Host of an existing Let's Encrypt certificate to use for SSL

Group running the ACME client.

Attribute set of certificates to get signed and renewed

Default values inheritable by all configured certs

Group under which the node-cert exporter shall be run.

Path to TLS certificate

Path to a certificate signing request to apply when fetching the certificate.

Path to the private key to the matching certificate signing request.

Key type to use for private keys

Commands to run after new certificates go live

Email address for account creation and correspondence from the CA

Domain to fetch certificate for (defaults to the entry name).

Minimum remaining validity before renewal in days.

S3 bucket name to use for HTTP-01 based challenges

ACME Directory Resource URI

The certificate profile to choose if the CA offers multiple profiles.

Interface and port to listen on to solve HTTP challenges in the form [INTERFACE]:PORT

Additional global flags to pass to all lego commands.

Where the webroot of the HTTP vhost is located. .well-known/acme-challenge/ directory will be created below the webroot if it doesn't exist. http://example.org/.well-known/acme-challenge/ must also be available (notice unencrypted HTTP).

Additional flags to pass to lego run.

Turns on the OCSP Must-Staple TLS extension

Whether to enable debug logging for this certificate.

Additional flags to pass to lego renew.

A list of extra domain names, which are included in the one certificate to be issued.

DNS Challenge provider

Set the resolver to use for performing recursive DNS queries

Directory where certificate and other state is stored.

Systemd calendar expression when to check for renewal

The list of systemd services to call systemctl try-reload-or-restart on.

Whether to inherit values set in security.acme.defaults or not.

Group running the ACME client.

Environment variables suffixed by "_FILE" to set for the cert's service for your selected dnsProvider

Path to an EnvironmentFile for the cert's service containing any required and optional environment variables for your selected dnsProvider

Group to run Agnos as

Toggles lego DNS propagation check, which is used alongside DNS-01 challenge to ensure the DNS entries required are available.

If set, then the authenticating user must be a member of this group to use this module.

The user's primary group.

Cert file to use for clients

Group for the default nutmon user

Certificate file in PEM format.

The group to run oCIS under

Group to run qui as.

Group to own the ZNC process.

Group under which Node-RED runs

Group running H2O services

Group the bee binary should execute under.

Group account under which MPD runs.

Group under which the VDRvdr service runs.

The group under which NNCP files shall be owned

The group of the wrapper program.

Group under which museum runs

Group under which NATS runs.

Group under which Ombi runs.

Group under which Plex runs.

The user's primary group.

Group under which caddy runs.

The group as which to run the Ergo node.

Group under which the Kubo daemon runs

Group under which the Loki service runs.

Group account under which unit runs.

User group under which nscd runs.

Group account under which tcsd runs.

Group to run the service.

Group account under which maddy runs.

The group of the Guix build user pool.

Group to use when no root privileges are required.

Group account where Apache NiFi runs.

Group under which db-rest runs.

Grant access to i2c devices (/dev/i2c-*) to users in this group.

The group to run as

Path to the certificate file.

Primary group of ntfy-sh user.

Group under which ytdl-sub runs.

Group under which gitea runs.

Group davis runs as.

Group under which Komga runs.

Group for the dspam daemon.

Group under which amule runs

Group to own the seatd socket

Group which runs Nexus3.

Group under which slskd runs.

The Omnom service group.

mailinglist local group

Group under which Stash runs.

The group to run Memos as.

Cyrus IMAP group name

The group for the service

Group account under which Sonarr runs.

Group the hound daemon should execute under.

Group account under which bosun runs.

Group account under which legit runs.

Group account under which nginx runs.

Group running Movim service

Group account under which rqbit runs.

Group account under which uWSGI runs.

The name of an existing group to use to run the service

Group snipe-it runs as.

Group to assign to the SEV device.

Group account under which Apache Felix runs.

Group under which httpd children processes run.

Group under which the coder service runs.

Group that users must be in to use cdemu.

Group to set for devices of the msr kernel subsystem.

Group to run the cgit service as.

Group under which the service should run

Webhook will be run under this group

The cert.pem file used for https.

List of certificate specs to feed to cert generator.

Group under which to run ollama

TLS certificate

The group as which to run quorum.

The group under which attic runs.

Group under which bazarr runs.

Group under which Lidarr runs.

The group immich should run as.

Artalk group name.

Group under which deluge runs.

The group to run Kismet as.

Group under which galene runs.

System group for opkssh

Group under which NZBGet runs

Group under which pretix should run.

Group under which Radarr runs.

Group monica runs as.

Group under which WebDAV runs.

Name of the Zammad group.

Group account under which prosody runs.

Etcd cert file

The group to run code-server under

Group account under which MySQL runs.

SSL certificate file path.

System group to run Flarum

Group account under which Akkoma runs.

Group to run cross-seed as.

Group owner of CCache directory

Group name under which SFTPGo runs.

Group under which to run the service

Specifies the owner group of the wiki directory

Group account under which the web-application run.

Group to run gitlab and all related services.

Group account under which Apache Tomcat runs.

Group to use when no root privileges are required.

Group to run the service as.

Group under which pyLoad runs, and which owns the download directory.

Group account under which Pocket ID runs.

Group to use to run Zeyple.

Group under which Git daemon would be running.

The group under which the web application runs.

Group under which firefly-iii runs

Path to TLS certificate to use for connections to public-inbox-imapd(1).

Path to TLS certificate to use for connections to public-inbox-nntpd(1).

If specified, Duo authentication is required only for users whose primary group or supplementary group list matches one of the space-separated pattern lists

If the default user "gocd-agent" is configured then this is the primary group of that user.

The group for the service.

Name of the group used to run the jupyter service

Primary group under which Traefik runs

Group account under which dolibarr runs.

Group account under which pixelfed runs.

Group to assign to the SEV guest device.

Group to run the Roon Bridge as.

Group to run the Roon Server as.

Whether to skip certificates issued before the first launch of Cert Spotter

Group under which seafile runs.

Group privileges for the server.

The group to run Corteza under.

Group under which Jackett runs.

Group under which Homebox runs.

Group under which Forgejo runs.

Group under which owncast runs.

Group to run the service as

Group under which Readarr runs.

Group under which pretalx should run.

Group under which netdata runs.

Group under which PdfDing runs

Group under which Redmine is ran.

Group under which Polaris is run.

The group under which stunnel runs.

Group under which MonetDB runs.

Group under which unbound runs.

The group to run ZITADEL under.

The group 0bin should run as

The TLS certificate to use for encryption.

The TLS certificate to use for encryption.

The TLS certificate to use for encryption.

Group account under which haproxy runs.

Group account under which couchdb runs.

Group account under which pleroma runs.

The group usbmuxd should use to run after startup.

Path to the cert.pem file, which will be copied into Syncthing's config directory.

Group which users must be in to use ydotool.

What to call the Postfix group (must be used only for postfix).

Group under which Podgrab runs, and which owns the download directory.

Path of certificates (*.{crt,cert,key}) used to connect to registry.

Path to the cert.pem file, which will be copied into Syncthing's configDir.

If the default user "gocd-server" is configured then this is the primary group of that user.

If the default user "jenkins" is configured then this is the primary group of that user.

Group account under which Calibre-Web runs.

The name of an existing user group under which the rsync process should run.

Group account under which Actual runs

The group of the service.

Group for the daemon.

Group for the daemon

Group account under which this instance of redis-server runs.

The group tuwunel is run as

Group assigned to the user and the webroot directory.

The group to run OpenCloud under

The group to run Syncthing under

An existing Let’s Encrypt certificate to use for this virtual host

Group under which dawarich runs.

The group to run crowdsec as

Group under which jellyfin runs.

Group agorakit runs as.

Group under which ejabberd is ran

Name of the LibreNMS group.

Group under which influxdb runs

Group under which Kanboard runs.

Group under which ErsatzTV runs.

Group under which rtorrent runs.

The group under which OliveTin runs.

Group under which Peertube runs.

Group ownership of service

Group under which Tautulli runs.

Group under which mastodon runs.

Group under which sniproxy runs.

Group under which Whisparr runs.

Owner group of the device

Group the user belongs to in initrd.

Dovecot group name.

Group account under which slapd runs.

Group account under which OpenTSDB runs.

Group under which the oxidized service runs.

Path to the host certificate.

Group account under which Klipper runs

Group that the CGI process will belong to. (Set to config.services.gitolite.group if you are using gitolite.)

Primary group of the Gitolite user account.

Group account under which Portunus runs its webserver.

Group under which Pingvin Share runs.

Group to run under when setuid is not enabled.

Group account under which this pool runs.

Group account under which inadyn runs.

Path to the server's certificate

The group temporal runs as

The group quickwit runs as

An existing Let’s Encrypt certificate to use for this virtual host

mjpg-streamer group name.

Path to the TLS certificate file

If the default slave agent user "jenkins" is configured then this is the primary group of that user.

The group as which to run bitcoind.

The group under which calibre-server runs.

Whether to enable Cert Spotter, a Certificate Transparency log monitor.

Group for the daemon.

Group account under which Portunus runs its LDAP server.

Group bookstack runs as

Group under which CommaFeed runs.

The group under which GlitchTip runs.

Group for bumblebee socket

Group under which blendfarm runs.

Group under which Kapacitor runs

The group to run the service as.

Group under which Pinchflat runs.

Group under which Navidrome runs.

Group under which recyclarr runs.

Group to run the service as

The group pgbouncer is run as.

Group under which to run the service

Group under which privatebin runs

Group under which headscale runs.

Path to the certificate file.

Charybdis IRC daemon group.

Run Apache Cassandra under this group.

Group for Ubertooth's udev rules.

Group of user running bitmagnet

Group account under which stargazer runs.

Group which rethinkdb user belongs to.

Group account under which Moonraker runs.

Group which runs the ruTorrent service.

Group account under which the service runs.

Extra command-line arguments to pass to Cert Spotter

Group name who owns the socket file.

A switch to disable Endorsement Key (EK) certificate verification

Group assigned to the device when connected.

Path to the SSL certificate file

Group under which Tandoor runs.

What to call the primary group of the dedicated user under which infinoted is run

TLS certificates directory to use for encryption

List of group entries to configure in /etc/nsswitch.conf

Primary group of buildbot user.

Group under which peertube-runner runs.

Group under which Suwayomi-Server runs.

Group which runs PlantUML server.

An existing Let’s Encrypt certificate to use for this virtual host

Primary group of buildbot Worker user.

Group which runs tailscale-nginx-auth

The user names of the group members, added to the /etc/group file.

The group ID owning the volume inside the container.

The group GID

Group to grant access to the Yggdrasil control socket

The path to a file or AF_UNIX stream socket to read the server certificate from

Name of the group members of which will be allowed to create usershares

Group for Taskserver.

Add the hook to the named group.

Group under which firefly-iii-data-importer runs

Group to run the service as

Group to run homebridge as.

Group under which Govee2MQTT should run.

Group under which photoprism runs.

Group under which Szurubooru runs.

Group microsocks runs as.

The group Linkwarden should run as.

Group under which LubeLogger runs.

The group to run Reposilite under.

Type of group to perform a group search against.

Group for hg.sr.ht

The group borg is run as

Group account name under which to run shairport-sync

Group which runs the Mattermost service.

Group account under which scollector runs.

Group for man.sr.ht

Group for git.sr.ht

Group for hub.sr.ht

Group to use to run nullmailer-send.

The group to run openvscode-server under

The name of the group

The path to the certificate directory.

Group for todo.sr.ht

Group for meta.sr.ht

Group account under which healthchecks runs.

Fully qualified path to the CA certificate.

Group under which the Periphery agent runs.

The group OpenSearch runs as

Group under which the service runs.

The group borg serve is run as

The name of the organization responsible for the X.509 certificate's /O name.

Group to assign to the SGX provisioning device.

Path to certificate (PEM with certificate chain)

TLS Certificate for gRPC server, leave blank to disable TLS

Group for paste.sr.ht

Group for lists.sr.ht

Group for pages.sr.ht

A system group name for this client instance.

A system group name for this client instance.

If inspectHttps is enabled, the time generated HTTPS certificates will be stored in a temporary directory for reuse

The group to run Silverbullet under

Path to the certificate used for TLS.

TLS Certificates to use to identify this client to the server

Group account under which HBase runs.

Group to run wyoming-satellite under.

Path to GitLab container registry certificate.

Group under which FileBrowser runs.

Group meshtasticd runs as.

Group under which qbittorrent runs.

Group under which Writefreely is ran.

TLS Certificate for gRPC server, leave blank to disable TLS

TLS Certificate for gRPC server, leave blank to disable TLS

Configuration for groups.

Group name of file owner

A host of an existing Let's Encrypt certificate to use. Note that this option does not create any certificates, nor it does add subdomains to existing ones – you will need to create them manually using security.acme.certs.

group to run vdirsyncer as

Group for builds.sr.ht

Path to the certificate file for the mongo database.

Group account under which the web-application run.

Group of the tpm kernel resource manager (tpmrm) device-group, set if applyUdevRules is set.

Fully qualified path to the server certificate.

Name of group to run the script under

Run Suricata with a specific group-id.

Under which user/group the specified command is allowed to run

Group under which this instance runs.

Under which user/group the specified command is allowed to run

Organizational unit to look up a group.

Etcd cert file.

The group under which Anubis is run

The group of the wrapper program.

Additional groups to be created automatically by the system.

Whether to group windows by application in Mission Control's Exposé

The group ID inside the container.

The group under which Anubis is run

Path to SSL certificate file.

The group to run the Phosh service.

TLS Certificate for gRPC server, leave blank to disable TLS

TLS Certificate for gRPC server, leave blank to disable TLS

Group under which the chrony exporter shall be run

Group account under which FoundationDB runs.

Group which runs the matterbridge service.

Group account under which Transmission runs.

Group under which the frr exporter shall be run

The name of the group for this authelia instance.

The group as which to run blockbook-frontend-‹name›.

Whether to enable the prometheus node-cert exporter.

The group of the file

The groups / GIDs this rule should apply for.

The groups / GIDs this rule should apply for.

Scripts to run upon the detection of a new certificate

Alias of services.tailscaleAuth.group.

An absolute file path (which should be outside the Nix-store) to Gemini certificates.

IPA server CA certificate

The groups / GIDs this rule should apply for.

Query to find a group associated to a user in the LDAP database.

Extra commandline options to pass to the node-cert exporter.

The certspotter package to use.

Members of this group can access the control socket for this interface.

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

This public key is an SSH certificate authority, rather than an individual host's key.

This public key is an SSH certificate authority, rather than an individual host's key.

How long certs generated by Stargazer should live for

A host of an existing Let's Encrypt certificate to use

Group under which this instance runs.

The group continuwuity is run as.

The group as which to run the wasabibackend node.

Group to be set as owner of the UNIX socket.

The group of the file

Group under which the sql exporter shall be run.

Group under which the nut exporter shall be run.

Group under which the kea exporter shall be run.

Group under which the pve exporter shall be run.

Group under which the zfs exporter shall be run.

Group under which the lnd exporter shall be run.

User account under which CockroachDB runs

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

A list of trusted root certificates in PEM format.

A list of trusted root certificates in PEM format.

Use a certificate generated by the NixOS ACME module for the given host

The lmtp daemon will make the unix socket group-read/write for users in this group.

Group under which to run the Spreed signaling server.

Group under which the postfix exporter shall be run

Group under which the flow exporter shall be run.

Group under which the mail exporter shall be run.

Group under which the snmp exporter shall be run.

Group under which the bind exporter shall be run.

Group under which the bird exporter shall be run.

Group under which the mqtt exporter shall be run.

Group under which the ebpf exporter shall be run.

Group under which the ipmi exporter shall be run.

Group under which the knot exporter shall be run.

Group under which the nats exporter shall be run.

Group under which the node exporter shall be run.

Group under which the ping exporter shall be run.

Group under which the json exporter shall be run.

Path to certificate describing the server.

TLS Certificate for gRPC server, leave blank to disable TLS

Whether to enable LDAPS protocol

Group under which the php-fpm exporter shall be run.

Unix Group to run the server under

The group's GID.

Group as which this instance of fcgiwrap will be run.

Group under which the idrac exporter shall be run.

Group under which the dmarc exporter shall be run.

Group under which the redis exporter shall be run.

Group under which the fritz exporter shall be run.

Group under which the v2ray exporter shall be run.

Group under which the kafka exporter shall be run.

Group under which the jitsi exporter shall be run.

Group under which the nginx exporter shall be run.

The lifetime (in minutes) of the resolver certificate

ID of the group in initrd.

A list of files containing trusted root certificates in PEM format

A list of files containing trusted root certificates in PEM format

Which user or group the specified command is allowed to run as

Group under which the dnssec exporter shall be run.

Group under which the mysqld exporter shall be run.

Group under which the script exporter shall be run.

Group under which the fastly exporter shall be run.

Group under which the deluge exporter shall be run.

Group under which the shelly exporter shall be run.

Group under which the rspamd exporter shall be run.

Group under which the tibber exporter shall be run.

Group under which the restic exporter shall be run.

Group under which the statsd exporter shall be run.

Group under which the domain exporter shall be run.

Group under which the pihole exporter shall be run.

Group(s) of this poller.

Use a certificate generated by the NixOS ACME module for the given host

Members of this group can control wpa_supplicant.

Path to the sendmail binary

Group under which Audiobookshelf runs.

Group account under which libretranslate runs.

The lmtp daemon will make the unix socket group-read/write for users in this group.

Group under which the nvidia-gpu exporter shall be run.

This public key is an SSH certificate authority, rather than an individual host's key.

Domain names to watch

A set of values to be modified by kwriteconfig6

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

Group under which the libvirt exporter shall be run.

Group under which the bitcoin exporter shall be run.

Group under which the dovecot exporter shall be run.

Group under which the sabnzbd exporter shall be run.

Group under which the varnish exporter shall be run.

Group under which the klipper exporter shall be run.

Group under which the unbound exporter shall be run.

Group under which the mongodb exporter shall be run.

Group under which the dnsmasq exporter shall be run.

Group under which the ecoflow exporter shall be run.

Group under which the apcupsd exporter shall be run.

Group under which the process exporter shall be run.

Group under which the systemd exporter shall be run.

To enable SSL, specify path to the name of certificate files without extension

Path to certificate (PEM with certificate chain)

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

Group under which the rtl_433 exporter shall be run.

Multiple GitHub Runners

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

Port to listen on.

User owning the certs.

Group under which the py-air-control exporter shall be run.

A host of an existing Let's Encrypt certificate to use

Group under which the mikrotik exporter shall be run.

Group under which the opnsense exporter shall be run.

Group under which the postgres exporter shall be run.

Group under which the nginxlog exporter shall be run.

Group under which the unpoller exporter shall be run.

Group under which the graphite exporter shall be run.

Group under which the fritzbox exporter shall be run.

Group under which the smartctl exporter shall be run.

Group under which the blackbox exporter shall be run.

Group under which the influxdb exporter shall be run.

Group under which the keylight exporter shall be run.

Group under which the collectd exporter shall be run.

Whether to enable certmgr.

Group under which the mailman3 exporter shall be run.

The interval before a certificate expires to start attempting to renew it.

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

List of paths to search for SSL certificates.

File path to a cert file.

Group under which the imap-mailstat exporter shall be run.

Certificate specs as described by: https://github.com/cloudflare/certmgr#certificate-specs These will be added to the Nix store, so they will be world readable.

The group's name

Certificate file for MQTT server access.

Group account under which changedetection-io runs.

Group under which the borgmatic exporter shall be run.

Group under which the surfboard exporter shall be run.

Group under which the rasdaemon exporter shall be run.

Group under which the nextcloud exporter shall be run.

Group under which the smokeping exporter shall be run.

Group under which the tailscale exporter shall be run.

Group under which the pgbouncer exporter shall be run.

Group under which the wireguard exporter shall be run.

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

Default kubeconfig client certificate file used to connect to kube-apiserver.

Group under which the junos-czerwonk exporter shall be run.

A list of email addresses to send certificate updates to.

Path to a SSL certificate file for the server

A host of an existing Let's Encrypt certificate to use

The certmgr package to use.

Members of this group can control wpa_supplicant.

Kubernetes proxy client certificate file used to connect to kube-apiserver.

Group under which the buildkite-agent exporter shall be run.

Group under which the storagebox exporter shall be run.

Group under which the scaphandre exporter shall be run.

Group under which the exportarr-lidarr exporter shall be run.

Group under which the exportarr-sonarr exporter shall be run.

Group under which the exportarr-bazarr exporter shall be run.

Group under which the exportarr-radarr exporter shall be run.

Section for a certificate candidate to use for authentication

The objectclass attribute to search for groups when enableLdapRoles is true

List of paths to exclute from searching for SSL certificates.

This optional key specifies the group to run the job as

Shared folder list

Section for a certificate candidate to use for authentication

Optional slot number of the token that stores the certificate.

Address to listen on.

A host of an existing Let's Encrypt certificate to use

The port for the Prometheus HTTP endpoint.

Group under which the exportarr-readarr exporter shall be run.

List files matching a pattern to include

List files matching a pattern to include

Open port in firewall for incoming connections.

Group under which the artifactory exporter shall be run.

Kubelet client certificate file used to connect to kube-apiserver.

Optional slot number of the token that stores the certificate.

A host of an existing Let's Encrypt certificate to use

Optional PKCS#11 module name.

Absolute path to the certificate to load

A host of an existing Let's Encrypt certificate to use

Some email providers (Gmail) have a different directory hierarchy for synchronized email messages

The group which should be allowed access to the given resource.

Group under which the exportarr-prowlarr exporter shall be run.

Optional PKCS#11 module name.

Absolute path to the certificate to load

Specify rules for nftables to add to the input chain when services.prometheus.exporters.node-cert.openFirewall is true.

Enable support for SANE scanners.

Hex-encoded CKA_ID or handle of the certificate on a token or TPM, respectively

A host of an existing Let's Encrypt certificate to use

User under which to run the service

Group under which the modemmanager exporter shall be run.

The group's members.

A host of an existing Let's Encrypt certificate to use

A host of an existing Let's Encrypt certificate to use

List of certificates to accept for authentication

The user's primary group.

User under which the service should run

Hex-encoded CKA_ID or handle of the certificate on a token or TPM, respectively

This specifies the service manager to use for restarting or reloading services

Whether to enable grouping of windows by application in Mission Control.

Certificates for agnos to issue or renew.

The default CA host:port to use.

List of certificate candidates to use for authentication

Kubernetes scheduler client certificate file used to connect to kube-apiserver.

The user names of the group members, added to the /etc/group file.

Groups to include in initrd.

Specify a filter for iptables to use when services.prometheus.exporters.node-cert.openFirewall is true

A host of an existing Let's Encrypt certificate to use

The KeePassXC groups used for storing and fetching of credentials

Only allow members of the wheel group to execute sudo by setting the executable's permissions accordingly

Control group which subgroups are placed under

Cert file to use for peer to peer communication

Group directory, relative to root.

Only allow members of the wheel group to execute sudo by setting the executable's permissions accordingly

Definition of groups.

A host of an existing Let's Encrypt certificate to use

How often to check certificate expirations and how often to update the cert_next_expires metric.

The address for the Prometheus HTTP endpoint.

This optional key specifies the group to run the job as

The port group variables for suricata.

Web server directory.

Whether to preserve the TERMINFO and TERMINFO_DIRS environment variables, for root and the wheel group.

Whether to preserve the TERMINFO and TERMINFO_DIRS environment variables, for root and the admin group.

This optional key specifies the group to run the job as

Domains the certificate represents

This optional key specifies the group to run the job as

The group of the running mount.davfs daemon

The unique name for THIS channel in THIS group

How to call postfix setgid group (for postdrop)

Certificate file for client cert authentication to the server.

Kubernetes controller manager client certificate file used to connect to kube-apiserver.

groups.ini contents

All groups to provision

NNTP group name for the inbox.

The name of this group for this account

Certificate file for client cert authentication to the server.

The directory holding configuration files, the SQlite database and the SSL Cert.

Whether to ensure that this group is present or absent.

Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.

Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.

List of kanidm entities (persons, groups, ...) which are part of this group.

Options used for the default rules, granting root and the wheel group permission to run any command as any user.

Attribute for a name of group.

List of CA certificates to accept for authentication

Enables hackrf udev rules and ensures 'plugdev' group exists

Certificate file for client cert authentication to the server.

Options used for the default rules, granting root and the wheel group permission to run any command as any user.

IRCD server SSL certificate

Path to certificate file.

Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers

Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers

Root of the certificate directory.

The directory where TLS certificates are stored.

A regexp matching the full paths of cgroups whose data shouldn't be collected

User under which to run the service

Path to the certificate used for SSL connections with clients.

The group to use for settings permissions

The port and interface of the listen endpoint in the form [HOST]:PORT[+CERT].

Whether users of the wheel group must provide a password to run commands as super user via sudo.

Whether users of the wheel group must provide a password to run commands as super user via doas.

Limit access to the ckb daemon to a particular group.

Path to keystore (combined PEM with cert/key, or PKCS12 keystore)

The address group variables for suricata, if not defined the default value of suricata (see example) will be used

Whether users of the wheel group must provide a password to run commands as super user via sudo.

When set to something distinct to null NSD is able to collect statistics per zone

File holding nginx configuration that sets the nonce used to create secret links

This tells pgmanage to only allow users in a certain PostgreSQL group to login to pgmanage

Path to the certificate key file (if protocol is set to https or h2).

A list of attribute sets containing paths to TLS certificates and keys

Path to the private key used for TLS.

Whether users of the wheel group must provide a password to run commands as super user via run0.

The path to the TLS key.

  nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"

Path to CA bundle file (PEM/X509)

Extra configuration for cgroup.conf

Restrict logins to members of these Google groups.

Cgroups to write in 'nixCgroups.cgroups'

Path to default file containing certificate authorities that should be used to validate the connection authenticity

The terminal permissions: the login tty will be owned by the TTYGROUP group, and the permissions will be set to TTYPERM

Certificate file for securing RPC connections.

Specifies files from which the user certificate is read.

Whether to enable the flag "--ignore-certificate-errors" for the Chromium browser opened by Jibri

Set workgroup name (default WORKGROUP).

Path to the certificate file (if protocol is set to https or h2).

Shared roster support

The path to the TLS certificate.

  nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"

The full path to the PEM encoded TLS certificate

The full path to the PEM encoded TLS certificate

Whether to permit root access only to members of group wheel.

Whether users of the wheel group must provide a password to run commands or edit files with please and pleaseedit respectively.

The full path to the PEM encoded TLS certificate

LDAP filter for groups.

Server certificate to use for TLS

The group GID

List of channels that should be grouped together into this group

Enable support for attaching AppArmor profiles at the user/group level, e.g., as part of a role based access control scheme.

The path to the client cert

Whether to add Wireshark to the global environment and create a 'wireshark' group

Path to certificate file

Whether to enable Google OS Login

Path to the TLS certificate for the web UI

TLS certificate path.

TLS ceritficate path.

The terminal permissions: the login tty will be owned by the TTYGROUP group, and the permissions will be set to TTYPERM

A class that groups will have.

Name of the runner group to add this runner to (defaults to the default runner group)

Name of the runner group to add this runner to (defaults to the default runner group)

Chain of CA-certificates to which our certificateFile is relative

The name of the group

Path to your SSL certificate

If set to true, you are free to add new users and groups to the system with the ordinary useradd and groupadd commands

Path to certificate.

Whether to allow users in the 'wireshark' group to capture USB traffic

The name of this group

Whether to allow users in the 'wireshark' group to capture network traffic

The group's description.

Path to certificate file

Provisioning of kanidm groups

Specifies which users are considered “administrators”, for those actions that require the user to authenticate as an administrator (i.e. have an auth_admin value)

Name of the rule group

Certificate file for MQTT

Path to HTTPS listener certificate.

Authorization group memberships to require

Path to MySQL listener certificate.

Output path for the certificate private key

Path to certificate file

Path to a file containing the certificate used for client authentication to the server.

Name of the folder the rule group will be stored in

Whether the member list should be overwritten each time (true) or appended (false)

Count of subordinate group ids

Path under which the stats socket is placed

The members of this group

Subordinate group ids that user is allowed to use

Automatically allocate subordinate user and group ids for this user

A list of group names that belong to the organization.

Interval that the rule group should be evaluated at

Whether to enable cgroup accounting; see cgroups(7).

Configure SSL server certificates to terminate the SSL sessions

Path to keystore (combined PEM with cert/key, or PKCS12 keystore)

Path to CA certificate to use for client authentication.

This option disables password/group lookups

Path to the TLS certificate file

Whether to install Light backlight control command and udev rules granting access to members of the "video" group.

Path to file containing certificate authorities that should be used to validate the connection authenticity

Path to file containing certificate authorities that should be used to validate the connection authenticity

The full path to the PEM encoded TLS certificate

The full path to the PEM encoded TLS certificate

Path to PostgreSQL listener certificate.

Ensure that only the given members are part of this group at every server start.

Whether to enable JACK Audio Connection Kit

When not set to null this option defines the path at which the unbound remote control socket should be created at

Whether to enable i2c devices support

Start of the range of subordinate group ids that user is allowed to use.

The path to the CA certificate to use.

Whether to enable brillo in userspace

Whether to automatically generate cfssl API webserver TLS cert and key, if they don't exist.

Extra x509 Subject Alternative Names to be added to the cfssl API webserver TLS cert.

Whether to allow logging into accounts that have no password set (i.e., have an empty password field in /etc/passwd or /etc/group)

Count of subordinate group ids

Enables udev rules for BladeRF devices

Certificate file for client cert authentication to the server.

Certificate file for client cert authentication to the server.

Subordinate group ids that user is allowed to use

Path to already created certificate.

Extra permission groups to attach to the KMonad instance for this keyboard

Automatically allocate subordinate user and group ids for this user

Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint

Whether to enable the systemd JSON user/group record lookup service .

Path to CA bundle file (PEM/X509)

Enable saned network daemon for remote connection to scanners.

saned would be run from scanner user; to allow access to hardware that doesn't have scanner group you should add needed groups to this user.

Whether to configure a setcap wrapper for tcpdump

List of groups this person should belong to.

Account certificate file, necessary to create, delete and manage tunnels

Certificate file for client cert authentication to the server.

Certificate file for client cert authentication to the server.

If true, allow all clients, do not check client cert subject.

The name that will be given to this DNSCrypt resolver.

Enables Glasgow udev rules and ensures 'plugdev' group exists

HOME_NET variable.

Start of the range of subordinate group ids that user is allowed to use.

Whether to enable minipro and its udev rules

Whether to check the resulting config file with unbound checkconf for syntax errors

Whether to enable sedutil, to manage self encrypting drives that conform to the Trusted Computing Group OPAL 2.0 SSC specification.

Default group to store mail for virtual users.

Certificate file for client cert authentication to the server.

Certificate file for client cert authentication to the server.

Certificate file for client cert authentication to the server.

Certificate file for client cert authentication to the server.

Certificate file for client cert authentication to the server.

Defines a group of servers to use as proxy target.

Whether to enable PdfDing service

Enables rtl-sdr udev rules, ensures 'plugdev' group exists, and blacklists DVB kernel modules

Configuration file for persisting runtime changes

The user of the file

User that runs smokeping and (optionally) thttpd

Indicates whether this is an account for a “real” user

Disable checking that at least the root user or a user in the wheel group can log in using a password or an SSH key

Path to the Unbound control socket certificate

All listed users will become part of the timekpr group so they can manage timekpr settings without requiring sudo.

GID where the socket should be set when protocol=socket

Whether to enable Portunus, a self-contained user/group management and authentication service for LDAP.

DNP3_SERVER variable.

DNP3_CLIENT variable.

Enable Docker support

Extra x509 Subject Alternative Names to be added to the kubernetes apiserver tls cert.

Group where a user must be a member of to gain superuser rights.

The certificates may use a relative path from the swanctl x509ca directory or an absolute path

ENIP_CLIENT variable.

ENIP_SERVER variable.

Whether to enable incusd, a daemon that manages containers and virtual machines

Certificate file for client cert authentication to the server.

Installs flashrom and configures udev rules for programmers used by flashrom

Whether to configure system to use gphoto2

Usernames to be added to the "openrazer" group, so that they can start and interact with the OpenRazer userspace daemon.

Path to the certificate used for the HTTPS listener

DC_SERVERS variable.

Account certificate file, necessary to create, delete and manage tunnels

AIM_SERVERS variable.

DNS_SERVERS variable.

SQL_SERVERS variable.

Directory for storing certificates to be used by Neo4j for TLS connections

Certificates for additional domains.

SMTP_SERVERS variable.

HTTP_SERVERS variable.

Which LDAP group attribute to search for authorized role ARNs

Whether to install and set up mouse-actions and it's udev rules

Whether or not to enable the headless Aria2 daemon service

Certificate to authenticate with.

The user of the file

User or group to restrict

Output path for the full chain including the acquired certificate

MODBUS_CLIENT variable

MODBUS_SERVER variable.

Path to private key.

Certificate file for client cert authentication to the server.

Certificate file for client cert authentication to the server.

Certificate file for client cert authentication to the server.

Data directory for Quickwit

Data directory for Temporal

Section for a CA certificate to accept for authentication

The path to a TLS certificate bundle used to verify the server's certificate.

Additional groups under which Traefik runs

A list of names of users that have additional rights when connecting to the Nix daemon, such as the ability to specify additional binary caches, or to import unsigned NARs

A list of names of users that have additional rights when connecting to the Nix daemon, such as the ability to specify additional binary caches, or to import unsigned NARs

EXTERNAL_NET variable.

Indicates whether this is an account for a “real” user

Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint

Enable acpilight

Whether to configure Privoxy to inspect HTTPS requests, meaning all encrypted traffic will be filtered as well

Whether to enable CoreCtrl, a tool to overclock amd graphics cards and processors

Optional slot number of the token that stores the certificate.

This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles

TELNET_SERVERS variable.

Enables sheep_net udev rules, ensures 'sheep_net' group exists, and adds sheep-net to boot.kernelModules and boot.extraModulePackages

Whether to use NetworkManager to obtain an IP address and other configuration for all network interfaces that are not manually configured

Make the Podman socket available in place of the Docker socket, so Docker tools can find the Podman socket

Whether to enable libutempter for mosh

Whether to enable libutempter for tmux

Whether to enable the feedbackd D-BUS service and udev rules

Certificate file for client cert authentication to the server.

Absolute path to the certificate to load

Optional PKCS#11 module name.

Hostgroups to declaratively load into FastNetMon Advanced

By default, all networks will get same priority group (0)

Enables kryoflux udev rules, ensures 'floppy' group exists

List of rule groups to import or update.

A system group name for this client instance.

A system group name for this client instance.

Whether to enable mx-puppet-discord is a discord puppeting bridge for matrix

If enabled, starts a Terraria server

Whether to enable automatically creating the user given in services.dovecot.user and the group given in services.dovecot.group.

The common name field of the certificate used by the mysql or postgres server

Path to a cert file for connecting to kubelet.

Set group-write permissions on a USB device

Send certificate payloads when using certificate authentication.

• With the default of ifasked the daemon sends certificate payloads only if certificate requests have been received.
• never disables sending of certificate payloads altogether,
• always causes certificate payloads to be sent unconditionally whenever certificate authentication is used

Hex-encoded CKA_ID or handle of the certificate on a token or TPM, respectively

Whether to sync ldap groups into BitWarden.

The login method

Users to be added to the idevice group.

Whether to enable non-root access to the firmware of UHK keyboards

Certificate file for client cert authentication to the server.

Whether to add Soundmodem to the global environment and configure a wrapper for 'soundmodemconfig' for users in the 'soundmodem' group.

Primary name for use (as a suffix) in:

• systemd service name,
• hardened user name and group,
• systemd *Directory= names,
• desktop application identification,

Primary name for use (as a suffix) in:

• systemd service name,
• hardened user name and group,
• systemd *Directory= names,
• desktop application identification,

Extra configuration lines to add to THIS channel's configuration.

Include services.beszel.agent.smartmon.package in the Beszel agent path for disk monitoring and add the agent to the disk group.

Users that intend to use BenchExec

This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles

Whether to enable udev rules for devices supported by libjaylink

A changegroup script which is installed in every mercurial repo

The user borg is run as

Certificate file for client cert authentication to the server.

The file mode creation mask for Aria2 service

Whether to assign user roles based on the user's LDAP group memberships

Data directory for OpenSearch

List of certificate policy OIDs the peer's certificate must have

Instead of synchronizing just the mailboxes that match the farPattern, use it as a prefix which is not matched against the patterns, and is not affected by mailbox list overrides.

Enable CIS Hardening for RKE2

A set that will be generated into configuration file, see the SmartDNS README for details of configuration parameters

Key file for client cert authentication to the server.

The user borg serve is run as

If true, a system-wide PipeWire service and socket is enabled allowing all users in the "pipewire" group to use it simultaneously

Whether to enable lemurs, a customizable TUI display/login manager.

IMAP4 patterns for which mailboxes on the remote mail server to sync

Key file for client cert authentication to the server.

Certificate file for client cert authentication to the server.

If true, allow all clients, do not check client cert subject.

Name for where mail coming from the remote (far) mail server will end up locally

All listed users will become part of the firezone-client group so they can control the tunnel service

Send certificate request payloads to offer trusted root CA certificates to the peer

Defines the base URI for the Hash and URL feature supported by IKEv2

Enable hardened VirtualBox, which ensures that only the binaries in the system path get access to the devices exposed by the kernel modules instead of all users in the vboxusers group.

Key file for client cert authentication to the server.

The user and group to run nebula-lighthouse-service as.

Name is used as a suffix for the service name, user, and group

When a job dies, launchd kills any remaining processes with the same process group ID as the job

List of groups to allow access to this vhost, or null to allow all.

Tell multipathd how to manage path group failback

The systemd KillMode to use for glusterd.

glusterd spawns other daemons like gsyncd

Postgresql database superuser used to create Nominatim database and import data

Group policies to install

The filepath to the provider secret key

Multiaddr or array of multiaddrs describing the address to serve the local HTTP API on

Username for the postgresql connection

PEM encoded X509 certificate for TLS

Group policies to install

Write logs to a specific Cloudwatch Logs group.

Specifies a program to be used to look up the user's public keys

If false, a PulseAudio server is launched automatically for each user that tries to use the sound system

If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad ("127.0.0.1") or an IPv6 address enclosed in square brackets ("[::1]").

(VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@" followed by the name of an abstract socket ("@myvarnishd") accept connections on a Unix domain socket

When a job dies, launchd kills any remaining processes with the same process group ID as the job

When a job dies, launchd kills any remaining processes with the same process group ID as the job

Number of I/O requests to route to a path before switching to the next in the same path group

The permission for settings.dir

When a job dies, launchd kills any remaining processes with the same process group ID as the job

Whether to enable the headless Transmission BitTorrent daemon

SSL key in PEM format

This option enables docker, a daemon that manages linux containers

Match windows where wm class group contains string.

This option enables lxd, a daemon that manages containers

Defines Anuko Time Tracker default language

Match windows where wm class group contains string.

Whether to enable KVMGT (iGVT-g) VGPU support

Username for the postgresql connection

Listen on a UNIX socket at the specified path

Allow users of the wpa_supplicant group to control wpa_supplicant through wpa_gui or wpa_cli

This optional key can be used to request that the datagram socket join a multicast group

This option enables libvirtd, a daemon that manages virtual machines

All relay groups to provision

The name of this relay group

Path to a file containing the password

Number of I/O requests to route to a path before switching to the next in the same path group

Attribute set of NetBird client daemons, by default each one will:

1. be manageable using dedicated tooling:

• netbird-<name> script,
• NetBird - netbird-<name> graphical interface when appropriate (see ui.enable),

2. run as a netbird-<name>.service,
3. listen for incoming remote connections on the port 51820 (openFirewall by default),
4. manage the netbird-<name> wireguard interface,
5. use the /var/lib/netbird-/config.json configuration file,
6. override /var/lib/netbird-/config.json with values from /etc/netbird-/config.d/*.json,
7. (hardened) be locally manageable by netbird-<name> system group,

With following caveats:

• multiple daemons will interfere with each other's DNS resolution of netbird.cloud, but should remain fully operational otherwise

Whether to enable VirtualBox.

Hardened service:

• runs as a dedicated user with minimal set of permissions (see caveats),
• restricts daemon configuration socket access to dedicated user group (you can grant access to it with users.users."<user>".extraGroups = [ netbird-‹name› ]),

Even though the local system resources access is restricted:

• CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
• older kernels don't have CAP_BPF and use CAP_SYS_ADMIN instead,

Known security features that are not (yet) integrated into the module:

• 2024-02-14: rosenpass is an experimental feature configurable solely through --enable-rosenpass flag on the netbird up command, see the docs

Hardened service:

• runs as a dedicated user with minimal set of permissions (see caveats),
• restricts daemon configuration socket access to dedicated user group (you can grant access to it with users.users."<user>".extraGroups = [ netbird-‹name› ]),

Even though the local system resources access is restricted:

• CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
• older kernels don't have CAP_BPF and use CAP_SYS_ADMIN instead,

Known security features that are not (yet) integrated into the module:

• 2024-02-14: rosenpass is an experimental feature configurable solely through --enable-rosenpass flag on the netbird up command, see the docs

All gateway groups (sites) to provision

The name of this gateway group

A list of groups for which targets are retrieved, only supported when targeting the container role

This optional key can be used to request that the datagram socket join a multicast group

This optional key can be used to request that the datagram socket join a multicast group

Remove users from bitwarden groups if no longer in the ldap group.

Do not send VRRP adverts over VRRP multicast group

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Path to a file containing the password

This optional key can be used to request that the datagram socket join a multicast group

The default path grouping policy to apply to unspecified multipaths

Attribute that lists members in a LDAP group.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Enable distributed billing on this poller

Key file for client cert authentication to the server.

The targets specified by the target group.

Kanidm groups that are allowed to login using PAM.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Kanidm groups that are allowed to login using PAM.

Listen on a UNIX socket at the specified path

Key file for client cert authentication to the server.

If not null, is used as the permissions set by system.activationScripts.transmission-daemon on the directories services.transmission.settings.download-dir, services.transmission.settings.incomplete-dir. and services.transmission.settings.watch-dir

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

The string by which Uyuni group names are joined into the groups label

Defaults to , in prometheus when set to null.

Key file for client cert authentication to the server.

Time to schedule CHILD_SA rekeying

Number of bytes processed before initiating CHILD_SA rekeying

Number of packets processed before initiating CHILD_SA rekeying