 SIGKILL all the processes under the appropriate descendant cgroups when the
406 configured limits are exceeded. NixOS does currently not configure cgroups
407 with oomd by default, this can be enabled using
408 [systemd.oomd.enableRootSlice](options.html#opt-systemd.oomd.enableRootSlice),
409 [systemd.oomd.enableSystemSlice](options.html#opt-systemd.oomd.enableSystemSlice),
410 and [systemd.oomd.enableUserServices](options.html#opt-systemd.oomd.enableUserServices).
411
412- The `tt-rss` service performs two database migrations when you first use its web UI after upgrade. Consider backing up its database before updating.
413
414- The `pass-secret-service` package now includes systemd units from upstream, so adding it to the NixOS `services.dbus.packages` option will make it start automatically as a systemd user service when an application tries to talk to the libsecret D-Bus API.
415
416- The Wordpress module now has support for installing language packs through a new option, `services.wordpress.sites.<site>.languages`.
417
418- The default package for `services.mullvad-vpn.package` was changed to `pkgs.mullvad`, allowing cross-platform usage of Mullvad. `pkgs.mullvad` only contains the Mullvad CLI tool, so users who rely on the Mullvad GUI will want to change it back to `pkgs.mullvad-vpn`, or add `pkgs.mullvad-vpn` to their environment.
419
420- PowerDNS has been updated from v4.6.2 to v4.7.2. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-4-7-0-or-master) provided by upstream before upgrading. Worth specifically noting is that the new Catalog Zones feature comes with a mandatory schema change for the GSQL database backends, which has to be manually applied.
421
422- There is a new module for the `thunar` program (the Xfce file manager), which depends on the `xfconf` dbus service, and also has a dbus service and a systemd unit. The option `services.xserver.desktopManager.xfce.thunarPlugins` has been renamed to `programs.thunar.plugins`, and may be removed in a future release.
423
424- There is a new module for `xfconf` (the Xfce configuration storage system), which has a dbus service.
425
426- The Mastodon package has been upgraded to v4.0.0. See the [v4.0.0 release notes](https://github.com/mastodon/mastodon/releases/tag/v4.0.0) for a list of changes. On standard setups, no manual migration steps are required. Nevertheless, a database backup is recommended.
427
428- The `nomad` package now defaults to v1.3, which no longer has a downgrade path to v1.2 or older.
429
430- The `nodePackages` package set now defaults to the LTS release in the `nodejs` package again, instead of being pinned to `nodejs-14_x`. Several updates to node2nix have been made for compatibility with newer Node.js and npm versions and a new `postRebuild` hook has been added for packages to perform extra build steps before the npm install step prunes dev dependencies.
431
432- `boot.kernel.sysctl` is defined as a freeformType and adds a custom merge option for `net.core.rmem_max` (taking the highest value defined to avoid conflicts between 2 services trying to set that value).
433
434- The `mame` package does not ship with its tools anymore in the default output. They were moved to a separate `tools` output instead. For convenience, `mame-tools` package was added for those who want to use it.
435
436- A NixOS module for Firefox has been added which allows preferences and [policies](https://github.com/mozilla/policy-templates/blob/master/README.md) to be set. This also allows extensions to be installed via the `ExtensionSettings` policy. The new options are under `programs.firefox`.
437
438- The option `services.picom.experimentalBackends` was removed since it is now the default and the option will cause `picom` to quit instead.
439
440- `haskellPackages.callHackage` is not always invalidated if `all-cabal-hashes` changes, leading to less rebuilds of haskell dependencies.
441
442- `haskellPackages.callHackage` and `haskellPackages.callCabal2nix` (and related functions) no longer keep a reference to the `cabal2nix` call used to generate them. As a result, they will be garbage collected more often.
443
444<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
445
446## New Services {#sec-release-22.11-new-services}
447
448- [alps](https://git.sr.ht/~migadu/alps), a simple and extensible webmail. Available as [services.alps](#opt-services.alps.enable).
449
450- [appvm](https://github.com/jollheef/appvm), Nix based app VMs. Available as [virtualisation.appvm](options.html#opt-virtualisation.appvm.enable).
451
452- [AusweisApp2](https://www.ausweisapp.bund.de/), the authentication software for the German ID card. Available as [programs.ausweisapp](#opt-programs.ausweisapp.enable).
453
454- [automatic-timezoned](https://github.com/maxbrunet/automatic-timezoned). a Linux daemon to automatically update the system timezone based on location. Available as [services.automatic-timezoned](#opt-services.automatic-timezoned.enable).
455
456- [Dolibarr](https://www.dolibarr.org/), an enterprise resource planning and customer relationship manager. Enable using [services.dolibarr](#opt-services.dolibarr.enable).
457
458- [dragonflydb](https://dragonflydb.io/), a modern replacement for Redis and Memcached. Available as [services.dragonflydb](#opt-services.dragonflydb.enable).
459
460- [endlessh-go](https://github.com/shizunge/endlessh-go), an SSH tarpit that exposes Prometheus metrics. Available as [services.endlessh-go](#opt-services.endlessh-go.enable).
461
462- [endlessh](https://github.com/skeeto/endlessh), an SSH tarpit. Available as [services.endlessh](#opt-services.endlessh.enable).
463
464- [EVCC](https://evcc.io) is an EV charge controller with PV integration. It supports a multitude of chargers, meters, vehicle APIs and more and ties that together with a well-tested backend and a lightweight web frontend. Available as [services.evcc](#opt-services.evcc.enable).
465
466- [expressvpn](https://www.expressvpn.com), the CLI client for ExpressVPN. Available as [services.expressvpn](#opt-services.expressvpn.enable).
467
468- [FreshRSS](https://freshrss.org/), a free, self-hostable RSS feed aggregator. Available as [services.freshrss](#opt-services.freshrss.enable).
469
470- [Garage](https://garagehq.deuxfleurs.fr/), a simple object storage server for geodistributed deployments, alternative to MinIO. Available as [services.garage](#opt-services.garage.enable).
471
472- [go-autoconfig](https://github.com/L11R/go-autoconfig), IMAP/SMTP autodiscover server. Available as [services.go-autoconfig](#opt-services.go-autoconfig.enable).
473
474- [Grafana Tempo](https://www.grafana.com/oss/tempo/), a distributed tracing store. Available as [services.tempo](#opt-services.tempo.enable).
475
476- [HBase cluster](https://hbase.apache.org/), a distributed, scalable, big data store. Available as [services.hadoop.hbase](options.html#opt-services.hadoop.hbase.enable).
477
478- [infnoise](https://github.com/leetronics/infnoise), a hardware True Random Number Generator dongle. Available as [services.infnoise](options.html#opt-services.infnoise.enable).
479
480- [kanata](https://github.com/jtroo/kanata), a tool to improve keyboard comfort and usability with advanced customization. Available as [services.kanata](options.html#opt-services.kanata.enable).
481
482- [karma](https://github.com/prymitive/karma), an alert dashboard for Prometheus Alertmanager. Available as [services.karma](options.html#opt-services.karma.enable)
483
484- [Komga](https://komga.org/), a free and open source comics/mangas media server. Available as [services.komga](#opt-services.komga.enable).
485
486- [kthxbye](https://github.com/prymitive/kthxbye), an alert acknowledgement management daemon for Prometheus Alertmanager. Available as [services.kthxbye](options.html#opt-services.kthxbye.enable)
487
488- [languagetool](https://languagetool.org/), a multilingual grammar, style, and spell checker. Available as [services.languagetool](options.html#opt-services.languagetool.enable).
489
490- [Listmonk](https://listmonk.app), a self-hosted newsletter manager. Enable using [services.listmonk](options.html#opt-services.listmonk.enable).
491
492- [Mepo](https://mepo.milesalan.com), a fast, simple, hackable OSM map viewer for mobile and desktop Linux. Available as [programs.mepo.enable](#opt-programs.mepo.enable).
493
494- [merecat](https://troglobit.com/projects/merecat/), a small and easy HTTP server based on thttpd. Available as [services.merecat](#opt-services.merecat.enable)
495
496- [netbird](https://netbird.io), a zero configuration VPN. Available as [services.netbird](options.html#opt-services.netbird.enable).
497
498- [ntfy.sh](https://ntfy.sh), a push notification service. Available as [services.ntfy-sh](#opt-services.ntfy-sh.enable)
499
500- [OpenRGB](https://gitlab.com/CalcProgrammer1/OpenRGB/-/tree/master), a FOSS tool for controlling RGB lighting. Available as [services.hardware.openrgb.enable](options.html#opt-services.hardware.openrgb.enable).
501
502- [Outline](https://www.getoutline.com/), a wiki and knowledge base similar to Notion. Available as [services.outline](#opt-services.outline.enable).
503
504- [Patroni](https://github.com/zalando/patroni), a template for PostgreSQL HA with ZooKeeper, etcd or Consul. Available as [services.patroni](options.html#opt-services.patroni.enable).
505
506- [persistent-evdev](https://github.com/aiberia/persistent-evdev), a daemon to add virtual proxy devices that mirror a physical input device but persist even if the underlying hardware is hot-plugged. Available as [services.persistent-evdev](#opt-services.persistent-evdev.enable).
507
508- [Please](https://github.com/edneville/please), a Sudo clone written in Rust. Available as [security.please](#opt-security.please.enable).
509
510- [Prometheus IPMI exporter](https://github.com/prometheus-community/ipmi_exporter), an IPMI exporter for Prometheus. Available as [services.prometheus.exporters.ipmi](#opt-services.prometheus.exporters.ipmi.enable).
511
512- [Sachet](https://github.com/messagebird/sachet/), an SMS alerting tool for the Prometheus Alertmanager. Available as [services.prometheus.sachet](#opt-services.prometheus.sachet.enable).
513
514- [schleuder](https://schleuder.org/), a mailing list manager with PGP support. Enable using [services.schleuder](#opt-services.schleuder.enable).
515
516- [syncstorage-rs](https://github.com/mozilla-services/syncstorage-rs), a self-hostable sync server for Firefox. Available as [services.firefox-syncserver](options.html#opt-services.firefox-syncserver.enable).
517
518- [Tandoor Recipes](https://tandoor.dev), a self-hosted multi-tenant recipe collection. Available as [services.tandoor-recipes](options.html#opt-services.tandoor-recipes.enable).
519
520- [TAYGA](http://www.litech.org/tayga/), an out-of-kernel stateless NAT64 implementation. Available as [services.tayga](#opt-services.tayga.enable).
521
522- [tmate-ssh-server](https://github.com/tmate-io/tmate-ssh-server), server side part of [tmate](https://tmate.io/). Available as [services.tmate-ssh-server](#opt-services.tmate-ssh-server.enable).
523
524- [Uptime Kuma](https://uptime.kuma.pet/), a fancy self-hosted monitoring tool. Available as [services.uptime-kuma](#opt-services.uptime-kuma.enable).
525
526- [WriteFreely](https://writefreely.org), a simple blogging platform with ActivityPub support. Available as [services.writefreely](options.html#opt-services.writefreely.enable).
527
528- [xray](https://github.com/XTLS/Xray-core), a fully compatible v2ray-core replacement. Features XTLS, which when enabled on server and client, brings UDP FullCone NAT to proxy setups. Available as [services.xray](options.html#opt-services.xray.enable).
529
530<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->