Merge master into staging-next

2020-05-05 19:51:09 +02:00 · 2020-05-05 19:51:09 +02:00 · 9875bbae75
commit 9875bbae75
parent 320f79365d 73dc3fc400
372 changed files with 3551 additions and 1619 deletions
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@ -15,7 +15,7 @@ Reviewing guidelines: https://hydra.nixos.org/job/nixpkgs/trunk/manual/latest/do

 <!-- Please check what applies. Note that these are not hard requirements but merely serve as information for reviewers. -->

- [ ] Tested using sandboxing ([nix.useSandbox](http://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS, or option `sandbox` in [`nix.conf`](http://nixos.org/nix/manual/#sec-conf-file) on non-NixOS linux)
+- [ ] Tested using sandboxing ([nix.useSandbox](https://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS, or option `sandbox` in [`nix.conf`](https://nixos.org/nix/manual/#sec-conf-file) on non-NixOS linux)
 - Built on platform(s)
   - [ ] NixOS
   - [ ] macOS
--- a/doc/contributing/quick-start.xml
+++ b/doc/contributing/quick-start.xml
@ -111,7 +111,7 @@
    </para>
    <para>
     The exact syntax and semantics of the Nix expression language, including the built-in function, are described in the Nix manual in the <link
-    xlink:href="http://hydra.nixos.org/job/nix/trunk/tarball/latest/download-by-type/doc/manual/#chap-writing-nix-expressions">chapter on writing Nix expressions</link>.
+    xlink:href="https://hydra.nixos.org/job/nix/trunk/tarball/latest/download-by-type/doc/manual/#chap-writing-nix-expressions">chapter on writing Nix expressions</link>.
    </para>
   </listitem>
   <listitem>
--- a/doc/languages-frameworks/android.section.md
+++ b/doc/languages-frameworks/android.section.md
@ -167,7 +167,7 @@ parameters that the SDK composition function (the function shown in the
 previous section) supports.

 This build function is particularly useful when it is desired to use
-[Hydra](http://nixos.org/hydra): the Nix-based continuous integration solution
+[Hydra](https://nixos.org/hydra): the Nix-based continuous integration solution
 to build Android apps. An Android APK gets exposed as a build product and can be
 installed on any Android device with a web browser by navigating to the build
 result page.
--- a/doc/languages-frameworks/index.xml
+++ b/doc/languages-frameworks/index.xml
@ -21,6 +21,7 @@
 <xi:include href="node.section.xml" />
 <xi:include href="ocaml.xml" />
 <xi:include href="perl.xml" />
+ <xi:include href="php.section.xml" />
 <xi:include href="python.section.xml" />
 <xi:include href="qt.xml" />
 <xi:include href="r.section.xml" />
--- a/doc/languages-frameworks/ios.section.md
+++ b/doc/languages-frameworks/ios.section.md
@ -18,7 +18,7 @@ The primary objective of this project is to use the Nix expression language to
 specify how iOS apps can be built from source code, and to automatically spawn
 iOS simulator instances for testing.

-This component also makes it possible to use [Hydra](http://nixos.org/hydra),
+This component also makes it possible to use [Hydra](https://nixos.org/hydra),
 the Nix-based continuous integration server to regularly build iOS apps and to
 do wireless ad-hoc installations of enterprise IPAs on iOS devices through
 Hydra.
--- a/doc/languages-frameworks/php.section.md
+++ b/doc/languages-frameworks/php.section.md
@ -1,10 +1,8 @@
-# PHP
+# PHP {#sec-php}

-## User Guide
+## User Guide {#ssec-php-user-guide}

-### Using PHP
-
-#### Overview
+### Overview {#ssec-php-user-guide-overview}

 Several versions of PHP are available on Nix, each of which having a
 wide variety of extensions and libraries available.
@ -36,7 +34,7 @@ opcache extension shipped with PHP is available at
 `php.extensions.opcache` and the third-party ImageMagick extension at
 `php.extensions.imagick`.

-#### Installing PHP with extensions
+### Installing PHP with extensions {#ssec-php-user-guide-installing-with-extensions}

 A PHP package with specific extensions enabled can be built using
 `php.withExtensions`. This is a function which accepts an anonymous
@ -64,7 +62,7 @@ To build your list of extensions from the ground up, you can simply
 ignore `enabled`:

 ```nix
-php.withExtensions ({ all, ... }: with all; [ opcache imagick ])
+php.withExtensions ({ all, ... }: with all; [ imagick opcache ])
 ```

 `php.withExtensions` provides extensions by wrapping a minimal php
@ -89,14 +87,14 @@ php.buildEnv {
 }
 ```

-##### Example setup for `phpfpm`
+#### Example setup for `phpfpm` {#ssec-php-user-guide-installing-with-extensions-phpfpm}

 You can use the previous examples in a `phpfpm` pool called `foo` as
 follows:

 ```nix
 let
-  myPhp = php.withExtensions ({ all, ... }: with all; [ opcache imagick ]);
+  myPhp = php.withExtensions ({ all, ... }: with all; [ imagick opcache ]);
 in {
  services.phpfpm.pools."foo".phpPackage = myPhp;
 };
@ -113,7 +111,7 @@ in {
 };
 ```

-##### Example usage with `nix-shell`
+#### Example usage with `nix-shell` {#ssec-php-user-guide-installing-with-extensions-nix-shell}

 This brings up a temporary environment that contains a PHP interpreter
 with the extensions `imagick` and `opcache` enabled:
@ -121,3 +119,19 @@ with the extensions `imagick` and `opcache` enabled:
 ```sh
 nix-shell -p 'php.withExtensions ({ all, ... }: with all; [ imagick opcache ])'
 ```
+
+### Installing PHP packages with extensions {#ssec-php-user-guide-installing-packages-with-extensions}
+
+All interactive tools use the PHP package you get them from, so all
+packages at `php.packages.*` use the `php` package with its default
+extensions. Sometimes this default set of extensions isn't enough and
+you may want to extend it. A common case of this is the `composer`
+package: a project may depend on certain extensions and `composer`
+won't work with that project unless those extensions are loaded.
+
+Example of building `composer` with additional extensions:
+```nix
+(php.withExtensions ({ all, enabled }:
+  enabled ++ (with all; [ imagick redis ]))
+).packages.composer
+```
--- a/doc/preface.chapter.md
+++ b/doc/preface.chapter.md
@ -42,7 +42,7 @@ distributed as soon as all tests for that channel pass, e.g.
 [this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
 shows the status of tests for the `nixpkgs` channel.

-The tests are conducted by a cluster called [Hydra](http://nixos.org/hydra/),
+The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
 which also builds binary packages from the Nix expressions in Nixpkgs for
 `x86_64-linux`, `i686-linux` and `x86_64-darwin`.
 The binaries are made available via a [binary cache](https://cache.nixos.org).
--- a/doc/release-notes.xml
+++ b/doc/release-notes.xml
@ -286,7 +286,7 @@ export NIX_MIRRORS_sourceforge=http://osdn.dl.sourceforge.net/sourceforge/</prog
  <note>
   <para>
    This release of Nixpkgs requires <link
-xlink:href='http://nixos.org/releases/nix/nix-0.10/'>Nix 0.10</link> or higher.
+xlink:href='https://nixos.org/releases/nix/nix-0.10/'>Nix 0.10</link> or higher.
   </para>
  </note>

@ -436,7 +436,7 @@ stdenv.mkDerivation {
   <listitem>
    <para>
     Distribution files have been moved to <link
-  xlink:href="http://nixos.org/" />.
+  xlink:href="https://nixos.org/" />.
    </para>
   </listitem>
   <listitem>
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -758,7 +758,7 @@
    name = "Jonathan Glines";
  };
  avaq = {
-    email = "avaq+nixos@xs4all.nl";
+    email = "nixpkgs@account.avaq.it";
    github = "avaq";
    githubId = 1217745;
    name = "Aldwin Vlasblom";
@ -4084,6 +4084,12 @@
    githubId = 6346418;
    name = "Kolby Crouch";
  };
+  kolloch = {
+    email = "info@eigenvalue.net";
+    github = "kolloch";
+    githubId = 339354;
+    name = "Peter Kolloch";
+  };
  konimex = {
    email = "herdiansyah@netc.eu";
    github = "konimex";
@ -4423,6 +4429,16 @@
      fingerprint = "74F5 E5CC 19D3 B5CB 608F  6124 68FF 81E6 A785 0F49";
    }];
  };
+  lourkeur = {
+    name = "Louis Bettens";
+    email = "louis@bettens.info";
+    github = "lourkeur";
+    githubId = 15657735;
+    keys = [{
+      longkeyid = "ed25519/0xDFE1D4A017337E2A";
+      fingerprint = "5B93 9CFA E8FC 4D8F E07A  3AEA DFE1 D4A0 1733 7E2A";
+    }];
+  };
  luis = {
    email = "luis.nixos@gmail.com";
    github = "Luis-Hebendanz";
@ -7130,6 +7146,12 @@
    githubId = 602439;
    name = "Serguei Narojnyi";
  };
+  snicket2100 = {
+    email = "57048005+snicket2100@users.noreply.github.com";
+    github = "snicket2100";
+    githubId = 57048005;
+    name = "snicket2100";
+  };
  snyh = {
    email = "snyh@snyh.org";
    github = "snyh";
--- a/maintainers/scripts/hydra-eval-failures.py
+++ b/maintainers/scripts/hydra-eval-failures.py
@ -79,7 +79,7 @@ def cli(jobset):
    and print a summary of failed builds
    """

-    url = "http://hydra.nixos.org/jobset/{}".format(jobset)
+    url = "https://hydra.nixos.org/jobset/{}".format(jobset)

    # get the last evaluation
    click.echo(click.style(
--- a/nixos/README
+++ b/nixos/README
@ -2,4 +2,4 @@

 NixOS is a Linux distribution based on the purely functional package
 management system Nix.  More information can be found at
-http://nixos.org/nixos and in the manual in doc/manual.
+https://nixos.org/nixos and in the manual in doc/manual.
--- a/nixos/doc/manual/configuration/adding-custom-packages.xml
+++ b/nixos/doc/manual/configuration/adding-custom-packages.xml
@ -11,7 +11,7 @@
  the package to your clone, and (optionally) submit a patch or pull request to
  have it accepted into the main Nixpkgs repository. This is described in
  detail in the <link
-xlink:href="http://nixos.org/nixpkgs/manual">Nixpkgs
+xlink:href="https://nixos.org/nixpkgs/manual">Nixpkgs
  manual</link>. In short, you clone Nixpkgs:
 <screen>
 <prompt>$ </prompt>git clone https://github.com/NixOS/nixpkgs
--- a/nixos/doc/manual/configuration/config-syntax.xml
+++ b/nixos/doc/manual/configuration/config-syntax.xml
@ -14,7 +14,7 @@
  when managing complex systems. The syntax and semantics of the Nix language
  are fully described in the
  <link
-xlink:href="http://nixos.org/nix/manual/#chap-writing-nix-expressions">Nix
+xlink:href="https://nixos.org/nix/manual/#chap-writing-nix-expressions">Nix
  manual</link>, but here we give a short overview of the most important
  constructs useful in NixOS configuration files.
 </para>
--- a/nixos/doc/manual/configuration/summary.xml
+++ b/nixos/doc/manual/configuration/summary.xml
@ -10,7 +10,7 @@
  expression language. It’s not complete. In particular, there are many other
  built-in functions. See the
  <link
-xlink:href="http://nixos.org/nix/manual/#chap-writing-nix-expressions">Nix
+xlink:href="https://nixos.org/nix/manual/#chap-writing-nix-expressions">Nix
  manual</link> for the rest.
 </para>

--- a/nixos/doc/manual/development/releases.xml
+++ b/nixos/doc/manual/development/releases.xml
@ -57,7 +57,7 @@
    <listitem>
     <para>
      <link xlink:href="https://github.com/NixOS/nixos-org-configurations/pull/18">
-      Make sure a channel is created at http://nixos.org/channels/. </link>
+      Make sure a channel is created at https://nixos.org/channels/. </link>
     </para>
    </listitem>
    <listitem>
--- a/nixos/doc/manual/development/replace-modules.xml
+++ b/nixos/doc/manual/development/replace-modules.xml
@ -37,7 +37,7 @@

  imports =
    [ # Use postgresql service from nixos-unstable channel.
-      # sudo nix-channel --add http://nixos.org/channels/nixos-unstable nixos-unstable
+      # sudo nix-channel --add https://nixos.org/channels/nixos-unstable nixos-unstable
      &lt;nixos-unstable/nixos/modules/services/databases/postgresql.nix&gt;
    ];

--- a/nixos/doc/manual/installation/obtaining.xml
+++ b/nixos/doc/manual/installation/obtaining.xml
@ -7,7 +7,7 @@
 <para>
  NixOS ISO images can be downloaded from the
  <link
-xlink:href="http://nixos.org/nixos/download.html">NixOS download
+xlink:href="https://nixos.org/nixos/download.html">NixOS download
  page</link>. There are a number of installation options. If you happen to
  have an optical drive and a spare CD, burning the image to CD and booting
  from that is probably the easiest option. Most people will need to prepare a
@ -26,7 +26,7 @@ xlink:href="https://nixos.wiki/wiki/NixOS_Installation_Guide#Making_the_installa
    <para>
     Using virtual appliances in Open Virtualization Format (OVF) that can be
     imported into VirtualBox. These are available from the
-     <link xlink:href="http://nixos.org/nixos/download.html">NixOS download
+     <link xlink:href="https://nixos.org/nixos/download.html">NixOS download
     page</link>.
    </para>
   </listitem>
--- a/nixos/doc/manual/release-notes/rl-1404.xml
+++ b/nixos/doc/manual/release-notes/rl-1404.xml
@ -49,7 +49,7 @@
    <para>
     Nix has been updated to 1.7
     (<link
-  xlink:href="http://nixos.org/nix/manual/#ssec-relnotes-1.7">details</link>).
+  xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-1.7">details</link>).
    </para>
   </listitem>
   <listitem>
--- a/nixos/doc/manual/release-notes/rl-1509.xml
+++ b/nixos/doc/manual/release-notes/rl-1509.xml
@ -22,7 +22,7 @@
    in excess of 8,000 Haskell packages. Detailed instructions on how to use
    that infrastructure can be found in the
    <link
-    xlink:href="http://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
+    xlink:href="https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
    Guide to the Haskell Infrastructure</link>. Users migrating from an earlier
    release may find helpful information below, in the list of
    backwards-incompatible changes. Furthermore, we distribute 51(!) additional
@ -555,7 +555,7 @@ nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA haskellPackages.pandoc
     the compiler now is the <literal>haskellPackages.ghcWithPackages</literal>
     function. The
     <link
-    xlink:href="http://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
+    xlink:href="https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's
     Guide to the Haskell Infrastructure</link> provides more information about
     this subject.
    </para>
--- a/nixos/doc/manual/release-notes/rl-1603.xml
+++ b/nixos/doc/manual/release-notes/rl-1603.xml
@ -54,7 +54,7 @@
    xlink:href="https://reproducible-builds.org/specs/source-date-epoch/">SOURCE_DATE_EPOCH</envar>
    to a deterministic value, and Nix has
    <link
-    xlink:href="http://nixos.org/nix/manual/#ssec-relnotes-1.11">gained
+    xlink:href="https://nixos.org/nix/manual/#ssec-relnotes-1.11">gained
    an option</link> to repeat a build a number of times to test determinism.
    An ongoing project, the goal of exact reproducibility is to allow binaries
    to be verified independently (e.g., a user might only trust binaries that
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -55,6 +55,12 @@
     The new <varname>virtualisation.containers</varname> module manages configuration shared by the CRI-O and Podman modules.
    </para>
   </listitem>
+   <listitem>
+    <para>
+      Declarative Docker containers are renamed from <varname>docker-containers</varname> to <varname>virtualisation.oci-containers.containers</varname>.
+      This is to make it possible to use <literal>podman</literal> instead of <literal>docker</literal>.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -984,9 +984,9 @@
  ./virtualisation/container-config.nix
  ./virtualisation/containers.nix
  ./virtualisation/nixos-containers.nix
+  ./virtualisation/oci-containers.nix
  ./virtualisation/cri-o.nix
  ./virtualisation/docker.nix
-  ./virtualisation/docker-containers.nix
  ./virtualisation/ecs-agent.nix
  ./virtualisation/libvirtd.nix
  ./virtualisation/lxc.nix
--- a/nixos/modules/programs/venus.nix
+++ b/nixos/modules/programs/venus.nix
@ -75,7 +75,7 @@ in
      };

      link = mkOption {
-        default = "http://planet.nixos.org";
+        default = "https://planet.nixos.org";
        type = types.str;
        description = ''
          Link to the main page.
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@ -87,19 +87,19 @@ let
        default = {};
        example = literalExample ''
          {
-            "example.org" = "/srv/http/nginx";
+            "example.org" = null;
            "mydomain.org" = null;
          }
        '';
        description = ''
-          A list of extra domain names, which are included in the one certificate to be issued, with their
-          own server roots if needed.
+          A list of extra domain names, which are included in the one certificate to be issued.
+          Setting a distinct server root is deprecated and not functional in 20.03+
        '';
      };

      keyType = mkOption {
        type = types.str;
-        default = "ec384";
+        default = "ec256";
        description = ''
          Key type to use for private keys.
          For an up to date list of supported values check the --key-type option
@ -250,7 +250,7 @@ in
            "example.com" = {
              webroot = "/var/www/challenges/";
              email = "foo@example.com";
-              extraDomains = { "www.example.com" = null; "foo.example.com" = "/var/www/foo/"; };
+              extraDomains = { "www.example.com" = null; "foo.example.com" = null; };
            };
            "bar.example.com" = {
              webroot = "/var/www/challenges/";
--- a/nixos/modules/security/acme.xml
+++ b/nixos/modules/security/acme.xml
@ -6,65 +6,49 @@
 <title>SSL/TLS Certificates with ACME</title>
 <para>
  NixOS supports automatic domain validation &amp; certificate retrieval and
-  renewal using the ACME protocol. This is currently only implemented by and
-  for Let's Encrypt. The alternative ACME client <literal>lego</literal> is
-  used under the hood.
+  renewal using the ACME protocol. Any provider can be used, but by default
+  NixOS uses Let's Encrypt. The alternative ACME client <literal>lego</literal>
+  is used under the hood.
+ </para>
+ <para>
+  Automatic cert validation and configuration for Apache and Nginx virtual
+  hosts is included in NixOS, however if you would like to generate a wildcard
+  cert or you are not using a web server you will have to configure DNS
+  based validation.
 </para>
 <section xml:id="module-security-acme-prerequisites">
  <title>Prerequisites</title>

  <para>
-   You need to have a running HTTP server for verification. The server must
-   have a webroot defined that can serve
+   To use the ACME module, you must accept the provider's terms of service
+   by setting <literal><xref linkend="opt-security.acme.acceptTerms" /></literal>
+   to <literal>true</literal>. The Let's Encrypt ToS can be found
+   <link xlink:href="https://letsencrypt.org/repository/">here</link>.
+  </para>
+
+  <para>
+   You must also set an email address to be used when creating accounts with
+   Let's Encrypt. You can set this for all certs with
+   <literal><xref linkend="opt-security.acme.email" /></literal>
+   and/or on a per-cert basis with
+   <literal><xref linkend="opt-security.acme.certs._name_.email" /></literal>.
+   This address is only used for registration and renewal reminders,
+   and cannot be used to administer the certificates in any way.
+  </para>
+
+  <para>
+   Alternatively, you can use a different ACME server by changing the
+   <literal><xref linkend="opt-security.acme.server" /></literal> option
+   to a provider of your choosing, or just change the server for one cert with
+   <literal><xref linkend="opt-security.acme.certs._name_.server" /></literal>.
+  </para>
+
+  <para>
+   You will need an HTTP server or DNS server for verification. For HTTP,
+   the server must have a webroot defined that can serve
   <filename>.well-known/acme-challenge</filename>. This directory must be
-   writeable by the user that will run the ACME client.
-  </para>
-
-  <para>
-   For instance, this generic snippet could be used for Nginx:
-<programlisting>
-http {
-  server {
-    server_name _;
-    listen 80;
-    listen [::]:80;
-
-    location /.well-known/acme-challenge {
-      root /var/www/challenges;
-    }
-
-    location / {
-      return 301 https://$host$request_uri;
-    }
-  }
-}
-</programlisting>
-  </para>
- </section>
- <section xml:id="module-security-acme-configuring">
-  <title>Configuring</title>
-
-  <para>
-   To enable ACME certificate retrieval &amp; renewal for a certificate for
-   <literal>foo.example.com</literal>, add the following in your
-   <filename>configuration.nix</filename>:
-<programlisting>
-<xref linkend="opt-security.acme.certs"/>."foo.example.com" = {
-  <link linkend="opt-security.acme.certs._name_.webroot">webroot</link> = "/var/www/challenges";
-  <link linkend="opt-security.acme.certs._name_.email">email</link> = "foo@example.com";
-};
-</programlisting>
-  </para>
-
-  <para>
-   The private key <filename>key.pem</filename> and certificate
-   <filename>fullchain.pem</filename> will be put into
-   <filename>/var/lib/acme/foo.example.com</filename>.
-  </para>
-  <para>
-   Refer to <xref linkend="ch-options" /> for all available configuration
-   options for the <link linkend="opt-security.acme.certs">security.acme</link>
-   module.
+   writeable by the user that will run the ACME client. For DNS, you must
+   set up credentials with your provider/server for use with lego.
  </para>
 </section>
 <section xml:id="module-security-acme-nginx">
@ -80,12 +64,27 @@ http {
  </para>

 <programlisting>
+<xref linkend="opt-security.acme.acceptTerms" /> = true;
+<xref linkend="opt-security.acme.email" /> = "admin+acme@example.com";
 services.nginx = {
-  <link linkend="opt-services.nginx.enable">enable = true;</link>
+  <link linkend="opt-services.nginx.enable">enable</link> = true;
  <link linkend="opt-services.nginx.virtualHosts">virtualHosts</link> = {
    "foo.example.com" = {
      <link linkend="opt-services.nginx.virtualHosts._name_.forceSSL">forceSSL</link> = true;
      <link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link> = true;
+      # All serverAliases will be added as <link linkend="opt-security.acme.certs._name_.extraDomains">extra domains</link> on the certificate.
+      <link linkend="opt-services.nginx.virtualHosts._name_.serverAliases">serverAliases</link> = [ "bar.example.com" ];
+      locations."/" = {
+        <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.root">root</link> = "/var/www";
+      };
+    };
+
+    # We can also add a different vhost and reuse the same certificate
+    # but we have to append extraDomains manually.
+    <link linkend="opt-security.acme.certs._name_.extraDomains">security.acme.certs."foo.example.com".extraDomains."baz.example.com"</link> = null;
+    "baz.example.com" = {
+      <link linkend="opt-services.nginx.virtualHosts._name_.forceSSL">forceSSL</link> = true;
+      <link linkend="opt-services.nginx.virtualHosts._name_.useACMEHost">useACMEHost</link> = "foo.example.com";
      locations."/" = {
        <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.root">root</link> = "/var/www";
      };
@ -94,4 +93,162 @@ services.nginx = {
 }
 </programlisting>
 </section>
+ <section xml:id="module-security-acme-httpd">
+  <title>Using ACME certificates in Apache/httpd</title>
+
+  <para>
+   Using ACME certificates with Apache virtual hosts is identical
+   to using them with Nginx. The attribute names are all the same, just replace
+   "nginx" with "httpd" where appropriate.
+  </para>
+ </section>
+ <section xml:id="module-security-acme-configuring">
+  <title>Manual configuration of HTTP-01 validation</title>
+
+  <para>
+   First off you will need to set up a virtual host to serve the challenges.
+   This example uses a vhost called <literal>certs.example.com</literal>, with
+   the intent that you will generate certs for all your vhosts and redirect
+   everyone to HTTPS.
+  </para>
+
+<programlisting>
+<xref linkend="opt-security.acme.acceptTerms" /> = true;
+<xref linkend="opt-security.acme.email" /> = "admin+acme@example.com";
+services.nginx = {
+  <link linkend="opt-services.nginx.enable">enable</link> = true;
+  <link linkend="opt-services.nginx.virtualHosts">virtualHosts</link> = {
+    "acmechallenge.example.com" = {
+      # Catchall vhost, will redirect users to HTTPS for all vhosts
+      <link linkend="opt-services.nginx.virtualHosts._name_.serverAliases">serverAliases</link> = [ "*.example.com" ];
+      # /var/lib/acme/.challenges must be writable by the ACME user
+      # and readable by the Nginx user.
+      # By default, this is the case.
+      locations."/.well-known/acme-challenge" = {
+        <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.root">root</link> = "/var/lib/acme/.challenges";
+      };
+      locations."/" = {
+        <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.return">return</link> = "301 https://$host$request_uri";
+      };
+    };
+  };
+}
+# Alternative config for Apache
+services.httpd = {
+  <link linkend="opt-services.httpd.enable">enable = true;</link>
+  <link linkend="opt-services.httpd.virtualHosts">virtualHosts</link> = {
+    "acmechallenge.example.com" = {
+      # Catchall vhost, will redirect users to HTTPS for all vhosts
+      <link linkend="opt-services.httpd.virtualHosts._name_.serverAliases">serverAliases</link> = [ "*.example.com" ];
+      # /var/lib/acme/.challenges must be writable by the ACME user and readable by the Apache user.
+      # By default, this is the case.
+      <link linkend="opt-services.httpd.virtualHosts._name_.documentRoot">documentRoot</link> = "/var/lib/acme/.challenges";
+      <link linkend="opt-services.httpd.virtualHosts._name_.extraConfig">extraConfig</link> = ''
+        RewriteEngine On
+        RewriteCond %{HTTPS} off
+        RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge [NC]
+        RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301]
+      '';
+    };
+  };
+}
+</programlisting>
+
+  <para>
+   Now you need to configure ACME to generate a certificate.
+  </para>
+
+<programlisting>
+<xref linkend="opt-security.acme.certs"/>."foo.example.com" = {
+  <link linkend="opt-security.acme.certs._name_.webroot">webroot</link> = "/var/lib/acme/.challenges";
+  <link linkend="opt-security.acme.certs._name_.email">email</link> = "foo@example.com";
+  # Since we have a wildcard vhost to handle port 80,
+  # we can generate certs for anything!
+  # Just make sure your DNS resolves them.
+  <link linkend="opt-security.acme.certs._name_.extraDomains">extraDomains</link> = [ "mail.example.com" ];
+};
+</programlisting>
+
+  <para>
+   The private key <filename>key.pem</filename> and certificate
+   <filename>fullchain.pem</filename> will be put into
+   <filename>/var/lib/acme/foo.example.com</filename>.
+  </para>
+
+  <para>
+   Refer to <xref linkend="ch-options" /> for all available configuration
+   options for the <link linkend="opt-security.acme.certs">security.acme</link>
+   module.
+  </para>
+ </section>
+ <section xml:id="module-security-acme-config-dns">
+  <title>Configuring ACME for DNS validation</title>
+
+  <para>
+   This is useful if you want to generate a wildcard certificate, since
+   ACME servers will only hand out wildcard certs over DNS validation.
+   There a number of supported DNS providers and servers you can utilise,
+   see the <link xlink:href="https://go-acme.github.io/lego/dns/">lego docs</link>
+   for provider/server specific configuration values. For the sake of these
+   docs, we will provide a fully self-hosted example using bind.
+  </para>
+
+<programlisting>
+services.bind = {
+  <link linkend="opt-services.bind.enable">enable</link> = true;
+  <link linkend="opt-services.bind.extraConfig">extraConfig</link> = ''
+    include "/var/lib/secrets/dnskeys.conf";
+  '';
+  <link linkend="opt-services.bind.zones">zones</link> = [
+    rec {
+      name = "example.com";
+      file = "/var/db/bind/${name}";
+      master = true;
+      extraConfig = "allow-update { key rfc2136key.example.com.; };";
+    }
+  ];
+}
+
+# Now we can configure ACME
+<xref linkend="opt-security.acme.acceptTerms" /> = true;
+<xref linkend="opt-security.acme.email" /> = "admin+acme@example.com";
+<xref linkend="opt-security.acme.certs" />."example.com" = {
+  <link linkend="opt-security.acme.certs._name_.domain">domain</link> = "*.example.com";
+  <link linkend="opt-security.acme.certs._name_.dnsProvider">dnsProvider</link> = "rfc2136";
+  <link linkend="opt-security.acme.certs._name_.credentialsFile">credentialsFile</link> = "/var/lib/secrets/certs.secret";
+  # We don't need to wait for propagation since this is a local DNS server
+  <link linkend="opt-security.acme.certs._name_.dnsPropagationCheck">dnsPropagationCheck</link> = false;
+};
+</programlisting>
+
+  <para>
+   The <filename>dnskeys.conf</filename> and <filename>certs.secret</filename>
+   must be kept secure and thus you should not keep their contents in your
+   Nix config. Instead, generate them one time with these commands:
+  </para>
+
+<programlisting>
+mkdir -p /var/lib/secrets
+tsig-keygen rfc2136key.example.com &gt; /var/lib/secrets/dnskeys.conf
+chown named:root /var/lib/secrets/dnskeys.conf
+chmod 400 /var/lib/secrets/dnskeys.conf
+
+# Copy the secret value from the dnskeys.conf, and put it in
+# RFC2136_TSIG_SECRET below
+
+cat &gt; /var/lib/secrets/certs.secret &lt;&lt; EOF
+RFC2136_NAMESERVER='127.0.0.1:53'
+RFC2136_TSIG_ALGORITHM='hmac-sha256.'
+RFC2136_TSIG_KEY='rfc2136key.example.com'
+RFC2136_TSIG_SECRET='your secret key'
+EOF
+chmod 400 /var/lib/secrets/certs.secret
+</programlisting>
+
+  <para>
+   Now you're all set to generate certs! You should monitor the first invokation
+   by running <literal>systemctl start acme-example.com.service &amp;
+   journalctl -fu acme-example.com.service</literal> and watching its log output.
+  </para>
+ </section>
 </chapter>
--- a/nixos/modules/services/backup/znapzend.nix
+++ b/nixos/modules/services/backup/znapzend.nix
@ -372,6 +372,41 @@ in
        and <citerefentry><refentrytitle>zfs</refentrytitle><manvolnum>8</manvolnum></citerefentry>
        for more info.
      '';
+      features.sendRaw = mkEnableOption ''
+        sendRaw feature which adds the options <literal>-w</literal> to the
+        <command>zfs send</command> command. For encrypted source datasets this
+        instructs zfs not to decrypt before sending which results in a remote
+        backup that can't be read without the encryption key/passphrase, useful
+        when the remote isn't fully trusted or not physically secure. This
+        option must be used consistently, raw incrementals cannot be based on
+        non-raw snapshots and vice versa.
+      '';
+      features.skipIntermediates = mkEnableOption ''
+        Enable the skipIntermediates feature to send a single increment
+        between latest common snapshot and the newly made one. It may skip
+        several source snaps if the destination was offline for some time, and
+        it should skip snapshots not managed by znapzend. Normally for online
+        destinations, the new snapshot is sent as soon as it is created on the
+        source, so there are no automatic increments to skip.
+      '';
+      features.lowmemRecurse = mkEnableOption ''
+        use lowmemRecurse on systems where you have too many datasets, so a
+        recursive listing of attributes to find backup plans exhausts the
+        memory available to <command>znapzend</command>: instead, go the slower
+        way to first list all impacted dataset names, and then query their
+        configs one by one.
+      '';
+      features.zfsGetType = mkEnableOption ''
+        use zfsGetType if your <command>zfs get</command> supports a
+        <literal>-t</literal> argument for filtering by dataset type at all AND
+        lists properties for snapshots by default when recursing, so that there
+        is too much data to process while searching for backup plans.
+        If these two conditions apply to your system, the time needed for a
+        <literal>--recursive</literal> search for backup plans can literally
+        differ by hundreds of times (depending on the amount of snapshots in
+        that dataset tree... and a decent backup plan will ensure you have a lot
+        of those), so you would benefit from requesting this feature.
+      '';
    };
  };

--- a/nixos/modules/services/editors/emacs.xml
+++ b/nixos/modules/services/editors/emacs.xml
@ -294,7 +294,7 @@ https://nixos.org/nixpkgs/manual/#sec-modify-via-packageOverrides
    If you are not on NixOS or want to install this particular Emacs only for
    yourself, you can do so by adding it to your
    <filename>~/.config/nixpkgs/config.nix</filename> (see
-    <link xlink:href="http://nixos.org/nixpkgs/manual/#sec-modify-via-packageOverrides">Nixpkgs
+    <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-modify-via-packageOverrides">Nixpkgs
    manual</link>):
    <example xml:id="module-services-emacs-config-nix">
     <title>Custom Emacs in <filename>~/.config/nixpkgs/config.nix</filename></title>
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@ -14,53 +14,9 @@ let
    RUN_USER = ${cfg.user}
    RUN_MODE = prod

-    [database]
-    DB_TYPE = ${cfg.database.type}
-    ${optionalString (usePostgresql || useMysql) ''
-      HOST = ${if cfg.database.socket != null then cfg.database.socket else cfg.database.host + ":" + toString cfg.database.port}
-      NAME = ${cfg.database.name}
-      USER = ${cfg.database.user}
-      PASSWD = #dbpass#
-    ''}
-    ${optionalString useSqlite ''
-      PATH = ${cfg.database.path}
-    ''}
-    ${optionalString usePostgresql ''
-      SSL_MODE = disable
-    ''}
+    ${generators.toINI {} cfg.settings}

-    [repository]
-    ROOT = ${cfg.repositoryRoot}
-
-    [server]
-    DOMAIN = ${cfg.domain}
-    HTTP_ADDR = ${cfg.httpAddress}
-    HTTP_PORT = ${toString cfg.httpPort}
-    ROOT_URL = ${cfg.rootUrl}
-    STATIC_ROOT_PATH = ${cfg.staticRootPath}
-    LFS_JWT_SECRET = #jwtsecret#
-
-    [session]
-    COOKIE_NAME = session
-    COOKIE_SECURE = ${boolToString cfg.cookieSecure}
-
-    [security]
-    SECRET_KEY = #secretkey#
-    INSTALL_LOCK = true
-
-    [log]
-    ROOT_PATH = ${cfg.log.rootPath}
-    LEVEL = ${cfg.log.level}
-
-    [service]
-    DISABLE_REGISTRATION = ${boolToString cfg.disableRegistration}
-
-    ${optionalString (cfg.mailerPasswordFile != null) ''
-      [mailer]
-      PASSWD = #mailerpass#
-    ''}
-
-    ${cfg.extraConfig}
+    ${optionalString (cfg.extraConfig != null) cfg.extraConfig}
  '';
 in

@ -279,9 +235,36 @@ in
        '';
      };

+      settings = mkOption {
+        type = with types; attrsOf (attrsOf (oneOf [ bool int str ]));
+        default = {};
+        description = ''
+          Gitea configuration. Refer to <link xlink:href="https://docs.gitea.io/en-us/config-cheat-sheet/"/>
+          for details on supported values.
+        '';
+        example = literalExample ''
+          {
+            "cron.sync_external_users" = {
+              RUN_AT_START = true;
+              SCHEDULE = "@every 24h";
+              UPDATE_EXISTING = true;
+            };
+            mailer = {
+              ENABLED = true;
+              MAILER_TYPE = "sendmail";
+              FROM = "do-not-reply@example.org";
+              SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
+            };
+            other = {
+              SHOW_FOOTER_VERSION = false;
+            };
+          }
+        '';
+      };
+
      extraConfig = mkOption {
-        type = types.str;
-        default = "";
+        type = with types; nullOr str;
+        default = null;
        description = "Configuration lines appended to the generated gitea configuration file.";
      };
    };
@ -294,6 +277,62 @@ in
      }
    ];

+    services.gitea.settings = {
+      database = mkMerge [
+        {
+          DB_TYPE = cfg.database.type;
+        }
+        (mkIf (useMysql || usePostgresql) {
+          HOST = if cfg.database.socket != null then cfg.database.socket else cfg.database.host + ":" + toString cfg.database.port;
+          NAME = cfg.database.name;
+          USER = cfg.database.user;
+          PASSWD = "#dbpass#";
+        })
+        (mkIf useSqlite {
+          PATH = cfg.database.path;
+        })
+        (mkIf usePostgresql {
+          SSL_MODE = "disable";
+        })
+      ];
+
+      repository = {
+        ROOT = cfg.repositoryRoot;
+      };
+
+      server = {
+        DOMAIN = cfg.domain;
+        HTTP_ADDR = cfg.httpAddress;
+        HTTP_PORT = cfg.httpPort;
+        ROOT_URL = cfg.rootUrl;
+        STATIC_ROOT_PATH = cfg.staticRootPath;
+        LFS_JWT_SECRET = "#jwtsecret#";
+      };
+
+      session = {
+        COOKIE_NAME = "session";
+        COOKIE_SECURE = cfg.cookieSecure;
+      };
+
+      security = {
+        SECRET_KEY = "#secretkey#";
+        INSTALL_LOCK = true;
+      };
+
+      log = {
+        ROOT_PATH = cfg.log.rootPath;
+        LEVEL = cfg.log.level;
+      };
+
+      service = {
+        DISABLE_REGISTRATION = cfg.disableRegistration;
+      };
+
+      mailer = mkIf (cfg.mailerPasswordFile != null) {
+        PASSWD = "#mailerpass#";
+      };
+    };
+
    services.postgresql = optionalAttrs (usePostgresql && cfg.database.createDatabase) {
      enable = mkDefault true;

@ -435,9 +474,12 @@ in

    users.groups.gitea = {};

-    warnings = optional (cfg.database.password != "")
-      ''config.services.gitea.database.password will be stored as plaintext
-        in the Nix store. Use database.passwordFile instead.'';
+    warnings =
+      optional (cfg.database.password != "") ''
+        config.services.gitea.database.password will be stored as plaintext in the Nix store. Use database.passwordFile instead.'' ++
+      optional (cfg.extraConfig != null) ''
+        services.gitea.`extraConfig` is deprecated, please use services.gitea.`settings`.
+      '';

    # Create database passwordFile default when password is configured.
    services.gitea.database.passwordFile =
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@ -283,7 +283,7 @@ in
      trustedBinaryCaches = mkOption {
        type = types.listOf types.str;
        default = [ ];
-        example = [ "http://hydra.nixos.org/" ];
+        example = [ "https://hydra.nixos.org/" ];
        description = ''
          List of binary cache URLs that non-root users can use (in
          addition to those specified using
--- a/nixos/modules/services/misc/octoprint.nix
+++ b/nixos/modules/services/misc/octoprint.nix
@ -17,9 +17,9 @@ let

  cfgUpdate = pkgs.writeText "octoprint-config.yaml" (builtins.toJSON fullConfig);

-  pluginsEnv = pkgs.python.buildEnv.override {
-    extraLibs = cfg.plugins pkgs.octoprint-plugins;
-  };
+  pluginsEnv = package.python.withPackages (ps: [ps.octoprint] ++ (cfg.plugins ps));
+
+  package = pkgs.octoprint;

 in
 {
@ -106,7 +106,6 @@ in
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      path = [ pluginsEnv ];
-      environment.PYTHONPATH = makeSearchPathOutput "lib" pkgs.python.sitePackages [ pluginsEnv ];

      preStart = ''
        if [ -e "${cfg.stateDir}/config.yaml" ]; then
@ -119,7 +118,7 @@ in
      '';

      serviceConfig = {
-        ExecStart = "${pkgs.octoprint}/bin/octoprint serve -b ${cfg.stateDir}";
+        ExecStart = "${pluginsEnv}/bin/octoprint serve -b ${cfg.stateDir}";
        User = cfg.user;
        Group = cfg.group;
      };
--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@ -382,6 +382,11 @@ let
        default = "en";
        description = "Default room language.";
      };
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = "Additional MUC specific configuration";
+      };
    };
  };

@ -792,6 +797,8 @@ in

      https_ports = ${toLua cfg.httpsPorts}

+      ${ cfg.extraConfig }
+
      ${lib.concatMapStrings (muc: ''
        Component ${toLua muc.domain} "muc"
            modules_enabled = { "muc_mam"; ${optionalString muc.vcard_muc ''"vcard_muc";'' } }
@ -809,8 +816,8 @@ in
            muc_room_default_change_subject = ${toLua muc.roomDefaultChangeSubject}
            muc_room_default_history_length = ${toLua muc.roomDefaultHistoryLength}
            muc_room_default_language = ${toLua muc.roomDefaultLanguage}
-
-          '') cfg.muc}
+            ${ muc.extraConfig }
+        '') cfg.muc}

      ${ lib.optionalString (cfg.uploadHttp != null) ''
        Component ${toLua cfg.uploadHttp.domain} "http_upload"
@ -820,8 +827,6 @@ in
            http_upload_path = ${toLua cfg.uploadHttp.httpUploadPath}
      ''}

-      ${ cfg.extraConfig }
-
      ${ lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: ''
        VirtualHost "${v.domain}"
          enabled = ${boolToString v.enabled};
--- a/nixos/modules/services/torrent/deluge.nix
+++ b/nixos/modules/services/torrent/deluge.nix
@ -142,7 +142,7 @@ in {
          description = ''
            Extra packages available at runtime to enable Deluge's plugins. For example,
            extraction utilities are required for the built-in "Extractor" plugin.
-            This always contains unzip, gnutar, xz, p7zip and bzip2.
+            This always contains unzip, gnutar, xz and bzip2.
          '';
        };

@ -187,7 +187,7 @@ in {
    );

    # Provide a default set of `extraPackages`.
-    services.deluge.extraPackages = with pkgs; [ unzip gnutar xz p7zip bzip2 ];
+    services.deluge.extraPackages = with pkgs; [ unzip gnutar xz bzip2 ];

    systemd.tmpfiles.rules = [
      "d '${cfg.dataDir}' 0770 ${cfg.user} ${cfg.group}"
--- a/nixos/modules/system/boot/initrd-ssh.nix
+++ b/nixos/modules/system/boot/initrd-ssh.nix
@ -83,6 +83,12 @@ in
        Authorized keys for the root user on initrd.
      '';
    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = "Verbatim contents of <filename>sshd_config</filename>.";
+    };
  };

  imports =
@ -126,6 +132,8 @@ in
      '' else ''
        UseDNS no
      ''}
+
+      ${cfg.extraConfig}
    '';
  in mkIf (config.boot.initrd.network.enable && cfg.enable) {
    assertions = [
--- a/nixos/modules/virtualisation/cri-o.nix
+++ b/nixos/modules/virtualisation/cri-o.nix
@ -4,6 +4,11 @@ with lib;

 let
  cfg = config.virtualisation.cri-o;
+
+  # Copy configuration files to avoid having the entire sources in the system closure
+  copyFile = filePath: pkgs.runCommandNoCC (builtins.unsafeDiscardStringContext (builtins.baseNameOf filePath)) {} ''
+    cp ${filePath} $out
+  '';
 in
 {
  imports = [
@ -45,9 +50,9 @@ in
  config = mkIf cfg.enable {
    environment.systemPackages = with pkgs;
      [ cri-o cri-tools conmon iptables runc utillinux ];
-    environment.etc."crictl.yaml".text = ''
-      runtime-endpoint: unix:///var/run/crio/crio.sock
-    '';
+
+    environment.etc."crictl.yaml".source = copyFile "${pkgs.cri-o.src}/crictl.yaml";
+
    environment.etc."crio/crio.conf".text = ''
      [crio]
      storage_driver = "${cfg.storageDriver}"
@ -66,23 +71,7 @@ in
      manage_network_ns_lifecycle = true
    '';

-    environment.etc."cni/net.d/20-cri-o-bridge.conf".text = ''
-      {
-        "cniVersion": "0.3.1",
-        "name": "crio-bridge",
-        "type": "bridge",
-        "bridge": "cni0",
-        "isGateway": true,
-        "ipMasq": true,
-        "ipam": {
-          "type": "host-local",
-          "subnet": "10.88.0.0/16",
-          "routes": [
-              { "dst": "0.0.0.0/0" }
-          ]
-        }
-      }
-    '';
+    environment.etc."cni/net.d/10-crio-bridge.conf".source = copyFile "${pkgs.cri-o.src}/contrib/cni/10-crio-bridge.conf";

    # Enable common /etc/containers configuration
    virtualisation.containers.enable = true;
--- a/nixos/modules/virtualisation/docker-containers.nix
+++ b/nixos/modules/virtualisation/docker-containers.nix
@ -1,17 +1,20 @@
-{ config, lib, pkgs, ... }:
+{ config, options, lib, pkgs, ... }:

 with lib;
 let
-  cfg = config.docker-containers;
+  cfg = config.virtualisation.oci-containers;
+  proxy_env = config.networking.proxy.envVars;

-  dockerContainer =
+  defaultBackend = options.virtualisation.oci-containers.backend.default;
+
+  containerOptions =
    { ... }: {

      options = {

        image = mkOption {
          type = with types; str;
-          description = "Docker image to run.";
+          description = "OCI image to run.";
          example = "library/hello-world";
        };

@ -58,18 +61,19 @@ let

        log-driver = mkOption {
          type = types.str;
-          default = "none";
+          default = "journald";
          description = ''
            Logging driver for the container.  The default of
-            <literal>"none"</literal> means that the container's logs will be
-            handled as part of the systemd unit.  Setting this to
-            <literal>"journald"</literal> will result in duplicate logging, but
-            the container's logs will be visible to the <command>docker
-            logs</command> command.
+            <literal>"journald"</literal> means that the container's logs will be
+            handled as part of the systemd unit.

-            For more details and a full list of logging drivers, refer to the
-            <link xlink:href="https://docs.docker.com/engine/reference/run/#logging-drivers---log-driver">
-            Docker engine documentation</link>
+            For more details and a full list of logging drivers, refer to respective backends documentation.
+
+            For Docker:
+            <link xlink:href="https://docs.docker.com/engine/reference/run/#logging-drivers---log-driver">Docker engine documentation</link>
+
+            For Podman:
+            Refer to the docker-run(1) man page.
          '';
        };

@ -172,10 +176,10 @@ let
          description = ''
            Define which other containers this one depends on. They will be added to both After and Requires for the unit.

-            Use the same name as the attribute under <literal>services.docker-containers</literal>.
+            Use the same name as the attribute under <literal>virtualisation.oci-containers</literal>.
          '';
          example = literalExample ''
-            services.docker-containers = {
+            virtualisation.oci-containers = {
              node1 = {};
              node2 = {
                dependsOn = [ "node1" ];
@ -184,10 +188,10 @@ let
          '';
        };

-        extraDockerOptions = mkOption {
+        extraOptions = mkOption {
          type = with types; listOf str;
          default = [];
-          description = "Extra options for <command>docker run</command>.";
+          description = "Extra options for <command>${defaultBackend} run</command>.";
          example = literalExample ''
            ["--network=host"]
          '';
@ -205,24 +209,31 @@ let
    };

  mkService = name: container: let
-    mkAfter = map (x: "docker-${x}.service") container.dependsOn;
-  in rec {
+    dependsOn = map (x: "${cfg.backend}-${x}.service") container.dependsOn;
+  in {
    wantedBy = [] ++ optional (container.autoStart) "multi-user.target";
-    after = [ "docker.service" "docker.socket" ] ++ mkAfter;
-    requires = after;
-    path = [ pkgs.docker ];
+    after = lib.optionals (cfg.backend == "docker") [ "docker.service" "docker.socket" ] ++ dependsOn;
+    requires = dependsOn;
+    environment = proxy_env;
+
+    path =
+      if cfg.backend == "docker" then [ pkgs.docker ]
+      else if cfg.backend == "podman" then [ config.virtualisation.podman.package ]
+      else throw "Unhandled backend: ${cfg.backend}";

    preStart = ''
-      docker rm -f ${name} || true
+      ${cfg.backend} rm -f ${name} || true
      ${optionalString (container.imageFile != null) ''
-        docker load -i ${container.imageFile}
+        ${cfg.backend} load -i ${container.imageFile}
        ''}
      '';
-    postStop = "docker rm -f ${name} || true";
-        
+    postStop = "${cfg.backend} rm -f ${name} || true";
+
    serviceConfig = {
+      StandardOutput = "null";
+      StandardError = "null";
      ExecStart = concatStringsSep " \\\n  " ([
-        "${pkgs.docker}/bin/docker run"
+        "${config.system.path}/bin/${cfg.backend} run"
        "--rm"
        "--name=${name}"
        "--log-driver=${container.log-driver}"
@ -233,12 +244,12 @@ let
        ++ optional (container.user != null) "-u ${escapeShellArg container.user}"
        ++ map (v: "-v ${escapeShellArg v}") container.volumes
        ++ optional (container.workdir != null) "-w ${escapeShellArg container.workdir}"
-        ++ map escapeShellArg container.extraDockerOptions
+        ++ map escapeShellArg container.extraOptions
        ++ [container.image]
        ++ map escapeShellArg container.cmd
      );

-      ExecStop = ''${pkgs.bash}/bin/sh -c "[ $SERVICE_RESULT = success ] || docker stop ${name}"'';
+      ExecStop = ''${pkgs.bash}/bin/sh -c "[ $SERVICE_RESULT = success ] || ${cfg.backend} stop ${name}"'';

      ### There is no generalized way of supporting `reload` for docker
      ### containers. Some containers may respond well to SIGHUP sent to their
@ -263,19 +274,50 @@ let
  };

 in {
+  imports = [
+    (
+      lib.mkChangedOptionModule
+      [ "docker-containers"  ]
+      [ "virtualisation" "oci-containers" ]
+      (oldcfg: {
+        backend = "docker";
+        containers = lib.mapAttrs (n: v: builtins.removeAttrs (v // {
+          extraOptions = v.extraDockerOptions or [];
+        }) [ "extraDockerOptions" ]) oldcfg.docker-containers;
+      })
+    )
+  ];

-  options.docker-containers = mkOption {
-    default = {};
-    type = types.attrsOf (types.submodule dockerContainer);
-    description = "Docker containers to run as systemd services.";
-  };
+  options.virtualisation.oci-containers = {

-  config = mkIf (cfg != {}) {
+    backend = mkOption {
+      type = types.enum [ "podman" "docker" ];
+      default =
+        # TODO: Once https://github.com/NixOS/nixpkgs/issues/77925 is resolved default to podman
+        # if versionAtLeast config.system.stateVersion "20.09" then "podman"
+        # else "docker";
+        "docker";
+      description = "The underlying Docker implementation to use.";
+    };

-    systemd.services = mapAttrs' (n: v: nameValuePair "docker-${n}" (mkService n v)) cfg;
-
-    virtualisation.docker.enable = true;
+    containers = mkOption {
+      default = {};
+      type = types.attrsOf (types.submodule containerOptions);
+      description = "OCI (Docker) containers to run as systemd services.";
+    };

  };

+  config = lib.mkIf (cfg.containers != {}) (lib.mkMerge [
+    {
+      systemd.services = mapAttrs' (n: v: nameValuePair "${cfg.backend}-${n}" (mkService n v)) cfg.containers;
+    }
+    (lib.mkIf (cfg.backend == "podman") {
+      virtualisation.podman.enable = true;
+    })
+    (lib.mkIf (cfg.backend == "docker") {
+      virtualisation.docker.enable = true;
+    })
+  ]);
+
 }
--- a/nixos/modules/virtualisation/podman.nix
+++ b/nixos/modules/virtualisation/podman.nix
@ -86,11 +86,21 @@ in
      };
    };

+    package = lib.mkOption {
+      type = types.package;
+      default = podmanPackage;
+      internal = true;
+      description = ''
+        The final Podman package (including extra packages).
+      '';
+    };
+
+
  };

  config = lib.mkIf cfg.enable {

-    environment.systemPackages = [ podmanPackage ]
+    environment.systemPackages = [ cfg.package ]
      ++ lib.optional cfg.dockerCompat dockerCompat;

    environment.etc."containers/libpod.conf".text = ''
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -70,7 +70,7 @@ in
  dhparams = handleTest ./dhparams.nix {};
  dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
  docker = handleTestOn ["x86_64-linux"] ./docker.nix {};
-  docker-containers = handleTestOn ["x86_64-linux"] ./docker-containers.nix {};
+  oci-containers = handleTestOn ["x86_64-linux"] ./oci-containers.nix {};
  docker-edge = handleTestOn ["x86_64-linux"] ./docker-edge.nix {};
  docker-preloader = handleTestOn ["x86_64-linux"] ./docker-preloader.nix {};
  docker-registry = handleTest ./docker-registry.nix {};
--- a/nixos/tests/chromium.nix
+++ b/nixos/tests/chromium.nix
@ -37,7 +37,7 @@ mapAttrs (channel: chromiumPkg: makeTest rec {
    </head>
    <body onload="javascript:document.title='startup done'">
      <img src="file://${pkgs.fetchurl {
-        url = "http://nixos.org/logo/nixos-hex.svg";
+        url = "https://nixos.org/logo/nixos-hex.svg";
        sha256 = "07ymq6nw8kc22m7kzxjxldhiq8gzmc7f45kq2bvhbdm0w5s112s4";
      }}" />
    </body>
--- a/nixos/tests/docker-containers.nix
+++ b/nixos/tests/docker-containers.nix
@ -1,27 +0,0 @@
-# Test Docker containers as systemd units
-
-import ./make-test-python.nix ({ pkgs, lib, ... }: {
-  name = "docker-containers";
-  meta = {
-    maintainers = with lib.maintainers; [ benley mkaito ];
-  };
-
-  nodes = {
-    docker = { pkgs, ... }: {
-      virtualisation.docker.enable = true;
-
-      docker-containers.nginx = {
-        image = "nginx-container";
-        imageFile = pkgs.dockerTools.examples.nginx;
-        ports = ["8181:80"];
-      };
-    };
-  };
-
-  testScript = ''
-    start_all()
-    docker.wait_for_unit("docker-nginx.service")
-    docker.wait_for_open_port(8181)
-    docker.wait_until_succeeds("curl http://localhost:8181 | grep Hello")
-  '';
-})
--- a/nixos/tests/ec2.nix
+++ b/nixos/tests/ec2.nix
@ -108,7 +108,7 @@ in {
    inherit image;
    sshPublicKey = snakeOilPublicKey;

-    # ### http://nixos.org/channels/nixos-unstable nixos
+    # ### https://nixos.org/channels/nixos-unstable nixos
    userData = ''
      { pkgs, ... }:

--- a/nixos/tests/minio.nix
+++ b/nixos/tests/minio.nix
@ -44,7 +44,7 @@ in {

    # Create a test bucket on the server
    machine.succeed(
-        "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} S3v4"
+        "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
    )
    machine.succeed("mc mb minio/test-bucket")
    machine.succeed("${minioPythonScript}")
--- a/nixos/tests/oci-containers.nix
+++ b/nixos/tests/oci-containers.nix
@ -0,0 +1,43 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+, lib ? pkgs.lib
+}:
+
+let
+
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
+
+  mkOCITest = backend: makeTest {
+    name = "oci-containers-${backend}";
+
+    meta = {
+      maintainers = with lib.maintainers; [ adisbladis benley mkaito ];
+    };
+
+    nodes = {
+      ${backend} = { pkgs, ... }: {
+        virtualisation.oci-containers = {
+          inherit backend;
+          containers.nginx = {
+            image = "nginx-container";
+            imageFile = pkgs.dockerTools.examples.nginx;
+            ports = ["8181:80"];
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+      ${backend}.wait_for_unit("${backend}-nginx.service")
+      ${backend}.wait_for_open_port(8181)
+      ${backend}.wait_until_succeeds("curl http://localhost:8181 | grep Hello")
+    '';
+  };
+
+in
+lib.foldl' (attrs: backend: attrs // { ${backend} = mkOCITest backend; }) {} [
+  "docker"
+  "podman"
+]
--- a/nixos/tests/udisks2.nix
+++ b/nixos/tests/udisks2.nix
@ -3,7 +3,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
 let

  stick = pkgs.fetchurl {
-    url = "http://nixos.org/~eelco/nix/udisks-test.img.xz";
+    url = "https://nixos.org/~eelco/nix/udisks-test.img.xz";
    sha256 = "0was1xgjkjad91nipzclaz5biv3m4b2nk029ga6nk7iklwi19l8b";
  };

--- a/nixos/tests/xmpp/prosody-mysql.nix
+++ b/nixos/tests/xmpp/prosody-mysql.nix
@ -6,6 +6,11 @@ import ../make-test-python.nix {
      environment.systemPackages = [
        (pkgs.callPackage ./xmpp-sendmessage.nix { connectTo = nodes.server.config.networking.primaryIPAddress; })
      ];
+      networking.extraHosts = ''
+        ${nodes.server.config.networking.primaryIPAddress} example.com
+        ${nodes.server.config.networking.primaryIPAddress} conference.example.com
+        ${nodes.server.config.networking.primaryIPAddress} uploads.example.com
+      '';
    };
    server = { config, pkgs, ... }: {
      nixpkgs.overlays = [
@ -18,6 +23,8 @@ import ../make-test-python.nix {
      ];
      networking.extraHosts = ''
        ${config.networking.primaryIPAddress} example.com
+        ${config.networking.primaryIPAddress} conference.example.com
+        ${config.networking.primaryIPAddress} uploads.example.com
      '';
      networking.firewall.enable = false;
      services.prosody = {
@ -39,6 +46,14 @@ import ../make-test-python.nix {
          domain = "example.com";
          enabled = true;
        };
+        muc = [
+          {
+            domain = "conference.example.com";
+          }
+        ];
+        uploadHttp = {
+          domain = "uploads.example.com";
+        };
      };
    };
    mysql = { config, pkgs, ... }: {
--- a/pkgs/applications/audio/chuck/default.nix
+++ b/pkgs/applications/audio/chuck/default.nix
@ -3,12 +3,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "1.4.0.0";
+  version = "1.4.0.1";
  pname = "chuck";

  src = fetchurl {
    url = "http://chuck.cs.princeton.edu/release/files/chuck-${version}.tgz";
-    sha256 = "1b17rsf7bv45gfhyhfmpz9d4rkxn24c0m2hgmpfjz3nlp0rf7bic";
+    sha256 = "1m0fhndbqaf0lii1asyc50c66bv55ib6mbnm8fzk5qc5ncs0r8hi";
  };

  nativeBuildInputs = [ flex bison which ];
--- a/pkgs/applications/audio/ft2-clone/default.nix
+++ b/pkgs/applications/audio/ft2-clone/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "ft2-clone";
-  version = "1.15";
+  version = "1.23";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "ft2-clone";
    rev = "v${version}";
-    sha256 = "19xgdaij71gpvq216zjlp60zmfdl2a8kf8sc3bpk8a4d4xh4n151";
+    sha256 = "03prdifc2nz7smmzdy19flp33m927vb7j5bhdc46gak753pikw7d";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/audio/gpodder/default.nix
+++ b/pkgs/applications/audio/gpodder/default.nix
@ -5,14 +5,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "gpodder";
-  version = "3.10.13";
+  version = "3.10.15";
  format = "other";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = version;
-    sha256 = "1h542syaxsx1hslfzlk3fx1nbp190zjw35kigw7a1kx1jwvfwapg";
+    sha256 = "0ghbanj142n0hgydzfjmnkdgri2kswsjal3mn10c723kih4ir4yr";
  };

  patches = [
--- a/pkgs/applications/audio/orca-c/default.nix
+++ b/pkgs/applications/audio/orca-c/default.nix
@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, ncurses, portmidi }:
+stdenv.mkDerivation {
+  pname = "orca-c";
+
+  version = "git-2020-05-01";
+
+  src = fetchFromGitHub {
+    owner = "hundredrabbits";
+    repo = "Orca-c";
+    rev = "d7a3b169c5ed0b06a9ad0fdb3057704da9a0b6ce";
+    sha256 = "101y617a295hzwr98ykvza1sycxlk29kzxn2ybjwc718r0alkbzz";
+  };
+
+  buildInputs = [ ncurses portmidi ];
+
+  patchPhase = ''
+    patchShebangs tool
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    install build/orca $out/bin/orca
+  '';
+
+  meta = with stdenv.lib; {
+    description = "An esoteric programming language designed to quickly create procedural sequencers.";
+    homepage = "https://github.com/hundredrabbits/Orca-c";
+    license = licenses.mit;
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "pt2-clone";
-  version = "1.07";
+  version = "1.12";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "pt2-clone";
    rev = "v${version}";
-    sha256 = "0g2bp9n05ng2fvqw86pb941zamcqnfz1l066wvh5j3av1w22khi8";
+    sha256 = "1y7kv889rm3nvaigcda4bglvwm799f3gp0zrivkvrg1lrlygs89f";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/audio/rofi-mpd/default.nix
+++ b/pkgs/applications/audio/rofi-mpd/default.nix
@ -2,13 +2,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "rofi-mpd";
-  version = "2.2.0";
+  version = "2.2.1";

  src = fetchFromGitHub {
    owner = "JakeStanger";
    repo = "Rofi_MPD";
    rev = "v${version}";
-    sha256 = "1b0y8706mmrxhiyz8g6znisllc35j8g7sz8gfjll9svysjmvb6lc";
+    sha256 = "0jabyn6gqh8ychn2a06xws3avz0lqdnx3qvqkavfd2xr6sp2q7lg";
  };

  propagatedBuildInputs = with python3Packages; [ mutagen mpd2 toml appdirs ];
--- a/pkgs/applications/audio/schismtracker/default.nix
+++ b/pkgs/applications/audio/schismtracker/default.nix
@ -1,30 +1,29 @@
-{ stdenv, fetchurl, alsaLib, python, SDL }:
+{ stdenv, fetchFromGitHub
+, autoreconfHook
+, alsaLib, python, SDL }:

 stdenv.mkDerivation rec {
-  version = "20120105";
  pname = "schismtracker";
+  version = "20190805";

-  src = fetchurl {
-    url = "http://schismtracker.org/dl/${pname}-${version}.tar.bz2";
-    sha256 = "1ny7wv2wxm1av299wvpskall6438wjjpadphmqc7c0h6d0zg5kii";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "0qqps20vvn3rgpg8174bjrrm38gqcci2z5z4c1r1vhbccclahgsd";
  };

-  preConfigure = ''
-    # Build fails on Linux with windres.
-    export ac_cv_prog_ac_ct_WINDRES=
-  '';
-
  configureFlags = [ "--enable-dependency-tracking" ];

-  buildInputs = [ alsaLib python SDL ];
+  nativeBuildInputs = [ autoreconfHook python ];

-  enableParallelBuilding = true;
+  buildInputs = [ alsaLib SDL ];

-  meta = {
+  meta = with stdenv.lib; {
    description = "Music tracker application, free reimplementation of Impulse Tracker";
    homepage = "http://schismtracker.org/";
-    license = stdenv.lib.licenses.gpl2;
+    license = licenses.gpl2;
    platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = [ stdenv.lib.maintainers.ftrvxmtrx ];
+    maintainers = with maintainers; [ ftrvxmtrx ];
  };
 }
--- a/pkgs/applications/audio/spotify-tui/default.nix
+++ b/pkgs/applications/audio/spotify-tui/default.nix
@ -2,20 +2,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "spotify-tui";
-  version = "0.18.0";
+  version = "0.19.0";

  src = fetchFromGitHub {
    owner = "Rigellute";
    repo = "spotify-tui";
    rev = "v${version}";
-    sha256 = "15icg332iyacdn4ydr4nivblayg4xkcnjh4f0sjnhj4q173v8fq2";
+    sha256 = "1bdcfkfbvvn262p4j0nb4kvjzzgrvn3kxlif48yipqkkykzsgz6g";
  };

-  cargoSha256 = "0rw8pj74k88rvcr18837g356lwsn2vdq384yma9df462xd2cw823";
+  cargoSha256 = "13v2ilmfs9468kavlx6wrsp0dscppxbxgygwpdd35p5hq3vnhl7k";

-  nativeBuildInputs = [ pkgconfig ] ++ stdenv.lib.optionals stdenv.isLinux [ python3 ];
-  buildInputs = [ openssl ]
-    ++ stdenv.lib.optional stdenv.isLinux libxcb
+  nativeBuildInputs = stdenv.lib.optionals stdenv.isLinux [ pkgconfig python3 ];
+  buildInputs = [ ]
+    ++ stdenv.lib.optionals stdenv.isLinux [ openssl libxcb ]
    ++ stdenv.lib.optionals stdenv.isDarwin [ AppKit Security ];

  meta = with stdenv.lib; {
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@ -35,13 +35,13 @@

 mkDerivation rec {
  pname = "strawberry";
-  version = "0.6.9";
+  version = "0.6.10";

  src = fetchFromGitHub {
    owner = "jonaski";
    repo = pname;
    rev = version;
-    sha256 = "0ssyqa14j54sja2dzhzrznbf1bbl0nc62p4jh2pd6fhinpw8y6dk";
+    sha256 = "0qf510hlxbndqzwq62mdzfclqxr3caf1a34kd770k84x8vrb4pld";
  };

  buildInputs = [
--- a/pkgs/applications/blockchains/bitcoin-abc.nix
+++ b/pkgs/applications/blockchains/bitcoin-abc.nix
@ -7,13 +7,13 @@ with stdenv.lib;
 mkDerivation rec {

  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-abc-" + version;
-  version = "0.21.3";
+  version = "0.21.5";

  src = fetchFromGitHub {
    owner = "bitcoin-ABC";
    repo = "bitcoin-abc";
    rev = "v${version}";
-    sha256 = "1pzdgghbsss2qjfgl42lvkbs5yc5q6jnzqnp24lljmrh341g2zn4";
+    sha256 = "1jx33n8dhn16iaxvmc56cxw0i5qk0ga5nf7qf9frwwq6zkglknga";
  };

  patches = [ ./fix-bitcoin-qt-build.patch ];
--- a/pkgs/applications/blockchains/clightning.nix
+++ b/pkgs/applications/blockchains/clightning.nix
@ -4,11 +4,11 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
  pname = "clightning";
-  version = "0.8.1";
+  version = "0.8.2";

  src = fetchurl {
    url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    sha256 = "079d3yx7yr7qrilqgaayvn18lxl8h6a1gwwbsgm5xsyxj4vdlz7r";
+    sha256 = "1w5l3r3pnhnwz3x7mjgd69cw9a18fpyjwj7kmfka7cf9hdgcwp9x";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/blockchains/lnd.nix
+++ b/pkgs/applications/blockchains/lnd.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "lnd";
-  version = "0.9.2-beta";
+  version = "0.10.0-beta";

  src = fetchFromGitHub {
    owner = "lightningnetwork";
    repo = "lnd";
    rev = "v${version}";
-    sha256 = "0gm33z89fiqv231ks2mkpsblskcsijipq8fcmip6m6jy8g06b1gb";
+    sha256 = "1amciz924s2h6qhy7w34jpv1jc25p5ayfxzvjph6hhx0bccrm88w";
  };

-  modSha256 = "1khxplvyaqgaddrx1nna1fw0nb1xz9bmqpxpfifif4f5nmx90gbr";
+  modSha256 = "15i4h3pkvyav9qsbfinzifram0knkylg24j6j0mxs4bnj80j4ycm";

  subPackages = ["cmd/lncli" "cmd/lnd"];

--- a/pkgs/applications/editors/bluefish/default.nix
+++ b/pkgs/applications/editors/bluefish/default.nix
@ -3,11 +3,11 @@
 }:

 stdenv.mkDerivation rec {
-  name = "bluefish-2.2.10";
+  name = "bluefish-2.2.11";

  src = fetchurl {
    url = "mirror://sourceforge/bluefish/${name}.tar.bz2";
-    sha256 = "1ciygj79q6i3ga5x1j8aivc05nh6rhhnm7hrq8q8xd9vd4ms3v5g";
+    sha256 = "1zy2ppdg3nq9iy3zgfhnw93bq5zbbhyampf7bk3grpfvq5zqfk25";
  };

  nativeBuildInputs = [ intltool pkgconfig wrapGAppsHook ];
--- a/pkgs/applications/editors/focuswriter/default.nix
+++ b/pkgs/applications/editors/focuswriter/default.nix
@ -2,11 +2,11 @@

 mkDerivation rec {
  pname = "focuswriter";
-  version = "1.7.5";
+  version = "1.7.6";

  src = fetchurl {
    url = "https://gottcode.org/focuswriter/focuswriter-${version}-src.tar.bz2";
-    sha256 = "19fqxyas941xcqjj68qpj42ayq0vw5rbd4ms5kvx8jyspp7wysqc";
+    sha256 = "0h85f6cs9zbxv118mjfxqfv41j19zkx2xq36mpnlmrlzkjj7dx9l";
  };

  nativeBuildInputs = [ pkgconfig qmake qttools ];
--- a/pkgs/applications/editors/jetbrains/common.nix
+++ b/pkgs/applications/editors/jetbrains/common.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, makeDesktopItem, makeWrapper, patchelf, p7zip
+{ stdenv, lib, makeDesktopItem, makeWrapper, patchelf
 , coreutils, gnugrep, which, git, unzip, libsecret, libnotify
 }:

@ -26,7 +26,7 @@ with stdenv; lib.makeOverridable mkDerivation rec {
    '';
  };

-  nativeBuildInputs = [ makeWrapper patchelf p7zip unzip ];
+  nativeBuildInputs = [ makeWrapper patchelf unzip ];

  patchPhase = lib.optionalString (!stdenv.isDarwin) ''
      get_file_size() {
--- a/pkgs/applications/editors/vim/macvim.nix
+++ b/pkgs/applications/editors/vim/macvim.nix
@ -27,13 +27,13 @@ in
 stdenv.mkDerivation {
  pname = "macvim";

-  version = "8.2.319";
+  version = "8.2.539";

  src = fetchFromGitHub {
    owner = "macvim-dev";
    repo = "macvim";
-    rev = "snapshot-162";
-    sha256 = "1mg55jlrz533wlqrx028fyv86rfhdzvm5kdi8xlf67flc5hh9vrp";
+    rev = "snapshot-163";
+    sha256 = "0ibc6h7zmk81dygkxd8a2rcq72zbqmr9kh64xhsm9h0p70505cdk";
  };

  enableParallelBuilding = true;
@ -66,7 +66,6 @@ stdenv.mkDerivation {
      "--with-tlib=ncurses"
      "--with-compiledby=Nix"
      "--disable-sparkle"
-      "LDFLAGS=-headerpad_max_install_names"
  ];

  makeFlags = ''PREFIX=$(out) CPPFLAGS="-Wno-error"'';
@ -81,11 +80,6 @@ stdenv.mkDerivation {

  # This is unfortunate, but we need to use the same compiler as Xcode,
  # but Xcode doesn't provide a way to configure the compiler.
-  #
-  # If you're willing to modify the system files, you can do this:
-  #   http://hamelot.co.uk/programming/add-gcc-compiler-to-xcode-6/
-  #
-  # But we don't have that option.
  preConfigure = ''
    CC=/usr/bin/clang

@ -101,8 +95,34 @@ stdenv.mkDerivation {
  ''
  ;

+  # Because we're building with system clang, this means we're building against Xcode's SDK and
+  # linking against system libraries. The configure script is picking up Nix Libsystem (via ruby)
+  # so we need to patch that out or we'll get linker issues. The MacVim binary built by Xcode links
+  # against the system anyway so it doesn't really matter that the Vim binary will too. If we
+  # decide that matters, we can always patch it back to the Nix libsystem post-build.
+  # It also picks up libiconv, libunwind, and objc4 from Nix. These seem relatively harmless but
+  # let's strip them out too.
+  #
+  # Note: If we do add a post-build install_name_tool patch, we need to add the
+  # "LDFLAGS=-headerpad_max_install_names" flag to configureFlags and either patch it into the
+  # Xcode project or pass it as a flag to xcodebuild as well.
  postConfigure = ''
-    substituteInPlace src/auto/config.mk --replace "PERL_CFLAGS	=" "PERL_CFLAGS	= -I${darwin.libutil}/include"
+    substituteInPlace src/auto/config.mk \
+      --replace "PERL_CFLAGS	=" "PERL_CFLAGS	= -I${darwin.libutil}/include" \
+      --replace " -L${stdenv.cc.libc}/lib" "" \
+      --replace " -L${darwin.libobjc}/lib" "" \
+      --replace " -L${darwin.libunwind}/lib" "" \
+      --replace " -L${darwin.libiconv}/lib" ""
+
+    # All the libraries we stripped have -osx- in their name as of this time.
+    # Assert now that this pattern no longer appears in config.mk.
+    ( # scope variable
+      while IFS="" read -r line; do
+        if [[ "$line" == LDFLAGS*-osx-* ]]; then
+          echo "WARNING: src/auto/config.mk contains reference to Nix osx library" >&2
+        fi
+      done <src/auto/config.mk
+    )

    substituteInPlace src/MacVim/vimrc --subst-var-by CSCOPE ${cscope}/bin/cscope
  '';
--- a/pkgs/applications/editors/vim/macvim.patch
+++ b/pkgs/applications/editors/vim/macvim.patch
@ -1,25 +1,5 @@
-diff --git a/src/MacVim/MacVim.xcodeproj/project.pbxproj b/src/MacVim/MacVim.xcodeproj/project.pbxproj
-index e519018de..556a4127d 100644
--- a/src/MacVim/MacVim.xcodeproj/project.pbxproj
-+++ b/src/MacVim/MacVim.xcodeproj/project.pbxproj
-@@ -1007,6 +1007,7 @@
- 				LD_RUNPATH_SEARCH_PATHS = "@loader_path/../Frameworks";
- 				MACOSX_DEPLOYMENT_TARGET = "";
- 				ONLY_ACTIVE_ARCH = YES;
-+				OTHER_LDFLAGS = "-headerpad_max_install_names";
- 				PRODUCT_BUNDLE_IDENTIFIER = org.vim.MacVim;
- 				PRODUCT_NAME = MacVim;
- 				VERSIONING_SYSTEM = "apple-generic";
-@@ -1039,6 +1040,7 @@
- 				LD_RUNPATH_SEARCH_PATHS = "@loader_path/../Frameworks";
- 				MACOSX_DEPLOYMENT_TARGET = "";
- 				ONLY_ACTIVE_ARCH = YES;
-+				OTHER_LDFLAGS = "-headerpad_max_install_names";
- 				PRODUCT_BUNDLE_IDENTIFIER = org.vim.MacVim;
- 				PRODUCT_NAME = MacVim;
- 				VERSIONING_SYSTEM = "apple-generic";
 diff --git a/src/MacVim/vimrc b/src/MacVim/vimrc
-index 23a06bf37..dfb10fe94 100644
+index 23a06bf..dfb10fe 100644
 --- a/src/MacVim/vimrc
 +++ b/src/MacVim/vimrc
@@ -14,35 +14,5 @@ set backspace+=indent,eol,start
@ -61,10 +41,10 @@ index 23a06bf37..dfb10fe94 100644
 +" Default cscopeprg to the Nix-installed path
 +set cscopeprg=@CSCOPE@
 diff --git a/src/Makefile b/src/Makefile
-index 32810d0a7..13a05f349 100644
+index 24c6934..d0f094e 100644
 --- a/src/Makefile
 +++ b/src/Makefile
-@@ -1385,7 +1385,7 @@ MACVIMGUI_SRC	= gui.c gui_beval.c MacVim/gui_macvim.m MacVim/MMBackend.m \
+@@ -1407,7 +1407,7 @@ MACVIMGUI_SRC	= gui.c gui_beval.c MacVim/gui_macvim.m MacVim/MMBackend.m \
 		  MacVim/MacVim.m
 MACVIMGUI_OBJ	= objects/gui.o objects/gui_beval.o \
 		  objects/gui_macvim.o objects/MMBackend.o objects/MacVim.o
@ -74,10 +54,10 @@ index 32810d0a7..13a05f349 100644
 MACVIMGUI_LIBS_DIR =
 MACVIMGUI_LIBS1	= -framework Cocoa -framework Carbon
 diff --git a/src/auto/configure b/src/auto/configure
-index 9e6a82f4a..3c6d1a89b 100755
+index 730d6d5..0259112 100755
 --- a/src/auto/configure
 +++ b/src/auto/configure
-@@ -5829,10 +5829,7 @@ $as_echo "not found" >&6; }
+@@ -5859,10 +5859,7 @@ $as_echo "not found" >&6; }
 
     for path in "${vi_cv_path_mzscheme_pfx}/lib" "${SCHEME_LIB}"; do
       if test "X$path" != "X"; then
@ -89,7 +69,7 @@ index 9e6a82f4a..3c6d1a89b 100755
 	  MZSCHEME_LIBS="${path}/libmzscheme3m.a"
 	  MZSCHEME_CFLAGS="-DMZ_PRECISE_GC"
 	elif test -f "${path}/libracket3m.a"; then
-@@ -6217,23 +6214,6 @@ $as_echo ">>> too old; need Perl version 5.003_01 or later <<<" >&6; }
+@@ -6247,23 +6244,6 @@ $as_echo ">>> too old; need Perl version 5.003_01 or later <<<" >&6; }
   fi
 
   if test "x$MACOS_X" = "xyes"; then
@ -113,7 +93,7 @@ index 9e6a82f4a..3c6d1a89b 100755
                 PERL_LIBS=`echo "$PERL_LIBS" | sed -e 's/-arch\ ppc//' -e 's/-arch\ i386//' -e 's/-arch\ x86_64//'`
     PERL_CFLAGS=`echo "$PERL_CFLAGS" | sed -e 's/-arch\ ppc//' -e 's/-arch\ i386//' -e 's/-arch\ x86_64//'`
   fi
-@@ -6456,13 +6436,7 @@ __:
+@@ -6486,13 +6466,7 @@ __:
 eof
 	    	    eval "`cd ${PYTHON_CONFDIR} && make -f "${tmp_mkf}" __ | sed '/ directory /d'`"
 	    rm -f -- "${tmp_mkf}"
@ -128,7 +108,7 @@ index 9e6a82f4a..3c6d1a89b 100755
 	      vi_cv_path_python_plibs="-L${PYTHON_CONFDIR} -lpython${vi_cv_var_python_version}"
 	      	      	      	      if test -n "${python_LINKFORSHARED}" && test -n "${python_PYTHONFRAMEWORKPREFIX}"; then
 	        python_link_symbol=`echo ${python_LINKFORSHARED} | sed 's/\([^ \t][^ \t]*[ \t][ \t]*[^ \t][^ \t]*\)[ \t].*/\1/'`
-@@ -6477,7 +6451,6 @@ eof
+@@ -6507,7 +6481,6 @@ eof
 	      fi
 	      vi_cv_path_python_plibs="${vi_cv_path_python_plibs} ${python_BASEMODLIBS} ${python_LIBS} ${python_SYSLIBS} ${python_LINKFORSHARED}"
 	      	      vi_cv_path_python_plibs=`echo $vi_cv_path_python_plibs | sed s/-ltermcap//`
@ -136,7 +116,7 @@ index 9e6a82f4a..3c6d1a89b 100755
 
 fi
 
-@@ -6556,13 +6529,6 @@ rm -f core conftest.err conftest.$ac_objext \
+@@ -6586,13 +6559,6 @@ rm -f core conftest.err conftest.$ac_objext \
 $as_echo "no" >&6; }
 	fi
 
@ -150,7 +130,7 @@ index 9e6a82f4a..3c6d1a89b 100755
 			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if compile and link flags for Python are sane" >&5
 $as_echo_n "checking if compile and link flags for Python are sane... " >&6; }
 	cflags_save=$CFLAGS
-@@ -7456,11 +7422,7 @@ $as_echo "$tclver - OK" >&6; };
+@@ -7486,11 +7452,7 @@ $as_echo "$tclver - OK" >&6; };
 
       { $as_echo "$as_me:${as_lineno-$LINENO}: checking for location of Tcl include" >&5
 $as_echo_n "checking for location of Tcl include... " >&6; }
@ -162,7 +142,7 @@ index 9e6a82f4a..3c6d1a89b 100755
       TCL_INC=
       for try in $tclinc; do
 	if test -f "$try/tcl.h"; then
-@@ -7478,12 +7440,8 @@ $as_echo "<not found>" >&6; }
+@@ -7508,12 +7470,8 @@ $as_echo "<not found>" >&6; }
       if test -z "$SKIP_TCL"; then
 	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for location of tclConfig.sh script" >&5
 $as_echo_n "checking for location of tclConfig.sh script... " >&6; }
@ -175,7 +155,7 @@ index 9e6a82f4a..3c6d1a89b 100755
 	for try in $tclcnf; do
 	  if test -f "$try/tclConfig.sh"; then
 	    { $as_echo "$as_me:${as_lineno-$LINENO}: result: $try/tclConfig.sh" >&5
-@@ -7673,10 +7631,6 @@ $as_echo "$rubyhdrdir" >&6; }
+@@ -7703,10 +7661,6 @@ $as_echo "$rubyhdrdir" >&6; }
 	if test -f "$rubylibdir/$librubya"; then
 	  librubyarg="$librubyarg"
 	  RUBY_LIBS="$RUBY_LIBS -L$rubylibdir"
@ -187,10 +167,10 @@ index 9e6a82f4a..3c6d1a89b 100755
 
 	if test "X$librubyarg" != "X"; then
 diff --git a/src/vim.h b/src/vim.h
-index f158aab..a714da9 100644
+index 87d1c92..8a7d5a5 100644
 --- a/src/vim.h
 +++ b/src/vim.h
-@@ -243,17 +243,6 @@
+@@ -250,17 +250,6 @@
 # define SUN_SYSTEM
 #endif
 
@ -209,7 +189,7 @@ index f158aab..a714da9 100644
 # include "os_amiga.h"
 #endif
 diff --git a/src/vimtutor b/src/vimtutor
-index 1e8769b25..47078b0e7 100755
+index 1e8769b..47078b0 100755
 --- a/src/vimtutor
 +++ b/src/vimtutor
@@ -16,7 +16,7 @@ seq="vim vim81 vim80 vim8 vim74 vim73 vim72 vim71 vim70 vim7 vim6 vi"
--- a/pkgs/applications/graphics/apitrace/default.nix
+++ b/pkgs/applications/graphics/apitrace/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, libX11, procps, python2, libdwarf, qtbase, qtwebkit }:
+{ stdenv, fetchFromGitHub, cmake, libX11, procps, python2, libdwarf, qtbase, qtwebkit, wrapQtAppsHook, libglvnd }:

 stdenv.mkDerivation rec {
  pname = "apitrace";
@ -15,7 +15,48 @@ stdenv.mkDerivation rec {
  # of games -- so it's fine to use e.g. bundled snappy.
  buildInputs = [ libX11 procps python2 libdwarf qtbase qtwebkit ];

-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook ];
+
+  # Don't automatically wrap all binaries, I prefer to explicitly only wrap
+  # `qapitrace`.
+  dontWrapQtApps = true;
+
+  postFixup = ''
+
+    # Since https://github.com/NixOS/nixpkgs/pull/60985, we add `/run-opengl-driver[-32]`
+    # to the `RUNPATH` of dispatcher libraries `dlopen()` ing OpenGL drivers.
+    # `RUNPATH` doesn't propagate throughout the whole application, but only
+    # from the module performing the `dlopen()`.
+    # 
+    # Apitrace wraps programs by running them with `LD_PRELOAD` pointing to `.so`
+    # files in $out/lib/apitrace/wrappers.
+    # 
+    # Theses wrappers effectively wrap the `dlopen()` calls from `libglvnd`
+    # and other dispatcher libraries, and run `dlopen()`  by themselves.
+    # 
+    # As `RUNPATH` doesn't propagate through the whole library, and they're now the
+    # library doing the real `dlopen()`, they also need to have
+    # `/run-opengl-driver[-32]` added to their `RUNPATH`.
+    #
+    # To stay simple, we add paths for 32 and 64 bits unconditionally.
+    # This doesn't have an impact on closure size, and if the 32 bit drivers
+    # are not available, that folder is ignored.
+    for i in $out/lib/apitrace/wrappers/*.so
+    do
+      echo "Patching OpenGL driver path for $i"
+      patchelf --set-rpath "/run/opengl-driver/lib:/run/opengl-driver-32/lib:$(patchelf --print-rpath $i)" $i
+    done
+
+    # Theses open the OpenGL driver at runtime, but it is not listed as NEEDED libraries. They need
+    # a reference to libglvnd.
+    for i in $out/bin/eglretrace $out/bin/glretrace
+    do
+      echo "Patching RPath for $i"
+      patchelf --set-rpath "${stdenv.lib.makeLibraryPath [libglvnd]}:$(patchelf --print-rpath $i)" $i
+    done
+
+    wrapQtApp $out/bin/qapitrace
+  '';

  meta = with stdenv.lib; {
    homepage = "https://apitrace.github.io";
--- a/pkgs/applications/graphics/avocode/default.nix
+++ b/pkgs/applications/graphics/avocode/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "avocode";
-  version = "4.4.3";
+  version = "4.6.2";

  src = fetchurl {
    url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
-    sha256 = "03pq55mdgbaf6c2q57ww2990wr6qz8hk1r6xs1irqy8990m4afvk";
+    sha256 = "1ldvscxfvwpsir8vr1ca9ra0841m6xy331ys31dngcp77nwncjqc";
  };

  libPath = stdenv.lib.makeLibraryPath (with xorg; [
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "drawio";
-  version = "12.9.9";
+  version = "13.0.3";

  src = fetchurl {
    url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/draw.io-x86_64-${version}.rpm";
-    sha256 = "07lx99fd4vkgdhagshzawrh8ncbv19hvxjpzgd3yjdj0nalvmxin";
+    sha256 = "104pfwipm8ch9xqlsz1gh18icr1p6i3n4c77bbdjakxcy4s5n7sg";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/fstl/default.nix
+++ b/pkgs/applications/graphics/fstl/default.nix
@ -2,7 +2,7 @@

 mkDerivation rec {
  pname = "fstl";
-  version = "0.9.3";
+  version = "0.9.4";

  buildInputs = [qtbase mesa_glu];

@ -23,7 +23,7 @@ mkDerivation rec {
    owner = "mkeeter";
    repo = "fstl";
    rev = "v" + version;
-    sha256 = "1j0y9xbf0ybrrnsmfzgpyyz6bi98xgzn9ivani424j01vffns892";
+    sha256 = "028hzdv11hgvcpc36q5scf4nw1256qswh37xhfn5a0iv7wycmnif";
  };

  meta = with stdenv.lib; {
--- a/pkgs/applications/kde/ark/default.nix
+++ b/pkgs/applications/kde/ark/default.nix
@ -9,14 +9,14 @@
  libarchive, libzip,

  # Archive tools
-  p7zip, lrzip,
+  lrzip,

  # Unfree tools
  unfreeEnableUnrar ? false, unrar,
 }:

 let
-  extraTools = [ p7zip lrzip ] ++ lib.optional unfreeEnableUnrar unrar;
+  extraTools = [ lrzip ] ++ lib.optional unfreeEnableUnrar unrar;
 in

 mkDerivation {
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@ -2,24 +2,24 @@

 stdenv.mkDerivation rec {
  pname = "1password";
-  version = "0.9.4";
+  version = "0.10.0";
  src =
    if stdenv.hostPlatform.system == "i686-linux" then
      fetchzip {
        url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_386_v${version}.zip";
-        sha256 = "0hgvcm42035fs2qhhvycppcrqgya98rmkk347j3hyj1m6kqxi99c";
+        sha256 = "07j11ikd0rzsj4d8rv74rfy497svq6l2q94ndf3b0a0mr8riyazj";
        stripRoot = false;
      }
    else if stdenv.hostPlatform.system == "x86_64-linux" then
      fetchzip {
        url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_amd64_v${version}.zip";
-        sha256 = "1fvl078kgpvzjr3jfp8zbajzsiwrcm33b7lqksxgcy30paqw6737";
+        sha256 = "177cl4x7rj3d74kzrpmiwps5n31axmlhqdwrdpkmay2gk9inswbs";
        stripRoot = false;
      }
    else if stdenv.hostPlatform.system == "x86_64-darwin" then
      fetchurl {
        url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_darwin_amd64_v${version}.pkg";
-        sha256 = "0fzbfxsgf0s93kg647zla9n9k5adnfb57dcwwnibs6lq5k63h8mj";
+        sha256 = "13yxmnh77g6zvl2gqf77m5i3v5706p2plgbgsn5hqrrf3g8ql63b";
      }
    else throw "Architecture not supported";

--- a/pkgs/applications/misc/alacritty/default.nix
+++ b/pkgs/applications/misc/alacritty/default.nix
@ -100,7 +100,7 @@ rustPlatform.buildRustPackage rec {
  '' + (
    if stdenv.isDarwin then ''
      mkdir $out/Applications
-      cp -r target/release/osx/Alacritty.app $out/Applications/Alacritty.app
+      cp -r $releaseDir/osx/Alacritty.app $out/Applications/Alacritty.app
    '' else ''
      install -D extra/linux/Alacritty.desktop -t $out/share/applications/
      install -D extra/logo/alacritty-term.svg $out/share/icons/hicolor/scalable/apps/Alacritty.svg
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@ -2,13 +2,13 @@

 pythonPackages.buildPythonApplication rec {
  pname = "cherrytree";
-  version = "0.39.2";
+  version = "0.39.3";

  src = fetchFromGitHub {
    owner = "giuspen";
    repo = "cherrytree";
    rev = version;
-    sha256 = "1l6wh24bhp4yhmsfmc0r4n2n10nlilkv4cmv5sfl80i250fiw7xa";
+    sha256 = "1k9i7acpphx0if6ij2p9fkmj638ry6hcyr1rdr039a8zi8hq98gz";

  };

--- a/pkgs/applications/misc/copyq/default.nix
+++ b/pkgs/applications/misc/copyq/default.nix
@ -5,13 +5,13 @@

 mkDerivation rec {
  pname = "CopyQ";
-  version = "3.10.0";
+  version = "3.11.0";

  src  = fetchFromGitHub {
    owner = "hluk";
    repo = "CopyQ";
    rev = "v${version}";
-    sha256 = "05nhgndiq0sm1bvb80sf5fgnm38249dclwzmfm7hzrablmkwgv3c";
+    sha256 = "1wx6nqcyzknbw71sliwq4cb5qq1gy6pr9867s6x3vpg3n8g2czkf";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/misc/ddgr/default.nix
+++ b/pkgs/applications/misc/ddgr/default.nix
@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, python3, installShellFiles }:

 stdenv.mkDerivation rec {
-  version = "1.8";
+  version = "1.8.1";
  pname = "ddgr";

  src = fetchFromGitHub {
    owner = "jarun";
    repo = "ddgr";
    rev = "v${version}";
-    sha256 = "1cyaindcg2vc3ij0p6b35inr01c6ys04izxsn1h70ixhsz46qg8z";
+    sha256 = "0668wzh1gqin0xscy3fly9hz370n2ny175f3kya9bsld0x0jkd5p";
  };

  nativeBuildInputs = [ installShellFiles ];
@ -17,11 +17,6 @@ stdenv.mkDerivation rec {

  makeFlags = [ "PREFIX=$(out)" ];

-  # Version 1.8 was released as 1.7
-  postPatch = ''
-    substituteInPlace ddgr --replace "_VERSION_ = '1.7'" "_VERSION_ = '${version}'"
-  '';
-
  postInstall = ''
    installShellCompletion --bash --name ddgr.bash auto-completion/bash/ddgr-completion.bash
    installShellCompletion --fish auto-completion/fish/ddgr.fish
--- a/pkgs/applications/misc/fetchmail/default.nix
+++ b/pkgs/applications/misc/fetchmail/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchurl, openssl }:

 let
-  version = "6.4.3";
+  version = "6.4.4";
 in
 stdenv.mkDerivation {
  pname = "fetchmail";
@ -9,7 +9,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "mirror://sourceforge/fetchmail/fetchmail-${version}.tar.xz";
-    sha256 = "1r6k14m40ni9114i3j1lr6zwpxky6k89mycgxxg0cpdap4a0wdmh";
+    sha256 = "1smbydwfjq29a2l44g6mgj0cd412fz40gbq6vq0klm7pmgd606si";
  };

  buildInputs = [ openssl ];
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@ -2,11 +2,11 @@

 python3Packages.buildPythonApplication rec {
  pname = "gallery_dl";
-  version = "1.13.3";
+  version = "1.13.6";

  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "0nhbhli45i2xhkmyj9mpg8fn1l58y2zmr6nnnnms557wpdpg112x";
+    sha256 = "17hgryj8qsxcx3c96ir25q0wsh5q0s6c6fb33lqfdbrfxrjcixbk";
  };

  doCheck = false;
--- a/pkgs/applications/misc/grip/default.nix
+++ b/pkgs/applications/misc/grip/default.nix
@ -2,11 +2,11 @@
 , curl, cdparanoia, libid3tag, ncurses, libtool }:

 stdenv.mkDerivation rec {
-  name = "grip-4.1.0";
+  name = "grip-4.1.1";

  src = fetchurl {
    url = "mirror://sourceforge/grip/${name}.tar.gz";
-    sha256 = "0iy7bcyrxm7zyrxah06qyxdshkgq6yqkadlw211j2qzld38a79j5";
+    sha256 = "1sbjgawb7qrinixybwi0adk7mpdfb565gkffp5gxxsw8fqd068fs";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/misc/joplin-desktop/default.nix
+++ b/pkgs/applications/misc/joplin-desktop/default.nix
@ -2,7 +2,7 @@

 let
  pname = "joplin-desktop";
-  version = "1.0.200";
+  version = "1.0.201";
  desktopItem = makeDesktopItem {
     name = "Joplin";
     exec = "joplin-desktop";
@ -13,7 +13,7 @@ in appimageTools.wrapType2 rec {
  name = "${pname}-${version}";
  src = fetchurl {
    url = "https://github.com/laurent22/joplin/releases/download/v${version}/Joplin-${version}.AppImage";
-    sha256 = "14gwv8i6dprvl96mifadq0zj77a82rww8xd5bmzm8ql6sidi2216";
+    sha256 = "060dkgamsv59vgslqyjfh1g8wg3nldrvfb9lf0y9sxjlbsv8bc55";
  };


--- a/pkgs/applications/misc/khard/default.nix
+++ b/pkgs/applications/misc/khard/default.nix
@ -1,12 +1,12 @@
 { stdenv, glibcLocales, python3 }:

 python3.pkgs.buildPythonApplication rec {
-  version = "0.16.0";
+  version = "0.16.1";
  pname = "khard";

  src = python3.pkgs.fetchPypi {
    inherit pname version;
-    sha256 = "0a1zpkq0pplmn9flxczq2wafs6zc07r9xx9qi6dqmyv9mhy9d87f";
+    sha256 = "0fg4qh5gzki5wg958wlpc8a2icnk74gzg33lqxjm755cfnjng7qd";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/applications/misc/latte-dock/default.nix
+++ b/pkgs/applications/misc/latte-dock/default.nix
@ -3,11 +3,11 @@

 mkDerivation rec {
  pname = "latte-dock";
-  version = "0.9.10";
+  version = "0.9.11";

  src = fetchurl {
    url = "https://download.kde.org/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "11s9fslr33h3ic14ifr43jphf68jpny8jmhvmrrwcz6w0p3falzw";
+    sha256 = "0x7a93a7axsa0fzpbkkv1z722k9za4p51xcpzdpnh5ih1zij0csi";
    name = "${pname}-${version}.tar.xz";
  };

--- a/pkgs/applications/misc/notable/default.nix
+++ b/pkgs/applications/misc/notable/default.nix
@ -3,14 +3,24 @@
 let
  pname = "notable";
  version = "1.8.4";
-in
-appimageTools.wrapType2 rec {
+  sha256 = "0rvz8zwsi62kiq89pv8n2wh9h5yb030kvdr1vf65xwqkhqcrzrby";
+
  name = "${pname}-${version}";
+
  src = fetchurl {
    url = "https://github.com/notable/notable/releases/download/v${version}/Notable-${version}.AppImage";
-    sha256 = "0rvz8zwsi62kiq89pv8n2wh9h5yb030kvdr1vf65xwqkhqcrzrby";
+    inherit sha256;
  };

+  appimageContents = appimageTools.extract {
+    inherit name src;
+  };
+
+in
+appimageTools.wrapType2 rec {
+
+  inherit name src;
+
  profile = ''
    export LC_ALL=C.UTF-8
    export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
@ -18,7 +28,14 @@ appimageTools.wrapType2 rec {

  multiPkgs = null; # no 32bit needed
  extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [ p.at-spi2-atk p.at-spi2-core ];
-  extraInstallCommands = "mv $out/bin/{${name},${pname}}";
+  extraInstallCommands = ''
+    mv $out/bin/{${name},${pname}}
+    install -m 444 -D ${appimageContents}/notable.desktop $out/share/applications/notable.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/1024x1024/apps/notable.png \
+      $out/share/icons/hicolor/1024x1024/apps/notable.png
+    substituteInPlace $out/share/applications/notable.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+  '';

  meta = with lib; {
    description = "The markdown-based note-taking app that doesn't suck";
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@ -1,5 +1,7 @@
-{ stdenv, lib, fetchFromGitHub, python2 }:
-
+{ pkgs, stdenv, lib, fetchFromGitHub, python3
+# To include additional plugins, pass them here as an overlay.
+, packageOverrides ? self: super: {}
+}:
 let
  mkOverride = attrname: version: sha256:
    self: super: {
@ -11,17 +13,19 @@ let
      });
    };

-  py = python2.override {
+  py = python3.override {
+    self = py;
    packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) ([
-      (mkOverride "flask"       "0.10.1" "0wrkavjdjndknhp8ya8j850jq7a1cli4g5a93mg8nh1xz2gq50sc")
-      (mkOverride "flask_login" "0.2.11" "1rg3rsjs1gwi2pw6vr9jmhaqm9b3vc9c4hfcsvp4y8agbh7g3mc3")
+      (mkOverride "flask"       "0.12.5" "fac2b9d443e49f7e7358a444a3db5950bdd0324674d92ba67f8f1f15f876b14f")
+      (mkOverride "flaskbabel"  "0.12.2" "11jwp8vvq1gnm31qh6ihy2h393hy18yn9yjp569g60r0wj1x2sii")
      (mkOverride "tornado"     "4.5.3"  "02jzd23l4r6fswmwxaica9ldlyc2p6q8dk6dyff7j58fmdzf853d")
+      (mkOverride "psutil"      "5.6.7"  "ffad8eb2ac614518bbe3c0b8eb9dffdb3a8d2e3a7d5da51c5b974fb723a5c5aa")

      # Octoprint holds back jinja2 to 2.8.1 due to breaking changes.
      # This old version does not have updated test config for pytest 4,
      # and pypi tarball doesn't contain tests dir anyways.
-      (pself: psuper: {
-        jinja2 = psuper.jinja2.overridePythonAttrs (oldAttrs: rec {
+      (self: super: {
+        jinja2 = super.jinja2.overridePythonAttrs (oldAttrs: rec {
          version = "2.8.1";
          src = oldAttrs.src.override {
            inherit version;
@ -29,74 +33,75 @@ let
          };
          doCheck = false;
        });
+
+        httpretty = super.httpretty.overridePythonAttrs (oldAttrs: rec {
+          doCheck = false;
+        });
+
+        celery = super.celery.overridePythonAttrs (oldAttrs: rec {
+          doCheck = false;
+        });
      })
+      (self: super: {
+        octoprint = self.buildPythonPackage rec {
+          pname = "OctoPrint";
+          version = "1.4.0";
+
+          src = fetchFromGitHub {
+            owner  = "foosel";
+            repo   = "OctoPrint";
+            rev    = version;
+            sha256 = "0387228544v28d69dcdg2zr5gp6qavkfr6dydpjgj5awxv3w25d5";
+          };
+
+          propagatedBuildInputs = with super; [
+            awesome-slugify flask flask_assets rsa requests pkginfo watchdog
+            semantic-version werkzeug flaskbabel tornado
+            psutil pyserial flask_login netaddr markdown
+            pylru pyyaml sarge feedparser netifaces click websocket_client
+            scandir chainmap future wrapt monotonic emoji jinja2
+            frozendict cachelib sentry-sdk filetype markupsafe
+          ] ++ lib.optionals stdenv.isDarwin [ py.pkgs.appdirs ];
+
+          checkInputs = with super; [ pytestCheckHook mock ddt ];
+
+          postPatch = let
+            ignoreVersionConstraints = [
+              "sentry-sdk"
+            ];
+          in ''
+            sed -r -i \
+              ${lib.concatStringsSep "\n" (map (e:
+                ''-e 's@${e}[<>=]+.*@${e}",@g' \''
+              ) ignoreVersionConstraints)}
+              setup.py
+          '';
+
+          dontUseSetuptoolsCheck = true;
+
+          preCheck = ''
+            export HOME=$(mktemp -d)
+            rm pytest.ini
+          '';
+
+          disabledTests = [
+            "test_check_setup" # Why should it be able to call pip?
+          ] ++ lib.optionals stdenv.isDarwin [
+            "test_set_external_modification"
+          ];
+
+          passthru.python = self.python;
+
+          meta = with stdenv.lib; {
+            homepage = "https://octoprint.org/";
+            description = "The snappy web interface for your 3D printer";
+            license = licenses.agpl3;
+            maintainers = with maintainers; [ abbradar gebner WhittlesJr ];
+          };
+        };
+      })
+      (import ./plugins.nix {inherit pkgs;})
+      packageOverrides
    ]);
  };
-
-  ignoreVersionConstraints = [
-    "Click"
-    "Flask-Assets"
-    "Flask-Babel"
-    "Flask-Principal"
-    "emoji"
-    "flask"
-    "future"
-    "futures"
-    "monotonic"
-    "markdown"
-    "pkginfo"
-    "psutil"
-    "pyserial"
-    "requests"
-    "rsa"
-    "sarge"
-    "scandir"
-    "semantic_version"
-    "watchdog"
-    "websocket-client"
-    "wrapt"
-    "sentry-sdk"
-    "werkzeug" # 0.16 just deprecates some stuff
-  ];
-
-in py.pkgs.buildPythonApplication rec {
-  pname = "OctoPrint";
-  version = "1.3.12";
-
-  src = fetchFromGitHub {
-    owner  = "foosel";
-    repo   = "OctoPrint";
-    rev    = version;
-    sha256 = "1lmqssgwjyhknjf3x58g7cr0fqz7fs5a3rl07r69wfpch63ranyd";
-  };
-
-  propagatedBuildInputs = with py.pkgs; [
-    awesome-slugify flask_assets rsa requests pkginfo watchdog
-    semantic-version flask_principal werkzeug flaskbabel tornado
-    psutil pyserial flask_login netaddr markdown sockjs-tornado
-    pylru pyyaml sarge feedparser netifaces click websocket_client
-    scandir chainmap future futures wrapt monotonic emoji
-    frozendict cachelib sentry-sdk typing filetype
-  ] ++ lib.optionals stdenv.isDarwin [ py.pkgs.appdirs ];
-
-  checkInputs = with py.pkgs; [ nose mock ddt ];
-
-  postPatch = ''
-    sed -r -i \
-      ${lib.concatStringsSep "\n" (map (e:
-        ''-e 's@${e}[<>=]+.*@${e}",@g' \''
-      ) ignoreVersionConstraints)}
-      setup.py
-  '';
-
-  checkPhase = ''
-    HOME=$(mktemp -d) nosetests ${lib.optionalString stdenv.isDarwin "--exclude=test_set_external_modification"}
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = "https://octoprint.org/";
-    description = "The snappy web interface for your 3D printer";
-    license = licenses.agpl3;
-    maintainers = with maintainers; [ abbradar gebner ];
-  };
-}
+in with py.pkgs; toPythonApplication octoprint
--- a/pkgs/applications/misc/octoprint/plugins.nix
+++ b/pkgs/applications/misc/octoprint/plugins.nix
@ -1,255 +1,255 @@
-{ stdenv, fetchgit, fetchFromGitHub, octoprint, python2Packages, marlin-calc }:
+{ pkgs }:

-let
-  buildPlugin = args: python2Packages.buildPythonPackage (args // {
+with pkgs;
+
+self: super: let
+  buildPlugin = args: self.buildPythonPackage (args // {
    pname = "OctoPrintPlugin-${args.pname}";
    inherit (args) version;
-    propagatedBuildInputs = (args.propagatedBuildInputs or []) ++ [ octoprint ];
+    propagatedBuildInputs = (args.propagatedBuildInputs or []) ++ [ super.octoprint ];
    # none of the following have tests
    doCheck = false;
  });
+in {
+  inherit buildPlugin;

-  self = {
+  # Deprecated alias
+  m3d-fio = self.m33-fio; # added 2016-08-13

-    # Deprecated alias
-    m3d-fio = self.m33-fio; # added 2016-08-13
+  m33-fio = buildPlugin rec {
+    pname = "M33-Fio";
+    version = "1.21";

-    m33-fio = buildPlugin rec {
-      pname = "M33-Fio";
-      version = "1.21";
-
-      src = fetchFromGitHub {
-        owner = "donovan6000";
-        repo = "M33-Fio";
-        rev = "V${version}";
-        sha256 = "1la3611kkqn8yiwjn6cizc45ri8pnk6ckld1na4nk6mqk88jvjq7";
-      };
-
-      patches = [
-        ./m33-fio-one-library.patch
-      ];
-
-      postPatch = ''
-        rm -rf octoprint_m33fio/static/libraries/*
-        (
-          cd 'shared library source'
-          make
-        )
-      '';
-
-      meta = with stdenv.lib; {
-        description = "OctoPrint plugin for the Micro 3D printer";
-        homepage = "https://github.com/donovan6000/M33-Fio";
-        license = licenses.gpl3;
-        maintainers = with maintainers; [ abbradar ];
-      };
+    src = fetchFromGitHub {
+      owner = "donovan6000";
+      repo = "M33-Fio";
+      rev = "V${version}";
+      sha256 = "1la3611kkqn8yiwjn6cizc45ri8pnk6ckld1na4nk6mqk88jvjq7";
    };

-    mqtt = buildPlugin rec {
-      pname = "MQTT";
-      version = "0.8.6";
+    patches = [
+      ./m33-fio-one-library.patch
+    ];

-      src = fetchFromGitHub {
-        owner = "OctoPrint";
-        repo = "OctoPrint-MQTT";
-        rev = version;
-        sha256 = "0y1jnfplcy8mh3szrfbbvngl02j49cbdizglrfsry4fvqg50zjxd";
-      };
+    postPatch = ''
+      rm -rf octoprint_m33fio/static/libraries/*
+      (
+        cd 'shared library source'
+        make
+      )
+    '';

-      propagatedBuildInputs = with python2Packages; [ paho-mqtt ];
-
-      meta = with stdenv.lib; {
-        description = "Publish printer status MQTT";
-        homepage = "https://github.com/OctoPrint/OctoPrint-MQTT";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ peterhoeg ];
-      };
-    };
-
-    titlestatus = buildPlugin rec {
-      pname = "TitleStatus";
-      version = "0.0.4";
-
-      src = fetchFromGitHub {
-        owner = "MoonshineSG";
-        repo = "OctoPrint-TitleStatus";
-        rev = version;
-        sha256 = "1l78xrabn5hcly2mgxwi17nwgnp2s6jxi9iy4wnw8k8icv74ag7k";
-      };
-
-      meta = with stdenv.lib; {
-        description = "Show printers status in window title";
-        homepage = "https://github.com/MoonshineSG/OctoPrint-TitleStatus";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ abbradar ];
-      };
-    };
-
-    stlviewer = buildPlugin rec {
-      pname = "STLViewer";
-      version = "0.4.2";
-
-      src = fetchFromGitHub {
-        owner = "jneilliii";
-        repo = "OctoPrint-STLViewer";
-        rev = version;
-        sha256 = "0mkvh44fn2ch4z2avsdjwi1rp353ylmk9j5fln4x7rx8ph8y7g2b";
-      };
-
-      meta = with stdenv.lib; {
-        description = "A simple stl viewer tab for OctoPrint";
-        homepage = "https://github.com/jneilliii/Octoprint-STLViewer";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ abbradar ];
-      };
-    };
-
-    curaenginelegacy = buildPlugin rec {
-      pname = "CuraEngineLegacy";
-      version = "1.0.2";
-
-      src = fetchFromGitHub {
-        owner = "OctoPrint";
-        repo = "OctoPrint-${pname}";
-        rev = version;
-        sha256 = "1cdb276wfyf3wcfj5g3migd6b6aqmkrxncrqjfcfx4j4k3xac965";
-      };
-
-      meta = with stdenv.lib; {
-        description = "Plugin for slicing via Cura Legacy from within OctoPrint";
-        homepage = "https://github.com/OctoPrint/OctoPrint-CuraEngineLegacy";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ gebner ];
-      };
-    };
-
-    touchui = buildPlugin rec {
-      pname = "TouchUI";
-      version = "0.3.13";
-
-      src = fetchFromGitHub {
-        owner = "BillyBlaze";
-        repo = "OctoPrint-${pname}";
-        rev = version;
-        sha256 = "0qk12ysabdzy6cna3l4f8v3qcnppppwxxsjx2i0xn1nd0cv6yzwh";
-      };
-
-      meta = with stdenv.lib; {
-        description = "Touch friendly interface for a small TFT module or phone for OctoPrint";
-        homepage = "https://github.com/BillyBlaze/OctoPrint-TouchUI";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ gebner ];
-      };
-    };
-
-    psucontrol = buildPlugin rec {
-      pname = "PSUControl";
-      version = "0.1.8";
-
-      src = fetchFromGitHub {
-        owner = "kantlivelong";
-        repo = "OctoPrint-${pname}";
-        rev = version;
-        sha256 = "0aj38d7b7d5pzmzq841pip18cpg18wy2vrxq2nd13875597y54b8";
-      };
-
-      preConfigure = ''
-        # optional; RPi.GPIO is broken on vanilla kernels
-        sed /RPi.GPIO/d -i requirements.txt
-      '';
-
-      meta = with stdenv.lib; {
-        description = "OctoPrint plugin to control ATX/AUX power supply";
-        homepage = "https://github.com/kantlivelong/OctoPrint-PSUControl";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ gebner ];
-      };
-    };
-
-    printtimegenius = buildPlugin rec {
-      pname = "PrintTimeGenius";
-      version = "2.2.1";
-
-      src = fetchFromGitHub {
-        owner = "eyal0";
-        repo = "OctoPrint-${pname}";
-        rev = version;
-        sha256 = "1dr93vbpxgxw3b1q4rwam8f4dmiwr5vnfr9796g6jx8xkpfzzy1h";
-      };
-
-      preConfigure = ''
-        # PrintTimeGenius ships with marlin-calc binaries for multiple architectures
-        rm */analyzers/marlin-calc*
-        sed 's@"{}.{}".format(binary_base_name, machine)@"${marlin-calc}/bin/marlin-calc"@' -i */analyzers/analyze_progress.py
-      '';
-
-      patches = [
-        ./printtimegenius-logging.patch
-      ];
-
-      meta = with stdenv.lib; {
-        description = "Better print time estimation for OctoPrint";
-        homepage = "https://github.com/eyal0/OctoPrint-PrintTimeGenius";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ gebner ];
-      };
-    };
-
-    abl-expert = buildPlugin rec {
-      pname = "ABL_Expert";
-      version = "2019-12-21";
-
-      src = fetchgit {
-        url = "https://framagit.org/razer/Octoprint_ABL_Expert/";
-        rev = "f11fbe05088ad618bfd9d064ac3881faec223f33";
-        sha256 = "026r4prkyvwzxag5pv36455q7s3gaig37nmr2nbvhwq3d2lbi5s4";
-      };
-
-      meta = with stdenv.lib; {
-        description = "Marlin auto bed leveling control, mesh correction, and z probe handling";
-        homepage = "https://framagit.org/razer/Octoprint_ABL_Expert/";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ WhittlesJr ];
-      };
-    };
-
-    gcodeeditor = buildPlugin rec {
-      pname = "GcodeEditor";
-      version = "0.2.6";
-
-      src = fetchFromGitHub {
-        owner = "ieatacid";
-        repo = "OctoPrint-${pname}";
-        rev = version;
-        sha256 = "0c6p78r3vd6ys3kld308pyln09zjbr9yif1ljvcx6wlml2i5l1vh";
-      };
-
-      meta = with stdenv.lib; {
-        description = "Edit gcode on OctoPrint";
-        homepage = "https://github.com/Sebclem/OctoPrint-SimpleEmergencyStop";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ WhittlesJr ];
-      };
-    };
-
-    simpleemergencystop = buildPlugin rec {
-      pname = "SimpleEmergencyStop";
-      version = "0.2.5";
-
-      src = fetchFromGitHub {
-        owner = "Sebclem";
-        repo = "OctoPrint-${pname}";
-        rev = version;
-        sha256 = "10wadv09wv2h96igvq3byw9hz1si82n3c7v5y0ii3j7hm2d06y8p";
-      };
-
-      meta = with stdenv.lib; {
-        description = "A simple plugin that add an emergency stop buton on NavBar of OctoPrint";
-        homepage = "https://github.com/ieatacid/OctoPrint-GcodeEditor";
-        license = licenses.agpl3;
-        maintainers = with maintainers; [ WhittlesJr ];
-      };
+    meta = with stdenv.lib; {
+      description = "OctoPrint plugin for the Micro 3D printer";
+      homepage = "https://github.com/donovan6000/M33-Fio";
+      license = licenses.gpl3;
+      maintainers = with maintainers; [ abbradar ];
    };
  };

-in self
+  mqtt = buildPlugin rec {
+    pname = "MQTT";
+    version = "0.8.6";
+
+    src = fetchFromGitHub {
+      owner = "OctoPrint";
+      repo = "OctoPrint-MQTT";
+      rev = version;
+      sha256 = "0y1jnfplcy8mh3szrfbbvngl02j49cbdizglrfsry4fvqg50zjxd";
+    };
+
+    propagatedBuildInputs = with super; [ paho-mqtt ];
+
+    meta = with stdenv.lib; {
+      description = "Publish printer status MQTT";
+      homepage = "https://github.com/OctoPrint/OctoPrint-MQTT";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ peterhoeg ];
+    };
+  };
+
+  titlestatus = buildPlugin rec {
+    pname = "TitleStatus";
+    version = "0.0.4";
+
+    src = fetchFromGitHub {
+      owner = "MoonshineSG";
+      repo = "OctoPrint-TitleStatus";
+      rev = version;
+      sha256 = "1l78xrabn5hcly2mgxwi17nwgnp2s6jxi9iy4wnw8k8icv74ag7k";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Show printers status in window title";
+      homepage = "https://github.com/MoonshineSG/OctoPrint-TitleStatus";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ abbradar ];
+    };
+  };
+
+  stlviewer = buildPlugin rec {
+    pname = "STLViewer";
+    version = "0.4.2";
+
+    src = fetchFromGitHub {
+      owner = "jneilliii";
+      repo = "OctoPrint-STLViewer";
+      rev = version;
+      sha256 = "0mkvh44fn2ch4z2avsdjwi1rp353ylmk9j5fln4x7rx8ph8y7g2b";
+    };
+
+    meta = with stdenv.lib; {
+      description = "A simple stl viewer tab for OctoPrint";
+      homepage = "https://github.com/jneilliii/Octoprint-STLViewer";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ abbradar ];
+    };
+  };
+
+  curaenginelegacy = buildPlugin rec {
+    pname = "CuraEngineLegacy";
+    version = "1.0.2";
+
+    src = fetchFromGitHub {
+      owner = "OctoPrint";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "1cdb276wfyf3wcfj5g3migd6b6aqmkrxncrqjfcfx4j4k3xac965";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Plugin for slicing via Cura Legacy from within OctoPrint";
+      homepage = "https://github.com/OctoPrint/OctoPrint-CuraEngineLegacy";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ gebner ];
+    };
+  };
+
+  touchui = buildPlugin rec {
+    pname = "TouchUI";
+    version = "0.3.14";
+
+    src = fetchFromGitHub {
+      owner = "BillyBlaze";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "033b9nk3kpnmjw9nggcaxy39hcgfviykcy2cx0j6m411agvmqbzf";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Touch friendly interface for a small TFT module or phone for OctoPrint";
+      homepage = "https://github.com/BillyBlaze/OctoPrint-TouchUI";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ gebner ];
+    };
+  };
+
+  psucontrol = buildPlugin rec {
+    pname = "PSUControl";
+    version = "0.1.9";
+
+    src = fetchFromGitHub {
+      owner = "kantlivelong";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "1cn009bdgn6c9ba9an5wfj8z02wi0xcsmbhkqggiqlnqy1fq45ca";
+    };
+
+    preConfigure = ''
+      # optional; RPi.GPIO is broken on vanilla kernels
+      sed /RPi.GPIO/d -i requirements.txt
+    '';
+
+    meta = with stdenv.lib; {
+      description = "OctoPrint plugin to control ATX/AUX power supply";
+      homepage = "https://github.com/kantlivelong/OctoPrint-PSUControl";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ gebner ];
+    };
+  };
+
+  printtimegenius = buildPlugin rec {
+    pname = "PrintTimeGenius";
+    version = "2.2.1";
+
+    src = fetchFromGitHub {
+      owner = "eyal0";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "1dr93vbpxgxw3b1q4rwam8f4dmiwr5vnfr9796g6jx8xkpfzzy1h";
+    };
+
+    preConfigure = ''
+      # PrintTimeGenius ships with marlin-calc binaries for multiple architectures
+      rm */analyzers/marlin-calc*
+      sed 's@"{}.{}".format(binary_base_name, machine)@"${pkgs.marlin-calc}/bin/marlin-calc"@' -i */analyzers/analyze_progress.py
+    '';
+
+    patches = [
+      ./printtimegenius-logging.patch
+    ];
+
+    meta = with stdenv.lib; {
+      description = "Better print time estimation for OctoPrint";
+      homepage = "https://github.com/eyal0/OctoPrint-PrintTimeGenius";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ gebner ];
+    };
+  };
+
+  abl-expert = buildPlugin rec {
+    pname = "ABL_Expert";
+    version = "2019-12-21";
+
+    src = fetchgit {
+      url = "https://framagit.org/razer/Octoprint_ABL_Expert/";
+      rev = "f11fbe05088ad618bfd9d064ac3881faec223f33";
+      sha256 = "026r4prkyvwzxag5pv36455q7s3gaig37nmr2nbvhwq3d2lbi5s4";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Marlin auto bed leveling control, mesh correction, and z probe handling";
+      homepage = "https://framagit.org/razer/Octoprint_ABL_Expert/";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ WhittlesJr ];
+    };
+  };
+
+  gcodeeditor = buildPlugin rec {
+    pname = "GcodeEditor";
+    version = "0.2.6";
+
+    src = fetchFromGitHub {
+      owner = "ieatacid";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "0c6p78r3vd6ys3kld308pyln09zjbr9yif1ljvcx6wlml2i5l1vh";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Edit gcode on OctoPrint";
+      homepage = "https://github.com/ieatacid/OctoPrint-GcodeEditor";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ WhittlesJr ];
+    };
+  };
+
+  simpleemergencystop = buildPlugin rec {
+    pname = "SimpleEmergencyStop";
+    version = "0.2.5";
+
+    src = fetchFromGitHub {
+      owner = "Sebclem";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "10wadv09wv2h96igvq3byw9hz1si82n3c7v5y0ii3j7hm2d06y8p";
+    };
+
+    meta = with stdenv.lib; {
+      description = "A simple plugin that add an emergency stop buton on NavBar of OctoPrint";
+      homepage = "https://github.com/Sebclem/OctoPrint-SimpleEmergencyStop";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ WhittlesJr ];
+    };
+  };
+}
--- a/pkgs/applications/misc/osmium-tool/default.nix
+++ b/pkgs/applications/misc/osmium-tool/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "osmium-tool";
-  version = "1.11.1";
+  version = "1.12.0";

  src = fetchFromGitHub {
    owner = "osmcode";
    repo = "osmium-tool";
    rev = "v${version}";
-    sha256 = "199dvajik5d56nybk2061vdjyxwakngfd7frxj99wr2vsrp4aw2b";
+    sha256 = "18afn5qzdjpip176kk5pr04mj0p7dv70dbz1n36qmqnq3gyms10q";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/misc/pdfarranger/default.nix
+++ b/pkgs/applications/misc/pdfarranger/default.nix
@ -5,13 +5,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "pdfarranger";
-  version = "1.4.2";
+  version = "1.5.1";

  src = fetchFromGitHub {
    owner = "jeromerobert";
    repo = pname;
    rev = version;
-    sha256 = "11q14pxyp5z4y3gabjnis3ip3xss6n94zjl42akwf27dxgxlpcjk";
+    sha256 = "0n4jw0dsqw929a34ff077kz8w89vkjkqf8dy4c356zh6gf23cdxr";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/pdfsam-basic/default.nix
+++ b/pkgs/applications/misc/pdfsam-basic/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "pdfsam-basic";
-  version = "4.1.2";
+  version = "4.1.3";

  src = fetchurl {
    url = "https://github.com/torakiki/pdfsam/releases/download/v${version}/pdfsam_${version}-1_amd64.deb";
-    sha256 = "1k1azxz92vkb4hylk4ki0szfn47ids0lwg01zfs54yc89j0c6142";
+    sha256 = "1rhv6mf6pr9aaa8516i3b7v6h622qb1p8c4jsy3j0s5wrdry5l9l";
  };

  unpackPhase = ''
--- a/pkgs/applications/misc/pueue/default.nix
+++ b/pkgs/applications/misc/pueue/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "pueue";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "Nukesor";
    repo = pname;
    rev = "v${version}";
-    sha256 = "11x4y3ah9f7mv9jssws95sw7rd20fxwdh11mrhcb4vwk59cmqsjz";
+    sha256 = "1v3fphx71hyv7fq09slhyzchw362swzhmhn7wmbazfdrj6fjhcki";
  };

-  cargoSha256 = "06zv3li14sg4a8bgj38zzx576ggm32ss0djmys1g0h5a0nxaaqfx";
+  cargoSha256 = "04vi9la17pabz1spfw1fzgy4c2ifnis6am5m4ck3lhccnn6j8bd3";

  checkPhase = "cargo test -- --skip test_single_huge_payload";

--- a/pkgs/applications/misc/redshift/default.nix
+++ b/pkgs/applications/misc/redshift/default.nix
@ -101,12 +101,13 @@ rec {

  redshift-wlr = mkRedshift {
    pname = "redshift-wlr";
-    version = "2019-04-17";
+    # upstream rebases so this is the push date
+    version = "2019-08-24";

    src = fetchFromGitHub {
      owner = "minus7";
      repo = "redshift";
-      rev = "eecbfedac48f827e96ad5e151de8f41f6cd3af66";
+      rev = "7da875d34854a6a34612d5ce4bd8718c32bec804";
      sha256 = "0rs9bxxrw4wscf4a8yl776a8g880m5gcm75q06yx2cn3lw2b7v22";
    };

--- a/pkgs/applications/misc/sweethome3d/default.nix
+++ b/pkgs/applications/misc/sweethome3d/default.nix
@ -73,14 +73,14 @@ in {

  application = mkSweetHome3D rec {
    pname = stdenv.lib.toLower module + "-application";
-    version = "6.2";
+    version = "6.3";
    module = "SweetHome3D";
    description = "Design and visualize your future home";
    license = stdenv.lib.licenses.gpl2Plus;
    src = fetchsvn {
      url = "https://svn.code.sf.net/p/sweethome3d/code/tags/V_" + d2u version + "/SweetHome3D/";
-      sha256 = "0a514a1zmipykvawil46v826ivkw9c00vdkyggyl6m41giay15zf";
-      rev = "6822";
+      sha256 = "1c13g0f73jgbzmjhdm9knqq1kh3vdl04zl3xlp30g9a1n0jkr38i";
+      rev = "6896";
    };
    desktopName = "Sweet Home 3D";
    icons = {
--- a/pkgs/applications/misc/toot/default.nix
+++ b/pkgs/applications/misc/toot/default.nix
@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, python3Packages }:

 python3Packages.buildPythonApplication rec {
-  version = "0.25.2";
+  version = "0.26.0";
  name    = "toot-${version}";

  src = fetchFromGitHub {
    owner  = "ihabunek";
    repo   = "toot";
    rev    = version;
-    sha256 = "0g18x8pbwhk2d3aphah6dqqbhz62k48pwx63flsnqd4brccd0jkh";
+    sha256 = "146jj83jixahgxwh12bbkfvci2wrz398h5x01kgppdy59m4pa4pl";
  };

  checkInputs = with python3Packages; [ pytest ];
--- a/pkgs/applications/misc/xastir/default.nix
+++ b/pkgs/applications/misc/xastir/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "xastir";
-  version = "2.1.4";
+  version = "2.1.6";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "Release-${version}";
-    sha256 = "14f908jy5jzvgm1h1sr47hjqjq3q2nq91byhimk84kj044fn21w9";
+    sha256 = "sha256-IdlRScAy7tCyVCElCceY4PvqPXWfZZ35f+MwCo3nO3s=";
  };

  buildInputs = [
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "xmrig";
-  version = "5.10.0";
+  version = "5.11.1";

  src = fetchFromGitHub {
    owner = "xmrig";
    repo = "xmrig";
    rev = "v${version}";
-    sha256 = "06nxhrb5vnlq3sxybiyzdpbv6ah1zam7r07s1c31sv37znlb77d5";
+    sha256 = "04wsz7hcmzm5dv9q1wb26nvcz5gxdcgkf00cp5bpbr3y9vc6dyz6";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/networking/Sylk/default.nix
+++ b/pkgs/applications/networking/Sylk/default.nix
@ -2,7 +2,7 @@

 let
  pname = "Sylk";
-  version = "2.6.1";
+  version = "2.7.0";
 in

 appimageTools.wrapType2 rec {
@ -10,7 +10,7 @@ appimageTools.wrapType2 rec {

  src = fetchurl {
    url = "http://download.ag-projects.com/Sylk/Sylk-${version}-x86_64.AppImage";
-    hash = "sha256:0417qk925k7p3fiq1zha9al86jrz6mqspda7mi3h9blpbyvlcy7w";
+    hash = "sha256:0xjg9j69yj06ys8229x6mwsjlk3mvxi8gnr2kymx0vhhg1zvqi1k";
  };

  profile = ''
--- a/pkgs/applications/networking/browsers/ephemeral/default.nix
+++ b/pkgs/applications/networking/browsers/ephemeral/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "ephemeral";
-  version = "6.3.3";
+  version = "6.4.1";

  src = fetchFromGitHub {
    owner = "cassidyjames";
    repo = "ephemeral";
    rev = version;
-    sha256 = "093bqc40p4s8jc1s5rg49363x24vnwwjayvgzmi4xag28f1x6kn8";
+    sha256 = "1lzcwaczh601kwbx7fzg32nrzlg67asby7p86qy10qz86xf4g608";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/atlantis/default.nix
+++ b/pkgs/applications/networking/cluster/atlantis/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "atlantis";
-  version = "0.11.1";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "runatlantis";
    repo = "atlantis";
    rev = "v${version}";
-    sha256 = "1ylk6n13ln6yaq4nc4n7fm00wfiyqi2x33sca5avzsvd1b387kk6";
+    sha256 = "16zz4xwpqipdmszbz93xxw31hbh7s8pfa9dm64ybyni7wc4lvdy6";
  };

-  modSha256 = "1bhplk3p780llpj9l0fwcyli74879968d6j582mvjwvf2winbqzq";
+  modSha256 = "18f7cf61yn5jkji5a4v6xw6c7xl40nj32n5w34xmcmszzf64cwkn";

  subPackages = [ "." ];

--- a/pkgs/applications/networking/cluster/chronos/default.nix
+++ b/pkgs/applications/networking/cluster/chronos/default.nix
@ -34,6 +34,6 @@ stdenv.mkDerivation rec {
    description = "Fault tolerant job scheduler for Mesos which handles dependencies and ISO8601 based schedules";
    maintainers = with maintainers; [ offline ];
    platforms   = platforms.unix;
-    broken = true; # doesn't build http://hydra.nixos.org/build/25768319
+    broken = true; # doesn't build https://hydra.nixos.org/build/25768319
  };
 }
--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@ -1,6 +1,6 @@
 { lib, buildGoModule, fetchFromGitHub, makeWrapper, kubernetes-helm, ... }:

-let version = "0.106.3"; in
+let version = "0.114.0"; in

 buildGoModule {
  pname = "helmfile";
@ -10,12 +10,12 @@ buildGoModule {
    owner = "roboll";
    repo = "helmfile";
    rev = "v${version}";
-    sha256 = "0pwkkgdcj9vx6nk574iaqwn074qfpgqd1c44d3kr3xdbac89yfyf";
+    sha256 = "0486wcfizi8xljr29mznc4p11ggz4rvk5n53qvb30f7ry4ncc8n5";
  };

  goPackagePath = "github.com/roboll/helmfile";

-  modSha256 = "1yv2b44qac0rms66v0qg13wsga0di6hwxa4dh2l0b1xvaf75ysay";
+  modSha256 = "0j7w12rrnsv2h5v0bqh6sjq9anm51zs0p3nzlhwsksw9c98r9avk";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/applications/networking/cluster/k9s/default.nix
+++ b/pkgs/applications/networking/cluster/k9s/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "k9s";
-  version = "0.18.1";
+  version = "0.19.4";

  src = fetchFromGitHub {
    owner  = "derailed";
    repo   = "k9s";
    rev    = "v${version}";
-    sha256 = "0a5x4yamvx2qlwngfvainbhplwp0hqwgvdqlj2jbrbz4hfhr1l59";
+    sha256 = "1ya3lrw31pxd1rxzf88l5hzilaxwrng1a3ibawgn57my333hrmf6";
  };

  buildFlagsArray = ''
@ -18,7 +18,7 @@ buildGoModule rec {
      -X github.com/derailed/k9s/cmd.commit=${src.rev}
  '';

-  modSha256 = "0wpf6iyq6p3a8azdkn17gdp01wq9khyzr1bab6qgvsnsnhnjzcky";
+  modSha256 = "11jxyzajlk6b5j19sg1kjr7qdzpxkwjwrvyhx9mwy6jb5sgqbzv8";

  meta = with stdenv.lib; {
    description = "Kubernetes CLI To Manage Your Clusters In Style.";
--- a/pkgs/applications/networking/cluster/luigi/default.nix
+++ b/pkgs/applications/networking/cluster/luigi/default.nix
@ -2,11 +2,11 @@

 python3Packages.buildPythonApplication rec {
  pname = "luigi";
-  version = "2.8.12";
+  version = "2.8.13";

  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "1p83mxqs7w5v27a58ps7wji5mlyfz66cpkbyrndix0pv9hdyzpxn";
+    sha256 = "0x14549iwj7r1knc0hmic9ny9hp960yjjqi4mxl78jb69gd3bhmf";
  };

  propagatedBuildInputs = with python3Packages; [ dateutil tornado_4 python-daemon boto3 ];
--- a/pkgs/applications/networking/feedreaders/rssguard/default.nix
+++ b/pkgs/applications/networking/feedreaders/rssguard/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "rssguard";
-  version = "3.5.9";
+  version = "3.6.0";

  src = fetchFromGitHub {
    owner = "martinrotter";
    repo = pname;
    rev = version;
-    sha256 = "0dvjcazvrgxfxg1gvznxj8kx569v4ivns0brq00cn2yxyd4wx43s";
+    sha256 = "0nlvhcvd3bbvd3dapqix7h29pchbd9gv5n3hmrig9yi98yv8q53r";
  };

  buildInputs =  [ qtwebengine qttools ];
--- a/pkgs/applications/networking/gmailctl/default.nix
+++ b/pkgs/applications/networking/gmailctl/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "gmailctl";
-  version = "0.6.0";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "mbrt";
    repo = "gmailctl";
    rev = "v${version}";
-    sha256 = "0g581gdkib7bj86blpm8skjvbnivmzh9ddikxai9hr5qq231j1pb";
+    sha256 = "08q4yjfbwlldirf3j5db18l8kn6sf288wd364s50jlcx2ka8w50j";
  };

-  modSha256 = "0pv3lhzl96ygzh9y01hi9klrrk403ii92imr9yrbimaf7rsvyvjp";
+  modSha256 = "1c7dk6l8lkq2j04cp5g97hwkwfmmyn5r0vpr5zpavvalxgjidsf4";

  meta = with stdenv.lib; {
    description = "Declarative configuration for Gmail filters";
--- a/pkgs/applications/networking/instant-messengers/qtox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qtox/default.nix
@ -7,7 +7,7 @@
 , AVFoundation ? null }:

 let
-  version = "1.16.3";
+  version = "1.17.2";
  rev = "v${version}";

 in mkDerivation {
@ -17,7 +17,7 @@ in mkDerivation {
  src = fetchFromGitHub {
    owner  = "qTox";
    repo   = "qTox";
-    sha256 = "0qd4nvbrjnnfnk8ghsxq3cd1n1qf1ck5zg6ib11ij2pg03s146pa";
+    sha256 = "04pbv1zsxy8dph2v0r9xc8lcm5g6604pwnppi3la5w46ihbwxlb9";
    inherit rev;
  };

--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
@ -2,7 +2,7 @@
  "name": "riot-web",
  "productName": "Riot",
  "main": "src/electron-main.js",
-  "version": "1.5.15",
+  "version": "1.6.0",
  "description": "A feature-rich client for Matrix.org",
  "author": "New Vector Ltd.",
  "dependencies": {
--- a/Show More
+++ b/Show More