Merge 64359a39a1 into haskell-updates

.github/workflows/eval.yml

@@ -168,6 +168,7 @@ jobs:
     needs: [eval]
     if: ${{ !cancelled() && !failure() }}
     permissions:
+      pull-requests: write
       statuses: write
     timeout-minutes: 5
     steps:
@@ -254,6 +255,17 @@ jobs:
               description,
               target_url
             })
+      - name: Request changes if PR is against an inappropriate branch
+        if: ${{ github.event_name == 'pull_request_target' }}
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            require('./nixpkgs/trusted/ci/github-script/check-target-branch.js')({
+              github,
+              context,
+              core,
+              dry: context.eventName == 'pull_request',
+            })
 
   # Creates a matrix of Eval performance for various versions and systems.
   report:

.github/workflows/merge-group.yml

@@ -84,6 +84,7 @@ jobs:
     # even though they are unused when working with the merge queue.
     permissions:
       # compare
+      pull-requests: write
       statuses: write
     secrets:
       CACHIX_AUTH_TOKEN_GHA: ${{ secrets.CACHIX_AUTH_TOKEN_GHA }}

.github/workflows/pull-request-target.yml

@@ -81,6 +81,7 @@ jobs:
     uses: ./.github/workflows/eval.yml
     permissions:
       # compare
+      pull-requests: write
       statuses: write
     with:
       artifact-prefix: ${{ inputs.artifact-prefix }}

ci/github-script/check-target-branch.js

@@ -0,0 +1,135 @@
+/// @ts-check
+
+// TODO: should this be combined with the branch checks in prepare.js?
+// They do seem quite similar, but this needs to run after eval,
+// and prepare.js obviously doesn't.
+
+const { classify, split } = require('../supportedBranches.js')
+const { readFile } = require('node:fs/promises')
+const { postReview } = require('./reviews.js')
+
+/**
+ * @param {{
+ *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
+ *  context: import('@actions/github/lib/context').Context
+ *  core: import('@actions/core')
+ *  dry: boolean
+ * }} CheckTargetBranchProps
+ */
+async function checkTargetBranch({ github, context, core, dry }) {
+  const changed = JSON.parse(
+    await readFile('comparison/changed-paths.json', 'utf-8'),
+  )
+  const pull_number = context.payload.pull_request?.number
+  if (!pull_number) {
+    core.warning(
+      'Skipping checkTargetBranch: no pull_request number (is this being run as part of a merge group?)',
+    )
+    return
+  }
+  const prInfo = (
+    await github.rest.pulls.get({
+      ...context.repo,
+      pull_number,
+    })
+  ).data
+  const base = prInfo.base.ref
+  const head = prInfo.head.ref
+  const baseClassification = classify(base)
+  const headClassification = classify(head)
+
+  // Don't run on, e.g., staging-nixos to master merges.
+  if (headClassification.type.includes('development')) {
+    core.info(
+      `Skipping checkTargetBranch: PR is from a development branch (${head})`,
+    )
+    return
+  }
+  // Don't run on PRs against staging branches, wip branches, haskell-updates, etc.
+  if (!baseClassification.type.includes('primary')) {
+    core.info(
+      `Skipping checkTargetBranch: PR is against a non-primary base branch (${base})`,
+    )
+    return
+  }
+
+  const maxRebuildCount = Math.max(
+    ...Object.values(changed.rebuildCountByKernel),
+  )
+  const rebuildsAllTests =
+    changed.attrdiff.changed.includes('nixosTests.simple') ?? false
+  core.info(
+    `checkTargetBranch: PR causes ${maxRebuildCount} rebuilds and ${rebuildsAllTests ? 'does' : 'does not'} rebuild all NixOS tests.`,
+  )
+
+  if (maxRebuildCount >= 1000) {
+    const desiredBranch =
+      base === 'master' ? 'staging' : `staging-${split(base).version}`
+    const body = [
+      `The PR's base branch is set to \`${base}\`, but this PR causes ${maxRebuildCount} rebuilds.`,
+      'It is therefore considered a mass rebuild.',
+      `Please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) (probably \`${desiredBranch}\`).`,
+    ].join('\n')
+
+    await postReview({
+      github,
+      context,
+      core,
+      dry,
+      body,
+      event: 'REQUEST_CHANGES',
+    })
+
+    throw new Error('This PR is against the wrong branch.')
+  } else if (rebuildsAllTests) {
+    let branchText
+    if (base === 'master' && maxRebuildCount >= 500) {
+      branchText = '(probably either `staging-nixos` or `staging`)'
+    } else if (base === 'master') {
+      branchText = '(probably `staging-nixos`)'
+    } else {
+      branchText = `(probably \`staging-${split(base).version}\`)`
+    }
+    const body = [
+      `The PR's base branch is set to \`${base}\`, but this PR rebuilds all NixOS tests.`,
+      base === 'master' && maxRebuildCount >= 500
+        ? `Since this PR also causes ${maxRebuildCount} rebuilds, it may also be considered a mass rebuild.`
+        : '',
+      `Please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) ${branchText}.`,
+    ].join('\n')
+
+    await postReview({
+      github,
+      context,
+      core,
+      dry,
+      body,
+      event: 'REQUEST_CHANGES',
+    })
+
+    throw new Error('This PR is against the wrong branch.')
+  } else if (maxRebuildCount >= 500) {
+    const stagingBranch =
+      base === 'master' ? 'staging' : `staging-${split(base).version}`
+    const body = [
+      `The PR's base branch is set to \`${base}\`, and this PR causes ${maxRebuildCount} rebuilds.`,
+      `Please consider whether this PR causes a mass rebuild according to [our conventions](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions).`,
+      `If it does cause a mass rebuild, please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) (probably \`${stagingBranch}\`).`,
+      `If it does not cause a mass rebuild, this message can be ignored.`,
+    ].join('\n')
+
+    await postReview({
+      github,
+      context,
+      core,
+      dry,
+      body,
+      event: 'COMMENT',
+    })
+  } else {
+    // Any existing reviews were dismissed by commits.js
+    core.info('checkTargetBranch: this PR is against an appropriate branch.')
+  }
+}
+
+module.exports = checkTargetBranch

ci/github-script/reviews.js

@@ -1,3 +1,16 @@
+const eventToState = {
+  COMMENT: 'COMMENTED',
+  REQUEST_CHANGES: 'CHANGES_REQUESTED',
+}
+
+/**
+ * @param {{
+ *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
+ *  context: import('@actions/github/lib/context').Context
+ *  core: import('@actions/core')
+ *  dry: boolean
+ * }} CheckTargetBranchProps
+ */
 async function dismissReviews({ github, context, dry }) {
   const pull_number = context.payload.pull_request.number
 
@@ -19,13 +32,13 @@ async function dismissReviews({ github, context, dry }) {
             ...context.repo,
             pull_number,
             review_id: review.id,
-            message: 'All good now, thank you!',
+            message: 'Review dismissed automatically',
           })
         }
         await github.graphql(
           `mutation($node_id:ID!) {
             minimizeComment(input: {
-              classifier: RESOLVED,
+              classifier: OUTDATED,
               subjectId: $node_id
             })
             { clientMutationId }
@@ -36,7 +49,14 @@ async function dismissReviews({ github, context, dry }) {
   )
 }
 
-async function postReview({ github, context, core, dry, body }) {
+async function postReview({
+  github,
+  context,
+  core,
+  dry,
+  body,
+  event = 'REQUEST_CHANGES',
+}) {
   const pull_number = context.payload.pull_request.number
 
   const pendingReview = (
@@ -49,10 +69,7 @@ async function postReview({ github, context, core, dry, body }) {
       review.user?.login === 'github-actions[bot]' &&
       // If a review is still pending, we can just update this instead
       // of posting a new one.
-      (review.state === 'CHANGES_REQUESTED' ||
-        // No need to post a new review, if an older one with the exact
-        // same content had already been dismissed.
-        review.body === body),
+      review.state === eventToState[event],
   )
 
   if (dry) {
@@ -72,7 +89,7 @@ async function postReview({ github, context, core, dry, body }) {
       await github.rest.pulls.createReview({
         ...context.repo,
         pull_number,
-        event: 'REQUEST_CHANGES',
+        event,
         body,
       })
     }

ci/github-script/run

@@ -105,4 +105,15 @@ program
     await run(checkCommitMessages, owner, repo, pr, options)
   })
 
+program
+  .command('check-target-branch')
+  .description('Check that the PR is made against the correct branch')
+  .argument('<owner>', 'Owner of the GitHub repository to run on (Example: NixOS)')
+  .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
+  .argument('<pr>', 'Number of the Pull Request to run on')
+  .action(async (owner, repo, pr, options) => {
+    const checkCommitMessages = (await import('./check-target-branch.js')).default
+    await run(checkCommitMessages, owner, repo, pr, options)
+  })
+
 await program.parse()

ci/supportedBranches.js

@@ -44,7 +44,7 @@ function classify(branch) {
   }
 }
 
-module.exports = { classify }
+module.exports = { classify, split }
 
 // If called directly via CLI, runs the following tests:
 if (!module.parent) {

lib/options.nix

@@ -672,11 +672,30 @@ rec {
     is necessary for complex values, e.g. functions, or values that depend on
     other values or packages.
 
+    # Examples
+    :::{.example}
+    ## `literalExpression` usage example
+
+    ```nix
+    llvmPackages = mkOption {
+      type = types.str;
+      description = ''
+        Version of llvm packages to use for
+        this module
+      '';
+      example = literalExpression ''
+        llvmPackages = pkgs.llvmPackages_20;
+      '';
+    };
+    ```
+
+    :::
+
     # Inputs
 
     `text`
 
-    : 1\. Function argument
+    : The text to render as a Nix expression
   */
   literalExpression =
     text:
@@ -688,6 +707,49 @@ rec {
         inherit text;
       };
 
+  /**
+    For use in the `defaultText` and `example` option attributes. Causes the
+    given string to be rendered verbatim in the documentation as a code
+    block with the language bassed on the provided input tag.
+
+    If you wish to render Nix code, please see `literalExpression`.
+
+    # Examples
+    :::{.example}
+    ## `literalCode` usage example
+
+    ```nix
+    myPythonScript = mkOption {
+      type = types.str;
+      description = ''
+        Example python script used by a module
+      '';
+      example = literalCode "python" ''
+        print("Hello world!")
+      '';
+    };
+    ```
+
+    :::
+
+    # Inputs
+
+    `languageTag`
+
+    : The language tag to use when producing the code block (i.e. `js`, `rs`, etc).
+
+    `text`
+
+    : The text to render as a Nix expression
+  */
+  literalCode =
+    languageTag: text:
+    lib.literalMD ''
+      ```${languageTag}
+      ${text}
+      ```
+    '';
+
   /**
     For use in the `defaultText` and `example` option attributes. Causes the
     given MD text to be inserted verbatim in the documentation, for when

maintainers/github-teams.json

@@ -422,10 +422,10 @@
     "maintainers": {
       "Mic92": 96200,
       "kalbasit": 87115,
+      "katexochen": 49727155,
       "zowoq": 59103226
     },
     "members": {
-      "katexochen": 49727155,
       "mfrw": 4929861,
       "qbit": 68368
     },
@@ -730,7 +730,9 @@
       "philiptaron": 43863,
       "zowoq": 59103226
     },
-    "members": {},
+    "members": {
+      "mdaniels5757": 8762511
+    },
     "name": "Nixpkgs CI"
   },
   "nixpkgs-core": {

maintainers/maintainer-list.nix

@@ -8623,6 +8623,13 @@
     githubId = 52276064;
     name = "figboy9";
   };
+  figsoda = {
+    email = "figsoda@pm.me";
+    matrix = "@figsoda:matrix.org";
+    github = "figsoda";
+    githubId = 40620903;
+    name = "figsoda";
+  };
   fionera = {
     email = "nix@fionera.de";
     github = "fionera";
@@ -19099,12 +19106,6 @@
     github = "0xnook";
     githubId = 88323754;
   };
-  noreferences = {
-    email = "norkus@norkus.net";
-    github = "jozuas";
-    githubId = 13085275;
-    name = "Juozas Norkus";
-  };
   norfair = {
     email = "syd@cs-syd.eu";
     github = "NorfairKing";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -34,6 +34,8 @@
 
 - [Ente Auth](https://ente.io/auth/), an open source 2FA authenticator, with end-to-end encrypted backups. Available as [programs.ente-auth](#opt-programs.ente-auth.enable).
 
+- [Dawarich](https://dawarich.app/), a self-hostable location history tracker. Available as [services.dawarich](#opt-services.dawarich.enable).
+
 - [udp-over-tcp](https://github.com/mullvad/udp-over-tcp), a tunnel for proxying UDP traffic over a TCP stream. Available as `services.udp-over-tcp`.
 
 - [Komodo Periphery](https://github.com/moghtech/komodo), a multi-server Docker and Git deployment agent by Komodo. Available as [services.komodo-periphery](#opt-services.komodo-periphery.enable).

nixos/modules/hardware/tuxedo-drivers.nix

@@ -94,16 +94,16 @@ in
     boot.extraModulePackages = [ tuxedo-drivers ];
     services.udev.packages = [
       tuxedo-drivers
-      lib.mkIf
-      (lib.any (v: v != null) cfg.settings)
-      (pkgs.writeTextDir "etc/udev/rules.d/90-tuxedo.rules" (
+    ]
+    ++ lib.optional (lib.any (v: v != null) (lib.attrValues cfg.settings)) (
+      pkgs.writeTextDir "etc/udev/rules.d/90-tuxedo.rules" (
         lib.concatLines (
           [ "# Custom rules for TUXEDO laptops" ]
           ++ (optUdevRule "charging_profile/charging_profile" cfg.settings.charging-profile)
           ++ (optUdevRule "charging_priority/charging_prio" cfg.settings.charging-priority)
           ++ (optUdevRule "fn_lock" cfg.settings.fn-lock)
         )
-      ))
-    ];
+      )
+    );
   };
 }

nixos/modules/module-list.nix

@@ -1597,6 +1597,7 @@
   ./services/web-apps/cryptpad.nix
   ./services/web-apps/dashy.nix
   ./services/web-apps/davis.nix
+  ./services/web-apps/dawarich.nix
   ./services/web-apps/dependency-track.nix
   ./services/web-apps/dex.nix
   ./services/web-apps/discourse.nix

nixos/modules/security/soteria.nix

@@ -36,8 +36,8 @@ in
       wants = [ "graphical-session.target" ];
       after = [ "graphical-session.target" ];
 
-      script = lib.getExe cfg.package;
       serviceConfig = {
+        ExecStart = lib.getExe cfg.package;
         Type = "simple";
         Restart = "on-failure";
         RestartSec = 1;

nixos/modules/services/blockchain/ethereum/geth.nix

@@ -206,6 +206,43 @@ in
           after = [ "network.target" ];
 
           serviceConfig = {
+            ExecStart =
+              let
+                args = lib.cli.toCommandLineShellGNU { } {
+                  inherit (cfg)
+                    syncmode
+                    gcmode
+                    port
+                    maxpeers
+                    ;
+                  nousb = true;
+                  ipcdisable = true;
+                  datadir = dataDir;
+                  ${cfg.network} = true;
+
+                  http = cfg.http.enable;
+                  "http.addr" = if cfg.http.enable then cfg.http.address else null;
+                  "http.port" = if cfg.http.enable then cfg.http.port else null;
+                  "http.api" = if cfg.http.apis != null then lib.concatStringsSep "," cfg.http.apis else null;
+
+                  ws = cfg.websocket.enable;
+                  "ws.addr" = if cfg.websocket.enable then cfg.websocket.address else null;
+                  "ws.port" = if cfg.websocket.enable then cfg.websocket.port else null;
+                  "ws.api" = if cfg.websocket.apis != null then lib.concatStringsSep "," cfg.websocket.apis else null;
+
+                  metrics = cfg.metrics.enable;
+                  "metrics.addr" = if cfg.metrics.enable then cfg.metrics.address else null;
+                  "metrics.port" = if cfg.metrics.enable then cfg.metrics.port else null;
+
+                  "authrpc.addr" = cfg.authrpc.address;
+                  "authrpc.port" = cfg.authrpc.port;
+                  "authrpc.vhosts" = lib.concatStringsSep "," cfg.authrpc.vhosts;
+                  "authrpc.jwtsecret" =
+                    if cfg.authrpc.jwtsecret != "" then cfg.authrpc.jwtsecret else "${dataDir}/geth/jwtsecret";
+                };
+              in
+              "${lib.getExe cfg.package} ${args} ${lib.escapeShellArgs cfg.extraArgs}";
+
             DynamicUser = true;
             Restart = "always";
             StateDirectory = stateDir;
@@ -217,37 +254,6 @@ in
             PrivateDevices = "true";
             MemoryDenyWriteExecute = "true";
           };
-
-          script = ''
-            ${cfg.package}/bin/geth \
-              --nousb \
-              --ipcdisable \
-              ${lib.optionalString (cfg.network != null) ''--${cfg.network}''} \
-              --syncmode ${cfg.syncmode} \
-              --gcmode ${cfg.gcmode} \
-              --port ${toString cfg.port} \
-              --maxpeers ${toString cfg.maxpeers} \
-              ${lib.optionalString cfg.http.enable ''--http --http.addr ${cfg.http.address} --http.port ${toString cfg.http.port}''} \
-              ${
-                lib.optionalString (cfg.http.apis != null) ''--http.api ${lib.concatStringsSep "," cfg.http.apis}''
-              } \
-              ${lib.optionalString cfg.websocket.enable ''--ws --ws.addr ${cfg.websocket.address} --ws.port ${toString cfg.websocket.port}''} \
-              ${
-                lib.optionalString (
-                  cfg.websocket.apis != null
-                ) ''--ws.api ${lib.concatStringsSep "," cfg.websocket.apis}''
-              } \
-              ${lib.optionalString cfg.metrics.enable ''--metrics --metrics.addr ${cfg.metrics.address} --metrics.port ${toString cfg.metrics.port}''} \
-              --authrpc.addr ${cfg.authrpc.address} --authrpc.port ${toString cfg.authrpc.port} --authrpc.vhosts ${lib.concatStringsSep "," cfg.authrpc.vhosts} \
-              ${
-                if (cfg.authrpc.jwtsecret != "") then
-                  ''--authrpc.jwtsecret ${cfg.authrpc.jwtsecret}''
-                else
-                  ''--authrpc.jwtsecret ${dataDir}/geth/jwtsecret''
-              } \
-              ${lib.escapeShellArgs cfg.extraArgs} \
-              --datadir ${dataDir}
-          '';
         }
       ))
     ) eachGeth;

nixos/modules/services/cluster/kubernetes/apiserver.nix

@@ -49,312 +49,327 @@ in
   ];
 
   ###### interface
-  options.services.kubernetes.apiserver = with lib.types; {
+  options.services.kubernetes.apiserver =
+    let
+      inherit (lib.types)
+        nullOr
+        str
+        bool
+        listOf
+        enum
+        attrs
+        path
+        separatedString
+        attrsOf
+        int
+        ;
+    in
+    {
 
-    advertiseAddress = lib.mkOption {
-      description = ''
-        Kubernetes apiserver IP address on which to advertise the apiserver
-        to members of the cluster. This address must be reachable by the rest
-        of the cluster.
-      '';
-      default = null;
-      type = nullOr str;
-    };
-
-    allowPrivileged = lib.mkOption {
-      description = "Whether to allow privileged containers on Kubernetes.";
-      default = false;
-      type = bool;
-    };
-
-    authorizationMode = lib.mkOption {
-      description = ''
-        Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/Webhook/RBAC/Node). See
-        <https://kubernetes.io/docs/reference/access-authn-authz/authorization/>
-      '';
-      default = [
-        "RBAC"
-        "Node"
-      ]; # Enabling RBAC by default, although kubernetes default is AllowAllow
-      type = listOf (enum [
-        "AlwaysAllow"
-        "AlwaysDeny"
-        "ABAC"
-        "Webhook"
-        "RBAC"
-        "Node"
-      ]);
-    };
-
-    authorizationPolicy = lib.mkOption {
-      description = ''
-        Kubernetes apiserver authorization policy file. See
-        <https://kubernetes.io/docs/reference/access-authn-authz/authorization/>
-      '';
-      default = [ ];
-      type = listOf attrs;
-    };
-
-    basicAuthFile = lib.mkOption {
-      description = ''
-        Kubernetes apiserver basic authentication file. See
-        <https://kubernetes.io/docs/reference/access-authn-authz/authentication>
-      '';
-      default = null;
-      type = nullOr path;
-    };
-
-    bindAddress = lib.mkOption {
-      description = ''
-        The IP address on which to listen for the --secure-port port.
-        The associated interface(s) must be reachable by the rest
-        of the cluster, and by CLI/web clients.
-      '';
-      default = "0.0.0.0";
-      type = str;
-    };
-
-    clientCaFile = lib.mkOption {
-      description = "Kubernetes apiserver CA file for client auth.";
-      default = top.caFile;
-      defaultText = lib.literalExpression "config.${otop.caFile}";
-      type = nullOr path;
-    };
-
-    disableAdmissionPlugins = lib.mkOption {
-      description = ''
-        Kubernetes admission control plugins to disable. See
-        <https://kubernetes.io/docs/admin/admission-controllers/>
-      '';
-      default = [ ];
-      type = listOf str;
-    };
-
-    enable = lib.mkEnableOption "Kubernetes apiserver";
-
-    enableAdmissionPlugins = lib.mkOption {
-      description = ''
-        Kubernetes admission control plugins to enable. See
-        <https://kubernetes.io/docs/admin/admission-controllers/>
-      '';
-      default = [
-        "NamespaceLifecycle"
-        "LimitRanger"
-        "ServiceAccount"
-        "ResourceQuota"
-        "DefaultStorageClass"
-        "DefaultTolerationSeconds"
-        "NodeRestriction"
-      ];
-      example = [
-        "NamespaceLifecycle"
-        "NamespaceExists"
-        "LimitRanger"
-        "SecurityContextDeny"
-        "ServiceAccount"
-        "ResourceQuota"
-        "PodSecurityPolicy"
-        "NodeRestriction"
-        "DefaultStorageClass"
-      ];
-      type = listOf str;
-    };
-
-    etcd = {
-      servers = lib.mkOption {
-        description = "List of etcd servers.";
-        default = [ "http://127.0.0.1:2379" ];
-        type = types.listOf types.str;
-      };
-
-      keyFile = lib.mkOption {
-        description = "Etcd key file.";
+      advertiseAddress = lib.mkOption {
+        description = ''
+          Kubernetes apiserver IP address on which to advertise the apiserver
+          to members of the cluster. This address must be reachable by the rest
+          of the cluster.
+        '';
         default = null;
-        type = types.nullOr types.path;
+        type = nullOr str;
       };
 
-      certFile = lib.mkOption {
-        description = "Etcd cert file.";
+      allowPrivileged = lib.mkOption {
+        description = "Whether to allow privileged containers on Kubernetes.";
+        default = false;
+        type = bool;
+      };
+
+      authorizationMode = lib.mkOption {
+        description = ''
+          Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/Webhook/RBAC/Node). See
+          <https://kubernetes.io/docs/reference/access-authn-authz/authorization/>
+        '';
+        default = [
+          "RBAC"
+          "Node"
+        ]; # Enabling RBAC by default, although kubernetes default is AllowAllow
+        type = listOf (enum [
+          "AlwaysAllow"
+          "AlwaysDeny"
+          "ABAC"
+          "Webhook"
+          "RBAC"
+          "Node"
+        ]);
+      };
+
+      authorizationPolicy = lib.mkOption {
+        description = ''
+          Kubernetes apiserver authorization policy file. See
+          <https://kubernetes.io/docs/reference/access-authn-authz/authorization/>
+        '';
+        default = [ ];
+        type = listOf attrs;
+      };
+
+      basicAuthFile = lib.mkOption {
+        description = ''
+          Kubernetes apiserver basic authentication file. See
+          <https://kubernetes.io/docs/reference/access-authn-authz/authentication>
+        '';
         default = null;
-        type = types.nullOr types.path;
+        type = nullOr path;
       };
 
-      caFile = lib.mkOption {
-        description = "Etcd ca file.";
+      bindAddress = lib.mkOption {
+        description = ''
+          The IP address on which to listen for the --secure-port port.
+          The associated interface(s) must be reachable by the rest
+          of the cluster, and by CLI/web clients.
+        '';
+        default = "0.0.0.0";
+        type = str;
+      };
+
+      clientCaFile = lib.mkOption {
+        description = "Kubernetes apiserver CA file for client auth.";
         default = top.caFile;
         defaultText = lib.literalExpression "config.${otop.caFile}";
-        type = types.nullOr types.path;
+        type = nullOr path;
       };
-    };
 
-    extraOpts = lib.mkOption {
-      description = "Kubernetes apiserver extra command line options.";
-      default = "";
-      type = separatedString " ";
-    };
+      disableAdmissionPlugins = lib.mkOption {
+        description = ''
+          Kubernetes admission control plugins to disable. See
+          <https://kubernetes.io/docs/admin/admission-controllers/>
+        '';
+        default = [ ];
+        type = listOf str;
+      };
 
-    extraSANs = lib.mkOption {
-      description = "Extra x509 Subject Alternative Names to be added to the kubernetes apiserver tls cert.";
-      default = [ ];
-      type = listOf str;
-    };
+      enable = lib.mkEnableOption "Kubernetes apiserver";
 
-    featureGates = lib.mkOption {
-      description = "Attribute set of feature gates.";
-      default = top.featureGates;
-      defaultText = lib.literalExpression "config.${otop.featureGates}";
-      type = attrsOf bool;
-    };
+      enableAdmissionPlugins = lib.mkOption {
+        description = ''
+          Kubernetes admission control plugins to enable. See
+          <https://kubernetes.io/docs/admin/admission-controllers/>
+        '';
+        default = [
+          "NamespaceLifecycle"
+          "LimitRanger"
+          "ServiceAccount"
+          "ResourceQuota"
+          "DefaultStorageClass"
+          "DefaultTolerationSeconds"
+          "NodeRestriction"
+        ];
+        example = [
+          "NamespaceLifecycle"
+          "NamespaceExists"
+          "LimitRanger"
+          "SecurityContextDeny"
+          "ServiceAccount"
+          "ResourceQuota"
+          "PodSecurityPolicy"
+          "NodeRestriction"
+          "DefaultStorageClass"
+        ];
+        type = listOf str;
+      };
 
-    kubeletClientCaFile = lib.mkOption {
-      description = "Path to a cert file for connecting to kubelet.";
-      default = top.caFile;
-      defaultText = lib.literalExpression "config.${otop.caFile}";
-      type = nullOr path;
-    };
+      etcd = {
+        servers = lib.mkOption {
+          description = "List of etcd servers.";
+          default = [ "http://127.0.0.1:2379" ];
+          type = listOf str;
+        };
 
-    kubeletClientCertFile = lib.mkOption {
-      description = "Client certificate to use for connections to kubelet.";
-      default = null;
-      type = nullOr path;
-    };
+        keyFile = lib.mkOption {
+          description = "Etcd key file.";
+          default = null;
+          type = nullOr path;
+        };
 
-    kubeletClientKeyFile = lib.mkOption {
-      description = "Key to use for connections to kubelet.";
-      default = null;
-      type = nullOr path;
-    };
+        certFile = lib.mkOption {
+          description = "Etcd cert file.";
+          default = null;
+          type = nullOr path;
+        };
 
-    preferredAddressTypes = lib.mkOption {
-      description = "List of the preferred NodeAddressTypes to use for kubelet connections.";
-      type = nullOr str;
-      default = null;
-    };
+        caFile = lib.mkOption {
+          description = "Etcd ca file.";
+          default = top.caFile;
+          defaultText = lib.literalExpression "config.${otop.caFile}";
+          type = nullOr path;
+        };
+      };
 
-    proxyClientCertFile = lib.mkOption {
-      description = "Client certificate to use for connections to proxy.";
-      default = null;
-      type = nullOr path;
-    };
+      extraOpts = lib.mkOption {
+        description = "Kubernetes apiserver extra command line options.";
+        default = "";
+        type = separatedString " ";
+      };
 
-    proxyClientKeyFile = lib.mkOption {
-      description = "Key to use for connections to proxy.";
-      default = null;
-      type = nullOr path;
-    };
+      extraSANs = lib.mkOption {
+        description = "Extra x509 Subject Alternative Names to be added to the kubernetes apiserver tls cert.";
+        default = [ ];
+        type = listOf str;
+      };
 
-    runtimeConfig = lib.mkOption {
-      description = ''
-        Api runtime configuration. See
-        <https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/>
-      '';
-      default = "authentication.k8s.io/v1beta1=true";
-      example = "api/all=false,api/v1=true";
-      type = str;
-    };
+      featureGates = lib.mkOption {
+        description = "Attribute set of feature gates.";
+        default = top.featureGates;
+        defaultText = lib.literalExpression "config.${otop.featureGates}";
+        type = attrsOf bool;
+      };
 
-    storageBackend = lib.mkOption {
-      description = ''
-        Kubernetes apiserver storage backend.
-      '';
-      default = "etcd3";
-      type = enum [
-        "etcd2"
-        "etcd3"
-      ];
-    };
+      kubeletClientCaFile = lib.mkOption {
+        description = "Path to a cert file for connecting to kubelet.";
+        default = top.caFile;
+        defaultText = lib.literalExpression "config.${otop.caFile}";
+        type = nullOr path;
+      };
 
-    securePort = lib.mkOption {
-      description = "Kubernetes apiserver secure port.";
-      default = 6443;
-      type = int;
-    };
+      kubeletClientCertFile = lib.mkOption {
+        description = "Client certificate to use for connections to kubelet.";
+        default = null;
+        type = nullOr path;
+      };
 
-    apiAudiences = lib.mkOption {
-      description = ''
-        Kubernetes apiserver ServiceAccount issuer.
-      '';
-      default = "api,https://kubernetes.default.svc";
-      type = str;
-    };
+      kubeletClientKeyFile = lib.mkOption {
+        description = "Key to use for connections to kubelet.";
+        default = null;
+        type = nullOr path;
+      };
 
-    serviceAccountIssuer = lib.mkOption {
-      description = ''
-        Kubernetes apiserver ServiceAccount issuer.
-      '';
-      default = "https://kubernetes.default.svc";
-      type = str;
-    };
+      preferredAddressTypes = lib.mkOption {
+        description = "List of the preferred NodeAddressTypes to use for kubelet connections.";
+        type = nullOr str;
+        default = null;
+      };
 
-    serviceAccountSigningKeyFile = lib.mkOption {
-      description = ''
-        Path to the file that contains the current private key of the service
-        account token issuer. The issuer will sign issued ID tokens with this
-        private key.
-      '';
-      type = path;
-    };
+      proxyClientCertFile = lib.mkOption {
+        description = "Client certificate to use for connections to proxy.";
+        default = null;
+        type = nullOr path;
+      };
 
-    serviceAccountKeyFile = lib.mkOption {
-      description = ''
-        File containing PEM-encoded x509 RSA or ECDSA private or public keys,
-        used to verify ServiceAccount tokens. The specified file can contain
-        multiple keys, and the flag can be specified multiple times with
-        different files. If unspecified, --tls-private-key-file is used.
-        Must be specified when --service-account-signing-key is provided
-      '';
-      type = path;
-    };
+      proxyClientKeyFile = lib.mkOption {
+        description = "Key to use for connections to proxy.";
+        default = null;
+        type = nullOr path;
+      };
 
-    serviceClusterIpRange = lib.mkOption {
-      description = ''
-        A CIDR notation IP range from which to assign service cluster IPs.
-        This must not overlap with any IP ranges assigned to nodes for pods.
-      '';
-      default = "10.0.0.0/24";
-      type = str;
-    };
+      runtimeConfig = lib.mkOption {
+        description = ''
+          Api runtime configuration. See
+          <https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/>
+        '';
+        default = "authentication.k8s.io/v1beta1=true";
+        example = "api/all=false,api/v1=true";
+        type = str;
+      };
 
-    tlsCertFile = lib.mkOption {
-      description = "Kubernetes apiserver certificate file.";
-      default = null;
-      type = nullOr path;
-    };
+      storageBackend = lib.mkOption {
+        description = ''
+          Kubernetes apiserver storage backend.
+        '';
+        default = "etcd3";
+        type = enum [
+          "etcd2"
+          "etcd3"
+        ];
+      };
 
-    tlsKeyFile = lib.mkOption {
-      description = "Kubernetes apiserver private key file.";
-      default = null;
-      type = nullOr path;
-    };
+      securePort = lib.mkOption {
+        description = "Kubernetes apiserver secure port.";
+        default = 6443;
+        type = int;
+      };
 
-    tokenAuthFile = lib.mkOption {
-      description = ''
-        Kubernetes apiserver token authentication file. See
-        <https://kubernetes.io/docs/reference/access-authn-authz/authentication>
-      '';
-      default = null;
-      type = nullOr path;
-    };
+      apiAudiences = lib.mkOption {
+        description = ''
+          Kubernetes apiserver ServiceAccount issuer.
+        '';
+        default = "api,https://kubernetes.default.svc";
+        type = str;
+      };
 
-    verbosity = lib.mkOption {
-      description = ''
-        Optional glog verbosity level for logging statements. See
-        <https://github.com/kubernetes/community/blob/master/contributors/devel/logging.md>
-      '';
-      default = null;
-      type = nullOr int;
-    };
+      serviceAccountIssuer = lib.mkOption {
+        description = ''
+          Kubernetes apiserver ServiceAccount issuer.
+        '';
+        default = "https://kubernetes.default.svc";
+        type = str;
+      };
 
-    webhookConfig = lib.mkOption {
-      description = ''
-        Kubernetes apiserver Webhook config file. It uses the kubeconfig file format.
-        See <https://kubernetes.io/docs/reference/access-authn-authz/webhook/>
-      '';
-      default = null;
-      type = nullOr path;
-    };
+      serviceAccountSigningKeyFile = lib.mkOption {
+        description = ''
+          Path to the file that contains the current private key of the service
+          account token issuer. The issuer will sign issued ID tokens with this
+          private key.
+        '';
+        type = path;
+      };
 
-  };
+      serviceAccountKeyFile = lib.mkOption {
+        description = ''
+          File containing PEM-encoded x509 RSA or ECDSA private or public keys,
+          used to verify ServiceAccount tokens. The specified file can contain
+          multiple keys, and the flag can be specified multiple times with
+          different files. If unspecified, --tls-private-key-file is used.
+          Must be specified when --service-account-signing-key is provided
+        '';
+        type = path;
+      };
+
+      serviceClusterIpRange = lib.mkOption {
+        description = ''
+          A CIDR notation IP range from which to assign service cluster IPs.
+          This must not overlap with any IP ranges assigned to nodes for pods.
+        '';
+        default = "10.0.0.0/24";
+        type = str;
+      };
+
+      tlsCertFile = lib.mkOption {
+        description = "Kubernetes apiserver certificate file.";
+        default = null;
+        type = nullOr path;
+      };
+
+      tlsKeyFile = lib.mkOption {
+        description = "Kubernetes apiserver private key file.";
+        default = null;
+        type = nullOr path;
+      };
+
+      tokenAuthFile = lib.mkOption {
+        description = ''
+          Kubernetes apiserver token authentication file. See
+          <https://kubernetes.io/docs/reference/access-authn-authz/authentication>
+        '';
+        default = null;
+        type = nullOr path;
+      };
+
+      verbosity = lib.mkOption {
+        description = ''
+          Optional glog verbosity level for logging statements. See
+          <https://github.com/kubernetes/community/blob/master/contributors/devel/logging.md>
+        '';
+        default = null;
+        type = nullOr int;
+      };
+
+      webhookConfig = lib.mkOption {
+        description = ''
+          Kubernetes apiserver Webhook config file. It uses the kubeconfig file format.
+          See <https://kubernetes.io/docs/reference/access-authn-authz/webhook/>
+        '';
+        default = null;
+        type = nullOr path;
+      };
+
+    };
 
   ###### implementation
   config = lib.mkMerge [

nixos/modules/services/computing/boinc/client.nix

@@ -99,10 +99,8 @@ in
       description = "BOINC Client";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      script = ''
-        exec ${fhsEnvExecutable} --dir ${cfg.dataDir} ${allowRemoteGuiRpcFlag}
-      '';
       serviceConfig = {
+        ExecStart = "${fhsEnvExecutable} --dir ${cfg.dataDir} ${allowRemoteGuiRpcFlag}";
         User = "boinc";
         Nice = 10;
       };

nixos/modules/services/hardware/libinput.nix

@@ -431,39 +431,42 @@ in
     };
   };
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      services.udev.packages = [ pkgs.libinput.out ];
+    })
 
-    services.xserver.modules = [ pkgs.xorg.xf86inputlibinput ];
+    (lib.mkIf (cfg.enable && config.services.xserver.enable) {
+      services.xserver.modules = [ pkgs.xorg.xf86inputlibinput ];
 
-    environment.systemPackages = [ pkgs.xorg.xf86inputlibinput ];
+      # for man pages
+      environment.systemPackages = [ pkgs.xorg.xf86inputlibinput ];
 
-    environment.etc =
-      let
-        cfgPath = "X11/xorg.conf.d/40-libinput.conf";
-      in
-      {
-        ${cfgPath} = {
-          source = pkgs.xorg.xf86inputlibinput.out + "/share/" + cfgPath;
-        };
-      };
-
-    services.udev.packages = [ pkgs.libinput.out ];
-
-    services.xserver.inputClassSections = [
-      (mkX11ConfigForDevice "mouse" "Pointer")
-      (mkX11ConfigForDevice "touchpad" "Touchpad")
-    ];
-
-    assertions = [
-      # already present in synaptics.nix
-      /*
+      environment.etc =
+        let
+          cfgPath = "X11/xorg.conf.d/40-libinput.conf";
+        in
         {
-          assertion = !config.services.xserver.synaptics.enable;
-          message = "Synaptics and libinput are incompatible, you cannot enable both (in services.xserver).";
-        }
-      */
-    ];
+          ${cfgPath} = {
+            source = pkgs.xorg.xf86inputlibinput.out + "/share/" + cfgPath;
+          };
+        };
 
-  };
+      services.xserver.inputClassSections = [
+        (mkX11ConfigForDevice "mouse" "Pointer")
+        (mkX11ConfigForDevice "touchpad" "Touchpad")
+      ];
+
+      assertions = [
+        # already present in synaptics.nix
+        /*
+          {
+            assertion = !config.services.xserver.synaptics.enable;
+            message = "Synaptics and libinput are incompatible, you cannot enable both (in services.xserver).";
+          }
+        */
+      ];
+    })
+  ];
 
 }

nixos/modules/services/hardware/pommed.nix

@@ -51,7 +51,7 @@ in
     systemd.services.pommed = {
       description = "Pommed Apple Hotkeys Daemon";
       wantedBy = [ "multi-user.target" ];
-      script = "${pkgs.pommed_light}/bin/pommed -f";
+      serviceConfig.ExecStart = "${lib.getExe pkgs.pommed_light} -f";
     };
   };
 }

nixos/modules/services/home-automation/zigbee2mqtt.nix

@@ -79,6 +79,7 @@ in
       after = [ "network.target" ];
       environment.ZIGBEE2MQTT_DATA = cfg.dataDir;
       serviceConfig = {
+        ExecStartPre = "${lib.getExe' pkgs.coreutils "cp"} --no-preserve=mode ${configFile} '${cfg.dataDir}/configuration.yaml'";
         ExecStart = "${cfg.package}/bin/zigbee2mqtt";
         User = "zigbee2mqtt";
         Group = "zigbee2mqtt";
@@ -130,9 +131,6 @@ in
         ];
         UMask = "0077";
       };
-      preStart = ''
-        cp --no-preserve=mode ${configFile} "${cfg.dataDir}/configuration.yaml"
-      '';
     };
 
     users.users.zigbee2mqtt = {

nixos/modules/services/logging/heartbeat.nix

@@ -67,12 +67,10 @@ in
     systemd.services.heartbeat = {
       description = "heartbeat log shipper";
       wantedBy = [ "multi-user.target" ];
-      preStart = ''
-        mkdir -p "${cfg.stateDir}"/{data,logs}
-      '';
       serviceConfig = {
         User = "nobody";
         AmbientCapabilities = "cap_net_raw";
+        ExecStartPre = "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.stateDir}'/data '${cfg.stateDir}'/logs";
         ExecStart = "${cfg.package}/bin/heartbeat -c \"${heartbeatYml}\" -path.data \"${cfg.stateDir}/data\" -path.logs \"${cfg.stateDir}/logs\"";
       };
     };

nixos/modules/services/logging/journalbeat.nix

@@ -71,12 +71,12 @@ in
       wantedBy = [ "multi-user.target" ];
       wants = [ "elasticsearch.service" ];
       after = [ "elasticsearch.service" ];
-      preStart = ''
-        mkdir -p ${cfg.stateDir}/data
-        mkdir -p ${cfg.stateDir}/logs
-      '';
       serviceConfig = {
         StateDirectory = cfg.stateDir;
+        ExecStartPre = [
+          "${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.stateDir}/data"
+          "${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.stateDir}/logs"
+        ];
         ExecStart = ''
           ${cfg.package}/bin/journalbeat \
             -c ${journalbeatYml} \

nixos/modules/services/logging/journaldriver.nix

@@ -91,12 +91,12 @@ in
   config = mkIf cfg.enable {
     systemd.services.journaldriver = {
       description = "Stackdriver Logging journal forwarder";
-      script = "${pkgs.journaldriver}/bin/journaldriver";
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
+        ExecStart = lib.getExe pkgs.journaldriver;
         Restart = "always";
         DynamicUser = true;
 

nixos/modules/services/logging/promtail.nix

@@ -66,14 +66,11 @@ in
       wantedBy = [ "multi-user.target" ];
       stopIfChanged = false;
 
-      preStart = ''
-        ${lib.getExe pkgs.promtail} -config.file=${configFile} -check-syntax
-      '';
-
       serviceConfig = {
         Restart = "on-failure";
         TimeoutStopSec = 10;
 
+        ExecStartPre = "${lib.getExe pkgs.promtail} -config.file=${configFile} -check-syntax";
         ExecStart = "${pkgs.promtail}/bin/promtail -config.file=${configFile} ${escapeShellArgs cfg.extraFlags}";
 
         ProtectSystem = "strict";

nixos/modules/services/logging/syslog-ng.nix

@@ -79,7 +79,6 @@ in
   config = lib.mkIf cfg.enable {
     systemd.services.syslog-ng = {
       description = "syslog-ng daemon";
-      preStart = "mkdir -p /{var,run}/syslog-ng";
       wantedBy = [ "multi-user.target" ];
       after = [ "multi-user.target" ]; # makes sure hostname etc is set
       serviceConfig = {
@@ -87,6 +86,7 @@ in
         PIDFile = pidFile;
         StandardOutput = "null";
         Restart = "on-failure";
+        ExecStartPre = "${lib.getExe' pkgs.coreutils "mkdir"} -p /var/syslog-ng /run/syslog-ng";
         ExecStart = "${cfg.package}/sbin/syslog-ng ${lib.concatStringsSep " " syslogngOptions}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
       };

nixos/modules/services/mail/cyrus-imap.nix

@@ -342,6 +342,7 @@ in
         User = if (cfg.user == null) then "cyrus" else cfg.user;
         Group = if (cfg.group == null) then "cyrus" else cfg.group;
         Type = "simple";
+        ExecStartPre = "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.imapdSettings.configdirectory}/socket' '${cfg.tmpDBDir}' /run/cyrus/proc /run/cyrus/lock";
         ExecStart = "${cyrus-imapdPkg}/libexec/master -l $LISTENQUEUE -C /etc/imapd.conf -M /etc/cyrus.conf -p /run/cyrus/master.pid -D";
         Restart = "on-failure";
         RestartSec = "1s";
@@ -367,9 +368,6 @@ in
         RestrictNamespaces = true;
         RestrictRealtime = true;
       };
-      preStart = ''
-        mkdir -p '${cfg.imapdSettings.configdirectory}/socket' '${cfg.tmpDBDir}' /run/cyrus/proc /run/cyrus/lock
-      '';
     };
     environment.systemPackages = [ cyrus-imapdPkg ];
   };

nixos/modules/services/mail/dkimproxy-out.nix

@@ -109,10 +109,8 @@ in
             chown -R dkimproxy-out:dkimproxy-out "${keydir}"
           fi
         '';
-        script = ''
-          exec ${pkgs.dkimproxy}/bin/dkimproxy.out --conf_file=${configfile}
-        '';
         serviceConfig = {
+          ExecStart = "${pkgs.dkimproxy}/bin/dkimproxy.out --conf_file=${configfile}";
           User = "dkimproxy-out";
           PermissionsStartOnly = true;
         };

nixos/modules/services/mail/nullmailer.nix

@@ -245,13 +245,13 @@
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
 
-        preStart = ''
-          rm -f /var/spool/nullmailer/trigger && mkfifo -m 660 /var/spool/nullmailer/trigger
-        '';
-
         serviceConfig = {
           User = cfg.user;
           Group = cfg.group;
+          ExecStartPre = [
+            "${lib.getExe' pkgs.coreutils "rm"} -f /var/spool/nullmailer/trigger"
+            "${lib.getExe' pkgs.coreutils "mkfifo"} -m 660 /var/spool/nullmailer/trigger"
+          ];
           ExecStart = "${pkgs.nullmailer}/bin/nullmailer-send";
           Restart = "always";
         };

nixos/modules/services/mail/postgrey.nix

@@ -210,13 +210,13 @@ in
         description = "Postfix Greylisting Service";
         wantedBy = [ "multi-user.target" ];
         before = [ "postfix.service" ];
-        preStart = ''
-          mkdir -p /var/postgrey
-          chown postgrey:postgrey /var/postgrey
-          chmod 0770 /var/postgrey
-        '';
         serviceConfig = {
           Type = "simple";
+          ExecStartPre = [
+            "${lib.getExe' pkgs.coreutils "mkdir"} -p /var/postgrey"
+            "${lib.getExe' pkgs.coreutils "chown"} postgrey:postgrey /var/postgrey"
+            "${lib.getExe' pkgs.coreutils "chmod"} 0770 /var/postgrey"
+          ];
           ExecStart = ''
             ${pkgs.postgrey}/bin/postgrey \
                       ${bind-flag} \

nixos/modules/services/mail/stalwart-mail.nix

@@ -162,16 +162,6 @@ in
           "network.target"
         ];
 
-        preStart =
-          if useLegacyStorage then
-            ''
-              mkdir -p ${cfg.dataDir}/data/blobs
-            ''
-          else
-            ''
-              mkdir -p ${cfg.dataDir}/db
-            '';
-
         serviceConfig = {
           # Upstream service config
           Type = "simple";
@@ -182,6 +172,15 @@ in
           RestartSec = 5;
           SyslogIdentifier = "stalwart-mail";
 
+          ExecStartPre =
+            if useLegacyStorage then
+              ''
+                ${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.dataDir}/data/blobs
+              ''
+            else
+              ''
+                ${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.dataDir}/db
+              '';
           ExecStart = [
             ""
             "${lib.getExe cfg.package} --config=${configFile}"

nixos/modules/services/misc/autofs.nix

@@ -88,14 +88,11 @@ in
       wants = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
-      preStart = ''
-        # There should be only one autofs service managed by systemd, so this should be safe.
-        rm -f /tmp/autofs-running
-      '';
-
       serviceConfig = {
         Type = "forking";
         PIDFile = "/run/autofs.pid";
+        # There should be only one autofs service managed by systemd, so this should be safe.
+        ExecStartPre = "${lib.getExe' pkgs.coreutils "rm"} -f /tmp/autofs-running";
         ExecStart = "${pkgs.autofs5}/bin/automount ${lib.optionalString cfg.debug "-d"} -p /run/autofs.pid -t ${toString cfg.timeout} ${autoMaster}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
       };

nixos/modules/services/misc/dictd.nix

@@ -78,7 +78,7 @@ in
         # with code 143 instead of exiting with code 0.
         serviceConfig.SuccessExitStatus = [ 143 ];
         serviceConfig.Type = "forking";
-        script = "${pkgs.dict}/sbin/dictd -s -c ${dictdb}/share/dictd/dictd.conf --locale en_US.UTF-8";
+        serviceConfig.ExecStart = "${pkgs.dict}/sbin/dictd -s -c ${dictdb}/share/dictd/dictd.conf --locale en_US.UTF-8";
       };
     };
 }

nixos/modules/services/misc/docker-registry.nix

@@ -143,11 +143,9 @@ in
       description = "Docker Container Registry";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
-      script = ''
-        ${cfg.package}/bin/registry serve ${configFile}
-      '';
 
       serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} serve ${configFile}";
         User = "docker-registry";
         WorkingDirectory = cfg.storagePath;
         AmbientCapabilities = lib.mkIf (cfg.port < 1024) "cap_net_bind_service";

nixos/modules/services/misc/errbot.nix

@@ -100,13 +100,13 @@ in
         {
           after = [ "network-online.target" ];
           wantedBy = [ "multi-user.target" ];
-          preStart = ''
-            mkdir -p ${dataDir}
-            chown -R errbot:errbot ${dataDir}
-          '';
           serviceConfig = {
             User = "errbot";
             Restart = "on-failure";
+            ExecStartPre = [
+              "${lib.getExe' pkgs.coreutils "mkdir"} -p ${dataDir}"
+              "${lib.getExe' pkgs.coreutils "chown"} -R errbot:errbot ${dataDir}"
+            ];
             ExecStart = "${pkgs.errbot}/bin/errbot -c ${mkConfigDir instanceCfg dataDir}/config.py";
             PermissionsStartOnly = true;
           };

nixos/modules/services/web-apps/dawarich.nix

@@ -0,0 +1,706 @@
+{
+  lib,
+  pkgs,
+  config,
+  options,
+  ...
+}:
+
+let
+  cfg = config.services.dawarich;
+  opt = options.services.dawarich;
+
+  dataDir = "/var/lib/dawarich";
+
+  isRedisUnixSocket = lib.hasPrefix "/" cfg.redis.host;
+
+  redisEnv =
+    if isRedisUnixSocket then
+      {
+        REDIS_URL = "unix://${config.services.redis.servers.dawarich.unixSocket}";
+      }
+    else
+      {
+        # Does not support passwords, but upstream does not provide an adequate env variable
+        # Perhaps patch or make a PR upstream in the future
+        REDIS_URL = "redis://${cfg.redis.host}:${toString cfg.redis.port}";
+      };
+
+  env = {
+    RAILS_ENV = "production";
+    NODE_ENV = "production";
+    BUNDLE_USER_HOME = "/tmp/bundle"; # will use private tmp inside systemd unit
+
+    SELF_HOSTED = "true";
+    STORE_GEODATA = "true";
+    APPLICATION_PROTOCOL = "http";
+    TIME_ZONE = config.time.timeZone; # otherwise upstream forces it to Europe/London
+    DOMAIN = cfg.localDomain;
+    APPLICATION_HOSTS = "127.0.0.1,::1,${cfg.localDomain}";
+
+    BOOTSNAP_CACHE_DIR = "/var/cache/dawarich/precompile";
+    LD_PRELOAD = "${lib.getLib pkgs.jemalloc}/lib/libjemalloc.so";
+
+    DATABASE_USER = cfg.database.user;
+    DATABASE_HOST = cfg.database.host;
+    DATABASE_NAME = cfg.database.name;
+    DATABASE_PORT = toString cfg.database.port;
+
+    SMTP_SERVER = cfg.smtp.host;
+    SMTP_PORT = toString cfg.smtp.port;
+    SMTP_FROM = cfg.smtp.fromAddress;
+    SMTP_USERNAME = cfg.smtp.user;
+    PORT = toString cfg.webPort;
+  }
+  // redisEnv
+  // cfg.environment;
+
+  systemCallFilter =
+    let
+      allowedSystemCalls = [
+        "@cpu-emulation"
+        "@debug"
+        "@keyring"
+        "@ipc"
+        "@mount"
+        "@obsolete"
+        "@privileged"
+        "@setuid"
+      ];
+    in
+    [
+      ("~" + lib.concatStringsSep " " allowedSystemCalls)
+      "@chown"
+      "pipe"
+      "pipe2"
+    ];
+
+  cfgService = {
+    User = cfg.user;
+    Group = cfg.group;
+    WorkingDirectory = cfg.package;
+    CacheDirectory = "dawarich";
+    CacheDirectoryMode = "0750";
+    StateDirectory = "dawarich";
+    StateDirectoryMode = "0750";
+    LogsDirectory = "dawarich";
+    LogsDirectoryMode = "0750";
+    ProcSubset = "pid";
+    ProtectProc = "invisible";
+    UMask = "0027";
+    CapabilityBoundingSet = "";
+    NoNewPrivileges = true;
+    ProtectSystem = "strict";
+    ProtectHome = true;
+    PrivateTmp = true;
+    PrivateDevices = true;
+    PrivateUsers = true;
+    ProtectClock = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectControlGroups = true;
+    RestrictAddressFamilies = [
+      "AF_UNIX"
+      "AF_INET"
+      "AF_INET6"
+      "AF_NETLINK"
+    ];
+    RestrictNamespaces = true;
+    LockPersonality = true;
+    MemoryDenyWriteExecute = false;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    RemoveIPC = true;
+    PrivateMounts = true;
+    SystemCallArchitectures = "native";
+    SystemCallFilter = systemCallFilter;
+
+    # ensure permissions to connect to the redis socket
+    SupplementaryGroups = lib.mkIf (cfg.redis.createLocally && isRedisUnixSocket) [
+      config.services.redis.servers.dawarich.group
+    ];
+  };
+
+  # Units that all Dawarich units After= and Requires= on
+  commonUnits =
+    lib.optional cfg.redis.createLocally "redis-dawarich.service"
+    ++ lib.optional cfg.database.createLocally "postgresql.target"
+    ++ lib.optional cfg.automaticMigrations "dawarich-init-db.service";
+
+  defaultSecretKeyBaseFile = "${dataDir}/secrets/secret-key-base";
+  needsGenCredentialsUnit = cfg.secretKeyBaseFile == null;
+  credentials = {
+    SECRET_KEY_BASE = lib.defaultTo defaultSecretKeyBaseFile cfg.secretKeyBaseFile;
+  }
+  // lib.optionalAttrs (cfg.database.passwordFile != null) {
+    DATABASE_PASSWORD = cfg.database.passwordFile;
+  }
+  // lib.optionalAttrs (cfg.smtp.passwordFile != null) {
+    SMTP_PASSWORD = cfg.smtp.passwordFile;
+  };
+  loadCredentialsIntoEnv = lib.concatMapAttrsStringSep "\n" (
+    name: _: ''export ${name}="$(systemd-creds cat ${name})"''
+  ) credentials;
+  loadCredentials = lib.mapAttrsToList (name: path: "${name}:${path}") credentials;
+
+  dawarichRails = pkgs.writeShellApplication {
+    name = "dawarich-rails";
+
+    text =
+      let
+        sourceExtraEnv = lib.concatMapStrings (p: "source ${p}\n") cfg.extraEnvFiles;
+        command = pkgs.writeShellScript "dawarich-rails-unwrapped" ''
+          ${sourceExtraEnv}
+          ${loadCredentialsIntoEnv}
+          export RAILS_ROOT="${cfg.package}"
+          exec ${lib.getExe' cfg.package "rails"} "$@"
+        '';
+        env' = lib.filterAttrs (_: value: value != null) env;
+        supplementaryGroups = lib.optionalString (cfg.redis.createLocally && isRedisUnixSocket) (
+          lib.escapeShellArg "--property=SupplementaryGroups=${config.services.redis.servers.dawarich.group}"
+        );
+      in
+      ''
+        exec ${lib.getExe' config.systemd.package "systemd-run"} \
+          ${
+            lib.escapeShellArgs (map (credential: "--property=LoadCredential=${credential}") loadCredentials)
+          } \
+          ${
+            lib.escapeShellArgs (lib.mapAttrsToList (name: value: "--setenv=${name}=${toString value}") env')
+          } \
+          --uid=${lib.escapeShellArg cfg.user} \
+          --gid=${lib.escapeShellArg cfg.group} \
+          ${supplementaryGroups} \
+          --working-directory=${lib.escapeShellArg cfg.package} \
+          --property=PrivateTmp=yes \
+          --pty \
+          --wait \
+          --collect \
+          --service-type=exec \
+          --quiet \
+          -- \
+          ${command} "$@"
+      '';
+  };
+  dawarichConsole = pkgs.writeShellScriptBin "dawarich-console" ''
+    exec ${lib.getExe dawarichRails} console "$@"
+  '';
+
+  sidekiqUnits = lib.attrsets.mapAttrs' (
+    name: processCfg:
+    lib.nameValuePair "dawarich-sidekiq-${name}" (
+      let
+        jobClassArgs = lib.concatMapStringsSep " " (c: "-q ${c}") processCfg.jobClasses;
+        jobClassLabel = lib.optionalString (
+          processCfg.jobClasses != [ ]
+        ) " (${lib.concatStringsSep ", " processCfg.jobClasses})";
+        threads = toString (if processCfg.threads == null then cfg.sidekiqThreads else processCfg.threads);
+      in
+      {
+        after = [
+          "network.target"
+        ]
+        ++ lib.optional needsGenCredentialsUnit "dawarich-init-credentials.service"
+        ++ commonUnits;
+        requires = lib.optional needsGenCredentialsUnit "dawarich-init-credentials.service" ++ commonUnits;
+        description = "Dawarich sidekiq${jobClassLabel}";
+        wantedBy = [ "dawarich.target" ];
+        environment = env // {
+          RAILS_MAX_THREADS = threads;
+        };
+        script = ''
+          ${loadCredentialsIntoEnv}
+
+          ${lib.getExe' cfg.package "sidekiq"} ${jobClassArgs} -c ${threads} -r ${cfg.package}
+        '';
+        serviceConfig = {
+          Restart = "always";
+          RestartSec = 20;
+          LoadCredential = loadCredentials;
+          EnvironmentFile = cfg.extraEnvFiles;
+          LimitNOFILE = "1024000";
+        }
+        // cfgService;
+      }
+    )
+  ) cfg.sidekiqProcesses;
+
+in
+{
+
+  options = {
+    services.dawarich = {
+      enable = lib.mkEnableOption "Dawarich, a self-hostable alternative to Google Location History";
+
+      configureNginx = lib.mkOption {
+        description = ''
+          Configure nginx as a reverse proxy for dawarich.
+          Alternatively you can configure a reverse-proxy of your choice to serve these paths:
+
+          `/ -> ''${pkgs.dawarich}/public`
+
+          `/ -> 127.0.0.1:{{ webPort }} `(If there was no file in the directory above.)
+
+          Make sure that websockets are forwarded properly. You might want to set up caching
+          of some requests. Take a look at dawarich's provided reverse proxy configurations at
+          `https://dawarich.app/docs/tutorials/reverse-proxy`.
+        '';
+        type = lib.types.bool;
+        default = true;
+      };
+
+      user = lib.mkOption {
+        description = ''
+          User under which dawarich runs. If it is set to "dawarich",
+          that user will be created, otherwise it should be set to the
+          name of a user created elsewhere.
+        '';
+        type = lib.types.str;
+        default = "dawarich";
+      };
+
+      group = lib.mkOption {
+        description = ''
+          Group under which dawarich runs.
+        '';
+        type = lib.types.str;
+        default = "dawarich";
+      };
+
+      webPort = lib.mkOption {
+        description = "TCP port used by the dawarich web service.";
+        type = lib.types.port;
+        default = 3000;
+      };
+
+      sidekiqThreads = lib.mkOption {
+        description = ''
+          Worker threads used by the dawarich-sidekiq-all service.
+          If `sidekiqProcesses` is configured and any processes specify null `threads`, this value is used.
+        '';
+        type = lib.types.int;
+        default = 5;
+      };
+
+      sidekiqProcesses = lib.mkOption {
+        description = ''
+          How many Sidekiq processes should be used to handle background jobs, and which job classes they handle.
+          Can be used to [speed up](https://dawarich.app/docs/FAQ/#how-to-speed-up-the-import-process) the import process.
+        '';
+        type =
+          with lib.types;
+          attrsOf (submodule {
+            options = {
+              jobClasses = lib.mkOption {
+                # https://github.com/Freika/dawarich/blob/0.37.2/config/sidekiq.yml
+                type = listOf (enum [
+                  "app_version_checking"
+                  "archival"
+                  "cache"
+                  "data_migrations"
+                  "default"
+                  "digests"
+                  "exports"
+                  "families"
+                  "imports"
+                  "mailers"
+                  "places"
+                  "points"
+                  "reverse_geocoding"
+                  "stats"
+                  "tracks"
+                  "trips"
+                  "visit_suggesting"
+                ]);
+                description = ''
+                  If not empty, which job classes should be executed by this process.
+                  *If left empty, all job classes will be executed by this process.*
+                '';
+              };
+              threads = lib.mkOption {
+                type = nullOr int;
+                description = ''
+                  Number of threads this process should use for executing jobs.
+                  If null, the configured `sidekiqThreads` are used.
+                '';
+              };
+            };
+          });
+        default = {
+          all = {
+            jobClasses = [ ];
+            threads = null;
+          };
+        };
+        example = {
+          all = {
+            jobClasses = [ ];
+            threads = null;
+          };
+          geocoding = {
+            jobClasses = [ "reverse_geocoding" ];
+            threads = 10;
+          };
+        };
+      };
+
+      localDomain = lib.mkOption {
+        description = "The domain serving your Dawarich instance.";
+        example = "dawarich.example.org";
+        type = lib.types.str;
+      };
+
+      secretKeyBaseFile = lib.mkOption {
+        description = ''
+          Path to file containing the secret key base.
+          A new secret key base can be generated by running:
+
+          `nix build -f '<nixpkgs>' dawarich; cd result; bin/bundle exec rails secret`
+
+          This file is loaded using systemd credentials, and therefore does not need to be
+          owned by the dawarich user.
+
+          If this option is null, it will be created at ${defaultSecretKeyBaseFile}
+          with a new secret key base.
+        '';
+        default = null;
+        type = lib.types.nullOr lib.types.str;
+      };
+
+      redis = {
+        createLocally = lib.mkOption {
+          description = ''
+            Whether to configure a local Redis server for Dawarich.
+            The connection is performed via Unix sockets by default,
+            but that can be changed by configuring {option}`${opt.redis.host}` and {option}`${opt.redis.port}`.
+          '';
+          type = lib.types.bool;
+          default = true;
+        };
+
+        host = lib.mkOption {
+          description = "The redis host Dawarich will connect to.";
+          type = lib.types.str;
+          default = config.services.redis.servers.dawarich.unixSocket;
+          defaultText = lib.literalExpression "config.services.redis.servers.dawarich.unixSocket";
+        };
+
+        port = lib.mkOption {
+          description = "The port of the redis server Dawarich will connect to. Set to zero to disable TCP and use Unix sockets instead.";
+          type = lib.types.port;
+          default = 0;
+        };
+      };
+
+      database = {
+        createLocally = lib.mkOption {
+          description = ''
+            Whether to configure a local PostgreSQL server and database for Dawarich.
+            The connection is performed via Unix sockets.
+          '';
+          type = lib.types.bool;
+          default = true;
+        };
+
+        host = lib.mkOption {
+          type = lib.types.str;
+          default = "/run/postgresql";
+          example = "127.0.0.1";
+          description = "Hostname or address of the postgresql server. If an absolute path is given here, it will be interpreted as a unix socket path.";
+        };
+
+        port = lib.mkOption {
+          type = lib.types.nullOr lib.types.port;
+          default = 5432;
+          description = "Port of the postgresql server.";
+        };
+
+        name = lib.mkOption {
+          type = lib.types.str;
+          default = "dawarich";
+          description = "The name of the dawarich database.";
+        };
+
+        user = lib.mkOption {
+          type = lib.types.str;
+          default = "dawarich";
+          description = "The database user for dawarich.";
+        };
+
+        passwordFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          example = "/run/keys/dawarich-db-password";
+          description = ''
+            A file containing the password corresponding to {option}`${opt.database.user}`.
+          '';
+        };
+      };
+
+      smtp = {
+        host = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+          description = "SMTP host used when sending emails to users.";
+        };
+
+        port = lib.mkOption {
+          type = lib.types.port;
+          default = 25;
+          description = "SMTP port used when sending emails to users.";
+        };
+
+        fromAddress = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+          example = "dawarich@example.com";
+          description = ''"From" address used when sending emails to users.'';
+        };
+
+        user = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+          example = "dawarich@example.com";
+          description = "SMTP login name.";
+        };
+
+        passwordFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          example = "/run/keys/dawarich-smtp-password";
+          description = ''
+            Path to file containing the SMTP password.
+          '';
+        };
+      };
+
+      package = lib.mkPackageOption pkgs "dawarich" { };
+
+      environment = lib.mkOption {
+        type =
+          with lib.types;
+          attrsOf (
+            nullOr (oneOf [
+              str
+              path
+              package
+            ])
+          );
+        default = { };
+        description = ''
+          Extra environment variables to pass to all dawarich services.
+        '';
+      };
+
+      extraEnvFiles = lib.mkOption {
+        type = with lib.types; listOf path;
+        default = [ ];
+        description = ''
+          Extra environment files to pass to all Dawarich services. Useful for passing down environment secrets.
+        '';
+        example = [ "/etc/dawarich/secret.env" ];
+      };
+
+      automaticMigrations = lib.mkOption {
+        description = "Whether to perform database migrations automatically";
+        type = lib.types.bool;
+        default = true;
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        assertions = [
+          {
+            assertion = !isRedisUnixSocket -> cfg.redis.port != 0;
+            message = ''
+              `services.dawarich.redis.port` needs to be configured if `services.dawarich.redis.host` is not a unix socket.
+            '';
+          }
+        ];
+
+        environment.systemPackages = [
+          dawarichConsole
+          dawarichRails
+        ];
+
+        systemd.targets.dawarich = {
+          description = "Target for all Dawarich services";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+        };
+
+        systemd.services.dawarich-init-credentials = lib.mkIf needsGenCredentialsUnit {
+          script = ''
+            umask 077
+          ''
+          + lib.optionalString (cfg.secretKeyBaseFile == null) ''
+            if ! test -f ${defaultSecretKeyBaseFile}; then
+              mkdir -p $(dirname ${defaultSecretKeyBaseFile})
+              bin/bundle exec rails secret > ${defaultSecretKeyBaseFile}
+            fi
+          '';
+
+          environment = env;
+          serviceConfig = {
+            Type = "oneshot";
+            SyslogIdentifier = "dawarich-init-dirs";
+            # System Call Filtering
+            SystemCallFilter = [ "~@resources" ] ++ systemCallFilter;
+          }
+          // cfgService;
+
+          after = [ "network.target" ];
+        };
+
+        systemd.services.dawarich-init-db = lib.mkIf cfg.automaticMigrations {
+          script = ''
+            ${loadCredentialsIntoEnv}
+
+            # Run primary database migrations first (needed before other migrations)
+            echo "Running primary database migrations..."
+            rails db:migrate
+
+            # Run data migrations
+            echo "Running DATA migrations..."
+            rake data:migrate
+
+            echo "Running seeds..."
+            rails db:seed
+          '';
+          path = [ cfg.package ];
+          environment = env;
+          serviceConfig = {
+            Type = "oneshot";
+            LoadCredential = loadCredentials;
+            EnvironmentFile = cfg.extraEnvFiles;
+            WorkingDirectory = cfg.package;
+            # System Call Filtering
+            SystemCallFilter = [ "~@resources" ] ++ systemCallFilter;
+          }
+          // cfgService;
+          # both postgres and redis are needed for the migrations to work
+          after = [
+            "network.target"
+          ]
+          ++ lib.optional needsGenCredentialsUnit "dawarich-init-credentials.service"
+          ++ lib.optional cfg.database.createLocally "postgresql.target"
+          ++ lib.optional cfg.redis.createLocally "redis-dawarich.service";
+          requires =
+            lib.optional needsGenCredentialsUnit "dawarich-init-credentials.service"
+            ++ lib.optional cfg.database.createLocally "postgresql.target"
+            ++ lib.optional cfg.redis.createLocally "redis-dawarich.service";
+        };
+
+        systemd.services.dawarich-web = {
+          after = [
+            "network.target"
+          ]
+          ++ lib.optional needsGenCredentialsUnit "dawarich-init-credentials.service"
+          ++ commonUnits;
+          requires = lib.optional needsGenCredentialsUnit "dawarich-init-credentials.service" ++ commonUnits;
+          wantedBy = [ "dawarich.target" ];
+          description = "Dawarich web";
+          environment = env;
+          script = ''
+            ${loadCredentialsIntoEnv}
+
+            ${lib.getExe' cfg.package "rails"} server
+          '';
+          serviceConfig = {
+            Restart = "always";
+            RestartSec = 20;
+            LoadCredential = loadCredentials;
+            EnvironmentFile = cfg.extraEnvFiles;
+            WorkingDirectory = cfg.package;
+            # Runtime directory and mode
+            RuntimeDirectory = "dawarich-web";
+            RuntimeDirectoryMode = "0750";
+          }
+          // cfgService;
+        };
+
+        systemd.tmpfiles.settings."dawarich"."${dataDir}/imports/watched".d = {
+          group = "dawarich";
+          mode = "700";
+          user = "dawarich";
+        };
+
+        services.nginx = lib.mkIf cfg.configureNginx {
+          enable = true;
+          virtualHosts."${cfg.localDomain}" = {
+            root = "${cfg.package}/public/";
+
+            locations."/" = {
+              tryFiles = "$uri @proxy";
+            };
+
+            locations."@proxy" = {
+              proxyPass = "http://127.0.0.1:${toString cfg.webPort}";
+              recommendedProxySettings = true;
+              proxyWebsockets = true;
+            };
+          };
+        };
+
+        services.redis.servers = lib.mkIf cfg.redis.createLocally {
+          dawarich = {
+            enable = true;
+            port = cfg.redis.port;
+            bind = lib.mkIf (!isRedisUnixSocket) cfg.redis.host;
+          };
+        };
+
+        services.postgresql = lib.mkIf cfg.database.createLocally {
+          enable = true;
+          extensions = ps: with ps; [ postgis ];
+          ensureUsers = [
+            {
+              inherit (cfg.database) name;
+              ensureDBOwnership = true;
+            }
+          ];
+          ensureDatabases = [ cfg.database.name ];
+        };
+
+        systemd.services.postgresql-setup.serviceConfig.ExecStartPost =
+          let
+            # https://github.com/Freika/dawarich/blob/0.30.6/db/schema.rb#L15-L16
+            # https://postgis.net/documentation/getting_started/
+            sqlFile = pkgs.writeText "dawarich-postgres-setup.sql" ''
+              CREATE EXTENSION IF NOT EXISTS postgis;
+              SELECT postgis_extensions_upgrade();
+            '';
+          in
+          lib.mkIf cfg.database.createLocally [
+            ''
+              ${lib.getExe' config.services.postgresql.package "psql"} -d "${cfg.database.name}" -f "${sqlFile}"
+            ''
+          ];
+
+        users.users = lib.mkIf (cfg.user == "dawarich") {
+          dawarich = {
+            isSystemUser = true;
+            home = cfg.package;
+            inherit (cfg) group;
+          };
+        };
+        users.groups = lib.mkIf (cfg.group == "dawarich") { ${cfg.group} = { }; };
+      }
+      {
+        systemd.services = lib.mkMerge [
+          sidekiqUnits
+        ];
+      }
+    ]
+  );
+
+  meta.maintainers = with lib.maintainers; [
+    diogotcorreia
+  ];
+
+}

nixos/modules/tasks/filesystems/zfs.nix

@@ -855,6 +855,7 @@ in
               "resilver_finish-start-scrub.sh"
               "scrub_finish-notify.sh"
               "statechange-notify.sh"
+              "zed-functions.sh"
             ]
             ++ lib.optionals (lib.versionOlder cfgZfs.package.version "2.4") [
               "deadman-slot_off.sh"

nixos/tests/all-tests.nix

@@ -446,6 +446,7 @@ in
   darling-dmg = runTest ./darling-dmg.nix;
   dashy = runTest ./web-apps/dashy.nix;
   davis = runTest ./davis.nix;
+  dawarich = runTest ./web-apps/dawarich.nix;
   db-rest = runTest ./db-rest.nix;
   dconf = runTest ./dconf.nix;
   ddns-updater = runTest ./ddns-updater.nix;

nixos/tests/lomiri-calendar-app.nix

@@ -91,7 +91,7 @@
         machine.sleep(10)
         machine.send_key("alt-f10")
         machine.sleep(2)
-        machine.wait_for_text(r"(Montag|Dienstag|Mittwoch|Donnerstag|Freitag|Samstag|Sonntag)")
+        machine.wait_for_text(r"(Termine|Tag|Woche|Monat|Jahr|Montag|Dienstag|Mittwoch|Donnerstag|Freitag|Samstag|Sonntag)")
         machine.screenshot("lomiri-calendar_localised")
   '';
 }

nixos/tests/ringboard.nix

@@ -6,7 +6,7 @@
 }:
 {
   name = "ringboard";
-  meta = { inherit (pkgs.ringboard.meta) maintainers; };
+  meta.maintainers = pkgs.ringboard.meta.maintainers ++ (with lib.maintainers; [ h7x4 ]);
 
   nodes.machine = {
     imports = [
@@ -17,12 +17,14 @@
     test-support.displayManager.auto.user = "alice";
 
     services.xserver.displayManager.sessionCommands = ''
-      '${lib.getExe pkgs.gedit}' &
+      '${lib.getExe pkgs.gedit}' my_document &
     '';
 
     services.ringboard.x11.enable = true;
   };
 
+  enableOCR = true;
+
   testScript =
     { nodes, ... }:
     let
@@ -31,7 +33,8 @@
     ''
       @polling_condition
       def gedit_running():
-        machine.succeed("pgrep gedit")
+        "Check that gedit is running and visible to the user"
+        machine.wait_for_text("my_document")
 
       with subtest("Wait for service startup"):
         machine.wait_for_unit("graphical.target")
@@ -40,10 +43,12 @@
 
       with subtest("Ensure clipboard is monitored"):
         with gedit_running: # type: ignore[union-attr]
-          machine.send_chars("Hello world!")
+          machine.send_chars("Hello world!", delay=0.1)
+          machine.sleep(1)
           machine.send_key("ctrl-a")
+          machine.sleep(1)
           machine.send_key("ctrl-c")
-          machine.wait_for_console_text("Small selection transfer complete")
-          machine.succeed("su - '${user}' -c 'ringboard search Hello | grep world!'")
+        machine.wait_until_succeeds("su - '${user}' -c 'journalctl --user -u ringboard-listener.service --grep \'Small selection transfer complete\'''", timeout=60)
+        machine.succeed("su - '${user}' -c 'ringboard search Hello | grep world!'")
     '';
 }

nixos/tests/web-apps/dawarich.nix

@@ -0,0 +1,77 @@
+{ ... }:
+{
+  name = "dawarich-nixos";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.dawarich = {
+        enable = true;
+        localDomain = "localhost";
+      };
+
+      environment.etc.geojson.source = pkgs.fetchurl {
+        url = "https://github.com/Freika/dawarich/raw/8c24764aa56a084e980e21bc2ffd13a72fd611db/spec/fixtures/files/geojson/export.json";
+        hash = "sha256-qI00E5ixKTRJduAD+qB3JzvrpoJmC55llNtSiPVyxz4=";
+      };
+    };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("dawarich.target")
+
+    machine.wait_for_open_port(3000) # Web
+    machine.succeed("curl --fail http://localhost/")
+
+    # Get API key via ruby console
+    api_key = machine.succeed("dawarich-rails runner \"puts User.find_by(email: 'demo@dawarich.app').api_key\"").strip().split("\n")[-1]
+
+    res = machine.succeed(f"curl -f -H 'Authorization: Bearer {api_key}' http://localhost/api/v1/users/me")
+    user_data = json.loads(res)
+    assert user_data['user']['email'] == 'demo@dawarich.app'
+
+    example_point = {
+      "locations": [
+        {
+          "type": "Feature",
+          "geometry": {
+            "type": "Point",
+            "coordinates": [
+              -122.40530871,
+              37.74430413
+            ]
+          },
+          "properties": {
+            "battery_state": "full",
+            "battery_level": 0.7,
+            "wifi": "dawarich_home",
+            "timestamp": "2025-01-17T21:03:01Z",
+            "horizontal_accuracy": 5,
+            "vertical_accuracy": -1,
+            "altitude": 0,
+            "speed": 92.088,
+            "speed_accuracy": 0,
+            "course": 27.07,
+            "course_accuracy": 0,
+            "track_id": "799F32F5-89BB-45FB-A639-098B1B95B09F",
+            "device_id": "8D5D4197-245B-4619-A88B-2049100ADE46"
+          }
+        }
+      ]
+    }
+    machine.succeed(f"curl -f -H 'Authorization: Bearer {api_key}' --json '{json.dumps(example_point)}' http://localhost/api/v1/points")
+
+    res = machine.succeed(f"curl -f -H 'Authorization: Bearer {api_key}' http://localhost/api/v1/points")
+    assert len(json.loads(res)) == 1
+
+    # Test watcher job import
+    import_dir = "/var/lib/dawarich/imports/watched/demo@dawarich.app"
+    machine.succeed(f"mkdir -p {import_dir} && cp /etc/geojson {import_dir}/example.json")
+
+    machine.succeed('dawarich-rails runner "Import::WatcherJob.perform_now"')
+    # job runs in the background so doesn't update immediately
+    res = machine.wait_until_succeeds(f"curl -f -H 'Authorization: Bearer {api_key}' http://localhost/api/v1/points | grep '\"id\":2'")
+    assert len(json.loads(res)) == 11
+  '';
+}

pkgs/applications/editors/emacs/elisp-packages/manual-packages/elpaca/default.nix

@@ -6,63 +6,24 @@
   lib,
 }:
 
-melpaBuild rec {
+melpaBuild {
   pname = "elpaca";
-  version = "0-unstable-2025-11-06";
+  version = "0-unstable-2025-02-16";
 
   src = fetchFromGitHub {
     owner = "progfolio";
     repo = "elpaca";
-    rev = "b5ef5f19ac1224853234c9acdac0ec9ea1c440a1";
-    hash = "sha256-EZ9emYTweRZzMKxZu9nbAaGgE2tInaL7KCKvJ5TaD0g=";
+    rev = "07b3a653e2411f4d4b5902af1c9b3f159e07bec5";
+    hash = "sha256-+YJX2BJxH3D5u7YC/yJskZu0F4Nlat3ZROe+RCZGq9w=";
   };
 
   nativeBuildInputs = [ git ];
 
-  # Moves extensions into the source root directory to install them.
-  # Disables warnings related to being used with package.el and not matching the installer
-  # Points the elpaca-repos-directory to the installed package in the nix store
-  postPatch =
-    let
-      siteVersion = lib.concatStrings (lib.drop 2 (lib.splitVersion version));
-    in
-    ''
-      mv extensions/* .
-      substituteInPlace elpaca.el \
-        --replace-fail "lwarn '(elpaca installer)" \
-                       "ignore '(elpaca installer)" \
-        --replace-fail "warn \"Package.el" \
-                       "ignore \"Package.el" \
-        --replace-fail "(expand-file-name \"elpaca/\" elpaca-repos-directory)" \
-                       "\"${placeholder "out"}/share/emacs/site-lisp/elpa/elpaca-${siteVersion}.0\""
-    '';
-
   passthru.updateScript = unstableGitUpdater { };
 
   meta = {
-    description = "Elisp package manager and replacement for package.el";
-    longDescription = ''
-      Elpaca is an elisp package manager. It allows users to find,
-      install, update, and remove third-party packages for Emacs. It
-      is a replacement for the built-in Emacs package manager,
-      package.el.
-
-      Elpaca:
-       - Installs packages asynchronously, in parallel for fast, non-blocking installations.
-       - Includes a flexible UI for finding and operating on packages.
-       - Downloads packages from their sources for convenient elisp development.
-       - Supports thousands of elisp packages out of the box (MELPA, NonGNU/GNU ELPA, Org/org-contrib).
-       - Makes it easy for users to create their own ELPAs.
-
-      Elpaca has been adapted for Emacs managed via Nix. To activate
-      Elpaca, this snippet can be used within your init.el:
-
-      ```elisp
-      (add-hook 'after-init-hook #'elpaca-process-queues)
-      (elpaca-use-package-mode) ;; Optional, for use-package support
-      ```
-    '';
     homepage = "https://github.com/progfolio/elpaca";
+    description = "Elisp package manager";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       abhisheksingh0x558

pkgs/applications/editors/vim/plugins/generated.nix

@@ -16184,6 +16184,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  tuis-nvim = buildVimPlugin {
+    pname = "tuis.nvim";
+    version = "0-unstable-2026-01-15";
+    src = fetchFromGitHub {
+      owner = "jrop";
+      repo = "tuis.nvim";
+      rev = "3f3daa725cf1faffe07287cfe347e054d2f80470";
+      hash = "sha256-IJIqWD6XNzoAVr75WLzBf1Ut35RxSHzZ0//hTskEdSA=";
+      fetchSubmodules = true;
+    };
+    meta.homepage = "https://github.com/jrop/tuis.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   tv-nvim = buildVimPlugin {
     pname = "tv.nvim";
     version = "0-unstable-2026-01-10";

pkgs/applications/editors/vim/plugins/utils/get-plugins.nix

@@ -1,10 +1,9 @@
 with import <localpkgs> { };
 let
   inherit (vimUtils.override { inherit vim; }) buildVimPlugin;
-  inherit (neovimUtils) buildNeovimPlugin;
 
   generated = callPackage <localpkgs/pkgs/applications/editors/vim/plugins/generated.nix> {
-    inherit buildNeovimPlugin buildVimPlugin;
+    inherit buildVimPlugin;
   } { } { };
 
   hasChecksum =
@@ -15,16 +14,15 @@ let
       "outputHash"
     ] value;
 
-  parse = name: value: {
-    pname = value.pname;
-    version = value.version;
+  parse = _name: value: {
+    inherit (value) pname version;
     homePage = value.meta.homepage;
     checksum =
       if hasChecksum value then
         {
           submodules = value.src.fetchSubmodules or false;
           sha256 = value.src.outputHash;
-          rev = value.src.rev;
+          inherit (value.src) rev;
         }
       else
         null;

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1242,6 +1242,7 @@ https://github.com/dmmulroy/tsc.nvim/,HEAD,
 https://github.com/jgdavey/tslime.vim/,,
 https://github.com/mtrajano/tssorter.nvim/,HEAD,
 https://github.com/Quramy/tsuquyomi/,,
+https://github.com/jrop/tuis.nvim/,HEAD,
 https://github.com/alexpasmantier/tv.nvim/,HEAD,
 https://github.com/folke/twilight.nvim/,,
 https://github.com/pmizio/typescript-tools.nvim/,,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -968,8 +968,8 @@ let
         mktplcRef = {
           name = "chatgpt-reborn";
           publisher = "chris-hayes";
-          version = "3.27.0";
-          sha256 = "sha256-52SvGb9TsvDQey5cjw+ZIQBP/1dyWcHKNjqCCCyM6k4=";
+          version = "3.28.0";
+          sha256 = "sha256-YOaOBDGoLg/bWB/Yw6CCbJ/J7s6qA8QlbM3wiknCTGQ=";
         };
       };
 
@@ -1268,8 +1268,8 @@ let
         mktplcRef = {
           publisher = "denoland";
           name = "vscode-deno";
-          version = "3.47.0";
-          hash = "sha256-T8RJi2SiFf6rMTpDQx9VuBv0zNwvusZrwybHeFe5/KQ=";
+          version = "3.48.0";
+          hash = "sha256-AWnX4toFJnIhflc039fN31lrrTaKKXUSrePanWoZnJI=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/denoland.vscode-deno/changelog";
@@ -2611,8 +2611,8 @@ let
         mktplcRef = {
           name = "language-julia";
           publisher = "julialang";
-          version = "1.171.2";
-          hash = "sha256-XELIrqcyd6DEpJjbSlE17noiYa8CZvDwnodA1QALewM=";
+          version = "1.174.2";
+          hash = "sha256-nlMuWnJOtUlCB9RGWUngB8KgIiNxoQTHkjI6ZtO/Gjs=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/julialang.language-julia/changelog";
@@ -4469,8 +4469,8 @@ let
         mktplcRef = {
           name = "vscode-stylelint";
           publisher = "stylelint";
-          version = "1.6.0";
-          hash = "sha256-t0zS4+UZePViqkGgVezy/2CyyqilUKb6byTYukbxqr8=";
+          version = "2.0.1";
+          hash = "sha256-TYUDm+i7Chuybbx91AUxH/oIyZYWpZ5XnYxjhjXGP88=";
         };
         meta = {
           description = "Official Stylelint extension for Visual Studio Code";

pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "sourcegraph";
     name = "amp";
-    version = "0.0.1768263519";
-    hash = "sha256-uOvvkzXvyHiJP3ZxHBJhXW/M8Ju1DjSXpwflAkKjgxs=";
+    version = "0.0.1768796962";
+    hash = "sha256-uZb5QI6JDv8FdLU0yZzFsJ43J0P0X5c16dl5Poa8n/w=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce-fast";
-  version = "0-unstable-2025-11-14";
+  version = "0-unstable-2026-01-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-fast-libretro";
-    rev = "7e9b257b8a591cb7e00f9e55371edba19db9799c";
-    hash = "sha256-LBx4bSnE3XeQw/Bc5EID8U6Dxj7uc6JBrV8vSwO/jEM=";
+    rev = "6d182b22f6b9430c76ea71579ffb2eee0e2e9521";
+    hash = "sha256-QHkG5CSZgaakblOgp5HxGvtWg8K4Nbag481nhG4UjoY=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/beetle-psx.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-01-12";
+  version = "0-unstable-2026-01-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "254285de247db71ac25a4392c159dc1114940794";
-    hash = "sha256-RDUyTGlrouttC9V4irOC8U1zcNsCxnTIdm6wrAECY2E=";
+    rev = "5965c585abcaf6b5205a1347de82471e22aaabe3";
+    hash = "sha256-Mks6xJre1gaxBqWfAzVTNp6Ooy5VDc86HAoj3wlHYRw=";
   };
 
   extraBuildInputs = lib.optionals withHw [

pkgs/applications/emulators/libretro/cores/bsnes.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "bsnes";
-  version = "0-unstable-2025-12-19";
+  version = "0-unstable-2026-01-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "bsnes-libretro";
-    rev = "d9b7c292cfb15959c9928e3b76bb1047b8499938";
-    hash = "sha256-FzYe6p3+knxcoIcQW00p3C3+rMEsAWI+ZFdy5mvDhoY=";
+    rev = "d0a61b2c679bc73286be5471b222b1f1ebfb67b9";
+    hash = "sha256-1C+c0cQqFSRDGBhNr4s4xD/THbyDP/iVUJpAmHFQfiE=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/fbneo.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fbneo";
-  version = "0-unstable-2026-01-11";
+  version = "0-unstable-2026-01-18";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fbneo";
-    rev = "aaecfedbb206a79d0e35a0dfe922622b921a66f7";
-    hash = "sha256-Xn3lxXFf7EEism9CIGYhvP83oCpOTrpgnBAwkkB4TDM=";
+    rev = "3faea4f9c678bad8063f3a2774b051f42848c856";
+    hash = "sha256-tH9XMBfg3O2oKIUeKWi2hl4yQuHa9BMgvkWjIxv/KIo=";
   };
 
   makefile = "Makefile";

pkgs/applications/networking/browsers/chromium/browser.nix

@@ -62,19 +62,20 @@ mkChromiumDerivation (base: rec {
       $out/share/applications/chromium-browser.desktop
 
     substituteInPlace $out/share/applications/chromium-browser.desktop \
-      --replace "@@MENUNAME@@" "Chromium" \
-      --replace "@@PACKAGE@@" "chromium" \
-      --replace "Exec=/usr/bin/@@USR_BIN_SYMLINK_NAME@@" "Exec=chromium"
-
-    # Append more mime types to the end
-    sed -i '/^MimeType=/ s,$,x-scheme-handler/webcal;x-scheme-handler/mailto;x-scheme-handler/about;x-scheme-handler/unknown,' \
-      $out/share/applications/chromium-browser.desktop
+      --replace-fail "@@MENUNAME@@" "Chromium" \
+      --replace-fail "@@PACKAGE@@" "chromium" \
+      --replace-fail "/usr/bin/@@USR_BIN_SYMLINK_NAME@@" "chromium" \
+      --replace-fail "@@URI_SCHEME@@" "x-scheme-handler/chromium;" \
+      --replace-fail "@@EXTRA_DESKTOP_ENTRIES@@" ""
 
     # See https://github.com/NixOS/nixpkgs/issues/12433
-    sed -i \
-      -e '/\[Desktop Entry\]/a\' \
-      -e 'StartupWMClass=chromium-browser' \
-      $out/share/applications/chromium-browser.desktop
+    substituteInPlace $out/share/applications/chromium-browser.desktop \
+      --replace-fail "[Desktop Entry]" "[Desktop Entry]''\nStartupWMClass=chromium-browser"
+
+    if grep -F '@@' $out/share/applications/chromium-browser.desktop ; then
+      echo "error: chromium-browser.desktop contains unsubstituted placeholders" >&2
+      exit 1
+    fi
   '';
 
   passthru = { inherit sandboxExecutableName; };

pkgs/applications/networking/cluster/rke2/1_35/images-versions.json

@@ -0,0 +1,138 @@
+{
+  "images-calico-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "d9184c1907c6a07328db80bc9787d9473874f99387997eb75712b3f109c28a95"
+  },
+  "images-calico-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "3b0fab246141f52418b0e8944ad0edac46e512ae837a6846d6685bd2ca934562"
+  },
+  "images-calico-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "9ffb3e4607f44d5dde2e5fd17e4c317fb2f232174cd9b4fc1b5979ec8f0f0fa8"
+  },
+  "images-calico-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "c1531be737cb6dc2819f35e8e63d095b05db9dcd0698416a60b786a9e3d69bbf"
+  },
+  "images-canal-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "dc6c2a3f22739fac02272372fc7eadb27809721ee921669203d46ec551fbb8a2"
+  },
+  "images-canal-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "sha256": "f039d8feabd264aa6a6d684560bd05e764e748292649736d436b28974b86668e"
+  },
+  "images-canal-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "6560ef5589c30afe63195d23a27ffcf4492a2e5135bb715c4c7818cd625a244e"
+  },
+  "images-canal-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "8085686ffb57b508198916cd8ebdaec2a90b1e2f1592caeb0c4a55ae1ab4d223"
+  },
+  "images-cilium-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "bf4fff99097f8bdf14d1ce51884e062140e311a08ad3661cd5455d966781d8ea"
+  },
+  "images-cilium-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "755338043246a0d167a16ff63ec53651ce9e837d39625d06bbbcd2c63004ec1c"
+  },
+  "images-cilium-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "f1b3dd87ee96aa022a73d535163bb066ae75b038188cd7937809e56d7896cd93"
+  },
+  "images-cilium-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "decc80c50fd887ec299ff9b5ec5e7853be71c49f337cd5bb806c377e9e6f75ce"
+  },
+  "images-core-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "0fcbac0cfe2b7df25a677686408da84f960f292573d29341779191a981a1cd58"
+  },
+  "images-core-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "4a715e8cc723a5b6b602b223c6609b1407ff837f6d31b203e23d2c53d9d7c85b"
+  },
+  "images-core-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "006b3603ca45d69897f47ac0e32b43eed3354a38fb3ed6d12b82f27c924f444d"
+  },
+  "images-core-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "f2ee745a844902404623a4e45f0ecbcb7753547e199c93f87b750a9c3b7d32ff"
+  },
+  "images-flannel-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "63751fc22b0e35c44224c0ff053d6606ec63b885d1f8bde659e931b3de17815e"
+  },
+  "images-flannel-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "sha256": "1107c8a8c5aa90d5a8351340ac0a54862bd720f265f1b48742d55289d20c299f"
+  },
+  "images-flannel-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "337cdc528527e804e82cccdca4eb9d8a211b79b2a7839f280f285db1eabce22f"
+  },
+  "images-flannel-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "bbb4c7627e3d449284f20d79cf8392686fca7066043777092a455fabbaaf9ad7"
+  },
+  "images-harvester-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "add464ba1af538d9ac0e4a5b739ede0ec5601e0fb380a07b6695d69fd95fa166"
+  },
+  "images-harvester-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "3623423261a3db1d58750d98cc71950f21ebdab355103eab192f60db90834f29"
+  },
+  "images-harvester-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "d593f160508714b5d2e4c194c354daf16064d36505ae8e75b86fa9e8eae1c8ab"
+  },
+  "images-harvester-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "2d0ad2cb9bf5c0e6497e4a1f7602b7868653b303c249f2034fd6b3b95e0db194"
+  },
+  "images-multus-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "2b4368fae7354431fbb66906a703f3c519bbcc71f46dd7e01d4874c911219990"
+  },
+  "images-multus-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "778b48e8e451f3440fb02dda27e87a3a1c2fc8b5e1ae1386398e30fb698fc808"
+  },
+  "images-multus-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "849f717627cc42919480bb35650e5e47c74fe39da40d1fe173f3b789abf5e3fc"
+  },
+  "images-multus-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "b570507f05e25379e0e3cd9f0bd9562d2fc87c8cba4eada865cfd22a94abab1b"
+  },
+  "images-traefik-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
+    "sha256": "d28e86d1aba3274a7ed13278d9852956f454c4bc1da30a1df9c0b1184aa41ed1"
+  },
+  "images-traefik-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
+    "sha256": "d7364c02738d90b1f9aaf48c5dfd17d0393333fe1a67002e522fe4cf429118e7"
+  },
+  "images-traefik-linux-arm64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
+    "sha256": "973358a62e4cbdd955097e9bdcbec7aacc439123486439aafcd1bb5af5828571"
+  },
+  "images-traefik-linux-arm64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
+    "sha256": "aaee9b9bf92cf42bbcb2862dd0bfaa217730ebfe69947926a6fd624b9ba19dcf"
+  },
+  "images-vsphere-linux-amd64-tar-gz": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "4eeb361e1946f56d6fa2dd0a0beee094d0818a4f4278b1531c3a481c349ac4a1"
+  },
+  "images-vsphere-linux-amd64-tar-zst": {
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.0%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "be8b6a4d3823c2e4f22df991236227415a771794e3631ce228f89f9f3363cdaf"
+  }
+}

pkgs/applications/networking/cluster/rke2/1_35/versions.nix

@@ -0,0 +1,13 @@
+{
+  rke2Version = "1.35.0+rke2r1";
+  rke2Commit = "233368982cc7242d3eb01e22112343839e8e8f2d";
+  rke2TarballHash = "sha256-spnfiv5butC6yh9h3uosS0M5jTbPAuy6N+jzdri9Ano=";
+  rke2VendorHash = "sha256-DSIhALF+Ic1zm52YntGoBbbJkeq0SX7QkpyOQ9z2+Qo=";
+  k8sImageTag = "v1.35.0-rke2r1-build20251218";
+  etcdVersion = "v3.6.6-k3s1-build20251210";
+  pauseVersion = "3.6";
+  ccmVersion = "v1.35.0-rc1.0.20251218152248-a6c6cd15c0c4-build20251219";
+  dockerizedVersion = "v1.35.0-rke2r1";
+  helmJobVersion = "v0.9.12-build20251215";
+  imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
+}

pkgs/applications/networking/cluster/rke2/default.nix

@@ -35,7 +35,17 @@ rec {
     }
   ) extraArgs;
 
+  rke2_1_35 = common (
+    (import ./1_35/versions.nix)
+    // {
+      updateScript = [
+        ./update-script.sh
+        "35"
+      ];
+    }
+  ) extraArgs;
+
   # Automatically set by update script
   rke2_stable = rke2_1_34;
-  rke2_latest = rke2_1_34;
+  rke2_latest = rke2_1_35;
 }

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -101,11 +101,11 @@
     "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
   },
   "baidubce_baiducloud": {
-    "hash": "sha256-BNpBNBxRSKgxwvgIY289MLUf0Eui5/ccY97sAouHjbc=",
+    "hash": "sha256-r5NPRWjjlLD5qrLmVPe3JFrRRp3mV0NJwT3rOo0k8FA=",
     "homepage": "https://registry.terraform.io/providers/baidubce/baiducloud",
     "owner": "baidubce",
     "repo": "terraform-provider-baiducloud",
-    "rev": "v1.22.16",
+    "rev": "v1.22.17",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1049,11 +1049,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-wHNR0U8z0wY878ww2e+yybYYwUCbiGWSkIcEiubfOp4=",
+    "hash": "sha256-VGf5sCHMhOFm+w3lz2yhH0lw0MSlQYlYK/+lEuXk4vc=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v7.29.0",
+    "rev": "v7.30.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/networking/gns3/gui.nix

@@ -39,21 +39,16 @@ pythonPackages.buildPythonApplication rec {
 
   propagatedBuildInputs = [ qt5.qtwayland ];
 
-  dependencies =
-    with pythonPackages;
-    [
-      distro
-      jsonschema
-      psutil
-      pyqt5
-      sentry-sdk
-      setuptools
-      sip
-      truststore
-    ]
-    ++ lib.optionals (pythonOlder "3.9") [
-      importlib-resources
-    ];
+  dependencies = with pythonPackages; [
+    distro
+    jsonschema
+    psutil
+    pyqt5
+    sentry-sdk
+    setuptools
+    sip
+    truststore
+  ];
 
   dontWrapQtApps = true;
 

pkgs/applications/networking/gns3/server.nix

@@ -35,28 +35,23 @@ python3Packages.buildPythonApplication {
 
   build-system = with python3Packages; [ setuptools ];
 
-  dependencies =
-    with python3Packages;
-    [
-      aiofiles
-      aiohttp
-      aiohttp-cors
-      async-generator
-      distro
-      jinja2
-      jsonschema
-      multidict
-      platformdirs
-      prompt-toolkit
-      psutil
-      py-cpuinfo
-      sentry-sdk
-      truststore
-      yarl
-    ]
-    ++ lib.optionals (pythonOlder "3.9") [
-      importlib-resources
-    ];
+  dependencies = with python3Packages; [
+    aiofiles
+    aiohttp
+    aiohttp-cors
+    async-generator
+    distro
+    jinja2
+    jsonschema
+    multidict
+    platformdirs
+    prompt-toolkit
+    psutil
+    py-cpuinfo
+    sentry-sdk
+    truststore
+    yarl
+  ];
 
   postInstall = lib.optionalString (!stdenv.hostPlatform.isWindows) ''
     rm $out/bin/gns3loopback

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -100,8 +100,8 @@ rec {
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "140.6.0esr";
-    sha512 = "817a807381fa0b5e5e2c3f961931855788649ed596b1c6773ec5b0d6715e90df137ab0f755408a9137b5573169c2e2040bf6a01c4ecdb9a8b010e6c43dbb6381";
+    version = "140.7.0esr";
+    sha512 = "92746d87ca2d5a59082c25aa3c3a816e5bf24ae3e095f8ec478a60c5cd890faea392ff98b5b510cc9a89b155240dce9d06c7ddd0f17f564722acc65105fb6cd2";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-140";

pkgs/applications/radio/rtl-sdr/default.nix

@@ -17,10 +17,17 @@ let
     }:
     stdenv.mkDerivation {
       inherit version pname src;
+
+      outputs = [
+        "out"
+        "dev"
+      ];
+
       nativeBuildInputs = [
         pkg-config
         cmake
       ];
+
       propagatedBuildInputs = [ libusb1 ];
 
       cmakeFlags = lib.optionals stdenv.hostPlatform.isLinux [

pkgs/applications/system/glances/default.nix

@@ -3,7 +3,6 @@
   buildPythonApplication,
   fetchFromGitHub,
   isPyPy,
-  pythonOlder,
   lib,
   defusedxml,
   packaging,
@@ -31,7 +30,7 @@ buildPythonApplication rec {
   version = "4.3.3";
   pyproject = true;
 
-  disabled = isPyPy || pythonOlder "3.9";
+  disabled = isPyPy;
 
   src = fetchFromGitHub {
     owner = "nicolargo";

pkgs/build-support/appimage/appimage-exec.sh

@@ -74,6 +74,10 @@ apprun() {
   else echo "$(basename "$APPIMAGE")" installed in "$APPDIR"
   fi
 
+  # Fix potential for the appimages to try to import libraries from QT
+  # installed on the system, causing a version mismatch
+  unset QT_PLUGIN_PATH
+
   export PATH="$PATH:$PWD/usr/bin"
 }
 

pkgs/build-support/buildenv/default.nix

@@ -17,7 +17,11 @@ in
 
 lib.makeOverridable (
   {
-    name,
+    name ? lib.throwIf (
+      pname == null || version == null
+    ) "buildEnv: expect arguments 'pname' and 'version' or 'name'" "${pname}-${version}",
+    pname ? null,
+    version ? null,
 
     # The manifest file (if any).  A symlink $out/manifest will be
     # created to it.
@@ -60,8 +64,6 @@ lib.makeOverridable (
 
     passthru ? { },
     meta ? { },
-    pname ? null,
-    version ? null,
   }:
   let
     chosenOutputs = map (drv: {

pkgs/by-name/_0/_0xproto/package.nix

@@ -6,7 +6,7 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "0xproto";
-  version = "2.501";
+  version = "2.502";
 
   src =
     let
@@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation rec {
     in
     fetchzip {
       url = "https://github.com/0xType/0xProto/releases/download/${version}/0xProto_${underscoreVersion}.zip";
-      hash = "sha256-l1+fRPMo3k9EEGXiMw+8Z78KxjO3AGgvyqSfsN188vQ=";
+      hash = "sha256-ffYvfEGMoIJKVEcs2XzhDrq++SkTbQOVvb6X9q+uyu8=";
       stripRoot = false;
     };
 

pkgs/by-name/am/amazon-ecs-cli/package.nix

@@ -1,46 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "amazon-ecs-cli";
-  version = "1.21.0";
-
-  src =
-    if stdenv.hostPlatform.system == "x86_64-linux" then
-      fetchurl {
-        url = "https://s3.amazonaws.com/amazon-ecs-cli/ecs-cli-linux-amd64-v${version}";
-        sha256 = "sEHwhirU2EYwtBRegiIvN4yr7VKtmy7e6xx5gZOkuY0=";
-      }
-    else if stdenv.hostPlatform.system == "x86_64-darwin" then
-      fetchurl {
-        url = "https://s3.amazonaws.com/amazon-ecs-cli/ecs-cli-darwin-amd64-v${version}";
-        sha256 = "1viala49sifpcmgn3jw24h5bkrlm4ffadjiqagbxj3lr0r78i9nm";
-      }
-    else
-      throw "Architecture not supported";
-
-  dontUnpack = true;
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp $src $out/bin/ecs-cli
-    chmod +x $out/bin/ecs-cli
-  ''; # */
-
-  meta = {
-    homepage = "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_CLI.html";
-    description = "Amazon ECS command line interface";
-    longDescription = "The Amazon Elastic Container Service (Amazon ECS) command line interface (CLI) provides high-level commands to simplify creating, updating, and monitoring clusters and tasks from a local development environment.";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ Scriptkiddi ];
-    platforms = [
-      "x86_64-linux"
-      "x86_64-darwin"
-    ];
-    mainProgram = "ecs-cli";
-  };
-}

pkgs/by-name/am/amp-cli/package-lock.json

@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "dependencies": {
-        "@sourcegraph/amp": "^0.0.1768219292-g8af118"
+        "@sourcegraph/amp": "^0.0.1768760544-gf06f5a"
       }
     },
     "node_modules/@napi-rs/keyring": {
@@ -228,9 +228,9 @@
       }
     },
     "node_modules/@sourcegraph/amp": {
-      "version": "0.0.1768219292-g8af118",
-      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1768219292-g8af118.tgz",
-      "integrity": "sha512-GW5MyNOiTu4G4cY29UI/0ttXu4b2QRwjmz4I9pvZqvIFrMmotBKC4wQinj8Dt6jD0ey7284Rhm8xHJ1iRtMoxA==",
+      "version": "0.0.1768760544-gf06f5a",
+      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1768760544-gf06f5a.tgz",
+      "integrity": "sha512-ECw/n1n3aKERHW8qo5KaFgKgLDj4zJElFsyHnAS10BRv3ON0T6BPbboMvqvtYq1NEeX00QGpBDO2u0Q1+k3oGQ==",
       "license": "Amp Commercial License",
       "dependencies": {
         "@napi-rs/keyring": "1.1.9"

pkgs/by-name/am/amp-cli/package.nix

@@ -9,11 +9,11 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1768219292-g8af118";
+  version = "0.0.1768760544-gf06f5a";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@sourcegraph/amp/-/amp-${finalAttrs.version}.tgz";
-    hash = "sha256-DstiWCfox5CuHKfy3EgLk7N8KK67txuMG/flriiDH3I=";
+    hash = "sha256-URgYg3SZXeHrw+xXiXC1BDe0/ZUFRu9mDmqtTIA9ObU=";
   };
 
   postPatch = ''
@@ -45,7 +45,7 @@ buildNpmPackage (finalAttrs: {
     chmod +x bin/amp-wrapper.js
   '';
 
-  npmDepsHash = "sha256-oB8YPiKoCG6+oNGlE6YdZ6F/6FEq96qJq/tdC164nrM=";
+  npmDepsHash = "sha256-7r522RT+38rjv1YqjhR9XIhWYoxVHmRUKeYfToCbsHA=";
 
   propagatedBuildInputs = [
     ripgrep

pkgs/by-name/an/ansel/package.nix

@@ -82,13 +82,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "ansel";
-  version = "0-unstable-2026-01-09";
+  version = "0-unstable-2026-01-17";
 
   src = fetchFromGitHub {
     owner = "aurelienpierreeng";
     repo = "ansel";
-    rev = "1d3af0ff6899a96a4fb916806696e563c1accb80";
-    hash = "sha256-XLKuQPCXAsH1qpC8Sw6AFSwXhl10pD0X1PSaRIhrnzs=";
+    rev = "0a6a812ce35f50ff4e2bf6302f1fb1c9d24a6f19";
+    hash = "sha256-1tvh8ZbEUPRufFN0KHbPDqy7DEod9LRRI0XpxKJDZmU=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ar/argo-workflows/package.nix

@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "argoproj";
-    repo = "argo";
+    repo = "argo-workflows";
     tag = "v${version}";
     hash = "sha256-TM/eK8biMxKV4SFJ1Lys+NPPeaHVjbBo83k2RH1Xi40=";
   };
@@ -55,7 +55,7 @@ buildGoModule rec {
   meta = {
     description = "Container native workflow engine for Kubernetes";
     mainProgram = "argo";
-    homepage = "https://github.com/argoproj/argo";
+    homepage = "https://github.com/argoproj/argo-workflows";
     changelog = "https://github.com/argoproj/argo-workflows/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ groodt ];

pkgs/by-name/as/astroterm/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "astroterm";
-  version = "1.0.9";
+  version = "1.0.10";
 
   src = fetchFromGitHub {
     owner = "da-luce";
     repo = "astroterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3UXFB4NNKn2w1dYlQzhFyxWwa7/1qkCXPNdBqHK+eQ8=";
+    hash = "sha256-z9KblIAoXk///NnRFHCSAFNDuNiPxDuuiliajcsyJM0=";
   };
 
   bsc5File = fetchurl {

pkgs/by-name/au/automatic-timezoned/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "automatic-timezoned";
-  version = "2.0.106";
+  version = "2.0.108";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = "automatic-timezoned";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-djvRfp1LhkHuDmjDuOErzcD9KXH6fiRrUR73ncldzUc=";
+    sha256 = "sha256-aizxFWQpiwEo197Oydez2nAChQQ32jPqOEW3wNLnb7c=";
   };
 
-  cargoHash = "sha256-T8PY/mFvcdXPZeQKEUekBan+0qBQnmsZ5O96EYcxkcI=";
+  cargoHash = "sha256-gT1pHDYwqVeZ0epGX8v3+B4o6y8jO21rUyz1rLD3eCY=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 

pkgs/by-name/aw/aws-shell/package.nix

@@ -1,59 +0,0 @@
-{
-  python3Packages,
-  lib,
-  fetchFromGitHub,
-  fetchPypi,
-  awscli,
-  writableTmpDirAsHomeHook,
-}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "aws-shell";
-  version = "0.2.2";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "awslabs";
-    repo = "aws-shell";
-    tag = version;
-    hash = "sha256-m96XaaFDFQaD2YPjw8D1sGJ5lex4Is4LQ5RhGzVPvH4=";
-  };
-
-  build-system = with python3Packages; [
-    setuptools
-  ];
-
-  dependencies = with python3Packages; [
-    botocore
-    pygments
-    mock
-    configobj
-    awscli
-    (prompt-toolkit.overrideAttrs (old: {
-      src = fetchPypi {
-        pname = "prompt_toolkit";
-        version = "1.0.18";
-        hash = "sha256-3U/KAsgGlJetkxotCZFMaw0bUBUc6Ha8Fb3kx0cJASY=";
-      };
-      postPatch = null;
-      propagatedBuildInputs = old.propagatedBuildInputs ++ [
-        wcwidth
-        six
-      ];
-    }))
-  ];
-
-  nativeCheckInputs = with python3Packages; [
-    pytestCheckHook
-    writableTmpDirAsHomeHook
-  ];
-
-  meta = {
-    homepage = "https://github.com/awslabs/aws-shell";
-    description = "Integrated shell for working with the AWS CLI";
-    platforms = lib.platforms.unix;
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ bot-wxt1221 ];
-    mainProgram = "aws-shell";
-  };
-}

pkgs/by-name/aw/aws_mturk_clt/package.nix

@@ -1,52 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  jre,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "aws-mturk-clt";
-  version = "1.3.0";
-
-  src = fetchurl {
-    url = "https://mturk.s3.amazonaws.com/CLTSource/aws-mturk-clt-${version}.tar.gz";
-    sha256 = "00yyc7k3iygg83cknv9i2dsaxwpwzdkc8a2l9j56lg999hw3mqm3";
-  };
-
-  installPhase = ''
-    mkdir -p $out
-    cp -prvd bin $out/
-
-    for i in $out/bin/*.sh; do
-      sed -i "$i" -e "s|^MTURK_CMD_HOME=.*|MTURK_CMD_HOME=$out\nexport JAVA_HOME=${jre}|"
-    done
-
-    mkdir -p $out/lib
-    cp -prvd lib/* $out/lib/
-  ''; # */
-
-  meta = {
-    homepage = "https://requester.mturk.com/developer";
-    description = "Command line tools for interacting with the Amazon Mechanical Turk";
-    license = lib.licenses.amazonsl;
-
-    longDescription = ''
-      The Amazon Mechanical Turk is a crowdsourcing marketplace that
-      allows users (“requesters”) to submit tasks to be performed by
-      other humans (“workers”) for a small fee.  This package
-      contains command-line tools for submitting tasks, querying
-      results, and so on.
-
-      The command-line tools expect a file
-      <filename>mturk.properties<filename> in the current directory,
-      which should contain the following:
-
-      <screen>
-      access_key=[insert your access key here]
-      secret_key=[insert your secret key here]
-      service_url=http://mechanicalturk.amazonaws.com/?Service=AWSMechanicalTurkRequester
-      </screen>
-    '';
-  };
-}

pkgs/by-name/aw/awscli2/package.nix

@@ -18,11 +18,7 @@ let
   py = python3 // {
     pkgs = python3.pkgs.overrideScope (
       final: prev: {
-        sphinx = prev.sphinx.overridePythonAttrs (prev: {
-          disabledTests = prev.disabledTests ++ [
-            "test_check_link_response_only" # fails on hydra https://hydra.nixos.org/build/242624087/nixlog/1
-          ];
-        });
+        # https://github.com/NixOS/nixpkgs/issues/449266
         prompt-toolkit = prev.prompt-toolkit.overridePythonAttrs (prev: rec {
           version = "3.0.51";
           src = prev.src.override {
@@ -30,6 +26,9 @@ let
             hash = "sha256-pNYmjAgnP9nK40VS/qvPR3g+809Yra2ISASWJDdQKrU=";
           };
         });
+
+        # backends/build_system/utils.py cannot parse PEP 440 version
+        # for python-dateutil 2.9.0.post0 (eg. post0)
         python-dateutil = prev.python-dateutil.overridePythonAttrs (prev: rec {
           version = "2.8.2";
           format = "setuptools";
@@ -48,24 +47,6 @@ let
           ];
           postPatch = null;
         });
-        ruamel-yaml = prev.ruamel-yaml.overridePythonAttrs (prev: rec {
-          version = "0.17.21";
-          src = prev.src.override {
-            inherit version;
-            hash = "sha256-i3zml6LyEnUqNcGsQURx3BbEJMlXO+SSa1b/P10jt68=";
-          };
-        });
-        urllib3 = prev.urllib3.overridePythonAttrs (prev: rec {
-          version = "1.26.18";
-          build-system = with final; [
-            setuptools
-          ];
-          postPatch = null;
-          src = prev.src.override {
-            inherit version;
-            hash = "sha256-+OzBu6VmdBNFfFKauVW/jGe0XbeZ0VkGYmFxnjKFgKA=";
-          };
-        });
       }
     );
   };
@@ -73,14 +54,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.32.15"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.33.2"; # N.B: if you change this, check if overrides are still up-to-date
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     tag = version;
-    hash = "sha256-TOXoArw33exbMfKBnNSECymYS8hVzPoVOA7PWzbnroc=";
+    hash = "sha256-dAtcYDdrZASrwBjQfnZ4DUR4F5WhY59/UX92QcILavs=";
   };
 
   postPatch = ''
@@ -90,7 +71,8 @@ py.pkgs.buildPythonApplication rec {
       --replace-fail 'distro>=1.5.0,<1.9.0' 'distro>=1.5.0' \
       --replace-fail 'docutils>=0.10,<0.20' 'docutils>=0.10' \
       --replace-fail 'prompt-toolkit>=3.0.24,<3.0.52' 'prompt-toolkit>=3.0.24' \
-      --replace-fail 'ruamel.yaml.clib>=0.2.0,<=0.2.12' 'ruamel.yaml.clib>=0.2.0' \
+      --replace-fail 'ruamel.yaml>=0.15.0,<=0.17.21' 'ruamel.yaml>=0.15.0' \
+      --replace-fail 'ruamel.yaml.clib>=0.2.0,<=0.2.12' 'ruamel.yaml.clib>=0.2.0'
 
     substituteInPlace requirements-base.txt \
       --replace-fail "wheel==0.43.0" "wheel>=0.43.0"
@@ -180,6 +162,9 @@ py.pkgs.buildPythonApplication rec {
     # Requires networking (socket binding not possible in sandbox)
     "test_is_socket"
     "test_is_special_file_warning"
+
+    # Disable slow tests
+    "test_details_disabled_for_choice_wo_details"
   ];
 
   pythonImportsCheck = [

pkgs/by-name/bi/bitrise/package.nix

@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "bitrise";
-  version = "2.36.1";
+  version = "2.36.3";
 
   src = fetchFromGitHub {
     owner = "bitrise-io";
     repo = "bitrise";
     rev = "v${version}";
-    hash = "sha256-U5885dS5C+AOF7DbiALy42rVcvr+2T3yE6E1mXrC49Y=";
+    hash = "sha256-0OwPRRr46JfAAjWyeP3n7pDaFN09U31Tq6cwGE7uKHI=";
   };
 
   # many tests rely on writable $HOME/.bitrise and require network access

pkgs/by-name/bi/biwascheme/package.nix

@@ -0,0 +1,43 @@
+{
+  buildNpmPackage,
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "biwascheme";
+  version = "0.8.3";
+
+  src = fetchFromGitHub {
+    owner = "biwascheme";
+    repo = "biwascheme";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-X3spl/myhcfmnJ1pN7RAoR0rc4kEM9s0DLtrN9RqyhU=";
+  };
+
+  npmDepsHash = "sha256-jVLCR6gIgK5OhH/KQPn3lYdTuNpMAEAQS1EtqIq8jTM=";
+
+  postPatch = ''
+    substituteInPlace rollup.config.js \
+      --replace-fail "git rev-parse HEAD" "echo ${finalAttrs.version}"
+  '';
+
+  env.PUPPETEER_SKIP_DOWNLOAD = true;
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Scheme interpreter written in JavaScript";
+    homepage = "https://github.com/biwascheme/biwascheme";
+    changelog = "https://github.com/biwascheme/biwascheme/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ yiyu ];
+    mainProgram = "biwas";
+  };
+})

pkgs/by-name/bl/bluesky-pds/package.nix

@@ -27,13 +27,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pds";
-  version = "0.4.193";
+  version = "0.4.204";
 
   src = fetchFromGitHub {
     owner = "bluesky-social";
     repo = "pds";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OCG1YR56k0syIxRVrwUr0teaBJFQXocq0H6j9JaQkh8=";
+    hash = "sha256-jYCMwHKKFIsfOgGYiKVrWtIT7atPA8NsetvfjDW05yE=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/service";
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_9;
     fetcherVersion = 2;
-    hash = "sha256-4qKWkINpUHzatiMa7ZNYp1NauU2641W0jHDjmRL9ipI=";
+    hash = "sha256-G6xZfbfz+jud1N6lxwp5FA5baAkFwmofejsPt/Gaze8=";
   };
 
   buildPhase = ''

pkgs/by-name/bo/boxflat/package.nix

@@ -14,14 +14,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "boxflat";
-  version = "1.35.3";
+  version = "1.35.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lawstorant";
     repo = "boxflat";
     tag = "v${version}";
-    hash = "sha256-ayreXC73OLNpnwNuJe0ImC/ch5W+O0lnkuD31ztTqso=";
+    hash = "sha256-R03mQIsa6T1ApV8SMWvilBfiCGcAWvyZ5hDDgAuGd6s=";
   };
 
   build-system = [ python3Packages.setuptools ];

pkgs/by-name/br/brainflow/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "brainflow";
-  version = "5.19.0";
+  version = "5.20.0";
 
   src = fetchFromGitHub {
     owner = "brainflow-dev";
     repo = "brainflow";
     tag = finalAttrs.version;
-    hash = "sha256-XoTd7pEsY2RuMQFj5zo9NhlYgiG0J0aEMdKuxtDuaFg=";
+    hash = "sha256-qxITJjO6Rf9cx4XWRguOlohud8gnMSQDb/qgwv3wA+8=";
   };
 
   patches = [ ];

pkgs/by-name/ca/canaille/package.nix

@@ -15,8 +15,6 @@ python.pkgs.buildPythonApplication rec {
   version = "0.0.74";
   pyproject = true;
 
-  disabled = python.pythonOlder "3.10";
-
   src = fetchFromGitLab {
     owner = "yaal";
     repo = "canaille";

pkgs/by-name/ca/candy-icons/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "candy-icons";
-  version = "0-unstable-2025-12-26";
+  version = "0-unstable-2026-01-13";
 
   src = fetchFromGitHub {
     owner = "EliverLara";
     repo = "candy-icons";
-    rev = "1ec7ed314104847d6bffdc89ef67663917a67268";
-    hash = "sha256-p8WZTNHwYTom0QnWvOU0JLRbEYZlGQq/QPpK3KlwBH8=";
+    rev = "42f5c4817f47e2ef4b011080ebbb2f50a9a6955b";
+    hash = "sha256-d7jxoqWPRlNX43CdIEihT6kxvke3k8GG9CJkmlkuRNw=";
   };
 
   nativeBuildInputs = [ gtk3 ];

pkgs/by-name/ca/carapace-bridge/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "carapace-bridge";
-  version = "1.4.10";
+  version = "1.4.11";
 
   src = fetchFromGitHub {
     owner = "carapace-sh";
     repo = "carapace-bridge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6CCLSwbAYkMelaM5ac1I1kwOlWKPSOU9M9/2Dybt55I=";
+    hash = "sha256-npy20q8Fmi4KKN/q41iG6sWmuQVLhiHyUCGVUwS0FsA=";
   };
 
   # buildGoModule tries to run `go mod vendor` instead of `go work vendor` on

pkgs/by-name/ca/cargo-binstall/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-binstall";
-  version = "1.16.6";
+  version = "1.16.7";
 
   src = fetchFromGitHub {
     owner = "cargo-bins";
     repo = "cargo-binstall";
     tag = "v${version}";
-    hash = "sha256-6acLC+ufODhCvHn7g+yzaN+qnTDjUrCBIX8uOj0PPgg=";
+    hash = "sha256-0r7QEGwuIh2mquKFqcf3VjvilhVz25Xpr2rJPQp504E=";
   };
 
-  cargoHash = "sha256-IPDhTbYRtL4nBdNgaQfZ2M+RwZYC5eJfs/+VNlOXodo=";
+  cargoHash = "sha256-ZJCIjQm/vbO1Voji143HXT3BwlXRtFq4rFNRUguwouA=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ca/cargo-xwin/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-xwin";
-  version = "0.20.2";
+  version = "0.21.2";
 
   src = fetchFromGitHub {
     owner = "rust-cross";
     repo = "cargo-xwin";
     rev = "v${version}";
-    hash = "sha256-M7OO2yO5BvNTqJLI50g25M5aupdOxmlZ3eealmP51Kc=";
+    hash = "sha256-GQV8Sy7BCkPGYusojZGQtaazTXONdJIZ4B4toO1Lj/w=";
   };
 
-  cargoHash = "sha256-DwQGmdSzEjzqfsvqczAMJfi9gJjK2b9FAGmMi7rGKuw=";
+  cargoHash = "sha256-fVr5W5xpucqUyKpDcubAh6GkB0roJ548EHgaIzqVJl0=";
 
   meta = {
     description = "Cross compile Cargo project to Windows MSVC target with ease";

pkgs/by-name/ce/ceph/old-python-packages/cryptography.nix

@@ -11,16 +11,13 @@
   rustc,
   setuptools-rust,
   openssl,
-  Security ? null,
   isPyPy,
   cffi,
   pkg-config,
   pytestCheckHook,
   pytest-subtests,
-  pythonOlder,
   pretend,
   libiconv,
-  libxcrypt,
   iso8601,
   py,
   pytz,
@@ -90,8 +87,7 @@ buildPythonPackage rec {
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
-  ]
-  ++ lib.optionals (pythonOlder "3.9") [ libxcrypt ];
+  ];
 
   propagatedBuildInputs = lib.optionals (!isPyPy) [ cffi ];
 

pkgs/by-name/cg/cgt-calc/package.nix

@@ -1,22 +1,35 @@
 {
   lib,
   fetchFromGitHub,
+  fetchpatch,
   python3Packages,
   withTeXLive ? true,
   texliveSmall,
 }:
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "cgt-calc";
-  version = "1.13.0";
+  version = "1.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "KapJI";
     repo = "capital-gains-calculator";
-    rev = "v${version}";
-    hash = "sha256-y/Y05wG89nccXyxfjqazyPJhd8dOkfwRJre+Rzx97Hw=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-6iOlDNlpfCrbRCxEJsRYw6zqOehv/buVN+iU6J6CtIk=";
   };
 
+  patches = [
+    # https://github.com/KapJI/capital-gains-calculator/pull/715
+    (fetchpatch {
+      url = "https://github.com/KapJI/capital-gains-calculator/commit/ec7155c1256b876d5906a3885656489e9fdd798c.patch";
+      hash = "sha256-pfGHSKuDRF0T1hP7kpRC285limd1voqLXcXCP7mAD3s=";
+    })
+  ];
+
+  pythonRelaxDeps = [
+    "defusedxml"
+  ];
+
   build-system = with python3Packages; [
     poetry-core
   ];
@@ -26,6 +39,7 @@ python3Packages.buildPythonApplication rec {
     jinja2
     pandas
     requests
+    pyrate-limiter
     types-requests
     yfinance
   ];
@@ -45,4 +59,4 @@ python3Packages.buildPythonApplication rec {
     maintainers = with lib.maintainers; [ ambroisie ];
     platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/ch/chatbox/package.nix

@@ -6,11 +6,11 @@
 }:
 let
   pname = "chatbox";
-  version = "1.18.2";
+  version = "1.18.4";
 
   src = fetchurl {
     url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-5SDoObRi+Zwq4ZvnPz1dYvjhU5oLHbbAG4X4E8KfFbA=";
+    hash = "sha256-6BUvwL87ndtI2lFMcNKxpdOpn+EyUhAK9jc+a/zpjpU=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };

pkgs/by-name/ch/chirp/package.nix

@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "chirp";
-  version = "0.4.0-unstable-2026-01-12";
+  version = "0.4.0-unstable-2026-01-17";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "e6100c8a3d4769848db16b9557c585bf9ff5c58c";
-    hash = "sha256-DpM8agWg0D4PJN7yR2frPCF7nnDt6ksv9PtQwqOJSos=";
+    rev = "a98aca98ea0aaf8aec1f13b088eaff6bd1ea5632";
+    hash = "sha256-IjsdKKevGgn0ZyxjlxRPhdnApR8/O3tDdIjQS61aM/s=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cl/clash-rs/package.nix

@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "clash-rs";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "Watfaq";
     repo = "clash-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MVj+GcSt0Q9bWLz7MpCIj9MtnHh/GRB3p+DapMPLxeY=";
+    hash = "sha256-WtNnBw0/eAz/uO/dlD2yRZHW38CXIT8zhh4lZ3HaIFs=";
   };
 
-  cargoHash = "sha256-Ikur9G6oSdKbK7gdZozBkplUjPfSjIABTVHjX7UPPvc=";
+  cargoHash = "sha256-8SLBsYtO6qVihc/C9R3ZptHCKgl2iXiQrOWqgDBXdTc=";
 
   cargoPatches = [ ./Cargo.patch ];
 

pkgs/by-name/cl/cloudflare-warp/package.nix

@@ -20,19 +20,29 @@
   jq,
   ripgrep,
   common-updater-scripts,
+  xar,
+  cpio,
   headless ? false,
 }:
 
 let
-  version = "2025.9.558";
+  version = "2025.10.186.0";
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://pkg.cloudflareclient.com/pool/noble/main/c/cloudflare-warp/cloudflare-warp_${version}.0_amd64.deb";
-      hash = "sha256-eYPy8YnP/vvYmvvjvF6Y0gSzdglsvoPW6CJ5npjrtpo=";
+      url = "https://pkg.cloudflareclient.com/pool/noble/main/c/cloudflare-warp/cloudflare-warp_${version}_amd64.deb";
+      hash = "sha256-l+csDSBXRAFb2075ciCAlE0bS5F48mAIK/Bv1r3Q8GE=";
     };
     aarch64-linux = fetchurl {
-      url = "https://pkg.cloudflareclient.com/pool/noble/main/c/cloudflare-warp/cloudflare-warp_${version}.0_arm64.deb";
-      hash = "sha256-K8XENo+9n3ChmQ33wAg/KiVHjNOKOXp6UQM2fpntgkE=";
+      url = "https://pkg.cloudflareclient.com/pool/noble/main/c/cloudflare-warp/cloudflare-warp_${version}_arm64.deb";
+      hash = "sha256-S6CfWYzcv+1Djj+TX+lrP5eG7oIpM0JrqtSw/UDD9ko=";
+    };
+    x86_64-darwin = fetchurl {
+      url = "https://downloads.cloudflareclient.com/v1/download/macos/version/${version}";
+      hash = "sha256-nnoOXPSpOJRyNdCC0/YAoBK8SwB+++qVwgZplrjNi2U=";
+    };
+    aarch64-darwin = fetchurl {
+      url = "https://downloads.cloudflareclient.com/v1/download/macos/version/${version}";
+      hash = "sha256-nnoOXPSpOJRyNdCC0/YAoBK8SwB+++qVwgZplrjNi2U=";
     };
   };
 in
@@ -46,26 +56,34 @@ stdenv.mkDerivation (finalAttrs: {
       or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   nativeBuildInputs = [
+    makeWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    xar
+    cpio
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     dpkg
     autoPatchelfHook
     versionCheckHook
-    makeWrapper
   ]
-  ++ lib.optionals (!headless) [
+  ++ lib.optionals (!headless && stdenv.hostPlatform.isLinux) [
     copyDesktopItems
     desktop-file-utils
   ];
 
-  buildInputs = [
-    dbus
-    libpcap
-    openssl
-    nss
-    (lib.getLib stdenv.cc.cc)
-  ]
-  ++ lib.optionals (!headless) [
-    gtk3
-  ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux (
+    [
+      dbus
+      libpcap
+      openssl
+      nss
+      (lib.getLib stdenv.cc.cc)
+    ]
+    ++ lib.optionals (!headless) [
+      gtk3
+    ]
+  );
 
   desktopItems = lib.optionals (!headless) [
     (makeDesktopItem {
@@ -88,48 +106,78 @@ stdenv.mkDerivation (finalAttrs: {
     "libpcap.so.0.8"
   ];
 
-  installPhase = ''
-    runHook preInstall
+  unpackPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    runHook preUnpack
 
-    mv usr $out
-    mv bin $out
-    mv etc $out
-    patchelf --replace-needed libpcap.so.0.8 ${libpcap}/lib/libpcap.so $out/bin/warp-dex
-    mv lib/systemd/system $out/lib/systemd/
-    substituteInPlace $out/lib/systemd/system/warp-svc.service \
-      --replace-fail "ExecStart=" "ExecStart=$out"
-    ${lib.optionalString (!headless) ''
-      substituteInPlace $out/lib/systemd/user/warp-taskbar.service \
-        --replace-fail "ExecStart=" "ExecStart=$out" \
-        --replace-fail "BindsTo=" "PartOf="
+    xar -xf $src
+    zcat < Cloudflare_WARP_${version}.pkg/Payload | cpio -i
 
-      cat >>$out/lib/systemd/user/warp-taskbar.service <<EOF
-
-      [Service]
-      BindReadOnlyPaths=$out:/usr:
-      EOF
-    ''}
-    ${lib.optionalString headless ''
-      # For headless version, remove GUI components
-      rm $out/bin/warp-taskbar
-      rm -r $out/lib/systemd/user
-      rm -r $out/etc
-      rm -r $out/share/applications
-      rm -r $out/share/icons
-      rm -r $out/share/warp
-    ''}
-
-    runHook postInstall
+    runHook postUnpack
   '';
 
-  postInstall = ''
+  installPhase =
+    if stdenv.hostPlatform.isDarwin then
+      ''
+        runHook preInstall
+
+        mkdir -p $out/Applications $out/bin
+
+        cp -R "Cloudflare WARP.app" $out/Applications/
+
+        for tool in warp-cli warp-dex warp-diag; do
+          ln -s "$out/Applications/Cloudflare WARP.app/Contents/Resources/$tool" "$out/bin/$tool"
+        done
+
+        runHook postInstall
+      ''
+    else
+      ''
+        runHook preInstall
+
+        mv usr $out
+        mv bin $out
+        mv etc $out
+        patchelf --replace-needed libpcap.so.0.8 ${libpcap}/lib/libpcap.so $out/bin/warp-dex
+        mv lib/systemd/system $out/lib/systemd/
+        substituteInPlace $out/lib/systemd/system/warp-svc.service \
+          --replace-fail "ExecStart=" "ExecStart=$out"
+        ${lib.optionalString (!headless) ''
+          substituteInPlace $out/lib/systemd/user/warp-taskbar.service \
+            --replace-fail "ExecStart=" "ExecStart=$out" \
+            --replace-fail "BindsTo=" "PartOf="
+
+          cat >>$out/lib/systemd/user/warp-taskbar.service <<EOF
+
+          [Service]
+          BindReadOnlyPaths=$out:/usr:
+          EOF
+        ''}
+        ${lib.optionalString headless ''
+          # For headless version, remove GUI components
+          rm $out/bin/warp-taskbar
+          rm -r $out/lib/systemd/user
+          rm -r $out/etc
+          rm -r $out/share/applications
+          rm -r $out/share/icons
+          rm -r $out/share/warp
+        ''}
+
+        runHook postInstall
+      '';
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
     wrapProgram $out/bin/warp-svc --prefix PATH : ${lib.makeBinPath [ nftables ]}
     ${lib.optionalString (!headless) ''
       wrapProgram $out/bin/warp-cli --prefix PATH : ${lib.makeBinPath [ desktop-file-utils ]}
     ''}
   '';
 
-  doInstallCheck = true;
+  doInstallCheck = stdenv.hostPlatform.isLinux;
+
+  # The Sparkle.framework in the upstream macOS package contains a broken symlink
+  # (XPCServices -> Versions/Current/XPCServices) where the target doesn't exist.
+  # This is present in the official installed app and doesn't affect functionality.
+  dontCheckForBrokenSymlinks = stdenv.hostPlatform.isDarwin;
 
   passthru = {
     inherit sources;
@@ -150,8 +198,8 @@ stdenv.mkDerivation (finalAttrs: {
             -H 'Accept: application/vnd.github+json' \
             -H 'X-GitHub-Api-Version: 2022-11-28' \
             'https://api.github.com/repos/cloudflare/cloudflare-docs/git/trees/production?recursive=true' |
-            jq 'last(.tree.[] | select(.path | startswith("src/content/warp-releases/linux/ga/"))).path' |
-            rg '([^/]+)\.0\.yaml\b' --only-matching --replace '$1'
+            jq -r '[.tree[].path | select(startswith("src/content/warp-releases/linux/ga/"))] | max_by(split("/")[-1] | split(".") | map(tonumber?))' |
+            rg '([^/]+)\.yaml\b' --only-matching --replace '$1'
         )"
 
         for platform in ${lib.escapeShellArgs finalAttrs.meta.platforms}; do
@@ -162,7 +210,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
-    changelog = "https://github.com/cloudflare/cloudflare-docs/blob/production/src/content/warp-releases/linux/ga/${finalAttrs.version}.0.yaml";
+    changelog = "https://github.com/cloudflare/cloudflare-docs/blob/production/src/content/warp-releases/linux/ga/${finalAttrs.version}.yaml";
     description =
       "Replaces the connection between your device and the Internet with a modern, optimized, protocol"
       + lib.optionalString headless " (headless version)";
@@ -172,10 +220,13 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "warp-cli";
     maintainers = with lib.maintainers; [
       marcusramberg
+      anish
     ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
     ];
   };
 })

pkgs/by-name/co/cosmic-reader/package.nix

@@ -19,13 +19,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-reader";
-  version = "0-unstable-2025-12-30";
+  version = "0-unstable-2026-01-16";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-reader";
-    rev = "4892355d48aa337f73f69aafe6739c6833f99a01";
-    hash = "sha256-kM6YzKTJkkyEv5DBEkkbmlfpUBLEhjaJ4OIzZ62HeJ0=";
+    rev = "1b030e2f96dc7a141473f87de3cb1f375298589f";
+    hash = "sha256-r+QPe7+rvdYm76DLFtOePh9+eIvSbzuqvhe4490ynWk=";
   };
 
   cargoHash = "sha256-4ofAtZN3FpYwNahinldALbdEJA5lDwa+CUsVIISnSTc=";

pkgs/by-name/ct/ctlptl/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "ctlptl";
-  version = "0.8.44";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "tilt-dev";
     repo = "ctlptl";
     rev = "v${version}";
-    hash = "sha256-DIVKwfTSA03Yyservf3TK7y9RKi2t6pELyC0cpoUH3I=";
+    hash = "sha256-y957JaHg2SnDC6yvwI/0fBFjbEKOfKFsNqOOrqQe+TU=";
   };
 
-  vendorHash = "sha256-bZd2DWQ2utKYctx9KzE5BzF5wkj1rGkka6PsYb7G8Oo=";
+  vendorHash = "sha256-gJiarW1uYr5vl9nt+JN6/yRyYr9J0sfDVZcNLLcwPJY=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/cu/curv/package.nix

@@ -6,10 +6,12 @@
   git,
   pkg-config,
   boost,
-  eigen_3_4_0,
+  eigen_5,
   glm,
+  gcc,
   libGL,
   libpng,
+  makeWrapper,
   openexr,
   onetbb,
   xorg,
@@ -20,14 +22,14 @@
 
 stdenv.mkDerivation {
   pname = "curv";
-  version = "0.5-unstable-2025-01-20";
+  version = "0.5-unstable-2026-01-17";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "doug-moen";
     repo = "curv";
-    rev = "ef082c6612407dd8abce06015f9a16b1ebf661b8";
-    hash = "sha256-BGL07ZBA+ao3fg3qp56sVTe+3tM2SOp8TGu/jF7SVlM=";
+    rev = "1c2eb68e47e3c61a98e39cd3c50f90691c5a268d";
+    hash = "sha256-PuRBnJswrg+PjtU6ize+PjoBpQSSEzO2CeCx9mQF+3w=";
     fetchSubmodules = true;
   };
 
@@ -36,11 +38,12 @@ stdenv.mkDerivation {
     cmake
     git
     pkg-config
+    makeWrapper
   ];
 
   buildInputs = [
     boost
-    eigen_3_4_0
+    eigen_5
     glm
     libGL
     libpng
@@ -75,6 +78,18 @@ stdenv.mkDerivation {
       --replace-fail "cmake_minimum_required(VERSION 2.6.2)" "cmake_minimum_required(VERSION 3.10)"
   '';
 
+  ## support runtime compilation with -Ojit
+  fixupPhase = ''
+    wrapProgram $out/bin/curv \
+      --set NIX_CFLAGS_COMPILE_${gcc.suffixSalt} "$NIX_CFLAGS_COMPILE" \
+      --set NIX_LDFLAGS_${gcc.suffixSalt} "$NIX_LDFLAGS" \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          gcc
+        ]
+      }"
+  '';
+
   passthru.updateScript = unstableGitUpdater { };
 
   meta = {

pkgs/by-name/cv/cvehound/package.nix

@@ -5,8 +5,13 @@
   gnugrep,
   python3,
 }:
-
-python3.pkgs.buildPythonApplication rec {
+let
+  runtimeDeps = [
+    coccinelle
+    gnugrep
+  ];
+in
+python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "cvehound";
   version = "1.2.1";
   pyproject = true;
@@ -14,19 +19,10 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "evdenis";
     repo = "cvehound";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-UvjmlAm/8B4KfE9grvvgn37Rui+ZRfs2oTLqYYgqcUQ=";
   };
 
-  makeWrapperArgs = [
-    "--prefix PATH : ${
-      lib.makeBinPath [
-        coccinelle
-        gnugrep
-      ]
-    }"
-  ];
-
   build-system = with python3.pkgs; [
     setuptools
   ];
@@ -45,10 +41,21 @@ python3.pkgs.buildPythonApplication rec {
   # Tries to clone the kernel sources
   doCheck = false;
 
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath finalAttrs.passthru.runtimeDeps)
+  ];
+
+  passthru = {
+    inherit runtimeDeps;
+  };
+
   meta = {
     description = "Tool to check linux kernel source dump for known CVEs";
     homepage = "https://github.com/evdenis/cvehound";
-    changelog = "https://github.com/evdenis/cvehound/blob/${src.rev}/ChangeLog";
+    changelog = "https://github.com/evdenis/cvehound/blob/${finalAttrs.src.rev}/ChangeLog";
     # See https://github.com/evdenis/cvehound/issues/22
     license = with lib.licenses; [
       gpl2Only
@@ -56,4 +63,4 @@ python3.pkgs.buildPythonApplication rec {
     ];
     maintainers = with lib.maintainers; [ ambroisie ];
   };
-}
+})

pkgs/by-name/da/dawarich/0001-build-ffi-gem.diff

@@ -0,0 +1,18 @@
+diff --git a/Gemfile.lock b/Gemfile.lock
+index d45a7657..d0a7b750 100644
+--- a/Gemfile.lock
++++ b/Gemfile.lock
+@@ -172,12 +172,7 @@ GEM
+       railties (>= 6.1.0)
+     fakeredis (0.1.4)
+     ffaker (2.25.0)
+-    ffi (1.17.2-aarch64-linux-gnu)
+-    ffi (1.17.2-arm-linux-gnu)
+-    ffi (1.17.2-arm64-darwin)
+-    ffi (1.17.2-x86-linux-gnu)
+-    ffi (1.17.2-x86_64-darwin)
+-    ffi (1.17.2-x86_64-linux-gnu)
++    ffi (1.17.2)
+     foreman (0.90.0)
+       thor (~> 1.4)
+     fugit (1.11.1)

pkgs/by-name/da/dawarich/0002-openssl-hotfix.diff

@@ -0,0 +1,32 @@
+diff --git a/Gemfile b/Gemfile
+index 36cf0d9c..fc914849 100644
+--- a/Gemfile
++++ b/Gemfile
+@@ -28,6 +28,7 @@ gem 'omniauth-github', '~> 2.0.0'
+ gem 'omniauth-google-oauth2'
+ gem 'omniauth_openid_connect'
+ gem 'omniauth-rails_csrf_protection'
++gem 'openssl'
+ gem 'parallel'
+ gem 'pg'
+ gem 'prometheus_exporter'
+diff --git a/Gemfile.lock b/Gemfile.lock
+index a32eb801..b2fc45bc 100644
+--- a/Gemfile.lock
++++ b/Gemfile.lock
+@@ -348,6 +348,7 @@ GEM
+       tzinfo
+       validate_url
+       webfinger (~> 2.0)
++    openssl (3.3.1)
+     optimist (3.2.1)
+     orm_adapter (0.5.0)
+     ostruct (0.6.1)
+@@ -665,6 +666,7 @@ DEPENDENCIES
+   omniauth-google-oauth2
+   omniauth-rails_csrf_protection
+   omniauth_openid_connect
++  openssl
+   parallel
+   pg
+   prometheus_exporter

pkgs/by-name/da/dawarich/package.nix

@@ -0,0 +1,142 @@
+{
+  lib,
+  applyPatches,
+  bundlerEnv,
+  fetchFromGitHub,
+  fetchNpmDeps,
+  nixosTests,
+  nodejs,
+  npmHooks,
+  ruby_3_4,
+  stdenv,
+  tailwindcss_3,
+  gemset ? import ./gemset.nix,
+  sources ? lib.importJSON ./sources.json,
+  unpatchedSource ? fetchFromGitHub {
+    owner = "Freika";
+    repo = "dawarich";
+    tag = sources.version;
+    inherit (sources) hash;
+  },
+}:
+let
+  ruby = ruby_3_4;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "dawarich";
+  inherit (sources) version;
+
+  # Use `applyPatches` here because bundix in the update script (see ./update.sh)
+  # needs to run on the already patched Gemfile and Gemfile.lock.
+  # Only patches changing these two files should be here;
+  # patches for other parts of the application should go directly into mkDerivation.
+  src = applyPatches {
+    src = unpatchedSource;
+    patches = [
+      # bundix and bundlerEnv fail with system-specific gems
+      ./0001-build-ffi-gem.diff
+      # openssl 3.6.0 breaks ruby openssl gem
+      # See https://github.com/NixOS/nixpkgs/issues/456753
+      # and https://github.com/ruby/openssl/issues/949#issuecomment-3370358680
+      ./0002-openssl-hotfix.diff
+    ];
+    postPatch = ''
+      substituteInPlace ./Gemfile \
+        --replace-fail "ruby File.read('.ruby-version').strip" "ruby '>= 3.4.0'"
+    '';
+  };
+
+  postPatch = ''
+    # move import directory to a more convenient place, otherwise its behind systemd private tmp
+    substituteInPlace ./app/services/imports/watcher.rb \
+      --replace-fail 'tmp/imports/watched' 'storage/imports/watched'
+  '';
+
+  dawarichGems = bundlerEnv {
+    name = "${finalAttrs.pname}-gems-${finalAttrs.version}";
+    inherit gemset ruby;
+    inherit (finalAttrs) version;
+    gemdir = finalAttrs.src;
+  };
+
+  npmDeps = fetchNpmDeps {
+    inherit (finalAttrs) src;
+    hash = sources.npmHash;
+  };
+
+  RAILS_ENV = "production";
+  NODE_ENV = "production";
+  REDIS_URL = ""; # build error if not defined
+  TAILWINDCSS_INSTALL_DIR = "${tailwindcss_3}/bin";
+
+  nativeBuildInputs = [
+    nodejs
+    npmHooks.npmConfigHook
+    finalAttrs.dawarichGems
+    finalAttrs.dawarichGems.wrappedRuby
+  ];
+  propagatedBuildInputs = [
+    finalAttrs.dawarichGems.wrappedRuby
+  ];
+  buildInputs = [
+    finalAttrs.dawarichGems
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    patchShebangs bin/
+    for b in $(ls $dawarichGems/bin/)
+    do
+      if [ ! -f bin/$b ]; then
+        ln -s $dawarichGems/bin/$b bin/$b
+      fi
+    done
+
+    SECRET_KEY_BASE_DUMMY=1 bundle exec rake assets:precompile
+
+    rm -rf node_modules tmp log storage
+    ln -s /var/log/dawarich log
+    ln -s /var/lib/dawarich storage
+    ln -s /tmp tmp
+
+    # delete more files unneeded at runtime
+    rm -rf docker docs screenshots package.json package-lock.json *.md *.example
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # tests are not needed at runtime
+    rm -rf spec e2e
+    # delete artifacts from patching
+    rm *.orig
+
+    mkdir -p $out
+    mv .{ruby*,app_version} $out/
+    mv * $out/
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) dawarich;
+    };
+    # run with: nix-shell ./maintainers/scripts/update.nix --argstr package dawarich
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    changelog = "https://github.com/Freika/dawarich/blob/${finalAttrs.version}/CHANGELOG.md";
+    description = "Self-hostable alternative to Google Location History (Google Maps Timeline)";
+    homepage = "https://dawarich.app/";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [
+      diogotcorreia
+    ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/da/dawarich/sources.json

@@ -0,0 +1,5 @@
+{
+  "version": "0.37.3",
+  "hash": "sha256-cZBT3ek5mzHbPr4aVHU47SNstEuBnpBNaCfaAe/IAEw=",
+  "npmHash": "sha256-wDe1Zx9HyheS76ltLtDQ+f4M7ohu/pyRuRaGGCnhkQI="
+}

pkgs/by-name/da/dawarich/update.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p bundix curl jq nix-update nix-prefetch-github prefetch-npm-deps gnused
+set -e
+set -o pipefail
+
+OWNER="Freika"
+REPO="dawarich"
+
+old_version=$(nix-instantiate --eval -A 'dawarich.version' default.nix | tr -d '"')
+version=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/$OWNER/$REPO/releases/latest" | jq -r ".tag_name")
+
+echo "Updating to $version"
+
+if [[ "$old_version" == "$version" ]]; then
+    echo "Already up to date!"
+    exit 0
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+
+echo "Fetching source code $REVISION"
+JSON=$(nix-prefetch-github "$OWNER" "$REPO" --rev "refs/tags/$version" 2>/dev/null)
+HASH=$(echo "$JSON" | jq -r .hash)
+
+cat > "$SCRIPT_DIR/sources.json" << EOF
+{
+  "version": "$version",
+  "hash": "$HASH",
+  "npmHash": "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+}
+EOF
+
+SOURCE_DIR="$(nix-build --no-out-link -A dawarich.src)"
+
+echo "Creating gemset.nix"
+bundix --lockfile="$SOURCE_DIR/Gemfile.lock" --gemfile="$SOURCE_DIR/Gemfile" --gemset="$SCRIPT_DIR/gemset.nix"
+nixfmt "$SCRIPT_DIR/gemset.nix"
+
+NPM_HASH="$(prefetch-npm-deps "$SOURCE_DIR/package-lock.json" 2>/dev/null)"
+sed -i "s;sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=;$NPM_HASH;g" "$SCRIPT_DIR/sources.json"