You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

rl-1909.xml 39KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838
  1. <section xmlns="http://docbook.org/ns/docbook"
  2. xmlns:xlink="http://www.w3.org/1999/xlink"
  3. xmlns:xi="http://www.w3.org/2001/XInclude"
  4. version="5.0"
  5. xml:id="sec-release-19.09">
  6. <title>Release 19.09 (“Loris”, 2019/09/??)</title>
  7. <section xmlns="http://docbook.org/ns/docbook"
  8. xmlns:xlink="http://www.w3.org/1999/xlink"
  9. xmlns:xi="http://www.w3.org/2001/XInclude"
  10. version="5.0"
  11. xml:id="sec-release-19.09-highlights">
  12. <title>Highlights</title>
  13. <para>
  14. In addition to numerous new and upgraded packages, this release has the
  15. following highlights:
  16. </para>
  17. <itemizedlist>
  18. <listitem>
  19. <para>
  20. End of support is planned for end of April 2020, handing over to 20.03.
  21. </para>
  22. </listitem>
  23. <listitem>
  24. <para>
  25. PHP now defaults to PHP 7.3, updated from 7.2.
  26. </para>
  27. </listitem>
  28. <listitem>
  29. <para>
  30. PHP 7.1 is no longer supported due to upstream not supporting this version for the entire lifecycle of the 19.09 release.
  31. </para>
  32. </listitem>
  33. <listitem>
  34. <para>
  35. The binfmt module is now easier to use. Additional systems can
  36. be added through <option>boot.binfmt.emulatedSystems</option>.
  37. For instance, <literal>boot.binfmt.emulatedSystems = [
  38. "wasm32-wasi" "x86_64-windows" "aarch64-linux" ];</literal> will
  39. set up binfmt interpreters for each of those listed systems.
  40. </para>
  41. </listitem>
  42. <listitem>
  43. <para>
  44. The installer now uses a less privileged <literal>nixos</literal> user whereas before we logged in as root.
  45. To gain root privileges use <literal>sudo -i</literal> without a password.
  46. </para>
  47. </listitem>
  48. <listitem>
  49. <para>
  50. We've updated to Xfce 4.14, which brings a new module <option>services.xserver.desktopManager.xfce4-14</option>.
  51. If you'd like to upgrade, please switch from the <option>services.xserver.desktopManager.xfce</option> module as it
  52. will be deprecated in a future release. They're incompatibilities with the current Xfce module; it doesn't support
  53. <option>thunarPlugins</option> and it isn't recommended to use <option>services.xserver.desktopManager.xfce</option>
  54. and <option>services.xserver.desktopManager.xfce4-14</option> simultaneously or to downgrade from Xfce 4.14 after upgrading.
  55. </para>
  56. </listitem>
  57. <listitem>
  58. <para>
  59. The GNOME 3 desktop manager module sports an interface to enable/disable core services, applications, and optional GNOME packages
  60. like games.
  61. <itemizedlist>
  62. <para>This can be achieved with the following options which the desktop manager default enables, excluding <literal>games</literal>.</para>
  63. <listitem><para><xref linkend="opt-services.gnome3.core-os-services.enable"/></para></listitem>
  64. <listitem><para><xref linkend="opt-services.gnome3.core-shell.enable"/></para></listitem>
  65. <listitem><para><xref linkend="opt-services.gnome3.core-utilities.enable"/></para></listitem>
  66. <listitem><para><xref linkend="opt-services.gnome3.games.enable"/></para></listitem>
  67. </itemizedlist>
  68. With these options we hope to give users finer grained control over their systems. Prior to this change you'd either have to manually
  69. disable options or use <option>environment.gnome3.excludePackages</option> which only excluded the optional applications.
  70. <option>environment.gnome3.excludePackages</option> is now unguarded, it can exclude any package installed with <option>environment.systemPackages</option>
  71. in the GNOME 3 module.
  72. </para>
  73. </listitem>
  74. <listitem>
  75. <para>
  76. Orthogonal to the previous changes to the GNOME 3 desktop manager module, we've updated all default services and applications
  77. to match as close as possible to a default reference GNOME 3 experience.
  78. </para>
  79. <bridgehead>The following changes were enacted in <option>services.gnome3.core-utilities.enable</option></bridgehead>
  80. <itemizedlist>
  81. <title>Applications removed from defaults:</title>
  82. <listitem><para><literal>accerciser</literal></para></listitem>
  83. <listitem><para><literal>dconf-editor</literal></para></listitem>
  84. <listitem><para><literal>evolution</literal></para></listitem>
  85. <listitem><para><literal>gnome-documents</literal></para></listitem>
  86. <listitem><para><literal>gnome-nettool</literal></para></listitem>
  87. <listitem><para><literal>gnome-power-manager</literal></para></listitem>
  88. <listitem><para><literal>gnome-todo</literal></para></listitem>
  89. <listitem><para><literal>gnome-tweaks</literal></para></listitem>
  90. <listitem><para><literal>gnome-usage</literal></para></listitem>
  91. <listitem><para><literal>gucharmap</literal></para></listitem>
  92. <listitem><para><literal>nautilus-sendto</literal></para></listitem>
  93. <listitem><para><literal>vinagre</literal></para></listitem>
  94. </itemizedlist>
  95. <itemizedlist>
  96. <title>Applications added to defaults:</title>
  97. <listitem><para><literal>cheese</literal></para></listitem>
  98. <listitem><para><literal>geary</literal></para></listitem>
  99. </itemizedlist>
  100. <bridgehead>The following changes were enacted in <option>services.gnome3.core-shell.enable</option></bridgehead>
  101. <itemizedlist>
  102. <title>Applications added to defaults:</title>
  103. <listitem><para><literal>gnome-color-manager</literal></para></listitem>
  104. <listitem><para><literal>orca</literal></para></listitem>
  105. </itemizedlist>
  106. <itemizedlist>
  107. <title>Services enabled:</title>
  108. <listitem><para><option>services.avahi.enable</option></para></listitem>
  109. </itemizedlist>
  110. </listitem>
  111. </itemizedlist>
  112. </section>
  113. <section xmlns="http://docbook.org/ns/docbook"
  114. xmlns:xlink="http://www.w3.org/1999/xlink"
  115. xmlns:xi="http://www.w3.org/2001/XInclude"
  116. version="5.0"
  117. xml:id="sec-release-19.09-new-services">
  118. <title>New Services</title>
  119. <para>
  120. The following new services were added since the last release:
  121. </para>
  122. <itemizedlist>
  123. <listitem>
  124. <para>
  125. <literal>./programs/dwm-status.nix</literal>
  126. </para>
  127. </listitem>
  128. <listitem>
  129. <para>
  130. The new <varname>hardware.printers</varname> module allows to declaratively configure CUPS printers
  131. via the <varname>ensurePrinters</varname> and
  132. <varname>ensureDefaultPrinter</varname> options.
  133. <varname>ensurePrinters</varname> will never delete existing printers,
  134. but will make sure that the given printers are configured as declared.
  135. </para>
  136. </listitem>
  137. <listitem>
  138. <para>
  139. There is a new <xref linkend="opt-services.system-config-printer.enable"/> and <xref linkend="opt-programs.system-config-printer.enable"/> module
  140. for the program of the same name. If you previously had <literal>system-config-printer</literal> enabled through some other
  141. means you should migrate to using one of these modules.
  142. </para>
  143. <itemizedlist>
  144. <para>If you're a user of the following desktopManager modules no action is needed:</para>
  145. <listitem>
  146. <para><option>services.xserver.desktopManager.plasma5</option></para>
  147. </listitem>
  148. <listitem>
  149. <para><option>services.xserver.desktopManager.gnome3</option></para>
  150. </listitem>
  151. <listitem>
  152. <para><option>services.xserver.desktopManager.pantheon</option></para>
  153. </listitem>
  154. <listitem>
  155. <para><option>services.xserver.desktopManager.mate</option></para>
  156. <para>
  157. Note Mate uses <literal>programs.system-config-printer</literal> as it doesn't
  158. use it as a service, but its graphical interface directly.
  159. </para>
  160. </listitem>
  161. </itemizedlist>
  162. </listitem>
  163. </itemizedlist>
  164. </section>
  165. <section xmlns="http://docbook.org/ns/docbook"
  166. xmlns:xlink="http://www.w3.org/1999/xlink"
  167. xmlns:xi="http://www.w3.org/2001/XInclude"
  168. version="5.0"
  169. xml:id="sec-release-19.09-incompatibilities">
  170. <title>Backward Incompatibilities</title>
  171. <para>
  172. When upgrading from a previous release, please be aware of the following
  173. incompatible changes:
  174. </para>
  175. <itemizedlist>
  176. <listitem>
  177. <para>
  178. Buildbot no longer supports Python 2, as support was dropped upstream in
  179. version 2.0.0. Configurations may need to be modified to make them
  180. compatible with Python 3.
  181. </para>
  182. </listitem>
  183. <listitem>
  184. <para>
  185. PostgreSQL now uses
  186. <filename class="directory">/run/postgresql</filename> as its socket
  187. directory instead of <filename class="directory">/tmp</filename>. So
  188. if you run an application like eg. Nextcloud, where you need to use
  189. the Unix socket path as the database host name, you need to change it
  190. accordingly.
  191. </para>
  192. </listitem>
  193. <listitem>
  194. <para>
  195. PostgreSQL 9.4 is scheduled EOL during the 19.09 life cycle and has been removed.
  196. </para>
  197. </listitem>
  198. <listitem>
  199. <para>
  200. The options <option>services.prometheus.alertmanager.user</option> and
  201. <option>services.prometheus.alertmanager.group</option> have been removed
  202. because the alertmanager service is now using systemd's <link
  203. xlink:href="http://0pointer.net/blog/dynamic-users-with-systemd.html">
  204. DynamicUser mechanism</link> which obviates these options.
  205. </para>
  206. </listitem>
  207. <listitem>
  208. <para>
  209. The NetworkManager systemd unit was renamed back from network-manager.service to
  210. NetworkManager.service for better compatibility with other applications expecting this name.
  211. The same applies to ModemManager where modem-manager.service is now called ModemManager.service again.
  212. </para>
  213. </listitem>
  214. <listitem>
  215. <para>
  216. The <option>services.nzbget.configFile</option> and <option>services.nzbget.openFirewall</option>
  217. options were removed as they are managed internally by the nzbget. The
  218. <option>services.nzbget.dataDir</option> option hadn't actually been used by
  219. the module for some time and so was removed as cleanup.
  220. </para>
  221. </listitem>
  222. <listitem>
  223. <para>
  224. The <option>services.mysql.pidDir</option> option was removed, as it was only used by the wordpress
  225. apache-httpd service to wait for mysql to have started up.
  226. This can be accomplished by either describing a dependency on mysql.service (preferred)
  227. or waiting for the (hardcoded) <filename>/run/mysqld/mysql.sock</filename> file to appear.
  228. </para>
  229. </listitem>
  230. <listitem>
  231. <para>
  232. The <option>services.emby.enable</option> module has been removed, see
  233. <option>services.jellyfin.enable</option> instead for a free software fork of Emby.
  234. See the Jellyfin documentation:
  235. <link xlink:href="https://jellyfin.readthedocs.io/en/latest/administrator-docs/migrate-from-emby/">
  236. Migrating from Emby to Jellyfin
  237. </link>
  238. </para>
  239. </listitem>
  240. <listitem>
  241. <para>
  242. IPv6 Privacy Extensions are now enabled by default for undeclared
  243. interfaces. The previous behaviour was quite misleading — even though
  244. the default value for
  245. <option>networking.interfaces.*.preferTempAddress</option> was
  246. <literal>true</literal>, undeclared interfaces would not prefer temporary
  247. addresses. Now, interfaces not mentioned in the config will prefer
  248. temporary addresses. EUI64 addresses can still be set as preferred by
  249. explicitly setting the option to <literal>false</literal> for the
  250. interface in question.
  251. </para>
  252. </listitem>
  253. <listitem>
  254. <para>
  255. Since Bittorrent Sync was superseded by Resilio Sync in 2016, the
  256. <literal>bittorrentSync</literal>, <literal>bittorrentSync14</literal>,
  257. and <literal>bittorrentSync16</literal> packages have been removed in
  258. favor of <literal>resilio-sync</literal>.
  259. </para>
  260. <para>
  261. The corresponding module, <option>services.btsync</option> has been
  262. replaced by the <option>services.resilio</option> module.
  263. </para>
  264. </listitem>
  265. <listitem>
  266. <para>
  267. The httpd service no longer attempts to start the postgresql service. If you have come to depend
  268. on this behaviour then you can preserve the behavior with the following configuration:
  269. <literal>systemd.services.httpd.after = [ "postgresql.service" ];</literal>
  270. </para>
  271. <para>
  272. The option <option>services.httpd.extraSubservices</option> has been
  273. marked as deprecated. You may still use this feature, but it will be
  274. removed in a future release of NixOS. You are encouraged to convert any
  275. httpd subservices you may have written to a full NixOS module.
  276. </para>
  277. <para>
  278. Most of the httpd subservices packaged with NixOS have been replaced with
  279. full NixOS modules including LimeSurvey, WordPress, and Zabbix. These
  280. modules can be enabled using the <option>services.limesurvey.enable</option>,
  281. <option>services.mediawiki.enable</option>, <option>services.wordpress.enable</option>,
  282. and <option>services.zabbixWeb.enable</option> options.
  283. </para>
  284. </listitem>
  285. <listitem>
  286. <para>
  287. The option <option>systemd.network.networks.&lt;name&gt;.routes.*.routeConfig.GatewayOnlink</option>
  288. was renamed to <option>systemd.network.networks.&lt;name&gt;.routes.*.routeConfig.GatewayOnLink</option>
  289. (capital <literal>L</literal>). This follows
  290. <link xlink:href="https://github.com/systemd/systemd/commit/9cb8c5593443d24c19e40bfd4fc06d672f8c554c">
  291. upstreams renaming
  292. </link> of the setting.
  293. </para>
  294. </listitem>
  295. <listitem>
  296. <para>
  297. As of this release the NixOps feature <literal>autoLuks</literal> is deprecated. It no longer works
  298. with our systemd version without manual intervention.
  299. </para>
  300. <para>
  301. Whenever the usage of the module is detected the evaluation will fail with a message
  302. explaining why and how to deal with the situation.
  303. </para>
  304. <para>
  305. A new knob named <literal>nixops.enableDeprecatedAutoLuks</literal>
  306. has been introduced to disable the eval failure and to acknowledge the notice was received and read.
  307. If you plan on using the feature please note that it might break with subsequent updates.
  308. </para>
  309. <para>
  310. Make sure you set the <literal>_netdev</literal> option for each of the file systems referring to block
  311. devices provided by the autoLuks module. Not doing this might render the system in a
  312. state where it doesn't boot anymore.
  313. </para>
  314. <para>
  315. If you are actively using the <literal>autoLuks</literal> module please let us know in
  316. <link xlink:href="https://github.com/NixOS/nixpkgs/issues/62211">issue #62211</link>.
  317. </para>
  318. </listitem>
  319. <listitem>
  320. <para>
  321. The setopt declarations will be evaluated at the end of <literal>/etc/zshrc</literal>, so any code in <xref linkend="opt-programs.zsh.interactiveShellInit" />,
  322. <xref linkend="opt-programs.zsh.loginShellInit" /> and <xref linkend="opt-programs.zsh.promptInit" /> may break if it relies on those options being set.
  323. </para>
  324. </listitem>
  325. <listitem>
  326. <para>
  327. The <literal>prometheus-nginx-exporter</literal> package now uses the offical exporter provided by NGINX Inc.
  328. Its metrics are differently structured and are incompatible to the old ones. For information about the metrics,
  329. have a look at the <link xlink:href="https://github.com/nginxinc/nginx-prometheus-exporter">official repo</link>.
  330. </para>
  331. </listitem>
  332. <listitem>
  333. <para>
  334. The <literal>shibboleth-sp</literal> package has been updated to version 3.
  335. It is largely backward compatible, for further information refer to the
  336. <link xlink:href="https://wiki.shibboleth.net/confluence/display/SP3/ReleaseNotes">release notes</link>
  337. and <link xlink:href="https://wiki.shibboleth.net/confluence/display/SP3/UpgradingFromV2">upgrade guide</link>.
  338. </para>
  339. <para>
  340. Nodejs 8 is scheduled EOL under the lifetime of 19.09 and has been dropped.
  341. </para>
  342. </listitem>
  343. <listitem>
  344. <para>
  345. By default, prometheus exporters are now run with <literal>DynamicUser</literal> enabled.
  346. Exporters that need a real user, now run under a seperate user and group which follow the pattern <literal>&lt;exporter-name&gt;-exporter</literal>, instead of the previous default <literal>nobody</literal> and <literal>nogroup</literal>.
  347. Only some exporters are affected by the latter, namely the exporters <literal>dovecot</literal>, <literal>node</literal>, <literal>postfix</literal> and <literal>varnish</literal>.
  348. </para>
  349. </listitem>
  350. <listitem>
  351. <para>
  352. The <literal>ibus-qt</literal> package is not installed by default anymore when <xref linkend="opt-i18n.inputMethod.enabled" /> is set to <literal>ibus</literal>.
  353. If IBus support in Qt 4.x applications is required, add the <literal>ibus-qt</literal> package to your <xref linkend="opt-environment.systemPackages" /> manually.
  354. </para>
  355. </listitem>
  356. <listitem>
  357. <para>
  358. The CUPS Printing service now uses socket-based activation by
  359. default, only starting when needed. The previous behavior can
  360. be restored by setting
  361. <option>services.cups.startWhenNeeded</option> to
  362. <literal>false</literal>.
  363. </para>
  364. </listitem>
  365. <listitem>
  366. <para>
  367. The <option>services.systemhealth</option> module has been removed from nixpkgs due to lack of maintainer.
  368. </para>
  369. </listitem>
  370. <listitem>
  371. <para>
  372. The <option>services.mantisbt</option> module has been removed from nixpkgs due to lack of maintainer.
  373. </para>
  374. </listitem>
  375. <listitem>
  376. <para>
  377. Squid 3 has been removed and the <option>squid</option> derivation now refers to Squid 4.
  378. </para>
  379. </listitem>
  380. <listitem>
  381. <para>
  382. The <option>services.pdns-recursor.extraConfig</option> option has been replaced by
  383. <option>services.pdns-recursor.settings</option>. The new option allows setting extra
  384. configuration while being better type-checked and mergeable.
  385. </para>
  386. </listitem>
  387. <listitem>
  388. <para>
  389. No service depends on <literal>keys.target</literal> anymore which is a systemd
  390. target that indicates if all <link xlink:href="https://nixos.org/nixops/manual/#idm140737322342384">NixOps keys</link> were successfully uploaded.
  391. Instead, <literal>&lt;key-name&gt;-key.service</literal> should be used to define
  392. a dependency of a key in a service. The full issue behind the <literal>keys.target</literal>
  393. dependency is described at <link xlink:href="https://github.com/NixOS/nixpkgs/issues/67265">NixOS/nixpkgs#67265</link>.
  394. </para>
  395. <para>
  396. The following services are affected by this:
  397. <itemizedlist>
  398. <listitem><para><link linkend="opt-services.dovecot2.enable"><literal>services.dovecot2</literal></link></para></listitem>
  399. <listitem><para><link linkend="opt-services.nsd.enable"><literal>services.nsd</literal></link></para></listitem>
  400. <listitem><para><link linkend="opt-services.softether.enable"><literal>services.softether</literal></link></para></listitem>
  401. <listitem><para><link linkend="opt-services.strongswan.enable"><literal>services.strongswan</literal></link></para></listitem>
  402. <listitem><para><link linkend="opt-services.strongswan-swanctl.enable"><literal>services.strongswan-swanctl</literal></link></para></listitem>
  403. <listitem><para><link linkend="opt-services.httpd.enable"><literal>services.httpd</literal></link></para></listitem>
  404. </itemizedlist>
  405. </para>
  406. </listitem>
  407. <listitem>
  408. <para>
  409. The <option>security.acme.directory</option> option has been replaced by a read-only <option>security.acme.certs.&lt;cert&gt;.directory</option> option for each certificate you define. This will be
  410. a subdirectory of <literal>/var/lib/acme</literal>. You can use this read-only option to figure out where the certificates are stored for a specific certificate. For example,
  411. the <option>services.nginx.virtualhosts.&lt;name&gt;.enableACME</option> option will use this directory option to find the certs for the virtual host.
  412. </para>
  413. <para>
  414. <option>security.acme.preDelay</option> and <option>security.acme.activationDelay</option> options have been removed. To execute a service before certificates
  415. are provisioned or renewed add a <literal>RequiredBy=acme-${cert}.service</literal> to any service.
  416. </para>
  417. <para>
  418. Furthermore, the acme module will not automatically add a dependency on <literal>lighttpd.service</literal> anymore. If you are using certficates provided by letsencrypt
  419. for lighttpd, then you should depend on the certificate service <literal>acme-${cert}.service></literal> manually.
  420. </para>
  421. <para>
  422. For nginx, the dependencies are still automatically managed when <option>services.nginx.virtualhosts.&lt;name&gt;.enableACME</option> is enabled just like before. What changed is that nginx now directly depends on the specific certificates that it needs,
  423. instead of depending on the catch-all <literal>acme-certificates.target</literal>. This target unit was also removed from the codebase.
  424. This will mean nginx will no longer depend on certificates it isn't explicitly managing and fixes a bug with certificate renewal
  425. ordering racing with nginx restarting which could lead to nginx getting in a broken state as described at
  426. <link xlink:href="https://github.com/NixOS/nixpkgs/issues/60180">NixOS/nixpkgs#60180</link>.
  427. </para>
  428. </listitem>
  429. <listitem>
  430. <para>
  431. The old deprecated <literal>emacs</literal> package sets have been dropped.
  432. What used to be called <literal>emacsPackagesNg</literal> is now simply called <literal>emacsPackages</literal>.
  433. </para>
  434. </listitem>
  435. <listitem>
  436. <para>
  437. <option>services.xserver.desktopManager.xterm</option> is now disabled by default if <literal>stateVersion</literal> is 19.09 or higher.
  438. Previously the xterm desktopManager was enabled when xserver was enabled, but it isn't useful for all people so it didn't make sense to
  439. have any desktopManager enabled default.
  440. </para>
  441. </listitem>
  442. <listitem>
  443. <para>
  444. The WeeChat plugin <literal>pkgs.weechatScripts.weechat-xmpp</literal> has been removed as it doesn't receive
  445. any updates from upstream and depends on outdated Python2-based modules.
  446. </para>
  447. </listitem>
  448. <listitem>
  449. <para>
  450. Old unsupported versions (<literal>logstash5</literal>,
  451. <literal>kibana5</literal>,
  452. <literal>filebeat5</literal>,
  453. <literal>heartbeat5</literal>,
  454. <literal>metricbeat5</literal>,
  455. <literal>packetbeat5</literal>) of the ELK-stack and Elastic beats have been removed.
  456. </para>
  457. </listitem>
  458. <listitem>
  459. <para>
  460. For NixOS 19.03, both Prometheus 1 and 2 were available to allow for
  461. a seamless transition from version 1 to 2 with existing setups.
  462. Because Prometheus 1 is no longer developed, it was removed.
  463. Prometheus 2 is now configured with <literal>services.prometheus</literal>.
  464. </para>
  465. </listitem>
  466. <listitem>
  467. <para>
  468. Citrix Receiver (<literal>citrix_receiver</literal>) has been dropped in favor of Citrix Workspace
  469. (<literal>citrix_workspace</literal>).
  470. </para>
  471. </listitem>
  472. <listitem>
  473. <para>
  474. The <literal>services.gitlab</literal> module has had its literal secret options (<option>services.gitlab.smtp.password</option>,
  475. <option>services.gitlab.databasePassword</option>,
  476. <option>services.gitlab.initialRootPassword</option>,
  477. <option>services.gitlab.secrets.secret</option>,
  478. <option>services.gitlab.secrets.db</option>,
  479. <option>services.gitlab.secrets.otp</option> and
  480. <option>services.gitlab.secrets.jws</option>) replaced by file-based versions (<option>services.gitlab.smtp.passwordFile</option>,
  481. <option>services.gitlab.databasePasswordFile</option>,
  482. <option>services.gitlab.initialRootPasswordFile</option>,
  483. <option>services.gitlab.secrets.secretFile</option>,
  484. <option>services.gitlab.secrets.dbFile</option>,
  485. <option>services.gitlab.secrets.otpFile</option> and
  486. <option>services.gitlab.secrets.jwsFile</option>). This was done so that secrets aren't stored
  487. in the world-readable nix store, but means that for each option you'll have to create a file with
  488. the same exact string, add "File" to the end of the option name, and change the definition to a
  489. string pointing to the corresponding file; e.g. <literal>services.gitlab.databasePassword = "supersecurepassword"</literal>
  490. becomes <literal>services.gitlab.databasePasswordFile = "/path/to/secret_file"</literal> where the
  491. file <literal>secret_file</literal> contains the string <literal>supersecurepassword</literal>.
  492. </para>
  493. <para>
  494. The state path (<option>services.gitlab.statePath</option>) now has the following restriction:
  495. no parent directory can be owned by any other user than <literal>root</literal> or the user
  496. specified in <option>services.gitlab.user</option>; i.e. if <option>services.gitlab.statePath</option>
  497. is set to <literal>/var/lib/gitlab/state</literal>, <literal>gitlab</literal> and all parent directories
  498. must be owned by either <literal>root</literal> or the user specified in <option>services.gitlab.user</option>.
  499. </para>
  500. <para>
  501. The <option>networking.useDHCP</option> option is unsupported in combination with
  502. <option>networking.useNetworkd</option> in anticipation of defaulting to it by default.
  503. It has to be set to <literal>false</literal> and enabled per
  504. interface with <option>networking.interfaces.&lt;name&gt;.useDHCP = true;</option>
  505. </para>
  506. </listitem>
  507. <listitem>
  508. <para>
  509. The Twitter client <literal>corebird</literal> has been dropped as <link xlink:href="https://www.patreon.com/posts/corebirds-future-18921328">it is discontinued and does not work against the new Twitter API</link>.
  510. Please use the fork <literal>cawbird</literal> instead which has been adapted to the API changes and is still maintained.
  511. </para>
  512. </listitem>
  513. <listitem>
  514. <para>
  515. The <literal>nodejs-11_x</literal> package has been removed as it's EOLed by upstream.
  516. </para>
  517. </listitem>
  518. </itemizedlist>
  519. </section>
  520. <section xmlns="http://docbook.org/ns/docbook"
  521. xmlns:xlink="http://www.w3.org/1999/xlink"
  522. xmlns:xi="http://www.w3.org/2001/XInclude"
  523. version="5.0"
  524. xml:id="sec-release-19.09-notable-changes">
  525. <title>Other Notable Changes</title>
  526. <itemizedlist>
  527. <listitem>
  528. <para>
  529. The <option>documentation</option> module gained an option named
  530. <option>documentation.nixos.includeAllModules</option> which makes the
  531. generated <citerefentry>
  532. <refentrytitle>configuration.nix</refentrytitle>
  533. <manvolnum>5</manvolnum></citerefentry> manual page include all options
  534. from all NixOS modules included in a given
  535. <literal>configuration.nix</literal> configuration file. Currently, it is
  536. set to <literal>false</literal> by default as enabling it frequently
  537. prevents evaluation. But the plan is to eventually have it set to
  538. <literal>true</literal> by default. Please set it to
  539. <literal>true</literal> now in your <literal>configuration.nix</literal>
  540. and fix all the bugs it uncovers.
  541. </para>
  542. </listitem>
  543. <listitem>
  544. <para>
  545. The <literal>vlc</literal> package gained support for Chromecast
  546. streaming, enabled by default. TCP port 8010 must be open for it to work,
  547. so something like <literal>networking.firewall.allowedTCPPorts = [ 8010
  548. ];</literal> may be required in your configuration. Also consider enabling
  549. <link xlink:href="https://nixos.wiki/wiki/Accelerated_Video_Playback">
  550. Accelerated Video Playback</link> for better transcoding performance.
  551. </para>
  552. </listitem>
  553. <listitem>
  554. <para>
  555. The following changes apply if the <literal>stateVersion</literal> is
  556. changed to 19.09 or higher. For <literal>stateVersion = "19.03"</literal>
  557. or lower the old behavior is preserved.
  558. </para>
  559. <itemizedlist>
  560. <listitem>
  561. <para>
  562. <literal>solr.package</literal> defaults to
  563. <literal>pkgs.solr_8</literal>.
  564. </para>
  565. </listitem>
  566. </itemizedlist>
  567. </listitem>
  568. <listitem>
  569. <para>
  570. The <literal>hunspellDicts.fr-any</literal> dictionary now ships with <literal>fr_FR.{aff,dic}</literal>
  571. which is linked to <literal>fr-toutesvariantes.{aff,dic}</literal>.
  572. </para>
  573. </listitem>
  574. <listitem>
  575. <para>
  576. The <literal>mysql</literal> service now runs as <literal>mysql</literal>
  577. user. Previously, systemd did execute it as root, and mysql dropped privileges
  578. itself.
  579. This includes <literal>ExecStartPre=</literal> and
  580. <literal>ExecStartPost=</literal> phases.
  581. To accomplish that, runtime and data directory setup was delegated to
  582. RuntimeDirectory and tmpfiles.
  583. </para>
  584. </listitem>
  585. <listitem>
  586. <para>
  587. With the upgrade to systemd version 242 the <literal>systemd-timesyncd</literal>
  588. service is no longer using <literal>DynamicUser=yes</literal>. In order for the
  589. upgrade to work we rely on an activation script to move the state from the old
  590. to the new directory. The older directory (prior <literal>19.09</literal>) was
  591. <literal>/var/lib/private/systemd/timesync</literal>.
  592. </para>
  593. <para>
  594. As long as the <literal>system.config.stateVersion</literal> is below
  595. <literal>19.09</literal> the state folder will migrated to its proper location
  596. (<literal>/var/lib/systemd/timesync</literal>), if required.
  597. </para>
  598. </listitem>
  599. <listitem>
  600. <para>
  601. The package <literal>avahi</literal> is now built to look up service
  602. definitions from <literal>/etc/avahi/services</literal> instead of its
  603. output directory in the nix store. Accordingly the module
  604. <option>avahi</option> now supports custom service definitions via
  605. <option>services.avahi.extraServiceFiles</option>, which are then placed
  606. in the aforementioned directory. See <citerefentry>
  607. <refentrytitle>avahi.service</refentrytitle><manvolnum>5</manvolnum>
  608. </citerefentry> for more information on custom service definitions.
  609. </para>
  610. </listitem>
  611. <listitem>
  612. <para>
  613. Since version 0.1.19, <literal>cargo-vendor</literal> honors package
  614. includes that are specified in the <filename>Cargo.toml</filename>
  615. file of Rust crates. <literal>rustPlatform.buildRustPackage</literal> uses
  616. <literal>cargo-vendor</literal> to collect and build dependent crates.
  617. Since this change in <literal>cargo-vendor</literal> changes the set of
  618. vendored files for most Rust packages, the hash that use used to verify
  619. the dependencies, <literal>cargoSha256</literal>, also changes.
  620. </para>
  621. <para>
  622. The <literal>cargoSha256</literal> hashes of all in-tree derivations that
  623. use <literal>buildRustPackage</literal> have been updated to reflect this
  624. change. However, third-party derivations that use
  625. <literal>buildRustPackage</literal> may have to be updated as well.
  626. </para>
  627. </listitem>
  628. <listitem>
  629. <para>
  630. The <literal>consul</literal> package was upgraded past version <literal>1.5</literal>,
  631. so its deprecated legacy UI is no longer available.
  632. </para>
  633. </listitem>
  634. <listitem>
  635. <para>
  636. The default resample-method for PulseAudio has been changed from the upstream default <literal>speex-float-1</literal>
  637. to <literal>speex-float-5</literal>. Be aware that low-powered ARM-based and MIPS-based boards will struggle with this
  638. so you'll need to set <option>hardware.pulseaudio.daemon.config.resample-method</option> back to <literal>speex-float-1</literal>.
  639. </para>
  640. </listitem>
  641. <listitem>
  642. <para>
  643. The <literal>phabricator</literal> package and associated <literal>httpd.extraSubservice</literal>, as well as the
  644. <literal>phd</literal> service have been removed from nixpkgs due to lack of maintainer.
  645. </para>
  646. </listitem>
  647. <listitem>
  648. <para>
  649. The <literal>mercurial</literal> <literal>httpd.extraSubservice</literal> has been removed from nixpkgs due to lack of maintainer.
  650. </para>
  651. </listitem>
  652. <listitem>
  653. <para>
  654. The <literal>trac</literal> <literal>httpd.extraSubservice</literal> has been removed from nixpkgs because it was unmaintained.
  655. </para>
  656. </listitem>
  657. <listitem>
  658. <para>
  659. The <literal>foswiki</literal> package and associated <literal>httpd.extraSubservice</literal> have been removed
  660. from nixpkgs due to lack of maintainer.
  661. </para>
  662. </listitem>
  663. <listitem>
  664. <para>
  665. The <literal>tomcat-connector</literal> <literal>httpd.extraSubservice</literal> has been removed from nixpkgs.
  666. </para>
  667. </listitem>
  668. <listitem>
  669. <para>
  670. It's now possible to change configuration in
  671. <link linkend="opt-services.nextcloud.enable">services.nextcloud</link> after the initial deploy
  672. since all config parameters are persisted in an additional config file generated by the module.
  673. Previously core configuration like database parameters were set using their imperative
  674. installer after creating <literal>/var/lib/nextcloud</literal>.
  675. </para>
  676. </listitem>
  677. <listitem>
  678. <para>
  679. There exists now <literal>lib.forEach</literal>, which is like <literal>map</literal>, but with
  680. arguments flipped. When mapping function body spans many lines (or has nested
  681. <literal>map</literal>s), it is often hard to follow which list is modified.
  682. </para>
  683. <para>
  684. Previous solution to this problem was either to use <literal>lib.flip map</literal>
  685. idiom or extract that anonymous mapping function to a named one. Both can still be used
  686. but <literal>lib.forEach</literal> is preferred over <literal>lib.flip map</literal>.
  687. </para>
  688. <para>
  689. The <literal>/etc/sysctl.d/nixos.conf</literal> file containing all the options set via
  690. <link linkend="opt-boot.kernel.sysctl">boot.kernel.sysctl</link> was moved to
  691. <literal>/etc/sysctl.d/60-nixos.conf</literal>, as
  692. <citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
  693. recommends prefixing all filenames in <literal>/etc/sysctl.d</literal> with a
  694. two-digit number and a dash to simplify the ordering of the files.
  695. </para>
  696. </listitem>
  697. <listitem>
  698. <para>
  699. We now install the sysctl snippets shipped with systemd.
  700. <itemizedlist>
  701. <para>This enables:</para>
  702. <listitem>
  703. <para>Loose reverse path filtering</para>
  704. </listitem>
  705. <listitem>
  706. <para>Source route filtering</para>
  707. </listitem>
  708. <listitem>
  709. <para>
  710. <literal>fq_codel</literal> as a packet scheduler (this helps to fight bufferbloat)
  711. </para>
  712. </listitem>
  713. </itemizedlist>
  714. This also configures the kernel to pass coredumps to <literal>systemd-coredump</literal>,
  715. and restricts the SysRq key combinations to the sync command only.
  716. These sysctl snippets can be found in <literal>/etc/sysctl.d/50-*.conf</literal>,
  717. and overridden via <link linkend="opt-boot.kernel.sysctl">boot.kernel.sysctl</link>
  718. (which will place the parameters in <literal>/etc/sysctl.d/60-nixos.conf</literal>).
  719. </para>
  720. </listitem>
  721. <listitem>
  722. <para>
  723. Coredumps are now acquired by <literal>systemd-coredump</literal> by default.
  724. <literal>systemd-coredump</literal> behaviour can still be modified via
  725. <option>systemd.coredump.extraConfig</option>.
  726. To stick to the old behaviour (having the kernel dump to a file called <literal>core</literal>
  727. in the working directory), without piping it through <literal>systemd-coredump</literal>, set
  728. <option>boot.kernel.sysctl."kernel.core_pattern"</option> to <literal>"core"</literal>.
  729. </para>
  730. </listitem>
  731. <listitem>
  732. <para>
  733. <literal>systemd.packages</literal> option now also supports generators and
  734. shutdown scripts. Old <literal>systemd.generator-packages</literal> option has
  735. been removed.
  736. </para>
  737. </listitem>
  738. <listitem>
  739. <para>
  740. The <literal>rmilter</literal> package was removed with associated module and options due deprecation by upstream developer.
  741. Use <literal>rspamd</literal> in proxy mode instead.
  742. </para>
  743. </listitem>
  744. <listitem>
  745. <para>
  746. systemd cgroup accounting via the
  747. <link linkend="opt-systemd.enableCgroupAccounting">systemd.enableCgroupAccounting</link>
  748. option is now enabled by default. It now also enables the more recent Block IO and IP accounting
  749. features.
  750. </para>
  751. </listitem>
  752. <listitem>
  753. <para>
  754. We no longer enable custom font rendering settings with <option>fonts.fontconfig.penultimate.enable</option> by default.
  755. The defaults from fontconfig are sufficient.
  756. </para>
  757. </listitem>
  758. <listitem>
  759. <para>
  760. The <literal>crashplan</literal> package and the
  761. <literal>crashplan</literal> service have been removed from nixpkgs due to
  762. crashplan shutting down the service, while the <literal>crashplansb</literal>
  763. package and <literal>crashplan-small-business</literal> service have been
  764. removed from nixpkgs due to lack of maintainer.
  765. </para>
  766. <para>
  767. The <link linkend="opt-services.redis.enable">redis module</link> was hardcoded to use the <literal>redis</literal> user,
  768. <filename class="directory">/run/redis</filename> as runtime directory and
  769. <filename class="directory">/var/lib/redis</filename> as state directory.
  770. Note that the NixOS module for Redis now disables kernel support for Transparent Huge Pages (THP),
  771. because this features causes major performance problems for Redis,
  772. e.g. (https://redis.io/topics/latency).
  773. </para>
  774. </listitem>
  775. <listitem>
  776. <para>
  777. Using <option>fonts.enableDefaultFonts</option> adds a default emoji font <literal>noto-fonts-emoji</literal>.
  778. <itemizedlist>
  779. <para>Users of the following options will have this enabled by default:</para>
  780. <listitem>
  781. <para><option>services.xserver.enable</option></para>
  782. </listitem>
  783. <listitem>
  784. <para><option>programs.sway.enable</option></para>
  785. </listitem>
  786. <listitem>
  787. <para><option>programs.way-cooler.enable</option></para>
  788. </listitem>
  789. <listitem>
  790. <para><option>services.xrdp.enable</option></para>
  791. </listitem>
  792. </itemizedlist>
  793. </para>
  794. </listitem>
  795. <listitem>
  796. <para>
  797. The <literal>altcoins</literal> categorization of packages has
  798. been removed. You now access these packages at the top level,
  799. ie. <literal>nix-shell -p dogecoin</literal> instead of
  800. <literal>nix-shell -p altcoins.dogecoin</literal>, etc.
  801. </para>
  802. </listitem>
  803. <listitem>
  804. <para>
  805. Ceph has been upgraded to v14.2.1.
  806. See the <link xlink:href="https://ceph.com/releases/v14-2-0-nautilus-released/">release notes</link> for details.
  807. The mgr dashboard as well as osds backed by loop-devices is no longer explicitly supported by the package and module.
  808. Note: There's been some issues with python-cherrypy, which is used by the dashboard
  809. and prometheus mgr modules (and possibly others), hence 0000-dont-check-cherrypy-version.patch.
  810. </para>
  811. </listitem>
  812. <listitem>
  813. <para>
  814. <literal>pkgs.weechat</literal> is now compiled against <literal>pkgs.python3</literal>.
  815. Weechat also recommends <link xlink:href="https://weechat.org/scripts/python3/">to use Python3
  816. in their docs.</link>
  817. </para>
  818. </listitem>
  819. </itemizedlist>
  820. </section>
  821. </section>