Release 2026_041 (2026-10-12)

Impact

26.05

  • pkgs.openssl_3, pointing to the 3.0.x branch, is now marked as insecure. We recommend updating to openssl_3_5 (LTS), which is API/ABI-compatible.

  • Machines will reboot to activate a changed kernel.

NixOS 26.05 platform

  • Introduce basic CrowdSec role for NGINX log analysis and WAF. (PL-135572)

  • fc-luks keystore rekey can now rekey multiple volumes concurrently, defaulting to half the available CPUs and tunable via -j/--parallel, with a progress bar and per-volume failure reporting. Each job runs memory-intensive key derivation (~1 GiB). (PL-135511)

  • ceph: Provide per-cluster “fcio” orchestration pool (PL-134255)

  • The LUKS keystore volume now fits on a small key stick: it is formatted as ext4 and takes the whole volume group instead of a fixed 1g, and the stick is mounted by its keys label whichever filesystem it carries. (PL-135638)

  • A major rewrite of our AI inference tooling. (PL-134151)

    With the experience we made over almost 9 months we have moved away from AMD and our infrastructure now runs on Nvidia RTX PRO 6000 cards.

    We completely removed AMD (rocm/vulkan) support for now as it introduced major stability issues and we want to drive complexity down and reliability up.

    Also, ollama was a great way to start this journey but hasn’t proven a good solution for a service offering. We thus replaced it with vllm and are now coordinating model placement over GPU clusters with our own tooling and can integrate different inference engines for testing and higher flexibility in production environments.

  • fc-luks volume unlock <pattern> unlocks matching LUKS volumes with the admin key, asking for the passphrase only once. This keeps a machine available when the local key stick fails and cannot be replaced immediately. (PL-135320)

  • Pull upstream NixOS changes, security fixes, and package updates:

    • apacheHttpd: 2.4.68 -> 2.4.69

    • chromedriver: 154.0.8037.57 -> 154.0.8037.97

    • chromium: 154.0.8037.57 -> 154.0.8037.97

    • discourse: 2026.8.0 -> 2026.9.0

    • docker: 29.8.0 -> 29.8.1

    • element-web: 1.12.28 -> 1.12.29

    • firefox: 156.0.1 -> 157.0

    • keycloak: 26.7.4 -> 26.7.5

    • linuxKernelStable: 6.12.111 -> 6.12.112

    • linuxKernelVerify: 6.18.54 -> 6.18.55

    • mastodon: 4.6.8 -> 4.6.9

    • matrix-synapse: 1.161.0 -> 1.162.0

    • nss_latest: 3.128 -> 3.130

    • openssl_3: (new version missing)

Detailed Changes