Merge branch 'NixOS:master' into flood-for-transmission_2025-07-19T10-51-22

Author: kugland

maintainers/maintainer-list.nix

@@ -1488,12 +1488,6 @@
     name = "Anas Elgarhy";
     keys = [ { fingerprint = "E10B D192 9231 08C7 3C35 7EC3 83E0 3DC6 F383 4086"; } ];
   };
-  AnatolyPopov = {
-    email = "[email protected]";
-    github = "AnatolyPopov";
-    githubId = 2312534;
-    name = "Anatolii Popov";
-  };
   andehen = {
     email = "[email protected]";
     github = "andehen";
@@ -12899,12 +12893,6 @@
     githubId = 20658981;
     name = "Jarosław Wygoda";
   };
-  jyp = {
-    email = "[email protected]";
-    github = "jyp";
-    githubId = 27747;
-    name = "Jean-Philippe Bernardy";
-  };
   jzellner = {
     email = "[email protected]";
     github = "sofuture";
@@ -18842,11 +18830,6 @@
     githubId = 9091609;
     name = "Omar Jatoi";
   };
-  omasanori = {
-    github = "omasanori";
-    githubId = 167209;
-    name = "Masanori Ogino";
-  };
   omgbebebe = {
     email = "[email protected]";
     github = "omgbebebe";
@@ -19342,6 +19325,12 @@
     githubId = 821972;
     name = "Parth Mehrotra";
   };
+  pascalj = {
+    email = "[email protected]";
+    github = "pascalj";
+    githubId = 330168;
+    name = "Pascal Jungblut";
+  };
   paschoal = {
     email = "[email protected]";
     github = "paschoal";

maintainers/team-list.nix

@@ -1144,7 +1144,6 @@ with lib.maintainers;
   sage = {
     members = [
       timokau
-      omasanori
       raskin
       collares
     ];

nixos/modules/profiles/installation-device.nix

@@ -102,11 +102,10 @@ with lib;
     boot.kernel.sysctl."vm.overcommit_memory" = "1";
 
     # To speed up installation a little bit, include the complete
-    # stdenv in the Nix store on the CD.
+    # stdenvNoCC in the Nix store on the CD.
     system.extraDependencies =
       with pkgs;
       [
-        stdenv
         stdenvNoCC # for runCommand
         busybox
         # For boot.initrd.systemd

nixos/modules/services/networking/cjdns.nix

@@ -49,7 +49,7 @@ let
         k: v:
         lib.optionalString (
           v.hostname != ""
-        ) "echo $(${pkgs.cjdns}/bin/publictoip6 ${v.publicKey}) ${v.hostname}"
+        ) "echo $(${pkgs.cjdns}/bin/cjdnstool util key2ip6 ${v.publicKey}) ${v.hostname}"
       ) (cfg.ETHInterface.connectTo // cfg.UDPInterface.connectTo)
     )}
   '';
@@ -268,7 +268,7 @@ in
 
         if [ -z "$CJDNS_PRIVATE_KEY" ]; then
             shopt -s lastpipe
-            ${pkg}/bin/makekeys | { read private ipv6 public; }
+            ${pkg}/bin/cjdnstool util keygen | { read private ipv6 public; }
 
             install -m 600 <(echo "CJDNS_PRIVATE_KEY=$private") /etc/cjdns.keys
             install -m 444 <(echo -e "CJDNS_IPV6=$ipv6\nCJDNS_PUBLIC_KEY=$public") /etc/cjdns.public

nixos/modules/services/security/kanidm.nix

@@ -888,7 +888,14 @@ in
         (
           defaultServiceConfig
           // {
-            BindReadOnlyPaths = mergePaths (defaultServiceConfig.BindReadOnlyPaths ++ secretPaths);
+            BindReadOnlyPaths = mergePaths (
+              defaultServiceConfig.BindReadOnlyPaths
+              ++ secretPaths
+              ++ (lib.optionals (cfg.provision.enable && !cfg.provision.acceptInvalidCerts) [
+                "-/etc/ssl"
+                "-/etc/static/ssl"
+              ])
+            );
           }
         )
         {

nixos/modules/services/security/usbguard.nix

@@ -50,11 +50,7 @@ in
     services.usbguard = {
       enable = lib.mkEnableOption "USBGuard daemon";
 
-      package = lib.mkPackageOption pkgs "usbguard" {
-        extraDescription = ''
-          If you do not need the Qt GUI, use `pkgs.usbguard-nox` to save disk space.
-        '';
-      };
+      package = lib.mkPackageOption pkgs "usbguard" { };
 
       ruleFile = lib.mkOption {
         type = lib.types.nullOr lib.types.path;

nixos/modules/services/web-apps/freshrss.nix

@@ -18,7 +18,7 @@ let
     DATA_PATH = cfg.dataDir;
   }
   // lib.optionalAttrs (cfg.extensions != [ ]) {
-    THIRDPARTY_EXTENSIONS_PATH = "${extension-env}/share/freshrss/";
+    THIRDPARTY_EXTENSIONS_PATH = "${extension-env}/share/freshrss";
   };
 in
 {

nixos/modules/services/web-apps/outline.nix

@@ -166,6 +166,13 @@ in
             type = lib.types.str;
             description = "S3 access key.";
           };
+          accelerateUrl = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              URL for AWS S3 [transfer acceleration](https://docs.aws.amazon.com/AmazonS3/latest/userguide/transfer-acceleration.html).
+            '';
+          };
           secretKeyFile = lib.mkOption {
             type = lib.types.path;
             description = "File path that contains the S3 secret key.";
@@ -682,6 +689,10 @@ in
             AWS_S3_ACL = cfg.storage.acl;
           })
 
+          (lib.mkIf (cfg.storage.storageType == "s3" && cfg.storage.accelerateUrl != null) {
+            AWS_S3_ACCELERATE_URL = cfg.storage.accelerateUrl;
+          })
+
           (lib.mkIf (cfg.slackAuthentication != null) {
             SLACK_CLIENT_ID = cfg.slackAuthentication.clientId;
           })

nixos/tests/cjdns.nix

@@ -105,7 +105,7 @@ in
 
     def cjdns_ip(machine):
         res = machine.succeed("ip -o -6 addr show dev tun0")
-        ip = re.split("\s+|/", res)[3]
+        ip = re.split("\\s+|/", res)[3]
         machine.log("has ip {}".format(ip))
         return ip
 
@@ -116,14 +116,14 @@ in
 
     # ping a few times each to let the routing table establish itself
 
-    alice.succeed("ping -c 4 {}".format(carol_ip6))
-    bob.succeed("ping -c 4 {}".format(carol_ip6))
+    alice.wait_until_succeeds("ping -c 4 {}".format(carol_ip6))
+    bob.wait_until_succeeds("ping -c 4 {}".format(carol_ip6))
 
-    carol.succeed("ping -c 4 {}".format(alice_ip6))
-    carol.succeed("ping -c 4 {}".format(bob_ip6))
+    carol.wait_until_succeeds("ping -c 4 {}".format(alice_ip6))
+    carol.wait_until_succeeds("ping -c 4 {}".format(bob_ip6))
 
-    alice.succeed("ping -c 4 {}".format(bob_ip6))
-    bob.succeed("ping -c 4 {}".format(alice_ip6))
+    alice.wait_until_succeeds("ping -c 4 {}".format(bob_ip6))
+    bob.wait_until_succeeds("ping -c 4 {}".format(alice_ip6))
 
     alice.wait_for_unit("httpd.service")
 

nixos/tests/freshrss/extensions.nix

@@ -8,14 +8,30 @@
         enable = true;
         baseUrl = "http://localhost";
         authType = "none";
-        extensions = [ pkgs.freshrss-extensions.youtube ];
+        extensions = [
+          pkgs.freshrss-extensions.youtube
+          pkgs.freshrss-extensions.title-wrap
+        ];
       };
     };
+  extraPythonPackages = p: [
+    p.lxml
+    p.lxml-stubs
+  ];
+  skipTypeCheck = true;
 
   testScript = ''
     machine.wait_for_unit("multi-user.target")
     machine.wait_for_open_port(80)
-    response = machine.succeed("curl -vvv -s http://localhost:80/i/?c=extension")
+    response = machine.succeed("curl -s http://localhost:80/i/?c=extension")
     assert '<span class="ext_name disabled">YouTube Video Feed</span>' in response, "Extension not present in extensions page."
+
+    # enable Title-Wrap extension
+    from lxml import etree
+    tree = etree.HTML(response)
+    csrf = tree.xpath("/html/body/header/nav/form/input/@value")[0]
+    response = machine.succeed(f"curl --fail-with-body -s 'http://localhost:80/i/?c=extension&a=enable&e=Title-Wrap' -d '_csrf={csrf}'")
+    # verify that the Title-Wrap css is accessible.
+    machine.succeed("curl --fail-with-body -s 'http://localhost:80/ext.php?1=&f=xExtension-TitleWrap/static/title_wrap.css'")
   '';
 }