Release 19.03 (“Koi”, 2019/03/??)Highlights
In addition to numerous new and upgraded packages, this release has the
following highlights:
The default Python 3 interpreter is now CPython 3.7 instead of CPython 3.6.
Added the Pantheon desktop environment.
It can be enabled through services.xserver.desktopManager.pantheon.enable.
services.xserver.desktopManager.pantheon default enables lightdm
as a display manager and using Pantheon's greeter.
This is because of limitations with the screenlocking implementation, whereas the
screenlocker would be non-functional without it.
Because of that it is recommended to retain this precaution, however if you'd like to change this set:
to false and enable your preferred display manager.
A major refactoring of the Kubernetes module has been completed.
Refactorings primarily focus on decoupling components and enhancing
security. Two-way TLS and RBAC has been enabled by default for all
components, which slightly changes the way the module is configured.
See: for details.
New Services
The following new services were added since the last release:
./programs/nm-applet.nix
There is a new security.googleOsLogin module for using
OS Login
to manage SSH access to Google Compute Engine instances, which supersedes
the imperative and broken google-accounts-daemon used
in nixos/modules/virtualisation/google-compute-config.nix.
./services/misc/beanstalkd.nixBackward Incompatibilities
When upgrading from a previous release, please be aware of the following
incompatible changes:
The minimum version of Nix required to evaluate Nixpkgs is now 2.0.
For users of NixOS 18.03 and 19.03, NixOS defaults to Nix 2.0, but
supports using Nix 1.11 by setting nix.package =
pkgs.nix1;. If this option is set to a Nix 1.11 package, you
will need to either unset the option or upgrade it to Nix 2.0.
For users of NixOS 17.09, you will first need to upgrade Nix by setting
nix.package = pkgs.nixStable2; and run
nixos-rebuild switch as the root
user.
For users of a daemon-less Nix installation on Linux or macOS, you can
upgrade Nix by running curl https://nixos.org/nix/install |
sh, or prior to doing a channel update, running
nix-env -iA nix.
If you have already run a channel update and Nix is no longer able to
evaluate Nixpkgs, the error message printed should provide adequate
directions for upgrading Nix.
For users of the Nix daemon on macOS, you can upgrade Nix by running
sudo -i sh -c 'nix-channel --update && nix-env -iA
nixpkgs.nix'; sudo launchctl stop org.nixos.nix-daemon; sudo launchctl
start org.nixos.nix-daemon.
The Syncthing state and configuration data has been moved from
services.syncthing.dataDir to the newly defined
services.syncthing.configDir, which default to
/var/lib/syncthing/.config/syncthing.
This change makes possible to share synced directories using ACLs
without Syncthing resetting the permission on every start.
The ntp module now has sane default restrictions.
If you're relying on the previous defaults, which permitted all queries
and commands from all firewall-permitted sources, you can set
services.ntp.restrictDefault and
services.ntp.restrictSource to
[].
Package rabbitmq_server is renamed to
rabbitmq-server.
The light module no longer uses setuid binaries, but
udev rules. As a consequence users of that module have to belong to the
video group in order to use the executable (i.e.
users.users.yourusername.extraGroups = ["video"];).
Buildbot now supports Python 3 and its packages have been moved to
pythonPackages. The options
and
can be used to select
the Python 2 or 3 version of the package.
Options
services.znc.confOptions.networks.name.userName and
services.znc.confOptions.networks.name.modulePackages
were removed. They were never used for anything and can therefore safely be removed.
Package wasm has been renamed proglodyte-wasm. The package
wasm will be pointed to ocamlPackages.wasm in 19.09, so
make sure to update your configuration if you want to keep proglodyte-wasm
When the nixpkgs.pkgs option is set, NixOS will no
longer ignore the nixpkgs.overlays option. The old
behavior can be recovered by setting nixpkgs.overlays =
lib.mkForce [];.
OpenSMTPD has been upgraded to version 6.4.0p1. This release makes
backwards-incompatible changes to the configuration file format. See
man smtpd.conf for more information on the new file
format.
The versioned postgresql have been renamed to use
underscore number seperators. For example, postgresql96
has been renamed to postgresql_9_6.
Package consul-ui and passthrough consul.ui have been removed.
The package consul now uses upstream releases that vendor the UI into the binary.
See #48714
for details.
Slurm introduces the new option
services.slurm.stateSaveLocation,
which is now set to /var/spool/slurm by default
(instead of /var/spool).
Make sure to move all files to the new directory or to set the option accordingly.
The slurmctld now runs as user slurm instead of root.
If you want to keep slurmctld running as root, set
services.slurm.user = root.
The options services.slurm.nodeName and
services.slurm.partitionName are now sets of
strings to correctly reflect that fact that each of these
options can occour more than once in the configuration.
The solr package has been upgraded from 4.10.3 to 7.5.0 and has undergone
some major changes. The services.solr module has been updated to reflect
these changes. Please review http://lucene.apache.org/solr/ carefully before upgrading.
Package ckb is renamed to ckb-next,
and options hardware.ckb.* are renamed to
hardware.ckb-next.*.
The option services.xserver.displayManager.job.logToFile which was
previously set to true when using the display managers
lightdm, sddm or xpra has been
reset to the default value (false).
Network interface indiscriminate NixOS firewall options
(networking.firewall.allow*) are now preserved when also
setting interface specific rules such as networking.firewall.interfaces.en0.allow*.
These rules continue to use the pseudo device "default"
(networking.firewall.interfaces.default.*), and assigning
to this pseudo device will override the (networking.firewall.allow*)
options.
The nscd service now disables all caching of
passwd and group databases by
default. This was interferring with the correct functioning of the
libnss_systemd.so module which is used by
systemd to manage uids and usernames in the presence of
DynamicUser= in systemd services. This was already the
default behaviour in presence of services.sssd.enable =
true because nscd caching would interfere with
sssd in unpredictable ways as well. Because we're
using nscd not for caching, but for convincing glibc to find NSS modules
in the nix store instead of an absolute path, we have decided to disable
caching globally now, as it's usually not the behaviour the user wants and
can lead to surprising behaviour. Furthermore, negative caching of host
lookups is also disabled now by default. This should fix the issue of dns
lookups failing in the presence of an unreliable network.
If the old behaviour is desired, this can be restored by setting
the services.nscd.config option
with the desired caching parameters.
services.nscd.config =
''
server-user nscd
threads 1
paranoia no
debug-level 0
enable-cache passwd yes
positive-time-to-live passwd 600
negative-time-to-live passwd 20
suggested-size passwd 211
check-files passwd yes
persistent passwd no
shared passwd yes
enable-cache group yes
positive-time-to-live group 3600
negative-time-to-live group 60
suggested-size group 211
check-files group yes
persistent group no
shared group yes
enable-cache hosts yes
positive-time-to-live hosts 600
negative-time-to-live hosts 5
suggested-size hosts 211
check-files hosts yes
persistent hosts no
shared hosts yes
'';
See #50316
for details.
GitLab Shell previously used the nix store paths for the
gitlab-shell command in its
authorized_keys file, which might stop working after
garbage collection. To circumvent that, we regenerated that file on each
startup. As gitlab-shell has now been changed to use
/var/run/current-system/sw/bin/gitlab-shell, this is
not necessary anymore, but there might be leftover lines with a nix store
path. Regenerate the authorized_keys file via
sudo -u git -H gitlab-rake gitlab:shell:setup in that
case.
The pam_unix account module is now loaded with its
control field set to required instead of
sufficient, so that later PAM account modules that
might do more extensive checks are being executed.
Previously, the whole account module verification was exited prematurely
in case a nss module provided the account name to
pam_unix.
The LDAP and SSSD NixOS modules already add their NSS modules when
enabled. In case your setup breaks due to some later PAM account module
previosuly shadowed, or failing NSS lookups, please file a bug. You can
get back the old behaviour by manually setting
.text]]>.
The pam_unix password module is now loaded with its
control field set to sufficient instead of
required, so that password managed only
by later PAM password modules are being executed.
Previously, for example, changing an LDAP account's password through PAM
was not possible: the whole password module verification
was exited prematurely by pam_unix,
preventing pam_ldap to manage the password as it should.
fish has been upgraded to 3.0.
It comes with a number of improvements and backwards incompatible changes.
See the fish release notes for more information.
The ibus-table input method has had a change in config format, which
causes all previous settings to be lost. See
this commit message
for details.
Support for NixOS module system type types.optionSet and
lib.mkOption argument options is removed.
Use types.submodule instead.
(#54637)
matrix-synapse has been updated to version 0.99. It will
no longer generate a self-signed certificate on first launch
and will be the last version to accept self-signed certificates.
As such, it is now recommended to use a proper certificate verified by a
root CA (for example Let's Encrypt).
mailutils now works by default when
sendmail is not in a setuid wrapper. As a consequence,
the sendmailPath argument, having lost its main use, has
been removed.
Other Notable Changes
The module gained the option
which determines the used
Matomo version.
The Matomo module now also comes with the systemd service matomo-archive-processing.service
and a timer that automatically triggers archive processing every hour.
This means that you can safely
disable browser triggers for Matomo archiving
at Administration > System > General Settings.
Additionally, you can enable to
delete old visitor logs
at Administration > System > Privacy,
but make sure that you run systemctl start matomo-archive-processing.service
at least once without errors if you have already collected data before,
so that the reports get archived before the source data gets deleted.
composableDerivation along with supporting library functions
has been removed.
The deprecated truecrypt package has been removed
and truecrypt attribute is now an alias for
veracrypt. VeraCrypt is backward-compatible with
TrueCrypt volumes. Note that cryptsetup also
supports loading TrueCrypt volumes.
The Kubernetes DNS addons, kube-dns, has been replaced with CoreDNS.
This change is made in accordance with Kubernetes making CoreDNS the official default
starting from
Kubernetes v1.11.
Please beware that upgrading DNS-addon on existing clusters might induce
minor downtime while the DNS-addon terminates and re-initializes.
Also note that the DNS-service now runs with 2 pod replicas by default.
The desired number of replicas can be configured using:
.
The quassel-webserver package and module was removed from nixpkgs due to the lack
of maintainers.
The astah-community package was removed from nixpkgs due to it being discontinued and the downloads not being available anymore.
The httpd service now saves log files with a .log file extension by default for
easier integration with the logrotate service.
The owncloud server packages and httpd subservice module were removed
from nixpkgs due to the lack of maintainers.
It is possible now to uze ZRAM devices as general purpose ephemeral block devices,
not only as swap. Using more than 1 device as ZRAM swap is no longer recommended,
but is still possible by setting zramSwap.swapDevices explicitly.
Default algorithm for ZRAM swap was changed to zstd.
Changes to ZRAM algorithm are applied during nixos-rebuild switch,
so make sure you have enough swap space on disk to survive ZRAM device rebuild. Alternatively,
use nixos-rebuild boot; reboot.
Symlinks in /etc (except /etc/static)
are now relative instead of absolute. This makes possible to examine
NixOS container's /etc directory from host system
(previously it pointed to host /etc when viewed from host,
and to container /etc when viewed from container chroot).
This also makes /etc/os-release adhere to
the standard
for NixOS containers.
Flat volumes are now disabled by default in hardware.pulseaudio.
This has been done to prevent applications, which are unaware of this feature, setting
their volumes to 100% on startup causing harm to your audio hardware and potentially your ears.
With this change application specific volumes are relative to the master volume which can be
adjusted independently, whereas before they were absolute; meaning that in effect, it scaled the
device-volume with the volume of the loudest application.
The ndppd module
now supports all config options provided by the current
upstream version as service options. Additionally the ndppd package doesn't contain
the systemd unit configuration from upstream anymore, the unit is completely configured by the NixOS module now.
New installs of NixOS will default to the Redmine 4.x series unless otherwise specified in
services.redmine.package while existing installs of NixOS will default to
the Redmine 3.x series.
The Grafana module now supports declarative
datasource and dashboard
provisioning.
The use of insecure ports on kubernetes has been deprecated.
Thus options:
services.kubernetes.apiserver.port and
services.kubernetes.controllerManager.port
has been renamed to .insecurePort,
and default of both options has changed to 0 (disabled).
Note that the default value of
services.kubernetes.apiserver.bindAddress
has changed from 127.0.0.1 to 0.0.0.0, allowing the apiserver to be
accessible from outside the master node itself.
If the apiserver insecurePort is enabled,
it is strongly recommended to only bind on the loopback interface. See:
services.kubernetes.apiserver.insecurebindAddress.
The option services.kubernetes.apiserver.allowPrivileged
and services.kubernetes.kubelet.allowPrivileged now
defaults to false. Disallowing privileged containers on the cluster.
The kubernetes module does no longer add the kubernetes package to
environment.systemPackages implicitly.
The intel driver has been removed from the default list of
X.org video drivers.
The modesetting driver should take over automatically,
it is better maintained upstream and has less problems with advanced X11 features.
Some performance regressions on some GPU models might happen.
Some OpenCL and VA-API applications might also break
(Beignet seems to provide OpenCL support with
modesetting driver, too).
Users who need this functionality more than multi-output XRandR are advised
to add `intel` to `videoDrivers` and report an issue (or provide additional
details in an existing one)
Openmpi has been updated to version 4.0.0, which removes some deprecated MPI-1 symbols.
This may break some older applications that still rely on those symbols.
An upgrade guide can be found here.