nixos/containers: new registries.settings option, deprecate others

Those options mapped to the deprecated V1 format,
and didn't allow using the newer format.

If any of the older options are used,
a warning is displayed,
and the generated registries.conf file follows the old V1 format.

For more information about the new format,
see https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -83,6 +83,12 @@
 
 - Apache Kafka has dropped support for ZooKeeper mode. The `apacheKafka_3_9` and `apacheKafka_4_0` packages have been removed, as every remaining packaged version is KRaft-only. The `services.apache-kafka.zookeeper` option (previously an alias for `services.apache-kafka.settings."zookeeper.connect"`) has been removed; migrate your cluster to [KRaft](#module-services-apache-kafka-kraft) mode instead.
 
+- `virtualisation.registries.block` / `insecure` / `search` were deprecated,
+  because they mapped to the deprecated V1 `registries.conf` format.
+  See the new option {option}`virtualisation.registries.settings`
+  and [containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)
+  to migrate to the new configuration format.
+
 - When Avahi's mDNS resolver is enabled (`services.avahi.nssmdns4` or `services.avahi.nssmdns6`), only the minimal mDNS resolver is enabled by default to avoid adding a 5 second delay to every failed reverse hostname lookup (e.g., delaying ping by 5 seconds). The "full" mDNS resolver now remains disabled unless `services.avahi.nssmdnsFull` is also enabled. Users who have customized [`/etc/mdns.allow`](https://github.com/avahi/nss-mdns/tree/master#etcmdnsallow) to allow mDNS domains not ending `.local` must enable `services.avahi.nssmdnsFull` to continue to resolve such domains.
 
 - String values passed to `services.phpfpm.settings`, `services.phpfpm.pools.<name>.phpEnv`, and `services.phpfpm.pools.<name>.settings` are now properly quoted and escaped, except for the `${}` syntax that is left as-is. If you are manually escaping these values, please adjust accordingly.

nixos/modules/virtualisation/containers.nix

@@ -9,6 +9,15 @@ let
 
   inherit (lib) literalExpression mkOption types;
 
+  oldRegistriesOptionsUsed = lib.any (x: x != [ ]) (
+    with cfg.registries;
+    [
+      search
+      insecure
+      block
+    ]
+  );
+
   toml = pkgs.formats.toml { };
 in
 {
@@ -61,30 +70,54 @@ in
     };
 
     registries = {
+      # TODO: remove those options in 26.11
       search = mkOption {
+        visible = false;
         type = types.listOf types.str;
-        default = [
-          "docker.io"
-          "quay.io"
-        ];
+        default = [ ];
         description = ''
           List of repositories to search.
+
+          Deprecated, examine {option}`virtualisation.registries.settings` instead.
         '';
       };
 
       insecure = mkOption {
         default = [ ];
+        visible = false;
         type = types.listOf types.str;
         description = ''
           List of insecure repositories.
+
+          Deprecated, examine {option}`virtualisation.registries.settings` instead.
         '';
       };
 
       block = mkOption {
         default = [ ];
+        visible = false;
         type = types.listOf types.str;
         description = ''
           List of blocked repositories.
+
+          Deprecated, examine {option}`virtualisation.registries.settings` instead.
+        '';
+      };
+
+      settings = mkOption {
+        type = toml.type;
+        default = {
+          registry = [
+            { location = "docker.io"; }
+            { location = "quay.io"; }
+          ];
+        };
+        description = ''
+          repositories.conf configuration.
+
+          Examine [containers-registries.conf(5)] for more information about the format.
+
+            [containers-registries.conf(5)]: https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md
         '';
       };
     };
@@ -112,6 +145,15 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    warnings = lib.optional oldRegistriesOptionsUsed "the options virtualisation.registries.search / insecure / block are deprecated. See virtualisation.registries.settings instead.";
+
+    virtualisation.containers.registries.settings = lib.mkIf oldRegistriesOptionsUsed {
+      registries = {
+        block.registries = cfg.registries.block;
+        insecure.registries = cfg.registries.insecure;
+        search.registries = cfg.registries.search;
+      };
+    };
 
     virtualisation.containers.containersConf.cniPlugins = [ pkgs.cni-plugins ];
 
@@ -136,9 +178,7 @@ in
 
       "containers/storage.conf".source = toml.generate "storage.conf" cfg.storage.settings;
 
-      "containers/registries.conf".source = toml.generate "registries.conf" {
-        registries = lib.mapAttrs (n: v: { registries = v; }) cfg.registries;
-      };
+      "containers/registries.conf".source = toml.generate "registries.conf" cfg.registries.settings;
 
       "containers/policy.json".source =
         if cfg.policy != { } then