When enabled, the user must authorize requested permissions for all extensions from programs.floorp.profiles.<profile>.extensions.packages in programs.floorp.profiles.<profile>.extensions.settings.<extensionID>.permissions

When enabled, programs.floorp.profiles.<profile>.extensions.settings.<extensionID>.permissions must specify the exact set of permissions that the extension will request

When enabled, programs.firefox.profiles.<profile>.extensions.settings.<extensionID>.permissions must specify the exact set of permissions that the extension will request

When enabled, programs.librewolf.profiles.<profile>.extensions.settings.<extensionID>.permissions must specify the exact set of permissions that the extension will request

When enabled, the user must authorize requested permissions for all extensions from programs.firefox.profiles.<profile>.extensions.packages in programs.firefox.profiles.<profile>.extensions.settings.<extensionID>.permissions

When enabled, the user must authorize requested permissions for all extensions from programs.librewolf.profiles.<profile>.extensions.packages in programs.librewolf.profiles.<profile>.extensions.settings.<extensionID>.permissions

List of ‹name› add-on packages to install for this profile

Attribute set of Floorp profiles.

Allowed permissions for this extension

Allowed permissions for this extension

Allowed permissions for this extension

Attribute set of options for each extension

Forcibly override any existing configuration for this extension.

Submodule for installing and configuring extensions.

Json formatted options for this extension.

Whether to override all previous firefox settings

Profile ID

Profile path.

Profile name.

Attribute set of Floorp preferences

Whether this is a default profile.

Attribute set of options for each extension

Forcibly override any existing configuration for this extension.

Declarative search engine configuration.

Attribute set of options for each extension

Json formatted options for this extension.

Custom bookmarks.

The extensions Visual Studio Code should be started with.

Whether to enable Google OS Login

Custom Floorp user chrome CSS.

List of ‹name› add-on packages to install for this profile

Forcibly override any existing configuration for this extension.

Extra preferences to add to user.js, before programs.firefox.profiles._name_.settings

The order the search engines are listed in

Submodule for installing and configuring extensions.

Extra preferences to add to user.js.

Json formatted options for this extension.

List of ‹name› add-on packages to install for this profile

Whether to force replace the existing search configuration

Custom Floorp user content CSS.

Whether to override all previous firefox settings

List of ‹name› add-on packages to install for this profile

Container ID

The default search engine used in the address bar and search bar.

Attrset of dconf profiles

Profile to use for the system.

Submodule for installing and configuring extensions.

Declarative bookmarks.

Whether to override all previous firefox settings

Attribute set of search engine configurations

Whether to force override existing custom bookmarks.

Attribute set of container configurations

The default search engine used in the Private Browsing.

Configuration file to define custom bookmarks.

Profile ID

Container icon.

Container name, e.g., shopping.

Whether to force replace the existing containers configuration

Container color.

List of maintainers of each module

Profiles allow multiple colima configurations

Profile ID

Sub-configuration options for specific profiles written to $XDG_CONFIG_HOME/mpv/mpv.conf

Profile path.

Profile name.

List of permissions that are granted with this password

The permissions of the wrapper program

List of maintainers of each module

Settings for this profile

A list of all VSCode profiles

Keyboard profile to apply at boot time

Attribute set of Firefox preferences

Extra profiles for Element

profile attribute set.

Profile name.

Profile path.

Custom configuration profiles for schroot.

Attribute set of Firefox profiles.

User's access level for changing data.

• view: view only permission.
• add: view and add permissions.
• edit: view, add, and edit permissions.
• sandstorm: permissions from the X-Sandstorm-Permissions request header.

Whether this is a default profile.

Profile name

A set of Gnome Terminal profiles

Profile hook scripts.

The permissions of the wrapper program

Extra commands that should be added to .zprofile.

The Nix profile name.

Attribute set of profile options

The certificate profile to choose if the CA offers multiple profiles.

Profile name, defaults to 'system' (NixOS).

Per output profile configuration.

Name of the profile.

Attribute set of LibreWolf preferences

Commands executed after the profile is successfully applied

Permissions to the UNIX socket, if configured.

Extra commands that should be run when initializing a login shell.

Whether to enable update checks/notifications

Configuration written to Visual Studio Code's mcp.json

Whether this is a default profile

Whether this is a default profile.

Path, relative to HOME, where Home Manager should write the X profile script.

Custom bookmarks.

Profile name

Whether this should be the default profile.

Autorandr profiles specification.

Attribute set of LibreWolf profiles.

Configuration written to Visual Studio Code's tasks.json

Preferences to add to this profile's user.js.

The certificate profile to choose if the CA offers multiple profiles.

The profile name.

A file in the format described in fstab(5), used to mount filesystems inside the chroot

Attribute set of site options for this profile

Declarative search engine configuration.

The profile directory where Home Manager generations are installed.

Settings for this site

Commands executed after the profile is successfully applied

Name of the default cryptographic profile chosen from the profile_dir directory.

The font name, null to use system default.

Paths to the Nix profile

Custom bookmarks.

Custom Firefox user chrome CSS.

Container ID

The order the search engines are listed in

Extra preferences to add to user.js.

Extra preferences to add to user.js, before programs.firefox.profiles._name_.settings

Colima configuration settings, see https://github.com/abiosoft/colima/blob/main/embedded/defaults/colima.yaml or run colima template.

Profile access endpoint.

Whether to force replace the existing search configuration

Profiles for TuneD

Custom Firefox user content CSS.

The terminal colors, null to use system default.

If true, allow applications in the terminal to make text boldface.

Outputs configuration.

Whether this profile will run as a service.

Run command as a login shell.

Profile GC root policies.

Whether to set this profile as:

• active docker context
• active kubernetes context
• active incus remote Exactly one or zero profiles should have this option set.

Declarative search engine configuration.

Configuration written to Visual Studio Code's settings.json

Attribute set of profiles.

The default search engine used in the address bar and search bar.

The cursor shape.

Whether to enable update notifications for extensions

Whether bold text is shown in bright colors.

Attribute set of Thunderbird profiles.

Names of the Disnix profiles to expose in the system's PATH

Container ID

The color for the terminal cursor.

Turn on/off the terminal's bell.

Defines global user snippets.

The bold color, null to use same as foreground.

Declarative bookmarks.

Custom LibreWolf user chrome CSS.

Defines an alias for the output

The cursor blink mode.

The order the search engines are listed in

A list of files to copy into the chroot from the host system.

Profile hook scripts.

Output DPI configuration.

Scales the output by the specified scale factor.

Whether to scroll when output is written.

The terminal palette.

Extra preferences to add to user.js.

Extra preferences to add to user.js, before programs.firefox.profiles._name_.settings

Output framerate.

Output resolution.

Definition of sandbox profiles.

Extra shell commands to run before session start.

Whether to force replace the existing search configuration

Output video display controller.

Whether to force override existing custom bookmarks.

Horizontal scaling factor/pixels.

Vertical scaling factor/pixels.

This profile's name.

Custom LibreWolf user content CSS.

Enables or disables the specified output.

Start URL of the site.

Per output profile configuration.

The profile file contents

Ensures that the specified users exist and have at least the ensured permissions

Attribute set of search engine configurations

Output gamma configuration.

Directory that contains all cryptographic profiles known to FAPI.

Name of the site.

The command to use to start the shell, or null for default shell.

The default search engine used in the address bar and search bar.

The profile's name.

Retention period for the GC roots in this profile.

Attribute set of container configurations

Whether to enable the output.

Defines user snippets for different languages.

Output rotate configuration.

The default search engine used in the Private Browsing.

Whether to enable wshowkeys (displays keypresses on screen on supported Wayland compositors)

<width>x<height>[@<rate>[Hz]]

Configures the specified output to use the specified mode

Interpolation method to be used for scaling the output.

Configuration file to define custom bookmarks.

Whether the scroll bar should be visible.

Declarative search engine configuration.

Declarative bookmarks.

Output scaling method.

The terminal permissions: the login tty will be owned by the TTYGROUP group, and the permissions will be set to TTYPERM

Combined stdout and stderr log file for the Colima service.

Output scale configuration

Keep the latest N GC roots in this profile.

Keybindings written to Visual Studio Code's keybindings.json

The colors for the terminal’s highlighted area.

Whether output should be marked as primary

Preswitch hook executed before mode switch.

Container icon.

Whether to force override existing custom bookmarks.

Permissions granted for the services.syncoid.user user for local target datasets

Custom Thunderbird user chrome CSS.

Predetect hook executed before autorandr attempts to run xrandr.

Container name, e.g., shopping.

The order the search engines are listed in

Extra lines to append to this profile's config.

Attribute set of search engine configurations

Container color.

Extra preferences to add to user.js.

Whether to force replace the existing search configuration

Text of the file.

Whether to force replace the existing containers configuration

The content of /etc/asusd/profile.ron

<x>,<y>

Places the output at the specified position in the global coordinates space.

Output position

Enables or disables adaptive synchronization (aka

Package providing the font

Sets the output transform.

Custom Thunderbird user content CSS.

The named AWS profile used to authenticate.

The terminal permissions: the login tty will be owned by the TTYGROUP group, and the permissions will be set to TTYPERM

The default search engine used in the Private Browsing.

Attribute set of container configurations

Autorandr profiles specification.

A list of profiles used to setup the global environment.

A list of profiles used to setup the global environment.

Postswitch hook executed after mode switch.

Configuration file to define custom bookmarks.

The number of scrollback lines to keep, null for infinite.

Map of PPD profiles to native TuneD profiles.

The default search engine used in the address bar and search bar.

Which string the terminal should send to an application when the user presses the Delete key.

auto : Send the @7 control sequence.

ascii-backspace : Send an ASCII backspace character (0x08).

ascii-delete : Send an ASCII delete character (0x7F).

delete-sequence : Send the @7 control sequence.

tty : Send terminal's "erase" setting.

The criteria can either be an output name, an output description or "*"

Icon to display in file manager, menus, etc.

Outputs configuration.

List of maintainers of each module

Color configuration

URL of the site's web app manifest.

The maximum charge level to help reduce battery wear:

• high_capacity charges to 100% (driver default)
• balanced charges to 90%
• stationary charges to 80% (maximum lifespan)

Note: Regardless of the configured charging profile, the operating system will always report the battery as being charged to 100%.

The foreground color.

The background color.

Container icon.

System databases (as described in /etc/nsswitch.conf on GNU/Linux systems) to copy into the chroot from the host.

The background color.

The foreground color.

the path passed to qbittorrent via --profile.

Makes user-profiles globally available under nextcloud.tld/u/user.name

Container name, e.g., shopping.

Refer to xrandr(1) for the documentation of the transform matrix.

Attribute set of feed accounts

Whether to integrate the MCP servers config from programs.mcp.servers into programs.vscode.profiles.<name>.userMcp

Whether to enable power-profiles-daemon, a DBus daemon that allows changing system behavior based upon user-selected power profiles.

Container color.

The power-profiles-daemon package to use.

Output name to EDID mapping

Whether to enable the desktop entry for this site.

Whether to force replace the existing containers configuration

Path of the source file.

Allow using external GPG keys with GPGME.

Permissions granted for the services.syncoid.user user for local source datasets

This feed account's name.

Attribute set of search engine configurations

Package providing the font

Package providing the font

Package providing the font

List of store paths to make accessible.

A list of profiles to enable

Whether to enable this angrr policy.

The default search engine used in the Private Browsing.

List of maintainers of each module

Ensures that the specified users exist and have at least the ensured permissions

Defines an alias for the output

Scales the output by the specified scale factor.

Package providing the font

Custom ordering of accounts and local folders in Thunderbird's folder pane

List of maintainers of each module

Which string the terminal should send to an application when the user presses the Backspace key.

auto : Attempt to determine the right value from the terminal's IO settings.

ascii-backspace : Send an ASCII backspace character (0x08).

ascii-delete : Send an ASCII delete character (0x7F).

delete-sequence : Send the @7 control sequence.

tty : Send terminal's "erase" setting.

Package providing the theme

The background color.

The foreground color.

Enables or disables the specified output.

Package providing the icon theme

Permissions granted for the services.syncoid.user user for local target datasets

Background transparency in percent.

<width>x<height>[@<rate>[Hz]]

Configures the specified output to use the specified mode

Whether to allow read access to FHS paths like /etc and /var.

Attribute set of environment variable

List of maintainers of each module

List of maintainers of each module

List of paths that should be read-only inside the sandbox.

Categories in which the entry should be shown in a menu.

List of paths that should be read/write inside the sandbox.

Custom ordering of calendar accounts

Output DPI configuration.

Package providing the theme

Package providing the theme

Package providing the theme

Whether to keep the last booted system generation

Output resolution.

Output framerate.

Vertical scaling factor/pixels.

Horizontal scaling factor/pixels.

Package providing the icon theme

Package providing the icon theme

Package providing the icon theme

Output video display controller.

Whether to create the home directory and ensure ownership as well as permissions to match the user.

Whether to keep the current system generation

Output gamma configuration.

Package providing the cursor theme

<x>,<y>

Places the output at the specified position in the global coordinates space.

Sets the pointer acceleration profile to the given profile

Whether to enable the output.

Output rotate configuration.

Enables or disables adaptive synchronization (aka

Automatically sync on profile open/close.

Sets the output transform.

Niceness.

Permissions to ensure for the user, specified as attribute set

The criteria can either be an output name, an output description or "*"

Output scaling method.

CPU scheduler priority.

IO scheduler priority.

CPU scheduler class.

IO scheduler class.

Preswitch hook executed before mode switch.

Whether output should be marked as primary

Whether to allow network access inside the sandbox.

Predetect hook executed before autorandr attempts to run xrandr.

Set group-write permissions on a USB device

Package providing the cursor theme

Package providing the cursor theme

Package providing the cursor theme

Output scale configuration

Specifies the directory where Memos will store its data.

Permissions granted for the services.syncoid.user user for local source datasets

Whether to create the home directory and ensure ownership as well as permissions to match the user.

The directory where MPD stores its state, tag cache, playlists etc

Output position

Sets the pointer acceleration profile to the given profile

Process matchers.

The work directory for CFSSL.

Whether to allow localhost network access inside the sandbox.

Postswitch hook executed after mode switch.

Directory for storing Caddy access logs.

Declaratively define NetworkManager profiles

The physical device name to listen on

Extends the systemd unit with permissions to allow for the use of the eXpress Data Path (XDP).

Whether to enable periodic garbage collection for user profile and nix store with nh clean user.

The data directory for MySQL.

The NATS data directory

List of Thunderbird profiles for which this account should be enabled

Serial port for the Z-Wave controller

Configuration for Nomad

Refer to xrandr(1) for the documentation of the transform matrix.

Permissions to ensure for the user, specified as an attribute set

Only allow members of the wheel group to execute sudo by setting the executable's permissions accordingly

The directory to store all user data, such as flow and credential files and all library data

Output name to EDID mapping

Only allow members of the wheel group to execute sudo by setting the executable's permissions accordingly

The Sonarr home directory used to store all data

Named AWS profile used to connect to the API.

Whether to allow users in the 'wireshark' group to capture USB traffic

The data directory for caddy.

Directory where aMule moves completed downloads

List of Thunderbird profiles for which this account should be enabled

Path where the socket should be created when protocol=socket

The directory where Galene stores its internal state

Path to TLS certificate

List of Thunderbird profiles for which this account should be enabled

The prosody home directory used to store all data

The directory where owncast stores its data files

A file containing a secure random string

Location for any persistent data Traefik creates, such as the ACME certificate store.

A file containing SQL statements to be executed on the first startup

Directories to search for profiles, separated by , or ;.

A file containing a connection string for the database

Attribute set of environment variable used in the global environment

This option effectively allows adding setuid/setgid bits, capabilities, changing file ownership and permissions of a program without directly modifying it

Path the service has access to

Wallet file

The data directory for goeland where the database will reside if using the unseen filter

The group to use for settings permissions

The gitolite home directory used to store all repositories

Change permissions for the socket

This tells the USBGuard daemon which file to load as policy rule set

Credentials and permissions for accessing the mpd server.

Whether to enable the Profile Sync daemon.

File permissions on the UNIX domain socket.

Whether to enable Profile-sync-daemon service.

Location of a file containing the SMTP password

A path of a profile file to include

The directory where Duplicati stores its data files.

Permissions on the UNIX socket.

This directory is used for uploads of pictures

The name of the device that should be remapped

File containing the SMTP password

File containing the Flask secret key

Where to store the backups

Whether to configure permissions to allow integration with Postfix.

The directory or NFS/SMB network share where MPD reads music from

Location of the Django secret key

The profile-sync-daemon package to use.

The data directory for PostgreSQL

The data directory for PostgreSQL

Host of the postgresql server

Postgresql database user with read-only permissions used for Nominatim web API service.

Port that the /debug/pprof endpoint will listen on.

The directory where config.txt and serversettings.json is saved

List of users allowed to operate with the config. "root" is always implicitly included

Host of the postgresql server

List of groups allowed to operate with the config

Whether to install a JSON formatted list of all Home Manager options

File containing the JWT private key

The input method configure in profile file in ini format.

The input method configure in profile file in ini format.

File containing an API key to talk to the Immich server

This directory is used for uploads of pictures

The read permissions to include for this token

Named AWS profile used to connect to the API.

Whether to run reaction as root

The read permissions to include for this token

API key to talk to the Immich server

Directory for storing certificates to be used by Neo4j for TLS connections

This is the name that will be displayed by NetworkManager and GUIs.

The directory where MPD stores playlists

The connection type defines the connection kind, like vpn, wireguard, gsm, wifi and more.

Bulk PDF import from consume directory

Path of the data directory

Unix Permissions in octal on the rtorrent directory.

The data directory for PostgreSQL

Path of the subvolume or mount point

Automatically login user on remote or other kind of externally supplied authentication, otherwise redirect to login form as normal

The directory used to store all data for healthchecks.

If not null, is used as the permissions set by system.activationScripts.transmission-daemon on the directories services.transmission.settings.download-dir, services.transmission.settings.incomplete-dir. and services.transmission.settings.watch-dir

Base directory used for logging.

Path to directory of CRLs (Certificate Revocation Lists) in PEM format

The directory or URI where MPD reads music from

If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad ("127.0.0.1") or an IPv6 address enclosed in square brackets ("[::1]").

(VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@" followed by the name of an abstract socket ("@myvarnishd") accept connections on a Unix domain socket

Host of the postgresql server

This directory is used for uploads of attachments and cache

The directory to store the database files in

Extra permission groups to attach to the KMonad instance for this keyboard

Path to directory of X.509 certificates in PEM format for trusted parties

The mandatory base directory for cryptographic objects of this policy

Whether to enable Libravatar as profile picture source on your instance

default permissions for all unauthenticated accesses.

Grant capabilities to the uWSGI instance

Path used for the database file.

List of additional portals that should be added to the environment

The docker package to use

The ASF home directory used to store all data

Default PPD profile.

Cursor acceleration (how fast speed increases from minSpeed to maxSpeed)

Whether to enable incusd, a daemon that manages containers and virtual machines

Whether to enable API access for mobile apps and third-party clients (Google Reader API and Fever API)

The path to a file containing the API key

To configure Slack auth, you'll need to create an Application at https://api.slack.com/apps

When configuring the Client ID, add a redirect URL under "OAuth & Permissions" to https://[publicUrl]/auth/slack.callback.

Specifies the path to a file containing the clear text password for the MQTT user

Path to a file containing the Cloudflare API authentication token

The directory where MPD stores playlists

Whether to add the activation script to the system profile

The default permissions (in octal) to create the UNIX socket with.

Hardened service:

• runs as a dedicated user with minimal set of permissions (see caveats),
• restricts daemon configuration socket access to dedicated user group (you can grant access to it with users.users."<user>".extraGroups = [ netbird-‹name› ]),

Even though the local system resources access is restricted:

• CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
• older kernels don't have CAP_BPF and use CAP_SYS_ADMIN instead,

Known security features that are not (yet) integrated into the module:

• 2024-02-14: rosenpass is an experimental feature configurable solely through --enable-rosenpass flag on the netbird up command, see the docs

Hardened service:

• runs as a dedicated user with minimal set of permissions (see caveats),
• restricts daemon configuration socket access to dedicated user group (you can grant access to it with users.users."<user>".extraGroups = [ netbird-‹name› ]),

Even though the local system resources access is restricted:

• CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
• older kernels don't have CAP_BPF and use CAP_SYS_ADMIN instead,

Known security features that are not (yet) integrated into the module:

• 2024-02-14: rosenpass is an experimental feature configurable solely through --enable-rosenpass flag on the netbird up command, see the docs

Additional groups under which Traefik runs

Path to the postgres socket directory

If the conflict.rateLimitIsAggregate option is true, then after each tick one point of conflict-credit is given to just one domain: the one at the front of the queue

As an alternative to specifying config, you can specify the path to the evaluated NixOS system configuration, typically a symlink to a system profile.

Account certificate file, necessary to create, delete and manage tunnels

Sets the step between the points of the scroll acceleration function

Grants the user created inherit permissions

Sets the step between the points of the (pointer) motion acceleration function

Cursor acceleration (how fast speed increases from minSpeed to maxSpeed)

This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles

Specifies the path to a file containing the hashed password for the MQTT user

Enable CIS Hardening for RKE2

Grants the user, created by the ensureUser attr, createdb permissions

Sets the points of the scroll acceleration function

A list of browsers to sync

Sets the points of the (pointer) motion acceleration function

Grants the user, created by the ensureUser attr, login permissions

The default permissions (in octal) to create the UNIX socket with.

Hide profile banner.

The profile file to load from "/var/lib/OpenRGB" at startup.

Sets the step between the points of the fallback acceleration function

Mounts to be added to every container under the Nvidia CDI profile.

Grants the user, created by the ensureUser attr, replication permissions

Account certificate file, necessary to create, delete and manage tunnels

Grants the user, created by the ensureUser attr, superuser permissions

Sets the step between the points of the scroll acceleration function

Sets the step between the points of the (pointer) motion acceleration function

Sets the points of the fallback acceleration function

Grants all permissions in the associated organization.

A separate activation script package that's not part of the system profile

File permissions on the UNIX domain socket.

Sets the points of the scroll acceleration function

Square profile pictures.

Sets the points of the (pointer) motion acceleration function

Grants all permissions in all organizations.

Make profile sidebar stick to top.

Grants the user, created by the ensureUser attr, replication permissions

Grants the user, created by the ensureUser attr, createrole permissions

Whether to enable the AppArmor Mandatory Access Control system

Sets the step between the points of the fallback acceleration function

The set of packages that appear in /run/current-system/sw

The set of packages that appear in /run/current-system/sw

Sets the points of the fallback acceleration function

A set of environment variables used in the global environment

This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles

Set to true to disable the use of Gravatar for user profile images.

When disabled, unprivileged users will not be able to create new namespaces

Process profile assignments.

Free-form settings mapped to the qBittorrent.conf file in the profile

Whether to enable killing of processes which have an AppArmor profile enabled (in security.apparmor.policies) but are not confined (because AppArmor can only confine new processes)

Whether the service discovery should list all instances for all projects

UUID of the connection profile

UUIDs are assigned once on connection creation and should never change as long as the connection still applies to the same network.

Additional scripts for WirePlumber to be used by configuration files