26.05 Release notes (unreleased)¶

Breaking changes¶

This release removes the “IOC modules” system for packaging EPICS IOCs, which was deprecated in EPNix 25.05. If you still used this old way of packaging IOCs, follow the migration guide Migrating from modules development.
The services.phoebus-alarm-server and services.phoebus-alarm-logger NixOS modules were heavily hardened, because the Alarm Server might run arbitrary commands from the network, often without any authentication.

See the Phoebus alarm danger indication for a more in-depth explanation.
The PVWS part of the services.dbwr NixOS module was split into its own module services.pvws.

If you set any of the settings EPICS_CA_ADDR_LIST, EPICS_CA_AUTO_ADDR_LIST, PV_DEFAULT_TYPE, or PV_WRITE_SUPPORT from services.dbwr.settings, define them in services.pvws.settings instead.
epnix.phoebus-olog was upgraded to 6.0.0+, which changed the option for setting the authentication providers.

Replace the use of demo_auth.enabled, ad.enabled, ldap.enabled, and embedded_ldap.enabled with services.phoebus-olog.settings.authenticationProviders instead, and set it to "inMemory", "activeDirectory", "ldap", or "embeddedLdap".

Phoebus Olog now also requires bcrypt hashed password for the embedded LDAP authentication provider. See the Phoebus Olog guide.
The services.phoebus-olog NixOS module now configures the Phoebus Olog service to accept HTTP connections instead of HTTPS.

That’s because the upstream HTTPS configuration’s private key is publicly available in the Git repository, making it insecure.

If you want an HTTPS service, configure a reverse proxy that forwards connections to the Phoebus Olog service.
epnix.archiver-appliance was upgraded to 2.4.0+ which introduced Parquet support and now requires Tomcat 10. This Tomcat 10 requirement unfortunately makes it incompatible with the services.dbwr and services.pvws modules, which require Tomcat 9. Either split your configuration into 2 machines, or use declarative NixOS containers.

New features and highlights¶

New packages for building a “Phoebus ecosystem VM” that contains most Phoebus-related services. You can build an OVA file with epnix.phoebus-ecosystem.virtualbox-image or run a QEMU VM with epnix.phoebus-ecosystem.qemu-vm. See the new Phoebus ecosystem VM guide for more information.
epnix.channel-finder-service was upgraded to 5.0.0+ and epnix.support.reccaster / python3Packages.recceiver were upgraded to 1.9.2+. No user-visible breaking changes.
epnix.phoebus now bundles the Phoebus documentation, and follows a file structure closer to what’s distributed in official Phoebus packages.
services.pvws can now be configured independently of DBWR.
epnix.dbwr was upgraded to R1.
The services.phoebus-olog module gained an openFirewall option.

You can now pass a function as argument to the mkEpicsPackage function. This means that you can use the finalAttrs pattern, for example:

# ...
mkEpicsPackage (finalAttrs: {
  pname = "my-package";
  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "my-owner";
    repo = "my-repo";
    rev = finalAttrs.version;
    hash = "...";
  };

  # ...
})

EPNix now enables structured attributes by default on mkEpicsPackage packages.

Fixes¶

spring-boot based services (ChannelFinder, Phoebus Olog, Phoebus save-and-restore) now won’t start an Embedded LDAP server unless the Embedded LDAP is explicitly used. This solves a port conflict when installing those services on the same machine.

This fix was backported to the nixos-25.11 branch.

Documentation¶

The Using Python scripts article was rewritten and is now much simpler.
The Phoebus Alarm guide now has a section on how to add custom alarm scripts.
A new guide for configuring Phoebus Olog.
We now serve the EPNix documentation on ReadTheDocs, with the hope of migrating from GitHub pages in the future. ReadTheDocs has better link preview, better multi-version management, should have less issue with SEO, and is open source.
A new No LLM policy that forbids using LLM for contributing to EPNix.