qo.is/infrastructure
4
0
Fork 0
Code Issues 16 Pull requests 2 Projects 1 Activity Actions

Upgrade to NixOS 26.05 #142

New issue
Open
opened 2026-06-24 11:36:12 +00:00 by fabianhauser · 0 comments
fabianhauser commented 2026-06-24 11:36:12 +00:00
Owner
Copy link

Upgrade the infrastructure flake from NixOS 25.11 to 26.05.

TODO

  • update resolved configuration structure

Flake / state

  • Bump nixpkgs input to nixos-26.05 and update flake.lock; confirm srvos, sops-nix, disko, deploy-rs, treefmt-nix, git-hooks-nix still build/follow
  • Bump per-host system.stateVersion to "26.05" and review impact — we explicitly pin the version-sensitive services (postgresql_14/postgresql_15, nextcloud33) so those won't auto-migrate; verify no other state-dependent default changes in a breaking way

srvos

  • Re-validate srvos.nixosModules.server against 26.05; confirm the 3 overrides are still needed/correct (networking.useNetworkd, services.userborn.enable, boot.initrd.systemd.enable)
  • boot.initrd.systemd.enable = false: keep for now — our luks-ssh remote-unlock relies on the scripted initrd (network.udhcpc, network.ssh, cryptsetup-askpass). 26.05 still supports scripted initrd, but track migrating luks-ssh to systemd initrd (systemd-networkd + systemd-ask-password) as separate future work
  • Check srvos main for new mkDefault defaults that overlap our SSH/nix/security config

Services in use

  • Forgejo (pkgs.forgejo): major bump in 26.05 (forgejo-lts → v15) — review breaking changes + DB migration in release notes
  • PostgreSQL: confirm postgresql_14 (Nextcloud) and postgresql_15 still present in 26.05; pg14 nears EOL — plan DB major upgrade if dropped
  • Telegraf/Prometheus: verify inputs/options vs srvos mixins-telegraf
  • Vaultwarden: verify package/options
  • Headscale / Tailscale (vpn-server, vpn-exit-node): verify policy/option compatibility

Networking

  • systemd-resolved / networkd / firewall: check option changes
Upgrade the infrastructure flake from NixOS 25.11 to 26.05. ## TODO - [ ] update resolved configuration structure ### Flake / state - [ ] Bump `nixpkgs` input to `nixos-26.05` and update `flake.lock`; confirm srvos, sops-nix, disko, deploy-rs, treefmt-nix, git-hooks-nix still build/follow - [ ] Bump per-host `system.stateVersion` to `"26.05"` and review impact — we explicitly pin the version-sensitive services (`postgresql_14`/`postgresql_15`, `nextcloud33`) so those won't auto-migrate; verify no other state-dependent default changes in a breaking way ### srvos - [ ] Re-validate `srvos.nixosModules.server` against 26.05; confirm the 3 overrides are still needed/correct (`networking.useNetworkd`, `services.userborn.enable`, `boot.initrd.systemd.enable`) - [ ] `boot.initrd.systemd.enable = false`: keep for now — our `luks-ssh` remote-unlock relies on the scripted initrd (`network.udhcpc`, `network.ssh`, `cryptsetup-askpass`). 26.05 still supports scripted initrd, but track migrating `luks-ssh` to systemd initrd (systemd-networkd + `systemd-ask-password`) as separate future work - [ ] Check srvos main for new `mkDefault` defaults that overlap our SSH/nix/security config ### Services in use - [ ] Forgejo (`pkgs.forgejo`): major bump in 26.05 (forgejo-lts → v15) — review breaking changes + DB migration in release notes - [ ] PostgreSQL: confirm `postgresql_14` (Nextcloud) and `postgresql_15` still present in 26.05; pg14 nears EOL — plan DB major upgrade if dropped - [ ] Telegraf/Prometheus: verify inputs/options vs srvos `mixins-telegraf` - [ ] Vaultwarden: verify package/options - [ ] Headscale / Tailscale (vpn-server, vpn-exit-node): verify policy/option compatibility ### Networking - [ ] systemd-resolved / networkd / firewall: check option changes
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
renovate/lock-file-maintenance
jellyfin
microvm-services
microvm-experiment
test-cloud
18-caral
No results found.
Labels
Clear labels   
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
urgent
This issue should be tackled soon

  
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
invalid
question
urgent
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
qo.is/infrastructure#142
No description provided.