c4patino/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-07-06 17:13:24 -05:00
Code Issues Projects Releases Packages Wiki Activity
nixpkgs/nixos/doc/manual/release-notes/rl-2611.section.md
Ilan Joselevich eaffe290dd
 nixos/nginx: add lua option for Lua scripting support 
Add `services.nginx.lua.{enable,extraPackages}` to enable OpenResty's
lua-nginx-module on a stock nginx. When enabled it adds the module,
includes lua-resty-core, and wires up lua_package_path /
lua_package_cpath (and lua_ssl_trusted_certificate) from a
luajit_openresty package set built from extraPackages.

When the configured package already bundles Lua (openresty), the module
and bundled libraries are not re-added; only the search path is set up so
its own lualib stays in use.

Migrate the openresty-lua test to the new option and add an nginx-lua
test covering the stock-nginx path.

Assisted-by: Claude:claude-opus-4-8
2026-06-25 00:56:45 +03:00

8.4 KiB
Raw Blame History

Release 26.11 ("Zokor", 2026.11/??)

Highlights

  • Create the first release note entry in this section!

New Modules

  • tranquil is an ATProto PDS (personal data server) implementation in Rust. A featureful, spec conscious and community driven alternative to the Bluesky reference implementation PDS. Available as services.tranquil-pds.

  • scx_loader, a system daemon and DBus-based loader for sched_ext schedulers. scxctl is the command-line client for interacting with the loader, allowing users to switch schedulers, modes, and arguments dynamically. Available as services.scx-loader

  • Nezha, a self-hosted, lightweight server and website monitoring and O&M tool. Available as services.nezha.

  • CastSponsorSkip, skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.

  • Stump, a free and open source comics, manga and digital book server with OPDS support. Available as services.stump.

  • FlapAlerted, detects BGP flapping events and provides statistics based on BGP update messages. Available as services.flap-alerted.

  • Unpackerr, extracts downloads for Radarr, Sonarr, Lidarr, Readarr, and/or a Watch folder. Available as services.unpackerr.

Backward Incompatibilities

  • boot.vesa has been removed. It was deprecated in 2020 because Xorg now works better with kernel modesetting. If you still need the legacy VESA 800x600 fallback, set boot.kernelParams = [ "vga=0x317" "nomodeset" ]; directly.

  • Support for the legacy U‐Boot image format has been removed from the initrd generators, as it is deprecated upstream and no longer used by any platform in Nixpkgs.

  • Rustical migrates from settings.http.host and settings.http.port to settings.http.bind to support UNIX domain sockets as well as TCP sockets in one setting.

  • A number of options for services.llama-cpp have been removed in favor of the structured option, attributes from which are used as arguments to llama-server executable, you can see all available options by running llama-server --help. Configuring model presets using Nix attribute set via services.llama-cpp.modelsPreset is no longer supported, please use services.llama-cpp.settings.models-preset with a path to an INI file containing desired options.

  • Python 2 has been removed from the top-level package set, as it is long past end-of-life. The python2, python27, python2Full, python27Full, python2Packages, and python27Packages attributes, along with the legacy python, pythonFull, and pythonPackages aliases, now throw an error directing you to python3. The isPy2 and isPy27 package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the resholve package for its oil dependency and is not exposed for general use.

  • security.polkit.enablePkexecWrapper has been introduced, making the pkexec setuid wrapper opt-in.

  • systemd.user.extraConfig has been removed in favor of the structured option. Use systemd.user.settings.Manager to set any systemd-user.conf(5) option directly. For example, replace systemd.user.extraConfig = "DefaultTimeoutStartSec=60"; with systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;.

  • services.timesyncd.extraConfig has been removed in favor of the structured option. Use services.timesyncd.settings.Time to set any timesyncd.conf(5) option directly. For example, replace services.timesyncd.extraConfig = "PollIntervalMaxSec=180"; with services.timesyncd.settings.Time.PollIntervalMaxSec = 180;.

  • services.firezone.server.provision has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone.

  • The services.syncthing module now updates the Syncthing REST API using partial updates (PATCH) instead of full replacements (PUT) for general settings. Updating these settings was broken and prone to errors after updates, see #428808 and #528889. As a result, settings modified manually through the Syncthing Web UI that are not explicitly defined in your Nix configuration will now persist across rebuilds.

  • services.plantuml-server.packages.jetty now supports jetty_12, it no longer supports jetty_11.

Other Notable Changes

  • komodo has been updated to the v2 release line (2.x). See the upstream v1 → v2 upgrade guide.

  • security.run0.enableSudoAlias now uses the run0-sudo-shim instead of a shell-script to improve compatibility.

  • security.run0.persistentAuth options have been added to support persistent Authentication of session. Timeout configurable via security.polkit.settings.Polkitd.ExpirationSeconds.

  • boot.loader.systemd-boot gained support for Automatic Boot Assessment via the new boot.loader.systemd-boot.bootCounting options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named nixos-<content-hash>.conf instead of nixos-generation-<n>.conf; existing entries are migrated automatically on the next nixos-rebuild boot/switch.

  • services.nginx gained a lua option to enable Lua scripting via OpenResty's lua-nginx-module on a stock nginx, configuring lua_package_path/lua_package_cpath from the packages listed in services.nginx.lua.extraPackages. Use this to add Lua to a regular nginx; for the full OpenResty platform (libraries that rely on its bundled lualib, such as lua-resty-openidc), set services.nginx.package to pkgs.openresty instead — the option configures the Lua search path for it too.

  • security.polkit.settings added for RFC42 style configuration of the polkitd daemon.

  • services.plausible can now again seed an initial admin user declaratively via services.plausible.adminUser.email. This makes fully declarative deployments safer: Otherwise the user needed to either accept Plausible's unauthenticated "first launch" setup wizard, which lets anyone reaching the instance create the first admin account, or do more work (deploying with NixOS's default binding to localhost without exposing it publicly, going through the wizard, and then deploying Plausible exposed to the Internet). This option was previously removed with NixOS 25.05 due to an upstream Plausible change making declarative admin creation more difficult, but this change re-implements the admin creation directly.

  • The newuidmap and newgidmap security wrappers are now installed with cap_setuid/cap_setgid file capabilities instead of the setuid-root bit, matching shadow's --with-fcaps install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via /etc/subuid (which NixOS never configures by default) additionally requires cap_setfcap; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";.