2019-09-09 16:24:15 +01:00
<section xmlns= "http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
xml:id="sec-release-20.03">
<title > Release 20.03 (“Markhor”, 2020.03/??)</title>
<section xmlns= "http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
xml:id="sec-release-20.03-highlights">
<title > Highlights</title>
<para >
2019-09-19 18:17:30 +01:00
In addition to numerous new and upgraded packages, this release has the
following highlights:
2019-09-09 16:24:15 +01:00
</para>
<itemizedlist >
<listitem >
<para >
Support is planned until the end of October 2020, handing over to 20.09.
</para>
</listitem>
2020-01-31 14:58:46 +00:00
<listitem >
<para >
Linux kernel is updated to branch 5.4 by default (from 4.19).
Users of Intel GPUs may prefer to explicitly set branch to 4.19 to avoid some regressions.
<programlisting > boot.kernelPackages = pkgs.linuxPackages_4_19;</programlisting>
</para>
</listitem>
2019-09-22 10:27:39 +01:00
<listitem >
<para >
Postgresql for NixOS service now defaults to v11.
</para>
</listitem>
2019-09-28 23:17:04 +01:00
<listitem >
<para >
The graphical installer image starts the graphical session automatically.
Before you'd be greeted by a tty and asked to enter <command > systemctl start display-manager</command> .
It is now possible to disable the display-manager from running by selecting the <literal > Disable display-manager</literal>
quirk in the boot menu.
</para>
</listitem>
2019-10-08 12:10:23 +01:00
<listitem >
<para >
2019-10-08 12:15:15 +01:00
By default zfs pools will now be trimmed on a weekly basis.
Trimming is only done on supported devices (i.e. NVME or SSDs)
and should improve throughput and lifetime of these devices.
It is controlled by the <varname > services.zfs.trim.enable</varname> varname.
2019-10-08 12:10:23 +01:00
The zfs scrub service (<varname > services.zfs.autoScrub.enable</varname> )
and the zfs autosnapshot service (<varname > services.zfs.autoSnapshot.enable</varname> )
are now only enabled if zfs is set in <varname > config.boot.initrd.supportedFilesystems</varname> or
<varname > config.boot.supportedFilesystems</varname> . These lists will automatically contain
zfs as soon as any zfs mountpoint is configured in <varname > fileSystems</varname> .
</para>
</listitem>
2019-10-09 00:54:56 +01:00
<listitem >
<para >
<command > nixos-option</command> has been rewritten in C++, speeding it up, improving correctness,
2019-12-17 20:08:07 +00:00
and adding a <option > -r</option> option which prints all options and their values recursively.
2019-10-09 00:54:56 +01:00
</para>
</listitem>
2019-12-10 14:10:30 +00:00
<listitem >
<para >
<option > services.xserver.desktopManager.default</option> and <option > services.xserver.windowManager.default</option> options were replaced by a single <xref linkend= "opt-services.xserver.displayManager.defaultSession" /> option to improve support for upstream session files. If you used something like:
<programlisting >
services.xserver.desktopManager.default = "xfce";
services.xserver.windowManager.default = "icewm";
</programlisting>
you should change it to:
<programlisting >
services.xserver.displayManager.defaultSession = "xfce+icewm";
</programlisting>
</para>
</listitem>
2019-09-09 16:24:15 +01:00
</itemizedlist>
</section>
<section xmlns= "http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
xml:id="sec-release-20.03-new-services">
<title > New Services</title>
<para >
The following new services were added since the last release:
</para>
<itemizedlist >
<listitem >
2019-11-15 04:58:35 +00:00
<para >
The kubernetes kube-proxy now supports a new hostname configuration
<literal > services.kubernetes.proxy.hostname</literal> which has to
be set if the hostname of the node should be non default.
</para>
2019-09-09 16:24:15 +01:00
</listitem>
2019-11-23 08:07:06 +00:00
<listitem >
<para >
UPower's configuration is now managed by NixOS and can be customized
via <option > services.upower</option> .
</para>
</listitem>
2020-02-01 23:01:25 +00:00
<listitem >
<para >
To use Geary you should enable <xref linkend= "opt-programs.geary.enable" /> instead of
just adding it to <xref linkend= "opt-environment.systemPackages" /> .
It was created so Geary could function properly outside of GNOME.
</para>
</listitem>
2019-09-09 16:24:15 +01:00
</itemizedlist>
2019-09-19 18:17:30 +01:00
2019-09-09 16:24:15 +01:00
</section>
<section xmlns= "http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
xml:id="sec-release-20.03-incompatibilities">
<title > Backward Incompatibilities</title>
<para >
2019-09-19 18:17:30 +01:00
When upgrading from a previous release, please be aware of the following
incompatible changes:
2019-09-09 16:24:15 +01:00
</para>
<itemizedlist >
<listitem >
2018-10-27 15:03:13 +01:00
<para >
GnuPG is now built without support for a graphical passphrase entry
by default. Please enable the <literal > gpg-agent</literal> user service
via the NixOS option <literal > programs.gnupg.agent.enable</literal> .
Note that upstream recommends using <literal > gpg-agent</literal> and
will spawn a <literal > gpg-agent</literal> on the first invocation of
GnuPG anyway.
</para>
2019-09-09 16:24:15 +01:00
</listitem>
<listitem >
2019-10-18 13:05:53 +01:00
<para >
The <literal > dynamicHosts</literal> option has been removed from the
2020-01-30 10:50:03 +00:00
<link linkend= "opt-networking.networkmanager.enable" > NetworkManager</link>
2019-10-18 13:05:53 +01:00
module. Allowing (multiple) regular users to override host entries
affecting the whole system opens up a huge attack vector.
There seem to be very rare cases where this might be useful.
Consider setting system-wide host entries using
<link linkend= "opt-networking.hosts" > networking.hosts</link> , provide
them via the DNS server in your network, or use
<link linkend= "opt-environment.etc" > environment.etc</link>
to add a file into <literal > /etc/NetworkManager/dnsmasq.d</literal>
reconfiguring <literal > hostsdir</literal> .
</para>
2019-09-09 16:24:15 +01:00
</listitem>
2019-10-22 22:43:28 +01:00
<listitem >
<para >
2019-11-03 11:29:48 +00:00
The <literal > 99-main.network</literal> file was removed. Maching all
network interfaces caused many breakages, see
<link xlink:href= "https://github.com/NixOS/nixpkgs/pull/18962" > #18962</link>
and <link xlink:href= "https://github.com/NixOS/nixpkgs/pull/71106" > #71106</link> .
2019-10-22 22:43:28 +01:00
</para>
<para >
2019-11-03 11:29:48 +00:00
We already don't support the global <link linkend= "opt-networking.useDHCP" > networking.useDHCP</link> ,
<link linkend= "opt-networking.defaultGateway" > networking.defaultGateway</link> and
<link linkend= "opt-networking.defaultGateway6" > networking.defaultGateway6</link> options
if <link linkend= "opt-networking.useNetworkd" > networking.useNetworkd</link> is enabled,
but direct users to configure the per-device
<link linkend= "opt-networking.interfaces" > networking.interfaces.< name> .…</link> options.
2019-10-22 22:43:28 +01:00
</para>
</listitem>
2019-10-29 23:43:34 +00:00
<listitem >
<para >
The stdenv now runs all bash with <literal > set -u</literal> , to catch the use of undefined variables.
Before, it itself used <literal > set -u</literal> but was careful to unset it so other packages' code ran as before.
Now, all bash code is held to the same high standard, and the rather complex stateful manipulation of the options can be discarded.
</para>
</listitem>
2019-11-11 21:41:26 +00:00
<listitem >
<para >
The SLIM Display Manager has been removed, as it has been unmaintained since 2013.
Consider migrating to a different display manager such as LightDM (current default in NixOS),
SDDM, GDM, or using the startx module which uses Xinitrc.
2019-11-16 10:45:07 +00:00
</para>
2019-11-11 21:41:26 +00:00
</listitem>
2020-01-13 14:59:11 +00:00
<listitem >
<para >
The Way Cooler wayland compositor has been removed, as the project has been officially canceled.
There are no more <literal > way-cooler</literal> attribute and <literal > programs.way-cooler</literal> options.
</para>
</listitem>
2019-10-19 16:37:44 +01:00
<listitem >
<para >
The BEAM package set has been deleted. You will only find there the different interpreters.
You should now use the different build tools coming with the languages with sandbox mode disabled.
</para>
2019-11-11 21:41:26 +00:00
</listitem>
2019-11-19 22:59:59 +00:00
<listitem >
<para >
There is now only one Xfce package-set and module. This means attributes, <literal > xfce4-14</literal>
<literal > xfce4-12</literal> , and <literal > xfceUnstable</literal> all now point to the latest Xfce 4.14
packages. And in future NixOS releases will be the latest released version of Xfce available at the
time during the releases development (if viable).
</para>
</listitem>
2019-11-21 22:31:19 +00:00
<listitem >
<para >
The <link linkend= "opt-services.phpfpm.pools" > phpfpm</link> module now sets
<literal > PrivateTmp=true</literal> in its systemd units for better process isolation.
If you rely on <literal > /tmp</literal> being shared with other services, explicitly override this by
setting <literal > serviceConfig.PrivateTmp</literal> to <literal > false</literal> for each phpfpm unit.
</para>
</listitem>
2019-11-21 20:54:49 +00:00
<listitem >
<para >
KDE’ <option > enableQt4Support</option> option any more.
</para>
</listitem>
2019-11-24 16:33:51 +00:00
<listitem >
<para >
The BeeGFS module has been removed.
</para>
</listitem>
2019-11-24 21:33:51 +00:00
<listitem >
<para >
The osquery module has been removed.
</para>
</listitem>
2019-11-02 13:34:50 +00:00
<listitem >
<para >
2019-11-26 16:04:59 +00:00
Going forward, <literal > ~/bin</literal> in the users home directory will no longer be in <literal > PATH</literal> by default.
2019-11-02 13:34:50 +00:00
If you depend on this you should set the option <literal > environment.homeBinInPath</literal> to <literal > true</literal> .
The aforementioned option was added this release.
</para>
</listitem>
2019-11-20 06:30:06 +00:00
<listitem >
<para >
The <literal > buildRustCrate</literal> infrastructure now produces <literal > lib</literal> outputs in addition to the <literal > out</literal> output.
This has led to drastically reduced closed sizes for some rust crates since development dependencies are now in the <literal > lib</literal> output.
</para>
2019-12-02 01:25:07 +00:00
</listitem>
<listitem >
<para >
Pango was upgraded to 1.44, which no longer uses freetype for font loading. This means that type1
and bitmap fonts are no longer supported in applications relying on Pango for font rendering
(notably, GTK application). See <link xlink:href= "https://gitlab.gnome.org/GNOME/pango/issues/386" >
upstream issue</link> for more information.
</para>
2019-11-20 06:30:06 +00:00
</listitem>
2019-06-21 10:17:33 +01:00
<listitem >
<para >
The packages <literal > openobex</literal> and <literal > obexftp</literal>
2019-12-08 17:34:47 +00:00
are no longer installed when enabling Bluetooth via
2019-06-21 10:17:33 +01:00
<option > hardware.bluetooth.enable</option> .
</para>
</listitem>
2019-12-02 13:44:33 +00:00
<listitem >
<para >
The <literal > dump1090</literal> derivation has been changed to use FlightAware's dump1090
as its upstream. However, this version does not have an internal webserver anymore. The
assets in the <literal > share/dump1090</literal> directory of the derivation can be used
in conjunction with an external webserver to replace this functionality.
</para>
</listitem>
2019-12-08 19:33:51 +00:00
<listitem >
<para >
The fourStore and fourStoreEndpoint modules have been removed.
</para>
</listitem>
2019-12-09 06:38:33 +00:00
<listitem >
<para >
Polkit no longer has the user of uid 0 (root) as an admin identity.
We now follow the upstream default of only having every member of the wheel
group admin privileged. Before it was root and members of wheel.
The positive outcome of this is pkexec GUI popups or terminal prompts
will no longer require the user to choose between two essentially equivalent
choices (whether to perform the action as themselves with wheel permissions, or as the root user).
</para>
</listitem>
2019-12-15 16:21:52 +00:00
<listitem >
<para >
NixOS containers no longer build NixOS manual by default. This saves evaluation time,
especially if there are many declarative containers defined. Note that this is already done
when <literal > < nixos/modules/profiles/minimal.nix> </literal> module is included
in container config.
</para>
</listitem>
2019-12-16 22:06:27 +00:00
<listitem >
<para >
The <literal > kresd</literal> services deprecates the <literal > interfaces</literal> option
in favor of the <literal > listenPlain</literal> option which requires full
<link xlink:href= "https://www.freedesktop.org/software/systemd/man/systemd.socket.html#ListenStream=" > systemd.socket compatible</link>
declaration which always include a port.
</para>
</listitem>
2019-11-03 11:29:33 +00:00
<listitem >
<para >
Virtual console options have been reorganized and can be found under
a single top-level attribute: <literal > console</literal> .
The full set of changes is as follows:
</para>
<itemizedlist >
<listitem >
<para >
<literal > i18n.consoleFont</literal> renamed to
<link linkend= "opt-console.font" > console.font</link>
</para>
</listitem>
<listitem >
<para >
<literal > i18n.consoleKeyMap</literal> renamed to
<link linkend= "opt-console.keyMap" > console.keyMap</link>
</para>
</listitem>
<listitem >
<para >
<literal > i18n.consoleColors</literal> renamed to
<link linkend= "opt-console.colors" > console.colors</link>
</para>
</listitem>
<listitem >
<para >
<literal > i18n.consolePackages</literal> renamed to
<link linkend= "opt-console.packages" > console.packages</link>
</para>
</listitem>
<listitem >
<para >
<literal > i18n.consoleUseXkbConfig</literal> renamed to
<link linkend= "opt-console.useXkbConfig" > console.useXkbConfig</link>
</para>
</listitem>
<listitem >
<para >
<literal > boot.earlyVconsoleSetup</literal> renamed to
<link linkend= "opt-console.earlySetup" > console.earlySetup</link>
</para>
</listitem>
<listitem >
<para >
<literal > boot.extraTTYs</literal> renamed to
<link linkend= "opt-console.extraTTYs" > console.extraTTYs</link>
</para>
</listitem>
</itemizedlist>
</listitem>
2019-11-23 10:30:48 +00:00
<listitem >
<para >
2019-12-25 19:06:18 +00:00
The <link linkend= "opt-services.awstats.enable" > awstats</link> module has been rewritten
2019-11-23 10:30:48 +00:00
to serve stats via static html pages, updated on a timer, over <link linkend= "opt-services.nginx.virtualHosts" > nginx</link> ,
2019-12-25 19:06:18 +00:00
instead of dynamic cgi pages over <link linkend= "opt-services.httpd.enable" > apache</link> .
2019-11-23 10:30:48 +00:00
</para>
<para >
Minor changes will be required to migrate existing configurations. Details of the
2019-12-25 19:06:18 +00:00
required changes can seen by looking through the <link linkend= "opt-services.awstats.enable" > awstats</link>
2019-11-23 10:30:48 +00:00
module.
</para>
</listitem>
2019-11-04 21:24:55 +00:00
<listitem >
<para >
The httpd module no longer provides options to support serving web content without defining a virtual host. As a
result of this the <link linkend= "opt-services.httpd.logPerVirtualHost" > services.httpd.logPerVirtualHost</link>
option now defaults to <literal > true</literal> instead of <literal > false</literal> . Please update your
configuration to make use of <link linkend= "opt-services.httpd.virtualHosts" > services.httpd.virtualHosts</link> .
</para>
<para >
The <link linkend= "opt-services.httpd.virtualHosts" > services.httpd.virtualHosts.< name> </link>
option has changed type from a list of submodules to an attribute set of submodules, better matching
<link linkend= "opt-services.nginx.virtualHosts" > services.nginx.virtualHosts.< name> </link> .
</para>
<para >
This change comes with the addition of the following options which mimic the functionality of their <literal > nginx</literal> counterparts:
<link linkend= "opt-services.httpd.virtualHosts" > services.httpd.virtualHosts.< name> .addSSL</link> ,
<link linkend= "opt-services.httpd.virtualHosts" > services.httpd.virtualHosts.< name> .forceSSL</link> ,
<link linkend= "opt-services.httpd.virtualHosts" > services.httpd.virtualHosts.< name> .onlySSL</link> ,
<link linkend= "opt-services.httpd.virtualHosts" > services.httpd.virtualHosts.< name> .enableACME</link> ,
<link linkend= "opt-services.httpd.virtualHosts" > services.httpd.virtualHosts.< name> .acmeRoot</link> , and
<link linkend= "opt-services.httpd.virtualHosts" > services.httpd.virtualHosts.< name> .useACMEHost</link> .
</para>
</listitem>
2020-01-06 17:43:26 +00:00
<listitem >
<para >
For NixOS configuration options, the <literal > loaOf</literal> type has
been deprecated and will be removed in a future release. In nixpkgs,
options of this type will be changed to <literal > attrsOf</literal>
instead. If you were using one of these in your configuration, you will
see a warning suggesting what changes will be required.
</para>
<para >
For example, <link linkend= "opt-users.users" > users.users</link> is a
<literal > loaOf</literal> option that is commonly used as follows:
<programlisting >
users.users =
[ { name = "me";
description = "My personal user.";
isNormalUser = true;
}
];
</programlisting>
This should be rewritten by removing the list and using the
value of <literal > name</literal> as the name of the attribute set:
<programlisting >
users.users.me =
{ description = "My personal user.";
isNormalUser = true;
};
</programlisting>
</para>
<para >
For more information on this change have look at these links:
<link xlink:href= "https://github.com/NixOS/nixpkgs/issues/1800" > issue #1800</link> ,
<link xlink:href= "https://github.com/NixOS/nixpkgs/pull/63103" > PR #63103</link> .
</para>
</listitem>
2020-01-08 22:59:37 +00:00
<listitem >
<para >
For NixOS modules, the types <literal > types.submodule</literal> and <literal > types.submoduleWith</literal> now support
paths as allowed values, similar to how <literal > imports</literal> supports paths.
Because of this, if you have a module that defines an option of type
<literal > either (submodule ...) path</literal> , it will break since a path
is now treated as the first type instead of the second. To fix this, change
the type to <literal > either path (submodule ...)</literal> .
</para>
</listitem>
2020-01-17 17:32:23 +00:00
<listitem >
<para >
The <link linkend= "opt-services.buildkite-agent.enable" > Buildkite Agent</link>
module and corresponding packages have been updated to 3.x.
While doing so, the following options have been changed:
</para>
<itemizedlist >
<listitem >
<para >
<literal > services.buildkite-agent.meta-data</literal> has been renamed to
<link linkend= "opt-services.buildkite-agent.tags" > services.buildkite-agent.tags</link> ,
to match upstreams naming for 3.x.
Its type has also changed - it now accepts an attrset of strings.
</para>
</listitem>
<listitem >
<para >
The<literal > services.buildkite-agent.openssh.publicKeyPath</literal> option
has been removed, as it's not necessary to deploy public keys to clone private
repositories.
</para>
</listitem>
<listitem >
<para >
<literal > services.buildkite-agent.openssh.privateKeyPath</literal>
has been renamed to
<link linkend= "opt-services.buildkite-agent.privateSshKeyPath" > buildkite-agent.privateSshKeyPath</link> ,
as the whole <literal > openssh</literal> now only contained that single option.
</para>
</listitem>
<listitem >
<para >
<link linkend= "opt-services.buildkite-agent.shell" > services.buildkite-agent.shell</link>
has been introduced, allowing to specify a custom shell to be used.
</para>
</listitem>
</itemizedlist>
</listitem>
2020-01-28 10:40:20 +00:00
<listitem >
<para >
The <literal > citrix_workspace_19_3_0</literal> package has been removed as
it will be EOLed within the lifespan of 20.03. For further information,
please refer to the <link xlink:href= "https://www.citrix.com/de-de/support/product-lifecycle/milestones/receiver.html" > support and maintenance information</link> from upstream.
</para>
</listitem>
2020-01-28 19:23:53 +00:00
<listitem >
<para >
The <literal > gcc5</literal> and <literal > gfortran5</literal> packages have been removed.
</para>
</listitem>
2020-01-26 22:41:19 +00:00
<listitem >
<para >
The <option > services.xserver.displayManager.auto</option> module has been removed.
It was only intended for use in internal NixOS tests, and gave the false impression
of it being a special display manager when it's actually LightDM.
Please use the <xref linkend= "opt-services.xserver.displayManager.lightdm.autoLogin" /> options instead,
or any other display manager in NixOS as they all support auto-login. If you used this module specifically
because it permitted root auto-login you can override the lightdm-autologin pam module like:
<programlisting >
<link xlink:href= "#opt-security.pam.services._name__.text" > security.pam.services.lightdm-autologin.text</link> = lib.mkForce ''
auth requisite pam_nologin.so
auth required pam_succeed_if.so quiet
auth required pam_permit.so
account include lightdm
password include lightdm
session include lightdm
'';
</programlisting>
The difference is the:
<programlisting >
auth required pam_succeed_if.so quiet
</programlisting>
line, where default it's:
<programlisting >
auth required pam_succeed_if.so uid >= 1000 quiet
</programlisting>
not permitting users with uid's below 1000 (like root).
All other display managers in NixOS are configured like this.
</para>
</listitem>
2020-01-30 18:08:06 +00:00
<listitem >
<para >
There have been lots of improvements to the Mailman module. As
a result,
</para>
<itemizedlist >
<listitem >
<para >
The <option > services.mailman.hyperkittyBaseUrl</option>
option has been renamed to <xref
linkend="opt-services.mailman.hyperkitty.baseUrl"/>.
</para>
</listitem>
<listitem >
<para >
The <option > services.mailman.hyperkittyApiKey</option>
option has been removed. This is because having an option
for the Hyperkitty API key meant that the API key would be
stored in the world-readable Nix store, which was a
security vulnerability. A new Hyperkitty API key will be
generated the first time the new Hyperkitty service is run,
and it will then be persisted outside of the Nix store. To
continue using Hyperkitty, you must set <xref
linkend="opt-services.mailman.hyperkitty.enable"/> to
<literal > true</literal> .
</para>
</listitem>
<listitem >
<para >
Additionally, some Postfix configuration must now be set
manually instead of automatically by the Mailman module:
<programlisting >
<xref linkend= "opt-services.postfix.relayDomains" /> = [ "hash:/var/lib/mailman/data/postfix_domains" ];
<xref linkend= "opt-services.postfix.config" /> .transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
<xref linkend= "opt-services.postfix.config" /> .local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
</programlisting>
This is because some users may want to include other values
in these lists as well, and this was not possible if they
were set automatically by the Mailman module. It would not
have been possible to just concatenate values from multiple
modules each setting the values they needed, because the
order of elements in the list is significant.
</para>
</listitem>
</itemizedlist>
</listitem>
2020-01-30 19:19:45 +00:00
<listitem >
<para > The LLVM versions 3.5, 3.9 and 4 (including the corresponding CLang versions) have been dropped.</para>
</listitem>
2020-01-30 10:57:58 +00:00
<listitem >
<para >
The <option > networking.interfaces.*.preferTempAddress</option> option has
been replaced by <option > networking.interfaces.*.tempAddress</option> .
The new option allows better control of the IPv6 temporary addresses,
including completely disabling them for interfaces where they are not
needed.
</para>
</listitem>
2020-02-01 12:55:57 +00:00
<listitem >
<para >
Rspamd was updated to version 2.2. Read
<link xlink:href= "https://rspamd.com/doc/migration.html#migration-to-rspamd-20" >
the upstream migration notes</link> carefully. Please be especially
aware that some modules were removed and the default Bayes backend is
now Redis.
</para>
</listitem>
2020-02-02 11:05:13 +00:00
<listitem >
<para >
The <literal > *psu</literal> versions of <package > oraclejdk8</package> have been removed
as they aren't provided by upstream anymore.
</para>
</listitem>
2020-02-01 23:36:47 +00:00
<listitem >
<para >
The <option > services.dnscrypt-proxy</option> module has been removed
as it used the deprecated version of dnscrypt-proxy. We've added
<xref linkend= "opt-services.dnscrypt-proxy2.enable" /> to use the supported version.
</para>
</listitem>
2019-09-09 16:24:15 +01:00
</itemizedlist>
</section>
<section xmlns= "http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
xml:id="sec-release-20.03-notable-changes">
<title > Other Notable Changes</title>
<itemizedlist >
<listitem >
2019-09-28 16:57:19 +01:00
<para > SD images are now compressed by default using <literal > bzip2</literal> .</para>
2019-09-09 16:24:15 +01:00
</listitem>
2019-05-30 12:11:56 +01:00
<listitem >
<para >
The nginx web server previously started its master process as root
privileged, then ran worker processes as a less privileged identity user.
This was changed to start all of nginx as a less privileged user (defined by
<literal > services.nginx.user</literal> and
<literal > services.nginx.group</literal> ). As a consequence, all files that
are needed for nginx to run (included configuration fragments, SSL
certificates and keys, etc.) must now be readable by this less privileged
user/group.
</para>
</listitem>
2019-05-21 09:24:47 +01:00
<listitem >
<para >
OpenSSH has been upgraded from 7.9 to 8.1, improving security and adding features
but with potential incompatibilities. Consult the
<link xlink:href= "https://www.openssh.com/txt/release-8.1" >
release announcement</link> for more information.
</para>
</listitem>
2019-12-02 19:04:44 +00:00
<listitem >
<para >
<literal > PRETTY_NAME</literal> in <literal > /etc/os-release</literal>
2019-12-03 14:09:55 +00:00
now uses the short rather than full version string.
2019-12-02 19:04:44 +00:00
</para>
</listitem>
2020-01-16 13:43:40 +00:00
<listitem >
<para >
It is now possible to unlock LUKS-Encrypted file systems using a FIDO2 token
via <option > boot.initrd.luks.fido2Support</option> .
</para>
</listitem>
2019-09-09 16:24:15 +01:00
</itemizedlist>
</section>
</section>
