From dd9883b2fbd2b9ea01d53654d383b29b4d68d05a Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Wed, 29 Sep 2021 12:09:20 +0200
Subject: [PATCH 01/63] nixos/dhcpd: switch to DynamicUser

The service can run unprivileged -- by using capabilities -- and the
uid/gid can be dynamically allocated since there are only a handful of
state files.

This change improves the overall security of the service by leveraging
systemd's hardening and getting rids of `nogroup` and the initial root
permissions (before the daemon drop privileges).
---
 nixos/modules/services/networking/dhcpd.nix | 93 ++++++++++-----------
 1 file changed, 44 insertions(+), 49 deletions(-)

diff --git a/nixos/modules/services/networking/dhcpd.nix b/nixos/modules/services/networking/dhcpd.nix
index 54e4f9002859..3c4c0069dfd0 100644
--- a/nixos/modules/services/networking/dhcpd.nix
+++ b/nixos/modules/services/networking/dhcpd.nix
@@ -28,38 +28,45 @@ let
       }
     '';
 
-  dhcpdService = postfix: cfg: optionalAttrs cfg.enable {
-    "dhcpd${postfix}" = {
-      description = "DHCPv${postfix} server";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+  dhcpdService = postfix: cfg:
+    let
+      configFile =
+        if cfg.configFile != null
+          then cfg.configFile
+          else writeConfig cfg;
+      leaseFile = "/var/lib/dhcpd${postfix}/dhcpd.leases";
+      args = [
+        "@${pkgs.dhcp}/sbin/dhcpd" "dhcpd${postfix}" "-${postfix}"
+        "-pf" "/run/dhcpd${postfix}/dhcpd.pid"
+        "-cf" configFile
+        "-lf" leaseFile
+      ] ++ cfg.extraFlags
+        ++ cfg.interfaces;
+    in
+      optionalAttrs cfg.enable {
+        "dhcpd${postfix}" = {
+          description = "DHCPv${postfix} server";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
 
-      preStart = ''
-        mkdir -m 755 -p ${cfg.stateDir}
-        chown dhcpd:nogroup ${cfg.stateDir}
-        touch ${cfg.stateDir}/dhcpd.leases
-      '';
-
-      serviceConfig =
-        let
-          configFile = if cfg.configFile != null then cfg.configFile else writeConfig cfg;
-          args = [ "@${pkgs.dhcp}/sbin/dhcpd" "dhcpd${postfix}" "-${postfix}"
-                   "-pf" "/run/dhcpd${postfix}/dhcpd.pid"
-                   "-cf" "${configFile}"
-                   "-lf" "${cfg.stateDir}/dhcpd.leases"
-                   "-user" "dhcpd" "-group" "nogroup"
-                 ] ++ cfg.extraFlags
-                   ++ cfg.interfaces;
-
-        in {
-          ExecStart = concatMapStringsSep " " escapeShellArg args;
-          Type = "forking";
-          Restart = "always";
-          RuntimeDirectory = [ "dhcpd${postfix}" ];
-          PIDFile = "/run/dhcpd${postfix}/dhcpd.pid";
+          preStart = "touch ${leaseFile}";
+          serviceConfig = {
+            ExecStart = concatMapStringsSep " " escapeShellArg args;
+            Type = "forking";
+            Restart = "always";
+            DynamicUser = true;
+            User = "dhcpd";
+            Group = "dhcpd";
+            AmbientCapabilities = [
+              "CAP_NET_RAW"          # to send ICMP messages
+              "CAP_NET_BIND_SERVICE" # to bind on DHCP port (67)
+            ];
+            StateDirectory   = "dhcpd${postfix}";
+            RuntimeDirectory = "dhcpd${postfix}";
+            PIDFile = "/run/dhcpd${postfix}/dhcpd.pid";
+          };
         };
-    };
-  };
+      };
 
   machineOpts = { ... }: {
 
@@ -102,15 +109,6 @@ let
       '';
     };
 
-    stateDir = mkOption {
-      type = types.path;
-      # We use /var/lib/dhcp for DHCPv4 to save backwards compatibility.
-      default = "/var/lib/dhcp${if postfix == "4" then "" else postfix}";
-      description = ''
-        State directory for the DHCP server.
-      '';
-    };
-
     extraConfig = mkOption {
       type = types.lines;
       default = "";
@@ -194,7 +192,13 @@ in
 
   imports = [
     (mkRenamedOptionModule [ "services" "dhcpd" ] [ "services" "dhcpd4" ])
-  ];
+  ] ++ flip map [ "4" "6" ] (postfix:
+    mkRemovedOptionModule [ "services" "dhcpd${postfix}" "stateDir" ] ''
+      The DHCP server state directory is now managed with the systemd's DynamicUser mechanism.
+      This means the directory is named after the service (dhcpd${postfix}), created under
+      /var/lib/private/ and symlinked to /var/lib/.
+    ''
+  );
 
   ###### interface
 
@@ -210,15 +214,6 @@ in
 
   config = mkIf (cfg4.enable || cfg6.enable) {
 
-    users = {
-      users.dhcpd = {
-        isSystemUser = true;
-        group = "dhcpd";
-        description = "DHCP daemon user";
-      };
-      groups.dhcpd = {};
-    };
-
     systemd.services = dhcpdService "4" cfg4 // dhcpdService "6" cfg6;
 
   };

From ebbae489082ad71fe10f02087f1b4b02c3cd5d2e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Dec 2021 23:13:16 +0000
Subject: [PATCH 02/63] babashka: 0.6.8 -> 0.7.0

---
 pkgs/development/interpreters/clojure/babashka.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/clojure/babashka.nix b/pkgs/development/interpreters/clojure/babashka.nix
index 7b1080fb0f8a..ffb33713a913 100644
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@@ -2,11 +2,11 @@
 
 buildGraalvmNativeImage rec {
   pname = "babashka";
-  version = "0.6.8";
+  version = "0.7.0";
 
   src = fetchurl {
     url = "https://github.com/babashka/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-GIJXXWJZ77n2FBOLKqRSlueo63JMxo0a49dDhneO6oo=";
+    sha256 = "sha256-zSjiHacetJ68U0GciIbuGET9I/51EM8JnPPUGemDfEI=";
   };
 
   executable = "bb";

From 50832be9982f1bdca40456ad54f3c0554b7ce132 Mon Sep 17 00:00:00 2001
From: Ryan Mulligan <ryan@ryantm.com>
Date: Tue, 21 Dec 2021 15:40:12 -0800
Subject: [PATCH 03/63] discourse: 2.8.0.beta9 -> 2.8.0.beta10; update plugins

---
 pkgs/servers/web-apps/discourse/default.nix   |  4 +-
 .../plugins/discourse-assign/default.nix      |  4 +-
 .../plugins/discourse-calendar/Gemfile.lock   |  6 +-
 .../plugins/discourse-calendar/default.nix    |  4 +-
 .../plugins/discourse-calendar/gemset.nix     | 20 ++----
 .../discourse-canned-replies/default.nix      |  4 +-
 .../discourse-chat-integration/default.nix    |  4 +-
 .../plugins/discourse-checklist/default.nix   |  4 +-
 .../discourse-data-explorer/default.nix       |  4 +-
 .../plugins/discourse-docs/default.nix        |  4 +-
 .../plugins/discourse-github/default.nix      |  4 +-
 .../plugins/discourse-math/default.nix        |  4 +-
 .../discourse-openid-connect/default.nix      |  4 +-
 .../plugins/discourse-prometheus/default.nix  |  4 +-
 .../discourse-saved-searches/default.nix      |  4 +-
 .../plugins/discourse-solved/default.nix      |  4 +-
 .../discourse-spoiler-alert/default.nix       |  4 +-
 .../plugins/discourse-voting/default.nix      |  4 +-
 .../discourse-yearly-review/default.nix       |  4 +-
 .../web-apps/discourse/rubyEnv/Gemfile.lock   | 32 +++++-----
 .../web-apps/discourse/rubyEnv/gemset.nix     | 64 +++++++++----------
 21 files changed, 89 insertions(+), 101 deletions(-)

diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix
index 6134b307c24d..9a04bf479913 100644
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -10,13 +10,13 @@
 }@args:
 
 let
-  version = "2.8.0.beta9";
+  version = "2.8.0.beta10";
 
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse";
     rev = "v${version}";
-    sha256 = "sha256-cTedMbf0N50ysRQqA9Fm1WQmI5J5hsqDSi2JZIa49jg=";
+    sha256 = "sha256-mlTOsHR8p0mTdhZHBESyDAa1XtMJ4uIht0VUcGD6Ses=";
   };
 
   runtimeDeps = [
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-assign/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-assign/default.nix
index ce0d3c137371..090bffd96605 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-assign/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-assign/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-assign";
-    rev = "91d0712b0440b6bb0c2fedbf6c31191cdeb991fe";
-    sha256 = "sha256-ATWLu0vJZFquRcAUpFKaU8mqjjVOv3PziAsHR3aemWk=";
+    rev = "920503f5fc2cbec1b3ba4d431cffda2281e12509";
+    sha256 = "sha256-qMUlJwETu99Qmbh4sn/1Vn7Xgaj3Jhi+/E8ecIbnVH8=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-docs";
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/Gemfile.lock b/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/Gemfile.lock
index c06404848514..218927821f4e 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/Gemfile.lock
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/Gemfile.lock
@@ -1,21 +1,19 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (6.1.4.1)
+    activesupport (7.0.0)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
       tzinfo (~> 2.0)
-      zeitwerk (~> 2.3)
     concurrent-ruby (1.1.9)
     i18n (1.8.11)
       concurrent-ruby (~> 1.0)
-    minitest (5.14.4)
+    minitest (5.15.0)
     rrule (0.4.2)
       activesupport (>= 4.1)
     tzinfo (2.0.4)
       concurrent-ruby (~> 1.0)
-    zeitwerk (2.5.1)
 
 PLATFORMS
   ruby
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/default.nix
index 6bcdb3119c3a..4e9860acdc56 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/default.nix
@@ -6,8 +6,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-calendar";
-    rev = "fbc617a5fa9f3a22bcc72bc2b32ea3cbdf6087c5";
-    sha256 = "sha256-qBtq8IvxdKYIFNL9DwdRqZceMMO/qgd6jTr3kk3so3Y=";
+    rev = "9c5516ff039225be04b1302c5c67837ce64fba9c";
+    sha256 = "sha256-tfQWhkQvHrIUl0+tIv8X65MvoUhUnKD7KHwQbBm3p7U=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-calendar";
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/gemset.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/gemset.nix
index 0248d93fc940..cd8b76c1bfb5 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/gemset.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-calendar/gemset.nix
@@ -1,14 +1,14 @@
 {
   activesupport = {
-    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
+    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19gx1jcq46x9d1pi1w8xq0bgvvfw239y4lalr8asm291gj3q3ds4";
+      sha256 = "04bsr3420wb8y5pagg3s0rkx44fix47wrjvfby2d205l9bq6azyk";
       type = "gem";
     };
-    version = "6.1.4.1";
+    version = "7.0.0";
   };
   concurrent-ruby = {
     groups = ["default"];
@@ -36,10 +36,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19z7wkhg59y8abginfrm2wzplz7py3va8fyngiigngqvsws6cwgl";
+      sha256 = "06xf558gid4w8lwx13jwfdafsch9maz8m0g85wnfymqj63x5nbbd";
       type = "gem";
     };
-    version = "5.14.4";
+    version = "5.15.0";
   };
   rrule = {
     dependencies = ["activesupport"];
@@ -63,14 +63,4 @@
     };
     version = "2.0.4";
   };
-  zeitwerk = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "18l4r6layck0d80ydc692mv1lxak5xbf6w2paj1x7m2ggbggzxgj";
-      type = "gem";
-    };
-    version = "2.5.1";
-  };
 }
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-canned-replies/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-canned-replies/default.nix
index 7ec87636d1c0..6bf41b11ec92 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-canned-replies/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-canned-replies/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-canned-replies";
-    rev = "1bb77ebbe0577f257bc16783dc8b7bbf2d915092";
-    sha256 = "0qvx8k9jsxjllqsqpf4k0j4niv1k2sggy6ak067wigs8ha3dkcr0";
+    rev = "dbbb8740287e44b5e9f0d8c968e3d237154e1f3c";
+    sha256 = "sha256-o4yZaXiQpt7Bb29kVKJOiIdNgcSEOnSiFAIhZtiX6ys=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-canned-replies";
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-chat-integration/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-chat-integration/default.nix
index b7123aca7d76..18f1b313048b 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-chat-integration/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-chat-integration/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-chat-integration";
-    rev = "ae0389ca89f26401a6c4cffaaae6adcf14af0e15";
-    sha256 = "sha256-wT9S2mMz2MOpWpYv/FrHYhZibStRIGC4P2Vrqs04bkA=";
+    rev = "46b2c05cbd00dbc49bff87d78f8e1ec4fdd43735";
+    sha256 = "sha256-G17obAc03FR3Qzn/IR++Y5Z1TkpP6lY5UDJsm4Lmj0M=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-chat-integration";
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-checklist/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-checklist/default.nix
index c02614f0c094..f8247e84a7ee 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-checklist/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-checklist/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-checklist";
-    rev = "d8012abd3d6dccb72eec83e6a96ef4809dcad681";
-    sha256 = "1ngjql65939c571gyaqj8ydcxy5kkril2qlkxqf579vvwzpvxw13";
+    rev = "b4e14bdac40131bd70a698015b35a111a18c9f88";
+    sha256 = "sha256-okxcLu6gXvEY37ylnhit5B+LwCdV5gMKBpC/m/PaGtc=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-checklist";
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-data-explorer/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-data-explorer/default.nix
index 46f0ec4d2ca5..0933a347b620 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-data-explorer/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-data-explorer/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-data-explorer";
-    rev = "3ce778ec6d96a300a06ffe0581f4681fbed8df7f";
-    sha256 = "1555k1anrijfbm0qfraby3ivh6h76177d541nxhnarj85mjx0hjb";
+    rev = "f77f5999069dbe98c49302566c82e5f77bb72db2";
+    sha256 = "sha256-N9LmFnza1pA3JRBE9bT9b/NhdYMKoF5GOUpq9XYdokY=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-data-explorer";
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix
index 78ae9aba6fc6..9c25200cc425 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-docs";
-    rev = "d3eee7008b7a703774331808e302e36f2f8b4eae";
-    sha256 = "1p3aqfpv207pvlbis43znwgw56yqsn41320yaw1gdcaakf5s2rsx";
+    rev = "e56816eb502b5ea37606f65a8df188e233f77240";
+    sha256 = "sha256-qvuoFsVXKa2IZgjVeqCca7X9jfohEBaoieZRsSFJCto=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-docs";
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-github/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-github/default.nix
index f56c23febbb6..06c4ec85fb0d 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-github/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-github/default.nix
@@ -6,8 +6,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-github";
-    rev = "8cd8c0703991c16cb2fa8cb1fd22a9c3849c7ae2";
-    sha256 = "17ga31a10sm3fqjpf40mz7fk62vynyng2a243pia9fjdq9py8slx";
+    rev = "9fae5e365c1330bc25265e3bb2a06d29adb38266";
+    sha256 = "sha256-0HUrhO78XbTr6ygNFT+Uh70n2z9dFpimawh4u8fpNjg=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-github";
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-math/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-math/default.nix
index ea449e9501da..d93422755615 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-math/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-math/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-math";
-    rev = "cacbd04bb239db3c772ff5a37c19fe39d127ff3d";
-    sha256 = "1bhs7wslb4rdf2b6h6klw1mpjf9pjpfpf2zg2mj8vg0acyaqvv9d";
+    rev = "3de98fc75b7d06d06651edc48449b1bb71d2171b";
+    sha256 = "sha256-HDhy6uvfmBxJq9UobLhAUdFcYULFvPZbb5vT1Sg7ung=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-math";
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-openid-connect/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-openid-connect/default.nix
index ba5bf27eb77c..6f1044939a70 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-openid-connect/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-openid-connect/default.nix
@@ -6,8 +6,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-openid-connect";
-    rev = "0e1511fcec2bbb26ef08e453920e955d4140df42";
-    sha256 = "02knx3z0ycz83cdarld2hmmpl6f9nkd2snp0qsbk9mjvbfvpfkni";
+    rev = "aa6a628687edc041bd6f46eb2a38e9a71644bdda";
+    sha256 = "sha256-VdaeueESr7X4gB1pW9e//nDLz62GTaZEPyFIvvCfg18=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-openid-connect";
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix
index 2685f73f1715..1300292132fd 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix
@@ -6,8 +6,8 @@
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-prometheus";
-    rev = "08138ae4f89da76dd577781a2116b2ab66f8f547";
-    sha256 = "1x4awgx9fj0a6drsix3mi39ynj56rca3km0fz2xb3g6vxgc7d2z1";
+    rev = "aaaf3eda30e5fc03c880c056c1f2388739569fb0";
+    sha256 = "sha256-8bfjPCcwDjEC7Tu0Jr9VZRpaDlP2nlIOWBH8pUQakxo=";
   };
 
   patches = [
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-saved-searches/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-saved-searches/default.nix
index a641d51f040e..c9e0b8a35422 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-saved-searches/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-saved-searches/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-saved-searches";
-    rev = "b59e0b60afdd5133e60c5cc6169f42f1edd746be";
-    sha256 = "0yhr7gx35q2nshvfxkplplkq73l7sgqlm8r3g1apniqicpk5flqy";
+    rev = "0c14b9080306c2e35abf32f8211076286fdfbd2f";
+    sha256 = "sha256-ahNw2WL5J4qAyUBgpYWTiS4G+QmQa+gloG2Vu67qXR8=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-saved-searches";
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-solved/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-solved/default.nix
index 2e9654ef4ae7..9ec64d2fde4b 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-solved/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-solved/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-solved";
-    rev = "40277e50d43e4bdaab99efab44f59f6e33d74740";
-    sha256 = "02n266swdslws8r26xf99l3ghpqd3dryd0qfp7kiqk3ksy8hh5n2";
+    rev = "6f50e2633545e160c01188bdfa9e57adf1d18adc";
+    sha256 = "sha256-+L4GzJrt15vYY29iYxVpPZFYhLygZJK4I5fqvhdI/HI=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-solved";
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-spoiler-alert/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-spoiler-alert/default.nix
index 85f54655f171..13ea320f743d 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-spoiler-alert/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-spoiler-alert/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-spoiler-alert";
-    rev = "790380d9d321f9368c7a16d8ed87718fc6047bf2";
-    sha256 = "079w4x2wlbsx164wv0zb373r8552wb5fvrb9pqzmrfvy0ybwf328";
+    rev = "f9545afaa557829f8f0c17a856e028a5be7407cf";
+    sha256 = "sha256-VhA7tK+uE2r6E66yn5FbT+Mdp9Ckj92xCF3Q9Wp60T8=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-spoiler-alert";
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-voting/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-voting/default.nix
index fdc0c0f051a4..708e0b116917 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-voting/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-voting/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-voting";
-    rev = "36a41c2969c1ddfd8980e3f766b730b849726a08";
-    sha256 = "0ns2i8liwpd29kbn44wzx9yb0jfpyz70h0hmrs71hz6fdalzm4ph";
+    rev = "c2d8b9456834796e90f2e13e7d11a08f389531e1";
+    sha256 = "sha256-z6JBsuq4nj1eqfU/xoU4xWcVNphuyr3C3iKO0chcSz4=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-voting";
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix
index 0cd8363ba0f4..95a65f49fb33 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix
@@ -5,8 +5,8 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-yearly-review";
-    rev = "683327574ea1a67c9c4182c887d6ba85171ca02b";
-    sha256 = "0y0hvb2ir9254ilpf7mnbn9xvv9anyqj4qwh97cw7jly7n2mga4m";
+    rev = "e42f48a576b753cb1e042e9693af35214333bb0f";
+    sha256 = "sha256-8+pwiQE0Ytva0t80bRDs+7mTZ82fPpmwb7Nk9boPFt8=";
   };
   meta = with lib; {
     homepage = "https://github.com/discourse/discourse-yearly-review";
diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
index 3a3217224cf6..11173dd94b5d 100644
--- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
@@ -83,7 +83,7 @@ GEM
     bootsnap (1.9.3)
       msgpack (~> 1.0)
     builder (3.2.4)
-    bullet (6.1.5)
+    bullet (7.0.0)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
     byebug (11.1.3)
@@ -101,7 +101,7 @@ GEM
     crack (0.4.5)
       rexml
     crass (1.0.6)
-    css_parser (1.10.0)
+    css_parser (1.11.0)
       addressable
     debug_inspector (1.1.0)
     diff-lcs (1.4.4)
@@ -129,10 +129,10 @@ GEM
       sprockets (>= 3.3, < 4.1)
     ember-source (2.18.2)
     erubi (1.10.0)
-    excon (0.88.0)
+    excon (0.89.0)
     execjs (2.8.1)
     exifr (1.3.9)
-    fabrication (2.22.0)
+    fabrication (2.23.1)
     faker (2.19.0)
       i18n (>= 1.6, < 2)
     fakeweb (1.3.0)
@@ -157,7 +157,7 @@ GEM
     faraday-rack (1.0.0)
     fast_blank (1.0.1)
     fast_xs (0.8.0)
-    fastimage (2.2.5)
+    fastimage (2.2.6)
     ffi (1.15.4)
     fspath (3.1.2)
     gc_tracer (1.5.1)
@@ -211,15 +211,15 @@ GEM
     logstash-event (1.2.02)
     logstash-logger (0.26.1)
       logstash-event (~> 1.2)
-    logster (2.10.0)
-    loofah (2.12.0)
+    logster (2.10.1)
+    loofah (2.13.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     lru_redux (1.1.0)
     lz4-ruby (0.3.3)
     maxminddb (0.1.22)
     memory_profiler (1.0.0)
-    message_bus (3.3.6)
+    message_bus (3.3.8)
       rack (>= 1.1.3)
     method_source (1.0.0)
     mini_mime (1.1.2)
@@ -229,9 +229,9 @@ GEM
     mini_scheduler (0.13.0)
       sidekiq (>= 4.2.3)
     mini_sql (1.1.3)
-    mini_suffix (0.3.2)
+    mini_suffix (0.3.3)
       ffi (~> 1.9)
-    minitest (5.14.4)
+    minitest (5.15.0)
     mocha (1.13.0)
     mock_redis (0.29.0)
       ruby2_keywords
@@ -282,7 +282,7 @@ GEM
     parallel (1.21.0)
     parallel_tests (3.7.3)
       parallel
-    parser (3.0.3.1)
+    parser (3.0.3.2)
       ast (~> 2.4.1)
     pg (1.2.3)
     progress (3.6.0)
@@ -325,7 +325,7 @@ GEM
       rake (>= 0.13)
       thor (~> 1.0)
     rainbow (3.0.0)
-    raindrops (0.19.2)
+    raindrops (0.20.0)
     rake (13.0.6)
     rb-fsevent (0.11.0)
     rb-inotify (0.10.1)
@@ -338,7 +338,7 @@ GEM
     redis (4.5.1)
     redis-namespace (1.8.1)
       redis (>= 3.0.4)
-    regexp_parser (2.1.1)
+    regexp_parser (2.2.0)
     request_store (1.5.0)
       rack (>= 1.4)
     rexml (3.2.5)
@@ -388,9 +388,9 @@ GEM
       rubocop-ast (>= 1.12.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.13.0)
+    rubocop-ast (1.15.0)
       parser (>= 3.0.1.1)
-    rubocop-discourse (2.4.2)
+    rubocop-discourse (2.5.0)
       rubocop (>= 1.1.0)
       rubocop-rspec (>= 2.0.0)
     rubocop-rspec (2.6.0)
@@ -432,7 +432,7 @@ GEM
     sprockets (3.7.2)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (3.4.1)
+    sprockets-rails (3.4.2)
       actionpack (>= 5.2)
       activesupport (>= 5.2)
       sprockets (>= 3.0.0)
diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
index 7ee104f66745..36b50339e037 100644
--- a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
@@ -273,10 +273,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01xachwsyykmp153514vz2khanbsz1n27j09za5gcxj54srh5l4p";
+      sha256 = "0w3jk595azcc9fvklrk2klkljwhgzjhnns7l5iqhnafvr8q60xnr";
       type = "gem";
     };
-    version = "6.1.5";
+    version = "7.0.0";
   };
   byebug = {
     groups = ["development" "test"];
@@ -414,10 +414,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1q8gj3wkc2mbzsqw5zcsr3kyzrrb2pda03pi769rjbvqr94g3bm5";
+      sha256 = "1qbdgp36dhcyljhmfxrvbgp1ha9yqxhxgyg3sdm48y9m371jd2an";
       type = "gem";
     };
-    version = "1.10.0";
+    version = "1.11.0";
   };
   debug_inspector = {
     groups = ["default" "development"];
@@ -573,10 +573,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15yrwawhvkjvfg0dsf8z81876ddj6161q0wh5s7pw4sim8z8pspr";
+      sha256 = "0153rr745g48h48vaplgmx7xkfjbc79acpq5jsl7agdrk4yf75ih";
       type = "gem";
     };
-    version = "0.88.0";
+    version = "0.89.0";
   };
   execjs = {
     groups = ["assets" "default"];
@@ -603,10 +603,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1a1zv94hcss44n1b04w0rg0swg8npigrj3nva9h0y2f1iflj124k";
+      sha256 = "1i4pcqmf8q0gkjzhndcbzgg8bg4rkvbpp2gapnqxc8j8gcxzi1fi";
       type = "gem";
     };
-    version = "2.22.0";
+    version = "2.23.1";
   };
   faker = {
     dependencies = ["i18n"];
@@ -757,10 +757,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05i1fgqy4l40niwm9y56d04f876sm0cvc7q3w2rpddf8gya4lcs9";
+      sha256 = "0nnggg20za5vamdpkgrxxa32z33d8hf0g2bciswkhqnc6amb3yjr";
       type = "gem";
     };
-    version = "2.2.5";
+    version = "2.2.6";
   };
   ffi = {
     groups = ["default" "development" "test"];
@@ -1090,10 +1090,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13k73ap18p09bxwgw24xc1lb5bxnky8p0xpx7yrlk74xlffasw30";
+      sha256 = "09l4rdq5gsnhr7ma7i5ddg8sagkqn122kz8cb244q4hyk9rwmd2w";
       type = "gem";
     };
-    version = "2.10.0";
+    version = "2.10.1";
   };
   loofah = {
     dependencies = ["crass" "nokogiri"];
@@ -1101,10 +1101,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nqcya57x2n58y1dify60i0dpla40n4yir928khp4nj5jrn9mgmw";
+      sha256 = "17rvbrqcci1579d7dpbsfmz1f9g7msk82lyh9ip5h29dkrnixcgg";
       type = "gem";
     };
-    version = "2.12.0";
+    version = "2.13.0";
   };
   lru_redux = {
     groups = ["default"];
@@ -1175,10 +1175,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1d0cdx4cszsa0wgnch1b5dcyalg6x9niyydik8yyampnpjghwfnk";
+      sha256 = "0xf3r47qpigg661krwa8z7k4f0z0rx9r5g2mgahrrwgjn67d332l";
       type = "gem";
     };
-    version = "3.3.6";
+    version = "3.3.8";
   };
   method_source = {
     groups = ["default" "development" "test"];
@@ -1248,20 +1248,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1r6pwyv1vpyza0rn1pyxls4qdw5jd3vg4k5dp1iaqa57n6fiqrvi";
+      sha256 = "1rr2nx1kixd7ccxqdnswjnflg46s6lr1f9vxkdy298k95zwk67cd";
       type = "gem";
     };
-    version = "0.3.2";
+    version = "0.3.3";
   };
   minitest = {
     groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19z7wkhg59y8abginfrm2wzplz7py3va8fyngiigngqvsws6cwgl";
+      sha256 = "06xf558gid4w8lwx13jwfdafsch9maz8m0g85wnfymqj63x5nbbd";
       type = "gem";
     };
-    version = "5.14.4";
+    version = "5.15.0";
   };
   mocha = {
     groups = ["development" "test"];
@@ -1530,10 +1530,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1skkdjawwigi9vs5zkp03jkpx2f11drfjz483g1xw2dnjdsq22c3";
+      sha256 = "0sszdl9mpzqzn9kxrp28sqmg47mjxcwypr4d60vbajqba4v885di";
       type = "gem";
     };
-    version = "3.0.3.1";
+    version = "3.0.3.2";
   };
   pg = {
     groups = ["default"];
@@ -1752,10 +1752,10 @@
     }];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07nikrdnsf6g55225njnzs1lm9s0lnbv2krvqd2gldwl49l7vl9x";
+      sha256 = "0wb2x51parf6v78w0cic90m33bdc92y5h8rj4wqs75dhw1b69hc7";
       type = "gem";
     };
-    version = "0.19.2";
+    version = "0.20.0";
   };
   rake = {
     groups = ["default" "development" "test"];
@@ -1839,10 +1839,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vg7imjnfcqjx7kw94ccj5r78j4g190cqzi1i59sh4a0l940b9cr";
+      sha256 = "008yn8j44414qxhn1c0nxp4a70rq0bqhz70hnjpgx8cjh2g0makp";
       type = "gem";
     };
-    version = "2.1.1";
+    version = "2.2.0";
   };
   request_store = {
     dependencies = ["rack"];
@@ -2031,10 +2031,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06krbzlj49gjfmxpjwadfwqsqg5bgcp9k1fahyxxk3f6idqhkjbv";
+      sha256 = "0bj8ppl4143f7pkcwm4l5wcahid6yzracdlzh1w2fpss89pic2rf";
       type = "gem";
     };
-    version = "1.13.0";
+    version = "1.15.0";
   };
   rubocop-discourse = {
     dependencies = ["rubocop" "rubocop-rspec"];
@@ -2042,10 +2042,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1agjjqdzajlssw2lxpchz5gr2sll9lh5yldccgmghxh39l01cr0a";
+      sha256 = "01f4y7am9cq276zl8vsgv64w8wfmhpbzg7vzsifhgnnh92g6s04g";
       type = "gem";
     };
-    version = "2.4.2";
+    version = "2.5.0";
   };
   rubocop-rspec = {
     dependencies = ["rubocop"];
@@ -2227,10 +2227,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pjz4lbv2v0p9fa5nsrxy5lphsixb9a69gq2rxp0h5sr61m18mdq";
+      sha256 = "1b9i14qb27zs56hlcc2hf139l0ghbqnjpmfi0054dxycaxvk5min";
       type = "gem";
     };
-    version = "3.4.1";
+    version = "3.4.2";
   };
   sshkey = {
     groups = ["default"];

From 721fde93ffcc941b7486e3ec77121d9a8ddbd64f Mon Sep 17 00:00:00 2001
From: Nikolay Amiantov <ab@fmap.me>
Date: Wed, 15 Dec 2021 01:07:47 +0300
Subject: [PATCH 04/63] docker: add rootless daemon script

---
 pkgs/applications/virtualization/docker/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 8345b2b42d76..3bea9f447668 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -15,7 +15,7 @@ rec {
       , go-md2man, go, containerd_1_4, runc, docker-proxy, tini, libtool
       , sqlite, iproute2, lvm2, systemd, docker-buildx, docker-compose_2
       , btrfs-progs, iptables, e2fsprogs, xz, util-linux, xfsprogs, git
-      , procps, libseccomp
+      , procps, libseccomp, rootlesskit, slirp4netns, fuse-overlayfs
       , nixosTests
       , clientOnly ? !stdenv.isLinux, symlinkJoin
     }:
@@ -77,6 +77,8 @@ rec {
 
       extraPath = optionals (stdenv.isLinux) (makeBinPath [ iproute2 iptables e2fsprogs xz xfsprogs procps util-linux git ]);
 
+      extraUserPath = optionals (stdenv.isLinux) (makeBinPath [ rootlesskit slirp4netns fuse-overlayfs ]);
+
       postPatch = ''
         patchShebangs hack/make.sh hack/make/
       '';
@@ -109,6 +111,11 @@ rec {
         install -Dm644 ./contrib/init/systemd/docker.service $out/etc/systemd/system/docker.service
         substituteInPlace $out/etc/systemd/system/docker.service --replace /usr/bin/dockerd $out/bin/dockerd
         install -Dm644 ./contrib/init/systemd/docker.socket $out/etc/systemd/system/docker.socket
+
+        # rootless Docker
+        install -Dm755 ./contrib/dockerd-rootless.sh $out/libexec/docker/dockerd-rootless.sh
+        makeWrapper $out/libexec/docker/dockerd-rootless.sh $out/bin/dockerd-rootless \
+          --prefix PATH : "$out/libexec/docker:$extraPath:$extraUserPath"
       '';
 
       DOCKER_BUILDTAGS = []
@@ -184,6 +191,7 @@ rec {
     '' + optionalString (!clientOnly) ''
       # symlink docker daemon to docker cli derivation
       ln -s ${moby}/bin/dockerd $out/bin/dockerd
+      ln -s ${moby}/bin/dockerd-rootless $out/bin/dockerd-rootless
 
       # systemd
       mkdir -p $out/etc/systemd/system

From ab64310a5e5534a8c96d6523ba5a765d27beceaf Mon Sep 17 00:00:00 2001
From: Nikolay Amiantov <ab@fmap.me>
Date: Wed, 15 Dec 2021 01:07:58 +0300
Subject: [PATCH 05/63] docker-rootless service: init

---
 .../from_md/release-notes/rl-2205.section.xml |  8 ++
 .../manual/release-notes/rl-2205.section.md   |  1 +
 nixos/modules/module-list.nix                 |  1 +
 .../virtualisation/docker-rootless.nix        | 98 +++++++++++++++++++
 nixos/tests/all-tests.nix                     |  1 +
 nixos/tests/docker-rootless.nix               | 41 ++++++++
 6 files changed, 150 insertions(+)
 create mode 100644 nixos/modules/virtualisation/docker-rootless.nix
 create mode 100644 nixos/tests/docker-rootless.nix

diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index ae6ff9d434ae..d11b29a6334d 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -33,6 +33,14 @@
           <link linkend="opt-services.aesmd.enable">services.aesmd</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://docs.docker.com/engine/security/rootless/">rootless
+          Docker</link>, a <literal>systemd --user</literal> Docker
+          service which runs without root permissions. Available as
+          <link xlink:href="options.html#opt-virtualisation.docker.rootless.enable">virtualisation.docker.rootless.enable</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html">filebeat</link>,
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 3e7f8d451b26..3990a3359b65 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -11,6 +11,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 ## New Services {#sec-release-22.05-new-services}
 
 - [aesmd](https://github.com/intel/linux-sgx#install-the-intelr-sgx-psw), the Intel SGX Architectural Enclave Service Manager. Available as [services.aesmd](#opt-services.aesmd.enable).
+- [rootless Docker](https://docs.docker.com/engine/security/rootless/), a `systemd --user` Docker service which runs without root permissions. Available as [virtualisation.docker.rootless.enable](options.html#opt-virtualisation.docker.rootless.enable).
 
 - [filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html), a lightweight shipper for forwarding and centralizing log data. Available as [services.filebeat](#opt-services.filebeat.enable).
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 30ad0db459ef..55de01735024 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1187,6 +1187,7 @@
   ./virtualisation/oci-containers.nix
   ./virtualisation/cri-o.nix
   ./virtualisation/docker.nix
+  ./virtualisation/docker-rootless.nix
   ./virtualisation/ecs-agent.nix
   ./virtualisation/libvirtd.nix
   ./virtualisation/lxc.nix
diff --git a/nixos/modules/virtualisation/docker-rootless.nix b/nixos/modules/virtualisation/docker-rootless.nix
new file mode 100644
index 000000000000..0e7f05031420
--- /dev/null
+++ b/nixos/modules/virtualisation/docker-rootless.nix
@@ -0,0 +1,98 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.virtualisation.docker.rootless;
+  proxy_env = config.networking.proxy.envVars;
+  settingsFormat = pkgs.formats.json {};
+  daemonSettingsFile = settingsFormat.generate "daemon.json" cfg.daemon.settings;
+
+in
+
+{
+  ###### interface
+
+  options.virtualisation.docker.rootless = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        This option enables docker in a rootless mode, a daemon that manages
+        linux containers. To interact with the daemon, one needs to set
+        <command>DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock</command>.
+      '';
+    };
+
+    setSocketVariable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Point <command>DOCKER_HOST</command> to rootless Docker instance for
+        normal users by default.
+      '';
+    };
+
+    daemon.settings = mkOption {
+      type = settingsFormat.type;
+      default = { };
+      example = {
+        ipv6 = true;
+        "fixed-cidr-v6" = "fd00::/80";
+      };
+      description = ''
+        Configuration for docker daemon. The attributes are serialized to JSON used as daemon.conf.
+        See https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-configuration-file
+      '';
+    };
+
+    package = mkOption {
+      default = pkgs.docker;
+      defaultText = literalExpression "pkgs.docker";
+      type = types.package;
+      example = literalExpression "pkgs.docker-edge";
+      description = ''
+        Docker package to be used in the module.
+      '';
+    };
+  };
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    environment.extraInit = optionalString cfg.setSocketVariable ''
+      if [ -z "$DOCKER_HOST" -a -n "$XDG_RUNTIME_DIR" ]; then
+        export DOCKER_HOST="unix://$XDG_RUNTIME_DIR/docker.sock"
+      fi
+    '';
+
+    # Taken from https://github.com/moby/moby/blob/master/contrib/dockerd-rootless-setuptool.sh
+    systemd.user.services.docker = {
+      wantedBy = [ "default.target" ];
+      description = "Docker Application Container Engine (Rootless)";
+      # needs newuidmap from pkgs.shadow
+      path = [ "/run/wrappers" ];
+      environment = proxy_env;
+      unitConfig.StartLimitInterval = "60s";
+      serviceConfig = {
+        Type = "notify";
+        ExecStart = "${cfg.package}/bin/dockerd-rootless --config-file=${daemonSettingsFile}";
+        ExecReload = "${pkgs.procps}/bin/kill -s HUP $MAINPID";
+        TimeoutSec = 0;
+        RestartSec = 2;
+        Restart = "always";
+        StartLimitBurst = 3;
+        LimitNOFILE = "infinity";
+        LimitNPROC = "infinity";
+        LimitCORE = "infinity";
+        Delegate = true;
+        NotifyAccess = "all";
+        KillMode = "mixed";
+      };
+    };
+  };
+
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 8f4d800abbfd..779519b965db 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -104,6 +104,7 @@ in
   dnscrypt-wrapper = handleTestOn ["x86_64-linux"] ./dnscrypt-wrapper {};
   doas = handleTest ./doas.nix {};
   docker = handleTestOn ["x86_64-linux"] ./docker.nix {};
+  docker-rootless = handleTestOn ["x86_64-linux"] ./docker-rootless.nix {};
   docker-edge = handleTestOn ["x86_64-linux"] ./docker-edge.nix {};
   docker-registry = handleTest ./docker-registry.nix {};
   docker-tools = handleTestOn ["x86_64-linux"] ./docker-tools.nix {};
diff --git a/nixos/tests/docker-rootless.nix b/nixos/tests/docker-rootless.nix
new file mode 100644
index 000000000000..e2a926eb3cb0
--- /dev/null
+++ b/nixos/tests/docker-rootless.nix
@@ -0,0 +1,41 @@
+# This test runs docker and checks if simple container starts
+
+import ./make-test-python.nix ({ lib, pkgs, ...} : {
+  name = "docker-rootless";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ abbradar ];
+  };
+
+  nodes = {
+    machine = { pkgs, ... }: {
+      virtualisation.docker.rootless.enable = true;
+
+      users.users.alice = {
+        uid = 1000;
+        isNormalUser = true;
+      };
+    };
+  };
+
+  testScript = { nodes, ... }:
+    let
+      user = nodes.machine.config.users.users.alice;
+      sudo = lib.concatStringsSep " " [
+        "XDG_RUNTIME_DIR=/run/user/${toString user.uid}"
+        "DOCKER_HOST=unix:///run/user/${toString user.uid}/docker.sock"
+        "sudo" "--preserve-env=XDG_RUNTIME_DIR,DOCKER_HOST" "-u" "alice"
+      ];
+    in ''
+      machine.wait_for_unit("multi-user.target")
+
+      machine.succeed("loginctl enable-linger alice")
+      machine.wait_until_succeeds("${sudo} systemctl --user is-active docker.service")
+
+      machine.succeed("tar cv --files-from /dev/null | ${sudo} docker import - scratchimg")
+      machine.succeed(
+          "${sudo} docker run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+      )
+      machine.succeed("${sudo} docker ps | grep sleeping")
+      machine.succeed("${sudo} docker stop sleeping")
+    '';
+})

From b4703e11afbc188397e2f49e3fad96b5b1502957 Mon Sep 17 00:00:00 2001
From: Nikolay Amiantov <ab@fmap.me>
Date: Fri, 17 Dec 2021 02:40:41 +0300
Subject: [PATCH 06/63] docker: only add rootless dependencies for the server

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 pkgs/applications/virtualization/docker/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 3bea9f447668..a6c94bf89144 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -77,7 +77,7 @@ rec {
 
       extraPath = optionals (stdenv.isLinux) (makeBinPath [ iproute2 iptables e2fsprogs xz xfsprogs procps util-linux git ]);
 
-      extraUserPath = optionals (stdenv.isLinux) (makeBinPath [ rootlesskit slirp4netns fuse-overlayfs ]);
+      extraUserPath = optionals (stdenv.isLinux && !clientOnly) (makeBinPath [ rootlesskit slirp4netns fuse-overlayfs ]);
 
       postPatch = ''
         patchShebangs hack/make.sh hack/make/

From 1138af563745b5d14e1299c5d32a29961d6313bb Mon Sep 17 00:00:00 2001
From: talyz <kim.lindberger@gmail.com>
Date: Wed, 22 Dec 2021 14:22:12 +0100
Subject: [PATCH 07/63] discourse: Add aarch64-linux to the list of platforms
 to be removed

...in the update script and remove it from the Gemfile.lock. Having
it there causes a failure with the error message:

Could not find libv8-node-16.10.0.0-aarch64-linux in any of the
sources (Bundler::GemNotFound)

And since we're not using the prebuilt binary packages anyway, we
don't need it there in the first place.
---
 pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock | 2 --
 pkgs/servers/web-apps/discourse/update.py            | 2 +-
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
index 11173dd94b5d..aec33b300ef3 100644
--- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
@@ -198,7 +198,6 @@ GEM
     jwt (2.3.0)
     kgio (2.11.4)
     libv8-node (16.10.0.0)
-    libv8-node (16.10.0.0-aarch64-linux)
     listen (3.7.0)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
@@ -466,7 +465,6 @@ GEM
     zeitwerk (2.5.1)
 
 PLATFORMS
-  aarch64-linux
   ruby
 
 DEPENDENCIES
diff --git a/pkgs/servers/web-apps/discourse/update.py b/pkgs/servers/web-apps/discourse/update.py
index 418c89d388b6..ebc85c02087a 100755
--- a/pkgs/servers/web-apps/discourse/update.py
+++ b/pkgs/servers/web-apps/discourse/update.py
@@ -164,7 +164,7 @@ def _diff_file(filepath: str, old_version: DiscourseVersion, new_version: Discou
 def _remove_platforms(rubyenv_dir: Path):
     for platform in ['arm64-darwin-20', 'x86_64-darwin-18',
                      'x86_64-darwin-19', 'x86_64-darwin-20',
-                     'x86_64-linux']:
+                     'x86_64-linux', 'aarch64-linux']:
         with open(rubyenv_dir / 'Gemfile.lock', 'r') as f:
             for line in f:
                 if platform in line:

From ae77e2fb78dcb3d1545fd0c3437d5bcafe310839 Mon Sep 17 00:00:00 2001
From: talyz <kim.lindberger@gmail.com>
Date: Wed, 22 Dec 2021 14:30:05 +0100
Subject: [PATCH 08/63] discourse: Forward the used system and pkgs attributes
 to the tests

The system attribute is otherwise deduced from the system the
evaluation runs on, which could be incorrect if using remote
builders.
---
 pkgs/servers/web-apps/discourse/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix
index 9a04bf479913..0d457debc147 100644
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -313,7 +313,11 @@ let
       enabledPlugins = plugins;
       plugins = callPackage ./plugins/all-plugins.nix { inherit mkDiscoursePlugin; };
       ruby = rubyEnv.wrappedRuby;
-      tests = import ../../../../nixos/tests/discourse.nix { package = pkgs.discourse.override args; };
+      tests = import ../../../../nixos/tests/discourse.nix {
+        inherit (stdenv) system;
+        inherit pkgs;
+        package = pkgs.discourse.override args;
+      };
     };
   };
 in discourse

From 5e2884794cdc26626723a45bc7a22c3a69d0520d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 24 Dec 2021 01:12:26 +0100
Subject: [PATCH 09/63] python3Packages.aiohue: 3.0.7 -> 3.0.10

---
 pkgs/development/python-modules/aiohue/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiohue/default.nix b/pkgs/development/python-modules/aiohue/default.nix
index 6b791b32e724..fd15d3aa8f80 100644
--- a/pkgs/development/python-modules/aiohue/default.nix
+++ b/pkgs/development/python-modules/aiohue/default.nix
@@ -2,19 +2,21 @@
 , buildPythonPackage
 , fetchPypi
 , aiohttp
+, asyncio-throttle
 }:
 
 buildPythonPackage rec {
   pname = "aiohue";
-  version = "3.0.7";
+  version = "3.0.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Q01giQZytOQ+Ko7kvL0OfdDPysfvtKhW7fYmHmAv5Go=";
+    sha256 = "sha256-LwtE9F5ic0aZ9/q3dSWn20O27yW/QD/Yi1NPdFmiP10=";
   };
 
   propagatedBuildInputs = [
     aiohttp
+    asyncio-throttle
   ];
 
   pythonImportsCheck = [

From 0879f11d899488e42552066f67d5a4d7769b53fd Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 24 Dec 2021 01:14:00 +0100
Subject: [PATCH 10/63] python3Packages.aiopvpc: 2.2.4 -> 3.0.0

---
 pkgs/development/python-modules/aiopvpc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiopvpc/default.nix b/pkgs/development/python-modules/aiopvpc/default.nix
index b3f24e6051a4..ae069ae18266 100644
--- a/pkgs/development/python-modules/aiopvpc/default.nix
+++ b/pkgs/development/python-modules/aiopvpc/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "aiopvpc";
-  version = "2.2.4";
+  version = "3.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "azogue";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-39cGDbaBS5we+WbqvABe6tKwTmbgd+NYLssKQCOuBsc=";
+    sha256 = "sha256-eTCQddoZIaCs7iKGNBC8aSq6ek4vwYXgIXx35UlME/k=";
   };
 
   nativeBuildInputs = [

From dd914062c09d18e767e6cf0ebf2fd77bfbd3df36 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 24 Dec 2021 01:49:05 +0100
Subject: [PATCH 11/63] python3Packages.pytile: 2021.10.0 -> 2021.12.0

---
 pkgs/development/python-modules/pytile/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytile/default.nix b/pkgs/development/python-modules/pytile/default.nix
index 4806fa0b55e2..1673688657cc 100644
--- a/pkgs/development/python-modules/pytile/default.nix
+++ b/pkgs/development/python-modules/pytile/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pytile";
-  version = "2021.10.0";
+  version = "2021.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = pname;
     rev = version;
-    sha256 = "sha256-9FbcGhRmXULJgfJOmy6mhiZwQUDNmvxZI/WxjJIbnc8=";
+    sha256 = "sha256-a76Qzk8ZsoV6HUOcDjMdnFVZJu/iKFbShoC9OZ0caDc=";
   };
 
   nativeBuildInputs = [

From 3c34d662ac0a93e4c5689ec4367aa1393d2bf952 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 24 Dec 2021 01:49:28 +0100
Subject: [PATCH 12/63] python3Packages.xknx: 0.18.14 -> 0.18.15

---
 pkgs/development/python-modules/xknx/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/xknx/default.nix b/pkgs/development/python-modules/xknx/default.nix
index f86abba711c7..781f59fa3cf7 100644
--- a/pkgs/development/python-modules/xknx/default.nix
+++ b/pkgs/development/python-modules/xknx/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "xknx";
-  version = "0.18.14";
+  version = "0.18.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "XKNX";
     repo = pname;
     rev = version;
-    sha256 = "sha256-PWBUG9sa9530cfXqpJ+0UVxOx+FxNfz4ZLazpUILvww=";
+    sha256 = "sha256-k/fLUuBjXScTvlvoBLZIVPEqNGIPI04FBeTBadp5uiY=";
   };
 
   propagatedBuildInputs = [

From 308bc63c20e2d5317e866c18d55bbe7783bf1394 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 24 Dec 2021 02:14:23 +0100
Subject: [PATCH 13/63] home-assistant: 2021.12.4 -> 2021.12.5

---
 pkgs/servers/home-assistant/component-packages.nix | 6 +++---
 pkgs/servers/home-assistant/default.nix            | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 419447a32bad..a903f7a333f8 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2021.12.4";
+  version = "2021.12.5";
   components = {
     "abode" = ps: with ps; [ abodepy ];
     "accuweather" = ps: with ps; [ accuweather ];
@@ -180,7 +180,7 @@
     "devolo_home_network" = ps: with ps; [ devolo-plc-api ];
     "dexcom" = ps: with ps; [ pydexcom ];
     "dhcp" = ps: with ps; [ aiodiscover scapy ];
-    "dht" = ps: with ps; [ ]; # missing inputs: adafruit-circuitpython-dht
+    "dht" = ps: with ps; [ ]; # missing inputs: RPi.GPIO adafruit-circuitpython-dht
     "dialogflow" = ps: with ps; [ aiohttp-cors ];
     "digital_ocean" = ps: with ps; [ digital-ocean ];
     "digitalloggers" = ps: with ps; [ ]; # missing inputs: dlipower
@@ -706,7 +706,7 @@
     "remote" = ps: with ps; [ ];
     "remote_rpi_gpio" = ps: with ps; [ ]; # missing inputs: gpiozero
     "renault" = ps: with ps; [ renault-api ];
-    "repetier" = ps: with ps; [ ]; # missing inputs: pyrepetier
+    "repetier" = ps: with ps; [ ]; # missing inputs: pyrepetierng
     "rest" = ps: with ps; [ jsonpath xmltodict ];
     "rest_command" = ps: with ps; [ ];
     "rflink" = ps: with ps; [ rflink ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 5e5026901b08..3701caea5087 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -252,7 +252,7 @@ let
   extraBuildInputs = extraPackages py.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2021.12.4";
+  hassVersion = "2021.12.5";
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "homeassistant";
@@ -269,7 +269,7 @@ in with py.pkgs; buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    hash = "sha256:NZPv6Zyy9brdArRsyGA6EMkYEY1wCf6osjek4lEsr1c=";
+    hash = "sha256:116qklmzvqh3hn3i6i7lvsnqydd2qclk612rwlxs3v56kzpks62n";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling

From 44a97867600d7148298e363f34cfcaee9ba486c4 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 24 Dec 2021 23:49:19 +0100
Subject: [PATCH 14/63] home-assistant: override yalexs

---
 pkgs/servers/home-assistant/default.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 3701caea5087..8f309f9b6c4f 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -219,6 +219,19 @@ let
       });
     })
 
+    # Remove with 2021.12.6 as the requirement will be 1.1.16 (at least)
+    (self: super: {
+      yalexs = super.yalexs.overridePythonAttrs (oldAttrs: rec {
+        version = "1.1.13";
+        src = fetchFromGitHub {
+          owner = "bdraco";
+          repo = "yalexs";
+          rev = "v${version}";
+          sha256 = "sha256-lnx8+VyDyO7Wg+QW+CC0FUg77Ndfjar6PLsDYwEpaCQ=";
+        };
+      });
+    })
+
     # home-assistant-frontend does not exist in python3.pkgs
     (self: super: {
       home-assistant-frontend = self.callPackage ./frontend.nix { };

From 5b4c7709d4d9ed01f29a846cd975a5aeaaa27496 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 26 Dec 2021 07:17:23 +0000
Subject: [PATCH 15/63] python38Packages.stripe: 2.63.0 -> 2.64.0

---
 pkgs/development/python-modules/stripe/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/stripe/default.nix b/pkgs/development/python-modules/stripe/default.nix
index ddb3a314f0a7..4acad30ea322 100644
--- a/pkgs/development/python-modules/stripe/default.nix
+++ b/pkgs/development/python-modules/stripe/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "stripe";
-  version = "2.63.0";
+  version = "2.64.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "816c935e31d82737a9e4362c662e8702bdf9000ea1bd36882cd4cbd23eb81ae1";
+    sha256 = "2f4b2175046104e4fcd8a2689a68bb9828a857814126d2ed13772cf2554fb93e";
   };
 
   propagatedBuildInputs = [ requests ];

From 60375da6f7f5aab0227befe186c19f5c9b18a913 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 26 Dec 2021 10:46:33 +0000
Subject: [PATCH 16/63] python38Packages.snowflake-connector-python: 2.7.1 ->
 2.7.2

---
 .../python-modules/snowflake-connector-python/default.nix     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/snowflake-connector-python/default.nix b/pkgs/development/python-modules/snowflake-connector-python/default.nix
index af6cd8defc7a..c157a6a2132a 100644
--- a/pkgs/development/python-modules/snowflake-connector-python/default.nix
+++ b/pkgs/development/python-modules/snowflake-connector-python/default.nix
@@ -24,12 +24,12 @@
 
 buildPythonPackage rec {
   pname = "snowflake-connector-python";
-  version = "2.7.1";
+  version = "2.7.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "81175ff9fe0355a7e9007a087458dddc0816985ec10dc122e690de03549afbff";
+    sha256 = "b2f8f360750eefa98be09ff53c130381646f8dfc8c6e4a705387676210ff8578";
   };
 
   propagatedBuildInputs = [

From 2d18e3a33daf50b3eb1fb6e9405f72ca8be502ba Mon Sep 17 00:00:00 2001
From: Bernardo Meurer <bernardo@meurer.org>
Date: Sun, 26 Dec 2021 13:39:41 -0300
Subject: [PATCH 17/63] roon-server: 1.8-850 -> 1.8-880

---
 pkgs/servers/roon-server/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/roon-server/default.nix b/pkgs/servers/roon-server/default.nix
index 96b10829d865..c39ac2d39cb4 100644
--- a/pkgs/servers/roon-server/default.nix
+++ b/pkgs/servers/roon-server/default.nix
@@ -8,13 +8,14 @@
 , icu66
 , krb5
 , lib
+, libtasn1
 , makeWrapper
 , stdenv
 , openssl
 }:
 stdenv.mkDerivation rec {
   pname = "roon-server";
-  version = "1.8-850";
+  version = "1.8-880";
 
   src =
     let
@@ -22,13 +23,14 @@ stdenv.mkDerivation rec {
     in
     fetchurl {
       url = "http://download.roonlabs.com/builds/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-      sha256 = "sha256-NSNaL0ERYTSYn9ETjWcQiuI4hY+w/lWVOz3n9lt6O+4=";
+      sha256 = "sha256-Td3iRYGmTg8Vx9c4e4ugIIbAqhDFPax9vR2BsCIQCZA=";
     };
 
   buildInputs = [
     alsa-lib
     freetype
     krb5
+    libtasn1
     stdenv.cc.cc.lib
   ];
 

From a88d846b91dc3c75b825187998debd8e08c7794b Mon Sep 17 00:00:00 2001
From: Lucas Savva <lucas@m1cr0man.com>
Date: Fri, 26 Nov 2021 21:39:06 +0000
Subject: [PATCH 18/63] nixos/acme: Remove selfsignedDeps from finished targets

selfsignedDeps is already appended to the after and wants
of a cert's renewal service, making these redundant.

You can see this if you run the following command:
systemctl list-dependencies --all --reverse acme-selfsigned-mydomain.com.service
---
 nixos/modules/security/acme.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index dcadbce68aa4..dcea137b52e9 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -842,8 +842,8 @@ in {
         # Create some targets which can be depended on to be "active" after cert renewals
         finishedTargets = mapAttrs' (cert: conf: nameValuePair "acme-finished-${cert}" {
           wantedBy = [ "default.target" ];
-          requires = [ "acme-${cert}.service" ] ++ conf.selfsignedDeps;
-          after = [ "acme-${cert}.service" ] ++ conf.selfsignedDeps;
+          requires = [ "acme-${cert}.service" ];
+          after = [ "acme-${cert}.service" ];
         }) certConfigs;
 
         # Create targets to limit the number of simultaneous account creations

From 87403a0b078d62245de7d619f2b71d2a0c78675a Mon Sep 17 00:00:00 2001
From: Lucas Savva <lucas@m1cr0man.com>
Date: Fri, 26 Nov 2021 21:57:31 +0000
Subject: [PATCH 19/63] nixos/acme: Add a human readable error on run failure

Closes NixOS/nixpkgs#108237

When a user first adds an ACME cert to their configuration,
it's likely to fail to renew due to DNS misconfig. This is
non-fatal for other services since selfsigned certs are
(usually) put in place to let dependant services start.
Tell the user about this in the logs, and exit 2 for
differentiation purposes.
---
 nixos/modules/security/acme.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index dcea137b52e9..be4762da8d13 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -391,8 +391,13 @@ let
           fi
 
         # Otherwise do a full run
-        else
-          lego ${runOpts}
+        elif ! lego ${runOpts}; then
+          # Produce a nice error for those doing their first nixos-rebuild with these certs
+          echo Failed to fetch certificates. \
+            This may mean your DNS records are set up incorrectly. \
+            ${optionalString (cfg.preliminarySelfsigned) "Selfsigned certs are in place and dependant services will still start."}
+          # Exit 2 so that users can potentially amend SuccessExitStatus to ignore this error.
+          exit 2
         fi
 
         mv domainhash.txt certificates/

From a7f00013280416ce889d841e675526b8cb96a0ee Mon Sep 17 00:00:00 2001
From: Lucas Savva <lucas@m1cr0man.com>
Date: Sat, 27 Nov 2021 00:03:35 +0000
Subject: [PATCH 20/63] nixos/acme: Check for revoked certificates

Closes #129838

It is possible for the CA to revoke a cert that has not yet
expired. We must run lego to validate this before expiration,
but we must still ignore failures on unexpired certs to retain
compatibility with #85794

Also changed domainHash logic such that a renewal will only
be attempted at all if domains are unchanged, and do a full
run otherwises. Resolves #147540 but will be partially
reverted when go-acme/lego#1532 is resolved + available.
---
 nixos/modules/security/acme.nix | 25 +++++++++++--------------
 nixos/tests/acme.nix            | 22 +++++++++++++++++++++-
 2 files changed, 32 insertions(+), 15 deletions(-)

diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index be4762da8d13..9242a12fd35f 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -156,6 +156,7 @@ let
       ${toString data.ocspMustStaple} ${data.keyType}
     '';
     certDir = mkHash hashData;
+    # TODO remove domainHash usage entirely. Waiting on go-acme/lego#1532
     domainHash = mkHash "${concatStringsSep " " extraDomains} ${data.domain}";
     accountHash = (mkAccountHash acmeServer data);
     accountDir = accountDirRoot + accountHash;
@@ -372,22 +373,19 @@ let
 
         echo '${domainHash}' > domainhash.txt
 
-        # Check if we can renew
-        if [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' -a -n "$(ls -1 accounts)" ]; then
+        # Check if we can renew.
+        # We can only renew if the list of domains has not changed.
+        if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' -a -n "$(ls -1 accounts)" ]; then
 
-          # When domains are updated, there's no need to do a full
-          # Lego run, but it's likely renew won't work if days is too low.
-          if [ -e certificates/domainhash.txt ] && cmp -s domainhash.txt certificates/domainhash.txt; then
+          # Even if a cert is not expired, it may be revoked by the CA.
+          # Try to renew, and silently fail if the cert is not expired.
+          # Avoids #85794 and resolves #129838
+          if ! lego ${renewOpts} --days ${toString cfg.validMinDays}; then
             if is_expiration_skippable out/full.pem; then
-              echo 1>&2 "nixos-acme: skipping renewal because expiration isn't within the coming ${toString cfg.validMinDays} days"
+              echo 1>&2 "nixos-acme: Ignoring failed renewal because expiration isn't within the coming ${toString cfg.validMinDays} days"
             else
-              echo 1>&2 "nixos-acme: renewing now, because certificate expires within the configured ${toString cfg.validMinDays} days"
-              lego ${renewOpts} --days ${toString cfg.validMinDays}
+              exit 3
             fi
-          else
-            echo 1>&2 "certificate domain(s) have changed; will renew now"
-            # Any number > 90 works, but this one is over 9000 ;-)
-            lego ${renewOpts} --days 9001
           fi
 
         # Otherwise do a full run
@@ -406,8 +404,7 @@ let
         chown 'acme:${data.group}' certificates/*
 
         # Copy all certs to the "real" certs directory
-        CERT='certificates/${keyName}.crt'
-        if [ -e "$CERT" ] && ! cmp -s "$CERT" out/fullchain.pem; then
+        if ! cmp -s 'certificates/${keyName}.crt' out/fullchain.pem; then
           touch out/renewed
           echo Installing new certificate
           cp -vp 'certificates/${keyName}.crt' out/fullchain.pem
diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix
index 72b7bb8a396a..80b85502d4e8 100644
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@@ -113,11 +113,19 @@ in import ./make-test-python.nix ({ lib, ... }: {
 
       # Now adding an alias to ensure that the certs are updated
       specialisation.nginx-aliases.configuration = { pkgs, ... }: {
-        services.nginx.virtualHosts."a.example.test" = {
+        services.nginx.virtualHosts."a.example.test" = (vhostBase pkgs) // {
           serverAliases = [ "b.example.test" ];
         };
       };
 
+      # Must be run after nginx-aliases
+      specialisation.remove-extra-domain.configuration = { pkgs, ... } : {
+        # This also validates that useACMEHost doesn't unexpectedly add the domain.
+        services.nginx.virtualHosts."b.example.test" = (vhostBase pkgs) // {
+          useACMEHost = "a.example.test";
+        };
+      };
+
       # Test OCSP Stapling
       specialisation.ocsp-stapling.configuration = { pkgs, ... }: {
         security.acme.certs."a.example.test" = {
@@ -408,6 +416,18 @@ in import ./make-test-python.nix ({ lib, ... }: {
           check_connection(client, "a.example.test")
           check_connection(client, "b.example.test")
 
+      with subtest("Can remove extra domains from a cert"):
+          switch_to(webserver, "remove-extra-domain")
+          webserver.wait_for_unit("acme-finished-a.example.test.target")
+          webserver.wait_for_unit("nginx.service")
+          check_connection(client, "a.example.test")
+          rc, _ = client.execute(
+              "openssl s_client -CAfile /tmp/ca.crt -connect b.example.test:443"
+              " </dev/null 2>/dev/null | openssl x509 -noout -text"
+              " | grep DNS: | grep b.example.test"
+          )
+          assert rc > 0, "Removed extraDomainName was not removed from the cert"
+
       with subtest("Can request certificates for vhost + aliases (apache-httpd)"):
           try:
               switch_to(webserver, "httpd-aliases")

From 377c6bcefce8e8ccd471892a1b24621d5a909457 Mon Sep 17 00:00:00 2001
From: Lucas Savva <lucas@m1cr0man.com>
Date: Sun, 28 Nov 2021 17:03:31 +0000
Subject: [PATCH 21/63] nixos/acme: Add defaults and inheritDefaults option

Allows configuring many default settings for certificates,
all of which can still be overridden on a per-cert basis.
Some options have been moved into .defaults from security.acme,
namely email, server, validMinDays and renewInterval. These
changes will not break existing configurations thanks to
mkChangedOptionModule.

With this, it is also now possible to configure DNS-01 with
web servers whose virtualHosts utilise enableACME. The only
requirement is you set `acmeRoot = null` for each vhost.

The test suite has been revamped to cover these additions
and also to generally make it easier to maintain. Test config
for apache and nginx has been fully standardised, and it
is now much easier to add a new web server if it follows
the same configuration patterns as those two. I have also
optimised the use of switch-to-configuration which should
speed up testing.
---
 nixos/modules/security/acme.nix               | 420 ++++++++-------
 .../web-servers/apache-httpd/default.nix      |  13 +-
 .../apache-httpd/vhost-options.nix            |   7 +-
 .../services/web-servers/nginx/default.nix    |  13 +-
 .../web-servers/nginx/vhost-options.nix       |   9 +-
 nixos/tests/acme.nix                          | 499 ++++++++++--------
 nixos/tests/common/acme/client/default.nix    |   6 +-
 nixos/tests/common/acme/server/default.nix    |   5 +
 8 files changed, 536 insertions(+), 436 deletions(-)

diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index 9242a12fd35f..c39653d174e5 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -128,7 +128,7 @@ let
   };
 
   certToConfig = cert: data: let
-    acmeServer = if data.server != null then data.server else cfg.server;
+    acmeServer = data.server;
     useDns = data.dnsProvider != null;
     destPath = "/var/lib/acme/${cert}";
     selfsignedDeps = optionals (cfg.preliminarySelfsigned) [ "acme-selfsigned-${cert}.service" ];
@@ -211,7 +211,7 @@ let
       description = "Renew ACME Certificate for ${cert}";
       wantedBy = [ "timers.target" ];
       timerConfig = {
-        OnCalendar = cfg.renewInterval;
+        OnCalendar = data.renewInterval;
         Unit = "acme-${cert}.service";
         Persistent = "yes";
 
@@ -356,7 +356,7 @@ let
           expiration_s=$[expiration_date - now]
           expiration_days=$[expiration_s / (3600 * 24)]   # rounds down
 
-          [[ $expiration_days -gt ${toString cfg.validMinDays} ]]
+          [[ $expiration_days -gt ${toString data.validMinDays} ]]
         }
 
         ${optionalString (data.webroot != null) ''
@@ -380,11 +380,12 @@ let
           # Even if a cert is not expired, it may be revoked by the CA.
           # Try to renew, and silently fail if the cert is not expired.
           # Avoids #85794 and resolves #129838
-          if ! lego ${renewOpts} --days ${toString cfg.validMinDays}; then
+          if ! lego ${renewOpts} --days ${toString data.validMinDays}; then
             if is_expiration_skippable out/full.pem; then
-              echo 1>&2 "nixos-acme: Ignoring failed renewal because expiration isn't within the coming ${toString cfg.validMinDays} days"
+              echo 1>&2 "nixos-acme: Ignoring failed renewal because expiration isn't within the coming ${toString data.validMinDays} days"
             else
-              exit 3
+              # High number to avoid Systemd reserved codes.
+              exit 11
             fi
           fi
 
@@ -394,8 +395,9 @@ let
           echo Failed to fetch certificates. \
             This may mean your DNS records are set up incorrectly. \
             ${optionalString (cfg.preliminarySelfsigned) "Selfsigned certs are in place and dependant services will still start."}
-          # Exit 2 so that users can potentially amend SuccessExitStatus to ignore this error.
-          exit 2
+          # Exit 10 so that users can potentially amend SuccessExitStatus to ignore this error.
+          # High number to avoid Systemd reserved codes.
+          exit 10
         fi
 
         mv domainhash.txt certificates/
@@ -423,8 +425,182 @@ let
 
   certConfigs = mapAttrs certToConfig cfg.certs;
 
+  # These options can be specified within
+  # security.acme or security.acme.certs.<name>
+  inheritableOpts =
+    { inheritDefaults ? false, defaults ? null }: {
+      validMinDays = mkOption {
+        type = types.int;
+        default = if inheritDefaults then defaults.validMinDays else 30;
+        description = "Minimum remaining validity before renewal in days.";
+      };
+
+      renewInterval = mkOption {
+        type = types.str;
+        default = if inheritDefaults then defaults.renewInterval else "daily";
+        description = ''
+          Systemd calendar expression when to check for renewal. See
+          <citerefentry><refentrytitle>systemd.time</refentrytitle>
+          <manvolnum>7</manvolnum></citerefentry>.
+        '';
+      };
+
+      enableDebugLogs = mkEnableOption "debug logging for this certificate" // {
+        default = if inheritDefaults then defaults.enableDebugLogs else true;
+      };
+
+      webroot = mkOption {
+        type = types.nullOr types.str;
+        default = if inheritDefaults then defaults.webroot else null;
+        example = "/var/lib/acme/acme-challenge";
+        description = ''
+          Where the webroot of the HTTP vhost is located.
+          <filename>.well-known/acme-challenge/</filename> directory
+          will be created below the webroot if it doesn't exist.
+          <literal>http://example.org/.well-known/acme-challenge/</literal> must also
+          be available (notice unencrypted HTTP).
+        '';
+      };
+
+      server = mkOption {
+        type = types.nullOr types.str;
+        default = if inheritDefaults then defaults.server else null;
+        description = ''
+          ACME Directory Resource URI. Defaults to Let's Encrypt's
+          production endpoint,
+          <link xlink:href="https://acme-v02.api.letsencrypt.org/directory"/>, if unset.
+        '';
+      };
+
+      email = mkOption {
+        type = types.str;
+        default = if inheritDefaults then defaults.email else null;
+        description = ''
+          Email address for account creation and correspondence from the CA.
+          It is recommended to use the same email for all certs to avoid account
+          creation limits.
+        '';
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = if inheritDefaults then defaults.group else "acme";
+        description = "Group running the ACME client.";
+      };
+
+      reloadServices = mkOption {
+        type = types.listOf types.str;
+        default = if inheritDefaults then defaults.reloadServices else [];
+        description = ''
+          The list of systemd services to call <code>systemctl try-reload-or-restart</code>
+          on.
+        '';
+      };
+
+      postRun = mkOption {
+        type = types.lines;
+        default = if inheritDefaults then defaults.postRun else "";
+        example = "cp full.pem backup.pem";
+        description = ''
+          Commands to run after new certificates go live. Note that
+          these commands run as the root user.
+
+          Executed in the same directory with the new certificate.
+        '';
+      };
+
+      keyType = mkOption {
+        type = types.str;
+        default = if inheritDefaults then defaults.keyType else "ec256";
+        description = ''
+          Key type to use for private keys.
+          For an up to date list of supported values check the --key-type option
+          at <link xlink:href="https://go-acme.github.io/lego/usage/cli/#usage"/>.
+        '';
+      };
+
+      dnsProvider = mkOption {
+        type = types.nullOr types.str;
+        default = if inheritDefaults then defaults.dnsProvider else null;
+        example = "route53";
+        description = ''
+          DNS Challenge provider. For a list of supported providers, see the "code"
+          field of the DNS providers listed at <link xlink:href="https://go-acme.github.io/lego/dns/"/>.
+        '';
+      };
+
+      dnsResolver = mkOption {
+        type = types.nullOr types.str;
+        default = if inheritDefaults then defaults.dnsResolver else null;
+        example = "1.1.1.1:53";
+        description = ''
+          Set the resolver to use for performing recursive DNS queries. Supported:
+          host:port. The default is to use the system resolvers, or Google's DNS
+          resolvers if the system's cannot be determined.
+        '';
+      };
+
+      credentialsFile = mkOption {
+        type = types.path;
+        default = if inheritDefaults then defaults.credentialsFile else null;
+        description = ''
+          Path to an EnvironmentFile for the cert's service containing any required and
+          optional environment variables for your selected dnsProvider.
+          To find out what values you need to set, consult the documentation at
+          <link xlink:href="https://go-acme.github.io/lego/dns/"/> for the corresponding dnsProvider.
+        '';
+        example = "/var/src/secrets/example.org-route53-api-token";
+      };
+
+      dnsPropagationCheck = mkOption {
+        type = types.bool;
+        default = if inheritDefaults then defaults.dnsPropagationCheck else true;
+        description = ''
+          Toggles lego DNS propagation check, which is used alongside DNS-01
+          challenge to ensure the DNS entries required are available.
+        '';
+      };
+
+      ocspMustStaple = mkOption {
+        type = types.bool;
+        default = if inheritDefaults then defaults.ocspMustStaple else false;
+        description = ''
+          Turns on the OCSP Must-Staple TLS extension.
+          Make sure you know what you're doing! See:
+          <itemizedlist>
+            <listitem><para><link xlink:href="https://blog.apnic.net/2019/01/15/is-the-web-ready-for-ocsp-must-staple/" /></para></listitem>
+            <listitem><para><link xlink:href="https://blog.hboeck.de/archives/886-The-Problem-with-OCSP-Stapling-and-Must-Staple-and-why-Certificate-Revocation-is-still-broken.html" /></para></listitem>
+          </itemizedlist>
+        '';
+      };
+
+      extraLegoFlags = mkOption {
+        type = types.listOf types.str;
+        default = if inheritDefaults then defaults.extraLegoFlags else [];
+        description = ''
+          Additional global flags to pass to all lego commands.
+        '';
+      };
+
+      extraLegoRenewFlags = mkOption {
+        type = types.listOf types.str;
+        default = if inheritDefaults then defaults.extraLegoRenewFlags else [];
+        description = ''
+          Additional flags to pass to lego renew.
+        '';
+      };
+
+      extraLegoRunFlags = mkOption {
+        type = types.listOf types.str;
+        default = if inheritDefaults then defaults.extraLegoRunFlags else [];
+        description = ''
+          Additional flags to pass to lego run.
+        '';
+      };
+    };
+
   certOpts = { name, ... }: {
-    options = {
+    options = (inheritableOpts { inherit (cfg) defaults; inheritDefaults = cfg.certs."${name}".inheritDefaults; }) // {
       # user option has been removed
       user = mkOption {
         visible = false;
@@ -443,40 +619,11 @@ let
         default = "_mkMergedOptionModule";
       };
 
-      enableDebugLogs = mkEnableOption "debug logging for this certificate" // { default = cfg.enableDebugLogs; };
-
-      webroot = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "/var/lib/acme/acme-challenge";
-        description = ''
-          Where the webroot of the HTTP vhost is located.
-          <filename>.well-known/acme-challenge/</filename> directory
-          will be created below the webroot if it doesn't exist.
-          <literal>http://example.org/.well-known/acme-challenge/</literal> must also
-          be available (notice unencrypted HTTP).
-        '';
-      };
-
-      listenHTTP = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = ":1360";
-        description = ''
-          Interface and port to listen on to solve HTTP challenges
-          in the form [INTERFACE]:PORT.
-          If you use a port other than 80, you must proxy port 80 to this port.
-        '';
-      };
-
-      server = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = ''
-          ACME Directory Resource URI. Defaults to Let's Encrypt's
-          production endpoint,
-          <link xlink:href="https://acme-v02.api.letsencrypt.org/directory"/>, if unset.
-        '';
+      directory = mkOption {
+        type = types.str;
+        readOnly = true;
+        default = "/var/lib/acme/${name}";
+        description = "Directory where certificate and other state is stored.";
       };
 
       domain = mkOption {
@@ -485,47 +632,6 @@ let
         description = "Domain to fetch certificate for (defaults to the entry name).";
       };
 
-      email = mkOption {
-        type = types.nullOr types.str;
-        default = cfg.email;
-        defaultText = literalExpression "config.${opt.email}";
-        description = "Contact email address for the CA to be able to reach you.";
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "acme";
-        description = "Group running the ACME client.";
-      };
-
-      reloadServices = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        description = ''
-          The list of systemd services to call <code>systemctl try-reload-or-restart</code>
-          on.
-        '';
-      };
-
-      postRun = mkOption {
-        type = types.lines;
-        default = "";
-        example = "cp full.pem backup.pem";
-        description = ''
-          Commands to run after new certificates go live. Note that
-          these commands run as the root user.
-
-          Executed in the same directory with the new certificate.
-        '';
-      };
-
-      directory = mkOption {
-        type = types.str;
-        readOnly = true;
-        default = "/var/lib/acme/${name}";
-        description = "Directory where certificate and other state is stored.";
-      };
-
       extraDomainNames = mkOption {
         type = types.listOf types.str;
         default = [];
@@ -540,92 +646,25 @@ let
         '';
       };
 
-      keyType = mkOption {
-        type = types.str;
-        default = "ec256";
-        description = ''
-          Key type to use for private keys.
-          For an up to date list of supported values check the --key-type option
-          at <link xlink:href="https://go-acme.github.io/lego/usage/cli/#usage"/>.
-        '';
-      };
-
-      dnsProvider = mkOption {
+      # This setting must be different for each configured certificate, otherwise
+      # two or more renewals may fail to bind to the address. Hence, it is not in
+      # the inheritableOpts.
+      listenHTTP = mkOption {
         type = types.nullOr types.str;
         default = null;
-        example = "route53";
+        example = ":1360";
         description = ''
-          DNS Challenge provider. For a list of supported providers, see the "code"
-          field of the DNS providers listed at <link xlink:href="https://go-acme.github.io/lego/dns/"/>.
+          Interface and port to listen on to solve HTTP challenges
+          in the form [INTERFACE]:PORT.
+          If you use a port other than 80, you must proxy port 80 to this port.
         '';
       };
 
-      dnsResolver = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "1.1.1.1:53";
-        description = ''
-          Set the resolver to use for performing recursive DNS queries. Supported:
-          host:port. The default is to use the system resolvers, or Google's DNS
-          resolvers if the system's cannot be determined.
-        '';
-      };
-
-      credentialsFile = mkOption {
-        type = types.path;
-        description = ''
-          Path to an EnvironmentFile for the cert's service containing any required and
-          optional environment variables for your selected dnsProvider.
-          To find out what values you need to set, consult the documentation at
-          <link xlink:href="https://go-acme.github.io/lego/dns/"/> for the corresponding dnsProvider.
-        '';
-        example = "/var/src/secrets/example.org-route53-api-token";
-      };
-
-      dnsPropagationCheck = mkOption {
-        type = types.bool;
+      inheritDefaults = mkOption {
         default = true;
-        description = ''
-          Toggles lego DNS propagation check, which is used alongside DNS-01
-          challenge to ensure the DNS entries required are available.
-        '';
-      };
-
-      ocspMustStaple = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Turns on the OCSP Must-Staple TLS extension.
-          Make sure you know what you're doing! See:
-          <itemizedlist>
-            <listitem><para><link xlink:href="https://blog.apnic.net/2019/01/15/is-the-web-ready-for-ocsp-must-staple/" /></para></listitem>
-            <listitem><para><link xlink:href="https://blog.hboeck.de/archives/886-The-Problem-with-OCSP-Stapling-and-Must-Staple-and-why-Certificate-Revocation-is-still-broken.html" /></para></listitem>
-          </itemizedlist>
-        '';
-      };
-
-      extraLegoFlags = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        description = ''
-          Additional global flags to pass to all lego commands.
-        '';
-      };
-
-      extraLegoRenewFlags = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        description = ''
-          Additional flags to pass to lego renew.
-        '';
-      };
-
-      extraLegoRunFlags = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        description = ''
-          Additional flags to pass to lego run.
-        '';
+        example = true;
+        description = "Whether to inherit values set in `security.acme.defaults` or not.";
+        type = lib.types.bool;
       };
     };
   };
@@ -634,41 +673,6 @@ in {
 
   options = {
     security.acme = {
-
-      enableDebugLogs = mkEnableOption "debug logging for all certificates by default" // { default = true; };
-
-      validMinDays = mkOption {
-        type = types.int;
-        default = 30;
-        description = "Minimum remaining validity before renewal in days.";
-      };
-
-      email = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = "Contact email address for the CA to be able to reach you.";
-      };
-
-      renewInterval = mkOption {
-        type = types.str;
-        default = "daily";
-        description = ''
-          Systemd calendar expression when to check for renewal. See
-          <citerefentry><refentrytitle>systemd.time</refentrytitle>
-          <manvolnum>7</manvolnum></citerefentry>.
-        '';
-      };
-
-      server = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = ''
-          ACME Directory Resource URI. Defaults to Let's Encrypt's
-          production endpoint,
-          <link xlink:href="https://acme-v02.api.letsencrypt.org/directory"/>, if unset.
-        '';
-      };
-
       preliminarySelfsigned = mkOption {
         type = types.bool;
         default = true;
@@ -691,6 +695,16 @@ in {
         '';
       };
 
+      defaults = mkOption {
+        type = types.submodule ({ ... }: { options = inheritableOpts {}; });
+        description = ''
+          Default values inheritable by all configured certs. You can
+          use this to define options shared by all your certs. These defaults
+          can also be ignored on a per-cert basis using the
+          `security.acme.certs.''${cert}.inheritDefaults' option.
+        '';
+      };
+
       certs = mkOption {
         default = { };
         type = with types; attrsOf (submodule certOpts);
@@ -724,12 +738,16 @@ in {
 
       To use the let's encrypt staging server, use security.acme.server =
       "https://acme-staging-v02.api.letsencrypt.org/directory".
-    ''
-    )
+    '')
     (mkRemovedOptionModule [ "security" "acme" "directory" ] "ACME Directory is now hardcoded to /var/lib/acme and its permisisons are managed by systemd. See https://github.com/NixOS/nixpkgs/issues/53852 for more info.")
     (mkRemovedOptionModule [ "security" "acme" "preDelay" ] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")
     (mkRemovedOptionModule [ "security" "acme" "activationDelay" ] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")
-    (mkChangedOptionModule [ "security" "acme" "validMin" ] [ "security" "acme" "validMinDays" ] (config: config.security.acme.validMin / (24 * 3600)))
+    (mkChangedOptionModule [ "security" "acme" "validMin" ] [ "security" "acme" "defaults" "validMinDays" ] (config: config.security.acme.validMin / (24 * 3600)))
+    (mkChangedOptionModule [ "security" "acme" "validMinDays" ] [ "security" "acme" "defaults" "validMinDays" ] (config: config.security.acme.validMinDays))
+    (mkChangedOptionModule [ "security" "acme" "renewInterval" ] [ "security" "acme" "defaults" "renewInterval" ] (config: config.security.acme.renewInterval))
+    (mkChangedOptionModule [ "security" "acme" "email" ] [ "security" "acme" "defaults" "email" ] (config: config.security.acme.email))
+    (mkChangedOptionModule [ "security" "acme" "server" ] [ "security" "acme" "defaults" "server" ] (config: config.security.acme.server))
+    (mkChangedOptionModule [ "security" "acme" "enableDebugLogs" ] [ "security" "acme" "defaults" "enableDebugLogs" ] (config: config.security.acme.enableDebugLogs))
   ];
 
   config = mkMerge [
diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix
index 992a58875e43..1a49b4ca15c7 100644
--- a/nixos/modules/services/web-servers/apache-httpd/default.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/default.nix
@@ -154,7 +154,7 @@ let
       sslServerKey = if useACME then "${sslCertDir}/key.pem" else hostOpts.sslServerKey;
       sslServerChain = if useACME then "${sslCertDir}/chain.pem" else hostOpts.sslServerChain;
 
-      acmeChallenge = optionalString useACME ''
+      acmeChallenge = optionalString (useACME && hostOpts.acmeRoot != null) ''
         Alias /.well-known/acme-challenge/ "${hostOpts.acmeRoot}/.well-known/acme-challenge/"
         <Directory "${hostOpts.acmeRoot}">
             AllowOverride None
@@ -677,9 +677,16 @@ in
     };
 
     security.acme.certs = let
-      acmePairs = map (hostOpts: nameValuePair hostOpts.hostName {
+      acmePairs = map (hostOpts: let
+        hasRoot = hostOpts.acmeRoot != null;
+      in nameValuePair hostOpts.hostName {
         group = mkDefault cfg.group;
-        webroot = hostOpts.acmeRoot;
+        # if acmeRoot is null inherit config.security.acme
+        # Since config.security.acme.certs.<cert>.webroot's own default value
+        # should take precedence set priority higher than mkOptionDefault
+        webroot = mkOverride (if hasRoot then 1000 else 2000) hostOpts.acmeRoot;
+        # Also nudge dnsProvider to null in case it is inherited
+        dnsProvider = mkOverride (if hasRoot then 1000 else 2000) null;
         extraDomainNames = hostOpts.serverAliases;
         # Use the vhost-specific email address if provided, otherwise let
         # security.acme.email or security.acme.certs.<cert>.email be used.
diff --git a/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix b/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix
index 8bb7e91ec9cd..c52ab2c596e0 100644
--- a/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix
@@ -128,9 +128,12 @@ in
     };
 
     acmeRoot = mkOption {
-      type = types.str;
+      type = types.nullOr types.str;
       default = "/var/lib/acme/acme-challenge";
-      description = "Directory for the acme challenge which is PUBLIC, don't put certs or keys in here";
+      description = ''
+        Directory for the acme challenge which is PUBLIC, don't put certs or keys in here.
+        Set to null to inherit from config.security.acme.
+      '';
     };
 
     sslServerCert = mkOption {
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index ba8e874f2ded..05b7870fc3a1 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -278,7 +278,7 @@ let
         acmeLocation = optionalString (vhost.enableACME || vhost.useACMEHost != null) ''
           location /.well-known/acme-challenge {
             ${optionalString (vhost.acmeFallbackHost != null) "try_files $uri @acme-fallback;"}
-            root ${vhost.acmeRoot};
+            ${optionalString (vhost.acmeRoot != null) "root ${vhost.acmeRoot};"}
             auth_basic off;
           }
           ${optionalString (vhost.acmeFallbackHost != null) ''
@@ -948,9 +948,16 @@ in
     };
 
     security.acme.certs = let
-      acmePairs = map (vhostConfig: nameValuePair vhostConfig.serverName {
+      acmePairs = map (vhostConfig: let
+        hasRoot = vhostConfig.acmeRoot != null;
+      in nameValuePair vhostConfig.serverName {
         group = mkDefault cfg.group;
-        webroot = vhostConfig.acmeRoot;
+        # if acmeRoot is null inherit config.security.acme
+        # Since config.security.acme.certs.<cert>.webroot's own default value
+        # should take precedence set priority higher than mkOptionDefault
+        webroot = mkOverride (if hasRoot then 1000 else 2000) vhostConfig.acmeRoot;
+        # Also nudge dnsProvider to null in case it is inherited
+        dnsProvider = mkOverride (if hasRoot then 1000 else 2000) null;
         extraDomainNames = vhostConfig.serverAliases;
       # Filter for enableACME-only vhosts. Don't want to create dud certs
       }) (filter (vhostConfig: vhostConfig.useACMEHost == null) acmeEnabledVhosts);
diff --git a/nixos/modules/services/web-servers/nginx/vhost-options.nix b/nixos/modules/services/web-servers/nginx/vhost-options.nix
index 7f49ce9586ca..c4e8285dc48b 100644
--- a/nixos/modules/services/web-servers/nginx/vhost-options.nix
+++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix
@@ -3,7 +3,7 @@
 # has additional options that affect the web server as a whole, like
 # the user/group to run under.)
 
-{ lib, ... }:
+{ config, lib, ... }:
 
 with lib;
 {
@@ -85,9 +85,12 @@ with lib;
     };
 
     acmeRoot = mkOption {
-      type = types.str;
+      type = types.nullOr types.str;
       default = "/var/lib/acme/acme-challenge";
-      description = "Directory for the acme challenge which is PUBLIC, don't put certs or keys in here";
+      description = ''
+        Directory for the acme challenge which is PUBLIC, don't put certs or keys in here.
+        Set to null to inherit from config.security.acme.
+      '';
     };
 
     acmeFallbackHost = mkOption {
diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix
index 80b85502d4e8..549fa9e64eea 100644
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@@ -1,9 +1,9 @@
-let
+import ./make-test-python.nix ({ pkgs, lib, ... }: let
   commonConfig = ./common/acme/client;
 
   dnsServerIP = nodes: nodes.dnsserver.config.networking.primaryIPAddress;
 
-  dnsScript = {pkgs, nodes}: let
+  dnsScript = nodes: let
     dnsAddress = dnsServerIP nodes;
   in pkgs.writeShellScript "dns-hook.sh" ''
     set -euo pipefail
@@ -15,30 +15,137 @@ let
     fi
   '';
 
-  documentRoot = pkgs: pkgs.runCommand "docroot" {} ''
+  dnsConfig = nodes: {
+    dnsProvider = "exec";
+    dnsPropagationCheck = false;
+    credentialsFile = pkgs.writeText "wildcard.env" ''
+      EXEC_PATH=${dnsScript nodes}
+      EXEC_POLLING_INTERVAL=1
+      EXEC_PROPAGATION_TIMEOUT=1
+      EXEC_SEQUENCE_INTERVAL=1
+    '';
+  };
+
+  documentRoot = pkgs.runCommand "docroot" {} ''
     mkdir -p "$out"
     echo hello world > "$out/index.html"
   '';
 
-  vhostBase = pkgs: {
+  vhostBase = {
     forceSSL = true;
-    locations."/".root = documentRoot pkgs;
+    locations."/".root = documentRoot;
   };
 
-in import ./make-test-python.nix ({ lib, ... }: {
+  vhostBaseHttpd = {
+    forceSSL = true;
+    inherit documentRoot;
+  };
+
+  # Base specialisation config for testing general ACME features
+  webserverBasicConfig = {
+    services.nginx.enable = true;
+    services.nginx.virtualHosts."a.example.test" = vhostBase // {
+      enableACME = true;
+    };
+  };
+
+  # Generate specialisations for testing a web server
+  mkServerConfigs = { server, group, vhostBaseData, extraConfig ? {} }: let
+    baseConfig = { nodes, config, specialConfig ? {} }: lib.mkMerge [
+      {
+        security.acme = {
+          defaults = (dnsConfig nodes) // {
+            inherit group;
+          };
+          # One manual wildcard cert
+          certs."example.test" = {
+            domain = "*.example.test";
+          };
+        };
+
+        services."${server}" = {
+          enable = true;
+          virtualHosts = {
+            # Run-of-the-mill vhost using HTTP-01 validation
+            "${server}-http.example.test" = vhostBaseData // {
+              serverAliases = [ "${server}-http-alias.example.test" ];
+              enableACME = true;
+            };
+
+            # Another which inherits the DNS-01 config
+            "${server}-dns.example.test" = vhostBaseData // {
+              serverAliases = [ "${server}-dns-alias.example.test" ];
+              enableACME = true;
+              # Set acmeRoot to null instead of using the default of "/var/lib/acme/acme-challenge"
+              # webroot + dnsProvider are mutually exclusive.
+              acmeRoot = null;
+            };
+
+            # One using the wildcard certificate
+            "${server}-wildcard.example.test" = vhostBaseData // {
+              serverAliases = [ "${server}-wildcard-alias.example.test" ];
+              useACMEHost = "example.test";
+            };
+          };
+        };
+
+        # Used to determine if service reload was triggered
+        systemd.targets."test-renew-${server}" = {
+          wants = [ "acme-${server}-http.example.test.service" ];
+          after = [ "acme-${server}-http.example.test.service" "${server}-config-reload.service" ];
+        };
+      }
+      specialConfig
+      extraConfig
+    ];
+  in {
+    "${server}".configuration = { nodes, config, ... }: baseConfig {
+      inherit nodes config;
+    };
+
+    # Test that server reloads when an alias is removed (and subsequently test removal works in acme)
+    "${server}-remove-alias".configuration = { nodes, config, ... }: baseConfig {
+      inherit nodes config;
+      specialConfig = {
+        # Remove an alias, but create a standalone vhost in its place for testing.
+        # This configuration results in certificate errors as useACMEHost does not imply
+        # append extraDomains, and thus we can validate the SAN is removed.
+        services."${server}" = {
+          virtualHosts."${server}-http.example.test".serverAliases = lib.mkForce [];
+          virtualHosts."${server}-http-alias.example.test" = vhostBaseData // {
+            useACMEHost = "${server}-http.example.test";
+          };
+        };
+      };
+    };
+
+    # Test that the server reloads when only the acme configuration is changed.
+    "${server}-change-acme-conf".configuration = { nodes, config, ... }: baseConfig {
+      inherit nodes config;
+      specialConfig = {
+        security.acme.certs."${server}-http.example.test" = {
+          keyType = "ec384";
+          # Also test that postRun is exec'd as root
+          postRun = "id | grep root";
+        };
+      };
+    };
+  };
+
+in {
   name = "acme";
   meta.maintainers = lib.teams.acme.members;
 
   nodes = {
     # The fake ACME server which will respond to client requests
-    acme = { nodes, lib, ... }: {
+    acme = { nodes, ... }: {
       imports = [ ./common/acme/server ];
       networking.nameservers = lib.mkForce [ (dnsServerIP nodes) ];
     };
 
     # A fake DNS server which can be configured with records as desired
     # Used to test DNS-01 challenge
-    dnsserver = { nodes, pkgs, ... }: {
+    dnsserver = { nodes, ... }: {
       networking.firewall.allowedTCPPorts = [ 8055 53 ];
       networking.firewall.allowedUDPPorts = [ 53 ];
       systemd.services.pebble-challtestsrv = {
@@ -54,7 +161,7 @@ in import ./make-test-python.nix ({ lib, ... }: {
     };
 
     # A web server which will be the node requesting certs
-    webserver = { pkgs, nodes, lib, config, ... }: {
+    webserver = { nodes, config, ... }: {
       imports = [ commonConfig ];
       networking.nameservers = lib.mkForce [ (dnsServerIP nodes) ];
       networking.firewall.allowedTCPPorts = [ 80 443 ];
@@ -63,138 +170,88 @@ in import ./make-test-python.nix ({ lib, ... }: {
       environment.systemPackages = [ pkgs.openssl ];
 
       # Set log level to info so that we can see when the service is reloaded
-      services.nginx.enable = true;
       services.nginx.logError = "stderr info";
 
-      # First tests configure a basic cert and run a bunch of openssl checks
-      services.nginx.virtualHosts."a.example.test" = (vhostBase pkgs) // {
-        enableACME = true;
-      };
-
-      # Used to determine if service reload was triggered
-      systemd.targets.test-renew-nginx = {
-        wants = [ "acme-a.example.test.service" ];
-        after = [ "acme-a.example.test.service" "nginx-config-reload.service" ];
-      };
-
-      # Test that account creation is collated into one service
-      specialisation.account-creation.configuration = { nodes, pkgs, lib, ... }: let
-        email = "newhostmaster@example.test";
-        caDomain = nodes.acme.config.test-support.acme.caDomain;
-        # Exit 99 to make it easier to track if this is the reason a renew failed
-        testScript = ''
-          test -e accounts/${caDomain}/${email}/account.json || exit 99
-        '';
-      in {
-        security.acme.email = lib.mkForce email;
-        systemd.services."b.example.test".preStart = testScript;
-        systemd.services."c.example.test".preStart = testScript;
-
-        services.nginx.virtualHosts."b.example.test" = (vhostBase pkgs) // {
-          enableACME = true;
-        };
-        services.nginx.virtualHosts."c.example.test" = (vhostBase pkgs) // {
-          enableACME = true;
-        };
-      };
-
-      # Cert config changes will not cause the nginx configuration to change.
-      # This tests that the reload service is correctly triggered.
-      # It also tests that postRun is exec'd as root
-      specialisation.cert-change.configuration = { pkgs, ... }: {
-        security.acme.certs."a.example.test".keyType = "ec384";
-        security.acme.certs."a.example.test".postRun = ''
-          set -euo pipefail
-          touch /home/test
-          chown root:root /home/test
-          echo testing > /home/test
-        '';
-      };
-
-      # Now adding an alias to ensure that the certs are updated
-      specialisation.nginx-aliases.configuration = { pkgs, ... }: {
-        services.nginx.virtualHosts."a.example.test" = (vhostBase pkgs) // {
-          serverAliases = [ "b.example.test" ];
-        };
-      };
-
-      # Must be run after nginx-aliases
-      specialisation.remove-extra-domain.configuration = { pkgs, ... } : {
-        # This also validates that useACMEHost doesn't unexpectedly add the domain.
-        services.nginx.virtualHosts."b.example.test" = (vhostBase pkgs) // {
-          useACMEHost = "a.example.test";
-        };
-      };
-
-      # Test OCSP Stapling
-      specialisation.ocsp-stapling.configuration = { pkgs, ... }: {
-        security.acme.certs."a.example.test" = {
-          ocspMustStaple = true;
-        };
-        services.nginx.virtualHosts."a.example.com" = {
-          extraConfig = ''
-            ssl_stapling on;
-            ssl_stapling_verify on;
+      specialisation = {
+        # First derivation used to test general ACME features
+        general.configuration = { ... }: let
+          caDomain = nodes.acme.config.test-support.acme.caDomain;
+          email = config.security.acme.defaults.email;
+          # Exit 99 to make it easier to track if this is the reason a renew failed
+          accountCreateTester = ''
+            test -e accounts/${caDomain}/${email}/account.json || exit 99
           '';
-        };
-      };
+        in lib.mkMerge [
+          webserverBasicConfig
+          {
+            # Used to test that account creation is collated into one service.
+            # These should not run until after acme-finished-a.example.test.target
+            systemd.services."b.example.test".preStart = accountCreateTester;
+            systemd.services."c.example.test".preStart = accountCreateTester;
 
-      # Test using Apache HTTPD
-      specialisation.httpd-aliases.configuration = { pkgs, config, lib, ... }: {
-        services.nginx.enable = lib.mkForce false;
-        services.httpd.enable = true;
-        services.httpd.adminAddr = config.security.acme.email;
-        services.httpd.virtualHosts."c.example.test" = {
-          serverAliases = [ "d.example.test" ];
-          forceSSL = true;
-          enableACME = true;
-          documentRoot = documentRoot pkgs;
-        };
+            services.nginx.virtualHosts."b.example.test" = vhostBase // {
+              enableACME = true;
+            };
+            services.nginx.virtualHosts."c.example.test" = vhostBase // {
+              enableACME = true;
+            };
+          }
+        ];
 
-        # Used to determine if service reload was triggered
-        systemd.targets.test-renew-httpd = {
-          wants = [ "acme-c.example.test.service" ];
-          after = [ "acme-c.example.test.service" "httpd-config-reload.service" ];
-        };
-      };
+        # Test OCSP Stapling
+        ocsp-stapling.configuration = { ... }: lib.mkMerge [
+          webserverBasicConfig
+          {
+            security.acme.certs."a.example.test".ocspMustStaple = true;
+            services.nginx.virtualHosts."a.example.com" = {
+              extraConfig = ''
+                ssl_stapling on;
+                ssl_stapling_verify on;
+              '';
+            };
+          }
+        ];
 
-      # Validation via DNS-01 challenge
-      specialisation.dns-01.configuration = { pkgs, config, nodes, ... }: {
-        security.acme.certs."example.test" = {
-          domain = "*.example.test";
-          group = config.services.nginx.group;
-          dnsProvider = "exec";
-          dnsPropagationCheck = false;
-          credentialsFile = pkgs.writeText "wildcard.env" ''
-            EXEC_PATH=${dnsScript { inherit pkgs nodes; }}
-          '';
-        };
+        # Validate service relationships by adding a slow start service to nginx' wants.
+        # Reproducer for https://github.com/NixOS/nixpkgs/issues/81842
+        slow-startup.configuration = { ... }: lib.mkMerge [
+          webserverBasicConfig
+          {
+            systemd.services.my-slow-service = {
+              wantedBy = [ "multi-user.target" "nginx.service" ];
+              before = [ "nginx.service" ];
+              preStart = "sleep 5";
+              script = "${pkgs.python3}/bin/python -m http.server";
+            };
 
-        services.nginx.virtualHosts."dns.example.test" = (vhostBase pkgs) // {
-          useACMEHost = "example.test";
-        };
-      };
+            services.nginx.virtualHosts."slow.example.com" = {
+              forceSSL = true;
+              enableACME = true;
+              locations."/".proxyPass = "http://localhost:8000";
+            };
+          }
+        ];
 
-      # Validate service relationships by adding a slow start service to nginx' wants.
-      # Reproducer for https://github.com/NixOS/nixpkgs/issues/81842
-      specialisation.slow-startup.configuration = { pkgs, config, nodes, lib, ... }: {
-        systemd.services.my-slow-service = {
-          wantedBy = [ "multi-user.target" "nginx.service" ];
-          before = [ "nginx.service" ];
-          preStart = "sleep 5";
-          script = "${pkgs.python3}/bin/python -m http.server";
-        };
+      # Test compatibility with Nginx
+      } // (mkServerConfigs {
+          server = "nginx";
+          group = "nginx";
+          vhostBaseData = vhostBase;
+        })
 
-        services.nginx.virtualHosts."slow.example.com" = {
-          forceSSL = true;
-          enableACME = true;
-          locations."/".proxyPass = "http://localhost:8000";
-        };
-      };
+      # Test compatibility with Apache HTTPD
+        // (mkServerConfigs {
+          server = "httpd";
+          group = "wwwrun";
+          vhostBaseData = vhostBaseHttpd;
+          extraConfig = {
+            services.httpd.adminAddr = config.security.acme.defaults.email;
+          };
+        });
     };
 
     # The client will be used to curl the webserver to validate configuration
-    client = {nodes, lib, pkgs, ...}: {
+    client = { nodes, ... }: {
       imports = [ commonConfig ];
       networking.nameservers = lib.mkForce [ (dnsServerIP nodes) ];
 
@@ -203,7 +260,7 @@ in import ./make-test-python.nix ({ lib, ... }: {
     };
   };
 
-  testScript = {nodes, ...}:
+  testScript = { nodes, ... }:
     let
       caDomain = nodes.acme.config.test-support.acme.caDomain;
       newServerSystem = nodes.webserver.config.system.build.toplevel;
@@ -212,23 +269,26 @@ in import ./make-test-python.nix ({ lib, ... }: {
     # Note, wait_for_unit does not work for oneshot services that do not have RemainAfterExit=true,
     # this is because a oneshot goes from inactive => activating => inactive, and never
     # reaches the active state. Targets do not have this issue.
-
     ''
       import time
 
 
-      has_switched = False
-
-
       def switch_to(node, name):
-          global has_switched
-          if has_switched:
-              node.succeed(
-                  "${switchToNewServer}"
-              )
-          has_switched = True
+          # On first switch, this will create a symlink to the current system so that we can
+          # quickly switch between derivations
+          root_specs = "/tmp/specialisation"
+          node.execute(
+            f"test -e {root_specs}"
+            f" || ln -s $(readlink /run/current-system)/specialisation {root_specs}"
+          )
+
+          switcher_path = f"/run/current-system/specialisation/{name}/bin/switch-to-configuration"
+          rc, _ = node.execute(f"test -e '{switcher_path}'")
+          if rc > 0:
+              switcher_path = f"/tmp/specialisation/{name}/bin/switch-to-configuration"
+
           node.succeed(
-              f"/run/current-system/specialisation/{name}/bin/switch-to-configuration test"
+              f"{switcher_path} test"
           )
 
 
@@ -318,8 +378,7 @@ in import ./make-test-python.nix ({ lib, ... }: {
               return download_ca_certs(node, retries - 1)
 
 
-      client.start()
-      dnsserver.start()
+      start_all()
 
       dnsserver.wait_for_unit("pebble-challtestsrv.service")
       client.wait_for_unit("default.target")
@@ -328,19 +387,30 @@ in import ./make-test-python.nix ({ lib, ... }: {
           'curl --data \'{"host": "${caDomain}", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'
       )
 
-      acme.start()
-      webserver.start()
-
       acme.wait_for_unit("network-online.target")
       acme.wait_for_unit("pebble.service")
 
       download_ca_certs(client)
 
+      # Perform general tests first
+      switch_to(webserver, "general")
+
       with subtest("Can request certificate with HTTPS-01 challenge"):
           webserver.wait_for_unit("acme-finished-a.example.test.target")
+          check_fullchain(webserver, "a.example.test")
+          check_issuer(webserver, "a.example.test", "pebble")
+          webserver.wait_for_unit("nginx.service")
+          check_connection(client, "a.example.test")
+
+      with subtest("Runs 1 cert for account creation before others"):
+          webserver.wait_for_unit("acme-finished-b.example.test.target")
+          webserver.wait_for_unit("acme-finished-c.example.test.target")
+          check_connection(client, "b.example.test")
+          check_connection(client, "c.example.test")
 
       with subtest("Certificates and accounts have safe + valid permissions"):
-          group = "${nodes.webserver.config.security.acme.certs."a.example.test".group}"
+          # Nginx will set the group appropriately when enableACME is used
+          group = "nginx"
           webserver.succeed(
               f"test $(stat -L -c '%a %U %G' /var/lib/acme/a.example.test/*.pem | tee /dev/stderr | grep '640 acme {group}' | wc -l) -eq 5"
           )
@@ -354,12 +424,6 @@ in import ./make-test-python.nix ({ lib, ... }: {
               f"test $(find /var/lib/acme/accounts -type f -exec stat -L -c '%a %U %G' {{}} \\; | tee /dev/stderr | grep -v '600 acme {group}' | wc -l) -eq 0"
           )
 
-      with subtest("Certs are accepted by web server"):
-          webserver.succeed("systemctl start nginx.service")
-          check_fullchain(webserver, "a.example.test")
-          check_issuer(webserver, "a.example.test", "pebble")
-          check_connection(client, "a.example.test")
-
       # Selfsigned certs tests happen late so we aren't fighting the system init triggering cert renewal
       with subtest("Can generate valid selfsigned certs"):
           webserver.succeed("systemctl clean acme-a.example.test.service --what=state")
@@ -373,89 +437,80 @@ in import ./make-test-python.nix ({ lib, ... }: {
           # Will succeed if nginx can load the certs
           webserver.succeed("systemctl start nginx-config-reload.service")
 
-      with subtest("Can reload nginx when timer triggers renewal"):
-          webserver.succeed("systemctl start test-renew-nginx.target")
-          check_issuer(webserver, "a.example.test", "pebble")
-          check_connection(client, "a.example.test")
-
-      with subtest("Runs 1 cert for account creation before others"):
-          switch_to(webserver, "account-creation")
-          webserver.wait_for_unit("acme-finished-a.example.test.target")
-          check_connection(client, "a.example.test")
-          webserver.wait_for_unit("acme-finished-b.example.test.target")
-          webserver.wait_for_unit("acme-finished-c.example.test.target")
-          check_connection(client, "b.example.test")
-          check_connection(client, "c.example.test")
-
-      with subtest("Can reload web server when cert configuration changes"):
-          switch_to(webserver, "cert-change")
-          webserver.wait_for_unit("acme-finished-a.example.test.target")
-          check_connection_key_bits(client, "a.example.test", "384")
-          webserver.succeed("grep testing /home/test")
-          # Clean to remove the testing file (and anything else messy we did)
-          webserver.succeed("systemctl clean acme-a.example.test.service --what=state")
-
       with subtest("Correctly implements OCSP stapling"):
           switch_to(webserver, "ocsp-stapling")
           webserver.wait_for_unit("acme-finished-a.example.test.target")
           check_stapling(client, "a.example.test")
 
       with subtest("Can request certificate with HTTPS-01 when nginx startup is delayed"):
+          webserver.execute("systemctl stop nginx")
           switch_to(webserver, "slow-startup")
           webserver.wait_for_unit("acme-finished-slow.example.com.target")
           check_issuer(webserver, "slow.example.com", "pebble")
+          webserver.wait_for_unit("nginx.service")
           check_connection(client, "slow.example.com")
 
-      with subtest("Can request certificate for vhost + aliases (nginx)"):
-          # Check the key hash before and after adding an alias. It should not change.
-          # The previous test reverts the ed384 change
-          webserver.wait_for_unit("acme-finished-a.example.test.target")
-          switch_to(webserver, "nginx-aliases")
-          webserver.wait_for_unit("acme-finished-a.example.test.target")
-          check_issuer(webserver, "a.example.test", "pebble")
-          check_connection(client, "a.example.test")
-          check_connection(client, "b.example.test")
+      domains = ["http", "dns", "wildcard"]
+      for server, logsrc in [
+          ("nginx", "journalctl -n 30 -u nginx.service"),
+          ("httpd", "tail -n 30 /var/log/httpd/*.log"),
+      ]:
+          wait_for_server = lambda: webserver.wait_for_unit(f"{server}.service")
+          with subtest(f"Works with {server}"):
+              try:
+                  switch_to(webserver, server)
+                  # Skip wildcard domain for this check ([:-1])
+                  for domain in domains[:-1]:
+                      webserver.wait_for_unit(
+                          f"acme-finished-{server}-{domain}.example.test.target"
+                      )
+              except Exception as err:
+                  _, output = webserver.execute(
+                      f"{logsrc} && ls -al /var/lib/acme/acme-challenge"
+                  )
+                  print(output)
+                  raise err
 
-      with subtest("Can remove extra domains from a cert"):
-          switch_to(webserver, "remove-extra-domain")
-          webserver.wait_for_unit("acme-finished-a.example.test.target")
-          webserver.wait_for_unit("nginx.service")
-          check_connection(client, "a.example.test")
-          rc, _ = client.execute(
-              "openssl s_client -CAfile /tmp/ca.crt -connect b.example.test:443"
-              " </dev/null 2>/dev/null | openssl x509 -noout -text"
-              " | grep DNS: | grep b.example.test"
-          )
-          assert rc > 0, "Removed extraDomainName was not removed from the cert"
+              wait_for_server()
 
-      with subtest("Can request certificates for vhost + aliases (apache-httpd)"):
-          try:
-              switch_to(webserver, "httpd-aliases")
-              webserver.wait_for_unit("acme-finished-c.example.test.target")
-          except Exception as err:
-              _, output = webserver.execute(
-                  "cat /var/log/httpd/*.log && ls -al /var/lib/acme/acme-challenge"
+              for domain in domains[:-1]:
+                  check_issuer(webserver, f"{server}-{domain}.example.test", "pebble")
+              for domain in domains:
+                  check_connection(client, f"{server}-{domain}.example.test")
+                  check_connection(client, f"{server}-{domain}-alias.example.test")
+
+          test_domain = f"{server}-{domains[0]}.example.test"
+
+          with subtest(f"Can reload {server} when timer triggers renewal"):
+              # Switch to selfsigned first
+              webserver.succeed(f"systemctl clean acme-{test_domain}.service --what=state")
+              webserver.succeed(f"systemctl start acme-selfsigned-{test_domain}.service")
+              check_issuer(webserver, test_domain, "minica")
+              webserver.succeed(f"systemctl start {server}-config-reload.service")
+              webserver.succeed(f"systemctl start test-renew-{server}.target")
+              check_issuer(webserver, test_domain, "pebble")
+              check_connection(client, test_domain)
+
+          with subtest("Can remove an alias from a domain + cert is updated"):
+              test_alias = f"{server}-{domains[0]}-alias.example.test"
+              switch_to(webserver, f"{server}-remove-alias")
+              webserver.wait_for_unit(f"acme-finished-{test_domain}.target")
+              wait_for_server()
+              check_connection(client, test_domain)
+              rc, _ = client.execute(
+                  f"openssl s_client -CAfile /tmp/ca.crt -connect {test_alias}:443"
+                  " </dev/null 2>/dev/null | openssl x509 -noout -text"
+                  f" | grep DNS: | grep {test_alias}"
               )
-              print(output)
-              raise err
-          check_issuer(webserver, "c.example.test", "pebble")
-          check_connection(client, "c.example.test")
-          check_connection(client, "d.example.test")
+              assert rc > 0, "Removed extraDomainName was not removed from the cert"
 
-      with subtest("Can reload httpd when timer triggers renewal"):
-          # Switch to selfsigned first
-          webserver.succeed("systemctl clean acme-c.example.test.service --what=state")
-          webserver.succeed("systemctl start acme-selfsigned-c.example.test.service")
-          check_issuer(webserver, "c.example.test", "minica")
-          webserver.succeed("systemctl start httpd-config-reload.service")
-          webserver.succeed("systemctl start test-renew-httpd.target")
-          check_issuer(webserver, "c.example.test", "pebble")
-          check_connection(client, "c.example.test")
-
-      with subtest("Can request wildcard certificates using DNS-01 challenge"):
-          switch_to(webserver, "dns-01")
-          webserver.wait_for_unit("acme-finished-example.test.target")
-          check_issuer(webserver, "example.test", "pebble")
-          check_connection(client, "dns.example.test")
+          with subtest("security.acme changes reflect on web server"):
+              # Switch back to normal server config first, reset everything.
+              switch_to(webserver, server)
+              wait_for_server()
+              switch_to(webserver, f"{server}-change-acme-conf")
+              webserver.wait_for_unit(f"acme-finished-{test_domain}.target")
+              wait_for_server()
+              check_connection_key_bits(client, test_domain, "384")
     '';
 })
diff --git a/nixos/tests/common/acme/client/default.nix b/nixos/tests/common/acme/client/default.nix
index 1e9885e375c7..9dbe345e7a01 100644
--- a/nixos/tests/common/acme/client/default.nix
+++ b/nixos/tests/common/acme/client/default.nix
@@ -5,9 +5,11 @@ let
 
 in {
   security.acme = {
-    server = "https://${caDomain}/dir";
-    email = "hostmaster@example.test";
     acceptTerms = true;
+    defaults = {
+      server = "https://${caDomain}/dir";
+      email = "hostmaster@example.test";
+    };
   };
 
   security.pki.certificateFiles = [ caCert ];
diff --git a/nixos/tests/common/acme/server/default.nix b/nixos/tests/common/acme/server/default.nix
index 1c3bfdf76b7e..450d49e60399 100644
--- a/nixos/tests/common/acme/server/default.nix
+++ b/nixos/tests/common/acme/server/default.nix
@@ -120,6 +120,11 @@ in {
         enable = true;
         description = "Pebble ACME server";
         wantedBy = [ "network.target" ];
+        environment = {
+          # We're not testing lego, we're just testing our configuration.
+          # No need to sleep.
+          PEBBLE_VA_NOSLEEP = "1";
+        };
 
         serviceConfig = {
           RuntimeDirectory = "pebble";

From 795469df589a3e1a595f556c8e817ce158922bd7 Mon Sep 17 00:00:00 2001
From: Bernardo Meurer <bernardo@meurer.org>
Date: Sun, 26 Dec 2021 13:46:30 -0300
Subject: [PATCH 22/63] roon-server: explicitly set dontConfigure/Build

---
 pkgs/servers/roon-server/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/servers/roon-server/default.nix b/pkgs/servers/roon-server/default.nix
index c39ac2d39cb4..e62f0a9dfd95 100644
--- a/pkgs/servers/roon-server/default.nix
+++ b/pkgs/servers/roon-server/default.nix
@@ -26,6 +26,9 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-Td3iRYGmTg8Vx9c4e4ugIIbAqhDFPax9vR2BsCIQCZA=";
     };
 
+  dontConfigure = true;
+  dontBuild = true;
+
   buildInputs = [
     alsa-lib
     freetype

From 07c15833093b9db5dacb3829afda03d7c71cc077 Mon Sep 17 00:00:00 2001
From: Lucas Savva <lucas@m1cr0man.com>
Date: Sat, 4 Dec 2021 17:32:17 +0000
Subject: [PATCH 23/63] nixos/acme: Update release notes

---
 .../from_md/release-notes/rl-2205.section.xml | 26 ++++++++++++++++++-
 .../manual/release-notes/rl-2205.section.md   | 11 ++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index d5e3190bf288..acafdcafa1b6 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -14,7 +14,17 @@
   </itemizedlist>
   <section xml:id="sec-release-22.05-highlights">
     <title>Highlights</title>
-    <itemizedlist spacing="compact">
+    <itemizedlist>
+      <listitem>
+        <para>
+          <literal>security.acme.defaults</literal> has been added to
+          simplify configuring settings for many certificates at once.
+          This also opens up the the option to use DNS-01 validation
+          when using <literal>enableACME</literal> on web server virtual
+          hosts (e.g.
+          <literal>services.nginx.virtualHosts.*.enableACME</literal>).
+        </para>
+      </listitem>
       <listitem>
         <para>
           PHP 8.1 is now available
@@ -180,6 +190,20 @@
           using this default will print a warning when rebuilt.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>security.acme</literal> certificates will now
+          correctly check for CA revokation before reaching their
+          minimum age.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Removing domains from
+          <literal>security.acme.certs._name_.extraDomainNames</literal>
+          will now correctly remove those domains during rebuild/renew.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The option
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 98709455ae74..7258d90bdb2a 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -6,6 +6,11 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 ## Highlights {#sec-release-22.05-highlights}
 
+- `security.acme.defaults` has been added to simplify configuring
+  settings for many certificates at once. This also opens up the
+  the option to use DNS-01 validation when using `enableACME` on
+  web server virtual hosts (e.g. `services.nginx.virtualHosts.*.enableACME`).
+
 - PHP 8.1 is now available
 
 ## New Services {#sec-release-22.05-new-services}
@@ -73,6 +78,12 @@ In addition to numerous new and upgraded packages, this release has the followin
 - The `services.unifi.openPorts` option default value of `true` is now deprecated and will be changed to `false` in 22.11.
   Configurations using this default will print a warning when rebuilt.
 
+- `security.acme` certificates will now correctly check for CA
+  revokation before reaching their minimum age.
+
+- Removing domains from `security.acme.certs._name_.extraDomainNames`
+  will now correctly remove those domains during rebuild/renew.
+
 - The option
   [services.ssh.enableAskPassword](#opt-services.ssh.enableAskPassword) was
   added, decoupling the setting of `SSH_ASKPASS` from

From 8d01b0862d3d52d72539cff65a405c09d864f82f Mon Sep 17 00:00:00 2001
From: Lucas Savva <lucas@m1cr0man.com>
Date: Sat, 4 Dec 2021 18:09:43 +0000
Subject: [PATCH 24/63] nixos/acme: Update documentation

- Added defaultText for all inheritable options.
- Add docs on using new defaults option to configure
  DNS validation for all domains.
- Update DNS docs to show using a service to configure
  rfc2136 instead of manual steps.
---
 nixos/modules/security/acme.nix               |  34 +++-
 nixos/modules/security/acme.xml               | 159 +++++++++++++++---
 nixos/modules/services/networking/prosody.xml |   2 +-
 nixos/modules/services/web-apps/discourse.xml |   2 +-
 .../modules/services/web-apps/jitsi-meet.xml  |   4 +-
 5 files changed, 172 insertions(+), 29 deletions(-)

diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index c39653d174e5..1b116482caeb 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -425,6 +425,8 @@ let
 
   certConfigs = mapAttrs certToConfig cfg.certs;
 
+  mkDefaultText = val: "Inherit from security.acme.defaults, otherwise ${val}" ;
+
   # These options can be specified within
   # security.acme or security.acme.certs.<name>
   inheritableOpts =
@@ -432,12 +434,14 @@ let
       validMinDays = mkOption {
         type = types.int;
         default = if inheritDefaults then defaults.validMinDays else 30;
+        defaultText = mkDefaultText "30";
         description = "Minimum remaining validity before renewal in days.";
       };
 
       renewInterval = mkOption {
         type = types.str;
         default = if inheritDefaults then defaults.renewInterval else "daily";
+        defaultText = mkDefaultText "'daily'";
         description = ''
           Systemd calendar expression when to check for renewal. See
           <citerefentry><refentrytitle>systemd.time</refentrytitle>
@@ -452,6 +456,7 @@ let
       webroot = mkOption {
         type = types.nullOr types.str;
         default = if inheritDefaults then defaults.webroot else null;
+        defaultText = mkDefaultText "null";
         example = "/var/lib/acme/acme-challenge";
         description = ''
           Where the webroot of the HTTP vhost is located.
@@ -465,6 +470,7 @@ let
       server = mkOption {
         type = types.nullOr types.str;
         default = if inheritDefaults then defaults.server else null;
+        defaultText = mkDefaultText "null";
         description = ''
           ACME Directory Resource URI. Defaults to Let's Encrypt's
           production endpoint,
@@ -475,6 +481,7 @@ let
       email = mkOption {
         type = types.str;
         default = if inheritDefaults then defaults.email else null;
+        defaultText = mkDefaultText "null";
         description = ''
           Email address for account creation and correspondence from the CA.
           It is recommended to use the same email for all certs to avoid account
@@ -485,12 +492,14 @@ let
       group = mkOption {
         type = types.str;
         default = if inheritDefaults then defaults.group else "acme";
+        defaultText = mkDefaultText "'acme'";
         description = "Group running the ACME client.";
       };
 
       reloadServices = mkOption {
         type = types.listOf types.str;
         default = if inheritDefaults then defaults.reloadServices else [];
+        defaultText = mkDefaultText "[]";
         description = ''
           The list of systemd services to call <code>systemctl try-reload-or-restart</code>
           on.
@@ -500,6 +509,7 @@ let
       postRun = mkOption {
         type = types.lines;
         default = if inheritDefaults then defaults.postRun else "";
+        defaultText = mkDefaultText "''";
         example = "cp full.pem backup.pem";
         description = ''
           Commands to run after new certificates go live. Note that
@@ -512,6 +522,7 @@ let
       keyType = mkOption {
         type = types.str;
         default = if inheritDefaults then defaults.keyType else "ec256";
+        defaultText = mkDefaultText "'ec256'";
         description = ''
           Key type to use for private keys.
           For an up to date list of supported values check the --key-type option
@@ -522,6 +533,7 @@ let
       dnsProvider = mkOption {
         type = types.nullOr types.str;
         default = if inheritDefaults then defaults.dnsProvider else null;
+        defaultText = mkDefaultText "null";
         example = "route53";
         description = ''
           DNS Challenge provider. For a list of supported providers, see the "code"
@@ -532,6 +544,7 @@ let
       dnsResolver = mkOption {
         type = types.nullOr types.str;
         default = if inheritDefaults then defaults.dnsResolver else null;
+        defaultText = mkDefaultText "null";
         example = "1.1.1.1:53";
         description = ''
           Set the resolver to use for performing recursive DNS queries. Supported:
@@ -543,6 +556,7 @@ let
       credentialsFile = mkOption {
         type = types.path;
         default = if inheritDefaults then defaults.credentialsFile else null;
+        defaultText = mkDefaultText "null";
         description = ''
           Path to an EnvironmentFile for the cert's service containing any required and
           optional environment variables for your selected dnsProvider.
@@ -555,6 +569,7 @@ let
       dnsPropagationCheck = mkOption {
         type = types.bool;
         default = if inheritDefaults then defaults.dnsPropagationCheck else true;
+        defaultText = mkDefaultText "true";
         description = ''
           Toggles lego DNS propagation check, which is used alongside DNS-01
           challenge to ensure the DNS entries required are available.
@@ -564,6 +579,7 @@ let
       ocspMustStaple = mkOption {
         type = types.bool;
         default = if inheritDefaults then defaults.ocspMustStaple else false;
+        defaultText = mkDefaultText "false";
         description = ''
           Turns on the OCSP Must-Staple TLS extension.
           Make sure you know what you're doing! See:
@@ -577,6 +593,7 @@ let
       extraLegoFlags = mkOption {
         type = types.listOf types.str;
         default = if inheritDefaults then defaults.extraLegoFlags else [];
+        defaultText = mkDefaultText "[]";
         description = ''
           Additional global flags to pass to all lego commands.
         '';
@@ -585,6 +602,7 @@ let
       extraLegoRenewFlags = mkOption {
         type = types.listOf types.str;
         default = if inheritDefaults then defaults.extraLegoRenewFlags else [];
+        defaultText = mkDefaultText "[]";
         description = ''
           Additional flags to pass to lego renew.
         '';
@@ -593,14 +611,24 @@ let
       extraLegoRunFlags = mkOption {
         type = types.listOf types.str;
         default = if inheritDefaults then defaults.extraLegoRunFlags else [];
+        defaultText = mkDefaultText "[]";
         description = ''
           Additional flags to pass to lego run.
         '';
       };
     };
 
-  certOpts = { name, ... }: {
-    options = (inheritableOpts { inherit (cfg) defaults; inheritDefaults = cfg.certs."${name}".inheritDefaults; }) // {
+  certOpts = { name, config, ... }: {
+    options = (inheritableOpts {
+      inherit (cfg) defaults;
+      # During doc generation, name = "<name>" and doesn't really
+      # exist as a cert. As such, handle undfined certs.
+      inheritDefaults = (lib.attrByPath
+        [name]
+        { inheritDefaults = false; }
+        cfg.certs
+      ).inheritDefaults;
+    }) // {
       # user option has been removed
       user = mkOption {
         visible = false;
@@ -696,7 +724,7 @@ in {
       };
 
       defaults = mkOption {
-        type = types.submodule ({ ... }: { options = inheritableOpts {}; });
+        type = types.submodule { options = inheritableOpts {}; };
         description = ''
           Default values inheritable by all configured certs. You can
           use this to define options shared by all your certs. These defaults
diff --git a/nixos/modules/security/acme.xml b/nixos/modules/security/acme.xml
index bf93800a0af4..f623cc509be6 100644
--- a/nixos/modules/security/acme.xml
+++ b/nixos/modules/security/acme.xml
@@ -7,8 +7,9 @@
  <para>
   NixOS supports automatic domain validation &amp; certificate retrieval and
   renewal using the ACME protocol. Any provider can be used, but by default
-  NixOS uses Let's Encrypt. The alternative ACME client <literal>lego</literal>
-  is used under the hood.
+  NixOS uses Let's Encrypt. The alternative ACME client
+  <link xlink:href="https://go-acme.github.io/lego/">lego</link> is used under
+  the hood.
  </para>
  <para>
   Automatic cert validation and configuration for Apache and Nginx virtual
@@ -29,7 +30,7 @@
   <para>
    You must also set an email address to be used when creating accounts with
    Let's Encrypt. You can set this for all certs with
-   <literal><xref linkend="opt-security.acme.email" /></literal>
+   <literal><xref linkend="opt-security.acme.defaults.email" /></literal>
    and/or on a per-cert basis with
    <literal><xref linkend="opt-security.acme.certs._name_.email" /></literal>.
    This address is only used for registration and renewal reminders,
@@ -38,7 +39,7 @@
 
   <para>
    Alternatively, you can use a different ACME server by changing the
-   <literal><xref linkend="opt-security.acme.server" /></literal> option
+   <literal><xref linkend="opt-security.acme.defaults.server" /></literal> option
    to a provider of your choosing, or just change the server for one cert with
    <literal><xref linkend="opt-security.acme.certs._name_.server" /></literal>.
   </para>
@@ -60,12 +61,12 @@
    = true;</literal> in a virtualHost config. We first create self-signed
    placeholder certificates in place of the real ACME certs. The placeholder
    certs are overwritten when the ACME certs arrive. For
-   <literal>foo.example.com</literal> the config would look like.
+   <literal>foo.example.com</literal> the config would look like this:
   </para>
 
 <programlisting>
 <xref linkend="opt-security.acme.acceptTerms" /> = true;
-<xref linkend="opt-security.acme.email" /> = "admin+acme@example.com";
+<xref linkend="opt-security.acme.defaults.email" /> = "admin+acme@example.com";
 services.nginx = {
   <link linkend="opt-services.nginx.enable">enable</link> = true;
   <link linkend="opt-services.nginx.virtualHosts">virtualHosts</link> = {
@@ -114,7 +115,7 @@ services.nginx = {
 
 <programlisting>
 <xref linkend="opt-security.acme.acceptTerms" /> = true;
-<xref linkend="opt-security.acme.email" /> = "admin+acme@example.com";
+<xref linkend="opt-security.acme.defaults.email" /> = "admin+acme@example.com";
 
 # /var/lib/acme/.challenges must be writable by the ACME user
 # and readable by the Nginx user. The easiest way to achieve
@@ -218,7 +219,7 @@ services.bind = {
 
 # Now we can configure ACME
 <xref linkend="opt-security.acme.acceptTerms" /> = true;
-<xref linkend="opt-security.acme.email" /> = "admin+acme@example.com";
+<xref linkend="opt-security.acme.defaults.email" /> = "admin+acme@example.com";
 <xref linkend="opt-security.acme.certs" />."example.com" = {
   <link linkend="opt-security.acme.certs._name_.domain">domain</link> = "*.example.com";
   <link linkend="opt-security.acme.certs._name_.dnsProvider">dnsProvider</link> = "rfc2136";
@@ -231,25 +232,39 @@ services.bind = {
   <para>
    The <filename>dnskeys.conf</filename> and <filename>certs.secret</filename>
    must be kept secure and thus you should not keep their contents in your
-   Nix config. Instead, generate them one time with these commands:
+   Nix config. Instead, generate them one time with a systemd service:
   </para>
 
 <programlisting>
-mkdir -p /var/lib/secrets
-tsig-keygen rfc2136key.example.com &gt; /var/lib/secrets/dnskeys.conf
-chown named:root /var/lib/secrets/dnskeys.conf
-chmod 400 /var/lib/secrets/dnskeys.conf
+systemd.services.dns-rfc2136-conf = {
+  requiredBy = ["acme-example.com.service", "bind.service"];
+  before = ["acme-example.com.service", "bind.service"];
+  unitConfig = {
+    ConditionPathExists = "!/var/lib/secrets/dnskeys.conf";
+  };
+  serviceConfig = {
+    Type = "oneshot";
+    UMask = 0077;
+  };
+  path = [ pkgs.bind ];
+  script = ''
+    mkdir -p /var/lib/secrets
+    tsig-keygen rfc2136key.example.com &gt; /var/lib/secrets/dnskeys.conf
+    chown named:root /var/lib/secrets/dnskeys.conf
+    chmod 400 /var/lib/secrets/dnskeys.conf
 
-# Copy the secret value from the dnskeys.conf, and put it in
-# RFC2136_TSIG_SECRET below
+    # Copy the secret value from the dnskeys.conf, and put it in
+    # RFC2136_TSIG_SECRET below
 
-cat &gt; /var/lib/secrets/certs.secret &lt;&lt; EOF
-RFC2136_NAMESERVER='127.0.0.1:53'
-RFC2136_TSIG_ALGORITHM='hmac-sha256.'
-RFC2136_TSIG_KEY='rfc2136key.example.com'
-RFC2136_TSIG_SECRET='your secret key'
-EOF
-chmod 400 /var/lib/secrets/certs.secret
+    cat &gt; /var/lib/secrets/certs.secret &lt;&lt; EOF
+    RFC2136_NAMESERVER='127.0.0.1:53'
+    RFC2136_TSIG_ALGORITHM='hmac-sha256.'
+    RFC2136_TSIG_KEY='rfc2136key.example.com'
+    RFC2136_TSIG_SECRET='your secret key'
+    EOF
+    chmod 400 /var/lib/secrets/certs.secret
+  '';
+};
 </programlisting>
 
   <para>
@@ -258,6 +273,106 @@ chmod 400 /var/lib/secrets/certs.secret
    journalctl -fu acme-example.com.service</literal> and watching its log output.
   </para>
  </section>
+
+ <section xml:id="module-security-acme-config-dns-with-vhosts">
+  <title>Using DNS validation with web server virtual hosts</title>
+
+  <para>
+   It is possible to use DNS-01 validation with all certificates,
+   including those automatically configured via the Nginx/Apache
+   <literal><link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link></literal>
+   option. This configuration pattern is fully
+   supported and part of the module's test suite for Nginx + Apache.
+  </para>
+
+  <para>
+   You must follow the guide above on configuring DNS-01 validation
+   first, however instead of setting the options for one certificate
+   (e.g. <xref linkend="opt-security.acme.certs._name_.dnsProvider" />)
+   you will set them as defaults
+   (e.g. <xref linkend="opt-security.acme.defaults.dnsProvider" />).
+  </para>
+
+<programlisting>
+# Configure ACME appropriately
+<xref linkend="opt-security.acme.acceptTerms" /> = true;
+<xref linkend="opt-security.acme.defaults.email" /> = "admin+acme@example.com";
+<xref linkend="opt-security.acme.defaults" /> = {
+  <link linkend="opt-security.acme.defaults.dnsProvider">dnsProvider</link> = "rfc2136";
+  <link linkend="opt-security.acme.defaults.credentialsFile">credentialsFile</link> = "/var/lib/secrets/certs.secret";
+  # We don't need to wait for propagation since this is a local DNS server
+  <link linkend="opt-security.acme.defaults.dnsPropagationCheck">dnsPropagationCheck</link> = false;
+};
+
+# For each virtual host you would like to use DNS-01 validation with,
+# set acmeRoot = null
+services.nginx = {
+  <link linkend="opt-services.nginx.enable">enable</link> = true;
+  <link linkend="opt-services.nginx.virtualHosts">virtualHosts</link> = {
+    "foo.example.com" = {
+      <link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link> = true;
+      <link linkend="opt-services.nginx.virtualHosts._name_.acmeRoot">acmeRoot</link> = null;
+    };
+  };
+}
+</programlisting>
+
+  <para>
+   And that's it! Next time your configuration is rebuilt, or when
+   you add a new virtualHost, it will be DNS-01 validated.
+  </para>
+ </section>
+
+ <section xml:id="module-security-acme-root-owned">
+  <title>Using ACME with services demanding root owned certificates</title>
+
+  <para>
+   Some services refuse to start if the configured certificate files
+   are not owned by root. PostgreSQL and OpenSMTPD are examples of these.
+   There is no way to change the user the ACME module uses (it will always be
+   <literal>acme</literal>), however you can use systemd's
+   <literal>LoadCredential</literal> feature to resolve this elegantly.
+   Below is an example configuration for OpenSMTPD, but this pattern
+   can be applied to any service.
+  </para>
+
+<programlisting>
+# Configure ACME however you like (DNS or HTTP validation), adding
+# the following configuration for the relevant certificate.
+# Note: You cannot use `systemctl reload` here as that would mean
+# the LoadCredential configuration below would be skipped and
+# the service would continue to use old certificates.
+security.acme.certs."mail.example.com".postRun = ''
+  systemctl restart opensmtpd
+'';
+
+# Now you must augment OpenSMTPD's systemd service to load
+# the certificate files.
+<link linkend="opt-systemd.services._name_.requires">systemd.services.opensmtpd.requires</link> = ["acme-finished-mail.example.com.target"];
+<link linkend="opt-systemd.services._name_.serviceConfig">systemd.services.opensmtpd.serviceConfig.LoadCredential</link> = let
+  certDir = config.security.acme.certs."mail.example.com".directory;
+in [
+  "cert.pem:${certDir}/cert.pem"
+  "key.pem:${certDir}/key.pem"
+];
+
+# Finally, configure OpenSMTPD to use these certs.
+services.opensmtpd = let
+  credsDir = "/run/credentials/opensmtpd.service";
+in {
+  enable = true;
+  setSendmail = false;
+  serverConfiguration = ''
+    pki mail.example.com cert "${credsDir}/cert.pem"
+    pki mail.example.com key "${credsDir}/key.pem"
+    listen on localhost tls pki mail.example.com
+    action act1 relay host smtp://127.0.0.1:10027
+    match for local action act1
+  '';
+};
+</programlisting>
+ </section>
+
  <section xml:id="module-security-acme-regenerate">
   <title>Regenerating certificates</title>
 
diff --git a/nixos/modules/services/networking/prosody.xml b/nixos/modules/services/networking/prosody.xml
index 471240cd1475..6358d744ff78 100644
--- a/nixos/modules/services/networking/prosody.xml
+++ b/nixos/modules/services/networking/prosody.xml
@@ -72,7 +72,7 @@ services.prosody = {
    a TLS certificate for the three endponits:
     <programlisting>
 security.acme = {
-  <link linkend="opt-security.acme.email">email</link> = "root@example.org";
+  <link linkend="opt-security.acme.defaults.email">email</link> = "root@example.org";
   <link linkend="opt-security.acme.acceptTerms">acceptTerms</link> = true;
   <link linkend="opt-security.acme.certs">certs</link> = {
     "example.org" = {
diff --git a/nixos/modules/services/web-apps/discourse.xml b/nixos/modules/services/web-apps/discourse.xml
index e91d3eac422d..ad9b65abf51e 100644
--- a/nixos/modules/services/web-apps/discourse.xml
+++ b/nixos/modules/services/web-apps/discourse.xml
@@ -25,7 +25,7 @@ services.discourse = {
   };
   <link linkend="opt-services.discourse.secretKeyBaseFile">secretKeyBaseFile</link> = "/path/to/secret_key_base_file";
 };
-<link linkend="opt-security.acme.email">security.acme.email</link> = "me@example.com";
+<link linkend="opt-security.acme.defaults.email">security.acme.email</link> = "me@example.com";
 <link linkend="opt-security.acme.acceptTerms">security.acme.acceptTerms</link> = true;
 </programlisting>
    </para>
diff --git a/nixos/modules/services/web-apps/jitsi-meet.xml b/nixos/modules/services/web-apps/jitsi-meet.xml
index 97373bc6d9a8..ff44c724adf4 100644
--- a/nixos/modules/services/web-apps/jitsi-meet.xml
+++ b/nixos/modules/services/web-apps/jitsi-meet.xml
@@ -20,7 +20,7 @@
   };
   <link linkend="opt-services.jitsi-videobridge.openFirewall">services.jitsi-videobridge.openFirewall</link> = true;
   <link linkend="opt-networking.firewall.allowedTCPPorts">networking.firewall.allowedTCPPorts</link> = [ 80 443 ];
-  <link linkend="opt-security.acme.email">security.acme.email</link> = "me@example.com";
+  <link linkend="opt-security.acme.defaults.email">security.acme.email</link> = "me@example.com";
   <link linkend="opt-security.acme.acceptTerms">security.acme.acceptTerms</link> = true;
 }</programlisting>
    </para>
@@ -46,7 +46,7 @@
   };
   <link linkend="opt-services.jitsi-videobridge.openFirewall">services.jitsi-videobridge.openFirewall</link> = true;
   <link linkend="opt-networking.firewall.allowedTCPPorts">networking.firewall.allowedTCPPorts</link> = [ 80 443 ];
-  <link linkend="opt-security.acme.email">security.acme.email</link> = "me@example.com";
+  <link linkend="opt-security.acme.defaults.email">security.acme.email</link> = "me@example.com";
   <link linkend="opt-security.acme.acceptTerms">security.acme.acceptTerms</link> = true;
 }</programlisting>
    </para>

From 41fb8d71ab5d92118eec5f056d3ce7e8f370a652 Mon Sep 17 00:00:00 2001
From: Lucas Savva <lucas@m1cr0man.com>
Date: Sat, 4 Dec 2021 19:01:18 +0000
Subject: [PATCH 25/63] nixos/acme: Add useRoot option

---
 nixos/modules/security/acme.nix | 23 ++++++++++++++++++-----
 nixos/tests/acme.nix            | 13 +++++++++++++
 2 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index 1b116482caeb..57e83a4a27b7 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -3,6 +3,7 @@ with lib;
 let
   cfg = config.security.acme;
   opt = options.security.acme;
+  user = if cfg.useRoot then "root" else "acme";
 
   # Used to calculate timer accuracy for coalescing
   numCerts = length (builtins.attrNames cfg.certs);
@@ -23,7 +24,7 @@ let
   # security.acme.certs.<cert>.group on some of the services.
   commonServiceConfig = {
     Type = "oneshot";
-    User = "acme";
+    User = user;
     Group = mkDefault "acme";
     UMask = 0022;
     StateDirectoryMode = 750;
@@ -101,12 +102,12 @@ let
   # is configurable on a per-cert basis.
   userMigrationService = let
     script = with builtins; ''
-      chown -R acme .lego/accounts
+      chown -R ${user} .lego/accounts
     '' + (concatStringsSep "\n" (mapAttrsToList (cert: data: ''
       for fixpath in ${escapeShellArg cert} .lego/${escapeShellArg cert}; do
         if [ -d "$fixpath" ]; then
           chmod -R u=rwX,g=rX,o= "$fixpath"
-          chown -R acme:${data.group} "$fixpath"
+          chown -R ${user}:${data.group} "$fixpath"
         fi
       done
     '') certConfigs));
@@ -268,7 +269,7 @@ let
         cat key.pem fullchain.pem > full.pem
 
         # Group might change between runs, re-apply it
-        chown 'acme:${data.group}' *
+        chown '${user}:${data.group}' *
 
         # Default permissions make the files unreadable by group + anon
         # Need to be readable by group
@@ -403,7 +404,7 @@ let
         mv domainhash.txt certificates/
 
         # Group might change between runs, re-apply it
-        chown 'acme:${data.group}' certificates/*
+        chown '${user}:${data.group}' certificates/*
 
         # Copy all certs to the "real" certs directory
         if ! cmp -s 'certificates/${keyName}.crt' out/fullchain.pem; then
@@ -723,6 +724,18 @@ in {
         '';
       };
 
+      useRoot = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to use the root user when generating certs. This is not recommended
+          for security + compatiblity reasons. If a service requires root owned certificates
+          consider following the guide on "Using ACME with services demanding root
+          owned certificates" in the NixOS manual, and only using this as a fallback
+          or for testing.
+        '';
+      };
+
       defaults = mkOption {
         type = types.submodule { options = inheritableOpts {}; };
         description = ''
diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix
index 549fa9e64eea..a4ed8fa67bfe 100644
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@@ -232,6 +232,13 @@ in {
           }
         ];
 
+        use-root.configuration = { ... }: lib.mkMerge [
+          webserverBasicConfig
+          {
+            security.acme.useRoot = true;
+          }
+        ];
+
       # Test compatibility with Nginx
       } // (mkServerConfigs {
           server = "nginx";
@@ -450,6 +457,12 @@ in {
           webserver.wait_for_unit("nginx.service")
           check_connection(client, "slow.example.com")
 
+      with subtest("Can set useRoot to true and still use certs normally"):
+          switch_to(webserver, "use-root")
+          webserver.wait_for_unit("nginx.service")
+          webserver.succeed("test \"$(stat -c '%U' /var/lib/acme/* | uniq)\" = \"root\"")
+          check_connection(client, "a.example.com")
+
       domains = ["http", "dns", "wildcard"]
       for server, logsrc in [
           ("nginx", "journalctl -n 30 -u nginx.service"),

From 2dcc3daadf3718b3b0216d4cfbaab9040a9beffd Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <contact@infinisil.com>
Date: Thu, 9 Dec 2021 22:43:54 +0100
Subject: [PATCH 26/63] nixos/acme: Clean up default handling

---
 nixos/modules/security/acme.nix | 89 ++++++++++++++-------------------
 1 file changed, 37 insertions(+), 52 deletions(-)

diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index 57e83a4a27b7..2b3a86f96fc7 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -426,23 +426,31 @@ let
 
   certConfigs = mapAttrs certToConfig cfg.certs;
 
-  mkDefaultText = val: "Inherit from security.acme.defaults, otherwise ${val}" ;
-
   # These options can be specified within
-  # security.acme or security.acme.certs.<name>
-  inheritableOpts =
-    { inheritDefaults ? false, defaults ? null }: {
+  # security.acme.defaults or security.acme.certs.<name>
+  inheritableModule = isDefaults: { config, ... }: let
+    defaultAndText = name: default: {
+      # When ! isDefaults then this is the option declaration for the
+      # security.acme.certs.<name> path, which has the extra inheritDefaults
+      # option, which if disabled means that we can't inherit it
+      default = if isDefaults || ! config.inheritDefaults then default else cfg.defaults.${name};
+      # The docs however don't need to depend on inheritDefaults, they should
+      # stay constant. Though notably it wouldn't matter much, because to get
+      # the option information, a submodule with name `<name>` is evaluated
+      # without any definitions.
+      defaultText = if isDefaults then default else literalExpression "config.security.acme.defaults.${name}";
+    };
+  in {
+    options = {
       validMinDays = mkOption {
         type = types.int;
-        default = if inheritDefaults then defaults.validMinDays else 30;
-        defaultText = mkDefaultText "30";
+        inherit (defaultAndText "validMinDays" 30) default defaultText;
         description = "Minimum remaining validity before renewal in days.";
       };
 
       renewInterval = mkOption {
         type = types.str;
-        default = if inheritDefaults then defaults.renewInterval else "daily";
-        defaultText = mkDefaultText "'daily'";
+        inherit (defaultAndText "renewInterval" "daily") default defaultText;
         description = ''
           Systemd calendar expression when to check for renewal. See
           <citerefentry><refentrytitle>systemd.time</refentrytitle>
@@ -451,13 +459,12 @@ let
       };
 
       enableDebugLogs = mkEnableOption "debug logging for this certificate" // {
-        default = if inheritDefaults then defaults.enableDebugLogs else true;
+        inherit (defaultAndText "enableDebugLogs" true) default defaultText;
       };
 
       webroot = mkOption {
         type = types.nullOr types.str;
-        default = if inheritDefaults then defaults.webroot else null;
-        defaultText = mkDefaultText "null";
+        inherit (defaultAndText "webroot" null) default defaultText;
         example = "/var/lib/acme/acme-challenge";
         description = ''
           Where the webroot of the HTTP vhost is located.
@@ -470,8 +477,7 @@ let
 
       server = mkOption {
         type = types.nullOr types.str;
-        default = if inheritDefaults then defaults.server else null;
-        defaultText = mkDefaultText "null";
+        inherit (defaultAndText "server" null) default defaultText;
         description = ''
           ACME Directory Resource URI. Defaults to Let's Encrypt's
           production endpoint,
@@ -481,8 +487,7 @@ let
 
       email = mkOption {
         type = types.str;
-        default = if inheritDefaults then defaults.email else null;
-        defaultText = mkDefaultText "null";
+        inherit (defaultAndText "email" null) default defaultText;
         description = ''
           Email address for account creation and correspondence from the CA.
           It is recommended to use the same email for all certs to avoid account
@@ -492,15 +497,13 @@ let
 
       group = mkOption {
         type = types.str;
-        default = if inheritDefaults then defaults.group else "acme";
-        defaultText = mkDefaultText "'acme'";
+        inherit (defaultAndText "group" "acme") default defaultText;
         description = "Group running the ACME client.";
       };
 
       reloadServices = mkOption {
         type = types.listOf types.str;
-        default = if inheritDefaults then defaults.reloadServices else [];
-        defaultText = mkDefaultText "[]";
+        inherit (defaultAndText "reloadServices" []) default defaultText;
         description = ''
           The list of systemd services to call <code>systemctl try-reload-or-restart</code>
           on.
@@ -509,8 +512,7 @@ let
 
       postRun = mkOption {
         type = types.lines;
-        default = if inheritDefaults then defaults.postRun else "";
-        defaultText = mkDefaultText "''";
+        inherit (defaultAndText "postRun" "") default defaultText;
         example = "cp full.pem backup.pem";
         description = ''
           Commands to run after new certificates go live. Note that
@@ -522,8 +524,7 @@ let
 
       keyType = mkOption {
         type = types.str;
-        default = if inheritDefaults then defaults.keyType else "ec256";
-        defaultText = mkDefaultText "'ec256'";
+        inherit (defaultAndText "keyType" "ec256") default defaultText;
         description = ''
           Key type to use for private keys.
           For an up to date list of supported values check the --key-type option
@@ -533,8 +534,7 @@ let
 
       dnsProvider = mkOption {
         type = types.nullOr types.str;
-        default = if inheritDefaults then defaults.dnsProvider else null;
-        defaultText = mkDefaultText "null";
+        inherit (defaultAndText "dnsProvider" null) default defaultText;
         example = "route53";
         description = ''
           DNS Challenge provider. For a list of supported providers, see the "code"
@@ -544,8 +544,7 @@ let
 
       dnsResolver = mkOption {
         type = types.nullOr types.str;
-        default = if inheritDefaults then defaults.dnsResolver else null;
-        defaultText = mkDefaultText "null";
+        inherit (defaultAndText "dnsResolver" null) default defaultText;
         example = "1.1.1.1:53";
         description = ''
           Set the resolver to use for performing recursive DNS queries. Supported:
@@ -556,8 +555,7 @@ let
 
       credentialsFile = mkOption {
         type = types.path;
-        default = if inheritDefaults then defaults.credentialsFile else null;
-        defaultText = mkDefaultText "null";
+        inherit (defaultAndText "credentialsFile" null) default defaultText;
         description = ''
           Path to an EnvironmentFile for the cert's service containing any required and
           optional environment variables for your selected dnsProvider.
@@ -569,8 +567,7 @@ let
 
       dnsPropagationCheck = mkOption {
         type = types.bool;
-        default = if inheritDefaults then defaults.dnsPropagationCheck else true;
-        defaultText = mkDefaultText "true";
+        inherit (defaultAndText "dnsPropagationCheck" true) default defaultText;
         description = ''
           Toggles lego DNS propagation check, which is used alongside DNS-01
           challenge to ensure the DNS entries required are available.
@@ -579,8 +576,7 @@ let
 
       ocspMustStaple = mkOption {
         type = types.bool;
-        default = if inheritDefaults then defaults.ocspMustStaple else false;
-        defaultText = mkDefaultText "false";
+        inherit (defaultAndText "ocspMustStaple" false) default defaultText;
         description = ''
           Turns on the OCSP Must-Staple TLS extension.
           Make sure you know what you're doing! See:
@@ -593,8 +589,7 @@ let
 
       extraLegoFlags = mkOption {
         type = types.listOf types.str;
-        default = if inheritDefaults then defaults.extraLegoFlags else [];
-        defaultText = mkDefaultText "[]";
+        inherit (defaultAndText "extraLegoFlags" []) default defaultText;
         description = ''
           Additional global flags to pass to all lego commands.
         '';
@@ -602,8 +597,7 @@ let
 
       extraLegoRenewFlags = mkOption {
         type = types.listOf types.str;
-        default = if inheritDefaults then defaults.extraLegoRenewFlags else [];
-        defaultText = mkDefaultText "[]";
+        inherit (defaultAndText "extraLegoRenewFlags" []) default defaultText;
         description = ''
           Additional flags to pass to lego renew.
         '';
@@ -611,25 +605,16 @@ let
 
       extraLegoRunFlags = mkOption {
         type = types.listOf types.str;
-        default = if inheritDefaults then defaults.extraLegoRunFlags else [];
-        defaultText = mkDefaultText "[]";
+        inherit (defaultAndText "extraLegoRunFlags" []) default defaultText;
         description = ''
           Additional flags to pass to lego run.
         '';
       };
     };
+  };
 
   certOpts = { name, config, ... }: {
-    options = (inheritableOpts {
-      inherit (cfg) defaults;
-      # During doc generation, name = "<name>" and doesn't really
-      # exist as a cert. As such, handle undfined certs.
-      inheritDefaults = (lib.attrByPath
-        [name]
-        { inheritDefaults = false; }
-        cfg.certs
-      ).inheritDefaults;
-    }) // {
+    options = {
       # user option has been removed
       user = mkOption {
         visible = false;
@@ -737,7 +722,7 @@ in {
       };
 
       defaults = mkOption {
-        type = types.submodule { options = inheritableOpts {}; };
+        type = types.submodule (inheritableModule true);
         description = ''
           Default values inheritable by all configured certs. You can
           use this to define options shared by all your certs. These defaults
@@ -748,7 +733,7 @@ in {
 
       certs = mkOption {
         default = { };
-        type = with types; attrsOf (submodule certOpts);
+        type = with types; attrsOf (submodule [ (inheritableModule false) certOpts ]);
         description = ''
           Attribute set of certificates to get signed and renewed. Creates
           <literal>acme-''${cert}.{service,timer}</literal> systemd units for

From 65f1b8c6ae2f2cf6a13d77b98b42eba31eef0424 Mon Sep 17 00:00:00 2001
From: Lucas Savva <lucas@m1cr0man.com>
Date: Sat, 18 Dec 2021 14:52:32 +0000
Subject: [PATCH 27/63] nixos/acme: Add test for lego's built-in web server

In the process I also found that the CapabilityBoundingSet
was restricting the service from listening on port 80, and
the AmbientCapabilities was ineffective. Fixed appropriately.
---
 nixos/modules/security/acme.nix |  2 +-
 nixos/tests/acme.nix            | 45 +++++++++++++++++++++++----------
 2 files changed, 32 insertions(+), 15 deletions(-)

diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index 2b3a86f96fc7..e244989d6408 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -324,7 +324,7 @@ let
           fi
         '');
       } // optionalAttrs (data.listenHTTP != null && toInt (elemAt (splitString ":" data.listenHTTP) 1) < 1024) {
-        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
       };
 
       # Working directory will be /tmp
diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix
index a4ed8fa67bfe..4af2303ce832 100644
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@@ -203,7 +203,7 @@ in {
           webserverBasicConfig
           {
             security.acme.certs."a.example.test".ocspMustStaple = true;
-            services.nginx.virtualHosts."a.example.com" = {
+            services.nginx.virtualHosts."a.example.test" = {
               extraConfig = ''
                 ssl_stapling on;
                 ssl_stapling_verify on;
@@ -224,7 +224,7 @@ in {
               script = "${pkgs.python3}/bin/python -m http.server";
             };
 
-            services.nginx.virtualHosts."slow.example.com" = {
+            services.nginx.virtualHosts."slow.example.test" = {
               forceSSL = true;
               enableACME = true;
               locations."/".proxyPass = "http://localhost:8000";
@@ -232,10 +232,24 @@ in {
           }
         ];
 
-        use-root.configuration = { ... }: lib.mkMerge [
+        # Test lego internal server (listenHTTP option)
+        # Also tests useRoot option
+        lego-server.configuration = { ... }: lib.mkMerge [
           webserverBasicConfig
           {
             security.acme.useRoot = true;
+            security.acme.certs."lego.example.test" = {
+              listenHTTP = ":80";
+              group = "nginx";
+            };
+            services.nginx.virtualHosts."a.example.test" = {
+              onlySSL = true;
+              forceSSL = lib.mkForce false;
+            };
+            services.nginx.virtualHosts."lego.example.test" = {
+              useACMEHost = "lego.example.test";
+              onlySSL = true;
+            };
           }
         ];
 
@@ -402,7 +416,7 @@ in {
       # Perform general tests first
       switch_to(webserver, "general")
 
-      with subtest("Can request certificate with HTTPS-01 challenge"):
+      with subtest("Can request certificate with HTTP-01 challenge"):
           webserver.wait_for_unit("acme-finished-a.example.test.target")
           check_fullchain(webserver, "a.example.test")
           check_issuer(webserver, "a.example.test", "pebble")
@@ -449,19 +463,22 @@ in {
           webserver.wait_for_unit("acme-finished-a.example.test.target")
           check_stapling(client, "a.example.test")
 
-      with subtest("Can request certificate with HTTPS-01 when nginx startup is delayed"):
+      with subtest("Can request certificate with HTTP-01 using lego's internal web server"):
+          switch_to(webserver, "lego-server")
+          webserver.wait_for_unit("acme-finished-lego.example.test.target")
+          webserver.wait_for_unit("nginx.service")
+          webserver.succeed("echo HENLO && systemctl cat nginx.service")
+          webserver.succeed("test \"$(stat -c '%U' /var/lib/acme/* | uniq)\" = \"root\"")
+          check_connection(client, "a.example.test")
+          check_connection(client, "lego.example.test")
+
+      with subtest("Can request certificate with HTTP-01 when nginx startup is delayed"):
           webserver.execute("systemctl stop nginx")
           switch_to(webserver, "slow-startup")
-          webserver.wait_for_unit("acme-finished-slow.example.com.target")
-          check_issuer(webserver, "slow.example.com", "pebble")
+          webserver.wait_for_unit("acme-finished-slow.example.test.target")
+          check_issuer(webserver, "slow.example.test", "pebble")
           webserver.wait_for_unit("nginx.service")
-          check_connection(client, "slow.example.com")
-
-      with subtest("Can set useRoot to true and still use certs normally"):
-          switch_to(webserver, "use-root")
-          webserver.wait_for_unit("nginx.service")
-          webserver.succeed("test \"$(stat -c '%U' /var/lib/acme/* | uniq)\" = \"root\"")
-          check_connection(client, "a.example.com")
+          check_connection(client, "slow.example.test")
 
       domains = ["http", "dns", "wildcard"]
       for server, logsrc in [

From b7f9203059f3a26d7dd8918cb59d48f748bc479b Mon Sep 17 00:00:00 2001
From: Evils <evils.devils@protonmail.com>
Date: Thu, 23 Dec 2021 14:27:57 +0100
Subject: [PATCH 28/63] kicad.updateScript: account for the bad 6.9.9 tag

---
 pkgs/applications/science/electronics/kicad/update.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/science/electronics/kicad/update.sh b/pkgs/applications/science/electronics/kicad/update.sh
index 099440956ae7..defddc036f40 100755
--- a/pkgs/applications/science/electronics/kicad/update.sh
+++ b/pkgs/applications/science/electronics/kicad/update.sh
@@ -28,7 +28,7 @@ export TMPDIR=/tmp
 latest_tag="$(git ls-remote --tags --sort -version:refname \
   https://gitlab.com/kicad/code/kicad.git \
   | grep -o 'refs/tags/[0-9]*\.[0-9]*\.[0-9]*$' \
-  | grep -v ".99" | head -n 1 | cut -d '/' -f 3)"
+  | grep -v "\.99" | grep -v "\.9\.9" | head -n 1 | cut -d '/' -f 3)"
 
 all_versions=( "${latest_tag}" master )
 

From 78f07691832d9912d59f29c002a176585b67f569 Mon Sep 17 00:00:00 2001
From: Evils <evils.devils@protonmail.com>
Date: Thu, 23 Dec 2021 14:52:07 +0100
Subject: [PATCH 29/63] kicad: 5.1.12 -> 6.0.0

remove old build conditionals
  the old wrapper env vars are no longer applicable to 6.0.0
  scripting is no longer optional
    though wxPython is still an optional dependency?

add withI18n build option to kicad.base
  i18n was moved to the kicad source, and is disabled by default
    withI18n takes the same default

add withPCM option
  to allow disabling building the Plugin and Content Manager

remove the withOCE option
  the build option was removed in upstream commit:
    1c5c052301b607a0cf8b8ed6681f1db1622a865b

and unconditionally use wxGTK31-gtk3 and wxPython
  the pcb editor's python terminal seems to work with these versions
---
 .../science/electronics/kicad/base.nix        | 39 ++++++---------
 .../science/electronics/kicad/default.nix     | 49 +++----------------
 .../science/electronics/kicad/versions.nix    | 24 ++++-----
 3 files changed, 33 insertions(+), 79 deletions(-)

diff --git a/pkgs/applications/science/electronics/kicad/base.nix b/pkgs/applications/science/electronics/kicad/base.nix
index 61fcff77e1c7..7cc5a151d74e 100644
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@@ -35,7 +35,6 @@
 , swig
 , python
 , wxPython
-, opencascade
 , opencascade-occt
 , libngspice
 , valgrind
@@ -45,21 +44,16 @@
 , kicadSrc
 , kicadVersion
 , i18n
-, withOCE
 , withOCC
 , withNgspice
 , withScripting
+, withI18n
+, withPCM
 , debug
 , sanitizeAddress
 , sanitizeThreads
-, withI18n
 }:
 
-assert lib.asserts.assertMsg (!(withOCE && stdenv.isAarch64)) "OCE fails a test on Aarch64";
-assert lib.asserts.assertMsg (!(withOCC && withOCE))
-  "Only one of OCC and OCE may be enabled";
-assert lib.assertMsg (!(stable && (sanitizeAddress || sanitizeThreads)))
-  "Only kicad-unstable(-small) supports address/thread sanitation";
 assert lib.assertMsg (!(sanitizeAddress && sanitizeThreads))
   "'sanitizeAddress' and 'sanitizeThreads' are mutually exclusive, use one.";
 
@@ -75,6 +69,7 @@ stdenv.mkDerivation rec {
   # tagged releases don't have "unknown"
   # kicad nightlies use git describe --dirty
   # nix removes .git, so its approximated here
+  # "6.99.0" doesn't have "-unknown", yet; so leaving this in case it returns
   postPatch = ''
     substituteInPlace CMakeModules/KiCadVersion.cmake \
       --replace "unknown" "${builtins.substring 0 10 src.rev}" \
@@ -82,23 +77,14 @@ stdenv.mkDerivation rec {
 
   makeFlags = optionals (debug) [ "CFLAGS+=-Og" "CFLAGS+=-ggdb" ];
 
-  cmakeFlags = optionals (stable && withScripting) [
-    "-DKICAD_SCRIPTING=ON"
-    "-DKICAD_SCRIPTING_MODULES=ON"
-    "-DKICAD_SCRIPTING_PYTHON3=ON"
-    "-DKICAD_SCRIPTING_WXPYTHON_PHOENIX=ON"
+  cmakeFlags = optionals (withScripting) [
+    "-DKICAD_SCRIPTING_WXPYTHON=ON"
   ]
   ++ optionals (!withScripting) [
-    "-DKICAD_SCRIPTING=OFF"
     "-DKICAD_SCRIPTING_WXPYTHON=OFF"
   ]
   ++ optional (withNgspice) "-DKICAD_SPICE=ON"
-  ++ optional (!withOCE) "-DKICAD_USE_OCE=OFF"
   ++ optional (!withOCC) "-DKICAD_USE_OCC=OFF"
-  ++ optionals (withOCE) [
-    "-DKICAD_USE_OCE=ON"
-    "-DOCE_DIR=${opencascade}"
-  ]
   ++ optionals (withOCC) [
     "-DKICAD_USE_OCC=ON"
     "-DOCC_INCLUDE_DIR=${opencascade-occt}/include/opencascade"
@@ -113,6 +99,12 @@ stdenv.mkDerivation rec {
   ]
   ++ optionals (sanitizeThreads) [
     "-DKICAD_SANITIZE_THREADS=ON"
+  ]
+  ++ optionals (withI18n) [
+    "-DKICAD_BUILD_I18N=ON"
+  ]
+  ++ optionals (!withPCM) [
+    "-DKICAD_PCM=OFF"
   ];
 
   nativeBuildInputs = [
@@ -154,20 +146,17 @@ stdenv.mkDerivation rec {
     curl
     openssl
     boost
+    swig
+    python
   ]
-  # unstable requires swig and python
-  # wxPython still optional
-  ++ optionals (withScripting || (!stable)) [ swig python ]
   ++ optional (withScripting) wxPython
   ++ optional (withNgspice) libngspice
-  ++ optional (withOCE) opencascade
   ++ optional (withOCC) opencascade-occt
   ++ optional (debug) valgrind
   ;
 
   # debug builds fail all but the python test
-  # 5.1.x fails the eeschema test
-  doInstallCheck = !debug && !stable;
+  doInstallCheck = !debug;
   installCheckTarget = "test";
 
   dontStrip = debug;
diff --git a/pkgs/applications/science/electronics/kicad/default.nix b/pkgs/applications/science/electronics/kicad/default.nix
index 425234e7f772..4c6ce3f9b73e 100644
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@@ -2,8 +2,7 @@
 , fetchFromGitLab
 , gnome
 , dconf
-, wxGTK30
-, wxGTK31
+, wxGTK31-gtk3
 , makeWrapper
 , gsettings-desktop-schemas
 , hicolor-icon-theme
@@ -15,7 +14,6 @@
 , pname ? "kicad"
 , stable ? true
 , oceSupport ? false
-, withOCE ? false
 , withOCCT ? false
 , withOCC ? true
 , ngspiceSupport ? false
@@ -28,7 +26,8 @@
 , sanitizeAddress ? false
 , sanitizeThreads ? false
 , with3d ? true
-, withI18n ? true
+, withI18n ? false
+, withPCM ? true # Plugin and Content Manager
 , srcs ? { }
 }:
 
@@ -71,8 +70,6 @@
 assert withNgspice -> libngspice != null;
 assert lib.assertMsg (!ngspiceSupport)
   "`nspiceSupport` was renamed to `withNgspice` for the sake of consistency with other kicad nix arguments.";
-assert lib.assertMsg (!oceSupport)
-  "`oceSupport` was renamed to `withOCE` for the sake of consistency with other kicad nix arguments.";
 assert lib.assertMsg (!scriptingSupport)
   "`scriptingSupport` was renamed to `withScripting` for the sake of consistency with other kicad nix arguments.";
 assert lib.assertMsg (!withOCCT)
@@ -132,25 +129,9 @@ let
     if srcOverridep "libVersion" then srcs.libVersion
     else versionsImport.${baseName}.libVersion.version;
 
-  wxGTK =
-    if (stable)
-    # wxGTK3x may default to withGtk2 = false, see #73145
-    then
-      wxGTK30.override
-        {
-          withGtk2 = false;
-        }
-    # wxGTK31 currently introduces an issue with opening the python interpreter in pcbnew
-    # but brings high DPI support?
-    else
-      wxGTK31.override {
-        withGtk2 = false;
-      };
-
+  wxGTK = wxGTK31-gtk3;
   python = python3;
-  wxPython = if (stable)
-    then python.pkgs.wxPython_4_0
-    else python.pkgs.wxPython_4_1;
+  wxPython = python.pkgs.wxPython_4_1;
 
   inherit (lib) concatStringsSep flatten optionalString optionals;
 in
@@ -164,7 +145,7 @@ stdenv.mkDerivation rec {
     inherit kicadSrc kicadVersion;
     inherit (passthru) i18n;
     inherit wxGTK python wxPython;
-    inherit withI18n withOCC withOCE withNgspice withScripting;
+    inherit withOCC withNgspice withScripting withI18n withPCM;
     inherit debug sanitizeAddress sanitizeThreads;
   };
 
@@ -197,27 +178,14 @@ stdenv.mkDerivation rec {
     "--prefix GIO_EXTRA_MODULES : ${dconf}/lib/gio/modules"
     # required to open a bug report link in firefox-wayland
     "--set-default MOZ_DBUS_REMOTE 1"
-  ]
-  ++ optionals (stable)
-  [
-    "--set-default KISYSMOD ${footprints}/share/kicad/modules"
-    "--set-default KICAD_SYMBOL_DIR ${symbols}/share/kicad/library"
-    "--set-default KICAD_TEMPLATE_DIR ${templates}/share/kicad/template"
-    "--prefix KICAD_TEMPLATE_DIR : ${symbols}/share/kicad/template"
-    "--prefix KICAD_TEMPLATE_DIR : ${footprints}/share/kicad/template"
-  ]
-  ++ optionals (stable && with3d) [ "--set-default KISYS3DMOD ${packages3d}/share/kicad/modules/packages3d" ]
-  ++ optionals (!stable)
-  [
     "--set-default KICAD6_FOOTPRINT_DIR ${footprints}/share/kicad/footprints"
     "--set-default KICAD6_SYMBOL_DIR ${symbols}/share/kicad/symbols"
     "--set-default KICAD6_TEMPLATE_DIR ${templates}/share/kicad/template"
     "--prefix KICAD6_TEMPLATE_DIR : ${symbols}/share/kicad/template"
     "--prefix KICAD6_TEMPLATE_DIR : ${footprints}/share/kicad/template"
   ]
-  ++ optionals (!stable && with3d)
+  ++ optionals (with3d)
   [
-    "--set-default KISYS3DMOD ${packages3d}/share/kicad/3dmodels"
     "--set-default KICAD6_3DMODEL_DIR ${packages3d}/share/kicad/3dmodels"
   ]
   ++ optionals (withNgspice) [ "--prefix LD_LIBRARY_PATH : ${libngspice}/lib" ]
@@ -259,9 +227,6 @@ stdenv.mkDerivation rec {
     ln -s ${base}/share/applications $out/share/applications
     ln -s ${base}/share/icons $out/share/icons
     ln -s ${base}/share/mime $out/share/mime
-  '' + optionalString (stable) ''
-    ln -s ${base}/share/appdata $out/share/appdata
-  '' + optionalString (!stable) ''
     ln -s ${base}/share/metainfo $out/share/metainfo
   '';
 
diff --git a/pkgs/applications/science/electronics/kicad/versions.nix b/pkgs/applications/science/electronics/kicad/versions.nix
index 50a75cdfd094..2b9b98f4b0ed 100644
--- a/pkgs/applications/science/electronics/kicad/versions.nix
+++ b/pkgs/applications/science/electronics/kicad/versions.nix
@@ -3,25 +3,25 @@
 {
   "kicad" = {
     kicadVersion = {
-      version =			"5.1.12";
+      version =			"6.0.0";
       src = {
-        rev =			"84ad8e8a86f13c0697f5cbed8c17977b6545ddc9";
-        sha256 =		"0kgikchqxds3mp71nkg307mr4c1dgv8akbmksz4w9x8jg4i1mfqq";
+        rev =			"d3dd2cf0fa975548d027db88d19b8a88866866d8";
+        sha256 =		"1jrfwyi4zs0rpcpsj01z6687a433nnr56cxbnz12jfg2yafpxk23";
       };
     };
     libVersion = {
-      version =			"5.1.12";
+      version =			"6.0.0";
       libSources = {
         i18n.rev =		"0ad3d7e469e31c8868ad83f90e22a9c18f16aa1f";
         i18n.sha256 =		"0y51l0r62cnxkvpc21732p3cx7pjvaqjih8193502hlv9kv1j9p6";
-        symbols.rev =		"97c0bfdd2f5ebe952bc90c60f080a8e41da60615";
-        symbols.sha256 =	"1zdajim409570xzis53kmrbdcf7000v2vmc90f49h214lrx2zhr2";
-        templates.rev =		"eca0f632eb76c8f49de4d5a590c83543090d0b7d";
-        templates.sha256 =	"1fbhn1l3j2rwc29aida9b408wif55i23bp9ddcs7dvf83smjm05g";
-        footprints.rev =	"b65732f8ebd7ab894fd638f3f2bf4a4e9b24f653";
-        footprints.sha256 =	"0qpii55dgv2gxqg1qq0dngdnbb9din790qi5qv0l6qqrzx843h5s";
-        packages3d.rev =	"0ddd588650fede09766b704feb15d30bcb6e144f";
-        packages3d.sha256 =	"12w7m5nbk9kcnlnlg4sk1sd7xgb9i2kxfi0jcbd0phs89qyl7wjr";
+        symbols.rev =		"275f22eb9eecd5b6deabdefd82c9a826254d9f23";
+        symbols.sha256 =	"0wjk464l60xknvgc9d870901lqnx296dw7amlh3wg0wf78izarfr";
+        templates.rev =		"3a422b5b0928f3fd31579769d4dee2b009a85a11";
+        templates.sha256 =	"0vbjy1v5923942ma0rqcp1dhylhxk1m4vyfxjxw13sizkrpmlwr1";
+        footprints.rev =	"3ea7895b0817abecaa34276346749a711b0c69f6";
+        footprints.sha256 =	"0jv2plwzhhkfx7a2zankkjkbfzjxv43ab8rqpxzqfq2fnx83q6r5";
+        packages3d.rev =	"e607286d4a48ddf654585b37b45d74416a9a70c7";
+        packages3d.sha256 =	"0vwcbzq42hzjl4f0zjaswmiff1x59hv64g5n00mx1gl0gwngnyla";
       };
     };
   };

From 818894d6a5bbe548db0d681945c430142511377b Mon Sep 17 00:00:00 2001
From: Evils <evils.devils@protonmail.com>
Date: Sat, 25 Dec 2021 20:12:51 +0100
Subject: [PATCH 30/63] kicad-unstable: 6.0.0-rc1 -> 2021-12-23

---
 .../science/electronics/kicad/versions.nix       | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/applications/science/electronics/kicad/versions.nix b/pkgs/applications/science/electronics/kicad/versions.nix
index 2b9b98f4b0ed..c15c989bac3f 100644
--- a/pkgs/applications/science/electronics/kicad/versions.nix
+++ b/pkgs/applications/science/electronics/kicad/versions.nix
@@ -27,23 +27,23 @@
   };
   "kicad-unstable" = {
     kicadVersion = {
-      version =			"6.0.0-rc1";
+      version =			"2021-12-23";
       src = {
-        rev =			"9fb05440b3ef3073613ecdeba6112aeb6b26c4df";
-        sha256 =		"1j0hd6bpmd80dyvy9mz4n4rr8f849bdwdd4vs8vfbsswf0gxj734";
+        rev =			"21eb92821866d558acd9e737b643b300a8b18202";
+        sha256 =		"01hg0byp60xzgz0xxfwvyq1hbvbllsys6lx9yfj27d3qjc3bdk42";
       };
     };
     libVersion = {
-      version =			"6.0.0-rc1";
+      version =			"2021-12-25";
       libSources = {
         i18n.rev =		"e89d9a89bec59199c1ade56ee2556591412ab7b0";
         i18n.sha256 =		"04zaqyhj3qr4ymyd3k5vjpcna64j8klpsygcgjcv29s3rdi8glfl";
-        symbols.rev =		"27b627393a7f2733e965ed82a5533a757789cbb2";
-        symbols.sha256 =	"0p1qay6h6ibkhcz1b8xszsihi432ddi8jgnan2xr5rl4539c4ydp";
+        symbols.rev =		"125a2e736504e776e4c6fb7f5131efad75edf245";
+        symbols.sha256 =	"0wjk464l60xknvgc9d870901lqnx296dw7amlh3wg0wf78izarfr";
         templates.rev =		"8c9ff3dadb9c75cf2932f11c09a46c0c9d84784b";
         templates.sha256 =	"0vbjy1v5923942ma0rqcp1dhylhxk1m4vyfxjxw13sizkrpmlwr1";
-        footprints.rev =	"4ce2242095912e491f1690210d9cb2328363b268";
-        footprints.sha256 =	"1zx13rrpiamxyv7y27mr5xsdz0d09hpwfgc2j496p3q41q2crlq0";
+        footprints.rev =	"ac8de318d8ef7b3eb64c78c6c2650b7b085f3271";
+        footprints.sha256 =	"0jv2plwzhhkfx7a2zankkjkbfzjxv43ab8rqpxzqfq2fnx83q6r5";
         packages3d.rev =	"1080b6e565e56bae9be46db2278a1542092d7a2d";
         packages3d.sha256 =	"0vwcbzq42hzjl4f0zjaswmiff1x59hv64g5n00mx1gl0gwngnyla";
       };

From b3f0da107ea4ed4951afe3fe6ae2b18c2b5d7ec0 Mon Sep 17 00:00:00 2001
From: Evils <evils.devils@protonmail.com>
Date: Thu, 23 Dec 2021 14:25:32 +0100
Subject: [PATCH 31/63] kicad: remove the separate i18n stuff

i18n is now in the kicad source in both stable and unstable
  behind the withI18n flag which is disabled by default
---
 .../science/electronics/kicad/base.nix        |  9 +----
 .../science/electronics/kicad/default.nix     | 35 +++++--------------
 .../science/electronics/kicad/i18n.nix        | 18 ----------
 .../science/electronics/kicad/update.sh       | 20 +----------
 .../science/electronics/kicad/versions.nix    |  4 ---
 5 files changed, 11 insertions(+), 75 deletions(-)
 delete mode 100644 pkgs/applications/science/electronics/kicad/i18n.nix

diff --git a/pkgs/applications/science/electronics/kicad/base.nix b/pkgs/applications/science/electronics/kicad/base.nix
index 7cc5a151d74e..78420bf1fae7 100644
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@@ -43,7 +43,6 @@
 , baseName
 , kicadSrc
 , kicadVersion
-, i18n
 , withOCC
 , withNgspice
 , withScripting
@@ -161,16 +160,10 @@ stdenv.mkDerivation rec {
 
   dontStrip = debug;
 
-  postInstall = optionalString (withI18n) ''
-    mkdir -p $out/share
-    lndir ${i18n}/share $out/share
-  '';
-
   meta = {
     description = "Just the built source without the libraries";
     longDescription = ''
-      Just the build products, optionally with the i18n linked in
-      the libraries are passed via an env var in the wrapper, default.nix
+      Just the build products, the libraries are passed via an env var in the wrapper, default.nix
     '';
     homepage = "https://www.kicad.org/";
     license = lib.licenses.agpl3;
diff --git a/pkgs/applications/science/electronics/kicad/default.nix b/pkgs/applications/science/electronics/kicad/default.nix
index 4c6ce3f9b73e..bdcac55f9c58 100644
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@@ -32,23 +32,21 @@
 }:
 
 # The `srcs` parameter can be used to override the kicad source code
-# and all libraries (including i18n), which are otherwise inaccessible
+# and all libraries, which are otherwise inaccessible
 # to overlays since most of the kicad build expression has been
 # refactored into base.nix, most of the library build expressions have
-# been refactored into libraries.nix, and most the i18n build
-# expression has been refactored into i18n.nix. Overrides are only
-# applied when building `kicad-unstable`. The `srcs` parameter has no
-# effect for stable `kicad`. `srcs` takes an attribute set in which
+# been refactored into libraries.nix. Overrides are only applied when
+# building `kicad-unstable`. The `srcs` parameter has
+# no effect for stable `kicad`. `srcs` takes an attribute set in which
 # any of the following attributes are meaningful (though none are
-# mandatory): "kicad", "kicadVersion", "i18n", "symbols", "templates",
+# mandatory): "kicad", "kicadVersion", "symbols", "templates",
 # "footprints", "packages3d", and "libVersion". "kicadVersion" and
 # "libVersion" should be set to a string with the desired value for
 # the version attribute in kicad's `mkDerivation` and the version
-# attribute in any of the library's or i18n's `mkDerivation`,
-# respectively. "kicad", "i18n", "symbols", "templates", "footprints",
-# and "packages3d" should be set to an appropriate fetcher (e.g.,
-# `fetchFromGitLab`). So, for example, a possible overlay for kicad
-# is:
+# attribute in any of the library's `mkDerivation`, respectively.
+# "kicad", "symbols", "templates", "footprints", and "packages3d"
+# should be set to an appropriate fetcher (e.g. `fetchFromGitLab`).
+# So, for example, a possible overlay for kicad is:
 #
 # final: prev:
 
@@ -88,14 +86,6 @@ let
     sha256 = versionsImport.${baseName}.kicadVersion.src.sha256;
   };
 
-  i18nSrcFetch = fetchFromGitLab {
-    group = "kicad";
-    owner = "code";
-    repo = "kicad-i18n";
-    rev = versionsImport.${baseName}.libVersion.libSources.i18n.rev;
-    sha256 = versionsImport.${baseName}.libVersion.libSources.i18n.sha256;
-  };
-
   libSrcFetch = name: fetchFromGitLab {
     group = "kicad";
     owner = "libraries";
@@ -118,11 +108,6 @@ let
     if srcOverridep "kicadVersion" then srcs.kicadVersion
     else versionsImport.${baseName}.kicadVersion.version;
 
-  i18nSrc = if srcOverridep "i18n" then srcs.i18n else i18nSrcFetch;
-  i18nVersion =
-    if srcOverridep "i18nVersion" then srcs.i18nVersion
-    else versionsImport.${baseName}.libVersion.version;
-
   libSrc = name: if srcOverridep name then srcs.${name} else libSrcFetch name;
   # TODO does it make sense to only have one version for all libs?
   libVersion =
@@ -139,11 +124,9 @@ stdenv.mkDerivation rec {
 
   # Common libraries, referenced during runtime, via the wrapper.
   passthru.libraries = callPackages ./libraries.nix { inherit libSrc; };
-  passthru.i18n = callPackage ./i18n.nix { src = i18nSrc; };
   base = callPackage ./base.nix {
     inherit stable baseName;
     inherit kicadSrc kicadVersion;
-    inherit (passthru) i18n;
     inherit wxGTK python wxPython;
     inherit withOCC withNgspice withScripting withI18n withPCM;
     inherit debug sanitizeAddress sanitizeThreads;
diff --git a/pkgs/applications/science/electronics/kicad/i18n.nix b/pkgs/applications/science/electronics/kicad/i18n.nix
deleted file mode 100644
index c9a70a0060d5..000000000000
--- a/pkgs/applications/science/electronics/kicad/i18n.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, stdenv
-, cmake
-, gettext
-, src
-}:
-
-stdenv.mkDerivation {
-  inherit src;
-
-  pname = "kicad-i18n";
-  version = builtins.substring 0 10 src.rev;
-
-  nativeBuildInputs = [ cmake gettext ];
-  meta = with lib; {
-    license = licenses.gpl2; # https://github.com/KiCad/kicad-i18n/issues/3
-    platforms = platforms.all;
-  };
-}
diff --git a/pkgs/applications/science/electronics/kicad/update.sh b/pkgs/applications/science/electronics/kicad/update.sh
index defddc036f40..0300a11c7857 100755
--- a/pkgs/applications/science/electronics/kicad/update.sh
+++ b/pkgs/applications/science/electronics/kicad/update.sh
@@ -66,10 +66,6 @@ gitlab="https://gitlab.com/kicad"
 # append commit hash or tag
 gitlab_pre="https://gitlab.com/api/v4/projects/kicad%2Fcode%2Fkicad/repository/archive.tar.gz?sha="
 
-# not a lib, but separate and already moved to gitlab
-i18n="${gitlab}/code/kicad-i18n.git"
-i18n_pre="https://gitlab.com/api/v4/projects/kicad%2Fcode%2Fkicad-i18n/repository/archive.tar.gz?sha="
-
 count=0
 
 printf "Latest tag is\t%s\n" "${latest_tag}" >&2
@@ -127,20 +123,6 @@ for version in "${all_versions[@]}"; do
         printf "%6sversion =\t\t\t\"%s\";\n" "" "${today}"
         printf "%6slibSources = {\n" ""
 
-        echo "Checking i18n" >&2
-        i18n_rev="$(${get_rev} "${i18n}" "${version}" | cut -f1)"
-        has_rev="$(grep -sm 1 "\"${pname}\"" -A 11 "${file}" | grep -sm 1 "${i18n_rev}" || true)"
-        has_hash="$(grep -sm 1 "\"${pname}\"" -A 12 "${file}" | grep -sm 1 "i18n.sha256" || true)"
-        if [[ -n ${has_rev} && -n ${has_hash} && -z ${clean} ]]; then
-          echo "Reusing old kicad-i18n-${today}.src.sha256, already latest .rev" >&2
-          grep -sm 1 "\"${pname}\"" -A 12 "${file}" | grep -sm 1 "i18n" -A 1
-        else
-          printf "%8si18n.rev =\t\t\"%s\";\n" "" "${i18n_rev}"
-          printf "%8si18n.sha256 =\t\t\"%s\";\n" "" \
-            "$(${prefetch} "${i18n_pre}${i18n_rev}")"
-          count=$((count+1))
-        fi
-
           for lib in "${libs[@]}"; do
             echo "Checking ${lib}" >&2
             url="${gitlab}/libraries/kicad-${lib}.git"
@@ -166,7 +148,7 @@ for version in "${all_versions[@]}"; do
     printf "%2s};\n" ""
   else
     printf "\nReusing old %s\n" "${pname}" >&2
-    grep -sm 1 "\"${pname}\"" -A 23 "${file}"
+    grep -sm 1 "\"${pname}\"" -A 21 "${file}"
   fi
 done
 printf "}\n"
diff --git a/pkgs/applications/science/electronics/kicad/versions.nix b/pkgs/applications/science/electronics/kicad/versions.nix
index c15c989bac3f..5fed12b0027b 100644
--- a/pkgs/applications/science/electronics/kicad/versions.nix
+++ b/pkgs/applications/science/electronics/kicad/versions.nix
@@ -12,8 +12,6 @@
     libVersion = {
       version =			"6.0.0";
       libSources = {
-        i18n.rev =		"0ad3d7e469e31c8868ad83f90e22a9c18f16aa1f";
-        i18n.sha256 =		"0y51l0r62cnxkvpc21732p3cx7pjvaqjih8193502hlv9kv1j9p6";
         symbols.rev =		"275f22eb9eecd5b6deabdefd82c9a826254d9f23";
         symbols.sha256 =	"0wjk464l60xknvgc9d870901lqnx296dw7amlh3wg0wf78izarfr";
         templates.rev =		"3a422b5b0928f3fd31579769d4dee2b009a85a11";
@@ -36,8 +34,6 @@
     libVersion = {
       version =			"2021-12-25";
       libSources = {
-        i18n.rev =		"e89d9a89bec59199c1ade56ee2556591412ab7b0";
-        i18n.sha256 =		"04zaqyhj3qr4ymyd3k5vjpcna64j8klpsygcgjcv29s3rdi8glfl";
         symbols.rev =		"125a2e736504e776e4c6fb7f5131efad75edf245";
         symbols.sha256 =	"0wjk464l60xknvgc9d870901lqnx296dw7amlh3wg0wf78izarfr";
         templates.rev =		"8c9ff3dadb9c75cf2932f11c09a46c0c9d84784b";

From f7da08bb193e9d0ae9e12319ba2941fa61f5d9c8 Mon Sep 17 00:00:00 2001
From: Evils <evils.devils@protonmail.com>
Date: Sat, 25 Dec 2021 16:52:54 +0100
Subject: [PATCH 32/63] kicad.updateScript: full shellcheck

---
 .../science/electronics/kicad/update.sh       | 42 ++++++++++++-------
 1 file changed, 28 insertions(+), 14 deletions(-)

diff --git a/pkgs/applications/science/electronics/kicad/update.sh b/pkgs/applications/science/electronics/kicad/update.sh
index 0300a11c7857..48270e962f53 100755
--- a/pkgs/applications/science/electronics/kicad/update.sh
+++ b/pkgs/applications/science/electronics/kicad/update.sh
@@ -1,7 +1,9 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p coreutils git nix curl
+# shellcheck shell=bash enable=all
 
 set -e
+shopt -s inherit_errexit
 
 # this script will generate versions.nix in the right location
 # this should contain the versions' revs and hashes
@@ -25,10 +27,12 @@ export TMPDIR=/tmp
 # remove items left in /nix/store?
 
 # get the latest tag that isn't an RC or *.99
-latest_tag="$(git ls-remote --tags --sort -version:refname \
-  https://gitlab.com/kicad/code/kicad.git \
-  | grep -o 'refs/tags/[0-9]*\.[0-9]*\.[0-9]*$' \
-  | grep -v "\.99" | grep -v "\.9\.9" | head -n 1 | cut -d '/' -f 3)"
+latest_tags="$(git ls-remote --tags --sort -version:refname https://gitlab.com/kicad/code/kicad.git)"
+# using a scratch variable to ensure command failures get caught (SC2312)
+scratch="$(grep -o 'refs/tags/[0-9]*\.[0-9]*\.[0-9]*$' <<< "${latest_tags}")"
+scratch="$(grep -ve '\.99' -e '\.9\.9' <<< "${scratch}")"
+scratch="$(head -n 1 <<< "${scratch}")"
+latest_tag="$(cut -d '/' -f 3 <<< "${scratch}")"
 
 all_versions=( "${latest_tag}" master )
 
@@ -60,11 +64,15 @@ tmp="${here}/,versions.nix.${RANDOM}"
 
 libs=( symbols templates footprints packages3d )
 
-get_rev="git ls-remote --heads --tags"
+get_rev() {
+  git ls-remote --heads --tags "$@"
+}
 
 gitlab="https://gitlab.com/kicad"
 # append commit hash or tag
-gitlab_pre="https://gitlab.com/api/v4/projects/kicad%2Fcode%2Fkicad/repository/archive.tar.gz?sha="
+src_pre="https://gitlab.com/api/v4/projects/kicad%2Fcode%2Fkicad/repository/archive.tar.gz?sha="
+lib_pre="https://gitlab.com/api/v4/projects/kicad%2Flibraries%2Fkicad-"
+lib_mid="/repository/archive.tar.gz?sha="
 
 count=0
 
@@ -104,16 +112,19 @@ for version in "${all_versions[@]}"; do
         printf "%6ssrc = {\n" ""
 
     echo "Checking src" >&2
-    src_rev="$(${get_rev} "${gitlab}"/code/kicad.git "${version}" | cut -f1)"
+    scratch="$(get_rev "${gitlab}"/code/kicad.git "${version}")"
+    src_rev="$(cut -f1 <<< "${scratch}")"
     has_rev="$(grep -sm 1 "\"${pname}\"" -A 4 "${file}" | grep -sm 1 "${src_rev}" || true)"
     has_hash="$(grep -sm 1 "\"${pname}\"" -A 5 "${file}" | grep -sm 1 "sha256" || true)"
+
     if [[ -n ${has_rev} && -n ${has_hash} && -z ${clean} ]]; then
       echo "Reusing old ${pname}.src.sha256, already latest .rev" >&2
-      grep -sm 1 "\"${pname}\"" -A 5 "${file}" | grep -sm 1 "rev" -A 1
+      scratch=$(grep -sm 1 "\"${pname}\"" -A 5 "${file}")
+      grep -sm 1 "rev" -A 1 <<< "${scratch}"
     else
+          prefetched="$(${prefetch} "${src_pre}${src_rev}")"
           printf "%8srev =\t\t\t\"%s\";\n" "" "${src_rev}"
-          printf "%8ssha256 =\t\t\"%s\";\n" \
-            "" "$(${prefetch} "${gitlab_pre}${src_rev}")"
+          printf "%8ssha256 =\t\t\"%s\";\n" "" "${prefetched}"
           count=$((count+1))
     fi
         printf "%6s};\n" ""
@@ -126,20 +137,23 @@ for version in "${all_versions[@]}"; do
           for lib in "${libs[@]}"; do
             echo "Checking ${lib}" >&2
             url="${gitlab}/libraries/kicad-${lib}.git"
-            lib_rev="$(${get_rev} "${url}" "${version}" | cut -f1 | tail -n1)"
+            scratch="$(get_rev "${url}" "${version}")"
+            scratch="$(cut -f1 <<< "${scratch}")"
+            lib_rev="$(tail -n1 <<< "${scratch}")"
             has_rev="$(grep -sm 1 "\"${pname}\"" -A 19 "${file}" | grep -sm 1 "${lib_rev}" || true)"
             has_hash="$(grep -sm 1 "\"${pname}\"" -A 20 "${file}" | grep -sm 1 "${lib}.sha256" || true)"
             if [[ -n ${has_rev} && -n ${has_hash} && -z ${clean} ]]; then
               echo "Reusing old kicad-${lib}-${today}.src.sha256, already latest .rev" >&2
-              grep -sm 1 "\"${pname}\"" -A 20 "${file}" | grep -sm 1 "${lib}" -A 1
+              scratch="$(grep -sm 1 "\"${pname}\"" -A 20 "${file}")"
+              grep -sm 1 "${lib}" -A 1 <<< "${scratch}"
             else
+              prefetched="$(${prefetch} "${lib_pre}${lib}${lib_mid}${lib_rev}")"
               printf "%8s%s.rev =\t" "" "${lib}"
               case "${lib}" in
                 symbols|templates) printf "\t" ;; *) ;;
               esac
               printf "\"%s\";\n" "${lib_rev}"
-              printf "%8s%s.sha256 =\t\"%s\";\n" "" \
-                "${lib}" "$(${prefetch} "https://gitlab.com/api/v4/projects/kicad%2Flibraries%2Fkicad-${lib}/repository/archive.tar.gz?sha=${lib_rev}")"
+              printf "%8s%s.sha256 =\t\"%s\";\n" "" "${lib}" "${prefetched}"
               count=$((count+1))
             fi
           done

From e54357a7d28ba3a69b0e13d5164815281bce0cc9 Mon Sep 17 00:00:00 2001
From: Evils <evils.devils@protonmail.com>
Date: Sun, 26 Dec 2021 00:55:34 +0100
Subject: [PATCH 33/63] kicad: KICAD_SPICE build option defaults to ON

and has apparently done so since it was added...
---
 pkgs/applications/science/electronics/kicad/base.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/science/electronics/kicad/base.nix b/pkgs/applications/science/electronics/kicad/base.nix
index 78420bf1fae7..fdda40341eb1 100644
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
   ++ optionals (!withScripting) [
     "-DKICAD_SCRIPTING_WXPYTHON=OFF"
   ]
-  ++ optional (withNgspice) "-DKICAD_SPICE=ON"
+  ++ optional (!withNgspice) "-DKICAD_SPICE=OFF"
   ++ optional (!withOCC) "-DKICAD_USE_OCC=OFF"
   ++ optionals (withOCC) [
     "-DKICAD_USE_OCC=ON"

From 83e6fe5557aa296f1d40c06458a28a2d7c99dbc1 Mon Sep 17 00:00:00 2001
From: Evils <evils.devils@protonmail.com>
Date: Sun, 26 Dec 2021 01:23:07 +0100
Subject: [PATCH 34/63] kicad: remove unused options

the asserts are in nixos-unstable by now

and use the build_qa flag to disable building unused tests
---
 pkgs/applications/science/electronics/kicad/base.nix  |  3 +++
 .../science/electronics/kicad/default.nix             | 11 -----------
 2 files changed, 3 insertions(+), 11 deletions(-)

diff --git a/pkgs/applications/science/electronics/kicad/base.nix b/pkgs/applications/science/electronics/kicad/base.nix
index fdda40341eb1..b54bbb714a58 100644
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@@ -93,6 +93,9 @@ stdenv.mkDerivation rec {
     "-DKICAD_STDLIB_DEBUG=ON"
     "-DKICAD_USE_VALGRIND=ON"
   ]
+  ++ optionals (!doInstallCheck) [
+    "-DKICAD_BUILD_QA_TESTS=OFF"
+  ]
   ++ optionals (sanitizeAddress) [
     "-DKICAD_SANITIZE_ADDRESS=ON"
   ]
diff --git a/pkgs/applications/science/electronics/kicad/default.nix b/pkgs/applications/science/electronics/kicad/default.nix
index bdcac55f9c58..44a538370dae 100644
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@@ -13,13 +13,9 @@
 
 , pname ? "kicad"
 , stable ? true
-, oceSupport ? false
-, withOCCT ? false
 , withOCC ? true
-, ngspiceSupport ? false
 , withNgspice ? true
 , libngspice
-, scriptingSupport ? false
 , withScripting ? true
 , python3
 , debug ? false
@@ -65,13 +61,6 @@
 #   });
 # }
 
-assert withNgspice -> libngspice != null;
-assert lib.assertMsg (!ngspiceSupport)
-  "`nspiceSupport` was renamed to `withNgspice` for the sake of consistency with other kicad nix arguments.";
-assert lib.assertMsg (!scriptingSupport)
-  "`scriptingSupport` was renamed to `withScripting` for the sake of consistency with other kicad nix arguments.";
-assert lib.assertMsg (!withOCCT)
-  "`withOCCT` was renamed to `withOCC` for the sake of consistency with upstream cmake options.";
 let
   baseName = if (stable) then "kicad" else "kicad-unstable";
   versionsImport = import ./versions.nix;

From 46cd06eb9d2763c0b7adaa362e2d03a945b2645f Mon Sep 17 00:00:00 2001
From: Lucas Savva <lucas@m1cr0man.com>
Date: Sun, 26 Dec 2021 21:12:33 +0000
Subject: [PATCH 35/63] nixos/acme: Add test for caddy

This test is technically broken since reloading caddy
does not seem to load new certs. This needs to be fixed
in caddy.
---
 nixos/tests/acme.nix | 81 ++++++++++++++++++++++++++++++++++++--------
 1 file changed, 66 insertions(+), 15 deletions(-)

diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix
index 4af2303ce832..0dd7743c52b6 100644
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@@ -234,27 +234,60 @@ in {
 
         # Test lego internal server (listenHTTP option)
         # Also tests useRoot option
-        lego-server.configuration = { ... }: lib.mkMerge [
-          webserverBasicConfig
+        lego-server.configuration = { ... }: {
+          security.acme.useRoot = true;
+          security.acme.certs."lego.example.test" = {
+            listenHTTP = ":80";
+            group = "nginx";
+          };
+          services.nginx.enable = true;
+          services.nginx.virtualHosts."lego.example.test" = {
+            useACMEHost = "lego.example.test";
+            onlySSL = true;
+          };
+        };
+
+      # Test compatiblity with Caddy
+      # It only supports useACMEHost, hence not using mkServerConfigs
+      } // (let
+        baseCaddyConfig = { nodes, config, ... }: {
+          security.acme = {
+            defaults = (dnsConfig nodes) // {
+              group = config.services.caddy.group;
+            };
+            # One manual wildcard cert
+            certs."example.test" = {
+              domain = "*.example.test";
+            };
+          };
+
+          services.caddy = {
+            enable = true;
+            virtualHosts."a.exmaple.test" = {
+              useACMEHost = "example.test";
+              extraConfig = ''
+                root * ${documentRoot}
+              '';
+            };
+          };
+        };
+      in {
+        caddy.configuration = baseCaddyConfig;
+
+        # Test that the server reloads when only the acme configuration is changed.
+        "caddy-change-acme-conf".configuration = { nodes, config, ... }: lib.mkMerge [
+          (baseCaddyConfig {
+            inherit nodes config;
+          })
           {
-            security.acme.useRoot = true;
-            security.acme.certs."lego.example.test" = {
-              listenHTTP = ":80";
-              group = "nginx";
-            };
-            services.nginx.virtualHosts."a.example.test" = {
-              onlySSL = true;
-              forceSSL = lib.mkForce false;
-            };
-            services.nginx.virtualHosts."lego.example.test" = {
-              useACMEHost = "lego.example.test";
-              onlySSL = true;
+            security.acme.certs."example.test" = {
+              keyType = "ec384";
             };
           }
         ];
 
       # Test compatibility with Nginx
-      } // (mkServerConfigs {
+      }) // (mkServerConfigs {
           server = "nginx";
           group = "nginx";
           vhostBaseData = vhostBase;
@@ -480,6 +513,24 @@ in {
           webserver.wait_for_unit("nginx.service")
           check_connection(client, "slow.example.test")
 
+      with subtest("Works with caddy"):
+          switch_to(webserver, "caddy")
+          webserver.wait_for_unit("acme-finished-example.test.target")
+          webserver.wait_for_unit("caddy.service")
+          # FIXME reloading caddy is not sufficient to load new certs.
+          # Restart it manually until this is fixed.
+          webserver.succeed("systemctl restart caddy.service")
+          check_connection(client, "a.example.test")
+
+      with subtest("security.acme changes reflect on caddy"):
+          switch_to(webserver, "caddy-change-acme-conf")
+          webserver.wait_for_unit("acme-finished-example.test.target")
+          webserver.wait_for_unit("caddy.service")
+          # FIXME reloading caddy is not sufficient to load new certs.
+          # Restart it manually until this is fixed.
+          webserver.succeed("systemctl restart caddy.service")
+          check_connection_key_bits(client, "a.example.test", "384")
+
       domains = ["http", "dns", "wildcard"]
       for server, logsrc in [
           ("nginx", "journalctl -n 30 -u nginx.service"),

From ffb546a115479035e1a430ffc6afe6582642fded Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 26 Dec 2021 23:45:42 +0100
Subject: [PATCH 36/63] python3Packages.yamlfix: 0.7.2 -> 0.8.0

---
 .../python-modules/yamlfix/default.nix        | 39 ++++++++++++++-----
 1 file changed, 29 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/yamlfix/default.nix b/pkgs/development/python-modules/yamlfix/default.nix
index 228ebcc295b0..f0203d58dffb 100644
--- a/pkgs/development/python-modules/yamlfix/default.nix
+++ b/pkgs/development/python-modules/yamlfix/default.nix
@@ -1,34 +1,53 @@
-{ lib, buildPythonPackage, fetchFromGitHub, pytestCheckHook, pytest-xdist
-, pythonOlder, click, ruyaml }:
+{ lib
+, buildPythonPackage
+, click
+, fetchFromGitHub
+, pytest-xdist
+, pytestCheckHook
+, pythonOlder
+, ruyaml
+}:
 
 buildPythonPackage rec {
   pname = "yamlfix";
-  version = "0.7.2";
+  version = "0.8.0";
+  format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "lyz-code";
     repo = pname;
     rev = version;
-    sha256 = "sha256-qlA6TyLkOuTXCdMnpfkyN/HDIRfB6+0pQ7f0GCsIjL4=";
+    sha256 = "sha256-Gkq80YMeiPy7xxLauA/nloW4znMV2tfE+e24HyZgUaQ=";
   };
 
-  propagatedBuildInputs = [ click ruyaml ];
+  propagatedBuildInputs = [
+    click
+    ruyaml
+  ];
 
-  checkInputs = [ pytestCheckHook pytest-xdist ];
+  checkInputs = [
+    pytest-xdist
+    pytestCheckHook
+  ];
 
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace 'python_paths = "."' ""
   '';
 
-  pytestFlagsArray = [ "-n" "$NIX_BUILD_CORES" ];
+  pytestFlagsArray = [
+    "-n"
+    "$NIX_BUILD_CORES"
+  ];
 
-  pythonImportsCheck = [ "yamlfix" ];
+  pythonImportsCheck = [
+    "yamlfix"
+  ];
 
   meta = with lib; {
-    description =
-      "A simple opinionated yaml formatter that keeps your comments!";
+    description = "Python YAML formatter that keeps your comments";
     homepage = "https://github.com/lyz-code/yamlfix";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ koozz ];

From cf5a79f89ca3f064e0b9338c46780d370b16a511 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 26 Dec 2021 23:42:23 +0000
Subject: [PATCH 37/63] python3Packages.caldav: 0.8.0 -> 0.8.2

---
 .../python-modules/caldav/default.nix         | 20 ++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/caldav/default.nix b/pkgs/development/python-modules/caldav/default.nix
index 2b50b5f2966a..27b59cfc07e1 100644
--- a/pkgs/development/python-modules/caldav/default.nix
+++ b/pkgs/development/python-modules/caldav/default.nix
@@ -4,7 +4,6 @@
 , pythonOlder
 , icalendar
 , lxml
-, mock
 , nose
 , pytz
 , requests
@@ -15,23 +14,27 @@
 
 buildPythonPackage rec {
   pname = "caldav";
-  version = "0.8.0";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "python-caldav";
     repo = pname;
     rev = "v${version}";
-    sha256 = "11q3svns3a2ywfci739krxbh67cx691qja772wq22606blyygyjy";
+    hash = "sha256-2mpE1aLipps4X/3EF0oKHXDcrgUh78/fxY6y1B1V2IU=";
   };
 
-  nativeBuildInputs = lib.optionals (pythonOlder "3.5") [ mock ];
-  propagatedBuildInputs = [ six requests vobject lxml ]
-    ++ lib.optionals (pythonOlder "3.6") [ pytz tzlocal ];
+  propagatedBuildInputs = [
+    vobject
+    lxml
+    requests
+    six
+  ];
 
   checkInputs = [
     icalendar
     nose
     tzlocal
+    pytz
   ];
 
   checkPhase = ''
@@ -41,7 +44,7 @@ buildPythonPackage rec {
   # xandikos and radicale is only a optional test dependency, not available for python3
   postPatch = ''
     substituteInPlace setup.py \
-      --replace ", 'xandikos'" "" \
+      --replace ", 'xandikos<0.2.4'" "" \
       --replace ", 'radicale'" ""
   '';
 
@@ -51,7 +54,6 @@ buildPythonPackage rec {
     description = "This project is a CalDAV (RFC4791) client library for Python.";
     homepage = "https://github.com/python-caldav/caldav";
     license = licenses.asl20;
-    maintainers = with maintainers; [ marenz ];
-    #broken = true; # requires radicale which is not packaged yet
+    maintainers = with maintainers; [ marenz dotlambda ];
   };
 }

From c8ae7e83350464ec218cc4a1a0f63788b14eeeaf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 26 Dec 2021 23:40:40 +0000
Subject: [PATCH 38/63] calendar-cli: 0.12.0 -> 0.13.0

https://github.com/tobixen/calendar-cli/releases/tag/v0.13.0
---
 pkgs/tools/networking/calendar-cli/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/calendar-cli/default.nix b/pkgs/tools/networking/calendar-cli/default.nix
index 497b77b57ac0..b2a7b0bd0a13 100644
--- a/pkgs/tools/networking/calendar-cli/default.nix
+++ b/pkgs/tools/networking/calendar-cli/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "calendar-cli";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "tobixen";
     repo = "calendar-cli";
     rev = "v${version}";
-    sha256 = "0qjld2m7hl3dx90491pqbjcja82c1f5gwx274kss4lkb8aw0kmlv";
+    hash = "sha256-wGigrBl5PJL+fVfnFnHDJ5zyB+Rq3Fm+q9vMvLuBBys=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [

From a06f28189a0e246729d21983af25ea981b62362e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 26 Dec 2021 23:26:36 +0000
Subject: [PATCH 39/63] radicale: 3.0.6 -> 3.1.0

https://github.com/Kozea/Radicale/blob/v3.1.0/NEWS.md
---
 pkgs/servers/radicale/3.x.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/radicale/3.x.nix b/pkgs/servers/radicale/3.x.nix
index 25f4d4b69c01..9d9fb16f4eb7 100644
--- a/pkgs/servers/radicale/3.x.nix
+++ b/pkgs/servers/radicale/3.x.nix
@@ -2,13 +2,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "radicale";
-  version = "3.0.6";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "Kozea";
     repo = "Radicale";
-    rev = version;
-    sha256 = "1xlsvrmx6jhi71j6j8z9sli5vwxasivzjyqf8zq8r0l5p7350clf";
+    rev = "v${version}";
+    hash = "sha256-LtPv+3FQMGC2YP2+1cSPZVUIzrUhteJTl58+JdvGcQg=";
   };
 
   postPatch = ''

From e36c946fb3516e95264e047386bd29b5908dae3c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 27 Dec 2021 03:16:56 +0000
Subject: [PATCH 40/63] crowdin-cli: 3.7.2 -> 3.7.4

---
 pkgs/tools/text/crowdin-cli/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/text/crowdin-cli/default.nix b/pkgs/tools/text/crowdin-cli/default.nix
index 8151d1ece950..9b2726443f40 100644
--- a/pkgs/tools/text/crowdin-cli/default.nix
+++ b/pkgs/tools/text/crowdin-cli/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "crowdin-cli";
-  version = "3.7.2";
+  version = "3.7.4";
 
   src = fetchurl {
     url = "https://github.com/crowdin/${pname}/releases/download/${version}/${pname}.zip";
-    sha256 = "sha256-7p+Di4GcztwzybJTcFXlun15NFYbJN8eGmJ0y9bify0=";
+    sha256 = "sha256-zsd95dkKzuhqtWFwc84tjZ05MnzE25UvfF459gfp+lA=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper unzip ];

From 6faa7ad3fc2fe556324c225bd704fef3a7fb2003 Mon Sep 17 00:00:00 2001
From: Robert Gerus <ar@bash.org.pl>
Date: Mon, 27 Dec 2021 04:41:20 +0100
Subject: [PATCH 41/63] nixos/kea: fixes for the systemd units

Fix a typo in the kea-dhcp-ddns-server unit definition, and add a
KEA_LOCKFILE_DIR environment variable without which kea daemons try to
access a lockfile under /var/run/kea path, which is prevented by
systemd's ProtectSystem (or one of the other Protect*) mechanism.
kea-dhcp-ddns-server doesn't react to updates from dhcp4 server at all
without it.
---
 nixos/modules/services/networking/kea.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/kea.nix b/nixos/modules/services/networking/kea.nix
index b11402204aec..4da47f575f79 100644
--- a/nixos/modules/services/networking/kea.nix
+++ b/nixos/modules/services/networking/kea.nix
@@ -236,6 +236,7 @@ in
 
       environment = {
         KEA_PIDFILE_DIR = "/run/kea";
+        KEA_LOCKFILE_DIR = "/run/kea";
       };
 
       restartTriggers = [
@@ -271,6 +272,7 @@ in
 
       environment = {
         KEA_PIDFILE_DIR = "/run/kea";
+        KEA_LOCKFILE_DIR = "/run/kea";
       };
 
       restartTriggers = [
@@ -313,6 +315,7 @@ in
 
       environment = {
         KEA_PIDFILE_DIR = "/run/kea";
+        KEA_LOCKFILE_DIR = "/run/kea";
       };
 
       restartTriggers = [
@@ -353,6 +356,7 @@ in
 
       environment = {
         KEA_PIDFILE_DIR = "/run/kea";
+        KEA_LOCKFILE_DIR = "/run/kea";
       };
 
       restartTriggers = [
@@ -361,7 +365,7 @@ in
 
       serviceConfig = {
         ExecStart = "${package}/bin/kea-dhcp-ddns -c /etc/kea/dhcp-ddns.conf ${lib.escapeShellArgs cfg.dhcp-ddns.extraArgs}";
-        AmbientCapabilites = [
+        AmbientCapabilities = [
           "CAP_NET_BIND_SERVICE"
         ];
         CapabilityBoundingSet = [

From 2753f7c8e1727d0c4068353d01f742aeccf87b59 Mon Sep 17 00:00:00 2001
From: Evils <evils.devils@protonmail.com>
Date: Mon, 27 Dec 2021 05:45:34 +0100
Subject: [PATCH 42/63] kicad: disable tests

due to an intermittent failure of the qa_pcbnew test
  https://gitlab.com/kicad/code/kicad/-/issues/9888
---
 pkgs/applications/science/electronics/kicad/base.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/science/electronics/kicad/base.nix b/pkgs/applications/science/electronics/kicad/base.nix
index b54bbb714a58..2f4fd63574b0 100644
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@@ -158,7 +158,9 @@ stdenv.mkDerivation rec {
   ;
 
   # debug builds fail all but the python test
-  doInstallCheck = !debug;
+  #doInstallCheck = !debug;
+  # temporarily disabled until upstream issue 9888 is resolved
+  doInstallCheck = false;
   installCheckTarget = "test";
 
   dontStrip = debug;

From 3fdeef8a7ee81787a099cfb57bd91f24c5ec587d Mon Sep 17 00:00:00 2001
From: Have a good time <i@niconiconi.xyz>
Date: Mon, 27 Dec 2021 17:08:27 +0800
Subject: [PATCH 43/63] emacs: Add withXinput2 argument

---
 pkgs/applications/editors/emacs/generic.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix
index bb899bf3de1c..49ecbbab4a3c 100644
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@@ -26,6 +26,7 @@
 , siteStart ? ./site-start.el
 , nativeComp ? false
 , withPgtk ? false
+, withXinput2 ? false
 , withImageMagick ? lib.versionOlder version "27" && (withX || withNS)
 , toolkit ? (
   if withGTK2 then "gtk2"
@@ -152,6 +153,7 @@ let emacs = stdenv.mkDerivation (lib.optionalAttrs nativeComp {
     ++ lib.optional nativeComp "--with-native-compilation"
     ++ lib.optional withImageMagick "--with-imagemagick"
     ++ lib.optional withPgtk "--with-pgtk"
+    ++ lib.optional withXinput2 "--with-xinput2"
   ;
 
   installTargets = [ "tags" "install" ];

From 0b55af0decfba13e484c859e57dfd102841529f0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 26 Dec 2021 12:19:46 +0000
Subject: [PATCH 44/63] openai: 0.11.4 -> 0.11.5

---
 pkgs/development/python-modules/openai/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index 61b2e9ba7509..542112126b10 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "openai";
-  version = "0.11.4";
+  version = "0.11.5";
 
   disabled = pythonOlder "3.7.1";
 
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "openai";
     repo = "openai-python";
     rev = "v${version}";
-    sha256 = "O2O4+GkyMyAxJqMNgiyPKoSXeJk0HGAst02QV6c9mJs=";
+    sha256 = "sha256-6eL3/vDWyIOVjRQo4OO3OgyUG3t8dKPtxzMMTxPCglM=";
   };
 
   propagatedBuildInputs = [

From 1d3a229018b3ec2adbc57401bce16ea32f696660 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 26 Dec 2021 11:43:04 +0000
Subject: [PATCH 45/63] python38Packages.jupyterlab: 3.2.4 -> 3.2.5

---
 pkgs/development/python-modules/jupyterlab/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/jupyterlab/default.nix b/pkgs/development/python-modules/jupyterlab/default.nix
index ab2900a2f88b..76b160eb97c3 100644
--- a/pkgs/development/python-modules/jupyterlab/default.nix
+++ b/pkgs/development/python-modules/jupyterlab/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab";
-  version = "3.2.4";
+  version = "3.2.5";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f692e0d95338d60f72dde660f16f3955a087775c59ec541ddb25952e3f97e9b1";
+    sha256 = "31b28f473b0f5826d2020583973c385526f0559b5b26efac6b8035ac1562874a";
   };
 
   nativeBuildInputs = [ jupyter-packaging ];

From e5daa25d079dae2af4d819e1259e6c98b0b5efcd Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 26 Dec 2021 22:52:50 +0100
Subject: [PATCH 46/63] python3Packages.flux-led: 0.27.13 -> 0.27.17

---
 pkgs/development/python-modules/flux-led/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/flux-led/default.nix b/pkgs/development/python-modules/flux-led/default.nix
index f3c458d8d7c3..15a2651ff5c0 100644
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "flux-led";
-  version = "0.27.13";
+  version = "0.27.17";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "flux_led";
     rev = version;
-    sha256 = "sha256-lOfEEMHuhTfti7NYeZpXc+jeYQMJd/EnvT1oHByaCbw=";
+    sha256 = "sha256-cb1QbGeOudxLOxU4aEVWYOzCrZ+xFl8F5qHVJdOhPlg=";
   };
 
   propagatedBuildInputs = [

From fdae0317e1045dcc9a82d8f6f16261203d702b7b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 27 Dec 2021 04:26:54 +0000
Subject: [PATCH 47/63] python38Packages.pycarwings2: 2.12 -> 2.13

---
 pkgs/development/python-modules/pycarwings2/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pycarwings2/default.nix b/pkgs/development/python-modules/pycarwings2/default.nix
index 164a5b3f562f..c4f23f74d614 100644
--- a/pkgs/development/python-modules/pycarwings2/default.nix
+++ b/pkgs/development/python-modules/pycarwings2/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pycarwings2";
-  version = "2.12";
+  version = "2.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.5";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
     owner = "filcole";
     repo = pname;
     # release not tagged: https://github.com/filcole/pycarwings2/issues/33
-    rev = "0dc9e7e74cb119614c72c7f955801a366f303c56";
-    sha256 = "sha256-3lyAgLuaNrCDvRT2yYkgaDiLPKW9Hbg05cQlMIBUs6o=";
+    rev = "v${version}";
+    sha256 = "04k1la7wix6sp668nqpwdhd3057b2bzcz7h2b9a57cxlifl8pjxf";
   };
 
   propagatedBuildInputs = [

From 51335e586b0e46c1d069c9d57ecd7b4fe981c960 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 26 Dec 2021 07:03:15 +0000
Subject: [PATCH 48/63] deep-translator: 1.5.5 -> 1.6.0

---
 pkgs/development/python-modules/deep-translator/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/deep-translator/default.nix b/pkgs/development/python-modules/deep-translator/default.nix
index a91c02a2bf3e..ae7bf52e1fe7 100644
--- a/pkgs/development/python-modules/deep-translator/default.nix
+++ b/pkgs/development/python-modules/deep-translator/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "deep-translator";
-  version = "1.5.5";
+  version = "1.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-XARhzRsquvKcdhPcooGIEmhGN7QJOCubcvOrZB0nhxU=";
+    sha256 = "sha256-B/SnLSaCRVhQvSU2hmdKPswM2N73nHAzQfVNBMgCofI=";
   };
 
   propagatedBuildInputs = [

From 8cd81712b4100f400dd8801c2a83aeaf726a4b95 Mon Sep 17 00:00:00 2001
From: Nelson Jeppesen <50854675+NelsonJeppesen@users.noreply.github.com>
Date: Sun, 26 Dec 2021 12:03:41 -0800
Subject: [PATCH 49/63] vim-plugins.kanagawa-nvim at init

---
 pkgs/misc/vim-plugins/generated.nix    | 12 ++++++++++++
 pkgs/misc/vim-plugins/vim-plugin-names |  1 +
 2 files changed, 13 insertions(+)

diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index 4060e2928f70..c217fddec5f3 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -2818,6 +2818,18 @@ final: prev:
     meta.homepage = "https://github.com/JuliaEditorSupport/julia-vim/";
   };
 
+  kanagawa-nvim = buildVimPluginFrom2Nix {
+    pname = "kanagawa.nvim";
+    version = "2021-12-25";
+    src = fetchFromGitHub {
+      owner = "rebelot";
+      repo = "kanagawa.nvim";
+      rev = "10bccb5e8e8530725c8059df2e6852fb01842d1c";
+      sha256 = "15jji03qvpbyfk1bpc9b31rbkklfzdnhmnld4cr5ydjmz1fd5fzb";
+    };
+    meta.homepage = "https://github.com/rebelot/kanagawa.nvim/";
+  };
+
   kommentary = buildVimPluginFrom2Nix {
     pname = "kommentary";
     version = "2021-12-03";
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index 24ac08d76391..e83504f9e162 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -642,6 +642,7 @@ rbong/vim-flog
 rcarriga/nvim-dap-ui
 rcarriga/nvim-notify
 rcarriga/vim-ultest
+rebelot/kanagawa.nvim
 rhysd/clever-f.vim
 rhysd/committia.vim
 rhysd/conflict-marker.vim

From fa272718c8ad7486672e1542dd5da495c5e6f3a1 Mon Sep 17 00:00:00 2001
From: Michael Stone <m@mstone.info>
Date: Sun, 26 Dec 2021 17:25:13 -0500
Subject: [PATCH 50/63] vscode-extensions.matklad.rust-analyzer: fix #152285 on
 aarch64-darwin

The rust-analyzer vscode extension depends on vsce which depends on keytar
which needs the AppKit and Security frameworks on Darwin.
---
 pkgs/misc/vscode-extensions/rust-analyzer/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/misc/vscode-extensions/rust-analyzer/default.nix b/pkgs/misc/vscode-extensions/rust-analyzer/default.nix
index 0580fc7d56ae..fa08acb84c60 100644
--- a/pkgs/misc/vscode-extensions/rust-analyzer/default.nix
+++ b/pkgs/misc/vscode-extensions/rust-analyzer/default.nix
@@ -8,6 +8,8 @@
 , esbuild
 , pkg-config
 , libsecret
+, stdenv
+, darwin
 , setDefaultServerPath ? true
 }:
 
@@ -40,6 +42,9 @@ let
       jq moreutils esbuild
       # Required by `keytar`, which is a dependency of `vsce`.
       pkg-config libsecret
+    ] ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.AppKit
+      darwin.apple_sdk.frameworks.Security
     ];
 
     # Follows https://github.com/rust-analyzer/rust-analyzer/blob/41949748a6123fd6061eb984a47f4fe780525e63/xtask/src/dist.rs#L39-L65

From f3cf953bbab8f9fd1e809dd6bf9439b683c36f4e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 26 Dec 2021 13:52:36 +0000
Subject: [PATCH 51/63] python38Packages.django_compressor: 2.4.1 -> 3.1

---
 pkgs/development/python-modules/django_compressor/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django_compressor/default.nix b/pkgs/development/python-modules/django_compressor/default.nix
index 61a32e2561a3..a8204eab5fad 100644
--- a/pkgs/development/python-modules/django_compressor/default.nix
+++ b/pkgs/development/python-modules/django_compressor/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
     pname = "django_compressor";
-    version = "2.4.1";
+    version = "3.1";
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "3358077605c146fdcca5f9eaffb50aa5dbe15f238f8854679115ebf31c0415e0";
+      sha256 = "c4a87bf65f9a534cfaf1c321a000a229c24e50c6d62ba6ab089482db42e819d9";
     };
     postPatch = ''
       substituteInPlace setup.py \

From 9a98b3a7094019637fd6eaf451a310f3614b72e4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 26 Dec 2021 16:48:17 +0000
Subject: [PATCH 52/63] python38Packages.phonenumbers: 8.12.39 -> 8.12.40

---
 pkgs/development/python-modules/phonenumbers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/phonenumbers/default.nix b/pkgs/development/python-modules/phonenumbers/default.nix
index 43a684e10dfa..5a8cb430ae6f 100644
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "phonenumbers";
-  version = "8.12.39";
+  version = "8.12.40";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0f7745e1f108654db347d885e814cbb5f225b8c5f5ce336024b193c79291ddaa";
+    sha256 = "00f2955a456b458f9b6ab0d24329049c3e7358c44dfc1979fe4908ced40f1eb8";
   };
 
   checkInputs = [

From cb8f864487100698fd9ab50d618f6c3d5425b117 Mon Sep 17 00:00:00 2001
From: Ben Darwin <bcdarwin@gmail.com>
Date: Thu, 23 Dec 2021 13:51:50 -0500
Subject: [PATCH 53/63] python3Packages.nitransforms: init at 21.0.0

---
 .../python-modules/nitransforms/default.nix   | 45 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 47 insertions(+)
 create mode 100644 pkgs/development/python-modules/nitransforms/default.nix

diff --git a/pkgs/development/python-modules/nitransforms/default.nix b/pkgs/development/python-modules/nitransforms/default.nix
new file mode 100644
index 000000000000..79fd93d32123
--- /dev/null
+++ b/pkgs/development/python-modules/nitransforms/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, h5py
+, nibabel
+, numpy
+, setuptools-scm
+, toml
+}:
+
+buildPythonPackage rec {
+  pname = "nitransforms";
+  version = "21.0.0";
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "njJqHqXVxldyGfmdM8GmgKdgIT4kMYLzcM5+ayR2EDo=";
+  };
+
+  buildInputs = [ setuptools-scm toml ];
+  propagatedBuildInputs = [ h5py nibabel numpy ];
+
+  doCheck = false;
+  # relies on data repo (https://github.com/nipreps-data/nitransforms-tests);
+  # probably too heavy
+  pythonImportsCheck = [
+    "nitransforms"
+    "nitransforms.base"
+    "nitransforms.io"
+    "nitransforms.io.base"
+    "nitransforms.linear"
+    "nitransforms.manip"
+    "nitransforms.nonlinear"
+    "nitransforms.patched"
+  ];
+
+  meta = with lib; {
+    homepage = "https://nitransforms.readthedocs.io";
+    description = "Geometric transformations for images and surfaces";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d35623b12c50..1faf86289bc3 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5296,6 +5296,8 @@ in {
 
   nitpick = callPackage ../applications/version-management/nitpick { };
 
+  nitransforms = callPackage ../development/python-modules/nitransforms { };
+
   nix-kernel = callPackage ../development/python-modules/nix-kernel {
     inherit (pkgs) nix;
   };

From aa450b6094d54995223e6885acf603b07f648985 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 26 Dec 2021 15:31:58 +0000
Subject: [PATCH 54/63] python38Packages.panel: 0.12.5 -> 0.12.6

---
 pkgs/development/python-modules/panel/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/panel/default.nix b/pkgs/development/python-modules/panel/default.nix
index cfb95b23f41c..8673c637eda6 100644
--- a/pkgs/development/python-modules/panel/default.nix
+++ b/pkgs/development/python-modules/panel/default.nix
@@ -17,7 +17,7 @@ let
 in
 buildPythonPackage rec {
   pname = "panel";
-  version = "0.12.5";
+  version = "0.12.6";
 
   # Don't forget to also update the node packages
   # 1. retrieve the package.json file
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   # 3. node2nix
   src = fetchPypi {
     inherit pname version;
-    sha256 = "351481f2a2176359b28effa64c9d9fce487d6758514109cab96f9ed84787ae99";
+    sha256 = "97e158e8eb941f88d71929407f9455c903b5e18d89969db8ce8af66036f46b53";
   };
 
   # Since 0.10.0 panel attempts to fetch from the web.

From 0a38568ff75771a852c98aeefe7115ed5582d7eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <Mic92@users.noreply.github.com>
Date: Mon, 27 Dec 2021 17:23:28 +0000
Subject: [PATCH 55/63] perl5Packages.DBIxClass: fix build (#152207)

---
 pkgs/top-level/perl-packages.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e2d6c24d60c7..83207868d1dc 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6312,6 +6312,13 @@ let
       url = "mirror://cpan/authors/id/R/RI/RIBASUSHI/DBIx-Class-0.082842.tar.gz";
       sha256 = "1rh7idjjbibc1zmiaaarask434lh0lx7f2xyfwmy37k9fa0xcpmh";
     };
+    patches = [
+      # https://github.com/Perl5/DBIx-Class/pull/141
+      (fetchpatch {
+        url = "https://github.com/Perl5/DBIx-Class/commit/fb896701d23fa4da622b5b1b2afbbba3da2dd8f3.patch";
+        sha256 = "sha256-MSbV9UfHu90NCdC5IFwuy/vpSDw4atfellYh7Ydvkm4=";
+      })
+    ];
     buildInputs = [ DBDSQLite TestDeep TestException TestWarn ];
     propagatedBuildInputs = [ ClassAccessorGrouped ClassC3Componentised ConfigAny ContextPreserve DBI DataDumperConcise DataPage DevelGlobalDestruction ModuleFind PathClass SQLAbstractClassic ScopeGuard SubName namespaceclean ];
     meta = {

From dcbd0c941b0963e98bb63ac2d155978eee295c21 Mon Sep 17 00:00:00 2001
From: Philipp <philipp+dev@xndr.de>
Date: Fri, 1 Oct 2021 10:20:47 +0200
Subject: [PATCH 56/63] mopidy-jellyfin: init at 1.0.2

Signed-off-by: Philipp <philipp+dev@xndr.de>
---
 pkgs/applications/audio/mopidy/default.nix  |  2 ++
 pkgs/applications/audio/mopidy/jellyfin.nix | 25 +++++++++++++++++++++
 pkgs/top-level/all-packages.nix             |  1 +
 3 files changed, 28 insertions(+)
 create mode 100644 pkgs/applications/audio/mopidy/jellyfin.nix

diff --git a/pkgs/applications/audio/mopidy/default.nix b/pkgs/applications/audio/mopidy/default.nix
index 971b226bc81d..d1b43bc4489b 100644
--- a/pkgs/applications/audio/mopidy/default.nix
+++ b/pkgs/applications/audio/mopidy/default.nix
@@ -9,6 +9,8 @@ lib.makeScope newScope (self: with self; {
 
   mopidy-iris = callPackage ./iris.nix { };
 
+  mopidy-jellyfin = callPackage ./jellyfin.nix { };
+
   mopidy-local = callPackage ./local.nix { };
 
   mopidy-moped = callPackage ./moped.nix { };
diff --git a/pkgs/applications/audio/mopidy/jellyfin.nix b/pkgs/applications/audio/mopidy/jellyfin.nix
new file mode 100644
index 000000000000..7790380f9b76
--- /dev/null
+++ b/pkgs/applications/audio/mopidy/jellyfin.nix
@@ -0,0 +1,25 @@
+{ lib, python3Packages, mopidy }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "mopidy-jellyfin";
+  version = "1.0.2";
+
+  src = python3Packages.fetchPypi {
+    inherit version;
+    pname = "Mopidy-Jellyfin";
+    sha256 = "0j7v5xx3c401r5dw1sqm1n2263chjga1d3ml85rg79hjhhhacy75";
+  };
+
+  propagatedBuildInputs = [ mopidy python3Packages.unidecode python3Packages.websocket-client ];
+
+  # no tests implemented
+  doCheck = false;
+  pythonImportsCheck = [ "mopidy_jellyfin" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/jellyfin/mopidy-jellyfin";
+    description = "Mopidy extension for playing audio files from Jellyfin";
+    license = licenses.asl20;
+    maintainers = [ maintainers.pstn ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bcf00c88b886..df2cfac8b717 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -27154,6 +27154,7 @@ with pkgs;
   inherit (mopidyPackages)
     mopidy
     mopidy-iris
+    mopidy-jellyfin
     mopidy-local
     mopidy-moped
     mopidy-mopify

From 4d6b67b9685bc2232e08ecd65a1633cbdedef4f5 Mon Sep 17 00:00:00 2001
From: Martino Fontana <tinozzo123@tutanota.com>
Date: Tue, 23 Nov 2021 22:16:56 +0100
Subject: [PATCH 57/63] citra: add build options

---
 pkgs/misc/emulators/citra/default.nix | 66 +++++++++++++++------------
 1 file changed, 38 insertions(+), 28 deletions(-)

diff --git a/pkgs/misc/emulators/citra/default.nix b/pkgs/misc/emulators/citra/default.nix
index c1d4724cee9b..92d0f5b1d364 100644
--- a/pkgs/misc/emulators/citra/default.nix
+++ b/pkgs/misc/emulators/citra/default.nix
@@ -3,21 +3,23 @@
 , fetchFromGitHub
 , cmake
 , wrapQtAppsHook
-, SDL2
-, qtbase
-, qtmultimedia
 , boost17x
-, libpulseaudio
 , pkg-config
 , libusb1
 , zstd
 , libressl
-, alsa-lib
-, rapidjson
-, aacHleDecoding ? true
-, fdk_aac
-, ffmpeg-full
+, enableSdl2 ? true, SDL2
+, enableQt ? true, qtbase, qtmultimedia
+, enableQtTranslation ? enableQt, qttools
+, enableWebService ? true
+, enableCubeb ? true, libpulseaudio
+, enableFfmpegAudioDecoder ? true
+, enableFfmpegVideoDumper ? true
+, ffmpeg
+, useDiscordRichPresence ? true, rapidjson
+, enableFdk ? false, fdk_aac
 }:
+assert lib.assertMsg (!enableFfmpegAudioDecoder || !enableFdk) "Can't enable both enableFfmpegAudioDecoder and enableFdk";
 
 stdenv.mkDerivation {
   pname = "citra";
@@ -31,36 +33,43 @@ stdenv.mkDerivation {
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [ cmake wrapQtAppsHook pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ]
+  ++ lib.optionals enableQt [ wrapQtAppsHook ];
+
   buildInputs = [
-    SDL2
-    qtbase
-    qtmultimedia
-    libpulseaudio
     boost17x
     libusb1
-    alsa-lib
-    rapidjson # for discord-rpc
-  ] ++ lib.optional aacHleDecoding [ fdk_aac ffmpeg-full ];
+  ]
+  ++ lib.optionals enableSdl2 [ SDL2 ]
+  ++ lib.optionals enableQt [ qtbase qtmultimedia ]
+  ++ lib.optionals enableQtTranslation [ qttools ]
+  ++ lib.optionals enableCubeb [ libpulseaudio ]
+  ++ lib.optionals (enableFfmpegAudioDecoder || enableFfmpegVideoDumper) [ ffmpeg ]
+  ++ lib.optionals useDiscordRichPresence [ rapidjson ]
+  ++ lib.optionals enableFdk [ fdk_aac ];
 
   cmakeFlags = [
     "-DUSE_SYSTEM_BOOST=ON"
-    "-DUSE_DISCORD_PRESENCE=ON"
-  ] ++ lib.optionals aacHleDecoding [
-    "-DENABLE_FFMPEG_AUDIO_DECODER=ON"
-    "-DCITRA_USE_BUNDLED_FFMPEG=OFF"
-  ];
+  ]
+  ++ lib.optionals (!enableSdl2) [ "-DENABLE_SDL2=OFF" ]
+  ++ lib.optionals (!enableQt) [ "-DENABLE_QT=OFF" ]
+  ++ lib.optionals enableQtTranslation [ "-DENABLE_QT_TRANSLATION=ON" ]
+  ++ lib.optionals (!enableWebService) [ "-DENABLE_WEB_SERVICE=OFF" ]
+  ++ lib.optionals (!enableCubeb) [ "-DENABLE_CUBEB=OFF" ]
+  ++ lib.optionals enableFfmpegAudioDecoder [ "-DENABLE_FFMPEG_AUDIO_DECODER=ON"]
+  ++ lib.optionals enableFfmpegVideoDumper [ "-DENABLE_FFMPEG_VIDEO_DUMPER=ON" ]
+  ++ lib.optionals useDiscordRichPresence [ "-DUSE_DISCORD_PRESENCE=ON" ]
+  ++ lib.optionals enableFdk [ "-DENABLE_FDK=ON" ];
 
   postPatch = ''
-    # we already know the submodules are present
+    # We already know the submodules are present
     substituteInPlace CMakeLists.txt \
       --replace "check_submodules_present()" ""
 
-    # Trick configure system.
-    sed -n 's,^ *path = \(.*\),\1,p' .gitmodules | while read path; do
-    mkdir "$path/.git"
-    done
-
+    # Devendoring
     rm -rf externals/zstd externals/libressl
     cp -r ${zstd.src} externals/zstd
     tar xf ${libressl.src} -C externals/
@@ -69,6 +78,7 @@ stdenv.mkDerivation {
   '';
 
   # Todo: cubeb audio backend (the default one) doesn't work on the SDL interface.
+  # This seems to be a problem with libpulseaudio, other applications have similar problems (e.g Duckstation).
   # Note that the two interfaces have two separate configuration files.
 
   meta = with lib; {

From 9027a59f7a8b776377c2020bd1444fc9c6ac3627 Mon Sep 17 00:00:00 2001
From: Nikolay Amiantov <ab@fmap.me>
Date: Tue, 21 Dec 2021 21:24:00 +0300
Subject: [PATCH 58/63] influxdb2 service: don't use dynamic user

It breaks something inside of influxdb2, which results in flurry of errors like these:

> ts=2021-12-21T18:19:35.513910Z lvl=info msg="Write failed" log_id=0YZYwvV0000 service=storage-engine service=write shard=50 error="[shard 50] unlinkat ./L1-00000055.tsi: read-only file system"

I believe this is somehow caused by a mount namespace that systemd creates for
the service, but I didn't investigate this deeper.
---
 nixos/modules/services/databases/influxdb2.nix | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/databases/influxdb2.nix b/nixos/modules/services/databases/influxdb2.nix
index a7aa5245d760..340c515bbb43 100644
--- a/nixos/modules/services/databases/influxdb2.nix
+++ b/nixos/modules/services/databases/influxdb2.nix
@@ -1,5 +1,7 @@
 { config, lib, pkgs, ... }:
+
 with lib;
+
 let
   format = pkgs.formats.json { };
   cfg = config.services.influxdb2;
@@ -9,12 +11,14 @@ in
   options = {
     services.influxdb2 = {
       enable = mkEnableOption "the influxdb2 server";
+
       package = mkOption {
         default = pkgs.influxdb2-server;
         defaultText = literalExpression "pkgs.influxdb2";
         description = "influxdb2 derivation to use.";
         type = types.package;
       };
+
       settings = mkOption {
         default = { };
         description = ''configuration options for influxdb2, see <link xlink:href="https://docs.influxdata.com/influxdb/v2.0/reference/config-options"/> for details.'';
@@ -28,18 +32,20 @@ in
       assertion = !(builtins.hasAttr "bolt-path" cfg.settings) && !(builtins.hasAttr "engine-path" cfg.settings);
       message = "services.influxdb2.config: bolt-path and engine-path should not be set as they are managed by systemd";
     }];
+
     systemd.services.influxdb2 = {
       description = "InfluxDB is an open-source, distributed, time series database";
       documentation = [ "https://docs.influxdata.com/influxdb/" ];
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
       environment = {
-        INFLUXD_CONFIG_PATH = "${configFile}";
+        INFLUXD_CONFIG_PATH = configFile;
       };
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/influxd --bolt-path \${STATE_DIRECTORY}/influxd.bolt --engine-path \${STATE_DIRECTORY}/engine";
         StateDirectory = "influxdb2";
-        DynamicUser = true;
+        User = "influxdb2";
+        Group = "influxdb2";
         CapabilityBoundingSet = "";
         SystemCallFilter = "@system-service";
         LimitNOFILE = 65536;
@@ -47,6 +53,13 @@ in
         Restart = "on-failure";
       };
     };
+
+    users.extraUsers.influxdb2 = {
+      isSystemUser = true;
+      group = "influxdb2";
+    };
+
+    users.extraGroups.influxdb2 = {};
   };
 
   meta.maintainers = with lib.maintainers; [ nickcao ];

From e89e6de3f69b001eb734bc3182f7391dbd00e686 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 26 Dec 2021 23:57:01 +0000
Subject: [PATCH 59/63] python3Packages.bimmer-connected: 0.8.5 -> 0.8.7

---
 pkgs/development/python-modules/bimmer-connected/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/bimmer-connected/default.nix b/pkgs/development/python-modules/bimmer-connected/default.nix
index 2742d02d004f..004b7d4e3e09 100644
--- a/pkgs/development/python-modules/bimmer-connected/default.nix
+++ b/pkgs/development/python-modules/bimmer-connected/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "bimmer-connected";
-  version = "0.8.5";
+  version = "0.8.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "bimmerconnected";
     repo = "bimmer_connected";
     rev = version;
-    hash = "sha256-twVI84YCW+t9ar2vHN1OEiY5tT4/pHP29GnpWprdeHs=";
+    hash = "sha256-nLZdaV341mULXIngkEqiLQeg4G2NDFGNg/AUozgJe74=";
   };
 
   nativeBuildInputs = [

From b28c1a30fb667c03f7d9bd29e2e62ceb4bb72501 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 27 Dec 2021 22:27:34 +0100
Subject: [PATCH 60/63] python3Packages.flux-led: 0.27.17 -> 0.27.19

---
 pkgs/development/python-modules/flux-led/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/flux-led/default.nix b/pkgs/development/python-modules/flux-led/default.nix
index 15a2651ff5c0..9131ad24976b 100644
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "flux-led";
-  version = "0.27.17";
+  version = "0.27.19";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "flux_led";
     rev = version;
-    sha256 = "sha256-cb1QbGeOudxLOxU4aEVWYOzCrZ+xFl8F5qHVJdOhPlg=";
+    sha256 = "sha256-QJCRBwsfQQzXQ7DDvzb9NKnZS2LqrQUygdzJ+ccjWt4=";
   };
 
   propagatedBuildInputs = [

From 013cde1d9dd5908a1c550cbddd4ce9d4e28abed7 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 27 Dec 2021 21:47:47 +0100
Subject: [PATCH 61/63] python3Packages.faraday-plugins: 1.5.8 -> 1.5.9

---
 pkgs/development/python-modules/faraday-plugins/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/faraday-plugins/default.nix b/pkgs/development/python-modules/faraday-plugins/default.nix
index ec55bff83269..ebef907f91f5 100644
--- a/pkgs/development/python-modules/faraday-plugins/default.nix
+++ b/pkgs/development/python-modules/faraday-plugins/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "faraday-plugins";
-  version = "1.5.8";
+  version = "1.5.9";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "infobyte";
     repo = "faraday_plugins";
     rev = "v${version}";
-    sha256 = "1r415g2f0cid8nr3y27ipx9hvwzh70l5wp0d7nv25qblc7g38mms";
+    sha256 = "sha256-rU7BF1lXLgJYLed5FVKXroivxKpmmNE5woGCpAcKAwg=";
   };
 
   propagatedBuildInputs = [

From b69eabccfabe1197812a2dbd76f4fb8472afa228 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Mon, 27 Dec 2021 15:51:21 -0800
Subject: [PATCH 62/63] ocrmypdf: 13.1.1 -> 13.2.0 (#151492)

---
 pkgs/development/python-modules/ocrmypdf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index cea3ec26dd74..a6c9b150ead7 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "13.1.1";
+  version = "13.2.0";
 
   src = fetchFromGitHub {
     owner = "jbarlow83";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     extraPostFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    sha256 = "sha256-NIh7eTsXQPNhrNWrTMFG7v4SFsicj1B4szEXcp5fXB4=";
+    sha256 = "sha256-mVPKcxTKoRgttwJdsY7r0kF7W1+G45iCc+mFctDipSM=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 8efd318b108e44673cfcb0643ddd1fd224e25dc1 Mon Sep 17 00:00:00 2001
From: David Nadlinger <code@klickverbot.at>
Date: Wed, 22 Dec 2021 02:38:22 +0000
Subject: [PATCH 63/63] python3.pkgs.isodate: 0.6.0 -> 0.6.1

This fixes building for Python 3.10.

GitHub: Fixes #151664.
---
 pkgs/development/python-modules/isodate/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/isodate/default.nix b/pkgs/development/python-modules/isodate/default.nix
index 19a643d216ac..21bcc3ed90a3 100644
--- a/pkgs/development/python-modules/isodate/default.nix
+++ b/pkgs/development/python-modules/isodate/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "isodate";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2e364a3d5759479cdb2d37cce6b9376ea504db2ff90252a2e5b7cc89cc9ff2d8";
+    sha256 = "SMWIHefosKDWSMsCTIBi3ITnuEDtgehkx2FP08Envek=";
   };
 
   propagatedBuildInputs = [ six ];