From 69c6e3352dbf417738453e3bad560cd4327d9f52 Mon Sep 17 00:00:00 2001
From: figboy9 <figboy9@tuta.io>
Date: Sun, 28 Jul 2024 14:03:49 +0900
Subject: [PATCH 01/53] nixos/veilid: Add veilid service module

---
 nixos/modules/module-list.nix                |   7 +-
 nixos/modules/services/networking/veilid.nix | 606 +++++++++++++++++++
 2 files changed, 609 insertions(+), 4 deletions(-)
 create mode 100644 nixos/modules/services/networking/veilid.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index f97a6b47512c..370e7b761443 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1236,6 +1236,7 @@
   ./services/networking/uptermd.nix
   ./services/networking/v2ray.nix
   ./services/networking/v2raya.nix
+  ./services/networking/veilid.nix
   ./services/networking/vdirsyncer.nix
   ./services/networking/vsftpd.nix
   ./services/networking/wasabibackend.nix
@@ -1694,9 +1695,7 @@
   ./virtualisation/xe-guest-utilities.nix
   ./virtualisation/xen-dom0.nix
   {
-    documentation.nixos.extraModules = [
-      ./virtualisation/qemu-vm.nix
-      ./image/repart.nix
-    ];
+    documentation.nixos.extraModules =
+      [ ./virtualisation/qemu-vm.nix ./image/repart.nix ];
   }
 ]
diff --git a/nixos/modules/services/networking/veilid.nix b/nixos/modules/services/networking/veilid.nix
new file mode 100644
index 000000000000..098b74b683e3
--- /dev/null
+++ b/nixos/modules/services/networking/veilid.nix
@@ -0,0 +1,606 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.veilid;
+  dataDir = "/var/lib/veilid";
+
+  settingsFormat = pkgs.formats.yaml { };
+  configFile = settingsFormat.generate "veilid.yaml" cfg.settings;
+in {
+  config = lib.mkIf cfg.enable {
+    networking = {
+      firewall = {
+        allowedTCPPorts = [ 5150 ];
+        allowedUDPPorts = [ 5150 ];
+      };
+    };
+
+    systemd.services.veilid = {
+      enable = true;
+      description = "Veilid Network Service";
+      after = [ "network-pre.target" ];
+      wants = [ "network.target" ];
+      before = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [ configFile ];
+      environment = { HOME = dataDir; };
+      serviceConfig = {
+        User = "veilid";
+        Restart = "always";
+        StateDirectory = "veilid";
+        RuntimeDirectory = "veilid";
+        ExecStart = "${pkgs.veilid}/bin/veilid-server -c ${configFile}";
+      };
+    };
+    users.users.veilid = { isSystemUser = true; };
+
+    users.users.veilid.group = "veilid";
+    users.groups.veilid = { };
+
+    environment = {
+      etc."veilid/veilid-server.conf".source = configFile;
+      systemPackages = [ pkgs.veilid ];
+    };
+  };
+
+  options.services.veilid = {
+    enable = lib.mkEnableOption "veilid";
+    settings = lib.mkOption {
+
+      type = lib.types.attrsOf (lib.types.submodule {
+        freeformType = settingsFormat.type;
+
+        options = {
+          daemon = {
+            enabled = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+            };
+            pid_file = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+            };
+            chroot = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+            };
+            working_directory = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+            };
+            user = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+            };
+            group = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+            };
+            stdout_file = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+            };
+            stderr_file = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+            };
+          };
+          client_api = {
+            ipc_enabled = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+            };
+            ipc_directory = lib.mkOption {
+              type = lib.types.str;
+              default =
+                "/home/${config.users.users.veilid.name}/.local/share/veilid/ipc";
+            };
+            network_enabled = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+            };
+            listen_address = lib.mkOption {
+              type = lib.types.str;
+              default = "localhost:5959";
+            };
+          };
+          auto_attach = lib.mkOption {
+            type = lib.types.bool;
+            default = true;
+          };
+          logging = {
+            system = {
+              enabled = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+              };
+              level = lib.mkOption {
+                type = lib.types.str;
+                default = "info";
+              };
+              ignore_log_targets = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
+                default = [ ];
+              };
+            };
+            terminal = {
+              enabled = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+              };
+              level = lib.mkOption {
+                type = lib.types.str;
+                default = "info";
+              };
+              ignore_log_targets = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
+                default = [ ];
+              };
+            };
+            file = {
+              enabled = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+              };
+              path = lib.mkOption {
+                type = lib.types.str;
+                default = "";
+              };
+              append = lib.mkOption {
+                type = lib.types.bool;
+                default = true;
+              };
+              level = lib.mkOption {
+                type = lib.types.str;
+                default = "info";
+              };
+              ignore_log_targets = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
+                default = [ ];
+              };
+            };
+            api = {
+              enabled = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+              };
+              level = lib.mkOption {
+                type = lib.types.str;
+                default = "info";
+              };
+              ignore_log_targets = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
+                default = [ ];
+              };
+            };
+            otlp = {
+              enabled = lib.mkOption {
+                type = lib.types.bool;
+                default = true;
+              };
+              level = lib.mkOption {
+                type = lib.types.str;
+                default = "trace";
+              };
+              grpc_endpoint = lib.mkOption {
+                type = lib.types.str;
+                default = "localhost:4317";
+              };
+              ignore_log_targets = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
+                default = [ ];
+              };
+            };
+            console = {
+              enabled = lib.mkOption {
+                type = lib.types.bool;
+                default = true;
+              };
+            };
+          };
+          testing = {
+            subnode_index = lib.mkOption {
+              type = lib.types.number;
+              default = 0;
+            };
+          };
+          core = {
+            capabilities = {
+              disable = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
+                default = [ ];
+              };
+            };
+            protected_store = {
+              allow_insecure_fallback = lib.mkOption {
+                type = lib.types.bool;
+                default = true;
+              };
+              always_use_insecure_storage = lib.mkOption {
+                type = lib.types.bool;
+                default = true;
+              };
+              directory = lib.mkOption {
+                type = lib.types.str;
+                default =
+                  "/home/${config.users.users.veilid.name}/.local/share/veilid/protected_store";
+              };
+              delete = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+              };
+              device_encryption_key_password = lib.mkOption {
+                type = lib.types.str;
+                default =
+                  "/home/${config.users.users.veilid.name}/.local/share/veilid/protected_store";
+              };
+              new_device_encryption_key_password = lib.mkOption {
+                type = lib.types.nullOr lib.types.str;
+                default = null;
+              };
+            };
+            table_store = {
+              directory = lib.mkOption {
+                type = lib.types.str;
+                default =
+                  "/home/${config.users.users.veilid.name}/.local/share/veilid/table_store";
+              };
+              delete = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+              };
+            };
+            block_store = {
+              directory = lib.mkOption {
+                type = lib.types.nullOr lib.types.str;
+                default =
+                  "/home/${config.users.users.veilid.name}/.local/share/veilid/block_store";
+              };
+              delete = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+              };
+            };
+            network = {
+              connection_initial_timeout_ms = lib.mkOption {
+                type = lib.types.number;
+                default = 2000;
+              };
+              connection_inactivity_timeout_ms = lib.mkOption {
+                type = lib.types.number;
+                default = 60000;
+              };
+              max_connections_per_ip4 = lib.mkOption {
+                type = lib.types.number;
+                default = 32;
+              };
+              max_connections_per_ip6_prefix = lib.mkOption {
+                type = lib.types.number;
+                default = 32;
+              };
+              max_connections_per_ip6_prefix_size = lib.mkOption {
+                type = lib.types.number;
+                default = 56;
+              };
+              max_connection_frequency_per_min = lib.mkOption {
+                type = lib.types.number;
+                default = 128;
+              };
+              client_allowlist_timeout_ms = lib.mkOption {
+                type = lib.types.number;
+                default = 300000;
+              };
+              reverse_connection_receipt_time_ms = lib.mkOption {
+                type = lib.types.number;
+                default = 5000;
+              };
+              network_key_password = lib.mkOption {
+                type = lib.types.nullOr lib.types.str;
+                default = null;
+              };
+            };
+            routing_table = {
+              node_id = lib.mkOption {
+                type = lib.types.nullOr lib.types.str;
+                default = null;
+              };
+              node_id_secret = lib.mkOption {
+                type = lib.types.nullOr lib.types.str;
+                default = null;
+              };
+              bootstrap = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
+                default = [ "bootstrap.veilid.net" ];
+              };
+              limit_over_attached = lib.mkOption {
+                type = lib.types.number;
+                default = 64;
+              };
+              limit_fully_attached = lib.mkOption {
+                type = lib.types.number;
+                default = 32;
+              };
+              limit_attached_strong = lib.mkOption {
+                type = lib.types.number;
+                default = 32;
+              };
+              limit_attached_good = lib.mkOption {
+                type = lib.types.number;
+                default = 8;
+              };
+              limit_attached_weak = lib.mkOption {
+                type = lib.types.number;
+                default = 4;
+              };
+            };
+            rpc = {
+              concurrency = lib.mkOption {
+                type = lib.types.number;
+                default = 0;
+              };
+              queue_size = lib.mkOption {
+                type = lib.types.number;
+                default = 1024;
+              };
+              max_timestamp_behind_ms = lib.mkOption {
+                type = lib.types.number;
+                default = 10000;
+              };
+              max_timestamp_ahead_ms = lib.mkOption {
+                type = lib.types.number;
+                default = 10000;
+              };
+              timeout_ms = lib.mkOption {
+                type = lib.types.number;
+                default = 5000;
+              };
+              max_route_hop_count = lib.mkOption {
+                type = lib.types.number;
+                default = 4;
+              };
+              default_route_hop_count = lib.mkOption {
+                type = lib.types.number;
+                default = 1;
+              };
+            };
+            dht = {
+              max_find_node_count = lib.mkOption {
+                type = lib.types.number;
+                default = 20;
+              };
+              resolve_node_timeout_ms = lib.mkOption {
+                type = lib.types.number;
+                default = 10000;
+              };
+              resolve_node_count = lib.mkOption {
+                type = lib.types.number;
+                default = 1;
+              };
+              resolve_node_fanout = lib.mkOption {
+                type = lib.types.number;
+                default = 4;
+              };
+              get_value_timeout_ms = lib.mkOption {
+                type = lib.types.number;
+                default = 10000;
+              };
+              get_value_count = lib.mkOption {
+                type = lib.types.number;
+                default = 3;
+              };
+              get_value_fanout = lib.mkOption {
+                type = lib.types.number;
+                default = 4;
+              };
+              set_value_timeout_ms = lib.mkOption {
+                type = lib.types.number;
+                default = 10000;
+              };
+              set_value_count = lib.mkOption {
+                type = lib.types.number;
+                default = 5;
+              };
+              set_value_fanout = lib.mkOption {
+                type = lib.types.number;
+                default = 4;
+              };
+              min_peer_count = lib.mkOption {
+                type = lib.types.number;
+                default = 20;
+              };
+              min_peer_refresh_time_ms = lib.mkOption {
+                type = lib.types.number;
+                default = 60000;
+              };
+              validate_dial_info_receipt_time_ms = lib.mkOption {
+                type = lib.types.number;
+                default = 2000;
+              };
+              local_subkey_cache_size = lib.mkOption {
+                type = lib.types.number;
+                default = 128;
+              };
+              local_max_subkey_cache_memory_mb = lib.mkOption {
+                type = lib.types.number;
+                default = 256;
+              };
+              remote_subkey_cache_size = lib.mkOption {
+                type = lib.types.number;
+                default = 1024;
+              };
+              remote_max_records = lib.mkOption {
+                type = lib.types.number;
+                default = 65536;
+              };
+              remote_max_subkey_cache_memory_mb = lib.mkOption {
+                type = lib.types.number;
+                default = 2552;
+              };
+              remote_max_storage_space_mb = lib.mkOption {
+                type = lib.types.number;
+                default = 10000;
+              };
+              public_watch_limit = lib.mkOption {
+                type = lib.types.number;
+                default = 32;
+              };
+              member_watch_limit = lib.mkOption {
+                type = lib.types.number;
+                default = 8;
+              };
+              max_watch_expiration_ms = lib.mkOption {
+                type = lib.types.number;
+                default = 600000;
+              };
+            };
+            upnp = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+            };
+            detect_address_changes = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+            };
+            restricted_nat_retries = lib.mkOption {
+              type = lib.types.number;
+              default = 0;
+            };
+            tls = {
+              certificate_path = lib.mkOption {
+                type = lib.types.str;
+                default =
+                  "/home/${config.users.users.veilid.name}/.local/share/veilid/protected_store";
+              };
+              private_key_path = lib.mkOption {
+                type = lib.types.str;
+                default =
+                  "/home/${config.users.users.veilid.name}/.local/share/veilid/protected_store";
+              };
+              connection_initial_timeout_ms = lib.mkOption {
+                type = lib.types.number;
+                default = 2000;
+              };
+            };
+            application = {
+              https = {
+                enabled = lib.mkOption {
+                  type = lib.types.bool;
+                  default = true;
+                };
+                listen_address = lib.mkOption {
+                  type = lib.types.str;
+                  default = ":433";
+                };
+
+                path = lib.mkOption {
+                  type = lib.types.str;
+                  default = "app";
+                };
+                url = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                };
+              };
+            };
+            protocol = {
+              udp = {
+                enabled = lib.mkOption {
+                  type = lib.types.bool;
+                  default = true;
+                };
+                socket_pool_size = lib.mkOption {
+                  type = lib.types.number;
+                  default = 0;
+                };
+                listen_address = lib.mkOption {
+                  type = lib.types.str;
+                  default = "";
+                };
+                public_address = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                };
+              };
+              tcp = {
+                connect = lib.mkOption {
+                  type = lib.types.bool;
+                  default = true;
+                };
+                listen = lib.mkOption {
+                  type = lib.types.bool;
+                  default = true;
+                };
+                max_connections = lib.mkOption {
+                  type = lib.types.number;
+                  default = 32;
+                };
+                listen_address = lib.mkOption {
+                  type = lib.types.str;
+                  default = "";
+                };
+                public_address = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                };
+              };
+              ws = {
+                connect = lib.mkOption {
+                  type = lib.types.bool;
+                  default = true;
+                };
+                listen = lib.mkOption {
+                  type = lib.types.bool;
+                  default = true;
+                };
+                max_connections = lib.mkOption {
+                  type = lib.types.number;
+                  default = 32;
+                };
+                listen_address = lib.mkOption {
+                  type = lib.types.str;
+                  default = "";
+                };
+
+                path = lib.mkOption {
+                  type = lib.types.str;
+                  default = "ws";
+                };
+                url = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                };
+              };
+              wss = {
+                connect = lib.mkOption {
+                  type = lib.types.bool;
+                  default = true;
+                };
+                listen = lib.mkOption {
+                  type = lib.types.bool;
+                  default = true;
+                };
+                max_connections = lib.mkOption {
+                  type = lib.types.number;
+                  default = 32;
+                };
+                listen_address = lib.mkOption {
+                  type = lib.types.str;
+                  default = "";
+                };
+
+                path = lib.mkOption {
+                  type = lib.types.str;
+                  default = "ws";
+                };
+                url = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                };
+              };
+            };
+          };
+        };
+      });
+    };
+  };
+
+}

From c321004b56ad5916f54edc7a863af45907c01164 Mon Sep 17 00:00:00 2001
From: figboy9 <figboy9@tuta.io>
Date: Sun, 28 Jul 2024 14:05:07 +0900
Subject: [PATCH 02/53] Add figboy9 to maintainers

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d5e0e9468be9..1ee6debd0b62 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6641,6 +6641,12 @@
       { fingerprint = "elY15tXap1tddxbBVoUoAioe1u0RDWti5rc9cauSmwo"; }
     ];
   };
+  figboy9 = {
+    email = "figboy9@tuta.io";
+    github = "figboy9";
+    githubId = 52276064;
+    name = "figboy9";
+  };
   figsoda = {
     email = "figsoda@pm.me";
     matrix = "@figsoda:matrix.org";

From 67b152a087a28cfab0191229af4626b432a6762a Mon Sep 17 00:00:00 2001
From: figboy9 <figboy9@tuta.io>
Date: Sun, 28 Jul 2024 14:42:12 +0900
Subject: [PATCH 03/53] Add figboy9 to module maintainers

---
 nixos/modules/services/networking/veilid.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/networking/veilid.nix b/nixos/modules/services/networking/veilid.nix
index 098b74b683e3..5ff7b3b196fc 100644
--- a/nixos/modules/services/networking/veilid.nix
+++ b/nixos/modules/services/networking/veilid.nix
@@ -603,4 +603,5 @@ in {
     };
   };
 
+  meta.maintainers = with lib.maintainers; [ figboy9 ];
 }

From 318014034a856b09da9bbe23c101a2d99d897b3b Mon Sep 17 00:00:00 2001
From: figboy9 <figboy9@tuta.io>
Date: Sat, 14 Sep 2024 18:03:02 +0900
Subject: [PATCH 04/53] reduce options

---
 nixos/modules/services/networking/veilid.nix | 589 +++----------------
 1 file changed, 87 insertions(+), 502 deletions(-)

diff --git a/nixos/modules/services/networking/veilid.nix b/nixos/modules/services/networking/veilid.nix
index 5ff7b3b196fc..9c8a9bd7a661 100644
--- a/nixos/modules/services/networking/veilid.nix
+++ b/nixos/modules/services/networking/veilid.nix
@@ -1,4 +1,5 @@
 { config, pkgs, lib, ... }:
+with lib;
 let
   cfg = config.services.veilid;
   dataDir = "/var/lib/veilid";
@@ -6,7 +7,7 @@ let
   settingsFormat = pkgs.formats.yaml { };
   configFile = settingsFormat.generate "veilid.yaml" cfg.settings;
 in {
-  config = lib.mkIf cfg.enable {
+  config = mkIf cfg.enable {
     networking = {
       firewall = {
         allowedTCPPorts = [ 5150 ];
@@ -43,565 +44,149 @@ in {
   };
 
   options.services.veilid = {
-    enable = lib.mkEnableOption "veilid";
-    settings = lib.mkOption {
-
-      type = lib.types.attrsOf (lib.types.submodule {
+    enable = mkEnableOption "Veilid Headless Node";
+    settings = mkOption {
+      description = ''
+        Build veilid-server.conf with nix expression.
+        Check [Configuration Keys](https://veilid.gitlab.io/developer-book/admin/config.html#configuration-keys).
+      '';
+      type = types.submodule {
         freeformType = settingsFormat.type;
 
         options = {
-          daemon = {
-            enabled = lib.mkOption {
-              type = lib.types.bool;
-              default = false;
-            };
-            pid_file = lib.mkOption {
-              type = lib.types.nullOr lib.types.str;
-              default = null;
-            };
-            chroot = lib.mkOption {
-              type = lib.types.nullOr lib.types.str;
-              default = null;
-            };
-            working_directory = lib.mkOption {
-              type = lib.types.nullOr lib.types.str;
-              default = null;
-            };
-            user = lib.mkOption {
-              type = lib.types.nullOr lib.types.str;
-              default = null;
-            };
-            group = lib.mkOption {
-              type = lib.types.nullOr lib.types.str;
-              default = null;
-            };
-            stdout_file = lib.mkOption {
-              type = lib.types.nullOr lib.types.str;
-              default = null;
-            };
-            stderr_file = lib.mkOption {
-              type = lib.types.nullOr lib.types.str;
-              default = null;
-            };
-          };
           client_api = {
-            ipc_enabled = lib.mkOption {
-              type = lib.types.bool;
+            ipc_enabled = mkOption {
+              type = types.bool;
               default = true;
+              description =
+                "veilid-server will respond to Python and other JSON client requests.";
             };
-            ipc_directory = lib.mkOption {
-              type = lib.types.str;
-              default =
-                "/home/${config.users.users.veilid.name}/.local/share/veilid/ipc";
+            ipc_directory = mkOption {
+              type = types.str;
+              default = "${dataDir}/ipc";
             };
-            network_enabled = lib.mkOption {
-              type = lib.types.bool;
-              default = false;
-            };
-            listen_address = lib.mkOption {
-              type = lib.types.str;
-              default = "localhost:5959";
-            };
-          };
-          auto_attach = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
           };
           logging = {
             system = {
-              enabled = lib.mkOption {
-                type = lib.types.bool;
-                default = false;
+              enabled = mkOption {
+                type = types.bool;
+                default = true;
+                description = "Events of type 'system' will be logged.";
               };
-              level = lib.mkOption {
-                type = lib.types.str;
+              level = mkOption {
+                type = types.str;
                 default = "info";
-              };
-              ignore_log_targets = lib.mkOption {
-                type = lib.types.listOf lib.types.str;
-                default = [ ];
+                description =
+                  "The minimum priority of system events to be logged.";
               };
             };
             terminal = {
-              enabled = lib.mkOption {
-                type = lib.types.bool;
+              enabled = mkOption {
+                type = types.bool;
                 default = false;
+                description = "Events of type 'terminal' will be logged.";
               };
-              level = lib.mkOption {
-                type = lib.types.str;
+              level = mkOption {
+                type = types.str;
                 default = "info";
-              };
-              ignore_log_targets = lib.mkOption {
-                type = lib.types.listOf lib.types.str;
-                default = [ ];
-              };
-            };
-            file = {
-              enabled = lib.mkOption {
-                type = lib.types.bool;
-                default = false;
-              };
-              path = lib.mkOption {
-                type = lib.types.str;
-                default = "";
-              };
-              append = lib.mkOption {
-                type = lib.types.bool;
-                default = true;
-              };
-              level = lib.mkOption {
-                type = lib.types.str;
-                default = "info";
-              };
-              ignore_log_targets = lib.mkOption {
-                type = lib.types.listOf lib.types.str;
-                default = [ ];
+                description =
+                  "The minimum priority of terminal events to be logged.";
               };
             };
             api = {
-              enabled = lib.mkOption {
-                type = lib.types.bool;
+              enabled = mkOption {
+                type = types.bool;
                 default = false;
+                description = "Events of type 'api' will be logged.";
               };
-              level = lib.mkOption {
-                type = lib.types.str;
+              level = mkOption {
+                type = types.str;
                 default = "info";
+                description =
+                  "The minimum priority of api events to be logged.";
               };
-              ignore_log_targets = lib.mkOption {
-                type = lib.types.listOf lib.types.str;
-                default = [ ];
-              };
-            };
-            otlp = {
-              enabled = lib.mkOption {
-                type = lib.types.bool;
-                default = true;
-              };
-              level = lib.mkOption {
-                type = lib.types.str;
-                default = "trace";
-              };
-              grpc_endpoint = lib.mkOption {
-                type = lib.types.str;
-                default = "localhost:4317";
-              };
-              ignore_log_targets = lib.mkOption {
-                type = lib.types.listOf lib.types.str;
-                default = [ ];
-              };
-            };
-            console = {
-              enabled = lib.mkOption {
-                type = lib.types.bool;
-                default = true;
-              };
-            };
-          };
-          testing = {
-            subnode_index = lib.mkOption {
-              type = lib.types.number;
-              default = 0;
             };
           };
           core = {
             capabilities = {
-              disable = lib.mkOption {
-                type = lib.types.listOf lib.types.str;
+              disable = mkOption {
+                type = types.listOf types.str;
                 default = [ ];
+                description =
+                  "A list of capabilities to disable (for example, DHTV to say you cannot store DHT information).";
               };
             };
             protected_store = {
-              allow_insecure_fallback = lib.mkOption {
-                type = lib.types.bool;
+              allow_insecure_fallback = mkOption {
+                type = types.bool;
                 default = true;
+                description =
+                  "If we can't use system-provided secure storage, should we proceed anyway?";
               };
-              always_use_insecure_storage = lib.mkOption {
-                type = lib.types.bool;
+              always_use_insecure_storage = mkOption {
+                type = types.bool;
                 default = true;
+                description =
+                  "Should we bypass any attempt to use system-provided secure storage?";
               };
-              directory = lib.mkOption {
-                type = lib.types.str;
-                default =
-                  "/home/${config.users.users.veilid.name}/.local/share/veilid/protected_store";
-              };
-              delete = lib.mkOption {
-                type = lib.types.bool;
-                default = false;
-              };
-              device_encryption_key_password = lib.mkOption {
-                type = lib.types.str;
-                default =
-                  "/home/${config.users.users.veilid.name}/.local/share/veilid/protected_store";
-              };
-              new_device_encryption_key_password = lib.mkOption {
-                type = lib.types.nullOr lib.types.str;
-                default = null;
+              directory = mkOption {
+                type = types.str;
+                default = "${dataDir}/protected_store";
+                description =
+                  "The filesystem directory to store your protected store in.";
               };
             };
             table_store = {
-              directory = lib.mkOption {
-                type = lib.types.str;
-                default =
-                  "/home/${config.users.users.veilid.name}/.local/share/veilid/table_store";
-              };
-              delete = lib.mkOption {
-                type = lib.types.bool;
-                default = false;
+              directory = mkOption {
+                type = types.str;
+                default = "${dataDir}/table_store";
+                description =
+                  "The filesystem directory to store your table store within.";
               };
             };
             block_store = {
-              directory = lib.mkOption {
-                type = lib.types.nullOr lib.types.str;
-                default =
-                  "/home/${config.users.users.veilid.name}/.local/share/veilid/block_store";
-              };
-              delete = lib.mkOption {
-                type = lib.types.bool;
-                default = false;
+              directory = mkOption {
+                type = types.nullOr types.str;
+                default = "${dataDir}/block_store";
+                description =
+                  "The filesystem directory to store blocks for the block store.";
               };
             };
             network = {
-              connection_initial_timeout_ms = lib.mkOption {
-                type = lib.types.number;
-                default = 2000;
-              };
-              connection_inactivity_timeout_ms = lib.mkOption {
-                type = lib.types.number;
-                default = 60000;
-              };
-              max_connections_per_ip4 = lib.mkOption {
-                type = lib.types.number;
-                default = 32;
-              };
-              max_connections_per_ip6_prefix = lib.mkOption {
-                type = lib.types.number;
-                default = 32;
-              };
-              max_connections_per_ip6_prefix_size = lib.mkOption {
-                type = lib.types.number;
-                default = 56;
-              };
-              max_connection_frequency_per_min = lib.mkOption {
-                type = lib.types.number;
-                default = 128;
-              };
-              client_allowlist_timeout_ms = lib.mkOption {
-                type = lib.types.number;
-                default = 300000;
-              };
-              reverse_connection_receipt_time_ms = lib.mkOption {
-                type = lib.types.number;
-                default = 5000;
-              };
-              network_key_password = lib.mkOption {
-                type = lib.types.nullOr lib.types.str;
-                default = null;
-              };
-            };
             routing_table = {
-              node_id = lib.mkOption {
-                type = lib.types.nullOr lib.types.str;
-                default = null;
-              };
-              node_id_secret = lib.mkOption {
-                type = lib.types.nullOr lib.types.str;
-                default = null;
-              };
-              bootstrap = lib.mkOption {
-                type = lib.types.listOf lib.types.str;
+                bootstrap = mkOption {
+                  type = types.listOf types.str;
                 default = [ "bootstrap.veilid.net" ];
+                  description =
+                    "Host name of existing well-known Veilid bootstrap servers for the network to connect to.";
+                };
               };
-              limit_over_attached = lib.mkOption {
-                type = lib.types.number;
-                default = 64;
+              dht = {
+                min_peer_count = mkOption {
+                  type = types.number;
+                  default = 20;
+                  description =
+                    "Minimum number of nodes to keep in the peer table.";
+                };
               };
-              limit_fully_attached = lib.mkOption {
-                type = lib.types.number;
-                default = 32;
-              };
-              limit_attached_strong = lib.mkOption {
-                type = lib.types.number;
-                default = 32;
-              };
-              limit_attached_good = lib.mkOption {
-                type = lib.types.number;
-                default = 8;
-              };
-              limit_attached_weak = lib.mkOption {
-                type = lib.types.number;
-                default = 4;
-              };
-            };
-            rpc = {
-              concurrency = lib.mkOption {
-                type = lib.types.number;
-                default = 0;
-              };
-              queue_size = lib.mkOption {
-                type = lib.types.number;
-                default = 1024;
-              };
-              max_timestamp_behind_ms = lib.mkOption {
-                type = lib.types.number;
-                default = 10000;
-              };
-              max_timestamp_ahead_ms = lib.mkOption {
-                type = lib.types.number;
-                default = 10000;
-              };
-              timeout_ms = lib.mkOption {
-                type = lib.types.number;
-                default = 5000;
-              };
-              max_route_hop_count = lib.mkOption {
-                type = lib.types.number;
-                default = 4;
-              };
-              default_route_hop_count = lib.mkOption {
-                type = lib.types.number;
-                default = 1;
-              };
-            };
-            dht = {
-              max_find_node_count = lib.mkOption {
-                type = lib.types.number;
-                default = 20;
-              };
-              resolve_node_timeout_ms = lib.mkOption {
-                type = lib.types.number;
-                default = 10000;
-              };
-              resolve_node_count = lib.mkOption {
-                type = lib.types.number;
-                default = 1;
-              };
-              resolve_node_fanout = lib.mkOption {
-                type = lib.types.number;
-                default = 4;
-              };
-              get_value_timeout_ms = lib.mkOption {
-                type = lib.types.number;
-                default = 10000;
-              };
-              get_value_count = lib.mkOption {
-                type = lib.types.number;
-                default = 3;
-              };
-              get_value_fanout = lib.mkOption {
-                type = lib.types.number;
-                default = 4;
-              };
-              set_value_timeout_ms = lib.mkOption {
-                type = lib.types.number;
-                default = 10000;
-              };
-              set_value_count = lib.mkOption {
-                type = lib.types.number;
-                default = 5;
-              };
-              set_value_fanout = lib.mkOption {
-                type = lib.types.number;
-                default = 4;
-              };
-              min_peer_count = lib.mkOption {
-                type = lib.types.number;
-                default = 20;
-              };
-              min_peer_refresh_time_ms = lib.mkOption {
-                type = lib.types.number;
-                default = 60000;
-              };
-              validate_dial_info_receipt_time_ms = lib.mkOption {
-                type = lib.types.number;
-                default = 2000;
-              };
-              local_subkey_cache_size = lib.mkOption {
-                type = lib.types.number;
-                default = 128;
-              };
-              local_max_subkey_cache_memory_mb = lib.mkOption {
-                type = lib.types.number;
-                default = 256;
-              };
-              remote_subkey_cache_size = lib.mkOption {
-                type = lib.types.number;
-                default = 1024;
-              };
-              remote_max_records = lib.mkOption {
-                type = lib.types.number;
-                default = 65536;
-              };
-              remote_max_subkey_cache_memory_mb = lib.mkOption {
-                type = lib.types.number;
-                default = 2552;
-              };
-              remote_max_storage_space_mb = lib.mkOption {
-                type = lib.types.number;
-                default = 10000;
-              };
-              public_watch_limit = lib.mkOption {
-                type = lib.types.number;
-                default = 32;
-              };
-              member_watch_limit = lib.mkOption {
-                type = lib.types.number;
-                default = 8;
-              };
-              max_watch_expiration_ms = lib.mkOption {
-                type = lib.types.number;
-                default = 600000;
-              };
-            };
-            upnp = lib.mkOption {
-              type = lib.types.bool;
-              default = true;
-            };
-            detect_address_changes = lib.mkOption {
-              type = lib.types.bool;
-              default = true;
-            };
-            restricted_nat_retries = lib.mkOption {
-              type = lib.types.number;
-              default = 0;
-            };
-            tls = {
-              certificate_path = lib.mkOption {
-                type = lib.types.str;
-                default =
-                  "/home/${config.users.users.veilid.name}/.local/share/veilid/protected_store";
-              };
-              private_key_path = lib.mkOption {
-                type = lib.types.str;
-                default =
-                  "/home/${config.users.users.veilid.name}/.local/share/veilid/protected_store";
-              };
-              connection_initial_timeout_ms = lib.mkOption {
-                type = lib.types.number;
-                default = 2000;
-              };
-            };
-            application = {
-              https = {
-                enabled = lib.mkOption {
-                  type = lib.types.bool;
+              upnp = mkOption {
+                type = types.bool;
                   default = true;
-                };
-                listen_address = lib.mkOption {
-                  type = lib.types.str;
-                  default = ":433";
-                };
-
-                path = lib.mkOption {
-                  type = lib.types.str;
-                  default = "app";
-                };
-                url = lib.mkOption {
-                  type = lib.types.nullOr lib.types.str;
-                  default = null;
-                };
+                description =
+                  "Should the app try to improve its incoming network connectivity using UPnP?";
               };
-            };
-            protocol = {
-              udp = {
-                enabled = lib.mkOption {
-                  type = lib.types.bool;
+              detect_address_changes = mkOption {
+                type = types.bool;
                   default = true;
-                };
-                socket_pool_size = lib.mkOption {
-                  type = lib.types.number;
-                  default = 0;
-                };
-                listen_address = lib.mkOption {
-                  type = lib.types.str;
-                  default = "";
-                };
-                public_address = lib.mkOption {
-                  type = lib.types.nullOr lib.types.str;
-                  default = null;
-                };
-              };
-              tcp = {
-                connect = lib.mkOption {
-                  type = lib.types.bool;
-                  default = true;
-                };
-                listen = lib.mkOption {
-                  type = lib.types.bool;
-                  default = true;
-                };
-                max_connections = lib.mkOption {
-                  type = lib.types.number;
-                  default = 32;
-                };
-                listen_address = lib.mkOption {
-                  type = lib.types.str;
-                  default = "";
-                };
-                public_address = lib.mkOption {
-                  type = lib.types.nullOr lib.types.str;
-                  default = null;
-                };
-              };
-              ws = {
-                connect = lib.mkOption {
-                  type = lib.types.bool;
-                  default = true;
-                };
-                listen = lib.mkOption {
-                  type = lib.types.bool;
-                  default = true;
-                };
-                max_connections = lib.mkOption {
-                  type = lib.types.number;
-                  default = 32;
-                };
-                listen_address = lib.mkOption {
-                  type = lib.types.str;
-                  default = "";
-                };
-
-                path = lib.mkOption {
-                  type = lib.types.str;
-                  default = "ws";
-                };
-                url = lib.mkOption {
-                  type = lib.types.nullOr lib.types.str;
-                  default = null;
-                };
-              };
-              wss = {
-                connect = lib.mkOption {
-                  type = lib.types.bool;
-                  default = true;
-                };
-                listen = lib.mkOption {
-                  type = lib.types.bool;
-                  default = true;
-                };
-                max_connections = lib.mkOption {
-                  type = lib.types.number;
-                  default = 32;
-                };
-                listen_address = lib.mkOption {
-                  type = lib.types.str;
-                  default = "";
-                };
-
-                path = lib.mkOption {
-                  type = lib.types.str;
-                  default = "ws";
-                };
-                url = lib.mkOption {
-                  type = lib.types.nullOr lib.types.str;
-                  default = null;
-                };
+                description =
+                  "Should veilid-core detect and notify on network address changes?";
               };
             };
           };
         };
-      });
+      };
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ figboy9 ];
+  meta.maintainers = with maintainers; [ figboy9 ];
 }

From 0ea2046bc50aac2f4abf37952898e51392eb27c5 Mon Sep 17 00:00:00 2001
From: figboy9 <figboy9@tuta.io>
Date: Sat, 14 Sep 2024 18:15:14 +0900
Subject: [PATCH 05/53] make opening the firewall optional

---
 nixos/modules/services/networking/veilid.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/networking/veilid.nix b/nixos/modules/services/networking/veilid.nix
index 9c8a9bd7a661..e5e32d78a245 100644
--- a/nixos/modules/services/networking/veilid.nix
+++ b/nixos/modules/services/networking/veilid.nix
@@ -8,11 +8,9 @@ let
   configFile = settingsFormat.generate "veilid.yaml" cfg.settings;
 in {
   config = mkIf cfg.enable {
-    networking = {
-      firewall = {
+    networking.firewall = mkIf cfg.openFirewall {
         allowedTCPPorts = [ 5150 ];
         allowedUDPPorts = [ 5150 ];
-      };
     };
 
     systemd.services.veilid = {
@@ -45,6 +43,11 @@ in {
 
   options.services.veilid = {
     enable = mkEnableOption "Veilid Headless Node";
+    openFirewall = mkOption {
+      default = false;
+      type = types.bool;
+      description = "Whether to open firewall on ports 5150/tcp, 5150/udp";
+    };
     settings = mkOption {
       description = ''
         Build veilid-server.conf with nix expression.

From 55a594468a7a224dfe2a8485bf51ff24d4d90fec Mon Sep 17 00:00:00 2001
From: figboy9 <figboy9@tuta.io>
Date: Sat, 14 Sep 2024 18:20:01 +0900
Subject: [PATCH 06/53] change dataDir

---
 nixos/modules/services/networking/veilid.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/veilid.nix b/nixos/modules/services/networking/veilid.nix
index e5e32d78a245..f04677f1a3cd 100644
--- a/nixos/modules/services/networking/veilid.nix
+++ b/nixos/modules/services/networking/veilid.nix
@@ -2,7 +2,7 @@
 with lib;
 let
   cfg = config.services.veilid;
-  dataDir = "/var/lib/veilid";
+  dataDir = "/var/db/veilid-server";
 
   settingsFormat = pkgs.formats.yaml { };
   configFile = settingsFormat.generate "veilid.yaml" cfg.settings;

From 16002b1628ed7a3accd743a6bd462f6bac3e8238 Mon Sep 17 00:00:00 2001
From: figboy9 <figboy9@tuta.io>
Date: Sat, 14 Sep 2024 18:25:26 +0900
Subject: [PATCH 07/53] fix systemd service based on veilid package

---
 nixos/modules/services/networking/veilid.nix | 80 ++++++++++++++------
 1 file changed, 57 insertions(+), 23 deletions(-)

diff --git a/nixos/modules/services/networking/veilid.nix b/nixos/modules/services/networking/veilid.nix
index f04677f1a3cd..90f2e2556ae2 100644
--- a/nixos/modules/services/networking/veilid.nix
+++ b/nixos/modules/services/networking/veilid.nix
@@ -5,40 +5,66 @@ let
   dataDir = "/var/db/veilid-server";
 
   settingsFormat = pkgs.formats.yaml { };
-  configFile = settingsFormat.generate "veilid.yaml" cfg.settings;
+  configFile = settingsFormat.generate "veilid-server.conf" cfg.settings;
 in {
   config = mkIf cfg.enable {
     networking.firewall = mkIf cfg.openFirewall {
-        allowedTCPPorts = [ 5150 ];
-        allowedUDPPorts = [ 5150 ];
+      allowedTCPPorts = [ 5150 ];
+      allowedUDPPorts = [ 5150 ];
     };
 
+    # Based on https://gitlab.com/veilid/veilid/-/blob/main/package/systemd/veilid-server.service?ref_type=heads
     systemd.services.veilid = {
       enable = true;
-      description = "Veilid Network Service";
-      after = [ "network-pre.target" ];
-      wants = [ "network.target" ];
-      before = [ "network.target" ];
+      description = "Veilid Headless Node";
+      wants = [ "network-online.target" ];
+      before = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ configFile ];
-      environment = { HOME = dataDir; };
+      environment = { RUST_BACKTRACE = "1"; };
       serviceConfig = {
-        User = "veilid";
-        Restart = "always";
-        StateDirectory = "veilid";
-        RuntimeDirectory = "veilid";
         ExecStart = "${pkgs.veilid}/bin/veilid-server -c ${configFile}";
+        ExecReload = "${pkgs.coreutils}/bin/kill -s HUP $MAINPID";
+        KillSignal = "SIGQUIT";
+        TimeoutStopSec = 5;
+        WorkingDirectory = "/";
+        User = "veilid";
+        Group = "veilid";
+        UMask = "0002";
+
+        CapabilityBoundingSet = "";
+        SystemCallFilter = [ "@system-service" ];
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectHome = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ReadWritePaths = dataDir;
+
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        LockPersonality = true;
+        RestrictSUIDSGID = true;
       };
     };
-    users.users.veilid = { isSystemUser = true; };
-
-    users.users.veilid.group = "veilid";
+    users.users.veilid = {
+      isSystemUser = true;
+      group = "veilid";
+      home = dataDir;
+      createHome = true;
+    };
     users.groups.veilid = { };
 
-    environment = {
-      etc."veilid/veilid-server.conf".source = configFile;
-      systemPackages = [ pkgs.veilid ];
-    };
+    environment = { systemPackages = [ pkgs.veilid ]; };
+    services.veilid.settings = { };
   };
 
   options.services.veilid = {
@@ -79,6 +105,7 @@ in {
               level = mkOption {
                 type = types.str;
                 default = "info";
+                example = "debug";
                 description =
                   "The minimum priority of system events to be logged.";
               };
@@ -92,6 +119,7 @@ in {
               level = mkOption {
                 type = types.str;
                 default = "info";
+                example = "debug";
                 description =
                   "The minimum priority of terminal events to be logged.";
               };
@@ -105,6 +133,7 @@ in {
               level = mkOption {
                 type = types.str;
                 default = "info";
+                example = "debug";
                 description =
                   "The minimum priority of api events to be logged.";
               };
@@ -115,6 +144,7 @@ in {
               disable = mkOption {
                 type = types.listOf types.str;
                 default = [ ];
+                example = [ "APPM" ];
                 description =
                   "A list of capabilities to disable (for example, DHTV to say you cannot store DHT information).";
               };
@@ -156,13 +186,17 @@ in {
               };
             };
             network = {
-            routing_table = {
+              routing_table = {
                 bootstrap = mkOption {
                   type = types.listOf types.str;
-                default = [ "bootstrap.veilid.net" ];
+                  default = [ "bootstrap.veilid.net" ];
                   description =
                     "Host name of existing well-known Veilid bootstrap servers for the network to connect to.";
                 };
+                node_id = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                };
               };
               dht = {
                 min_peer_count = mkOption {
@@ -174,13 +208,13 @@ in {
               };
               upnp = mkOption {
                 type = types.bool;
-                  default = true;
+                default = true;
                 description =
                   "Should the app try to improve its incoming network connectivity using UPnP?";
               };
               detect_address_changes = mkOption {
                 type = types.bool;
-                  default = true;
+                default = true;
                 description =
                   "Should veilid-core detect and notify on network address changes?";
               };

From a01561ab26fd18602577f5d5d38a40b36929eb06 Mon Sep 17 00:00:00 2001
From: figboy9 <figboy9@tuta.io>
Date: Sun, 15 Sep 2024 10:35:52 +0900
Subject: [PATCH 08/53] nixos/veilid: add a description of options

---
 nixos/modules/services/networking/veilid.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nixos/modules/services/networking/veilid.nix b/nixos/modules/services/networking/veilid.nix
index 90f2e2556ae2..82e242144311 100644
--- a/nixos/modules/services/networking/veilid.nix
+++ b/nixos/modules/services/networking/veilid.nix
@@ -93,6 +93,7 @@ in {
             ipc_directory = mkOption {
               type = types.str;
               default = "${dataDir}/ipc";
+              description = "IPC directory where file sockets are stored.";
             };
           };
           logging = {
@@ -196,6 +197,8 @@ in {
                 node_id = lib.mkOption {
                   type = lib.types.nullOr lib.types.str;
                   default = null;
+                  description =
+                    "Base64-encoded public key for the node, used as the node's ID.";
                 };
               };
               dht = {

From ca5cb00a4cfc8505a637527b7ebc8f342a4c7eeb Mon Sep 17 00:00:00 2001
From: figboy9 <figboy9@tuta.io>
Date: Sun, 15 Sep 2024 10:37:36 +0900
Subject: [PATCH 09/53] nixos/veilid: format with nixfmt-rfc-style

---
 nixos/modules/services/networking/veilid.nix | 63 +++++++++-----------
 1 file changed, 29 insertions(+), 34 deletions(-)

diff --git a/nixos/modules/services/networking/veilid.nix b/nixos/modules/services/networking/veilid.nix
index 82e242144311..d0d411bcec48 100644
--- a/nixos/modules/services/networking/veilid.nix
+++ b/nixos/modules/services/networking/veilid.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 with lib;
 let
   cfg = config.services.veilid;
@@ -6,7 +11,8 @@ let
 
   settingsFormat = pkgs.formats.yaml { };
   configFile = settingsFormat.generate "veilid-server.conf" cfg.settings;
-in {
+in
+{
   config = mkIf cfg.enable {
     networking.firewall = mkIf cfg.openFirewall {
       allowedTCPPorts = [ 5150 ];
@@ -21,7 +27,9 @@ in {
       before = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ configFile ];
-      environment = { RUST_BACKTRACE = "1"; };
+      environment = {
+        RUST_BACKTRACE = "1";
+      };
       serviceConfig = {
         ExecStart = "${pkgs.veilid}/bin/veilid-server -c ${configFile}";
         ExecReload = "${pkgs.coreutils}/bin/kill -s HUP $MAINPID";
@@ -63,7 +71,9 @@ in {
     };
     users.groups.veilid = { };
 
-    environment = { systemPackages = [ pkgs.veilid ]; };
+    environment = {
+      systemPackages = [ pkgs.veilid ];
+    };
     services.veilid.settings = { };
   };
 
@@ -87,8 +97,7 @@ in {
             ipc_enabled = mkOption {
               type = types.bool;
               default = true;
-              description =
-                "veilid-server will respond to Python and other JSON client requests.";
+              description = "veilid-server will respond to Python and other JSON client requests.";
             };
             ipc_directory = mkOption {
               type = types.str;
@@ -107,8 +116,7 @@ in {
                 type = types.str;
                 default = "info";
                 example = "debug";
-                description =
-                  "The minimum priority of system events to be logged.";
+                description = "The minimum priority of system events to be logged.";
               };
             };
             terminal = {
@@ -121,8 +129,7 @@ in {
                 type = types.str;
                 default = "info";
                 example = "debug";
-                description =
-                  "The minimum priority of terminal events to be logged.";
+                description = "The minimum priority of terminal events to be logged.";
               };
             };
             api = {
@@ -135,8 +142,7 @@ in {
                 type = types.str;
                 default = "info";
                 example = "debug";
-                description =
-                  "The minimum priority of api events to be logged.";
+                description = "The minimum priority of api events to be logged.";
               };
             };
           };
@@ -146,44 +152,38 @@ in {
                 type = types.listOf types.str;
                 default = [ ];
                 example = [ "APPM" ];
-                description =
-                  "A list of capabilities to disable (for example, DHTV to say you cannot store DHT information).";
+                description = "A list of capabilities to disable (for example, DHTV to say you cannot store DHT information).";
               };
             };
             protected_store = {
               allow_insecure_fallback = mkOption {
                 type = types.bool;
                 default = true;
-                description =
-                  "If we can't use system-provided secure storage, should we proceed anyway?";
+                description = "If we can't use system-provided secure storage, should we proceed anyway?";
               };
               always_use_insecure_storage = mkOption {
                 type = types.bool;
                 default = true;
-                description =
-                  "Should we bypass any attempt to use system-provided secure storage?";
+                description = "Should we bypass any attempt to use system-provided secure storage?";
               };
               directory = mkOption {
                 type = types.str;
                 default = "${dataDir}/protected_store";
-                description =
-                  "The filesystem directory to store your protected store in.";
+                description = "The filesystem directory to store your protected store in.";
               };
             };
             table_store = {
               directory = mkOption {
                 type = types.str;
                 default = "${dataDir}/table_store";
-                description =
-                  "The filesystem directory to store your table store within.";
+                description = "The filesystem directory to store your table store within.";
               };
             };
             block_store = {
               directory = mkOption {
                 type = types.nullOr types.str;
                 default = "${dataDir}/block_store";
-                description =
-                  "The filesystem directory to store blocks for the block store.";
+                description = "The filesystem directory to store blocks for the block store.";
               };
             };
             network = {
@@ -191,35 +191,30 @@ in {
                 bootstrap = mkOption {
                   type = types.listOf types.str;
                   default = [ "bootstrap.veilid.net" ];
-                  description =
-                    "Host name of existing well-known Veilid bootstrap servers for the network to connect to.";
+                  description = "Host name of existing well-known Veilid bootstrap servers for the network to connect to.";
                 };
                 node_id = lib.mkOption {
                   type = lib.types.nullOr lib.types.str;
                   default = null;
-                  description =
-                    "Base64-encoded public key for the node, used as the node's ID.";
+                  description = "Base64-encoded public key for the node, used as the node's ID.";
                 };
               };
               dht = {
                 min_peer_count = mkOption {
                   type = types.number;
                   default = 20;
-                  description =
-                    "Minimum number of nodes to keep in the peer table.";
+                  description = "Minimum number of nodes to keep in the peer table.";
                 };
               };
               upnp = mkOption {
                 type = types.bool;
                 default = true;
-                description =
-                  "Should the app try to improve its incoming network connectivity using UPnP?";
+                description = "Should the app try to improve its incoming network connectivity using UPnP?";
               };
               detect_address_changes = mkOption {
                 type = types.bool;
                 default = true;
-                description =
-                  "Should veilid-core detect and notify on network address changes?";
+                description = "Should veilid-core detect and notify on network address changes?";
               };
             };
           };

From 1dba027ae97a0ec3d19826f913c7235546c19442 Mon Sep 17 00:00:00 2001
From: figboy9 <figboy9@tuta.io>
Date: Sun, 15 Sep 2024 10:40:44 +0900
Subject: [PATCH 10/53] nixos/veilid: format module-list with nixfmt-rfc-style

---
 nixos/modules/module-list.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 370e7b761443..26fdff93e98d 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1695,7 +1695,9 @@
   ./virtualisation/xe-guest-utilities.nix
   ./virtualisation/xen-dom0.nix
   {
-    documentation.nixos.extraModules =
-      [ ./virtualisation/qemu-vm.nix ./image/repart.nix ];
+    documentation.nixos.extraModules = [
+      ./virtualisation/qemu-vm.nix
+      ./image/repart.nix
+    ];
   }
 ]

From 3fc34aa9115281c14c80d09a77ad8985e256461a Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 17 Sep 2024 09:30:02 +0300
Subject: [PATCH 11/53] tzupdate: use less with lib; make src rev accurate

---
 pkgs/applications/misc/tzupdate/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/misc/tzupdate/default.nix b/pkgs/applications/misc/tzupdate/default.nix
index c991a71e9c0a..1d29d0948103 100644
--- a/pkgs/applications/misc/tzupdate/default.nix
+++ b/pkgs/applications/misc/tzupdate/default.nix
@@ -11,18 +11,18 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "cdown";
     repo = "tzupdate";
-    rev = version;
+    rev = "refs/tags/${version}";
     hash = "sha256-eod4yFzX7pATNQmG7jU+r9mnC9nprJ55ufMXpKjw/YI=";
   };
 
   cargoHash = "sha256-5+lp5xlwJxFDqzVxptJPX7z0iLoMkgdwHxvRVIXHF7Y=";
 
-  meta = with lib; {
+  meta = {
     description = "Set the system timezone based on IP geolocation";
     homepage = "https://github.com/cdown/tzupdate";
-    license = licenses.mit;
-    maintainers = with maintainers; [ camillemndn ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ camillemndn ];
+    platforms = lib.platforms.linux;
     mainProgram = "tzupdate";
   };
 }

From 94892f8f20c1312589ca59426a042642e563af45 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 17 Sep 2024 09:30:19 +0300
Subject: [PATCH 12/53] tzupdate: add doronbehar to maintainers

---
 nixos/modules/services/misc/tzupdate.nix    | 2 +-
 pkgs/applications/misc/tzupdate/default.nix | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/misc/tzupdate.nix b/nixos/modules/services/misc/tzupdate.nix
index be63bb179e42..e9f086a2ad78 100644
--- a/nixos/modules/services/misc/tzupdate.nix
+++ b/nixos/modules/services/misc/tzupdate.nix
@@ -41,5 +41,5 @@ in {
     };
   };
 
-  meta.maintainers = [ ];
+  meta.maintainers = with lib.maintainers; [ doronbehar ];
 }
diff --git a/pkgs/applications/misc/tzupdate/default.nix b/pkgs/applications/misc/tzupdate/default.nix
index 1d29d0948103..adfb93fb0246 100644
--- a/pkgs/applications/misc/tzupdate/default.nix
+++ b/pkgs/applications/misc/tzupdate/default.nix
@@ -21,7 +21,10 @@ rustPlatform.buildRustPackage rec {
     description = "Set the system timezone based on IP geolocation";
     homepage = "https://github.com/cdown/tzupdate";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ camillemndn ];
+    maintainers = with lib.maintainers; [
+      camillemndn
+      doronbehar
+    ];
     platforms = lib.platforms.linux;
     mainProgram = "tzupdate";
   };

From 8efaf0d2d6ae01cdafe9de714ab803d9eaec2aca Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 17 Sep 2024 09:30:55 +0300
Subject: [PATCH 13/53] nixos/tzupdate: use timedatectl to actually set the
 timezone

See also: https://github.com/cdown/tzupdate/issues/135
---
 nixos/modules/services/misc/tzupdate.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/misc/tzupdate.nix b/nixos/modules/services/misc/tzupdate.nix
index e9f086a2ad78..9e979bb47675 100644
--- a/nixos/modules/services/misc/tzupdate.nix
+++ b/nixos/modules/services/misc/tzupdate.nix
@@ -30,13 +30,12 @@ in {
       description = "tzupdate timezone update service";
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
+      script = ''
+        timedatectl set-timezone $(${lib.getExe pkgs.tzupdate} --print-only)
+      '';
 
       serviceConfig = {
         Type = "oneshot";
-        # We could link directly into pkgs.tzdata, but at least timedatectl seems
-        # to expect the symlink to point directly to a file in etc.
-        # Setting the "debian timezone file" to point at /dev/null stops it doing anything.
-        ExecStart = "${pkgs.tzupdate}/bin/tzupdate -z /etc/zoneinfo -d /dev/null";
       };
     };
   };

From 56f8f810aeedd2b03c4bc390f714875fe522e93a Mon Sep 17 00:00:00 2001
From: figboy9 <figboy9@tuta.io>
Date: Mon, 23 Sep 2024 13:30:38 +0900
Subject: [PATCH 14/53] nixos/veilid: fix description link

---
 nixos/modules/services/networking/veilid.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/veilid.nix b/nixos/modules/services/networking/veilid.nix
index d0d411bcec48..d471a5f61952 100644
--- a/nixos/modules/services/networking/veilid.nix
+++ b/nixos/modules/services/networking/veilid.nix
@@ -87,7 +87,7 @@ in
     settings = mkOption {
       description = ''
         Build veilid-server.conf with nix expression.
-        Check [Configuration Keys](https://veilid.gitlab.io/developer-book/admin/config.html#configuration-keys).
+        Check <link xlink:href="https://veilid.gitlab.io/developer-book/admin/config.html#configuration-keys">Configuration Keys</link>.
       '';
       type = types.submodule {
         freeformType = settingsFormat.type;

From 08d1584a0b8e74b00d9fb4972283e2ac6dc82f4d Mon Sep 17 00:00:00 2001
From: Konrad Malik <konrad.malik@gmail.com>
Date: Mon, 23 Sep 2024 14:13:13 +0200
Subject: [PATCH 15/53] usage: init at 0.3.1

---
 pkgs/by-name/us/usage/package.nix | 36 +++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 pkgs/by-name/us/usage/package.nix

diff --git a/pkgs/by-name/us/usage/package.nix b/pkgs/by-name/us/usage/package.nix
new file mode 100644
index 000000000000..96406b363602
--- /dev/null
+++ b/pkgs/by-name/us/usage/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  usage,
+  testers,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "jdx";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "jdx";
+    repo = "usage";
+    rev = "v${version}";
+    hash = "sha256-9zQ+gkBVhzjqSIieGjxoD9vc7999lfRQ7awkvlEkseE=";
+  };
+
+  cargoHash = "sha256-4ebjD1Tf7F2YyNrF7eEi2yKonctprnyu4nMf+vE2whY=";
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion { package = usage; };
+  };
+
+  meta = {
+    homepage = "https://usage.jdx.dev";
+    description = "Specification for CLIs";
+    changelog = "https://github.com/jdx/usage/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ konradmalik ];
+    mainProgram = "usage";
+  };
+}

From 127ee2dce6bbda65504dc4519a598ff27be05aa5 Mon Sep 17 00:00:00 2001
From: rewine <luhongxu@deepin.org>
Date: Thu, 26 Sep 2024 21:25:56 +0800
Subject: [PATCH 16/53] deepin.qt6mpris: init at 1.0.0.1-1deepin1

---
 pkgs/desktops/deepin/default.nix              |  1 +
 .../deepin/library/qt6mpris/default.nix       | 46 +++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 pkgs/desktops/deepin/library/qt6mpris/default.nix

diff --git a/pkgs/desktops/deepin/default.nix b/pkgs/desktops/deepin/default.nix
index fc8137cac857..4b350abdd1a7 100644
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@@ -38,6 +38,7 @@ let
       dtk6log = callPackage ./library/dtk6log { };
       qt6platform-plugins = callPackage ./library/qt6platform-plugins { };
       qt6integration = callPackage ./library/qt6integration { };
+      qt6mpris = callPackage ./library/qt6mpris { };
 
       #### CORE
       deepin-kwin = callPackage ./core/deepin-kwin { };
diff --git a/pkgs/desktops/deepin/library/qt6mpris/default.nix b/pkgs/desktops/deepin/library/qt6mpris/default.nix
new file mode 100644
index 000000000000..71a17256d6c1
--- /dev/null
+++ b/pkgs/desktops/deepin/library/qt6mpris/default.nix
@@ -0,0 +1,46 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  qt6Packages,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "qt6mpris";
+  version = "1.0.0.1-1deepin1";
+
+  src = fetchFromGitHub {
+    owner = "deepin-community";
+    repo = "qt6mpris";
+    rev = finalAttrs.version;
+    hash = "sha256-PCdA9q/txaL2Fbr2/4+Z7L4zxWeULl3bq8MVH3i1g3g=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/src.pro \
+      --replace-fail '$$[QT_INSTALL_LIBS]'    "$out/lib" \
+      --replace-fail '$$[QT_INSTALL_HEADERS]' "$out/include" \
+      --replace-fail '$$[QMAKE_MKSPECS]'      "$out/mkspecs"
+    substituteInPlace declarative/declarative.pro \
+      --replace-fail '$$[QT_INSTALL_QML]'     "$out/${qt6Packages.qtbase.qtQmlPrefix}"
+  '';
+
+  nativeBuildInputs = [
+    qt6Packages.qmake
+  ];
+
+  dontWrapQtApps = true;
+
+  buildInputs = [
+    qt6Packages.qtbase
+    qt6Packages.qtdeclarative
+  ];
+
+  meta = {
+    description = "Qt and QML MPRIS interface and adaptor";
+    homepage = "https://github.com/deepin-community/qt6mpris";
+    license = lib.licenses.lgpl21Plus;
+    platforms = lib.platforms.linux;
+    maintainers = lib.teams.deepin.members;
+  };
+})

From 339306e6abcd7221ebd0ed103213c4c1194bd22d Mon Sep 17 00:00:00 2001
From: rewine <luhongxu@deepin.org>
Date: Fri, 20 Sep 2024 21:02:17 +0800
Subject: [PATCH 17/53] deepin.deepin-music: 7.0.3 -> 7.0.9

---
 .../deepin/apps/deepin-music/default.nix      | 51 +++++++++----------
 1 file changed, 24 insertions(+), 27 deletions(-)

diff --git a/pkgs/desktops/deepin/apps/deepin-music/default.nix b/pkgs/desktops/deepin/apps/deepin-music/default.nix
index 16dc19831085..9013306af657 100644
--- a/pkgs/desktops/deepin/apps/deepin-music/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-music/default.nix
@@ -4,18 +4,14 @@
   fetchFromGitHub,
   cmake,
   pkg-config,
-  qttools,
-  wrapQtAppsHook,
-  dtkwidget,
-  dtkdeclarative,
-  qt5integration,
-  qt5platform-plugins,
-  udisks2-qt5,
-  qtmpris,
-  qtmultimedia,
-  kcodecs,
+  dtk6widget,
+  dtk6declarative,
+  qt6integration,
+  qt6platform-plugins,
+  qt6mpris,
   ffmpeg,
   libvlc,
+  qt6Packages,
   taglib,
   SDL2,
   gst_all_1,
@@ -23,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "deepin-music";
-  version = "7.0.3";
+  version = "7.0.9";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    hash = "sha256-MLfkSO8ru8MKiwgiQ0mPO3zGlnIeSHPc0Op5jjzJ6PE=";
+    hash = "sha256-tj0XICmp7sM2m6aSf/DgxS7JXO3Wy/83sZIPGV17gFo=";
   };
 
   patches = [ "${src}/patches/fix-library-path.patch" ];
@@ -37,20 +33,20 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    qttools
-    wrapQtAppsHook
+    qt6Packages.qttools
+    qt6Packages.wrapQtAppsHook
   ];
 
   buildInputs =
     [
-      dtkwidget
-      dtkdeclarative
-      qt5integration
-      qt5platform-plugins
-      udisks2-qt5
-      qtmpris
-      qtmultimedia
-      kcodecs
+      dtk6widget
+      dtk6declarative
+      qt6integration
+      qt6platform-plugins
+      qt6mpris
+      qt6Packages.qtbase
+      qt6Packages.qt5compat
+      qt6Packages.qtmultimedia
       ffmpeg
       libvlc
       taglib
@@ -69,18 +65,19 @@ stdenv.mkDerivation rec {
     "-I${libvlc}/include/vlc"
   ];
 
-  strictDeps = true;
+  # qtmultimedia can't not be found with strictDeps
+  strictDeps = false;
 
   preFixup = ''
     qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Awesome music player with brilliant and tweakful UI Deepin-UI based";
     mainProgram = "deepin-music";
     homepage = "https://github.com/linuxdeepin/deepin-music";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    maintainers = teams.deepin.members;
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = lib.teams.deepin.members;
   };
 }

From 730cdcdef79333644d6c2f63f5416c75914ee7f9 Mon Sep 17 00:00:00 2001
From: Michael Hoang <enzime@users.noreply.github.com>
Date: Fri, 27 Sep 2024 11:37:07 +0700
Subject: [PATCH 18/53] haskellPackages.hnix-store-core_0_8_0_0: fix build

---
 pkgs/development/haskell-modules/configuration-common.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 3abbd578e5c4..068098a2b156 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -593,6 +593,10 @@ self: super: {
   # Too strict bounds on algebraic-graphs
   # https://github.com/haskell-nix/hnix-store/issues/180
   hnix-store-core_0_6_1_0 = doJailbreak super.hnix-store-core_0_6_1_0;
+
+  # 2024-09-27: dependent-sum-template pinned to 0.1.1.1, however 0.2.0.1+ required
+  hnix-store-core_0_8_0_0 = super.hnix-store-core_0_8_0_0.override { dependent-sum-template = self.dependent-sum-template_0_2_0_1; };
+
   # 2023-12-11: Needs older core
   hnix-store-remote = super.hnix-store-remote.override { hnix-store-core = self.hnix-store-core_0_6_1_0; };
 

From 8315dc67e269b6bbc9f9a6ccd219fea721d803e1 Mon Sep 17 00:00:00 2001
From: qubitnano <146656568+qubitnano@users.noreply.github.com>
Date: Sun, 14 Jul 2024 16:16:23 -0400
Subject: [PATCH 19/53] mongodb-7_0: init at 7.0.14

---
 pkgs/servers/nosql/mongodb/7.0.nix            | 37 +++++++++++
 pkgs/servers/nosql/mongodb/mongodb.nix        | 11 +++-
 .../nosql/mongodb/mongodb7-SConstruct.patch   | 63 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               | 13 ++++
 4 files changed, 122 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/servers/nosql/mongodb/7.0.nix
 create mode 100644 pkgs/servers/nosql/mongodb/mongodb7-SConstruct.patch

diff --git a/pkgs/servers/nosql/mongodb/7.0.nix b/pkgs/servers/nosql/mongodb/7.0.nix
new file mode 100644
index 000000000000..ec7136119472
--- /dev/null
+++ b/pkgs/servers/nosql/mongodb/7.0.nix
@@ -0,0 +1,37 @@
+{
+  stdenv,
+  callPackage,
+  sasl,
+  boost,
+  Security,
+  CoreFoundation,
+  cctools,
+  avxSupport ? stdenv.hostPlatform.avxSupport,
+}:
+
+let
+  buildMongoDB = callPackage ./mongodb.nix {
+    inherit
+      sasl
+      boost
+      Security
+      CoreFoundation
+      cctools
+      stdenv
+      ;
+  };
+in
+buildMongoDB {
+  inherit avxSupport;
+  version = "7.0.14";
+  sha256 = "sha256-3NUv/Rr6V0rH6zHCXJwHZ7ZQOqMJvYGessNVemUF6g0=";
+  patches = [
+    # ModuleNotFoundError: No module named 'mongo_tooling_metrics':
+    # NameError: name 'SConsToolingMetrics' is not defined:
+    # The recommended linker 'lld' is not supported with the current compiler configuration, you can try the 'gold' linker with '--linker=gold'.
+    ./mongodb7-SConstruct.patch
+
+    # Fix building with python 3.12 since the imp module was removed
+    ./mongodb-python312.patch
+  ];
+}
diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index f90695934121..5836a925498f 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -4,6 +4,7 @@
 , buildPackages
 , boost
 , gperftools
+, pcre2
 , pcre-cpp
 , snappy
 , zlib
@@ -48,7 +49,6 @@ let
 
   system-libraries = [
     "boost"
-    "pcre"
     "snappy"
     "yaml"
     "zlib"
@@ -56,7 +56,13 @@ let
     #"stemmer"  -- not nice to package yet (no versioning, no makefile, no shared libs).
     #"valgrind" -- mongodb only requires valgrind.h, which is vendored in the source.
     #"wiredtiger"
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ "tcmalloc" ];
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ "tcmalloc" ]
+    ++ lib.optionals (lib.versionOlder version "7.0") [
+      "pcre"
+    ]
+    ++ lib.optionals (lib.versionAtLeast version "7.0") [
+      "pcre2"
+    ];
   inherit (lib) systems subtractLists;
 
 in stdenv.mkDerivation rec {
@@ -83,6 +89,7 @@ in stdenv.mkDerivation rec {
     yaml-cpp
     openssl
     openldap
+    pcre2
     pcre-cpp
     sasl
     snappy
diff --git a/pkgs/servers/nosql/mongodb/mongodb7-SConstruct.patch b/pkgs/servers/nosql/mongodb/mongodb7-SConstruct.patch
new file mode 100644
index 000000000000..e5489ea38dfd
--- /dev/null
+++ b/pkgs/servers/nosql/mongodb/mongodb7-SConstruct.patch
@@ -0,0 +1,63 @@
+diff --git a/SConstruct b/SConstruct
+index 07579349b83..68a26f26a49 100644
+--- a/SConstruct
++++ b/SConstruct
+@@ -23,7 +23,6 @@ from pkg_resources import parse_version
+ 
+ import SCons
+ import SCons.Script
+-from mongo_tooling_metrics.lib.top_level_metrics import SConsToolingMetrics
+ from site_scons.mongo import build_profiles
+ 
+ # This must be first, even before EnsureSConsVersion, if
+@@ -1653,16 +1652,6 @@ env = Environment(variables=env_vars, **envDict)
+ del envDict
+ env.AddMethod(lambda env, name, **kwargs: add_option(name, **kwargs), 'AddOption')
+ 
+-# The placement of this is intentional. Here we setup an atexit method to store tooling metrics.
+-# We should only register this function after env, env_vars and the parser have been properly initialized.
+-SConsToolingMetrics.register_metrics(
+-    utc_starttime=datetime.utcnow(),
+-    artifact_dir=env.Dir('$BUILD_DIR').get_abspath(),
+-    env_vars=env_vars,
+-    env=env,
+-    parser=_parser,
+-)
+-
+ if get_option('build-metrics'):
+     env['BUILD_METRICS_ARTIFACTS_DIR'] = '$BUILD_ROOT/$VARIANT_DIR'
+     env.Tool('build_metrics')
+@@ -3549,33 +3538,6 @@ def doConfigure(myenv):
+         myenv.AddMethod(
+             functools.partial(var_func, var=var, func=CheckFlag), f"Check{var}Supported")
+ 
+-    if myenv.ToolchainIs('gcc', 'clang'):
+-        # This tells clang/gcc to use the gold linker if it is available - we prefer the gold linker
+-        # because it is much faster. Don't use it if the user has already configured another linker
+-        # selection manually.
+-        if any(flag.startswith('-fuse-ld=') for flag in env['LINKFLAGS']):
+-            myenv.FatalError(
+-                f"Use the '--linker' option instead of modifying the LINKFLAGS directly.")
+-
+-        linker_ld = get_option('linker')
+-        if linker_ld == 'auto':
+-            if not env.TargetOSIs('darwin', 'macOS'):
+-                if not myenv.AddToLINKFLAGSIfSupported('-fuse-ld=lld'):
+-                    myenv.FatalError(
+-                        f"The recommended linker 'lld' is not supported with the current compiler configuration, you can try the 'gold' linker with '--linker=gold'."
+-                    )
+-        elif link_model.startswith("dynamic") and linker_ld == 'bfd':
+-            # BFD is not supported due to issues with it causing warnings from some of
+-            # the third party libraries that mongodb is linked with:
+-            # https://jira.mongodb.org/browse/SERVER-49465
+-            myenv.FatalError(f"Linker {linker_ld} is not supported with dynamic link model builds.")
+-        else:
+-            if not myenv.AddToLINKFLAGSIfSupported(f'-fuse-ld={linker_ld}'):
+-                myenv.FatalError(f"Linker {linker_ld} could not be configured.")
+-
+-        if has_option('gcov') and myenv.AddToCCFLAGSIfSupported('-fprofile-update=single'):
+-            myenv.AppendUnique(LINKFLAGS=['-fprofile-update=single'])
+-
+     detectCompiler = Configure(
+         myenv,
+         help=False,
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3d80d39bedd7..c6d23a02db4b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -25034,6 +25034,19 @@ with pkgs;
       if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
   };
 
+  mongodb-7_0 = darwin.apple_sdk_11_0.callPackage ../servers/nosql/mongodb/7.0.nix {
+    sasl = cyrus_sasl;
+    boost = boost179.override { enableShared = false; };
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
+    stdenv = if stdenv.hostPlatform.isDarwin then
+      darwin.apple_sdk_11_0.stdenv.override (old: {
+        hostPlatform = old.hostPlatform // { darwinMinVersion = "10.14"; };
+        buildPlatform = old.buildPlatform // { darwinMinVersion = "10.14"; };
+        targetPlatform = old.targetPlatform // { darwinMinVersion = "10.14"; };
+      }) else
+      if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
+  };
+
   immudb = callPackage ../servers/nosql/immudb { };
 
   influxdb = callPackage ../servers/nosql/influxdb { };

From 24524c1cf38fdb016b0917771bbd8c2acd6a5060 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Sat, 28 Sep 2024 13:11:25 -0400
Subject: [PATCH 20/53] cdist: drop explicitly added pythonImportsCheckHook

---
 pkgs/tools/admin/cdist/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/tools/admin/cdist/default.nix b/pkgs/tools/admin/cdist/default.nix
index 8467605727c9..a84eeb4a1a27 100644
--- a/pkgs/tools/admin/cdist/default.nix
+++ b/pkgs/tools/admin/cdist/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonApplication
 , fetchFromGitea
-, pythonImportsCheckHook
 , six
 , sphinxHook
 , sphinx-rtd-theme
@@ -21,7 +20,6 @@ buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    pythonImportsCheckHook
     six
     sphinxHook
     sphinx-rtd-theme

From 14ff4058cf40ccff20a92140d3e7f084266014cc Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Sat, 28 Sep 2024 13:15:42 -0400
Subject: [PATCH 21/53] python312Packages.cffconvert: fix typo
 pythonImportsCheckHook -> pythonImportsCheck

---
 pkgs/development/python-modules/cffconvert/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/cffconvert/default.nix b/pkgs/development/python-modules/cffconvert/default.nix
index befd378ac31d..c7dba79bb5cb 100644
--- a/pkgs/development/python-modules/cffconvert/default.nix
+++ b/pkgs/development/python-modules/cffconvert/default.nix
@@ -44,7 +44,7 @@ buildPythonPackage rec {
     "tests/cli/test_rawify_url.py"
   ];
 
-  pythonImportsCheckHook = [ "cffconvert" ];
+  pythonImportsCheck = [ "cffconvert" ];
 
   meta = {
     changelog = "https://github.com/citation-file-format/cffconvert/blob/${src.rev}/CHANGELOG.md";

From 2dd770f56f2d6eb75389f98015f11a39e48716e5 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Sat, 28 Sep 2024 13:16:51 -0400
Subject: [PATCH 22/53] python312Packages.vharfbuzz: drop explicitly added
 pythonImportsCheckHook

---
 pkgs/development/python-modules/vharfbuzz/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/vharfbuzz/default.nix b/pkgs/development/python-modules/vharfbuzz/default.nix
index 5d41a3a2e57b..e822dacb633a 100644
--- a/pkgs/development/python-modules/vharfbuzz/default.nix
+++ b/pkgs/development/python-modules/vharfbuzz/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   fonttools,
-  pythonImportsCheckHook,
   uharfbuzz,
 }:
 
@@ -21,7 +20,6 @@ buildPythonPackage rec {
     fonttools
     uharfbuzz
   ];
-  nativeBuildInputs = [ pythonImportsCheckHook ];
 
   # Package has no tests.
   doCheck = false;

From 19402d25f33be1b3fdb06bb6a8d584051fedf5c2 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Sat, 28 Sep 2024 13:17:46 -0400
Subject: [PATCH 23/53] python312Packages.stringbrewer: drop explicitly added
 pythonImportsCheckHook

---
 pkgs/development/python-modules/stringbrewer/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/stringbrewer/default.nix b/pkgs/development/python-modules/stringbrewer/default.nix
index 8b79efd7be55..9b5fe137e087 100644
--- a/pkgs/development/python-modules/stringbrewer/default.nix
+++ b/pkgs/development/python-modules/stringbrewer/default.nix
@@ -4,7 +4,6 @@
   fetchPypi,
   rstr,
   sre-yield,
-  pythonImportsCheckHook,
 }:
 
 buildPythonPackage rec {
@@ -21,7 +20,6 @@ buildPythonPackage rec {
     rstr
     sre-yield
   ];
-  nativeBuildInputs = [ pythonImportsCheckHook ];
 
   # Package has no tests
   doCheck = false;

From 53803e36c824e85ba28e76d3f71a30f17a01d355 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Sat, 28 Sep 2024 13:19:35 -0400
Subject: [PATCH 24/53] python312Packages.sphinx-hoverxref: drop explicitly
 added pythonImportsCheckHook

---
 pkgs/development/python-modules/sphinx-hoverxref/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/sphinx-hoverxref/default.nix b/pkgs/development/python-modules/sphinx-hoverxref/default.nix
index 643e3111311d..903005d0df9a 100644
--- a/pkgs/development/python-modules/sphinx-hoverxref/default.nix
+++ b/pkgs/development/python-modules/sphinx-hoverxref/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   flit-core,
-  pythonImportsCheckHook,
   # documentation build dependencies
   sphinxHook,
   sphinx-notfound-page,
@@ -37,7 +36,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     flit-core
-    pythonImportsCheckHook
 
     sphinxHook
     sphinx-notfound-page

From d7be485798cda6edf2057c852546b1a610896712 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Sat, 28 Sep 2024 13:20:38 -0400
Subject: [PATCH 25/53] python312Packages.sphinx-version-warning: drop
 explicitly added pythonImportsCheckHook

---
 .../python-modules/sphinx-version-warning/default.nix           | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/sphinx-version-warning/default.nix b/pkgs/development/python-modules/sphinx-version-warning/default.nix
index 6856bcd4fee7..771b674c18de 100644
--- a/pkgs/development/python-modules/sphinx-version-warning/default.nix
+++ b/pkgs/development/python-modules/sphinx-version-warning/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   fetchpatch,
-  pythonImportsCheckHook,
   pythonOlder,
   setuptools,
   sphinx,
@@ -47,7 +46,6 @@ buildPythonPackage {
   ];
 
   nativeBuildInputs = [
-    pythonImportsCheckHook
     sphinx-autoapi
     sphinx-prompt
     sphinx-rtd-theme

From 742e50c7f155064a562301cf0e068ddee0151833 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Sat, 28 Sep 2024 13:21:30 -0400
Subject: [PATCH 26/53] python312Packages.sphinx-notfound-page: drop explicitly
 added pythonImportsCheckHook

---
 .../development/python-modules/sphinx-notfound-page/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/sphinx-notfound-page/default.nix b/pkgs/development/python-modules/sphinx-notfound-page/default.nix
index 58c81240c42a..93e7662214ef 100644
--- a/pkgs/development/python-modules/sphinx-notfound-page/default.nix
+++ b/pkgs/development/python-modules/sphinx-notfound-page/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   flit-core,
-  pythonImportsCheckHook,
   pythonOlder,
   # documentation build dependencies
   sphinxHook,
@@ -38,7 +37,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     flit-core
-    pythonImportsCheckHook
     sphinxHook
     sphinx-prompt
     sphinx-rtd-theme

From 5d0617ac822c69fa4dbc7699b67885edc4f8e2bc Mon Sep 17 00:00:00 2001
From: Alexandre Acebedo <alexandre@acebedo.fr>
Date: Sun, 15 Sep 2024 16:01:08 +0200
Subject: [PATCH 27/53] hyprlandPlugins.hyprsplit: init at 0.43.0

---
 .../hyprwm/hyprland-plugins/default.nix       |  1 +
 .../hyprwm/hyprland-plugins/hyprsplit.nix     | 34 +++++++++++++++++++
 2 files changed, 35 insertions(+)
 create mode 100644 pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix

diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix
index 2970e724b3fd..91f57ad526d9 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix
@@ -32,6 +32,7 @@ let
     { hyprgrass = import ./hyprgrass.nix; }
     { hyprscroller = import ./hyprscroller.nix; }
     { hyprspace = import ./hyprspace.nix; }
+    { hyprsplit = import ./hyprsplit.nix; }
     (import ./hyprland-plugins.nix)
   ];
 in
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix
new file mode 100644
index 000000000000..13e51037fc9c
--- /dev/null
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  meson,
+  fetchFromGitHub,
+  hyprland,
+  ninja,
+  mkHyprlandPlugin,
+}:
+mkHyprlandPlugin hyprland rec {
+  pluginName = "hyprsplit";
+  version = "0.43.0";
+
+  src = fetchFromGitHub {
+    owner = "shezdy";
+    repo = "hyprsplit";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-r533kNIyfgPi/q8ddIYyDK1Pmupt/F3ncHuFo3zjDkU=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+  ];
+
+  meta = {
+    homepage = "https://github.com/shezdy/hyprsplit";
+    description = "Hyprland plugin for awesome / dwm like workspaces";
+    license = lib.licenses.bsd3;
+    inherit (hyprland.meta) platforms;
+    maintainers = with lib.maintainers; [
+      aacebedo
+    ];
+  };
+}

From 05bd4e31cc37d102ac7f95a529e19ea0989574ae Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 28 Sep 2024 18:52:11 +0000
Subject: [PATCH 28/53] werf: 2.10.6 -> 2.10.7

---
 pkgs/by-name/we/werf/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/we/werf/package.nix b/pkgs/by-name/we/werf/package.nix
index 9f55f565d525..deafc456bab6 100644
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "2.10.6";
+  version = "2.10.7";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    hash = "sha256-TVjmPylomSp8WT2YW6x6CPkk6FinKGrGRlDEAtl8vRI=";
+    hash = "sha256-pIgBYB0EEelpNgNPAxUu2jqFoT4myru5wAu3Oobmqn8=";
   };
 
-  vendorHash = "sha256-OR2nIR2q3iRfaSQSQRKn+jbygETx2+WmkOIjOCIB9O8=";
+  vendorHash = "sha256-MSxqRU9TUYDoUoYubXPrxABwLL5gou52ia0dX7lzQ5Q=";
 
   proxyVendor = true;
 

From 7249b5cc222ad856d9335fc9ed1d2abfac19b7ad Mon Sep 17 00:00:00 2001
From: Lorenzo Manacorda <lorenzo@mailbox.org>
Date: Sat, 28 Sep 2024 22:02:39 +0200
Subject: [PATCH 29/53] gotosocial: build with kvformat tag

As done by upstream: https://github.com/superseriousbusiness/gotosocial/blob/main/scripts/build.sh#L9

This prints values better, as well as having a tiny performance benefit.
---
 pkgs/servers/gotosocial/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/servers/gotosocial/default.nix b/pkgs/servers/gotosocial/default.nix
index 3f57180795ee..56968f1f7f32 100644
--- a/pkgs/servers/gotosocial/default.nix
+++ b/pkgs/servers/gotosocial/default.nix
@@ -33,6 +33,10 @@ buildGoModule rec {
     "-X main.Version=${version}"
   ];
 
+  tags = [
+    "kvformat"
+  ];
+
   postInstall = ''
     tar xf ${web-assets}
     mkdir -p $out/share/gotosocial

From 3925d753c67c44d9432d968d6ca09f8133ff01c1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 28 Sep 2024 20:05:30 +0000
Subject: [PATCH 30/53] homepage-dashboard: 0.9.9 -> 0.9.10

---
 pkgs/servers/homepage-dashboard/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/homepage-dashboard/default.nix b/pkgs/servers/homepage-dashboard/default.nix
index f9ce34fde86e..96c58a598187 100644
--- a/pkgs/servers/homepage-dashboard/default.nix
+++ b/pkgs/servers/homepage-dashboard/default.nix
@@ -29,16 +29,16 @@ let
 in
 buildNpmPackage rec {
   pname = "homepage-dashboard";
-  version = "0.9.9";
+  version = "0.9.10";
 
   src = fetchFromGitHub {
     owner = "gethomepage";
     repo = "homepage";
     rev = "v${version}";
-    hash = "sha256-jUKXAqq6Oj8CmOuBUlsf0zDIcK+3MX/czzNDmakN9VM=";
+    hash = "sha256-qDbYgitMbjOMIZUyQuFSNAyb/ZRAcStm/jDrsIutKno=";
   };
 
-  npmDepsHash = "sha256-YjcF8FkURnTurcJ0Iq0ghv/bhu5sFA860jXrn3TkRds=";
+  npmDepsHash = "sha256-gAti4y4Ios7XjJ3nVOhzjwPzcAC2upODZ64qQjx17JE=";
 
   preBuild = ''
     mkdir -p config

From 5e83503dc011d4460523dd6c35393beb03b91523 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 28 Sep 2024 22:27:43 +0200
Subject: [PATCH 31/53] python312Packages.vllm: mark as broken

RuntimeError: Unknown runtime environment
---
 pkgs/development/python-modules/vllm/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index 3b9e6ee43487..fa5b9d848152 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -176,6 +176,8 @@ buildPythonPackage rec {
       happysalada
       lach
     ];
-    broken = !cudaSupport && !rocmSupport;
+    # RuntimeError: Unknown runtime environment
+    broken = true;
+    # broken = !cudaSupport && !rocmSupport;
   };
 }

From 6512103dfe744c6613aa9a6929835066fc5a137e Mon Sep 17 00:00:00 2001
From: Daniel Nagy <danielnagy@posteo.de>
Date: Sat, 21 Sep 2024 12:15:00 +0200
Subject: [PATCH 32/53] nixos/monero: remove `with lib;`

---
 nixos/modules/services/networking/monero.nix | 84 ++++++++++----------
 1 file changed, 41 insertions(+), 43 deletions(-)

diff --git a/nixos/modules/services/networking/monero.nix b/nixos/modules/services/networking/monero.nix
index 37a687f524b9..5cb418a9f1e6 100644
--- a/nixos/modules/services/networking/monero.nix
+++ b/nixos/modules/services/networking/monero.nix
@@ -1,12 +1,10 @@
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
   cfg     = config.services.monero;
 
   listToConf = option: list:
-    concatMapStrings (value: "${option}=${value}\n") list;
+    lib.concatMapStrings (value: "${option}=${value}\n") list;
 
   login = (cfg.rpc.user != null && cfg.rpc.password != null);
 
@@ -14,17 +12,17 @@ let
     log-file=/dev/stdout
     data-dir=${dataDir}
 
-    ${optionalString mining.enable ''
+    ${lib.optionalString mining.enable ''
       start-mining=${mining.address}
       mining-threads=${toString mining.threads}
     ''}
 
     rpc-bind-ip=${rpc.address}
     rpc-bind-port=${toString rpc.port}
-    ${optionalString login ''
+    ${lib.optionalString login ''
       rpc-login=${rpc.user}:${rpc.password}
     ''}
-    ${optionalString rpc.restricted ''
+    ${lib.optionalString rpc.restricted ''
       restricted-rpc=1
     ''}
 
@@ -50,34 +48,34 @@ in
 
     services.monero = {
 
-      enable = mkEnableOption "Monero node daemon";
+      enable = lib.mkEnableOption "Monero node daemon";
 
-      dataDir = mkOption {
-        type = types.str;
+      dataDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/lib/monero";
         description = ''
           The directory where Monero stores its data files.
         '';
       };
 
-      mining.enable = mkOption {
-        type = types.bool;
+      mining.enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to mine monero.
         '';
       };
 
-      mining.address = mkOption {
-        type = types.str;
+      mining.address = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           Monero address where to send mining rewards.
         '';
       };
 
-      mining.threads = mkOption {
-        type = types.addCheck types.int (x: x>=0);
+      mining.threads = lib.mkOption {
+        type = lib.types.addCheck lib.types.int (x: x>=0);
         default = 0;
         description = ''
           Number of threads used for mining.
@@ -85,48 +83,48 @@ in
         '';
       };
 
-      rpc.user = mkOption {
-        type = types.nullOr types.str;
+      rpc.user = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           User name for RPC connections.
         '';
       };
 
-      rpc.password = mkOption {
-        type = types.nullOr types.str;
+      rpc.password = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Password for RPC connections.
         '';
       };
 
-      rpc.address = mkOption {
-        type = types.str;
+      rpc.address = lib.mkOption {
+        type = lib.types.str;
         default = "127.0.0.1";
         description = ''
           IP address the RPC server will bind to.
         '';
       };
 
-      rpc.port = mkOption {
-        type = types.port;
+      rpc.port = lib.mkOption {
+        type = lib.types.port;
         default = 18081;
         description = ''
           Port the RPC server will bind to.
         '';
       };
 
-      rpc.restricted = mkOption {
-        type = types.bool;
+      rpc.restricted = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to restrict RPC to view only commands.
         '';
       };
 
-      limits.upload = mkOption {
-        type = types.addCheck types.int (x: x>=-1);
+      limits.upload = lib.mkOption {
+        type = lib.types.addCheck lib.types.int (x: x>=-1);
         default = -1;
         description = ''
           Limit of the upload rate in kB/s.
@@ -134,8 +132,8 @@ in
         '';
       };
 
-      limits.download = mkOption {
-        type = types.addCheck types.int (x: x>=-1);
+      limits.download = lib.mkOption {
+        type = lib.types.addCheck lib.types.int (x: x>=-1);
         default = -1;
         description = ''
           Limit of the download rate in kB/s.
@@ -143,8 +141,8 @@ in
         '';
       };
 
-      limits.threads = mkOption {
-        type = types.addCheck types.int (x: x>=0);
+      limits.threads = lib.mkOption {
+        type = lib.types.addCheck lib.types.int (x: x>=0);
         default = 0;
         description = ''
           Maximum number of threads used for a parallel job.
@@ -152,8 +150,8 @@ in
         '';
       };
 
-      limits.syncSize = mkOption {
-        type = types.addCheck types.int (x: x>=0);
+      limits.syncSize = lib.mkOption {
+        type = lib.types.addCheck lib.types.int (x: x>=0);
         default = 0;
         description = ''
           Maximum number of blocks to sync at once.
@@ -161,16 +159,16 @@ in
         '';
       };
 
-      extraNodes = mkOption {
-        type = types.listOf types.str;
+      extraNodes = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         description = ''
           List of additional peer IP addresses to add to the local list.
         '';
       };
 
-      priorityNodes = mkOption {
-        type = types.listOf types.str;
+      priorityNodes = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         description = ''
           List of peer IP addresses to connect to and
@@ -178,8 +176,8 @@ in
         '';
       };
 
-      exclusiveNodes = mkOption {
-        type = types.listOf types.str;
+      exclusiveNodes = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         description = ''
           List of peer IP addresses to connect to *only*.
@@ -187,8 +185,8 @@ in
         '';
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = ''
           Extra lines to be added verbatim to monerod configuration.
@@ -202,7 +200,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     users.users.monero = {
       isSystemUser = true;
@@ -228,7 +226,7 @@ in
       };
     };
 
-    assertions = singleton {
+    assertions = lib.singleton {
       assertion = cfg.mining.enable -> cfg.mining.address != "";
       message   = ''
        You need a Monero address to receive mining rewards:

From 36e31275ba89b2f49677cae7d24d8aa95ed39953 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 29 Sep 2024 00:22:55 +0200
Subject: [PATCH 33/53] python312Packages.python-opendata-transport: 0.4.0 ->
 0.5.0

Changelog: https://github.com/home-assistant-ecosystem/python-opendata-transport/releases/tag/0.5.0
---
 .../python-modules/python-opendata-transport/default.nix      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-opendata-transport/default.nix b/pkgs/development/python-modules/python-opendata-transport/default.nix
index 0473b5dcfe19..47d661b1a587 100644
--- a/pkgs/development/python-modules/python-opendata-transport/default.nix
+++ b/pkgs/development/python-modules/python-opendata-transport/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "python-opendata-transport";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "python_opendata_transport";
     inherit version;
-    hash = "sha256-2lEKPu5vjyqNUqz1NGmZ5b6YP3oWnCgoubDdiQCbdps=";
+    hash = "sha256-CtYsks7Q33ww0Mr9ehhq7+fJhCsj4gxKytiCZ6G4Aqc=";
   };
 
   nativeBuildInputs = [ setuptools ];

From fb6389cb8033025b6709fd77e9bb8d53441d1f0f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 29 Sep 2024 00:24:15 +0200
Subject: [PATCH 34/53] python312Packages.python-opendata-transport: refactor

---
 .../python-modules/python-opendata-transport/default.nix  | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/python-opendata-transport/default.nix b/pkgs/development/python-modules/python-opendata-transport/default.nix
index 47d661b1a587..d94ed2604721 100644
--- a/pkgs/development/python-modules/python-opendata-transport/default.nix
+++ b/pkgs/development/python-modules/python-opendata-transport/default.nix
@@ -13,7 +13,7 @@ buildPythonPackage rec {
   version = "0.5.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     pname = "python_opendata_transport";
@@ -21,9 +21,9 @@ buildPythonPackage rec {
     hash = "sha256-CtYsks7Q33ww0Mr9ehhq7+fJhCsj4gxKytiCZ6G4Aqc=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     urllib3
   ];
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     description = "Python client for interacting with transport.opendata.ch";
     homepage = "https://github.com/home-assistant-ecosystem/python-opendata-transport";
     changelog = "https://github.com/home-assistant-ecosystem/python-opendata-transport/releases/tag/${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }

From ab4dc6ca78809a367aba6fb2813a15116560e2a9 Mon Sep 17 00:00:00 2001
From: lelgenio <lelgenio@lelgenio.com>
Date: Sat, 28 Sep 2024 20:03:55 -0300
Subject: [PATCH 35/53] doc/javascript: fix example usage of yarn hooks

---
 doc/languages-frameworks/javascript.section.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 2996686cde40..e68a29b0b3fd 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -524,8 +524,8 @@ An example usage of the above attributes is:
   fetchYarnDeps,
   yarnConfigHook,
   yarnBuildHook,
+  yarnInstallHook,
   nodejs,
-  npmHooks,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -541,7 +541,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-mo8urQaWIHu33+r0Y7mL9mJ/aSe/5CihuIetTeDHEUQ=";
+    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
   };
 
   nativeBuildInputs = [

From f11d291c2e437b8bedcd997f1dac17bcafbd1151 Mon Sep 17 00:00:00 2001
From: eveeifyeve <88671402+Eveeifyeve@users.noreply.github.com>
Date: Sun, 29 Sep 2024 08:54:58 +1000
Subject: [PATCH 36/53] pythonPackages.pyinstaller: fix darwin build

pythonPackages.pyinstaller: fix bin prefix stdenv hostplatform linux check

pythonPackages.pyinstaller: fix macholib import
---
 pkgs/development/python-modules/pyinstaller/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pyinstaller/default.nix b/pkgs/development/python-modules/pyinstaller/default.nix
index c8b4d4697202..c7b770f1b418 100644
--- a/pkgs/development/python-modules/pyinstaller/default.nix
+++ b/pkgs/development/python-modules/pyinstaller/default.nix
@@ -11,7 +11,9 @@
 , pyinstaller
 , glibc
 , binutils
+, macholib
 , installShellFiles
+, stdenv
 }:
 
 buildPythonPackage rec {
@@ -34,10 +36,11 @@ buildPythonPackage rec {
   dependencies = [
     altgraph
     packaging
+    macholib
     pyinstaller-hooks-contrib
   ];
 
-  makeWrapperArgs = [
+  makeWrapperArgs = lib.optionals stdenv.hostPlatform.isLinux [
     "--prefix" "PATH" ":"  (lib.makeBinPath [ glibc binutils ])
   ];
 

From dd65d15cc0f1d4471972f9c0c2693c1765f203a1 Mon Sep 17 00:00:00 2001
From: Icy-Thought <icy-thought@pm.me>
Date: Sun, 29 Sep 2024 01:36:44 +0200
Subject: [PATCH 37/53] picom: v12 -> v12.1

---
 pkgs/by-name/pi/picom/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pi/picom/package.nix b/pkgs/by-name/pi/picom/package.nix
index 0ac54323bff7..200ad56d1e2b 100644
--- a/pkgs/by-name/pi/picom/package.nix
+++ b/pkgs/by-name/pi/picom/package.nix
@@ -33,13 +33,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "picom";
-  version = "12";
+  version = "12.1";
 
   src = fetchFromGitHub {
     owner = "yshui";
     repo = "picom";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-7XpZEYQtjsBAcMMEJXlfSaZ1jdDxDBnzkSAtTbW7Br4=";
+    hash = "sha256-XBFSPSrG6C4n5oQUQbWXyy9iCuEdrdaxU0CPR73juzk=";
     fetchSubmodules = true;
   };
 

From 3bd8b06582ff0d9674eaf7f73739d846506df825 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 29 Sep 2024 00:35:21 +0000
Subject: [PATCH 38/53] troubadix: 24.9.2 -> 24.9.4

---
 pkgs/by-name/tr/troubadix/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/tr/troubadix/package.nix b/pkgs/by-name/tr/troubadix/package.nix
index ba0db2dfd33f..dec1e9f26d39 100644
--- a/pkgs/by-name/tr/troubadix/package.nix
+++ b/pkgs/by-name/tr/troubadix/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "troubadix";
-  version = "24.9.2";
+  version = "24.9.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "troubadix";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nFzrOSaq0U6qapmk59iAK3N0gQag1fMaew3LtOK+neY=";
+    hash = "sha256-y7IVEDbXYiNi9/SIlbmrkZ5SxrLzYe3Yy8LkP+wID3w=";
   };
 
   pythonRelaxDeps = [ "validators" ];

From d1f806d5d892cf54304993c67009fd1cb0ec475c Mon Sep 17 00:00:00 2001
From: zimward <96021122+zimward@users.noreply.github.com>
Date: Sun, 29 Sep 2024 11:56:20 +0900
Subject: [PATCH 39/53] quickwit: fix compilation with rust 1.80

---
 pkgs/servers/search/quickwit/Cargo.lock       |  8 +++---
 pkgs/servers/search/quickwit/default.nix      |  4 +++
 .../quickwit/update-time-for-rust-1.80.patch  | 28 +++++++++++++++++++
 3 files changed, 36 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/servers/search/quickwit/update-time-for-rust-1.80.patch

diff --git a/pkgs/servers/search/quickwit/Cargo.lock b/pkgs/servers/search/quickwit/Cargo.lock
index db5e22e698f2..6d48db37fa12 100644
--- a/pkgs/servers/search/quickwit/Cargo.lock
+++ b/pkgs/servers/search/quickwit/Cargo.lock
@@ -8225,9 +8225,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.34"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
  "deranged",
  "itoa",
@@ -8258,9 +8258,9 @@ dependencies = [
 
 [[package]]
 name = "time-macros"
-version = "0.2.17"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
  "num-conv",
  "time-core",
diff --git a/pkgs/servers/search/quickwit/default.nix b/pkgs/servers/search/quickwit/default.nix
index ccc32cb90056..60a18dc4f834 100644
--- a/pkgs/servers/search/quickwit/default.nix
+++ b/pkgs/servers/search/quickwit/default.nix
@@ -96,6 +96,10 @@ rustPlatform.buildRustPackage rec {
     };
   };
 
+  cargoPatches =[
+    ./update-time-for-rust-1.80.patch
+  ];
+
   CARGO_PROFILE_RELEASE_LTO = "fat";
   CARGO_PROFILE_RELEASE_CODEGEN_UNITS = "1";
 
diff --git a/pkgs/servers/search/quickwit/update-time-for-rust-1.80.patch b/pkgs/servers/search/quickwit/update-time-for-rust-1.80.patch
new file mode 100644
index 000000000000..225bf7f8a1c0
--- /dev/null
+++ b/pkgs/servers/search/quickwit/update-time-for-rust-1.80.patch
@@ -0,0 +1,28 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index db5e22e6..6d48db37 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -8225,9 +8225,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.34"
++version = "0.3.36"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
++checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
+  "deranged",
+  "itoa",
+@@ -8258,9 +8258,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.17"
++version = "0.2.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
++checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+ dependencies = [
+  "num-conv",
+  "time-core",

From b53d059d5edd09fdc8121f23020184e177bb4408 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 29 Sep 2024 03:44:34 +0000
Subject: [PATCH 40/53] supermariowar: 2023-unstable-2024-09-17 ->
 2023-unstable-2024-09-21

---
 pkgs/by-name/su/supermariowar/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/su/supermariowar/package.nix b/pkgs/by-name/su/supermariowar/package.nix
index 4ebeef24ce7d..4199d48469e4 100644
--- a/pkgs/by-name/su/supermariowar/package.nix
+++ b/pkgs/by-name/su/supermariowar/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "supermariowar";
-  version = "2023-unstable-2024-09-17";
+  version = "2023-unstable-2024-09-21";
 
   src = fetchFromGitHub {
     owner = "mmatyas";
     repo = "supermariowar";
-    rev = "6b8ff8c669ca31a116754d23b6ff65e42ac50733";
-    hash = "sha256-P0jV7G81thj0UJoYLd5+H5SjjaVu4goJxc9IkbzxJgs=";
+    rev = "7e7ebe39cadba5d0bd9d7e87a08264332c2f1f12";
+    hash = "sha256-kBwaqw0GZvLWE5GqgfieLRU4s8wYFtTZyl1MgwWGbMc=";
     fetchSubmodules = true;
   };
 

From 170923d16b7d8883592336ff4d23b22db6a6a724 Mon Sep 17 00:00:00 2001
From: Savyasachee Jha <genghizkhan91@hawkradius.com>
Date: Sun, 29 Sep 2024 10:27:55 +0530
Subject: [PATCH 41/53] firefly-iii: 6.1.20 -> 6.1.21

---
 pkgs/by-name/fi/firefly-iii/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fi/firefly-iii/package.nix b/pkgs/by-name/fi/firefly-iii/package.nix
index fe284605faed..d3510ce80282 100644
--- a/pkgs/by-name/fi/firefly-iii/package.nix
+++ b/pkgs/by-name/fi/firefly-iii/package.nix
@@ -12,7 +12,7 @@
 
 let
   pname = "firefly-iii";
-  version = "6.1.20";
+  version = "6.1.21";
   phpPackage = php83;
   npmDepsHash = "sha256-N4o7FKdya6bGakNKNq2QUV8HKRfuov5ahvbjR/rsimU=";
 
@@ -20,7 +20,7 @@ let
     owner = "firefly-iii";
     repo = "firefly-iii";
     rev = "v${version}";
-    hash = "sha256-vb9pGupa4cRy/p9iHJT7SMNchRQSU9Nnh6FphEcvt+k=";
+    hash = "sha256-jadxzUhOb3G/DwJk8IV4IcwjmxgrrriVMVwj1cYFHEA=";
   };
 in
 

From d46eefeffd5d77babaf82a5741297af166bedc81 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 29 Sep 2024 08:21:18 +0300
Subject: [PATCH 42/53] google-cloud-cpp: 2.14.0 -> 2.29.0

Fixes build with latest GCC/glibc/protobuf/etc, also
catches us up on a year of updates.
---
 .../libraries/google-cloud-cpp/default.nix    | 27 ++++++-------------
 .../hardcode-googleapis-path.patch            | 14 ++++++++++
 2 files changed, 22 insertions(+), 19 deletions(-)
 create mode 100644 pkgs/development/libraries/google-cloud-cpp/hardcode-googleapis-path.patch

diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index e8caeadcd32d..c70d9d70340e 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
+, substituteAll
 , c-ares
 , cmake
 , crc32c
@@ -20,41 +20,33 @@
 }:
 let
   # defined in cmake/GoogleapisConfig.cmake
-  googleapisRev = "85f8c758016c279fb7fa8f0d51ddc7ccc0dd5e05";
+  googleapisRev = "6a474b31c53cc1797710206824a17b364a835d2d";
   googleapis = fetchFromGitHub {
     name = "googleapis-src";
     owner = "googleapis";
     repo = "googleapis";
     rev = googleapisRev;
-    hash = "sha256-4Qiz0pBgW3OZi+Z8Zq6k9E94+8q6/EFMwPh8eQxDjdI=";
+    hash = "sha256-t5oX6Gc1WSMSBDftXA9RZulckUenxOEHBYeq2qf8jnY=";
   };
 in
 stdenv.mkDerivation rec {
   pname = "google-cloud-cpp";
-  version = "2.14.0";
+  version = "2.29.0";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-cpp";
     rev = "v${version}";
-    sha256 = "sha256-0SoOaAqvk8cVC5W3ejTfe4O/guhrro3uAzkeIpAkCpg=";
+    sha256 = "sha256-gCq8Uc+s/rnJWsGlI7f+tvAZHH8K69+H/leUOKE2GCY=";
   };
 
   patches = [
-    # https://github.com/googleapis/google-cloud-cpp/pull/12554, tagged in 2.16.0
-    (fetchpatch {
-      name = "prepare-for-GCC-13.patch";
-      url = "https://github.com/googleapis/google-cloud-cpp/commit/ae30135c86982c36e82bb0f45f99baa48c6a780b.patch";
-      hash = "sha256-L0qZfdhP8Zt/gYBWvJafteVgBHR8Kup49RoOrLDtj3k=";
+    (substituteAll {
+      src = ./hardcode-googleapis-path.patch;
+      url = googleapis;
     })
   ];
 
-  postPatch = ''
-    substituteInPlace external/googleapis/CMakeLists.txt \
-      --replace "https://github.com/googleapis/googleapis/archive/\''${_GOOGLE_CLOUD_CPP_GOOGLEAPIS_COMMIT_SHA}.tar.gz" "file://${googleapis}"
-    sed -i '/https:\/\/storage.googleapis.com\/cloud-cpp-community-archive\/com_google_googleapis/d' external/googleapis/CMakeLists.txt
-  '';
-
   nativeBuildInputs = [
     cmake
     ninja
@@ -78,9 +70,6 @@ stdenv.mkDerivation rec {
     protobuf
   ];
 
-  # https://hydra.nixos.org/build/222679737/nixlog/3/tail
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isAarch64 "-Wno-error=maybe-uninitialized";
-
   doInstallCheck = true;
 
   preInstallCheck =
diff --git a/pkgs/development/libraries/google-cloud-cpp/hardcode-googleapis-path.patch b/pkgs/development/libraries/google-cloud-cpp/hardcode-googleapis-path.patch
new file mode 100644
index 000000000000..9e1affcfe016
--- /dev/null
+++ b/pkgs/development/libraries/google-cloud-cpp/hardcode-googleapis-path.patch
@@ -0,0 +1,14 @@
+--- a/external/googleapis/CMakeLists.txt
++++ b/external/googleapis/CMakeLists.txt
+@@ -20,10 +20,7 @@ endif ()
+
+ include(GoogleapisConfig)
+
+-set(GOOGLE_CLOUD_CPP_GOOGLEAPIS_URL
+-    "https://github.com/googleapis/googleapis/archive/${_GOOGLE_CLOUD_CPP_GOOGLEAPIS_COMMIT_SHA}.tar.gz"
+-    "https://storage.googleapis.com/cloud-cpp-community-archive/github.com/googleapis/googleapis/archive/${_GOOGLE_CLOUD_CPP_GOOGLEAPIS_COMMIT_SHA}.tar.gz"
+-)
++set(GOOGLE_CLOUD_CPP_GOOGLEAPIS_URL @url@)
+ set(GOOGLE_CLOUD_CPP_GOOGLEAPIS_URL_HASH
+     "${_GOOGLE_CLOUD_CPP_GOOGLEAPIS_SHA256}")
+ if (GOOGLE_CLOUD_CPP_OVERRIDE_GOOGLEAPIS_URL)

From ce7068660a63abca25f9284d39d95bdddce7175b Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 28 Sep 2024 12:12:29 +0300
Subject: [PATCH 43/53] nixos/xdg/icons: add `fallbackThemes` option

---
 nixos/modules/config/xdg/icons.nix              | 17 +++++++++++++++++
 .../services/desktop-managers/plasma6.nix       |  1 +
 2 files changed, 18 insertions(+)

diff --git a/nixos/modules/config/xdg/icons.nix b/nixos/modules/config/xdg/icons.nix
index 9e2b3c2e46e0..b0267d21d3eb 100644
--- a/nixos/modules/config/xdg/icons.nix
+++ b/nixos/modules/config/xdg/icons.nix
@@ -13,6 +13,14 @@
         [XDG Icon Theme specification](https://specifications.freedesktop.org/icon-theme-spec/icon-theme-spec-latest.html).
       '';
     };
+    xdg.icons.fallbackCursorThemes = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [];
+      description = ''
+        Names of the fallback cursor themes, in order of preference, to be used when no other icon source can be found.
+        Set to `[]` to disable the fallback entirely.
+      '';
+    };
   };
 
   config = lib.mkIf config.xdg.icons.enable {
@@ -25,6 +33,15 @@
       # Empty icon theme that contains index.theme file describing directories
       # where toolkits should look for icons installed by apps.
       pkgs.hicolor-icon-theme
+    ] ++ lib.optionals (config.xdg.icons.fallbackCursorThemes != []) [
+      (pkgs.writeTextFile {
+        name = "fallback-cursor-theme";
+        text = ''
+          [Icon Theme]
+          Inherits=${lib.concatStringsSep "," config.xdg.icons.fallbackCursorThemes}
+        '';
+        destination = "/share/icons/default/index.theme";
+      })
     ];
 
     # libXcursor looks for cursors in XCURSOR_PATH
diff --git a/nixos/modules/services/desktop-managers/plasma6.nix b/nixos/modules/services/desktop-managers/plasma6.nix
index a7f71f13fbbd..2555c58d46ec 100644
--- a/nixos/modules/services/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/desktop-managers/plasma6.nix
@@ -245,6 +245,7 @@ in {
     systemd.services."drkonqi-coredump-processor@".wantedBy = ["systemd-coredump@.service"];
 
     xdg.icons.enable = true;
+    xdg.icons.fallbackCursorThemes = mkDefault ["breeze_cursors"];
 
     xdg.portal.enable = true;
     xdg.portal.extraPortals = [

From ffec0c4485ac46d0d200311567ef41d910b78262 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 29 Sep 2024 06:03:59 +0000
Subject: [PATCH 44/53] application-title-bar: 0.7.2 -> 0.7.3

---
 pkgs/by-name/ap/application-title-bar/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ap/application-title-bar/package.nix b/pkgs/by-name/ap/application-title-bar/package.nix
index 65fda7aa82b5..a98fda3e6b00 100644
--- a/pkgs/by-name/ap/application-title-bar/package.nix
+++ b/pkgs/by-name/ap/application-title-bar/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "application-title-bar";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "antroids";
     repo = "application-title-bar";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-0tSwjyKPVyOR0VJi1qqMFf/yVmWFmyue0xaNp9pYxDo=";
+    hash = "sha256-kvFUz0m222jTGrkqLyYmnW0o4MXU9lLAsyk6QBAJHr8=";
   };
 
   propagatedUserEnvPkgs = with kdePackages; [ kconfig ];

From 8b540b5f7197e68c96e4824b6c1be58c18484a2a Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 29 Sep 2024 10:45:23 +0300
Subject: [PATCH 45/53] python312Packages.botocore: 1.34.131 -> 1.35.29

---
 pkgs/development/python-modules/botocore/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index 68a1ae7c68dc..870b3b86a7e3 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.34.131"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.35.29"; # N.B: if you change this, change boto3 and awscli to a matching version
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UC3a/h1if88eTAB8hkVOXdAR26fFi9jopTaKefPjh9w=";
+    hash = "sha256-TtKKsDZ1uwCKKQxFLF3deqpdTj+hkSqtvfkwV+6ENis=";
   };
 
   pythonRelaxDeps = [ "urllib3" ];

From afb688c2265eb0c4ee5709f8885ceecca797c80c Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 29 Sep 2024 10:45:36 +0300
Subject: [PATCH 46/53] python312Packages.boto3: 1.34.131 -> 1.35.29

---
 pkgs/development/python-modules/boto3/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index f6998d6400a2..2f28117ca2ea 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "boto";
     repo = "boto3";
     rev = "refs/tags/${version}";
-    hash = "sha256-fiUguOzNF9T3CcGD1mYl2b5QFbvBG8wNOd3Or2NR66E=";
+    hash = "sha256-4WP5E8LuuxWZi8DK8yOpvyy6isSfB4eFcbctkTEd3As=";
   };
 
   nativeBuildInputs = [

From 48d02fb9ac57627a62389985e6abb48f8bcdd456 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 29 Sep 2024 10:45:58 +0300
Subject: [PATCH 47/53] awscli: 1.33.13 -> 1.34.29

---
 pkgs/tools/admin/awscli/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index d7fc15a173cf..c792563000a6 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -13,12 +13,12 @@ let
     pname = "awscli";
     # N.B: if you change this, change botocore and boto3 to a matching version too
     # check e.g. https://github.com/aws/aws-cli/blob/1.33.21/setup.py
-    version = "1.33.13";
+    version = "1.34.29";
     pyproject = true;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-utRALEoP+CWlmkPnbgByFSSX9Nr39iyTdv5uABT6Kps=";
+      hash = "sha256-2w9z6f8ThKIISEiExePHObUZzBrdltP3AfZqKh8d1Mo=";
     };
 
     pythonRelaxDeps = [

From 5d8390a8c4473579044fcc48225e9db6b9afae60 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 29 Sep 2024 10:46:12 +0300
Subject: [PATCH 48/53] python312Packages.py-partiql-parser: 0.5.4 -> 0.5.6

---
 pkgs/development/python-modules/py-partiql-parser/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/py-partiql-parser/default.nix b/pkgs/development/python-modules/py-partiql-parser/default.nix
index f3978e4fb695..a240fbcd8085 100644
--- a/pkgs/development/python-modules/py-partiql-parser/default.nix
+++ b/pkgs/development/python-modules/py-partiql-parser/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "py-partiql-parser";
-  version = "0.5.4";
+  version = "0.5.6";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "getmoto";
     repo = "py-partiql-parser";
     rev = "refs/tags/${version}";
-    hash = "sha256-BSqc3xibStb3J6Rua4dDp/eRD5/ns/dU1vGa4vL1Cyo=";
+    hash = "sha256-uEpgcY2bBaeFaK/0gWg1ef81FmKJy7m5G21aETW9QXU=";
   };
 
   build-system = [ hatchling ];

From 110123ae4d1b1d174c3436c131cc0e8fef7a6766 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 29 Sep 2024 10:46:22 +0300
Subject: [PATCH 49/53] python312Packages.moto: 5.0.12 -> 5.0.15

---
 pkgs/development/python-modules/moto/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/moto/default.nix b/pkgs/development/python-modules/moto/default.nix
index 3f5ae8133936..96e633f4c465 100644
--- a/pkgs/development/python-modules/moto/default.nix
+++ b/pkgs/development/python-modules/moto/default.nix
@@ -44,14 +44,14 @@
 
 buildPythonPackage rec {
   pname = "moto";
-  version = "5.0.12";
+  version = "5.0.15";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EL1DS/2jKWOf6VKUcMTCeTgGTBOZhAJOamJRPlCv9Cc=";
+    hash = "sha256-V6qMKvQXzGSg3f5j5bzRrakPUHm3PN0fdMTp+zChp+Y=";
   };
 
   build-system = [ setuptools ];

From 14e14fa5479ceadc031718d6527185eee5d5b857 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 29 Sep 2024 08:20:26 +0000
Subject: [PATCH 50/53] ast-grep: 0.27.1 -> 0.27.3

---
 pkgs/by-name/as/ast-grep/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/as/ast-grep/package.nix b/pkgs/by-name/as/ast-grep/package.nix
index af62e192ca67..44c90f1e2cfc 100644
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ast-grep";
-  version = "0.27.1";
+  version = "0.27.3";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     rev = version;
-    hash = "sha256-7jTkQIBeC8Vl8wrrdulZZq/aQNwksUsAdA7hlPEd4cQ=";
+    hash = "sha256-nE4cHQvFseSgB6LluTp9dCDEqR9vAymZCN3V7HgieYA=";
   };
 
-  cargoHash = "sha256-sDKF8KbTQGQizyjV3w4+LGgz1i18wmKzvHfCb3XGb0g=";
+  cargoHash = "sha256-A0qvug8wbqN22B0j6BFZyeHMfmlBsuZJRJ1SmctTz1s=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 497561b99a0a3dfbb10757615996f4c54c888c66 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 29 Sep 2024 08:49:37 +0000
Subject: [PATCH 51/53] firefoxpwa: 2.12.4 -> 2.12.5

---
 pkgs/by-name/fi/firefoxpwa/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fi/firefoxpwa/package.nix b/pkgs/by-name/fi/firefoxpwa/package.nix
index 13ca4fbcd6c1..696c17ed2671 100644
--- a/pkgs/by-name/fi/firefoxpwa/package.nix
+++ b/pkgs/by-name/fi/firefoxpwa/package.nix
@@ -28,13 +28,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "firefoxpwa";
-  version = "2.12.4";
+  version = "2.12.5";
 
   src = fetchFromGitHub {
     owner = "filips123";
     repo = "PWAsForFirefox";
     rev = "v${version}";
-    hash = "sha256-VNCQUF/Xep/PkrNd9Mzbm3NWPToqXpJM6SzDoqBXbNY=";
+    hash = "sha256-WAAZ35AkKzufhDm8RNTpSsGJjqCIm84THEOmXemvv2o=";
   };
 
   sourceRoot = "${src.name}/native";

From 2f204572c6bdb1272b6ecd9b9de8c5b1551dd292 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 29 Sep 2024 12:15:23 +0300
Subject: [PATCH 52/53] nixos-rebuild: remove accidentally lost check

We should not set version to .git. when we don't know the commit.
---
 pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 023bdde5b90d..c5bc19f82980 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -564,7 +564,9 @@ getVersion() {
         fi
     fi
 
-    echo ".git.$rev"
+    if [ -n "$rev" ]; then
+        echo ".git.$rev"
+    fi
 }
 
 

From 0896eb4cbbc300df2ebdebb13adc381191ba0499 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Sat, 28 Sep 2024 22:07:17 -0600
Subject: [PATCH 53/53] cryptomator: 1.13.0 -> 1.14.1

---
 pkgs/tools/security/cryptomator/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/security/cryptomator/default.nix b/pkgs/tools/security/cryptomator/default.nix
index 38d3aa2a86ba..084e9d9b1c35 100644
--- a/pkgs/tools/security/cryptomator/default.nix
+++ b/pkgs/tools/security/cryptomator/default.nix
@@ -7,18 +7,18 @@
 
 maven.buildMavenPackage rec {
   pname = "cryptomator";
-  version = "1.13.0";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "cryptomator";
     repo = "cryptomator";
     rev = version;
-    hash = "sha256-aKj8/yQzNWWV2m+sF2Or59OyPMiBqPeXEHn88w2VUkU=";
+    hash = "sha256-so8RINjFLF9H4K9f/60Ym/v/VpcVfxJ/c+JDOAPFgZU=";
   };
 
   mvnJdk = jdk;
   mvnParameters = "-Dmaven.test.skip=true -Plinux";
-  mvnHash = "sha256-bZGTYkxRXgjGoxAdVkgiZZgVSghKz3Mq9pCBdivMNPQ=";
+  mvnHash = "sha256-aB7wgnJAYvCizC0/gG/amcId/WVVWmZndItm398nDfQ=";
 
   preBuild = ''
     VERSION=${version}