talexander/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Releases Activity
nixpkgs/nixos/doc/manual/release-notes/rl-2511.section.md

21 KiB
Raw Permalink Blame History

Release 25.11 ("Xantusia", 2025.11/??)

Highlights

  • nixos-rebuild-ng, a full rewrite of nixos-rebuild in Python, is enabled by default from this release. You can disable it by setting to false in your configuration if you need, but please report any issues. It is expected that the next major version of NixOS (26.05) will remove the {option}system.rebuild.enableNg option.

  • Secure boot support can now be enabled for the Limine bootloader through {option}boot.loader.limine.secureBoot.enable. Bootloader install script signs the bootloader, then kernels are hashed during system rebuild and written to a config. This allows Limine to boot only the kernels installed through NixOS system.

  • The default PostgreSQL version for new NixOS installations (i.e. with system.stateVersion >= 25.11) is v17.

  • The NetworkManager module does not ship with a default set of VPN plugins anymore. All required VPN plugins must now be explicitly configured in networking.networkmanager.plugins.

New Modules

Backward Incompatibilities

  • The Perl implementation of the switch-to-configuration program is removed. All switchable systems now use the Rust rewrite. Any prior usage of system.switch.enableNg must now be removed. If you have any outstanding issues with the new implementation, please open an issue on GitHub.

  • The no-broken-symlink build hook now also fails builds whose output derivation contains links to $TMPDIR (typically /build, which contains the build directory).

  • The services.polipo module has been removed as polipo is unmaintained and archived upstream.

  • The non-LTS Forgejo package (forgejo) has been updated to 12.0.0. This release contains breaking changes, see the release blog post for all the details and how to ensure smooth upgrades.

  • The Pocket ID module ([services.pocket-id][#opt-services.pocket-id.enable]) and package (pocket-id) has been updated to 1.0.0. Some environment variables have been changed or removed, see the migration guide.

  • The zigbee2mqtt package was updated to version 2.x, which contains breaking changes. See the discussion for further information.

  • []{#sec-release-25.11-incompatibilities-sourcehut-removed} The services.sourcehut module and corresponding sourcehut packages were removed due to being broken and unmaintained.

  • The dovecot systemd service was renamed from dovecot2 to dovecot. The former is now just an alias. Update any overrides on the systemd unit to the new name.

  • Prosody has been updated to major release 13 which removed some obsoleted modules and brought a couple of major and breaking changes:

    • The http_files module is now disabled by default because it now requires http_files_dir to be configured.
    • The vcard_muc module has been removed and got replaced by the inbuilt muc_vcard module.
    • The http_upload module has been removed and you must migrate to the http_file_share module to stay XEP-0423 compliant. The httpFileShare options got expanded to better facility that.
    • The admin_shell module is now always being loaded to make prosodyctl functional.
    • The mime_types_file setting is now set to "${pkgs.mailcap}/etc/mime.types" to prevent errors. For a complete list of changes, please see their announcement.

  • The yeahwm package and services.xserver.windowManager.yeahwm module were removed due to the package being broken and unmaintained upstream.

  • The services.postgresql module now sets up a systemd unit postgresql.target. Depending on postgresql.target guarantees that postgres is in read-write mode and initial/ensure scripts were executed. Depending on postgresql.service only guarantees a read-only connection.

  • The services.siproxd module has been removed as siproxd is unmaintained and broken with libosip 5.x.

  • netbox-manage script created by the netbox module no longer uses sudo -u netbox internally. It can be run as root and will change it's user to netbox using runuser

  • services.dwm-status.extraConfig was replaced by RFC0042-compliant , which is used to generate the config file. services.dwm-status.order is now moved to , as it's a part of the config file.

  • gitversion was updated to 6.3.0, which includes a number of breaking changes, old configurations may need updating or they will cause the tool to fail to run. See the 6.0.0 release notes for GitVersion for details on the breaking changes, the documentation on the configuration format for the new configuration specification, and the documentation on version variables for what is now supported.

  • renovate was updated to v41. See the upstream release notes for v40 and v41 for breaking changes.

  • The boot.readOnlyNixStore has been removed. Control over bind mount options on /nix/store is now offered by the boot.nixStoreMountOpts option.

  • The Postfix module has been updated and likely requires configuration changes:

  • vmalert now supports multiple instances with the option services.vmalert.instances."".enable

  • services.victorialogs.package now defaults to victorialogs, as victoriametrics no longer contains the VictoriaLogs binaries.

  • The services.traccar.settings attribute has been reworked. Instead of the previous flat attribute set the new implementation uses nested attribute sets. You need to update you configuration manually. For instance, services.traccar.settings.loggerConsole becomes services.traccar.settings.logger.console.

  • The wstunnel module was converted to RFC42-style settings, you will need to update your NixOS config if you make use of this module.

  • private-gpt service has been removed by lack of maintenance upstream.

  • NixOS display manager modules now strictly use tty1, where many of them previously used tty7. Options to configure display managers' VT have been dropped. A configuration with a display manager enabled will not start getty@tty1.service, even if the system is forced to boot into multi-user.target instead of graphical.target.

  • command-not-found package is now disabled by default; it works only for nix-channels based systems, and requires setup for it to work.

Other Notable Changes

  • services.clamsmtp is unmaintained and was removed from Nixpkgs.

  • prosody gained a config check option named services.prosody.checkConfig which runs prosodyctl check config and is turned on by default.

  • services.dependency-track removed its configuration of the JVM heap size. This lets the JVM choose its maximum heap size automatically, which should work much better in practice for most users. For deployments on systems with little RAM, it may now be necessary to manually configure a maximum heap size using {option}services.dependency-track.javaArgs.

  • services.dnscrypt-proxy2 gains a package option to specify dnscrypt-proxy package to use.

  • services.nextcloud.configureRedis now defaults to true in accordance with upstream recommendations to have caching for file locking. See the upstream doc for further details.

  • services.gitea supports sending notifications with sendmail again. To do this, activate the parameter services.gitea.mailerUseSendmail and configure SMTP server.

  • Revamp of the ACME certificate acquisication and renewal process to help scale systems with lots (100+) of certificates.

    Units and targets have been reshaped to better support more specific dependency propagation and avoid superfluously triggering unchanged units:

    If a service requires a syntactically valid certificate to start it should now depend on the acme-{certname}.service unit.

    We now always generate initial self-signed certificates as this drastically simplifies the dependency structure. As a result, the option security.acme.preliminarySelfsigned has been removed.

    Instead of the previous acme-finished-{certname}.targets there are now acme-order-renew-{certname}.services that will be activated in a delayed fashion to ensure that bootstrapping with servers like nginx that take part in the acquisition/renewal process works smoothly. Dependencies on acme-finished units should move to acme-order-renew.

    Note that system activation will complete before all certificates may have been renewed or acquired.

  • libvirt now supports using nftables backend.

    • The virtualisation.libvirtd.firewallBackend option can be used to configure the firewall backend used by libvirtd.

  • systemd.extraConfig and boot.initrd.systemd.extraConfig was converted to RFC42-style systemd.settings.Manager and boot.initrd.systemd.settings.Manager respectively.

    • systemd.watchdog.runtimeTime was renamed to systemd.settings.Manager.RuntimeWatchdogSec
    • systemd.watchdog.device was renamed to systemd.settings.Manager.WatchdogDevice
    • systemd.watchdog.rebootTime was renamed to systemd.settings.Manager.RebootWatchdogSec
    • systemd.watchdog.kexecTime was renamed to systemd.settings.Manager.KExecWatchdogSec
    • systemd.enableCgroupAccounting was removed. Cgroup accounting now needs to be disabled directly using systemd.settings.Manager.*Accounting.

  • services.ntpd-rs now performs configuration validation.

  • services.postsrsd now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the services.postsrsd.configurePostfix option.

  • services.pfix-srsd now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the services.pfix-srsd.configurePostfix option.

  • services.monero now includes the environmentFile option for adding secrets to the Monero daemon config.

  • services.netbird.server now uses dedicated packages split out due to relicensing of server components to AGPLv3 with version 0.53.0,

  • The new option networking.ipips has been added to create IP within IP kind of tunnels (including 4in6, ip6ip6 and ipip). With the existing networking.sits option (6in4), it is now possible to create all combinations of IPv4 and IPv6 encapsulation.

  • It is now possible to configure the default source address using the new options networking.defaultGateway.source, networking.defaultGateway6.source.

  • Potential race conditions in the network setup when using networking.interfaces have been fixed by disabling duplicate address detection (DAD) for statically configured IPv6 addresses.

  • amdgpu kernel driver overdrive mode can now be enabled by setting hardware.amdgpu.overdrive.enable and customized through hardware.amdgpu.overdrive.ppfeaturemask. This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}programs.corectrl.gpuOverclock.enable and {option}programs.tuxclocker.enableAMD.

  • services.varnish.http_address has been superseeded by services.varnish.listen which is now structured config for all of varnish's -a variations.

  • does not ship with an SSH agent anymore, as this is now handled by the gcr_4 package instead of gnome-keyring. A new module has been added to support this, under (its default value has been set to to ensure a smooth transition). See the relevant upstream PR for more details.

  • The nettools package (ifconfig, arp, mii-tool, netstat, route) is not installed by default anymore. The suite is unmaintained and users should migrate to iproute2 and ethtool instead.

  • sparkleshare has been removed as it no longer builds and has been abandoned upstream.