nixpkgs/nixos/doc/manual/release-notes/rl-1909.xml

<section xmlns="http://docbook.org/ns/docbook"
         xmlns:xlink="http://www.w3.org/1999/xlink"
         xmlns:xi="http://www.w3.org/2001/XInclude"
         version="5.0"
         xml:id="sec-release-19.09">
 <title>Release 19.09 (“Loris”, 2019/09/??)</title>

 <section xmlns="http://docbook.org/ns/docbook"
         xmlns:xlink="http://www.w3.org/1999/xlink"
         xmlns:xi="http://www.w3.org/2001/XInclude"
         version="5.0"
         xml:id="sec-release-19.09-highlights">
  <title>Highlights</title>

  <para>
   In addition to numerous new and upgraded packages, this release has the
   following highlights:
  </para>

  <itemizedlist>
   <listitem>
    <para>
     End of support is planned for end of April 2020, handing over to 20.03.
    </para>
   </listitem>
   <listitem>
    <para>
     PHP now defaults to PHP 7.3, updated from 7.2.
    </para>
   </listitem>
   <listitem>
    <para>
     PHP 7.1 is no longer supported due to upstream not supporting this version for the entire lifecycle of the 19.09 release.
    </para>
   </listitem>
   <listitem>
     <para>
       The binfmt module is now easier to use. Additional systems can
       be added through <option>boot.binfmt.emulatedSystems</option>.
       For instance, <literal>boot.binfmt.emulatedSystems = [
       "wasm32-wasi" "x86_64-windows" "aarch64-linux" ];</literal> will
       set up binfmt interpreters for each of those listed systems.
     </para>
   </listitem>
   <listitem>
     <para>
     The installer now uses a less privileged <literal>nixos</literal> user whereas before we logged in as root.
     To gain root privileges use <literal>sudo -i</literal> without a password.
    </para>
   </listitem>
   <listitem>
    <para>
      We've updated to Xfce 4.14, which brings a new module <option>services.xserver.desktopManager.xfce4-14</option>.
      If you'd like to upgrade, please switch from the <option>services.xserver.desktopManager.xfce</option> module as it
      will be deprecated in a future release. They're incompatibilities with the current Xfce module; it doesn't support
      <option>thunarPlugins</option> and it isn't recommended to use <option>services.xserver.desktopManager.xfce</option>
      and <option>services.xserver.desktopManager.xfce4-14</option> simultaneously or to downgrade from Xfce 4.14 after upgrading.
    </para>
   </listitem>
  </itemizedlist>
 </section>

 <section xmlns="http://docbook.org/ns/docbook"
         xmlns:xlink="http://www.w3.org/1999/xlink"
         xmlns:xi="http://www.w3.org/2001/XInclude"
         version="5.0"
         xml:id="sec-release-19.09-new-services">
  <title>New Services</title>

  <para>
   The following new services were added since the last release:
  </para>

  <itemizedlist>
   <listitem>
    <para>
     <literal>./programs/dwm-status.nix</literal>
    </para>
   </listitem>
  </itemizedlist>
 </section>

 <section xmlns="http://docbook.org/ns/docbook"
         xmlns:xlink="http://www.w3.org/1999/xlink"
         xmlns:xi="http://www.w3.org/2001/XInclude"
         version="5.0"
         xml:id="sec-release-19.09-incompatibilities">
  <title>Backward Incompatibilities</title>

  <para>
   When upgrading from a previous release, please be aware of the following
   incompatible changes:
  </para>

  <itemizedlist>
   <listitem>
    <para>
     Buildbot no longer supports Python 2, as support was dropped upstream in
     version 2.0.0. Configurations may need to be modified to make them
     compatible with Python 3.
    </para>
   </listitem>
   <listitem>
    <para>
     PostgreSQL now uses
     <filename class="directory">/run/postgresql</filename> as its socket
     directory instead of <filename class="directory">/tmp</filename>. So
     if you run an application like eg. Nextcloud, where you need to use
     the Unix socket path as the database host name, you need to change it
     accordingly.
    </para>
   </listitem>
   <listitem>
    <para>
     The options <option>services.prometheus.alertmanager.user</option> and
     <option>services.prometheus.alertmanager.group</option> have been removed
     because the alertmanager service is now using systemd's <link
     xlink:href="http://0pointer.net/blog/dynamic-users-with-systemd.html">
     DynamicUser mechanism</link> which obviates these options.
    </para>
   </listitem>
   <listitem>
    <para>
     The NetworkManager systemd unit was renamed back from network-manager.service to
     NetworkManager.service for better compatibility with other applications expecting this name.
     The same applies to ModemManager where modem-manager.service is now called ModemManager.service again.
    </para>
   </listitem>
   <listitem>
    <para>
     The <option>services.nzbget.configFile</option> and <option>services.nzbget.openFirewall</option>
     options were removed as they are managed internally by the nzbget. The
     <option>services.nzbget.dataDir</option> option hadn't actually been used by
     the module for some time and so was removed as cleanup.
    </para>
   </listitem>
   <listitem>
    <para>
     The <option>services.mysql.pidDir</option> option was removed, as it was only used by the wordpress
     apache-httpd service to wait for mysql to have started up.
     This can be accomplished by either describing a dependency on mysql.service (preferred)
     or waiting for the (hardcoded) <filename>/run/mysqld/mysql.sock</filename> file to appear.
    </para>
   </listitem>
   <listitem>
    <para>
     The <option>services.emby.enable</option> module has been removed, see
     <option>services.jellyfin.enable</option> instead for a free software fork of Emby.

     See the Jellyfin documentation:
     <link xlink:href="https://jellyfin.readthedocs.io/en/latest/administrator-docs/migrate-from-emby/">
       Migrating from Emby to Jellyfin
     </link>
    </para>
   </listitem>
   <listitem>
     <para>
     IPv6 Privacy Extensions are now enabled by default for undeclared
     interfaces. The previous behaviour was quite misleading — even though
     the default value for
     <option>networking.interfaces.*.preferTempAddress</option> was
     <literal>true</literal>, undeclared interfaces would not prefer temporary
     addresses. Now, interfaces not mentioned in the config will prefer
     temporary addresses. EUI64 addresses can still be set as preferred by
     explicitly setting the option to <literal>false</literal> for the
     interface in question.
    </para>
   </listitem>
   <listitem>
    <para>
     Since Bittorrent Sync was superseded by Resilio Sync in 2016, the
     <literal>bittorrentSync</literal>, <literal>bittorrentSync14</literal>,
     and <literal>bittorrentSync16</literal> packages have been removed in
     favor of <literal>resilio-sync</literal>.
    </para>
    <para>
     The corresponding module, <option>services.btsync</option> has been
     replaced by the <option>services.resilio</option> module.
    </para>
   </listitem>
   <listitem>
    <para>
     The httpd service no longer attempts to start the postgresql service. If you have come to depend
     on this behaviour then you can preserve the behavior with the following configuration:
     <literal>systemd.services.httpd.after = [ "postgresql.service" ];</literal>
    </para>
    <para>
     The option <option>services.httpd.extraSubservices</option> has been
     marked as deprecated. You may still use this feature, but it will be
     removed in a future release of NixOS. You are encouraged to convert any
     httpd subservices you may have written to a full NixOS module.
    </para>
    <para>
     Most of the httpd subservices packaged with NixOS have been replaced with
     full NixOS modules including LimeSurvey, WordPress, and Zabbix. These
     modules can be enabled using the <option>services.limesurvey.enable</option>,
     <option>services.mediawiki.enable</option>, <option>services.wordpress.enable</option>,
     and <option>services.zabbixWeb.enable</option> options.
    </para>
   </listitem>
   <listitem>
    <para>
     The option <option>systemd.network.networks.&lt;name&gt;.routes.*.routeConfig.GatewayOnlink</option>
     was renamed to <option>systemd.network.networks.&lt;name&gt;.routes.*.routeConfig.GatewayOnLink</option>
     (capital <literal>L</literal>). This follows
     <link xlink:href="https://github.com/systemd/systemd/commit/9cb8c5593443d24c19e40bfd4fc06d672f8c554c">
      upstreams renaming
     </link> of the setting.
    </para>
   </listitem>
   <listitem>
    <para>
     As of this release the NixOps feature <literal>autoLuks</literal> is deprecated. It no longer works
     with our systemd version without manual intervention.
    </para>
    <para>
     Whenever the usage of the module is detected the evaluation will fail with a message
     explaining why and how to deal with the situation.
    </para>
    <para>
     A new knob named <literal>nixops.enableDeprecatedAutoLuks</literal>
     has been introduced to disable the eval failure and to acknowledge the notice was received and read.
     If you plan on using the feature please note that it might break with subsequent updates.
    </para>
    <para>
     Make sure you set the <literal>_netdev</literal> option for each of the file systems referring to block
     devices provided by the autoLuks module. Not doing this might render the system in a
     state where it doesn't boot anymore.
    </para>
    <para>
     If you are actively using the <literal>autoLuks</literal> module please let us know in
     <link xlink:href="https://github.com/NixOS/nixpkgs/issues/62211">issue #62211</link>.
    </para>
   </listitem>
   <listitem>
    <para>
     The setopt declarations will be evaluated at the end of <literal>/etc/zshrc</literal>, so any code in <xref linkend="opt-programs.zsh.interactiveShellInit" />,
     <xref linkend="opt-programs.zsh.loginShellInit" /> and <xref linkend="opt-programs.zsh.promptInit" /> may break if it relies on those options being set.
    </para>
   </listitem>
   <listitem>
    <para>
      The <literal>prometheus-nginx-exporter</literal> package now uses the offical exporter provided by NGINX Inc.
      Its metrics are differently structured and are incompatible to the old ones. For information about the metrics,
      have a look at the <link xlink:href="https://github.com/nginxinc/nginx-prometheus-exporter">official repo</link>.
    </para>
   </listitem>
   <listitem>
    <para>
     The <literal>shibboleth-sp</literal> package has been updated to version 3.
     It is largely backward compatible, for further information refer to the
     <link xlink:href="https://wiki.shibboleth.net/confluence/display/SP3/ReleaseNotes">release notes</link>
     and <link xlink:href="https://wiki.shibboleth.net/confluence/display/SP3/UpgradingFromV2">upgrade guide</link>.
    </para>
     <para>
       Nodejs 8 is scheduled EOL under the lifetime of 19.09 and has been dropped.
     </para>
   </listitem>
   <listitem>
     <para>
       By default, prometheus exporters are now run with <literal>DynamicUser</literal> enabled.
       Exporters that need a real user, now run under a seperate user and group which follow the pattern <literal>&lt;exporter-name&gt;-exporter</literal>, instead of the previous default <literal>nobody</literal> and <literal>nogroup</literal>.
       Only some exporters are affected by the latter, namely the exporters <literal>dovecot</literal>, <literal>node</literal>, <literal>postfix</literal> and <literal>varnish</literal>.
     </para>
   </listitem>
   <listitem>
     <para>
       The <literal>ibus-qt</literal> package is not installed by default anymore when <xref linkend="opt-i18n.inputMethod.enabled" /> is set to <literal>ibus</literal>.
       If IBus support in Qt 4.x applications is required, add the <literal>ibus-qt</literal> package to your <xref linkend="opt-environment.systemPackages" /> manually.
     </para>
   </listitem>
   <listitem>
     <para>
       The CUPS Printing service now uses socket-based activation by
       default, only starting when needed. The previous behavior can
       be restored by setting
       <option>services.cups.startWhenNeeded</option> to
       <literal>false</literal>.
     </para>
   </listitem>
   <listitem>
     <para>
       The <option>services.systemhealth</option> module has been removed from nixpkgs due to lack of maintainer.
     </para>
   </listitem>
   <listitem>
     <para>
       The <option>services.mantisbt</option> module has been removed from nixpkgs due to lack of maintainer.
     </para>
   </listitem>
   <listitem>
     <para>
       Squid 3 has been removed and the <option>squid</option> derivation now refers to Squid 4.
     </para>
   </listitem>
   <listitem>
     <para>
       The <option>services.pdns-recursor.extraConfig</option> option has been replaced by
       <option>services.pdns-recursor.settings</option>. The new option allows setting extra
       configuration while being better type-checked and mergeable.
     </para>
   </listitem>
   <listitem>
    <para>
     No service depends on <literal>keys.target</literal> anymore which is a systemd
     target that indicates if all <link xlink:href="https://nixos.org/nixops/manual/#idm140737322342384">NixOps keys</link> were successfully uploaded.
     Instead, <literal>&lt;key-name&gt;-key.service</literal> should be used to define
     a dependency of a key in a service. The full issue behind the <literal>keys.target</literal>
     dependency is described at <link xlink:href="https://github.com/NixOS/nixpkgs/issues/67265">NixOS/nixpkgs#67265</link>.
    </para>
    <para>
     The following services are affected by this:
     <itemizedlist>
      <listitem><para><link linkend="opt-services.dovecot2.enable"><literal>services.dovecot2</literal></link></para></listitem>
      <listitem><para><link linkend="opt-services.nsd.enable"><literal>services.nsd</literal></link></para></listitem>
      <listitem><para><link linkend="opt-services.softether.enable"><literal>services.softether</literal></link></para></listitem>
      <listitem><para><link linkend="opt-services.strongswan.enable"><literal>services.strongswan</literal></link></para></listitem>
      <listitem><para><link linkend="opt-services.strongswan-swanctl.enable"><literal>services.strongswan-swanctl</literal></link></para></listitem>
      <listitem><para><link linkend="opt-services.httpd.enable"><literal>services.httpd</literal></link></para></listitem>
     </itemizedlist>
    </para>
   </listitem>
  </itemizedlist>
 </section>

 <section xmlns="http://docbook.org/ns/docbook"
         xmlns:xlink="http://www.w3.org/1999/xlink"
         xmlns:xi="http://www.w3.org/2001/XInclude"
         version="5.0"
         xml:id="sec-release-19.09-notable-changes">
  <title>Other Notable Changes</title>

  <itemizedlist>
   <listitem>
    <para>
     The <option>documentation</option> module gained an option named
     <option>documentation.nixos.includeAllModules</option> which makes the
     generated <citerefentry>
     <refentrytitle>configuration.nix</refentrytitle>
     <manvolnum>5</manvolnum></citerefentry> manual page include all options
     from all NixOS modules included in a given
     <literal>configuration.nix</literal> configuration file. Currently, it is
     set to <literal>false</literal> by default as enabling it frequently
     prevents evaluation. But the plan is to eventually have it set to
     <literal>true</literal> by default. Please set it to
     <literal>true</literal> now in your <literal>configuration.nix</literal>
     and fix all the bugs it uncovers.
    </para>
   </listitem>
   <listitem>
    <para>
     The <literal>vlc</literal> package gained support for Chromecast
     streaming, enabled by default. TCP port 8010 must be open for it to work,
     so something like <literal>networking.firewall.allowedTCPPorts = [ 8010
     ];</literal> may be required in your configuration. Also consider enabling
     <link xlink:href="https://nixos.wiki/wiki/Accelerated_Video_Playback">
     Accelerated Video Playback</link> for better transcoding performance.
    </para>
   </listitem>
   <listitem>
    <para>
     The following changes apply if the <literal>stateVersion</literal> is
     changed to 19.09 or higher. For <literal>stateVersion = "19.03"</literal>
     or lower the old behavior is preserved.
    </para>
    <itemizedlist>
     <listitem>
      <para>
       <literal>solr.package</literal> defaults to
       <literal>pkgs.solr_8</literal>.
      </para>
     </listitem>
    </itemizedlist>
   </listitem>
   <listitem>
    <para>
     The <literal>hunspellDicts.fr-any</literal> dictionary now ships with <literal>fr_FR.{aff,dic}</literal>
     which is linked to <literal>fr-toutesvariantes.{aff,dic}</literal>.
    </para>
   </listitem>
   <listitem>
    <para>
     The <literal>mysql</literal> service now runs as <literal>mysql</literal>
     user. Previously, systemd did execute it as root, and mysql dropped privileges
     itself.
     This includes <literal>ExecStartPre=</literal> and
     <literal>ExecStartPost=</literal> phases.
     To accomplish that, runtime and data directory setup was delegated to
     RuntimeDirectory and tmpfiles.
    </para>
   </listitem>
   <listitem>
    <para>
     With the upgrade to systemd version 242 the <literal>systemd-timesyncd</literal>
     service is no longer using <literal>DynamicUser=yes</literal>. In order for the
     upgrade to work we rely on an activation script to move the state from the old
     to the new directory. The older directory (prior <literal>19.09</literal>) was
     <literal>/var/lib/private/systemd/timesync</literal>.
    </para>
    <para>
     As long as the <literal>system.config.stateVersion</literal> is below
     <literal>19.09</literal> the state folder will migrated to its proper location
     (<literal>/var/lib/systemd/timesync</literal>), if required.
    </para>
   </listitem>
   <listitem>
    <para>
     The package <literal>avahi</literal> is now built to look up service
     definitions from <literal>/etc/avahi/services</literal> instead of its
     output directory in the nix store. Accordingly the module
     <option>avahi</option> now supports custom service definitions via
     <option>services.avahi.extraServiceFiles</option>, which are then placed
     in the aforementioned directory. See <citerefentry>
     <refentrytitle>avahi.service</refentrytitle><manvolnum>5</manvolnum>
     </citerefentry> for more information on custom service definitions.
    </para>
   </listitem>
   <listitem>
    <para>
     Since version 0.1.19, <literal>cargo-vendor</literal> honors package
     includes that are specified in the <filename>Cargo.toml</filename>
     file of Rust crates. <literal>rustPlatform.buildRustPackage</literal> uses
     <literal>cargo-vendor</literal> to collect and build dependent crates.
     Since this change in <literal>cargo-vendor</literal> changes the set of
     vendored files for most Rust packages, the hash that use used to verify
     the dependencies, <literal>cargoSha256</literal>, also changes.
    </para>
    <para>
     The <literal>cargoSha256</literal> hashes of all in-tree derivations that
     use <literal>buildRustPackage</literal> have been updated to reflect this
     change. However, third-party derivations that use
     <literal>buildRustPackage</literal> may have to be updated as well.
    </para>
   </listitem>
   <listitem>
    <para>
     The <literal>consul</literal> package was upgraded past version <literal>1.5</literal>,
     so its deprecated legacy UI is no longer available.
    </para>
   </listitem>
   <listitem>
    <para>
     The default resample-method for PulseAudio has been changed from the upstream default <literal>speex-float-1</literal>
     to <literal>speex-float-5</literal>. Be aware that low-powered ARM-based and MIPS-based boards will struggle with this
     so you'll need to set <option>hardware.pulseaudio.daemon.config.resample-method</option> back to <literal>speex-float-1</literal>.
    </para>
   </listitem>
   <listitem>
    <para>
     The <literal>phabricator</literal> package and associated <literal>httpd.extraSubservice</literal>, as well as the
     <literal>phd</literal> service have been removed from nixpkgs due to lack of maintainer.
    </para>
   </listitem>
   <listitem>
    <para>
     The <literal>mercurial</literal> <literal>httpd.extraSubservice</literal> has been removed from nixpkgs due to lack of maintainer.
    </para>
   </listitem>
   <listitem>
    <para>
     The <literal>trac</literal> <literal>httpd.extraSubservice</literal> has been removed from nixpkgs because it was unmaintained.
    </para>
   </listitem>
   <listitem>
    <para>
     The <literal>foswiki</literal> package and associated <literal>httpd.extraSubservice</literal> have been removed
     from nixpkgs due to lack of maintainer.
    </para>
   </listitem>
   <listitem>
    <para>
     The <literal>tomcat-connector</literal> <literal>httpd.extraSubservice</literal> has been removed from nixpkgs.
    </para>
   </listitem>
   <listitem>
    <para>
     It's now possible to change configuration in
     <link linkend="opt-services.nextcloud.enable">services.nextcloud</link> after the initial deploy
     since all config parameters are persisted in an additional config file generated by the module.
     Previously core configuration like database parameters were set using their imperative
     installer after creating <literal>/var/lib/nextcloud</literal>.
    </para>
   </listitem>
   <listitem>
    <para>
     There exists now <literal>lib.forEach</literal>, which is like <literal>map</literal>, but with
     arguments flipped. When mapping function body spans many lines (or has nested
     <literal>map</literal>s), it is often hard to follow which list is modified.
    </para>
    <para>
     Previous solution to this problem was either to use <literal>lib.flip map</literal>
     idiom or extract that anonymous mapping function to a named one. Both can still be used
     but <literal>lib.forEach</literal> is preferred over <literal>lib.flip map</literal>.
    </para>
    <para>
      The <literal>/etc/sysctl.d/nixos.conf</literal> file containing all the options set via
      <link linkend="opt-boot.kernel.sysctl">boot.kernel.sysctl</link> was moved to
      <literal>/etc/sysctl.d/60-nixos.conf</literal>, as
      <citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
      recommends prefixing all filenames in <literal>/etc/sysctl.d</literal> with a
      two-digit number and a dash to simplify the ordering of the files.
    </para>
   </listitem>
   <listitem>
    <para>
      We now install the sysctl snippets shipped with systemd.
    <itemizedlist>
     <para>This enables:</para>
     <listitem>
      <para>Loose reverse path filtering</para>
     </listitem>
     <listitem>
      <para>Source route filtering</para>
     </listitem>
     <listitem>
      <para>
       <literal>fq_codel</literal> as a packet scheduler (this helps to fight bufferbloat)
      </para>
     </listitem>
    </itemizedlist>

     This also configures the kernel to pass coredumps to <literal>systemd-coredump</literal>.
     These sysctl snippets can be found in <literal>/etc/sysctl.d/50-*.conf</literal>,
     and overridden via <link linkend="opt-boot.kernel.sysctl">boot.kernel.sysctl</link>
     (which will place the parameters in <literal>/etc/sysctl.d/60-nixos.conf</literal>).
     </para>
   </listitem>
   <listitem>
    <para>
      Coredumps are now acquired by <literal>systemd-coredump</literal> by default.
      <literal>systemd-coredump</literal> behaviour can still be modified via
      <option>systemd.coredump.extraConfig</option>.
      To stick to the old behaviour (having the kernel dump to a file called <literal>core</literal>
      in the working directory), without piping it through <literal>systemd-coredump</literal>, set
      <option>boot.kernel.sysctl."kernel.core_pattern"</option> to <literal>"core"</literal>.
    </para>
   </listitem>
  <listitem>
   <para>
    <literal>systemd.packages</literal> option now also supports generators and
    shutdown scripts. Old <literal>systemd.generator-packages</literal> option has
    been removed.
   </para>
  </listitem>
  <listitem>
   <para>
    The <literal>rmilter</literal> package was removed with associated module and options due deprecation by upstream developer.
    Use <literal>rspamd</literal> in proxy mode instead.
   </para>
  </listitem>
  <listitem>
   <para>
     systemd cgroup accounting via the
     <link linkend="opt-systemd.enableCgroupAccounting">systemd.enableCgroupAccounting</link>
     option is now enabled by default. It now also enables the more recent Block IO and IP accounting
     features.
   </para>
  </listitem>
  </itemizedlist>
 </section>
</section>