···

       
293
       
293
       
 
       


     

       
294
       
294
       
 
       
#### Figures

     

       
295
       
295
       
 
       


     

       
296
       
296
       
-
       
To define a referencable figure use the following fencing:

     

       
296
       
296
       
+
       
To define a referenceable figure use the following fencing:

     

       
297
       
297
       
 
       


     

       
298
       
298
       
 
       
```markdown

     

       
299
       
299
       
 
       
::: {.figure #nixos-logo}

     

···

       
241
       
241
       
 
       
`allowSubstitutes` (Bool, _optional_)

     

       
242
       
242
       
 
       


     

       
243
       
243
       
 
       
: Whether to allow substituting from a binary cache.

     

       
244
       
244
       
-
       
  Passed through to [`allowSubsitutes`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-allowSubstitutes) of the underlying call to `builtins.derivation`.

     

       
244
       
244
       
+
       
  Passed through to [`allowSubstitutes`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-allowSubstitutes) of the underlying call to `builtins.derivation`.

     

       
245
       
245
       
 
       


     

       
246
       
246
       
 
       
  It defaults to `false`, as running the derivation's simple `builder` executable locally is assumed to be faster than network operations.

     

       
247
       
247
       
 
       
  Set it to true if the `checkPhase` step is expensive.

     
···

       
453
       
453
       
 
       


     

       
454
       
454
       
 
       
### `writeScriptBin` {#trivial-builder-writeScriptBin}

     

       
455
       
455
       
 
       


     

       
456
       
456
       
-
       
Write a script within a `bin` subirectory of a directory in the Nix store.

     

       
456
       
456
       
+
       
Write a script within a `bin` subdirectory of a directory in the Nix store.

     

       
457
       
457
       
 
       
This is for consistency with the convention of software packages placing executables under `bin`.

     

       
458
       
458
       
 
       


     

       
459
       
459
       
 
       
`writeScriptBin` takes the following arguments:

     

···

       
233
       
233
       
 
       
* `npmPruneFlags`: Flags to pass to `npm prune`. Defaults to the value of `npmInstallFlags`.

     

       
234
       
234
       
 
       
* `makeWrapperArgs`: Flags to pass to `makeWrapper`, added to executable calling the generated `.js` with `node` as an interpreter. These scripts are defined in `package.json`.

     

       
235
       
235
       
 
       
* `nodejs`: The `nodejs` package to build against, using the corresponding `npm` shipped with that version of `node`. Defaults to `pkgs.nodejs`.

     

       
236
       
236
       
-
       
* `npmDeps`: The dependencies used to build the npm package. Especially useful to not have to recompute workspace depedencies.

     

       
236
       
236
       
+
       
* `npmDeps`: The dependencies used to build the npm package. Especially useful to not have to recompute workspace dependencies.

     

       
237
       
237
       
 
       


     

       
238
       
238
       
 
       
#### prefetch-npm-deps {#javascript-buildNpmPackage-prefetch-npm-deps}

     

       
239
       
239
       
 
       


     

···

       
88
       
88
       
 
       
}

     

       
89
       
89
       
 
       
```

     

       
90
       
90
       
 
       


     

       
91
       
91
       
-
       
The annotations in the `nim-overrides.nix` set are functions that take two arguments and return a new attrset to be overlayed on the package being built.

     

       
91
       
91
       
+
       
The annotations in the `nim-overrides.nix` set are functions that take two arguments and return a new attrset to be overlaid on the package being built.

     

       
92
       
92
       
 
       
- lockAttrs: the attrset for this library from within a lockfile. This can be used to implement library version constraints, such as marking libraries as broken or insecure.

     

       
93
       
93
       
 
       
- prevAttrs: the attrset produced by initial arguments to `buildNimPackage` and any preceding lockfile overlays.

     

       
94
       
94
       
 
       


     

···

       
236
       
236
       
 
       
Arguments:

     

       
237
       
237
       
 
       
- (+) There's no point in using this library for a single file, since you can't do anything other than add it to the store or not.

     

       
238
       
238
       
 
       
  And it would be unclear how the library should behave if the one file wouldn't be added to the store:

     

       
239
       
239
       
-
       
  `toSource { root = ./file.nix; fileset = <empty>; }` has no reasonable result because returing an empty store path wouldn't match the file type, and there's no way to have an empty file store path, whatever that would mean.

     

       
239
       
239
       
+
       
  `toSource { root = ./file.nix; fileset = <empty>; }` has no reasonable result because returning an empty store path wouldn't match the file type, and there's no way to have an empty file store path, whatever that would mean.

     

       
240
       
240
       
 
       


     

       
241
       
241
       
 
       
### `fileFilter` takes a path

     

       
242
       
242
       
 
       


     

···

       
90
       
90
       
 
       


     

       
91
       
91
       
 
       
### systemd Stage 1 {#sec-luks-file-systems-fido2-systemd}

     

       
92
       
92
       
 
       


     

       
93
       
93
       
-
       
If systemd stage 1 is enabled, it handles unlocking of LUKS-enrypted volumes

     

       
93
       
93
       
+
       
If systemd stage 1 is enabled, it handles unlocking of LUKS-encrypted volumes

     

       
94
       
94
       
 
       
during boot. The following example enables systemd stage1 and adds support for

     

       
95
       
95
       
 
       
unlocking the existing LUKS2 volume `root` using any enrolled FIDO2 compatible

     

       
96
       
96
       
 
       
tokens.

     

···

       
75
       
75
       
 
       


     

       
76
       
76
       
 
       
"Normal" systemd units, by default, are ordered AFTER `sysinit.target`. In

     

       
77
       
77
       
 
       
other words, these "normal" units expect all services ordered before

     

       
78
       
78
       
-
       
`sysinit.target` to have finished without explicity declaring this dependency

     

       
78
       
78
       
+
       
`sysinit.target` to have finished without explicitly declaring this dependency

     

       
79
       
79
       
 
       
relationship for each dependency. See the [systemd

     

       
80
       
80
       
 
       
bootup](https://www.freedesktop.org/software/systemd/man/latest/bootup.html)

     

       
81
       
81
       
 
       
for more details on the bootup process.

     

···

       
824
       
824
       
 
       
  Configurations using this default will print a warning when rebuilt.

     

       
825
       
825
       
 
       


     

       
826
       
826
       
 
       
- `security.acme` certificates will now correctly check for CA

     

       
827
       
827
       
-
       
  revokation before reaching their minimum age.

     

       
827
       
827
       
+
       
  revocation before reaching their minimum age.

     

       
828
       
828
       
 
       


     

       
829
       
829
       
 
       
- Removing domains from `security.acme.certs._name_.extraDomainNames`

     

       
830
       
830
       
 
       
  will now correctly remove those domains during rebuild/renew.

     

···

       
365
       
365
       
 
       
  This means that configuration now has to be done using [environment variables](https://hexdocs.pm/livebook/readme.html#environment-variables) instead of command line arguments.

     

       
366
       
366
       
 
       
  This has the further consequence that the `livebook` service configuration has changed.

     

       
367
       
367
       
 
       


     

       
368
       
368
       
-
       
- `lua` interpreters default LUA_PATH and LUA_CPATH are not overriden by nixpkgs

     

       
368
       
368
       
+
       
- `lua` interpreters default LUA_PATH and LUA_CPATH are not overridden by nixpkgs

     

       
369
       
369
       
 
       
  anymore, we patch LUA_ROOT instead which is more respectful to upstream.

     

       
370
       
370
       
 
       


     

       
371
       
371
       
 
       
- `luarocks-packages-updater`'s .csv format, used to define lua packages to be updated, has changed: `src` (URL of a git repository) has now become `rockspec` (URL of a rockspec) to remove ambiguity regarding which rockspec to use and simplify implementation.

     
···

       
730
       
730
       
 
       
- `services.postgresql.extraPlugins`' type has expanded. Previously it was a list of packages, now it can also be a function that returns such a list.

     

       
731
       
731
       
 
       
  For example a config line like ``services.postgresql.extraPlugins = with pkgs.postgresql_11.pkgs; [ postgis ];`` is recommended to be changed to ``services.postgresql.extraPlugins = ps: with ps; [ postgis ];``;

     

       
732
       
732
       
 
       


     

       
733
       
733
       
-
       
- `services.slskd` has been refactored to include more configuation options in

     

       
733
       
733
       
+
       
- `services.slskd` has been refactored to include more configuration options in

     

       
734
       
734
       
 
       
  the free-form `services.slskd.settings` option, and some defaults (including listen ports)

     

       
735
       
735
       
 
       
  have been changed to match the upstream defaults. Additionally, disk logging is now

     

       
736
       
736
       
 
       
  disabled by default, and the log rotation timer has been removed.

     
···

       
758
       
758
       
 
       


     

       
759
       
759
       
 
       
- `systemd` units can now specify the `Upholds=` and `UpheldBy=` unit dependencies via the aptly

     

       
760
       
760
       
 
       
  named `upholds` and `upheldBy` options. These options get systemd to enforce that the

     

       
761
       
761
       
-
       
  dependencies remain continuosly running for as long as the dependent unit is in a running state.

     

       
761
       
761
       
+
       
  dependencies remain continuously running for as long as the dependent unit is in a running state.

     

       
762
       
762
       
 
       


     

       
763
       
763
       
 
       
- A stdenv's default set of hardening flags can now be set via its `bintools-wrapper`'s `defaultHardeningFlags` argument. A convenient stdenv adapter, `withDefaultHardeningFlags`, can be used to override an existing stdenv's `defaultHardeningFlags`.

     

       
764
       
764
       
 
       


     

···

       
24
       
24
       
 
       


     

       
25
       
25
       
 
       
If you cause a regression (we've all been there), you are responsible for fixing it, but in case you can't fix it (it happens), feel free to ask for help. That's fine, just let us know.

     

       
26
       
26
       
 
       


     

       
27
       
27
       
-
       
To merge code, you need to be a commiter, or use the merge-bot, but currently the merge-bot only works for packages located at `pkgs/by-name/`, which means, K3s still need to be migrated there before you can use merge-bot for merging. As a non-commiter, once you have approved a PR you need to forward the request to a commiter. For deciding which commiter, give preference initially to K3s commiters, but any commiter can commit. A commiter usually has a green approval in PRs.

     

       
27
       
27
       
+
       
To merge code, you need to be a committer, or use the merge-bot, but currently the merge-bot only works for packages located at `pkgs/by-name/`, which means, K3s still need to be migrated there before you can use merge-bot for merging. As a non-committer, once you have approved a PR you need to forward the request to a committer. For deciding which committer, give preference initially to K3s committers, but any committer can commit. A committer usually has a green approval in PRs.

     

       
28
       
28
       
 
       


     

       
29
       
29
       
-
       
K3s's commiters currently are: superherointj, marcusramberg, Mic92.

     

       
29
       
29
       
+
       
K3s's committers currently are: superherointj, marcusramberg, Mic92.

     

       
30
       
30
       
 
       


     

       
31
       
31
       
 
       
@euank is often silent but still active and has always handled anything dreadful, internal parts of K3s/Kubernetes or architecture things, he initially packaged K3s for nixpkgs, think of him as a last resort, when we fail to accomplish a fix, he comes to rescue us from ourselves.

     

       
32
       
32
       
 
       


     

       
33
       
33
       
-
       
@mic92 stepped up when @superherointj stepped down a time ago, as Mic92 has a broad responsibility in nixpkgs (he is responsible for far too many things already, nixpkgs-reviews, sops-nix, release manager, bot-whatever), we avoid giving him chore work for `nixos-unstable`, only pick him as commiter last. As Mic92 runs K3s in a `nixos-stable` setting, he might help in testing stable backports.

     

       
33
       
33
       
+
       
@mic92 stepped up when @superherointj stepped down a time ago, as Mic92 has a broad responsibility in nixpkgs (he is responsible for far too many things already, nixpkgs-reviews, sops-nix, release manager, bot-whatever), we avoid giving him chore work for `nixos-unstable`, only pick him as committer last. As Mic92 runs K3s in a `nixos-stable` setting, he might help in testing stable backports.

     

       
34
       
34
       
 
       


     

       
35
       
35
       
 
       
On how to handle requests, it's the usual basics, such as, when reviewing PRs, issues, be welcoming, helpful, provide hints whenever possible, try to move things forward, assume good will, ignore [as don't react to] any negativity [since it spirals badly], delay and sort any (severe) disagreement in private. Even on disagrements, be thankful to people for their dedicated time, no matter what happens. In essence, on any unfortunate event, **always put people over code**.

     

       
36
       
36
       
 
       


     

···

       
11
       
11
       
 
       


     

       
12
       
12
       
 
       
## Patch Release Support Lifecycle

     

       
13
       
13
       
 
       


     

       
14
       
14
       
-
       
K3s is built on top of K8s and typically provides a similar release cadence and support window (simply by cherry-picking over k8s patches). As such, we assume k3s's support lifecycle is identical to upstream K8s. The upstream K8s release and support lifecycle, including maintenance and end-of-life dates for current releases, is documented [on their suppport site](https://kubernetes.io/releases/patch-releases/#support-period). A more tabular view of the current support timeline can also be found on [endoflife.date](https://endoflife.date/kubernetes).

     

       
14
       
14
       
+
       
K3s is built on top of K8s and typically provides a similar release cadence and support window (simply by cherry-picking over k8s patches). As such, we assume k3s's support lifecycle is identical to upstream K8s. The upstream K8s release and support lifecycle, including maintenance and end-of-life dates for current releases, is documented [on their support site](https://kubernetes.io/releases/patch-releases/#support-period). A more tabular view of the current support timeline can also be found on [endoflife.date](https://endoflife.date/kubernetes).

     

       
15
       
15
       
 
       


     

       
16
       
16
       
 
       
In short, a new Kubernetes version is released roughly every 4 months and each release is supported for a little over 1 year.

     

       
17
       
17
       
 
       


     

···

       
23
       
23
       
 
       
## Top-level directories

     

       
24
       
24
       
 
       


     

       
25
       
25
       
 
       
- `cuda`: CUDA redistributables! Provides extension to `cudaPackages` scope.

     

       
26
       
26
       
-
       
- `cudatoolkit`: monolothic CUDA Toolkit run-file installer. Provides extension

     

       
26
       
26
       
+
       
- `cudatoolkit`: monolithic CUDA Toolkit run-file installer. Provides extension

     

       
27
       
27
       
 
       
    to `cudaPackages` scope.

     

       
28
       
28
       
 
       
- `cudnn`: NVIDIA cuDNN library.

     

       
29
       
29
       
 
       
- `cutensor`: NVIDIA cuTENSOR library.

     

···

       
23
       
23
       
 
       
doesn't offer a way to export the list of dependency URLs and hashes (it

     

       
24
       
24
       
 
       
does in a way, but it's far from being complete, and as such is useless

     

       
25
       
25
       
 
       
for nixpkgs). Even if did, it would be annoying to use considering

     

       
26
       
26
       
-
       
fetching non-Gradle dependendencies in Gradle scripts is commonplace.

     

       
26
       
26
       
+
       
fetching non-Gradle dependencies in Gradle scripts is commonplace.

     

       
27
       
27
       
 
       


     

       
28
       
28
       
 
       
That's why the setup hook uses mitm-cache, a program designed for

     

       
29
       
29
       
 
       
intercepting all HTTP requests, recording all the files that were