[staging] staging-next merge

.github/workflows/eval.yml

@@ -210,7 +210,7 @@ jobs:
             --arg beforeResultDir ./baseResult \
             --arg afterResultDir ./prResult \
             -o comparison
-
+          cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"
           # TODO: Request reviews from maintainers for packages whose files are modified in the PR
 
       - name: Upload the combined results

ci/eval/default.nix

@@ -261,6 +261,7 @@ let
           --slurpfile after ${afterResultDir}/outpaths.json \
           > $out/changed-paths.json
 
+        jq -r -f ${./generate-step-summary.jq} < $out/changed-paths.json > $out/step-summary.md
         # TODO: Compare eval stats
       '';
 

ci/eval/generate-step-summary.jq

@@ -0,0 +1,15 @@
+def truncate(xs; n):
+  if xs | length > n then xs[:n] + ["..."]
+  else xs
+  end;
+
+def itemize_packages(xs):
+  # we truncate the list to stay below the GitHub limit of 1MB per step summary.
+  truncate(xs; 3000) | map("- [\(.)](https://search.nixos.org/packages?channel=unstable&show=\(.)&from=0&size=50&sort=relevance&type=packages&query=\(.))") | join("\n");
+
+def section(title; xs):
+  "<details> <summary>" + title + " (" + (xs | length | tostring) + ")</summary>\n\n" + itemize_packages(xs) + "</details>";
+
+section("Added packages"; .attrdiff.added) + "\n\n" +
+section("Removed packages"; .attrdiff.removed) + "\n\n" +
+section("Changed packages"; .attrdiff.changed)

maintainers/maintainer-list.nix

@@ -18732,6 +18732,12 @@
     github = "ribose-jeffreylau";
     githubId = 2649467;
   };
+  ribru17 = {
+    name = "Riley Bruins";
+    email = "ribru17@hotmail.com";
+    github = "ribru17";
+    githubId = 55766287;
+  };
   ricarch97 = {
     email = "ricardo.steijn97@gmail.com";
     github = "RicArch97";

nixos/doc/manual/installation/installing-from-other-distro.section.md

@@ -160,6 +160,18 @@ The first steps to all these are the same:
     Refer to the `nixos-generate-config` step in
     [](#sec-installation) for more information.
 
+    ::: {.note}
+    On [UEFI](https://en.wikipedia.org/wiki/UEFI) systems, check that your `/etc/nixos/hardware-configuration.nix` did the right thing with the [EFI System Partition](https://en.wikipedia.org/wiki/EFI_system_partition).
+    In NixOS, by default, both [systemd-boot](https://systemd.io/BOOT/) and [grub](https://www.gnu.org/software/grub/index.html) expect it to be mounted on `/boot`.
+    However, the configuration generator bases its [](#opt-fileSystems) configuration on the current mount points at the time it is run.
+    If the current system and NixOS's bootloader configuration don't agree on where the [EFI System Partition](https://en.wikipedia.org/wiki/EFI_system_partition) is to be mounted, you'll need to manually alter the mount point in `hardware-configuration.nix` before building the system closure.
+    :::
+
+    ::: {.note}
+    The lustrate process will not work if the [](#opt-boot.initrd.systemd.enable) option is set to `true`.
+    If you want to use this option, wait until after the first boot into the NixOS system to enable it and rebuild.
+    :::
+
     You'll likely want to set a root password for your first boot using
     the configuration files because you won't have a chance to enter a
     password until after you reboot. You can initialize the root password
@@ -231,26 +243,46 @@ The first steps to all these are the same:
     $ echo etc/nixos | sudo tee -a /etc/NIXOS_LUSTRATE
     ```
 
-1.  Finally, move the `/boot` directory of your current distribution out
-    of the way (the lustrate process will take care of the rest once you
-    reboot, but this one must be moved out now because NixOS needs to
-    install its own boot files:
+1.  Finally, install NixOS's boot system, backing up the current boot system's files in the process.
+
+    The details of this step can vary depending on the bootloader configuration in NixOS and the bootloader in use by the current system.
+
+    The commands below should work for:
+
+    - [BIOS](https://en.wikipedia.org/wiki/BIOS) systems.
+
+    - [UEFI](https://en.wikipedia.org/wiki/UEFI) systems where both the current system and NixOS mount the [EFI System Partition](https://en.wikipedia.org/wiki/EFI_system_partition) on `/boot`.
+      Both [systemd-boot](https://systemd.io/BOOT/) and [grub](https://www.gnu.org/software/grub/index.html) expect this by default in NixOS, but other distributions vary.
+
+    ::: {.warning}
+    Once you complete this step, your current distribution will no longer be bootable!
+    If you didn't get all the NixOS configuration right, especially those settings pertaining to boot loading and root partition, NixOS may not be bootable either.
+    Have a USB rescue device ready in case this happens.
+    :::
 
     ::: {.warning}
-    Once you complete this step, your current distribution will no
-    longer be bootable! If you didn't get all the NixOS configuration
-    right, especially those settings pertaining to boot loading and root
-    partition, NixOS may not be bootable either. Have a USB rescue
-    device ready in case this happens.
+    On [UEFI](https://en.wikipedia.org/wiki/UEFI) systems, anything on the [EFI System Partition](https://en.wikipedia.org/wiki/EFI_system_partition) will be removed by these commands, such as other coexisting OS's bootloaders.
     :::
 
     ```ShellSession
-    $ sudo mv -v /boot /boot.bak &&
-    sudo /nix/var/nix/profiles/system/bin/switch-to-configuration boot
+    $ sudo mkdir /boot.bak && sudo mv /boot/* /boot.bak &&
+    sudo NIXOS_INSTALL_BOOTLOADER=1 /nix/var/nix/profiles/system/bin/switch-to-configuration boot
     ```
 
     Cross your fingers, reboot, hopefully you should get a NixOS prompt!
 
+    In other cases, most commonly where the [EFI System Partition](https://en.wikipedia.org/wiki/EFI_system_partition) of the current system is instead mounted on `/boot/efi`, the goal is to:
+
+    - Make sure `/boot` (and the [EFI System Partition](https://en.wikipedia.org/wiki/EFI_system_partition), if mounted elsewhere) are mounted how the NixOS configuration would mount them.
+
+    - Clear them of files related to the current system, backing them up outside of `/boot`.
+      NixOS will move the backups into `/old-root` along with everything else when it first boots.
+
+    - Instruct the NixOS closure built earlier to install its bootloader with:
+      ```ShellSession
+      sudo NIXOS_INSTALL_BOOTLOADER=1 /nix/var/nix/profiles/system/bin/switch-to-configuration boot
+      ```
+
 1.  If for some reason you want to revert to the old distribution,
     you'll need to boot on a USB rescue disk and do something along
     these lines:

nixos/modules/installer/cd-dvd/installation-cd-base.nix

@@ -42,5 +42,11 @@
     done
   '';
 
+  environment.defaultPackages = with pkgs; [
+    rsync
+  ];
+
+  programs.git.enable = lib.mkDefault true;
+
   system.stateVersion = lib.mkDefault lib.trivial.release;
 }

nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix

@@ -49,10 +49,6 @@
     vim
     nano
 
-    # Include some version control tools.
-    git
-    rsync
-
     # Firefox for reading the manual.
     firefox
 

nixos/modules/installer/sd-card/sd-image-raspberrypi.nix

@@ -17,6 +17,10 @@
   sdImage = {
     populateFirmwareCommands = let
       configTxt = pkgs.writeText "config.txt" ''
+        # u-boot refuses to start (gets stuck at rainbow polygon) without this,
+        # at least on Raspberry Pi 0.
+        enable_uart=1
+
         # Prevent the firmware from smashing the framebuffer setup done by the mainline kernel
         # when attempting to show low-voltage or overtemperature warnings.
         avoid_warnings=1
@@ -28,7 +32,7 @@
         kernel=u-boot-rpi1.bin
       '';
       in ''
-        (cd ${pkgs.raspberrypifw}/share/raspberrypi/boot && cp bootcode.bin fixup*.dat start*.elf $NIX_BUILD_TOP/firmware/)
+        (cd ${pkgs.raspberrypifw}/share/raspberrypi/boot && cp bootcode.bin fixup*.dat start*.elf *.dtb $NIX_BUILD_TOP/firmware/)
         cp ${pkgs.ubootRaspberryPiZero}/u-boot.bin firmware/u-boot-rpi0.bin
         cp ${pkgs.ubootRaspberryPi}/u-boot.bin firmware/u-boot-rpi1.bin
         cp ${configTxt} firmware/config.txt

nixos/modules/profiles/installation-device.nix

@@ -74,8 +74,8 @@ with lib;
     # installation device for head-less systems i.e. arm boards by manually
     # mounting the storage in a different system.
     services.openssh = {
-      enable = true;
-      settings.PermitRootLogin = "yes";
+      enable = mkDefault true;
+      settings.PermitRootLogin = mkDefault "yes";
     };
 
     # Enable wpa_supplicant, but don't start it by default.

nixos/modules/security/acme/mk-cert-ownership-assertion.nix

@@ -6,7 +6,7 @@ let
 
   svcGroups = svc:
     (lib.optional (svc.serviceConfig ? Group) svc.serviceConfig.Group)
-    ++ (svc.serviceConfig.SupplementaryGroups or [ ]);
+    ++ lib.toList (svc.serviceConfig.SupplementaryGroups or [ ]);
 in
 {
   assertion = builtins.all (svc:

nixos/modules/services/networking/hostapd.nix

@@ -1001,7 +1001,7 @@ in {
                     "20-addMacAllowFromSaeFile" = mkIf (bssCfg.authentication.saeAddToMacAllow && bssCfg.authentication.saePasswordsFile != null) (pkgs.writeShellScript "add-mac-allow-from-sae-file" ''
                       MAC_ALLOW_FILE=$2
                       grep mac= ${escapeShellArg bssCfg.authentication.saePasswordsFile} \
-                        | grep -v '\s*#' \
+                        | grep -v '^\s*#' \
                         | grep -Eo 'mac=([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})' \
                         | sed 's|^mac=||' >> "$MAC_ALLOW_FILE"
                     '');
@@ -1025,7 +1025,7 @@ in {
                     # Add sae passwords from file
                     "20-saePasswordsFile" = mkIf (bssCfg.authentication.saePasswordsFile != null) (pkgs.writeShellScript "sae-passwords-file" ''
                       HOSTAPD_CONFIG_FILE=$1
-                      grep -v '\s*#' ${escapeShellArg bssCfg.authentication.saePasswordsFile} \
+                      grep -v '^\s*#' ${escapeShellArg bssCfg.authentication.saePasswordsFile} \
                         | sed 's/^/sae_password=/' >> "$HOSTAPD_CONFIG_FILE"
                     '');
                   };

nixos/modules/services/web-apps/plausible.md

@@ -15,15 +15,6 @@ After that, `plausible` can be deployed like this:
 {
   services.plausible = {
     enable = true;
-    adminUser = {
-      # activate is used to skip the email verification of the admin-user that's
-      # automatically created by plausible. This is only supported if
-      # postgresql is configured by the module. This is done by default, but
-      # can be turned off with services.plausible.database.postgres.setup.
-      activate = true;
-      email = "admin@localhost";
-      passwordFile = "/run/secrets/plausible-admin-pwd";
-    };
     server = {
       baseUrl = "http://analytics.example.org";
       # secretKeybaseFile is a path to the file which contains the secret generated

nixos/modules/services/web-apps/plausible.nix

@@ -11,33 +11,6 @@ in {
 
     package = mkPackageOption pkgs "plausible" { };
 
-    adminUser = {
-      name = mkOption {
-        default = "admin";
-        type = types.str;
-        description = ''
-          Name of the admin user that plausible will created on initial startup.
-        '';
-      };
-
-      email = mkOption {
-        type = types.str;
-        example = "admin@localhost";
-        description = ''
-          Email-address of the admin-user.
-        '';
-      };
-
-      passwordFile = mkOption {
-        type = types.either types.str types.path;
-        description = ''
-          Path to the file which contains the password of the admin user.
-        '';
-      };
-
-      activate = mkEnableOption "activating the freshly created admin-user";
-    };
-
     database = {
       clickhouse = {
         setup = mkEnableOption "creating a clickhouse instance" // { default = true; };
@@ -164,18 +137,13 @@ in {
 
   imports = [
     (mkRemovedOptionModule [ "services" "plausible" "releaseCookiePath" ] "Plausible uses no distributed Erlang features, so this option is no longer necessary and was removed")
+    (mkRemovedOptionModule [ "services" "plausible" "adminUser" "name" ] "Admin user is now created using first start wizard")
+    (mkRemovedOptionModule [ "services" "plausible" "adminUser" "email" ] "Admin user is now created using first start wizard")
+    (mkRemovedOptionModule [ "services" "plausible" "adminUser" "passwordFile" ] "Admin user is now created using first start wizard")
+    (mkRemovedOptionModule [ "services" "plausible" "adminUser" "activate" ] "Admin user is now created using first start wizard")
   ];
 
   config = mkIf cfg.enable {
-    assertions = [
-      { assertion = cfg.adminUser.activate -> cfg.database.postgres.setup;
-        message = ''
-          Unable to automatically activate the admin-user if no locally managed DB for
-          postgres (`services.plausible.database.postgres.setup') is enabled!
-        '';
-      }
-    ];
-
     services.postgresql = mkIf cfg.database.postgres.setup {
       enable = true;
     };
@@ -243,11 +211,7 @@ in {
             # Home is needed to connect to the node with iex
             HOME = "/var/lib/plausible";
 
-            ADMIN_USER_NAME = cfg.adminUser.name;
-            ADMIN_USER_EMAIL = cfg.adminUser.email;
-
-            DATABASE_SOCKET_DIR = cfg.database.postgres.socket;
-            DATABASE_NAME = cfg.database.postgres.dbname;
+            DATABASE_URL = "postgresql:///${cfg.database.postgres.dbname}?host=${cfg.database.postgres.socket}";
             CLICKHOUSE_DATABASE_URL = cfg.database.clickhouse.url;
 
             BASE_URL = cfg.server.baseUrl;
@@ -270,7 +234,6 @@ in {
             # even though we set `RELEASE_DISTRIBUTION=none` so the cookie should be unused.
             # Thus, make a random one, which should then be ignored.
             export RELEASE_COOKIE=$(tr -dc A-Za-z0-9 < /dev/urandom | head -c 20)
-            export ADMIN_USER_PWD="$(< $CREDENTIALS_DIRECTORY/ADMIN_USER_PWD )"
             export SECRET_KEY_BASE="$(< $CREDENTIALS_DIRECTORY/SECRET_KEY_BASE )"
 
             ${lib.optionalString (cfg.mail.smtp.passwordFile != null)
@@ -283,10 +246,6 @@ in {
 
             ${cfg.package}/migrate.sh
             export IP_GEOLOCATION_DB=${pkgs.dbip-country-lite}/share/dbip/dbip-country-lite.mmdb
-            ${cfg.package}/bin/plausible eval "(Plausible.Release.prepare() ; Plausible.Auth.create_user(\"$ADMIN_USER_NAME\", \"$ADMIN_USER_EMAIL\", \"$ADMIN_USER_PWD\"))"
-            ${optionalString cfg.adminUser.activate ''
-              psql -d plausible <<< "UPDATE users SET email_verified=true where email = '$ADMIN_USER_EMAIL';"
-            ''}
 
             exec plausible start
           '';
@@ -297,7 +256,6 @@ in {
             WorkingDirectory = "/var/lib/plausible";
             StateDirectory = "plausible";
             LoadCredential = [
-              "ADMIN_USER_PWD:${cfg.adminUser.passwordFile}"
               "SECRET_KEY_BASE:${cfg.server.secretKeybaseFile}"
             ] ++ lib.optionals (cfg.mail.smtp.passwordFile != null) [ "SMTP_USER_PWD:${cfg.mail.smtp.passwordFile}"];
           };

nixos/modules/services/x11/desktop-managers/cinnamon.nix

@@ -12,7 +12,7 @@ let
     extraGSettingsOverrides = cfg.extraGSettingsOverrides;
   };
 
-  notExcluded = pkg: (!(lib.elem pkg config.environment.cinnamon.excludePackages));
+  notExcluded = pkg: (!(lib.elem (lib.getName pkg) (map lib.getName config.environment.cinnamon.excludePackages)));
 in
 
 {

nixos/modules/services/x11/desktop-managers/gnome.nix

@@ -58,7 +58,7 @@ let
     enableGnomePanel = true;
   } ++ cfg.flashback.customSessions;
 
-  notExcluded = pkg: mkDefault (!(lib.elem pkg config.environment.gnome.excludePackages));
+  notExcluded = pkg: mkDefault (!(lib.elem (lib.getName pkg) (map lib.getName config.environment.gnome.excludePackages)));
 
 in
 

nixos/modules/system/activation/switch-to-configuration.pl

@@ -41,10 +41,6 @@
 my $out = "@out@";
 # System closure path to switch to
 my $toplevel = "@toplevel@";
-# Path to the directory containing systemd tools of the old system
-my $cur_systemd = abs_path("/run/current-system/sw/bin");
-# Path to the systemd store path of the new system
-my $new_systemd = "@systemd@";
 
 # To be robust against interruption, record what units need to be started etc.
 # We read these files again every time this script starts to make sure we continue
@@ -130,6 +126,12 @@
     exit(0);
 }
 
+# Path to the directory containing systemd tools of the old system
+# Needs to be after the "boot" action exits, as this directory will not exist when doing a NIXOS_LUSTRATE install
+my $cur_systemd = abs_path("/run/current-system/sw/bin");
+# Path to the systemd store path of the new system
+my $new_systemd = "@systemd@";
+
 # Check if we can activate the new configuration.
 my $cur_init_interface_version = read_file("/run/current-system/init-interface-version", err_mode => "quiet") // "";
 my $new_init_interface_version = read_file("$toplevel/init-interface-version");