26.05 Release notes (unreleased)

Breaking changes

  • This release removes the “IOC modules” system for packaging EPICS IOCs, which was deprecated in EPNix 25.05. If you still used this old way of packaging IOCs, follow the migration guide Migrating from modules development.

  • The services.phoebus-alarm-server and services.phoebus-alarm-logger NixOS modules were heavily hardened, because the Alarm Server might run arbitrary commands from the network, often without any authentication.

    See the Phoebus alarm danger indication for a more in-depth explanation.

  • The PVWS part of the services.dbwr NixOS module was split into its own module services.pvws.

    If you set any of the settings EPICS_CA_ADDR_LIST, EPICS_CA_AUTO_ADDR_LIST, PV_DEFAULT_TYPE, or PV_WRITE_SUPPORT from services.dbwr.settings, define them in services.pvws.settings instead.

  • epnix.phoebus-olog was upgraded to 6.0.0+, which changed the option for setting the authentication providers.

    Replace the use of demo_auth.enabled, ad.enabled, ldap.enabled, and embedded_ldap.enabled with services.phoebus-olog.settings.authenticationProviders instead, and set it to "inMemory", "activeDirectory", "ldap", or "embeddedLdap".

    Phoebus Olog now also requires bcrypt hashed password for the embedded LDAP authentication provider. See the Phoebus Olog guide.

  • The services.phoebus-olog NixOS module now configures the Phoebus Olog service to accept HTTP connections instead of HTTPS.

    That’s because the upstream HTTPS configuration’s private key is publicly available in the Git repository, making it insecure.

    If you want an HTTPS service, configure a reverse proxy that forwards connections to the Phoebus Olog service.

New features and highlights

  • epnix.channel-finder-service was upgraded to 5.0.0+ and epnix.support.reccaster / python3Packages.recceiver were upgraded to 1.9.2+. No user-visible breaking changes.

  • epnix.phoebus now bundles the Phoebus documentation, and follows a file structure closer to what’s distributed in official Phoebus packages.

  • services.pvws can now be configured independently of DBWR.

  • epnix.dbwr was upgraded to R1.

  • The services.phoebus-olog module gained an openFirewall option.

  • You can now pass a function as argument to the mkEpicsPackage function. This means that you can use the finalAttrs pattern, for example:

    # ...
mkEpicsPackage (finalAttrs: {
  pname = "my-package";
  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "my-owner";
    repo = "my-repo";
    rev = finalAttrs.version;
    hash = "...";
  };

  # ...
})

Fixes

  • spring-boot based services (ChannelFinder, Phoebus Olog, Phoebus save-and-restore) now won’t start an Embedded LDAP server unless the Embedded LDAP is explicitly used. This solves a port conflict when installing those services on the same machine.

    This fix was backported to the nixos-25.11 branch.

Documentation