Merge branch 'master' into current

2026-05-02 14:15:12 +02:00
parent 336b261aff e8e5dcb060
commit 345bb99acb
3549 changed files with 115899 additions and 71229 deletions
@@ -551,7 +551,6 @@
              - pkgs/by-name/*/*tree-sitter*/**/*
              - pkgs/by-name/ne/neovim-unwrapped/treesitter-parsers.nix
              - pkgs/development/python-modules/*tree-sitter*/**/*
-              - pkgs/development/tools/parsing/tree-sitter/**/*

 "6.topic: updaters":
  - any:
@@ -49,7 +49,7 @@ jobs:

      - name: Create backport PRs
        id: backport
-        uses: korthout/backport-action@3c06f323a58619da1e8522229ebc8d5de2633e46 # v4.3.0
+        uses: korthout/backport-action@ad30f01dbe543be4a24431001c38f3617af8c745 # v4.4.0
        with:
          # Config README: https://github.com/korthout/backport-action#backport-action
          add_author_as_reviewer: true
@@ -62,7 +62,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
        with:
          # Sandbox is disabled on MacOS by default.
          extra_nix_config: sandbox = true
@@ -120,7 +120,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
        continue-on-error: true
@@ -132,7 +132,7 @@ jobs:
            core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)

      - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - name: Load supported versions
        id: versions
@@ -180,7 +180,7 @@ jobs:
          target-as-trusted-at: ${{ inputs.targetSha }}

      - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
        continue-on-error: true
@@ -270,7 +270,7 @@ jobs:
          merge-multiple: true

      - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - name: Combine all output paths and eval stats
        run: |
@@ -465,7 +465,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

      - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - name: Ensure flake outputs on all systems still evaluate
        run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'
@@ -35,7 +35,7 @@ jobs:
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
      # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
        continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5

      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
        continue-on-error: true
@@ -475,11 +475,12 @@ nixos/tests/incus/                      @adamcstephens
 pkgs/by-name/in/incus/                  @adamcstephens
 pkgs/by-name/lx/lxc*                    @adamcstephens

-# Flutter
+# ExpidusOS, Flutter
 /pkgs/development/compilers/flutter @RossComputerGuy
+/pkgs/desktops/expidus              @RossComputerGuy

 # GNU Tar & Zip
-/pkgs/tools/archivers/gnutar        @RossComputerGuy
+/pkgs/by-name/gn/gnutar        @RossComputerGuy
 /pkgs/by-name/zi/zip           @RossComputerGuy

 # SELinux
@@ -188,12 +188,7 @@ let
            kernel: rebuilds: lib.nameValuePair "10.rebuild-${kernel}-stdenv" (lib.elem "stdenv" rebuilds)
          ) rebuildsByKernel
          // {
-            "10.rebuild-nixos-tests" =
-              lib.elem "nixosTests.simple" (extractPackageNames diffAttrs.rebuilds)
-              &&
-                # Only set this label when no other label with indication for staging has been set.
-                # This avoids confusion whether to target staging or batch this with kernel updates.
-                lib.last (lib.sort lib.lessThan (lib.attrValues rebuildCountByKernel)) <= 500;
+            "10.rebuild-nixos-tests" = lib.elem "nixosTests.simple" (extractPackageNames diffAttrs.rebuilds);
          };
      }
    );
@@ -66,8 +66,9 @@ function runChecklist({
    if (allByName) {
      // We can only determine the below, if all packages are in by-name, since
      // we can't reliably relate changed files to packages outside by-name.
-      checklist[`${user.login} is a maintainer of all touched packages.`] =
-        eligible.has(user.id)
+      checklist[
+        `${user.login} is a maintainer of all touched packages on the ${pull_request.base.ref} branch.`
+      ] = eligible.has(user.id)
    }
  } else {
    // This is only used when no user is passed, i.e. for labeling.
@@ -920,14 +920,14 @@ respectively. Otherwise, the fetcher uses `fetchzip`.

 This is used with Radicle repositories. The arguments expected are similar to `fetchgit`.

-Requires a `seed` argument (e.g. `seed.radicle.xyz` or `rosa.radicle.xyz`) and a `repo` argument
+Requires a `seed` argument (e.g. `seed.radicle.dev` or `rosa.radicle.network`) and a `repo` argument
 (the repository id *without* the `rad:` prefix). Also accepts an optional `node` argument which
 contains the id of the node from which to fetch the specified ref. If `node` is `null` (the
 default), a canonical ref is fetched instead.

 ```nix
 fetchFromRadicle {
-  seed = "seed.radicle.xyz";
+  seed = "seed.radicle.dev";
  repo = "z3gqcJUoA1n9HaHKufZs5FCSGazv5"; # heartwood
  tag = "releases/1.3.0";
  hash = "sha256-4o88BWKGGOjCIQy7anvzbA/kPOO+ZsLMzXJhE61odjw=";
@@ -942,7 +942,7 @@ contains the full revision id of the Radicle patch to fetch.

 ```nix
 fetchRadiclePatch {
-  seed = "rosa.radicle.xyz";
+  seed = "rosa.radicle.network";
  repo = "z4V1sjrXqjvFdnCUbxPFqd5p4DtH5"; # radicle-explorer
  revision = "d97d872386c70607beda2fb3fc2e60449e0f4ce4"; # patch: d77e064
  hash = "sha256-ttnNqj0lhlSP6BGzEhhUOejKkkPruM9yMwA5p9Di4bk=";
@@ -3,6 +3,7 @@
 This chapter describes several special build helpers.

 ```{=include=} sections
+special/buildenv.section.md
 special/fakenss.section.md
 special/fhs-environments.section.md
 special/makesetuphook.section.md
@@ -0,0 +1,101 @@
+# buildEnv {#sec-buildEnv}
+
+`buildEnv` constructs a derivation containing directories and symbolic links, which resembles the profile layout where a list of derivations or store paths are installed.
+
+Unlike [`symlinkJoin`](#trivial-builder-symlinkJoin), `buildEnv` takes special care of the outputs to link and checks for content collisions across the paths by default.
+A common use case for `buildEnv` is constructing environment wrappers, such as an interpreter with modules or a program with extensions.
+For example, [`python.withPackage`](#attributes-on-interpreters-packages) is based on `buildEnv`.
+
+## Arguments {#sec-buildEnv-arguments}
+
+`buildEnv` takes [fixed-point arguments (`buildEnv (finalAttrs: { })`)](#chap-build-helpers-finalAttrs) as well as a plain attribute set.
+
+Unless otherwise noted, arguments can be overridden directly using [`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs).
+
+`buildEnv` enforces [structured attributes (`{ __structuredAttrs = true; }`)](https://nix.dev/manual/nix/2.18/language/advanced-attributes.html#adv-attr-structuredAttrs).
+
+- `name` or `pname` and `version` (required):
+    The name of the environment.
+
+- `paths` (required):
+    The derivations or store paths to symlink ("install").
+
+    The elements can be any path-like object that string-interpolates to a store path.
+    The priority of each path is taken from `<path>.meta.priority` and falls back to `lib.meta.defaultPriority` if not set.
+
+    The argument `paths` is passed as attribute `passthru.paths` to prevent unexpected context pollution.
+    `passthru.paths` can be overridden with `<pkg>.overrideAttrs`.
+
+-   `extraOutputsToInstall` (default to `[ ]`):
+    Package outputs to include in addition to what `meta.outputsToInstall` specifies.
+
+-   `includeClosures` (default to `false`):
+    Whether to include closures of all input paths.
+    The list of the closure paths are constructed with `writeClosure`.
+    They are installed with lower priority and with build-time exceptions silenced.
+
+-   `extraPrefix` (default to `""`):
+    Root the result in directory `"$out${extraPrefix}"`, e.g. `"/share"`.
+
+-   `ignoreCollisions` (default: `false`):
+    Don't fail the build upon content collisions.
+
+-   `checkCollisionContents` (default: `true`):
+    If there is a collision, check whether the contents and permissions match; and only if not, throw a collision error.
+
+-   `ignoreSingleFileOutputs` (default: `false`):
+    Don't fail the build upon single-file outputs.
+
+-   `manifest` (default: `""`):
+    The manifest file (if any). A symlink `$out/manifest` will be created to it.
+
+-   `pathsToLink` (default: `[ "/" ]`):
+    The paths (relative to each element of `paths`) that we want to symlink (e.g., `["/bin"]`).
+    Any file outside the directories in this list won't be symlinked into the produced environment.
+
+-   `postBuild` (default: `""`):
+    Shell commands to run after building the symlink tree.
+
+-   `passthru` and `meta` (default: `{ }`):
+    `stdenv.mkDerivation`-supported attributes not passing down to `builtins.derivation`.
+
+-   `derivationArgs` (default: `{ }`):
+    Additional `stdenv.mkDerivation` arguments, such as `nativeBuildInputs`/`buildInputs` for `postBuild` dependencies and setup hooks.
+
+    `derivationArgs` is not passed down to `stdenv.mkDerivation`.
+    Override its attributes directly via `<pkg>.overrideAttrs` and reference directly via `finalAttrs`.
+
+## Build-time exceptions {#sec-buildEnv-exceptions}
+
+There are situations where the specified `paths` might not produce sensible profile layout.
+By default, the builder fails early upon detecting these exceptions.
+`buildEnv` provides arguments to fine-tune or ignore certain exceptions.
+
+### Path collisions {#ssec-buildEnv-collisions}
+
+Path collisions occur when files provided by two more output paths with the same priority overlap with each other, making the result profile layout potentially affected by the order of elements of `paths`.
+This is undesirable in several use cases, such as when `paths` are determined by merging Nix modules.
+
+If the argument `checkCollisionContents` is `true`, the builder checks whether the overlapping paths share the same content and mode, and fails only if not.
+
+The argument `ignoreCollisions` silence the collision checks and allow the files to be overwritten based on the order of chosen output paths.
+
+In addition to silencing this exception with `ignoreCollisions`, one can also adjust the priority of colliding packages and store paths.
+Store paths can specify priority in the form
+
+```nix
+{
+  outPath = <path>;
+  meta.priority = <priority>;
+}
+```
+
+And [`lib.meta.setPrio`](#function-library-lib.meta.setPrio)-related Nixpkgs Library functions also apply to a string-like attribute set (`{ outPath = <path>; }`).
+
+### Single-file outputs {#ssec-buildEnv-singleFileOutputs}
+
+When an output path provides a single file instead of a directory, it inherently cannot merge into the result layout.
+All discoverable packages should configure their `meta.outputsToInstall` correctly, so that single-file outputs won't be installed into a profile.
+
+Set `ignoreSingleFileOutputs` to `true` to drop all single-file output paths silently.
+This option is useful when the specified paths contain the output paths of package tests.
@@ -13,7 +13,7 @@ Primarily made for a multi-language environment.

 #### `npmDeps` {#npm-config-hook-deps}

-Derivation that contains the NPM package dependencies.
+Derivation that contains the npm package dependencies.
 Usually built with `fetchNpmDeps`.
 This attribute is required or the hook will abort the build.

@@ -93,7 +93,7 @@ there are 3 steps: frontend dependencies (javascript), backend dependencies (eli

 ##### mixRelease - Frontend dependencies (javascript) {#mix-release-javascript-deps}

-For phoenix projects, inside of Nixpkgs you can either use yarn2nix (mkYarnModule) or node2nix. An example with yarn2nix can be found [here](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix#L39). An example with node2nix will follow. To package something outside of nixpkgs, you have alternatives like [npmlock2nix](https://github.com/nix-community/npmlock2nix) or [nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage)
+For phoenix projects, inside of Nixpkgs you can either use `fetchYarnDeps` or `buildNpmPackage`. An example with `fetchYarnDeps` can be found [here](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pl/plausible/package.nix). An example with `fetchYarnDeps` will follow. To package something outside of nixpkgs, you have alternatives like [npmlock2nix](https://github.com/nix-community/npmlock2nix) or [nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage)

 ##### mixRelease - backend dependencies (mix) {#mix-release-mix-deps}

@@ -45,17 +45,14 @@ If a particular lock file is present, it is a strong indication of which package

 It's better to try to use a Nix tool that understands the lock file.
 Using a different tool might give you a hard-to-understand error because different packages have been installed.
-An example of problems that could arise can be found [here](https://github.com/NixOS/nixpkgs/pull/126629).
-Upstream use npm, but this is an attempt to package it with `yarn2nix` (that uses yarn.lock).

 Using a different tool forces you to commit a lock file to the repository.
 These files are fairly large, so when packaging for nixpkgs, this approach does not scale well.

 Exceptions to this rule are:

- When you encounter one of the bugs from a Nix tool. In each of the tool-specific instructions, known problems will be detailed. If you have a problem with a particular tool, then it's best to try another tool, even if this means you will have to re-create a lock file and commit it to Nixpkgs. In general `yarn2nix` has fewer known problems, and so a simple search in Nixpkgs will reveal many `yarn.lock` files committed.
+- When you encounter one of the bugs from a Nix tool. In each of the tool-specific instructions, known problems will be detailed. If you have a problem with a particular tool, then it's best to try another tool, even if this means you will have to re-create a lock file and commit it to Nixpkgs.
 - Some lock files contain particular version of a package that has been pulled off npm for some reason. In that case, you can recreate upstream lock (by removing the original and `npm install`, `yarn`, ...) and commit this to nixpkgs.
- The only tool that supports workspaces (a feature of npm that helps manage sub-directories with different package.json from a single top level package.json) is `yarn2nix`. If upstream has workspaces you should try `yarn2nix`.

 ### Try to use upstream package.json {#javascript-upstream-package-json}

@@ -92,7 +89,7 @@ Exceptions to this rule are:
 Each tool has an abstraction to just build the node_modules (dependencies) directory.
 You can always use the `stdenv.mkDerivation` with the node_modules to build the package (symlink the node_modules directory and then use the package build command).
 The node_modules abstraction can be also used to build some web framework frontends.
-For an example of this see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix) is built. `mkYarnModules` to make the derivation containing node_modules.
+For an example of this see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pl/plausible/package.nix) is built.
 Then when building the frontend you can just symlink the node_modules directory.

 ## Tool-specific instructions {#javascript-tool-specific}
@@ -486,40 +483,29 @@ In this example, `prePnpmInstall` will be run by both `pnpmConfigHook` and by th

 #### pnpm `fetcherVersion` {#javascript-pnpm-fetcherVersion}

-This is the version of the output of `fetchPnpmDeps`, if you haven't set it already, you can use `1` with your current hash:
+This is the version of the output of `fetchPnpmDeps`. New packages should use `3`:

 ```nix
 {
  # ...
  pnpmDeps = fetchPnpmDeps {
    # ...
-    fetcherVersion = 1;
-    hash = "..."; # you can use your already set hash here
-  };
-}
-```
-
-After upgrading to a newer `fetcherVersion`, you need to regenerate the hash:
-
-```nix
-{
-  # ...
-  pnpmDeps = fetchPnpmDeps {
-    # ...
-    fetcherVersion = 2;
+    fetcherVersion = 3;
    hash = "..."; # clear this hash and generate a new one
  };
 }
 ```

+When upgrading to a newer `fetcherVersion`, you need to regenerate the hash.
+
 This variable ensures that we can make changes to the output of `fetchPnpmDeps` without breaking existing hashes.
 Changes can include workarounds or bug fixes to existing PNPM issues.

 ##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}

- 1: Initial version, nothing special
+- 1: Initial version, nothing special. **Deprecated: Scheduled for removal in the 26.11 release.**. New packages must not use this value.
 - 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975)
- 3: [Build a reproducible tarball](https://github.com/NixOS/nixpkgs/pull/469950)
+- 3: [Build a reproducible tarball](https://github.com/NixOS/nixpkgs/pull/469950). **Recommended**

 ### Yarn {#javascript-yarn}

@@ -598,139 +584,6 @@ To install the package `yarnInstallHook` uses both `npm` and `yarn` to cleanup p

 - `yarnKeepDevDeps`: Disables the removal of devDependencies from `node_modules` before installation.

-#### yarn2nix {#javascript-yarn2nix}
-
-> [!WARNING]
-> The `yarn2nix` functions have been deprecated in favor of `yarnConfigHook`, `yarnBuildHook` and `yarnInstallHook` (for Yarn v1) and `yarn-berry_*.*` tooling (Yarn v3 and v4). Documentation for `yarn2nix` functions still appears here for the sake of the packages that still use them. See also a tracking issue [#324246](https://github.com/NixOS/nixpkgs/issues/324246).
-
-##### Preparation {#javascript-yarn2nix-preparation}
-
-You will need at least a `yarn.lock` file. If upstream does not have one you need to generate it and reference it in your package definition.
-
-If the downloaded files contain the `package.json` and `yarn.lock` files they can be used like this:
-
-```nix
-{
-  offlineCache = fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
-    hash = "....";
-  };
-}
-```
-
-##### mkYarnPackage {#javascript-yarn2nix-mkYarnPackage}
-
-> [!WARNING]
-> The `mkYarnPackage` functions have been deprecated in favor of `yarnConfigHook`, `yarnBuildHook` and `yarnInstallHook` (for Yarn v1) and `yarn-berry_*.*` tooling (Yarn v3 and v4). Documentation for `mkYarnPackage` functions still appears here for the sake of the packages that still use them. See also a tracking issue [#324246](https://github.com/NixOS/nixpkgs/issues/324246).
-
-`mkYarnPackage` will by default try to generate a binary. For packages only generating static assets (Svelte, Vue, React, Webpack, ...), you will need to explicitly override the build step with your instructions.
-
-It's important to use the `--offline` flag. For example if you script is `"build": "something"` in `package.json` use:
-
-```nix
-{
-  nativeBuildInputs = [ writableTmpDirAsHomeHook ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    yarn --offline build
-
-    runHook postBuild
-  '';
-}
-```
-
-The `distPhase` is packing the package's dependencies in a tarball using `yarn pack`. You can disable it using:
-
-```nix
-{ doDist = false; }
-```
-
-The configure phase can sometimes fail because it makes many assumptions that may not always apply. One common override is:
-
-```nix
-{
-  configurePhase = ''
-    runHook preConfigure
-
-    ln -s $node_modules node_modules
-
-    runHook postConfigure
-  '';
-}
-```
-
-or if you need a writeable node_modules directory:
-
-```nix
-{
-  configurePhase = ''
-    runHook preConfigure
-
-    cp -r $node_modules node_modules
-    chmod +w node_modules
-
-    runHook postConfigure
-  '';
-}
-```
-
-##### mkYarnModules {#javascript-yarn2nix-mkYarnModules}
-
-This will generate a derivation including the `node_modules` directory.
-If you have to build a derivation for an integrated web framework (Rails, Phoenix, etc.), this is probably the easiest way.
-
-#### Overriding dependency behavior {#javascript-mkYarnPackage-overriding-dependencies}
-
-In the `mkYarnPackage` record the property `pkgConfig` can be used to override packages when you encounter problems building.
-
-For instance, say your package is throwing errors when trying to invoke node-sass:
-
-```
-ENOENT: no such file or directory, scandir '/build/source/node_modules/node-sass/vendor'
-```
-
-To fix this we will specify different versions of build inputs to use, as well as some post install steps to get the software built the way we want:
-
-```nix
-mkYarnPackage rec {
-  pkgConfig = {
-    node-sass = {
-      buildInputs = with final; [
-        python
-        libsass
-        pkg-config
-      ];
-      postInstall = ''
-        LIBSASS_EXT=auto yarn --offline run build
-        rm build/config.gypi
-      '';
-    };
-  };
-}
-```
-
-##### Pitfalls {#javascript-yarn2nix-pitfalls}
-
- If version is missing from upstream package.json, yarn will silently install nothing. In that case, you will need to override package.json as shown in the [package.json section](#javascript-upstream-package-json)
- Having trouble with `node-gyp`? Try adding these lines to the `yarnPreBuild` steps:
-
-  ```nix
-  {
-    yarnPreBuild = ''
-      mkdir -p $HOME/.node-gyp/${nodejs.version}
-      echo 9 > $HOME/.node-gyp/${nodejs.version}/installVersion
-      ln -sfv ${nodejs}/include $HOME/.node-gyp/${nodejs.version}
-      export npm_config_nodedir=${nodejs}
-    '';
-  }
-  ```
-
-  - The `echo 9` steps comes from this answer: <https://stackoverflow.com/a/49139496>
-  - Exporting the headers in `npm_config_nodedir` comes from this issue: <https://github.com/nodejs/node-gyp/issues/1191#issuecomment-301243919>
- `offlineCache` (described [above](#javascript-yarn2nix-preparation)) must be specified to avoid [Import From Derivation](#ssec-import-from-derivation) (IFD) when used inside Nixpkgs.
-
 #### Yarn Berry v3/v4 {#javascript-yarn-v3-v4}
 Yarn Berry (v3 / v4) have similar formats, they start with blocks like these:

@@ -17,14 +17,14 @@ Consider the following package:
  maven,
 }:

-maven.buildMavenPackage rec {
+maven.buildMavenPackage (finalAttrs: {
  pname = "jd-cli";
  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "intoolswetrust";
    repo = "jd-cli";
-    tag = "jd-cli-${version}";
+    tag = "jd-cli-${finalAttrs.version}";
    hash = "sha256-rRttA5H0A0c44loBzbKH7Waoted3IsOgxGCD2VM0U/Q=";
  };

@@ -50,7 +50,7 @@ maven.buildMavenPackage rec {
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ majiir ];
  };
-}
+})
 ```

 This package calls `maven.buildMavenPackage` to do its work. The primary difference from `stdenv.mkDerivation` is the `mvnHash` variable, which is a hash of all of the Maven dependencies.
@@ -133,7 +133,7 @@ step 2 which will most probably fail the build. The `go-offline` plugin cannot
 handle these so-called [dynamic dependencies](https://github.com/qaware/go-offline-maven-plugin?tab=readme-ov-file#dynamic-dependencies).
 In that case you must add these dynamic dependencies manually with:
 ```nix
-maven.buildMavenPackage rec {
+maven.buildMavenPackage {
  manualMvnArtifacts = [
    # add dynamic test dependencies here
    "org.apache.maven.surefire:surefire-junit-platform:3.1.2"
@@ -115,6 +115,25 @@ patch those plugins but expose the necessary configuration under
 `PLUGIN.passthru.initLua` for neovim plugins. For instance, the `unicode-vim` plugin
 needs the path towards a unicode database so we expose the following snippet `vim.g.Unicode_data_directory="${self.unicode-vim}/autoload/unicode"` under `vimPlugins.unicode-vim.passthru.initLua`.

+### Plugin license overrides {#neovim-plugin-license-overrides}
+
+Generated Vim and Neovim plugins get their `meta.license` from GitHub license metadata when possible.
+Some upstream repositories do not expose a license file that GitHub can detect, or only mention the license in a README.
+In those cases, add a manual `meta.license` override in [overrides.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/overrides.nix).
+
+For example, if upstream documents that a plugin uses the Vim license but GitHub does not detect it:
+
+```nix
+{
+  foo-nvim = super.foo-nvim.overrideAttrs (old: {
+    meta = old.meta // {
+      # README says this plugin is distributed under the Vim license.
+      license = lib.licenses.vim;
+    };
+  });
+}
+```
+
 ## LuaRocks based plugins {#neovim-luarocks-based-plugins}

 In order to automatically handle plugin dependencies, several Neovim plugins
@@ -214,12 +214,6 @@ code, while others choose not to.

 In Nix, there are multiple approaches to building a Composer-based project.

-::: {.warning}
-`buildComposerProject2` has a [known bug](https://github.com/NixOS/nixpkgs/issues/451395)
-where the `vendorHash` changes every time a Composer release happens that changes the
-`autoload.php` or vendored composer code.
-:::
-
 One such method is the `php.buildComposerProject2` helper function, which serves
 as a wrapper around `mkDerivation`.

@@ -207,6 +207,62 @@ following are specific to `buildPythonPackage`:
 * `setupPyGlobalFlags ? []`: List of flags passed to `setup.py` command.
 * `setupPyBuildFlags ? []`: List of flags passed to `setup.py build_ext` command.

+##### Using fixed-point arguments {#buildpythonpackage-fixed-point-arguments}
+
+Both `buildPythonPackage` and `buildPythonApplication` support [fixed-point arguments](#chap-build-helpers-finalAttrs), similar to `stdenv.mkDerivation`.
+This allows you to reference the final attributes of the derivation.
+
+Instead of using `rec`:
+
+```nix
+buildPythonPackage rec {
+  pname = "pyspread";
+  version = "2.4";
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-...";
+  };
+}
+```
+
+You can use the `finalAttrs` pattern:
+
+```nix
+buildPythonPackage (finalAttrs: {
+  pname = "pyspread";
+  version = "2.4";
+  src = fetchPypi {
+    pname = "pyspread";
+    inherit (finalAttrs) version;
+    hash = "sha256-...";
+  };
+})
+```
+
+See the [general documentation on fixed-point arguments](#chap-build-helpers-finalAttrs) for more details on the benefits of this pattern.
+
+::: {.note}
+
+Some `buildPythonPackage`/`buildPythonApplication` arguments are passed down indirectly to `stdenv.mkDerivation` via `passthru`.
+Therefore the final state of these attributes can be accessed via `finalAttrs.passthru.${name}`.
+[`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs) can override them using the `passthru = prevAttrs.passthru // { foo = "bar"; }` pattern.
+Such arguments include:
+
+- `disabled`
+- `pyproject`
+- `format`
+- `build-system`
+- `dependencies`
+- `optional-dependencies`
+
+<!--
+TODO(@doronbehar): When `.overridePythonAttrs` will be removed, the above text might need to be revised. See:
+
+- https://github.com/NixOS/nixpkgs/pull/379637
+- https://github.com/NixOS/nixpkgs/pull/469804
+-->
+:::
+
 The [`stdenv.mkDerivation`](#sec-using-stdenv) function accepts various parameters for describing
 build inputs (see "Specifying dependencies"). The following are of special
 interest for Python packages, either because these are primarily used, or
@@ -237,29 +293,23 @@ the overrides for packages in the package set.
 ```nix
 with import <nixpkgs> { };

-(
-  let
-    python =
-      let
-        packageOverrides = self: super: {
-          pandas = super.pandas.overridePythonAttrs (old: rec {
-            version = "0.19.1";
-            src = fetchPypi {
-              pname = "pandas";
-              inherit version;
-              hash = "sha256-JQn+rtpy/OA2deLszSKEuxyttqBzcAil50H+JDHUdCE=";
-            };
-          });
-        };
-      in
-      pkgs.python3.override {
-        inherit packageOverrides;
-        self = python;
-      };
-
-  in
-  python.withPackages (ps: [ ps.blaze ])
-).env
+let
+  python = pkgs.python3.override {
+    packageOverrides = self: super: {
+      pandas = super.pandas.overridePythonAttrs (
+        finalAttrs: prevAttrs: {
+          version = "0.19.1";
+          src = fetchPypi {
+            pname = "pandas";
+            inherit (finalAttrs) version;
+            hash = "sha256-JQn+rtpy/OA2deLszSKEuxyttqBzcAil50H+JDHUdCE=";
+          };
+        }
+      );
+    };
+  };
+in
+(python.withPackages (ps: [ ps.blaze ])).env
 ```

 The next example shows a non trivial overriding of the `blas` implementation to
@@ -13,19 +13,20 @@ Tcl packages are typically built with `tclPackages.mkTclDerivation`.
 Tcl dependencies go in `buildInputs`/`nativeBuildInputs`/... like other packages.
 For more complex package definitions, such as packages with mixed languages, use `tcl.tclPackageHook`.

-Where possible, make sure to enable stubs for maximum compatibility, usually with the `--enable-stubs` configure flag.
+Where possible, make sure to enable stubs for maximum compatibility.
+If you are using `mkTclDerivation`, `--enable-stubs` will be automatically added to `configureFlags`.

 Here is a simple package example to be called with `tclPackages.callPackage`.

 ```
 { lib, fetchzip, mkTclDerivation, openssl }:

-mkTclDerivation rec {
+mkTclDerivation (finalAttrs: {
  pname = "tcltls";
  version = "1.7.22";

  src = fetchzip {
-    url = "https://core.tcl-lang.org/tcltls/uv/tcltls-${version}.tar.gz";
+    url = "https://core.tcl-lang.org/tcltls/uv/tcltls-${finalAttrs.version}.tar.gz";
    hash = "sha256-TOouWcQc3MNyJtaAGUGbaQoaCWVe6g3BPERct/V65vk=";
  };

@@ -33,7 +34,6 @@ mkTclDerivation rec {

  configureFlags = [
    "--with-ssl-dir=${openssl.dev}"
-    "--enable-stubs"
  ];

  meta = {
@@ -43,7 +43,7 @@ mkTclDerivation rec {
    license = lib.licenses.tcltk;
    platforms = lib.platforms.unix;
  };
-}
+})
 ```

 All Tcl libraries are declared in `pkgs/top-level/tcl-packages.nix` and are defined in `pkgs/development/tcl-modules/`.
@@ -52,3 +52,35 @@ Its use is documented in `pkgs/development/tcl-modules/by-name/README.md`.

 All Tcl applications reside elsewhere.
 In case a package is used as both a library and an application (for example `expect`), it should be defined in `tcl-packages.nix`, with an alias elsewhere.
+
+### Using tclRequiresCheck {#using-tclrequirescheck}
+
+Although unit tests are highly preferred to validate correctness of a package, not
+all packages have test suites that can be run easily, and some have none at all.
+To help ensure the package still works, [`tclRequiresCheck`](#using-tclrequirescheck) can attempt to `package require`
+the listed modules.
+
+```nix
+{
+  tclRequiresCheck = [
+    "json"
+    "doctools"
+  ];
+}
+```
+
+roughly translates to:
+
+```nix
+{
+  preDist = ''
+    TCLLIBPATH="$out/lib $TCLLIBPATH"
+    tclsh <<<'exit [catch {package require json; package require doctools}]'
+  '';
+}
+```
+
+However, this is done in its own phase, and not dependent on whether [`doCheck = true;`](#var-stdenv-doCheck).
+
+This can also be useful in verifying that the package doesn't assume commonly
+present packages (e.g. `tcllib`).
@@ -379,6 +379,9 @@
  "sec-build-helper-extendMkDerivation": [
    "index.html#sec-build-helper-extendMkDerivation"
  ],
+  "sec-buildEnv-exceptions": [
+    "index.html#sec-buildEnv-exceptions"
+  ],
  "sec-building-packages-with-llvm": [
    "index.html#sec-building-packages-with-llvm"
  ],
@@ -445,7 +448,13 @@
    "index.html#overriding-the-generator",
    "index.html#javascript-node2nix",
    "index.html#javascript-node2nix-preparation",
-    "index.html#javascript-node2nix-pitfalls"
+    "index.html#javascript-node2nix-pitfalls",
+    "index.html#javascript-yarn2nix-mkYarnPackage",
+    "index.html#javascript-yarn2nix",
+    "index.html#javascript-yarn2nix-preparation",
+    "index.html#javascript-yarn2nix-mkYarnModules",
+    "index.html#javascript-mkYarnPackage-overriding-dependencies",
+    "index.html#javascript-yarn2nix-pitfalls"
  ],
  "sec-nixpkgs-release-26.05-lib": [
    "release-notes.html#sec-nixpkgs-release-26.05-lib"
@@ -770,6 +779,12 @@
  "sec-treefmt-options-reference": [
    "index.html#sec-treefmt-options-reference"
  ],
+  "ssec-buildEnv-collisions": [
+    "index.html#ssec-buildEnv-collisions"
+  ],
+  "ssec-buildEnv-singleFileOutputs": [
+    "index.html#ssec-buildEnv-singleFileOutputs"
+  ],
  "ssec-cosmic-common-issues": [
    "index.html#ssec-cosmic-common-issues"
  ],
@@ -878,6 +893,9 @@
  "typst-package-scope-and-usage": [
    "index.html#typst-package-scope-and-usage"
  ],
+  "using-tclrequirescheck": [
+    "index.html#using-tclrequirescheck"
+  ],
  "var-go-buildTestBinaries": [
    "index.html#var-go-buildTestBinaries"
  ],
@@ -2182,6 +2200,12 @@
  "chap-special": [
    "index.html#chap-special"
  ],
+  "sec-buildEnv": [
+    "index.html#sec-buildEnv"
+  ],
+  "sec-buildEnv-arguments": [
+    "index.html#sec-buildEnv-arguments"
+  ],
  "sec-fakeNss": [
    "index.html#sec-fakeNss"
  ],
@@ -3702,24 +3726,6 @@
  "javascript-yarninstallhook": [
    "index.html#javascript-yarninstallhook"
  ],
-  "javascript-yarn2nix": [
-    "index.html#javascript-yarn2nix"
-  ],
-  "javascript-yarn2nix-preparation": [
-    "index.html#javascript-yarn2nix-preparation"
-  ],
-  "javascript-yarn2nix-mkYarnPackage": [
-    "index.html#javascript-yarn2nix-mkYarnPackage"
-  ],
-  "javascript-yarn2nix-mkYarnModules": [
-    "index.html#javascript-yarn2nix-mkYarnModules"
-  ],
-  "javascript-mkYarnPackage-overriding-dependencies": [
-    "index.html#javascript-mkYarnPackage-overriding-dependencies"
-  ],
-  "javascript-yarn2nix-pitfalls": [
-    "index.html#javascript-yarn2nix-pitfalls"
-  ],
  "javascript-yarnBerry-missing-hashes": [
    "index.html#javascript-yarnBerry-missing-hashes"
  ],
@@ -4053,6 +4059,9 @@
  "buildpythonpackage-parameters": [
    "index.html#buildpythonpackage-parameters"
  ],
+  "buildpythonpackage-fixed-point-arguments": [
+    "index.html#buildpythonpackage-fixed-point-arguments"
+  ],
  "overriding-python-build-helpers": [
    "index.html#overriding-python-build-helpers"
  ],
@@ -4477,6 +4486,9 @@
    "index.html#neovim-plugin-required-snippet",
    "index.html#vim-plugin-required-snippet"
  ],
+  "neovim-plugin-license-overrides": [
+    "index.html#neovim-plugin-license-overrides"
+  ],
  "updating-plugins-in-nixpkgs": [
    "index.html#updating-plugins-in-nixpkgs"
  ],
@@ -324,6 +324,13 @@ and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

+- `buildEnv` now takes fixed-point arguments (`finalAttrs: { }`).
+  The custom overrider `<env-pkg>.override` is deprecated but kept in this release. It will be removed in future releases after tree-wide transition.
+  The argument `paths` is passed as `passthru.paths` to avoid bringing in unexpected context.
+
+- `buildEnv` now takes `derivationArgs` for additional arguments to pass to `stdenv.mkDerivation`.
+  A compatibility layer is added for directly-specified arguments `nativeBuildInputs` and `buildInputs`.
+
 - Added `rewriteURL` attribute to the nixpkgs `config`, to allow for rewriting the URLs downloaded by `fetchurl`.

 - Added `hashedMirrors` attribute to the nixpkgs `config`, to allow for customization of the hashed mirrors used by `fetchurl`.
@@ -348,7 +355,7 @@ and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).

 - `fetchgit` now accepts a `rootDir` argument to limit the resulting source to one subdirectory of the whole Git repository. Corresponding `--root-dir` option added to `nix-prefetch-git`.

- `fetchNpmDeps` now accepts a `npmRegistryOverridesString` argument to pass NPM registry overrides to the fetcher.
+- `fetchNpmDeps` now accepts a `npmRegistryOverridesString` argument to pass npm registry overrides to the fetcher.

 - `ffmpeg_8`, `ffmpeg_8-headless`, and `ffmpeg_8-full` have been added. The default version of FFmpeg is now `ffmpeg_8`. You can install previous versions from package attributes such as `ffmpeg_7`.

@@ -80,11 +80,15 @@

 - Note that the above `nodePackages` removal also coincides with the removal of `node2nix` and its tooling, which have been deprecated for a long time.

+- `buildEnv`-constructed packages now take only [structured attributes (`{ __structuredAttrs = true; }`)](https://nix.dev/manual/nix/2.18/language/advanced-attributes.html#adv-attr-structuredAttrs).
+
 - `xfce.mkXfceDerivation` has been deprecated (i.e. conditioned behind `nixpkgs.config.allowAliases`)
  and will be removed in NixOS 26.11, please use `stdenv.mkDerivation` directly. You can migrate by
  adding `pkg-config`, `xfce4-dev-tools`, and `wrapGAppsHook3` to your `nativeBuildInputs` and
  `--enable-maintainer-mode` to your `configureFlags`.

+- `yarn2nix`/`yarn2nix-moretea` and its tooling(`mkYarnPackage`, `mkYarnModules`, and `fixup_yarn_lock`) have been removed as they were unmaintainable in nixpkgs. If you want to build with Yarn V1 going forward, use the hooks instead(`yarnBuildHook`, `yarnConfigHook`, and `yarnInstallHook`). See the yarn v1 documentation in the nixpkgs manual for more details.
+
 - `albert` has been updated to the version 34.0.5. This release redesigns the query system to support stateful asynchronous handlers and infinite scrolling, and adds internationalized tokenization.
  This update introduces several breaking changes: the Python plugin interface is now v5.0, the `PATH` plugin has been renamed to `Commandline`, and the QStylesheets-based widgets box model frontend has been removed.
  For more information read the [changelog for 34.0.0](https://albertlauncher.github.io/2026/01/19/albert-v34.0.0-released/).
@@ -133,12 +137,21 @@

 - `pulsar` has finally migrated from electron v12 to v30, backup `~/.pulsar` before upgrading. See [Pulsar on Electron 30: what it means for you](https://blog.pulsar-edit.dev/posts/20251202-savetheclocktower-pulsar-on-electron-30/).

+- `mactracker` has been updated to major version 8, which now [requires macOS 11 Big Sur or later](https://mactracker.ca/releasenotes-mac.html#:~:text=System%20requirements%20updated%20to%20macOS%2011%20Big%20Sur%20and%20later). The previous version supported Mac OS X 10.6.8 or later.
+
 - `bartender` has been updated to major version 6. This removes support for MacOS Sonoma (and adds support for Tahoe). For more information, see [the release notes](https://www.macbartender.com/Bartender6/release_notes/) or [the Bartender 6 support page](https://www.macbartender.com/Bartender6/support/).

 - `lima` has been updated from `1.x` to `2.x`. This major update includes several breaking changes, such as `/tmp/lima` no longer being mounted by default.

 - Varnish Cache has been updated to major version 8, `varnish` now refers to `varnish80`. That release contains breaking changes, see [Upgrading to Varnish-Cache 8.0](https://vinyl-cache.org/docs/8.0/whats-new/upgrading-8.0.html).
  Note that the Varnish 6 LTS release remains available as `varnish60`.
+  The Varnish Cache open-source project renamed itself to Vinyl Cache. Please migrate to `vinyl-cache`. See the `vinyl-cache` release notes entry for more information.
+  Varnish 8 is not supported for the entire NixOS 26.05 release cycle.
+
+- Vinyl Cache has been introduced with the major version 9 as the Varnish Cache open source project renamed itself to Vinyl Cache. Please migrate to Vinyl Cache 9 when you still use Varnish Cache.
+  A new module has also been introduced for this migration: `services.vinyl-cache`.
+  This release contains breaking changes, see [Upgrading to Vinyl Cache 9.0](https://vinyl-cache.org/docs/9.0/whats-new/upgrading-9.0.html).
+  The `varnish-modules` project is currently not packaged for Vinyl Cache, as it is incompatible.

 - `eslint` has been updated from version 9 to version 10. Please see https://eslint.org/blog/2026/02/eslint-v10.0.0-released/ for details about the breaking changes included in the update.

@@ -162,6 +175,10 @@

 - the `xorg` package set has been deprecated, packages have moved to the top level.

+- `python3Packages.buildPythonPackage` and `python3Packages.buildPythonApplication` now throw errors in the presence of `pytestFlagsArray`.
+  Please use [`pytestFlags` and `(enabled|disabled)(TestPaths|Tests|TestMarks)`](#using-pytestcheckhook) instead.
+  If modifying the Nix expression is not feasible, users can remediate the error by overriding `pytestFlagsArray` with `null` or `[ ]`.
+
 - `python3Packages.pygame` has been been renamed to `python3Packages.pygame-original`, the attribute `python3Packages.pygame` will from python 3.14 default to the more actively maintained `python3Packages.pygame-ce`

 - `fastly` has been updated to major version 14. For more information, you can check the [release notes](https://github.com/fastly/cli/releases/tag/v14.0.0)
@@ -247,11 +264,16 @@

 - `python3packages.pillow-avif-plugin` has been removed as the functionality is included in `python3packages.pillow` directly since version 11.3.

+- `wasistlos` (previously known as `whatsapp-for-linux`) has been removed because it was unmaintained and archived upstream.
+  Multiple alternatives exist: `karere`, `whatsie` and `zapzap` among others.
+
 - `light` has been removed because it was unmaintained.
  `brightnessctl` and `acpilight` provide similar functionality.

 - `opensmtpd-filter-dkimsign` is now installed into `libexec/smtpd` instead of `libexec/opensmtpd` so that now it is properly linked into the environment built by `services.opensmtpd.procPackages`. If you hardcoded path to `filter-dkimsign` please consider using this option.

+- `shisho` has been removed because it's archived. `semgrep`, `opengrep`, and `ast-grep` provide similar functionality.
+
 - `services.openssh.settings.AcceptEnv` now explicitly defined as an option that takes a list of strings, to facilitate option merging. Setting it to a string value is no longer supported.

 - All Xfce packages have been moved to top level (e.g. if you previously added `pkgs.xfce.xfce4-whiskermenu-plugin` to `environment.systemPackages`, you will need to change it to `pkgs.xfce4-whiskermenu-plugin`). The `xfce` scope will be removed in NixOS 26.11.
@@ -268,10 +290,16 @@

 - The default packages in `services.jenkins.packages` have been dropped, since not every Jenkins installation needs any package at all. It's more reasonable to leave it empty and let users configure what they need.

+- The `pie` hardening flag has been removed and will now error, after being deprecated in 25.11. Compilers are expected to enable PIE by default, as has been common practice since 2016 outside of Nixpkgs. If a package needs `pie` disabled pass `-no-pie` in `CFLAGS`. It is unlikely this will be necessary in many cases; due to the prevalence of default PIE toolchains, most packages incompatible with PIE already pass `-no-pie`.
+
 ## Other Notable Changes {#sec-nixpkgs-release-26.05-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

+- `nvidia-x11` proprietary kernel modules are now provided separately as `nvidia_x11.mod`, while `nvidia_x11.open` remains the open-source kernel module package.
+
+- `linuxPackages.nvidiaPackages` now follows NVIDIA's official release branches by exposing `production`, `new_feature`, and `beta`. The convenience aliases `latest` (newer of `production` and `new_feature`) and `bleeding_edge` (newer of `latest` and `beta`) are provided; note that `beta` now refers strictly to the beta branch.
+
 - `balatro` now supports the Google Play and Xbox PC versions of the game.  Pass the `apk` or `Assets.zip` as `balatro.override { src = "…" }`.

 - `uptime-kuma` has been updated to v2, which requires an automated migration that can take a few hours. **A backup is highly recommended.**
@@ -280,6 +308,8 @@

 - The `libcxxhardeningextensive` hardening flag has been **disabled** by default. Enabling it by default in 25.11 was unintentional and may have had a negative effect on performance in some cases. `libcxxhardeningfast` remains enabled by default.

+- The packages `ibtool`, `actool` and `re-plistbuddy` have been added, providing reimplementations of the corresponding proprietary Apple tools. They are more compatible with the originals than the previously existing `xcbuild` package, and should enable more darwin software to be built from source.
+
 - Switch inhibitors were introduced, which add a pre-switch check that compares a list of strings between the previous and the new generation, and refuses to switch into the new generation when there is a difference between the two lists. This allows to avoid switching into a system when for instance the systemd version changed by adding `config.systemd.package.version` to the switch inhibitors for your system. You can still forcefully switch into any generation by setting `NIXOS_NO_CHECK=1`.

 - GNU Taler has been updated to version 1.3.
@@ -290,6 +320,12 @@

 - `fetchPnpmDeps` and `pnpmConfigHook` were added as top-level attributes, replacing the now deprecated `pnpm.fetchDeps` and `pnpm.configHook` attributes.

+- `fetchPnpmDeps`' `fetcherVersion = 1` is deprecated and scheduled for removal
+  in the 26.11 release. A deprecation warning has been added. Packages still on
+  `fetcherVersion = 1` should migrate to `fetcherVersion = 3` and regenerate
+  their hashes. See the [pnpm `fetcherVersion`
+  section](#javascript-pnpm-fetcherVersion) of the manual for details.
+
 - `buildNpmPackage` now supports `npmDepsFetcherVersion` (and `fetchNpmDeps` now supports `fetcherVersion`). Set to `2` to enable packument caching, which fixes builds for projects using npm workspaces.

 - Added `dell-bios-fan-control` package and service.
@@ -331,6 +367,8 @@ gnuradioMinimal.override {
 }
 ```

+- Added `headplane` and `headplane-agent` packages, and `services.headplane` service.
+
 ## Nixpkgs Library {#sec-nixpkgs-release-26.05-lib}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -490,3 +490,7 @@ div.appendix .variablelist .term {
  font-family: Roboto;
  src: url(Roboto.ttf);
 }
+
+.chapter {
+  content-visibility: auto;
+}
@@ -123,7 +123,6 @@ let
    pathExists
    seq
    typeOf
-    nixVersion
    ;

  inherit (lib.lists)
@@ -138,7 +137,6 @@ let

  inherit (lib.strings)
    isStringLike
-    versionOlder
    ;

  inherit (lib.filesystem)
@@ -201,7 +201,7 @@ in
        in
        if builtins.length matches != 0 then
          { inherit path matches; }
-        else if path == /. then
+        else if toString path == "/" then
          null
        else
          go (dirOf path);
@@ -211,7 +211,7 @@ in
          base = baseNameOf file;
          type = (builtins.readDir parent).${base} or null;
        in
-        file == /. || type == "directory";
+        toString file == "/" || type == "directory";
    in
    go (if isDir then file else parent);

@@ -371,7 +371,6 @@ in
    let
      inherit (lib)
        concatMapAttrs
-        id
        makeScope
        recurseIntoAttrs
        removeSuffix
@@ -19,7 +19,6 @@ let
    isString
    match
    typeOf
-    elemAt
    ;

 in
@@ -23,7 +23,6 @@ let
  */
  ipv6Bits = 128;
  ipv6Pieces = 8; # 'x:x:x:x:x:x:x:x'
-  ipv6PieceBits = 16; # One piece in range from 0 to 0xffff.
  ipv6PieceMaxValue = 65535; # 2^16 - 1
 in
 let
@@ -468,7 +468,7 @@ rec {
    : 3\. Function argument
  */
  mergeUniqueOption =
-    args@{
+    {
      message,
      # WARNING: the default merge function assumes that the definition is a valid (option) value. You MUST pass a merge function if the return value needs to be
      #   - type checked beyond what .check does (which should be very little; only on the value head; not attribute values, etc)
@@ -37,17 +37,63 @@ rec {
  );

  /**
-    This is the entrypoint for the portable part of modular services.
+    Entrypoint for integrating modular services into a containing module system.

-    It provides the various options that are consumed by service manager implementations.
+    Each containing system (NixOS, ...) calls `configure` to
+    obtain a `serviceSubmodule` type for its services option. The returned submodule
+    includes the portable service base and any service-manager-specific modules
+    passed via `extraRootModules`.
+
+    **Implementing for a new system** (e.g. home-manager, nix-darwin):
+
+    ```nix
+    # darwin/modules/services/system.nix
+    { lib, config, pkgs, ... }:
+    let
+      portable-lib = import <nixpkgs/lib/services/lib.nix> { inherit lib; };
+
+      modularServiceConfiguration = portable-lib.configure {
+        serviceManagerPkgs = pkgs;
+        extraRootModules = [
+          ./launchd-service.nix    # launchd-specific options (plist generation, etc.)
+        ];
+      };
+    in
+    {
+      options.services = lib.mkOption {
+        type = lib.types.attrsOf modularServiceConfiguration.serviceSubmodule;
+        default = { };
+      };
+
+      config = {
+        # Convert service tree -> launchd plists, assertions, etc.
+        # (analogous to how NixOS converts to systemd units)
+        launchd.agents = ...;
+        assertions = ...;
+        warnings = ...;
+      };
+    }
+    ```
+
+    lib.services.configure :: AttrSet -> { serviceSubmodule :: SubmoduleType }

    # Inputs

-    `serviceManagerPkgs`: A Nixpkgs instance which will be used for built-in logic such as converting `configData.<path>.text` to a store path.
+    `serviceManagerPkgs`

-    `extraRootModules`: Modules to be loaded into the "root" service submodule, but not into its sub-`services`. That's the modules' own responsibility.
+    : 1\. A Nixpkgs instance used for built-in logic such as converting
+    `configData.<path>.text` to a store path.

-    `extraRootSpecialArgs`: Fixed module arguments that are provided in a similar manner to `extraRootModules`.
+    `extraRootModules`
+
+    : 2\. Modules to be loaded into the "root" service submodule, but not
+    into its sub-`services`. That's the modules' own responsibility.
+    Typically contains service-manager-specific option modules
+    (e.g. systemd unit options, launchd plist options).
+
+    `extraRootSpecialArgs`
+
+    : 3\. Fixed module arguments provided alongside `extraRootModules`.

    # Output

@@ -311,7 +311,13 @@ let
          fileName = path + "/${file}";
          packedRefsName = path + "/packed-refs";
          absolutePath =
-            base: path: if lib.hasPrefix "/" path then path else toString (/. + "${base}/${path}");
+            base: path:
+            if lib.hasPrefix "/" path then
+              path
+            else if lib.hasPrefix "/" base then
+              "${base}/${path}"
+            else
+              "/${base}/${path}";
        in
        if
          pathIsRegularFile path
@@ -337,6 +337,7 @@ rec {

  /**
    Concatenate a list of strings, adding a newline at the end of each one.
+    Defined as `concatMapStrings (s: s + "\n")`.

    # Inputs

@@ -360,7 +361,7 @@ rec {

    :::
  */
-  concatLines = str: concatStringsSep "\n" str + "\n";
+  concatLines = concatMapStrings (s: s + "\n");

  /**
    Given string `s`, replace every occurrence of the string `from` with the string `to`.
@@ -300,6 +300,8 @@ let
            "powerpc"
          else if final.isRiscV then
            "riscv"
+          else if final.isSh4 then
+            "sh"
          else if final.isS390 then
            "s390"
          else if final.isLoongArch64 then
@@ -40,6 +40,7 @@ let
    "i686-linux"
    "loongarch64-linux"
    "m68k-linux"
+    "sh4-linux"
    "microblaze-linux"
    "microblazeel-linux"
    "mips-linux"
@@ -145,6 +146,7 @@ in
  or1k = filterDoubles predicates.isOr1k;
  m68k = filterDoubles predicates.isM68k;
  arc = filterDoubles predicates.isArc;
+  sh4 = filterDoubles predicates.isSh4;
  s390 = filterDoubles predicates.isS390;
  s390x = filterDoubles predicates.isS390x;
  loongarch64 = filterDoubles predicates.isLoongArch64;
@@ -243,6 +243,10 @@ rec {
    config = "arc-unknown-linux-gnu";
  };

+  sh4 = {
+    config = "sh4-unknown-linux-gnu";
+  };
+
  s390 = {
    config = "s390-unknown-linux-gnu";
  };
@@ -234,6 +234,11 @@ rec {
        family = "arc";
      };
    };
+    isSh4 = {
+      cpu = {
+        family = "sh";
+      };
+    };
    isS390 = {
      cpu = {
        family = "s390";
@@ -284,6 +284,12 @@ rec {
        family = "m68k";
      };

+      sh4 = {
+        bits = 32;
+        significantByte = littleEndian;
+        family = "sh";
+      };
+
      powerpc = {
        bits = 32;
        significantByte = bigEndian;
@@ -632,6 +632,15 @@ rec {
    else if platform.isPower64 then
      if platform.isLittleEndian then powernv else ppc64

+    else if platform.isSh4 then
+      {
+        linux-kernel = {
+          target = "vmlinux";
+          # SH arch doesn't have a 'make install' target.
+          installTarget = "vmlinux";
+        };
+      }
+
    else
      { };
 }
@@ -51,7 +51,6 @@ let
    filter
    filterAttrs
    fix
-    fold
    foldAttrs
    foldl
    foldl'
@@ -559,6 +558,10 @@ runTests {
    ];
    expected = "a\nb\nc\n";
  };
+  testConcatLinesEmpty = {
+    expr = concatLines [ ];
+    expected = "";
+  };

  testMakeIncludePathWithPkgs = {
    expr = (
@@ -4790,7 +4793,7 @@ runTests {
  # for sub-directories
  testPackagesFromDirectoryNestedScopes =
    let
-      inherit (lib) makeScope recurseIntoAttrs;
+      inherit (lib) makeScope;
      emptyScope = makeScope lib.callPackageWith (_: { });
    in
    {
@@ -3,16 +3,10 @@ let
  inherit (lib)
    types
    mkOption
-    setDefaultModuleLocation
    evalModules
    ;
  inherit (types)
    deferredModule
-    lazyAttrsOf
-    submodule
-    str
-    raw
-    enum
    ;
 in
 {
@@ -1,12 +1,11 @@
 { lib, ... }:
 let
-  inherit (lib) types mkOption setDefaultModuleLocation;
+  inherit (lib) types mkOption;
  inherit (types)
    deferredModule
    lazyAttrsOf
    submodule
    str
-    raw
    enum
    ;
 in
@@ -1,15 +1,4 @@
 { lib, ... }:
-let
-  inherit (lib) mkOption types;
-
-  moduleWithKey =
-    { config, ... }:
-    {
-      config = {
-        enable = true;
-      };
-    };
-in
 {
  imports = [
    ./declare-enable.nix
@@ -6,7 +6,6 @@
 }:
 let
  inherit (lib) mkOption types;
-  forceDeep = x: builtins.deepSeq x x;
  mergedSubOption = (options.merged.type.getSubOptions options.merged.loc).extensible;
 in
 {
@@ -171,6 +171,7 @@ lib.runTests (
      "i686-linux"
      "loongarch64-linux"
      "m68k-linux"
+      "sh4-linux"
      "microblaze-linux"
      "microblazeel-linux"
      "mips-linux"
@@ -145,6 +145,12 @@
    githubId = 67933444;
    keys = [ { fingerprint = "B39E B98E 8860 DAFB 0567  0073 A614 B7D2 5134 987A"; } ];
  };
+  _0xgsvs = {
+    email = "venkat.subrahmanyam.34@gmail.com";
+    name = "0xgsvs";
+    github = "0xgsvs";
+    githubId = 161702876;
+  };
  _0xMillyByte = {
    email = "emilia.daelman@gmail.com";
    name = "Emilia Daelman";
@@ -1009,6 +1015,12 @@
    githubId = 56970006;
    keys = [ { fingerprint = "50E2 669C AB38 2F4A 5F72  1667 0D6B FC01 D45E DADD"; } ];
  };
+  akosseres = {
+    name = "Ákos Seres";
+    email = "seresakos2000@gmail.com";
+    github = "AkosSeres";
+    githubId = 11257907;
+  };
  akotro = {
    name = "Antonis Kotronakis";
    email = "mail@akotro.dev";
@@ -3958,6 +3970,12 @@
    name = "Joseph Madden";
    keys = [ { fingerprint = "3CF8 E983 2219 AB4B 0E19  158E 6112 1921 C9F8 117C"; } ];
  };
+  brett = {
+    email = "brett@librum.org";
+    github = "brett";
+    githubId = 523;
+    name = "Brett Eisenberg";
+  };
  brettlyons = {
    email = "blyons@fastmail.com";
    github = "brettlyons";
@@ -4842,6 +4860,12 @@
    github = "CHN-beta";
    githubId = 35858462;
  };
+  choco98 = {
+    name = "Conor Boyle";
+    email = "conorboyle07@protonmail.com";
+    github = "chocoblocko9";
+    githubId = 91826251;
+  };
  ChocolateLoverRaj = {
    email = "paranjperajas@gmail.com";
    github = "ChocolateLoverRaj";
@@ -5302,12 +5326,6 @@
    githubId = 27779510;
    keys = [ { fingerprint = "FDF5 EF67 8CC1 FE22 1845  6A22 CF7B BB5B C756 1BD3"; } ];
  };
-  coffeeispower = {
-    email = "tiagodinis33@proton.me";
-    github = "coffeeispower";
-    name = "Tiago Dinis";
-    githubId = 92828847;
-  };
  cofob = {
    name = "Egor Ternovoy";
    email = "cofob@riseup.net";
@@ -5442,6 +5460,12 @@
    name = "Simon Hauser";
    githubId = 15233006;
  };
+  connor-grady = {
+    email = "connor.grady@gmail.com";
+    github = "connor-grady";
+    githubId = 50903811;
+    name = "Connor Grady";
+  };
  connorbaker = {
    email = "ConnorBaker01@gmail.com";
    matrix = "@connorbaker:matrix.org";
@@ -7234,12 +7258,6 @@
    githubId = 187309685;
    name = "Drew Council";
  };
-  dritter = {
-    email = "dritter03@googlemail.com";
-    github = "dritter";
-    githubId = 1544760;
-    name = "Dominik Ritter";
-  };
  drperceptron = {
    github = "drperceptron";
    githubId = 92106371;
@@ -7739,6 +7757,12 @@
    githubId = 411447;
    name = "Leo Gaspard";
  };
+  ekzyis = {
+    email = "ramdip.singhgill@gmail.com";
+    github = "ekzyis";
+    githubId = 27162016;
+    name = "Ramdip Gill";
+  };
  elasticdog = {
    email = "aaron@elasticdog.com";
    github = "elasticdog";
@@ -7886,6 +7910,12 @@
    githubId = 45268815;
    name = "Flavio Galán";
  };
+  ElSebas41 = {
+    email = "achavezaiquipa@gmail.com";
+    github = "ElSebas41";
+    githubId = 189925713;
+    name = "Angel Chavez";
+  };
  elvishjerricco = {
    email = "elvishjerricco@gmail.com";
    matrix = "@elvishjerricco:matrix.org";
@@ -10607,7 +10637,7 @@
  };
  hekazu = {
    name = "Henri Peurasaari";
-    email = "henri.peurasaari@helsinki.fi";
+    email = "henri.peurasaari@alumni.helsinki.fi";
    github = "hekazu";
    githubId = 16819092;
  };
@@ -11273,6 +11303,12 @@
    githubId = 55025025;
    name = "Feather Lin";
  };
+  igor-ramazanov = {
+    email = "personal@igorramazanov.tech";
+    github = "igor-ramazanov";
+    githubId = 12570166;
+    name = "Igor Ramazanov";
+  };
  igsha = {
    email = "igor.sharonov@gmail.com";
    github = "igsha";
@@ -11655,6 +11691,11 @@
    github = "IsotoxalDev";
    githubId = 62714538;
  };
+  issai = {
+    name = "Issai";
+    github = "TheLimifiedLime";
+    githubId = 69121493;
+  };
  istoph = {
    email = "chr@istoph.de";
    name = "Christoph Hüffelmann";
@@ -12384,6 +12425,13 @@
    githubId = 9425955;
    name = "Jean-François Labonté";
  };
+  jelni = {
+    email = "nixpkgs@jel.gay";
+    github = "jelni";
+    githubId = 25802745;
+    matrix = "@me:jel.gay";
+    name = "jel";
+  };
  jemand771 = {
    email = "willy@jemand771.net";
    github = "jemand771";
@@ -12514,6 +12562,11 @@
    githubId = 277474;
    keys = [ { fingerprint = "F1F1 3395 8E8E 9CC4 D9FC  9647 1931 9CD8 416A 642B"; } ];
  };
+  jfr = {
+    name = "Joseph Fox-Rabinovitz";
+    github = " joe-saronic";
+    githubId = 156837150;
+  };
  jfroche = {
    name = "Jean-François Roche";
    email = "jfroche@pyxel.be";
@@ -13215,6 +13268,12 @@
    github = "joshainglis";
    githubId = 1281131;
  };
+  joshgodsiff = {
+    name = "Josh Godsiff";
+    email = "josh.godsiff@gmail.com";
+    github = "joshgodsiff";
+    githubId = 145132;
+  };
  joshheinrichs-shopify = {
    name = "Josh Heinrichs";
    email = "josh.heinrichs@shopify.com";
@@ -13844,6 +13903,13 @@
    matrix = "@katexochen:matrix.org";
    name = "Paul Meyer";
  };
+  katok = {
+    name = "katok";
+    email = "kat.ok.timofey@gmail.com";
+    matrix = "@kat.ok:matrix.org";
+    github = "Hi-Timofey";
+    githubId = 43324422;
+  };
  katrinafyi = {
    name = "katrinafyi";
    github = "katrinafyi";
@@ -14236,6 +14302,13 @@
    githubId = 10689811;
    name = "Torben Schweren";
  };
+  kittyandrew = {
+    email = "alias.nixpkgs.maintainer@kittymail.me";
+    github = "kittyandrew";
+    githubId = 45767571;
+    matrix = "@kittyandrew:ndrew.me";
+    name = "kittyandrew";
+  };
  kittywitch = {
    email = "kat@inskip.me";
    github = "kittywitch";
@@ -14453,6 +14526,12 @@
    githubId = 913109;
    name = "Emil Fresk";
  };
+  korkutkardes7 = {
+    email = "korkutkardes7@hotmail.com";
+    github = "KorkutKardes7";
+    githubId = 148012191;
+    name = "Korkut Kardeşseven";
+  };
  kornholi = {
    email = "kornholijo@gmail.com";
    github = "kornholi";
@@ -17994,7 +18073,7 @@
    keys = [ { fingerprint = "C3E7 F8C4 9CBC 9320 D360  B117 8516 D0FA 7D8F 58FC"; } ];
  };
  Misaka13514 = {
-    name = "Misaka13514";
+    name = "Rine Amakawa";
    email = "Misaka13514@gmail.com";
    matrix = "@misaka13514:matrix.org";
    github = "Misaka13514";
@@ -18440,6 +18519,11 @@
    githubId = 8165792;
    name = "Mark Karpov";
  };
+  mrmaxmeier = {
+    github = "mrmaxmeier";
+    githubId = 3913977;
+    name = "Mrmaxmeier";
+  };
  mrmebelman = {
    email = "burzakovskij@protonmail.com";
    github = "MrMebelMan";
@@ -19445,6 +19529,14 @@
    name = "Nicolas Goudry";
    keys = [ { fingerprint = "21B6 A59A 4E89 0B1B 83E3 0CDB 01C8 8C03 5450 9AA9"; } ];
  };
+  nicolas-guichard = {
+    name = "Nicolas Qiu Guichard";
+    email = "nicolas@guichard.eu";
+    matrix = "@nicolas:guichard.eu";
+    github = "nicolas-guichard";
+    githubId = 11260285;
+    keys = [ { fingerprint = "22B2 237B 0158 EE61 704C E191 7684 D229 0313 47AA"; } ];
+  };
  nicomem = {
    email = "nix@nicomem.com";
    github = "nicomem";
@@ -23305,12 +23397,6 @@
    githubId = 641278;
    name = "Robert T. McGibbon";
  };
-  rmgpinto = {
-    email = "hessian_loom_0u@icloud.com";
-    github = "rmgpinto";
-    githubId = 24584;
-    name = "Ricardo Gândara Pinto";
-  };
  rnhmjoj = {
    email = "rnhmjoj@inventati.org";
    matrix = "@rnhmjoj:eurofusion.eu";
@@ -24639,6 +24725,7 @@
    name = "Greg Pfeil";
  };
  sempiternal-aurora = {
+    email = "myrialsarvay@gmail.com";
    github = "sempiternal-aurora";
    githubId = 78790545;
    name = "Myria Sarvay";
@@ -25994,6 +26081,19 @@
    github = "StayBlue";
    githubId = 23127866;
  };
+  stealthbadger747 = {
+    email = "parawell.erik@gmail.com";
+    github = "StealthBadger747";
+    githubId = 26052996;
+    name = "Erik Parawell";
+  };
+  stealthybox = {
+    email = "leigh@null.net";
+    github = "stealthybox";
+    githubId = 2754700;
+    name = "Leigh Capili";
+    keys = [ { fingerprint = "05E7 89C9 142C DD05 8261  4EF8 5943 2144 444F B382"; } ];
+  };
  steamwalker = {
    email = "steamwalker@xs4all.nl";
    github = "steamwalker";
@@ -26246,12 +26346,6 @@
    githubId = 90754995;
    name = "sudo-mac";
  };
-  sudoforge = {
-    github = "sudoforge";
-    githubId = 3893293;
-    name = "sudoforge";
-    keys = [ { fingerprint = "7EBCE51F278D30AE1C34036341BF61468C327D5A"; } ];
-  };
  sudosubin = {
    email = "sudosubin@gmail.com";
    github = "sudosubin";
@@ -27730,6 +27824,12 @@
    githubId = 7727887;
    name = "Tomas Kala";
  };
+  tomasrivera = {
+    email = "tomas.riveral@icloud.com";
+    github = "tomasriveral";
+    githubId = 137088692;
+    name = "Tomás Rivera";
+  };
  tomberek = {
    email = "tomberek@gmail.com";
    matrix = "@tomberek:matrix.org";
@@ -68,9 +68,6 @@ pkgs.stdenvNoCC.mkDerivation {
  '';
  shellHook =
    let
-      # trying to only add spaces as necessary for optional args
-      # with optStr don't need spaces between nix templating
-      optStr = cond: string: lib.optionalString cond "${string} ";
      args = [
        "hydra-check"
      ]
@@ -1,6 +1,6 @@
 # Nix script to calculate the Haskell dependencies of every haskellPackage. Used by ./hydra-report.hs.
 let
-  pkgs = import ../../.. { };
+  pkgs = import ../../.. { config.allowAliases = false; };
  inherit (pkgs) lib;
  getDeps =
    _: pkg:
@@ -20,6 +20,6 @@ cat > $tmpfile << EOF
 dont-distribute-packages:
 EOF

-nix-instantiate --eval --option restrict-eval true -I . --strict --json maintainers/scripts/haskell/transitive-broken-packages.nix | jq -r . | LC_ALL=C.UTF-8 sort --ignore-case >> $tmpfile
+nix-instantiate --show-trace --eval --option restrict-eval true -I . --strict --json maintainers/scripts/haskell/transitive-broken-packages.nix | jq -r . | LC_ALL=C.UTF-8 sort --ignore-case >> $tmpfile

 mv $tmpfile $config_file
@@ -1,11 +1,16 @@
 let
  nixpkgs = import ../../..;
  inherit (nixpkgs { }) pkgs lib;
+  isVersioned = attr: builtins.match "[A-Za-z0-9-]+(_[0-9]+)+" attr != null;
  getEvaluating =
    x:
-    builtins.attrNames (
+    lib.mapAttrsToList (_: v: v.pname) (
      lib.filterAttrs (
-        _: v: (builtins.tryEval (v.outPath or null)).success && lib.isDerivation v && !v.meta.broken
+        n: v:
+        !(isVersioned n)
+        && (builtins.tryEval (v.outPath or null)).success
+        && lib.isDerivation v
+        && !v.meta.broken
      ) x
    );
  brokenDeps = lib.subtractLists (getEvaluating pkgs.haskellPackages) (
@@ -111,4 +111,9 @@ sed -r \
 # ShellCheck: latest version of command-line dev tool.
 # Agda: The Agda community is fast-moving; we strive to always include the newest versions of Agda and the Agda packages in nixpkgs.

+# Work around Stackage LTS including a bogus version of cassava which has been deprecated on Hackage.
+# See <https://github.com/haskell-hvr/cassava/issues/248>.
+# TODO(@sternenseemann): drop this once the situation has been resolved in Stackage LTS
+sed -e 's/cassava ==0.5.5.0/cassava >= 0.5.4.0 && (> 0.5.5.0 || < 0.5.5.0) && < 0.6.0.0/' -i "$stackage_config"
+
 echo "$old_version -> $version"
@@ -17,12 +17,9 @@ in
 let
  inherit (builtins)
    attrNames
-    concatStrings
    filter
-    genList
    isNull
    length
-    stringLength
    toJSON
    ;
  inherit (pkgs.lib)
@@ -99,7 +99,7 @@ these assumptions the best it can.

 Here is how to build the above Todo plugin. Note that we rely on
 package-lock.json being assembled correctly, so must use a version where it is!
-If there is no lockfile or the lockfile is incorrect, Nix cannot fetch NPM build
+If there is no lockfile or the lockfile is incorrect, Nix cannot fetch npm build
 and runtime dependencies for a sandbox build.

 ```nix
@@ -1466,6 +1466,24 @@
  "module-services-mailman-other-mtas": [
    "index.html#module-services-mailman-other-mtas"
  ],
+  "test-opt-requiredFeatures": [
+    "index.html#test-opt-requiredFeatures"
+  ],
+  "test-opt-requiredFeatures.apple-virt": [
+    "index.html#test-opt-requiredFeatures.apple-virt"
+  ],
+  "test-opt-requiredFeatures.devnet": [
+    "index.html#test-opt-requiredFeatures.devnet"
+  ],
+  "test-opt-requiredFeatures.kvm": [
+    "index.html#test-opt-requiredFeatures.kvm"
+  ],
+  "test-opt-requiredFeatures.nixos-test": [
+    "index.html#test-opt-requiredFeatures.nixos-test"
+  ],
+  "test-opt-requiredFeatures.uid-range": [
+    "index.html#test-opt-requiredFeatures.uid-range"
+  ],
  "trezor": [
    "index.html#trezor"
  ],
@@ -139,7 +139,7 @@

 - [`pay-respects`](https://codeberg.org/iff/pay-respects), a terminal command correction program, alternative to `thefuck`, written in Rust. Available as [programs.pay-respects](options.html#opt-programs.pay-respects).

- [Radicle](https://radicle.xyz), an open source, peer-to-peer code collaboration stack built on Git. Available as [services.radicle](#opt-services.radicle.enable).
+- [Radicle](https://radicle.dev), an open source, peer-to-peer code collaboration stack built on Git. Available as [services.radicle](#opt-services.radicle.enable).

 - [Ordinal](https://github.com/snu-sf/Ordinal), A library for ordinal numbers in the Coq proof assistant.

@@ -149,9 +149,9 @@

 - [qBittorrent](https://www.qbittorrent.org/), a bittorrent client programmed in C++ / Qt that uses libtorrent by Arvid Norberg. Available as [services.qbittorrent](#opt-services.qbittorrent.enable).

- [radicle-ci-broker](https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:zwTxygwuz5LDGBq255RA2CbNGrz8), a tool for running CI for repositories in the local [Radicle](https://radicle.xyz/) node. Available as [services.radicle.ci.broker.enable](#opt-services.radicle.ci.broker.enable).
+- [radicle-ci-broker](https://radicle.network/nodes/seed.radicle.dev/rad:zwTxygwuz5LDGBq255RA2CbNGrz8), a tool for running CI for repositories in the local [Radicle](https://radicle.dev/) node. Available as [services.radicle.ci.broker.enable](#opt-services.radicle.ci.broker.enable).

- [radicle-native-ci](https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z3qg5TKmN83afz2fj9z3fQjU8vaYE), an adapter for the [Radicle CI broker](https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:zwTxygwuz5LDGBq255RA2CbNGrz8), for performing CI runs locally. Available as [services.radicle.ci.adapters.native](#opt-services.radicle.ci.adapters.native.instances).
+- [radicle-native-ci](https://radicle.network/nodes/seed.radicle.dev/rad:z3qg5TKmN83afz2fj9z3fQjU8vaYE), an adapter for the [Radicle CI broker](https://radicle.network/nodes/seed.radicle.dev/rad:zwTxygwuz5LDGBq255RA2CbNGrz8), for performing CI runs locally. Available as [services.radicle.ci.adapters.native](#opt-services.radicle.ci.adapters.native.instances).

 - [rauc](https://rauc.io/) (the Robust Auto-Update Controller), a daemon that allows reliable and secure software updates in embedded Linux systems. Available at [services.rauc](#opt-services.rauc.enable).

@@ -42,12 +42,28 @@

 - The default kernel package has been updated from 6.12 to 6.18. All supported kernels remain available.

+- The default D-Bus implementation has been switched from `dbus` to `dbus-broker`. dbus-broker provides
+  higher performance and reliability while maintaining compatibility with the D-Bus reference implementation.
+
+  Note that changing `services.dbus.implementation` is a **switch inhibitor**: switching between
+  implementations requires a reboot rather than just `nixos-rebuild switch`, because restarting D-Bus
+  mid-session is unsafe.
+
+  Users who wish to keep the classic daemon can set: `services.dbus.implementation = "dbus";`
+
+- The NixOS integration test driver now supports `systemd-nspawn` containers as an alternative backend to QEMU virtual machines ([#470248](https://github.com/NixOS/nixpkgs/pull/470248), [#478109](https://github.com/NixOS/nixpkgs/pull/478109), [#479968](https://github.com/NixOS/nixpkgs/pull/479968)).
+  Most NixOS integration tests do not require a full VM, and switching them to containers can considerably reduce test time and resource usage.
+  Container-based tests also run fine on Nix builders that are themselves VMs without KVM, and because containers can bind-mount host device nodes, they make it possible to exercise GPU/CUDA workloads from within NixOS integration tests.
+  See [the NixOS manual section on writing tests](https://nixos.org/manual/nixos/stable/#sec-writing-nixos-tests) for details on how to opt in and on the limitations of the container backend.
+
 ## New Modules {#sec-release-26.05-new-modules}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

 - [OpenThread Border Router](https://openthread.io/), a Thread border router for POSIX-based platforms that bridges Thread mesh networks to IP networks. Available as [services.openthread-border-router](#opt-services.openthread-border-router.enable).

+- [Atuin](https://atuin.sh), magical shell history — sync, search and backup your terminal history. Available as [programs.atuin](#opt-programs.atuin.enable).
+
 - [Meshtastic](https://meshtastic.org), an open-source, off-grid, decentralised mesh network
  designed to run on affordable, low-power devices. Available as [services.meshtasticd]
  (#opt-services.meshtasticd.enable).
@@ -64,6 +80,8 @@

 - [reaction](https://reaction.ppom.me/), a daemon that scans program outputs for repeated patterns, and takes action. A common usage is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors. A modern alternative to fail2ban. Available as [services.reaction](#opt-services.reaction.enable).

+- [vinyl-cache] as the Varnish Cache project renamed itself. Available as [services.vinyl-cache](#opt-services.vinyl-cache.enable). To aid the migration, the old `services.varnish` module is still available.
+
 - [papra](https://papra.app/), an open-source document management platform designed to help you organize, secure, and archive your files effortlessly. Available as [services.papra](#opt-services.papra.enable).

 - [rqbit](https://github.com/ikatson/rqbit), a bittorrent client written in Rust. It has HTTP API and Web UI, and can be used as a library. Available as [services.rqbit](#opt-services.rqbit.enable).
@@ -100,6 +118,8 @@

 - [Ente Auth](https://ente.io/auth/), an open source 2FA authenticator, with end-to-end encrypted backups. Available as [programs.ente-auth](#opt-programs.ente-auth.enable).

+- [linkding](https://linkding.link/), a self-hosted bookmark manager designed to be minimal, fast, and easy to set up. Available as [services.linkding](#opt-services.linkding.enable).
+
 - [Tinyauth](https://tinyauth.app/), a simple authentication middleware for web apps, with OAuth and LDAP support. Available as [services.tinyauth](#opt-services.tinyauth.enable).

 - [Strichliste](https://www.strichliste.org), a digital self-service tallysheet used in hackerspaces, clubs and offices. Available as [services.strichliste](#opt-services.strichliste.enable).
@@ -116,6 +136,8 @@

 - [RSSHub](https://github.com/DIYgod/RSSHub), a service to convert many sources into rss. Available as `services.rsshub`.

+- [ReFrame](https://github.com/AlynxZhou/reframe), a DRM/KMS based remote desktop for Linux that supports Wayland/NVIDIA/headless/login.
+
 - [Komodo Periphery](https://github.com/moghtech/komodo), a multi-server Docker and Git deployment agent by Komodo. Available as [services.komodo-periphery](#opt-services.komodo-periphery.enable).

 - [Shoko](https://shokoanime.com), an anime management system. Available as [services.shoko](#opt-services.shoko.enable).
@@ -126,7 +148,9 @@

 - [tabbyAPI](https://github.com/theroyallab/tabbyAPI), the official OpenAI compatible API server for Exllama. Available as [services.tabbyapi](#opt-services.tabbyapi.enable).

- [Tdarr](https://tdarr.io), Audio/Video Library Analytics & Transcode/Remux Automation. Available as [services.tdarr](#opt-services.tdarr.enable)
+- [Tdarr](https://tdarr.io), Audio/Video Library Analytics & Transcode/Remux Automation. Available as [services.tdarr](#opt-services.tdarr.enable).
+
+- [Headplane](https://headplane.net), a feature-complete Web UI for Headscale. Available as [services.headplane](#opt-services.headplane.enable).

 - [whois](https://packages.qa.debian.org/w/whois.html), an intelligent WHOIS client. Available as `programs.whois`.

@@ -147,6 +171,8 @@

 - `services.crabfit` was removed because its upstream packages are unmaintained and insecure.

+- `services.mosquitto` now generates per-listener authentication and access control via the upstream `password-file` and `acl-file` plugins instead of the deprecated `password_file` and `acl_file` options. The plugins contain the same code, so behaviour is unchanged, but [](#opt-services.mosquitto.package) must now be at least version 2.1.
+
 - `sing-box` has been updated to 1.13.0, which has removed some deprecated options.  See [upstream documentation](https://sing-box.sagernet.org/configuration/) for details and migration options.

 - `services.statsd` has been removed because the packages it relies on do not exist anymore in nixpkgs.
@@ -167,6 +193,9 @@

 - `services.uptime` has been removed because the package it relies on does not exist anymore in nixpkgs.

+- `services.mattermost` now defaults to version 11, which has dropped support for MySQL in favor of Postgres. As a result, all support for MySQL has been removed from the module.
+  See the [migration steps](https://docs.mattermost.com/deployment-guide/manual-postgres-migration.html) if you were not running Postgres.
+
 - `post-resume.target` has been removed. See {manpage}`systemd.special(7)` about `sleep.target` for instructions on ordering a process after resume with `ExecStop=`.

 - `services.kubernetes.addons.dns.coredns` has been renamed to `services.kubernetes.addons.dns.corednsImage` and now expects a
@@ -256,6 +285,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 - `ceph` has been upgraded to v20. See the [Ceph "tentacle" release notes](https://docs.ceph.com/en/latest/releases/tentacle/#v20-2-0-tentacle) for details and recommended upgrade procedure.
  Note that **upgrades of server-side components are one-way**, and downgrading e.g. an OSD from *Tentacle* to *Squid* is not just not supported but is known to break.

+- `services.unifi`'s `jrePackage` option now defaults to `jdk25_headless` instead of `jdk17_headless`, in order to be compatible with new versions of `unifi`.
+
 - The `networking.wireless` module has been security hardened by default: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system.

  As part of these changes, `/etc/wpa_supplicant.conf` has been deprecated: the NixOS-generated configuration file is now linked to `/etc/wpa_supplicant/nixos.conf` and `/etc/wpa_supplicant/imperative.conf` has been added for imperatively configuring `wpa_supplicant` or when using [allowAuxiliaryImperativeNetworks](#opt-networking.wireless.allowAuxiliaryImperativeNetworks).
@@ -316,9 +347,17 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

- [hardware.xpadneo](#opt-hardware.xpadneo.enable) now supports configuring kernel module parameters via a freeform [settings](#opt-hardware.xpadneo.settings) option, with convenience options for [rumble attenuation](#opt-hardware.xpadneo.rumbleAttenuation) and [controller quirks](#opt-hardware.xpadneo.quirks).
+- `switch-to-configuration` now reloads a service instead of restarting it when the only change to its unit is `ExecReload=`, and takes no action when `ExecReload=` is removed. Previously both cases triggered a restart.

- The `services.prometheus.exporters` module interface now accepts an optional `socketOpts` attribute, allowing individual exporter modules to describe an accompanying `systemd.sockets.prometheus-${name}-exporter` unit alongside their service, enabling socket activation support.
+- [`hardware.nvidia.branch`](#opt-hardware.nvidia.branch) was added to select the NVIDIA driver branch; setting [`hardware.nvidia.package`](#opt-hardware.nvidia.package) overrides this.
+
+- The NixOS NVIDIA module wiring has been updated to match the new `nvidia-x11` output layout.
+
+- `nixos/nvidia` now uses EGL external platform ICD libraries built from source (`egl-gbm`, `egl-wayland`, `egl-wayland2`, `egl-x11`) instead of relying on vendor-provided binaries for these components.
+
+- `hardware.nvidia.moduleParams` was added to configure NVIDIA kernel module parameters declaratively. These parameters are now written to `modprobe` configuration instead of being passed through global kernel command-line parameters.
+
+- [hardware.xpadneo](#opt-hardware.xpadneo.enable) now supports configuring kernel module parameters via a freeform [settings](#opt-hardware.xpadneo.settings) option, with convenience options for [rumble attenuation](#opt-hardware.xpadneo.rumbleAttenuation) and [controller quirks](#opt-hardware.xpadneo.quirks).

 - Wine has been updated to the 11.0 branch. Please check the [upstream announcement](https://gitlab.winehq.org/wine/wine/-/releases/wine-11.0) for more details.

@@ -337,6 +376,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.

 - Cinnamon has been updated to 6.6, please check the [upstream announcement](https://www.linuxmint.com/rel_zena_whatsnew.php) for more details.

+- Rspamd has been updated to 4.0. Please check the upstream [migration](https://docs.rspamd.com/tutorials/migration/#migration-to-rspamd-400) documentation, especially if you run a sharded Redis deployment.
+
 - Budgie has been updated to 10.10, please check the [upstream announcement](https://buddiesofbudgie.org/blog/budgie-10-10-released) for more details.

 - `fonts.fontconfig.useEmbeddedBitmaps` is now set to `true` by default.
@@ -356,6 +397,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.

 - `systemd.network.*` has been updated to support all configuration options from upstream `networkd` version 259.

+- `networking.resolvconf.enable` now defaults to `true` unconditionally instead of `!(config.environment.etc ? "resolv.conf")`.If you set `environment.etc."resolv.conf"` yourself, then you should also set `networking.resolvconf.enable = false`.
+
 - `services.openssh` now supports generating host SSH keys by setting `services.openssh.generateHostKeys = true` while leaving `services.openssh.enable` disabled.  This is particularly useful for systems that have no need of an SSH daemon but want SSH host keys for other purposes such as using agenix or sops-nix.

 - `services.openssh.enableRecommendedAlgorithms` has been added to allow users to opt out of NixOS's curated set of recommended algorithms. This set to true by default, and thus is not a breaking change. Users may want to set this to false if they prefer upstream's default algorithms. See <https://github.com/NixOS/nixpkgs/pull/471330>.
@@ -278,6 +278,21 @@ rec {
      attr ? ${name} && !(hasPrefix "@" attr.${name})
    ) "Systemd ${group} field `${name}' is not a systemd credential";

+  assertRouteMetricOrTriple =
+    name: group: attr:
+    let
+      isMetric = n: 0 <= n && 4294967295 >= n;
+
+      parts = splitString ":" attr.${name};
+      partsValid =
+        length parts == 3 && all (p: (match "[0-9]+" p) != null && isMetric (toIntBase10 p)) parts;
+      valid = (isInt attr.${name} && isMetric attr.${name}) || partsValid;
+    in
+    optional (attr ? ${name} && !valid) (
+      "Systemd ${group} field `${name}' must either be an integer in the range [0,4294967295]"
+      + " or a string containing three integers separated with `:`"
+    );
+
  checkUnitConfig =
    group: checks: attrs:
    let
@@ -413,6 +413,10 @@ in
      [QuickFairQueueingClass]
      ${attrsToSection def.quickFairQueueingConfigClass}
    ''
+    + optionalString (def.mobileNetworkConfig != { }) ''
+      [MobileNetwork]
+      ${attrsToSection def.mobileNetworkConfig}
+    ''
    + flip concatMapStrings def.bridgeVLANs (x: ''
      [BridgeVLAN]
      ${attrsToSection x}
@@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,

  buildPythonApplication,
  colorama,
@@ -59,6 +60,8 @@ buildPythonApplication {
    socat
    util-linux
    vde2
+  ]
+  ++ lib.optionals stdenv.isLinux [
    vhost-device-vsock
  ]
  ++ lib.optionals enableNspawn [
@@ -315,7 +315,7 @@ class Driver:

        general_symbols = dict(
            start_all=self.start_all,
-            test_script=self.config.test_script,
+            test_script=self.test_script,
            machines=self.machines,
            machines_qemu=self.machines_qemu,
            machines_nspawn=self.machines_nspawn,
@@ -360,8 +360,6 @@ class Driver:
        if not self.config.enable_ssh_backdoor:
            return

-        assert self.vhost_vsock is not None
-
        if self.machines:
            print("SSH backdoor enabled, the machines can be accessed like this:")
            print(
@@ -1,7 +1,7 @@
 {
  config,
  lib,
-  pkgs,
+  hostPkgs,
  ...
 }:
 let
@@ -75,9 +75,9 @@ in
        ) (lib.attrValues config.nodes ++ lib.attrValues config.containers)
      );
      global_timeout = config.globalTimeout;
-      test_script = pkgs.writeText "test-script" config.testScriptString;
+      test_script = hostPkgs.writeText "test-script" config.testScriptString;
      enable_ssh_backdoor = config.sshBackdoor.enable;
    };
-    driverConfigurationFile = pkgs.writers.writeJSON "driverConfiguration.json" config.driverConfiguration;
+    driverConfigurationFile = hostPkgs.writers.writeJSON "driverConfiguration.json" config.driverConfiguration;
  };
 }
@@ -9,6 +9,8 @@ let

  inherit (config) sshBackdoor;

+  inherit (hostPkgs.stdenv.hostPlatform) isLinux;
+
  # Reifies and correctly wraps the python test driver for
  # the respective qemu version and with or without ocr support
  testDriver = config.pythonTestDriverPackage.override {
@@ -251,7 +253,7 @@ in
        # depending on whether debugging is enabled.
        #
        # If needed, this can still be turned off.
-        virtualisation.qemu.enableSharedMemory = lib.mkDefault true;
+        virtualisation.qemu.enableSharedMemory = lib.mkDefault isLinux;

        assertions = [
          {
@@ -3,6 +3,7 @@
  hostPkgs,
  lib,
  containers,
+  nodes,
  options,
  ...
 }:
@@ -28,9 +29,62 @@ let
    */
    f:
    lib.mkOverride (opt.highestPrio - 1) (f opt.value);
+
+  requiredFeaturesModuleType = {
+    freeformType = types.attrsOf types.bool;
+    options = {
+      devnet = mkOption {
+        type = types.bool;
+        default =
+          builtins.length (lib.attrNames containers) > 0 && builtins.length (lib.attrNames nodes) > 0;
+        defaultText = lib.literalMD "`true` if both VMs and containers are present.";
+        description = ''
+          This heuristic setting that assumes that the majority of tests requires VMs and containers
+          to communicate over network. To support such tests, adding "/dev/net" to `nix.settings.extra-sandbox-paths` is necessary.
+
+          Override this to `false` if the heuristic is wrong in some cases.
+        '';
+      };
+      nixos-test = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Standard requirement for NixOS integration tests";
+      };
+      uid-range = mkOption {
+        type = types.bool;
+        default = builtins.length (lib.attrNames containers) > 0;
+        defaultText = lib.literalMD "`true` if containers are present.";
+        description = "Containers use systemd-nspawn, which requires pid 0 inside of the sandbox. `uid-range` enables that.";
+      };
+      kvm = mkOption {
+        type = types.bool;
+        default = isLinux;
+        defaultText = lib.literalMD "`true` if built to run on Linux.";
+        description = "Whether Linux KVM virtualization is required when running this test. Can be disabled to allow emulated execution.";
+      };
+      apple-virt = mkOption {
+        type = types.bool;
+        default = isDarwin;
+        defaultText = lib.literalMD "`true` if built to run on Darwin.";
+        description = "Whether Apple virtualization functionality is required for running this test.";
+      };
+    };
+  };
 in
 {
  options = {
+    requiredFeatures = mkOption {
+      description = "Builder features that are required for running this test.";
+      example = lib.literalExpression ''
+        {
+          cuda = true;
+          devnet = mkForce false;
+        }
+      '';
+      type = types.submodule requiredFeaturesModuleType;
+      default = { }; # this is necessary due to a bug in the module system.
+    };
+
    passthru = mkOption {
      type = types.lazyAttrsOf types.raw;
      description = ''
@@ -98,13 +152,7 @@ in
      {
        name = "vm-test-run-${config.name}";

-        requiredSystemFeatures = [
-          "nixos-test"
-        ]
-        # Containers use systemd-nspawn, which requires pid 0 inside of the sandbox.
-        ++ lib.optional (builtins.length (lib.attrNames containers) > 0) "uid-range"
-        ++ lib.optional isLinux "kvm"
-        ++ lib.optional isDarwin "apple-virt";
+        requiredSystemFeatures = lib.attrNames (lib.filterAttrs (_: v: v) config.requiredFeatures);

        nativeBuildInputs = lib.optionals config.enableDebugHook [
          hostPkgs.openssh
@@ -518,8 +518,7 @@ in

        useEmbeddedBitmaps = lib.mkOption {
          type = lib.types.bool;
-          default = lib.versionAtLeast config.system.stateVersion "26.05";
-          defaultText = lib.literalExpression "lib.versionAtLeast config.system.stateVersion \"26.05\"";
+          default = true;
          description = "Use embedded bitmaps in fonts like Calibri.";
        };

@@ -69,8 +69,7 @@ in

      enable = lib.mkOption {
        type = lib.types.bool;
-        default = !(config.environment.etc ? "resolv.conf");
-        defaultText = lib.literalExpression ''!(config.environment.etc ? "resolv.conf")'';
+        default = true;
        description = ''
          Whether DNS configuration is managed by resolvconf.
        '';
@@ -170,6 +169,17 @@ in
    }

    (lib.mkIf cfg.enable {
+      assertions = [
+        {
+          assertion = !(config.environment.etc ? "resolv.conf");
+          message = ''
+            networking.resolvconf.enable is true but environment.etc."resolv.conf"
+            is also set. Set networking.resolvconf.enable = false if another
+            service manages /etc/resolv.conf.
+          '';
+        }
+      ];
+
      users.groups.resolvconf = { };

      networking.resolvconf.subscriberFiles = [ "/etc/resolv.conf" ];
@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let

  sysctlOption = lib.mkOptionType {
@@ -61,11 +66,32 @@ in

  config = {

-    environment.etc."sysctl.d/60-nixos.conf".text = lib.concatStrings (
-      lib.mapAttrsToList (
-        n: v: lib.optionalString (v != null) "${n}=${if v == false then "0" else toString v}\n"
-      ) config.boot.kernel.sysctl
-    );
+    environment.etc = {
+      "sysctl.d/55-nixos-aslr-entropy.conf".source =
+        pkgs.runCommand "55-nixos-aslr-entropy.conf"
+          {
+            inherit (config.boot.kernelPackages.kernel) configfile;
+          }
+          ''
+            mmap_rnd_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$")
+            if [[ -z "$mmap_rnd_bits_max" ]]; then
+              echo "Unable to determine mmap_rnd_bits_max. Check your kernel configfile is valid."
+              exit 1
+            fi
+            mmap_rnd_compat_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$")
+            if [[ -z "$mmap_rnd_compat_bits_max" ]]; then
+              echo "Unable to determine mmap_rnd_compat_bits_max. Check your kernel configfile is valid."
+              exit 1
+            fi
+            echo "vm.mmap_rnd_bits=$mmap_rnd_bits_max" >> $out
+            echo "vm.mmap_rnd_compat_bits=$mmap_rnd_compat_bits_max" >> $out
+          '';
+      "sysctl.d/60-nixos.conf".text = lib.concatStrings (
+        lib.mapAttrsToList (
+          n: v: lib.optionalString (v != null) "${n}=${if v == false then "0" else toString v}\n"
+        ) config.boot.kernel.sysctl
+      );
+    };

    systemd.services.systemd-sysctl = {
      wantedBy = [ "multi-user.target" ];
@@ -66,6 +66,17 @@
      source = "${config.system.path}/share/terminfo";
    };

+    boot.initrd.systemd.contents = lib.listToAttrs (
+      lib.map
+        (ti: lib.nameValuePair "/etc/terminfo/${ti}" { source = "${pkgs.ncurses}/share/terminfo/${ti}"; })
+        [
+          "l/linux"
+          "v/vt100"
+          "v/vt102"
+          "v/vt220"
+        ]
+    );
+
    environment.profileRelativeSessionVariables = {
      TERMINFO_DIRS = [ "/share/terminfo" ];
    };
@@ -0,0 +1,24 @@
+{ lib, config, ... }:
+let
+  facterLib = import ./lib.nix lib;
+
+  inherit (config.hardware.facter) report;
+  isBaremetal = config.hardware.facter.detected.virtualisation.none.enable;
+  hasAmdCpu = facterLib.hasAmdCpu report;
+
+  kver = config.boot.kernelPackages.kernel.version;
+in
+lib.mkIf (config.hardware.facter.enable && isBaremetal && hasAmdCpu) {
+  boot = lib.mkMerge [
+    (lib.mkIf ((lib.versionAtLeast kver "5.17") && (lib.versionOlder kver "6.1")) {
+      kernelParams = [ "initcall_blacklist=acpi_cpufreq_init" ];
+      kernelModules = [ "amd-pstate" ];
+    })
+    (lib.mkIf ((lib.versionAtLeast kver "6.1") && (lib.versionOlder kver "6.3")) {
+      kernelParams = [ "amd_pstate=passive" ];
+    })
+    (lib.mkIf (lib.versionAtLeast kver "6.3") {
+      kernelParams = [ "amd_pstate=active" ];
+    })
+  ];
+}
@@ -5,6 +5,7 @@
 }:
 {
  imports = [
+    ./amd-cpu.nix
    ./boot.nix
    ./bluetooth.nix
    ./camera
@@ -6,11 +6,10 @@
 }:
 let
  cfg = config.hardware.openrazer;
-  kernelPackages = config.boot.kernelPackages;

  toPyBoolStr = b: if b then "True" else "False";

-  daemonExe = "${pkgs.openrazer-daemon}/bin/openrazer-daemon --config ${daemonConfFile}";
+  daemonExe = "${cfg.packages.daemon}/bin/openrazer-daemon --config ${daemonConfFile}";

  daemonConfFile = pkgs.writeTextFile {
    name = "razer.conf";
@@ -132,6 +131,14 @@ in
          can start and interact with the OpenRazer userspace daemon.
        '';
      };
+
+      packages = {
+        kernel = lib.mkPackageOption pkgs "openrazer kernel" { } // {
+          default = config.boot.kernelPackages.openrazer;
+          defaultText = lib.literalExpression "config.boot.kernelPackages.openrazer";
+        };
+        daemon = lib.mkPackageOption pkgs [ "python3Packages" "openrazer-daemon" ] { };
+      };
    };
  };

@@ -143,14 +150,16 @@ in
  ];

  config = lib.mkIf cfg.enable {
-    boot.extraModulePackages = [ kernelPackages.openrazer ];
+    boot.extraModulePackages = [ cfg.packages.kernel ];
    boot.kernelModules = drivers;

    # Makes the man pages available so you can successfully run
    # > systemctl --user help openrazer-daemon
-    environment.systemPackages = [ pkgs.python3Packages.openrazer-daemon.man ];
+    environment.systemPackages = lib.mkIf (cfg.packages.daemon ? man) [
+      cfg.packages.daemon.man
+    ];

-    services.udev.packages = [ kernelPackages.openrazer ];
+    services.udev.packages = [ cfg.packages.kernel ];
    services.dbus.packages = [ dbusServiceFile ];

    # A user must be a member of the openrazer group in order to start
@@ -93,7 +93,10 @@ in
    ];
    boot.kernelModules = lib.optional useBbswitch "bbswitch";
    boot.extraModulePackages =
-      lib.optional useBbswitch kernel.bbswitch ++ lib.optional useNvidia kernel.nvidia_x11.bin;
+      lib.optional useBbswitch kernel.bbswitch
+      ++ lib.optional useNvidia (
+        if config.hardware.nvidia.open == true then kernel.nvidia_x11.open else kernel.nvidia_x11.mod
+      );

    environment.systemPackages = [
      bumblebee
@@ -6,10 +6,12 @@
 }:
 let
  nvidiaEnabled = lib.elem "nvidia" config.services.xserver.videoDrivers;
-  nvidia_x11 = if nvidiaEnabled || cfg.datacenter.enable then cfg.package else null;
+  nvidia_x11 = if cfg.enabled then cfg.package else null;

  cfg = config.hardware.nvidia;

+  inherit (config.boot.kernelPackages) nvidiaPackages;
+
  useOpenModules = cfg.open == true;

  pCfg = cfg.prime;
@@ -27,7 +29,7 @@ in
      enabled = lib.mkOption {
        readOnly = true;
        type = lib.types.bool;
-        default = nvidia_x11 != null;
+        default = nvidiaEnabled || cfg.datacenter.enable;
        defaultText = lib.literalMD "`true` if NVIDIA support is enabled";
        description = "True if NVIDIA support is enabled";
      };
@@ -296,15 +298,63 @@ in
        It also drastically increases the time the driver needs to clock down after load
      '';

-      package = lib.mkOption {
-        default =
-          config.boot.kernelPackages.nvidiaPackages."${if cfg.datacenter.enable then "dc" else "stable"}";
+      branch = lib.mkOption {
+        type =
+          (lib.types.enum (builtins.attrNames (lib.filterAttrs (_: lib.isDerivation) nvidiaPackages)))
+          // {
+            description = "one of the available driver branches in `pkgs/os-specific/linux/nvidia-x11/default.nix`";
+          };
+        default = if cfg.datacenter.enable then "dc" else "stable";
        defaultText = lib.literalExpression ''
-          config.boot.kernelPackages.nvidiaPackages."\$\{if cfg.datacenter.enable then "dc" else "stable"}"
+          if config.hardware.nvidia.datacenter.enable then "dc" else "stable"
        '';
-        example = "config.boot.kernelPackages.nvidiaPackages.legacy_470";
+        example = "bleeding_edge";
+        description = ''
+          The branch of the NVIDIA driver to use.
+
+          Note: if {option}`hardware.nvidia.package` is set, it overrides this option.
+
+          Commonly interesting branches for end users:
+
+          - production, new_feature, beta:
+            NVIDIA's official production / new feature / beta release branches.
+
+          - stable:
+            The default; the highest stable version.
+
+          - latest:
+            Whichever is newer of `production` and `new_feature`.
+
+          - bleeding_edge:
+            Whichever is newer of `latest` and `beta`.
+
+          - legacy_580:
+            The long-lived 580 series (LTSB), for GPUs that newer driver branches
+            no longer support (often Maxwell through Volta; roughly GeForce GTX 9xx
+            through 10xx, plus rare Volta cards like TITAN V).
+
+          - vulkan_beta:
+            The Vulkan developer beta driver, for users interested in testing new
+            Vulkan features.
+        '';
+      };
+
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = nvidiaPackages.${cfg.branch};
+        defaultText = lib.literalExpression "config.boot.kernelPackages.nvidiaPackages.\${config.hardware.nvidia.branch}";
+        example = lib.literalExpression "config.boot.kernelPackages.nvidiaPackages.legacy_470";
        description = ''
          The NVIDIA driver package to use.
+
+          Prefer using {option}`hardware.nvidia.branch` when possible.
+
+          If you set this option, it is recommended to pick a package from
+          `config.boot.kernelPackages.nvidiaPackages` so the driver build matches
+          your configured kernel.
+
+          For custom versions, you can use `nvidiaPackages.mkDriver`; see
+          `pkgs/os-specific/linux/nvidia-x11/default.nix` for examples.
        '';
      };

@@ -332,6 +382,20 @@ in
      videoAcceleration = lib.mkEnableOption "video acceleration (VA-API)" // {
        default = true;
      };
+
+      moduleParams = lib.mkOption {
+        type = lib.types.attrsOf (lib.types.attrsOf lib.types.raw);
+        default = { };
+        example = ''
+          {
+            nvidia = {
+              NVreg_UsePageAttributeTable = 1;
+              NVreg_RegistryDwords = "EnableBrightnessControl=1"
+            };
+          }
+        '';
+        description = "Additional parameters to pass to the NVIDIA kernel module.";
+      };
    };
  };

@@ -356,6 +420,13 @@ in
                It is suggested to use the open source kernel modules on Turing or later GPUs (RTX series, GTX 16xx), and the closed source modules otherwise.
              '';
            }
+            {
+              assertion = !cfg.open || (nvidia_x11.open != null);
+              message = ''
+                The selected NVIDIA package does not provide open kernel modules.
+                Set hardware.nvidia.open = false or choose a package branch with open module support.
+              '';
+            }
          ];
          boot = {
            blacklistedKernelModules = [
@@ -394,10 +465,52 @@ in
            KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 0'"
            KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm-tools c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 1'"
          '';
-          hardware.graphics = {
-            extraPackages = [ nvidia_x11.out ];
-            extraPackages32 = [ nvidia_x11.lib32 ];
-          };
+          hardware.graphics =
+            let
+              icd = [
+                "egl-wayland"
+              ]
+              # GBM support was added in 495.
+              ++ lib.optionals (lib.versionAtLeast nvidia_x11.version "495") [
+                "egl-gbm"
+              ]
+              # ICDs below use a new driver interface, which is added in the 560 series drivers.
+              ++ lib.optionals (lib.versionAtLeast nvidia_x11.version "560") [
+                "egl-wayland2"
+                "egl-x11"
+              ];
+              combineIcdPkgs =
+                icd: pkgs:
+                pkgs.symlinkJoin {
+                  name = "nvidia-egl-external-platforms${lib.optionalString pkgs.stdenv.is32bit "-x32"}";
+                  paths = lib.attrVals icd pkgs;
+                  # Remediate reversed priorities in pre-595 drivers,
+                  # https://github.com/NixOS/nixpkgs/pull/497342#issuecomment-4034876793
+                  postBuild = lib.optionalString (lib.versionOlder nvidia_x11.version "595") ''
+                    pushd $out/share/egl/egl_external_platform.d
+                    for f in [0-9][0-9]_*; do
+                      num=''${f:0:2}
+                      rest=''${f:2}
+                      new=$(printf "%02d" $((99 - 10#$num)))
+                      mv -- "$f" "tmp-$new$rest"
+                    done
+                    for f in tmp-*; do
+                      mv -- "$f" "''${f#tmp-}"
+                    done
+                    popd
+                  '';
+                };
+            in
+            {
+              extraPackages = [
+                nvidia_x11.out
+                (combineIcdPkgs icd pkgs)
+              ];
+              extraPackages32 = [
+                nvidia_x11.lib32
+                (combineIcdPkgs icd pkgs.pkgsi686Linux)
+              ];
+            };
          environment.systemPackages = [ nvidia_x11.bin ];
        }

@@ -482,6 +595,17 @@ in
                -> (useOpenModules && lib.versionAtLeast nvidia_x11.version "595");
              message = "NVIDIA driver support for kernel suspend notifiers requires NVIDIA driver version 595 or newer, and the open source kernel modules.";
            }
+
+            {
+              assertion =
+                removeAttrs cfg.moduleParams [
+                  "nvidia"
+                  "nvidia-drm"
+                  "nvidia-modeset"
+                  "nvidia-uvm"
+                ] == { };
+              message = "You can only use `hardware.nvidia.moduleParams` to set parameters for the kernel modules of NVIDIA drivers.";
+            }
          ];

          # If Optimus/PRIME is enabled, we:
@@ -673,8 +797,25 @@ in
            lib.optional (nvidia_x11.persistenced != null && config.virtualisation.docker.enableNvidia)
              "L+ /run/nvidia-docker/extras/bin/nvidia-persistenced - - - - ${nvidia_x11.persistenced}/origBin/nvidia-persistenced";

+          hardware.nvidia.moduleParams = lib.mkMerge (
+            lib.optional (offloadCfg.enable || cfg.modesetting.enable) { nvidia-drm.modeset = 1; }
+            ++ lib.optional (
+              (offloadCfg.enable || cfg.modesetting.enable) && lib.versionAtLeast nvidia_x11.version "545"
+            ) { nvidia-drm.fbdev = 1; }
+            ++ lib.optional (cfg.powerManagement.enable && cfg.powerManagement.kernelSuspendNotifier) {
+              nvidia.NVreg_UseKernelSuspendNotifiers = 1;
+            }
+            ++ lib.optional cfg.powerManagement.enable { nvidia.NVreg_PreserveVideoMemoryAllocations = 1; }
+            ++ lib.optional (
+              useOpenModules
+              && lib.versionAtLeast nvidia_x11.version "515.43.04"
+              && lib.versionOlder nvidia_x11.version "545.23.06"
+            ) { nvidia.NVreg_OpenRmEnableUnsupportedGpus = 1; }
+            ++ lib.optional cfg.powerManagement.finegrained { nvidia.NVreg_DynamicPowerManagement = "0x02"; }
+          );
+
          boot = {
-            extraModulePackages = if useOpenModules then [ nvidia_x11.open ] else [ nvidia_x11.bin ];
+            extraModulePackages = if useOpenModules then [ nvidia_x11.open ] else [ nvidia_x11.mod ];
            # nvidia-uvm is required by CUDA applications.
            kernelModules = lib.optionals config.services.xserver.enable [
              "nvidia"
@@ -682,27 +823,16 @@ in
              "nvidia_drm"
            ];

-            # If requested enable modesetting via kernel parameters.
-            kernelParams =
-              lib.optional (offloadCfg.enable || cfg.modesetting.enable) "nvidia-drm.modeset=1"
-              ++ lib.optional (
-                (offloadCfg.enable || cfg.modesetting.enable) && lib.versionAtLeast nvidia_x11.version "545"
-              ) "nvidia-drm.fbdev=1"
-              ++ lib.optional (
-                cfg.powerManagement.enable && cfg.powerManagement.kernelSuspendNotifier
-              ) "nvidia.NVreg_UseKernelSuspendNotifiers=1"
-              ++ lib.optional cfg.powerManagement.enable "nvidia.NVreg_PreserveVideoMemoryAllocations=1"
-              ++ lib.optional (
-                useOpenModules
-                && lib.versionAtLeast nvidia_x11.version "515.43.04"
-                && lib.versionOlder nvidia_x11.version "545.23.06"
-              ) "nvidia.NVreg_OpenRmEnableUnsupportedGpus=1"
-              ++ lib.optional (config.boot.kernelPackages.kernel.kernelAtLeast "6.2" && !ibtSupport) "ibt=off";
+            kernelParams = lib.optional (
+              config.boot.kernelPackages.kernel.kernelAtLeast "6.2" && !ibtSupport
+            ) "ibt=off";

-            # enable finegrained power management
-            extraModprobeConfig = lib.optionalString cfg.powerManagement.finegrained ''
-              options nvidia "NVreg_DynamicPowerManagement=0x02"
-            '';
+            extraModprobeConfig =
+              let
+                mergeParams = lib.concatMapAttrsStringSep " " (k: v: "${k}=${toString v}");
+                genModprobeLine = module: params: "options ${module} ${mergeParams params}";
+              in
+              lib.concatMapAttrsStringSep "\n" genModprobeLine cfg.moduleParams;
          };
          services.udev.extraRules = lib.optionalString cfg.powerManagement.finegrained (
            lib.optionalString (lib.versionOlder config.boot.kernelPackages.kernel.version "5.5") ''
@@ -728,7 +858,7 @@ in
        })
        # Data Center
        (lib.mkIf (cfg.datacenter.enable) {
-          boot.extraModulePackages = [ nvidia_x11.bin ];
+          boot.extraModulePackages = if useOpenModules then [ nvidia_x11.open ] else [ nvidia_x11.mod ];

          systemd = {
            tmpfiles.rules =
@@ -92,7 +92,7 @@ in
            -i ${channelSources} --quiet --option build-use-substitutes false \
            ${lib.optionalString config.boot.initrd.systemd.enable "--option sandbox false"} # There's an issue with pivot_root
          mkdir -m 0700 -p /root/.nix-defexpr
-          ln -s /nix/var/nix/profiles/per-user/root/channels /root/.nix-defexpr/channels
+          ln -sfvT /nix/var/nix/profiles/per-user/root/channels /root/.nix-defexpr/channels
          mkdir -m 0755 -p /var/lib/nixos
          touch /var/lib/nixos/did-channel-init
        fi
@@ -136,19 +136,21 @@ let
          libPath = filter (pkgs.path + "/lib");
          pkgsLibPath = filter (pkgs.path + "/pkgs/pkgs-lib");
          nixosPath = filteredModules + "/nixos";
-          NIX_ABORT_ON_WARN = warningsAreErrors;
+          env.NIX_ABORT_ON_WARN = warningsAreErrors;
          modules =
            "[ "
            + concatMapStringsSep " " (p: ''"${removePrefix "${modulesPath}/" (toString p)}"'') docModules.lazy
            + " ]";
-          passAsFile = [ "modules" ];
          disallowedReferences = [
            filteredModules
            libPath
            pkgsLibPath
          ];
+          __structuredAttrs = true;
        }
        ''
+          modulesPath="$TMPDIR/modules"
+          printf "%s" "$modules" > "$modulesPath"
          export NIX_STORE_DIR=$TMPDIR/store
          export NIX_STATE_DIR=$TMPDIR/state
          ${pkgs.buildPackages.nix}/bin/nix-instantiate \
@@ -168,6 +168,7 @@
  ./programs/appimage.nix
  ./programs/arp-scan.nix
  ./programs/atop.nix
+  ./programs/atuin.nix
  ./programs/ausweisapp.nix
  ./programs/autoenv.nix
  ./programs/autojump.nix
@@ -691,6 +692,7 @@
  ./services/hardware/nvidia-optimus.nix
  ./services/hardware/openrgb.nix
  ./services/hardware/pcscd.nix
+  ./services/hardware/pdudaemon.nix
  ./services/hardware/pid-fan-controller.nix
  ./services/hardware/pommed.nix
  ./services/hardware/power-profiles-daemon.nix
@@ -726,6 +728,7 @@
  ./services/home-automation/esphome.nix
  ./services/home-automation/evcc.nix
  ./services/home-automation/govee2mqtt.nix
+  ./services/home-automation/home-assistant-matter-hub.nix
  ./services/home-automation/home-assistant.nix
  ./services/home-automation/homebridge.nix
  ./services/home-automation/matter-server.nix
@@ -1210,7 +1213,6 @@
  ./services/networking/geph.nix
  ./services/networking/ghostunnel.nix
  ./services/networking/git-daemon.nix
-  ./services/networking/globalprotect-vpn.nix
  ./services/networking/gns3-server.nix
  ./services/networking/gnunet.nix
  ./services/networking/go-autoconfig.nix
@@ -1224,6 +1226,7 @@
  ./services/networking/hans.nix
  ./services/networking/haproxy.nix
  ./services/networking/harmonia.nix
+  ./services/networking/headplane.nix
  ./services/networking/headscale.nix
  ./services/networking/hickory-dns.nix
  ./services/networking/hostapd.nix
@@ -1306,6 +1309,7 @@
  ./services/networking/netbird.nix
  ./services/networking/netbird/server.nix
  ./services/networking/netclient.nix
+  ./services/networking/netfoil.nix
  ./services/networking/networkd-dispatcher.nix
  ./services/networking/networkmanager.nix
  ./services/networking/newt.nix
@@ -1318,6 +1322,7 @@
  ./services/networking/nix-store-gcs-proxy.nix
  ./services/networking/nixops-dns.nix
  ./services/networking/nm-file-secret-agent.nix
+  ./services/networking/nmtrust.nix
  ./services/networking/nncp.nix
  ./services/networking/nntp-proxy.nix
  ./services/networking/nomad.nix
@@ -1698,6 +1703,7 @@
  ./services/web-apps/librespeed.nix
  ./services/web-apps/libretranslate.nix
  ./services/web-apps/limesurvey.nix
+  ./services/web-apps/linkding.nix
  ./services/web-apps/linkwarden.nix
  ./services/web-apps/lubelogger.nix
  ./services/web-apps/mainsail.nix
@@ -1837,6 +1843,7 @@
  ./services/web-servers/unit/default.nix
  ./services/web-servers/uwsgi.nix
  ./services/web-servers/varnish/default.nix
+  ./services/web-servers/vinyl-cache/default.nix
  ./services/x11/clight.nix
  ./services/x11/colord.nix
  ./services/x11/desktop-managers/default.nix
@@ -138,10 +138,6 @@ in
    #
    # TODO(winter): Move to qemu-vm? Trying it here for now as a
    # low impact change that'll probably improve people's experience.
-    #
-    # (I have no clue what is going on in https://github.com/nix-darwin/nix-darwin/issues/1081
-    # though, as this fix would only apply to one person in that thread... hopefully someone
-    # comes across with a reproducer if this doesn't do it.)
    system.systemBuilderArgs.allowSubstitutes = true;

    nix.settings = {
@@ -251,6 +247,9 @@ in
      # To prevent gratuitous rebuilds on each change to Nixpkgs
      nixos.revision = null;

+      # To prevent channels and Git checkouts resulting in different system drvs
+      nixos.versionSuffix = "";
+
      # to be updated by module maintainers, see nixpkgs#325610
      stateVersion = "24.05";
    };
@@ -0,0 +1,195 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) escapeShellArgs;
+
+  cfg = config.programs.atuin;
+
+  tomlFormat = pkgs.formats.toml { };
+
+  settingsFile = tomlFormat.generate "atuin-config" cfg.settings;
+in
+{
+  options.programs.atuin = {
+    enable = lib.mkEnableOption "atuin";
+
+    package = lib.mkPackageOption pkgs "atuin" { };
+
+    enableBashIntegration = lib.mkEnableOption "Bash integration" // {
+      default = config.programs.bash.enable;
+      defaultText = lib.literalExpression "config.programs.bash.enable";
+    };
+
+    enableZshIntegration = lib.mkEnableOption "Zsh integration" // {
+      default = config.programs.zsh.enable;
+      defaultText = lib.literalExpression "config.programs.zsh.enable";
+    };
+
+    enableFishIntegration = lib.mkEnableOption "Fish integration" // {
+      default = config.programs.fish.enable;
+      defaultText = lib.literalExpression "config.programs.fish.enable";
+    };
+
+    flags = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [
+        "--disable-up-arrow"
+        "--disable-ctrl-r"
+      ];
+      description = ''
+        Flags to append to the shell hook.
+      '';
+    };
+
+    settings = lib.mkOption {
+      type = tomlFormat.type;
+      default = { };
+      example = lib.literalExpression ''
+        {
+          auto_sync = true;
+          sync_frequency = "5m";
+          sync_address = "https://api.atuin.sh";
+          search_mode = "prefix";
+        }
+      '';
+      description = ''
+        Configuration written to {file}`/etc/atuin/config.toml`.
+
+        See <https://docs.atuin.sh/configuration/config/> for the full list
+        of options.
+      '';
+    };
+
+    daemon = {
+      enable = lib.mkEnableOption "the Atuin daemon" // {
+        default = pkgs.stdenv.hostPlatform.isLinux;
+        defaultText = lib.literalExpression "pkgs.stdenv.hostPlatform.isLinux";
+      };
+
+      logLevel = lib.mkOption {
+        type = lib.types.enum [
+          "trace"
+          "debug"
+          "info"
+          "warn"
+          "error"
+        ];
+        default = "info";
+        description = ''
+          Log level for the Atuin daemon.
+        '';
+      };
+    };
+
+    themes = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.oneOf [
+          tomlFormat.type
+          lib.types.path
+          lib.types.lines
+        ]
+      );
+      description = ''
+        Each theme is written to
+        {file}`/etc/atuin/themes/theme-name.toml`
+        where the name of each attribute is the theme-name
+
+        See <https://docs.atuin.sh/guide/theming/> for the full list
+        of options.
+      '';
+      default = { };
+      example = lib.literalExpression ''
+        {
+          "my-theme" = {
+            theme.name = "My Theme";
+            colors = {
+              Base = "#000000";
+              Title = "#FFFFFF";
+            };
+          };
+        }
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    # Atuin only reads from ATUIN_CONFIG_DIR or XDG_CONFIG_HOME, not XDG_CONFIG_DIRS,
+    # so we must set ATUIN_CONFIG_DIR to point to the system-wide config location.
+    environment.variables.ATUIN_CONFIG_DIR = "/etc/atuin";
+
+    environment.etc = lib.mkMerge [
+      (lib.mkIf (cfg.settings != { }) {
+        "atuin/config.toml".source = settingsFile;
+      })
+
+      (lib.mkIf (cfg.themes != { }) (
+        builtins.mapAttrs' (
+          name: theme:
+          lib.nameValuePair "atuin/themes/${name}.toml" {
+            source =
+              if builtins.isString theme then
+                pkgs.writeText "atuin-theme-${name}" theme
+              else if builtins.isPath theme || lib.isStorePath theme then
+                theme
+              else
+                tomlFormat.generate "atuin-theme-${name}" theme;
+          }
+        ) cfg.themes
+      ))
+    ];
+
+    programs.bash.interactiveShellInit = lib.mkIf cfg.enableBashIntegration ''
+      if [[ :$SHELLOPTS: =~ :(vi|emacs): ]]; then
+        eval "$(${lib.getExe cfg.package} init bash ${escapeShellArgs cfg.flags})"
+      fi
+    '';
+
+    programs.zsh.interactiveShellInit = lib.mkIf cfg.enableZshIntegration ''
+      if [[ $options[zle] = on ]]; then
+        eval "$(${lib.getExe cfg.package} init zsh ${escapeShellArgs cfg.flags})"
+      fi
+    '';
+
+    programs.fish.interactiveShellInit = lib.mkIf cfg.enableFishIntegration ''
+      ${lib.getExe cfg.package} init fish ${escapeShellArgs cfg.flags} | source
+    '';
+
+    systemd = lib.mkIf (cfg.daemon.enable && pkgs.stdenv.hostPlatform.isLinux) {
+      user.services.atuin-daemon = {
+        unitConfig = {
+          Description = "Atuin daemon";
+          Requires = [ "atuin-daemon.socket" ];
+        };
+        serviceConfig = {
+          ExecStart = "${lib.getExe cfg.package} daemon start";
+          Environment = [ "ATUIN_LOG=${cfg.daemon.logLevel}" ];
+          Restart = "on-failure";
+          RestartSteps = 3;
+          RestartMaxDelaySec = 6;
+        };
+      };
+
+      user.sockets.atuin-daemon = {
+        unitConfig = {
+          Description = "Atuin daemon socket";
+        };
+        socketConfig = {
+          ListenStream = "%t/atuin/atuin.sock";
+          SocketMode = "0640";
+          DirectoryMode = "0740";
+          RemoveOnStop = true;
+        };
+        wantedBy = [ "sockets.target" ];
+      };
+    };
+  };
+
+  meta.maintainers = cfg.package.meta.maintainers;
+}
@@ -5,9 +5,9 @@
  ...
 }:
 let
-  inherit (builtins) isList elem;
+  inherit (builtins) isList;
  inherit (lib)
-    getExe
+    concatMapStrings
    literalExpression
    maintainers
    mapAttrs'
@@ -36,33 +36,6 @@ let
      boolToString value
    else
      toString value;
-
-  initScript =
-    {
-      program,
-      shell,
-      flags ? [ ],
-    }:
-    if (shell != "fish") then
-      ''
-        eval "$(${getExe program} ${toString flags})"
-      ''
-    else
-      ''
-        ${getExe program} ${toString flags} | source
-      '';
-
-  shellInit =
-    shell:
-    optionalString (elem pkgs.bat-extras.batpipe cfg.extraPackages) (initScript {
-      program = pkgs.bat-extras.batpipe;
-      inherit shell;
-    })
-    + optionalString (elem pkgs.bat-extras.batman cfg.extraPackages) (initScript {
-      program = pkgs.bat-extras.batman;
-      inherit shell;
-      flags = [ "--export-env" ];
-    });
 in
 {
  options.programs.bat = {
@@ -112,17 +85,21 @@ in
      );
    };

-    programs = {
-      bash = mkIf (!config.programs.fish.enable) {
-        interactiveShellInit = shellInit "bash";
+    programs =
+      let
+        shellInit = shell: concatMapStrings (pkg: pkg.shellInit shell) cfg.extraPackages;
+      in
+      {
+        bash = mkIf (!config.programs.fish.enable) {
+          interactiveShellInit = shellInit "bash";
+        };
+        fish = mkIf config.programs.fish.enable {
+          interactiveShellInit = shellInit "fish";
+        };
+        zsh = mkIf (!config.programs.fish.enable && config.programs.zsh.enable) {
+          interactiveShellInit = shellInit "zsh";
+        };
      };
-      fish = mkIf config.programs.fish.enable {
-        interactiveShellInit = shellInit "fish";
-      };
-      zsh = mkIf (!config.programs.fish.enable && config.programs.zsh.enable) {
-        interactiveShellInit = shellInit "zsh";
-      };
-    };
  };
  meta.maintainers = with maintainers; [ sigmasquadron ];
 }
@@ -61,7 +61,7 @@ in
  config = lib.mkMerge [
    {
      programs.command-not-found = {
-        enable = lib.mkOptionDefault (builtins.pathExists cfg.dbPath);
+        enable = lib.mkDefault (builtins.pathExists cfg.dbPath);
        dbPath = pkgs.path + "/programs.sqlite";
      };
    }
@@ -199,16 +199,16 @@ in
            ''
          else
            indentFishFile "nixos-env-preinit.fish" ''
-              # This happens before $__fish_datadir/config.fish sets fish_function_path, so it is currently
-              # unset. We set it and then completely erase it, leaving its configuration to $__fish_datadir/config.fish
-              set fish_function_path ${pkgs.fishPlugins.foreign-env}/share/fish/vendor_functions.d $__fish_datadir/functions
+              # This happens before embedded:config.fish sets fish_function_path, so it is currently
+              # unset. We set it and then completely erase it, leaving its configuration to embedded:config.fish
+              set fish_function_path ${pkgs.fishPlugins.foreign-env}/share/fish/vendor_functions.d

              # source the NixOS environment config
              if [ -z "$__NIXOS_SET_ENVIRONMENT_DONE" ]
                fenv source ${config.system.build.setEnvironment}
              end

-              # clear fish_function_path so that it will be correctly set when we return to $__fish_datadir/config.fish
+              # clear fish_function_path so that it will be correctly set when we return to embedded:config.fish
              set -e fish_function_path
            '';
      }
@@ -301,11 +301,20 @@ in
                    find -L $package/share/man -type f | xargs ${pkgs.python3.pythonOnBuildForHost.interpreter} ${patchedGenerator}/create_manpage_completions.py --directory $out >/dev/null
                  fi
                '';
+            packages =
+              if
+                config.documentation.enable && config.documentation.nixos.enable && config.documentation.man.enable
+              then
+                builtins.filter (pkg: pkg != config.system.build.manual.nixos-configuration-reference-manpage) (
+                  cfge.systemPackages ++ cfg.extraCompletionPackages
+                )
+              else
+                cfge.systemPackages ++ cfg.extraCompletionPackages;
          in
          pkgs.buildEnv {
            name = "system_fish-completions";
            ignoreCollisions = true;
-            paths = map generateCompletions (config.environment.systemPackages ++ cfg.extraCompletionPackages);
+            paths = map generateCompletions packages;
          };
      })

@@ -76,12 +76,6 @@ in
        [ ];

    assertions = [
-      # Not strictly required but probably a good assertion to have
-      {
-        assertion = cfg.clean.enable -> cfg.enable;
-        message = "programs.nh.clean.enable requires programs.nh.enable";
-      }
-
      {
        assertion = (cfg.flake != null) -> !(lib.hasSuffix ".nix" cfg.flake);
        message = "nh.flake must be a directory, not a nix file";
@@ -25,7 +25,10 @@ in
  config = lib.mkIf cfg.enable {
    environment.systemPackages = [ cfg.package ];
    networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedUDPPorts = [ 5678 ];
+      allowedUDPPorts = [
+        5678
+        20561
+      ];
      allowedUDPPortRanges = [
        {
          from = 40000;
@@ -214,6 +214,13 @@ in
    ] "The fourStoreEndpoint module has been removed")
    (mkRemovedOptionModule [ "services" "fprot" ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [ "services" "frab" ] "The frab module has been removed")
+    (mkRemovedOptionModule
+      [
+        "services"
+        "globalprotect"
+      ]
+      "The corresponding package was removed from nixpkgs, as it depended on qt5 webengine. A replacements based on tauri exist upstream, but requires non-trivial maintainance in nixpkgs to update."
+    )
    (mkRemovedOptionModule
      [
        "services"
@@ -677,10 +677,6 @@ let
      };
    in
    {
-      imports = [
-        (lib.mkRenamedOptionModule [ "credentialsFile" ] [ "environmentFile" ])
-      ];
-
      options = {
        validMinDays = lib.mkOption {
          type = lib.types.nullOr lib.types.int;
@@ -143,68 +143,81 @@ in
    };
  };

-  config = lib.mkIf (cfg.enable && cfg.stateful) {
-    systemd.services = {
-      dhparams-init = {
-        description = "Clean Up Old Diffie-Hellman Parameters";
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      warnings = [
+        ''
+          The `security.dhparam` module is deprecated and scheduled for removal in NixOS 26.11.
+          Generating your own params has been shown to be problematic in RFC 7919 (2016).

-        # Clean up even when no DH params is set
-        wantedBy = [ "multi-user.target" ];
+          Remove any uses of DHE and migrate to ECDHE (RFC 8422, 2018) and
+          Hybrid PQ (draft-ietf-tls-ecdhe-mlkem, 2026) key exchange algorithms.
+        ''
+      ];
+    })
+    (lib.mkIf (cfg.enable && cfg.stateful) {
+      systemd.services = {
+        dhparams-init = {
+          description = "Clean Up Old Diffie-Hellman Parameters";

-        serviceConfig.RemainAfterExit = true;
-        serviceConfig.Type = "oneshot";
+          # Clean up even when no DH params is set
+          wantedBy = [ "multi-user.target" ];

-        script = ''
-          if [ ! -d ${cfg.path} ]; then
-            mkdir -p ${cfg.path}
-          fi
+          serviceConfig.RemainAfterExit = true;
+          serviceConfig.Type = "oneshot";

-          # Remove old dhparams
-          for file in ${cfg.path}/*; do
-            if [ ! -f "$file" ]; then
-              continue
+          script = ''
+            if [ ! -d ${cfg.path} ]; then
+              mkdir -p ${cfg.path}
            fi
-            ${lib.concatStrings (
-              lib.mapAttrsToList (
-                name:
-                { bits, path, ... }:
-                ''
-                  if [ "$file" = ${lib.escapeShellArg path} ] && \
-                     ${pkgs.openssl}/bin/openssl dhparam -in "$file" -text \
-                     | head -n 1 | grep "(${toString bits} bit)" > /dev/null; then
-                    continue
-                  fi
-                ''
-              ) cfg.params
-            )}
-            rm "$file"
-          done

-          # TODO: Ideally this would be removing the *former* cfg.path, though
-          # this does not seem really important as changes to it are quite
-          # unlikely
-          rmdir --ignore-fail-on-non-empty ${cfg.path}
-        '';
-      };
-    }
-    // lib.mapAttrs' (
-      name:
-      { bits, path, ... }:
-      lib.nameValuePair "dhparams-gen-${name}" {
-        description = "Generate Diffie-Hellman Parameters for ${name}";
-        after = [ "dhparams-init.service" ];
-        before = [ "${name}.service" ];
-        requiredBy = [ "${name}.service" ];
-        wantedBy = [ "multi-user.target" ];
-        unitConfig.ConditionPathExists = "!${path}";
-        serviceConfig.Type = "oneshot";
-        script = ''
-          mkdir -p ${lib.escapeShellArg cfg.path}
-          ${pkgs.openssl}/bin/openssl dhparam -out ${lib.escapeShellArg path} \
-            ${toString bits}
-        '';
+            # Remove old dhparams
+            for file in ${cfg.path}/*; do
+              if [ ! -f "$file" ]; then
+                continue
+              fi
+              ${lib.concatStrings (
+                lib.mapAttrsToList (
+                  name:
+                  { bits, path, ... }:
+                  ''
+                    if [ "$file" = ${lib.escapeShellArg path} ] && \
+                       ${pkgs.openssl}/bin/openssl dhparam -in "$file" -text \
+                       | head -n 1 | grep "(${toString bits} bit)" > /dev/null; then
+                      continue
+                    fi
+                  ''
+                ) cfg.params
+              )}
+              rm "$file"
+            done
+
+            # TODO: Ideally this would be removing the *former* cfg.path, though
+            # this does not seem really important as changes to it are quite
+            # unlikely
+            rmdir --ignore-fail-on-non-empty ${cfg.path}
+          '';
+        };
      }
-    ) cfg.params;
-  };
+      // lib.mapAttrs' (
+        name:
+        { bits, path, ... }:
+        lib.nameValuePair "dhparams-gen-${name}" {
+          description = "Generate Diffie-Hellman Parameters for ${name}";
+          after = [ "dhparams-init.service" ];
+          before = [ "${name}.service" ];
+          requiredBy = [ "${name}.service" ];
+          wantedBy = [ "multi-user.target" ];
+          unitConfig.ConditionPathExists = "!${path}";
+          serviceConfig.Type = "oneshot";
+          script = ''
+            mkdir -p ${lib.escapeShellArg cfg.path}
+            ${pkgs.openssl}/bin/openssl dhparam -out ${lib.escapeShellArg path} \
+              ${toString bits}
+          '';
+        }
+      ) cfg.params;
+    })
+  ];

 }
@@ -55,6 +55,7 @@ in

      settings = lib.mkOption {
        inherit (settingsFormat) type;
+        default = { };
        example.mpd = {
          enabled = true;
          hostname = "::";
@@ -47,7 +47,7 @@ in
    includeFileList = lib.mkOption {
      type = lib.types.nullOr lib.types.path;
      default = null;
-      example = /path/to/fileList.txt;
+      example = "/path/to/fileList.txt";
      description = ''
        File containing newline-separated list of paths to include into the
        backups. See the FILE SELECTION section in {manpage}`duplicity(1)` for
@@ -58,7 +58,7 @@ in
    excludeFileList = lib.mkOption {
      type = lib.types.nullOr lib.types.path;
      default = null;
-      example = /path/to/fileList.txt;
+      example = "/path/to/fileList.txt";
      description = ''
        File containing newline-separated list of paths to exclude into the
        backups. See the FILE SELECTION section in {manpage}`duplicity(1)` for
@@ -94,7 +94,7 @@ in
          ${lib.optionalString cfg.appendOnly "--append-only"} \
          ${lib.optionalString cfg.privateRepos "--private-repos"} \
          ${lib.optionalString cfg.prometheus "--prometheus"} \
-          ${lib.escapeShellArgs cfg.extraFlags} \
+          ${lib.escapeShellArgs cfg.extraFlags}
        '';
        Type = "simple";
        User = "restic";
@@ -360,7 +360,7 @@ in
        ${lib.optionalString haveLocalDB ''
          if ! [ -e ${baseDir}/.db-created ]; then
            runuser -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createuser hydra
-            runuser -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createdb -- -O hydra hydra
+            runuser -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createdb -O hydra hydra
            touch ${baseDir}/.db-created
          fi
          echo "create extension if not exists pg_trgm" | runuser -u ${config.services.postgresql.superUser} -- ${config.services.postgresql.package}/bin/psql hydra
@@ -81,7 +81,7 @@ in
                };
                description = ''
                  Configuration of radicle-native-ci.
-                  See <https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z3qg5TKmN83afz2fj9z3fQjU8vaYE#configuration> for more information.
+                  See <https://radicle.network/nodes/seed.radicle.dev/rad:z3qg5TKmN83afz2fj9z3fQjU8vaYE#configuration> for more information.
                '';
                default = { };
              };
@@ -135,7 +135,7 @@ in
      };
      description = ''
        Configuration of radicle-ci-broker.
-        See <https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:zwTxygwuz5LDGBq255RA2CbNGrz8/tree/doc/userguide.md#configuration> for more information.
+        See <https://radicle.network/nodes/seed.radicle.dev/rad:zwTxygwuz5LDGBq255RA2CbNGrz8/tree/doc/userguide.md#configuration> for more information.
      '';
      default = { };
      example = lib.literalExpression ''
@@ -16,7 +16,7 @@ let
      ''
        mkdir -p $out/bin
        makeWrapper ${cfg.package}/bin/dgraph $out/bin/dgraph \
-          --prefix PATH : "${lib.makeBinPath [ pkgs.nodejs ]}" \
+          --prefix PATH : "${lib.makeBinPath [ pkgs.nodejs ]}"
      '';
  securityOptions = {
    NoNewPrivileges = true;
@@ -5,7 +5,7 @@
  ...
 }:
 let
-  toml = pkgs.formats.toml { };
+  gitIni = pkgs.formats.gitIni { };
  cfg = config.services.dunst;
 in
 {
@@ -22,7 +22,7 @@ in
    };

    settings = lib.mkOption {
-      type = toml.type;
+      type = gitIni.type;
      default = { };
      description = "Dunst configuration, see dunst(5)";
      example = lib.literalExpression ''
@@ -69,7 +69,7 @@ in

    environment = {
      systemPackages = [ cfg.package ];
-      etc."xdg/dunst/dunstrc".source = toml.generate "dunstrc" cfg.settings;
+      etc."xdg/dunst/dunstrc".source = gitIni.generate "dunstrc" cfg.settings;
    };

    services.dbus.packages = [ cfg.package ];
@@ -73,7 +73,9 @@ in
      extraGroups = [ "video" ];
    };
    # Required for authentication
-    security.pam.services.cosmic-greeter = { };
+    security.pam.services.cosmic-greeter = {
+      allowNullPassword = true;
+    };

    hardware.graphics.enable = true;
    services.accounts-daemon.enable = true;
@@ -0,0 +1,146 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.pdudaemon;
+  configFile = pkgs.writeText "pdudaemon.conf" (
+    lib.generators.toJSON { } {
+      daemon = {
+        hostname = cfg.bindAddress;
+        port = cfg.port;
+        logging_level = cfg.logLevel;
+        listener = cfg.listener;
+      };
+      pdus = cfg.pdus;
+    }
+  );
+in
+{
+  meta = {
+    maintainers = with lib.maintainers; [
+      aiyion
+      emantor
+    ];
+  };
+
+  options = {
+    services.pdudaemon = {
+      enable = lib.mkEnableOption "PDUDaemon";
+
+      package = lib.mkPackageOption pkgs "pdudaemon" { };
+
+      bindAddress = lib.mkOption {
+        default = "0.0.0.0";
+        type = lib.types.str;
+        description = "Bind address for the PDUDaemon.";
+      };
+
+      port = lib.mkOption {
+        default = 16421;
+        type = lib.types.port;
+        description = "Port to bind to.";
+      };
+
+      openFirewall = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Whether to automatically open the PDUDaemon listen port in the firewall.
+        '';
+      };
+
+      listener = lib.mkOption {
+        default = "http";
+        type = lib.types.enum [
+          "http"
+          "tcp"
+        ];
+        description = "Which kind of listener to provide.";
+      };
+
+      logLevel = lib.mkOption {
+        default = "error";
+        type = lib.types.enum [
+          "debug"
+          "info"
+          "warning"
+          "error"
+        ];
+        description = "PDUDaemon log level.";
+      };
+
+      pdus = lib.mkOption {
+        type = with lib.types; attrsOf anything;
+        default = { };
+        description = ''
+          Structural pdus section of PDUDaemon's pdudaemon.conf.
+          Refer to <https://github.com/pdudaemon/pdudaemon/blob/main/share/pdudaemon.conf>
+          for more examples.
+        '';
+        example = lib.literalExpression ''
+          {
+            cbs350-poe-switch = {
+              driver = "snmpv1";
+              community = "private";
+              oid = ".1.3.6.1.2.1.105.1.1.1.3.1.*;
+              onsetting = 1;
+              offsetting = 2;
+            };
+            energenie = {
+              driver = "EG-PMS";
+              device = "aa:bb:cc:xx:yy";
+            };
+            local = {
+              driver = "localcmdline";
+            };
+          };
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
+
+    systemd.services.pdudaemon = {
+      after = [ "network-online.target" ];
+      description = "Control and Queueing daemon for PDUs";
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} --conf ${configFile}";
+        Type = "simple";
+        DynamicUser = "yes";
+        StateDirectory = "pdudaemon";
+        ProtectHome = true;
+        Restart = "on-failure";
+        CapabilityBoundingSet = "";
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+        SystemCallArchitectures = "native";
+        MemoryDenyWriteExecute = true;
+        RestrictNamespaces = true;
+        ProtectHostname = true;
+        LockPersonality = true;
+        ProtectKernelTunables = true;
+        RestrictRealtime = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        PrivateUsers = true;
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+      };
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+    };
+  };
+}
@@ -6,183 +6,70 @@
 }:
 let
  cfg = config.services.pid-fan-controller;
-  heatSource = {
-    options = {
-      name = lib.mkOption {
-        type = lib.types.uniq lib.types.nonEmptyStr;
-        description = "Name of the heat source.";
-      };
-      wildcardPath = lib.mkOption {
-        type = lib.types.nonEmptyStr;
-        description = ''
-          Path of the heat source's `hwmon` `temp_input` file.
-          This path can contain multiple wildcards, but has to resolve to
-          exactly one result.
-        '';
-      };
-      pidParams = {
-        setPoint = lib.mkOption {
-          type = lib.types.ints.unsigned;
-          description = "Set point of the controller in °C.";
-        };
-        P = lib.mkOption {
-          description = "K_p of PID controller.";
-          type = lib.types.float;
-        };
-        I = lib.mkOption {
-          description = "K_i of PID controller.";
-          type = lib.types.float;
-        };
-        D = lib.mkOption {
-          description = "K_d of PID controller.";
-          type = lib.types.float;
-        };
-      };
-    };
-  };
-
-  fan = {
-    options = {
-      wildcardPath = lib.mkOption {
-        type = lib.types.str;
-        description = ''
-          Wildcard path of the `hwmon` `pwm` file.
-          If the fans are not to be found in `/sys/class/hwmon/hwmon*` the corresponding
-          kernel module (like `nct6775`) needs to be added to `boot.kernelModules`.
-          See the [`hwmon` Documentation](https://www.kernel.org/doc/html/latest/hwmon/index.html).
-        '';
-      };
-      minPwm = lib.mkOption {
-        default = 0;
-        type = lib.types.ints.u8;
-        description = "Minimum PWM value.";
-      };
-      maxPwm = lib.mkOption {
-        default = 255;
-        type = lib.types.ints.u8;
-        description = "Maximum PWM value.";
-      };
-      cutoff = lib.mkOption {
-        default = false;
-        type = lib.types.bool;
-        description = "Whether to stop the fan when `minPwm` is reached.";
-      };
-      heatPressureSrcs = lib.mkOption {
-        type = lib.types.nonEmptyListOf lib.types.str;
-        description = "Heat pressure sources affected by the fan.";
-      };
-    };
-  };
+  settingsFormat = pkgs.formats.json { };
 in
 {
  options.services.pid-fan-controller = {
    enable = lib.mkEnableOption "the PID fan controller, which controls the configured fans by running a closed-loop PID control loop";
    package = lib.mkPackageOption pkgs "pid-fan-controller" { };
-    settings = {
-      interval = lib.mkOption {
-        default = 500;
-        type = lib.types.int;
-        description = "Interval between controller cycles in milliseconds.";
-      };
-      heatSources = lib.mkOption {
-        type = lib.types.listOf (lib.types.submodule heatSource);
-        description = "List of heat sources to be monitored.";
-        example = ''
-          [
-            {
-              name = "cpu";
-              wildcardPath = "/sys/devices/pci0000:00/0000:00:18.3/hwmon/hwmon*/temp1_input";
-              pidParams = {
-                setPoint = 60;
-                P = -5.0e-3;
-                I = -2.0e-3;
-                D = -6.0e-3;
-              };
-            }
-          ];
-        '';
-      };
-      fans = lib.mkOption {
-        type = lib.types.listOf (lib.types.submodule fan);
-        description = "List of fans to be controlled.";
-        example = ''
-          [
-            {
-              wildcardPath = "/sys/devices/platform/nct6775.2592/hwmon/hwmon*/pwm1";
-              minPwm = 60;
-              maxPwm = 255;
-              heatPressureSrcs = [
-                "cpu"
-                "gpu"
-              ];
-            }
-          ];
-        '';
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = lib.types.either settingsFormat.type (lib.types.listOf settingsFormat.type);
      };
+      default = { };
+      description = ''
+        Configuration for pid-fan-controller, see
+        <https://github.com/zimward/pid-fan-controller>
+        for supported values.
+      '';
    };
  };
-  config = lib.mkIf cfg.enable {
-    #map camel cased attrs into snake case for config
-    environment.etc."pid-fan-settings.json".text = builtins.toJSON {
-      interval = cfg.settings.interval;
-      heat_srcs = map (heatSrc: {
-        name = heatSrc.name;
-        wildcard_path = heatSrc.wildcardPath;
-        PID_params = {
-          set_point = heatSrc.pidParams.setPoint;
-          P = heatSrc.pidParams.P;
-          I = heatSrc.pidParams.I;
-          D = heatSrc.pidParams.D;
-        };
-      }) cfg.settings.heatSources;
-      fans = map (fan: {
-        wildcard_path = fan.wildcardPath;
-        min_pwm = fan.minPwm;
-        max_pwm = fan.maxPwm;
-        cutoff = fan.cutoff;
-        heat_pressure_srcs = fan.heatPressureSrcs;
-      }) cfg.settings.fans;
-    };

-    systemd.services.pid-fan-controller = {
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "simple";
-        ExecStart = [ (lib.getExe cfg.package) ];
-        ExecStopPost = [ "${lib.getExe cfg.package} disable" ];
-        Restart = "always";
-        #This service needs to run as root to write to /sys.
-        #therefore it should operate with the least amount of privileges needed
-        ProtectHome = "yes";
-        #strict is not possible as it needs /sys
-        ProtectSystem = "full";
-        ProtectProc = "invisible";
-        PrivateNetwork = "yes";
-        NoNewPrivileges = "yes";
-        MemoryDenyWriteExecute = "yes";
-        RestrictNamespaces = "~user pid net uts mnt";
-        ProtectKernelModules = "yes";
-        RestrictRealtime = "yes";
-        SystemCallFilter = "@system-service";
-        CapabilityBoundingSet = "~CAP_KILL CAP_WAKE_ALARM CAP_IPC_LOC CAP_BPF CAP_LINUX_IMMUTABLE CAP_BLOCK_SUSPEND CAP_MKNOD";
-      };
-      # restart unit if config changed
-      restartTriggers = [ config.environment.etc."pid-fan-settings.json".source ];
+  config =
+    let
+      oldConfig = cfg.settings ? heatSources;
+      configFile = settingsFormat.generate "pid-fan-settings.json" (
+        if oldConfig then
+          {
+            interval = cfg.settings.interval or 500;
+            heat_srcs = map (heatSrc: {
+              name = heatSrc.name or "";
+              wildcard_path = heatSrc.wildcardPath;
+              PID_params = {
+                set_point = heatSrc.pidParams.setPoint;
+                P = heatSrc.pidParams.P;
+                I = heatSrc.pidParams.I;
+                D = heatSrc.pidParams.D;
+              };
+            }) cfg.settings.heatSources;
+            fans = map (fan: {
+              wildcard_path = fan.wildcardPath;
+              min_pwm = fan.minPwm;
+              max_pwm = fan.maxPwm;
+              cutoff = fan.cutoff or false;
+              heat_pressure_srcs = fan.heatPressureSrcs;
+            }) cfg.settings.fans;
+          }
+        else
+          cfg.settings
+      );
+    in
+    lib.mkIf cfg.enable {
+      systemd.packages = [ cfg.package ];
+      systemd.services.pid-fan-controller.environment.PID_FAN_CONFIG = toString configFile;
+      systemd.services.pid-fan-controller.wantedBy = [ "multi-user.target" ];
+      systemd.services.pid-fan-controller-sleep.wantedBy = [ "sleep.target" ];
+
+      warnings =
+        if oldConfig then
+          [
+            ''
+              The configuration of `pid-fan-controller` is no longer deeply configured and the rewriting will be removed in 26.11!
+              Please switch to using underscore case as shown in the upstream documentation.
+            ''
+          ]
+        else
+          [ ];
    };
-    #sleep hook to restart the service as it breaks otherwise
-    systemd.services.pid-fan-controller-sleep = {
-      before = [ "sleep.target" ];
-      wantedBy = [ "sleep.target" ];
-      unitConfig = {
-        StopWhenUnneeded = "yes";
-      };
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-        ExecStart = [ "systemctl stop pid-fan-controller.service" ];
-        ExecStop = [ "systemctl restart pid-fan-controller.service" ];
-      };
-    };
-  };
  meta.maintainers = with lib.maintainers; [ zimward ];
 }
@@ -145,6 +145,7 @@ in
        RuntimeDirectoryMode = "0750";
        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
        ReadWritePaths = [ stateDir ];
+        ExecPaths = [ stateDir ];

        # Hardening
        CapabilityBoundingSet = "";
@@ -41,7 +41,7 @@ in
    environmentFile = mkOption {
      type = nullOr path;
      default = null;
-      example = /run/keys/evcc;
+      example = "/run/keys/evcc";
      description = ''
        File with environment variables to pass into the runtime environment.

@@ -0,0 +1,100 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.home-assistant-matter-hub;
+  settingsFormat = pkgs.formats.json { };
+  configFile = settingsFormat.generate "home-assistant-matter-hub.json" cfg.settings;
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    kranzes
+    marie
+  ];
+
+  options.services.home-assistant-matter-hub = {
+    enable = lib.mkEnableOption "home-assistant-matter-hub, a Matter bridge for Home Assistant";
+
+    package = lib.mkPackageOption pkgs "home-assistant-matter-hub" { };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to open the Matter commissioning ports (UDP/TCP 5540) in the
+        firewall.
+      '';
+    };
+
+    accessTokenFile = lib.mkOption {
+      type = lib.types.externalPath;
+      example = "/run/secrets/home-assistant-matter-hub-token";
+      description = ''
+        Path to a file containing a Home Assistant long-lived access token.
+        The file is loaded as a systemd credential and read into
+        `HAMH_HOME_ASSISTANT_ACCESS_TOKEN` at service start.
+      '';
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          homeAssistantUrl = lib.mkOption {
+            type = lib.types.str;
+            example = lib.literalExpression "config.services.home-assistant.config.homeassistant.internal_url";
+            description = "HTTP URL of the Home Assistant instance to bridge.";
+          };
+
+          httpPort = lib.mkOption {
+            type = lib.types.port;
+            default = 8482;
+            description = "Port the web interface listens on.";
+          };
+        };
+      };
+      default = { };
+      example = lib.literalExpression ''
+        {
+          homeAssistantUrl = config.services.home-assistant.config.homeassistant.internal_url;
+        }
+      '';
+      description = ''
+        Configuration written to a JSON file and passed to
+        `home-assistant-matter-hub start --config`. Keys use camelCase, matching
+        the long-form CLI flags. See
+        <https://riddix.github.io/home-assistant-matter-hub/getting-started/installation#23-configuration-options>
+        for the full list of options.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ 5540 ];
+      allowedUDPPorts = [ 5540 ];
+    };
+
+    systemd.services.home-assistant-matter-hub = {
+      description = "Home Assistant Matter Hub";
+      documentation = [ "https://riddix.github.io/home-assistant-matter-hub/" ];
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      script = ''
+        export HAMH_HOME_ASSISTANT_ACCESS_TOKEN=$(systemd-creds cat HAMH_HOME_ASSISTANT_ACCESS_TOKEN)
+        exec ${lib.getExe cfg.package} start --config=${configFile} --storage-location="$1"
+      '';
+      scriptArgs = "%S/home-assistant-matter-hub";
+
+      serviceConfig = {
+        LoadCredential = [ "HAMH_HOME_ASSISTANT_ACCESS_TOKEN:${cfg.accessTokenFile}" ];
+        DynamicUser = true;
+        StateDirectory = "home-assistant-matter-hub";
+      };
+    };
+  };
+}
@@ -329,8 +329,8 @@ in
          This option does not delete accounts which are not (anymore) listed.
        '';
        example = {
-          "user1@localhost".passwordFile = /secrets/user1-localhost;
-          "user2@localhost".passwordFile = /secrets/user2-localhost;
+          "user1@localhost".passwordFile = "/secrets/user1-localhost";
+          "user2@localhost".passwordFile = "/secrets/user2-localhost";
        };
        type = lib.types.attrsOf (
          lib.types.submodule {
--- a/Show More
+++ b/Show More