Merge master into staging-next

36 files changed, 355 insertions, 862 deletions

diff --git a/nixos/doc/manual/development/freeform-modules.xml b/nixos/doc/manual/development/freeform-modules.xml
new file mode 100644
index 00000000000..257e6b11bf0
--- /dev/null
+++ b/nixos/doc/manual/development/freeform-modules.xml
@@ -0,0 +1,68 @@
+<section xmlns="http://docbook.org/ns/docbook"
+        xmlns:xlink="http://www.w3.org/1999/xlink"
+        xmlns:xi="http://www.w3.org/2001/XInclude"
+        version="5.0"
+        xml:id="sec-freeform-modules">
+ <title>Freeform modules</title>
+ <para>
+  Freeform modules allow you to define values for option paths that have not been declared explicitly. This can be used to add attribute-specific types to what would otherwise have to be <literal>attrsOf</literal> options in order to accept all attribute names.
+ </para>
+ <para>
+  This feature can be enabled by using the attribute <literal>freeformType</literal> to define a freeform type. By doing this, all assignments without an associated option will be merged using the freeform type and combined into the resulting <literal>config</literal> set. Since this feature nullifies name checking for entire option trees, it is only recommended for use in submodules.
+ </para>
+ <example xml:id="ex-freeform-module">
+  <title>Freeform submodule</title>
+  <para>
+   The following shows a submodule assigning a freeform type that allows arbitrary attributes with <literal>str</literal> values below <literal>settings</literal>, but also declares an option for the <literal>settings.port</literal> attribute to have it type-checked and assign a default value. See <xref linkend="ex-settings-typed-attrs"/> for a more complete example.
+  </para>
+ <programlisting>
+{ lib, config, ... }: {
+
+  options.settings = lib.mkOption {
+    type = lib.types.submodule {
+
+      freeformType = with lib.types; attrsOf str;
+
+      # We want this attribute to be checked for the correct type
+      options.port = lib.mkOption {
+        type = lib.types.port;
+        # Declaring the option also allows defining a default value
+        default = 8080;
+      };
+
+    };
+  };
+}
+ </programlisting>
+ <para>
+  And the following shows what such a module then allows
+ </para>
+ <programlisting>
+{
+  # Not a declared option, but the freeform type allows this
+  settings.logLevel = "debug";
+
+  # Not allowed because the the freeform type only allows strings
+  # settings.enable = true;
+
+  # Allowed because there is a port option declared
+  settings.port = 80;
+
+  # Not allowed because the port option doesn't allow strings
+  # settings.port = "443";
+}
+ </programlisting>
+ </example>
+ <note>
+  <para>
+   Freeform attributes cannot depend on other attributes of the same set without infinite recursion:
+<programlisting>
+{
+  # This throws infinite recursion encountered
+  settings.logLevel = lib.mkIf (config.settings.port == 80) "debug";
+}
+</programlisting>
+   To prevent this, declare options for all attributes that need to depend on others. For above example this means to declare <literal>logLevel</literal> to be an option.
+  </para>
+ </note>
+</section>
diff --git a/nixos/doc/manual/development/settings-options.xml b/nixos/doc/manual/development/settings-options.xml
index 84895adb444..c99c3af92f8 100644
--- a/nixos/doc/manual/development/settings-options.xml
+++ b/nixos/doc/manual/development/settings-options.xml
@@ -137,7 +137,7 @@ in {
       description = ''
         Configuration for foo, see
         &lt;link xlink:href="https://example.com/docs/foo"/&gt;
-        for supported values.
+        for supported settings.
       '';
     };
   };
@@ -167,13 +167,50 @@ in {
 
     # We know that the `user` attribute exists because we set a default value
     # for it above, allowing us to use it without worries here
-    users.users.${cfg.settings.user} = {}
+    users.users.${cfg.settings.user} = {};
 
     # ...
   };
 }
 </programlisting>
    </example>
+   <section xml:id="sec-settings-attrs-options">
+    <title>Option declarations for attributes</title>
+    <para>
+     Some <literal>settings</literal> attributes may deserve some extra care. They may need a different type, default or merging behavior, or they are essential options that should show their documentation in the manual. This can be done using <xref linkend='sec-freeform-modules'/>.
+     <example xml:id="ex-settings-typed-attrs">
+      <title>Declaring a type-checked <literal>settings</literal> attribute</title>
+      <para>
+       We extend above example using freeform modules to declare an option for the port, which will enforce it to be a valid integer and make it show up in the manual.
+      </para>
+<programlisting>
+settings = lib.mkOption {
+  type = lib.types.submodule {
+
+    freeformType = settingsFormat.type;
+
+    # Declare an option for the port such that the type is checked and this option
+    # is shown in the manual.
+    options.port = lib.mkOption {
+      type = lib.types.port;
+      default = 8080;
+      description = ''
+        Which port this service should listen on.
+      '';
+    };
+
+  };
+  default = {};
+  description = ''
+    Configuration for Foo, see
+    &lt;link xlink:href="https://example.com/docs/foo"/&gt;
+    for supported values.
+  '';
+};
+</programlisting>
+     </example>
+    </para>
+   </section>
  </section>
 
 </section>
diff --git a/nixos/doc/manual/development/writing-modules.xml b/nixos/doc/manual/development/writing-modules.xml
index 602f134f9cb..d244356dbed 100644
--- a/nixos/doc/manual/development/writing-modules.xml
+++ b/nixos/doc/manual/development/writing-modules.xml
@@ -183,5 +183,6 @@ in {
  <xi:include href="meta-attributes.xml" />
  <xi:include href="importing-modules.xml" />
  <xi:include href="replace-modules.xml" />
+ <xi:include href="freeform-modules.xml" />
  <xi:include href="settings-options.xml" />
 </chapter>
diff --git a/nixos/maintainers/scripts/ec2/amazon-image.nix b/nixos/maintainers/scripts/ec2/amazon-image.nix
index 36f3e7af873..b09f4ca47a3 100644
--- a/nixos/maintainers/scripts/ec2/amazon-image.nix
+++ b/nixos/maintainers/scripts/ec2/amazon-image.nix
@@ -63,8 +63,8 @@ in {
     fsType = "ext4";
     configFile = pkgs.writeText "configuration.nix"
       ''
-        {
-          imports = [ <nixpkgs/nixos/modules/virtualisation/amazon-image.nix> ];
+        { modulesPath, ... }: {
+          imports = [ "''${modulesPath}/virtualisation/amazon-image.nix" ];
           ${optionalString config.ec2.hvm ''
             ec2.hvm = true;
           ''}
diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index 873b8073fed..941ab78f863 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -27,6 +27,7 @@ with lib;
     fonts.fontconfig.enable = false;
 
     nixpkgs.overlays = singleton (const (super: {
+      cairo = super.cairo.override { x11Support = false; };
       dbus = super.dbus.override { x11Support = false; };
       networkmanager-fortisslvpn = super.networkmanager-fortisslvpn.override { withGnome = false; };
       networkmanager-l2tp = super.networkmanager-l2tp.override { withGnome = false; };
@@ -35,6 +36,7 @@ with lib;
       networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
       networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
       gobject-introspection = super.gobject-introspection.override { x11Support = false; };
+      qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; };
     }));
   };
 }
diff --git a/nixos/modules/installer/tools/nixos-build-vms/nixos-build-vms.sh b/nixos/modules/installer/tools/nixos-build-vms/nixos-build-vms.sh
index 25106733087..2a6c3ab1149 100644
--- a/nixos/modules/installer/tools/nixos-build-vms/nixos-build-vms.sh
+++ b/nixos/modules/installer/tools/nixos-build-vms/nixos-build-vms.sh
@@ -1,4 +1,4 @@
-#! @shell@ -e
+#! @runtimeShell@ -e
 
 # Shows the usage of this command to the user
 
diff --git a/nixos/modules/installer/tools/nixos-enter.sh b/nixos/modules/installer/tools/nixos-enter.sh
index 1fdd4627a90..c72ef6e9c28 100644
--- a/nixos/modules/installer/tools/nixos-enter.sh
+++ b/nixos/modules/installer/tools/nixos-enter.sh
@@ -1,4 +1,4 @@
-#! @shell@
+#! @runtimeShell@
 
 set -e
 
diff --git a/nixos/modules/installer/tools/nixos-install.sh b/nixos/modules/installer/tools/nixos-install.sh
index 0b62bca8367..e0252befdfd 100644
--- a/nixos/modules/installer/tools/nixos-install.sh
+++ b/nixos/modules/installer/tools/nixos-install.sh
@@ -1,4 +1,4 @@
-#! @shell@
+#! @runtimeShell@
 
 set -e
 shopt -s nullglob
diff --git a/nixos/modules/installer/tools/nixos-rebuild.sh b/nixos/modules/installer/tools/nixos-rebuild.sh
index 354274478a3..437199bae1d 100644
--- a/nixos/modules/installer/tools/nixos-rebuild.sh
+++ b/nixos/modules/installer/tools/nixos-rebuild.sh
@@ -1,6 +1,6 @@
-#! @shell@
+#! @runtimeShell@
 
-if [ -x "@shell@" ]; then export SHELL="@shell@"; fi;
+if [ -x "@runtimeShell@" ]; then export SHELL="@runtimeShell@"; fi;
 
 set -e
 set -o pipefail
diff --git a/nixos/modules/installer/tools/nixos-version.sh b/nixos/modules/installer/tools/nixos-version.sh
index fb0fe26116a..f5e3f32b3c6 100644
--- a/nixos/modules/installer/tools/nixos-version.sh
+++ b/nixos/modules/installer/tools/nixos-version.sh
@@ -1,4 +1,4 @@
-#! @shell@
+#! @runtimeShell@
 
 case "$1" in
   -h|--help)
diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index 11128621424..1582f049309 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -14,11 +14,13 @@ let
   nixos-build-vms = makeProg {
     name = "nixos-build-vms";
     src = ./nixos-build-vms/nixos-build-vms.sh;
+    inherit (pkgs) runtimeShell;
   };
 
   nixos-install = makeProg {
     name = "nixos-install";
     src = ./nixos-install.sh;
+    inherit (pkgs) runtimeShell;
     nix = config.nix.package.out;
     path = makeBinPath [ nixos-enter ];
   };
@@ -28,6 +30,7 @@ let
     makeProg {
       name = "nixos-rebuild";
       src = ./nixos-rebuild.sh;
+      inherit (pkgs) runtimeShell;
       nix = config.nix.package.out;
       nix_x86_64_linux = fallback.x86_64-linux;
       nix_i686_linux = fallback.i686-linux;
@@ -50,6 +53,7 @@ let
   nixos-version = makeProg {
     name = "nixos-version";
     src = ./nixos-version.sh;
+    inherit (pkgs) runtimeShell;
     inherit (config.system.nixos) version codeName revision;
     inherit (config.system) configurationRevision;
     json = builtins.toJSON ({
@@ -64,6 +68,7 @@ let
   nixos-enter = makeProg {
     name = "nixos-enter";
     src = ./nixos-enter.sh;
+    inherit (pkgs) runtimeShell;
   };
 
 in
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 4692ea32656..bdb7fa3b12c 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -198,7 +198,7 @@ in
       bosun = 161;
       kubernetes = 162;
       peerflix = 163;
-      chronos = 164;
+      #chronos = 164; # removed 2020-08-15
       gitlab = 165;
       tox-bootstrapd = 166;
       cadvisor = 167;
@@ -247,7 +247,7 @@ in
       bepasty = 215;
       # pumpio = 216; # unused, removed 2018-02-24
       nm-openvpn = 217;
-      mathics = 218;
+      # mathics = 218; # unused, removed 2020-08-15
       ejabberd = 219;
       postsrsd = 220;
       opendkim = 221;
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 2cc36078223..08ed6e63e72 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -466,14 +466,11 @@
   ./services/misc/leaps.nix
   ./services/misc/lidarr.nix
   ./services/misc/mame.nix
-  ./services/misc/mathics.nix
   ./services/misc/matrix-appservice-discord.nix
   ./services/misc/matrix-synapse.nix
   ./services/misc/mautrix-telegram.nix
   ./services/misc/mbpfan.nix
   ./services/misc/mediatomb.nix
-  ./services/misc/mesos-master.nix
-  ./services/misc/mesos-slave.nix
   ./services/misc/metabase.nix
   ./services/misc/mwlib.nix
   ./services/misc/nix-daemon.nix
@@ -786,10 +783,8 @@
   ./services/networking/znc/default.nix
   ./services/printing/cupsd.nix
   ./services/scheduling/atd.nix
-  ./services/scheduling/chronos.nix
   ./services/scheduling/cron.nix
   ./services/scheduling/fcron.nix
-  ./services/scheduling/marathon.nix
   ./services/search/elasticsearch.nix
   ./services/search/elasticsearch-curator.nix
   ./services/search/hound.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index cfe216d512b..ef7e3354112 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -17,8 +17,11 @@ with lib;
     (mkAliasOptionModule [ "environment" "checkConfigurationOptions" ] [ "_module" "check" ])
 
     # Completely removed modules
+    (mkRemovedOptionModule [ "services" "chronos" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "firefox" "syncserver" "user" ] "")
     (mkRemovedOptionModule [ "services" "firefox" "syncserver" "group" ] "")
+    (mkRemovedOptionModule [ "services" "marathon" ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [ "services" "mesos" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "winstone" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "networking" "vpnc" ] "Use environment.etc.\"vpnc/service.conf\" instead.")
     (mkRemovedOptionModule [ "environment" "blcr" "enable" ] "The BLCR module has been removed")
@@ -28,6 +31,7 @@ with lib;
     (mkRemovedOptionModule [ "services" "osquery" ] "The osquery module has been removed")
     (mkRemovedOptionModule [ "services" "fourStore" ] "The fourStore module has been removed")
     (mkRemovedOptionModule [ "services" "fourStoreEndpoint" ] "The fourStoreEndpoint module has been removed")
+    (mkRemovedOptionModule [ "services" "mathics" ] "The Mathics module has been removed")
     (mkRemovedOptionModule [ "programs" "way-cooler" ] ("way-cooler is abandoned by its author: " +
       "https://way-cooler.org/blog/2020/01/09/way-cooler-post-mortem.html"))
     (mkRemovedOptionModule [ "services" "xserver" "multitouch" ] ''
diff --git a/nixos/modules/security/wrappers/default.nix b/nixos/modules/security/wrappers/default.nix
index a0fadb018ec..2def74f8535 100644
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@@ -160,8 +160,11 @@ in
   config = {
 
     security.wrappers = {
+      # These are mount related wrappers that require the +s permission.
       fusermount.source = "${pkgs.fuse}/bin/fusermount";
       fusermount3.source = "${pkgs.fuse3}/bin/fusermount3";
+      mount.source = "${lib.getBin pkgs.utillinux}/bin/mount";
+      umount.source = "${lib.getBin pkgs.utillinux}/bin/umount";
     };
 
     boot.specialFileSystems.${parentWrapperDir} = {
diff --git a/nixos/modules/services/editors/emacs.nix b/nixos/modules/services/editors/emacs.nix
index d791b387665..00d9eaad9eb 100644
--- a/nixos/modules/services/editors/emacs.nix
+++ b/nixos/modules/services/editors/emacs.nix
@@ -15,26 +15,27 @@ let
     fi
   '';
 
-desktopApplicationFile = pkgs.writeTextFile {
-  name = "emacsclient.desktop";
-  destination = "/share/applications/emacsclient.desktop";
-  text = ''
-[Desktop Entry]
-Name=Emacsclient
-GenericName=Text Editor
-Comment=Edit text
-MimeType=text/english;text/plain;text/x-makefile;text/x-c++hdr;text/x-c++src;text/x-chdr;text/x-csrc;text/x-java;text/x-moc;text/x-pascal;text/x-tcl;text/x-tex;application/x-shellscript;text/x-c;text/x-c++;
-Exec=emacseditor %F
-Icon=emacs
-Type=Application
-Terminal=false
-Categories=Development;TextEditor;
-StartupWMClass=Emacs
-Keywords=Text;Editor;
-'';
-};
-
-in {
+  desktopApplicationFile = pkgs.writeTextFile {
+    name = "emacsclient.desktop";
+    destination = "/share/applications/emacsclient.desktop";
+    text = ''
+      [Desktop Entry]
+      Name=Emacsclient
+      GenericName=Text Editor
+      Comment=Edit text
+      MimeType=text/english;text/plain;text/x-makefile;text/x-c++hdr;text/x-c++src;text/x-chdr;text/x-csrc;text/x-java;text/x-moc;text/x-pascal;text/x-tcl;text/x-tex;application/x-shellscript;text/x-c;text/x-c++;
+      Exec=emacseditor %F
+      Icon=emacs
+      Type=Application
+      Terminal=false
+      Categories=Development;TextEditor;
+      StartupWMClass=Emacs
+      Keywords=Text;Editor;
+    '';
+  };
+
+in
+{
 
   options.services.emacs = {
     enable = mkOption {
@@ -86,10 +87,10 @@ in {
       description = "Emacs: the extensible, self-documenting text editor";
 
       serviceConfig = {
-        Type      = "forking";
+        Type = "forking";
         ExecStart = "${pkgs.bash}/bin/bash -c 'source ${config.system.build.setEnvironment}; exec ${cfg.package}/bin/emacs --daemon'";
-        ExecStop  = "${cfg.package}/bin/emacsclient --eval (kill-emacs)";
-        Restart   = "always";
+        ExecStop = "${cfg.package}/bin/emacsclient --eval (kill-emacs)";
+        Restart = "always";
       };
     } // optionalAttrs cfg.enable { wantedBy = [ "default.target" ]; };
 
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index fa393de3219..5d8de3b1bbd 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -696,7 +696,6 @@ in {
       "L+ /run/gitlab/shell-config.yml - - - - ${pkgs.writeText "config.yml" (builtins.toJSON gitlabShellConfig)}"
 
       "L+ ${cfg.statePath}/config/unicorn.rb - - - - ${./defaultUnicornConfig.rb}"
-      "L+ ${cfg.statePath}/config/initializers/extra-gitlab.rb - - - - ${extraGitlabRb}"
     ];
 
     systemd.services.gitlab-sidekiq = {
@@ -816,6 +815,7 @@ in {
             rm -f ${cfg.statePath}/lib
             cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/config.dist/* ${cfg.statePath}/config
             cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/db/* ${cfg.statePath}/db
+            ln -sf ${extraGitlabRb} ${cfg.statePath}/config/initializers/extra-gitlab.rb
 
             ${cfg.packages.gitlab-shell}/bin/install
 
diff --git a/nixos/modules/services/misc/mathics.nix b/nixos/modules/services/misc/mathics.nix
deleted file mode 100644
index c588a30d76c..00000000000
--- a/nixos/modules/services/misc/mathics.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-{ pkgs, lib, config, ... }:
-
-with lib;
-
-let
-  cfg = config.services.mathics;
-
-in {
-  options = {
-    services.mathics = {
-      enable = mkEnableOption "Mathics notebook service";
-
-      external = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Listen on all interfaces, rather than just localhost?";
-      };
-
-      port = mkOption {
-        type = types.int;
-        default = 8000;
-        description = "TCP port to listen on.";
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-
-    users.users.mathics = {
-      group = config.users.groups.mathics.name;
-      description = "Mathics user";
-      home = "/var/lib/mathics";
-      createHome = true;
-      uid = config.ids.uids.mathics;
-    };
-
-    users.groups.mathics.gid = config.ids.gids.mathics;
-
-    systemd.services.mathics = {
-      description = "Mathics notebook server";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-      serviceConfig = {
-        User = config.users.users.mathics.name;
-        Group = config.users.groups.mathics.name;
-        ExecStart = concatStringsSep " " [
-          "${pkgs.mathics}/bin/mathicsserver"
-          "--port" (toString cfg.port)
-          (if cfg.external then "--external" else "")
-        ];
-      };
-    };
-  };
-}
diff --git a/nixos/modules/services/misc/mesos-master.nix b/nixos/modules/services/misc/mesos-master.nix
deleted file mode 100644
index 572a9847e46..00000000000
--- a/nixos/modules/services/misc/mesos-master.nix
+++ /dev/null
@@ -1,125 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.mesos.master;
-
-in {
-
-  options.services.mesos = {
-
-    master = {
-      enable = mkOption {
-        description = "Whether to enable the Mesos Master.";
-        default = false;
-        type = types.bool;
-      };
-
-      ip = mkOption {
-        description = "IP address to listen on.";
-        default = "0.0.0.0";
-        type = types.str;
-      };
-
-      port = mkOption {
-        description = "Mesos Master port";
-        default = 5050;
-        type = types.int;
-      };
-
-      advertiseIp = mkOption {
-        description = "IP address advertised to reach this master.";
-        default = null;
-        type = types.nullOr types.str;
-      };
-
-      advertisePort = mkOption {
-        description = "Port advertised to reach this Mesos master.";
-        default = null;
-        type = types.nullOr types.int;
-      };
-
-      zk = mkOption {
-        description = ''
-          ZooKeeper URL (used for leader election amongst masters).
-          May be one of:
-            zk://host1:port1,host2:port2,.../mesos
-            zk://username:password@host1:port1,host2:port2,.../mesos
-        '';
-        type = types.str;
-      };
-
-      workDir = mkOption {
-        description = "The Mesos work directory.";
-        default = "/var/lib/mesos/master";
-        type = types.str;
-      };
-
-      extraCmdLineOptions = mkOption {
-        description = ''
-          Extra command line options for Mesos Master.
-
-          See https://mesos.apache.org/documentation/latest/configuration/
-        '';
-        default = [ "" ];
-        type = types.listOf types.str;
-        example = [ "--credentials=VALUE" ];
-      };
-
-      quorum = mkOption {
-        description = ''
-          The size of the quorum of replicas when using 'replicated_log' based
-          registry. It is imperative to set this value to be a majority of
-          masters i.e., quorum > (number of masters)/2.
-
-          If 0 will fall back to --registry=in_memory.
-        '';
-        default = 0;
-        type = types.int;
-      };
-
-      logLevel = mkOption {
-        description = ''
-          The logging level used. Possible values:
-            'INFO', 'WARNING', 'ERROR'
-        '';
-        default = "INFO";
-        type = types.str;
-      };
-
-    };
-
-
-  };
-
-
-  config = mkIf cfg.enable {
-    systemd.tmpfiles.rules = [
-      "d '${cfg.workDir}' 0700 - - - -"
-    ];
-    systemd.services.mesos-master = {
-      description = "Mesos Master";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-      serviceConfig = {
-        ExecStart = ''
-          ${pkgs.mesos}/bin/mesos-master \
-            --ip=${cfg.ip} \
-            --port=${toString cfg.port} \
-            ${optionalString (cfg.advertiseIp != null) "--advertise_ip=${cfg.advertiseIp}"} \
-            ${optionalString (cfg.advertisePort  != null) "--advertise_port=${toString cfg.advertisePort}"} \
-            ${if cfg.quorum == 0
-              then "--registry=in_memory"
-              else "--zk=${cfg.zk} --registry=replicated_log --quorum=${toString cfg.quorum}"} \
-            --work_dir=${cfg.workDir} \
-            --logging_level=${cfg.logLevel} \
-            ${toString cfg.extraCmdLineOptions}
-        '';
-        Restart = "on-failure";
-      };
-    };
-  };
-
-}
-
diff --git a/nixos/modules/services/misc/mesos-slave.nix b/nixos/modules/services/misc/mesos-slave.nix
deleted file mode 100644
index 170065d0065..00000000000
--- a/nixos/modules/services/misc/mesos-slave.nix
+++ /dev/null
@@ -1,220 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.mesos.slave;
-
-  mkAttributes =
-    attrs: concatStringsSep ";" (mapAttrsToList
-                                   (k: v: "${k}:${v}")
-                                   (filterAttrs (k: v: v != null) attrs));
-  attribsArg = optionalString (cfg.attributes != {})
-                              "--attributes=${mkAttributes cfg.attributes}";
-
-  containerizersArg = concatStringsSep "," (
-    lib.unique (
-      cfg.containerizers ++ (optional cfg.withDocker "docker")
-    )
-  );
-
-  imageProvidersArg = concatStringsSep "," (
-    lib.unique (
-      cfg.imageProviders ++ (optional cfg.withDocker "docker")
-    )
-  );
-
-  isolationArg = concatStringsSep "," (
-    lib.unique (
-      cfg.isolation ++ (optionals cfg.withDocker [ "filesystem/linux" "docker/runtime"])
-    )
-  );
-
-in {
-
-  options.services.mesos = {
-    slave = {
-      enable = mkOption {
-        description = "Whether to enable the Mesos Slave.";
-        default = false;
-        type = types.bool;
-      };
-
-      ip = mkOption {
-        description = "IP address to listen on.";
-        default = "0.0.0.0";
-        type = types.str;
-      };
-
-      port = mkOption {
-        description = "Port to listen on.";
-        default = 5051;
-        type = types.int;
-      };
-
-      advertiseIp = mkOption {
-        description = "IP address advertised to reach this agent.";
-        default = null;
-        type = types.nullOr types.str;
-      };
-
-      advertisePort = mkOption {
-        description = "Port advertised to reach this agent.";
-        default = null;
-        type = types.nullOr types.int;
-      };
-
-      containerizers = mkOption {
-        description = ''
-          List of containerizer implementations to compose in order to provide
-          containerization. Available options are mesos and docker.
-          The order the containerizers are specified is the order they are tried.
-        '';
-        default = [ "mesos" ];
-        type = types.listOf types.str;
-      };
-
-      imageProviders = mkOption {
-        description = "List of supported image providers, e.g., APPC,DOCKER.";
-        default = [ ];
-        type = types.listOf types.str;
-      };
-
-      imageProvisionerBackend = mkOption {
-        description = ''
-          Strategy for provisioning container rootfs from images,
-          e.g., aufs, bind, copy, overlay.
-        '';
-        default = "copy";
-        type = types.str;
-      };
-
-      isolation = mkOption {
-        description = ''
-          Isolation mechanisms to use, e.g., posix/cpu,posix/mem, or
-          cgroups/cpu,cgroups/mem, or network/port_mapping, or `gpu/nvidia` for nvidia
-          specific gpu isolation.
-        '';
-        default = [ "posix/cpu" "posix/mem" ];
-        type = types.listOf types.str;
-      };
-
-      master = mkOption {
-        description = ''
-          May be one of:
-            zk://host1:port1,host2:port2,.../path
-            zk://username:password@host1:port1,host2:port2,.../path
-        '';
-        type = types.str;
-      };
-
-      withHadoop = mkOption {
-        description = "Add the HADOOP_HOME to the slave.";
-        default = false;
-        type = types.bool;
-      };
-
-      withDocker = mkOption {
-        description = "Enable the docker containerizer.";
-        default = config.virtualisation.docker.enable;
-        type = types.bool;
-      };
-
-      dockerRegistry = mkOption {
-        description = ''
-          The default url for pulling Docker images.
-          It could either be a Docker registry server url,
-          or a local path in which Docker image archives are stored.
-        '';
-        default = null;
-        type = types.nullOr (types.either types.str types.path);
-      };
-
-      workDir = mkOption {
-        description = "The Mesos work directory.";
-        default = "/var/lib/mesos/slave";
-        type = types.str;
-      };
-
-      extraCmdLineOptions = mkOption {
-        description = ''
-          Extra command line options for Mesos Slave.
-
-          See https://mesos.apache.org/documentation/latest/configuration/
-        '';
-        default = [ "" ];
-        type = types.listOf types.str;
-        example = [ "--gc_delay=3days" ];
-      };
-
-      logLevel = mkOption {
-        description = ''
-          The logging level used. Possible values:
-            'INFO', 'WARNING', 'ERROR'
-        '';
-        default = "INFO";
-        type = types.str;
-      };
-
-      attributes = mkOption {
-        description = ''
-          Machine attributes for the slave instance.
-
-          Use caution when changing this; you may need to manually reset slave
-          metadata before the slave can re-register.
-        '';
-        default = {};
-        type = types.attrsOf types.str;
-        example = { rack = "aa";
-                    host = "aabc123";
-                    os = "nixos"; };
-      };
-
-      executorEnvironmentVariables = mkOption {
-        description = ''
-          The environment variables that should be passed to the executor, and thus subsequently task(s).
-        '';
-        default = {
-          PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
-        };
-        type = types.attrsOf types.str;
-      };
-    };
-
-  };
-
-  config = mkIf cfg.enable {
-    systemd.tmpfiles.rules = [
-      "d '${cfg.workDir}' 0701 - - - -"
-    ];
-    systemd.services.mesos-slave = {
-      description = "Mesos Slave";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ] ++ optionals cfg.withDocker [ "docker.service" ] ;
-      path = [ pkgs.runtimeShellPackage ];
-      serviceConfig = {
-        ExecStart = ''
-          ${pkgs.mesos}/bin/mesos-slave \
-            --containerizers=${containerizersArg} \
-            --image_providers=${imageProvidersArg} \
-            --image_provisioner_backend=${cfg.imageProvisionerBackend} \
-            --isolation=${isolationArg} \
-            --ip=${cfg.ip} \
-            --port=${toString cfg.port} \
-            ${optionalString (cfg.advertiseIp != null) "--advertise_ip=${cfg.advertiseIp}"} \
-            ${optionalString (cfg.advertisePort  != null) "--advertise_port=${toString cfg.advertisePort}"} \
-            --master=${cfg.master} \
-            --work_dir=${cfg.workDir} \
-            --logging_level=${cfg.logLevel} \
-            ${attribsArg} \
-            ${optionalString cfg.withHadoop "--hadoop-home=${pkgs.hadoop}"} \
-            ${optionalString cfg.withDocker "--docker=${pkgs.docker}/libexec/docker/docker"} \
-            ${optionalString (cfg.dockerRegistry != null) "--docker_registry=${cfg.dockerRegistry}"} \
-            --executor_environment_variables=${lib.escapeShellArg (builtins.toJSON cfg.executorEnvironmentVariables)} \
-            ${toString cfg.extraCmdLineOptions}
-        '';
-      };
-    };
-  };
-
-}
diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
index 26ddd4e811e..ccb34163d5f 100644
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@@ -129,13 +129,17 @@ in {
     systemd.services."kresd@".serviceConfig = {
       ExecStart = "${package}/bin/kresd --noninteractive "
         + "-c ${package}/lib/knot-resolver/distro-preconfig.lua -c ${configFile}";
-      # Ensure correct ownership in case UID or GID changes.
+      # Ensure /run/knot-resolver exists
+      RuntimeDirectory = "knot-resolver";
+      RuntimeDirectoryMode = "0770";
+      # Ensure /var/lib/knot-resolver exists
+      StateDirectory = "knot-resolver";
+      StateDirectoryMode = "0770";
+      # Ensure /var/cache/knot-resolver exists
       CacheDirectory = "knot-resolver";
-      CacheDirectoryMode = "0750";
+      CacheDirectoryMode = "0770";
     };
 
-    systemd.tmpfiles.packages = [ package ];
-
     # Try cleaning up the previously default location of cache file.
     # Note that /var/cache/* should always be safe to remove.
     # TODO: remove later, probably between 20.09 and 21.03
diff --git a/nixos/modules/services/scheduling/chronos.nix b/nixos/modules/services/scheduling/chronos.nix
deleted file mode 100644
index 9a8ed4c09ac..00000000000
--- a/nixos/modules/services/scheduling/chronos.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.chronos;
-
-in {
-
-  ###### interface
-
-  options.services.chronos = {
-    enable = mkOption {
-      description = "Whether to enable graphite web frontend.";
-      default = false;
-      type = types.bool;
-    };
-
-    httpPort = mkOption {
-      description = "Chronos listening port";
-      default = 4400;
-      type = types.int;
-    };
-
-    master = mkOption {
-      description = "Chronos mesos master zookeeper address";
-      default = "zk://${head cfg.zookeeperHosts}/mesos";
-      type = types.str;
-    };
-
-    zookeeperHosts = mkOption {
-      description = "Chronos mesos zookepper addresses";
-      default = [ "localhost:2181" ];
-      type = types.listOf types.str;
-    };
-  };
-
-  ###### implementation
-
-  config = mkIf cfg.enable {
-    systemd.services.chronos = {
-      description = "Chronos Service";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" "zookeeper.service" ];
-
-      serviceConfig = {
-        ExecStart = "${pkgs.chronos}/bin/chronos --master ${cfg.master} --zk_hosts ${concatStringsSep "," cfg.zookeeperHosts} --http_port ${toString cfg.httpPort}";
-        User = "chronos";
-      };
-    };
-
-    users.users.chronos.uid = config.ids.uids.chronos;
-  };
-}
diff --git a/nixos/modules/services/scheduling/marathon.nix b/nixos/modules/services/scheduling/marathon.nix
deleted file mode 100644
index 2e0d20c64b2..00000000000
--- a/nixos/modules/services/scheduling/marathon.nix
+++ /dev/null
@@ -1,98 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.services.marathon;
-
-in {
-
-  ###### interface
-
-  options.services.marathon = {
-    enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-	Whether to enable the marathon mesos framework.
-      '';
-    };
-
-    master = mkOption {
-      type = types.str;
-      default = "zk://${concatStringsSep "," cfg.zookeeperHosts}/mesos";
-      example = "zk://1.2.3.4:2181,2.3.4.5:2181,3.4.5.6:2181/mesos";
-      description = ''
-	Mesos master address. See <link xlink:href="https://mesosphere.github.io/marathon/docs/"/> for details.
-      '';
-    };
-
-    zookeeperHosts = mkOption {
-      type = types.listOf types.str;
-      default = [ "localhost:2181" ];
-      example = [ "1.2.3.4:2181" "2.3.4.5:2181" "3.4.5.6:2181" ];
-      description = ''
-	ZooKeeper hosts' addresses.
-      '';
-    };
-
-    user = mkOption {
-      type = types.str;
-      default = "marathon";
-      example = "root";
-      description = ''
-	The user that the Marathon framework will be launched as. If the user doesn't exist it will be created.
-	If you want to run apps that require root access or you want to launch apps using arbitrary users, that
-	is using the `--mesos_user` flag then you need to change this to `root`.
-      '';
-    };
-
-    httpPort = mkOption {
-      type = types.int;
-      default = 8080;
-      description = ''
-	Marathon listening port for HTTP connections.
-      '';
-    };
-
-    extraCmdLineOptions = mkOption {
-      type = types.listOf types.str;
-      default = [ ];
-      example = [ "--https_port=8443" "--zk_timeout=10000" "--marathon_store_timeout=2000" ];
-      description = ''
-	Extra command line options to pass to Marathon.
-	See <link xlink:href="https://mesosphere.github.io/marathon/docs/command-line-flags.html"/> for all possible flags.
-      '';
-    };
-
-    environment = mkOption {
-      default = { };
-      type = types.attrs;
-      example = { JAVA_OPTS = "-Xmx512m"; MESOSPHERE_HTTP_CREDENTIALS = "username:password"; };
-      description = ''
-	Environment variables passed to Marathon.
-      '';
-    };
-  };
-
-  ###### implementation
-
-  config = mkIf cfg.enable {
-    systemd.services.marathon = {
-      description = "Marathon Service";
-      environment = cfg.environment;
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" "zookeeper.service" "mesos-master.service" "mesos-slave.service" ];
-
-      serviceConfig = {
-        ExecStart = "${pkgs.marathon}/bin/marathon --master ${cfg.master} --zk zk://${concatStringsSep "," cfg.zookeeperHosts}/marathon --http_port ${toString cfg.httpPort} ${concatStringsSep " " cfg.extraCmdLineOptions}";
-        User = cfg.user;
-        Restart = "always";
-        RestartSec = "2";
-      };
-    };
-
-    users.users.${cfg.user}.isSystemUser = true;
-  };
-}
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index d9660852528..7da119758fc 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -47,8 +47,18 @@ let
 in {
 
   imports = [
-    ( mkRemovedOptionModule [ "services" "nextcloud" "nginx" "enable" ]
-      "The nextcloud module dropped support for other webservers than nginx.")
+    (mkRemovedOptionModule [ "services" "nextcloud" "nginx" "enable" ] ''
+      The nextcloud module supports `nginx` as reverse-proxy by default and doesn't
+      support other reverse-proxies officially.
+
+      However it's possible to use an alternative reverse-proxy by
+
+        * disabling nginx
+        * setting `listen.owner` & `listen.group` in the phpfpm-pool to a different value
+
+      Further details about this can be found in the `Nextcloud`-section of the NixOS-manual
+      (which can be openend e.g. by running `nixos-help`).
+    '')
   ];
 
   options.services.nextcloud = {
@@ -544,36 +554,40 @@ in {
             '';
           };
           "/" = {
-            priority = 200;
-            extraConfig = "rewrite ^ /index.php;";
+            priority = 900;
+            extraConfig = "try_files $uri $uri/ /index.php$request_uri;";
           };
           "~ ^/store-apps" = {
             priority = 201;
             extraConfig = "root ${cfg.home};";
           };
-          "= /.well-known/carddav" = {
+          "^~ /.well-known" = {
             priority = 210;
-            extraConfig = "return 301 $scheme://$host/remote.php/dav;";
-          };
-          "= /.well-known/caldav" = {
-            priority = 210;
-            extraConfig = "return 301 $scheme://$host/remote.php/dav;";
-          };
-          "~ ^\\/(?:build|tests|config|lib|3rdparty|templates|data)\\/" = {
-            priority = 300;
-            extraConfig = "deny all;";
-          };
-          "~ ^\\/(?:\\.|autotest|occ|issue|indie|db_|console)" = {
-            priority = 300;
-            extraConfig = "deny all;";
+            extraConfig = ''
+              location = /.well-known/carddav {
+                return 301 $scheme://$host/remote.php/dav;
+              }
+              location = /.well-known/caldav {
+                return 301 $scheme://$host/remote.php/dav;
+              }
+              try_files $uri $uri/ =404;
+            '';
           };
-          "~ ^\\/(?:index|remote|public|cron|core/ajax\\/update|status|ocs\\/v[12]|updater\\/.+|ocs-provider\\/.+|ocm-provider\\/.+)\\.php(?:$|\\/)" = {
+          "~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)".extraConfig = ''
+            return 404;
+          '';
+          "~ ^/(?:\\.|autotest|occ|issue|indie|db_|console)".extraConfig = ''
+            return 404;
+          '';
+          "~ \\.php(?:$|/)" = {
             priority = 500;
             extraConfig = ''
               include ${config.services.nginx.package}/conf/fastcgi.conf;
-              fastcgi_split_path_info ^(.+\.php)(\\/.*)$;
+              fastcgi_split_path_info ^(.+?\.php)(\\/.*)$;
+              set $path_info $fastcgi_path_info;
               try_files $fastcgi_script_name =404;
-              fastcgi_param PATH_INFO $fastcgi_path_info;
+              fastcgi_param PATH_INFO $path_info;
+              fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
               fastcgi_param HTTPS ${if cfg.https then "on" else "off"};
               fastcgi_param modHeadersAvailable true;
               fastcgi_param front_controller_active true;
@@ -583,28 +597,24 @@ in {
               fastcgi_read_timeout 120s;
             '';
           };
-          "~ ^\\/(?:updater|ocs-provider|ocm-provider)(?:$|\\/)".extraConfig = ''
-            try_files $uri/ =404;
-            index index.php;
-          '';
-          "~ \\.(?:css|js|woff2?|svg|gif)$".extraConfig = ''
+          "~ \\.(?:css|js|svg|gif|map)$".extraConfig = ''
             try_files $uri /index.php$request_uri;
-            add_header Cache-Control "public, max-age=15778463";
-            add_header X-Content-Type-Options nosniff;
-            add_header X-XSS-Protection "1; mode=block";
-            add_header X-Robots-Tag none;
-            add_header X-Download-Options noopen;
-            add_header X-Permitted-Cross-Domain-Policies none;
-            add_header X-Frame-Options sameorigin;
-            add_header Referrer-Policy no-referrer;
+            expires 6M;
             access_log off;
           '';
-          "~ \\.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$".extraConfig = ''
+          "~ \\.woff2?$".extraConfig = ''
             try_files $uri /index.php$request_uri;
+            expires 7d;
             access_log off;
           '';
+          "~ ^\\/(?:updater|ocs-provider|ocm-provider)(?:$|\\/)".extraConfig = ''
+            try_files $uri/ =404;
+            index index.php;
+          '';
         };
         extraConfig = ''
+          index index.php index.html /index.php$request_uri;
+          expires 1m;
           add_header X-Content-Type-Options nosniff;
           add_header X-XSS-Protection "1; mode=block";
           add_header X-Robots-Tag none;
@@ -613,8 +623,6 @@ in {
           add_header X-Frame-Options sameorigin;
           add_header Referrer-Policy no-referrer;
           add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
-          error_page 403 /core/templates/403.php;
-          error_page 404 /core/templates/404.php;
           client_max_body_size ${cfg.maxUploadSize};
           fastcgi_buffers 64 4K;
           fastcgi_hide_header X-Powered-By;
diff --git a/nixos/modules/services/web-apps/nextcloud.xml b/nixos/modules/services/web-apps/nextcloud.xml
index f8b92244c89..02e4dba2861 100644
--- a/nixos/modules/services/web-apps/nextcloud.xml
+++ b/nixos/modules/services/web-apps/nextcloud.xml
@@ -123,6 +123,61 @@
   </para>
  </section>
 
+ <section xml:id="module-services-nextcloud-httpd">
+  <title>Using an alternative webserver as reverse-proxy (e.g. <literal>httpd</literal>)</title>
+  <para>
+   By default, <package>nginx</package> is used as reverse-proxy for <package>nextcloud</package>.
+   However, it's possible to use e.g. <package>httpd</package> by explicitly disabling
+   <package>nginx</package> using <xref linkend="opt-services.nginx.enable" /> and fixing the
+   settings <literal>listen.owner</literal> &amp; <literal>listen.group</literal> in the
+   <link linkend="opt-services.phpfpm.pools">corresponding <literal>phpfpm</literal> pool</link>.
+  </para>
+  <para>
+   An exemplary configuration may look like this:
+<programlisting>{ config, lib, pkgs, ... }: {
+  <link linkend="opt-services.nginx.enable">services.nginx.enable</link> = false;
+  services.nextcloud = {
+    <link linkend="opt-services.nextcloud.enable">enable</link> = true;
+    <link linkend="opt-services.nextcloud.hostName">hostName</link> = "localhost";
+
+    /* further, required options */
+  };
+  <link linkend="opt-services.phpfpm.pools._name_.settings">services.phpfpm.pools.nextcloud.settings</link> = {
+    "listen.owner" = config.services.httpd.user;
+    "listen.group" = config.services.httpd.group;
+  };
+  services.httpd = {
+    <link linkend="opt-services.httpd.enable">enable</link> = true;
+    <link linkend="opt-services.httpd.adminAddr">adminAddr</link> = "webmaster@localhost";
+    <link linkend="opt-services.httpd.extraModules">extraModules</link> = [ "proxy_fcgi" ];
+    virtualHosts."localhost" = {
+      <link linkend="opt-services.httpd.virtualHosts._name_.documentRoot">documentRoot</link> = config.services.nextcloud.package;
+      <link linkend="opt-services.httpd.virtualHosts._name_.extraConfig">extraConfig</link> = ''
+        &lt;Directory "${config.services.nextcloud.package}"&gt;
+          &lt;FilesMatch "\.php$"&gt;
+            &lt;If "-f %{REQUEST_FILENAME}"&gt;
+              SetHandler "proxy:unix:${config.services.phpfpm.pools.nextcloud.socket}|fcgi://localhost/"
+            &lt;/If&gt;
+          &lt;/FilesMatch&gt;
+          &lt;IfModule mod_rewrite.c&gt;
+            RewriteEngine On
+            RewriteBase /
+            RewriteRule ^index\.php$ - [L]
+            RewriteCond %{REQUEST_FILENAME} !-f
+            RewriteCond %{REQUEST_FILENAME} !-d
+            RewriteRule . /index.php [L]
+          &lt;/IfModule&gt;
+          DirectoryIndex index.php
+          Require all granted
+          Options +FollowSymLinks
+        &lt;/Directory&gt;
+      '';
+    };
+  };
+}</programlisting>
+  </para>
+ </section>
+
  <section xml:id="module-services-nextcloud-maintainer-info">
   <title>Maintainer information</title>
 
diff --git a/nixos/modules/services/web-servers/unit/default.nix b/nixos/modules/services/web-servers/unit/default.nix
index 65dcdbed000..894271d1e55 100644
--- a/nixos/modules/services/web-servers/unit/default.nix
+++ b/nixos/modules/services/web-servers/unit/default.nix
@@ -120,9 +120,12 @@ in {
         ProtectHome = true;
         PrivateTmp = true;
         PrivateDevices = true;
+        PrivateUsers = false;
         ProtectHostname = true;
+        ProtectClock = true;
         ProtectKernelTunables = true;
         ProtectKernelModules = true;
+        ProtectKernelLogs = true;
         ProtectControlGroups = true;
         RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
         LockPersonality = true;
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 39be069ad0e..b215392f250 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -81,10 +81,6 @@ let
       "systemd-coredump.socket"
       "systemd-coredump@.service"
 
-      # SysV init compatibility.
-      "systemd-initctl.socket"
-      "systemd-initctl.service"
-
       # Kernel module loading.
       "systemd-modules-load.service"
       "kmod-static-nodes.service"
@@ -1012,18 +1008,18 @@ in
       "sysctl.d/50-coredump.conf".source = "${systemd}/example/sysctl.d/50-coredump.conf";
       "sysctl.d/50-default.conf".source = "${systemd}/example/sysctl.d/50-default.conf";
 
-      "tmpfiles.d".source = (pkgs.symlinkJoin {
+      "tmpfiles.d".source = pkgs.symlinkJoin {
         name = "tmpfiles.d";
-        paths = cfg.tmpfiles.packages;
+        paths = map (p: p + "/lib/tmpfiles.d") cfg.tmpfiles.packages;
         postBuild = ''
           for i in $(cat $pathsPath); do
-            (test -d $i/lib/tmpfiles.d && test $(ls $i/lib/tmpfiles.d/*.conf | wc -l) -ge 1) || (
-              echo "ERROR: The path $i was passed to systemd.tmpfiles.packages but either does not contain the folder lib/tmpfiles.d or if it contains that folder, there are no files ending in .conf in it."
+            (test -d "$i" && test $(ls "$i"/*.conf | wc -l) -ge 1) || (
+              echo "ERROR: The path '$i' from systemd.tmpfiles.packages contains no *.conf files."
               exit 1
             )
           done
         '';
-      }) + "/lib/tmpfiles.d";
+      };
 
       "systemd/system-generators" = { source = hooks "generators" cfg.generators; };
       "systemd/system-shutdown" = { source = hooks "shutdown" cfg.shutdown; };
diff --git a/nixos/modules/tasks/filesystems/zfs.nix b/nixos/modules/tasks/filesystems/zfs.nix
index c9d9c6c1657..9ca7c6fb343 100644
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@@ -191,13 +191,14 @@ in
       };
 
       requestEncryptionCredentials = mkOption {
-        type = types.bool;
+        type = types.either types.bool (types.listOf types.str);
         default = true;
+        example = [ "tank" "data" ];
         description = ''
-          Request encryption keys or passwords for all encrypted datasets on import.
-          For root pools the encryption key can be supplied via both an
-          interactive prompt (keylocation=prompt) and from a file
-          (keylocation=file://).
+          If true on import encryption keys or passwords for all encrypted datasets
+          are requested. To only decrypt selected datasets supply a list of dataset
+          names instead. For root pools the encryption key can be supplied via both
+          an interactive prompt (keylocation=prompt) and from a file (keylocation=file://).
         '';
       };
 
@@ -419,9 +420,13 @@ in
               fi
               poolImported "${pool}" || poolImport "${pool}"  # Try one last time, e.g. to import a degraded pool.
             fi
-            ${lib.optionalString cfgZfs.requestEncryptionCredentials ''
-              zfs load-key -a
-            ''}
+            ${if isBool cfgZfs.requestEncryptionCredentials
+              then optionalString cfgZfs.requestEncryptionCredentials ''
+                zfs load-key -a
+              ''
+              else concatMapStrings (fs: ''
+                zfs load-key ${fs}
+              '') cfgZfs.requestEncryptionCredentials}
         '') rootPools));
       };
 
@@ -517,9 +522,16 @@ in
               done
               poolImported "${pool}" || poolImport "${pool}"  # Try one last time, e.g. to import a degraded pool.
               if poolImported "${pool}"; then
-                ${optionalString cfgZfs.requestEncryptionCredentials ''
+                ${optionalString (if isBool cfgZfs.requestEncryptionCredentials
+                                  then cfgZfs.requestEncryptionCredentials
+                                  else cfgZfs.requestEncryptionCredentials != []) ''
                   ${packages.zfsUser}/sbin/zfs list -rHo name,keylocation ${pool} | while IFS=$'\t' read ds kl; do
-                    (case "$kl" in
+                    (${optionalString (!isBool cfgZfs.requestEncryptionCredentials) ''
+                         if ! echo '${concatStringsSep "\n" cfgZfs.requestEncryptionCredentials}' | grep -qFx "$ds"; then
+                           continue
+                         fi
+                       ''}
+                    case "$kl" in
                       none )
                         ;;
                       prompt )
diff --git a/nixos/modules/testing/test-instrumentation.nix b/nixos/modules/testing/test-instrumentation.nix
index 1baeab53b0c..a6b34e36d20 100644
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@@ -55,7 +55,12 @@ with import ../../lib/qemu-flags.nix { inherit pkgs; };
     systemd.services."serial-getty@hvc0".enable = false;
 
     # Only use a serial console, no TTY.
-    virtualisation.qemu.consoles = [ qemuSerialDevice ];
+    # NOTE: optionalAttrs
+    #       test-instrumentation.nix appears to be used without qemu-vm.nix, so
+    #       we avoid defining consoles if not possible.
+    # TODO: refactor such that test-instrumentation can import qemu-vm
+    #       or declare virtualisation.qemu.console option in a module that's always imported
+    virtualisation = lib.optionalAttrs (options ? virtualisation.qemu.consoles) { qemu.consoles = [ qemuSerialDevice ]; };
 
     boot.initrd.preDeviceCommands =
       ''
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 10432e1cb52..a4a62d85a59 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -195,12 +195,10 @@ in
   mailcatcher = handleTest ./mailcatcher.nix {};
   mariadb-galera-mariabackup = handleTest ./mysql/mariadb-galera-mariabackup.nix {};
   mariadb-galera-rsync = handleTest ./mysql/mariadb-galera-rsync.nix {};
-  mathics = handleTest ./mathics.nix {};
   matomo = handleTest ./matomo.nix {};
   matrix-synapse = handleTest ./matrix-synapse.nix {};
   mediawiki = handleTest ./mediawiki.nix {};
   memcached = handleTest ./memcached.nix {};
-  mesos = handleTest ./mesos.nix {};
   metabase = handleTest ./metabase.nix {};
   miniflux = handleTest ./miniflux.nix {};
   minio = handleTest ./minio.nix {};
diff --git a/nixos/tests/mathics.nix b/nixos/tests/mathics.nix
deleted file mode 100644
index fcbeeb18a72..00000000000
--- a/nixos/tests/mathics.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-import ./make-test.nix ({ pkgs, ... }: {
-  name = "mathics";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ benley ];
-  };
-
-  nodes = {
-    machine = { ... }: {
-      services.mathics.enable = true;
-      services.mathics.port = 8888;
-    };
-  };
-
-  testScript = ''
-    startAll;
-    $machine->waitForUnit("mathics.service");
-    $machine->waitForOpenPort(8888);
-    $machine->succeed("curl http://localhost:8888/");
-  '';
-})
diff --git a/nixos/tests/mesos.nix b/nixos/tests/mesos.nix
deleted file mode 100644
index 2e6dc0eda06..00000000000
--- a/nixos/tests/mesos.nix
+++ /dev/null
@@ -1,92 +0,0 @@
-import ./make-test.nix ({ pkgs, ...} : rec {
-  name = "mesos";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ offline kamilchm cstrahan ];
-  };
-
-  nodes = {
-    master = { ... }: {
-      networking.firewall.enable = false;
-      services.zookeeper.enable = true;
-      services.mesos.master = {
-          enable = true;
-          zk = "zk://master:2181/mesos";
-      };
-    };
-
-    slave = { ... }: {
-      networking.firewall.enable = false;
-      networking.nat.enable = true;
-      virtualisation.docker.enable = true;
-      services.mesos = {
-        slave = {
-          enable = true;
-          master = "master:5050";
-          dockerRegistry = registry;
-          executorEnvironmentVariables = {
-            PATH = "/run/current-system/sw/bin";
-          };
-        };
-      };
-    };
-  };
-
-  simpleDocker = pkgs.dockerTools.buildImage {
-    name = "echo";
-    tag = "latest";
-    contents = [ pkgs.stdenv.shellPackage pkgs.coreutils ];
-    config = {
-      Env = [
-        # When shell=true, mesos invokes "sh -c '<cmd>'", so make sure "sh" is
-        # on the PATH.
-        "PATH=${pkgs.stdenv.shellPackage}/bin:${pkgs.coreutils}/bin"
-      ];
-      Entrypoint = [ "echo" ];
-    };
-  };
-
-  registry = pkgs.runCommand "registry" { } ''
-    mkdir -p $out
-    cp ${simpleDocker} $out/echo:latest.tar
-  '';
-
-  testFramework = pkgs.pythonPackages.buildPythonPackage {
-    name = "mesos-tests";
-    propagatedBuildInputs = [ pkgs.mesos ];
-    catchConflicts = false;
-    src = ./mesos_test.py;
-    phases = [ "installPhase" "fixupPhase" ];
-    installPhase = ''
-      install -Dvm 0755 $src $out/bin/mesos_test.py
-
-      echo "done" > test.result
-      tar czf $out/test.tar.gz test.result
-    '';
-  };
-
-  testScript =
-    ''
-      startAll;
-      $master->waitForUnit("zookeeper.service");
-      $master->waitForUnit("mesos-master.service");
-      $slave->waitForUnit("docker.service");
-      $slave->waitForUnit("mesos-slave.service");
-      $master->waitForOpenPort(2181);
-      $master->waitForOpenPort(5050);
-      $slave->waitForOpenPort(5051);
-
-      # is slave registered?
-      $master->waitUntilSucceeds("curl -s --fail http://master:5050/master/slaves".
-                                 " | grep -q \"\\\"hostname\\\":\\\"slave\\\"\"");
-
-      # try to run docker image
-      $master->succeed("${pkgs.mesos}/bin/mesos-execute --master=master:5050".
-                       " --resources=\"cpus:0.1;mem:32\" --name=simple-docker".
-                       " --containerizer=mesos --docker_image=echo:latest".
-                       " --shell=true --command=\"echo done\" | grep -q TASK_FINISHED");
-
-      # simple command with .tar.gz uri
-      $master->succeed("${testFramework}/bin/mesos_test.py master ".
-                       "${testFramework}/test.tar.gz");
-    '';
-})
diff --git a/nixos/tests/mesos_test.py b/nixos/tests/mesos_test.py
deleted file mode 100644
index be8bb32e49a..00000000000
--- a/nixos/tests/mesos_test.py
+++ /dev/null
@@ -1,72 +0,0 @@
-#!/usr/bin/env python
-import uuid
-import time
-import subprocess
-import os
-
-import sys
-
-from mesos.interface import Scheduler
-from mesos.native import MesosSchedulerDriver
-from mesos.interface import mesos_pb2
-
-def log(msg):
-    process = subprocess.Popen("systemd-cat", stdin=subprocess.PIPE)
-    (out,err) = process.communicate(msg)
-
-class NixosTestScheduler(Scheduler):
-    def __init__(self):
-        self.master_ip = sys.argv[1]
-        self.download_uri = sys.argv[2]
-
-    def resourceOffers(self, driver, offers):
-        log("XXX got resource offer")
-
-        offer = offers[0]
-        task = self.new_task(offer)
-        uri = task.command.uris.add()
-        uri.value = self.download_uri
-        task.command.value = "cat test.result"
-        driver.launchTasks(offer.id, [task])
-
-    def statusUpdate(self, driver, update):
-        log("XXX status update")
-        if update.state == mesos_pb2.TASK_FAILED:
-            log("XXX test task failed with message: " + update.message)
-            driver.stop()
-            sys.exit(1)
-        elif update.state == mesos_pb2.TASK_FINISHED:
-            driver.stop()
-            sys.exit(0)
-
-    def new_task(self, offer):
-        task = mesos_pb2.TaskInfo()
-        id = uuid.uuid4()
-        task.task_id.value = str(id)
-        task.slave_id.value = offer.slave_id.value
-        task.name = "task {}".format(str(id))
-
-        cpus = task.resources.add()
-        cpus.name = "cpus"
-        cpus.type = mesos_pb2.Value.SCALAR
-        cpus.scalar.value = 0.1
-
-        mem = task.resources.add()
-        mem.name = "mem"
-        mem.type = mesos_pb2.Value.SCALAR
-        mem.scalar.value = 32
-
-        return task
-
-if __name__ == '__main__':
-    log("XXX framework started")
-
-    framework = mesos_pb2.FrameworkInfo()
-    framework.user = "root"
-    framework.name = "nixos-test-framework"
-    driver = MesosSchedulerDriver(
-        NixosTestScheduler(),
-        framework,
-        sys.argv[1] + ":5050"
-    )
-    driver.run()
diff --git a/nixos/tests/misc.nix b/nixos/tests/misc.nix
index 17260ce6406..ae150553273 100644
--- a/nixos/tests/misc.nix
+++ b/nixos/tests/misc.nix
@@ -20,12 +20,24 @@ import ./make-test-python.nix ({ pkgs, ...} : rec {
         { fsType = "tmpfs";
           options = [ "mode=1777" "noauto" ];
         };
+        # Tests https://discourse.nixos.org/t/how-to-make-a-derivations-executables-have-the-s-permission/8555
+        "/user-mount/point" = {
+          device = "/user-mount/source";
+          fsType = "none";
+          options = [ "bind" "rw" "user" "noauto" ];
+        };
+        "/user-mount/denied-point" = {
+          device = "/user-mount/denied-source";
+          fsType = "none";
+          options = [ "bind" "rw" "noauto" ];
+        };
       };
       systemd.automounts = singleton
         { wantedBy = [ "multi-user.target" ];
           where = "/tmp2";
         };
       users.users.sybil = { isNormalUser = true; group = "wheel"; };
+      users.users.alice = { isNormalUser = true; };
       security.sudo = { enable = true; wheelNeedsPassword = false; };
       boot.kernel.sysctl."vm.swappiness" = 1;
       boot.kernelParams = [ "vsyscall=emulate" ];
@@ -112,6 +124,26 @@ import ./make-test-python.nix ({ pkgs, ...} : rec {
           machine.succeed("touch /tmp2/x")
           machine.succeed("grep '/tmp2 tmpfs' /proc/mounts")
 
+      with subtest(
+          "Whether mounting by a user is possible with the `user` option in fstab (#95444)"
+      ):
+          machine.succeed("mkdir -p /user-mount/source")
+          machine.succeed("touch /user-mount/source/file")
+          machine.succeed("chmod -R a+Xr /user-mount/source")
+          machine.succeed("mkdir /user-mount/point")
+          machine.succeed("chown alice:users /user-mount/point")
+          machine.succeed("su - alice -c 'mount /user-mount/point'")
+          machine.succeed("su - alice -c 'ls /user-mount/point/file'")
+      with subtest(
+          "Whether mounting by a user is denied without the `user` option in  fstab"
+      ):
+          machine.succeed("mkdir -p /user-mount/denied-source")
+          machine.succeed("touch /user-mount/denied-source/file")
+          machine.succeed("chmod -R a+Xr /user-mount/denied-source")
+          machine.succeed("mkdir /user-mount/denied-point")
+          machine.succeed("chown alice:users /user-mount/denied-point")
+          machine.fail("su - alice -c 'mount /user-mount/denied-point'")
+
       with subtest("shell-vars"):
           machine.succeed('[ -n "$NIX_PATH" ]')
 
diff --git a/nixos/tests/mysql/mysql.nix b/nixos/tests/mysql/mysql.nix
index 50e1c76e9fd..5437a286043 100644
--- a/nixos/tests/mysql/mysql.nix
+++ b/nixos/tests/mysql/mysql.nix
@@ -172,32 +172,32 @@ import ./../make-test-python.nix ({ pkgs, ...} : {
         "echo 'use testdb; select test_id from tests;' | sudo -u testuser mysql -u testuser -N | grep 42"
     )
 
-    # Check if TokuDB plugin works
+    # Check if RocksDB plugin works
     mariadb.succeed(
-        "echo 'use testdb; create table tokudb (test_id INT, PRIMARY KEY (test_id)) ENGINE = TokuDB;' | sudo -u testuser mysql -u testuser"
+        "echo 'use testdb; create table rocksdb (test_id INT, PRIMARY KEY (test_id)) ENGINE = RocksDB;' | sudo -u testuser mysql -u testuser"
     )
     mariadb.succeed(
-        "echo 'use testdb; insert into tokudb values (25);' | sudo -u testuser mysql -u testuser"
+        "echo 'use testdb; insert into rocksdb values (28);' | sudo -u testuser mysql -u testuser"
     )
     mariadb.succeed(
-        "echo 'use testdb; select test_id from tokudb;' | sudo -u testuser mysql -u testuser -N | grep 25"
+        "echo 'use testdb; select test_id from rocksdb;' | sudo -u testuser mysql -u testuser -N | grep 28"
     )
     mariadb.succeed(
-        "echo 'use testdb; drop table tokudb;' | sudo -u testuser mysql -u testuser"
+        "echo 'use testdb; drop table rocksdb;' | sudo -u testuser mysql -u testuser"
     )
-
-    # Check if RocksDB plugin works
+  '' + pkgs.stdenv.lib.optionalString pkgs.stdenv.isx86_64 ''
+    # Check if TokuDB plugin works
     mariadb.succeed(
-        "echo 'use testdb; create table rocksdb (test_id INT, PRIMARY KEY (test_id)) ENGINE = RocksDB;' | sudo -u testuser mysql -u testuser"
+        "echo 'use testdb; create table tokudb (test_id INT, PRIMARY KEY (test_id)) ENGINE = TokuDB;' | sudo -u testuser mysql -u testuser"
     )
     mariadb.succeed(
-        "echo 'use testdb; insert into rocksdb values (28);' | sudo -u testuser mysql -u testuser"
+        "echo 'use testdb; insert into tokudb values (25);' | sudo -u testuser mysql -u testuser"
     )
     mariadb.succeed(
-        "echo 'use testdb; select test_id from rocksdb;' | sudo -u testuser mysql -u testuser -N | grep 28"
+        "echo 'use testdb; select test_id from tokudb;' | sudo -u testuser mysql -u testuser -N | grep 25"
     )
     mariadb.succeed(
-        "echo 'use testdb; drop table rocksdb;' | sudo -u testuser mysql -u testuser"
+        "echo 'use testdb; drop table tokudb;' | sudo -u testuser mysql -u testuser"
     )
   '';
 })
diff --git a/nixos/tests/zfs.nix b/nixos/tests/zfs.nix
index 7ba60ee9806..87e6c900c98 100644
--- a/nixos/tests/zfs.nix
+++ b/nixos/tests/zfs.nix
@@ -46,6 +46,17 @@ let
             "zpool destroy rpool",
             "udevadm settle",
         )
+
+        machine.succeed(
+            'echo password | zpool create -o altroot="/tmp/mnt" '
+            + "-O encryption=aes-256-gcm -O keyformat=passphrase rpool /dev/vdb1",
+            "zfs create -o mountpoint=legacy rpool/root",
+            "mount -t zfs rpool/root /tmp/mnt",
+            "udevadm settle",
+            "umount /tmp/mnt",
+            "zpool destroy rpool",
+            "udevadm settle",
+        )
       '' + extraTest;
 
     };
@@ -57,18 +68,6 @@ in {
 
   unstable = makeZfsTest "unstable" {
     enableUnstable = true;
-    extraTest = ''
-      machine.succeed(
-          'echo password | zpool create -o altroot="/tmp/mnt" '
-          + "-O encryption=aes-256-gcm -O keyformat=passphrase rpool /dev/vdb1",
-          "zfs create -o mountpoint=legacy rpool/root",
-          "mount -t zfs rpool/root /tmp/mnt",
-          "udevadm settle",
-          "umount /tmp/mnt",
-          "zpool destroy rpool",
-          "udevadm settle",
-      )
-    '';
   };
 
   installer = (import ./installer.nix { }).zfsroot;