···

       
448
       
448
       
 
       
  - Overriding Wayland compositor is possible using `waylandSessionCompositor` option, but you might need to take care [`xfce4-session`](https://gitlab.xfce.org/xfce/xfce4-session/-/merge_requests/49), [`dbus-update-activation-environment`](https://github.com/labwc/labwc/blob/eaf11face68ee1f1bcc7ce1498304ca8c108c8ba/src/config/session.c#L234) and [`systemctl --user import-environment`](https://github.com/labwc/labwc/blob/eaf11face68ee1f1bcc7ce1498304ca8c108c8ba/src/config/session.c#L239) on startup.

     

       
449
       
449
       
 
       
  - For new Xfce installations, default panel layout has [changed](https://gitlab.xfce.org/xfce/xfce4-panel/-/merge_requests/158/diffs) to not include external panel plugins by default. You can still add them yourself using the "Panel Preferences" dialog.

     

       
450
       
450
       
 
       


     

       
451
       
451
       
+
       
- PAM services for `i3lock`/`i3lock-color`, `vlock`, `xlock`, and `xscreensaver` now default to disabled unless other corresponding NixOS options are set (`programs.i3lock.enable`, `console.enable`, `services.xserver.enable`, and `services.xscreensaver.enable`, respectively). If for some reason you want one of them back without setting the corresponding option, set, e.g., `security.pam.services.xlock.enable = true`.

     

       
452
       
452
       
+
       


     

       
451
       
453
       
 
       
- [`system.stateVersion`](#opt-system.stateVersion) is now validated and must be in the `"YY.MM"` format, ideally corresponding to a prior NixOS release.

     

       
452
       
454
       
 
       


     

       
453
       
455
       
 
       
- `services.mysql` now supports easy cluster setup via [`services.mysql.galeraCluster`](#opt-services.mysql.galeraCluster.enable) option.

     

···

       
145
       
145
       
 
       
          description = "Name of the PAM service.";

     

       
146
       
146
       
 
       
        };

     

       
147
       
147
       
 
       


     

       
148
       
148
       
+
       
        enable = lib.mkEnableOption "this PAM service" // {

     

       
149
       
149
       
+
       
          default = true;

     

       
150
       
150
       
+
       
          example = false;

     

       
151
       
151
       
+
       
        };

     

       
152
       
152
       
+
       


     

       
148
       
153
       
 
       
        rules = lib.mkOption {

     

       
149
       
154
       
 
       
          # This option is experimental and subject to breaking changes without notice.

     

       
150
       
155
       
 
       
          visible = false;

     
···

       
1566
       
1571
       
 
       
        Defaults env_keep+=SSH_AUTH_SOCK

     

       
1567
       
1572
       
 
       
      '';

     

       
1568
       
1573
       
 
       


     

       
1574
       
1574
       
+
       
  enabledServices = lib.filterAttrs (name: svc: svc.enable) config.security.pam.services;

     

       
1575
       
1575
       
+
       


     

       
1569
       
1576
       
 
       
in

     

       
1570
       
1577
       
 
       


     

       
1571
       
1578
       
 
       
{

     
···

       
2282
       
2289
       
 
       
      };

     

       
2283
       
2290
       
 
       
    };

     

       
2284
       
2291
       
 
       


     

       
2285
       
2285
       
-
       
    environment.etc = lib.mapAttrs' makePAMService config.security.pam.services;

     

       
2292
       
2292
       
+
       
    environment.etc = lib.mapAttrs' makePAMService enabledServices;

     

       
2286
       
2293
       
 
       


     

       
2287
       
2294
       
 
       
    security.pam.services =

     

       
2288
       
2295
       
 
       
      {

     
···

       
2298
       
2305
       
 
       
        '';

     

       
2299
       
2306
       
 
       


     

       
2300
       
2307
       
 
       
        # Most of these should be moved to specific modules.

     

       
2301
       
2301
       
-
       
        i3lock = { };

     

       
2302
       
2302
       
-
       
        i3lock-color = { };

     

       
2303
       
2303
       
-
       
        vlock = { };

     

       
2304
       
2304
       
-
       
        xlock = { };

     

       
2305
       
2305
       
-
       
        xscreensaver = { };

     

       
2308
       
2308
       
+
       
        i3lock.enable = lib.mkDefault config.programs.i3lock.enable;

     

       
2309
       
2309
       
+
       
        i3lock-color.enable = lib.mkDefault config.programs.i3lock.enable;

     

       
2310
       
2310
       
+
       
        vlock.enable = lib.mkDefault config.console.enable;

     

       
2311
       
2311
       
+
       
        xlock.enable = lib.mkDefault config.services.xserver.enable;

     

       
2312
       
2312
       
+
       
        xscreensaver.enable = lib.mkDefault config.services.xscreensaver.enable;

     

       
2306
       
2313
       
 
       


     

       
2307
       
2314
       
 
       
        runuser = {

     

       
2308
       
2315
       
 
       
          rootOK = true;

     
···

       
2327
       
2334
       
 
       


     

       
2328
       
2335
       
 
       
    security.apparmor.includes."abstractions/pam" =

     

       
2329
       
2336
       
 
       
      lib.concatMapStrings (name: "r ${config.environment.etc."pam.d/${name}".source},\n") (

     

       
2330
       
2330
       
-
       
        lib.attrNames config.security.pam.services

     

       
2337
       
2337
       
+
       
        lib.attrNames enabledServices

     

       
2331
       
2338
       
 
       
      )

     

       
2332
       
2339
       
 
       
      + (

     

       
2333
       
2340
       
 
       
        with lib;

     

       
2334
       
2334
       
-
       
        pipe config.security.pam.services [

     

       
2341
       
2341
       
+
       
        pipe enabledServices [

     

       
2335
       
2342
       
 
       
          lib.attrValues

     

       
2336
       
2343
       
 
       
          (catAttrs "rules")

     

       
2337
       
2344
       
 
       
          (lib.concatMap lib.attrValues)

     

···

       
15
       
15
       
 
       
    ${pkgs.lsof}/bin/lsof | ${pkgs.gnugrep}/bin/grep $MNTPT | ${pkgs.gawk}/bin/awk '{print $2}' | ${pkgs.findutils}/bin/xargs ${pkgs.util-linux}/bin/kill -$SIGNAL

     

       
16
       
16
       
 
       
  '';

     

       
17
       
17
       
 
       


     

       
18
       
18
       
-
       
  anyPamMount = lib.any (lib.attrByPath [ "pamMount" ] false) (

     

       
18
       
18
       
+
       
  anyPamMount = lib.any (svc: svc.enable && svc.pamMount) (

     

       
19
       
19
       
 
       
    lib.attrValues config.security.pam.services

     

       
20
       
20
       
 
       
  );

     

       
21
       
21
       
 
       
in

     

···

       
9
       
9
       
 
       


     

       
10
       
10
       
 
       
  cfg = config.services.xserver.displayManager;

     

       
11
       
11
       
 
       
  gdm = pkgs.gdm;

     

       
12
       
12
       
-
       
  pamCfg = config.security.pam.services;

     

       
12
       
12
       
+
       
  pamLogin = config.security.pam.services.login;

     

       
13
       
13
       
 
       
  settingsFormat = pkgs.formats.ini { };

     

       
14
       
14
       
 
       
  configFile = settingsFormat.generate "custom.conf" cfg.gdm.settings;

     

       
15
       
15
       
 
       


     
···

       
345
       
345
       
 
       
      gdm-autologin.text = ''

     

       
346
       
346
       
 
       
        auth      requisite     pam_nologin.so

     

       
347
       
347
       
 
       
        auth      required      pam_succeed_if.so uid >= 1000 quiet

     

       
348
       
348
       
-
       
        ${lib.optionalString pamCfg.login.enableGnomeKeyring ''

     

       
348
       
348
       
+
       
        ${lib.optionalString (pamLogin.enable && pamLogin.enableGnomeKeyring) ''

     

       
349
       
349
       
 
       
          auth       [success=ok default=1]      ${gdm}/lib/security/pam_gdm.so

     

       
350
       
350
       
 
       
          auth       optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so

     

       
351
       
351
       
 
       
        ''}

     
···

       
369
       
369
       
 
       
        auth       requisite                   pam_faillock.so      preauth

     

       
370
       
370
       
 
       
        auth       required                    ${pkgs.fprintd}/lib/security/pam_fprintd.so

     

       
371
       
371
       
 
       
        auth       required                    pam_env.so

     

       
372
       
372
       
-
       
        ${lib.optionalString pamCfg.login.enableGnomeKeyring ''

     

       
372
       
372
       
+
       
        ${lib.optionalString (pamLogin.enable && pamLogin.enableGnomeKeyring) ''

     

       
373
       
373
       
 
       
          auth       [success=ok default=1]      ${gdm}/lib/security/pam_gdm.so

     

       
374
       
374
       
 
       
          auth       optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so

     

       
375
       
375
       
 
       
        ''}