From d6dbe0703566c8d6baa2246a6eb79a53365199c9 Mon Sep 17 00:00:00 2001
From: marius david <mariusdavid@laposte.net>
Date: Mon, 8 Nov 2021 23:49:47 +0100
Subject: [PATCH 01/22] patool: fix the non-use of hard-coded binary

---
 pkgs/development/python-modules/patool/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/patool/default.nix b/pkgs/development/python-modules/patool/default.nix
index 2fa07d32ccb1..3c4d971240f6 100644
--- a/pkgs/development/python-modules/patool/default.nix
+++ b/pkgs/development/python-modules/patool/default.nix
@@ -3,6 +3,7 @@
   gzip, bzip2, xz}:
 
 # unrar is unfree, as well as 7z with unrar support, not including it (patool doesn't support unar)
+# it will still use unrar if present in the path
 
 let
   compression-utilities = [
@@ -34,9 +35,9 @@ buildPythonPackage rec {
     sha256 = "0v4r77sm3yzh7y1whfwxmp01cchd82jbhvbg9zsyd2yb944imzjy";
   };
 
-  prePatch = ''
+  postPatch = ''
     substituteInPlace patoolib/util.py \
-      --replace "path = None" 'path = append_to_path(os.environ["PATH"], "${lib.makeBinPath compression-utilities}")'
+      --replace "path = None" 'path = os.environ["PATH"] + ":${lib.makeBinPath compression-utilities}"'
   '';
 
   checkInputs = [ pytestCheckHook ] ++ compression-utilities;

From 87f831c382113e79d3e1a62c15d8ba048347fd57 Mon Sep 17 00:00:00 2001
From: marius david <mariusdavid@laposte.net>
Date: Fri, 6 May 2022 10:54:45 +0200
Subject: [PATCH 02/22] patool: remove unused compression utilities

---
 pkgs/development/python-modules/patool/default.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/patool/default.nix b/pkgs/development/python-modules/patool/default.nix
index 3c4d971240f6..cbc3a05044ee 100644
--- a/pkgs/development/python-modules/patool/default.nix
+++ b/pkgs/development/python-modules/patool/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchFromGitHub, pytestCheckHook, p7zip,
-  unzip, cabextract, zip, zopfli, lzip, zpaq, gnutar, gnugrep, diffutils, file,
+  cabextract, zip, lzip, zpaq, gnutar, gnugrep, diffutils, file,
   gzip, bzip2, xz}:
 
 # unrar is unfree, as well as 7z with unrar support, not including it (patool doesn't support unar)
@@ -8,11 +8,9 @@
 let
   compression-utilities = [
     p7zip
-    unzip
     gnutar
     cabextract
     zip
-    zopfli
     lzip
     zpaq
     gzip

From 04eb893beb851563010cd3158fac617e5d2ff123 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Sun, 10 Jul 2022 10:24:01 +0200
Subject: [PATCH 03/22] weechat: 3.5 -> 3.6

https://github.com/weechat/weechat/releases/tag/v3.6
---
 pkgs/applications/networking/irc/weechat/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index 1b5f797e98c6..1835e59e86c2 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -28,14 +28,14 @@ let
   in
     assert lib.all (p: p.enabled -> ! (builtins.elem null p.buildInputs)) plugins;
     stdenv.mkDerivation rec {
-      version = "3.5";
+      version = "3.6";
       pname = "weechat";
 
       hardeningEnable = [ "pie" ];
 
       src = fetchurl {
         url = "https://weechat.org/files/src/weechat-${version}.tar.bz2";
-        sha256 = "sha256-8ZSa2dQPTiChGW00T5OASHmd0C2PatUtTu9Gr4CF4Oc=";
+        sha256 = "sha256-GkYN/Y4LQQr7GdSDu0ucXXM9wWPAqKD1txJXkOhJMDc=";
       };
 
       outputs = [ "out" "man" ] ++ map (p: p.name) enabledPlugins;

From 02906974ec37d5a85bcdfe023f50b9a86ff9a391 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Wed, 13 Jul 2022 01:30:11 +0200
Subject: [PATCH 04/22] polaris: fix Os error 24: 'Too many open files' in
 checkPhase

I set the ulimit to 4096, the default used by Darwin since #173657
---
 pkgs/servers/polaris/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/servers/polaris/default.nix b/pkgs/servers/polaris/default.nix
index fb9384ea0518..da53dc99252a 100644
--- a/pkgs/servers/polaris/default.nix
+++ b/pkgs/servers/polaris/default.nix
@@ -38,6 +38,11 @@ rustPlatform.buildRustPackage rec {
     cp -a docs/swagger $out/share/polaris-swagger
   '';
 
+  preCheck = ''
+    # 'Err' value: Os { code: 24, kind: Uncategorized, message: "Too many open files" }
+    ulimit -n 4096
+  '';
+
   passthru.updateScript = ./update.sh;
 
   meta = with lib; {

From d54d70f16615992b8005e7bec4b0d77954a95346 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Wed, 13 Jul 2022 19:03:50 +0200
Subject: [PATCH 05/22] nixos/mxisd: allow passing secrets

Suppose you want to provide a LDAP-based directory search to your
homeserver via a service-user with a bind-password. To make sure that
this doesn't end up in the Nix store, it's now possible to set a
substitute for the bindPassword like

    services.mxisd.extraConfig.ldap.connection = {
      # host, bindDn etc.
      bindPassword = "$LDAP_BIND_PW";
    };

and write the actual secret into an environment file that's readable for
`mxisd.service` containing

    LDAP_BIND_PW=<your secret bind pw>

and the following setting in the Nix expression:

    services.mxisd.environmentFile = "/runs/ecrets/mxisd";

(cherry picked from commit aa25ce7aa1a89618e4257fd46c7d20879f54c728)
---
 nixos/modules/services/networking/mxisd.nix | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/mxisd.nix b/nixos/modules/services/networking/mxisd.nix
index 803f0689d1fd..267c605040ea 100644
--- a/nixos/modules/services/networking/mxisd.nix
+++ b/nixos/modules/services/networking/mxisd.nix
@@ -46,6 +46,15 @@ in {
         description = "The mxisd/ma1sd package to use";
       };
 
+      environmentFile = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Path to an environment-file which may contain secrets to be
+          substituted via <package>envsubst</package>.
+        '';
+      };
+
       dataDir = mkOption {
         type = types.str;
         default = "/var/lib/mxisd";
@@ -118,7 +127,12 @@ in {
         Type = "simple";
         User = "mxisd";
         Group = "mxisd";
-        ExecStart = "${cfg.package}/bin/${executable} -c ${configFile}";
+        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        ExecStart = "${cfg.package}/bin/${executable} -c ${cfg.dataDir}/mxisd-config.yaml";
+        ExecStartPre = "${pkgs.writeShellScript "mxisd-substitute-secrets" ''
+          ${pkgs.envsubst}/bin/envsubst -o ${cfg.dataDir}/mxisd-config.yaml \
+            -i ${configFile}
+        ''}";
         WorkingDirectory = cfg.dataDir;
         Restart = "on-failure";
       };

From bccaac95357abafe114ee20a39a5d9c91253d5bc Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 14 Jul 2022 23:42:18 +0200
Subject: [PATCH 06/22] nixos/privacyidea: better secret-handling ldap-proxy &
 RFC42-style settings for ldap-proxy

Instead of hard-coding a single `configFile` for
`privacyidea-ldap-proxy.service` which is pretty unmergable with other
declarations it now uses a RFC42-like approach. Also to make sure that
secrets can be handled properly without ending up in the Nix store, it's
possible to inject secrets via envsubst

    {
      services.privacyidea.ldap-proxy = {
        enable = true;
        environmentFile = "/run/secrets/ldap-pw";
        settings = {
          privacyidea.instance = "privacyidea.example.org";
          service-account = {
            dn = "uid=readonly,ou=serviceaccounts,dc=example,dc=org";
            password = "$LDAP_PW";
          };
        };
      };
    }

and the following secret file (at `/run/secrets`):

    LDAP_PW=<super-secret ldap pw>

For backwards-compat the old `configFile`-option is kept, but it throws
a deprecation warning and is mutually exclusive with the
`settings`-attrset. Also, it doesn't support secrets injection with
`envsubst` & `environmentFile`.
---
 .../modules/services/security/privacyidea.nix | 63 ++++++++++++++++++-
 1 file changed, 60 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/security/privacyidea.nix b/nixos/modules/services/security/privacyidea.nix
index c1617348fb01..190feaf657f3 100644
--- a/nixos/modules/services/security/privacyidea.nix
+++ b/nixos/modules/services/security/privacyidea.nix
@@ -51,6 +51,16 @@ let
     ${cfg.extraConfig}
   '';
 
+  renderValue = x:
+    if isList x then concatMapStringsSep "," (x: ''"${x}"'') x
+    else if isString x && hasInfix "," x then ''"${x}"''
+    else x;
+
+  ldapProxyConfig = pkgs.writeText "ldap-proxy.ini"
+    (generators.toINI {}
+      (flip mapAttrs cfg.ldap-proxy.settings
+        (const (mapAttrs (const renderValue)))));
+
 in
 
 {
@@ -172,7 +182,8 @@ in
         enable = mkEnableOption "PrivacyIDEA LDAP Proxy";
 
         configFile = mkOption {
-          type = types.path;
+          type = types.nullOr types.path;
+          default = null;
           description = ''
             Path to PrivacyIDEA LDAP Proxy configuration (proxy.ini).
           '';
@@ -189,6 +200,26 @@ in
           default = "pi-ldap-proxy";
           description = "Group account under which PrivacyIDEA LDAP proxy runs.";
         };
+
+        settings = mkOption {
+          type = with types; attrsOf (attrsOf (oneOf [ str bool int (listOf str) ]));
+          default = {};
+          description = ''
+            Attribute-set containing the settings for <package>privacyidea-ldap-proxy</package>.
+            It's possible to pass secrets using env-vars as substitutes and
+            use the option <xref linkend="opt-services.privacyidea.ldap-proxy.environmentFile" />
+            to inject them via <package>envsubst</package>.
+          '';
+        };
+
+        environmentFile = mkOption {
+          default = null;
+          type = types.nullOr types.str;
+          description = ''
+            Environment file containing secrets to be substituted into
+            <xref linkend="opt-services.privacyidea.ldap-proxy.settings" />.
+          '';
+        };
       };
     };
   };
@@ -276,6 +307,18 @@ in
 
     (mkIf cfg.ldap-proxy.enable {
 
+      assertions = [
+        { assertion = let
+            xor = a: b: a && !b || !a && b;
+          in xor (cfg.ldap-proxy.settings == {}) (cfg.ldap-proxy.configFile == null);
+          message = "configFile & settings are mutually exclusive for services.privacyidea.ldap-proxy!";
+        }
+      ];
+
+      warnings = mkIf (cfg.ldap-proxy.configFile != null) [
+        "Using services.privacyidea.ldap-proxy.configFile is deprecated! Use the RFC42-style settings option instead!"
+      ];
+
       systemd.services.privacyidea-ldap-proxy = let
         ldap-proxy-env = pkgs.python3.withPackages (ps: [ ps.privacyidea-ldap-proxy ]);
       in {
@@ -284,14 +327,28 @@ in
         serviceConfig = {
           User = cfg.ldap-proxy.user;
           Group = cfg.ldap-proxy.group;
-          ExecStart = ''
+          StateDirectory = "privacyidea-ldap-proxy";
+          EnvironmentFile = mkIf (cfg.ldap-proxy.environmentFile != null)
+            cfg.ldap-proxy.environmentFile;
+          ExecStartPre = mkIf (cfg.ldap-proxy.settings != {})
+            "${pkgs.writeShellScript "substitute-secrets-ldap-proxy" ''
+              set -x
+              ${pkgs.envsubst}/bin/envsubst \
+                -i ${ldapProxyConfig} \
+                -o $STATE_DIRECTORY/ldap-proxy.ini
+            ''}";
+          ExecStart = let
+            configPath = if cfg.ldap-proxy.settings != {}
+              then "%S/privacyidea-ldap-proxy/ldap-proxy.ini"
+              else cfg.ldap-proxy.configFile;
+          in ''
             ${ldap-proxy-env}/bin/twistd \
               --nodaemon \
               --pidfile= \
               -u ${cfg.ldap-proxy.user} \
               -g ${cfg.ldap-proxy.group} \
               ldap-proxy \
-              -c ${cfg.ldap-proxy.configFile}
+              -c ${configPath}
           '';
           Restart = "always";
         };

From 4adf26f01893ed98f9ebbc55cbf87cb1be57a54a Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sat, 16 Jul 2022 14:00:46 +0200
Subject: [PATCH 07/22] nixos/privacyidea-ldap-proxy: always run envsubst

Otherwise the file doesn't exist at the expected location.
---
 nixos/modules/services/security/privacyidea.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/nixos/modules/services/security/privacyidea.nix b/nixos/modules/services/security/privacyidea.nix
index 190feaf657f3..d48266e4a759 100644
--- a/nixos/modules/services/security/privacyidea.nix
+++ b/nixos/modules/services/security/privacyidea.nix
@@ -330,9 +330,8 @@ in
           StateDirectory = "privacyidea-ldap-proxy";
           EnvironmentFile = mkIf (cfg.ldap-proxy.environmentFile != null)
             cfg.ldap-proxy.environmentFile;
-          ExecStartPre = mkIf (cfg.ldap-proxy.settings != {})
+          ExecStartPre =
             "${pkgs.writeShellScript "substitute-secrets-ldap-proxy" ''
-              set -x
               ${pkgs.envsubst}/bin/envsubst \
                 -i ${ldapProxyConfig} \
                 -o $STATE_DIRECTORY/ldap-proxy.ini

From bafaa05bf1cdb00030b8f4303eb1f976cf728793 Mon Sep 17 00:00:00 2001
From: Simon Bruder <simon@sbruder.de>
Date: Sun, 17 Jul 2022 10:11:15 +0200
Subject: [PATCH 08/22] yuzu-{ea,mainline}: {2725,1088} -> {2841,1092}

This also changes the update script, because pineapple changed their
releases which no longer have a name set explicitly.
---
 pkgs/applications/emulators/yuzu/default.nix | 12 ++++++------
 pkgs/applications/emulators/yuzu/update.sh   |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/emulators/yuzu/default.nix b/pkgs/applications/emulators/yuzu/default.nix
index 5c6fd625cf66..bc63771494e2 100644
--- a/pkgs/applications/emulators/yuzu/default.nix
+++ b/pkgs/applications/emulators/yuzu/default.nix
@@ -5,23 +5,23 @@
 }:
 
 let
-  # Fetched from https://api.yuzu-emu.org/gamedb, last updated 2022-05-12
+  # Fetched from https://api.yuzu-emu.org/gamedb, last updated 2022-07-14
   # Please make sure to update this when updating yuzu!
   compat-list = fetchurl {
     name = "yuzu-compat-list";
-    url = "https://web.archive.org/web/20220512184801/https://api.yuzu-emu.org/gamedb";
+    url = "https://web.archive.org/web/20220714160745/https://api.yuzu-emu.org/gamedb";
     sha256 = "sha256-anOmO7NscHDsQxT03+YbJEyBkXjhcSVGgKpDwt//GHw=";
   };
 in {
   mainline = libsForQt5.callPackage ./generic.nix rec {
     pname = "yuzu-mainline";
-    version = "1088";
+    version = "1092";
 
     src = fetchFromGitHub {
       owner = "yuzu-emu";
       repo = "yuzu-mainline";
       rev = "mainline-0-${version}";
-      sha256 = "0kjiynv1fwc14w7382qgzayz5j9n2rnzbpbq49zgcywc4wwcxzs2";
+      sha256 = "1avcq924q0r8pfv1s0a88iyii7yixcxpb3yhlj0xg9zqnwp9r23y";
       fetchSubmodules = true;
     };
 
@@ -30,13 +30,13 @@ in {
 
   early-access = libsForQt5.callPackage ./generic.nix rec {
     pname = "yuzu-ea";
-    version = "2725";
+    version = "2841";
 
     src = fetchFromGitHub {
       owner = "pineappleEA";
       repo = "pineapple-src";
       rev = "EA-${version}";
-      sha256 = "1nmcl9y9chr7cdvnra5zs1v42d3i801hmsjdlz3fmp15n04bcjmp";
+      sha256 = "16lrq9drv0x7gs1siq37m4zmh6d2g3vhnw9qcqajr9p0vmlpnh6l";
       fetchSubmodules = true;
     };
 
diff --git a/pkgs/applications/emulators/yuzu/update.sh b/pkgs/applications/emulators/yuzu/update.sh
index e128db066f35..8dedcab02813 100755
--- a/pkgs/applications/emulators/yuzu/update.sh
+++ b/pkgs/applications/emulators/yuzu/update.sh
@@ -53,7 +53,7 @@ updateEarlyAccess() {
     OLD_EA_HASH="$(getLocalHash "yuzu-ea")"
 
     NEW_EA_VERSION="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
-        "https://api.github.com/repos/pineappleEA/pineapple-src/releases?per_page=1" | jq -r '.[0].name' | cut -d"-" -f2 | cut -d" " -f1)"
+        "https://api.github.com/repos/pineappleEA/pineapple-src/releases?per_page=1" | jq -r '.[0].tag_name' | cut -d"-" -f2 | cut -d" " -f1)"
 
     if [[ "${OLD_EA_VERSION}" = "${NEW_EA_VERSION}" ]]; then
         echo "yuzu-ea is already up to date!"

From c2c82fbe43c6f793b3e4999eaa5775b5f1c07508 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Mon, 18 Jul 2022 13:47:09 +0200
Subject: [PATCH 09/22] nixos/mxisd: use a list for env file for mergeability

---
 nixos/modules/services/networking/mxisd.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/mxisd.nix b/nixos/modules/services/networking/mxisd.nix
index 267c605040ea..5b1e0dee8e35 100644
--- a/nixos/modules/services/networking/mxisd.nix
+++ b/nixos/modules/services/networking/mxisd.nix
@@ -127,7 +127,7 @@ in {
         Type = "simple";
         User = "mxisd";
         Group = "mxisd";
-        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
         ExecStart = "${cfg.package}/bin/${executable} -c ${cfg.dataDir}/mxisd-config.yaml";
         ExecStartPre = "${pkgs.writeShellScript "mxisd-substitute-secrets" ''
           ${pkgs.envsubst}/bin/envsubst -o ${cfg.dataDir}/mxisd-config.yaml \

From 949c334ea9b9a506cb8644a356f64c30a92ef307 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Mon, 18 Jul 2022 13:58:08 +0200
Subject: [PATCH 10/22] nixos/privacyidea-ldap-proxy: use list for
 EnvironmentFile for mergeability

---
 nixos/modules/services/security/privacyidea.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/security/privacyidea.nix b/nixos/modules/services/security/privacyidea.nix
index d48266e4a759..13e27f255068 100644
--- a/nixos/modules/services/security/privacyidea.nix
+++ b/nixos/modules/services/security/privacyidea.nix
@@ -329,7 +329,7 @@ in
           Group = cfg.ldap-proxy.group;
           StateDirectory = "privacyidea-ldap-proxy";
           EnvironmentFile = mkIf (cfg.ldap-proxy.environmentFile != null)
-            cfg.ldap-proxy.environmentFile;
+            [ cfg.ldap-proxy.environmentFile ];
           ExecStartPre =
             "${pkgs.writeShellScript "substitute-secrets-ldap-proxy" ''
               ${pkgs.envsubst}/bin/envsubst \

From 83841f8bf7fe66931aff44d94f89f7a14aebdc6c Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Fri, 15 Jul 2022 21:56:18 +0300
Subject: [PATCH 11/22] =?UTF-8?q?qgis:=203.26.0=20=E2=86=92=203.26.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/applications/gis/qgis/unwrapped.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
index 1c46cd81f65a..f0cfbda170d9 100644
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -69,14 +69,14 @@ let
     six
   ];
 in mkDerivation rec {
-  version = "3.26.0";
+  version = "3.26.1";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-yHQi5ai7fdgznTf562Bj0QPE+SXg972O7+r01RY7itE=";
+    sha256 = "sha256-FjMe/5uEbmSeQrAtkKvoGh4VlPkbGMHNzlCpn27C5CQ=";
   };
 
   passthru = {

From 75fdfe76cd4fb7ccf00647ba487bfe470cf23498 Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Fri, 15 Jul 2022 21:56:53 +0300
Subject: [PATCH 12/22] =?UTF-8?q?qgis-ltr:=203.22.8=20=E2=86=92=203.22.9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/applications/gis/qgis/unwrapped-ltr.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/gis/qgis/unwrapped-ltr.nix b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
index 0ad11bc630bf..8acc917b047f 100644
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@@ -69,14 +69,14 @@ let
     six
   ];
 in mkDerivation rec {
-  version = "3.22.8";
+  version = "3.22.9";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-YxF7FzyNNt+bdk96g2sWWv9haqV0L6Ab96D0hV0BFrA=";
+    sha256 = "sha256-QHdcK34e7tC0AUstE8pbsBHzHXbmOd3gI2/zqsxb6X4=";
   };
 
   passthru = {

From d9a59b22ee0a61cc59bd21d0a2f748fe3fd6af26 Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Sun, 17 Jul 2022 13:42:39 +0300
Subject: [PATCH 13/22] Group GIS applications

---
 pkgs/top-level/all-packages.nix | 63 +++++++++++++++++----------------
 1 file changed, 32 insertions(+), 31 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 58a47d5ed77c..7aa11d31370c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3410,8 +3410,6 @@ with pkgs;
 
   dconf = callPackage ../development/libraries/dconf { };
 
-  dcw-gmt = callPackage ../applications/gis/gmt/dcw.nix { };
-
   ddate = callPackage ../tools/misc/ddate { };
 
   ddosify = callPackage ../development/tools/ddosify { };
@@ -3839,11 +3837,6 @@ with pkgs;
     variant = "krita";
   };
 
-  gmt = callPackage ../applications/gis/gmt {
-    inherit (darwin.apple_sdk.frameworks)
-      Accelerate CoreGraphics CoreVideo;
-  };
-
   gpg-tui = callPackage ../tools/security/gpg-tui {
     inherit (darwin.apple_sdk.frameworks) AppKit Foundation;
     inherit (darwin) libobjc libresolv;
@@ -25593,6 +25586,38 @@ with pkgs;
 
   zuki-themes = callPackage ../data/themes/zuki { };
 
+  ### APPLICATIONS / GIS
+
+  gmt = callPackage ../applications/gis/gmt {
+    inherit (darwin.apple_sdk.frameworks)
+      Accelerate CoreGraphics CoreVideo;
+  };
+
+  gshhg-gmt = callPackage ../applications/gis/gmt/gshhg.nix { };
+
+  dcw-gmt = callPackage ../applications/gis/gmt/dcw.nix { };
+
+  grass = callPackage ../applications/gis/grass { };
+
+  openorienteering-mapper = libsForQt5.callPackage ../applications/gis/openorienteering-mapper { };
+
+  qgis-ltr = callPackage ../applications/gis/qgis/ltr.nix { };
+
+  qgis = callPackage ../applications/gis/qgis { };
+
+  qmapshack = libsForQt5.callPackage ../applications/gis/qmapshack { };
+
+  saga = libsForQt5.callPackage ../applications/gis/saga {
+    inherit (darwin.apple_sdk.frameworks) Cocoa;
+  };
+
+  udig = callPackage ../applications/gis/udig { };
+
+  whitebox-tools = callPackage ../applications/gis/whitebox-tools {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
+  zombietrackergps = libsForQt5.callPackage ../applications/gis/zombietrackergps { };
 
   ### APPLICATIONS
 
@@ -26956,8 +26981,6 @@ with pkgs;
 
   gpx-viewer = callPackage ../applications/misc/gpx-viewer { };
 
-  grass = callPackage ../applications/gis/grass { };
-
   grepcidr = callPackage ../applications/search/grepcidr { };
 
   grepm = callPackage ../applications/search/grepm { };
@@ -29328,8 +29351,6 @@ with pkgs;
     vm = callPackage ../applications/audio/open-music-kontrollers/vm.nix { };
   };
 
-  openorienteering-mapper = libsForQt5.callPackage ../applications/gis/openorienteering-mapper { };
-
   openscad = libsForQt5.callPackage ../applications/graphics/openscad {};
 
   open-stage-control = callPackage ../applications/audio/open-stage-control {
@@ -29720,10 +29741,6 @@ with pkgs;
 
   wrapQemuBinfmtP = callPackage ../applications/virtualization/qemu/binfmt-p-wrapper.nix { };
 
-  qgis-ltr = callPackage ../applications/gis/qgis/ltr.nix { };
-
-  qgis = callPackage ../applications/gis/qgis { };
-
   qgroundcontrol = libsForQt5.callPackage ../applications/science/robotics/qgroundcontrol { };
 
   qjackctl = libsForQt5.callPackage ../applications/audio/qjackctl { };
@@ -29741,8 +29758,6 @@ with pkgs;
 
   garmindev = callPackage ../applications/misc/qlandkartegt/garmindev.nix {};
 
-  qmapshack = libsForQt5.callPackage ../applications/gis/qmapshack { };
-
   qmediathekview = libsForQt5.callPackage ../applications/video/qmediathekview { };
 
   qmplay2 = libsForQt5.callPackage ../applications/video/qmplay2 { };
@@ -31166,10 +31181,6 @@ with pkgs;
     wlroots = wlroots_0_14;
   };
 
-  whitebox-tools = callPackage ../applications/gis/whitebox-tools {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   windowlab = callPackage ../applications/window-managers/windowlab { };
 
   windowmaker = callPackage ../applications/window-managers/windowmaker { };
@@ -31605,8 +31616,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreServices;
   };
 
-  zombietrackergps = libsForQt5.callPackage ../applications/gis/zombietrackergps { };
-
   zoom-us = callPackage ../applications/networking/instant-messengers/zoom-us { };
 
   zotero = callPackage ../applications/office/zotero { };
@@ -31898,10 +31907,6 @@ with pkgs;
 
   quorum = callPackage ../applications/blockchains/quorum { };
 
-  saga = libsForQt5.callPackage ../applications/gis/saga {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
-
   samplv1 = libsForQt5.callPackage ../applications/audio/samplv1 { };
 
   scaleft = callPackage ../applications/networking/scaleft { };
@@ -31927,8 +31932,6 @@ with pkgs;
 
   drumkv1 = libsForQt5.callPackage ../applications/audio/drumkv1 { };
 
-  gshhg-gmt = callPackage ../applications/gis/gmt/gshhg.nix { };
-
   eureka-editor = callPackage ../applications/misc/eureka-editor { };
 
   eureka-ideas = callPackage ../applications/misc/eureka-ideas {
@@ -32980,8 +32983,6 @@ with pkgs;
 
   uchess = callPackage ../games/uchess { };
 
-  udig = callPackage ../applications/gis/udig { };
-
   ufoai = callPackage ../games/ufoai { };
 
   uhexen2 = callPackage ../games/uhexen2 { };

From b3b78ce3ef66e838dbbabfbdb5162b6a551b5a32 Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Mon, 18 Jul 2022 22:40:13 +1000
Subject: [PATCH 14/22] sgt-puzzles: update sgt-puzzles.menu to a working URL

Motivation: Fix sgt-puzzles.menu. Its URL is currently 404ing since
https://github.com/gentoo/gentoo/raw/720e614d0107e86fc1e520bac17726578186843d/games-puzzle/sgt-puzzles/files/sgt-puzzles.menu
is 404ing because https://github.com/Oleh-Kravchenko/portage is 404ing.
---
 pkgs/games/sgt-puzzles/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index 1c0b7aeda493..e3a6bd5d9ec2 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   sgt-puzzles-menu = fetchurl {
-    url = "https://raw.githubusercontent.com/Oleh-Kravchenko/portage/master/games-puzzle/sgt-puzzles/files/sgt-puzzles.menu";
+    url = "https://raw.githubusercontent.com/gentoo/gentoo/720e614d0107e86fc1e520bac17726578186843d/games-puzzle/sgt-puzzles/files/sgt-puzzles.menu";
     sha256 = "088w0x9g3j8pn725ix8ny8knhdsfgjr3hpswsh9fvfkz5vlg2xkm";
   };
 

From 34aa48f5784ab6fe748df1062e46a43683cd5082 Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Mon, 18 Jul 2022 22:23:53 +1000
Subject: [PATCH 15/22] sgtpuzzles: Fix Icon path.

Prior to this commits, GNOME did not render icons for sgtpuzzle's
desktop items.
---
 pkgs/games/sgt-puzzles/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index e3a6bd5d9ec2..20ac24242c46 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
         --set-key Name --set-value $i \
         --set-key Comment --set-value "${meta.description}" \
         --set-key Categories --set-value "Game;LogicGame;X-sgt-puzzles;" \
-        --set-key Icon --set-value $out/share/icons/hicolor/48x48/apps/$i-48d24 \
+        --set-key Icon --set-value $out/share/icons/hicolor/48x48/apps/$i-48d24.png \
         $i.desktop
     done
 

From 61bf2a9c6879496ae9bbbe59c7c3b169728f1516 Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Mon, 18 Jul 2022 22:20:28 +1000
Subject: [PATCH 16/22] sgtpuzzles: 20200610.9aa7b7c -> 20220613.387d323

This required moving to sgtpuzzle's cmake-based build:
https://git.tartarus.org/?p=simon/puzzles.git;a=commit;h=cc7f5503dc8f4ddf468e080a73028c83d1196e83

Tested by compiling and playing some games on x86_64.
---
 pkgs/games/sgt-puzzles/default.nix | 31 ++++++++++++------------------
 1 file changed, 12 insertions(+), 19 deletions(-)

diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index 20ac24242c46..603f119e20db 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, fetchurl, desktop-file-utils
-, gtk3, libX11
-, makeWrapper, pkg-config, perl, autoreconfHook, wrapGAppsHook
+, gtk3, libX11, cmake, imagemagick
+, pkg-config, perl, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
   pname = "sgt-puzzles";
-  version = "20200610.9aa7b7c";
+  version = "20220613.387d323";
 
   src = fetchurl {
     url = "http://www.chiark.greenend.org.uk/~sgtatham/puzzles/puzzles-${version}.tar.gz";
-    sha256 = "0rrd1c77ar91zqy4rr4xp1z7x3ywnshlac99cga4hnrgwb7vwl3f";
+    hash = "sha256-Vcm7gxC9R7vvLkgkHblvEOONGLkYSHGMRfSBktgN/oQ=";
   };
 
   sgt-puzzles-menu = fetchurl {
@@ -17,18 +17,17 @@ stdenv.mkDerivation rec {
     sha256 = "088w0x9g3j8pn725ix8ny8knhdsfgjr3hpswsh9fvfkz5vlg2xkm";
   };
 
-  nativeBuildInputs = [ autoreconfHook desktop-file-utils makeWrapper
-    pkg-config perl wrapGAppsHook ];
+  nativeBuildInputs = [
+    cmake
+    desktop-file-utils
+    imagemagick
+    perl
+    pkg-config
+    wrapGAppsHook
+  ];
 
   buildInputs = [ gtk3 libX11 ];
 
-  makeFlags = [ "prefix=$(out)" "gamesdir=$(out)/bin"];
-
-  preInstall = ''
-    mkdir -p "$out"/{bin,share/doc/sgtpuzzles}
-    cp gamedesc.txt LICENCE README "$out/share/doc/sgtpuzzles"
-  '';
-
   postInstall = ''
     for i in  $(basename -s $out/bin/*); do
 
@@ -57,12 +56,6 @@ stdenv.mkDerivation rec {
     install -Dm644 ${sgt-puzzles-menu} -t $out/etc/xdg/menus/applications-merged/
   '';
 
-  preConfigure = ''
-    perl mkfiles.pl
-    export NIX_LDFLAGS="$NIX_LDFLAGS -lX11"
-    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error"
-    cp Makefile.gtk Makefile
-  '';
   meta = with lib; {
     description = "Simon Tatham's portable puzzle collection";
     license = licenses.mit;

From 59cc4254df4d727bf2048ee44bb68d4173c23aca Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Mon, 18 Jul 2022 22:24:40 +1000
Subject: [PATCH 17/22] sgtpuzzles: Use higher resolution icons: 48x48 -> 96x96

Motivation: The 48x48 icons look fuzzy on my 1080 width monitor, and
on the Pinephone.
---
 pkgs/games/sgt-puzzles/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index 603f119e20db..499e8385388c 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     for i in  $(basename -s $out/bin/*); do
 
       ln -s $out/bin/$i $out/bin/sgt-puzzle-$i
-      install -Dm644 icons/$i-48d24.png -t $out/share/icons/hicolor/48x48/apps/
+      install -Dm644 icons/$i-96d24.png -t $out/share/icons/hicolor/96x96/apps/
 
       # Generate/validate/install .desktop files.
       echo "[Desktop Entry]" > $i.desktop
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
         --set-key Name --set-value $i \
         --set-key Comment --set-value "${meta.description}" \
         --set-key Categories --set-value "Game;LogicGame;X-sgt-puzzles;" \
-        --set-key Icon --set-value $out/share/icons/hicolor/48x48/apps/$i-48d24.png \
+        --set-key Icon --set-value $out/share/icons/hicolor/96x96/apps/$i-96d24.png \
         $i.desktop
     done
 

From 55a280290d9016d252edbf1055b9283d8a653b1e Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Mon, 18 Jul 2022 22:47:58 +1000
Subject: [PATCH 18/22] sgtpuzzles: add tomfitzhenry@ as co-maintainer

---
 pkgs/games/sgt-puzzles/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index 499e8385388c..7419b6810cb2 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Simon Tatham's portable puzzle collection";
     license = licenses.mit;
-    maintainers = [ maintainers.raskin ];
+    maintainers = with maintainers; [ raskin tomfitzhenry ];
     platforms = platforms.linux;
     homepage = "https://www.chiark.greenend.org.uk/~sgtatham/puzzles/";
   };

From c286a8f8c25db8d31178a874886c892a2ecebad7 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Mon, 18 Jul 2022 15:00:07 +0200
Subject: [PATCH 19/22] rt: 5.0.2 -> 5.0.3

fixes CVE-2022-25802, CVE-2022-25803 and CVE-2020-11022 (in rt)

For all changes see https://github.com/bestpractical/rt/releases/tag/rt-5.0.3
---
 pkgs/servers/rt/default.nix      | 7 +++----
 pkgs/top-level/perl-packages.nix | 6 +++---
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/pkgs/servers/rt/default.nix b/pkgs/servers/rt/default.nix
index a113c25f396c..894da7a652ee 100644
--- a/pkgs/servers/rt/default.nix
+++ b/pkgs/servers/rt/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rt";
-  version = "5.0.2";
+  version = "5.0.3";
 
   src = fetchFromGitHub {
     repo = pname;
     rev = "${pname}-${version}";
     owner = "bestpractical";
-    sha256 = "1qdvbsmdynjw2v0clnmhdmrky7w4dsiysv92n7d7jdbawnicqahn";
+    hash = "sha256-ZitlueLEbV3mGJg0aDrLa5IReJiOVaEf+JicbA9zUS4=";
   };
 
   patches = [
@@ -120,8 +120,7 @@ stdenv.mkDerivation rec {
   ];
 
   preAutoreconf = ''
-    substituteInPlace configure.ac \
-      --replace "rt-3.9.EXPORTED" "rt-${version}"
+    echo rt-${version} > .tag
   '';
   preConfigure = ''
     configureFlags="$configureFlags --with-web-user=$UID"
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 244711fa9013..3e85dd0713e1 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6590,10 +6590,10 @@ let
 
   DBIxSearchBuilder = buildPerlPackage {
     pname = "DBIx-SearchBuilder";
-    version = "1.68";
+    version = "1.71";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/B/BP/BPS/DBIx-SearchBuilder-1.68.tar.gz";
-      sha256 = "be197c0f83c426996f77d22126f3103f958fc4bd1791c6962b793cc2779601f8";
+      url = "mirror://cpan/authors/id/B/BP/BPS/DBIx-SearchBuilder-1.71.tar.gz";
+      sha256 = "1ga2sjis6lg51z58il8q165klc38dmb3wj3phyxjfjg6yskdsbz4";
     };
     buildInputs = [ DBDSQLite ];
     propagatedBuildInputs = [ CacheSimpleTimedExpiry ClassAccessor ClassReturnValue Clone DBIxDBSchema Want capitalization ];

From 0005ee6060ba02bee022d06117a49d6ee0d9a7cd Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Mon, 18 Jul 2022 12:39:33 +0200
Subject: [PATCH 20/22] josh: init at 22.06.22

---
 .../version-management/josh/default.nix       | 60 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 62 insertions(+)
 create mode 100644 pkgs/applications/version-management/josh/default.nix

diff --git a/pkgs/applications/version-management/josh/default.nix b/pkgs/applications/version-management/josh/default.nix
new file mode 100644
index 000000000000..acf2b24c0794
--- /dev/null
+++ b/pkgs/applications/version-management/josh/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, libgit2
+, openssl
+, pkg-config
+, makeWrapper
+, git
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "josh";
+  version = "22.06.22";
+
+  src = fetchFromGitHub {
+    owner = "esrlabs";
+    repo = "josh";
+    rev = "r" + version;
+    sha256 = "0511qv9zyjvv4zfz6zyi69ssbkrwa24n0ah5w9mb4gzd547as8pq";
+  };
+
+  cargoSha256 = "0zfjjyyz4pxar1mfkkj9aij4dnwqy3asdrmay1iy6ijjn1qd97n4";
+
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    libgit2
+    openssl
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.Security
+  ];
+
+  cargoBuildFlags = [
+    "-p" "josh"
+    "-p" "josh-proxy"
+    # TODO: josh-ui
+  ];
+
+  postInstall = ''
+    wrapProgram "$out/bin/josh-proxy" --prefix PATH : "${git}/bin"
+  '';
+
+  meta = {
+    description = "Just One Single History";
+    homepage = "https://josh-project.github.io/josh/";
+    downloadPage = "https://github.com/josh-project/josh";
+    changelog = "https://github.com/josh-project/josh/releases/tag/${version}";
+    license = lib.licenses.mit;
+    maintainers = [
+      lib.maintainers.sternenseemann
+      lib.maintainers.tazjin
+    ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7aa11d31370c..6c8af61fe2f2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -27309,6 +27309,8 @@ with pkgs;
 
   jmusicbot = callPackage ../applications/audio/jmusicbot { };
 
+  josh = callPackage ../applications/version-management/josh { };
+
   junction = callPackage ../applications/misc/junction { };
 
   lemonade = callPackage ../applications/misc/lemonade { };

From 080774e28f421b6fb890cf4d6aff7caad8e9b32e Mon Sep 17 00:00:00 2001
From: oaksoaj <oaksoaj@riseup.net>
Date: Sat, 2 Jul 2022 16:34:59 +0200
Subject: [PATCH 21/22] yggdrasil: reenable DynamicUser

Since version 0.4 Yggdrasil works again using systemd's DynamicUser option.
This patch reenables it to improve security.

We tested this with both persistent and non-persistent keys. Everything
seems to work fine.
---
 .../modules/services/networking/yggdrasil.nix | 29 ++++---------------
 1 file changed, 6 insertions(+), 23 deletions(-)

diff --git a/nixos/modules/services/networking/yggdrasil.nix b/nixos/modules/services/networking/yggdrasil.nix
index 99c18ae6919e..8e88064a9071 100644
--- a/nixos/modules/services/networking/yggdrasil.nix
+++ b/nixos/modules/services/networking/yggdrasil.nix
@@ -60,13 +60,6 @@ in {
         '';
       };
 
-      group = mkOption {
-        type = types.str;
-        default = "root";
-        example = "wheel";
-        description = "Group to grant access to the Yggdrasil control socket.";
-      };
-
       openMulticastPort = mkOption {
         type = bool;
         default = false;
@@ -154,27 +147,17 @@ in {
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         Restart = "always";
 
-        Group = cfg.group;
+        User = "yggdrasil";
+        DynamicUser = true;
+        StateDirectory = "yggdrasil";
         RuntimeDirectory = "yggdrasil";
         RuntimeDirectoryMode = "0750";
         BindReadOnlyPaths = lib.optional configFileProvided cfg.configFile
           ++ lib.optional cfg.persistentKeys keysPath;
+        ReadWritePaths = "/run/yggdrasil";
 
-        # TODO: as of yggdrasil 0.3.8 and systemd 243, yggdrasil fails
-        # to set up the network adapter when DynamicUser is set.  See
-        # github.com/yggdrasil-network/yggdrasil-go/issues/557.  The
-        # following options are implied by DynamicUser according to
-        # the systemd.exec documentation, and can be removed if the
-        # upstream issue is fixed and DynamicUser is set to true:
-        PrivateTmp = true;
-        RemoveIPC = true;
-        NoNewPrivileges = true;
-        ProtectSystem = "strict";
-        RestrictSUIDSGID = true;
-        # End of list of options implied by DynamicUser.
-
-        AmbientCapabilities = "CAP_NET_ADMIN";
-        CapabilityBoundingSet = "CAP_NET_ADMIN";
+        AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
+        CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
         MemoryDenyWriteExecute = true;
         ProtectControlGroups = true;
         ProtectHome = "tmpfs";

From fc9e22fca12e71f5a43ab616aa0e669392174e12 Mon Sep 17 00:00:00 2001
From: oaksoaj <oaksoaj@riseup.net>
Date: Sat, 2 Jul 2022 18:20:27 +0200
Subject: [PATCH 22/22] yggdrasil: add group option back and remove systemd
 User= directive

The group configuration parameter allow to share access to yggdrasil
control socket with the users in the system. In the version we propose,
it is null by default so that only root can access the control socket,
but let user create their own group if they need.

Remove User= durective in systemd unit. Should a user with the specified
name already exist in the system, it would be used silently instead of a
dynamic user which could be a security concern.
---
 nixos/modules/services/networking/yggdrasil.nix | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/networking/yggdrasil.nix b/nixos/modules/services/networking/yggdrasil.nix
index 8e88064a9071..ae681988ea11 100644
--- a/nixos/modules/services/networking/yggdrasil.nix
+++ b/nixos/modules/services/networking/yggdrasil.nix
@@ -60,6 +60,13 @@ in {
         '';
       };
 
+      group = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "wheel";
+        description = "Group to grant access to the Yggdrasil control socket. If <code>null</code>, only root can access the socket.";
+      };
+
       openMulticastPort = mkOption {
         type = bool;
         default = false;
@@ -147,7 +154,6 @@ in {
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         Restart = "always";
 
-        User = "yggdrasil";
         DynamicUser = true;
         StateDirectory = "yggdrasil";
         RuntimeDirectory = "yggdrasil";
@@ -168,7 +174,9 @@ in {
         RestrictRealtime = true;
         SystemCallArchitectures = "native";
         SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @resources";
-      };
+      } // (if (cfg.group != null) then {
+        Group = cfg.group;
+      } else {});
     };
 
     networking.dhcpcd.denyInterfaces = cfg.denyDhcpcdInterfaces;