In addition to numerous new and upgraded packages, this release has the following highlights: Support for wrapping binaries using firejail has been added through programs.firejail.wrappedBinaries. For example programs.firejail = { enable = true; wrappedBinaries = { firefox = "${lib.getBin pkgs.firefox}/bin/firefox"; mpv = "${lib.getBin pkgs.mpv}/bin/mpv"; }; }; This will place firefox and mpv binaries in the global path wrapped by firejail. User channels are now in the default NIX_PATH, allowing users to use their personal nix-channel defined channels in nix-build and nix-shell commands, as well as in imports like import <mychannel>. For example $ nix-channel --add https://nixos.org/channels/nixpkgs-unstable nixpkgsunstable $ nix-channel --update $ nix-build '<nixpkgsunstable>' -A gitFull $ nix run -f '<nixpkgsunstable>' gitFull $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull'

The following new services were added since the last release: The services.cassandra module has been reworked and was rewritten from scratch. The service has succeeding tests for the versions 2.1, 2.2, 3.0 and 3.11 of Apache Cassandra. There is a new services.foundationdb module for deploying FoundationDB clusters. When enabled the iproute2 will copy the files expected by ip route (e.g., rt_tables) in /run/iproute2. This allows to write aliases for routing tables for instance. services.strongswan-swanctl is a modern replacement for services.strongswan. You can use either one of them to setup IPsec VPNs but not both at the same time. services.strongswan-swanctl uses the swanctl command which uses the modern vici Versatile IKE Configuration Interface. The deprecated ipsec command used in services.strongswan is using the legacy stroke configuration interface.

When upgrading from a previous release, please be aware of the following incompatible changes: The deprecated services.cassandra module has seen a complete rewrite. (See above.) lib.strict is removed. Use builtins.seq instead. The clementine package points now to the free derivation. clementineFree is removed now and clementineUnfree points to the package which is bundled with the unfree libspotify package. The netcat package is now taken directly from OpenBSD's libressl, instead of relying on Debian's fork. The new version should be very close to the old version, but there are some minor differences. Importantly, flags like -b, -q, -C, and -Z are no longer accepted by the nc command. The services.docker-registry.extraConfig object doesn't contain environment variables anymore. Instead it needs to provide an object structure that can be mapped onto the YAML configuration defined in the docker/distribution docs. gnucash has changed from version 2.4 to 3.x. If you've been using gnucash (version 2.4) instead of gnucash26 (version 2.6) you must open your Gnucash data file(s) with gnucash26 and then save them to upgrade the file format. Then you may use your data file(s) with Gnucash 3.x. See the upgrade documentation. Gnucash 2.4 is still available under the attribute gnucash24. services.munge now runs as user (and group) munge instead of root. Make sure the key file is accessible to the daemon. dockerTools.buildImage now uses null as default value for tag, which indicates that the nix output hash will be used as tag. The ELK stack: elasticsearch, logstash and kibana has been upgraded from 2.* to 6.3.*. The 2.* versions have been unsupported since last year so they have been removed. You can still use the 5.* versions under the names elasticsearch5, logstash5 and kibana5. The elastic beats: filebeat, heartbeat, metricbeat and packetbeat have had the same treatment: they now target 6.3.* as well. The 5.* versions are available under the names: filebeat5, heartbeat5, metricbeat5 and packetbeat5 The ELK-6.3 stack now comes with X-Pack by default. Since X-Pack is licensed under the Elastic License the ELK packages now have an unfree license. To use them you need to specify allowUnfree = true; in your nixpkgs configuration. Fortunately there is also a free variant of the ELK stack without X-Pack. The packages are available under the names: elasticsearch-oss, logstash-oss and kibana-oss. Options boot.initrd.luks.devices.name.yubikey.ramfsMountPoint boot.initrd.luks.devices.name.yubikey.storage.mountPoint were removed. luksroot.nix module never supported more than one YubiKey at a time anyway, hence those options never had any effect. You should be able to remove them from your config without any issues.

dockerTools.pullImage relies on image digest instead of image tag to download the image. The sha256 of a pulled image has to be updated. lib.attrNamesToStr has been deprecated. Use more specific concatenation (lib.concat(Map)StringsSep) instead. lib.addErrorContextToAttrs has been deprecated. Use builtins.addErrorContext directly. lib.showVal has been deprecated. Use lib.traceSeqN instead. lib.traceXMLVal has been deprecated. Use lib.traceValFn builtins.toXml instead. lib.traceXMLValMarked has been deprecated. Use lib.traceValFn (x: str + builtins.toXML x) instead. The pkgs argument to NixOS modules can now be set directly using nixpkgs.pkgs. Previously, only the system, config and overlays arguments could be used to influence pkgs. A NixOS system can now be constructed more easily based on a preexisting invocation of Nixpkgs. For example: inherit (pkgs.nixos { boot.loader.grub.enable = false; fileSystems."/".device = "/dev/xvda1"; }) toplevel kernel initialRamdisk manual; This benefits evaluation performance, lets you write Nixpkgs packages that depend on NixOS images and is consistent with a deployment architecture that would be centered around Nixpkgs overlays. lib.traceValIfNot has been deprecated. Use if/then/else and lib.traceValSeq instead. lib.traceCallXml has been deprecated. Please complain if you use the function regularly. The attribute lib.nixpkgsVersion has been deprecated in favor of lib.version. Please refer to the discussion in NixOS/nixpkgs#39416 for further reference. lib.recursiveUpdateUntil was not acting according to its specification. It has been fixed to act according to the docstring, and a test has been added. The module for security.dhparams has two new options now: security.dhparams.stateless Puts the generated Diffie-Hellman parameters into the Nix store instead of managing them in a stateful manner in /var/lib/dhparams. security.dhparams.defaultBitSize The default bit size to use for the generated Diffie-Hellman parameters. The path to the actual generated parameter files should now be queried using config.security.dhparams.params.name.path because it might be either in the Nix store or in a directory configured by security.dhparams.path. Module implementers should not set a specific bit size in order to let users configure it by themselves if they want to have a different bit size than the default (2048). An example usage of this would be: { config, ... }: { security.dhparams.params.myservice = {}; environment.etc."myservice.conf".text = '' dhparams = ${config.security.dhparams.params.myservice.path} ''; } networking.networkmanager.useDnsmasq has been deprecated. Use networking.networkmanager.dns instead. The option services.kubernetes.apiserver.admissionControl was renamed to services.kubernetes.apiserver.enableAdmissionPlugins. Recommended way to access the Kubernetes Dashboard is via HTTPS (TLS) Therefore; public service port for the dashboard has changed to 443 (container port 8443) and scheme to https. The option services.kubernetes.apiserver.address was renamed to services.kubernetes.apiserver.bindAddress. Note that the default value has changed from 127.0.0.1 to 0.0.0.0. The option services.kubernetes.apiserver.publicAddress was not used and thus has been removed. The option services.kubernetes.addons.dashboard.enableRBAC was renamed to services.kubernetes.addons.dashboard.rbac.enable. The Kubernetes Dashboard now has only minimal RBAC permissions by default. If dashboard cluster-admin rights are desired, set services.kubernetes.addons.dashboard.rbac.clusterAdmin to true. On existing clusters, in order for the revocation of privileges to take effect, the current ClusterRoleBinding for kubernetes-dashboard must be manually removed: kubectl delete clusterrolebinding kubernetes-dashboard The programs.screen module provides allows to configure /etc/screenrc, however the module behaved fairly counterintuitive as the config exists, but the package wasn't available. Since 18.09 pkgs.screen will be added to environment.systemPackages. The module services.networking.hostapd now uses WPA2 by default. s6Dns, s6Networking, s6LinuxUtils and s6PortableUtils renamed to s6-dns, s6-networking, s6-linux-utils and s6-portable-utils respectively. The module option nix.useSandbox is now defaulted to true.