[pull] master from NixOS:master

doc/release-notes/rl-2611.section.md

@@ -53,6 +53,10 @@
 
 - `fflogs` has been removed because it was no longer functional. Users should switch to `archon-lite`.
 
+- `keycloak.plugins.scim-for-keycloak` has been removed. The upstream open-source project is [end-of-life](https://github.com/Captain-P-Goldfish/scim-for-keycloak) and its last release targets Keycloak 20, which is incompatible with the packaged Keycloak.
+
+- `keycloak.plugins.scim-keycloak-user-storage-spi` has been removed. Upstream has moved the plugin into Keycloak itself as the experimental `ipatuura` federation provider and no longer maintains the standalone repository.
+
 - `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
   Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
 

maintainers/maintainer-list.nix

@@ -14958,6 +14958,11 @@
     githubId = 361496;
     name = "Nikola Knežević";
   };
+  koalalorenzo = {
+    name = "Lorenzo Setale";
+    github = "koalalorenzo";
+    githubId = 33528;
+  };
   koffydrop = {
     github = "koffydrop";
     githubId = 67888720;

nixos/doc/manual/redirects.json

@@ -65,6 +65,24 @@
   "module-services-keycloak-unix-socket": [
     "index.html#module-services-keycloak-unix-socket"
   ],
+  "module-services-lxmd": [
+    "index.html#module-services-lxmd"
+  ],
+  "module-services-lxmd-communication-backbone": [
+    "index.html#module-services-lxmd-communication-backbone"
+  ],
+  "module-services-lxmd-communication-rpc": [
+    "index.html#module-services-lxmd-communication-rpc"
+  ],
+  "module-services-lxmd-communication-with-rnsd": [
+    "index.html#module-services-lxmd-communication-with-rnsd"
+  ],
+  "module-services-lxmd-health-check": [
+    "index.html#module-services-lxmd-health-check"
+  ],
+  "module-services-lxmd-quickstart": [
+    "index.html#module-services-lxmd-quickstart"
+  ],
   "module-services-mautrix-discord": [
     "index.html#module-services-mautrix-discord"
   ],
@@ -104,6 +122,18 @@
   "module-services-onedrive": [
     "index.html#module-services-onedrive"
   ],
+  "module-services-rnsd": [
+    "index.html#module-services-rnsd"
+  ],
+  "module-services-rnsd-hardware-access": [
+    "index.html#module-services-rnsd-hardware-access"
+  ],
+  "module-services-rnsd-health-check": [
+    "index.html#module-services-rnsd-health-check"
+  ],
+  "module-services-rnsd-quickstart": [
+    "index.html#module-services-rnsd-quickstart"
+  ],
   "module-services-tandoor-recipes-migrating-media-option-move": [
     "index.html#module-services-tandoor-recipes-migrating-media-option-move",
     "index.html#module-services-tandoor-recipes-migrating-media-option-1"

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -58,6 +58,10 @@
 
 - [NordVPN](https://github.com/NordSecurity/nordvpn-linux), a NordVPN client for linux. Available as [services.nordvpn](options.html#opt-services.nordvpn.enable).
 
+- [RNSD](https://reticulum.network/), the Reticulum Network Stack Daemon. It provides a secure and efficient way to communicate over the Reticulum Network. Available as [services.rnsd](#opt-services.rnsd.enable).
+
+- [LXMD](https://github.com/markqvist/LXMF), a universal, distributed and secure messaging protocol for Reticulum. Available as [services.lxmd](#opt-services.lxmd.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/module-list.nix

@@ -1289,6 +1289,7 @@
   ./services/networking/logmein-hamachi.nix
   ./services/networking/lokinet.nix
   ./services/networking/lxd-image-server.nix
+  ./services/networking/lxmd.nix
   ./services/networking/magic-wormhole-mailbox-server.nix
   ./services/networking/matterbridge.nix
   ./services/networking/meshtasticd.nix
@@ -1386,6 +1387,7 @@
   ./services/networking/redsocks.nix
   ./services/networking/reframe.nix
   ./services/networking/resilio.nix
+  ./services/networking/rnsd.nix
   ./services/networking/robustirc-bridge.nix
   ./services/networking/rosenpass.nix
   ./services/networking/routedns.nix

nixos/modules/services/networking/lxmd.md

@@ -0,0 +1,225 @@
+# LXMD {#module-services-lxmd}
+
+[LXMF](https://github.com/markqvist/lxmf) daemon (`lxmd`).
+
+This module runs `lxmd` as a systemd service with `DynamicUser = true` and
+`StateDirectory = "lxmd"` directives.
+
+## Quickstart {#module-services-lxmd-quickstart}
+
+A minimal setup:
+
+```nix
+{
+  services.lxmd.enable = true;
+}
+```
+
+With custom LXMD and RNSD settings:
+
+```nix
+{
+  services.lxmd = {
+    enable = true;
+
+    identityFile = "<path-to-lxmd-identity-file>";
+
+    settings = {
+      propagation-node = {
+        autopeer = true;
+      };
+    };
+
+    rnsd = {
+      identityFile = "<path-to-rnsd-identity-file>";
+
+      settings = {
+        reticulum = {
+          require_shared_instance = true;
+          is_shared_instance = true;
+          enable_transport = true;
+          instance_name = "default";
+          shared_instance_type = "unix";
+        };
+      };
+    };
+  };
+}
+```
+
+At startup, settings provided through
+[`services.lxmd.settings`](#opt-services.lxmd.settings),
+[`services.lxmd.identityFile`](#opt-services.lxmd.identityFile), and
+[`services.lxmd.rnsd.settings`](#opt-services.lxmd.rnsd.settings) are copied
+into the service state directory.
+
+## Health Check {#module-services-lxmd-health-check}
+
+You can optionally wait for `lxmd` to become responsive during startup using
+`lxmd --status`:
+
+```nix
+{
+  services.lxmd = {
+    enable = true;
+
+    healthCheck = {
+      enable = true;
+      intervalSeconds = 2;
+      timeoutSeconds = 120;
+    };
+  };
+}
+```
+
+When enabled, startup fails if `lxmd --status` does not succeed before
+[`services.lxmd.healthCheck.timeoutSeconds`](#opt-services.lxmd.healthCheck.timeoutSeconds).
+
+## Communicating With RNSD {#module-services-lxmd-communication-with-rnsd}
+
+Even though both services are hardened (via Systemd's `DynamicUser = true` and
+`StateDirectory = "lxmd"` directives), `lxmd` can still communicate with `rnsd`
+in several ways.
+
+### Option 1: Shared Instance Over Unix RPC {#module-services-lxmd-communication-rpc}
+
+Use a shared Reticulum instance exposed through a local Unix RPC socket:
+
+```nix
+{
+  services.rnsd = {
+    enable = true;
+
+    identityFile = "<path-to-rnsd-identity-file>";
+
+    settings = {
+      reticulum = {
+        enable_transport = true;
+        share_instance = true;
+        instance_name = "default";
+        shared_instance_type = "unix";
+      };
+      interfaces = {
+        auto = {
+          type = "AutoInterface";
+          enabled = true;
+        };
+      };
+    };
+  };
+
+  services.lxmd = {
+    enable = true;
+
+    identityFile = "<path-to-lxmd-identity-file>";
+
+    settings = {
+      # LXMD settings, run `lxmd --exampleconfig` for details
+    };
+
+    rnsd = {
+      identityFile = "<path-to-rnsd-identity-file>";
+
+      settings = {
+        reticulum = {
+          require_shared_instance = true;
+          is_shared_instance = true;
+          enable_transport = true;
+          instance_name = "default";
+          shared_instance_type = "unix";
+        };
+      };
+    };
+  };
+}
+```
+
+In this model, `lxmd` points to an RNS configuration that joins the shared
+instance. Both RNS transport identity files in `rnsd` and `lxmd` must be the
+same. If you use different transport identity files, then set the same `rpc_key`
+in both `rnsd` configurations to allow them to communicate securely.
+
+It is also possible to use a shared instance over TCP, please refer to the
+[Reticulum documentation](https://reticulum.network/manual/) for details.
+
+### Option 2: Isolated Instances Connected Through BackboneInterface {#module-services-lxmd-communication-backbone}
+
+Reticulum applications (`rnsd`, `lxmd`, and others) can be isolated by running:
+
+- one primary `rnsd` service instance as a non-privileged service account,
+- one instance per application, each with its own user and configuration,
+- a `BackboneInterface` between each isolated application instance and the
+  primary instance.
+
+On the primary `rnsd` instance, the `BackboneInterface` is configured to accept
+connections from the isolated instances, as such:
+
+```nix
+{
+  services.rnsd = {
+    enable = true;
+
+    identityFile = "<path-to-rnsd-identity-file>";
+
+    settings = {
+      reticulum = {
+        # RNSD settings, run `rnsd --exampleconfig` for details
+      };
+      interfaces = {
+        root = {
+          type = "BackboneInterface";
+          enabled = true;
+          mode = "gateway";
+          discoverable = true;
+          listen_ip = "127.0.0.1";
+          listen_port = 4242;
+        };
+      };
+    };
+  };
+}
+```
+
+Then, on each isolated application instance, the `BackboneInterface` is
+configured to connect to the primary instance:
+
+```nix
+{
+  services.lxmd = {
+    enable = true;
+
+    identityFile = "<path-to-lxmd-identity-file>";
+
+    settings = {
+      # LXMD settings, run `lxmd --exampleconfig` for details
+    };
+
+    rnsd = {
+      identityFile = "<path-to-rnsd-identity-file>";
+
+      settings = {
+        reticulum = {
+          # RNSD settings, run `rnsd --exampleconfig` for details
+        };
+        interfaces = {
+          local = {
+            type = "BackboneInterface";
+            enabled = true;
+            target_host = "127.0.0.1";
+            target_port = 4242;
+          };
+        };
+      };
+    };
+  };
+}
+```
+
+The primary `rnsd` instance serves system-local `BackboneInterface` links for
+applications and external interfaces for the wider network. Each isolated app
+uses its own RNS configuration directory (for example with
+`--rnsconfig <path>`), and that local instance connects to the root instance
+through `BackboneInterface`.
+
+Running multiple instances increases memory usage and adds one extra hop, but
+the performance impact is generally negligible.