Merge master into staging-next

doc/stdenv.xml

@@ -997,7 +997,6 @@ passthru.updateScript = [ ../../update.sh pname "--requested-release=unstable" ]
       </para>
      </listitem>
     </varlistentry>
-    <varlistentry>
     <varlistentry>
      <term>
       <varname>dontMakeSourcesWritable</varname>

lib/tests/release.nix

@@ -1,11 +1,9 @@
 { pkgs ? import ((import ../.).cleanSource ../..) {} }:
 
-pkgs.stdenv.mkDerivation {
-  name = "nixpkgs-lib-tests";
-  buildInputs = [ pkgs.nix ];
+pkgs.runCommandNoCC "nixpkgs-lib-tests" {
+  buildInputs = [ pkgs.nix (import ./check-eval.nix) ];
   NIX_PATH="nixpkgs=${pkgs.path}";
-
-  buildCommand = ''
+} ''
     datadir="${pkgs.nix}/share"
     export TEST_ROOT=$(pwd)/test-tmp
     export NIX_BUILD_HOOK=
@@ -22,10 +20,5 @@ pkgs.stdenv.mkDerivation {
     cd ${pkgs.path}/lib/tests
     bash ./modules.sh
 
-    [[ "$(nix-instantiate --eval --strict misc.nix)" == "[ ]" ]]
-
-    [[ "$(nix-instantiate --eval --strict systems.nix)" == "[ ]" ]]
-
     touch $out
-  '';
-}
+''

maintainers/maintainer-list.nix

@@ -4080,6 +4080,16 @@
     github = "pradeepchhetri";
     name = "Pradeep Chhetri";
   };
+  pradyuman = {
+    email = "me@pradyuman.co";
+    github = "pradyuman";
+    name = "Pradyuman Vig";
+    keys = [
+      { longkeyid = "rsa4096/4F74D5361C4CA31E";
+        fingerprint = "240B 57DE 4271 2480 7CE3  EAC8 4F74 D536 1C4C A31E";
+      }
+    ];
+  };
   prikhi = {
     email = "pavan.rikhi@gmail.com";
     github = "prikhi";
@@ -4726,6 +4736,11 @@
     github = "sigma";
     name = "Yann Hodique";
   };
+  sikmir = {
+    email = "sikmir@gmail.com";
+    github = "sikmir";
+    name = "Nikolay Korotkiy";
+  };
   simonvandel = {
     email = "simon.vandel@gmail.com";
     github = "simonvandel";

nixos/doc/manual/release-notes/rl-1909.xml

@@ -137,9 +137,9 @@
    <listitem>
     <para>
      Several of the apache subservices have been replaced with full NixOS
-     modules including LimeSurvey and WordPress.
-     These modules can be enabled using the <option>services.limesurvey.enable</option>
-     and <option>services.wordpress.enable</option> options.
+     modules including LimeSurvey, WordPress, and Zabbix.
+     These modules can be enabled using the <option>services.limesurvey.enable</option>,
+     <option>services.wordpress.enable</option>, and <option>services.zabbixWeb.enable</option> options.
     </para>
    </listitem>
    <listitem>
@@ -318,6 +318,17 @@
      The <literal>mercurial</literal> <literal>httpd.extraSubservice</literal> has been removed from nixpkgs due to lack of maintainer.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The <literal>trac</literal> <literal>httpd.extraSubservice</literal> has been removed from nixpkgs because it was unmaintained.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <literal>foswiki</literal> package and associated <literal>httpd.extraSubservice</literal> have been removed
+     from nixpkgs due to lack of maintainer.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>

nixos/modules/hardware/opengl.nix

@@ -118,6 +118,19 @@ in
           set. This can be used to add OpenCL drivers, VA-API/VDPAU drivers etc.
         '';
       };
+
+      setLdLibraryPath = mkOption {
+        type = types.bool;
+        internal = true;
+        default = false;
+        description = ''
+          Whether the <literal>LD_LIBRARY_PATH</literal> environment variable
+          should be set to the locations of driver libraries. Drivers which
+          rely on overriding libraries should set this to true. Drivers which
+          support <literal>libglvnd</literal> and other dispatch libraries
+          instead of overriding libraries should not set this.
+        '';
+      };
     };
 
   };
@@ -145,11 +158,8 @@ in
       )
     ];
 
-    environment.sessionVariables.LD_LIBRARY_PATH =
-      [ "/run/opengl-driver/lib" ] ++ optional cfg.driSupport32Bit "/run/opengl-driver-32/lib";
-
-    environment.variables.XDG_DATA_DIRS =
-      [ "/run/opengl-driver/share" ] ++ optional cfg.driSupport32Bit "/run/opengl-driver-32/share";
+    environment.sessionVariables.LD_LIBRARY_PATH = mkIf cfg.setLdLibraryPath
+      ([ "/run/opengl-driver/lib" ] ++ optional cfg.driSupport32Bit "/run/opengl-driver-32/lib");
 
     hardware.opengl.package = mkDefault (makePackage pkgs);
     hardware.opengl.package32 = mkDefault (makePackage pkgs.pkgsi686Linux);

nixos/modules/hardware/video/amdgpu-pro.nix

@@ -30,10 +30,11 @@ in
     nixpkgs.config.xorg.abiCompat = "1.19";
 
     services.xserver.drivers = singleton
-      { name = "amdgpu"; modules = [ package ]; libPath = [ package ]; };
+      { name = "amdgpu"; modules = [ package ]; };
 
     hardware.opengl.package = package;
     hardware.opengl.package32 = package32;
+    hardware.opengl.setLdLibraryPath = true;
 
     boot.extraModulePackages = [ package ];
 

nixos/modules/hardware/video/ati.nix

@@ -21,10 +21,11 @@ in
     nixpkgs.config.xorg.abiCompat = "1.17";
 
     services.xserver.drivers = singleton
-      { name = "fglrx"; modules = [ ati_x11 ]; libPath = [ "${ati_x11}/lib" ]; };
+      { name = "fglrx"; modules = [ ati_x11 ]; };
 
     hardware.opengl.package = ati_x11;
     hardware.opengl.package32 = pkgs.pkgsi686Linux.linuxPackages.ati_drivers_x11.override { libsOnly = true; kernel = null; };
+    hardware.opengl.setLdLibraryPath = true;
 
     environment.systemPackages = [ ati_x11 ];
 

nixos/modules/hardware/video/nvidia.nix

@@ -138,7 +138,6 @@ in
     services.xserver.drivers = singleton {
       name = "nvidia";
       modules = [ nvidia_x11.bin ];
-      libPath = [ nvidia_x11 ];
       deviceSection = optionalString optimusCfg.enable
         ''
           BusID "${optimusCfg.nvidiaBusId}"

nixos/modules/misc/ids.nix

@@ -516,7 +516,7 @@
       tss = 176;
       #memcached = 177; # unused, removed 2018-01-03
       #ntp = 179; # unused
-      #zabbix = 180; # unused
+      zabbix = 180;
       #redis = 181; # unused, removed 2018-01-03
       #unifi = 183; # unused
       #uptimed = 184; # unused

nixos/modules/module-list.nix

@@ -516,6 +516,7 @@
   ./services/monitoring/uptime.nix
   ./services/monitoring/vnstat.nix
   ./services/monitoring/zabbix-agent.nix
+  ./services/monitoring/zabbix-proxy.nix
   ./services/monitoring/zabbix-server.nix
   ./services/network-filesystems/beegfs.nix
   ./services/network-filesystems/cachefilesd.nix
@@ -782,6 +783,7 @@
   ./services/web-apps/virtlyst.nix
   ./services/web-apps/wordpress.nix
   ./services/web-apps/youtrack.nix
+  ./services/web-apps/zabbix.nix
   ./services/web-servers/apache-httpd/default.nix
   ./services/web-servers/caddy.nix
   ./services/web-servers/fcgiwrap.nix

nixos/modules/rename.nix

@@ -171,6 +171,9 @@ with lib;
        The starting time can be configured via <literal>services.postgresqlBackup.startAt</literal>.
     '')
 
+    # zabbixServer
+    (mkRenamedOptionModule [ "services" "zabbixServer" "dbServer" ] [ "services" "zabbixServer" "database" "host" ])
+
     # Profile splitting
     (mkRenamedOptionModule [ "virtualisation" "growPartition" ] [ "boot" "growPartition" ])
 
@@ -214,6 +217,7 @@ with lib;
     (mkRemovedOptionModule [ "services" "winstone" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "mysql" "pidDir" ] "Don't wait for pidfiles, describe dependencies through systemd")
     (mkRemovedOptionModule [ "services" "mysql" "rootPassword" ] "Use socket authentication or set the password outside of the nix store.")
+    (mkRemovedOptionModule [ "services" "zabbixServer" "dbPassword" ] "Use services.zabbixServer.database.passwordFile instead.")
 
     # ZSH
     (mkRenamedOptionModule [ "programs" "zsh" "enableSyntaxHighlighting" ] [ "programs" "zsh" "syntaxHighlighting" "enable" ])

nixos/modules/services/monitoring/zabbix-agent.nix

@@ -1,73 +1,118 @@
-# Zabbix agent daemon.
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
-
   cfg = config.services.zabbixAgent;
 
-  zabbix = cfg.package;
+  inherit (lib) mkDefault mkEnableOption mkIf mkOption;
+  inherit (lib) attrValues concatMapStringsSep literalExample optionalString types;
 
-  stateDir = "/run/zabbix";
+  user = "zabbix-agent";
+  group = "zabbix-agent";
 
-  logDir = "/var/log/zabbix";
+  moduleEnv = pkgs.symlinkJoin {
+    name = "zabbix-agent-module-env";
+    paths = attrValues cfg.modules;
+  };
 
-  pidFile = "${stateDir}/zabbix_agentd.pid";
-
-  configFile = pkgs.writeText "zabbix_agentd.conf"
-    ''
-      Server = ${cfg.server}
-
-      LogFile = ${logDir}/zabbix_agentd
-
-      PidFile = ${pidFile}
-
-      StartAgents = 1
-
-      ${config.services.zabbixAgent.extraConfig}
-    '';
+  configFile = pkgs.writeText "zabbix_agent.conf" ''
+    LogType = console
+    Server = ${cfg.server}
+    ListenIP = ${cfg.listen.ip}
+    ListenPort = ${toString cfg.listen.port}
+    ${optionalString (cfg.modules != {}) "LoadModulePath = ${moduleEnv}/lib"}
+    ${concatMapStringsSep "\n" (name: "LoadModule = ${name}") (builtins.attrNames cfg.modules)}
+    ${cfg.extraConfig}
+  '';
 
 in
 
 {
-
-  ###### interface
+  # interface
 
   options = {
 
     services.zabbixAgent = {
+      enable = mkEnableOption "the Zabbix Agent";
 
-      enable = mkOption {
-        default = false;
+      package = mkOption {
+        type = types.package;
+        default = pkgs.zabbix.agent;
+        defaultText = "pkgs.zabbix.agent";
+        description = "The Zabbix package to use.";
+      };
+
+      extraPackages = mkOption {
+        type = types.listOf types.package;
+        default = with pkgs; [ nettools ];
+        defaultText = "[ nettools ]";
+        example = "[ nettools mysql ]";
         description = ''
-          Whether to run the Zabbix monitoring agent on this machine.
-          It will send monitoring data to a Zabbix server.
+          Packages to be added to the Zabbix <envar>PATH</envar>.
+          Typically used to add executables for scripts, but can be anything.
         '';
       };
 
-      package = mkOption {
-        type = types.attrs; # Note: pkgs.zabbixXY isn't a derivation, but an attrset of { server = ...; agent = ...; }.
-        default = pkgs.zabbix;
-        defaultText = "pkgs.zabbix";
-        example = literalExample "pkgs.zabbix34";
-        description = ''
-          The Zabbix package to use.
+      modules = mkOption {
+        type = types.attrsOf types.package;
+        description = "A set of modules to load.";
+        default = {};
+        example = literalExample ''
+          {
+            "dummy.so" = pkgs.stdenv.mkDerivation {
+              name = "zabbix-dummy-module-''${cfg.package.version}";
+              src = cfg.package.src;
+              buildInputs = [ cfg.package ];
+              sourceRoot = "zabbix-''${cfg.package.version}/src/modules/dummy";
+              installPhase = '''
+                mkdir -p $out/lib
+                cp dummy.so $out/lib/
+              ''';
+            };
+          }
         '';
       };
 
       server = mkOption {
-        default = "127.0.0.1";
+        type = types.str;
         description = ''
           The IP address or hostname of the Zabbix server to connect to.
         '';
       };
 
+      listen = {
+        ip = mkOption {
+          type = types.str;
+          default = "0.0.0.0";
+          description = ''
+            List of comma delimited IP addresses that the agent should listen on.
+          '';
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 10050;
+          description = ''
+            Agent will listen on this port for connections from the server.
+          '';
+        };
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Open ports in the firewall for the Zabbix Agent.
+        '';
+      };
+
+      # TODO: for bonus points migrate this to https://github.com/NixOS/rfcs/pull/42
       extraConfig = mkOption {
         default = "";
         type = types.lines;
         description = ''
-          Configuration that is injected verbatim into the configuration file.
+          Configuration that is injected verbatim into the configuration file. Refer to
+          <link xlink:href="https://www.zabbix.com/documentation/current/manual/appendix/config/zabbix_agentd"/>
+          for details on supported values.
         '';
       };
 
@@ -75,38 +120,38 @@ in
 
   };
 
-
-  ###### implementation
+  # implementation
 
   config = mkIf cfg.enable {
 
-    users.users = mkIf (!config.services.zabbixServer.enable) (singleton
-      { name = "zabbix";
-        uid = config.ids.uids.zabbix;
-        description = "Zabbix daemon user";
-      });
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.listen.port ];
+    };
 
-    systemd.services."zabbix-agent" =
-      { description = "Zabbix Agent";
+    users.users.${user} = {
+      description = "Zabbix Agent daemon user";
+      inherit group;
+    };
 
-        wantedBy = [ "multi-user.target" ];
+    users.groups.${group} = { };
 
-        path = [ pkgs.nettools ];
+    systemd.services."zabbix-agent" = {
+      description = "Zabbix Agent";
 
-        preStart =
-          ''
-            mkdir -m 0755 -p ${stateDir} ${logDir}
-            chown zabbix ${stateDir} ${logDir}
-          '';
+      wantedBy = [ "multi-user.target" ];
 
-        serviceConfig.ExecStart = "@${zabbix.agent}/sbin/zabbix_agentd zabbix_agentd --config ${configFile}";
-        serviceConfig.Type = "forking";
-        serviceConfig.RemainAfterExit = true;
-        serviceConfig.Restart = "always";
-        serviceConfig.RestartSec = 2;
+      path = [ "/run/wrappers" ] ++ cfg.extraPackages;
+
+      serviceConfig = {
+        ExecStart = "@${cfg.package}/sbin/zabbix_agentd zabbix_agentd -f --config ${configFile}";
+        Restart = "always";
+        RestartSec = 2;
+
+        User = user;
+        Group = group;
+        PrivateTmp = true;
       };
-
-    environment.systemPackages = [ zabbix.agent ];
+    };
 
   };
 

nixos/modules/services/monitoring/zabbix-proxy.nix

@@ -0,0 +1,290 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.zabbixProxy;
+  pgsql = config.services.postgresql;
+  mysql = config.services.mysql;
+
+  inherit (lib) mkDefault mkEnableOption mkIf mkOption;
+  inherit (lib) attrValues concatMapStringsSep literalExample optional optionalAttrs optionalString types;
+
+  user = "zabbix";
+  group = "zabbix";
+  runtimeDir = "/run/zabbix";
+  stateDir = "/var/lib/zabbix";
+  passwordFile = "${runtimeDir}/zabbix-dbpassword.conf";
+
+  moduleEnv = pkgs.symlinkJoin {
+    name = "zabbix-proxy-module-env";
+    paths = attrValues cfg.modules;
+  };
+
+  configFile = pkgs.writeText "zabbix_proxy.conf" ''
+    LogType = console
+    ListenIP = ${cfg.listen.ip}
+    ListenPort = ${toString cfg.listen.port}
+    # TODO: set to cfg.database.socket if database type is pgsql?
+    DBHost = ${optionalString (cfg.database.createLocally != true) cfg.database.host}
+    ${optionalString (cfg.database.createLocally != true) "DBPort = ${cfg.database.port}"}
+    DBName = ${cfg.database.name}
+    DBUser = ${cfg.database.user}
+    ${optionalString (cfg.database.passwordFile != null) "Include ${passwordFile}"}
+    ${optionalString (mysqlLocal && cfg.database.socket != null) "DBSocket = ${cfg.database.socket}"}
+    SocketDir = ${runtimeDir}
+    FpingLocation = /run/wrappers/bin/fping
+    ${optionalString (cfg.modules != {}) "LoadModulePath = ${moduleEnv}/lib"}
+    ${concatMapStringsSep "\n" (name: "LoadModule = ${name}") (builtins.attrNames cfg.modules)}
+    ${cfg.extraConfig}
+  '';
+
+  mysqlLocal = cfg.database.createLocally && cfg.database.type == "mysql";
+  pgsqlLocal = cfg.database.createLocally && cfg.database.type == "pgsql";
+
+in
+
+{
+  # interface
+
+  options = {
+
+    services.zabbixProxy = {
+      enable = mkEnableOption "the Zabbix Proxy";
+
+      package = mkOption {
+        type = types.package;
+        default =
+          if cfg.database.type == "mysql" then pkgs.zabbix.proxy-mysql
+          else if cfg.database.type == "pgsql" then pkgs.zabbix.proxy-pgsql
+          else pkgs.zabbix.proxy-sqlite;
+        defaultText = "pkgs.zabbix.proxy-pgsql";
+        description = "The Zabbix package to use.";
+      };
+
+      extraPackages = mkOption {
+        type = types.listOf types.package;
+        default = with pkgs; [ nettools nmap traceroute ];
+        defaultText = "[ nettools nmap traceroute ]";
+        description = ''
+          Packages to be added to the Zabbix <envar>PATH</envar>.
+          Typically used to add executables for scripts, but can be anything.
+        '';
+      };
+
+      modules = mkOption {
+        type = types.attrsOf types.package;
+        description = "A set of modules to load.";
+        default = {};
+        example = literalExample ''
+          {
+            "dummy.so" = pkgs.stdenv.mkDerivation {
+              name = "zabbix-dummy-module-''${cfg.package.version}";
+              src = cfg.package.src;
+              buildInputs = [ cfg.package ];
+              sourceRoot = "zabbix-''${cfg.package.version}/src/modules/dummy";
+              installPhase = '''
+                mkdir -p $out/lib
+                cp dummy.so $out/lib/
+              ''';
+            };
+          }
+        '';
+      };
+
+      database = {
+        type = mkOption {
+          type = types.enum [ "mysql" "pgsql" "sqlite" ];
+          example = "mysql";
+          default = "pgsql";
+          description = "Database engine to use.";
+        };
+
+        host = mkOption {
+          type = types.str;
+          default = "localhost";
+          description = "Database host address.";
+        };
+
+        port = mkOption {
+          type = types.int;
+          default = if cfg.database.type == "mysql" then mysql.port else pgsql.port;
+          description = "Database host port.";
+        };
+
+        name = mkOption {
+          type = types.str;
+          default = "zabbix";
+          description = "Database name.";
+        };
+
+        user = mkOption {
+          type = types.str;
+          default = "zabbix";
+          description = "Database user.";
+        };
+
+        passwordFile = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          example = "/run/keys/zabbix-dbpassword";
+          description = ''
+            A file containing the password corresponding to
+            <option>database.user</option>.
+          '';
+        };
+
+        socket = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          example = "/run/postgresql";
+          description = "Path to the unix socket file to use for authentication.";
+        };
+
+        createLocally = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Whether to create a local database automatically.";
+        };
+      };
+
+      listen = {
+        ip = mkOption {
+          type = types.str;
+          default = "0.0.0.0";
+          description = ''
+            List of comma delimited IP addresses that the trapper should listen on.
+            Trapper will listen on all network interfaces if this parameter is missing.
+          '';
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 10051;
+          description = ''
+            Listen port for trapper.
+          '';
+        };
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Open ports in the firewall for the Zabbix Proxy.
+        '';
+      };
+
+      # TODO: for bonus points migrate this to https://github.com/NixOS/rfcs/pull/42
+      extraConfig = mkOption {
+        default = "";
+        type = types.lines;
+        description = ''
+          Configuration that is injected verbatim into the configuration file. Refer to
+          <link xlink:href="https://www.zabbix.com/documentation/current/manual/appendix/config/zabbix_proxy"/>
+          for details on supported values.
+        '';
+      };
+
+    };
+
+  };
+
+  # implementation
+
+  config = mkIf cfg.enable {
+
+    assertions = [
+      { assertion = !config.services.zabbixServer.enable;
+        message = "Please choose one of services.zabbixServer or services.zabbixProxy.";
+      }
+      { assertion = cfg.database.createLocally -> cfg.database.user == user;
+        message = "services.zabbixProxy.database.user must be set to ${user} if services.zabbixProxy.database.createLocally is set true";
+      }
+      { assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
+        message = "a password cannot be specified if services.zabbixProxy.database.createLocally is set to true";
+      }
+    ];
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.listen.port ];
+    };
+
+    services.mysql = optionalAttrs mysqlLocal {
+      enable = true;
+      package = mkDefault pkgs.mariadb;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [
+        { name = cfg.database.user;
+          ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
+        }
+      ];
+    };
+
+    services.postgresql = optionalAttrs pgsqlLocal {
+      enable = true;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [
+        { name = cfg.database.user;
+          ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
+        }
+      ];
+    };
+
+    users.users.${user} = {
+      description = "Zabbix daemon user";
+      uid = config.ids.uids.zabbix;
+      inherit group;
+    };
+
+    users.groups.${group} = {
+      gid = config.ids.gids.zabbix;
+    };
+
+    security.wrappers = {
+      fping.source = "${pkgs.fping}/bin/fping";
+    };
+
+    systemd.services."zabbix-proxy" = {
+      description = "Zabbix Proxy";
+
+      wantedBy = [ "multi-user.target" ];
+      after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
+
+      path = [ "/run/wrappers" ] ++ cfg.extraPackages;
+      preStart = optionalString pgsqlLocal ''
+        if ! test -e "${stateDir}/db-created"; then
+          cat ${cfg.package}/share/zabbix/database/postgresql/schema.sql | ${pgsql.package}/bin/psql ${cfg.database.name}
+          cat ${cfg.package}/share/zabbix/database/postgresql/images.sql | ${pgsql.package}/bin/psql ${cfg.database.name}
+          cat ${cfg.package}/share/zabbix/database/postgresql/data.sql | ${pgsql.package}/bin/psql ${cfg.database.name}
+          touch "${stateDir}/db-created"
+        fi
+      '' + optionalString mysqlLocal ''
+        if ! test -e "${stateDir}/db-created"; then
+          cat ${cfg.package}/share/zabbix/database/mysql/schema.sql | ${mysql.package}/bin/mysql ${cfg.database.name}
+          cat ${cfg.package}/share/zabbix/database/mysql/images.sql | ${mysql.package}/bin/mysql ${cfg.database.name}
+          cat ${cfg.package}/share/zabbix/database/mysql/data.sql | ${mysql.package}/bin/mysql ${cfg.database.name}
+          touch "${stateDir}/db-created"
+        fi
+      '' + optionalString (cfg.database.passwordFile != null) ''
+        # create a copy of the supplied password file in a format zabbix can consume
+        touch ${passwordFile}
+        chmod 0600 ${passwordFile}
+        echo -n "DBPassword = " > ${passwordFile}
+        cat ${cfg.database.passwordFile} >> ${passwordFile}
+      '';
+
+      serviceConfig = {
+        ExecStart = "@${cfg.package}/sbin/zabbix_proxy zabbix_proxy -f --config ${configFile}";
+        Restart = "always";
+        RestartSec = 2;
+
+        User = user;
+        Group = group;
+        RuntimeDirectory = "zabbix";
+        StateDirectory = "zabbix";
+        PrivateTmp = true;
+      };
+    };
+
+  };
+
+}

nixos/modules/services/monitoring/zabbix-server.nix

@@ -1,125 +1,292 @@
-# Zabbix server daemon.
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
-
   cfg = config.services.zabbixServer;
+  pgsql = config.services.postgresql;
+  mysql = config.services.mysql;
 
-  stateDir = "/run/zabbix";
+  inherit (lib) mkDefault mkEnableOption mkIf mkOption;
+  inherit (lib) attrValues concatMapStringsSep literalExample optional optionalAttrs optionalString types;
 
-  logDir = "/var/log/zabbix";
+  user = "zabbix";
+  group = "zabbix";
+  runtimeDir = "/run/zabbix";
+  stateDir = "/var/lib/zabbix";
+  passwordFile = "${runtimeDir}/zabbix-dbpassword.conf";
 
-  libDir = "/var/lib/zabbix";
+  moduleEnv = pkgs.symlinkJoin {
+    name = "zabbix-server-module-env";
+    paths = attrValues cfg.modules;
+  };
 
-  pidFile = "${stateDir}/zabbix_server.pid";
+  configFile = pkgs.writeText "zabbix_server.conf" ''
+    LogType = console
+    ListenIP = ${cfg.listen.ip}
+    ListenPort = ${toString cfg.listen.port}
+    # TODO: set to cfg.database.socket if database type is pgsql?
+    DBHost = ${optionalString (cfg.database.createLocally != true) cfg.database.host}
+    ${optionalString (cfg.database.createLocally != true) "DBPort = ${cfg.database.port}"}
+    DBName = ${cfg.database.name}
+    DBUser = ${cfg.database.user}
+    ${optionalString (cfg.database.passwordFile != null) "Include ${passwordFile}"}
+    ${optionalString (mysqlLocal && cfg.database.socket != null) "DBSocket = ${cfg.database.socket}"}
+    SocketDir = ${runtimeDir}
+    FpingLocation = /run/wrappers/bin/fping
+    ${optionalString (cfg.modules != {}) "LoadModulePath = ${moduleEnv}/lib"}
+    ${concatMapStringsSep "\n" (name: "LoadModule = ${name}") (builtins.attrNames cfg.modules)}
+    ${cfg.extraConfig}
+  '';
 
-  configFile = pkgs.writeText "zabbix_server.conf"
-    ''
-      LogFile = ${logDir}/zabbix_server
-
-      PidFile = ${pidFile}
-
-      ${optionalString (cfg.dbServer != "localhost") ''
-        DBHost = ${cfg.dbServer}
-      ''}
-
-      DBName = zabbix
-
-      DBUser = zabbix
-
-      ${optionalString (cfg.dbPassword != "") ''
-        DBPassword = ${cfg.dbPassword}
-      ''}
-
-      ${config.services.zabbixServer.extraConfig}
-    '';
-
-  useLocalPostgres = cfg.dbServer == "localhost" || cfg.dbServer == "";
+  mysqlLocal = cfg.database.createLocally && cfg.database.type == "mysql";
+  pgsqlLocal = cfg.database.createLocally && cfg.database.type == "pgsql";
 
 in
 
 {
-
-  ###### interface
+  # interface
 
   options = {
 
-    services.zabbixServer.enable = mkOption {
-      default = false;
-      type = types.bool;
-      description = ''
-        Whether to run the Zabbix server on this machine.
-      '';
-    };
+    services.zabbixServer = {
+      enable = mkEnableOption "the Zabbix Server";
 
-    services.zabbixServer.dbServer = mkOption {
-      default = "localhost";
-      type = types.str;
-      description = ''
-        Hostname or IP address of the database server.
-        Use an empty string ("") to use peer authentication.
-      '';
-    };
+      package = mkOption {
+        type = types.package;
+        default = if cfg.database.type == "mysql" then pkgs.zabbix.server-mysql else pkgs.zabbix.server-pgsql;
+        defaultText = "pkgs.zabbix.server-pgsql";
+        description = "The Zabbix package to use.";
+      };
 
-    services.zabbixServer.dbPassword = mkOption {
-      default = "";
-      type = types.str;
-      description = "Password used to connect to the database server.";
-    };
+      extraPackages = mkOption {
+        type = types.listOf types.package;
+        default = with pkgs; [ nettools nmap traceroute ];
+        defaultText = "[ nettools nmap traceroute ]";
+        description = ''
+          Packages to be added to the Zabbix <envar>PATH</envar>.
+          Typically used to add executables for scripts, but can be anything.
+        '';
+      };
+
+      modules = mkOption {
+        type = types.attrsOf types.package;
+        description = "A set of modules to load.";
+        default = {};
+        example = literalExample ''
+          {
+            "dummy.so" = pkgs.stdenv.mkDerivation {
+              name = "zabbix-dummy-module-''${cfg.package.version}";
+              src = cfg.package.src;
+              buildInputs = [ cfg.package ];
+              sourceRoot = "zabbix-''${cfg.package.version}/src/modules/dummy";
+              installPhase = '''
+                mkdir -p $out/lib
+                cp dummy.so $out/lib/
+              ''';
+            };
+          }
+        '';
+      };
+
+      database = {
+        type = mkOption {
+          type = types.enum [ "mysql" "pgsql" ];
+          example = "mysql";
+          default = "pgsql";
+          description = "Database engine to use.";
+        };
+
+        host = mkOption {
+          type = types.str;
+          default = "localhost";
+          description = "Database host address.";
+        };
+
+        port = mkOption {
+          type = types.int;
+          default = if cfg.database.type == "mysql" then mysql.port else pgsql.port;
+          description = "Database host port.";
+        };
+
+        name = mkOption {
+          type = types.str;
+          default = "zabbix";
+          description = "Database name.";
+        };
+
+        user = mkOption {
+          type = types.str;
+          default = "zabbix";
+          description = "Database user.";
+        };
+
+        passwordFile = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          example = "/run/keys/zabbix-dbpassword";
+          description = ''
+            A file containing the password corresponding to
+            <option>database.user</option>.
+          '';
+        };
+
+        socket = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          example = "/run/postgresql";
+          description = "Path to the unix socket file to use for authentication.";
+        };
+
+        createLocally = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Whether to create a local database automatically.";
+        };
+      };
+
+      listen = {
+        ip = mkOption {
+          type = types.str;
+          default = "0.0.0.0";
+          description = ''
+            List of comma delimited IP addresses that the trapper should listen on.
+            Trapper will listen on all network interfaces if this parameter is missing.
+          '';
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 10051;
+          description = ''
+            Listen port for trapper.
+          '';
+        };
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Open ports in the firewall for the Zabbix Server.
+        '';
+      };
+
+      # TODO: for bonus points migrate this to https://github.com/NixOS/rfcs/pull/42
+      extraConfig = mkOption {
+        default = "";
+        type = types.lines;
+        description = ''
+          Configuration that is injected verbatim into the configuration file. Refer to
+          <link xlink:href="https://www.zabbix.com/documentation/current/manual/appendix/config/zabbix_server"/>
+          for details on supported values.
+        '';
+      };
 
-    services.zabbixServer.extraConfig = mkOption {
-      default = "";
-      type = types.lines;
-      description = ''
-        Configuration that is injected verbatim into the configuration file.
-      '';
     };
 
   };
 
-  ###### implementation
+  # implementation
 
   config = mkIf cfg.enable {
 
-    services.postgresql.enable = useLocalPostgres;
+    assertions = [
+      { assertion = cfg.database.createLocally -> cfg.database.user == user;
+        message = "services.zabbixServer.database.user must be set to ${user} if services.zabbixServer.database.createLocally is set true";
+      }
+      { assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
+        message = "a password cannot be specified if services.zabbixServer.database.createLocally is set to true";
+      }
+    ];
 
-    users.users = singleton
-      { name = "zabbix";
-        uid = config.ids.uids.zabbix;
-        description = "Zabbix daemon user";
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.listen.port ];
+    };
+
+    services.mysql = optionalAttrs mysqlLocal {
+      enable = true;
+      package = mkDefault pkgs.mariadb;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [
+        { name = cfg.database.user;
+          ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
+        }
+      ];
+    };
+
+    services.postgresql = optionalAttrs pgsqlLocal {
+      enable = true;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [
+        { name = cfg.database.user;
+          ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
+        }
+      ];
+    };
+
+    users.users.${user} = {
+      description = "Zabbix daemon user";
+      uid = config.ids.uids.zabbix;
+      inherit group;
+    };
+
+    users.groups.${group} = {
+      gid = config.ids.gids.zabbix;
+    };
+
+    security.wrappers = {
+      fping.source = "${pkgs.fping}/bin/fping";
+    };
+
+    systemd.services."zabbix-server" = {
+      description = "Zabbix Server";
+
+      wantedBy = [ "multi-user.target" ];
+      after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
+
+      path = [ "/run/wrappers" ] ++ cfg.extraPackages;
+      preStart = ''
+        # pre 19.09 compatibility
+        if test -e "${runtimeDir}/db-created"; then
+          mv "${runtimeDir}/db-created" "${stateDir}/"
+        fi
+      '' + optionalString pgsqlLocal ''
+        if ! test -e "${stateDir}/db-created"; then
+          cat ${cfg.package}/share/zabbix/database/postgresql/schema.sql | ${pgsql.package}/bin/psql ${cfg.database.name}
+          cat ${cfg.package}/share/zabbix/database/postgresql/images.sql | ${pgsql.package}/bin/psql ${cfg.database.name}
+          cat ${cfg.package}/share/zabbix/database/postgresql/data.sql | ${pgsql.package}/bin/psql ${cfg.database.name}
+          touch "${stateDir}/db-created"
+        fi
+      '' + optionalString mysqlLocal ''
+        if ! test -e "${stateDir}/db-created"; then
+          cat ${cfg.package}/share/zabbix/database/mysql/schema.sql | ${mysql.package}/bin/mysql ${cfg.database.name}
+          cat ${cfg.package}/share/zabbix/database/mysql/images.sql | ${mysql.package}/bin/mysql ${cfg.database.name}
+          cat ${cfg.package}/share/zabbix/database/mysql/data.sql | ${mysql.package}/bin/mysql ${cfg.database.name}
+          touch "${stateDir}/db-created"
+        fi
+      '' + optionalString (cfg.database.passwordFile != null) ''
+        # create a copy of the supplied password file in a format zabbix can consume
+        touch ${passwordFile}
+        chmod 0600 ${passwordFile}
+        echo -n "DBPassword = " > ${passwordFile}
+        cat ${cfg.database.passwordFile} >> ${passwordFile}
+      '';
+
+      serviceConfig = {
+        ExecStart = "@${cfg.package}/sbin/zabbix_server zabbix_server -f --config ${configFile}";
+        Restart = "always";
+        RestartSec = 2;
+
+        User = user;
+        Group = group;
+        RuntimeDirectory = "zabbix";
+        StateDirectory = "zabbix";
+        PrivateTmp = true;
       };
+    };
 
-    systemd.services."zabbix-server" =
-      { description = "Zabbix Server";
-
-        wantedBy = [ "multi-user.target" ];
-        after = optional useLocalPostgres "postgresql.service";
-
-        preStart =
-          ''
-            mkdir -m 0755 -p ${stateDir} ${logDir} ${libDir}
-            chown zabbix ${stateDir} ${logDir} ${libDir}
-
-            if ! test -e "${libDir}/db-created"; then
-                ${pkgs.su}/bin/su -s "$SHELL" ${config.services.postgresql.superUser} -c '${pkgs.postgresql}/bin/createuser --no-superuser --no-createdb --no-createrole zabbix' || true
-                ${pkgs.su}/bin/su -s "$SHELL" ${config.services.postgresql.superUser} -c '${pkgs.postgresql}/bin/createdb --owner zabbix zabbix' || true
-                cat ${pkgs.zabbix.server}/share/zabbix/db/schema/postgresql.sql | ${pkgs.su}/bin/su -s "$SHELL" zabbix -c '${pkgs.postgresql}/bin/psql zabbix'
-                cat ${pkgs.zabbix.server}/share/zabbix/db/data/images_pgsql.sql | ${pkgs.su}/bin/su -s "$SHELL" zabbix -c '${pkgs.postgresql}/bin/psql zabbix'
-                cat ${pkgs.zabbix.server}/share/zabbix/db/data/data.sql | ${pkgs.su}/bin/su -s "$SHELL" zabbix -c '${pkgs.postgresql}/bin/psql zabbix'
-                touch "${libDir}/db-created"
-            fi
-          '';
-
-        path = [ pkgs.nettools ];
-
-        serviceConfig.ExecStart = "@${pkgs.zabbix.server}/sbin/zabbix_server zabbix_server --config ${configFile}";
-        serviceConfig.Type = "forking";
-        serviceConfig.Restart = "always";
-        serviceConfig.RestartSec = 2;
-        serviceConfig.PIDFile = pidFile;
-      };
+    systemd.services.httpd.after =
+      optional (config.services.zabbixWeb.enable && mysqlLocal) "mysql.service" ++
+      optional (config.services.zabbixWeb.enable && pgsqlLocal) "postgresql.service";
 
   };
 

nixos/modules/services/networking/dhcpcd.nix

@@ -162,7 +162,7 @@ in
 
         wantedBy = [ "multi-user.target" ] ++ optional (!hasDefaultGatewaySet) "network-online.target";
         wants = [ "network.target" "systemd-udev-settle.service" ];
-        before = [ "network.target" ];
+        before = [ "network-online.target" ];
         after = [ "systemd-udev-settle.service" ];
 
         # Stopping dhcpcd during a reconfiguration is undesirable

nixos/modules/services/networking/kresd.nix

@@ -80,8 +80,11 @@ in
         # Syntax depends on being IPv6 or IPv4.
         (iface: if elem ":" (stringToCharacters iface) then "[${iface}]:53" else "${iface}:53")
         cfg.interfaces;
-      socketConfig.ListenDatagram = listenStreams;
-      socketConfig.FreeBind = true;
+      socketConfig = {
+        ListenDatagram = listenStreams;
+        FreeBind = true;
+        FileDescriptorName = "dns";
+      };
     };
 
     systemd.sockets.kresd-tls = mkIf (cfg.listenTLS != []) rec {

nixos/modules/services/torrent/deluge.nix

@@ -118,36 +118,74 @@ in {
             more informations.
           '';
         };
+
+        user = mkOption {
+          type = types.str;
+          default = "deluge";
+          description = ''
+            User account under which deluge runs.
+          '';
+        };
+
+        group = mkOption {
+          type = types.str;
+          default = "deluge";
+          description = ''
+            Group under which deluge runs.
+          '';
+        };
+
+        extraPackages = mkOption {
+          type = types.listOf types.package;
+          default = [];
+          description = ''
+            Extra packages available at runtime to enable Deluge's plugins. For example,
+            extraction utilities are required for the built-in "Extractor" plugin.
+            This always contains unzip, gnutar, xz, p7zip and bzip2.
+          '';
+        };
       };
 
       deluge.web = {
         enable = mkEnableOption "Deluge Web daemon";
+
         port = mkOption {
-        type = types.port;
+          type = types.port;
           default = 8112;
           description = ''
             Deluge web UI port.
           '';
         };
+
+        openFirewall = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Open ports in the firewall for deluge web daemon
+          '';
+        };
       };
     };
   };
 
   config = mkIf cfg.enable {
 
-    systemd.tmpfiles.rules = [ "d '${configDir}' 0770 deluge deluge" ]
+    # Provide a default set of `extraPackages`.
+    services.deluge.extraPackages = with pkgs; [ unzip gnutar xz p7zip bzip2 ];
+
+    systemd.tmpfiles.rules = [ "d '${configDir}' 0770 ${cfg.user} ${cfg.group}" ]
     ++ optional (cfg.config ? "download_location")
-      "d '${cfg.config.download_location}' 0770 deluge deluge"
+      "d '${cfg.config.download_location}' 0770 ${cfg.user} ${cfg.group}"
     ++ optional (cfg.config ? "torrentfiles_location")
-      "d '${cfg.config.torrentfiles_location}' 0770 deluge deluge"
+      "d '${cfg.config.torrentfiles_location}' 0770 ${cfg.user} ${cfg.group}"
     ++ optional (cfg.config ? "move_completed_path")
-      "d '${cfg.config.move_completed_path}' 0770 deluge deluge";
+      "d '${cfg.config.move_completed_path}' 0770 ${cfg.user} ${cfg.group}";
 
     systemd.services.deluged = {
       after = [ "network.target" ];
       description = "Deluge BitTorrent Daemon";
       wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.deluge ];
+      path = [ pkgs.deluge ] ++ cfg.extraPackages;
       serviceConfig = {
         ExecStart = ''
           ${pkgs.deluge}/bin/deluged \
@@ -157,8 +195,8 @@ in {
         # To prevent "Quit & shutdown daemon" from working; we want systemd to
         # manage it!
         Restart = "on-success";
-        User = "deluge";
-        Group = "deluge";
+        User = cfg.user;
+        Group = cfg.group;
         UMask = "0002";
         LimitNOFILE = cfg.openFilesLimit;
       };
@@ -177,26 +215,37 @@ in {
             --config ${configDir} \
             --port ${toString cfg.web.port}
         '';
-        User = "deluge";
-        Group = "deluge";
+        User = cfg.user;
+        Group = cfg.group;
       };
     };
 
-    networking.firewall = mkIf (cfg.declarative && cfg.openFirewall && !(cfg.config.random_port or true)) {
-      allowedTCPPortRanges = singleton (listToRange (cfg.config.listen_ports or listenPortsDefault));
-      allowedUDPPortRanges = singleton (listToRange (cfg.config.listen_ports or listenPortsDefault));
-    };
+    networking.firewall = mkMerge [
+      (mkIf (cfg.declarative && cfg.openFirewall && !(cfg.config.random_port or true)) {
+        allowedTCPPortRanges = singleton (listToRange (cfg.config.listen_ports or listenPortsDefault));
+        allowedUDPPortRanges = singleton (listToRange (cfg.config.listen_ports or listenPortsDefault));
+      })
+      (mkIf (cfg.web.openFirewall) {
+        allowedTCPPorts = [ cfg.web.port ];
+      })
+    ];
 
     environment.systemPackages = [ pkgs.deluge ];
 
-    users.users.deluge = {
-      group = "deluge";
-      uid = config.ids.uids.deluge;
-      home = cfg.dataDir;
-      createHome = true;
-      description = "Deluge Daemon user";
+    users.users = mkIf (cfg.user == "deluge") {
+      deluge = {
+        group = cfg.group;
+        uid = config.ids.uids.deluge;
+        home = cfg.dataDir;
+        createHome = true;
+        description = "Deluge Daemon user";
+      };
     };
 
-    users.groups.deluge.gid = config.ids.gids.deluge;
+    users.groups = mkIf (cfg.group == "deluge") {
+      deluge = {
+        gid = config.ids.gids.deluge;
+      };
+    };
   };
 }

nixos/modules/services/web-apps/zabbix.nix

@@ -0,0 +1,225 @@
+{ config, lib, pkgs, ... }:
+
+let
+
+  inherit (lib) mkDefault mkEnableOption mkForce mkIf mkMerge mkOption types;
+  inherit (lib) literalExample mapAttrs optionalString;
+
+  cfg = config.services.zabbixWeb;
+  fpm = config.services.phpfpm.pools.zabbix;
+
+  user = "zabbix";
+  group = "zabbix";
+  stateDir = "/var/lib/zabbix";
+
+  zabbixConfig = pkgs.writeText "zabbix.conf.php" ''
+    <?php
+    // Zabbix GUI configuration file.
+    global $DB;
+    $DB['TYPE'] = '${ { "mysql" = "MYSQL"; "pgsql" = "POSTGRESQL"; "oracle" = "ORACLE"; }.${cfg.database.type} }';
+    $DB['SERVER'] = '${cfg.database.host}';
+    $DB['PORT'] = '${toString cfg.database.port}';
+    $DB['DATABASE'] = '${cfg.database.name}';
+    $DB['USER'] = '${cfg.database.user}';
+    $DB['PASSWORD'] = ${if cfg.database.passwordFile != null then "file_get_contents('${cfg.database.passwordFile}')" else "''"};
+    // Schema name. Used for IBM DB2 and PostgreSQL.
+    $DB['SCHEMA'] = ''';
+    $ZBX_SERVER = '${cfg.server.address}';
+    $ZBX_SERVER_PORT = '${toString cfg.server.port}';
+    $ZBX_SERVER_NAME = ''';
+    $IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
+  '';
+
+in
+{
+  # interface
+
+  options.services = {
+    zabbixWeb = {
+      enable = mkEnableOption "the Zabbix web interface";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.zabbix.web;
+        defaultText = "zabbix.web";
+        description = "Which Zabbix package to use.";
+      };
+
+      server = {
+        port = mkOption {
+          type = types.int;
+          description = "The port of the Zabbix server to connect to.";
+          default = 10051;
+        };
+
+        address = mkOption {
+          type = types.str;
+          description = "The IP address or hostname of the Zabbix server to connect to.";
+          default = "localhost";
+        };
+      };
+
+      database = {
+        type = mkOption {
+          type = types.enum [ "mysql" "pgsql" "oracle" ];
+          example = "mysql";
+          default = "pgsql";
+          description = "Database engine to use.";
+        };
+
+        host = mkOption {
+          type = types.str;
+          default = "";
+          description = "Database host address.";
+        };
+
+        port = mkOption {
+          type = types.int;
+          default =
+            if cfg.database.type == "mysql" then config.services.mysql.port
+            else if cfg.database.type == "pgsql" then config.services.postgresql.port
+            else 1521;
+          description = "Database host port.";
+        };
+
+        name = mkOption {
+          type = types.str;
+          default = "zabbix";
+          description = "Database name.";
+        };
+
+        user = mkOption {
+          type = types.str;
+          default = "zabbix";
+          description = "Database user.";
+        };
+
+        passwordFile = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          example = "/run/keys/zabbix-dbpassword";
+          description = ''
+            A file containing the password corresponding to
+            <option>database.user</option>.
+          '';
+        };
+
+        socket = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          example = "/run/postgresql";
+          description = "Path to the unix socket file to use for authentication.";
+        };
+      };
+
+      virtualHost = mkOption {
+        type = types.submodule ({
+          options = import ../web-servers/apache-httpd/per-server-options.nix {
+            inherit lib;
+            forMainServer = false;
+          };
+        });
+        example = {
+          hostName = "zabbix.example.org";
+          enableSSL = true;
+          adminAddr = "webmaster@example.org";
+          sslServerCert = "/var/lib/acme/zabbix.example.org/full.pem";
+          sslServerKey = "/var/lib/acme/zabbix.example.org/key.pem";
+        };
+        description = ''
+          Apache configuration can be done by adapting <literal>services.httpd.virtualHosts.&lt;name&gt;</literal>.
+          See <xref linkend="opt-services.httpd.virtualHosts"/> for further information.
+        '';
+      };
+
+      poolConfig = mkOption {
+        type = types.lines;
+        default = ''
+          pm = dynamic
+          pm.max_children = 32
+          pm.start_servers = 2
+          pm.min_spare_servers = 2
+          pm.max_spare_servers = 4
+          pm.max_requests = 500
+        '';
+        description = ''
+          Options for the Zabbix PHP pool. See the documentation on <literal>php-fpm.conf</literal> for details on configuration directives.
+        '';
+      };
+
+    };
+  };
+
+  # implementation
+
+  config = mkIf cfg.enable {
+
+    systemd.tmpfiles.rules = [
+      "d '${stateDir}' 0750 ${user} ${group} - -"
+      "d '${stateDir}/session' 0750 ${user} ${config.services.httpd.group} - -"
+    ];
+
+    services.phpfpm.pools.zabbix = {
+      phpOptions = ''
+        # https://www.zabbix.com/documentation/current/manual/installation/install
+        memory_limit = 128M
+        post_max_size = 16M
+        upload_max_filesize = 2M
+        max_execution_time = 300
+        max_input_time = 300
+        session.auto_start = 0
+        mbstring.func_overload = 0
+        always_populate_raw_post_data = -1
+        # https://bbs.archlinux.org/viewtopic.php?pid=1745214#p1745214
+        session.save_path = ${stateDir}/session
+      '' + optionalString (config.time.timeZone != null) ''
+        date.timezone = "${config.time.timeZone}"
+      '' + optionalString (cfg.database.type == "oracle") ''
+        extension=${pkgs.phpPackages.oci8}/lib/php/extensions/oci8.so
+      '';
+      listen = "/run/phpfpm/zabbix.sock";
+      extraConfig = ''
+        listen.owner = ${config.services.httpd.user};
+        listen.group = ${config.services.httpd.group};
+        user = ${user};
+        group = ${config.services.httpd.group};
+        env[ZABBIX_CONFIG] = ${zabbixConfig}
+        ${cfg.poolConfig}
+      '';
+    };
+
+    services.httpd = {
+      enable = true;
+      adminAddr = mkDefault cfg.virtualHost.adminAddr;
+      extraModules = [ "proxy_fcgi" ];
+      virtualHosts = [ (mkMerge [
+        cfg.virtualHost {
+          documentRoot = mkForce "${cfg.package}/share/zabbix";
+          extraConfig = ''
+            <Directory "${cfg.package}/share/zabbix">
+              <FilesMatch "\.php$">
+                <If "-f %{REQUEST_FILENAME}">
+                  SetHandler "proxy:unix:${fpm.listen}|fcgi://localhost/"
+                </If>
+              </FilesMatch>
+              AllowOverride all
+              Options -Indexes
+              DirectoryIndex index.php
+            </Directory>
+          '';
+        }
+      ]) ];
+    };
+
+    users.users.${user} = mapAttrs (name: mkDefault) {
+      description = "Zabbix daemon user";
+      uid = config.ids.uids.zabbix;
+      inherit group;
+    };
+
+    users.groups.${group} = mapAttrs (name: mkDefault) {
+      gid = config.ids.gids.zabbix;
+    };
+
+  };
+}

nixos/modules/services/web-servers/apache-httpd/foswiki.nix

@@ -1,78 +0,0 @@
-{ config, pkgs, lib, serverInfo, ... }:
-let
-  inherit (pkgs) foswiki;
-  inherit (serverInfo.serverConfig) user group;
-  inherit (config) vardir;
-in
-{
-  options.vardir = lib.mkOption {
-    type = lib.types.path;
-    default = "/var/www/foswiki";
-    description = "The directory where variable foswiki data will be stored and served from.";
-  };
-
-  # TODO: this will probably need to be better customizable
-  extraConfig =
-    let httpd-conf = pkgs.runCommand "foswiki-httpd.conf"
-      { preferLocalBuild = true; }
-      ''
-        substitute '${foswiki}/foswiki_httpd_conf.txt' "$out" \
-          --replace /var/www/foswiki/ "${vardir}/"
-      '';
-    in
-      ''
-        RewriteEngine on
-        RewriteRule /foswiki/(.*) ${vardir}/$1
-
-        <Directory "${vardir}">
-          Require all granted
-        </Directory>
-
-        Include ${httpd-conf}
-        <Directory "${vardir}/pub">
-          Options FollowSymlinks
-        </Directory>
-      '';
-
-  /** This handles initial setup and updates.
-      It will probably need some tweaking, maybe per-site.  */
-  startupScript = pkgs.writeScript "foswiki_startup.sh" (
-    let storeLink = "${vardir}/package"; in
-    ''
-      [ -e '${storeLink}' ] || needs_setup=1
-      mkdir -p '${vardir}'
-      cd '${vardir}'
-      ln -sf -T '${foswiki}' '${storeLink}'
-
-      if [ -n "$needs_setup" ]; then # do initial setup
-        mkdir -p bin lib
-        # setup most of data/ as copies only
-        cp -r '${foswiki}'/data '${vardir}/'
-        rm -r '${vardir}'/data/{System,mime.types}
-        ln -sr -t '${vardir}/data/' '${storeLink}'/data/{System,mime.types}
-
-        ln -sr '${storeLink}/locale' .
-
-        mkdir pub
-        ln -sr '${storeLink}/pub/System' pub/
-
-        mkdir templates
-        ln -sr '${storeLink}'/templates/* templates/
-
-        ln -sr '${storeLink}/tools' .
-
-        mkdir -p '${vardir}'/working/{logs,tmp}
-        ln -sr '${storeLink}/working/README' working/ # used to check dir validity
-
-        chown -R '${user}:${group}' .
-        chmod +w -R .
-      fi
-
-      # bin/* and lib/* shall always be overwritten, in case files are added
-      ln -srf '${storeLink}'/bin/* '${vardir}/bin/'
-      ln -srf '${storeLink}'/lib/* '${vardir}/lib/'
-    ''
-    /* Symlinking bin/ one-by-one ensures that ${vardir}/lib/LocalSite.cfg
-        is used instead of ${foswiki}/... */
-  );
-}

nixos/modules/services/web-servers/apache-httpd/trac.nix

@@ -1,121 +0,0 @@
-{ config, lib, pkgs, serverInfo, ... }:
-
-with lib;
-
-let
-
-  # Build a Subversion instance with Apache modules and Swig/Python bindings.
-  subversion = pkgs.subversion.override {
-    bdbSupport = true;
-    httpServer = true;
-    pythonBindings = true;
-    apacheHttpd = httpd;
-  };
-
-  httpd = serverInfo.serverConfig.package;
-
-  versionPre24 = versionOlder httpd.version "2.4";
-
-in
-
-{
-
-  options = {
-
-    projectsLocation = mkOption {
-      description = "URL path in which Trac projects can be accessed";
-      default = "/projects";
-    };
-
-    projects = mkOption {
-      description = "List of projects that should be provided by Trac. If they are not defined yet empty projects are created.";
-      default = [];
-      example =
-        [ { identifier = "myproject";
-            name = "My Project";
-            databaseURL="postgres://root:password@/tracdb";
-            subversionRepository="/data/subversion/myproject";
-          }
-        ];
-    };
-
-    user = mkOption {
-      default = "wwwrun";
-      description = "User account under which Trac runs.";
-    };
-
-    group = mkOption {
-      default = "wwwrun";
-      description = "Group under which Trac runs.";
-    };
-
-    ldapAuthentication = {
-      enable = mkOption {
-        default = false;
-        description = "Enable the ldap authentication in trac";
-      };
-
-      url = mkOption {
-        default = "ldap://127.0.0.1/dc=example,dc=co,dc=ke?uid?sub?(objectClass=inetOrgPerson)";
-        description = "URL of the LDAP authentication";
-      };
-
-      name = mkOption {
-        default = "Trac server";
-        description = "AuthName";
-      };
-    };
-
-  };
-
-  extraModules = singleton
-    { name = "python"; path = "${pkgs.mod_python}/modules/mod_python.so"; };
-
-  extraConfig = ''
-    <Location ${config.projectsLocation}>
-      SetHandler mod_python
-      PythonHandler trac.web.modpython_frontend
-      PythonOption TracEnvParentDir /var/trac/projects
-      PythonOption TracUriRoot ${config.projectsLocation}
-      PythonOption PYTHON_EGG_CACHE /var/trac/egg-cache
-    </Location>
-    ${if config.ldapAuthentication.enable then ''
-      <LocationMatch "^${config.projectsLocation}[^/]+/login$">
-        AuthType Basic
-        AuthName "${config.ldapAuthentication.name}"
-        AuthBasicProvider "ldap"
-        AuthLDAPURL "${config.ldapAuthentication.url}"
-        ${if versionPre24 then "authzldapauthoritative Off" else ""}
-        require valid-user
-      </LocationMatch>
-    '' else ""}
-  '';
-
-  globalEnvVars = singleton
-    { name = "PYTHONPATH";
-      value =
-        makeSearchPathOutput "lib" "lib/${pkgs.python.libPrefix}/site-packages"
-          [ pkgs.mod_python
-            pkgs.pythonPackages.trac
-            pkgs.pythonPackages.setuptools
-            pkgs.pythonPackages.genshi
-            pkgs.pythonPackages.psycopg2
-            subversion
-          ];
-    };
-
-  startupScript = pkgs.writeScript "activateTrac" ''
-    mkdir -p /var/trac
-    chown ${config.user}:${config.group} /var/trac
-
-    ${concatMapStrings (project:
-      ''
-        if [ ! -d /var/trac/${project.identifier} ]
-        then
-            export PYTHONPATH=${pkgs.pythonPackages.psycopg2}/lib/${pkgs.python.libPrefix}/site-packages
-            ${pkgs.pythonPackages.trac}/bin/trac-admin /var/trac/${project.identifier} initenv "${project.name}" "${project.databaseURL}" svn "${project.subversionRepository}"
-        fi
-      '' ) (config.projects)}
-  '';
-
-}

nixos/modules/services/web-servers/apache-httpd/zabbix.nix

@@ -1,84 +0,0 @@
-{ config, lib, pkgs, serverInfo, ... }:
-
-with lib;
-
-let
-
-  # The Zabbix PHP frontend needs to be able to write its
-  # configuration settings (the connection info to the database) to
-  # the "conf" subdirectory.  So symlink $out/conf to some directory
-  # outside of the Nix store where we want to keep this stateful info.
-  # Note that different instances of the frontend will therefore end
-  # up with their own copies of the PHP sources.  !!! Alternatively,
-  # we could generate zabbix.conf.php declaratively.
-  zabbixPHP = pkgs.runCommand "${pkgs.zabbix.server.name}-php" {}
-    ''
-      cp -rs ${pkgs.zabbix.server}/share/zabbix/php "$out"
-      chmod -R u+w $out
-      ln -s "${if config.configFile == null
-               then "${config.stateDir}/zabbix.conf.php"
-               else config.configFile}" "$out/conf/zabbix.conf.php"
-    '';
-
-in
-
-{
-
-  enablePHP = true;
-
-  phpOptions =
-    ''
-      post_max_size = 32M
-      max_execution_time = 300
-      max_input_time = 300
-    '';
-
-  extraConfig = ''
-    Alias ${config.urlPrefix}/ ${zabbixPHP}/
-
-    <Directory ${zabbixPHP}>
-      DirectoryIndex index.php
-      Order deny,allow
-      Allow from *
-    </Directory>
-  '';
-
-  startupScript = pkgs.writeScript "zabbix-startup-hook" ''
-    mkdir -p ${config.stateDir}
-    chown -R ${serverInfo.serverConfig.user} ${config.stateDir}
-  '';
-
-  # The frontend needs "ps" to find out whether zabbix_server is running.
-  extraServerPath = [ pkgs.procps ];
-
-  options = {
-
-    urlPrefix = mkOption {
-      default = "/zabbix";
-      description = "
-        The URL prefix under which the Zabbix service appears.
-        Use the empty string to have it appear in the server root.
-      ";
-    };
-
-    configFile = mkOption {
-      default = null;
-      type = types.nullOr types.path;
-      description = ''
-        The configuration file (zabbix.conf.php) which contains the database
-        connection settings. If not set, the configuration settings will created
-        by the web installer.
-      '';
-    };
-
-    stateDir = mkOption {
-      default = "/var/lib/zabbix/frontend";
-      description = "
-        Directory where the dynamically generated configuration data
-        of the PHP frontend will be stored.
-      ";
-    };
-
-  };
-
-}

nixos/modules/services/x11/xserver.nix

@@ -662,10 +662,9 @@ in
         restartIfChanged = false;
 
         environment =
-          {
-            LD_LIBRARY_PATH = concatStringsSep ":" ([ "/run/opengl-driver/lib" ]
-              ++ concatLists (catAttrs "libPath" cfg.drivers));
-          } // cfg.displayManager.job.environment;
+          optionalAttrs config.hardware.opengl.setLdLibraryPath
+            { LD_LIBRARY_PATH = pkgs.addOpenGLRunpath.driverLink; }
+          // cfg.displayManager.job.environment;
 
         preStart =
           ''

nixos/modules/system/boot/loader/grub/install-grub.pl

@@ -407,6 +407,29 @@ addEntry("NixOS - Default", $defaultConfig);
 
 $conf .= "$extraEntries\n" unless $extraEntriesBeforeNixOS;
 
+# Find all the children of the current default configuration
+# Do not search for grand children
+my @links = sort (glob "$defaultConfig/fine-tune/*");
+foreach my $link (@links) {
+
+    my $entryName = "";
+
+    my $cfgName = readFile("$link/configuration-name");
+
+    my $date = strftime("%F", localtime(lstat($link)->mtime));
+    my $version =
+        -e "$link/nixos-version"
+        ? readFile("$link/nixos-version")
+        : basename((glob(dirname(Cwd::abs_path("$link/kernel")) . "/lib/modules/*"))[0]);
+
+    if ($cfgName) {
+        $entryName = $cfgName;
+    } else {
+        $entryName = "($date - $version)";
+    }
+    addEntry("NixOS - $entryName", $link);
+}
+
 my $grubBootPath = $grubBoot->path;
 # extraEntries could refer to @bootRoot@, which we have to substitute
 $conf =~ s/\@bootRoot\@/$grubBootPath/g;

nixos/modules/tasks/auto-upgrade.nix

@@ -53,6 +53,16 @@ let cfg = config.system.autoUpgrade; in
         '';
       };
 
+      allowReboot = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Reboot the system into the new generation instead of a switch
+          if the new generation uses a different kernel, kernel modules
+          or initrd than the booted system.
+        '';
+      };
+
     };
 
   };
@@ -78,11 +88,23 @@ let cfg = config.system.autoUpgrade; in
           HOME = "/root";
         } // config.networking.proxy.envVars;
 
-      path = [ pkgs.gnutar pkgs.xz.bin pkgs.gitMinimal config.nix.package.out ];
+      path = [ pkgs.coreutils pkgs.gnutar pkgs.xz.bin pkgs.gitMinimal config.nix.package.out ];
 
-      script = ''
-        ${config.system.build.nixos-rebuild}/bin/nixos-rebuild switch ${toString cfg.flags}
-      '';
+      script = let
+          nixos-rebuild = "${config.system.build.nixos-rebuild}/bin/nixos-rebuild";
+        in
+        if cfg.allowReboot then ''
+            ${nixos-rebuild} boot ${toString cfg.flags}
+            booted="$(readlink /run/booted-system/{initrd,kernel,kernel-modules})"
+            built="$(readlink /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules})"
+            if [ "$booted" = "$built" ]; then
+              ${nixos-rebuild} switch ${toString cfg.flags}
+            else
+              /run/current-system/sw/bin/shutdown -r +1
+            fi
+          '' else ''
+            ${nixos-rebuild} switch ${toString cfg.flags}
+        '';
 
       startAt = cfg.dates;
     };

nixos/modules/virtualisation/parallels-guest.nix

@@ -47,7 +47,7 @@ in
   config = mkIf config.hardware.parallels.enable {
     services.xserver = {
       drivers = singleton
-        { name = "prlvideo"; modules = [ prl-tools ]; libPath = [ prl-tools ]; };
+        { name = "prlvideo"; modules = [ prl-tools ]; };
 
       screenSection = ''
         Option "NoMTRR"
@@ -65,6 +65,7 @@ in
 
     hardware.opengl.package = prl-tools;
     hardware.opengl.package32 = pkgs.pkgsi686Linux.linuxPackages.prl-tools.override { libsOnly = true; kernel = null; };
+    hardware.opengl.setLdLibraryPath = true;
 
     services.udev.packages = [ prl-tools ];
 

nixos/tests/deluge.nix

@@ -8,9 +8,11 @@ import ./make-test.nix ({ pkgs, ...} : {
     simple = {
       services.deluge = {
         enable = true;
-        web.enable = true;
+        web = {
+          enable = true;
+          openFirewall = true;
+        };
       };
-      networking.firewall.allowedTCPPorts = [ 8112 ];
     };
 
     declarative =

nixos/tests/installer.nix

@@ -67,6 +67,7 @@ let
   # partitions and filesystems.
   testScriptFun = { bootLoader, createPartitions, grubVersion, grubDevice, grubUseEfi
                   , grubIdentifier, preBootCommands, extraConfig
+                  , testCloneConfig
                   }:
     let
       iface = if grubVersion == 1 then "ide" else "virtio";
@@ -85,6 +86,7 @@ let
     in if !isEfi && !(pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) then
       throw "Non-EFI boot methods are only supported on i686 / x86_64"
     else ''
+
       $machine->start;
 
       # Make sure that we get a login prompt etc.
@@ -185,6 +187,43 @@ let
       ${preBootCommands}
       $machine->waitForUnit("network.target");
       $machine->shutdown;
+
+      # Tests for validating clone configuration entries in grub menu
+      ${optionalString testCloneConfig ''
+        # Reboot Machine
+        $machine = createMachine({ ${hdFlags} qemuFlags => "${qemuFlags}", name => "clone-default-config" });
+        ${preBootCommands}
+        $machine->waitForUnit("multi-user.target");
+
+        # Booted configuration name should be Home
+        # This is not the name that shows in the grub menu.
+        # The default configuration is always shown as "Default"
+        $machine->succeed("cat /run/booted-system/configuration-name >&2");
+        $machine->succeed("cat /run/booted-system/configuration-name | grep Home");
+
+        # We should find **not** a file named /etc/gitconfig
+        $machine->fail("test -e /etc/gitconfig");
+
+        # Set grub to boot the second configuration
+        $machine->succeed("grub-reboot 1");
+
+        $machine->shutdown;
+
+        # Reboot Machine
+        $machine = createMachine({ ${hdFlags} qemuFlags => "${qemuFlags}", name => "clone-alternate-config" });
+        ${preBootCommands}
+
+        $machine->waitForUnit("multi-user.target");
+        # Booted configuration name should be Work
+        $machine->succeed("cat /run/booted-system/configuration-name >&2");
+        $machine->succeed("cat /run/booted-system/configuration-name | grep Work");
+
+        # We should find a file named /etc/gitconfig
+        $machine->succeed("test -e /etc/gitconfig");
+
+        $machine->shutdown;
+      ''}
+
     '';
 
 
@@ -194,6 +233,7 @@ let
     , bootLoader ? "grub" # either "grub" or "systemd-boot"
     , grubVersion ? 2, grubDevice ? "/dev/vda", grubIdentifier ? "uuid", grubUseEfi ? false
     , enableOCR ? false, meta ? {}
+    , testCloneConfig ? false
     }:
     makeTest {
       inherit enableOCR;
@@ -269,7 +309,8 @@ let
 
       testScript = testScriptFun {
         inherit bootLoader createPartitions preBootCommands
-                grubVersion grubDevice grubIdentifier grubUseEfi extraConfig;
+                grubVersion grubDevice grubIdentifier grubUseEfi extraConfig
+                testCloneConfig;
       };
     };
 
@@ -304,6 +345,66 @@ let
         '';
       };
 
+  # The (almost) simplest partitioning scheme: a swap partition and
+  # one big filesystem partition.
+  simple-test-config = { createPartitions =
+       ''
+         $machine->succeed(
+             "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+             . " mkpart primary linux-swap 1M 1024M"
+             . " mkpart primary ext2 1024M -1s",
+             "udevadm settle",
+             "mkswap /dev/vda1 -L swap",
+             "swapon -L swap",
+             "mkfs.ext3 -L nixos /dev/vda2",
+             "mount LABEL=nixos /mnt",
+         );
+       '';
+   };
+
+  simple-uefi-grub-config =
+    { createPartitions =
+        ''
+          $machine->succeed(
+              "flock /dev/vda parted --script /dev/vda -- mklabel gpt"
+              . " mkpart ESP fat32 1M 50MiB" # /boot
+              . " set 1 boot on"
+              . " mkpart primary linux-swap 50MiB 1024MiB"
+              . " mkpart primary ext2 1024MiB -1MiB", # /
+              "udevadm settle",
+              "mkswap /dev/vda2 -L swap",
+              "swapon -L swap",
+              "mkfs.ext3 -L nixos /dev/vda3",
+              "mount LABEL=nixos /mnt",
+              "mkfs.vfat -n BOOT /dev/vda1",
+              "mkdir -p /mnt/boot",
+              "mount LABEL=BOOT /mnt/boot",
+          );
+        '';
+        bootLoader = "grub";
+        grubUseEfi = true;
+    };
+
+  clone-test-extraconfig = { extraConfig =
+         ''
+         environment.systemPackages = [ pkgs.grub2 ];
+         boot.loader.grub.configurationName = "Home";
+         nesting.clone = [
+         {
+           boot.loader.grub.configurationName = lib.mkForce "Work";
+
+           environment.etc = {
+             "gitconfig".text = "
+               [core]
+                 gitproxy = none for work.com
+                 ";
+           };
+         }
+         ];
+         '';
+       testCloneConfig = true;
+  };
+
 
 in {
 
@@ -312,21 +413,10 @@ in {
 
   # The (almost) simplest partitioning scheme: a swap partition and
   # one big filesystem partition.
-  simple = makeInstallerTest "simple"
-    { createPartitions =
-        ''
-          $machine->succeed(
-              "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
-              . " mkpart primary linux-swap 1M 1024M"
-              . " mkpart primary ext2 1024M -1s",
-              "udevadm settle",
-              "mkswap /dev/vda1 -L swap",
-              "swapon -L swap",
-              "mkfs.ext3 -L nixos /dev/vda2",
-              "mount LABEL=nixos /mnt",
-          );
-        '';
-    };
+  simple = makeInstallerTest "simple" simple-test-config;
+
+  # Test cloned configurations with the simple grub configuration
+  simpleClone = makeInstallerTest "simpleClone" (simple-test-config // clone-test-extraconfig);
 
   # Simple GPT/UEFI configuration using systemd-boot with 3 partitions: ESP, swap & root filesystem
   simpleUefiSystemdBoot = makeInstallerTest "simpleUefiSystemdBoot"
@@ -351,28 +441,10 @@ in {
         bootLoader = "systemd-boot";
     };
 
-  simpleUefiGrub = makeInstallerTest "simpleUefiGrub"
-    { createPartitions =
-        ''
-          $machine->succeed(
-              "flock /dev/vda parted --script /dev/vda -- mklabel gpt"
-              . " mkpart ESP fat32 1M 50MiB" # /boot
-              . " set 1 boot on"
-              . " mkpart primary linux-swap 50MiB 1024MiB"
-              . " mkpart primary ext2 1024MiB -1MiB", # /
-              "udevadm settle",
-              "mkswap /dev/vda2 -L swap",
-              "swapon -L swap",
-              "mkfs.ext3 -L nixos /dev/vda3",
-              "mount LABEL=nixos /mnt",
-              "mkfs.vfat -n BOOT /dev/vda1",
-              "mkdir -p /mnt/boot",
-              "mount LABEL=BOOT /mnt/boot",
-          );
-        '';
-        bootLoader = "grub";
-        grubUseEfi = true;
-    };
+  simpleUefiGrub = makeInstallerTest "simpleUefiGrub" simple-uefi-grub-config;
+
+  # Test cloned configurations with the uefi grub configuration
+  simpleUefiGrubClone = makeInstallerTest "simpleUefiGrubClone" (simple-uefi-grub-config // clone-test-extraconfig);
 
   # Same as the previous, but now with a separate /boot partition.
   separateBoot = makeInstallerTest "separateBoot"

nixos/tests/trac.nix

@@ -1,74 +0,0 @@
-import ./make-test.nix ({ pkgs, ... }: {
-  name = "trac";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ eelco ];
-  };
-
-  nodes = {
-    storage =
-      { ... }:
-      { services.nfs.server.enable = true;
-        services.nfs.server.exports = ''
-          /repos 192.168.1.0/255.255.255.0(rw,no_root_squash)
-        '';
-        services.nfs.server.createMountPoints = true;
-      };
-
-    postgresql =
-      { pkgs, ... }:
-      { services.postgresql.enable = true;
-        services.postgresql.package = pkgs.postgresql;
-        services.postgresql.enableTCPIP = true;
-        services.postgresql.authentication = ''
-          # Generated file; do not edit!
-          local all all                trust
-          host  all all 127.0.0.1/32   trust
-          host  all all ::1/128        trust
-          host  all all 192.168.1.0/24 trust
-        '';
-      };
-
-    webserver =
-      { pkgs, ... }:
-      { fileSystems = pkgs.lib.mkVMOverride
-          [ { mountPoint = "/repos";
-              device = "storage:/repos";
-              fsType = "nfs";
-            }
-          ];
-        services.httpd.enable = true;
-        services.httpd.adminAddr = "root@localhost";
-        services.httpd.extraSubservices = [ { serviceType = "trac"; } ];
-        environment.systemPackages = [ pkgs.pythonPackages.trac pkgs.subversion ];
-      };
-
-    client =
-      { ... }:
-      { imports = [ ./common/x11.nix ];
-        services.xserver.desktopManager.plasma5.enable = true;
-      };
-  };
-
-  testScript =
-    ''
-      startAll;
-
-      $postgresql->waitForUnit("postgresql");
-      $postgresql->succeed("createdb trac");
-
-      $webserver->succeed("mkdir -p /repos/trac");
-      $webserver->succeed("svnadmin create /repos/trac");
-
-      $webserver->waitForUnit("httpd");
-      $webserver->waitForFile("/var/trac");
-      $webserver->succeed("mkdir -p /var/trac/projects/test");
-      $webserver->succeed("PYTHONPATH=${pkgs.pythonPackages.psycopg2}/lib/${pkgs.python.libPrefix}/site-packages trac-admin /var/trac/projects/test initenv Test postgres://root\@postgresql/trac svn /repos/trac");
-
-      $client->waitForX;
-      $client->execute("konqueror http://webserver/projects/test &");
-      $client->waitForWindow(qr/Test.*Konqueror/);
-      $client->sleep(30); # loading takes a long time
-
-      $client->screenshot("screen");
-    '';
-})

pkgs/applications/altcoins/clightning.nix

@@ -4,11 +4,11 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "clightning-${version}";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchurl {
     url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    sha256 = "448022c2433cbf19bbd0f726344b0500c0c21ee5cc2291edf6b622f094cb3a15";
+    sha256 = "557be34410f27a8d55d9f31a40717a8f5e99829f2bd114c24e7ca1dd5f6b7d85";
   };
 
   enableParallelBuilding = true;
@@ -18,15 +18,6 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "prefix=$(out) VERSION=v${version}" ];
 
-  patches = [
-    # remove after 0.7.0
-    (fetchpatch {
-      name = "fix-0.7.0-build.patch";
-      url = "https://github.com/ElementsProject/lightning/commit/ffc03d2bc84dc42f745959fbb6c8007cf0a6f701.patch";
-      sha256 = "1m5fiz3m8k3nk09nldii8ij94bg6fqllqgdbiwj3sy12vihs8c4v";
-    })
-  ];
-
   configurePhase = ''
     ./configure --prefix=$out --disable-developer --disable-valgrind
   '';

pkgs/applications/audio/radiotray-ng/default.nix

@@ -39,14 +39,14 @@ let
   pythonInputs = with python2.pkgs; [ python2 lxml ];
 in
 stdenv.mkDerivation rec {
-  name = "radiotray-ng-${version}";
-  version = "0.2.5";
+  pname = "radiotray-ng";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "ebruck";
     repo = "radiotray-ng";
     rev = "v${version}";
-    sha256 = "1crvpn1mgrv7bd2k683mpgs59785mkrjvmp1f14iyq4qrr0f9zzi";
+    sha256 = "0khrfxjas2ldh0kksq7l811srqy16ahjxchvz0hhykx5hykymxlb";
   };
 
   nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook makeWrapper ];
@@ -64,9 +64,10 @@ stdenv.mkDerivation rec {
   patches = [ ./no-dl-googletest.patch ];
 
   postPatch = ''
-    for x in debian/CMakeLists.txt include/radiotray-ng/common.hpp data/*.desktop; do
+    for x in package/CMakeLists.txt include/radiotray-ng/common.hpp data/*.desktop; do
       substituteInPlace $x --replace /usr $out
     done
+    substituteInPlace package/CMakeLists.txt --replace /etc/xdg/autostart $out/etc/xdg/autostart
 
     # We don't find the radiotray-ng-notification icon otherwise
     substituteInPlace data/radiotray-ng.desktop \

pkgs/applications/audio/radiotray-ng/no-dl-googletest.patch

@@ -1,4 +1,4 @@
-From 2ce91cd2244e61d54e0c0a3b26851912240b0667 Mon Sep 17 00:00:00 2001
+From b6f7a9e2e0194c6baed63a33b7beff359080b8d9 Mon Sep 17 00:00:00 2001
 From: Will Dietz <w@wdtz.org>
 Date: Sat, 16 Mar 2019 11:40:00 -0500
 Subject: [PATCH] don't download googletest
@@ -9,7 +9,7 @@ Subject: [PATCH] don't download googletest
  2 files changed, 19 deletions(-)
 
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index fc1b9de..301c266 100644
+index ddba1be..3396705 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
 @@ -70,25 +70,7 @@ endif()
@@ -51,5 +51,5 @@ index 859c048..58ab5c2 100644
      target_include_directories(${target} PRIVATE ${JSONCPP_INCLUDE_DIRS})
      gtest_discover_tests(${target})
 -- 
-2.21.GIT
+2.22.0
 

pkgs/applications/editors/jupyter/kernel.nix

@@ -37,15 +37,15 @@ in
     installPhase =  ''
       mkdir kernels
 
-      ${concatStringsSep "\n" (mapAttrsToList (kernelName: kernel:
+      ${concatStringsSep "\n" (mapAttrsToList (kernelName: unfilteredKernel:
         let
-          config = builtins.toJSON {
-            display_name = if (kernel.displayName != "")
-              then kernel.displayName
-              else kernelName;
-            argv = kernel.argv;
-            language = kernel.language;
-          };
+          allowedKernelKeys = ["argv" "displayName" "language" "interruptMode" "env" "metadata" "logo32" "logo64"];
+          kernel = filterAttrs (n: v: (any (x: x == n) allowedKernelKeys)) unfilteredKernel;
+          config = builtins.toJSON (
+            kernel
+            // {display_name = if (kernel.displayName != "") then kernel.displayName else kernelName;}
+            // (optionalAttrs (kernel ? interruptMode) { interrupt_mode = kernel.interruptMode; })
+          );
           logo32 =
             if (kernel.logo32 != null)
             then "ln -s ${kernel.logo32} 'kernels/${kernelName}/logo-32x32.png';"

pkgs/applications/editors/vscode/vscode.nix

@@ -11,13 +11,13 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    "x86_64-linux" = "02h71b9m9w4nc8g9iy2kafg041brli4zwv7pv6i1qg6p5cf2jdfx";
-    "x86_64-darwin" = "1awq0rwiizwbjqf7crv59qr7m7rmgpfba0b4qx2bpx1mn25fmq56";
+    "x86_64-linux" = "1ck13xpnfklfc81jd8d5md09fcp0gjypacdqj276mzhr5mig29cd";
+    "x86_64-darwin" = "0xpzm372swv0by22saxib16fvvvfjr7d68aj3l5dsl5c9a8v23qj";
   }.${system};
 in
   callPackage ./generic.nix rec {
 
-    version = "1.36.0";
+    version = "1.36.1";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";

pkgs/applications/editors/vscode/vscodium.nix

@@ -11,13 +11,13 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    "x86_64-linux" = "09vmq87az0f91xwyfby85pnn4mg0rlf7pyvs5bkrxv0r8jxxfpq7";
-    "x86_64-darwin" = "16yzzmlf3v9aj7dyglqjxdksabv0cc98w6kdv5rbfw865hj4bbck";
+    "x86_64-linux" = "1ay4zvkbln2wf2j1d71mn13b6p2fqvzgz45mzrgaqwsszhbg4xzp";
+    "x86_64-darwin" = "17r9krb1qd92ybx078hkw9zlyym6kbnmbl91vjdilsq77bkf9jmw";
   }.${system};
 in
   callPackage ./generic.nix rec {
 
-    version = "1.36.0";
+    version = "1.36.1";
     pname = "vscodium";
 
     executableName = "codium";

pkgs/applications/misc/archiver/default.nix

@@ -1,26 +1,24 @@
-{ buildGoPackage
+{ buildGoModule
 , fetchFromGitHub
 , lib
 }:
 
-buildGoPackage rec {
-  name = "archiver-${version}";
-  version = "3.0.0";
-
-  goPackagePath = "github.com/mholt/archiver";
+buildGoModule rec {
+  pname = "archiver";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "mholt";
-    repo = "archiver";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "1wngv51333h907mp6nbzd9dq6r0x06mag2cij92912jcbzy0q8bk";
+    sha256 = "1kq2cyhbniwdabk426j493cs8d4nj35vmznm9031rrdd9ln5h9gl";
   };
 
-  goDeps = ./deps.nix;
+  modSha256 = "13vwgqpw7ypq6mrvwmnl8n38x0h89ymryrrzkf7ya478fp00vclj";
 
   meta = with lib; {
-    description = "Easily create and extract .zip, .tar, .tar.gz, .tar.bz2, .tar.xz, .tar.lz4, .tar.sz, and .rar (extract-only) files with Go";
-    homepage = https://github.com/mholt/archiver;
+    description = "Easily create & extract archives, and compress & decompress files of various formats";
+    homepage = "https://github.com/mholt/archiver";
     license = licenses.mit;
     maintainers = with maintainers; [ kalbasit ];
     platforms = platforms.all;

pkgs/applications/misc/archiver/deps.nix

@@ -1,56 +0,0 @@
-[
-  {
-    goPackagePath = "github.com/dsnet/compress";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dsnet/compress";
-      rev = "cc9eb1d7ad760af14e8f918698f745e80377af4f";
-      sha256 = "159liclywmyb6zx88ga5gn42hfl4cpk1660zss87fkx31hdq9fgx";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/snappy";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/snappy";
-      rev = "2e65f85255dbc3072edf28d6b5b8efc472979f5a";
-      sha256 = "05w6mpc4qcy0pv8a2bzng8nf4s5rf5phfang4jwy9rgf808q0nxf";
-    };
-  }
-  {
-    goPackagePath = "github.com/nwaples/rardecode";
-    fetch = {
-      type = "git";
-      url = "https://github.com/nwaples/rardecode";
-      rev = "197ef08ef68c4454ae5970a9c2692d6056ceb8d7";
-      sha256 = "0vvijw7va283dbdvnf4bgkn7bjngxqzk1rzdpy8sl343r62bmh4g";
-    };
-  }
-  {
-    goPackagePath = "github.com/pierrec/lz4";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pierrec/lz4";
-      rev = "623b5a2f4d2a41e411730dcdfbfdaeb5c0c4564e";
-      sha256 = "1hhf7vyz5irrqs7ixdmvsvzmy9izv3ha8jbyy0cs486h61nzqkki";
-    };
-  }
-  {
-    goPackagePath = "github.com/ulikunitz/xz";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ulikunitz/xz";
-      rev = "590df8077fbcb06ad62d7714da06c00e5dd2316d";
-      sha256 = "07mivr4aiw3b8qzwajsxyjlpbkf3my4xx23lv0yryc4pciam5lhy";
-    };
-  }
-  {
-    goPackagePath = "github.com/xi2/xz";
-    fetch = {
-      type = "git";
-      url = "https://github.com/xi2/xz";
-      rev = "48954b6210f8d154cb5f8484d3a3e1f83489309e";
-      sha256 = "178r0fa2dpzxf0sabs7dn0c8fa7vs87zlxk6spkn374ls9pir7nq";
-    };
-  }
-]

pkgs/applications/misc/cdrtools/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, acl, libcap }:
+{ stdenv, fetchurl, acl, libcap, Carbon, IOKit }:
 
 stdenv.mkDerivation rec {
   name = "cdrtools-${version}";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./fix-paths.patch ];
 
-  buildInputs = [ acl libcap ];
+  buildInputs = if stdenv.isDarwin then [ Carbon IOKit ] else [ acl libcap ];
 
   postPatch = ''
     sed "/\.mk3/d" -i libschily/Targets.man
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     homepage = https://sourceforge.net/projects/cdrtools/;
     description = "Highly portable CD/DVD/BluRay command line recording software";
     license = with licenses; [ gpl2 lgpl2 cddl ];
-    platforms = platforms.linux;
+    platforms = with platforms; linux ++ darwin;
     # Licensing issues: This package contains code licensed under CDDL, GPL2
     # and LGPL2. There is a debate regarding the legality of distributing this
     # package in binary form.

pkgs/applications/misc/electrum/default.nix

@@ -1,4 +1,5 @@
 { stdenv, fetchurl, fetchFromGitHub, python3, python3Packages, zbar, secp256k1
+, enableQt ? !stdenv.isDarwin
 
 
 # for updater.nix
@@ -14,14 +15,23 @@
 }:
 
 let
-  version = "3.3.7";
+  version = "3.3.8";
+
+  libsecp256k1_name =
+    if stdenv.isLinux then "libsecp256k1.so.0"
+    else if stdenv.isDarwin then "libsecp256k1.0.dylib"
+    else "libsecp256k1${stdenv.hostPlatform.extensions.sharedLibrary}";
+
+  libzbar_name =
+    if stdenv.isLinux then "libzbar.so.0"
+    else "libzbar${stdenv.hostPlatform.extensions.sharedLibrary}";
 
   # Not provided in official source releases, which are what upstream signs.
   tests = fetchFromGitHub {
     owner = "spesmilo";
     repo = "electrum";
     rev = version;
-    sha256 = "1g2kbbsi6k105q6s0la20h12gz8dzka5kdcjbdhs12jqsjfx3lr0";
+    sha256 = "1di8ba77kgapcys0d7h5nx1qqakv3s60c6sp8skw8p69ramsl73c";
 
     extraPostFetch = ''
       mv $out ./all
@@ -36,7 +46,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "13ahc4zqpgzmck2r663sqqgz86xsd83r5qqi26mh2vazy1i6pykz";
+    sha256 = "1g00cj1pmckd4xis8r032wmraiv3vd3zc803hnyxa2bnhj8z3bg2";
   };
 
   postUnpack = ''
@@ -56,9 +66,7 @@ python3Packages.buildPythonApplication rec {
     protobuf
     pyaes
     pycryptodomex
-    pyqt5
     pysocks
-    qdarkstyle
     qrcode
     requests
     tlslite-ng
@@ -70,15 +78,20 @@ python3Packages.buildPythonApplication rec {
 
     # TODO plugins
     # amodem
-  ];
+  ] ++ stdenv.lib.optionals enableQt [ pyqt5 qdarkstyle ];
 
   preBuild = ''
     sed -i 's,usr_share = .*,usr_share = "'$out'/share",g' setup.py
-    sed -i "s|name = 'libzbar.*'|name='${zbar}/lib/libzbar.so'|" electrum/qrscanner.py
-    substituteInPlace ./electrum/ecc_fast.py --replace libsecp256k1.so.0 ${secp256k1}/lib/libsecp256k1.so.0
-  '';
+    substituteInPlace ./electrum/ecc_fast.py \
+      --replace ${libsecp256k1_name} ${secp256k1}/lib/libsecp256k1${stdenv.hostPlatform.extensions.sharedLibrary}
+  '' + (if enableQt then ''
+    substituteInPlace ./electrum/qrscanner.py \
+      --replace ${libzbar_name} ${zbar}/lib/libzbar${stdenv.hostPlatform.extensions.sharedLibrary}
+  '' else ''
+    sed -i '/qdarkstyle/d' contrib/requirements/requirements.txt
+  '');
 
-  postInstall = ''
+  postInstall = stdenv.lib.optionalString stdenv.isLinux ''
     # Despite setting usr_share above, these files are installed under
     # $out/nix ...
     mv $out/${python3.sitePackages}/nix/store"/"*/share $out
@@ -123,6 +136,7 @@ python3Packages.buildPythonApplication rec {
     '';
     homepage = https://electrum.org/;
     license = licenses.mit;
+    platforms = platforms.all;
     maintainers = with maintainers; [ ehmry joachifm np ];
   };
 }

pkgs/applications/misc/mako/default.nix

@@ -1,6 +1,7 @@
 { stdenv, fetchFromGitHub, meson, ninja, pkgconfig, scdoc
 , systemd, pango, cairo, gdk_pixbuf
-, wayland, wayland-protocols }:
+, wayland, wayland-protocols
+, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "mako";
@@ -13,6 +14,14 @@ stdenv.mkDerivation rec {
     sha256 = "17azdc37xsbmx13fkfp23vg9lznrv9fh6nhagn64wdq3nhsxm3b6";
   };
 
+  # to be removed with next release
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/emersion/mako/commit/ca8e763f06756136c534b1bbd2e5b536be6b1995.patch";
+      sha256 = "09mi7nn2vwc69igxxc6y2m36n3snhsz0ady99yabhrzl17k4ryds";
+    })
+  ];
+
   nativeBuildInputs = [ meson ninja pkgconfig scdoc wayland-protocols ];
   buildInputs = [ systemd pango cairo gdk_pixbuf wayland ];
 

pkgs/applications/misc/overmind/default.nix

@@ -1,25 +1,25 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, tmux, which, makeWrapper }:
+{ lib, buildGoPackage, fetchFromGitHub, tmux, which, makeWrapper }:
 
 buildGoPackage rec {
-  name = "overmind-${version}";
-  version = "2.0.1";
+  pname = "overmind";
+  version = "2.0.2";
   goPackagePath = "github.com/DarthSim/overmind";
 
   nativeBuildInputs = [ makeWrapper ];
 
   postInstall = ''
-    wrapProgram "$bin/bin/overmind" --prefix PATH : "${stdenv.lib.makeBinPath [ tmux which ]}"
+    wrapProgram "$bin/bin/overmind" --prefix PATH : "${lib.makeBinPath [ tmux which ]}"
   '';
 
   src = fetchFromGitHub {
     owner = "DarthSim";
-    repo = "overmind";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "1j3cpcfgacn5ic19sgrs1djn5jr4d7j7lxaz0vbaf414lrl76qz8";
+    sha256 = "0cns19gqkfxsiiyfxhb05cjp1iv2fb40x47gp8djrwwzcd1r6zxh";
   };
 
-  meta = with stdenv.lib; {
-    homepage = https://github.com/DarthSim/overmind;
+  meta = with lib; {
+    homepage = "https://github.com/DarthSim/overmind";
     description = "Process manager for Procfile-based applications and tmux";
     license = with licenses; [ mit ];
     maintainers = [ maintainers.adisbladis ];

pkgs/applications/misc/zathura/pdf-poppler/default.nix

@@ -5,8 +5,8 @@ stdenv.mkDerivation rec {
   name = "zathura-pdf-poppler-${version}";
 
   src = fetchurl {
-    url = "https://pwmt.org/projects/zathura/plugins/download/${name}.tar.xz";
-    sha256 = "1p4jcny0jniygns78mcf0nlm298dszh49qpmjmackrm6dq8hc25y";
+    url = "https://git.pwmt.org/pwmt/zathura-pdf-poppler/-/archive/${version}/${name}.tar.gz";
+    sha256 = "0c15rnwh42m3ybrhax01bl36w0iynaq8xg6l08riml3cyljypi9l";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig zathura_core ];

pkgs/applications/networking/browsers/chromium/plugins.nix

@@ -100,11 +100,11 @@ let
 
   flash = stdenv.mkDerivation rec {
     name = "flashplayer-ppapi-${version}";
-    version = "32.0.0.207";
+    version = "32.0.0.223";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "09bbrlnw343ygcibyjfa27r8gjdg1dcxx85d3v4v93wfi29nl789";
+      sha256 = "0xm6jcdip4gki267ldw106l5j43im0ji2zjsarvi7n2nvvnwwgnl";
       stripRoot = false;
     };
 

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix

@@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation rec {
   name = "flashplayer-${version}";
-  version = "32.0.0.207";
+  version = "32.0.0.223";
 
   src = fetchurl {
     url =
@@ -85,14 +85,14 @@ stdenv.mkDerivation rec {
     sha256 =
       if debug then
         if arch == "x86_64" then
-          "0v5dlqaapr29qyb2pm57yafnmxdxin7shn1xqsx2sc9xwmvmaw7v"
+          "165zsh4dzzsy38kc8yxp0jdygk4qid5xd642gchlky7z6fwza223"
         else
-          "0ygxcvn6srjg9clayfri86c64inwidp9qk25hbsbyr8m8gghpwqb"
+          "1by2zqw9xgvpf1jnbf5qjl3kcjn5wxznl44f47f8h2gkgcnrf749"
       else
         if arch == "x86_64" then
-          "1y1c65vfsvapqsl2q6vm75m5jyksjwnfs6f6ijcpg0dmf5f4fypy"
+          "07hbg98pgpp81v2sr4vw8siava7wkg1r6hg8i6rg00w9mhvn9vcz"
         else
-          "1h9samf24l0ix6188p940h7l989nwkzlrvv7qdxczj3p62zzvqfy";
+          "1z2nmznmwvg3crdj3gbz2bxvi8dq2jk5yiwk79y90h199nsan1n2";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix

@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation rec {
   name = "flashplayer-standalone-${version}";
-  version = "32.0.0.207";
+  version = "32.0.0.223";
 
   src = fetchurl {
     url =
@@ -60,9 +60,9 @@ stdenv.mkDerivation rec {
         "https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz";
     sha256 =
       if debug then
-        "0z08da6xhjvsxn9xymcnpphap2h0ydj784ms1f950l84rdl4qrr4"
+        "1f3098vfznnx8d7rimgbalr2728jhzwca9val7pdi9b8yf9labwk"
       else
-        "0d2pxggrzamrg143bvic0qa2v70jpplnahihfa4q2rbvy0l3i2pq";
+        "005iyajgp55ww25rcyxg5g0kbzddp6izfly9p4agahmzlzv18y4h";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/networking/cluster/kube-router/default.nix

@@ -1,17 +1,16 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage rec {
-  name = "kube-router-${version}";
-  version = "0.2.5";
-  rev = "v${version}";
+  pname = "kube-router";
+  version = "0.3.1";
 
   goPackagePath = "github.com/cloudnativelabs/kube-router";
 
   src = fetchFromGitHub {
-    inherit rev;
     owner = "cloudnativelabs";
-    repo = "kube-router";
-    sha256 = "1j6q6kg4qj75v2mdy9ivvwq8mx9fpdf0w08959l8imrp5byd56wv";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "06azrghcxp6n4bvrqxpwhmg60qk4jqcrkl1lh1rardlzhl71lk1h";
   };
 
   buildFlagsArray = ''
@@ -22,7 +21,7 @@ buildGoPackage rec {
     ${goPackagePath}/pkg/cmd.buildDate=Nix
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://www.kube-router.io/";
     description = "All-in-one router, firewall and service proxy for Kubernetes";
     license = licenses.asl20;

pkgs/applications/networking/gns3/default.nix

@@ -2,7 +2,7 @@
 
 let
   stableVersion = "2.1.21";
-  previewVersion = "2.2.0b3";
+  previewVersion = "2.2.0b4";
   addVersion = args:
     let version = if args.stable then stableVersion else previewVersion;
         branch = if args.stable then "stable" else "preview";
@@ -18,7 +18,7 @@ in {
   };
   guiPreview = mkGui {
     stable = false;
-    sha256Hash = "1bzy95zqinwrrga7qj6gvpzvz34w4ddhvgmpgq3p1lwzixpqg1w7";
+    sha256Hash = "03jlg4ncs69gv1dn1zsdm0ipvlg6r0lwf8myxric6vv4ks7qqd3w";
   };
 
   serverStable = mkServer {
@@ -27,6 +27,6 @@ in {
   };
   serverPreview = mkServer {
     stable = false;
-    sha256Hash = "1bq4ww6qhhl0qw6yj7cf7yg54yb4y8mxlnwss6hgbyfv5fz9rxjp";
+    sha256Hash = "0mzn62649hmmqq8z2vphqvi0w38jwq8ps4zzbl1dqygbf4gadnqa";
   };
 }

pkgs/applications/networking/instant-messengers/gajim/default.nix

@@ -7,7 +7,7 @@
 , xvfb_run, dbus
 
 # Optional dependencies
-, enableJingle ? true, farstream, gstreamer, gst-plugins-base, gst-libav, gst-plugins-ugly
+, enableJingle ? true, farstream, gstreamer, gst-plugins-base, gst-libav, gst-plugins-ugly, libnice
 , enableE2E ? true
 , enableSecrets ? true, libsecret
 , enableRST ? true, docutils
@@ -33,14 +33,14 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   buildInputs = [
-    gobject-introspection gtk3 gnome3.adwaita-icon-theme
-  ] ++ lib.optionals enableJingle [ farstream gstreamer gst-plugins-base gst-libav gst-plugins-ugly ]
+    gobject-introspection gtk3 gnome3.adwaita-icon-theme wrapGAppsHook
+  ] ++ lib.optionals enableJingle [ farstream gstreamer gst-plugins-base gst-libav gst-plugins-ugly libnice ]
     ++ lib.optional enableSecrets libsecret
     ++ lib.optional enableSpelling gspell
     ++ lib.optional enableUPnP gupnp-igd;
 
   nativeBuildInputs = [
-    gettext wrapGAppsHook
+    gettext
   ];
 
   propagatedBuildInputs = with python3.pkgs; [

pkgs/applications/networking/mumble/default.nix

@@ -139,15 +139,15 @@ let
   };
 
   gitSource = rec {
-    version = "2018-07-01";
+    version = "2019-07-10";
     qtVersion = 5;
 
     # Needs submodules
     src = fetchFromGitHub {
       owner = "mumble-voip";
       repo = "mumble";
-      rev = "c19ac8c0b0f934d2ff206858d7cb66352d6eb418";
-      sha256 = "1mzp1bgn49ycs16d6r8icqq35wq25198fs084vyq6j5f78ni7pvz";
+      rev = "41b265584654c7ac216fd3ccb9c141734d3f839b";
+      sha256 = "00irlzz5q4drmsfbwrkyy7p7w8a5fc1ip5vyicq3g3cy58dprpqr";
       fetchSubmodules = true;
     };
   };

pkgs/applications/science/machine-learning/fasttext/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fasttext";
-  version = "0.2.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "facebookresearch";
     repo = "fastText";
-    rev = version;
-    sha256 = "1fcrz648r2s80bf7vc0l371xillz5jk3ldaiv9jb7wnsyri831b4";
+    rev = "v${version}";
+    sha256 = "1cbzz98qn8aypp4r5kwwwc9wiq5bwzv51kcsb15xjfs9lz8h3rii";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/version-management/git-and-tools/hub/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "hub";
-  version = "2.12.1";
+  version = "2.12.2";
 
   goPackagePath = "github.com/github/hub";
 
@@ -13,7 +13,7 @@ buildGoPackage rec {
     owner = "github";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0i9bqcgdidl5zawkpq2fjrimzbb37i1m2fisvj32d27fsp1824bk";
+    sha256 = "0sxfmjg26s86m5xa9nbj8287kg12kygxw6gggahal6v7zjhwcvaz";
   };
 
   nativeBuildInputs = [ groff utillinux ];

pkgs/applications/virtualization/dynamips/default.nix

@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "dynamips";
-  version = "0.2.20";
+  version = "0.2.21";
 
   src = fetchFromGitHub {
     owner = "GNS3";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1841h0m0k0p3c3ify4imafjk7jigcj2zlr8rn3iyp7jnafkxqik7";
+    sha256 = "0pvdqs6kjz0x0wqb5f1k3r25dg82wssm7wz4psm0m6bxsvf5l0i5";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/virtualization/virt-manager/default.nix

@@ -1,13 +1,18 @@
 { stdenv, fetchurl, python3Packages, intltool, file
 , wrapGAppsHook, gtk-vnc, vte, avahi, dconf
 , gobject-introspection, libvirt-glib, system-libvirt
-, gsettings-desktop-schemas, glib, libosinfo, gnome3, gtk3
+, gsettings-desktop-schemas, glib, libosinfo, gnome3
+, gtksourceview4
 , spiceSupport ? true, spice-gtk ? null
 , cpio, e2fsprogs, findutils, gzip
 }:
 
 with stdenv.lib;
 
+# TODO: remove after there's support for setupPyDistFlags
+let
+  setuppy = ../../../development/interpreters/python/run_setup.py;
+in
 python3Packages.buildPythonApplication rec {
   name = "virt-manager-${version}";
   version = "2.2.0";
@@ -19,13 +24,14 @@ python3Packages.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook intltool file
+    intltool file
     gobject-introspection # for setup hook populating GI_TYPELIB_PATH
   ];
 
   buildInputs = [
+    wrapGAppsHook
     libvirt-glib vte dconf gtk-vnc gnome3.adwaita-icon-theme avahi
-    gsettings-desktop-schemas libosinfo gtk3
+    gsettings-desktop-schemas libosinfo gtksourceview4
     gobject-introspection # Temporary fix, see https://github.com/NixOS/nixpkgs/issues/56943
   ] ++ optional spiceSupport spice-gtk;
 
@@ -43,8 +49,12 @@ python3Packages.buildPythonApplication rec {
     ${python3Packages.python.interpreter} setup.py configure --prefix=$out
   '';
 
-  postInstall = ''
-    ${glib.dev}/bin/glib-compile-schemas "$out"/share/glib-2.0/schemas
+  # TODO: remove after there's support for setupPyDistFlags
+  buildPhase = ''
+    runHook preBuild
+    cp ${setuppy} nix_run_setup
+    ${python3Packages.python.pythonForBuild.interpreter} nix_run_setup --no-update-icon-cache build_ext bdist_wheel
+    runHook postBuild
   '';
 
   preFixup = ''

pkgs/applications/virtualization/virt-viewer/default.nix

@@ -30,7 +30,6 @@ stdenv.mkDerivation rec {
     xen
   ] ++ optionals spiceSupport [
     spice-gtk spice-protocol libcap gdbm
-    gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good
   ];
 
   # Required for USB redirection PolicyKit rules file

pkgs/applications/window-managers/sway/idle.nix

@@ -5,19 +5,15 @@
 
 stdenv.mkDerivation rec {
   name = "swayidle-${version}";
-  version = "1.4";
+  version = "1.5";
 
   src = fetchFromGitHub {
     owner = "swaywm";
     repo = "swayidle";
     rev = version;
-    sha256 = "1fpacy9jwfi3vd94sgsy8qgx5092rm3vsplj2zjbmxkak1gjn56n";
+    sha256 = "05qi96j58xqxjiighay1d39rfanxcpn6vlynj23mb5dymxvlaq9n";
   };
 
-  postPatch = ''
-    sed -iE "s/version: '1\.3',/version: '${version}',/" meson.build
-  '';
-
   nativeBuildInputs = [ meson ninja pkgconfig scdoc ];
   buildInputs = [ wayland wayland-protocols systemd ];
 

pkgs/build-support/fetchurl/default.nix

@@ -49,8 +49,11 @@ in
   # first element of `urls').
   name ? ""
 
-  # Different ways of specifying the hash.
-, outputHash ? ""
+, # SRI hash.
+  hash ? ""
+
+, # Legacy ways of specifying the hash.
+  outputHash ? ""
 , outputHashAlgo ? ""
 , md5 ? ""
 , sha1 ? ""
@@ -103,7 +106,8 @@ let
     else throw "fetchurl requires either `url` or `urls` to be set";
 
   hash_ =
-    if md5 != "" then throw "fetchurl does not support md5 anymore, please use sha256 or sha512"
+    if hash != "" then { outputHashAlgo = null; outputHash = hash; }
+    else if md5 != "" then throw "fetchurl does not support md5 anymore, please use sha256 or sha512"
     else if (outputHash != "" && outputHashAlgo != "") then { inherit outputHashAlgo outputHash; }
     else if sha512 != "" then { outputHashAlgo = "sha512"; outputHash = sha512; }
     else if sha256 != "" then { outputHashAlgo = "sha256"; outputHash = sha256; }

pkgs/build-support/fetchurl/mirrors.nix

@@ -409,9 +409,10 @@ rec {
 
   # Alsa Project
   alsa = [
-     ftp://ftp.alsa-project.org/pub/
-     http://alsa.cybermirror.org/
-     http://www.mirrorservice.org/sites/ftp.alsa-project.org/pub/
-     http://alsa.mirror.fr/
+    https://www.alsa-project.org/files/pub/
+    ftp://ftp.alsa-project.org/pub/
+    http://alsa.cybermirror.org/
+    http://www.mirrorservice.org/sites/ftp.alsa-project.org/pub/
+    http://alsa.mirror.fr/
   ];
 }

pkgs/development/go-packages/generic/default.nix

@@ -72,14 +72,19 @@ let
 
   goPath = if goDeps != null then importGodeps { depsFile = goDeps; } ++ extraSrcs
                              else extraSrcs;
-  package = go.stdenv.mkDerivation (
+  package = stdenv.mkDerivation (
     (builtins.removeAttrs args [ "goPackageAliases" "disabled" "extraSrcs"]) // {
 
     nativeBuildInputs = [ removeReferencesTo go ]
       ++ (lib.optional (!dontRenameImports) govers) ++ nativeBuildInputs;
     buildInputs = buildInputs;
 
-    inherit (go) GOOS GOARCH;
+    inherit (go) GOOS GOARCH GO386 CGO_ENABLED;
+
+    GOHOSTARCH = go.GOHOSTARCH or null;
+    GOHOSTOS = go.GOHOSTOS or null;
+
+    GOARM = toString (stdenv.lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
 
     configurePhase = args.configurePhase or ''
       runHook preConfigure

pkgs/development/interpreters/python/build-python-package-wheel.nix

@@ -8,7 +8,7 @@
 attrs // {
   unpackPhase = ''
     mkdir dist
-    cp $src dist/"''${src#*-}"
+    cp "$src" "dist/$(stripHash "$src")"
   '';
 
   # Wheels are pre-compiled

pkgs/development/interpreters/python/fetchpypi.nix

@@ -0,0 +1,28 @@
+# `fetchPypi` function for fetching artifacts from PyPI.
+{ fetchurl
+, makeOverridable
+}:
+
+let
+  computeUrl = {format ? "setuptools", ... } @attrs: let
+    computeWheelUrl = {pname, version, python ? "py2.py3", abi ? "none", platform ? "any"}:
+    # Fetch a wheel. By default we fetch an universal wheel.
+    # See https://www.python.org/dev/peps/pep-0427/#file-name-convention for details regarding the optional arguments.
+      "https://files.pythonhosted.org/packages/${python}/${builtins.substring 0 1 pname}/${pname}/${pname}-${version}-${python}-${abi}-${platform}.whl";
+
+    computeSourceUrl = {pname, version, extension ? "tar.gz"}:
+    # Fetch a source tarball.
+      "mirror://pypi/${builtins.substring 0 1 pname}/${pname}/${pname}-${version}.${extension}";
+
+    compute = (if format == "wheel" then computeWheelUrl
+      else if format == "setuptools" then computeSourceUrl
+      else throw "Unsupported format ${format}");
+
+  in compute (builtins.removeAttrs attrs ["format"]);
+
+in makeOverridable( {format ? "setuptools", sha256 ? "", hash ? "", ... } @attrs:
+  let
+    url = computeUrl (builtins.removeAttrs attrs ["sha256" "hash"]) ;
+  in fetchurl {
+    inherit url sha256 hash;
+  })

pkgs/development/libraries/SDL_gpu/default.nix

@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, cmake, SDL2, libGLU }:
+
+stdenv.mkDerivation rec {
+  pname = "SDL_gpu-unstable";
+  version = "2019-01-24";
+
+  src = fetchFromGitHub {
+    owner = "grimfang4";
+    repo = "sdl-gpu";
+    rev = "e3d350b325a0e0d0b3007f69ede62313df46c6ef";
+    sha256 = "0kibcaim01inb6xxn4mr6affn4hm50vz9kahb5k9iz8dmdsrhxy1";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ SDL2 libGLU ];
+
+  cmakeFlags = [
+    "-DSDL_gpu_BUILD_DEMOS=OFF"
+    "-DSDL_gpu_BUILD_TOOLS=OFF"
+    "-DSDL_gpu_BUILD_VIDEO_TEST=OFF"
+    "-DSDL_gpu_BUILD_TESTS=OFF"
+  ];
+
+  patchPhase = ''
+    sed -ie '210s#''${OUTPUT_DIR}/lib#''${CMAKE_INSTALL_LIBDIR}#' src/CMakeLists.txt
+    sed -ie '213s#''${OUTPUT_DIR}/lib#''${CMAKE_INSTALL_LIBDIR}#' src/CMakeLists.txt
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A library for high-performance, modern 2D graphics with SDL written in C";
+    homepage = "https://github.com/grimfang4/sdl-gpu";
+    license = licenses.mit;
+    maintainers = with maintainers; [ pmiddend ];
+    platforms = platforms.linux;
+  };
+}

pkgs/development/libraries/discord-rpc/default.nix

@@ -0,0 +1,40 @@
+{ stdenv
+, fetchFromGitHub
+, cmake
+, rapidjson
+, AppKit
+, buildExamples ? false
+}:
+
+stdenv.mkDerivation rec {
+  pname = "discord-rpc";
+  version = "3.4.0";
+
+  src = fetchFromGitHub {
+    owner = "discordapp";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "04cxhqdv5r92lrpnhxf8702a8iackdf3sfk1050z7pijbijiql2a";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    rapidjson
+  ] ++ stdenv.lib.optional stdenv.isDarwin AppKit;
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=true"
+    "-DBUILD_EXAMPLES=${stdenv.lib.boolToString buildExamples}"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Official library to interface with the Discord client";
+    homepage = "https://github.com/discordapp/discord-rpc";
+    license = licenses.mit;
+    maintainers = with maintainers; [ tadeokondrak ];
+    platforms = platforms.all;
+  };
+}

pkgs/development/libraries/qt-5/5.12/qtwebengine-darwin-no-platform-check.patch

@@ -19,3 +19,15 @@ diff --git a/mkspecs/features/platform.prf b/mkspecs/features/platform.prf
      }
    } else {
      skipBuild("Unknown platform. Qt WebEngine only supports Linux, Windows, and macOS.")
+diff --git a/src/core/config/mac_osx.pri b/src/core/config/mac_osx.pri
+--- a/src/core/config/mac_osx.pri
++++ b/src/core/config/mac_osx.pri
+@@ -5,8 +5,6 @@ load(functions)
+ # otherwise query for it.
+ QMAKE_MAC_SDK_VERSION = $$eval(QMAKE_MAC_SDK.$${QMAKE_MAC_SDK}.SDKVersion)
+ isEmpty(QMAKE_MAC_SDK_VERSION) {
+-     QMAKE_MAC_SDK_VERSION = $$system("/usr/bin/xcodebuild -sdk $${QMAKE_MAC_SDK} -version SDKVersion 2>/dev/null")
+-     isEmpty(QMAKE_MAC_SDK_VERSION): error("Could not resolve SDK version for \'$${QMAKE_MAC_SDK}\'")
+ }
+
+ QMAKE_CLANG_DIR = "/usr"

pkgs/development/libraries/qtpbfimageplugin/default.nix

@@ -0,0 +1,39 @@
+{ stdenv, fetchFromGitHub, qmake, qtbase, protobuf }:
+
+stdenv.mkDerivation rec {
+  pname = "qtpbfimageplugin";
+  version = "1.4";
+
+  src = fetchFromGitHub {
+    owner = "tumic0";
+    repo = "QtPBFImagePlugin";
+    rev = version;
+    sha256 = "0d39i7rmhrmm2df49gd47zm37gnz3fmyr6hfc6hhzvk08jb6956r";
+  };
+
+  nativeBuildInputs = [ qmake ];
+  buildInputs = [ qtbase protobuf ];
+
+  postPatch = ''
+    # Fix plugin dir
+    substituteInPlace pbfplugin.pro \
+      --replace "\$\$[QT_INSTALL_PLUGINS]" "$out/$qtPluginPrefix"
+
+    # Fix darwin build
+    substituteInPlace pbfplugin.pro \
+      --replace '$$PROTOBUF/lib/libprotobuf-lite.a' '${protobuf}/lib/libprotobuf-lite.dylib'
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Qt image plugin for displaying Mapbox vector tiles";
+    longDescription = ''
+      QtPBFImagePlugin is a Qt image plugin that enables applications capable of
+      displaying raster MBTiles maps or raster XYZ online maps to also display PBF
+      vector tiles without (almost) any application modifications.
+    '';
+    homepage = https://github.com/tumic0/QtPBFImagePlugin;
+    license = licenses.lgpl3;
+    maintainers = [ maintainers.sikmir ];
+    platforms = platforms.unix;
+  };
+}

pkgs/development/libraries/soundtouch/default.nix

@@ -1,22 +1,24 @@
-{stdenv, fetchurl, autoconf, automake, libtool}:
+{stdenv, lib, fetchFromGitLab, autoconf, automake, libtool}:
 
 stdenv.mkDerivation rec {
-  pName = "soundtouch";
-  name = "${pName}-2.0.0";
-  src = fetchurl {
-    url = "https://www.surina.net/soundtouch/${name}.tar.gz";
-    sha256 = "09cxr02mfyj2bg731bj0i9hh565x8l9p91aclxs8wpqv8b8zf96j";
+  pname = "soundtouch";
+  version = "2.1.2";
+
+  src = fetchFromGitLab {
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "174wgm3s0inmbnkrlnspxjwm2014qhjhkbdqa5r8rbfi0nzqxzsz";
   };
 
-  buildInputs = [ autoconf automake libtool ];
+  nativeBuildInputs = [ autoconf automake libtool ];
 
   preConfigure = "./bootstrap";
 
-  meta = {
-      description = "A program and library for changing the tempo, pitch and playback rate of audio";
-      homepage = http://www.surina.net/soundtouch/;
-      downloadPage = http://www.surina.net/soundtouch/sourcecode.html;
-      license = stdenv.lib.licenses.lgpl21;
-      platforms = stdenv.lib.platforms.all;
+  meta = with lib; {
+    description = "A program and library for changing the tempo, pitch and playback rate of audio";
+    homepage = "http://www.surina.net/soundtouch/";
+    license = licenses.lgpl21;
+    platforms = platforms.all;
   };
 }

pkgs/development/libraries/spice-gtk/default.nix

@@ -87,10 +87,13 @@ stdenv.mkDerivation rec {
     vala
   ];
 
+  propagatedBuildInputs = [
+    gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good
+  ];
+
   buildInputs = [
     cyrus_sasl
     epoxy
-    gst_all_1.gst-plugins-base
     gtk3
     json-glib
     libcacard

pkgs/development/python-modules/aiorpcx/default.nix

@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "aiorpcx";
-  version = "0.17.0";
+  version = "0.18.3";
 
   src = fetchPypi {
     inherit version;
     pname = "aiorpcX";
-    sha256 = "14np5r75rs0v45vsv20vbzmnv3qisvm9mdllj1j9s1633cvcik0k";
+    sha256 = "0k545hc7wl6sh1svydzbv6x7sx5pig2pqkl3yxs9riwmvzawx9xp";
   };
 
   propagatedBuildInputs = [ attrs ];

pkgs/development/python-modules/anonip/default.nix

@@ -0,0 +1,24 @@
+{ stdenv, lib, buildPythonPackage, fetchFromGitHub, ipaddress, isPy27 }:
+
+buildPythonPackage rec {
+  pname = "anonip";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "DigitaleGesellschaft";
+    repo = "Anonip";
+    rev = "v${version}";
+    sha256 = "0y5xqivcinp6pwx4whc8ca1n2wxrvff7a2lpbz2dhivilfanmljs";
+  };
+
+  propagatedBuildInputs = lib.optionals isPy27 [ ipaddress ];
+
+  checkPhase = "python tests.py";
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/DigitaleGesellschaft/Anonip";
+    description = "A tool to anonymize IP-addresses in log-files";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.mmahut ];
+  };
+}

pkgs/development/python-modules/deap/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "deap";
-  version = "1.2.2";
+  version = "1.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "95c63e66d755ec206c80fdb2908851c0bef420ee8651ad7be4f0578e9e909bcf";
+    sha256 = "102r11pxb36xkq5bjv1lpkss77v278f5xdv6lvkbjdvqryydf3yd";
   };
 
   propagatedBuildInputs = [ numpy matplotlib ];
@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   meta = with stdenv.lib; {
     description = "DEAP is a novel evolutionary computation framework for rapid prototyping and testing of ideas.";
-    homepage = https://github.com/DEAP/deap;
+    homepage = "https://github.com/DEAP/deap";
     license = licenses.lgpl3;
     maintainers = with maintainers; [ psyanticy ];
   };

pkgs/development/python-modules/fasttext/default.nix

@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "fasttext";
-  version = "0.2.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "facebookresearch";
     repo = "fastText";
-    rev = version;
-    sha256 = "1fcrz648r2s80bf7vc0l371xillz5jk3ldaiv9jb7wnsyri831b4";
+    rev = "v${version}";
+    sha256 = "1cbzz98qn8aypp4r5kwwwc9wiq5bwzv51kcsb15xjfs9lz8h3rii";
   };
 
   buildInputs = [ pybind11 ];

pkgs/development/python-modules/flask-caching/default.nix

@@ -1,28 +1,26 @@
-{ lib, buildPythonPackage, fetchPypi, flask, pytest, pytestcov }:
+{ lib, buildPythonPackage, fetchPypi, flask, pytest, pytestcov, pytest-xprocess }:
 
 buildPythonPackage rec {
   pname = "Flask-Caching";
-  version = "1.4.0";
+  version = "1.7.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e34f24631ba240e09fe6241e1bf652863e0cff06a1a94598e23be526bc2e4985";
+    sha256 = "17jnnmnpdflv120yhsfbnpick06iias6f2hcxmf1mi1nr35kdqjj";
   };
 
   propagatedBuildInputs = [ flask ];
 
-  checkInputs = [ pytest pytestcov ];
+  checkInputs = [ pytest pytestcov pytest-xprocess ];
 
+  # backend_cache relies on pytest-cache, which is a stale package from 2013
   checkPhase = ''
-    py.test
+    pytest -k 'not backend_cache'
   '';
 
-  # https://github.com/sh4nks/flask-caching/pull/74
-  doCheck = false;
-
   meta = with lib; {
     description = "Adds caching support to your Flask application";
-    homepage = https://github.com/sh4nks/flask-caching;
+    homepage = "https://github.com/sh4nks/flask-caching";
     license = licenses.bsd3;
   };
 }

pkgs/development/python-modules/m2crypto/default.nix

@@ -9,12 +9,12 @@
 
 
 buildPythonPackage rec {
-  version = "0.32.0";
+  version = "0.35.2";
   pname = "M2Crypto";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09d3zs2ivyxbi0fa42mnan0fcplc08q2qd70p1b43sxxdbxcdj99";
+    sha256 = "09yirf3w77w6f49q6nxhrjm9c3a4y9s30s1k09chqrw8zdgx8sjc";
   };
 
   patches = [

pkgs/development/python-modules/msrest/default.nix

@@ -18,12 +18,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.6.7";
+  version = "0.6.8";
   pname = "msrest";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "07136g3j7zgcvkxki4v6q1p2dm1nzzc28181s8dwic0y4ml8qlq5";
+    sha256 = "0yd43fnmfxkvk3idkyn67ziwjgkwkn261kicr3szjibpqjqcpsf9";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pytest-flask/default.nix

@@ -0,0 +1,31 @@
+{ stdenv, buildPythonPackage, fetchPypi, pytest, flask, werkzeug, setuptools_scm }:
+
+buildPythonPackage rec {
+  pname = "pytest-flask";
+  version = "0.15.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0jdzrib94vwfpl8524h34aqzqndh3h4xn706v32xh412c8dphx6q";
+  };
+
+  doCheck = false;
+
+  buildInputs = [
+     pytest
+  ];
+
+  propagatedBuildInputs = [
+    flask
+    werkzeug
+  ];
+
+  nativeBuildInputs = [ setuptools_scm ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/pytest-dev/pytest-flask/";
+    license = licenses.mit;
+    description = "A set of py.test fixtures to test Flask applications";
+    maintainers = with maintainers; [ vanschelven ];
+  };
+}

pkgs/development/python-modules/pytest-xprocess/default.nix

@@ -0,0 +1,32 @@
+{ lib, buildPythonPackage, fetchPypi
+, psutil
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-xprocess";
+  version = "0.12.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "06w2acg0shy0vxrmnxpqclimhgfjys5ql5kmmzr7r1lai46x1q2h";
+  };
+
+  propagatedBuildInputs = [ psutil pytest ];
+
+  # Remove test QoL package from install_requires
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "'pytest-cache', " ""
+  '';
+
+  # There's no tests in repo
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Pytest external process plugin";
+    homepage = "https://github.com/pytest-dev";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}

pkgs/development/python-modules/sklearn-deap/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchFromGitHub, numpy, scipy, deap, scikitlearn, python }:
+{ stdenv, buildPythonPackage, fetchFromGitHub, numpy, scipy, deap, scikitlearn, python, isPy3k }:
 
 buildPythonPackage rec {
   pname = "sklearn-deap";
@@ -23,6 +23,7 @@ buildPythonPackage rec {
     homepage = https://github.com/rsteca/sklearn-deap;
     license = licenses.lgpl3;
     maintainers = with maintainers; [ psyanticy ];
+    broken = isPy3k; # https://github.com/rsteca/sklearn-deap/issues/65
   };
 }
 

pkgs/development/python-modules/spacy/default.nix

@@ -34,7 +34,9 @@ buildPythonPackage rec {
 
   prePatch = ''
     substituteInPlace setup.py \
-      --replace "plac<1.0.0,>=0.9.6" "plac>=0.9.6"
+      --replace "plac<1.0.0,>=0.9.6" "plac>=0.9.6" \
+      --replace "regex==" "regex>=" \
+      --replace "wheel>=0.32.0,<0.33.0" "wheel>=0.32.0"
   '';
 
   propagatedBuildInputs = [

pkgs/development/python-modules/suds-jurko/default.nix

@@ -1,7 +1,6 @@
 { stdenv
 , buildPythonPackage
 , fetchPypi
-, pytest_3
 , isPyPy
 }:
 
@@ -16,7 +15,7 @@ buildPythonPackage rec {
     sha256 = "1s4radwf38kdh3jrn5acbidqlr66sx786fkwi0rgq61hn4n2bdqw";
   };
 
-  checkInputs = [ pytest_3 ];
+  doCheck = false;
 
   postPatch = ''
     # fails

pkgs/development/python-modules/swagger-spec-validator/default.nix

@@ -0,0 +1,37 @@
+{ lib, buildPythonPackage, fetchFromGitHub, pyyaml, jsonschema, six, pytest, mock }:
+
+buildPythonPackage rec {
+  pname = "swagger-spec-validator";
+  version = "2.4.3";
+
+  src = fetchFromGitHub {
+    owner = "Yelp";
+    repo = "swagger_spec_validator";
+    rev = "v" + version;
+    sha256 = "02f8amc6iq2clxxmrz8hirbb57sizaxijp0higqy16shk63ibalw";
+  };
+
+  checkInputs = [
+    pytest
+    mock
+  ];
+
+  checkPhase = ''
+    pytest tests
+  '';
+
+  propagatedBuildInputs = [
+    pyyaml
+    jsonschema
+    six
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/Yelp/swagger_spec_validator";
+    license = licenses.asl20;
+    description = "Validation of Swagger specifications";
+    maintainers = with maintainers; [ vanschelven ];
+  };
+}
+
+

pkgs/development/python-modules/thinc/default.nix

@@ -28,11 +28,11 @@
 
 buildPythonPackage rec {
   pname = "thinc";
-  version = "7.0.4";
+  version = "7.0.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "14v8ygjrkj63dwd4pi490ld6i2d8n8wzcf15hnacjjfwij93pa1q";
+    sha256 = "12d0766z7ksqpqrvldi46mx0z4zsbgncda4fpvxra1d6vbchf8ba";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
@@ -81,6 +81,6 @@ buildPythonPackage rec {
     description = "Practical Machine Learning for NLP in Python";
     homepage = https://github.com/explosion/thinc;
     license = licenses.mit;
-    maintainers = with maintainers; [ aborsu sdll ];
+    maintainers = with maintainers; [ aborsu danieldk sdll ];
     };
 }

pkgs/development/tools/build-managers/mage/default.nix

@@ -1,32 +1,30 @@
-{ buildGoPackage, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
-with lib;
-
-buildGoPackage rec {
-  name = "mage-${version}";
-  version = "1.7.1";
-
-  goPackagePath = "github.com/magefile/mage";
-  subPackages = [ "." ];
+buildGoModule rec {
+  pname = "mage";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "magefile";
-    repo = "mage";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "0n4k5dy338rxwzj654smxzlanmd0zws6mdzv0wc4byqjhr7mqhg2";
+    sha256 = "0vkzm2k2v3np30kdgz9kpwkhnshbjcn8j1y321djz2h3w23k5h7r";
   };
 
+  modSha256 = "0sjjj9z1dhilhpc8pq4154czrb79z9cm044jvn75kxcjv6v5l2m5";
+
   buildFlagsArray = [
     "-ldflags="
     "-X github.com/magefile/mage/mage.commitHash=v${version}"
     "-X github.com/magefile/mage/mage.gitTag=v${version}"
+    "-X github.com/magefile/mage/mage.timestamp=1970-01-01T00:00:00Z"
   ];
 
-  meta = {
+  meta = with lib; {
     description = "A Make/Rake-like Build Tool Using Go";
+    homepage = "https://magefile.org/";
     license = licenses.asl20;
-    maintainers = [ maintainers.swdunlop ];
-    homepage = https://magefile.org/;
+    maintainers = with maintainers; [ swdunlop ];
     platforms = platforms.all;
   };
 }

pkgs/development/tools/continuous-integration/gitlab-runner/default.nix

@@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl }:
 
 let
-  version = "11.11.2";
+  version = "12.0.2";
   # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
   docker_x86_64 = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-x86_64.tar.xz";
-    sha256 = "0q5i9517jsz3mw7hglbnjih7q114350dfd9nyzv7xfk56kc0172w";
+    sha256 = "0b1xkksd4rgqvjahp5bf53sk887z2fxwr7rf8vqs9j9aw54zm5cn";
   };
 
   docker_arm = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-arm.tar.xz";
-    sha256 = "0q7g0ggaxg6akda06an867vbdqjrfcxf4c81b1cxfhbk7whxgxhv";
+    sha256 = "1cjl64g3ymnrs9c3fl28aydfzf18ik4vnjcvijv28c3gm1i6chs0";
   };
 in
 buildGoPackage rec {
@@ -29,7 +29,7 @@ buildGoPackage rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "0bnn89z7p2mrjjlq7i9yfr6ra903vr278qhhy2i126w56dlac6vf";
+    sha256 = "0cbh11libcyfdgrvnl1aa11x90ac7zgn1d9myc4dwmqzfdm4kdlb";
   };
 
   patches = [ ./fix-shell-path.patch ];

pkgs/development/tools/distgen/default.nix

@@ -0,0 +1,32 @@
+{ lib, python3 }:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "distgen";
+  version = "1.3";
+
+  src = python3.pkgs.fetchPypi {
+    inherit pname version;
+    sha256 = "03jwy08wgp1lp6208vks1hv9g1f3aj45cml6k99mm3nw1jfnlbbq";
+  };
+
+  checkInputs = with python3.pkgs; [
+    pytest
+    mock
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    distro
+    jinja2
+    six
+    pyyaml
+  ];
+
+  checkPhase = "make test-unit PYTHON=${python3.executable}";
+
+  meta = with lib; {
+    description = "Templating system/generator for distributions";
+    license = licenses.gpl2Plus;
+    homepage = "https://distgen.readthedocs.io/";
+    maintainers = with maintainers; [ bachp ];
+  };
+}

pkgs/development/tools/rust/cargo-xbuild/default.nix

@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-xbuild";
-  version = "0.5.12";
+  version = "0.5.14";
 
   src = fetchFromGitHub {
     owner = "rust-osdev";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "1vjsss2zrja4kpr83vw6g0hf9xdx658wjhdiymzndbcf32qrx7x1";
+    rev = version;
+    sha256 = "1f87rz17bdpdipc9x2j4gq1zq181gcshhn7vc9pnn6f487hz0bgq";
   };
 
   cargoSha256 = "1r9i79lymfwpbcx2lp509v435qpkl9bqly1ya369p41n5yprrcjv";

pkgs/games/minecraft-server/default.nix

@@ -1,57 +1,34 @@
 { stdenv, fetchurl, jre }:
+stdenv.mkDerivation rec {
+  name = "minecraft-server-${version}";
+  version = "1.14.3";
 
-let
-  common = { version, sha256, url }:
-    stdenv.mkDerivation (rec {
-      name = "minecraft-server-${version}";
-      inherit version;
-
-      src = fetchurl {
-        inherit url sha256;
-      };
-
-      preferLocalBuild = true;
-
-      installPhase = ''
-        mkdir -p $out/bin $out/lib/minecraft
-        cp -v $src $out/lib/minecraft/server.jar
-
-        cat > $out/bin/minecraft-server << EOF
-        #!/bin/sh
-        exec ${jre}/bin/java \$@ -jar $out/lib/minecraft/server.jar nogui
-        EOF
-
-        chmod +x $out/bin/minecraft-server
-      '';
-
-      phases = "installPhase";
-
-      meta = {
-        description = "Minecraft Server";
-        homepage    = "https://minecraft.net";
-        license     = stdenv.lib.licenses.unfreeRedistributable;
-        platforms   = stdenv.lib.platforms.unix;
-        maintainers = with stdenv.lib.maintainers; [ thoughtpolice tomberek costrouc];
-      };
-    });
-
-in {
-  minecraft-server_1_14 = common {
-    version = "1.14";
-    url    = "https://launcher.mojang.com/v1/objects/f1a0073671057f01aa843443fef34330281333ce/server.jar";
-    sha256 = "671e3d334dd601c520bf1aeb96e49038145172bef16bc6c418e969fd8bf8ff6c";
+  src = fetchurl {
+    url    = "https://launcher.mojang.com/v1/objects/d0d0fe2b1dc6ab4c65554cb734270872b72dadd6/server.jar";
+    sha256 = "0f0v0kqz2v5758551yji1vj6xf43lvbma30v3crz4h7cpzq5c8ll";
   };
 
-  minecraft-server_1_13_2 = common {
-    version = "1.13.2";
-    url    = "https://launcher.mojang.com/v1/objects/3737db93722a9e39eeada7c27e7aca28b144ffa7/server.jar";
-    sha256 = "13h8dxrrgqa1g6sd7aaw26779hcsqsyjm7xm0sknifn54lnamlzz";
-  };
+  preferLocalBuild = true;
 
-  minecraft-server_1_12_2 = common {
-    version = "1.12.2";
-    url = "https://s3.amazonaws.com/Minecraft.Download/versions/1.12.2/minecraft_server.1.12.2.jar";
-    sha256 = "0zhnac6yvkdgdaag0gb0fgrkgizbwrpf7s76yqdiknfswrs947zy";
-  };
+  installPhase = ''
+    mkdir -p $out/bin $out/lib/minecraft
+    cp -v $src $out/lib/minecraft/server.jar
 
+    cat > $out/bin/minecraft-server << EOF
+    #!/bin/sh
+    exec ${jre}/bin/java \$@ -jar $out/lib/minecraft/server.jar nogui
+    EOF
+
+    chmod +x $out/bin/minecraft-server
+  '';
+
+  phases = "installPhase";
+
+  meta = {
+    description = "Minecraft Server";
+    homepage    = "https://minecraft.net";
+    license     = stdenv.lib.licenses.unfreeRedistributable;
+    platforms   = stdenv.lib.platforms.unix;
+    maintainers = with stdenv.lib.maintainers; [ thoughtpolice tomberek costrouc];
+  };
 }

pkgs/misc/screensavers/betterlockscreen/default.nix

@@ -1,6 +1,6 @@
 {
   stdenv, makeWrapper, fetchFromGitHub,
-  imagemagick, i3lock-color, xdpyinfo, xrandr, bc, feh
+  imagemagick, i3lock-color, xdpyinfo, xrandr, bc, feh, procps, xrdb
 }:
 
 stdenv.mkDerivation rec {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     let
       PATH =
         stdenv.lib.makeBinPath
-        [imagemagick i3lock-color xdpyinfo xrandr bc feh];
+        [imagemagick i3lock-color xdpyinfo xrandr bc feh procps xrdb];
     in ''
       mkdir -p $out/bin
       cp betterlockscreen $out/bin/betterlockscreen

pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch

@@ -1,36 +1,8 @@
-From 44887227f7f617cbf84713ec45685cb4999039ff Mon Sep 17 00:00:00 2001
-From: Jan Tojnar <jtojnar@gmail.com>
-Date: Tue, 30 Oct 2018 22:26:30 +0100
-Subject: [PATCH] build: Add option for installation sysconfdir
-
-On NixOS, sysconfdir is read-only by default, and packages are not supposed to
-install files there. Instead, NixOS has a concept of modules that declaratively
-describe the system configuration.
-
-We still want to install the config files and certificates to fwupd prefix,
-so that the modules can use them as they see fit, but at the same time, we
-cannot set sysconfdir=${prefix}/etc because the daemon needs to read the
-configuration from the directory created by the module.
-
-With autotools, we could easily solve this by passing a the sysconfdir inside
-prefix only to `make install`, but Meson does not support anything like that.
-Until we manage to convince Meson to support install flags, we need to create
-our own install flag.
----
- data/meson.build                 | 4 ++--
- data/pki/meson.build             | 8 ++++----
- data/remotes.d/meson.build       | 6 +++---
- meson.build                      | 6 ++++++
- meson_options.txt                | 1 +
- plugins/redfish/meson.build      | 2 +-
- plugins/uefi/meson.build         | 2 +-
- 7 files changed, 18 insertions(+), 11 deletions(-)
-
 diff --git a/data/meson.build b/data/meson.build
-index 8dd2ac9a..d4ad1cbc 100644
+index 61664cd6..f10abbba 100644
 --- a/data/meson.build
 +++ b/data/meson.build
-@@ -9,7 +9,7 @@ if get_option('tests') and get_option('daemon')
+@@ -11,7 +11,7 @@ if get_option('daemon')
  endif
  
  install_data(['daemon.conf'],
@@ -39,7 +11,7 @@ index 8dd2ac9a..d4ad1cbc 100644
  )
  
  install_data(['org.freedesktop.fwupd.metainfo.xml'],
-@@ -17,7 +17,7 @@ install_data(['org.freedesktop.fwupd.metainfo.xml'],
+@@ -23,7 +23,7 @@ install_data(['org.freedesktop.fwupd.svg'],
  )
  
  install_data(['org.freedesktop.fwupd.conf'],
@@ -47,7 +19,7 @@ index 8dd2ac9a..d4ad1cbc 100644
 +  install_dir : join_paths(sysconfdir_install, 'dbus-1', 'system.d')
  )
  
- install_data(['metadata.xml'],
+ if get_option('daemon')
 diff --git a/data/pki/meson.build b/data/pki/meson.build
 index eefcc914..dc801fa1 100644
 --- a/data/pki/meson.build
@@ -85,7 +57,7 @@ index eefcc914..dc801fa1 100644
  endif
  
 diff --git a/data/remotes.d/meson.build b/data/remotes.d/meson.build
-index 824291fc..d0599a00 100644
+index a27c31ef..374e09b6 100644
 --- a/data/remotes.d/meson.build
 +++ b/data/remotes.d/meson.build
 @@ -3,7 +3,7 @@ if get_option('daemon') and get_option('lvfs')
@@ -98,22 +70,22 @@ index 824291fc..d0599a00 100644
    i18n.merge_file(
      input: 'lvfs.metainfo.xml',
 @@ -37,12 +37,12 @@ configure_file(
-   output : 'fwupd.conf',
-   configuration : con2,
-   install: true,
--  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
-+  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
- )
- configure_file(
-   input : 'vendor.conf',
    output : 'vendor.conf',
    configuration : con2,
    install: true,
 -  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
++  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
+ )
+ configure_file(
+   input : 'vendor-directory.conf',
+   output : 'vendor-directory.conf',
+   configuration : con2,
+   install: true,
+-  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
  )
 diff --git a/meson.build b/meson.build
-index b6df98b3..d672ee37 100644
+index a89f9b3f..736896eb 100644
 --- a/meson.build
 +++ b/meson.build
 @@ -145,6 +145,12 @@ localstatedir = join_paths(prefix, get_option('localstatedir'))
@@ -130,22 +102,33 @@ index b6df98b3..d672ee37 100644
  if gio.version().version_compare ('>= 2.55.0')
    conf.set('HAVE_GIO_2_55_0', '1')
 diff --git a/meson_options.txt b/meson_options.txt
-index 23ef8cdb..db8f93b6 100644
+index 5d4163e8..db81fd1f 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -17,6 +17,7 @@ option('plugin_uefi', type : 'boolean', value : true, description : 'enable UEFI
- option('plugin_nvme', type : 'boolean', value : true, description : 'enable NVMe support')
+@@ -21,6 +21,7 @@ option('plugin_modem_manager', type : 'boolean', value : false, description : 'e
  option('systemd', type : 'boolean', value : true, description : 'enable systemd support')
  option('systemdunitdir', type: 'string', value: '', description: 'Directory for systemd units')
+ option('elogind', type : 'boolean', value : false, description : 'enable elogind support')
 +option('sysconfdir_install', type: 'string', value: '', description: 'sysconfdir to use during installation')
  option('tests', type : 'boolean', value : true, description : 'enable tests')
  option('udevdir', type: 'string', value: '', description: 'Directory for udev rules')
  option('efi-cc', type : 'string', value : 'gcc', description : 'the compiler to use for EFI modules')
+diff --git a/plugins/dell-esrt/meson.build b/plugins/dell-esrt/meson.build
+index cb9f4555..b972d7fb 100644
+--- a/plugins/dell-esrt/meson.build
++++ b/plugins/dell-esrt/meson.build
+@@ -36,5 +36,5 @@ configure_file(
+   output : 'dell-esrt.conf',
+   configuration : con2,
+   install: true,
+-  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
++  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
+ )
 diff --git a/plugins/redfish/meson.build b/plugins/redfish/meson.build
-index ef07bd81..d2c7e259 100644
+index 5c88504e..7706da71 100644
 --- a/plugins/redfish/meson.build
 +++ b/plugins/redfish/meson.build
-@@ -25,7 +25,7 @@ shared_module('fu_plugin_redfish',
+@@ -26,7 +26,7 @@ shared_module('fu_plugin_redfish',
  )
  
  install_data(['redfish.conf'],
@@ -155,10 +138,10 @@ index ef07bd81..d2c7e259 100644
  
  if get_option('tests')
 diff --git a/plugins/uefi/meson.build b/plugins/uefi/meson.build
-index 09ebdf82..02fc0661 100644
+index ac9f5dd8..1ab51b5e 100644
 --- a/plugins/uefi/meson.build
 +++ b/plugins/uefi/meson.build
-@@ -73,7 +73,7 @@ executable(
+@@ -79,7 +79,7 @@ executable(
  )
  
  install_data(['uefi.conf'],
@@ -167,5 +150,3 @@ index 09ebdf82..02fc0661 100644
  )
  
  if get_option('tests')
--- 
-2.19.1

pkgs/os-specific/linux/firmware/fwupd/default.nix

@@ -1,10 +1,11 @@
 { stdenv, fetchurl, substituteAll, gtk-doc, pkgconfig, gobject-introspection, intltool
 , libgudev, polkit, libxmlb, gusb, sqlite, libarchive, glib-networking
-, libsoup, help2man, gpgme, libxslt, elfutils, libsmbios, efivar, glibcLocales
-, gnu-efi, libyaml, valgrind, meson, libuuid, colord, docbook_xml_dtd_43, docbook_xsl
+, libsoup, help2man, gpgme, libxslt, elfutils, libsmbios, efivar, gnu-efi
+, libyaml, valgrind, meson, libuuid, colord, docbook_xml_dtd_43, docbook_xsl
 , ninja, gcab, gnutls, python3, wrapGAppsHook, json-glib, bash-completion
 , shared-mime-info, umockdev, vala, makeFontsConf, freefont_ttf
 , cairo, freetype, fontconfig, pango
+, bubblewrap, efibootmgr, flashrom, tpm2-tools
 }:
 
 # Updating? Keep $out/etc synchronized with passthru.filesInstalledToEtc
@@ -18,17 +19,17 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "fwupd";
-  version = "1.2.3";
+  version = "1.2.8";
 
   src = fetchurl {
     url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-    sha256 = "11qpgincndahq96rbm2kgcy9kw5n9cmbbilsrqcqcyk7mvv464sl";
+    sha256 = "0qbvq52c0scn1h99i1rf2la6rrhckin6gb02k7l0v3g07mxs20wc";
   };
 
   outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
 
   nativeBuildInputs = [
-    meson ninja gtk-doc pkgconfig gobject-introspection intltool glibcLocales shared-mime-info
+    meson ninja gtk-doc pkgconfig gobject-introspection intltool shared-mime-info
     valgrind gcab docbook_xml_dtd_43 docbook_xsl help2man libxslt python wrapGAppsHook vala
   ];
   buildInputs = [
@@ -37,10 +38,13 @@ in stdenv.mkDerivation rec {
     bash-completion cairo freetype fontconfig pango
   ];
 
-  LC_ALL = "en_US.UTF-8"; # For po/make-images
-
   patches = [
-    ./fix-paths.patch
+    (substituteAll {
+      src = ./fix-paths.patch;
+      inherit flashrom efibootmgr bubblewrap;
+      tpm2_tools = "${tpm2-tools}";
+    })
+
     ./add-option-for-installation-sysconfdir.patch
 
     # installed tests are installed to different output
@@ -63,6 +67,10 @@ in stdenv.mkDerivation rec {
     substituteInPlace meson.build \
       --replace "plugin_dir = join_paths(libdir, 'fwupd-plugins-3')" \
                 "plugin_dir = join_paths('${placeholder "out"}', 'fwupd_plugins-3')"
+
+    substituteInPlace data/meson.build --replace \
+      "install_dir: systemd.get_pkgconfig_variable('systemdshutdowndir')" \
+      "install_dir: '${placeholder "out"}/lib/systemd/system-shutdown'"
   '';
 
   # /etc/os-release not available in sandbox
@@ -114,10 +122,11 @@ in stdenv.mkDerivation rec {
   # /etc/fwupd/uefi.conf is created by the services.hardware.fwupd NixOS module
   passthru = {
     filesInstalledToEtc = [
-      "fwupd/remotes.d/fwupd.conf"
+      "fwupd/remotes.d/dell-esrt.conf"
       "fwupd/remotes.d/lvfs-testing.conf"
       "fwupd/remotes.d/lvfs.conf"
       "fwupd/remotes.d/vendor.conf"
+      "fwupd/remotes.d/vendor-directory.conf"
       "pki/fwupd/GPG-KEY-Hughski-Limited"
       "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
       "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"

pkgs/os-specific/linux/firmware/fwupd/fix-paths.patch

@@ -1,15 +1,71 @@
+diff --git a/data/builder/meson.build b/data/builder/meson.build
+index c7a430c0..e69de29b 100644
 --- a/data/builder/meson.build
 +++ b/data/builder/meson.build
 @@ -1,3 +0,0 @@
 -install_data('README.md',
 -  install_dir : join_paths(localstatedir, 'lib', 'fwupd', 'builder')
 -)
+diff --git a/meson_post_install.sh b/meson_post_install.sh
+index 0cbb6f41..d757a81a 100755
 --- a/meson_post_install.sh
 +++ b/meson_post_install.sh
-@@ -11,6 +11,4 @@
+@@ -11,6 +11,4 @@ LOCALSTATEDIR=$2
      echo 'Updating systemd deps'
      mkdir -p ${DESTDIR}${SYSTEMDUNITDIR}/system-update.target.wants
      ln -sf ../fwupd-offline-update.service ${DESTDIR}${SYSTEMDUNITDIR}/system-update.target.wants/fwupd-offline-update.service
 -    echo 'Creating stateful directory'
 -    mkdir -p ${DESTDIR}${LOCALSTATEDIR}/lib/fwupd
  #fi
+diff --git a/plugins/flashrom/fu-plugin-flashrom.c b/plugins/flashrom/fu-plugin-flashrom.c
+index 598e0c42..a0a2c4a7 100644
+--- a/plugins/flashrom/fu-plugin-flashrom.c
++++ b/plugins/flashrom/fu-plugin-flashrom.c
+@@ -52,7 +52,7 @@ fu_plugin_startup (FuPlugin *plugin, GError **error)
+ 	g_autoptr(GError) error_local = NULL;
+
+ 	/* we need flashrom from the host system */
+-	data->flashrom_fn = fu_common_find_program_in_path ("flashrom", &error_local);
++	data->flashrom_fn = fu_common_find_program_in_path ("@flashrom@/bin/flashrom", &error_local);
+
+ 	/* search for devices */
+ 	hwids = fu_plugin_get_hwids (plugin);
+diff --git a/plugins/uefi/fu-plugin-uefi.c b/plugins/uefi/fu-plugin-uefi.c
+index 9293715c..e2e77c58 100644
+--- a/plugins/uefi/fu-plugin-uefi.c
++++ b/plugins/uefi/fu-plugin-uefi.c
+@@ -416,7 +416,7 @@ fu_plugin_update (FuPlugin *plugin,
+ 	fu_plugin_add_report_metadata (plugin, "MissingCapsuleHeader", str);
+
+ 	/* record boot information to system log for future debugging */
+-	efibootmgr_path = fu_common_find_program_in_path ("efibootmgr", NULL);
++	efibootmgr_path = fu_common_find_program_in_path ("@efibootmgr@/bin/efibootmgr", NULL);
+ 	if (efibootmgr_path != NULL) {
+ 		if (!g_spawn_command_line_sync ("efibootmgr -v",
+ 						&boot_variables, NULL, NULL, error))
+diff --git a/plugins/uefi/fu-uefi-pcrs.c b/plugins/uefi/fu-uefi-pcrs.c
+index 5c7e5239..01acbf7f 100644
+--- a/plugins/uefi/fu-uefi-pcrs.c
++++ b/plugins/uefi/fu-uefi-pcrs.c
+@@ -147,7 +147,7 @@ fu_uefi_pcrs_setup (FuUefiPcrs *self, GError **error)
+ 		/* old name, then new name */
+ 		argv0 = fu_common_find_program_in_path ("tpm2_listpcrs", NULL);
+ 		if (argv0 == NULL)
+-			argv0 = fu_common_find_program_in_path ("tpm2_pcrlist", error);
++			argv0 = fu_common_find_program_in_path ("@tpm2_tools@/bin/tpm2_pcrlist", error);
+ 		if (argv0 == NULL)
+ 			return FALSE;
+ 		if (!fu_uefi_pcrs_setup_tpm20 (self, argv0, error))
+diff --git a/src/fu-common.c b/src/fu-common.c
+index bd6faeef..45ba2a60 100644
+--- a/src/fu-common.c
++++ b/src/fu-common.c
+@@ -436,7 +436,7 @@ fu_common_firmware_builder (GBytes *bytes,
+ 	g_return_val_if_fail (error == NULL || *error == NULL, NULL);
+
+ 	/* find bwrap in the path */
+-	bwrap_fn = fu_common_find_program_in_path ("bwrap", error);
++	bwrap_fn = fu_common_find_program_in_path ("@bubblewrap@/bin/bwrap", error);
+ 	if (bwrap_fn == NULL)
+ 		return NULL;
+

pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix

@@ -1,13 +1,13 @@
 { stdenv, buildPackages, fetchgit, fetchpatch, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "5.0.2019.05.29";
-  modDirVersion = "5.0.0";
+  version = "5.1.2019.07.11";
+  modDirVersion = "5.1.0";
 
   src = fetchgit {
     url = "https://evilpiepirate.org/git/bcachefs.git";
-    rev = "7e42539c80470cb655bbc46cd0f144de6c644523";
-    sha256 = "0f7z3awfzdg56rby6z8dh9v9bzyyfn53zgwxmk367mfi0wqk49d2";
+    rev = "44dc1f269553f33cce43628444970efb85a7e802";
+    sha256 = "1i32s15r0a844dnp3h9ac37xm9h69g0jn75pqz2gbfrafpk3pac1";
   };
 
   extraConfig = "BCACHEFS_FS m";

pkgs/os-specific/linux/nvidia-x11/default.nix

@@ -22,10 +22,10 @@ rec {
   beta = stable;
 
   stable_430 = generic {
-    version = "430.26";
-    sha256_64bit = "1rnfxl4dxa3jjidfdvfjmg1a8nc787ss15cakrp2wwrn8jlr9av6";
-    settingsSha256 = "0rjsj697s9jfls7iz1hs7aqp36ihf3l82yz1x1w9wdvlw94a3nym";
-    persistencedSha256 = "1n554i4g37hs49bb631x692ygfncn7a5hzb6mh9kx7hmv69yzazh";
+    version = "430.34";
+    sha256_64bit = "0c3x25gilibbgazvp20d5sfmmgcf0gfqf024nzzqryxg4m05h39b";
+    settingsSha256 = "1xpf9gbpq5xynxm6f401ab09aa243h1sk2vcxvzjwqgcil36zzad";
+    persistencedSha256 = "00dd0m87nwqfv9i23bvbqgcz10x9mvfxg9249nvhp4y3ha65rms6";
   };
 
   # Last one supporting x86

pkgs/os-specific/linux/nvidia-x11/settings.nix

@@ -72,6 +72,17 @@ stdenv.mkDerivation rec {
     ${lib.optionalString (!withGtk3) ''
       rm -f $out/lib/libnvidia-gtk3.so.*
     ''}
+
+    # Install the desktop file and icon.
+    # The template has substitution variables intended to be replaced resulting
+    # in absolute paths. Because absolute paths break after the desktop file is
+    # copied by a desktop environment, make Exec and Icon be just a name.
+    sed -i doc/nvidia-settings.desktop \
+      -e "s|^Exec=.*$|Exec=nvidia-settings|" \
+      -e "s|^Icon=.*$|Icon=nvidia-settings|" \
+      -e "s|__NVIDIA_SETTINGS_DESKTOP_CATEGORIES__|Settings|g"
+    install doc/nvidia-settings.desktop -D -t $out/share/applications/
+    install doc/nvidia-settings.png -D -t $out/share/icons/hicolor/128x128/apps/
   '';
 
   binaryName = if withGtk3 then ".nvidia-settings-wrapped" else "nvidia-settings";

pkgs/servers/dns/knot-resolver/default.nix

@@ -1,76 +1,77 @@
-{ stdenv, fetchurl, fetchpatch, runCommand, pkgconfig, hexdump, which
-, knot-dns, luajit, libuv, lmdb, gnutls, nettle
-, cmocka, systemd, dns-root-data, makeWrapper
+{ stdenv, fetchurl
+# native deps.
+, runCommand, pkgconfig, meson, ninja, makeWrapper
+# build+runtime deps.
+, knot-dns, luajitPackages, libuv, gnutls, lmdb, systemd, dns-root-data
+# test-only deps.
+, cmocka, which, cacert
 , extraFeatures ? false /* catch-all if defaults aren't enough */
-, luajitPackages
 }:
 let # un-indented, over the whole file
 
 result = if extraFeatures then wrapped-full else unwrapped;
 
-inherit (stdenv.lib) optional;
+inherit (stdenv.lib) optional optionals concatStringsSep;
+lua = luajitPackages;
+
+# FIXME: remove these usages once resolving
+# https://github.com/NixOS/nixpkgs/pull/63108#issuecomment-508670438
+exportLuaPathsFor = luaPkgs: ''
+  export LUA_PATH='${ concatStringsSep ";" (map lua.getLuaPath  luaPkgs)}'
+  export LUA_CPATH='${concatStringsSep ";" (map lua.getLuaCPath luaPkgs)}'
+'';
 
 unwrapped = stdenv.mkDerivation rec {
   name = "knot-resolver-${version}";
-  version = "3.2.1";
+  version = "4.1.0";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-resolver/${name}.tar.xz";
-    sha256 = "d1396888ec3a63f19dccdf2b7dbcb0d16a5d8642766824b47f4c21be90ce362b";
+    sha256 = "2fe470f9bb1007667cdd448f758087244b7195a0234c2b100a9beeed0a2d3e68";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "support-libzscanner-2.8.diff";
-      url = "https://gitlab.labs.nic.cz/knot/knot-resolver/commit/186f263.diff";
-      sha256 = "19zqigvc7m2a4j6bk9whx7gj0v009568rz5qwk052z7pzfikr8mk";
-    })
-  ];
-
-  # Short-lived cross fix, as upstream is migrating to meson anyway.
-  postPatch = ''
-    substituteInPlace platform.mk --replace "objdump" "$OBJDUMP"
-  '';
-
   outputs = [ "out" "dev" ];
 
-  configurePhase = "patchShebangs scripts/";
+  preConfigure = ''
+    patchShebangs scripts/
+  ''
+    + stdenv.lib.optionalString doInstallCheck (exportLuaPathsFor [ lua.cqueues lua.basexx ]);
 
-  nativeBuildInputs = [ pkgconfig which hexdump ];
+  nativeBuildInputs = [ pkgconfig meson ninja ];
 
   # http://knot-resolver.readthedocs.io/en/latest/build.html#requirements
-  buildInputs = [ knot-dns luajit libuv gnutls nettle lmdb ]
-    ++ optional stdenv.isLinux systemd # sd_notify
+  buildInputs = [ knot-dns lua.lua libuv gnutls lmdb ]
+    ++ optional stdenv.isLinux systemd # passing sockets, sd_notify
     ## optional dependencies; TODO: libedit, dnstap
     ;
 
-  checkInputs = [ cmocka ];
-
-  makeFlags = [
-    "PREFIX=$(out)"
-    "ROOTHINTS=${dns-root-data}/root.hints"
-    "KEYFILE_DEFAULT=${dns-root-data}/root.ds"
-  ];
-  CFLAGS = [ "-O2" "-DNDEBUG" ];
-
-  enableParallelBuilding = true;
-
-  doCheck = true;
-  doInstallCheck = false; # FIXME
-  preInstallCheck = ''
-    patchShebangs tests/config/runtest.sh
-  '';
+  mesonFlags = [
+    "-Dkeyfile_default=${dns-root-data}/root.ds"
+    "-Droot_hints=${dns-root-data}/root.hints"
+    "-Dinstall_kresd_conf=disabled" # not really useful; examples are inside share/doc/
+    "--default-library=static" # not used by anyone
+  ]
+  ++ optional doInstallCheck "-Dunit_tests=enabled"
+  ++ optional (doInstallCheck && !stdenv.isDarwin) "-Dconfig_tests=enabled"
+    #"-Dextra_tests=enabled" # not suitable as in-distro tests; many deps, too.
+  ;
 
   postInstall = ''
-    rm "$out"/etc/knot-resolver/root.hints # using system-wide instead
+    rm "$out"/lib/libkres.a
+  '';
+
+  # aarch64: see https://github.com/wahern/cqueues/issues/223
+  doInstallCheck = with stdenv; hostPlatform == buildPlatform && !hostPlatform.isAarch64;
+  installCheckInputs = [ cmocka which cacert ];
+  installCheckPhase = ''
+    meson test --print-errorlogs
   '';
 
   meta = with stdenv.lib; {
     description = "Caching validating DNS resolver, from .cz domain registry";
     homepage = https://knot-resolver.cz;
     license = licenses.gpl3Plus;
-    # Platforms using negative pointers for stack won't work ATM due to LuaJIT impl.
-    platforms = filter (p: p != "aarch64-linux") platforms.unix;
+    platforms = platforms.unix;
     maintainers = [ maintainers.vcunat /* upstream developer */ ];
   };
 };
@@ -93,11 +94,12 @@ wrapped-full =
     preferLocalBuild = true;
     allowSubstitutes = false;
   }
-  ''
+  (exportLuaPathsFor luaPkgs
+  + ''
     mkdir -p "$out"/{bin,share}
     makeWrapper '${unwrapped}/bin/kresd' "$out"/bin/kresd \
-      --set LUA_PATH  '${concatStringsSep ";" (map getLuaPath  luaPkgs)}' \
-      --set LUA_CPATH '${concatStringsSep ";" (map getLuaCPath luaPkgs)}'
+      --set LUA_PATH  "$LUA_PATH" \
+      --set LUA_CPATH "$LUA_CPATH"
 
     ln -sr '${unwrapped}/share/man' "$out"/share/
     ln -sr "$out"/{bin,sbin}
@@ -105,6 +107,6 @@ wrapped-full =
     echo "Checking that 'http' module loads, i.e. lua search paths work:"
     echo "modules.load('http')" > test-http.lua
     echo -e 'quit()' | env -i "$out"/bin/kresd -a 127.0.0.1#53535 -c test-http.lua
-  '';
+  '');
 
 in result

pkgs/servers/foswiki/default.nix

@@ -1,44 +0,0 @@
-{ stdenv, fetchurl, perlPackages }:
-
-perlPackages.buildPerlPackage rec {
-  pname = "foswiki";
-  version = "2.1.0";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/foswiki/${version}/Foswiki-${version}.tgz";
-    sha256 = "03286pb966h99zgickm2f20rgnqwp9wga5wfkdvirv084kjdh8vp";
-  };
-
-  outputs = [ "out" ];
-
-  buildInputs = with perlPackages; [
-    # minimum requirements from INSTALL.html#System_Requirements
-    AlgorithmDiff ArchiveTar AuthenSASL CGI CGISession CryptPasswdMD5
-    EmailMIME Encode Error FileCopyRecursive HTMLParser HTMLTree
-    IOSocketSSL JSON
-    LocaleMaketextLexicon LocaleMsgfmt
-    LWP URI perlPackages.Version
-    /*# optional dependencies
-    libapreq2 DBI DBDmysql DBDPg DBDSQLite FCGI FCGIProcManager
-    CryptSMIME CryptX509 ConvertPEM
-    */
-  ];
-
-  preConfigure = ''
-    touch Makefile.PL
-    patchShebangs .
-  '';
-  configureScript = "bin/configure";
-
-  # there's even no makefile
-  doCheck = false;
-  installPhase = ''cp -r . "$out" '';
-
-  meta = with stdenv.lib; {
-    description = "An open, programmable collaboration platform";
-    homepage = http://foswiki.org;
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-  };
-}
-

pkgs/servers/mautrix-whatsapp/default.nix

@@ -2,15 +2,15 @@
 
 buildGoPackage rec {
   name = "mautrix-unstable-${version}";
-  version = "2019-02-24";
+  version = "2019-07-04";
 
   goPackagePath = "maunium.net/go/mautrix-whatsapp";
 
   src = fetchFromGitHub {
     owner = "tulir";
     repo = "mautrix-whatsapp";
-    rev = "485acf6de654b8fb70007876c074fb004eb9717b";
-    sha256 = "1v7h3s8h0aiq6g06h9j1sidw8y5aiw24sgdh9knr1c90pvvc7pmv";
+    rev = "29f5ae45c4b22f463003b23e355b951831f08b3e";
+    sha256 = "12209m3x01i7bnnkg57ag1ivsk6n6pqaqfin7y02irgi3i3rm31r";
   };
 
   goDeps = ./deps.nix;

pkgs/servers/mautrix-whatsapp/deps.nix

@@ -1,21 +1,22 @@
+# NOTE: this file isn't entirely generated, while performing the bump
+# from 2019-02-24 to 2019-06-01, a lot of stuff broke during `vgo2nix` as the
+# tool is unable to parse `replace` statements atm.
+#
+# The following sources were altered manually:
+# * github.com/Rhymen/go-whatsapp -> github.com/tulir/go-whatsapp (at 36ed380bdc18)
+# * github.com/golang/protobuf: v1.2.0 -> v1.3.1
+# * maunium.net/go/mautrix: v0.1.0-alpha3 -> ca5d9535b6cc
+# * maunium.net/go/mautrix-appservice: v0.1.0-alpha3 -> 6e6c9bb47548
+
 # file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
 [
-  {
-    goPackagePath = "github.com/Baozisoftware/qrcode-terminal-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Baozisoftware/qrcode-terminal-go";
-      rev = "c0650d8dff0f";
-      sha256 = "166h9zy9y7ygayhybg7d080hpdcf1mvkf3rwnq5lqg8i3cg71s7b";
-    };
-  }
   {
     goPackagePath = "github.com/Rhymen/go-whatsapp";
     fetch = {
       type = "git";
-      url = "https://github.com/Rhymen/go-whatsapp";
-      rev = "c1173899de99";
-      sha256 = "1f46zpbfgv3k38lgdrcwqf4cm34dgqxlfs9qzg380in61460lcri";
+      url = "https://github.com/tulir/go-whatsapp";
+      rev = "36ed380bdc188e35fe804d6dd4809ee170136670";
+      sha256 = "1ida4j5hgqc5djwfsaqp8g6iynn150rwj42kqk9q2srwz5075n4p";
     };
   }
   {
@@ -32,8 +33,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/golang/protobuf";
-      rev = "v1.2.0";
-      sha256 = "0kf4b59rcbb1cchfny2dm9jyznp8ri2hsb14n8iak1q8986xa0ab";
+      rev = "v1.3.1";
+      sha256 = "15am4s4646qy6iv0g3kkqq52rzykqjhm4bf08dk0fy2r58knpsyl";
     };
   }
   {
@@ -41,8 +42,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/gorilla/mux";
-      rev = "v1.7.0";
-      sha256 = "09cn5v1gxrrrydzyllp1asbhgm5xsawb92as7cg9jqg6iyqajvlc";
+      rev = "v1.6.2";
+      sha256 = "0pvzm23hklxysspnz52mih6h1q74vfrdhjfm1l3sa9r8hhqmmld2";
     };
   }
   {
@@ -54,13 +55,22 @@
       sha256 = "00i4vb31nsfkzzk7swvx3i75r2d960js3dri1875vypk3v2s0pzk";
     };
   }
+  {
+    goPackagePath = "github.com/lib/pq";
+    fetch = {
+      type = "git";
+      url = "https://github.com/lib/pq";
+      rev = "v1.1.1";
+      sha256 = "0g64wlg1l1ybq4x44idksl4pgm055s58jxc6r6x4qhqm5q76h0km";
+    };
+  }
   {
     goPackagePath = "github.com/mattn/go-colorable";
     fetch = {
       type = "git";
       url = "https://github.com/mattn/go-colorable";
-      rev = "v0.1.1";
-      sha256 = "0l640974j804c1yyjfgyxqlsivz0yrzmbql4mhcw2azryigkp08p";
+      rev = "v0.0.9";
+      sha256 = "1nwjmsppsjicr7anq8na6md7b1z84l9ppnlr045hhxjvbkqwalvx";
     };
   }
   {
@@ -68,8 +78,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/mattn/go-isatty";
-      rev = "v0.0.5";
-      sha256 = "114d5xm8rfxplzd7nxz97gfngb4bhqy102szl084d1afcxsvm4aa";
+      rev = "v0.0.4";
+      sha256 = "0zs92j2cqaw9j8qx1sdxpv3ap0rgbs0vrvi72m40mg8aa36gd39w";
     };
   }
   {
@@ -82,7 +92,16 @@
     };
   }
   {
-    goPackagePath = "github.com/russross/blackfriday";
+    goPackagePath = "github.com/pkg/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pkg/errors";
+      rev = "v0.8.1";
+      sha256 = "0g5qcb4d4fd96midz0zdk8b9kz8xkzwfa8kr1cliqbg8sxsy5vd1";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/russross/blackfriday.v2";
     fetch = {
       type = "git";
       url = "https://github.com/russross/blackfriday";
@@ -113,8 +132,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/crypto";
-      rev = "ffb98f73852f";
-      sha256 = "0hil543q2zq8wxsz6ljrfnrhhxg5j0mrjfwskf2x6q0ppqizsa4h";
+      rev = "b8fe1690c613";
+      sha256 = "1mbfpbrirsz8fsdkibm9l4sccpm774p9201mpmfh4hxshz3girq3";
     };
   }
   {
@@ -135,15 +154,6 @@
       sha256 = "1bb0mw6ckb1k7z8v3iil2qlqwfj408fvvp8m1cik2b46p7snyjhm";
     };
   }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "cd391775e71e";
-      sha256 = "12wk5ylx0jjajipr68yn50wcd0c9shzhq9y4an40ldnv4bsdp2rj";
-    };
-  }
   {
     goPackagePath = "gopkg.in/check.v1";
     fetch = {
@@ -185,8 +195,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/tulir/mautrix-go.git";
-      rev = "v0.1.0-alpha.3";
-      sha256 = "12nlyij57ss2a5d1f1k1vsmjjvxp1fannlrbnp2jsj6rrsq0d2wr";
+      rev = "ca5d9535b6ccee8fdf473f9cc935932ef3e53ae7";
+      sha256 = "1qrh77c8vh2k6ffwf0cymjmhcp7d0rdad1ixqx5r1xig27f7v0qg";
     };
   }
   {
@@ -194,8 +204,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/tulir/mautrix-appservice-go.git";
-      rev = "v0.1.0-alpha.3";
-      sha256 = "17y11wgqbrafbq6bnn4rp2lzd50fjz9d6f8j3382jsara7ps95vr";
+      rev = "6e6c9bb4754849443cb3c64d9510f8d2eb3e668d";
+      sha256 = "1zwsfvgxs2zbc6yvgnk16w2wkh891kihrzar3qzz9cvsgjznlyvy";
     };
   }
 ]

pkgs/servers/monitoring/zabbix/2.0.nix

@@ -1,92 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, postgresql, curl, openssl, zlib
-, enableJabber ? false, minmay ? null }:
-
-assert enableJabber -> minmay != null;
-
-let
-
-  version = "2.0.21";
-  branch = "2.0";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/zabbix/zabbix-${version}.tar.gz";
-    sha256 = "14g22x2zy5xqnh2xg23xy5gjd49d1i8pks7pkidwdwa9acwgfx71";
-  };
-
-  preConfigure =
-    ''
-      substituteInPlace ./configure \
-        --replace " -static" "" \
-        ${stdenv.lib.optionalString (stdenv.cc.libc != null) ''
-          --replace /usr/include/iconv.h ${stdenv.lib.getDev stdenv.cc.libc}/include/iconv.h
-        ''}
-    '';
-
-in
-
-{
-  recurseForDerivations = true;
-
-  server = stdenv.mkDerivation {
-    name = "zabbix-${version}";
-
-    inherit src preConfigure;
-
-    configureFlags = [
-      "--enable-agent"
-      "--enable-server"
-      "--with-postgresql"
-      "--with-libcurl"
-      "--with-gettext"
-    ] ++ stdenv.lib.optional enableJabber "--with-jabber=${minmay}";
-
-    postPatch = ''
-      sed -i -e 's/iksemel/minmay/g' configure src/libs/zbxmedia/jabber.c
-      sed -i \
-        -e '/^static ikstransport/,/}/d' \
-        -e 's/iks_connect_with\(.*\), &zbx_iks_transport/mmay_connect_via\1/' \
-        -e 's/iks/mmay/g' -e 's/IKS/MMAY/g' src/libs/zbxmedia/jabber.c
-    '';
-
-  nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ postgresql curl openssl zlib ];
-
-    postInstall =
-      ''
-        mkdir -p $out/share/zabbix
-        cp -prvd frontends/php $out/share/zabbix/php
-        mkdir -p $out/share/zabbix/db/data
-        cp -prvd database/postgresql/data.sql $out/share/zabbix/db/data/data.sql
-        cp -prvd database/postgresql/images.sql $out/share/zabbix/db/data/images_pgsql.sql
-        mkdir -p $out/share/zabbix/db/schema
-        cp -prvd database/postgresql/schema.sql $out/share/zabbix/db/schema/postgresql.sql
-      '';
-
-    meta = {
-      inherit branch;
-      description = "An enterprise-class open source distributed monitoring solution";
-      homepage = https://www.zabbix.com/;
-      license = "GPL";
-      maintainers = [ stdenv.lib.maintainers.eelco ];
-      platforms = stdenv.lib.platforms.linux;
-    };
-  };
-
-  agent = stdenv.mkDerivation {
-    name = "zabbix-agent-${version}";
-
-    inherit src preConfigure;
-
-    configureFlags = [ "--enable-agent" ];
-
-    meta = with stdenv.lib; {
-      inherit branch;
-      description = "An enterprise-class open source distributed monitoring solution (client-side agent)";
-      homepage = https://www.zabbix.com/;
-      license = licenses.gpl2;
-      maintainers = [ maintainers.eelco ];
-      platforms = platforms.linux;
-    };
-  };
-
-}

pkgs/servers/monitoring/zabbix/2.2.nix

@@ -1,104 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, postgresql, curl, openssl, zlib
-, net_snmp , libssh2, openldap
-, enableJabber ? false, minmay ? null
-, enableSnmp ? false
-, enableSsh ? false
-, enableLdap ? false
-}:
-
-assert enableJabber -> minmay != null;
-
-let
-
-  version = "2.2.20";
-  branch = "2.2";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/zabbix/zabbix-${version}.tar.gz";
-    sha256 = "00pfpyj3vydwx9dn0bklh1p5j0bp2awi4hvv4kgliyav8l0416hk";
-  };
-
-  preConfigure =
-    ''
-      substituteInPlace ./configure \
-        --replace " -static" "" \
-        ${stdenv.lib.optionalString (stdenv.cc.libc != null) ''
-          --replace /usr/include/iconv.h ${stdenv.lib.getDev stdenv.cc.libc}/include/iconv.h
-        ''}
-    '';
-
-in
-
-{
-  recurseForDerivations = true;
-
-  server = stdenv.mkDerivation {
-    name = "zabbix-${version}";
-
-    inherit src preConfigure;
-
-    configureFlags = [
-      "--enable-agent"
-      "--enable-server"
-      "--with-postgresql"
-      "--with-libcurl"
-      "--with-gettext"
-    ]
-    ++ stdenv.lib.optional enableJabber "--with-jabber=${minmay}"
-    ++ stdenv.lib.optional enableSnmp "--with-net-snmp"
-    ++ stdenv.lib.optional enableSsh "--with-ssh2=${libssh2.dev}"
-    ++ stdenv.lib.optional enableLdap "--with-ldap=${openldap.dev}";
-
-    postPatch = ''
-      sed -i -e 's/iksemel/minmay/g' configure src/libs/zbxmedia/jabber.c
-      sed -i \
-        -e '/^static ikstransport/,/}/d' \
-        -e 's/iks_connect_with\(.*\), &zbx_iks_transport/mmay_connect_via\1/' \
-        -e 's/iks/mmay/g' -e 's/IKS/MMAY/g' src/libs/zbxmedia/jabber.c
-    '';
-
-  nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ postgresql curl openssl zlib ]
-      ++ stdenv.lib.optional enableSnmp net_snmp
-      ++ stdenv.lib.optional enableSsh libssh2
-      ++ stdenv.lib.optional enableLdap openldap;
-
-    postInstall =
-      ''
-        mkdir -p $out/share/zabbix
-        cp -prvd frontends/php $out/share/zabbix/php
-        mkdir -p $out/share/zabbix/db/data
-        cp -prvd database/postgresql/data.sql $out/share/zabbix/db/data/data.sql
-        cp -prvd database/postgresql/images.sql $out/share/zabbix/db/data/images_pgsql.sql
-        mkdir -p $out/share/zabbix/db/schema
-        cp -prvd database/postgresql/schema.sql $out/share/zabbix/db/schema/postgresql.sql
-      '';
-
-    meta = {
-      inherit branch;
-      description = "An enterprise-class open source distributed monitoring solution";
-      homepage = https://www.zabbix.com/;
-      license = "GPL";
-      maintainers = [ stdenv.lib.maintainers.eelco ];
-      platforms = stdenv.lib.platforms.linux;
-    };
-  };
-
-  agent = stdenv.mkDerivation {
-    name = "zabbix-agent-${version}";
-
-    inherit src preConfigure;
-
-    configureFlags = [ "--enable-agent" ];
-
-    meta = with stdenv.lib; {
-      inherit branch;
-      description = "An enterprise-class open source distributed monitoring solution (client-side agent)";
-      homepage = https://www.zabbix.com/;
-      license = licenses.gpl2;
-      maintainers = [ maintainers.eelco ];
-      platforms = platforms.linux;
-    };
-  };
-
-}

pkgs/servers/monitoring/zabbix/3.4.nix

@@ -1,41 +0,0 @@
-{ stdenv, fetchurl, pcre, libiconv, openssl }:
-
-
-let
-
-  version = "3.4.8";
-  branch = "3.4";
-
-  src = fetchurl {
-    url = "https://netix.dl.sourceforge.net/project/zabbix/ZABBIX%20Latest%20Stable/${version}/zabbix-${version}.tar.gz";
-    sha256 = "cec14993d1ec2c9d8c51f6608c9408620f27174db92edc2347bafa7b841ccc07";
-  };
-
-in
-
-{
-  agent = stdenv.mkDerivation {
-    name = "zabbix-agent-${version}";
-
-    inherit src;
-
-     configureFlags = [
-      "--enable-agent"
-      "--with-libpcre=${pcre.dev}"
-      "--with-iconv=${libiconv}"
-      "--with-openssl=${openssl.dev}"
-    ];
-    buildInputs = [ pcre libiconv openssl ];
-
-    meta = with stdenv.lib; {
-      inherit branch;
-      description = "An enterprise-class open source distributed monitoring solution (client-side agent)";
-      homepage = https://www.zabbix.com/;
-      license = licenses.gpl2;
-      maintainers = [ maintainers.eelco ];
-      platforms = platforms.linux;
-    };
-  };
-
-}
-

pkgs/servers/monitoring/zabbix/agent.nix

@@ -0,0 +1,38 @@
+{ stdenv, fetchurl, pkgconfig, libiconv, openssl, pcre }:
+
+import ./versions.nix ({ version, sha256 }:
+  stdenv.mkDerivation {
+    pname = "zabbix-agent";
+    inherit version;
+
+    src = fetchurl {
+      url = "mirror://sourceforge/zabbix/ZABBIX%20Latest%20Stable/${version}/zabbix-${version}.tar.gz";
+      inherit sha256;
+    };
+
+    nativeBuildInputs = [ pkgconfig ];
+    buildInputs = [
+      libiconv
+      openssl
+      pcre
+    ];
+
+    configureFlags = [
+      "--enable-agent"
+      "--with-iconv"
+      "--with-libpcre"
+      "--with-openssl=${openssl.dev}"
+    ];
+
+    postInstall = ''
+      cp conf/zabbix_agentd/*.conf $out/etc/zabbix_agentd.conf.d/
+    '';
+
+    meta = with stdenv.lib; {
+      description = "An enterprise-class open source distributed monitoring solution (client-side agent)";
+      homepage = "https://www.zabbix.com/";
+      license = licenses.gpl2;
+      maintainers = with maintainers; [ mmahut psyanticy ];
+      platforms = platforms.linux;
+    };
+  })

pkgs/servers/monitoring/zabbix/default.nix

@@ -1,75 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, postgresql, curl, openssl, zlib }:
-
-let
-
-  version = "1.8.22";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/zabbix/zabbix-${version}.tar.gz";
-    sha256 = "0cjj3c4j4b9sl3hgh1fck330z9q0gz2k68g227y0paal6k6f54g7";
-  };
-
-  preConfigure =
-    ''
-      substituteInPlace ./configure \
-        --replace " -static" "" \
-        ${stdenv.lib.optionalString (stdenv.cc.libc != null) ''
-          --replace /usr/include/iconv.h ${stdenv.lib.getDev stdenv.cc.libc}/include/iconv.h
-        ''}
-    '';
-
-in
-
-{
-
-  server = stdenv.mkDerivation {
-    name = "zabbix-${version}";
-
-    inherit src preConfigure;
-
-    configureFlags = [
-      "--enable-agent"
-      "--enable-server"
-      "--with-pgsql"
-      "--with-libcurl"
-    ];
-
-  nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ postgresql curl openssl zlib ];
-
-    postInstall =
-      ''
-        mkdir -p $out/share/zabbix
-        cp -prvd frontends/php $out/share/zabbix/php
-        mkdir -p $out/share/zabbix/db/data
-        cp -prvd create/data/*.sql $out/share/zabbix/db/data
-        mkdir -p $out/share/zabbix/db/schema
-        cp -prvd create/schema/*.sql $out/share/zabbix/db/schema
-      '';
-
-    meta = {
-      description = "An enterprise-class open source distributed monitoring solution";
-      homepage = https://www.zabbix.com/;
-      license = "GPL";
-      maintainers = [ stdenv.lib.maintainers.eelco ];
-      platforms = stdenv.lib.platforms.linux;
-    };
-  };
-
-  agent = stdenv.mkDerivation {
-    name = "zabbix-agent-${version}";
-
-    inherit src preConfigure;
-
-    configureFlags = [ "--enable-agent" ];
-
-    meta = with stdenv.lib; {
-      description = "An enterprise-class open source distributed monitoring solution (client-side agent)";
-      homepage = https://www.zabbix.com/;
-      license = licenses.gpl2;
-      maintainers = [ maintainers.eelco ];
-      platforms = platforms.linux;
-    };
-  };
-
-}