summary refs log tree commit diff
path: root/pkgs/servers
diff options
context:
space:
mode:
authorAlyssa Ross <hi@alyssa.is>2020-01-26 22:39:25 +0000
committerAlyssa Ross <hi@alyssa.is>2020-01-26 22:39:25 +0000
commitbd2ad77e38991af0d7a3a5d82bd3f41a077ce401 (patch)
treed1e26d039eb5004eb7c836aafff259cc198626d4 /pkgs/servers
parente5d8381542a8d084371d26013fab199f52474be7 (diff)
parentad3f0d9829119b611350a9be1c226fb625f1f310 (diff)
downloadnixpkgs-bd2ad77e38991af0d7a3a5d82bd3f41a077ce401.tar
nixpkgs-bd2ad77e38991af0d7a3a5d82bd3f41a077ce401.tar.gz
nixpkgs-bd2ad77e38991af0d7a3a5d82bd3f41a077ce401.tar.bz2
nixpkgs-bd2ad77e38991af0d7a3a5d82bd3f41a077ce401.tar.lz
nixpkgs-bd2ad77e38991af0d7a3a5d82bd3f41a077ce401.tar.xz
nixpkgs-bd2ad77e38991af0d7a3a5d82bd3f41a077ce401.tar.zst
nixpkgs-bd2ad77e38991af0d7a3a5d82bd3f41a077ce401.zip
Merge remote-tracking branch 'nixpkgs/master' into master
Diffstat (limited to 'pkgs/servers')
-rw-r--r--pkgs/servers/amqp/rabbitmq-server/default.nix33
-rw-r--r--pkgs/servers/apache-kafka/default.nix9
-rw-r--r--pkgs/servers/dante/default.nix4
-rw-r--r--pkgs/servers/dns/knot-resolver/default.nix3
-rw-r--r--pkgs/servers/ftp/bftpd/default.nix4
-rw-r--r--pkgs/servers/home-assistant/cli.nix2
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix55
-rw-r--r--pkgs/servers/home-assistant/default.nix71
-rw-r--r--pkgs/servers/home-assistant/esphome.nix17
-rw-r--r--pkgs/servers/home-assistant/frontend.nix4
-rwxr-xr-xpkgs/servers/home-assistant/parse-requirements.py10
-rw-r--r--pkgs/servers/http/apache-httpd/2.4.nix1
-rw-r--r--pkgs/servers/http/apache-modules/mod_ca/default.nix35
-rw-r--r--pkgs/servers/http/apache-modules/mod_crl/default.nix24
-rw-r--r--pkgs/servers/http/apache-modules/mod_csr/default.nix41
-rw-r--r--pkgs/servers/http/apache-modules/mod_csr/openssl_setter_compat.h66
-rw-r--r--pkgs/servers/http/apache-modules/mod_ocsp/default.nix24
-rw-r--r--pkgs/servers/http/apache-modules/mod_pkcs12/default.nix24
-rw-r--r--pkgs/servers/http/apache-modules/mod_scep/default.nix41
-rw-r--r--pkgs/servers/http/apache-modules/mod_scep/openssl_setter_compat.h66
-rw-r--r--pkgs/servers/http/apache-modules/mod_spkac/default.nix24
-rw-r--r--pkgs/servers/http/apache-modules/mod_timestamp/default.nix24
-rw-r--r--pkgs/servers/http/apache-modules/mod_wsgi/default.nix4
-rw-r--r--pkgs/servers/http/jetty/default.nix4
-rw-r--r--pkgs/servers/http/lwan/default.nix4
-rw-r--r--pkgs/servers/http/unit/default.nix9
-rw-r--r--pkgs/servers/http/unit/drop_cap.patch79
-rw-r--r--pkgs/servers/jellyfin/default.nix6
-rw-r--r--pkgs/servers/mail/mailman/core.nix47
-rw-r--r--pkgs/servers/mail/mailman/default.nix57
-rw-r--r--pkgs/servers/mail/mailman/hyperkitty.nix23
-rw-r--r--pkgs/servers/mail/mailman/postorius.nix16
-rw-r--r--pkgs/servers/mail/mailman/web.nix3
-rw-r--r--pkgs/servers/mail/public-inbox/0002-msgtime-drop-Date-Parse-for-RFC2822.patch172
-rw-r--r--pkgs/servers/mail/public-inbox/default.nix10
-rw-r--r--pkgs/servers/matrix-synapse/default.nix4
-rw-r--r--pkgs/servers/matterbridge/default.nix9
-rw-r--r--pkgs/servers/mautrix-whatsapp/0001-Add-missing-go-dependencies-to-go.sum.patch46
-rw-r--r--pkgs/servers/mautrix-whatsapp/default.nix10
-rw-r--r--pkgs/servers/metabase/default.nix4
-rw-r--r--pkgs/servers/monitoring/facette/default.nix31
-rw-r--r--pkgs/servers/monitoring/grafana/default.nix6
-rw-r--r--pkgs/servers/monitoring/loki/default.nix10
-rw-r--r--pkgs/servers/mqtt/mosquitto/default.nix4
-rw-r--r--pkgs/servers/mxisd/default.nix6
-rw-r--r--pkgs/servers/nextcloud/default.nix4
-rw-r--r--pkgs/servers/nginx-sso/default.nix4
-rw-r--r--pkgs/servers/rippled/default.nix74
-rw-r--r--pkgs/servers/search/elasticsearch/7.x.nix8
-rw-r--r--pkgs/servers/search/elasticsearch/plugins.nix16
-rw-r--r--pkgs/servers/search/groonga/default.nix4
-rw-r--r--pkgs/servers/search/solr/8.x.nix35
-rw-r--r--pkgs/servers/search/solr/default.nix14
-rw-r--r--pkgs/servers/ser2net/default.nix23
-rw-r--r--pkgs/servers/sql/postgresql/ext/plv8.nix4
-rw-r--r--pkgs/servers/sql/postgresql/ext/timescaledb.nix4
-rw-r--r--pkgs/servers/tt-rss/theme-feedly/default.nix4
-rw-r--r--pkgs/servers/web-apps/dokuwiki/default.nix31
-rw-r--r--pkgs/servers/web-apps/matomo/default.nix4
-rw-r--r--pkgs/servers/web-apps/moodle/default.nix4
-rw-r--r--pkgs/servers/web-apps/shaarli/material-theme.nix5
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix15
-rw-r--r--pkgs/servers/zoneminder/default.nix4
63 files changed, 995 insertions, 408 deletions
diff --git a/pkgs/servers/amqp/rabbitmq-server/default.nix b/pkgs/servers/amqp/rabbitmq-server/default.nix
index f1838f2a2cb..868fd3a6d56 100644
--- a/pkgs/servers/amqp/rabbitmq-server/default.nix
+++ b/pkgs/servers/amqp/rabbitmq-server/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchurl, erlang, elixir, python, libxml2, libxslt, xmlto
 , docbook_xml_dtd_45, docbook_xsl, zip, unzip, rsync, getconf, socat
+, procps, coreutils, gnused, systemd, glibcLocales
 , AppKit, Carbon, Cocoa
 }:
 
@@ -15,7 +16,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs =
-    [ erlang elixir python libxml2 libxslt xmlto docbook_xml_dtd_45 docbook_xsl zip unzip rsync ]
+    [ erlang elixir python libxml2 libxslt xmlto docbook_xml_dtd_45 docbook_xsl zip unzip rsync glibcLocales ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ AppKit Carbon Cocoa ];
 
   outputs = [ "out" "man" "doc" ];
@@ -23,15 +24,31 @@ stdenv.mkDerivation rec {
   installFlags = [ "PREFIX=$(out)" "RMQ_ERLAPP_DIR=$(out)" ];
   installTargets = [ "install" "install-man" ];
 
-  runtimePath = stdenv.lib.makeBinPath [getconf erlang socat];
+  preBuild = ''
+    export LANG=C.UTF-8 # fix elixir locale warning
+  '';
+
+  runtimePath = stdenv.lib.makeBinPath [
+    erlang
+    getconf # for getting memory limits
+    socat systemd procps # for systemd unit activation check
+    gnused coreutils # used by helper scripts
+  ];
   postInstall = ''
-    echo 'PATH=${runtimePath}:''${PATH:+:}$PATH' >> $out/sbin/rabbitmq-env
+    # rabbitmq-env calls to sed/coreutils, so provide everything early
+    sed -i $out/sbin/rabbitmq-env -e '2s|^|PATH=${runtimePath}\''${PATH:+:}\$PATH/\n|'
+
+    # rabbitmq-server script uses `dirname` to get hold of a
+    # rabbitmq-env, so let's provide this file directly. After that
+    # point everything is OK - the PATH above will kick in
+    substituteInPlace $out/sbin/rabbitmq-server \
+      --replace '`dirname $0`/rabbitmq-env' \
+                "$out/sbin/rabbitmq-env"
 
-    # we know exactly where rabbitmq is gonna be,
-    # so we patch that into the env-script
-    substituteInPlace $out/sbin/rabbitmq-env \
-      --replace 'RABBITMQ_SCRIPTS_DIR=`dirname $SCRIPT_PATH`' \
-                "RABBITMQ_SCRIPTS_DIR=$out/sbin"
+    # We know exactly where rabbitmq is gonna be, so we patch that into the env-script.
+    # By doing it early we make sure that auto-detection for this will
+    # never be executed (somewhere below in the script).
+    sed -i $out/sbin/rabbitmq-env -e "2s|^|RABBITMQ_SCRIPTS_DIR=$out/sbin\n|"
 
     # there’s a few stray files that belong into share
     mkdir -p $doc/share/doc/rabbitmq-server
diff --git a/pkgs/servers/apache-kafka/default.nix b/pkgs/servers/apache-kafka/default.nix
index 7b27909856d..769f5f79a77 100644
--- a/pkgs/servers/apache-kafka/default.nix
+++ b/pkgs/servers/apache-kafka/default.nix
@@ -44,9 +44,14 @@ let
       sha256 = "1svdnhdzq9a6jsig513i0ahaysfgar5i385bq9fz7laga6a4z3qv";
     };
     "2.3" = {
-      kafkaVersion = "2.3.0";
+      kafkaVersion = "2.3.1";
       scalaVersion = "2.12";
-      sha256 = "1rz3xqv26h0zv5pmk65znzn08gycmrfj6vvbmrvl9i7hm4hm2vyq";
+      sha256 = "0bldfrvd351agm237icnvn36va67crpnzmbh6dlq84ip910xsgas";
+    };
+    "2.4" = {
+      kafkaVersion = "2.4.0";
+      scalaVersion = "2.12";
+      sha256 = "1vng5ipkjzqy0wijc706w2m1rjl5d0nsgbxiacci739y1jmjnn5r";
     };
   };
 in
diff --git a/pkgs/servers/dante/default.nix b/pkgs/servers/dante/default.nix
index ae083f17ada..c36ca2f8f50 100644
--- a/pkgs/servers/dante/default.nix
+++ b/pkgs/servers/dante/default.nix
@@ -11,7 +11,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pam libkrb5 cyrus_sasl miniupnpc ];
 
-  configureFlags = ["--with-libc=libc${stdenv.targetPlatform.extensions.sharedLibrary}"];
+  configureFlags = if !stdenv.isDarwin
+    then [ "--with-libc=libc.so.6" ]
+    else [ "--with-libc=libc${stdenv.targetPlatform.extensions.sharedLibrary}" ];
 
   dontAddDisableDepTrack = stdenv.isDarwin;
 
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index d996d646d22..953d8ebcbae 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -30,9 +30,6 @@ unwrapped = stdenv.mkDerivation rec {
     sha256 = "0ca0f171ae2b2d76830967a5150eb0fa496b48b2a48f41b2be65d3743aaece25";
   };
 
-  # https://gitlab.labs.nic.cz/knot/knot-resolver/issues/496
-  postPatch = "sed '/prefill.test.lua/d' -i modules/meson.build";
-
   outputs = [ "out" "dev" ];
 
   preConfigure = ''
diff --git a/pkgs/servers/ftp/bftpd/default.nix b/pkgs/servers/ftp/bftpd/default.nix
index e7c22904cea..34757462a17 100644
--- a/pkgs/servers/ftp/bftpd/default.nix
+++ b/pkgs/servers/ftp/bftpd/default.nix
@@ -5,11 +5,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
-  version = "5.2";
+  version = "5.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/${pname}/${pname}/${name}/${name}.tar.gz";
-    sha256 = "0kmavljj3zwpgdib9nb14fnriiv0l9zm3hglimcyz26sxbw5jqky";
+    sha256 = "19fd9r233wkjk8gdxn6qsjgfijiw67a48xhgbm2kq46bx80yf3pg";
   };
 
   preConfigure = ''
diff --git a/pkgs/servers/home-assistant/cli.nix b/pkgs/servers/home-assistant/cli.nix
index 36b31947025..419462dcf85 100644
--- a/pkgs/servers/home-assistant/cli.nix
+++ b/pkgs/servers/home-assistant/cli.nix
@@ -33,7 +33,7 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   meta = with lib; {
-    description = "Command-line tool for Home Asssistant";
+    description = "Command-line tool for Home Assistant";
     homepage = https://github.com/home-assistant/home-assistant-cli;
     license = licenses.asl20;
     maintainers = with maintainers; [ dotlambda ];
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 492d5a0b0dc..275241fcd17 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "0.100.3";
+  version = "0.103.6";
   components = {
     "abode" = ps: with ps; [  ];
     "acer_projector" = ps: with ps; [ pyserial ];
@@ -11,6 +11,7 @@
     "ads" = ps: with ps; [  ];
     "aftership" = ps: with ps; [  ];
     "air_quality" = ps: with ps; [  ];
+    "airly" = ps: with ps; [  ];
     "airvisual" = ps: with ps; [ pyairvisual ];
     "aladdin_connect" = ps: with ps; [  ];
     "alarm_control_panel" = ps: with ps; [  ];
@@ -18,6 +19,7 @@
     "alarmdotcom" = ps: with ps; [  ];
     "alert" = ps: with ps; [  ];
     "alexa" = ps: with ps; [ aiohttp-cors ];
+    "almond" = ps: with ps; [ aiohttp-cors ];
     "alpha_vantage" = ps: with ps; [  ];
     "amazon_polly" = ps: with ps; [ boto3 ];
     "ambiclimate" = ps: with ps; [  ];
@@ -28,11 +30,12 @@
     "androidtv" = ps: with ps; [  ];
     "anel_pwrctrl" = ps: with ps; [  ];
     "anthemav" = ps: with ps; [  ];
-    "apache_kafka" = ps: with ps; [  ];
+    "apache_kafka" = ps: with ps; [ aiokafka ];
     "apcupsd" = ps: with ps; [  ];
     "api" = ps: with ps; [ aiohttp-cors ];
     "apns" = ps: with ps; [  ];
     "apple_tv" = ps: with ps; [ pyatv ];
+    "apprise" = ps: with ps; [ apprise ];
     "aprs" = ps: with ps; [  ];
     "aqualogic" = ps: with ps; [  ];
     "aquostv" = ps: with ps; [  ];
@@ -45,6 +48,7 @@
     "asterisk_cdr" = ps: with ps; [  ];
     "asterisk_mbox" = ps: with ps; [  ];
     "asuswrt" = ps: with ps; [  ];
+    "aten_pe" = ps: with ps; [  ];
     "atome" = ps: with ps; [  ];
     "august" = ps: with ps; [  ];
     "aurora" = ps: with ps; [  ];
@@ -58,6 +62,7 @@
     "aws" = ps: with ps; [  ];
     "axis" = ps: with ps; [  ];
     "azure_event_hub" = ps: with ps; [  ];
+    "azure_service_bus" = ps: with ps; [ azure-servicebus ];
     "baidu" = ps: with ps; [  ];
     "bayesian" = ps: with ps; [  ];
     "bbb_gpio" = ps: with ps; [  ];
@@ -105,7 +110,7 @@
     "clicksend" = ps: with ps; [  ];
     "clicksend_tts" = ps: with ps; [  ];
     "climate" = ps: with ps; [  ];
-    "cloud" = ps: with ps; [ aiohttp-cors ];
+    "cloud" = ps: with ps; [ aiohttp-cors hass-nabucasa ];
     "cloudflare" = ps: with ps; [  ];
     "cmus" = ps: with ps; [  ];
     "co2signal" = ps: with ps; [  ];
@@ -134,7 +139,7 @@
     "deconz" = ps: with ps; [  ];
     "decora" = ps: with ps; [  ];
     "decora_wifi" = ps: with ps; [  ];
-    "default_config" = ps: with ps; [ pynacl aiohttp-cors distro netdisco sqlalchemy zeroconf ];
+    "default_config" = ps: with ps; [ pynacl aiohttp-cors defusedxml distro hass-nabucasa netdisco sqlalchemy zeroconf ];
     "delijn" = ps: with ps; [  ];
     "deluge" = ps: with ps; [ deluge-client ];
     "demo" = ps: with ps; [ aiohttp-cors ];
@@ -158,11 +163,12 @@
     "dlna_dmr" = ps: with ps; [  ];
     "dnsip" = ps: with ps; [ aiodns ];
     "dominos" = ps: with ps; [ aiohttp-cors ];
-    "doods" = ps: with ps; [  ];
+    "doods" = ps: with ps; [ pillow ];
     "doorbird" = ps: with ps; [  ];
     "dovado" = ps: with ps; [  ];
     "downloader" = ps: with ps; [  ];
     "dsmr" = ps: with ps; [  ];
+    "dsmr_reader" = ps: with ps; [ aiohttp-cors hbmqtt paho-mqtt ];
     "dte_energy_bridge" = ps: with ps; [  ];
     "dublin_bus_transport" = ps: with ps; [  ];
     "duckdns" = ps: with ps; [  ];
@@ -230,6 +236,7 @@
     "flexit" = ps: with ps; [  ];
     "flic" = ps: with ps; [  ];
     "flock" = ps: with ps; [  ];
+    "flume" = ps: with ps; [  ];
     "flunearyou" = ps: with ps; [  ];
     "flux" = ps: with ps; [  ];
     "flux_led" = ps: with ps; [  ];
@@ -264,6 +271,7 @@
     "geo_rss_events" = ps: with ps; [  ];
     "geofency" = ps: with ps; [ aiohttp-cors ];
     "geonetnz_quakes" = ps: with ps; [  ];
+    "geonetnz_volcano" = ps: with ps; [  ];
     "github" = ps: with ps; [ PyGithub ];
     "gitlab_ci" = ps: with ps; [ python-gitlab ];
     "gitter" = ps: with ps; [  ];
@@ -290,7 +298,6 @@
     "growatt_server" = ps: with ps; [  ];
     "gstreamer" = ps: with ps; [  ];
     "gtfs" = ps: with ps; [  ];
-    "gtt" = ps: with ps; [  ];
     "habitica" = ps: with ps; [  ];
     "hangouts" = ps: with ps; [  ];
     "harman_kardon_avr" = ps: with ps; [  ];
@@ -304,7 +311,7 @@
     "here_travel_time" = ps: with ps; [  ];
     "hikvision" = ps: with ps; [  ];
     "hikvisioncam" = ps: with ps; [  ];
-    "hipchat" = ps: with ps; [  ];
+    "hisense_aehw4a1" = ps: with ps; [  ];
     "history" = ps: with ps; [ aiohttp-cors sqlalchemy ];
     "history_graph" = ps: with ps; [ aiohttp-cors sqlalchemy ];
     "history_stats" = ps: with ps; [ aiohttp-cors sqlalchemy ];
@@ -324,22 +331,21 @@
     "html5" = ps: with ps; [ aiohttp-cors pywebpush ];
     "http" = ps: with ps; [ aiohttp-cors ];
     "htu21d" = ps: with ps; [  ];
-    "huawei_lte" = ps: with ps; [  ];
+    "huawei_lte" = ps: with ps; [ stringcase ];
     "huawei_router" = ps: with ps; [  ];
     "hue" = ps: with ps; [ aiohue ];
     "hunterdouglas_powerview" = ps: with ps; [  ];
     "hydrawise" = ps: with ps; [  ];
-    "hydroquebec" = ps: with ps; [  ];
     "hyperion" = ps: with ps; [  ];
     "ialarm" = ps: with ps; [  ];
     "iaqualink" = ps: with ps; [  ];
-    "icloud" = ps: with ps; [  ];
+    "icloud" = ps: with ps; [ pyicloud ];
     "idteck_prox" = ps: with ps; [  ];
     "ifttt" = ps: with ps; [ aiohttp-cors pyfttt ];
     "iglo" = ps: with ps; [  ];
     "ign_sismologia" = ps: with ps; [  ];
     "ihc" = ps: with ps; [ defusedxml ];
-    "image_processing" = ps: with ps; [ aiohttp-cors pillow ];
+    "image_processing" = ps: with ps; [ aiohttp-cors ];
     "imap" = ps: with ps; [  ];
     "imap_email_content" = ps: with ps; [  ];
     "incomfort" = ps: with ps; [  ];
@@ -351,6 +357,7 @@
     "input_text" = ps: with ps; [  ];
     "insteon" = ps: with ps; [  ];
     "integration" = ps: with ps; [  ];
+    "intent" = ps: with ps; [ aiohttp-cors ];
     "intent_script" = ps: with ps; [  ];
     "ios" = ps: with ps; [ aiohttp-cors zeroconf ];
     "iota" = ps: with ps; [  ];
@@ -470,6 +477,7 @@
     "mqtt_json" = ps: with ps; [ aiohttp-cors hbmqtt paho-mqtt ];
     "mqtt_room" = ps: with ps; [ aiohttp-cors hbmqtt paho-mqtt ];
     "mqtt_statestream" = ps: with ps; [ aiohttp-cors hbmqtt paho-mqtt ];
+    "msteams" = ps: with ps; [  ];
     "mvglive" = ps: with ps; [ PyMVGLive ];
     "mychevy" = ps: with ps; [  ];
     "mycroft" = ps: with ps; [  ];
@@ -538,6 +546,7 @@
     "openweathermap" = ps: with ps; [ pyowm ];
     "opple" = ps: with ps; [  ];
     "orangepi_gpio" = ps: with ps; [  ];
+    "oru" = ps: with ps; [  ];
     "orvibo" = ps: with ps; [  ];
     "osramlightify" = ps: with ps; [  ];
     "otp" = ps: with ps; [ pyotp ];
@@ -548,6 +557,7 @@
     "pandora" = ps: with ps; [ pexpect ];
     "panel_custom" = ps: with ps; [ aiohttp-cors ];
     "panel_iframe" = ps: with ps; [ aiohttp-cors ];
+    "pcal9535a" = ps: with ps; [  ];
     "pencom" = ps: with ps; [  ];
     "persistent_notification" = ps: with ps; [  ];
     "person" = ps: with ps; [  ];
@@ -572,6 +582,7 @@
     "prometheus" = ps: with ps; [ aiohttp-cors prometheus_client ];
     "prowl" = ps: with ps; [  ];
     "proximity" = ps: with ps; [  ];
+    "proxmoxve" = ps: with ps; [  ];
     "proxy" = ps: with ps; [ pillow ];
     "ps4" = ps: with ps; [  ];
     "ptvsd" = ps: with ps; [  ];
@@ -583,7 +594,7 @@
     "pushsafer" = ps: with ps; [  ];
     "pvoutput" = ps: with ps; [  ];
     "pyload" = ps: with ps; [  ];
-    "python_script" = ps: with ps; [  ];
+    "python_script" = ps: with ps; [ restrictedpython ];
     "qbittorrent" = ps: with ps; [  ];
     "qld_bushfire" = ps: with ps; [  ];
     "qnap" = ps: with ps; [  ];
@@ -647,7 +658,7 @@
     "serial" = ps: with ps; [ pyserial-asyncio ];
     "serial_pm" = ps: with ps; [  ];
     "sesame" = ps: with ps; [  ];
-    "seven_segments" = ps: with ps; [  ];
+    "seven_segments" = ps: with ps; [ pillow ];
     "seventeentrack" = ps: with ps; [  ];
     "shell_command" = ps: with ps; [  ];
     "shiftr" = ps: with ps; [ paho-mqtt ];
@@ -658,6 +669,7 @@
     "simplepush" = ps: with ps; [  ];
     "simplisafe" = ps: with ps; [  ];
     "simulated" = ps: with ps; [  ];
+    "sinch" = ps: with ps; [  ];
     "sisyphus" = ps: with ps; [  ];
     "sky_hub" = ps: with ps; [  ];
     "skybeacon" = ps: with ps; [  ];
@@ -679,9 +691,10 @@
     "socialblade" = ps: with ps; [  ];
     "solaredge" = ps: with ps; [ stringcase ];
     "solaredge_local" = ps: with ps; [  ];
+    "solarlog" = ps: with ps; [  ];
     "solax" = ps: with ps; [  ];
     "soma" = ps: with ps; [  ];
-    "somfy" = ps: with ps; [  ];
+    "somfy" = ps: with ps; [ aiohttp-cors ];
     "somfy_mylink" = ps: with ps; [  ];
     "sonarr" = ps: with ps; [  ];
     "songpal" = ps: with ps; [  ];
@@ -697,7 +710,8 @@
     "spotify" = ps: with ps; [ aiohttp-cors ];
     "sql" = ps: with ps; [ sqlalchemy ];
     "squeezebox" = ps: with ps; [  ];
-    "ssdp" = ps: with ps; [ netdisco ];
+    "ssdp" = ps: with ps; [ defusedxml netdisco ];
+    "starline" = ps: with ps; [  ];
     "starlingbank" = ps: with ps; [  ];
     "startca" = ps: with ps; [ xmltodict ];
     "statistics" = ps: with ps; [  ];
@@ -706,7 +720,7 @@
     "stiebel_eltron" = ps: with ps; [  ];
     "stream" = ps: with ps; [ aiohttp-cors av ];
     "streamlabswater" = ps: with ps; [  ];
-    "stride" = ps: with ps; [  ];
+    "stt" = ps: with ps; [ aiohttp-cors ];
     "suez_water" = ps: with ps; [  ];
     "sun" = ps: with ps; [  ];
     "supervisord" = ps: with ps; [  ];
@@ -735,14 +749,14 @@
     "tcp" = ps: with ps; [  ];
     "ted5000" = ps: with ps; [ xmltodict ];
     "teksavvy" = ps: with ps; [  ];
-    "telegram" = ps: with ps; [ aiohttp-cors python-telegram-bot ];
-    "telegram_bot" = ps: with ps; [ aiohttp-cors python-telegram-bot ];
+    "telegram" = ps: with ps; [ pysocks aiohttp-cors python-telegram-bot ];
+    "telegram_bot" = ps: with ps; [ pysocks aiohttp-cors python-telegram-bot ];
     "tellduslive" = ps: with ps; [  ];
     "tellstick" = ps: with ps; [  ];
     "telnet" = ps: with ps; [  ];
     "temper" = ps: with ps; [  ];
     "template" = ps: with ps; [  ];
-    "tensorflow" = ps: with ps; [ numpy protobuf tensorflow ];
+    "tensorflow" = ps: with ps; [ numpy pillow protobuf tensorflow ];
     "tesla" = ps: with ps; [  ];
     "tfiac" = ps: with ps; [  ];
     "thermoworks_smoke" = ps: with ps; [ stringcase ];
@@ -789,6 +803,7 @@
     "uk_transport" = ps: with ps; [  ];
     "unifi" = ps: with ps; [ aiounifi ];
     "unifi_direct" = ps: with ps; [ pexpect ];
+    "unifiled" = ps: with ps; [  ];
     "universal" = ps: with ps; [  ];
     "upc_connect" = ps: with ps; [  ];
     "upcloud" = ps: with ps; [  ];
@@ -808,6 +823,7 @@
     "venstar" = ps: with ps; [  ];
     "vera" = ps: with ps; [  ];
     "verisure" = ps: with ps; [  ];
+    "versasense" = ps: with ps; [  ];
     "version" = ps: with ps; [ pyhaversion ];
     "vesync" = ps: with ps; [  ];
     "viaggiatreno" = ps: with ps; [  ];
@@ -839,6 +855,7 @@
     "wink" = ps: with ps; [  ];
     "wirelesstag" = ps: with ps; [  ];
     "withings" = ps: with ps; [ aiohttp-cors ];
+    "wled" = ps: with ps; [  ];
     "workday" = ps: with ps; [ holidays ];
     "worldclock" = ps: with ps; [  ];
     "worldtidesinfo" = ps: with ps; [  ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 392f1f510cc..8e83d7f15da 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchurl, fetchFromGitHub, fetchpatch, python3, protobuf3_6
 
 # Look up dependencies of specified components in component-packages.nix
-, extraComponents ? []
+, extraComponents ? [ ]
 
 # Additional packages to add to propagatedBuildInputs
 , extraPackages ? ps: []
@@ -21,44 +21,15 @@ let
 
   defaultOverrides = [
     # Override the version of some packages pinned in Home Assistant's setup.py
-#     (mkOverride "aiohttp" "3.5.4"
-#       "9c4c83f4fa1938377da32bc2d59379025ceeee8e24b89f72fcbccd8ca22dc9bf")
-#     (mkOverride "astral" "1.10.1"
-#       "d2a67243c4503131c856cafb1b1276de52a86e5b8a1d507b7e08bee51cb67bf1")
-#     (mkOverride "async-timeout" "3.0.1"
-#       "0c3c816a028d47f659d6ff5c745cb2acf1f966da1fe5c19c77a70282b25f4c5f")
-#     (mkOverride "bcrypt" "3.1.7"
-#       "0b0069c752ec14172c5f78208f1863d7ad6755a6fae6fe76ec2c80d13be41e42")
-#     (mkOverride "pyjwt" "1.7.1"
-#       "8d59a976fb773f3e6a39c85636357c4f0e242707394cadadd9814f5cbaa20e96")
-    (mkOverride "cryptography" "2.7" # TODO for 2.8: Remove the override below
-      "e6347742ac8f35ded4a46ff835c60e68c22a536a8ae5c4422966d06946b6d4c6")
-    (mkOverride "cryptography_vectors" "2.7" # required by cryptography==2.7
-      "f12dfb9bd669a68004074cb5b26df6e93ed1a95ebd1a999dff0a840212ff68bc")
-#     (mkOverride "importlib-metadata" "0.18"
-#       "cb6ee23b46173539939964df59d3d72c3e0c1b5d54b84f1d8a7e912fe43612db")
-    (mkOverride "python-slugify" "3.0.4"
-      "0dv97yi5fq074q5qyqbin09pmi8ixg36caf5nkpw2bqkd8jh6pap")
-#     (mkOverride "pyyaml" "5.1.1"
-#       "b4bb4d3f5e232425e25dda21c070ce05168a786ac9eda43768ab7f3ac2770955")
-#     (mkOverride "requests" "2.22.0"
-#       "11e007a8a2aa0323f5a921e9e6a2d7e4e67d9877e85773fba9ba6419025cbeb4")
-#     (mkOverride "ruamel_yaml" "0.15.97"
-#       "17dbf6b7362e7aee8494f7a0f5cffd44902a6331fe89ef0853b855a7930ab845")
-#     (mkOverride "voluptuous" "0.11.5"
-#       "567a56286ef82a9d7ae0628c5842f65f516abcb496e74f3f59f1d7b28df314ef")
-#     (mkOverride "voluptuous-serialize" "2.1.0"
-#       "d30fef4f1aba251414ec0b315df81a06da7bf35201dcfb1f6db5253d738a154f")
-
-    # used by auth.mfa_modules.totp
-    (mkOverride "pyotp" "2.2.7"
-      "be0ffeabddaa5ee53e7204e7740da842d070cf69168247a3d0c08541b84de602")
 
     # used by check_config script
     # can be unpinned once https://github.com/home-assistant/home-assistant/issues/11917 is resolved
     (mkOverride "colorlog" "4.0.2"
       "3cf31b25cbc8f86ec01fef582ef3b840950dea414084ed19ab922c8b493f9b42")
 
+    (mkOverride "pyyaml" "5.1.2"
+      "1r5faspz73477hlbjgilw05xsms0glmsa371yqdd26znqsvg1b81")
+
     # required by aioesphomeapi
     (self: super: {
       protobuf = super.protobuf.override {
@@ -66,19 +37,6 @@ let
       };
     })
 
-    (self: super: {
-      # TODO: Remove this override after updating to cryptography 2.8
-      cryptography = super.cryptography.overridePythonAttrs (oldAttrs: {
-        propagatedBuildInputs = oldAttrs.propagatedBuildInputs ++ [ super.asn1crypto ];
-        patches = [
-          (fetchpatch {
-            url = "https://github.com/pyca/cryptography/commit/e575e3d482f976c4a1f3203d63ea0f5007a49a2a.patch";
-            sha256 = "0vg9prqsizd6gzh5j7lscsfxzxlhz7pacvzhgqmj1vhdhjwbblcp";
-          })
-        ];
-      });
-    })
-
     # hass-frontend does not exist in python3.pkgs
     (self: super: {
       hass-frontend = self.callPackage ./frontend.nix { };
@@ -112,7 +70,7 @@ let
   extraBuildInputs = extraPackages py.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "0.100.3";
+  hassVersion = "0.103.6";
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "homeassistant";
@@ -127,7 +85,7 @@ in with py.pkgs; buildPythonApplication rec {
     owner = "home-assistant";
     repo = "home-assistant";
     rev = version;
-    sha256 = "1rrv71h91qjq5sii4wfcdjvrcpid2aci1dwadrcd35363ff0w200";
+    sha256 = "1492q4icyhvz30fw5ysrwlnsls4iy5pv62ay3vq1ygcfnlapkqhl";
   };
 
   propagatedBuildInputs = [
@@ -140,7 +98,15 @@ in with py.pkgs; buildPythonApplication rec {
   ] ++ componentBuildInputs ++ extraBuildInputs;
 
   checkInputs = [
-    asynctest pytest pytest-aiohttp requests-mock pydispatcher aiohue
+    asynctest pytest pytest-aiohttp requests-mock pydispatcher aiohue netdisco hass-nabucasa
+  ];
+
+  patches = [
+    # newer importlib-metadata version
+    (fetchpatch {
+      url = "https://github.com/home-assistant/home-assistant/commit/63c6b803dc2d835d57b97ed833ee5cd8318bf7ae.patch";
+      sha256 = "16q3qdnmgsw5415f70zvsv1z63dljp3c9glv06cyj4s6qsl13xdc";
+    })
   ];
 
   postPatch = ''
@@ -151,9 +117,10 @@ in with py.pkgs; buildPythonApplication rec {
   '';
 
   checkPhase = ''
-    # The components' dependencies are not included, so they cannot be tested
-    # test_webhook_create_cloudhook imports hass_nabucasa and is thus excluded
-    py.test --ignore tests/components -k "not test_webhook_create_cloudhook and not test_webhook_config_flow_registers_webhook"
+    # - components' dependencies are not included, so they cannot be tested
+    # - test_merge_id_schema requires pyqwikswitch
+    # - unclear why test_merge fails: assert merge_log_err.call_count != 0
+    py.test --ignore tests/components -k "not test_merge_id_schema and not test_merge"
     # Some basic components should be tested however
     py.test \
       tests/components/{api,config,configurator,demo,discovery,frontend,group,history,history_graph} \
diff --git a/pkgs/servers/home-assistant/esphome.nix b/pkgs/servers/home-assistant/esphome.nix
index 27dabd2a2eb..12b36de4965 100644
--- a/pkgs/servers/home-assistant/esphome.nix
+++ b/pkgs/servers/home-assistant/esphome.nix
@@ -3,27 +3,26 @@
 let
   python = python3.override {
     packageOverrides = self: super: {
-      tornado = super.tornado.overridePythonAttrs (oldAttrs: rec {
-        version = "5.1.1";
+      protobuf = super.protobuf.override {
+        protobuf = protobuf3_10;
+      };
+      pyyaml = super.pyyaml.overridePythonAttrs (oldAttrs: rec {
+        version = "5.1.2";
         src = oldAttrs.src.override {
           inherit version;
-          sha256 = "4e5158d97583502a7e2739951553cbd88a72076f152b4b11b64b9a10c4c49409";
+          sha256 = "1r5faspz73477hlbjgilw05xsms0glmsa371yqdd26znqsvg1b81";
         };
       });
-      protobuf = super.protobuf.override {
-        protobuf = protobuf3_10;
-      };
-
     };
   };
 
 in python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "1.14.1";
+  version = "1.14.3";
 
   src = python.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "1hw1q2fck9429077w207rk65a1krzyi6qya5pzjkpw4av5s0v0g3";
+    sha256 = "0xnsl000c5a2li9qw9anrzzq437qn1n4hcfc24i4rfq37awzmig7";
   };
 
   ESPHOME_USE_SUBPROCESS = "";
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index fd873011488..75d02ed0635 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -4,11 +4,11 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20190919.0";
+  version = "20200108.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1xdw8fj4njc3sf15mlyiwigrwf89xsz4r2dsv6zs5fnl512r439a";
+    sha256 = "1h6fgkx8fffzs829893gjbh0wbjgxjzz2ca64v8r5sb938bfayg8";
   };
 
   # no Python tests implemented
diff --git a/pkgs/servers/home-assistant/parse-requirements.py b/pkgs/servers/home-assistant/parse-requirements.py
index 647e4513de4..96cf1d86050 100755
--- a/pkgs/servers/home-assistant/parse-requirements.py
+++ b/pkgs/servers/home-assistant/parse-requirements.py
@@ -105,7 +105,9 @@ components = parse_components(version=version)
 build_inputs = {}
 for component in sorted(components.keys()):
     attr_paths = []
-    for req in sorted(get_reqs(components, component)):
+    missing_reqs = []
+    reqs = sorted(get_reqs(components, component))
+    for req in reqs:
         # Some requirements are specified by url, e.g. https://example.org/foobar#xyz==1.0.0
         # Therefore, if there's a "#" in the line, only take the part after it
         req = req[req.find('#') + 1:]
@@ -114,8 +116,14 @@ for component in sorted(components.keys()):
         if attr_path is not None:
             # Add attribute path without "python3Packages." prefix
             attr_paths.append(attr_path[len(PKG_SET + '.'):])
+        else:
+            missing_reqs.append(name)
     else:
         build_inputs[component] = attr_paths
+    n_diff = len(reqs) > len(build_inputs[component])
+    if n_diff > 0:
+        print("Component {} is missing {} dependencies".format(component, n_diff))
+        print("missing requirements: {}".format(missing_reqs))
 
 with open(os.path.dirname(sys.argv[0]) + '/component-packages.nix', 'w') as f:
     f.write('# Generated by parse-requirements.py\n')
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index d5da6df8d68..252365098dd 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
   prePatch = ''
     sed -i config.layout -e "s|installbuilddir:.*|installbuilddir: $dev/share/build|"
     sed -i support/apachectl.in -e 's|@LYNX_PATH@|${lynx}/bin/lynx|'
+    sed -i support/apachectl.in -e 's|$HTTPD -t|$HTTPD -t -f /etc/httpd/httpd.conf|'
   '';
 
   # Required for ‘pthread_cancel’.
diff --git a/pkgs/servers/http/apache-modules/mod_ca/default.nix b/pkgs/servers/http/apache-modules/mod_ca/default.nix
new file mode 100644
index 00000000000..37f2a397ae6
--- /dev/null
+++ b/pkgs/servers/http/apache-modules/mod_ca/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchurl, pkgconfig, apacheHttpd, openssl, openldap }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_ca";
+  version = "0.2.1";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "1pxapjrzdsk2s25vhgvf56fkakdqcbn9hjncwmqh0asl1pa25iic";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ apacheHttpd openssl openldap ];
+
+  # Note that configureFlags and installFlags are inherited by
+  # the various submodules.
+  #
+  configureFlags = [
+    "--with-apxs=${apacheHttpd.dev}/bin/apxs"
+  ];
+
+  installFlags = [
+    "INCLUDEDIR=${placeholder ''out''}/include"
+    "LIBEXECDIR=${placeholder ''out''}/modules"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "RedWax CA service module";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
diff --git a/pkgs/servers/http/apache-modules/mod_crl/default.nix b/pkgs/servers/http/apache-modules/mod_crl/default.nix
new file mode 100644
index 00000000000..54c0de1c701
--- /dev/null
+++ b/pkgs/servers/http/apache-modules/mod_crl/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchurl, pkgconfig, mod_ca, apr, aprutil }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_crl";
+  version = "0.2.1";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "0k6iqn5a4bqdz3yx6d53f1r75c21jnwhxmmcq071zq0361xjzzj6";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ mod_ca apr aprutil ];
+  inherit (mod_ca) configureFlags installFlags;
+
+  meta = with stdenv.lib; {
+    description = "RedWax module for Certificate Revocation Lists";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
diff --git a/pkgs/servers/http/apache-modules/mod_csr/default.nix b/pkgs/servers/http/apache-modules/mod_csr/default.nix
new file mode 100644
index 00000000000..60f97d2f361
--- /dev/null
+++ b/pkgs/servers/http/apache-modules/mod_csr/default.nix
@@ -0,0 +1,41 @@
+{ stdenv, fetchurl, pkgconfig, mod_ca, apr, aprutil }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_csr";
+  version = "0.2.1";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "01sdvv07kchdd6ssrmd2cbhj50qh2ibp5g5h6jy1jqbzp0b3j9ja";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ mod_ca apr aprutil ];
+  inherit (mod_ca) configureFlags installFlags;
+
+  # After openssl-1.0.2t, starting in  openssl-1.1.0l
+  # parts of the OpenSSL struct API was replaced by
+  # getters - but some setters where forgotten.
+  #
+  # It is expected that these are back/retrofitted in version
+  # openssl-1.1.1d -- but while fixing this it was found
+  # that there were quite a few other setters missing and
+  # that some of the memory management needed was at odds
+  # with the principles used sofar.
+  #
+  # See https://github.com/openssl/openssl/pull/10563
+  #
+  # So as a stopgap - use a minimalist compat. layer
+  # https://source.redwax.eu/projects/RS/repos/mod_csr/browse/openssl_setter_compat.h
+  #
+  preBuild = "cp ${./openssl_setter_compat.h} openssl_setter_compat.h";
+
+  meta = with stdenv.lib; {
+    description = "RedWax CA service module to handle Certificate Signing Requests";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
diff --git a/pkgs/servers/http/apache-modules/mod_csr/openssl_setter_compat.h b/pkgs/servers/http/apache-modules/mod_csr/openssl_setter_compat.h
new file mode 100644
index 00000000000..a2a9e0f7a18
--- /dev/null
+++ b/pkgs/servers/http/apache-modules/mod_csr/openssl_setter_compat.h
@@ -0,0 +1,66 @@
+/* Licensed to Stichting The Commons Conservancy (TCC) under one or more
+ * contributor license agreements.  See the AUTHORS file distributed with
+ * this work for additional information regarding copyright ownership.
+ * TCC licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// These routines are copies from OpenSSL/1.1.1 its x509/x509_req.c
+// and the private header files for that. They are needed as
+// starting with OpenSSL 1.1.0 the X509_req structure became
+// private; and got some get0 functions to access its internals.
+// But no getter's until post 1.1.1 (PR#10563). So this is a
+// stopgap for these lacking releases.
+//
+// Testest against: 
+//   openssl-1.0.2t 0x01000214fL (does not need it, privates still accessile)
+//   openssl-1.1.0l 0x0101000cfL (needs it)
+//   openssl-1.1.1d 0x01010104fL (last version that needs it)
+//   openssl-1.1.1-dev		 (should not need it - post PR#10563).
+//
+/* #if OPENSSL_VERSION_NUMBER >= 0x010100000L &&  OPENSSL_VERSION_NUMBER  <= 0x01010104fL */
+#if OPENSSL_VERSION_NUMBER >= 0x010100000L 
+#include "openssl/x509.h"
+
+#define HAS_OPENSSL_PR10563_WORK_AROUND
+
+struct X509_req_info_st {
+    ASN1_ENCODING enc;          
+    ASN1_INTEGER *version;     
+    X509_NAME *subject;       
+    X509_PUBKEY *pubkey;     
+    STACK_OF(X509_ATTRIBUTE) *attributes;
+};
+
+typedef _Atomic int CRYPTO_REF_COUNT;
+
+struct X509_req_st {
+    X509_REQ_INFO req_info; 
+    X509_ALGOR sig_alg;       
+    ASN1_BIT_STRING *signature; /* signature */
+    CRYPTO_REF_COUNT references;
+    CRYPTO_RWLOCK *lock;
+# ifndef OPENSSL_NO_SM2
+    ASN1_OCTET_STRING *sm2_id;
+# endif
+};
+
+
+static void _X509_REQ_set1_signature(X509_REQ *req, X509_ALGOR *palg)
+{
+    if (req->sig_alg.algorithm)
+        ASN1_OBJECT_free(req->sig_alg.algorithm);
+    if (req->sig_alg.parameter)
+        ASN1_TYPE_free(req->sig_alg.parameter);
+    req->sig_alg = *palg;
+}
+#endif
diff --git a/pkgs/servers/http/apache-modules/mod_ocsp/default.nix b/pkgs/servers/http/apache-modules/mod_ocsp/default.nix
new file mode 100644
index 00000000000..6730ca16f10
--- /dev/null
+++ b/pkgs/servers/http/apache-modules/mod_ocsp/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchurl, pkgconfig, mod_ca, apr, aprutil }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_ocsp";
+  version = "0.2.1";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "1vwgai56krdf8knb0mgy07ni9mqxk82bcb4gibwpnxvl6qwgv2i0";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ mod_ca apr aprutil ];
+  inherit (mod_ca) configureFlags installFlags;
+
+  meta = with stdenv.lib; {
+    description = "RedWax CA service modules of OCSP Online Certificate Validation";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
diff --git a/pkgs/servers/http/apache-modules/mod_pkcs12/default.nix b/pkgs/servers/http/apache-modules/mod_pkcs12/default.nix
new file mode 100644
index 00000000000..2bcf3b1d9c2
--- /dev/null
+++ b/pkgs/servers/http/apache-modules/mod_pkcs12/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchurl, pkgconfig, mod_ca, apr, aprutil }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_pkcs12";
+  version = "0.2.1";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "0by4qfjs3a8q0amzwazfq8ii6ydv36v2mjga0jzc9i6xyl4rs6ai";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ mod_ca apr aprutil ];
+  inherit (mod_ca) configureFlags installFlags;
+
+  meta = with stdenv.lib; {
+    description = "RedWax CA service modules for PKCS#12 format files";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
diff --git a/pkgs/servers/http/apache-modules/mod_scep/default.nix b/pkgs/servers/http/apache-modules/mod_scep/default.nix
new file mode 100644
index 00000000000..98703659c35
--- /dev/null
+++ b/pkgs/servers/http/apache-modules/mod_scep/default.nix
@@ -0,0 +1,41 @@
+{ stdenv, fetchurl, pkgconfig, mod_ca, apr, aprutil }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_scep";
+  version = "0.2.1";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "14l8v6y6kx5dg8avb5ny95qdcgrw40ss80nqrgmw615mk7zcj81f";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ mod_ca apr aprutil ];
+  inherit (mod_ca) configureFlags installFlags;
+
+  # After openssl-1.0.2t, starting in  openssl-1.1.0l
+  # parts of the OpenSSL struct API was replaced by
+  # getters - but some setters where forgotten.
+  #
+  # It is expected that these are back/retrofitted in version
+  # openssl-1.1.1d -- but while fixing this it was found
+  # that there were quite a few other setters missing and
+  # that some of the memory management needed was at odds
+  # with the principles used sofar.
+  #
+  # See https://github.com/openssl/openssl/pull/10563
+  #
+  # So as a stopgap - use a minimalist compat. layer
+  # https://source.redwax.eu/projects/RS/repos/mod_csr/browse/openssl_setter_compat.h
+  #
+  preBuild = "cp ${./openssl_setter_compat.h} openssl_setter_compat.h";
+
+  meta = with stdenv.lib; {
+    description = "RedWax CA service modules for SCEP (Automatic ceritifcate issue/renewal)";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
diff --git a/pkgs/servers/http/apache-modules/mod_scep/openssl_setter_compat.h b/pkgs/servers/http/apache-modules/mod_scep/openssl_setter_compat.h
new file mode 100644
index 00000000000..a2a9e0f7a18
--- /dev/null
+++ b/pkgs/servers/http/apache-modules/mod_scep/openssl_setter_compat.h
@@ -0,0 +1,66 @@
+/* Licensed to Stichting The Commons Conservancy (TCC) under one or more
+ * contributor license agreements.  See the AUTHORS file distributed with
+ * this work for additional information regarding copyright ownership.
+ * TCC licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// These routines are copies from OpenSSL/1.1.1 its x509/x509_req.c
+// and the private header files for that. They are needed as
+// starting with OpenSSL 1.1.0 the X509_req structure became
+// private; and got some get0 functions to access its internals.
+// But no getter's until post 1.1.1 (PR#10563). So this is a
+// stopgap for these lacking releases.
+//
+// Testest against: 
+//   openssl-1.0.2t 0x01000214fL (does not need it, privates still accessile)
+//   openssl-1.1.0l 0x0101000cfL (needs it)
+//   openssl-1.1.1d 0x01010104fL (last version that needs it)
+//   openssl-1.1.1-dev		 (should not need it - post PR#10563).
+//
+/* #if OPENSSL_VERSION_NUMBER >= 0x010100000L &&  OPENSSL_VERSION_NUMBER  <= 0x01010104fL */
+#if OPENSSL_VERSION_NUMBER >= 0x010100000L 
+#include "openssl/x509.h"
+
+#define HAS_OPENSSL_PR10563_WORK_AROUND
+
+struct X509_req_info_st {
+    ASN1_ENCODING enc;          
+    ASN1_INTEGER *version;     
+    X509_NAME *subject;       
+    X509_PUBKEY *pubkey;     
+    STACK_OF(X509_ATTRIBUTE) *attributes;
+};
+
+typedef _Atomic int CRYPTO_REF_COUNT;
+
+struct X509_req_st {
+    X509_REQ_INFO req_info; 
+    X509_ALGOR sig_alg;       
+    ASN1_BIT_STRING *signature; /* signature */
+    CRYPTO_REF_COUNT references;
+    CRYPTO_RWLOCK *lock;
+# ifndef OPENSSL_NO_SM2
+    ASN1_OCTET_STRING *sm2_id;
+# endif
+};
+
+
+static void _X509_REQ_set1_signature(X509_REQ *req, X509_ALGOR *palg)
+{
+    if (req->sig_alg.algorithm)
+        ASN1_OBJECT_free(req->sig_alg.algorithm);
+    if (req->sig_alg.parameter)
+        ASN1_TYPE_free(req->sig_alg.parameter);
+    req->sig_alg = *palg;
+}
+#endif
diff --git a/pkgs/servers/http/apache-modules/mod_spkac/default.nix b/pkgs/servers/http/apache-modules/mod_spkac/default.nix
new file mode 100644
index 00000000000..72e0d521e3b
--- /dev/null
+++ b/pkgs/servers/http/apache-modules/mod_spkac/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchurl, pkgconfig, mod_ca, apr, aprutil }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_spkac";
+  version = "0.2.1";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "0x6ia9qcr7lx2awpv9cr4ndic5f4g8yqzmp2hz66zpzkmk2b2pyz";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ mod_ca apr aprutil ];
+  inherit (mod_ca) configureFlags installFlags;
+
+  meta = with stdenv.lib; {
+    description = "RedWax CA service module for handling the Netscape keygen requests. ";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
diff --git a/pkgs/servers/http/apache-modules/mod_timestamp/default.nix b/pkgs/servers/http/apache-modules/mod_timestamp/default.nix
new file mode 100644
index 00000000000..139da289078
--- /dev/null
+++ b/pkgs/servers/http/apache-modules/mod_timestamp/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchurl, pkgconfig, mod_ca, apr, aprutil }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_timestamp";
+  version = "0.2.1";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "0j4b04dbdwn9aff3da9m0lnqi0qbw6c6hhi81skl15kyc3vzp67f";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ mod_ca apr aprutil ];
+  inherit (mod_ca) configureFlags installFlags;
+
+  meta = with stdenv.lib; {
+    description = "RedWax CA service module for issuing signed timestamps";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
diff --git a/pkgs/servers/http/apache-modules/mod_wsgi/default.nix b/pkgs/servers/http/apache-modules/mod_wsgi/default.nix
index 461ab1e297e..c0e4cefa40a 100644
--- a/pkgs/servers/http/apache-modules/mod_wsgi/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_wsgi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mod_wsgi";
-  version = "4.6.8";
+  version = "4.7.0";
 
   src = fetchurl {
     url = "https://github.com/GrahamDumpleton/mod_wsgi/archive/${version}.tar.gz";
-    sha256 = "0xym7i3iaxqi23dayacv2llhi0klxcb4ldll5cjxv6lg9v5r88x2";
+    sha256 = "079f4py20jd6n3d7djak5l9j8p6hfq96lf577iir6qpfsk2p0k3n";
   };
 
   buildInputs = [ apacheHttpd python ncurses ];
diff --git a/pkgs/servers/http/jetty/default.nix b/pkgs/servers/http/jetty/default.nix
index 8d2340647cb..4a3a3f2da01 100644
--- a/pkgs/servers/http/jetty/default.nix
+++ b/pkgs/servers/http/jetty/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jetty";
-  version = "9.4.24.v20191120";
+  version = "9.4.25.v20191220";
   src = fetchurl {
     url = "https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/${version}/jetty-distribution-${version}.tar.gz";
     name = "jetty-distribution-${version}.tar.gz";
-    sha256 = "072vr8gfly2xdwxx1c771yymf145l8nv0j31liwqrih8zqvvhsd4";
+    sha256 = "1jnx4hnvd2krsdisqwpws1qd1r0f8gm9a4sx4a8c7zqrmfd2zx1a";
   };
 
   phases = [ "unpackPhase" "installPhase" ];
diff --git a/pkgs/servers/http/lwan/default.nix b/pkgs/servers/http/lwan/default.nix
index f692832e882..9cd9a6b7fec 100644
--- a/pkgs/servers/http/lwan/default.nix
+++ b/pkgs/servers/http/lwan/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lwan";
-  version = "0.1";
+  version = "0.2";
 
   src = fetchFromGitHub {
     owner = "lpereira";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1mckryzb06smky0bx2bkqwqzpnq4pb8vlgmmwsvqmwi4mmw9wmi1";
+    sha256 = "1z1g6bmdsf7zj809sq6jqkpzkdnx1jch84kk67h0v2x6lxhdpv5r";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/servers/http/unit/default.nix b/pkgs/servers/http/unit/default.nix
index d210fcefc85..c3af0d55543 100644
--- a/pkgs/servers/http/unit/default.nix
+++ b/pkgs/servers/http/unit/default.nix
@@ -18,16 +18,21 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "1.13.0";
+  version = "1.14.0";
   pname = "unit";
 
   src = fetchFromGitHub {
     owner = "nginx";
     repo = "unit";
     rev = version;
-    sha256 = "1b5il05isq5yvnx2qpnihsrmj0jliacvhrm58i87d48anwpv1k8q";
+    sha256 = "01anczfcdwd22hb0y4zw647f86ivk5zq8lcd13xfxjvkmnsnbj9w";
   };
 
+  patches = [
+    # https://github.com/nginx/unit/issues/357
+    ./drop_cap.patch
+  ];
+
   nativeBuildInputs = [ which ];
 
   buildInputs = [ ]
diff --git a/pkgs/servers/http/unit/drop_cap.patch b/pkgs/servers/http/unit/drop_cap.patch
new file mode 100644
index 00000000000..87caf77904e
--- /dev/null
+++ b/pkgs/servers/http/unit/drop_cap.patch
@@ -0,0 +1,79 @@
+diff -r ed17ce89119f src/nxt_capability.c
+--- a/src/nxt_capability.c      Fri Dec 06 17:02:23 2019 +0000
++++ b/src/nxt_capability.c      Mon Dec 09 23:23:00 2019 +0000
+@@ -93,6 +93,26 @@ nxt_capability_specific_set(nxt_task_t *
+     return NXT_OK;
+ }
+ 
++
++nxt_int_t
++nxt_capability_drop_all(nxt_task_t *task)
++{
++    struct __user_cap_header_struct hdr;
++    struct __user_cap_data_struct data[2];
++
++    hdr.version = nxt_capability_linux_get_version();
++    hdr.pid = nxt_pid;
++
++    nxt_memset(data, 0, sizeof(data));
++
++    if (nxt_slow_path(nxt_capset(&hdr, data) == -1)) {
++        nxt_alert(task, "failed to drop capabilities %E", nxt_errno);
++        return NXT_ERROR;
++    }
++
++    return NXT_OK;
++}
++
+ #else
+ 
+ static nxt_int_t
+diff -r ed17ce89119f src/nxt_capability.h
+--- a/src/nxt_capability.h      Fri Dec 06 17:02:23 2019 +0000
++++ b/src/nxt_capability.h      Mon Dec 09 23:23:00 2019 +0000
+@@ -14,4 +14,6 @@ typedef struct {
+ NXT_EXPORT nxt_int_t nxt_capability_set(nxt_task_t *task,
+     nxt_capabilities_t *cap);
+ 
++NXT_EXPORT nxt_int_t nxt_capability_drop_all(nxt_task_t *task);
++
+ #endif /* _NXT_CAPABILITY_INCLUDED_ */
+diff -r ed17ce89119f src/nxt_process.c
+--- a/src/nxt_process.c Fri Dec 06 17:02:23 2019 +0000
++++ b/src/nxt_process.c Mon Dec 09 23:23:00 2019 +0000
+@@ -264,7 +264,7 @@ cleanup:
+ static void
+ nxt_process_start(nxt_task_t *task, nxt_process_t *process)
+ {
+-    nxt_int_t                    ret, cap_setid;
++    nxt_int_t                    ret, cap_setid, drop_caps;
+     nxt_port_t                   *port, *main_port;
+     nxt_thread_t                 *thread;
+     nxt_runtime_t                *rt;
+@@ -285,9 +285,12 @@ nxt_process_start(nxt_task_t *task, nxt_
+ 
+     cap_setid = rt->capabilities.setid;
+ 
++    drop_caps = cap_setid;
++
+ #if (NXT_HAVE_CLONE_NEWUSER)
+-    if (!cap_setid && NXT_CLONE_USER(init->isolation.clone.flags)) {
++    if (NXT_CLONE_USER(init->isolation.clone.flags)) {
+         cap_setid = 1;
++        drop_caps = 0;
+     }
+ #endif
+ 
+@@ -301,6 +304,12 @@ nxt_process_start(nxt_task_t *task, nxt_
+         if (nxt_slow_path(ret != NXT_OK)) {
+             goto fail;
+         }
++
++#if (NXT_HAVE_LINUX_CAPABILITY)
++        if (drop_caps && nxt_capability_drop_all(task) != NXT_OK) {
++            goto fail;
++        }
++#endif
+     }
+ 
+     rt->type = init->type;
\ No newline at end of file
diff --git a/pkgs/servers/jellyfin/default.nix b/pkgs/servers/jellyfin/default.nix
index b1116dc4a95..6da342ae880 100644
--- a/pkgs/servers/jellyfin/default.nix
+++ b/pkgs/servers/jellyfin/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, unzip, sqlite, makeWrapper, dotnet-sdk, ffmpeg,
+{ stdenv, lib, fetchurl, unzip, sqlite, makeWrapper, dotnet-netcore, ffmpeg,
   fontconfig, freetype }:
 
 let
@@ -32,7 +32,7 @@ in stdenv.mkDerivation rec {
   ];
 
   propagatedBuildInputs = [
-    dotnet-sdk
+    dotnet-netcore
     sqlite
   ];
 
@@ -42,7 +42,7 @@ in stdenv.mkDerivation rec {
     install -dm 755 "$out/opt/jellyfin"
     cp -r * "$out/opt/jellyfin"
 
-    makeWrapper "${dotnet-sdk}/bin/dotnet" $out/bin/jellyfin \
+    makeWrapper "${dotnet-netcore}/bin/dotnet" $out/bin/jellyfin \
       --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [
         sqlite fontconfig freetype stdenv.cc.cc.lib
       ]}:$out/opt/jellyfin/runtimes/${runtimeDir}/native/" \
diff --git a/pkgs/servers/mail/mailman/core.nix b/pkgs/servers/mail/mailman/core.nix
deleted file mode 100644
index 1ba220039ea..00000000000
--- a/pkgs/servers/mail/mailman/core.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{ stdenv, buildPythonPackage, fetchPypi, alembic, aiosmtpd, dnspython
-, flufl_bounce, flufl_i18n, flufl_lock, lazr_config, lazr_delegates, passlib
-, requests, zope_configuration, click, falcon, importlib-resources
-, zope_component, lynx, postfix
-}:
-
-buildPythonPackage rec {
-  pname = "mailman";
-  version = "3.2.2";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "09s9p5pb8gff6zblwidyq830yfgcvv50p5drdaxj1qpy8w46lvc6";
-  };
-
-  propagatedBuildInputs = [
-    alembic aiosmtpd click dnspython falcon flufl_bounce flufl_i18n flufl_lock
-    importlib-resources lazr_config passlib requests zope_configuration
-    zope_component
-  ];
-
-  patchPhase = ''
-    substituteInPlace src/mailman/config/postfix.cfg \
-      --replace /usr/sbin/postmap ${postfix}/bin/postmap
-    substituteInPlace src/mailman/config/schema.cfg \
-      --replace /usr/bin/lynx ${lynx}/bin/lynx
-  '';
-
-  # Mailman assumes that those scripts in $out/bin are Python scripts. Wrapping
-  # them in shell code breaks this assumption. The proper way to use mailman is
-  # to create a specialized python interpreter:
-  #
-  #   python37.withPackages (ps: [ps.mailman])
-  #
-  # This gives a properly wrapped 'mailman' command plus an interpreter that
-  # has all the necessary search paths to execute unwrapped 'master' and
-  # 'runner' scripts. The setup is a little tricky, but fortunately NixOS is
-  # about to get a OS module that takes care of those details.
-  dontWrapPythonPrograms = true;
-
-  meta = {
-    homepage = https://www.gnu.org/software/mailman/;
-    description = "Free software for managing electronic mail discussion and newsletter lists";
-    license = stdenv.lib.licenses.gpl3Plus;
-    maintainers = with stdenv.lib.maintainers; [ peti ];
-  };
-}
diff --git a/pkgs/servers/mail/mailman/default.nix b/pkgs/servers/mail/mailman/default.nix
index e9f66b92be2..8e763800f65 100644
--- a/pkgs/servers/mail/mailman/default.nix
+++ b/pkgs/servers/mail/mailman/default.nix
@@ -1,33 +1,48 @@
-{ stdenv, fetchurl, python2 }:
+{ stdenv, buildPythonPackage, fetchPypi, isPy3k, alembic, aiosmtpd, dnspython
+, flufl_bounce, flufl_i18n, flufl_lock, lazr_config, lazr_delegates, passlib
+, requests, zope_configuration, click, falcon, importlib-resources
+, zope_component, lynx, postfix, authheaders, gunicorn
+}:
 
-stdenv.mkDerivation rec {
+buildPythonPackage rec {
   pname = "mailman";
-  version = "2.1.29";
+  version = "3.3.0";
+  disabled = !isPy3k;
 
-  src = fetchurl {
-    url = "mirror://gnu/mailman/${pname}-${version}.tgz";
-    sha256 = "0b0dpwf6ap260791c7lg2vpw30llf19hymbf2hja3s016rqp5243";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1qph9i93ndahfxi3bb2sd0kjm2c0pkh844ai6zacfmvihl1k3pvy";
   };
 
-  buildInputs = [ python2 python2.pkgs.dnspython ];
-
-  patches = [ ./fix-var-prefix.patch ];
-
-  configureFlags = [
-    "--without-permcheck"
-    "--with-cgi-ext=.cgi"
-    "--with-var-prefix=/var/lib/mailman"
+  propagatedBuildInputs = [
+    alembic aiosmtpd click dnspython falcon flufl_bounce flufl_i18n flufl_lock
+    importlib-resources lazr_config passlib requests zope_configuration
+    zope_component authheaders gunicorn
   ];
 
-  installTargets = "doinstall"; # Leave out the 'update' target that's implied by 'install'.
-
-  makeFlags = [ "DIRSETGID=:" ];
+  patchPhase = ''
+    substituteInPlace src/mailman/config/postfix.cfg \
+      --replace /usr/sbin/postmap ${postfix}/bin/postmap
+    substituteInPlace src/mailman/config/schema.cfg \
+      --replace /usr/bin/lynx ${lynx}/bin/lynx
+  '';
+
+  # Mailman assumes that those scripts in $out/bin are Python scripts. Wrapping
+  # them in shell code breaks this assumption. The proper way to use mailman is
+  # to create a specialized python interpreter:
+  #
+  #   python37.withPackages (ps: [ps.mailman])
+  #
+  # This gives a properly wrapped 'mailman' command plus an interpreter that
+  # has all the necessary search paths to execute unwrapped 'master' and
+  # 'runner' scripts. The setup is a little tricky, but fortunately NixOS is
+  # about to get a OS module that takes care of those details.
+  dontWrapPythonPrograms = true;
 
   meta = {
     homepage = https://www.gnu.org/software/mailman/;
-    description = "Free software for managing electronic mail discussion and e-newsletter lists";
-    license = stdenv.lib.licenses.gpl2Plus;
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.peti ];
+    description = "Free software for managing electronic mail discussion and newsletter lists";
+    license = stdenv.lib.licenses.gpl3Plus;
+    maintainers = with stdenv.lib.maintainers; [ peti ];
   };
 }
diff --git a/pkgs/servers/mail/mailman/hyperkitty.nix b/pkgs/servers/mail/mailman/hyperkitty.nix
index 8f060da3446..fedd6c9f759 100644
--- a/pkgs/servers/mail/mailman/hyperkitty.nix
+++ b/pkgs/servers/mail/mailman/hyperkitty.nix
@@ -1,27 +1,34 @@
-{ stdenv, buildPythonPackage, fetchPypi, coverage, mock
+{ stdenv, buildPythonPackage, fetchPypi, isPy3k, isort, coverage, mock
 , robot-detection, django_extensions, rjsmin, cssmin, django-mailman3
-, django-haystack, lockfile, networkx, dateutil, defusedxml
+, django-haystack, flufl_lock, networkx, dateutil, defusedxml
 , django-paintstore, djangorestframework, django, django-q
-, django_compressor, beautifulsoup4, six, psycopg2, whoosh
+, django_compressor, beautifulsoup4, six, psycopg2, whoosh, elasticsearch
 }:
 
 buildPythonPackage rec {
   pname = "HyperKitty";
-  version = "1.2.2";
+  version = "1.3.2";
+  disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1z2zswlml6nppxhzw9a4nrj7i5wsxd29s3q78ka1rwr5m5n7s1rz";
+    sha256 = "092fkv0xyf5vgj33xwq0mh9h5c5d56ifwimaqbfpx5cwc6yivb88";
   };
 
-  buildInputs = [ coverage mock ];
+  nativeBuildInputs = [ isort ];
   propagatedBuildInputs = [
     robot-detection django_extensions rjsmin cssmin django-mailman3
-    django-haystack lockfile networkx dateutil defusedxml
+    django-haystack flufl_lock networkx dateutil defusedxml
     django-paintstore djangorestframework django django-q
-    django_compressor beautifulsoup4 six psycopg2 whoosh
+    django_compressor six psycopg2 isort
   ];
 
+  # Some of these are optional runtime dependencies that are not
+  # listed as dependencies in setup.py.  To use these, they should be
+  # dependencies of the Django Python environment, but not of
+  # HyperKitty so they're not included for people who don't need them.
+  checkInputs = [ beautifulsoup4 coverage elasticsearch mock whoosh ];
+
   checkPhase = ''
     cd $NIX_BUILD_TOP/$sourceRoot
     PYTHONPATH=.:$PYTHONPATH python example_project/manage.py test \
diff --git a/pkgs/servers/mail/mailman/postorius.nix b/pkgs/servers/mail/mailman/postorius.nix
index 871f2ea244d..bcb92051fc8 100644
--- a/pkgs/servers/mail/mailman/postorius.nix
+++ b/pkgs/servers/mail/mailman/postorius.nix
@@ -1,23 +1,21 @@
 { stdenv, buildPythonPackage, fetchPypi, beautifulsoup4, vcrpy, mock
-, django-mailman3, mailmanclient
+, django-mailman3, mailmanclient, readme_renderer
 }:
 
 buildPythonPackage rec {
   pname = "postorius";
-  version = "1.2.4";
+  version = "1.3.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1722lnscxfl8wdigf5d80d1qmd5gblr439wa989jxlww0wkjg9fl";
+    sha256 = "0wrm0hda7ym9qaygxirqaaii66ndmgyy7gx8wqdg07pfx14zcyja";
   };
 
-  buildInputs = [ beautifulsoup4 vcrpy mock ];
-  propagatedBuildInputs = [ django-mailman3 ];
+  propagatedBuildInputs = [ django-mailman3 readme_renderer ];
+  checkInputs = [ beautifulsoup4 vcrpy mock ];
 
-  checkPhase = ''
-    cd $NIX_BUILD_TOP/$sourceRoot
-    PYTHONPATH=.:$PYTHONPATH python example_project/manage.py test --settings=test_settings postorius
-  '';
+  # Tries to connect to database.
+  doCheck = false;
 
   meta = {
     homepage = https://www.gnu.org/software/mailman/;
diff --git a/pkgs/servers/mail/mailman/web.nix b/pkgs/servers/mail/mailman/web.nix
index b0ead765a60..ec16775b1d4 100644
--- a/pkgs/servers/mail/mailman/web.nix
+++ b/pkgs/servers/mail/mailman/web.nix
@@ -1,4 +1,4 @@
-{ stdenv, python, hyperkitty, postorius, buildPythonPackage
+{ stdenv, python, hyperkitty, postorius, buildPythonPackage, isPy3k
 , serverEMail ? "postmaster@example.org"
 , archiverKey ? "SecretArchiverAPIKey"
 , allowedHosts ? []
@@ -17,6 +17,7 @@ in
 
 buildPythonPackage {
   name = "mailman-web-0";
+  disabled = !isPy3k;
 
   propagatedBuildInputs = [ hyperkitty postorius ];
 
diff --git a/pkgs/servers/mail/public-inbox/0002-msgtime-drop-Date-Parse-for-RFC2822.patch b/pkgs/servers/mail/public-inbox/0002-msgtime-drop-Date-Parse-for-RFC2822.patch
new file mode 100644
index 00000000000..ebc9a6f2237
--- /dev/null
+++ b/pkgs/servers/mail/public-inbox/0002-msgtime-drop-Date-Parse-for-RFC2822.patch
@@ -0,0 +1,172 @@
+From c9b5164c954cd0de80d971f1c4ced16bf41ea81b Mon Sep 17 00:00:00 2001
+From: Eric Wong <e@80x24.org>
+Date: Fri, 29 Nov 2019 12:25:07 +0000
+Subject: [PATCH 2/2] msgtime: drop Date::Parse for RFC2822
+
+Date::Parse is not optimized for RFC2822 dates and isn't
+packaged on OpenBSD.  It's still useful for historical
+email when email clients were less conformant, but is
+less relevant for new emails.
+---
+ lib/PublicInbox/MsgTime.pm | 115 ++++++++++++++++++++++++++++++++-----
+ t/msgtime.t                |   6 ++
+ 2 files changed, 107 insertions(+), 14 deletions(-)
+
+diff --git a/lib/PublicInbox/MsgTime.pm b/lib/PublicInbox/MsgTime.pm
+index 58e11d72..e9b27a49 100644
+--- a/lib/PublicInbox/MsgTime.pm
++++ b/lib/PublicInbox/MsgTime.pm
+@@ -7,24 +7,114 @@ use strict;
+ use warnings;
+ use base qw(Exporter);
+ our @EXPORT_OK = qw(msg_timestamp msg_datestamp);
+-use Date::Parse qw(str2time strptime);
++use Time::Local qw(timegm);
++my @MoY = qw(january february march april may june
++		july august september october november december);
++my %MoY;
++@MoY{@MoY} = (0..11);
++@MoY{map { substr($_, 0, 3) } @MoY} = (0..11);
++
++my %OBSOLETE_TZ = ( # RFC2822 4.3 (Obsolete Date and Time)
++	EST => '-0500', EDT => '-0400',
++	CST => '-0600', CDT => '-0500',
++	MST => '-0700', MDT => '-0600',
++	PST => '-0800', PDT => '-0700',
++	UT => '+0000', GMT => '+0000', Z => '+0000',
++
++	# RFC2822 states:
++	#   The 1 character military time zones were defined in a non-standard
++	#   way in [RFC822] and are therefore unpredictable in their meaning.
++);
++my $OBSOLETE_TZ = join('|', keys %OBSOLETE_TZ);
+ 
+ sub str2date_zone ($) {
+ 	my ($date) = @_;
++	my ($ts, $zone);
++
++	# RFC822 is most likely for email, but we can tolerate an extra comma
++	# or punctuation as long as all the data is there.
++	# We'll use '\s' since Unicode spaces won't affect our parsing.
++	# SpamAssassin ignores commas and redundant spaces, too.
++	if ($date =~ /(?:[A-Za-z]+,?\s+)? # day-of-week
++			([0-9]+),?\s+  # dd
++			([A-Za-z]+)\s+ # mon
++			([0-9]{2,})\s+ # YYYY or YY (or YYY :P)
++			([0-9]+)[:\.] # HH:
++				((?:[0-9]{2})|(?:\s?[0-9])) # MM
++				(?:[:\.]((?:[0-9]{2})|(?:\s?[0-9])))? # :SS
++			\s+	# a TZ offset is required:
++				([\+\-])? # TZ sign
++				[\+\-]* # I've seen extra "-" e.g. "--500"
++				([0-9]+|$OBSOLETE_TZ)(?:\s|$) # TZ offset
++			/xo) {
++		my ($dd, $m, $yyyy, $hh, $mm, $ss, $sign, $tz) =
++					($1, $2, $3, $4, $5, $6, $7, $8);
++		# don't accept non-English months
++		defined(my $mon = $MoY{lc($m)}) or return;
++
++		if (defined(my $off = $OBSOLETE_TZ{$tz})) {
++			$sign = substr($off, 0, 1);
++			$tz = substr($off, 1);
++		}
++
++		# Y2K problems: 3-digit years, follow RFC2822
++		if (length($yyyy) <= 3) {
++			$yyyy += 1900;
++
++			# and 2-digit years from '09 (2009) (0..49)
++			$yyyy += 100 if $yyyy < 1950;
++		}
++
++		$ts = timegm($ss // 0, $mm, $hh, $dd, $mon, $yyyy);
+ 
+-	my $ts = str2time($date);
+-	return undef unless(defined $ts);
++		# Compute the time offset from [+-]HHMM
++		$tz //= 0;
++		my ($tz_hh, $tz_mm);
++		if (length($tz) == 1) {
++			$tz_hh = $tz;
++			$tz_mm = 0;
++		} elsif (length($tz) == 2) {
++			$tz_hh = 0;
++			$tz_mm = $tz;
++		} else {
++			$tz_hh = $tz;
++			$tz_hh =~ s/([0-9]{2})\z//;
++			$tz_mm = $1;
++		}
++		while ($tz_mm >= 60) {
++			$tz_mm -= 60;
++			$tz_hh += 1;
++		}
++		$sign //= '+';
++		my $off = $sign . ($tz_mm * 60 + ($tz_hh * 60 * 60));
++		$ts -= $off;
++		$sign = '+' if $off == 0;
++		$zone = sprintf('%s%02d%02d', $sign, $tz_hh, $tz_mm);
+ 
+-	# off is the time zone offset in seconds from GMT
+-	my ($ss,$mm,$hh,$day,$month,$year,$off) = strptime($date);
+-	return undef unless(defined $off);
++	# Time::Zone and Date::Parse are part of the same distibution,
++	# and we need Time::Zone to deal with tz names like "EDT"
++	} elsif (eval { require Date::Parse }) {
++		$ts = Date::Parse::str2time($date);
++		return undef unless(defined $ts);
+ 
+-	# Compute the time zone from offset
+-	my $sign = ($off < 0) ? '-' : '+';
+-	my $hour = abs(int($off / 3600));
+-	my $min  = ($off / 60) % 60;
+-	my $zone = sprintf('%s%02d%02d', $sign, $hour, $min);
++		# off is the time zone offset in seconds from GMT
++		my ($ss,$mm,$hh,$day,$month,$year,$off) =
++					Date::Parse::strptime($date);
++		return undef unless(defined $off);
++
++		# Compute the time zone from offset
++		my $sign = ($off < 0) ? '-' : '+';
++		my $hour = abs(int($off / 3600));
++		my $min  = ($off / 60) % 60;
++
++		$zone = sprintf('%s%02d%02d', $sign, $hour, $min);
++	} else {
++		warn "Date::Parse missing for non-RFC822 date: $date\n";
++		return undef;
++	}
+ 
++	# Note: we've already applied the offset to $ts at this point,
++	# but we want to keep "git fsck" happy.
+ 	# "-1200" is the furthest westermost zone offset,
+ 	# but git fast-import is liberal so we use "-1400"
+ 	if ($zone >= 1400 || $zone <= -1400) {
+@@ -59,9 +149,6 @@ sub msg_date_only ($) {
+ 	my @date = $hdr->header_raw('Date');
+ 	my ($ts);
+ 	foreach my $d (@date) {
+-		# Y2K problems: 3-digit years
+-		$d =~ s!([A-Za-z]{3}) ([0-9]{3}) ([0-9]{2}:[0-9]{2}:[0-9]{2})!
+-			my $yyyy = $2 + 1900; "$1 $yyyy $3"!e;
+ 		$ts = eval { str2date_zone($d) } and return $ts;
+ 		if ($@) {
+ 			my $mid = $hdr->header_raw('Message-ID');
+diff --git a/t/msgtime.t b/t/msgtime.t
+index 6b396602..d9643b65 100644
+--- a/t/msgtime.t
++++ b/t/msgtime.t
+@@ -84,4 +84,10 @@ is_deeply(datestamp('Fri, 28 Jun 2002 12:54:40 -700'), [1025294080, '-0700']);
+ is_deeply(datestamp('Sat, 12 Jan 2002 12:52:57 -200'), [1010847177, '-0200']);
+ is_deeply(datestamp('Mon, 05 Nov 2001 10:36:16 -800'), [1004985376, '-0800']);
+ 
++# obsolete formats described in RFC2822
++for (qw(UT GMT Z)) {
++	is_deeply(datestamp('Fri, 02 Oct 1993 00:00:00 '.$_), [ 749520000, '+0000']);
++}
++is_deeply(datestamp('Fri, 02 Oct 1993 00:00:00 EDT'), [ 749534400, '-0400']);
++
+ done_testing();
+-- 
+2.24.1
+
diff --git a/pkgs/servers/mail/public-inbox/default.nix b/pkgs/servers/mail/public-inbox/default.nix
index b4749558500..affcb0e8b23 100644
--- a/pkgs/servers/mail/public-inbox/default.nix
+++ b/pkgs/servers/mail/public-inbox/default.nix
@@ -1,4 +1,4 @@
-{ buildPerlPackage, lib, fetchurl, makeWrapper
+{ buildPerlPackage, lib, fetchurl, fetchpatch, makeWrapper
 , DBDSQLite, EmailMIME, IOSocketSSL, IPCRun, Plack, PlackMiddlewareReverseProxy
 , SearchXapian, TimeDate, URI
 , git, highlight, openssl, xapian
@@ -29,6 +29,14 @@ buildPerlPackage rec {
     sha256 = "0sa2m4f2x7kfg3mi4im7maxqmqvawafma8f7g92nyfgybid77g6s";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://public-inbox.org/meta/20200101032822.GA13063@dcvr/raw";
+      sha256 = "0ncxqqkvi5lwi8zaa7lk7l8mf8h278raxsvbvllh3z7jhfb48r3l";
+    })
+    ./0002-msgtime-drop-Date-Parse-for-RFC2822.patch
+  ];
+
   outputs = [ "out" "devdoc" "sa_config" ];
 
   postConfigure = ''
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 577915be134..608ac6028f4 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -23,11 +23,11 @@ let
 
 in buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.7.3";
+  version = "1.9.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1vpwf6jqwb66mq31lk5f0wzfsqa2l65rd7b1zqjbhvmz0js8kz5f";
+    sha256 = "0ghmxzk2njid7d7ccggda8a9zx4dg1r59n5ymp8f2n9kxz7z2rj2";
   };
 
   patches = [
diff --git a/pkgs/servers/matterbridge/default.nix b/pkgs/servers/matterbridge/default.nix
index 673d3f1f21b..2226d960581 100644
--- a/pkgs/servers/matterbridge/default.nix
+++ b/pkgs/servers/matterbridge/default.nix
@@ -1,14 +1,15 @@
-{ stdenv, buildGoPackage, fetchurl }:
+{ stdenv, buildGoModule, fetchurl }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "matterbridge";
-  version = "1.11.0";
+  version = "1.16.3";
 
   goPackagePath = "github.com/42wim/matterbridge";
+  modSha256 = "sha256-Q6R6AhAELirFijw5ntyjly46HCzFMpLGSJYfv864gt0=";
 
   src = fetchurl {
     url = "https://github.com/42wim/matterbridge/archive/v${version}.tar.gz";
-    sha256 = "1fjpgdaq4mfgf36gzk3hhmlbpfn44b7xll2rdpy69y460jrjfg6k";
+    sha256 = "sha256-VAbZSXilmmd2z2bK4/UZzOrjohDVcJHah9t3DE1mtOE=";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/mautrix-whatsapp/0001-Add-missing-go-dependencies-to-go.sum.patch b/pkgs/servers/mautrix-whatsapp/0001-Add-missing-go-dependencies-to-go.sum.patch
deleted file mode 100644
index e1fd5f4725b..00000000000
--- a/pkgs/servers/mautrix-whatsapp/0001-Add-missing-go-dependencies-to-go.sum.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From e9b9d97074ab811747792ef86f3d195709b65751 Mon Sep 17 00:00:00 2001
-From: Maximilian Bosch <maximilian@mbosch.me>
-Date: Fri, 29 Nov 2019 16:27:15 +0100
-Subject: [PATCH] Add missing go dependencies to go.sum
-
-Generated by running `go build` locally. Otherwise some dependencies are
-missing when building with `buildGoModule` in Nix as it tries to fetch
-the packages during compilation and fails with the following error:
-
-```
-verifying maunium.net/go/mautrix-appservice@v0.1.0-alpha.3.0.20191110192030-cd699619a163: maunium.net/go/mautrix-appservice@v0.1.0-alpha.3.0.20191110192030-cd699619a163: Get https://sum.golang.org/lookup/maunium.net/go/mautrix-appservice@v0.1.0-alpha.3.0.20191110192030-cd699619a163: dial tcp: lookup sum.golang.org on [::1]:53: read udp [::1]:44681->[::1]:53: read: connection refused
-builder for '/nix/store/qxpy80j6y4gl1h6hplsznml1ffrca6az-mautrix-whatsapp-unstable-2019-11-17.drv' failed with exit code 1
-```
----
- go.sum | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/go.sum b/go.sum
-index f638f9a..ab7e907 100644
---- a/go.sum
-+++ b/go.sum
-@@ -45,6 +45,7 @@ github.com/tulir/go-whatsapp v0.0.2-0.20190830212741-33ca6ee47cf5 h1:0pUczFGOo4s
- github.com/tulir/go-whatsapp v0.0.2-0.20190830212741-33ca6ee47cf5/go.mod h1:u3Hdptbz3iB5y/NEoSKgsp9hBzUlm0A5OrLMVdENAX8=
- github.com/tulir/go-whatsapp v0.0.2-0.20190903182221-4e1a838ff3ba h1:exEcedSHn0qEZ1iwNwFF5brEuflhMScjFyyzmxUA+og=
- github.com/tulir/go-whatsapp v0.0.2-0.20190903182221-4e1a838ff3ba/go.mod h1:u3Hdptbz3iB5y/NEoSKgsp9hBzUlm0A5OrLMVdENAX8=
-+github.com/tulir/go-whatsapp v0.0.2-0.20191109203156-c477dae1c7e9 h1:WyLOadcpkAvoyaGfUvBgj/mTHetzliBGFioEEtM+Ac8=
- github.com/tulir/go-whatsapp v0.0.2-0.20191109203156-c477dae1c7e9/go.mod h1:ustkccVUt0hOuKikjFb6b4Eray6At5djkcKYYu4+Lco=
- golang.org/x/crypto v0.0.0-20190131182504-b8fe1690c613/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
- golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 h1:VklqNMn3ovrHsnt90PveolxSbWFaJdECFbxSq0Mqo2M=
-@@ -73,6 +74,7 @@ maunium.net/go/mautrix v0.1.0-alpha.3.0.20190622085722-6406f15cb8e3 h1:oVabjOi2r
- maunium.net/go/mautrix v0.1.0-alpha.3.0.20190622085722-6406f15cb8e3/go.mod h1:O+QWJP3H7BZEzIBSrECKpnpRnEKBwaoWVEu/yZwVwxg=
- maunium.net/go/mautrix v0.1.0-alpha.3.0.20190825132810-9d870654e9d2 h1:0iVxLLAOSBqtJqhIjW9EbblMsaSYoCJRo5mHPZnytUk=
- maunium.net/go/mautrix v0.1.0-alpha.3.0.20190825132810-9d870654e9d2/go.mod h1:O+QWJP3H7BZEzIBSrECKpnpRnEKBwaoWVEu/yZwVwxg=
-+maunium.net/go/mautrix v0.1.0-alpha.3.0.20191110191816-178ce1f1561d h1:lfEHd6diaoKLdZvVNcmBF9kD667xWw+x7iXlvfpEd00=
- maunium.net/go/mautrix v0.1.0-alpha.3.0.20191110191816-178ce1f1561d/go.mod h1:O+QWJP3H7BZEzIBSrECKpnpRnEKBwaoWVEu/yZwVwxg=
- maunium.net/go/mautrix-appservice v0.1.0-alpha.3.0.20190618052224-6e6c9bb47548 h1:ni1nqs+2AOO+g1ND6f2W0pMcb6sIDVqzerXosO+pI2g=
- maunium.net/go/mautrix-appservice v0.1.0-alpha.3.0.20190618052224-6e6c9bb47548/go.mod h1:yVWU0gvIHIXClgyVnShiufiDksFbFrBqHG9lDAYcmGI=
-@@ -86,4 +88,5 @@ maunium.net/go/mautrix-appservice v0.1.0-alpha.3.0.20190830063827-e7dcd7e42e7c h
- maunium.net/go/mautrix-appservice v0.1.0-alpha.3.0.20190830063827-e7dcd7e42e7c/go.mod h1:FJRRpH5+p3wCfEt6u/3kMeu9aGX/pk2PqtvjRDRW74w=
- maunium.net/go/mautrix-appservice v0.1.0-alpha.3.0.20190901152202-40639f5932be h1:sSBx9AGR4iYHRFwljqNwxXFtbY2bKLJHgI9B4whAU8I=
- maunium.net/go/mautrix-appservice v0.1.0-alpha.3.0.20190901152202-40639f5932be/go.mod h1:FJRRpH5+p3wCfEt6u/3kMeu9aGX/pk2PqtvjRDRW74w=
-+maunium.net/go/mautrix-appservice v0.1.0-alpha.3.0.20191110192030-cd699619a163 h1:+tWThOHlyIW2VITR4A05wuhixu0AH8iZZ/Ha7AwkAys=
- maunium.net/go/mautrix-appservice v0.1.0-alpha.3.0.20191110192030-cd699619a163/go.mod h1:ST7YYCoHtFC4c7/Iga8W5wwKXyxjwVh4DlsnyIU6rYw=
--- 
-2.23.0
-
diff --git a/pkgs/servers/mautrix-whatsapp/default.nix b/pkgs/servers/mautrix-whatsapp/default.nix
index 892f797a00e..bb72ce1b45f 100644
--- a/pkgs/servers/mautrix-whatsapp/default.nix
+++ b/pkgs/servers/mautrix-whatsapp/default.nix
@@ -2,18 +2,16 @@
 
 buildGoModule {
   pname = "mautrix-whatsapp-unstable";
-  version = "2019-11-17";
+  version = "2020-01-12";
 
   src = fetchFromGitHub {
     owner = "tulir";
     repo = "mautrix-whatsapp";
-    rev = "0fba1db6aa88a95ff567f44aa9be7ce6ef24787f";
-    sha256 = "07cgpvicr6n897myx86mlnx7bydsxnf51lnjbv9dl5yyii73f957";
+    rev = "39e46833b471b0cf262d4ff57fcd61530b5d2b9e";
+    sha256 = "1r1f52advibb97vrhi2gw0d0scnsvfbmfqizsbpjmgm7ci9jjhcl";
   };
 
-  patches = [ ./0001-Add-missing-go-dependencies-to-go.sum.patch ];
-
-  modSha256 = "0y0im3dz5z3rcsmnxkk0l6xqwcyxb0bi9h4arw7zblfy16iw6vrr";
+  modSha256 = "18bcv7x49bqnzwhafh8fvyv9z2d4j6w0iyqql0alq57hy7h7lxik";
 
   meta = with stdenv.lib; {
     homepage = https://github.com/tulir/mautrix-whatsapp;
diff --git a/pkgs/servers/metabase/default.nix b/pkgs/servers/metabase/default.nix
index e266ea71ee0..69a92942f5c 100644
--- a/pkgs/servers/metabase/default.nix
+++ b/pkgs/servers/metabase/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "metabase";
-  version = "0.33.7.1";
+  version = "0.34.1";
 
   src = fetchurl {
     url = "http://downloads.metabase.com/v${version}/metabase.jar";
-    sha256 = "1rx9v0vcrpsjsclap4x9ic9jwhyd24v1n1v8si18blzn3iyr8c36";
+    sha256 = "0fcggpv9ikx481ci7jw6phhmk3mqxbsn9pfs1kqmhwy1ka4ck6dg";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/monitoring/facette/default.nix b/pkgs/servers/monitoring/facette/default.nix
deleted file mode 100644
index 5d6f0fc3bfe..00000000000
--- a/pkgs/servers/monitoring/facette/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ stdenv, fetchFromGitHub
-, go, pkgconfig, nodejs, nodePackages, pandoc, rrdtool }:
-
-stdenv.mkDerivation rec {
-  pname = "facette";
-  version = "0.4.1";
-  src = fetchFromGitHub {
-    owner = "facette";
-    repo = "facette";
-    rev = version;
-    sha256 = "0p28s2vn18cqg8p7bzhb38wky0m98d5xv3wvf1nmg1kmwhwim6mi";
-  };
-  nativeBuildInputs = [ go pkgconfig nodejs nodePackages.npm pandoc ];
-  buildInputs = [ rrdtool ];
-  preBuild = ''
-    export HOME="$NIX_BUILD_ROOT" # npm needs a writable home
-  '';
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  meta = with stdenv.lib; {
-    description = "Time series data visualization software";
-    longDescription = ''
-      Facette is a web application to display time series data from various
-      sources — such as collectd, Graphite, InfluxDB or KairosDB — on graphs.
-    '';
-    homepage = https://facette.io/;
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ fgaz ];
-    broken = true; # not really broken, it just requires an internet connection to build. see #45382
-  };
-}
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 787c7b1d463..183bbc73f5d 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "grafana";
-  version = "6.5.2";
+  version = "6.5.3";
 
   goPackagePath = "github.com/grafana/grafana";
 
@@ -12,12 +12,12 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "1hplnb8rv2sxai05qf6il5kza08bkhcawvymr2h9lfdsj7p4kbzy";
+    sha256 = "1ks951b3ar1wdpbxn8ak74m8zh02d3lbmk6mphwni68c019ymahi";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "1fnj41lp9b53iyjgis5x8k3g5vl73fdrxsdxnf10d4ma95cwb2qa";
+    sha256 = "1gjj0h7kz4lan00ka5kg901l3nyzswnjfr0slqy08bl4svqpizh2";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/monitoring/loki/default.nix b/pkgs/servers/monitoring/loki/default.nix
index 895621d4cba..b5e63a3aed4 100644
--- a/pkgs/servers/monitoring/loki/default.nix
+++ b/pkgs/servers/monitoring/loki/default.nix
@@ -1,7 +1,7 @@
 { stdenv, buildGoPackage, fetchFromGitHub, makeWrapper, systemd }:
 
 buildGoPackage rec {
-  version = "1.2.0";
+  version = "1.3.0";
   pname = "grafana-loki";
   goPackagePath = "github.com/grafana/loki";
 
@@ -11,9 +11,15 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "loki";
-    sha256 = "04ix58gb9yy5jf8fhn3k1pbwqs69k7m96cck38ymhwml1793b4k9";
+    sha256 = "0b1dpb3vh5i18467qk8kpb5ic14p4p1dfyr8hjkznf6bs7g8ka1q";
   };
 
+  postPatch = ''
+    substituteInPlace pkg/distributor/distributor_test.go --replace \
+      '"eth0", "en0", "lo0"' \
+      '"lo"'
+  '';
+
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = stdenv.lib.optionals stdenv.isLinux [ systemd.dev ];
 
diff --git a/pkgs/servers/mqtt/mosquitto/default.nix b/pkgs/servers/mqtt/mosquitto/default.nix
index 5b0f4eceaed..b52cfb09d4f 100644
--- a/pkgs/servers/mqtt/mosquitto/default.nix
+++ b/pkgs/servers/mqtt/mosquitto/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mosquitto";
-  version = "1.6.7";
+  version = "1.6.8";
 
   src = fetchFromGitHub {
     owner  = "eclipse";
     repo   = "mosquitto";
     rev    = "v${version}";
-    sha256 = "1g9g9c95ypfa9dv53ga3hjqxrrlqmcf1lmpxgrifl2l34q4zzfln";
+    sha256 = "1py13vg3vwwwg6jdnmq46z6rlzb84r4ggqsmsrn4yar5hrw9pa90";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/mxisd/default.nix b/pkgs/servers/mxisd/default.nix
index 4290d31870c..c5841d4d1a8 100644
--- a/pkgs/servers/mxisd/default.nix
+++ b/pkgs/servers/mxisd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, jre, git, gradle_4, perl, makeWrapper }:
+{ stdenv, fetchFromGitHub, jre, git, gradle, perl, makeWrapper }:
 
 let
   name = "mxisd-${version}";
@@ -16,7 +16,7 @@ let
   deps = stdenv.mkDerivation {
     name = "${name}-deps";
     inherit src;
-    nativeBuildInputs = [ gradle_4 perl git ];
+    nativeBuildInputs = [ gradle perl git ];
 
     buildPhase = ''
       export MXISD_BUILD_VERSION=${rev}
@@ -41,7 +41,7 @@ let
 in
 stdenv.mkDerivation {
   inherit name src version;
-  nativeBuildInputs = [ gradle_4 perl makeWrapper ];
+  nativeBuildInputs = [ gradle perl makeWrapper ];
   buildInputs = [ jre ];
 
   patches = [ ./0001-gradle.patch ];
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 0d0aec4fb2c..9fb7a2e3e0e 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nextcloud";
-  version = "17.0.2";
+  version = "18.0.0";
 
   src = fetchurl {
     url = "https://download.nextcloud.com/server/releases/${pname}-${version}.tar.bz2";
-    sha256 = "1qrxalyyfjlv3myzkn5z33smfpv8r1ph2w9ax6jqivspq3zrc9gk";
+    sha256 = "0yr6sh9nf15dpnpcj4ypdmm9l3y8ls57pxsmqh5h913db2jrah0r";
   };
 
   installPhase = ''
diff --git a/pkgs/servers/nginx-sso/default.nix b/pkgs/servers/nginx-sso/default.nix
index 5cc583c68b3..10a0c99996d 100644
--- a/pkgs/servers/nginx-sso/default.nix
+++ b/pkgs/servers/nginx-sso/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "nginx-sso";
-  version = "0.22.0";
+  version = "0.24.0";
   rev = "v${version}";
 
   goPackagePath = "github.com/Luzifer/nginx-sso";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "Luzifer";
     repo = "nginx-sso";
-    sha256 = "1kcyb7sbqna18yw3myi3c0imhh4hsa0h2k2y0bqfr2pqsnssz54a";
+    sha256 = "0jkmd1hdr40i1wd3001ixjv1nminsxmwhvnhcgfqcdn5gnaradwn";
   };
 
   postInstall = ''
diff --git a/pkgs/servers/rippled/default.nix b/pkgs/servers/rippled/default.nix
index 840f63f3e05..905e776ea36 100644
--- a/pkgs/servers/rippled/default.nix
+++ b/pkgs/servers/rippled/default.nix
@@ -1,34 +1,28 @@
-{ stdenv, fetchFromGitHub, fetchgit, fetchurl, git, cmake, pkgconfig
+{ stdenv, fetchFromGitHub, fetchgit, fetchurl, runCommand, git, cmake, pkgconfig
 , openssl, boost, zlib }:
 
 let
-  sqlite3 = fetchurl {
+  sqlite3 = fetchurl rec {
     url = "https://www.sqlite.org/2018/sqlite-amalgamation-3260000.zip";
     sha256 = "0vh9aa5dyvdwsyd8yp88ss300mv2c2m40z79z569lcxa6fqwlpfy";
-  };
-
-  beast = fetchgit {
-    url = "https://github.com/boostorg/beast.git";
-    rev = "2f9a8440c2432d8a196571d6300404cb76314125";
-    sha256 = "1n9ms5cn67b0p0mhldz5psgylds22sm5x22q7knrsf20856vlk5a";
-    fetchSubmodules = false;
-    leaveDotGit = true;
+    passthru.url = url;
   };
 
   docca = fetchgit {
     url = "https://github.com/vinniefalco/docca.git";
     rev = "335dbf9c3613e997ed56d540cc8c5ff2e28cab2d";
-    sha256 = "09cb90k0ygmnlpidybv6nzf6is51i80lnwlvad6ijc3gf1z6i1yh";
-    fetchSubmodules = false;
+    sha256 = "1yisdg7q2p9q9gz0c446796p3ggx9s4d6g8w4j1pjff55655805h";
     leaveDotGit = true;
+    fetchSubmodules = false;
   };
 
-  rocksdb = fetchgit {
+  rocksdb = fetchgit rec {
     url = "https://github.com/facebook/rocksdb.git";
-    rev = "a297643f2e327a8bc7061bfc838fdf11935a2cf2";
-    sha256 = "00z8i4fwr27j9d4ymnls7rcgfvm6xh36a4hy2m2njx4x513pgyzw";
-    fetchSubmodules = false;
+    rev = "v5.17.2";
+    sha256 = "0d9ssggjls1hc4zhng65yg8slqlcw0lr23qr6f39shg42lzr227p";
     leaveDotGit = true;
+    fetchSubmodules = false;
+    postFetch = "cd $out && git tag ${rev}";
   };
 
   lz4 = fetchgit rec {
@@ -51,8 +45,8 @@ let
 
   soci = fetchgit {
     url = "https://github.com/SOCI/soci.git";
-    rev = "3a1f602b3021b925d38828e3ff95f9e7f8887ff7";
-    sha256 = "0lnps42cidlrn43h13b9yc8cs3fwgz7wb6a1kfc9rnw7swkh757f";
+    rev = "04e1870294918d20761736743bb6136314c42dd5";
+    sha256 = "0w3b7qi3bwn8bxh4qbqy6c1fw2bbwh7pxvk8b3qb6h4qgsh6kx89";
     leaveDotGit = true;
     fetchSubmodules = false;
   };
@@ -67,11 +61,11 @@ let
   };
 
   nudb = fetchgit rec {
-    url = "https://github.com/vinniefalco/NuDB.git";
-    rev = "1.0.0";
-    sha256 = "142bxicv25xaw4fmpw8bbblb1grdw30wyj181xl4a5734zw3qgmz";
+    url = "https://github.com/CPPAlliance/NuDB.git";
+    rev = "2.0.1";
+    sha256 = "0h7hmwavrxzj1v547h3z0031ckwphjayfpv1mgcr6q86wm9p5468";
     leaveDotGit = true;
-    fetchSubmodules = false;
+    fetchSubmodules = true; # submodules are needed, rocksdb is dependency
     postFetch = "cd $out && git tag ${rev}";
   };
 
@@ -88,40 +82,54 @@ let
     url = "https://github.com/google/googletest.git";
     rev = "c3bb0ee2a63279a803aaad956b9b26d74bf9e6e2";
     sha256 = "0pj5b6jnrj5lrccz2disr8hklbnzd8hwmrwbfqmvhiwb9q9p0k2k";
-    leaveDotGit = true;
     fetchSubmodules = false;
+    leaveDotGit = true;
   };
 
   google-benchmark = fetchgit {
     url = "https://github.com/google/benchmark.git";
     rev = "5b7683f49e1e9223cf9927b24f6fd3d6bd82e3f8";
     sha256 = "0qg70j47zqnrbszlgrzmxpr4g88kq0gyq6v16bhaggfm83c6mg6i";
-    leaveDotGit = true;
     fetchSubmodules = false;
+    leaveDotGit = true;
   };
+
+  # hack to merge rocksdb revisions from rocksdb and nudb, so build process
+  # will find both
+  rocksdb-merged = runCommand "rocksdb-merged" {
+    buildInputs = [ git ];
+  } ''
+    commit=$(cd ${nudb} && git ls-tree HEAD extras/rocksdb | awk '{ print $3  }')
+    git clone ${rocksdb} $out && cd $out
+    git fetch ${nudb}/extras/rocksdb $commit
+    git checkout $commit
+  '';
 in stdenv.mkDerivation rec {
   pname = "rippled";
-  version = "1.2.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "ripple";
     repo = "rippled";
     rev = version;
-    sha256 = "1lm0zzz0hi2sh2f4iqq3scapzdjbxcjgr700fgham9wqgaj2ash5";
+    sha256 = "1z04378bg8lcyrnn7sl3j2zfxbwwy2biasg1d4fbaq4snxg5d1pq";
   };
 
   hardeningDisable = ["format"];
-  cmakeFlags = ["-Dstatic=OFF"];
+  cmakeFlags = [
+    "-Dstatic=OFF"
+    "-DBOOST_LIBRARYDIR=${boost.out}/lib"
+    "-DBOOST_INCLUDEDIR=${boost.dev}/include"
+  ];
 
   nativeBuildInputs = [ pkgconfig cmake git ];
-  buildInputs = [ openssl openssl.dev boost zlib ];
+  buildInputs = [ openssl openssl.dev zlib ];
 
   preConfigure = ''
     export HOME=$PWD
 
-    git config --global url."file://${beast}".insteadOf "https://github.com/vinniefalco/Beast.git"
-    git config --global url."file://${docca}".insteadOf "https://github.com/vinniefalco/docca.git"
-    git config --global url."file://${rocksdb}".insteadOf "https://github.com/facebook/rocksdb.git"
+    git config --global url."file://${docca}".insteadOf "${docca.url}"
+    git config --global url."file://${rocksdb-merged}".insteadOf "${rocksdb.url}"
     git config --global url."file://${lz4}".insteadOf "${lz4.url}"
     git config --global url."file://${libarchive}".insteadOf "${libarchive.url}"
     git config --global url."file://${soci}".insteadOf "${soci.url}"
@@ -131,7 +139,7 @@ in stdenv.mkDerivation rec {
     git config --global url."file://${google-benchmark}".insteadOf "${google-benchmark.url}"
     git config --global url."file://${google-test}".insteadOf "${google-test.url}"
 
-    substituteInPlace CMakeLists.txt --replace "URL https://www.sqlite.org/2018/sqlite-amalgamation-3260000.zip" "URL ${sqlite3}"
+    substituteInPlace Builds/CMake/deps/Sqlite.cmake --replace "URL ${sqlite3.url}" "URL ${sqlite3}"
   '';
 
   doCheck = true;
@@ -141,7 +149,7 @@ in stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Ripple P2P payment network reference server";
-    homepage = https://ripple.com;
+    homepage = https://github.com/ripple/rippled;
     maintainers = with maintainers; [ ehmry offline ];
     license = licenses.isc;
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/servers/search/elasticsearch/7.x.nix b/pkgs/servers/search/elasticsearch/7.x.nix
index 31891920369..73a947066bf 100644
--- a/pkgs/servers/search/elasticsearch/7.x.nix
+++ b/pkgs/servers/search/elasticsearch/7.x.nix
@@ -17,12 +17,12 @@ let
   shas =
     if enableUnfree
     then {
-      x86_64-linux  = "0x1ws6iqflvzphg2srvdrn4xrr5wd5fnykkc9h006mj9rb5lp1k9";
-      x86_64-darwin = "0yjzgsbsgwa6gbp270fqfm1klm6f8n4s2xmay62gdgvnsj543cxz";
+      x86_64-linux  = "1s27bzx5y8vcd95qrw6av3fhyxb45219x9ahwaxa2cygmbpighrp";
+      x86_64-darwin = "1ia3byir3i5qaarmcaysrg3dhnxjmxnf0m0kzyf61g9aiy87gb7q";
     }
     else {
-      x86_64-linux  = "1nl6yic1j422l2c7mf8wv0ylfx6marrwm7d181z9nzdswq509kpg";
-      x86_64-darwin = "1sy4an9d1faifr3n2y45kalrd22yb68dnpjhi9h8q73c21gp8pzf";
+      x86_64-linux  = "005i7d7ag10qkn7bkx7md50iihvcvc84hay2j94wvsm7yghhbmi3";
+      x86_64-darwin = "01f81720rbzdqc0g1xymhz2lflldfbnb0rh7mpki99pss28vj9sh";
     };
 in
 stdenv.mkDerivation (rec {
diff --git a/pkgs/servers/search/elasticsearch/plugins.nix b/pkgs/servers/search/elasticsearch/plugins.nix
index a40a142368a..cdab1fce7b0 100644
--- a/pkgs/servers/search/elasticsearch/plugins.nix
+++ b/pkgs/servers/search/elasticsearch/plugins.nix
@@ -30,9 +30,9 @@ in {
     pluginName = "analysis-lemmagen";
     version = esVersion;
     src = fetchurl {
-      url = "https://github.com/vhyza/${pluginName}/releases/download/v${version}/${pluginName}-${version}-plugin.zip";
+      url = "https://github.com/vhyza/elasticsearch-${pluginName}/releases/download/v${version}/elasticsearch-${pluginName}-${version}-plugin.zip";
       sha256 =
-        if version == "7.3.1" then "1nb82z6s94mzdx1srb1pwj7cpzs8w74njap0xiqn7sg5ylk6adm8"
+        if version == "7.5.1" then "0js8b9a9ma797448m3sy92qxbwziix8gkcka7hf17dqrb9k29v61"
         else if version == "6.8.3" then "12bshvp01pp2lgwd0cn9l58axg8gdimsh4g9wfllxi1bdpv4cy53"
         else throw "unsupported version ${version} for plugin ${pluginName}";
     };
@@ -49,7 +49,7 @@ in {
     src = fetchurl {
       url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${version}.zip";
       sha256 =
-        if version == "7.3.1" then "1p30by7pqnvj8dcwws51kh9s962c42qwqq07gmj4jl83zxcl8kyl"
+        if version == "7.5.1" then "09wl2bpng4xx384xns960rymnm64b5zn2cb1sp25n85pd0isp4p2"
         else if version == "6.8.3" then "0pmffz761dqjpvmkl7i7xsyw1iyyspqpddxp89rjsznfc9pak5im"
         else throw "unsupported version ${version} for plugin ${pluginName}";
     };
@@ -66,7 +66,7 @@ in {
     src = fetchurl {
       url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${version}.zip";
       sha256 =
-        if version == "7.3.1" then "1b9l17zv6582sdcdiabwd293xx5ckc2d3h6smiv6znk5f4dxj7km"
+        if version == "7.5.1" then "0hhwxkjlkw1yv5sp6pdn5k1y8bdv4mnmb6nby1z4367mig6rm8v9"
         else if version == "6.8.3" then "0kfr4i2rcwinjn31xrc2piicasjanaqcgnbif9xc7lnak2nnzmll"
         else throw "unsupported version ${version} for plugin ${pluginName}";
     };
@@ -83,7 +83,7 @@ in {
     src = fetchurl {
       url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${esVersion}.zip";
       sha256 =
-        if version == "7.3.1" then "1dqd3hd8qa1bsvd1p42k5zcrdmb66d2yspfc7g8nsz89w6b1invg"
+        if version == "7.5.1" then "1j1rgbha5lh0a02h55zqc5qn0mvvi16l2m5r8lmaswp97px056v9"
         else if version == "6.8.3" then "1mm6hj2m1db68n81rzsvlw6nisflr5ikzk5zv9nmk0z641n5vh1x"
         else throw "unsupported version ${version} for plugin ${pluginName}";
     };
@@ -100,7 +100,7 @@ in {
     src = fetchurl {
       url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${esVersion}.zip";
       sha256 =
-        if version == "7.3.1" then "0kpb1hn2fb4lh6kn96vi7265ign9lwcd0zfc19l4n6fpp8js5lfh"
+        if version == "7.5.1" then "15g438zpxrcmsgddwmk3sccy92ha90cyq9c61kcw1q84wfi0a7jl"
         else if version == "6.8.3" then "1s2klpvnhpkrk53p64zbga3b66czi7h1a13f58kfn2cn0zfavnbk"
         else throw "unsupported version ${version} for plugin ${pluginName}";
     };
@@ -117,13 +117,13 @@ in {
     pluginName = "search-guard";
     version =
       # https://docs.search-guard.com/latest/search-guard-versions
-      if esVersion == "7.3.1" then "${esVersion}-37.0.0"
+      if esVersion == "7.5.1" then "${esVersion}-38.0.0"
       else if esVersion == "6.8.3" then "${esVersion}-25.5"
       else throw "unsupported version ${esVersion} for plugin ${pluginName}";
     src = fetchurl {
       url = "mirror://maven/com/floragunn/${pluginName}-${majorVersion}/${version}/${pluginName}-${majorVersion}-${version}.zip";
       sha256 =
-        if version == "7.3.1-37.0.0" then "0rb631npr6vykrhln3x6q75xwb0wndvrspwnak0rld5d7pqn1r04"
+        if version == "7.5.1-38.0.0" then "1a1wp9wrmz6ji2rnpk0b9jqnp86w0w0z8sb48giyc1gzcy1ra9yh"
         else if version == "6.8.3-25.5" then "0a7ys9qinc0fjyka03cx9rv0pm7wnvslk234zv5vrphkrj52s1cb"
         else throw "unsupported version ${version} for plugin ${pluginName}";
     };
diff --git a/pkgs/servers/search/groonga/default.nix b/pkgs/servers/search/groonga/default.nix
index cfadeac5f07..d610a02ee91 100644
--- a/pkgs/servers/search/groonga/default.nix
+++ b/pkgs/servers/search/groonga/default.nix
@@ -7,11 +7,11 @@
 stdenv.mkDerivation rec {
 
   pname = "groonga";
-  version = "9.1.0";
+  version = "9.1.1";
 
   src = fetchurl {
     url    = "https://packages.groonga.org/source/groonga/${pname}-${version}.tar.gz";
-    sha256 = "11mlpnaldb6z438qdb7qjq9dxbh71l6v6lrv69fxka34izpgyhkk";
+    sha256 = "16i5bmypawxjac6g808qgr0z3rvla6g6dr586rmwl7sbq0z2nr82";
   };
 
   buildInputs = with stdenv.lib;
diff --git a/pkgs/servers/search/solr/8.x.nix b/pkgs/servers/search/solr/8.x.nix
deleted file mode 100644
index 6a5dfb98aa7..00000000000
--- a/pkgs/servers/search/solr/8.x.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ stdenv, fetchurl, jre, makeWrapper }:
-
-stdenv.mkDerivation rec {
-  pname = "solr";
-  version = "8.3.1";
-
-  src = fetchurl {
-    url = "mirror://apache/lucene/${pname}/${version}/${pname}-${version}.tgz";
-    sha256 = "0n80690vdsd0gf5gg77kg8pyf3nw0iv33zag9r7al88j5riy42ih";
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    mkdir -p $out $out/bin
-
-    cp -r bin/solr bin/post $out/bin/
-    cp -r contrib $out/
-    cp -r dist $out/
-    cp -r example $out/
-    cp -r server $out/
-
-    wrapProgram $out/bin/solr --set JAVA_HOME "${jre}"
-    wrapProgram $out/bin/post --set JAVA_HOME "${jre}"
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = "https://lucene.apache.org/solr/";
-    description = "Open source enterprise search platform from the Apache Lucene project";
-    license = licenses.asl20;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ domenkozar aanderse ];
-  };
-
-}
diff --git a/pkgs/servers/search/solr/default.nix b/pkgs/servers/search/solr/default.nix
index c94b11c91dd..701d3880cbd 100644
--- a/pkgs/servers/search/solr/default.nix
+++ b/pkgs/servers/search/solr/default.nix
@@ -1,12 +1,12 @@
-{ stdenv, fetchurl, jre, makeWrapper }:
+{ stdenv, fetchurl, jre, makeWrapper, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "solr";
-  version = "7.7.2";
+  version = "8.4.1";
 
   src = fetchurl {
-    url = "mirror://apache/lucene/solr/${version}/solr-${version}.tgz";
-    sha256 = "1pr02d4sw5arig1brjb6j7ir644n8s737qsx6ll46di5iw1y93pb";
+    url = "mirror://apache/lucene/${pname}/${version}/${pname}-${version}.tgz";
+    sha256 = "00a35a6ppd4ngp80dxak3bqrp8vmx0wixr4x2h2p9qxj4khf2fgc";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -24,12 +24,16 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/post --set JAVA_HOME "${jre}"
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) solr;
+  };
+
   meta = with stdenv.lib; {
     homepage = "https://lucene.apache.org/solr/";
     description = "Open source enterprise search platform from the Apache Lucene project";
     license = licenses.asl20;
     platforms = platforms.all;
-    maintainers = [ maintainers.domenkozar maintainers.aanderse ];
+    maintainers = with maintainers; [ domenkozar aanderse ];
   };
 
 }
diff --git a/pkgs/servers/ser2net/default.nix b/pkgs/servers/ser2net/default.nix
new file mode 100644
index 00000000000..e18d96013e4
--- /dev/null
+++ b/pkgs/servers/ser2net/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, lib, fetchFromGitHub, gensio, libyaml, autoreconfHook }:
+
+stdenv.mkDerivation rec {
+  pname = "ser2net";
+  version = "4.1.1";
+
+  src = fetchFromGitHub {
+    owner = "cminyard";
+    repo = "${pname}";
+    rev = "v${version}";
+    sha256 = "1zl68mmd7pp10cjv1jk8rs2dlbwvzskyb58qvc7ph7vc6957lfhc";
+  };
+
+  buildInputs = [ autoreconfHook gensio libyaml ];
+
+  meta = with lib; {
+    description = "Serial to network connection server";
+    homepage = "https://sourceforge.net/projects/ser2net/";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ emantor ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/servers/sql/postgresql/ext/plv8.nix b/pkgs/servers/sql/postgresql/ext/plv8.nix
index 75a2853e2c0..ffba1bd8e3b 100644
--- a/pkgs/servers/sql/postgresql/ext/plv8.nix
+++ b/pkgs/servers/sql/postgresql/ext/plv8.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "plv8";
-  version = "2.3.13";
+  version = "2.3.14";
 
   nativeBuildInputs = [ perl ];
   buildInputs = [ v8 postgresql ];
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "plv8";
     repo = "plv8";
     rev = "v${version}";
-    sha256 = "12xpcc1ylzyy75wi1m4vijknzv2gxab05w9z90jb03faq18cnlql";
+    sha256 = "12g7z0xkb6zg2qd0hppk2izq238v1k52vb13jlvaij1rbhh10mbp";
   };
 
   makefile = "Makefile.shared";
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 0427de60aa5..6f0ec04cd75 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "timescaledb";
-  version = "1.5.1";
+  version = "1.6.0";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ postgresql openssl ];
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     owner  = "timescale";
     repo   = "timescaledb";
     rev    = "refs/tags/${version}";
-    sha256 = "1mgmkc42nksfsmjg463v03rj1v8gybwlzzi515gxz6ijx8604w4c";
+    sha256 = "0b42rhkycr4pwwa4fxnmppd3bl0xz7azvlm145rd7warlsr5h0lb";
   };
 
   cmakeFlags = [ "-DSEND_TELEMETRY_DEFAULT=OFF" "-DREGRESS_CHECKS=OFF" ];
diff --git a/pkgs/servers/tt-rss/theme-feedly/default.nix b/pkgs/servers/tt-rss/theme-feedly/default.nix
index c35667546c6..8ad511e5b5b 100644
--- a/pkgs/servers/tt-rss/theme-feedly/default.nix
+++ b/pkgs/servers/tt-rss/theme-feedly/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchFromGitHub }: stdenv.mkDerivation rec {
   pname = "tt-rss-theme-feedly";
-  version = "2.0.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "levito";
     repo = "tt-rss-feedly-theme";
     rev = "v${version}";
-    sha256 = "024hngwzfdgw5jqppc8vh75jidfqghaccy969hvbhxhgk6j6l8m4";
+    sha256 = "0rl5g664grx3m7yxa14rgnbvnlc3xnn44kzjji5layxww6jd8h2s";
   };
 
   dontBuild = true;
diff --git a/pkgs/servers/web-apps/dokuwiki/default.nix b/pkgs/servers/web-apps/dokuwiki/default.nix
index ff6fa982228..f12a75c8e18 100644
--- a/pkgs/servers/web-apps/dokuwiki/default.nix
+++ b/pkgs/servers/web-apps/dokuwiki/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, fetchFromGitHub, writeText }:
 
 stdenv.mkDerivation rec {
   pname = "dokuwiki";
@@ -11,9 +11,38 @@ stdenv.mkDerivation rec {
     sha256 = "1na5pn4j4mi2la80ywzg1krwqdxz57mjkw0id6ga9rws809gkdjp";
   };
 
+  preload = writeText "preload.php" ''
+  <?php
+
+    $config_cascade = array(
+      'acl' => array(
+        'default'   => getenv('DOKUWIKI_ACL_AUTH_CONFIG'),
+      ),
+      'plainauth.users' => array(
+        'default'   => getenv('DOKUWIKI_USERS_AUTH_CONFIG'),
+        'protected' => "" // not used by default
+      ),
+    );
+  '';
+
+  phpLocalConfig = writeText "local.php" ''
+  <?php
+    return require(getenv('DOKUWIKI_LOCAL_CONFIG'));
+  ?>
+  '';
+
+  phpPluginsLocalConfig = writeText "plugins.local.php" ''
+  <?php
+    return require(getenv('DOKUWIKI_PLUGINS_LOCAL_CONFIG'));
+  ?>
+  '';
+
   installPhase = ''
     mkdir -p $out/share/dokuwiki
     cp -r * $out/share/dokuwiki
+    cp ${preload} $out/share/dokuwiki/inc/preload.php
+    cp ${phpLocalConfig} $out/share/dokuwiki/conf/local.php
+    cp ${phpPluginsLocalConfig} $out/share/dokuwiki/conf/plugins.local.php
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/web-apps/matomo/default.nix b/pkgs/servers/web-apps/matomo/default.nix
index 5c88b8efb4a..d5f0b7057f0 100644
--- a/pkgs/servers/web-apps/matomo/default.nix
+++ b/pkgs/servers/web-apps/matomo/default.nix
@@ -3,8 +3,8 @@
 let
   versions = {
     matomo = {
-      version = "3.13.0";
-      sha256 = "0h4jqibb86zw5l26r927qrbjhba8c79pc4xp3hgpi25p3fjncax8";
+      version = "3.13.1";
+      sha256 = "071m3sw3rrhlccbwdyklcn8rwp4mcnii5m2a7zmgx3rv87i9n2ni";
     };
 
     matomo-beta = {
diff --git a/pkgs/servers/web-apps/moodle/default.nix b/pkgs/servers/web-apps/moodle/default.nix
index 2957d296dc4..3de6005a3cf 100644
--- a/pkgs/servers/web-apps/moodle/default.nix
+++ b/pkgs/servers/web-apps/moodle/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, writeText }:
 
 let
-  version = "3.8";
+  version = "3.8.1";
   stableVersion = builtins.substring 0 2 (builtins.replaceStrings ["."] [""] version);
 in
 
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.moodle.org/stable${stableVersion}/${pname}-${version}.tgz";
-    sha256 = "00ssx0drgp1fy062x6alp0x8di7hjn4xc87v8skpy3aznchfxyk9";
+    sha256 = "1xz2wq16blw9p2b6wlrn9lr524gddm5jyac5prka8kp6lrk0v0y1";
   };
 
   phpConfig = writeText "config.php" ''
diff --git a/pkgs/servers/web-apps/shaarli/material-theme.nix b/pkgs/servers/web-apps/shaarli/material-theme.nix
index ef0a4331d41..b0829fce733 100644
--- a/pkgs/servers/web-apps/shaarli/material-theme.nix
+++ b/pkgs/servers/web-apps/shaarli/material-theme.nix
@@ -26,10 +26,13 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
+    # This package has not been updated for the new build process
+    # introduced in 0.10.3 which depends on npm and gulp.
+    broken = true;
     description = "A theme base on Google's Material Design for Shaarli, the superfast delicious clone";
     license = licenses.mit;
     homepage = https://github.com/kalvn/Shaarli-Material;
-    maintainers = with maintainers; [ schneefux ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index c01bca007dc..84bf23a0fde 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -1,5 +1,5 @@
 { abiCompat ? null,
-  stdenv, makeWrapper, fetchurl, fetchpatch, buildPackages,
+  stdenv, makeWrapper, fetchurl, fetchpatch, fetchFromGitLab, buildPackages,
   automake, autoconf, gettext, libiconv, libtool, intltool,
   freetype, tradcpp, fontconfig, meson, ninja, ed,
   libGL, spice-protocol, zlib, libGLU, dbus, libunwind, libdrm,
@@ -745,11 +745,14 @@ self: super:
 
   xf86videointel = super.xf86videointel.overrideAttrs (attrs: {
     # the update script only works with released tarballs :-/
-    name = "xf86-video-intel-2018-12-03";
-    src = fetchurl {
-      url = "http://cgit.freedesktop.org/xorg/driver/xf86-video-intel/snapshot/"
-          + "e5ff8e1828f97891c819c919d7115c6e18b2eb1f.tar.gz";
-      sha256 = "01136zljk6liaqbk8j9m43xxzqj6xy4v50yjgi7l7g6pp8pw0gx6";
+    name = "xf86-video-intel-2019-12-09";
+    src = fetchFromGitLab {
+      domain = "gitlab.freedesktop.org";
+      group = "xorg";
+      owner = "driver";
+      repo = "xf86-video-intel";
+      rev = "f66d39544bb8339130c96d282a80f87ca1606caf";
+      sha256 = "14rwbbn06l8qpx7s5crxghn80vgcx8jmfc7qvivh72d81r0kvywl";
     };
     buildInputs = attrs.buildInputs ++ [self.libXfixes self.libXScrnSaver self.pixman];
     nativeBuildInputs = attrs.nativeBuildInputs ++ [autoreconfHook self.utilmacros];
diff --git a/pkgs/servers/zoneminder/default.nix b/pkgs/servers/zoneminder/default.nix
index 2dcaf44010e..e536ea0373c 100644
--- a/pkgs/servers/zoneminder/default.nix
+++ b/pkgs/servers/zoneminder/default.nix
@@ -162,6 +162,10 @@ in stdenv.mkDerivation rec {
     "-DZM_CONFIG_DIR=${placeholder "out"}/etc/zoneminder"
     "-DZM_WEB_USER=${user}"
     "-DZM_WEB_GROUP=${user}"
+
+    # Workaround issue in CMakeLists.txt where ZM_CGIDIR set to ${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBEXECDIR}/zoneminder/cgi-bin
+    # But CMAKE_INSTALL_LIBEXECDIR is already an absolute path from cmake setup-hook
+    "-DZM_CGIDIR=${placeholder "out"}/libexec/zoneminder/cgi-bin"
   ];
 
   passthru = { inherit dirName; };