tobias/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-11-10 01:33:11 +01:00
Code Issues Packages Projects Releases Wiki Activity
nixpkgs/nixos/doc/manual/release-notes/rl-2511.section.md
Léana 江 0829ce947c
nixos/eval-config: Remove NIXOS_EXTRA_MODULE_PATH 
This removes the previously depricated NIXOS_EXTRA_MODULE_PATH
environment variable.

Tested with
$ nix-instantiate nixos/lib/eval-config.nix --arg modules '[{fileSystems."/".device="x";boot.loader.grub.enable=false;}]' -A config.system.build.toplevel
$ NIXOS_EXTRA_MODULE_PATH=$HOME/whatever.nix nix-instantiate nixos/lib/eval-config.nix --arg modules '[{fileSystems."/".device="x";boot.loader.grub.enable=false;}]' -A config.system.build.toplevel
2025-09-08 11:02:43 +08:00

26 KiB
Raw Blame History

Release 25.11 ("Xantusia", 2025.11/??)

Highlights

  • nixos-rebuild-ng, a full rewrite of nixos-rebuild in Python, is enabled by default from this release. You can disable it by setting to false in your configuration if you need, but please report any issues. It is expected that the next major version of NixOS (26.05) will remove the {option}system.rebuild.enableNg option.

  • rEFInd, a graphical boot manager for UEFI systems, can now be used through .

  • Secure boot support can now be enabled for the Limine bootloader through {option}boot.loader.limine.secureBoot.enable. Bootloader install script signs the bootloader, then kernels are hashed during system rebuild and written to a config. This allows Limine to boot only the kernels installed through NixOS system.

  • The default PostgreSQL version for new NixOS installations (i.e. with system.stateVersion >= 25.11) is v17.

  • The NetworkManager module does not ship with a default set of VPN plugins anymore. All required VPN plugins must now be explicitly configured in networking.networkmanager.plugins.

  • The Qt 5-based versions of KDE Gear, Plasma, Maui and Deepin have been removed. Users are advised to migrate to Plasma 6 and Gear 25.08, available under kdePackages.

  • Syncthing has been updated to version 2.0.0.

New Modules

Backward Incompatibilities

  • The Perl implementation of the switch-to-configuration program is removed. All switchable systems now use the Rust rewrite. Any prior usage of system.switch.enableNg must now be removed. If you have any outstanding issues with the new implementation, please open an issue on GitHub.

  • The no-broken-symlink build hook now also fails builds whose output derivation contains links to $TMPDIR (typically /build, which contains the build directory).

  • The services.polipo module has been removed as polipo is unmaintained and archived upstream.

  • The non-LTS Forgejo package (forgejo) has been updated to 12.0.0. This release contains breaking changes, see the release blog post for all the details and how to ensure smooth upgrades.

  • sing-box has been updated to 1.12.3, which includes a number of breaking changes, old configurations may need updating or they will cause the tool to fail to run. See the change log for details and migration for how to update old configurations.

  • The Pocket ID module ([services.pocket-id][#opt-services.pocket-id.enable]) and package (pocket-id) has been updated to 1.0.0. Some environment variables have been changed or removed, see the migration guide.

  • services.seafile has been removed, as it is unmaintained and outdated. See the manual for details and next steps.

  • The zigbee2mqtt package was updated to version 2.x, which contains breaking changes. See the discussion for further information.

  • []{#sec-release-25.11-incompatibilities-sourcehut-removed} The services.sourcehut module and corresponding sourcehut packages were removed due to being broken and unmaintained.

  • The zookeeper project changed their logging tool to logback, therefore services.zookeeper.logging option has been updated to expect a logback compatible string.

  • The dovecot systemd service was renamed from dovecot2 to dovecot. The former is now just an alias. Update any overrides on the systemd unit to the new name.

  • Prosody has been updated to major release 13 which removed some obsoleted modules and brought a couple of major and breaking changes:

    • The http_files module is now disabled by default because it now requires http_files_dir to be configured.
    • The vcard_muc module has been removed and got replaced by the inbuilt muc_vcard module.
    • The http_upload module has been removed and you must migrate to the http_file_share module to stay XEP-0423 compliant. The httpFileShare options got expanded to better facility that.
    • The admin_shell module is now always being loaded to make prosodyctl functional.
    • The mime_types_file setting is now set to "${pkgs.mailcap}/etc/mime.types" to prevent errors. For a complete list of changes, please see their announcement.

  • The yeahwm package and services.xserver.windowManager.yeahwm module were removed due to the package being broken and unmaintained upstream.

  • The services.postgresql module now sets up a systemd unit postgresql.target. Depending on postgresql.target guarantees that postgres is in read-write mode and initial/ensure scripts were executed. Depending on postgresql.service only guarantees a read-only connection.

  • The services.siproxd module has been removed as siproxd is unmaintained and broken with libosip 5.x.

  • services.tor.torsocks.enable no longer defaults to true if Tor and Tor client functionality is enabled.

  • netbox-manage script created by the netbox module no longer uses sudo -u netbox internally. It can be run as root and will change it's user to netbox using runuser

  • services.gateone has been removed as the package was removed such that it does not work.

  • services.dwm-status.extraConfig was replaced by RFC0042-compliant , which is used to generate the config file. services.dwm-status.order is now moved to , as it's a part of the config file.

  • gitversion was updated to 6.3.0, which includes a number of breaking changes, old configurations may need updating or they will cause the tool to fail to run. See the 6.0.0 release notes for GitVersion for details on the breaking changes, the documentation on the configuration format for the new configuration specification, and the documentation on version variables for what is now supported.

  • renovate was updated to v41. See the upstream release notes for v40 and v41 for breaking changes.

  • The "NIXOS_EXTRA_MODULE_PATH" variable from configuration evaluation has been deprecated. We recommend a workflow where you update the expression files instead, but if you wish to continue to use this variable, you may do so with a module like:

    {
  imports = [
    (builtins.getEnv "NIXOS_EXTRA_MODULE_PATH")
  ];
}

    This has the benefit that your configuration hints at the non-standard workflow.

  • i18n.inputMethod.fcitx5.plasma6Support has been removed because qt6 is the only one used for fcitx5-configtool now.

  • The boot.readOnlyNixStore has been removed. Control over bind mount options on /nix/store is now offered by the boot.nixStoreMountOpts option.

  • The Postfix module has been updated and likely requires configuration changes:

  • vmalert now supports multiple instances with the option services.vmalert.instances."".enable

  • services.victorialogs.package now defaults to victorialogs, as victoriametrics no longer contains the VictoriaLogs binaries.

  • The services.traccar.settings attribute has been reworked. Instead of the previous flat attribute set the new implementation uses nested attribute sets. You need to update you configuration manually. For instance, services.traccar.settings.loggerConsole becomes services.traccar.settings.logger.console.

  • The wstunnel module was converted to RFC42-style settings, you will need to update your NixOS config if you make use of this module.

  • private-gpt service has been removed by lack of maintenance upstream.

  • NixOS display manager modules now strictly use tty1, where many of them previously used tty7. Options to configure display managers' VT have been dropped. A configuration with a display manager enabled will not start getty@tty1.service, even if the system is forced to boot into multi-user.target instead of graphical.target.

  • river 0.3.x has been renamed to river-classic upstream, and the package renamed accordingly. programs.river has been renamed to programs.river-classic.

  • command-not-found package is now disabled by default; it works only for nix-channels based systems, and requires setup for it to work.

  • The systemd target kbrequest.target is now unset by default, instead of being forcibly symlinked to rescue.target. In case you were relying on this behavior (Alt + ArrowUp on the tty causing the current target to be changed to rescue.target), you can restore it by setting systemd.targets.rescue.aliases = [ "kbrequest.target" ]; in your configuration.

Other Notable Changes

  • services.clamsmtp is unmaintained and was removed from Nixpkgs.

  • prosody gained a config check option named services.prosody.checkConfig which runs prosodyctl check config and is turned on by default.

  • services.dependency-track removed its configuration of the JVM heap size. This lets the JVM choose its maximum heap size automatically, which should work much better in practice for most users. For deployments on systems with little RAM, it may now be necessary to manually configure a maximum heap size using {option}services.dependency-track.javaArgs.

  • services.dnscrypt-proxy2 gains a package option to specify dnscrypt-proxy package to use.

  • services.nextcloud.configureRedis now defaults to true in accordance with upstream recommendations to have caching for file locking. See the upstream doc for further details.

  • mate-wayland-session 1.28.4 is now using the default wayfire decorator instead of firedecor, thus services.xserver.desktopManager.mate.enableWaylandSession is no longer shipping firedecor. If you are experiencing broken window decorations after upgrade, backup and remove ~/.config/mate/wayfire.ini and re-login.

  • services.gitea supports sending notifications with sendmail again. To do this, activate the parameter services.gitea.mailerUseSendmail and configure SMTP server.

  • Revamp of the ACME certificate acquisication and renewal process to help scale systems with lots (100+) of certificates.

    Units and targets have been reshaped to better support more specific dependency propagation and avoid superfluously triggering unchanged units:

    If a service requires a syntactically valid certificate to start it should now depend on the acme-{certname}.service unit.

    We now always generate initial self-signed certificates as this drastically simplifies the dependency structure. As a result, the option security.acme.preliminarySelfsigned has been removed.

    Instead of the previous acme-finished-{certname}.targets there are now acme-order-renew-{certname}.services that will be activated in a delayed fashion to ensure that bootstrapping with servers like nginx that take part in the acquisition/renewal process works smoothly. Dependencies on acme-finished units should move to acme-order-renew.

    Note that system activation will complete before all certificates may have been renewed or acquired.

  • libvirt now supports using nftables backend.

    • The virtualisation.libvirtd.firewallBackend option can be used to configure the firewall backend used by libvirtd.

  • systemd.extraConfig and boot.initrd.systemd.extraConfig was converted to RFC42-style systemd.settings.Manager and boot.initrd.systemd.settings.Manager respectively.

    • systemd.watchdog.runtimeTime was renamed to systemd.settings.Manager.RuntimeWatchdogSec
    • systemd.watchdog.device was renamed to systemd.settings.Manager.WatchdogDevice
    • systemd.watchdog.rebootTime was renamed to systemd.settings.Manager.RebootWatchdogSec
    • systemd.watchdog.kexecTime was renamed to systemd.settings.Manager.KExecWatchdogSec
    • systemd.enableCgroupAccounting was removed. Cgroup accounting now needs to be disabled directly using systemd.settings.Manager.*Accounting.

  • services.logind.extraConfig was converted to RFC42-style services.logind.settings.Login.

  • services.ntpd-rs now performs configuration validation.

  • Immich now has support for VectorChord when using the PostgreSQL configuration provided by services.immich.database.enable, which replaces pgvecto-rs. VectorChord support can be toggled with the option services.immich.database.enableVectorChord. Additionally, pgvecto-rs support is now disabled from NixOS 25.11 onwards using the option services.immich.database.enableVectors. This option will be removed fully in the future once Immich drops support for pgvecto-rs fully. See Immich migration instructions

  • services.restic.backups now includes a command option for passing a command to the --stdin-from-command flag.

  • services.postsrsd now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the services.postsrsd.configurePostfix option.

  • services.pfix-srsd now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the services.pfix-srsd.configurePostfix option.

  • services.monero now includes the environmentFile option for adding secrets to the Monero daemon config.

  • services.netbird.server now uses dedicated packages split out due to relicensing of server components to AGPLv3 with version 0.53.0,

  • services.pds has been renamed to services.bluesky-pds.

  • The new option networking.ipips has been added to create IP within IP kind of tunnels (including 4in6, ip6ip6 and ipip). With the existing networking.sits option (6in4), it is now possible to create all combinations of IPv4 and IPv6 encapsulation.

  • It is now possible to configure the default source address using the new options networking.defaultGateway.source, networking.defaultGateway6.source.

  • Potential race conditions in the network setup when using networking.interfaces have been fixed by disabling duplicate address detection (DAD) for statically configured IPv6 addresses.

  • amdgpu kernel driver overdrive mode can now be enabled by setting hardware.amdgpu.overdrive.enable and customized through hardware.amdgpu.overdrive.ppfeaturemask. This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}programs.corectrl.gpuOverclock.enable and {option}programs.tuxclocker.enableAMD.

  • services.varnish.http_address has been superseeded by services.varnish.listen which is now structured config for all of varnish's -a variations.

  • does not ship with an SSH agent anymore, as this is now handled by the gcr_4 package instead of gnome-keyring. A new module has been added to support this, under (its default value has been set to to ensure a smooth transition). See the relevant upstream PR for more details.

  • The nettools package (ifconfig, arp, mii-tool, netstat, route) is not installed by default anymore. The suite is unmaintained and users should migrate to iproute2 and ethtool instead.

  • sparkleshare has been removed as it no longer builds and has been abandoned upstream.