From eb0189224b96379b7e3d76c2393f989abed44817 Mon Sep 17 00:00:00 2001
From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com>
Date: Fri, 20 Dec 2024 16:24:49 +0200
Subject: [PATCH 01/31] koboldcpp: update `cudaArches` example

---
 pkgs/by-name/ko/koboldcpp/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ko/koboldcpp/package.nix b/pkgs/by-name/ko/koboldcpp/package.nix
index 499c5ddd3fe1..457733e63633 100644
--- a/pkgs/by-name/ko/koboldcpp/package.nix
+++ b/pkgs/by-name/ko/koboldcpp/package.nix
@@ -20,7 +20,7 @@
 
   cublasSupport ? config.cudaSupport,
   # You can find a full list here: https://arnon.dk/matching-sm-architectures-arch-and-gencode-for-various-nvidia-cards/
-  # For example if you're on an GTX 1080 that means you're using "Pascal" and you need to pass "sm_60"
+  # For example if you're on an RTX 3060 that means you're using "Ampere" and you need to pass "sm_86"
   cudaArches ? cudaPackages.cudaFlags.realArches or [ ],
 
   clblastSupport ? stdenv.hostPlatform.isLinux,

From 4bd5e1da37c506ac21862d28064977103fb805df Mon Sep 17 00:00:00 2001
From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com>
Date: Fri, 20 Dec 2024 16:25:30 +0200
Subject: [PATCH 02/31] koboldcpp: remove `gitUpdater`

---
 pkgs/by-name/ko/koboldcpp/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/ko/koboldcpp/package.nix b/pkgs/by-name/ko/koboldcpp/package.nix
index 457733e63633..4ad4ad01a82d 100644
--- a/pkgs/by-name/ko/koboldcpp/package.nix
+++ b/pkgs/by-name/ko/koboldcpp/package.nix
@@ -3,7 +3,6 @@
   fetchFromGitHub,
   stdenv,
   makeWrapper,
-  gitUpdater,
   python3Packages,
   tk,
   addDriverRunpath,

From 415fe80741e2b2b65c4a4d5f9416d34b20cc9c69 Mon Sep 17 00:00:00 2001
From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com>
Date: Fri, 20 Dec 2024 16:26:36 +0200
Subject: [PATCH 03/31] koboldcpp: drop `openblas`

Upstream dropped `openblass` since v1.75
---
 pkgs/by-name/ko/koboldcpp/package.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/by-name/ko/koboldcpp/package.nix b/pkgs/by-name/ko/koboldcpp/package.nix
index 4ad4ad01a82d..3841ec6755c5 100644
--- a/pkgs/by-name/ko/koboldcpp/package.nix
+++ b/pkgs/by-name/ko/koboldcpp/package.nix
@@ -14,9 +14,6 @@
   config,
   cudaPackages ? { },
 
-  openblasSupport ? !stdenv.hostPlatform.isDarwin,
-  openblas,
-
   cublasSupport ? config.cudaSupport,
   # You can find a full list here: https://arnon.dk/matching-sm-architectures-arch-and-gencode-for-various-nvidia-cards/
   # For example if you're on an RTX 3060 that means you're using "Ampere" and you need to pass "sm_86"
@@ -65,7 +62,6 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     [ tk ]
     ++ finalAttrs.pythonInputs
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_12 ]
-    ++ lib.optionals openblasSupport [ openblas ]
     ++ lib.optionals cublasSupport [
       cudaPackages.libcublas
       cudaPackages.cuda_nvcc
@@ -81,7 +77,6 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   pythonPath = finalAttrs.pythonInputs;
 
   makeFlags = [
-    (makeBool "LLAMA_OPENBLAS" openblasSupport)
     (makeBool "LLAMA_CUBLAS" cublasSupport)
     (makeBool "LLAMA_CLBLAST" clblastSupport)
     (makeBool "LLAMA_VULKAN" vulkanSupport)

From 0dae157805a942c99900cc40aa5e907b7c5920dc Mon Sep 17 00:00:00 2001
From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com>
Date: Fri, 20 Dec 2024 14:30:31 +0000
Subject: [PATCH 04/31] koboldcpp: 1.79.1 -> 1.80

Changelog: https://github.com/LostRuins/koboldcpp/releases/tag/v1.80
Diff: https://github.com/LostRuins/koboldcpp/compare/v1.79.1...v1.80
---
 pkgs/by-name/ko/koboldcpp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ko/koboldcpp/package.nix b/pkgs/by-name/ko/koboldcpp/package.nix
index 3841ec6755c5..82f586c958f2 100644
--- a/pkgs/by-name/ko/koboldcpp/package.nix
+++ b/pkgs/by-name/ko/koboldcpp/package.nix
@@ -40,13 +40,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "koboldcpp";
-  version = "1.79.1";
+  version = "1.80";
 
   src = fetchFromGitHub {
     owner = "LostRuins";
     repo = "koboldcpp";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-RHeEI6mJklGF7BQXxLwxSr1xD6GsI9+fio888UxKru0=";
+    hash = "sha256-X91sBw4YmozKwDe9Hzvk4CP3DLvw2Q6XPTBR3TaEwqg=";
   };
 
   enableParallelBuilding = true;

From 093daf148a87aa9a3817a64ea499905fcae70246 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 20 Dec 2024 19:26:45 +0000
Subject: [PATCH 05/31] structorizer: 3.32-23 -> 3.32-24

---
 pkgs/by-name/st/structorizer/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/st/structorizer/package.nix b/pkgs/by-name/st/structorizer/package.nix
index 6b464a467401..c29d388c0c84 100644
--- a/pkgs/by-name/st/structorizer/package.nix
+++ b/pkgs/by-name/st/structorizer/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "structorizer";
-  version = "3.32-23";
+  version = "3.32-24";
 
   desktopItems = [
     (makeDesktopItem {
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     owner = "fesch";
     repo = "Structorizer.Desktop";
     rev = version;
-    hash = "sha256-fqvQH4DRl+R0laGOnfWgFz67JSAdUzrws4k7gmQ3S7A=";
+    hash = "sha256-bzo8lUdjCPf22AF++Q9YnvuQp89M2T1cLixuEDHWX6U=";
   };
 
   patches = [

From e62a47c0c8c1f340066165e1d35dab63f519ce6a Mon Sep 17 00:00:00 2001
From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com>
Date: Fri, 20 Dec 2024 22:03:28 +0200
Subject: [PATCH 06/31] koboldcpp: add `(darwinMinVersionHook "10.15")`

Bump up minimum version, so no APIs are missing
---
 pkgs/by-name/ko/koboldcpp/package.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ko/koboldcpp/package.nix b/pkgs/by-name/ko/koboldcpp/package.nix
index 82f586c958f2..ba67339e9266 100644
--- a/pkgs/by-name/ko/koboldcpp/package.nix
+++ b/pkgs/by-name/ko/koboldcpp/package.nix
@@ -8,6 +8,7 @@
   addDriverRunpath,
 
   apple-sdk_12,
+  darwinMinVersionHook,
 
   koboldLiteSupport ? true,
 
@@ -61,7 +62,10 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   buildInputs =
     [ tk ]
     ++ finalAttrs.pythonInputs
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_12 ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_12
+      (darwinMinVersionHook "10.15")
+    ]
     ++ lib.optionals cublasSupport [
       cudaPackages.libcublas
       cudaPackages.cuda_nvcc

From 1ccd253accfb140acbf9da9f56d9dc6d3aece088 Mon Sep 17 00:00:00 2001
From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com>
Date: Fri, 20 Dec 2024 22:16:27 +0200
Subject: [PATCH 07/31] koboldcpp: disable vulkan for darwin

It's causing build failure
---
 pkgs/by-name/ko/koboldcpp/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ko/koboldcpp/package.nix b/pkgs/by-name/ko/koboldcpp/package.nix
index ba67339e9266..68dfe8237d70 100644
--- a/pkgs/by-name/ko/koboldcpp/package.nix
+++ b/pkgs/by-name/ko/koboldcpp/package.nix
@@ -24,7 +24,7 @@
   clblast,
   ocl-icd,
 
-  vulkanSupport ? true,
+  vulkanSupport ? (!stdenv.hostPlatform.isDarwin),
   vulkan-loader,
   metalSupport ? stdenv.hostPlatform.isDarwin,
   nix-update-script,

From e57e423549cc53355e9f72449bc47501e7f367eb Mon Sep 17 00:00:00 2001
From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com>
Date: Sat, 21 Dec 2024 16:49:02 +0000
Subject: [PATCH 08/31] koboldcpp: 1.80 -> 1.80.1

Changelog: https://github.com/LostRuins/koboldcpp/releases/tag/v1.80.1
Diff: https://github.com/LostRuins/koboldcpp/compare/v1.80...v1.80.1
---
 pkgs/by-name/ko/koboldcpp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ko/koboldcpp/package.nix b/pkgs/by-name/ko/koboldcpp/package.nix
index 68dfe8237d70..1c5b60219bde 100644
--- a/pkgs/by-name/ko/koboldcpp/package.nix
+++ b/pkgs/by-name/ko/koboldcpp/package.nix
@@ -41,13 +41,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "koboldcpp";
-  version = "1.80";
+  version = "1.80.1";
 
   src = fetchFromGitHub {
     owner = "LostRuins";
     repo = "koboldcpp";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-X91sBw4YmozKwDe9Hzvk4CP3DLvw2Q6XPTBR3TaEwqg=";
+    hash = "sha256-CgJzYF8FnHk0zKdysGJWLnNo/MND24AbQdjRbDtv0II=";
   };
 
   enableParallelBuilding = true;

From e130769df50b053d2d25dd9a44e4acfc506ce626 Mon Sep 17 00:00:00 2001
From: oddlama <oddlama@oddlama.org>
Date: Sun, 22 Dec 2024 22:10:46 +0100
Subject: [PATCH 09/31] nixos/hostapd: remove unused imports

---
 nixos/modules/services/networking/hostapd.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/nixos/modules/services/networking/hostapd.nix b/nixos/modules/services/networking/hostapd.nix
index 82ece277f187..091479a7e00b 100644
--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@@ -11,7 +11,6 @@ let
     attrNames
     attrValues
     concatLists
-    concatMap
     concatMapStrings
     concatStringsSep
     count
@@ -34,11 +33,9 @@ let
     mkOption
     mkPackageOption
     mkRemovedOptionModule
-    optional
     optionalAttrs
     optionalString
     optionals
-    singleton
     stringLength
     toLower
     types

From 440a6ea178a27054dcae362405252b9d5a2909fc Mon Sep 17 00:00:00 2001
From: Chatnoir Miki <cmiki@amono.me>
Date: Mon, 23 Dec 2024 15:10:54 +0800
Subject: [PATCH 10/31] sqlitestudio: 3.4.10 -> 3.4.12

---
 pkgs/by-name/sq/sqlitestudio/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sq/sqlitestudio/package.nix b/pkgs/by-name/sq/sqlitestudio/package.nix
index 0dbab2e7c509..3f6f302a5b12 100644
--- a/pkgs/by-name/sq/sqlitestudio/package.nix
+++ b/pkgs/by-name/sq/sqlitestudio/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "sqlitestudio";
-  version = "3.4.10";
+  version = "3.4.12";
 
   src = fetchFromGitHub {
     owner = "pawelsalawa";
     repo = "sqlitestudio";
     rev = version;
-    hash = "sha256-M0k+DpHXl0UA7uGRlAz3ksUk5qI2olz9dd+jmuBZuXU=";
+    hash = "sha256-KPHiJTAxRQ3ZNnkKpfj877vTHEPRKNwy7wHfseftukQ=";
   };
 
   nativeBuildInputs =

From 2dfabce3866aa9d7e445fe69cce3c9a1b14da60f Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 23 Dec 2024 08:43:24 +0100
Subject: [PATCH 11/31] nixos/dolibarr: format

---
 nixos/modules/services/web-apps/dolibarr.nix | 382 +++++++++++--------
 1 file changed, 216 insertions(+), 166 deletions(-)

diff --git a/nixos/modules/services/web-apps/dolibarr.nix b/nixos/modules/services/web-apps/dolibarr.nix
index 3f9f853e3b25..dd2b2f2a12ad 100644
--- a/nixos/modules/services/web-apps/dolibarr.nix
+++ b/nixos/modules/services/web-apps/dolibarr.nix
@@ -1,49 +1,81 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
-  inherit (lib) any boolToString concatStringsSep isBool isString mapAttrsToList mkDefault mkEnableOption mkIf mkMerge mkOption optionalAttrs types mkPackageOption;
+  inherit (lib)
+    any
+    boolToString
+    concatStringsSep
+    isBool
+    isString
+    mapAttrsToList
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkMerge
+    mkOption
+    optionalAttrs
+    types
+    mkPackageOption
+    ;
 
   package = cfg.package.override { inherit (cfg) stateDir; };
 
   cfg = config.services.dolibarr;
   vhostCfg = lib.optionalAttrs (cfg.nginx != null) config.services.nginx.virtualHosts."${cfg.domain}";
 
-  mkConfigFile = filename: settings:
+  mkConfigFile =
+    filename: settings:
     let
       # hack in special logic for secrets so we read them from a separate file avoiding the nix store
-      secretKeys = [ "force_install_databasepass" "dolibarr_main_db_pass" "dolibarr_main_instance_unique_id" ];
+      secretKeys = [
+        "force_install_databasepass"
+        "dolibarr_main_db_pass"
+        "dolibarr_main_instance_unique_id"
+      ];
 
-      toStr = k: v:
-        if (any (str: k == str) secretKeys) then v
-        else if isString v then "'${v}'"
-        else if isBool v then boolToString v
-        else if v == null then "null"
-        else toString v
-      ;
+      toStr =
+        k: v:
+        if (any (str: k == str) secretKeys) then
+          v
+        else if isString v then
+          "'${v}'"
+        else if isBool v then
+          boolToString v
+        else if v == null then
+          "null"
+        else
+          toString v;
     in
-      pkgs.writeText filename ''
-        <?php
-        ${concatStringsSep "\n" (mapAttrsToList (k: v: "\$${k} = ${toStr k v};") settings)}
-      '';
+    pkgs.writeText filename ''
+      <?php
+      ${concatStringsSep "\n" (mapAttrsToList (k: v: "\$${k} = ${toStr k v};") settings)}
+    '';
 
   # see https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/install/install.forced.sample.php for all possible values
-  install = {
-    force_install_noedit = 2;
-    force_install_main_data_root = "${cfg.stateDir}/documents";
-    force_install_nophpinfo = true;
-    force_install_lockinstall = "444";
-    force_install_distrib = "nixos";
-    force_install_type = "mysqli";
-    force_install_dbserver = cfg.database.host;
-    force_install_port = toString cfg.database.port;
-    force_install_database = cfg.database.name;
-    force_install_databaselogin = cfg.database.user;
+  install =
+    {
+      force_install_noedit = 2;
+      force_install_main_data_root = "${cfg.stateDir}/documents";
+      force_install_nophpinfo = true;
+      force_install_lockinstall = "444";
+      force_install_distrib = "nixos";
+      force_install_type = "mysqli";
+      force_install_dbserver = cfg.database.host;
+      force_install_port = toString cfg.database.port;
+      force_install_database = cfg.database.name;
+      force_install_databaselogin = cfg.database.user;
 
-    force_install_mainforcehttps = vhostCfg.forceSSL or false;
-    force_install_createuser = false;
-    force_install_dolibarrlogin = null;
-  } // optionalAttrs (cfg.database.passwordFile != null) {
-    force_install_databasepass = ''file_get_contents("${cfg.database.passwordFile}")'';
-  };
+      force_install_mainforcehttps = vhostCfg.forceSSL or false;
+      force_install_createuser = false;
+      force_install_dolibarrlogin = null;
+    }
+    // optionalAttrs (cfg.database.passwordFile != null) {
+      force_install_databasepass = ''file_get_contents("${cfg.database.passwordFile}")'';
+    };
 in
 {
   # interface
@@ -131,22 +163,28 @@ in
     };
 
     settings = mkOption {
-      type = with types; (attrsOf (oneOf [ bool int str ]));
+      type =
+        with types;
+        (attrsOf (oneOf [
+          bool
+          int
+          str
+        ]));
       default = { };
       description = "Dolibarr settings, see <https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/conf/conf.php.example> for details.";
     };
 
     nginx = mkOption {
-      type = types.nullOr (types.submodule (
-        lib.recursiveUpdate
-          (import ../web-servers/nginx/vhost-options.nix { inherit config lib; })
-          {
+      type = types.nullOr (
+        types.submodule (
+          lib.recursiveUpdate (import ../web-servers/nginx/vhost-options.nix { inherit config lib; }) {
             # enable encryption by default,
             # as sensitive login and Dolibarr (ERP) data should not be transmitted in clear text.
             options.forceSSL.default = true;
             options.enableACME.default = true;
           }
-      ));
+        )
+      );
       default = null;
       example = lib.literalExpression ''
         {
@@ -158,17 +196,23 @@ in
         }
       '';
       description = ''
-          With this option, you can customize an nginx virtual host which already has sensible defaults for Dolibarr.
-          Set to {} if you do not need any customization to the virtual host.
-          If enabled, then by default, the {option}`serverName` is
-          `''${domain}`,
-          SSL is active, and certificates are acquired via ACME.
-          If this is set to null (the default), no nginx virtualHost will be configured.
+        With this option, you can customize an nginx virtual host which already has sensible defaults for Dolibarr.
+        Set to {} if you do not need any customization to the virtual host.
+        If enabled, then by default, the {option}`serverName` is
+        `''${domain}`,
+        SSL is active, and certificates are acquired via ACME.
+        If this is set to null (the default), no nginx virtualHost will be configured.
       '';
     };
 
     poolConfig = mkOption {
-      type = with types; attrsOf (oneOf [ str int bool ]);
+      type =
+        with types;
+        attrsOf (oneOf [
+          str
+          int
+          bool
+        ]);
       default = {
         "pm" = "dynamic";
         "pm.max_children" = 32;
@@ -188,138 +232,144 @@ in
   config = mkIf cfg.enable (mkMerge [
     {
 
-    assertions = [
-      { assertion = cfg.database.createLocally -> cfg.database.user == cfg.user;
-        message = "services.dolibarr.database.user must match services.dolibarr.user if the database is to be automatically provisioned";
-      }
-    ];
-
-    services.dolibarr.settings = {
-      dolibarr_main_url_root = "https://${cfg.domain}";
-      dolibarr_main_document_root = "${package}/htdocs";
-      dolibarr_main_url_root_alt = "/custom";
-      dolibarr_main_data_root = "${cfg.stateDir}/documents";
-
-      dolibarr_main_db_host = cfg.database.host;
-      dolibarr_main_db_port = toString cfg.database.port;
-      dolibarr_main_db_name = cfg.database.name;
-      dolibarr_main_db_prefix = "llx_";
-      dolibarr_main_db_user = cfg.database.user;
-      dolibarr_main_db_pass = mkIf (cfg.database.passwordFile != null) ''
-        file_get_contents("${cfg.database.passwordFile}")
-      '';
-      dolibarr_main_db_type = "mysqli";
-      dolibarr_main_db_character_set = mkDefault "utf8";
-      dolibarr_main_db_collation = mkDefault "utf8_unicode_ci";
-
-      # Authentication settings
-      dolibarr_main_authentication = mkDefault "dolibarr";
-
-      # Security settings
-      dolibarr_main_prod = true;
-      dolibarr_main_force_https = vhostCfg.forceSSL or false;
-      dolibarr_main_restrict_os_commands = "${pkgs.mariadb}/bin/mysqldump, ${pkgs.mariadb}/bin/mysql";
-      dolibarr_nocsrfcheck = false;
-      dolibarr_main_instance_unique_id = ''
-        file_get_contents("${cfg.stateDir}/dolibarr_main_instance_unique_id")
-      '';
-      dolibarr_mailing_limit_sendbyweb = false;
-    };
-
-    systemd.tmpfiles.rules = [
-      "d '${cfg.stateDir}' 0750 ${cfg.user} ${cfg.group}"
-      "d '${cfg.stateDir}/documents' 0750 ${cfg.user} ${cfg.group}"
-      "f '${cfg.stateDir}/conf.php' 0660 ${cfg.user} ${cfg.group}"
-      "L '${cfg.stateDir}/install.forced.php' - ${cfg.user} ${cfg.group} - ${mkConfigFile "install.forced.php" install}"
-    ];
-
-    services.mysql = mkIf cfg.database.createLocally {
-      enable = mkDefault true;
-      package = mkDefault pkgs.mariadb;
-      ensureDatabases = [ cfg.database.name ];
-      ensureUsers = [
-        { name = cfg.database.user;
-          ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
+      assertions = [
+        {
+          assertion = cfg.database.createLocally -> cfg.database.user == cfg.user;
+          message = "services.dolibarr.database.user must match services.dolibarr.user if the database is to be automatically provisioned";
         }
       ];
-    };
 
-    services.nginx.enable = mkIf (cfg.nginx != null) true;
-    services.nginx.virtualHosts."${cfg.domain}" = mkIf (cfg.nginx != null) (lib.mkMerge [
-      cfg.nginx
-      ({
-        root = lib.mkForce "${package}/htdocs";
-        locations."/".index = "index.php";
-        locations."~ [^/]\\.php(/|$)" = {
+      services.dolibarr.settings = {
+        dolibarr_main_url_root = "https://${cfg.domain}";
+        dolibarr_main_document_root = "${package}/htdocs";
+        dolibarr_main_url_root_alt = "/custom";
+        dolibarr_main_data_root = "${cfg.stateDir}/documents";
+
+        dolibarr_main_db_host = cfg.database.host;
+        dolibarr_main_db_port = toString cfg.database.port;
+        dolibarr_main_db_name = cfg.database.name;
+        dolibarr_main_db_prefix = "llx_";
+        dolibarr_main_db_user = cfg.database.user;
+        dolibarr_main_db_pass = mkIf (cfg.database.passwordFile != null) ''
+          file_get_contents("${cfg.database.passwordFile}")
+        '';
+        dolibarr_main_db_type = "mysqli";
+        dolibarr_main_db_character_set = mkDefault "utf8";
+        dolibarr_main_db_collation = mkDefault "utf8_unicode_ci";
+
+        # Authentication settings
+        dolibarr_main_authentication = mkDefault "dolibarr";
+
+        # Security settings
+        dolibarr_main_prod = true;
+        dolibarr_main_force_https = vhostCfg.forceSSL or false;
+        dolibarr_main_restrict_os_commands = "${pkgs.mariadb}/bin/mysqldump, ${pkgs.mariadb}/bin/mysql";
+        dolibarr_nocsrfcheck = false;
+        dolibarr_main_instance_unique_id = ''
+          file_get_contents("${cfg.stateDir}/dolibarr_main_instance_unique_id")
+        '';
+        dolibarr_mailing_limit_sendbyweb = false;
+      };
+
+      systemd.tmpfiles.rules = [
+        "d '${cfg.stateDir}' 0750 ${cfg.user} ${cfg.group}"
+        "d '${cfg.stateDir}/documents' 0750 ${cfg.user} ${cfg.group}"
+        "f '${cfg.stateDir}/conf.php' 0660 ${cfg.user} ${cfg.group}"
+        "L '${cfg.stateDir}/install.forced.php' - ${cfg.user} ${cfg.group} - ${mkConfigFile "install.forced.php" install}"
+      ];
+
+      services.mysql = mkIf cfg.database.createLocally {
+        enable = mkDefault true;
+        package = mkDefault pkgs.mariadb;
+        ensureDatabases = [ cfg.database.name ];
+        ensureUsers = [
+          {
+            name = cfg.database.user;
+            ensurePermissions = {
+              "${cfg.database.name}.*" = "ALL PRIVILEGES";
+            };
+          }
+        ];
+      };
+
+      services.nginx.enable = mkIf (cfg.nginx != null) true;
+      services.nginx.virtualHosts."${cfg.domain}" = mkIf (cfg.nginx != null) (
+        lib.mkMerge [
+          cfg.nginx
+          ({
+            root = lib.mkForce "${package}/htdocs";
+            locations."/".index = "index.php";
+            locations."~ [^/]\\.php(/|$)" = {
+              extraConfig = ''
+                fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+                fastcgi_pass unix:${config.services.phpfpm.pools.dolibarr.socket};
+              '';
+            };
+          })
+        ]
+      );
+
+      systemd.services."phpfpm-dolibarr".after = mkIf cfg.database.createLocally [ "mysql.service" ];
+      services.phpfpm.pools.dolibarr = {
+        inherit (cfg) user group;
+        phpPackage = pkgs.php.buildEnv {
+          extensions = { enabled, all }: enabled ++ [ all.calendar ];
+          # recommended by dolibarr web application
           extraConfig = ''
-            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
-            fastcgi_pass unix:${config.services.phpfpm.pools.dolibarr.socket};
+            session.use_strict_mode = 1
+            session.cookie_samesite = "Lax"
+            ; open_basedir = "${package}/htdocs, ${cfg.stateDir}"
+            allow_url_fopen = 0
+            disable_functions = "pcntl_alarm, pcntl_fork, pcntl_waitpid, pcntl_wait, pcntl_wifexited, pcntl_wifstopped, pcntl_wifsignaled, pcntl_wifcontinued, pcntl_wexitstatus, pcntl_wtermsig, pcntl_wstopsig, pcntl_signal, pcntl_signal_get_handler, pcntl_signal_dispatch, pcntl_get_last_error, pcntl_strerror, pcntl_sigprocmask, pcntl_sigwaitinfo, pcntl_sigtimedwait, pcntl_exec, pcntl_getpriority, pcntl_setpriority, pcntl_async_signals"
           '';
         };
-      })
-    ]);
 
-    systemd.services."phpfpm-dolibarr".after = mkIf cfg.database.createLocally [ "mysql.service" ];
-    services.phpfpm.pools.dolibarr = {
-      inherit (cfg) user group;
-      phpPackage = pkgs.php.buildEnv {
-        extensions = { enabled, all }: enabled ++ [ all.calendar ];
-        # recommended by dolibarr web application
-        extraConfig = ''
-          session.use_strict_mode = 1
-          session.cookie_samesite = "Lax"
-          ; open_basedir = "${package}/htdocs, ${cfg.stateDir}"
-          allow_url_fopen = 0
-          disable_functions = "pcntl_alarm, pcntl_fork, pcntl_waitpid, pcntl_wait, pcntl_wifexited, pcntl_wifstopped, pcntl_wifsignaled, pcntl_wifcontinued, pcntl_wexitstatus, pcntl_wtermsig, pcntl_wstopsig, pcntl_signal, pcntl_signal_get_handler, pcntl_signal_dispatch, pcntl_get_last_error, pcntl_strerror, pcntl_sigprocmask, pcntl_sigwaitinfo, pcntl_sigtimedwait, pcntl_exec, pcntl_getpriority, pcntl_setpriority, pcntl_async_signals"
+        settings = {
+          "listen.mode" = "0660";
+          "listen.owner" = cfg.user;
+          "listen.group" = cfg.group;
+        } // cfg.poolConfig;
+      };
+
+      # there are several challenges with dolibarr and NixOS which we can address here
+      # - the dolibarr installer cannot be entirely automated, though it can partially be by including a file called install.forced.php
+      # - the dolibarr installer requires write access to its config file during installation, though not afterwards
+      # - the dolibarr config file generally holds secrets generated by the installer, though the config file is a php file so we can read and write these secrets from an external file
+      systemd.services.dolibarr-config = {
+        description = "dolibarr configuration file management via NixOS";
+        wantedBy = [ "multi-user.target" ];
+
+        script = ''
+          # extract the 'main instance unique id' secret that the dolibarr installer generated for us, store it in a file for use by our own NixOS generated configuration file
+          ${pkgs.php}/bin/php -r "include '${cfg.stateDir}/conf.php'; file_put_contents('${cfg.stateDir}/dolibarr_main_instance_unique_id', \$dolibarr_main_instance_unique_id);"
+
+          # replace configuration file generated by installer with the NixOS generated configuration file
+          install -m 644 ${mkConfigFile "conf.php" cfg.settings} '${cfg.stateDir}/conf.php'
         '';
+
+        serviceConfig = {
+          Type = "oneshot";
+          User = cfg.user;
+          Group = cfg.group;
+          RemainAfterExit = "yes";
+        };
+
+        unitConfig = {
+          ConditionFileNotEmpty = "${cfg.stateDir}/conf.php";
+        };
       };
 
-      settings = {
-        "listen.mode" = "0660";
-        "listen.owner" = cfg.user;
-        "listen.group" = cfg.group;
-      } // cfg.poolConfig;
-    };
-
-    # there are several challenges with dolibarr and NixOS which we can address here
-    # - the dolibarr installer cannot be entirely automated, though it can partially be by including a file called install.forced.php
-    # - the dolibarr installer requires write access to its config file during installation, though not afterwards
-    # - the dolibarr config file generally holds secrets generated by the installer, though the config file is a php file so we can read and write these secrets from an external file
-    systemd.services.dolibarr-config = {
-      description = "dolibarr configuration file management via NixOS";
-      wantedBy = [ "multi-user.target" ];
-
-      script = ''
-        # extract the 'main instance unique id' secret that the dolibarr installer generated for us, store it in a file for use by our own NixOS generated configuration file
-        ${pkgs.php}/bin/php -r "include '${cfg.stateDir}/conf.php'; file_put_contents('${cfg.stateDir}/dolibarr_main_instance_unique_id', \$dolibarr_main_instance_unique_id);"
-
-        # replace configuration file generated by installer with the NixOS generated configuration file
-        install -m 644 ${mkConfigFile "conf.php" cfg.settings} '${cfg.stateDir}/conf.php'
-      '';
-
-      serviceConfig = {
-        Type = "oneshot";
-        User = cfg.user;
-        Group = cfg.group;
-        RemainAfterExit = "yes";
+      users.users.dolibarr = mkIf (cfg.user == "dolibarr") {
+        isSystemUser = true;
+        group = cfg.group;
       };
 
-      unitConfig = {
-        ConditionFileNotEmpty = "${cfg.stateDir}/conf.php";
+      users.groups = optionalAttrs (cfg.group == "dolibarr") {
+        dolibarr = { };
       };
-    };
-
-    users.users.dolibarr = mkIf (cfg.user == "dolibarr" ) {
-      isSystemUser = true;
-      group = cfg.group;
-    };
-
-    users.groups = optionalAttrs (cfg.group == "dolibarr") {
-      dolibarr = { };
-    };
-  }
-  (mkIf (cfg.nginx != null) {
-    users.users."${config.services.nginx.group}".extraGroups = mkIf (cfg.nginx != null) [ cfg.group ];
-  })
-]);
+    }
+    (mkIf (cfg.nginx != null) {
+      users.users."${config.services.nginx.group}".extraGroups = mkIf (cfg.nginx != null) [ cfg.group ];
+    })
+  ]);
 }

From 8b235ad144a9dacb1224408e3a493bc17a4dc44b Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 23 Dec 2024 08:44:43 +0100
Subject: [PATCH 12/31] nixos/dolibarr: change permissions of conf.php to read
 only

---
 nixos/modules/services/web-apps/dolibarr.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/dolibarr.nix b/nixos/modules/services/web-apps/dolibarr.nix
index dd2b2f2a12ad..136720ef67b4 100644
--- a/nixos/modules/services/web-apps/dolibarr.nix
+++ b/nixos/modules/services/web-apps/dolibarr.nix
@@ -344,7 +344,7 @@ in
           ${pkgs.php}/bin/php -r "include '${cfg.stateDir}/conf.php'; file_put_contents('${cfg.stateDir}/dolibarr_main_instance_unique_id', \$dolibarr_main_instance_unique_id);"
 
           # replace configuration file generated by installer with the NixOS generated configuration file
-          install -m 644 ${mkConfigFile "conf.php" cfg.settings} '${cfg.stateDir}/conf.php'
+          install -m 440 ${mkConfigFile "conf.php" cfg.settings} '${cfg.stateDir}/conf.php'
         '';
 
         serviceConfig = {

From 1077e452bcd6a2bc09f5e64cef9259c2577b0db5 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Tue, 24 Dec 2024 10:32:53 +0100
Subject: [PATCH 13/31] ubports-click: unstable-2023-02-22 -> 0.5.2

---
 .../tools/click/dbus-test-runner.patch        | 23 ------
 pkgs/development/tools/click/default.nix      | 82 +++++++++++++++++--
 2 files changed, 73 insertions(+), 32 deletions(-)
 delete mode 100644 pkgs/development/tools/click/dbus-test-runner.patch

diff --git a/pkgs/development/tools/click/dbus-test-runner.patch b/pkgs/development/tools/click/dbus-test-runner.patch
deleted file mode 100644
index c705cf99aa7c..000000000000
--- a/pkgs/development/tools/click/dbus-test-runner.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-diff --git a/click_package/Makefile.am b/click_package/Makefile.am
-index 4981d74..9df9e79 100644
---- a/click_package/Makefile.am
-+++ b/click_package/Makefile.am
-@@ -1,5 +1,3 @@
--SUBDIRS = tests
--
- noinst_SCRIPTS = paths.py
- CLEANFILES = $(noinst_SCRIPTS)
- 
-diff --git a/configure.ac b/configure.ac
-index 8f4dc9e..adbd366 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -52,8 +52,6 @@ PKG_CHECK_MODULES([SERVICE], [
- AC_SUBST([SERVICE_CFLAGS])
- AC_SUBST([SERVICE_LIBS])
- 
--AC_CHECK_PROG(DBUS_TEST_RUNNER_CHECK,dbus-test-runner,yes)
--AS_IF([test "${DBUS_TEST_RUNNER_CHECK}" != "yes"], [AC_MSG_ERROR([dbus-test-runner not found])])
- AC_CHECK_PROG(GDBUS_CHECK,gdbus,yes)
- AS_IF([test "${GDBUS_CHECK}" != "yes"], [AC_MSG_ERROR([gdbus (glib) not found])])
- 
diff --git a/pkgs/development/tools/click/default.nix b/pkgs/development/tools/click/default.nix
index 97950147254c..a2f66c4d8fca 100644
--- a/pkgs/development/tools/click/default.nix
+++ b/pkgs/development/tools/click/default.nix
@@ -1,9 +1,16 @@
 {
   lib,
   fetchFromGitLab,
+  fetchpatch,
+  stdenv,
   buildPythonApplication,
   autoreconfHook,
+  dbus,
+  dbus-test-runner,
+  dpkg,
+  glib,
   python-debian,
+  python-apt,
   perl,
   vala,
   pkg-config,
@@ -13,26 +20,34 @@
   gobject-introspection,
   getopt,
   setuptools,
+  six,
   pygobject3,
+  unittestCheckHook,
   wrapGAppsHook3,
 }:
 
-buildPythonApplication {
+buildPythonApplication rec {
   pname = "click";
-  version = "unstable-2023-02-22";
+  version = "0.5.2";
   format = "other";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/click";
-    rev = "aaf2735e8e6cbeaf2e429c70136733513a81718a";
-    hash = "sha256-pNu995/w3tbz15QQVdVYBnWnAoZmqWj1DN/5PZZ0iZw=";
+    rev = version;
+    hash = "sha256-AV3n6tghvpV/6Ew6Lokf8QAGBIMbHFAnp6G4pefVn+8=";
   };
 
   postPatch = ''
     # These should be proper Requires, using the header needs their headers
     substituteInPlace lib/click/click-*.pc.in \
-      --replace 'Requires.private' 'Requires'
+      --replace-fail 'Requires.private' 'Requires'
+
+    # Don't completely override PKG_CONFIG_PATH
+    substituteInPlace click_package/tests/Makefile.am \
+      --replace-fail 'PKG_CONFIG_PATH=$(top_builddir)/lib/click' 'PKG_CONFIG_PATH=$(top_builddir)/lib/click:$(PKG_CONFIG_PATH)'
+
+    patchShebangs bin/click
   '';
 
   configureFlags = [
@@ -51,8 +66,15 @@ buildPythonApplication {
     export PYTHON_INSTALL_FLAGS="--prefix=$out"
   '';
 
+  strictDeps = true;
+
+  pkgsBuildBuild = [
+    pkg-config
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
+    dbus-test-runner # Always checking for this
     perl
     pkg-config
     gobject-introspection
@@ -61,17 +83,59 @@ buildPythonApplication {
     wrapGAppsHook3
   ];
 
-  # Tests were omitted for time constraint reasons
-  doCheck = false;
+  nativeCheckInputs = [
+    dbus
+    dpkg
+    unittestCheckHook
+  ];
+
+  checkInputs = [
+    python-apt
+    six
+  ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  preCheck = ''
+    export HOME=$TMP
+
+    # tests recompile some files for loaded predefines, doesn't use any optimisation level for it
+    # makes test output harder to read, so make the warning go away
+    export NIX_CFLAGS_COMPILE+=" -U_FORTIFY_SOURCE"
+
+    for path in $disabledTestPaths; do
+      rm -v $path
+    done
+  '';
+
+  disabledTestPaths = [
+    # From apt: Unable to determine a suitable packaging system type
+    "click_package/tests/integration/test_signatures.py"
+    "click_package/tests/test_build.py"
+    "click_package/tests/test_install.py"
+    "click_package/tests/test_scripts.py"
+  ];
 
   enableParallelBuilding = true;
 
   patches = [
-    # dbus-test-runner not packaged yet, otherwise build-time dependency even when not running tests
-    ./dbus-test-runner.patch
+    # Remove when version > 0.5.2
+    (fetchpatch {
+      name = "0001-click-fix-Wimplicit-function-declaration.patch";
+      url = "https://gitlab.com/ubports/development/core/click/-/commit/8f654978a12e6f9a0b6ff64296ec5565e3ff5cd0.patch";
+      hash = "sha256-kio+DdtuagUNYEosyQY3q3H+dJM3cLQRW9wUKUcpUTY=";
+    })
+
+    # Remove when version > 0.5.2
+    (fetchpatch {
+      name = "0002-click-Add-uid_t-and-gid_t-to-the-ctypes-_typemap.patch";
+      url = "https://gitlab.com/ubports/development/core/click/-/commit/cbcd23b08b02fa122434e1edd69c2b3dcb6a8793.patch";
+      hash = "sha256-QaWRhxO61wAzULVqPLdJrLuBCr3+NhKmQlEPuYq843I=";
+    })
   ];
 
   buildInputs = [
+    glib
     libgee
     json-glib
     properties-cpp

From ab54cadc2745331e93fbbd736883653179ad146f Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Tue, 24 Dec 2024 10:37:36 +0100
Subject: [PATCH 14/31] ubports-click: Modernise

- Reorder function arguments in lexicographical order, derivation attributes in more common order
- Add changelog, mainProgram, pkgConfigModules + test
- Adjust maintainers, heavily related to Lomiri so pulling in that team
---
 pkgs/development/tools/click/default.nix | 205 ++++++++++++-----------
 1 file changed, 108 insertions(+), 97 deletions(-)

diff --git a/pkgs/development/tools/click/default.nix b/pkgs/development/tools/click/default.nix
index a2f66c4d8fca..a607870cf4bb 100644
--- a/pkgs/development/tools/click/default.nix
+++ b/pkgs/development/tools/click/default.nix
@@ -1,28 +1,30 @@
 {
-  lib,
+  buildPythonApplication,
   fetchFromGitLab,
   fetchpatch,
+  lib,
   stdenv,
-  buildPythonApplication,
+  testers,
+  ubports-click,
   autoreconfHook,
   dbus,
   dbus-test-runner,
   dpkg,
-  glib,
-  python-debian,
-  python-apt,
-  perl,
-  vala,
-  pkg-config,
-  libgee,
-  json-glib,
-  properties-cpp,
-  gobject-introspection,
   getopt,
+  glib,
+  gobject-introspection,
+  json-glib,
+  libgee,
+  perl,
+  pkg-config,
+  properties-cpp,
+  pygobject3,
+  python-apt,
+  python-debian,
   setuptools,
   six,
-  pygobject3,
   unittestCheckHook,
+  vala,
   wrapGAppsHook3,
 }:
 
@@ -38,86 +40,6 @@ buildPythonApplication rec {
     hash = "sha256-AV3n6tghvpV/6Ew6Lokf8QAGBIMbHFAnp6G4pefVn+8=";
   };
 
-  postPatch = ''
-    # These should be proper Requires, using the header needs their headers
-    substituteInPlace lib/click/click-*.pc.in \
-      --replace-fail 'Requires.private' 'Requires'
-
-    # Don't completely override PKG_CONFIG_PATH
-    substituteInPlace click_package/tests/Makefile.am \
-      --replace-fail 'PKG_CONFIG_PATH=$(top_builddir)/lib/click' 'PKG_CONFIG_PATH=$(top_builddir)/lib/click:$(PKG_CONFIG_PATH)'
-
-    patchShebangs bin/click
-  '';
-
-  configureFlags = [
-    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
-    "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
-  ];
-
-  preFixup = ''
-    makeWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH : "$out/lib"
-    )
-  '';
-
-  preConfigure = ''
-    export click_cv_perl_vendorlib=$out/${perl.libPrefix}
-    export PYTHON_INSTALL_FLAGS="--prefix=$out"
-  '';
-
-  strictDeps = true;
-
-  pkgsBuildBuild = [
-    pkg-config
-  ];
-
-  nativeBuildInputs = [
-    autoreconfHook
-    dbus-test-runner # Always checking for this
-    perl
-    pkg-config
-    gobject-introspection
-    vala
-    getopt
-    wrapGAppsHook3
-  ];
-
-  nativeCheckInputs = [
-    dbus
-    dpkg
-    unittestCheckHook
-  ];
-
-  checkInputs = [
-    python-apt
-    six
-  ];
-
-  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
-
-  preCheck = ''
-    export HOME=$TMP
-
-    # tests recompile some files for loaded predefines, doesn't use any optimisation level for it
-    # makes test output harder to read, so make the warning go away
-    export NIX_CFLAGS_COMPILE+=" -U_FORTIFY_SOURCE"
-
-    for path in $disabledTestPaths; do
-      rm -v $path
-    done
-  '';
-
-  disabledTestPaths = [
-    # From apt: Unable to determine a suitable packaging system type
-    "click_package/tests/integration/test_signatures.py"
-    "click_package/tests/test_build.py"
-    "click_package/tests/test_install.py"
-    "click_package/tests/test_scripts.py"
-  ];
-
-  enableParallelBuilding = true;
-
   patches = [
     # Remove when version > 0.5.2
     (fetchpatch {
@@ -134,10 +56,39 @@ buildPythonApplication rec {
     })
   ];
 
+  postPatch = ''
+    # These should be proper Requires, using the header needs their headers
+    substituteInPlace lib/click/click-*.pc.in \
+      --replace-fail 'Requires.private' 'Requires'
+
+    # Don't completely override PKG_CONFIG_PATH
+    substituteInPlace click_package/tests/Makefile.am \
+      --replace-fail 'PKG_CONFIG_PATH=$(top_builddir)/lib/click' 'PKG_CONFIG_PATH=$(top_builddir)/lib/click:$(PKG_CONFIG_PATH)'
+
+    patchShebangs bin/click
+  '';
+
+  strictDeps = true;
+
+  pkgsBuildBuild = [
+    pkg-config
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    dbus-test-runner # Always checking for this
+    getopt
+    gobject-introspection
+    perl
+    pkg-config
+    vala
+    wrapGAppsHook3
+  ];
+
   buildInputs = [
     glib
-    libgee
     json-glib
+    libgee
     properties-cpp
   ];
 
@@ -147,14 +98,74 @@ buildPythonApplication rec {
     setuptools
   ];
 
+  nativeCheckInputs = [
+    dbus
+    dpkg
+    unittestCheckHook
+  ];
+
+  checkInputs = [
+    python-apt
+    six
+  ];
+
+  preConfigure = ''
+    export click_cv_perl_vendorlib=$out/${perl.libPrefix}
+    export PYTHON_INSTALL_FLAGS="--prefix=$out"
+  '';
+
+  configureFlags = [
+    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+    "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
+  ];
+
+  enableParallelBuilding = true;
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  disabledTestPaths = [
+    # From apt: Unable to determine a suitable packaging system type
+    "click_package/tests/integration/test_signatures.py"
+    "click_package/tests/test_build.py"
+    "click_package/tests/test_install.py"
+    "click_package/tests/test_scripts.py"
+  ];
+
+  preCheck = ''
+    export HOME=$TMP
+
+    # tests recompile some files for loaded predefines, doesn't use any optimisation level for it
+    # makes test output harder to read, so make the warning go away
+    export NIX_CFLAGS_COMPILE+=" -U_FORTIFY_SOURCE"
+
+    # Haven'tbeen able to get them excluded via disabledTest{s,Paths}, just deleting them
+    for path in $disabledTestPaths; do
+      rm -v $path
+    done
+  '';
+
+  preFixup = ''
+    makeWrapperArgs+=(
+      --prefix LD_LIBRARY_PATH : "$out/lib"
+    )
+  '';
+
+  passthru.tests.pkg-config = testers.hasPkgConfigModules {
+    package = ubports-click;
+  };
+
   meta = {
-    description = "Tool to build click packages. Mainly used for Ubuntu Touch";
+    description = "Tool to build click packages, mainly used for Ubuntu Touch";
     homepage = "https://gitlab.com/ubports/development/core/click";
+    changelog = "https://gitlab.com/ubports/development/core/click/-/blob/${version}/ChangeLog";
     license = lib.licenses.gpl3Only;
+    mainProgram = "click";
     maintainers = with lib.maintainers; [
       ilyakooo0
-      OPNA2608
-    ];
+    ] ++ lib.teams.lomiri.members;
     platforms = lib.platforms.linux;
+    pkgConfigModules = [
+      "click-0.4"
+    ];
   };
 }

From 774cfbe7067b15e906c5d6d4221deb7fb9dc34ec Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Tue, 24 Dec 2024 10:39:33 +0100
Subject: [PATCH 15/31] ubports-click: Add passthru.updateScript

(Untested on this machine, runs OOM when I attempt to run update.nix)
---
 pkgs/development/tools/click/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/click/default.nix b/pkgs/development/tools/click/default.nix
index a607870cf4bb..c722dcfe7266 100644
--- a/pkgs/development/tools/click/default.nix
+++ b/pkgs/development/tools/click/default.nix
@@ -2,6 +2,7 @@
   buildPythonApplication,
   fetchFromGitLab,
   fetchpatch,
+  gitUpdater,
   lib,
   stdenv,
   testers,
@@ -150,8 +151,11 @@ buildPythonApplication rec {
     )
   '';
 
-  passthru.tests.pkg-config = testers.hasPkgConfigModules {
-    package = ubports-click;
+  passthru = {
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = ubports-click;
+    };
+    updateScript = gitUpdater { };
   };
 
   meta = {

From 65121a80804feaa02d4da23694b398fc737aca56 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Tue, 24 Dec 2024 10:43:21 +0100
Subject: [PATCH 16/31] ubports-click: Migrate to by-pkgs

---
 .../ub/ubports-click/package.nix}                | 16 +++++-----------
 pkgs/top-level/all-packages.nix                  |  2 --
 2 files changed, 5 insertions(+), 13 deletions(-)
 rename pkgs/{development/tools/click/default.nix => by-name/ub/ubports-click/package.nix} (94%)

diff --git a/pkgs/development/tools/click/default.nix b/pkgs/by-name/ub/ubports-click/package.nix
similarity index 94%
rename from pkgs/development/tools/click/default.nix
rename to pkgs/by-name/ub/ubports-click/package.nix
index c722dcfe7266..f00b1a302597 100644
--- a/pkgs/development/tools/click/default.nix
+++ b/pkgs/by-name/ub/ubports-click/package.nix
@@ -1,5 +1,4 @@
 {
-  buildPythonApplication,
   fetchFromGitLab,
   fetchpatch,
   gitUpdater,
@@ -19,17 +18,12 @@
   perl,
   pkg-config,
   properties-cpp,
-  pygobject3,
-  python-apt,
-  python-debian,
-  setuptools,
-  six,
-  unittestCheckHook,
+  python3Packages,
   vala,
   wrapGAppsHook3,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "click";
   version = "0.5.2";
   format = "other";
@@ -93,7 +87,7 @@ buildPythonApplication rec {
     properties-cpp
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     python-debian
     pygobject3
     setuptools
@@ -102,10 +96,10 @@ buildPythonApplication rec {
   nativeCheckInputs = [
     dbus
     dpkg
-    unittestCheckHook
+    python3Packages.unittestCheckHook
   ];
 
-  checkInputs = [
+  checkInputs = with python3Packages; [
     python-apt
     six
   ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7057e2550531..b57fc088dbea 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6957,8 +6957,6 @@ with pkgs;
     llvmPackages = llvmPackages_18;
   };
 
-  ubports-click = python3Packages.callPackage ../development/tools/click { };
-
   urweb = callPackage ../development/compilers/urweb {
     icu = icu67;
   };

From 2bdbb27131d34bd3a73307f35fe110303af18c21 Mon Sep 17 00:00:00 2001
From: Florian Brandes <florian.brandes@posteo.de>
Date: Tue, 24 Dec 2024 10:45:18 +0100
Subject: [PATCH 17/31] python312Packages.flask-security: fix test

Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
---
 .../python-modules/flask-security/default.nix       |  5 +++++
 .../flask-security/fix_test_basic.patch             | 13 +++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 pkgs/development/python-modules/flask-security/fix_test_basic.patch

diff --git a/pkgs/development/python-modules/flask-security/default.nix b/pkgs/development/python-modules/flask-security/default.nix
index 558880850878..be4d066c8655 100644
--- a/pkgs/development/python-modules/flask-security/default.nix
+++ b/pkgs/development/python-modules/flask-security/default.nix
@@ -64,6 +64,11 @@ buildPythonPackage rec {
     hash = "sha256-RGRwgrDFe+0v8NYyajMikdoi1DQf1I+B5y8KJyF+cZs=";
   };
 
+  patches = [
+    # https://github.com/pallets-eco/flask-security/pull/1040
+    ./fix_test_basic.patch
+  ];
+
   build-system = [ flit-core ];
 
   # flask-login>=0.6.2 not satisfied by version 0.7.0.dev0
diff --git a/pkgs/development/python-modules/flask-security/fix_test_basic.patch b/pkgs/development/python-modules/flask-security/fix_test_basic.patch
new file mode 100644
index 000000000000..f7ecfd8e9433
--- /dev/null
+++ b/pkgs/development/python-modules/flask-security/fix_test_basic.patch
@@ -0,0 +1,13 @@
+diff --git a/tests/test_basic.py b/tests/test_basic.py
+index d52be429..09dfa8e4 100644
+--- a/tests/test_basic.py
++++ b/tests/test_basic.py
+@@ -157,6 +157,8 @@ def test_authenticate_with_subdomain_next(app, client, get_message):
+ 
+ @pytest.mark.settings(subdomain="auth")
+ def test_authenticate_with_root_domain_next(app, client, get_message):
++    # As of Flask 3.1 this must be explicitly set.
++    app.subdomain_matching = True
+     app.config["SERVER_NAME"] = "lp.com"
+     app.config["SECURITY_REDIRECT_ALLOW_SUBDOMAINS"] = True
+     data = dict(email="matt@lp.com", password="password")
\ No newline at end of file

From 5f3da539cccb91cb0966767fb8b16a424015011c Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Tue, 24 Dec 2024 11:11:45 +0100
Subject: [PATCH 18/31] ubports-click: Get rid of externally-supplied self

---
 pkgs/by-name/ub/ubports-click/package.nix | 283 +++++++++++-----------
 1 file changed, 144 insertions(+), 139 deletions(-)

diff --git a/pkgs/by-name/ub/ubports-click/package.nix b/pkgs/by-name/ub/ubports-click/package.nix
index f00b1a302597..7cf007b91f9e 100644
--- a/pkgs/by-name/ub/ubports-click/package.nix
+++ b/pkgs/by-name/ub/ubports-click/package.nix
@@ -5,7 +5,6 @@
   lib,
   stdenv,
   testers,
-  ubports-click,
   autoreconfHook,
   dbus,
   dbus-test-runner,
@@ -23,147 +22,153 @@
   wrapGAppsHook3,
 }:
 
-python3Packages.buildPythonApplication rec {
-  pname = "click";
-  version = "0.5.2";
-  format = "other";
+let
+  self = python3Packages.buildPythonApplication rec {
+    pname = "click";
+    version = "0.5.2";
+    format = "other";
 
-  src = fetchFromGitLab {
-    owner = "ubports";
-    repo = "development/core/click";
-    rev = version;
-    hash = "sha256-AV3n6tghvpV/6Ew6Lokf8QAGBIMbHFAnp6G4pefVn+8=";
-  };
-
-  patches = [
-    # Remove when version > 0.5.2
-    (fetchpatch {
-      name = "0001-click-fix-Wimplicit-function-declaration.patch";
-      url = "https://gitlab.com/ubports/development/core/click/-/commit/8f654978a12e6f9a0b6ff64296ec5565e3ff5cd0.patch";
-      hash = "sha256-kio+DdtuagUNYEosyQY3q3H+dJM3cLQRW9wUKUcpUTY=";
-    })
-
-    # Remove when version > 0.5.2
-    (fetchpatch {
-      name = "0002-click-Add-uid_t-and-gid_t-to-the-ctypes-_typemap.patch";
-      url = "https://gitlab.com/ubports/development/core/click/-/commit/cbcd23b08b02fa122434e1edd69c2b3dcb6a8793.patch";
-      hash = "sha256-QaWRhxO61wAzULVqPLdJrLuBCr3+NhKmQlEPuYq843I=";
-    })
-  ];
-
-  postPatch = ''
-    # These should be proper Requires, using the header needs their headers
-    substituteInPlace lib/click/click-*.pc.in \
-      --replace-fail 'Requires.private' 'Requires'
-
-    # Don't completely override PKG_CONFIG_PATH
-    substituteInPlace click_package/tests/Makefile.am \
-      --replace-fail 'PKG_CONFIG_PATH=$(top_builddir)/lib/click' 'PKG_CONFIG_PATH=$(top_builddir)/lib/click:$(PKG_CONFIG_PATH)'
-
-    patchShebangs bin/click
-  '';
-
-  strictDeps = true;
-
-  pkgsBuildBuild = [
-    pkg-config
-  ];
-
-  nativeBuildInputs = [
-    autoreconfHook
-    dbus-test-runner # Always checking for this
-    getopt
-    gobject-introspection
-    perl
-    pkg-config
-    vala
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
-    glib
-    json-glib
-    libgee
-    properties-cpp
-  ];
-
-  propagatedBuildInputs = with python3Packages; [
-    python-debian
-    pygobject3
-    setuptools
-  ];
-
-  nativeCheckInputs = [
-    dbus
-    dpkg
-    python3Packages.unittestCheckHook
-  ];
-
-  checkInputs = with python3Packages; [
-    python-apt
-    six
-  ];
-
-  preConfigure = ''
-    export click_cv_perl_vendorlib=$out/${perl.libPrefix}
-    export PYTHON_INSTALL_FLAGS="--prefix=$out"
-  '';
-
-  configureFlags = [
-    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
-    "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
-  ];
-
-  enableParallelBuilding = true;
-
-  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
-
-  disabledTestPaths = [
-    # From apt: Unable to determine a suitable packaging system type
-    "click_package/tests/integration/test_signatures.py"
-    "click_package/tests/test_build.py"
-    "click_package/tests/test_install.py"
-    "click_package/tests/test_scripts.py"
-  ];
-
-  preCheck = ''
-    export HOME=$TMP
-
-    # tests recompile some files for loaded predefines, doesn't use any optimisation level for it
-    # makes test output harder to read, so make the warning go away
-    export NIX_CFLAGS_COMPILE+=" -U_FORTIFY_SOURCE"
-
-    # Haven'tbeen able to get them excluded via disabledTest{s,Paths}, just deleting them
-    for path in $disabledTestPaths; do
-      rm -v $path
-    done
-  '';
-
-  preFixup = ''
-    makeWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH : "$out/lib"
-    )
-  '';
-
-  passthru = {
-    tests.pkg-config = testers.hasPkgConfigModules {
-      package = ubports-click;
+    src = fetchFromGitLab {
+      owner = "ubports";
+      repo = "development/core/click";
+      rev = version;
+      hash = "sha256-AV3n6tghvpV/6Ew6Lokf8QAGBIMbHFAnp6G4pefVn+8=";
     };
-    updateScript = gitUpdater { };
-  };
 
-  meta = {
-    description = "Tool to build click packages, mainly used for Ubuntu Touch";
-    homepage = "https://gitlab.com/ubports/development/core/click";
-    changelog = "https://gitlab.com/ubports/development/core/click/-/blob/${version}/ChangeLog";
-    license = lib.licenses.gpl3Only;
-    mainProgram = "click";
-    maintainers = with lib.maintainers; [
-      ilyakooo0
-    ] ++ lib.teams.lomiri.members;
-    platforms = lib.platforms.linux;
-    pkgConfigModules = [
-      "click-0.4"
+    patches = [
+      # Remove when version > 0.5.2
+      (fetchpatch {
+        name = "0001-click-fix-Wimplicit-function-declaration.patch";
+        url = "https://gitlab.com/ubports/development/core/click/-/commit/8f654978a12e6f9a0b6ff64296ec5565e3ff5cd0.patch";
+        hash = "sha256-kio+DdtuagUNYEosyQY3q3H+dJM3cLQRW9wUKUcpUTY=";
+      })
+
+      # Remove when version > 0.5.2
+      (fetchpatch {
+        name = "0002-click-Add-uid_t-and-gid_t-to-the-ctypes-_typemap.patch";
+        url = "https://gitlab.com/ubports/development/core/click/-/commit/cbcd23b08b02fa122434e1edd69c2b3dcb6a8793.patch";
+        hash = "sha256-QaWRhxO61wAzULVqPLdJrLuBCr3+NhKmQlEPuYq843I=";
+      })
     ];
+
+    postPatch = ''
+      # These should be proper Requires, using the header needs their headers
+      substituteInPlace lib/click/click-*.pc.in \
+        --replace-fail 'Requires.private' 'Requires'
+
+      # Don't completely override PKG_CONFIG_PATH
+      substituteInPlace click_package/tests/Makefile.am \
+        --replace-fail 'PKG_CONFIG_PATH=$(top_builddir)/lib/click' 'PKG_CONFIG_PATH=$(top_builddir)/lib/click:$(PKG_CONFIG_PATH)'
+
+      patchShebangs bin/click
+    '';
+
+    strictDeps = true;
+
+    pkgsBuildBuild = [
+      pkg-config
+    ];
+
+    nativeBuildInputs = [
+      autoreconfHook
+      dbus-test-runner # Always checking for this
+      getopt
+      gobject-introspection
+      perl
+      pkg-config
+      vala
+      wrapGAppsHook3
+    ];
+
+    buildInputs = [
+      glib
+      json-glib
+      libgee
+      properties-cpp
+    ];
+
+    propagatedBuildInputs = with python3Packages; [
+      python-debian
+      pygobject3
+      setuptools
+    ];
+
+    nativeCheckInputs = [
+      dbus
+      dpkg
+      python3Packages.unittestCheckHook
+    ];
+
+    checkInputs = with python3Packages; [
+      python-apt
+      six
+    ];
+
+    preConfigure = ''
+      export click_cv_perl_vendorlib=$out/${perl.libPrefix}
+      export PYTHON_INSTALL_FLAGS="--prefix=$out"
+    '';
+
+    configureFlags = [
+      "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+      "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
+    ];
+
+    enableParallelBuilding = true;
+
+    doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+    disabledTestPaths = [
+      # From apt: Unable to determine a suitable packaging system type
+      "click_package/tests/integration/test_signatures.py"
+      "click_package/tests/test_build.py"
+      "click_package/tests/test_install.py"
+      "click_package/tests/test_scripts.py"
+    ];
+
+    preCheck = ''
+      export HOME=$TMP
+
+      # tests recompile some files for loaded predefines, doesn't use any optimisation level for it
+      # makes test output harder to read, so make the warning go away
+      export NIX_CFLAGS_COMPILE+=" -U_FORTIFY_SOURCE"
+
+      # Haven'tbeen able to get them excluded via disabledTest{s,Paths}, just deleting them
+      for path in $disabledTestPaths; do
+        rm -v $path
+      done
+    '';
+
+    preFixup = ''
+      makeWrapperArgs+=(
+        --prefix LD_LIBRARY_PATH : "$out/lib"
+      )
+    '';
+
+    passthru = {
+      updateScript = gitUpdater { };
+    };
+
+    meta = {
+      description = "Tool to build click packages, mainly used for Ubuntu Touch";
+      homepage = "https://gitlab.com/ubports/development/core/click";
+      changelog = "https://gitlab.com/ubports/development/core/click/-/blob/${version}/ChangeLog";
+      license = lib.licenses.gpl3Only;
+      mainProgram = "click";
+      maintainers = with lib.maintainers; [
+        ilyakooo0
+      ] ++ lib.teams.lomiri.members;
+      platforms = lib.platforms.linux;
+      pkgConfigModules = [
+        "click-0.4"
+      ];
+    };
+  };
+in
+self // {
+  passthru = self.passthru // {
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = self;
+    };
   };
 }

From dba1cb7d78c8c6cca892b070166502bc9e5888a0 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Tue, 24 Dec 2024 11:15:09 +0100
Subject: [PATCH 19/31] ubports-click: nixfmt

---
 pkgs/by-name/ub/ubports-click/package.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ub/ubports-click/package.nix b/pkgs/by-name/ub/ubports-click/package.nix
index 7cf007b91f9e..c6597596e206 100644
--- a/pkgs/by-name/ub/ubports-click/package.nix
+++ b/pkgs/by-name/ub/ubports-click/package.nix
@@ -155,9 +155,12 @@ let
       changelog = "https://gitlab.com/ubports/development/core/click/-/blob/${version}/ChangeLog";
       license = lib.licenses.gpl3Only;
       mainProgram = "click";
-      maintainers = with lib.maintainers; [
-        ilyakooo0
-      ] ++ lib.teams.lomiri.members;
+      maintainers =
+        with lib.maintainers;
+        [
+          ilyakooo0
+        ]
+        ++ lib.teams.lomiri.members;
       platforms = lib.platforms.linux;
       pkgConfigModules = [
         "click-0.4"
@@ -165,7 +168,8 @@ let
     };
   };
 in
-self // {
+self
+// {
   passthru = self.passthru // {
     tests.pkg-config = testers.hasPkgConfigModules {
       package = self;

From bd57668ad50e23656cd3212f1340c2ceea6d3a12 Mon Sep 17 00:00:00 2001
From: rewine <luhongxu@deepin.org>
Date: Tue, 24 Dec 2024 19:43:23 +0800
Subject: [PATCH 20/31] deepin.deepin-editor: 6.5.2 -> 6.5.8

---
 pkgs/desktops/deepin/apps/deepin-editor/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/desktops/deepin/apps/deepin-editor/default.nix b/pkgs/desktops/deepin/apps/deepin-editor/default.nix
index 096a353224d4..28ec4b9600e2 100644
--- a/pkgs/desktops/deepin/apps/deepin-editor/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-editor/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "deepin-editor";
-  version = "6.5.2";
+  version = "6.5.8";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    hash = "sha256-Z3fsnjo4Pcu1e8lKvWdWBhpoOFFy0dSrI2HehRYKJ0k=";
+    hash = "sha256-QMq7DIggMhY4EseIa7/tvgxGwZn07OitOm1YjrzMFHg=";
   };
 
   nativeBuildInputs = [

From b81048705b0541a01468e19c33c51cd3d418e741 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 24 Dec 2024 12:04:03 +0000
Subject: [PATCH 21/31] home-manager: 0-unstable-2024-12-12 ->
 0-unstable-2024-12-23

---
 pkgs/by-name/ho/home-manager/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ho/home-manager/package.nix b/pkgs/by-name/ho/home-manager/package.nix
index 81f2cede3ac6..6b24aca0cc08 100644
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@@ -19,14 +19,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2024-12-12";
+  version = "0-unstable-2024-12-23";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "3066cc58f552421a2c5414e78407fa5603405b1e";
-    hash = "sha256-e9YAMReFV1fDPcZLFC2pa4k/8TloSXeX0z2VysNMAoA=";
+    rev = "f1b1786ea77739dcd181b920d430e30fb1608b8a";
+    hash = "sha256-f9UyHMTb+BwF6RDZ8eO9HOkSlKeeSPBlcYhMmV1UNIk=";
   };
 
   nativeBuildInputs = [

From ab9f4b1ab35f9d566a16789163049c8995a8dc9f Mon Sep 17 00:00:00 2001
From: genga <genga898@gmail.com>
Date: Fri, 20 Dec 2024 16:34:28 +0300
Subject: [PATCH 22/31] waymore: init at 4.7

waymore: remove versionCheckHook

waymore: add passthru tests
---
 pkgs/by-name/wa/waymore/package.nix | 51 +++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 pkgs/by-name/wa/waymore/package.nix

diff --git a/pkgs/by-name/wa/waymore/package.nix b/pkgs/by-name/wa/waymore/package.nix
new file mode 100644
index 000000000000..155e5c3c97ef
--- /dev/null
+++ b/pkgs/by-name/wa/waymore/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  waymore,
+  testers,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "waymore";
+  version = "4.7";
+
+  src = fetchFromGitHub {
+    owner = "xnl-h4ck3r";
+    repo = "waymore";
+    tag = "v${version}";
+    hash = "sha256-oaswuXQPdAl2XExwEWnSN15roqNj9OVUr1Y1vsX461o=";
+  };
+
+  preBuild = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    requests
+    termcolor
+    pyyaml
+    psutil
+    uritools
+    tldextract
+  ];
+
+  passthru.tests.version = testers.testVersion {
+    package = waymore;
+    command = "waymore --version";
+    version = "Waymore - v${version}";
+  };
+
+  meta = {
+    description = "Find way more from the Wayback Machine";
+    homepage = "https://github.com/xnl-h4ck3r/waymore";
+    changelog = "https://github.com/xnl-h4ck3r/waymore/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ genga898 ];
+    mainProgram = "waymore";
+  };
+}

From 5c64b8de060af215a15b3f69820be40119067891 Mon Sep 17 00:00:00 2001
From: Gereon Schomber <gereon.schomber@gmail.com>
Date: Mon, 23 Dec 2024 09:48:55 +0100
Subject: [PATCH 23/31] maintainers: add IncredibleLaser

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 38aa90b275d6..2bab9ed20556 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9699,6 +9699,12 @@
     githubId = 36667224;
     name = "Yingchi Long";
   };
+  IncredibleLaser = {
+    github = "IncredibleLaser";
+    githubId = 45564436;
+    matrix = "@incrediblelaser:tchncs.de";
+    name = "Gereon Schomber";
+  };
   indexyz = {
     email = "indexyz@pm.me";
     github = "5aaee9";

From 7567d65ca9df2ae44d80541e0ad28ff62b2924fd Mon Sep 17 00:00:00 2001
From: Gereon Schomber <gereon.schomber@gmail.com>
Date: Mon, 23 Dec 2024 09:48:37 +0100
Subject: [PATCH 24/31] managarr: init at v0.4.2

Signed-off-by: John Titor <50095635+JohnRTitor@users.noreply.github.com>
---
 pkgs/by-name/ma/managarr/package.nix | 30 ++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 pkgs/by-name/ma/managarr/package.nix

diff --git a/pkgs/by-name/ma/managarr/package.nix b/pkgs/by-name/ma/managarr/package.nix
new file mode 100644
index 000000000000..715ec001e6b1
--- /dev/null
+++ b/pkgs/by-name/ma/managarr/package.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  perl,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "managarr";
+  version = "0.4.2";
+
+  src = fetchFromGitHub {
+    owner = "Dark-Alex-17";
+    repo = "managarr";
+    tag = "v${version}";
+    hash = "sha256-OxGFubtMsGnR8cWDKkeAgryY095uydA3LzE5SS0dspQ=";
+  };
+
+  cargoHash = "sha256-bws4LwpJGfq0hCA2Fq51uCMvr0arbayppq1jvDrILZI=";
+
+  nativeBuildInputs = [ perl ];
+
+  meta = {
+    description = "TUI and CLI to manage your Servarrs";
+    homepage = "https://github.com/Dark-Alex-17/managarr";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.IncredibleLaser ];
+    mainProgram = "managarr";
+  };
+}

From 7ce091b05f71c84b0092c8c36e25a22546d58a4a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 25 Dec 2024 08:39:02 +0000
Subject: [PATCH 25/31] python312Packages.libuuu: 1.5.182 -> 1.5.182.post1

---
 pkgs/development/python-modules/libuuu/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/libuuu/default.nix b/pkgs/development/python-modules/libuuu/default.nix
index d824c2379877..bdb5ad84f38d 100644
--- a/pkgs/development/python-modules/libuuu/default.nix
+++ b/pkgs/development/python-modules/libuuu/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "libuuu";
-  version = "1.5.182";
+  version = "1.5.182.post1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-k6JwGxYeFbGNl7zcuKN6SbRq8Z4yD1dXXL3ORyGqhYE=";
+    hash = "sha256-Hf0GwhrzKQL5w+OXQ39yuG4xmbk/1HgCCdCulIORSU8=";
   };
 
   build-system = [

From 4402319ea2dd5c6405ff1fce9164b5c6afd55c03 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 25 Dec 2024 10:05:20 +0000
Subject: [PATCH 26/31] python312Packages.httpx-oauth: 0.16.0 -> 0.16.1

---
 pkgs/development/python-modules/httpx-oauth/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/httpx-oauth/default.nix b/pkgs/development/python-modules/httpx-oauth/default.nix
index affd324967bc..41234fda1d2a 100644
--- a/pkgs/development/python-modules/httpx-oauth/default.nix
+++ b/pkgs/development/python-modules/httpx-oauth/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "httpx-oauth";
-  version = "0.16.0";
+  version = "0.16.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "frankie567";
     repo = "httpx-oauth";
     tag = "v${version}";
-    hash = "sha256-KM+GaBC3jOhMsTVdUixsEjm47j28qeFmFKbI7fnVSG4=";
+    hash = "sha256-/2IBAEZrK0Do7t9g+MWsKuIlcg0ANCfOoagVwTbBso8=";
   };
 
   build-system = [

From 9edf772d70dfd062f6c8254fe4ecd3722e17a8af Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 25 Dec 2024 12:11:10 +0100
Subject: [PATCH 27/31] maintainers: drop milahu

Was banned from the project in 2023-02.
---
 maintainers/maintainer-list.nix                            | 6 ------
 pkgs/applications/maui/booth.nix                           | 2 +-
 pkgs/development/libraries/qt-6/modules/qtbase/default.nix | 1 -
 pkgs/development/libraries/qt-6/qtModule.nix               | 1 -
 pkgs/development/python-modules/slugid/default.nix         | 2 +-
 5 files changed, 2 insertions(+), 10 deletions(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e55b7c07349f..b56630427149 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14811,12 +14811,6 @@
     name = "Marcin Mikuła";
     keys = [ { fingerprint = "5547 2A56 AC30 69C9 15C8  B98D 997F 71FA 1D74 6E37"; } ];
   };
-  milahu = {
-    email = "milahu@gmail.com";
-    github = "milahu";
-    githubId = 12958815;
-    name = "Milan Hauth";
-  };
   milesbreslin = {
     email = "milesbreslin@gmail.com";
     github = "MilesBreslin";
diff --git a/pkgs/applications/maui/booth.nix b/pkgs/applications/maui/booth.nix
index 1d9a8e9568df..adf9a1b68cdf 100644
--- a/pkgs/applications/maui/booth.nix
+++ b/pkgs/applications/maui/booth.nix
@@ -53,6 +53,6 @@ mkDerivation {
     mainProgram = "booth";
     homepage = "https://invent.kde.org/maui/booth";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ milahu ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index e183b35393d7..7065eae8e631 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -322,7 +322,6 @@ stdenv.mkDerivation rec {
       lgpl3Plus
     ];
     maintainers = with maintainers; [
-      milahu
       nickcao
       LunNova
     ];
diff --git a/pkgs/development/libraries/qt-6/qtModule.nix b/pkgs/development/libraries/qt-6/qtModule.nix
index afcabcd02dc0..a4813a0c29e6 100644
--- a/pkgs/development/libraries/qt-6/qtModule.nix
+++ b/pkgs/development/libraries/qt-6/qtModule.nix
@@ -66,7 +66,6 @@ stdenv.mkDerivation (
         lgpl3Plus
       ];
       maintainers = with maintainers; [
-        milahu
         nickcao
       ];
       platforms = platforms.unix;
diff --git a/pkgs/development/python-modules/slugid/default.nix b/pkgs/development/python-modules/slugid/default.nix
index cc695e5f2dbd..3e9a885a6023 100644
--- a/pkgs/development/python-modules/slugid/default.nix
+++ b/pkgs/development/python-modules/slugid/default.nix
@@ -24,6 +24,6 @@ buildPythonPackage rec {
     description = "URL-safe base64 UUID encoder for generating 22 character slugs";
     homepage = "https://github.com/taskcluster/slugid.py";
     license = licenses.mpl20;
-    maintainers = with maintainers; [ milahu ];
+    maintainers = with maintainers; [ ];
   };
 }

From b29f28a0eb09871cee6535e8669911e3cfe0b91b Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 25 Dec 2024 14:33:46 +0300
Subject: [PATCH 28/31] qt6.qtwebengine: backport aarch64 build fix for xnnpack

---
 .../libraries/qt-6/modules/qtwebengine/default.nix     | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
index 149e02e99c68..1a7da3ed6c67 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
@@ -66,6 +66,7 @@
   bootstrap_cmds,
   cctools,
   xcbuild,
+  fetchpatch,
 }:
 
 qtModule {
@@ -114,6 +115,15 @@ qtModule {
 
     # Override locales install path so they go to QtWebEngine's $out
     ./locales-path.patch
+
+    # Fix build of vendored xnnpack on aarch64/gcc14
+    # FIXME: remove when upstream updates
+    (fetchpatch {
+      url = "https://github.com/google/XNNPACK/commit/1b11a8b0620afe8c047304273674c4c57c289755.patch";
+      stripLen = 1;
+      extraPrefix = "src/3rdparty/chromium/third_party/xnnpack/src/";
+      hash = "sha256-GUESVNR88I1K2V5xr0e09ec4j2eselMhNN06+PCcINM=";
+    })
   ];
 
   postPatch =

From 3beb804fc1e1714e0ad2d183f6ae55d91d8fe939 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 25 Dec 2024 15:29:42 +0100
Subject: [PATCH 29/31] python312Packages.kserve: 0.14.0 -> 0.14.1

Diff: https://github.com/kserve/kserve/compare/refs/tags/v0.14.0...v0.14.1

Changelog: https://github.com/kserve/kserve/releases/tag/v0.14.1
---
 pkgs/development/python-modules/kserve/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/kserve/default.nix b/pkgs/development/python-modules/kserve/default.nix
index c0f878a78ed4..2fc4813f1a7a 100644
--- a/pkgs/development/python-modules/kserve/default.nix
+++ b/pkgs/development/python-modules/kserve/default.nix
@@ -49,14 +49,14 @@
 
 buildPythonPackage rec {
   pname = "kserve";
-  version = "0.14.0";
+  version = "0.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kserve";
     repo = "kserve";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-N/IgiTiyBNw7WQWxcUJlXU+Q9o3UUaduD9ZBKwu0uRE=";
+    tag = "v${version}";
+    hash = "sha256-VwuUXANjshV4fN0i54Fs0zubHY81UtQcCV14JwMpXwA=";
   };
 
   sourceRoot = "${src.name}/python/kserve";
@@ -64,6 +64,7 @@ buildPythonPackage rec {
   pythonRelaxDeps = [
     "fastapi"
     "httpx"
+    "numpy"
     "prometheus-client"
     "protobuf"
     "uvicorn"

From 8b193d75ac4ddf7d2a8cb002c313d3bd0f269532 Mon Sep 17 00:00:00 2001
From: oddlama <oddlama@oddlama.org>
Date: Sun, 22 Dec 2024 22:12:14 +0100
Subject: [PATCH 30/31] nixos/hostapd: remove CCMP-256 from recommended ciphers

---
 nixos/doc/manual/release-notes/rl-2505.section.md | 3 +++
 nixos/modules/services/networking/hostapd.nix     | 7 ++++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 5ce521657c93..449a590262c2 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -134,6 +134,9 @@
 
 - `vscode-utils.buildVscodeExtension` now requires pname as an argument
 
+- The behavior of `services.hostapd.radios.<name>.networks.<name>.authentication.enableRecommendedPairwiseCiphers` was changed to not include `CCMP-256` anymore.
+  Since all configured pairwise ciphers have to be supported by the radio, this caused startup failures on many devices which is hard to debug in hostapd.
+
 - `nerdfonts` has been separated into individual font packages under the namespace `nerd-fonts`. The directories for font
   files have changed from `$out/share/fonts/{opentype,truetype}/NerdFonts` to
   `$out/share/fonts/{opentype,truetype}/NerdFonts/<fontDirName>`, where `<fontDirName>` can be found in the
diff --git a/nixos/modules/services/networking/hostapd.nix b/nixos/modules/services/networking/hostapd.nix
index 091479a7e00b..8635dea738ce 100644
--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@@ -707,7 +707,7 @@ in {
 
                     pairwiseCiphers = mkOption {
                       default = ["CCMP"];
-                      example = ["CCMP-256" "GCMP-256"];
+                      example = ["GCMP" "GCMP-256"];
                       type = types.listOf types.str;
                       description = ''
                         Set of accepted cipher suites (encryption algorithms) for pairwise keys (unicast packets).
@@ -716,7 +716,8 @@ in {
 
                         Please refer to the hostapd documentation for allowed values. Generally, only
                         CCMP or GCMP modes should be considered safe options. Most devices support CCMP while
-                        GCMP is often only available with devices supporting WiFi 5 (IEEE 802.11ac) or higher.
+                        GCMP and GCMP-256 is often only available with devices supporting WiFi 5 (IEEE 802.11ac) or higher.
+                        CCMP-256 support is rare.
                       '';
                     };
 
@@ -903,7 +904,7 @@ in {
                   bssCfg = bssSubmod.config;
                   pairwiseCiphers =
                     concatStringsSep " " (unique (bssCfg.authentication.pairwiseCiphers
-                      ++ optionals bssCfg.authentication.enableRecommendedPairwiseCiphers ["CCMP" "CCMP-256" "GCMP" "GCMP-256"]));
+                      ++ optionals bssCfg.authentication.enableRecommendedPairwiseCiphers ["CCMP" "GCMP" "GCMP-256"]));
                 in {
                   settings = {
                     ssid = bssCfg.ssid;

From 4f254b2d73af3b5d35b6974cc64700be541ca595 Mon Sep 17 00:00:00 2001
From: Liassica <115422798+Liassica@users.noreply.github.com>
Date: Wed, 25 Dec 2024 11:31:12 -0600
Subject: [PATCH 31/31] nixos/duckdns: add to module list and release notes

---
 nixos/doc/manual/release-notes/rl-2505.section.md | 2 ++
 nixos/modules/module-list.nix                     | 1 +
 2 files changed, 3 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 1caa762d4ebf..fe3afce3f997 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -63,6 +63,8 @@
 
 - [waagent](https://github.com/Azure/WALinuxAgent), the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with [services.waagent](options.html#opt-services.waagent.enable).
 
+- [duckdns](https://www.duckdns.org), free dynamic DNS. Available with [services.duckdns](options.html#opt-services.duckdns.enable)
+
 - [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](options.html#opt-services.nostr-rs-relay.enable).
 
 - [Actual Budget](https://actualbudget.org/), a local-first personal finance app. Available as [services.actual](#opt-services.actual.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9fe8e3be6477..92e8db5ee8e1 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -763,6 +763,7 @@
   ./services/misc/disnix.nix
   ./services/misc/docker-registry.nix
   ./services/misc/domoticz.nix
+  ./services/misc/duckdns.nix
   ./services/misc/duckling.nix
   ./services/misc/dwm-status.nix
   ./services/misc/dysnomia.nix