esteve
March 17, 2026, 6:00pm
6563
master ← esteve:add-vcs2l
opened 05:52PM - 13 Mar 26 UTC
## Things done
[vcstool](https://github.com/dirk-thomas/vcstool/) has been un… maintained since January 2022, [vcs2l](https://github.com/ros-infrastructure/vcs2l/) supersedes it.
- Built on platform:
- [x] x86_64-linux
- [ ] aarch64-linux
- [ ] x86_64-darwin
- [ ] aarch64-darwin
- Tested, as applicable:
- [ ] [NixOS tests] in [nixos/tests].
- [ ] [Package tests] at `passthru.tests`.
- [ ] Tests in [lib/tests] or [pkgs/test] for functions and "core" functionality.
- [ ] Ran `nixpkgs-review` on this PR. See [nixpkgs-review usage].
- [ ] Tested basic functionality of all binary files, usually in `./result/bin/`.
- Nixpkgs Release Notes
- [ ] Package update: when the change is major or breaking.
- NixOS Release Notes
- [ ] Module addition: when adding a new NixOS module.
- [ ] Module update: when the change is significant.
- [ ] Fits [CONTRIBUTING.md], [pkgs/README.md], [maintainers/README.md] and other READMEs.
[NixOS tests]: https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests
[Package tests]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests
[nixpkgs-review usage]: https://github.com/Mic92/nixpkgs-review#usage
[CONTRIBUTING.md]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md
[lib/tests]: https://github.com/NixOS/nixpkgs/blob/master/lib/tests
[maintainers/README.md]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md
[nixos/tests]: https://github.com/NixOS/nixpkgs/blob/master/nixos/tests
[pkgs/README.md]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md
[pkgs/test]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/test
PR drops vcstool (which has been unmaintained upstream since January 2022) and adds vcs2l, which supersedes. I kept the original maintainer of the vcstool package in vcs2l and added myself, but I wasn’t sure if they are interested in mantaining the vcs2l package.
PRs for adding better systemd creds support to radicle & keycloak.
These have been sitting for a little while now, I’d really like to know what path forward there might be to getting these approved, absolutely willing to put more time into reworking them if needs be but I need the feedback.
master ← eliasvasylenko:keycloak-add-systemd-creds-import-options
opened 08:50PM - 19 Jan 26 UTC
Instead of passing secrets to keycloak via filesystem paths and LoadCredentials,… we use credential names and ImportCredentials. This is more flexible, allowing credentials to be resolved by different systemd mechanisms, and allowing encrypted creds to be used.
**Note:** Presented as an alternative strategy to https://github.com/NixOS/nixpkgs/pull/475836, and as an exploration of @arianvp's comments there.
### Alternatives
#### Disable a credential by setting it to null
This would mean e.g. folding the `passwordCredential` and `enablePassword` options into a single option, with `null` representing disabling the password. But then we have to pick either "default disabled" or have a "default name", we can't have it both ways. Meaning we'd either remove the default names like `keycloak.db_password` and always expect the user to configure a name, or we'd keep the default name and if the user wants to disable a cred they must explicitly set it to null.
#### No name options at all
We could go the other way and remove the `passwordCredential`, `sslCertCredential`, etc. options and prescribe that credential's must be passed in with the default names.
This is maybe a bit less flexible as you then can't easily support using the same credential between multiple services that expect it by different names.
The generic _secret options could be specified as `my_keycloak_option._secret = true` and then the credential name derived as `keycloak.settings.my_keycloak_option`.
#### No enable options
We could remove the `enablePassword`, `enableSSL` options and say that whether these options are enabled is determined dynamically by the presence of the appropriate credentials.
This is arguably less safe as there is no verification that the intended secrets are provided... if creds get misconfigured accidentally and stop being presented to the service it may just silently continue to work with e.g. passwords or certs accidentally disabled.
#### No name *or* enable options
As both of the above, and now there are no options relating to secrets. The generic _secret options could still be handled with a single glob pattern e.g. `ImportCredential = "keycloak.settings.*"` and dynamically mapped into the settings. This makes configuration a bit more dynamic and a bit more complex to add to the config - we can't statically template them and use `replace-secret`.
## Things done
- Built on platform:
- [ ] x86_64-linux
- [ ] aarch64-linux
- [ ] x86_64-darwin
- [ ] aarch64-darwin
- Tested, as applicable:
- [x] [NixOS tests] in [nixos/tests].
- [ ] [Package tests] at `passthru.tests`.
- [ ] Tests in [lib/tests] or [pkgs/test] for functions and "core" functionality.
- [ ] Ran `nixpkgs-review` on this PR. See [nixpkgs-review usage].
- [ ] Tested basic functionality of all binary files, usually in `./result/bin/`.
- Nixpkgs Release Notes
- [x] Package update: when the change is major or breaking.
- NixOS Release Notes
- [ ] Module addition: when adding a new NixOS module.
- [x] Module update: when the change is significant.
- [x] Fits [CONTRIBUTING.md], [pkgs/README.md], [maintainers/README.md] and other READMEs.
[NixOS tests]: https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests
[Package tests]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests
[nixpkgs-review usage]: https://github.com/Mic92/nixpkgs-review#usage
[CONTRIBUTING.md]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md
[lib/tests]: https://github.com/NixOS/nixpkgs/blob/master/lib/tests
[maintainers/README.md]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md
[nixos/tests]: https://github.com/NixOS/nixpkgs/blob/master/nixos/tests
[pkgs/README.md]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md
[pkgs/test]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/test
master ← eliasvasylenko:introduce-systemd-creds-option-utils
opened 09:27AM - 01 Jan 26 UTC
Update radicle to support systemd creds more completely via ImportCredential.
…
By default it will look for the cred names supported by the upstream package (https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5/patches/cfbc8ab4edd0eddb24e56a7ce56a1a0f6d2d3d39, https://radicle.xyz/2026/01/14/radicle-1.6.0), but alternate cred names can be chosen to produce a rename on the ImportCredential.
-------
_The following text is out of date, describing a previous approach that was more complex and more flexible, left for posterity..._
I intend to add support for encrypted creds to various systemd services in nixpkgs, and looking around for examples to draw from there appears to only be the `radicle` module. So I've used this as a starting point and refactored it on top of some reusable library utilities, with the aim to apply these utilities more widely if they get accepted.
My motivation is that I use encrypted creds extensively in my own nixos configs, and they can be painful to retrofit to existing modules. Also the way creds are configured in radicle is enough for most use-cases, but there are valid use-cases for surfacing the underlying systemd features more faithfully on an opt-in basis (on the part of the end-user). I think establishing some patterns for this and trying to propagate them into a few more modules would benefit everyone.
### Things done
- Added a new mkCredentialOption utility for credentials, which may be given either as a string/path, or as a submodule allowing to specify the name of the credential, whether it's encrypted, etc. alongside the path.
- Ported radicle module onto new utils.
- ~~Added new test to make sure backwards-compat not broken for existing encrypted/unencrypted options in radicle.~~
Notes:
I noticed a comment in the radicle module that you can't use the %d specifier BindReadOnlyPaths but this does seem to work. It may be that systemd added this capability since this module was written so I updated to use it.
Users can continue to use `privateKeyFile = "cred:/some/my/path";` to configure an encrypted credential, but now can also say e.g. `privateKeyFile.LoadCredential = "cred-name:/some/my/path";` to configure an unencrypted credential with an explicit credential name (which may be valuable for certain use-cases, e.g. I think if the path points to a socket).
Note: for basic use like `privateKeyFile = "/some/my/path";`, when the setting doesn't contain ":" it will continue to be interpreted as a file path. This is backwards compatible for radicle, and is also the most sensible default behaviour for 99% of users who don't care about this stuff. For users who do want to opt into richer systemd config options like `privateKeyFile.LoadCredential = "cred-name";` the setting will be passed straight to systemd as-is, which means without a ":" it will be interpreted as the credential ID.
- Built on platform:
- [ ] x86_64-linux
- [ ] aarch64-linux
- [ ] x86_64-darwin
- [ ] aarch64-darwin
- Tested, as applicable:
- [x] [NixOS tests] in [nixos/tests].
- [ ] [Package tests] at `passthru.tests`.
- [ ] Tests in [lib/tests] or [pkgs/test] for functions and "core" functionality.
- [x] Ran `nixpkgs-review` on this PR. See [nixpkgs-review usage].
- [ ] Tested basic functionality of all binary files, usually in `./result/bin/`.
- Nixpkgs Release Notes
- [ ] Package update: when the change is major or breaking.
- NixOS Release Notes
- [ ] Module addition: when adding a new NixOS module.
- [x] Module update: when the change is significant.
- [ ] Fits [CONTRIBUTING.md], [pkgs/README.md], [maintainers/README.md] and other READMEs.
[NixOS tests]: https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests
[Package tests]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests
[nixpkgs-review usage]: https://github.com/Mic92/nixpkgs-review#usage
[CONTRIBUTING.md]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md
[lib/tests]: https://github.com/NixOS/nixpkgs/blob/master/lib/tests
[maintainers/README.md]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md
[nixos/tests]: https://github.com/NixOS/nixpkgs/blob/master/nixos/tests
[pkgs/README.md]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md
[pkgs/test]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/test
---
Add a :+1: [reaction] to [pull requests you find important].
[reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
[pull requests you find important]: https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+sort%3Areactions-%2B1-desc
master ← Princemachiavelli:jhoffer/fix_ignored_failed_bootloader
opened 09:28PM - 18 Mar 26 UTC
Previously, if `boot.loader.systemd-boot.extraInstallCommands` was non-empty, er… rors from `systemdBootBuilder` would be ignored. If `/boot` was too small to install every boot entry, the `OSError: [Errno 28] No space left on device:` python error would be present in stdout/stdeer but the return code would still indicate success.
## Things done
Manually tested on x86 hardware, `switch-to-configuration boot` now exists with non-zero exit code and `Failed to install bootloader` message if any failures occur in `install-systemd-boot.sh`.
If you used the boot.loader.systemd-boot.extraInstallCommands option then any errors installing the bootloader entries would just be ignored. This could present as systems not updating whet their /boot partition is too full. Just enable the standard best practice errexit, pipefail, etc. resolves this.