The default PostgreSQL version for new NixOS installations (i.e. with system.stateVersion >= 26.11) is v18.

The nixexprs.tar.xz tarball will be discontinued together with Nixpkgs 27.05 after 2027-12-31. Migrate to the nixexprs.tar.zst tarball instead.

This affects for example users who pull Nixpkgs as a flake input from https://channels.nixos.org:

-nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz";
+nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";

tranquil is an ATProto PDS (personal data server) implementation in Rust. A featureful, spec conscious and community driven alternative to the Bluesky reference implementation PDS. Available as services.tranquil-pds.

Moonlight Qt, a client for playing your PC games on almost any device. Available as programs.moonlight-qt.

scx_loader, a system daemon and DBus-based loader for sched_ext schedulers. scxctl is the command-line client for interacting with the loader, allowing users to switch schedulers, modes, and arguments dynamically. Available as services.scx-loader

tap, an ATProtocol firehose synchronisation utility. Available as services.tap.

Nezha, a self-hosted, lightweight server and website monitoring and O&M tool. Available as services.nezha.

Watt, a CPU frequency and power management daemon for Linux. Available as services.watt.

mail-tlsa-check-exporter, validates SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter. Available as services.prometheus.exporters.mail-tlsa-check.

CastSponsorSkip, skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.

Stump, a free and open source comics, manga and digital book server with OPDS support. Available as services.stump.

Freescout, a free, open source Helpdesk and shared mailbox. Available as services.freescout.

Koito, a modern, themeable scrobbler that you can use with any program that scrobbles to a custom ListenBrainz URL. Available as services.koito.

FlapAlerted, detects BGP flapping events and provides statistics based on BGP update messages. Available as services.flap-alerted.

gocron, a task scheduler with web interface. Available as services.gocron.

Unpackerr, extracts downloads for Radarr, Sonarr, Lidarr, Readarr, and/or a Watch folder. Available as services.unpackerr.

Matrix Authentication Service is an OAuth2.0 and OpenID Connect provider for Matrix homeservers (such as Synapse). It replaces standard password authentication with modern OpenID Connect flows, and can delegate authentication to upstream OIDC providers. Available as services.matrix-authentication-service.

stash-clipboard, a Wayland clipboard “manager” with fast persistent history and multi-media support. Available as services.stash-clipboard.

OO7 is a desktop-agnostic Secret Service provider. Available as services.oo7

NordVPN, a NordVPN client for linux. Available as services.nordvpn.

boot.vesa has been removed. It was deprecated in 2020 because Xorg now works better with kernel modesetting. If you still need the legacy VESA 800x600 fallback, set boot.kernelParams = [ "vga=0x317" "nomodeset" ]; directly.

authentik has been updated to 2026.5.3, which changes the default listen address from 0.0.0.0 to [::]. IPv4-only deployments might need to adjust their listen settings. Deployments running the server and worker in the same network namespace must also set at least the worker AUTHENTIK_LISTEN__HTTP address so that the server and worker do not bind to the same address.

services.alps has been rewritten, see upstream repository for configuration.

Support for the legacy U‐Boot image format has been removed from the initrd generators, as it is deprecated upstream and no longer used by any platform in Nixpkgs.

Rustical migrates from settings.http.host and settings.http.port to settings.http.bind to support UNIX domain sockets as well as TCP sockets in one setting.

A number of options for services.llama-cpp have been removed in favor of the structured services.llama-cpp.settings option, attributes from which are used as arguments to llama-server executable, you can see all available options by running llama-server --help. Configuring model presets using Nix attribute set via services.llama-cpp.modelsPreset is no longer supported, please use services.llama-cpp.settings.models-preset with a path to an INI file containing desired options.

Python 2 has been removed from the top-level package set, as it is long past end-of-life. The python2, python27, python2Full, python27Full, python2Packages, and python27Packages attributes, along with the legacy python, pythonFull, and pythonPackages aliases, now throw an error directing you to python3. The isPy2 and isPy27 package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the resholve package for its oil dependency and is not exposed for general use.

security.polkit.enablePkexecWrapper has been introduced, making the pkexec setuid wrapper opt-in.

Apache Kafka has dropped support for ZooKeeper mode. The apacheKafka_3_9 and apacheKafka_4_0 packages have been removed, as every remaining packaged version is KRaft-only. The services.apache-kafka.zookeeper option (previously an alias for services.apache-kafka.settings."zookeeper.connect") has been removed; migrate your cluster to KRaft mode instead.

virtualisation.registries.block / insecure / search were deprecated, because they mapped to the deprecated V1 registries.conf format. See the new option virtualisation.registries.settings and containers-registries.conf(5) to migrate to the new configuration format.

When Avahi’s mDNS resolver is enabled (services.avahi.nssmdns4 or services.avahi.nssmdns6), only the minimal mDNS resolver is enabled by default to avoid adding a 5 second delay to every failed reverse hostname lookup (e.g., delaying ping by 5 seconds). The “full” mDNS resolver now remains disabled unless services.avahi.nssmdnsFull is also enabled. Users who have customized /etc/mdns.allow to allow mDNS domains not ending .local must enable services.avahi.nssmdnsFull to continue to resolve such domains.

String values passed to services.phpfpm.settings, services.phpfpm.pools.<name>.phpEnv, and services.phpfpm.pools.<name>.settings are now properly quoted and escaped, except for the ${} syntax that is left as-is. If you are manually escaping these values, please adjust accordingly.

systemd.user.extraConfig has been removed in favor of the structured systemd.user.settings.Manager option. Use systemd.user.settings.Manager to set any systemd-user.conf(5) option directly. For example, replace systemd.user.extraConfig = "DefaultTimeoutStartSec=60"; with systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;.

matrix-appservice-discord was removed from nixpkgs along with its NixOS module (services.matrix-appservice-discord) as it is no longer actively maintained upstream. Use the actively-maintained puppeting bridge mautrix-discord instead.

services.timesyncd.extraConfig has been removed in favor of the structured services.timesyncd.settings.Time option. Use services.timesyncd.settings.Time to set any timesyncd.conf(5) option directly. For example, replace services.timesyncd.extraConfig = "PollIntervalMaxSec=180"; with services.timesyncd.settings.Time.PollIntervalMaxSec = 180;.

services.firezone.server.provision has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone.

The services.syncthing module now updates the Syncthing REST API using partial updates (PATCH) instead of full replacements (PUT) for general settings. Updating these settings was broken and prone to errors after updates, see #428808 and #528889. As a result, settings modified manually through the Syncthing Web UI that are not explicitly defined in your Nix configuration will now persist across rebuilds.

services.plantuml-server.packages.jetty now supports jetty_12, it no longer supports jetty_11.

services.komodo-periphery has been updated to support version 2.0.0. Some options have been renamed to match the new configuration structure; compatibility aliases are provided for the renamed options. The passkeys and outbound.onboardingKey options have been removed; use passkeyFiles, auth.privateKey/auth.corePublicKeys, or outbound.onboardingKeyFile instead. New outbound mode configuration is available under outbound.*.

komodo has been updated to the v2 release line (2.x). See the upstream v1 → v2 upgrade guide.

temporal has been updated to the 1.31 release line. Always consult the upstream upgrade notes before upgrading between versions.

The shell_interact() function on interactive runs of NixOS VM tests has been deprecated. Use the SSH backdoor instead.

services.netbox has received a number of updates:

security.run0.enableSudoAlias now uses the run0-sudo-shim instead of a shell-script to improve compatibility.

With system.etc.overlay.mutable = false, NixOS now ships an empty /etc/machine-id in the image. Previously the file was absent and systemd logged System cannot boot: Missing /etc/machine-id and /etc/ is read-only while ConditionFirstBoot fired on every boot. With this change, systemd now overlays a transient ID from /run/machine-id for the session, and systemd-machine-id-commit.service has ConditionFirstBoot so it writes the machine-id through to a persistent backing file when one is bind-mounted over /etc/machine-id. To persist the machine-id across reboots, bind-mount a writable file containing uninitialized over /etc/machine-id from the initrd, or set systemd.machine_id= on the kernel command line (use systemd.machine_id=firmware to derive a stable ID on hardware that supports it).

security.run0.persistentAuth options have been added to support persistent Authentication of session. Timeout configurable via security.polkit.settings.Polkitd.ExpirationSeconds.

boot.loader.systemd-boot gained support for Automatic Boot Assessment via the new boot.loader.systemd-boot.bootCounting options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named nixos-<content-hash>.conf instead of nixos-generation-<n>.conf; existing entries are migrated automatically on the next nixos-rebuild boot/switch.

services.nginx gained a lua option to enable Lua scripting via OpenResty’s lua-nginx-module on a stock nginx, configuring lua_package_path/lua_package_cpath from the packages listed in services.nginx.lua.extraPackages. Use this to add Lua to a regular nginx; for the full OpenResty platform (libraries that rely on its bundled lualib, such as lua-resty-openidc), set services.nginx.package to pkgs.openresty instead — the option configures the Lua search path for it too.

security.polkit.settings added for RFC42 style configuration of the polkitd daemon.

boot.supportedFilesystems.ntfs installs ntfsprogs-plus instead of ntfs3g on kernel version 7.1 and later, unless boot.supportedFilesystems.ntfs-3g is explicitly enabled.

The programs.fuse module, which provides the fusermount3 executable and the /etc/fuse.conf config file, is now opt-in. The obligation to enable it has been shifted to its various consumers (e.g. gvfs, flatpak, appimage, sshfs). This can break fuse consumers at runtime, that don’t explicitly declare that dependency with a module, e.g the mounting functionality in various backup tools (borg, restic, rclone, …).

services.plausible can now again seed an initial admin user declaratively via services.plausible.adminUser.email. This makes fully declarative deployments safer: Otherwise the user needed to either accept Plausible’s unauthenticated “first launch” setup wizard, which lets anyone reaching the instance create the first admin account, or do more work (deploying with NixOS’s default binding to localhost without exposing it publicly, going through the wizard, and then deploying Plausible exposed to the Internet). This option was previously removed with NixOS 25.05 due to an upstream Plausible change making declarative admin creation more difficult, but this change re-implements the admin creation directly.

The newuidmap and newgidmap security wrappers are now installed with cap_setuid/cap_setgid file capabilities instead of the setuid-root bit, matching shadow’s --with-fcaps install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via /etc/subuid (which NixOS never configures by default) additionally requires cap_setfcap; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";.

The authelia module now uses systemd’s LoadCredential to load all files defined in secrets. As such, these files no longer need to be readable by the authelia user and group: they can for example be set to be only readable by the root user.

zoneminder has been updated to 1.38.x release. See upstream release note. While database migration should happen automatically, it’s recommended that you make a backup of the database before upgrading your system.

The latest available version of Nextcloud is v34 (available as pkgs.nextcloud34). The installation logic is as follows:

trilium-desktop and trilium-server have been updated to 0.104.0. This release includes security hardening fixes that may break functionality. See upstream release note for details.

Stage 1 (a.k.a. initrd) is now based on systemd by default, and the old scripted implementation is deprecated and scheduled for removal in 26.11. If you run into issues migrating, you can get help from the community or report an issue on GitHub.

You can temporarily revert to the scripted stage 1 implementation by disabling boot.initrd.systemd.enable, but this is discouraged.

Most incompatibilities will be explained with assertions during configuration evaluation, but be aware of the following that can’t be automatically detected:

The system.nix file has been added as an alternative entry point to configuration.nix (and flake.nix) that allows configuring NixOS without using nix-channel. This file must evaluate to a NixOS system derivation or an attribute set of such derivations, in which case the attribute to build has to be selected with the --attr option of nixos-rebuild or nixos-install. For example,

# system.nix
let
  # Pinned Nixpkgs archive
  #
  # Use `curl -I https://channels.nixos.org/nixos-26.05` to get the
  # latest commit of the stable channel and `nix-prefetch-url --unpack`
  # to compute its sha256 hash.
  nixpkgs = builtins.fetchTarball {
    url = "https://github.com/NixOS/nixpkgs/archive/c217913993d6.tar.gz";
    sha256 = "026mprs324330pfazlgbw987qmsa8ligglarvqbcxzig2kgw0lqg";
  };
in
import "${nixpkgs}/nixos" {
  # Build NixOS using an external configuration.nix file,
  # or directly set your options here
  configuration = ./configuration.nix;
}

The default location of system.nix is /etc/nixos/system.nix and can be changed by setting the <nixos-system> search path. nixos-rebuild and nixos-install can now also load a system.nix file in the current directory (only if --attr is used) or from a directory specified with --file.

The default kernel package has been updated from 6.12 to 6.18. All supported kernels remain available.

The default D-Bus implementation has been switched from dbus to dbus-broker. dbus-broker provides higher performance and reliability while maintaining compatibility with the D-Bus reference implementation.

Note that changing services.dbus.implementation is a switch inhibitor: switching between implementations requires a reboot rather than just nixos-rebuild switch, because restarting D-Bus mid-session is unsafe.

Users who wish to keep the classic daemon can set: services.dbus.implementation = "dbus";

The NixOS integration test driver now supports systemd-nspawn containers as an alternative backend to QEMU virtual machines (#470248, #478109, #479968). Most NixOS integration tests do not require a full VM, and switching them to containers can considerably reduce test time and resource usage. Container-based tests also run fine on Nix builders that are themselves VMs without KVM, and because containers can bind-mount host device nodes, they make it possible to exercise GPU/CUDA workloads from within NixOS integration tests. See the NixOS manual section on writing tests for details on how to opt in and on the limitations of the container backend.

services.autossh-ng.sessions NixOS module was introduced as a simpler alternative to the existing services.autossh.sessions module.

services.nextcloud-spreed-signaling NixOS module has been added to facilitate declarative management of a standalone Spreed signaling server (“High Performance Backend” for Nextcloud Talk).

OpenThread Border Router, a Thread border router for POSIX-based platforms that bridges Thread mesh networks to IP networks. Available as services.openthread-border-router.

Atuin, magical shell history — sync, search and backup your terminal history. Available as programs.atuin.

Meshtastic, an open-source, off-grid, decentralised mesh network designed to run on affordable, low-power devices. Available as services.meshtasticd.

Goupile, an open-source design tool for secure forms including Clinical Report Forms (eCRF). Available as services.goupile.

knot-resolver, in version 6. Available as services.knot-resolver. A module for knot-resolver 5 was already available as services.kresd.

ImmichFrame, display your photos from Immich as a digital photo frame. Available as services.immichframe.

adw-bluetooth, a GNOME-inspired LibAdwaita Bluetooth applet. Available as services.adw-bluetooth.

PdfDing, manage, view and edit your PDFs seamlessly on all your devices wherever you are. Available as services.pdfding.

mangowc, a lightweight and feature-rich Wayland compositor based on dwl. Available as programs.mangowc.

reaction, a daemon that scans program outputs for repeated patterns, and takes action. A common usage is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors. A modern alternative to fail2ban. Available as services.reaction.

vinyl-cache as the Varnish Cache project renamed itself. Available as services.vinyl-cache. To aid the migration, the old services.varnish module is still available.

papra, an open-source document management platform designed to help you organize, secure, and archive your files effortlessly. Available as services.papra.

rqbit, a bittorrent client written in Rust. It has HTTP API and Web UI, and can be used as a library. Available as services.rqbit.

Tailscale Serve, configure Tailscale Serve for exposing local services to your tailnet. Available as services.tailscale.serve.

qui, a modern alternative webUI for qBittorrent, with multi-instance support. Written in Go/React. Available as services.qui.

kiwix-serve, a service that serves ZIM files (such as Wikipedia archives) over HTTP. Available as services.kiwix-serve.

matterjs-server, a Matter controller with a Home Assistant compatible WebSocket API. Available as services.matterjs-server.

Remark42, a self-hosted comment engine. Available as services.remark42.

LibreChat, open-source self-hostable ChatGPT clone with Agents and RAG APIs. Available as services.librechat.

nohang, a daemon for Linux that prevents out of memory (OOM) situations from affecting system responsiveness. Available as services.nohang.

clevis-luks-askpass, automatic LUKS unlocking in initrd using clevis token bindings stored in LUKS headers. Available as boot.initrd.clevisLuksAskpass.

passless, a daemon for using Webauthn Passkeys backed by password-store.

bentopdf, a privacy-first PDF toolkit running completely in-browser. Available as services.bentopdf.

hyprwhspr-rs, a keybind activated speech-to-text voice dictation utility built for use with Hyprland. Available as services.hyprwhspr-rs.

DankMaterialShell, a complete desktop shell for Wayland compositors built with Quickshell. Available as programs.dms-shell.

pyroscope, a continuous profiling platform that allows for performance debugging. Available as services.pyroscope.

dms-greeter, a modern display manager greeter for DankMaterialShell that works with greetd and supports multiple Wayland compositors. Available as services.displayManager.dms-greeter.

dsearch, a fast filesystem search service with fuzzy matching. Available as programs.dsearch.

Rustical, a CalDav/CardDav server aiming to be simple, fast and passwordless. Available as services.rustical.

Elephant, a data provider service and backend for building custom application launchers. Available as services.elephant.

Dunst, a lightweight and customizable notification daemon. Available as services.dunst.

cocoon, a PDS (personal data server) that is an alternative to the Bluesky PDS. Available as services.cocoon.

Ente Auth, an open source 2FA authenticator, with end-to-end encrypted backups. Available as programs.ente-auth.

linkding, a self-hosted bookmark manager designed to be minimal, fast, and easy to set up. Available as services.linkding.

gs1200-exporter, a Prometheus exporter for Zyxel GS1200 series switches. Available as services.gs1200-exporter.

Tinyauth, a simple authentication middleware for web apps, with OAuth and LDAP support. Available as services.tinyauth.

Strichliste, a digital self-service tallysheet used in hackerspaces, clubs and offices. Available as services.strichliste.

Dawarich, a self-hostable location history tracker. Available as services.dawarich.

Howdy, a Windows Hello™ style facial authentication program for Linux. Available as services.howdy

SuiteNumérique Drive, a collaborative file sharing and document management platform that scales. Built with Django and React. Open source alternative to Sharepoint or Google Drive. Available as services.lasuite-drive.

linux-enable-ir-emitter, a tool used to set up IR cameras, used with Howdy. Available as services.linux-enable-ir-emitter.

udp-over-tcp, a tunnel for proxying UDP traffic over a TCP stream. Available as services.udp-over-tcp.udp2tcp and services.udp-over-tcp.tcp2udp.

turborepo-remote-cache, an open-source implementation of the Turborepo custom remote cache server. Available as services.turborepo-remote-cache.

RSSHub, a service to convert many sources into rss. Available as services.rsshub.

ReFrame, a DRM/KMS based remote desktop for Linux that supports Wayland/NVIDIA/headless/login. Available as services.reframe

Komodo Periphery, a multi-server Docker and Git deployment agent by Komodo. Available as services.komodo-periphery.

Shoko, an anime management system. Available as services.shoko.

perses, the open dashboard tool for Prometheus and other data sources. Available as services.perses.

Drasl, an alternative authentication server for Minecraft. Available as services.drasl.

tabbyAPI, the official OpenAI compatible API server for Exllama. Available as services.tabbyapi.

Tdarr, Audio/Video Library Analytics & Transcode/Remux Automation. Available as services.tdarr.

Headplane, a feature-complete Web UI for Headscale. Available as services.headplane.

whois, an intelligent WHOIS client. Available as programs.whois.

porxie, a correct and efficient ATProto blob proxy for secure content delivery. Available as services.porxie.

LogiOps, an unofficial userspace driver for HID++ Logitech devices. Available as services.logiops.

services.openssh.settings.AcceptEnv is now explicitly defined as an option that takes a list of strings, to facilitate option merging. Setting it to a string value is no longer supported.

The default packages in services.jenkins.packages have been dropped, since not every Jenkins installation needs any package at all. It’s more reasonable to leave it empty and let users configure what they need.

services.taskchampion-sync-server module has had an option services.taskchampion-sync-server.dynamicUser added to use systemd’s DynamicUser feature. This is enabled by default when stateVersion is at least 26.05, and disabled otherwise. If you need this feature, you need to set services.taskchampion-sync-server.dynamicUser to true and migrate /var/lib/taskchampion-sync-server to /var/lib/private/taskchampion-sync-server.

The programs.captive-browser module no longer falls back on a setcap wrapper around udhcpc to discover your network’s DNS server due to GHSA-wc3r-c66x-8xmc (CVE-2026-25740). If you’re using this module, you must either configure programs.captive-browser.dhcp-dns manually or enable one of NetworkManager, dhcpcd, or systemd-networkd.

The services.yggdrasil module has been refactored with the following breaking changes:

services.xserver will now throw an error if an X11 driver specified in videoDriver(s) cannot be found. Previously, unknown drivers would be silently ignored.

The services.avahi.wideArea option now defaults to false as a mitigation against CVE-2024-52615/GHSA-x6vp-f33h-h32g.

systemd.coredump.extraConfig has been removed in favor of the structured systemd.coredump.settings.Coredump option. Use systemd.coredump.settings.Coredump to set any coredump.conf(5) option directly. For example, replace systemd.coredump.extraConfig = "Storage=journal"; with systemd.coredump.settings.Coredump.Storage = "journal";.

services.home-assistant.config.lovelace.mode has been renamed to lovelace.dashboards and lovelace.resource_mode to match the configuration format required by Home Assistant 2026.8. Users who explicitly set lovelace.mode should remove it; the module generates the correct entries automatically.

fulcrum has been updated to 2.x. If run against an existing v1.x database without the --db-upgrade flag it refuses to start; the upgrade takes around an hour on Bitcoin mainnet.

opentrack, slushload, synthesia, vtfedit, winbox, wineasio, and yabridge use wineWow64Packages instead of wineWowPackages as wine versions >= 11.0 have deprecated wineWowPackages. As such, the prefixes for these packages are NOT backwards compatible and need to be regenerated with potential for data loss.

profiles/hardened has been removed, because:

services.crabfit was removed because its upstream packages are unmaintained and insecure.

services.opensnitch.settings.Rules.Path now defaults to /var/lib/opensnitch/rules instead of the previous /etc/opensnitchd/rules because it contains mutable data.

services.mosquitto now generates per-listener authentication and access control via the upstream password-file and acl-file plugins instead of the deprecated password_file and acl_file options. The plugins contain the same code, so behaviour is unchanged, but services.mosquitto.package must now be at least version 2.1.

sing-box has been updated to 1.13.0, which has removed some deprecated options. See upstream documentation for details and migration options.

services.statsd has been removed because the packages it relies on do not exist anymore in nixpkgs.

services.pyload has been removed because the package it relies on does not exist anymore in nixpkgs due to vulnerabilities and being unmaintained.

Removed the ability from systemd to start units installed via nix-env -i. This feature is hardly used and most units do not work without NixOS specific changes anyways. Removing this allows us to drop a custom systemd patch improving systemd maintainability and update speed.

Removed the ability from systemd to depend on open-yet-unformatted dm-crypt devices as systemd device units. For example you cannot call systemd-makefs on such devices. This was never implemented upstream but patched into Nixpkgs’s systemd. Removing this allows us to drop a custom systemd patch improving systemd maintainability and update speed.

linux_hardened kernel has been removed due to a lack of maintenance.

services.tandoor-recipes now uses a sub-directory for media files by default starting with 26.05. Existing setups should move media files out of the data directory and adjust services.tandoor-recipes.extraConfig.MEDIA_ROOT accordingly. See Migrating media files for pre 26.05 installations.

linux-rt kernel has been removed due to a lack of maintenance.

rustic was upgraded to 0.11.x, which contains breaking changes to command-line parameters and configuration file.

The packages iw and wirelesstools (iwconfig, iwlist, etc.) are no longer installed implicitly if wireless networking has been enabled.

The fileSystems.<name>.fsType option no longer has a default value and must be specified by the user. The value "auto" still works as before, though its use is generally discouraged.

services.uptime has been removed because the package it relies on does not exist anymore in nixpkgs.

services.mattermost now defaults to version 11, which has dropped support for MySQL in favor of Postgres. As a result, all support for MySQL has been removed from the module. See the migration steps if you were not running Postgres. Note that version 11 also restricts the user limit to 250 by default; see the pkgs.mattermost removeUserLimit and removeFreeBadge options combined with services.mattermost.package to change this behavior. For example:

post-resume.target has been removed. See systemd.special(7) about sleep.target for instructions on ordering a process after resume with ExecStop=.

services.vsftpd no longer automatically configures a PAM module. This means configurations using services.vsftpd.localUsers will no longer work unless services.vsftpd.enableVirtualUsers and services.vsftpd.userDbPath are also configured. The old behaviour can be restored by setting security.pam.services.vsftpd.enable = true, although this only ever worked by accident and may not be secure.

services.kubernetes.addons.dns.coredns has been renamed to services.kubernetes.addons.dns.corednsImage and now expects a package instead of attrs. Now, by default, nixpkgs.coredns in conjunction with dockerTools.buildImage is used, instead of pulling the upstream container image from Docker Hub. If you want the old behavior, you can set:

services.stalwart-mail has been renamed to services.stalwart to align with upstream re-brand as an e-mail and collaboration server. Other notable breaking changes to module:

services.eintopf has been renamed to services.lauti to align with upstream re-brand as a community online calendar.

services.oauth2-proxy.clientSecret and services.oauth2-proxy.cookie.secret have been replaced with services.oauth2-proxy.clientSecretFile and services.oauth2-proxy.cookie.secretFile respectively. This was done to ensure secrets don’t get made world-readable.

services.grafana.settings.security.secret_key doesn’t have a default value anymore. Please generate your own key or hard-code the old one (“SW2YcwTIb9zpOOhoPsMm”) explicitly. See the upstream docs and the instructions on how to rotate for further information.

Please do note that there’s no official way to rotate. On a single-node instance with the database and the secret-key being on the same filesystem with the same permissions for Grafana only to read, it is most likely OK to keep using the old key.

If you need to rotate, a 3rd-party tool, grafana-secretkey-rotation-tool is a tested option. When using a secret for this value, make sure to use Grafana’s variable expansion to inject secrets.

services.promtail has been removed, as promtail reached its end of life. Consider migrating to services.alloy.enable, or, if you are looking for something light-weight, services.fluent-bit.enable. See https://grafana.com/docs/alloy/latest/set-up/migrate/ or https://docs.fluentbit.io/manual/data-pipeline/outputs/loki.

Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.

services.immich no longer supports pgvecto.rs since the package has been removed from nixpkgs. As a result, options services.immich.database.enableVectors and services.immich.database.enableVectorchord have been removed, and VectorChord is now always used. If you have not completed the migration yet, ensure you completely remove the extension from your database before upgrading by following the migration guide.

services.cgit before always had the git-http-backend and its “export all” setting enabled, which sidestepped any access control configured in cgit’s settings. Now you have to make a decision and either enable or disable opt-services.cgit.<name>.gitHttpBackend.checkExportOkFiles (or disable the git-http-backend).

rocmPackages_6 has been removed. rocmPackages has been updated to ROCm 7.x. Out of tree packages may rely on obsolete hipblas APIs or compile time constant warp size and need to be updated.

mysql80 has been removed. Please update to mysql84 or mariadb. See the upgrade guide for more information.

services.prometheus.exporters.rspamd has been removed. It relied on the Rspamd /stat endpoint via the JSON exporter. You can use the Rspamd /metrics endpoint directly instead.

The Bash implementation of the nixos-rebuild program is removed. All switchable systems now use the Python rewrite. Any prior usage of system.rebuild.enableNg must now be removed. If you have any outstanding issues with the new implementation, please open an issue on GitHub.

services.desktopManager.gnome no longer installs the Geary e-mail client since it is not part of the GNOME core applications list. Geary’s position in the default favorite apps section has been replaced by GNOME Text Editor. To keep it installed, add programs.geary.enable = true; to your configuration.

walker has been updated to 2.0.0+, which is a complete rewrite in rust.

It now requires a running elephant application launcher backend service, which can be enabled using the new services.elephant.enable.

The way keybinds and actions are handled have been completely revamped. Please refer to the default config.

services.portunus has been upgraded to 2.2.0, which includes a bug fix that may cause existing databases to be rejected if user accounts are configured with malformed email addresses. Please refer to the upstream release announcement for details and instructions on how to fix problematic database entries.

Support for reiserfs in nixpkgs has been removed, following the removal in Linux 6.13.

services.tor no longer bind mounts Unix sockets of onion services into its chroot because it was not reliable. Users should do it themselves using either JoinsNamespaceOf= and Unix sockets in /tmp or BindPaths= from a persistent parent directory of each Unix socket. See https://github.com/NixOS/nixpkgs/issues/481673.

support for ecryptfs in nixpkgs has been removed.

services.xserver.cmt has been removed as the xf86-input-cmt package was broken and unmaintained upstream.

programs.light was removed from nixpkgs due to the corresponding package being unmaintained upstream. brightnessctl and hardware.acpilight offer replacements.

ceph has been upgraded to v20. See the Ceph “tentacle” release notes for details and recommended upgrade procedure. Note that upgrades of server-side components are one-way, and downgrading e.g. an OSD from Tentacle to Squid is not just not supported but is known to break.

services.unifi.jrePackage now defaults to jdk25_headless instead of jdk17_headless, in order to be compatible with new versions of unifi.

The networking.wireless module has been security hardened by default: the wpa_supplicant daemon now runs under an unprivileged user with restricted access to the system.

As part of these changes, /etc/wpa_supplicant.conf has been deprecated: the NixOS-generated configuration file is now linked to /etc/wpa_supplicant/nixos.conf and /etc/wpa_supplicant/imperative.conf has been added for imperatively configuring wpa_supplicant or when using allowAuxiliaryImperativeNetworks.

If client certificates, keys or other files are needed, these should be stored under /etc/wpa_supplicant and owned by wpa_supplicant to ensure the daemon can read them.

Similarly, the ctrl_interface directory set in wpa_supplicant’s conf must be writeable by the wpa_supplicant user so that the wpa_supplicant daemon can start successfully. If you were changing ctrl_interface in extraConfig or in /etc/wpa_supplicant/imperative.conf, please remove that line.

Also, the networking.wireless.userControlled.group option has been removed since there is now a dedicated wpa_supplicant group to control the daemon, and networking.wireless.userControlled.enable has been renamed to networking.wireless.userControlled.

No functionality should have been impacted by these changes (including controlling via wpa_cli, integration with NetworkManager or connman), but if you find any problems, please open an issue on GitHub. If necessary, the security hardening can be reverted with networking.wireless.enableHardening.

Note for NetworkManager users: before these changes NetworkManager used to spawn its own wpa_supplicant daemon, but now it relies on networking.wireless. So, if you had networking.wireless.enable = false in your configuration, you should remove that line.

Some implementation details of the NixOS network-interfaces module have been changed:

In the PowerDNS Recursor module, following the deprecation period started with NixOS 25.05, the option services.pdns-recursor.old-settings has been removed and services.pdns-recursor.yaml-settings consequently renamed to services.pdns-recursor.settings.

services.angrr now uses TOML for configuration. Define policies with services.angrr.settings (generate TOML file) or point to a file using services.angrr.configFile. The legacy options services.angrr.period, services.angrr.ownedOnly, and services.angrr.removeRoot have been removed. See man 5 angrr and the description of services.angrr.settings options for examples and details.

services.homepage-dashboard.environmentFile has been renamed to services.homepage-dashboard.environmentFiles, and now expects a list of strings.

services.pingvin-share has been removed as the pingvin-share.backend package was broken and the project was archived upstream.

services.jellyseerr has been renamed to services.seerr following the upstream changes. Notable breaking changes:

services.vikunja has been updated to Vikunja v1.0.0, which introduces multiple breaking changes. Notable breaking changes:

services.xtreemfs has been removed as the xtreemfs package was broken and unmaintained upstream.

opengfw package and services.opengfw module have been removed as the upstream GitHub repository and website have been shut down.

services.esphome no longer uses DynamicUser. The service now runs as a static esphome system user. systemd handles the migration from /var/lib/private/esphome automatically, but users with impermanence setups should ensure /var/lib/esphome is persisted.

programs.pqos-wrapper module has been deleted as the corresponding package has been dropped from nixpkgs.

programs.benchexec.enable = true no longer sets programs.pqos-wrapper.enable = true as the corresponding module has been deleted.

Reloading or restarting systemd units from the NixOS activation script is deprecated, and will be removed in NixOS 26.11. This deprecation is part of a bigger effort to deprecate activation scripts altogether, which will take place over several releases. There are no in-tree usages of the now-deprecated reload/restart functionality.

Switch inhibitors were introduced, which add a pre-switch check that compares a list of strings between the previous and the new generation, and refuses to switch into the new generation when there is a difference between the two lists. This allows avoiding switching into a system when for instance the systemd version changed by adding config.systemd.package.version to the switch inhibitors for your system. You can still forcefully switch into any generation by setting NIXOS_NO_CHECK=1.

switch-to-configuration now reloads a service instead of restarting it when the only change to its unit is ExecReload=, and takes no action when ExecReload= is removed. Previously both cases triggered a restart.

hardware.nvidia.branch was added to select the NVIDIA driver branch; setting hardware.nvidia.package overrides this.

The NixOS NVIDIA module wiring has been updated to match the new nvidia-x11 output layout.

nixos/nvidia now uses EGL external platform ICD libraries built from source (egl-gbm, egl-wayland, egl-wayland2, egl-x11) instead of relying on vendor-provided binaries for these components.

hardware.nvidia.moduleParams was added to configure NVIDIA kernel module parameters declaratively. These parameters are now written to modprobe configuration instead of being passed through global kernel command-line parameters.

hardware.xpadneo now supports configuring kernel module parameters via a freeform settings option, with convenience options for rumble attenuation and controller quirks.

security.acme now defaults to a dynamic renewal duration, if security.acme.defaults.validMinDays remains unset. This accommodates certificates with different ACME profile:

The module for the Dovecot IMAP server, services.dovecot2, now uses RFC-42-style settings, exposing a structured interface to write the configuration file.

Also see the list of available settings for Dovecot 2.3 or 2.4.

fonts.fontconfig.useEmbeddedBitmaps is now set to true by default.

services.frp now supports multiple instances through services.frp.instances to make it possible to run multiple frp clients or servers at the same time.

services.resolved module was converted to RFC42-style settings. The moved options have also been renamed to match the upstream names. Aliases mean current configs will continue to function, but users should move to the new options as convenient.

systemd.sleep.extraConfig was replaced by RFC 0042-compliant systemd.sleep.settings.Sleep, which is used to generate the sleep.conf configuration file. See sleep.conf.d(5) for available options.

Support for Bluetooth audio based on bluez-alsa has been added to the hardware.alsa module. It can be enabled with the new enableBluetooth option.

services.atuin now has an environmentFile option to safely allow configuring secrets, such as an ATUIN_DB_URI containing a Postgres password.

systemd.network.* has been updated to support all configuration options from upstream networkd version 259.

networking.resolvconf.enable now defaults to true unconditionally instead of !(config.environment.etc ? "resolv.conf"). If you set environment.etc."resolv.conf" yourself, then you should also set networking.resolvconf.enable = false.

The services.drupal module has a few improvements aimed at making it better for installing custom Drupal instances, namely a new webRoot option for identifying custom webroots in source code, a new configRoot option for identifying and synchronizing config yamls onto NixOS, and some new settings for managing variable content and filepaths.

services.openssh now supports generating host SSH keys by setting services.openssh.generateHostKeys = true while leaving services.openssh.enable disabled. This is particularly useful for systems that have no need of an SSH daemon but want SSH host keys for other purposes such as using agenix or sops-nix.

services.openssh.enableRecommendedAlgorithms has been added to allow users to opt out of NixOS’s curated set of recommended algorithms. This set to true by default, and thus is not a breaking change. Users may want to set this to false if they prefer upstream’s default algorithms. See https://github.com/NixOS/nixpkgs/pull/471330.

services.openssh.banner has been removed. Use services.openssh.settings.Banner instead.

IPVLAN interfaces can now be configured through the networking.ipvlans option in the networking module.

services.caddy now supports setting services.caddy.httpPort and services.caddy.httpsPort and opening them in the firewall via services.caddy.openFirewall.

The latest available version of Nextcloud is v33 (available as pkgs.nextcloud33). The installation logic is as follows:

InvoicePlane with the Caddy webserver (services.invoiceplane.webserver = "caddy") now sets up sites with Caddy’s automatic HTTPS instead of HTTP-only. To keep the old behavior for a site example.com, set services.caddy.virtualHosts."example.com".hostName = "http://example.com". If you set custom Caddy options for a InvoicePlane site, migrate these options by removing http:// from services.caddy.virtualHosts."http://example.com".

services.slurm now supports slurmrestd usage through the services.slurm.rest.enable NixOS options.

The networking.firewall.logRefusedConnections option now defaults to false. Logging of refused or dropped incoming connections can generate a very high volume of kernel log messages on internet-facing systems, causing the kernel ring buffer (dmesg) to rotate quickly and potentially discard more relevant diagnostic information.

The services.calibre-web systemd service has been hardened with additional sandboxing restrictions.

services.kanidm options for server, client and unix were moved under dedicated namespaces. For each component enableComponent and componentSettings are now component.enable and component.settings. The unix module now supports using SSH keys from Kanidm via services.kanidm.unix.sshIntegration = true.

services.radicle now supports importing the private key and passphrase as systemd creds.

Added nixos-init, a Rust-based bashless initialization system for systemd initrd.

COSMIC DE has been updated to the beta version, bringing it closer to its first stable release. This includes updates to its core components, applications, and overall stability.

FirewallD support has been added. It can be configured both as a standalone service (through services.firewalld), and as a backend to the existing networking.firewall options.

GNOME has been updated to version 49.

Refer to the GNOME release notes for more details.

networking.firewall now has a backend option for choosing which backend to use.

nixos-rebuild-ng, a full rewrite of nixos-rebuild in Python, is enabled by default from this release. You can disable it by setting system.rebuild.enableNg to false in your configuration if you need, but please report any issues. It is expected that the next major version of NixOS (26.05) will remove the system.rebuild.enableNg option.

rEFInd, a graphical boot manager for UEFI systems, can now be used through boot.loader.refind.enable.

Secure boot support can now be enabled for the Limine bootloader through boot.loader.limine.secureBoot.enable. Bootloader install script signs the bootloader, then kernels are hashed during system rebuild and written to a config. This allows Limine to boot only the kernels installed through NixOS system.

Syncthing has been updated to version 2.0.0.

The default PostgreSQL version for new NixOS installations (i.e. with system.stateVersion >= 25.11) is v17.

The NetworkManager module does not ship with a default set of VPN plugins anymore. All required VPN plugins must now be explicitly configured in networking.networkmanager.plugins.

The Qt 5-based versions of KDE Gear, Plasma, Maui and Deepin have been removed. Users are advised to migrate to Plasma 6 and Gear 25.08, available under kdePackages.

Added nixos-init, a Rust-based bashless initialization system for systemd initrd. This allows building NixOS systems without any interpreter. Enable via system.nixos-init.enable = true;.

angrr, a service that automatically cleans up old auto GC roots. Available as services.angrr.

Auto-scrub support for Bcachefs filesystems can now be enabled through services.bcachefs.autoScrub.enable to periodically check for data corruption. If there’s a correct copy available, it will automatically repair corrupted blocks.

Beszel, a lightweight server monitoring hub with historical data, docker stats, and alerts. Available as services.beszel.agent and services.beszel.hub.

boot.kernel.sysfs, a new way to set sysfs attributes.

Broadcast Box, a WebRTC broadcast server. Available as services.broadcast-box.

Drivers and utilities for Tenstorrent have been added. Available as hardware.tenstorrent.

byedpi, a DPI bypass service. Available as services.byedpi.

Chrysalis, a graphical configurator for Kaleidoscope-powered keyboards. Available as programs.chrysalis.

Chhoto URL, a simple, blazingly fast, selfhosted URL shortener with no unnecessary features, written in Rust. Available as services.chhoto-url.

conman, a serial console management program. Available as services.conman.

Corteza, a low-code platform. Available as services.corteza.

crowdsec, a free, open-source and collaborative IPS. Available as services.crowdsec.

crowdsec-firewall-bouncer, the CrowdSec Remediation Component for fetching new and old decisions from a CrowdSec API and adding them to a blocklist used by supported firewalls. Available as services.crowdsec-firewall-bouncer.

docuseal, a DocuSign alternative. Create, fill, and sign digital documents. Available as services.docuseal.

Draupnir, a Matrix moderation bot. Available as services.draupnir.

dwl, a compact, hackable compositor for Wayland based on wlroots. Available as programs.dwl.

ente, a service that provides a fully open source, end-to-end encrypted platform for photos and videos. Available as services.ente.api and services.ente.web.

ErsatzTV, a personal IPTV server. Available as services.ersatztv.

Fediwall, a web application for live displaying toots from mastodon, inspired by mastowall. Available as services.fediwall.

FileBrowser, a web application for managing and sharing files. Available as services.filebrowser.

FirewallD, a firewall daemon with D-Bus interface providing a dynamic firewall. Available as services.firewalld and a networking.firewall.backend.

fw-fanctrl, a simple systemd service to better control Framework Laptop’s fan(s). Available as hardware.fw-fanctrl.

go-httpbin, a reasonably complete and well-tested golang port of httpbin, with zero dependencies outside the go stdlib. Available as services.go-httpbin.

gtklock, a GTK-based lockscreen for Wayland. Available as programs.gtklock.

Homebridge, a lightweight Node.js server you can run on your home network that emulates the iOS HomeKit API. Available as services.homebridge.

IfState, manage host interface settings in a declarative manner. Available as networking.ifstate and boot.initrd.network.ifstate.

KMinion, feature-rich Prometheus exporter for Apache Kafka. Available as services.prometheus.exporters.kafka.

LACT, a GPU monitoring and configuration tool, can now be enabled through services.lact.enable. Note that for LACT to work properly on AMD GPU systems, you need to enable hardware.amdgpu.overdrive.enable.

lemurs, a customizable TUI display/login manager. Available as services.displayManager.lemurs.

LibreTranslate, a free and open source machine translation API. Available as services.libretranslate.

Linkwarden a self-hosted collaborative bookmark manager to collect, read, annotate, and fully preserve what matters, all in one place. Available as services.linkwarden.

Linyaps, a cross-distribution package manager with sandboxed apps and shared runtime. Available as services.linyaps.

llama-swap, a light weight transparent proxy server that provides automatic model swapping to llama.cpp’s server (or any server with an OpenAI compatible endpoint). Available as services.llama-swap.enable.

local-content-share, a simple web-app for storing/sharing text snippets and files in your local network. Available as services.local-content-share.

LubeLogger, a vehicle maintenance and fuel mileage tracker. Available as services.lubelogger.

mautrix-discord, a Matrix-Discord puppeting/relay bridge. Available as services.mautrix-discord.

Neat IP Address Planner (NIPAP), a sleek, intuitive and powerful IP address management system. Available as services.nipap.enable.

nebula-lighthouse-service, a public Nebula VPN lighthouse service. Available as services.nebula-lighthouse-service.

Newt, a fully user space WireGuard tunnel client and TCP/UDP proxy, designed to securely expose private resources controlled by Pangolin. Available as services.newt.

nixbit, a GUI application for updating your NixOS system from a Nix Flakes Git repository. Available as programs.nixbit.

nix-store-veritysetup, a systemd generator to unlock the Nix Store as a dm-verity protected block device. Available as boot.initrd.nix-store-veritysetup.

nvme-rs, NVMe monitoring services.nvme-rs.

Overseerr, a request management and media discovery tool for the Plex ecosystem. Available as services.overseerr.

PairDrop, a peer-to-peer file transfer web app. Available as services.pairdrop.

paisa, a personal finance tracker and dashboard. Available as services.paisa.

Pangolin, a tunneled reverse proxy server with access control. Available as services.pangolin.

Pi-hole, a DNS sinkhole for advertisements based on Dnsmasq. Available as services.pihole-ftl, and services.pihole-web for the web GUI and API.

pmount, a tool that allows normal users to mount removable devices without requiring root privileges Available as programs.pmount.

postfix-tlspol, a MTA-STS and DANE resolver and TLS policy server for Postfix. Available as services.postfix-tlspol.

Prometheus Tailscale Exporter, a Prometheus exporter for Tailscale Tailnet metrics.

Prometheus Storagebox Exporter, a Prometheus exporter for Hetzner storage boxes.

qBittorrent, a bittorrent client programmed in C++ / Qt that uses libtorrent by Arvid Norberg. Available as services.qbittorrent.

radicle-ci-broker, a tool for running CI for repositories in the local Radicle node. Available as services.radicle.ci.broker.enable.

radicle-native-ci, an adapter for the Radicle CI broker, for performing CI runs locally. Available as services.radicle.ci.adapters.native.

rauc (the Robust Auto-Update Controller), a daemon that allows reliable and secure software updates in embedded Linux systems. Available as services.rauc.

ringboard, a fast, efficient, and composable clipboard manager for Linux. Available for x11 as services.ringboard and for Wayland as services.ringboard.

rsync, an open source utility that provides fast incremental file transfer. Available as services.rsync.

Sharkey, a Sharkish microblogging platform. Available as services.sharkey.

SillyTavern, an LLM Frontend for Power Users. Available as services.sillytavern.

SuiteNumérique Docs, a collaborative note taking, wiki and documentation web platform and alternative to Notion or Outline. Available as services.lasuite-docs.

SuiteNumérique Meet, an open source alternative to Google Meet and Zoom powered by LiveKit. It features HD video calls, screen sharing, and chat features. Available as services.lasuite-meet.

Speedify, a proprietary VPN which allows combining multiple internet connections (Wi-Fi, 4G, 5G, Ethernet, Starlink, Satellite, and more) to improve the stability, speed, and security of online experiences. Available as services.speedify.

Spoolman, a inventory management system for Filament spools. Available as services.spoolman.

Sshwifty, a Telnet and SSH client for your browser. Available as services.sshwifty.

Szurubooru, an image board engine inspired by services such as Danbooru, dedicated for small and medium communities. Available as services.szurubooru.

Temporal, a durable execution platform that enables developers to build scalable applications without sacrificing productivity or reliability. Available as services.temporal.

Timekpr-nExT, a time managing application that helps optimizing time spent at computer for your subordinates, children or even for yourself. Available as services.timekpr.enable.

tlsrpt-reporter, an application suite to generate and deliver TLSRPT reports. Available as services.tlsrpt.

tsidp, a simple OIDC / OAuth Identity Provider (IdP) server for your tailnet. Available as services.tsidp.

TuneD, a system tuning service for Linux. Available as services.tuned.

tuwunel, a federated chat server implementing the Matrix protocol, forked from Conduwuit. Available as services.matrix-tuwunel.

umami, a simple, fast, privacy-focused alternative to Google Analytics. Available as services.umami.

wayvnc, a VNC server for wlroots based Wayland compositors. Available as programs.wayvnc.

XPPen, an official closed-source driver for XP Pen tablets. Available as programs.xppen.

Warpgate, an SSH, HTTPS, MySQL and Postgres bastion. Available as services.warpgate. Note that you need to run warpgate recover-access to recover builtin admin account, as the initialisation script uses a throwaway value to initialise its database.

yubikey-manager, a tool for configuring YubiKey devices. Available as programs.yubikey-manager.

rumno, a visual pop-up notification manager. Available as services.rumno.

boot.enableContainers is only turned on when a declarative NixOS container is defined in containers. If you use the nixos-container tool for imperative container management, set boot.enableContainers = true; explicitly.

Configurations with boot.initrd.systemd.enable && !boot.initrd.enable will have their init script at $toplevel/init instead of $toplevel/prepare-root. This is because it does not make sense for systemd stage 1 to affect the init script when stage 1 is entirely disabled (e.g. containers).

command-not-found package is now disabled by default; it works only for nix-channels based systems, and requires setup for it to work.

hardware.amdgpu.amdvlk and the amdvlk package have been removed, as they have been deprecated by AMD. These have been replaced with the RADV driver from Mesa, which is enabled by default.

firezone has changed how the Everyone group behaves. Service Accounts are no longer considered part of Everyone.

i18n.inputMethod.fcitx5.plasma6Support has been removed because qt6 is the only one used for fcitx5-configtool now.

Linux 5.4 and all its variants have been removed since mainline will reach its end of life within the support-span of 25.11.

miniflux no longer uses the hstore PostgreSQL extension. Having the extension would prevent Miniflux from starting. In case you are managing your miniflux PostgreSQL database externally, disable the extension with DROP EXTENSION IF EXISTS hstore;.

netbox-manage script created by the netbox module no longer uses sudo -u netbox internally. It can be run as root and will change its user to netbox using runuser.

NixOS display manager modules now strictly use tty1, where many of them previously used tty7. Options to configure display managers’ VT have been dropped. A configuration with a display manager enabled will not start getty@tty1.service, even if the system is forced to boot into multi-user.target instead of graphical.target.

programs.cardboard was removed due to the package having been broken since at least November 2024.

programs.goldwarden has been removed, due to the software not working with newer versions of the Bitwarden and Vaultwarden servers, as well as it being abandoned upstream.

programs.skim.fuzzyCompletions has been removed in favor of adding the completions to the package itself.

Prosody has been updated to major release 13 which removed some obsoleted modules and brought a couple of major and breaking changes:

programs.river has been renamed to programs.river-classic following an upstream decision.

services.chatgpt-retrieval-plugin was removed due to the package having been broken since at least November 2024.

services.dwm-status.extraConfig was replaced by RFC0042-compliant services.dwm-status.settings, which is used to generate the config file. services.dwm-status.order is now moved to services.dwm-status.settings.order, as it’s a part of the config file.

services.forgejo.dump.age now defaults to 4w, which deletes dumps older than 4 weeks. This new behaviour could result in older backups being deleted.

services.gateone has been removed as the package was removed such that it does not work.

services.journald.gateway.user and services.journald.gateway.system now defaults to false. This new behaviour matches the default behaviour of the systemd-journal-gatewayd service itself.

services.nextcloud.notify_push.enable now installs the notify_push app. Therefore the appstore is now disabled when using notify_push. See services.nextcloud.appstoreEnable.

services.nixseparatedebuginfod.enable = true; has been replaced by services.nixseparatedebuginfod2.enable = true. If you only use the official binary cache https://cache.nixos.org then no further configuration should be needed. If you have other https substituters, you can add them to services.nixseparatedebuginfod2.substituters. SSH substituters are not supported by nixseparatedebuginfod2. Consider running nixseparatedebuginfod2 on the substituter instead, and pointing to it with the new option environment.debuginfodServers.

services.parsoid and the nodePackages.parsoid package have been removed, as the JavaScript-based version this module uses is not compatible with modern MediaWiki versions.

services.private-gpt has been removed by lack of maintenance upstream.

services.quorum has been removed as the quorum package was broken and abandoned upstream.

services.seafile has been removed, as it is unmaintained and outdated. See the manual for details and next steps.

services.tor.torsocks.enable no longer defaults to true if Tor and Tor client functionality is enabled.

The boot.readOnlyNixStore has been removed. Control over bind mount options on /nix/store is now offered by the boot.nixStoreMountOpts option.

The dovecot systemd service was renamed from dovecot2 to dovecot. The former is now just an alias. Update any overrides on the systemd unit to the new name.

The NIXOS_EXTRA_MODULE_PATH variable from configuration evaluation has been deprecated. We recommend a workflow where you update the expression files instead, but if you wish to continue to use this variable, you may do so with a module like:

{
  imports = [
    (builtins.getEnv "NIXOS_EXTRA_MODULE_PATH")
  ];
}

This has the benefit that your configuration hints at the non-standard workflow.

The file-roller module has been removed due to not being required for function, file roller itself has also been removed from the services.desktopManager.gnome module as it’s not part of GNOME core applications.

The Perl implementation of the switch-to-configuration program is removed. All switchable systems now use the Rust rewrite. Any prior usage of system.switch.enableNg must now be removed. If you have any outstanding issues with the new implementation, please open an issue on GitHub.

The Pocket ID module (services.pocket-id) and package (pocket-id) has been updated to 1.0.0. Some environment variables have been changed or removed, see the migration guide.

The Postfix module has been updated and likely requires configuration changes:

The services.meilisearch module now always defaults to the latest version of meilisearch, as the previous meilisearch_1_11 package was removed. This is only an issue if you were using the old version.

The services.mysql module now restarts the database on-abnormal, which means that it now will be restarted in certain situations, it wasn’t before. For example an OOM-kill.

The services.nginx.sso module has switched to generating its configuration file in /run. You should manually delete /var/lib/nginx-sso/config.yaml to avoid storing secret values to disk.

The services.postgresql module now sets up a systemd unit postgresql.target. Depending on postgresql.target guarantees that postgres is in read-write mode and initial/ensure scripts were executed. Depending on postgresql.service only guarantees a read-only connection.

The services.polipo module has been removed as polipo is unmaintained and archived upstream.

The services.postfixadmin module has been removed due to a lack of active maintainers.

The services.siproxd module has been removed as siproxd is unmaintained and broken with libosip 5.x.

The services.snapserver module has been migrated to use the settings option and render a configuration file instead of passing every option over the command line.

The services.sourcehut module and corresponding sourcehut packages were removed due to being broken and unmaintained.

The services.traccar.settings attribute has been reworked. Instead of the previous flat attribute set the new implementation uses nested attribute sets. You need to update you configuration manually. For instance, services.traccar.settings.loggerConsole becomes services.traccar.settings.logger.console.

The services.tt-rss module and package have been removed as upstream development ceased on 2025-11-01, and the source is no longer available officially.

The systemd target kbrequest.target is now unset by default, instead of being forcibly symlinked to rescue.target. In case you were relying on this behavior (Alt + ArrowUp on the tty causing the current target to be changed to rescue.target), you can restore it by setting systemd.targets.rescue.aliases = [ "kbrequest.target" ]; in your configuration.

The wstunnel module was converted to RFC42-style settings, you will need to update your NixOS config if you make use of this module.

services.xserver.windowManager.yeahwm was removed due to the package being broken and unmaintained upstream.

The zookeeper project changed their logging tool to logback, therefore services.zookeeper.logging option has been updated to expect a logback compatible string.

virtualisation.lxd has been removed due to lack of Nixpkgs maintenance. Users can migrate to virtualisation.incus, a fork of LXD, as a replacement. See Incus migration documentation for migration information.

virtualisation.libvirtd now uses OVMF images shipped with QEMU for UEFI machines. virtualisation.libvirtd.qemu.ovmf has been removed.

vmalert now supports multiple instances with the option services.vmalert.instances."".enable

virtualisation.waydroid.package now defaults to waydroid-nftables on systems with nftables enabled.

services.victorialogs.package now defaults to victorialogs, as victoriametrics no longer contains the VictoriaLogs binaries.

A new option boot.isNspawnContainer has been added. This option will be used to guard nspawn-specific configuration in NixOS since boot.isContainer is also used for different container-runtimes such as LXC.

amdgpu kernel driver overdrive mode can now be enabled by setting hardware.amdgpu.overdrive.enable and customized through hardware.amdgpu.overdrive.ppfeaturemask. This allows for fine-grained control over the GPU’s performance and maybe required by overclocking software like Corectrl and Lact. These new options replace old options such as programs.corectrl.gpuOverclock.enable and programs.tuxclocker.enableAMD.

bcachefs file systems will now use the out-of-tree module for supported kernels. The in-tree module has been removed, and users will need to switch to kernels that support the out-of-tree module.

boot.plymouth now has a package option to specify the package used in the module.

Docker now defaults to 28.x, because version 27.x stopped receiving security updates and bug fixes after May 2, 2025.

Due to deprecation of gnome-session X11 support, services.desktopManager.pantheon now defaults to pantheon-wayland session. The X11 session has been removed, see this issue for details.

libvirt now supports using nftables backend.

linux_libre & linux_latest_libre have been removed due to a lack of maintenance.

Immich now has support for VectorChord when using the PostgreSQL configuration provided by services.immich.database.enable, which replaces pgvecto-rs. VectorChord support can be toggled with the option services.immich.database.enableVectorChord. Additionally, pgvecto-rs support is now disabled from NixOS 25.11 onwards using the option services.immich.database.enableVectors. This option will be removed fully in the future once Immich drops support for pgvecto-rs fully. See Immich migration instructions.

It is now possible to configure the default source address using the new options networking.defaultGateway.source, networking.defaultGateway6.source.

mate-wayland-session 1.28.4 is now using the default wayfire decorator instead of firedecor, thus services.xserver.desktopManager.mate.enableWaylandSession is no longer shipping firedecor. If you are experiencing broken window decorations after upgrade, backup and remove ~/.config/mate/wayfire.ini and re-login.

networking.wireless.networks.<name> now has an option to specify SSID, hence allowing duplicated SSID setup. The BSSID option is added alongside with this.

Options under networking.getaddrinfo are now allowed to declaratively configure address selection and sorting behavior of getaddrinfo in dual-stack networks.

Potential race conditions in the network setup when using networking.interfaces have been fixed by disabling duplicate address detection (DAD) for statically configured IPv6 addresses.

prosody gained a config check option named services.prosody.checkConfig which runs prosodyctl check config and is turned on by default.

Revamp of the ACME certificate acquisition and renewal process to help scale systems with lots (100+) of certificates.

Units and targets have been reshaped to better support more specific dependency propagation and avoid superfluously triggering unchanged units:

If a service requires a syntactically valid certificate to start it should now depend on the acme-{certname}.service unit.

We now always generate initial self-signed certificates as this drastically simplifies the dependency structure. As a result, the option security.acme.preliminarySelfsigned has been removed.

Instead of the previous acme-finished-{certname}.targets there are now acme-order-renew-{certname}.services that will be activated in a delayed fashion to ensure that bootstrapping with servers like nginx that take part in the acquisition/renewal process works smoothly. Dependencies on acme-finished units should move to acme-order-renew.

Note that system activation will complete before all certificates may have been renewed or acquired.

services.clamsmtp is unmaintained and was removed from Nixpkgs.

services.clickhouse has added the serverConfig and userConfig options. You may also use extraServerConfig and extraUserConfig to pass plain text XML.

services.dependency-track removed its configuration of the JVM heap size. This lets the JVM choose its maximum heap size automatically, which should work much better in practice for most users. For deployments on systems with little RAM, it may now be necessary to manually configure a maximum heap size using services.dependency-track.javaArgs.

services.dnscrypt-proxy2 was renamed to services.dnscrypt-proxy to match the package name. The systemd service is now also dnscrypt-proxy, but the old name is still provided as an alias for backwards compatibility.

services.dnscrypt-proxy gains a package option to specify dnscrypt-proxy package to use.

services.eris-server was removed from Nixpkgs due to a hostile upstream.

services.filesender and the package filesender have been removed because they depend on simplesamlphp.

services.gitea supports sending notifications with sendmail again. To do this, activate the parameter services.gitea.mailerUseSendmail and configure SMTP server.

services.gnome.gnome-keyring does not ship with an SSH agent anymore, as this is now handled by the gcr_4 package instead of gnome-keyring. A new module has been added to support this, under services.gnome.gcr-ssh-agent.enable (its default value has been set to services.gnome.gnome-keyring.enable to ensure a smooth transition). See the relevant upstream PR for more details.

services.grafana does no longer send usage statistics by default.

services.k3s now shares most of its code with services.rke2. The merge resulted in both modules providing more options, with services.rke2 receiving the most improvements. Existing configurations for either module should not be affected.

services.libvirtd.autoSnapshot has been added as a backup service for libvirt managed VMs.

services.limesurvey now supports nginx as reverse-proxy. Available as services.limesurvey.webserver.

services.mattermost has been updated to use the 10.11 ESR instead of 10.5. While this shouldn’t break anyone, we also now package Mattermost 11 as mattermostLatest. Note that Mattermost 11 drops support for MySQL. The Mattermost module will assertion fail if you try to use MySQL with Mattermost 11; support for using MySQL with Mattermost will fully be removed in NixOS 26.

services.matter-server now hosts a debug dashboard on the configured port. Open the port on the firewall with services.matter-server.openFirewall.

services.monero now includes the environmentFile option for adding secrets to the Monero daemon config.

services.nebula.networks.<name> will now store configuration files in /etc/nebula/<name>.yml and supports config reloading.

services.logind.extraConfig was converted to RFC42-style services.logind.settings.Login.

services.nginx.recommendedProxySettings now sets X-Forwarded-Server to the hostname of nginx instead of the original host.

services.netbird.server now uses dedicated packages split out due to relicensing of server components to AGPLv3 with version 0.53.0,

services.nextcloud.configureRedis now defaults to true in accordance with upstream recommendations to have caching for file locking. See the upstream doc for further details.

services.ntpd-rs now performs configuration validation.

services.opentelemetry-collector has a new option validateConfigFile option that checks the configuration file during build. It is enabled by default if the configuration file is in the Nix store.

services.restic.backups now includes a command option for passing a command to the –stdin-from-command flag.

services.pds has been renamed to services.bluesky-pds.

services.pfix-srsd now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the services.pfix-srsd.configurePostfix option.

services.postsrsd now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the services.postsrsd.configurePostfix option.

services.varnish.http_address has been superseded by services.varnish.listen which is now structured config for all of varnish’s -a variations.

services.xserver.desktopManager.deepin and associated packages have been removed due to being unmaintained. See issue #422090 for more details.

systemd.extraConfig and boot.initrd.systemd.extraConfig was converted to RFC42-style systemd.settings.Manager and boot.initrd.systemd.settings.Manager respectively.

The ksycoca cache in Plasma 6 will no longer be re-built when $XDG_CACHE_HOME is not set to $HOME/.cache.

The latest available version of Nextcloud is v32 (available as pkgs.nextcloud32). The installation logic is as follows:

The nettools package (ifconfig, arp, mii-tool, netstat, route) is not installed by default anymore. The suite is unmaintained and users should migrate to iproute2 and ethtool instead.

The new option networking.ipips has been added to create IP within IP kind of tunnels (including 4in6, ip6ip6 and ipip). With the existing networking.sits option (6in4), it is now possible to create all combinations of IPv4 and IPv6 encapsulation.

tpm2-totp can now be used to show a TOTP during boot using Plymouth. Available as boot.plymouth.tpm2-totp.

users.users.*.linger now defaults to null rather than false, meaning NixOS will not attempt to enable or disable lingering for that user account, instead allowing for imperative control over lingering using the loginctl commands. In practice, this is unlikely to make a difference for most people, as new users are created without lingering configured. There is a new, related option, users.manageLingering, which can be used to prevent NixOS attempting to manage lingering entirely.

NixOS now has initial support for the COSMIC DE which is currently at Alpha 7. COSMIC is a Rust-based Desktop Environment by System76, makers of Pop!_OS. You can use COSMIC by enabling the greeter (login manager) with services.displayManager.cosmic-greeter.enable, and the DE itself by enabling services.desktopManager.cosmic.enable. The support in NixOS/Nixpkgs is stable but still considered experimental because of the recent the addition. The COSMIC maintainers will be waiting for one more release of NixOS to determine if the experimental tag should be removed or not. Until then, please report any issues to the COSMIC DE tracker in Nixpkgs instead of upstream.

nixos-rebuild-ng, a full rewrite of nixos-rebuild in Python, is available for testing. You can enable it by setting system.rebuild.enableNg in your configuration (this will replace the old nixos-rebuild), or by adding nixos-rebuild-ng to your environment.systemPackages (in this case, it will live side-by-side with nixos-rebuild as nixos-rebuild-ng). It is expected that the next major version of NixOS (25.11) will enable system.rebuild.enableNg by default.

A nixos-rebuild build-image sub-command has been added. It allows users to build platform-specific (disk) images from their NixOS configurations. nixos-rebuild build-image works similar to the popular nix-community/nixos-generators project. See new section on image building in the NixOS manual. It is also available for nixos-rebuild-ng.

nixos-option has been rewritten to a Nix expression called by a simple bash script. This lowers our maintenance threshold, makes eval errors less verbose, adds support for flake-based configurations, descending into attrsOf and listOf submodule options, and --show-trace.

The global Mesa version can now be managed without a mass rebuild by setting hardware.graphics.package.

GNOME has been updated to version 48.

Refer to the GNOME release notes for more details.

channels.nixos.org now supports the Lockable HTTP Tarball Protocol. This allows using the channel nixexprs.tar as Nix Flake input, e.g.:

inputs.nixpkgs.url = "https://channels.nixos.org/nixos-25.05/nixexprs.tar.xz";

AmneziaVPN, a self-hostable open-source VPN client, is available in two variants:

Bazecor, the graphical configurator for Dygma Products. Available as programs.bazecor.

Bonsai, a general-purpose event mapper/state machine primarily used to create complex key shortcuts, and as part of the SXMO desktop environment. Available as services.bonsaid.

scanservjs, a web UI for SANE scanners. Available at services.scanservjs.

Kimai, a web-based multi-user time-tracking application. Available as services.kimai.

Kismet, a Wi-Fi, Bluetooth, and RF monitoring application supporting a wide range of hardware. Available as services.kismet.

vwifi, a Wi-Fi simulator daemon leveraging the mac80211_hwsim and vhost_vsock kernel modules for efficient simulation of multi-node Wi-Fi networks. Available as services.vwifi.

Oncall, a web-based calendar tool designed for scheduling and managing on-call shifts. Available as services.oncall.

Homer, a very simple static homepage for your server. Available as services.homer.

Ghidra, a software reverse engineering (SRE) suite of tools. Available as programs.ghidra.

Omnom, a webpage bookmarking and snapshotting service. Available as services.omnom.

Yggdrasil-Jumper, an independent project that aims to transparently reduce latency of a connection over Yggdrasil network, utilizing NAT traversal to automatically bypass intermediary nodes. Available as services.yggdrasil-jumper.

xpad-noone is the original upstream xpad driver from the Linux kernel with support for Xbox One controllers removed — especially useful for people who want to use an XBox One controller under the xone driver and an Xbox 360 controller under the xpad driver at the same time. Available as hardware.xpad-noone.

uMurmur, minimalistic Mumble server primarily targeted to run on embedded computers. Available as services.umurmur.

Zenoh, a pub/sub/query protocol with low overhead. The Zenoh router daemon is available as services.zenohd.

ytdl-sub, a tool that downloads media via yt-dlp and prepares it for your favorite media player, including Kodi, Jellyfin, Plex, Emby, and modern music players. Available as services.ytdl-sub.

MaryTTS, an open-source, multilingual text-to-speech synthesis system written in pure Java. Available as services.marytts.

Continuwuity, a federated chat server implementing the Matrix protocol, forked from Conduwuit. Available as services.matrix-continuwuity.

Reposilite, a lightweight and easy-to-use repository manager for Maven-based artifacts in the JVM ecosystem. Available as services.reposilite.

networking.modemmanager has been split out of networking.networkmanager. NetworkManager still enables ModemManager by default, but options exist now to run NetworkManager without ModemManager.

Routinator 3000, a full-featured RPKI Relying Party software package that runs as a service which periodically downloads and verifies RPKI data. Available as services.routinator.

doh-server, a high performance DNS over HTTPS server. Available as services.doh-server.

ncps, a Nix binary cache proxy service implemented in Go using go-nix. Available as services.ncps.

Readeck, a read-it later web-application. Available as services.readeck.

EasyTier, a decentralized VPN solution. Available as services.easytier.

Traccar, a modern GPS Tracking Platform. Available as services.traccar.

Memos, a privacy-first, lightweight note-taking solution that allows you to effortlessly capture and share your ideas. Available as services.memos.

Schroot, a lightweight virtualisation tool. Securely enter a chroot and run a command or login shell. Available as programs.schroot.

Firezone, an enterprise-ready zero-trust access platform built on WireGuard. This includes the server stack as services.firezone.server.enable, a TURN/STUN relay service as services.firezone.relay.enable, a gateway service as services.firezone.gateway.enable, a headless client as services.firezone.headless-client.enable and a GUI client as services.firezone.gui-client.enable.

crab-hole, a cross platform Pi-hole clone written in Rust using hickory-dns/trust-dns. Available as services.crab-hole.

agnos, a program that obtains TLS certificates from an ACME provider via the DNS-01 challenge without using third-party DNS provider APIs. Available as security.agnos.

zwave-js-ui, a full featured Z-Wave Control Panel and MQTT Gateway. Available as services.zwave-js-ui.

Pinchflat, a selfhosted YouTube media manager used to track channels and download videos on release. Available as services.pinchflat.

Amazon CloudWatch Agent, the official telemetry collector for AWS CloudWatch and AWS X-Ray. Available as services.amazon-cloudwatch-agent.

Fluent Bit, a fast Log, Metrics and Traces Processor and Forwarder. Available as services.fluent-bit.

Bat, a cat(1) clone with wings. Available as programs.bat.

Autotier, a passthrough FUSE filesystem. Available as services.autotierfs.

PostgREST, a standalone web server that turns your PostgreSQL database directly into a RESTful API. Available as services.postgrest.

postgres-websockets, a middleware that adds websockets capabilities on top of PostgreSQL’s asynchronous notifications using LISTEN and NOTIFY commands. Available as services.postgres-websockets.

µStreamer, a lightweight MJPEG-HTTP streamer. Available as services.ustreamer.

Whoogle Search, a self-hosted, ad-free, privacy-respecting metasearch engine. Available as services.whoogle-search.

autobrr, a modern download automation tool for torrents and usenets. Available as services.autobrr.

cross-seed, a tool to set-up fully automatic cross-seeding of torrents. Available as services.cross-seed.

Froide-Govplan, a web application government planer. Available as services.froide-govplan.

agorakit, an organization tool for citizens’ collectives. Available with services.agorakit.

vivid, a generator for LS_COLOR. Available as programs.vivid.

matrix-alertmanager, a bot to receive Alertmanager webhook events and forward them to chosen Matrix rooms. Available as services.matrix-alertmanager.

waagent, the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with services.waagent.

nfc-nci, an alternative NFC stack and PC/SC driver for the NXP PN54x chipset, commonly found in Lenovo systems as NXP1001 (NPC300). Available as hardware.nfc-nci.

grav, a modern flat-file CMS. Available with services.grav.

duckdns, free dynamic DNS. Available with services.duckdns.

Zoxide, a smarter cd command, inspired by z and autojump. Available as programs.zoxide.

victorialogs, log database from VictoriaMetrics. Available as services.victorialogs.

gokapi, Lightweight selfhosted Firefox Send alternative without public upload. AWS S3 supported. Available with services.gokapi.

nostr-rs-relay, This is a nostr relay, written in Rust. Available as services.nostr-rs-relay.

haven, is a high availability vault for events on nostr. Available as services.haven.

strfry, a relay for the nostr protocol. Available as services.strfry.

Prometheus Node Cert Exporter, a prometheus exporter to check for SSL cert expiry. Available as services.prometheus.exporters.node-cert.

Actual Budget, a local-first personal finance app. Available as services.actual.

immich-public-proxy, a proxy for sharing Immich albums without exposing the Immich API. Available as services.immich-public-proxy.

Zipline, a ShareX/file upload server that is easy to use, packed with features, and with an easy setup. Available as services.zipline.

GlitchTip, an open source Sentry API compatible error tracking platform. Available as services.glitchtip.

yarr, a small, web-based feed aggregator and RSS reader. Available as services.yarr.

OliveTin, gives safe and simple access to predefined shell commands from a web interface. Available as services.olivetin.

alertmanager-ntfy, forwards Prometheus Alertmanager notifications to ntfy.sh. Available as services.prometheus.alertmanager-ntfy.

Stash, an organizer for your adult videos/images, written in Go. Available as services.stash.

vsmartcard-vpcd, a virtual smart card driver. Available as services.vsmartcard-vpcd.

Fider, an open platform to collect and prioritize feedback. Available as services.fider.

PDS, Personal Data Server for bsky. Available as services.pds.

Anubis, a scraper defense software. Available as services.anubis.

synapse-auto-compressor, a rust-based matrix-synapse state compressor for postgresql. Available as services.synapse-auto-compressor.

mqtt-exporter, a Prometheus exporter for exposing messages from MQTT. Available as services.prometheus.exporters.mqtt.

pocket-id, an OIDC provider with passkeys support. Available as services.pocket-id.

nvidia-gpu, a Prometheus exporter that scrapes nvidia-smi for GPU metrics. Available as services.prometheus.exporters.nvidia-gpu.

Lavalink, a standalone audio sending node based on Lavaplayer and Koe. Available as services.lavalink.

OpenGamepadUI, an open source gamepad-native game launcher and overlay for Linux. Available as programs.opengamepadui.

InputPlumber, an open source input router and remapper daemon for Linux. Available as services.inputplumber.

dump1090-fa, a simple Mode S decoder for RTLSDR devices with a web interface. Available as services.dump1090-fa.

PowerStation, an open source TDP control and performance daemon with DBus interface for Linux. Available as services.powerstation.

g3proxy, an open source enterprise forward proxy from ByteDance, similar to Squid or tinyproxy. Available as services.g3proxy.

OpenCloud, an open-source, modern file-sync and sharing platform. It is a fork of oCIS, a ground-up rewrite of the well-known PHP-based NextCloud server. Available as services.opencloud.

echoip, a simple service for looking up your IP address. Available as services.echoip.

whoami, a tiny Go server that prints OS information and HTTP request to output. Available as services.whoami.

LiteLLM, a LLM Gateway to provide model access, fallbacks and spend tracking across 100+ LLMs. All in the OpenAI format. Available as services.litellm.

Buffyboard, a framebuffer on-screen keyboard. Available as services.buffyboard.

KanBoard, a project management tool that focuses on the Kanban methodology. Available as services.kanboard.

git-worktree-switcher, switch between git worktrees with speed. Available as programs.git-worktree-switcher.

GLPI-Agent, GLPI Agent. Available as services.glpiAgent.

pgBackRest, a reliable backup and restore solution for PostgreSQL. Available as services.pgbackrest.

Recyclarr a TRaSH Guides synchronizer for Sonarr and Radarr. Available as services.recyclarr.

Rebuilderd an independent verification of binary packages - Reproducible Builds. Available as services.rebuilderd.

Limine a modern, advanced, portable, multiprotocol bootloader and boot manager. Available as boot.loader.limine.

tee-supplicant, a userspace supplicant for OP-TEE OS. Available as services.tee-supplicant.

Orthanc a lightweight, RESTful DICOM server for healthcare and medical research. Available as services.orthanc.

Docling Serve running Docling as an API service. Available as services.docling-serve.

Pareto Security is an alternative to corporate compliance solutions for companies that care about security but know it doesn’t have to be invasive. Available as services.paretosecurity.

GNU Rush is a Restricted User Shell, designed for systems providing limited remote access to their resources. Available as programs.rush.

ipfs-cluster, Pinset orchestration for IPFS. Available as services.ipfs-cluster.

bitbox-bridge, a bridge software that connects BitBox hardware wallets to computers & web wallets like Rabby. Allows one to interact & transact with smart contracts, Web3 websites & financial services without storing private keys anywhere other than the hardware wallet. Available as services.bitbox-bridge.

GoDNS, a dynamic DNS client written in Go, which supports multiple DNS providers. Available as services.godns.

CookCLI Server, a web UI for cooklang recipes. Available as services.cook-cli.

Prometheus eBPF Exporter, Prometheus exporter for custom eBPF metrics. Available as services.prometheus.exporters.ebpf.

services.rippled has been removed, as rippled was broken and had not been updated since 2022.

services.rippleDataApi has been removed, as ripple-data-api was broken and had not been updated since 2022.

The nixos/modules/virtualisation/amazon-ec2-amis.nix file is not supported anymore since 24.05. It will throw and error starting 25.05 with instructions the following instructions: The canonical source for NixOS AMIs is the AWS API. Please see https://nixos.org/download/#nixos-amazon or https://nixos.github.io/amis/ for instructions.

The latest available version of Nextcloud is v31 (available as pkgs.nextcloud31). The installation logic is as follows:

services.cloudflare-dyndns.apiTokenFile now must be just your Cloudflare api token. Previously it was supposed to be a file of the form CLOUDFLARE_API_TOKEN=....

services.nextcloud.config.dbtype is unset by default, the previous default was sqlite. This was done because sqlite is not a reasonable default since it’s not recommended by upstream and thus doesn’t qualify as default.

PowerDNS Recursor has been updated to version 5.1.2, which comes with a new YAML configuration format (recursor.yml) and deprecates the previous format (recursor.conf). Accordingly, the NixOS option services.pdns-recursor.settings has been renamed to old-settings and will be provided for backward compatibility until the next NixOS release. Users are asked to migrate their settings to the new yaml-settings. option following this guide. Note that options other than services.pdns-recursor.settings are unaffacted by this change.

The virtualisation.hypervGuest.videoMode option has been removed. Standard tooling can now be used to configure display modes for Hyper-V VMs.

Nextcloud’s default FPM pool settings have been increased according to upstream recommendations. It’s advised to review the new defaults and description of services.nextcloud.poolSettings.

In users.users subuid allocation on systems with multiple users it could happen that some users’ allocated subuid ranges collided with others. Now these users get new subuid ranges assigned. When this happens, a warning is issued on the first activation. If the subuids were used (e.g. with rootless container managers like podman), please change the ownership of affected files accordingly.

The services.locate module does no longer support findutil’s locate due to its inferior performance compared to mlocate and plocate. The new default is plocate. As the service.locate.localuser option only applied when using findutil’s locate, it has also been removed.

services.paperless now installs paperless-manage as a normal system package instead of creating a symlink in /var/lib/paperless. paperless-manage now also changes to the appropriate user when being executed.

asusd has been upgraded to version 6 which supports multiple aura devices. To account for this, the single auraConfig configuration option has been replaced with auraConfigs which is an attribute set of config options per each device. The config files may also be now specified as either source files or text strings; to account for this you will need to specify that text is used for your existing configs, e.g.:

-services.asusd.asusdConfig = '''file contents'''
+services.asusd.asusdConfig.text = '''file contents'''

linuxPackages.nvidiaPackages.stable now defaults to the production variant instead of latest.

services.paperless.address no longer accepts a domain name or Unix domain socket.

networking.wireguard.enable = true does not always add wireguard-tools to system packages anymore. Only when wireguard interfaces are configured, the backing implementation packages are added to system PATH.

virtualisation/azure-common.nix’s filesystem and grub configurations have been moved to virtualisation/azure-image.nix. This makes azure-common.nix more generic so it could be used for users who generate Azure image using other methods (e.g. nixos-generators and disko). For existing users depending on these configurations, please also import azure-image.nix.

services.signald has been removed as signald is unmaintained upstream and has been incompatible to official Signal servers for a long while.

The earlyoom service is now using upstream systemd service, which enables hardening and filesystem isolation by default. If you need filesystem write access or want to access home directory via killHook, hardening setting can be changed via, e.g. systemd.services.earlyoom.serviceConfig.ProtectSystem.

services.earlyoom.extraArgs is now shell-escaped for each element without word-breaking. So you want to write extraArgs = [ "--prefer" "spaced pat" ] rather than previous extraArgs = [ "--prefer 'spaced pat'" ].

programs.less.lessopen is now null by default. To restore the previous behaviour, set it to ''|${lib.getExe' pkgs.lesspipe "lesspipe.sh"} %s''.

hardware.pulseaudio has been renamed to services.pulseaudio. The deprecated option names will continue to work, but causes a warning.

services.nextcloud now uses systemd’s credential mechanism to read in secret files. The nextcloud-occ wrapper script implements this using systemd-run, as such it now also requires root privileges or $CREDENTIALS_DIRECTORY set where running it as user nextcloud was enough previously.

services.mongodb.initialRootPassword has been replaced with the more secure option services.mongodb.initialRootPasswordFile

services.bird2 has been renamed to services.bird and the default bird package has been switched to bird3. bird2 can still be chosen via the services.bird.package option.

The behavior of the networking.nat.externalIP and networking.nat.externalIPv6 options has been changed. networking.nat.forwardPorts now only forwards packets destined for the specified IP addresses.

gitlab has been updated from 17.x to 18.x and requires postgresql >= 16, as stated in the documentation. Check the upgrade guide in the NixOS manual on how to upgrade your PostgreSQL installation.

services.gitlab now requires the setting of activeRecordPrimaryKeyFile, activeRecordDeterministicKeyFile, activeRecordSaltFile as GitLab introduced Rails ActiveRecord encryption.

The Mattermost module (services.mattermost) and packages (mattermost and mmctl) have been substantially updated:

DokuWiki with the Caddy webserver (services.dokuwiki.webserver = "caddy") now sets up sites with Caddy’s automatic HTTPS instead of HTTP-only. To keep the old behavior for a site example.com, set services.caddy.virtualHosts."example.com".hostName = "http://example.com". If you set custom Caddy options for a DokuWiki site, migrate these options by removing http:// from services.caddy.virtualHosts."http://example.com".

Wordpress with the Caddy webserver (services.wordpress.webserver = "caddy") now sets up sites with Caddy’s automatic HTTPS instead of HTTP-only. Given a site example.com, http://example.com now 301 redirects to https://example.com. To keep the old behavior for a site example.com, set services.caddy.virtualHosts."example.com".hostName = "http://example.com".

The behavior of services.hostapd.radios.<name>.networks.<name>.authentication.enableRecommendedPairwiseCiphers was changed to not include CCMP-256 anymore. Since all configured pairwise ciphers have to be supported by the radio, this caused startup failures on many devices which is hard to debug in hostapd.

The hardware.gkraken module has been removed. The recommended alternative is programs.coolercontrol.

To avoid delaying user logins unnecessarily the multi-user.target is no longer ordered after network-online.target. System services requiring a connection to start correctly must explicitly state so, i.e.

{
  systemd.services."<name>" = {
    wants = [ "network-online.target" ];
    after = [ "network-online.target" ];
  };
}

This changed follows a deprecation period of one year started in NixOS 24.05 (see PR #283818).

The values of services.borgbackup.jobs.*.extraArgs and other extra*Args options are now represented as Bash arrays. If these arguments were modified using services.borgbackup.jobs.*.preHook, they will need to be adjusted to append to these arrays, i.e.

-extraCreateArgs="$extraCreateArgs --exclude /some/path"
+extraCreateArgs+=("--exclude" "/some/path")

programs.xonsh.package now gets overridden internally with extraPackages to support programs.xonsh.extraPackages. See programs.xonsh.extraPackages for more details.

services.nitter.guestAccounts has been renamed to services.nitter.sessionsFile, for consistency with upstream. The file format is unchanged.

virtualisation.azure.agent option provided by azure-agent.nix is replaced by services.waagent, and will be removed in a future release.

Netdata removed support for non cloud deployments in version 2, so the withCloud option has been removed.

The ZFS import service now respects fileSystems.*.options = [ "noauto" ]; and does not add that pool’s import service to zfs-import.target, meaning it will not be automatically imported at boot.

Default file names of images generated by several builders in system.build have been changed as outlined in the table below.

Names are now known at evaluation time and customizable via the new options image.baseName, image.extension, image.fileName and image.filePath with the latter returning a path relative to the derivations out path (e.g. iso/${image.fileName for iso images).

security.apparmor.policies.<name>.enforce and security.apparmor.policies.<name>.enable were removed. Configuring the state of apparmor policies must now be done using security.apparmor.policies.<name>.state tristate option.

services.graylog.package now defaults to graylog-6_0 as previous default graylog-5_1 is EOL and therefore removed. Check the migration guides on 5.1→5.2 and 5.2→6.0 for breaking changes.

programs.clash-verge.tunMode was deprecated and removed because now service mode is necessary to start program. Without programs.clash-verge.enable, clash-verge-rev will refuse to start.

services.discourse now requires PostgreSQL 15 per default. Please update before upgrading.

services.homepage-dashboard now requires the allowedHosts option to be set in accordance with the documentation.

luakit has been updated to 2.4.0. If you use any website which uses IndexedDB or local storage and wish to retain the saved information, some manual intervention may be required

services.netbird.tunnels was renamed to services.netbird.clients, hardened (using dedicated less-privileged users) and significantly extended.

services.rsyncd.settings now supports only two attributes sections and globalSection. As a result, all sections previously defined under services.rsyncd.settings must now be put in services.rsyncd.settings.sections. Global settings must now be placed in services.rsyncd.settings.globalSection instead of services.rsyncd.settings.global.

virtualisation.containers with backend “podman” now supports rootless containers and sd_notify(3)-integration based on container healthchecks.

Cinnamon has been updated to 6.4, please check the upstream announcement for more details.

Pantheon has been updated to 8, please check the upstream announcement for more details.

Xfce has been updated to 4.20, please check the upstream feature tour for more details.

PAM services for i3lock/i3lock-color, vlock, xlock, and xscreensaver now default to disabled unless other corresponding NixOS options are set (programs.i3lock.enable, console.enable, services.xserver.enable, and services.xscreensaver.enable, respectively). If for some reason you want one of them back without setting the corresponding option, set, e.g., security.pam.services.xlock.enable = true.

The nixos-generate-config command now supports a optional --flake option, which will generate a flake.nix file alongside the configuration.nix and hardware-configuration.nix, providing an easy introduction into flake-based system configurations.

system.stateVersion is now validated and must be in the "YY.MM" format, ideally corresponding to a prior NixOS release.

hardware.xone will also enable hardware.xpad-noone to provide Xbox 360 driver by default.

services.mysql now supports easy cluster setup via services.mysql.galeraCluster option.

Example:

{
  services.mysql = {
    enable = true;
    galeraCluster = {
      enable = true;
      localName = "Node 1";
      localAddress = "galera_01";
      nodeAddresses = [
        "galera_01"
        "galera_02"
        "galera_03"
      ];
    };
  };
}

systemd’s systemd-ssh-generator(8) now works out of the box on NixOS.

SSH host key generation has been separated into the dedicated systemd service sshd-keygen.service.

services.dex now restarts upon changes to the .environmentFile option or path type entries in .settings.staticClients[].secretFile.

services.geoclue2 now has an enableStatic option, which allows the NixOS configuration to specify a fixed location for GeoClue to use.

services.mongodb is now compatible with the mongodb-ce binary package. To make use of it, set services.mongodb.package to pkgs.mongodb-ce.

services.jupyter is now compatible with Jupyter Notebook 7. See the migration guide for details.

networking.wireguard now has an optional networkd backend. It is enabled by default when networking.useNetworkd is enabled, and it can be enabled alongside scripted networking with networking.wireguard.useNetworkd. Some networking.wireguard options have slightly different behavior with the networkd and script-based backends, documented in each option.

services.rss-bridge now has a package option as well as support for caddy as reverse proxy.

services.avahi.ipv6 now defaults to true.

In the services.xserver.displayManager.startx module, two new options generateScript and extraCommands have been added to to declaratively configure the .xinitrc script.

All services that require a root certificate bundle now use the value of a new read-only option, security.pki.caBundle.

services.hddfancontrol has been modified to use an attribute set for settings, enabling configurations with multiple instances of the daemon running at once (e.g., for two separate drive bays).

services.cloudflared now uses a dynamic user, and its user and group options have been removed. If the user or group is still necessary, they can be created manually.

The Home Assistant module has new options services.home-assistant.blueprints.automation, services.home-assistant.blueprints.script, and services.home-assistant.blueprints.template that allow for the declarative installation of blueprints into the appropriate configuration directories.

services.dovecot2.modules have been removed, now need to use environment.systemPackages to load additional Dovecot modules.

services.kmonad now creates a determinate symlink (in /dev/input/by-id/) to each of KMonad virtual devices.

services.searx now supports configuration of the favicons cache and other options available in SearXNG’s favicons.toml file

services.gitea now supports CAPTCHA usage through the services.gitea.captcha variable.

services.soft-serve now restarts upon config change.

services.keycloak now provides a realmFiles option that allows to import realms during startup. See https://www.keycloak.org/server/importExport

bind.cacheNetworks now only controls access for recursive queries, where it previously controlled access for all queries.

The Starship module now automatically loads the starship prompt when using xonsh.

services.mongodb.enableAuth now uses the newer mongosh shell instead of the legacy shell to configure the initial superuser. You can configure the mongosh package to use through the services.mongodb.mongoshPackage option.

There is a new set of NixOS test tools for testing virtual Wi-Fi networks in many different topologies. See the services.vwifi module, services.kismet NixOS test, and manual for documentation and examples.

The paperless module now has an option for regular automatic export of documents data using the integrated document exporter.

Exposed the paperless-manage script package via the services.paperless.manage read-only option.

New options for the declarative configuration of the user space part of ALSA have been introduced under hardware.alsa, including setting the default capture and playback device, defining sound card aliases and volume controls. Note: these are intended for users not running a sound server like PulseAudio or PipeWire, but having ALSA as their only sound system.

services.k3s now provides the autoDeployCharts option that allows to automatically deploy Helm charts via the k3s Helm controller.

Mattermost, a self-hosted chat collaboration platform supporting calls, playbooks, and boards, has been updated. It now has multiple versions, disabled telemetry, and a native frontend build in nixpkgs, removing all upstream prebuilt blobs.

services.geoclue2 now uses beaconDB as a default geolocation service, replacing Mozilla Location Services which was retired in June 2024.

security.acme now supports renewal using CSRs (Certificate Signing Request) through the options security.acme.*.csr and security.acme.*.csrKey.

programs.fzf.keybindings now supports the fish shell.

A toggle has been added under users.users.<name>.enable to allow toggling individual users conditionally. If set to false, the user account will not be created.

New hooks were added:

Nix was updated to 2.24, which brings a lot of improvements and fixes. See the release notes for 2.19, 2.20, 2.21, 2.22, 2.23, 2.24. Notable changes include improvements to Git fetching, documentation comment support in nix-repl> :doc, as well as many quality of life additions.

There have been significant changes to macOS support.

This will be the last release of Nixpkgs to support versions of CUDA prior to CUDA 12.0. These versions only work with old compiler versions that will be unsupported by the time of the Nixpkgs 25.05 release. In the future, users should expect CUDA versions to be dropped as the compiler versions they require leave upstream support windows.

Convenience options for amdgpu, the open source driver for Radeon cards, are now available under hardware.amdgpu.

AMDVLK, AMD’s open source Vulkan driver, is now available to be configured under the hardware.amdgpu.amdvlk option. This also allows configuring runtime settings for AMDVLK, including enabling experimental features.

The moonlight-qt package (for Moonlight game streaming) now has HDR support on Linux systems.

Sched-ext, a Linux kernel feature to run schedulers in userspace, is now available services.scx. Requires Linux kernel version 6.12 or later.

PostgreSQL now defaults to major version 16.

GNOME has been updated to version 47. Refer to the release notes for more details.

authelia has been upgraded to version 4.38. This version brings several features and improvements which are detailed in the release blog post. This release also deprecates some configuration keys which are likely to be removed in version 5.0.0.

netbird has been updated to 0.31.1. This adds a built-in relay server which is not yet supported by the NixOS module, as well as a metrics endpoint for both the management and signal services. The default metrics port for the signal service has been changed from 9090 to 9091 to prevent a port conflict with the management server. This can be changed with their respective metricsPort as needed. Refer to the release notes and this pull request for more information.

compressDrv can compress selected files in a derivation. compressDrvWeb compresses files for common web server usage (.gz with zopfli, .br with brotli).

hardware.display is a new module implementing workarounds for misbehaving monitors by setting up custom EDID files and forcing kernel/framebuffer modes.

services.displayManager.ly is a new module for configuring the display manager ly, a TUI-based replacement for SDDM and LightDM meant for window manager users.

srcOnly was rewritten to be more readable, have additional warnings in the event that something is probably wrong, use the stdenv provided by the derivation, and Noogle-compatible documentation was added.

The default sound server for most graphical sessions has been switched from PulseAudio to PipeWire. Users that want to keep using PulseAudio will want to set services.pipewire.enable = false; and hardware.pulseaudio.enable = true;. There is currently no plan to fully deprecate and remove PulseAudio, however, PipeWire should generally be preferred for new installs.

The Rust rewrite of the switch-to-configuration program is now used for system activation by default. If you experience any issues, please report them. The original Perl script is deprecated and is planned for removal in the 25.05 release. It will remain accessible until then by setting system.switch.enableNg to false.

Support for mounting filesystems from block devices protected with dm-verity was added through the boot.initrd.systemd.dmVerity option.

The Xen Project Hypervisor is once again available as a virtualisation option under virtualisation.xen.

A new option systemd.enableStrictShellChecks has been added. When enabled, all systemd scripts generated by NixOS will be checked with shellcheck and any errors or warnings will cause the build to fail. This affects all scripts that have been created through the script, reload, preStart, postStart, preStop and postStop options for systemd services. This does not affect commandlines passed directly to ExecStart, ExecReload, ExecStartPre, ExecStartPost, ExecStop or ExecStopPost. It therefore also does not affect systemd units that are coming from packages and that are not defined through the NixOS config. This option is disabled by default, and although some services have already been fixed, it is still likely that you will encounter build failures when enabling this. We encourage people to enable this option when they are willing and able to submit fixes for potential build failures to nixpkgs. The option can also be enabled or disabled for individual services using the enableStrictShellChecks option on the service itself, which will take precedence over the global setting.

hardware.block allows configuration of I/O schedulers for block devices.

KMonad, an advanced keyboard remapping utility. Available as services.kmonad.

Coral, hardware support for Coral.ai Edge TPU devices. Available as hardware.coral.usb.enable and hardware.coral.pcie.enable.

Cyrus IMAP, an email, contacts and calendar server. Available as services.cyrus-imap service.

TaskChampion Sync-Server, a Taskwarrior 3 sync server. Available as services.taskchampion-sync-server.

FlareSolverr, a proxy server to bypass Cloudflare protection. Available as services.flaresolverr.

Whisparr, an adult movie collection manager for Usenet and BitTorrent users. Available as services.whisparr.

Gancio, a shared agenda for local communities. Available as services.gancio.

Goatcounter, an easy web analytics platform with no tracking of personal data. Available as services.goatcounter.

Privatebin, a minimalist, open source online pastebin where the server has zero knowledge of pasted data. Available as services.privatebin.

UWSM, a wayland session manager to wrap Wayland compositors into useful systemd units such as graphical-session.target. Available as programs.uwsm.

Open-WebUI, a user-friendly WebUI for LLMs. Available as services.open-webui.

Quickwit, a sub-second search & analytics engine on cloud storage. Available as services.quickwit.

Userborn, a service for declarative user management. This can be used instead of the update-users-groups.pl Perl script and/or systemd-sysusers. This is now recommended over systemd-sysusers to achieve a system without Perl, as it can create normal users and change passwords. Available as services.userborn.

g810-led, a LED controller for Logitech G keyboards. Available as services.g810-led.

Hatsu, a self-hosted bridge that interacts with Fediverse on behalf of your static site. Available as services.hatsu.

Soteria, a polkit authentication agent to handle elevated prompts for any desktop environment. Normally this should only be used on DEs or WMs that do not provide a graphical polkit frontend on their own. Available as security.soteria.

Flood, a beautiful WebUI for various torrent clients. Available as services.flood.

Niri, a scrollable-tiling Wayland compositor. Available as programs.niri.

Firefly-iii Data Importer, a data importer for Firefly-III. Available as services.firefly-iii-data-importer.

Dashy, an open source, highly customizable, easy to use, privacy-respecting dashboard app. Available as services.dashy.

[QGroundControl], a ground station support and configuration manager for the PX4 and APM Flight Stacks. Available as programs.qgroundcontrol.

Eintopf, a community event and calendar web application. Available as services.eintopf.

pay-respects, a terminal command correction program, alternative to thefuck, written in Rust. Available as programs.pay-respects.

Radicle, an open source, peer-to-peer code collaboration stack built on Git. Available as services.radicle.

Ordinal, A library for ordinal numbers in the Coq proof assistant.

ddns-updater, a service with a WebUI to update DNS records periodically for many providers. Available as services.ddns-updater.

Immersed, a closed-source coworking platform. Available as programs.immersed.

HomeBox, an inventory and organization system built for the home user. Available as services.homebox.

evremap, a keyboard input remapper for Linux/Wayland systems. Available as services.evremap.

matrix-hookshot, a Matrix bot for connecting to external services. Available as services.matrix-hookshot.

Renovate, a dependency updating tool for various Git forges and language ecosystems. Available as services.renovate.

Music Assistant, a music library manager for your offline and online music sources that can stream to a wide range of supported players. Available as services.music-assistant.

zeronsd, a DNS server for ZeroTier users. Available with services.zeronsd.servedNetworks.

Collabora Online, a collaborative online office suite based on LibreOffice technology. Available as services.collabora-online.

wg-access-server, an all-in-one WireGuard VPN solution with a WebUI for connecting devices. Available as services.wg-access-server.

Pingvin Share, a self-hosted file sharing platform and an alternative for WeTransfer. Available as services.pingvin-share.

Envision, a UI for building, configuring and running Monado, the open source OpenXR runtime. Available as programs.envision.

Localsend, an open source cross-platform alternative to AirDrop. Available as programs.localsend.

Gatus, an automated developer-oriented status page. Available as services.gatus.

cryptpad, a privacy-oriented collaborative office suite, has been added back. Available as services.cryptpad.

realm, a simple, high performance relay server written in Rust. Available as services.realm.

Gotenberg, an API server for converting files to PDFs that can be used alongside Paperless-ngx. Available as services.gotenberg.

Suricata, a free and open source, mature, fast and robust network threat detection engine. Available as services.suricata.

Playerctld, a daemon to track media player activity. Available as services.playerctld.

Glance, a self-hosted dashboard that puts all your feeds in one place. Available as services.glance.

Apache Tika, a toolkit that detects and extracts metadata and text from over a thousand different file types. Available as services.tika.

Misskey, an interplanetary microblogging platform. Available as services.misskey.

Improved File Manager (IFM), a single-file web-based file manager. Available as services.ifm.

OpenGFW, an implementation of the Great Firewall on Linux. Available as services.opengfw.

Rathole, a lightweight and high-performance reverse proxy for NAT traversal. Available as services.rathole.

Proton Mail bridge, a desktop application that runs in the background, encrypting and decrypting messages as they enter and leave your computer. Available as services.protonmail-bridge.

chromadb, an open-source AI application database with batteries included. Available as services.chromadb.

bitmagnet, a self-hosted BitTorrent indexer, DHT crawler, content classifier and torrent search engine with WebUI, GraphQL API and Servarr stack integration. Available as services.bitmagnet.

Wakapi, a time tracking software for programmers. Available as services.wakapi.

foot, a fast, lightweight and minimalistic Wayland terminal emulator. Available as programs.foot.

ToDesk, a remote desktop application. Available as services.todesk.

Dependency Track, an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Available as services.dependency-track.

Immich, a self-hosted photo and video backup solution. Available as services.immich.

saunafs, a distributed POSIX file system. Available as services.saunafs.

obs-studio, a free and open source software for video recording and live streaming. Available as programs.obs-studio.

Veilid, a privacy-focused, headless server for data sharing and messaging on a peer-to-peer network. Available as services.veilid.

Fedimint, a module based system for building federated applications (Federated E-Cash Mint). Available as services.fedimintd.

tiny-dfr, a dynamic function row daemon for the Touch Bar found on some Apple laptops. Available as hardware.apple.touchBar.enable.

Swapspace, a dynamic swap space manager that turns your unused free space into swap automatically. Available as services.swapspace.

Zapret, a DPI bypass tool. Available as services.zapret.

Glances, an open-source system cross-platform monitoring tool. Available as services.glances.

Nixpkgs now requires Nix 2.3.17 or newer to allow for zstd compressed binary artifacts.

The sound options have been removed or renamed, as they had a lot of unintended side effects. See below for details.

The NVIDIA driver no longer defaults to the proprietary kernel module with versions >= 560. You will need to manually set hardware.nvidia.open to select the proprietary or open modules.

The intel driver for the X server (services.xserver.videoDrives = [ "intel" ]) is no longer functional due to incompatibilities with the latest Mesa version. All users are strongly encouraged to switch to the generic modesetting driver (the default one) whenever possible, for more information see the manual chapter on Intel Graphics and issue #342763.

The intel-compute-runtime package dropped support for older GPUs, and only supports 12th Gen and newer from now on. Intel GPUs from Gen 8,9 and 11 need to use the intel-compute-runtime-legacy1 package in hardware.graphics.extraPackages.

The (buildPythonPackage { ... }).override and (buildPythonPackage { ... }).overrideDerivation attributes is now deprecated and removed in favour of overridePythonAttrs and lib.overrideDerivation. This change does not affect the override interface of most Python packages, as <pkg>.override provided by callPackage shadows such a locally-defined override attribute. The <pkg>.overrideDerivation attribute of Python packages called with callPackage will also remain available after this change.

All Cinnamon and XApp packages have been moved to top-level (i.e., cinnamon.nemo is now nemo).

All GNOME packages have been moved to top-level (i.e., gnome.nautilus is now nautilus).

transmission has been aliased with a trace warning to transmission_3, since Transmission 4 has been released last year and Transmission 3 will eventually go away – this is meant to make people aware of the new version. services.transmission.package now also defaults to transmission_3, as the upgrade can cause data loss in some cases (examples: #5153, #6796). Please make sure to back up to your data directory if you may be affected:

The default mongodb version has been updated from 5.0 to 7.0. For more information, see the compatibility changes for MongoDB 6.0 and 7.0.

unifi has been updated to UniFi 8. unifi7 was removed as it is vulnerable to CVE-2024-42025 and required a version of MongoDB that has reached end of life.

androidenv.androidPkgs_9_0 has been removed. It is replaced with androidenv.androidPkgs for a more complete Android SDK, including support for Android 9 and later.

The VirtualBox demo installer appliance has been removed. Please use the standard installer ISOs instead.

grafana has been updated to version 11.3. This version doesn’t support setting http_addr to a hostname anymore, an IP address is expected.

deno has been updated to Deno 2, which has breaking changes. See the migration guide for details.

gogs has been removed. Upstream development has stalled and it has several critical vulnerabilities that weren’t addressed within a year. Consider migrating to forgejo or gitea.

knot-dns has been updated to version 3.4.x. Check the migration guide for breaking changes.

mutmut has been updated to version 3.0.5.

services.kubernetes.kubelet.clusterDns now accepts a list of DNS resolvers rather than a single string, bringing the module more in line with the upstream Kubelet configuration schema.

bluemap has changed the format used to store map tiles, and the database layout has been heavily modified. Upstream recommends a clean reinstallation: https://github.com/BlueMap-Minecraft/BlueMap/releases/tag/v5.2. Unless you are using an SQL storage backend, this should only entail deleting the contents of config.services.bluemap.coreSettings.data (defaults to /var/lib/bluemap) and config.services.bluemap.webRoot (defaults to /var/lib/bluemap/web).

wstunnel has had a major version upgrade that entailed rewriting the program in Rust. The module was updated to accommodate for breaking changes and breaking changes to the module options were minimised as much as possible. Nonetheless, some were inevitable due to changes in the upstream CLI. Certain options were moved from separate CLI arguments into the forward specifications, and those options were also removed from the module’s options. Please consult the wstunnel man page for more details. Also be aware that if you have set additional options in services.wstunnel.{clients,servers}.<name>.extraArgs, they may have been modified or removed upstream.

gnat and gnatPackages now use GNAT 13 instead of GNAT 12. This matches the default gcc version.

percona-server_8_4 and mysql84 now have password authentication via the deprecated mysql_native_password disabled by default. This authentication plugin can be enabled via a CLI argument again, for detailed instructions and alternative authentication methods see upstream documentation. The config file directive default_authentication_plugin has been removed.

Percona has decided not to follow the LTS/ Innovation release scheme of upstream MySQL and thus will only create releases for MySQL LTS versions. Hence, the package names percona-server_lts, percona-server_innovation, percona-xtrabackup_lts and percona-xtrabackup_innovation are deprecated.

clang-tools_<version> packages have been moved into llvmPackages_<version> (i.e. clang-tools_18 is now llvmPackages_18.clang-tools).

buildbot was updated to 4.0 and the AngularJS frontend replaced by a React frontend. See the upstream release notes.

headscale has been updated to version 0.23.0 which reworked large parts of the configuration, including DNS, Magic DNS prefixes and ACL policy files. See the upstream changelog for details.

nginx package no longer includes the gd and geoip dependencies. To re-enable them, override nginx with the options withImageFilter = true; and withGeoIP = true;.

systemd.enableUnifiedCgroupHierarchy has been removed. In systemd 256, support for cgroup v1 (‘legacy’ and ‘hybrid’ hierarchies) is now considered obsolete and systemd will refuse to boot under it by default. To forcibly re-enable cgroup v1 support, you can set boot.kernelParams = [ "systemd.unified_cgroup_hierarchy=0" "SYSTEMD_CGROUP_ENABLE_LEGACY_FORCE=1" ]. This is not an officially supported configuration and might cause your system to become unbootable in future versions. You are on your own.

nrfutil – which previously pointed to the now-deprecated pc-nrfutil Python package – has been repackaged under the same name with the new nrfutil tool.

openssh and openssh_hpn are now compiled without Kerberos 5 / GSSAPI support in an effort to reduce the attack surface of the components. Users needing this support can use the new opensshWithKerberos and openssh_hpnWithKerberos package flavors (e.g. programs.ssh.package = pkgs.openssh_gssapi).

security.ipa.ipaHostname now defaults to the value of networking.fqdn if it is set, instead of the previous hardcoded default of ${networking.hostName}.${security.ipa.domain}.

The MSMTP_QUEUE and MSMTP_LOG environment variables accepted by msmtpq have been renamed to MSMTPQ_Q and MSMTPQ_LOG respectively.

The logrotate service has been hardened and now requires enabling allowNetworking if network access is required.

mautrix-whatsapp has been updated to version 0.11.0, which is a major rewrite of the bridge. Config file changes are required.

qBittorrent has been updated to major version 5, which drops support for Qt 5. The qbittorrent-qt5 package has been removed.

The fcgiwrap module now allows multiple instances running as distinct users. The option services.fgciwrap now takes an attribute set of the configuration of each individual instance. This requires migrating any previous configuration keys from services.fcgiwrap.* to services.fcgiwrap.instances.some-instance.*. The ownership and mode of the UNIX sockets created by this service are now configurable and private by default. Processes also now run as a dynamically allocated user by default instead of root.

The mautrix-signal module was adapted to incorporate the configuration changes that resulted from the update to the mautrix bridgev2 architecture. Pre-0.7.0 configurations should continue to work. In case you want to update your configuration, make sure to check the NixOS manual.

cargo-tauri has been updated to major version 2. Please review the migration guide. v1 of cargo-tauri is still available as cargo-tauri_1, but will be removed in future releases.

The nvidia driver no longer defaults to the proprietary driver starting with version 560. You will need to manually set hardware.nvidia.open to select the proprietary or open driver.

postgresql_12 has been removed since it reached its end of life.

postgresql no longer accepts the enableSystemd override. Use systemdSupport instead.

postgresql was split into default and -dev outputs. To make this work without circular dependencies, the output of the pg_config system view has been removed. The pg_config binary is provided in the -dev output and still works as expected.

The arguments from services.postgresql.initdbArgs now get shell-escaped.

postgresql is now hardened by default using the common systemd settings for that.

The dhcpcd service (networking.useDHCP) has been hardened and now runs exclusively as the “dhcpcd” user. Users that were relying on the root privileges in networking.dhcpcd.runHook will have to write specific sudo or polkit rules to allow dhcpcd to perform privileged actions.

As part of these changes, the DHCP lease files directory has also been moved from /var/db/dhcpcd to /var/lib/dhcpcd. This migration is performed automatically, but users may have to update their backup configuration.

singularity-tools have the storeDir argument removed from its override interface and use builtins.storeDir instead.

The mkLayer and shellScript build helpers in singularity-tools are deprecated, as they are no longer involved in image-building. Maintainers will remove them in future releases.

The rust.toTargetArch, rust.toTargetOs, rust.toTargetFamily, rust.toTargetVendor, rust.toRustTarget, rust.toRustTargetSpec, rust.toRustTargetSpecShort, and rust.IsNoStdTarget functions are deprecated in favour of the rust.platform.arch, rust.platform.os, rust.platform.target-family, rust.platform.vendor, rust.rustcTarget, rust.rustcTargetSpec, rust.cargoShortTarget, rust.cargoEnvVarTarget, and rust.isNoStdTarget platform attributes respectively.

All Budgie and budgiePlugins packages have been moved to top-level (i.e., budgie.budgie-desktop is now budgie-desktop and budgiePlugins.budgie-media-player-applet is now budgie-media-player-applet).

The method of safely handling secrets in the networking.wireless module has been changed to benefit from a new feature of wpa_supplicant. The syntax to refer to secrets has changed slightly and the option networking.wireless.environmentFile has been replaced by networking.wireless.secretsFile; see the description of the latter for how to upgrade.

NetBox was updated to >= 4.1.0. Have a look at the breaking changes of the 4.0 release and the 4.1 release, make the required changes to your database, if needed, then upgrade by setting services.netbox.package = pkgs.netbox_4_1; in your configuration.

services.cgit now runs as the cgit user by default instead of root. This change requires granting access to the repositories to this user or setting the appropriate one through services.cgit.some-instance.user.

All Oracle JDKs and JREs (oraclejdk, oraclejdk8, oraclejre, oraclejre8, jrePlugin, jre8Plugin, jdkdistro, oraclejdk8distro, and oraclejdk11) were dropped due to being unmaintained and heavily insecure. OpenJDK provides compatible replacements for JDKs and JREs.

gradle_6 was removed due to being unsupported upstream as of 10 Feb 2023. Additionally, it had numerous security vulnerabilities that were only patched in later versions, such as CVE-2021-29429, CVE-2021-29427, CVE-2021-29428, and CVE-2021-32751.

nvimpager was updated to version 0.13.0, which changes the order of user and nvimpager settings: user commands in -c and --cmd now override the respective default settings because they are executed later.

javacard-devkit was dropped due to having a dependency on the Oracle JDK, as well as being several years out-of-date.

Kubernetes featureGates have changed from a listOf str to attrsOf bool. This refactor makes it possible to also disable feature gates, without having to use extraOpts flags.

A previous configuration may have looked like this:

{
  featureGates = [ "EphemeralContainers" ];
  extraOpts = pkgs.lib.concatStringsSep " " ([ ''--feature-gates="CSIMigration=false"'' ]);
}

Using an attribute set instead, the new configuration would be:

{
  featureGates = {
    EphemeralContainers = true;
    CSIMigration = false;
  };
}

pkgs.nextcloud27 has been removed as it has reached EOL.

The environment.noXlibs option has been removed. It was a common source of unexpected rebuilds and breakage that was often hard to diagnose. If you need to disable certain libraries, you’re encouraged to add your own overlay to your configuration that targets the packages you care about.

frigate was updated past 0.14.0. This release includes various breaking changes, so please review the release notes. Most prominently, access to the web interface and API are now protected by authentication. Retrieve the auto-created admin account from the frigate.service journal after upgrading.

nodePackages.coc-python was dropped, as its upstream is unmaintained. The associated vimPlugins.coc-python was also dropped. The upstream project recommends using coc-pyright or coc-jedi as replacements.

forgejo has been upgraded from version 7.0 to version 9.0, see the release notes for 8.0 and 9.0.

services.forgejo.mailerPasswordFile has been deprecated by the drop-in replacement services.forgejo.secrets.mailer.PASSWD, which is part of the new free-form services.forgejo.secrets option. services.forgejo.secrets is a small wrapper over systemd’s LoadCredential=. It has the same structure (sections/keys) as services.forgejo.settings but takes file paths that will be read before service startup instead of some plaintext value. services.forgejo.package now defaults to forgejo-lts, the Long Term Support version of Forgejo.

forgejo and forgejo-lts no longer support the opt-in feature PAM (Pluggable Authentication Module).

gitea no longer supports the opt-in feature PAM (Pluggable Authentication Module).

vuze was removed because it is unmaintained upstream and insecure (CVE-2018-13417). BiglyBT is a maintained fork.

services.ddclient.use has been deprecated: ddclient now supports separate IPv4 and IPv6 configuration. Use services.ddclient.usev4 and services.ddclient.usev6 instead.

services.pgbouncer systemd service is now configured with Type=notify-reload and allows reloading configuration without process restart. PgBouncer configuration options were moved to the freeform type option under services.pgbouncer.settings.

Docear was removed because it was unmaintained upstream. JabRef, Zotero, or Mendeley are potential replacements.

nodePackages.coc-metals was removed due to being deprecated upstream. vimPlugins.nvim-metals is its official replacement.

matrix-sliding-sync was removed because it has been replaced by the simplified sliding sync functionality introduced in matrix-synapse 114.0.

nodePackages.coc-tslint, vimPlugins.coc-tslint, nodePackages.coc-tslint-plugin, and vimPlugins.coc-tslint-plugin were removed due to being deprecated upstream. The nodePackages.coc-eslint and vimPlugins.coc-eslint packages offer comparable features for eslint, which replaced tslint.

Tcl packages have been moved into the tclPackages scope.

teleport has been upgraded from major version 15 to major version 16. Refer to upstream upgrade instructions and release notes for v16.

tests.overriding’s passthru.tests has been restructured as an attribute set instead of a list, making individual tests accessible by their names.

skk-dict was split into multiple packages under skkDictionaries. If in doubt of what to use, try skkDictionaries.l. As part of this change, the dictionaries were moved from $out/share to $out/share/skk. The dictionaries also won’t be converted to UTF-8 unless the useUtf8 package option is enabled; UTF-8 converted dictionaries will have the .utf8 suffix appended to its filename.

vaultwarden lost the capability to bind to privileged ports. If you rely on this behavior, override the systemd unit to allow CAP_NET_BIND_SERVICE in your configuration.

services.invoiceplane.sites.<name>.extraConfig was removed. Configuration must now be done through the structured services.invoiceplane.sites.<name>.settings option.

services.ollama.sandbox has been replaced with options to configure a static user and group. The writablePaths option has also been removed and the models directory is now always exempt from sandboxing.

The gns3-server service now runs under the gns3 system user instead of a dynamically created one via DynamicUser. The use of SUID wrappers is incompatible with SystemD’s DynamicUser setting, and GNS3 requires calling ubridge through its SUID wrapper to function properly. This change requires to manually move the following directories:

Legacy package stalwart-mail_0_6 was dropped, please note the manual upgrade process before changing the package to pkgs.stalwart-mail in services.stalwart-mail.package.

nomad_1_5 and nomad_1_6 were dropped, as they have reached end-of-life upstream. Evaluating them will throw an error.

The default nomad package has been updated to 1.8.x. For more information, see breaking changes for Nomad 1.8

androidndkPkgs has been updated to androidndkPkgs_26.

Android NDK version 26 and SDK version 33 are now the default versions used for cross compilation to android.

ankisyncd package and its services.ankisyncd have been removed. Use services.anki-sync-server instead.

nodePackages.vscode-css-languageserver-bin, nodePackages.vscode-html-languageserver-bin, and nodePackages.vscode-json-languageserver-bin were dropped due to an unmaintained upstream. The vscode-langservers-extracted package is a maintained drop-in replacement.

nodePackages.prisma has been replaced by prisma.

fetchNextcloudApp has been rewritten to use fetchurl rather than fetchzip. This invalidates all existing hashes, but you can restore the old behavior by passing it unpack = true.

haskell.lib.compose.justStaticExecutables now disallows references to GHC in its output by default to alert users to closure size issues caused by #164630. See “Packaging Helpers” in the Haskell section of the Nixpkgs manual for information on working around output '...' is not allowed to refer to the following paths errors caused by this change.

services.stalwart-mail now runs under the stalwart-mail system user instead of a dynamic one via DynamicUser in order to avoid automatic ownership changes on its large file store on service restart. This change requires to manually move the state directory from /var/lib/private/stalwart-mail to /var/lib/stalwart-mail, and to change the ownership of the directory and its content to stalwart-mail.

services.stalwart-mail now uses RocksDB as the default storage backend for stateVersion ≥ 24.11. It was previously using SQLite for structured data and the filesystem for blobs.

services.stargazer has been hardened to improve security, but these changes make break certain setups, particularly around traditional CGI.

services.shiori now requires the HTTP secret value SHIORI_HTTP_SECRET_KEY to be provided as an environment variable. services.shiori.environmentFile has been introduced to handle this:

# This is how a environment file can be generated:
# $ printf "SHIORI_HTTP_SECRET_KEY=%s\n" "$(openssl rand -hex 16)" > /path/to/env-file
services.shiori.environmentFile = "/path/to/env-file";

/share/nano is now only linked when programs.nano.enable is enabled.

PPD files for Utax printers were renamed (spaces replaced by underscores) in the newest foomatic-db package. Users of Utax printers might need to adapt their hardware.printers.ensurePrinters.*.model value to account for this.

sqldeveloper was dropped due to being severely out-of-date and having a dependency on JavaFX for Java 8, which we do not support.

The kvdo kernel module package was removed as it was upstreamed in kernel version 6.9, where it is now called dm-vdo.

libe57format has been updated to >= 3.0.0, which contains some backward-incompatible API changes. See the release note for more details.

gitlab deprecated support for runner registration tokens in GitLab 16.0, disabled their support in GitLab 17.0 and will ultimately remove it in GitLab 18.0 (as outlined in the documentation). After upgrading to GitLab >= 17.0, it is possible to re-enable support for registration tokens in the UI until GitLab 18.0. Refer to the manual on using registration tokens after GitLab 17.0. GitLab administrators should migrate to the new runner registration workflow with runner authentication tokens until the release of GitLab 18.0.

gitlab has been updated from 16.x to 17.x and requires postgresql >= 14.9, as stated in the documentation. Check the upgrade guide in the NixOS manual on how to upgrade your PostgreSQL installation.

gitaly (part of gitlab) is now using the bundled git package instead of pkgs.git, to maintain compatibility with GitLab.

nixos/gitlab no longer adds pkgs.git to environment.systemPackages by default.

The replay-sorcery package and module was removed as it unmaintained upstream. Consider using gpu-screen-recorder or obs-studio instead.

A few options of services.samba have been moved from extraConfig and configText to the new freeform option settings and renamed, e.g.:

zx was updated to v8, which introduces several breaking changes. See the v8 changelog for more information.

feishin removed support for Navidrome < v0.53.2 due to an API change. See the v0.10.0 release notes for more information.

services.dnscrypt-wrapper was removed, as the project has been effectively unmaintained since 2018. Moreover, the NixOS module had to rely on an abandoned version of dnscrypt-proxy v1 for the rotation of keys. To wrap a resolver with DNSCrypt, you can instead use dnsdist. See services.dnsdist.dnscrypt

The portunus package and service do not support weak password hashes anymore. If you installed Portunus on NixOS 23.11 or earlier, upgrade to NixOS 24.05 first to get support for strong password hashing. Then, follow the instructions on the upstream release notes to upgrade all existing user accounts to strong password hashes. If you need to upgrade to 24.11 without having completed the migration, consider the security implications of weak password hashes on your user accounts, and add the following to your configuration:

{
  services.portunus.package = pkgs.portunus.override { libxcrypt = pkgs.libxcrypt-legacy; };
  services.portunus.ldap.package = pkgs.openldap.override { libxcrypt = pkgs.libxcrypt-legacy; };
}

The default value of services.kubernetes.kubelet.hostname is now lowercased. Explicitly set kubelet.hostname to networking.fqdnOrHostName to get back the old default behavior.

Docker now defaults to 27.x, as version 24.x stopped receiving security updates and bug fixes after February 1, 2024.

keycloak was updated to version 25, which introduces new hostname related options. See Upgrading Guide for instructions.

programs.vim.defaultEditor now only works if programs.vim.enable is enabled.

services.mautrix-meta was updated to 0.4. This release makes significant changes to the settings format. If you have custom settings you should migrate them to the new format. Unfortunately upstream provides little guidance for how to do this, but the auto-migration code may serve as a useful reference. The NixOS module should warn you if you still have any old settings configured.

The nodePackages.shout package has been removed because it was deprecated upstream in favor of thelounge. The shout top-level attribute was an alias to this package. The associated services.shout module has also been removed.

prometheus-openldap-exporter was removed, as it was unmaintained both upstream and in nixpkgs.

The indi-full package no longer contains non-free drivers. To get the old collection of drivers use indi-full-nonfree or create your own collection of drivers by overriding indi-with-drivers. E.g.: pkgs.indi-with-drivers.override {extraDrivers = with pkgs.indi-3rdparty; [indi-gphoto];}

/share/vim-plugins now only gets linked if programs.vim.enable is enabled

The services.guix module now manages trusted substitute servers declaratively. Instead of guix archive --authorize, list keys with services.guix.substituters.authorizedKeys. Default substitute servers can be set via services.guix.substituters.urls.

The tracy package no longer works on X11, since it’s moved to Wayland support, which is the intended default behavior by Tracy maintainers. X11 users have to switch to the new package tracy-x11.

gollum has been upgraded to major version 6. Please review their migration notes.

services.prometheus.exporters.minio option has been removed, as it’s upstream implementation was broken and unmaintained. Minio now has built-in Prometheus metrics exposure, which can be used instead.

The services.prometheus.exporters.tor option has been removed, as its upstream implementation was broken and unmaintained.

services.patroni.raft has been removed, as Raft has been deprecated by upstream since 3.0.0.

The jd-cli package was removed due to an inactive upstream and a dependency on the shut down JCenter JAR repository. Java decompilers already packaged in Nixpkgs include bytecode-viewer (GUI), cfr (CLI), and procyon (CLI).

The jd-gui package was removed due to an inactive upstream and a dependency on the end-of-life Gradle 6. Java decompilers already packaged in Nixpkgs include bytecode-viewer (GUI), cfr (CLI), and procyon (CLI).

services.roundcube.maxAttachmentSize will multiply the value set with 1.37 to offset overhead introduced by the base64 encoding applied to attachments.

services.mxisd has been removed as both mxisd and ma1sd are no longer maintained. Consequently, the package ma1sd has also been removed.

The rss-bridge service drops the support to load a configuration file from ${config.services.rss-bridge.dataDir}/config.ini.php. Consider using the services.rss-bridge.config option instead.

mikutter has been removed, as the package was broken and had no maintainers in nixpkgs.

xdg.portal.gtkUsePortal has been removed, as it had been deprecated for over 2 years. Using the GTK_USE_PORTAL environment variable in this manner is not intended nor encouraged by the GTK developers, but can still be done manually via environment.sessionVariables.

Support for the legacy CUPS browsing and LDAP have been removed from services.printing. If cups or ldap are in the BrowseRemoteProtocols setting in services.printing.browsedConf, it needs to be removed.

services.trust-dns has been renamed to services.hickory-dns.

services.prometheus.exporters.pgbouncer.connectionStringFile has been removed since it leaked the connection string (and thus potentially the DB password) into the cmdline of process making it effectively world-readable.

Use services.prometheus.exporters.pgbouncer.connectionEnvFile instead.

lsh and services.lshd have been removed as they had no maintainer in Nixpkgs and no upstream release in over a decade. It is recommended to migrate to openssh and services.openssh.

ceph has been upgraded to v19. See the Ceph “squid” release notes for details and recommended upgrade procedure.

services.frr has been refactored to use upstream service scripts. The per-daemon configurations have been removed in favour of an integrated-vtysh-config style config. The daemon submodules now use the daemon name (e.g. ospfd) instead of the protocol name (ospf). The daemons zebra, mgmtd and staticd are always enabled if a config is present. The vtyListenAddress and vtyListenPort options have been removed; use options or extraOptions instead, respectively.

opencv2 and opencv3 have been removed, as they are obsolete and were not used by any other package. External users are encouraged to migrate to OpenCV 4.

tvheadend package and the services.tvheadend module have been removed due to lack of maintenance in Nixpkgs and being stuck on an unmaintained version that required FFmpeg 4. Please see the related pull request #332259 if you are interested in maintaining a newer version.

antennas and services.antennas have been removed as they only work with tvheadend (see above).

system.build.brightboxImage has been removed as it no longer built and has not seen any maintenance in over 7 years (excluding tree-wide changes).

services.syncplay now exposes all currently available command-line arguments for syncplay-server as options, as well as a useACMEHost option for easy TLS setup. The systemd service now uses DynamicUser/StateDirectory and the user and group options have been deprecated.

openlens was removed. It is recommended to use lens-desktop instead.

services.dnsmasq.extraConfig has been removed, as it had been deprecated for over 2 years. This option has been replaced by services.dnsmasq.settings.

The NixOS installation media no longer support the ReiserFS or JFS file systems by default.

Minimal installer ISOs are no longer built on the small channel. Please obtain installer images from the full release channels.

The default FFmpeg version is now 7.1, and FFmpeg 5 has been removed. Please prefer using the package variants without a version suffix, or pin FFmpeg 6 or 4 if necessary for compatibility. Note that we keep old versions around only as required to support packages in the tree, and FFmpeg 4 especially should be avoided in favour of newer versions as it may be removed soon.

openssl now defaults to the latest version line 3.3.x, instead of 3.0.x before. While there should be no major code incompatibilities, newer OpenSSL versions typically strengthen the default security level. This means that you may have to explicitly allow weak ciphers, hashes and key lengths if necessary. See: OpenSSL security level documentation.

isync has been updated to version 1.5.0, which introduces some breaking changes. See the compatibility concerns for more details.

Two new packages – gpauth and gpclient from the 2.x version of the GlobalProtect-openconnect project – are added in parallel to globalprotect-openconnect. The GUI components related to the project are non-free and not packaged.

Compatible string matching for hardware.deviceTree.overlays has been changed to a more correct behavior. See below for details.

rustic was upgraded to 0.9.0, which contains breaking changes to the config file format.

pkgs.formats.ini and pkgs.formats.iniWithGlobalSection with listsAsDuplicateKeys or listToValue no longer merge non-list values into lists by default. Backwards-compatible behavior can be enabled with atomsCoercedToLists.

Atlassian Server products have been removed, as support for the Atlassian Server products ended in February 2024 and there was insufficient interest in maintaining the Atlassian Data Center replacements:

python3Packages.nose has been removed, as it has been deprecated and unmaintained for almost a decade and does not work on Python 3.12. Please switch to pytest or another test runner/framework.

dotnet-sdk, dotnet-runtime, and all other dotnet packages now use a wrapper package containing bin/dotnet, build hooks, etc. If you need to reference the underlying dotnet distribution (DOTNET_ROOT) you should use e.g. dotnet-runtime.unwrapped.

The root of dotnet distribution packages (DOTNET_ROOT) is now under e.g. ${dotnet-sdk.unwrapped}/share/dotnet instead of directly in the package root. This is consistent with packaging guidelines and more friendly for FHS environments.

dotnet-sdk, dotnet-runtime, and dotnet-aspnetcore now point to dotnet 8 rather than dotnet 6. For packages that still need dotnet 6, use dotnet-sdk_6, etc.

torq has been removed because upstreamed went closed source.

The zerocallusedregs hardening flag is enabled by default on compilers that support it.

The stackclashprotection hardening flag has been added, though disabled by default.

The pacret hardening flag has been added, though disabled by default.

cargoSha256 in rustPlatform.buildRustPackage has been deprecated in favor of cargoHash which supports SRI hashes. See buildRustPackage: Compiling Rust applications with Cargo for more information.

The vendorHash of Go packages built with buildGoModule can now be overridden with overrideAttrs. goModules, modRoot, vendorHash, deleteVendor, and proxyVendor are now passed as derivation attributes. goModules and vendorHash are no longer placed under passthru.

buildFlags/buildFlagsArray on buildGoModule have been deprecated. 24.11 is the last release where buildGoModule accepts these flags (while throwing a warning). Use the ldflags and/or tags attributes or the environment instead.

buildGoPackage has been deprecated. 24.11 is the last release with buildGoPackage available.

hareHook has been added as the language framework for Hare. From now on, it, not the hare package, should be added to nativeBuildInputs when building Hare programs.

virtualisation.docker.liveRestore has been renamed to virtualisation.docker.daemon.settings."live-restore" and turned off by default for state versions of at least 24.11.

Tailscale’s authKeyFile can now have its corresponding parameters set through config.services.tailscale.authKeyParameters, allowing for non-ephemeral unsupervised deployment and more. See Registering new nodes using OAuth credentials for the supported options.

nixosTests now provide a working IPv6 setup for VLAN 1 by default.

Kanidm can now be provisioned using the new [services.kanidm.provision] option, but requires using a patched version available via pkgs.kanidm.withSecretProvisioning.

Kanidm previously had an incorrect systemd service type, causing dependent units with an after and requires directive to start before kanidm* finished startup. The module has now been updated in line with upstream recommendations.

services.jupyter is now compatible with Jupyter Notebook 7. See the migration guide for details.

The kubelet configuration file can now be amended with arbitrary additional content using the services.kubernetes.kubelet.extraConfig option.

The services.seafile module was updated to major version 11.

The new option boot.binfmt.addEmulatedSystemsToNixSandbox allows you to skip adding the emulated systems to nix.settings.extra-platforms. Now you can emulate foreign binaries locally while only building them on native remote builders.

The latest available version of Nextcloud is v30 (available as pkgs.nextcloud30). The installation logic is as follows:

To facilitate dependency injection, the imgui package now builds a static archive using vcpkg’ CMake rules. The derivation now installs “impl” headers selectively instead of by a wildcard. Use imgui.src if you just want to access the unpacked sources.

The new boot.loader.systemd-boot.windows option makes setting up dual-booting with Windows on a different drive easier.

The boot.loader.raspberryPi options were marked as deprecated in 23.11 and have now been removed.

Linux 4.19 has been removed because it will reach its end of life within the lifespan of 24.11.

Unprivileged access to the kernel syslog via dmesg is now restricted by default. Users wanting to keep an unrestricted access to it can set boot.kernel.sysctl."kernel.dmesg_restrict" = false.

The i18n.inputMethod module introduces two new properties: enable and type, for declaring whether to enable an alternative input method and defining which input method respectfully. The options available in type are the same as the existing enabled option. enabled is now deprecated, and will be removed in a future release.

security.pam.u2f now uses freeform options; all module options are now configurable through security.pam.u2f.settings.

mikutter was removed as the package was broken and had no maintainers.

services.getty.autologinOnce was added to limit the automatic login to once per boot and on the first tty only. When using full disk encryption, this option allows to unlock the system without retyping the passphrase while keeping the other ttys protected.

Gollum was upgraded to major version 6. Read their migration notes.

The hooks yarnConfigHook and yarnBuildHook were added. These should replace yarn2nix.mkYarnPackage and other yarn2nix related tools. The motivation to get rid of yarn2nix tools is the fact that they are too complex and hard to maintain, and they rely upon too much Nix evaluation which is problematic if import-from-derivation is not allowed (see more details at #296856. The transition from mkYarnPackage to yarn{Config,Build}Hook is tracked at #324246.

services.timesyncd.servers now defaults to null, allowing systemd-timesyncd to use NTP servers advertised by DHCP.

services.timesyncd.fallbackServers was added and defaults to networking.timeServers.

Cinnamon has been updated to 6.2. Please check upstream announcement for more details. Following Mint 22 defaults, the Cinnamon module no longer ships geary and hexchat by default.

zfs.latestCompatibleLinuxPackages is deprecated and is now pointing at the default kernel. If using the stable LTS kernel (default linuxPackages is not possible then you must explicitly pin a specific kernel release. For example, boot.kernelPackages = pkgs.linuxPackages_6_6. Please be aware that non-LTS kernels are likely to go EOL before ZFS supports the latest supported non-LTS release, requiring manual intervention.

The shadowstack hardening flag has been added, though disabled by default.

writeReferencesToFile has been removed after its deprecation in 24.05. Use the trivial build helper writeClosure instead.

xxd is now provided by the tinyxxd package rather than vim.xxd to reduce closure size and vulnerability impact. Since it has the same options and semantics as Vim’s xxd utility, there is no user impact. Vim’s xxd remains available as the vim.xxd package.

restic module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep). Available as services.restic.backups.<name>.inhibitsSleep.

Mattermost has been updated from 9.5 to 9.11 ESR. See the changelog for more details.

cargo-tauri.hook was introduced to help users build Tauri projects. It is meant to be used alongside rustPlatform.buildRustPackage and Node hooks such as npmConfigHook, pnpm.configHook, and the new yarnConfig

power.ups now powers off UPSs during a power outage event. This saves UPS battery and ensures that host(s) get back up again when power comes back, even in the scenario when the UPS would have had enough capacity to keep power on during the whole power outage. If you like the old behaviour of keeping the UPSs on (and emptying the battery) after the host(s) have shut down, and risk not getting a power cycle event to get the host(s) back up, set power.ups.upsmon.settings.POWERDOWNFLAG = null;.

nixos-firewall-tool now supports nftables in addition to iptables and is installed by default when NixOS firewall is enabled.

Support for runner registration tokens has been deprecated in gitlab-runner 15.6 and is expected to be removed in gitlab-runner 18.0. Configuration of existing runners should be changed to using runner authentication tokens by configuring services.gitlab-runner.services.<name>.authenticationTokenConfigFile instead of the former services.gitlab-runner.services.<name>.registrationConfigFile option.

iproute2 now has libbpf support.

If you use extensions that are not packaged in nixpkgs, please review whether it still works with the current settings and adjust accordingly if needed.

nix.channel.enable = false no longer implies nix.settings.nix-path = []. Since Nix 2.13, a nix-path set in nix.conf cannot be overridden by the NIX_PATH configuration variable.

ZFS now imports its pools in postResumeCommands rather than postDeviceCommands. If you had postDeviceCommands scripts that depended on ZFS pools being imported, those now need to be in postResumeCommands.

services.automatic-timezoned.enable = true will now set time.timeZone = null. This is to avoid silently shadowing a user’s explicitly defined timezone without recognition on the user’s part.

services.localtimed.enable = true will now set time.timeZone = null. This is to avoid silently shadowing a user’s explicitly defined timezone without recognition on the user’s part.

qgis and qgis-ltr are now built without grass by default. grass support can be enabled with qgis.override { withGrass = true; }.

virtualisation.incus module gained new incus-user.service and incus-user.socket systemd units. It is now possible to add a user to incus group instead of incus-admin for increased security.

buildDotnetModule now uses JSON-based instead of nix-based lockfiles. Support for nix-based lockfiles has been deprecated and will be dropped on release 25.11.

buildDotnetModule.fetch-deps now generates a JSON lockfile by default. A nix-based lockfile will be generated if one existed before for compatibility, however it has been deprecated and will be dropped on release 25.11.

freecad now supports addons and custom configuration in nix-way, which can be used by calling freecad.customize.

buildNimSbom was added as an alternative to buildNimPackage. buildNimSbom uses SBOMs to generate packages whereas buildNimPackage uses a custom JSON lockfile format.

The default kernel package has been updated from 6.1 to 6.6. All supported kernels remain available.

For each supporting version of the Linux kernel, firmware blobs are compressed with zstd. For firmware blobs this means an increase of 4.4% in size, however a significantly higher decompression speed.

NixOS now installs a stub ELF loader that prints an informative error message when users attempt to run binaries not made for NixOS.

On flake-based NixOS configurations using nixpkgs.lib.nixosSystem, NixOS will automatically set NIX_PATH and the system-wide flake registry (/etc/nix/registry.json) to point <nixpkgs> and the unqualified flake path nixpkgs to the version of nixpkgs used to build the system.

This makes nix run nixpkgs#hello and nix-build '<nixpkgs>' -A hello work out of the box with no added configuration, reusing dependencies already on the system.

This may be undesirable if Nix commands are not going to be run on the built system since it adds nixpkgs to the system closure. For such closure-size-constrained non-interactive systems, this setting should be disabled.

To disable it, set nixpkgs.flake.setNixPath and nixpkgs.flake.setFlakeRegistry to false.

NixOS AMIs are now uploaded regularly to a new AWS Account. Instructions on how to use them can be found on https://nixos.github.io/amis. We are working on integrating the data into the NixOS homepage. The list in nixos/modules/virtualisation/amazon-ec2-amis.nix will stop being updated and will be removed in the future.

It is now possible to have a completely perlless system (i.e. a system without perl). Previously, the NixOS activation depended on two perl scripts which can now be replaced via an opt-in mechanism. To make your system perlless, you can use the new perlless profile:

{ modulesPath, ... }:
{
  imports = [ "${modulesPath}/profiles/perlless.nix" ];
}

Cinnamon has been updated to 6.0. Please be aware that the Wayland session is still experimental in this release and could potentially affect Xorg sessions. We suggest a reboot when switching between sessions.

GNOME has been updated to 46 “Kathmandu”. Refer to the release notes for more details. Notably this release brings experimental VRR support, default GTK renderer changes and WebDAV support in Online Accounts. This release we have also stopped including the legacy and unsupported Adwaita-Dark theme by default.

Lomiri (formerly known as Unity8) desktop mode, using Mir 2.x to function as a Wayland compositor, is now available and can be installed with services.desktopManager.lomiri.enable = true. Note that some core applications, services and indicators have yet to be packaged, and some functions may remain incomplete, but the base experience should be there.

LXQt has been updated to 2.0, which is based on Qt 6 and features Wayland support for many applications.

MATE has been updated to 1.28.

Plasma 6 is now available and can be installed with services.desktopManager.plasma6.enable = true;. Plasma 5 will likely be deprecated in the next release (24.11). Note that Plasma 6 runs as Wayland by default, and the X11 session needs to be explicitly selected if necessary.

Anki Sync Server, the official sync server built into recent versions of Anki. Available as services.anki-sync-server. The pre-existing services.ankisyncd has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the ankisyncd software.

ALVR, a VR desktop streamer. Available as programs.alvr.

AppImage, a tool to package desktop applications, now has a binfmt option to support running AppImages seamlessly on NixOS. Available as programs.appimage.binfmt.

armagetronad, a mid-2000s 3D lightcycle game widely played at iD Tech Camps. You can define multiple servers using services.armagetronad.<server>.enable.

BenchExec, a framework for reliable benchmarking and resource measurement, available as programs.benchexec, as well as related programs CPU Energy Meter, available as programs.cpu-energy-meter, and PQoS Wrapper, available as programs.pqos-wrapper.

Bluemap, a 3D minecraft map renderer. Available as services.bluemap.

clatd, a CLAT / SIIT-DC Edge Relay implementation for Linux.

Clevis, a pluggable framework for automated decryption, used to unlock encrypted devices in initrd. Available as boot.initrd.clevis.enable.

CommaFeed, a Google Reader-inspired self-hosted RSS reader. Available as services.commafeed.

davis, a simple CardDav and CalDav server inspired by Baïkal. Available as services.davis.

db-rest, a wrapper around Deutsche Bahn’s internal API for public transport data. Available as services.db-rest.

dnsproxy, a simple DNS proxy with DoH, DoT, DoQ and DNSCrypt support. Available as services.dnsproxy.

FCast Receiver, an open-source alternative to Chromecast and AirPlay. Available as programs.fcast-receiver.

FileSender, a file sharing software. Available as services.filesender.

Firefly-iii, a free and open source personal finance manager. Available as services.firefly-iii.

Flarum, a delightfully simple discussion platform for your website. Available as services.flarum.

fritz-exporter, a Prometheus exporter for extracting metrics from FRITZ! devices. Available as services.prometheus.exporters.fritz.

GNS3, a network software emulator. Available as services.gns3-server.

go-camo, a secure image proxy server. Available as services.go-camo.

Guix, a functional package manager inspired by Nix. Available as services.guix.

Handheld Daemon, support for gaming handhelds like the Legion Go, ROG Ally, and GPD Win. Available as services.handheld-daemon.

hebbot, a Matrix bot to generate “This Week in X” like blog posts. Available as services.hebbot.

inadyn, a Dynamic DNS client with built-in support for multiple providers. Available as services.inadyn.

intel-gpu-tools, tools for development and testing of the Intel DRM driver. Available as hardware.intel-gpu-tools.

isolate, a sandbox for securely executing untrusted programs. Available as security.isolate.

Jottacloud Command-line Tool, a CLI for the Jottacloud cloud storage provider. Available as services.jotta-cli.

keto, a permission & access control server, the first open source implementation of Zanzibar: Google’s Consistent, Global Authorization System.

manticoresearch, easy to use open source fast database for search. Available as services.manticore.

maubot, a plugin-based Matrix bot framework. Available as services.maubot.

mautrix-meta, a Matrix <-> Facebook and Matrix <-> Instagram hybrid puppeting/relaybot bridge. Available as services.mautrix-meta.

mautrix-signal, a Matrix-Signal puppeting bridge. Available as services.mautrix-signal.

Mealie, a self-hosted recipe manager and meal planner with a RestAPI backend and a reactive frontend application built in NuxtJS for a pleasant user experience for the whole family. Available as services.mealie.

MollySocket which allows getting Signal notifications via UnifiedPush.

microsocks, a tiny, portable SOCKS5 server with very moderate resource usage. Available as services.microsocks.

Mihomo, a rule-based proxy in Go. Available as services.mihomo.enable.

Monado, an open source XR runtime. Available as services.monado.

Netbird, an open-source VPN management platform, now has a self-hosted management server. Available as services.netbird.server.

nh, yet another Nix CLI helper. Available as programs.nh.

oink, a dynamic DNS client for Porkbun. Available as services.oink.

ollama, server for running large language models locally.

nextjs-ollama-llm-ui, light-weight frontend server to chat with Ollama models through a web app.

ownCloud Infinite Scale Stack, a modern and scalable rewrite of ownCloud.

PhotonVision, a free, fast, and easy-to-use computer vision solution for the FIRST® Robotics Competition.

ping_exporter, a Prometheus exporter for ICMP echo requests. Available as services.prometheus.exporters.ping.

Pretix, an open source ticketing software for events. Available as services.pretix.

pretalx, a conference planning tool. Available as services.pretalx.

private-gpt, a service to interact with your documents using the power of LLMs, 100% privately, no data leaks.

Prometheus DNSSEC Exporter: check for validity and expiration in DNSSEC signatures and expose metrics for Prometheus. Available as services.prometheus.exporters.dnssec.

prometheus-nats-exporter, a Prometheus exporter for NATS. Available as services.prometheus.exporters.nats.

pyLoad, a FOSS download manager written in Python. Available as services.pyload.

Python Matter Server, a Matter Controller Server exposing websocket connections for use with other services, notably Home Assistant. Available as services.matter-server.

RustDesk, a full-featured open source remote control alternative for self-hosting and security with minimal configuration. Alternative to TeamViewer. Available as services.rustdesk-server.

ryzen-monitor-ng, a desktop AMD CPU power monitor and controller, similar to Ryzen Master but for Linux. Available as programs.ryzen-monitor-ng.

ryzen-smu, Linux kernel driver to expose the SMU (System Management Unit) for certain AMD Ryzen Processors. Includes the userspace program monitor_cpu. Available at hardware.cpu.amd.ryzen-smu.

Scrutiny, a S.M.A.R.T monitoring tool for hard disks with a web frontend. Available as services.scrutiny.

SimpleSAMLphp, an application written in native PHP that deals with authentication (SQL, .htpasswd, YubiKey, LDAP, PAPI, Radius). Available as services.simplesamlphp.

systemd’s gateway, upload, and remote services, which provide ways of sending journals across the network. Enable using services.journald.gateway, services.journald.upload, and services.journald.remote.

systemd-lock-handler, a bridge between logind D-Bus events and systemd targets. Available as services.systemd-lock-handler.enable.

rspamd-trainer, script triggered by a helper which reads mails from a specific mail inbox and feeds them into rspamd for spam/ham training.

Sunshine, a self-hosted game stream host for Moonlight. Available as services.sunshine.

Suwayomi Server, a free and open source manga reader server that runs extensions built for Tachiyomi. Available as services.suwayomi-server.

TigerBeetle, a distributed financial accounting database designed for mission critical safety and performance. Available as services.tigerbeetle.

transfer-sh, a tool that supports easy and fast file sharing from the command-line. Available as services.transfer-sh.

TuxClocker, a hardware control and monitoring program. Available as programs.tuxclocker.

Uni-Sync, a synchronization tool for Lian Li Uni Controllers. Available as hardware.uni-sync.

wastebin, a pastebin server written in rust. Available as services.wastebin.

watchdogd, a system and process supervisor using watchdog timers. Available as services.watchdogd.

WiVRn, an OpenXR streaming application. Available as services.wivrn.

Workout-tracker, a workout tracking web application for personal use.

wyoming-satellite, a voice assistant satellite for Home Assistant using the Wyoming protocol. Available as services.wyoming.satellite.

xdg-terminal-exec, the proposed Default Terminal Execution Specification.

Convenience options for amdgpu, open source driver for Radeon cards, is now available under hardware.amdgpu.

ydotool, a generic command-line automation tool now has a module. Available as programs.ydotool.

your_spotify, a self hosted Spotify tracking dashboard. Available as services.your_spotify

RKE2, also known as RKE Government, is Rancher’s next-generation Kubernetes distribution. Available as services.rke2.

akkoma now requires explicitly setting the base URL for uploaded media (settings."Pleroma.Upload".base_url), as well as for the media proxy if enabled (settings."Media"). This is recommended to be a separate (sub)domain to the one Akkoma is hosted at. See here for more details.

appimageTools.wrapAppImage now creates the binary at $out/bin/${pname} rather than $out/bin/${pname}-${version}, which will break downstream workarounds.

apptainer and singularity now prioritize system-wide PATH over those constructed from dependent packages when searching for third-party utilities. The PATH to search for third-party utilities, known as defaultPath inside Apptainer/Singularity source code, is now constructed from the following sources, ordered by their precedence:

This change is required to enable Sylabs SingularityCE (singularity) to run images, as it requires a fusermount3 command with the SUID bit set.

newuidmapPath and newgidmapPath arguments are deprecated in favour of systemBinPaths. Their support will be removed in future releases.

programs.singularity.systemBinPaths option is introduced to specify the systemBinPaths argument of the overridden package. It includes "/run/wrappers/bin" even if specified empty.

programs.singularity.enableFakeroot option is deprecated and has no effect. --fakeroot support is now always enabled as long as programs.singularity.systemBinPaths is not forcefully overridden.

azure-cli now has extension support. For example, to install the aks-preview extension, use

{
  environment.systemPackages = [ (azure-cli.withExtensions [ azure-cli.extensions.aks-preview ]) ];
}

To make the azure-cli immutable and prevent clashes in case azure-cli is also installed via other package managers, some configuration files were moved into the derivation. This can be disabled by overriding withImmutableConfig = false when building azure-cli.

boot.supportedFilesystems and boot.initrd.supportedFilesystems are now attribute sets instead of lists. Assignment from lists as done previously is still supported, but checking whether a filesystem is enabled must now by done using supportedFilesystems.fs or false instead of using lib.elem "fs" supportedFilesystems as was done previously.

buildGoModule now throws an error when vendorHash is not specified. vendorSha256, deprecated in Nixpkgs 23.11, is now ignored and is no longer a vendorHash alias.

chromium and ungoogled-chromium had a long-standing issue regarding Widevine DRM handling in nixpkgs fixed. chromium now no longer automatically downloads Widevine when encountering DRM protected content. To be able to play DRM protected content in chromium, you now have to explicitly opt-in as originally intended using chromium.override { enableWideVine = true; }. This override was added almost 10 years ago.

craftos-pc package has been updated to v2.8, which includes breaking changes.

cryptsetup has been upgraded from 2.6.1 to 2.7.0. Cryptsetup is a critical component enabling LUKS-based (but not only) full disk encryption. Take the time to review the release notes. One of the highlights is that it is now possible to use hardware OPAL-based encryption of your disk with cryptsetup. It has a lot of caveats, see the above notes for the full details.

crystal package has been updated to 1.11.x, which has some breaking changes. Refer to crystal’s changelog for more information. (v1.10, v1.11)

cudaPackages package scope has been updated to cudaPackages_12.

cudaPackages.autoAddOpenGLRunpathHook and cudaPackages.autoAddDriverRunpath have been deprecated for pkgs.autoAddDriverRunpath. Functionality has not changed, but the setuphook has been renamed and moved to the top-level package scope.

cudaPackages.cudatoolkit has been deprecated and replaced with a symlink-based wrapper for the splayed redistributable CUDA packages. The wrapper only includes tools and libraries necessary to build common packages such as tensorflow. The original runfile-based cudatoolkit is still available as cudatoolkit-legacy-runfile.

cudaPackages.nsight_systems now has most vendored third-party libraries removed, though we now only ship it for cudaPackages_11_8 and later, due to outdated dependencies. Users comfortable with the vendored dependencies may use overrideAttrs to amend the postPatch phase and the meta.broken correspondingly. Alternatively, one could package the deprecated boost170 locally, as required for cudaPackages_11_4.nsight_systems.

cudaPackages.autoFixElfFiles has been deprecated for pkgs.autoFixElfFiles. Functionality has not changed, but the setuphook has been renamed and moved to the top-level package scope.

davfs2’s services.davfs2.extraConfig setting has been deprecated and converted to the free-form type option named services.davfs2.settings according to RFC42.

dwarf-fortress has been updated to version 50, which is identical to the version on Steam, but without the paid elements like tilepacks. dfhack and Dwarf Therapist still work, and older versions are still packaged in case you’d like to roll back. Note that DF 50 saves will not be compatible with DF 0.47 and earlier. See Bay 12 Games for more details on what’s new in Dwarf Fortress.

erlang-ls package no longer ships the els_dap binary as of v0.51.0.

erlang_node_short_name, erlang_node_name: port and options configuration parameters are gone, and have been replaced with an environment parameter. Use the appropriate environment variables inside environment to configure the service instead.

firefox-devedition, firefox-beta, firefox-esr executable file names for now match their package names, which is consistent with the firefox-*-bin packages. The desktop entries are also updated so that you can have multiple editions of firefox in your app launcher.

gauge now supports installing plugins using Nix. For the old imperative approach, switch to gauge-unwrapped. You can load plugins from an existing gauge manifest file using gauge.fromManifest ./path/to/manifest.json or specify plugins in Nix using gauge.withPlugins (p: with p; [ js html-report xml-report ]).

gitea has been updated to 1.21, which introduces several breaking changes, including:

git-town was updated from version 11 to 13. See the changelog for breaking changes.

gonic has been updated to v0.16.4. Config now requires playlists-path to be set. See the rest of the v0.16.0 release notes for more details.

go-ethereum has been updated to v1.14.3. Geth v1.14.0 introduced a brand new live-tracing feature, which required a number of breaking internal API changes. If you had your own native tracers implemented before this change, the changelog contains the necessary steps needed to update your old code for the new APIs. Geth v1.14.0 drops support for running pre-merge networks (#29169). It also stops automatically constructing the pending block (#28623), removes support for filtering pending logs, switched to using Go v1.22 by default (#28946), which means we’ve dropped support for Go v1.20. See the 1.14.0 release notes for more details.

grafana-loki has been updated to 3.0.0, which includes breaking changes.

gtest package has been updated past v1.13.0, which requires C++14 or higher.

hare may now be cross-compiled. For that to work, however, haredoc needed to stop being built together with it. Thus, the latter is now its own package with the name of haredoc.

himalaya has been updated to v1.0.0-beta.4, which introduces breaking changes. Check out the release note for details.

halloy has been updated to 2024.5, which introduced a breaking change by switching the config format from YAML to TOML. See https://github.com/squidowl/halloy/releases/tag/2024.5 for details.

hvm was updated to version 2.

icu no longer includes install-sh and mkinstalldirs in the shared folder.

idris2 was updated to v0.7.0. This version introduces breaking changes. Check out the changelog for details.

inetutils now has a lower priority to avoid shadowing the commonly-used util-linux. If one wishes to restore the default priority, simply use lib.setPrio 5 inetutils or override with meta.priority = 5.

jdt-language-server package now uses upstream’s provided python wrapper instead of our own custom wrapper. This results in the following breaking and notable changes:

julia environments can now be built with arbitrary packages from the ecosystem using the .withPackages function. For example: julia.withPackages ["Plots"].

k3s has been updated to version v1.30, previous supported versions are available under release-specific names (e.g. k3s_1_27, k3s_1_28, and k3s_1_29) in order to help you migrate to the latest supported version. See changelog and upgrade notes for more information.

k9s was updated to v0.31. There have been various breaking changes in the config file format, check out the changelog of v0.29, v0.30 and v0.31 for details. It is recommended to back up your current configuration and let k9s recreate the new base configuration.

kanata package has been updated to v1.6.1, which includes breaking changes. Check out the changelog of v1.5.0 and v1.6.0 for details.

linuxPackages_testing_bcachefs is now fully deprecated by linuxPackages_latest, and is therefore no longer available.

livebook package is now built as a mix release instead of an escript. This means that configuration now has to be done using environment variables instead of command line arguments. This has the further consequence that the livebook service configuration has changed.

lua interpreters default LUA_PATH and LUA_CPATH are not overridden by nixpkgs anymore, we patch LUA_ROOT instead which is more respectful to upstream.

luarocks-packages-updater’s .csv format, used to define lua packages to be updated, has changed: src (URL of a git repository) has now become rockspec (URL of a rockspec) to remove ambiguity regarding which rockspec to use and simplify implementation.

mkosi was updated to v22. Parts of the user interface have changed. Consult the release notes of v19, v20, v21 and v22 for a list of changes.

mongodb-4_4 has been removed as it has reached end of life. Consequently, unifi7 and unifi8 now use MongoDB 5.0 by default.

mongodb-5_0 and newer requires a cpu with the AVX instruction set to run.

neo4j has been updated to version 5. You may want to read the release notes for Neo4j 5.

netbox was updated to v3.7. services.netbox.package still defaults to v3.6 if stateVersion is earlier than 24.05. Refer to upstream’s breaking changes for v3.7.0 and upgrade NetBox by changing services.netbox.package. Database migrations will be run automatically.

network-interfaces.target system target was removed as it has been deprecated for a long time. Use network.target instead.

networking.iproute2.enable now does not set environment.etc."iproute2/rt_tables".text.

Setting environment.etc."iproute2/{CONFIG_FILE_NAME}".text will override the whole configuration file instead of appending it to the upstream configuration file.

CONFIG_FILE_NAME includes bpf_pinning, ematch_map, group, nl_protos, rt_dsfield, rt_protos, rt_realms, rt_scopes, and rt_tables.

nextcloud26 has been removed since it’s not maintained anymore by upstream. The latest available version of Nextcloud is now v29 (available as pkgs.nextcloud29). The installation logic is as follows:

nitter requires a guest_accounts.jsonl to be provided as a path or loaded into the default location at /var/lib/nitter/guest_accounts.jsonl. See Guest Account Branch Deployment for details.

nixVersions.unstable was removed. Instead the following attributes are provided:

nomad has been updated - note that HashiCorp recommends updating one minor version at a time. Please check their upgrade guide for information on safely updating clusters and potential breaking changes.

nvtop family of packages was reorganized into a nested attrset. nvtop has been renamed to nvtopPackages.full, and all nvtop-{amd,nvidia,intel,msm} packages are renamed to nvtopPackages.{amd,nvidia,intel,msm}.

openssh, openssh_hpn and openssh_gssapi are now compiled without support for the DSA signature algorithm as it is being deprecated upstream. Users still relying on DSA keys should consider upgrading to another signature algorithm. However, for the time being it is possible to restore DSA key support using override to set dsaKeysSupport = true.

optparse-bash is now dropped due to upstream inactivity. Alternatives available in Nixpkgs include argc, argbash, bashly and gum, to name a few.

paperless’ services.paperless.extraConfig setting has been removed and converted to the free-form type and option named services.paperless.settings.

pdns was updated to version v4.9.x, which introduces breaking changes. Check out the Upgrade Notes for details.

percona-server now follows the same two-fold release cycle as Oracle MySQL and provides a Long-Term-Support (LTS) in parallel with a continuous-delivery Innovation release. percona-server defaults to percona-server_lts, will be backed by the same release branch throughout the lifetime of this stable NixOS release, and is still available under the versioned attribute percona-server_8_0. The percona-server_innovation releases however have support periods shorter than the lifetime of this NixOS release and will continuously be updated to newer Percona releases. Note that Oracle considers the Innovation releases to be production-grade, but each release might include backwards-incompatible changes, even in its on-disk format. The same release scheme is applied to the supporting percona-xtrabackup tool as well.

pipewire and wireplumber modules have removed support for using environment.etc."pipewire/..." and environment.etc."wireplumber/...". Use services.pipewire.extraConfig or services.pipewire.configPackages for PipeWire and services.pipewire.wireplumber.configPackages for WirePlumber instead.

power.ups now generates upsd.conf, upsd.users and upsmon.conf automatically from a set of new configuration options. This breaks compatibility with existing power.ups setups where these files were created manually. Back up these files before upgrading NixOS.

programs.nix-ld.libraries no longer sets baseLibraries via the option’s default but in config and now merges any additional libraries with the default ones. This means that lib.mkForce must be used to clear the list of default libraries.

screen’s module has been cleaned, and will now require you to set programs.screen.enable in order to populate screenrc and add the program to the environment.

security.acme.defaults.server now has a default value instead of null. This effectively uses the same server, the Let’s Encrypt production server, but makes the default explicit, instead of relying on the Lego default.

A side effect of this is that the directory in which account data is stored changes and the ACME module will request a new account and new certificates for all domains. This may cause issues if you pin an acccounturl in a CAA DNS record. To avoid this, you may set security.acme.defaults.server = null to keep the old hashes.

security.pam.sshAgentAuth.enable now requires services.openssh.authorizedKeysFiles to be non-empty, which is the case when services.openssh.enable is true. Previously, pam_ssh_agent_auth silently failed to work.

security.pam.enableSSHAgentAuth was replaced by the sshAgentAuth attrset, and only authorized_keys files listed in sshAgentAuth.authorizedKeysFiles are trusted, defaulting to /etc/ssh/authorized_keys.d/%u.

services.archisteamfarm no longer uses the abbreviation asf for its state directory (/var/lib/asf), user and group (both asf). Instead the long name archisteamfarm is used. Configurations with system.stateVersion 23.11 or earlier, default to the old stateDirectory until the 24.11 release and must either set the option explicitly or move the data to the new directory.

frr was updated to 10.0, which introduces the default of enforce-first-as for BGP. Please disable again if needed.

services.aria2.rpcSecret has been replaced with services.aria2.rpcSecretFile. This was done so that secrets aren’t stored in the world-readable Nix store. To migrate, you will have to create a file with the same exact string, and change your module options to point to that file. For example, services.aria2.rpcSecret = "mysecret" becomes services.aria2.rpcSecretFile = "/path/to/secret_file" where the file secret_file contains the string mysecret.

services.avahi.nssmdns was split into services.avahi.nssmdns4 and services.avahi.nssmdns6 which enable the mDNS NSS switches for IPv4 and IPv6 respectively. Since most mDNS responders only register IPv4 addresses, most users want to keep the IPv6 support disabled to avoid long timeouts.

services.frp.settings now generates the frp configuration file in TOML format as recommended by upstream, instead of the legacy INI format. This has also introduced other changes in the configuration file structure and options:

services.hledger-web.capabilities options has been replaced by a new option services.hledger-web.allow.

services.homepage-dashboard now takes its configuration using native Nix expressions, rather than dumping templated configurations into /var/lib/homepage-dashboard where they were previously managed manually. There are now new options which allow the configuration of bookmarks, services, widgets and custom CSS/JS natively in Nix.

services.invidious.settings.db.user, the default database username has changed from kemal to invidious. Setups involving an externally-provisioned database (i.e. services.invidious.database.createLocally == false) should adjust their configuration accordingly. The old kemal user will not be removed automatically even when the database is provisioned automatically.(https://github.com/NixOS/nixpkgs/pull/265857).

services.oauth2_proxy was renamed to services.oauth2-proxy. Also the corresponding service, user and group were renamed.

services.smokeping now has an option webService. When enabled, smokeping is now served via nginx instead of thttpd. This change brings the following consequences:

services.neo4j.allowUpgrade was removed and no longer has any effect. Neo4j 5 supports automatic rolling upgrades.

services.nextcloud has the following options moved into services.nextcloud.settings and renamed to match the name from Nextcloud’s config.php:

services.nginx will no longer advertise HTTP/3 availability automatically. This must now be manually added, preferably to each location block. Example:

{
  locations."/".extraConfig = ''
    add_header Alt-Svc 'h3=":$server_port"; ma=86400';
  '';
  locations."^~ /assets/".extraConfig = ''
    add_header Alt-Svc 'h3=":$server_port"; ma=86400';
  '';
}

services.pgbouncer now has systemd support enabled and will log to journald. The default setting for services.pgbouncer.logFile is now null to disable logging to a separate log file.

services.postgresql.ensureUsers._.ensurePermissions has been removed as it is not declarative and is broken with newer postgresql versions. Consider using services.postgresql.ensureUsers.*.ensureDBOwnership instead or a tool that is more suited for managing the data inside a postgresql database.

services.redis.vmOverCommit now defaults to true and no longer enforces Transparent Hugepages (THP) to be disabled. Redis only works with THP configured to madvise which is the kernel’s default.

services.resolved.fallbackDns

services.vikunja systemd service now uses vikunja as dynamic user instead of vikunja-api. Database users might need to be changed.

services.vikunja.setupNginx setting has been removed. Users now need to set up the webserver configuration on their own with a proxy pass to the vikunja service.

services.vmagent module deprecates dataDir, group and user settings in favor of the systemd-provided CacheDirectory and DynamicUser.

services.vmagent.remoteWriteUrl setting has been renamed to services.vmagent.remoteWrite.url and now defaults to null.

services.zope2 has been removed, as zope2 is unmaintained and was relying on Python 2.

spark2014 has been renamed to gnatprove. A version of gnatprove matching different GNAT versions is available from the different gnatPackages sets.

stalwart-mail has been updated to v0.5.3, which includes breaking changes.

system.etc.overlay.enable option was added. If enabled, /etc is mounted via an overlayfs instead of being created by a custom perl script.

system.forbiddenDependenciesRegex has been renamed to system.forbiddenDependenciesRegexes and now has the type of listOf string instead of string to accept multiple regexes.

systemd.oomd module behavior has changed:

systemd.sysusers.enable option was added. If enabled, users and groups are created with systemd-sysusers instead of with a custom perl script.

teleport has been upgraded from major version 14 to major version 15. Refer to upstream upgrade instructions and release notes for v15.

unifiLTS, unifi5 and unifi6 have been removed, as they require MongoDB versions which are end-of-life. All these versions can be upgraded to unifi7 directly.