From f250290d9a6214d34eb9700a80ea280302169a4e Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 15:25:50 +0100
Subject: [PATCH 01/20] nixops_unstable: 2023-12-17 -> 2024-02-28

---
 pkgs/applications/networking/cluster/nixops/unwrapped.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nixops/unwrapped.nix b/pkgs/applications/networking/cluster/nixops/unwrapped.nix
index e8cb998b52c7..34cbf0949154 100644
--- a/pkgs/applications/networking/cluster/nixops/unwrapped.nix
+++ b/pkgs/applications/networking/cluster/nixops/unwrapped.nix
@@ -13,14 +13,14 @@
 
 buildPythonApplication rec {
   pname = "nixops";
-  version = "unstable-2023-12-17";
+  version = "unstable-2024-02-28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "nixops";
-    rev = "053668e849bb369973cf265b7e8f38e66ef70138";
-    hash = "sha256-Kus1Ls1tT8fVGLX0NakRXmjuz5/J/tfqU4TLOkiZqvo=";
+    rev = "08feccb14074c5434f3e483d19a7f7d9bfcdb669";
+    hash = "sha256-yWeF5apQJdChjYVSOyH6LYjJYGa1RL68LRHrSgZ9l8U=";
   };
 
   postPatch = ''

From 4a29e5442d66d939abf6216894bedfdb79ae3a15 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 15:49:46 +0100
Subject: [PATCH 02/20] nixops_unstable -> nixops_unstable_minimal.withPlugins

Providing the whole set by default is not feasible, and anything
smaller than that would be too arbitrary.

The aliases.nix error message puts users on the right path to get
exactly the plugins they need.

nixops_unstable_full probably won't be in a buildable state, so
we can't recommend it. It may be useful for CI.
---
 .../networking/cluster/nixops/default.nix     | 28 +++++++++++--------
 pkgs/top-level/aliases.nix                    |  6 +++-
 pkgs/top-level/all-packages.nix               |  6 +++-
 3 files changed, 27 insertions(+), 13 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index 3fef75313b00..da9783b9a6eb 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -43,14 +43,20 @@ let
       inherit withPlugins python;
     };
   }));
-in withPlugins (ps: [
-  ps.nixops-aws
-  ps.nixops-digitalocean
-  ps.nixops-encrypted-links
-  ps.nixops-gce
-  ps.nixops-hercules-ci
-  ps.nixops-hetzner
-  ps.nixops-hetznercloud
-  ps.nixops-libvirtd
-  ps.nixops-vbox
-])
+
+in {
+  nixops_unstable_minimal = withPlugins (ps: []);
+
+  # Not recommended; too fragile.
+  nixops_unstable_full = withPlugins (ps: [
+    ps.nixops-aws
+    ps.nixops-digitalocean
+    ps.nixops-encrypted-links
+    ps.nixops-gce
+    ps.nixops-hercules-ci
+    ps.nixops-hetzner
+    ps.nixops-hetznercloud
+    ps.nixops-libvirtd
+    ps.nixops-vbox
+  ]);
+}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index be6927bc33ed..fc9248b519a8 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -782,8 +782,12 @@ mapAliases ({
   nix_2_4 = nixVersions.nix_2_4;
   nix_2_5 = nixVersions.nix_2_5;
   nix_2_6 = nixVersions.nix_2_6;
-  nixops = throw "'nixops' has been removed. Please use 'nixops_unstable' for the time being."; # Added 2023-10-26
+  nixops = throw "'nixops' has been removed. Please use 'nixops_unstable_minimal' for the time being. E.g. nixops_unstable_minimal.withPlugins (ps: [ ps.nixops-gce ])"; # Added 2023-10-26
   nixopsUnstable = nixops_unstable; # Added 2022-03-03
+
+  # When the nixops_unstable alias is removed, nixops_unstable_minimal can be renamed to nixops_unstable.
+  nixops_unstable = throw "nixops_unstable has been replaced. Please use for example 'nixops_unstable_minimal.withPlugins (ps: [ ps.nixops-gce ps.nixops-encrypted-links ])' instead"; # Added 2024-02-28
+
   nixosTest = testers.nixosTest; # Added 2022-05-05
   nmap-unfree = nmap; # Added 2021-04-06
   nodejs_14 = throw "nodejs_14 has been removed as it is EOL."; # Added 2023-10-30
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 85a35a22b721..7d4b1cc17e14 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -40205,7 +40205,11 @@ with pkgs;
 
   nixStatic = pkgsStatic.nix;
 
-  nixops_unstable = callPackage ../applications/networking/cluster/nixops { };
+  inherit (callPackages ../applications/networking/cluster/nixops { })
+    nixops_unstable_minimal
+
+    # Not recommended; too fragile
+    nixops_unstable_full;
 
   /*
     Evaluate a NixOS configuration using this evaluation of Nixpkgs.

From 663b3d4be79ebb31ab277a55c0fe4b975cfa17c2 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 16:22:34 +0100
Subject: [PATCH 03/20] nixops_unstable*: Make withPlugins.*.tests.nixos behave
 correctly

---
 nixos/tests/nixops/default.nix                         |  2 +-
 .../applications/networking/cluster/nixops/default.nix | 10 ++++++++--
 .../networking/cluster/nixops/unwrapped.nix            |  2 +-
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/nixos/tests/nixops/default.nix b/nixos/tests/nixops/default.nix
index 6501d13a2ed3..acfe6feee9d1 100644
--- a/nixos/tests/nixops/default.nix
+++ b/nixos/tests/nixops/default.nix
@@ -9,7 +9,7 @@ let
     #  - Alternatively, blocked on a NixOps 2 release
     #    https://github.com/NixOS/nixops/issues/1242
     # stable = testsLegacyNetwork { nixopsPkg = pkgs.nixops; };
-    unstable = testsForPackage { nixopsPkg = pkgs.nixops_unstable; };
+    unstable = testsForPackage { nixopsPkg = pkgs.nixops_unstable_minimal; };
 
     # inherit testsForPackage;
   };
diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index da9783b9a6eb..6bdbebb8eb6d 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -28,8 +28,8 @@ let
   # selector is a function mapping pythonPackages to a list of plugins
   # e.g. nixops_unstable.withPlugins (ps: with ps; [ nixops-aws ])
   withPlugins = selector: let
-    selected = selector (plugins python.pkgs);
-  in python.pkgs.toPythonApplication (python.pkgs.nixops.overridePythonAttrs (old: {
+   selected = selector (plugins python.pkgs);
+   r = python.pkgs.toPythonApplication (python.pkgs.nixops.overridePythonAttrs (old: {
     propagatedBuildInputs = old.propagatedBuildInputs ++ selected;
 
     # Propagating dependencies leaks them through $PYTHONPATH which causes issues
@@ -41,8 +41,14 @@ let
     passthru = old.passthru // {
       plugins = plugins python.pkgs;
       inherit withPlugins python;
+      tests = old.passthru.tests // {
+        nixos = old.passthru.tests.nixos.passthru.override {
+          nixopsPkg = r;
+        };
+      };
     };
   }));
+  in r;
 
 in {
   nixops_unstable_minimal = withPlugins (ps: []);
diff --git a/pkgs/applications/networking/cluster/nixops/unwrapped.nix b/pkgs/applications/networking/cluster/nixops/unwrapped.nix
index 34cbf0949154..058f7f2d2c1c 100644
--- a/pkgs/applications/networking/cluster/nixops/unwrapped.nix
+++ b/pkgs/applications/networking/cluster/nixops/unwrapped.nix
@@ -50,7 +50,7 @@ buildPythonApplication rec {
   pythonImportsCheck = [ "nixops" ];
 
   passthru = {
-    tests.nixops = nixosTests.nixops.unstable;
+    tests.nixos = nixosTests.nixops.unstable;
     updateScript = unstableGitUpdater {};
   };
 

From 8d9f5ca31a0315c99584dc3d0d642354ca1c67aa Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 16:29:27 +0100
Subject: [PATCH 04/20] nixops_unstable_*: Memoize availablePlugins

---
 pkgs/applications/networking/cluster/nixops/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index 6bdbebb8eb6d..abaa62a8bfdb 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -25,10 +25,12 @@ let
     nixopsvbox = nixops-vbox;
   };
 
+  withPlugins = withPlugins' { availablePlugins = plugins python.pkgs; };
+
   # selector is a function mapping pythonPackages to a list of plugins
   # e.g. nixops_unstable.withPlugins (ps: with ps; [ nixops-aws ])
-  withPlugins = selector: let
-   selected = selector (plugins python.pkgs);
+  withPlugins' = { availablePlugins }: selector: let
+   selected = selector availablePlugins;
    r = python.pkgs.toPythonApplication (python.pkgs.nixops.overridePythonAttrs (old: {
     propagatedBuildInputs = old.propagatedBuildInputs ++ selected;
 
@@ -39,7 +41,7 @@ let
     '';
 
     passthru = old.passthru // {
-      plugins = plugins python.pkgs;
+      plugins = availablePlugins;
       inherit withPlugins python;
       tests = old.passthru.tests // {
         nixos = old.passthru.tests.nixos.passthru.override {

From bc2a13998c7576ae1ccb00ad98f765b6f828e50c Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 16:31:40 +0100
Subject: [PATCH 05/20] nixops_unstable_*: Internal rename

---
 pkgs/applications/networking/cluster/nixops/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index abaa62a8bfdb..92a38618e662 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -30,9 +30,9 @@ let
   # selector is a function mapping pythonPackages to a list of plugins
   # e.g. nixops_unstable.withPlugins (ps: with ps; [ nixops-aws ])
   withPlugins' = { availablePlugins }: selector: let
-   selected = selector availablePlugins;
+   selectedPlugins = selector availablePlugins;
    r = python.pkgs.toPythonApplication (python.pkgs.nixops.overridePythonAttrs (old: {
-    propagatedBuildInputs = old.propagatedBuildInputs ++ selected;
+    propagatedBuildInputs = old.propagatedBuildInputs ++ selectedPlugins;
 
     # Propagating dependencies leaks them through $PYTHONPATH which causes issues
     # when used in nix-shell.

From 695f75a8a3d4c1fbdf1e9dadd249f41e8619f832 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 16:32:36 +0100
Subject: [PATCH 06/20] nixops_unstable_*: Rename plugins attribute to
 availablePlugins

---
 pkgs/applications/networking/cluster/nixops/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index 92a38618e662..e07d83a1cbf5 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -41,7 +41,7 @@ let
     '';
 
     passthru = old.passthru // {
-      plugins = availablePlugins;
+      inherit availablePlugins;
       inherit withPlugins python;
       tests = old.passthru.tests // {
         nixos = old.passthru.tests.nixos.passthru.override {

From c5180c311eb26a913815eed888b51932235ab03c Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 16:32:52 +0100
Subject: [PATCH 07/20] nixops_unstable_*: Add selectedPlugins attribute

---
 pkgs/applications/networking/cluster/nixops/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index e07d83a1cbf5..7b3383e6e3ea 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -41,7 +41,7 @@ let
     '';
 
     passthru = old.passthru // {
-      inherit availablePlugins;
+      inherit availablePlugins selectedPlugins;
       inherit withPlugins python;
       tests = old.passthru.tests // {
         nixos = old.passthru.tests.nixos.passthru.override {

From 76fc2db1f59c526bbfa4cbfb2c2ccddf71f20ca3 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 17:14:27 +0100
Subject: [PATCH 08/20] nixosTests.nixops_unstable: Set memorySize to 2G

Give the evaluator some breathing room.
---
 nixos/tests/nixops/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/tests/nixops/default.nix b/nixos/tests/nixops/default.nix
index acfe6feee9d1..8477e5059fca 100644
--- a/nixos/tests/nixops/default.nix
+++ b/nixos/tests/nixops/default.nix
@@ -32,6 +32,7 @@ let
           pkgs.hello
           pkgs.figlet
         ];
+        virtualisation.memorySize = 2048;
 
         # TODO: make this efficient, https://github.com/NixOS/nixpkgs/issues/180529
         system.includeBuildDependencies = true;

From de55e7313fe2778b27a3f46da4911d5b6e55db28 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 17:15:21 +0100
Subject: [PATCH 09/20] nixops_unstable_minimal.tests.withAPlugin: init

This way ofborg will do a better job if we only specify
nixops_unstable as a prefix.
---
 pkgs/applications/networking/cluster/nixops/default.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index 7b3383e6e3ea..e6a8a69cc4c7 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -1,4 +1,4 @@
-{ python3 }:
+{ lib, python3 }:
 
 let
   python = python3.override {
@@ -47,6 +47,12 @@ let
         nixos = old.passthru.tests.nixos.passthru.override {
           nixopsPkg = r;
         };
+      }
+      # Make sure we also test with a configuration that's been extended with a plugin.
+      // lib.optionalAttrs (selectedPlugins == []) {
+        withAPlugin =
+          lib.recurseIntoAttrs
+            (withPlugins (ps: with ps; [ nixops-encrypted-links ])).tests;
       };
     };
   }));

From 60618cc6973102eea2b983bc7eb2a31e655095b4 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 17:19:30 +0100
Subject: [PATCH 10/20] nixops_unstablePlugins: init

---
 pkgs/top-level/all-packages.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7d4b1cc17e14..2e652d3b4e69 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -40211,6 +40211,9 @@ with pkgs;
     # Not recommended; too fragile
     nixops_unstable_full;
 
+  # Useful with ofborg, e.g. commit prefix `nixops_unstablePlugins.nixops-aws: ...` to trigger automatically.
+  nixops_unstablePlugins = recurseIntoAttrs nixops_unstable_minimal.availablePlugins;
+
   /*
     Evaluate a NixOS configuration using this evaluation of Nixpkgs.
 

From 27b08a25ccef11709250163a5121ea3607115b2c Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 17:23:21 +0100
Subject: [PATCH 11/20] 
 pkgs/applications/networking/cluster/nixops/default.nix: Format

---
 .../networking/cluster/nixops/default.nix     | 57 ++++++++++---------
 1 file changed, 30 insertions(+), 27 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index e6a8a69cc4c7..ea0f2af2b4fc 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -29,37 +29,40 @@ let
 
   # selector is a function mapping pythonPackages to a list of plugins
   # e.g. nixops_unstable.withPlugins (ps: with ps; [ nixops-aws ])
-  withPlugins' = { availablePlugins }: selector: let
-   selectedPlugins = selector availablePlugins;
-   r = python.pkgs.toPythonApplication (python.pkgs.nixops.overridePythonAttrs (old: {
-    propagatedBuildInputs = old.propagatedBuildInputs ++ selectedPlugins;
+  withPlugins' = { availablePlugins }: selector:
+    let
+      selectedPlugins = selector availablePlugins;
+      r = python.pkgs.toPythonApplication (python.pkgs.nixops.overridePythonAttrs (old: {
+        propagatedBuildInputs = old.propagatedBuildInputs ++ selectedPlugins;
 
-    # Propagating dependencies leaks them through $PYTHONPATH which causes issues
-    # when used in nix-shell.
-    postFixup = ''
-      rm $out/nix-support/propagated-build-inputs
-    '';
+        # Propagating dependencies leaks them through $PYTHONPATH which causes issues
+        # when used in nix-shell.
+        postFixup = ''
+          rm $out/nix-support/propagated-build-inputs
+        '';
 
-    passthru = old.passthru // {
-      inherit availablePlugins selectedPlugins;
-      inherit withPlugins python;
-      tests = old.passthru.tests // {
-        nixos = old.passthru.tests.nixos.passthru.override {
-          nixopsPkg = r;
+        passthru = old.passthru // {
+          inherit availablePlugins selectedPlugins;
+          inherit withPlugins python;
+          tests = old.passthru.tests // {
+            nixos = old.passthru.tests.nixos.passthru.override {
+              nixopsPkg = r;
+            };
+          }
+            # Make sure we also test with a configuration that's been extended with a plugin.
+            // lib.optionalAttrs (selectedPlugins == [ ]) {
+            withAPlugin =
+              lib.recurseIntoAttrs
+                (withPlugins (ps: with ps; [ nixops-encrypted-links ])).tests;
+          };
         };
-      }
-      # Make sure we also test with a configuration that's been extended with a plugin.
-      // lib.optionalAttrs (selectedPlugins == []) {
-        withAPlugin =
-          lib.recurseIntoAttrs
-            (withPlugins (ps: with ps; [ nixops-encrypted-links ])).tests;
-      };
-    };
-  }));
-  in r;
+      }));
+    in
+    r;
 
-in {
-  nixops_unstable_minimal = withPlugins (ps: []);
+in
+{
+  nixops_unstable_minimal = withPlugins (ps: [ ]);
 
   # Not recommended; too fragile.
   nixops_unstable_full = withPlugins (ps: [

From 48150e79c52b4f212ddf608d85b242c0a957fc2b Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 22:33:48 +0100
Subject: [PATCH 12/20] nixops_unstable_*: Use explicit fixpoint with
 encapsulation

No change in behavior. Just explicit recursion that's not taken
advantage of.

(This is working towards a managable setup for adding a bunch of
overriding methods that make life easier for external plugin
packagers.)
---
 .../networking/cluster/nixops/default.nix     | 123 ++++++++++--------
 1 file changed, 69 insertions(+), 54 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index ea0f2af2b4fc..ad3caf0d9dbf 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -1,71 +1,86 @@
 { lib, python3 }:
 
 let
-  python = python3.override {
-    packageOverrides = self: super: {
-      nixops = self.callPackage ./unwrapped.nix { };
-    } // (plugins self);
-  };
+  inherit (lib) extends;
 
-  plugins = ps: with ps; rec {
-    nixops-aws = callPackage ./plugins/nixops-aws.nix { };
-    nixops-digitalocean = callPackage ./plugins/nixops-digitalocean.nix { };
-    nixops-encrypted-links = callPackage ./plugins/nixops-encrypted-links.nix { };
-    nixops-gce = callPackage ./plugins/nixops-gce.nix { };
-    nixops-hercules-ci = callPackage ./plugins/nixops-hercules-ci.nix { };
-    nixops-hetzner = callPackage ./plugins/nixops-hetzner.nix { };
-    nixops-hetznercloud = callPackage ./plugins/nixops-hetznercloud.nix { };
-    nixops-libvirtd = callPackage ./plugins/nixops-libvirtd.nix { };
-    nixops-vbox = callPackage ./plugins/nixops-vbox.nix { };
-    nixos-modules-contrib = callPackage ./plugins/nixos-modules-contrib.nix { };
-
-    # aliases for backwards compatibility
-    nixops-gcp = nixops-gce;
-    nixops-virtd = nixops-libvirtd;
-    nixopsvbox = nixops-vbox;
-  };
-
-  withPlugins = withPlugins' { availablePlugins = plugins python.pkgs; };
-
-  # selector is a function mapping pythonPackages to a list of plugins
-  # e.g. nixops_unstable.withPlugins (ps: with ps; [ nixops-aws ])
-  withPlugins' = { availablePlugins }: selector:
+  # doc: https://github.com/NixOS/nixpkgs/pull/158781/files#diff-854251fa1fe071654921224671c8ba63c95feb2f96b2b3a9969c81676780053a
+  encapsulate = layerZero:
     let
-      selectedPlugins = selector availablePlugins;
-      r = python.pkgs.toPythonApplication (python.pkgs.nixops.overridePythonAttrs (old: {
-        propagatedBuildInputs = old.propagatedBuildInputs ++ selectedPlugins;
+      fixed = layerZero ({ extend = f: encapsulate (extends f layerZero); } // fixed);
+    in fixed.public;
 
-        # Propagating dependencies leaks them through $PYTHONPATH which causes issues
-        # when used in nix-shell.
-        postFixup = ''
-          rm $out/nix-support/propagated-build-inputs
-        '';
+  nixopsContextBase = this: {
 
-        passthru = old.passthru // {
-          inherit availablePlugins selectedPlugins;
-          inherit withPlugins python;
-          tests = old.passthru.tests // {
-            nixos = old.passthru.tests.nixos.passthru.override {
-              nixopsPkg = r;
+    python = python3.override {
+      packageOverrides = self: super: {
+        nixops = self.callPackage ./unwrapped.nix { };
+      } // (this.plugins self);
+    };
+
+    plugins = ps: with ps; rec {
+      nixops-aws = callPackage ./plugins/nixops-aws.nix { };
+      nixops-digitalocean = callPackage ./plugins/nixops-digitalocean.nix { };
+      nixops-encrypted-links = callPackage ./plugins/nixops-encrypted-links.nix { };
+      nixops-gce = callPackage ./plugins/nixops-gce.nix { };
+      nixops-hercules-ci = callPackage ./plugins/nixops-hercules-ci.nix { };
+      nixops-hetzner = callPackage ./plugins/nixops-hetzner.nix { };
+      nixops-hetznercloud = callPackage ./plugins/nixops-hetznercloud.nix { };
+      nixops-libvirtd = callPackage ./plugins/nixops-libvirtd.nix { };
+      nixops-vbox = callPackage ./plugins/nixops-vbox.nix { };
+      nixos-modules-contrib = callPackage ./plugins/nixos-modules-contrib.nix { };
+
+      # aliases for backwards compatibility
+      nixops-gcp = nixops-gce;
+      nixops-virtd = nixops-libvirtd;
+      nixopsvbox = nixops-vbox;
+    };
+
+    withPlugins = this.withPlugins' { availablePlugins = this.plugins this.python.pkgs; };
+
+    # selector is a function mapping pythonPackages to a list of plugins
+    # e.g. nixops_unstable.withPlugins (ps: with ps; [ nixops-aws ])
+    withPlugins' = { availablePlugins }: selector:
+      let
+        selectedPlugins = selector availablePlugins;
+        r = this.python.pkgs.toPythonApplication (this.python.pkgs.nixops.overridePythonAttrs (old: {
+          propagatedBuildInputs = old.propagatedBuildInputs ++ selectedPlugins;
+
+          # Propagating dependencies leaks them through $PYTHONPATH which causes issues
+          # when used in nix-shell.
+          postFixup = ''
+            rm $out/nix-support/propagated-build-inputs
+          '';
+
+          passthru = old.passthru // {
+            inherit availablePlugins selectedPlugins;
+            inherit (this) withPlugins python;
+            tests = old.passthru.tests // {
+              nixos = old.passthru.tests.nixos.passthru.override {
+                nixopsPkg = r;
+              };
+            }
+              # Make sure we also test with a configuration that's been extended with a plugin.
+              // lib.optionalAttrs (selectedPlugins == [ ]) {
+              withAPlugin =
+                lib.recurseIntoAttrs
+                  (this.withPlugins (ps: with ps; [ nixops-encrypted-links ])).tests;
             };
-          }
-            # Make sure we also test with a configuration that's been extended with a plugin.
-            // lib.optionalAttrs (selectedPlugins == [ ]) {
-            withAPlugin =
-              lib.recurseIntoAttrs
-                (withPlugins (ps: with ps; [ nixops-encrypted-links ])).tests;
           };
-        };
-      }));
-    in
-    r;
+        }));
+      in
+      r;
+
+    public = this.withPlugins (ps: []);
+  };
+
+  minimal = encapsulate nixopsContextBase;
 
 in
 {
-  nixops_unstable_minimal = withPlugins (ps: [ ]);
+  nixops_unstable_minimal = minimal;
 
   # Not recommended; too fragile.
-  nixops_unstable_full = withPlugins (ps: [
+  nixops_unstable_full = minimal.withPlugins (ps: [
     ps.nixops-aws
     ps.nixops-digitalocean
     ps.nixops-encrypted-links

From f5f2ef33fad2f550a833d754edc96686be66adf8 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 22:38:45 +0100
Subject: [PATCH 13/20] nixops_unstable_*: Remove ad-hoc availablePlugins
 overriding state

---
 .../applications/networking/cluster/nixops/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index ad3caf0d9dbf..f8373efdfecf 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -35,13 +35,13 @@ let
       nixopsvbox = nixops-vbox;
     };
 
-    withPlugins = this.withPlugins' { availablePlugins = this.plugins this.python.pkgs; };
+    availablePlugins = this.plugins this.python.pkgs;
 
     # selector is a function mapping pythonPackages to a list of plugins
     # e.g. nixops_unstable.withPlugins (ps: with ps; [ nixops-aws ])
-    withPlugins' = { availablePlugins }: selector:
+    withPlugins = selector:
       let
-        selectedPlugins = selector availablePlugins;
+        selectedPlugins = selector this.availablePlugins;
         r = this.python.pkgs.toPythonApplication (this.python.pkgs.nixops.overridePythonAttrs (old: {
           propagatedBuildInputs = old.propagatedBuildInputs ++ selectedPlugins;
 
@@ -52,8 +52,8 @@ let
           '';
 
           passthru = old.passthru // {
-            inherit availablePlugins selectedPlugins;
-            inherit (this) withPlugins python;
+            inherit selectedPlugins;
+            inherit (this) availablePlugins withPlugins python;
             tests = old.passthru.tests // {
               nixos = old.passthru.tests.nixos.passthru.override {
                 nixopsPkg = r;

From 576be941f8cceed14a6a937a61e42814a553312d Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 22:53:49 +0100
Subject: [PATCH 14/20] nixops_unstable_*: Remove ad-hoc selectedPlugins
 overriding state

---
 .../networking/cluster/nixops/default.nix       | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index f8373efdfecf..8bcd0f9db630 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -37,13 +37,19 @@ let
 
     availablePlugins = this.plugins this.python.pkgs;
 
+    selectedPlugins = [];
+
     # selector is a function mapping pythonPackages to a list of plugins
     # e.g. nixops_unstable.withPlugins (ps: with ps; [ nixops-aws ])
     withPlugins = selector:
-      let
+      this.extend (this: _old: {
         selectedPlugins = selector this.availablePlugins;
+      });
+
+    rawPackage =
+      let
         r = this.python.pkgs.toPythonApplication (this.python.pkgs.nixops.overridePythonAttrs (old: {
-          propagatedBuildInputs = old.propagatedBuildInputs ++ selectedPlugins;
+          propagatedBuildInputs = old.propagatedBuildInputs ++ this.selectedPlugins;
 
           # Propagating dependencies leaks them through $PYTHONPATH which causes issues
           # when used in nix-shell.
@@ -52,15 +58,14 @@ let
           '';
 
           passthru = old.passthru // {
-            inherit selectedPlugins;
-            inherit (this) availablePlugins withPlugins python;
+            inherit (this) selectedPlugins availablePlugins withPlugins python;
             tests = old.passthru.tests // {
               nixos = old.passthru.tests.nixos.passthru.override {
                 nixopsPkg = r;
               };
             }
               # Make sure we also test with a configuration that's been extended with a plugin.
-              // lib.optionalAttrs (selectedPlugins == [ ]) {
+              // lib.optionalAttrs (this.selectedPlugins == [ ]) {
               withAPlugin =
                 lib.recurseIntoAttrs
                   (this.withPlugins (ps: with ps; [ nixops-encrypted-links ])).tests;
@@ -70,7 +75,7 @@ let
       in
       r;
 
-    public = this.withPlugins (ps: []);
+    public = this.rawPackage;
   };
 
   minimal = encapsulate nixopsContextBase;

From 88e807a141d2d5e9049083381ec2a9ac9148455a Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 22:55:30 +0100
Subject: [PATCH 15/20] nixops_unstable_*: Remove unnecessary r fixpoint

---
 .../networking/cluster/nixops/default.nix     | 46 +++++++++----------
 1 file changed, 21 insertions(+), 25 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index 8bcd0f9db630..4d61e019a33e 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -46,34 +46,30 @@ let
         selectedPlugins = selector this.availablePlugins;
       });
 
-    rawPackage =
-      let
-        r = this.python.pkgs.toPythonApplication (this.python.pkgs.nixops.overridePythonAttrs (old: {
-          propagatedBuildInputs = old.propagatedBuildInputs ++ this.selectedPlugins;
+    rawPackage = this.python.pkgs.toPythonApplication (this.python.pkgs.nixops.overridePythonAttrs (old: {
+      propagatedBuildInputs = old.propagatedBuildInputs ++ this.selectedPlugins;
 
-          # Propagating dependencies leaks them through $PYTHONPATH which causes issues
-          # when used in nix-shell.
-          postFixup = ''
-            rm $out/nix-support/propagated-build-inputs
-          '';
+      # Propagating dependencies leaks them through $PYTHONPATH which causes issues
+      # when used in nix-shell.
+      postFixup = ''
+        rm $out/nix-support/propagated-build-inputs
+      '';
 
-          passthru = old.passthru // {
-            inherit (this) selectedPlugins availablePlugins withPlugins python;
-            tests = old.passthru.tests // {
-              nixos = old.passthru.tests.nixos.passthru.override {
-                nixopsPkg = r;
-              };
-            }
-              # Make sure we also test with a configuration that's been extended with a plugin.
-              // lib.optionalAttrs (this.selectedPlugins == [ ]) {
-              withAPlugin =
-                lib.recurseIntoAttrs
-                  (this.withPlugins (ps: with ps; [ nixops-encrypted-links ])).tests;
-            };
+      passthru = old.passthru // {
+        inherit (this) selectedPlugins availablePlugins withPlugins python;
+        tests = old.passthru.tests // {
+          nixos = old.passthru.tests.nixos.passthru.override {
+            nixopsPkg = rawPackage;
           };
-        }));
-      in
-      r;
+        }
+          # Make sure we also test with a configuration that's been extended with a plugin.
+          // lib.optionalAttrs (this.selectedPlugins == [ ]) {
+          withAPlugin =
+            lib.recurseIntoAttrs
+              (this.withPlugins (ps: with ps; [ nixops-encrypted-links ])).tests;
+        };
+      };
+    }));
 
     public = this.rawPackage;
   };

From 8b9543baac8c68e46382edc92ff3c65294af1310 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 23:16:59 +0100
Subject: [PATCH 16/20] nixops_unstable_*: Forward overrideAttrs

---
 .../networking/cluster/nixops/default.nix     | 38 +++++++++++--------
 1 file changed, 22 insertions(+), 16 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index 4d61e019a33e..058400c2d94d 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -54,24 +54,30 @@ let
       postFixup = ''
         rm $out/nix-support/propagated-build-inputs
       '';
-
-      passthru = old.passthru // {
-        inherit (this) selectedPlugins availablePlugins withPlugins python;
-        tests = old.passthru.tests // {
-          nixos = old.passthru.tests.nixos.passthru.override {
-            nixopsPkg = rawPackage;
-          };
-        }
-          # Make sure we also test with a configuration that's been extended with a plugin.
-          // lib.optionalAttrs (this.selectedPlugins == [ ]) {
-          withAPlugin =
-            lib.recurseIntoAttrs
-              (this.withPlugins (ps: with ps; [ nixops-encrypted-links ])).tests;
-        };
-      };
     }));
 
-    public = this.rawPackage;
+    # Extra package attributes that aren't derivation attributes, just like `mkDerivation`'s `passthru`.
+    extraPackageAttrs = {
+      inherit (this) selectedPlugins availablePlugins withPlugins python;
+      tests = this.rawPackage.tests // {
+        nixos = this.rawPackage.tests.nixos.passthru.override {
+          nixopsPkg = this.rawPackage;
+        };
+      }
+        # Make sure we also test with a configuration that's been extended with a plugin.
+        // lib.optionalAttrs (this.selectedPlugins == [ ]) {
+        withAPlugin =
+          lib.recurseIntoAttrs
+            (this.withPlugins (ps: with ps; [ nixops-encrypted-links ])).tests;
+      };
+      overrideAttrs = f: this.extend (this: oldThis: {
+        rawPackage = oldThis.rawPackage.overrideAttrs f;
+      });
+    };
+
+    package = lib.lazyDerivation { outputs = [ "out" "dist" ]; derivation = this.rawPackage; } // this.extraPackageAttrs;
+
+    public = this.package;
   };
 
   minimal = encapsulate nixopsContextBase;

From 5a1285c2163173217d2adc5f56a4b7bd5234b714 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 23:38:47 +0100
Subject: [PATCH 17/20] nixops_unstable_*: Add addAvailablePlugins

---
 .../networking/cluster/nixops/default.nix        | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index 058400c2d94d..d3efd3ed2448 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -14,10 +14,10 @@ let
     python = python3.override {
       packageOverrides = self: super: {
         nixops = self.callPackage ./unwrapped.nix { };
-      } // (this.plugins self);
+      } // (this.plugins self super);
     };
 
-    plugins = ps: with ps; rec {
+    plugins = ps: _super: with ps; rec {
       nixops-aws = callPackage ./plugins/nixops-aws.nix { };
       nixops-digitalocean = callPackage ./plugins/nixops-digitalocean.nix { };
       nixops-encrypted-links = callPackage ./plugins/nixops-encrypted-links.nix { };
@@ -35,7 +35,8 @@ let
       nixopsvbox = nixops-vbox;
     };
 
-    availablePlugins = this.plugins this.python.pkgs;
+    # We should not reapply the overlay, but it tends to work out. (It's been this way since poetry2nix was dropped.)
+    availablePlugins = this.plugins this.python.pkgs this.python.pkgs;
 
     selectedPlugins = [];
 
@@ -73,6 +74,15 @@ let
       overrideAttrs = f: this.extend (this: oldThis: {
         rawPackage = oldThis.rawPackage.overrideAttrs f;
       });
+      /**
+       * nixops.addAvailablePlugins: Overlay -> Package
+       *
+       * Add available plugins to the package. You probably also want to enable
+       * them with the `withPlugins` method.
+       */
+      addAvailablePlugins = newPlugins: this.extend (finalThis: oldThis: {
+        plugins = lib.composeExtensions oldThis.plugins newPlugins;
+      });
     };
 
     package = lib.lazyDerivation { outputs = [ "out" "dist" ]; derivation = this.rawPackage; } // this.extraPackageAttrs;

From 114af421c5a708a6dedf0c4f27f8bca0502267a8 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 23:48:57 +0100
Subject: [PATCH 18/20] nixops_unstable_*: Test addAvailablePlugins and
 withPlugins commute

Actually the lack of instantiation is the main purpose, but it's nice
to test commutativity too. (Even if it's just one example...)
---
 pkgs/applications/networking/cluster/nixops/default.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index d3efd3ed2448..1e086bb5c571 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -1,4 +1,4 @@
-{ lib, python3 }:
+{ lib, python3, emptyFile }:
 
 let
   inherit (lib) extends;
@@ -64,6 +64,13 @@ let
         nixos = this.rawPackage.tests.nixos.passthru.override {
           nixopsPkg = this.rawPackage;
         };
+        commutative_addAvailablePlugins_withPlugins =
+          assert
+            (this.public.addAvailablePlugins (self: super: { inherit emptyFile; })).withPlugins (ps: [ emptyFile ])
+            ==
+            # Note that this value proves that the package is not instantiated until the end, where it's valid again.
+            (this.public.withPlugins (ps: [ emptyFile ])).addAvailablePlugins (self: super: { inherit emptyFile; });
+          emptyFile;
       }
         # Make sure we also test with a configuration that's been extended with a plugin.
         // lib.optionalAttrs (this.selectedPlugins == [ ]) {

From 5e1bf24bc97568fbab49156b1b8396c4a61d0b35 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 28 Feb 2024 23:57:23 +0100
Subject: [PATCH 19/20] nixops_unstable_*: Expose internals politely

---
 pkgs/applications/networking/cluster/nixops/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index 1e086bb5c571..75902de1b9f6 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -90,6 +90,9 @@ let
       addAvailablePlugins = newPlugins: this.extend (finalThis: oldThis: {
         plugins = lib.composeExtensions oldThis.plugins newPlugins;
       });
+
+      # For those who need or dare.
+      internals = this;
     };
 
     package = lib.lazyDerivation { outputs = [ "out" "dist" ]; derivation = this.rawPackage; } // this.extraPackageAttrs;

From e63713d2b70cddcec7886ac138b00c2704c1e9d5 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 29 Feb 2024 02:12:20 +0100
Subject: [PATCH 20/20] nixops_unstablePlugins.nixops-aws: 2023-08-09 ->
 2024-02-29

---
 .../networking/cluster/nixops/plugins/nixops-aws.nix        | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-aws.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-aws.nix
index 06d8135bc9ff..78b9bc879aaa 100644
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-aws.nix
+++ b/pkgs/applications/networking/cluster/nixops/plugins/nixops-aws.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage {
   pname = "nixops-aws";
-  version = "unstable-2023-08-09";
+  version = "unstable-2024-02-29";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "nixops-aws";
-    rev = "8802d1cda9004ec1362815292c2a8ab95e6d64e8";
-    hash = "sha256-i0KjFrwpDHRch9jorccdVwnjAQiORClDUqm2R2xvwuU=";
+    rev = "d173b2f14ec767d782ceab45fb22b32fe3b5a1f7";
+    hash = "sha256-ocTtc7POt1bugb9Bki2ew2Eh5uc933GftNw1twoOJsc=";
   };
 
   postPatch = ''