From ccdca43d80049e228f41b2a4159b704129b1a1be Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 29 Jun 2025 21:20:42 +0200
Subject: [PATCH] nixos/networkmanager: drop default plugin list and toggle

It is unclear where this list originated, but it doesn't make sense to
ship it with all networkmanager installations. The most excessive plugin
is openconnect, that ships a 250 MB closure including webkitgtk.

Instead users now have to specify the plugins they want explicitly. I
updated the option to give hints on how to find them as best as I can.
---
 .../manual/release-notes/rl-2511.section.md   |  2 +
 .../services/networking/networkmanager.nix    | 46 +++++++++----------
 2 files changed, 25 insertions(+), 23 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 1d3c230e682d..9588ee334a50 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -10,6 +10,8 @@
 
 - The default PostgreSQL version for new NixOS installations (i.e. with `system.stateVersion >= 25.11`) is v17.
 
+- The NetworkManager module does not ship with a default set of VPN plugins anymore. All required VPN plugins must now be explicitly configured in [`networking.networkmanager.plugins`](#opt-networking.networkmanager.plugins).
+
 ## New Modules {#sec-release-25.11-new-modules}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 4200792bfa9b..2dfe39127cc8 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -225,30 +225,37 @@ in
         type =
           let
             networkManagerPluginPackage = types.package // {
-              description = "NetworkManager plug-in";
+              description = "NetworkManager plugin package";
               check =
                 p:
                 lib.assertMsg
                   (types.package.check p && p ? networkManagerPlugin && lib.isString p.networkManagerPlugin)
                   ''
-                    Package ‘${p.name}’, is not a NetworkManager plug-in.
+                    Package ‘${p.name}’, is not a NetworkManager plugin.
                     Those need to have a ‘networkManagerPlugin’ attribute.
                   '';
             };
           in
           types.listOf networkManagerPluginPackage;
         default = [ ];
-        description = ''
-          List of NetworkManager plug-ins to enable.
-          Some plug-ins are enabled by the NetworkManager module by default.
+        example = literalExpression ''
+          [
+            networkmanager-fortisslvpn
+            networkmanager-iodine
+            networkmanager-l2tp
+            networkmanager-openconnect
+            networkmanager-openvpn
+            networkmanager-sstp
+            networkmanager-strongswan
+            networkmanager-vpnc
+          ]
         '';
-      };
-
-      enableDefaultPlugins = mkOption {
-        type = types.bool;
-        default = true;
         description = ''
-          Enable a set of recommended plugins.
+          List of plugin packages to install.
+
+          See <https://search.nixos.org/packages?query=networkmanager-> for available plugin packages.
+          and <https://networkmanager.dev/docs/vpn/> for an overview over builtin and external plugins
+          and their support status.
         '';
       };
 
@@ -520,6 +527,11 @@ in
       "networkmanager"
       "enableStrongSwan"
     ] "Pass `pkgs.networkmanager_strongswan` into `networking.networkmanager.plugins` instead.")
+    (mkRemovedOptionModule [
+      "networking"
+      "networkmanager"
+      "enableDefaultPlugins"
+    ] "Configure the required plugins explicitly in `networking.networkmanager.plugins`.")
   ];
 
   ###### implementation
@@ -663,18 +675,6 @@ in
         useDHCP = false;
       })
 
-      (mkIf cfg.enableDefaultPlugins {
-        networkmanager.plugins = with pkgs; [
-          networkmanager-fortisslvpn
-          networkmanager-iodine
-          networkmanager-l2tp
-          networkmanager-openconnect
-          networkmanager-openvpn
-          networkmanager-vpnc
-          networkmanager-sstp
-        ];
-      })
-
       (mkIf enableIwd {
         wireless.iwd.enable = true;
       })