In addition to numerous new and upgraded packages, this release has the following highlights: Support is planned until the end of December 2022, handing over to 22.11.

security.acme.defaults has been added to simplify configuring settings for many certificates at once. This also opens up the the option to use DNS-01 validation when using enableACME on web server virtual hosts (e.g. services.nginx.virtualHosts.*.enableACME). PHP 8.1 is now available Mattermost has been updated to extended support release 6.3, as the previously packaged extended support release 5.37 is reaching its end of life. Migrations may take a while, see the changelog and important upgrade notes.

aesmd, the Intel SGX Architectural Enclave Service Manager. Available as services.aesmd. rootless Docker, a systemd --user Docker service which runs without root permissions. Available as virtualisation.docker.rootless.enable. matrix-conduit, a simple, fast and reliable chat server powered by matrix. Available as services.matrix-conduit. filebeat, a lightweight shipper for forwarding and centralizing log data. Available as services.filebeat. FRRouting, a popular suite of Internet routing protocol daemons (BGP, BFD, OSPF, IS-IS, VVRP and others). Available as services.frr heisenbridge, a bouncer-style Matrix IRC bridge. Available as services.heisenbridge. ergochat, a modern IRC with IRCv3 features. Available as services.ergochat. PowerDNS-Admin, a web interface for the PowerDNS server. Available at services.powerdns-admin. maddy, a composable all-in-one mail server. Available as services.maddy. mtr-exporter, a Prometheus exporter for mtr metrics. Available as services.mtr-exporter. tetrd, share your internet connection from your device to your PC and vice versa through a USB cable. Available at services.tetrd. ArchiSteamFarm, a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as services.archisteamfarm. teleport, allows engineers and security professionals to unify access for SSH servers, Kubernetes clusters, web applications, and databases across all environments. Available at services.teleport. BaGet, a lightweight NuGet and symbol server. Available at services.baget. prosody-filer, a server for handling XMPP HTTP Upload requests. Available at services.prosody-filer. timetagger, an open source time-tracker with an intuitive user experience and powerful reporting. services.timetagger. rstudio-server, a browser-based version of the RStudio IDE for the R programming language. Available as services.rstudio-server.

pkgs.ghc now refers to pkgs.targetPackages.haskellPackages.ghc. This only makes a difference if you are cross-compiling and will ensure that pkgs.ghc always runs on the host platform and compiles for the target platform (similar to pkgs.gcc for example). haskellPackages.ghc still behaves as before, running on the build platform and compiling for the host platform (similar to stdenv.cc). This means you don’t have to adjust your derivations if you use haskellPackages.callPackage, but when using pkgs.callPackage and taking ghc as an input, you should now use buildPackages.ghc instead to ensure cross compilation keeps working (or switch to haskellPackages.callPackage). pkgs.emacsPackages.orgPackages is removed because org elpa is deprecated. The packages in the top level of pkgs.emacsPackages, such as org and org-contrib, refer to the ones in pkgs.emacsPackages.elpaPackages and pkgs.emacsPackages.nongnuPackages where the new versions will release. services.kubernetes.addons.dashboard was removed due to it being an outdated version. The mailpile email webclient (services.mailpile) has been removed due to its reliance on python2. The MoinMoin wiki engine (services.moinmoin) has been removed, because Python 2 is being retired from nixpkgs. The wafHook hook now honors NIX_BUILD_CORES when enableParallelBuilding is not set explicitly. Packages can restore the old behaviour by setting enableParallelBuilding=false. pkgs.claws-mail-gtk2, representing Claws Mail’s older release version three, was removed in order to get rid of Python 2. Please switch to claws-mail, which is Claws Mail’s latest release based on GTK+3 and Python 3. The writers.writePython2 and corresponding writers.writePython2Bin convenience functions to create executable Python 2 scripts in the store were removed in preparation of removal of the Python 2 interpreter. Scripts have to be converted to Python 3 for use with writers.writePython3 or writers.writePyPy2 needs to be used. If you previously used /etc/docker/daemon.json, you need to incorporate the changes into the new option virtualisation.docker.daemon.settings. The backward compatibility in services.dokuwiki to configure sites with the old interface has been removed. Please use services.dokuwiki.sites instead. opensmtpd-extras is no longer build with python2 scripting support due to python2 deprecation in nixpkgs The autorestic package has been upgraded from 1.3.0 to 1.5.0 which introduces breaking changes in config file, check their migration guide for more details. For pkgs.python3.pkgs.ipython, its direct dependency pkgs.python3.pkgs.matplotlib-inline (which is really an adapter to integrate matplotlib in ipython if it is installed) does not depend on pkgs.python3.pkgs.matplotlib anymore. This is closer to a non-Nix install of ipython. This has the added benefit to reduce the closure size of ipython from ~400MB to ~160MB (including ~100MB for python itself). documentation.man has been refactored to support choosing a man implementation other than GNU’s man-db. For this, documentation.man.manualPages has been renamed to documentation.man.man-db.manualPages. If you want to use the new alternative man implementation mandoc, add documentation.man = { enable = true; man-db.enable = false; mandoc.enable = true; } to your configuration. Normal users (with isNormalUser = true) which have non-empty subUidRanges or subGidRanges set no longer have additional implicit ranges allocated. To enable automatic allocation back set autoSubUidGidRange = true. idris2 now requires --package when using packages contrib and network, while previously these idris2 packages were automatically loaded. services.thelounge.private was removed in favor of services.thelounge.public, to follow with upstream changes. pkgs.docbookrx was removed since it’s unmaintained MultiMC has been replaced with the fork PolyMC due to upstream developers being hostile to 3rd party package maintainers. PolyMC removes all MultiMC branding and is aimed at providing proper 3rd party packages like the one contained in Nixpkgs. This change affects the data folder where game instances and other save and configuration files are stored. Users with existing installations should rename ~/.local/share/multimc to ~/.local/share/polymc. The main config file’s path has also moved from ~/.local/share/multimc/multimc.cfg to ~/.local/share/polymc/polymc.cfg. pkgs.noto-fonts-cjk is now deprecated in favor of pkgs.noto-fonts-cjk-sans and pkgs.noto-fonts-cjk-serif because they each have different release schedules. To maintain compatibility with prior releases of Nixpkgs, pkgs.noto-fonts-cjk is currently an alias of pkgs.noto-fonts-cjk-sans and doesn’t include serif fonts. The interface that allows activation scripts to restart units has been reworked. Restarting and reloading is now done by a single file /run/nixos/activation-restart-list that honors restartIfChanged and reloadIfChanged of the units. The services.bookstack.cacheDir option has been removed, since the cache directory is now handled by systemd. The services.bookstack.extraConfig option has been replaced by services.bookstack.config which implements a settings-style configuration.

The option services.redis.servers was added to support per-application redis-server which is more secure since Redis databases are only mere key prefixes without any configuration or ACL of their own. Backward-compatibility is preserved by mapping old services.redis.settings to services.redis.servers."".settings, but you are strongly encouraged to name each redis-server instance after the application using it, instead of keeping that nameless one. Except for the nameless services.redis.servers."" still accessible at 127.0.0.1:6379, and to the members of the Unix group redis through the Unix socket /run/redis/redis.sock, all other services.redis.servers.${serverName} are only accessible by default to the members of the Unix group redis-${serverName} through the Unix socket /run/redis-${serverName}/redis.sock. The option virtualisation.vmVariant was added to allow users to make changes to the nixos-rebuild build-vm configuration that do not apply to their normal system. The config.system.build.vm attribute now always exists and defaults to the value from vmVariant. Configurations that import the virtualisation/qemu-vm.nix module themselves will override this value, such that vmVariant is not used. Similarly virtualisation.vmVariantWithBootloader was added. The writers.writePyPy2/writers.writePyPy3 and corresponding writers.writePyPy2Bin/writers.writePyPy3Bin convenience functions to create executable Python 2/3 scripts using the PyPy interpreter were added. The influxdb2 package was split into influxdb2-server and influxdb2-cli, matching the split that took place upstream. A combined influxdb2 package is still provided in this release for backwards compatibilty, but will be removed at a later date. The services.unifi.openPorts option default value of true is now deprecated and will be changed to false in 22.11. Configurations using this default will print a warning when rebuilt. security.acme certificates will now correctly check for CA revokation before reaching their minimum age. Removing domains from security.acme.certs._name_.extraDomainNames will now correctly remove those domains during rebuild/renew. The option programs.ssh.enableAskPassword was added, decoupling the setting of SSH_ASKPASS from services.xserver.enable. This allows easy usage in non-X11 environments, e.g. Wayland. The services.stubby module was converted to a settings-style configuration. The option services.duplicati.dataDir has been added to allow changing the location of duplicati’s files. fetchFromSourcehut now allows fetching repositories recursively using fetchgit or fetchhg if the argument fetchSubmodules is set to true. The option services.thelounge.plugins has been added to allow installing plugins for The Lounge. Plugins can be found in pkgs.theLoungePlugins.plugins and pkgs.theLoungePlugins.themes. The firmwareLinuxNonfree package has been renamed to linux-firmware. A new module was added for the Starship shell prompt, providing the options programs.starship.enable and programs.starship.settings. services.mattermost.plugins has been added to allow the declarative installation of Mattermost plugins. Plugins are automatically repackaged using autoPatchelf. The zrepl package has been updated from 0.4.0 to 0.5: The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume. A bug involving encrypt-on-receive has been fixed. Read the zrepl documentation and check the output of zfs get -r encryption,zrepl:placeholder PATH_TO_ROOTFS on the receiver. Renamed option services.openssh.challengeResponseAuthentication to services.openssh.kbdInteractiveAuthentication. Reason is that the old name has been deprecated upstream. Using the old option name will still work, but produce a warning.