- `services.frp.settings` now generates the frp configuration file in TOML format as [recommended by upstream](https://github.com/fatedier/frp#configuration-files), instead of the legacy INI format. This has also introduced other changes in the configuration file structure and options:
  - The `settings.common` section in the configuration is no longer valid and all the options form inside it now go directly under `settings`.
  - Configuration option names have been changed from snake_case to camelCase. For example: `server_addr` becomes `serverAddr`, `server_port` becomes `serverPort` etc.
  - Proxies are now defined with a new option, `settings.proxies`, which takes a list of proxies.
  - Consult the [upstream documentation](https://github.com/fatedier/frp#example-usage) for more details on the changes.

- `services.hledger-web.capabilities` options has been replaced by a new option `services.hledger-web.allow`.

  - `allow = "view"` means `capabilities = { view = true; }`;
  - `allow = "add"` means `capabilities = { view = true; add = true; }`;
  - `allow = "edit"` means `capabilities = { view = true; add = true; edit = true }`;
  - `allow = "sandstorm"` reads permissions from the `X-Sandstorm-Permissions` request header.

- `services.homepage-dashboard` now takes its configuration using native Nix expressions, rather than dumping templated configurations into `/var/lib/homepage-dashboard` where they were previously managed manually. There are now new options which allow the configuration of bookmarks, services, widgets and custom CSS/JS natively in Nix.

- `services.invidious.settings.db.user`, the default database username has changed from `kemal` to `invidious`. Setups involving an externally-provisioned database (i.e. `services.invidious.database.createLocally == false`) should adjust their configuration accordingly. The old `kemal` user will not be removed automatically even when the database is provisioned automatically.(https://github.com/NixOS/nixpkgs/pull/265857).

- `services.oauth2_proxy` was renamed to `services.oauth2-proxy`. Also the corresponding service, user and group were renamed.

- `services.smokeping` now has an option `webService`. When enabled, smokeping is now served via nginx instead of thttpd. This change brings the following consequences:
  - The default port for smokeping is now the nginx default port 80 instead of 8081.
  - The option `services.smokeping.port` has been removed. To customize the port, use `services.nginx.virtualHosts.smokeping.listen.*.port`.

- `services.neo4j.allowUpgrade` was removed and no longer has any effect. Neo4j 5 supports automatic rolling upgrades.

- `services.nextcloud` has the following options moved into [`services.nextcloud.settings`](#opt-services.nextcloud.settings) and renamed to match the name from Nextcloud's `config.php`:
  - `logLevel` -> [`loglevel`](#opt-services.nextcloud.settings.loglevel),
  - `logType` -> [`log_type`](#opt-services.nextcloud.settings.log_type),
  - `defaultPhoneRegion` -> [`default_phone_region`](#opt-services.nextcloud.settings.default_phone_region),
  - `overwriteProtocol` -> [`overwriteprotocol`](#opt-services.nextcloud.settings.overwriteprotocol),
  - `skeletonDirectory` -> [`skeletondirectory`](#opt-services.nextcloud.settings.skeletondirectory),
  - `globalProfiles` -> [`profile.enabled`](#opt-services.nextcloud.settings._profile.enabled_),
  - `extraTrustedDomains` -> [`trusted_domains`](#opt-services.nextcloud.settings.trusted_domains) and
  - `trustedProxies` -> [`trusted_proxies`](#opt-services.nextcloud.settings.trusted_proxies).

- `services.nginx` will no longer advertise HTTP/3 availability automatically. This must now be manually added, preferably to each location block.
  Example:

  ```nix
  {
    locations."/".extraConfig = ''
      add_header Alt-Svc 'h3=":$server_port"; ma=86400';
    '';
    locations."^~ /assets/".extraConfig = ''
      add_header Alt-Svc 'h3=":$server_port"; ma=86400';
    '';
  }
  ```

- `services.pgbouncer` now has systemd support enabled and will log to journald. The default setting for `services.pgbouncer.logFile` is now `null` to disable logging to a separate log file.