Merge remote-tracking branch 'upstream/master' into staging

2018-05-08 09:36:00 -05:00 · 2018-05-08 09:36:00 -05:00 · 6748534d83
commit 6748534d83
parent 4f7cdd35d5 3510b983c4
317 changed files with 7440 additions and 6298 deletions
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@ -136,7 +136,18 @@ checkConfigOutput "true" "$@" ./define-module-check.nix
 # Check coerced value.
 checkConfigOutput "\"42\"" config.value ./declare-coerced-value.nix
 checkConfigOutput "\"24\"" config.value ./declare-coerced-value.nix ./define-value-string.nix
-checkConfigError 'The option value .* in .* is not.*string or signed integer.*' config.value ./declare-coerced-value.nix ./define-value-list.nix
+checkConfigError 'The option value .* in .* is not.*string or signed integer convertible to it' config.value ./declare-coerced-value.nix ./define-value-list.nix
+
+# Check coerced value with unsound coercion
+checkConfigOutput "12" config.value ./declare-coerced-value-unsound.nix
+checkConfigError 'The option value .* in .* is not.*8 bit signed integer.* or string convertible to it' config.value ./declare-coerced-value-unsound.nix ./define-value-string-bigint.nix
+checkConfigError 'unrecognised JSON value' config.value ./declare-coerced-value-unsound.nix ./define-value-string-arbitrary.nix
+
+# Check loaOf with long list.
+checkConfigOutput "1 2 3 4 5 6 7 8 9 10" config.result ./loaOf-with-long-list.nix
+
+# Check loaOf with many merges of lists.
+checkConfigOutput "1 2 3 4 5 6 7 8 9 10" config.result ./loaOf-with-many-list-merges.nix

 cat <<EOF
 ====== module tests ======
--- a/lib/tests/modules/declare-coerced-value-unsound.nix
+++ b/lib/tests/modules/declare-coerced-value-unsound.nix
@ -0,0 +1,10 @@
+{ lib, ... }:
+
+{
+  options = {
+    value = lib.mkOption {
+      default = "12";
+      type = lib.types.coercedTo lib.types.str lib.toInt lib.types.ints.s8;
+    };
+  };
+}
--- a/lib/tests/modules/define-value-string-arbitrary.nix
+++ b/lib/tests/modules/define-value-string-arbitrary.nix
@ -0,0 +1,3 @@
+{
+  value = "foobar";
+}
--- a/lib/tests/modules/define-value-string-bigint.nix
+++ b/lib/tests/modules/define-value-string-bigint.nix
@ -0,0 +1,3 @@
+{
+  value = "1000";
+}
--- a/lib/tests/modules/loaOf-with-long-list.nix
+++ b/lib/tests/modules/loaOf-with-long-list.nix
@ -0,0 +1,19 @@
+{ config, lib, ... }:
+
+{
+  options = {
+    loaOfInt = lib.mkOption {
+      type = lib.types.loaOf lib.types.int;
+    };
+
+    result = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = {
+    loaOfInt = [ 1 2 3 4 5 6 7 8 9 10 ];
+
+    result = toString (lib.attrValues config.loaOfInt);
+  };
+}
--- a/lib/tests/modules/loaOf-with-many-list-merges.nix
+++ b/lib/tests/modules/loaOf-with-many-list-merges.nix
@ -0,0 +1,19 @@
+{ config, lib, ... }:
+
+{
+  options = {
+    loaOfInt = lib.mkOption {
+      type = lib.types.loaOf lib.types.int;
+    };
+
+    result = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = {
+    loaOfInt = lib.mkMerge (map lib.singleton [ 1 2 3 4 5 6 7 8 9 10 ]);
+
+    result = toString (lib.attrValues config.loaOfInt);
+  };
+}
--- a/lib/types.nix
+++ b/lib/types.nix
@ -256,7 +256,7 @@ rec {
      functor = (defaultFunctor name) // { wrapped = elemType; };
    };

-    nonEmptyListOf = elemType: 
+    nonEmptyListOf = elemType:
      let list = addCheck (types.listOf elemType) (l: l != []);
      in list // { description = "non-empty " + list.description; };

@ -280,15 +280,26 @@ rec {
    # List or attribute set of ...
    loaOf = elemType:
      let
-        convertIfList = defIdx: def:
+        convertAllLists = defs:
+          let
+            padWidth = stringLength (toString (length defs));
+            unnamedPrefix = i: "unnamed-" + fixedWidthNumber padWidth i + ".";
+          in
+            imap1 (i: convertIfList (unnamedPrefix i)) defs;
+
+        convertIfList = unnamedPrefix: def:
          if isList def.value then
-            { inherit (def) file;
-              value = listToAttrs (
-                imap1 (elemIdx: elem:
-                  { name = elem.name or "unnamed-${toString defIdx}.${toString elemIdx}";
-                    value = elem;
-                  }) def.value);
-            }
+            let
+              padWidth = stringLength (toString (length def.value));
+              unnamed = i: unnamedPrefix + fixedWidthNumber padWidth i;
+            in
+              { inherit (def) file;
+                value = listToAttrs (
+                  imap1 (elemIdx: elem:
+                    { name = elem.name or (unnamed elemIdx);
+                      value = elem;
+                    }) def.value);
+              }
          else
            def;
        listOnly = listOf elemType;
@ -297,7 +308,7 @@ rec {
        name = "loaOf";
        description = "list or attribute set of ${elemType.description}s";
        check = x: isList x || isAttrs x;
-        merge = loc: defs: attrOnly.merge loc (imap1 convertIfList defs);
+        merge = loc: defs: attrOnly.merge loc (convertAllLists defs);
        getSubOptions = prefix: elemType.getSubOptions (prefix ++ ["<name?>"]);
        getSubModules = elemType.getSubModules;
        substSubModules = m: loaOf (elemType.substSubModules m);
@ -419,16 +430,13 @@ rec {
      assert coercedType.getSubModules == null;
      mkOptionType rec {
        name = "coercedTo";
-        description = "${finalType.description} or ${coercedType.description}";
-        check = x: finalType.check x || coercedType.check x;
+        description = "${finalType.description} or ${coercedType.description} convertible to it";
+        check = x: finalType.check x || (coercedType.check x && finalType.check (coerceFunc x));
        merge = loc: defs:
          let
            coerceVal = val:
              if finalType.check val then val
-              else let
-                coerced = coerceFunc val;
-              in assert finalType.check coerced; coerced;
-
+              else coerceFunc val;
          in finalType.merge loc (map (def: def // { value = coerceVal def.value; }) defs);
        getSubOptions = finalType.getSubOptions;
        getSubModules = finalType.getSubModules;
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -998,6 +998,11 @@
    github = "demin-dmitriy";
    name = "Dmitriy Demin";
  };
+  demyanrogozhin = {
+    email = "demyan.rogozhin@gmail.com";
+    github = "demyanrogozhin";
+    name = "Demyan Rogozhin";
+  };
  derchris = {
    email = "derchris@me.com";
    github = "derchrisuk";
@ -1740,6 +1745,11 @@
    github = "jdagilliland";
    name = "Jason Gilliland";
  };
+  jD91mZM2 = {
+    email = "me@krake.one";
+    github = "jD91mZM2";
+    name = "jD91mZM2";
+  };
  jefdaj = {
    email = "jefdaj@gmail.com";
    github = "jefdaj";
@ -1815,6 +1825,11 @@
    github = "joamaki";
    name = "Jussi Maki";
  };
+  joelburget = {
+    email = "joelburget@gmail.com";
+    github = "joelburget";
+    name = "Joel Burget";
+  };
  joelmo = {
    email = "joel.moberg@gmail.com";
    github = "joelmo";
--- a/nixos/doc/manual/release-notes/rl-1809.xml
+++ b/nixos/doc/manual/release-notes/rl-1809.xml
@ -101,6 +101,12 @@ $ nix-instantiate -E '(import &lt;nixpkgsunstable&gt; {}).gitFull'
     that can be mapped onto the YAML configuration defined in <link xlink:href="https://github.com/docker/distribution/blob/v2.6.2/docs/configuration.md">the <varname>docker/distribution</varname> docs</link>.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     <literal>googleearth</literal> has been removed from Nixpkgs. Google does not provide
+     a stable URL for Nixpkgs to use to package this proprietary software.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

@ -169,6 +175,64 @@ $ nix-instantiate -E '(import &lt;nixpkgsunstable&gt; {}).gitFull'
     for further reference.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     The module for <option>security.dhparams</option> has two new options now:
+    </para>
+
+    <variablelist>
+     <varlistentry>
+      <term><option>security.dhparams.stateless</option></term>
+      <listitem><para>
+       Puts the generated Diffie-Hellman parameters into the Nix store instead
+       of managing them in a stateful manner in
+       <filename class="directory">/var/lib/dhparams</filename>.
+      </para></listitem>
+     </varlistentry>
+     <varlistentry>
+      <term><option>security.dhparams.defaultBitSize</option></term>
+      <listitem><para>
+       The default bit size to use for the generated Diffie-Hellman parameters.
+      </para></listitem>
+     </varlistentry>
+    </variablelist>
+
+    <note><para>
+     The path to the actual generated parameter files should now be queried
+     using
+     <literal>config.security.dhparams.params.<replaceable>name</replaceable>.path</literal>
+     because it might be either in the Nix store or in a directory configured
+     by <option>security.dhparams.path</option>.
+    </para></note>
+
+    <note>
+     <title>For developers:</title>
+     <para>
+      Module implementers should not set a specific bit size in order to let
+      users configure it by themselves if they want to have a different bit
+      size than the default (2048).
+     </para>
+     <para>
+      An example usage of this would be:
+<programlisting>
+{ config, ... }:
+
+{
+  security.dhparams.params.myservice = {};
+  environment.etc."myservice.conf".text = ''
+    dhparams = ${config.security.dhparams.params.myservice.path}
+  '';
+}
+</programlisting>
+     </para>
+    </note>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>networking.networkmanager.useDnsmasq</literal> has been deprecated. Use
+     <literal>networking.networkmanager.dns</literal> instead.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>
 </section>
--- a/nixos/lib/make-ext4-fs.nix
+++ b/nixos/lib/make-ext4-fs.nix
@ -14,7 +14,7 @@ in
 pkgs.stdenv.mkDerivation {
  name = "ext4-fs.img";

-  nativeBuildInputs = with pkgs; [e2fsprogs libfaketime perl];
+  nativeBuildInputs = with pkgs; [e2fsprogs.bin libfaketime perl];

  buildCommand =
    ''
@ -83,5 +83,12 @@ pkgs.stdenv.mkDerivation {
        echo "--- Failed to create EXT4 image of $bytes bytes (numInodes=$numInodes, numDataBlocks=$numDataBlocks) ---"
        return 1
      fi
+
+      # I have ended up with corrupted images sometimes, I suspect that happens when the build machine's disk gets full during the build.
+      if ! fsck.ext4 -n -f $out; then
+        echo "--- Fsck failed for EXT4 image of $bytes bytes (numInodes=$numInodes, numDataBlocks=$numDataBlocks) ---"
+        cat errorlog
+        return 1
+      fi
    '';
 }
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@ -1,6 +1,6 @@
 {
-  x86_64-linux = "/nix/store/2gk7rk2sx2dkmsjr59gignrfdmya8f6s-nix-2.0.1";
-  i686-linux = "/nix/store/5160glkphiv13qggnivyidg8r0491pbl-nix-2.0.1";
-  aarch64-linux = "/nix/store/jk29zz3ns9vdkkclcyzzkpzp8dhv1x3i-nix-2.0.1";
-  x86_64-darwin = "/nix/store/4a9czmrpd4hf3r80zcmga2c2lm3hbbvv-nix-2.0.1";
+  x86_64-linux = "/nix/store/z6avpvg24f6d1br2sr6qlphsq3h4d91v-nix-2.0.2";
+  i686-linux = "/nix/store/cdqjyb9srhwkc4gqbknnap7y31lws4yq-nix-2.0.2";
+  aarch64-linux = "/nix/store/fbgaa3fb2am30klwv4lls44njwqh487a-nix-2.0.2";
+  x86_64-darwin = "/nix/store/hs8mxsvdhm95dxgx943d74fws01j2zj3-nix-2.0.2";
 }
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@ -75,20 +75,20 @@ let cfg = config.documentation; in
    (mkIf cfg.man.enable {
      environment.systemPackages = [ pkgs.man-db ];
      environment.pathsToLink = [ "/share/man" ];
-      environment.extraOutputsToInstall = [ "man" ] ++ optional cfg.dev.enable [ "devman" ];
+      environment.extraOutputsToInstall = [ "man" ] ++ optional cfg.dev.enable "devman";
    })

    (mkIf cfg.info.enable {
      environment.systemPackages = [ pkgs.texinfoInteractive ];
      environment.pathsToLink = [ "/share/info" ];
-      environment.extraOutputsToInstall = [ "info" ] ++ optional cfg.dev.enable [ "devinfo" ];
+      environment.extraOutputsToInstall = [ "info" ] ++ optional cfg.dev.enable "devinfo";
    })

    (mkIf cfg.doc.enable {
      # TODO(@oxij): put it here and remove from profiles?
      # environment.systemPackages = [ pkgs.w3m ]; # w3m-nox?
      environment.pathsToLink = [ "/share/doc" ];
-      environment.extraOutputsToInstall = [ "doc" ] ++ optional cfg.dev.enable [ "devdoc" ];
+      environment.extraOutputsToInstall = [ "doc" ] ++ optional cfg.dev.enable "devdoc";
    })

  ]);
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -190,7 +190,7 @@
      cadvisor = 167;
      nylon = 168;
      apache-kafka = 169;
-      panamax = 170;
+      #panamax = 170; # unused
      exim = 172;
      #fleet = 173; # unused
      #input = 174; # unused
@ -306,6 +306,7 @@
      ceph = 288;
      duplicati = 289;
      monetdb = 290;
+      restic = 291;

      # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!

@ -473,9 +474,9 @@
      #chronos = 164; # unused
      gitlab = 165;
      nylon = 168;
-      panamax = 170;
+      #panamax = 170; # unused
      exim = 172;
-      fleet = 173;
+      #fleet = 173; # unused
      input = 174;
      sddm = 175;
      tss = 176;
@ -580,6 +581,7 @@
      ceph = 288;
      duplicati = 289;
      monetdb = 290;
+      restic = 291;

      # When adding a gid, make sure it doesn't match an existing
      # uid. Users and groups with the same name should have equal
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -167,14 +167,13 @@
  ./services/backup/mysql-backup.nix
  ./services/backup/postgresql-backup.nix
  ./services/backup/restic.nix
+  ./services/backup/restic-rest-server.nix
  ./services/backup/rsnapshot.nix
  ./services/backup/tarsnap.nix
  ./services/backup/znapzend.nix
-  ./services/cluster/fleet.nix
  ./services/cluster/kubernetes/default.nix
  ./services/cluster/kubernetes/dns.nix
  ./services/cluster/kubernetes/dashboard.nix
-  ./services/cluster/panamax.nix
  ./services/computing/boinc/client.nix
  ./services/computing/torque/server.nix
  ./services/computing/torque/mom.nix
@ -514,6 +513,7 @@
  ./services/networking/murmur.nix
  ./services/networking/namecoind.nix
  ./services/networking/nat.nix
+  ./services/networking/ndppd.nix
  ./services/networking/networkmanager.nix
  ./services/networking/nftables.nix
  ./services/networking/ngircd.nix
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -17,6 +17,7 @@ with lib;
    (mkRenamedOptionModule [ "networking" "enableIntel2100BGFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
    (mkRenamedOptionModule [ "networking" "enableRalinkFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
    (mkRenamedOptionModule [ "networking" "enableRTL8192cFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
+    (mkRenamedOptionModule [ "networking" "networkmanager" "useDnsmasq" ] [ "networking" "networkmanager" "dns" ])

    (mkRenamedOptionModule [ "services" "cadvisor" "host" ] [ "services" "cadvisor" "listenAddress" ])
    (mkChangedOptionModule [ "services" "printing" "gutenprint" ] [ "services" "printing" "drivers" ]
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@ -257,7 +257,7 @@ in

                    if [ -e /tmp/lastExitCode ] && [ "$(cat /tmp/lastExitCode)" = "0" ]; then
                      ${if data.activationDelay != null then ''
-                      
+
                      ${data.preDelay}

                      if [ -d '${lpath}' ]; then
@ -266,6 +266,10 @@ in
                        systemctl --wait start acme-setlive-${cert}.service
                      fi
                      '' else data.postRun}
+
+                      # noop ensuring that the "if" block is non-empty even if
+                      # activationDelay == null and postRun == ""
+                      true
                    fi
                  '';

@ -294,7 +298,7 @@ in
                        chown '${data.user}:${data.group}' '${cpath}'
                      fi
                  '';
-                  script = 
+                  script =
                    ''
                      workdir="$(mktemp -d)"

--- a/nixos/modules/security/dhparams.nix
+++ b/nixos/modules/security/dhparams.nix
@ -1,107 +1,173 @@
 { config, lib, pkgs, ... }:

-with lib;
 let
+  inherit (lib) mkOption types;
  cfg = config.security.dhparams;
-in
-{
+
+  bitType = types.addCheck types.int (b: b >= 16) // {
+    name = "bits";
+    description = "integer of at least 16 bits";
+  };
+
+  paramsSubmodule = { name, config, ... }: {
+    options.bits = mkOption {
+      type = bitType;
+      default = cfg.defaultBitSize;
+      description = ''
+        The bit size for the prime that is used during a Diffie-Hellman
+        key exchange.
+      '';
+    };
+
+    options.path = mkOption {
+      type = types.path;
+      readOnly = true;
+      description = ''
+        The resulting path of the generated Diffie-Hellman parameters
+        file for other services to reference. This could be either a
+        store path or a file inside the directory specified by
+        <option>security.dhparams.path</option>.
+      '';
+    };
+
+    config.path = let
+      generated = pkgs.runCommand "dhparams-${name}.pem" {
+        nativeBuildInputs = [ pkgs.openssl ];
+      } "openssl dhparam -out \"$out\" ${toString config.bits}";
+    in if cfg.stateful then "${cfg.path}/${name}.pem" else generated;
+  };
+
+in {
  options = {
    security.dhparams = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to generate new DH params and clean up old DH params.
+        '';
+      };
+
      params = mkOption {
-        description =
-          ''
-            Diffie-Hellman parameters to generate.
-
-            The value is the size (in bits) of the DH params to generate. The
-            generated DH params path can be found in
-            <filename><replaceable>security.dhparams.path</replaceable>/<replaceable>name</replaceable>.pem</filename>.
-
-            Note: The name of the DH params is taken as being the name of the
-            service it serves: the params will be generated before the said
-            service is started.
-
-            Warning: If you are removing all dhparams from this list, you have
-            to leave security.dhparams.enable for at least one activation in
-            order to have them be cleaned up. This also means if you rollback to
-            a version without any dhparams the existing ones won't be cleaned
-            up.
-          '';
-        type = with types; attrsOf int;
+        type = with types; let
+          coerce = bits: { inherit bits; };
+        in attrsOf (coercedTo int coerce (submodule paramsSubmodule));
        default = {};
-        example = { nginx = 3072; };
+        example = lib.literalExample "{ nginx.bits = 3072; }";
+        description = ''
+          Diffie-Hellman parameters to generate.
+
+          The value is the size (in bits) of the DH params to generate. The
+          generated DH params path can be found in
+          <literal>config.security.dhparams.params.<replaceable>name</replaceable>.path</literal>.
+
+          <note><para>The name of the DH params is taken as being the name of
+          the service it serves and the params will be generated before the
+          said service is started.</para></note>
+
+          <warning><para>If you are removing all dhparams from this list, you
+          have to leave <option>security.dhparams.enable</option> for at
+          least one activation in order to have them be cleaned up. This also
+          means if you rollback to a version without any dhparams the
+          existing ones won't be cleaned up. Of course this only applies if
+          <option>security.dhparams.stateful</option> is
+          <literal>true</literal>.</para></warning>
+
+          <note><title>For module implementers:</title><para>It's recommended
+          to not set a specific bit size here, so that users can easily
+          override this by setting
+          <option>security.dhparams.defaultBitSize</option>.</para></note>
+        '';
+      };
+
+      stateful = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether generation of Diffie-Hellman parameters should be stateful or
+          not. If this is enabled, PEM-encoded files for Diffie-Hellman
+          parameters are placed in the directory specified by
+          <option>security.dhparams.path</option>. Otherwise the files are
+          created within the Nix store.
+
+          <note><para>If this is <literal>false</literal> the resulting store
+          path will be non-deterministic and will be rebuilt every time the
+          <package>openssl</package> package changes.</para></note>
+        '';
+      };
+
+      defaultBitSize = mkOption {
+        type = bitType;
+        default = 2048;
+        description = ''
+          This allows to override the default bit size for all of the
+          Diffie-Hellman parameters set in
+          <option>security.dhparams.params</option>.
+        '';
      };

      path = mkOption {
-        description =
-          ''
-            Path to the directory in which Diffie-Hellman parameters will be
-            stored.
-          '';
        type = types.str;
        default = "/var/lib/dhparams";
-      };
-
-      enable = mkOption {
-        description =
-          ''
-            Whether to generate new DH params and clean up old DH params.
-          '';
-        default = false;
-        type = types.bool;
+        description = ''
+          Path to the directory in which Diffie-Hellman parameters will be
+          stored. This only is relevant if
+          <option>security.dhparams.stateful</option> is
+          <literal>true</literal>.
+        '';
      };
    };
  };

-  config = mkIf cfg.enable {
+  config = lib.mkIf (cfg.enable && cfg.stateful) {
    systemd.services = {
      dhparams-init = {
-        description = "Cleanup old Diffie-Hellman parameters";
-        wantedBy = [ "multi-user.target" ]; # Clean up even when no DH params is set
-        serviceConfig.Type = "oneshot";
-        script =
-          # Create directory
-          ''
-            if [ ! -d ${cfg.path} ]; then
-              mkdir -p ${cfg.path}
-            fi
-          '' +
-          # Remove old dhparams
-          ''
-            for file in ${cfg.path}/*; do
-              if [ ! -f "$file" ]; then
-                continue
-              fi
-          '' + concatStrings (mapAttrsToList (name: value:
-          ''
-              if [ "$file" == "${cfg.path}/${name}.pem" ] && \
-                  ${pkgs.openssl}/bin/openssl dhparam -in "$file" -text | head -n 1 | grep "(${toString value} bit)" > /dev/null; then
-                continue
-              fi
-          ''
-          ) cfg.params) +
-          ''
-              rm $file
-            done
+        description = "Clean Up Old Diffie-Hellman Parameters";

-            # TODO: Ideally this would be removing the *former* cfg.path, though this
-            # does not seem really important as changes to it are quite unlikely
-            rmdir --ignore-fail-on-non-empty ${cfg.path}
-          '';
-      };
-    } //
-      mapAttrs' (name: value: nameValuePair "dhparams-gen-${name}" {
-        description = "Generate Diffie-Hellman parameters for ${name} if they don't exist yet";
-        after = [ "dhparams-init.service" ];
-        before = [ "${name}.service" ];
+        # Clean up even when no DH params is set
        wantedBy = [ "multi-user.target" ];
+
+        serviceConfig.RemainAfterExit = true;
        serviceConfig.Type = "oneshot";
-        script =
-          ''
+
+        script = ''
+          if [ ! -d ${cfg.path} ]; then
            mkdir -p ${cfg.path}
-            if [ ! -f ${cfg.path}/${name}.pem ]; then
-              ${pkgs.openssl}/bin/openssl dhparam -out ${cfg.path}/${name}.pem ${toString value}
+          fi
+
+          # Remove old dhparams
+          for file in ${cfg.path}/*; do
+            if [ ! -f "$file" ]; then
+              continue
            fi
-          '';
-      }) cfg.params;
+            ${lib.concatStrings (lib.mapAttrsToList (name: { bits, path, ... }: ''
+              if [ "$file" = ${lib.escapeShellArg path} ] && \
+                 ${pkgs.openssl}/bin/openssl dhparam -in "$file" -text \
+                 | head -n 1 | grep "(${toString bits} bit)" > /dev/null; then
+                continue
+              fi
+            '') cfg.params)}
+            rm $file
+          done
+
+          # TODO: Ideally this would be removing the *former* cfg.path, though
+          # this does not seem really important as changes to it are quite
+          # unlikely
+          rmdir --ignore-fail-on-non-empty ${cfg.path}
+        '';
+      };
+    } // lib.mapAttrs' (name: { bits, path, ... }: lib.nameValuePair "dhparams-gen-${name}" {
+      description = "Generate Diffie-Hellman Parameters for ${name}";
+      after = [ "dhparams-init.service" ];
+      before = [ "${name}.service" ];
+      wantedBy = [ "multi-user.target" ];
+      unitConfig.ConditionPathExists = "!${path}";
+      serviceConfig.Type = "oneshot";
+      script = ''
+        mkdir -p ${lib.escapeShellArg cfg.path}
+        ${pkgs.openssl}/bin/openssl dhparam -out ${lib.escapeShellArg path} \
+          ${toString bits}
+      '';
+    }) cfg.params;
  };
 }
--- a/nixos/modules/services/backup/restic-rest-server.nix
+++ b/nixos/modules/services/backup/restic-rest-server.nix
@ -0,0 +1,107 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.restic.server;
+in
+{
+  meta.maintainers = [ maintainers.bachp ];
+
+  options.services.restic.server = {
+    enable = mkEnableOption "Restic REST Server";
+
+    listenAddress = mkOption {
+      default = ":8000";
+      example = "127.0.0.1:8080";
+      type = types.str;
+      description = "Listen on a specific IP address and port.";
+    };
+
+    dataDir = mkOption {
+      default = "/var/lib/restic";
+      type = types.path;
+      description = "The directory for storing the restic repository.";
+    };
+
+    appendOnly = mkOption {
+      default = false;
+      type = types.bool;
+      description = ''
+        Enable append only mode.
+        This mode allows creation of new backups but prevents deletion and modification of existing backups.
+        This can be useful when backing up systems that have a potential of being hacked.
+      '';
+    };
+
+    privateRepos = mkOption {
+      default = false;
+      type = types.bool;
+      description = ''
+        Enable private repos.
+        Grants access only when a subdirectory with the same name as the user is specified in the repository URL.
+      '';
+    };
+
+    prometheus = mkOption {
+      default = false;
+      type = types.bool;
+      description = "Enable Prometheus metrics at /metrics.";
+    };
+
+    extraFlags = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = ''
+        Extra commandline options to pass to Restic REST server.
+      '';
+    };
+
+    package = mkOption {
+      default = pkgs.restic-rest-server;
+      defaultText = "pkgs.restic-rest-server";
+      type = types.package;
+      description = "Restic REST server package to use.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.restic-rest-server = {
+      description = "Restic REST Server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = ''
+          ${cfg.package}/bin/rest-server \
+          --listen ${cfg.listenAddress} \
+          --path ${cfg.dataDir} \
+          ${optionalString cfg.appendOnly "--append-only"} \
+          ${optionalString cfg.privateRepos "--private-repos"} \
+          ${optionalString cfg.prometheus "--prometheus"} \
+          ${escapeShellArgs cfg.extraFlags} \
+        '';
+        Type = "simple";
+        User = "restic";
+        Group = "restic";
+
+        # Security hardening
+        ReadWritePaths = [ cfg.dataDir ];
+        PrivateTmp = true;
+        ProtectSystem = "strict";
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        PrivateDevices = true;
+      };
+    };
+
+    users.extraUsers.restic = {
+      group = "restic";
+      home = cfg.dataDir;
+      createHome = true;
+      uid = config.ids.uids.restic;
+    };
+
+    users.extraGroups.restic.gid = config.ids.uids.restic;
+  };
+}
--- a/nixos/modules/services/cluster/fleet.nix
+++ b/nixos/modules/services/cluster/fleet.nix
@ -1,150 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.fleet;
-
-in {
-
-  ##### Interface
-  options.services.fleet = {
-    enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Whether to enable fleet service.
-      '';
-    };
-
-    listen = mkOption {
-      type = types.listOf types.str;
-      default = [ "/var/run/fleet.sock" ];
-      example = [ "/var/run/fleet.sock" "127.0.0.1:49153" ];
-      description = ''
-        Fleet listening addresses.
-      '';
-    };
-
-    etcdServers = mkOption {
-      type = types.listOf types.str;
-      default = [ "http://127.0.0.1:2379" ];
-      description = ''
-        Fleet list of etcd endpoints to use.
-      '';
-    };
-
-    publicIp = mkOption {
-      type = types.nullOr types.str;
-      default = "";
-      description = ''
-        Fleet IP address that should be published with the local Machine's
-        state and any socket information. If not set, fleetd will attempt
-        to detect the IP it should publish based on the machine's IP
-        routing information.
-      '';
-    };
-
-    etcdCafile = mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      description = ''
-        Fleet TLS ca file when SSL certificate authentication is enabled
-        in etcd endpoints.
-      '';
-    };
-
-    etcdKeyfile = mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      description = ''
-        Fleet TLS key file when SSL certificate authentication is enabled
-        in etcd endpoints.
-      '';
-    };
-
-    etcdCertfile = mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      description = ''
-        Fleet TLS cert file when SSL certificate authentication is enabled
-        in etcd endpoints.
-      '';
-    };
-
-    metadata = mkOption {
-      type = types.attrsOf types.str;
-      default = {};
-      apply = attrs: concatMapStringsSep "," (n: "${n}=${attrs."${n}"}") (attrNames attrs);
-      example = literalExample ''
-        {
-          region = "us-west";
-          az = "us-west-1";
-        }
-      '';
-      description = ''
-        Key/value pairs that are published with the local to the fleet registry.
-        This data can be used directly by a client of fleet to make scheduling decisions.
-      '';
-    };
-
-    extraConfig = mkOption {
-      type = types.attrsOf types.str;
-      apply = mapAttrs' (n: v: nameValuePair ("FLEET_" + n) v);
-      default = {};
-      example = literalExample ''
-        {
-          VERBOSITY = 1;
-          ETCD_REQUEST_TIMEOUT = "2.0";
-          AGENT_TTL = "40s";
-        }
-      '';
-      description = ''
-        Fleet extra config. See
-        <link xlink:href="https://github.com/coreos/fleet/blob/master/Documentation/deployment-and-configuration.md"/>
-        for configuration options.
-      '';
-    };
-
-  };
-
-  ##### Implementation
-  config = mkIf cfg.enable {
-    systemd.services.fleet = {
-      description = "Fleet Init System Daemon";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" "fleet.socket" "etcd.service" "docker.service" ];
-      requires = [ "fleet.socket" ];
-      environment = {
-        FLEET_ETCD_SERVERS = concatStringsSep "," cfg.etcdServers;
-        FLEET_PUBLIC_IP = cfg.publicIp;
-        FLEET_ETCD_CAFILE = cfg.etcdCafile;
-        FLEET_ETCD_KEYFILE = cfg.etcdKeyfile;
-        FLEET_ETCD_CERTFILE = cfg.etcdCertfile;
-        FLEET_METADATA = cfg.metadata;
-      } // cfg.extraConfig;
-      serviceConfig = {
-        ExecStart = "${pkgs.fleet}/bin/fleetd";
-        Group = "fleet";
-      };
-    };
-
-    systemd.sockets.fleet = {
-      description = "Fleet Socket for the API";
-      wantedBy = [ "sockets.target" ];
-      listenStreams = cfg.listen;
-      socketConfig = {
-        ListenStream = "/var/run/fleet.sock";
-        SocketMode = "0660";
-        SocketUser = "root";
-        SocketGroup = "fleet";
-      };
-    };
-
-    services.etcd.enable = mkDefault true;
-    virtualisation.docker.enable = mkDefault true;
-
-    environment.systemPackages = [ pkgs.fleet ];
-    users.extraGroups.fleet.gid = config.ids.gids.fleet;
-  };
-}
--- a/nixos/modules/services/cluster/panamax.nix
+++ b/nixos/modules/services/cluster/panamax.nix
@ -1,156 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.panamax;
-
-  panamax_api = pkgs.panamax_api.override { dataDir = cfg.dataDir + "/api"; };
-  panamax_ui = pkgs.panamax_ui.override { dataDir = cfg.dataDir + "/ui"; };
-
-in {
-
-  ##### Interface
-  options.services.panamax = {
-    enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Whether to enable Panamax service.
-      '';
-    };
-
-    UIPort = mkOption {
-      type = types.int;
-      default = 8888;
-      description = ''
-        Panamax UI listening port.
-      '';
-    };
-
-    APIPort = mkOption {
-      type = types.int;
-      default = 3000;
-      description = ''
-        Panamax UI listening port.
-      '';
-    };
-
-    dataDir = mkOption {
-      type = types.str;
-      default = "/var/lib/panamax";
-      description = ''
-        Data dir for Panamax.
-      '';
-    };
-
-    fleetctlEndpoint = mkOption {
-      type = types.str;
-      default = "http://127.0.0.1:2379";
-      description = ''
-        Panamax fleetctl endpoint.
-      '';
-    };
-
-    journalEndpoint = mkOption {
-      type = types.str;
-      default = "http://127.0.0.1:19531";
-      description = ''
-        Panamax journal endpoint.
-      '';
-    };
-
-    secretKey = mkOption {
-      type = types.str;
-      default = "SomethingVeryLong.";
-      description = ''
-        Panamax secret key (do change this).
-      '';
-    };
-
-  };
-
-  ##### Implementation
-  config = mkIf cfg.enable {
-    systemd.services.panamax-api = {
-      description = "Panamax API";
-
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" "fleet.service" "etcd.service" "docker.service" ];
-
-      path = [ panamax_api ];
-      environment = {
-        RAILS_ENV = "production";
-        JOURNAL_ENDPOINT = cfg.journalEndpoint;
-        FLEETCTL_ENDPOINT = cfg.fleetctlEndpoint;
-        PANAMAX_DATABASE_PATH = "${cfg.dataDir}/api/db/mnt/db.sqlite3";
-      };
-
-      preStart = ''
-        rm -rf ${cfg.dataDir}/state/tmp
-        mkdir -p ${cfg.dataDir}/api/{db/mnt,state/log,state/tmp}
-        ln -sf ${panamax_api}/share/panamax-api/_db/{schema.rb,seeds.rb,migrate} ${cfg.dataDir}/api/db/
-
-        if [ ! -f ${cfg.dataDir}/.created ]; then
-          bundle exec rake db:setup
-          bundle exec rake db:seed
-          bundle exec rake panamax:templates:load || true
-          touch ${cfg.dataDir}/.created
-        else
-          bundle exec rake db:migrate
-        fi
-      '';
-
-      serviceConfig = {
-        ExecStart = "${panamax_api}/bin/bundle exec rails server --binding 127.0.0.1 --port ${toString cfg.APIPort}";
-        User = "panamax";
-        Group = "panamax";
-      };
-    };
-
-    systemd.services.panamax-ui = {
-      description = "Panamax UI";
-
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" "panamax_api.service" ];
-
-      path = [ panamax_ui ];
-      environment = {
-        RAILS_ENV = "production";
-        JOURNAL_ENDPOINT = cfg.journalEndpoint;
-        PMX_API_PORT_3000_TCP_ADDR = "localhost";
-        PMX_API_PORT_3000_TCP_PORT = toString cfg.APIPort;
-        SECRET_KEY_BASE = cfg.secretKey;
-      };
-
-      preStart = ''
-        mkdir -p ${cfg.dataDir}/ui/state/{log,tmp}
-        chown -R panamax:panamax ${cfg.dataDir}
-      '';
-
-      serviceConfig = {
-        ExecStart = "${panamax_ui}/bin/bundle exec rails server --binding 127.0.0.1 --port ${toString cfg.UIPort}";
-        User = "panamax";
-        Group = "panamax";
-        PermissionsStartOnly = true;
-      };
-    };
-
-    users.extraUsers.panamax =
-    { uid = config.ids.uids.panamax;
-      description = "Panamax user";
-      createHome = true;
-      home = cfg.dataDir;
-      extraGroups = [ "docker" ];
-    };
-
-    services.journald.enableHttpGateway = mkDefault true;
-    services.fleet.enable = mkDefault true;
-    services.cadvisor.enable = mkDefault true;
-    services.cadvisor.port = mkDefault 3002;
-    virtualisation.docker.enable = mkDefault true;
-
-    environment.systemPackages = [ panamax_api panamax_ui ];
-    users.extraGroups.panamax.gid = config.ids.gids.panamax;
-  };
-}
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@ -25,6 +25,7 @@ let
      ssl_cert = <${cfg.sslServerCert}
      ssl_key = <${cfg.sslServerKey}
      ${optionalString (!(isNull cfg.sslCACert)) ("ssl_ca = <" + cfg.sslCACert)}
+      ssl_dh = <${config.security.dhparams.path}/dovecot2.pem
      disable_plaintext_auth = yes
    '')

@ -297,10 +298,15 @@ in


  config = mkIf cfg.enable {
-
    security.pam.services.dovecot2 = mkIf cfg.enablePAM {};

-    services.dovecot2.protocols =
+    security.dhparams = mkIf (! isNull cfg.sslServerCert) {
+      enable = true;
+      params = {
+        dovecot2 = 2048;
+      };
+    };
+   services.dovecot2.protocols =
     optional cfg.enableImap "imap"
     ++ optional cfg.enablePop3 "pop3"
     ++ optional cfg.enableLmtp "lmtp";
--- a/nixos/modules/services/misc/matrix-synapse.nix
+++ b/nixos/modules/services/misc/matrix-synapse.nix
@ -395,7 +395,14 @@ in {
      };
      url_preview_ip_range_blacklist = mkOption {
        type = types.listOf types.str;
-        default = [];
+        default = [
+          "127.0.0.0/8"
+          "10.0.0.0/8"
+          "172.16.0.0/12"
+          "192.168.0.0/16"
+          "100.64.0.0/10"
+          "169.254.0.0/16"
+        ];
        description = ''
          List of IP address CIDR ranges that the URL preview spider is denied
          from accessing.
@ -412,14 +419,7 @@ in {
      };
      url_preview_url_blacklist = mkOption {
        type = types.listOf types.str;
-        default = [
-          "127.0.0.0/8"
-          "10.0.0.0/8"
-          "172.16.0.0/12"
-          "192.168.0.0/16"
-          "100.64.0.0/10"
-          "169.254.0.0/16"
-        ];
+        default = [];
        description = ''
          Optional list of URL matches that the URL preview spider is
          denied from accessing.
--- a/nixos/modules/services/networking/firewall.nix
+++ b/nixos/modules/services/networking/firewall.nix
@ -242,6 +242,9 @@ let

    # Don't allow traffic to leak out until the script has completed
    ip46tables -A INPUT -j nixos-drop
+
+    ${cfg.extraStopCommands}
+
    if ${startScript}; then
      ip46tables -D INPUT -j nixos-drop 2>/dev/null || true
    else
--- a/nixos/modules/services/networking/matterbridge.nix
+++ b/nixos/modules/services/networking/matterbridge.nix
@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ options, config, pkgs, lib, ... }:

 with lib;

@ -6,7 +6,11 @@ let

  cfg = config.services.matterbridge;

-  matterbridgeConfToml = pkgs.writeText "matterbridge.toml" (cfg.configFile);
+  matterbridgeConfToml =
+    if cfg.configPath == null then
+      pkgs.writeText "matterbridge.toml" (cfg.configFile)
+    else
+      cfg.configPath;

 in

@ -15,17 +19,32 @@ in
    services.matterbridge = {
      enable = mkEnableOption "Matterbridge chat platform bridge";

+      configPath = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        example = "/etc/nixos/matterbridge.toml";
+        description = ''
+          The path to the matterbridge configuration file.
+        '';
+      };
+
      configFile = mkOption {
        type = types.str;
        example = ''
-          #WARNING: as this file contains credentials, be sure to set correct file permissions          [irc]
+          # WARNING: as this file contains credentials, do not use this option!
+          # It is kept only for backwards compatibility, and would cause your
+          # credentials to be in the nix-store, thus with the world-readable
+          # permission bits.
+          # Use services.matterbridge.configPath instead.
+
+          [irc]
              [irc.freenode]
              Server="irc.freenode.net:6667"
              Nick="matterbot"

          [mattermost]
              [mattermost.work]
-               #do not prefix it wit http:// or https://
+               # Do not prefix it with http:// or https://
               Server="yourmattermostserver.domain"
               Team="yourteam"
               Login="yourlogin"
@ -44,6 +63,10 @@ in
              channel="off-topic"
        '';
        description = ''
+          WARNING: THIS IS INSECURE, as your password will end up in
+          <filename>/nix/store</filename>, thus publicly readable. Use
+          <literal>services.matterbridge.configPath</literal> instead.
+
          The matterbridge configuration file in the TOML file format.
        '';
      };
@ -65,32 +88,31 @@ in
    };
  };

-  config = mkMerge [
-    (mkIf cfg.enable {
+  config = mkIf cfg.enable {
+    warnings = optional options.services.matterbridge.configFile.isDefined
+      "The option services.matterbridge.configFile is insecure and should be replaced with services.matterbridge.configPath";

-      users.extraUsers = mkIf (cfg.user == "matterbridge") [
-        { name = "matterbridge";
-          group = "matterbridge";
-        } ];
-
-      users.extraGroups = mkIf (cfg.group == "matterbridge") [
-        { name = "matterbridge";
-        } ];
-
-      systemd.services.matterbridge = {
-        description = "Matterbridge chat platform bridge";
-        wantedBy = [ "multi-user.target" ];
-        after = [ "network.target" ];
-
-        serviceConfig = {
-          User = cfg.user;
-          Group = cfg.group;
-          ExecStart = "${pkgs.matterbridge.bin}/bin/matterbridge -conf ${matterbridgeConfToml}";
-          Restart = "always";
-          RestartSec = "10";
-        };
+    users.extraUsers = optional (cfg.user == "matterbridge")
+      { name = "matterbridge";
+        group = "matterbridge";
      };
-    })
-  ];
-}

+    users.extraGroups = optional (cfg.group == "matterbridge")
+      { name = "matterbridge";
+      };
+
+    systemd.services.matterbridge = {
+      description = "Matterbridge chat platform bridge";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = "${pkgs.matterbridge.bin}/bin/matterbridge -conf ${matterbridgeConfToml}";
+        Restart = "always";
+        RestartSec = "10";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/networking/minidlna.nix
+++ b/nixos/modules/services/networking/minidlna.nix
@ -1,23 +1,16 @@
 # Module for MiniDLNA, a simple DLNA server.
-
 { config, lib, pkgs, ... }:

 with lib;

 let
-
  cfg = config.services.minidlna;
-
  port = 8200;
-
 in

 {
-
  ###### interface
-
  options = {
-
    services.minidlna.enable = mkOption {
      type = types.bool;
      default = false;
@ -43,24 +36,48 @@ in
        '';
    };

+    services.minidlna.loglevel = mkOption {
+      type = types.str;
+      default = "warn";
+      example = "general,artwork,database,inotify,scanner,metadata,http,ssdp,tivo=warn";
+      description =
+        ''
+          Defines the type of messages that should be logged, and down to
+          which level of importance they should be considered.
+
+          The possible types are “artwork”, “database”, “general”, “http”,
+          “inotify”, “metadata”, “scanner”, “ssdp” and “tivo”.
+
+          The levels are “off”, “fatal”, “error”, “warn”, “info” and
+          “debug”, listed here in order of decreasing importance.  “off”
+          turns off logging messages entirely, “fatal” logs the most
+          critical messages only, and so on down to “debug” that logs every
+          single messages.
+
+          The types are comma-separated, followed by an equal sign (‘=’),
+          followed by a level that applies to the preceding types. This can
+          be repeated, separating each of these constructs with a comma.
+
+          Defaults to “general,artwork,database,inotify,scanner,metadata,
+          http,ssdp,tivo=warn” which logs every type of message at the
+          “warn” level.
+        '';
+    };
+
    services.minidlna.config = mkOption {
      type = types.lines;
      description = "The contents of MiniDLNA's configuration file.";
    };
-
  };

-
  ###### implementation
-
  config = mkIf cfg.enable {
-
    services.minidlna.config =
      ''
        port=${toString port}
        friendly_name=${config.networking.hostName} MiniDLNA
        db_dir=/var/cache/minidlna
-        log_level=warn
+        log_level=${cfg.loglevel}
        inotify=yes
        ${concatMapStrings (dir: ''
          media_dir=${dir}
@ -98,7 +115,5 @@ in
              " -f ${pkgs.writeText "minidlna.conf" cfg.config}";
          };
      };
-
  };
-
 }
--- a/nixos/modules/services/networking/ndppd.nix
+++ b/nixos/modules/services/networking/ndppd.nix
@ -0,0 +1,47 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.ndppd;
+
+  configFile = pkgs.runCommand "ndppd.conf" {} ''
+    substitute ${pkgs.ndppd}/etc/ndppd.conf $out \
+      --replace eth0 ${cfg.interface} \
+      --replace 1111:: ${cfg.network}
+  '';
+in {
+  options = {
+    services.ndppd = {
+      enable = mkEnableOption "daemon that proxies NDP (Neighbor Discovery Protocol) messages between interfaces";
+      interface = mkOption {
+        type = types.string;
+        default = "eth0";
+        example = "ens3";
+        description = "Interface which is on link-level with router.";
+      };
+      network = mkOption {
+        type = types.string;
+        default = "1111::";
+        example = "2001:DB8::/32";
+        description = "Network that we proxy.";
+      };
+      configFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = "Path to configuration file.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.packages = [ pkgs.ndppd ];
+    environment.etc."ndppd.conf".source = if (cfg.configFile != null) then cfg.configFile else configFile;
+    systemd.services.ndppd = {
+      serviceConfig.RuntimeDirectory = [ "ndppd" ];
+      wantedBy = [ "multi-user.target" ];
+    };
+  };
+
+  meta.maintainers = with maintainers; [ gnidorah ];
+}
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@ -10,7 +10,8 @@ let
  stateDirs = "/var/lib/NetworkManager /var/lib/dhclient /var/lib/misc";

  dns =
-    if cfg.useDnsmasq then "dnsmasq"
+    if cfg.dns == "none" then "none"
+    else if cfg.dns == "dnsmasq" then "dnsmasq"
    else if config.services.resolved.enable then "systemd-resolved"
    else if config.services.unbound.enable then "unbound"
    else "default";
@ -205,14 +206,20 @@ in {
        };
      };

-      useDnsmasq = mkOption {
-        type = types.bool;
-        default = false;
+      dns = mkOption {
+        type = types.enum [ "auto" "dnsmasq" "none" ];
+        default = "auto";
        description = ''
-          Enable NetworkManager's dnsmasq integration. NetworkManager will run
-          dnsmasq as a local caching nameserver, using a "split DNS"
-          configuration if you are connected to a VPN, and then update
-          resolv.conf to point to the local nameserver.
+          Options:
+            - auto: Check for systemd-resolved, unbound, or use default.
+            - dnsmasq:
+              Enable NetworkManager's dnsmasq integration. NetworkManager will run
+              dnsmasq as a local caching nameserver, using a "split DNS"
+              configuration if you are connected to a VPN, and then update
+              resolv.conf to point to the local nameserver.
+            - none:
+              Disable NetworkManager's DNS integration completely.
+              It will not touch your /etc/resolv.conf.
        '';
      };

--- a/nixos/modules/services/networking/nsd.nix
+++ b/nixos/modules/services/networking/nsd.nix
@ -20,6 +20,7 @@ let
    zoneStats = length (collect (x: (x.zoneStats or null) != null) cfg.zones) > 0;
  };

+  mkZoneFileName = name: if name == "." then "root" else name;

  nsdEnv = pkgs.buildEnv {
    name = "nsd-env";
@ -50,8 +51,9 @@ let
  };

  writeZoneData = name: text: pkgs.writeTextFile {
-    inherit name text;
-    destination = "/zones/${name}";
+    name = "nsd-zone-${mkZoneFileName name}";
+    inherit text;
+    destination = "/zones/${mkZoneFileName name}";
  };


@ -146,7 +148,7 @@ let
  zoneConfigFile = name: zone: ''
    zone:
      name:         "${name}"
-      zonefile:     "${stateDir}/zones/${name}"
+      zonefile:     "${stateDir}/zones/${mkZoneFileName name}"
      ${maybeString "outgoing-interface: " zone.outgoingInterface}
    ${forEach     "  rrl-whitelist: "      zone.rrlWhitelist}
      ${maybeString "zonestats: "          zone.zoneStats}
@ -887,6 +889,12 @@ in

  config = mkIf cfg.enable {

+    assertions = singleton {
+      assertion = zoneConfigs ? "." -> cfg.rootServer;
+      message = "You have a root zone configured. If this is really what you "
+              + "want, please enable 'services.nsd.rootServer'.";
+    };
+
    environment.systemPackages = [ nsdPkg ];

    users.extraGroups = singleton {
--- a/nixos/modules/services/security/sshguard.nix
+++ b/nixos/modules/services/security/sshguard.nix
@ -133,6 +133,7 @@ in {
            ReadOnlyDirectories = "/";
            ReadWriteDirectories = "/run/sshguard /var/lib/sshguard";
            RuntimeDirectory = "sshguard";
+            StateDirectory = "sshguard";
            CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW";
         };
      };
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -38,6 +38,7 @@ let
      ${toString (flip mapAttrsToList upstream.servers (name: server: ''
        server ${name} ${optionalString server.backup "backup"};
      ''))}
+      ${upstream.extraConfig}
    }
  ''));

@ -492,6 +493,13 @@ in
              '';
              default = {};
            };
+            extraConfig = mkOption {
+              type = types.lines;
+              default = "";
+              description = ''
+                These lines go to the end of the upstream verbatim.
+              '';
+            };
          };
        });
        description = ''
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@ -4,6 +4,7 @@ use strict;
 use warnings;
 use File::Basename;
 use File::Slurp;
+use Net::DBus;
 use Sys::Syslog qw(:standard :macros);
 use Cwd 'abs_path';

@ -67,17 +68,15 @@ EOF
 $SIG{PIPE} = "IGNORE";

 sub getActiveUnits {
-    # FIXME: use D-Bus or whatever to query this, since parsing the
-    # output of list-units is likely to break.
-    # Use current version of systemctl binary before daemon is reexeced.
-    my $lines = `LANG= /run/current-system/sw/bin/systemctl list-units --full --no-legend`;
+    my $mgr = Net::DBus->system->get_service("org.freedesktop.systemd1")->get_object("/org/freedesktop/systemd1");
+    my $units = $mgr->ListUnitsByPatterns([], []);
    my $res = {};
-    foreach my $line (split '\n', $lines) {
-        chomp $line;
-        last if $line eq "";
-        $line =~ /^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s/ or next;
-        next if $1 eq "UNIT";
-        $res->{$1} = { load => $2, state => $3, substate => $4 };
+    for my $item (@$units) {
+        my ($id, $description, $load_state, $active_state, $sub_state,
+            $following, $unit_path, $job_id, $job_type, $job_path) = @$item;
+        next unless $following eq '';
+        next if $job_id == 0 and $active_state eq 'inactive';
+        $res->{$id} = { load => $load_state, state => $active_state, substate => $sub_state };
    }
    return $res;
 }
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@ -127,7 +127,8 @@ let
      configurationName = config.boot.loader.grub.configurationName;

      # Needed by switch-to-configuration.
-      perl = "${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl";
+
+      perl = "${pkgs.perl}/bin/perl " + (concatMapStringsSep " " (lib: "-I${lib}/${pkgs.perl.libPrefix}") (with pkgs.perlPackages; [ FileSlurp NetDBus XMLParser XMLTwig ]));
  } else throw "\nFailed assertions:\n${concatStringsSep "\n" (map (x: "- ${x}") failed)}");

  # Replace runtime dependencies
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -23,9 +23,12 @@ let

  cfg = config.virtualisation;

-  qemuGraphics = if cfg.graphics then "" else "-nographic";
-  kernelConsole = if cfg.graphics then "" else "console=${qemuSerialDevice}";
-  ttys = [ "tty1" "tty2" "tty3" "tty4" "tty5" "tty6" ];
+  qemuGraphics = lib.optionalString (!cfg.graphics) "-nographic";
+
+  # enable both serial console and tty0. select preferred console (last one) based on cfg.graphics
+  kernelConsoles = let
+    consoles = [ "console=${qemuSerialDevice},115200n8" "console=tty0" ];
+    in lib.concatStringsSep " " (if cfg.graphics then consoles else reverseList consoles);

  # XXX: This is very ugly and in the future we really should use attribute
  # sets to build ALL of the QEMU flags instead of this mixed mess of Nix
@ -108,7 +111,7 @@ let
            ${mkDiskIfaceDriveFlag "0" "file=$NIX_DISK_IMAGE,cache=writeback,werror=report"} \
            -kernel ${config.system.build.toplevel}/kernel \
            -initrd ${config.system.build.toplevel}/initrd \
-            -append "$(cat ${config.system.build.toplevel}/kernel-params) init=${config.system.build.toplevel}/init regInfo=${regInfo}/registration ${kernelConsole} $QEMU_KERNEL_PARAMS" \
+            -append "$(cat ${config.system.build.toplevel}/kernel-params) init=${config.system.build.toplevel}/init regInfo=${regInfo}/registration ${kernelConsoles} $QEMU_KERNEL_PARAMS" \
          ''} \
          $extraDisks \
          ${qemuGraphics} \
@ -248,9 +251,10 @@ in
        default = true;
        description =
          ''
-            Whether to run QEMU with a graphics window, or access
-            the guest computer serial port through the host tty.
-          '';
+            Whether to run QEMU with a graphics window, or in nographic mode.
+            Serial console will be enabled on both settings, but this will
+            change the preferred console.
+            '';
      };

    virtualisation.cores =
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -269,6 +269,7 @@ in rec {
  tests.containers-macvlans = callTest tests/containers-macvlans.nix {};
  tests.couchdb = callTest tests/couchdb.nix {};
  tests.deluge = callTest tests/deluge.nix {};
+  tests.dhparams = callTest tests/dhparams.nix {};
  tests.docker = callTestOnMatchingSystems ["x86_64-linux"] tests/docker.nix {};
  tests.docker-tools = callTestOnMatchingSystems ["x86_64-linux"] tests/docker-tools.nix {};
  tests.docker-tools-overlay = callTestOnMatchingSystems ["x86_64-linux"] tests/docker-tools-overlay.nix {};
@ -284,7 +285,6 @@ in rec {
  tests.ferm = callTest tests/ferm.nix {};
  tests.firefox = callTest tests/firefox.nix {};
  tests.firewall = callTest tests/firewall.nix {};
-  tests.fleet = callTestOnMatchingSystems ["x86_64-linux"] tests/fleet.nix {};
  tests.fwupd = callTest tests/fwupd.nix {};
  tests.gdk-pixbuf = callTest tests/gdk-pixbuf.nix {};
  #tests.gitlab = callTest tests/gitlab.nix {};
@ -361,7 +361,6 @@ in rec {
  tests.openldap = callTest tests/openldap.nix {};
  tests.owncloud = callTest tests/owncloud.nix {};
  tests.pam-oath-login = callTest tests/pam-oath-login.nix {};
-  #tests.panamax = callTestOnMatchingSystems ["x86_64-linux"] tests/panamax.nix {};
  tests.peerflix = callTest tests/peerflix.nix {};
  tests.php-pcre = callTest tests/php-pcre.nix {};
  tests.postgresql = callSubTests tests/postgresql.nix {};
--- a/nixos/tests/dhparams.nix
+++ b/nixos/tests/dhparams.nix
@ -0,0 +1,144 @@
+let
+  common = { pkgs, ... }: {
+    security.dhparams.enable = true;
+    environment.systemPackages = [ pkgs.openssl ];
+  };
+
+in import ./make-test.nix {
+  name = "dhparams";
+
+  nodes.generation1 = { pkgs, config, ... }: {
+    imports = [ common ];
+    security.dhparams.params = {
+      # Use low values here because we don't want the test to run for ages.
+      foo.bits = 16;
+      # Also use the old format to make sure the type is coerced in the right
+      # way.
+      bar = 17;
+    };
+
+    systemd.services.foo = {
+      description = "Check systemd Ordering";
+      wantedBy = [ "multi-user.target" ];
+      unitConfig = {
+        # This is to make sure that the dhparams generation of foo occurs
+        # before this service so we need this service to start as early as
+        # possible to provoke a race condition.
+        DefaultDependencies = false;
+
+        # We check later whether the service has been started or not.
+        ConditionPathExists = config.security.dhparams.params.foo.path;
+      };
+      serviceConfig.Type = "oneshot";
+      serviceConfig.RemainAfterExit = true;
+      # The reason we only provide an ExecStop here is to ensure that we don't
+      # accidentally trigger an error because a file system is not yet ready
+      # during very early startup (we might not even have the Nix store
+      # available, for example if future changes in NixOS use systemd mount
+      # units to do early file system initialisation).
+      serviceConfig.ExecStop = "${pkgs.coreutils}/bin/true";
+    };
+  };
+
+  nodes.generation2 = {
+    imports = [ common ];
+    security.dhparams.params.foo.bits = 18;
+  };
+
+  nodes.generation3 = common;
+
+  nodes.generation4 = {
+    imports = [ common ];
+    security.dhparams.stateful = false;
+    security.dhparams.params.foo2.bits = 18;
+    security.dhparams.params.bar2.bits = 19;
+  };
+
+  nodes.generation5 = {
+    imports = [ common ];
+    security.dhparams.defaultBitSize = 30;
+    security.dhparams.params.foo3 = {};
+    security.dhparams.params.bar3 = {};
+  };
+
+  testScript = { nodes, ... }: let
+    getParamPath = gen: name: let
+      node = "generation${toString gen}";
+    in nodes.${node}.config.security.dhparams.params.${name}.path;
+
+    assertParamBits = gen: name: bits: let
+      path = getParamPath gen name;
+    in ''
+      $machine->nest('check bit size of ${path}', sub {
+        my $out = $machine->succeed('openssl dhparam -in ${path} -text');
+        $out =~ /^\s*DH Parameters:\s+\((\d+)\s+bit\)\s*$/m;
+        die "bit size should be ${toString bits} but it is $1 instead."
+          if $1 != ${toString bits};
+      });
+    '';
+
+    switchToGeneration = gen: let
+      node = "generation${toString gen}";
+      inherit (nodes.${node}.config.system.build) toplevel;
+      switchCmd = "${toplevel}/bin/switch-to-configuration test";
+    in ''
+      $machine->nest('switch to generation ${toString gen}', sub {
+        $machine->succeed('${switchCmd}');
+        $main::machine = ''$${node};
+      });
+    '';
+
+  in ''
+    my $machine = $generation1;
+
+    $machine->waitForUnit('multi-user.target');
+
+    subtest "verify startup order", sub {
+      $machine->succeed('systemctl is-active foo.service');
+    };
+
+    subtest "check bit sizes of dhparam files", sub {
+      ${assertParamBits 1 "foo" 16}
+      ${assertParamBits 1 "bar" 17}
+    };
+
+    ${switchToGeneration 2}
+
+    subtest "check whether bit size has changed", sub {
+      ${assertParamBits 2 "foo" 18}
+    };
+
+    subtest "ensure that dhparams file for 'bar' was deleted", sub {
+      $machine->fail('test -e ${getParamPath 1 "bar"}');
+    };
+
+    ${switchToGeneration 3}
+
+    subtest "ensure that 'security.dhparams.path' has been deleted", sub {
+      $machine->fail(
+        'test -e ${nodes.generation3.config.security.dhparams.path}'
+      );
+    };
+
+    ${switchToGeneration 4}
+
+    subtest "check bit sizes dhparam files", sub {
+      ${assertParamBits 4 "foo2" 18}
+      ${assertParamBits 4 "bar2" 19}
+    };
+
+    subtest "check whether dhparam files are in the Nix store", sub {
+      $machine->succeed(
+        'expr match ${getParamPath 4 "foo2"} ${builtins.storeDir}',
+        'expr match ${getParamPath 4 "bar2"} ${builtins.storeDir}',
+      );
+    };
+
+    ${switchToGeneration 5}
+
+    subtest "check whether defaultBitSize works as intended", sub {
+      ${assertParamBits 5 "foo3" 30}
+      ${assertParamBits 5 "bar3" 30}
+    };
+  '';
+}
--- a/nixos/tests/fleet.nix
+++ b/nixos/tests/fleet.nix
@ -1,76 +0,0 @@
-import ./make-test.nix ({ pkgs, ...} : rec {
-  name = "simple";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ offline ];
-  };
-
-  nodes = {
-    node1 =
-      { config, pkgs, ... }:
-        {
-          services = {
-            etcd = {
-              enable = true;
-              listenPeerUrls = ["http://0.0.0.0:7001"];
-              initialAdvertisePeerUrls = ["http://node1:7001"];
-              initialCluster = ["node1=http://node1:7001" "node2=http://node2:7001"];
-            };
-         };
-
-          services.fleet = {
-            enable = true;
-            metadata.name = "node1";
-          };
-
-          networking.firewall.allowedTCPPorts = [ 7001 ];
-        };
-
-    node2 =
-      { config, pkgs, ... }:
-        {
-          services = {
-            etcd = {
-              enable = true;
-              listenPeerUrls = ["http://0.0.0.0:7001"];
-              initialAdvertisePeerUrls = ["http://node2:7001"];
-              initialCluster = ["node1=http://node1:7001" "node2=http://node2:7001"];
-            };
-           };
-
-          services.fleet = {
-            enable = true;
-            metadata.name = "node2";
-          };
-
-          networking.firewall.allowedTCPPorts = [ 7001 ];
-        };
-  };
-
-  service = builtins.toFile "hello.service" ''
-    [Unit]
-    Description=Hello World
-
-    [Service]
-    ExecStart=/bin/sh -c "while true; do echo \"Hello, world\"; /var/run/current-system/sw/bin/sleep 1; done"
-
-    [X-Fleet]
-    MachineMetadata=name=node2
-  '';
-
-  testScript =
-    ''
-      startAll;
-      $node1->waitForUnit("fleet.service");
-      $node2->waitForUnit("fleet.service");
-
-      $node2->waitUntilSucceeds("fleetctl list-machines | grep node1");
-      $node1->waitUntilSucceeds("fleetctl list-machines | grep node2");
-
-      $node1->succeed("cp ${service} hello.service && fleetctl submit hello.service");
-      $node1->succeed("fleetctl list-unit-files | grep hello");
-      $node1->succeed("fleetctl start hello.service");
-      $node1->waitUntilSucceeds("fleetctl list-units | grep running");
-      $node1->succeed("fleetctl stop hello.service");
-      $node1->succeed("fleetctl destroy hello.service");
-    '';
-})
--- a/nixos/tests/nsd.nix
+++ b/nixos/tests/nsd.nix
@ -41,6 +41,7 @@ in import ./make-test.nix ({ pkgs, ...} : {
        { address = "dead:beef::1"; prefixLength = 64; }
      ];
      services.nsd.enable = true;
+      services.nsd.rootServer = true;
      services.nsd.interfaces = lib.mkForce [];
      services.nsd.zones."example.com.".data = ''
        @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
@ -55,6 +56,11 @@ in import ./make-test.nix ({ pkgs, ...} : {
        @ A 9.8.7.6
        @ AAAA fedc::bbaa
      '';
+      services.nsd.zones.".".data = ''
+        @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
+        root A 1.8.7.4
+        root AAAA acbd::4
+      '';
    };
  };

@ -86,6 +92,9 @@ in import ./make-test.nix ({ pkgs, ...} : {

        assertHost($_, "a", "deleg.example.com", qr/address 9.8.7.6$/);
        assertHost($_, "aaaa", "deleg.example.com", qr/address fedc::bbaa$/);
+
+        assertHost($_, "a", "root", qr/address 1.8.7.4$/);
+        assertHost($_, "aaaa", "root", qr/address acbd::4$/);
      };
    }
  '';
--- a/nixos/tests/panamax.nix
+++ b/nixos/tests/panamax.nix
@ -1,21 +0,0 @@
-import ./make-test.nix ({ pkgs, ...} : {
-  name = "panamax";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ offline ];
-  };
-
-  machine = { config, pkgs, ... }: {
-    services.panamax.enable = true;
-  };
-
-  testScript =
-    ''
-      startAll;
-      $machine->waitForUnit("panamax-api.service");
-      $machine->waitForUnit("panamax-ui.service");
-      $machine->waitForOpenPort(3000);
-      $machine->waitForOpenPort(8888);
-      $machine->succeed("curl --fail http://localhost:8888/ > /dev/null");
-      $machine->shutdown;
-    '';
-})
--- a/pkgs/applications/altcoins/bitcoin-abc.nix
+++ b/pkgs/applications/altcoins/bitcoin-abc.nix
@ -7,13 +7,13 @@ with stdenv.lib;
 stdenv.mkDerivation rec {

  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-abc-" + version;
-  version = "0.17.0";
+  version = "0.17.1";

  src = fetchFromGitHub {
    owner = "bitcoin-ABC";
    repo = "bitcoin-abc";
    rev = "v${version}";
-    sha256 = "1s2y29h2q4fnbrfg2ig1cd3h7g3kdcdyrfq7znq1ndnh8xj1j489";
+    sha256 = "1kq9n3s9vhkmfaizsyi2cb91ibi06gb6wx0hkcb9hg3nrrvcka3y";
  };

  patches = [ ./fix-bitcoin-qt-build.patch ];
--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@ -86,4 +86,7 @@ rec {

  parity = callPackage ./parity { };
  parity-beta = callPackage ./parity/beta.nix { };
+  parity-ui = callPackage ./parity-ui { };
+
+  particl-core = callPackage ./particl/particl-core.nix { boost = boost165; miniupnpc = miniupnpc_2; withGui = false; };
 }
--- a/pkgs/applications/altcoins/nano-wallet/CMakeLists.txt.patch
+++ b/pkgs/applications/altcoins/nano-wallet/CMakeLists.txt.patch
@ -0,0 +1,13 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index b43f02f6..4470abbf 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -119,7 +119,7 @@ endif (RAIBLOCKS_SECURE_RPC)
+ 
+ include_directories (${CMAKE_SOURCE_DIR})
+ 
+-set(Boost_USE_STATIC_LIBS        ON)
+add_definitions(-DBOOST_LOG_DYN_LINK)
+ set(Boost_USE_MULTITHREADED      ON)
+ 
+ if (BOOST_CUSTOM)
--- a/pkgs/applications/altcoins/nano-wallet/default.nix
+++ b/pkgs/applications/altcoins/nano-wallet/default.nix
@ -0,0 +1,57 @@
+{lib, pkgs, stdenv, fetchFromGitHub, cmake, pkgconfig, boost, libGL, qtbase}:
+
+stdenv.mkDerivation rec {
+
+  name = "nano-wallet-${version}";
+  version = "12.1";
+
+  src = fetchFromGitHub {
+    owner = "nanocurrency";
+    repo = "raiblocks";
+    rev = "V${version}";
+    sha256 = "10ng7qn6y31s2bjahmpivw2plx90ljjjzb87j3l7zmppsjd2iq03";
+    fetchSubmodules = true;
+  };
+
+  # Use a patch to force dynamic linking
+  patches = [
+    ./CMakeLists.txt.patch
+  ];
+
+  cmakeFlags = let
+    options = {
+      BOOST_ROOT = "${boost}";
+      Boost_USE_STATIC_LIBS = "OFF";
+      RAIBLOCKS_GUI = "ON";
+      RAIBLOCKS_TEST = "ON";
+      Qt5_DIR = "${qtbase.dev}/lib/cmake/Qt5";
+      Qt5Core_DIR = "${qtbase.dev}/lib/cmake/Qt5Core";
+      Qt5Gui_INCLUDE_DIRS = "${qtbase.dev}/include/QtGui";
+      Qt5Widgets_INCLUDE_DIRS = "${qtbase.dev}/include/QtWidgets";
+    };
+    optionToFlag = name: value: "-D${name}=${value}";
+  in lib.mapAttrsToList optionToFlag options;
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ boost libGL qtbase ];
+
+  buildPhase = ''
+    make nano_wallet
+  '';
+
+  checkPhase = ''
+    ./core_test
+  '';
+
+  meta = {
+    inherit version;
+    description = "Wallet for Nano cryptocurrency";
+    homepage = https://nano.org/en/wallet/;
+    license = lib.licenses.bsd2;
+    # Fails on Darwin. See:
+    # https://github.com/NixOS/nixpkgs/pull/39295#issuecomment-386800962
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ jluttine ];
+  };
+
+}
--- a/pkgs/applications/altcoins/parity-ui/default.nix
+++ b/pkgs/applications/altcoins/parity-ui/default.nix
@ -0,0 +1,50 @@
+{ stdenv, pkgs, fetchurl, lib, makeWrapper, nodePackages }:
+
+let
+
+uiEnv = pkgs.callPackage ./env.nix { };
+
+in stdenv.mkDerivation rec {
+  name = "parity-ui-${version}";
+  version = "0.1.1";
+
+  src = fetchurl {
+    url = "https://github.com/parity-js/shell/releases/download/v${version}/parity-ui_${version}_amd64.deb";
+    sha256 = "1jym6q63m5f4xm06dxiiabhbqnr0hysf2d3swysncs5hg6w00lh3";
+    name = "${name}.deb";
+  };
+
+  nativeBuildInputs = [ makeWrapper nodePackages.asar ];
+
+  buildCommand = ''
+    mkdir -p $out/usr/
+    ar p $src data.tar.xz | tar -C $out -xJ .
+    substituteInPlace $out/usr/share/applications/parity-ui.desktop \
+      --replace "/opt/Parity UI" $out/bin
+    mv $out/usr/* $out/
+    mv "$out/opt/Parity UI" $out/share/parity-ui
+    rm -r $out/usr/
+    rm -r $out/opt/
+
+    fixupPhase
+
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${uiEnv.libPath}:$out/share/parity-ui" \
+      $out/share/parity-ui/parity-ui
+
+    find $out/share/parity-ui -name "*.node" -exec patchelf --set-rpath "${uiEnv.libPath}:$out/share/parity-ui" {} \;
+
+    paxmark m $out/share/parity-ui/parity-ui
+
+    mkdir -p $out/bin
+    ln -s $out/share/parity-ui/parity-ui $out/bin/parity-ui
+  '';
+
+  meta = with stdenv.lib; {
+    description = "UI for Parity. Fast, light, robust Ethereum implementation";
+    homepage = http://parity.io;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.sorpaas ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/altcoins/parity-ui/env.nix
+++ b/pkgs/applications/altcoins/parity-ui/env.nix
@ -0,0 +1,19 @@
+{ stdenv, lib, zlib, glib, alsaLib, dbus, gtk2, atk, pango, freetype, fontconfig
+, libgnome-keyring3, gdk_pixbuf, gvfs, cairo, cups, expat, libgpgerror, nspr
+, nss, xorg, libcap, systemd, libnotify, libsecret, gnome3 }:
+
+let
+  packages = [
+    stdenv.cc.cc zlib glib dbus gtk2 atk pango freetype libgnome-keyring3
+    fontconfig gdk_pixbuf cairo cups expat libgpgerror alsaLib nspr nss
+    xorg.libXrender xorg.libX11 xorg.libXext xorg.libXdamage xorg.libXtst
+    xorg.libXcomposite xorg.libXi xorg.libXfixes xorg.libXrandr
+    xorg.libXcursor xorg.libxkbfile xorg.libXScrnSaver libcap systemd libnotify
+    xorg.libxcb libsecret gnome3.gconf
+  ];
+
+  libPathNative = lib.makeLibraryPath packages;
+  libPath64 = lib.makeSearchPathOutput "lib" "lib64" packages;
+  libPath = "${libPathNative}:${libPath64}";
+
+in { inherit packages libPath; }
--- a/pkgs/applications/altcoins/particl/particl-core.nix
+++ b/pkgs/applications/altcoins/particl/particl-core.nix
@ -0,0 +1,47 @@
+{ stdenv
+, autoreconfHook
+, boost
+, db48
+, fetchurl
+, libevent
+, libtool
+, miniupnpc
+, openssl
+, pkgconfig
+, utillinux
+, zeromq
+, zlib
+, withGui
+, unixtools
+}:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+  name = "particl-core-${version}";
+  version     = "0.16.0.4";
+
+  src = fetchurl {
+    url = "https://github.com/particl/particl-core/archive/v${version}.tar.gz";
+    sha256 = "1yy8pw13rn821jpi1zvzwi3ipxi1bgfxv8g6jz49qlbjzjmjcr68";
+  };
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  buildInputs = [
+    openssl db48 boost zlib miniupnpc libevent zeromq
+    unixtools.hexdump
+  ];
+
+  configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ];
+
+  meta = {
+    description = "Privacy-Focused Marketplace & Decentralized Application Platform";
+    longDescription= ''
+      An open source, decentralized privacy platform built for global person to person eCommerce.
+    '';
+    homepage = https://particl.io/;
+    maintainers = with maintainers; [ demyanrogozhin ];
+    license = licenses.mit;
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/audio/mopidy/iris.nix
+++ b/pkgs/applications/audio/mopidy/iris.nix
@ -2,11 +2,11 @@

 pythonPackages.buildPythonApplication rec {
  pname = "Mopidy-Iris";
-  version = "3.17.1";
+  version = "3.17.5";

  src = pythonPackages.fetchPypi {
    inherit pname version;
-    sha256 = "02k1br077v9c5x6nn0391vh28pvn1zjbkjv8h508vy7k6ch2xjyq";
+    sha256 = "011bccvjy1rdrc43576hgfb7md404ziqmkam6na2z6v9km1b9gwr";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/audio/snd/default.nix
+++ b/pkgs/applications/audio/snd/default.nix
@ -4,11 +4,11 @@
 }:

 stdenv.mkDerivation rec {
-  name = "snd-18.2";
+  name = "snd-18.3";

  src = fetchurl {
    url = "mirror://sourceforge/snd/${name}.tar.gz";
-    sha256 = "0b0ija3cf2c9sqh3cclk5a7i73vagfkyw211aykfd76w7ibirs3r";
+    sha256 = "117sgvdv0a03ys1v27bs99mgzpfm2a7xg6s0q6m1f79jniia12ss";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@ -1,6 +1,6 @@
 { fetchurl, stdenv, dpkg, xorg, alsaLib, makeWrapper, openssl, freetype
-, glib, pango, cairo, atk, gdk_pixbuf, gtk2, cups, nspr, nss, libpng, GConf
-, libgcrypt, systemd, fontconfig, dbus, expat, ffmpeg_0_10, curl, zlib, gnome2 }:
+, glib, pango, cairo, atk, gdk_pixbuf, gtk2, cups, nspr, nss, libpng
+, libgcrypt, systemd, fontconfig, dbus, expat, ffmpeg_0_10, curl, zlib, gnome3 }:

 let
  # Please update the stable branch!
@ -20,7 +20,6 @@ let
    ffmpeg_0_10
    fontconfig
    freetype
-    GConf
    gdk_pixbuf
    glib
    gtk2
@ -93,7 +92,7 @@ stdenv.mkDerivation {
      librarypath="${stdenv.lib.makeLibraryPath deps}:$libdir"
      wrapProgram $out/share/spotify/spotify \
        --prefix LD_LIBRARY_PATH : "$librarypath" \
-        --prefix PATH : "${gnome2.zenity}/bin"
+        --prefix PATH : "${gnome3.zenity}/bin"

      # Desktop file
      mkdir -p "$out/share/applications/"
--- a/pkgs/applications/audio/x42-plugins/default.nix
+++ b/pkgs/applications/audio/x42-plugins/default.nix
@ -3,12 +3,12 @@
 , libGLU, lv2, gtk2, cairo, pango, fftwFloat, zita-convolver }:

 stdenv.mkDerivation rec {
-  version = "20170428";
+  version = "20180320";
  name = "x42-plugins-${version}";

  src = fetchurl {
    url = "http://gareus.org/misc/x42-plugins/${name}.tar.xz";
-    sha256 = "0yi82rak2277x4nzzr5zwbsnha5pi61w975c8src2iwar2b6m0xg";
+    sha256 = "167ly9nxqq3g0j35i9jv9rvd8qp4i9ncfcjxmg972cp6q8ak8mdl";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/editors/neovim/ruby_provider/Gemfile.lock
+++ b/pkgs/applications/editors/neovim/ruby_provider/Gemfile.lock
@ -1,9 +1,9 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    msgpack (1.2.2)
+    msgpack (1.2.4)
    multi_json (1.13.1)
-    neovim (0.6.2)
+    neovim (0.7.0)
      msgpack (~> 1.0)
      multi_json (~> 1.0)

--- a/pkgs/applications/editors/neovim/ruby_provider/gemset.nix
+++ b/pkgs/applications/editors/neovim/ruby_provider/gemset.nix
@ -2,10 +2,10 @@
  msgpack = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ai0sfdv9jnr333fsvkn7a8vqvn0iwiw83yj603a3i68ds1x6di1";
+      sha256 = "09xy1wc4wfbd1jdrzgxwmqjzfdfxbz0cqdszq2gv6rmc3gv1c864";
      type = "gem";
    };
-    version = "1.2.2";
+    version = "1.2.4";
  };
  multi_json = {
    source = {
@ -19,9 +19,9 @@
    dependencies = ["msgpack" "multi_json"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "15r3j9bwlpm1ry7cp6059xb0irvsvvlmw53i28z6sf2khwfj5j53";
+      sha256 = "0b487dzz41im8cwzvfjqgf8kkrp6mpkvcbzhazrmqqw8gxyvfbq4";
      type = "gem";
    };
-    version = "0.6.2";
+    version = "0.7.0";
  };
 }
--- a/pkgs/applications/editors/sublime/3/packages.nix
+++ b/pkgs/applications/editors/sublime/3/packages.nix
@ -5,14 +5,14 @@ let
 in
  rec {
    sublime3-dev = common {
-      buildVersion = "3162";
-      x32sha256 = "190il02hqvv64w17w7xc1fz2wkbhk5a5y96jb25dvafmslm46d4i";
-      x64sha256 = "1nsjhjs6zajhx7m3dk7i450krg6pb03zffm1n3m1v0xb9zr37xz3";
+      buildVersion = "3170";
+      x32sha256 = "04ll92mqnpvvaa161il6l02gvd0g0x95sci0yrywr6jzk6am1fzg";
+      x64sha256 = "1snzjr000qrjyvzd876x5j66138glh0bff3c1b2cb2bfc88c3kzx";
    } {};

    sublime3 = common {
-      buildVersion = "3143";
-      x32sha256 = "0dgpx4wij2m77f478p746qadavab172166bghxmj7fb61nvw9v5i";
-      x64sha256 = "06b554d2cvpxc976rvh89ix3kqc7klnngvk070xrs8wbyb221qcw";
+      buildVersion = "3170";
+      x32sha256 = "04ll92mqnpvvaa161il6l02gvd0g0x95sci0yrywr6jzk6am1fzg";
+      x64sha256 = "1snzjr000qrjyvzd876x5j66138glh0bff3c1b2cb2bfc88c3kzx";
    } {};
  }
--- a/pkgs/applications/editors/vscode/default.nix
+++ b/pkgs/applications/editors/vscode/default.nix
@ -2,7 +2,7 @@
  makeWrapper, libXScrnSaver, libxkbfile, libsecret }:

 let
-  version = "1.22.2";
+  version = "1.23.0";
  channel = "stable";

  plat = {
@ -12,9 +12,9 @@ let
  }.${stdenv.system};

  sha256 = {
-    "i686-linux" = "17iqqg6vdccbl1k4k2ks3kkgg7619j6qdvca4k27pjfqm17mvw5n";
-    "x86_64-linux" = "1ng2jhhaghsf7a2dmrimazh817jh0ag88whija179ywgrg3i6xam";
-    "x86_64-darwin" = "083hizigzxm45hcy6yqwznj9ibqdaxg2xv8rsyas4ig9x55irrcj";
+    "i686-linux" = "1nyrcgnf18752n3i7xaq6gpb2k4wsfzk671kxg6za4ycrriw1f5l";
+    "x86_64-linux" = "1mkxyavzav522sl3fjn2hdlbj0bkdl3hagqiw9i6h8wgkxcvsszy";
+    "x86_64-darwin" = "123ggzssd5qd80jxar2pf5g2n2473pd2j8pfjyir1c7xkaqji2w6";
  }.${stdenv.system};

  archive_fmt = if stdenv.system == "x86_64-darwin" then "zip" else "tar.gz";
--- a/pkgs/applications/graphics/epeg/default.nix
+++ b/pkgs/applications/graphics/epeg/default.nix
@ -0,0 +1,31 @@
+{ lib, stdenv, fetchFromGitHub, pkgconfig, libtool, autoconf, automake
+, libjpeg, libexif
+}:
+
+stdenv.mkDerivation rec {
+  name = "epeg-0.9.1.042"; # version taken from configure.ac
+
+  src = fetchFromGitHub {
+    owner = "mattes";
+    repo = "epeg";
+    rev = "248ae9fc3f1d6d06e6062a1f7bf5df77d4f7de9b";
+    sha256 = "14ad33w3pxrg2yfc2xzyvwyvjirwy2d00889dswisq8b84cmxfia";
+  };
+
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [ pkgconfig libtool autoconf automake ];
+
+  propagatedBuildInputs = [ libjpeg libexif ];
+
+  preConfigure = ''
+    ./autogen.sh
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/mattes/epeg;
+    description = "Insanely fast JPEG/ JPG thumbnail scaling";
+    platforms = platforms.linux ++ platforms.darwin;
+    maintainers = with maintainers; [ nh2 ];
+  };
+}
--- a/pkgs/applications/graphics/graphicsmagick/default.nix
+++ b/pkgs/applications/graphics/graphicsmagick/default.nix
@ -2,14 +2,14 @@
 , libjpeg, libpng, libtiff, libxml2, zlib, libtool, xz, libX11
 , libwebp, quantumdepth ? 8, fixDarwinDylibNames }:

-let version = "1.3.28"; in
+let version = "1.3.29"; in

 stdenv.mkDerivation {
  name = "graphicsmagick-${version}";

  src = fetchurl {
    url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${version}.tar.xz";
-    sha256 = "0jlrrimrajcmwp7llivyj14qnzb1mpqd8vw95dl6zbx5m2lnhall";
+    sha256 = "1m0cc6kpky06lpcipj7rfwc2jbw2igr0jk97zqmw3j1ld5mg93g1";
  };

  patches = [
--- a/pkgs/applications/graphics/openscad/default.nix
+++ b/pkgs/applications/graphics/openscad/default.nix
@ -1,20 +1,30 @@
-{ stdenv, fetchurl, qt4, qmake4Hook, bison, flex, eigen, boost, libGLU_combined, glew, opencsg, cgal
-, mpfr, gmp, glib, pkgconfig, harfbuzz, qscintilla, gettext
+{ stdenv, fetchurl, fetchFromGitHub, qt5, libsForQt5
+, bison, flex, eigen, boost, libGLU_combined, glew, opencsg, cgal
+, mpfr, gmp, glib, pkgconfig, harfbuzz, gettext
 }:

 stdenv.mkDerivation rec {
-  version = "2015.03-3";
+  version = "2018.04-git";
  name = "openscad-${version}";

-  src = fetchurl {
-    url = "http://files.openscad.org/${name}.src.tar.gz";
-    sha256 = "0djsgi9yx1nxr2gh1kgsqw5vrbncp8v5li0p1pp02higqf1psajx";
+#  src = fetchurl {
+#    url = "http://files.openscad.org/${name}.src.tar.gz";
+#    sha256 = "0djsgi9yx1nxr2gh1kgsqw5vrbncp8v5li0p1pp02higqf1psajx";
+#  };
+  src = fetchFromGitHub {
+    owner = "openscad";
+    repo = "openscad";
+    rev = "179074dff8c23cbc0e651ce8463737df0006f4ca";
+    sha256 = "1y63yqyd0v255liik4ff5ak6mj86d8d76w436x76hs5dk6jgpmfb";
  };

  buildInputs = [
-    qt4 qmake4Hook bison flex eigen boost libGLU_combined glew opencsg cgal mpfr gmp glib
-    pkgconfig harfbuzz qscintilla gettext
-  ];
+    bison flex eigen boost libGLU_combined glew opencsg cgal mpfr gmp glib
+    pkgconfig harfbuzz gettext
+  ]
+    ++ (with qt5; [qtbase qmake])
+    ++ (with libsForQt5; [qscintilla])
+  ;

  qmakeFlags = [ "VERSION=${version}" ];

--- a/pkgs/applications/graphics/pqiv/default.nix
+++ b/pkgs/applications/graphics/pqiv/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation (rec {
  name = "pqiv-${version}";
-  version = "2.10.3";
+  version = "2.10.4";

  src = fetchFromGitHub {
    owner = "phillipberndt";
    repo = "pqiv";
    rev = version;
-    sha256 = "16nhnv0dcp242jf1099pjr5dwnc65i40cnb3dvx1avdhidcmsx01";
+    sha256 = "04fawc3sd625y1bbgfgwmak56pq28sm58dwn5db4h183iy3awdl9";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/graphics/shutter/default.nix
+++ b/pkgs/applications/graphics/shutter/default.nix
@ -1,4 +1,6 @@
-{ stdenv, fetchurl, fetchpatch, perl, perlPackages, makeWrapper, imagemagick, gdk_pixbuf, librsvg }:
+{ stdenv, fetchurl, fetchpatch, perl, perlPackages, makeWrapper, imagemagick, gdk_pixbuf, librsvg
+, hicolor-icon-theme
+}:

 let
  perlModules = with perlPackages;
@ -29,6 +31,7 @@ stdenv.mkDerivation rec {
    wrapProgram $out/bin/shutter \
      --set PERL5LIB "${stdenv.lib.makePerlPath perlModules}" \
      --prefix PATH : "${imagemagick.out}/bin" \
+      --suffix XDG_DATA_DIRS : "${hicolor-icon-theme}/share" \
      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"
  '';

--- a/pkgs/applications/kde/akonadi-import-wizard.nix
+++ b/pkgs/applications/kde/akonadi-import-wizard.nix
@ -0,0 +1,20 @@
+{
+  mkDerivation, lib, kdepimTeam,
+  extra-cmake-modules, kdoctools,
+  akonadi, karchive, kcontacts, kcrash, kidentitymanagement, kio,
+  kmailtransport, kwallet, mailcommon, mailimporter, messagelib
+}:
+
+mkDerivation {
+  name = "akonadi-import-wizard";
+  meta = {
+    license = with lib.licenses; [ gpl2Plus lgpl21Plus fdl12 ];
+    maintainers = kdepimTeam;
+  };
+  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+  buildInputs = [
+    akonadi karchive kcontacts kcrash kidentitymanagement kio
+    kmailtransport kwallet mailcommon mailimporter messagelib
+  ];
+  outputs = [ "out" "dev" ];
+}
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@ -67,6 +67,7 @@ let
      akonadi = callPackage ./akonadi {};
      akonadi-calendar = callPackage ./akonadi-calendar.nix {};
      akonadi-contacts = callPackage ./akonadi-contacts.nix {};
+      akonadi-import-wizard = callPackage ./akonadi-import-wizard.nix {};
      akonadi-mime = callPackage ./akonadi-mime.nix {};
      akonadi-notes = callPackage ./akonadi-notes.nix {};
      akonadi-search = callPackage ./akonadi-search.nix {};
@ -101,6 +102,7 @@ let
      kdenetwork-filesharing = callPackage ./kdenetwork-filesharing.nix {};
      kdenlive = callPackage ./kdenlive.nix {};
      kdepim-runtime = callPackage ./kdepim-runtime.nix {};
+      kdepim-addons = callPackage ./kdepim-addons.nix {};
      kdepim-apps-libs = callPackage ./kdepim-apps-libs {};
      kdf = callPackage ./kdf.nix {};
      kdialog = callPackage ./kdialog.nix {};
--- a/pkgs/applications/kde/kdepim-addons.nix
+++ b/pkgs/applications/kde/kdepim-addons.nix
@ -0,0 +1,23 @@
+{
+  mkDerivation, lib, kdepimTeam,
+  extra-cmake-modules, shared-mime-info,
+  akonadi-import-wizard, akonadi-notes, calendarsupport, eventviews,
+  incidenceeditor, kcalcore, kcalutils, kconfig, kdbusaddons, kdeclarative,
+  kdepim-apps-libs, kholidays, ki18n, kmime, ktexteditor, ktnef, libgravatar,
+  libksieve, mailcommon, mailimporter, messagelib, poppler_qt5, prison
+}:
+
+mkDerivation {
+  name = "kdepim-addons";
+  meta = {
+    license = with lib.licenses; [ gpl2Plus lgpl21Plus ];
+    maintainers = kdepimTeam;
+  };
+  nativeBuildInputs = [ extra-cmake-modules shared-mime-info ];
+  buildInputs = [
+    akonadi-import-wizard akonadi-notes calendarsupport eventviews
+    incidenceeditor kcalcore kcalutils kconfig kdbusaddons kdeclarative
+    kdepim-apps-libs kholidays ki18n kmime ktexteditor ktnef libgravatar
+    libksieve mailcommon mailimporter messagelib poppler_qt5 prison
+  ];
+}
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@ -0,0 +1,34 @@
+{ stdenv, fetchzip, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  name = "1password-${version}";
+  version = "0.4";
+  src = if stdenv.system == "i686-linux" then fetchzip {
+    url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_386_v${version}.zip";
+    sha256 = "0mhlqvd3az50gnfil0xlq10855v3bg7yb05j6ndg4h2c551jrq41";
+    stripRoot = false;
+  } else fetchzip {
+    url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_amd64_v${version}.zip";
+    sha256 = "15cv8xi4slid9jicdmc5xx2r9ag63wcx1mn7hcgzxbxbhyrvwhyf";
+    stripRoot = false;
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  installPhase = ''
+    mkdir -p $out/bin
+    install -D op $out/share/1password/op
+
+    # https://github.com/NixOS/patchelf/issues/66#issuecomment-267743051
+    makeWrapper $(cat $NIX_CC/nix-support/dynamic-linker) $out/bin/op \
+      --argv0 op \
+      --add-flags $out/share/1password/op
+  '';
+
+  meta = with stdenv.lib; {
+    description = "1Password command-line tool";
+    homepage    = "https://blog.agilebits.com/2017/09/06/announcing-the-1password-command-line-tool-public-beta/";
+    maintainers = with maintainers; [ joelburget ];
+    license     = licenses.unfree;
+    platforms   = [ "i686-linux" "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/misc/dunst/default.nix
+++ b/pkgs/applications/misc/dunst/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fetchpatch
+{ stdenv, fetchFromGitHub
 , pkgconfig, which, perl, libXrandr
 , cairo, dbus, systemd, gdk_pixbuf, glib, libX11, libXScrnSaver
 , libXinerama, libnotify, libxdg_basedir, pango, xproto, librsvg
--- a/pkgs/applications/misc/googleearth/default.nix
+++ b/pkgs/applications/misc/googleearth/default.nix
@ -1,79 +0,0 @@
-{ stdenv, fetchurl, glibc, libGLU_combined, freetype, glib, libSM, libICE, libXi, libXv
-, libXrender, libXrandr, libXfixes, libXcursor, libXinerama, libXext, libX11, qt4
-, zlib, fontconfig, dpkg }:
-
-let
-  arch =
-    if stdenv.system == "x86_64-linux" then "amd64"
-    else if stdenv.system == "i686-linux" then "i386"
-    else throw "Unsupported system ${stdenv.system}";
-  sha256 =
-    if arch == "amd64"
-    then "0dwnppn5snl5bwkdrgj4cyylnhngi0g66fn2k41j3dvis83x24k6"
-    else "0gndbxrj3kgc2dhjqwjifr3cl85hgpm695z0wi01wvwzhrjqs0l2";
-  fullPath = stdenv.lib.makeLibraryPath [
-    glibc
-    glib
-    stdenv.cc.cc
-    libSM
-    libICE
-    libXi
-    libXv
-    libGLU_combined
-    libXrender
-    libXrandr
-    libXfixes
-    libXcursor
-    libXinerama
-    freetype
-    libXext
-    libX11
-    qt4
-    zlib
-    fontconfig
-  ];
-in
-stdenv.mkDerivation rec {
-  version = "7.1.4.1529";
-  name = "googleearth-${version}";
-
-  src = fetchurl {
-    url = "https://dl.google.com/earth/client/current/google-earth-stable_current_${arch}.deb";
-    inherit sha256;
-  };
-
-  phases = "unpackPhase installPhase";
-
-  buildInputs = [ dpkg ];
-
-  unpackPhase = ''
-    dpkg-deb -x ${src} ./
-  '';
-
-  installPhase =''
-    mkdir $out
-    mv usr/* $out/
-    rmdir usr
-    mv * $out/
-    rm $out/bin/google-earth $out/opt/google/earth/free/google-earth
-    ln -s $out/opt/google/earth/free/googleearth $out/bin/google-earth
-
-    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${fullPath}:\$ORIGIN" \
-      $out/opt/google/earth/free/googleearth-bin
-
-    for a in $out/opt/google/earth/free/*.so* ; do
-      patchelf --set-rpath "${fullPath}:\$ORIGIN" $a
-    done
-  '';
-
-  dontPatchELF = true;
-
-  meta = {
-    description = "A world sphere viewer";
-    homepage = http://earth.google.com;
-    license = stdenv.lib.licenses.unfree;
-    maintainers = [ stdenv.lib.maintainers.viric ];
-    platforms = stdenv.lib.platforms.linux;
-  };
-}
--- a/pkgs/applications/misc/houdini/runtime.nix
+++ b/pkgs/applications/misc/houdini/runtime.nix
@ -29,11 +29,11 @@ let
  license_dir = "~/.config/houdini";
 in
 stdenv.mkDerivation rec {
-  version = "16.5.405";
+  version = "16.5.439";
  name = "houdini-runtime-${version}";
  src = requireFile rec {
    name = "houdini-${version}-linux_x86_64_gcc4.8.tar.gz";
-    sha256 = "14i0kzv881jqd5z9jshri1fxxi3pkxdmi5l4p2b51c9i3apsxmw6";
+    sha256 = "7e483072a0e6e751a93f2a2f968cccb2d95559c61106ffeb344c95975704321b";
    message = ''
      This nix expression requires that ${name} is already part of the store.
      Download it from https://sidefx.com and add it to the nix store with:
--- a/pkgs/applications/misc/keepass/default.nix
+++ b/pkgs/applications/misc/keepass/default.nix
@ -3,11 +3,11 @@

 with builtins; buildDotnetPackage rec {
  baseName = "keepass";
-  version = "2.38";
+  version = "2.39";

  src = fetchurl {
    url = "mirror://sourceforge/keepass/KeePass-${version}-Source.zip";
-    sha256 = "0m33gfpvv01xc28k4rrc8llbyk6qanm9rsqcnv8ydms0cr78dbbk";
+    sha256 = "05mrbzlkr2h42cls6xhas76dg8kyic4fijwckrh0b0qv5pp71c11";
  };

  sourceRoot = ".";
--- a/pkgs/applications/misc/limesuite/default.nix
+++ b/pkgs/applications/misc/limesuite/default.nix
@ -0,0 +1,53 @@
+{ stdenv, fetchFromGitHub, cmake
+, sqlite, wxGTK30, libusb1, soapysdr
+, mesa_glu, libX11, gnuplot, fltk
+} :
+
+let
+  version = "18.04.1";
+
+in stdenv.mkDerivation {
+  name = "limesuite-${version}";
+
+  src = fetchFromGitHub {
+    owner = "myriadrf";
+    repo = "LimeSuite";
+    rev = "v${version}";
+    sha256 = "1aaqnwif1j045hvj011k5dyqxgxx72h33r4al74h5f8al81zvzj9";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [
+    libusb1
+    sqlite
+    wxGTK30
+    fltk
+    gnuplot
+    libusb1
+    soapysdr
+    mesa_glu
+    libX11
+  ];
+
+  postInstall = ''
+    mkdir -p $out/lib/udev/rules.d
+    cp ../udev-rules/64-limesuite.rules $out/lib/udev/rules.d
+
+    mkdir -p $out/share/limesuite
+    cp bin/Release/lms7suite_mcu/* $out/share/limesuite
+
+    cp bin/dualRXTX $out/bin
+    cp bin/basicRX $out/bin
+    cp bin/singleRX $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Driver and GUI for LMS7002M-based SDR platforms";
+    homepage = https://github.com/myriadrf/LimeSuite;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ markuskowa ];
+    platforms = platforms.linux;
+  };
+}
+
--- a/pkgs/applications/misc/pdfpc/default.nix
+++ b/pkgs/applications/misc/pdfpc/default.nix
@ -4,13 +4,13 @@
 stdenv.mkDerivation rec {
  name = "${product}-${version}";
  product = "pdfpc";
-  version = "4.1";
+  version = "4.1.1";

  src = fetchFromGitHub {
    repo = "pdfpc";
    owner = "pdfpc";
    rev = "v${version}";
-    sha256 = "02cp0x5prqrizxdp0sf2sk5ip0363vyw6fxsb3zwyx4dw0vz4g96";
+    sha256 = "1yjh9rx49d24wlwg44r2a6b5scybp8l1fi9wyf05sig6zfziw1mm";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/soapyairspy/default.nix
+++ b/pkgs/applications/misc/soapyairspy/default.nix
@ -0,0 +1,30 @@
+{ stdenv, fetchFromGitHub, cmake
+, airspy, soapysdr
+} :
+
+let
+  version = "0.1.1";
+
+in stdenv.mkDerivation {
+  name = "soapyairspy-${version}";
+
+  src = fetchFromGitHub {
+    owner = "pothosware";
+    repo = "SoapyAirspy";
+    rev = "soapy-airspy-${version}";
+    sha256 = "072vc9619s9f22k7639krr1p2418cmhgm44yhzy7x9dzapc43wvk";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ airspy soapysdr ];
+
+  cmakeFlags = [ "-DSoapySDR_DIR=${soapysdr}/share/cmake/SoapySDR/" ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/pothosware/SoapyAirspy;
+    description = "SoapySDR plugin for Airspy devices";
+    license = licenses.mit;
+    maintainers = with maintainers; [ markuskowa ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/misc/soapybladerf/default.nix
+++ b/pkgs/applications/misc/soapybladerf/default.nix
@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig
+, libbladeRF, soapysdr
+} :
+
+let
+  version = "0.3.5";
+
+in stdenv.mkDerivation {
+  name = "soapybladerf-${version}";
+
+  src = fetchFromGitHub {
+    owner = "pothosware";
+    repo = "SoapyBladeRF";
+    rev = "soapy-bladerf-${version}";
+    sha256 = "1n7vy6y8k1smq3l729npxbhxbnrc79gz06dxkibsihz4k8sddkrg";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ libbladeRF soapysdr ];
+
+  cmakeFlags = [ "-DSoapySDR_DIR=${soapysdr}/share/cmake/SoapySDR/" ];
+
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/pothosware/SoapyBladeRF;
+    description = "SoapySDR plugin for BladeRF devices";
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ markuskowa ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/misc/soapyhackrf/default.nix
+++ b/pkgs/applications/misc/soapyhackrf/default.nix
@ -0,0 +1,30 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig
+, hackrf, soapysdr
+} :
+
+let
+  version = "0.3.2";
+
+in stdenv.mkDerivation {
+  name = "soapyhackrf-${version}";
+
+  src = fetchFromGitHub {
+    owner = "pothosware";
+    repo = "SoapyHackRF";
+    rev = "soapy-hackrf-${version}";
+    sha256 = "1sgx2nk8yrzfwisjfs9mw0xwc47bckzi17p42s2pbv7zcxzpb66p";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ hackrf soapysdr ];
+
+  cmakeFlags = [ "-DSoapySDR_DIR=${soapysdr}/share/cmake/SoapySDR/" ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/pothosware/SoapyHackRF;
+    description = "SoapySDR plugin for HackRF devices";
+    license = licenses.mit;
+    maintainers = with maintainers; [ markuskowa ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/misc/soapyremote/default.nix
+++ b/pkgs/applications/misc/soapyremote/default.nix
@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, cmake, soapysdr }:
+
+let
+  version = "0.4.3";
+
+in stdenv.mkDerivation {
+  name = "soapyremote-${version}";
+
+  src = fetchFromGitHub {
+    owner = "pothosware";
+    repo = "SoapyRemote";
+    rev = "d07f43863b1ef79252f8029cfb5947220f21311d";
+    sha256 = "0i101dfqq0aawybv0qyjgsnhk39dc4q6z6ys2gsvwjhpf3d48aw0";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ soapysdr ];
+
+  cmakeFlags = [ "-DSoapySDR_DIR=${soapysdr}/share/cmake/SoapySDR/" ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/pothosware/SoapyRemote;
+    description = "SoapySDR plugin for remote access to SDRs";
+    license = licenses.boost;
+    maintainers = with maintainers; [ markuskowa ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/misc/soapysdr/default.nix
+++ b/pkgs/applications/misc/soapysdr/default.nix
@ -0,0 +1,50 @@
+{ stdenv, lib, lndir, makeWrapper
+, fetchFromGitHub, cmake
+, libusb, pkgconfig
+, python, swig2, numpy, ncurses
+, extraPackages ? []
+} :
+
+let
+  version = "0.6.1";
+
+in stdenv.mkDerivation {
+  name = "soapysdr-${version}";
+
+  src = fetchFromGitHub {
+    owner = "pothosware";
+    repo = "SoapySDR";
+    rev = "soapy-sdr-${version}";
+    sha256 = "1azbb2j6dv0b2dd5ks6yqd31j17sdhi9p82czwc8zy2isymax0l9";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ libusb ncurses numpy swig2 python ];
+
+  cmakeFlags = [
+    "-DCMAKE_BUILD_TYPE=Release"
+    "-DUSE_PYTHON_CONFIG=ON"
+  ];
+
+  postFixup = lib.optionalString (lib.length extraPackages != 0) ''
+    # Join all plugins via symlinking
+    for i in ${toString extraPackages}; do
+      ${lndir}/bin/lndir -silent $i $out
+    done
+
+    # Needed for at least the remote plugin server
+    for file in out/bin/*; do
+        ${makeWrapper}/bin/wrapProgram "$file" \
+            --prefix SOAPY_SDR_PLUGIN_PATH : ${lib.makeSearchPath "lib/SoapySDR/modules0.6" extraPackages}
+    done
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/pothosware/SoapySDR;
+    description = "Vendor and platform neutral SDR support library";
+    license = licenses.boost;
+    maintainers = with maintainers; [ markuskowa ];
+    platforms = platforms.linux;
+  };
+}
+
--- a/pkgs/applications/misc/soapyuhd/default.nix
+++ b/pkgs/applications/misc/soapyuhd/default.nix
@ -0,0 +1,34 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig
+, uhd, boost, soapysdr
+} :
+
+let
+  version = "0.3.4";
+
+in stdenv.mkDerivation {
+  name = "soapyuhd-${version}";
+
+  src = fetchFromGitHub {
+    owner = "pothosware";
+    repo = "SoapyUHD";
+    rev = "soapy-uhd-${version}";
+    sha256 = "1da7cjcvfdqhgznm7x14s1h7lwz5lan1b48akw445ah1vxwvh4hl";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ uhd boost soapysdr ];
+
+  cmakeFlags = [ "-DSoapySDR_DIR=${soapysdr}/share/cmake/SoapySDR/" ];
+
+  postPatch = ''
+    sed -i "s:DESTINATION .*uhd/modules:DESTINATION $out/lib/uhd/modules:" CMakeLists.txt
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/pothosware/SoapyAirspy;
+    description = "SoapySDR plugin for UHD devices";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ markuskowa ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/misc/todiff/default.nix
+++ b/pkgs/applications/misc/todiff/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  name = "todiff-${version}";
-  version = "0.4.0";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "Ekleog";
    repo = "todiff";
    rev = version;
-    sha256 = "0n3sifinwhny651q1v1a6y9ybim1b0nd5s1z26sigjdhdvxckn65";
+    sha256 = "0xnqw98nccnkqfdmbkblm897v981rw1fagbi5q895bpwfg0p71lk";
  };

-  cargoSha256 = "0mxdpn98fvmxrp656vwxvzl9vprz5mvqj7d1hvvs4gsjrsiyp0fy";
+  cargoSha256 = "0ih7lw5hbayvc66fjqwga0i7l3sb9qn0m26vnham5li39f5i3rqp";

  meta = with stdenv.lib; {
    description = "Human-readable diff for todo.txt files";
--- a/pkgs/applications/misc/welle-io/default.nix
+++ b/pkgs/applications/misc/welle-io/default.nix
@ -1,6 +1,6 @@
 { stdenv, buildEnv, fetchFromGitHub, cmake, pkgconfig
 , qtbase, qtcharts, qtmultimedia, qtquickcontrols, qtquickcontrols2
-, faad2, rtl-sdr, libusb, fftwSinglePrec }:
+, faad2, rtl-sdr, soapysdr-with-plugins, libusb, fftwSinglePrec }:
 let

  version = "1.0-rc2";
@ -28,10 +28,11 @@ in stdenv.mkDerivation {
    qtquickcontrols
    qtquickcontrols2
    rtl-sdr
+    soapysdr-with-plugins
  ];

  cmakeFlags = [
-    "-DRTLSDR=true"
+    "-DRTLSDR=true" "-DSOAPYSDR=true"
  ];

  enableParallelBuilding = true;
@ -41,7 +42,6 @@ in stdenv.mkDerivation {
    homepage = http://www.welle.io/;
    maintainers = with maintainers; [ ck3d ];
    license = licenses.gpl2;
-    platforms = with platforms; linux ++ darwin;
+    platforms = with platforms; [ "x86_64-linux" "i686-linux" ] ++ darwin;
  };
-
 }
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  name = "xmrig-${version}";
-  version = "2.5.3";
+  version = "2.6.1";

  src = fetchFromGitHub {
    owner = "xmrig";
    repo = "xmrig";
    rev = "v${version}";
-    sha256 = "1f9z9akgaf27r5hjrsjw0clk47p7igi0slbg7z6c3rvy5q9kq0wp";
+    sha256 = "05gd3jl8nvj2b73l4x72rfbbxrkw3r8q1h761ly4z35v4f3lahk8";
  };

  nativeBuildInputs = [ cmake ];
@ -28,6 +28,7 @@ stdenv.mkDerivation rec {
    description = "Monero (XMR) CPU miner";
    homepage = "https://github.com/xmrig/xmrig";
    license = licenses.gpl3Plus;
+    platforms   = [ "x86_64-linux" "x86_64-darwin" ];
    maintainers = with maintainers; [ fpletz ];
  };
 }
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@ -12,8 +12,6 @@
 , gdk_pixbuf
 , glib
 , glibc
-, gst-plugins-base
-, gstreamer
 , gtk2
 , gtk3
 , kerberos
@ -30,6 +28,7 @@
 , libcanberra-gtk2
 , libgnome
 , libgnomeui
+, libnotify
 , defaultIconTheme
 , libGLU_combined
 , nspr
@ -98,8 +97,6 @@ stdenv.mkDerivation {
      gdk_pixbuf
      glib
      glibc
-      gst-plugins-base
-      gstreamer
      gtk2
      gtk3
      kerberos
@ -116,6 +113,7 @@ stdenv.mkDerivation {
      libcanberra-gtk2
      libgnome
      libgnomeui
+      libnotify
      libGLU_combined
      nspr
      nss
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -2,7 +2,7 @@

 ## various stuff that can be plugged in
 , flashplayer, hal-flash
-, MPlayerPlugin, ffmpeg, gst_all, xorg, libpulseaudio, libcanberra-gtk2
+, MPlayerPlugin, ffmpeg, xorg, libpulseaudio, libcanberra-gtk2
 , jrePlugin, icedtea_web
 , trezor-bridge, bluejeans, djview4, adobe-reader
 , google_talk_plugin, fribid, gnome3/*.gnome-shell*/
@ -65,13 +65,12 @@ let
          ++ lib.optional (cfg.enableUgetIntegrator or false) uget-integrator
          ++ extraNativeMessagingHosts
        );
-      libs = (if ffmpegSupport then [ ffmpeg ] else with gst_all; [ gstreamer gst-plugins-base ])
+      libs = lib.optional ffmpegSupport ffmpeg
            ++ lib.optional gssSupport kerberos
            ++ lib.optionals (cfg.enableQuakeLive or false)
            (with xorg; [ stdenv.cc libX11 libXxf86dga libXxf86vm libXext libXt alsaLib zlib libudev ])
            ++ lib.optional (enableAdobeFlash && (cfg.enableAdobeFlashDRM or false)) hal-flash
            ++ lib.optional (config.pulseaudio or true) libpulseaudio;
-      gst-plugins = with gst_all; [ gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-ffmpeg ];
      gtk_modules = [ libcanberra-gtk2 ];

    in stdenv.mkDerivation {
@ -97,7 +96,6 @@ let
      };

      buildInputs = [makeWrapper]
-        ++ lib.optional (!ffmpegSupport) gst-plugins
        ++ lib.optional (browser ? gtk3) browser.gtk3;

      buildCommand = ''
@ -117,9 +115,7 @@ let
            --suffix PATH ':' "$out/bin" \
            --set MOZ_APP_LAUNCHER "${browserName}${nameSuffix}" \
            --set MOZ_SYSTEM_DIR "$out/lib/mozilla" \
-            ${lib.optionalString (!ffmpegSupport)
-                ''--prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH"''
-            + lib.optionalString (browser ? gtk3)
+            ${lib.optionalString (browser ? gtk3)
                ''--prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
                  --suffix XDG_DATA_DIRS : '${gnome3.defaultIconTheme}/share'
                ''
--- a/pkgs/applications/networking/browsers/lynx/default.nix
+++ b/pkgs/applications/networking/browsers/lynx/default.nix
@ -9,21 +9,24 @@ assert sslSupport -> openssl != null;

 stdenv.mkDerivation rec {
  name = "lynx-${version}";
-  version = "2.8.9dev.16";
+  version = "2.8.9dev.17";

  src = fetchurl {
    urls = [
      "ftp://ftp.invisible-island.net/lynx/tarballs/lynx${version}.tar.bz2"
      "https://invisible-mirror.net/archives/lynx/tarballs/lynx${version}.tar.bz2"
    ];
-    sha256 = "1j0vx871ghkm7fgrafnvd2ml3ywcl8d3gyhq02fhfb851c88lc84";
+    sha256 = "1lvfsnrw5mmwrmn1m76q9mx287xwm3h5lg8sv7bcqilc0ywi2f54";
  };

  enableParallelBuilding = true;

  hardeningEnable = [ "pie" ];

-  configureFlags = [ "--enable-widec" ] ++ stdenv.lib.optional sslSupport "--with-ssl";
+  configureFlags = [
+    "--enable-widec"
+    "--enable-ipv6"
+  ] ++ stdenv.lib.optional sslSupport "--with-ssl";

  depsBuildBuild = [ buildPackages.stdenv.cc ];
  nativeBuildInputs = [ nukeReferences ]
@ -40,7 +43,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "A text-mode web browser";
-    homepage = http://lynx.invisible-island.net/;
+    homepage = https://lynx.invisible-island.net/;
    license = licenses.gpl2Plus;
    platforms = platforms.unix;
  };
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@ -10,14 +10,14 @@

 stdenv.mkDerivation rec {
  name = "palemoon-${version}";
-  version = "27.8.3";
+  version = "27.9.0";

  src = fetchFromGitHub {
    name   = "palemoon-src";
    owner  = "MoonchildProductions";
    repo   = "Pale-Moon";
    rev    = version + "_Release";
-    sha256 = "1v3wliq8k5yq17ms214fhwka8x4l3sq8kja59dx4pbvczzb1zyzh";
+    sha256 = "181g1hy4k9xr6nlrw8jamp541gr5znny4mmpwwaa1lzq5v1w1sw6";
  };

  desktopItem = makeDesktopItem {
--- a/pkgs/applications/networking/cluster/cni/plugins.nix
+++ b/pkgs/applications/networking/cluster/cni/plugins.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "cni-plugins-${version}";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "containernetworking";
    repo = "plugins";
    rev = "v${version}";
-    sha256 = "0m885v76azs7lrk6m6n53rwh0xadwvdcr90h0l3bxpdv87sj2mnf";
+    sha256 = "1sywllwnr6lc812sgkqjdd3y10r82shl88dlnwgnbgzs738q2vp2";
  };

  buildInputs = [ go ];
--- a/pkgs/applications/networking/cluster/kontemplate/default.nix
+++ b/pkgs/applications/networking/cluster/kontemplate/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name          = "kontemplate-${version}";
-  version       = "1.4.0";
+  version       = "1.5.0";
  goPackagePath = "github.com/tazjin/kontemplate";
  goDeps        = ./deps.nix;

@ -10,7 +10,7 @@ buildGoPackage rec {
    owner  = "tazjin";
    repo   = "kontemplate";
    rev    = "v${version}";
-    sha256 = "11aqc9sgyqz3pscx7njnb3xghl7d61vzdgl3bqndady0dxsccrpj";
+    sha256 = "0k3yr0ypw6brj1lxqs041zsyi0r09113i0x3xfj48zv4ralq74b6";
  };

  meta = with lib; {
--- a/pkgs/applications/networking/cluster/panamax/api/Gemfile
+++ b/pkgs/applications/networking/cluster/panamax/api/Gemfile
@ -1,23 +0,0 @@
-source 'https://rubygems.org'
-
-gem 'rails', '4.1.7'
-gem 'puma', '2.8.2'
-gem 'sqlite3', '1.3.9'
-gem 'faraday_middleware', '0.9.0'
-gem 'docker-api', '1.13.0', require: 'docker'
-gem 'fleet-api', '0.6.0', require: 'fleet'
-gem 'active_model_serializers', '0.9.0'
-gem 'octokit', '3.2.0'
-gem 'kmts', '2.0.1'
-
-group :test, :development do
-  gem 'rspec-rails'
-  gem 'its'
-end
-
-group :test do
-  gem 'coveralls', '0.7.0'
-  gem 'shoulda-matchers', '2.6.1'
-  gem 'database_cleaner', '1.3.0'
-  gem 'webmock', '1.20.0'
-end
--- a/pkgs/applications/networking/cluster/panamax/api/Gemfile.lock
+++ b/pkgs/applications/networking/cluster/panamax/api/Gemfile.lock
@ -1,164 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    actionmailer (4.1.7)
-      actionpack (= 4.1.7)
-      actionview (= 4.1.7)
-      mail (~> 2.5, >= 2.5.4)
-    actionpack (4.1.7)
-      actionview (= 4.1.7)
-      activesupport (= 4.1.7)
-      rack (~> 1.5.2)
-      rack-test (~> 0.6.2)
-    actionview (4.1.7)
-      activesupport (= 4.1.7)
-      builder (~> 3.1)
-      erubis (~> 2.7.0)
-    active_model_serializers (0.9.0)
-      activemodel (>= 3.2)
-    activemodel (4.1.7)
-      activesupport (= 4.1.7)
-      builder (~> 3.1)
-    activerecord (4.1.7)
-      activemodel (= 4.1.7)
-      activesupport (= 4.1.7)
-      arel (~> 5.0.0)
-    activesupport (4.1.7)
-      i18n (~> 0.6, >= 0.6.9)
-      json (~> 1.7, >= 1.7.7)
-      minitest (~> 5.1)
-      thread_safe (~> 0.1)
-      tzinfo (~> 1.1)
-    addressable (2.3.6)
-    archive-tar-minitar (0.5.2)
-    arel (5.0.1.20140414130214)
-    builder (3.2.2)
-    coveralls (0.7.0)
-      multi_json (~> 1.3)
-      rest-client
-      simplecov (>= 0.7)
-      term-ansicolor
-      thor
-    crack (0.4.2)
-      safe_yaml (~> 1.0.0)
-    database_cleaner (1.3.0)
-    diff-lcs (1.2.5)
-    docile (1.1.5)
-    docker-api (1.13.0)
-      archive-tar-minitar
-      excon (>= 0.37.0)
-      json
-    erubis (2.7.0)
-    excon (0.37.0)
-    faraday (0.8.9)
-      multipart-post (~> 1.2.0)
-    faraday_middleware (0.9.0)
-      faraday (>= 0.7.4, < 0.9)
-    fleet-api (0.6.0)
-      faraday (= 0.8.9)
-      faraday_middleware (= 0.9.0)
-    hike (1.2.3)
-    i18n (0.7.0)
-    its (0.2.0)
-      rspec-core
-    json (1.8.1)
-    kmts (2.0.1)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
-    mime-types (2.4.3)
-    minitest (5.5.1)
-    multi_json (1.10.1)
-    multipart-post (1.2.0)
-    octokit (3.2.0)
-      sawyer (~> 0.5.3)
-    puma (2.8.2)
-      rack (>= 1.1, < 2.0)
-    rack (1.5.2)
-    rack-test (0.6.3)
-      rack (>= 1.0)
-    rails (4.1.7)
-      actionmailer (= 4.1.7)
-      actionpack (= 4.1.7)
-      actionview (= 4.1.7)
-      activemodel (= 4.1.7)
-      activerecord (= 4.1.7)
-      activesupport (= 4.1.7)
-      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.1.7)
-      sprockets-rails (~> 2.0)
-    railties (4.1.7)
-      actionpack (= 4.1.7)
-      activesupport (= 4.1.7)
-      rake (>= 0.8.7)
-      thor (>= 0.18.1, < 2.0)
-    rake (10.4.0)
-    rest-client (1.6.7)
-      mime-types (>= 1.16)
-    rspec-core (3.1.7)
-      rspec-support (~> 3.1.0)
-    rspec-expectations (3.1.2)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.1.0)
-    rspec-mocks (3.1.3)
-      rspec-support (~> 3.1.0)
-    rspec-rails (3.1.0)
-      actionpack (>= 3.0)
-      activesupport (>= 3.0)
-      railties (>= 3.0)
-      rspec-core (~> 3.1.0)
-      rspec-expectations (~> 3.1.0)
-      rspec-mocks (~> 3.1.0)
-      rspec-support (~> 3.1.0)
-    rspec-support (3.1.2)
-    safe_yaml (1.0.4)
-    sawyer (0.5.4)
-      addressable (~> 2.3.5)
-      faraday (~> 0.8, < 0.10)
-    shoulda-matchers (2.6.1)
-      activesupport (>= 3.0.0)
-    simplecov (0.9.1)
-      docile (~> 1.1.0)
-      multi_json (~> 1.0)
-      simplecov-html (~> 0.8.0)
-    simplecov-html (0.8.0)
-    sprockets (2.12.3)
-      hike (~> 1.2)
-      multi_json (~> 1.0)
-      rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    sprockets-rails (2.2.4)
-      actionpack (>= 3.0)
-      activesupport (>= 3.0)
-      sprockets (>= 2.8, < 4.0)
-    sqlite3 (1.3.9)
-    term-ansicolor (1.3.0)
-      tins (~> 1.0)
-    thor (0.19.1)
-    thread_safe (0.3.4)
-    tilt (1.4.1)
-    tins (1.3.0)
-    tzinfo (1.2.2)
-      thread_safe (~> 0.1)
-    webmock (1.20.0)
-      addressable (>= 2.3.6)
-      crack (>= 0.3.2)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  active_model_serializers (= 0.9.0)
-  coveralls (= 0.7.0)
-  database_cleaner (= 1.3.0)
-  docker-api (= 1.13.0)
-  faraday_middleware (= 0.9.0)
-  fleet-api (= 0.6.0)
-  its
-  kmts (= 2.0.1)
-  octokit (= 3.2.0)
-  puma (= 2.8.2)
-  rails (= 4.1.7)
-  rspec-rails
-  shoulda-matchers (= 2.6.1)
-  sqlite3 (= 1.3.9)
-  webmock (= 1.20.0)
--- a/pkgs/applications/networking/cluster/panamax/api/default.nix
+++ b/pkgs/applications/networking/cluster/panamax/api/default.nix
@ -1,74 +0,0 @@
-{ stdenv, fetchgit, fetchurl, makeWrapper, bundlerEnv, bundler
-, ruby, libxslt, libxml2, sqlite, openssl, docker
-, dataDir ? "/var/lib/panamax-api" }@args:
-
-with stdenv.lib;
-
-stdenv.mkDerivation rec {
-  name = "panamax-api-${version}";
-  version = "0.2.16";
-
-  env = bundlerEnv {
-    name = "panamax-api-gems-${version}";
-    inherit ruby;
-    gemdir = ./.;
-  };
-
-  bundler = args.bundler.override { inherit ruby; };
-
-  database_yml = builtins.toFile "database.yml" ''
-    production:
-      adapter: sqlite3
-      database: <%= ENV["PANAMAX_DATABASE_PATH"] || "${dataDir}/db/mnt/db.sqlite3" %>
-      timeout: 5000
-  '';
-
-  src = fetchgit {
-    rev = "refs/tags/v${version}";
-    url = "git://github.com/CenturyLinkLabs/panamax-api";
-    sha256 = "0dqg0fbmy5cgjh0ql8yqlybhjyyrslgghjrc24wjhd1rghjn2qi6";
-  };
-
-  buildInputs = [ makeWrapper sqlite openssl env.ruby bundler ];
-
-  setSourceRoot = ''
-    mkdir -p $out/share
-    cp -R panamax-api $out/share/panamax-api
-    export sourceRoot="$out/share/panamax-api"
-  '';
-
-  postPatch = ''
-    find . -type f -exec sed -e 's|/usr/bin/docker|${docker}/bin/docker|g' -i "{}" \;
-  '';
-
-  configurePhase = ''
-    export HOME=$PWD
-    export GEM_HOME=${env}/${env.ruby.gemPath}
-    export RAILS_ENV=production
-
-    ln -sf ${database_yml} config/database.yml
-  '';
-
-  installPhase = ''
-    rm -rf log tmp
-    mv ./db ./_db
-    ln -sf ${dataDir}/{db,state/log,state/tmp} .
-
-    mkdir -p $out/bin
-    makeWrapper bin/bundle "$out/bin/bundle" \
-      --run "cd $out/share/panamax-api" \
-      --prefix "PATH" : "$out/share/panamax-api/bin:${env.ruby}/bin:$PATH" \
-      --prefix "HOME" : "$out/share/panamax-api" \
-      --prefix "GEM_HOME" : "${env}/${env.ruby.gemPath}" \
-      --prefix "GEM_PATH" : "$out/share/panamax-api:${bundler}/${env.ruby.gemPath}"
-  '';
-
-  meta = with stdenv.lib; {
-    broken = true; # needs ruby 2.1
-    homepage = https://github.com/CenturyLinkLabs/panamax-api;
-    description = "The API behind The Panamax UI";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ matejc offline ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/networking/cluster/panamax/api/gemset.nix
+++ b/pkgs/applications/networking/cluster/panamax/api/gemset.nix
@ -1,568 +0,0 @@
-{
-  "actionmailer" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "0qjv5akjbpgd4cx518k522mssvc3y3nki65hi6fj5nbzi7a6rwq5";
-    };
-    dependencies = [
-      "actionpack"
-      "actionview"
-      "mail"
-    ];
-  };
-  "actionpack" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "07y1ny00h69xklq260smyl5md052f617gqrzkyw5sxafs5z25zax";
-    };
-    dependencies = [
-      "actionview"
-      "activesupport"
-      "rack"
-      "rack-test"
-    ];
-  };
-  "actionview" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "06sp37gfpn2jn7j6vlpp1y6vfi5kig60vyvixrjhyz0g4vgm13ax";
-    };
-    dependencies = [
-      "activesupport"
-      "builder"
-      "erubis"
-    ];
-  };
-  "active_model_serializers" = {
-    version = "0.9.0";
-    source = {
-      type = "gem";
-      sha256 = "1ws3gx3wwlm17w7k0agwzmcmww6627lvqaqm828lzm3g1xqilkkl";
-    };
-    dependencies = [
-      "activemodel"
-    ];
-  };
-  "activemodel" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "0rlqzz25l7vsphgkilg80kmk20d9h357awi27ax6zzb9klkqh0jr";
-    };
-    dependencies = [
-      "activesupport"
-      "builder"
-    ];
-  };
-  "activerecord" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "0j4r0m32mjbwmz9gs8brln35jzr1cn7h585ggj0w0f1ai4hjsby5";
-    };
-    dependencies = [
-      "activemodel"
-      "activesupport"
-      "arel"
-    ];
-  };
-  "activesupport" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "13i3mz66d5kp5y39gjwmcfqv0wb6mxm5k1nnz40wvd38dsf7n3bs";
-    };
-    dependencies = [
-      "i18n"
-      "json"
-      "minitest"
-      "thread_safe"
-      "tzinfo"
-    ];
-  };
-  "addressable" = {
-    version = "2.3.6";
-    source = {
-      type = "gem";
-      sha256 = "137fj0whmn1kvaq8wjalp8x4qbblwzvg3g4bfx8d8lfi6f0w48p8";
-    };
-  };
-  "archive-tar-minitar" = {
-    version = "0.5.2";
-    source = {
-      type = "gem";
-      sha256 = "1j666713r3cc3wb0042x0wcmq2v11vwwy5pcaayy5f0lnd26iqig";
-    };
-  };
-  "arel" = {
-    version = "5.0.1.20140414130214";
-    source = {
-      type = "gem";
-      sha256 = "0dhnc20h1v8ml3nmkxq92rr7qxxpk6ixhwvwhgl2dbw9mmxz0hf9";
-    };
-  };
-  "builder" = {
-    version = "3.2.2";
-    source = {
-      type = "gem";
-      sha256 = "14fii7ab8qszrvsvhz6z2z3i4dw0h41a62fjr2h1j8m41vbrmyv2";
-    };
-  };
-  "coveralls" = {
-    version = "0.7.0";
-    source = {
-      type = "gem";
-      sha256 = "0sz30d7b83qqsj3i0fr691w05d62wj7x3afh0ryjkqkis3fq94j4";
-    };
-    dependencies = [
-      "multi_json"
-      "rest-client"
-      "simplecov"
-      "term-ansicolor"
-      "thor"
-    ];
-  };
-  "crack" = {
-    version = "0.4.2";
-    source = {
-      type = "gem";
-      sha256 = "1il94m92sz32nw5i6hdq14f1a2c3s9hza9zn6l95fvqhabq38k7a";
-    };
-    dependencies = [
-      "safe_yaml"
-    ];
-  };
-  "database_cleaner" = {
-    version = "1.3.0";
-    source = {
-      type = "gem";
-      sha256 = "19w25yda684pg29bggq26wy4lpyjvzscwg2hx3hmmmpysiwfnxgn";
-    };
-  };
-  "diff-lcs" = {
-    version = "1.2.5";
-    source = {
-      type = "gem";
-      sha256 = "1vf9civd41bnqi6brr5d9jifdw73j9khc6fkhfl1f8r9cpkdvlx1";
-    };
-  };
-  "docile" = {
-    version = "1.1.5";
-    source = {
-      type = "gem";
-      sha256 = "0m8j31whq7bm5ljgmsrlfkiqvacrw6iz9wq10r3gwrv5785y8gjx";
-    };
-  };
-  "docker-api" = {
-    version = "1.13.0";
-    source = {
-      type = "gem";
-      sha256 = "1rara27gn7lxaf12dqkx8s1clssg10jndfcy4wz2fv6ms1i1lnp6";
-    };
-    dependencies = [
-      "archive-tar-minitar"
-      "excon"
-      "json"
-    ];
-  };
-  "erubis" = {
-    version = "2.7.0";
-    source = {
-      type = "gem";
-      sha256 = "1fj827xqjs91yqsydf0zmfyw9p4l2jz5yikg3mppz6d7fi8kyrb3";
-    };
-  };
-  "excon" = {
-    version = "0.37.0";
-    source = {
-      type = "gem";
-      sha256 = "05x7asmsq5m419n1lhzk9bic02gwng4cqmrcqsfnd6kmkwm8csv2";
-    };
-  };
-  "faraday" = {
-    version = "0.8.9";
-    source = {
-      type = "gem";
-      sha256 = "17d79fsgx0xwh0mfxyz5pbr435qlw79phlfvifc546w2axdkp718";
-    };
-    dependencies = [
-      "multipart-post"
-    ];
-  };
-  "faraday_middleware" = {
-    version = "0.9.0";
-    source = {
-      type = "gem";
-      sha256 = "1kwvi2sdxd6j764a7q5iir73dw2v6816zx3l8cgfv0wr2m47icq2";
-    };
-    dependencies = [
-      "faraday"
-    ];
-  };
-  "fleet-api" = {
-    version = "0.6.0";
-    source = {
-      type = "gem";
-      sha256 = "0136mzc0fxp6mzh38n6xbg87cw9g9vq1nrlr3ylazbflvmlxgan6";
-    };
-    dependencies = [
-      "faraday"
-      "faraday_middleware"
-    ];
-  };
-  "hike" = {
-    version = "1.2.3";
-    source = {
-      type = "gem";
-      sha256 = "0i6c9hrszzg3gn2j41v3ijnwcm8cc2931fnjiv6mnpl4jcjjykhm";
-    };
-  };
-  "i18n" = {
-    version = "0.7.0";
-    source = {
-      type = "gem";
-      sha256 = "1i5z1ykl8zhszsxcs8mzl8d0dxgs3ylz8qlzrw74jb0gplkx6758";
-    };
-  };
-  "its" = {
-    version = "0.2.0";
-    source = {
-      type = "gem";
-      sha256 = "0rxwds9ipqp48mzqcaxzmfcqhawazg0zlhc1avv3i2cmm3np1z8g";
-    };
-    dependencies = [
-      "rspec-core"
-    ];
-  };
-  "json" = {
-    version = "1.8.1";
-    source = {
-      type = "gem";
-      sha256 = "0002bsycvizvkmk1jyv8px1hskk6wrjfk4f7x5byi8gxm6zzn6wn";
-    };
-  };
-  "kmts" = {
-    version = "2.0.1";
-    source = {
-      type = "gem";
-      sha256 = "1wk680q443lg35a25am6i8xawf16iqg5xnq1m8xd2gib4dsy1d8v";
-    };
-  };
-  "mail" = {
-    version = "2.6.3";
-    source = {
-      type = "gem";
-      sha256 = "1nbg60h3cpnys45h7zydxwrl200p7ksvmrbxnwwbpaaf9vnf3znp";
-    };
-    dependencies = [
-      "mime-types"
-    ];
-  };
-  "mime-types" = {
-    version = "2.4.3";
-    source = {
-      type = "gem";
-      sha256 = "16nissnb31wj7kpcaynx4gr67i7pbkzccfg8k7xmplbkla4rmwiq";
-    };
-  };
-  "minitest" = {
-    version = "5.5.1";
-    source = {
-      type = "gem";
-      sha256 = "1h8jn0rgmwy37jnhfcg55iilw0n370vgp8xnh0g5laa8rhv32fyn";
-    };
-  };
-  "multi_json" = {
-    version = "1.10.1";
-    source = {
-      type = "gem";
-      sha256 = "1ll21dz01jjiplr846n1c8yzb45kj5hcixgb72rz0zg8fyc9g61c";
-    };
-  };
-  "multipart-post" = {
-    version = "1.2.0";
-    source = {
-      type = "gem";
-      sha256 = "12p7lnmc52di1r4h73h6xrpppplzyyhani9p7wm8l4kgf1hnmwnc";
-    };
-  };
-  "octokit" = {
-    version = "3.2.0";
-    source = {
-      type = "gem";
-      sha256 = "07ll3x1hv72zssb4hkdw56xg3xk6x4fch4yf38zljvbh388r11ng";
-    };
-    dependencies = [
-      "sawyer"
-    ];
-  };
-  "puma" = {
-    version = "2.8.2";
-    source = {
-      type = "gem";
-      sha256 = "1l57fmf8vyxfjv7ab5znq0k339cym5ghnm5xxfvd1simjp73db0k";
-    };
-    dependencies = [
-      "rack"
-    ];
-  };
-  "rack" = {
-    version = "1.5.2";
-    source = {
-      type = "gem";
-      sha256 = "19szfw76cscrzjldvw30jp3461zl00w4xvw1x9lsmyp86h1g0jp6";
-    };
-  };
-  "rack-test" = {
-    version = "0.6.3";
-    source = {
-      type = "gem";
-      sha256 = "0h6x5jq24makgv2fq5qqgjlrk74dxfy62jif9blk43llw8ib2q7z";
-    };
-    dependencies = [
-      "rack"
-    ];
-  };
-  "rails" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "059mpljplmhfz8rr4hk40q67fllcpsy809m4mwwbkm8qwif2z5r0";
-    };
-    dependencies = [
-      "actionmailer"
-      "actionpack"
-      "actionview"
-      "activemodel"
-      "activerecord"
-      "activesupport"
-      "railties"
-      "sprockets-rails"
-    ];
-  };
-  "railties" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "1n08h0rgj0aq5lvslnih6lvqz9wadpz6nnb25i4qhp37fhhyz9yz";
-    };
-    dependencies = [
-      "actionpack"
-      "activesupport"
-      "rake"
-      "thor"
-    ];
-  };
-  "rake" = {
-    version = "10.4.0";
-    source = {
-      type = "gem";
-      sha256 = "0a10xzqc1lh6gjkajkslr0n40wjrniyiyzxkp9m5fc8wf7b74zw8";
-    };
-  };
-  "rest-client" = {
-    version = "1.6.7";
-    source = {
-      type = "gem";
-      sha256 = "0nn7zalgidz2yj0iqh3xvzh626krm2al79dfiij19jdhp0rk8853";
-    };
-    dependencies = [
-      "mime-types"
-    ];
-  };
-  "rspec-core" = {
-    version = "3.1.7";
-    source = {
-      type = "gem";
-      sha256 = "01bawvln663gffljwzpq3mrpa061cghjbvfbq15jvhmip3csxqc9";
-    };
-    dependencies = [
-      "rspec-support"
-    ];
-  };
-  "rspec-expectations" = {
-    version = "3.1.2";
-    source = {
-      type = "gem";
-      sha256 = "0m8d36wng1lpbcs54zhg1rxh63rgj345k3p0h0c06lgknz339nzh";
-    };
-    dependencies = [
-      "diff-lcs"
-      "rspec-support"
-    ];
-  };
-  "rspec-mocks" = {
-    version = "3.1.3";
-    source = {
-      type = "gem";
-      sha256 = "0gxk5w3klia4zsnp0svxck43xxwwfdqvhr3srv6p30f3m5q6rmzr";
-    };
-    dependencies = [
-      "rspec-support"
-    ];
-  };
-  "rspec-rails" = {
-    version = "3.1.0";
-    source = {
-      type = "gem";
-      sha256 = "1b1in3n1dc1bpf9wb3p3b2ynq05iacmr48jxzc73lj4g44ksh3wq";
-    };
-    dependencies = [
-      "actionpack"
-      "activesupport"
-      "railties"
-      "rspec-core"
-      "rspec-expectations"
-      "rspec-mocks"
-      "rspec-support"
-    ];
-  };
-  "rspec-support" = {
-    version = "3.1.2";
-    source = {
-      type = "gem";
-      sha256 = "14y6v9r9lrh91ry9r79h85v0f3y9ja25w42nv5z9n0bipfcwhprb";
-    };
-  };
-  "safe_yaml" = {
-    version = "1.0.4";
-    source = {
-      type = "gem";
-      sha256 = "1hly915584hyi9q9vgd968x2nsi5yag9jyf5kq60lwzi5scr7094";
-    };
-  };
-  "sawyer" = {
-    version = "0.5.4";
-    source = {
-      type = "gem";
-      sha256 = "01kl4zpf0gaacnkra5nikrzfpwj8f10hsvgyzm7z2s1mz4iipx2v";
-    };
-    dependencies = [
-      "addressable"
-      "faraday"
-    ];
-  };
-  "shoulda-matchers" = {
-    version = "2.6.1";
-    source = {
-      type = "gem";
-      sha256 = "1p3jhvd4dsj6d7nbmvnqhqhpmb8pnr05pi7jv9ajwqcys8140mc1";
-    };
-    dependencies = [
-      "activesupport"
-    ];
-  };
-  "simplecov" = {
-    version = "0.9.1";
-    source = {
-      type = "gem";
-      sha256 = "06hylxlalaxxldpbaqa54gc52wxdff0fixdvjyzr6i4ygxwzr7yf";
-    };
-    dependencies = [
-      "docile"
-      "multi_json"
-      "simplecov-html"
-    ];
-  };
-  "simplecov-html" = {
-    version = "0.8.0";
-    source = {
-      type = "gem";
-      sha256 = "0jhn3jql73x7hsr00wwv984iyrcg0xhf64s90zaqv2f26blkqfb9";
-    };
-  };
-  "sprockets" = {
-    version = "2.12.3";
-    source = {
-      type = "gem";
-      sha256 = "1bn2drr8bc2af359dkfraq0nm0p1pib634kvhwn5lvj3r4vllnn2";
-    };
-    dependencies = [
-      "hike"
-      "multi_json"
-      "rack"
-      "tilt"
-    ];
-  };
-  "sprockets-rails" = {
-    version = "2.2.4";
-    source = {
-      type = "gem";
-      sha256 = "172cdg38cqsfgvrncjzj0kziz7kv6b1lx8pccd0blyphs25qf4gc";
-    };
-    dependencies = [
-      "actionpack"
-      "activesupport"
-      "sprockets"
-    ];
-  };
-  "sqlite3" = {
-    version = "1.3.9";
-    source = {
-      type = "gem";
-      sha256 = "07m6a6flmyyi0rkg0j7x1a9861zngwjnximfh95cli2zzd57914r";
-    };
-  };
-  "term-ansicolor" = {
-    version = "1.3.0";
-    source = {
-      type = "gem";
-      sha256 = "1a2gw7gmpmx57sdpyhjwl0zn4bqp7jyjz7aslpvvphd075layp4b";
-    };
-    dependencies = [
-      "tins"
-    ];
-  };
-  "thor" = {
-    version = "0.19.1";
-    source = {
-      type = "gem";
-      sha256 = "08p5gx18yrbnwc6xc0mxvsfaxzgy2y9i78xq7ds0qmdm67q39y4z";
-    };
-  };
-  "thread_safe" = {
-    version = "0.3.4";
-    source = {
-      type = "gem";
-      sha256 = "1cil2zcdzqkyr8zrwhlg7gywryg36j4mxlxw0h0x0j0wjym5nc8n";
-    };
-  };
-  "tilt" = {
-    version = "1.4.1";
-    source = {
-      type = "gem";
-      sha256 = "00sr3yy7sbqaq7cb2d2kpycajxqf1b1wr1yy33z4bnzmqii0b0ir";
-    };
-  };
-  "tins" = {
-    version = "1.3.0";
-    source = {
-      type = "gem";
-      sha256 = "1yxa5kyp9mw4w866wlg7c32ingzqxnzh3ir9yf06pwpkmq3mrbdi";
-    };
-  };
-  "tzinfo" = {
-    version = "1.2.2";
-    source = {
-      type = "gem";
-      sha256 = "1c01p3kg6xvy1cgjnzdfq45fggbwish8krd0h864jvbpybyx7cgx";
-    };
-    dependencies = [
-      "thread_safe"
-    ];
-  };
-  "webmock" = {
-    version = "1.20.0";
-    source = {
-      type = "gem";
-      sha256 = "0bl5v0xzcj24lx7xpsnywv3liqnqb5lfxysmmfb2fgi0n8586i6m";
-    };
-    dependencies = [
-      "addressable"
-      "crack"
-    ];
-  };
-}
--- a/pkgs/applications/networking/cluster/panamax/ui/Gemfile
+++ b/pkgs/applications/networking/cluster/panamax/ui/Gemfile
@ -1,31 +0,0 @@
-source 'https://rubygems.org'
-
-gem 'rails', '4.1.7'
-gem 'puma', '2.8.2'
-gem 'sass', '3.3.9'
-gem 'therubyracer', '0.12.1', platforms: :ruby
-gem 'haml', '4.0.5'
-gem 'uglifier', '2.5.1'
-gem 'ctl_base_ui'
-gem 'activeresource', '4.0.0'
-gem 'kramdown', '1.4.0'
-gem 'zeroclipboard-rails'
-
-
-group :test, :development do
-  gem 'rspec-rails'
-  gem 'its'
-  gem 'capybara'
-  gem 'teaspoon'
-  gem 'phantomjs'
-  gem 'dotenv-rails', '0.11.1'
-  gem 'pry'
-  gem 'pry-byebug'
-  gem 'pry-stack_explorer'
-end
-
-group :test do
-  gem 'webmock'
-  gem 'sinatra', '1.4.5'
-  gem 'coveralls', '0.7.0'
-end
--- a/pkgs/applications/networking/cluster/panamax/ui/Gemfile.lock
+++ b/pkgs/applications/networking/cluster/panamax/ui/Gemfile.lock
@ -1,226 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    actionmailer (4.1.7)
-      actionpack (= 4.1.7)
-      actionview (= 4.1.7)
-      mail (~> 2.5, >= 2.5.4)
-    actionpack (4.1.7)
-      actionview (= 4.1.7)
-      activesupport (= 4.1.7)
-      rack (~> 1.5.2)
-      rack-test (~> 0.6.2)
-    actionview (4.1.7)
-      activesupport (= 4.1.7)
-      builder (~> 3.1)
-      erubis (~> 2.7.0)
-    activemodel (4.1.7)
-      activesupport (= 4.1.7)
-      builder (~> 3.1)
-    activerecord (4.1.7)
-      activemodel (= 4.1.7)
-      activesupport (= 4.1.7)
-      arel (~> 5.0.0)
-    activeresource (4.0.0)
-      activemodel (~> 4.0)
-      activesupport (~> 4.0)
-      rails-observers (~> 0.1.1)
-    activesupport (4.1.7)
-      i18n (~> 0.6, >= 0.6.9)
-      json (~> 1.7, >= 1.7.7)
-      minitest (~> 5.1)
-      thread_safe (~> 0.1)
-      tzinfo (~> 1.1)
-    addressable (2.3.6)
-    arel (5.0.1.20140414130214)
-    binding_of_caller (0.7.2)
-      debug_inspector (>= 0.0.1)
-    builder (3.2.2)
-    byebug (3.5.1)
-      columnize (~> 0.8)
-      debugger-linecache (~> 1.2)
-      slop (~> 3.6)
-    capybara (2.4.4)
-      mime-types (>= 1.16)
-      nokogiri (>= 1.3.3)
-      rack (>= 1.0.0)
-      rack-test (>= 0.5.4)
-      xpath (~> 2.0)
-    coderay (1.1.0)
-    columnize (0.8.9)
-    coveralls (0.7.0)
-      multi_json (~> 1.3)
-      rest-client
-      simplecov (>= 0.7)
-      term-ansicolor
-      thor
-    crack (0.4.2)
-      safe_yaml (~> 1.0.0)
-    ctl_base_ui (0.0.5)
-      haml (~> 4.0)
-      jquery-rails (~> 3.1)
-      jquery-ui-rails (~> 4.2)
-      rails (~> 4.1)
-      sass (~> 3.3)
-    debug_inspector (0.0.2)
-    debugger-linecache (1.2.0)
-    diff-lcs (1.2.5)
-    docile (1.1.5)
-    dotenv (0.11.1)
-      dotenv-deployment (~> 0.0.2)
-    dotenv-deployment (0.0.2)
-    dotenv-rails (0.11.1)
-      dotenv (= 0.11.1)
-    erubis (2.7.0)
-    execjs (2.2.2)
-    haml (4.0.5)
-      tilt
-    hike (1.2.3)
-    i18n (0.7.0)
-    its (0.2.0)
-      rspec-core
-    jquery-rails (3.1.2)
-      railties (>= 3.0, < 5.0)
-      thor (>= 0.14, < 2.0)
-    jquery-ui-rails (4.2.1)
-      railties (>= 3.2.16)
-    json (1.8.2)
-    kramdown (1.4.0)
-    libv8 (3.16.14.11)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
-    method_source (0.8.2)
-    mime-types (2.4.3)
-    mini_portile (0.6.1)
-    minitest (5.5.1)
-    multi_json (1.10.1)
-    netrc (0.8.0)
-    nokogiri (1.6.5)
-      mini_portile (~> 0.6.0)
-    phantomjs (1.9.7.1)
-    pry (0.10.1)
-      coderay (~> 1.1.0)
-      method_source (~> 0.8.1)
-      slop (~> 3.4)
-    pry-byebug (2.0.0)
-      byebug (~> 3.4)
-      pry (~> 0.10)
-    pry-stack_explorer (0.4.9.1)
-      binding_of_caller (>= 0.7)
-      pry (>= 0.9.11)
-    puma (2.8.2)
-      rack (>= 1.1, < 2.0)
-    rack (1.5.2)
-    rack-protection (1.5.3)
-      rack
-    rack-test (0.6.3)
-      rack (>= 1.0)
-    rails (4.1.7)
-      actionmailer (= 4.1.7)
-      actionpack (= 4.1.7)
-      actionview (= 4.1.7)
-      activemodel (= 4.1.7)
-      activerecord (= 4.1.7)
-      activesupport (= 4.1.7)
-      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.1.7)
-      sprockets-rails (~> 2.0)
-    rails-observers (0.1.2)
-      activemodel (~> 4.0)
-    railties (4.1.7)
-      actionpack (= 4.1.7)
-      activesupport (= 4.1.7)
-      rake (>= 0.8.7)
-      thor (>= 0.18.1, < 2.0)
-    rake (10.4.0)
-    ref (1.0.5)
-    rest-client (1.7.2)
-      mime-types (>= 1.16, < 3.0)
-      netrc (~> 0.7)
-    rspec-core (3.1.7)
-      rspec-support (~> 3.1.0)
-    rspec-expectations (3.1.2)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.1.0)
-    rspec-mocks (3.1.3)
-      rspec-support (~> 3.1.0)
-    rspec-rails (3.1.0)
-      actionpack (>= 3.0)
-      activesupport (>= 3.0)
-      railties (>= 3.0)
-      rspec-core (~> 3.1.0)
-      rspec-expectations (~> 3.1.0)
-      rspec-mocks (~> 3.1.0)
-      rspec-support (~> 3.1.0)
-    rspec-support (3.1.2)
-    safe_yaml (1.0.4)
-    sass (3.3.9)
-    simplecov (0.9.1)
-      docile (~> 1.1.0)
-      multi_json (~> 1.0)
-      simplecov-html (~> 0.8.0)
-    simplecov-html (0.8.0)
-    sinatra (1.4.5)
-      rack (~> 1.4)
-      rack-protection (~> 1.4)
-      tilt (~> 1.3, >= 1.3.4)
-    slop (3.6.0)
-    sprockets (2.12.3)
-      hike (~> 1.2)
-      multi_json (~> 1.0)
-      rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    sprockets-rails (2.2.4)
-      actionpack (>= 3.0)
-      activesupport (>= 3.0)
-      sprockets (>= 2.8, < 4.0)
-    teaspoon (0.8.0)
-      railties (>= 3.2.5, < 5)
-    term-ansicolor (1.3.0)
-      tins (~> 1.0)
-    therubyracer (0.12.1)
-      libv8 (~> 3.16.14.0)
-      ref
-    thor (0.19.1)
-    thread_safe (0.3.4)
-    tilt (1.4.1)
-    tins (1.3.3)
-    tzinfo (1.2.2)
-      thread_safe (~> 0.1)
-    uglifier (2.5.1)
-      execjs (>= 0.3.0)
-      json (>= 1.8.0)
-    webmock (1.20.4)
-      addressable (>= 2.3.6)
-      crack (>= 0.3.2)
-    xpath (2.0.0)
-      nokogiri (~> 1.3)
-    zeroclipboard-rails (0.1.0)
-      railties (>= 3.1)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  activeresource (= 4.0.0)
-  capybara
-  coveralls (= 0.7.0)
-  ctl_base_ui
-  dotenv-rails (= 0.11.1)
-  haml (= 4.0.5)
-  its
-  kramdown (= 1.4.0)
-  phantomjs
-  pry
-  pry-byebug
-  pry-stack_explorer
-  puma (= 2.8.2)
-  rails (= 4.1.7)
-  rspec-rails
-  sass (= 3.3.9)
-  sinatra (= 1.4.5)
-  teaspoon
-  therubyracer (= 0.12.1)
-  uglifier (= 2.5.1)
-  webmock
-  zeroclipboard-rails
--- a/pkgs/applications/networking/cluster/panamax/ui/default.nix
+++ b/pkgs/applications/networking/cluster/panamax/ui/default.nix
@ -1,72 +0,0 @@
-{ stdenv, fetchgit, fetchurl, makeWrapper, bundlerEnv, bundler
-, ruby, openssl, sqlite, dataDir ? "/var/lib/panamax-ui"}@args:
-
-with stdenv.lib;
-
-stdenv.mkDerivation rec {
-  name = "panamax-ui-${version}";
-  version = "0.2.14";
-
-  env = bundlerEnv {
-    name = "panamax-ui-gems-${version}";
-    inherit ruby;
-    gemdir = ./.;
-  };
-
-  bundler = args.bundler.override { inherit ruby; };
-
-  src = fetchgit {
-    rev = "refs/tags/v${version}";
-    url = "git://github.com/CenturyLinkLabs/panamax-ui";
-    sha256 = "01k0h0rjqp5arvwxm2xpfxjsag5qw0qqlg7hx4v8f6jsyc4wmjfl";
-  };
-
-  buildInputs = [ makeWrapper env.ruby openssl sqlite bundler ];
-
-  setSourceRoot = ''
-    mkdir -p $out/share
-    cp -R panamax-ui $out/share/panamax-ui
-    export sourceRoot="$out/share/panamax-ui"
-  '';
-
-  postPatch = ''
-    find . -type f -iname "*.haml" -exec sed -e 's|CoreOS Journal|NixOS Journal|g' -i "{}" \;
-    find . -type f -iname "*.haml" -exec sed -e 's|CoreOS Local|NixOS Local|g' -i "{}" \;
-    find . -type f -iname "*.haml" -exec sed -e 's|CoreOS Host|NixOS Host|g' -i "{}" \;
-    sed -e 's|CoreOS Local|NixOS Local|g' -i "spec/features/manage_application_spec.rb"
-    # fix libv8 dependency
-    substituteInPlace Gemfile.lock --replace "3.16.14.7" "3.16.14.11"
-  '';
-
-  configurePhase = ''
-    export HOME=$PWD
-    export GEM_HOME=${env}/${env.ruby.gemPath}
-  '';
-
-  buildPhase = ''
-    rm -f ./bin/*
-    bundle exec rake rails:update:bin
-  '';
-
-  installPhase = ''
-    rm -rf log tmp db
-    ln -sf ${dataDir}/{db,state/log,state/tmp} .
-
-    mkdir -p $out/bin
-    makeWrapper bin/bundle "$out/bin/bundle" \
-      --run "cd $out/share/panamax-ui" \
-      --prefix "PATH" : "$out/share/panamax-ui/bin:${env.ruby}/bin:$PATH" \
-      --prefix "HOME" : "$out/share/panamax-ui" \
-      --prefix "GEM_HOME" : "${env}/${env.ruby.gemPath}" \
-      --prefix "GEM_PATH" : "$out/share/panamax-ui:${bundler}/${env.ruby.gemPath}"
-  '';
-
-  meta = with stdenv.lib; {
-    broken = true; # needs ruby 2.1
-    homepage = https://github.com/CenturyLinkLabs/panamax-ui;
-    description = "The Web GUI for Panamax";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ matejc offline ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/networking/cluster/panamax/ui/gemset.nix
+++ b/pkgs/applications/networking/cluster/panamax/ui/gemset.nix
@ -1,789 +0,0 @@
-{
-  "actionmailer" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "0qjv5akjbpgd4cx518k522mssvc3y3nki65hi6fj5nbzi7a6rwq5";
-    };
-    dependencies = [
-      "actionpack"
-      "actionview"
-      "mail"
-    ];
-  };
-  "actionpack" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "07y1ny00h69xklq260smyl5md052f617gqrzkyw5sxafs5z25zax";
-    };
-    dependencies = [
-      "actionview"
-      "activesupport"
-      "rack"
-      "rack-test"
-    ];
-  };
-  "actionview" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "06sp37gfpn2jn7j6vlpp1y6vfi5kig60vyvixrjhyz0g4vgm13ax";
-    };
-    dependencies = [
-      "activesupport"
-      "builder"
-      "erubis"
-    ];
-  };
-  "activemodel" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "0rlqzz25l7vsphgkilg80kmk20d9h357awi27ax6zzb9klkqh0jr";
-    };
-    dependencies = [
-      "activesupport"
-      "builder"
-    ];
-  };
-  "activerecord" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "0j4r0m32mjbwmz9gs8brln35jzr1cn7h585ggj0w0f1ai4hjsby5";
-    };
-    dependencies = [
-      "activemodel"
-      "activesupport"
-      "arel"
-    ];
-  };
-  "activeresource" = {
-    version = "4.0.0";
-    source = {
-      type = "gem";
-      sha256 = "0fc5igjijyjzsl9q5kybkdzhc92zv8wsv0ifb0y90i632jx6d4jq";
-    };
-    dependencies = [
-      "activemodel"
-      "activesupport"
-      "rails-observers"
-    ];
-  };
-  "activesupport" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "13i3mz66d5kp5y39gjwmcfqv0wb6mxm5k1nnz40wvd38dsf7n3bs";
-    };
-    dependencies = [
-      "i18n"
-      "json"
-      "minitest"
-      "thread_safe"
-      "tzinfo"
-    ];
-  };
-  "addressable" = {
-    version = "2.3.6";
-    source = {
-      type = "gem";
-      sha256 = "137fj0whmn1kvaq8wjalp8x4qbblwzvg3g4bfx8d8lfi6f0w48p8";
-    };
-  };
-  "arel" = {
-    version = "5.0.1.20140414130214";
-    source = {
-      type = "gem";
-      sha256 = "0dhnc20h1v8ml3nmkxq92rr7qxxpk6ixhwvwhgl2dbw9mmxz0hf9";
-    };
-  };
-  "binding_of_caller" = {
-    version = "0.7.2";
-    source = {
-      type = "gem";
-      sha256 = "15jg6dkaq2nzcd602d7ppqbdxw3aji961942w93crs6qw4n6h9yk";
-    };
-    dependencies = [
-      "debug_inspector"
-    ];
-  };
-  "builder" = {
-    version = "3.2.2";
-    source = {
-      type = "gem";
-      sha256 = "14fii7ab8qszrvsvhz6z2z3i4dw0h41a62fjr2h1j8m41vbrmyv2";
-    };
-  };
-  "byebug" = {
-    version = "3.5.1";
-    source = {
-      type = "gem";
-      sha256 = "0ldc2r0b316rrn2fgdgiznskj9gb0q9n60243laq7nqw9na8wdan";
-    };
-    dependencies = [
-      "columnize"
-      "debugger-linecache"
-      "slop"
-    ];
-  };
-  "capybara" = {
-    version = "2.4.4";
-    source = {
-      type = "gem";
-      sha256 = "114k4xi4nfbp3jfbxgwa3fksbwsyibx74gbdqpcgg3dxpmzkaa4f";
-    };
-    dependencies = [
-      "mime-types"
-      "nokogiri"
-      "rack"
-      "rack-test"
-      "xpath"
-    ];
-  };
-  "coderay" = {
-    version = "1.1.0";
-    source = {
-      type = "gem";
-      sha256 = "059wkzlap2jlkhg460pkwc1ay4v4clsmg1bp4vfzjzkgwdckr52s";
-    };
-  };
-  "columnize" = {
-    version = "0.8.9";
-    source = {
-      type = "gem";
-      sha256 = "1f3azq8pvdaaclljanwhab78hdw40k908ma2cwk59qzj4hvf7mip";
-    };
-  };
-  "coveralls" = {
-    version = "0.7.0";
-    source = {
-      type = "gem";
-      sha256 = "0sz30d7b83qqsj3i0fr691w05d62wj7x3afh0ryjkqkis3fq94j4";
-    };
-    dependencies = [
-      "multi_json"
-      "rest-client"
-      "simplecov"
-      "term-ansicolor"
-      "thor"
-    ];
-  };
-  "crack" = {
-    version = "0.4.2";
-    source = {
-      type = "gem";
-      sha256 = "1il94m92sz32nw5i6hdq14f1a2c3s9hza9zn6l95fvqhabq38k7a";
-    };
-    dependencies = [
-      "safe_yaml"
-    ];
-  };
-  "ctl_base_ui" = {
-    version = "0.0.5";
-    source = {
-      type = "gem";
-      sha256 = "1pji85xmddgld5lqx52zxi5r2kx6rsjwkqlr26bp62xb29r10x57";
-    };
-    dependencies = [
-      "haml"
-      "jquery-rails"
-      "jquery-ui-rails"
-      "rails"
-      "sass"
-    ];
-  };
-  "debug_inspector" = {
-    version = "0.0.2";
-    source = {
-      type = "gem";
-      sha256 = "109761g00dbrw5q0dfnbqg8blfm699z4jj70l4zrgf9mzn7ii50m";
-    };
-  };
-  "debugger-linecache" = {
-    version = "1.2.0";
-    source = {
-      type = "gem";
-      sha256 = "0iwyx190fd5vfwj1gzr8pg3m374kqqix4g4fc4qw29sp54d3fpdz";
-    };
-  };
-  "diff-lcs" = {
-    version = "1.2.5";
-    source = {
-      type = "gem";
-      sha256 = "1vf9civd41bnqi6brr5d9jifdw73j9khc6fkhfl1f8r9cpkdvlx1";
-    };
-  };
-  "docile" = {
-    version = "1.1.5";
-    source = {
-      type = "gem";
-      sha256 = "0m8j31whq7bm5ljgmsrlfkiqvacrw6iz9wq10r3gwrv5785y8gjx";
-    };
-  };
-  "dotenv" = {
-    version = "0.11.1";
-    source = {
-      type = "gem";
-      sha256 = "09z0y0d6bks7i0sqvd8szfqj9i1kkj01anzly7shi83b3gxhrq9m";
-    };
-    dependencies = [
-      "dotenv-deployment"
-    ];
-  };
-  "dotenv-deployment" = {
-    version = "0.0.2";
-    source = {
-      type = "gem";
-      sha256 = "1ad66jq9a09qq1js8wsyil97018s7y6x0vzji0dy34gh65sbjz8c";
-    };
-  };
-  "dotenv-rails" = {
-    version = "0.11.1";
-    source = {
-      type = "gem";
-      sha256 = "0r6hif0i1lipbi7mkxx7wa5clsn65n6wyd9jry262cx396lsfrqy";
-    };
-    dependencies = [
-      "dotenv"
-    ];
-  };
-  "erubis" = {
-    version = "2.7.0";
-    source = {
-      type = "gem";
-      sha256 = "1fj827xqjs91yqsydf0zmfyw9p4l2jz5yikg3mppz6d7fi8kyrb3";
-    };
-  };
-  "execjs" = {
-    version = "2.2.2";
-    source = {
-      type = "gem";
-      sha256 = "05m41mnxn4b2p133qzbz5cy9cc5rn57aa0pp2943hxmzbk379z1f";
-    };
-  };
-  "haml" = {
-    version = "4.0.5";
-    source = {
-      type = "gem";
-      sha256 = "1xmzb0k5q271090crzmv7dbw8ss4289bzxklrc0fhw6pw3kcvc85";
-    };
-    dependencies = [
-      "tilt"
-    ];
-  };
-  "hike" = {
-    version = "1.2.3";
-    source = {
-      type = "gem";
-      sha256 = "0i6c9hrszzg3gn2j41v3ijnwcm8cc2931fnjiv6mnpl4jcjjykhm";
-    };
-  };
-  "i18n" = {
-    version = "0.7.0";
-    source = {
-      type = "gem";
-      sha256 = "1i5z1ykl8zhszsxcs8mzl8d0dxgs3ylz8qlzrw74jb0gplkx6758";
-    };
-  };
-  "its" = {
-    version = "0.2.0";
-    source = {
-      type = "gem";
-      sha256 = "0rxwds9ipqp48mzqcaxzmfcqhawazg0zlhc1avv3i2cmm3np1z8g";
-    };
-    dependencies = [
-      "rspec-core"
-    ];
-  };
-  "jquery-rails" = {
-    version = "3.1.2";
-    source = {
-      type = "gem";
-      sha256 = "0h5a565i3l2mbd221m6mz9d1nr53pz19i9qxv08qr1dv0yx2pr3y";
-    };
-    dependencies = [
-      "railties"
-      "thor"
-    ];
-  };
-  "jquery-ui-rails" = {
-    version = "4.2.1";
-    source = {
-      type = "gem";
-      sha256 = "1garrnqwh35acj2pp4sp6fpm2g881h23y644lzbic2qmcrq9wd2v";
-    };
-    dependencies = [
-      "railties"
-    ];
-  };
-  "json" = {
-    version = "1.8.2";
-    source = {
-      type = "gem";
-      sha256 = "0zzvv25vjikavd3b1bp6lvbgj23vv9jvmnl4vpim8pv30z8p6vr5";
-    };
-  };
-  "kramdown" = {
-    version = "1.4.0";
-    source = {
-      type = "gem";
-      sha256 = "001vy0ymiwbvkdbb9wpqmswv6imliv7xim00gq6rlk0chnbiaq80";
-    };
-  };
-  libv8 = {
-    version = "3.16.14.11";
-    source = {
-      type = "gem";
-      sha256 = "000vbiy78wk5r1f6p7qncab8ldg7qw5pjz7bchn3lw700gpaacxp";
-    };
-  };
-  "mail" = {
-    version = "2.6.3";
-    source = {
-      type = "gem";
-      sha256 = "1nbg60h3cpnys45h7zydxwrl200p7ksvmrbxnwwbpaaf9vnf3znp";
-    };
-    dependencies = [
-      "mime-types"
-    ];
-  };
-  "method_source" = {
-    version = "0.8.2";
-    source = {
-      type = "gem";
-      sha256 = "1g5i4w0dmlhzd18dijlqw5gk27bv6dj2kziqzrzb7mpgxgsd1sf2";
-    };
-  };
-  "mime-types" = {
-    version = "2.4.3";
-    source = {
-      type = "gem";
-      sha256 = "16nissnb31wj7kpcaynx4gr67i7pbkzccfg8k7xmplbkla4rmwiq";
-    };
-  };
-  "mini_portile" = {
-    version = "0.6.1";
-    source = {
-      type = "gem";
-      sha256 = "07gah4k84sar9d850v9gip9b323pw74vwwndh3bbzxpw5iiwsd3l";
-    };
-  };
-  "minitest" = {
-    version = "5.5.1";
-    source = {
-      type = "gem";
-      sha256 = "1h8jn0rgmwy37jnhfcg55iilw0n370vgp8xnh0g5laa8rhv32fyn";
-    };
-  };
-  "multi_json" = {
-    version = "1.10.1";
-    source = {
-      type = "gem";
-      sha256 = "1ll21dz01jjiplr846n1c8yzb45kj5hcixgb72rz0zg8fyc9g61c";
-    };
-  };
-  "netrc" = {
-    version = "0.8.0";
-    source = {
-      type = "gem";
-      sha256 = "1j4jbdvd19kq34xiqx1yqb4wmcywyrlaky8hrh09c1hz3c0v5dkb";
-    };
-  };
-  "nokogiri" = {
-    version = "1.6.5";
-    source = {
-      type = "gem";
-      sha256 = "1xmxz6fa0m4p7c7ngpgz6gjgv65lzz63dsf0b6vh7gs2fkiw8j7l";
-    };
-    dependencies = [
-      "mini_portile"
-    ];
-  };
-  "phantomjs" = {
-    version = "1.9.7.1";
-    source = {
-      type = "gem";
-      sha256 = "14as0yzwbzvshbp1f8igjxcdxc5vbjgh0jhdvy393il084inlrl7";
-    };
-  };
-  "pry" = {
-    version = "0.10.1";
-    source = {
-      type = "gem";
-      sha256 = "1j0r5fm0wvdwzbh6d6apnp7c0n150hpm9zxpm5xvcgfqr36jaj8z";
-    };
-    dependencies = [
-      "coderay"
-      "method_source"
-      "slop"
-    ];
-  };
-  "pry-byebug" = {
-    version = "2.0.0";
-    source = {
-      type = "gem";
-      sha256 = "17b6720ci9345wkzj369ydyj6hdlg2krd26zivpd4dvaijszzgzq";
-    };
-    dependencies = [
-      "byebug"
-      "pry"
-    ];
-  };
-  "pry-stack_explorer" = {
-    version = "0.4.9.1";
-    source = {
-      type = "gem";
-      sha256 = "1828jqcfdr9nk86n15ky199vf33cfz51wkpv6kx230g0dsh9r85z";
-    };
-    dependencies = [
-      "binding_of_caller"
-      "pry"
-    ];
-  };
-  "puma" = {
-    version = "2.8.2";
-    source = {
-      type = "gem";
-      sha256 = "1l57fmf8vyxfjv7ab5znq0k339cym5ghnm5xxfvd1simjp73db0k";
-    };
-    dependencies = [
-      "rack"
-    ];
-  };
-  "rack" = {
-    version = "1.5.2";
-    source = {
-      type = "gem";
-      sha256 = "19szfw76cscrzjldvw30jp3461zl00w4xvw1x9lsmyp86h1g0jp6";
-    };
-  };
-  "rack-protection" = {
-    version = "1.5.3";
-    source = {
-      type = "gem";
-      sha256 = "0cvb21zz7p9wy23wdav63z5qzfn4nialik22yqp6gihkgfqqrh5r";
-    };
-    dependencies = [
-      "rack"
-    ];
-  };
-  "rack-test" = {
-    version = "0.6.3";
-    source = {
-      type = "gem";
-      sha256 = "0h6x5jq24makgv2fq5qqgjlrk74dxfy62jif9blk43llw8ib2q7z";
-    };
-    dependencies = [
-      "rack"
-    ];
-  };
-  "rails" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "059mpljplmhfz8rr4hk40q67fllcpsy809m4mwwbkm8qwif2z5r0";
-    };
-    dependencies = [
-      "actionmailer"
-      "actionpack"
-      "actionview"
-      "activemodel"
-      "activerecord"
-      "activesupport"
-      "railties"
-      "sprockets-rails"
-    ];
-  };
-  "rails-observers" = {
-    version = "0.1.2";
-    source = {
-      type = "gem";
-      sha256 = "1lsw19jzmvipvrfy2z04hi7r29dvkfc43h43vs67x6lsj9rxwwcy";
-    };
-    dependencies = [
-      "activemodel"
-    ];
-  };
-  "railties" = {
-    version = "4.1.7";
-    source = {
-      type = "gem";
-      sha256 = "1n08h0rgj0aq5lvslnih6lvqz9wadpz6nnb25i4qhp37fhhyz9yz";
-    };
-    dependencies = [
-      "actionpack"
-      "activesupport"
-      "rake"
-      "thor"
-    ];
-  };
-  "rake" = {
-    version = "10.4.0";
-    source = {
-      type = "gem";
-      sha256 = "0a10xzqc1lh6gjkajkslr0n40wjrniyiyzxkp9m5fc8wf7b74zw8";
-    };
-  };
-  "ref" = {
-    version = "1.0.5";
-    source = {
-      type = "gem";
-      sha256 = "19qgpsfszwc2sfh6wixgky5agn831qq8ap854i1jqqhy1zsci3la";
-    };
-  };
-  "rest-client" = {
-    version = "1.7.2";
-    source = {
-      type = "gem";
-      sha256 = "0h8c0prfi2v5p8iim3wm60xc4yripc13nqwq601bfl85k4gf25i0";
-    };
-    dependencies = [
-      "mime-types"
-      "netrc"
-    ];
-  };
-  "rspec-core" = {
-    version = "3.1.7";
-    source = {
-      type = "gem";
-      sha256 = "01bawvln663gffljwzpq3mrpa061cghjbvfbq15jvhmip3csxqc9";
-    };
-    dependencies = [
-      "rspec-support"
-    ];
-  };
-  "rspec-expectations" = {
-    version = "3.1.2";
-    source = {
-      type = "gem";
-      sha256 = "0m8d36wng1lpbcs54zhg1rxh63rgj345k3p0h0c06lgknz339nzh";
-    };
-    dependencies = [
-      "diff-lcs"
-      "rspec-support"
-    ];
-  };
-  "rspec-mocks" = {
-    version = "3.1.3";
-    source = {
-      type = "gem";
-      sha256 = "0gxk5w3klia4zsnp0svxck43xxwwfdqvhr3srv6p30f3m5q6rmzr";
-    };
-    dependencies = [
-      "rspec-support"
-    ];
-  };
-  "rspec-rails" = {
-    version = "3.1.0";
-    source = {
-      type = "gem";
-      sha256 = "1b1in3n1dc1bpf9wb3p3b2ynq05iacmr48jxzc73lj4g44ksh3wq";
-    };
-    dependencies = [
-      "actionpack"
-      "activesupport"
-      "railties"
-      "rspec-core"
-      "rspec-expectations"
-      "rspec-mocks"
-      "rspec-support"
-    ];
-  };
-  "rspec-support" = {
-    version = "3.1.2";
-    source = {
-      type = "gem";
-      sha256 = "14y6v9r9lrh91ry9r79h85v0f3y9ja25w42nv5z9n0bipfcwhprb";
-    };
-  };
-  "safe_yaml" = {
-    version = "1.0.4";
-    source = {
-      type = "gem";
-      sha256 = "1hly915584hyi9q9vgd968x2nsi5yag9jyf5kq60lwzi5scr7094";
-    };
-  };
-  "sass" = {
-    version = "3.3.9";
-    source = {
-      type = "gem";
-      sha256 = "0k19vj73283i907z4wfkc9qdska2b19z7ps6lcr5s4qzwis1zkmz";
-    };
-  };
-  "simplecov" = {
-    version = "0.9.1";
-    source = {
-      type = "gem";
-      sha256 = "06hylxlalaxxldpbaqa54gc52wxdff0fixdvjyzr6i4ygxwzr7yf";
-    };
-    dependencies = [
-      "docile"
-      "multi_json"
-      "simplecov-html"
-    ];
-  };
-  "simplecov-html" = {
-    version = "0.8.0";
-    source = {
-      type = "gem";
-      sha256 = "0jhn3jql73x7hsr00wwv984iyrcg0xhf64s90zaqv2f26blkqfb9";
-    };
-  };
-  "sinatra" = {
-    version = "1.4.5";
-    source = {
-      type = "gem";
-      sha256 = "0qyna3wzlnvsz69d21lxcm3ixq7db08mi08l0a88011qi4qq701s";
-    };
-    dependencies = [
-      "rack"
-      "rack-protection"
-      "tilt"
-    ];
-  };
-  "slop" = {
-    version = "3.6.0";
-    source = {
-      type = "gem";
-      sha256 = "00w8g3j7k7kl8ri2cf1m58ckxk8rn350gp4chfscmgv6pq1spk3n";
-    };
-  };
-  "sprockets" = {
-    version = "2.12.3";
-    source = {
-      type = "gem";
-      sha256 = "1bn2drr8bc2af359dkfraq0nm0p1pib634kvhwn5lvj3r4vllnn2";
-    };
-    dependencies = [
-      "hike"
-      "multi_json"
-      "rack"
-      "tilt"
-    ];
-  };
-  "sprockets-rails" = {
-    version = "2.2.4";
-    source = {
-      type = "gem";
-      sha256 = "172cdg38cqsfgvrncjzj0kziz7kv6b1lx8pccd0blyphs25qf4gc";
-    };
-    dependencies = [
-      "actionpack"
-      "activesupport"
-      "sprockets"
-    ];
-  };
-  "teaspoon" = {
-    version = "0.8.0";
-    source = {
-      type = "gem";
-      sha256 = "1j3brbm9cv5km9d9wzb6q2b3cvc6m254z48h7h77z1w6c5wr0p3z";
-    };
-    dependencies = [
-      "railties"
-    ];
-  };
-  "term-ansicolor" = {
-    version = "1.3.0";
-    source = {
-      type = "gem";
-      sha256 = "1a2gw7gmpmx57sdpyhjwl0zn4bqp7jyjz7aslpvvphd075layp4b";
-    };
-    dependencies = [
-      "tins"
-    ];
-  };
-  "therubyracer" = {
-    version = "0.12.1";
-    source = {
-      type = "gem";
-      sha256 = "106fqimqyaalh7p6czbl5m2j69z8gv7cm10mjb8bbb2p2vlmqmi6";
-    };
-    dependencies = [
-      "libv8"
-      "ref"
-    ];
-  };
-  "thor" = {
-    version = "0.19.1";
-    source = {
-      type = "gem";
-      sha256 = "08p5gx18yrbnwc6xc0mxvsfaxzgy2y9i78xq7ds0qmdm67q39y4z";
-    };
-  };
-  "thread_safe" = {
-    version = "0.3.4";
-    source = {
-      type = "gem";
-      sha256 = "1cil2zcdzqkyr8zrwhlg7gywryg36j4mxlxw0h0x0j0wjym5nc8n";
-    };
-  };
-  "tilt" = {
-    version = "1.4.1";
-    source = {
-      type = "gem";
-      sha256 = "00sr3yy7sbqaq7cb2d2kpycajxqf1b1wr1yy33z4bnzmqii0b0ir";
-    };
-  };
-  "tins" = {
-    version = "1.3.3";
-    source = {
-      type = "gem";
-      sha256 = "14jnsg15wakdk1ljh2iv9yvzk8nb7gpzd2zw4yvjikmffqjyqvna";
-    };
-  };
-  "tzinfo" = {
-    version = "1.2.2";
-    source = {
-      type = "gem";
-      sha256 = "1c01p3kg6xvy1cgjnzdfq45fggbwish8krd0h864jvbpybyx7cgx";
-    };
-    dependencies = [
-      "thread_safe"
-    ];
-  };
-  "uglifier" = {
-    version = "2.5.1";
-    source = {
-      type = "gem";
-      sha256 = "1vihq309mzv9a2i0s8v4imrn1g2kj8z0vr88q3i5b657c4kxzfp0";
-    };
-    dependencies = [
-      "execjs"
-      "json"
-    ];
-  };
-  "webmock" = {
-    version = "1.20.4";
-    source = {
-      type = "gem";
-      sha256 = "01cz13ybxbbvkpl21bcfv0p9ir8m2zcplx93ps01ma54p25z4mxr";
-    };
-    dependencies = [
-      "addressable"
-      "crack"
-    ];
-  };
-  "xpath" = {
-    version = "2.0.0";
-    source = {
-      type = "gem";
-      sha256 = "04kcr127l34p7221z13blyl0dvh0bmxwx326j72idayri36a394w";
-    };
-    dependencies = [
-      "nokogiri"
-    ];
-  };
-  "zeroclipboard-rails" = {
-    version = "0.1.0";
-    source = {
-      type = "gem";
-      sha256 = "00ixal0a0mxaqsyzp06c6zz4qdwqydy1qv4n7hbyqfhbmsdalcfc";
-    };
-    dependencies = [
-      "railties"
-    ];
-  };
-}
--- a/pkgs/applications/networking/instant-messengers/baresip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/baresip/default.nix
@ -1,6 +1,5 @@
-{stdenv, fetchurl, zlib, openssl, libre, librem, pkgconfig
-, cairo, mpg123, gstreamer, gst-ffmpeg, gst-plugins-base, gst-plugins-bad
-, gst-plugins-good, alsaLib, SDL, libv4l, celt, libsndfile, srtp, ffmpeg
+{stdenv, fetchurl, zlib, openssl, libre, librem, pkgconfig, gst_all_1
+, cairo, mpg123, alsaLib, SDL, libv4l, celt, libsndfile, srtp, ffmpeg
 , gsm, speex, portaudio, spandsp, libuuid, ccache, libvpx
 }:
 stdenv.mkDerivation rec {
@ -11,11 +10,10 @@ stdenv.mkDerivation rec {
    sha256 = "02bf4fwirf3b7h3cr1jqm0xsjzza4fi9kg88424js2l0xywwzpgf";
  };
  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [zlib openssl libre librem
-    cairo mpg123 gstreamer gst-ffmpeg gst-plugins-base gst-plugins-bad gst-plugins-good
+  buildInputs = [zlib openssl libre librem cairo mpg123
    alsaLib SDL libv4l celt libsndfile srtp ffmpeg gsm speex portaudio spandsp libuuid
    ccache libvpx
-    ];
+  ] ++ (with gst_all_1; [ gstreamer gst-libav gst-plugins-base gst-plugins-bad gst-plugins-good ]);
  makeFlags = [
    "LIBRE_MK=${libre}/share/re/re.mk"
    "LIBRE_INC=${libre}/include/re"
@ -26,7 +24,7 @@ stdenv.mkDerivation rec {
    "CCACHE_DISABLE=1"

    "USE_ALSA=1" "USE_AMR=1" "USE_CAIRO=1" "USE_CELT=1"
-    "USE_CONS=1" "USE_EVDEV=1" "USE_FFMPEG=1"  "USE_GSM=1" "USE_GST=1"
+    "USE_CONS=1" "USE_EVDEV=1" "USE_FFMPEG=1"  "USE_GSM=1" "USE_GST1=1"
    "USE_L16=1" "USE_MPG123=1" "USE_OSS=1" "USE_PLC=1" "USE_VPX=1"
    "USE_PORTAUDIO=1" "USE_SDL=1" "USE_SNDFILE=1" "USE_SPEEX=1"
    "USE_SPEEX_AEC=1" "USE_SPEEX_PP=1" "USE_SPEEX_RESAMP=1" "USE_SRTP=1"
--- a/pkgs/applications/networking/instant-messengers/nheko/default.nix
+++ b/pkgs/applications/networking/instant-messengers/nheko/default.nix
@ -17,8 +17,8 @@ let
    src = fetchFromGitHub {
      owner = "mujx";
      repo = "matrix-structs";
-      rev = "91bb2b85a75d664007ef81aeb500d35268425922";
-      sha256 = "1v544pv18sd91gdrhbk0nm54fggprsvwwrkjmxa59jrvhwdk7rsx";
+      rev = "690080daa3bc1984297c4d7103cde9ea07e2e0b7";
+      sha256 = "0l6mncpdbjmrzp5a3q1jv0sxf7bwl5ljslrcjca1j2bjjbqb61bz";
    };

    postUnpack = ''
@ -47,13 +47,13 @@ let
 in
 stdenv.mkDerivation rec {
  name = "nheko-${version}";
-  version = "0.3.1";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "mujx";
    repo = "nheko";
    rev = "v${version}";
-    sha256 = "1dqd698p6wicz0x1lb6mzlwcp68sjkivanb9lwz3yy1mlmy8i3jn";
+    sha256 = "1yg6bk193mqj99x3sy0f20x3ggpl0ahrp36w6hhx7pyw5qm17342";
  };

  # This patch is likely not strictly speaking needed, but will help detect when
--- a/pkgs/applications/networking/instant-messengers/nheko/external-deps.patch
+++ b/pkgs/applications/networking/instant-messengers/nheko/external-deps.patch
@ -54,7 +54,7 @@ index cef00f6..e69de29 100644
 -  MatrixStructs
 -
 -  GIT_REPOSITORY https://github.com/mujx/matrix-structs
-  GIT_TAG 91bb2b85a75d664007ef81aeb500d35268425922
+-  GIT_TAG 690080daa3bc1984297c4d7103cde9ea07e2e0b7
 -
 -  BUILD_IN_SOURCE 1
 -  SOURCE_DIR ${MATRIX_STRUCTS_ROOT}
--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@ -3,11 +3,11 @@
 let configFile = writeText "riot-config.json" conf; in
 stdenv.mkDerivation rec {
  name= "riot-web-${version}";
-  version = "0.14.1";
+  version = "0.14.2";

  src = fetchurl {
    url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "08paca7wc135hspkv97bgh2a29hbg8vxv0mrp68mgwscpyrl6vnf";
+    sha256 = "1qma49a6lvr9anrry3vbhjhvy06bgapknnvbdljnbb3l9c99nmxi";
  };

  installPhase = ''
--- a/pkgs/applications/networking/instant-messengers/telepathy/logger/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/logger/default.nix
@ -7,7 +7,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "http://telepathy.freedesktop.org/releases/${project}/${name}.tar.bz2";
-    sha256 = "18i00l8lnp5dghqmgmpxnn0is2a20pkisxy0sb78hnd2dz0z6xnl";
+    sha256 = "1bjx85k7jyfi5pvl765fzc7q2iz9va51anrc2djv7caksqsdbjlg";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -1,14 +1,14 @@
 { stdenv, fetchurl, system, makeWrapper, makeDesktopItem,
-  alsaLib, dbus, glib, gstreamer, fontconfig, freetype, libpulseaudio, libxml2,
-  libxslt, libGLU_combined, nspr, nss, sqlite, utillinux, zlib, xorg, udev, expat, libv4l }:
+  alsaLib, dbus, glib, fontconfig, freetype, libpulseaudio,
+  utillinux, zlib, xorg, udev, sqlite, expat, libv4l, procps }:

 let

-  version = "2.0.106600.0904";
+  version = "2.0.123200.0405";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${version}/zoom_x86_64.tar.xz";
-      sha256 = "1dcr0rqgjingjqbqv37hqjhhwy8axnjyirrnmjk44b5xnh239w9s";
+      sha256 = "1ifwa2xf5mw1ll2j1f39qd7mpyxpc6xj3650dmlnxf525dsm573z";
    };
  };

@ -17,25 +17,20 @@ in stdenv.mkDerivation {

  src = srcs.${system};

-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];

  libPath = stdenv.lib.makeLibraryPath [
    alsaLib
-    dbus
+    expat
    glib
-    gstreamer
-    fontconfig
    freetype
    libpulseaudio
-    libxml2
-    libxslt
-    nspr
-    nss
+    zlib
+    dbus
+    fontconfig
    sqlite
    utillinux
-    zlib
    udev
-    expat

    xorg.libX11
    xorg.libSM
@ -79,6 +74,7 @@ in stdenv.mkDerivation {
    makeWrapper $packagePath/zoom $out/bin/zoom-us \
        --prefix LD_LIBRARY_PATH : "$packagePath:$libPath" \
        --prefix LD_PRELOAD : "${libv4l}/lib/v4l1compat.so" \
+        --prefix PATH : "${procps}/bin" \
        --set QT_PLUGIN_PATH "$packagePath/platforms" \
        --set QT_XKB_CONFIG_ROOT "${xorg.xkeyboardconfig}/share/X11/xkb" \
        --set QTCOMPOSE "${xorg.libX11.out}/share/X11/locale"
--- a/pkgs/applications/networking/ndppd/default.nix
+++ b/pkgs/applications/networking/ndppd/default.nix
@ -1,6 +1,11 @@
-{ stdenv, fetchFromGitHub, gzip, ... }:
+{ stdenv, fetchFromGitHub, fetchurl, gzip, ... }:

-stdenv.mkDerivation rec {
+let
+  serviceFile = fetchurl {
+    url = "https://raw.githubusercontent.com/DanielAdolfsson/ndppd/f37e8eb33dc68b3385ecba9b36a5efd92755580f/ndppd.service";
+    sha256 = "1zf54pzjfj9j9gr48075njqrgad4myd3dqmhvzxmjy4gjy9ixmyh";
+  };
+in stdenv.mkDerivation rec {
  name = "ndppd-${version}";
  version = "0.2.5";

@ -19,6 +24,16 @@ stdenv.mkDerivation rec {
    substituteInPlace Makefile --replace /bin/gzip ${gzip}/bin/gzip
  '';

+  postInstall = ''
+    mkdir -p $out/etc
+    cp ndppd.conf-dist $out/etc/ndppd.conf
+
+    mkdir -p $out/lib/systemd/system
+    # service file needed for our module is not in release yet
+    substitute ${serviceFile} $out/lib/systemd/system/ndppd.service \
+      --replace /usr/sbin/ndppd $out/sbin/ndppd
+  '';
+
  meta = {
    description = "A daemon that proxies NDP (Neighbor Discovery Protocol) messages between interfaces";
    homepage = https://github.com/DanielAdolfsson/ndppd;
--- a/pkgs/applications/networking/newsreaders/liferea/default.nix
+++ b/pkgs/applications/networking/newsreaders/liferea/default.nix
@ -6,13 +6,13 @@

 let
  pname = "liferea";
-  version = "1.12.2";
+  version = "1.12.3";
 in stdenv.mkDerivation rec {
  name = "${pname}-${version}";

  src = fetchurl {
    url = "https://github.com/lwindolf/${pname}/releases/download/v${version}/${name}.tar.bz2";
-    sha256 = "18mz1drp6axvjbr9jdw3i0ijl3l2m191198p4c93qnm7g96ldh15";
+    sha256 = "0wm2c8qrgnadq63fivai53xm7vl05wgxc0nk39jcriscdikzqpcg";
  };

  nativeBuildInputs = [ wrapGAppsHook python3Packages.wrapPython intltool pkgconfig ];
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@ -10,11 +10,11 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "qbittorrent-${version}";
-  version = "4.0.4";
+  version = "4.1.0";

  src = fetchurl {
    url = "mirror://sourceforge/qbittorrent/${name}.tar.xz";
-    sha256 = "13sw0sdw2agm49plp9xvkg6wva274drpvgz76dqj4j2kfxx9s2jk";
+    sha256 = "0fdr74sc31x421sb69vlgal1hxpccjxxk8hrrzz9f5bg4jv895pw";
  };

  nativeBuildInputs = [ pkgconfig which ];
--- a/Show More
+++ b/Show More