pyrox.dev
1# Release 21.11 (“Porcupine”, 2021/11/30) {#sec-release-21.11}
2
3- Support is planned until the end of June 2022, handing over to 22.05.
4
5## Highlights {#sec-release-21.11-highlights}
6
7In addition to numerous new and upgraded packages, this release has the following highlights:
8
9- Nix has been updated to version 2.4, reference its [release notes](https://discourse.nixos.org/t/nix-2-4-released/15822) for more information on what has changed. The previous version of Nix, 2.3.16, remains available for the time being in the `nix_2_3` package.
10
11- `iptables` is now using `nf_tables` under the hood, by using `iptables-nft`,
12 similar to [Debian](https://wiki.debian.org/nftables#Current_status) and
13 [Fedora](https://fedoraproject.org/wiki/Changes/iptables-nft-default).
14 This means, `ip[6]tables`, `arptables` and `ebtables` commands will actually
15 show rules from some specific tables in the `nf_tables` kernel subsystem.
16 In case you're migrating from an older release without rebooting, there might
17 be cases where you end up with iptable rules configured both in the legacy
18 `iptables` kernel backend, as well as in the `nf_tables` backend.
19 This can lead to confusing firewall behaviour. An `iptables-save` after
20 switching will complain about "iptables-legacy tables present".
21 It's probably best to reboot after the upgrade, or manually removing all
22 legacy iptables rules (via the `iptables-legacy` package).
23
24- systemd got an `nftables` backend, and configures (networkd) rules in their
25 own `io.systemd.*` tables. Check `nft list ruleset` to see these rules, not
26 `iptables-save` (which only shows `iptables`-created rules.
27
28- PHP now defaults to PHP 8.0, updated from 7.4.
29
30- kops now defaults to 1.21.1, which uses containerd as the default runtime.
31
32- `python3` now defaults to Python 3.9, updated from Python 3.8.
33
34- PostgreSQL now defaults to major version 13.
35
36- spark now defaults to spark 3, updated from 2. A [migration guide](https://spark.apache.org/docs/latest/core-migration-guide.html#upgrading-from-core-24-to-30) is available.
37
38- Improvements have been made to the Hadoop module and package:
39 - HDFS and YARN now support production-ready highly available deployments with automatic failover.
40 - Hadoop now defaults to Hadoop 3, updated from 2.
41 - JournalNode, ZKFS and HTTPFS services have been added.
42
43- Activation scripts can now, optionally, be run during a `nixos-rebuild dry-activate` and can detect the dry activation by reading `$NIXOS_ACTION`.
44 This allows activation scripts to output what they would change if the activation was really run.
45 The users/modules activation script supports this and outputs some of is actions.
46
47- KDE Plasma now finally works on Wayland.
48
49- bash now defaults to major version 5.
50
51- Systemd was updated to version 249 (from 247).
52
53- Pantheon desktop has been updated to version 6. Due to changes of screen locker, if locking doesn't work for you, please try `gsettings set org.gnome.desktop.lockdown disable-lock-screen false`.
54
55- `kubernetes-helm` now defaults to 3.7.0, which introduced some breaking changes to the experimental OCI manifest format. See [HIP 6](https://github.com/helm/community/blob/main/hips/hip-0006.md) for more details.
56 `helmfile` also defaults to 0.141.0, which is the minimum compatible version.
57
58- GNOME has been upgraded to 41. Please take a look at their [Release Notes](https://help.gnome.org/misc/release-notes/41.0/) for details.
59
60- LXD support was greatly improved:
61 - building LXD images from configurations is now directly possible with just nixpkgs
62 - hydra is now building nixOS LXD images that can be used standalone with full nixos-rebuild support
63
64- OpenSSH was updated to version 8.8p1
65 - This breaks connections to old SSH daemons as ssh-rsa host keys and ssh-rsa public keys that were signed with SHA-1 are disabled by default now
66 - These can be re-enabled, see the [OpenSSH changelog](https://www.openssh.com/txt/release-8.8) for details
67
68- ORY Kratos was updated to version 0.8.0-alpha.3
69 - This release requires you to run SQL migrations. Please, as always, create a backup of your database first!
70 - The SDKs are now generated with tag v0alpha2 to reflect that some signatures have changed in a breaking fashion. Please update your imports from v0alpha1 to v0alpha2.
71 - The SMTPS scheme used in courier config URL with cleartext/StartTLS/TLS SMTP connection types is now only supporting implicit TLS. For StartTLS and cleartext SMTP, please use the SMTP scheme instead.
72 - for more details, see [Release Notes](https://github.com/ory/kratos/releases/tag/v0.8.0-alpha.1).
73
74## New Services {#sec-release-21.11-new-services}
75
76- [btrbk](https://digint.ch/btrbk/index.html), a backup tool for btrfs subvolumes, taking advantage of btrfs specific capabilities to create atomic snapshots and transfer them incrementally to your backup locations. Available as [services.btrbk](options.html#opt-services.brtbk.instances).
77
78- [clipcat](https://github.com/xrelkd/clipcat/), an X11 clipboard manager written in Rust. Available at [services.clipcat](options.html#opt-services.clipcat.enable).
79
80- [dex](https://github.com/dexidp/dex), an OpenID Connect (OIDC) identity and OAuth 2.0 provider. Available at [services.dex](options.html#opt-services.dex.enable).
81
82- [geoipupdate](https://github.com/maxmind/geoipupdate), a GeoIP database updater from MaxMind. Available as [services.geoipupdate](options.html#opt-services.geoipupdate.enable).
83
84- [Jibri](https://github.com/jitsi/jibri), a service for recording or streaming a Jitsi Meet conference. Available as [services.jibri](options.html#opt-services.jibri.enable).
85
86- [Kea](https://www.isc.org/kea/), ISCs 2nd generation DHCP and DDNS server suite. Available at [services.kea](options.html#opt-services.kea.dhcp4).
87
88- [owncast](https://owncast.online/), self-hosted video live streaming solution. Available at [services.owncast](options.html#opt-services.owncast.enable).
89
90- [PeerTube](https://joinpeertube.org/), developed by Framasoft, is the free and decentralized alternative to video platforms. Available at [services.peertube](options.html#opt-services.peertube.enable).
91
92- [sourcehut](https://sr.ht), a collection of tools useful for software development. Available as [services.sourcehut](options.html#opt-services.sourcehut.enable).
93
94- [ucarp](https://download.pureftpd.org/pub/ucarp/README), an userspace implementation of the Common Address Redundancy Protocol (CARP). Available as [networking.ucarp](options.html#opt-networking.ucarp.enable).
95
96- Users of flashrom should migrate to [programs.flashrom.enable](options.html#opt-programs.flashrom.enable) and add themselves to the `flashrom` group to be able to access programmers supported by flashrom.
97
98- [vikunja](https://vikunja.io), a to-do list app. Available as [services.vikunja](#opt-services.vikunja.enable).
99
100- [opensnitch](https://github.com/evilsocket/opensnitch), an application firewall. Available as [services.opensnitch](#opt-services.opensnitch.enable).
101
102- [snapraid](https://www.snapraid.it/), a backup program for disk arrays.
103 Available as [snapraid](#opt-services.snapraid.enable).
104
105- [Hockeypuck](https://github.com/hockeypuck/hockeypuck), a OpenPGP Key Server. Available as [services.hockeypuck](#opt-services.hockeypuck.enable).
106
107- [buildkite-agent-metrics](https://github.com/buildkite/buildkite-agent-metrics), a command-line tool for collecting Buildkite agent metrics, now has a Prometheus exporter available as [services.prometheus.exporters.buildkite-agent](#opt-services.prometheus.exporters.buildkite-agent.enable).
108
109- [influxdb-exporter](https://github.com/prometheus/influxdb_exporter) a Prometheus exporter that exports metrics received on an InfluxDB compatible endpoint is now available as [services.prometheus.exporters.influxdb](#opt-services.prometheus.exporters.influxdb.enable).
110
111- [mx-puppet-discord](https://github.com/matrix-discord/mx-puppet-discord), a discord puppeting bridge for matrix. Available as `services.mx-puppet-discord`.
112
113- [MeshCentral](https://www.meshcommander.com/meshcentral2/overview), a remote administration service ("TeamViewer but self-hosted and with more features") is now available with a package and a module: [services.meshcentral.enable](#opt-services.meshcentral.enable)
114
115- [moonraker](https://github.com/Arksine/moonraker), an API web server for Klipper.
116 Available as [moonraker](#opt-services.moonraker.enable).
117
118- [influxdb2](https://github.com/influxdata/influxdb), a Scalable datastore for metrics, events, and real-time analytics. Available as [services.influxdb2](#opt-services.influxdb2.enable).
119
120- [isso](https://posativ.org/isso/), a commenting server similar to Disqus.
121 Available as [isso](#opt-services.isso.enable)
122
123- [navidrome](https://www.navidrome.org/), a personal music streaming server with
124 subsonic-compatible api. Available as [navidrome](#opt-services.navidrome.enable).
125
126- [fluidd](https://docs.fluidd.xyz/), a Klipper web interface for managing 3d printers using moonraker. Available as [fluidd](#opt-services.fluidd.enable).
127
128- [sx](https://github.com/earnestly/sx), a simple alternative to both xinit and startx for starting a Xorg server. Available as [services.xserver.displayManager.sx](#opt-services.xserver.displayManager.sx.enable)
129
130- [postfixadmin](https://postfixadmin.sourceforge.io/), a web based virtual user administration interface for Postfix mail servers. Available as [postfixadmin](#opt-services.postfixadmin.enable).
131
132- [prowlarr](https://wiki.servarr.com/prowlarr), an indexer manager/proxy built on the popular arr .net/reactjs base stack [services.prowlarr](#opt-services.prowlarr.enable).
133
134- [soju](https://sr.ht/~emersion/soju), a user-friendly IRC bouncer. Available as [services.soju](options.html#opt-services.soju.enable).
135
136- [nats](https://nats.io/), a high performance cloud and edge messaging system. Available as [services.nats](#opt-services.nats.enable).
137
138- [git](https://git-scm.com), a distributed version control system. Available as [programs.git](options.html#opt-programs.git.enable).
139
140- [parsedmarc](https://domainaware.github.io/parsedmarc/), a service
141 which parses incoming [DMARC](https://dmarc.org/) reports and stores
142 or sends them to a downstream service for further analysis.
143 Documented in [its manual entry](#module-services-parsedmarc).
144
145- [spark](https://spark.apache.org/), a unified analytics engine for large-scale data processing.
146
147- [touchegg](https://github.com/JoseExposito/touchegg), a multi-touch gesture recognizer. Available as [services.touchegg](#opt-services.touchegg.enable).
148
149- [pantheon-tweaks](https://github.com/pantheon-tweaks/pantheon-tweaks), an unofficial system settings panel for Pantheon. Available as `programs.pantheon-tweaks`.
150
151- [joycond](https://github.com/DanielOgorchock/joycond), a service that uses `hid-nintendo` to provide nintendo joycond pairing and better nintendo switch pro controller support.
152
153- [multipath](https://github.com/opensvc/multipath-tools), the device mapper multipath (DM-MP) daemon. Available as [services.multipath](#opt-services.multipath.enable).
154
155- [seafile](https://www.seafile.com/en/home/), an open source file syncing & sharing software. Available as [services.seafile](options.html#opt-services.seafile.enable).
156
157- [rasdaemon](https://github.com/mchehab/rasdaemon), a hardware error logging daemon. Available as [hardware.rasdaemon](#opt-hardware.rasdaemon.enable).
158
159- `code-server`-module now available
160
161- [xmrig](https://github.com/xmrig/xmrig), a high performance, open source, cross platform RandomX, KawPow, CryptoNight and AstroBWT unified CPU/GPU miner and RandomX benchmark.
162
163- Auto nice daemons [ananicy](https://github.com/Nefelim4ag/Ananicy) and [ananicy-cpp](https://gitlab.com/ananicy-cpp/ananicy-cpp/). Available as [services.ananicy](#opt-services.ananicy.enable).
164
165- [smartctl_exporter](https://github.com/prometheus-community/smartctl_exporter), a Prometheus exporter for [S.M.A.R.T.](https://en.wikipedia.org/wiki/S.M.A.R.T.) data. Available as [services.prometheus.exporters.smartctl](options.html#opt-services.prometheus.exporters.smartctl.enable).
166
167- [twingate](https://docs.twingate.com/docs/linux), a high performance, easy to use zero trust solution that enables access to private resources from any device with better security than a VPN.
168
169## Backward Incompatibilities {#sec-release-21.11-incompatibilities}
170
171- The NixOS VM test framework, `pkgs.nixosTest`/`make-test-python.nix` (`pkgs.testers.nixosTest` since 22.05), now requires detaching commands such as `succeed("foo &")` and `succeed("foo | xclip -i")` to close stdout.
172 This can be done with a redirect such as `succeed("foo >&2 &")`. This breaking change was necessitated by a race condition causing tests to fail or hang.
173 It applies to all methods that invoke commands on the nodes, including `execute`, `succeed`, `fail`, `wait_until_succeeds`, `wait_until_fails`.
174
175- The `services.wakeonlan` option was removed, and replaced with `networking.interfaces.<name>.wakeOnLan`.
176
177- The `security.wrappers` option now requires to always specify an owner, group and whether the setuid/setgid bit should be set.
178 This is motivated by the fact that before NixOS 21.11, specifying either setuid or setgid but not owner/group resulted in wrappers owned by nobody/nogroup, which is unsafe.
179
180- Since `iptables` now uses `nf_tables` backend and `ipset` doesn't support it, some applications (ferm, shorewall, firehol) may have limited functionality.
181
182- The `paperless` module and package have been removed. All users should migrate to the
183 successor `paperless-ng` instead. The Paperless project [has been
184 archived](https://github.com/the-paperless-project/paperless/commit/9b0063c9731f7c5f65b1852cb8caff97f5e40ba4)
185 and advises all users to use `paperless-ng` instead.
186
187 Users can use the `services.paperless-ng` module as a replacement while noting the following incompatibilities:
188
189 - `services.paperless.ocrLanguages` has no replacement. Users should migrate to [`services.paperless-ng.extraConfig`](options.html#opt-services.paperless-ng.extraConfig) instead:
190
191 ```nix
192 {
193 services.paperless-ng.extraConfig = {
194 # Provide languages as ISO 639-2 codes
195 # separated by a plus (+) sign.
196 # https://en.wikipedia.org/wiki/List_of_ISO_639-2_codes
197 PAPERLESS_OCR_LANGUAGE = "deu+eng+jpn"; # German & English & Japanse
198 };
199 }
200 ```
201
202 - If you previously specified `PAPERLESS_CONSUME_MAIL_*` settings in
203 `services.paperless.extraConfig` you should remove those options now. You
204 now _must_ define those settings in the admin interface of paperless-ng.
205
206 - Option `services.paperless.manage` no longer exists.
207 Use the script at `${services.paperless-ng.dataDir}/paperless-ng-manage` instead.
208 Note that this script only exists after the `paperless-ng` service has been
209 started at least once.
210
211 - After switching to the new system configuration you should run the Django
212 management command to reindex your documents and optionally create a user,
213 if you don't have one already.
214
215 To do so, enter the data directory (the value of
216 `services.paperless-ng.dataDir`, `/var/lib/paperless` by default), switch
217 to the paperless user and execute the management command like below:
218
219 ```
220 $ cd /var/lib/paperless
221 $ su paperless -s /bin/sh
222 $ ./paperless-ng-manage document_index reindex
223 # if not already done create a user account, paperless-ng requires a login
224 $ ./paperless-ng-manage createsuperuser
225 Username (leave blank to use 'paperless'): my-user-name
226 Email address: me@example.com
227 Password: **********
228 Password (again): **********
229 Superuser created successfully.
230 ```
231
232- The `staticjinja` package has been upgraded from 1.0.4 to 4.1.1
233
234- Firefox v91 does not support addons with invalid signature anymore. Firefox ESR needs to be used for nix addon support.
235
236- The `erigon` ethereum node has moved to a new database format in `2021-05-04`, and requires a full resync
237
238- The `erigon` ethereum node has moved its database location in `2021-08-03`, users upgrading must manually move their chaindata (see [release notes](https://github.com/ledgerwatch/erigon/releases/tag/v2021.08.03)).
239
240- [users.users.<name>.group](options.html#opt-users.users._name_.group) no longer defaults to `nogroup`, which was insecure. Out-of-tree modules are likely to require adaptation: instead of
241 ```nix
242 {
243 users.users.foo = {
244 isSystemUser = true;
245 };
246 }
247 ```
248 also create a group for your user:
249 ```nix
250 {
251 users.users.foo = {
252 isSystemUser = true;
253 group = "foo";
254 };
255 users.groups.foo = { };
256 }
257 ```
258
259- `services.geoip-updater` was broken and has been replaced by [services.geoipupdate](options.html#opt-services.geoipupdate.enable).
260
261- `ihatemoney` has been updated to version 5.1.1 ([release notes](https://github.com/spiral-project/ihatemoney/blob/5.1.1/CHANGELOG.rst)). If you serve ihatemoney by HTTP rather than HTTPS, you must set [services.ihatemoney.secureCookie](options.html#opt-services.ihatemoney.secureCookie) to `false`.
262
263- PHP 7.3 is no longer supported due to upstream not supporting this version for the entire lifecycle of the 21.11 release.
264
265- Those making use of `buildBazelPackage` will need to regenerate the fetch hashes (preferred), or set `fetchConfigured = false;`.
266
267- `consul` was upgraded to a new major release with breaking changes, see [upstream changelog](https://github.com/hashicorp/consul/releases/tag/v1.10.0).
268
269- fsharp41 has been removed in preference to use the latest dotnet-sdk
270
271- The following F#-related packages have been removed for being unmaintaned. Please use `fetchNuGet` for specific packages.
272
273 - ExtCore
274 - Fake
275 - Fantomas
276 - FsCheck
277 - FsCheck262
278 - FsCheckNunit
279 - FSharpAutoComplete
280 - FSharpCompilerCodeDom
281 - FSharpCompilerService
282 - FSharpCompilerTools
283 - FSharpCore302
284 - FSharpCore3125
285 - FSharpCore4001
286 - FSharpCore4117
287 - FSharpData
288 - FSharpData225
289 - FSharpDataSQLProvider
290 - FSharpFormatting
291 - FsLexYacc
292 - FsLexYacc706
293 - FsLexYaccRuntime
294 - FsPickler
295 - FsUnit
296 - Projekt
297 - Suave
298 - UnionArgParser
299 - ExcelDnaRegistration
300 - MathNetNumerics
301
302- `programs.x2goserver` is now `services.x2goserver`
303
304- The following dotnet-related packages have been removed for being unmaintaned. Please use `fetchNuGet` for specific packages.
305 - Autofac
306 - SystemValueTuple
307 - MicrosoftDiaSymReader
308 - MicrosoftDiaSymReaderPortablePdb
309 - SystemCollectionsImmutable
310 - SystemCollectionsImmutable131
311 - SystemReflectionMetadata
312 - NUnit350
313 - Deedle
314 - ExcelDna
315 - GitVersionTree
316 - NDeskOptions
317
318* The `antlr` package now defaults to the 4.x release instead of the
319 old 2.7.7 version.
320
321* The `pulseeffects` package updated to [version 4.x](https://github.com/wwmm/easyeffects/releases/tag/v6.0.0) and renamed to `easyeffects`.
322
323* The `libwnck` package now defaults to the 3.x release instead of the
324 old 2.31.0 version.
325
326* The `bitwarden_rs` packages and modules were renamed to `vaultwarden`
327 [following upstream](https://github.com/dani-garcia/vaultwarden/discussions/1642). More specifically,
328
329 - `pkgs.bitwarden_rs`, `pkgs.bitwarden_rs-sqlite`, `pkgs.bitwarden_rs-mysql` and
330 `pkgs.bitwarden_rs-postgresql` were renamed to `pkgs.vaultwarden`, `pkgs.vaultwarden-sqlite`,
331 `pkgs.vaultwarden-mysql` and `pkgs.vaultwarden-postgresql`, respectively.
332
333 - Old names are preserved as aliases for backwards compatibility, but may be removed in the future.
334 - The `bitwarden_rs` executable was also renamed to `vaultwarden` in all packages.
335
336 - `pkgs.bitwarden_rs-vault` was renamed to `pkgs.vaultwarden-vault`.
337
338 - `pkgs.bitwarden_rs-vault` is preserved as an alias for backwards compatibility, but may be removed in the future.
339 - The static files were moved from `/usr/share/bitwarden_rs` to `/usr/share/vaultwarden`.
340
341 - The `services.bitwarden_rs` config module was renamed to `services.vaultwarden`.
342
343 - `services.bitwarden_rs` is preserved as an alias for backwards compatibility, but may be removed in the future.
344
345 - `systemd.services.bitwarden_rs`, `systemd.services.backup-bitwarden_rs` and `systemd.timers.backup-bitwarden_rs`
346 were renamed to `systemd.services.vaultwarden`, `systemd.services.backup-vaultwarden` and
347 `systemd.timers.backup-vaultwarden`, respectively.
348
349 - Old names are preserved as aliases for backwards compatibility, but may be removed in the future.
350
351 - `users.users.bitwarden_rs` and `users.groups.bitwarden_rs` were renamed to `users.users.vaultwarden` and
352 `users.groups.vaultwarden`, respectively.
353
354 - The data directory remains located at `/var/lib/bitwarden_rs`, for backwards compatibility.
355
356- `yggdrasil` was upgraded to a new major release with breaking changes, see [upstream changelog](https://github.com/yggdrasil-network/yggdrasil-go/releases/tag/v0.4.0).
357
358- `icingaweb2` was upgraded to a new release which requires a manual database upgrade, see [upstream changelog](https://github.com/Icinga/icingaweb2/releases/tag/v2.9.0).
359
360- The `isabelle` package has been upgraded from 2020 to 2021
361
362- the `mingw-64` package has been upgraded from 6.0.0 to 9.0.0
363
364- `tt-rss` was upgraded to the commit on 2021-06-21, which has breaking changes. If you use `services.tt-rss.extraConfig` you should migrate to the `putenv`-style configuration. See [this Discourse post](https://community.tt-rss.org/t/rip-config-php-hello-classes-config-php/4337) in the tt-rss forums for more details.
365
366- The following Visual Studio Code extensions were renamed to keep the naming convention uniform.
367
368 - `bbenoist.Nix` -> `bbenoist.nix`
369 - `CoenraadS.bracket-pair-colorizer` -> `coenraads.bracket-pair-colorizer`
370 - `golang.Go` -> `golang.go`
371
372- `services.uptimed` now uses `/var/lib/uptimed` as its stateDirectory instead of `/var/spool/uptimed`. Make sure to move all files to the new directory.
373
374- Deprecated package aliases in `emacs.pkgs.*` have been removed. These aliases were remnants of the old Emacs package infrastructure. We now use exact upstream names wherever possible.
375
376- `programs.neovim.runtime` switched to a `linkFarm` internally, making it impossible to use wildcards in the `source` argument.
377
378- The `openrazer` and `openrazer-daemon` packages as well as the `hardware.openrazer` module now require users to be members of the `openrazer` group instead of `plugdev`. With this change, users no longer need be granted the entire set of `plugdev` group permissions, which can include permissions other than those required by `openrazer`. This is desirable from a security point of view. The setting [`hardware.openrazer.users`](options.html#opt-services.hardware.openrazer.users) can be used to add users to the `openrazer` group.
379
380- The fontconfig service's dpi option has been removed.
381 Fontconfig should use Xft settings by default so there's no need to override one value in multiple places.
382 The user can set DPI via ~/.Xresources properly, or at the system level per monitor, or as a last resort at the system level with `services.xserver.dpi`.
383
384- The `yambar` package has been split into `yambar` and `yambar-wayland`, corresponding to the xorg and wayland backend respectively. Please switch to `yambar-wayland` if you are on wayland.
385
386- The `services.minio` module gained an additional option `consoleAddress`, that
387 configures the address and port the web UI is listening, it defaults to `:9001`.
388 To be able to access the web UI this port needs to be opened in the firewall.
389
390- The `varnish` package was upgraded from 6.3.x to 7.x. `varnish60` for the last LTS release is also still available.
391
392- The `kubernetes` package was upgraded to 1.22. The `kubernetes.apiserver.kubeletHttps` option was removed and HTTPS is always used.
393
394- The attribute `linuxPackages_latest_hardened` was dropped because the hardened patches
395 lag behind the upstream kernel which made version bumps harder. If you want to use
396 a hardened kernel, please pin it explicitly with a versioned attribute such as
397 `linuxPackages_5_10_hardened`.
398
399- The `nomad` package now defaults to a 1.1.x release instead of 1.0.x
400
401- If `exfat` is included in `boot.supportedFilesystems` and when using kernel 5.7
402 or later, the `exfatprogs` user-space utilities are used instead of `exfat`.
403
404- The `todoman` package was upgraded from 3.9.0 to 4.0.0. This introduces breaking changes in the [configuration file](https://todoman.readthedocs.io/en/stable/configure.html#configuration-file) format.
405
406- The `datadog-agent`, `datadog-integrations-core` and `datadog-process-agent` packages
407 were upgraded from 6.11.2 to 7.30.2, git-2018-09-18 to 7.30.1 and 6.11.1 to 7.30.2,
408 respectively. As a result `services.datadog-agent` has had breaking changes to the
409 configuration file. For details, see the [upstream changelog](https://github.com/DataDog/datadog-agent/blob/main/CHANGELOG.rst).
410
411- `opencv2` no longer includes the non-free libraries by default, and consequently `pfstools` no longer includes OpenCV support by default. Both packages now support an `enableUnfree` option to re-enable this functionality.
412- `services.xserver.displayManager.defaultSession = "plasma5"` does not work anymore, instead use either `"plasma"` for the Plasma X11 session or `"plasmawayland"` for the Plasma Wayland session.
413
414- `boot.kernelParams` now only accepts one command line parameter per string. This change is aimed to reduce common mistakes like "param = 12", which would be parsed as 3 parameters.
415
416- `nix.daemonNiceLevel` and `nix.daemonIONiceLevel` have been removed in favour of the new options [`nix.daemonCPUSchedPolicy`](options.html#opt-nix.daemonCPUSchedPolicy), [`nix.daemonIOSchedClass`](options.html#opt-nix.daemonIOSchedClass) and [`nix.daemonIOSchedPriority`](options.html#opt-nix.daemonIOSchedPriority). Please refer to the options documentation and the `sched(7)` and `ioprio_set(2)` man pages for guidance on how to use them.
417
418- The `coursier` package's binary was renamed from `coursier` to `cs`. Completions which haven't worked for a while should now work with the renamed binary. To keep using `coursier`, you can create a shell alias.
419
420- The `services.mosquitto` module has been rewritten to support multiple listeners and per-listener configuration.
421 Module configurations from previous releases will no longer work and must be updated.
422
423- The `fluidsynth_1` attribute has been removed, as this legacy version is no longer needed in nixpkgs. The actively maintained 2.x series is available as `fluidsynth` unchanged.
424
425- Nextcloud 20 (`pkgs.nextcloud20`) has been dropped because it was EOLed by upstream in 2021-10.
426
427- The `virtualisation.pathsInNixDB` option was renamed
428 [`virtualisation.additionalPaths`](options.html#opt-virtualisation.additionalPaths).
429
430- The `services.ddclient.password` option was removed, and replaced with `services.ddclient.passwordFile`.
431
432- The default GNAT version has been changed: The `gnat` attribute now points to `gnat12`
433 instead of `gnat9`.
434
435- `retroArchCores` has been removed. This means that using `nixpkgs.config.retroarch` to customize RetroArch cores is not supported anymore. Instead, use package overrides, for example: `retroarch.override { cores = with libretro; [ citra snes9x ]; };`. Also, `retroarchFull` derivation is available for those who want to have all RetroArch cores available.
436
437- The Linux kernel for security reasons now restricts access to BPF syscalls via `BPF_UNPRIV_DEFAULT_OFF=y`. Unprivileged access can be reenabled via the `kernel.unprivileged_bpf_disabled` sysctl knob.
438
439- `/usr` will always be included in the initial ramdisk. See the `fileSystems.<name>.neededForBoot` option.
440 If any files exist under `/usr` (which is not typical for NixOS), they will be included in the initial ramdisk, increasing its size to a possibly problematic extent.
441
442- `pkgs.haskell-language-server` will now by default be linked dynamically to improve TemplateHaskell compatibility. To mitigate the increased closure size it will now by default only support our current default ghc (at the moment 9.0.2). Add other ghc versions via e.g. `pkgs.haskell-language-server.override { supportedGhcVersions = [ "90" "92" ]; }`.
443
444- `pkgs.redis` is now built using the system jemalloc. This disables the experimental active defragmentation feature of redis. Users who require this feature can switch back to redis' vendored version of jemalloc by setting `services.redis.package = pkgs.redis.override { useSystemJemalloc = false; };`.
445
446## Other Notable Changes {#sec-release-21.11-notable-changes}
447
448
449- The linux kernel package infrastructure was moved out of `all-packages.nix`, and restructured. Linux related functions and attributes now live under the `pkgs.linuxKernel` attribute set.
450 In particular the versioned `linuxPackages_*` package sets (such as `linuxPackages_5_4`) and kernels from `pkgs` were moved there and now live under `pkgs.linuxKernel.packages.*`. The unversioned ones (such as `linuxPackages_latest`) remain untouched.
451
452- In NixOS virtual machines (QEMU), the `virtualisation` module has been updated with new options:
453 - [`forwardPorts`](options.html#opt-virtualisation.forwardPorts) to configure IPv4 port forwarding,
454 - [`sharedDirectories`](options.html#opt-virtualisation.sharedDirectories) to set up shared host directories,
455 - [`resolution`](options.html#opt-virtualisation.resolution) to set the screen resolution,
456 - [`useNixStoreImage`](options.html#opt-virtualisation.useNixStoreImage) to use a disk image for the Nix store instead of 9P.
457
458 In addition, the default [`msize`](options.html#opt-virtualisation.msize) parameter in 9P filesystems (including /nix/store and all shared directories) has been increased to 16K for improved performance.
459
460- The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets.
461
462 However, if [`services.fail2ban.enable`](options.html#opt-services.fail2ban.enable) is `true`, the `fail2ban` will override the verbosity to `"VERBOSE"`, so that `fail2ban` can observe the failed login attempts from the SSH logs.
463
464- The [`services.xserver.extraLayouts`](options.html#opt-services.xserver.extraLayouts) no longer cause additional rebuilds when a layout is added or modified.
465
466- Sway: The terminal emulator `rxvt-unicode` is no longer installed by default via `programs.sway.extraPackages`. The current default configuration uses `alacritty` (and soon `foot`) so this is only an issue when using a customized configuration and not installing `rxvt-unicode` explicitly.
467
468- `python3` now defaults to Python 3.9. Python 3.9 introduces many deprecation warnings, please look at the [What's New In Python 3.9 post](https://docs.python.org/3/whatsnew/3.9.html) for more information.
469
470- `qtile` hase been updated from '0.16.0' to '0.18.0', please check [qtile changelog](https://github.com/qtile/qtile/blob/master/CHANGELOG) for changes.
471
472- The `claws-mail` package now references the new GTK+ 3 release branch, major version 4. To use the GTK+ 2 releases, one can install the `claws-mail-gtk2` package.
473
474- The wordpress module provides a new interface which allows to use different webservers with the new option [`services.wordpress.webserver`](options.html#opt-services.wordpress.webserver). Currently `httpd`, `caddy` and `nginx` are supported. The definitions of wordpress sites should now be set in [`services.wordpress.sites`](options.html#opt-services.wordpress.sites).
475
476 Sites definitions that use the old interface are automatically migrated in the new option. This backward compatibility will be removed in 22.05.
477
478- The dokuwiki module provides a new interface which allows to use different webservers with the new option [`services.dokuwiki.webserver`](options.html#opt-services.dokuwiki.webserver). Currently `caddy` and `nginx` are supported. The definitions of dokuwiki sites should now be set in [`services.dokuwiki.sites`](options.html#opt-services.dokuwiki.sites).
479
480 Sites definitions that use the old interface are automatically migrated in the new option. This backward compatibility will be removed in 22.05.
481
482- The order of NSS (host) modules has been brought in line with upstream
483 recommendations:
484
485 - The `myhostname` module is placed before the `resolve` (optional) and `dns`
486 entries, but after `file` (to allow overriding via `/etc/hosts` /
487 `networking.extraHosts`, and prevent ISPs with catchall-DNS resolvers from
488 hijacking `.localhost` domains)
489 - The `mymachines` module, which provides hostname resolution for local
490 containers (registered with `systemd-machined`) is placed to the front, to
491 make sure its mappings are preferred over other resolvers.
492 - If systemd-networkd is enabled, the `resolve` module is placed before
493 `files` and `myhostname`, as it provides the same logic internally, with
494 caching.
495 - The `mdns(_minimal)` module has been updated to the new priorities.
496
497 If you use your own NSS host modules, make sure to update your priorities
498 according to these rules:
499
500 - NSS modules which should be queried before `resolved` DNS resolution should
501 use mkBefore.
502 - NSS modules which should be queried after `resolved`, `files` and
503 `myhostname`, but before `dns` should use the default priority
504 - NSS modules which should come after `dns` should use mkAfter.
505
506- The [networking.wireless](options.html#opt-networking.wireless.enable) module (based on wpa_supplicant) has been heavily reworked, solving a number of issues and adding useful features:
507 - The automatic discovery of wireless interfaces at boot has been made reliable again (issues [#101963](https://github.com/NixOS/nixpkgs/issues/101963), [#23196](https://github.com/NixOS/nixpkgs/issues/23196)).
508 - WPA3 and Fast BSS Transition (802.11r) are now enabled by default for all networks.
509 - Secrets like pre-shared keys and passwords can now be handled safely, meaning without including them in a world-readable file (`wpa_supplicant.conf` under /nix/store).
510 This is achieved by storing the secrets in a secured [environmentFile](options.html#opt-networking.wireless.environmentFile) and referring to them though environment variables that are expanded inside the configuration.
511 - With multiple interfaces declared, independent wpa_supplicant daemons are started, one for each interface (the services are named `wpa_supplicant-wlan0`, `wpa_supplicant-wlan1`, etc.).
512 - The generated `wpa_supplicant.conf` file is now formatted for easier reading.
513 - A new [scanOnLowSignal](options.html#opt-networking.wireless.scanOnLowSignal) option has been added to facilitate fast roaming between access points (enabled by default).
514 - A new [networks.<name>.authProtocols](options.html#opt-networking.wireless.networks._name_.authProtocols) option has been added to change the authentication protocols used when connecting to a network.
515
516- The [networking.wireless.iwd](options.html#opt-networking.wireless.iwd.enable) module has a new [networking.wireless.iwd.settings](options.html#opt-networking.wireless.iwd.settings) option.
517
518- The [services.smokeping.host](options.html#opt-services.smokeping.host) option was added and defaulted to `localhost`. Before, `smokeping` listened to all interfaces by default. NixOS defaults generally aim to provide non-Internet-exposed defaults for databases and internal monitoring tools, see e.g. [#100192](https://github.com/NixOS/nixpkgs/issues/100192). Further, the systemd service for `smokeping` got reworked defaults for increased operational stability, see [PR #144127](https://github.com/NixOS/nixpkgs/pull/144127) for details.
519
520- The [services.syncoid.enable](options.html#opt-services.syncoid.enable) module now properly drops ZFS permissions after usage. Before it delegated permissions to whole pools instead of datasets and didn't clean up after execution. You can manually look this up for your pools by running `zfs allow your-pool-name` and use `zfs unallow syncoid your-pool-name` to clean this up.
521
522- Zfs: `latestCompatibleLinuxPackages` is now exported on the zfs package. One can use `boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;` to always track the latest compatible kernel with a given version of zfs.
523
524- Nginx will use the value of `sslTrustedCertificate` if provided for a virtual host, even if `enableACME` is set. This is useful for providers not using the same certificate to sign OCSP responses and server certificates.
525
526- `lib.formats.yaml`'s `generate` will not generate JSON anymore, but instead use more of the YAML-specific syntax.
527
528- MariaDB was upgraded from 10.5.x to 10.6.x. Please read the [upstream release notes](https://mariadb.com/kb/en/changes-improvements-in-mariadb-106/) for changes and upgrade instructions.
529
530- The MariaDB C client library, also known as libmysqlclient or mariadb-connector-c, was upgraded from 3.1.x to 3.2.x. While this should hopefully not have any impact, this upgrade comes with some changes to default behavior, so you might want to review the [upstream release notes](https://mariadb.com/kb/en/changes-and-improvements-in-mariadb-connector-c-32/).
531
532- GNOME desktop environment now enables `QGnomePlatform` as the Qt platform theme, which should avoid crashes when opening file chooser dialogs in Qt apps by using XDG desktop portal. Additionally, it will make the apps fit better visually.
533
534- `rofi` has been updated from '1.6.1' to '1.7.0', one important thing is the removal of the old xresources based configuration setup. Read more [in rofi's changelog](https://github.com/davatorium/rofi/blob/cb12e6fc058f4a0f4f/Changelog#L1).
535
536- ipfs now defaults to not listening on you local network. This setting was change as server providers won't accept port scanning on their private network. If you have several ipfs instances running on a network you own, feel free to change the setting `ipfs.localDiscovery = true;`. localDiscovery enables different instances to discover each other and share data.
537
538- `lua` and `luajit` interpreters have been patched to avoid looking into /usr/lib
539 directories, thus increasing the purity of the build.
540
541- Three new options, [xdg.mime.addedAssociations](#opt-xdg.mime.addedAssociations), [xdg.mime.defaultApplications](#opt-xdg.mime.defaultApplications), and [xdg.mime.removedAssociations](#opt-xdg.mime.removedAssociations) have been added to the [xdg.mime](#opt-xdg.mime.enable) module to allow the configuration of `/etc/xdg/mimeapps.list`.
542
543- Kopia was upgraded from 0.8.x to 0.9.x. Please read the [upstream release notes](https://github.com/kopia/kopia/releases/tag/v0.9.0) for changes and upgrade instructions.
544
545- The `systemd.network` module has gained support for the FooOverUDP link type.
546
547- The `networking` module has a new `networking.fooOverUDP` option to configure Foo-over-UDP encapsulations.
548
549- `networking.sits` now supports Foo-over-UDP encapsulation.
550
551- The `virtualisation.libvirtd` module has been refactored and updated with new options:
552 - `virtualisation.libvirtd.qemu*` options (e.g.: `virtualisation.libvirtd.qemuRunAsRoot`) were moved to [`virtualisation.libvirtd.qemu`](options.html#opt-virtualisation.libvirtd.qemu) submodule,
553 - software TPM1/TPM2 support (e.g.: Windows 11 guests) ([`virtualisation.libvirtd.qemu.swtpm`](options.html#opt-virtualisation.libvirtd.qemu.swtpm)),
554 - custom OVMF package (e.g.: `pkgs.OVMFFull` with HTTP, CSM and Secure Boot support) ([`virtualisation.libvirtd.qemu.ovmf.package`](options.html#opt-virtualisation.libvirtd.qemu.ovmf.package)).
555
556- The `cawbird` Twitter client now uses its own API keys to count as different application than upstream builds. This is done to evade application-level rate limiting. While existing accounts continue to work, users may want to remove and re-register their account in the client to enjoy a better user experience and benefit from this change.
557
558- A new option `services.prometheus.enableReload` has been added which can be enabled to reload the prometheus service when its config file changes instead of restarting.
559
560- The option `services.prometheus.environmentFile` has been removed since it was causing [issues](https://github.com/NixOS/nixpkgs/issues/126083) and Prometheus now has native support for secret files, i.e. `basic_auth.password_file` and `authorization.credentials_file`.
561
562- Dokuwiki now supports caddy! However
563 - the nginx option has been removed, in the new configuration, please use the `dokuwiki.webserver = "nginx"` instead.
564 - The "${hostname}" option has been deprecated, please use `dokuwiki.sites = [ "${hostname}" ]` instead
565
566- The [services.unifi](options.html#opt-services.unifi.enable) module has been reworked, solving a number of issues. This leads to several user facing changes:
567 - The `services.unifi.dataDir` option is removed and the data is now always located under `/var/lib/unifi/data`. This is done to make better use of systemd state direcotiry and thus making the service restart more reliable.
568 - The unifi logs can now be found under: `/var/log/unifi` instead of `/var/lib/unifi/logs`.
569 - The unifi run directory can now be found under: `/run/unifi` instead of `/var/lib/unifi/run`.
570
571- `security.pam.services.<name>.makeHomeDir` now uses `umask=0077` instead of `umask=0022` when creating the home directory.
572
573- Loki has had another release. Some default values have been changed for the configuration and some configuration options have been renamed. For more details, please check [the upgrade guide](https://grafana.com/docs/loki/latest/upgrading/#240).
574
575- `julia` now refers to `julia-stable` instead of `julia-lts`. In practice this means it has been upgraded from `1.0.4` to `1.5.4`.
576
577- RetroArch has been upgraded from version `1.8.5` to `1.9.13.2`. Since the previous release was quite old, if you're having issues after the upgrade, please delete your `$XDG_CONFIG_HOME/retroarch/retroarch.cfg` file.
578
579- hydrus has been upgraded from version `438` to `463`. Since upgrading between releases this old is advised against, be sure to have a backup of your data before upgrading. For details, see [the hydrus manual](https://hydrusnetwork.github.io/hydrus/help/getting_started_installing.html#big_updates).
580
581- More jdk and jre versions are now exposed via `java-packages.compiler`.
582
583- The sets `haskell.packages` and `haskell.compiler` now contain for every ghc version an attribute with the minor version dropped. E.g. for `ghc8107` there also now exists `ghc810`. Those attributes point to the same compilers and packagesets but have the advantage that e.g. `ghc92` stays stable when we update from `ghc925` to `ghc926`.