Merge master into staging-next

2024-11-18 15:56:50 +01:00 · 2021-07-03 12:01:23 +00:00 · 2021-07-03 12:01:23 +00:00 · 6cead635ad
commit 6cead635ad
parent 77a94d88ad 1e61298bf5
62 changed files with 576 additions and 270 deletions
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@ -11,7 +11,7 @@ name: "Periodic Merges (24h)"
 on:
  schedule:
    # * is a special character in YAML so you have to quote this string
-    # Merge every 6 hours
+    # Merge every 24 hours
    - cron:  '0 0 * * *'

 jobs:
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -339,6 +339,116 @@
          release instead of the old 2.31.0 version.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <literal>bitwarden_rs</literal> packages and modules were
+          renamed to <literal>vaultwarden</literal>
+          <link xlink:href="https://github.com/dani-garcia/vaultwarden/discussions/1642">following
+          upstream</link>. More specifically,
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              <literal>pkgs.bitwarden_rs</literal>,
+              <literal>pkgs.bitwarden_rs-sqlite</literal>,
+              <literal>pkgs.bitwarden_rs-mysql</literal> and
+              <literal>pkgs.bitwarden_rs-postgresql</literal> were
+              renamed to <literal>pkgs.vaultwarden</literal>,
+              <literal>pkgs.vaultwarden-sqlite</literal>,
+              <literal>pkgs.vaultwarden-mysql</literal> and
+              <literal>pkgs.vaultwarden-postgresql</literal>,
+              respectively.
+            </para>
+            <itemizedlist spacing="compact">
+              <listitem>
+                <para>
+                  Old names are preserved as aliases for backwards
+                  compatibility, but may be removed in the future.
+                </para>
+              </listitem>
+              <listitem>
+                <para>
+                  The <literal>bitwarden_rs</literal> executable was
+                  also renamed to <literal>vaultwarden</literal> in all
+                  packages.
+                </para>
+              </listitem>
+            </itemizedlist>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>pkgs.bitwarden_rs-vault</literal> was renamed to
+              <literal>pkgs.vaultwarden-vault</literal>.
+            </para>
+            <itemizedlist spacing="compact">
+              <listitem>
+                <para>
+                  <literal>pkgs.bitwarden_rs-vault</literal> is
+                  preserved as an alias for backwards compatibility, but
+                  may be removed in the future.
+                </para>
+              </listitem>
+              <listitem>
+                <para>
+                  The static files were moved from
+                  <literal>/usr/share/bitwarden_rs</literal> to
+                  <literal>/usr/share/vaultwarden</literal>.
+                </para>
+              </listitem>
+            </itemizedlist>
+          </listitem>
+          <listitem>
+            <para>
+              The <literal>services.bitwarden_rs</literal> config module
+              was renamed to <literal>services.vaultwarden</literal>.
+            </para>
+            <itemizedlist spacing="compact">
+              <listitem>
+                <para>
+                  <literal>services.bitwarden_rs</literal> is preserved
+                  as an alias for backwards compatibility, but may be
+                  removed in the future.
+                </para>
+              </listitem>
+            </itemizedlist>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>systemd.services.bitwarden_rs</literal>,
+              <literal>systemd.services.backup-bitwarden_rs</literal>
+              and <literal>systemd.timers.backup-bitwarden_rs</literal>
+              were renamed to
+              <literal>systemd.services.vaultwarden</literal>,
+              <literal>systemd.services.backup-vaultwarden</literal> and
+              <literal>systemd.timers.backup-vaultwarden</literal>,
+              respectively.
+            </para>
+            <itemizedlist spacing="compact">
+              <listitem>
+                <para>
+                  Old names are preserved as aliases for backwards
+                  compatibility, but may be removed in the future.
+                </para>
+              </listitem>
+            </itemizedlist>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>users.users.bitwarden_rs</literal> and
+              <literal>users.groups.bitwarden_rs</literal> were renamed
+              to <literal>users.users.vaultwarden</literal> and
+              <literal>users.groups.vaultwarden</literal>, respectively.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The data directory remains located at
+              <literal>/var/lib/bitwarden_rs</literal>, for backwards
+              compatibility.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-21.11-notable-changes">
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -85,6 +85,32 @@ In addition to numerous new and upgraded packages, this release has the followin
 * The `libwnck` package now defaults to the 3.x release instead of the
  old 2.31.0 version.

+* The `bitwarden_rs` packages and modules were renamed to `vaultwarden`
+  [following upstream](https://github.com/dani-garcia/vaultwarden/discussions/1642). More specifically,
+
+  * `pkgs.bitwarden_rs`, `pkgs.bitwarden_rs-sqlite`, `pkgs.bitwarden_rs-mysql` and
+    `pkgs.bitwarden_rs-postgresql` were renamed to `pkgs.vaultwarden`, `pkgs.vaultwarden-sqlite`,
+    `pkgs.vaultwarden-mysql` and `pkgs.vaultwarden-postgresql`, respectively.
+    * Old names are preserved as aliases for backwards compatibility, but may be removed in the future.
+    * The `bitwarden_rs` executable was also renamed to `vaultwarden` in all packages.
+
+  * `pkgs.bitwarden_rs-vault` was renamed to `pkgs.vaultwarden-vault`.
+    * `pkgs.bitwarden_rs-vault` is preserved as an alias for backwards compatibility, but may be removed in the future.
+    * The static files were moved from `/usr/share/bitwarden_rs` to `/usr/share/vaultwarden`.
+
+  * The `services.bitwarden_rs` config module was renamed to `services.vaultwarden`.
+    * `services.bitwarden_rs` is preserved as an alias for backwards compatibility, but may be removed in the future.
+
+  * `systemd.services.bitwarden_rs`, `systemd.services.backup-bitwarden_rs` and `systemd.timers.backup-bitwarden_rs`
+    were renamed to `systemd.services.vaultwarden`, `systemd.services.backup-vaultwarden` and
+    `systemd.timers.backup-vaultwarden`, respectively.
+    * Old names are preserved as aliases for backwards compatibility, but may be removed in the future.
+
+  * `users.users.bitwarden_rs` and `users.groups.bitwarden_rs` were renamed to `users.users.vaultwarden` and
+    `users.groups.vaultwarden`, respectively.
+
+  * The data directory remains located at `/var/lib/bitwarden_rs`, for backwards compatibility.
+
 ## Other Notable Changes {#sec-release-21.11-notable-changes}

 - The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -874,7 +874,6 @@
  ./services/search/hound.nix
  ./services/search/kibana.nix
  ./services/search/solr.nix
-  ./services/security/bitwarden_rs/default.nix
  ./services/security/certmgr.nix
  ./services/security/cfssl.nix
  ./services/security/clamav.nix
@ -900,6 +899,7 @@
  ./services/security/torsocks.nix
  ./services/security/usbguard.nix
  ./services/security/vault.nix
+  ./services/security/vaultwarden/default.nix
  ./services/security/yubikey-agent.nix
  ./services/system/cloud-init.nix
  ./services/system/dbus.nix
--- a/nixos/modules/services/networking/coturn.nix
+++ b/nixos/modules/services/networking/coturn.nix
@ -16,6 +16,7 @@ ${lib.optionalString cfg.lt-cred-mech "lt-cred-mech"}
 ${lib.optionalString cfg.no-auth "no-auth"}
 ${lib.optionalString cfg.use-auth-secret "use-auth-secret"}
 ${lib.optionalString (cfg.static-auth-secret != null) ("static-auth-secret=${cfg.static-auth-secret}")}
+${lib.optionalString (cfg.static-auth-secret-file != null) ("static-auth-secret=#static-auth-secret#")}
 realm=${cfg.realm}
 ${lib.optionalString cfg.no-udp "no-udp"}
 ${lib.optionalString cfg.no-tcp "no-tcp"}
@ -182,6 +183,13 @@ in {
          by a separate program, so this is why that other mode is 'dynamic'.
        '';
      };
+      static-auth-secret-file = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Path to the file containing the static authentication secret.
+        '';
+      };
      realm = mkOption {
        type = types.str;
        default = config.networking.hostName;
@ -293,42 +301,63 @@ in {
    };
  };

-  config = mkIf cfg.enable {
-    users.users.turnserver =
-      { uid = config.ids.uids.turnserver;
-        description = "coturn TURN server user";
-      };
-    users.groups.turnserver =
-      { gid = config.ids.gids.turnserver;
-        members = [ "turnserver" ];
-      };
+  config = mkIf cfg.enable (mkMerge ([
+    { assertions = [
+      { assertion = cfg.static-auth-secret != null -> cfg.static-auth-secret-file == null ;
+        message = "static-auth-secret and static-auth-secret-file cannot be set at the same time";
+      }
+    ];}

-    systemd.services.coturn = {
-      description = "coturn TURN server";
-      after = [ "network-online.target" ];
-      wants = [ "network-online.target" ];
-      wantedBy = [ "multi-user.target" ];
+    {
+      users.users.turnserver =
+        { uid = config.ids.uids.turnserver;
+          description = "coturn TURN server user";
+        };
+      users.groups.turnserver =
+        { gid = config.ids.gids.turnserver;
+          members = [ "turnserver" ];
+        };

-      unitConfig = {
-        Documentation = "man:coturn(1) man:turnadmin(1) man:turnserver(1)";
-      };
+      systemd.services.coturn = let
+        runConfig = "/run/coturn/turnserver.cfg";
+      in {
+        description = "coturn TURN server";
+        after = [ "network-online.target" ];
+        wants = [ "network-online.target" ];
+        wantedBy = [ "multi-user.target" ];

-      serviceConfig = {
-        Type = "simple";
-        ExecStart = "${pkgs.coturn}/bin/turnserver -c ${configFile}";
-        RuntimeDirectory = "turnserver";
-        User = "turnserver";
-        Group = "turnserver";
-        AmbientCapabilities =
-          mkIf (
-            cfg.listening-port < 1024 ||
-            cfg.alt-listening-port < 1024 ||
-            cfg.tls-listening-port < 1024 ||
-            cfg.alt-tls-listening-port < 1024 ||
-            cfg.min-port < 1024
-          ) "cap_net_bind_service";
-        Restart = "on-abort";
+        unitConfig = {
+          Documentation = "man:coturn(1) man:turnadmin(1) man:turnserver(1)";
+        };
+
+        preStart = ''
+          cat ${configFile} > ${runConfig}
+          ${optionalString (cfg.static-auth-secret-file != null) ''
+            STATIC_AUTH_SECRET="$(head -n1 ${cfg.static-auth-secret-file} || :)"
+            sed -e "s,#static-auth-secret#,$STATIC_AUTH_SECRET,g" \
+              -i ${runConfig}
+          '' }
+          chmod 640 ${runConfig}
+        '';
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${pkgs.coturn}/bin/turnserver -c ${runConfig}";
+          RuntimeDirectory = "turnserver";
+          User = "turnserver";
+          Group = "turnserver";
+          AmbientCapabilities =
+            mkIf (
+              cfg.listening-port < 1024 ||
+              cfg.alt-listening-port < 1024 ||
+              cfg.tls-listening-port < 1024 ||
+              cfg.alt-tls-listening-port < 1024 ||
+              cfg.min-port < 1024
+            ) "cap_net_bind_service";
+          Restart = "on-abort";
+        };
      };
-    };
-  };
+    systemd.tmpfiles.rules = [
+      "d  /run/coturn 0700 turnserver turnserver - -"
+    ];
+  }]));
 }
--- a/nixos/modules/services/security/bitwarden_rs/backup.sh
+++ b/nixos/modules/services/security/bitwarden_rs/backup.sh
@ -1,6 +1,6 @@
 #!/usr/bin/env bash

-# Based on: https://github.com/dani-garcia/bitwarden_rs/wiki/Backing-up-your-vault
+# Based on: https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault
 if ! mkdir -p "$BACKUP_FOLDER"; then
  echo "Could not create backup folder '$BACKUP_FOLDER'" >&2
  exit 1
--- a/nixos/modules/services/security/bitwarden_rs/default.nix
+++ b/nixos/modules/services/security/bitwarden_rs/default.nix
@ -3,9 +3,9 @@
 with lib;

 let
-  cfg = config.services.bitwarden_rs;
-  user = config.users.users.bitwarden_rs.name;
-  group = config.users.groups.bitwarden_rs.name;
+  cfg = config.services.vaultwarden;
+  user = config.users.users.vaultwarden.name;
+  group = config.users.groups.vaultwarden.name;

  # Convert name from camel case (e.g. disable2FARemember) to upper case snake case (e.g. DISABLE_2FA_REMEMBER).
  nameToEnvVar = name:
@ -26,22 +26,26 @@ let
        if value != null then [ (nameValuePair (nameToEnvVar name) (if isBool value then boolToString value else toString value)) ] else []
      ) cfg.config));
    in { DATA_FOLDER = "/var/lib/bitwarden_rs"; } // optionalAttrs (!(configEnv ? WEB_VAULT_ENABLED) || configEnv.WEB_VAULT_ENABLED == "true") {
-      WEB_VAULT_FOLDER = "${pkgs.bitwarden_rs-vault}/share/bitwarden_rs/vault";
+      WEB_VAULT_FOLDER = "${pkgs.vaultwarden-vault}/share/vaultwarden/vault";
    } // configEnv;

-  configFile = pkgs.writeText "bitwarden_rs.env" (concatStrings (mapAttrsToList (name: value: "${name}=${value}\n") configEnv));
+  configFile = pkgs.writeText "vaultwarden.env" (concatStrings (mapAttrsToList (name: value: "${name}=${value}\n") configEnv));

-  bitwarden_rs = pkgs.bitwarden_rs.override { inherit (cfg) dbBackend; };
+  vaultwarden = pkgs.vaultwarden.override { inherit (cfg) dbBackend; };

 in {
-  options.services.bitwarden_rs = with types; {
-    enable = mkEnableOption "bitwarden_rs";
+  imports = [
+    (mkRenamedOptionModule [ "services" "bitwarden_rs" ] [ "services" "vaultwarden" ])
+  ];
+
+  options.services.vaultwarden = with types; {
+    enable = mkEnableOption "vaultwarden";

    dbBackend = mkOption {
      type = enum [ "sqlite" "mysql" "postgresql" ];
      default = "sqlite";
      description = ''
-        Which database backend bitwarden_rs will be using.
+        Which database backend vaultwarden will be using.
      '';
    };

@ -49,7 +53,7 @@ in {
      type = nullOr str;
      default = null;
      description = ''
-        The directory under which bitwarden_rs will backup its persistent data.
+        The directory under which vaultwarden will backup its persistent data.
      '';
    };

@ -65,7 +69,7 @@ in {
        }
      '';
      description = ''
-        The configuration of bitwarden_rs is done through environment variables,
+        The configuration of vaultwarden is done through environment variables,
        therefore the names are converted from camel case (e.g. disable2FARemember)
        to upper case snake case (e.g. DISABLE_2FA_REMEMBER).
        In this conversion digits (0-9) are handled just like upper case characters,
@ -75,17 +79,17 @@ in {
        This allows working around any potential future conflicting naming conventions.

        Based on the attributes passed to this config option an environment file will be generated
-        that is passed to bitwarden_rs's systemd service.
+        that is passed to vaultwarden's systemd service.

        The available configuration options can be found in
-        <link xlink:href="https://github.com/dani-garcia/bitwarden_rs/blob/${bitwarden_rs.version}/.env.template">the environment template file</link>.
+        <link xlink:href="https://github.com/dani-garcia/vaultwarden/blob/${vaultwarden.version}/.env.template">the environment template file</link>.
      '';
    };

    environmentFile = mkOption {
      type = with types; nullOr path;
      default = null;
-      example = "/root/bitwarden_rs.env";
+      example = "/root/vaultwarden.env";
      description = ''
        Additional environment file as defined in <citerefentry>
        <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
@ -95,7 +99,7 @@ in {
        may be passed to the service without adding them to the world-readable Nix store.

        Note that this file needs to be available on the host on which
-        <literal>bitwarden_rs</literal> is running.
+        <literal>vaultwarden</literal> is running.
      '';
    };
  };
@ -106,20 +110,21 @@ in {
      message = "Backups for database backends other than sqlite will need customization";
    } ];

-    users.users.bitwarden_rs = {
+    users.users.vaultwarden = {
      inherit group;
      isSystemUser = true;
    };
-    users.groups.bitwarden_rs = { };
+    users.groups.vaultwarden = { };

-    systemd.services.bitwarden_rs = {
+    systemd.services.vaultwarden = {
+      aliases = [ "bitwarden_rs" ];
      after = [ "network.target" ];
      path = with pkgs; [ openssl ];
      serviceConfig = {
        User = user;
        Group = group;
        EnvironmentFile = [ configFile ] ++ optional (cfg.environmentFile != null) cfg.environmentFile;
-        ExecStart = "${bitwarden_rs}/bin/bitwarden_rs";
+        ExecStart = "${vaultwarden}/bin/vaultwarden";
        LimitNOFILE = "1048576";
        PrivateTmp = "true";
        PrivateDevices = "true";
@ -131,15 +136,16 @@ in {
      wantedBy = [ "multi-user.target" ];
    };

-    systemd.services.backup-bitwarden_rs = mkIf (cfg.backupDir != null) {
-      description = "Backup bitwarden_rs";
+    systemd.services.backup-vaultwarden = mkIf (cfg.backupDir != null) {
+      aliases = [ "backup-bitwarden_rs" ];
+      description = "Backup vaultwarden";
      environment = {
        DATA_FOLDER = "/var/lib/bitwarden_rs";
        BACKUP_FOLDER = cfg.backupDir;
      };
      path = with pkgs; [ sqlite ];
      serviceConfig = {
-        SyslogIdentifier = "backup-bitwarden_rs";
+        SyslogIdentifier = "backup-vaultwarden";
        Type = "oneshot";
        User = mkDefault user;
        Group = mkDefault group;
@ -148,12 +154,13 @@ in {
      wantedBy = [ "multi-user.target" ];
    };

-    systemd.timers.backup-bitwarden_rs = mkIf (cfg.backupDir != null) {
-      description = "Backup bitwarden_rs on time";
+    systemd.timers.backup-vaultwarden = mkIf (cfg.backupDir != null) {
+      aliases = [ "backup-bitwarden_rs" ];
+      description = "Backup vaultwarden on time";
      timerConfig = {
        OnCalendar = mkDefault "23:00";
        Persistent = "true";
-        Unit = "backup-bitwarden_rs.service";
+        Unit = "backup-vaultwarden.service";
      };
      wantedBy = [ "multi-user.target" ];
    };
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -42,7 +42,6 @@ in
  bind = handleTest ./bind.nix {};
  bitcoind = handleTest ./bitcoind.nix {};
  bittorrent = handleTest ./bittorrent.nix {};
-  bitwarden = handleTest ./bitwarden.nix {};
  blockbook-frontend = handleTest ./blockbook-frontend.nix {};
  boot = handleTestOn ["x86_64-linux"] ./boot.nix {}; # syslinux is unsupported on aarch64
  boot-stage1 = handleTest ./boot-stage1.nix {};
@ -88,6 +87,7 @@ in
  containers-tmpfs = handleTest ./containers-tmpfs.nix {};
  convos = handleTest ./convos.nix {};
  corerad = handleTest ./corerad.nix {};
+  coturn = handleTest ./coturn.nix {};
  couchdb = handleTest ./couchdb.nix {};
  cri-o = handleTestOn ["x86_64-linux"] ./cri-o.nix {};
  custom-ca = handleTest ./custom-ca.nix {};
@ -446,6 +446,7 @@ in
  v2ray = handleTest ./v2ray.nix {};
  vault = handleTest ./vault.nix {};
  vault-postgresql = handleTest ./vault-postgresql.nix {};
+  vaultwarden = handleTest ./vaultwarden.nix {};
  vector = handleTest ./vector.nix {};
  victoriametrics = handleTest ./victoriametrics.nix {};
  virtualbox = handleTestOn ["x86_64-linux"] ./virtualbox.nix {};
--- a/nixos/tests/coturn.nix
+++ b/nixos/tests/coturn.nix
@ -0,0 +1,29 @@
+import ./make-test-python.nix ({ ... }: {
+  name = "coturn";
+  nodes = {
+    default = {
+      services.coturn.enable = true;
+    };
+    secretsfile = {
+      boot.postBootCommands = ''
+        echo "some-very-secret-string" > /run/coturn-secret
+      '';
+      services.coturn = {
+        enable = true;
+        static-auth-secret-file = "/run/coturn-secret";
+      };
+    };
+  };
+
+  testScript =
+    ''
+      start_all()
+
+      with subtest("by default works without configuration"):
+          default.wait_for_unit("coturn.service")
+
+      with subtest("works with static-auth-secret-file"):
+          secretsfile.wait_for_unit("coturn.service")
+          secretsfile.succeed("grep 'some-very-secret-string' /run/coturn/turnserver.cfg")
+    '';
+})
--- a/nixos/tests/vaultwarden.nix
+++ b/nixos/tests/vaultwarden.nix
@ -4,7 +4,7 @@
 }:

 # These tests will:
-#  * Set up a bitwarden-rs server
+#  * Set up a vaultwarden server
 #  * Have Firefox use the web vault to create an account, log in, and save a password to the valut
 #  * Have the bw cli log in and read that password from the vault
 #
@ -24,8 +24,8 @@ let

  storedPassword = "seeeecret";

-  makeBitwardenTest = backend: makeTest {
-    name = "bitwarden_rs-${backend}";
+  makeVaultwardenTest = backend: makeTest {
+    name = "vaultwarden-${backend}";
    meta = {
      maintainers = with pkgs.lib.maintainers; [ jjjollyjim ];
    };
@ -45,9 +45,9 @@ let
              package = pkgs.mariadb;
            };

-            services.bitwarden_rs.config.databaseUrl = "mysql://bitwardenuser:${dbPassword}@localhost/bitwarden";
+            services.vaultwarden.config.databaseUrl = "mysql://bitwardenuser:${dbPassword}@localhost/bitwarden";

-            systemd.services.bitwarden_rs.after = [ "mysql.service" ];
+            systemd.services.vaultwarden.after = [ "mysql.service" ];
          };

          postgresql = {
@ -60,9 +60,9 @@ let
              '';
            };

-            services.bitwarden_rs.config.databaseUrl = "postgresql://bitwardenuser:${dbPassword}@localhost/bitwarden";
+            services.vaultwarden.config.databaseUrl = "postgresql://bitwardenuser:${dbPassword}@localhost/bitwarden";

-            systemd.services.bitwarden_rs.after = [ "postgresql.service" ];
+            systemd.services.vaultwarden.after = [ "postgresql.service" ];
          };

          sqlite = { };
@ -71,7 +71,7 @@ let
        mkMerge [
          backendConfig.${backend}
          {
-            services.bitwarden_rs = {
+            services.vaultwarden = {
              enable = true;
              dbBackend = backend;
              config.rocketPort = 80;
@ -152,7 +152,7 @@ let

    testScript = ''
      start_all()
-      server.wait_for_unit("bitwarden_rs.service")
+      server.wait_for_unit("vaultwarden.service")
      server.wait_for_open_port(80)

      with subtest("configure the cli"):
@ -184,6 +184,6 @@ let
 in
 builtins.listToAttrs (
  map
-    (backend: { name = backend; value = makeBitwardenTest backend; })
+    (backend: { name = backend; value = makeVaultwardenTest backend; })
    backends
 )
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@ -91,7 +91,7 @@ stdenv.mkDerivation rec {
    homepage = "https://about.draw.io/";
    license = licenses.asl20;
    changelog = "https://github.com/jgraph/drawio-desktop/releases/tag/v${version}";
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@ -107,7 +107,7 @@ stdenv.mkDerivation rec {
    description = "Multi-platform password manager";
    homepage = "https://1password.com/";
    license = licenses.unfree;
-    maintainers = with maintainers; [ danieldk timstott savannidgerinel ];
+    maintainers = with maintainers; [ timstott savannidgerinel ];
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/misc/otpclient/default.nix
+++ b/pkgs/applications/misc/otpclient/default.nix
@ -0,0 +1,36 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, pkg-config
+, gtk3
+, wrapGAppsHook
+, jansson
+, libgcrypt
+, libzip
+, libpng
+, libcotp
+, zbar
+}:
+
+stdenv.mkDerivation rec {
+  pname = "otpclient";
+  version = "2.4.4";
+
+  src = fetchFromGitHub {
+    owner = "paolostivanin";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0zjvhcx9q8nsf97zikddxriky0kghi4j4i7312s94pl8c7kb4abr";
+  };
+
+  buildInputs = [ gtk3 jansson libgcrypt libzip libpng libcotp zbar ];
+  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook ];
+
+  meta = with lib; {
+    description = "Highly secure and easy to use OTP client written in C/GTK that supports both TOTP and HOTP";
+    homepage = "https://github.com/paolostivanin/OTPClient";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ alexbakker ];
+  };
+}
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@ -62,7 +62,7 @@ mkChromiumDerivation (base: rec {
      -e '/\[Desktop Entry\]/a\' \
      -e 'StartupWMClass=chromium-browser' \
      $out/share/applications/chromium-browser.desktop
-  '' + lib.optionalString (channel == "dev") ''
+  '' + lib.optionalString (channel != "stable") ''
    cp -v "$buildPath/crashpad_handler" "$libExecPath/"
  '';

--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "dnscontrol";
-  version = "3.10.0";
+  version = "3.10.1";

  src = fetchFromGitHub {
    owner = "StackExchange";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-22wYc6W4a5P9+JW7NW+s85IlQ+tfLhYzDarN6PGkFk4=";
+    sha256 = "sha256-fYQqH/J027XJPML/qKMpuu2Nxuvb0cyjOu2czLH8SoM=";
  };

-  vendorSha256 = "sha256-TPvO/E/uOyVSMNRQ3zzt15+i0UK0uHvI4qM5PqmHY20=";
+  vendorSha256 = "sha256-225TR9jTZSGEJZz3csl/pR/v2unUK67l08x5ESQTJzA=";

  subPackages = [ "." ];

--- a/pkgs/applications/office/softmaker/generic.nix
+++ b/pkgs/applications/office/softmaker/generic.nix
@ -123,7 +123,7 @@ in stdenv.mkDerivation {
    description = "An office suite with a word processor, spreadsheet and presentation program";
    homepage = "https://www.softmaker.com/";
    license = licenses.unfree;
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/office/super-productivity/default.nix
+++ b/pkgs/applications/office/super-productivity/default.nix
@ -5,11 +5,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "super-productivity";
-  version = "6.5.2";
+  version = "7.2.1";

  src = fetchurl {
    url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-${version}.AppImage";
-    sha256 = "1ivl7chsv9axgk6nqkf580pav651hchi3di0mrp0pylpsqgk6f1f";
+    sha256 = "93eeb56fe923c48a9384cde0633e98a9d9dc5c0869fce63b9724ff74bb400049";
    name = "${pname}-${version}.AppImage";
  };

--- a/pkgs/applications/system/glances/default.nix
+++ b/pkgs/applications/system/glances/default.nix
@ -9,14 +9,14 @@

 buildPythonApplication rec {
  pname = "glances";
-  version = "3.1.7";
+  version = "3.2.0";
  disabled = isPyPy;

  src = fetchFromGitHub {
    owner = "nicolargo";
    repo = "glances";
    rev = "v${version}";
-    sha256 = "sha256-82ZD32dqRYGbGM/uyaJ5VqVZbhDZthiEcTihkV43JOU=";
+    sha256 = "126xpx8i85giy3hkhqh0qcln9i1qj5bfciaqh9486rkl54xm8zsr";
  };

  # Some tests fail in the sandbox (they e.g. require access to /sys/class/power_supply):
@ -48,7 +48,7 @@ buildPythonApplication rec {
  meta = with lib; {
    homepage = "https://nicolargo.github.io/glances/";
    description = "Cross-platform curses-based monitoring tool";
-    changelog = "https://github.com/nicolargo/glances/releases/tag/v${version}";
+    changelog = "https://github.com/nicolargo/glances/blob/v${version}/NEWS.rst";
    license = licenses.lgpl3Only;
    maintainers = with maintainers; [ jonringer primeos koral ];
  };
--- a/pkgs/applications/video/makemkv/default.nix
+++ b/pkgs/applications/video/makemkv/default.nix
@ -72,6 +72,6 @@ in mkDerivation {
    license = licenses.unfree;
    homepage = "http://makemkv.com";
    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ danieldk titanous ];
+    maintainers = with maintainers; [ titanous ];
  };
 }
--- a/pkgs/applications/window-managers/sway/idle.nix
+++ b/pkgs/applications/window-managers/sway/idle.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub
-, meson, ninja, pkg-config, scdoc
+, meson, ninja, pkg-config, scdoc, wayland-scanner
 , wayland, wayland-protocols, systemd
 }:

@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
      --replace "version: '1.5'" "version: '${version}'"
  '';

-  nativeBuildInputs = [ meson ninja pkg-config scdoc ];
+  nativeBuildInputs = [ meson ninja pkg-config scdoc wayland-scanner ];
  buildInputs = [ wayland wayland-protocols systemd ];

  mesonFlags = [ "-Dman-pages=enabled" "-Dlogind=enabled" ];
--- a/pkgs/applications/window-managers/sway/lock.nix
+++ b/pkgs/applications/window-managers/sway/lock.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub
-, meson, ninja, pkg-config, scdoc
+, meson, ninja, pkg-config, scdoc, wayland-scanner
 , wayland, wayland-protocols, libxkbcommon, cairo, gdk-pixbuf, pam
 }:

@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
      --replace "version: '1.4'" "version: '${version}'"
  '';

-  nativeBuildInputs = [ meson ninja pkg-config scdoc ];
+  nativeBuildInputs = [ meson ninja pkg-config scdoc wayland-scanner ];
  buildInputs = [ wayland wayland-protocols libxkbcommon cairo gdk-pixbuf pam ];

  mesonFlags = [
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -117,7 +117,8 @@ rec {
        --tmpdir=$TMPDIR \
        --override-os ${os} \
        --override-arch ${arch} \
-        copy "$sourceURL" "docker-archive://$out:$destNameTag"
+        copy "$sourceURL" "docker-archive://$out:$destNameTag" \
+        | cat  # pipe through cat to force-disable progress bar
    '';

  # We need to sum layer.tar, not a directory, hence tarsum instead of nix-hash.
--- a/pkgs/data/misc/fedora-backgrounds/generic.nix
+++ b/pkgs/data/misc/fedora-backgrounds/generic.nix
@ -38,6 +38,6 @@ stdenvNoCC.mkDerivation {
    description = "A set of default and supplemental wallpapers for Fedora";
    license = licenses.cc-by-sa-40;
    platforms = platforms.unix;
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/compilers/llvm/rocm/clang.nix
+++ b/pkgs/development/compilers/llvm/rocm/clang.nix
@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
    description = "ROCm fork of the clang C/C++/Objective-C/Objective-C++ LLVM compiler frontend";
    homepage = "https://llvm.org/";
    license = with licenses; [ ncsa ];
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/compilers/llvm/rocm/lld/default.nix
+++ b/pkgs/development/compilers/llvm/rocm/lld/default.nix
@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
    description = "ROCm fork of the LLVM Linker";
    homepage = "https://github.com/RadeonOpenCompute/llvm-project";
    license = licenses.ncsa;
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/compilers/llvm/rocm/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/rocm/llvm/default.nix
@ -91,7 +91,7 @@ in stdenv.mkDerivation rec {
    description = "ROCm fork of the LLVM compiler infrastructure";
    homepage = "https://github.com/RadeonOpenCompute/llvm-project";
    license = with licenses; [ ncsa ];
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/haskell-modules/generic-builder.nix
+++ b/pkgs/development/haskell-modules/generic-builder.nix
@ -53,6 +53,7 @@ in
 , enableParallelBuilding ? true
 , maintainers ? null
 , changelog ? null
+, mainProgram ? null
 , doCoverage ? false
 , doHaddock ? !(ghc.isHaLVM or false)
 , passthru ? {}
@ -666,6 +667,7 @@ stdenv.mkDerivation ({
         // optionalAttrs (args ? hydraPlatforms) { inherit hydraPlatforms; }
         // optionalAttrs (args ? badPlatforms)   { inherit badPlatforms; }
         // optionalAttrs (args ? changelog)      { inherit changelog; }
+         // optionalAttrs (args ? mainProgram)    { inherit mainProgram; }
         ;

 }
--- a/pkgs/development/libraries/amdvlk/default.nix
+++ b/pkgs/development/libraries/amdvlk/default.nix
@ -85,6 +85,6 @@ in stdenv.mkDerivation rec {
    changelog = "https://github.com/GPUOpen-Drivers/AMDVLK/releases/tag/v-${version}";
    license = licenses.mit;
    platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = with maintainers; [ danieldk Flakebi ];
+    maintainers = with maintainers; [ Flakebi ];
  };
 }
--- a/pkgs/development/libraries/libbaseencode/default.nix
+++ b/pkgs/development/libraries/libbaseencode/default.nix
@ -0,0 +1,22 @@
+{ stdenv, lib, fetchFromGitHub, cmake }:
+
+stdenv.mkDerivation rec {
+  pname = "libbaseencode";
+  version = "1.0.11";
+
+  src = fetchFromGitHub {
+    owner = "paolostivanin";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1f52yh052z8k90d1ag6nk01p1gf4i1zxp1daw8mashs8avqr2m7g";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "Library written in C for encoding and decoding data using base32 or base64 (RFC-4648)";
+    homepage = "https://github.com/paolostivanin/libbaseencode";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ alexbakker ];
+  };
+}
--- a/pkgs/development/libraries/libcotp/default.nix
+++ b/pkgs/development/libraries/libcotp/default.nix
@ -0,0 +1,23 @@
+{ stdenv, lib, fetchFromGitHub, cmake, pkg-config, libgcrypt, libbaseencode }:
+
+stdenv.mkDerivation rec {
+  pname = "libcotp";
+  version = "1.2.3";
+
+  src = fetchFromGitHub {
+    owner = "paolostivanin";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1qq4shwiz1if9vys052dnsbm4dfw1ynlj6nsb0v4zjly3ndspfsk";
+  };
+
+  buildInputs = [ libbaseencode libgcrypt ];
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  meta = with lib; {
+    description = "C library that generates TOTP and HOTP";
+    homepage = "https://github.com/paolostivanin/libcotp";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ alexbakker ];
+  };
+}
--- a/pkgs/development/libraries/rocclr/default.nix
+++ b/pkgs/development/libraries/rocclr/default.nix
@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
    description = "Radeon Open Compute common language runtime";
    homepage = "https://github.com/ROCm-Developer-Tools/ROCclr";
    license = licenses.mit;
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
    # rocclr seems to have some AArch64 ifdefs, but does not seem
    # to be supported yet by the build infrastructure. Recheck in
    # the future.
--- a/pkgs/development/libraries/rocm-comgr/default.nix
+++ b/pkgs/development/libraries/rocm-comgr/default.nix
@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
    description = "APIs for compiling and inspecting AMDGPU code objects";
    homepage = "https://github.com/RadeonOpenCompute/ROCm-CompilerSupport/tree/amd-stg-open/lib/comgr";
    license = licenses.ncsa;
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/libraries/rocm-device-libs/default.nix
+++ b/pkgs/development/libraries/rocm-device-libs/default.nix
@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
    description = "Set of AMD-specific device-side language runtime libraries";
    homepage = "https://github.com/RadeonOpenCompute/ROCm-Device-Libs";
    license = licenses.ncsa;
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/libraries/rocm-opencl-icd/default.nix
+++ b/pkgs/development/libraries/rocm-opencl-icd/default.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "OpenCL ICD definition for AMD GPUs using the ROCm stack";
    license = licenses.mit;
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/libraries/rocm-opencl-runtime/default.nix
+++ b/pkgs/development/libraries/rocm-opencl-runtime/default.nix
@ -77,7 +77,7 @@ stdenv.mkDerivation rec {
    description = "OpenCL runtime for AMD GPUs, part of the ROCm stack";
    homepage = "https://github.com/RadeonOpenCompute/ROCm-OpenCL-Runtime";
    license = with licenses; [ asl20 mit ];
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/libraries/rocm-runtime/default.nix
+++ b/pkgs/development/libraries/rocm-runtime/default.nix
@ -43,6 +43,6 @@ stdenv.mkDerivation rec {
    description = "Platform runtime for ROCm";
    homepage = "https://github.com/RadeonOpenCompute/ROCR-Runtime";
    license = with licenses; [ ncsa ];
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/libraries/rocm-thunk/default.nix
+++ b/pkgs/development/libraries/rocm-thunk/default.nix
@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
    description = "Radeon open compute thunk interface";
    homepage = "https://github.com/RadeonOpenCompute/ROCT-Thunk-Interface";
    license = with licenses; [ bsd2 mit ];
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/dftfit/default.nix
+++ b/pkgs/development/python-modules/dftfit/default.nix
@ -1,52 +0,0 @@
-{ lib
-, fetchPypi
-, buildPythonPackage
-, pymatgen
-, marshmallow
-, pyyaml
-, pygmo
-, pandas
-, scipy
-, numpy
-, scikit-learn
-, lammps-cython
-, pymatgen-lammps
-, pytestrunner
-, isPy3k
-}:
-
-buildPythonPackage rec {
-  pname = "dftfit";
-  version = "0.5.1";
-  disabled = (!isPy3k);
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "4dcbde48948835dcf2d49d6628c9df5747a8ec505d517e374b8d6c7fe95892df";
-  };
-
-  buildInputs = [ pytestrunner ];
-  propagatedBuildInputs = [
-    pymatgen
-    marshmallow
-    pyyaml
-    pygmo
-    pandas
-    scipy
-    numpy
-    scikit-learn
-    lammps-cython
-    pymatgen-lammps
-  ];
-
-  # tests require git lfs download. and is quite large so skip tests
-  doCheck = false;
-  pythonImportsCheck = [ "dftfit" ];
-
-  meta = {
-    description = "Ab-Initio Molecular Dynamics Potential Development";
-    homepage = "https://gitlab.com/costrouc/dftfit";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ costrouc ];
-  };
-}
--- a/pkgs/development/python-modules/enaml/default.nix
+++ b/pkgs/development/python-modules/enaml/default.nix
@ -12,13 +12,13 @@

 buildPythonPackage rec {
  pname = "enaml";
-  version = "0.11.2";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "nucleic";
    repo = pname;
    rev = version;
-    sha256 = "1in5qa5j96qs3gsv8yaxs1l6dbm69xhzvc0pbzg0dd9kpqxfdy1j";
+    sha256 = "sha256-8ZahvFDYW7xUTSTZP1UXnQBCg9RVUywoO7EbqtTQPJI=";
  };

  # qt bindings cannot be found during tests
--- a/pkgs/development/python-modules/lammps-cython/default.nix
+++ b/pkgs/development/python-modules/lammps-cython/default.nix
@ -1,53 +0,0 @@
-{ lib
-, fetchurl
-, buildPythonPackage
-, lammps-mpi
-, mpi
-, mpi4py
-, numpy
-, cython
-, pymatgen
-, ase
-, pytestrunner
-, isPy3k
-}:
-
-buildPythonPackage rec {
-  pname = "lammps-cython";
-  version = "0.5.7";
-  disabled = (!isPy3k);
-
-  src = fetchurl {
-     url = "https://gitlab.com/costrouc/${pname}/-/archive/v${version}/${pname}-v${version}.tar.gz";
-     sha256 = "1wj9scmjdl00af13b5ihfccrjpikrdgkzd88ialam1nkxvxi42bl";
-  };
-
-  buildInputs = [ cython pytestrunner ];
-  propagatedBuildInputs = [ mpi4py pymatgen ase numpy ];
-
-  preBuild = ''
-    echo "Creating lammps.cfg file..."
-    cat << EOF > lammps.cfg
-    [lammps]
-    lammps_include_dir = ${lammps-mpi}/include
-    lammps_library_dir = ${lammps-mpi}/lib
-    lammps_library = lammps_mpi
-
-    [mpi]
-    mpi_include_dir = ${mpi}/include
-    mpi_library_dir = ${mpi}/lib
-    mpi_library     = mpi
-    EOF
-  '';
-
-  pythonImportsCheck = [ "lammps" ];
-
-  meta = {
-    description = "Pythonic Wrapper to LAMMPS using cython";
-    homepage = "https://gitlab.com/costrouc/lammps-cython";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ costrouc ];
-    # fails import check
-    broken = true;
-  };
-}
--- a/pkgs/development/python-modules/selenium/default.nix
+++ b/pkgs/development/python-modules/selenium/default.nix
@ -49,7 +49,7 @@ buildPythonPackage rec {
  '';

  passthru.tests = {
-    testing-bitwarden = nixosTests.bitwarden;
+    testing-vaultwarden = nixosTests.vaultwarden;
  };

  meta = with lib; {
--- a/pkgs/development/python-modules/zha-quirks/default.nix
+++ b/pkgs/development/python-modules/zha-quirks/default.nix
@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "zha-quirks";
-  version = "0.0.57";
+  version = "0.0.58";

  src = fetchFromGitHub {
    owner = "zigpy";
    repo = "zha-device-handlers";
    rev = version;
-    sha256 = "sha256-ajdluj6UIzjJUK30GtoM+e5lsMQRKnn3FPNEg+RS/DM=";
+    sha256 = "sha256-QU5ssbnT3/gioQ3vM9zvlbwxqSWyKIylsV9NuFkNe+Q=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/tools/build-managers/rocm-cmake/default.nix
+++ b/pkgs/development/tools/build-managers/rocm-cmake/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    description = "CMake modules for common build tasks for the ROCm stack";
    homepage = "https://github.com/RadeonOpenCompute/rocm-cmake";
    license = licenses.mit;
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/tools/open-policy-agent/default.nix
+++ b/pkgs/development/tools/open-policy-agent/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "open-policy-agent";
-  version = "0.29.4";
+  version = "0.30.0";

  src = fetchFromGitHub {
    owner = "open-policy-agent";
@ -10,14 +10,11 @@ buildGoModule rec {
    rev = "v${version}";
    sha256 = "sha256-AjNr+t30ftF92+cEfvt8iHBDVD/SO52ojJRLAkYF9l4=";
  };
-
  vendorSha256 = null;

  subPackages = [ "." ];

-  preBuild = ''
-    buildFlagsArray+=("-ldflags" "-s -w -X github.com/open-policy-agent/opa/version.Version=${version}")
-  '';
+  ldflags = [ "-s" "-w" "-X github.com/open-policy-agent/opa/version.Version=${version}" ];

  doInstallCheck = true;
  installCheckPhase = ''
--- a/pkgs/development/tools/tapview/default.nix
+++ b/pkgs/development/tools/tapview/default.nix
@ -0,0 +1,32 @@
+{ asciidoctor
+, fetchFromGitLab
+, lib
+, stdenv
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tapview";
+  version = "1.1";
+
+  nativeBuildInputs = [ asciidoctor ];
+
+  src = fetchFromGitLab {
+    owner = "esr";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-inrxICNglZU/tup+YnHaDiVss32K2OXht/7f8lOZI4g=";
+  };
+
+  # Remove unecessary `echo` checks: `/bin/echo` fails, and `echo -n` works as expected.
+  patches = [ ./dont_check_echo.patch ];
+
+  makeFlags = [ "prefix=$(out)" ];
+
+  meta = with lib; {
+    description = "A minimalist pure consumer for TAP (Test Anything Protocol)";
+    homepage = "https://gitlab.com/esr/tapview";
+    license = licenses.bsd2;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ pamplemousse ];
+  };
+}
--- a/pkgs/development/tools/tapview/dont_check_echo.patch
+++ b/pkgs/development/tools/tapview/dont_check_echo.patch
@ -0,0 +1,44 @@
+diff --git a/tapview b/tapview
+index ad6a33a66d1..4cf9545d42f 100644
+--- a/tapview
+++ b/tapview
+@@ -13,21 +13,6 @@
+ #
+ # This is version 1.1
+ # A newer version may be available at https://gitlab.com/esr/tapview
+-#
+-# POSIX allows but does not mandate that -n suppresses emission of a
+-# trailing newline in echo. Thus, some shell builtin echos don't do
+-# that.  Cope gracefully.
+-# shellcheck disable=SC2039
+-if [ "$(echo -n "a"; echo "b")" != "ab" ]
+-then
+-    ECHO="echo"
+-elif [ "$(/bin/echo -n "a"; /bin/echo "b")" = "ab" ]
+-then
+-    ECHO="/bin/echo"
+-else
+-    echo "tapview: bailing out, your echo lacks -n support."
+-    exit 3
+-fi
+ 
+ OK="."
+ FAIL="F"
+@@ -37,7 +22,7 @@ TODO_OK="u"
+ 
+ ship_char() {
+     # shellcheck disable=SC2039
+-    "${ECHO}" -n "$1"
+    echo -n "$1"
+ }
+ 
+ ship_line() {
+@@ -155,7 +140,7 @@ do
+     fi
+ done
+ 
+-/bin/echo ""
+echo ""
+ 
+ if [ -z "$expect" ]
+ then
--- a/pkgs/os-specific/linux/bpftrace/default.nix
+++ b/pkgs/os-specific/linux/bpftrace/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "bpftrace";
-  version = "0.12.1";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner  = "iovisor";
    repo   = "bpftrace";
    rev    = "v${version}";
-    sha256 = "sha256-DZO47AH506DBVH/AuvOF3JfpRxv/D/lmzVg8WOH9Dqo=";
+    sha256 = "sha256-BKWBdFzj0j7rAfG30A0fwyYCpOG/5NFRPODW46EP1u0=";
  };

  buildInputs = with llvmPackages;
--- a/pkgs/servers/coturn/default.nix
+++ b/pkgs/servers/coturn/default.nix
@ -8,6 +8,7 @@
 , libprom
 , libpromhttp
 , libmicrohttpd
+, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -34,6 +35,8 @@ stdenv.mkDerivation rec {
    ./pure-configure.patch
  ];

+  passthru.tests.coturn = nixosTests.coturn;
+
  meta = with lib; {
    homepage = "https://coturn.net/";
    license = with licenses; [ bsd3 ];
--- a/pkgs/servers/sip/freeswitch/default.nix
+++ b/pkgs/servers/sip/freeswitch/default.nix
@ -1,4 +1,4 @@
-{ fetchFromGitHub, fetchpatch, stdenv, lib, pkg-config, autoreconfHook
+{ fetchFromGitHub, stdenv, lib, pkg-config, autoreconfHook
 , ncurses, gnutls, readline
 , openssl, perl, sqlite, libjpeg, speex, pcre, libuuid
 , ldns, libedit, yasm, which, libsndfile, libtiff
@ -88,21 +88,14 @@ in

 stdenv.mkDerivation rec {
  pname = "freeswitch";
-  version = "1.10.5";
+  version = "1.10.6";
  src = fetchFromGitHub {
    owner = "signalwire";
    repo = pname;
    rev = "v${version}";
-    sha256 = "18dhyb19k28dcm1i8mhqvvgm2phsrmrwyjmfn79glk8pdlalvcha";
+    sha256 = "1i5n06pds3kvzhhzfwvhwxnvcb2p2fcr8k52157aplm2i7prl4q2";
  };

-  patches = [
-    # https://github.com/signalwire/freeswitch/pull/812 fix mod_spandsp, mod_gsmopen build, drop when updating from 1.10.5
-    (fetchpatch {
-      url = "https://github.com/signalwire/freeswitch/commit/51fba83ed3ed2d9753d8e6b13e13001aca50b493.patch";
-      sha256 = "0h2bmifsyyasxjka3pczbmqym1chvz91fmb589njrdbwpkjyvqh3";
-    })
-  ];
  postPatch = ''
    patchShebangs     libs/libvpx/build/make/rtcd.pl
    substituteInPlace libs/libvpx/build/make/configure.sh \
@ -117,10 +110,11 @@ stdenv.mkDerivation rec {
    done
  '';

-  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  strictDeps = true;
+  nativeBuildInputs = [ pkg-config autoreconfHook perl which yasm ];
  buildInputs = [
-    openssl ncurses gnutls readline perl libjpeg
-    sqlite pcre speex ldns libedit yasm which
+    openssl ncurses gnutls readline libjpeg
+    sqlite pcre speex ldns libedit
    libsndfile libtiff
    libuuid
  ]
--- a/pkgs/tools/admin/exoscale-cli/default.nix
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@ -2,13 +2,13 @@

 buildGoPackage rec {
  pname = "exoscale-cli";
-  version = "1.32.2";
+  version = "1.34.0";

  src = fetchFromGitHub {
    owner  = "exoscale";
    repo   = "cli";
    rev    = "v${version}";
-    sha256 = "sha256-Yx+GA959AB6m62hDlZKYjsuT9Y9TJbIdzUVBMM8OgTg=";
+    sha256 = "sha256-Gu9o1aUDlhcEZPZZsfVF0FnlzT1DvbEXMXjnOxhY8tY=";
  };

  goPackagePath = "github.com/exoscale/cli";
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@ -75,7 +75,7 @@ rustPlatform.buildRustPackage rec {
  meta = with lib; {
    description = "An interactive tree view, a fuzzy search, a balanced BFS descent and customizable commands";
    homepage = "https://dystroy.org/broot/";
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
    license = with licenses; [ mit ];
  };
 }
--- a/pkgs/tools/misc/mslink/default.nix
+++ b/pkgs/tools/misc/mslink/default.nix
@ -1,9 +1,9 @@
-{ stdenv
+{ gccStdenv
 , lib
 , fetchurl
 }:

-stdenv.mkDerivation rec {
+gccStdenv.mkDerivation rec {
  pname = "mslink";
  version = "1.3";

@ -17,6 +17,9 @@ stdenv.mkDerivation rec {
  '';

  installPhase = ''
+    if [[ "$(uname)" == "Darwin" ]]; then
+      mv mslink.exe mslink
+    fi
    install -D mslink $out/bin/mslink
  '';

--- a/pkgs/tools/security/cfssl/default.nix
+++ b/pkgs/tools/security/cfssl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "cfssl";
-  version = "1.5.0";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = "cfssl";
    rev = "v${version}";
-    sha256 = "1yzxz2l7h2d3f8j6l9xlm7g9659gsa17zf4q0883s0jh3l3xgs5n";
+    sha256 = "sha256-29HEaW5LCoHcuJrfVUN2hnsRtaSTrvIBo8ok2UJbfuQ=";
  };

  subPackages = [
--- a/pkgs/tools/security/bitwarden_rs/default.nix
+++ b/pkgs/tools/security/bitwarden_rs/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, nixosTests
+{ lib, stdenv, rustPlatform, fetchFromGitHub, fetchurl, nixosTests
 , pkg-config, openssl
 , libiconv, Security, CoreServices
 , dbBackend ? "sqlite", libmysqlclient, postgresql }:
@ -7,16 +7,18 @@ let
  featuresFlag = "--features ${dbBackend}";

 in rustPlatform.buildRustPackage rec {
-  pname = "bitwarden_rs";
-  version = "1.20.0";
+  pname = "vaultwarden";
+  version = "1.22.1";

  src = fetchFromGitHub {
    owner = "dani-garcia";
    repo = pname;
    rev = version;
-    sha256 = "1ncy4iwmdzdp8rv1gc5i4s1rp97d94n4l4bh08v6w4zdpx0zn8b9";
+    sha256 = "sha256-aXbnNO3mTAgE1yNx7YVDo1vPpO8ACZpBGHQ633fNZ3k=";
  };

+  cargoSha256 = "sha256-SFzq3OU0a0s3zlEzUkqGdZb/knYafqDamLy4ghH4i8I=";
+
  nativeBuildInputs = [ pkg-config ];
  buildInputs = with lib; [ openssl ]
    ++ optionals stdenv.isDarwin [ libiconv Security CoreServices ]
@ -25,7 +27,6 @@ in rustPlatform.buildRustPackage rec {

  RUSTC_BOOTSTRAP = 1;

-  cargoSha256 = "0vdi792bzqxj8g215r9r5anzs4qhqsm6sjzwpj1l9861bn7j4xsz";
  cargoBuildFlags = [ featuresFlag ];

  checkPhase = ''
@ -35,11 +36,11 @@ in rustPlatform.buildRustPackage rec {
    runHook postCheck
  '';

-  passthru.tests = nixosTests.bitwarden;
+  passthru.tests = nixosTests.vaultwarden;

  meta = with lib; {
    description = "Unofficial Bitwarden compatible server written in Rust";
-    homepage = "https://github.com/dani-garcia/bitwarden_rs";
+    homepage = "https://github.com/dani-garcia/vaultwarden";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ msteen ];
  };
--- a/pkgs/tools/security/bitwarden_rs/vault.nix
+++ b/pkgs/tools/security/bitwarden_rs/vault.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, nixosTests }:

 stdenv.mkDerivation rec {
-  pname = "bitwarden_rs-vault";
+  pname = "vaultwarden-vault";
  version = "2.19.0";

  src = fetchurl {
@ -10,16 +10,16 @@ stdenv.mkDerivation rec {
  };

  buildCommand = ''
-    mkdir -p $out/share/bitwarden_rs/
-    cd $out/share/bitwarden_rs/
+    mkdir -p $out/share/vaultwarden/
+    cd $out/share/vaultwarden/
    tar xf $src
    mv web-vault vault
  '';

-  passthru.tests = nixosTests.bitwarden;
+  passthru.tests = nixosTests.vaultwarden;

  meta = with lib; {
-    description = "Integrates the web vault into bitwarden_rs";
+    description = "Integrates the web vault into vaultwarden";
    homepage = "https://github.com/dani-garcia/bw_web_builds";
    platforms = platforms.all;
    license = licenses.gpl3Plus;
--- a/pkgs/tools/system/rocm-smi/default.nix
+++ b/pkgs/tools/system/rocm-smi/default.nix
@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
    description = "System management interface for AMD GPUs supported by ROCm";
    homepage = "https://github.com/RadeonOpenCompute/ROC-smi";
    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ danieldk ];
+    maintainers = with maintainers; [ ];
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/tools/text/hottext/default.nix
+++ b/pkgs/tools/text/hottext/default.nix
@ -67,7 +67,7 @@ in stdenv.mkDerivation rec {

  nimFlags = [ "-d:release" ] ++ map (lib: "--path:${lib}/src") nimLibs;

-  HOTTEXT_FONT_PATH = "${gentium}/share/fonts/truetype/GentiumPlus-R.ttf";
+  HOTTEXT_FONT_PATH = "${gentium}/share/fonts/truetype/GentiumPlus-Regular.ttf";

  buildPhase = ''
    runHook preBuild
--- a/pkgs/tools/text/languagetool/default.nix
+++ b/pkgs/tools/text/languagetool/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "LanguageTool";
-  version = "5.3";
+  version = "5.4";

  src = fetchzip {
    url = "https://www.languagetool.org/download/${pname}-${version}.zip";
-    sha256 = "1km20ajqb65vkhkrf94zy5srcss66ix8padp7ng59pa8pj11wmi2";
+    sha256 = "sha256-2khadADfzwkW+J0uafPWJ6xUQRSQDm8seiBHueQGmKI=";
  };
  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ jre ];
--- a/pkgs/tools/wayland/wayland-proxy-virtwl/default.nix
+++ b/pkgs/tools/wayland/wayland-proxy-virtwl/default.nix
@ -0,0 +1,37 @@
+{ lib
+, fetchFromGitHub
+, ocamlPackages
+}:
+
+ocamlPackages.buildDunePackage rec {
+  pname = "wayland-proxy-virtwl";
+  version = "unstable-2021-04-15";
+
+  src = fetchFromGitHub {
+    owner = "talex5";
+    repo = pname;
+    rev = "09321a28f3d4c0fa7e41ebb3014106b62090b649";
+    sha256 = "03rc2jp5d2y9y7mfis6kk9gchd49gvq0jg6fq5gi9r21ckb4k5v4";
+  };
+
+  postPatch = ''
+    # no need to vendor
+    rm -r ocaml-wayland
+  '';
+
+  useDune2 = true;
+  minimumOCamlVersion = "4.08";
+
+  buildInputs = with ocamlPackages; [
+    wayland
+    cmdliner
+    logs
+  ];
+
+  meta = {
+    homepage = "https://github.com/talex5/wayland-virtwl-proxy";
+    description = "Proxy Wayland connections across a VM boundary";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.sternenseemann ];
+  };
+}
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -88,6 +88,14 @@ mapAliases ({
  bittorrentSync = throw "bittorrentSync has been deprecated by resilio-sync."; # added 2019-06-03
  bittorrentSync14 = throw "bittorrentSync14 has been deprecated by resilio-sync."; # added 2019-06-03
  bittorrentSync20 = throw "bittorrentSync20 has been deprecated by resilio-sync."; # added 2019-06-03
+
+  # bitwarden_rs renamed to vaultwarden with release 1.21.0 (2021-04-30)
+  bitwarden_rs = vaultwarden;
+  bitwarden_rs-sqlite = vaultwarden-sqlite;
+  bitwarden_rs-mysql = vaultwarden-mysql;
+  bitwarden_rs-postgresql = vaultwarden-postgresql;
+  bitwarden_rs-vault = vaultwarden-vault;
+
  bs1770gain = throw "bs1770gain has been removed from nixpkgs, as it had no maintainer or reverse dependencies."; # added 2021-01-02
  btc1 = throw "btc1 has been removed, it was abandoned by upstream"; # added 2020-11-03
  buildPerlPackage = perlPackages.buildPerlPackage; # added 2018-10-12
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -474,6 +474,8 @@ in

  pkger = callPackage ../development/libraries/pkger { };

+  tapview = callPackage ../development/tools/tapview { };
+
  run = callPackage ../development/tools/run { };

  mod = callPackage ../development/tools/mod { };
@ -1310,15 +1312,6 @@ in

  inherit (nodePackages) bitwarden-cli;

-  bitwarden_rs = callPackage ../tools/security/bitwarden_rs {
-    inherit (darwin.apple_sdk.frameworks) Security CoreServices;
-  };
-  bitwarden_rs-sqlite = bitwarden_rs;
-  bitwarden_rs-mysql = bitwarden_rs.override { dbBackend = "mysql"; };
-  bitwarden_rs-postgresql = bitwarden_rs.override { dbBackend = "postgresql"; };
-
-  bitwarden_rs-vault = callPackage ../tools/security/bitwarden_rs/vault.nix { };
-
  bkyml = callPackage ../tools/misc/bkyml { };

  blockbench-electron = callPackage ../applications/graphics/blockbench-electron { };
@ -2301,6 +2294,8 @@ in

  wayland-utils = callPackage ../tools/wayland/wayland-utils { };

+  wayland-proxy-virtwl = callPackage ../tools/wayland/wayland-proxy-virtwl { };
+
  wev = callPackage ../tools/wayland/wev { };

  wdomirror = callPackage ../tools/wayland/wdomirror { };
@ -7672,6 +7667,8 @@ in

  otfcc = callPackage ../tools/misc/otfcc { };

+  otpclient = callPackage ../applications/misc/otpclient { };
+
  otpw = callPackage ../os-specific/linux/otpw { };

  ovftool = callPackage ../tools/virtualization/ovftool { };
@ -16035,6 +16032,8 @@ in
    inherit (ocaml-ng.ocamlPackages) bap ocaml findlib ctypes;
  };

+  libbaseencode = callPackage ../development/libraries/libbaseencode { };
+
  libbass = (callPackage ../development/libraries/audio/libbass { }).bass;
  libbass_fx = (callPackage ../development/libraries/audio/libbass { }).bass_fx;

@ -16148,6 +16147,8 @@ in

  libctemplate = callPackage ../development/libraries/libctemplate { };

+  libcotp = callPackage ../development/libraries/libcotp { };
+
  libcouchbase = callPackage ../development/libraries/libcouchbase { };

  libcue = callPackage ../development/libraries/libcue { };
@ -31573,6 +31574,15 @@ in

  vazir-code-font = callPackage ../data/fonts/vazir-code-font { };

+  vaultwarden = callPackage ../tools/security/vaultwarden {
+    inherit (darwin.apple_sdk.frameworks) Security CoreServices;
+  };
+  vaultwarden-sqlite = vaultwarden;
+  vaultwarden-mysql = vaultwarden.override { dbBackend = "mysql"; };
+  vaultwarden-postgresql = vaultwarden.override { dbBackend = "postgresql"; };
+
+  vaultwarden-vault = callPackage ../tools/security/vaultwarden/vault.nix { };
+
  vazir-fonts = callPackage ../data/fonts/vazir-fonts { };

  vbam = callPackage ../misc/emulators/vbam { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -1905,8 +1905,6 @@ in {

  devpi-common = callPackage ../development/python-modules/devpi-common { };

-  dftfit = callPackage ../development/python-modules/dftfit { };
-
  diagrams = callPackage ../development/python-modules/diagrams { };

  diceware = callPackage ../development/python-modules/diceware { };
@ -3914,8 +3912,6 @@ in {

  labmath = callPackage ../development/python-modules/labmath { };

-  lammps-cython = callPackage ../development/python-modules/lammps-cython { };
-
  langcodes = callPackage ../development/python-modules/langcodes { };

  langdetect = callPackage ../development/python-modules/langdetect { };