nixpkgs/nixos/doc/manual/release-notes/rl-1709.xml

<section xmlns="http://docbook.org/ns/docbook"
         xmlns:xlink="http://www.w3.org/1999/xlink"
         xmlns:xi="http://www.w3.org/2001/XInclude"
         version="5.0"
         xml:id="sec-release-17.09">

<title>Release 17.09 (“Hummingbird”, 2017/09/??)</title>

<para>In addition to numerous new and upgraded packages, this release
has the following highlights: </para>

<itemizedlist>
  <listitem>
    <para>
      The GNOME version is now 3.24.
    </para>
  </listitem>
  <listitem>
    <para>
      The user handling now keeps track of deallocated UIDs/GIDs. When a user
      or group is revived, this allows it to be allocated the UID/GID it had before.
      A consequence is that UIDs and GIDs are no longer reused.
    </para>
  </listitem>
  <listitem>
    <para>
      The module option <option>services.xserver.xrandrHeads</option> now
      causes the first head specified in this list to be set as the primary
      head. Apart from that, it's now possible to also set additional options
      by using an attribute set, for example:
<programlisting>
{ services.xserver.xrandrHeads = [
    "HDMI-0"
    {
      output = &quot;DVI-0&quot;;
      primary = true;
      monitorConfig = ''
        Option &quot;Rotate&quot; &quot;right&quot;
      '';
    }
  ];
}
</programlisting>
      This will set the <literal>DVI-0</literal> output to be the primary head,
      even though <literal>HDMI-0</literal> is the first head in the list.
    </para>
  </listitem>
  <listitem>
    <para>
      The handling of SSL in the nginx module has been cleaned up, renaming
      the misnomed <literal>enableSSL</literal> to <literal>onlySSL</literal>
      which reflects its original intention. This is not to be used with the
      already existing <literal>forceSSL</literal> which creates a second
      non-SSL virtual host redirecting to the SSL virtual host. This by
      chance had worked earlier due to specific implementation details. In
      case you had specified both please remove the <literal>enableSSL</literal>
      option to keep the previous behaviour.
    </para>
    <para>
      Another <literal>addSSL</literal> option has been introduced to configure
      both a non-SSL virtual host and an SSL virtual host.
    </para>
    <para>
      Options to configure <literal>resolver</literal>s and
      <literal>upstream</literal>s have been introduced. See their information
      for further details.
    </para>
    <para>
      The <literal>port</literal> option has been replaced by a more generic
      <literal>listen</literal> option which makes it possible to specify
      multiple addresses, ports and SSL configs dependant on the new SSL
      handling mentioned above.
    </para>
  </listitem>
</itemizedlist>

<para>The following new services were added since the last release:</para>

<itemizedlist>
  <listitem>
    <para></para>
  </listitem>
</itemizedlist>


<para>When upgrading from a previous release, please be aware of the
following incompatible changes:</para>

<itemizedlist>
  <listitem>
    <para>
      The <literal>aiccu</literal> package was removed. This is due to SixXS
      <link xlink:href="https://www.sixxs.net/main/"> sunsetting</link> its IPv6 tunnel.
    </para>
  </listitem>
  <listitem>
    <para>
      The <literal>fanctl</literal> package and <literal>fan</literal> module
      have been removed due to the developers not upstreaming their iproute2
      patches and lagging with compatibility to recent iproute2 versions.
    </para>
  </listitem>
  <listitem>
    <para>
      Top-level <literal>idea</literal> package collection was renamed.
      All JetBrains IDEs are now at <literal>jetbrains</literal>.
    </para>
  </listitem>
  <listitem>
    <para>
      <literal>flexget</literal>'s state database cannot be upgraded to its
      new internal format, requiring removal of any existing
      <literal>db-config.sqlite</literal> which will be automatically recreated.
    </para>
  </listitem>
  <listitem>
    <para>
      The ipfs package now doesn't ignore the <literal>dataDir</literal> option anymore. If you've ever set this option to anything other than the default you'll have to either unset it (so the default gets used) or migrate the old data manually with
<programlisting>
dataDir=&lt;valueOfDataDir&gt;
mv /var/lib/ipfs/.ipfs/* $dataDir
rmdir /var/lib/ipfs/.ipfs
</programlisting>
    </para>
  </listitem>
  <listitem>
    <para>
      The following changes apply if the <literal>stateVersion</literal> is changed to 17.09 or higher.
      For <literal>stateVersion = "17.03</literal> or lower the old behavior is preserved.
    </para>
    <para>
      The <literal>postgres</literal> default version was changed from 9.5 to 9.6.
    </para>
    <para>
      The <literal>postgres</literal> superuser name has changed from <literal>root</literal> to <literal>postgres</literal> to more closely follow what other Linux distributions are doing.
    </para>
    <para>
      The <literal>postgres</literal> default <literal>dataDir</literal> has changed from <literal>/var/db/postgres</literal> to <literal>/var/lib/postgresql/$psqlSchema</literal> where $psqlSchema is 9.6 for example.
    </para>
    <para>
      The <literal>mysql</literal> default <literal>dataDir</literal> has changed from <literal>/var/mysql</literal> to <literal>/var/lib/mysql</literal>.
    </para>
    <para>
            Radicale's default package has changed from 1.x to 2.x. Instructions to migrate can be found <link xlink:href="http://radicale.org/1to2/"> here </link>. It is also possible to use the newer version by setting the <literal>package</literal> to <literal>radicale2</literal>, which is done automatically when <literal>stateVersion</literal> is 17.09 or higher. The <literal>extraArgs</literal> option has been added to allow passing the data migration arguments specified in the instructions; see the <filename xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/radicale.nix">radicale.nix</filename> NixOS test for an example migration.
    </para>
  </listitem>
  <listitem>
    <para>
      The <literal>caddy</literal> service was previously using an extra
      <literal>.caddy</literal> in the data directory specified with the
      <literal>dataDir</literal> option. The contents of the
      <literal>.caddy</literal> directory are now expected to be in the
      <literal>dataDir</literal>.
    </para>
  </listitem>
  <listitem>
    <para>
      The <literal>ssh-agent</literal> user service is not started by default
      anymore. Use <literal>programs.ssh.startAgent</literal> to enable it if
      needed. There is also a new <literal>programs.gnupg.agent</literal>
      module that creates a <literal>gpg-agent</literal> user service. It can
      also serve as a SSH agent if <literal>enableSSHSupport</literal> is set.
    </para>
  </listitem>
  <listitem>
    <para>
      The <literal>services.tinc.networks.&lt;name&gt;.listenAddress</literal>
      option had a misleading name that did not correspond to its behavior. It
      now correctly defines the ip to listen for incoming connections on. To
      keep the previous behaviour, use
      <literal>services.tinc.networks.&lt;name&gt;.bindToAddress</literal>
      instead. Refer to the description of the options for more details.
    </para>
  </listitem>
  <listitem>
    <para>
      <literal>tlsdate</literal> package and module were removed. This is due to the project
      being dead and not building with openssl 1.1.
    </para>
  </listitem>
  <listitem>
    <para>
      <literal>wvdial</literal> package and module were removed. This is due to the project
      being dead and not building with openssl 1.1.
    </para>
  </listitem>
  <listitem>
    <para>
      <literal>cc-wrapper</literal>'s setup-hook now exports a number of
      environment variables corresponding to binutils binaries,
      (e.g. <envar>LD</envar>, <envar>STRIP</envar>, <envar>RANLIB</envar>,
      etc). This is done to prevent packages' build systems guessing, which is
      harder to predict, especially when cross-compiling. However, some packages
      have broken due to this—their build systems either not supporting, or
      claiming to support without adequate testing, taking such environment
      variables as parameters.
    </para>
  </listitem>
  <listitem>
    <para>
      <literal>services.firefox.syncserver</literal> now runs by default as a
      non-root user. To accomodate this change, the default sqlite database
      location has also been changed. Migration should work automatically.
      Refer to the description of the options for more details.
    </para>
  </listitem>
  <listitem>
    <para>
      The <literal>compiz</literal> window manager and package was
      removed. The system support had been broken for several years.
    </para>
  </listitem>
  <listitem>
    <para>
      Touchpad support should now be enabled through
      <literal>libinput</literal> as <literal>synaptics</literal> is
      now deprecated. See the option
      <literal>services.xserver.libinput.enable</literal>.
    </para>
  </listitem>
  <listitem>
    <para>
      grsecurity/PaX support has been dropped, following upstream's
      decision to cease free support.  See
      <link xlink:href="https://grsecurity.net/passing_the_baton.php">
      upstream's announcement</link> for more information.
      No complete replacement for grsecurity/PaX is available presently.
    </para>
  </listitem>
    <listitem>
    <para>
      The <literal>gnupg</literal> package used to suffix its programs
      with <literal>2</literal>, like <command>gpg2</command> and
      <command>gpgv2</command>. This suffix has since been dropped,
      and the programs are now simply <command>gpg</command>,
      <command>gpgv</command>, etc.
    </para>
  </listitem>
  <listitem>
    <para>
      <literal>services.mysql</literal> now has declarative
      configuration of databases and users with the <literal>ensureDatabases</literal> and
      <literal>ensureUsers</literal> options.
    </para>

    <para>
      These options will never delete existing databases and users,
      especially not when the value of the options are changed.
    </para>

    <para>
      The MySQL users will be identified using
      <link xlink:href="https://mariadb.com/kb/en/library/authentication-plugin-unix-socket/">
        Unix socket authentication</link>. This authenticates the
        Unix user with the same name only, and that without the need
        for a password.
    </para>

    <para>
      If you have previously created a MySQL <literal>root</literal>
      user <emphasis>with a password</emphasis>, you will need to add
      <literal>root</literal> user for unix socket authentication
      before using the new options. This can be done by running the
      following SQL script:

<programlisting language="sql">
CREATE USER 'root'@'%' IDENTIFIED BY '';
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
FLUSH PRIVILEGES;

-- Optionally, delete the password-authenticated user:
-- DROP USER 'root'@'localhost';
</programlisting>
    </para>
  </listitem>

  <listitem>
    <para>
      Templated systemd services e.g <literal>container@name</literal> are
      now handled currectly when switching to a new configuration, resulting
      in them being reloaded.
    </para>
  </listitem>

  <listitem>
    <para>
      <literal>services.mysqlBackup</literal> now works by default
      without any user setup, including for users other than
      <literal>mysql</literal>.
    </para>

    <para>
      By default, the <literal>mysql</literal> user is no longer the
      user which performs the backup. Instead a system account
      <literal>mysqlbackup</literal> is used.
    </para>

    <para>
      The <literal>mysqlBackup</literal> service is also now using
      systemd timers instead of <literal>cron</literal>.
    </para>

    <para>
      Therefore, the <literal>services.mysqlBackup.period</literal>
      option no longer exists, and has been replaced with
      <literal>services.mysqlBackup.calendar</literal>, which is in
      the format of <link
      xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.time.html#Calendar%20Events">systemd.time(7)</link>.
    </para>

    <para>
      If you expect to be sent an e-mail when the backup fails,
      consider using a script which monitors the systemd journal for
      errors. Regretfully, at present there is no built-in
      functionality for this.
    </para>

    <para>
      You can check that backups still work by running
      <command>systemctl start mysql-backup</command> then
      <command>systemctl status mysql-backup</command>.
    </para>
  </listitem>

  <listitem>
    <para>Steam: the <literal>newStdcpp</literal> parameter
    was removed and should not be needed anymore.</para>
  </listitem>

  <listitem>
    <para>
      Redis has been updated to version 4 which mandates a cluster
      mass-restart, due to changes in the network handling, in order
      to ensure compatibility with networks NATing traffic.
    </para>
  </listitem>
</itemizedlist>

<para>Other notable improvements:</para>

<itemizedlist>

  <listitem>
    <para>
      Modules can now be disabled by using <link
      xlink:href="https://nixos.org/nixpkgs/manual/#sec-replace-modules">
      disabledModules</link>, allowing another to take it's place.  This can be
      used to import a set of modules from another channel while keeping the
      rest of the system on a stable release.
    </para>
  </listitem>
  <listitem>
    <para>
      Updated to FreeType 2.7.1, including a new TrueType engine.
      The new engine replaces the Infinality engine which was the default in
      NixOS. The default font rendering settings are now provided by
      fontconfig-penultimate, replacing fontconfig-ultimate; the new defaults
      are less invasive and provide rendering that is more consistent with
      other systems and hopefully with each font designer's intent. Some
      system-wide configuration has been removed from the Fontconfig NixOS
      module where user Fontconfig settings are available.
    </para>
  </listitem>
  <listitem>
    <para>
      ZFS/SPL have been updated to 0.7.0, <literal>zfsUnstable, splUnstable</literal>
      have therefore been removed.
    </para>
  </listitem>
  <listitem>
    <para>
      The <option>time.timeZone</option> option now allows the value
      <literal>null</literal> in addition to timezone strings. This value
      allows changing the timezone of a system imperatively using
      <command>timedatectl set-timezone</command>. The default timezone
      is still UTC.
    </para>
  </listitem>
  <listitem>
    <para>
      Nixpkgs overlays may now be specified with a file as well as a directory. The
      value of <literal>&lt;nixpkgs-overlays></literal> may be a file, and
      <filename>~/.config/nixpkgs/overlays.nix</filename> can be used instead of the
      <filename>~/.config/nixpkgs/overalys</filename> directory.
    </para>
    <para>
      See the overlays chapter of the Nixpkgs manual for more details.
    </para>
  </listitem>
  <listitem>
    <para>
      Definitions for <filename>/etc/hosts</filename> can now be specified
      declaratively with <literal>networking.hosts</literal>.
    </para>
  </listitem>
  <listitem>
    <para>
      Two new options have been added to the installer loader, in addition
      to the default having changed. The kernel log verbosity has been lowered
      to the upstream default for the default options, in order to not spam
      the console when e.g. joining a network.
    </para>
    <para>
      This therefore leads to adding a new <literal>debug</literal> option
      to set the log level to the previous verbose mode, to make debugging
      easier, but still accessible easily.
    </para>
    <para>
      Additionally a <literal>copytoram</literal> option has been added,
      which makes it possible to remove the install medium after booting.
      This allows tethering from your phone after booting from it.
    </para>
    <para>
      <literal>services.gitlab-runner.configOptions</literal> has been added
      to specify the configuration of gitlab-runners declaratively.
    </para>
    <para>
      <literal>services.jenkins.plugins</literal> has been added
      to install plugins easily, this can be generated with jenkinsPlugins2nix.
    </para>
    <para>
      <literal>services.postfix.config</literal> has been added
      to specify the main.cf with NixOS options. Additionally other options
      have been added to the postfix module and has been improved further.
    </para>
    <para>
        The GitLab package and module have been updated to the latest 9.5 release.
    </para>
    <para>
      The <literal>systemd-boot</literal> boot loader now lists the NixOS
      version, kernel version and build date of all bootable generations.
    </para>
  </listitem>
  <listitem>
    <para>
      The dnscrypt-proxy service now defaults to using a random upstream resolver,
      selected from the list of public non-logging resolvers with DNSSEC support.
      Existing configurations can be migrated to this mode of operation by
      omitting the <option>services.dnscrypt-proxy.resolverName</option> option
      or setting it to <literal>"random"</literal>.
    </para>
  </listitem>

</itemizedlist>

</section>