rl-1809.section.md

Release 18.09 ("Jellyfish", 2018/10/05) {#sec-release-18.09}

Highlights {#sec-release-18.09-highlights}

In addition to numerous new and upgraded packages, this release has the following notable updates:

• End of support is planned for end of April 2019, handing over to 19.03.

• Platform support: x86_64-linux and x86_64-darwin as always. Support for aarch64-linux is as with the previous releases, not equivalent to the x86-64-linux release, but with efforts to reach parity.

• Nix has been updated to 2.1; see its release notes.

• Core versions: linux: 4.14 LTS (unchanged), glibc: 2.26 → 2.27, gcc: 7 (unchanged), systemd: 237 → 239.

• Desktop version changes: gnome: 3.26 → 3.28, (KDE) plasma-desktop: 5.12 → 5.13.

Notable changes and additions for 18.09 include:

• Support for wrapping binaries using firejail has been added through programs.firejail.wrappedBinaries.

  For example

  {
    programs.firejail = {
      enable = true;
      wrappedBinaries = {
        firefox = "${lib.getBin pkgs.firefox}/bin/firefox";
        mpv = "${lib.getBin pkgs.mpv}/bin/mpv";
      };
    };
  }

  This will place firefox and mpv binaries in the global path wrapped by firejail.

• User channels are now in the default NIX_PATH, allowing users to use their personal nix-channel defined channels in nix-build and nix-shell commands, as well as in imports like import <mychannel>.

  For example

  $ nix-channel --add https://nixos.org/channels/nixpkgs-unstable nixpkgsunstable
  $ nix-channel --update
  $ nix-build '<nixpkgsunstable>' -A gitFull
  $ nix run -f '<nixpkgsunstable>' gitFull
  $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull'

New Services {#sec-release-18.09-new-services}

A curated selection of new services that were added since the last release:

• The services.cassandra module has been reworked and was rewritten from scratch. The service has succeeding tests for the versions 2.1, 2.2, 3.0 and 3.11 of Apache Cassandra.

• There is a new services.foundationdb module for deploying FoundationDB clusters.

• When enabled the iproute2 will copy the files expected by ip route (e.g., rt_tables) in /etc/iproute2. This allows to write aliases for routing tables for instance.

• services.strongswan-swanctl is a modern replacement for services.strongswan. You can use either one of them to setup IPsec VPNs but not both at the same time.

  services.strongswan-swanctl uses the swanctl command which uses the modern vici Versatile IKE Configuration Interface. The deprecated ipsec command used in services.strongswan is using the legacy stroke configuration interface.

• The new services.elasticsearch-curator service periodically curates or manages, your Elasticsearch indices and snapshots.

Every new services:

• ./config/xdg/autostart.nix

• ./config/xdg/icons.nix

• ./config/xdg/menus.nix

• ./config/xdg/mime.nix

• ./hardware/brightnessctl.nix

• ./hardware/onlykey.nix

• ./hardware/video/uvcvideo/default.nix

• ./misc/documentation.nix

• ./programs/firejail.nix

• ./programs/iftop.nix

• ./programs/sedutil.nix

• ./programs/singularity.nix

• ./programs/xss-lock.nix

• ./programs/zsh/zsh-autosuggestions.nix

• ./services/admin/oxidized.nix

• ./services/backup/duplicati.nix

• ./services/backup/restic.nix

• ./services/backup/restic-rest-server.nix

• ./services/cluster/hadoop/default.nix

• ./services/databases/aerospike.nix

• ./services/databases/monetdb.nix

• ./services/desktops/bamf.nix

• ./services/desktops/flatpak.nix

• ./services/desktops/zeitgeist.nix

• ./services/development/bloop.nix

• ./services/development/jupyter/default.nix

• ./services/hardware/lcd.nix

• ./services/hardware/undervolt.nix

• ./services/misc/clipmenu.nix

• ./services/misc/gitweb.nix

• ./services/misc/serviio.nix

• ./services/misc/safeeyes.nix

• ./services/misc/sysprof.nix

• ./services/misc/weechat.nix

• ./services/monitoring/datadog-agent.nix

• ./services/monitoring/incron.nix

• ./services/networking/dnsdist.nix

• ./services/networking/freeradius.nix

• ./services/networking/hans.nix

• ./services/networking/morty.nix

• ./services/networking/ndppd.nix

• ./services/networking/ocserv.nix

• ./services/networking/owamp.nix

• ./services/networking/quagga.nix

• ./services/networking/shadowsocks.nix

• ./services/networking/stubby.nix

• ./services/networking/zeronet.nix

• ./services/security/certmgr.nix

• ./services/security/cfssl.nix

• ./services/security/oauth2_proxy_nginx.nix

• ./services/web-apps/virtlyst.nix

• ./services/web-apps/youtrack.nix

• ./services/web-servers/hitch/default.nix

• ./services/web-servers/hydron.nix

• ./services/web-servers/meguca.nix

• ./services/web-servers/nginx/gitweb.nix

• ./virtualisation/kvmgt.nix

• ./virtualisation/qemu-guest-agent.nix

Backward Incompatibilities {#sec-release-18.09-incompatibilities}

When upgrading from a previous release, please be aware of the following incompatible changes:

• Some licenses that were incorrectly not marked as unfree now are. This is the case for:

  • cc-by-nc-sa-20: Creative Commons Attribution Non Commercial Share Alike 2.0

  • cc-by-nc-sa-25: Creative Commons Attribution Non Commercial Share Alike 2.5

  • cc-by-nc-sa-30: Creative Commons Attribution Non Commercial Share Alike 3.0

  • cc-by-nc-sa-40: Creative Commons Attribution Non Commercial Share Alike 4.0

  • cc-by-nd-30: Creative Commons Attribution-No Derivative Works v3.00

  • msrla: Microsoft Research License Agreement

• The deprecated services.cassandra module has seen a complete rewrite. (See above.)

• lib.strict is removed. Use builtins.seq instead.

• The clementine package points now to the free derivation. clementineFree is removed now and clementineUnfree points to the package which is bundled with the unfree libspotify package.

• The netcat package is now taken directly from OpenBSD's libressl, instead of relying on Debian's fork. The new version should be very close to the old version, but there are some minor differences. Importantly, flags like -b, -q, -C, and -Z are no longer accepted by the nc command.

• The services.docker-registry.extraConfig object doesn't contain environment variables anymore. Instead it needs to provide an object structure that can be mapped onto the YAML configuration defined in the docker/distribution docs.

• gnucash has changed from version 2.4 to 3.x. If you've been using gnucash (version 2.4) instead of gnucash26 (version 2.6) you must open your Gnucash data file(s) with gnucash26 and then save them to upgrade the file format. Then you may use your data file(s) with Gnucash 3.x. See the upgrade documentation. Gnucash 2.4 is still available under the attribute gnucash24.

• services.munge now runs as user (and group) munge instead of root. Make sure the key file is accessible to the daemon.

• dockerTools.buildImage now uses null as default value for tag, which indicates that the nix output hash will be used as tag.

• The ELK stack: elasticsearch, logstash and kibana has been upgraded from 2.* to 6.3.*. The 2.* versions have been unsupported since last year so they have been removed. You can still use the 5.* versions under the names elasticsearch5, logstash5 and kibana5.

  The elastic beats: filebeat, heartbeat, metricbeat and packetbeat have had the same treatment: they now target 6.3.* as well. The 5.* versions are available under the names: filebeat5, heartbeat5, metricbeat5 and packetbeat5

  The ELK-6.3 stack now comes with X-Pack by default. Since X-Pack is licensed under the Elastic License the ELK packages now have an unfree license. To use them you need to specify allowUnfree = true; in your nixpkgs configuration.

  Fortunately there is also a free variant of the ELK stack without X-Pack. The packages are available under the names: elasticsearch-oss, logstash-oss and kibana-oss.

• Options boot.initrd.luks.devices.name.yubikey.ramfsMountPoint boot.initrd.luks.devices.name.yubikey.storage.mountPoint were removed. luksroot.nix module never supported more than one YubiKey at a time anyway, hence those options never had any effect. You should be able to remove them from your config without any issues.

• stdenv.system and system in nixpkgs now refer to the host platform instead of the build platform. For native builds this is not change, let alone a breaking one. For cross builds, it is a breaking change, and stdenv.buildPlatform.system can be used instead for the old behavior. They should be using that anyways for clarity.

• Groups kvm and render are introduced now, as systemd requires them.

Other Notable Changes {#sec-release-18.09-notable-changes}

• dockerTools.pullImage relies on image digest instead of image tag to download the image. The sha256 of a pulled image has to be updated.

• lib.attrNamesToStr has been deprecated. Use more specific concatenation (lib.concat(Map)StringsSep) instead.

• lib.addErrorContextToAttrs has been deprecated. Use builtins.addErrorContext directly.

• lib.showVal has been deprecated. Use lib.traceSeqN instead.

• lib.traceXMLVal has been deprecated. Use lib.traceValFn builtins.toXml instead.

• lib.traceXMLValMarked has been deprecated. Use lib.traceValFn (x: str + builtins.toXML x) instead.

• The pkgs argument to NixOS modules can now be set directly using nixpkgs.pkgs. Previously, only the system, config and overlays arguments could be used to influence pkgs.

• A NixOS system can now be constructed more easily based on a preexisting invocation of Nixpkgs. For example:

  {
    inherit (pkgs.nixos {
      boot.loader.grub.enable = false;
      fileSystems."/".device = "/dev/xvda1";
    }) toplevel kernel initialRamdisk manual;
  }

  This benefits evaluation performance, lets you write Nixpkgs packages that depend on NixOS images and is consistent with a deployment architecture that would be centered around Nixpkgs overlays.

• lib.traceValIfNot has been deprecated. Use if/then/else and lib.traceValSeq instead.

• lib.traceCallXml has been deprecated. Please complain if you use the function regularly.

• The attribute lib.nixpkgsVersion has been deprecated in favor of lib.version. Please refer to the discussion in NixOS/nixpkgs#39416 for further reference.

• lib.recursiveUpdateUntil was not acting according to its specification. It has been fixed to act according to the docstring, and a test has been added.

• The module for security.dhparams has two new options now:

  security.dhparams.stateless

  : Puts the generated Diffie-Hellman parameters into the Nix store instead of managing them in a stateful manner in /var/lib/dhparams.

  security.dhparams.defaultBitSize

  : The default bit size to use for the generated Diffie-Hellman parameters.

  ::: {.note} The path to the actual generated parameter files should now be queried using config.security.dhparams.params.name.path because it might be either in the Nix store or in a directory configured by security.dhparams.path. :::

  ::: {.note} For developers:

  Module implementers should not set a specific bit size in order to let users configure it by themselves if they want to have a different bit size than the default (2048).

  An example usage of this would be:

  { config, ... }:
  
  {
    security.dhparams.params.myservice = {};
    environment.etc."myservice.conf".text = ''
      dhparams = ${config.security.dhparams.params.myservice.path}
    '';
  }

  :::

• networking.networkmanager.useDnsmasq has been deprecated. Use networking.networkmanager.dns instead.

• The Kubernetes package has been bumped to major version 1.11. Please consult the release notes for details on new features and api changes.

• The option services.kubernetes.apiserver.admissionControl was renamed to services.kubernetes.apiserver.enableAdmissionPlugins.

• Recommended way to access the Kubernetes Dashboard is via HTTPS (TLS) Therefore; public service port for the dashboard has changed to 443 (container port 8443) and scheme to https.

• The option services.kubernetes.apiserver.address was renamed to services.kubernetes.apiserver.bindAddress. Note that the default value has changed from 127.0.0.1 to 0.0.0.0.

• The option services.kubernetes.apiserver.publicAddress was not used and thus has been removed.

• The option services.kubernetes.addons.dashboard.enableRBAC was renamed to services.kubernetes.addons.dashboard.rbac.enable.

• The Kubernetes Dashboard now has only minimal RBAC permissions by default. If dashboard cluster-admin rights are desired, set services.kubernetes.addons.dashboard.rbac.clusterAdmin to true. On existing clusters, in order for the revocation of privileges to take effect, the current ClusterRoleBinding for kubernetes-dashboard must be manually removed: kubectl delete clusterrolebinding kubernetes-dashboard

• The programs.screen module provides allows to configure /etc/screenrc, however the module behaved fairly counterintuitive as the config exists, but the package wasn't available. Since 18.09 pkgs.screen will be added to environment.systemPackages.

• The module services.networking.hostapd now uses WPA2 by default.

• s6Dns, s6Networking, s6LinuxUtils and s6PortableUtils renamed to s6-dns, s6-networking, s6-linux-utils and s6-portable-utils respectively.

• The module option nix.useSandbox is now defaulted to true.

• The config activation script of nixos-rebuild now reloads all user units for each authenticated user.

• The default display manager is now LightDM. To use SLiM set services.xserver.displayManager.slim.enable to true.

• NixOS option descriptions are now automatically broken up into individual paragraphs if the text contains two consecutive newlines, so it's no longer necessary to use </para><para> to start a new paragraph.

• Top-level buildPlatform, hostPlatform, and targetPlatform in Nixpkgs are deprecated. Please use their equivalents in stdenv instead: stdenv.buildPlatform, stdenv.hostPlatform, and stdenv.targetPlatform.