nixos/doc: bump Pandoc

Update the pinned channel in `md-to-db`, which bumps the Pandoc version,
which fixes https://github.com/NixOS/nixpkgs/issues/125511 maybe.

nixos/doc/manual/from_md/administration/cleaning-store.chapter.xml

···
     this unit automatically at certain points in time, for instance,
     every night at 03:15:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 nix.gc.automatic = true;
 nix.gc.dates = &quot;03:15&quot;;
 </programlisting>

nixos/doc/manual/from_md/administration/container-networking.section.xml

···
     address. This can be accomplished using the following configuration
     on the host:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.nat.enable = true;
 networking.nat.internalInterfaces = [&quot;ve-+&quot;];
 networking.nat.externalInterface = &quot;eth0&quot;;
···
     If you are using Network Manager, you need to explicitly prevent it
     from managing container interfaces:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.networkmanager.unmanaged = [ &quot;interface-name:ve-*&quot; ];
 </programlisting>
   <para>

nixos/doc/manual/from_md/administration/control-groups.chapter.xml

···
     process would get 1/1001 of the cgroup’s CPU time.) You can limit a
     service’s CPU share in <literal>configuration.nix</literal>:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 systemd.services.httpd.serviceConfig.CPUShares = 512;
 </programlisting>
   <para>
···
     <literal>configuration.nix</literal>; for instance, to limit
     <literal>httpd.service</literal> to 512 MiB of RAM (excluding swap):
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 systemd.services.httpd.serviceConfig.MemoryLimit = &quot;512M&quot;;
 </programlisting>
   <para>

nixos/doc/manual/from_md/administration/declarative-containers.section.xml

···
     following specifies that there shall be a container named
     <literal>database</literal> running PostgreSQL:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 containers.database =
   { config =
       { config, pkgs, ... }:
···
     However, they cannot change the network configuration. You can give
     a container its own network as follows:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 containers.database = {
   privateNetwork = true;
   hostAddress = &quot;192.168.100.10&quot;;

nixos/doc/manual/from_md/administration/service-mgmt.chapter.xml

···
       In order to enable a systemd <emphasis>system</emphasis> service
       with provided upstream package, use (e.g):
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 systemd.packages = [ pkgs.packagekit ];
 </programlisting>
     <para>

nixos/doc/manual/from_md/configuration/abstractions.section.xml

···
     If you find yourself repeating yourself over and over, it’s time to
     abstract. Take, for instance, this Apache HTTP Server configuration:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 {
   services.httpd.virtualHosts =
     { &quot;blog.example.org&quot; = {
···
     the only difference is the document root directories. To prevent
     this duplication, we can use a <literal>let</literal>:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 let
   commonConfig =
     { adminAddr = &quot;[e-mail]&quot;;
···
     You can write a <literal>let</literal> wherever an expression is
     allowed. Thus, you also could have written:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 {
   services.httpd.virtualHosts =
     let commonConfig = ...; in
···
     of different virtual hosts, all with identical configuration except
     for the document root. This can be done as follows:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 {
   services.httpd.virtualHosts =
     let

nixos/doc/manual/from_md/configuration/ad-hoc-network-config.section.xml

···
     network configuration not covered by the existing NixOS modules. For
     instance, to statically configure an IPv6 address:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.localCommands =
   ''
     ip -6 addr add 2001:610:685:1::1/64 dev eth0

nixos/doc/manual/from_md/configuration/adding-custom-packages.section.xml

···
       manual. Finally, you add it to
       <xref linkend="opt-environment.systemPackages" />, e.g.
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 environment.systemPackages = [ pkgs.my-package ];
 </programlisting>
     <para>
···
       Hello</link> package directly in
       <literal>configuration.nix</literal>:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 environment.systemPackages =
   let
     my-hello = with pkgs; stdenv.mkDerivation rec {
···
       Of course, you can also move the definition of
       <literal>my-hello</literal> into a separate Nix expression, e.g.
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 environment.systemPackages = [ (import ./my-hello.nix) ];
 </programlisting>
     <para>
       where <literal>my-hello.nix</literal> contains:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 with import &lt;nixpkgs&gt; {}; # bring all of Nixpkgs into scope
 
 stdenv.mkDerivation rec {
···
       need to install <literal>appimage-run</literal>: add to
       <literal>/etc/nixos/configuration.nix</literal>
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 environment.systemPackages = [ pkgs.appimage-run ];
 </programlisting>
     <para>

nixos/doc/manual/from_md/configuration/config-file.section.xml

···
   <para>
     The NixOS configuration file generally looks like this:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, pkgs, ... }:
 
 { option definitions
···
     the name of an option and <literal>value</literal> is its value. For
     example,
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, pkgs, ... }:
 
 { services.httpd.enable = true;
···
     <literal>true</literal>. This means that the example above can also
     be written as:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, pkgs, ... }:
 
 { services = {
···
         <para>
           Strings are enclosed in double quotes, e.g.
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 networking.hostName = &quot;dexter&quot;;
 </programlisting>
         <para>
···
           Multi-line strings can be enclosed in <emphasis>double single
           quotes</emphasis>, e.g.
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 networking.extraHosts =
   ''
     127.0.0.2 other-localhost
···
           These can be <literal>true</literal> or
           <literal>false</literal>, e.g.
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 networking.firewall.enable = true;
 networking.firewall.allowPing = false;
 </programlisting>
···
         <para>
           For example,
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 boot.kernel.sysctl.&quot;net.ipv4.tcp_keepalive_time&quot; = 60;
 </programlisting>
         <para>
···
           Sets were introduced above. They are name/value pairs enclosed
           in braces, as in the option definition
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 fileSystems.&quot;/boot&quot; =
   { device = &quot;/dev/sda1&quot;;
     fsType = &quot;ext4&quot;;
···
           The important thing to note about lists is that list elements
           are separated by whitespace, like this:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 boot.kernelModules = [ &quot;fuse&quot; &quot;kvm-intel&quot; &quot;coretemp&quot; ];
 </programlisting>
         <para>
           List elements can be any other type, e.g. sets:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 swapDevices = [ { device = &quot;/dev/disk/by-label/swap&quot;; } ];
 </programlisting>
       </listitem>
···
           through the function argument <literal>pkgs</literal>. Typical
           uses:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 environment.systemPackages =
   [ pkgs.thunderbird
     pkgs.emacs

nixos/doc/manual/from_md/configuration/customizing-packages.section.xml

···
     a dependency on GTK 2. If you want to build it against GTK 3, you
     can specify that as follows:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 environment.systemPackages = [ (pkgs.emacs.override { gtk = pkgs.gtk3; }) ];
 </programlisting>
   <para>
···
     the package, such as the source code. For instance, if you want to
     override the source code of Emacs, you can say:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 environment.systemPackages = [
   (pkgs.emacs.overrideAttrs (oldAttrs: {
     name = &quot;emacs-25.0-pre&quot;;
···
     everything depend on your customised instance, you can apply a
     <emphasis>global</emphasis> override as follows:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 nixpkgs.config.packageOverrides = pkgs:
   { emacs = pkgs.emacs.override { gtk = pkgs.gtk3; };
   };

nixos/doc/manual/from_md/configuration/declarative-packages.section.xml

···
     adding the following line to <literal>configuration.nix</literal>
     enables the Mozilla Thunderbird email application:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 environment.systemPackages = [ pkgs.thunderbird ];
 </programlisting>
   <para>

nixos/doc/manual/from_md/configuration/file-systems.chapter.xml

···
     <literal>/dev/disk/by-label/data</literal> onto the mount point
     <literal>/data</literal>:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 fileSystems.&quot;/data&quot; =
   { device = &quot;/dev/disk/by-label/data&quot;;
     fsType = &quot;ext4&quot;;

nixos/doc/manual/from_md/configuration/firewall.section.xml

···
     both IPv4 and IPv6 traffic. It is enabled by default. It can be
     disabled as follows:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.firewall.enable = false;
 </programlisting>
   <para>
     If the firewall is enabled, you can open specific TCP ports to the
     outside world:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.firewall.allowedTCPPorts = [ 80 443 ];
 </programlisting>
   <para>
···
   <para>
     To open ranges of TCP ports:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.firewall.allowedTCPPortRanges = [
   { from = 4000; to = 4007; }
   { from = 8000; to = 8010; }

nixos/doc/manual/from_md/configuration/gpu-accel.chapter.xml

···
         <xref linkend="opt-hardware.opengl.extraPackages" /> enables
         OpenCL support:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 hardware.opengl.extraPackages = [
   rocm-opencl-icd
 ];
···
         enable OpenCL support. For example, for Gen8 and later GPUs, the
         following configuration can be used:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 hardware.opengl.extraPackages = [
   intel-compute-runtime
 ];
···
         makes amdvlk the default driver and hides radv and lavapipe from
         the device list. A specific driver can be forced as follows:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 hardware.opengl.extraPackages = [
   pkgs.amdvlk
 ];
···
         Modern Intel GPUs use the iHD driver, which can be installed
         with:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 hardware.opengl.extraPackages = [
   intel-media-driver
 ];
···
         Older Intel GPUs use the i965 driver, which can be installed
         with:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 hardware.opengl.extraPackages = [
   vaapiIntel
 ];

nixos/doc/manual/from_md/configuration/ipv4-config.section.xml

···
     interfaces. However, you can configure an interface manually as
     follows:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.interfaces.eth0.ipv4.addresses = [ {
   address = &quot;192.168.1.2&quot;;
   prefixLength = 24;
···
     Typically you’ll also want to set a default gateway and set of name
     servers:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.defaultGateway = &quot;192.168.1.1&quot;;
 networking.nameservers = [ &quot;8.8.8.8&quot; ];
 </programlisting>
···
     The host name is set using
     <xref linkend="opt-networking.hostName" />:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.hostName = &quot;cartman&quot;;
 </programlisting>
   <para>

nixos/doc/manual/from_md/configuration/ipv6-config.section.xml

···
     <xref linkend="opt-networking.interfaces._name_.tempAddress" />. You
     can disable IPv6 support globally by setting:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.enableIPv6 = false;
 </programlisting>
   <para>
     You can disable IPv6 on a single interface using a normal sysctl (in
     this example, we use interface <literal>eth0</literal>):
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 boot.kernel.sysctl.&quot;net.ipv6.conf.eth0.disable_ipv6&quot; = true;
 </programlisting>
   <para>
     As with IPv4 networking interfaces are automatically configured via
     DHCPv6. You can configure an interface manually:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.interfaces.eth0.ipv6.addresses = [ {
   address = &quot;fe00:aa:bb:cc::2&quot;;
   prefixLength = 64;
···
     For configuring a gateway, optionally with explicitly specified
     interface:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.defaultGateway6 = {
   address = &quot;fe00::1&quot;;
   interface = &quot;enp0s3&quot;;

nixos/doc/manual/from_md/configuration/kubernetes.chapter.xml

···
     way is to enable and configure cluster components appropriately by
     hand:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 services.kubernetes = {
   apiserver.enable = true;
   controllerManager.enable = true;
···
     <quote>node</quote>) to the host. This enables apiserver,
     controllerManager, scheduler, addonManager, kube-proxy and etcd:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 services.kubernetes.roles = [ &quot;master&quot; ];
 </programlisting>
   <para>
     While this will enable the kubelet and kube-proxy only:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 services.kubernetes.roles = [ &quot;node&quot; ];
 </programlisting>
   <para>
     Assigning both the master and node roles is usable if you want a
     single node Kubernetes cluster for dev or testing purposes:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 services.kubernetes.roles = [ &quot;master&quot; &quot;node&quot; ];
 </programlisting>
   <para>

nixos/doc/manual/from_md/configuration/linux-kernel.chapter.xml

···
     option <literal>boot.kernelPackages</literal>. For instance, this
     selects the Linux 3.10 kernel:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 boot.kernelPackages = pkgs.linuxKernel.packages.linux_3_10;
 </programlisting>
   <para>
···
     <xref linkend="sec-customising-packages" />). For instance, to
     enable support for the kernel debugger KGDB:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 nixpkgs.config.packageOverrides = pkgs: pkgs.lib.recursiveUpdate pkgs {
   linuxKernel.kernels.linux_5_10 = pkgs.linuxKernel.kernels.linux_5_10.override {
     extraConfig = ''
···
     automatically by <literal>udev</literal>. You can force a module to
     be loaded via <xref linkend="opt-boot.kernelModules" />, e.g.
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 boot.kernelModules = [ &quot;fuse&quot; &quot;kvm-intel&quot; &quot;coretemp&quot; ];
 </programlisting>
   <para>
···
     root file system), you can use
     <xref linkend="opt-boot.initrd.kernelModules" />:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 boot.initrd.kernelModules = [ &quot;cifs&quot; ];
 </programlisting>
   <para>
···
     Kernel runtime parameters can be set through
     <xref linkend="opt-boot.kernel.sysctl" />, e.g.
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 boot.kernel.sysctl.&quot;net.ipv4.tcp_keepalive_time&quot; = 120;
 </programlisting>
   <para>
···
       You can customize the default kernel configuration by overriding
       the arguments for your kernel package:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 pkgs.linux_latest.override {
   ignoreConfigErrors = true;
   autoModules = false;
···
     <para>
       To use your custom kernel package in your NixOS configuration, set
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 boot.kernelPackages = pkgs.linuxPackagesFor yourCustomKernel;
 </programlisting>
     <para>
···
       a kernel that uses it with
       <literal>pkgs.linuxManualConfig</literal>:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 let
   baseKernel = pkgs.linux_latest;
 in pkgs.linuxManualConfig {
···
       available kernel version <emphasis>that is supported by
       ZFS</emphasis> like this:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 {
   boot.kernelPackages = pkgs.zfs.latestCompatibleLinuxPackages;
 }

nixos/doc/manual/from_md/configuration/luks-file-systems.section.xml

···
     at boot time as <literal>/</literal>, add the following to
     <literal>configuration.nix</literal>:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 boot.initrd.luks.devices.crypted.device = &quot;/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d&quot;;
 fileSystems.&quot;/&quot;.device = &quot;/dev/mapper/crypted&quot;;
 </programlisting>
···
     located on an encrypted partition, it is necessary to add the
     following grub option:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 boot.loader.grub.enableCryptodisk = true;
 </programlisting>
   <section xml:id="sec-luks-file-systems-fido2">
···
       compatible key, add the following to
       <literal>configuration.nix</literal>:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 boot.initrd.luks.fido2Support = true;
 boot.initrd.luks.devices.&quot;/dev/sda2&quot;.fido2.credential = &quot;f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7&quot;;
 </programlisting>
···
       protected, such as
       <link xlink:href="https://trezor.io/">Trezor</link>.
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 boot.initrd.luks.devices.&quot;/dev/sda2&quot;.fido2.passwordLess = true;
 </programlisting>
   </section>

nixos/doc/manual/from_md/configuration/modularity.section.xml

···
     other modules by including them from
     <literal>configuration.nix</literal>, e.g.:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, pkgs, ... }:
 
 { imports = [ ./vpn.nix ./kde.nix ];
···
     <literal>vpn.nix</literal> and <literal>kde.nix</literal>. The
     latter might look like this:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, pkgs, ... }:
 
 { services.xserver.enable = true;
···
     you want it to appear first, you can use
     <literal>mkBefore</literal>:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 boot.kernelModules = mkBefore [ &quot;kvm-intel&quot; ];
 </programlisting>
   <para>
···
     When that happens, it’s possible to force one definition take
     precedence over the others:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 services.httpd.adminAddr = pkgs.lib.mkForce &quot;[e-mail]&quot;;
 </programlisting>
   <para>
···
     <xref linkend="opt-services.xserver.enable" /> is set to
     <literal>true</literal> somewhere else:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, pkgs, ... }:
 
 { environment.systemPackages =
···
     below would have the same effect as importing a file which sets
     those options.
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, pkgs, ... }:
 
 let netConfig = hostName: {

nixos/doc/manual/from_md/configuration/network-manager.section.xml

···
     To facilitate network configuration, some desktop environments use
     NetworkManager. You can enable NetworkManager by setting:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.networkmanager.enable = true;
 </programlisting>
   <para>
···
     All users that should have permission to change network settings
     must belong to the <literal>networkmanager</literal> group:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 users.users.alice.extraGroups = [ &quot;networkmanager&quot; ];
 </programlisting>
   <para>
···
       used together if desired. To do this you need to instruct
       NetworkManager to ignore those interfaces like:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 networking.networkmanager.unmanaged = [
    &quot;*&quot; &quot;except:type:wwan&quot; &quot;except:type:gsm&quot;
 ];

nixos/doc/manual/from_md/configuration/profiles.chapter.xml

···
     to say, expected usage is to add them to the imports list of your
     <literal>/etc/configuration.nix</literal> as such:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 imports = [
   &lt;nixpkgs/nixos/modules/profiles/profile-name.nix&gt;
 ];

nixos/doc/manual/from_md/configuration/renaming-interfaces.section.xml

···
       the interface with MAC address
       <literal>52:54:00:12:01:01</literal> using a netword link unit:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 systemd.network.links.&quot;10-wan&quot; = {
   matchConfig.PermanentMACAddress = &quot;52:54:00:12:01:01&quot;;
   linkConfig.Name = &quot;wan&quot;;
···
     <para>
       Alternatively, we can use a plain old udev rule:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.udev.initrdRules = ''
   SUBSYSTEM==&quot;net&quot;, ACTION==&quot;add&quot;, DRIVERS==&quot;?*&quot;, \
   ATTR{address}==&quot;52:54:00:12:01:01&quot;, KERNEL==&quot;eth*&quot;, NAME=&quot;wan&quot;

nixos/doc/manual/from_md/configuration/ssh.section.xml

···
   <para>
     Secure shell (SSH) access to your machine can be enabled by setting:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 services.openssh.enable = true;
 </programlisting>
   <para>
···
     You can declaratively specify authorised RSA/DSA public keys for a
     user as follows:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 users.users.alice.openssh.authorizedKeys.keys =
   [ &quot;ssh-dss AAAAB3NzaC1kc3MAAACBAPIkGWVEt4...&quot; ];
 </programlisting>

nixos/doc/manual/from_md/configuration/sshfs-file-systems.section.xml

···
       <link linkend="opt-fileSystems">fileSystems</link> option. Here’s
       a typical setup:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 {
   system.fsPackages = [ pkgs.sshfs ];
 
···
       well, for example you can change the default SSH port or specify a
       jump proxy:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 {
   options =
     [ &quot;ProxyJump=[e-mail]&quot;
···
       It’s also possible to change the <literal>ssh</literal> command
       used by SSHFS to connect to the server. For example:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 {
   options =
     [ (builtins.replaceStrings [&quot; &quot;] [&quot;\\040&quot;]

nixos/doc/manual/from_md/configuration/subversion.chapter.xml

···
       Apache HTTP, setting
       <xref linkend="opt-services.httpd.adminAddr" /> appropriately:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.httpd.enable = true;
 services.httpd.adminAddr = ...;
 networking.firewall.allowedTCPPorts = [ 80 443 ];
···
       <literal>.authz</literal> file describing access permission, and
       <literal>AuthUserFile</literal> to the password file.
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.httpd.extraModules = [
     # note that order is *super* important here
     { name = &quot;dav_svn&quot;; path = &quot;${pkgs.apacheHttpdPackages.subversion}/modules/mod_dav_svn.so&quot;; }
···
       <literal>ACCESS_FILE</literal> will look something like the
       following:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 [/]
 * = r
 

nixos/doc/manual/from_md/configuration/user-mgmt.chapter.xml

···
     states that a user account named <literal>alice</literal> shall
     exist:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 users.users.alice = {
   isNormalUser = true;
   home = &quot;/home/alice&quot;;
···
     A user ID (uid) is assigned automatically. You can also specify a
     uid manually by adding
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 uid = 1000;
 </programlisting>
   <para>
···
     Groups can be specified similarly. The following states that a group
     named <literal>students</literal> shall exist:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 users.groups.students.gid = 1000;
 </programlisting>
   <para>

nixos/doc/manual/from_md/configuration/wayland.chapter.xml

···
     Compositor such as sway without separately enabling a Wayland
     server:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 programs.sway.enable = true;
 </programlisting>
   <para>
···
     be able to share your screen, you might want to activate this
     option:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 xdg.portal.wlr.enable = true;
 </programlisting>
   <para>

nixos/doc/manual/from_md/configuration/wireless.section.xml

···
   <para>
     NixOS will start wpa_supplicant for you if you enable this setting:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.wireless.enable = true;
 </programlisting>
   <para>
     NixOS lets you specify networks for wpa_supplicant declaratively:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.wireless.networks = {
   echelon = {                # SSID with no spaces or special characters
     psk = &quot;abcdefgh&quot;;
···
         psk=dca6d6ed41f4ab5a984c9f55f6f66d4efdc720ebf66959810f4329bb391c5435
 }
 </programlisting>
-  <programlisting language="bash">
+  <programlisting language="nix">
 networking.wireless.networks = {
   echelon = {
     pskRaw = &quot;dca6d6ed41f4ab5a984c9f55f6f66d4efdc720ebf66959810f4329bb391c5435&quot;;

nixos/doc/manual/from_md/configuration/x-windows.chapter.xml

···
     The X Window System (X11) provides the basis of NixOS’ graphical
     user interface. It can be enabled as follows:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 services.xserver.enable = true;
 </programlisting>
   <para>
···
     and <literal>intel</literal>). You can also specify a driver
     manually, e.g.
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 services.xserver.videoDrivers = [ &quot;r128&quot; ];
 </programlisting>
   <para>
···
     <literal>xterm</literal> window. Thus you should pick one or more of
     the following lines:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 services.xserver.desktopManager.plasma5.enable = true;
 services.xserver.desktopManager.xfce.enable = true;
 services.xserver.desktopManager.gnome.enable = true;
···
     LightDM. You can select an alternative one by picking one of the
     following lines:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 services.xserver.displayManager.sddm.enable = true;
 services.xserver.displayManager.gdm.enable = true;
 </programlisting>
   <para>
     You can set the keyboard layout (and optionally the layout variant):
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 services.xserver.layout = &quot;de&quot;;
 services.xserver.xkbVariant = &quot;neo&quot;;
 </programlisting>
···
     The X server is started automatically at boot time. If you don’t
     want this to happen, you can set:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 services.xserver.autorun = false;
 </programlisting>
   <para>
···
     On 64-bit systems, if you want OpenGL for 32-bit programs such as in
     Wine, you should also set the following:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 hardware.opengl.driSupport32Bit = true;
 </programlisting>
   <section xml:id="sec-x11-auto-login">
···
       manager and desktop environment. If you wanted no desktop
       environment and i3 as your your window manager, you’d define:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.xserver.displayManager.defaultSession = &quot;none+i3&quot;;
 </programlisting>
     <para>
       Every display manager in NixOS supports auto-login, here is an
       example using lightdm for a user <literal>alice</literal>:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.xserver.displayManager.lightdm.enable = true;
 services.xserver.displayManager.autoLogin.enable = true;
 services.xserver.displayManager.autoLogin.user = &quot;alice&quot;;
···
       <xref linkend="opt-services.xserver.videoDrivers" /> to set one.
       The recommended configuration for modern systems is:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.xserver.videoDrivers = [ &quot;modesetting&quot; ];
 </programlisting>
     <para>
       If you experience screen tearing no matter what, this
       configuration was reported to resolve the issue:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.xserver.videoDrivers = [ &quot;intel&quot; ];
 services.xserver.deviceSection = ''
   Option &quot;DRI&quot; &quot;2&quot;
···
       enabled by default because it’s not free software. You can enable
       it as follows:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.xserver.videoDrivers = [ &quot;nvidia&quot; ];
 </programlisting>
     <para>
       Or if you have an older card, you may have to use one of the
       legacy drivers:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.xserver.videoDrivers = [ &quot;nvidiaLegacy390&quot; ];
 services.xserver.videoDrivers = [ &quot;nvidiaLegacy340&quot; ];
 services.xserver.videoDrivers = [ &quot;nvidiaLegacy304&quot; ];
···
       features or performance. If you still want to use it anyway, you
       need to explicitly set:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.xserver.videoDrivers = [ &quot;amdgpu-pro&quot; ];
 </programlisting>
     <para>
···
       Support for Synaptics touchpads (found in many laptops such as the
       Dell Latitude series) can be enabled as follows:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.xserver.libinput.enable = true;
 </programlisting>
     <para>
       The driver has many options (see <xref linkend="ch-options" />).
       For instance, the following disables tap-to-click behavior:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.xserver.libinput.touchpad.tapping = false;
 </programlisting>
     <para>
···
       applications look similar to GTK ones, you can use the following
       configuration:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 qt5.enable = true;
 qt5.platformTheme = &quot;gtk2&quot;;
 qt5.style = &quot;gtk2&quot;;
···
       <literal>symbols</literal>; it’s an XKB peculiarity that will help
       with testing):
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 xkb_symbols &quot;us-greek&quot;
 {
   include &quot;us(basic)&quot;            // includes the base US keys
···
     <para>
       A minimal layout specification must include the following:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.xserver.extraLayouts.us-greek = {
   description = &quot;US layout with alt-gr greek&quot;;
   languages   = [ &quot;eng&quot; ];
···
       interest, then create a <literal>media-key</literal> file to hold
       the keycodes definitions
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 xkb_keycodes &quot;media&quot;
 {
  &lt;volUp&gt;   = 123;
···
     <para>
       Now use the newly define keycodes in <literal>media-sym</literal>:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 xkb_symbols &quot;media&quot;
 {
  key.type = &quot;ONE_LEVEL&quot;;
···
     <para>
       As before, to install the layout do
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.xserver.extraLayouts.media = {
   description  = &quot;Multimedia keys remapping&quot;;
   languages    = [ &quot;eng&quot; ];
···
       default. As a workaround, you can set the keymap using
       <literal>setxkbmap</literal> at the start of the session with:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.xserver.displayManager.sessionCommands = &quot;setxkbmap -keycodes media&quot;;
 </programlisting>
     <para>

nixos/doc/manual/from_md/configuration/xfce.chapter.xml

···
   <para>
     To enable the Xfce Desktop Environment, set
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 services.xserver.desktopManager.xfce.enable = true;
 services.xserver.displayManager.defaultSession = &quot;xfce&quot;;
 </programlisting>
···
     Optionally, <emphasis>picom</emphasis> can be enabled for nice
     graphical effects, some example settings:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 services.picom = {
   enable = true;
   fade = true;

nixos/doc/manual/from_md/development/activation-script.section.xml

···
     these dependencies into account and order the snippets accordingly.
     As a simple example:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 system.activationScripts.my-activation-script = {
   deps = [ &quot;etc&quot; ];
   # supportsDryActivation = true;

nixos/doc/manual/from_md/development/assertions.section.xml

···
     <para>
       This is an example of using <literal>warnings</literal>.
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 { config, lib, ... }:
 {
   config = lib.mkIf config.services.foo.enable {
···
       assertion is useful to prevent such a broken system from being
       built.
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 { config, lib, ... }:
 {
   config = lib.mkIf config.services.syslogd.enable {

nixos/doc/manual/from_md/development/bootspec.chapter.xml

···
       <literal>/etc/os-release</literal> in order to bake it into a
       unified kernel image:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 { config, lib, ... }: {
   boot.bootspec.extensions = {
     &quot;org.secureboot.osRelease&quot; = config.environment.etc.&quot;os-release&quot;.source;

nixos/doc/manual/from_md/development/freeform-modules.section.xml

···
     type-checked <literal>settings</literal> attribute</link> for a more
     complete example.
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { lib, config, ... }: {
 
   options.settings = lib.mkOption {
···
   <para>
     And the following shows what such a module then allows
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 {
   # Not a declared option, but the freeform type allows this
   settings.logLevel = &quot;debug&quot;;
···
       Freeform attributes cannot depend on other attributes of the same
       set without infinite recursion:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 {
   # This throws infinite recursion encountered
   settings.logLevel = lib.mkIf (config.settings.port == 80) &quot;debug&quot;;

nixos/doc/manual/from_md/development/importing-modules.section.xml

···
     Sometimes NixOS modules need to be used in configuration but exist
     outside of Nixpkgs. These modules can be imported:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, lib, pkgs, ... }:
 
 {
···
     Nixpkgs NixOS modules. Like any NixOS module, this module can import
     additional modules:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 # ./module-list/default.nix
 [
   ./example-module1
   ./example-module2
 ]
 </programlisting>
-  <programlisting language="bash">
+  <programlisting language="nix">
 # ./extra-module/default.nix
 { imports = import ./module-list.nix; }
 </programlisting>
-  <programlisting language="bash">
+  <programlisting language="nix">
 # NIXOS_EXTRA_MODULE_PATH=/absolute/path/to/extra-module
 { config, lib, pkgs, ... }:
 

nixos/doc/manual/from_md/development/meta-attributes.section.xml

···
     Each of the meta-attributes must be defined at most once per module
     file.
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, lib, pkgs, ... }:
 {
   options = {

nixos/doc/manual/from_md/development/option-declarations.section.xml

···
     hasn’t been declared in any module. An option declaration generally
     looks like this:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 options = {
   name = mkOption {
     type = type specification;
···
         For example:
       </para>
       <anchor xml:id="ex-options-declarations-util-mkEnableOption-magic" />
-      <programlisting language="bash">
+      <programlisting language="nix">
 lib.mkEnableOption &quot;magic&quot;
 # is like
 lib.mkOption {
···
         <para>
           Usage:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 mkPackageOption pkgs &quot;name&quot; { default = [ &quot;path&quot; &quot;in&quot; &quot;pkgs&quot; ]; example = &quot;literal example&quot;; }
 </programlisting>
         <para>
···
           Examples:
         </para>
         <anchor xml:id="ex-options-declarations-util-mkPackageOption-hello" />
-        <programlisting language="bash">
+        <programlisting language="nix">
 lib.mkPackageOption pkgs &quot;hello&quot; { }
 # is like
 lib.mkOption {
···
 }
 </programlisting>
         <anchor xml:id="ex-options-declarations-util-mkPackageOption-ghc" />
-        <programlisting language="bash">
+        <programlisting language="nix">
 lib.mkPackageOption pkgs &quot;GHC&quot; {
   default = [ &quot;ghc&quot; ];
   example = &quot;pkgs.haskell.packages.ghc92.ghc.withPackages (hkgs: [ hkgs.primes ])&quot;;
···
             <emphasis role="strong">Example: Extensible type placeholder
             in the service module</emphasis>
           </para>
-          <programlisting language="bash">
+          <programlisting language="nix">
 services.xserver.displayManager.enable = mkOption {
   description = &quot;Display manager to use&quot;;
   type = with types; nullOr (enum [ ]);
···
             <literal>services.xserver.displayManager.enable</literal> in
             the <literal>gdm</literal> module</emphasis>
           </para>
-          <programlisting language="bash">
+          <programlisting language="nix">
 services.xserver.displayManager.enable = mkOption {
   type = with types; nullOr (enum [ &quot;gdm&quot; ]);
 };
···
             <literal>services.xserver.displayManager.enable</literal> in
             the <literal>sddm</literal> module</emphasis>
           </para>
-          <programlisting language="bash">
+          <programlisting language="nix">
 services.xserver.displayManager.enable = mkOption {
   type = with types; nullOr (enum [ &quot;sddm&quot; ]);
 };

nixos/doc/manual/from_md/development/option-def.section.xml

···
     Option definitions are generally straight-forward bindings of values
     to option names, like
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 config = {
   services.httpd.enable = true;
 };
···
       another option, you may need to use <literal>mkIf</literal>.
       Consider, for instance:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 config = if config.services.httpd.enable then {
   environment.systemPackages = [ ... ];
   ...
···
       value being constructed here. After all, you could also write the
       clearly circular and contradictory:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 config = if config.services.httpd.enable then {
   services.httpd.enable = false;
 } else {
···
     <para>
       The solution is to write:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 config = mkIf config.services.httpd.enable {
   environment.systemPackages = [ ... ];
   ...
···
       of the conditional to be <quote>pushed down</quote> into the
       individual definitions, as if you had written:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 config = {
   environment.systemPackages = if config.services.httpd.enable then [ ... ] else [];
   ...
···
       option defaults have priority 1500. You can specify an explicit
       priority by using <literal>mkOverride</literal>, e.g.
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 services.openssh.enable = mkOverride 10 false;
 </programlisting>
     <para>
···
       <literal>mkOrder 500</literal> and
       <literal>mkOrder 1500</literal>, respectively. As an example,
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 hardware.firmware = mkBefore [ myFirmware ];
 </programlisting>
     <para>
···
       to be merged together as if they were declared in separate
       modules. This can be done using <literal>mkMerge</literal>:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 config = mkMerge
   [ # Unconditional stuff.
     { environment.systemPackages = [ ... ];

nixos/doc/manual/from_md/development/option-types.section.xml

···
           <para>
             Two definitions of this type like
           </para>
-          <programlisting language="bash">
+          <programlisting language="nix">
 {
   str = lib.mkDefault &quot;foo&quot;;
   pkg.hello = pkgs.hello;
   fun.fun = x: x + 1;
 }
 </programlisting>
-          <programlisting language="bash">
+          <programlisting language="nix">
 {
   str = lib.mkIf true &quot;bar&quot;;
   pkg.gcc = pkgs.gcc;
···
           <para>
             will get merged to
           </para>
-          <programlisting language="bash">
+          <programlisting language="nix">
 {
   str = &quot;bar&quot;;
   pkg.gcc = pkgs.gcc;
···
       <emphasis role="strong">Example: Directly defined
       submodule</emphasis>
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 options.mod = mkOption {
   description = &quot;submodule example&quot;;
   type = with types; submodule {
···
       <emphasis role="strong">Example: Submodule defined as a
       reference</emphasis>
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 let
   modOptions = {
     options = {
···
       <emphasis role="strong">Example: Declaration of a list of
       submodules</emphasis>
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 options.mod = mkOption {
   description = &quot;submodule example&quot;;
   type = with types; listOf (submodule {
···
       <emphasis role="strong">Example: Definition of a list of
       submodules</emphasis>
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 config.mod = [
   { foo = 1; bar = &quot;one&quot;; }
   { foo = 2; bar = &quot;two&quot;; }
···
       <emphasis role="strong">Example: Declaration of attribute sets of
       submodules</emphasis>
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 options.mod = mkOption {
   description = &quot;submodule example&quot;;
   type = with types; attrsOf (submodule {
···
       <emphasis role="strong">Example: Definition of attribute sets of
       submodules</emphasis>
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 config.mod.one = { foo = 1; bar = &quot;one&quot;; };
 config.mod.two = { foo = 2; bar = &quot;two&quot;; };
 </programlisting>
···
             <emphasis role="strong">Example: Adding a type
             check</emphasis>
           </para>
-          <programlisting language="bash">
+          <programlisting language="nix">
 byte = mkOption {
   description = &quot;An integer between 0 and 255.&quot;;
   type = types.addCheck types.int (x: x &gt;= 0 &amp;&amp; x &lt;= 255);
···
             <emphasis role="strong">Example: Overriding a type
             check</emphasis>
           </para>
-          <programlisting language="bash">
+          <programlisting language="nix">
 nixThings = mkOption {
   description = &quot;words that start with 'nix'&quot;;
   type = types.str // {

nixos/doc/manual/from_md/development/replace-modules.section.xml

···
     only overrides the module definition, this won’t use postgresql from
     nixos-unstable unless explicitly configured to do so.
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, lib, pkgs, ... }:
 
 {
···
     for an existing module. Importing this module will disable the
     original module without having to know its implementation details.
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, lib, pkgs, ... }:
 
 with lib;

nixos/doc/manual/from_md/development/settings-options.section.xml

···
       used, along with some other related best practices. See the
       comments for explanations.
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 { options, config, lib, pkgs, ... }:
 let
   cfg = config.services.foo;
···
         <emphasis role="strong">Example: Declaring a type-checked
         <literal>settings</literal> attribute</emphasis>
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 settings = lib.mkOption {
   type = lib.types.submodule {
 

nixos/doc/manual/from_md/development/writing-modules.chapter.xml

···
     In <xref linkend="sec-configuration-syntax" />, we saw the following
     structure of NixOS modules:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, pkgs, ... }:
 
 { option definitions
···
     <emphasis role="strong">Example: Structure of NixOS
     Modules</emphasis>
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, pkgs, ... }:
 
 {
···
     <emphasis role="strong">Example: NixOS Module for the
     <quote>locate</quote> Service</emphasis>
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, lib, pkgs, ... }:
 
 with lib;
···
     <emphasis role="strong">Example: Escaping in Exec
     directives</emphasis>
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, lib, pkgs, utils, ... }:
 
 with lib;

nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml

···
   <para>
     A NixOS test is a module that has the following structure:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 {
 
   # One or more machines:
···
         Tests that are part of NixOS are added to
         <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/all-tests.nix"><literal>nixos/tests/all-tests.nix</literal></link>.
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
   hostname = runTest ./hostname.nix;
 </programlisting>
       <para>
         Overrides can be added by defining an anonymous module in
         <literal>all-tests.nix</literal>.
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
   hostname = runTest {
     imports = [ ./hostname.nix ];
     defaults.networking.firewall.enable = false;
···
         Outside the <literal>nixpkgs</literal> repository, you can
         instantiate the test by first importing the NixOS library,
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 let nixos-lib = import (nixpkgs + &quot;/nixos/lib&quot;) { };
 in
 
···
       For faster dev cycles it’s also possible to disable the
       code-linters (this shouldn’t be committed though):
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 {
   skipLint = true;
   nodes.machine =
···
       disable the Black linter directly (again, don’t commit this within
       the Nixpkgs repository):
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
   testScript =
     ''
       # fmt: off
···
       Similarly, the type checking of test scripts can be disabled in
       the following way:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 {
   skipTypeCheck = true;
   nodes.machine =
···
       <literal>polling_condition</literal> takes the following
       (optional) arguments:
     </para>
-    <para>
-      <literal>seconds_interval</literal>
-    </para>
-    <para>
-      : specifies how often the condition should be polled:
-    </para>
+    <variablelist>
+      <varlistentry>
+        <term>
+          <literal>seconds_interval</literal>
+        </term>
+        <listitem>
+          <para>
+            specifies how often the condition should be polled:
+          </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
     <programlisting language="python">
 @polling_condition(seconds_interval=10)
 def foo_running():
     machine.succeed(&quot;pgrep -x foo&quot;)
 </programlisting>
-    <para>
-      <literal>description</literal>
-    </para>
-    <para>
-      : is used in the log when the condition is checked. If this is not
-      provided, the description is pulled from the docstring of the
-      function. These two are therefore equivalent:
-    </para>
+    <variablelist>
+      <varlistentry>
+        <term>
+          <literal>description</literal>
+        </term>
+        <listitem>
+          <para>
+            is used in the log when the condition is checked. If this is
+            not provided, the description is pulled from the docstring
+            of the function. These two are therefore equivalent:
+          </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
     <programlisting language="python">
 @polling_condition
 def foo_running():
···
       <literal>extraPythonPackages</literal>. For example, you could add
       <literal>numpy</literal> like this:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 {
   extraPythonPackages = p: [ p.numpy ];
 

nixos/doc/manual/from_md/installation/building-nixos.chapter.xml

···
       can create the following file at
       <literal>modules/installer/cd-dvd/installation-cd-graphical-gnome-macbook.nix</literal>:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 { config, ... }:
 
 {

nixos/doc/manual/from_md/installation/changing-config.chapter.xml

···
     unless you have set <literal>mutableUsers = false</literal>. Another
     way is to temporarily add the following to your configuration:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 users.users.your-user.initialHashedPassword = &quot;test&quot;;
 </programlisting>
   <para>

nixos/doc/manual/from_md/installation/installing-behind-a-proxy.section.xml

···
         <literal>/mnt/etc/nixos/configuration.nix</literal> to keep the
         internet accessible after reboot.
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 networking.proxy.default = &quot;http://user:password@proxy:port/&quot;;
 networking.proxy.noProxy = &quot;127.0.0.1,localhost,internal.domain&quot;;
 </programlisting>

nixos/doc/manual/from_md/installation/installing-from-other-distro.section.xml

···
         Ubuntu, you may want to add something like this to your
         <literal>configuration.nix</literal>:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 boot.loader.grub.extraEntries = ''
   menuentry &quot;Ubuntu&quot; {
     search --set=ubuntu --fs-uuid 3cc3e652-0c1f-4800-8451-033754f68e6e
···
         account with <literal>sudo passwd -l root</literal> if you use
         <literal>sudo</literal>)
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 users.users.root.initialHashedPassword = &quot;&quot;;
 </programlisting>
     </listitem>

nixos/doc/manual/from_md/installation/installing-kexec.section.xml

···
     instead of the default installer image, you can build your own
     <literal>configuration.nix</literal>:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { modulesPath, ... }: {
   imports = [
     (modulesPath + &quot;/installer/netboot/netboot-minimal.nix&quot;)

nixos/doc/manual/from_md/installation/installing-virtualbox-guest.section.xml

···
     There are a few modifications you should make in configuration.nix.
     Enable booting:
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 boot.loader.grub.device = &quot;/dev/sda&quot;;
 </programlisting>
   <para>
     Also remove the fsck that runs at startup. It will always fail to
     run, stopping your boot until you press <literal>*</literal>.
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 boot.initrd.checkJournalingFS = false;
 </programlisting>
   <para>
···
     If you do not add <literal>&quot;nofail&quot;</literal>, the system
     will not boot properly.
   </para>
-  <programlisting language="bash">
+  <programlisting language="nix">
 { config, pkgs, ...} :
 {
   fileSystems.&quot;/virtualboxshare&quot; = {

nixos/doc/manual/from_md/installation/upgrading.chapter.xml

···
       You can keep a NixOS system up-to-date automatically by adding the
       following to <literal>configuration.nix</literal>:
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 system.autoUpgrade.enable = true;
 system.autoUpgrade.allowReboot = true;
 </programlisting>
···
       contains a different kernel, initrd or kernel modules. You can
       also specify a channel explicitly, e.g.
     </para>
-    <programlisting language="bash">
+    <programlisting language="nix">
 system.autoUpgrade.channel = https://nixos.org/channels/nixos-22.11;
 </programlisting>
   </section>

nixos/doc/manual/from_md/release-notes/rl-1404.section.xml

···
         the NixOS configuration. For instance, if a package
         <literal>foo</literal> provides systemd units, you can say:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 {
   systemd.packages = [ pkgs.foo ];
 }
···
         to enable those units. You can then set or override unit options
         in the usual way, e.g.
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 {
   systemd.services.foo.wantedBy = [ &quot;multi-user.target&quot; ];
   systemd.services.foo.serviceConfig.MemoryLimit = &quot;512M&quot;;
···
         NixOS configuration requires unfree packages from Nixpkgs, you
         need to enable support for them explicitly by setting:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 {
   nixpkgs.config.allowUnfree = true;
 }
···
         The Adobe Flash player is no longer enabled by default in the
         Firefox and Chromium wrappers. To enable it, you must set:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 {
   nixpkgs.config.allowUnfree = true;
   nixpkgs.config.firefox.enableAdobeFlash = true; # for Firefox
···
         The firewall is now enabled by default. If you don’t want this,
         you need to disable it explicitly:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 {
   networking.firewall.enable = false;
 }

nixos/doc/manual/from_md/release-notes/rl-1412.section.xml

···
         documentation</link> for details. If you wish to continue to use
         httpd 2.2, add the following line to your NixOS configuration:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 {
   services.httpd.package = pkgs.apacheHttpd_2_2;
 }

nixos/doc/manual/from_md/release-notes/rl-1509.section.xml

···
       </para>
     </listitem>
   </itemizedlist>
-  <programlisting language="bash">
+  <programlisting language="nix">
 {
   system.autoUpgrade.enable = true;
 }
···
       </para>
     </listitem>
   </itemizedlist>
-  <programlisting language="bash">
+  <programlisting language="nix">
 {
   system.stateVersion = &quot;14.12&quot;;
 }
···
       </para>
     </listitem>
   </itemizedlist>
-  <programlisting language="bash">
+  <programlisting language="nix">
 {
   fileSystems.&quot;/shiny&quot; = {
     device = &quot;myshinysharedfolder&quot;;
···
         <literal>lib</literal>, after adding it as argument of the
         module. The following module
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 { config, pkgs, ... }:
 
 with pkgs.lib;
···
       <para>
         should be modified to look like:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 { config, pkgs, lib, ... }:
 
 with lib;
···
         replaced by <literal>(import &lt;nixpkgs&gt; {})</literal>. The
         following module
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 { config, pkgs, ... }:
 
 let
···
       <para>
         should be modified to look like:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 { config, pkgs, ... }:
 
 let

nixos/doc/manual/from_md/release-notes/rl-1603.section.xml

···
         You will need to add an import statement to your NixOS
         configuration in order to use it, e.g.
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 {
   imports = [ &lt;nixpkgs/nixos/modules/services/misc/gitit.nix&gt; ];
 }
···
         to be built in. All modules now reside in
         <literal>nginxModules</literal> set. Example configuration:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 nginx.override {
   modules = [ nginxModules.rtmp nginxModules.dav nginxModules.moreheaders ];
 }
···
         continue to work, but print a warning, until the 16.09 release.
         An example of the new style:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 {
   fileSystems.&quot;/example&quot; = {
     device = &quot;/dev/sdc&quot;;
···
         used input method name, <literal>&quot;ibus&quot;</literal> for
         ibus. An example of the new style:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 {
   i18n.inputMethod.enabled = &quot;ibus&quot;;
   i18n.inputMethod.ibus.engines = with pkgs.ibus-engines; [ anthy mozc ];
···
       <para>
         That is equivalent to the old version:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 {
   programs.ibus.enable = true;
   programs.ibus.plugins = with pkgs; [ ibus-anthy mozc ];
···
         point to exact folder where syncthing is writing to. Example
         configuration should look something like:
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 {
   services.syncthing = {
       enable = true;

nixos/doc/manual/from_md/release-notes/rl-1609.section.xml

···
         interface has been streamlined. Desktop users should be able to
         simply set
       </para>
-      <programlisting language="bash">
+      <programlisting language="nix">
 {
   security.grsecurity.enable = true;
 }

nixos/doc/manual/from_md/release-notes/rl-1703.section.xml

···
           <literal>service.nylon</literal> is now declared using named
           instances. As an example:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.nylon = {
     enable = true;
···
         <para>
           should be replaced with:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.nylon.myvpn = {
     enable = true;
···
           <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">
           overlays</link>. For example, the following code:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 let
   pkgs = import &lt;nixpkgs&gt; {};
 in
···
         <para>
           should be replaced by:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 let
   pkgs = import &lt;nixpkgs&gt; {};
 in

nixos/doc/manual/from_md/release-notes/rl-1709.section.xml

···
           head. Apart from that, it’s now possible to also set
           additional options by using an attribute set, for example:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 { services.xserver.xrandrHeads = [
     &quot;HDMI-0&quot;
     {

nixos/doc/manual/from_md/release-notes/rl-1803.section.xml

···
         <para>
           In order to have the previous default configuration add
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.xserver.displayManager.lightdm.greeters.gtk.indicators = [
     &quot;~host&quot; &quot;~spacer&quot;

nixos/doc/manual/from_md/release-notes/rl-1809.section.xml

···
         <para>
           For example
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   programs.firejail = {
     enable = true;
···
           A NixOS system can now be constructed more easily based on a
           preexisting invocation of Nixpkgs. For example:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   inherit (pkgs.nixos {
     boot.loader.grub.enable = false;
···
           <para>
             An example usage of this would be:
           </para>
-          <programlisting language="bash">
+          <programlisting language="nix">
 { config, ... }:
 
 {

nixos/doc/manual/from_md/release-notes/rl-1903.section.xml

···
           setting the <literal>services.nscd.config</literal> option
           with the desired caching parameters.
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.nscd.config =
   ''

nixos/doc/manual/from_md/release-notes/rl-2003.section.xml

···
           option to improve support for upstream session files. If you
           used something like:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.xserver.desktopManager.default = &quot;xfce&quot;;
   services.xserver.windowManager.default = &quot;icewm&quot;;
···
         <para>
           you should change it to:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.xserver.displayManager.defaultSession = &quot;xfce+icewm&quot;;
 }
···
           is a <literal>loaOf</literal> option that is commonly used as
           follows:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   users.users =
     [ { name = &quot;me&quot;;
···
           value of <literal>name</literal> as the name of the attribute
           set:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   users.users.me =
     { description = &quot;My personal user.&quot;;
···
           because it permitted root auto-login you can override the
           lightdm-autologin pam module like:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   security.pam.services.lightdm-autologin.text = lib.mkForce ''
       auth     requisite pam_nologin.so
···
               Additionally, some Postfix configuration must now be set
               manually instead of automatically by the Mailman module:
             </para>
-            <programlisting language="bash">
+            <programlisting language="nix">
 {
   services.postfix.relayDomains = [ &quot;hash:/var/lib/mailman/data/postfix_domains&quot; ];
   services.postfix.config.transport_maps = [ &quot;hash:/var/lib/mailman/data/postfix_lmtp&quot; ];
···
           or by passing a TOML configuration file via
           <link xlink:href="options.html#opt-services.dnscrypt-proxy2.configFile">services.dnscrypt-proxy2.configFile</link>.
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   # Example configuration:
   services.dnscrypt-proxy2.enable = true;
···
               when upgrading. Otherwise, the package can be deployed
               using the following config:
             </para>
-            <programlisting language="bash">
+            <programlisting language="nix">
 { pkgs, ... }: {
   services.hydra.package = pkgs.hydra-migration;
 }
···
         <para>
           To continue to use the old approach, you can configure:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.nginx.appendConfig = let cfg = config.services.nginx; in ''user ${cfg.user} ${cfg.group};'';
   systemd.services.nginx.serviceConfig.User = lib.mkForce &quot;root&quot;;
···
               older, you simply need to enable postgresql-support
               explicitly:
             </para>
-            <programlisting language="bash">
+            <programlisting language="nix">
 { ... }: {
   services.matrix-synapse = {
     enable = true;

nixos/doc/manual/from_md/release-notes/rl-2009.section.xml

···
           traditional mysql_native_password plugin method, one must run
           the following:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
 services.mysql.initialScript = pkgs.writeText &quot;mariadb-init.sql&quot; ''
   ALTER USER root@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD(&quot;verysecret&quot;);
···
           allow MySQL to read from /home and /tmp directories when using
           <literal>LOAD DATA INFILE</literal>
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   systemd.services.mysql.serviceConfig.ProtectHome = lib.mkForce &quot;read-only&quot;;
 }
···
           <literal>SELECT * INTO OUTFILE</literal>, assuming the mysql
           user has write access to <literal>/var/data</literal>
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   systemd.services.mysql.serviceConfig.ReadWritePaths = [ &quot;/var/data&quot; ];
 }
···
           <literal>phantomJsSupport = true</literal> to the package
           instantiation:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.grafana.package = pkgs.grafana.overrideAttrs (oldAttrs: rec {
     phantomJsSupport = true;
···
           <literal>opcache</literal>, <literal>pdo</literal> and
           <literal>pdo_mysql</literal> loaded:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   environment.systemPackages = [
     (pkgs.php.withExtensions
···
           The remaining configuration flags can now be set directly on
           the <literal>php</literal> attribute. For example, instead of
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   php.override {
     config.php.embed = true;
···
         <para>
           you should now write
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   php.override {
     embedSupport = true;
···
           writing to other folders, use
           <literal>systemd.services.nginx.serviceConfig.ReadWritePaths</literal>
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   systemd.services.nginx.serviceConfig.ReadWritePaths = [ &quot;/var/www&quot; ];
 }
···
           docs</link> for details). If you require serving files from
           home directories, you may choose to set e.g.
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   systemd.services.nginx.serviceConfig.ProtectHome = &quot;read-only&quot;;
 }
···
         <para>
           Replace a <literal>nesting.clone</literal> entry with:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   specialisation.example-sub-configuration = {
     configuration = {
···
         <para>
           Replace a <literal>nesting.children</literal> entry with:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   specialisation.example-sub-configuration = {
     inheritParentConfig = false;
···
           multi-instance config with an existing bitcoind data directory
           and user, you have to adjust the original config, e.g.:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.bitcoind = {
     enable = true;
···
         <para>
           To something similar:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.bitcoind.mainnet = {
     enable = true;
···
           the original SSL settings, you have to adjust the original
           config, e.g.:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.dokuwiki = {
     enable = true;
···
         <para>
           To something similar:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.dokuwiki.&quot;mywiki&quot; = {
     enable = true;
···
           option is (<literal>/var/db/postgresql</literal>) and then
           explicitly set this value to maintain compatibility:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.postgresql.dataDir = &quot;/var/db/postgresql&quot;;
 }
···
           you must include those directories into the
           <literal>BindPaths</literal> of the service:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   systemd.services.transmission.serviceConfig.BindPaths = [ &quot;/path/to/alternative/download-dir&quot; ];
 }
···
           <literal>transmission-daemon</literal> is now only available
           on the local network interface by default. Use:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.transmission.settings.rpc-bind-address = &quot;0.0.0.0&quot;;
 }
···
         <para>
           This means that a configuration like this
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.dovecot2.mailboxes = [
     { name = &quot;Junk&quot;;
···
         <para>
           should now look like this:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.dovecot2.mailboxes = {
     Junk.auto = &quot;create&quot;;

nixos/doc/manual/from_md/release-notes/rl-2105.section.xml

···
           <literal>mediatomb</literal> package. If you want to keep the
           old behavior, you must declare it with:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.mediatomb.package = pkgs.mediatomb;
 }
···
           service declaration to add the firewall rules itself before,
           you should now declare it with:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.mediatomb.openFirewall = true;
 }
···
           <link xlink:href="options.html#opt-services.uwsgi.capabilities">services.uwsgi.capabilities</link>.
           The previous behaviour can be restored by setting:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.uwsgi.user = &quot;root&quot;;
   services.uwsgi.group = &quot;root&quot;;
···
           has been removed. To enable Privoxy, and to configure it to
           use Tor’s faster port, use the following configuration:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   opt-services.privoxy.enable = true;
   opt-services.privoxy.enableTor = true;
···
           <literal>mpich</literal> instead of the default
           <literal>openmpi</literal> can now be achived like this:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 self: super:
 {
   mpi = super.mpich;
···
           kodiPackages.inputstream-adaptive and kodiPackages.vfs-sftp
           addons:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   environment.systemPackages = [
     pkgs.kodi
···
           and as a result the above configuration should now be written
           as:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   environment.systemPackages = [
     (pkgs.kodi.withPackages (p: with p; [
···
           users to declare autoscan media directories from their nixos
           configuration:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.mediatomb.mediaDirectories = [
     { path = &quot;/var/lib/mediatomb/pictures&quot;; recursive = false; hidden-files = false; }
···
           been dropped. Users that still want it should add the
           following to their system configuration:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.gvfs.package = pkgs.gvfs.override { samba = null; };
 }

nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

···
             </para>
           </listitem>
         </itemizedlist>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.paperless-ng.extraConfig = {
     # Provide languages as ISO 639-2 codes
···
           insecure. Out-of-tree modules are likely to require
           adaptation: instead of
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   users.users.foo = {
     isSystemUser = true;
···
         <para>
           also create a group for your user:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   users.users.foo = {
     isSystemUser = true;

nixos/doc/manual/from_md/release-notes/rl-2205.section.xml

···
           <literal>programs.msmtp.*</literal> can be used instead for an
           equivalent setup. For example:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   # Original ssmtp configuration:
   services.ssmtp = {
···
           <literal>config.nixpkgs.config.allowUnfree</literal> are
           enabled. If you still want these fonts, use:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   fonts.fonts = [
     pkgs.xorg.fontbhlucidatypewriter100dpi
···
         <para>
           Before:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.matrix-synapse = {
     enable = true;
···
         <para>
           After:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
 {
   services.matrix-synapse = {
     enable = true;
···
         <para>
           Before:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
   services.keycloak = {
     enable = true;
     httpPort = &quot;8080&quot;;
···
         <para>
           After:
         </para>
-        <programlisting language="bash">
+        <programlisting language="nix">
   services.keycloak = {
     enable = true;
     settings = {

nixos/doc/manual/from_md/release-notes/rl-2211.section.xml

···
               removed. This option was an association of environment
               variables for Grafana. If you had an expression like
             </para>
-            <programlisting language="bash">
+            <programlisting language="nix">
 {
   services.grafana.extraOptions.SECURITY_ADMIN_USER = &quot;foobar&quot;;
 }
···
               For the migration, it is recommended to turn it into the
               INI format, i.e. to declare
             </para>
-            <programlisting language="bash">
+            <programlisting language="nix">
 {
   services.grafana.settings.security.admin_user = &quot;foobar&quot;;
 }

nixos/doc/manual/md-to-db.sh

···
 #! /usr/bin/env nix-shell
-#! nix-shell -I nixpkgs=https://github.com/NixOS/nixpkgs/tarball/21.11 -i bash -p pandoc
+#! nix-shell -I nixpkgs=https://github.com/NixOS/nixpkgs/tarball/22.11 -i bash -p pandoc
 
 # This script is temporarily needed while we transition the manual to
 # CommonMark. It converts the .md files in the regular manual folder