When enabled with services.transmission.home services.transmission.settings.incomplete-dir-enabled, new torrents will download the files to this directory

The directory where Transmission will create .config/transmission-daemon. as well as Downloads/ unless services.transmission.settings.download-dir is changed, and .incomplete/ unless services.transmission.settings.incomplete-dir is changed.

Whether to enable the services.transmission.settings.watch-dir.

If not null, is used as the permissions set by system.activationScripts.transmission-daemon on the directories services.transmission.settings.download-dir, services.transmission.settings.incomplete-dir. and services.transmission.settings.watch-dir

Specifies if TLS should be enabled

Require TLS or TLS-PSK encryption

True if ZFS filesystem support is enabled

Require TLS or TLS-PSK encryption

Require TLS or TLS-PSK encryption

Specifies if TLS should be enabled

Specifies if TLS should be enabled

If enabled, the virtual machine will boot directly into the kernel instead of through a bootloader

True if NVIDIA support is enabled

Whether to enable Micro Transport Protocol (µTP).

Whether this list is enabled

If true, a backend match requires the frontend connection be TLS encrypted

Deprecated - use type and enable = true instead

Deprecated - use type and enable = true instead

Enable/disable the embedded DNS proxy server

Whether to enable SMTP.

Directory to store downloaded files.

Whether to enable MQTT support.

Enable Captcha.

Watch a directory for torrent files and add them to transmission.

Whether to run services.transmission.settings.script-torrent-done-filename at torrent completion.

Events of type 'api' will be logged.

Working directory of the OpenGFW service and home of opengfw.user.

Path used for -xkbdir xserver parameter.

Makes user-profiles globally available under nextcloud.tld/u/user.name

Whether to use redis support

Directory where to download torrents.

Whether to enable XtreemFS DIR service.

Directory where incomplete downloading files are stored.

Events of type 'system' will be logged.

Check for new versions

Whether to enable the TCP JSON-RPC.

Whether to enable watchdogd plugin filenr.

Whether to enable the HTTP JSON-RPC.

Enable unix-command socket.

Whether to enable OCSP Stapling

Enable or disable PKCE (Proof Key for Code Exchange) support

Whether to enable .

Whether to enable watchdogd plugin loadavg.

Whether to enable watchdogd plugin meminfo.

The port to listen on for incoming connections (TCP).

Events of type 'terminal' will be logged.

Whether to enable this SMTP server for listmonk.

Whether to enable the billing system.

The option "enabled" takes 3 values - "yes", "no", "detection-only". "yes" enables both detection and the parser, "no" disables both, and "detection-only" enables protocol detection only (parser disabled).

TLS Options for the Director

Whether to enable Dendrite's full-text search engine.

Configuration of XtreemFS DIR service

Whether to enable presence tracking

Chunkwm Plugins directory.

Whether to enable the TCP JSON-RPC.

List of sources that should be enabled

Specifies the listen port for the HTTP service that returns the status page.

The director name used by the system administrator

Whether to enable the virtual host

Must be set to a unique identifier, preferably a UUID according to RFC 4122

The path of a PEM encoded TLS private key

Defines if LDAP will be used for user authentication

Defines if OpenID Connect will be used for user authentication

Whether to enable streaming via TCP.

Path to a git repository

If specified, it defines the interface to listen on

Whether to enable Bacula Director Daemon.

The preview providers that should be explicitly enabled.

Path to the directory Traefik should watch for configuration files.

A systemd service name to use (without .service suffix).

A systemd service name to use (without .service suffix).

Netfilter mark and mask for input traffic

An attribute set that adds to named directory hash table.

Whether to enable this activity check.

A state directory used by NetBird client to store config.json, state.json & resolv.conf.

A state directory used by NetBird client to store config.json, state.json & resolv.conf.

Extra configuration for Bacula Director Daemon.

Whether to enable this wake-up check.

Job types that this runner will execute.

Enable bluemap's built-in webserver

Path to chroot into at runtime as an additional layer of protection.

Specify the port (a positive integer) on which the Director daemon will listen for Bacula Console connections

Enable Metrics.

A runtime directory used by NetBird client.

A runtime directory used by NetBird client.

Whether to enable the token service as well.

Path to the directory where data will be stored on disk.

Specifies the password that must be supplied for a Director.

DEPRECATED

Whether to enable XtreemFS DIR replication plugin.

The default logging directory

A list of additional plugins to enable if managePlugins is true.

The directory where FileBrowser stores its cache.

directory to store info about uploads

Where to store below's logs

Configuration of XtreemFS DIR replication plugin

Whether to enable proxying of remote media through the instance's proxy.

Whether to enable the bot on startup.

Enable warp routing

Common name attribute of allowed peer certificates

Turn on time zone support

Directories where static files are located.

Collectors to enable

Collectors to enable in addition to the ones that are enabled by default.

Whether to wrap the rush binary with a SUID-enabled wrapper

Where to store below's data

Collectors to enable

Log file directories.

Collectors to enable or disable

The minimal peer port to listen to for incoming connections when services.transmission.settings.peer-port-random-on-start is enabled.

Extra configuration to be passed in Messages directive.

Extra configuration to be passed in Director directive.

Whether to enable a faster, persistent implementation of use_nix and use_flake, to replace the builtin one .

Whether to enable a faster, persistent implementation of use_nix and use_flake, to replace the built-in one .

Whether to enable nix-direnv, a fast, persistent use_nix implementation for direnv.

Collectors to enable

The maximum peer port to listen to for incoming connections when services.transmission.settings.peer-port-random-on-start is enabled.

The path specifying a PEM encoded TLS CA certificate(s)

Verify peer certificate

The nix-direnv package to use

The nix-direnv package to use.

The nix-direnv package to use.

The path where the collected RPKI data is stored.

The sync mode influences how operations are committed to the disk log before the operation is acknowledged to the caller.

-ASYNC mode the writes to the disk log are buffered in memory by the operating system

Extra lines to append to the sourced direnvrc

Extra lines to append to the sourced direnvrc

Directory for storing log files.

Enable automatic transcription of videos.

Specify the directory to store database and album art cache.

Directory for storing user uploads and similar data.

Direnv configuration

Direnv configuration

Directories where template files are located.

If enabled, start the Resilio Sync daemon

Whether to enable spring loading (expose) for directories.

Artalk working directory

The directory in which Garage will store the data blocks of objects

Directory for storing temporary files.

Enable NVIDIA GPU controls for a device by index

The full path to the PEM encoded TLS certificate

Whether to enable nginx or not

Whether to delete torrents added from the services.transmission.settings.watch-dir.

Whether this filter is currently active.

If enabled, checks that Nix can parse the generated nix.conf.

Is the preview URL API enabled? If enabled, you must specify an explicit url_preview_ip_range_blacklist of IPs that the spider is denied from accessing.

Working directory of BIND.

Directory for privoxy files such as .action and .filter.

The directory in which hickory-dns should look for .zone files, whenever zones aren't specified by absolute path.

Indicates whether to allow the contents of the dataDir directory to be changed by the user at run-time

Directory to store keychains and configuration.

veilid-server will respond to Python and other JSON client requests.

The data dir for Kubo

If enabled, use TLS (encryption) over an LDAP (port 389) connection

Directory to store configuration and metadata.

This option defines Director resources in Bacula Storage Daemon.

This option defines director resources in Bacula File Daemon.

The subdirectory in which to serve cgit

Target location for Applications

List of error types to collect from the event database.

If enabled (the default), checks for data type mismatches and that Nix can parse the generated nix.conf.

If enabled (the default), checks for data type mismatches and that Nix can parse the generated nix.conf.

Authentication settings

Directories to be scanned for media files

Directory where HTML and JSON report pages are written.

Whether to enable support for Linux MD RAID arrays

Directory for privoxy template files.

Whether to enable the hiding of direnv logging .

Whether to enable the hiding of direnv logging .

Whether to enable direnv, the environment switcher.

If enabled, checks the nix.conf parsing for any kind of error

Whether to enable nginx or not

List of enabled features in order.

Paths to shared directories

Directory where chrony state is stored.

Whether to automatically use angrr before loading .envrc.

Only enabled bridges are available for feed production

vdirsyncer job configurations

Whether to enable silent mode, that is, disabling direnv logging.

Custom stdlib written to $XDG_CONFIG_HOME/direnv/direnvrc.

Directories to search for profiles, separated by , or ;.

List of group entries to configure in /etc/nsswitch.conf

TLS Options for the Director in this Configuration.

TLS Options for the Director in this Configuration.

The OAuth2 redirect URL.

When enabled Grafana will send anonymous usage statistics to stats.grafana.org

HTTP status used by globalRedirect & forceSSL

Path to the static files.

Options to add to .dir_colors file

The path of a PEM encoded TLS private key

The path of a PEM encoded TLS private key

Whether to enable mise, integration of use_mise for direnv.

The direnv package to use.

The direnv package to use.

The direnv package to use.

The InspIRCd package to use

Target location for Fonts

The directory to use for Yandex

The metadata directory, put this on a fast disk (e.g

List of passwd entries to configure in /etc/nsswitch.conf

Whether to synchronise your machine's time using ntpd, as a peer in the NTP network

Whether to enable angrr direnv integration.

Configuration written to $XDG_CONFIG_HOME/direnv/direnv.toml

End of time range to show.

This option will set "hbase.rootdir" in hbase-site.xml and determine the directory shared by region servers and into which HBase persists

path to the local directory where all files are stored

The mise package to use.

Path to bosun's ledis data dir

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

List of enabled features in order.

List of enabled features in order.

Whether to enable loading direnv in nix-shell nix shell or nix develop .

Whether to enable loading direnv in nix-shell nix shell or nix develop .

Whether to enable direnv integration

Whether to enable guests to login if auth is enabled.

Whether to enable vdirsyncer.

Whether to enable vdirsyncer.

HTTP status used by globalRedirect and forceSSL

HTTP status used by globalRedirect and forceSSL

HTTP status used by globalRedirect and forceSSL

Either a path to a certificate with a client certificate and the key or a list of paths to the files with them.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

A file path where access tokens are stored.

Null or path to certificate to verify SSL against

Whether to enable synchronization using vdirsyncer.

HTTP status used by globalRedirect and forceSSL

The user agent to report to the server

Directory where downloaded files are stored.

HTTP status used by globalRedirect & forceSSL

List of configuration directives for this UPS.

Require TLS or TLS-PSK encryption

Require TLS or TLS-PSK encryption

script-directory config, for options take a look at the documentation

Default directory to add folders in the web UI.

The path of the Searx server settings.yml file

Rule directories for the reloader to refresh.

Command to call for each item creation and modification

Directories containing files to include in the Kerberos configuration.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

Location of the state directory of charybdis.

HTTP status used by globalRedirect and forceSSL

HTTP status used by globalRedirect and forceSSL

HTTP status used by globalRedirect and forceSSL

HTTP status used by globalRedirect and forceSSL

HTTP status used by globalRedirect and forceSSL

Directory under which Actual runs and saves its data

Enable ReGreet, a clean and customizable greeter for greetd

The filesystem directory to store your table store within.

The filesystem directory to store blocks for the block store.

Whether to enable direnv integration

Start of time range to show.

The vdirsyncer package to use.

The vdirsyncer package to use.

User account to run vdirsyncer as, otherwise as a systemd dynamic user

The wrapped direnv package.

The wrapped direnv package.

group to run vdirsyncer as

If enabled, the agent attempts to install and then load an RDMA kernel driver that matches the version of the firmware on the underlying hardware.

Enables generation of split artifacts from partitions

systemd service that is enabled by default

A time range to synchronize. start and end can be any Python expression that returns a datetime.datetime object.

If enabled, produces logs with detailed messages that describes what pam_mysql is doing

Nextcloud's data storage path

Whether to enable nginx or not

With this option, you can customize an H2O virtual host which already has sensible defaults for Movim

URL to a PubSubHubbub-compatible hub server

Location where Tomcat stores configuration files, web applications and logfiles

If "ip" is given, client IP based session affinity is enabled

Kinds of items to show

The amount of time which can elapse when kexec is being executed before a watchdog hardware device will automatically reboot the system

Specifies whether vdirsyncer should request vCards in version 4.0

Spark worker work dir.

The upload limit for files

HTTP status used by globalRedirect & forceSSL

The ollama package to use

Defines the path to the data directory

Enables GnuPG network certificate management daemon with socket-activation for every user session.

A command that prints the URL of the storage.

Optional configuration file to link to use instead of the default file ($XDG_CONFIG_HOME/vdirsyncer/config).

If enabled, pam_gnupg will attempt to automatically unlock the user's GPG keys with the login password via gpg-agent

The path specifying a PEM encoded TLS CA certificate(s)

The path specifying a PEM encoded TLS CA certificate(s)

Whether to use HTTPS

Whether to enable this vdirsyncer job.

User to run under when setuid is not enabled.

Cache directory.

If enabled, NixOS will periodically update the database of files used by the locate command.

Engine statistics such as packet counters, memory use counters and others can be logged in several ways

The NATS data directory

Whether to enable new users to login if auth is enabled.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

Whether any uploads are permitted to anonymous users.

When to hide the top bar when hideTopBar is enabled.

HTTP status used by globalRedirect and forceSSL

vdirsyncer pair configurations

Where to redirect new users upon registration.

The path to the password for the specified ntfy-sh user

When enabled, a private key that is used during authentication will be added to ssh-agent if it is running (with confirmation enabled if set to 'confirm')

If enabled (the default), Nix will only download binaries from binary caches if they are cryptographically signed with any of the keys listed in nix.settings.trusted-public-keys

If enabled (the default), Nix will only download binaries from binary caches if they are cryptographically signed with any of the keys listed in nix.settings.trusted-public-keys

Attribute set of environment variables.

https://github.com/Glimesh/broadcast-box#environment-variables

The ntfy-sh user to use for authenticating with the ntfy-sh instance

Whether to enable the Keybase root redirector service, allowing any user to access KBFS files via /keybase, which will show different contents depending on the requester.

existing configuration file

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

Shell commands to run when file has changed between generations

The data dir for ipfs-cluster.

If set, all requests for this host are redirected permanently to the given URL.

If set, all requests for this host are redirected permanently to the given URL.

Whether to enable an additional input method type.

Whether to enable an additional input method type.

Group to run under when setuid is not enabled.

Path of the Neo4j home directory

HTTP status used by globalRedirect and forceSSL

HTTP status used by globalRedirect and forceSSL

HTTP status used by globalRedirect and forceSSL

HTTP status used by globalRedirect and forceSSL

HTTP status used by globalRedirect and forceSSL

HTTP status used by globalRedirect and forceSSL

HTTP status used by globalRedirect and forceSSL

Path to link apps relative to the home directory.

Path to link apps relative to the home directory.

With this option, you can customize an Nginx virtual host which already has sensible defaults for Movim

With safeExit enabled, the daemon will ask the driver to disable the WDT before exiting

The absolute path to the directory which hosts the public-inbox.

The base directory for account maildir directories

Whether to manage .dir_colors and set LS_COLORS.

If enabled, NixOS will set up a kernel that will boot on crash, and leave the user in systemd rescue to be able to save the crashed kernel dump at /proc/vmcore

Enables the in-database configuration.

https://docs.postgrest.org/en/stable/references/configuration.html#in-database-configuration

Specifies if TLS should be enabled

Specifies if TLS should be enabled

systemd timer configuration

Whether to enable nginx or not

Metadata keys that should be synchronized when vdirsyncer metasync is executed.

If enabled systemd-journald will turn on auditing on start-up

Path of the data directory

SSL port to bind to

Whether to set the XDG user dir environment variables, like XDG_DESKTOP_DIR.

This defaults to true for state version < 26.05 and false otherwise.

Shell commands to run when file has changed between generations

The directory or URI where MPD reads music from

XtreemFS home dir for the xtreemfs user.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

If set, all requests for this host are redirected permanently to the given URL.

The redirect method to use.

If enabled, start the Syncplay server.

Dirmngr configuration options

Whether vdirsyncer should produce verbose output.

HTTP status used by globalRedirect and forceSSL

The dircolors package to use.

vdirsyncer's status path

A command that prints the user name to standard output.

general configuration

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

Enabled Fcitx5 addons.

Enabled Fcitx5 addons.

Select the enabled input method

Directory where certificate and other state is stored.

Path to the TLS key for the web UI

Whether to enable the Thanos query node exposing PromQL enabled Query API with data retrieved from multiple store nodes.

HTTP status used by globalRedirect and forceSSL

The kanata package to use. ::: {.note} If danger-enable-cmd is enabled in any of the keyboards, the kanata-with-cmd package should be used. :::

HTTP status used by globalRedirect and forceSSL

IPC directory where file sockets are stored.

Allow the installation and updating of apps from the Nextcloud appstore

Log ERROR level messages only

What should happen if synchronization in one direction is impossible due to one storage being read-only

Configures the user domain, if enabled

Whether git-http-backend should only export repositories that contain a git-daemon-export-ok file

If enabled, system metrics will be sent to Linode LongView.

SMTP configuration

List of public keys used to sign binary caches

List of public keys used to sign binary caches

If set, all requests for this host are redirected permanently to the given URL.

Extra configuration options that will be added verbatim at the end of the ldap configuration file (ldap.conf(5))

Whether the HTTP service (when enabled) will decode ERIS content at /uri-res/N2R?urn:eris:

Do not persist any stateful znapzend setups

Folders which should be shared by Syncthing

Folders which should be shared by Syncthing

The path to the workdir

fangfrisch configuration

Whether to enable vdirsyncer.

Common name attribute of allowed peer certificates

Common name attribute of allowed peer certificates

Log DEBUG, INFO, WARN and ERROR messages

Peers/devices which Syncthing should communicate with

Peers/devices which Syncthing should communicate with

If Monitor is set to no, this director will have full access to this Storage daemon

If Monitor is set to no, this director will have full access to this Storage daemon

Shell commands to run when file has changed between generations

Shell commands to run when file has changed between generations

Target location for Services

The cache directory in which to store mail files while they are being downloaded

Select the enabled input method

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

Enable restrictions on the use of the well-known prefix (64:ff9b::/96) - prevents translation of non-global IPv4 ranges when using the well-known prefix

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

Extra lines added to .dir_colors file.

Iptables filters that if matched will get the packet off of redsocks.

If enabled, spacecookie will hide personal information of users like IP addresses from log output.

If enabled, protect SSH logins with Duo Security.

A shell application which will produce an nvd diff of the system closure with and without facter enabled.

Run node as a replica

If enabled, spacecookie will not print timestamps at the beginning of every log line.

HTTP status used by globalRedirect and forceSSL

Whether to enable the HTTP/2 protocol

Whether to enable the HTTP/2 protocol

Whether to enable the HTTP/2 protocol

If set, all requests for this host are redirected permanently to the given URL.

The username/email in case SMTP auth is enabled.

HTTP status used by globalRedirect and forceSSL

How often to run vdirsyncer

If true, requests in the form /~user/page.html are rewritten to take the file public_html/page.html from the home directory of the user.

vdirsyncer storage configurations

AppArmor mode for dbus.

enabled enables mediation when it's supported in the kernel, disabled always disables AppArmor even with kernel support, and required fails when AppArmor was not found in the kernel.

When enabled, configures emacsclient to be the default editor using the EDITOR environment variable.

Path to a keyfile used to unlock the backing encrypted device

Maildir configuration for this account.

Whether to enable the HTTP/2 protocol

Start the daemon automatically using XDG autostart

Whether to enable the fail2ban service

Directory to store export.

If enabled, each virtual host gets its own access.log and error.log, namely suffixed by the hostName of the virtual host.

Whether to automatically update DERP maps on a set frequency.

Prompt for login with an html login mask if enabled, otherwise prompt for basic auth (useful for SSO)

List of derivations that provide container images

When to hide the bottom bar when hideBottomBar is enabled.

If enabled, protect logins with Duo Security using PAM support.

If enabled, causes a leave action to be sent when closing consul

Configures the keyboard control behavior

Path to the TLS certificate for the web UI

Whether to enable script-directory.

A command that prints the OAuth credentials to standard output

If enabled, abbreviations will be preferred over aliases when other modules define aliases for fish.

Whether to enable swaylock

Changes the Intel Turbo feature status (1 is disabled and 0 is enabled).

The root directory for file URLs used with the Cypher LOAD CSV clause

Whether to enable XDG desktop integration

Run yes | vdirsyncer discover prior to vdirsyncer sync

The vdirsyncer package to use.

The filesystem directory to store your protected store in.

Path of the database plugin directory

Path to a keyfile used to unlock the backing encrypted device

Location of the riemann-base dir

With this option, you can customize an H2O virtual host which already has sensible defaults for Dolibarr

Whether to enable the Alot mail user agent

Require email validation before sign up completes.

If enabled, the agent creates a swap file (/swapfile) on the resource disk and adds it to the system swap space

Whether to enable the HTTP/2 protocol

Whether to enable the HTTP/2 protocol

Whether to enable the HTTP/2 protocol

Whether to enable the HTTP/2 protocol

Whether to enable the HTTP/2 protocol

The TLS mode to use

Unix command socket that can be used to pass commands to Suricata

What interface to use for hardware acceleration.

• null: default behavior
  • if nixpkgs.config.rocmSupport is enabled, uses "rocm"
  • if nixpkgs.config.cudaSupport is enabled, uses "cuda"
  • otherwise defaults to false
• false: disable GPU, only use CPU
• "rocm": supported by most modern AMD GPUs
  • may require overriding gpu type with services.ollama.rocmOverrideGfx if rocm doesn't detect your AMD gpu
• "cuda": supported by most modern NVIDIA GPUs

Shell commands to run when file has changed between generations

A shell application which will produce a nix-diff of the system closure with and without facter enabled.

The list of hostnames and/or IP addresses from which the Mailman Web UI will accept requests

Define the client configurations

Whether to disable send and accept redirects for all network interfaces

A directory that should contain the policy files, used to customize Botan’s behaviour when negotiating the TLS connections with the IRC servers.

Key bindings for actkbd

Path to maildir directory where mail for this account is stored

The cache allows tarsnap to identify previously stored data blocks, reducing archival time and bandwidth usage

If set, all requests for this host are redirected permanently to the given URL.

With this option, you can customize an nginx virtualHost which already has sensible defaults for Matomo

Verify peer certificate

Verify peer certificate

List of enabled daemon modules

Directories containing files to include in the Kerberos configuration.

The script-directory package to use.

Enable gitolite management under the gitolite user

Whether to enable starting the POP3 listener (when Dovecot is enabled).

Whether to periodically upgrade NixOS to the latest version

Whether the nix-channel command and state files are made available on the machine

If enabled, starts a Minetest Server.

The hostname at which you wish firefly-iii to be served

Enables the use of the ~/.ssh/authorized_keys file

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

If set, Nix will perform builds in a sandboxed environment that it will set up automatically for each build

If we should send notifications to the desktop

Whether to enable the beets music library manager

Target location for Preference Panes

Target location for QuickLook Plugins

Whether to enable starting the IMAP listener (when Dovecot is enabled).

Whether to enable starting the LMTP listener (when Dovecot is enabled).

Enables routing of QUIC packets using eBPF

The fan type, can be hwmon for standard fans,

atasmart to read the temperature via S

HTTP status used by globalRedirect and forceSSL

Whether to enable NVIDIA Optimus support using the NVIDIA proprietary driver via PRIME

A directory where vdirsyncer will store some additional data for the next sync

Controls Link-Local Multicast Name Resolution support (RFC 4795) on the local host

With this option, you can customize an nginx virtual host which already has sensible defaults for Pixelfed

If an Anonymous keyword is present, then anonymous proxying is enabled

Run bitbox-bridge.service only when hardware wallet is plugged, also registers the systemd device unit

If set, all requests for this host are redirected permanently to the given URL.

What interface to use for hardware acceleration

If enabled, the pam_umask module will be loaded.

The path to the upperdir

With this option, you can customize an NGINX virtual host which already has sensible defaults for Kanboard

Whether to enable compressed feature which adds the options -Lce to the zfs send command

Whether the nix-channel command and state files are made available on the machine

Specifies the device to use for hardware acceleration.

• cpu: no acceleration just use the CPU
• rocm: supported by modern AMD GPUs
• cuda: supported by modern NVIDIA GPUs
• metal: supported on darwin aarch64 machines

Tabby will try and determine what type of acceleration that is already enabled in your configuration when acceleration = null.

• nixpkgs.config.cudaSupport
• nixpkgs.config.rocmSupport
• if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64

IFF multiple acceleration methods are found to be enabled or if you haven't set either cudaSupport or rocmSupport you will have to specify the device type manually here otherwise it will default to the first from the list above or to cpu.

The list of path(s) to the lowerdir(s)

If set, all requests for this host are redirected permanently to the given URL.

On startup, the baseDir directory is populated with various files, subdirectories and symlinks

Whether to use TLS.

If enabled, starts a Terraria server

Whether the LDAP Server is an Active Directory.

pattern of a directory structure locally and on s3

Automatic backup of important data to a AWS S3 (or compatible) instance

If enabled, disables all logging.

If enabled, disables all logging.

Sets the send events mode to disabled, enabled, or disabled-on-external-mouse

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

Enables or disables the laptop keyboard's Function (Fn) lock at boot

List of filesystem paths to archive.

A command that prints the OAuth credentials to standard output

If set, all requests for this host are redirected permanently to the given URL.

HTTP status used by globalRedirect and forceSSL

Additional command-line arguments passed verbatim to udhcpc if boot.initrd.network.enable and boot.initrd.network.udhcpc.enable are enabled.

Port LDAP is accessible on.

Only applies if ssl_enable is activated

Only applies if ssl_enable is activated

Only applies if ssl_enable is activated

With this option, you can customize an nginx virtual host which already has sensible defaults for radicle-httpd

If enabled, users are created with systemd-sysusers instead of with the custom update-users-groups.pl script

Whether to enable Homebrew to generate lockfiles when you manually invoke brew bundle [install]

Whether to enable the HTTP/2 protocol

If enabled, starts the ArchisSteamFarm service

This option lists the machines to be used if distributed builds are enabled (see nix.distributedBuilds)

This option lists the machines to be used if distributed builds are enabled (see nix.distributedBuilds)

This option lists the machines to be used if distributed builds are enabled (see nix.distributedBuilds)

The upload limit for files

The directories from which plugins should be loaded

With this option, you can customize an nginx virtual host which already has sensible defaults for Dolibarr

If enabled, checks all masters for the last zone version

Whether to enable the Blueman applet

Specifies the password that must be supplied for the default Bacula Console to be authorized

Specifies the password that must be supplied for the default Bacula Console to be authorized

Whether to periodically upload logs to QRZ

Whether to enable nginx virtual host that will serve the javascript application and act as a proxy for the XMPP server

User to run the program.

Sync users.

Plugin directory paths

Path to the postgres socket directory

If enabled, the generated nftables rule set will be owned exclusively by firewalld

The directory where MPD stores playlists

Name of the config adapter to use

List of services entries to configure in /etc/nsswitch.conf

Whether to periodically update the DOK resource file

If enabled the automatic login will only happen in the first tty once per boot

Root path for LDAP.

The directory where old plugin versions and conflicting plugins should be moved

Options for configuring workers

Whether or not the whitelist (in whitelist.json) shoud be enabled

The Nginx status page URL

The directory where uploaded new plugins should be stored.

Whether to enable the HTTP/2 protocol

Whether to enable the HTTP/2 protocol

Whether to enable the HTTP/2 protocol

Whether to enable the HTTP/2 protocol

Whether to enable the HTTP/2 protocol

Whether to enable the HTTP/2 protocol

Whether to enable the HTTP/2 protocol

Exclude all non-globally-routable IPs from redsocks

The collections to synchronize between the storages.

User directory, relative to root.

If set, all requests for this host are redirected (defaults to 301, configurable with redirectCode) to the given hostname.

additional groups to add the dynamic user to

Whether to use STARTTLS.

Whether to periodically update the SOTA database

Whether to periodically update the WWFF database

Whether to exit the shell when Zellij exits after being autostarted

HTTP status used by globalRedirect and forceSSL

Run everything in one thread inside the worker process

If enabled, this will replace the FAIL_DELAY setting from login.defs

Whether to periodically upload logs to LoTW

Whitelisted players, only has an effect when services.mchprs.declarativeWhitelist is true and the whitelist is enabled via services.mchprs.whitelist.enable

Whether to enable Neovim

If enabled, the Crossfire game server will be started at boot.

Absolute path to the password store

Whether to enable the Etebase server

Specifies whether the web interface is enabled.

Group directory, relative to root.

The directory where the skeleton files are located

If enabled, the generated destination NAT (DNAT) rules will NOT accept traffic that was DNAT'd by other entities, e.g. docker

If enabled Rsync will be socket-activated rather than run persistently.

The full path to the PEM encoded TLS certificate

The full path to the PEM encoded TLS certificate

Whether to sync ldap groups into BitWarden.

When enabled, will automatically register the "brscan4" sane backend and bring configuration files to their expected location.

The Apache status page URL

Whether to allow editing the kernel command-line before boot

A file containing the secret used to encrypt secrets for OTP tokens

If enabled, systemd will always respawn dnsmasq even if shut down manually

Enabled IBus engines

Whether to generate SSH host keys

Whether to enable this .link unit

Whether to enable Zsh integration .

Whether to enable Zsh integration .

The domain the Bitwarden/Vaultwarden is accessible on.

Directory where Akkoma will put uploaded files.

LDAP filter for users.

Forcibly import the ZFS root pool(s) during early boot

Whether to enable Bitwarden Directory Connector.

List of hosts entries to configure in /etc/nsswitch.conf

Whether to enable nftables and use nftables based firewall if enabled. nftables is a Linux-based packet filtering framework intended to replace frameworks like iptables

Whether to let the nslcd daemon (nss-pam-ldapd) handle the LDAP lookups for NSS and PAM

If enabled, virtual users will use the same privileges as local users

Whether to enable Zsh integration.

Whether to enable the HTTP/2 protocol

If enabled, the Nix store in the VM is made writable by layering an overlay filesystem on top of the host's Nix store

Options to configure the LDAP connection

Options to configure what gets synced

The sensor type, can be hwmon for standard sensors,

atasmart to read the temperature via S

If enabled, start a Minecraft Server

Whether to enable Bash integration .

Whether to enable Fish integration .

Whether to enable Bash integration .

Whether to enable Fish integration .

List of shadow entries to configure in /etc/nsswitch.conf

Enables Uber's USSH PAM (pam-ussh) module

List of attribute sets containing configuration for each domain

If true, a system-wide PipeWire service and socket is enabled allowing all users in the "pipewire" group to use it simultaneously

Whether to enable Whether add CAP_NET_BIND_SERVICE to the tunnel service, this should be enabled if you want to bind port < 1024.

The path to the file with the password in case SMTP auth is enabled.

If enabled, validates the generated config file.

LDAP filter for groups.

Additional listeners to start when Dovecot is enabled.

Whether to enable Fish integration.

Whether to enable Bash integration.

List of Thunderbird profiles for which this account should be enabled

Path to file that contains LDAP password for user in {option}`ldap.username

When enabled, configures VSCode to be the default editor using the EDITOR environment variable.

Requires libunwind to be available when Suricata is configured and built

Suffix for the email, normally @example.com.

Enable if you are syncing more than 2000 users/groups.

Whether to enable the HTTP/2 protocol

Whether to configure nginx as a reverse proxy for Invidious

Whether to enable the HTTP/2 protocol

Set to false to remove all feedback links from the UI.

When enabled, instructs udisks2 to mount removable drives under /media/ directory, instead of the default, ACL-controlled /run/media/$USER/

Additional plugins dir used to configure nomad.

Whether the LDAP server paginates search results.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Enables support for IEEE 802.11n (WiFi 4, HT)

Whether to periodically update the list of LoTW users

Whether to propagate the legacy options under services.znc.confOptions.* to the znc config

Additional arguments passed to initdb during data dir initialisation.

Additional arguments passed to initdb during data dir initialisation.

List of source directories and files to backup

The bitwarden-directory-connector-cli package to use.

Whether to enable Xonsh integration .

Whether to configure the postgresql database for part-db

The option is dictated by the plugin

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

The user to authenticate as.

Enabled safe options

Class that users must have.

The host the LDAP is accessible on.

Initialization commands to run when completion is enabled.

If Notifications are enabled and an expiry date is set, warn 5 days before expiry

Whether to enable Allow the system to forward packets from easytier

Explicitly install extras provided by matrix-synapse

When enabled, installs neovim and configures neovim to be the default editor using the EDITOR environment variable.

Whether to enable opening the HTTP server port and, if enabled, the HTTPS redirect server port in the firewall. .

Themes to add for Vencord, they can be enabled by setting programs.vesktop.vencord.settings.enabledThemes to [ "THEME_NAME.css" ]

Configuration for ZNC, see https://wiki.znc.in/Configuration for details

Enable CIS Hardening for RKE2

Enables or disables drag lock during tapping behavior

Whether to enable NVIDIA Optimus support using the NVIDIA proprietary driver via reverse PRIME

The hostname at which you wish privatebin to be served

If enabled, the configured environment will be translated to native fish using babelfish

If enabled, the configured environment will be translated to native fish using babelfish

Dynamic configuration files to write

Whether to enable the security plugin, plugins.security.ssl.transport.keystore_filepath or plugins.security.ssl.transport.server.pemcert_filepath and plugins.security.ssl.transport.client.pemcert_filepath must be set for this plugin to be enabled.

Target location for Dictionaries

A class that groups will have.

Sets the send events mode to disabled, enabled, or disabled-on-external-mouse

Enable or disable TLS

Path to a list of ini file containing confidential settings such as credentials

Whether to enable the HTTP/2 protocol

By default sidebar shows the full path of the mailbox, but with this enabled only the relative name is shown.

Add network connectivity support to initrd

Target location for Spotlight Plugins

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Path to the data dir fedimintd will use to store its data

Whether to enable the HTTP/2 protocol

The address Anubis' metrics server listens to

Whether to initialise non‐existent secrets with random values

A port to serve DNS entries on when dns-resolver.address is enabled.

A port to serve DNS entries on when dns-resolver.address is enabled.

List of sudoers entries to configure in /etc/nsswitch.conf

Ignore the user configures. Warning: When this is enabled, the user config files are totally ignored and the user dict can't be saved and loaded.

Ignore the user configures. Warning: When this is enabled, the user config files are totally ignored and the user dict can't be saved and loaded.

Authentication settings

Automatically enable the apps in services.nextcloud.extraApps every time Nextcloud starts

List of Thunderbird profiles for which this account should be enabled

Storage quota for the repository

Whether to synchronize Maildir flags.

The interval when to run the connector

If enabled srun will accept the option "--x11" to allow for X11 forwarding from within an interactive session or a batch job

Whether to periodically upload logs to Clublog

Whether to periodically prune gitlab runner's Docker resources

Directory of static files

Target location for VST Plugins

Default working directory for server (server-working-dir in rserver.conf).

Path to the file containing the password for the root user if auth is enabled.

Allow the service to create and use its own config file inside the dataDir as configured by services.mediatomb.dataDir

Bulk PDF import from consume directory

Name of HTTP request header used for dynamic prefixing of UI links and redirects

Directory that holds the TSM node's password information.

When enabled, the stargazer process will be given CAP_SETGID and CAP_SETUID so that it can run cgi processes as a different user

Define a lower and upper time value (in HH:MM format) which constitute a time window during which reboots are allowed after an upgrade

Whether to periodically update the Clublog SCP database

If a Store doesn't send any data in this specified duration then a Store will be ignored and partial data will be returned if it's enabled. 0 disables timeout

If enabled, a Fontconfig configuration file will be built pointing to a set of default fonts

When enabled, will automatically register the "dsseries" SANE backend

Optional

Whether to run shellcheck on the generated scripts for systemd units

List of forwarded ports from the external interface to internal destinations by using DNAT

The meilisearch package to use

End of time range to show.

Whether to open the firewall ports for Reposilite

If enabled, pam_wallet will attempt to automatically unlock the user's default KDE wallet upon login

Whether to enable U2F support in the i3lock program

List of Thunderbird profiles for which this account should be enabled

The DankMaterialShell package to use for the greeter

The systemd target that will automatically start ashell

Whether to enable intra-zone forwarding

Authentication settings

If a user has no email address, combine a username prefix with a suffix value to form an email.

Whether to enable Nushell integration.

Remove users from bitwarden groups if no longer in the ldap group.

Name of HTTP request header used for dynamic prefixing of UI links and redirects

Plugins to enable

Enable billing Cron-Jobs on the local instance

Some servers have invalid or self-signed certificates

Maximum estimated error threshold for the rtcautotrim command

Either a path to a certificate with a client certificate and the key or a list of paths to the files with them.

If GitLab container registry should be enabled by default for projects.

Whether to enable hardware accelerated graphics drivers

Atomically update the host OS, container images, portable service images or other sources

Whether to enable synchronization using vdirsyncer.

A file path where access tokens are stored.

Null or path to certificate to verify SSL against

0 to disable four finger vertical swipe gestures, 2 to enable (down for Mission Control, up for App Exposé)

Whether the service should be reloaded during a NixOS configuration switch if its definition has changed

If enabled, periodically check the journal with journalwatch and report the results by mail.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Check redirects for manualHTML.

The user agent to report to the server

Conditions to make outbound packets go through this redsocks instance

Whether to clear the configuration of the interfaces that were set up in the initrd right before stage 2 takes over

Command to call for each item creation and modification

Start of time range to show.

Directory to write the output to.

The pathname of the IMAP configuration directory.

Auto-detected URLs can be clicked on to open them in your browser

Attribute for a name of group.

Attribute for a users email.

If inspectHttps is enabled, the time generated HTTPS certificates will be stored in a temporary directory for reuse

When IPv6 is enabled with SLAAC, this option controls the use of temporary address (aka privacy extensions) on this interface

Enables middle button emulation

End of time range to show.

Whether to enable Zsh integration.

Attribute that lists members in a LDAP group.

What to do in case of a conflict between the storages

Additional Munin plugins to activate

Whether this account is enabled

Whether or not SSL verification should be enabled for outgoing connections to the homeserver.

Allow localhost redirects

The hostname at which you wish firefly-iii-data-importer to be served

Target location for Color Pickers

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

A time range to synchronize. start and end can be any Python expression that returns a datetime.datetime object.

Environment variables which are read by healthchecks (local)_settings.py

Whether the service should be reloaded during a NixOS configuration switch if its definition has changed

Kinds of items to show

Specifies whether vdirsyncer should request vCards in version 4.0

Whether to enable Bash integration.

Whether to enable Fish integration.

Enables settings required for NetBird's routing features: Network Resources, Network Routes & Exit Nodes

Enable automatic config reload on config change

Set of paths that should be intercepted and rewritten while checking the ruleset using pkgs.buildPackages.libredirect.

Whether to enable the HTTP/2 protocol

Either a path to a certificate with a client certificate and the key or a list of paths to the files with them.

Provides a custom seed for the RANDSTRUCT security option of the Linux kernel

Null or path to certificate to verify SSL against

Whether to enable synchronization using vdirsyncer.

A file path where access tokens are stored.

Target location for VST3 Plugins

A command that prints the URL of the storage.

PostgreSQL package to use

The package that provides the 32-bit driver set

Enables or disables drag lock during tapping behavior

The user agent to report to the server

Whether to enable Homebrew to automatically use the Brewfile that this module generates in the Nix store, when you manually invoke brew bundle

Whether to enable render offload support using the NVIDIA proprietary driver via PRIME

Environment variables to set for the service

Enables MOBIKE on IKEv2 connections

Environment variables which are read by healthchecks (local)_settings.py

Start of time range to show.

Command to call for each item creation and modification

Whether to give the container its own private UIDs/GIDs space (user namespacing)

Whether to enable Hyprlock, Hyprland's GPU-accelerated lock screen utility

The attribute that contains the users username.

In direct boot situations, you may want to influence the initrd to load to use your own customized payload

Directory for storing certificates to be used by Neo4j for TLS connections

Whether to enable nginx reverse proxy for derper

Unless enabled, encryption keys can be easily recovered by an attacker with physical access to any machine with PCMCIA, ExpressCard, ThunderBolt or FireWire port

When not set to null this option defines the path at which the unbound remote control socket should be created at

Additional Munin plugins to autoconfigure, using munin-node-configure --suggest

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

A time range to synchronize. start and end can be any Python expression that returns a datetime.datetime object.

Whether to enable git integration for difftastic

Whether to enable tournament mode

If enabled, pam_gnome_keyring will attempt to automatically unlock the user's default Gnome keyring upon login

Kinds of items to show

DEPRECATED, use driverOptions

If enabled, allow principal names containing (.) dots

Specifies whether vdirsyncer should request vCards in version 4.0

Attribute set of paths whose content is copied to the extensions subdirectory of the MediaWiki installation and enabled in configuration

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Metadata keys that should be synchronized when vdirsyncer metasync is executed.

Address to access the nginx status page

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Whether to use sign the limine binary with sbctl.

Location of the dir with main.css CSS file

A command that prints the URL of the storage.

Remove and re-add users/groups, See https://bitwarden.com/help/user-group-filters/#overwriting-syncs for more details.

Opens up the erlang distribution port of all enabled components to allow reaching the server cluster from the internet

Path to a file containing the idm admin password for kanidm

Whether to enable the HTTP/2 protocol

Whether to enable the systemd-networkd-wait-online service.

systemd-networkd-wait-online can timeout and fail if there are no network interfaces available for it to manage

A command that prints the user name to standard output.

If set to false, run lightdm in greeterless mode

Attribute that lists a user's creation date.

Plugins to add to the environment of MediaGoblin

What should happen if synchronization in one direction is impossible due to one storage being read-only

Command line options for pg_dump

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Use Apple Watch for sudo authentication, for devices without Touch ID or laptops with lids closed, consider using this

Database settings will be reset to the value set in this module if this is not enabled

Set environment path of systemd to include the current system's bin directory

Whether to enable Nushell integration.

Metadata keys that should be synchronized when vdirsyncer metasync is executed.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Target location for Screen Savers

Target location for Input Methods

Shared folder list

Whether to consider the network online when any interface is online, as opposed to all of them

This option implements Override local DNS as it is not yet implemented in Tailscaled-on-macOS

When recursive is enabled, adds -ignorelinks flag to lndir

It causes lndir to not treat symbolic links in the source directory specially

A command that prints the user name to standard output.

A command that prints the OAuth credentials to standard output

Enables middle button emulation

Whether to enable the HTTP/2 protocol

Allow clients to create repositories in subdirectories of the specified path

What should happen if synchronization in one direction is impossible due to one storage being read-only

Whitelisted players, only has an effect when services.minecraft-server.declarative is true and the whitelist is enabled via services.minecraft-server.serverProperties by setting white-list to true

Whether to invert the icmp block handling

Determines whether to check for release version mismatch between Home Manager and Nixpkgs

When recursive is enabled, adds -ignorelinks flag to lndir

It causes lndir to not treat symbolic links in the source directory specially

Command to send a mail

Group under which the postfix exporter shall be run

The path specifying a PEM encoded TLS CA certificate(s)

The path specifying a PEM encoded TLS CA certificate(s)

Will place a separate image per screen when enabled, otherwise a single image will be stretched across all screens.

Set the $HYPRSHOT_DIR environment variable to the given location

Path to a keyfile used to unlock the backing encrypted device

Whether the Mattermost config.json is writeable by Mattermost

Elasticsearch host

Whether to enable the systemd-networkd-wait-online service.

systemd-networkd-wait-online can timeout and fail if there are no network interfaces available for it to manage

A command that prints the OAuth credentials to standard output

When recursive is enabled, adds -ignorelinks flag to lndir

It causes lndir to not treat symbolic links in the source directory specially

When recursive is enabled, adds -ignorelinks flag to lndir

It causes lndir to not treat symbolic links in the source directory specially

Names of backends which are enabled by default but should be disabled

Whether the config should be checked at build time

Additional PHP extensions to use for Nextcloud

Enable running shellcheck on the generated scripts for this unit

A command that prints the OAuth credentials to standard output

Logs dropped packets failing the reverse path filter test if the option networking.firewall.checkReversePath is enabled.

Directory below /var/lib to store metrics

HMAC-SHA-256 is used with 128-bit truncation with IPsec

Connection string to postgresql in the [rust postgres crate config format](https://docs.rs/postgres/latest/postgres/config/struct

Whether to enable git integration for riff

Additional packages to generate completions from, if programs.fish.generateCompletions is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Whether to consider the network online when any interface is online, as opposed to all of them

Whether to attach to the default session after being autostarted if a Zellij session already exists

Additional units shipped with systemd that shall be enabled.

Whether generation of Diffie-Hellman parameters should be stateful or not

Whether to enable git integration for delta

When recursive is enabled, adds -ignorelinks flag to lndir

It causes lndir to not treat symbolic links in the source directory specially

The systemd target that will automatically start quickshell

The collections to synchronize between the storages.

Enabled collectors

Directory separator for mapping notmuch tags to maildirs.

The Quickshell package to use for the greeter

Enables settings required for Tailscale's routing features like subnet routers and exit nodes

Required for some non-Amazon S3 implementations

The Wayland compositor to run the greeter in

Whether all users can write to the consumption dir.

A command that prints the OAuth credentials to standard output

Whether to enable protontricks, a simple wrapper for running Winetricks commands for Proton-enabled games.

Whether to enable automatic client password generation

Whether to enable msmtp

Whether to enable Zsh integration

Whether to enable Bash integration

Whether to enable Fish integration

Enable running shellcheck on the generated scripts for this unit

Hosts for which git-credential-keepassxc is enabled.

The path of a directory which contains a custom landing page.

The path to the workdir

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Whether to enable Whether video acceleration (VA-API) should be enabled. .

If enabled, the virtual machine will provide a EFI boot manager. useEFIBoot is ignored if useBootLoader == false.

Whether to make sshd look up authorized keys from SSS

When enabled, the clock indicator (which by default is the colon) will flash on and off each second

Command to send a mail

Additional units shipped with systemd that shall be enabled.

The collections to synchronize between the storages.

The activation scripts blocks to run when activating a Home Manager generation

Whether to enable the Firefox Sync storage service

Which pinentry package to use

If enabled, when NIX_SSL_CERT_FILE is set on the host, pass the CA certificates from the host to the VM.

Whether to enable git integration for diff-so-fancy

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Whether to enable Bash completion for all interactive Bash shells

Whether or not SSL verification should be enabled for outgoing connections to the homeserver.

Whether to enable Homebrew to auto-update itself and all formulae when you manually invoke commands like brew install, brew upgrade, brew tap, and brew bundle [install]

Whether to enable git integration for patdiff

ChronyServerAddress of the chrony server side command port. (Not enabled by default.) Defaults to the local unix socket.

If enabled for legacy MBR VMs, the VM image will have a separate boot partition mounted at /boot. useBIOSBoot is ignored if useEFIBoot == true.

The compression level used when compression is enabled. gzip accepts levels 1 to 9. zstd accepts levels 1 to 19.

Enables lxd to use zfs as a storage for containers

The manual pages to generate caches for if documentation.man.generateCaches is enabled

The path to the upperdir

The package that provides the system-wide resolvconf command

Optional

Whether to create symlinks to the system generations under /boot

The list of path(s) to the lowerdir(s)

Whether to enable automatic generation and persistence of keys

The credentials to access the web interface, in case authentication is enabled, in the format username:hash

If enabled, causes the following behavior:

• Passes the --ephemeral flag to the runner configuration script
• De-registers and stops the runner with GitHub after it has processed one job
• Restarts the service after its successful exit
• On start, wipes the state directory and configures a new runner

You should only enable this option if tokenFile points to a file which contains a personal access token (PAT)

Whether to allow other versions of PostgreSQL than the recommended one

Whether the automatically provisioned Elasticsearch instance should be added as a grafana datasource

Warn if Notmuch is not also enabled for this account

When set to false, disables checking for new versions of Grafana from Grafana's GitHub repository

Determines whether a process should detect changes to the configuration file since it was last read

Collectors to disable which are enabled by default.

Whether this interface should be configured with DHCP

If networking.firewall.logRefusedPackets and this option are enabled, then only log packets specifically directed at this machine, i.e., not broadcasts or multicasts.

Whether to overwrite Jellyfin's encoding.xml configuration file on each service start

Install the SPICE USB redirection helper with setuid privileges

Warn if Notmuch is not also enabled for this account

Collectors to disable which are enabled by default.

Whether to set up and configure an nginx virtual host according to upstream's recommendations

Mount nvidia-docker-1 directories on containers: /usr/local/nvidia/lib and /usr/local/nvidia/lib64.

What to do in case of a conflict between the storages

Optional

Whether to enable jujutsu integration for delta

Path to file that contains Client ID.

Enable per-CPU CHILD_SAs

Collectors to disable from the list of collectors that are enabled by default.

Which codecs to enable for hardware encoding. h264 is always enabled.

When enabled, force overwriting of the Atuin configuration file ($XDG_CONFIG_HOME/atuin/config.toml)

Whether to enable the --fakeroot support of Singularity/Apptainer

Whether to enable IPv6 Privacy Extensions for interfaces not configured explicitly in networking.interfaces._name_.tempAddress

If set, users with enabled Google Authenticator (created ~/.google_authenticator) will be required to provide Google Authenticator token to log in.

Collectors to enable or disable

What to do in case of a conflict between the storages

The system-wide memory allocator

Whether to persist metrics to a file

If enabled, causes the following behavior:

• Passes the --ephemeral flag to the runner configuration script
• De-registers and stops the runner with GitHub after it has processed one job
• On stop, systemd wipes the runtime directory (this always happens, even without using the ephemeral option)
• Restarts the service after its successful exit
• On start, wipes the state directory and configures a new runner

You should only enable this option if tokenFile points to a file which contains a personal access token (PAT)

By default, all allowed IPs and subnets are comma-separated in the allowed_ips field

Whether to enable kernel modesetting when using the NVIDIA proprietary driver

Whether to periodically prune Podman resources

Whether to periodically prune Docker resources

Whether to run QEMU with a graphics window, or in nographic mode

An attribute set of option values passed to rclone mount

Whether to enable Starship's transient prompt feature in fish shells

When enabled dockerd is started on boot

Target location for Internet Plugins

Name of the voice model to use

Whether to enable loading the wireless regulatory database at boot.

Collectors to disable which are enabled by default

Override the default working directory for the container.

Whether to enable git integration for diff-highlight

Type of 9p cache to use when mounting host nix store. "none" provides no caching. "loose" enables Linux's local VFS cache. "fscache" uses Linux's fscache subsystem

If enabled, lowerdir, upperdir and workdir will be prefixed with /sysroot

If enabled, sets the ATH_USER_REGD kernel config switch to true to disable the enforcement of EEPROM regulatory restrictions for ath drivers

If enabled, copies the NixOS configuration file (usually /etc/nixos/configuration.nix) and symlinks it from the resulting system (getting to /run/current-system/configuration.nix)

When enabled, alerts will be tried to dispatch with an error message regarding faulty templating or missing fields to help debugging.

Whether to enable four-finger pinch gesture (spread shows the Desktop, pinch shows the Launchpad): 0 to disable, 2 to enable

When enabled, alerts are presented in HTML format and include colorized status (FIR|RES), alert start time, and a link to the generator of the alert.

When using the SLiRP user networking (default), this option allows to forward ports to/from the host/guest.

Encrypt swap device with a random key

Change the paths where mandoc makewhatis(8)generates the manual page index caches. documentation.man.generateCaches should be enabled to allow cache generation

When enabled, n8n sends notifications of new versions and security updates.

Whether to enable three-finger vertical swipe gesture (down for Mission Control, up for App Exposé): 0 to disable, 2 to enable

Path to file that contains Client Secret.

If this option is enabled, the guest will be isolated, i.e. it will not be able to contact the host and no guest IP packets will be routed over the host to the outside

Whether to use NetworkManager to obtain an IP address and other configuration for all network interfaces that are not manually configured

Target location for Audio Unit Plugins

The client TLS security level.

https://www.postfix.org/postconf.5.html#smtp_tls_security_level

Configure the launchd agent to manage the AeroSpace process

Enable IPComp compression before encryption

List of source directories and files to backup

Set syntax highlighters

Whether to include the build closure of the whole system in its runtime closure

Whether to enable "Natural" scrolling direction

The name of the connection to mediate this connection through

Whether to generate Device Tree-related directives in the extlinux configuration

Whether to enable killing of processes which have an AppArmor profile enabled (in security.apparmor.policies) but are not confined (because AppArmor can only confine new processes)

XFRM interface ID set on inbound policies/SA, can be overridden by child config, see there for details

Configure whether HTTP requests follow HTTP 3xx redirects

Configure whether HTTP requests follow HTTP 3xx redirects

Number of seconds we're willing to wait for a guest to shut down

When enabled, programs.floorp.profiles.<profile>.extensions.settings.<extensionID>.permissions must specify the exact set of permissions that the extension will request

Custom ordering of accounts and local folders in Thunderbird's folder pane

Runs container in ephemeral mode with the empty root filesystem at boot

Custom ordering of calendar accounts

Whether to assign predictable names to network interfaces

XFRM interface ID set on outbound policies/SA, can be overridden by child config, see there for details

If this attribute is given, SAE-PK will be enabled for this connection

Encrypt swap device with a random key

Configure whether HTTP requests follow HTTP 3xx redirects

Configure whether HTTP requests follow HTTP 3xx redirects

When enabled, programs.firefox.profiles.<profile>.extensions.settings.<extensionID>.permissions must specify the exact set of permissions that the extension will request

If not null and --rga-accurate is enabled, mime type matching is used instead of file name matching

If enabled, the boot disk of the virtual machine will be formatted and mounted with the default filesystems for testing

Configure whether HTTP requests follow HTTP 3xx redirects

Configure whether HTTP requests follow HTTP 3xx redirects

Configure whether HTTP requests follow HTTP 3xx redirects

Configure whether HTTP requests follow HTTP 3xx redirects

Send certificate request payloads to offer trusted root CA certificates to the peer

When set to false, disables checking for new versions of installed plugins from https://grafana.com

When enabled, programs.librewolf.profiles.<profile>.extensions.settings.<extensionID>.permissions must specify the exact set of permissions that the extension will request

XFRM interface ID set on inbound policies/SA

When enabled, the container is automatically started on boot

Configure whether HTTP requests follow HTTP 3xx redirects

Set to true if you want to enable HTTP Strict-Transport-Security (HSTS) response header

When enabled, the user must authorize requested permissions for all extensions from programs.floorp.profiles.<profile>.extensions.packages in programs.floorp.profiles.<profile>.extensions.settings.<extensionID>.permissions

When enabled, the user must authorize requested permissions for all extensions from programs.firefox.profiles.<profile>.extensions.packages in programs.firefox.profiles.<profile>.extensions.settings.<extensionID>.permissions

XFRM interface ID set on outbound policies/SA

Configure whether HTTP requests follow HTTP 3xx redirects

Configure whether HTTP requests follow HTTP 3xx redirects

Configure whether HTTP requests follow HTTP 3xx redirects

Netfilter mark and mask for output traffic

If enabled, lowerdir, upperdir and workdir will be prefixed with /sysroot

If enabled, continuwuity will send a simple GET request periodically to https://continuwuity.org/.well-known/continuwuity/announcements for any new announcements made.

When enabled, the user must authorize requested permissions for all extensions from programs.librewolf.profiles.<profile>.extensions.packages in programs.librewolf.profiles.<profile>.extensions.settings.<extensionID>.permissions

Authentication to expect from remote

Configure whether HTTP requests follow HTTP 3xx redirects

Netfilter mark applied to packets after the inbound IPsec SA processed them

Periodically re-execute the wg utility every this many seconds in order to let WireGuard notice DNS / hostname changes

Netfilter mark applied to packets after the outbound IPsec SA processed them

Configure whether HTTP requests follow HTTP 3xx redirects

Authentication to perform locally.

• The default pubkey uses public key authentication using a private key associated to a usable certificate.
• psk uses pre-shared key authentication.
• The IKEv1 specific xauth is used for XAuth or Hybrid authentication,
• while the IKEv2 specific eap keyword defines EAP authentication.
• For xauth, a specific backend name may be appended, separated by a dash

Additionally enable the recommended set of pairwise ciphers

Configure whether HTTP requests follow HTTP 3xx redirects

Declaratively define NetworkManager profiles

Set to true to enable HSTS preloading option

Set to true to enable HSTS includeSubDomains option

Sets how long a browser should cache HSTS in seconds