Merge master into staging-next

NixOS · Jan 16, 2025 · d4a1995 · d4a1995
2 parents 4083f92 + 5ae2660
commit d4a1995
Show file tree

Hide file tree

Showing 207 changed files with 2,503 additions and 11,097 deletions.
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
@@ -22,8 +22,8 @@ jobs:
       - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
         id: app-token
         with:
-          app-id: ${{ vars.BACKPORT_APP_ID }}
-          private-key: ${{ secrets.BACKPORT_PRIVATE_KEY }}
+          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
 
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:

diff --git a/.github/workflows/periodic-merge-24h.yml b/.github/workflows/periodic-merge-24h.yml
@@ -14,9 +14,7 @@ on:
     - cron:  '0 0 * * *'
   workflow_dispatch:
 
-permissions:
-  contents: write  # for devmasx/merge-branch to merge branches
-  pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
+permissions: {}
 
 jobs:
   periodic-merge:
@@ -39,3 +37,4 @@ jobs:
     with:
       from: ${{ matrix.pairs.from }}
       into: ${{ matrix.pairs.into }}
+    secrets: inherit
diff --git a/.github/workflows/periodic-merge-6h.yml b/.github/workflows/periodic-merge-6h.yml
@@ -14,9 +14,7 @@ on:
     - cron:  '0 */6 * * *'
   workflow_dispatch:
 
-permissions:
-  contents: write  # for devmasx/merge-branch to merge branches
-  pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
+permissions: {}
 
 jobs:
   periodic-merge:
@@ -37,3 +35,4 @@ jobs:
     with:
       from: ${{ matrix.pairs.from }}
       into: ${{ matrix.pairs.into }}
+    secrets: inherit
diff --git a/.github/workflows/periodic-merge.yml b/.github/workflows/periodic-merge.yml
@@ -17,6 +17,14 @@ jobs:
     runs-on: ubuntu-24.04
     name: ${{ inputs.from }} → ${{ inputs.into }}
     steps:
+      # Use a GitHub App to create the PR so that CI gets triggered
+      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
+      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+        id: app-token
+        with:
+          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Find merge base between two branches
@@ -38,7 +46,7 @@ jobs:
           type: now
           from_branch: ${{ steps.merge_base.outputs.merge_base || inputs.from }}
           target_branch: ${{ inputs.into }}
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ steps.app-token.outputs.token }}
 
       - name: Comment on failure
         uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
@@ -47,3 +55,4 @@ jobs:
           issue-number: 105153
           body: |
             Periodic merge from `${{ inputs.from }}` into `${{ inputs.into }}` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
+          token: ${{ steps.app-token.outputs.token }}
diff --git a/doc/stdenv/platform-notes.chapter.md b/doc/stdenv/platform-notes.chapter.md
@@ -80,7 +80,7 @@ stdenv.mkDerivation {
 }
 ```
 
-Note: It is possible to have multiple, different instances of `darwinMinVerisonHook` in your inputs.
+Note: It is possible to have multiple, different instances of `darwinMinVersionHook` in your inputs.
 When that happens, the one with the  highest version is always used.
 
 #### Picking an SDK version {#sec-darwin-troubleshooting-picking-sdk-version}

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
@@ -2066,6 +2066,12 @@
     githubId = 869771;
     name = "Kirill Boltaev";
   };
+  aspauldingcode = {
+    email = "[email protected]";
+    github = "aspauldingcode";
+    githubId = 10196826;
+    name = "Alex Spaulding";
+  };
   asppsa = {
     email = "[email protected]";
     github = "asppsa";
@@ -4956,6 +4962,12 @@
     name = "Dov Alperin";
     keys = [ { fingerprint = "4EED 5096 B925 86FA 1101  6673 7F2C 07B9 1B52 BB61"; } ];
   };
+  da-luce = {
+    email = "[email protected]";
+    github = "da-luce";
+    githubId = 102048662;
+    name = "Dalton Luce";
+  };
   damhiya = {
     name = "SoonWon Moon";
     email = "[email protected]";
@@ -7422,6 +7434,12 @@
     name = "Felix Albrigtsen";
     matrix = "@felixalb:feal.no";
   };
+  felixdorn = {
+    name = "Félix";
+    matrix = "@d:xfe.li";
+    github = "felixdorn";
+    githubId = 55788595;
+  };
   felixscheinost = {
     name = "Felix Scheinost";
     email = "[email protected]";
@@ -20884,6 +20902,12 @@
     githubId = 16765155;
     name = "Shardul Baral";
   };
+  sharpchen = {
+    github = "sharpchen";
+    githubId = 77432836;
+    name = "sharpchen";
+    email = "[email protected]";
+  };
   sharzy = {
     email = "[email protected]";
     github = "SharzyL";

diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -37,6 +37,8 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- [AmneziaVPN](https://amnezia.org/en), an open-source VPN client, with a key feature that enables you to deploy your own VPN server on your server. Available as [programs.amnezia-vpn](#opt-programs.amnezia-vpn.enable).
+
 - [Bazecor](https://github.com/Dygmalab/Bazecor), the graphical configurator for Dygma Products.
 
 - [Bonsai](https://git.sr.ht/~stacyharper/bonsai), a general-purpose event mapper/state machine primarily used to create complex key shortcuts, and as part of the [SXMO](https://sxmo.org/) desktop environment. Available as [services.bonsaid](#opt-services.bonsaid.enable).
@@ -182,6 +184,8 @@
 
 - `linuxPackages.nvidiaPackages.dc_520` has been removed since it is marked broken and there are better newer alternatives.
 
+- `pnpm` was updated to version 10. If your project is incompatible, you can install the previous version from the package attribute `pnpm_9`.
+
 - `programs.less.lessopen` is now null by default. To restore the previous behaviour, set it to `''|${lib.getExe' pkgs.lesspipe "lesspipe.sh"} %s''`.
 
 - `hardware.pulseaudio` has been renamed to `services.pulseaudio`.  The deprecated option names will continue to work, but causes a warning.

diff --git a/nixos/lib/eval-config.nix b/nixos/lib/eval-config.nix
@@ -90,7 +90,7 @@ let
       You have set specialArgs.pkgs, which means that options like nixpkgs.config
       and nixpkgs.overlays will be ignored. If you wish to reuse an already created
       pkgs, which you know is configured correctly for this NixOS configuration,
-      please import the `nixosModules.pkgsReadOnly` module from the nixpkgs flake or
+      please import the `nixosModules.readOnlyPkgs` module from the nixpkgs flake or
       `(modulesPath + "/misc/nixpkgs/read-only.nix"), and set `{ nixpkgs.pkgs = <your pkgs>; }`.
       This properly disables the ignored options to prevent future surprises.
     ''

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
@@ -148,6 +148,7 @@
   ./programs/_1password.nix
   ./programs/adb.nix
   ./programs/alvr.nix
+  ./programs/amnezia-vpn.nix
   ./programs/appgate-sdp.nix
   ./programs/appimage.nix
   ./programs/arp-scan.nix

diff --git a/nixos/modules/programs/amnezia-vpn.nix b/nixos/modules/programs/amnezia-vpn.nix
@@ -0,0 +1,27 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.programs.amnezia-vpn;
+in
+{
+  options.programs.amnezia-vpn = {
+    enable = lib.mkEnableOption "The AmneziaVPN client";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.amnezia-vpn ];
+    services.dbus.packages = [ pkgs.amnezia-vpn ];
+    services.resolved.enable = true;
+
+    systemd = {
+      packages = [ pkgs.amnezia-vpn ];
+      services."AmneziaVPN".wantedBy = [ "multi-user.target" ];
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ sund3RRR ];
+}
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
@@ -1219,7 +1219,10 @@ in
           be changed using {option}`security.pam.u2f.authFile` option.
 
           File format is:
-          `username:first_keyHandle,first_public_key: second_keyHandle,second_public_key`
+          ```
+          <username1>:<KeyHandle1>,<UserKey1>,<CoseType1>,<Options1>:<KeyHandle2>,<UserKey2>,<CoseType2>,<Options2>:...
+          <username2>:<KeyHandle1>,<UserKey1>,<CoseType1>,<Options1>:<KeyHandle2>,<UserKey2>,<CoseType2>,<Options2>:...
+          ```
           This file can be generated using {command}`pamu2fcfg` command.
 
           More information can be found [here](https://developers.yubico.com/pam-u2f/).

diff --git a/nixos/modules/services/home-automation/wyoming/faster-whisper.nix b/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  utils,
   ...
 }:
 
@@ -20,6 +21,10 @@ let
     toString
     ;
 
+  inherit (utils)
+    escapeSystemdExecArgs
+    ;
+
 in
 
 {
@@ -29,7 +34,7 @@ in
     servers = mkOption {
       default = { };
       description = ''
-        Attribute set of faster-whisper instances to spawn.
+        Attribute set of wyoming-faster-whisper instances to spawn.
       '';
       type = types.attrsOf (
         types.submodule (
@@ -43,9 +48,33 @@ in
                 default = "tiny-int8";
                 example = "Systran/faster-distil-whisper-small.en";
                 description = ''
-                  Name of the voice model to use.
+                  Name of the voice model to use. Can also be a HuggingFace model ID or a path to
+                  a custom model directory.
+
+                  Compressed models (`int8`) are slightly less accurate, but smaller and faster.
 
-                  Check the [2.0.0 release notes](https://github.com/rhasspy/wyoming-faster-whisper/releases/tag/v2.0.0) for possible values.
+                  Available models:
+                  - `tiny-int8` (compressed)
+                  - `tiny`
+                  - `tiny.en` (English only)
+                  - `base-int8` (compressed)
+                  - `base`
+                  - `base.en` (English only)
+                  - `small-int8` (compressed)
+                  - `distil-small.en` (distilled, English only)
+                  - `small`
+                  - `small.en` (English only)
+                  - `medium-int8` (compressed)
+                  - `distil-medium.en` (distilled, English only)
+                  - `medium`
+                  - `medium.en` (English only)
+                  - `large`
+                  - `large-v1`
+                  - `distil-large-v2` (distilled, English only)
+                  - `large-v2`
+                  - `distil-large-v3` (distilled, English only)
+                  - `large-v3`
+                  - `turbo` (faster than large-v3)
                 '';
               };
 
@@ -171,6 +200,7 @@ in
                   "uz"
                   "vi"
                   "yi"
+                  "yue"
                   "yo"
                   "zh"
                 ];
@@ -180,12 +210,26 @@ in
                 '';
               };
 
+              initialPrompt = mkOption {
+                type = nullOr str;
+                default = null;
+                example = ''
+                  The following conversation takes place in the universe of Wizard of Oz. Key terms include 'Yellow Brick Road' (the path to follow), 'Emerald City' (the ultimate goal), and 'Ruby Slippers' (the magical tools to succeed). Keep these in mind as they guide the journey.
+                '';
+                description = ''
+                  Optional text to provide as a prompt for the first window. This can be used to provide, or
+                  "prompt-engineer" a context for transcription, e.g. custom vocabularies or proper nouns
+                  to make it more likely to predict those word correctly.
+                '';
+              };
+
               beamSize = mkOption {
                 type = ints.unsigned;
-                default = 1;
+                default = 0;
                 example = 5;
                 description = ''
                   The number of beams to use in beam search.
+                  Use `0` to automatically select a value based on the CPU.
                 '';
                 apply = toString;
               };
@@ -233,18 +277,35 @@ in
           serviceConfig = {
             DynamicUser = true;
             User = "wyoming-faster-whisper";
-            StateDirectory = "wyoming/faster-whisper";
+            StateDirectory = [
+              "wyoming/faster-whisper"
+              "wyoming/faster-whisper/models"
+            ];
             # https://github.com/home-assistant/addons/blob/master/whisper/rootfs/etc/s6-overlay/s6-rc.d/whisper/run
-            ExecStart = ''
-              ${cfg.package}/bin/wyoming-faster-whisper \
-                --data-dir $STATE_DIRECTORY \
-                --download-dir $STATE_DIRECTORY \
-                --uri ${options.uri} \
-                --device ${options.device} \
-                --model ${options.model} \
-                --language ${options.language} \
-                --beam-size ${options.beamSize} ${options.extraArgs}
-            '';
+            ExecStart = escapeSystemdExecArgs (
+              [
+                (lib.getExe cfg.package)
+                "--data-dir"
+                "/var/lib/wyoming/faster-whisper"
+                "--download-dir"
+                "/var/lib/wyoming/faster-whisper/models"
+                "--uri"
+                options.uri
+                "--device"
+                options.device
+                "--model"
+                options.model
+                "--language"
+                options.language
+                "--beam-size"
+                options.beamSize
+              ]
+              ++ lib.optionals (options.initialPrompt != null) [
+                "--initial-prompt"
+                options.initialPrompt
+              ]
+              ++ options.extraArgs
+            );
             CapabilityBoundingSet = "";
             DeviceAllow =
               if