nixpkgs/nixos/doc/manual/release-notes/rl-2311.section.md

# Release 23.11 (“Tapir”, 2023.11/??) {#sec-release-23.11}

## Highlights {#sec-release-23.11-highlights}

- FoundationDB now defaults to major version 7.

## New Services {#sec-release-23.11-new-services}

- Create the first release note entry in this section!

<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

- [river](https://github.com/riverwm/river), A dynamic tiling wayland compositor. Available as [programs.river](#opt-programs.river.enable).

## Backward Incompatibilities {#sec-release-23.11-incompatibilities}

- The latest version of `clonehero` now stores custom content in `~/.clonehero`. See the [migration instructions](https://clonehero.net/2022/11/29/v23-to-v1-migration-instructions.html). Typically, these content files would exist along side the binary, but the previous build used a wrapper script that would store them in `~/.config/unity3d/srylain Inc_/Clone Hero`.

- `etcd` has been updated to 3.5, you will want to read the [3.3 to 3.4](https://etcd.io/docs/v3.5/upgrades/upgrade_3_4/) and [3.4 to 3.5](https://etcd.io/docs/v3.5/upgrades/upgrade_3_5/) upgrade guides

## Other Notable Changes {#sec-release-23.11-notable-changes}

- The Cinnamon module now enables XDG desktop integration by default. If you are experiencing collisions related to xdg-desktop-portal-gtk you can safely remove `xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];` from your NixOS configuration.

- A new option was added to the virtualisation module that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` is still supported for cases where the name of the network interface is irrelevant.

- `services.nginx` gained a `defaultListen` option at server-level with support for PROXY protocol listeners, also `proxyProtocol` is now exposed in `services.nginx.virtualHosts.<name>.listen` option. It is now possible to run PROXY listeners and non-PROXY listeners at a server-level, see [#213510](https://github.com/NixOS/nixpkgs/pull/213510/) for more details.
23.11 is Tapir 2023-05-22 20:14:06 +01:00			`# Release 23.11 (“Tapir”, 2023.11/??) {#sec-release-23.11}`

			`## Highlights {#sec-release-23.11-highlights}`

foundationdb: default to foundationdb71 2023-05-24 23:08:10 +01:00			`- FoundationDB now defaults to major version 7.`
rl-2311: Add placeholder entries This fixes manual-combined validation. 2023-05-23 05:59:00 +01:00
23.11 is Tapir 2023-05-22 20:14:06 +01:00			`## New Services {#sec-release-23.11-new-services}`

rl-2311: Add placeholder entries This fixes manual-combined validation. 2023-05-23 05:59:00 +01:00			`- Create the first release note entry in this section!`

23.11 is Tapir 2023-05-22 20:14:06 +01:00			`<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->`

nixos/river: init module 2023-05-15 12:45:23 +01:00			`- [river](https://github.com/riverwm/river), A dynamic tiling wayland compositor. Available as [programs.river](#opt-programs.river.enable).`

23.11 is Tapir 2023-05-22 20:14:06 +01:00			`## Backward Incompatibilities {#sec-release-23.11-incompatibilities}`

clonehero: 0.23.2.2 -> 1.0.0.4080 Co-authored-by: Kira Bruneau <kira.bruneau@pm.me> 2023-04-25 06:29:28 +01:00			- The latest version of `clonehero` now stores custom content in `~/.clonehero`. See the [migration instructions](https://clonehero.net/2022/11/29/v23-to-v1-migration-instructions.html). Typically, these content files would exist along side the binary, but the previous build used a wrapper script that would store them in `~/.config/unity3d/srylain Inc_/Clone Hero`.
rl-2311: Add placeholder entries This fixes manual-combined validation. 2023-05-23 05:59:00 +01:00
etcd: switch to etcd_3_5 2023-05-23 21:54:43 +01:00			- `etcd` has been updated to 3.5, you will want to read the [3.3 to 3.4](https://etcd.io/docs/v3.5/upgrades/upgrade_3_4/) and [3.4 to 3.5](https://etcd.io/docs/v3.5/upgrades/upgrade_3_5/) upgrade guides

23.11 is Tapir 2023-05-22 20:14:06 +01:00			`## Other Notable Changes {#sec-release-23.11-notable-changes}`

nixos/cinnamon: enable portals by default 2023-05-26 15:13:36 +01:00			- The Cinnamon module now enables XDG desktop integration by default. If you are experiencing collisions related to xdg-desktop-portal-gtk you can safely remove `xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];` from your NixOS configuration.

nixos/qemu-vm: add option for named network interfaces Adds a new option to the virtualisation modules that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` option is still supported for cases where the name of the network interface is irrelevant. 2023-05-22 04:38:52 +01:00			- A new option was added to the virtualisation module that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` is still supported for cases where the name of the network interface is irrelevant.
nixos/nginx: first-class PROXY protocol support PROXY protocol is a convenient way to carry information about the originating address/port of a TCP connection across multiple layers of proxies/NAT, etc. Currently, it is possible to make use of it in NGINX's NixOS module, but is painful when we want to enable it "globally". Technically, this is achieved by reworking the defaultListen options and the objective is to have a coherent way to specify default listeners in the current API design. See `mkDefaultListenVhost` and `defaultListen` for the details. It adds a safeguard against running a NGINX with no HTTP listeners (e.g. only PROXY listeners) while asking for ACME certificates over HTTP-01. An interesting usecase of PROXY protocol is to enable seamless IPv4 to IPv6 proxy with origin IPv4 address for IPv6-only NGINX servers, it is demonstrated how to achieve this in the tests, using sniproxy. Finally, the tests covers: - NGINX `defaultListen` mechanisms are not broken by these changes; - NGINX PROXY protocol listeners are working in a final usecase (sniproxy); - uses snakeoil TLS certs from ACME setup with wildcard certificates; In the future, it is desirable to spoof-attack NGINX in this scenario to ascertain that `set_real_ip_from` and all the layers are working as intended and preventing any user from setting their origin IP address to any arbitrary, opening up the NixOS module to bad™ vulnerabilities. For now, it is quite hard to achieve while being minimalistic about the tests dependencies. 2023-03-05 17:13:27 +00:00
			- `services.nginx` gained a `defaultListen` option at server-level with support for PROXY protocol listeners, also `proxyProtocol` is now exposed in `services.nginx.virtualHosts.<name>.listen` option. It is now possible to run PROXY listeners and non-PROXY listeners at a server-level, see [#213510](https://github.com/NixOS/nixpkgs/pull/213510/) for more details.