Merge remote-tracking branch 'origin/master' into staging

2019-02-09 12:14:06 -05:00 · 2019-02-09 12:14:06 -05:00 · 5c09d977c7
commit 5c09d977c7
parent 21d991b1fd 18d059a4ac
478 changed files with 13633 additions and 4732 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -68,6 +68,11 @@
    github = "abbradar";
    name = "Nikolay Amiantov";
  };
+  abhi18av = {
+    email = "abhi18av@gmail.com";
+    github = "abhi18av";
+    name = "Abhinav Sharma";
+  };
  abigailbuccaneer = {
    email = "abigailbuccaneer@gmail.com";
    github = "abigailbuccaneer";
@ -236,6 +241,11 @@
    email = "nix-commits@lists.science.uu.nl";
    name = "Nix Committers";
  };
+  allonsy = {
+    email = "linuxbash8@gmail.com";
+    github = "allonsy";
+    name = "Alec Snyder";
+  };
  alunduil = {
    email = "alunduil@gmail.com";
    github = "alunduil";
@ -1270,6 +1280,11 @@
    github = "eadwu";
    name = "Edmund Wu";
  };
+  eamsden = {
+    email = "edward@blackriversoft.com";
+    github = "eamsden";
+    name = "Edward Amsden";
+  };
  earldouglas = {
    email = "james@earldouglas.com";
    github = "earldouglas";
@ -1295,6 +1310,11 @@
    github = "edef1c";
    name = "edef";
  };
+  embr = {
+    email = "hi@liclac.eu";
+    github = "liclac";
+    name = "embr";
+  };
  ederoyd46 = {
    email = "matt@ederoyd.co.uk";
    github = "ederoyd46";
@ -1495,6 +1515,11 @@
    github = "expipiplus1";
    name = "Joe Hermaszewski";
  };
+  eyjhb = {
+    email = "eyjhbb@gmail.com";
+    github = "eyJhb";
+    name = "eyJhb";
+  };
  f--t = {
    email = "git@f-t.me";
    github = "f--t";
@ -3480,6 +3505,11 @@
    github = "pesterhazy";
    name = "Paulus Esterhazy";
  };
+  petabyteboy = {
+    email = "me@pbb.lc";
+    github = "petabyteboy";
+    name = "Milan Pässler";
+  };
  peterhoeg = {
    email = "peter@hoeg.com";
    github = "peterhoeg";
@ -4156,6 +4186,11 @@
    github = "shlevy";
    name = "Shea Levy";
  };
+  shou = {
+    email = "x+g@shou.io";
+    github = "Shou";
+    name = "Benedict Aas";
+  };
  siddharthist = {
    email = "langston.barrett@gmail.com";
    github = "siddharthist";
@ -4677,7 +4712,7 @@
    name = "Thomas Tuegel";
  };
  tv = {
-    email = "tv@shackspace.de";
+    email = "tv@krebsco.de";
    github = "4z3";
    name = "Tomislav Viljetić";
  };
@ -5151,4 +5186,9 @@
    github = "mredaelli";
    name = "Massimo Redaelli";
  };
+  shmish111 = {
+    email = "shmish111@gmail.com";
+    github = "shmish111";
+    name = "David Smith";
+  };
 }
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@ -0,0 +1,22 @@
+ansicolors,
+argparse,
+dkjson
+inspect
+lrexlib-gnu,
+lrexlib-posix,
+ltermbox,
+lua-cmsgpack,
+lua_cliargs,
+lua-term,
+luaffi,http://luarocks.org/dev,
+luuid,
+penlight,
+say,
+luv,
+luasystem,
+mediator_lua,http://luarocks.org/manifests/teto
+mpack,http://luarocks.org/manifests/teto
+nvim-client,http://luarocks.org/manifests/teto
+busted,http://luarocks.org/manifests/teto
+luassert,http://luarocks.org/manifests/teto
+coxpcall,https://luarocks.org/manifests/hisham,1.17.0-1
--- a/maintainers/scripts/update-luarocks-packages
+++ b/maintainers/scripts/update-luarocks-packages
@ -0,0 +1,112 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -p nix-prefetch-scripts luarocks-nix -i bash
+
+# You'll likely want to use
+# ``
+# nixpkgs $ maintainers/scripts/update-luarocks-packages pkgs/development/lua-modules/generated-packages.nix
+# ``
+# to update all libraries in that folder.
+# to debug, redirect stderr to stdout with 2>&1
+
+
+# stop the script upon C-C
+set -eu -o pipefail
+
+if [ $# -lt 1 ]; then
+	print_help
+    exit 1
+fi
+
+CSV_FILE="maintainers/scripts/luarocks-packages.csv"
+TMP_FILE="$(mktemp)"
+
+exit_trap()
+{
+  local lc="$BASH_COMMAND" rc=$?
+  test $rc -eq 0 || echo -e "*** error $rc: $lc.\nGenerated temporary file in $TMP_FILE" >&2
+}
+trap exit_trap EXIT
+
+print_help() {
+    echo "Usage: $0 <GENERATED_FILE>"
+    echo "(most likely pkgs/development/lua-modules/generated-packages.nix)"
+	echo ""
+	echo " -c <CSV_FILE> to set the list of luarocks package to generate"
+	exit 1
+}
+
+
+while getopts ":hc:" opt; do
+  case $opt in
+    h)
+      print_help
+      ;;
+    c)
+      echo "Loading package list from $OPTARG !" >&2
+      CSV_FILE="$OPTARG"
+      ;;
+    \?)
+      echo "Invalid option: -$OPTARG" >&2
+      ;;
+  esac
+  shift $((OPTIND-1))
+done
+
+GENERATED_NIXFILE="$1"
+
+HEADER="
+/* ${GENERATED_NIXFILE} is an auto-generated file -- DO NOT EDIT!
+Regenerate it with:
+nixpkgs$ ${0} ${GENERATED_NIXFILE}
+
+These packages are manually refined in lua-overrides.nix
+*/
+{ self, lua, stdenv, fetchurl, fetchgit, pkgs, ... } @ args:
+self: super:
+with self;
+{
+"
+
+FOOTER="
+}
+/* GENERATED */
+"
+
+
+function convert_pkg () {
+    pkg="$1"
+	server=""
+	if [ ! -z "$2" ]; then
+		server=" --server=$2"
+	fi
+
+    version="${3:-}"
+
+    echo "looking at $pkg (version $version) from server [$server]" >&2
+    cmd="luarocks nix $server $pkg $version"
+    drv="$($cmd)"
+    if [ $? -ne 0 ]; then
+        echo "Failed to convert $pkg" >&2
+        echo "$drv" >&2
+    else
+        echo "$drv" | tee -a "$TMP_FILE"
+    fi
+}
+
+# params needed when called via callPackage
+echo "$HEADER" | tee "$TMP_FILE"
+
+# list of packages with format
+# name,server,version
+while IFS=, read -r pkg_name server version
+do
+	if [ -z "$pkg_name" ]; then
+		echo "Skipping empty package name" >&2
+	fi
+	convert_pkg "$pkg_name" "$server" "$version"
+done < "$CSV_FILE"
+
+# close the set
+echo "$FOOTER" | tee -a "$TMP_FILE"
+
+cp "$TMP_FILE" "$GENERATED_NIXFILE"
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@ -265,6 +265,7 @@ in rec {
      xsltproc \
        ${manualXsltprocOptions} \
        --stringparam target.database.document "${olinkDB}/olinkdb.xml" \
+        --stringparam id.warnings "1" \
        --nonet --output $dst/ \
        ${docbook_xsl_ns}/xml/xsl/docbook/xhtml/chunktoc.xsl \
        ${manual-combined}/manual-combined.xml
--- a/nixos/doc/manual/release-notes/rl-1903.xml
+++ b/nixos/doc/manual/release-notes/rl-1903.xml
@ -410,6 +410,23 @@
    (<link xlink:href="https://github.com/NixOS/nixpkgs/pull/54637">#54637</link>)
   </para>
  </listitem>
+  <listitem>
+   <para>
+    <literal>matrix-synapse</literal> has been updated to version 0.99. It will
+    <link xlink:href="https://github.com/matrix-org/synapse/pull/4509">no longer generate a self-signed certificate on first launch</link>
+    and will be <link xlink:href="https://matrix.org/blog/2019/02/05/synapse-0-99-0/">the last version to accept self-signed certificates</link>.
+    As such, it is now recommended to use a proper certificate verified by a
+    root CA (for example Let's Encrypt).
+   </para>
+  </listitem>
+   <listitem>
+    <para>
+     <literal>mailutils</literal> now works by default when
+     <literal>sendmail</literal> is not in a setuid wrapper. As a consequence,
+     the <literal>sendmailPath</literal> argument, having lost its main use, has
+     been removed.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

@ -462,6 +479,11 @@
       of maintainers.
     </para>
   </listitem>
+   <listitem>
+     <para>
+       The astah-community package was removed from nixpkgs due to it being discontinued and the downloads not being available anymore.
+     </para>
+   </listitem>
   <listitem>
     <para>
       The httpd service now saves log files with a .log file extension by default for
@ -503,6 +525,28 @@
     </para>
    </note>
   </listitem>
+   <listitem>
+    <para>
+     The <link xlink:href="https://github.com/DanielAdolfsson/ndppd"><literal>ndppd</literal></link> module
+     now supports <link linkend="opt-services.ndppd.enable">all config options</link> provided by the current
+     upstream version as service options. Additionally the <literal>ndppd</literal> package doesn't contain
+     the systemd unit configuration from upstream anymore, the unit is completely configured by the NixOS module now.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     New installs of NixOS will default to the Redmine 4.x series unless otherwise specified in
+     <literal>services.redmine.package</literal> while existing installs of NixOS will default to
+     the Redmine 3.x series.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <link linkend="opt-services.grafana.enable">Grafana module</link> now supports declarative
+     <link xlink:href="http://docs.grafana.org/administration/provisioning/">datasource and dashboard</link>
+     provisioning.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>
 </section>
--- a/nixos/lib/testing.nix
+++ b/nixos/lib/testing.nix
@ -3,7 +3,7 @@
  # Use a minimal kernel?
 , minimal ? false
  # Ignored
-, config ? null
+, config ? {}
  # Modules to add to each VM
 , extraConfigurations ? [] }:

--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@ -339,11 +339,11 @@ let
    #   dates (cp -p, touch, mcopy -m, faketime for label), IDs (mkfs.vfat -i)
    ''
      mkdir ./contents && cd ./contents
-      cp -rp "${efiDir}"/* .
+      cp -rp "${efiDir}"/EFI .
      mkdir ./boot
      cp -p "${config.boot.kernelPackages.kernel}/${config.system.boot.loader.kernelFile}" \
        "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}" ./boot/
-      touch --date=@0 ./*
+      touch --date=@0 ./EFI ./boot

      usage_size=$(du -sb --apparent-size . | tr -cd '[:digit:]')
      # Make the image 110% as big as the files need to make up for FAT overhead
@ -355,7 +355,7 @@ let
      echo "Image size: $image_size"
      truncate --size=$image_size "$out"
      ${pkgs.libfaketime}/bin/faketime "2000-01-01 00:00:00" ${pkgs.dosfstools}/sbin/mkfs.vfat -i 12345678 -n EFIBOOT "$out"
-      mcopy -psvm -i "$out" ./* ::
+      mcopy -psvm -i "$out" ./EFI ./boot ::
      # Verify the FAT partition.
      ${pkgs.dosfstools}/sbin/fsck.vfat -vn "$out"
    ''; # */
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@ -340,6 +340,8 @@ foreach my $fs (read_file("/proc/self/mountinfo")) {
    chomp $fs;
    my @fields = split / /, $fs;
    my $mountPoint = $fields[4];
+    $mountPoint =~ s/\\040/ /g; # account for mount points with spaces in the name (\040 is the escape character)
+    $mountPoint =~ s/\\011/\t/g; # account for mount points with tabs in the name (\011 is the escape character)
    next unless -d $mountPoint;
    my @mountOptions = split /,/, $fields[5];

@ -355,6 +357,8 @@ foreach my $fs (read_file("/proc/self/mountinfo")) {
    my $fsType = $fields[$n];
    my $device = $fields[$n + 1];
    my @superOptions = split /,/, $fields[$n + 2];
+    $device =~ s/\\040/ /g; # account for devices with spaces in the name (\040 is the escape character)
+    $device =~ s/\\011/\t/g; # account for mount points with tabs in the name (\011 is the escape character)

    # Skip the read-only bind-mount on /nix/store.
    next if $mountPoint eq "/nix/store" && (grep { $_ eq "rw" } @superOptions) && (grep { $_ eq "ro" } @mountOptions);
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -101,6 +101,7 @@
  ./programs/gnupg.nix
  ./programs/gphoto2.nix
  ./programs/iftop.nix
+  ./programs/iotop.nix
  ./programs/java.nix
  ./programs/kbdlight.nix
  ./programs/less.nix
--- a/nixos/modules/programs/iotop.nix
+++ b/nixos/modules/programs/iotop.nix
@ -0,0 +1,17 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.iotop;
+in {
+  options = {
+    programs.iotop.enable = mkEnableOption "iotop + setcap wrapper";
+  };
+  config = mkIf cfg.enable {
+    security.wrappers.iotop = {
+      source = "${pkgs.iotop}/bin/iotop";
+      capabilities = "cap_net_admin+p";
+    };
+  };
+}
--- a/nixos/modules/programs/sway-beta.nix
+++ b/nixos/modules/programs/sway-beta.nix
@ -60,10 +60,11 @@ in {
    extraPackages = mkOption {
      type = with types; listOf package;
      default = with pkgs; [
+        swaylock swayidle
        xwayland rxvt_unicode dmenu
      ];
      defaultText = literalExample ''
-        with pkgs; [ xwayland rxvt_unicode dmenu ];
+        with pkgs; [ swaylock swayidle xwayland rxvt_unicode dmenu ];
      '';
      example = literalExample ''
        with pkgs; [
--- a/nixos/modules/services/games/minecraft-server.nix
+++ b/nixos/modules/services/games/minecraft-server.nix
@ -4,8 +4,41 @@ with lib;

 let
  cfg = config.services.minecraft-server;
-in
-{
+
+  # We don't allow eula=false anyways
+  eulaFile = builtins.toFile "eula.txt" ''
+    # eula.txt managed by NixOS Configuration
+    eula=true
+  '';
+
+  whitelistFile = pkgs.writeText "whitelist.json"
+    (builtins.toJSON
+      (mapAttrsToList (n: v: { name = n; uuid = v; }) cfg.whitelist));
+
+  cfgToString = v: if builtins.isBool v then boolToString v else toString v;
+
+  serverPropertiesFile = pkgs.writeText "server.properties" (''
+    # server.properties managed by NixOS configuration
+  '' + concatStringsSep "\n" (mapAttrsToList
+    (n: v: "${n}=${cfgToString v}") cfg.serverProperties));
+
+
+  # To be able to open the firewall, we need to read out port values in the
+  # server properties, but fall back to the defaults when those don't exist.
+  # These defaults are from https://minecraft.gamepedia.com/Server.properties#Java_Edition_3
+  defaultServerPort = 25565;
+
+  serverPort = cfg.serverProperties.server-port or defaultServerPort;
+
+  rconPort = if cfg.serverProperties.enable-rcon or false
+    then cfg.serverProperties."rcon.port" or 25575
+    else null;
+
+  queryPort = if cfg.serverProperties.enable-query or false
+    then cfg.serverProperties."query.port" or 25565
+    else null;
+
+in {
  options = {
    services.minecraft-server = {

@ -13,10 +46,32 @@ in
        type = types.bool;
        default = false;
        description = ''
-          If enabled, start a Minecraft Server. The listening port for
-          the server is always <literal>25565</literal>. The server
+          If enabled, start a Minecraft Server. The server
          data will be loaded from and saved to
-          <literal>${cfg.dataDir}</literal>.
+          <option>services.minecraft-server.dataDir</option>.
+        '';
+      };
+
+      declarative = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to use a declarative Minecraft server configuration.
+          Only if set to <literal>true</literal>, the options
+          <option>services.minecraft-server.whitelist</option> and
+          <option>services.minecraft-server.serverProperties</option> will be
+          applied.
+        '';
+      };
+
+      eula = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether you agree to
+          <link xlink:href="https://account.mojang.com/documents/minecraft_eula">
+          Mojangs EULA</link>. This option must be set to
+          <literal>true</literal> to run Minecraft server.
        '';
      };

@ -24,7 +79,7 @@ in
        type = types.path;
        default = "/var/lib/minecraft";
        description = ''
-          Directory to store minecraft database and other state/data files.
+          Directory to store Minecraft database and other state/data files.
        '';
      };

@ -32,21 +87,84 @@ in
        type = types.bool;
        default = false;
        description = ''
-          Whether to open ports in the firewall (if enabled) for the server.
+          Whether to open ports in the firewall for the server.
        '';
      };

+      whitelist = mkOption {
+        type = let
+          minecraftUUID = types.strMatching
+            "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}" // {
+              description = "Minecraft UUID";
+            };
+          in types.attrsOf minecraftUUID;
+        default = {};
+        description = ''
+          Whitelisted players, only has an effect when
+          <option>services.minecraft-server.declarative</option> is
+          <literal>true</literal> and the whitelist is enabled
+          via <option>services.minecraft-server.serverProperties</option> by
+          setting <literal>white-list</literal> to <literal>true</literal>.
+          This is a mapping from Minecraft usernames to UUIDs.
+          You can use <link xlink:href="https://mcuuid.net/"/> to get a
+          Minecraft UUID for a username.
+        '';
+        example = literalExample ''
+          {
+            username1 = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
+            username2 = "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy";
+          };
+        '';
+      };
+
+      serverProperties = mkOption {
+        type = with types; attrsOf (either bool (either int str));
+        default = {};
+        example = literalExample ''
+          {
+            server-port = 43000;
+            difficulty = 3;
+            gamemode = 1;
+            max-players = 5;
+            motd = "NixOS Minecraft server!";
+            white-list = true;
+            enable-rcon = true;
+            "rcon.password" = "hunter2";
+          }
+        '';
+        description = ''
+          Minecraft server properties for the server.properties file. Only has
+          an effect when <option>services.minecraft-server.declarative</option>
+          is set to <literal>true</literal>. See
+          <link xlink:href="https://minecraft.gamepedia.com/Server.properties#Java_Edition_3"/>
+          for documentation on these values.
+        '';
+      };
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.minecraft-server;
+        defaultText = "pkgs.minecraft-server";
+        example = literalExample "pkgs.minecraft-server_1_12_2";
+        description = "Version of minecraft-server to run.";
+      };
+
      jvmOpts = mkOption {
-        type = types.str;
+        type = types.separatedString " ";
        default = "-Xmx2048M -Xms2048M";
-        description = "JVM options for the Minecraft Service.";
+        # Example options from https://minecraft.gamepedia.com/Tutorials/Server_startup_script
+        example = "-Xmx2048M -Xms4092M -XX:+UseG1GC -XX:+CMSIncrementalPacing "
+          + "-XX:+CMSClassUnloadingEnabled -XX:ParallelGCThreads=2 "
+          + "-XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=10";
+        description = "JVM options for the Minecraft server.";
      };
    };
  };

  config = mkIf cfg.enable {
+
    users.users.minecraft = {
-      description     = "Minecraft Server Service user";
+      description     = "Minecraft server service user";
      home            = cfg.dataDir;
      createHome      = true;
      uid             = config.ids.uids.minecraft;
@ -57,17 +175,60 @@ in
      wantedBy      = [ "multi-user.target" ];
      after         = [ "network.target" ];

-      serviceConfig.Restart = "always";
-      serviceConfig.User    = "minecraft";
-      script = ''
-        cd ${cfg.dataDir}
-        exec ${pkgs.minecraft-server}/bin/minecraft-server ${cfg.jvmOpts}
-      '';
+      serviceConfig = {
+        ExecStart = "${cfg.package}/bin/minecraft-server ${cfg.jvmOpts}";
+        Restart = "always";
+        User = "minecraft";
+        WorkingDirectory = cfg.dataDir;
+      };
+
+      preStart = ''
+        ln -sf ${eulaFile} eula.txt
+      '' + (if cfg.declarative then ''
+
+        if [ -e .declarative ]; then
+
+          # Was declarative before, no need to back up anything
+          ln -sf ${whitelistFile} whitelist.json
+          cp -f ${serverPropertiesFile} server.properties
+
+        else
+
+          # Declarative for the first time, backup stateful files
+          ln -sb --suffix=.stateful ${whitelistFile} whitelist.json
+          cp -b --suffix=.stateful ${serverPropertiesFile} server.properties
+
+          # server.properties must have write permissions, because every time
+          # the server starts it first parses the file and then regenerates it..
+          chmod +w server.properties
+          echo "Autogenerated file that signifies that this server configuration is managed declaratively by NixOS" \
+            > .declarative
+
+        fi
+      '' else ''
+        if [ -e .declarative ]; then
+          rm .declarative
+        fi
+      '');
    };

-    networking.firewall = mkIf cfg.openFirewall {
-      allowedUDPPorts = [ 25565 ];
-      allowedTCPPorts = [ 25565 ];
-    };
+    networking.firewall = mkIf cfg.openFirewall (if cfg.declarative then {
+      allowedUDPPorts = [ serverPort ];
+      allowedTCPPorts = [ serverPort ]
+        ++ optional (! isNull queryPort) queryPort
+        ++ optional (! isNull rconPort) rconPort;
+    } else {
+      allowedUDPPorts = [ defaultServerPort ];
+      allowedTCPPorts = [ defaultServerPort ];
+    });
+
+    assertions = [
+      { assertion = cfg.eula;
+        message = "You must agree to Mojangs EULA to run minecraft-server."
+          + " Read https://account.mojang.com/documents/minecraft_eula and"
+          + " set `services.minecraft-server.eula` to `true` if you agree.";
+      }
+    ];
+
  };
 }
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@ -25,6 +25,20 @@ in
      description = "Hostname to use for the nginx vhost";
    };

+    package = mkOption {
+      type = types.package;
+      default = pkgs.roundcube;
+
+      example = literalExample ''
+        roundcube.withPlugins (plugins: [ plugins.persistent_login ])
+      '';
+
+      description = ''
+        The package which contains roundcube's sources. Can be overriden to create
+        an environment which contains roundcube and third-party plugins.
+      '';
+    };
+
    database = {
      username = mkOption {
        type = types.str;
@ -86,7 +100,7 @@ in
          forceSSL = mkDefault true;
          enableACME = mkDefault true;
          locations."/" = {
-            root = pkgs.roundcube;
+            root = cfg.package;
            index = "index.php";
            extraConfig = ''
              location ~* \.php$ {
@ -140,12 +154,12 @@ in
            ${pkgs.sudo}/bin/sudo -u ${pgSuperUser} psql postgres -c "create database ${cfg.database.dbname} with owner ${cfg.database.username}";
          fi
          PGPASSWORD=${cfg.database.password} ${pkgs.postgresql}/bin/psql -U ${cfg.database.username} \
-            -f ${pkgs.roundcube}/SQL/postgres.initial.sql \
+            -f ${cfg.package}/SQL/postgres.initial.sql \
            -h ${cfg.database.host} ${cfg.database.dbname}
          touch /var/lib/roundcube/db-created
        fi

-        ${pkgs.php}/bin/php ${pkgs.roundcube}/bin/update.sh
+        ${pkgs.php}/bin/php ${cfg.package}/bin/update.sh
      '';
      serviceConfig.Type = "oneshot";
    };
--- a/nixos/modules/services/misc/docker-registry.nix
+++ b/nixos/modules/services/misc/docker-registry.nix
@ -18,7 +18,7 @@ let
      delete.enabled = cfg.enableDelete;
    };
    http = {
-      addr = ":${builtins.toString cfg.port}";
+      addr = "${cfg.listenAddress}:${builtins.toString cfg.port}";
      headers.X-Content-Type-Options = ["nosniff"];
    };
    health.storagedriver = {
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -497,7 +497,12 @@ in {
    systemd.services.gitaly = {
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
-      path = with pkgs; [ gitAndTools.git cfg.packages.gitaly.rubyEnv cfg.packages.gitaly.rubyEnv.wrappedRuby ];
+      path = with pkgs; [
+        openssh
+        gitAndTools.git
+        cfg.packages.gitaly.rubyEnv
+        cfg.packages.gitaly.rubyEnv.wrappedRuby
+      ];
      serviceConfig = {
        Type = "simple";
        User = cfg.user;
--- a/nixos/modules/services/misc/home-assistant.nix
+++ b/nixos/modules/services/misc/home-assistant.nix
@ -6,9 +6,18 @@ let
  cfg = config.services.home-assistant;

  # cfg.config != null can be assumed here
-  configFile = pkgs.writeText "configuration.json"
+  configJSON = pkgs.writeText "configuration.json"
    (builtins.toJSON (if cfg.applyDefaultConfig then
-    (lib.recursiveUpdate defaultConfig cfg.config) else cfg.config));
+    (recursiveUpdate defaultConfig cfg.config) else cfg.config));
+  configFile = pkgs.runCommand "configuration.yaml" { } ''
+    ${pkgs.remarshal}/bin/json2yaml -i ${configJSON} -o $out
+  '';
+
+  lovelaceConfigJSON = pkgs.writeText "ui-lovelace.json"
+    (builtins.toJSON cfg.lovelaceConfig);
+  lovelaceConfigFile = pkgs.runCommand "ui-lovelace.yaml" { } ''
+    ${pkgs.remarshal}/bin/json2yaml -i ${lovelaceConfigJSON} -o $out
+  '';

  availableComponents = pkgs.home-assistant.availableComponents;

@ -44,7 +53,9 @@ let
  # If you are changing this, please update the description in applyDefaultConfig
  defaultConfig = {
    homeassistant.time_zone = config.time.timeZone;
-    http.server_port = (toString cfg.port);
+    http.server_port = cfg.port;
+  } // optionalAttrs (cfg.lovelaceConfig != null) {
+    lovelace.mode = "yaml";
  };

 in {
@ -99,6 +110,53 @@ in {
      '';
    };

+    configWritable = mkOption {
+      default = false;
+      type = types.bool;
+      description = ''
+        Whether to make <filename>configuration.yaml</filename> writable.
+        This only has an effect if <option>config</option> is set.
+        This will allow you to edit it from Home Assistant's web interface.
+        However, bear in mind that it will be overwritten at every start of the service.
+      '';
+    };
+
+    lovelaceConfig = mkOption {
+      default = null;
+      type = with types; nullOr attrs;
+      # from https://www.home-assistant.io/lovelace/yaml-mode/
+      example = literalExample ''
+        {
+          title = "My Awesome Home";
+          views = [ {
+            title = "Example";
+            cards = [ {
+              type = "markdown";
+              title = "Lovelace";
+              content = "Welcome to your **Lovelace UI**.";
+            } ];
+          } ];
+        }
+      '';
+      description = ''
+        Your <filename>ui-lovelace.yaml</filename> as a Nix attribute set.
+        Setting this option will automatically add
+        <literal>lovelace.mode = "yaml";</literal> to your <option>config</option>.
+        Beware that setting this option will delete your previous <filename>ui-lovelace.yaml</filename>
+      '';
+    };
+
+    lovelaceConfigWritable = mkOption {
+      default = false;
+      type = types.bool;
+      description = ''
+        Whether to make <filename>ui-lovelace.yaml</filename> writable.
+        This only has an effect if <option>lovelaceConfig</option> is set.
+        This will allow you to edit it from Home Assistant's web interface.
+        However, bear in mind that it will be overwritten at every start of the service.
+      '';
+    };
+
    package = mkOption {
      default = pkgs.home-assistant;
      defaultText = "pkgs.home-assistant";
@ -144,12 +202,17 @@ in {
    systemd.services.home-assistant = {
      description = "Home Assistant";
      after = [ "network.target" ];
-      preStart = lib.optionalString (cfg.config != null) ''
-        config=${cfg.configDir}/configuration.yaml
-        rm -f $config
-        ${pkgs.remarshal}/bin/json2yaml -i ${configFile} -o $config
-        chmod 444 $config
-      '';
+      preStart = optionalString (cfg.config != null) (if cfg.configWritable then ''
+        cp --no-preserve=mode ${configFile} "${cfg.configDir}/configuration.yaml"
+      '' else ''
+        rm -f "${cfg.configDir}/configuration.yaml"
+        ln -s ${configFile} "${cfg.configDir}/configuration.yaml"
+      '') + optionalString (cfg.lovelaceConfig != null) (if cfg.lovelaceConfigWritable then ''
+        cp --no-preserve=mode ${lovelaceConfigFile} "${cfg.configDir}/ui-lovelace.yaml"
+      '' else ''
+        rm -f "${cfg.configDir}/ui-lovelace.yaml"
+        ln -s ${lovelaceConfigFile} "${cfg.configDir}/ui-lovelace.yaml"
+      '');
      serviceConfig = {
        ExecStart = "${package}/bin/hass --config '${cfg.configDir}'";
        User = "hass";
--- a/nixos/modules/services/misc/matrix-synapse.nix
+++ b/nixos/modules/services/misc/matrix-synapse.nix
@ -651,12 +651,16 @@ in {

    services.postgresql.enable = mkIf usePostgresql (mkDefault true);

-    systemd.services.matrix-synapse = {
+    systemd.services.matrix-synapse =
+    let
+      python = (pkgs.python3.withPackages (ps: with ps; [ (ps.toPythonModule cfg.package) ]));
+    in
+    {
      description = "Synapse Matrix homeserver";
      after = [ "network.target" "postgresql.service" ];
      wantedBy = [ "multi-user.target" ];
      preStart = ''
-        ${cfg.package}/bin/homeserver \
+        ${python.interpreter} -m synapse.app.homeserver \
          --config-path ${configFile} \
          --keys-directory ${cfg.dataDir} \
          --generate-keys
@ -687,10 +691,11 @@ in {
        WorkingDirectory = cfg.dataDir;
        PermissionsStartOnly = true;
        ExecStart = ''
-          ${cfg.package}/bin/homeserver \
+          ${python.interpreter} -m synapse.app.homeserver \
            ${ concatMapStringsSep "\n  " (x: "--config-path ${x} \\") ([ configFile ] ++ cfg.extraConfigFiles) }
            --keys-directory ${cfg.dataDir}
        '';
+        ExecReload = "${pkgs.utillinux}/bin/kill -HUP $MAINPID";
        Restart = "on-failure";
      };
    };
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@ -30,6 +30,13 @@ let
    ${cfg.extraConfig}
  '';

+  additionalEnvironment = pkgs.writeText "additional_environment.rb" ''
+    config.logger = Logger.new("${cfg.stateDir}/log/production.log", 14, 1048576)
+    config.logger.level = Logger::INFO
+
+    ${cfg.extraEnv}
+  '';
+
  unpackTheme = unpack "theme";
  unpackPlugin = unpack "plugin";
  unpack = id: (name: source:
@ -54,12 +61,20 @@ in
        description = "Enable the Redmine service.";
      };

+      # default to the 4.x series not forcing major version upgrade of those on the 3.x series
      package = mkOption {
        type = types.package;
-        default = pkgs.redmine;
+        default = if versionAtLeast config.system.stateVersion "19.03"
+          then pkgs.redmine_4
+          else pkgs.redmine
+        ;
        defaultText = "pkgs.redmine";
-        description = "Which Redmine package to use.";
-        example = "pkgs.redmine.override { ruby = pkgs.ruby_2_3; }";
+        description = ''
+          Which Redmine package to use. This defaults to version 3.x if
+          <literal>system.stateVersion &lt; 19.03</literal> and version 4.x
+          otherwise.
+        '';
+        example = "pkgs.redmine_4.override { ruby = pkgs.ruby_2_4; }";
      };

      user = mkOption {
@ -103,6 +118,19 @@ in
        '';
      };

+      extraEnv = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''
+          Extra configuration in additional_environment.rb.
+
+          See https://svn.redmine.org/redmine/trunk/config/additional_environment.rb.example
+        '';
+        example = literalExample ''
+          config.logger.level = Logger::DEBUG
+        '';
+      };
+
      themes = mkOption {
        type = types.attrsOf types.path;
        default = {};
@ -249,6 +277,9 @@ in
        # link in the application configuration
        ln -fs ${configurationYml} "${cfg.stateDir}/config/configuration.yml"

+        # link in the additional environment configuration
+        ln -fs ${additionalEnvironment} "${cfg.stateDir}/config/additional_environment.rb"
+

        # link in all user specified themes
        rm -rf "${cfg.stateDir}/public/themes/"*
--- a/nixos/modules/services/misc/weechat.xml
+++ b/nixos/modules/services/misc/weechat.xml
@ -8,7 +8,7 @@
  <link xlink:href="https://weechat.org/">WeeChat</link> is a fast and
  extensible IRC client.
 </para>
- <section>
+ <section xml:id="module-services-weechat-basic-usage">
  <title>Basic Usage</title>

  <para>
@ -35,7 +35,7 @@
   in the state directory <literal>/var/lib/weechat</literal>.
  </para>
 </section>
- <section>
+ <section xml:id="module-services-weechat-reattach">
  <title>Re-attaching to WeeChat</title>

  <para>
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@ -50,6 +50,158 @@ let
    SMTP_FROM_ADDRESS = cfg.smtp.fromAddress;
  } // cfg.extraOptions;

+  datasourceConfiguration = {
+    apiVersion = 1;
+    datasources = cfg.provision.datasources;
+  };
+
+  datasourceFile = pkgs.writeText "datasource.yaml" (builtins.toJSON datasourceConfiguration);
+
+  dashboardConfiguration = {
+    apiVersion = 1;
+    providers = cfg.provision.dashboards;
+  };
+
+  dashboardFile = pkgs.writeText "dashboard.yaml" (builtins.toJSON dashboardConfiguration);
+
+  provisionConfDir =  pkgs.runCommand "grafana-provisioning" { } ''
+    mkdir -p $out/{datasources,dashboards}
+    ln -sf ${datasourceFile} $out/datasources/datasource.yaml
+    ln -sf ${dashboardFile} $out/dashboards/dashboard.yaml
+  '';
+
+  # Get a submodule without any embedded metadata:
+  _filter = x: filterAttrs (k: v: k != "_module") x;
+
+  # http://docs.grafana.org/administration/provisioning/#datasources
+  grafanaTypes.datasourceConfig = types.submodule {
+    options = {
+      name = mkOption {
+        type = types.str;
+        description = "Name of the datasource. Required";
+      };
+      type = mkOption {
+        type = types.enum ["graphite" "prometheus" "cloudwatch" "elasticsearch" "influxdb" "opentsdb" "mysql" "mssql" "postgres" "loki"];
+        description = "Datasource type. Required";
+      };
+      access = mkOption {
+        type = types.enum ["proxy" "direct"];
+        default = "proxy";
+        description = "Access mode. proxy or direct (Server or Browser in the UI). Required";
+      };
+      orgId = mkOption {
+        type = types.int;
+        default = 1;
+        description = "Org id. will default to orgId 1 if not specified";
+      };
+      url = mkOption {
+        type = types.str;
+        description = "Url of the datasource";
+      };
+      password = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = "Database password, if used";
+      };
+      user = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = "Database user, if used";
+      };
+      database = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = "Database name, if used";
+      };
+      basicAuth = mkOption {
+        type = types.nullOr types.bool;
+        default = null;
+        description = "Enable/disable basic auth";
+      };
+      basicAuthUser = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = "Basic auth username";
+      };
+      basicAuthPassword = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = "Basic auth password";
+      };
+      withCredentials = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Enable/disable with credentials headers";
+      };
+      isDefault = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Mark as default datasource. Max one per org";
+      };
+      jsonData = mkOption {
+        type = types.nullOr types.attrs;
+        default = null;
+        description = "Datasource specific configuration";
+      };
+      secureJsonData = mkOption {
+        type = types.nullOr types.attrs;
+        default = null;
+        description = "Datasource specific secure configuration";
+      };
+      version = mkOption {
+        type = types.int;
+        default = 1;
+        description = "Version";
+      };
+      editable = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Allow users to edit datasources from the UI.";
+      };
+    };
+  };
+
+  # http://docs.grafana.org/administration/provisioning/#dashboards
+  grafanaTypes.dashboardConfig = types.submodule {
+    options = {
+      name = mkOption {
+        type = types.str;
+        default = "default";
+        description = "Provider name";
+      };
+      orgId = mkOption {
+        type = types.int;
+        default = 1;
+        description = "Organization ID";
+      };
+      folder = mkOption {
+        type = types.str;
+        default = "";
+        description = "Add dashboards to the speciied folder";
+      };
+      type = mkOption {
+        type = types.str;
+        default = "file";
+        description = "Dashboard provider type";
+      };
+      disableDeletion = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Disable deletion when JSON file is removed";
+      };
+      updateIntervalSeconds = mkOption {
+        type = types.int;
+        default = 10;
+        description = "How often Grafana will scan for changed dashboards";
+      };
+      options = {
+        path = mkOption {
+          type = types.path;
+          description = "Path grafana will watch for dashboards";
+        };
+      };
+    };
+  };
 in {
  options.services.grafana = {
    enable = mkEnableOption "grafana";
@ -175,6 +327,22 @@ in {
      };
    };

+    provision = {
+      enable = mkEnableOption "provision";
+      datasources = mkOption {
+        description = "Grafana datasources configuration";
+        default = [];
+        type = types.listOf grafanaTypes.datasourceConfig;
+        apply = x: map _filter x;
+      };
+      dashboards = mkOption {
+        description = "Grafana dashboard configuration";
+        default = [];
+        type = types.listOf grafanaTypes.dashboardConfig;
+        apply = x: map _filter x;
+      };
+    };
+
    security = {
      adminUser = mkOption {
        description = "Default admin username.";
@ -313,10 +481,15 @@ in {
  };

  config = mkIf cfg.enable {
-    warnings = optional (
-      cfg.database.password != opt.database.password.default ||
-      cfg.security.adminPassword != opt.security.adminPassword.default
-    ) "Grafana passwords will be stored as plaintext in the Nix store!";
+    warnings = flatten [
+      (optional (
+        cfg.database.password != opt.database.password.default ||
+        cfg.security.adminPassword != opt.security.adminPassword.default
+      ) "Grafana passwords will be stored as plaintext in the Nix store!")
+      (optional (
+        any (x: x.password != null || x.basicAuthPassword != null || x.secureJsonData != null) cfg.provision.datasources
+      ) "Datasource passwords will be stored as plaintext in the Nix store!")
+    ];

    environment.systemPackages = [ cfg.package ];

@ -359,6 +532,9 @@ in {
        ${optionalString (cfg.smtp.passwordFile != null) ''
          export GF_SMTP_PASSWORD="$(cat ${escapeShellArg cfg.smtp.passwordFile})"
        ''}
+        ${optionalString cfg.provision.enable ''
+          export GF_PATHS_PROVISIONING=${provisionConfDir};
+        ''}
        exec ${cfg.package.bin}/bin/grafana-server -homepath ${cfg.dataDir}
      '';
      serviceConfig = {
--- a/nixos/modules/services/monitoring/munin.nix
+++ b/nixos/modules/services/monitoring/munin.nix
@ -4,7 +4,7 @@
 # TODO: LWP/Pg perl libs aren't recognized

 # TODO: support fastcgi
-# http://munin-monitoring.org/wiki/CgiHowto2
+# http://guide.munin-monitoring.org/en/latest/example/webserver/apache-cgi.html
 # spawn-fcgi -s /run/munin/fastcgi-graph.sock -U www-data   -u munin -g munin /usr/lib/munin/cgi/munin-cgi-graph
 # spawn-fcgi -s /run/munin/fastcgi-html.sock  -U www-data   -u munin -g munin /usr/lib/munin/cgi/munin-cgi-html
 # https://paste.sh/vofcctHP#-KbDSXVeWoifYncZmLfZzgum
@ -24,6 +24,8 @@ let
      logdir    /var/log/munin
      rundir    /run/munin

+      ${lib.optionalString (cronCfg.extraCSS != "") "staticdir ${customStaticDir}"}
+
      ${cronCfg.extraGlobalConfig}

      ${cronCfg.hosts}
@ -63,6 +65,11 @@ let
      [ipmi*]
      user root
      group root
+
+      [munin*]
+      env.UPDATE_STATSFILE /var/lib/munin/munin-update.stats
+
+      ${nodeCfg.extraPluginConfig}
    '';

  pluginConfDir = pkgs.stdenv.mkDerivation {
@ -72,6 +79,54 @@ let
      ln -s ${pluginConf} $out/nixos-config
    '';
  };
+
+  # Copy one Munin plugin into the Nix store with a specific name.
+  # This is suitable for use with plugins going directly into /etc/munin/plugins,
+  # i.e. munin.extraPlugins.
+  internOnePlugin = name: path:
+    "cp -a '${path}' '${name}'";
+
+  # Copy an entire tree of Munin plugins into a single directory in the Nix
+  # store, with no renaming.
+  # This is suitable for use with munin-node-configure --suggest, i.e.
+  # munin.extraAutoPlugins.
+  internManyPlugins = name: path:
+    "find '${path}' -type f -perm /a+x -exec cp -a -t . '{}' '+'";
+
+  # Use the appropriate intern-fn to copy the plugins into the store and patch
+  # them afterwards in an attempt to get them to run on NixOS.
+  internAndFixPlugins = name: intern-fn: paths:
+    pkgs.runCommand name {} ''
+      mkdir -p "$out"
+      cd "$out"
+      ${lib.concatStringsSep "\n"
+          (lib.attrsets.mapAttrsToList intern-fn paths)}
+      chmod -R u+w .
+      find . -type f -exec sed -E -i '
+        s,(/usr)?/s?bin/,/run/current-system/sw/bin/,g
+      ' '{}' '+'
+    '';
+
+  # TODO: write a derivation for munin-contrib, so that for contrib plugins
+  # you can just refer to them by name rather than needing to include a copy
+  # of munin-contrib in your nixos configuration.
+  extraPluginDir = internAndFixPlugins "munin-extra-plugins.d"
+    internOnePlugin nodeCfg.extraPlugins;
+
+  extraAutoPluginDir = internAndFixPlugins "munin-extra-auto-plugins.d"
+    internManyPlugins
+    (builtins.listToAttrs
+      (map
+        (path: { name = baseNameOf path; value = path; })
+        nodeCfg.extraAutoPlugins));
+
+  customStaticDir = pkgs.runCommand "munin-custom-static-data" {} ''
+    cp -a "${pkgs.munin}/etc/opt/munin/static" "$out"
+    cd "$out"
+    chmod -R u+w .
+    echo "${cronCfg.extraCSS}" >> style.css
+    echo "${cronCfg.extraCSS}" >> style-new.css
+  '';
 in

 {
@ -82,11 +137,12 @@ in

      enable = mkOption {
        default = false;
+        type = types.bool;
        description = ''
          Enable Munin Node agent. Munin node listens on 0.0.0.0 and
          by default accepts connections only from 127.0.0.1 for security reasons.

-          See <link xlink:href='http://munin-monitoring.org/wiki/munin-node.conf' />.
+          See <link xlink:href='http://guide.munin-monitoring.org/en/latest/architecture/index.html' />.
        '';
      };

@ -95,18 +151,108 @@ in
        type = types.lines;
        description = ''
          <filename>munin-node.conf</filename> extra configuration. See
-          <link xlink:href='http://munin-monitoring.org/wiki/munin-node.conf' />
+          <link xlink:href='http://guide.munin-monitoring.org/en/latest/reference/munin-node.conf.html' />
        '';
      };

-      # TODO: add option to add additional plugins
+      extraPluginConfig = mkOption {
+        default = "";
+        type = types.lines;
+        description = ''
+          <filename>plugin-conf.d</filename> extra plugin configuration. See
+          <link xlink:href='http://guide.munin-monitoring.org/en/latest/plugin/use.html' />
+        '';
+        example = ''
+          [fail2ban_*]
+          user root
+        '';
+      };

+      extraPlugins = mkOption {
+        default = {};
+        type = with types; attrsOf path;
+        description = ''
+          Additional Munin plugins to activate. Keys are the name of the plugin
+          symlink, values are the path to the underlying plugin script. You
+          can use the same plugin script multiple times (e.g. for wildcard
+          plugins).
+
+          Note that these plugins do not participate in autoconfiguration. If
+          you want to autoconfigure additional plugins, use
+          <option>services.munin-node.extraAutoPlugins</option>.
+
+          Plugins enabled in this manner take precedence over autoconfigured
+          plugins.
+
+          Plugins will be copied into the Nix store, and it will attempt to
+          modify them to run properly by fixing hardcoded references to
+          <literal>/bin</literal>, <literal>/usr/bin</literal>,
+          <literal>/sbin</literal>, and <literal>/usr/sbin</literal>.
+        '';
+        example = literalExample ''
+          {
+            zfs_usage_bigpool = /src/munin-contrib/plugins/zfs/zfs_usage_;
+            zfs_usage_smallpool = /src/munin-contrib/plugins/zfs/zfs_usage_;
+            zfs_list = /src/munin-contrib/plugins/zfs/zfs_list;
+          };
+        '';
+      };
+
+      extraAutoPlugins = mkOption {
+        default = [];
+        type = with types; listOf path;
+        description = ''
+          Additional Munin plugins to autoconfigure, using
+          <literal>munin-node-configure --suggest</literal>. These should be
+          the actual paths to the plugin files (or directories containing them),
+          not just their names.
+
+          If you want to manually enable individual plugins instead, use
+          <option>services.munin-node.extraPlugins</option>.
+
+          Note that only plugins that have the 'autoconfig' capability will do
+          anything if listed here, since plugins that cannot autoconfigure
+          won't be automatically enabled by
+          <literal>munin-node-configure</literal>.
+
+          Plugins will be copied into the Nix store, and it will attempt to
+          modify them to run properly by fixing hardcoded references to
+          <literal>/bin</literal>, <literal>/usr/bin</literal>,
+          <literal>/sbin</literal>, and <literal>/usr/sbin</literal>.
+        '';
+        example = literalExample ''
+          [
+            /src/munin-contrib/plugins/zfs
+            /src/munin-contrib/plugins/ssh
+          ];
+        '';
+      };
+
+      disabledPlugins = mkOption {
+        # TODO: figure out why Munin isn't writing the log file and fix it.
+        # In the meantime this at least suppresses a useless graph full of
+        # NaNs in the output.
+        default = [ "munin_stats" ];
+        type = with types; listOf string;
+        description = ''
+          Munin plugins to disable, even if
+          <literal>munin-node-configure --suggest</literal> tries to enable
+          them. To disable a wildcard plugin, use an actual wildcard, as in
+          the example.
+
+          munin_stats is disabled by default as it tries to read
+          <literal>/var/log/munin/munin-update.log</literal> for timing
+          information, and the NixOS build of Munin does not write this file.
+        '';
+        example = [ "diskstats" "zfs_usage_*" ];
+      };
    };

    services.munin-cron = {

      enable = mkOption {
        default = false;
+        type = types.bool;
        description = ''
          Enable munin-cron. Takes care of all heavy lifting to collect data from
          nodes and draws graphs to html. Runs munin-update, munin-limits,
@ -119,11 +265,12 @@ in

      extraGlobalConfig = mkOption {
        default = "";
+        type = types.lines;
        description = ''
          <filename>munin.conf</filename> extra global configuration.
-          See <link xlink:href='http://munin-monitoring.org/wiki/munin.conf' />.
+          See <link xlink:href='http://guide.munin-monitoring.org/en/latest/reference/munin.conf.html' />.
          Useful to setup notifications, see
-          <link xlink:href='http://munin-monitoring.org/wiki/HowToContact' />
+          <link xlink:href='http://guide.munin-monitoring.org/en/latest/tutorial/alert.html' />
        '';
        example = ''
          contact.email.command mail -s "Munin notification for ''${var:host}" someone@example.com
@ -131,14 +278,34 @@ in
      };

      hosts = mkOption {
+        default = "";
+        type = types.lines;
+        description = ''
+          Definitions of hosts of nodes to collect data from. Needs at least one
+          host for cron to succeed. See
+          <link xlink:href='http://guide.munin-monitoring.org/en/latest/reference/munin.conf.html' />
+        '';
        example = ''
          [''${config.networking.hostName}]
          address localhost
        '';
+      };
+
+      extraCSS = mkOption {
+        default = "";
+        type = types.lines;
        description = ''
-          Definitions of hosts of nodes to collect data from. Needs at least one
-          hosts for cron to succeed. See
-          <link xlink:href='http://munin-monitoring.org/wiki/munin.conf' />
+          Custom styling for the HTML that munin-cron generates. This will be
+          appended to the CSS files used by munin-cron and will thus take
+          precedence over the builtin styles.
+        '';
+        example = ''
+          /* A simple dark theme. */
+          html, body { background: #222222; }
+          #header, #footer { background: #333333; }
+          img.i, img.iwarn, img.icrit, img.iunkn {
+            filter: invert(100%) hue-rotate(-30deg);
+          }
        '';
      };

@ -155,6 +322,7 @@ in
      description = "Munin monitoring user";
      group = "munin";
      uid = config.ids.uids.munin;
+      home = "/var/lib/munin";
    }];

    users.groups = [{
@ -173,14 +341,27 @@ in
      environment.MUNIN_PLUGSTATE = "/run/munin";
      environment.MUNIN_LOGDIR = "/var/log/munin";
      preStart = ''
-        echo "updating munin plugins..."
+        echo "Updating munin plugins..."

        mkdir -p /etc/munin/plugins
        rm -rf /etc/munin/plugins/*
+
+        # Autoconfigure builtin plugins
        ${pkgs.munin}/bin/munin-node-configure --suggest --shell --families contrib,auto,manual --config ${nodeConf} --libdir=${pkgs.munin}/lib/plugins --servicedir=/etc/munin/plugins --sconfdir=${pluginConfDir} 2>/dev/null | ${pkgs.bash}/bin/bash

-        # NOTE: we disable disktstats because plugin seems to fail and it hangs html generation (100% CPU + memory leak)
-        rm /etc/munin/plugins/diskstats || true
+        # Autoconfigure extra plugins
+        ${pkgs.munin}/bin/munin-node-configure --suggest --shell --families contrib,auto,manual --config ${nodeConf} --libdir=${extraAutoPluginDir} --servicedir=/etc/munin/plugins --sconfdir=${pluginConfDir} 2>/dev/null | ${pkgs.bash}/bin/bash
+
+        ${lib.optionalString (nodeCfg.extraPlugins != {}) ''
+            # Link in manually enabled plugins
+            ln -f -s -t /etc/munin/plugins ${extraPluginDir}/*
+          ''}
+
+        ${lib.optionalString (nodeCfg.disabledPlugins != []) ''
+            # Disable plugins
+            cd /etc/munin/plugins
+            rm -f ${toString nodeCfg.disabledPlugins}
+          ''}
      '';
      serviceConfig = {
        ExecStart = "${pkgs.munin}/sbin/munin-node --config ${nodeConf} --servicedir /etc/munin/plugins/ --sconfdir=${pluginConfDir}";
@ -192,6 +373,10 @@ in

  }) (mkIf cronCfg.enable {

+    # Munin is hardcoded to use DejaVu Mono and the graphs come out wrong if
+    # it's not available.
+    fonts.fonts = [ pkgs.dejavu_fonts ];
+
    systemd.timers.munin-cron = {
      description = "batch Munin master programs";
      wantedBy = [ "timers.target" ];
--- a/nixos/modules/services/networking/ndppd.nix
+++ b/nixos/modules/services/networking/ndppd.nix
@ -5,43 +5,163 @@ with lib;
 let
  cfg = config.services.ndppd;

-  configFile = pkgs.runCommand "ndppd.conf" {} ''
-    substitute ${pkgs.ndppd}/etc/ndppd.conf $out \
-      --replace eth0 ${cfg.interface} \
-      --replace 1111:: ${cfg.network}
-  '';
-in {
-  options = {
-    services.ndppd = {
-      enable = mkEnableOption "daemon that proxies NDP (Neighbor Discovery Protocol) messages between interfaces";
+  render = s: f: concatStringsSep "\n" (mapAttrsToList f s);
+  prefer = a: b: if a != null then a else b;
+
+  ndppdConf = prefer cfg.configFile (pkgs.writeText "ndppd.conf" ''
+    route-ttl ${toString cfg.routeTTL}
+    ${render cfg.proxies (proxyInterfaceName: proxy: ''
+    proxy ${prefer proxy.interface proxyInterfaceName} {
+      router ${boolToString proxy.router}
+      timeout ${toString proxy.timeout}
+      ttl ${toString proxy.ttl}
+      ${render proxy.rules (ruleNetworkName: rule: ''
+      rule ${prefer rule.network ruleNetworkName} {
+        ${rule.method}${if rule.method == "iface" then " ${rule.interface}" else ""}
+      }'')}
+    }'')}
+  '');
+
+  proxy = types.submodule {
+    options = {
      interface = mkOption {
-        type = types.string;
-        default = "eth0";
-        example = "ens3";
-        description = "Interface which is on link-level with router.";
-      };
-      network = mkOption {
-        type = types.string;
-        default = "1111::";
-        example = "2001:DB8::/32";
-        description = "Network that we proxy.";
-      };
-      configFile = mkOption {
-        type = types.nullOr types.path;
+        type = types.nullOr types.str;
+        description = ''
+          Listen for any Neighbor Solicitation messages on this interface,
+          and respond to them according to a set of rules.
+          Defaults to the name of the attrset.
+        '';
        default = null;
-        description = "Path to configuration file.";
      };
+      router = mkOption {
+        type = types.bool;
+        description = ''
+          Turns on or off the router flag for Neighbor Advertisement Messages.
+        '';
+        default = true;
+      };
+      timeout = mkOption {
+        type = types.int;
+        description = ''
+          Controls how long to wait for a Neighbor Advertisment Message before 
+          invalidating the entry, in milliseconds.
+        '';
+        default = 500;
+      };
+      ttl = mkOption {
+        type = types.int;
+        description = ''
+          Controls how long a valid or invalid entry remains in the cache, in 
+          milliseconds.
+        '';
+        default = 30000;
+      };
+      rules = mkOption {
+        type = types.attrsOf rule;
+        description = ''
+          This is a rule that the target address is to match against. If no netmask
+          is provided, /128 is assumed. You may have several rule sections, and the
+          addresses may or may not overlap.
+        '';
+        default = {};
+      };
+    };
+  };
+
+  rule = types.submodule {
+    options = {
+      network = mkOption {
+        type = types.nullOr types.str;
+        description = ''
+          This is the target address is to match against. If no netmask
+          is provided, /128 is assumed. The addresses of serveral rules
+          may or may not overlap.
+          Defaults to the name of the attrset.
+        '';
+        default = null;
+      };
+      method = mkOption {
+        type = types.enum [ "static" "iface" "auto" ];
+        description = ''
+          static: Immediately answer any Neighbor Solicitation Messages
+            (if they match the IP rule).
+          iface: Forward the Neighbor Solicitation Message through the specified
+            interface and only respond if a matching Neighbor Advertisement
+            Message is received.
+          auto: Same as iface, but instead of manually specifying the outgoing
+            interface, check for a matching route in /proc/net/ipv6_route.
+        '';
+        default = "auto";
+      };
+      interface = mkOption {
+        type = types.nullOr types.str;
+        description = "Interface to use when method is iface.";
+        default = null;
+      };
+    };
+  };
+
+in {
+  options.services.ndppd = {
+    enable = mkEnableOption "daemon that proxies NDP (Neighbor Discovery Protocol) messages between interfaces";
+    interface = mkOption {
+      type = types.nullOr types.str;
+      description = ''
+        Interface which is on link-level with router.
+        (Legacy option, use services.ndppd.proxies.&lt;interface&gt;.rules.&lt;network&gt; instead)
+      '';
+      default = null;
+      example = "eth0";
+    };
+    network = mkOption {
+      type = types.nullOr types.str;
+      description = ''
+        Network that we proxy.
+        (Legacy option, use services.ndppd.proxies.&lt;interface&gt;.rules.&lt;network&gt; instead)
+      '';
+      default = null;
+      example = "1111::/64";
+    };
+    configFile = mkOption {
+      type = types.nullOr types.path;
+      description = "Path to configuration file.";
+      default = null;
+    };
+    routeTTL = mkOption {
+      type = types.int;
+      description = ''
+        This tells 'ndppd' how often to reload the route file /proc/net/ipv6_route,
+        in milliseconds.
+      '';
+      default = 30000;
+    };
+    proxies = mkOption {
+      type = types.attrsOf proxy;
+      description = ''
+        This sets up a listener, that will listen for any Neighbor Solicitation
+        messages, and respond to them according to a set of rules.
+      '';
+      default = {};
+      example = { "eth0".rules."1111::/64" = {}; };
    };
  };

  config = mkIf cfg.enable {
-    systemd.packages = [ pkgs.ndppd ];
-    environment.etc."ndppd.conf".source = if (cfg.configFile != null) then cfg.configFile else configFile;
+    warnings = mkIf (cfg.interface != null && cfg.network != null) [ ''
+      The options services.ndppd.interface and services.ndppd.network will probably be removed soon,
+      please use services.ndppd.proxies.<interface>.rules.<network> instead.
+    '' ];
+
+    services.ndppd.proxies = mkIf (cfg.interface != null && cfg.network != null) {
+      "${cfg.interface}".rules."${cfg.network}" = {};
+    };
+
    systemd.services.ndppd = {
-      serviceConfig.RuntimeDirectory = [ "ndppd" ];
+      description = "NDP Proxy Daemon";
+      documentation = [ "man:ndppd(1)" "man:ndppd.conf(5)" ];
+      after = [ "network-pre.target" ];
      wantedBy = [ "multi-user.target" ];
+      serviceConfig.ExecStart = "${pkgs.ndppd}/bin/ndppd -c ${ndppdConf}";
    };
  };
-
-  meta.maintainers = with maintainers; [ gnidorah ];
 }
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@ -122,7 +122,7 @@ in {

    systemd.packages = [ pkgs.syncthing ];

-    users = mkIf (cfg.user == defaultUser) {
+    users = mkIf (cfg.systemService && cfg.user == defaultUser) {
      users."${defaultUser}" =
        { group = cfg.group;
          home  = cfg.dataDir;
--- a/nixos/modules/services/networking/unifi.nix
+++ b/nixos/modules/services/networking/unifi.nix
@ -121,11 +121,12 @@ in
    };

    networking.firewall = mkIf cfg.openPorts {
-      # https://help.ubnt.com/hc/en-us/articles/204910084-UniFi-Change-Default-Ports-for-Controller-and-UAPs
+      # https://help.ubnt.com/hc/en-us/articles/218506997
      allowedTCPPorts = [
        8080  # Port for UAP to inform controller.
        8880  # Port for HTTP portal redirect, if guest portal is enabled.
        8843  # Port for HTTPS portal redirect, ditto.
+        6789  # Port for UniFi mobile speed test.
      ];
      allowedUDPPorts = [
        3478  # UDP port used for STUN.
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -426,7 +426,7 @@ in {
              "~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\\.php(?:$|/)" = {
                priority = 500;
                extraConfig = ''
-                  include ${pkgs.nginxMainline}/conf/fastcgi.conf;
+                  include ${config.services.nginx.package}/conf/fastcgi.conf;
                  fastcgi_split_path_info ^(.+\.php)(/.*)$;
                  fastcgi_param PATH_INFO $fastcgi_path_info;
                  fastcgi_param HTTPS ${if cfg.https then "on" else "off"};
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix
@ -6,12 +6,14 @@ let

  dmcfg = config.services.xserver.displayManager;
  ldmcfg = dmcfg.lightdm;
+  xcfg = config.services.xserver;
  cfg = ldmcfg.greeters.gtk;

  inherit (pkgs) writeText;

  theme = cfg.theme.package;
  icons = cfg.iconTheme.package;
+  cursors = cfg.cursorTheme.package;

  # The default greeter provided with this expression is the GTK greeter.
  # Again, we need a few things in the environment for the greeter to run with
@ -28,7 +30,8 @@ let
        --set GTK_EXE_PREFIX "${theme}" \
        --set GTK_DATA_PREFIX "${theme}" \
        --set XDG_DATA_DIRS "${theme}/share:${icons}/share" \
-        --set XDG_CONFIG_HOME "${theme}/share"
+        --set XDG_CONFIG_HOME "${theme}/share" \
+        --set XCURSOR_PATH "${cursors}/share/icons"

      cat - > $out/lightdm-gtk-greeter.desktop << EOF
      [Desktop Entry]
@ -44,9 +47,12 @@ let
    [greeter]
    theme-name = ${cfg.theme.name}
    icon-theme-name = ${cfg.iconTheme.name}
+    cursor-theme-name = ${cfg.cursorTheme.name}
+    cursor-theme-size = ${toString cfg.cursorTheme.size}
    background = ${ldmcfg.background}
    ${optionalString (cfg.clock-format != null) "clock-format = ${cfg.clock-format}"}
    ${optionalString (cfg.indicators != null) "indicators = ${concatStringsSep ";" cfg.indicators}"}
+    ${optionalString (xcfg.dpi != null) "xft-dpi=${toString xcfg.dpi}"}
    ${cfg.extraConfig}
    '';

@ -106,6 +112,33 @@ in

      };

+      cursorTheme = {
+
+        package = mkOption {
+          default = pkgs.gnome3.defaultIconTheme;
+          defaultText = "pkgs.gnome3.defaultIconTheme";
+          description = ''
+            The package path that contains the cursor theme given in the name option.
+          '';
+        };
+
+        name = mkOption {
+          type = types.str;
+          default = "Adwaita";
+          description = ''
+            Name of the cursor theme to use for the lightdm-gtk-greeter.
+          '';
+        };
+
+        size = mkOption {
+          type = types.int;
+          default = 16;
+          description = ''
+            Size of the cursor theme to use for the lightdm-gtk-greeter.
+          '';
+        };
+      };
+
      clock-format = mkOption {
        type = types.nullOr types.str;
        default = null;
--- a/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix
+++ b/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix
@ -33,7 +33,7 @@ let
      avoid_warnings=1
    '' + optional isAarch64 ''
      # Boot in 64-bit mode.
-      arm_control=0x200
+      arm_64bit=1
    '' + (if cfg.uboot.enable then ''
      kernel=u-boot-rpi.bin
    '' else ''
--- a/nixos/modules/tasks/auto-upgrade.nix
+++ b/nixos/modules/tasks/auto-upgrade.nix
@ -78,7 +78,7 @@ let cfg = config.system.autoUpgrade; in
          HOME = "/root";
        } // config.networking.proxy.envVars;

-      path = [ pkgs.gnutar pkgs.xz.bin config.nix.package.out ];
+      path = [ pkgs.gnutar pkgs.xz.bin pkgs.gitMinimal config.nix.package.out ];

      script = ''
        ${config.system.build.nixos-rebuild}/bin/nixos-rebuild switch ${toString cfg.flags}
--- a/nixos/modules/tasks/encrypted-devices.nix
+++ b/nixos/modules/tasks/encrypted-devices.nix
@ -19,21 +19,21 @@ let
        description = "The block device is backed by an encrypted one, adds this device as a initrd luks entry.";
      };

-      options.blkDev = mkOption {
+      blkDev = mkOption {
        default = null;
        example = "/dev/sda1";
        type = types.nullOr types.str;
        description = "Location of the backing encrypted device.";
      };

-      options.label = mkOption {
+      label = mkOption {
        default = null;
        example = "rootfs";
        type = types.nullOr types.str;
        description = "Label of the unlocked encrypted device. Set <literal>fileSystems.&lt;name?&gt;.device</literal> to <literal>/dev/mapper/&lt;label&gt;</literal> to mount the unlocked device.";
      };

-      options.keyFile = mkOption {
+      keyFile = mkOption {
        default = null;
        example = "/mnt-root/root/.swapkey";
        type = types.nullOr types.str;
--- a/nixos/modules/tasks/filesystems.nix
+++ b/nixos/modules/tasks/filesystems.nix
@ -231,7 +231,7 @@ in
        fsToSkipCheck = [ "none" "bindfs" "btrfs" "zfs" "tmpfs" "nfs" "vboxsf" "glusterfs" ];
        skipCheck = fs: fs.noCheck || fs.device == "none" || builtins.elem fs.fsType fsToSkipCheck;
        # https://wiki.archlinux.org/index.php/fstab#Filepath_spaces
-        escape = string: builtins.replaceStrings [ " " ] [ "\\040" ] string;
+        escape = string: builtins.replaceStrings [ " " "\t" ] [ "\\040" "\\011" ] string;
      in ''
        # This is a generated file.  Do not edit!
        #
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -129,6 +129,7 @@ in
  matrix-synapse = handleTest ./matrix-synapse.nix {};
  memcached = handleTest ./memcached.nix {};
  mesos = handleTest ./mesos.nix {};
+  minio = handleTest ./minio.nix {};
  misc = handleTest ./misc.nix {};
  mongodb = handleTest ./mongodb.nix {};
  morty = handleTest ./morty.nix {};
@ -142,6 +143,8 @@ in
  nat.firewall = handleTest ./nat.nix { withFirewall = true; };
  nat.firewall-conntrack = handleTest ./nat.nix { withFirewall = true; withConntrackHelpers = true; };
  nat.standalone = handleTest ./nat.nix { withFirewall = false; };
+  ndppd = handleTest ./ndppd.nix {};
+  neo4j = handleTest ./neo4j.nix {};
  netdata = handleTest ./netdata.nix {};
  networking.networkd = handleTest ./networking.nix { networkd = true; };
  networking.scripted = handleTest ./networking.nix { networkd = false; };
@ -161,6 +164,7 @@ in
  opensmtpd = handleTest ./opensmtpd.nix {};
  openssh = handleTest ./openssh.nix {};
  osquery = handleTest ./osquery.nix {};
+  osrm-backend = handleTest ./osrm-backend.nix {};
  ostree = handleTest ./ostree.nix {};
  pam-oath-login = handleTest ./pam-oath-login.nix {};
  pam-u2f = handleTest ./pam-u2f.nix {};
--- a/nixos/tests/home-assistant.nix
+++ b/nixos/tests/home-assistant.nix
@ -50,6 +50,18 @@ in {
              }
            ];
          };
+          lovelaceConfig = {
+            title = "My Awesome Home";
+            views = [ {
+              title = "Example";
+              cards = [ {
+                type = "markdown";
+                title = "Lovelace";
+                content = "Welcome to your **Lovelace UI**.";
+              } ];
+            } ];
+          };
+          lovelaceConfigWritable = true;
        };
      };
  };
@ -59,8 +71,10 @@ in {
    $hass->waitForUnit("home-assistant.service");

    # The config is specified using a Nix attribute set,
-    # but then converted from JSON to YAML
-    $hass->succeed("test -f ${configDir}/configuration.yaml");
+    # converted from JSON to YAML, and linked to the config dir
+    $hass->succeed("test -L ${configDir}/configuration.yaml");
+    # The lovelace config is copied because lovelaceConfigWritable = true
+    $hass->succeed("test -f ${configDir}/ui-lovelace.yaml");

    # Check that Home Assistant's web interface and API can be reached
    $hass->waitForOpenPort(8123);
--- a/nixos/tests/hydra/default.nix
+++ b/nixos/tests/hydra/default.nix
@ -1,77 +1,91 @@
-import ../make-test.nix ({ pkgs, ...} :
+{ system ? builtins.currentSystem
+, config ? { }
+, pkgs ? import ../../.. { inherit system config; }
+}:

 let
-   trivialJob = pkgs.writeTextDir "trivial.nix" ''
-     { trivial = builtins.derivation {
-         name = "trivial";
-         system = "x86_64-linux";
-         builder = "/bin/sh";
-         args = ["-c" "echo success > $out; exit 0"];
-       };
-     }
-   '';

-    createTrivialProject = pkgs.stdenv.mkDerivation {
-      name = "create-trivial-project";
-      unpackPhase = ":";
-      buildInputs = [ pkgs.makeWrapper ];
-      installPhase = "install -m755 -D ${./create-trivial-project.sh} $out/bin/create-trivial-project.sh";
-      postFixup = ''
-        wrapProgram "$out/bin/create-trivial-project.sh" --prefix PATH ":" ${pkgs.stdenv.lib.makeBinPath [ pkgs.curl ]} --set EXPR_PATH ${trivialJob}
-      '';
-    };
+  trivialJob = pkgs.writeTextDir "trivial.nix" ''
+   { trivial = builtins.derivation {
+       name = "trivial";
+       system = "x86_64-linux";
+       builder = "/bin/sh";
+       args = ["-c" "echo success > $out; exit 0"];
+     };
+   }
+  '';

-in {
-  name = "hydra-init-localdb";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ pstn lewo ma27 ];
+  createTrivialProject = pkgs.stdenv.mkDerivation {
+    name = "create-trivial-project";
+    unpackPhase = ":";
+    buildInputs = [ pkgs.makeWrapper ];
+    installPhase = "install -m755 -D ${./create-trivial-project.sh} $out/bin/create-trivial-project.sh";
+    postFixup = ''
+      wrapProgram "$out/bin/create-trivial-project.sh" --prefix PATH ":" ${pkgs.stdenv.lib.makeBinPath [ pkgs.curl ]} --set EXPR_PATH ${trivialJob}
+    '';
  };

-  machine =
-    { pkgs, ... }:
+  callTest = f: f { inherit system pkgs; };

-    {
-      virtualisation.memorySize = 1024;
-      time.timeZone = "UTC";
+  hydraPkgs = {
+    inherit (pkgs) nixStable nixUnstable;
+  };

-      environment.systemPackages = [ createTrivialProject pkgs.jq ];
-      services.hydra = {
-        enable = true;
+  tests = pkgs.lib.flip pkgs.lib.mapAttrs hydraPkgs (name: nix:
+    callTest (import ../make-test.nix ({ pkgs, lib, ... }:
+      {
+        name = "hydra-with-${name}";
+        meta = with pkgs.stdenv.lib.maintainers; {
+          maintainers = [ pstn lewo ma27 ];
+        };

-        #Hydra needs those settings to start up, so we add something not harmfull.
-        hydraURL = "example.com";
-        notificationSender = "example@example.com";
-      };
-      nix = {
-        buildMachines = [{
-          hostName = "localhost";
-          systems = [ "x86_64-linux" ];
-        }];
+        machine = { pkgs, ... }:
+          {
+            virtualisation.memorySize = 1024;
+            time.timeZone = "UTC";

-        binaryCaches = [];
-      };
-    };
+            environment.systemPackages = [ createTrivialProject pkgs.jq ];
+            services.hydra = {
+              enable = true;

-  testScript =
-    ''
-      # let the system boot up
-      $machine->waitForUnit("multi-user.target");
-      # test whether the database is running
-      $machine->succeed("systemctl status postgresql.service");
-      # test whether the actual hydra daemons are running
-      $machine->succeed("systemctl status hydra-queue-runner.service");
-      $machine->succeed("systemctl status hydra-init.service");
-      $machine->succeed("systemctl status hydra-evaluator.service");
-      $machine->succeed("systemctl status hydra-send-stats.service");
+              #Hydra needs those settings to start up, so we add something not harmfull.
+              hydraURL = "example.com";
+              notificationSender = "example@example.com";

-      $machine->succeed("hydra-create-user admin --role admin --password admin");
+              package = pkgs.hydra.override { inherit nix; };
+            };
+            nix = {
+              buildMachines = [{
+                hostName = "localhost";
+                systems = [ "x86_64-linux" ];
+              }];

-      # create a project with a trivial job
-      $machine->waitForOpenPort(3000);
+              binaryCaches = [];
+            };
+          };

-      # make sure the build as been successfully built
-      $machine->succeed("create-trivial-project.sh");
+        testScript = ''
+          # let the system boot up
+          $machine->waitForUnit("multi-user.target");
+          # test whether the database is running
+          $machine->succeed("systemctl status postgresql.service");
+          # test whether the actual hydra daemons are running
+          $machine->succeed("systemctl status hydra-queue-runner.service");
+          $machine->succeed("systemctl status hydra-init.service");
+          $machine->succeed("systemctl status hydra-evaluator.service");
+          $machine->succeed("systemctl status hydra-send-stats.service");

-      $machine->waitUntilSucceeds('curl -L -s http://localhost:3000/build/1 -H "Accept: application/json" |  jq .buildstatus | xargs test 0 -eq');
-    '';
-})
+          $machine->succeed("hydra-create-user admin --role admin --password admin");
+
+          # create a project with a trivial job
+          $machine->waitForOpenPort(3000);
+
+          # make sure the build as been successfully built
+          $machine->succeed("create-trivial-project.sh");
+
+          $machine->waitUntilSucceeds('curl -L -s http://localhost:3000/build/1 -H "Accept: application/json" |  jq .buildstatus | xargs test 0 -eq');
+        '';
+      })));
+
+in
+  tests
--- a/nixos/tests/matrix-synapse.nix
+++ b/nixos/tests/matrix-synapse.nix
@ -1,4 +1,32 @@
-import ./make-test.nix ({ pkgs, ... } : {
+import ./make-test.nix ({ pkgs, ... } : let
+
+
+  runWithOpenSSL = file: cmd: pkgs.runCommand file {
+    buildInputs = [ pkgs.openssl ];
+  } cmd;
+
+
+  ca_key = runWithOpenSSL "ca-key.pem" "openssl genrsa -out $out 2048";
+  ca_pem = runWithOpenSSL "ca.pem" ''
+    openssl req \
+      -x509 -new -nodes -key ${ca_key} \
+      -days 10000 -out $out -subj "/CN=snakeoil-ca"
+  '';
+  key = runWithOpenSSL "matrix_key.pem" "openssl genrsa -out $out 2048";
+  csr = runWithOpenSSL "matrix.csr" ''
+    openssl req \
+       -new -key ${key} \
+       -out $out -subj "/CN=localhost" \
+  '';
+  cert = runWithOpenSSL "matrix_cert.pem" ''
+    openssl x509 \
+      -req -in ${csr} \
+      -CA ${ca_pem} -CAkey ${ca_key} \
+      -CAcreateserial -out $out \
+      -days 365
+  '';
+
+in {

  name = "matrix-synapse";
  meta = with pkgs.stdenv.lib.maintainers; {
@ -8,23 +36,31 @@ import ./make-test.nix ({ pkgs, ... } : {
  nodes = {
    # Since 0.33.0, matrix-synapse doesn't allow underscores in server names
    serverpostgres = args: {
-      services.matrix-synapse.enable = true;
-      services.matrix-synapse.database_type = "psycopg2";
+      services.matrix-synapse = {
+        enable = true;
+        database_type = "psycopg2";
+        tls_certificate_path = "${cert}";
+        tls_private_key_path = "${key}";
+      };
    };

    serversqlite = args: {
-      services.matrix-synapse.enable = true;
-      services.matrix-synapse.database_type = "sqlite3";
+      services.matrix-synapse = {
+        enable = true;
+        database_type = "sqlite3";
+        tls_certificate_path = "${cert}";
+        tls_private_key_path = "${key}";
+      };
    };
  };

  testScript = ''
    startAll;
    $serverpostgres->waitForUnit("matrix-synapse.service");
-    $serverpostgres->waitUntilSucceeds("curl -Lk https://localhost:8448/");
+    $serverpostgres->waitUntilSucceeds("curl -L --cacert ${ca_pem} https://localhost:8448/");
    $serverpostgres->requireActiveUnit("postgresql.service");
    $serversqlite->waitForUnit("matrix-synapse.service");
-    $serversqlite->waitUntilSucceeds("curl -Lk https://localhost:8448/");
+    $serversqlite->waitUntilSucceeds("curl -L --cacert ${ca_pem} https://localhost:8448/");
    $serversqlite->mustSucceed("[ -e /var/lib/matrix-synapse/homeserver.db ]");
  '';

--- a/nixos/tests/munin.nix
+++ b/nixos/tests/munin.nix
@ -15,9 +15,7 @@ import ./make-test.nix ({ pkgs, ...} : {
           munin-node = {
             enable = true;
             # disable a failing plugin to prevent irrelevant error message, see #23049
-             extraConfig = ''
-               ignore_file ^apc_nis$
-             '';
+             disabledPlugins = [ "apc_nis" ];
           };
           munin-cron = {
            enable = true;
--- a/nixos/tests/ndppd.nix
+++ b/nixos/tests/ndppd.nix
@ -0,0 +1,61 @@
+import ./make-test.nix ({ pkgs, lib, ...} : {
+  name = "ndppd";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ fpletz ];
+  };
+
+  nodes = {
+    upstream = { pkgs, ... }: {
+      environment.systemPackages = [ pkgs.tcpdump ];
+      networking.useDHCP = false;
+      networking.interfaces = {
+        eth1 = {
+          ipv6.addresses = [
+            { address = "fd23::1"; prefixLength = 112; }
+          ];
+          ipv6.routes = [
+            { address = "fd42::";
+              prefixLength = 112;
+            }
+          ];
+        };
+      };
+    };
+    server = { pkgs, ... }: {
+      boot.kernel.sysctl = {
+        "net.ipv6.conf.all.forwarding" = "1";
+        "net.ipv6.conf.default.forwarding" = "1";
+      };
+      environment.systemPackages = [ pkgs.tcpdump ];
+      networking.useDHCP = false;
+      networking.interfaces = {
+        eth1 = {
+          ipv6.addresses = [
+            { address = "fd23::2"; prefixLength = 112; }
+          ];
+        };
+      };
+      services.ndppd = {
+        enable = true;
+        interface = "eth1";
+        network = "fd42::/112";
+      };
+      containers.client = {
+        autoStart = true;
+        privateNetwork = true;
+        hostAddress = "192.168.255.1";
+        localAddress = "192.168.255.2";
+        hostAddress6 = "fd42::1";
+        localAddress6 = "fd42::2";
+        config = {};
+      };
+    };
+  };
+
+  testScript = ''
+    startAll;
+    $server->waitForUnit("multi-user.target");
+    $upstream->waitForUnit("multi-user.target");
+    $upstream->waitUntilSucceeds("ping -c5 fd42::2");
+  '';
+})
--- a/nixos/tests/neo4j.nix
+++ b/nixos/tests/neo4j.nix
@ -0,0 +1,20 @@
+import ./make-test.nix {
+  name = "neo4j";
+
+  nodes = {
+    master =
+      { ... }:
+
+      {
+        services.neo4j.enable = true;
+      };
+  };
+
+  testScript = ''
+    startAll;
+
+    $master->waitForUnit("neo4j");
+    $master->sleep(20); # Hopefully this is long enough!!
+    $master->succeed("curl http://localhost:7474/");
+  '';
+}
--- a/nixos/tests/osrm-backend.nix
+++ b/nixos/tests/osrm-backend.nix
@ -0,0 +1,53 @@
+import ./make-test.nix ({ pkgs, lib, ... }:
+let
+  port = 5000;
+in {
+  name = "osrm-backend";
+  meta.maintainers = [ lib.maintainers.erictapen ];
+
+  machine = { config, pkgs, ... }:{
+
+    services.osrm = {
+      enable = true;
+      inherit port;
+      dataFile = let
+        filename = "monaco";
+        osrm-data = pkgs.stdenv.mkDerivation {
+          name = "osrm-data";
+
+          buildInputs = [ pkgs.osrm-backend ];
+
+          # This is a pbf file of monaco, downloaded at 2019-01-04 from
+          # http://download.geofabrik.de/europe/monaco-latest.osm.pbf
+          # as apparently no provider of OSM files guarantees immutability,
+          # this is hosted as a gist on GitHub.
+          src = pkgs.fetchgit {
+            url = "https://gist.github.com/erictapen/01e39f73a6c856eac53ba809a94cdb83";
+            rev = "9b1ff0f24deb40e5cf7df51f843dbe860637b8ce";
+            sha256 = "1scqhmrfnpwsy5i2a9jpggqnvfgj4hv9p4qyvc79321pzkbv59nx";
+          };
+
+          buildCommand = ''
+            cp $src/${filename}.osm.pbf .
+            ${pkgs.osrm-backend}/bin/osrm-extract -p ${pkgs.osrm-backend}/share/osrm/profiles/car.lua ${filename}.osm.pbf
+            ${pkgs.osrm-backend}/bin/osrm-partition ${filename}.osrm
+            ${pkgs.osrm-backend}/bin/osrm-customize ${filename}.osrm
+            mkdir -p $out
+            cp ${filename}* $out/
+          '';
+        };
+      in "${osrm-data}/${filename}.osrm";
+    };
+
+    environment.systemPackages = [ pkgs.jq ];
+  };
+
+  testScript = let
+    query = "http://localhost:${toString port}/route/v1/driving/7.41720,43.73304;7.42463,43.73886?steps=true";
+  in ''
+    $machine->waitForUnit("osrm.service");
+    $machine->waitForOpenPort(${toString port});
+    $machine->succeed("curl --silent '${query}' | jq .waypoints[0].name | grep -F 'Boulevard Rainier III'");
+    $machine->succeed("curl --silent '${query}' | jq .waypoints[1].name | grep -F 'Avenue de la Costa'");
+  '';
+})
--- a/nixos/tests/postgresql.nix
+++ b/nixos/tests/postgresql.nix
@ -7,7 +7,7 @@ with import ../lib/testing.nix { inherit system pkgs; };
 with pkgs.lib;

 let
-  postgresql-versions = import ../../pkgs/servers/sql/postgresql pkgs pkgs;
+  postgresql-versions = import ../../pkgs/servers/sql/postgresql pkgs;
  test-sql = pkgs.writeText "postgresql-test" ''
    CREATE EXTENSION pgcrypto; -- just to check if lib loading works
    CREATE TABLE sth (
@ -67,12 +67,7 @@ let

  };
 in
-  (mapAttrs' (name: package: { inherit name; value=make-postgresql-test name package false;}) postgresql-versions) // (
-    # just pick one version for the dump all test
-    let
-      first = head (attrNames postgresql-versions);
-      name = "${first}-backup-all";
-    in {
-      ${name} = make-postgresql-test name postgresql-versions.${first} true;
-    }
-  )
+  (mapAttrs' (name: package: { inherit name; value=make-postgresql-test name package false;}) postgresql-versions) // {
+    postgresql_11-backup-all = make-postgresql-test "postgresql_11-backup-all" postgresql-versions.postgresql_11 true;
+  }
+
--- a/nixos/tests/redmine.nix
+++ b/nixos/tests/redmine.nix
@ -1,40 +1,58 @@
-import ./make-test.nix ({ pkgs, lib, ... }:
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing.nix { inherit system pkgs; };
+with pkgs.lib;
+
+let
+  redmineTest = package: makeTest {
+    machine =
+      { config, pkgs, ... }:
+      { services.mysql.enable = true;
+        services.mysql.package = pkgs.mariadb;
+        services.mysql.ensureDatabases = [ "redmine" ];
+        services.mysql.ensureUsers = [
+          { name = "redmine";
+            ensurePermissions = { "redmine.*" = "ALL PRIVILEGES"; };
+          }
+        ];
+
+        services.redmine.enable = true;
+        services.redmine.package = package;
+        services.redmine.database.socket = "/run/mysqld/mysqld.sock";
+        services.redmine.plugins = {
+          redmine_env_auth = pkgs.fetchurl {
+            url = https://github.com/Intera/redmine_env_auth/archive/0.7.zip;
+            sha256 = "1xb8lyarc7mpi86yflnlgyllh9hfwb9z304f19dx409gqpia99sc";
+          };
+        };
+        services.redmine.themes = {
+          dkuk-redmine_alex_skin = pkgs.fetchurl {
+            url = https://bitbucket.org/dkuk/redmine_alex_skin/get/1842ef675ef3.zip;
+            sha256 = "0hrin9lzyi50k4w2bd2b30vrf1i4fi1c0gyas5801wn8i7kpm9yl";
+          };
+        };
+      };
+
+    testScript = ''
+      startAll;
+
+      $machine->waitForUnit('redmine.service');
+      $machine->waitForOpenPort('3000');
+      $machine->succeed("curl --fail http://localhost:3000/");
+    '';
+  };
+in
 {
-  name = "redmine";
-  meta.maintainers = [ lib.maintainers.aanderse ];
+  redmine_3 = redmineTest pkgs.redmine // {
+    name = "redmine_3";
+    meta.maintainers = [ maintainers.aanderse ];
+  };

-  machine =
-    { config, pkgs, ... }:
-    { services.mysql.enable = true;
-      services.mysql.package = pkgs.mariadb;
-      services.mysql.ensureDatabases = [ "redmine" ];
-      services.mysql.ensureUsers = [
-        { name = "redmine";
-          ensurePermissions = { "redmine.*" = "ALL PRIVILEGES"; };
-        }
-      ];
-
-      services.redmine.enable = true;
-      services.redmine.database.socket = "/run/mysqld/mysqld.sock";
-      services.redmine.plugins = {
-        redmine_env_auth = pkgs.fetchurl {
-          url = https://github.com/Intera/redmine_env_auth/archive/0.6.zip;
-          sha256 = "0yyr1yjd8gvvh832wdc8m3xfnhhxzk2pk3gm2psg5w9jdvd6skak";
-        };
-      };
-      services.redmine.themes = {
-        dkuk-redmine_alex_skin = pkgs.fetchurl {
-          url = https://bitbucket.org/dkuk/redmine_alex_skin/get/1842ef675ef3.zip;
-          sha256 = "0hrin9lzyi50k4w2bd2b30vrf1i4fi1c0gyas5801wn8i7kpm9yl";
-        };
-      };
-    };
-
-  testScript = ''
-    startAll;
-
-    $machine->waitForUnit('redmine.service');
-    $machine->waitForOpenPort('3000');
-    $machine->succeed("curl --fail http://localhost:3000/");
-  '';
-})
+  redmine_4 = redmineTest pkgs.redmine_4 // {
+    name = "redmine_4";
+    meta.maintainers = [ maintainers.aanderse ];
+  };
+}
--- a/nixos/tests/roundcube.nix
+++ b/nixos/tests/roundcube.nix
@ -10,6 +10,8 @@ import ./make-test.nix ({ pkgs, ...} : {
        enable = true;
        hostName = "roundcube";
        database.password = "notproduction";
+        package = pkgs.roundcube.withPlugins (plugins: [ plugins.persistent_login ]);
+        plugins = [ "persistent_login" ];
      };
      services.nginx.virtualHosts.roundcube = {
        forceSSL = false;
@ -23,6 +25,6 @@ import ./make-test.nix ({ pkgs, ...} : {
    $roundcube->waitForUnit("postgresql.service");
    $roundcube->waitForUnit("phpfpm-roundcube.service");
    $roundcube->waitForUnit("nginx.service");
-    $roundcube->succeed("curl -sSfL http://roundcube/");
+    $roundcube->succeed("curl -sSfL http://roundcube/ | grep 'Keep me logged in'");
  '';
 })
--- a/pkgs/applications/altcoins/parity/beta.nix
+++ b/pkgs/applications/altcoins/parity/beta.nix
@ -1,6 +1,6 @@
 let
-  version     = "2.3.0";
-  sha256      = "0v79nz19riaga6iwj6m59fq8adm5llrkq61xizriz30rw8rkk04z";
-  cargoSha256 = "01vdrfqh2nlghbgnbb7qmrazsjmynrb9542qrgchxq589wasb4j2";
+  version     = "2.3.1";
+  sha256      = "13y3gczqb0rb6v17j63j1zp11cnykbv9c674hrk1i6jb3y4am4lv";
+  cargoSha256 = "1pj5hzy7k1l9bbw1qpz80vvk89qz4qz4rnnkcvn2rkbmq382gxwy";
 in
  import ./parity.nix { inherit version sha256 cargoSha256; }
--- a/pkgs/applications/altcoins/parity/default.nix
+++ b/pkgs/applications/altcoins/parity/default.nix
@ -1,6 +1,6 @@
 let
-  version     = "2.2.7";
-  sha256      = "0bxq4z84vsb8hmbscr41xiw11m9xg6if231v76c2dmkbyqgpqy8p";
-  cargoSha256 = "1izwqg87qxhmmkd49m0k09i7r05sfcb18m5jbpvggjzp57ips09r";
+  version     = "2.2.8";
+  sha256      = "1l2bxra4fkbh8gnph9wnc24ddmzfdclsgcjbx8q6fflhcg6r9hf1";
+  cargoSha256 = "10lg0vzikzlj927hpn59x1dz9dvhcaqsl8nz14vj2iz42vfkcm7p";
 in
  import ./parity.nix { inherit version sha256 cargoSha256; }
--- a/pkgs/applications/audio/cmus/default.nix
+++ b/pkgs/applications/audio/cmus/default.nix
@ -100,13 +100,13 @@ in

 stdenv.mkDerivation rec {
  name = "cmus-${version}";
-  version = "2.7.1";
+  version = "2.8.0";

  src = fetchFromGitHub {
    owner  = "cmus";
    repo   = "cmus";
    rev    = "v${version}";
-    sha256 = "0xd96py21bl869qlv1353zw7xsgq6v5s8szr0ldr63zj5fgc2ps5";
+    sha256 = "1ydnvq13ay8b8mfmmgwi5qsgyf220yi1d01acbnxqn775dghmwar";
  };

  patches = [ ./option-debugging.patch ];
--- a/pkgs/applications/audio/flacon/default.nix
+++ b/pkgs/applications/audio/flacon/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  name = "flacon-${version}";
-  version = "5.0.0";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "flacon";
    repo = "flacon";
    rev = "v${version}";
-    sha256 = "0pglqm2z7mp5igqmfnmvrgjhfbfrj8q5jvd0a0g2dzv3rqwfw4vc";
+    sha256 = "18m077z1hqjg10chy5rgajd9q1wnrcxhiidivgjcdchc9q5d4b08";
  };

  nativeBuildInputs = [ cmake pkgconfig makeWrapper ];
--- a/pkgs/applications/audio/fldigi/default.nix
+++ b/pkgs/applications/audio/fldigi/default.nix
@ -2,13 +2,12 @@
  libsamplerate, libpulseaudio, libXinerama, gettext, pkgconfig, alsaLib }:

 stdenv.mkDerivation rec {
-  version = "4.0.18";
+  version = "4.1.00";
  pname = "fldigi";
-  name = "${pname}-${version}";

  src = fetchurl {
-    url = "mirror://sourceforge/${pname}/${name}.tar.gz";
-    sha256 = "0a3z9xj9gsa6fskiai9410kwqfb6156km59y36a31mhyddzk27p7";
+    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
+    sha256 = "1hm2n4p3pdd029kizgzwf3zzgsy1m6z83z7rr2kyjhrq2vp5gf0s";
  };

  buildInputs = [ libXinerama gettext hamlib fltk13 libjpeg libpng portaudio
--- a/pkgs/applications/audio/gpodder/default.nix
+++ b/pkgs/applications/audio/gpodder/default.nix
@ -5,14 +5,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "gpodder";
-  version = "3.10.6";
+  version = "3.10.7";
  format = "other";

  src = fetchFromGitHub {
-    owner = "gpodder";
-    repo = "gpodder";
+    owner = pname;
+    repo = pname;
    rev = version;
-    sha256 = "11nccsnlxrj8wwl8dyz9a0yrzma6ipx5gwj2lc7m308z60r8wvjs";
+    sha256 = "0sx9rj6dpvd2xz7lak2yi0zlgr3lp2ng1fw23s39la9ly4g1835j";
  };

  postPatch = with stdenv.lib; ''
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@ -5,14 +5,14 @@

 stdenv.mkDerivation rec {
  pname = "lsp-plugins";
-  version = "1.1.4";
+  version = "1.1.5";
  name = "${pname}-${version}";

  src = fetchFromGitHub {
    owner = "sadko4u";
    repo = "${pname}";
    rev = "${name}";
-    sha256 = "0vb8ax0w4d2a153wxrhkpi21fxsv7c24k57vhfgmm1lqwv6pbl69";
+    sha256 = "0xcxm47j7mz5vprjqqhi95gz62syp4y737h7cssxd3flqkgar7xr";
  };

  nativeBuildInputs = [ pkgconfig php expat ];
--- a/pkgs/applications/audio/mopidy/iris.nix
+++ b/pkgs/applications/audio/mopidy/iris.nix
@ -2,11 +2,11 @@

 pythonPackages.buildPythonApplication rec {
  pname = "Mopidy-Iris";
-  version = "3.31.8";
+  version = "3.32.4";

  src = pythonPackages.fetchPypi {
    inherit pname version;
-    sha256 = "16rrvby6rdiz53minfqsbgmymnc4agi2iwp0pf5ahsaxp1xq0cqy";
+    sha256 = "16b3dkxland4mjzjs2rz5gbqjapzzmap4d1mfhbrj2ch3plmdy7g";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/audio/pulseaudio-modules-bt/default.nix
+++ b/pkgs/applications/audio/pulseaudio-modules-bt/default.nix
@ -23,13 +23,13 @@ let

 in stdenv.mkDerivation rec {
  name = "pulseaudio-modules-bt-${version}";
-  version = "unstable-2018-11-01";
+  version = "unstable-2019-01-05";

  src = fetchFromGitHub {
    owner = "EHfive";
    repo = "pulseaudio-modules-bt";
-    rev = "a2f62fcaa702bb883c07d074ebca8d7135520ab8";
-    sha256 = "1fhg7q9064zikhy0xxldn4fvh49pc47mgikcbd9yhsk66gcn6zj3";
+    rev = "4b0cde160c96f40d860fef267a6ded49ae045be0";
+    sha256 = "15jw5nf2dhqqdwzyh2x5kdkrq7f3qn140gw6gmspcai9kplhk24w";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/audio/x42-plugins/default.nix
+++ b/pkgs/applications/audio/x42-plugins/default.nix
@ -3,12 +3,12 @@
 , libGLU, lv2, gtk2, cairo, pango, fftwFloat, zita-convolver }:

 stdenv.mkDerivation rec {
-  version = "20181103";
+  version = "20190105";
  name = "x42-plugins-${version}";

  src = fetchurl {
    url = "https://gareus.org/misc/x42-plugins/${name}.tar.xz";
-    sha256 = "085d6qjj7nl22f0xamqdrnfxwi8zrfwgkwm1svm73bjkdv270438";
+    sha256 = "1bb7k3ly4qa05zgkbpm7d3x9cjch1fklgh279m6hp0ac3hhncdxp";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/audio/yoshimi/default.nix
+++ b/pkgs/applications/audio/yoshimi/default.nix
@ -6,11 +6,11 @@ assert stdenv ? glibc;

 stdenv.mkDerivation  rec {
  name = "yoshimi-${version}";
-  version = "1.5.10";
+  version = "1.5.10.1";

  src = fetchurl {
    url = "mirror://sourceforge/yoshimi/${name}.tar.bz2";
-    sha256 = "0mazzn5pc4xnjci3yy1yfsx9l05gkxqzkmscaq1h75jpa7qfsial";
+    sha256 = "02mmy17sa3dlwmjjahn8rfd6h67c5s0q3fvkf6ljrc2mbbpwc375";
  };

  buildInputs = [
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -8,19 +8,19 @@ let
    inherit (gnome2) GConf gnome_vfs;
  };
  stableVersion = {
-    version = "3.3.0.20"; # "Android Studio 3.3"
-    build = "182.5199772";
-    sha256Hash = "0dracganibnkyapn2pk2qqnxpwmii57371ycri4nccaci9v9pcjw";
+    version = "3.3.1.0"; # "Android Studio 3.3.1"
+    build = "182.5264788";
+    sha256Hash = "0fghqkc8pkb7waxclm0qq4nlnsvmv9d3fcj5nnvgbfkjyw032q42";
  };
  betaVersion = {
-    version = "3.4.0.11"; # "Android Studio 3.4 Beta 2"
-    build = "183.5240537";
-    sha256Hash = "0mv7ayqjkw97jzdifw1cdvjhnzygzkd2a9rc0h99fclhf2nii5yr";
+    version = "3.4.0.12"; # "Android Studio 3.4 Beta 3"
+    build = "183.5256591";
+    sha256Hash = "1yab2sgabgk3wa3wrzv9z1dc2k7x0079v0mlwrp32jwx8r9byvcw";
  };
  latestVersion = { # canary & dev
-    version = "3.5.0.1"; # "Android Studio 3.5 Canary 2"
-    build = "183.5240547";
-    sha256Hash = "0z52ig9v2w9i6bqiqpdvgcr6g6sgl8p5317jamg72d5csm9hgfx3";
+    version = "3.5.0.2"; # "Android Studio 3.5 Canary 3"
+    build = "183.5256920";
+    sha256Hash = "09bd80ld21hq743xjacsq0nkxwl5xzr253p86n71n580yn4rgmlb";
  };
 in rec {
  # Old alias (TODO @primeos: Remove after 19.03 is branched off):
--- a/pkgs/applications/editors/dhex/default.nix
+++ b/pkgs/applications/editors/dhex/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "dhex-${version}";
-  version = "0.68";
+  version = "0.69";

  src = fetchurl {
    url = "http://www.dettus.net/dhex/dhex_${version}.tar.gz";
-    sha256 = "126c34745b48a07448cfe36fe5913d37ec562ad72d3f732b99bd40f761f4da08";
+    sha256 = "06y4lrp29f2fh303ijk1xhspa1d4x4dm6hnyw3dd8szi3k6hnwsj";
  };

  buildInputs = [ ncurses ];
--- a/pkgs/applications/editors/emacs/default.nix
+++ b/pkgs/applications/editors/emacs/default.nix
@ -42,6 +42,7 @@ stdenv.mkDerivation rec {

  patches = [
    ./clean-env.patch
+    ./tramp-detect-wrapped-gvfsd.patch
  ];

  postPatch = lib.optionalString srcRepo ''
--- a/pkgs/applications/editors/emacs/tramp-detect-wrapped-gvfsd.patch
+++ b/pkgs/applications/editors/emacs/tramp-detect-wrapped-gvfsd.patch
@ -0,0 +1,14 @@
+diff --git a/lisp/net/tramp-gvfs.el b/lisp/net/tramp-gvfs.el
+index f370abba31..f2806263a9 100644
+--- a/lisp/net/tramp-gvfs.el
+++ b/lisp/net/tramp-gvfs.el
+@@ -164,7 +164,8 @@ tramp-gvfs-enabled
+     (and (featurep 'dbusbind)
+ 	 (tramp-compat-funcall 'dbus-get-unique-name :system)
+ 	 (tramp-compat-funcall 'dbus-get-unique-name :session)
+-	 (or (tramp-compat-process-running-p "gvfs-fuse-daemon")
+	 (or (tramp-compat-process-running-p ".gvfsd-fuse-wrapped")
+             (tramp-compat-process-running-p "gvfs-fuse-daemon")
+ 	     (tramp-compat-process-running-p "gvfsd-fuse"))))
+   "Non-nil when GVFS is available.")
+ 
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -250,145 +250,145 @@ in

  clion = buildClion rec {
    name = "clion-${version}";
-    version = "2018.3.3"; /* updated by script */
+    version = "2018.3.4"; /* updated by script */
    description  = "C/C++ IDE. New. Intelligent. Cross-platform";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "1pffxq69ihdc55lsy2q56vlanpgyks0g82n40b29j4m66flmxbkl"; /* updated by script */
+      sha256 = "1zglpw9vc3ybdmwymi0c2m6anhcmx9jcqi69gnn06n9f4x1v6gwn"; /* updated by script */
    };
    wmClass = "jetbrains-clion";
-    update-channel = "CLion Release"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
+    update-channel = "CLion RELEASE"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
  };

  datagrip = buildDataGrip rec {
    name = "datagrip-${version}";
-    version = "2018.2.5"; /* updated by script */
+    version = "2018.3.2"; /* updated by script */
    description = "Your Swiss Army Knife for Databases and SQL";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
-      sha256 = "0ls3qas8z0d1ynn6hh42qipa5br2g2497wf3pgcw3q0m3kp6wida"; /* updated by script */
+      sha256 = "0vj1cgmg33626i38x9wmh5hqr1lf0x3m23gzq30rp4q4cbi38806"; /* updated by script */
    };
    wmClass = "jetbrains-datagrip";
-    update-channel = "DataGrip 2018.2";
+    update-channel = "DataGrip RELEASE";
  };

  goland = buildGoland rec {
    name = "goland-${version}";
-    version = "2018.3.2"; /* updated by script */
+    version = "2018.3.3"; /* updated by script */
    description = "Up and Coming Go IDE";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "0vnw6zc23dibpk1z7yg1lrgjznqc7508g1azybml878h6yykm5a4"; /* updated by script */
+      sha256 = "065z8084xkv6w8m7pq98rgls1avzrqm23mrxdq5172rs5p1c5r9f"; /* updated by script */
    };
    wmClass = "jetbrains-goland";
-    update-channel = "GoLand Release";
+    update-channel = "GoLand RELEASE";
  };

  idea-community = buildIdea rec {
    name = "idea-community-${version}";
-    version = "2018.3.3"; /* updated by script */
+    version = "2018.3.4"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "1c9x3m7dknqr6yxqnn2ch3akwm6yskpmy32hcbjg7s87g1n6gy8m"; /* updated by script */
+      sha256 = "0j5yc7n04jlyyghmwllpfvcd2g6k1syjp07xb1ljyx7rm4jcf8q6"; /* updated by script */
    };
    wmClass = "jetbrains-idea-ce";
-    update-channel = "IntelliJ IDEA Release";
+    update-channel = "IntelliJ IDEA RELEASE";
  };

  idea-ultimate = buildIdea rec {
    name = "idea-ultimate-${version}";
-    version = "2018.3.3"; /* updated by script */
+    version = "2018.3.4"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jdk.tar.gz";
-      sha256 = "1dj39hs63xba2jfk3sd2yiq7vk7758axrc5549krfd1aaawl4sl8"; /* updated by script */
+      sha256 = "0s3r3h1zcwkfqhsfb224fgy62fdhnd4gjgk2h6pyhq1frnh3x5bg"; /* updated by script */
    };
    wmClass = "jetbrains-idea";
-    update-channel = "IntelliJ IDEA Release";
+    update-channel = "IntelliJ IDEA RELEASE";
  };

  phpstorm = buildPhpStorm rec {
    name = "phpstorm-${version}";
-    version = "2018.2.6"; /* updated by script */
+    version = "2018.3.3"; /* updated by script */
    description = "Professional IDE for Web and PHP developers";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "0z627q9mcxlz8a92dndnaz2qa9dkaapimsfqkvc0i8ab88yw75v1"; /* updated by script */
+      sha256 = "0znhw83h46a3haspwcin5xjf3ask8ijxla778p9vdbi9xs0zqx39"; /* updated by script */
    };
    wmClass = "jetbrains-phpstorm";
-    update-channel = "PhpStorm 2018.2";
+    update-channel = "PhpStorm RELEASE";
  };

  pycharm-community = buildPycharm rec {
    name = "pycharm-community-${version}";
-    version = "2018.3.3"; /* updated by script */
+    version = "2018.3.4"; /* updated by script */
    description = "PyCharm Community Edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0dnjkq1qbxc05cxafi5hw6pw9wya0w44ni32b34sclq26xr6blvj"; /* updated by script */
+      sha256 = "11kzzwkp206l466ii6vm6iqmhpx0s594vh37x2lwwsgmg6qzz6vq"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm-ce";
-    update-channel = "PyCharm Release";
+    update-channel = "PyCharm RELEASE";
  };

  pycharm-professional = buildPycharm rec {
    name = "pycharm-professional-${version}";
-    version = "2018.3.3"; /* updated by script */
+    version = "2018.3.4"; /* updated by script */
    description = "PyCharm Professional Edition";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0z6qjc3qh58ds338rlfzi9446y3sghpnccaachkja2q59f97dfma"; /* updated by script */
+      sha256 = "1m8lzghs6g57fwcv6bpmnf21d4w2k10gsmi0i2wv2j8ff4hcy7ij"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm";
-    update-channel = "PyCharm Release";
+    update-channel = "PyCharm RELEASE";
  };

  rider = buildRider rec {
    name = "rider-${version}";
-    version = "2018.3.1"; /* updated by script */
+    version = "2018.3.2"; /* updated by script */
    description = "A cross-platform .NET IDE based on the IntelliJ platform and ReSharper";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/rider/JetBrains.Rider-${version}.tar.gz";
-      sha256 = "0ghk819ik28y9b61vb2h463zbvvq1n2wl778czkakc4qjba2qnks"; /* updated by script */
+      sha256 = "1ffzbp2xca2z8g0wlkvmqr0j2f2dnqafpnvzk9zd5asfhhbyrhg5"; /* updated by script */
    };
    wmClass = "jetbrains-rider";
-    update-channel = "Rider 2018.3";
+    update-channel = "Rider RELEASE";
  };

  ruby-mine = buildRubyMine rec {
    name = "ruby-mine-${version}";
-    version = "2018.2.6"; /* updated by script */
+    version = "2018.3.3"; /* updated by script */
    description = "The Most Intelligent Ruby and Rails IDE";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "0xbmj7d1ccq2qf1jsvch1zxdrypkvzxdfkr431c8fnabh993yxx1"; /* updated by script */
+      sha256 = "1zjcdsr91y07dhqmhqy2yq6c0rhsxg2m52fz14hhmphddlwvhzny"; /* updated by script */
    };
    wmClass = "jetbrains-rubymine";
-    update-channel = "RubyMine 2018.2";
+    update-channel = "RubyMine RELEASE";
  };

  webstorm = buildWebStorm rec {
    name = "webstorm-${version}";
-    version = "2018.3.3"; /* updated by script */
+    version = "2018.3.4"; /* updated by script */
    description = "Professional IDE for Web and JavaScript development";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "0q8njbrll7qgijnxqic2mpca2jb2plpd677xdj5v72mm66mvxmss"; /* updated by script */
+      sha256 = "11l39yy8qdrr89y9x3i9acp0am4xb86z6v7wg1kc9fd5p13jr2xs"; /* updated by script */
    };
    wmClass = "jetbrains-webstorm";
-    update-channel = "WebStorm Release";
+    update-channel = "WebStorm RELEASE";
  };

 }
--- a/pkgs/applications/editors/kdevelop5/kdevelop.nix
+++ b/pkgs/applications/editors/kdevelop5/kdevelop.nix
@ -9,7 +9,7 @@

 let
  pname = "kdevelop";
-  version = "5.2.4";
+  version = "5.3.1";
  qtVersion = "5.${lib.versions.minor qtbase.version}";
 in
 mkDerivation rec {
@ -17,7 +17,7 @@ mkDerivation rec {

  src = fetchurl {
    url = "mirror://kde/stable/${pname}/${version}/src/${name}.tar.xz";
-    sha256 = "1jbks7nh9rybz4kg152l39hfj2x0p6mjins8x9mz03bbv8jf8gic";
+    sha256 = "1098ra7qpal6578hsv20kvxc63v47sp85wjhqr5rgzr2fm7jf6fr";
  };

  nativeBuildInputs = [
@ -37,6 +37,12 @@ mkDerivation rec {
    shared-mime-info libksysguard konsole kcrash karchive kguiaddons kpurpose
  ];

+  # https://cgit.kde.org/kdevelop.git/commit/?id=716372ae2e8dff9c51e94d33443536786e4bd85b
+  # required as nixos seems to be unable to find CLANG_BUILTIN_DIR
+  cmakeFlags = [
+    "-DCLANG_BUILTIN_DIR=${llvmPackages.clang-unwrapped}/lib/clang/${(builtins.parseDrvName llvmPackages.clang.name).version}/include"
+  ];
+
  postInstall = ''
    # The kdevelop! script (shell environment) needs qdbus and kioclient5 in PATH.
    wrapProgram "$out/bin/kdevelop!" \
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@ -1,15 +1,25 @@
 { stdenv, fetchFromGitHub, cmake, gettext, msgpack, libtermkey, libiconv
-, libuv, luaPackages, ncurses, pkgconfig
+, libuv, lua, ncurses, pkgconfig
 , unibilium, xsel, gperf
 , libvterm-neovim
 , withJemalloc ? true, jemalloc
+, glibcLocales ? null, procps ? null
+
+# now defaults to false because some tests can be flaky (clipboard etc)
+, doCheck ? false
 }:

 with stdenv.lib;

 let
-
-  neovim = stdenv.mkDerivation rec {
+  neovimLuaEnv = lua.withPackages(ps:
+    (with ps; [ mpack lpeg luabitop ]
+    ++ optionals doCheck [
+        nvim-client luv coxpcall busted luafilesystem penlight inspect
+      ]
+    ));
+in
+  stdenv.mkDerivation rec {
    name = "neovim-unwrapped-${version}";
    version = "0.3.4";

@ -36,11 +46,20 @@ let
      ncurses
      libvterm-neovim
      unibilium
-      luaPackages.lua
      gperf
+      neovimLuaEnv
    ] ++ optional withJemalloc jemalloc
      ++ optional stdenv.isDarwin libiconv
-      ++ lualibs;
+      ++ optionals doCheck [ glibcLocales procps ]
+    ;
+
+    inherit doCheck;
+
+    # to be exhaustive, one could run
+    # make oldtests too
+    checkPhase = ''
+      make functionaltest
+    '';

    nativeBuildInputs = [
      cmake
@ -48,10 +67,6 @@ let
      pkgconfig
    ];

-    LUA_PATH = stdenv.lib.concatStringsSep ";" (map luaPackages.getLuaPath lualibs);
-    LUA_CPATH = stdenv.lib.concatStringsSep ";" (map luaPackages.getLuaCPath lualibs);
-
-    lualibs = [ luaPackages.mpack luaPackages.lpeg luaPackages.luabitop ];

    # nvim --version output retains compilation flags and references to build tools
    postPatch = ''
@ -61,9 +76,11 @@ let
    disallowedReferences = [ stdenv.cc ];

    cmakeFlags = [
-      "-DLUA_PRG=${luaPackages.lua}/bin/lua"
+      "-DLUA_PRG=${neovimLuaEnv}/bin/lua"
      "-DGPERF_PRG=${gperf}/bin/gperf"
-    ];
+    ]
+    ++ optional doCheck "-DBUSTED_PRG=${neovimLuaEnv}/bin/busted"
+    ;

    # triggers on buffer overflow bug while running tests
    hardeningDisable = [ "fortify" ];
@ -81,6 +98,11 @@ let
                $out/bin/nvim
    '';

+    # export PATH=$PWD/build/bin:${PATH}
+    shellHook=''
+      export VIMRUNTIME=$PWD/runtime
+    '';
+
    meta = {
      description = "Vim text editor fork focused on extensibility and agility";
      longDescription = ''
@ -104,7 +126,4 @@ let
      # https://nix-cache.s3.amazonaws.com/log/9ahcb52905d9d417zsskjpc331iailpq-neovim-unwrapped-0.2.2.drv
      broken = stdenv.isAarch64;
    };
-  };
-
-in
-  neovim
+  }
--- a/pkgs/applications/gis/qgis/default.nix
+++ b/pkgs/applications/gis/qgis/default.nix
@ -5,7 +5,7 @@
 }:

 stdenv.mkDerivation rec {
-  name = "qgis-2.18.22";
+  name = "qgis-2.18.28";

  buildInputs = [ gdal qt4 flex openssl bison proj geos xlibsWrapper sqlite gsl qwt qscintilla
    fcgi libspatialindex libspatialite postgresql qjson qca2 txt2tags pkgconfig
@ -35,14 +35,15 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://qgis.org/downloads/${name}.tar.bz2";
-    sha256 = "00b3a2hfn3i7bdx7x96vz2nj0976vpkhid4ss7n8c33fdvw3k82a";
+    sha256 = "18pijqls1isd2bpg0mkrw07jqvdfaiwwb9mvz7p2xrgqcjx7dxsq";
  };

  patches = [
-    # https://github.com/qgis/QGIS/pull/7765
+    # already merged upstream in QGIS-3.*, but needs to be backported to QGIS-2
    (fetchpatch {
-      url = "https://github.com/qgis/QGIS/commit/6b61ef361a77f057dc29eb07463007bd9012b253.patch";
-      sha256 = "1xibcahm18n7nxff1xvwwzjf505hvhiw5dk12is7aclv49h0rdf7";
+      url = "https://patch-diff.githubusercontent.com/raw/qgis/QGIS/pull/7263.patch";
+      name = "Ensure_qgis.db_is_writable_when_copied_from_RO_source";
+      sha256 = "19wr2kz0x8x6p2n0ylzd4lqrdmbkxyxr0zpwf2vl9hdp92rdjxbv";
    })
  ];

--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, pkgconfig, libtool
-, bzip2, zlib, libX11, libXext, libXt, fontconfig, freetype, ghostscript, libjpeg
+, bzip2, zlib, libX11, libXext, libXt, fontconfig, freetype, ghostscript, libjpeg, djvulibre
 , lcms2, openexr, libpng, librsvg, libtiff, libxml2, openjpeg, libwebp, libheif
 , ApplicationServices
 }:
@ -53,7 +53,7 @@ stdenv.mkDerivation rec {

  buildInputs =
    [ zlib fontconfig freetype ghostscript
-      libpng libtiff libxml2 libheif
+      libpng libtiff libxml2 libheif djvulibre
    ]
    ++ lib.optionals (!stdenv.hostPlatform.isMinGW)
      [ openexr librsvg openjpeg ]
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, pkgconfig, libtool
-, bzip2, zlib, libX11, libXext, libXt, fontconfig, freetype, ghostscript, libjpeg
+, bzip2, zlib, libX11, libXext, libXt, fontconfig, freetype, ghostscript, libjpeg, djvulibre
 , lcms2, openexr, libpng, librsvg, libtiff, libxml2, openjpeg, libwebp, fftw, libheif, libde265
 , ApplicationServices
 }:
@ -65,7 +65,7 @@ stdenv.mkDerivation rec {

  buildInputs =
    [ zlib fontconfig freetype ghostscript
-      libpng libtiff libxml2 libheif libde265
+      libpng libtiff libxml2 libheif libde265 djvulibre
    ]
    ++ lib.optionals (!stdenv.hostPlatform.isMinGW)
      [ openexr librsvg openjpeg ]
--- a/pkgs/applications/graphics/astah-community/default.nix
+++ b/pkgs/applications/graphics/astah-community/default.nix
@ -1,63 +0,0 @@
-{ stdenv, fetchurl, makeWrapper, makeDesktopItem, unzip, jre }:
-
-let
-
-  name = "astah-community";
-  version = "7.2.0";
-  postfix = "1ff236";
-  desktopIcon = fetchurl {
-    name = "${name}.png";
-    url = "https://aur.archlinux.org/cgit/aur.git/plain/astah_community.png?h=astah-community&id=94710b5a6aadcaf489022b0f0e61f8832ae6fa87";
-    sha256 = "0knlknwfqqnhg63sxxpia5ykn397id31gzr956wnn6yjj58k3ckm";
-  };
-  mimeXml = fetchurl {
-    name = "${name}.xml";
-    url = "https://aur.archlinux.org/cgit/aur.git/plain/astah_community.xml?h=astah-community&id=94710b5a6aadcaf489022b0f0e61f8832ae6fa87";
-    sha256 = "096n2r14ddm97r32i4sbp7v4qdmwn9sxy7lwphcx1nydppb0m97b";
-  };
-  desktopItem = makeDesktopItem {
-    name = name;
-    exec = "astah %U";
-    icon = "${desktopIcon}";
-    comment = "Lightweight, easy-to-use, and free UML2.x modeler";
-    desktopName = "Astah* Community";
-    genericName = "Astah* Community";
-    mimeType = "application/x-astah";
-    categories = "Application;Development;";
-    extraEntries = "NoDisplay=false";
-  };
-
-in
-
-stdenv.mkDerivation {
-  name = "${name}-${version}";
-
-  src = fetchurl {
-    url = "http://cdn.change-vision.com/files/${name}-${stdenv.lib.replaceStrings ["."] ["_"] version}-${postfix}.zip";
-    sha256 = "1lkl30jdjiarvh2ap9rjabvrq9qhrlmfrasv3vvkag22y9w4l499";
-  };
-
-  nativeBuildInputs = [ unzip makeWrapper ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/{bin,share}
-    cp -r . $out/share/astah
-    cp -r ${desktopItem}/share/applications $out/share/applications
-
-    install -D ${desktopIcon} $out/share/pixmaps/${name}.png
-    install -D ${mimeXml} $out/share/mime/packages/${name}.xml
-
-    makeWrapper ${jre}/bin/java $out/bin/astah \
-      --add-flags "-jar $out/share/astah/astah-community.jar"
-
-    runHook postInstall
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Lightweight, easy-to-use, and free UML2.x modeler";
-    homepage = http://astah.net/editions/community;
-    license = licenses.unfree;
-  };
-}
--- a/pkgs/applications/misc/albert/default.nix
+++ b/pkgs/applications/misc/albert/default.nix
@ -4,13 +4,13 @@

 mkDerivation rec {
  pname = "albert";
-  version = "0.15.0";
+  version = "0.16.1";

  src = fetchFromGitHub {
    owner  = "albertlauncher";
    repo   = "albert";
    rev    = "v${version}";
-    sha256 = "063z9yq6bsxcsqsw1n93ks5dzhzv6i252mjz1d5mxhxvgmqlfk0v";
+    sha256 = "04sr35fqz66i24lv7r2p9qfqxs55i8xpj7aam0v9yakcr33lf55a";
    fetchSubmodules = true;
  };

@ -25,7 +25,7 @@ mkDerivation rec {

  postPatch = ''
    sed -i "/QStringList dirs = {/a    \"$out/libs\"," \
-      lib/albertcore/src/core/albert.cpp
+      src/app/main.cpp
  '';

  preBuild = ''
--- a/pkgs/applications/misc/apvlv/default.nix
+++ b/pkgs/applications/misc/apvlv/default.nix
@ -41,6 +41,7 @@ stdenv.mkDerivation rec {
      url = "https://github.com/naihe2010/apvlv/commit/a3a895772a27d76dab0c37643f0f4c73f9970e62.patch";
      sha256 = "1fpc7wr1ajilvwi5gjsy5g9jcx4bl03gp5dmajg90ljqbhwz2bfi";
    })
+    ./fix-build-with-poppler-0.73.0.patch
  ];

  installPhase = ''
--- a/pkgs/applications/misc/apvlv/fix-build-with-poppler-0.73.0.patch
+++ b/pkgs/applications/misc/apvlv/fix-build-with-poppler-0.73.0.patch
@ -0,0 +1,13 @@
+diff --git a/src/ApvlvPdf.cc b/src/ApvlvPdf.cc
+index 765b112..83d133f 100644
+--- a/src/ApvlvPdf.cc
+++ b/src/ApvlvPdf.cc
+@@ -29,7 +29,7 @@
+ #include "ApvlvPdf.h"
+
+ #ifndef POPPLER_WITH_GDK
+-#include <goo/gtypes.h>
+#include <goo/gfile.h>
+
+ static void
+ copy_cairo_surface_to_pixbuf (cairo_surface_t *surface,
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@ -5,12 +5,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "3.38.1";
+  version = "3.39.1";
  name = "calibre-${version}";

  src = fetchurl {
    url = "https://download.calibre-ebook.com/${version}/${name}.tar.xz";
-    sha256 = "07fvpnabk17sfg81xn0bsnw36k45hawwz0fcz5cmp5qydm85ncv0";
+    sha256 = "08c1wsdn0giv9zfb6bis9bbrw687rci8fs26qsal8ijmjk55dfsh";
  };

  patches = [
--- a/pkgs/applications/misc/cardpeek/default.nix
+++ b/pkgs/applications/misc/cardpeek/default.nix
@ -0,0 +1,28 @@
+{ stdenv, lib, fetchFromGitHub, pkgconfig, autoreconfHook,
+  glib, gtk3, pcsclite, lua5_2, curl, readline }:
+let
+  version = "0.8.4";
+in
+  stdenv.mkDerivation {
+    name = "cardpeek-${version}";
+
+    src = fetchFromGitHub {
+      owner = "L1L1";
+      repo = "cardpeek";
+      rev = "cardpeek-${version}";
+      sha256 = "1ighpl7nvcvwnsd6r5h5n9p95kclwrq99hq7bry7s53yr57l6588";
+    };
+
+    nativeBuildInputs = [ pkgconfig autoreconfHook ];
+    buildInputs = [ glib gtk3 pcsclite lua5_2 curl readline ];
+
+    enableParallelBuilding = true;
+
+    meta = with stdenv.lib; {
+      homepage = https://github.com/L1L1/cardpeek;
+      description = "A tool to read the contents of ISO7816 smart cards";
+      license = licenses.gpl3Plus;
+      platforms = with platforms; linux ++ darwin;
+      maintainers = with maintainers; [ embr ];
+    };
+  }
--- a/pkgs/applications/misc/chirp/default.nix
+++ b/pkgs/applications/misc/chirp/default.nix
@ -2,12 +2,12 @@
 , pyserial, pygtk }:

 stdenv.mkDerivation rec {
-  name = "chirp-daily-${version}";
-  version = "20181018";
+  pname = "chirp-daily";
+  version = "20190201";

  src = fetchurl {
-    url = "https://trac.chirp.danplanet.com/chirp_daily/daily-${version}/${name}.tar.gz";
-    sha256 = "0jd7xi6q09b3djn1k7pj1sbqvw24kn7dcp9r6abvxily4pc1xhdr";
+    url = "https://trac.chirp.danplanet.com/chirp_daily/daily-${version}/${pname}-${version}.tar.gz";
+    sha256 = "1ag3qzdq39zhpagviq9gpwk4y3h11z0j40nccsnhlq8h8bxpvwlf";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/misc/cool-retro-term/default.nix
+++ b/pkgs/applications/misc/cool-retro-term/default.nix
@ -2,14 +2,14 @@
 , qtquickcontrols, qtgraphicaleffects, qmake }:

 stdenv.mkDerivation rec {
-  version = "1.1.0";
+  version = "1.1.1";
  name = "cool-retro-term-${version}";

  src = fetchFromGitHub {
    owner = "Swordfish90";
    repo = "cool-retro-term";
    rev = version;
-    sha256 = "0gmigjpc19q7l94q4wzbrxh7cdb6zk3zscaijzwsz9364wsgzb47";
+    sha256 = "0mird4k88ml6y61hky2jynrjmnxl849fvhsr5jfdlnv0i7r5vwi5";
  };

  patchPhase = ''
--- a/pkgs/applications/misc/copyq/default.nix
+++ b/pkgs/applications/misc/copyq/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  name = "CopyQ-${version}";
-  version = "3.7.2";
+  version = "3.7.3";

  src  = fetchFromGitHub {
    owner = "hluk";
    repo = "CopyQ";
    rev = "v${version}";
-    sha256 = "1f2q9lzs5z31rl689ai2hig4nrj8cg9g25hhsrj6r85q9vkwkqjs";
+    sha256 = "1nxxxq0lfs4r673i70dh2xwdn3chcjl913bkz14kyna29i6n1nwm";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/misc/dmenu/default.nix
+++ b/pkgs/applications/misc/dmenu/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, libX11, libXinerama, libXft, zlib, patches ? null }:

 stdenv.mkDerivation rec {
-  name = "dmenu-4.8";
+  name = "dmenu-4.9";

  src = fetchurl {
    url = "https://dl.suckless.org/tools/${name}.tar.gz";
-    sha256 = "0qfvfrj10xlwd9hkvb57wshryan65bl6423h0qhiw1h76rf5lqgy";
+    sha256 = "0ia9nqr83bv6x247q30bal0v42chcj9qcjgv59xs6xj46m7iz5xk";
  };

  buildInputs = [ libX11 libXinerama zlib libXft ];
--- a/pkgs/applications/misc/fff/default.nix
+++ b/pkgs/applications/misc/fff/default.nix
@ -1,24 +1,26 @@
-{ stdenv, fetchFromGitHub, makeWrapper, xdg_utils, file, coreutils }:
+{ stdenv, fetchFromGitHub, makeWrapper, bashInteractive, xdg_utils, file, coreutils, w3m, xdotool }:

 stdenv.mkDerivation rec {
  pname = "fff";
-  version = "2.0";
+  version = "2.1";

  src = fetchFromGitHub {
    owner = "dylanaraps";
    repo = pname;
    rev = version;
-    sha256 = "0pqxqg1gnl3kgqma5vb0wcy4n9xbm0dp7g7dxl60cwcyqvd4vm3i";
+    sha256 = "0s5gi5ghwax5gc886pvbpcmsbmzhxzywajwzjsdxwjyd1v1iynwh";
  };

-  pathAdd = stdenv.lib.makeSearchPath "bin" [ xdg_utils file coreutils ];
-  buildInputs = [ makeWrapper ];
+  pathAdd = stdenv.lib.makeSearchPath "bin" ([ xdg_utils file coreutils w3m xdotool ]);

-  installPhase = ''
-    install -D fff "$out/bin/fff"
-    install -D README.md "$out/share/doc/fff/README.md"
-    install -D fff.1 "$out/share/man/man1/fff.1"
-    wrapProgram $out/bin/fff --prefix PATH : ${pathAdd}
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ bashInteractive ];
+  dontBuild = true;
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  postInstall = ''
+    wrapProgram "$out/bin/fff" --prefix PATH : $pathAdd
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/misc/flmsg/default.nix
+++ b/pkgs/applications/misc/flmsg/default.nix
@ -6,13 +6,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "4.0.7";
+  version = "4.0.8";
  pname = "flmsg";
-  name = "${pname}-${version}";

  src = fetchurl {
-    url = "mirror://sourceforge/fldigi/${name}.tar.gz";
-    sha256 = "1kdlwhxsw02pas9d0kakkq2713wj1m4q881f6am5aq4x8n01f4xw";
+    url = "mirror://sourceforge/fldigi/${pname}-${version}.tar.gz";
+    sha256 = "1yy9z6mchs7r3x108z5rp0h6a18zjqrn9zq5x72qwqh1byjnfwc8";
  };

  buildInputs = [
--- a/pkgs/applications/misc/flrig/default.nix
+++ b/pkgs/applications/misc/flrig/default.nix
@ -6,13 +6,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "1.3.41";
+  version = "1.3.42";
  pname = "flrig";
-  name = "${pname}-${version}";

  src = fetchurl {
-    url = "mirror://sourceforge/fldigi/${name}.tar.gz";
-    sha256 = "0vh14azg3pppyg3fb7kf6q3ighw1ka9m60jf2dzsd77f4hidhqx4";
+    url = "mirror://sourceforge/fldigi/${pname}-${version}.tar.gz";
+    sha256 = "10qn710ms145zq2xzb6z2fnygxmh5pmfmyfdbphrc7mrvd0phzp0";
  };

  buildInputs = [
--- a/pkgs/applications/misc/font-manager/default.nix
+++ b/pkgs/applications/misc/font-manager/default.nix
@ -49,10 +49,6 @@ stdenv.mkDerivation rec {
    patchShebangs meson_post_install.py
  '';

-  postInstall = ''
-    rm $out/share/applications/mimeinfo.cache
-  '';
-
  meta = {
    homepage = https://fontmanager.github.io/;
    description = "Simple font management for GTK+ desktop environments";
--- a/pkgs/applications/misc/haxor-news/default.nix
+++ b/pkgs/applications/misc/haxor-news/default.nix
@ -1,4 +1,4 @@
-{ stdenv, python }:
+{ stdenv, python, fetchpatch }:

 with python.pkgs;

@ -11,6 +11,12 @@ buildPythonApplication rec {
    sha256 = "5b9af8338a0f8b95a8133b66ef106553823813ac171c0aefa3f3f2dbeb4d7f88";
  };

+  # allow newer click version
+  patches = fetchpatch {
+    url = "${meta.homepage}/commit/5b0d3ef1775756ca15b6d83fba1fb751846b5427.patch";
+    sha256 = "1551knh2f7yarqzcpip16ijmbx8kzdna8cihxlxx49ww55f5sg67";
+  };
+
  propagatedBuildInputs = [
    click
    colorama
--- a/pkgs/applications/misc/k2pdfopt/default.nix
+++ b/pkgs/applications/misc/k2pdfopt/default.nix
@ -6,19 +6,29 @@
 , enableJPEG2K ? true, jasper
 , enableDJVU ? true, djvulibre
 , enableGOCR ? false, gocr # Disabled by default due to crashes
-, enableTesseract ? true, leptonica, tesseract
+, enableTesseract ? true, leptonica, tesseract4
 }:

 with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "k2pdfopt-${version}";
-  version = "2.42";
+  version = "2.51a";

-  src = fetchzip {
-    url = "http://www.willus.com/k2pdfopt/src/k2pdfopt_v${version}_src.zip";
-    sha256 = "1zag4jmkr0qrcpqqb5davmvdrabhdyz87q4zz0xpfkl6xw2dn9bk";
-  };
+  src = (fetchzip {
+    url = "http://www.willus.com/k2pdfopt/src/k2pdfopt_v2.51_src.zip";
+    sha256 = "133l7xkvi67s6sfk8cfh7rmavbsf7ib5fyksk1ci6b6sch3z2sw9";
+  });
+
+  # Note: the v2.51a zip contains only files to be replaced in the v2.50 zip.
+  v251a_src = (fetchzip {
+    url = "http://www.willus.com/k2pdfopt/src/k2pdfopt_v2.51a_src.zip";
+    sha256 = "0vvwblii7kgdwfxw8dzk6jbmz4dv94d7rkv18i60y8wkayj6yhl6";
+  });
+
+  postUnpack = ''
+    cp -r ${v251a_src}/* $sourceRoot
+  '';

  patches = [ ./k2pdfopt.patch ];

@ -27,65 +37,43 @@ stdenv.mkDerivation rec {
  buildInputs =
  let
    mupdf_modded = mupdf.overrideAttrs (attrs: {
-      name = "mupdf-1.10a";
-      version = "1.10a";
-      src = fetchurl {
-        url = "https://mupdf.com/downloads/archive/mupdf-1.10a-source.tar.gz";
-        sha256 = "0dm8wcs8i29aibzkqkrn8kcnk4q0kd1v66pg48h5c3qqp4v1zk5a";
-      };
      # Excluded the pdf-*.c files, since they mostly just broke the #includes
      prePatch = ''
        cp ${src}/mupdf_mod/{font,stext-device,string}.c source/fitz/
        cp ${src}/mupdf_mod/font-win32.c source/pdf/
      '';
-      # Patches from previous 1.10a version in nixpkgs
-      patches = [
-        # Compatibility with new openjpeg
-        ./load-jpx.patch
-
-        (fetchurl {
-         name = "CVE-2017-5896.patch";
-         url = "http://git.ghostscript.com/?p=mupdf.git;a=patch;h=2c4e5867ee699b1081527bc6c6ea0e99a35a5c27";
-         sha256 = "14k7x47ifx82sds1c06ibzbmcparfg80719jhgwjk6w1vkh4r693";
-        })
-
-        (fetchpatch {
-          name = "mupdf-1.10a-shared_libs-1.patch";
-          url = "https://ftp.osuosl.org/pub/blfs/conglomeration/mupdf/mupdf-1.10a-shared_libs-1.patch";
-          sha256 = "0kg4vahp7hlyyj5hl18brk8s8xcbqrx19pqjzkfq6ha8mqa3k4ab";
-        })
-      ];
-
-      # Override this since the jpeg directory was renamed libjpeg in mupdf 1.11
-      preConfigure = ''
-        # Don't remove mujs because upstream version is incompatible
-        rm -rf thirdparty/{curl,freetype,glfw,harfbuzz,jbig2dec,jpeg,openjpeg,zlib}
-      '';
-      postPatch = let
-        # OpenJPEG version is hardcoded in package source
-        openJpegVersion = with stdenv;
-          lib.concatStringsSep "." (lib.lists.take 2
-          (lib.splitString "." (lib.getVersion openjpeg)));
-        in ''
-          sed -i "s/__OPENJPEG__VERSION__/${openJpegVersion}/" source/fitz/load-jpx.c
-        '';
    });
+
    leptonica_modded = leptonica.overrideAttrs (attrs: {
+      name = "leptonica-1.74.4";
+      # Modified source files apply to this particular version of leptonica
+      version = "1.74.4";
+
+      src = fetchurl {
+        url = "http://www.leptonica.org/source/leptonica-1.74.4.tar.gz";
+        sha256 = "0fw39amgyv8v6nc7x8a4c7i37dm04i6c5zn62d24bgqnlhk59hr9";
+      };
+
      prePatch = ''
-        cp ${src}/leptonica_mod/* src/
+        cp ${src}/leptonica_mod/{allheaders.h,dewarp2.c,leptwin.c} src/
      '';
+      patches = [];
    });
-    tesseract_modded = tesseract.override {
-      tesseractBase = tesseract.tesseractBase.overrideAttrs (_: {
+    tesseract_modded = tesseract4.override {
+      tesseractBase = tesseract4.tesseractBase.overrideAttrs (_: {
        prePatch = ''
-          cp ${src}/tesseract_mod/{ambigs.cpp,ccutil.h,ccutil.cpp} ccutil/
-          cp ${src}/tesseract_mod/dawg.cpp api/
-          cp ${src}/tesseract_mod/{imagedata.cpp,tessdatamanager.cpp} ccstruct/
-          cp ${src}/tesseract_mod/openclwrapper.h opencl/
-          cp ${src}/tesseract_mod/{tessedit.cpp,thresholder.cpp} ccmain/
-          cp ${src}/tesseract_mod/tess_lang_mod_edge.h cube/
-          cp ${src}/tesseract_mod/tesscapi.cpp api/
-          cp ${src}/include_mod/{tesseract.h,leptonica.h} api/
+          cp ${src}/tesseract_mod/baseapi.{h,cpp} src/api/
+          cp ${src}/tesseract_mod/ccutil.{h,cpp} src/ccutil/
+          cp ${src}/tesseract_mod/genericvector.h src/ccutil/
+          cp ${src}/tesseract_mod/input.cpp src/lstm/
+          cp ${src}/tesseract_mod/lstmrecognizer.cpp src/lstm/
+          cp ${src}/tesseract_mod/mainblk.cpp src/ccutil/
+          cp ${src}/tesseract_mod/params.cpp src/ccutil/
+          cp ${src}/tesseract_mod/serialis.{h,cpp} src/ccutil/
+          cp ${src}/tesseract_mod/tesscapi.cpp src/api/
+          cp ${src}/tesseract_mod/tessdatamanager.cpp src/ccstruct/
+          cp ${src}/tesseract_mod/tessedit.cpp src/ccmain/
+          cp ${src}/include_mod/{tesseract.h,leptonica.h} src/api/
        '';
        patches = [ ./tesseract.patch ];
      });
--- a/pkgs/applications/misc/k2pdfopt/load-jpx.patch
+++ b/pkgs/applications/misc/k2pdfopt/load-jpx.patch
@ -1,29 +0,0 @@
--- a/source/fitz/load-jpx.c
-+++ b/source/fitz/load-jpx.c
-@@ -484,12 +484,16 @@
- /* Without the definition of OPJ_STATIC, compilation fails on windows
-  * due to the use of __stdcall. We believe it is required on some
-  * linux toolchains too. */
-+#ifdef __cplusplus
-+extern "C"
-+{
- #define OPJ_STATIC
- #ifndef _MSC_VER
- #define OPJ_HAVE_STDINT_H
- #endif
-+#endif
- 
-#include <openjpeg.h>
-+#include <openjpeg-__OPENJPEG__VERSION__/openjpeg.h>
- 
- /* OpenJPEG does not provide a safe mechanism to intercept
-  * allocations. In the latest version all allocations go
-@@ -971,4 +975,8 @@
- 	fz_drop_pixmap(ctx, img);
- }
- 
-+#ifdef __cplusplus
-+}
-+#endif
-+
- #endif /* HAVE_LURATECH */
--- a/pkgs/applications/misc/k2pdfopt/tesseract.patch
+++ b/pkgs/applications/misc/k2pdfopt/tesseract.patch
@ -1,7 +1,7 @@
-diff --git a/api/Makefile.am b/api/Makefile.am
+diff --git a/src/api/Makefile.am b/src/api/Makefile.am
 index d8c1e54..46ead13 100644
--- a/api/Makefile.am
-+++ b/api/Makefile.am
+--- a/src/api/Makefile.am
+++ b/src/api/Makefile.am
@@ -42,7 +42,7 @@ libtesseract_api_la_CPPFLAGS = $(AM_CPPFLAGS)
 if VISIBILITY
 libtesseract_api_la_CPPFLAGS += -DTESS_EXPORTS
--- a/pkgs/applications/misc/kitty/default.nix
+++ b/pkgs/applications/misc/kitty/default.nix
@ -45,6 +45,12 @@ buildPythonApplication rec {
    cp -r linux-package/{bin,share,lib} $out
    wrapProgram "$out/bin/kitty" --prefix PATH : "$out/bin:${stdenv.lib.makeBinPath [ imagemagick xsel ]}"
    runHook postInstall
+
+    # ZSH completions need to be invoked with `source`:
+    # https://github.com/kovidgoyal/kitty/blob/8ceb941051b89b7c50850778634f0b6137aa5e6e/docs/index.rst#zsh
+    mkdir -p "$out/share/"{bash-completion/completions,fish/vendor_completions.d,zsh/site-functions}
+    "$out/bin/kitty" + complete setup fish > "$out/share/fish/vendor_completions.d/kitty.fish"
+    "$out/bin/kitty" + complete setup bash > "$out/share/bash-completion/completions/kitty.bash"
  '';

  postInstall = ''
--- a/pkgs/applications/misc/latte-dock/default.nix
+++ b/pkgs/applications/misc/latte-dock/default.nix
@ -3,12 +3,12 @@

 mkDerivation rec {
  pname = "latte-dock";
-  version = "0.8.4";
+  version = "0.8.5";
  name = "${pname}-${version}";

  src = fetchurl {
    url = "https://download.kde.org/stable/${pname}/${name}.tar.xz";
-    sha256 = "0zm2xckyaymd53a38mf1bh9in4bh2bshbr3z8z9gn6mp7c60jay3";
+    sha256 = "1yhnmppp65xy8skainn438q3hwlpsz8qcj4ksvl8xdz5jzn7gs7k";
    name = "${name}.tar.xz";
  };

--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@ -67,7 +67,7 @@ in stdenv.mkDerivation rec {
    Name: mupdf
    Description: Library for rendering PDF documents
    Version: ${version}
-    Libs: -L$out/lib -lmupdf -lmupdfthird
+    Libs: -L$out/lib -lmupdf -lmupdf-third
    Cflags: -I$dev/include
    EOF

--- a/pkgs/applications/misc/mysql-workbench/default.nix
+++ b/pkgs/applications/misc/mysql-workbench/default.nix
@ -13,12 +13,12 @@ let
  inherit (python2.pkgs) paramiko pycairo pyodbc;
 in stdenv.mkDerivation rec {
  pname = "mysql-workbench";
-  version = "8.0.13";
+  version = "8.0.14";
  name = "${pname}-${version}";

  src = fetchurl {
    url = "http://dev.mysql.com/get/Downloads/MySQLGUITools/mysql-workbench-community-${version}-src.tar.gz";
-    sha256 = "1p4xy2a5cin1l06j4ixpgp1ynhjdj5gax4fjhznspch3c63jp9hj";
+    sha256 = "0mz615drx18h0frc6fq9nknqbpq7lr0xlsfmxd5irw2jz629lj76";
  };

  patches = [
--- a/pkgs/applications/misc/notejot/default.nix
+++ b/pkgs/applications/misc/notejot/default.nix
@ -3,7 +3,7 @@

 stdenv.mkDerivation rec {
  pname = "notejot";
-  version = "1.5.3";
+  version = "1.5.4";

  name = "${pname}-${version}";

@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    owner = "lainsce";
    repo = pname;
    rev = version;
-    sha256 = "1n41sg9a38p9qp8pz3lx9rnb8kc069vkbwf963zzpzs2745h6s9v";
+    sha256 = "1lv4s2mqddi6lz414kqpp4vcwnkjibc0k2xhnczaa1wf3azlxjgf";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/orca/default.nix
+++ b/pkgs/applications/misc/orca/default.nix
@ -7,15 +7,17 @@
 , speechd, brltty, setproctitle, gst_all_1, gst-python
 }:

-buildPythonApplication rec {
+let
  pname = "orca";
-  version = "3.30.1";
+  version = "3.30.2";
+in buildPythonApplication rec {
+  name = "${pname}-${version}";

  format = "other";

  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1b9s69frjmghjm1p9a4rrvknl9m0qlwr7mr4lsxkvjnblhsnw0g7";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    sha256 = "17asibc46i5gr2fw04jvvdi85zzmxwlnhyq7r6cr3m5prrdr8a53";
  };

  patches = [
--- a/pkgs/applications/misc/pdfpc/default.nix
+++ b/pkgs/applications/misc/pdfpc/default.nix
@ -4,13 +4,13 @@
 stdenv.mkDerivation rec {
  name = "${product}-${version}";
  product = "pdfpc";
-  version = "4.3.1_0";
+  version = "4.3.2";

  src = fetchFromGitHub {
-    repo = "pdfpc";
-    owner = "pdfpc";
+    repo = product;
+    owner = product;
    rev = "v${version}";
-    sha256 = "04bvgpdy3l030jd1f87a94lz4lky29skpak3k0bzazsajwpywprd";
+    sha256 = "15y6g92fp6x6dwwhrhkfny5z20w7pq9c8w19fh2vzff9aa6m2h9z";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/qolibri/default.nix
+++ b/pkgs/applications/misc/qolibri/default.nix
@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, pkgconfig, cmake, libeb, lzo, qtbase
+, qtmultimedia, qttools, qtwebengine }:
+
+stdenv.mkDerivation rec {
+  name = "qolibri-${version}";
+  version = "2018-11-14";
+
+  src = fetchFromGitHub {
+    owner = "ludios";
+    repo = "qolibri";
+    rev = "133a1c33e74d931ad54407f70d84a0016d96981f";
+    sha256 = "16ifix0q8ww4l3xflgxr9j81c0lzlnkjr8fj961x3nxz7288pdg2";
+  };
+
+  nativeBuildInputs = [ pkgconfig cmake ];
+  buildInputs = [
+    libeb lzo qtbase qtmultimedia qttools qtwebengine
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/ludios/qolibri;
+    description = "EPWING reader for viewing Japanese dictionaries";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ ivan ];
+    license = licenses.gpl2;
+  };
+}
--- a/pkgs/applications/misc/ranger/default.nix
+++ b/pkgs/applications/misc/ranger/default.nix
@ -19,7 +19,8 @@ python3Packages.buildPythonApplication rec {
  LC_ALL = "en_US.UTF-8";

  checkInputs = with python3Packages; [ pytest ];
-  propagatedBuildInputs = [ file ];
+  propagatedBuildInputs = [ file ]
+    ++ lib.optional (imagePreviewSupport) [ python3Packages.pillow ];

  checkPhase = ''
    py.test tests
--- a/pkgs/applications/misc/st/default.nix
+++ b/pkgs/applications/misc/st/default.nix
@ -4,11 +4,11 @@
 with stdenv.lib;

 stdenv.mkDerivation rec {
-  name = "st-0.8.1";
+  name = "st-0.8.2";

  src = fetchurl {
    url = "https://dl.suckless.org/st/${name}.tar.gz";
-    sha256 = "09k94v3n20gg32xy7y68p96x9dq5msl80gknf9gbvlyjp3i0zyy4";
+    sha256 = "0ddz2mdp1c7q67rd5vrvws9r0493ln0mlqyc3d73dv8im884xdxf";
  };

  inherit patches;
--- a/pkgs/applications/misc/xastir/default.nix
+++ b/pkgs/applications/misc/xastir/default.nix
@ -5,14 +5,14 @@
 }:

 stdenv.mkDerivation rec {
-  name = "xastir-${version}";
-  version = "208";
+  pname = "xastir";
+  version = "2.1.0";

  src = fetchFromGitHub {
-    owner = "Xastir";
-    repo = "Xastir";
-    rev = "707f3aa8c7ca3e3fecd32d5a4af3f742437e5dce";
-    sha256 = "1mm22vn3hws7dmg9wpaj4s0zkzb77i3aqa2ay3q6kqjkdhv25brl";
+    owner = pname;
+    repo = pname;
+    rev = "Release-${version}";
+    sha256 = "16zsgy3589snawr8f1fa22ymvpnjy6njvxmsck7q8p2xmmz2ry7r";
  };

  buildInputs = [
--- a/pkgs/applications/misc/xlog/default.nix
+++ b/pkgs/applications/misc/xlog/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, glib, gtk2, pkgconfig, hamlib }:
 stdenv.mkDerivation rec {
-  name = "xlog-${version}";
-  version = "2.0.15";
-  
+  pname = "xlog";
+  version = "2.0.17";
+
  src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/xlog/${name}.tar.gz";
-    sha256 = "0an883wqw3zwpw8nqinm9cb17hp2xw9vf603k4l2345p61jqdw2j";
+    url = "https://download.savannah.gnu.org/releases/xlog/${pname}-${version}.tar.gz";
+    sha256 = "0vmn8518zk7qk1mbp1h8dm0f8fx0z0jvmy42c1n15il714lj7vsl";
  };

  buildInputs = [ glib pkgconfig gtk2 hamlib ];
@ -18,12 +18,11 @@ stdenv.mkDerivation rec {
         and EDI (ARRL VHF/UHF contest format) and can import twlog, editest and OH1AA logbook files.
         Xlog is able to do DXCC lookups and will display country information, CQ and ITU zone,
         location in latitude and longitude and distance and heading in kilometers or miles,
-         both for short and long path. 
+         both for short and long path.
      '';
    homepage = https://www.nongnu.org/xlog;
    maintainers = [ maintainers.mafo ];
    license = licenses.gpl3;
    platforms = platforms.unix;
  };
-
 }
--- a/pkgs/applications/misc/xsuspender/default.nix
+++ b/pkgs/applications/misc/xsuspender/default.nix
@ -0,0 +1,36 @@
+{ lib, stdenv, fetchFromGitHub, cmake, makeWrapper, pkgconfig
+, glib, libwnck3, procps }:
+
+with lib;
+
+stdenv.mkDerivation rec {
+  name = "xsuspender-${version}";
+  version = "1.1";
+
+  src = fetchFromGitHub {
+    owner = "kernc";
+    repo = "xsuspender";
+    rev = version;
+    sha256 = "03lbga68dxg89d227sdwk1f5xj4r1pmj0qh2kasi2cqh8ll7qv4b";
+  };
+
+  outputs = [ "out" "man" "doc" ];
+
+  nativeBuildInputs = [ cmake pkgconfig makeWrapper ];
+  buildInputs = [ glib libwnck3 ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    wrapProgram $out/bin/xsuspender \
+      --prefix PATH : "${makeBinPath [ procps ]}"
+  '';
+
+  meta = {
+    description = "Auto-suspend inactive X11 applications.";
+    homepage = "https://kernc.github.io/xsuspender/";
+    license = licenses.wtfpl;
+    maintainers = with maintainers; [ offline ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -76,11 +76,11 @@ let rpath = lib.makeLibraryPath [

 in stdenv.mkDerivation rec {
    pname = "brave";
-    version = "0.58.21";
+    version = "0.59.34";

    src = fetchurl {
        url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-        sha256 = "0mml8zjpm8gjw3krppr57y4p10ky975v0s4wyyx7ixr1lzk2qp11";
+        sha256 = "1i14y01387q0h12w6h780v9d98qygmx0w0vbygy4w9x9aj5nnask";
    };

    dontConfigure = true;
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/cluster/kube-router/default.nix
+++ b/pkgs/applications/networking/cluster/kube-router/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name = "kube-router-${version}";
-  version = "0.2.3";
+  version = "0.2.5";
  rev = "v${version}";

  goPackagePath = "github.com/cloudnativelabs/kube-router";
@ -11,7 +11,7 @@ buildGoPackage rec {
    inherit rev;
    owner = "cloudnativelabs";
    repo = "kube-router";
-    sha256 = "1dsr76dq6sycwgh75glrcb4scv52lrrd0aivskhc7mwq30plafcj";
+    sha256 = "1j6q6kg4qj75v2mdy9ivvwq8mx9fpdf0w08959l8imrp5byd56wv";
  };

  buildFlagsArray = ''
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@ -15,13 +15,13 @@ with lib;

 stdenv.mkDerivation rec {
  name = "kubernetes-${version}";
-  version = "1.13.2";
+  version = "1.13.3";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kubernetes";
    rev = "v${version}";
-    sha256 = "1j5yyzn3c481ba6bbyx6gsa41zhg3x35sdbajlnxmbnid0g21g8g";
+    sha256 = "1fcp27c501ql4v7fl7rl5qyjlw1awk139rwwm0jqdpgh3sd22l2z";
  };

  buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];
--- a/pkgs/applications/networking/gns3/default.nix
+++ b/pkgs/applications/networking/gns3/default.nix
@ -2,8 +2,7 @@

 let
  stableVersion = "2.1.12";
-  # Currently there is no preview version.
-  previewVersion = stableVersion;
+  previewVersion = "2.2.0a1";
  addVersion = args:
    let version = if args.stable then stableVersion else previewVersion;
        branch = if args.stable then "stable" else "preview";
@ -19,7 +18,7 @@ in {
  };
  guiPreview = mkGui {
    stable = false;
-    sha256Hash = guiSrcHash;
+    sha256Hash = "16jjgfbdi7b3349wrqalf40qcaqzw3d4vdjbwcy8dbqblg48hn5w";
  };

  serverStable = mkServer {
@ -28,6 +27,6 @@ in {
  };
  serverPreview = mkServer {
    stable = false;
-    sha256Hash = serverSrcHash;
+    sha256Hash = "0bcsjljy947grfn3y9xyi3dbzdw5wkljq1nr66cqfkidx9f4fzni";
  };
 }
--- a/pkgs/applications/networking/gns3/gui.nix
+++ b/pkgs/applications/networking/gns3/gui.nix
@ -20,7 +20,7 @@ in pythonPackages.buildPythonPackage rec {
    raven psutil jsonschema # tox for check
    # Runtime dependencies
    sip (pyqt5.override { withWebSockets = true; })
-  ];
+  ] ++ stdenv.lib.optional (!stable) pythonPackages.distro;

  doCheck = false; # Failing

--- a/Show More
+++ b/Show More