14 KiB
Release 22.05 (“Quokka”, 2022.05/??)
In addition to numerous new and upgraded packages, this release has the following highlights:
- Support is planned until the end of December 2022, handing over to 22.11.
Highlights
-
security.acme.defaults
has been added to simplify configuring settings for many certificates at once. This also opens up the the option to use DNS-01 validation when usingenableACME
on web server virtual hosts (e.g.services.nginx.virtualHosts.*.enableACME
). -
PHP 8.1 is now available
-
Mattermost has been updated to extended support release 6.3, as the previously packaged extended support release 5.37 is reaching its end of life. Migrations may take a while, see the changelog and important upgrade notes.
New Services
-
aesmd, the Intel SGX Architectural Enclave Service Manager. Available as services.aesmd.
-
rootless Docker, a
systemd --user
Docker service which runs without root permissions. Available as virtualisation.docker.rootless.enable. -
matrix-conduit, a simple, fast and reliable chat server powered by matrix. Available as services.matrix-conduit.
-
filebeat, a lightweight shipper for forwarding and centralizing log data. Available as services.filebeat.
-
FRRouting, a popular suite of Internet routing protocol daemons (BGP, BFD, OSPF, IS-IS, VVRP and others). Available as services.frr
-
heisenbridge, a bouncer-style Matrix IRC bridge. Available as services.heisenbridge.
-
ergochat, a modern IRC with IRCv3 features. Available as services.ergochat.
-
PowerDNS-Admin, a web interface for the PowerDNS server. Available at services.powerdns-admin.
-
maddy, a composable all-in-one mail server. Available as services.maddy.
-
mtr-exporter, a Prometheus exporter for mtr metrics. Available as services.mtr-exporter.
-
tetrd, share your internet connection from your device to your PC and vice versa through a USB cable. Available at services.tetrd.
-
ArchiSteamFarm, a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as services.archisteamfarm.
-
teleport, allows engineers and security professionals to unify access for SSH servers, Kubernetes clusters, web applications, and databases across all environments. Available at services.teleport.
-
BaGet, a lightweight NuGet and symbol server. Available at services.baget.
-
prosody-filer, a server for handling XMPP HTTP Upload requests. Available at services.prosody-filer.
-
timetagger, an open source time-tracker with an intuitive user experience and powerful reporting. services.timetagger.
-
rstudio-server, a browser-based version of the RStudio IDE for the R programming language. Available as services.rstudio-server.
Backward Incompatibilities
-
pkgs.ghc
now refers topkgs.targetPackages.haskellPackages.ghc
. This only makes a difference if you are cross-compiling and will ensure thatpkgs.ghc
always runs on the host platform and compiles for the target platform (similar topkgs.gcc
for example).haskellPackages.ghc
still behaves as before, running on the build platform and compiling for the host platform (similar tostdenv.cc
). This means you don't have to adjust your derivations if you usehaskellPackages.callPackage
, but when usingpkgs.callPackage
and takingghc
as an input, you should now usebuildPackages.ghc
instead to ensure cross compilation keeps working (or switch tohaskellPackages.callPackage
). -
pkgs.emacsPackages.orgPackages
is removed because org elpa is deprecated. The packages in the top level ofpkgs.emacsPackages
, such as org and org-contrib, refer to the ones inpkgs.emacsPackages.elpaPackages
andpkgs.emacsPackages.nongnuPackages
where the new versions will release. -
services.kubernetes.addons.dashboard
was removed due to it being an outdated version. -
The
mailpile
email webclient (services.mailpile
) has been removed due to its reliance on python2. -
The MoinMoin wiki engine (
services.moinmoin
) has been removed, because Python 2 is being retired from nixpkgs. -
The
wafHook
hook now honorsNIX_BUILD_CORES
whenenableParallelBuilding
is not set explicitly. Packages can restore the old behaviour by settingenableParallelBuilding=false
. -
pkgs.claws-mail-gtk2
, representing Claws Mail's older release version three, was removed in order to get rid of Python 2. Please switch toclaws-mail
, which is Claws Mail's latest release based on GTK+3 and Python 3. -
The
writers.writePython2
and correspondingwriters.writePython2Bin
convenience functions to create executable Python 2 scripts in the store were removed in preparation of removal of the Python 2 interpreter. Scripts have to be converted to Python 3 for use withwriters.writePython3
orwriters.writePyPy2
needs to be used. -
If you previously used
/etc/docker/daemon.json
, you need to incorporate the changes into the new optionvirtualisation.docker.daemon.settings
. -
The backward compatibility in
services.dokuwiki
to configure sites with the old interface has been removed. Please useservices.dokuwiki.sites
instead. -
opensmtpd-extras is no longer build with python2 scripting support due to python2 deprecation in nixpkgs
-
The
autorestic
package has been upgraded from 1.3.0 to 1.5.0 which introduces breaking changes in config file, check their migration guide for more details. -
For
pkgs.python3.pkgs.ipython
, its direct dependencypkgs.python3.pkgs.matplotlib-inline
(which is really an adapter to integrate matplotlib in ipython if it is installed) does not depend onpkgs.python3.pkgs.matplotlib
anymore. This is closer to a non-Nix install of ipython. This has the added benefit to reduce the closure size ofipython
from ~400MB to ~160MB (including ~100MB for python itself). -
documentation.man
has been refactored to support choosing a man implementation other than GNU'sman-db
. For this,documentation.man.manualPages
has been renamed todocumentation.man.man-db.manualPages
. If you want to use the new alternative man implementationmandoc
, adddocumentation.man = { enable = true; man-db.enable = false; mandoc.enable = true; }
to your configuration. -
Normal users (with
isNormalUser = true
) which have non-emptysubUidRanges
orsubGidRanges
set no longer have additional implicit ranges allocated. To enable automatic allocation back setautoSubUidGidRange = true
. -
idris2
now requires--package
when using packagescontrib
andnetwork
, while previously these idris2 packages were automatically loaded. -
services.thelounge.private
was removed in favor ofservices.thelounge.public
, to follow with upstream changes. -
pkgs.docbookrx
was removed since it's unmaintained -
MultiMC has been replaced with the fork PolyMC due to upstream developers being hostile to 3rd party package maintainers. PolyMC removes all MultiMC branding and is aimed at providing proper 3rd party packages like the one contained in Nixpkgs. This change affects the data folder where game instances and other save and configuration files are stored. Users with existing installations should rename
~/.local/share/multimc
to~/.local/share/polymc
. The main config file's path has also moved from~/.local/share/multimc/multimc.cfg
to~/.local/share/polymc/polymc.cfg
. -
pkgs.noto-fonts-cjk
is now deprecated in favor ofpkgs.noto-fonts-cjk-sans
andpkgs.noto-fonts-cjk-serif
because they each have different release schedules. To maintain compatibility with prior releases of Nixpkgs,pkgs.noto-fonts-cjk
is currently an alias ofpkgs.noto-fonts-cjk-sans
and doesn't include serif fonts. -
The interface that allows activation scripts to restart units has been reworked. Restarting and reloading is now done by a single file
/run/nixos/activation-restart-list
that honorsrestartIfChanged
andreloadIfChanged
of the units. -
The
services.bookstack.cacheDir
option has been removed, since the cache directory is now handled by systemd. -
The
services.bookstack.extraConfig
option has been replaced byservices.bookstack.config
which implements a settings-style configuration.
Other Notable Changes
-
The option services.redis.servers was added to support per-application
redis-server
which is more secure since Redis databases are only mere key prefixes without any configuration or ACL of their own. Backward-compatibility is preserved by mapping oldservices.redis.settings
toservices.redis.servers."".settings
, but you are strongly encouraged to name eachredis-server
instance after the application using it, instead of keeping that nameless one. Except for the namelessservices.redis.servers.""
still accessible at127.0.0.1:6379
, and to the members of the Unix groupredis
through the Unix socket/run/redis/redis.sock
, all otherservices.redis.servers.${serverName}
are only accessible by default to the members of the Unix groupredis-${serverName}
through the Unix socket/run/redis-${serverName}/redis.sock
. -
The option virtualisation.vmVariant was added to allow users to make changes to the
nixos-rebuild build-vm
configuration that do not apply to their normal system.The
config.system.build.vm
attribute now always exists and defaults to the value fromvmVariant
. Configurations that import thevirtualisation/qemu-vm.nix
module themselves will override this value, such thatvmVariant
is not used.Similarly virtualisation.vmVariantWithBootloader was added.
-
The
writers.writePyPy2
/writers.writePyPy3
and correspondingwriters.writePyPy2Bin
/writers.writePyPy3Bin
convenience functions to create executable Python 2/3 scripts using the PyPy interpreter were added. -
The
influxdb2
package was split intoinfluxdb2-server
andinfluxdb2-cli
, matching the split that took place upstream. A combinedinfluxdb2
package is still provided in this release for backwards compatibilty, but will be removed at a later date. -
The
services.unifi.openPorts
option default value oftrue
is now deprecated and will be changed tofalse
in 22.11. Configurations using this default will print a warning when rebuilt. -
security.acme
certificates will now correctly check for CA revokation before reaching their minimum age. -
Removing domains from
security.acme.certs._name_.extraDomainNames
will now correctly remove those domains during rebuild/renew. -
The option programs.ssh.enableAskPassword was added, decoupling the setting of
SSH_ASKPASS
fromservices.xserver.enable
. This allows easy usage in non-X11 environments, e.g. Wayland. -
programs.ssh.knownHosts has gained an
extraHostNames
option to replacehostNames
.hostNames
is deprecated, but still available for now. -
The
services.stubby
module was converted to a settings-style configuration. -
The option
services.duplicati.dataDir
has been added to allow changing the location of duplicati's files. -
fetchFromSourcehut
now allows fetching repositories recursively usingfetchgit
orfetchhg
if the argumentfetchSubmodules
is set totrue
. -
The option
services.thelounge.plugins
has been added to allow installing plugins for The Lounge. Plugins can be found inpkgs.theLoungePlugins.plugins
andpkgs.theLoungePlugins.themes
. -
The
firmwareLinuxNonfree
package has been renamed tolinux-firmware
. -
The
services.mbpfan
module was converted to a RFC 0042 configuration. -
A new module was added for the Starship shell prompt, providing the options
programs.starship.enable
andprograms.starship.settings
. -
services.mattermost.plugins
has been added to allow the declarative installation of Mattermost plugins. Plugins are automatically repackaged using autoPatchelf. -
The
zrepl
package has been updated from 0.4.0 to 0.5:- The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume.
- A bug involving encrypt-on-receive has been fixed. Read the zrepl documentation and check the output of
zfs get -r encryption,zrepl:placeholder PATH_TO_ROOTFS
on the receiver.
-
Renamed option
services.openssh.challengeResponseAuthentication
toservices.openssh.kbdInteractiveAuthentication
. Reason is that the old name has been deprecated upstream. Using the old option name will still work, but produce a warning.