710 lines
31 KiB
XML
710 lines
31 KiB
XML
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
version="5.0"
|
|
xml:id="sec-release-20.09">
|
|
<title>Release 20.09 (“Nightingale”, 2020.09/??)</title>
|
|
|
|
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
version="5.0"
|
|
xml:id="sec-release-20.09-highlights">
|
|
<title>Highlights</title>
|
|
|
|
<para>
|
|
In addition to numerous new and upgraded packages, this release has the
|
|
following highlights:
|
|
</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
Support is planned until the end of April 2021, handing over to 21.03.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>GNOME desktop environment was upgraded to 3.36, see its <link xlink:href="https://help.gnome.org/misc/release-notes/3.36/">release notes</link>.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
<package>maxx</package> package removed along with <varname>services.xserver.desktopManager.maxx</varname> module.
|
|
Please migrate to <package>cdesktopenv</package> and <varname>services.xserver.desktopManager.cde</varname> module.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
We now distribute a GNOME ISO.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
PHP now defaults to PHP 7.4, updated from 7.3.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Python 3 now defaults to Python 3.8 instead of 3.7.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Two new options, <link linkend="opt-services.openssh.authorizedKeysCommand">authorizedKeysCommand</link>
|
|
and <link linkend="opt-services.openssh.authorizedKeysCommandUser">authorizedKeysCommandUser</link>, have
|
|
been added to the <literal>openssh</literal> module. If you have <literal>AuthorizedKeysCommand</literal>
|
|
in your <link linkend="opt-services.openssh.extraConfig">services.openssh.extraConfig</link> you should
|
|
make use of these new options instead.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
There is a new module for Podman(<varname>virtualisation.podman</varname>), a drop-in replacement for the Docker command line.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The new <varname>virtualisation.containers</varname> module manages configuration shared by the CRI-O and Podman modules.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Declarative Docker containers are renamed from <varname>docker-containers</varname> to <varname>virtualisation.oci-containers.containers</varname>.
|
|
This is to make it possible to use <literal>podman</literal> instead of <literal>docker</literal>.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
MariaDB has been updated to 10.4, MariaDB Galera to 26.4.
|
|
Before you upgrade, it would be best to take a backup of your database.
|
|
For MariaDB Galera Cluster, see <link xlink:href="https://mariadb.com/kb/en/upgrading-from-mariadb-103-to-mariadb-104-with-galera-cluster/">Upgrading
|
|
from MariaDB 10.3 to MariaDB 10.4 with Galera Cluster</link> instead.
|
|
Before doing the upgrade read <link xlink:href="https://mariadb.com/kb/en/upgrading-from-mariadb-103-to-mariadb-104/#incompatible-changes-between-103-and-104">Incompatible
|
|
Changes Between 10.3 and 10.4</link>.
|
|
After the upgrade you will need to run <literal>mysql_upgrade</literal>.
|
|
MariaDB 10.4 introduces a number of changes to the authentication process, intended to make things easier and more
|
|
intuitive. See <link xlink:href="https://mariadb.com/kb/en/authentication-from-mariadb-104/">Authentication from MariaDB 10.4</link>.
|
|
unix_socket auth plugin does not use a password, and uses the connecting user's UID instead. When a new MariaDB data directory is initialized, two MariaDB users are
|
|
created and can be used with new unix_socket auth plugin, as well as traditional mysql_native_password plugin: root@localhost and mysql@localhost. To actually use
|
|
the traditional mysql_native_password plugin method, one must run the following:
|
|
<programlisting>
|
|
services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" ''
|
|
ALTER USER root@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD("verysecret");
|
|
'';
|
|
</programlisting>
|
|
When MariaDB data directory is just upgraded (not initialized), the users are not created or modified.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
MySQL server is now started with additional systemd sandbox/hardening options for better security. The PrivateTmp, ProtectHome, and ProtectSystem options
|
|
may be problematic when MySQL is attempting to read from or write to your filesystem anywhere outside of its own state directory, for example when
|
|
calling <literal>LOAD DATA INFILE or SELECT * INTO OUTFILE</literal>. In this scenario a variant of the following may be required:
|
|
- allow MySQL to read from /home and /tmp directories when using <literal>LOAD DATA INFILE</literal>
|
|
<programlisting>
|
|
systemd.services.mysql.serviceConfig.ProtectHome = lib.mkForce "read-only";
|
|
</programlisting>
|
|
- allow MySQL to write to custom folder <literal>/var/data</literal> when using <literal>SELECT * INTO OUTFILE</literal>, assuming the mysql user has write
|
|
access to <literal>/var/data</literal>
|
|
<programlisting>
|
|
systemd.services.mysql.serviceConfig.ReadWritePaths = [ "/var/data" ];
|
|
</programlisting>
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Two new option <link linkend="opt-documentation.man.generateCaches">documentation.man.generateCaches</link>
|
|
has been added to automatically generate the <literal>man-db</literal> caches, which are needed by utilities
|
|
like <command>whatis</command> and <command>apropos</command>. The caches are generated during the build of
|
|
the NixOS configuration: since this can be expensive when a large number of packages are installed, the
|
|
feature is disabled by default.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
<varname>services.postfix.sslCACert</varname> was replaced by <varname>services.postfix.tlsTrustedAuthorities</varname> which now defaults to system certifcate authorities.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Subordinate GID and UID mappings are now set up automatically for all normal users.
|
|
This will make container tools like Podman work as non-root users out of the box.
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</section>
|
|
|
|
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
version="5.0"
|
|
xml:id="sec-release-20.09-new-services">
|
|
<title>New Services</title>
|
|
|
|
<para>
|
|
The following new services were added since the last release:
|
|
</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
There is a new <xref linkend="opt-security.doas.enable"/> module that provides <command>doas</command>, a lighter alternative to <command>sudo</command> with many of the same features.
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
</section>
|
|
|
|
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
version="5.0"
|
|
xml:id="sec-release-20.09-incompatibilities">
|
|
<title>Backward Incompatibilities</title>
|
|
|
|
<para>
|
|
When upgrading from a previous release, please be aware of the following
|
|
incompatible changes:
|
|
</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
<literal>buildGoModule</literal> now internally creates a vendor directory
|
|
in the source tree for downloaded modules instead of using go's <link
|
|
xlink:href="https://golang.org/cmd/go/#hdr-Module_proxy_protocol">module
|
|
proxy protocol</link>. This storage format is simpler and therefore less
|
|
likekly to break with future versions of go. As a result
|
|
<literal>buildGoModule</literal> switched from
|
|
<literal>modSha256</literal> to the <literal>vendorSha256</literal>
|
|
attribute to pin fetched version data. <literal>buildGoModule</literal>
|
|
still accepts <literal>modSha256</literal> with a warning, but support will
|
|
be removed in the next release.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Grafana is now built without support for phantomjs by default. Phantomjs support has been
|
|
<link xlink:href="https://grafana.com/docs/grafana/latest/guides/whats-new-in-v6-4/">deprecated in Grafana</link>
|
|
and the <package>phantomjs</package> project is
|
|
<link xlink:href="https://github.com/ariya/phantomjs/issues/15344#issue-302015362">currently unmaintained</link>.
|
|
It can still be enabled by providing <literal>phantomJsSupport = true</literal> to the package instanciation:
|
|
<programlisting>{
|
|
services.grafana.package = pkgs.grafana.overrideAttrs (oldAttrs: rec {
|
|
phantomJsSupport = false;
|
|
});
|
|
}</programlisting>
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The <link linkend="opt-services.supybot.enable">supybot</link> module now uses <literal>/var/lib/supybot</literal>
|
|
as its default <link linkend="opt-services.supybot.stateDir">stateDir</link> path if <literal>stateVersion</literal>
|
|
is 20.09 or higher. It also enables number of
|
|
<link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Sandboxing">systemd sandboxing options</link>
|
|
which may possibly interfere with some plugins. If this is the case you can disable the options through attributes in
|
|
<option>systemd.services.supybot.serviceConfig</option>.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The <literal>security.duosec.skey</literal> option, which stored a secret in the
|
|
nix store, has been replaced by a new
|
|
<link linkend="opt-security.duosec.secretKeyFile">security.duosec.secretKeyFile</link>
|
|
option for better security.
|
|
</para>
|
|
<para>
|
|
<literal>security.duosec.ikey</literal> has been renamed to
|
|
<link linkend="opt-security.duosec.integrationKey">security.duosec.integrationKey</link>.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
<literal>vmware</literal> has been removed from the <literal>services.x11.videoDrivers</literal> defaults.
|
|
For VMWare guests set <literal>virtualisation.vmware.guest.enable</literal> to <literal>true</literal> which will include the appropriate drivers.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The initrd SSH support now uses OpenSSH rather than Dropbear to
|
|
allow the use of Ed25519 keys and other OpenSSH-specific
|
|
functionality. Host keys must now be in the OpenSSH format, and at
|
|
least one pre-generated key must be specified.
|
|
</para>
|
|
<para>
|
|
If you used the <option>boot.initrd.network.ssh.host*Key</option>
|
|
options, you'll get an error explaining how to convert your host
|
|
keys and migrate to the new
|
|
<option>boot.initrd.network.ssh.hostKeys</option> option.
|
|
Otherwise, if you don't have any host keys set, you'll need to
|
|
generate some; see the <option>hostKeys</option> option
|
|
documentation for instructions.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Since this release there's an easy way to customize your PHP
|
|
install to get a much smaller base PHP with only wanted
|
|
extensions enabled. See the following snippet installing a
|
|
smaller PHP with the extensions <literal>imagick</literal>,
|
|
<literal>opcache</literal>, <literal>pdo</literal> and
|
|
<literal>pdo_mysql</literal> loaded:
|
|
|
|
<programlisting>
|
|
environment.systemPackages = [
|
|
(pkgs.php.withExtensions
|
|
({ all, ... }: with all; [
|
|
imagick
|
|
opcache
|
|
pdo
|
|
pdo_mysql
|
|
])
|
|
)
|
|
];</programlisting>
|
|
|
|
The default <literal>php</literal> attribute hasn't lost any
|
|
extensions. The <literal>opcache</literal> extension has been
|
|
added.
|
|
|
|
All upstream PHP extensions are available under <package><![CDATA[php.extensions.<name?>]]></package>.
|
|
</para>
|
|
<para>
|
|
All PHP <literal>config</literal> flags have been removed for
|
|
the following reasons:
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
The updated <literal>php</literal> attribute is now easily
|
|
customizable to your liking by using
|
|
<literal>php.withExtensions</literal> or
|
|
<literal>php.buildEnv</literal> instead of writing config files
|
|
or changing configure flags.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The remaining configuration flags can now be set directly on
|
|
the <literal>php</literal> attribute. For example, instead of
|
|
|
|
<programlisting>
|
|
php.override {
|
|
config.php.embed = true;
|
|
config.php.apxs2 = false;
|
|
}
|
|
</programlisting>
|
|
|
|
you should now write
|
|
|
|
<programlisting>
|
|
php.override {
|
|
embedSupport = true;
|
|
apxs2Support = false;
|
|
}
|
|
</programlisting>
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Gollum received a major update to version 5.x and you may have to change
|
|
some links in your wiki when migrating from gollum 4.x. More information
|
|
can be found
|
|
<link xlink:href="https://github.com/gollum/gollum/wiki/5.0-release-notes#migrating-your-wiki">here</link>.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Deluge 2.x was added and is used as default for new NixOS
|
|
installations where stateVersion is >= 20.09. If you are upgrading from a previous
|
|
NixOS version, you can set <literal>service.deluge.package = pkgs.deluge-2_x</literal>
|
|
to upgrade to Deluge 2.x and migrate the state to the new format.
|
|
Be aware that backwards state migrations are not supported by Deluge.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Add option <literal>services.nginx.enableSandbox</literal> to starting Nginx web server with additional sandbox/hardening options.
|
|
By default, write access to <literal>services.nginx.stateDir</literal> is allowed. To allow writing to other folders,
|
|
use <literal>systemd.services.nginx.serviceConfig.ReadWritePaths</literal>
|
|
<programlisting>
|
|
systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
|
|
</programlisting>
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The NixOS options <literal>nesting.clone</literal> and
|
|
<literal>nesting.children</literal> have been deleted, and
|
|
replaced with named <xref linkend="opt-specialisation"/>
|
|
configurations.
|
|
</para>
|
|
|
|
<para>
|
|
Replace a <literal>nesting.clone</literal> entry with:
|
|
|
|
<programlisting>{
|
|
<link xlink:href="#opt-specialisation">specialisation.example-sub-configuration</link> = {
|
|
<link xlink:href="#opt-specialisation._name_.configuration">configuration</link> = {
|
|
...
|
|
};
|
|
};</programlisting>
|
|
|
|
</para>
|
|
<para>
|
|
Replace a <literal>nesting.children</literal> entry with:
|
|
|
|
<programlisting>{
|
|
<link xlink:href="#opt-specialisation">specialisation.example-sub-configuration</link> = {
|
|
<link xlink:href="#opt-specialisation._name_.inheritParentConfig">inheritParentConfig</link> = false;
|
|
<link xlink:href="#opt-specialisation._name_.configuration">configuration</link> = {
|
|
...
|
|
};
|
|
};</programlisting>
|
|
</para>
|
|
|
|
<para>
|
|
To switch to a specialised configuration at runtime you need to
|
|
run:
|
|
<programlisting>
|
|
# sudo /run/current-system/specialisation/example-sub-configuration/bin/switch-to-configuration test
|
|
</programlisting>
|
|
Before you would have used:
|
|
<programlisting>
|
|
# sudo /run/current-system/fine-tune/child-1/bin/switch-to-configuration test
|
|
</programlisting>
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The Nginx log directory has been moved to <literal>/var/log/nginx</literal>, the cache directory
|
|
to <literal>/var/cache/nginx</literal>. The option <literal>services.nginx.stateDir</literal> has
|
|
been removed.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The httpd web server previously started its main process as root
|
|
privileged, then ran worker processes as a less privileged identity user.
|
|
This was changed to start all of httpd as a less privileged user (defined by
|
|
<xref linkend="opt-services.httpd.user"/> and
|
|
<xref linkend="opt-services.httpd.group"/>). As a consequence, all files that
|
|
are needed for httpd to run (included configuration fragments, SSL
|
|
certificates and keys, etc.) must now be readable by this less privileged
|
|
user/group.
|
|
</para>
|
|
<para>
|
|
The default value for <xref linkend="opt-services.httpd.mpm"/>
|
|
has been changed from <literal>prefork</literal> to <literal>event</literal>. Along with
|
|
this change the default value for
|
|
<link linkend="opt-services.httpd.virtualHosts">services.httpd.virtualHosts.<name>.http2</link>
|
|
has been set to <literal>true</literal>.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The <literal>systemd-networkd</literal> option
|
|
<literal>systemd.network.networks.<name>.dhcp.CriticalConnection</literal>
|
|
has been removed following upstream systemd's deprecation of the same. It is recommended to use
|
|
<literal>systemd.network.networks.<name>.networkConfig.KeepConfiguration</literal> instead.
|
|
See <citerefentry><refentrytitle>systemd.network</refentrytitle>
|
|
<manvolnum>5</manvolnum></citerefentry> for details.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The <literal>systemd-networkd</literal> option
|
|
<literal>systemd.network.networks._name_.dhcpConfig</literal>
|
|
has been renamed to
|
|
<xref linkend="opt-systemd.network.networks._name_.dhcpV4Config"/>
|
|
following upstream systemd's documentation change.
|
|
See <citerefentry><refentrytitle>systemd.network</refentrytitle>
|
|
<manvolnum>5</manvolnum></citerefentry> for details.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
In the <literal>picom</literal> module, several options that accepted
|
|
floating point numbers encoded as strings (for example
|
|
<xref linkend="opt-services.picom.activeOpacity"/>) have been changed
|
|
to the (relatively) new native <literal>float</literal> type. To migrate
|
|
your configuration simply remove the quotes around the numbers.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
When using <literal>buildBazelPackage</literal> from Nixpkgs,
|
|
<literal>flat</literal> hash mode is now used for dependencies
|
|
instead of <literal>recursive</literal>. This is to better allow
|
|
using hashed mirrors where needed. As a result, these hashes
|
|
will have changed.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The rkt module has been removed, it was archived by upstream.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The <link xlink:href="https://bazaar.canonical.com">Bazaar</link> VCS is
|
|
unmaintained and, as consequence of the Python 2 EOL, the packages
|
|
<literal>bazaar</literal> and <literal>bazaarTools</literal> were
|
|
removed. Breezy, the backward compatible fork of Bazaar (see the
|
|
<link xlink:href="https://www.jelmer.uk/breezy-intro.html">announcement</link>),
|
|
was packaged as <literal>breezy</literal> and can be used instead.
|
|
</para>
|
|
<para>
|
|
Regarding Nixpkgs, <literal>fetchbzr</literal>,
|
|
<literal>nix-prefetch-bzr</literal> and Bazaar support in Hydra will
|
|
continue to work through Breezy.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
In addition to the hostname, the fully qualified domain name (FQDN),
|
|
which consists of <literal>${cfg.hostName}</literal> and
|
|
<literal>${cfg.domain}</literal> is now added to
|
|
<literal>/etc/hosts</literal>, to allow local FQDN resolution, as used by the
|
|
<literal>hostname --fqdn</literal> command and other applications that
|
|
try to determine the FQDN. These new entries take precedence over entries
|
|
from the DNS which could cause regressions in some very specific setups.
|
|
Additionally the hostname is now resolved to <literal>127.0.0.2</literal>
|
|
instead of <literal>127.0.1.1</literal> to be consistent with what
|
|
<literal>nss-myhostname</literal> (from systemd) returns.
|
|
The old behaviour can e.g. be restored by using
|
|
<literal>networking.hosts = lib.mkForce { "127.0.1.1" = [ config.networking.hostName ]; };</literal>.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The hostname (<literal>networking.hostName</literal>) must now be a valid
|
|
DNS label (see RFC 1035) and as such must not contain the domain part.
|
|
This means that the hostname must start with a letter, end with a letter
|
|
or digit, and have as interior characters only letters, digits, and
|
|
hyphen. The maximum length is 63 characters. Additionally it is
|
|
recommended to only use lower-case characters.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The GRUB specific option <option>boot.loader.grub.extraInitrd</option>
|
|
has been replaced with the generic option
|
|
<option>boot.initrd.secrets</option>. This option creates a secondary
|
|
initrd from the specified files, rather than using a manually created
|
|
initrd file.
|
|
|
|
Due to an existing bug with <option>boot.loader.grub.extraInitrd</option>,
|
|
it is not possible to directly boot an older generation that used that
|
|
option. It is still possible to rollback to that generation if the required
|
|
initrd file has not been deleted.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The <link xlink:href="https://github.com/okTurtles/dnschain">DNSChain</link>
|
|
package and NixOS module have been removed from Nixpkgs as the software is
|
|
unmaintained and can't be built. For more information see issue
|
|
<link xlink:href="https://github.com/NixOS/nixpkgs/issues/89205">#89205</link>.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
In the <literal>resilio</literal> module, <xref linkend="opt-services.resilio.httpListenAddr"/> has been changed to listen to <literal>[::1]</literal> instead of <literal>0.0.0.0</literal>.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Radicale's default package has changed from 2.x to 3.x. An upgrade
|
|
checklist can be found
|
|
<link xlink:href="https://github.com/Kozea/Radicale/blob/3.0.x/NEWS.md#upgrade-checklist">here</link>.
|
|
You can use the newer version in the NixOS service by setting the
|
|
<literal>package</literal> to <literal>radicale3</literal>, which is done
|
|
automatically if <literal>stateVersion</literal> is 20.09 or higher.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
We now have a unified <xref linkend="opt-services.xserver.displayManager.autoLogin"/> option interface
|
|
to be used for every display-manager in NixOS.
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</section>
|
|
|
|
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
version="5.0"
|
|
xml:id="sec-release-20.09-notable-changes">
|
|
<title>Other Notable Changes</title>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>SD images are now compressed by default using <literal>zstd</literal>. The compression for ISO images has also been changed to <literal>zstd</literal>, but ISO images are still not compressed by default.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
<option>services.journald.rateLimitBurst</option> was updated from
|
|
<literal>1000</literal> to <literal>10000</literal> to follow the new
|
|
upstream systemd default.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The <package>notmuch</package> package move its emacs-related binaries and
|
|
emacs lisp files to a separate output. They're not part
|
|
of the default <literal>out</literal> output anymore - if you relied on the
|
|
<literal>notmuch-emacs-mua</literal> binary or the emacs lisp files, access them via
|
|
the <literal>notmuch.emacs</literal> output.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The default output of <literal>buildGoPackage</literal> is now <literal>$out</literal> instead of <literal>$bin</literal>.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Packages built using <literal>buildRustPackage</literal> now use <literal>release</literal>
|
|
mode for the <literal>checkPhase</literal> by default.
|
|
</para>
|
|
<para>
|
|
Please note that Rust packages utilizing a custom build/install procedure
|
|
(e.g. by using a <filename>Makefile</filename>) or test suites that rely on the
|
|
structure of the <filename>target/</filename> directory may break due to those assumptions.
|
|
For further information, please read the Rust section in the Nixpkgs manual.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The cc- and binutils-wrapper's "infix salt" and <literal>_BUILD_</literal> and <literal>_TARGET_</literal> user infixes have been replaced with with a "suffix salt" and suffixes and <literal>_FOR_BUILD</literal> and <literal>_FOR_TARGET</literal>.
|
|
This matches the autotools convention for env vars which standard for these things, making interfacing with other tools easier.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Additional Git documentation (HTML and text files) is now available via the <literal>git-doc</literal> package.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Default algorithm for ZRAM swap was changed to <literal>zstd</literal>.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The scripted networking system now uses <literal>.link</literal> files in
|
|
<literal>/etc/systemd/network</literal> to configure mac address and link MTU,
|
|
instead of the sometimes buggy <literal>network-link-*</literal> units, which
|
|
have been removed.
|
|
Bringing the interface up has been moved to the beginning of the
|
|
<literal>network-addresses-*</literal> unit.
|
|
Note this doesn't require <command>systemd-networkd</command> - it's udev that
|
|
parses <literal>.link</literal> files.
|
|
Extra care needs to be taken in the presence of <link xlink:href="https://wiki.debian.org/NetworkInterfaceNames#THE_.22PERSISTENT_NAMES.22_SCHEME">legacy udev rules</link>
|
|
to rename interfaces, as MAC Address and MTU defined in these options can only match on the original link name.
|
|
In such cases, you most likely want to create a <literal>10-*.link</literal> file through <xref linkend="opt-systemd.network.links"/> and set both name and MAC Address / MTU there.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Grafana received a major update to version 7.x. A plugin is now needed for
|
|
image rendering support, and plugins must now be signed by default. More
|
|
information can be found
|
|
<link xlink:href="https://grafana.com/docs/grafana/latest/installation/upgrading/#upgrading-to-v7-0">in the Grafana documentation</link>.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The <literal>hardware.u2f</literal> module, which was installing udev rules
|
|
was removed, as udev gained native support to handle FIDO security tokens.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
With this release <literal>systemd-networkd</literal> (when enabled through <xref linkend="opt-networking.useNetworkd"/>)
|
|
has it's netlink socket created through a <literal>systemd.socket</literal> unit. This gives us control over
|
|
socket buffer sizes and other parameters. For larger setups where networkd has to create a lot of (virtual)
|
|
devices the default buffer size (currently 128MB) is not enough.
|
|
</para>
|
|
<para>
|
|
On a machine with >100 virtual interfaces (e.g., wireguard tunnels, VLANs, …), that all have to
|
|
be brought up during system startup, the receive buffer size will spike for a brief period.
|
|
Eventually some of the message will be dropped since there is not enough (permitted) buffer
|
|
space available.
|
|
</para>
|
|
<para>
|
|
By having <literal>systemd-networkd</literal> start with a netlink socket created by
|
|
<literal>systemd</literal> we can configure the <literal>ReceiveBufferSize=</literal> parameter
|
|
in the socket options (i.e. <literal>systemd.sockets.systemd-networkd.socketOptions.ReceiveBufferSize</literal>)
|
|
without recompiling <literal>systemd-networkd</literal>.
|
|
</para>
|
|
<para>
|
|
Since the actual memory requirements depend on hardware, timing, exact
|
|
configurations etc. it isn't currently possible to infer a good default
|
|
from within the NixOS module system. Administrators are advised to
|
|
monitor the logs of <literal>systemd-networkd</literal> for <literal>rtnl: kernel receive buffer
|
|
overrun</literal> spam and increase the memory limit as they see fit.
|
|
</para>
|
|
<para>
|
|
Note: Increasing the <literal>ReceiveBufferSize=</literal> doesn't allocate any memory. It just increases
|
|
the upper bound on the kernel side. The memory allocation depends on the amount of messages that are
|
|
queued on the kernel side of the netlink socket.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Specifying <link linkend="opt-services.dovecot2.mailboxes">mailboxes</link> in the <package>dovecot2</package> module
|
|
as a list is deprecated and will break eval in 21.03. Instead, an attribute-set should be specified where the <literal>name</literal>
|
|
should be the key of the attribute.
|
|
</para>
|
|
<para>
|
|
This means that a configuration like this
|
|
<programlisting>{
|
|
<link linkend="opt-services.dovecot2.mailboxes">services.dovecot2.mailboxes</link> = [
|
|
{ name = "Junk";
|
|
auto = "create";
|
|
}
|
|
];
|
|
}</programlisting>
|
|
should now look like this:
|
|
<programlisting>{
|
|
<link linkend="opt-services.dovecot2.mailboxes">services.dovecot2.mailboxes</link> = {
|
|
Junk.auto = "create";
|
|
};
|
|
}</programlisting>
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
<package>netbeans</package> was upgraded to 12.0 and now defaults to OpenJDK 11. This might cause problems if your projects depend on packages that were removed in Java 11.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
<package>nextcloud</package> has been updated to <link xlink:href="https://nextcloud.com/blog/nextcloud-hub-brings-productivity-to-home-office/">v19</link>.
|
|
</para>
|
|
<para>
|
|
If you have an existing installation, please make sure that you're on
|
|
<package>nextcloud18</package> before upgrading to <package>nextcloud19</package>
|
|
since Nextcloud doesn't support upgrades across multiple major versions.
|
|
</para>
|
|
<para>
|
|
The <literal>nixos-run-vms</literal> script now deletes the
|
|
previous run machines states on test startup. You can use the
|
|
<literal>--keep-vm-state</literal> flag to match the previous
|
|
behaviour and keep the same VM state between different test runs.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
The <link linkend="opt-nix.buildMachines">nix.buildMachines</link> option is now type-checked.
|
|
There are no functional changes, however this may require updating some configurations to use correct types for all attributes.
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</section>
|
|
</section>
|