From 9ac11c07628c1a35b4a47ae4f76372f131d04c75 Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Fri, 29 Oct 2021 19:56:17 +0100
Subject: [PATCH 01/34] nixos/malloc: fix scudo on non-x86_64 machines

---
 nixos/modules/config/malloc.nix | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/config/malloc.nix b/nixos/modules/config/malloc.nix
index 84da5643004f..a3fed33afa18 100644
--- a/nixos/modules/config/malloc.nix
+++ b/nixos/modules/config/malloc.nix
@@ -22,8 +22,15 @@ let
       '';
     };
 
-    scudo = {
-      libPath = "${pkgs.llvmPackages_latest.compiler-rt}/lib/linux/libclang_rt.scudo-x86_64.so";
+    scudo = let
+      platformMap = {
+        aarch64-linux = "aarch64";
+        x86_64-linux  = "x86_64";
+      };
+
+      systemPlatform = platformMap.${pkgs.stdenv.hostPlatform.system} or (throw "scudo not supported on ${pkgs.stdenv.hostPlatform.system}");
+    in {
+      libPath = "${pkgs.llvmPackages_latest.compiler-rt}/lib/linux/libclang_rt.scudo-${systemPlatform}.so";
       description = ''
         A user-mode allocator based on LLVM Sanitizer’s CombinedAllocator,
         which aims at providing additional mitigations against heap based

From 5c8015b4d5246ebc45cf16da764d6e1c8052cedc Mon Sep 17 00:00:00 2001
From: "P. R. d. O" <d.ol.rod@protonmail.com>
Date: Thu, 11 Nov 2021 18:17:01 -0600
Subject: [PATCH 02/34] pomotroid: init at 0.13.0

---
 pkgs/applications/misc/pomotroid/default.nix | 60 ++++++++++++++++++++
 pkgs/top-level/all-packages.nix              |  4 ++
 2 files changed, 64 insertions(+)
 create mode 100644 pkgs/applications/misc/pomotroid/default.nix

diff --git a/pkgs/applications/misc/pomotroid/default.nix b/pkgs/applications/misc/pomotroid/default.nix
new file mode 100644
index 000000000000..dfe76aa92f4c
--- /dev/null
+++ b/pkgs/applications/misc/pomotroid/default.nix
@@ -0,0 +1,60 @@
+{ stdenv, lib, fetchurl, makeWrapper, makeDesktopItem, copyDesktopItems, electron }:
+
+let
+  version = "0.13.0";
+  appIcon = fetchurl {
+    url = "https://raw.githubusercontent.com/Splode/pomotroid/v${version}/static/icon.png";
+    sha256 = "sha256-BEPoOBErw5ZCeK4rtdxdwZZLimbpglu1Cu++4xzuVUs=";
+  };
+
+in stdenv.mkDerivation rec {
+  pname = "pomotroid";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://github.com/Splode/pomotroid/releases/download/v${version}/${pname}-${version}-linux.tar.gz";
+    sha256 = "sha256-AwpVnvwWQd/cgmZvtr5NprnLyeXz6ym4Fywc808tcSc=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      exec = "pomotroid";
+      icon = "pomotroid";
+      comment = meta.description;
+      desktopName = "Pomotroid";
+      genericName = "Pomodoro Application";
+    })
+  ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/opt/pomotroid $out/share/pomotroid $out/share/pixmaps
+
+    cp -r ./ $out/opt/pomotroid
+    mv $out/opt/pomotroid/{locales,resources} $out/share/pomotroid
+    cp ${appIcon} $out/share/pixmaps/pomotroid.png
+
+    makeWrapper ${electron}/bin/electron $out/bin/pomotroid \
+      --add-flags $out/share/pomotroid/resources/app.asar
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Simple and visually-pleasing Pomodoro timer";
+    homepage = "https://splode.github.io/pomotroid";
+    license = licenses.mit;
+    maintainers = with maintainers; [ wolfangaukang ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0596ae8b29a4..957457b0e552 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -27332,6 +27332,10 @@ with pkgs;
 
   polymake = callPackage ../applications/science/math/polymake { };
 
+  pomotroid = callPackage ../applications/misc/pomotroid {
+    electron = electron_9;
+  };
+
   pond = callPackage ../applications/networking/instant-messengers/pond { };
 
   ponymix = callPackage ../applications/audio/ponymix { };

From b85a0597380060def713a7ff3b13a6478c1a265c Mon Sep 17 00:00:00 2001
From: Austin Butler <austinabutler@gmail.com>
Date: Sun, 2 Jan 2022 15:28:13 -0800
Subject: [PATCH 03/34] element-desktop: fix "Sqlcipher support is missing"

---
 .../instant-messengers/element/element-desktop.nix           | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
index bce13052e5ac..1a0c25c606b0 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@@ -7,6 +7,7 @@
 , fetchYarnDeps
 , electron
 , element-web
+, sqlcipher
 , callPackage
 , Security
 , AppKit
@@ -78,7 +79,9 @@ mkYarnPackage rec {
     ln -s "${desktopItem}/share/applications" "$out/share/applications"
 
     # executable wrapper
+    # LD_PRELOAD workaround for sqlcipher not found: https://github.com/matrix-org/seshat/issues/102
     makeWrapper '${electron_exec}' "$out/bin/${executableName}" \
+      --set LD_PRELOAD ${sqlcipher}/lib/libsqlcipher.so \
       --add-flags "$out/share/element/electron${lib.optionalString useWayland " --enable-features=UseOzonePlatform --ozone-platform=wayland"}"
   '';
 
@@ -94,7 +97,7 @@ mkYarnPackage rec {
     name = "element-desktop";
     exec = "${executableName} %u";
     icon = "element";
-    desktopName = "Element (Riot)";
+    desktopName = "Element";
     genericName = "Matrix Client";
     comment = meta.description;
     categories = "Network;InstantMessaging;Chat;";

From f22aef829c81a028b2fa074a0a1004ecaeb9ef4c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 11 Jan 2022 11:45:35 +0000
Subject: [PATCH 04/34] telepresence2: 2.4.6 -> 2.4.9

---
 pkgs/tools/networking/telepresence2/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/networking/telepresence2/default.nix b/pkgs/tools/networking/telepresence2/default.nix
index 9a2e1b4bbc78..7b61dcf746cd 100644
--- a/pkgs/tools/networking/telepresence2/default.nix
+++ b/pkgs/tools/networking/telepresence2/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "telepresence2";
-  version = "2.4.6";
+  version = "2.4.9";
 
   src = fetchFromGitHub {
     owner = "telepresenceio";
     repo = "telepresence";
     rev = "v${version}";
-    sha256 = "09w7yk7jk5m6clq3drbgdr61w60b21jmfd635brfahms8pykmmzl";
+    sha256 = "sha256-cGG357Z0OI+aXGHWJaOPkkKUm1KcsYBvhHxNlIYlL+0=";
   };
 
   # The Helm chart is go:embed'ed as a tarball in the binary.
@@ -21,7 +21,7 @@ buildGoModule rec {
     go run ./build-aux/package_embedded_chart/main.go ${src.rev}
   '';
 
-  vendorSha256 = "0przkcqaf56a0sgan2xxqfpbs9nbmq4brwdv1qnag7i9myzvixxb";
+  vendorSha256 = "sha256-DzAxqSiWag9mOgPznjhMCQJhtJZo7hsezhwJBidsvJQ=";
 
   ldflags = [
     "-s" "-w" "-X=github.com/telepresenceio/telepresence/v2/pkg/version.Version=${src.rev}"

From caf0ba41b31b76c8052cdc26bee5a13a07fda5a4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 11 Jan 2022 17:28:29 +0000
Subject: [PATCH 05/34] libpqxx: 7.6.0 -> 7.7.0

---
 pkgs/development/libraries/libpqxx/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libpqxx/default.nix b/pkgs/development/libraries/libpqxx/default.nix
index e95adbd62942..d7eba4c87396 100644
--- a/pkgs/development/libraries/libpqxx/default.nix
+++ b/pkgs/development/libraries/libpqxx/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libpqxx";
-  version = "7.6.0";
+  version = "7.7.0";
 
   src = fetchFromGitHub {
     owner = "jtv";
     repo = pname;
     rev = version;
-    sha256 = "sha256-shcGJebjXJ3ORvcdINJFLiuW7ySqe6HyPUQioeUG/wM=";
+    sha256 = "sha256-O30czHwEDXz5xY4o3MWhmEK06OKTKMQCy0M6qwSEpy8=";
   };
 
   nativeBuildInputs = [ gnused python3 ];

From 689155195fe0a8677d529d6915ad1bff06ab3373 Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Thu, 13 Jan 2022 21:51:46 +0100
Subject: [PATCH 06/34] terraform-providers: split the removed providers

Expose the date when they were removed/archived.
---
 .../cluster/terraform-providers/default.nix   | 99 ++++++++++---------
 1 file changed, 54 insertions(+), 45 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
index 67b7cc9cd7d5..a9a5ca93711c 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -40,49 +40,58 @@ let
   automated-providers = lib.mapAttrs (_: attrs: mkProvider attrs) list;
 
   # These are the providers that don't fall in line with the default model
-  special-providers = let archived = throw "the provider has been archived by upstream"; in {
-    # Packages that don't fit the default model
-    gandi = callPackage ./gandi { };
-    # mkisofs needed to create ISOs holding cloud-init data,
-    # and wrapped to terraform via deecb4c1aab780047d79978c636eeb879dd68630
-    libvirt = automated-providers.libvirt.overrideAttrs (_: { propagatedBuildInputs = [ cdrtools ]; });
-    teleport = callPackage ./teleport { };
-    vpsadmin = callPackage ./vpsadmin { };
-  } // (lib.optionalAttrs (config.allowAliases or false) {
-    arukas = archived; # added 2022/01
-    bitbucket = archived; # added 2022/01
-    chef = archived; # added 2022/01
-    cherryservers = archived; # added 2022/01
-    clc = archived; # added 2022/01
-    cloudstack = throw "removed from nixpkgs"; # added 2022/01
-    cobbler = archived; # added 2022/01
-    cohesity = archived; # added 2022/01
-    dyn = archived; # added 2022/01
-    genymotion = archived; # added 2022/01
-    hedvig = archived; # added 2022/01
-    ignition = archived; # added 2022/01
-    incapsula = archived; # added 2022/01
-    influxdb = archived; # added 2022/01
-    jdcloud = archived; # added 2022/01
-    kubernetes-alpha = throw "This has been merged as beta into the kubernetes provider. See https://www.hashicorp.com/blog/beta-support-for-crds-in-the-terraform-provider-for-kubernetes for details";
-    librato = archived; # added 2022/01
-    logentries = archived; # added 2022/01
-    metalcloud = archived; # added 2022/01
-    mysql = archived; # added 2022/01
-    nixos = archived; # added 2022/01
-    oneandone = archived; # added 2022/01
-    packet = archived; # added 2022/01
-    profitbricks = archived; # added 2022/01
-    pureport = archived; # added 2022/01
-    rancher = archived; # added 2022/01
-    rightscale = archived; # added 2022/01
-    runscope = archived; # added 2022/01
-    segment = throw "removed from nixpkgs"; # added 2022/01
-    softlayer = archived; # added 2022/01
-    telefonicaopencloud = archived; # added 2022/01
-    terraform = archived; # added 2022/01
-    ultradns = archived; # added 2022/01
-    vthunder = throw "provider was renamed to thunder"; # added 2022/01
-  });
+  special-providers =
+    {
+      # Packages that don't fit the default model
+      gandi = callPackage ./gandi { };
+      # mkisofs needed to create ISOs holding cloud-init data,
+      # and wrapped to terraform via deecb4c1aab780047d79978c636eeb879dd68630
+      libvirt = automated-providers.libvirt.overrideAttrs (_: { propagatedBuildInputs = [ cdrtools ]; });
+      teleport = callPackage ./teleport { };
+      vpsadmin = callPackage ./vpsadmin { };
+    };
+
+  # Put all the providers we not longer support in this list.
+  removed-providers =
+    let
+      archived = date: throw "the provider has been archived by upstream on ${date}";
+      removed = date: throw "removed from nixpkgs on ${date}";
+    in
+    lib.optionalAttrs (config.allowAliases or false) {
+      arukas = archived "2022/01";
+      bitbucket = archived "2022/01";
+      chef = archived "2022/01";
+      cherryservers = archived "2022/01";
+      clc = archived "2022/01";
+      cloudstack = removed "2022/01";
+      cobbler = archived "2022/01";
+      cohesity = archived "2022/01";
+      dyn = archived "2022/01";
+      genymotion = archived "2022/01";
+      hedvig = archived "2022/01";
+      ignition = archived "2022/01";
+      incapsula = archived "2022/01";
+      influxdb = archived "2022/01";
+      jdcloud = archived "2022/01";
+      kubernetes-alpha = throw "This has been merged as beta into the kubernetes provider. See https://www.hashicorp.com/blog/beta-support-for-crds-in-the-terraform-provider-for-kubernetes for details";
+      librato = archived "2022/01";
+      logentries = archived "2022/01";
+      metalcloud = archived "2022/01";
+      mysql = archived "2022/01";
+      nixos = archived "2022/01";
+      oneandone = archived "2022/01";
+      packet = archived "2022/01";
+      profitbricks = archived "2022/01";
+      pureport = archived "2022/01";
+      rancher = archived "2022/01";
+      rightscale = archived "2022/01";
+      runscope = archived "2022/01";
+      segment = removed "2022/01";
+      softlayer = archived "2022/01";
+      telefonicaopencloud = archived "2022/01";
+      terraform = archived "2022/01";
+      ultradns = archived "2022/01";
+      vthunder = throw "provider was renamed to thunder on 2022/01";
+    };
 in
-automated-providers // special-providers // { inherit mkProvider; }
+automated-providers // special-providers // removed-providers // { inherit mkProvider; }

From f3fa6bfe96a03323e8e180889ddb6f5a688290e9 Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Thu, 13 Jan 2022 21:56:07 +0100
Subject: [PATCH 07/34] terraform-providers.mkProvider: cleanup

Remove the layer of indirection. Expose what parameters are expected
from the function call.
---
 .../cluster/terraform-providers/default.nix   | 36 +++++++++++--------
 1 file changed, 21 insertions(+), 15 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
index a9a5ca93711c..109951dfdd1c 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -7,34 +7,40 @@
 , cdrtools # libvirt
 }:
 let
-  list = lib.importJSON ./providers.json;
-
-  buildWithGoModule = data:
+  # Our generic constructor to build new providers.
+  #
+  # Is designed to combine with the terraform.withPlugins implementation.
+  mkProvider =
+    { owner
+    , repo
+    , rev
+    , version
+    , sha256
+    , vendorSha256 ? throw "vendorSha256 missing: please use `buildGoModule`" /* added 2022/01 */
+    , deleteVendor ? false
+    , proxyVendor ? false
+    , provider-source-address
+    }@attrs:
     buildGoModule {
-      pname = data.repo;
-      inherit (data) vendorSha256 version;
+      pname = repo;
+      inherit vendorSha256 version deleteVendor proxyVendor;
       subPackages = [ "." ];
       doCheck = false;
       # https://github.com/hashicorp/terraform-provider-scaffolding/blob/a8ac8375a7082befe55b71c8cbb048493dd220c2/.goreleaser.yml
       # goreleaser (used for builds distributed via terraform registry) requires that CGO is disabled
       CGO_ENABLED = 0;
-      ldflags = [ "-s" "-w" "-X main.version=${data.version}" "-X main.commit=${data.rev}" ];
+      ldflags = [ "-s" "-w" "-X main.version=${version}" "-X main.commit=${rev}" ];
       src = fetchFromGitHub {
-        inherit (data) owner repo rev sha256;
+        inherit owner repo rev sha256;
       };
-      deleteVendor = data.deleteVendor or false;
-      proxyVendor = data.proxyVendor or false;
 
       # Terraform allow checking the provider versions, but this breaks
       # if the versions are not provided via file paths.
-      postBuild = "mv $NIX_BUILD_TOP/go/bin/${data.repo}{,_v${data.version}}";
-      passthru = data;
+      postBuild = "mv $NIX_BUILD_TOP/go/bin/${repo}{,_v${version}}";
+      passthru = attrs;
     };
 
-  # Our generic constructor to build new providers
-  mkProvider = attrs:
-    (if (lib.hasAttr "vendorSha256" attrs) then buildWithGoModule else throw /* added 2022/01 */ "vendorSha256 missing: please use `buildGoModule`")
-      attrs;
+  list = lib.importJSON ./providers.json;
 
   # These providers are managed with the ./update-all script
   automated-providers = lib.mapAttrs (_: attrs: mkProvider attrs) list;

From 090872ef68bceff2369e9ebce7a60358a752c4f1 Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Thu, 13 Jan 2022 22:00:00 +0100
Subject: [PATCH 08/34] terraform_0_12: remove

Remove the last version that doesn't use the registry
---
 .../networking/cluster/terraform/default.nix       | 14 --------------
 pkgs/top-level/aliases.nix                         |  1 +
 pkgs/top-level/all-packages.nix                    |  1 -
 3 files changed, 1 insertion(+), 15 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 573cb83ccce2..8c71e5e6df6c 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -160,20 +160,6 @@ rec {
   # Constructor for other terraform versions
   mkTerraform = attrs: pluggable (generic attrs);
 
-  terraform_0_12 = mkTerraform {
-    version = "0.12.31";
-    sha256 = "03p698xdbk5gj0f9v8v1fpd74zng3948dyy4f2hv7zgks9hid7fg";
-    patches = [
-      ./provider-path.patch
-      (fetchpatch {
-        name = "fix-mac-mojave-crashes.patch";
-        url = "https://github.com/hashicorp/terraform/commit/cd65b28da051174a13ac76e54b7bb95d3051255c.patch";
-        sha256 = "1k70kk4hli72x8gza6fy3vpckdm3sf881w61fmssrah3hgmfmbrs";
-      })
-    ];
-    passthru = { inherit plugins; };
-  };
-
   terraform_0_13 = mkTerraform {
     version = "0.13.7";
     sha256 = "1cahnmp66dk21g7ga6454yfhaqrxff7hpwpdgc87cswyq823fgjn";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 861d649d0796..f26f1e0664e9 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -972,6 +972,7 @@ mapAliases ({
   telepathy_salut = telepathy-salut; # added 2018-02-25
   telnet = inetutils; # added 2018-05-15
   terminus = throw "terminus has been removed, it was unmaintained in nixpkgs"; # added 2021-08-21
+  terraform_0_12 = throw "terraform_0_12 has been removed from nixpkgs on 2021/01";
   terraform_1_0_0 = throw "terraform_1_0_0 has been renamed to terraform_1"; # added 2021-06-15
   terraform_1_0 = throw "terraform_1_0 has been renamed to terraform_1"; # added 2021-12-08
   terraform-provider-ibm = terraform-providers.ibm; # added 2018-09-28
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ff2ae2087025..840fbf864f20 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -33589,7 +33589,6 @@ with pkgs;
     buildGoModule = buildGo117Module;
   })
     mkTerraform
-    terraform_0_12
     terraform_0_13
     terraform_0_14
     terraform_0_15

From d32d994cc195858ec6569011a642d29350241edc Mon Sep 17 00:00:00 2001
From: sudosubin <sudosubin@gmail.com>
Date: Sun, 16 Jan 2022 22:31:42 +0900
Subject: [PATCH 09/34] pipenv: add pipenv shell completions

---
 pkgs/development/tools/pipenv/default.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/development/tools/pipenv/default.nix b/pkgs/development/tools/pipenv/default.nix
index 1c09bb502a23..c9590c7fa5ee 100644
--- a/pkgs/development/tools/pipenv/default.nix
+++ b/pkgs/development/tools/pipenv/default.nix
@@ -38,6 +38,17 @@ in buildPythonApplication rec {
 
   propagatedBuildInputs = runtimeDeps python3.pkgs;
 
+  postInstall = ''
+    mkdir -p "$out/share/bash-completion/completions"
+    _PIPENV_COMPLETE=bash_source "$out/bin/pipenv" > "$out/share/bash-completion/completions/pipenv"
+
+    mkdir -p "$out/share/zsh/vendor-completions"
+    _PIPENV_COMPLETE=zsh_source "$out/bin/pipenv" > "$out/share/zsh/vendor-completions/_pipenv"
+
+    mkdir -p "$out/share/fish/vendor_completions.d"
+    _PIPENV_COMPLETE=fish_source "$out/bin/pipenv" > "$out/share/fish/vendor_completions.d/pipenv.fish"
+  '';
+
   doCheck = true;
   checkPhase = ''
     export HOME=$(mktemp -d)

From e6415e1dc266204575affe723fbd1843f1e68cb7 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sun, 16 Jan 2022 22:24:07 -0700
Subject: [PATCH 10/34] mattermost: 6.2.1 -> 6.3.0 (extended support release)

---
 pkgs/servers/mattermost/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/mattermost/default.nix b/pkgs/servers/mattermost/default.nix
index fc8a299d251c..2630bb4d56ad 100644
--- a/pkgs/servers/mattermost/default.nix
+++ b/pkgs/servers/mattermost/default.nix
@@ -10,7 +10,7 @@
 , storePathAsBuildHash ? false }:
 
 let
-  version = "6.2.1";
+  version = "6.3.0";
 
   goPackagePath = "github.com/mattermost/mattermost-server";
 
@@ -22,7 +22,7 @@ let
       owner = "mattermost";
       repo = "mattermost-server";
       rev = "v${version}";
-      sha256 = "WjBsbW7aEI+MX2I1LrEJh8JgNQ4Do7PpeshXgaQAk1s=";
+      sha256 = "y3VTDl01UrMpgoN06lf98C+uTu2N9u0EAWYADPpOI3w=";
     };
 
     ldflags = [
@@ -65,7 +65,7 @@ let
 
     src = fetchurl {
       url = "https://releases.mattermost.com/${version}/mattermost-${version}-linux-amd64.tar.gz";
-      sha256 = "pV/MwMCK8vMzASXuM1+ePcarIgrcNAkFLEdmPya911E=";
+      sha256 = "PqinkPC7J6Ng1fjTrcAa6ZqiyB2JKkGRdvJ6h2wNS5w=";
     };
 
     installPhase = ''

From 9db1fb4772f6a7ea548d64e3f9e672a69b8418a9 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sun, 16 Jan 2022 22:32:55 -0700
Subject: [PATCH 11/34] nixos/mattermost: update release notes

---
 .../from_md/release-notes/rl-2205.section.xml | 19 +++++++++++++++----
 .../manual/release-notes/rl-2205.section.md   |  8 ++++++--
 .../modules/services/web-apps/mattermost.nix  |  2 +-
 3 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index 2d8086aba774..6f1059bba304 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -32,10 +32,14 @@
       </listitem>
       <listitem>
         <para>
-          Mattermost has been updated to version 6.2. Migrations may
-          take a while, see the
-          <link xlink:href="https://docs.mattermost.com/install/self-managed-changelog.html#release-v6.2-feature-release">upgrade
-          notes</link>.
+          Mattermost has been updated to extended support release 6.3,
+          as the previously packaged extended support release 5.37 is
+          <link xlink:href="https://docs.mattermost.com/upgrade/extended-support-release.html">reaching
+          its end of life</link>. Migrations may take a while, see the
+          <link xlink:href="https://docs.mattermost.com/install/self-managed-changelog.html#release-v6-3-extended-support-release">changelog</link>
+          and
+          <link xlink:href="https://docs.mattermost.com/upgrade/important-upgrade-notes.html">important
+          upgrade notes</link>.
         </para>
       </listitem>
     </itemizedlist>
@@ -517,6 +521,13 @@
           <literal>programs.starship.settings</literal>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>services.mattermost.plugins</literal> has been added
+          to allow the declarative installation of Mattermost plugins.
+          Plugins are automatically repackaged using autoPatchelf.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
 </section>
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index f83573a3a860..7dbaf4157e56 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -13,8 +13,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - PHP 8.1 is now available
 
-- Mattermost has been updated to version 6.2. Migrations may take a while,
-  see the [upgrade notes](https://docs.mattermost.com/install/self-managed-changelog.html#release-v6.2-feature-release).
+- Mattermost has been updated to extended support release 6.3, as the previously packaged extended support release 5.37 is [reaching its end of life](https://docs.mattermost.com/upgrade/extended-support-release.html).
+  Migrations may take a while, see the [changelog](https://docs.mattermost.com/install/self-managed-changelog.html#release-v6-3-extended-support-release)
+  and [important upgrade notes](https://docs.mattermost.com/upgrade/important-upgrade-notes.html).
 
 ## New Services {#sec-release-22.05-new-services}
 
@@ -177,3 +178,6 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - A new module was added for the [Starship](https://starship.rs/) shell prompt,
   providing the options `programs.starship.enable` and `programs.starship.settings`.
+
+- `services.mattermost.plugins` has been added to allow the declarative installation of Mattermost plugins.
+  Plugins are automatically repackaged using autoPatchelf.
diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix
index 310a673f5114..2901f307dc5a 100644
--- a/nixos/modules/services/web-apps/mattermost.nix
+++ b/nixos/modules/services/web-apps/mattermost.nix
@@ -181,7 +181,7 @@ in
         description = ''
           Plugins to add to the configuration. Overrides any installed if non-null.
           This is a list of paths to .tar.gz files or derivations evaluating to
-          .tar.gz files. All entries will be passed to `mattermost plugin add`.
+          .tar.gz files.
         '';
       };
 

From 697198834c6a861d30b8fbfe4162525c87155e00 Mon Sep 17 00:00:00 2001
From: blargg <tomjankauski@gmail.com>
Date: Mon, 17 May 2021 18:54:13 -0700
Subject: [PATCH 12/34] nixos/borgbackup: Add a persistentTimer option.

Persistent starts the backup service on power on if it was missed while
the system was powered down, for example.
---
 nixos/modules/services/backup/borgbackup.nix | 24 ++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix
index 6804055a2940..cb2c4d6381f9 100644
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@@ -102,6 +102,14 @@ let
       inherit (cfg) startAt;
     };
 
+  mkBackupTimers = name: cfg:
+    nameValuePair "borgbackup-job-${name}" {
+      description = "BorgBackup job ${name} timer";
+      timerConfig = {
+        Persistent = cfg.persistentTimer;
+      };
+    };
+
   # utility function around makeWrapper
   mkWrapperDrv = {
       original, name, set ? {}
@@ -321,6 +329,19 @@ in {
             '';
           };
 
+          persistentTimer = mkOption {
+            default = false;
+            type = types.bool;
+            example = true;
+            description = literalDocBook ''
+              Set the <literal>persistentTimer</literal> option for the
+              <citerefentry><refentrytitle>systemd.timer</refentrytitle>
+              <manvolnum>5</manvolnum></citerefentry>
+              which triggers the backup immediately if the last trigger
+              was missed (e.g. if the system was powered down).
+            '';
+          };
+
           user = mkOption {
             type = types.str;
             description = ''
@@ -695,6 +716,9 @@ in {
         # A repo named "foo" is mapped to systemd.services.borgbackup-repo-foo
         // mapAttrs' mkRepoService repos;
 
+      # A job named "foo" is mapped to systemd.timers.borgbackup-job-foo
+      systemd.timers = mapAttrs' mkBackupTimers jobs;
+
       users = mkMerge (mapAttrsToList mkUsersConfig repos);
 
       environment.systemPackages = with pkgs; [ borgbackup ] ++ (mapAttrsToList mkBorgWrapper jobs);

From 91dfaa5453fca2a12f375d25b084f82d1a370491 Mon Sep 17 00:00:00 2001
From: Felix Buehler <account@buehler.rocks>
Date: Tue, 11 Jan 2022 13:43:07 +0100
Subject: [PATCH 13/34] nixos/borgbackup: start remote backup only if network
 is available

---
 nixos/modules/services/backup/borgbackup.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix
index cb2c4d6381f9..05f222d5fbe2 100644
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@@ -108,6 +108,8 @@ let
       timerConfig = {
         Persistent = cfg.persistentTimer;
       };
+      # if remote-backup wait for network
+      after = optional (cfg.persistentTimer && !isLocalPath cfg.repo) "network-online.target";
     };
 
   # utility function around makeWrapper

From 17d0b66cf6940aabb7901fa03e9bd38e4e008963 Mon Sep 17 00:00:00 2001
From: Markus Kowalewski <markus.kowalewski@fysik.su.se>
Date: Mon, 17 Jan 2022 15:50:31 +0100
Subject: [PATCH 14/34] gromacs: 2021.4 -> 2021.5

---
 .../science/molecular-dynamics/gromacs/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
index f30e94f03d88..dd4bb6ef1425 100644
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@@ -19,11 +19,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "gromacs";
-  version = "2021.4";
+  version = "2021.5";
 
   src = fetchurl {
     url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-${version}.tar.gz";
-    sha256 = "07ds8abxq0k7vfpjvxb8in3fhb6lz0pbdzbmlidyzaw37qz8lw6b";
+    sha256 = "1dh9l2gcv61h1r6qsg8vr3k1xp8jgd27czzg24kzf4k823k3z9pb";
   };
 
   nativeBuildInputs = [ cmake ];

From bfc686ccb53094863a653f4790dcda4c48065f2b Mon Sep 17 00:00:00 2001
From: ImGabe <gabrielpmonte@hotmail.com>
Date: Mon, 17 Jan 2022 14:15:05 -0300
Subject: [PATCH 15/34] vscode-extensions.jdinhlife.gruvbox: init at 1.5.1

---
 pkgs/misc/vscode-extensions/default.nix | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/pkgs/misc/vscode-extensions/default.nix b/pkgs/misc/vscode-extensions/default.nix
index 794a66578017..c3471211c530 100644
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@@ -1064,6 +1064,22 @@ let
         };
       };
 
+      jdinhlife.gruvbox = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "gruvbox";
+          publisher = "jdinhlife";
+          version = "1.5.1";
+          sha256 = "sha256-0ghB0E+Wa9W2bNFFiH2Q3pUJ9HV5+JfKohX4cRyevC8=";
+        };
+        meta = with lib; {
+          description = "Gruvbox Theme";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=jdinhlife.gruvbox";
+          homepage = "https://github.com/jdinhify/vscode-theme-gruvbox";
+          license = licenses.mit;
+          maintainers = with maintainers; [ imgabe ];
+        };
+      };
+
       jnoortheen.nix-ide = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "nix-ide";

From 6782373cf32a0e2a15f50601b59bc1be24317bb6 Mon Sep 17 00:00:00 2001
From: Gordias <gordias@disroot.org>
Date: Mon, 17 Jan 2022 15:42:35 -0500
Subject: [PATCH 16/34] maintainers: add gordias

---
 maintainers/maintainer-list.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f1188327de50..5deb26cc8589 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4455,6 +4455,16 @@
     githubId = 1621335;
     name = "Andrew Trachenko";
   };
+  gordias = {
+    name = "Gordias";
+    email = "gordias@disroot.org";
+    github = "NotGordias";
+    githubId = 94724133;
+    keys = [{
+      longkeyid = "ed25519/0x5D47284830FAA4FA";
+      fingerprint = "C006 B8A0 0618 F3B6 E0E4  2ECD 5D47 2848 30FA A4FA";
+    }];
+  };
   govanify = {
     name = "Gauvain 'GovanifY' Roussel-Tarbouriech";
     email = "gauvain@govanify.com";

From 6f05ed5371929a5a2ebada3e5f38aeb79226b2a7 Mon Sep 17 00:00:00 2001
From: Gordias <gordias@disroot.org>
Date: Mon, 17 Jan 2022 15:50:30 -0500
Subject: [PATCH 17/34] alps: init at 2021-09-29

this commit adds the alps webmail package (https://git.sr.ht/~migadu/alps/)
---
 pkgs/servers/alps/default.nix   | 24 ++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix |  2 ++
 2 files changed, 26 insertions(+)
 create mode 100644 pkgs/servers/alps/default.nix

diff --git a/pkgs/servers/alps/default.nix b/pkgs/servers/alps/default.nix
new file mode 100644
index 000000000000..f367dc59401e
--- /dev/null
+++ b/pkgs/servers/alps/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromSourcehut }:
+
+buildGoModule rec {
+  pname = "alps";
+  version = "2021-09-29";
+
+  src = fetchFromSourcehut {
+    owner = "~migadu";
+    repo = "alps";
+    rev = "d4c35f3c3157bece8e50fd95f2ee1081be30d7ae";
+    sha256 = "sha256-xKfRLdfeD7lWdmC0iiq4dOIv2SmzbKH7HcAISCJgdug=";
+  };
+
+  vendorSha256 = "sha256-8fmbv5uPRfzUqsYU95YzsnuFkq4cwj+LN2X3W/yBHyA=";
+
+  proxyVendor = true;
+
+  meta = with lib; {
+    description = "A simple and extensible webmail.";
+    homepage = "https://git.sr.ht/~migadu/alps";
+    license = licenses.mit;
+    maintainers = with maintainers; [ gordias ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 203a6e9ea12d..8bfbdf6b79f0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20764,6 +20764,8 @@ with pkgs;
 
   alerta-server = callPackage ../servers/monitoring/alerta { };
 
+  alps = callPackage ../servers/alps {};
+
   apacheHttpd_2_4 = callPackage ../servers/http/apache-httpd/2.4.nix { };
   apacheHttpd = apacheHttpd_2_4;
 

From f533a6d2bdd11bf901c7d370e7ddd604b245cf98 Mon Sep 17 00:00:00 2001
From: Zane van Iperen <zane@zanevaniperen.com>
Date: Tue, 18 Jan 2022 11:40:06 +1000
Subject: [PATCH 18/34] nixos/modules/syncthing: add 22000/udp to firewall

---
 nixos/modules/services/networking/syncthing.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index e37e324019e8..3a3d4c80ecff 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -468,7 +468,7 @@ in {
         default = false;
         example = true;
         description = ''
-          Whether to open the default ports in the firewall: TCP 22000 for transfers
+          Whether to open the default ports in the firewall: TCP/UDP 22000 for transfers
           and UDP 21027 for discovery.
 
           If multiple users are running Syncthing on this machine, you will need
@@ -504,7 +504,7 @@ in {
 
     networking.firewall = mkIf cfg.openDefaultPorts {
       allowedTCPPorts = [ 22000 ];
-      allowedUDPPorts = [ 21027 ];
+      allowedUDPPorts = [ 21027 22000 ];
     };
 
     systemd.packages = [ pkgs.syncthing ];

From 42994be64b12ed7713aaf6f50ae550f999057833 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Fri, 14 Jan 2022 14:54:42 +0100
Subject: [PATCH 19/34] nixos: add cachix-agent service

---
 nixos/modules/module-list.nix                 |  1 +
 .../services/system/cachix-agent/default.nix  | 57 +++++++++++++++++++
 2 files changed, 58 insertions(+)
 create mode 100644 nixos/modules/services/system/cachix-agent/default.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index db3646b28497..98213c0125de 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -967,6 +967,7 @@
   ./services/security/vault.nix
   ./services/security/vaultwarden/default.nix
   ./services/security/yubikey-agent.nix
+  ./services/system/cachix-agent/default.nix
   ./services/system/cloud-init.nix
   ./services/system/dbus.nix
   ./services/system/earlyoom.nix
diff --git a/nixos/modules/services/system/cachix-agent/default.nix b/nixos/modules/services/system/cachix-agent/default.nix
new file mode 100644
index 000000000000..67707e1483b7
--- /dev/null
+++ b/nixos/modules/services/system/cachix-agent/default.nix
@@ -0,0 +1,57 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.cachix-agent;
+in {
+  meta.maintainers = [ lib.maintainers.domenkozar ];
+
+  options.services.cachix-agent = {
+    enable = mkEnableOption "Cachix Deploy Agent: https://docs.cachix.org/deploy/";
+
+    name = mkOption {
+      type = types.str;
+      description = "Agent name, usually same as the hostname";
+      default = config.networking.hostName;
+      defaultText = "config.networking.hostName";
+    };
+
+    profile = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "Profile name, defaults to 'system' (NixOS).";
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.cachix;
+      defaultText = literalExpression "pkgs.cachix";
+      description = "Cachix Client package to use.";
+    };
+
+    credentialsFile = mkOption {
+      type = types.path;
+      default = "/etc/cachix-agent.token";
+      description = ''
+        Required file that needs to contain CACHIX_AGENT_TOKEN=...
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.cachix-agent = {
+      description = "Cachix Deploy Agent";
+      after = ["network.target"];
+      path = [ config.nix.package ];
+      wantedBy = [ "multi-user.target" ];
+      # don't restart while changing
+      reloadIfChanged = true;
+      serviceConfig = {
+        Restart = "on-failure";
+        EnvironmentFile = cfg.credentialsFile;
+        ExecStart = "${cfg.package}/bin/cachix deploy agent ${cfg.name} ${if cfg.profile != null then profile else ""}";
+      };
+    };
+  };
+}

From 7caa6f4de48ae4de02e12aaa13a9eb9a66013ae8 Mon Sep 17 00:00:00 2001
From: Felix Buehler <account@buehler.rocks>
Date: Mon, 17 Jan 2022 16:00:31 +0100
Subject: [PATCH 20/34] nixos/borgbackup: move systemd.timers logic into single
 block

---
 nixos/modules/services/backup/borgbackup.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix
index 05f222d5fbe2..2c307a701f3e 100644
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@@ -99,14 +99,15 @@ let
         BORG_REPO = cfg.repo;
         inherit (cfg) extraArgs extraInitArgs extraCreateArgs extraPruneArgs;
       } // (mkPassEnv cfg) // cfg.environment;
-      inherit (cfg) startAt;
     };
 
   mkBackupTimers = name: cfg:
     nameValuePair "borgbackup-job-${name}" {
       description = "BorgBackup job ${name} timer";
+      wantedBy = [ "timers.target" ];
       timerConfig = {
         Persistent = cfg.persistentTimer;
+        OnCalendar = cfg.startAt;
       };
       # if remote-backup wait for network
       after = optional (cfg.persistentTimer && !isLocalPath cfg.repo) "network-online.target";
@@ -719,7 +720,8 @@ in {
         // mapAttrs' mkRepoService repos;
 
       # A job named "foo" is mapped to systemd.timers.borgbackup-job-foo
-      systemd.timers = mapAttrs' mkBackupTimers jobs;
+      # only generate the timer if interval (startAt) is set
+      systemd.timers = mapAttrs' mkBackupTimers (filterAttrs (_: cfg: cfg.startAt != []) jobs);
 
       users = mkMerge (mapAttrsToList mkUsersConfig repos);
 

From c8aa2e9d7aa3b28f4b59dcc328ec2c64abf6f089 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 18 Jan 2022 13:33:03 +0100
Subject: [PATCH 21/34] gtk3: fix patch hash

The usual nix-prefetch-url confusion with fetchpatch:
https://github.com/NixOS/nixpkgs/pull/153412#issuecomment-1015350908
---
 pkgs/development/libraries/gtk/3.x.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 9a2655a379f0..bb1451594475 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
     # 3.24.31 does not declare QuartzCore dependency properly and fails to link
     (fetchpatch {
       url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/0ac61443694b477c41fc246cb387ef86aba441de.patch";
-      sha256 = "sha256-aiT/NeAxIl6ZS9KwMssQPzD7NtW7qqeySc/CyWakQfk=";
+      sha256 = "sha256-KaMeIdV/gfM4xzN9lIkY99E7bzAfTM6VETk5DEunB2w=";
     })
   ];
 

From 3c2143ee7f1591b641c06eb8ac476c1b8c12e791 Mon Sep 17 00:00:00 2001
From: Robert Helgesson <robert@rycee.net>
Date: Tue, 18 Jan 2022 13:33:52 +0100
Subject: [PATCH 22/34] cue: 0.4.0 -> 0.4.1

Also

- download source from GitHub,

- run test suite, and

- add simple installation test.
---
 pkgs/development/tools/cue/default.nix | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/tools/cue/default.nix b/pkgs/development/tools/cue/default.nix
index f177ced3092d..9119dbce158d 100644
--- a/pkgs/development/tools/cue/default.nix
+++ b/pkgs/development/tools/cue/default.nix
@@ -1,18 +1,19 @@
-{ buildGoModule, fetchgit, lib }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
 buildGoModule rec {
   pname = "cue";
-  version = "0.4.0";
+  version = "0.4.1";
 
-  src = fetchgit {
-    url = "https://cue.googlesource.com/cue";
+  src = fetchFromGitHub {
+    owner = "cue-lang";
+    repo = "cue";
     rev = "v${version}";
-    sha256 = "sha256-rcGEl+CMFyxZKsOKhVimhv5/ONo3xS6FjgKModZGR2o=";
+    sha256 = "1q1mkqb6fk515g556yn8ks3gqrimfbadprmbv5rill1lpipq5xbj";
   };
 
-  vendorSha256 = "sha256-eSKVlBgnHR1R0j1lNwtFoIgRuj8GqoMbvuBl/N1SanY=";
+  vendorSha256 = "12p77a97lbff6qhncs5qx13k3wmf9hrr09mhh12isw5s0p0n53xm";
 
-  doCheck = false;
+  checkPhase = "go test ./...";
 
   subPackages = [ "cmd/cue" ];
 
@@ -20,6 +21,11 @@ buildGoModule rec {
     "-s" "-w" "-X cuelang.org/go/cmd/cue/cmd.version=${version}"
   ];
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/cue eval - <<<'a: "all good"' > /dev/null
+  '';
+
   meta = {
     description = "A data constraint language which aims to simplify tasks involving defining and using data";
     homepage = "https://cuelang.org/";

From 6d985ef1744ba2d2c3eacf269af52bd3eaf58f93 Mon Sep 17 00:00:00 2001
From: Daniel Frank <git@danielfrank.net>
Date: Fri, 14 Jan 2022 21:59:11 +0100
Subject: [PATCH 23/34] openssh: Rename option, old option is deprecated
 upstream

---
 nixos/modules/services/networking/ssh/sshd.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index f19624aba022..7bfc70050992 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -81,6 +81,7 @@ in
   imports = [
     (mkAliasOptionModule [ "services" "sshd" "enable" ] [ "services" "openssh" "enable" ])
     (mkAliasOptionModule [ "services" "openssh" "knownHosts" ] [ "programs" "ssh" "knownHosts" ])
+    (mkRenamedOptionModule [ "services" "openssh" "challengeResponseAuthentication" ] [ "services" "openssh" "kbdInteractiveAuthentication" ])
   ];
 
   ###### interface
@@ -218,11 +219,11 @@ in
         '';
       };
 
-      challengeResponseAuthentication = mkOption {
+      kbdInteractiveAuthentication = mkOption {
         type = types.bool;
         default = true;
         description = ''
-          Specifies whether challenge/response authentication is allowed.
+          Specifies whether keyboard-interactive authentication is allowed.
         '';
       };
 
@@ -534,7 +535,7 @@ in
         PermitRootLogin ${cfg.permitRootLogin}
         GatewayPorts ${cfg.gatewayPorts}
         PasswordAuthentication ${if cfg.passwordAuthentication then "yes" else "no"}
-        ChallengeResponseAuthentication ${if cfg.challengeResponseAuthentication then "yes" else "no"}
+        KbdInteractiveAuthentication ${if cfg.kbdInteractiveAuthentication then "yes" else "no"}
 
         PrintMotd no # handled by pam_motd
 

From 11b2191b74c0a8b6bf30fc1136033321a2ea1b96 Mon Sep 17 00:00:00 2001
From: Daniel Frank <git@danielfrank.net>
Date: Sat, 15 Jan 2022 13:51:28 +0100
Subject: [PATCH 24/34] openssh: Update tests to use new option name

---
 nixos/tests/borgbackup.nix            | 2 +-
 nixos/tests/btrbk.nix                 | 2 +-
 nixos/tests/google-oslogin/server.nix | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/nixos/tests/borgbackup.nix b/nixos/tests/borgbackup.nix
index cbb28689209b..d3cd6c66bfeb 100644
--- a/nixos/tests/borgbackup.nix
+++ b/nixos/tests/borgbackup.nix
@@ -106,7 +106,7 @@ in {
       services.openssh = {
         enable = true;
         passwordAuthentication = false;
-        challengeResponseAuthentication = false;
+        kbdInteractiveAuthentication = false;
       };
 
       services.borgbackup.repos.repo1 = {
diff --git a/nixos/tests/btrbk.nix b/nixos/tests/btrbk.nix
index 2689bb66c63a..9f34f7dfbe38 100644
--- a/nixos/tests/btrbk.nix
+++ b/nixos/tests/btrbk.nix
@@ -53,7 +53,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
         services.openssh = {
           enable = true;
           passwordAuthentication = false;
-          challengeResponseAuthentication = false;
+          kbdInteractiveAuthentication = false;
         };
         services.btrbk = {
           extraPackages = [ pkgs.lz4 ];
diff --git a/nixos/tests/google-oslogin/server.nix b/nixos/tests/google-oslogin/server.nix
index fdb7141da317..a0a3144ae69f 100644
--- a/nixos/tests/google-oslogin/server.nix
+++ b/nixos/tests/google-oslogin/server.nix
@@ -17,7 +17,7 @@ in {
   };
 
   services.openssh.enable = true;
-  services.openssh.challengeResponseAuthentication = false;
+  services.openssh.kbdInteractiveAuthentication = false;
   services.openssh.passwordAuthentication = false;
 
   security.googleOsLogin.enable = true;

From d851c11a9f15058c906af79ba0982b2faafef654 Mon Sep 17 00:00:00 2001
From: Daniel Frank <git@danielfrank.net>
Date: Sat, 15 Jan 2022 14:51:59 +0100
Subject: [PATCH 25/34] openssh: add release-notes entry for
 services.openssh.{challengeResponseAuthentication ->
 kbdInteractiveAuthentication}

---
 .../manual/from_md/release-notes/rl-2205.section.xml  | 11 +++++++++++
 nixos/doc/manual/release-notes/rl-2205.section.md     |  4 ++++
 2 files changed, 15 insertions(+)

diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index 874d68043f47..75efc4e20492 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -564,6 +564,17 @@
           </listitem>
         </itemizedlist>
       </listitem>
+      <listitem>
+        <para>
+          Renamed option
+          <literal>services.openssh.challengeResponseAuthentication</literal>
+          to
+          <literal>services.openssh.kbdInteractiveAuthentication</literal>.
+          Reason is that the old name has been deprecated upstream.
+          Using the old option name will still work, but produce a
+          warning.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
 </section>
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 66a06794cebd..f0cab80e58c0 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -189,3 +189,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 - The `zrepl` package has been updated from 0.4.0 to 0.5:
     * The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume.
     * A bug involving encrypt-on-receive has been fixed.  Read the [zrepl documentation](https://zrepl.github.io/configuration/sendrecvoptions.html#job-recv-options-placeholder) and check the output of `zfs get -r encryption,zrepl:placeholder PATH_TO_ROOTFS` on the receiver.
+
+- Renamed option `services.openssh.challengeResponseAuthentication` to `services.openssh.kbdInteractiveAuthentication`.
+  Reason is that the old name has been deprecated upstream.
+  Using the old option name will still work, but produce a warning.

From d35021fc314ffe4a197f13b21743569bb16498bb Mon Sep 17 00:00:00 2001
From: davidak <git@davidak.de>
Date: Mon, 17 Jan 2022 10:59:15 +0100
Subject: [PATCH 26/34] monitor: 0.11.0 -> 0.12.0

---
 pkgs/applications/system/monitor/default.nix | 18 ++++++++++++++++--
 pkgs/top-level/all-packages.nix              |  4 +++-
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/system/monitor/default.nix b/pkgs/applications/system/monitor/default.nix
index 6b535e5ad418..653d727525e8 100644
--- a/pkgs/applications/system/monitor/default.nix
+++ b/pkgs/applications/system/monitor/default.nix
@@ -18,17 +18,20 @@
 , sassc
 , udisks2
 , wrapGAppsHook
+, libX11
+, libXext
+, libXNVCtrl
 }:
 
 stdenv.mkDerivation rec {
   pname = "monitor";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "stsdc";
     repo = "monitor";
     rev = version;
-    sha256 = "sha256-xWhhjn7zk/juXx50wLG2TpB5aqU+588kWBBquWrVJbM=";
+    sha256 = "1fv98yz9393ddp0k96bwbgccy6x9dmmg8g1pjd3xs6m4c1bnvfc7";
     fetchSubmodules = true;
   };
 
@@ -53,8 +56,19 @@ stdenv.mkDerivation rec {
     libwnck
     sassc
     udisks2
+    libX11
+    libXext
+    libXNVCtrl
   ];
 
+  # Force link against Xext, otherwise build fails with:
+  # ld: /nix/store/...-libXNVCtrl-495.46/lib/libXNVCtrl.a(NVCtrl.o): undefined reference to symbol 'XextAddDisplay'
+  # ld: /nix/store/...-libXext-1.3.4/lib/libXext.so.6: error adding symbols: DSO missing from command line
+  # https://github.com/stsdc/monitor/issues/292
+  NIX_LDFLAGS = "-lXext";
+
+  mesonFlags = [ "-Dindicator-wingpanel=enabled" ];
+
   postPatch = ''
     chmod +x meson/post_install.py
     patchShebangs meson/post_install.py
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cee2b77b23e7..0bdf15188ad0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -27189,7 +27189,9 @@ with pkgs;
     ocamlPackages = ocaml-ng.ocamlPackages_4_01_0;
   };
 
-  monitor = callPackage ../applications/system/monitor { };
+  monitor = callPackage ../applications/system/monitor {
+    libXNVCtrl = linuxPackages.nvidia_x11.settings.libXNVCtrl;
+  };
 
   moolticute = libsForQt5.callPackage ../applications/misc/moolticute { };
 

From 04386f35520ebca9d58fe1a2848de2fce9697142 Mon Sep 17 00:00:00 2001
From: Sascha Grunert <sgrunert@redhat.com>
Date: Tue, 18 Jan 2022 15:09:54 +0100
Subject: [PATCH 27/34] fuse-overlayfs: 1.8 -> 1.8.1

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
---
 pkgs/tools/filesystems/fuse-overlayfs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/filesystems/fuse-overlayfs/default.nix b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
index 28109560ac29..7a7f442878ca 100644
--- a/pkgs/tools/filesystems/fuse-overlayfs/default.nix
+++ b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fuse-overlayfs";
-  version = "1.8";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VqtBJ8HRyhjwKVoRu6+EArZMVbzXkaK89yV56MzRUJo=";
+    sha256 = "sha256-0vmcn3AOASjN61QzxxGYpPMWlukanh8+vbZQcFpU/vs=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];

From e7fa7fdffc8c37239fb98e1d902a932cad066ea5 Mon Sep 17 00:00:00 2001
From: talyz <kim.lindberger@gmail.com>
Date: Tue, 11 Jan 2022 13:19:51 +0100
Subject: [PATCH 28/34] nixos/bookstack: Clear the cache more reliably

When upgrading bookstack, if something in the cache conflicts with the
new installation, the artisan commands might fail. To solve this, make
the cache lifetime bound to the setup service. This also removes the
`cacheDir` option, since the path is now handled automatically by
systemd.
---
 .../from_md/release-notes/rl-2205.section.xml |  7 +++++
 .../manual/release-notes/rl-2205.section.md   |  3 ++
 nixos/modules/services/web-apps/bookstack.nix | 29 ++++++++-----------
 3 files changed, 22 insertions(+), 17 deletions(-)

diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index 932d60d6b361..705d28aad5dc 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -391,6 +391,13 @@
           <literal>reloadIfChanged</literal> of the units.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>services.bookstack.cacheDir</literal> option has
+          been removed, since the cache directory is now handled by
+          systemd.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-22.05-notable-changes">
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 7e97bd06676c..70691ccce877 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -122,6 +122,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The interface that allows activation scripts to restart units has been reworked. Restarting and reloading is now done by a single file `/run/nixos/activation-restart-list` that honors `restartIfChanged` and `reloadIfChanged` of the units.
 
+- The `services.bookstack.cacheDir` option has been removed, since the
+  cache directory is now handled by systemd.
+
 ## Other Notable Changes {#sec-release-22.05-notable-changes}
 
 - The option [services.redis.servers](#opt-services.redis.servers) was added
diff --git a/nixos/modules/services/web-apps/bookstack.nix b/nixos/modules/services/web-apps/bookstack.nix
index b509e4fff458..1124568e8d35 100644
--- a/nixos/modules/services/web-apps/bookstack.nix
+++ b/nixos/modules/services/web-apps/bookstack.nix
@@ -26,6 +26,10 @@ let
 
 
 in {
+  imports = [
+    (mkRemovedOptionModule [ "services" "bookstack" "cacheDir" ] "The cache directory is now handled automatically.")
+  ];
+
   options.services.bookstack = {
 
     enable = mkEnableOption "BookStack";
@@ -60,12 +64,6 @@ in {
       type = types.str;
     };
 
-    cacheDir = mkOption {
-      description = "BookStack cache directory";
-      default = "/var/cache/bookstack";
-      type = types.path;
-    };
-
     dataDir = mkOption {
       description = "BookStack data directory";
       default = "/var/lib/bookstack";
@@ -290,8 +288,11 @@ in {
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         Type = "oneshot";
+        RemainAfterExit = true;
         User = user;
         WorkingDirectory = "${bookstack}";
+        RuntimeDirectory = "bookstack/cache";
+        RuntimeDirectoryMode = 0700;
       };
       script = ''
         # set permissions
@@ -313,27 +314,21 @@ in {
         ${optionalString (mail.encryption != null) "MAIL_ENCRYPTION=${mail.encryption};"}
         ${optionalString (db.passwordFile != null) "DB_PASSWORD=$(head -n1 ${db.passwordFile})"}
         ${optionalString (mail.passwordFile != null) "MAIL_PASSWORD=$(head -n1 ${mail.passwordFile})"}
-        APP_SERVICES_CACHE=${cfg.cacheDir}/services.php
-        APP_PACKAGES_CACHE=${cfg.cacheDir}/packages.php
-        APP_CONFIG_CACHE=${cfg.cacheDir}/config.php
-        APP_ROUTES_CACHE=${cfg.cacheDir}/routes-v7.php
-        APP_EVENTS_CACHE=${cfg.cacheDir}/events.php
+        APP_SERVICES_CACHE=/run/bookstack/cache/services.php
+        APP_PACKAGES_CACHE=/run/bookstack/cache/packages.php
+        APP_CONFIG_CACHE=/run/bookstack/cache/config.php
+        APP_ROUTES_CACHE=/run/bookstack/cache/routes-v7.php
+        APP_EVENTS_CACHE=/run/bookstack/cache/events.php
         ${optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "SESSION_SECURE_COOKIE=true"}
         ${toString cfg.extraConfig}
         " > "${cfg.dataDir}/.env"
 
         # migrate db
         ${pkgs.php}/bin/php artisan migrate --force
-
-        # clear & create caches (needed in case of update)
-        ${pkgs.php}/bin/php artisan cache:clear
-        ${pkgs.php}/bin/php artisan config:clear
-        ${pkgs.php}/bin/php artisan view:clear
       '';
     };
 
     systemd.tmpfiles.rules = [
-      "d ${cfg.cacheDir}                           0700 ${user} ${group} - -"
       "d ${cfg.dataDir}                            0710 ${user} ${group} - -"
       "d ${cfg.dataDir}/public                     0750 ${user} ${group} - -"
       "d ${cfg.dataDir}/public/uploads             0750 ${user} ${group} - -"

From df607c1d1f6ea9ad5fcc99a0cabba0ede4be0d4e Mon Sep 17 00:00:00 2001
From: talyz <kim.lindberger@gmail.com>
Date: Tue, 11 Jan 2022 13:36:52 +0100
Subject: [PATCH 29/34] nixos/bookstack: Make the hostname configurable...

...and set a reasonable default `appURL` based on it.

This is pretty much required when configuring ACME, and useful in
general.
---
 nixos/modules/services/web-apps/bookstack.nix | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/bookstack.nix b/nixos/modules/services/web-apps/bookstack.nix
index 1124568e8d35..62a04bccc667 100644
--- a/nixos/modules/services/web-apps/bookstack.nix
+++ b/nixos/modules/services/web-apps/bookstack.nix
@@ -24,6 +24,7 @@ let
     $sudo ${pkgs.php}/bin/php artisan $*
   '';
 
+  tlsEnabled = cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME;
 
 in {
   imports = [
@@ -55,11 +56,26 @@ in {
       type = types.path;
     };
 
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default = if config.networking.domain != null then
+                  config.networking.fqdn
+                else
+                  config.networking.hostName;
+      defaultText = lib.literalExpression "config.networking.fqdn";
+      example = "bookstack.example.com";
+      description = ''
+        The hostname to serve BookStack on.
+      '';
+    };
+
     appURL = mkOption {
       description = ''
         The root URL that you want to host BookStack on. All URLs in BookStack will be generated using this value.
         If you change this in the future you may need to run a command to update stored URLs in the database. Command example: <code>php artisan bookstack:update-url https://old.example.com https://new.example.com</code>
       '';
+      default = "http${lib.optionalString tlsEnabled "s"}://${cfg.hostname}";
+      defaultText = ''http''${lib.optionalString tlsEnabled "s"}://''${cfg.hostname}'';
       example = "https://example.com";
       type = types.str;
     };
@@ -256,7 +272,7 @@ in {
 
     services.nginx = {
       enable = mkDefault true;
-      virtualHosts.bookstack = mkMerge [ cfg.nginx {
+      virtualHosts.${cfg.hostname} = mkMerge [ cfg.nginx {
         root = mkForce "${bookstack}/public";
         extraConfig = optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "fastcgi_param HTTPS on;";
         locations = {

From a0b54a0626634b34b579e52f84464e5ab890afdd Mon Sep 17 00:00:00 2001
From: talyz <kim.lindberger@gmail.com>
Date: Tue, 11 Jan 2022 13:48:13 +0100
Subject: [PATCH 30/34] nixos/bookstack: Simplify the nginx setup

Use the recommended defaults and remove unnecessary configuration.
---
 nixos/modules/services/web-apps/bookstack.nix | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/nixos/modules/services/web-apps/bookstack.nix b/nixos/modules/services/web-apps/bookstack.nix
index 62a04bccc667..c0eec78059b5 100644
--- a/nixos/modules/services/web-apps/bookstack.nix
+++ b/nixos/modules/services/web-apps/bookstack.nix
@@ -272,24 +272,19 @@ in {
 
     services.nginx = {
       enable = mkDefault true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
       virtualHosts.${cfg.hostname} = mkMerge [ cfg.nginx {
         root = mkForce "${bookstack}/public";
-        extraConfig = optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "fastcgi_param HTTPS on;";
         locations = {
           "/" = {
             index = "index.php";
-            extraConfig = ''try_files $uri $uri/ /index.php?$query_string;'';
-          };
-          "~ \.php$" = {
-            extraConfig = ''
-              try_files $uri $uri/ /index.php?$query_string;
-              include ${pkgs.nginx}/conf/fastcgi_params;
-              fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-              fastcgi_param REDIRECT_STATUS 200;
-              fastcgi_pass unix:${config.services.phpfpm.pools."bookstack".socket};
-              ${optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "fastcgi_param HTTPS on;"}
-            '';
+            tryFiles = "$uri $uri/ /index.php?$query_string";
           };
+          "~ \.php$".extraConfig = ''
+            fastcgi_pass unix:${config.services.phpfpm.pools."bookstack".socket};
+          '';
           "~ \.(js|css|gif|png|ico|jpg|jpeg)$" = {
             extraConfig = "expires 365d;";
           };

From 07b64a2ad72563fbf63be443954aa20406ae87fd Mon Sep 17 00:00:00 2001
From: talyz <kim.lindberger@gmail.com>
Date: Tue, 11 Jan 2022 13:51:52 +0100
Subject: [PATCH 31/34] nixos/bookstack: Add option config to replace
 extraConfig

The `extraConfig` parameter only handles text - it doesn't support
arbitrary secrets and, with the way it's processed in the setup
script, it's very easy to accidentally unescape the echoed string and
run shell commands / feed garbage to bash.

To fix this, implement a new option, `config`, which instead takes a
typed attribute set, generates the `.env` file in nix and does
arbitrary secret replacement. This option is then used to provide the
configuration for all other options which change the `.env` file.
---
 .../from_md/release-notes/rl-2205.section.xml |  10 ++
 .../manual/release-notes/rl-2205.section.md   |   5 +
 nixos/modules/services/web-apps/bookstack.nix | 146 +++++++++++++-----
 3 files changed, 126 insertions(+), 35 deletions(-)

diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index 705d28aad5dc..0902b62251f4 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -398,6 +398,16 @@
           systemd.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>services.bookstack.extraConfig</literal> option
+          has been replaced by
+          <literal>services.bookstack.config</literal> which implements
+          a
+          <link xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">settings-style</link>
+          configuration.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-22.05-notable-changes">
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 70691ccce877..447b6cabde13 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -125,6 +125,11 @@ In addition to numerous new and upgraded packages, this release has the followin
 - The `services.bookstack.cacheDir` option has been removed, since the
   cache directory is now handled by systemd.
 
+- The `services.bookstack.extraConfig` option has been replaced by
+  `services.bookstack.config` which implements a
+  [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)
+  configuration.
+
 ## Other Notable Changes {#sec-release-22.05-notable-changes}
 
 - The option [services.redis.servers](#opt-services.redis.servers) was added
diff --git a/nixos/modules/services/web-apps/bookstack.nix b/nixos/modules/services/web-apps/bookstack.nix
index c0eec78059b5..54eaea63b6eb 100644
--- a/nixos/modules/services/web-apps/bookstack.nix
+++ b/nixos/modules/services/web-apps/bookstack.nix
@@ -28,6 +28,7 @@ let
 
 in {
   imports = [
+    (mkRemovedOptionModule [ "services" "bookstack" "extraConfig" ] "Use services.bookstack.config instead.")
     (mkRemovedOptionModule [ "services" "bookstack" "cacheDir" ] "The cache directory is now handled automatically.")
   ];
 
@@ -49,8 +50,9 @@ in {
 
     appKeyFile = mkOption {
       description = ''
-        A file containing the AppKey.
-        Used for encryption where needed. Can be generated with <code>head -c 32 /dev/urandom| base64</code> and must be prefixed with <literal>base64:</literal>.
+        A file containing the Laravel APP_KEY - a 32 character long,
+        base64 encoded key used for encryption where needed. Can be
+        generated with <code>head -c 32 /dev/urandom | base64</code>.
       '';
       example = "/run/keys/bookstack-appkey";
       type = types.path;
@@ -216,16 +218,59 @@ in {
       '';
     };
 
-    extraConfig = mkOption {
-      type = types.nullOr types.lines;
-      default = null;
-      example = ''
-        ALLOWED_IFRAME_HOSTS="https://example.com"
-        WKHTMLTOPDF=/home/user/bins/wkhtmltopdf
+    config = mkOption {
+      type = with types;
+        attrsOf
+          (nullOr
+            (either
+              (oneOf [
+                bool
+                int
+                port
+                path
+                str
+              ])
+              (submodule {
+                options = {
+                  _secret = mkOption {
+                    type = nullOr str;
+                    description = ''
+                      The path to a file containing the value the
+                      option should be set to in the final
+                      configuration file.
+                    '';
+                  };
+                };
+              })));
+      default = {};
+      example = literalExpression ''
+        {
+          ALLOWED_IFRAME_HOSTS = "https://example.com";
+          WKHTMLTOPDF = "/home/user/bins/wkhtmltopdf";
+          AUTH_METHOD = "oidc";
+          OIDC_NAME = "MyLogin";
+          OIDC_DISPLAY_NAME_CLAIMS = "name";
+          OIDC_CLIENT_ID = "bookstack";
+          OIDC_CLIENT_SECRET = {_secret = "/run/keys/oidc_secret"};
+          OIDC_ISSUER = "https://keycloak.example.com/auth/realms/My%20Realm";
+          OIDC_ISSUER_DISCOVER = true;
+        }
       '';
       description = ''
-        Lines to be appended verbatim to the BookStack configuration.
-        Refer to <link xlink:href="https://www.bookstackapp.com/docs/"/> for details on supported values.
+        BookStack configuration options to set in the
+        <filename>.env</filename> file.
+
+        Refer to <link xlink:href="https://www.bookstackapp.com/docs/"/>
+        for details on supported values.
+
+        Settings containing secret data should be set to an attribute
+        set containing the attribute <literal>_secret</literal> - a
+        string pointing to a file containing the value the option
+        should be set to. See the example to get a better picture of
+        this: in the resulting <filename>.env</filename> file, the
+        <literal>OIDC_CLIENT_SECRET</literal> key will be set to the
+        contents of the <filename>/run/keys/oidc_secret</filename>
+        file.
       '';
     };
 
@@ -242,6 +287,30 @@ in {
       }
     ];
 
+    services.bookstack.config = {
+      APP_KEY._secret = cfg.appKeyFile;
+      APP_URL = cfg.appURL;
+      DB_HOST = db.host;
+      DB_PORT = db.port;
+      DB_DATABASE = db.name;
+      DB_USERNAME = db.user;
+      MAIL_DRIVER = mail.driver;
+      MAIL_FROM_NAME = mail.fromName;
+      MAIL_FROM = mail.from;
+      MAIL_HOST = mail.host;
+      MAIL_PORT = mail.port;
+      MAIL_USERNAME = mail.user;
+      MAIL_ENCRYPTION = mail.encryption;
+      DB_PASSWORD._secret = db.passwordFile;
+      MAIL_PASSWORD._secret = mail.passwordFile;
+      APP_SERVICES_CACHE = "/run/bookstack/cache/services.php";
+      APP_PACKAGES_CACHE = "/run/bookstack/cache/packages.php";
+      APP_CONFIG_CACHE = "/run/bookstack/cache/config.php";
+      APP_ROUTES_CACHE = "/run/bookstack/cache/routes-v7.php";
+      APP_EVENTS_CACHE = "/run/bookstack/cache/events.php";
+      SESSION_SECURE_COOKIE = tlsEnabled;
+    };
+
     environment.systemPackages = [ artisan ];
 
     services.mysql = mkIf db.createLocally {
@@ -305,34 +374,41 @@ in {
         RuntimeDirectory = "bookstack/cache";
         RuntimeDirectoryMode = 0700;
       };
-      script = ''
+      path = [ pkgs.replace-secret ];
+      script =
+        let
+          isSecret = v: isAttrs v && v ? _secret && isString v._secret;
+          bookstackEnvVars = lib.generators.toKeyValue {
+            mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
+              mkValueString = v: with builtins;
+                if isInt         v then toString v
+                else if isString v then v
+                else if true  == v then "true"
+                else if false == v then "false"
+                else if isSecret v then v._secret
+                else throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty {}) v}";
+            };
+          };
+          secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.config);
+          mkSecretReplacement = file: ''
+            replace-secret ${escapeShellArgs [ file file "${cfg.dataDir}/.env" ]}
+          '';
+          secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+          filteredConfig = lib.converge (lib.filterAttrsRecursive (_: v: ! elem v [ {} null ])) cfg.config;
+          bookstackEnv = pkgs.writeText "bookstack.env" (bookstackEnvVars filteredConfig);
+        in ''
+        # error handling
+        set -euo pipefail
+
         # set permissions
         umask 077
+
         # create .env file
-        echo "
-        APP_KEY=base64:$(head -n1 ${cfg.appKeyFile})
-        APP_URL=${cfg.appURL}
-        DB_HOST=${db.host}
-        DB_PORT=${toString db.port}
-        DB_DATABASE=${db.name}
-        DB_USERNAME=${db.user}
-        MAIL_DRIVER=${mail.driver}
-        MAIL_FROM_NAME=\"${mail.fromName}\"
-        MAIL_FROM=${mail.from}
-        MAIL_HOST=${mail.host}
-        MAIL_PORT=${toString mail.port}
-        ${optionalString (mail.user != null) "MAIL_USERNAME=${mail.user};"}
-        ${optionalString (mail.encryption != null) "MAIL_ENCRYPTION=${mail.encryption};"}
-        ${optionalString (db.passwordFile != null) "DB_PASSWORD=$(head -n1 ${db.passwordFile})"}
-        ${optionalString (mail.passwordFile != null) "MAIL_PASSWORD=$(head -n1 ${mail.passwordFile})"}
-        APP_SERVICES_CACHE=/run/bookstack/cache/services.php
-        APP_PACKAGES_CACHE=/run/bookstack/cache/packages.php
-        APP_CONFIG_CACHE=/run/bookstack/cache/config.php
-        APP_ROUTES_CACHE=/run/bookstack/cache/routes-v7.php
-        APP_EVENTS_CACHE=/run/bookstack/cache/events.php
-        ${optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "SESSION_SECURE_COOKIE=true"}
-        ${toString cfg.extraConfig}
-        " > "${cfg.dataDir}/.env"
+        install -T -m 0600 -o ${user} ${bookstackEnv} "${cfg.dataDir}/.env"
+        ${secretReplacements}
+        if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
+            sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
+        fi
 
         # migrate db
         ${pkgs.php}/bin/php artisan migrate --force

From 617f6e0a8b3f2411db670a50ca8af0743e8f0af7 Mon Sep 17 00:00:00 2001
From: sudosubin <sudosubin@gmail.com>
Date: Wed, 19 Jan 2022 00:16:39 +0900
Subject: [PATCH 32/34] pipenv: refact to use installShellCompletion

---
 pkgs/development/tools/pipenv/default.nix | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/tools/pipenv/default.nix b/pkgs/development/tools/pipenv/default.nix
index c9590c7fa5ee..9d2d9b3962c0 100644
--- a/pkgs/development/tools/pipenv/default.nix
+++ b/pkgs/development/tools/pipenv/default.nix
@@ -1,5 +1,6 @@
 { lib
 , python3
+, installShellFiles
 }:
 
 with python3.pkgs;
@@ -27,6 +28,8 @@ in buildPythonApplication rec {
 
   LC_ALL = "en_US.UTF-8";
 
+  nativeBuildInputs = [ installShellFiles ];
+
   postPatch = ''
     # pipenv invokes python in a subprocess to create a virtualenv
     # and to call setup.py.
@@ -39,14 +42,10 @@ in buildPythonApplication rec {
   propagatedBuildInputs = runtimeDeps python3.pkgs;
 
   postInstall = ''
-    mkdir -p "$out/share/bash-completion/completions"
-    _PIPENV_COMPLETE=bash_source "$out/bin/pipenv" > "$out/share/bash-completion/completions/pipenv"
-
-    mkdir -p "$out/share/zsh/vendor-completions"
-    _PIPENV_COMPLETE=zsh_source "$out/bin/pipenv" > "$out/share/zsh/vendor-completions/_pipenv"
-
-    mkdir -p "$out/share/fish/vendor_completions.d"
-    _PIPENV_COMPLETE=fish_source "$out/bin/pipenv" > "$out/share/fish/vendor_completions.d/pipenv.fish"
+    installShellCompletion --cmd pipenv \
+      --bash <(_PIPENV_COMPLETE=bash_source $out/bin/pipenv) \
+      --zsh <(_PIPENV_COMPLETE=zsh_source $out/bin/pipenv) \
+      --fish <(_PIPENV_COMPLETE=fish_source $out/bin/pipenv)
   '';
 
   doCheck = true;

From 91cc0cf63bc9959f9cdcc60ab15cf2eae6d870b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@dev.si>
Date: Tue, 18 Jan 2022 16:49:18 +0100
Subject: [PATCH 33/34] Update
 nixos/modules/services/system/cachix-agent/default.nix

Co-authored-by: pennae <82953136+pennae@users.noreply.github.com>
---
 nixos/modules/services/system/cachix-agent/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/system/cachix-agent/default.nix b/nixos/modules/services/system/cachix-agent/default.nix
index 67707e1483b7..496e0b90355b 100644
--- a/nixos/modules/services/system/cachix-agent/default.nix
+++ b/nixos/modules/services/system/cachix-agent/default.nix
@@ -42,7 +42,7 @@ in {
   config = mkIf cfg.enable {
     systemd.services.cachix-agent = {
       description = "Cachix Deploy Agent";
-      after = ["network.target"];
+      after = ["network-online.target"];
       path = [ config.nix.package ];
       wantedBy = [ "multi-user.target" ];
       # don't restart while changing

From 87fb0aed8561aaf14fcedbc8d03af8178f0b9b47 Mon Sep 17 00:00:00 2001
From: AndersonTorres <torres.anderson.85@protonmail.com>
Date: Fri, 14 Jan 2022 20:05:23 -0300
Subject: [PATCH 34/34] all-packages.nix: reformat some expressions

More specifically, moving the games to the `###GAMES` section, and moving the
non-games out of it.
---
 pkgs/top-level/all-packages.nix | 106 ++++++++++++++++----------------
 1 file changed, 53 insertions(+), 53 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e8ae72acf459..82c5c6fe3dee 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30263,6 +30263,22 @@ with pkgs;
 
   drumkv1 = libsForQt5.callPackage ../applications/audio/drumkv1 { };
 
+  gshhg-gmt = callPackage ../applications/gis/gmt/gshhg.nix { };
+
+  eureka-editor = callPackage ../applications/misc/eureka-editor { };
+
+  eureka-ideas = callPackage ../applications/misc/eureka-ideas {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
+  fava = callPackage ../applications/office/fava {};
+
+  nux = callPackage ../tools/misc/nux { };
+
+  tts = callPackage ../tools/audio/tts { };
+
+  fslint = callPackage ../applications/misc/fslint { };
+
   ### GAMES
 
   _1oom = callPackage ../games/1oom { };
@@ -30285,7 +30301,7 @@ with pkgs;
 
   blockattack = callPackage ../games/blockattack { } ;
 
-  colobot = callPackage ../games/colobot {};
+  colobot = callPackage ../games/colobot { };
 
   doom-bcc = callPackage ../games/zdoom/bcc-git.nix { };
 
@@ -30380,7 +30396,7 @@ with pkgs;
   amoeba = callPackage ../games/amoeba { };
   amoeba-data = callPackage ../games/amoeba/data.nix { };
 
-  andyetitmoves = callPackage ../games/andyetitmoves {};
+  andyetitmoves = callPackage ../games/andyetitmoves { };
 
   angband = callPackage ../games/angband { };
 
@@ -30393,7 +30409,7 @@ with pkgs;
 
   armagetronad-dedicated = callPackage ../games/armagetronad { dedicatedServer = true; };
 
-  arena = callPackage ../games/arena {};
+  arena = callPackage ../games/arena { };
 
   arx-libertatis = libsForQt5.callPackage ../games/arx-libertatis { };
 
@@ -30407,17 +30423,17 @@ with pkgs;
 
   astromenace = callPackage ../games/astromenace { };
 
-  atanks = callPackage ../games/atanks {};
+  atanks = callPackage ../games/atanks { };
 
-  azimuth = callPackage ../games/azimuth {};
+  azimuth = callPackage ../games/azimuth { };
 
   ballAndPaddle = callPackage ../games/ball-and-paddle {
     guile = guile_1_8;
   };
 
-  banner = callPackage ../games/banner {};
+  banner = callPackage ../games/banner { };
 
-  bastet = callPackage ../games/bastet {};
+  bastet = callPackage ../games/bastet { };
 
   black-hole-solver = callPackage ../games/black-hole-solver {
     inherit (perlPackages) PathTiny;
@@ -30502,12 +30518,12 @@ with pkgs;
   inherit (import ../games/crossfire pkgs)
     crossfire-server crossfire-arch crossfire-maps crossfire-client;
 
-  crrcsim = callPackage ../games/crrcsim {};
+  crrcsim = callPackage ../games/crrcsim { };
 
   curseofwar = callPackage ../games/curseofwar { SDL = null; };
   curseofwar-sdl = callPackage ../games/curseofwar { ncurses = null; };
 
-  cutemaze = libsForQt5.callPackage ../games/cutemaze {};
+  cutemaze = libsForQt5.callPackage ../games/cutemaze { };
 
   cuyo = callPackage ../games/cuyo { };
 
@@ -30522,7 +30538,7 @@ with pkgs;
     };
   };
 
-  dhewm3 = callPackage ../games/dhewm3 {};
+  dhewm3 = callPackage ../games/dhewm3 { };
 
   domination = callPackage ../games/domination { };
 
@@ -30570,12 +30586,6 @@ with pkgs;
 
   eternity = callPackage ../games/eternity-engine { };
 
-  eureka-editor = callPackage ../applications/misc/eureka-editor { };
-
-  eureka-ideas = callPackage ../applications/misc/eureka-ideas {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   extremetuxracer = callPackage ../games/extremetuxracer {
     libpng = libpng12;
   };
@@ -30604,13 +30614,11 @@ with pkgs;
 
   factorio-utils = callPackage ../games/factorio/utils.nix { };
 
-  fairymax = callPackage ../games/fairymax {};
+  fairymax = callPackage ../games/fairymax { };
 
-  fava = callPackage ../applications/office/fava {};
+  fheroes2 = callPackage ../games/fheroes2 { };
 
-  fheroes2 = callPackage ../games/fheroes2 {};
-
-  fish-fillets-ng = callPackage ../games/fish-fillets-ng {};
+  fish-fillets-ng = callPackage ../games/fish-fillets-ng { };
 
   fishfight = callPackage ../games/fishfight {
     inherit (xorg) libX11 libXi;
@@ -30656,8 +30664,6 @@ with pkgs;
     };
   };
 
-  fslint = callPackage ../applications/misc/fslint {};
-
   galaxis = callPackage ../games/galaxis { };
 
   gambatte = callPackage ../games/gambatte { };
@@ -30676,9 +30682,9 @@ with pkgs;
 
   gemrb = callPackage ../games/gemrb { };
 
-  gimx = callPackage ../games/gimx {};
+  gimx = callPackage ../games/gimx { };
 
-  gl117 = callPackage ../games/gl-117 {};
+  gl117 = callPackage ../games/gl-117 { };
 
   globulation2 = callPackage ../games/globulation {
     boost = boost155;
@@ -30704,13 +30710,11 @@ with pkgs;
 
   gnushogi = callPackage ../games/gnushogi { };
 
-  gogui = callPackage ../games/gogui {};
+  gogui = callPackage ../games/gogui { };
 
-  gscrabble = python3Packages.callPackage ../games/gscrabble {};
+  gscrabble = python3Packages.callPackage ../games/gscrabble { };
 
-  gshogi = python3Packages.callPackage ../games/gshogi {};
-
-  gshhg-gmt = callPackage ../applications/gis/gmt/gshhg.nix { };
+  gshogi = python3Packages.callPackage ../games/gshogi { };
 
   qtads = qt5.callPackage ../games/qtads { };
 
@@ -30724,7 +30728,7 @@ with pkgs;
 
   gtypist = callPackage ../games/gtypist { };
 
-  gweled = callPackage ../games/gweled {};
+  gweled = callPackage ../games/gweled { };
 
   gzdoom = callPackage ../games/gzdoom { };
 
@@ -30772,7 +30776,7 @@ with pkgs;
     enableGPU = false;
   };
 
-  klavaro = callPackage ../games/klavaro {};
+  klavaro = callPackage ../games/klavaro { };
 
   kobodeluxe = callPackage ../games/kobodeluxe { };
 
@@ -30794,7 +30798,7 @@ with pkgs;
 
   liberation-circuit = callPackage ../games/liberation-circuit { };
 
-  lincity = callPackage ../games/lincity {};
+  lincity = callPackage ../games/lincity { };
 
   lincity_ng = callPackage ../games/lincity/ng.nix {
     # https://github.com/lincity-ng/lincity-ng/issues/25
@@ -30808,7 +30812,7 @@ with pkgs;
   liquidwar5 = callPackage ../games/liquidwar/5.nix {
   };
 
-  lugaru = callPackage ../games/lugaru {};
+  lugaru = callPackage ../games/lugaru { };
 
   macopix = callPackage ../games/macopix {
     gtk = gtk2;
@@ -30820,7 +30824,7 @@ with pkgs;
 
   mars = callPackage ../games/mars { };
 
-  megaglest = callPackage ../games/megaglest {};
+  megaglest = callPackage ../games/megaglest { };
 
   methane = callPackage ../games/methane { };
 
@@ -30843,7 +30847,7 @@ with pkgs;
   minecraftServers = import ../games/minecraft-servers { inherit callPackage lib javaPackages; };
   minecraft-server = minecraftServers.vanilla; # backwards compatibility
 
-  moon-buggy = callPackage ../games/moon-buggy {};
+  moon-buggy = callPackage ../games/moon-buggy { };
 
   inherit (callPackages ../games/minetest {
     inherit (darwin) libiconv;
@@ -30889,8 +30893,6 @@ with pkgs;
 
   nexuiz = callPackage ../games/nexuiz { };
 
-  nux = callPackage ../tools/misc/nux { };
-
   ninvaders = callPackage ../games/ninvaders { };
 
   njam = callPackage ../games/njam { };
@@ -30927,7 +30929,7 @@ with pkgs;
 
   portmod = callPackage ../games/portmod { };
 
-  tlauncher = callPackage ../games/tlauncher {};
+  tlauncher = callPackage ../games/tlauncher { };
 
   tr-patcher = callPackage ../games/tr-patcher { };
 
@@ -30955,8 +30957,8 @@ with pkgs;
       static = true;
     };
   };
-  openttd-grfcodec = callPackage ../games/openttd/grfcodec.nix {};
-  openttd-nml = callPackage ../games/openttd/nml.nix {};
+  openttd-grfcodec = callPackage ../games/openttd/grfcodec.nix { };
+  openttd-nml = callPackage ../games/openttd/nml.nix { };
 
   opentyrian = callPackage ../games/opentyrian { };
 
@@ -30978,7 +30980,7 @@ with pkgs;
 
   pinball = callPackage ../games/pinball { };
 
-  pingus = callPackage ../games/pingus {};
+  pingus = callPackage ../games/pingus { };
 
   pioneer = callPackage ../games/pioneer { };
 
@@ -31022,7 +31024,7 @@ with pkgs;
   ioquake3 = callPackage ../games/quake3/ioquake { };
   quake3e = callPackage ../games/quake3/quake3e { };
 
-  quantumminigolf = callPackage ../games/quantumminigolf {};
+  quantumminigolf = callPackage ../games/quantumminigolf { };
 
   r2mod_cli = callPackage ../games/r2mod_cli { };
 
@@ -31073,7 +31075,7 @@ with pkgs;
     openjdk = openjdk8;
   };
 
-  sauerbraten = callPackage ../games/sauerbraten {};
+  sauerbraten = callPackage ../games/sauerbraten { };
 
   scid = callPackage ../games/scid {
     tcl = tcl-8_5;
@@ -31146,7 +31148,7 @@ with pkgs;
 
   ssl-cert-check = callPackage ../tools/admin/ssl-cert-check { };
 
-  stardust = callPackage ../games/stardust {};
+  stardust = callPackage ../games/stardust { };
 
   starspace = callPackage ../applications/science/machine-learning/starspace { };
 
@@ -31248,8 +31250,6 @@ with pkgs;
 
   tremulous = callPackage ../games/tremulous { };
 
-  tts = callPackage ../tools/audio/tts { };
-
   tumiki-fighters = callPackage ../games/tumiki-fighters { };
 
   tuxpaint = callPackage ../games/tuxpaint { };
@@ -31392,8 +31392,8 @@ with pkgs;
 
 
   xpilot-ng = callPackage ../games/xpilot { };
-  bloodspilot-server = callPackage ../games/xpilot/bloodspilot-server.nix {};
-  bloodspilot-client = callPackage ../games/xpilot/bloodspilot-client.nix {};
+  bloodspilot-server = callPackage ../games/xpilot/bloodspilot-server.nix { };
+  bloodspilot-client = callPackage ../games/xpilot/bloodspilot-client.nix { };
 
   xskat = callPackage ../games/xskat { };
 
@@ -31442,6 +31442,10 @@ with pkgs;
 
   _0verkill = callPackage ../games/0verkill { };
 
+  hhexen = callPackage ../games/hhexen { };
+
+  wyvern = callPackage ../games/wyvern { };
+
   ### DESKTOP ENVIRONMENTS
 
   cdesktopenv = callPackage ../desktops/cdesktopenv { };
@@ -31471,8 +31475,6 @@ with pkgs;
 
   gnome-tour = callPackage ../desktops/gnome/core/gnome-tour { };
 
-  hhexen = callPackage ../games/hhexen { };
-
   hsetroot = callPackage ../tools/X11/hsetroot { };
 
   imwheel = callPackage ../tools/X11/imwheel { };
@@ -33860,8 +33862,6 @@ with pkgs;
     wxGTK = wxGTK30;
   };
 
-  wyvern = callPackage ../games/wyvern { };
-
   x11idle = callPackage ../tools/misc/x11idle {};
 
   x11docker = callPackage ../applications/virtualization/x11docker { };