path: root/nixos/doc/manual/release-notes/rl-2009.section.md

# Release 20.09 ("Nightingale", 2020.10/27) {#sec-release-20.09}

Support is planned until the end of June 2021, handing over to 21.05. (Plans [ have shifted](https://github.com/NixOS/rfcs/blob/master/rfcs/0080-nixos-release-schedule.md#core-changes) by two months since release of 20.09.)

## Highlights {#sec-release-20.09-highlights}

In addition to 7349 new, 14442 updated, and 8181 removed packages, this release has the following highlights:

- Core version changes:

  - gcc: 9.2.0 -\> 9.3.0

  - glibc: 2.30 -\> 2.31

  - linux: still defaults to 5.4.x, all supported kernels available

  - mesa: 19.3.5 -\> 20.1.7

- Desktop Environments:

  - plasma5: 5.17.5 -\> 5.18.5

  - kdeApplications: 19.12.3 -\> 20.08.1

  - gnome3: 3.34 -\> 3.36, see its [release notes](https://help.gnome.org/misc/release-notes/3.36/)

  - cinnamon: added at 4.6

  - NixOS now distributes an official [GNOME ISO](https://nixos.org/download.html#nixos-iso)

- Programming Languages and Frameworks:

  - Agda ecosystem was heavily reworked (see more details below)

  - PHP now defaults to PHP 7.4, updated from 7.3

  - PHP 7.2 is no longer supported due to upstream not supporting this version for the entire lifecycle of the 20.09 release

  - Python 3 now defaults to Python 3.8 instead of 3.7

  - Python 3.5 reached its upstream EOL at the end of September 2020: it has been removed from the list of available packages

- Databases and Service Monitoring:

  - MariaDB has been updated to 10.4, MariaDB Galera to 26.4. Please read the related upgrade instructions under [backwards incompatibilities](#sec-release-20.09-incompatibilities) before upgrading.

  - Zabbix now defaults to 5.0, updated from 4.4. Please read related sections under [backwards compatibilities](#sec-release-20.09-incompatibilities) before upgrading.

- Major module changes:

  - Quickly configure a complete, private, self-hosted video conferencing solution with the new Jitsi Meet module.

  - Two new options, [authorizedKeysCommand](options.html#opt-services.openssh.authorizedKeysCommand) and [authorizedKeysCommandUser](options.html#opt-services.openssh.authorizedKeysCommandUser), have been added to the `openssh` module. If you have `AuthorizedKeysCommand` in your [services.openssh.extraConfig](options.html#opt-services.openssh.extraConfig) you should make use of these new options instead.

  - There is a new module for Podman (`virtualisation.podman`), a drop-in replacement for the Docker command line.

  - The new `virtualisation.containers` module manages configuration shared by the CRI-O and Podman modules.

  - Declarative Docker containers are renamed from `docker-containers` to `virtualisation.oci-containers.containers`. This is to make it possible to use `podman` instead of `docker`.

  - The new option [documentation.man.generateCaches](options.html#opt-documentation.man.generateCaches) has been added to automatically generate the `man-db` caches, which are needed by utilities like `whatis` and `apropos`. The caches are generated during the build of the NixOS configuration: since this can be expensive when a large number of packages are installed, the feature is disabled by default.

  - `services.postfix.sslCACert` was replaced by `services.postfix.tlsTrustedAuthorities` which now defaults to system certificate authorities.

  - The various documented workarounds to use steam have been converted to a module. `programs.steam.enable` enables steam, controller support and the workarounds.

  - Support for built-in LCDs in various pieces of Logitech hardware (keyboards and USB speakers). `hardware.logitech.lcd.enable` enables support for all hardware supported by the [g15daemon project](https://sourceforge.net/projects/g15daemon/).

  - The GRUB module gained support for basic password protection, which allows to restrict non-default entries in the boot menu to one or more users. The users and passwords are defined via the option `boot.loader.grub.users`. Note: Password support is only available in GRUB version 2.

- NixOS module changes:

  - The NixOS module system now supports freeform modules as a mix between `types.attrsOf` and `types.submodule`. These allow you to explicitly declare a subset of options while still permitting definitions without an associated option. See [](#sec-freeform-modules) for how to use them.

  - Following its deprecation in 20.03, the Perl NixOS test driver has been removed. All remaining tests have been ported to the Python test framework. Code outside nixpkgs using `make-test.nix` or `testing.nix` needs to be ported to `make-test-python.nix` and `testing-python.nix` respectively.

  - Subordinate GID and UID mappings are now set up automatically for all normal users. This will make container tools like Podman work as non-root users out of the box.

- Starting with this release, the hydra-build-result `nixos-YY.MM` branches no longer exist in the [deprecated nixpkgs-channels repository](https://github.com/nixos/nixpkgs-channels). These branches are now in [the main nixpkgs repository](https://github.com/nixos/nixpkgs).

## New Services {#sec-release-20.09-new-services}

In addition to 1119 new, 118 updated, and 476 removed options; 61 new modules were added since the last release:

- Hardware:

  - [hardware.system76.firmware-daemon.enable](options.html#opt-hardware.system76.firmware-daemon.enable) adds easy support of system76 firmware

  - [hardware.uinput.enable](options.html#opt-hardware.uinput.enable) loads uinput kernel module

  - [hardware.video.hidpi.enable](options.html#opt-hardware.video.hidpi.enable) enable good defaults for HiDPI displays

  - [hardware.wooting.enable](options.html#opt-hardware.wooting.enable) support for Wooting keyboards

  - [hardware.xpadneo.enable](options.html#opt-hardware.xpadneo.enable) xpadneo driver for Xbox One wireless controllers

- Programs:

  - [programs.hamster.enable](options.html#opt-programs.hamster.enable) enable hamster time tracking

  - [programs.steam.enable](options.html#opt-programs.steam.enable) adds easy enablement of steam and related system configuration

- Security:

  - [security.doas.enable](options.html#opt-security.doas.enable) alternative to sudo, allows non-root users to execute commands as root

  - [security.tpm2.enable](options.html#opt-security.tpm2.enable) add Trusted Platform Module 2 support

- System:

  - [boot.initrd.network.openvpn.enable](options.html#opt-boot.initrd.network.openvpn.enable) start an OpenVPN client during initrd boot

- Virtualization:

  - [boot.enableContainers](options.html#opt-boot.enableContainers) use nixos-containers

  - [virtualisation.oci-containers.containers](options.html#opt-virtualisation.oci-containers.containers) run OCI (Docker) containers

  - [virtualisation.podman.enable](options.html#opt-virtualisation.podman.enable) daemonless container engine

- Services:

  - [services.ankisyncd.enable](options.html#opt-services.ankisyncd.enable) Anki sync server

  - [services.bazarr.enable](options.html#opt-services.bazarr.enable) Subtitle manager for Sonarr and Radarr

  - [services.biboumi.enable](options.html#opt-services.biboumi.enable) Biboumi XMPP gateway to IRC

  - [services.blockbook-frontend](options.html#opt-services.blockbook-frontend) Blockbook-frontend, a service for the Trezor wallet

  - [services.cage.enable](options.html#opt-services.cage.enable) Wayland cage service

  - [services.convos.enable](options.html#opt-services.convos.enable) IRC daemon, which can be accessed throught the browser

  - [services.engelsystem.enable](options.html#opt-services.engelsystem.enable) Tool for coordinating volunteers and shifts on large events

  - [services.espanso.enable](options.html#opt-services.espanso.enable) text-expander written in rust

  - [services.foldingathome.enable](options.html#opt-services.foldingathome.enable) Folding\@home client

  - [services.gerrit.enable](options.html#opt-services.gerrit.enable) Web-based team code collaboration tool

  - [services.go-neb.enable](options.html#opt-services.go-neb.enable) Matrix bot

  - [services.hardware.xow.enable](options.html#opt-services.hardware.xow.enable) xow as a systemd service

  - [services.hercules-ci-agent.enable](options.html#opt-services.hercules-ci-agent.enable) Hercules CI build agent

  - [services.jicofo.enable](options.html#opt-services.jicofo.enable) Jitsi Conference Focus, component of Jitsi Meet

  - [services.jirafeau.enable](options.html#opt-services.jirafeau.enable) A web file repository

  - [services.jitsi-meet.enable](options.html#opt-services.jitsi-meet.enable) Secure, simple and scalable video conferences

  - [services.jitsi-videobridge.enable](options.html#opt-services.jitsi-videobridge.enable) Jitsi Videobridge, a WebRTC compatible router

  - [services.jupyterhub.enable](options.html#opt-services.jupyterhub.enable) Jupyterhub development server

  - [services.k3s.enable](options.html#opt-services.k3s.enable) Lightweight Kubernetes distribution

  - [services.magic-wormhole-mailbox-server.enable](options.html#opt-services.magic-wormhole-mailbox-server.enable) Magic Wormhole Mailbox Server

  - [services.malcontent.enable](options.html#opt-services.malcontent.enable) Parental Control support

  - [services.matrix-appservice-discord.enable](options.html#opt-services.matrix-appservice-discord.enable) Matrix and Discord bridge

  - [services.mautrix-telegram.enable](options.html#opt-services.mautrix-telegram.enable) Matrix-Telegram puppeting/relaybot bridge

  - [services.mirakurun.enable](options.html#opt-services.mirakurun.enable) Japanese DTV Tuner Server Service

  - [services.molly-brown.enable](options.html#opt-services.molly-brown.enable) Molly-Brown Gemini server

  - [services.mullvad-vpn.enable](options.html#opt-services.mullvad-vpn.enable) Mullvad VPN daemon

  - [services.ncdns.enable](options.html#opt-services.ncdns.enable) Namecoin to DNS bridge

  - [services.nextdns.enable](options.html#opt-services.nextdns.enable) NextDNS to DoH Proxy service

  - [services.nix-store-gcs-proxy](options.html#opt-services.nix-store-gcs-proxy) Google storage bucket to be used as a nix store

  - [services.onedrive.enable](options.html#opt-services.onedrive.enable) OneDrive sync service

  - [services.pinnwand.enable](options.html#opt-services.pinnwand.enable) Pastebin-like service

  - [services.pixiecore.enable](options.html#opt-services.pixiecore.enable) Manage network booting of machines

  - [services.privacyidea.enable](options.html#opt-services.privacyidea.enable) Privacy authentication server

  - [services.quorum.enable](options.html#opt-services.quorum.enable) Quorum blockchain daemon

  - [services.robustirc-bridge.enable](options.html#opt-services.robustirc-bridge.enable) RobustIRC bridge

  - [services.rss-bridge.enable](options.html#opt-services.rss-bridge.enable) Generate RSS and Atom feeds

  - [services.rtorrent.enable](options.html#opt-services.rtorrent.enable) rTorrent service

  - [services.smartdns.enable](options.html#opt-services.smartdns.enable) SmartDNS DNS server

  - [services.sogo.enable](options.html#opt-services.sogo.enable) SOGo groupware

  - [services.teeworlds.enable](options.html#opt-services.teeworlds.enable) Teeworlds game server

  - [services.torque.mom.enable](options.html#opt-services.torque.mom.enable) torque computing node

  - [services.torque.server.enable](options.html#opt-services.torque.server.enable) torque server

  - [services.tuptime.enable](options.html#opt-services.tuptime.enable) A total uptime service

  - [services.urserver.enable](options.html#opt-services.urserver.enable) X11 remote server

  - [services.wasabibackend.enable](options.html#opt-services.wasabibackend.enable) Wasabi backend service

  - [services.yubikey-agent.enable](options.html#opt-services.yubikey-agent.enable) Yubikey agent

  - [services.zigbee2mqtt.enable](options.html#opt-services.zigbee2mqtt.enable) Zigbee to MQTT bridge

## Backward Incompatibilities {#sec-release-20.09-incompatibilities}

When upgrading from a previous release, please be aware of the following incompatible changes:

- MariaDB has been updated to 10.4, MariaDB Galera to 26.4. Before you upgrade, it would be best to take a backup of your database. For MariaDB Galera Cluster, see [Upgrading from MariaDB 10.3 to MariaDB 10.4 with Galera Cluster](https://mariadb.com/kb/en/upgrading-from-mariadb-103-to-mariadb-104-with-galera-cluster/) instead. Before doing the upgrade read [Incompatible Changes Between 10.3 and 10.4](https://mariadb.com/kb/en/upgrading-from-mariadb-103-to-mariadb-104/#incompatible-changes-between-103-and-104). After the upgrade you will need to run `mysql_upgrade`. MariaDB 10.4 introduces a number of changes to the authentication process, intended to make things easier and more intuitive. See [Authentication from MariaDB 10.4](https://mariadb.com/kb/en/authentication-from-mariadb-104/). unix_socket auth plugin does not use a password, and uses the connecting user\'s UID instead. When a new MariaDB data directory is initialized, two MariaDB users are created and can be used with new unix_socket auth plugin, as well as traditional mysql_native_password plugin: root\@localhost and mysql\@localhost. To actually use the traditional mysql_native_password plugin method, one must run the following:

  ```nix
  {
  services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" ''
    ALTER USER root@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD("verysecret");
  '';
  }
  ```

  When MariaDB data directory is just upgraded (not initialized), the users are not created or modified.

- MySQL server is now started with additional systemd sandbox/hardening options for better security. The PrivateTmp, ProtectHome, and ProtectSystem options may be problematic when MySQL is attempting to read from or write to your filesystem anywhere outside of its own state directory, for example when calling `LOAD DATA INFILE or SELECT * INTO OUTFILE`. In this scenario a variant of the following may be required: - allow MySQL to read from /home and /tmp directories when using `LOAD DATA INFILE`

  ```nix
  {
    systemd.services.mysql.serviceConfig.ProtectHome = lib.mkForce "read-only";
  }
  ```

  \- allow MySQL to write to custom folder `/var/data` when using `SELECT * INTO OUTFILE`, assuming the mysql user has write access to `/var/data`

  ```nix
  {
    systemd.services.mysql.serviceConfig.ReadWritePaths = [ "/var/data" ];
  }
  ```

  The MySQL service no longer runs its `systemd` service startup script as `root` anymore. A dedicated non `root` super user account is required for operation. This means users with an existing MySQL or MariaDB database server are required to run the following SQL statements as a super admin user before upgrading:

  ```SQL
  CREATE USER IF NOT EXISTS 'mysql'@'localhost' identified with unix_socket;
  GRANT ALL PRIVILEGES ON *.* TO 'mysql'@'localhost' WITH GRANT OPTION;
  ```

  If you use MySQL instead of MariaDB please replace `unix_socket` with