b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity
nixpkgs/nixos/doc/manual/release-notes/rl-2311.section.md

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

88 lines
7.6 KiB
Markdown
Raw Normal View History

23.11 is Tapir
2023-05-22 19:14:06 +00:00
# Release 23.11 (“Tapir”, 2023.11/??) {#sec-release-23.11}
## Highlights {#sec-release-23.11-highlights}
foundationdb: default to foundationdb71
2023-05-24 22:08:10 +00:00
- FoundationDB now defaults to major version 7.
rl-2311: Add placeholder entries This fixes manual-combined validation.
2023-05-23 04:59:00 +00:00
23.11 is Tapir
2023-05-22 19:14:06 +00:00
## New Services {#sec-release-23.11-new-services}
rl-2311: Add placeholder entries This fixes manual-combined validation.
2023-05-23 04:59:00 +00:00
- Create the first release note entry in this section!
nixos/acme-dns: init
2023-05-31 13:08:37 +00:00
- [acme-dns](https://github.com/joohoi/acme-dns), a limited DNS server to handle ACME DNS challenges easily and securely. Available as [services.acme-dns](#opt-services.acme-dns.enable).
23.11 is Tapir
2023-05-22 19:14:06 +00:00
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
nixos/river: init module
2023-05-15 11:45:23 +00:00
- [river](https://github.com/riverwm/river), A dynamic tiling wayland compositor. Available as [programs.river](#opt-programs.river.enable).
nixos/gotosocial: init Co-authored-by: Peder Bergebakken Sundt <pbsds@hotmail.com>
2023-05-19 18:18:17 +00:00
- [GoToSocial](https://gotosocial.org/), an ActivityPub social network server, written in Golang. Available as [services.gotosocial](#opt-services.gotosocial.enable).
nixos/sitespeed-io: init
2023-05-30 22:45:14 +00:00
- [sitespeed-io](https://sitespeed.io), a tool that can generate metrics (timings, diagnostics) for websites. Available as [services.sitespeed-io](#opt-services.sitespeed-io.enable).
doc: add entry in 23.11 release notes
2023-06-20 13:47:32 +00:00
- [Apache Guacamole](https://guacamole.apache.org/), a cross-platform, clientless remote desktop gateway. Available as [services.guacamole-server](#opt-services.guacamole-server.enable) and [services.guacamole-client](#opt-services.guacamole-client.enable) services.
23.11 is Tapir
2023-05-22 19:14:06 +00:00
## Backward Incompatibilities {#sec-release-23.11-incompatibilities}
writeTextFile: revert workaround for `executable = null`
2023-05-31 13:23:09 +00:00
- `writeTextFile` now requires `executable` to be boolean, values like `null` or `""` will now fail to evaluate.
clonehero: 0.23.2.2 -> 1.0.0.4080 Co-authored-by: Kira Bruneau <kira.bruneau@pm.me>
2023-04-25 05:29:28 +00:00
- The latest version of `clonehero` now stores custom content in `~/.clonehero`. See the [migration instructions](https://clonehero.net/2022/11/29/v23-to-v1-migration-instructions.html). Typically, these content files would exist along side the binary, but the previous build used a wrapper script that would store them in `~/.config/unity3d/srylain Inc_/Clone Hero`.
rl-2311: Add placeholder entries This fixes manual-combined validation.
2023-05-23 04:59:00 +00:00
python3.pkgs.fetchPypi: deprecate in favor of top-level fetchPypi
2023-05-25 18:42:29 +00:00
- `python3.pkgs.fetchPypi` (and `python3Packages.fetchPypi`) has been deprecated in favor of top-level `fetchPypi`.
mariadb: upgrade default from 10.6 to 10.11 which is the next LTS release
2023-06-07 11:07:07 +00:00
- `mariadb` now defaults to `mariadb_1011` instead of `mariadb_106`, meaning the default version was upgraded from 10.6.x to 10.11.x. See the [upgrade notes](https://mariadb.com/kb/en/upgrading-from-mariadb-10-6-to-mariadb-10-11/) for potential issues.
glibc: split getent into its own output Many dependents only require getent and not all the locale generation tools that are included in the `bin` output. This can save some closure size!
2023-05-22 17:53:52 +00:00
- `getent` has been moved from `glibc`'s `bin` output to its own dedicated output, reducing closure size for many dependents. Dependents using the `getent` alias should not be affected; others should move from using `glibc.bin` or `getBin glibc` to `getent` (which also improves compatibility with non-glibc platforms).
etcd: switch to etcd_3_5
2023-05-23 20:54:43 +00:00
- `etcd` has been updated to 3.5, you will want to read the [3.3 to 3.4](https://etcd.io/docs/v3.5/upgrades/upgrade_3_4/) and [3.4 to 3.5](https://etcd.io/docs/v3.5/upgrades/upgrade_3_5/) upgrade guides
himalaya: 0.7.3 -> 0.8.0
2023-05-31 15:36:57 +00:00
- `himalaya` has been updated to `0.8.0`, which drops the native TLS support (in favor of Rustls) and add OAuth 2.0 support. See the [release note](https://github.com/soywod/himalaya/releases/tag/v0.8.0) for more details.
nixos/caddy: change `acmeCA` default to `null` The nixos/caddy module is somewhat old by now and has undergone quite some refactors. This specific module option (originally named `ca`) used to make a bit more sense when Caddy did not have multiple ACME CAs as fallback (LE & ZeroSSL) by configured by default yet (ZeroSSL came with v2.3.0). I also rephrased the description slightly, to mention Caddy's automatic issuer fallback and a note which this option maps to in the Caddyfile, to provide a bit more context and a more up-to-date recommendation. Specifically that "fine-grained configuration" section comes from a time when this module did some custom tls/issuer config json merging with the templated Caddyfile using `jq`. The "The URL to the ACME CA's directory" section is a word-for-word copy from the official Caddy docs, which also include a link to LE's docs to the referenced staging endpoint. So I added that as well.
2023-06-05 15:59:08 +00:00
- The [services.caddy.acmeCA](#opt-services.caddy.acmeCA) option now defaults to `null` instead of `"https://acme-v02.api.letsencrypt.org/directory"`, to use all of Caddy's default ACME CAs and enable Caddy's automatic issuer fallback feature by default, as recommended by upstream.
php: drop PHP 8.0 Closes #224505
2023-06-21 20:09:16 +00:00
- `php80` is no longer supported due to upstream not supporting this version anymore.
php: Upgrade from PHP 8.1 to 8.2 as default PHP
2023-06-23 19:37:16 +00:00
- PHP now defaults to PHP 8.2, updated from 8.1.
nixos/doc/manual: add release notes for util-linux on Darwin This is a follow-up to PR #232713.
2023-06-01 00:25:11 +00:00
- `util-linux` is now supported on Darwin and is no longer an alias to `unixtools`. Use the `unixtools.util-linux` package for access to the Apple variants of the utilities.
kbd: split vlock into its own output This avoids a dependency on pam when only the actual keyboard data is used.
2023-05-25 13:45:34 +00:00
- The `vlock` program from the `kbd` package has been moved into its own package output and should now be referenced explicitly as `kbd.vlock` or replaced with an alternative such as the standalone `vlock` package or `physlock`.
nixos: Use systemd-makefs for autoFormat
2023-05-29 20:14:18 +00:00
- `fileSystems.<name>.autoFormat` now uses `systemd-makefs`, which does not accept formatting options. Therefore, `fileSystems.<name>.formatOptions` has been removed.
nixos: Use systemd-growfs for autoResize
2023-05-29 20:14:55 +00:00
- `fileSystems.<name>.autoResize` now uses `systemd-growfs` to resize the file system online in stage 2. This means that `f2fs` and `ext2` can no longer be auto resized, while `xfs` and `btrfs` now can be.
nixos/lemmy: remove option removed upstream
2023-06-15 15:26:40 +00:00
- `services.lemmy.settings.federation` was removed in 0.17.0 and no longer has any effect. To enable federation, the hostname must be set in the configuration file and then federation must be enabled in the admin web UI. See the [release notes](https://github.com/LemmyNet/lemmy/blob/c32585b03429f0f76d1e4ff738786321a0a9df98/RELEASES.md#upgrade-instructions) for more details.
nixos/release-notes: Add a note about Hashcash being removed from spamassassin.
2023-05-21 19:01:05 +00:00
- `spamassassin` no longer supports the `Hashcash` module. The module needs to be removed from the `loadplugin` list if it was copied over from the default `initPreConf` option.
23.11 is Tapir
2023-05-22 19:14:06 +00:00
## Other Notable Changes {#sec-release-23.11-notable-changes}
nixos/cinnamon: enable portals by default
2023-05-26 14:13:36 +00:00
- The Cinnamon module now enables XDG desktop integration by default. If you are experiencing collisions related to xdg-desktop-portal-gtk you can safely remove `xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];` from your NixOS configuration.
nixos/fontconfig: Change default antialiasing style to greyscale instead of subpixel fontconfig before version 2.13.1 was apparently implicitly not using subpixel antialiasing. The fontconfig NixOS module deviated from this, using subpixel antialiasing with `rgb` layout by default. In fontconfig 2.14.1, subpixel antialiasing was inadvertently enabled as the default: https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/2b6afa02ab2b7dd3796a48cf47896c4c6de4d6ba According to https://gitlab.freedesktop.org/fontconfig/fontconfig/-/issues/337, that deviates from GNOME/GTK’s defaults, which resulted in apps taking the settings directly from fontconfig (e.g. Firefox) from diverging from GNOME programs. The change was subsequently reverted in 2.14.2, choosing the greyscale antialiasing explicitly: https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/030759b74f5b3ce7fab6d17bbda6377444e82841 Let’s reflect this default setting in the NixOS module. Co-authored-by: Jan Tojnar <jtojnar@gmail.com> Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
2023-03-24 10:43:39 +00:00
- `fontconfig` now defaults to using greyscale antialiasing instead of subpixel antialiasing because of a [recommendation from one of the downstreams](https://gitlab.freedesktop.org/fontconfig/fontconfig/-/issues/337). You can change this value by configuring [](#opt-fonts.fontconfig.subpixel.rgba) accordingly.
nextcloud27: init Fixes #237560
2023-06-14 11:59:43 +00:00
- The latest available version of Nextcloud is v27 (available as `pkgs.nextcloud27`). The installation logic is as follows:
- If [`services.nextcloud.package`](#opt-services.nextcloud.package) is specified explicitly, this package will be installed (**recommended**)
- If [`system.stateVersion`](#opt-system.stateVersion) is >=23.11, `pkgs.nextcloud27` will be installed by default.
- If [`system.stateVersion`](#opt-system.stateVersion) is >=23.05, `pkgs.nextcloud26` will be installed by default.
- Please note that an upgrade from v25 (or older) to v27 directly is not possible. Please upgrade to `nextcloud26` (or earlier) first. Nextcloud prohibits skipping major versions while upgrading. You can upgrade by declaring [`services.nextcloud.package = pkgs.nextcloud26;`](options.html#opt-services.nextcloud.package).
nixos/qemu-vm: add option for named network interfaces Adds a new option to the virtualisation modules that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` option is still supported for cases where the name of the network interface is irrelevant.
2023-05-22 03:38:52 +00:00
- A new option was added to the virtualisation module that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` is still supported for cases where the name of the network interface is irrelevant.
nixos/nginx: first-class PROXY protocol support PROXY protocol is a convenient way to carry information about the originating address/port of a TCP connection across multiple layers of proxies/NAT, etc. Currently, it is possible to make use of it in NGINX's NixOS module, but is painful when we want to enable it "globally". Technically, this is achieved by reworking the defaultListen options and the objective is to have a coherent way to specify default listeners in the current API design. See `mkDefaultListenVhost` and `defaultListen` for the details. It adds a safeguard against running a NGINX with no HTTP listeners (e.g. only PROXY listeners) while asking for ACME certificates over HTTP-01. An interesting usecase of PROXY protocol is to enable seamless IPv4 to IPv6 proxy with origin IPv4 address for IPv6-only NGINX servers, it is demonstrated how to achieve this in the tests, using sniproxy. Finally, the tests covers: - NGINX `defaultListen` mechanisms are not broken by these changes; - NGINX PROXY protocol listeners are working in a final usecase (sniproxy); - uses snakeoil TLS certs from ACME setup with wildcard certificates; In the future, it is desirable to spoof-attack NGINX in this scenario to ascertain that `set_real_ip_from` and all the layers are working as intended and preventing any user from setting their origin IP address to any arbitrary, opening up the NixOS module to bad™ vulnerabilities. For now, it is quite hard to achieve while being minimalistic about the tests dependencies.
2023-03-05 17:13:27 +00:00
nixos/manual: disallow docbook option docs it's been long in the making, and with 23.05 out we can finally disable docbook option docs and default to markdown instead. this brings a massive speed boost in manual and manpage builds, so much so that we may consider enabling user module documentation by default. we don't remove the docbook support code entirely yet because it's a lot all over, and probably better removed in multiple separate changes.
2023-06-11 17:29:32 +00:00
- DocBook option documentation is no longer supported, all module documentation now uses markdown.
nixos/nginx: first-class PROXY protocol support PROXY protocol is a convenient way to carry information about the originating address/port of a TCP connection across multiple layers of proxies/NAT, etc. Currently, it is possible to make use of it in NGINX's NixOS module, but is painful when we want to enable it "globally". Technically, this is achieved by reworking the defaultListen options and the objective is to have a coherent way to specify default listeners in the current API design. See `mkDefaultListenVhost` and `defaultListen` for the details. It adds a safeguard against running a NGINX with no HTTP listeners (e.g. only PROXY listeners) while asking for ACME certificates over HTTP-01. An interesting usecase of PROXY protocol is to enable seamless IPv4 to IPv6 proxy with origin IPv4 address for IPv6-only NGINX servers, it is demonstrated how to achieve this in the tests, using sniproxy. Finally, the tests covers: - NGINX `defaultListen` mechanisms are not broken by these changes; - NGINX PROXY protocol listeners are working in a final usecase (sniproxy); - uses snakeoil TLS certs from ACME setup with wildcard certificates; In the future, it is desirable to spoof-attack NGINX in this scenario to ascertain that `set_real_ip_from` and all the layers are working as intended and preventing any user from setting their origin IP address to any arbitrary, opening up the NixOS module to bad™ vulnerabilities. For now, it is quite hard to achieve while being minimalistic about the tests dependencies.
2023-03-05 17:13:27 +00:00
- `services.nginx` gained a `defaultListen` option at server-level with support for PROXY protocol listeners, also `proxyProtocol` is now exposed in `services.nginx.virtualHosts.<name>.listen` option. It is now possible to run PROXY listeners and non-PROXY listeners at a server-level, see [#213510](https://github.com/NixOS/nixpkgs/pull/213510/) for more details.
nixos/qemu-vm: use persistent block device names This change removes the bespoke logic around identifying block devices. Instead of trying to find the right device by iterating over `qemu.drives` and guessing the right partition number (e.g. /dev/vda{1,2}), devices are now identified by persistent names provided by udev in /dev/disk/by-*. Before this change, the root device was formatted on demand in the initrd. However, this makes it impossible to use filesystem identifiers to identify devices. Now, the formatting step is performed before the VM is started. Because some tests, however, rely on this behaviour, a utility function to replace this behaviour in added in /nixos/tests/common/auto-format-root-device.nix. Devices that contain neither a partition table nor a filesystem are identified by their hardware serial number which is injecetd via QEMU (and is thus persistent and predictable). PCI paths are not a reliably way to identify devices because their availability and numbering depends on the QEMU machine type. This change makes the module more robust against changes in QEMU and the kernel (non-persistent device naming) and by decoupling abstractions (i.e. rootDevice, bootPartition, and bootLoaderDevice) enables further improvement down the line.
2023-06-08 00:34:10 +00:00
## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}
- The `qemu-vm.nix` module by default now identifies block devices via
persistent names available in `/dev/disk/by-*`. Because the rootDevice is
identfied by its filesystem label, it needs to be formatted before the VM is
started. The functionality of automatically formatting the rootDevice in the
initrd is removed from the QEMU module. However, for tests that depend on
this functionality, a test utility for the scripted initrd is added
(`nixos/tests/common/auto-format-root-device.nix`). To use this in a NixOS
test, import the module, e.g. `imports = [
./common/auto-format-root-device.nix ];` When you use the systemd initrd, you
can automatically format the root device by setting
`virtualisation.fileSystems."/".autoFormat = true;`.
Reference in a new issue Copy permalink