pyrox.dev
1# Release 22.05 (“Quokka”, 2022.05/30) {#sec-release-22.05}
2
3- Support is planned until the end of December 2022, handing over to 22.11.
4
5## Highlights {#sec-release-22.05-highlights}
6
7In addition to numerous new and upgraded packages, this release has the following highlights:
8
9- Nix has been updated from 2.3 to 2.8. This mainly brings experimental support
10 for Flakes, but also marks the `nix` command as experimental which now has to
11 be enabled via the configuration explicitly. For more information and
12 instructions for upgrades, see the
13 release notes for [nix-2.4](https://nixos.org/manual/nix/stable/release-notes/rl-2.4.html),
14 [nix-2.5](https://nixos.org/manual/nix/stable/release-notes/rl-2.5.html),
15 [nix-2.6](https://nixos.org/manual/nix/stable/release-notes/rl-2.6.html),
16 [nix-2.7](https://nixos.org/manual/nix/stable/release-notes/rl-2.7.html) and
17 [nix-2.8](https://nixos.org/manual/nix/stable/release-notes/rl-2.8.html)
18
19- The `firefox` browser on `x86_64-linux` now makes use of profile-guided
20 optimisation, resulting in a much more responsive browsing experience.
21
22- GNOME has been upgraded to 42. Please take a look at their [Release
23 Notes](https://release.gnome.org/42/) for details. In particular, it replaces
24 gedit with GNOME Text Editor, GNOME Terminal with GNOME Console (formerly
25 King's Cross) and GNOME Screenshot by a tool integrated into the Shell.
26
27- PHP 8.1 is now available.
28
29- systemd services can now set [systemd.services.\<name\>.reloadTriggers](#opt-systemd.services) instead of `reloadIfChanged` for a more granular distinction between reloads and restarts.
30
31- Systemd has been upgraded to the version 250.
32
33- Pulseaudio has been updated to version 15.0 and now optionally
34 [supports additional Bluetooth audio codecs](https://www.freedesktop.org/wiki/Software/PulseAudio/Notes/15.0/#supportforldacandaptxbluetoothcodecsplussbcxqsbcwithhigher-qualityparameters)
35 such as aptX or LDAC, with codec switching available in `pavucontrol`. This
36 feature is disabled by default, but can be enabled with the option
37 `hardware.pulseaudio.package = pkgs.pulseaudioFull;`. Existing third-party
38 modules that offered similar functions, such as `pulseaudio-modules-bt` or
39 `pulseaudio-hsphfpd`, are obsolete and have been removed.
40
41- PostgreSQL now defaults to major version 14.
42
43- Module authors can use `mkRenamedOptionModuleWith` to automate the deprecation cycle without annoying out-of-tree module authors and their users.
44
45- The default GHC version has been updated from 8.10.7 to 9.0.2. `pkgs.haskellPackages` and `pkgs.ghc` will now use this version by default.
46
47- The GNOME and Plasma installation CDs now use `pkgs.calamares` and `pkgs.calamares-nixos-extensions` to allow users to easily install and set up NixOS with a GUI.
48
49- `security.acme.defaults` has been added to simplify the configuration of
50 settings for many certificates at once. This also opens up the option to use
51 DNS-01 validation when using `enableACME` web server virtual hosts (e.g.
52 `services.nginx.virtualHosts.*.enableACME`).
53
54## New Services {#sec-release-22.05-new-services}
55
56- [1password](https://1password.com/), command-lines and graphic interface for 1Password. Available as [programs._1password](#opt-programs._1password.enable) and [programs._1password-gui](#opt-programs._1password.enable).
57
58- [aesmd](https://github.com/intel/linux-sgx#install-the-intelr-sgx-psw), the Intel SGX Architectural Enclave Service Manager. Available as [services.aesmd](#opt-services.aesmd.enable).
59
60- [agate](https://github.com/mbrubeck/agate), a very simple server for the Gemini hypertext protocol. Available as [services.agate](#opt-services.agate.enable).
61
62- [apfs](https://github.com/linux-apfs/linux-apfs-rw), a kernel module for mounting the Apple File System (APFS).
63
64- [argonone](https://gitlab.com/DarkElvenAngel/argononed), a replacement daemon for the Raspberry Pi Argon One power button and cooler. Available at [services.hardware.argonone](options.html#opt-services.hardware.argonone.enable).
65
66- [ArchiSteamFarm](https://github.com/JustArchiNET/ArchiSteamFarm), a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as [services.archisteamfarm](#opt-services.archisteamfarm.enable).
67
68- [BaGet](https://loic-sharma.github.io/BaGet/), a lightweight NuGet and symbol server. Available at services.baget.
69
70- [bird-lg](https://github.com/xddxdd/bird-lg-go), a BGP looking glass for Bird Routing. Available as [services.bird-lg](#opt-services.bird-lg.package).
71
72- [blocky](https://0xerr0r.github.io/blocky/), fast and lightweight DNS proxy as ad-blocker for local network with many features. Available as [services.blocky](#opt-services.blocky.enable).
73
74- [cloudflare-dyndns](https://github.com/kissgyorgy/cloudflare-dyndns), CloudFlare Dynamic DNS client. Available as [services.cloudflare-dyndns](#opt-services.cloudflare-dyndns.enable).
75
76- [Corosync](https://corosync.github.io/corosync/) and [Pacemaker](https://clusterlabs.org/pacemaker/), A open-source high availability resource manager. Available as [services.corosync](#opt-services.corosync.enable) and [services.pacemaker](#opt-services.pacemaker.enable).
77
78- [create_ap](https://github.com/lakinduakash/linux-wifi-hotspot), a module for creating wifi hotspots using the program linux-wifi-hotspot. Available as [services.create_ap](#opt-services.create_ap.enable).
79
80- [Envoy](https://www.envoyproxy.io/), a high-performance reverse proxy. Available as [services.envoy](#opt-services.envoy.enable).
81
82- [ergochat](https://ergo.chat), a modern IRC with IRCv3 features. Available as [services.ergochat](#opt-services.ergochat.enable).
83
84- [ethercalc](https://github.com/audreyt/ethercalc), an online collaborative spreadsheet. Available as [services.ethercalc](#opt-services.ethercalc.enable).
85
86- [filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html), a lightweight shipper for forwarding and centralizing log data. Available as [services.filebeat](#opt-services.filebeat.enable).
87
88- [FRRouting](https://frrouting.org/), a popular suite of Internet routing protocol daemons (BGP, BFD, OSPF, IS-IS, VRRP and others). Available as [services.frr](#opt-services.frr.babeld.enable).
89
90- [Grafana Mimir](https://grafana.com/oss/mimir/), an open source, horizontally scalable, highly available, multi-tenant, long-term storage for Prometheus. Available as [services.mimir](#opt-services.mimir.enable).
91
92- [Haste](https://hastebin.com/about.md), a pastebin written in node.js. Available as [services.haste](#opt-services.haste-server.enable).
93
94- [headscale](https://github.com/juanfont/headscale), an Open Source implementation of the [Tailscale](https://tailscale.io) Control Server. Available as [services.headscale](#opt-services.headscale.enable).
95
96- [heisenbridge](https://github.com/hifi/heisenbridge), a bouncer-style Matrix IRC bridge. Available as [services.heisenbridge](#opt-services.heisenbridge.enable).
97
98- [https-dns-proxy](https://github.com/aarond10/https_dns_proxy), DNS to DNS over HTTPS (DoH) proxy. Available as [services.https-dns-proxy](#opt-services.https-dns-proxy.enable).
99
100- [input-remapper](https://github.com/sezanzeb/input-remapper), an easy to use tool to change the mapping of your input device buttons. Available at [services.input-remapper](#opt-services.input-remapper.enable).
101
102- [InvoicePlane](https://invoiceplane.com), web application for managing and creating invoices. Available at [services.invoiceplane](#opt-services.invoiceplane.sites._name_.enable).
103
104- [k3b](https://userbase.kde.org/K3b), the KDE disk burning application. Available as [programs.k3b](#opt-programs.k3b.enable).
105
106- [K40-Whisperer](https://www.scorchworks.com/K40whisperer/k40whisperer.html), a program to control cheap Chinese laser cutters. Available as [programs.k40-whisperer.enable](#opt-programs.k40-whisperer.enable). Users must add themselves to the `k40` group to be able to access the device.
107
108- [kanidm](https://kanidm.github.io/kanidm/stable/), an identity management server written in Rust. Available as [services.kanidm](#opt-services.kanidm.enableServer)
109
110- [Maddy](https://maddy.email/), a free an open source mail server. Available as [services.maddy](#opt-services.maddy.enable).
111
112- [matrix-conduit](https://conduit.rs/), a simple, fast and reliable chat server powered by matrix. Available as [services.matrix-conduit](options.html#opt-services.matrix-conduit.enable).
113
114- [Moosefs](https://moosefs.com), fault tolerant petabyte distributed file system. Available as [moosefs](#opt-services.moosefs.master.enable).
115
116- [mozillavpn](https://github.com/mozilla-mobile/mozilla-vpn-client), the client for the [Mozilla VPN](https://vpn.mozilla.org/) service. Available as [services.mozillavpn](#opt-services.mozillavpn.enable).
117
118- [mtr-exporter](https://github.com/mgumz/mtr-exporter), a Prometheus exporter for mtr metrics. Available as [services.mtr-exporter](#opt-services.mtr-exporter.enable).
119
120- [nbd](https://nbd.sourceforge.io/), a Network Block Device server. Available as [services.nbd](#opt-services.nbd.server.enable).
121
122- [netbox](https://github.com/netbox-community/netbox), infrastructure resource modeling (IRM) tool. Available as [services.netbox](#opt-services.netbox.enable).
123
124- [nethoscope](https://github.com/vvilhonen/nethoscope), listen to your network traffic. Available as [programs.nethoscope](#opt-programs.nethoscope.enable).
125
126- [nifi](https://nifi.apache.org), an easy to use, powerful, and reliable system to process and distribute data. Available as [services.nifi](#opt-services.nifi.enable).
127
128- [nix-ld](https://github.com/Mic92/nix-ld), Run unpatched dynamic binaries on NixOS. Available as [programs.nix-ld](#opt-programs.nix-ld.enable).
129
130- [NNCP](http://www.nncpgo.org), NNCP (Node to Node copy) utilities and configuration, Available as [programs.nncp](#opt-programs.nncp.enable).
131
132- [pgadmin4](https://github.com/postgres/pgadmin4), an admin interface for the PostgreSQL database. Available at [services.pgadmin](#opt-services.pgadmin.enable).
133
134- [PowerDNS-Admin](https://github.com/ngoduykhanh/PowerDNS-Admin), a web interface for the PowerDNS server. Available at [services.powerdns-admin](#opt-services.powerdns-admin.enable).
135
136- [prometheus-pve-exporter](https://github.com/prometheus-pve/prometheus-pve-exporter), a tool that exposes information from the Proxmox VE API for use by Prometheus. Available as [services.prometheus.exporters.pve](#opt-services.prometheus.exporters.pve.enable).
137
138- [prosody-filer](https://github.com/ThomasLeister/prosody-filer), a server for handling XMPP HTTP Upload requests. Available at [services.prosody-filer](#opt-services.prosody-filer.enable).
139
140- [Public Inbox](https://public-inbox.org), an "archives first" approach to mailing lists. Available as [services.public-inbox](#opt-services.public-inbox.enable).
141
142- [r53-ddns](https://github.com/fleaz/r53-ddns), a small tool to run your own DDNS service via AWS Route53. Available as [services.r53-ddns](#opt-services.r53-ddns.enable).
143
144- [rmfakecloud](https://ddvk.github.io/rmfakecloud/), a clone of the cloud sync the remarkable tablet. Available as [services.rmfakecloud](#opt-services.rmfakecloud.enable).
145
146- [rootless Docker](https://docs.docker.com/engine/security/rootless/), a `systemd --user` Docker service which runs without root permissions. Available as [virtualisation.docker.rootless.enable](#opt-virtualisation.docker.rootless.enable).
147
148- [rstudio-server](https://www.rstudio.com/products/rstudio/#rstudio-server), a browser-based version of the RStudio IDE for the R programming language. Available as [services.rstudio-server](#opt-services.rstudio-server.enable).
149
150- [mediamtx](https://github.com/aler9/mediamtx), ready-to-use RTSP / RTMP / HLS server and proxy that allows to read, publish and proxy video and audio streams. Available as [services.mediamtx](#opt-services.mediamtx.enable).
151
152- [Snipe-IT](https://snipeitapp.com), a free open source IT asset/license management system. Available as [services.snipe-it](#opt-services.snipe-it.enable).
153
154- [snowflake-proxy](https://snowflake.torproject.org/), a system to defeat internet censorship. Available as [services.snowflake-proxy](#opt-services.snowflake-proxy.enable).
155
156- [sslmate-agent](https://sslmate.com/), a daemon for managing SSL/TLS certificates on a server. Available as [services.sslmate-agent](services.sslmate-agent.enable).
157
158- [starship](https://starship.rs), a minimal, blazing-fast, and infinitely customizable prompt for any shell. Available at [programs.startship](#opt-programs.starship.enable).
159
160- [systembus-notify](https://github.com/rfjakob/systembus-notify), allow system level notifications to reach the users. Available as [services.systembus-notify](opt-services.systembus-notify.enable). Please keep in mind that this service should only be enabled on machines with fully trusted users, as any local user is able to DoS user sessions by spamming notifications.
161
162- [teleport](https://goteleport.com), allows engineers and security professionals to unify access for SSH servers, Kubernetes clusters, web applications, and databases across all environments. Available at [services.teleport](#opt-services.teleport.enable).
163
164- [tetrd](https://tetrd.app), share your internet connection from your device to your PC and vice versa through a USB cable. Available at [services.tetrd](#opt-services.tetrd.enable).
165
166- [uptermd](https://upterm.dev), an open-source solution for sharing terminal sessions instantly over the public internet via secure tunnels. Available at [services.uptermd](#opt-services.uptermd.enable).
167
168- [usbrelayd](https://github.com/darrylb123/usbrelay), an USB Relay MQTT daemon. Available as [services.usbrelayd](#opt-services.usbrelayd.enable).
169
170- [webdav-server-rs](https://github.com/miquels/webdav-server-rs), Webdav server in rust. Available as [services.webdav-server-rs](#opt-services.webdav-server-rs.enable).
171
172- [wg-netmanager](https://github.com/gin66/wg_netmanager), the Wireguard network manager. Available as [services.wg-netmanager](#opt-services.wg-netmanager.enable).
173
174- [Zammad](https://zammad.org/), a web-based, open source user support/ticketing solution. Available as [services.zammad](#opt-services.zammad.enable).
175
176<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
177
178## Backward Incompatibilities {#sec-release-22.05-incompatibilities}
179
180- `pkgs.ghc` now refers to `pkgs.targetPackages.haskellPackages.ghc`.
181 This _only_ makes a difference if you are cross-compiling and will
182 ensure that `pkgs.ghc` always runs on the host platform and compiles
183 for the target platform (similar to `pkgs.gcc` for example).
184 `haskellPackages.ghc` still behaves as before, running on the build
185 platform and compiling for the host platform (similar to `stdenv.cc`).
186 This means you don't have to adjust your derivations if you use
187 `haskellPackages.callPackage`, but when using `pkgs.callPackage` and
188 taking `ghc` as an input, you should now use `buildPackages.ghc`
189 instead to ensure cross compilation keeps working (or switch to
190 `haskellPackages.callPackage`).
191
192- `pkgs.ghc.withPackages` as well as `haskellPackages.ghcWithPackages` etc.
193 now needs be overridden directly, as opposed to overriding the result of
194 calling it. Additionally, the `withLLVM` parameter has been renamed to
195 `useLLVM`. So instead of `(ghc.withPackages (p: [])).override { withLLVM = true; }`,
196 one needs to use `(ghc.withPackages.override { useLLVM = true; }) (p: [])`.
197
198- The update of the haskell package set brings with it a new version of the `xmonad`
199 module, which will break your configuration if you use `launch` as entrypoint. The
200 example code the corresponding nixos module was adjusted, you may want to have a look at it.
201
202- The `home-assistant` module now requires users that don't want their
203 configuration to be managed declaratively to set
204 `services.home-assistant.config = null;`. This is required
205 due to the way default settings are handled with the new settings style.
206
207 Additionally the default list of `extraComponents` now includes the minimal
208 dependencies to successfully complete the [onboarding](https://www.home-assistant.io/getting-started/onboarding/)
209 procedure.
210
211- `pkgs.emacsPackages.orgPackages` is removed because org elpa is deprecated.
212 The packages in the top level of `pkgs.emacsPackages`, such as org and
213 org-contrib, refer to the ones in `pkgs.emacsPackages.elpaPackages` and
214 `pkgs.emacsPackages.nongnuPackages` where the new versions will release.
215
216- The configuration and state directories used by `nixos-containers` have been
217 moved from `/etc/containers` and `/var/lib/containers` to
218 `/etc/nixos-containers` and `/var/lib/nixos-containers`.
219
220 If you are changing `system.stateVersion` to `"22.05"` manually on an existing
221 system you are responsible for migrating these directories yourself.
222
223 This is to improve compatibility with `libcontainer` based software such as Podman and Skopeo
224 which assumes they have ownership over `/etc/containers`.
225
226- `lib.systems.supported` has been removed, as it was overengineered for determining the systems to support in the nixpkgs flake. The list of systems exposed by the nixpkgs flake can now be accessed as `lib.systems.flakeExposed`.
227
228- For new installations `virtualisation.oci-containers.backend` is now set to `podman` by default.
229 If you still want to use Docker on systems where `system.stateVersion` is set to to `"22.05"` set `virtualisation.oci-containers.backend = "docker";`.Old systems with older `stateVersion`s stay with "docker".
230
231- `security.klogd` was removed. Logging of kernel messages is handled
232 by systemd since Linux 3.5.
233
234- `pkgs.ssmtp` has been dropped due to the program being unmaintained.
235 `pkgs.msmtp` can be used instead as a substitute `sendmail` implementation.
236 The corresponding options `services.ssmtp.*` have been removed as well.
237 `programs.msmtp.*` can be used instead for an equivalent setup. For example:
238
239 ```nix
240 {
241 # Original ssmtp configuration:
242 services.ssmtp = {
243 enable = true;
244 useTLS = true;
245 useSTARTTLS = true;
246 hostName = "smtp.example:587";
247 authUser = "someone";
248 authPassFile = "/secrets/password.txt";
249 };
250
251 # Equivalent msmtp configuration:
252 programs.msmtp = {
253 enable = true;
254 accounts.default = {
255 tls = true;
256 tls_starttls = true;
257 auth = true;
258 host = "smtp.example";
259 port = 587;
260 user = "someone";
261 passwordeval = "cat /secrets/password.txt";
262 };
263 };
264 }
265 ```
266
267- `services.kubernetes.addons.dashboard` was removed due to it being an outdated version.
268
269- `services.kubernetes.scheduler.{port,address}` now set `--secure-port` and `--bind-address` instead of `--port` and `--address`, since the former have been deprecated and are no longer functional in kubernetes>=1.23. Ensure that you are not relying on the insecure behaviour before upgrading.
270
271- In the PowerDNS Recursor module (`services.pdns-recursor`), default values of several IP address-related NixOS options have been updated to match the default upstream behavior.
272 In particular, Recursor by default will:
273 - listen on (and allows connections from) both IPv4 and IPv6 addresses
274 (`services.pdns-recursor.dns.address`, `services.pdns-recursor.dns.allowFrom`);
275 - allow only local connections to the REST API server (`services.pdns-recursor.api.allowFrom`).
276
277- In the ncdns module, the default value of `services.ncdns.address` has been changed to the IPv6 loopback address (`::1`).
278
279- `openldap` (and therefore the slapd LDAP server) were updated to version 2.6.2. The project introduced backwards-incompatible changes, namely the removal of the bdb, hdb, ndb, and shell backends in slapd. Therefore before updating, dump your database `slapcat -n 1` in LDIF format, and reimport it after updating your `services.openldap.settings`, which represents your `cn=config`.
280
281 Additionally with 2.5 the argon2 module was included in the standard distribution and renamed from `pw-argon2` to `argon2`. Remember to update your `olcModuleLoad` entry in `cn=config`.
282
283- `openssh` has been update to 8.9p1, changing the FIDO security key middleware interface.
284
285- `git` no longer hardcodes the path to openssh' ssh binary to reduce the amount of rebuilds. If you are using git with ssh remotes and do not have a ssh binary in your environment consider adding `openssh` to it or switching to `gitFull`.
286
287- `services.k3s.enable` no longer implies `systemd.enableUnifiedCgroupHierarchy = false`, and will default to the 'systemd' cgroup driver when using `services.k3s.docker = true`.
288 This change may require a reboot to take effect, and k3s may not be able to run if the boot cgroup hierarchy does not match its configuration.
289 The previous behavior may be retained by explicitly setting `systemd.enableUnifiedCgroupHierarchy = false` in your configuration.
290
291- `fonts.fonts` no longer includes ancient bitmap fonts when both `config.services.xserver.enable` and `config.nixpkgs.config.allowUnfree` are enabled.
292 If you still want these fonts, use:
293
294 ```nix
295 {
296 fonts.fonts = [
297 pkgs.xorg.fontbhlucidatypewriter100dpi
298 pkgs.xorg.fontbhlucidatypewriter75dpi
299 pkgs.xorg.fontbh100dpi
300 ];
301 }
302 ```
303
304- `services.prometheus.alertManagerTimeout` has been removed as it has been deprecated upstream and has no effect.
305
306- The DHCP server (`services.dhcpd4`, `services.dhcpd6`) has been hardened.
307 The service is now using the systemd's `DynamicUser` mechanism to run as an unprivileged dynamically-allocated user with limited capabilities.
308 The dhcpd state files are now always stored in `/var/lib/dhcpd{4,6}` and the `services.dhcpd4.stateDir` and `service.dhcpd6.stateDir` options have been removed.
309 If you were depending on root privileges or set{uid,gid,cap} binaries in dhcpd shell hooks, you may give dhcpd more capabilities with e.g. `systemd.services.dhcpd6.serviceConfig.AmbientCapabilities`.
310
311- The `mailpile` email webclient (`services.mailpile`) has been removed due to its reliance on python2.
312
313- `services.ipfs.extraFlags` is now escaped with `utils.escapeSystemdExecArgs`. If you rely on systemd interpolating `extraFlags` in the service `ExecStart`, this will no longer work.
314
315- `hbase` version 0.98.24 has been removed. The package now defaults to version 2.4.11. Versions 1.7.1 and 3.0.0-alpha-2 are also available.
316
317- `services.paperless-ng` was renamed to `services.paperless`. Accordingly, the `paperless-ng-manage` script (located in `dataDir`) was renamed to `paperless-manage`. `services.paperless` now uses `paperless-ngx`.
318
319- The `matrix-synapse` service (`services.matrix-synapse`) has been converted to use the `settings` option defined in RFC42.
320 This means that options that are part of your `homeserver.yaml` configuration, and that were specified at the top-level of the
321 module (`services.matrix-synapse`) now need to be moved into `services.matrix-synapse.settings`. And while not all options you
322 may use are defined in there, they are still supported, because you can set arbitrary values in this freeform type.
323
324 The `listeners.*.bind_address` option was renamed to `bind_addresses` in order to match the upstream `homeserver.yaml` option
325 name. It is now also a list of strings instead of a string.
326
327 An example to make the required migration clearer:
328
329 Before:
330 ```nix
331 {
332 services.matrix-synapse = {
333 enable = true;
334
335 server_name = "example.com";
336 public_baseurl = "https://example.com:8448";
337
338 enable_registration = false;
339 registration_shared_secret = "xohshaeyui8jic7uutuDogahkee3aehuaf6ei3Xouz4iicie5thie6nohNahceut";
340 macaroon_secret_key = "xoo8eder9seivukaiPh1cheikohquuw8Yooreid0The4aifahth3Ou0aiShaiz4l";
341
342 tls_certificate_path = "/var/lib/acme/example.com/fullchain.pem";
343 tls_certificate_path = "/var/lib/acme/example.com/fullchain.pem";
344
345 listeners = [
346 {
347 port = 8448;
348 bind_address = "";
349 type = "http";
350 tls = true;
351 resources = [
352 {
353 names = [ "client" ];
354 compress = true;
355 }
356 {
357 names = [ "federation" ];
358 compress = false;
359 }
360 ];
361 }
362 ];
363
364 };
365 }
366 ```
367
368 After:
369 ```nix
370 {
371 services.matrix-synapse = {
372 enable = true;
373
374 # this attribute set holds all values that go into your homeserver.yaml configuration
375 # See https://github.com/matrix-org/synapse/blob/develop/docs/sample_config.yaml for
376 # possible values.
377 settings = {
378 server_name = "example.com";
379 public_baseurl = "https://example.com:8448";
380
381 enable_registration = false;
382 # pass `registration_shared_secret` and `macaroon_secret_key` via `extraConfigFiles` instead
383
384 tls_certificate_path = "/var/lib/acme/example.com/fullchain.pem";
385 tls_certificate_path = "/var/lib/acme/example.com/fullchain.pem";
386
387 listeners = [
388 {
389 port = 8448;
390 bind_addresses = [
391 "::"
392 "0.0.0.0"
393 ];
394 type = "http";
395 tls = true;
396 resources = [
397 {
398 names = [ "client" ];
399 compress = true;
400 }
401 {
402 names = [ "federation" ];
403 compress = false;
404 }
405 ];
406 }
407 ];
408 };
409
410 extraConfigFiles = [ "/run/keys/matrix-synapse/secrets.yaml" ];
411 };
412 }
413 ```
414
415 The secrets in your original config should be migrated into a YAML file that is included via `extraConfigFiles`. The filename must be quoted to prevent nix from copying it to the (world readable) store.
416
417 Additionally a few option defaults have been synced up with upstream default values, for example the `max_upload_size` grew from `10M` to `50M`. For the same reason, the default
418 `media_store_path` was changed from `${dataDir}/media` to `${dataDir}/media_store` if `system.stateVersion` is at least `22.05`. Files will need to be manually moved to the new
419 location if the `stateVersion` is updated.
420
421 As of Synapse 1.58.0, the old groups/communities feature has been disabled by default. It will be completely removed with Synapse 1.61.0.
422
423- The Keycloak package (`pkgs.keycloak`) has been switched from the
424 Wildfly version, which will soon be deprecated, to the Quarkus based
425 version. The Keycloak service (`services.keycloak`) has been updated
426 to accommodate the change and now differs from the previous version
427 in a few ways:
428
429 - `services.keycloak.extraConfig` has been removed in favor of the
430 new [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)
431 [`services.keycloak.settings`](#opt-services.keycloak.settings)
432 option. The available options correspond directly to parameters in
433 `conf/keycloak.conf`. Some of the most important parameters are
434 documented as suboptions, the rest can be found in the [All
435 configuration section of the Keycloak Server Installation and
436 Configuration
437 Guide](https://www.keycloak.org/server/all-config). While the new
438 configuration is much simpler and cleaner than the old JBoss CLI
439 one, this unfortunately mean that there's no straightforward way
440 to convert an old configuration to the new format and some
441 settings may not even be available anymore.
442
443 - `services.keycloak.frontendUrl` was removed and the frontend URL
444 is now configured through the `hostname` family of settings in
445 [`services.keycloak.settings`](#opt-services.keycloak.settings)
446 instead. See the [Hostname section of the Keycloak Server
447 Installation and Configuration
448 Guide](https://www.keycloak.org/server/hostname) for more
449 details. Additionally, `/auth` was removed from the default
450 context path and needs to be added back in
451 [`services.keycloak.settings.http-relative-path`](#opt-services.keycloak.settings.http-relative-path)
452 if you want to keep compatibility with your current clients.
453
454 - `services.keycloak.bindAddress`,
455 `services.keycloak.forceBackendUrlToFrontendUrl`,
456 `services.keycloak.httpPort` and `services.keycloak.httpsPort`
457 have been removed in favor of their equivalent options in
458 [`services.keycloak.settings`](#opt-services.keycloak.settings). `httpPort`
459 and `httpsPort` have additionally had their types changed from
460 `str` to `port`.
461
462 The new names are as follows:
463 - `bindAddress`: [`services.keycloak.settings.http-host`](#opt-services.keycloak.settings.http-host)
464 - `forceBackendUrlToFrontendUrl`: `services.keycloak.settings.hostname-strict-backchannel`
465 - `httpPort`: [`services.keycloak.settings.http-port`](#opt-services.keycloak.settings.http-port)
466 - `httpsPort`: [`services.keycloak.settings.https-port`](#opt-services.keycloak.settings.https-port)
467
468 For example, when using a reverse proxy the migration could look
469 like this:
470
471 Before:
472 ```nix
473 {
474 services.keycloak = {
475 enable = true;
476 httpPort = "8080";
477 frontendUrl = "https://keycloak.example.com/auth";
478 database.passwordFile = "/run/keys/db_password";
479 extraConfig = {
480 "subsystem=undertow"."server=default-server"."http-listener=default".proxy-address-forwarding =
481 true;
482 };
483 };
484 }
485 ```
486
487 After:
488 ```nix
489 {
490 services.keycloak = {
491 enable = true;
492 settings = {
493 http-port = 8080;
494 hostname = "keycloak.example.com";
495 http-relative-path = "/auth";
496 proxy = "edge";
497 };
498 database.passwordFile = "/run/keys/db_password";
499 };
500 }
501 ```
502
503- The MoinMoin wiki engine (`services.moinmoin`) has been removed, because Python 2 is being retired from nixpkgs.
504
505- Services in the `hadoop` module previously set `openFirewall` to true by default.
506 This has now been changed to false. Node definitions for multi-node clusters would need
507 `openFirewall = true;` to be added to to hadoop services when upgrading from NixOS 21.11.
508
509- `services.hadoop.yarn.nodemanager` now uses cgroup-based CPU limit enforcement by default.
510 Additionally, the option `useCGroups` was added to nodemanagers as an easy way to switch
511 back to the old behavior.
512
513- The `wafHook` hook now honors `NIX_BUILD_CORES` when `enableParallelBuilding` is not set explicitly. Packages can restore the old behaviour by setting `enableParallelBuilding=false`.
514
515- `pkgs.claws-mail-gtk2`, representing Claws Mail's older release version three, was removed in order to get rid of Python 2.
516 Please switch to `claws-mail`, which is Claws Mail's latest release based on GTK+3 and Python 3.
517
518- The `writers.writePython2` and corresponding `writers.writePython2Bin` convenience functions to create executable Python 2 scripts in the store were removed in preparation of removal of the Python 2 interpreter.
519 Scripts have to be converted to Python 3 for use with `writers.writePython3` or `writers.writePyPy2` needs to be used.
520
521- `buildGoModule` was updated to use `go_1_17`, third party derivations that specify >= go 1.17 in the main `go.mod` will need to regenerate their `vendorSha256` hash.
522
523- The `gnome-passwordsafe` package updated to [version 6.x](https://gitlab.gnome.org/World/secrets/-/tags/6.0) and renamed to `gnome-secrets`.
524
525- `services.gnome.experimental-features.realtime-scheduling` option has been removed, as GNOME Shell now [uses rtkit](https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/2060). Use `security.rtkit.enable = true;` instead. As before, you will need to have it enabled using GSettings.
526
527- `services.telepathy` will no longer be enabled by default for GNOME desktops, one should enable it in their configs if using Empathy or Polari.
528
529- If you previously used `/etc/docker/daemon.json`, you need to incorporate the changes into the new option `virtualisation.docker.daemon.settings`.
530
531- Ntopng (`services.ntopng`) is updated to 5.2.1 and uses a separate Redis instance if `system.stateVersion` is at least `22.05`. Existing setups shouldn't be affected.
532
533- The backward compatibility in `services.wordpress` to configure sites with
534 the old interface has been removed. Please use `services.wordpress.sites`
535 instead.
536
537- The backward compatibility in `services.dokuwiki` to configure sites with the
538 old interface has been removed. Please use `services.dokuwiki.sites` instead.
539
540- opensmtpd-extras is no longer build with python2 scripting support due to python2 deprecation in nixpkgs
541
542- `services.miniflux.adminCredentialFiles` is now required, instead of defaulting to `admin` and `password`.
543
544- The `taskserver` module no longer implicitly opens ports in the firewall
545 configuration. This is now controlled through the option
546 `services.taskserver.openFirewall`.
547
548- The `autorestic` package has been upgraded from 1.3.0 to 1.5.0 which introduces breaking changes in config file, check [their migration guide](https://autorestic.vercel.app/migration/1.4_1.5) for more details.
549
550- `teleport` has been upgraded to major version 9. Please see upstream [upgrade instructions](https://goteleport.com/docs/setup/operations/upgrading/) and [release notes](https://goteleport.com/docs/changelog/#900).
551
552- For `pkgs.python3.pkgs.ipython`, its direct dependency `pkgs.python3.pkgs.matplotlib-inline`
553 (which is really an adapter to integrate matplotlib in ipython if it is installed) does
554 not depend on `pkgs.python3.pkgs.matplotlib` anymore.
555 This is closer to a non-Nix install of ipython.
556 This has the added benefit to reduce the closure size of `ipython` from ~400MB to ~160MB
557 (including ~100MB for python itself).
558
559- `documentation.man` has been refactored to support choosing a man implementation other than GNU's `man-db`. For this, `documentation.man.manualPages` has been renamed to `documentation.man.man-db.manualPages`. If you want to use the new alternative man implementation `mandoc`, add `documentation.man = { enable = true; man-db.enable = false; mandoc.enable = true; }` to your configuration.
560
561- Normal users (with `isNormalUser = true`) which have non-empty `subUidRanges` or `subGidRanges` set no longer have additional implicit ranges allocated. To enable automatic allocation back set `autoSubUidGidRange = true`.
562
563- `idris2` now requires `--package` when using packages `contrib` and `network`, while previously these idris2 packages were automatically loaded.
564
565- The iputils package, which is installed by default, no longer provides the
566 legacy tools `tftpd` and `traceroute6`. More tools (`ninfod`, `rarpd`, and
567 `rdisc`) are going to be removed in the next release. See
568 [upstream's release notes](https://github.com/iputils/iputils/releases/tag/20211215)
569 for more details and available replacements.
570
571- `services.thelounge.private` was removed in favor of `services.thelounge.public`, to follow with upstream changes.
572
573- `pkgs.docbookrx` was removed since it's unmaintained
574
575- `pkgs._7zz` is now correctly licensed as LGPL3+ and BSD3 with optional unfree unRAR licensed code
576
577- The `vim.customize` function produced by `vimUtils.makeCustomizable` now has a slightly different interface:
578 * The wrapper now includes everything in the given Vim derivation if `name` is `"vim"` (the default). This makes the `wrapManual` argument obsolete, but this behavior can be overridden by setting the `standalone` argument.
579 * All the executables present in the given derivation (or, in `standalone` mode, only the `*vim` ones) are wrapped. This makes the `wrapGui` argument obsolete.
580 * The `vimExecutableName` and `gvimExecutableName` arguments were replaced by a single `executableName` argument in which the shell variable `$exe` can be used to refer to the wrapped executable's name.
581
582 See the comments in `pkgs/applications/editors/vim/plugins/vim-utils.nix` for more details.
583
584 `vimUtils.vimWithRC` was removed. You should instead use `customize` on a Vim derivation, which now accepts `vimrcFile` and `gvimrcFile` arguments.
585
586- `tilp2` was removed together with its module
587
588- The F-PROT antivirus (`fprot` package) and its service module were removed because it
589 reached [end-of-life](https://kb.cyren.com/av-support/index.php?/Knowledgebase/Article/View/434/0/end-of-sale--end-of-life-for-f-prot-and-csam).
590
591- `bird1` and its modules `services.bird` as well as `services.bird6` have been removed. Upgrade to `services.bird2`.
592
593- The options `networking.interfaces.<name>.ipv4.routes` and `networking.interfaces.<name>.ipv6.routes` are no longer ignored when using networkd instead of the default scripted network backend by setting `networking.useNetworkd` to `true`.
594
595- The `miller` package has been upgraded from 5.10.3 to [6.2.0](https://github.com/johnkerl/miller/releases/tag/v6.2.0). See [What's new in Miller 6](https://miller.readthedocs.io/en/latest/new-in-miller-6).
596
597- MultiMC has been replaced with the fork PrismLauncher due to upstream
598 developers being hostile to 3rd party package maintainers. PrismLauncher
599 removes all MultiMC branding and is aimed at providing proper 3rd party
600 packages like the one contained in Nixpkgs. This change affects the data
601 folder where game instances and other save and configuration files are stored.
602 Users with existing installations should rename `~/.local/share/multimc` to
603 `~/.local/share/PrismLauncher`. The main config file's path has also moved
604 from `~/.local/share/multimc/multimc.cfg` to
605 `~/.local/share/PrismLauncher/prismlauncher.cfg`.
606
607- `systemd-nspawn@.service` settings have been reverted to the default systemd behaviour. User namespaces are now activated by default. If you want to keep running nspawn containers without user namespaces you need to set `systemd.nspawn.<name>.execConfig.PrivateUsers = false`
608
609- `systemd-shutdown` is now properly linked on shutdown to unmount all filesystems and device mapper devices cleanly. This can be disabled using `systemd.shutdownRamfs.enable`.
610
611- The Tor SOCKS proxy is now actually disabled if `services.tor.client.enable` is set to `false` (the default). If you are using this functionality but didn't change the setting or set it to `false`, you now need to set it to `true`.
612
613- `services.github-runner` has been hardened. Notably address families and
614 system calls have been restricted, which may adversely affect some kinds of
615 testing, e.g. using `AF_BLUETOOTH` to test bluetooth devices.
616
617- The terraform 0.12 compatibility has been removed and the `terraform.withPlugins` and `terraform-providers.mkProvider` implementations simplified. Providers now need to be stored under
618`$out/libexec/terraform-providers/<registry>/<owner>/<name>/<version>/<os>_<arch>/terraform-provider-<name>_v<version>` (which mkProvider does).
619
620 This breaks back-compat so it's not possible to mix-and-match with previous versions of nixpkgs. In exchange, it now becomes possible to use the providers from [nixpkgs-terraform-providers-bin](https://github.com/numtide/nixpkgs-terraform-providers-bin) directly.
621
622- The `dendrite` package has been upgraded from 0.5.1 to
623 [0.6.5](https://github.com/matrix-org/dendrite/releases/tag/v0.6.5). Instances
624 configured with split sqlite databases, which has been the default
625 in NixOS, require merging of the federation sender and signing key
626 databases. See upstream [release
627 notes](https://github.com/matrix-org/dendrite/releases/tag/v0.6.0)
628 on version 0.6.0 for details on database changes.
629
630- The existing `pkgs.opentelemetry-collector` has been moved to
631 `pkgs.opentelemetry-collector-contrib` to match the actual source being the
632 "contrib" edition. `pkgs.opentelemetry-collector` is now the actual core
633 release of opentelemetry-collector. If you use the community contributions
634 you should change the package you refer to. If you don't need them update your
635 commands from `otelcontribcol` to `otelcorecol` and enjoy a 7x smaller binary.
636
637- `services.zookeeper` has a new option `jre` for specifying the JRE to start
638 zookeeper with. It defaults to the JRE that `pkgs.zookeeper` was wrapped with,
639 instead of `pkgs.jre`. This changes the JRE to `pkgs.jdk11_headless` by default.
640
641- `pkgs.pgadmin` now refers to `pkgs.pgadmin4`. `pgadmin3` has been removed.
642
643- `pkgs.minetestclient_4` and `pkgs.minetestserver_4` have been removed, as the last 4.x release was in 2018. `pkgs.minetestclient` (equivalent to `pkgs.minetest` ) and `pkgs.minetestserver` can be used instead.
644
645- `pkgs.noto-fonts-cjk` is now deprecated in favor of `pkgs.noto-fonts-cjk-sans`
646 and `pkgs.noto-fonts-cjk-serif` because they each have different release
647 schedules. To maintain compatibility with prior releases of Nixpkgs,
648 `pkgs.noto-fonts-cjk` is currently an alias of `pkgs.noto-fonts-cjk-sans` and
649 doesn't include serif fonts.
650
651- `pkgs.epgstation` has been upgraded from v1 to v2, resulting in incompatible
652 changes in the database scheme and configuration format.
653
654- Some top-level settings under [services.epgstation](#opt-services.epgstation.enable)
655 is now deprecated because it was redundant due to the same options being
656 present in [services.epgstation.settings](#opt-services.epgstation.settings).
657
658- The option `services.epgstation.basicAuth` was removed because basic
659 authentication support was dropped by upstream.
660
661- The option [services.epgstation.database.passwordFile](#opt-services.epgstation.database.passwordFile)
662 no longer has a default value. Make sure to set this option explicitly before
663 upgrading. Change the database password if necessary.
664
665- The [services.epgstation.settings](#opt-services.epgstation.settings)
666 option now expects options for `config.yml` in EPGStation v2.
667
668- Existing data for the [services.epgstation](#opt-services.epgstation.enable)
669 module would have to be backed up prior to the upgrade. To back up existing
670 data to `/tmp/epgstation.bak`, run
671 `sudo -u epgstation epgstation run backup /tmp/epgstation.bak`.
672 To import that data after to the upgrade, run
673 `sudo -u epgstation epgstation run v1migrate /tmp/epgstation.bak`
674
675- `switch-to-configuration` (the script that is run when running `nixos-rebuild switch` for example) has been reworked
676 * The interface that allows activation scripts to restart units has been streamlined. Restarting and reloading is now done by a single file `/run/nixos/activation-restart-list` that honors `restartIfChanged` and `reloadIfChanged` of the units.
677 * Preferring to reload instead of restarting can still be achieved using `/run/nixos/activation-reload-list`.
678 * The script now uses a proper ini-file parser to parse systemd units. Some values are now only searched in one section instead of in the entire unit. This is only relevant for units that don't use the NixOS systemd moule.
679 * `RefuseManualStop`, `X-OnlyManualStart`, `X-StopOnRemoval`, `X-StopOnReconfiguration` are only searched in the `[Unit]` section
680 * `X-ReloadIfChanged`, `X-RestartIfChanged`, `X-StopIfChanged` are only searched in the `[Service]` section
681
682- The `services.bookstack.cacheDir` option has been removed, since the
683 cache directory is now handled by systemd.
684
685- The `services.bookstack.extraConfig` option has been replaced by
686 `services.bookstack.config` which implements a
687 [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)
688 configuration.
689
690- `lib.assertMsg` and `lib.assertOneOf` no longer return `false` if the passed condition is `false`, `throw`ing the given error message instead (which makes the resulting error message less cluttered). This will not impact the behaviour of code using these functions as intended, namely as top-level wrapper for `assert` conditions.
691
692- The `vpnc` package has been changed to use GnuTLS instead of OpenSSL by default for licensing reasons.
693
694- The default version of `nextcloud` is **nextcloud24**. Please note that it's **not** possible to upgrade
695 `nextcloud` across multiple major versions! This means it's e.g. not possible to upgrade from `nextcloud22`
696 to `nextcloud24` in a single deploy and most `21.11` users will have to upgrade to `nextcloud23` first.
697
698- `pkgs.vimPlugins.onedark-nvim` now refers to [navarasu/onedark.nvim](https://github.com/navarasu/onedark.nvim)
699 (formerly refers to [olimorris/onedarkpro.nvim](https://github.com/olimorris/onedarkpro.nvim)).
700
701- `services.pipewire.enable` will default to enabling the WirePlumber session manager instead of pipewire-media-session.
702 pipewire-media-session is deprecated by upstream and not recommended, but can still be manually enabled by setting
703 `services.pipewire.media-session.enable` to `true` and `services.pipewire.wireplumber.enable` to `false`.
704
705- `pkgs.makeDesktopItem` has been refactored to provide a more idiomatic API. Specifically:
706 - All valid options as of FDO Desktop Entry specification version 1.4 can now be passed in as explicit arguments
707 - `exec` can now be null, for entries that are not of type Application
708 - `mimeType` argument is renamed to `mimeTypes` for consistency
709 - `mimeTypes`, `categories`, `implements`, `keywords`, `onlyShowIn` and `notShowIn` take lists of strings instead of one string with semicolon separators
710 - `extraDesktopEntries` renamed to `extraConfig` for consistency
711 - Actions should now be provided as an attrset `actions`, the `Actions` line will be autogenerated.
712 - `extraEntries` is removed.
713 - Additional validation is added both at eval time and at build time.
714
715 See the `vscode` package for a more detailed example.
716
717- Existing `resholve*` functions have been renamed and nested under `pkgs.resholve`. Update uses to:
718 - `resholvePackage` -> `resholve.mkDerivation`
719 - `resholveScript` -> `resholve.writeScript`
720 - `resholveScriptBin` -> `resholve.writeScriptBin`
721
722- `pkgs.cosmopolitan` no longer provides the `cosmoc` command. It has been moved to `pkgs.cosmoc`.
723
724- `pkgs.graalvmXX-ce` packages no longer provide support for Python/Ruby/WASM, instead focusing only in Java and Native Image Support. If you need to add support back, please see the `pkgs.graalvmCEPackages.mkGraal` function to create your own customized version of GraalVM with support for what you need.
725
726<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
727
728## Other Notable Changes {#sec-release-22.05-notable-changes}
729
730- The option [services.redis.servers](#opt-services.redis.servers) was added
731 to support per-application `redis-server` which is more secure since Redis databases
732 are only mere key prefixes without any configuration or ACL of their own.
733 Backward-compatibility is preserved by mapping old `services.redis.settings`
734 to `services.redis.servers."".settings`, but you are strongly encouraged
735 to name each `redis-server` instance after the application using it,
736 instead of keeping that nameless one.
737 Except for the nameless `services.redis.servers.""`
738 still accessible at `127.0.0.1:6379`,
739 and to the members of the Unix group `redis`
740 through the Unix socket `/run/redis/redis.sock`,
741 all other `services.redis.servers.${serverName}`
742 are only accessible by default
743 to the members of the Unix group `redis-${serverName}`
744 through the Unix socket `/run/redis-${serverName}/redis.sock`.
745
746- The option [virtualisation.vmVariant](#opt-virtualisation.vmVariant) was added
747 to allow users to make changes to the `nixos-rebuild build-vm` configuration
748 that do not apply to their normal system.
749
750 The `config.system.build.vm` attribute now always exists and defaults to the
751 value from `vmVariant`. Configurations that import the `virtualisation/qemu-vm.nix`
752 module themselves will override this value, such that `vmVariant` is not used.
753
754 Similarly [virtualisation.vmVariantWithBootloader](#opt-virtualisation.vmVariantWithBootLoader) was added.
755
756- The configuration portion of the `nix-daemon` module has been reworked and exposed as [nix.settings](options.html#opt-nix-settings):
757 * Legacy options have been mapped to the corresponding options under under [nix.settings](options.html#opt-nix.settings) and will be deprecated when NixOS 21.11 reaches end of life.
758 * [nix.buildMachines.publicHostKey](options.html#opt-nix.buildMachines.publicHostKey) has been added.
759
760- [`kops`](https://kops.sigs.k8s.io) defaults to 1.23.2, which will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes >= 1.22. This will increase security by default, but may break some types of workloads. The default behaviour for `spec.kubeDNS.nodeLocalDNS.forwardToKubeDNS` has changed from `true` to `false`. Cilium now has `disable-cnp-status-updates: true` by default. Set this to false if you rely on the CiliumNetworkPolicy status fields. Support for Kubernetes 1.17, the Lyft CNI, Weave CNI on Kubernetes >= 1.23, CentOS 7 and 8, Debian 9, RHEL 7, and Ubuntu 16.05 (Xenial) has been removed. See the [1.22 release notes](https://kops.sigs.k8s.io/releases/1.22-notes/) and [1.23 release notes](https://kops.sigs.k8s.io/releases/1.23-notes/) for more details, including other significant changes.
761
762- Mattermost has been upgraded to extended support version 6.3 as the previously
763 packaged extended support version 5.37 is [reaching end of life](https://docs.mattermost.com/upgrade/extended-support-release.html).
764 Migration may take some time, see the [changelog](https://docs.mattermost.com/install/self-managed-changelog.html#release-v6-3-extended-support-release)
765 and [important upgrade notes](https://docs.mattermost.com/upgrade/important-upgrade-notes.html).
766
767- The `writers.writePyPy2`/`writers.writePyPy3` and corresponding `writers.writePyPy2Bin`/`writers.writePyPy3Bin` convenience functions to create executable Python 2/3 scripts using the PyPy interpreter were added.
768
769- Some improvements have been made to the `hadoop` module:
770 - A `gatewayRole` option has been added, for deploying hadoop cluster configuration files to a node that does not have any active services
771 - Support for older versions of hadoop have been added to the module
772 - Overriding and extending site XML files has been made easier
773
774- The auto-upgrade service now accepts persistent (default: true) parameter.
775 By default auto-upgrade will now run immediately if it would have been triggered at least
776 once during the time when the timer was inactive.
777
778- Mastodon now uses `services.redis.servers` to start a new redis server, instead of using a global redis server.
779 This improves compatibility with other services that use redis.
780
781 Note that this will recreate the redis database, although according to the [Mastodon docs](https://docs.joinmastodon.org/admin/backups/),
782 this is almost harmless:
783 > Losing the Redis database is almost harmless: The only irrecoverable data will be the contents of the Sidekiq queues and scheduled retries of previously failed jobs.
784 > The home and list feeds are stored in Redis, but can be regenerated with tootctl.
785
786 If you do want to save the redis database, you can use the following commands:
787 ```bash
788 redis-cli save
789 cp /var/lib/redis/dump.rdb "/var/lib/redis-mastodon/dump.rdb"
790 ```
791- Peertube now uses services.redis.servers to start a new redis server, instead of using a global redis server.
792 This improves compatibility with other services that use redis.
793
794 Redis database is used for storage only cache and job queue. More information can be found here - [Peertube architecture](https://docs.joinpeertube.org/contribute-architecture).
795
796 If you do want to save the redis database, you can use the following commands before upgrade OS:
797 ```bash
798 redis-cli save
799 sudo mkdir /var/lib/redis-peertube
800 sudo cp /var/lib/redis/dump.rdb /var/lib/redis-peertube/dump.rdb
801 ```
802- Added the `keter` NixOS module. Keter reverse proxies requests to your loaded application based on virtual hostnames.
803
804- If you are using Wayland you can choose to use the Ozone Wayland support
805 in Chrome and several Electron apps by setting the environment variable
806 `NIXOS_OZONE_WL=1` (for example via
807 `environment.sessionVariables.NIXOS_OZONE_WL = "1"`).
808 This is not enabled by default because Ozone Wayland is
809 still under heavy development and behavior is not always flawless.
810 Furthermore, not all Electron apps use the latest Electron versions.
811
812- A new option group `systemd.network.wait-online` was added, with options to configure `systemd-networkd-wait-online.service`:
813 - `anyInterface` allows specifying that the network should be considered online when *at least one* interface is online (useful on laptops)
814 - `timeout` defines how long to wait for the network to come online
815 - `extraArgs` for everything else
816
817- The `influxdb2` package was split into `influxdb2-server` and
818 `influxdb2-cli`, matching the split that took place upstream. A
819 combined `influxdb2` package is still provided in this release for
820 backwards compatibility, but will be removed at a later date.
821
822- The `unifi` package was switched from `unifi6` to `unifi7`.
823 Direct downgrades from Unifi 7 to Unifi 6 are not possible and require restoring from a backup made by Unifi 6.
824
825- `programs.zsh.autosuggestions.strategy` now takes a list of strings instead of a string.
826
827- The `asterisk` and `asterisk-stable` packages were switched from `asterisk_18` to the newly-packaged `asterisk_19`. Asterisk 13 and 17 have been removed as they have reached their end of life.
828
829- The `services.unifi.openPorts` option default value of `true` is now deprecated and will be changed to `false` in 22.11.
830 Configurations using this default will print a warning when rebuilt.
831
832- The `services.unifi-video.openPorts` option default value of `true` is now deprecated and will be changed to `false` in 22.11.
833 Configurations using this default will print a warning when rebuilt.
834
835- `security.acme` certificates will now correctly check for CA
836 revocation before reaching their minimum age.
837
838- Removing domains from `security.acme.certs._name_.extraDomainNames`
839 will now correctly remove those domains during rebuild/renew.
840
841- MariaDB is now offered in several versions, not just the newest one.
842 So if you have a need for running MariaDB 10.4 for example, you can now just set `services.mysql.package = pkgs.mariadb_104;`.
843 In general, it is recommended to run the newest version, to get the newest features, while sticking with an LTS version will most likely provide a more stable experience.
844 Sometimes software is also incompatible with the newest version of MariaDB.
845
846- The option
847 [programs.ssh.enableAskPassword](#opt-programs.ssh.enableAskPassword) was
848 added, decoupling the setting of `SSH_ASKPASS` from
849 `services.xserver.enable`. This allows easy usage in non-X11 environments,
850 e.g. Wayland.
851
852- [programs.ssh.knownHosts](#opt-programs.ssh.knownHosts) has gained an `extraHostNames`
853 option to augment `hostNames`. It is now possible to use the attribute name of a `knownHosts`
854 entry as the primary host name and specify secondary host names using `extraHostNames` without
855 having to duplicate the primary host name.
856
857- The `services.stubby` module was converted to a [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.
858
859- The option
860 [services.xserver.desktopManager.runXdgAutostartIfNone](#opt-services.xserver.desktopManager.runXdgAutostartIfNone)
861 was added in order to automatically run XDG autostart files for sessions without a desktop manager.
862 This replaces helpers like the `dex` package.
863
864- When setting [i18n.inputMethod.enabled](#opt-i18n.inputMethod.enabled) to `fcitx5`,
865 it no longer creates corresponding systemd user services.
866 It now relies on XDG autostart files to start and work properly in your desktop sessions.
867 If you are using only a window manager without a desktop manager, you need to enable
868 `services.xserver.desktopManager.runXdgAutostartIfNone` or using the `dex` package to make `fcitx5` work.
869
870
871- The option `services.duplicati.dataDir` has been added to allow changing the location of duplicati's files.
872
873- The options `boot.extraModprobeConfig` and `boot.blacklistedKernelModules` now also take effect in the initrd by copying the file `/etc/modprobe.d/nixos.conf` into the initrd.
874
875- `nixos-generate-config` now puts the dhcp configuration in `hardware-configuration.nix` instead of `configuration.nix`.
876
877- ORY Kratos was updated to version 0.9.0-alpha.3, which introduces some breaking changes:
878 - All endpoints at the Admin API are now exposed at `/admin/`. For example, endpoint `https://kratos:4434/identities` is now exposed at `https://kratos:4434/admin/identities`
879 - Configuration key `selfservice.whitelisted_return_urls` has been renamed to `allowed_return_urls`
880 - The `password_identifier` form field of the password login strategy has been renamed to `identifier` to make compatibility with passwordless flows possible.
881 - Instead of having a global `default_schema_url` which developers used to update their schema, you now need to define the `default_schema_id` which must reference schema ID in your config.
882 - Calling `/self-service/recovery` without flow ID or with an invalid flow ID while authenticated will now respond with an error instead of redirecting to the default page.
883 - If you are relying on the SQLite images, update your Docker Pull commands as follows:
884 - `docker pull oryd/kratos:{version}`
885 - Additionally, all passwords now have to be at least 8 characters long.
886 - For more details, see:
887 - [Release Notes for v0.8.1-alpha-1](https://github.com/ory/kratos/releases/tag/v0.8.1-alpha.1)
888 - [Release Notes for v0.8.2-alpha-1](https://github.com/ory/kratos/releases/tag/v0.8.2-alpha.1)
889 - [Release Notes for v0.9.0-alpha-1](https://github.com/ory/kratos/releases/tag/v0.9.0-alpha.1)
890 - [Release Notes for v0.9.0-alpha-3](https://github.com/ory/kratos/releases/tag/v0.9.0-alpha.3)
891
892
893- `fetchFromSourcehut` now allows fetching repositories recursively
894 using `fetchgit` or `fetchhg` if the argument `fetchSubmodules`
895 is set to `true`.
896
897- A module for declarative configuration of openconnect VPN profiles was added under `networking.openconnect`.
898
899- The `element-desktop` package now has an `useKeytar` option (defaults to `true`),
900 which allows disabling `keytar` and in turn `libsecret` usage
901 (which binds to native credential managers / keychain libraries).
902
903- The option `services.thelounge.plugins` has been added to allow installing plugins for The Lounge. Plugins can be found in `pkgs.theLoungePlugins.plugins` and `pkgs.theLoungePlugins.themes`.
904
905- The option `services.xserver.videoDriver = [ "nvidia" ];` will now also install [nvidia VA-API drivers](https://github.com/elFarto/nvidia-vaapi-driver) by default.
906
907- The `firmwareLinuxNonfree` package has been renamed to `linux-firmware`.
908
909- It is now possible to specify wordlists to include as handy to access environment variables using the `config.environment.wordlist` configuration options.
910
911- The `services.mbpfan` module was converted to a [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.
912
913- The default value for `programs.spacefm.settings.graphical_su` got unset. It previously pointed to `gksu` which has been removed.
914
915- The [Dino](https://dino.im) XMPP client was updated to 0.3, adding support for audio and video calls.
916
917- `services.mattermost.plugins` has been added to allow the declarative installation of Mattermost plugins.
918 Plugins are automatically repackaged using autoPatchelf.
919
920- [services.logrotate.enable](#opt-services.logrotate.enable) now defaults to true if any rotate path has
921 been defined, and some paths have been added by default.
922- The logrotate module also has been updated to freeform syntax: `services.logrotate.paths`
923 and `services.logrotate.extraConfig` will work, but issue deprecation
924 warnings and [services.logrotate.settings](#opt-services.logrotate.settings) should now be used instead.
925
926- `security.pam.ussh` has been added, which allows authorizing PAM sessions based on SSH _certificates_ held within an SSH agent, using [pam-ussh](https://github.com/uber/pam-ussh).
927
928- The `vscode-extensions.ionide.ionide-fsharp` package has been updated to 6.0.0 and now requires .NET 6.0.
929
930- The `phpPackages.box` package has been updated from 2.7.5 to 3.16.0. See the [upgrade guide](https://github.com/box-project/box/blob/master/UPGRADE.md#from-27-to-30) for more details.
931
932- The `zrepl` package has been updated from 0.4.0 to 0.5:
933
934 - The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume.
935 - A bug involving encrypt-on-receive has been fixed. Read the [zrepl documentation](https://zrepl.github.io/configuration/sendrecvoptions.html#job-recv-options-placeholder) and check the output of `zfs get -r encryption,zrepl:placeholder PATH_TO_ROOTFS` on the receiver.
936
937- The `polybar` package has been updated from 3.5.7 to 3.6.2. See [the changelog](https://github.com/polybar/polybar/releases/tag/3.6.0) for more details.
938 - Breaking changes include changes to escaping rules in configuration values, changes in behavior when encountering invalid tag names, and changes to inter-process-messaging (IPC).
939
940- Renamed option `services.openssh.challengeResponseAuthentication` to `services.openssh.kbdInteractiveAuthentication`.
941 Reason is that the old name has been deprecated upstream.
942 Using the old option name will still work, but produce a warning.
943
944- `services.autorandr` now allows for adding hooks and profiles declaratively.
945
946- The `pomerium-cli` command has been moved out of the `pomerium` package into
947 the `pomerium-cli` package, following upstream's repository split. If you are
948 using the `pomerium-cli` command, you should now install the `pomerium-cli`
949 package.
950
951- The option `services.networking.networkmanager.enableFccUnlock`
952 was added to support FCC unlock procedures. Since release 1.18.4, the ModemManager
953 daemon no longer automatically performs the FCC unlock procedure by default. See
954 [the docs](https://modemmanager.org/docs/modemmanager/fcc-unlock/) for more details.
955
956- `programs.tmux` has a new option `plugins` that accepts a list of packages from the `tmuxPlugins` group. The specified packages are added to the system and loaded by `tmux`.
957
958- The polkit service, available at `security.polkit.enable`, is now disabled by default. It will automatically be enabled through services and desktop environments as needed.
959
960- `mercury` was updated to 22.01.1, which has some breaking changes ([Mercury 22.01 news](https://dl.mercurylang.org/release/release-notes-22.01.html)).
961
962- xfsprogs was update to version 5.15, which enables inobtcount and bigtime by default on filesystem creation. Support for these features was added in kernel 5.10 and deemed stable in kernel 5.15.
963 If you want to be able to mount XFS filesystems created with this release of xfsprogs on kernel releases older than 5.10, you need to format them with `mkfs.xfs -m bigtime=0 -m inobtcount=0`.
964
965- `services.xserver.desktopManager.xfce` now includes Xfce's screen locker, `xfce4-screensaver` that is enabled by default. You can disable it by setting `false` to [services.xserver.desktopManager.xfce.enableScreensaver](#opt-services.xserver.desktopManager.xfce.enableScreensaver).
966
967- The `hadoop` package has added support for `aarch64-linux` and `aarch64-darwin` as of 3.3.1 ([#158613](https://github.com/NixOS/nixpkgs/pull/158613)).
968
969- The `R` package now builds again on `aarch64-darwin` ([#158992](https://github.com/NixOS/nixpkgs/pull/158992)).
970
971- The `nss` package was split into `nss_esr` and `nss_latest`, with `nss` being an alias for `nss_esr`. This was done to ease maintenance of `nss` and dependent high-profile packages like `firefox`.
972
973- The default `scribus` version is now 1.5, while version 1.4 is still available as `scribus_1_4` ([#172700](https://github.com/NixOS/nixpkgs/pull/172700)).
974
975- The Nextcloud module now supports to create a Mysql database automatically
976 with `services.nextcloud.database.createLocally` enabled.
977
978- The Nextcloud module now allows setting the value of the `max-age` directive of the `Strict-Transport-Security` HTTP header, which is now controlled by the `services.nextcloud.https` option, rather than `services.nginx.recommendedHttpHeaders`.
979
980- The `spark3` package has been updated from 3.1.2 to 3.2.1 ([#160075](https://github.com/NixOS/nixpkgs/pull/160075)):
981
982 - Testing has been enabled for `aarch64-linux` in addition to `x86_64-linux`.
983 - The `spark3` package is now usable on `aarch64-darwin` as a result of [#158613](https://github.com/NixOS/nixpkgs/pull/158613) and [#158992](https://github.com/NixOS/nixpkgs/pull/158992).
984
985- The option `services.snapserver.openFirewall` will no longer default to
986 `true` starting with NixOS 22.11. Enable it explicitly if you need to control
987 Snapserver remotely or connect streamig clients from other hosts.
988
989- The option [networking.useDHCP](options.html#opt-networking.useDHCP) isn't deprecated anymore.
990 When using [`systemd-networkd`](options.html#opt-networking.useNetworkd), a generic
991 `.network`-unit is added which enables DHCP for each interface matching `en*`, `eth*`
992 or `wl*` with priority 99 (which means that it doesn't have any effect if such an interface is matched
993 by a `.network-`unit with a lower priority). In case of scripted networking, no behavior
994 was changed.
995
996- The new [`postgresqlTestHook`](https://nixos.org/manual/nixpkgs/stable/#sec-postgresqlTestHook) runs a PostgreSQL server for the duration of package checks.
997
998- `zfs` was updated from 2.1.4 to 2.1.5, enabling it to be used with Linux kernel 5.18.
999
1000- `stdenv.mkDerivation` now supports a self-referencing `finalAttrs:` parameter
1001 containing the final `mkDerivation` arguments including overrides.
1002 `drv.overrideAttrs` now supports two parameters `finalAttrs: previousAttrs:`.
1003 This allows packaging configuration to be overridden in a consistent manner by
1004 providing an alternative to `rec {}` syntax.
1005
1006 Additionally, `passthru` can now reference `finalAttrs.finalPackage` containing
1007 the final package, including attributes such as the output paths and
1008 `overrideAttrs`.
1009
1010 New language integrations can be simplified by overriding a "prototype"
1011 package containing the language-specific logic. This removes the need for a
1012 extra layer of overriding for the "generic builder" arguments, thus removing a
1013 usability problem and source of error.
1014
1015<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->