Certificate file for client cert authentication to the server.

The file mode creation mask for Aria2 service

Whether to assign user roles based on the user's LDAP group memberships

Data directory for OpenSearch

List of certificate policy OIDs the peer's certificate must have

Instead of synchronizing just the mailboxes that match the farPattern, use it as a prefix which is not matched against the patterns, and is not affected by mailbox list overrides.

Enable CIS Hardening for RKE2

A set that will be generated into configuration file, see the SmartDNS README for details of configuration parameters

Key file for client cert authentication to the server.

The user borg serve is run as

If true, a system-wide PipeWire service and socket is enabled allowing all users in the "pipewire" group to use it simultaneously

Whether to enable lemurs, a customizable TUI display/login manager.

IMAP4 patterns for which mailboxes on the remote mail server to sync

Key file for client cert authentication to the server.

Certificate file for client cert authentication to the server.

If true, allow all clients, do not check client cert subject.

Name for where mail coming from the remote (far) mail server will end up locally

All listed users will become part of the firezone-client group so they can control the tunnel service

Send certificate request payloads to offer trusted root CA certificates to the peer

Tells fish to run this function when the job with the specified group ID exits

Defines the base URI for the Hash and URL feature supported by IKEv2

Enable hardened VirtualBox, which ensures that only the binaries in the system path get access to the devices exposed by the kernel modules instead of all users in the vboxusers group.

Key file for client cert authentication to the server.

The user and group to run nebula-lighthouse-service as.

Name is used as a suffix for the service name, user, and group

When a job dies, launchd kills any remaining processes with the same process group ID as the job

List of groups to allow access to this vhost, or null to allow all.

Tell multipathd how to manage path group failback

The systemd KillMode to use for glusterd.

glusterd spawns other daemons like gsyncd

Postgresql database superuser used to create Nominatim database and import data

Group policies to install

The filepath to the provider secret key

Multiaddr or array of multiaddrs describing the address to serve the local HTTP API on

Username for the postgresql connection

PEM encoded X509 certificate for TLS

Group policies to install

Write logs to a specific Cloudwatch Logs group.

Specifies a program to be used to look up the user's public keys

If false, a PulseAudio server is launched automatically for each user that tries to use the sound system

If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad ("127.0.0.1") or an IPv6 address enclosed in square brackets ("[::1]").

(VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@" followed by the name of an abstract socket ("@myvarnishd") accept connections on a Unix domain socket

When a job dies, launchd kills any remaining processes with the same process group ID as the job

When a job dies, launchd kills any remaining processes with the same process group ID as the job

Number of I/O requests to route to a path before switching to the next in the same path group

The permission for settings.dir

When a job dies, launchd kills any remaining processes with the same process group ID as the job

Whether to enable the headless Transmission BitTorrent daemon

SSL key in PEM format

This option enables docker, a daemon that manages linux containers

Match windows where wm class group contains string.

This option enables lxd, a daemon that manages containers

Defines Anuko Time Tracker default language

Match windows where wm class group contains string.

Whether to enable KVMGT (iGVT-g) VGPU support

Username for the postgresql connection

Listen on a UNIX socket at the specified path

Allow users of the wpa_supplicant group to control wpa_supplicant through wpa_gui or wpa_cli

This optional key can be used to request that the datagram socket join a multicast group

This option enables libvirtd, a daemon that manages virtual machines

All relay groups to provision

The name of this relay group

Path to a file containing the password

Number of I/O requests to route to a path before switching to the next in the same path group

Attribute set of NetBird client daemons, by default each one will:

1. be manageable using dedicated tooling:

• netbird-<name> script,
• NetBird - netbird-<name> graphical interface when appropriate (see ui.enable),

2. run as a netbird-<name>.service,
3. listen for incoming remote connections on the port 51820 (openFirewall by default),
4. manage the netbird-<name> wireguard interface,
5. use the /var/lib/netbird-/config.json configuration file,
6. override /var/lib/netbird-/config.json with values from /etc/netbird-/config.d/*.json,
7. (hardened) be locally manageable by netbird-<name> system group,

With following caveats:

• multiple daemons will interfere with each other's DNS resolution of netbird.cloud, but should remain fully operational otherwise

Whether to enable VirtualBox.

Hardened service:

• runs as a dedicated user with minimal set of permissions (see caveats),
• restricts daemon configuration socket access to dedicated user group (you can grant access to it with users.users."<user>".extraGroups = [ netbird-‹name› ]),

Even though the local system resources access is restricted:

• CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
• older kernels don't have CAP_BPF and use CAP_SYS_ADMIN instead,

Known security features that are not (yet) integrated into the module:

• 2024-02-14: rosenpass is an experimental feature configurable solely through --enable-rosenpass flag on the netbird up command, see the docs

Hardened service:

• runs as a dedicated user with minimal set of permissions (see caveats),
• restricts daemon configuration socket access to dedicated user group (you can grant access to it with users.users."<user>".extraGroups = [ netbird-‹name› ]),

Even though the local system resources access is restricted:

• CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
• older kernels don't have CAP_BPF and use CAP_SYS_ADMIN instead,

Known security features that are not (yet) integrated into the module:

• 2024-02-14: rosenpass is an experimental feature configurable solely through --enable-rosenpass flag on the netbird up command, see the docs

All gateway groups (sites) to provision

The name of this gateway group

A list of groups for which targets are retrieved, only supported when targeting the container role

This optional key can be used to request that the datagram socket join a multicast group

This optional key can be used to request that the datagram socket join a multicast group

Remove users from bitwarden groups if no longer in the ldap group.

Do not send VRRP adverts over VRRP multicast group

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Path to a file containing the password

This optional key can be used to request that the datagram socket join a multicast group

The default path grouping policy to apply to unspecified multipaths

Attribute that lists members in a LDAP group.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Enable distributed billing on this poller

Key file for client cert authentication to the server.

The targets specified by the target group.

Kanidm groups that are allowed to login using PAM.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

Kanidm groups that are allowed to login using PAM.

Listen on a UNIX socket at the specified path

Key file for client cert authentication to the server.

If not null, is used as the permissions set by system.activationScripts.transmission-daemon on the directories services.transmission.settings.download-dir, services.transmission.settings.incomplete-dir. and services.transmission.settings.watch-dir

Key file for client cert authentication to the server.

Key file for client cert authentication to the server.

The string by which Uyuni group names are joined into the groups label

Defaults to , in prometheus when set to null.