Merge branch 'NixOS:master' into autoraise/add-custom-compile-flags

.github/workflows/build.yml

@@ -3,6 +3,9 @@ name: Build
 on:
   workflow_call:
     inputs:
+      artifact-prefix:
+        required: true
+        type: string
       baseBranch:
         required: true
         type: string
@@ -100,5 +103,5 @@ jobs:
           contains(fromJSON(inputs.baseBranch).type, 'primary')
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
-          name: nixos-manual-${{ matrix.name }}
+          name: ${{ inputs.artifact-prefix }}nixos-manual-${{ matrix.name }}
           path: nixos-manual

.github/workflows/eval.yml

@@ -3,6 +3,9 @@ name: Eval
 on:
   workflow_call:
     inputs:
+      artifact-prefix:
+        required: true
+        type: string
       mergedSha:
         required: true
         type: string
@@ -110,7 +113,7 @@ jobs:
           MATRIX_SYSTEM: ${{ matrix.system }}
           MATRIX_VERSION: ${{ matrix.version || 'nixVersions.latest' }}
         run: |
-          nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned  -A eval.singleSystem \
+          nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A eval.singleSystem \
             --argstr evalSystem "$MATRIX_SYSTEM" \
             --arg chunkSize 8000 \
             --argstr nixPath "$MATRIX_VERSION" \
@@ -119,19 +122,29 @@ jobs:
           # Note: Keep the same further down in sync!
 
       - name: Evaluate the ${{ matrix.system }} output paths at the target commit
-        if: inputs.targetSha
         env:
           MATRIX_SYSTEM: ${{ matrix.system }}
-        # This is very quick, because it pulls the eval results from Cachix.
         run: |
-          nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.singleSystem \
+          TARGET_DRV=$(nix-instantiate nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.singleSystem \
             --argstr evalSystem "$MATRIX_SYSTEM" \
             --arg chunkSize 8000 \
-            --argstr nixPath "nixVersions.latest" \
-            --out-link target
+            --argstr nixPath "nixVersions.latest")
+
+          # Try to fetch this from Cachix a few times, for up to 30 seconds. This avoids running Eval
+          # twice in the Merge Queue, when a later item finishes Eval at the merge commit earlier.
+          for _i in {1..6}; do
+            # Using --max-jobs 0 will cause nix-build to fail if this can't be substituted from cachix.
+            if nix-build "$TARGET_DRV" --max-jobs 0; then
+              break
+            fi
+            sleep 5
+          done
+
+          # Either fetches from Cachix or runs Eval itself. The fallback is required
+          # for pull requests into wip-branches without merge queue.
+          nix-build "$TARGET_DRV" --out-link target
 
       - name: Compare outpaths against the target branch
-        if: inputs.targetSha
         env:
           MATRIX_SYSTEM: ${{ matrix.system }}
         run: |
@@ -142,16 +155,15 @@ jobs:
             --out-link diff
 
       - name: Upload outpaths diff and stats
-        if: inputs.targetSha
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
-          name: ${{ matrix.version && format('{0}-', matrix.version) || '' }}diff-${{ matrix.system }}
+          name: ${{ inputs.artifact-prefix }}${{ matrix.version && format('{0}-', matrix.version) || '' }}diff-${{ matrix.system }}
           path: diff/*
 
   compare:
     runs-on: ubuntu-24.04-arm
     needs: [eval]
-    if: inputs.targetSha && !cancelled() && !failure()
+    if: ${{ !cancelled() && !failure() }}
     permissions:
       statuses: write
     timeout-minutes: 5
@@ -169,7 +181,7 @@ jobs:
       - name: Download output paths and eval stats for all systems
         uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
-          pattern: diff-*
+          pattern: ${{ inputs.artifact-prefix }}diff-*
           path: diff
           merge-multiple: true
 
@@ -182,6 +194,12 @@ jobs:
             --arg diffDir ./diff \
             --out-link combined
 
+      - name: Upload the maintainer list
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: ${{ inputs.artifact-prefix }}maintainers
+          path: combined/maintainers.json
+
       - name: Compare against the target branch
         env:
           AUTHOR_ID: ${{ github.event.pull_request.user.id }}
@@ -202,7 +220,7 @@ jobs:
       - name: Upload the comparison results
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
-          name: comparison
+          name: ${{ inputs.artifact-prefix }}comparison
           path: comparison/*
 
       - name: Add eval summary to commit statuses
@@ -250,6 +268,7 @@ jobs:
       - name: Add version comparison table to job summary
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
+          ARTIFACT_PREFIX: ${{ inputs.artifact-prefix }}
           SYSTEMS: ${{ inputs.systems }}
           VERSIONS: ${{ needs.versions.outputs.versions }}
         with:
@@ -257,6 +276,7 @@ jobs:
             const { readFileSync } = require('node:fs')
             const path = require('node:path')
 
+            const prefix = process.env.ARTIFACT_PREFIX
             const systems = JSON.parse(process.env.SYSTEMS)
             const versions = JSON.parse(process.env.VERSIONS)
 
@@ -272,7 +292,7 @@ jobs:
                   [{ data: version }].concat(
                     systems.map((system) => {
                       try {
-                        const artifact = path.join('versions', `${version}-diff-${system}`)
+                        const artifact = path.join('versions', `${prefix}${version}-diff-${system}`)
                         const time = Math.round(
                           parseFloat(
                             readFileSync(

.github/workflows/merge-group.yml

@@ -4,6 +4,9 @@ on:
   merge_group:
   workflow_call:
     inputs:
+      artifact-prefix:
+        required: true
+        type: string
       mergedSha:
         required: true
         type: string
@@ -54,7 +57,9 @@ jobs:
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
     with:
+      artifact-prefix: ${{ inputs.artifact-prefix }}
       mergedSha: ${{ inputs.mergedSha || github.event.merge_group.head_sha }}
+      targetSha: ${{ inputs.targetSha || github.event.merge_group.base_sha }}
       systems: ${{ needs.prepare.outputs.systems }}
 
   # This job's only purpose is to create the target for the "Required Status Checks" branch ruleset.

.github/workflows/pr.yml

@@ -3,6 +3,10 @@ name: PR
 on:
   pull_request_target:
   workflow_call:
+    inputs:
+      artifact-prefix:
+        required: true
+        type: string
     secrets:
       CACHIX_AUTH_TOKEN:
         required: true
@@ -90,6 +94,7 @@ jobs:
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
     with:
+      artifact-prefix: ${{ inputs.artifact-prefix }}
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
       systems: ${{ needs.prepare.outputs.systems }}
@@ -116,6 +121,8 @@ jobs:
     uses: ./.github/workflows/reviewers.yml
     secrets:
       OWNER_APP_PRIVATE_KEY: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
+    with:
+      artifact-prefix: ${{ inputs.artifact-prefix }}
 
   build:
     name: Build
@@ -124,6 +131,7 @@ jobs:
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
     with:
+      artifact-prefix: ${{ inputs.artifact-prefix }}
       baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
 

.github/workflows/reviewers.yml

@@ -7,6 +7,10 @@ on:
   pull_request_target:
     types: [ready_for_review]
   workflow_call:
+    inputs:
+      artifact-prefix:
+        required: true
+        type: string
     secrets:
       OWNER_APP_PRIVATE_KEY:
         required: true
@@ -91,6 +95,8 @@ jobs:
       - name: Wait for comparison to be done
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         id: eval
+        env:
+          ARTIFACT: ${{ inputs.artifact-prefix }}comparison
         with:
           script: |
             const run_id = (await github.rest.actions.listWorkflowRuns({
@@ -111,7 +117,7 @@ jobs:
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 run_id,
-                name: 'comparison'
+                name: process.env.ARTIFACT,
               })
               if (result.data.total_count > 0) return
               await new Promise(resolve => setTimeout(resolve, 5000))
@@ -128,7 +134,7 @@ jobs:
         with:
           run-id: ${{ steps.eval.outputs.run-id }}
           github-token: ${{ github.token }}
-          pattern: comparison
+          pattern: ${{ inputs.artifact-prefix }}comparison
           path: comparison
           merge-multiple: true
 

.github/workflows/test.yml

@@ -79,6 +79,7 @@ jobs:
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
     with:
+      artifact-prefix: mg-
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
 
@@ -95,3 +96,5 @@ jobs:
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
       NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+    with:
+      artifact-prefix: pr-

ci/eval/compare/utils.nix

@@ -22,7 +22,7 @@ rec {
       splittedPath = lib.splitString "." packagePlatformPath;
 
       # ["python312Packages" "numpy" "aarch64-linux"] -> ["python312Packages" "numpy"]
-      packagePath = lib.sublist 0 (lib.length splittedPath - 1) splittedPath;
+      packagePath = lib.init splittedPath;
 
       # "python312Packages.numpy"
       name = lib.concatStringsSep "." packagePath;

ci/eval/default.nix

@@ -111,6 +111,7 @@ let
           --option allow-import-from-derivation false \
           --query --available \
           --out-path --json \
+          --meta \
           --show-trace \
           --arg chunkSize "$chunkSize" \
           --arg myChunk "$myChunk" \
@@ -204,6 +205,7 @@ let
         fi
 
         cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
+        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json
       '';
 
   diff = callPackage ./diff.nix { };
@@ -232,6 +234,14 @@ let
           })
         ' > $out/combined-diff.json
 
+        # Combine maintainers from all systems
+        cat ${diffDir}/*/maintainers.json | jq -s '
+          add | group_by(.package) | map({
+            key: .[0].package,
+            value: map(.maintainers) | flatten | unique
+          }) | from_entries
+        ' > $out/maintainers.json
+
         mkdir -p $out/before/stats
         for d in ${diffDir}/before/*; do
           cp -r "$d"/stats-by-chunk $out/before/stats/$(basename "$d")

ci/eval/diff.nix

@@ -76,11 +76,36 @@ let
   afterAttrs = getAttrs after;
   diffAttrs = diff beforeAttrs afterAttrs;
   diffJson = writeText "diff.json" (builtins.toJSON diffAttrs);
+
+  # The maintainer list is not diffed, but just taken as is, to provide a map
+  # of maintainers on the target branch. A list of GitHub IDs is sufficient for
+  # all our purposes and reduces size massively.
+  meta = lib.importJSON "${after}/${evalSystem}/meta.json";
+  maintainers = lib.pipe meta [
+    (lib.mapAttrsToList (
+      k: v: {
+        # splits off the platform suffix
+        package = lib.pipe k [
+          (lib.splitString ".")
+          lib.init
+          (lib.concatStringsSep ".")
+        ];
+        maintainers = map (m: m.githubId) v.maintainers or [ ];
+      }
+    ))
+    # Some paths don't have a platform suffix, those will appear with an empty package here.
+    (lib.filter ({ package, maintainers }: package != "" && maintainers != [ ]))
+  ];
+  maintainersJson = writeText "maintainers.json" (builtins.toJSON maintainers);
 in
 runCommand "diff" { } ''
   mkdir -p $out/${evalSystem}
 
-  cp -r ${before} $out/before
-  cp -r ${after} $out/after
+  cp -r --no-preserve=mode ${before} $out/before
+  cp -r --no-preserve=mode ${after} $out/after
+  # JSON files will be processed above explicitly, so avoid copying over
+  # the source files to keep the artifacts smaller.
+  find $out/before $out/after -iname '*.json' -delete
   cp ${diffJson} $out/${evalSystem}/diff.json
+  cp ${maintainersJson} $out/${evalSystem}/maintainers.json
 ''

doc/build-helpers/images/dockertools.section.md

@@ -202,6 +202,10 @@ Similarly, if you encounter errors similar to `Error_Protocol ("certificate has
 
   _Default value:_ `false`.
 
+`meta` (Attribute Set)
+
+: The `meta` attribute of the resulting derivation, as in `stdenv.mkDerivation`. Accepts `description`, `maintainers` and any other `meta` attributes.
+
 `contents` **DEPRECATED**
 
 : This attribute is deprecated, and users are encouraged to use `copyToRoot` instead.
@@ -635,6 +639,10 @@ This allows the function to produce reproducible images.
 
   _Default value:_ `false`.
 
+`meta` (Attribute Set)
+
+: The `meta` attribute of the resulting derivation, as in `stdenv.mkDerivation`. Accepts `description`, `maintainers` and any other `meta` attributes.
+
 `passthru` (Attribute Set; _optional_)
 
 : Use this to pass any attributes as [`passthru`](#chap-passthru) for the resulting derivation.

doc/packages/darwin-builder.section.md

@@ -64,13 +64,15 @@ builders = ssh-ng://builder@linux-builder ${ARCH}-linux /etc/nix/builder_ed25519
 builders-use-substitutes = true
 ```
 
-To allow Nix to connect to a remote builder not running on port 22, you will also need to create a new file at `/etc/ssh/ssh_config.d/100-linux-builder.conf`:
+To allow Nix to connect to the default remote builder, which does not run on port 22, you will also need to create a new file at `/etc/ssh/ssh_config.d/100-linux-builder.conf`:
 
 ```
 Host linux-builder
   Hostname localhost
   HostKeyAlias linux-builder
   Port 31022
+  User builder
+  IdentityFile /etc/nix/builder_ed25519
 ```
 
 … and then restart your Nix daemon to apply the change:
@@ -79,6 +81,8 @@ Host linux-builder
 $ sudo launchctl kickstart -k system/org.nixos.nix-daemon
 ```
 
+Note that if the builder is running and you have created the above ssh conf file, you can ssh into the builder with `sudo ssh builder@linux-builder`.
+
 ## Example flake usage {#sec-darwin-builder-example-flake}
 
 ```nix

lib/customisation.nix

@@ -864,4 +864,139 @@ rec {
         transformDrv
         ;
     };
+
+  /**
+    Removes a prefix from the attribute names of a cross index.
+
+    A cross index (short for "Cross Platform Pair Index") is a 6-field structure
+    organizing values by cross-compilation platform relationships.
+
+    # Inputs
+
+    `prefix`
+    : The prefix to remove from cross index attribute names
+
+    `crossIndex`
+    : A cross index with prefixed names
+
+    # Type
+
+    ```
+    renameCrossIndexFrom :: String -> AttrSet -> AttrSet
+    ```
+
+    # Examples
+
+    :::{.example}
+    ## `lib.customisation.renameCrossIndexFrom` usage example
+
+    ```nix
+    renameCrossIndexFrom "pkgs" { pkgsBuildBuild = ...; pkgsBuildHost = ...; ... }
+    => { buildBuild = ...; buildHost = ...; ... }
+    ```
+    :::
+  */
+  renameCrossIndexFrom = prefix: x: {
+    buildBuild = x."${prefix}BuildBuild";
+    buildHost = x."${prefix}BuildHost";
+    buildTarget = x."${prefix}BuildTarget";
+    hostHost = x."${prefix}HostHost";
+    hostTarget = x."${prefix}HostTarget";
+    targetTarget = x."${prefix}TargetTarget";
+  };
+
+  /**
+    Adds a prefix to the attribute names of a cross index.
+
+    A cross index (short for "Cross Platform Pair Index") is a 6-field structure
+    organizing values by cross-compilation platform relationships.
+
+    # Inputs
+
+    `prefix`
+    : The prefix to add to cross index attribute names
+
+    `crossIndex`
+    : A cross index to be prefixed
+
+    # Type
+
+    ```
+    renameCrossIndexTo :: String -> AttrSet -> AttrSet
+    ```
+
+    # Examples
+
+    :::{.example}
+    ## `lib.customisation.renameCrossIndexTo` usage example
+
+    ```nix
+    renameCrossIndexTo "self" { buildBuild = ...; buildHost = ...; ... }
+    => { selfBuildBuild = ...; selfBuildHost = ...; ... }
+    ```
+    :::
+  */
+  renameCrossIndexTo = prefix: x: {
+    "${prefix}BuildBuild" = x.buildBuild;
+    "${prefix}BuildHost" = x.buildHost;
+    "${prefix}BuildTarget" = x.buildTarget;
+    "${prefix}HostHost" = x.hostHost;
+    "${prefix}HostTarget" = x.hostTarget;
+    "${prefix}TargetTarget" = x.targetTarget;
+  };
+
+  /**
+    Takes a function and applies it pointwise to each field of a cross index.
+
+    A cross index (short for "Cross Platform Pair Index") is a 6-field structure
+    organizing values by cross-compilation platform relationships.
+
+    # Inputs
+
+    `f`
+    : Function to apply to each cross index value
+
+    `crossIndex`
+    : A cross index to transform
+
+    # Type
+
+    ```
+    mapCrossIndex :: (a -> b) -> AttrSet -> AttrSet
+    ```
+
+    # Examples
+
+    :::{.example}
+    ## `lib.customisation.mapCrossIndex` usage example
+
+    ```nix
+    mapCrossIndex (x: x * 10) { buildBuild = 1; buildHost = 2; ... }
+    => { buildBuild = 10; buildHost = 20; ... }
+    ```
+
+    ```nix
+    # Extract a package from package sets
+    mapCrossIndex (pkgs: pkgs.hello) crossIndexedPackageSets
+    ```
+    :::
+  */
+  mapCrossIndex =
+    f:
+    {
+      buildBuild,
+      buildHost,
+      buildTarget,
+      hostHost,
+      hostTarget,
+      targetTarget,
+    }:
+    {
+      buildBuild = f buildBuild;
+      buildHost = f buildHost;
+      buildTarget = f buildTarget;
+      hostHost = f hostHost;
+      hostTarget = f hostTarget;
+      targetTarget = f targetTarget;
+    };
 }

lib/default.nix

@@ -397,6 +397,9 @@ let
         makeScopeWithSplicing
         makeScopeWithSplicing'
         extendMkDerivation
+        renameCrossIndexFrom
+        renameCrossIndexTo
+        mapCrossIndex
         ;
       inherit (self.derivations) lazyDerivation optionalDrvAttr warnOnInstantiate;
       inherit (self.generators) mkLuaInline;

lib/tests/misc.nix

@@ -4741,4 +4741,82 @@ runTests {
     expected = "/non-existent/this/does/not/exist/for/real/please-dont-mess-with-your-local-fs/default.nix";
   };
 
+  # Tests for cross index utilities
+
+  testRenameCrossIndexFrom = {
+    expr = lib.renameCrossIndexFrom "pkgs" {
+      pkgsBuildBuild = "dummy-build-build";
+      pkgsBuildHost = "dummy-build-host";
+      pkgsBuildTarget = "dummy-build-target";
+      pkgsHostHost = "dummy-host-host";
+      pkgsHostTarget = "dummy-host-target";
+      pkgsTargetTarget = "dummy-target-target";
+    };
+    expected = {
+      buildBuild = "dummy-build-build";
+      buildHost = "dummy-build-host";
+      buildTarget = "dummy-build-target";
+      hostHost = "dummy-host-host";
+      hostTarget = "dummy-host-target";
+      targetTarget = "dummy-target-target";
+    };
+  };
+
+  testRenameCrossIndexTo = {
+    expr = lib.renameCrossIndexTo "self" {
+      buildBuild = "dummy-build-build";
+      buildHost = "dummy-build-host";
+      buildTarget = "dummy-build-target";
+      hostHost = "dummy-host-host";
+      hostTarget = "dummy-host-target";
+      targetTarget = "dummy-target-target";
+    };
+    expected = {
+      selfBuildBuild = "dummy-build-build";
+      selfBuildHost = "dummy-build-host";
+      selfBuildTarget = "dummy-build-target";
+      selfHostHost = "dummy-host-host";
+      selfHostTarget = "dummy-host-target";
+      selfTargetTarget = "dummy-target-target";
+    };
+  };
+
+  testMapCrossIndex = {
+    expr = lib.mapCrossIndex (x: x * 10) {
+      buildBuild = 1;
+      buildHost = 2;
+      buildTarget = 3;
+      hostHost = 4;
+      hostTarget = 5;
+      targetTarget = 6;
+    };
+    expected = {
+      buildBuild = 10;
+      buildHost = 20;
+      buildTarget = 30;
+      hostHost = 40;
+      hostTarget = 50;
+      targetTarget = 60;
+    };
+  };
+
+  testMapCrossIndexString = {
+    expr = lib.mapCrossIndex (x: "prefix-${x}") {
+      buildBuild = "bb";
+      buildHost = "bh";
+      buildTarget = "bt";
+      hostHost = "hh";
+      hostTarget = "ht";
+      targetTarget = "tt";
+    };
+    expected = {
+      buildBuild = "prefix-bb";
+      buildHost = "prefix-bh";
+      buildTarget = "prefix-bt";
+      hostHost = "prefix-hh";
+      hostTarget = "prefix-ht";
+      targetTarget = "prefix-tt";
+    };
+  };
+
 }

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -379,6 +379,8 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - `virtualisation.azure.agent` option provided by `azure-agent.nix` is replaced by `services.waagent`, and will be removed in a future release.
 
+- Netdata removed support for non cloud deployments in version 2, so the `withCloud` option has been removed.
+
 - The ZFS import service now respects `fileSystems.*.options = [ "noauto" ];` and does not add that pool's import service to `zfs-import.target`, meaning it will not be automatically imported at boot.
 
 - Default file names of images generated by several builders in `system.build` have been changed as outlined in the table below.

nixos/modules/security/doas.nix

@@ -7,8 +7,6 @@
 let
   cfg = config.security.doas;
 
-  inherit (pkgs) doas;
-
   mkUsrString = user: toString user;
 
   mkGrpString = group: ":${toString group}";
@@ -67,6 +65,8 @@ in
       '';
     };
 
+    package = lib.mkPackageOption pkgs "doas" { };
+
     wheelNeedsPassword = lib.mkOption {
       type = with lib.types; bool;
       default = true;
@@ -256,11 +256,11 @@ in
       setuid = true;
       owner = "root";
       group = "root";
-      source = "${doas}/bin/doas";
+      source = lib.getExe cfg.package;
     };
 
     environment.systemPackages = [
-      doas
+      cfg.package
     ];
 
     security.pam.services.doas = {

nixos/modules/security/soteria.nix

@@ -36,8 +36,8 @@ in
       wants = [ "graphical-session.target" ];
       after = [ "graphical-session.target" ];
 
+      script = lib.getExe cfg.package;
       serviceConfig = {
-        ExecStart = lib.getExe cfg.package;
         Type = "simple";
         Restart = "on-failure";
         RestartSec = 1;

nixos/modules/services/blockchain/ethereum/geth.nix

@@ -206,43 +206,6 @@ in
           after = [ "network.target" ];
 
           serviceConfig = {
-            ExecStart =
-              let
-                args = lib.cli.toCommandLineShellGNU { } {
-                  inherit (cfg)
-                    syncmode
-                    gcmode
-                    port
-                    maxpeers
-                    ;
-                  nousb = true;
-                  ipcdisable = true;
-                  datadir = dataDir;
-                  ${cfg.network} = true;
-
-                  http = cfg.http.enable;
-                  "http.addr" = if cfg.http.enable then cfg.http.address else null;
-                  "http.port" = if cfg.http.enable then cfg.http.port else null;
-                  "http.api" = if cfg.http.apis != null then lib.concatStringsSep "," cfg.http.apis else null;
-
-                  ws = cfg.websocket.enable;
-                  "ws.addr" = if cfg.websocket.enable then cfg.websocket.address else null;
-                  "ws.port" = if cfg.websocket.enable then cfg.websocket.port else null;
-                  "ws.api" = if cfg.websocket.apis != null then lib.concatStringsSep "," cfg.websocket.apis else null;
-
-                  metrics = cfg.metrics.enable;
-                  "metrics.addr" = if cfg.metrics.enable then cfg.metrics.address else null;
-                  "metrics.port" = if cfg.metrics.enable then cfg.metrics.port else null;
-
-                  "authrpc.addr" = cfg.authrpc.address;
-                  "authrpc.port" = cfg.authrpc.port;
-                  "authrpc.vhosts" = lib.concatStringsSep "," cfg.authrpc.vhosts;
-                  "authrpc.jwtsecret" =
-                    if cfg.authrpc.jwtsecret != "" then cfg.authrpc.jwtsecret else "${dataDir}/geth/jwtsecret";
-                };
-              in
-              "${lib.getExe cfg.package} ${args} ${lib.escapeShellArgs cfg.extraArgs}";
-
             DynamicUser = true;
             Restart = "always";
             StateDirectory = stateDir;
@@ -254,6 +217,37 @@ in
             PrivateDevices = "true";
             MemoryDenyWriteExecute = "true";
           };
+
+          script = ''
+            ${cfg.package}/bin/geth \
+              --nousb \
+              --ipcdisable \
+              ${lib.optionalString (cfg.network != null) ''--${cfg.network}''} \
+              --syncmode ${cfg.syncmode} \
+              --gcmode ${cfg.gcmode} \
+              --port ${toString cfg.port} \
+              --maxpeers ${toString cfg.maxpeers} \
+              ${lib.optionalString cfg.http.enable ''--http --http.addr ${cfg.http.address} --http.port ${toString cfg.http.port}''} \
+              ${
+                lib.optionalString (cfg.http.apis != null) ''--http.api ${lib.concatStringsSep "," cfg.http.apis}''
+              } \
+              ${lib.optionalString cfg.websocket.enable ''--ws --ws.addr ${cfg.websocket.address} --ws.port ${toString cfg.websocket.port}''} \
+              ${
+                lib.optionalString (
+                  cfg.websocket.apis != null
+                ) ''--ws.api ${lib.concatStringsSep "," cfg.websocket.apis}''
+              } \
+              ${lib.optionalString cfg.metrics.enable ''--metrics --metrics.addr ${cfg.metrics.address} --metrics.port ${toString cfg.metrics.port}''} \
+              --authrpc.addr ${cfg.authrpc.address} --authrpc.port ${toString cfg.authrpc.port} --authrpc.vhosts ${lib.concatStringsSep "," cfg.authrpc.vhosts} \
+              ${
+                if (cfg.authrpc.jwtsecret != "") then
+                  ''--authrpc.jwtsecret ${cfg.authrpc.jwtsecret}''
+                else
+                  ''--authrpc.jwtsecret ${dataDir}/geth/jwtsecret''
+              } \
+              ${lib.escapeShellArgs cfg.extraArgs} \
+              --datadir ${dataDir}
+          '';
         }
       ))
     ) eachGeth;

nixos/modules/services/cluster/kubernetes/kubelet.nix

@@ -362,7 +362,6 @@ in
         '';
         serviceConfig = {
           Slice = "kubernetes.slice";
-          CPUAccounting = true;
           MemoryAccounting = true;
           Restart = "on-failure";
           RestartSec = "1000ms";

nixos/modules/services/computing/boinc/client.nix

@@ -99,8 +99,10 @@ in
       description = "BOINC Client";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
+      script = ''
+        exec ${fhsEnvExecutable} --dir ${cfg.dataDir} ${allowRemoteGuiRpcFlag}
+      '';
       serviceConfig = {
-        ExecStart = "${fhsEnvExecutable} --dir ${cfg.dataDir} ${allowRemoteGuiRpcFlag}";
         User = "boinc";
         Nice = 10;
       };

nixos/modules/services/computing/slurm/slurm.nix

@@ -475,13 +475,15 @@ in
             ''}
           '';
 
-          environment.SLURM_CONF = configPath;
+          script = ''
+            export SLURM_CONF=${configPath}
+            exec ${cfg.package}/bin/slurmdbd -D
+          '';
 
           serviceConfig = {
             RuntimeDirectory = "slurmdbd";
             Type = "simple";
             PIDFile = "/run/slurmdbd.pid";
-            ExecStart = "${lib.getExe' cfg.package "slurmdbd"} -D";
             ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
           };
         };

nixos/modules/services/games/minetest-server.nix

@@ -172,9 +172,12 @@ in
       serviceConfig.Restart = "always";
       serviceConfig.User = "minetest";
       serviceConfig.Group = "minetest";
-      serviceConfig.StateDirectory = "minetest";
-      serviceConfig.WorkingDirectory = "/var/lib/minetest";
-      serviceConfig.ExecStart = "${pkgs.minetest}/bin/minetest ${lib.escapeShellArgs flags}";
+
+      script = ''
+        cd /var/lib/minetest
+
+        exec ${pkgs.minetest}/bin/minetest ${lib.escapeShellArgs flags}
+      '';
     };
   };
 }

nixos/modules/services/hardware/pommed.nix

@@ -51,7 +51,7 @@ in
     systemd.services.pommed = {
       description = "Pommed Apple Hotkeys Daemon";
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${lib.getExe pkgs.pommed_light} -f";
+      script = "${pkgs.pommed_light}/bin/pommed -f";
     };
   };
 }

nixos/modules/services/home-automation/zigbee2mqtt.nix

@@ -79,7 +79,6 @@ in
       after = [ "network.target" ];
       environment.ZIGBEE2MQTT_DATA = cfg.dataDir;
       serviceConfig = {
-        ExecStartPre = "${lib.getExe' pkgs.coreutils "cp"} --no-preserve=mode ${configFile} '${cfg.dataDir}/configuration.yaml'";
         ExecStart = "${cfg.package}/bin/zigbee2mqtt";
         User = "zigbee2mqtt";
         Group = "zigbee2mqtt";
@@ -130,6 +129,9 @@ in
         ];
         UMask = "0077";
       };
+      preStart = ''
+        cp --no-preserve=mode ${configFile} "${cfg.dataDir}/configuration.yaml"
+      '';
     };
 
     users.users.zigbee2mqtt = {

nixos/modules/services/logging/heartbeat.nix

@@ -67,10 +67,12 @@ in
     systemd.services.heartbeat = {
       description = "heartbeat log shipper";
       wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -p "${cfg.stateDir}"/{data,logs}
+      '';
       serviceConfig = {
         User = "nobody";
         AmbientCapabilities = "cap_net_raw";
-        ExecStartPre = "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.stateDir}'/data '${cfg.stateDir}'/logs";
         ExecStart = "${cfg.package}/bin/heartbeat -c \"${heartbeatYml}\" -path.data \"${cfg.stateDir}/data\" -path.logs \"${cfg.stateDir}/logs\"";
       };
     };

nixos/modules/services/logging/journalbeat.nix

@@ -71,12 +71,12 @@ in
       wantedBy = [ "multi-user.target" ];
       wants = [ "elasticsearch.service" ];
       after = [ "elasticsearch.service" ];
+      preStart = ''
+        mkdir -p ${cfg.stateDir}/data
+        mkdir -p ${cfg.stateDir}/logs
+      '';
       serviceConfig = {
         StateDirectory = cfg.stateDir;
-        ExecStartPre = [
-          "${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.stateDir}/data"
-          "${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.stateDir}/logs"
-        ];
         ExecStart = ''
           ${cfg.package}/bin/journalbeat \
             -c ${journalbeatYml} \

nixos/modules/services/logging/journaldriver.nix

@@ -91,12 +91,12 @@ in
   config = mkIf cfg.enable {
     systemd.services.journaldriver = {
       description = "Stackdriver Logging journal forwarder";
+      script = "${pkgs.journaldriver}/bin/journaldriver";
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
-        ExecStart = lib.getExe pkgs.journaldriver;
         Restart = "always";
         DynamicUser = true;
 

nixos/modules/services/logging/promtail.nix

@@ -66,11 +66,14 @@ in
       wantedBy = [ "multi-user.target" ];
       stopIfChanged = false;
 
+      preStart = ''
+        ${lib.getExe pkgs.promtail} -config.file=${configFile} -check-syntax
+      '';
+
       serviceConfig = {
         Restart = "on-failure";
         TimeoutStopSec = 10;
 
-        ExecStartPre = "${lib.getExe pkgs.promtail} -config.file=${configFile} -check-syntax";
         ExecStart = "${pkgs.promtail}/bin/promtail -config.file=${configFile} ${escapeShellArgs cfg.extraFlags}";
 
         ProtectSystem = "strict";

nixos/modules/services/logging/syslog-ng.nix

@@ -79,6 +79,7 @@ in
   config = lib.mkIf cfg.enable {
     systemd.services.syslog-ng = {
       description = "syslog-ng daemon";
+      preStart = "mkdir -p /{var,run}/syslog-ng";
       wantedBy = [ "multi-user.target" ];
       after = [ "multi-user.target" ]; # makes sure hostname etc is set
       serviceConfig = {
@@ -86,7 +87,6 @@ in
         PIDFile = pidFile;
         StandardOutput = "null";
         Restart = "on-failure";
-        ExecStartPre = "${lib.getExe' pkgs.coreutils "mkdir"} -p /var/syslog-ng /run/syslog-ng";
         ExecStart = "${cfg.package}/sbin/syslog-ng ${lib.concatStringsSep " " syslogngOptions}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
       };

nixos/modules/services/mail/cyrus-imap.nix

@@ -342,7 +342,6 @@ in
         User = if (cfg.user == null) then "cyrus" else cfg.user;
         Group = if (cfg.group == null) then "cyrus" else cfg.group;
         Type = "simple";
-        ExecStartPre = "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.imapdSettings.configdirectory}/socket' '${cfg.tmpDBDir}' /run/cyrus/proc /run/cyrus/lock";
         ExecStart = "${cyrus-imapdPkg}/libexec/master -l $LISTENQUEUE -C /etc/imapd.conf -M /etc/cyrus.conf -p /run/cyrus/master.pid -D";
         Restart = "on-failure";
         RestartSec = "1s";
@@ -368,6 +367,9 @@ in
         RestrictNamespaces = true;
         RestrictRealtime = true;
       };
+      preStart = ''
+        mkdir -p '${cfg.imapdSettings.configdirectory}/socket' '${cfg.tmpDBDir}' /run/cyrus/proc /run/cyrus/lock
+      '';
     };
     environment.systemPackages = [ cyrus-imapdPkg ];
   };

nixos/modules/services/mail/dkimproxy-out.nix

@@ -109,8 +109,10 @@ in
             chown -R dkimproxy-out:dkimproxy-out "${keydir}"
           fi
         '';
+        script = ''
+          exec ${pkgs.dkimproxy}/bin/dkimproxy.out --conf_file=${configfile}
+        '';
         serviceConfig = {
-          ExecStart = "${pkgs.dkimproxy}/bin/dkimproxy.out --conf_file=${configfile}";
           User = "dkimproxy-out";
           PermissionsStartOnly = true;
         };

nixos/modules/services/mail/nullmailer.nix

@@ -245,13 +245,13 @@
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
 
+        preStart = ''
+          rm -f /var/spool/nullmailer/trigger && mkfifo -m 660 /var/spool/nullmailer/trigger
+        '';
+
         serviceConfig = {
           User = cfg.user;
           Group = cfg.group;
-          ExecStartPre = [
-            "${lib.getExe' pkgs.coreutils "rm"} -f /var/spool/nullmailer/trigger"
-            "${lib.getExe' pkgs.coreutils "mkfifo"} -m 660 /var/spool/nullmailer/trigger"
-          ];
           ExecStart = "${pkgs.nullmailer}/bin/nullmailer-send";
           Restart = "always";
         };

nixos/modules/services/mail/postgrey.nix

@@ -210,13 +210,13 @@ in
         description = "Postfix Greylisting Service";
         wantedBy = [ "multi-user.target" ];
         before = [ "postfix.service" ];
+        preStart = ''
+          mkdir -p /var/postgrey
+          chown postgrey:postgrey /var/postgrey
+          chmod 0770 /var/postgrey
+        '';
         serviceConfig = {
           Type = "simple";
-          ExecStartPre = [
-            "${lib.getExe' pkgs.coreutils "mkdir"} -p /var/postgrey"
-            "${lib.getExe' pkgs.coreutils "chown"} postgrey:postgrey /var/postgrey"
-            "${lib.getExe' pkgs.coreutils "chmod"} 0770 /var/postgrey"
-          ];
           ExecStart = ''
             ${pkgs.postgrey}/bin/postgrey \
                       ${bind-flag} \

nixos/modules/services/mail/stalwart-mail.nix

@@ -162,16 +162,17 @@ in
           "network.target"
         ];
 
+        preStart =
+          if useLegacyStorage then
+            ''
+              mkdir -p ${cfg.dataDir}/data/blobs
+            ''
+          else
+            ''
+              mkdir -p ${cfg.dataDir}/db
+            '';
+
         serviceConfig = {
-          ExecStartPre =
-            if useLegacyStorage then
-              ''
-                ${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.dataDir}/data/blobs
-              ''
-            else
-              ''
-                ${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.dataDir}/db
-              '';
           ExecStart = [
             ""
             "${lib.getExe cfg.package} --config=${configFile}"

nixos/modules/services/misc/autofs.nix

@@ -88,11 +88,14 @@ in
       wants = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
+      preStart = ''
+        # There should be only one autofs service managed by systemd, so this should be safe.
+        rm -f /tmp/autofs-running
+      '';
+
       serviceConfig = {
         Type = "forking";
         PIDFile = "/run/autofs.pid";
-        # There should be only one autofs service managed by systemd, so this should be safe.
-        ExecStartPre = "${lib.getExe' pkgs.coreutils "rm"} -f /tmp/autofs-running";
         ExecStart = "${pkgs.autofs5}/bin/automount ${lib.optionalString cfg.debug "-d"} -p /run/autofs.pid -t ${builtins.toString cfg.timeout} ${autoMaster}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
       };

nixos/modules/services/misc/dictd.nix

@@ -78,7 +78,7 @@ in
         # with code 143 instead of exiting with code 0.
         serviceConfig.SuccessExitStatus = [ 143 ];
         serviceConfig.Type = "forking";
-        serviceConfig.ExecStart = "${pkgs.dict}/sbin/dictd -s -c ${dictdb}/share/dictd/dictd.conf --locale en_US.UTF-8";
+        script = "${pkgs.dict}/sbin/dictd -s -c ${dictdb}/share/dictd/dictd.conf --locale en_US.UTF-8";
       };
     };
 }

nixos/modules/services/misc/docker-registry.nix

@@ -143,9 +143,11 @@ in
       description = "Docker Container Registry";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
+      script = ''
+        ${cfg.package}/bin/registry serve ${configFile}
+      '';
 
       serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} serve ${configFile}";
         User = "docker-registry";
         WorkingDirectory = cfg.storagePath;
         AmbientCapabilities = lib.mkIf (cfg.port < 1024) "cap_net_bind_service";

nixos/modules/services/misc/errbot.nix

@@ -100,13 +100,13 @@ in
         {
           after = [ "network-online.target" ];
           wantedBy = [ "multi-user.target" ];
+          preStart = ''
+            mkdir -p ${dataDir}
+            chown -R errbot:errbot ${dataDir}
+          '';
           serviceConfig = {
             User = "errbot";
             Restart = "on-failure";
-            ExecStartPre = [
-              "${lib.getExe' pkgs.coreutils "mkdir"} -p ${dataDir}"
-              "${lib.getExe' pkgs.coreutils "chown"} -R errbot:errbot ${dataDir}"
-            ];
             ExecStart = "${pkgs.errbot}/bin/errbot -c ${mkConfigDir instanceCfg dataDir}/config.py";
             PermissionsStartOnly = true;
           };

nixos/modules/services/misc/gollum.nix

@@ -138,13 +138,17 @@ in
       description = "Gollum wiki";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
+      path = [ pkgs.git ];
+
+      preStart = ''
+        # This is safe to be run on an existing repo
+        git init ${cfg.stateDir}
+      '';
 
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
         WorkingDirectory = cfg.stateDir;
-        # This is safe to be run on an existing repo
-        ExecStartPre = "${lib.getExe pkgs.git} init ${cfg.stateDir}";
         ExecStart = ''
           ${cfg.package}/bin/gollum \
             --port ${toString cfg.port} \

nixos/modules/services/misc/paperless.nix

@@ -664,9 +664,6 @@ in
           serviceConfig = {
             User = cfg.user;
             WorkingDirectory = cfg.dataDir;
-            ExecStart = "${manage}/bin/paperless-manage document_exporter ${cfg.exporter.directory} ${
-              lib.cli.toCommandLineShellGNU { } cfg.exporter.settings
-            }";
           };
           unitConfig =
             let
@@ -685,7 +682,13 @@ in
               OnFailure = services;
               OnSuccess = services;
             };
+          enableStrictShellChecks = true;
           path = [ manage ];
+          script = ''
+            paperless-manage document_exporter ${cfg.exporter.directory} ${
+              lib.cli.toCommandLineShellGNU { } cfg.exporter.settings
+            }
+          '';
         };
       })
     ]

nixos/modules/services/misc/svnserve.nix

@@ -40,8 +40,8 @@ in
     systemd.services.svnserve = {
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      services.ExecStartPre = "${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.svnBaseDir}";
-      services.ExecStart = "${pkgs.subversion.out}/bin/svnserve -r ${cfg.svnBaseDir} -d --foreground --pid-file=/run/svnserve.pid";
+      preStart = "mkdir -p ${cfg.svnBaseDir}";
+      script = "${pkgs.subversion.out}/bin/svnserve -r ${cfg.svnBaseDir} -d --foreground --pid-file=/run/svnserve.pid";
     };
   };
 }

nixos/modules/services/misc/tandoor-recipes.nix

@@ -119,12 +119,6 @@ in
       after = lib.optional cfg.database.createLocally "postgresql.target";
 
       serviceConfig = {
-        ExecStartPre = [
-          "${lib.getExe' pkgs.coreutils "ln"} -sf ${manage} tandoor-recipes-manage"
-
-          # Let django migrate the DB as needed
-          "${lib.getExe pkg} migrate"
-        ];
         ExecStart = ''
           ${pkg.python.pkgs.gunicorn}/bin/gunicorn recipes.wsgi
         '';
@@ -178,6 +172,13 @@ in
 
       wantedBy = [ "multi-user.target" ];
 
+      preStart = ''
+        ln -sf ${manage} tandoor-recipes-manage
+
+        # Let django migrate the DB as needed
+        ${pkg}/bin/tandoor-recipes migrate
+      '';
+
       environment = env // {
         PYTHONPATH = "${pkg.python.pkgs.makePythonPath pkg.propagatedBuildInputs}:${pkg}/lib/tandoor-recipes";
       };

nixos/modules/services/monitoring/prometheus/exporters/pgbouncer.nix

@@ -139,9 +139,9 @@ in
 
   serviceOpts = {
     after = [ "pgbouncer.service" ];
-    serviceConfig.ExecStart = concatStringsSep " " (
+    script = concatStringsSep " " (
       [
-        "${escapeShellArg (getExe cfg.package)}"
+        "exec -- ${escapeShellArg (getExe cfg.package)}"
         "--web.listen-address ${cfg.listenAddress}:${toString cfg.port}"
       ]
       ++ optionals (cfg.connectionString != null) [

nixos/modules/services/networking/dnscache.nix

@@ -108,16 +108,17 @@ in
         daemontools
         djbdns
       ];
-      environment.FORWARDONLY = lib.mkIf cfg.forwardOnly "1";
       preStart = ''
         rm -rf /var/lib/dnscache
         dnscache-conf dnscache dnscache /var/lib/dnscache ${config.services.dnscache.ip}
         rm -rf /var/lib/dnscache/root
         ln -sf ${dnscache-root} /var/lib/dnscache/root
       '';
-      serviceConfig.StateDirectory = "dnscache";
-      serviceConfig.WorkingDirectory = "/var/lib/dnscache";
-      serviceConfig.ExecStart = "/var/lib/dnscache/run";
+      script = ''
+        cd /var/lib/dnscache/
+        ${lib.optionalString cfg.forwardOnly "export FORWARDONLY=1"}
+        exec ./run
+      '';
     };
   };
 }

nixos/modules/services/networking/freeradius.nix

@@ -13,9 +13,11 @@ let
     wantedBy = [ "multi-user.target" ];
     after = [ "network.target" ];
     wants = [ "network.target" ];
+    preStart = ''
+      ${cfg.package}/bin/radiusd -C -d ${cfg.configDir} -l stdout
+    '';
 
     serviceConfig = {
-      ExecStartPre = "${cfg.package}/bin/radiusd -C -d ${cfg.configDir} -l stdout";
       ExecStart =
         "${cfg.package}/bin/radiusd -f -d ${cfg.configDir} -l stdout" + lib.optionalString cfg.debug " -xx";
       ExecReload = [

nixos/modules/services/networking/ircd-hybrid/default.nix

@@ -152,7 +152,7 @@ in
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${ircdService}/bin/control start";
+      script = "${ircdService}/bin/control start";
     };
   };
 }

nixos/modules/services/networking/ncps.nix

@@ -275,9 +275,12 @@ in
       wants = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
+      preStart = ''
+        ${lib.getExe cfg.dbmatePackage} --migrations-dir=${cfg.package}/share/ncps/db/migrations --url=${cfg.cache.databaseURL} up
+      '';
+
       serviceConfig = lib.mkMerge [
         {
-          ExecStartPre = "${lib.getExe cfg.dbmatePackage} --migrations-dir=${cfg.package}/share/ncps/db/migrations --url=${cfg.cache.databaseURL} up";
           ExecStart = "${lib.getExe cfg.package} ${globalFlags} serve ${serveFlags}";
           User = "ncps";
           Group = "ncps";

nixos/modules/services/networking/nghttpx/default.nix

@@ -115,9 +115,11 @@ in
       nghttpx = {
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
+        script = ''
+          ${pkgs.nghttp2}/bin/nghttpx --conf=${configurationFile}
+        '';
 
         serviceConfig = {
-          ExecStart = "${pkgs.nghttp2}/bin/nghttpx --conf=${configurationFile}";
           Restart = "on-failure";
           RestartSec = 60;
         };

nixos/modules/services/networking/nm-file-secret-agent.nix

@@ -125,7 +125,7 @@ in
       after = [ "NetworkManager.service" ];
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ nmFileSecretAgentConfigFile ];
-      serviceConfig.ExecStart = "${lib.getExe cfg.ensureProfiles.secrets.package} --conf ${nmFileSecretAgentConfigFile}";
+      script = "${lib.getExe cfg.ensureProfiles.secrets.package} --conf ${nmFileSecretAgentConfigFile}";
     };
   };
 }

nixos/modules/services/networking/oidentd.nix

@@ -32,7 +32,7 @@ with lib;
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig.Type = "forking";
-      serviceConfig.ExecStart = "${lib.getExe pkgs.oidentd} -u oidentd -g nogroup";
+      script = "${pkgs.oidentd}/sbin/oidentd -u oidentd -g nogroup";
     };
 
     users.users.oidentd = {

nixos/modules/services/networking/oink.nix

@@ -84,8 +84,8 @@ in
       description = "Dynamic DNS client for Porkbun";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
+      script = "${cfg.package}/bin/oink -c ${oinkConfig}";
       serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} -c ${oinkConfig}";
         Restart = "on-failure";
         RestartSec = "10";
       };

nixos/modules/services/networking/opengfw.nix

@@ -374,22 +374,21 @@ in
         after = [ "network.target" ];
         path = with pkgs; [ iptables ];
 
+        preStart = ''
+          ${optionalString (rules != null) "ln -sf ${rules} rules.yaml"}
+          ${optionalString (settings != null) "ln -sf ${settings} config.yaml"}
+        '';
+
+        script = ''
+          ${config.security.wrapperDir}/OpenGFW \
+            -f ${cfg.logFormat} \
+            -l ${cfg.logLevel} \
+            ${optionalString (cfg.pcapReplay != null) "-p ${cfg.pcapReplay}"} \
+            -c config.yaml \
+            rules.yaml
+        '';
+
         serviceConfig = rec {
-          ExecStartPre =
-            lib.optionals (rules != null) [ "${lib.getExe' pkgs.coreutils "ln"} -sf ${rules} rules.yaml" ]
-            ++ lib.optionals (settings != null) [
-              "${lib.getExe' pkgs.coreutils "ln"} -sf ${settings} config.yaml"
-            ];
-          ExecStart =
-            let
-              args = lib.cli.toCommandLineShellGNU { } {
-                f = cfg.logFormat;
-                l = cfg.logLevel;
-                p = cfg.pcapReplay;
-                c = "config.yaml";
-              };
-            in
-            "${config.security.wrapperDir}/OpenGFW ${args} rules.yaml";
           WorkingDirectory = cfg.dir;
           ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID";
           Restart = "always";

nixos/modules/services/networking/ostinato.nix

@@ -108,7 +108,9 @@ in
     systemd.services.drone = {
       description = "Ostinato agent-controller";
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${pkg}/bin/drone ${toString cfg.port} ${configFile}";
+      script = ''
+        ${pkg}/bin/drone ${toString cfg.port} ${configFile}
+      '';
     };
 
   };

nixos/modules/services/networking/pangolin.nix

@@ -241,6 +241,11 @@ in
           requires = [ "network.target" ];
           after = [ "network.target" ];
 
+          preStart = ''
+            mkdir -p ${cfg.dataDir}/config
+            cp -f ${cfgFile} ${cfg.dataDir}/config/config.yml
+          '';
+
           serviceConfig = {
             User = "pangolin";
             Group = "fossorial";
@@ -312,11 +317,6 @@ in
               "~@swap:EPERM"
               "~@timer:EPERM"
             ];
-
-            ExecStartPre = [
-              "${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.dataDir}/config"
-              "${lib.getExe' pkgs.coreutils "cp"} -f ${cfgFile} ${cfg.dataDir}/config/config.yml"
-            ];
             ExecStart = lib.getExe cfg.package;
           };
         };

nixos/modules/services/networking/pdnsd.nix

@@ -80,13 +80,13 @@ in
     systemd.services.pdnsd = {
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
+      preStart = ''
+        mkdir -p "${cfg.cacheDir}"
+        touch "${cfg.cacheDir}/pdnsd.cache"
+        chown -R ${pdnsdUser}:${pdnsdGroup} "${cfg.cacheDir}"
+      '';
       description = "pdnsd";
       serviceConfig = {
-        ExecStartPre = [
-          "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.cacheDir}'"
-          "${lib.getExe' pkgs.coreutils "touch"} '${cfg.cacheDir}/pdnsd.cache'"
-          "${lib.getExe' pkgs.coreutils "chown"} -R ${pdnsdUser}:${pdnsdGroup} '${cfg.cacheDir}'"
-        ];
         ExecStart = "${pdnsd}/bin/pdnsd -c ${pdnsdConf}";
       };
     };

nixos/modules/services/networking/redsocks.nix

@@ -276,7 +276,7 @@ in
         description = "Redsocks";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
-        serviceConfig.ExecStart = "${lib.getExe pkgs.redsocks} -c ${configfile}";
+        script = "${pkgs.redsocks}/bin/redsocks -c ${configfile}";
       };
 
       networking.firewall.extraCommands = iptables;

nixos/modules/services/networking/smokeping.nix

@@ -337,12 +337,12 @@ in
       serviceConfig = {
         User = cfg.user;
         Restart = "on-failure";
-        ExecStartPre = [
-          "${cfg.package}/bin/smokeping --check --config=${configPath}"
-          "${cfg.package}/bin/smokeping --static --config=${configPath}"
-        ];
         ExecStart = "${cfg.package}/bin/smokeping --config=/etc/smokeping.conf --nodaemon";
       };
+      preStart = ''
+        ${cfg.package}/bin/smokeping --check --config=${configPath}
+        ${cfg.package}/bin/smokeping --static --config=${configPath}
+      '';
     };
 
     systemd.tmpfiles.rules = [

nixos/modules/services/networking/supybot.nix

@@ -104,12 +104,14 @@ in
       documentation = [ "https://limnoria.readthedocs.io/" ];
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        # This needs to be created afresh every time
+        rm -f '${cfg.stateDir}/supybot.cfg.bak'
+      '';
 
       startLimitIntervalSec = 5 * 60; # 5 min
       startLimitBurst = 1;
       serviceConfig = {
-        # This needs to be created afresh every time
-        ExecStartPre = "${lib.getExe' pkgs.coreutils "rm"} -f '${cfg.stateDir}/supybot.cfg.bak'";
         ExecStart = "${pyEnv}/bin/supybot ${cfg.stateDir}/supybot.cfg";
         PIDFile = "/run/supybot.pid";
         User = "supybot";

nixos/modules/services/networking/tailscale.nix

@@ -240,8 +240,10 @@ in
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         Type = "oneshot";
-        ExecStart = "${lib.getExe cfg.package} set ${escapeShellArgs cfg.extraSetFlags}";
       };
+      script = ''
+        ${lib.getExe cfg.package} set ${escapeShellArgs cfg.extraSetFlags}
+      '';
     };
 
     boot.kernel.sysctl = mkIf (cfg.useRoutingFeatures == "server" || cfg.useRoutingFeatures == "both") {

nixos/modules/services/networking/thelounge.nix

@@ -112,11 +112,11 @@ in
     systemd.services.thelounge = {
       description = "The Lounge web IRC client";
       wantedBy = [ "multi-user.target" ];
+      preStart = "ln -sf ${pkgs.writeText "config.js" configJsData} ${dataDir}/config.js";
       environment.THELOUNGE_PACKAGES = mkIf (cfg.plugins != [ ]) "${plugins}";
       serviceConfig = {
         User = "thelounge";
         StateDirectory = baseNameOf dataDir;
-        ExecStartPre = "${lib.getExe' pkgs.coreutils "ln"} -sf ${pkgs.writeText "config.js" configJsData} ${dataDir}/config.js";
         ExecStart = "${getExe cfg.package} start";
       };
     };

nixos/modules/services/networking/tinydns.nix

@@ -58,11 +58,10 @@ with lib;
         ln -sf ${pkgs.writeText "tinydns-data" config.services.tinydns.data} data
         tinydns-data
       '';
-      serviceConfig = {
-        StateDirectory = "tinydns";
-        WorkingDirectory = "/var/lib/tinydns";
-        ExecStart = "/var/lib/tinydns/run";
-      };
+      script = ''
+        cd /var/lib/tinydns
+        exec ./run
+      '';
     };
   };
 }

nixos/modules/services/networking/toxvpn.nix

@@ -43,19 +43,20 @@ with lib;
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
 
+      preStart = ''
+        mkdir -p /run/toxvpn || true
+        chown toxvpn /run/toxvpn
+      '';
+
+      path = [ pkgs.toxvpn ];
+
+      script = ''
+        exec toxvpn -i ${config.services.toxvpn.localip} -l /run/toxvpn/control -u toxvpn -p ${toString config.services.toxvpn.port} ${
+          lib.concatMapStringsSep " " (x: "-a ${x}") config.services.toxvpn.auto_add_peers
+        }
+      '';
+
       serviceConfig = {
-        ExecStart =
-          let
-            args = lib.cli.toCommandLineShellGNU { } {
-              i = config.services.toxvpn.localip;
-              l = "/run/toxvpn/control";
-              u = "toxvpn";
-              p = config.services.toxvpn.port;
-              a = config.services.toxvpn.auto_add_peers;
-            };
-          in
-          "${lib.getExe pkgs.toxvpn} ${args}";
-        RuntimeDirectory = "toxvpn";
         KillMode = "process";
         Restart = "on-success";
         Type = "notify";

nixos/modules/services/networking/twingate.nix

@@ -17,7 +17,7 @@ in
   config = lib.mkIf cfg.enable {
     systemd.packages = [ cfg.package ];
     systemd.services.twingate = {
-      serviceConfig.ExecStartPre = "${lib.getExe' pkgs.coreutils "cp"} -r --update=none ${cfg.package}/etc/twingate/. /etc/twingate/";
+      preStart = "cp -r --update=none ${cfg.package}/etc/twingate/. /etc/twingate/";
       wantedBy = [ "multi-user.target" ];
     };
 

nixos/modules/services/networking/xinetd.nix

@@ -143,7 +143,8 @@ in
       description = "xinetd server";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${lib.getExe pkgs.xinetd} -syslog daemon -dontfork -stayalive -f ${configFile}";
+      path = [ pkgs.xinetd ];
+      script = "exec xinetd -syslog daemon -dontfork -stayalive -f ${configFile}";
     };
   };
 }

nixos/modules/services/networking/xray.nix

@@ -93,8 +93,10 @@ with lib;
         description = "xray Daemon";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
+        script = ''
+          exec "${cfg.package}/bin/xray" -config "$CREDENTIALS_DIRECTORY/config.json"
+        '';
         serviceConfig = {
-          ExecStart = "${cfg.package}/bin/xray -config %d/config.json";
           DynamicUser = true;
           LoadCredential = "config.json:${settingsFile}";
           CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";

nixos/modules/services/networking/zerobin.nix

@@ -91,14 +91,14 @@ in
       enable = true;
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStartPre = [
-        "${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.dataDir}"
-        "${lib.getExe' pkgs.coreutils "chown"} ${cfg.user} ${cfg.dataDir}"
-      ];
       serviceConfig.ExecStart = "${pkgs.zerobin}/bin/zerobin ${cfg.listenAddress} ${toString cfg.listenPort} false ${cfg.user} ${cfg.group} ${zerobin_config}";
       serviceConfig.PrivateTmp = "yes";
       serviceConfig.User = cfg.user;
       serviceConfig.Group = cfg.group;
+      preStart = ''
+        mkdir -p ${cfg.dataDir}
+        chown ${cfg.user} ${cfg.dataDir}
+      '';
     };
   };
 }

nixos/modules/services/scheduling/prefect.nix

@@ -173,7 +173,6 @@ in
           ProtectKernelLogs = true;
           ProtectControlGroups = true;
           MemoryAccounting = true;
-          CPUAccounting = true;
 
           ExecStart = "${pkgs.prefect}/bin/prefect server start --host ${cfg.host} --port ${toString cfg.port}";
           Restart = "always";
@@ -216,7 +215,6 @@ in
           ProtectKernelLogs = true;
           ProtectControlGroups = true;
           MemoryAccounting = true;
-          CPUAccounting = true;
           ExecStart = ''
             ${pkgs.prefect}/bin/prefect worker start \
               --pool ${poolName} \

nixos/modules/services/security/authelia.nix

@@ -375,10 +375,10 @@ in
             })
             // instance.environmentVariables;
 
+          preStart = "${execCommand} ${configArg} validate-config";
           serviceConfig = {
             User = instance.user;
             Group = instance.group;
-            ExecStartPre = "${execCommand} ${configArg} validate-config";
             ExecStart = "${execCommand} ${configArg}";
             Restart = "always";
             RestartSec = "5s";

nixos/modules/services/security/certmgr.nix

@@ -34,6 +34,11 @@ let
         [ spec ]
     ) (lib.attrValues cfg.specs)
   );
+
+  preStart = ''
+    ${lib.concatStringsSep " \\\n" ([ "mkdir -p" ] ++ map lib.escapeShellArg specPaths)}
+    ${cfg.package}/bin/certmgr -f ${certmgrYaml} check
+  '';
 in
 {
   options.services.certmgr = {
@@ -210,14 +215,11 @@ in
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
+      inherit preStart;
 
       serviceConfig = {
         Restart = "always";
         RestartSec = "10s";
-        ExecStartPre = [
-          "${lib.getExe' pkgs.coreutils "mkdir"} -p ${lib.escapeShellArgs specPaths}"
-          "${lib.getExe cfg.package} -f ${certmgrYaml} check"
-        ];
         ExecStart = "${cfg.package}/bin/certmgr -f ${certmgrYaml}";
       };
     };

nixos/modules/services/security/hologram-agent.nix

@@ -55,8 +55,10 @@ in
         "network-link-dummy0.service"
         "network-addresses-dummy0.service"
       ];
+      preStart = ''
+        /run/current-system/sw/bin/rm -fv /run/hologram.sock
+      '';
       serviceConfig = {
-        ExecStartPre = "/run/current-system/sw/bin/rm -fv /run/hologram.sock";
         ExecStart = "${pkgs.hologram}/bin/hologram-agent -debug -conf ${cfgFile} -port ${cfg.httpPort}";
       };
     };

nixos/modules/services/web-apps/bluemap.nix

@@ -298,8 +298,10 @@ in
         Type = "oneshot";
         Group = "nginx";
         UMask = "026";
-        ExecStart = "${lib.getExe pkgs.bluemap} -c ${configFolder} -gs -r";
       };
+      script = ''
+        ${lib.getExe pkgs.bluemap} -c ${configFolder} -gs -r
+      '';
     };
 
     systemd.timers."render-bluemap-maps" = lib.mkIf cfg.enableRender {

nixos/modules/services/web-apps/cloudlog.nix

@@ -383,44 +383,37 @@ in
         cloudlog-upload-lotw = {
           description = "Upload QSOs to LoTW if certs have been provided";
           enable = cfg.upload-lotw.enable;
-          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/lotw/lotw_upload";
-          serviceConfig.Type = "oneshot";
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/lotw/lotw_upload";
         };
         cloudlog-update-lotw-users = {
           description = "Update LOTW Users Database";
           enable = cfg.update-lotw-users.enable;
-          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/lotw/load_users";
-          serviceConfig.Type = "oneshot";
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/lotw/load_users";
         };
         cloudlog-update-dok = {
           description = "Update DOK File for autocomplete";
           enable = cfg.update-dok.enable;
-          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_dok";
-          serviceConfig.Type = "oneshot";
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_dok";
         };
         cloudlog-update-clublog-scp = {
           description = "Update Clublog SCP Database File";
           enable = cfg.update-clublog-scp.enable;
-          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_clublog_scp";
-          serviceConfig.Type = "oneshot";
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_clublog_scp";
         };
         cloudlog-update-wwff = {
           description = "Update WWFF File for autocomplete";
           enable = cfg.update-wwff.enable;
-          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_wwff";
-          serviceConfig.Type = "oneshot";
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_wwff";
         };
         cloudlog-upload-qrz = {
           description = "Upload QSOs to QRZ Logbook";
           enable = cfg.upload-qrz.enable;
-          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/qrz/upload";
-          serviceConfig.Type = "oneshot";
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/qrz/upload";
         };
         cloudlog-update-sota = {
           description = "Update SOTA File for autocomplete";
           enable = cfg.update-sota.enable;
-          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_sota";
-          serviceConfig.Type = "oneshot";
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_sota";
         };
       };
       timers = {

nixos/modules/services/web-apps/discourse.nix

@@ -17,7 +17,10 @@ let
   upstreamPostgresqlVersion = lib.getVersion pkgs.postgresql_15;
 
   postgresqlPackage =
-    if config.services.postgresql.enable then config.services.postgresql.package else pkgs.postgresql;
+    if config.services.postgresql.enable then
+      config.services.postgresql.finalPackage
+    else
+      pkgs.postgresql;
 
   postgresqlVersion = lib.getVersion postgresqlPackage;
 
@@ -540,7 +543,7 @@ in
     assertions = [
       {
         assertion = (cfg.database.host != null) -> (cfg.database.passwordFile != null);
-        message = "When services.gitlab.database.host is customized, services.discourse.database.passwordFile must be set!";
+        message = "When services.discourse.database.host is customized, services.discourse.database.passwordFile must be set!";
       }
       {
         assertion = cfg.hostname != "";
@@ -694,6 +697,9 @@ in
 
     services.postgresql = lib.mkIf databaseActuallyCreateLocally {
       enable = true;
+      extensions = ps: [
+        ps.pgvector
+      ];
       ensureUsers = [ { name = "discourse"; } ];
     };
 
@@ -719,6 +725,7 @@ in
           psql -tAc "SELECT 1 FROM pg_database WHERE datname = 'discourse'" | grep -q 1 || psql -tAc 'CREATE DATABASE "discourse" OWNER "discourse"'
           psql '${cfg.database.name}' -tAc "CREATE EXTENSION IF NOT EXISTS pg_trgm"
           psql '${cfg.database.name}' -tAc "CREATE EXTENSION IF NOT EXISTS hstore"
+          psql '${cfg.database.name}' -tAc "CREATE EXTENSION IF NOT EXISTS vector"
         '';
 
         serviceConfig = {
@@ -805,8 +812,11 @@ in
 
           cp -r ${cfg.package}/share/discourse/config.dist/* /run/discourse/config/
           cp -r ${cfg.package}/share/discourse/public.dist/* /run/discourse/public/
+          cp -r ${cfg.package.assets.generated}/* /run/discourse/assets-generated/
           ln -sf /var/lib/discourse/uploads /run/discourse/public/uploads
           ln -sf /var/lib/discourse/backups /run/discourse/public/backups
+          # discourse creates images in this folder, and by default it only has u=rx
+          chmod 750 /run/discourse/public/images
 
           (
               umask u=rwx,g=,o=
@@ -839,6 +849,7 @@ in
           "assets/javascripts/plugins"
           "public"
           "sockets"
+          "assets-generated"
         ];
         RuntimeDirectoryMode = "0750";
         StateDirectory = map (p: "discourse/" + p) [

nixos/modules/services/web-apps/galene.nix

@@ -133,16 +133,19 @@ in
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
+      preStart = ''
+        ${optionalString (cfg.insecure != true && cfg.certFile != null && cfg.keyFile != null) ''
+          install -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.certFile} ${cfg.dataDir}/cert.pem
+          install -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.keyFile} ${cfg.dataDir}/key.pem
+        ''}
+      '';
+
       serviceConfig = mkMerge [
         {
           Type = "simple";
           User = cfg.user;
           Group = cfg.group;
           WorkingDirectory = cfg.stateDir;
-          ExecStartPre = lib.mkIf (cfg.insecure != true && cfg.certFile != null && cfg.keyFile != null) [
-            "${lib.getExe' pkgs.coreutils "install"} -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.certFile} ${cfg.dataDir}/cert.pem"
-            "${lib.getExe' pkgs.coreutils "install"} -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.keyFile} ${cfg.dataDir}/key.pem"
-          ];
           ExecStart = ''
             ${cfg.package}/bin/galene \
             ${optionalString (cfg.insecure) "-insecure"} \

nixos/modules/services/web-apps/glitchtip.nix

@@ -236,8 +236,11 @@ in
         glitchtip = commonService // {
           description = "GlitchTip";
 
+          preStart = ''
+            ${lib.getExe pkg} migrate
+          '';
+
           serviceConfig = commonServiceConfig // {
-            ExecStartPre = "${lib.getExe pkg} migrate";
             ExecStart = ''
               ${lib.getExe python.pkgs.gunicorn} \
                 --bind=${cfg.listenAddress}:${toString cfg.port} \

nixos/modules/services/web-apps/healthchecks.nix

@@ -237,13 +237,14 @@ in
           wantedBy = [ "healthchecks.target" ];
           after = [ "healthchecks-migration.service" ];
 
+          preStart = ''
+            ${pkg}/opt/healthchecks/manage.py collectstatic --no-input
+            ${pkg}/opt/healthchecks/manage.py remove_stale_contenttypes --no-input
+          ''
+          + lib.optionalString (cfg.settings.DEBUG != "True") "${pkg}/opt/healthchecks/manage.py compress";
+
           serviceConfig = commonConfig // {
             Restart = "always";
-            ExecStartPre = [
-              "${pkg}/opt/healthchecks/manage.py collectstatic --no-input"
-              "${pkg}/opt/healthchecks/manage.py remove_stale_contenttypes --no-input"
-            ]
-            ++ lib.optionals (cfg.settings.DEBUG != "True") [ "${pkg}/opt/healthchecks/manage.py compress" ];
             ExecStart = ''
               ${pkgs.python3Packages.gunicorn}/bin/gunicorn hc.wsgi \
                 --bind ${cfg.listenAddress}:${toString cfg.port} \

nixos/modules/services/web-apps/mediagoblin.nix

@@ -310,6 +310,19 @@ in
       in
       {
         mediagoblin-celeryd = lib.recursiveUpdate serviceDefaults {
+          # we cannot change DEFAULT.data_dir inside mediagoblin.ini because of an annoying bug
+          # https://todo.sr.ht/~mediagoblin/mediagoblin/57
+          preStart = ''
+            cp --remove-destination ${
+              pkgs.writeText "mediagoblin.ini" (
+                lib.generators.toINI { } (lib.filterAttrsRecursive (n: v: n != "plugins") cfg.settings)
+                + "\n"
+                + lib.generators.toINI { mkKeyValue = mkSubSectionKeyValue 2; } {
+                  inherit (cfg.settings.mediagoblin) plugins;
+                }
+              )
+            } /var/lib/mediagoblin/mediagoblin.ini
+          '';
           serviceConfig = {
             Environment = [
               "CELERY_CONFIG_MODULE=mediagoblin.init.celery.from_celery"
@@ -318,19 +331,6 @@ in
               "MEDIAGOBLIN_CONFIG=/var/lib/mediagoblin/mediagoblin.ini"
               "PASTE_CONFIG=${pasteConfig}"
             ];
-            # we cannot change DEFAULT.data_dir inside mediagoblin.ini because of an annoying bug
-            # https://todo.sr.ht/~mediagoblin/mediagoblin/57
-            ExecStartPre = ''
-              ${lib.getExe' pkgs.coreutils "cp"} --remove-destination ${
-                pkgs.writeText "mediagoblin.ini" (
-                  lib.generators.toINI { } (lib.filterAttrsRecursive (n: v: n != "plugins") cfg.settings)
-                  + "\n"
-                  + lib.generators.toINI { mkKeyValue = mkSubSectionKeyValue 2; } {
-                    inherit (cfg.settings.mediagoblin) plugins;
-                  }
-                )
-              } /var/lib/mediagoblin/mediagoblin.ini
-            '';
             ExecStart = "${lib.getExe' finalPackage "celery"} worker --loglevel=INFO";
           };
           unitConfig.Description = "MediaGoblin Celery";
@@ -345,16 +345,16 @@ in
             "mediagoblin-celeryd.service"
             "postgresql.target"
           ];
+          preStart = ''
+            cp --remove-destination ${pasteConfig} /var/lib/mediagoblin/paste.ini
+            ${lib.getExe' finalPackage "gmg"} dbupdate
+          '';
           serviceConfig = {
             Environment = [
               "CELERY_ALWAYS_EAGER=false"
               "GI_TYPELIB_PATH=${GI_TYPELIB_PATH}"
               "GST_PLUGIN_PATH=${GST_PLUGIN_PATH}"
             ];
-            ExecStartPre = [
-              "${lib.getExe' pkgs.coreutils "cp"} --remove-destination ${pasteConfig} /var/lib/mediagoblin/paste.ini"
-              "${lib.getExe' finalPackage "gmg"} dbupdate"
-            ];
             ExecStart = "${lib.getExe' finalPackage "paster"} serve /var/lib/mediagoblin/paste.ini";
           };
           unitConfig.Description = "Mediagoblin";

nixos/modules/services/web-apps/miniflux.nix

@@ -18,6 +18,14 @@ let
   cfg = config.services.miniflux;
 
   boolToInt = b: if b then 1 else 0;
+
+  pgbin = "${config.services.postgresql.package}/bin";
+  # The hstore extension is no longer needed as of v2.2.14
+  # and would prevent Miniflux from starting.
+  preStart = pkgs.writeScript "miniflux-pre-start" ''
+    #!${pkgs.runtimeShell}
+    ${pgbin}/psql "miniflux" -c "DROP EXTENSION IF EXISTS hstore"
+  '';
 in
 
 {
@@ -133,9 +141,7 @@ in
       serviceConfig = {
         Type = "oneshot";
         User = config.services.postgresql.superUser;
-        # The hstore extension is no longer needed as of v2.2.14
-        # and would prevent Miniflux from starting.
-        ExecStart = ''${config.services.postgresql.package}/bin/psql "miniflux" -c "DROP EXTENSION IF EXISTS hstore"'';
+        ExecStart = preStart;
       };
     };
 

nixos/modules/services/web-apps/misskey.nix

@@ -326,19 +326,19 @@ in
       environment = {
         MISSKEY_CONFIG_YML = "/run/misskey/default.yml";
       };
+      preStart = ''
+        install -m 700 ${settingsFormat.generate "misskey-config.yml" cfg.settings} /run/misskey/default.yml
+      ''
+      + (lib.optionalString (cfg.database.passwordFile != null) ''
+        ${pkgs.replace-secret}/bin/replace-secret '@DATABASE_PASSWORD@' "${cfg.database.passwordFile}" /run/misskey/default.yml
+      '')
+      + (lib.optionalString (cfg.redis.passwordFile != null) ''
+        ${pkgs.replace-secret}/bin/replace-secret '@REDIS_PASSWORD@' "${cfg.redis.passwordFile}" /run/misskey/default.yml
+      '')
+      + (lib.optionalString (cfg.meilisearch.keyFile != null) ''
+        ${pkgs.replace-secret}/bin/replace-secret '@MEILISEARCH_KEY@' "${cfg.meilisearch.keyFile}" /run/misskey/default.yml
+      '');
       serviceConfig = {
-        ExecStartPre = [
-          "${lib.getExe' pkgs.coreutils "install"} -m 700 ${settingsFormat.generate "misskey-config.yml" cfg.settings} /run/misskey/default.yml"
-        ]
-        ++ (lib.optionals (cfg.database.passwordFile != null) [
-          "${lib.getExe pkgs.replace-secret} '@DATABASE_PASSWORD@' '${cfg.database.passwordFile}' /run/misskey/default.yml"
-        ])
-        ++ (lib.optionals (cfg.redis.passwordFile != null) [
-          "${lib.getExe pkgs.replace-secret} '@REDIS_PASSWORD@' '${cfg.redis.passwordFile}' /run/misskey/default.yml"
-        ])
-        ++ (lib.optionals (cfg.meilisearch.keyFile != null) [
-          "${lib.getExe pkgs.replace-secret} '@MEILISEARCH_KEY@' '${cfg.meilisearch.keyFile}' /run/misskey/default.yml"
-        ]);
         ExecStart = "${cfg.package}/bin/misskey migrateandstart";
         RuntimeDirectory = "misskey";
         RuntimeDirectoryMode = "700";

nixos/modules/services/web-apps/nexus.nix

@@ -142,8 +142,9 @@ in
         fi
       '';
 
+      script = "${cfg.package}/bin/nexus run";
+
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/nexus run";
         User = cfg.user;
         Group = cfg.group;
         PrivateTmp = true;

nixos/modules/services/web-apps/part-db.nix

@@ -200,7 +200,6 @@ in
           requires = [ "postgresql.target" ];
           wantedBy = [ "multi-user.target" ];
           serviceConfig = {
-            ExecStart = "${lib.getExe cfg.phpPackage} ${lib.getExe' cfg.package "console"} doctrine:migrations:migrate --no-interaction";
             Type = "oneshot";
             RemainAfterExit = true;
             User = "part-db";
@@ -208,6 +207,10 @@ in
           restartTriggers = [
             cfg.package
           ];
+          script = ''
+            set -euo pipefail
+            ${lib.getExe cfg.phpPackage} ${lib.getExe' cfg.package "console"} doctrine:migrations:migrate --no-interaction
+          '';
         };
 
         phpfpm-part-db = {

nixos/modules/services/web-apps/peering-manager.nix

@@ -307,8 +307,11 @@ in
           ]
           ++ lib.optionals (cfg.environmentFile != null) [ "peering-manager-config.service" ];
 
+          preStart = ''
+            ${pkg}/bin/peering-manager remove_stale_contenttypes --no-input
+          '';
+
           serviceConfig = {
-            ExecStartPre = "${pkg}/bin/peering-manager remove_stale_contenttypes --no-input";
             ExecStart = ''
               ${pkg.python.pkgs.gunicorn}/bin/gunicorn peering_manager.wsgi \
                 --bind ${cfg.listenAddress}:${toString cfg.port} \

nixos/modules/services/web-apps/silverbullet.nix

@@ -95,6 +95,7 @@ in
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
+      preStart = lib.mkIf (!lib.hasPrefix "/var/lib/" cfg.spaceDir) "mkdir -p '${cfg.spaceDir}'";
       serviceConfig = {
         Type = "simple";
         User = "${cfg.user}";
@@ -103,9 +104,6 @@ in
         StateDirectory = lib.mkIf (lib.hasPrefix "/var/lib/" cfg.spaceDir) (
           lib.last (lib.splitString "/" cfg.spaceDir)
         );
-        ExecStartPre = lib.mkIf (
-          !lib.hasPrefix "/var/lib/" cfg.spaceDir
-        ) "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.spaceDir}'";
         ExecStart =
           "${lib.getExe cfg.package} --port ${toString cfg.listenPort} --hostname '${cfg.listenAddress}' '${cfg.spaceDir}' "
           + lib.concatStringsSep " " cfg.extraArgs;

nixos/modules/services/web-apps/wakapi.nix

@@ -143,6 +143,10 @@ in
       ++ optional (cfg.database.dialect == "postgres") "postgresql.target";
       wantedBy = [ "multi-user.target" ];
 
+      script = ''
+        exec ${getExe cfg.package} -config ${settingsFile}
+      '';
+
       serviceConfig = {
         Environment = mkMerge [
           (mkIf (cfg.passwordSalt != null) "WAKAPI_PASSWORD_SALT=${cfg.passwordSalt}")
@@ -153,8 +157,6 @@ in
           (lib.optional (cfg.passwordSaltFile != null) cfg.passwordSaltFile)
           ++ (lib.optional (cfg.smtpPasswordFile != null) cfg.smtpPasswordFile);
 
-        ExecStart = "${getExe cfg.package} -config ${settingsFile}";
-
         User = config.users.users.wakapi.name;
         Group = config.users.users.wakapi.group;
 

nixos/modules/services/web-servers/h2o/default.nix

@@ -443,7 +443,6 @@ in
       ++ builtins.map (certName: "acme-${certName}.service") acmeCertNames.all;
 
       serviceConfig = {
-        ExecStartPre = "${h2oExe} --mode 'test'";
         ExecStart = "${h2oExe} --mode 'master'";
         ExecReload = [
           "${h2oExe} --mode 'test'"
@@ -484,6 +483,8 @@ in
         AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
         CapabilitiesBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
       };
+
+      preStart = "${h2oExe} --mode 'test'";
     };
 
     # This service waits for all certificates to be available before reloading

nixos/modules/services/web-servers/jboss/default.nix

@@ -93,7 +93,7 @@ in
   config = mkIf config.services.jboss.enable {
     systemd.services.jboss = {
       description = "JBoss server";
-      serviceConfig.ExecStart = "${jbossService}/bin/control start";
+      script = "${jbossService}/bin/control start";
       wantedBy = [ "multi-user.target" ];
     };
   };

nixos/modules/system/boot/systemd/user.nix

@@ -71,7 +71,7 @@ in
     systemd.user.extraConfig = mkOption {
       default = "";
       type = types.lines;
-      example = "DefaultCPUAccounting=yes";
+      example = "DefaultTimeoutStartSec=60";
       description = ''
         Extra config options for systemd user instances. See {manpage}`systemd-user.conf(5)` for
         available options.

nixos/modules/virtualisation/waagent.nix

@@ -370,7 +370,6 @@ in
         Type = "simple";
         Restart = "always";
         Slice = "azure.slice";
-        CPUAccounting = true;
         MemoryAccounting = true;
       };
     };

nixos/tests/all-tests.nix

@@ -14,10 +14,15 @@
 # where said tests are unsupported.
 # Example callTest that just extracts the derivation from the test:
 #   callTest = t: t.test;
-
-with pkgs.lib;
-
 let
+  inherit (pkgs.lib)
+    isAttrs
+    isFunction
+    mapAttrs
+    elem
+    recurseIntoAttrs
+    ;
+
   # TODO: remove when handleTest is gone (make sure nixosTests and nixos/release.nix#tests are unaffected)
   # TODO: when removing, also deprecate `test` attribute in ../lib/testing/run.nix
   discoverTests =
@@ -667,7 +672,7 @@ in
   guacamole-server = runTest ./guacamole-server.nix;
   guix = handleTest ./guix { };
   gvisor = runTest ./gvisor.nix;
-  h2o = import ./web-servers/h2o { inherit recurseIntoAttrs runTest; };
+  h2o = import ./web-servers/h2o { inherit runTest; };
   hadoop = import ./hadoop {
     inherit handleTestOn;
     package = pkgs.hadoop;
@@ -737,13 +742,13 @@ in
   immich-vectorchord-migration = runTest ./web-apps/immich-vectorchord-migration.nix;
   immich-vectorchord-reindex = runTest ./web-apps/immich-vectorchord-reindex.nix;
   incron = runTest ./incron.nix;
-  incus = pkgs.recurseIntoAttrs (
+  incus = recurseIntoAttrs (
     handleTest ./incus {
       lts = false;
       inherit system pkgs;
     }
   );
-  incus-lts = pkgs.recurseIntoAttrs (handleTest ./incus { inherit system pkgs; });
+  incus-lts = recurseIntoAttrs (handleTest ./incus { inherit system pkgs; });
   influxdb = runTest ./influxdb.nix;
   influxdb2 = runTest ./influxdb2.nix;
   initrd-luks-empty-passphrase = runTest ./initrd-luks-empty-passphrase.nix;
@@ -754,7 +759,7 @@ in
   initrdNetwork = runTest ./initrd-network.nix;
   input-remapper = runTest ./input-remapper.nix;
   inspircd = runTest ./inspircd.nix;
-  installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests { });
+  installed-tests = recurseIntoAttrs (handleTest ./installed-tests { });
   installer = handleTest ./installer.nix { };
   installer-systemd-stage-1 = handleTest ./installer-systemd-stage-1.nix { };
   intune = runTest ./intune.nix;
@@ -808,7 +813,7 @@ in
   ksm = runTest ./ksm.nix;
   kthxbye = runTest ./kthxbye.nix;
   kubernetes = handleTestOn [ "x86_64-linux" ] ./kubernetes { };
-  kubo = import ./kubo { inherit recurseIntoAttrs runTest; };
+  kubo = import ./kubo { inherit runTest; };
   lact = runTest ./lact.nix;
   ladybird = runTest ./ladybird.nix;
   languagetool = runTest ./languagetool.nix;
@@ -891,7 +896,7 @@ in
   man = runTest ./man.nix;
   mariadb-galera = handleTest ./mysql/mariadb-galera.nix { };
   marytts = runTest ./marytts.nix;
-  mastodon = pkgs.recurseIntoAttrs (handleTest ./web-apps/mastodon { inherit handleTestOn; });
+  mastodon = recurseIntoAttrs (handleTest ./web-apps/mastodon { inherit handleTestOn; });
   mate = runTest ./mate.nix;
   mate-wayland = runTest ./mate-wayland.nix;
   matomo = runTest ./matomo.nix;
@@ -953,7 +958,7 @@ in
   mopidy = runTest ./mopidy.nix;
   morph-browser = runTest ./morph-browser.nix;
   mosquitto = runTest ./mosquitto.nix;
-  movim = import ./web-apps/movim { inherit recurseIntoAttrs runTest; };
+  movim = import ./web-apps/movim { inherit runTest; };
   mpd = runTest ./mpd.nix;
   mpv = runTest ./mpv.nix;
   mtp = runTest ./mtp.nix;
@@ -1410,7 +1415,7 @@ in
   suricata = runTest ./suricata.nix;
   suwayomi-server = import ./suwayomi-server.nix {
     inherit runTest;
-    lib = pkgs.lib;
+    inherit (pkgs) lib;
   };
   svnserve = runTest ./svnserve.nix;
   swap-file-btrfs = runTest ./swap-file-btrfs.nix;

nixos/tests/discourse.nix

@@ -29,7 +29,7 @@ in
   nodes.discourse =
     { nodes, ... }:
     {
-      virtualisation.memorySize = 2048;
+      virtualisation.memorySize = 4096;
       virtualisation.cores = 4;
       virtualisation.useNixStoreImage = true;
       virtualisation.writableStore = false;

nixos/tests/kubo/default.nix

@@ -1,5 +1,5 @@
-{ recurseIntoAttrs, runTest }:
-recurseIntoAttrs {
+{ lib, runTest }:
+lib.recurseIntoAttrs {
   kubo = runTest ./kubo.nix;
   kubo-fuse = runTest ./kubo-fuse.nix;
 }

nixos/tests/paperless.nix

@@ -116,9 +116,9 @@
           assert "1 timers listed." in timers, "incorrect number of timers"
 
           # Double check that our attrset option override works as expected
-          cmdline = node.succeed("systemctl cat paperless-exporter | grep ExecStart | grep 'paperless-manage' | cut -f 2 -d=")
+          cmdline = node.succeed("grep 'paperless-manage' $(systemctl cat paperless-exporter | grep ExecStart | cut -f 2 -d=)")
           print(f"Exporter command line {cmdline!r}")
-          assert cmdline.strip().endswith("paperless-manage document_exporter /var/lib/paperless/export --compare-checksums --delete --no-progress-bar --no-thumbnail"), "Unexpected exporter command line"
+          assert cmdline.strip() == "paperless-manage document_exporter /var/lib/paperless/export --compare-checksums --delete --no-progress-bar --no-thumbnail", "Unexpected exporter command line"
 
     test_paperless(simple)
     simple.send_monitor_command("quit")

nixos/tests/web-apps/movim/default.nix

@@ -1,6 +1,5 @@
-{ recurseIntoAttrs, runTest }:
-
-recurseIntoAttrs {
+{ lib, runTest }:
+lib.recurseIntoAttrs {
   ejabberd-h2o = runTest ./ejabberd-h2o.nix;
   prosody-nginx = runTest ./prosody-nginx.nix;
 }

nixos/tests/web-servers/h2o/default.nix

@@ -1,6 +1,5 @@
-{ recurseIntoAttrs, runTest }:
-
-recurseIntoAttrs {
+{ lib, runTest }:
+lib.recurseIntoAttrs {
   basic = runTest ./basic.nix;
   mruby = runTest ./mruby.nix;
   tls-recommendations = runTest ./tls-recommendations.nix;

pkgs/applications/editors/emacs/make-emacs.nix

@@ -53,7 +53,6 @@
   ncurses,
   nixosTests,
   pkg-config,
-  recurseIntoAttrs,
   sigtool,
   sqlite,
   replaceVars,
@@ -496,7 +495,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit withNativeCompilation;
     inherit withTreeSitter;
     inherit withXwidgets;
-    pkgs = recurseIntoAttrs (emacsPackagesFor finalAttrs.finalPackage);
+    pkgs = lib.recurseIntoAttrs (emacsPackagesFor finalAttrs.finalPackage);
     tests = {
       inherit (nixosTests) emacs-daemon;
       withPackages = callPackage ./build-support/wrapper-test.nix {

pkgs/applications/editors/neovim/tests/default.nix

@@ -128,7 +128,7 @@ let
     }
   );
 in
-pkgs.recurseIntoAttrs rec {
+pkgs.lib.recurseIntoAttrs rec {
 
   inherit nmt;
 

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -242,12 +242,12 @@
   };
   c3 = buildGrammar {
     language = "c3";
-    version = "0.0.0+rev=057a75d";
+    version = "0.0.0+rev=e457069";
     src = fetchFromGitHub {
       owner = "c3lang";
       repo = "tree-sitter-c3";
-      rev = "057a75df0c866034d8edce989f701ee2cb0481d8";
-      hash = "sha256-MeeyiX9ZozGDbTNbO/Tvs97tQyzic5pu2sIPgXow2ok=";
+      rev = "e4570693b8064a83cd7826795d5ef29400313d3c";
+      hash = "sha256-gzlLKP/BE5sNM8tJ7ObKQNvd36CqWipFWhMkb4XqjjU=";
     };
     meta.homepage = "https://github.com/c3lang/tree-sitter-c3";
   };
@@ -518,14 +518,14 @@
   };
   diff = buildGrammar {
     language = "diff";
-    version = "0.0.0+rev=e42b8de";
+    version = "0.0.0+rev=2520c3f";
     src = fetchFromGitHub {
-      owner = "the-mikedavis";
+      owner = "tree-sitter-grammars";
       repo = "tree-sitter-diff";
-      rev = "e42b8def4f75633568f1aecfe01817bf15164928";
-      hash = "sha256-1ibGin1e6+geAQNoV/KLCBOoXYcZo7S5+Q2XgsZPIfU=";
+      rev = "2520c3f934b3179bb540d23e0ef45f75304b5fed";
+      hash = "sha256-8rYLNGgoZSvvfqO2++nAgFKmvbkKJ3m+9B8bTXp6Us4=";
     };
-    meta.homepage = "https://github.com/the-mikedavis/tree-sitter-diff";
+    meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-diff";
   };
   disassembly = buildGrammar {
     language = "disassembly";
@@ -562,12 +562,12 @@
   };
   dot = buildGrammar {
     language = "dot";
-    version = "0.0.0+rev=71e2c52";
+    version = "0.0.0+rev=80327ab";
     src = fetchFromGitHub {
       owner = "rydesun";
       repo = "tree-sitter-dot";
-      rev = "71e2c5241eef9de920a4efedfefd1d527dd9a118";
-      hash = "sha256-Z1XtNX1zV8xGlsaFbqh2VXPAx0fs4D7JxwqaEWSWcB0=";
+      rev = "80327abbba6f47530edeb0df9f11bd5d5c93c14d";
+      hash = "sha256-sepmaKnpbj/bgMBa06ksQFOMPtcCqGaINiJqFBJN/0Y=";
     };
     meta.homepage = "https://github.com/rydesun/tree-sitter-dot";
   };
@@ -1082,12 +1082,12 @@
   };
   gomod = buildGrammar {
     language = "gomod";
-    version = "0.0.0+rev=6efb596";
+    version = "0.0.0+rev=2e88687";
     src = fetchFromGitHub {
       owner = "camdencheek";
       repo = "tree-sitter-go-mod";
-      rev = "6efb59652d30e0e9cd5f3b3a669afd6f1a926d3c";
-      hash = "sha256-KD6Fio9qie3wbGAvQaYsMdYOK1QjnRrGExt1oL/6mis=";
+      rev = "2e886870578eeba1927a2dc4bd2e2b3f598c5f9a";
+      hash = "sha256-OfhV3lxdyIhA3XZYbafEtdOsQsTCSSCBrN3WbzSVg0g=";
     };
     meta.homepage = "https://github.com/camdencheek/tree-sitter-go-mod";
   };
@@ -1369,23 +1369,23 @@
   };
   hyprlang = buildGrammar {
     language = "hyprlang";
-    version = "0.0.0+rev=d626ec0";
+    version = "0.0.0+rev=b23e85d";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-hyprlang";
-      rev = "d626ec06e4d876fc41200a30b3e6f2b4714c7367";
-      hash = "sha256-f8CjiLd2tof+zfr7ze/CxZWtKRqQv8sK9Q21ZxEg6C8=";
+      rev = "b23e85dded5d150ffee0ac83c01cbeb1520aad2f";
+      hash = "sha256-COIl7ngqTzQQBxgmRNCwF8x7OHNGCrUa5G/hPrlXsmw=";
     };
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-hyprlang";
   };
   idl = buildGrammar {
     language = "idl";
-    version = "0.0.0+rev=3632e92";
+    version = "0.0.0+rev=86d434e";
     src = fetchFromGitHub {
       owner = "cathaysia";
       repo = "tree-sitter-idl";
-      rev = "3632e926ef4ba924b05993683111480af0d5c9e3";
-      hash = "sha256-fywOjqJ0yrG/QayyBXdc2iOtaytdc9bqd1leQ8kxR/0=";
+      rev = "86d434e732f971ecec24571e0dcb6b14c8b19952";
+      hash = "sha256-u+2KBpk9ctry5cHlvqarYS8l5ERFlWrs9D09u2C6cvI=";
     };
     meta.homepage = "https://github.com/cathaysia/tree-sitter-idl";
   };
@@ -1624,12 +1624,12 @@
   };
   kitty = buildGrammar {
     language = "kitty";
-    version = "0.0.0+rev=064d1b4";
+    version = "0.0.0+rev=2e9b602";
     src = fetchFromGitHub {
       owner = "OXY2DEV";
       repo = "tree-sitter-kitty";
-      rev = "064d1b4d8ae1b93244de0ff6bc9f0ee0cffee3b5";
-      hash = "sha256-DN6SWXZM1HedUtV7mDEEgictaI2V/pQHh5cg906qfO0=";
+      rev = "2e9b602ca676cac63887cca5a4535106f3475c82";
+      hash = "sha256-9knYf4/0G8zX2grWJi6U/1TQmUWQCjdMK3Vd/fw93C0=";
     };
     meta.homepage = "https://github.com/OXY2DEV/tree-sitter-kitty";
   };
@@ -1891,12 +1891,12 @@
   };
   mlir = buildGrammar {
     language = "mlir";
-    version = "0.0.0+rev=47c3f2c";
+    version = "0.0.0+rev=6543579";
     src = fetchFromGitHub {
       owner = "artagnon";
       repo = "tree-sitter-mlir";
-      rev = "47c3f2cf3b10016503f2577c2d99c15bb2053402";
-      hash = "sha256-1NmkSEGh6Y9BIGcdW4HrMNdqlKKfVHgcY1Amk4EKf8U=";
+      rev = "65435795eb4132d5eff66d62347050e863e5ebe5";
+      hash = "sha256-s7oNzU7rTjejwgW9F28GayuxEe/Gn51+yQi7iPqgFfw=";
     };
     generate = true;
     meta.homepage = "https://github.com/artagnon/tree-sitter-mlir";
@@ -2692,14 +2692,13 @@
   };
   scfg = buildGrammar {
     language = "scfg";
-    version = "0.0.0+rev=2f3709e";
+    version = "0.0.0+rev=d850fd4";
     src = fetchFromGitHub {
       owner = "rockorager";
       repo = "tree-sitter-scfg";
-      rev = "2f3709e7656fa2c443f92041c91a9f843f8cd625";
-      hash = "sha256-2/n+pSR6Ojahm8iBnpNsQscrXQqzZflKBA42gX29u50=";
+      rev = "d850fd470445d73de318a21d734d1e09e29b773c";
+      hash = "sha256-AnyOcQFA3N6AFZiG7eLS1xCm1qX6hko9lFV4oV9p/E8=";
     };
-    generate = true;
     meta.homepage = "https://github.com/rockorager/tree-sitter-scfg";
   };
   scheme = buildGrammar {

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -3190,6 +3190,7 @@ assertNoAdditions {
       "snacks.dashboard"
       "snacks.debug"
       "snacks.dim"
+      "snacks.explorer.init"
       "snacks.git"
       "snacks.image.convert"
       "snacks.image.image"
@@ -4090,8 +4091,9 @@ assertNoAdditions {
 
   wiki-vim = super.wiki-vim.overrideAttrs {
     checkInputs = [
-      # Optional telescope integration
+      # Optional picker integration
       self.telescope-nvim
+      self.fzf-lua
     ];
   };
 

pkgs/applications/editors/vscode/extensions/betterthantomorrow.calva/default.nix

@@ -11,8 +11,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "calva";
     publisher = "betterthantomorrow";
-    version = "2.0.538";
-    hash = "sha256-lJ9AnTNN9TkPDh9u2KV1BLn/fgZOWSOXNOTAdV+r6s4=";
+    version = "2.0.539";
+    hash = "sha256-nNlEBm89sVQzLMfQjeE4uBUH/bH/mw8mYF+3/JfB78U=";
   };
 
   nativeBuildInputs = [