A list of names of users that have additional rights when connecting to the Nix daemon, such as the ability to specify additional binary caches, or to import unsigned NARs

A list of names of users that have additional rights when connecting to the Nix daemon, such as the ability to specify additional binary caches, or to import unsigned NARs

Whether to add nix-ssh to the nix.settings.trusted-users

A list of names of users (separated by whitespace) that are allowed to connect to the Nix daemon

A list of names of users (separated by whitespace) that are allowed to connect to the Nix daemon

The username to log in as on the remote host

The username to log in as on the remote host

The username to log in as on the remote host

Configuration for users.

Additional user accounts to be created automatically by the system

Message of the day shown to users when they log in.

The user's UID.

The user's primary group.

The user's home directory.

The account UID

A file containing the message of the day shown to users when they log in.

The user's primary group.

The name of the user account

The name of the user account

List of public keys used to sign binary caches

List of public keys used to sign binary caches

Configuration for groups.

List of users owned and managed by nix-darwin

Whether to make the user account hidden.

Additional groups to be created automatically by the system.

The user's home directory

Users that can access upsd

Create the home directory when creating the user.

Alias of users.users.

If set to false, the user account will not be created

The path to the user's shell

The user's auxiliary groups.

The user's home directory mode in numeric format

Attributes for user's entry in pam_mount.conf.xml

Path to encrypted luks device that contains the user's home directory.

Settings for pam_mysql

Whether to create the home directory and ensure ownership as well as permissions to match the user.

The distinguished name of the search base.

The set of packages that should be made available to the user

The set of packages that should be made availabe to the user

Alias of users.groups.

Subordinate group ids that user is allowed to use

Subordinate user ids that user is allowed to use

Indicates if the user is a system user or not

Count of subordinate user ids

Count of subordinate group ids

The default home directory for normal users.

Automatically allocate subordinate user and group ids for this user

The user's shell

The username to use when connecting to the database

The hostname of the MySQL/MariaDB server

If true, the user's shell will be set to users.defaultUserShell.

Indicates whether this is an account for a “real” user

List of groups owned and managed by nix-darwin

Start of the range of subordinate user ids that user is allowed to use.

Start of the range of subordinate group ids that user is allowed to use.

If enabled (the default), Nix will only download binaries from binary caches if they are cryptographically signed with any of the keys listed in nix.settings.trusted-public-keys

If enabled (the default), Nix will only download binaries from binary caches if they are cryptographically signed with any of the keys listed in nix.settings.trusted-public-keys

The URL of the LDAP server.

Whether to include authentication against LDAP in login PAM.

Set the date on which the user's account will no longer be accessible

Settings for libnss-mysql

Whether to enable authentication against an LDAP server.

The group's GID.

Additional criteria for the query.

Whether to enable or disable lingering for this user

If enabled, use TLS (encryption) over an LDAP (port 389) connection

The name of table that maps unique login names to the passwords.

The name of the database containing the users

Whether to enable authentication against a MySQL/MariaDB database.

Whether to manage whether users linger or not.

The group GID

Users to include in initrd.

The user's home directory.

The name of the group

The group's name

Specifies the time limit (in seconds) to use when performing searches

The account UID

The user's primary group.

A short description of the user account, typically the user's full name

By default, nixos will check that programs

The name of the column that contains a unix login name.

To enable stylus and multi-touch support, the user you're going to use must be added to this list

By default, nix-darwin will check that programs

The name of the user account

Whether to include lookup against LDAP in NSS.

The group GID

Specifies the time limit (in seconds) to use when connecting to the directory server

Add the necessary actions for a upsmon process to work

The name of the group

This option defines the default shell assigned to user accounts

If enabled, produces logs with detailed messages that describes what pam_mysql is doing

The group's members.

Indicates if the user is a system user or not

Users that intend to use BenchExec

Whether to require that no two users/groups share the same uid/gid.

SQL query for the getpwnam syscall.

SQL query for the getgrgid syscall.

SQL query for the getgrnam syscall.

SQL query for the getspnam syscall.

SQL query for the getspent syscall.

SQL query for the getgrent syscall.

SQL query for the getpwuid syscall.

SQL query for the getpwent syscall.

A short description of the user account, typically the user's full name

NNTP-Proxy user configuration

The set of packages that should be made available to the user

The name of the table used for password alteration

The name of the table to which logs are written.

Maximum number of concurrent clients allowed.

The path to the file containing the password for the user

Allow the user to do certain things with upsd

The default encryption method to use for passwordCrypt = 1.

User accounts for GRUB

The user names of the group members, added to the /etc/group file.

Disable checking that at least the root user or a user in the wheel group can log in using a password or an SSH key

If set to false, the user account will not be created

Extra configuration options that will be added verbatim at the end of the ldap configuration file (ldap.conf(5))

The user's auxiliary groups.

The path to the user's shell

If set to true, you are free to add new users and groups to the system with the ordinary useradd and groupadd commands

The user's home directory mode in numeric format

Attributes for user's entry in pam_mount.conf.xml

Path to encrypted luks device that contains the user's home directory.

ID of the user in initrd.

Whether to create the home directory and ensure ownership as well as permissions to match the user.

Enables logging of authentication attempts in the MySQL database.

The path to a file containing the credentials to use when binding to the LDAP server (if not binding anonymously).

SQL query for the memsbygid syscall.

SQL query for the gidsbymem syscall.

Specifies the clear text password for the account

Indicates whether this is an account for a “real” user

Load users and passwords from this file

Extra configuration options that will be added verbatim at the end of the nslcd configuration file (nslcd.conf(5)).

List of UIDs of all users for which this application is allowed location info access, Defaults to an empty string to allow it for all users.

The usernames / UIDs this rule should apply for.

The usernames / UIDs this rule should apply for.

Subordinate user ids that user is allowed to use

Subordinate group ids that user is allowed to use

A list of files each containing one OpenSSH public key that should be added to the user's authorized keys

A list of files each containing one OpenSSH public key that should be added to the user's authorized keys

A list of verbatim OpenSSH public keys that should be added to the user's authorized keys

A list of verbatim OpenSSH public keys that should be added to the user's authorized keys

The user names of the group members, added to the /etc/group file.

The name of the column in the log table to which the description of the performed operation is stored.

The usernames / UIDs this rule should apply for.

Count of subordinate group ids

Count of subordinate user ids

Automatically allocate subordinate user and group ids for this user

List of user-password pairs to provide to the sync server.

The path to the user's shell in initrd.

Group the user belongs to in initrd.

The name of the column that contains a (encrypted) password string.

List of users granted permission to use CrossMacro.

The name of the column in the log table to which the timestamp of the log entry is stored.

The name of the column in the log table to which the name of the user being authenticated is stored.

The name of the column in the log table to which the name of the user being authenticated is stored.

The name of the column in the log table to which the pid of the process utilising the pam_mysql authentication service is stored.

A list of verbatim principal names that should be added to the user's authorized principals.

If true, the user's shell will be set to users.defaultUserShell.

Per-user rules for creation, deletion and cleaning of volatile and temporary files automatically.

The full path to a file that contains the user's (clear text) password

Start of the range of subordinate group ids that user is allowed to use.

Start of the range of subordinate user ids that user is allowed to use.

Specifies the policy to use for reconnecting to an unavailable LDAP server

Let the user initiate specific instant commands

List of users, use empty list for any.

Whether to enable or disable lingering for this user

Users to be added to the idevice group.

Specifies the password hash for the account, generated with grub-mkpasswd-pbkdf2

This is a comma-separated list of usernames

The name of the column in the log table to which the name of the remote host that initiates the session is stored

Set the date on which the user's account will no longer be accessible

Optional

RPC user information for JSON-RPC connections.

Path to a custom home page

Whether to let the nslcd daemon (nss-pam-ldapd) handle the LDAP lookups for NSS and PAM

Location of the dokuwiki users file

If enabled, users are created with systemd-sysusers instead of with the custom update-users-groups.pl script

Usernames to be added to the "openrazer" group, so that they can start and interact with the OpenRazer userspace daemon.

List of users who are denied to login via Samba.

Set the path to file where the user's credentials are stored

Username

Users to provision.

Password accepted by anki-sync-server for the associated username. WARNING: This option is not secure

A set of users and their passwords and ACLs.

The group's description.

Username for JSON-RPC connections.

Allowed users and their secrets

Specifies the (clear text) password for the user

List of binary cache URLs that non-root users can use (in addition to those specified using nix.settings.substituters) by passing --option binary-caches to Nix commands.

List of binary cache URLs that non-root users can use (in addition to those specified using nix.settings.substituters) by passing --option binary-caches to Nix commands.

Set to false to prohibit users from being able to sign up / create user accounts

The name of the column or an SQL expression that indicates the status of the user

Specifies the path to a file containing the clear text password for the account

Per-user rules for creation, deletion and cleaning of volatile and temporary files automatically

User name accepted by anki-sync-server.

The distinguished name to use to bind to the LDAP server when the root user tries to modify a user's password.

SHA-512 password hash (can be generated by mkpasswd -m sha-512 <password>)

Text used as placeholder text on login page for login/username input.

The path to a file containing the credentials with which to bind to the LDAP server if the root user tries to change a user's password.

The full path to a file that contains the hash of the user's password

A short description of the user account, typically the user's full name

By default, nixos will check that programs

File containing the password accepted by anki-sync-server for the associated username

Specifies the path to a file containing the password hash for the account, generated with grub-mkpasswd-pbkdf2

Whether to periodically update the list of LoTW users

Number of nixbld user accounts created to perform secure concurrent builds

Number of nixbld user accounts created to perform secure concurrent builds

Set to true to automatically add new users to the main organization (id 1)

Specifies the initial password for the user, i.e. the password assigned if the user does not already exist

Specifies the hashed password for the user

If enabled, virtual users will use the same privileges as local users

The distinguished name to bind to the LDAP server with

Ensures that the specified users exist and have at least the ensured permissions

Sync users.

Maximum number of concurrent connections to the proxy for this user

Whether to enable new users to login if auth is enabled.

Control client access to topics on the broker.

The method to encrypt the user's password:

• 0 (or "plain"): No encryption

Text used as placeholder text on login page for password input.

Sets the default UI theme. system matches the user's system theme.

Set to false to prohibit users from creating new organizations.

Password HMAC-SHA-256 for JSON-RPC connections

By default, pam_mysql keeps the connection to the MySQL database until the session is closed

Specifies the initial hashed password for the user, i.e. the hashed password assigned if the user does not already exist

Per-user Pareto Security configuration.

Whether to ensure that this user is present or absent.

A list of verbatim OpenSSH public keys that should be added to the user's authorized keys

A list of files each containing one OpenSSH public key that should be added to the user's authorized keys

This tells pgmanage whether or not to only allow super users to login

Your users.yaml as a Nix attribute set

Specifies the (clear text) password for the MQTT User.

A list of verbatim principal names that should be added to the user's authorized principals.

Ensures that the specified users exist and have at least the ensured permissions

Set this value to automatically add new users to the provided org

Password for the user

This setting configures the default UI language, which must be a supported IETF language tag, such as en-US.

Viewers can access and use Explore and perform temporary edits on panels in dashboards they have access to

Specification (in the format described by systemd.time(7)) of the time at which the LoTW user update will occur.

Specifies the path to a file containing the clear text password for the MQTT user

Users allowed to use incrontab

A unique ID that links the agent to Pareto Cloud

Specifies the hashed password for the MQTT User

A list of user names that belong to the organization.

The role new users will be assigned for the main organization (if the auto_assign_org setting is set to true).

Specifies the (clear text) password for the user

Specifies the path to a file containing the hashed password for the MQTT user

Ensures that the specified users exist

Users allowed to authenticate even if not in allowedDomains.

List of plugins to load automatically for all users

Choose users database file to use for authentication

Maximum number of concurrent clients allowed.

Users forbidden from using fcron.

Directory where the zsh configuration and more should be located, relative to the users home directory

Defines the mapping from system users to database users

Grant access to i2c devices (/dev/i2c-*) to users in this group.

Require email validation before sign up completes.

The full path to a file that contains the hash of the user's password

Users forbidden from using incrontab.

Whether to add Wireshark to the global environment and create a 'wireshark' group

Group that users must be in to use cdemu.

Your role in Tor network

Allow users to block communications with other users

Specifies the initial password for the user, i.e. the password assigned if the user does not already exist

Whether the config should be checked at build time

Specifies the hashed password for the user

Set the maximum number of FUSE mounts allowed to non-root users.

Whether to allow users in the 'wireshark' group to capture USB traffic

Specifies which users are considered “administrators”, for those actions that require the user to authenticate as an administrator (i.e. have an auth_admin value)

The Google Admin to impersonate for API calls

Whether to allow users in the 'wireshark' group to capture network traffic

Users allowed to use fcrontab and fcrondyn (one name per line, all for everyone).

Whether to enable presence tracking

Whether users can log in with passwords defined in /etc/shadow.

Defines the mapping from system users to database users

Number of Guix build users to be used in the build pool.

Whether to enable the sudo command, which allows non-root users to execute commands as root.

Whether to enable the doas command, which allows non-root users to execute commands as root.

Range of user IDs used for the creation of regular users by useradd or newusers.

Range of user IDs used for the creation of regular users by useradd or newusers.

Only applies if enableVirtualUsers is true

List of shells which binaries should be installed to /bin/

Name of the group members of which will be allowed to create usershares

Whether to enable user-configurable Samba shares.

Range of user IDs used for the creation of system users by useradd or newusers.

Range of user IDs used for the creation of system users by useradd or newusers.

Group which users must be in to use ydotool.

Chat with users in the same room.

Specifies the initial hashed password for the user, i.e. the hashed password assigned if the user does not already exist

The resolved shell path that users can inherit to set rush as their login shell

Whether to enable FTP for local users.

Enable support for SANE scanners.

Whether to enable a memory-safe implementation of the sudo command, which allows non-root users to execute commands as root .

SMTP port used when sending emails to users.

SMTP host used when sending emails to users.

A list of users allowed to access the ifp dbus interface.

Whether to run the Nix build users validation checks.

User to use when no root privileges are required

Check readiness of users.

Whether to enable brillo in userspace

Whether to enable i2c devices support

Enables P11 PAM (pam_p11) module

Allow non-root users to specify the allow_other or allow_root mount options, see mount.fuse3(8).

Allow authentication modules to auto-create users in tt-rss internal database when authenticated successfully.

Whether to enable Ombi, a web application that automatically gives your shared Plex or Emby users the ability to request content by themselves!

Optionally see https://docs.ombi.app/info/reverse-proxy on how to set up a reverse proxy .

Whether any write activity is permitted to users.

Enables udev rules for BladeRF devices

Whether to enable please, a Sudo clone which allows a users to execute a command or edit a file as another user .

Whether to enable pmount, a tool that allows normal users to mount removable devices without requiring root privileges .

Apple menu > System Preferences > Users and Groups > Login Options

Allow users to login to the machine as guests using the Guest account

Whether to enable the dp9ik pam module provided by tlsclient

Whether to enable the Howdy PAM module

SMTP host used when sending emails to users.

SMTP port used when sending emails to users.

SMTP host used when sending emails to users.

SMTP port used when sending emails to users.

The bare JID of the gateway administrator

The list of the email addresses of the listmasters (users authorized to perform global server commands).

Allow all users to access the FUSE mount points

Gives the verbosity level that is used when logging messages from sshd(8)

Default user to store mail for virtual users.

Only monitors owned symbolic link target of GC roots.

• "auto": behaves like true for normal users, false for root.
• "true": only monitor GC roots owned by the current user.
• "false": monitor all GC roots.

If specified, login is allowed only for the listed users

If specified, login is denied for all listed users

Defines how users authenticate themselves to the server

Defines how users authenticate themselves to the server

List of administrator users

Only allow members of the wheel group to execute sudo by setting the executable's permissions accordingly

Name of the group used to run the jupyter service

Automatically login user on remote or other kind of externally supplied authentication, otherwise redirect to login form as normal

Path to text to display when users join

Only allow members of the wheel group to execute sudo by setting the executable's permissions accordingly

Path to a json file containing users and folders to load (or update) on startup

List of public signing keys of users that can access the admin panel

Store messages in an archive and allow users to access it

Send a message to users when they log in

Default group to store mail for virtual users.

Whether to enable minipro and its udev rules

The group of the running mount.davfs daemon

If specified, Duo authentication is required only for users whose primary group or supplementary group list matches one of the space-separated pattern lists

Operate in single user mode, disables all functionality related to multiple users and authentication

Enables users to publish their mood, activity, playing music and more

If specified, login is allowed only for users part of the listed groups

If specified, login is denied for all users part of the listed groups

Remap all users to "nobody"

The location for users to install Drupal themes.

Text to display when users join

Allow users to set vCards

When true, any user will be able to register

All listed users will become part of the timekpr group so they can manage timekpr settings without requiring sudo.

Kea DHCP6 configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/dhcp6-srv.html

Kea DHCP4 configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/dhcp4-srv.html

Whether to enable incusd, a daemon that manages containers and virtual machines

Allow users of the wpa_supplicant group to control wpa_supplicant through wpa_gui or wpa_cli

Kea DHCP-DDNS configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/ddns.html

The default realm to be used for the users when no explicit origin/realm relationship was found in the database, or if the TURN server is not using any database (just the commands-line settings and the userdb file)

Installs flashrom and configures udev rules for programmers used by flashrom

This option is opposite to lt-cred-mech. (TURN Server with no-auth option allows anonymous access)

How users are authenticated storage -- save passwords internally pam -- Linux PAM authentication

Whether to prevent sign-up of new users via the web UI

The base DN for your Hologram users

Allow users to have a roster

Which user or group the specified command is allowed to run as

The location for users to install Drupal modules.

Allow normal users to control wpa_supplicant through wpa_gui or wpa_cli

Whether users are included.

When this option is not 0, users ability to control feed purging intervals is disabled and all articles (which are not starred) older than this amount of days are purged.

Kea Control Agent configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/agent.html

Enables Kerberos PAM modules (pam-krb5, pam-ccreds)

Use chfn SUID to allow non-root users to change their account GECOS information.

Apple menu > System Preferences > Users and Groups > Login Options

Disables the "Shutdown" option when users are logged in

Whether to enable zeitgeist, a service which logs the users' activities and events.

Enables Yubico PAM (yubico-pam) module

Whether or not to enable the headless Aria2 daemon service

Only applies if sslEnable is true

Whether to install and set up mouse-actions and it's udev rules

This is the URL that users will enter to load your instance

Outgoing email for notifications generated by users.

If set, the pam_mysql module will be used to authenticate users against a MySQL/MariaDB database.

Enable acpilight

Outgoing email for notifications generated by users.

"From" address used when sending emails to users.

"From" address used when sending Emails to users.

Whether to enable nonpaying users to submit builds.

Apple menu > System Preferences > Users and Groups > Login Options

Disables the “Restart” option when users are logged in

Whether to enable tailscale.nginx-auth, to authenticate users via tailscale.

The lmtp daemon will make the unix socket group-read/write for users in this group.

Welcome users who register accounts

Whether to try to create home directories for users with $HOMEs pointing to nonexistent locations on session login.

Only applies if sslEnable is true

Configures the user domain, if enabled

Apple menu > System Preferences > Users and Groups > Login Options

Displays login window as a name and password field instead of a list of users

Whether users of the wheel group must provide a password to run commands as super user via sudo.

Whether users of the wheel group must provide a password to run commands as super user via doas.

Path to the working directory (used for config and pidfile)

This controls the hostname for the 9front authentication server that users will be authenticated against.

Allow normal users to control wpa_supplicant through wpa_gui or wpa_cli

Whether users of the wheel group must provide a password to run commands as super user via sudo.

Do we ignore the lid state

Some laptops are broken

This tells pgmanage to only allow users in a certain PostgreSQL group to login to pgmanage

Whether to enable API access for mobile apps and third-party clients (Google Reader API and Fever API)

If enabled, spacecookie will hide personal information of users like IP addresses from log output.

Whether users of the wheel group must provide a password to run commands as super user via run0.

If set, users listed in ~/.yubico/authorized_yubikeys are able to log in with the associated Yubikey tokens.

The following authentication modes are available: Open -- Accept connections from anyone, use NickServ for user authentication

Enable or disable TTY auditing for specified users

If enabled, starts a Terraria server

Seed settings for users and groups

A list of users which will not be shown in the display manager.

Specifies if mapped OpenID Connect accounts are automatically created upon successful authentication

Define resource limits that should apply to users or groups

Window class translation rules. /etc/X11/imwheelrc is generated based on this config which means this config is global for all users

Send announcement to all online users

Number of daemons to serve user requests

Whether to enable provisioning of groups, users and oauth2 resource servers.

Defines whether users see the Register option in the menu of Time Tracker that allows them to self-register and create new organizations (top groups).

Whether to add Soundmodem to the global environment and configure a wrapper for 'soundmodemconfig' for users in the 'soundmodem' group.

Whether to enable non-root access to the firmware of UHK keyboards

The lmtp daemon will make the unix socket group-read/write for users in this group.

Font packages to use in Steam

Whether to enable tailscale.nginx-auth, to authenticate nginx users via tailscale.

If set, users listed in $XDG_CONFIG_HOME/Yubico/u2f_keys (or $HOME/.config/Yubico/u2f_keys if XDG variable is not set) are able to log in with the associated U2F key

Allow users to register on this server using a client and change passwords

Whether to enable udev rules for devices supported by libjaylink

File containing a secret used to salt the users' password hashes and generate filenames for static content.

Whether users of the wheel group must provide a password to run commands or edit files with please and pleaseedit respectively.

Install the SPICE USB redirection helper with setuid privileges

Whether any uploads are permitted to anonymous users.

If set, users with an SSH certificate containing an authorized principal in their SSH agent are able to log in

Newline separated list of names to be allowed/denied if userlistEnable is true

Whether to enable the Howdy PAM module

Users and proxy configuration

Refer to the Tuliprox documentation for available attributes

Launch Hyprland with the UWSM (Universal Wayland Session Manager) session manager

An attribute set that maps aliases (the top level attribute names in this option) to command strings or directly to build outputs

Initial preferences are used to configure the browser for the first run

Specifies if mapped OpenID Connect accounts are automatically created upon successful authentication

Enable font antialiasing

List of users allowed to operate with the config. "root" is always implicitly included

Whether to enable exposing OpenSSH public keys defined in userdb

If true, a system-wide PipeWire service and socket is enabled allowing all users in the "pipewire" group to use it simultaneously

Whether local users are confined to their home directory.

Whether any uploads are permitted to anonymous users.

A file containing the secret used to encrypt session keys

Make your The Lounge instance public

Enable if you want to fetch all, even the read messages from the server

Whether to allow registration of new admin users.

An attribute set that maps aliases (the top level attribute names in this option) to command strings or directly to build outputs

Do minification on public static files which reduces the size of assets — saving data for the server & users as well as offering a performance improvement

A file containing the secret used to encrypt secrets for OTP tokens

Sets transmission's file mode creation mask

Enables U2F PAM (pam-u2f) module

All listed users will become part of the firezone-client group so they can control the tunnel service

List of reporter objects used to present build status to various users.

Whether to enable System bus notification support

WARNING: enabling this option (while convenient) should not be done on a machine where you do not trust the other users as it allows any other local user to DoS your session by spamming notifications .

Path to the configuration file containing authorized users credentials to run iperf tests.

Whether new users can register on this server

The duration in time a user invitation remains valid before expiring

Enable hardened VirtualBox, which ensures that only the binaries in the system path get access to the devices exposed by the kernel modules instead of all users in the vboxusers group.

Enable if you want to delete read messages from the server

Enable font hinting

Set this option to true to enable HTTP compression, this can improve transfer speed and bandwidth utilization

This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles

Maximum amount of users which will be allowed to register on this system. 0 - no limit.

If set, shows a contact email address when rendering error pages

A list of paths that should be included in the system closure but generally not visible to users

The hosts.hfaxd file entry in the spooling area will be symlinked to the location given here

Maximum number of client connections allowed

Whether to generate the password files at build time and store them directly in the system closure, without requiring any services at boot time

Makes user-profiles globally available under nextcloud.tld/u/user.name

Paths to the Nix profile

Don't allow users to connect in non-secure mode (without random padding).

If set, shows a contact email address when rendering error pages

Path to a file containing extra ntfy environment variables in the systemd EnvironmentFile format

Defines one or more team names that auto-provisioned OIDC users shall be added to

Frontend configuration

Name of the remote read config, which if specified must be unique among remote read configs

This is optional and is by default off, because most users will not need it

Specify SSH host keys to import into the initrd

A list of users who should be able to integrate 1Password with polkit-based authentication mechanisms.

Apple menu > System Preferences > Users and Groups > Login Options

Auto login the supplied user on boot

Name of the remote write config, which if specified must be unique among remote write configs

SFTP private key file

Where to redirect new users upon registration.

JSON file containing secret keys

Whether to enable configuration for Hyprland, a tiling Wayland compositor that doesn't sacrifice on its looks.

The set of packages that appear in /run/current-system/sw

The set of packages that appear in /run/current-system/sw

When not set to null this option defines the path at which the unbound remote control socket should be created at

FreeType LCD filter

Whether new users can register on this server

Whether to open the default ports in the firewall: TCP/UDP 22000 for transfers and UDP 21027 for discovery

This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles

If false, a PulseAudio server is launched automatically for each user that tries to use the sound system

If you want to prevent node sharing from allowing users to access services across tailnets, declare your expected tailnets domain here.

Allow users to register themselves

Whether to enable the dummy "startx" pseudo-display manager, which allows users to start X manually via the startx command from a virtual terminal.

Deactivates analytics

The permission for settings.dir

The channel in which users will appear in when connecting.

When disabled, unprivileged users will not be able to create new namespaces

List of accepted local users

This is optional and is by default off, because most users will not need it

Converts users profiles and Avatars between old and new formats

Defines one or more team names that auto-provisioned OIDC users shall be added to

Whether to use binary caches for downloading store paths

The manual pages to generate caches for if documentation.man.generateCaches is enabled

Whether all users can write to the consumption dir.

Whenever to send wall notifications to all users.

Authentication type

Whether to enable the headless Transmission BitTorrent daemon

Push notifications to inform users of new messages or other pertinent information even when they have no XMPP clients online

Source of truth of users

The base URL of the API server

Apple menu > System Preferences > Users and Groups > Login Options

Hides the Sleep button on the login screen

Apple menu > System Preferences > Users and Groups > Login Options

Hides the Shut Down button on the login screen

Diffie-Hellman parameters to generate

This option enables docker, a daemon that manages linux containers

Set of default packages that aren't strictly necessary for a running system, entries can be removed for a more minimal NixOS installation

This option enables lxd, a daemon that manages containers

Exposes EDID files from users-sourced database at https://github.com/linuxhw/EDID

Attribute names will be mapped to EDID filenames <NAME>.bin

Set of default packages that aren't strictly necessary for a running system, entries can be removed for a more minimal NixOS installation

Whether to enable the "sx" pseudo-display manager, which allows users to start manually via the "sx" command from a vt shell

Identity the EAP/XAuth secret belongs to

Identity the NTLM secret belongs to

Apple menu > System Preferences > Users and Groups > Login Options

Hides the Restart button on the login screen

All actors (users) to provision

Whether to enable KVMGT (iGVT-g) VGPU support

Whether to enable registration for new users.

LDAP filter for users.

If set, all recipients to users at either "localhost" (the literal string) or the canonical host name (from the me control attribute) are remapped to this address

Identity the EAP/XAuth secret belongs to

This option enables libvirtd, a daemon that manages virtual machines

The XEP-0423 defines a set of recommended XEPs to implement for a server

Enable if you are syncing more than 2000 users/groups.

Set of core packages for a normal interactive system

Whenever to use precomputated tables for ElGamal. i2pd defaults to false to save 64M of memory (and looses some performance)

An attribute set where the keys name the organisation and the values are a set of lists of users and groups.

A boolean that controls whether site visitors can create new accounts

Class that users must have.

Enables single account mode

Environment file to be passed to the systemd service

Environment file to be passed to the systemd service

Font packages to use in OpenGamepadUI

Whether users must authenticate when using the web UI or command-line tool

Apple menu > System Preferences > Users and Groups > Login Options

If set to true, the Power Off menu item will be disabled when the user is logged in

Displays a CAPTCHA challenge for users that register externally.

Allow users to edit datasources from the UI.

Whether to use NetworkManager to obtain an IP address and other configuration for all network interfaces that are not manually configured

Make the Podman socket available in place of the Docker socket, so Docker tools can find the Podman socket

The directory where the skeleton files are located

Remove users from bitwarden groups if no longer in the ldap group.

If set, users with enabled Google Authenticator (created ~/.google_authenticator) will be required to provide Google Authenticator token to log in.

Point DOCKER_HOST to rootless Docker instance for normal users by default.

Outbound email configuration is mandatory for Firezone and supports many different delivery adapters

This option defines the first version of NixOS you have installed on this particular machine, and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions

Attribute for a users email.

Whether new users can register on this server.

Send notifications about killed processes via the system d-bus

The attribute that contains the users username.

If set, will use the Google OS Login PAM modules (pam_oslogin_login, pam_oslogin_admin) to verify possible OS Login users and set sudoers configuration accordingly

If set, will use the pam_oslogin_login's user authentication methods to authenticate users using 2FA

Enable registration for new users.

Remove and re-add users/groups, See https://bitwarden.com/help/user-group-filters/#overwriting-syncs for more details.

The configuration of vaultwarden is done through environment variables, therefore it is recommended to use upper snake case (e.g. DISABLE_2FA_REMEMBER)

Additional environment file or files as defined in systemd.exec(5)

Whenever to send systembus-notify notifications

Default 2FA method for new users and fallback for preferred but disabled methods.

Whether to enable support for unprivileged users to launch containers.

The name-string specifies an external program to be called that will automatically change volumes as required by Bacula

Whether the users will be able to use the ad-hoc commands that lets them configure their realname and username.

If not null, is used as the permissions set by system.activationScripts.transmission-daemon on the directories services.transmission.settings.download-dir, services.transmission.settings.incomplete-dir. and services.transmission.settings.watch-dir

Do not allow more than this many server connections per user (regardless of database)

The read permissions to include for this token

The read permissions to include for this token