From 137a367b17866f2984b266c9efa3e3c72878c69d Mon Sep 17 00:00:00 2001
From: PerchunPak <git@perchun.it>
Date: Sun, 18 May 2025 19:49:52 +0200
Subject: [PATCH 01/47] nvim-treesitter grammars updater: small improvements

Mainly ran `ruff format` on the file and used newer `pathlib.Path`
---
 .../plugins/utils/nvim-treesitter/update.py   | 22 ++++++++++---------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter/update.py b/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter/update.py
index 6b19eb24ebf6..44d421e37823 100755
--- a/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter/update.py
+++ b/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter/update.py
@@ -1,17 +1,21 @@
 #!/usr/bin/env nix-shell
-#!nix-shell update-shell.nix -i python
+#!nix-shell ./update-shell.nix -i python
 
 import json
 import logging
 import os
 import subprocess
 from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
 
 import requests
 
 log = logging.getLogger("vim-updater")
 
-NURR_JSON_URL = "https://raw.githubusercontent.com/nvim-neorocks/nurr/main/tree-sitter-parsers.json"
+NURR_JSON_URL = (
+    "https://raw.githubusercontent.com/nvim-neorocks/nurr/main/tree-sitter-parsers.json"
+)
+
 
 def generate_grammar(lang, parser_info):
     """Generate grammar for a language based on the parser info"""
@@ -30,7 +34,9 @@ def generate_grammar(lang, parser_info):
     version = "0.0.0+rev={rev[:7]}";
     src = """
 
-        generated += subprocess.check_output(["nurl", url, rev, "--indent=4"], text=True)
+        generated += subprocess.check_output(
+            ["nurl", url, rev, "--indent=4"], text=True
+        )
         generated += ";"
 
         location = install_info.get("location", "")
@@ -82,8 +88,7 @@ def fetch_nurr_parsers():
 def process_parser_info(parser_info):
     """Process a single parser info entry and generate grammar for it"""
     try:
-        lang = parser_info["lang"]
-        return generate_grammar(lang, parser_info)
+        return generate_grammar(parser_info["lang"], parser_info)
     except Exception as e:
         log.error(f"Error processing parser: {e}")
         return ""
@@ -119,13 +124,10 @@ def update_grammars():
 
 
 if __name__ == "__main__":
-    logging.basicConfig(level=logging.INFO, format='%(levelname)s: %(message)s')
+    logging.basicConfig(level=logging.INFO, format="%(levelname)s: %(message)s")
 
     generated = update_grammars()
-    output_path = os.path.join(
-        os.path.dirname(__file__),
-        "../../nvim-treesitter/generated.nix"
-    )
+    output_path = Path(__file__).parent.parent / "nvim-treesitter/generated.nix"
     log.info("Writing output to %s", output_path)
     with open(output_path, "w") as f:
         f.write(generated)

From 1a47b9efd078cb8c458e99744258138214362aae Mon Sep 17 00:00:00 2001
From: PerchunPak <git@perchun.it>
Date: Sun, 18 May 2025 19:53:33 +0200
Subject: [PATCH 02/47] nvim-treesitter grammars updater: avoid silent fails

What if some grammar fails to update? Well, it gets removed from the
generated file. How would we know that the grammar failed? By reading
logs. Who reads logs if the command didn't crash? Right, nobody. Or even
if someone examines the logs, it is too easy to overlook the failure
(are you sure you read every single line of code? It is not even colored)

They are useful only in two cases:

- During debugging, this happens rarely
- Let's print something to keep the user informed that we are doing
  something

  It should not to be a mistake to overlook one line from the logs,
  because when you run the same script hundreds of times (we do updates
  weekly), you barely look at logs; you scan them, at most.

By treating logs this way, we can inform ourselves about possible
breakages before it gets even reviewed by another person, not by a user
opening a bug report months later.

![image](https://github.com/user-attachments/assets/608dad73-626a-4e06-9122-38d2a085d473)
---
 .../plugins/utils/nvim-treesitter/update.py   | 46 ++++++++-----------
 1 file changed, 19 insertions(+), 27 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter/update.py b/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter/update.py
index 44d421e37823..7ae13615d2ab 100755
--- a/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter/update.py
+++ b/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter/update.py
@@ -19,44 +19,40 @@ NURR_JSON_URL = (
 
 def generate_grammar(lang, parser_info):
     """Generate grammar for a language based on the parser info"""
-    try:
-        if "install_info" not in parser_info:
-            log.warning(f"Parser {lang} does not have install_info, skipping")
-            return ""
+    if "install_info" not in parser_info:
+        log.warning(f"Parser {lang} does not have install_info, skipping")
+        return ""
 
-        install_info = parser_info["install_info"]
+    install_info = parser_info["install_info"]
 
-        url = install_info["url"]
-        rev = install_info["revision"]
+    url = install_info["url"]
+    rev = install_info["revision"]
 
-        generated = f"""  {lang} = buildGrammar {{
+    generated = f"""  {lang} = buildGrammar {{
     language = "{lang}";
     version = "0.0.0+rev={rev[:7]}";
     src = """
 
-        generated += subprocess.check_output(
-            ["nurl", url, rev, "--indent=4"], text=True
-        )
-        generated += ";"
+    generated += subprocess.check_output(
+        ["nurl", url, rev, "--indent=4"], text=True
+    )
+    generated += ";"
 
-        location = install_info.get("location", "")
-        if location:
-            generated += f"""
+    location = install_info.get("location", "")
+    if location:
+        generated += f"""
     location = "{location}";"""
 
-        if install_info.get("generate", False):
-            generated += """
+    if install_info.get("generate", False):
+        generated += """
     generate = true;"""
 
-        generated += f"""
+    generated += f"""
     meta.homepage = "{url}";
   }};
 """
 
-        return generated
-    except Exception as e:
-        log.error(f"Error generating grammar for {lang}: {e}")
-        return ""
+    return generated
 
 
 def fetch_nurr_parsers():
@@ -87,11 +83,7 @@ def fetch_nurr_parsers():
 
 def process_parser_info(parser_info):
     """Process a single parser info entry and generate grammar for it"""
-    try:
-        return generate_grammar(parser_info["lang"], parser_info)
-    except Exception as e:
-        log.error(f"Error processing parser: {e}")
-        return ""
+    return generate_grammar(parser_info["lang"], parser_info)
 
 
 def update_grammars():

From f201c1abead6960a0b0199c6569483a340be5f32 Mon Sep 17 00:00:00 2001
From: Kamil Monicz <kamil@monicz.dev>
Date: Tue, 20 May 2025 02:57:09 +0200
Subject: [PATCH 03/47] Fix mapscript Python package install

---
 pkgs/by-name/ma/mapserver/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/ma/mapserver/package.nix b/pkgs/by-name/ma/mapserver/package.nix
index a3bbd8239692..8e2dc6fc06e2 100644
--- a/pkgs/by-name/ma/mapserver/package.nix
+++ b/pkgs/by-name/ma/mapserver/package.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withPython [
       swig
       python3.pkgs.setuptools
+      python3.pkgs.pythonImportsCheckHook
     ];
 
   buildInputs = [
@@ -82,6 +83,13 @@ stdenv.mkDerivation rec {
     (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
   ];
 
+  postInstall = lib.optionalString withPython ''
+    mkdir -p $out/${python3.sitePackages}
+    cp -r src/mapscript/python/mapscript $out/${python3.sitePackages}
+  '';
+
+  pythonImportsCheck = [ "mapscript" ];
+
   meta = {
     description = "Platform for publishing spatial data and interactive mapping applications to the web";
     homepage = "https://mapserver.org/";

From f6e0762cc059f66fd6bf4b97096f630771e801b3 Mon Sep 17 00:00:00 2001
From: Christoph Heiss <christoph@c8h4.io>
Date: Fri, 6 Jun 2025 14:30:19 +0200
Subject: [PATCH 04/47] proxmox-backup-client: use correct value for
 RUSTC_TARGET

Signed-off-by: Christoph Heiss <christoph@c8h4.io>
---
 pkgs/by-name/pr/proxmox-backup-client/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/pr/proxmox-backup-client/package.nix b/pkgs/by-name/pr/proxmox-backup-client/package.nix
index e19b41c293c6..8350bd9f1684 100644
--- a/pkgs/by-name/pr/proxmox-backup-client/package.nix
+++ b/pkgs/by-name/pr/proxmox-backup-client/package.nix
@@ -118,7 +118,7 @@ rustPlatform.buildRustPackage {
   postBuild = ''
     make -C docs \
       DEB_VERSION=${version} DEB_VERSION_UPSTREAM=${version} \
-      RUSTC_TARGET=${stdenv.hostPlatform.config} \
+      RUSTC_TARGET=${stdenv.targetPlatform.rust.rustcTarget} \
       BUILD_MODE=release \
       proxmox-backup-client.1 pxar.1
   '';

From 2dc044b8f82912b85c0ae25a9f41042a5f64a2ed Mon Sep 17 00:00:00 2001
From: Christoph Heiss <christoph@c8h4.io>
Date: Fri, 6 Jun 2025 17:35:42 +0200
Subject: [PATCH 05/47] proxmox-backup-client: avoid `git` as buildInput

The build script of the `pbs-buildcfg` crate either uses `REPOID` from
the environment or runs `git rev-parse HEAD`. The latter case results in
an empty string anyway, so just fast-track it.

Signed-off-by: Christoph Heiss <christoph@c8h4.io>
---
 pkgs/by-name/pr/proxmox-backup-client/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pr/proxmox-backup-client/package.nix b/pkgs/by-name/pr/proxmox-backup-client/package.nix
index 8350bd9f1684..9ac5e32ae4f4 100644
--- a/pkgs/by-name/pr/proxmox-backup-client/package.nix
+++ b/pkgs/by-name/pr/proxmox-backup-client/package.nix
@@ -10,7 +10,6 @@
   libuuid,
   acl,
   libxcrypt,
-  git,
   installShellFiles,
   sphinx,
   systemd,
@@ -149,8 +148,10 @@ rustPlatform.buildRustPackage {
 
   doCheck = false;
 
+  # pbs-buildcfg requires this set, would be the git commit id
+  REPOID = "";
+
   nativeBuildInputs = [
-    git
     pkg-config
     pkgconf
     rustPlatform.bindgenHook

From 6bc9f0fbe3ce39abface640e00fb01484d10aa22 Mon Sep 17 00:00:00 2001
From: Christoph Heiss <christoph@c8h4.io>
Date: Fri, 6 Jun 2025 17:35:48 +0200
Subject: [PATCH 06/47] proxmox-backup-client: drop unused `pkg-config`
 buildInput

Signed-off-by: Christoph Heiss <christoph@c8h4.io>
---
 pkgs/by-name/pr/proxmox-backup-client/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/pr/proxmox-backup-client/package.nix b/pkgs/by-name/pr/proxmox-backup-client/package.nix
index 9ac5e32ae4f4..24b5b2a23997 100644
--- a/pkgs/by-name/pr/proxmox-backup-client/package.nix
+++ b/pkgs/by-name/pr/proxmox-backup-client/package.nix
@@ -3,7 +3,6 @@
   fetchgit,
   fetchFromGitHub,
   rustPlatform,
-  pkg-config,
   pkgconf,
   openssl,
   fuse3,
@@ -152,7 +151,6 @@ rustPlatform.buildRustPackage {
   REPOID = "";
 
   nativeBuildInputs = [
-    pkg-config
     pkgconf
     rustPlatform.bindgenHook
     installShellFiles

From 723612485fb7466d471f5facaf34e89244fd3458 Mon Sep 17 00:00:00 2001
From: Christoph Heiss <christoph@c8h4.io>
Date: Tue, 10 Jun 2025 22:18:56 +0200
Subject: [PATCH 07/47] proxmox-backup-client: avoid some unnecessary
 buildInputs due to greedy linkage

These are actually not necessary, rustc just does greedy linkage.

Signed-off-by: Christoph Heiss <christoph@c8h4.io>
---
 .../pr/proxmox-backup-client/package.nix        | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/pr/proxmox-backup-client/package.nix b/pkgs/by-name/pr/proxmox-backup-client/package.nix
index 24b5b2a23997..6bd8a0e52de4 100644
--- a/pkgs/by-name/pr/proxmox-backup-client/package.nix
+++ b/pkgs/by-name/pr/proxmox-backup-client/package.nix
@@ -11,9 +11,7 @@
   libxcrypt,
   installShellFiles,
   sphinx,
-  systemd,
   stdenv,
-  fetchpatch,
   versionCheckHook,
 }:
 
@@ -111,6 +109,13 @@ rustPlatform.buildRustPackage {
 
     cp ${./Cargo.lock} Cargo.lock
     rm .cargo/config.toml
+
+    # avoid some unnecessary dependendcies, stemming from greedy linkage by rustc
+    # see also upstream Makefile for similar workaround
+    mkdir -p .dep-stubs
+    echo '!<arch>' >.dep-stubs/libsystemd.a
+    echo '!<arch>' >.dep-stubs/libuuid.a
+    echo '!<arch>' >.dep-stubs/libcrypt.a
   '';
 
   postBuild = ''
@@ -145,6 +150,8 @@ rustPlatform.buildRustPackage {
     "--bin=pxar"
   ];
 
+  RUSTFLAGS = [ "-L.dep-stubs" ];
+
   doCheck = false;
 
   # pbs-buildcfg requires this set, would be the git commit id
@@ -156,15 +163,15 @@ rustPlatform.buildRustPackage {
     installShellFiles
     sphinx
   ];
+
   buildInputs = [
     openssl
     fuse3
-    libuuid
     acl
-    libxcrypt
-    systemd.dev
   ];
 
+  strictDeps = true;
+
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "version";

From 2f79f084a1360acc22a93dba4ec0dce01cd9ebbf Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Tue, 10 Jun 2025 16:19:46 -0400
Subject: [PATCH 08/47] jack_rack: drop

Unused, unmaintained upstream, and has not built [since 2025-01-15](https://hydra.nixos.org/build/282788842).
---
 pkgs/by-name/ja/jack_rack/package.nix | 44 ---------------------------
 pkgs/top-level/aliases.nix            |  1 +
 2 files changed, 1 insertion(+), 44 deletions(-)
 delete mode 100644 pkgs/by-name/ja/jack_rack/package.nix

diff --git a/pkgs/by-name/ja/jack_rack/package.nix b/pkgs/by-name/ja/jack_rack/package.nix
deleted file mode 100644
index a8703792a8af..000000000000
--- a/pkgs/by-name/ja/jack_rack/package.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  pkg-config,
-  libjack2,
-  ladspaH,
-  gtk2,
-  alsa-lib,
-  libxml2,
-  lrdf,
-}:
-stdenv.mkDerivation rec {
-  pname = "jack-rack";
-  version = "1.4.7";
-  src = fetchurl {
-    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "1lmibx9gicagcpcisacj6qhq6i08lkl5x8szysjqvbgpxl9qg045";
-  };
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    libjack2
-    ladspaH
-    gtk2
-    alsa-lib
-    libxml2
-    lrdf
-  ];
-  NIX_LDFLAGS = "-lm -lpthread";
-
-  meta = {
-    description = ''An effects "rack" for the JACK low latency audio API'';
-    longDescription = ''
-      JACK Rack is an effects "rack" for the JACK low latency audio
-      API. The rack can be filled with LADSPA effects plugins and can
-      be controlled using the ALSA sequencer. It's phat; it turns your
-      computer into an effects box.
-    '';
-    homepage = "https://jack-rack.sourceforge.net/";
-    license = lib.licenses.gpl2Plus;
-    maintainers = [ lib.maintainers.astsmtl ];
-    platforms = lib.platforms.linux;
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 9fd7438a95d7..23f97ddc7719 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -932,6 +932,7 @@ mapAliases {
   ### J ###
 
   jack2Full = throw "'jack2Full' has been renamed to/replaced by 'jack2'"; # Converted to throw 2024-10-17
+  jack_rack = throw "'jack_rack' has been removed due to lack of maintenance upstream."; # Added 2025-06-10
   jami-client-qt = jami-client; # Added 2022-11-06
   jami-client = jami; # Added 2023-02-10
   jami-daemon = jami.daemon; # Added 2023-02-10

From 38ebfcf596cd6b1f4336b66d6c71de3c9b876e88 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Wed, 11 Jun 2025 08:37:09 +0200
Subject: [PATCH 09/47] box64: 0.3.4 -> 0.3.6

---
 pkgs/applications/emulators/box64/default.nix | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/emulators/box64/default.nix b/pkgs/applications/emulators/box64/default.nix
index 04c4f768e9bd..537998c47eb3 100644
--- a/pkgs/applications/emulators/box64/default.nix
+++ b/pkgs/applications/emulators/box64/default.nix
@@ -21,15 +21,22 @@ assert
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "box64";
-  version = "0.3.4";
+  version = "0.3.6";
 
   src = fetchFromGitHub {
     owner = "ptitSeb";
     repo = "box64";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-CY5Emg5TsMVs++2EukhVzqn9440kF/BO8HZGQgCpGu4=";
+    hash = "sha256-Z8r7aonVj7VSifgLKx/L7VRdGNnQtTvS4mjI+2+uPxY=";
   };
 
+  # Setting cpu doesn't seem to work (or maybe isn't enough / gets overwritten by the wrapper's arch flag?), errors about unsupported instructions for target
+  # (this is for code that gets executed conditionally if the cpu at runtime supports their features, so setting this should be fine)
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'ASMFLAGS  -pipe -mcpu=cortex-a76' 'ASMFLAGS  -pipe -march=armv8.2-a+fp16+dotprod'
+  '';
+
   nativeBuildInputs = [
     cmake
     python3

From 4316fc5113ace4fb56bacc39758a462f40bf89c6 Mon Sep 17 00:00:00 2001
From: Andrew Marshall <andrew@johnandrewmarshall.com>
Date: Tue, 10 Jun 2025 20:58:33 -0400
Subject: [PATCH 10/47] devdocs-desktop: drop

Upstream repo archived in Jan 2022. Electron 12 was EOL in Nov 2021.
---
 pkgs/by-name/de/devdocs-desktop/package.nix | 43 ---------------------
 pkgs/top-level/aliases.nix                  |  1 +
 2 files changed, 1 insertion(+), 43 deletions(-)
 delete mode 100644 pkgs/by-name/de/devdocs-desktop/package.nix

diff --git a/pkgs/by-name/de/devdocs-desktop/package.nix b/pkgs/by-name/de/devdocs-desktop/package.nix
deleted file mode 100644
index a0fb3d6cfffb..000000000000
--- a/pkgs/by-name/de/devdocs-desktop/package.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  lib,
-  appimageTools,
-  fetchurl,
-}:
-
-let
-  version = "0.7.2";
-  pname = "devdocs-desktop";
-
-  src = fetchurl {
-    url = "https://github.com/egoist/devdocs-desktop/releases/download/v${version}/DevDocs-${version}.AppImage";
-    sha256 = "sha256-4ugpzh0Dweae6tKb6uqRhEW9HT+iVIo8MQRbVKTdRFw=";
-  };
-
-  appimageContents = appimageTools.extractType2 {
-    inherit pname version src;
-  };
-
-in
-appimageTools.wrapType2 rec {
-  inherit pname version src;
-
-  extraInstallCommands = ''
-    install -m 444 -D ${appimageContents}/devdocs.desktop $out/share/applications/devdocs.desktop
-    install -m 444 -D ${appimageContents}/devdocs.png $out/share/icons/hicolor/0x0/apps/devdocs.png
-    substituteInPlace $out/share/applications/devdocs.desktop \
-      --replace 'Exec=AppRun' 'Exec=${pname}'
-  '';
-
-  meta = with lib; {
-    description = "Full-featured desktop app for DevDocs.io";
-    longDescription = ''
-      DevDocs.io combines multiple API documentations in a fast, organized, and searchable interface. This is an unofficial desktop app for it.
-    '';
-    homepage = "https://github.com/egoist/devdocs-desktop";
-    downloadPage = "https://github.com/egoist/devdocs-desktop/releases";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ymarkus ];
-    platforms = [ "x86_64-linux" ];
-    mainProgram = "devdocs-desktop";
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 81a23b6edbdc..2ce5262e4946 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -532,6 +532,7 @@ mapAliases {
 
   demjson = with python3Packages; toPythonApplication demjson; # Added 2022-01-18
   devdash = throw "'devdash' has been removed as the upstream project was archived"; # Added 2025-03-27
+  devdocs-desktop = throw "'devdocs-desktop' has been removed as it is unmaintained upstream and vendors insecure dependencies"; # Added 2025-06-11
   dfilemanager = throw "'dfilemanager' has been dropped as it was unmaintained"; # Added 2025-06-03
   dgsh = throw "'dgsh' has been removed, as it was broken and unmaintained"; # added 2024-05-09
   dibbler = throw "dibbler was removed because it is not maintained anymore"; # Added 2024-05-14

From 7872c3b8c68417ce9b11c891bd51f524845d940a Mon Sep 17 00:00:00 2001
From: Sander <hey@sandydoo.me>
Date: Thu, 12 Jun 2025 23:05:21 +0200
Subject: [PATCH 11/47] pjsip: fix builds failing to patch executables on macos

A lot of non-executable files in the build output are marked as
executable, including a header file, which causes `install_name_tool` to
fail.

We now search `/bin` and `/share/**/samples` specifically and check that
the file is a Mach-O binary before patching.
---
 pkgs/by-name/pj/pjsip/package.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pj/pjsip/package.nix b/pkgs/by-name/pj/pjsip/package.nix
index 53219b38c98e..6cd8d59e8669 100644
--- a/pkgs/by-name/pj/pjsip/package.nix
+++ b/pkgs/by-name/pj/pjsip/package.nix
@@ -109,9 +109,12 @@ stdenv.mkDerivation (finalAttrs: {
       done
 
       # Rewrite library references for all executables.
-      find "$out" -executable -type f | while read executable; do
-        install_name_tool "''${change_args[@]}" "$executable"
-      done
+      find "$out" -type f -executable -path "*/bin/*" -o -type f -executable -path "*/share/*/samples/*" \
+        | while read executable; do
+          if isMachO "$executable"; then
+            install_name_tool "''${change_args[@]}" "$executable"
+          fi
+        done
     '';
 
   # We need the libgcc_s.so.1 loadable (for pthread_cancel to work)

From 6f20f07dd704c4a83e8c236e51c04e2f1a05d6db Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Sat, 14 Jun 2025 11:28:47 +0200
Subject: [PATCH 12/47] sumatools: drop

All derivations fail to build with GCC 14 and their repositories were
archived upstream [1]-[3].

[1] https://git.metabarcoding.org/obitools/sumaclust
[2] https://git.metabarcoding.org/obitools/sumalibs
[3] https://git.metabarcoding.org/obitools/sumatra
---
 .../science/biology/sumatools/default.nix     | 77 -------------------
 pkgs/top-level/aliases.nix                    |  3 +
 pkgs/top-level/all-packages.nix               |  6 --
 3 files changed, 3 insertions(+), 83 deletions(-)
 delete mode 100644 pkgs/applications/science/biology/sumatools/default.nix

diff --git a/pkgs/applications/science/biology/sumatools/default.nix b/pkgs/applications/science/biology/sumatools/default.nix
deleted file mode 100644
index fc07cd661c56..000000000000
--- a/pkgs/applications/science/biology/sumatools/default.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-{
-  lib,
-  gccStdenv,
-  fetchFromGitLab,
-  zlib,
-}:
-
-let
-  stdenv = gccStdenv;
-  meta = with lib; {
-    description = "Fast and exact comparison and clustering of sequences";
-    homepage = "https://metabarcoding.org/sumatra";
-    maintainers = [ maintainers.bzizou ];
-    platforms = platforms.unix;
-  };
-
-in
-rec {
-
-  # Suma library
-  sumalibs = stdenv.mkDerivation rec {
-    version = "1.0.34";
-    pname = "sumalibs";
-    src = fetchFromGitLab {
-      domain = "git.metabarcoding.org";
-      owner = "obitools";
-      repo = pname;
-      rev = "sumalib_v${version}";
-      sha256 = "0hwkrxzfz7m5wdjvmrhkjg8kis378iaqr5n4nhdhkwwhn8x1jn5a";
-    };
-    makeFlags = [ "PREFIX=$(out)" ];
-    inherit meta;
-  };
-
-  # Sumatra
-  sumatra = stdenv.mkDerivation rec {
-    version = "1.0.34";
-    pname = "sumatra";
-    src = fetchFromGitLab {
-      domain = "git.metabarcoding.org";
-      owner = "obitools";
-      repo = pname;
-      rev = "${pname}_v${version}";
-      sha256 = "1bbpbdkshdc3xffqnr1qfy8qk64ldsmdc3s8mrcrlx132rgbi5f6";
-    };
-    buildInputs = [
-      sumalibs
-      zlib
-    ];
-    makeFlags = [
-      "LIBSUMA=${sumalibs}/lib/libsuma.a"
-      "LIBSUMAPATH=-L${sumalibs}"
-      "PREFIX=$(out)"
-    ];
-    inherit meta;
-  };
-
-  # Sumaclust
-  sumaclust = stdenv.mkDerivation rec {
-    version = "1.0.34";
-    pname = "sumaclust";
-    src = fetchFromGitLab {
-      domain = "git.metabarcoding.org";
-      owner = "obitools";
-      repo = pname;
-      rev = "${pname}_v${version}";
-      sha256 = "0x8yi3k3jxhmv2krp4rcjlj2f9zg0qrk7gx4kpclf9c3yxgsgrds";
-    };
-    buildInputs = [ sumalibs ];
-    makeFlags = [
-      "LIBSUMA=${sumalibs}/lib/libsuma.a"
-      "LIBSUMAPATH=-L${sumalibs}"
-      "PREFIX=$(out)"
-    ];
-    inherit meta;
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 3f0235e09a09..783637970235 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1847,6 +1847,9 @@ mapAliases {
   suidChroot = throw "'suidChroot' has been dropped as it was unmaintained, failed to build and had questionable security considerations"; # Added 2025-05-17
   suitesparse_4_2 = throw "'suitesparse_4_2' has been removed as it was unmaintained upstream"; # Added 2025-05-17
   suitesparse_4_4 = throw "'suitesparse_4_4' has been removed as it was unmaintained upstream"; # Added 2025-05-17
+  sumaclust = throw "'sumaclust' has been removed as it was archived upstream and broken with GCC 14"; # Added 2025-06-14
+  sumalibs = throw "'sumalibs' has been removed as it was archived upstream and broken with GCC 14"; # Added 2025-06-14
+  sumatra = throw "'sumatra' has been removed as it was archived upstream and broken with GCC 14"; # Added 2025-06-14
   sumneko-lua-language-server = lua-language-server; # Added 2023-02-07
   sumokoin = throw "sumokoin has been removed as it was abandoned upstream"; # Added 2024-11-23
   supertag = throw "supertag has been removed as it was abandoned upstream and fails to build"; # Added 2025-04-20
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a7e155283026..7ad31ce75ac1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15539,12 +15539,6 @@ with pkgs;
 
   samtools = callPackage ../applications/science/biology/samtools { };
 
-  inherit (callPackages ../applications/science/biology/sumatools { })
-    sumalibs
-    sumaclust
-    sumatra
-    ;
-
   trimmomatic = callPackage ../applications/science/biology/trimmomatic {
     jdk = pkgs.jdk21_headless;
     # Reduce closure size

From 7d6240688ac00a81d4219c8cfa4b42cd370029c6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 14 Jun 2025 13:34:58 +0000
Subject: [PATCH 13/47] lint-staged: 16.1.0 -> 16.1.1

---
 pkgs/by-name/li/lint-staged/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/lint-staged/package.nix b/pkgs/by-name/li/lint-staged/package.nix
index a4c7b302b818..f78481515a27 100644
--- a/pkgs/by-name/li/lint-staged/package.nix
+++ b/pkgs/by-name/li/lint-staged/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "lint-staged";
-  version = "16.1.0";
+  version = "16.1.1";
 
   src = fetchFromGitHub {
     owner = "okonet";
     repo = "lint-staged";
     rev = "v${version}";
-    hash = "sha256-dR0z/60CHDqCl9pEc9KQww1S5aSZ4XGsfNqxBSZe0Ig=";
+    hash = "sha256-DBLS0hMu2mG4+sGhhGjIlfj2y2A33RccEP3plweaKio=";
   };
 
-  npmDepsHash = "sha256-MznWvv61Z+8t+Nicj6yWlQqUHVx7AAtkDXu2L2E5dw8=";
+  npmDepsHash = "sha256-LJipxwO5B01KlfjOVhlhw5veH2+wpzWm0EwcRdVFleQ=";
 
   dontNpmBuild = true;
 

From 5fe092dd1efd902c09ab3ee0be581a511ea041be Mon Sep 17 00:00:00 2001
From: arthsmn <arthsmn@proton.me>
Date: Sat, 14 Jun 2025 07:40:58 -0300
Subject: [PATCH 14/47] smfh: init at 1

---
 pkgs/by-name/sm/smfh/package.nix | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 pkgs/by-name/sm/smfh/package.nix

diff --git a/pkgs/by-name/sm/smfh/package.nix b/pkgs/by-name/sm/smfh/package.nix
new file mode 100644
index 000000000000..d59d42a9221c
--- /dev/null
+++ b/pkgs/by-name/sm/smfh/package.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "smfh";
+  version = "1.1";
+
+  src = fetchFromGitHub {
+    owner = "feel-co";
+    repo = "smfh";
+    tag = finalAttrs.version;
+    hash = "sha256-/9Ww10kYopxfCNNnNDwENTubs7Wzqlw+O6PJAHNOYQw=";
+  };
+
+  cargoHash = "sha256-MpqbmhjNsE1krs7g3zWSXGxzb4G/A+cz/zxD2Jk2HC8=";
+
+  meta = {
+    description = "Sleek Manifest File Handler";
+    homepage = "https://github.com/feel-co/smfh";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [
+      arthsmn
+      gerg-l
+    ];
+    mainProgram = "smfh";
+  };
+})

From 3e2703c74c87b4c4db55c988849a2532917eab4c Mon Sep 17 00:00:00 2001
From: Jonathan Davies <jpds@protonmail.com>
Date: Wed, 27 Nov 2024 19:06:38 +0000
Subject: [PATCH 15/47] nixos/clickhouse: Moved existing test to subdirectory

---
 nixos/tests/all-tests.nix          |  2 +-
 nixos/tests/clickhouse.nix         | 33 ----------------------------
 nixos/tests/clickhouse/base.nix    | 35 ++++++++++++++++++++++++++++++
 nixos/tests/clickhouse/default.nix |  9 ++++++++
 4 files changed, 45 insertions(+), 34 deletions(-)
 delete mode 100644 nixos/tests/clickhouse.nix
 create mode 100644 nixos/tests/clickhouse/base.nix
 create mode 100644 nixos/tests/clickhouse/default.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 6cb04827cb77..6b928e4f3b50 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -306,7 +306,7 @@ in
   cinnamon-wayland = runTest ./cinnamon-wayland.nix;
   cjdns = runTest ./cjdns.nix;
   clatd = runTest ./clatd.nix;
-  clickhouse = runTest ./clickhouse.nix;
+  clickhouse = handleTest ./clickhouse { };
   cloud-init = handleTest ./cloud-init.nix { };
   cloud-init-hostname = handleTest ./cloud-init-hostname.nix { };
   cloudlog = runTest ./cloudlog.nix;
diff --git a/nixos/tests/clickhouse.nix b/nixos/tests/clickhouse.nix
deleted file mode 100644
index 165f00a1ec4e..000000000000
--- a/nixos/tests/clickhouse.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ pkgs, ... }:
-{
-  name = "clickhouse";
-  meta.maintainers = with pkgs.lib.maintainers; [ ];
-
-  nodes.machine = {
-    services.clickhouse.enable = true;
-    virtualisation.memorySize = 4096;
-  };
-
-  testScript =
-    let
-      # work around quote/substitution complexity by Nix, Perl, bash and SQL.
-      tableDDL = pkgs.writeText "ddl.sql" "CREATE TABLE `demo` (`value` FixedString(10)) engine = MergeTree PARTITION BY value ORDER BY tuple();";
-      insertQuery = pkgs.writeText "insert.sql" "INSERT INTO `demo` (`value`) VALUES ('foo');";
-      selectQuery = pkgs.writeText "select.sql" "SELECT * from `demo`";
-    in
-    ''
-      machine.start()
-      machine.wait_for_unit("clickhouse.service")
-      machine.wait_for_open_port(9000)
-
-      machine.succeed(
-          "cat ${tableDDL} | clickhouse-client"
-      )
-      machine.succeed(
-          "cat ${insertQuery} | clickhouse-client"
-      )
-      machine.succeed(
-          "cat ${selectQuery} | clickhouse-client | grep foo"
-      )
-    '';
-}
diff --git a/nixos/tests/clickhouse/base.nix b/nixos/tests/clickhouse/base.nix
new file mode 100644
index 000000000000..fef710b2e5ab
--- /dev/null
+++ b/nixos/tests/clickhouse/base.nix
@@ -0,0 +1,35 @@
+import ../make-test-python.nix (
+  { pkgs, ... }:
+  {
+    name = "clickhouse";
+    meta.maintainers = with pkgs.lib.maintainers; [ jpds ];
+
+    nodes.machine = {
+      services.clickhouse.enable = true;
+      virtualisation.memorySize = 4096;
+    };
+
+    testScript =
+      let
+        # work around quote/substitution complexity by Nix, Perl, bash and SQL.
+        tableDDL = pkgs.writeText "ddl.sql" "CREATE TABLE `demo` (`value` FixedString(10)) engine = MergeTree PARTITION BY value ORDER BY tuple();";
+        insertQuery = pkgs.writeText "insert.sql" "INSERT INTO `demo` (`value`) VALUES ('foo');";
+        selectQuery = pkgs.writeText "select.sql" "SELECT * from `demo`";
+      in
+      ''
+        machine.start()
+        machine.wait_for_unit("clickhouse.service")
+        machine.wait_for_open_port(9000)
+
+        machine.succeed(
+            "cat ${tableDDL} | clickhouse-client"
+        )
+        machine.succeed(
+            "cat ${insertQuery} | clickhouse-client"
+        )
+        machine.succeed(
+            "cat ${selectQuery} | clickhouse-client | grep foo"
+        )
+      '';
+  }
+)
diff --git a/nixos/tests/clickhouse/default.nix b/nixos/tests/clickhouse/default.nix
new file mode 100644
index 000000000000..931d58d1fa11
--- /dev/null
+++ b/nixos/tests/clickhouse/default.nix
@@ -0,0 +1,9 @@
+{
+  system ? builtins.currentSystem,
+  config ? { },
+  pkgs ? import ../../.. { inherit system config; },
+}:
+
+{
+  base = import ./base.nix { inherit system pkgs; };
+}

From 39cab037fa5752b25787664692a304f5f14b289a Mon Sep 17 00:00:00 2001
From: Jonathan Davies <jpds@protonmail.com>
Date: Wed, 27 Nov 2024 19:08:58 +0000
Subject: [PATCH 16/47] nixos/clickhouse: Added Kafka engine testcase

---
 nixos/tests/clickhouse/default.nix |   1 +
 nixos/tests/clickhouse/kafka.nix   | 174 +++++++++++++++++++++++++++++
 2 files changed, 175 insertions(+)
 create mode 100644 nixos/tests/clickhouse/kafka.nix

diff --git a/nixos/tests/clickhouse/default.nix b/nixos/tests/clickhouse/default.nix
index 931d58d1fa11..ebc4a4702398 100644
--- a/nixos/tests/clickhouse/default.nix
+++ b/nixos/tests/clickhouse/default.nix
@@ -6,4 +6,5 @@
 
 {
   base = import ./base.nix { inherit system pkgs; };
+  kafka = import ./kafka.nix { inherit system pkgs; };
 }
diff --git a/nixos/tests/clickhouse/kafka.nix b/nixos/tests/clickhouse/kafka.nix
new file mode 100644
index 000000000000..2dd6f1946e35
--- /dev/null
+++ b/nixos/tests/clickhouse/kafka.nix
@@ -0,0 +1,174 @@
+import ../make-test-python.nix (
+  { pkgs, ... }:
+
+  let
+    kafkaNamedCollectionConfig = ''
+      <clickhouse>
+        <named_collections>
+          <cluster_1>
+              <!-- ClickHouse Kafka engine parameters -->
+              <kafka_broker_list>kafka:9092</kafka_broker_list>
+              <kafka_topic_list>test_topic</kafka_topic_list>
+              <kafka_group_name>clickhouse</kafka_group_name>
+              <kafka_format>JSONEachRow</kafka_format>
+              <kafka_commit_every_batch>0</kafka_commit_every_batch>
+              <kafka_num_consumers>1</kafka_num_consumers>
+              <kafka_thread_per_consumer>1</kafka_thread_per_consumer>
+
+              <!-- Kafka extended configuration -->
+              <kafka>
+                <debug>all</debug>
+                <auto_offset_reset>earliest</auto_offset_reset>
+              </kafka>
+          </cluster_1>
+        </named_collections>
+      </clickhouse>
+    '';
+
+    kafkaNamedCollection = pkgs.writeText "kafka.xml" kafkaNamedCollectionConfig;
+  in
+  {
+    name = "clickhouse-kafka";
+    meta.maintainers = with pkgs.lib.maintainers; [ jpds ];
+
+    nodes = {
+      clickhouse = {
+        environment.etc = {
+          "clickhouse-server/config.d/kafka.xml" = {
+            source = "${kafkaNamedCollection}";
+          };
+        };
+
+        services.clickhouse.enable = true;
+        virtualisation.memorySize = 4096;
+      };
+
+      kafka = {
+        networking.firewall.allowedTCPPorts = [
+          9092
+          9093
+        ];
+
+        environment.systemPackages = [
+          pkgs.apacheKafka
+          pkgs.jq
+        ];
+
+        services.apache-kafka = {
+          enable = true;
+
+          # Randomly generated uuid. You can get one by running:
+          # kafka-storage.sh random-uuid
+          clusterId = "b81s-MuGSwyt_B9_h37wtQ";
+
+          formatLogDirs = true;
+
+          settings = {
+            listeners = [
+              "PLAINTEXT://:9092"
+              "CONTROLLER://:9093"
+            ];
+            "listener.security.protocol.map" = [
+              "PLAINTEXT:PLAINTEXT"
+              "CONTROLLER:PLAINTEXT"
+            ];
+            "controller.quorum.voters" = [
+              "1@kafka:9093"
+            ];
+            "controller.listener.names" = [ "CONTROLLER" ];
+
+            "node.id" = 1;
+            "broker.rack" = 1;
+
+            "process.roles" = [
+              "broker"
+              "controller"
+            ];
+
+            "log.dirs" = [ "/var/lib/apache-kafka" ];
+            "num.partitions" = 1;
+            "offsets.topic.replication.factor" = 1;
+            "transaction.state.log.replication.factor" = 1;
+            "transaction.state.log.min.isr" = 1;
+          };
+        };
+
+        systemd.services.apache-kafka.serviceConfig.StateDirectory = "apache-kafka";
+      };
+    };
+
+    testScript =
+      let
+        jsonTestMessage = pkgs.writeText "kafka-test-data.json" ''
+          { "id": 1, "first_name": "Fred", "age": 32 }
+          { "id": 2, "first_name": "Barbara", "age": 30 }
+          { "id": 3, "first_name": "Nicola", "age": 12 }
+        '';
+        # work around quote/substitution complexity by Nix, Perl, bash and SQL.
+        tableKafkaDDL = pkgs.writeText "ddl-kafka.sql" ''
+          CREATE TABLE `test_kafka_topic` (
+            `id` UInt32,
+            `first_name` String,
+            `age` UInt32
+          ) ENGINE = Kafka(cluster_1);
+        '';
+
+        tableDDL = pkgs.writeText "ddl.sql" ''
+          CREATE TABLE `test_topic` (
+            `id` UInt32,
+            `first_name` String,
+            `age` UInt32
+          ) ENGINE = MergeTree ORDER BY id;
+        '';
+
+        viewDDL = pkgs.writeText "view.sql" ''
+          CREATE MATERIALIZED VIEW kafka_view TO test_topic AS
+          SELECT
+              id,
+              first_name,
+              age,
+          FROM test_kafka_topic;
+        '';
+        selectQuery = pkgs.writeText "select.sql" "SELECT sum(age) from `test_topic`";
+      in
+      ''
+        kafka.start()
+        kafka.wait_for_unit("apache-kafka")
+        kafka.wait_for_open_port(9092)
+
+        clickhouse.start()
+        clickhouse.wait_for_unit("clickhouse")
+        clickhouse.wait_for_open_port(9000)
+
+        clickhouse.wait_until_succeeds(
+          """
+            journalctl -o cat -u clickhouse.service | grep "Merging configuration file '/etc/clickhouse-server/config.d/kafka.xml'"
+          """
+        )
+
+        clickhouse.succeed(
+          "cat ${tableKafkaDDL} | clickhouse-client"
+        )
+
+        clickhouse.succeed(
+          "cat ${tableDDL} | clickhouse-client"
+        )
+
+        clickhouse.succeed(
+          "cat ${viewDDL} | clickhouse-client"
+        )
+
+        kafka.succeed(
+          "jq -rc . ${jsonTestMessage} | kafka-console-producer.sh --topic test_topic --bootstrap-server kafka:9092"
+        )
+
+        kafka.wait_until_succeeds(
+          "journalctl -o cat -u apache-kafka.service | grep 'Created a new member id ClickHouse-clickhouse-default-test_kafka_topic'"
+        )
+
+        clickhouse.wait_until_succeeds(
+          "cat ${selectQuery} | clickhouse-client | grep 74"
+        )
+      '';
+  }
+)

From d1e65bf4e6426042d933c1794b9ce78449a6b55c Mon Sep 17 00:00:00 2001
From: Jonathan Davies <jpds@protonmail.com>
Date: Tue, 25 Mar 2025 16:59:07 +0000
Subject: [PATCH 17/47] nixos/clickhouse: Added keeper testcase

---
 nixos/tests/clickhouse/default.nix |   1 +
 nixos/tests/clickhouse/keeper.nix  | 185 +++++++++++++++++++++++++++++
 2 files changed, 186 insertions(+)
 create mode 100644 nixos/tests/clickhouse/keeper.nix

diff --git a/nixos/tests/clickhouse/default.nix b/nixos/tests/clickhouse/default.nix
index ebc4a4702398..bd52a1ebbd67 100644
--- a/nixos/tests/clickhouse/default.nix
+++ b/nixos/tests/clickhouse/default.nix
@@ -7,4 +7,5 @@
 {
   base = import ./base.nix { inherit system pkgs; };
   kafka = import ./kafka.nix { inherit system pkgs; };
+  keeper = import ./keeper.nix { inherit system pkgs; };
 }
diff --git a/nixos/tests/clickhouse/keeper.nix b/nixos/tests/clickhouse/keeper.nix
new file mode 100644
index 000000000000..27e839e288a7
--- /dev/null
+++ b/nixos/tests/clickhouse/keeper.nix
@@ -0,0 +1,185 @@
+import ../make-test-python.nix (
+  { lib, pkgs, ... }:
+  rec {
+    name = "clickhouse-keeper";
+    meta.maintainers = with pkgs.lib.maintainers; [ jpds ];
+
+    nodes =
+      let
+        node = i: {
+
+          environment.etc = {
+            "clickhouse-server/config.d/cluster.xml".text = ''
+              <clickhouse>
+                <remote_servers>
+                  <perftest_2shards_1replicas>
+                    ${lib.concatStrings (
+                      lib.imap0 (j: name: ''
+                        <shard>
+                          <replica>
+                              <host>${name}</host>
+                              <port>9000</port>
+                          </replica>
+                        </shard>
+                      '') (builtins.attrNames nodes)
+                    )}
+                  </perftest_2shards_1replicas>
+                </remote_servers>
+              </clickhouse>
+            '';
+
+            "clickhouse-server/config.d/keeper.xml".text = ''
+              <clickhouse>
+                <keeper_server>
+                  <server_id>${toString i}</server_id>
+                  <tcp_port>9181</tcp_port>
+                  <log_storage_path>/var/lib/clickhouse/coordination/log</log_storage_path>
+                  <snapshot_storage_path>/var/lib/clickhouse/coordination/snapshots</snapshot_storage_path>
+
+                  <coordination_settings>
+                    <operation_timeout_ms>10000</operation_timeout_ms>
+                    <session_timeout_ms>30000</session_timeout_ms>
+                    <raft_logs_level>trace</raft_logs_level>
+                    <rotate_log_storage_interval>10000</rotate_log_storage_interval>
+                  </coordination_settings>
+
+                  <raft_configuration>
+                    ${lib.concatStrings (
+                      lib.imap1 (j: name: ''
+                        <server>
+                          <id>${toString j}</id>
+                          <hostname>${name}</hostname>
+                          <port>9444</port>
+                        </server>
+                      '') (builtins.attrNames nodes)
+                    )}
+                  </raft_configuration>
+                </keeper_server>
+
+                <zookeeper>
+                  ${lib.concatStrings (
+                    lib.imap0 (j: name: ''
+                      <node>
+                        <host>${name}</host>
+                        <port>9181</port>
+                      </node>
+                    '') (builtins.attrNames nodes)
+                  )}
+                </zookeeper>
+
+                <distributed_ddl>
+                  <path>/clickhouse/testcluster/task_queue/ddl</path>
+                </distributed_ddl>
+              </clickhouse>
+            '';
+
+            "clickhouse-server/config.d/listen.xml".text = ''
+              <clickhouse>
+                <listen_host>::</listen_host>
+              </clickhouse>
+            '';
+
+            "clickhouse-server/config.d/macros.xml".text = ''
+              <clickhouse>
+                <macros>
+                    <replica>${toString i}</replica>
+                    <cluster>perftest_2shards_1replicas</cluster>
+                </macros>
+              </clickhouse>
+            '';
+          };
+
+          networking.firewall.allowedTCPPorts = [
+            9009
+            9181
+            9444
+          ];
+
+          services.clickhouse.enable = true;
+
+          systemd.services.clickhouse = {
+            after = [ "network-online.target" ];
+            requires = [ "network-online.target" ];
+          };
+
+          virtualisation.memorySize = 1024 * 4;
+          virtualisation.diskSize = 1024 * 10;
+        };
+      in
+      {
+        clickhouse1 = node 1;
+        clickhouse2 = node 2;
+      };
+
+    testScript =
+      let
+        # work around quote/substitution complexity by Nix, Perl, bash and SQL.
+        clustersQuery = pkgs.writeText "clusters.sql" "SHOW clusters";
+        keeperQuery = pkgs.writeText "keeper.sql" "SELECT * FROM system.zookeeper WHERE path IN ('/', '/clickhouse') FORMAT VERTICAL";
+        systemClustersQuery = pkgs.writeText "system-clusters.sql" "SELECT host_name, host_address, replica_num FROM system.clusters WHERE cluster = 'perftest_2shards_1replicas'";
+
+        tableDDL = pkgs.writeText "table.sql" ''
+          CREATE TABLE test ON cluster 'perftest_2shards_1replicas'   ( A Int64, S String)
+          Engine = ReplicatedMergeTree('/clickhouse/{cluster}/tables/{database}/{table}', '{replica}')
+          ORDER BY A;
+        '';
+
+        insertDDL = pkgs.writeText "insert.sql" "
+          INSERT INTO test SELECT number, '' FROM numbers(100000000);
+        ";
+
+        selectCountQuery = pkgs.writeText "select-count.sql" "
+          select count() from test;
+        ";
+      in
+      ''
+        clickhouse1.start()
+        clickhouse2.start()
+
+        for machine in clickhouse1, clickhouse2:
+          machine.wait_for_unit("clickhouse.service")
+          machine.wait_for_open_port(9000)
+          machine.wait_for_open_port(9009)
+          machine.wait_for_open_port(9181)
+          machine.wait_for_open_port(9444)
+
+          machine.wait_until_succeeds(
+            """
+              journalctl -o cat -u clickhouse.service | grep "Merging configuration file '/etc/clickhouse-server/config.d/keeper.xml'"
+            """
+          )
+
+          machine.log(machine.succeed(
+            "cat ${clustersQuery} | clickhouse-client | grep perftest_2shards_1replicas"
+          ))
+
+          machine.log(machine.succeed(
+            "cat ${keeperQuery} | clickhouse-client"
+          ))
+
+          machine.succeed(
+            "cat ${systemClustersQuery} | clickhouse-client | grep clickhouse1"
+          )
+          machine.succeed(
+            "cat ${systemClustersQuery} | clickhouse-client | grep clickhouse2"
+          )
+
+          machine.succeed(
+            "ls /var/lib/clickhouse/coordination/log | grep changelog"
+          )
+
+        clickhouse2.succeed(
+          "cat ${tableDDL} | clickhouse-client"
+        )
+
+        clickhouse2.succeed(
+          "cat ${insertDDL} | clickhouse-client"
+        )
+
+        for machine in clickhouse1, clickhouse2:
+          machine.wait_until_succeeds(
+            "cat ${selectCountQuery} | clickhouse-client | grep 100000000"
+          )
+      '';
+  }
+)

From 4d60b8f537c3cb24231febff5f1e3378b3e72122 Mon Sep 17 00:00:00 2001
From: Jonathan Davies <jpds@protonmail.com>
Date: Sat, 24 May 2025 18:30:50 +0000
Subject: [PATCH 18/47] nixos/clickhouse: Add S3 testcase

---
 nixos/tests/clickhouse/default.nix |   1 +
 nixos/tests/clickhouse/s3.nix      | 123 +++++++++++++++++++++++++++++
 2 files changed, 124 insertions(+)
 create mode 100644 nixos/tests/clickhouse/s3.nix

diff --git a/nixos/tests/clickhouse/default.nix b/nixos/tests/clickhouse/default.nix
index bd52a1ebbd67..0efa24146ee3 100644
--- a/nixos/tests/clickhouse/default.nix
+++ b/nixos/tests/clickhouse/default.nix
@@ -8,4 +8,5 @@
   base = import ./base.nix { inherit system pkgs; };
   kafka = import ./kafka.nix { inherit system pkgs; };
   keeper = import ./keeper.nix { inherit system pkgs; };
+  s3 = import ./s3.nix { inherit system pkgs; };
 }
diff --git a/nixos/tests/clickhouse/s3.nix b/nixos/tests/clickhouse/s3.nix
new file mode 100644
index 000000000000..b3ba5b360cc0
--- /dev/null
+++ b/nixos/tests/clickhouse/s3.nix
@@ -0,0 +1,123 @@
+import ../make-test-python.nix (
+  { pkgs, ... }:
+
+  let
+    s3 = {
+      bucket = "clickhouse-bucket";
+      accessKey = "BKIKJAA5BMMU2RHO6IBB";
+      secretKey = "V7f1CwQqAcwo80UEIJEjc5gVQUSSx5ohQ9GSrr12";
+    };
+
+    clickhouseS3StorageConfig = ''
+      <clickhouse>
+        <storage_configuration>
+          <disks>
+            <s3_disk>
+              <type>s3</type>
+              <endpoint>http://minio:9000/${s3.bucket}/</endpoint>
+              <access_key_id>${s3.accessKey}</access_key_id>
+              <secret_access_key>${s3.secretKey}</secret_access_key>
+              <metadata_path>/var/lib/clickhouse/disks/s3_disk/</metadata_path>
+            </s3_disk>
+            <s3_cache>
+              <type>cache</type>
+              <disk>s3_disk</disk>
+              <path>/var/lib/clickhouse/disks/s3_cache/</path>
+              <max_size>10Gi</max_size>
+            </s3_cache>
+          </disks>
+          <policies>
+            <s3_main>
+              <volumes>
+                <main>
+                  <disk>s3_disk</disk>
+                </main>
+              </volumes>
+            </s3_main>
+          </policies>
+        </storage_configuration>
+      </clickhouse>
+    '';
+  in
+  {
+    name = "clickhouse-s3";
+    meta.maintainers = with pkgs.lib.maintainers; [ jpds ];
+
+    nodes = {
+      clickhouse = {
+        environment.etc = {
+          "clickhouse-server/config.d/s3.xml" = {
+            text = "${clickhouseS3StorageConfig}";
+          };
+        };
+
+        services.clickhouse.enable = true;
+        virtualisation.diskSize = 15 * 1024;
+        virtualisation.memorySize = 4 * 1024;
+      };
+
+      minio =
+        { pkgs, ... }:
+        {
+          virtualisation.diskSize = 2 * 1024;
+          networking.firewall.allowedTCPPorts = [ 9000 ];
+
+          services.minio = {
+            enable = true;
+            inherit (s3) accessKey secretKey;
+          };
+
+          environment.systemPackages = [ pkgs.minio-client ];
+        };
+    };
+
+    testScript =
+      let
+        # work around quote/substitution complexity by Nix, Perl, bash and SQL.
+        tableDDL = pkgs.writeText "ddl.sql" ''
+          CREATE TABLE `demo` (
+            `value` String
+          )
+          ENGINE = MergeTree
+          ORDER BY value
+          SETTINGS storage_policy = 's3_main';
+        '';
+        insertQuery = pkgs.writeText "insert.sql" "INSERT INTO `demo` (`value`) VALUES ('foo');";
+        selectQuery = pkgs.writeText "select.sql" "SELECT * from `demo`";
+      in
+      ''
+        minio.wait_for_unit("minio")
+        minio.wait_for_open_port(9000)
+        minio.succeed(
+          "mc alias set minio "
+          + "http://localhost:9000 "
+          + "${s3.accessKey} ${s3.secretKey} --api s3v4",
+          "mc mb minio/${s3.bucket}",
+        )
+
+        clickhouse.start()
+        clickhouse.wait_for_unit("clickhouse.service")
+        clickhouse.wait_for_open_port(9000)
+
+        clickhouse.wait_until_succeeds(
+          """
+            journalctl -o cat -u clickhouse.service | grep "Merging configuration file '/etc/clickhouse-server/config.d/s3.xml'"
+          """
+        )
+
+        clickhouse.succeed(
+            "cat ${tableDDL} | clickhouse-client"
+        )
+        clickhouse.succeed(
+            "cat ${insertQuery} | clickhouse-client"
+        )
+        clickhouse.succeed(
+            "cat ${selectQuery} | clickhouse-client | grep foo"
+        )
+
+        minio.log(minio.succeed(
+          "mc ls minio/${s3.bucket}",
+        ))
+      '';
+  }
+)

From 2723c76503948166d20caaa1614663b0dc4b3c69 Mon Sep 17 00:00:00 2001
From: Jonathan Davies <jpds@protonmail.com>
Date: Sun, 15 Jun 2025 12:35:59 +0000
Subject: [PATCH 19/47] nixos/clickhouse: Migrate tests from handleTest to
 runTest

---
 nixos/tests/all-tests.nix          |   2 +-
 nixos/tests/clickhouse/base.nix    |  62 +++---
 nixos/tests/clickhouse/default.nix |  14 +-
 nixos/tests/clickhouse/kafka.nix   | 306 ++++++++++++++--------------
 nixos/tests/clickhouse/keeper.nix  | 310 ++++++++++++++---------------
 nixos/tests/clickhouse/s3.nix      | 218 ++++++++++----------
 6 files changed, 450 insertions(+), 462 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 6b928e4f3b50..c4f60d1532cc 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -306,7 +306,7 @@ in
   cinnamon-wayland = runTest ./cinnamon-wayland.nix;
   cjdns = runTest ./cjdns.nix;
   clatd = runTest ./clatd.nix;
-  clickhouse = handleTest ./clickhouse { };
+  clickhouse = import ./clickhouse { inherit runTest; };
   cloud-init = handleTest ./cloud-init.nix { };
   cloud-init-hostname = handleTest ./cloud-init-hostname.nix { };
   cloudlog = runTest ./cloudlog.nix;
diff --git a/nixos/tests/clickhouse/base.nix b/nixos/tests/clickhouse/base.nix
index fef710b2e5ab..cbeb5b64699a 100644
--- a/nixos/tests/clickhouse/base.nix
+++ b/nixos/tests/clickhouse/base.nix
@@ -1,35 +1,33 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "clickhouse";
-    meta.maintainers = with pkgs.lib.maintainers; [ jpds ];
+{ pkgs, ... }:
+{
+  name = "clickhouse";
+  meta.maintainers = with pkgs.lib.maintainers; [ jpds ];
 
-    nodes.machine = {
-      services.clickhouse.enable = true;
-      virtualisation.memorySize = 4096;
-    };
+  nodes.machine = {
+    services.clickhouse.enable = true;
+    virtualisation.memorySize = 4096;
+  };
 
-    testScript =
-      let
-        # work around quote/substitution complexity by Nix, Perl, bash and SQL.
-        tableDDL = pkgs.writeText "ddl.sql" "CREATE TABLE `demo` (`value` FixedString(10)) engine = MergeTree PARTITION BY value ORDER BY tuple();";
-        insertQuery = pkgs.writeText "insert.sql" "INSERT INTO `demo` (`value`) VALUES ('foo');";
-        selectQuery = pkgs.writeText "select.sql" "SELECT * from `demo`";
-      in
-      ''
-        machine.start()
-        machine.wait_for_unit("clickhouse.service")
-        machine.wait_for_open_port(9000)
+  testScript =
+    let
+      # work around quote/substitution complexity by Nix, Perl, bash and SQL.
+      tableDDL = pkgs.writeText "ddl.sql" "CREATE TABLE `demo` (`value` FixedString(10)) engine = MergeTree PARTITION BY value ORDER BY tuple();";
+      insertQuery = pkgs.writeText "insert.sql" "INSERT INTO `demo` (`value`) VALUES ('foo');";
+      selectQuery = pkgs.writeText "select.sql" "SELECT * from `demo`";
+    in
+    ''
+      machine.start()
+      machine.wait_for_unit("clickhouse.service")
+      machine.wait_for_open_port(9000)
 
-        machine.succeed(
-            "cat ${tableDDL} | clickhouse-client"
-        )
-        machine.succeed(
-            "cat ${insertQuery} | clickhouse-client"
-        )
-        machine.succeed(
-            "cat ${selectQuery} | clickhouse-client | grep foo"
-        )
-      '';
-  }
-)
+      machine.succeed(
+          "cat ${tableDDL} | clickhouse-client"
+      )
+      machine.succeed(
+          "cat ${insertQuery} | clickhouse-client"
+      )
+      machine.succeed(
+          "cat ${selectQuery} | clickhouse-client | grep foo"
+      )
+    '';
+}
diff --git a/nixos/tests/clickhouse/default.nix b/nixos/tests/clickhouse/default.nix
index 0efa24146ee3..e6568010eb66 100644
--- a/nixos/tests/clickhouse/default.nix
+++ b/nixos/tests/clickhouse/default.nix
@@ -1,12 +1,8 @@
-{
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../../.. { inherit system config; },
-}:
+{ runTest }:
 
 {
-  base = import ./base.nix { inherit system pkgs; };
-  kafka = import ./kafka.nix { inherit system pkgs; };
-  keeper = import ./keeper.nix { inherit system pkgs; };
-  s3 = import ./s3.nix { inherit system pkgs; };
+  base = runTest ./base.nix;
+  kafka = runTest ./kafka.nix;
+  keeper = runTest ./keeper.nix;
+  s3 = runTest ./s3.nix;
 }
diff --git a/nixos/tests/clickhouse/kafka.nix b/nixos/tests/clickhouse/kafka.nix
index 2dd6f1946e35..29e4f839d07f 100644
--- a/nixos/tests/clickhouse/kafka.nix
+++ b/nixos/tests/clickhouse/kafka.nix
@@ -1,174 +1,172 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    kafkaNamedCollectionConfig = ''
-      <clickhouse>
-        <named_collections>
-          <cluster_1>
-              <!-- ClickHouse Kafka engine parameters -->
-              <kafka_broker_list>kafka:9092</kafka_broker_list>
-              <kafka_topic_list>test_topic</kafka_topic_list>
-              <kafka_group_name>clickhouse</kafka_group_name>
-              <kafka_format>JSONEachRow</kafka_format>
-              <kafka_commit_every_batch>0</kafka_commit_every_batch>
-              <kafka_num_consumers>1</kafka_num_consumers>
-              <kafka_thread_per_consumer>1</kafka_thread_per_consumer>
+let
+  kafkaNamedCollectionConfig = ''
+    <clickhouse>
+      <named_collections>
+        <cluster_1>
+            <!-- ClickHouse Kafka engine parameters -->
+            <kafka_broker_list>kafka:9092</kafka_broker_list>
+            <kafka_topic_list>test_topic</kafka_topic_list>
+            <kafka_group_name>clickhouse</kafka_group_name>
+            <kafka_format>JSONEachRow</kafka_format>
+            <kafka_commit_every_batch>0</kafka_commit_every_batch>
+            <kafka_num_consumers>1</kafka_num_consumers>
+            <kafka_thread_per_consumer>1</kafka_thread_per_consumer>
 
-              <!-- Kafka extended configuration -->
-              <kafka>
-                <debug>all</debug>
-                <auto_offset_reset>earliest</auto_offset_reset>
-              </kafka>
-          </cluster_1>
-        </named_collections>
-      </clickhouse>
-    '';
+            <!-- Kafka extended configuration -->
+            <kafka>
+              <debug>all</debug>
+              <auto_offset_reset>earliest</auto_offset_reset>
+            </kafka>
+        </cluster_1>
+      </named_collections>
+    </clickhouse>
+  '';
 
-    kafkaNamedCollection = pkgs.writeText "kafka.xml" kafkaNamedCollectionConfig;
-  in
-  {
-    name = "clickhouse-kafka";
-    meta.maintainers = with pkgs.lib.maintainers; [ jpds ];
+  kafkaNamedCollection = pkgs.writeText "kafka.xml" kafkaNamedCollectionConfig;
+in
+{
+  name = "clickhouse-kafka";
+  meta.maintainers = with pkgs.lib.maintainers; [ jpds ];
 
-    nodes = {
-      clickhouse = {
-        environment.etc = {
-          "clickhouse-server/config.d/kafka.xml" = {
-            source = "${kafkaNamedCollection}";
-          };
+  nodes = {
+    clickhouse = {
+      environment.etc = {
+        "clickhouse-server/config.d/kafka.xml" = {
+          source = "${kafkaNamedCollection}";
         };
-
-        services.clickhouse.enable = true;
-        virtualisation.memorySize = 4096;
       };
 
-      kafka = {
-        networking.firewall.allowedTCPPorts = [
-          9092
-          9093
-        ];
-
-        environment.systemPackages = [
-          pkgs.apacheKafka
-          pkgs.jq
-        ];
-
-        services.apache-kafka = {
-          enable = true;
-
-          # Randomly generated uuid. You can get one by running:
-          # kafka-storage.sh random-uuid
-          clusterId = "b81s-MuGSwyt_B9_h37wtQ";
-
-          formatLogDirs = true;
-
-          settings = {
-            listeners = [
-              "PLAINTEXT://:9092"
-              "CONTROLLER://:9093"
-            ];
-            "listener.security.protocol.map" = [
-              "PLAINTEXT:PLAINTEXT"
-              "CONTROLLER:PLAINTEXT"
-            ];
-            "controller.quorum.voters" = [
-              "1@kafka:9093"
-            ];
-            "controller.listener.names" = [ "CONTROLLER" ];
-
-            "node.id" = 1;
-            "broker.rack" = 1;
-
-            "process.roles" = [
-              "broker"
-              "controller"
-            ];
-
-            "log.dirs" = [ "/var/lib/apache-kafka" ];
-            "num.partitions" = 1;
-            "offsets.topic.replication.factor" = 1;
-            "transaction.state.log.replication.factor" = 1;
-            "transaction.state.log.min.isr" = 1;
-          };
-        };
-
-        systemd.services.apache-kafka.serviceConfig.StateDirectory = "apache-kafka";
-      };
+      services.clickhouse.enable = true;
+      virtualisation.memorySize = 4096;
     };
 
-    testScript =
-      let
-        jsonTestMessage = pkgs.writeText "kafka-test-data.json" ''
-          { "id": 1, "first_name": "Fred", "age": 32 }
-          { "id": 2, "first_name": "Barbara", "age": 30 }
-          { "id": 3, "first_name": "Nicola", "age": 12 }
-        '';
-        # work around quote/substitution complexity by Nix, Perl, bash and SQL.
-        tableKafkaDDL = pkgs.writeText "ddl-kafka.sql" ''
-          CREATE TABLE `test_kafka_topic` (
-            `id` UInt32,
-            `first_name` String,
-            `age` UInt32
-          ) ENGINE = Kafka(cluster_1);
-        '';
+    kafka = {
+      networking.firewall.allowedTCPPorts = [
+        9092
+        9093
+      ];
 
-        tableDDL = pkgs.writeText "ddl.sql" ''
-          CREATE TABLE `test_topic` (
-            `id` UInt32,
-            `first_name` String,
-            `age` UInt32
-          ) ENGINE = MergeTree ORDER BY id;
-        '';
+      environment.systemPackages = [
+        pkgs.apacheKafka
+        pkgs.jq
+      ];
 
-        viewDDL = pkgs.writeText "view.sql" ''
-          CREATE MATERIALIZED VIEW kafka_view TO test_topic AS
-          SELECT
-              id,
-              first_name,
-              age,
-          FROM test_kafka_topic;
-        '';
-        selectQuery = pkgs.writeText "select.sql" "SELECT sum(age) from `test_topic`";
-      in
-      ''
-        kafka.start()
-        kafka.wait_for_unit("apache-kafka")
-        kafka.wait_for_open_port(9092)
+      services.apache-kafka = {
+        enable = true;
 
-        clickhouse.start()
-        clickhouse.wait_for_unit("clickhouse")
-        clickhouse.wait_for_open_port(9000)
+        # Randomly generated uuid. You can get one by running:
+        # kafka-storage.sh random-uuid
+        clusterId = "b81s-MuGSwyt_B9_h37wtQ";
 
-        clickhouse.wait_until_succeeds(
-          """
-            journalctl -o cat -u clickhouse.service | grep "Merging configuration file '/etc/clickhouse-server/config.d/kafka.xml'"
-          """
-        )
+        formatLogDirs = true;
 
-        clickhouse.succeed(
-          "cat ${tableKafkaDDL} | clickhouse-client"
-        )
+        settings = {
+          listeners = [
+            "PLAINTEXT://:9092"
+            "CONTROLLER://:9093"
+          ];
+          "listener.security.protocol.map" = [
+            "PLAINTEXT:PLAINTEXT"
+            "CONTROLLER:PLAINTEXT"
+          ];
+          "controller.quorum.voters" = [
+            "1@kafka:9093"
+          ];
+          "controller.listener.names" = [ "CONTROLLER" ];
 
-        clickhouse.succeed(
-          "cat ${tableDDL} | clickhouse-client"
-        )
+          "node.id" = 1;
+          "broker.rack" = 1;
 
-        clickhouse.succeed(
-          "cat ${viewDDL} | clickhouse-client"
-        )
+          "process.roles" = [
+            "broker"
+            "controller"
+          ];
 
-        kafka.succeed(
-          "jq -rc . ${jsonTestMessage} | kafka-console-producer.sh --topic test_topic --bootstrap-server kafka:9092"
-        )
+          "log.dirs" = [ "/var/lib/apache-kafka" ];
+          "num.partitions" = 1;
+          "offsets.topic.replication.factor" = 1;
+          "transaction.state.log.replication.factor" = 1;
+          "transaction.state.log.min.isr" = 1;
+        };
+      };
 
-        kafka.wait_until_succeeds(
-          "journalctl -o cat -u apache-kafka.service | grep 'Created a new member id ClickHouse-clickhouse-default-test_kafka_topic'"
-        )
+      systemd.services.apache-kafka.serviceConfig.StateDirectory = "apache-kafka";
+    };
+  };
 
-        clickhouse.wait_until_succeeds(
-          "cat ${selectQuery} | clickhouse-client | grep 74"
-        )
+  testScript =
+    let
+      jsonTestMessage = pkgs.writeText "kafka-test-data.json" ''
+        { "id": 1, "first_name": "Fred", "age": 32 }
+        { "id": 2, "first_name": "Barbara", "age": 30 }
+        { "id": 3, "first_name": "Nicola", "age": 12 }
       '';
-  }
-)
+      # work around quote/substitution complexity by Nix, Perl, bash and SQL.
+      tableKafkaDDL = pkgs.writeText "ddl-kafka.sql" ''
+        CREATE TABLE `test_kafka_topic` (
+          `id` UInt32,
+          `first_name` String,
+          `age` UInt32
+        ) ENGINE = Kafka(cluster_1);
+      '';
+
+      tableDDL = pkgs.writeText "ddl.sql" ''
+        CREATE TABLE `test_topic` (
+          `id` UInt32,
+          `first_name` String,
+          `age` UInt32
+        ) ENGINE = MergeTree ORDER BY id;
+      '';
+
+      viewDDL = pkgs.writeText "view.sql" ''
+        CREATE MATERIALIZED VIEW kafka_view TO test_topic AS
+        SELECT
+            id,
+            first_name,
+            age,
+        FROM test_kafka_topic;
+      '';
+      selectQuery = pkgs.writeText "select.sql" "SELECT sum(age) from `test_topic`";
+    in
+    ''
+      kafka.start()
+      kafka.wait_for_unit("apache-kafka")
+      kafka.wait_for_open_port(9092)
+
+      clickhouse.start()
+      clickhouse.wait_for_unit("clickhouse")
+      clickhouse.wait_for_open_port(9000)
+
+      clickhouse.wait_until_succeeds(
+        """
+          journalctl -o cat -u clickhouse.service | grep "Merging configuration file '/etc/clickhouse-server/config.d/kafka.xml'"
+        """
+      )
+
+      clickhouse.succeed(
+        "cat ${tableKafkaDDL} | clickhouse-client"
+      )
+
+      clickhouse.succeed(
+        "cat ${tableDDL} | clickhouse-client"
+      )
+
+      clickhouse.succeed(
+        "cat ${viewDDL} | clickhouse-client"
+      )
+
+      kafka.succeed(
+        "jq -rc . ${jsonTestMessage} | kafka-console-producer.sh --topic test_topic --bootstrap-server kafka:9092"
+      )
+
+      kafka.wait_until_succeeds(
+        "journalctl -o cat -u apache-kafka.service | grep 'Created a new member id ClickHouse-clickhouse-default-test_kafka_topic'"
+      )
+
+      clickhouse.wait_until_succeeds(
+        "cat ${selectQuery} | clickhouse-client | grep 74"
+      )
+    '';
+}
diff --git a/nixos/tests/clickhouse/keeper.nix b/nixos/tests/clickhouse/keeper.nix
index 27e839e288a7..40be4c19f2cf 100644
--- a/nixos/tests/clickhouse/keeper.nix
+++ b/nixos/tests/clickhouse/keeper.nix
@@ -1,185 +1,183 @@
-import ../make-test-python.nix (
-  { lib, pkgs, ... }:
-  rec {
-    name = "clickhouse-keeper";
-    meta.maintainers = with pkgs.lib.maintainers; [ jpds ];
+{ lib, pkgs, ... }:
+rec {
+  name = "clickhouse-keeper";
+  meta.maintainers = with pkgs.lib.maintainers; [ jpds ];
 
-    nodes =
-      let
-        node = i: {
+  nodes =
+    let
+      node = i: {
 
-          environment.etc = {
-            "clickhouse-server/config.d/cluster.xml".text = ''
-              <clickhouse>
-                <remote_servers>
-                  <perftest_2shards_1replicas>
-                    ${lib.concatStrings (
-                      lib.imap0 (j: name: ''
-                        <shard>
-                          <replica>
-                              <host>${name}</host>
-                              <port>9000</port>
-                          </replica>
-                        </shard>
-                      '') (builtins.attrNames nodes)
-                    )}
-                  </perftest_2shards_1replicas>
-                </remote_servers>
-              </clickhouse>
-            '';
-
-            "clickhouse-server/config.d/keeper.xml".text = ''
-              <clickhouse>
-                <keeper_server>
-                  <server_id>${toString i}</server_id>
-                  <tcp_port>9181</tcp_port>
-                  <log_storage_path>/var/lib/clickhouse/coordination/log</log_storage_path>
-                  <snapshot_storage_path>/var/lib/clickhouse/coordination/snapshots</snapshot_storage_path>
-
-                  <coordination_settings>
-                    <operation_timeout_ms>10000</operation_timeout_ms>
-                    <session_timeout_ms>30000</session_timeout_ms>
-                    <raft_logs_level>trace</raft_logs_level>
-                    <rotate_log_storage_interval>10000</rotate_log_storage_interval>
-                  </coordination_settings>
-
-                  <raft_configuration>
-                    ${lib.concatStrings (
-                      lib.imap1 (j: name: ''
-                        <server>
-                          <id>${toString j}</id>
-                          <hostname>${name}</hostname>
-                          <port>9444</port>
-                        </server>
-                      '') (builtins.attrNames nodes)
-                    )}
-                  </raft_configuration>
-                </keeper_server>
-
-                <zookeeper>
+        environment.etc = {
+          "clickhouse-server/config.d/cluster.xml".text = ''
+            <clickhouse>
+              <remote_servers>
+                <perftest_2shards_1replicas>
                   ${lib.concatStrings (
                     lib.imap0 (j: name: ''
-                      <node>
-                        <host>${name}</host>
-                        <port>9181</port>
-                      </node>
+                      <shard>
+                        <replica>
+                            <host>${name}</host>
+                            <port>9000</port>
+                        </replica>
+                      </shard>
                     '') (builtins.attrNames nodes)
                   )}
-                </zookeeper>
+                </perftest_2shards_1replicas>
+              </remote_servers>
+            </clickhouse>
+          '';
 
-                <distributed_ddl>
-                  <path>/clickhouse/testcluster/task_queue/ddl</path>
-                </distributed_ddl>
-              </clickhouse>
-            '';
+          "clickhouse-server/config.d/keeper.xml".text = ''
+            <clickhouse>
+              <keeper_server>
+                <server_id>${toString i}</server_id>
+                <tcp_port>9181</tcp_port>
+                <log_storage_path>/var/lib/clickhouse/coordination/log</log_storage_path>
+                <snapshot_storage_path>/var/lib/clickhouse/coordination/snapshots</snapshot_storage_path>
 
-            "clickhouse-server/config.d/listen.xml".text = ''
-              <clickhouse>
-                <listen_host>::</listen_host>
-              </clickhouse>
-            '';
+                <coordination_settings>
+                  <operation_timeout_ms>10000</operation_timeout_ms>
+                  <session_timeout_ms>30000</session_timeout_ms>
+                  <raft_logs_level>trace</raft_logs_level>
+                  <rotate_log_storage_interval>10000</rotate_log_storage_interval>
+                </coordination_settings>
 
-            "clickhouse-server/config.d/macros.xml".text = ''
-              <clickhouse>
-                <macros>
-                    <replica>${toString i}</replica>
-                    <cluster>perftest_2shards_1replicas</cluster>
-                </macros>
-              </clickhouse>
-            '';
-          };
+                <raft_configuration>
+                  ${lib.concatStrings (
+                    lib.imap1 (j: name: ''
+                      <server>
+                        <id>${toString j}</id>
+                        <hostname>${name}</hostname>
+                        <port>9444</port>
+                      </server>
+                    '') (builtins.attrNames nodes)
+                  )}
+                </raft_configuration>
+              </keeper_server>
 
-          networking.firewall.allowedTCPPorts = [
-            9009
-            9181
-            9444
-          ];
+              <zookeeper>
+                ${lib.concatStrings (
+                  lib.imap0 (j: name: ''
+                    <node>
+                      <host>${name}</host>
+                      <port>9181</port>
+                    </node>
+                  '') (builtins.attrNames nodes)
+                )}
+              </zookeeper>
 
-          services.clickhouse.enable = true;
+              <distributed_ddl>
+                <path>/clickhouse/testcluster/task_queue/ddl</path>
+              </distributed_ddl>
+            </clickhouse>
+          '';
 
-          systemd.services.clickhouse = {
-            after = [ "network-online.target" ];
-            requires = [ "network-online.target" ];
-          };
+          "clickhouse-server/config.d/listen.xml".text = ''
+            <clickhouse>
+              <listen_host>::</listen_host>
+            </clickhouse>
+          '';
 
-          virtualisation.memorySize = 1024 * 4;
-          virtualisation.diskSize = 1024 * 10;
+          "clickhouse-server/config.d/macros.xml".text = ''
+            <clickhouse>
+              <macros>
+                  <replica>${toString i}</replica>
+                  <cluster>perftest_2shards_1replicas</cluster>
+              </macros>
+            </clickhouse>
+          '';
         };
-      in
-      {
-        clickhouse1 = node 1;
-        clickhouse2 = node 2;
+
+        networking.firewall.allowedTCPPorts = [
+          9009
+          9181
+          9444
+        ];
+
+        services.clickhouse.enable = true;
+
+        systemd.services.clickhouse = {
+          after = [ "network-online.target" ];
+          requires = [ "network-online.target" ];
+        };
+
+        virtualisation.memorySize = 1024 * 4;
+        virtualisation.diskSize = 1024 * 10;
       };
+    in
+    {
+      clickhouse1 = node 1;
+      clickhouse2 = node 2;
+    };
 
-    testScript =
-      let
-        # work around quote/substitution complexity by Nix, Perl, bash and SQL.
-        clustersQuery = pkgs.writeText "clusters.sql" "SHOW clusters";
-        keeperQuery = pkgs.writeText "keeper.sql" "SELECT * FROM system.zookeeper WHERE path IN ('/', '/clickhouse') FORMAT VERTICAL";
-        systemClustersQuery = pkgs.writeText "system-clusters.sql" "SELECT host_name, host_address, replica_num FROM system.clusters WHERE cluster = 'perftest_2shards_1replicas'";
+  testScript =
+    let
+      # work around quote/substitution complexity by Nix, Perl, bash and SQL.
+      clustersQuery = pkgs.writeText "clusters.sql" "SHOW clusters";
+      keeperQuery = pkgs.writeText "keeper.sql" "SELECT * FROM system.zookeeper WHERE path IN ('/', '/clickhouse') FORMAT VERTICAL";
+      systemClustersQuery = pkgs.writeText "system-clusters.sql" "SELECT host_name, host_address, replica_num FROM system.clusters WHERE cluster = 'perftest_2shards_1replicas'";
 
-        tableDDL = pkgs.writeText "table.sql" ''
-          CREATE TABLE test ON cluster 'perftest_2shards_1replicas'   ( A Int64, S String)
-          Engine = ReplicatedMergeTree('/clickhouse/{cluster}/tables/{database}/{table}', '{replica}')
-          ORDER BY A;
-        '';
+      tableDDL = pkgs.writeText "table.sql" ''
+        CREATE TABLE test ON cluster 'perftest_2shards_1replicas'   ( A Int64, S String)
+        Engine = ReplicatedMergeTree('/clickhouse/{cluster}/tables/{database}/{table}', '{replica}')
+        ORDER BY A;
+      '';
 
-        insertDDL = pkgs.writeText "insert.sql" "
+      insertDDL = pkgs.writeText "insert.sql" "
           INSERT INTO test SELECT number, '' FROM numbers(100000000);
         ";
 
-        selectCountQuery = pkgs.writeText "select-count.sql" "
+      selectCountQuery = pkgs.writeText "select-count.sql" "
           select count() from test;
         ";
-      in
-      ''
-        clickhouse1.start()
-        clickhouse2.start()
+    in
+    ''
+      clickhouse1.start()
+      clickhouse2.start()
 
-        for machine in clickhouse1, clickhouse2:
-          machine.wait_for_unit("clickhouse.service")
-          machine.wait_for_open_port(9000)
-          machine.wait_for_open_port(9009)
-          machine.wait_for_open_port(9181)
-          machine.wait_for_open_port(9444)
+      for machine in clickhouse1, clickhouse2:
+        machine.wait_for_unit("clickhouse.service")
+        machine.wait_for_open_port(9000)
+        machine.wait_for_open_port(9009)
+        machine.wait_for_open_port(9181)
+        machine.wait_for_open_port(9444)
 
-          machine.wait_until_succeeds(
-            """
-              journalctl -o cat -u clickhouse.service | grep "Merging configuration file '/etc/clickhouse-server/config.d/keeper.xml'"
-            """
-          )
-
-          machine.log(machine.succeed(
-            "cat ${clustersQuery} | clickhouse-client | grep perftest_2shards_1replicas"
-          ))
-
-          machine.log(machine.succeed(
-            "cat ${keeperQuery} | clickhouse-client"
-          ))
-
-          machine.succeed(
-            "cat ${systemClustersQuery} | clickhouse-client | grep clickhouse1"
-          )
-          machine.succeed(
-            "cat ${systemClustersQuery} | clickhouse-client | grep clickhouse2"
-          )
-
-          machine.succeed(
-            "ls /var/lib/clickhouse/coordination/log | grep changelog"
-          )
-
-        clickhouse2.succeed(
-          "cat ${tableDDL} | clickhouse-client"
+        machine.wait_until_succeeds(
+          """
+            journalctl -o cat -u clickhouse.service | grep "Merging configuration file '/etc/clickhouse-server/config.d/keeper.xml'"
+          """
         )
 
-        clickhouse2.succeed(
-          "cat ${insertDDL} | clickhouse-client"
+        machine.log(machine.succeed(
+          "cat ${clustersQuery} | clickhouse-client | grep perftest_2shards_1replicas"
+        ))
+
+        machine.log(machine.succeed(
+          "cat ${keeperQuery} | clickhouse-client"
+        ))
+
+        machine.succeed(
+          "cat ${systemClustersQuery} | clickhouse-client | grep clickhouse1"
+        )
+        machine.succeed(
+          "cat ${systemClustersQuery} | clickhouse-client | grep clickhouse2"
         )
 
-        for machine in clickhouse1, clickhouse2:
-          machine.wait_until_succeeds(
-            "cat ${selectCountQuery} | clickhouse-client | grep 100000000"
-          )
-      '';
-  }
-)
+        machine.succeed(
+          "ls /var/lib/clickhouse/coordination/log | grep changelog"
+        )
+
+      clickhouse2.succeed(
+        "cat ${tableDDL} | clickhouse-client"
+      )
+
+      clickhouse2.succeed(
+        "cat ${insertDDL} | clickhouse-client"
+      )
+
+      for machine in clickhouse1, clickhouse2:
+        machine.wait_until_succeeds(
+          "cat ${selectCountQuery} | clickhouse-client | grep 100000000"
+        )
+    '';
+}
diff --git a/nixos/tests/clickhouse/s3.nix b/nixos/tests/clickhouse/s3.nix
index b3ba5b360cc0..2268b6128fe6 100644
--- a/nixos/tests/clickhouse/s3.nix
+++ b/nixos/tests/clickhouse/s3.nix
@@ -1,123 +1,121 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    s3 = {
-      bucket = "clickhouse-bucket";
-      accessKey = "BKIKJAA5BMMU2RHO6IBB";
-      secretKey = "V7f1CwQqAcwo80UEIJEjc5gVQUSSx5ohQ9GSrr12";
-    };
+let
+  s3 = {
+    bucket = "clickhouse-bucket";
+    accessKey = "BKIKJAA5BMMU2RHO6IBB";
+    secretKey = "V7f1CwQqAcwo80UEIJEjc5gVQUSSx5ohQ9GSrr12";
+  };
 
-    clickhouseS3StorageConfig = ''
-      <clickhouse>
-        <storage_configuration>
-          <disks>
-            <s3_disk>
-              <type>s3</type>
-              <endpoint>http://minio:9000/${s3.bucket}/</endpoint>
-              <access_key_id>${s3.accessKey}</access_key_id>
-              <secret_access_key>${s3.secretKey}</secret_access_key>
-              <metadata_path>/var/lib/clickhouse/disks/s3_disk/</metadata_path>
-            </s3_disk>
-            <s3_cache>
-              <type>cache</type>
-              <disk>s3_disk</disk>
-              <path>/var/lib/clickhouse/disks/s3_cache/</path>
-              <max_size>10Gi</max_size>
-            </s3_cache>
-          </disks>
-          <policies>
-            <s3_main>
-              <volumes>
-                <main>
-                  <disk>s3_disk</disk>
-                </main>
-              </volumes>
-            </s3_main>
-          </policies>
-        </storage_configuration>
-      </clickhouse>
-    '';
-  in
-  {
-    name = "clickhouse-s3";
-    meta.maintainers = with pkgs.lib.maintainers; [ jpds ];
+  clickhouseS3StorageConfig = ''
+    <clickhouse>
+      <storage_configuration>
+        <disks>
+          <s3_disk>
+            <type>s3</type>
+            <endpoint>http://minio:9000/${s3.bucket}/</endpoint>
+            <access_key_id>${s3.accessKey}</access_key_id>
+            <secret_access_key>${s3.secretKey}</secret_access_key>
+            <metadata_path>/var/lib/clickhouse/disks/s3_disk/</metadata_path>
+          </s3_disk>
+          <s3_cache>
+            <type>cache</type>
+            <disk>s3_disk</disk>
+            <path>/var/lib/clickhouse/disks/s3_cache/</path>
+            <max_size>10Gi</max_size>
+          </s3_cache>
+        </disks>
+        <policies>
+          <s3_main>
+            <volumes>
+              <main>
+                <disk>s3_disk</disk>
+              </main>
+            </volumes>
+          </s3_main>
+        </policies>
+      </storage_configuration>
+    </clickhouse>
+  '';
+in
+{
+  name = "clickhouse-s3";
+  meta.maintainers = with pkgs.lib.maintainers; [ jpds ];
 
-    nodes = {
-      clickhouse = {
-        environment.etc = {
-          "clickhouse-server/config.d/s3.xml" = {
-            text = "${clickhouseS3StorageConfig}";
-          };
+  nodes = {
+    clickhouse = {
+      environment.etc = {
+        "clickhouse-server/config.d/s3.xml" = {
+          text = "${clickhouseS3StorageConfig}";
         };
-
-        services.clickhouse.enable = true;
-        virtualisation.diskSize = 15 * 1024;
-        virtualisation.memorySize = 4 * 1024;
       };
 
-      minio =
-        { pkgs, ... }:
-        {
-          virtualisation.diskSize = 2 * 1024;
-          networking.firewall.allowedTCPPorts = [ 9000 ];
-
-          services.minio = {
-            enable = true;
-            inherit (s3) accessKey secretKey;
-          };
-
-          environment.systemPackages = [ pkgs.minio-client ];
-        };
+      services.clickhouse.enable = true;
+      virtualisation.diskSize = 15 * 1024;
+      virtualisation.memorySize = 4 * 1024;
     };
 
-    testScript =
-      let
-        # work around quote/substitution complexity by Nix, Perl, bash and SQL.
-        tableDDL = pkgs.writeText "ddl.sql" ''
-          CREATE TABLE `demo` (
-            `value` String
-          )
-          ENGINE = MergeTree
-          ORDER BY value
-          SETTINGS storage_policy = 's3_main';
-        '';
-        insertQuery = pkgs.writeText "insert.sql" "INSERT INTO `demo` (`value`) VALUES ('foo');";
-        selectQuery = pkgs.writeText "select.sql" "SELECT * from `demo`";
-      in
-      ''
-        minio.wait_for_unit("minio")
-        minio.wait_for_open_port(9000)
-        minio.succeed(
-          "mc alias set minio "
-          + "http://localhost:9000 "
-          + "${s3.accessKey} ${s3.secretKey} --api s3v4",
-          "mc mb minio/${s3.bucket}",
-        )
+    minio =
+      { pkgs, ... }:
+      {
+        virtualisation.diskSize = 2 * 1024;
+        networking.firewall.allowedTCPPorts = [ 9000 ];
 
-        clickhouse.start()
-        clickhouse.wait_for_unit("clickhouse.service")
-        clickhouse.wait_for_open_port(9000)
+        services.minio = {
+          enable = true;
+          inherit (s3) accessKey secretKey;
+        };
 
-        clickhouse.wait_until_succeeds(
-          """
-            journalctl -o cat -u clickhouse.service | grep "Merging configuration file '/etc/clickhouse-server/config.d/s3.xml'"
-          """
-        )
+        environment.systemPackages = [ pkgs.minio-client ];
+      };
+  };
 
-        clickhouse.succeed(
-            "cat ${tableDDL} | clickhouse-client"
+  testScript =
+    let
+      # work around quote/substitution complexity by Nix, Perl, bash and SQL.
+      tableDDL = pkgs.writeText "ddl.sql" ''
+        CREATE TABLE `demo` (
+          `value` String
         )
-        clickhouse.succeed(
-            "cat ${insertQuery} | clickhouse-client"
-        )
-        clickhouse.succeed(
-            "cat ${selectQuery} | clickhouse-client | grep foo"
-        )
-
-        minio.log(minio.succeed(
-          "mc ls minio/${s3.bucket}",
-        ))
+        ENGINE = MergeTree
+        ORDER BY value
+        SETTINGS storage_policy = 's3_main';
       '';
-  }
-)
+      insertQuery = pkgs.writeText "insert.sql" "INSERT INTO `demo` (`value`) VALUES ('foo');";
+      selectQuery = pkgs.writeText "select.sql" "SELECT * from `demo`";
+    in
+    ''
+      minio.wait_for_unit("minio")
+      minio.wait_for_open_port(9000)
+      minio.succeed(
+        "mc alias set minio "
+        + "http://localhost:9000 "
+        + "${s3.accessKey} ${s3.secretKey} --api s3v4",
+        "mc mb minio/${s3.bucket}",
+      )
+
+      clickhouse.start()
+      clickhouse.wait_for_unit("clickhouse.service")
+      clickhouse.wait_for_open_port(9000)
+
+      clickhouse.wait_until_succeeds(
+        """
+          journalctl -o cat -u clickhouse.service | grep "Merging configuration file '/etc/clickhouse-server/config.d/s3.xml'"
+        """
+      )
+
+      clickhouse.succeed(
+          "cat ${tableDDL} | clickhouse-client"
+      )
+      clickhouse.succeed(
+          "cat ${insertQuery} | clickhouse-client"
+      )
+      clickhouse.succeed(
+          "cat ${selectQuery} | clickhouse-client | grep foo"
+      )
+
+      minio.log(minio.succeed(
+        "mc ls minio/${s3.bucket}",
+      ))
+    '';
+}

From b96ba61ce130cdd621d8468c8e11cd021d63fb96 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 16 Jun 2025 02:01:23 +0200
Subject: [PATCH 20/47] station: drop

Per the contributing guidelines there must be a committer in
meta.maintainers to unblock fast updates.

But this browser is a joke, all electron browser are. They cannot be safe
browsers by design. And this one pins Electron 27 and we ship its
vendored Electron version. It went EOL on 2024-04-16.
---
 pkgs/by-name/st/station/package.nix | 50 -----------------------------
 pkgs/top-level/aliases.nix          |  1 +
 2 files changed, 1 insertion(+), 50 deletions(-)
 delete mode 100644 pkgs/by-name/st/station/package.nix

diff --git a/pkgs/by-name/st/station/package.nix b/pkgs/by-name/st/station/package.nix
deleted file mode 100644
index c80a0ad5a3b4..000000000000
--- a/pkgs/by-name/st/station/package.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{
-  lib,
-  appimageTools,
-  fetchurl,
-  makeWrapper,
-  nix-update-script,
-}:
-let
-  version = "3.3.0";
-  pname = "station";
-  src = fetchurl {
-    url = "https://github.com/getstation/desktop-app/releases/download/v${version}/Station-x86_64.AppImage";
-    hash = "sha256-OiUVRKpU2W1dJ6z9Dqvxd+W4/oNpG+Zolj43ZHpKaO0=";
-  };
-  appimageContents = appimageTools.extractType2 {
-    inherit pname version src;
-  };
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
-  extraInstallCommands = ''
-    source "${makeWrapper}/nix-support/setup-hook"
-    wrapProgram $out/bin/${pname} \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
-    install -m 444 -D ${appimageContents}/station-desktop-app.desktop \
-      $out/share/applications/station-desktop-app.desktop
-    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/station-desktop-app.png \
-      $out/share/icons/hicolor/512x512/apps/station-desktop-app.png
-    substituteInPlace $out/share/applications/station-desktop-app.desktop \
-      --replace-fail 'Exec=AppRun' 'Exec=station'
-  '';
-
-  passthru = {
-    updateScript = nix-update-script {
-      extraArgs = [ "--url=https://github.com/getstation/desktop-app" ];
-    };
-  };
-
-  meta = {
-    changelog = "https://github.com/getstation/desktop-app/releases/tag/v${version}";
-    description = "A single place for all of your web applications";
-    downloadPage = "https://github.com/getstation/desktop-app/releases";
-    homepage = "https://getstation.com/";
-    license = lib.licenses.asl20;
-    mainProgram = "station";
-    maintainers = with lib.maintainers; [ flexiondotorg ];
-    platforms = [ "x86_64-linux" ];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 5ef666197848..a4e9de4208c8 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1834,6 +1834,7 @@ mapAliases {
   ssm-agent = amazon-ssm-agent; # Added 2023-10-17
   starpls-bin = starpls;
   starspace = throw "starspace has been removed from nixpkgs, as it was broken"; # Added 2024-07-15
+  station = throw "station has been removed from nixpkgs, as there were no committers among its maintainers to unblock security issues"; # added 2025-06-16
   steamPackages = {
     steamArch = throw "`steamPackages.steamArch` has been removed as it's no longer applicable";
     steam = lib.warnOnInstantiate "`steamPackages.steam` has been moved to top level as `steam-unwrapped`" steam-unwrapped;

From 78a023058c3489904c6f570d0fd512b316d7cb2d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Jun 2025 02:19:48 +0000
Subject: [PATCH 21/47] pfetch: 1.9.0 -> 1.9.1

---
 pkgs/by-name/pf/pfetch/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pf/pfetch/package.nix b/pkgs/by-name/pf/pfetch/package.nix
index 1a559db35571..78e373fa4bc2 100644
--- a/pkgs/by-name/pf/pfetch/package.nix
+++ b/pkgs/by-name/pf/pfetch/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "pfetch";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "Un1q32";
     repo = "pfetch";
     tag = version;
-    hash = "sha256-DWntcAowiia4gEiYcZCJ6+uDGQ5h2eh/XwSSW+ThPKY=";
+    hash = "sha256-a2ay+Ag9vYwGGENRPCcFLCmtyOCyHhF6/P7NAn/CzSI=";
   };
 
   dontBuild = true;

From 712d22863f7724a8b66394e59911318830795cbd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Jun 2025 03:31:12 +0000
Subject: [PATCH 22/47] copilot-language-server: 1.330.0 -> 1.335.0

---
 pkgs/by-name/co/copilot-language-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/copilot-language-server/package.nix b/pkgs/by-name/co/copilot-language-server/package.nix
index 20230ef65b76..2a4fbd59d141 100644
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -45,11 +45,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.330.0";
+  version = "1.335.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-native-${finalAttrs.version}.zip";
-    hash = "sha256-/Em00UVEg46gEI52fG7aQo2rqKwqrF3V1tAVx2hpyMc=";
+    hash = "sha256-ZMnbfVLe1ZtYYCaMhSNqeWfHEtKJf8BImiipypa57w0=";
     stripRoot = false;
   };
 

From 5d4fe2a55cde4e48df34317c2dd0a9ef6ba420dc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Jun 2025 04:31:55 +0000
Subject: [PATCH 23/47] vscode-extensions.gitlab.gitlab-workflow: 6.21.0 ->
 6.25.0

---
 pkgs/applications/editors/vscode/extensions/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index db06989b0752..7db5464ac46b 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2129,8 +2129,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.21.0";
-          hash = "sha256-vaOAk4ovQjUcnBtxqMlRstYLvR6uzmqGk3Sx6zV6wvY=";
+          version = "6.25.0";
+          hash = "sha256-Y4NeeT2CddHj++hE0JxionmEPQHaIeibsrwztCjHYHs=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";

From 63fe6de7258a7caf94b1482e5d05e6d56f3f53ba Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Jun 2025 04:50:30 +0000
Subject: [PATCH 24/47] mirrord: 3.143.0 -> 3.144.0

---
 pkgs/by-name/mi/mirrord/manifest.json | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json
index dc66bc77a164..cad3b85fb214 100644
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.143.0",
+  "version": "3.144.0",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.143.0/mirrord_linux_x86_64",
-      "hash": "sha256-0wu90iNAP7OQYENHIPsTSPk8Ko2jK0uBdZWe2d1URS8="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.144.0/mirrord_linux_x86_64",
+      "hash": "sha256-XbveB71EIChiuPVfqOshEhPZHnTGd7xJt48/zuyq5TA="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.143.0/mirrord_linux_aarch64",
-      "hash": "sha256-MWQ5k9Tk6q7f5QQ3Og9O5dyEDd+wNi3FFYqbFpa7uxM="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.144.0/mirrord_linux_aarch64",
+      "hash": "sha256-4Tw68aWpNsjfi6d7qgBhbVvAMsHwUsttfVSpx3Kv2Nk="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.143.0/mirrord_mac_universal",
-      "hash": "sha256-GdwZWtNTuiUf+DcuZkVUm0YVH0EKfT6V6clcv1E7BxY="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.144.0/mirrord_mac_universal",
+      "hash": "sha256-FhRgopH7QRH+30Bofoiwdx3Vlne6D/ftaqhGuUnyH0g="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.143.0/mirrord_mac_universal",
-      "hash": "sha256-GdwZWtNTuiUf+DcuZkVUm0YVH0EKfT6V6clcv1E7BxY="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.144.0/mirrord_mac_universal",
+      "hash": "sha256-FhRgopH7QRH+30Bofoiwdx3Vlne6D/ftaqhGuUnyH0g="
     }
   }
 }

From 204f3d137ca52305dbe80e141e5b4642b9e70b04 Mon Sep 17 00:00:00 2001
From: Mahyar Mirrashed <mah.mirr@gmail.com>
Date: Mon, 16 Jun 2025 00:42:31 -0500
Subject: [PATCH 25/47] vimPlugins.search-and-replace-nvim: init at 2025-06-16

chore: add runtime dependencies
---
 pkgs/applications/editors/vim/plugins/generated.nix | 13 +++++++++++++
 pkgs/applications/editors/vim/plugins/overrides.nix | 10 ++++++++++
 .../editors/vim/plugins/vim-plugin-names            |  1 +
 3 files changed, 24 insertions(+)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 211674e389da..b51ff99c10b0 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -13199,6 +13199,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  search-and-replace-nvim = buildVimPlugin {
+    pname = "search-and-replace.nvim";
+    version = "2025-06-16";
+    src = fetchFromGitHub {
+      owner = "mahyarmirrashed";
+      repo = "search-and-replace.nvim";
+      rev = "12dce26afc7f3c66d6ffbf2eae91ce19d4cdcc74";
+      sha256 = "0i197fs58qk6mgqsxi7cacba8sya7kh9cdnnz6sa79ry42cdff6a";
+    };
+    meta.homepage = "https://github.com/mahyarmirrashed/search-and-replace.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   searchbox-nvim = buildVimPlugin {
     pname = "searchbox.nvim";
     version = "2025-01-09";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index a96ed59fe44b..821a7be77646 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -124,6 +124,9 @@
   uv,
   # nvim-vstsl dependencies
   vtsls,
+  # search-and-replace.nvim dependencies
+  fd,
+  sad,
 }:
 self: super:
 let
@@ -3022,6 +3025,13 @@ in
     dependencies = [ self.nui-nvim ];
   };
 
+  search-and-replace-nvim = super.search-and-replace-nvim.overrideAttrs {
+    runtimeDeps = [
+      fd
+      sad
+    ];
+  };
+
   skim = buildVimPlugin {
     pname = "skim";
     inherit (skim) version;
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 219c65e60e87..860ce0bc9942 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1013,6 +1013,7 @@ https://github.com/tiagovla/scope.nvim/,HEAD,
 https://github.com/0xJohnnyboy/scretch.nvim/,HEAD,
 https://github.com/Xuyuanp/scrollbar.nvim/,,
 https://github.com/cakebaker/scss-syntax.vim/,,
+https://github.com/mahyarmirrashed/search-and-replace.nvim/,HEAD,
 https://github.com/VonHeikemen/searchbox.nvim/,,
 https://github.com/RobertAudi/securemodelines/,,
 https://github.com/megaannum/self/,,

From 6a6cbb2850623a2ce7cf80c17c884e3a5faba947 Mon Sep 17 00:00:00 2001
From: RatCornu <balthazar.patiachvili@crans.org>
Date: Fri, 14 Feb 2025 18:34:43 +0100
Subject: [PATCH 26/47] python312Packages.heif-image-plugin: init at 0.6.2

---
 .../heif-image-plugin/default.nix             | 34 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 36 insertions(+)
 create mode 100644 pkgs/development/python-modules/heif-image-plugin/default.nix

diff --git a/pkgs/development/python-modules/heif-image-plugin/default.nix b/pkgs/development/python-modules/heif-image-plugin/default.nix
new file mode 100644
index 000000000000..0216fa39fb53
--- /dev/null
+++ b/pkgs/development/python-modules/heif-image-plugin/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  cffi,
+  piexif,
+  pillow,
+}:
+
+buildPythonPackage rec {
+  pname = "heif-image-plugin";
+  version = "0.6.2";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "uploadcare";
+    repo = "heif-image-plugin";
+    rev = "v${version}";
+    hash = "sha256-SlnnlBscNelNH0XkOenq3nolyqzRMK10SzVii61Moi4=";
+  };
+
+  propagatedBuildInputs = [
+    cffi
+    piexif
+    pillow
+  ];
+
+  meta = {
+    description = "Simple HEIF/HEIC images plugin for Pillow base on pyhief library";
+    homepage = "https://github.com/uploadcare/heif-image-plugin";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ratcornu ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 256f47de64f7..0a3fef7d002f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6376,6 +6376,8 @@ self: super: with self; {
 
   hebg = callPackage ../development/python-modules/hebg { };
 
+  heif-image-plugin = callPackage ../development/python-modules/heif-image-plugin { };
+
   help2man = callPackage ../development/python-modules/help2man { };
 
   helpdev = callPackage ../development/python-modules/helpdev { };

From 11f0150cf68f373f01471ef1f4eb6e8c4eeed944 Mon Sep 17 00:00:00 2001
From: RatCornu <balthazar.patiachvili@crans.org>
Date: Fri, 14 Feb 2025 18:55:02 +0100
Subject: [PATCH 27/47] python312Packages.pillow-avif-plugin: init at 1.4.6

---
 .../pillow-avif-plugin/default.nix            | 30 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 32 insertions(+)
 create mode 100644 pkgs/development/python-modules/pillow-avif-plugin/default.nix

diff --git a/pkgs/development/python-modules/pillow-avif-plugin/default.nix b/pkgs/development/python-modules/pillow-avif-plugin/default.nix
new file mode 100644
index 000000000000..3750e1d1dd4c
--- /dev/null
+++ b/pkgs/development/python-modules/pillow-avif-plugin/default.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  libavif,
+  pillow,
+}:
+
+buildPythonPackage rec {
+  pname = "pillow-avif-plugin";
+  version = "1.4.6";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-hVz1DQP2/Bbh/V42SzzqC3n0v5DTn/ISOWlzXYUeCLo=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+  buildInputs = [ libavif ];
+  propagatedBuildInputs = [ pillow ];
+
+  meta = {
+    description = "Pillow plugin that adds support for AVIF files";
+    homepage = "https://github.com/fdintino/pillow-avif-plugin";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ ratcornu ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0a3fef7d002f..194f76088537 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11370,6 +11370,8 @@ self: super: with self; {
     inherit (pkgs.xorg) libxcb;
   };
 
+  pillow-avif-plugin = callPackage ../development/python-modules/pillow-avif-plugin { };
+
   pillow-heif = callPackage ../development/python-modules/pillow-heif { };
 
   pillow-jpls = callPackage ../development/python-modules/pillow-jpls { };

From 9925eb833969fad0afc245699c6386effd54751b Mon Sep 17 00:00:00 2001
From: RatCornu <balthazar.patiachvili@crans.org>
Date: Sun, 16 Feb 2025 19:31:19 +0100
Subject: [PATCH 28/47] szurubooru: init at 2.5-unstable-2025-02-11

---
 pkgs/servers/web-apps/szurubooru/client.nix  | 36 +++++++++
 pkgs/servers/web-apps/szurubooru/default.nix | 20 +++++
 pkgs/servers/web-apps/szurubooru/server.nix  | 82 ++++++++++++++++++++
 pkgs/top-level/all-packages.nix              |  2 +
 4 files changed, 140 insertions(+)
 create mode 100644 pkgs/servers/web-apps/szurubooru/client.nix
 create mode 100644 pkgs/servers/web-apps/szurubooru/default.nix
 create mode 100644 pkgs/servers/web-apps/szurubooru/server.nix

diff --git a/pkgs/servers/web-apps/szurubooru/client.nix b/pkgs/servers/web-apps/szurubooru/client.nix
new file mode 100644
index 000000000000..9553390862d4
--- /dev/null
+++ b/pkgs/servers/web-apps/szurubooru/client.nix
@@ -0,0 +1,36 @@
+{
+  src,
+  version,
+  lib,
+  buildNpmPackage,
+}:
+
+buildNpmPackage {
+  pname = "szurubooru-client";
+  inherit version;
+
+  src = "${src}/client";
+
+  npmDepsHash = "sha256-HtcitZl2idgVleB6c0KCTSNLxh7hP8/G/RGdMaQG3iI=";
+  makeCacheWritable = true;
+
+  npmBuildFlags = [
+    "--gzip"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    mv ./public/* $out
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Client of szurubooru, an image board engine for small and medium communities";
+    homepage = "https://github.com/rr-/szurubooru";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ ratcornu ];
+  };
+}
diff --git a/pkgs/servers/web-apps/szurubooru/default.nix b/pkgs/servers/web-apps/szurubooru/default.nix
new file mode 100644
index 000000000000..67d7b57aa20f
--- /dev/null
+++ b/pkgs/servers/web-apps/szurubooru/default.nix
@@ -0,0 +1,20 @@
+{
+  callPackage,
+  fetchFromGitHub,
+  recurseIntoAttrs,
+}:
+
+let
+  version = "2.5-unstable-2025-02-11";
+  src = fetchFromGitHub {
+    owner = "rr-";
+    repo = "szurubooru";
+    rev = "376f687c386f65522b2f65e98b998b21af26ee29";
+    hash = "sha256-4w1iOYp+CVg60dYxRilj08D4Hle6R9Y0v+Nd3fws1Zc=";
+  };
+in
+
+recurseIntoAttrs {
+  client = callPackage ./client.nix { inherit src version; };
+  server = callPackage ./server.nix { inherit src version; };
+}
diff --git a/pkgs/servers/web-apps/szurubooru/server.nix b/pkgs/servers/web-apps/szurubooru/server.nix
new file mode 100644
index 000000000000..a85b749c7426
--- /dev/null
+++ b/pkgs/servers/web-apps/szurubooru/server.nix
@@ -0,0 +1,82 @@
+{
+  src,
+  version,
+  lib,
+  fetchPypi,
+  python3,
+}:
+
+let
+  overrides = [
+    (self: super: {
+      alembic = super.alembic.overridePythonAttrs (oldAttrs: rec {
+        version = "1.14.1";
+        src = fetchPypi {
+          pname = "alembic";
+          inherit version;
+          sha256 = "sha256-SW6IgkWlOt8UmPyrMXE6Rpxlg2+N524BOZqhw+kN0hM=";
+        };
+        doCheck = false;
+      });
+
+      pyheif = super.pyheif.overridePythonAttrs (oldAttrs: {
+        doCheck = false;
+      });
+
+      sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
+        version = "1.3.23";
+        src = fetchPypi {
+          pname = "SQLAlchemy";
+          inherit version;
+          sha256 = "sha256-b8ozZyV4Zm9lfBMVUsTviXnBYG5JT3jNUZl0LfsmkYs=";
+        };
+
+        doCheck = false;
+      });
+    })
+  ];
+
+  python = python3.override {
+    self = python;
+    packageOverrides = lib.composeManyExtensions overrides;
+  };
+in
+
+python.pkgs.buildPythonApplication {
+  pname = "szurubooru-server";
+  inherit version;
+  pyproject = true;
+
+  src = "${src}/server";
+
+  nativeBuildInputs = with python.pkgs; [ setuptools ];
+  propagatedBuildInputs = with python.pkgs; [
+    alembic
+    certifi
+    coloredlogs
+    heif-image-plugin
+    numpy
+    pillow-avif-plugin
+    pillow
+    psycopg2-binary
+    pyheif
+    pynacl
+    pyrfc3339
+    pytz
+    pyyaml
+    sqlalchemy
+    yt-dlp
+  ];
+
+  postInstall = ''
+    mkdir $out/bin
+    install -m0755 $src/szuru-admin $out/bin/szuru-admin
+  '';
+
+  meta = with lib; {
+    description = "Server of szurubooru, an image board engine for small and medium communities";
+    homepage = "https://github.com/rr-/szurubooru";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ ratcornu ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 16748b632d83..94b5763734ed 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9676,6 +9676,8 @@ with pkgs;
 
   svxlink = libsForQt5.callPackage ../applications/radio/svxlink { };
 
+  szurubooru = callPackage ../servers/web-apps/szurubooru { };
+
   tclap = tclap_1_2;
 
   tclap_1_2 = callPackage ../development/libraries/tclap/1.2.nix { };

From 94de595a56d3bc0f4ea06cd25aa50b56e7dc61b0 Mon Sep 17 00:00:00 2001
From: RatCornu <balthazar.patiachvili@crans.org>
Date: Tue, 18 Feb 2025 19:46:57 +0100
Subject: [PATCH 29/47] nixos/szurubooru: init at 2.5-unstable-2025-02-11

---
 nixos/doc/manual/redirects.json               |  12 +
 nixos/modules/module-list.nix                 |   1 +
 nixos/modules/services/web-apps/szurubooru.md |  80 +++++
 .../modules/services/web-apps/szurubooru.nix  | 331 ++++++++++++++++++
 4 files changed, 424 insertions(+)
 create mode 100644 nixos/modules/services/web-apps/szurubooru.md
 create mode 100644 nixos/modules/services/web-apps/szurubooru.nix

diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 86854c1065ac..5970010e9e64 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -551,6 +551,18 @@
   "module-services-youtrack-upgrade-2022_3-2023_1": [
     "index.html#module-services-youtrack-upgrade-2022_3-2023_1"
   ],
+  "module-services-szurubooru": [
+    "index.html#module-services-szurubooru"
+  ],
+  "module-services-szurubooru-basic-usage": [
+    "index.html#module-services-szurubooru-basic-usage"
+  ],
+  "module-services-szurubooru-reverse-proxy-configuration": [
+    "index.html#module-services-szurubooru-reverse-proxy-configuration"
+  ],
+  "module-services-szurubooru-extra-config": [
+    "index.html#module-services-szurubooru-extra-config"
+  ],
   "module-services-suwayomi-server": [
     "index.html#module-services-suwayomi-server"
   ],
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index fec4eda45b8b..78cebbee8ca5 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1663,6 +1663,7 @@
   ./services/web-apps/stirling-pdf.nix
   ./services/web-apps/strfry.nix
   ./services/web-apps/suwayomi-server.nix
+  ./services/web-apps/szurubooru.nix
   ./services/web-apps/trilium.nix
   ./services/web-apps/tt-rss.nix
   ./services/web-apps/vikunja.nix
diff --git a/nixos/modules/services/web-apps/szurubooru.md b/nixos/modules/services/web-apps/szurubooru.md
new file mode 100644
index 000000000000..368fe608d450
--- /dev/null
+++ b/nixos/modules/services/web-apps/szurubooru.md
@@ -0,0 +1,80 @@
+# Szurubooru {#module-services-szurubooru}
+
+An image board engine dedicated for small and medium communities.
+
+## Configuration {#module-services-szurubooru-basic-usage}
+
+By default the module will execute Szurubooru server only, the web client only contains static files that can be reached via a reverse proxy.
+
+Here is a basic configuration:
+
+```nix
+{
+  services.szurubooru = {
+    enable = true;
+
+    server = {
+      port = 8080;
+
+      settings = {
+        domain = "https://szurubooru.domain.tld";
+        secretFile = /path/to/secret/file;
+      };
+    };
+
+    database = {
+      passwordFile = /path/to/secret/file;
+    };
+  };
+}
+```
+
+## Reverse proxy configuration {#module-services-szurubooru-reverse-proxy-configuration}
+
+The prefered method to run this service is behind a reverse proxy not to expose an open port. For example, here is a minimal Nginx configuration:
+
+```nix
+{
+  services.szurubooru = {
+    enable = true;
+
+    server = {
+      port = 8080;
+      ...
+    };
+
+    ...
+  };
+
+  services.nginx.virtualHosts."szurubooru.domain.tld" = {
+    locations = {
+      "/api/".proxyPass = "http://localhost:8080/";
+      "/data/".root = config.services.szurubooru.dataDir;
+      "/" = {
+        root = config.services.szurubooru.client.package;
+        tryFiles = "$uri /index.htm";
+      };
+    };
+  };
+}
+```
+
+## Extra configuration {#module-services-szurubooru-extra-config}
+
+Not all configuration options of the server are available directly in this module, but you can add them in `services.szurubooru.server.settings`:
+
+```nix
+{
+  services.szurubooru = {
+    enable = true;
+
+    server.settings = {
+      domain = "https://szurubooru.domain.tld";
+      delete_source_files = "yes";
+      contact_email = "example@domain.tld";
+    };
+  };
+}
+```
+
+You can find all of the options in the default config file available [here](https://github.com/rr-/szurubooru/blob/master/server/config.yaml.dist).
diff --git a/nixos/modules/services/web-apps/szurubooru.nix b/nixos/modules/services/web-apps/szurubooru.nix
new file mode 100644
index 000000000000..95b1a7ad7e8b
--- /dev/null
+++ b/nixos/modules/services/web-apps/szurubooru.nix
@@ -0,0 +1,331 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.szurubooru;
+  inherit (lib)
+    mkOption
+    mkEnableOption
+    mkIf
+    mkPackageOption
+    types
+    ;
+  format = pkgs.formats.yaml { };
+  python = pkgs.python312;
+in
+
+{
+  options = {
+    services.szurubooru = {
+      enable = mkEnableOption "Szurubooru, an image board engine dedicated for small and medium communities";
+
+      user = mkOption {
+        type = types.str;
+        default = "szurubooru";
+        description = ''
+          User account under which Szurubooru runs.
+        '';
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "szurubooru";
+        description = ''
+          Group under which Szurubooru runs.
+        '';
+      };
+
+      dataDir = mkOption {
+        type = types.path;
+        default = "/var/lib/szurubooru";
+        example = "/var/lib/szuru";
+        description = ''
+          The path to the data directory in which Szurubooru will store its data.
+        '';
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        example = true;
+        description = ''
+          Whether to open the firewall for the port in {option}`services.szurubooru.server.port`.
+        '';
+      };
+
+      server = {
+        package = mkPackageOption pkgs [
+          "szurubooru"
+          "server"
+        ] { };
+
+        port = mkOption {
+          type = types.port;
+          default = 8080;
+          example = 9000;
+          description = ''
+            Port to expose HTTP service.
+          '';
+        };
+
+        threads = mkOption {
+          type = types.int;
+          default = 4;
+          example = 6;
+          description = ''Number of waitress threads to start.'';
+        };
+
+        settings = mkOption {
+          type = types.submodule {
+            freeformType = format.type;
+            options = {
+              name = mkOption {
+                type = types.str;
+                default = "szurubooru";
+                example = "Szuru";
+                description = ''Name shown in the website title and on the front page.'';
+              };
+
+              domain = mkOption {
+                type = types.str;
+                example = "http://example.com";
+                description = ''Full URL to the homepage of this szurubooru site (with no trailing slash).'';
+              };
+
+              # NOTE: this is not a real upstream option
+              secretFile = mkOption {
+                type = types.path;
+                example = "/run/secrets/szurubooru-server-secret";
+                description = ''
+                  File containing a secret used to salt the users' password hashes and generate filenames for static content.
+                '';
+              };
+
+              delete_source_files = mkOption {
+                type = types.enum [
+                  "yes"
+                  "no"
+                ];
+                default = "no";
+                example = "yes";
+                description = ''Whether to delete thumbnails and source files on post delete.'';
+              };
+
+              smtp = {
+                host = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  example = "localhost";
+                  description = ''Host of the SMTP server used to send reset password.'';
+                };
+
+                port = mkOption {
+                  type = types.nullOr types.port;
+                  default = null;
+                  example = 25;
+                  description = ''Port of the SMTP server.'';
+                };
+
+                user = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  example = "bot";
+                  description = ''User to connect to the SMTP server.'';
+                };
+
+                # NOTE: this is not a real upstream option
+                passFile = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  example = "/run/secrets/szurubooru-smtp-pass";
+                  description = ''File containing the password associated to the given user for the SMTP server.'';
+                };
+              };
+
+              data_url = mkOption {
+                type = types.str;
+                default = "${cfg.server.settings.domain}/data/";
+                defaultText = lib.literalExpression ''"''${services.szurubooru.server.settings.domain}/data/"'';
+                example = "http://example.com/content/";
+                description = ''Full URL to the data endpoint.'';
+              };
+
+              data_dir = mkOption {
+                type = types.path;
+                default = "${cfg.dataDir}/data";
+                defaultText = lib.literalExpression ''"''${services.szurubooru.dataDir}/data"'';
+                example = "/srv/szurubooru/data";
+                description = ''Path to the static files.'';
+              };
+
+              debug = mkOption {
+                type = types.int;
+                default = 0;
+                example = 1;
+                description = ''Whether to generate server logs.'';
+              };
+
+              show_sql = mkOption {
+                type = types.int;
+                default = 0;
+                example = 1;
+                description = ''Whether to show SQL in server logs.'';
+              };
+            };
+          };
+          description = ''
+            Configuration to write to {file}`config.yaml`.
+            See <https://github.com/rr-/szurubooru/blob/master/server/config.yaml.dist> for more information.
+          '';
+        };
+      };
+
+      client = {
+        package = mkPackageOption pkgs [
+          "szurubooru"
+          "client"
+        ] { };
+      };
+
+      database = {
+        host = mkOption {
+          type = types.str;
+          default = "localhost";
+          example = "192.168.1.2";
+          description = ''Host on which the PostgreSQL database runs.'';
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 5432;
+          description = ''The port under which PostgreSQL listens to.'';
+        };
+
+        name = mkOption {
+          type = types.str;
+          default = cfg.database.user;
+          defaultText = lib.literalExpression "szurubooru.database.name";
+          example = "szuru";
+          description = ''Name of the PostgreSQL database.'';
+        };
+
+        user = mkOption {
+          type = types.str;
+          default = "szurubooru";
+          example = "szuru";
+          description = ''PostgreSQL user.'';
+        };
+
+        passwordFile = mkOption {
+          type = types.path;
+          example = "/run/secrets/szurubooru-db-password";
+          description = ''A file containing the password for the PostgreSQL user.'';
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.server.port ];
+
+    users.groups = mkIf (cfg.group == "szurubooru") {
+      szurubooru = { };
+    };
+
+    users.users = mkIf (cfg.user == "szurubooru") {
+      szurubooru = {
+        group = cfg.group;
+        description = "Szurubooru Daemon user";
+        isSystemUser = true;
+      };
+    };
+
+    systemd.services.szurubooru =
+      let
+        configFile = format.generate "config.yaml" (
+          lib.pipe cfg.server.settings [
+            (
+              settings:
+              lib.recursiveUpdate settings {
+                secretFile = null;
+                secret = "$SZURUBOORU_SECRET";
+
+                smtp.pass = if settings.smtp.passFile != null then "$SZURUBOORU_SMTP_PASS" else null;
+                smtp.passFile = null;
+                smtp.enable = null;
+
+                database = "postgresql://${cfg.database.user}:$SZURUBOORU_DATABASE_PASSWORD@${cfg.database.host}:${toString cfg.database.port}/${cfg.database.name}";
+              }
+            )
+            (lib.filterAttrsRecursive (_: x: x != null))
+          ]
+        );
+        pyenv = python.buildEnv.override {
+          extraLibs = [ (python.pkgs.toPythonModule cfg.server.package) ];
+        };
+      in
+      {
+        description = "Server of Szurubooru, an image board engine dedicated for small and medium communities";
+
+        wantedBy = [
+          "multi-user.target"
+          "szurubooru-client.service"
+        ];
+        before = [ "szurubooru-client.service" ];
+        after = [
+          "network.target"
+          "network-online.target"
+        ];
+        wants = [ "network-online.target" ];
+
+        environment = {
+          PYTHONPATH = "${pyenv}/${pyenv.sitePackages}/";
+        };
+
+        path =
+          with pkgs;
+          [
+            envsubst
+            ffmpeg_4-full
+          ]
+          ++ (with python.pkgs; [
+            alembic
+            waitress
+          ]);
+
+        script = ''
+          export SZURUBOORU_SECRET="$(<${cfg.server.settings.secretFile})"
+          export SZURUBOORU_DATABASE_PASSWORD="$(<${cfg.database.passwordFile})"
+          ${lib.optionalString (cfg.server.settings.smtp.passFile != null) ''
+            export SZURUBOORU_SMTP_PASS=$(<${cfg.server.settings.smtp.passFile})
+          ''}
+          install -m0640 ${cfg.server.package.src}/config.yaml.dist ${cfg.dataDir}/config.yaml.dist
+          envsubst -i ${configFile} -o ${cfg.dataDir}/config.yaml
+          sed 's|script_location = |script_location = ${cfg.server.package.src}/|' ${cfg.server.package.src}/alembic.ini > ${cfg.dataDir}/alembic.ini
+          alembic upgrade head
+          waitress-serve --port ${toString cfg.server.port} --threads ${toString cfg.server.threads} szurubooru.facade:app
+        '';
+
+        serviceConfig = {
+          User = cfg.user;
+          Group = cfg.group;
+
+          Type = "simple";
+          Restart = "on-failure";
+
+          StateDirectory = mkIf (cfg.dataDir == "/var/lib/szurubooru") "szurubooru";
+          WorkingDirectory = cfg.dataDir;
+        };
+      };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ ratcornu ];
+    doc = ./szurubooru.md;
+  };
+}

From 99d14360785dd1f04db7bbc79c195277895c4908 Mon Sep 17 00:00:00 2001
From: RatCornu <balthazar.patiachvili@crans.org>
Date: Mon, 10 Mar 2025 15:06:36 +0100
Subject: [PATCH 30/47] nixos/szurubooru: add nixos test

---
 nixos/tests/all-tests.nix                   |  1 +
 nixos/tests/szurubooru.nix                  | 52 +++++++++++++++++++++
 pkgs/servers/web-apps/szurubooru/server.nix |  3 ++
 3 files changed, 56 insertions(+)
 create mode 100644 nixos/tests/szurubooru.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 6cb04827cb77..6bfdee9c3619 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1372,6 +1372,7 @@ in
   systemd-homed = runTest ./systemd-homed.nix;
   systemtap = handleTest ./systemtap.nix { };
   startx = import ./startx.nix { inherit pkgs runTest; };
+  szurubooru = handleTest ./szurubooru.nix { };
   taler = handleTest ./taler { };
   tandoor-recipes = runTest ./tandoor-recipes.nix;
   tandoor-recipes-script-name = runTest ./tandoor-recipes-script-name.nix;
diff --git a/nixos/tests/szurubooru.nix b/nixos/tests/szurubooru.nix
new file mode 100644
index 000000000000..adcfecdbf34b
--- /dev/null
+++ b/nixos/tests/szurubooru.nix
@@ -0,0 +1,52 @@
+import ./make-test-python.nix (
+  { lib, pkgs, ... }:
+  {
+    name = "szurubooru";
+    meta.maintainers = with lib.maintainers; [ ratcornu ];
+
+    nodes.machine =
+      let
+        dbpass = "changeme";
+      in
+
+      { config, ... }:
+      {
+        services.postgresql = {
+          enable = true;
+          initialScript = pkgs.writeText "init.sql" ''
+            CREATE USER ${config.services.szurubooru.database.user} WITH PASSWORD '${dbpass}';
+            CREATE DATABASE ${config.services.szurubooru.database.name} WITH OWNER ${config.services.szurubooru.database.user};
+          '';
+        };
+
+        services.szurubooru = {
+          enable = true;
+
+          dataDir = "/var/lib/szurubooru";
+
+          server = {
+            port = 6666;
+            settings = {
+              domain = "http://127.0.0.1";
+              secretFile = pkgs.writeText "secret" "secret";
+              debug = 1;
+            };
+          };
+
+          database = {
+            host = "localhost";
+            port = 5432;
+            name = "szurubooru";
+            user = "szurubooru";
+            passwordFile = pkgs.writeText "pass" "${dbpass}";
+          };
+        };
+      };
+
+    testScript = ''
+      machine.wait_for_unit("szurubooru.service")
+      machine.wait_for_open_port(6666)
+      machine.succeed('curl -H "Content-Type: application/json" -H "Accept: application/json" --fail http://127.0.0.1:6666/info')
+    '';
+  }
+)
diff --git a/pkgs/servers/web-apps/szurubooru/server.nix b/pkgs/servers/web-apps/szurubooru/server.nix
index a85b749c7426..0d5a7b65e257 100644
--- a/pkgs/servers/web-apps/szurubooru/server.nix
+++ b/pkgs/servers/web-apps/szurubooru/server.nix
@@ -2,6 +2,7 @@
   src,
   version,
   lib,
+  nixosTests,
   fetchPypi,
   python3,
 }:
@@ -73,6 +74,8 @@ python.pkgs.buildPythonApplication {
     install -m0755 $src/szuru-admin $out/bin/szuru-admin
   '';
 
+  passthru.tests.szurubooru = nixosTests.szurubooru;
+
   meta = with lib; {
     description = "Server of szurubooru, an image board engine for small and medium communities";
     homepage = "https://github.com/rr-/szurubooru";

From 1198555d317e31454b72bccfc37acddc6ab53ec2 Mon Sep 17 00:00:00 2001
From: RatCornu <balthazar.patiachvili@crans.org>
Date: Mon, 10 Mar 2025 15:09:37 +0100
Subject: [PATCH 31/47] nixos/szurubooru: add release note

---
 nixos/doc/manual/release-notes/rl-2511.section.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index a8a311b69bc6..58f11b6a5e57 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -32,6 +32,8 @@
 
 - [postfix-tlspol](https://github.com/Zuplu/postfix-tlspol), MTA-STS and DANE resolver and TLS policy server for Postfix. Available as [services.postfix-tlspol](#opt-services.postfix-tlspol.enable).
 
+- [Szurubooru](https://github.com/rr-/szurubooru), an image board engine inspired by services such as Danbooru, dedicated for small and medium communities. Available as [services.szurubooru](#opt-services.szurubooru.enable).
+
 - [SuiteNumérique Docs](https://github.com/suitenumerique/docs), a collaborative note taking, wiki and documentation web platform and alternative to Notion or Outline. Available as [services.lasuite-docs](#opt-services.lasuite-docs.enable).
 
 [dwl](https://codeberg.org/dwl/dwl), a compact, hackable compositor for Wayland based on wlroots. Available as [programs.dwl](#opt-programs.dwl.enable).

From e9b6f129ae67a3599a2336e990c364d77a6e0135 Mon Sep 17 00:00:00 2001
From: Benedikt Rips <benedikt.rips@gmail.com>
Date: Wed, 26 Mar 2025 10:53:34 +0100
Subject: [PATCH 32/47] clean: init at 3.1

This also fixes a build regression incurred by GCC 14 that led to the
previous derivation being removed in 41068ae0c69c.
---
 ...port-do-not-rebuild-equal-timestamps.patch | 21 +++++
 ...clare-functions-explicitly-for-gcc14.patch | 22 +++++
 pkgs/by-name/cl/clean/package.nix             | 80 +++++++++++++++++++
 pkgs/top-level/aliases.nix                    |  1 -
 4 files changed, 123 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/cl/clean/chroot-build-support-do-not-rebuild-equal-timestamps.patch
 create mode 100644 pkgs/by-name/cl/clean/declare-functions-explicitly-for-gcc14.patch
 create mode 100644 pkgs/by-name/cl/clean/package.nix

diff --git a/pkgs/by-name/cl/clean/chroot-build-support-do-not-rebuild-equal-timestamps.patch b/pkgs/by-name/cl/clean/chroot-build-support-do-not-rebuild-equal-timestamps.patch
new file mode 100644
index 000000000000..3f0d0a25d3a7
--- /dev/null
+++ b/pkgs/by-name/cl/clean/chroot-build-support-do-not-rebuild-equal-timestamps.patch
@@ -0,0 +1,21 @@
+The clean command line compiler clm uses timestamps of dcl, icl, abc and o files
+to decide what must be rebuild.  However as for chroot builds, all of the
+library files will have equal timestamps, this leads to clm trying to rebuild
+the library modules distributed with the Clean installation every time a user
+compiles any file, which fails ue to the absence of write permission on the Nix
+store.
+
+This patch changes the freshness check to use less than instead of less than or
+equal to in order to avoid this.
+
+--- b/src/clm/clm.c
++++ a/src/clm/clm.c
+@@ -250,7 +250,7 @@
+ 		|| (t1.dwHighDateTime==t2.dwHighDateTime && (unsigned)(t1.dwLowDateTime)<=(unsigned)(t2.dwLowDateTime)))
+ #else
+ 	typedef unsigned long FileTime;
+-#	define FILE_TIME_LE(t1,t2) (t1<=t2)
++#	define FILE_TIME_LE(t1,t2) (t1<t2)
+ #endif
+ 
+ typedef struct project_node {
diff --git a/pkgs/by-name/cl/clean/declare-functions-explicitly-for-gcc14.patch b/pkgs/by-name/cl/clean/declare-functions-explicitly-for-gcc14.patch
new file mode 100644
index 000000000000..aa9c7d7e0df3
--- /dev/null
+++ b/pkgs/by-name/cl/clean/declare-functions-explicitly-for-gcc14.patch
@@ -0,0 +1,22 @@
+--- a/src/RuntimeSystem/scon.c
++++ b/src/RuntimeSystem/scon.c
+@@ -858,6 +858,8 @@
+ int execution_aborted;
+ int return_code;
+ 
++extern void abc_main (void);
++
+ int main (int argc,char **argv)
+ {
+ 	int arg_n;
+
+--- a/src/clm/cachingcompiler.h
++++ b/src/clm/cachingcompiler.h
+@@ -1,6 +1,7 @@
+ Clean (:: *Thread :== Int)
+ int start_caching_compiler (CleanCharArray compiler_path);
+ Clean (start_caching_compiler :: {#Char} Thread -> (Int, Thread))
++int start_caching_compiler_with_args (CleanCharArray coc_path, char** cocl_argv, int cocl_argv_size);
+ int call_caching_compiler (CleanCharArray args);
+ Clean (call_caching_compiler :: {#Char} Thread -> (Int, Thread))
+ int stop_caching_compiler (void);
diff --git a/pkgs/by-name/cl/clean/package.nix b/pkgs/by-name/cl/clean/package.nix
new file mode 100644
index 000000000000..c75a7296b6ae
--- /dev/null
+++ b/pkgs/by-name/cl/clean/package.nix
@@ -0,0 +1,80 @@
+{
+  binutils,
+  fetchurl,
+  gcc,
+  lib,
+  runCommand,
+  stdenv,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "clean";
+  version = "3.1";
+
+  src =
+    if stdenv.hostPlatform.system == "i686-linux" then
+      (fetchurl {
+        url = "https://ftp.cs.ru.nl/Clean/Clean31/linux/clean3.1_32_boot.tar.gz";
+        sha256 = "Ls0IKf+o7yhRLhtSV61jzmnYukfh5x5fogHaP5ke/Ck=";
+      })
+    else if stdenv.hostPlatform.system == "x86_64-linux" then
+      (fetchurl {
+        url = "https://ftp.cs.ru.nl/Clean/Clean31/linux/clean3.1_64_boot.tar.gz";
+        sha256 = "Gg5CVZjrwDBtV7Vuw21Xj6Rn+qN1Mf6B3ls6r/16oBc=";
+      })
+    else
+      throw "Architecture not supported";
+
+  hardeningDisable = [ "pic" ];
+
+  patches = [
+    ./chroot-build-support-do-not-rebuild-equal-timestamps.patch
+    ./declare-functions-explicitly-for-gcc14.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail 'INSTALL_DIR = $(CURRENTDIR)' "INSTALL_DIR = $out"
+    substituteInPlace src/clm/clm.c \
+      --replace-fail /usr/bin/as ${binutils}/bin/as \
+      --replace-fail /usr/bin/gcc ${gcc}/bin/gcc
+  '';
+
+  buildFlags = [ "-C src/" ];
+
+  # do not strip libraries and executables since all symbols since they are
+  # required as is for compilation. Especially the labels of unused section need
+  # to be kept.
+  dontStrip = true;
+
+  passthru.tests.compile-hello-world = runCommand "compile-hello-world" { } ''
+    cat >HelloWorld.icl <<EOF
+    module HelloWorld
+    Start = "Hello, world!"
+    EOF
+    ${finalAttrs.finalPackage}/bin/clm HelloWorld -o hello-world
+    touch $out
+  '';
+
+  meta = {
+    description = "General purpose, state-of-the-art, pure and lazy functional programming language";
+    longDescription = ''
+      Clean is a general purpose, state-of-the-art, pure and lazy functional
+      programming language designed for making real-world applications. Some
+      of its most notable language features are uniqueness typing, dynamic typing,
+      and generic functions.
+    '';
+
+    homepage = "http://wiki.clean.cs.ru.nl/Clean";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [
+      bmrips
+      erin
+    ];
+    platforms = [
+      "i686-linux"
+      "x86_64-linux"
+    ];
+    mainProgram = "clean";
+  };
+})
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 81a23b6edbdc..fd07a6b6d4b9 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -436,7 +436,6 @@ mapAliases {
   citra = throw "citra has been removed from nixpkgs, as it has been taken down upstream"; # added 2024-03-04
   citra-nightly = throw "citra-nightly has been removed from nixpkgs, as it has been taken down upstream"; # added 2024-03-04
   citra-canary = throw "citra-canary has been removed from nixpkgs, as it has been taken down upstream"; # added 2024-03-04
-  clean = throw "'clean' has been removed from nixpkgs, as it is unmaintained and broken"; # Added 2025-05-18
   cloog = throw "cloog has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-09-13
   cloog_0_18_0 = throw "cloog_0_18_0 has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-09-13
   cloogppl = throw "cloogppl has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-09-13

From 23f472730beb1e119a5bc6689c1da64e4bdeeaba Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Mon, 16 Jun 2025 09:07:23 +0200
Subject: [PATCH 33/47] departure-mono: use `sourceRoot`

Follow up of https://github.com/NixOS/nixpkgs/pull/417058
---
 pkgs/by-name/de/departure-mono/package.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/de/departure-mono/package.nix b/pkgs/by-name/de/departure-mono/package.nix
index 84b4381e9f53..e3aefa976abc 100644
--- a/pkgs/by-name/de/departure-mono/package.nix
+++ b/pkgs/by-name/de/departure-mono/package.nix
@@ -14,12 +14,14 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     hash = "sha256-XYL76L266MKqClxfbPn/C6+x/vcs7AD56DtiDmQam2A=";
   };
 
+  sourceRoot = "${finalAttrs.src.name}/DepartureMono-${finalAttrs.version}";
+
   installPhase = ''
     runHook preInstall
 
-    install -D -m 444 DepartureMono-1.500/*.otf -t $out/share/fonts/otf
-    install -D -m 444 DepartureMono-1.500/*.woff -t $out/share/fonts/woff
-    install -D -m 444 DepartureMono-1.500/*.woff2 -t $out/share/fonts/woff2
+    install -D -m 444 *.otf -t $out/share/fonts/otf
+    install -D -m 444 *.woff -t $out/share/fonts/woff
+    install -D -m 444 *.woff2 -t $out/share/fonts/woff2
 
     runHook postInstall
   '';

From 6085eb03d44c641ea8b3c2100f52332e5bdc3f1b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 15 Jun 2025 13:31:12 +0000
Subject: [PATCH 34/47] novops: 0.19.0 -> 0.20.0

---
 pkgs/by-name/no/novops/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/no/novops/package.nix b/pkgs/by-name/no/novops/package.nix
index 8898152794e1..d0d6d9b60ff8 100644
--- a/pkgs/by-name/no/novops/package.nix
+++ b/pkgs/by-name/no/novops/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "novops";
-  version = "0.19.0";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "PierreBeucher";
     repo = "novops";
     rev = "v${version}";
-    hash = "sha256-bpv8Ybrsb2CAV8Qxj69F2E/mekYsOuAiZWuDNHDtxw0=";
+    hash = "sha256-TvlbA9RXuAPm1rN3VaIrVKMfyePT9oLSh87Bqclwcj8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-w5jBCVoLm0zzLMa7COHsQbHq+TlJZCnabNZyO8nlTKk=";
+  cargoHash = "sha256-oXOK8LQZ2+u566HIi0DYuocEsZMfj1ogkHciH8hFVR8=";
 
   buildInputs =
     [

From 0ae7439ac7da1b21820a13f8550c22dcfc15e2a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Mon, 16 Jun 2025 14:40:01 +0700
Subject: [PATCH 35/47] =?UTF-8?q?antonio-font:=20stdenv=20=E2=86=92=20stde?=
 =?UTF-8?q?nvNoCC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

oops
---
 pkgs/by-name/an/antonio-font/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/an/antonio-font/package.nix b/pkgs/by-name/an/antonio-font/package.nix
index d9ff06682f2b..1c15c06105ab 100644
--- a/pkgs/by-name/an/antonio-font/package.nix
+++ b/pkgs/by-name/an/antonio-font/package.nix
@@ -1,10 +1,10 @@
 {
   lib,
-  stdenv,
+  stdenvNoCC,
   fetchFromGitHub,
 }:
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   pname = "antonio";
   version = "0-unstable-2013-11-21";
 

From 35ddde8ed1b161e22d4018de40a8b72c88c5116b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Jun 2025 07:44:17 +0000
Subject: [PATCH 36/47] termscp: 0.17.0 -> 0.18.0

---
 pkgs/by-name/te/termscp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/te/termscp/package.nix b/pkgs/by-name/te/termscp/package.nix
index a32508c59623..0cc5c2c8159c 100644
--- a/pkgs/by-name/te/termscp/package.nix
+++ b/pkgs/by-name/te/termscp/package.nix
@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "termscp";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "veeso";
     repo = "termscp";
     tag = "v${version}";
-    hash = "sha256-ClCPXux1sM3hRbtJ3YngrAmc4btTgQmg/Bg/7uFHCOw=";
+    hash = "sha256-QBvxXl1+f2617dwoZzSJq9vQY6hOXeHZjEh4xqMyayA=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-k/6+EWHAXd8BN551xDlQkYsBZsP/jgT+NO5GbVXJkVI=";
+  cargoHash = "sha256-ghJdAou3IsDVmOnDYiYO1yR3BtkrfUek10Bh9GuVH1E=";
 
   nativeBuildInputs = [
     pkg-config

From 9e5b34e810455f43d38290b2289e21906f0d7eb0 Mon Sep 17 00:00:00 2001
From: Damien Cassou <damien@cassou.me>
Date: Wed, 11 Jun 2025 13:24:52 +0200
Subject: [PATCH 37/47] reckon: 0.9.2 -> 0.11.1

This was done with:
  nix-shell maintainers/scripts/update.nix --argstr package reckon
---
 pkgs/tools/text/reckon/Gemfile.lock | 12 ++++++++----
 pkgs/tools/text/reckon/gemset.nix   | 26 ++++++++++++++++++++++++--
 2 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/pkgs/tools/text/reckon/Gemfile.lock b/pkgs/tools/text/reckon/Gemfile.lock
index 7409a4bae84f..4242ab5536c8 100644
--- a/pkgs/tools/text/reckon/Gemfile.lock
+++ b/pkgs/tools/text/reckon/Gemfile.lock
@@ -1,15 +1,19 @@
 GEM
   remote: https://rubygems.org/
   specs:
+    abbrev (0.1.2)
     chronic (0.10.2)
+    csv (3.3.5)
     highline (2.1.0)
     matrix (0.4.2)
     rchardet (1.8.0)
-    reckon (0.9.2)
+    reckon (0.11.1)
+      abbrev (> 0.1)
       chronic (>= 0.3.0)
-      highline (>= 1.5.2)
+      csv (> 0.1)
+      highline (~> 2.0)
       matrix (>= 0.4.2)
-      rchardet (>= 1.8.0)
+      rchardet (= 1.8.0)
 
 PLATFORMS
   ruby
@@ -18,4 +22,4 @@ DEPENDENCIES
   reckon
 
 BUNDLED WITH
-   2.4.13
+   2.6.6
diff --git a/pkgs/tools/text/reckon/gemset.nix b/pkgs/tools/text/reckon/gemset.nix
index d8903b9adf4e..1aae5dd9be0e 100644
--- a/pkgs/tools/text/reckon/gemset.nix
+++ b/pkgs/tools/text/reckon/gemset.nix
@@ -1,4 +1,14 @@
 {
+  abbrev = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0hj2qyx7rzpc7awhvqlm597x7qdxwi4kkml4aqnp5jylmsm4w6xd";
+      type = "gem";
+    };
+    version = "0.1.2";
+  };
   chronic = {
     groups = [ "default" ];
     platforms = [ ];
@@ -9,6 +19,16 @@
     };
     version = "0.10.2";
   };
+  csv = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0gz7r2kazwwwyrwi95hbnhy54kwkfac5swh2gy5p5vw36fn38lbf";
+      type = "gem";
+    };
+    version = "3.3.5";
+  };
   highline = {
     groups = [ "default" ];
     platforms = [ ];
@@ -41,7 +61,9 @@
   };
   reckon = {
     dependencies = [
+      "abbrev"
       "chronic"
+      "csv"
       "highline"
       "matrix"
       "rchardet"
@@ -50,9 +72,9 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0188k41lvz5vnn03qw1hbi6c2i88n5p3183rb0xz9rfjcngh2ly3";
+      sha256 = "1y4iqjmgzj9nrp22pmayia54mpb4d6ga85q9xzqir7mhcd2bdca1";
       type = "gem";
     };
-    version = "0.9.2";
+    version = "0.11.1";
   };
 }

From 15d2bf6cf6d88482f70bf3e021d4fabb37ccbf36 Mon Sep 17 00:00:00 2001
From: Damien Cassou <damien@cassou.me>
Date: Wed, 11 Jun 2025 13:29:32 +0200
Subject: [PATCH 38/47] reckon: Add passthru.tests.version

---
 pkgs/tools/text/reckon/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/text/reckon/default.nix b/pkgs/tools/text/reckon/default.nix
index 7efdfe91cf64..a1dc52c8fe8a 100644
--- a/pkgs/tools/text/reckon/default.nix
+++ b/pkgs/tools/text/reckon/default.nix
@@ -5,6 +5,8 @@
   bundlerUpdateScript,
   makeWrapper,
   file,
+  testers,
+  reckon,
 }:
 
 stdenv.mkDerivation rec {
@@ -31,7 +33,13 @@ stdenv.mkDerivation rec {
       runHook postInstall
     '';
 
-  passthru.updateScript = bundlerUpdateScript "reckon";
+  passthru = {
+    tests.version = testers.testVersion {
+      package = reckon;
+      version = "${version}";
+    };
+    updateScript = bundlerUpdateScript "reckon";
+  };
 
   meta = with lib; {
     description = "Flexibly import bank account CSV files into Ledger for command line accounting";

From 9c03be63f9fb06146f312ccdbb8c97c80dd87b8e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Jun 2025 07:59:03 +0000
Subject: [PATCH 39/47] s-search: 0.7.2 -> 0.7.3

---
 pkgs/by-name/s-/s-search/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/s-/s-search/package.nix b/pkgs/by-name/s-/s-search/package.nix
index 3e8ba938eeb7..16fa1088f117 100644
--- a/pkgs/by-name/s-/s-search/package.nix
+++ b/pkgs/by-name/s-/s-search/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "s-search";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "zquestz";
     repo = "s";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5hkorROs11nrDK5/BBEPIugVYeVUWtAnpCBBuKTj15g=";
+    hash = "sha256-g+Gz16U5rP3v+RbutDUh5+1YdTDe+ROFEnNAlNZX1fw=";
   };
 
   vendorHash = "sha256-0E/9fONanSxb2Tv5wKIpf1J/A6Hdge23xy3r6pFyV9E=";

From 359e2b3f4f25ec854965bf4c7a4032798ea0c46d Mon Sep 17 00:00:00 2001
From: Aaron Jheng <wentworth@outlook.com>
Date: Sun, 15 Jun 2025 21:30:35 +0800
Subject: [PATCH 40/47] goreman: use finalAttrs

---
 pkgs/by-name/go/goreman/package.nix | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/go/goreman/package.nix b/pkgs/by-name/go/goreman/package.nix
index 9a572a8a41b8..22567e16a140 100644
--- a/pkgs/by-name/go/goreman/package.nix
+++ b/pkgs/by-name/go/goreman/package.nix
@@ -3,17 +3,16 @@
   buildGoModule,
   fetchFromGitHub,
   testers,
-  goreman,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "goreman";
   version = "0.3.16";
 
   src = fetchFromGitHub {
     owner = "mattn";
     repo = "goreman";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-hOFnLxHsrauOrsbJYKNrwFFT5yYX/rdZUVjscBIGDLo=";
   };
 
@@ -25,15 +24,15 @@ buildGoModule rec {
   ];
 
   passthru.tests.version = testers.testVersion {
-    package = goreman;
+    package = finalAttrs.finalPackage;
     command = "goreman version";
   };
 
-  meta = with lib; {
+  meta = {
     description = "foreman clone written in go language";
     mainProgram = "goreman";
     homepage = "https://github.com/mattn/goreman";
-    license = licenses.mit;
-    maintainers = with maintainers; [ zimbatm ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ zimbatm ];
   };
-}
+})

From be55c6c4e51edd2469a5d4c7991fa1ee93098885 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Thu, 10 Apr 2025 09:46:17 +0200
Subject: [PATCH 41/47] nix-store-veritysetup-generator: add mainProgram

---
 pkgs/by-name/ni/nix-store-veritysetup-generator/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/ni/nix-store-veritysetup-generator/package.nix b/pkgs/by-name/ni/nix-store-veritysetup-generator/package.nix
index 6a92ed47aba7..6c0ff9bc4428 100644
--- a/pkgs/by-name/ni/nix-store-veritysetup-generator/package.nix
+++ b/pkgs/by-name/ni/nix-store-veritysetup-generator/package.nix
@@ -40,5 +40,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/nikstur/nix-store-veritysetup-generator";
     license = licenses.mit;
     maintainers = with lib.maintainers; [ nikstur ];
+    mainProgram = "nix-store-veritysetup-generator";
   };
 }

From 50d0a8180046fd533dcca23a46d60ea99904091a Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Sat, 14 Jun 2025 21:44:46 +0200
Subject: [PATCH 42/47] nixos/nix-store-veritysetup: init

---
 nixos/modules/module-list.nix                 |   1 +
 .../system/boot/nix-store-veritysetup.nix     |  38 ++++++
 nixos/tests/all-tests.nix                     |   1 +
 nixos/tests/nix-store-veritysetup.nix         | 108 ++++++++++++++++++
 4 files changed, 148 insertions(+)
 create mode 100644 nixos/modules/system/boot/nix-store-veritysetup.nix
 create mode 100644 nixos/tests/nix-store-veritysetup.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 78cebbee8ca5..8b9c38d4ee71 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1786,6 +1786,7 @@
   ./system/boot/luksroot.nix
   ./system/boot/modprobe.nix
   ./system/boot/networkd.nix
+  ./system/boot/nix-store-veritysetup.nix
   ./system/boot/plymouth.nix
   ./system/boot/resolved.nix
   ./system/boot/shutdown.nix
diff --git a/nixos/modules/system/boot/nix-store-veritysetup.nix b/nixos/modules/system/boot/nix-store-veritysetup.nix
new file mode 100644
index 000000000000..6a4d9bd9cc20
--- /dev/null
+++ b/nixos/modules/system/boot/nix-store-veritysetup.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.boot.initrd.nix-store-veritysetup;
+in
+{
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  options.boot.initrd.nix-store-veritysetup = {
+    enable = lib.mkEnableOption "nix-store-veritysetup";
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.boot.initrd.systemd.dmVerity.enable;
+        message = "nix-store-veritysetup requires dm-verity in the systemd initrd.";
+      }
+    ];
+
+    boot.initrd.systemd = {
+      contents = {
+        "/etc/systemd/system-generators/nix-store-veritysetup-generator".source =
+          "${lib.getExe pkgs.nix-store-veritysetup-generator}";
+      };
+
+      storePaths = [
+        "${config.boot.initrd.systemd.package}/bin/systemd-escape"
+      ];
+    };
+
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 4de915a2570a..552fb324db76 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -938,6 +938,7 @@ in
   nix-required-mounts = runTest ./nix-required-mounts;
   nix-serve = runTest ./nix-serve.nix;
   nix-serve-ssh = runTest ./nix-serve-ssh.nix;
+  nix-store-veritysetup = runTest ./nix-store-veritysetup.nix;
   nixops = handleTest ./nixops/default.nix { };
   nixos-generate-config = runTest ./nixos-generate-config.nix;
   nixos-rebuild-install-bootloader = handleTestOn [
diff --git a/nixos/tests/nix-store-veritysetup.nix b/nixos/tests/nix-store-veritysetup.nix
new file mode 100644
index 000000000000..3b6a5e6a734f
--- /dev/null
+++ b/nixos/tests/nix-store-veritysetup.nix
@@ -0,0 +1,108 @@
+{ lib, ... }:
+{
+
+  name = "nix-store-veritysetup";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine =
+    { config, modulesPath, ... }:
+    {
+
+      imports = [
+        "${modulesPath}/image/repart.nix"
+      ];
+
+      image.repart = {
+        name = "nix-store";
+        partitions = {
+          "nix-store" = {
+            storePaths = [ config.system.build.toplevel ];
+            stripNixStorePrefix = true;
+            repartConfig = {
+              Type = "linux-generic";
+              Label = "nix-store";
+              Format = "erofs";
+              Minimize = "best";
+              Verity = "data";
+              VerityMatchKey = "nix-store";
+            };
+          };
+          "nix-store-verity" = {
+            repartConfig = {
+              Type = "linux-generic";
+              Label = "nix-store-verity";
+              Verity = "hash";
+              VerityMatchKey = "nix-store";
+              Minimize = "best";
+            };
+          };
+        };
+      };
+
+      boot.initrd = {
+        systemd = {
+          enable = true;
+          dmVerity.enable = true;
+        };
+        nix-store-veritysetup.enable = true;
+      };
+
+      virtualisation = {
+        mountHostNixStore = false;
+        qemu.drives = [
+          {
+            name = "nix-store";
+            file = ''"$NIX_STORE"'';
+          }
+        ];
+        fileSystems = {
+          "/nix/store" = {
+            fsType = "erofs";
+            device = "/dev/mapper/nix-store";
+          };
+        };
+      };
+
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      import os
+      import json
+      import subprocess
+      import tempfile
+
+      with open("${nodes.machine.system.build.image}/repart-output.json") as f:
+        data = json.load(f)
+
+      storehash = data[0]["roothash"]
+
+      os.environ["QEMU_KERNEL_PARAMS"] = f"storehash={storehash}"
+
+      tmp_disk_image = tempfile.NamedTemporaryFile()
+
+      subprocess.run([
+        "${nodes.machine.virtualisation.qemu.package}/bin/qemu-img",
+        "create",
+        "-f",
+        "qcow2",
+        "-b",
+        "${nodes.machine.system.build.image}/${nodes.machine.image.repart.imageFile}",
+        "-F",
+        "raw",
+        tmp_disk_image.name,
+      ])
+
+      os.environ["NIX_STORE"] = tmp_disk_image.name
+
+      machine.start()
+
+      print(machine.succeed("findmnt"))
+      print(machine.succeed("dmsetup info nix-store"))
+
+      machine.wait_for_unit("multi-user.target")
+    '';
+
+}

From 14b7196c75e2213ec69b86d9ef8d48de7dc7b24d Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Thu, 10 Apr 2025 10:30:26 +0200
Subject: [PATCH 43/47] nixos/nix-store-veritysetup: add release note

---
 nixos/doc/manual/release-notes/rl-2511.section.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 58f11b6a5e57..9a236172dfe8 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -34,6 +34,8 @@
 
 - [Szurubooru](https://github.com/rr-/szurubooru), an image board engine inspired by services such as Danbooru, dedicated for small and medium communities. Available as [services.szurubooru](#opt-services.szurubooru.enable).
 
+- [nix-store-veritysetup](https://github.com/nikstur/nix-store-veritysetup-generator), a systemd generator to unlock the Nix Store as a dm-verity protected block device. Available as [boot.initrd.nix-store-veritysetup](options.html#opt-boot.initrd.nix-store-veritysetup.enable).
+
 - [SuiteNumérique Docs](https://github.com/suitenumerique/docs), a collaborative note taking, wiki and documentation web platform and alternative to Notion or Outline. Available as [services.lasuite-docs](#opt-services.lasuite-docs.enable).
 
 [dwl](https://codeberg.org/dwl/dwl), a compact, hackable compositor for Wayland based on wlroots. Available as [programs.dwl](#opt-programs.dwl.enable).

From bcecded9ec6f9e93149fe6c9f9d6199d89739ea9 Mon Sep 17 00:00:00 2001
From: Brian McKenna <brian@brianmckenna.org>
Date: Thu, 23 Nov 2023 15:20:12 +1100
Subject: [PATCH 44/47] sgdboop: init at 1.3.1

---
 .../sg/sgdboop/hide_desktop_entry.patch       | 22 +++++++
 pkgs/by-name/sg/sgdboop/package.nix           | 60 +++++++++++++++++++
 2 files changed, 82 insertions(+)
 create mode 100644 pkgs/by-name/sg/sgdboop/hide_desktop_entry.patch
 create mode 100644 pkgs/by-name/sg/sgdboop/package.nix

diff --git a/pkgs/by-name/sg/sgdboop/hide_desktop_entry.patch b/pkgs/by-name/sg/sgdboop/hide_desktop_entry.patch
new file mode 100644
index 000000000000..422c82fc4f29
--- /dev/null
+++ b/pkgs/by-name/sg/sgdboop/hide_desktop_entry.patch
@@ -0,0 +1,22 @@
+From a4ca664abfac0b7efa7dbc48c6438bc1a5333962 Mon Sep 17 00:00:00 2001
+From: Fazzi <faaris.ansari@proton.me>
+Date: Sat, 24 May 2025 20:55:50 +0100
+Subject: [PATCH] desktopFile: hide entry from app launchers
+
+---
+ linux-release/com.steamgriddb.SGDBoop.desktop | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/linux-release/com.steamgriddb.SGDBoop.desktop b/linux-release/com.steamgriddb.SGDBoop.desktop
+index 9c84cdb..9899682 100644
+--- a/linux-release/com.steamgriddb.SGDBoop.desktop
++++ b/linux-release/com.steamgriddb.SGDBoop.desktop
+@@ -4,7 +4,7 @@ Comment=Apply Steam assets from SteamGridDB
+ Exec=SGDBoop %U
+ Terminal=false
+ Type=Application
+-NoDisplay=false
++NoDisplay=true
+ Icon=com.steamgriddb.SGDBoop
+ MimeType=x-scheme-handler/sgdb
+ Categories=Utility
diff --git a/pkgs/by-name/sg/sgdboop/package.nix b/pkgs/by-name/sg/sgdboop/package.nix
new file mode 100644
index 000000000000..6ec7d9a1c03c
--- /dev/null
+++ b/pkgs/by-name/sg/sgdboop/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  curl,
+  pkg-config,
+  wrapGAppsHook3,
+}:
+stdenv.mkDerivation rec {
+  pname = "sgdboop";
+  version = "1.3.1";
+
+  src = fetchFromGitHub {
+    owner = "SteamGridDB";
+    repo = "SGDBoop";
+    tag = "v${version}";
+    hash = "sha256-FpVQQo2N/qV+cFhYZ1FVm+xlPHSVMH4L+irnQEMlUQs=";
+  };
+
+  patches = [
+    # Hide the app from app launchers, as it is not meant to be run directly
+    # Remove when https://github.com/SteamGridDB/SGDBoop/pull/112 is merged
+    ./hide_desktop_entry.patch
+  ];
+
+  makeFlags = [
+    # The flatpak install just copies things to /app - otherwise wants to do things with XDG
+    "FLATPAK_ID=fake"
+  ];
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail "/app/" "$out/"
+  '';
+
+  postInstall = ''
+    rm -r "$out/share/metainfo"
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+    wrapGAppsHook3
+  ];
+
+  buildInputs = [
+    curl
+  ];
+
+  meta = {
+    description = "Applying custom artwork to Steam, using SteamGridDB";
+    homepage = "https://github.com/SteamGridDB/SGDBoop/";
+    license = lib.licenses.zlib;
+    maintainers = with lib.maintainers; [
+      saturn745
+      fazzi
+    ];
+    mainProgram = "SGDBoop";
+    platforms = lib.platforms.linux;
+  };
+}

From 60264c48e960a46f5aeeb9fc24d56460fb97211d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20S=C3=A1nchez=20Medina?=
 <alejandrosanchzmedina@gmail.com>
Date: Mon, 16 Jun 2025 11:03:45 +0200
Subject: [PATCH 45/47] doc: point manual contributing guides to devmode's
 README (#411326)

There's quite a bit of pingpong redirection with Nixpkgs and NixOS
manual utilities. Since devmode was lacking a README, the descriptive
text is moved there and it's referenced by both manuals.
---
 doc/README.md                                           | 6 +-----
 nixos/doc/manual/contributing-to-this-manual.chapter.md | 4 +++-
 nixos/doc/manual/redirects.json                         | 3 +++
 pkgs/by-name/de/devmode/README.md                       | 6 ++++++
 4 files changed, 13 insertions(+), 6 deletions(-)
 create mode 100644 pkgs/by-name/de/devmode/README.md

diff --git a/doc/README.md b/doc/README.md
index 029db7eabc7f..bcd9ffd63550 100644
--- a/doc/README.md
+++ b/doc/README.md
@@ -56,11 +56,7 @@ Make sure that your local files aren't added to Git history by adding the follow
 
 #### `devmode`
 
-The shell in the manual source directory makes available a command, `devmode`.
-It is a daemon, that:
-1. watches the manual's source for changes and when they occur — rebuilds
-2. HTTP serves the manual, injecting a script that triggers reload on changes
-3. opens the manual in the default browser
+Use [`devmode`](../pkgs/by-name/de/devmode/README.md) for a live preview when editing the manual.
 
 ### Testing redirects
 
diff --git a/nixos/doc/manual/contributing-to-this-manual.chapter.md b/nixos/doc/manual/contributing-to-this-manual.chapter.md
index a78a136becca..1b296918f9e2 100644
--- a/nixos/doc/manual/contributing-to-this-manual.chapter.md
+++ b/nixos/doc/manual/contributing-to-this-manual.chapter.md
@@ -37,7 +37,9 @@ Make sure that your local files aren't added to Git history by adding the follow
 /**/.direnv
 ```
 
-You might want to also use [`devmode`](https://github.com/NixOS/nixpkgs/blob/master/doc/README.md#devmode) while editing the manual.
+### `devmode` {#sec-contributing-devmode}
+
+Use [`devmode`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/de/devmode/README.md) for a live preview when editing the manual.
 
 ## Testing redirects {#sec-contributing-redirects}
 
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 5970010e9e64..fe19534a82e4 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -95,6 +95,9 @@
   "sec-contributing-development-env": [
     "index.html#sec-contributing-development-env"
   ],
+  "sec-contributing-devmode": [
+    "index.html#sec-contributing-devmode"
+  ],
   "sec-mattermost": [
     "index.html#sec-mattermost"
   ],
diff --git a/pkgs/by-name/de/devmode/README.md b/pkgs/by-name/de/devmode/README.md
new file mode 100644
index 000000000000..506474769004
--- /dev/null
+++ b/pkgs/by-name/de/devmode/README.md
@@ -0,0 +1,6 @@
+# `devmode`
+
+`devmode` is a daemon, that:
+1. watches the manual's source for changes and when they occur — rebuilds
+2. HTTP serves the manual, injecting a script that triggers reload on changes
+3. opens the manual in the default browser

From ed717ed01d44b1b3f330e5a384efed5354308045 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 16 Jun 2025 12:38:31 +0300
Subject: [PATCH 46/47] cpupower: prepare for 6.16-rc2

---
 pkgs/os-specific/linux/cpupower/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/os-specific/linux/cpupower/default.nix b/pkgs/os-specific/linux/cpupower/default.nix
index c80352a1e7e3..e439be715d9a 100644
--- a/pkgs/os-specific/linux/cpupower/default.nix
+++ b/pkgs/os-specific/linux/cpupower/default.nix
@@ -42,6 +42,7 @@ stdenv.mkDerivation {
     doc = "share/doc/cpupower";
     conf = "etc";
     bash_completion_ = "share/bash-completion/completions";
+    unit = "lib/systemd/system";
   };
 
   enableParallelBuilding = true;

From aebe0591a964446d608666b24fb2767ed4d21f48 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 16 Jun 2025 12:38:28 +0300
Subject: [PATCH 47/47] linux_testing: 6.16-rc1 -> 6.16-rc2

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 2d18f73d36c6..6c7ddb2bbea1 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "6.16-rc1",
-        "hash": "sha256:0wi66d2wma4lfs3pbwqg7k1pavxc3wyr54yxii3mmaab81pfdx27"
+        "version": "6.16-rc2",
+        "hash": "sha256:1hzkpp5161ss40d8j9nzvzyw6vljslx0pk5fin0klj884l5i8igh"
     },
     "6.1": {
         "version": "6.1.141",