Path to directory of CRLs (Certificate Revocation Lists) in PEM format

This optional key describes, at a high level, the intended purpose of the job

Whether to enable dynamic Boost balances power between the CPU and the GPU for improved performance on supported laptops using the nvidia-powerd daemon

Additional environment variables to be passed to the jenkins process

The maximum size (in bytes) to which a process's resident set size may grow

The maximum size (in bytes) to which a process's resident set size may grow

Set the log level of the daemon.

This optional key is used to specify additional environment variables to be set before running the job.

The lmtp daemon will make the unix socket group-read/write for users in this group.

This optional key can be used to request that the datagram socket join a multicast group

The root directory for file URLs used with the Cypher LOAD CSV clause

This flag instructs launchd that the job promises to use vproc_transaction_begin(3) and vproc_transaction_end(3) to track outstanding transactions that need to be reconciled before the process can safely terminate

Path of the database plugin directory

Path to directory of X.509 certificates in PEM format for trusted parties

Extra command-line options passed to the daemon

This optional key is used as a hint to launchctl(1) that it should not submit this job to launchd when loading a job or jobs

Interface address to bind the endlessh-go daemon to answer Prometheus queries.

This optional key specifies whether the kernel should consider this daemon to be low priority when doing file system I/O.

This flag corresponds to the "wait" or "nowait" option of inetd

Settings whose options overwrite fields in .config/transmission-daemon/settings.json (each time the service starts)

Configuration for act_runner daemon

This optional key specifies whether the kernel should consider this daemon to be low priority when doing file system I/O.

The mandatory base directory for cryptographic objects of this policy

File containing the password for the mpd daemon

Open ports in the firewall for TorrentStream daemon.

This optional key causes the job to be started every calendar interval as specified

Whether to enable evdevremapkeys, a daemon to remap events on linux input devices.

Unix domain socket that the mail notification daemon listens on.

How to treat USB controller devices that are already connected when the daemon starts

This is a numeric value in mebibytes (MiB) that tells the audit daemon when to perform a configurable action because the system is running low on disk space

Whether to request X11 forwarding on outgoing connections by default

The version of nix that nixseparatedebuginfod should use as client for the nix daemon

The port where the daemon will listen to client connections for this homeserver

The specified name-string gives the system file name of the storage device managed by this storage daemon

Whether to leave interfaces configured on dhcpcd daemon shutdown

The address where the daemon will listen to client connections for this homeserver.

The implementation to use for the message bus defined by the D-Bus specification

Enable automatic-timezoned, simple daemon for keeping the system timezone up-to-date based on the current location

Interval in which the TuneD daemon is waken up and checks for events (in seconds).

Whether to use individual -restore calls to apply changes to the firewall

File path containing environment variables for configuring the GoToSocial service in the format of an EnvironmentFile as described by systemd.exec(5)

A list of files each containing one OpenSSH public key that should be added to the user's authorized keys

A list of files each containing one OpenSSH public key that should be added to the user's authorized keys

A list of verbatim OpenSSH public keys that should be added to the user's authorized keys

A list of verbatim OpenSSH public keys that should be added to the user's authorized keys

Hardened service:

• runs as a dedicated user with minimal set of permissions (see caveats),
• restricts daemon configuration socket access to dedicated user group (you can grant access to it with users.users."<user>".extraGroups = [ netbird-‹name› ]),

Even though the local system resources access is restricted:

• CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
• older kernels don't have CAP_BPF and use CAP_SYS_ADMIN instead,

Known security features that are not (yet) integrated into the module:

• 2024-02-14: rosenpass is an experimental feature configurable solely through --enable-rosenpass flag on the netbird up command, see the docs

Hardened service:

• runs as a dedicated user with minimal set of permissions (see caveats),
• restricts daemon configuration socket access to dedicated user group (you can grant access to it with users.users."<user>".extraGroups = [ netbird-‹name› ]),

Even though the local system resources access is restricted:

• CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
• older kernels don't have CAP_BPF and use CAP_SYS_ADMIN instead,

Known security features that are not (yet) integrated into the module:

• 2024-02-14: rosenpass is an experimental feature configurable solely through --enable-rosenpass flag on the netbird up command, see the docs

Set the log level of the daemon.

Whether to enable Open vSwitch

The address for the daemon to listen on

A list of files each containing one OpenSSH public key that should be added to the user's authorized keys

The OCaml-based Xen Store Daemon configuration

Path to the Xen Store Daemon PID file.

The maximum number of open files for this process

The maximum number of open files for this process

A list of verbatim OpenSSH public keys that should be added to the user's authorized keys

The extra command-line options to pass to docker daemon.

Whether to enable the GlusterFS Events Daemon

This optional key specifies whether the kernel should consider this daemon to be low priority when doing file system I/O when the process is throttled with the Darwin-background classification.

The presence of this key specifies that the daemon expects to be run as if it were launched from inetd.

Extra packages to add to PATH for the docker daemon process.

The port where the daemon will listen to client connections for this homeserver

Absolute path to the certificate to load

The address where the daemon will listen to client connections for this homeserver.

Whether to apply security hardening measures to wpa_supplicant

The maximum number of open files for this process

The maximum number of open files for this process

The maximum number of open files for this process

The maximum number of open files for this process

This optional key is used to specify launch on demand sockets that can be used to let launchd know when to run the job

This optional key specifies whether the kernel should consider this daemon to be low priority when doing file system I/O when the process is throttled with the Darwin-background classification.

Additional configuration for the WirePlumber daemon when run in single-instance mode (the default in nixpkgs and currently the only supported way to run WirePlumber configured via extraConfig)

This optional key specifies whether the kernel should consider this daemon to be low priority when doing file system I/O when the process is throttled with the Darwin-background classification.

The presence of this key specifies that the daemon expects to be run as if it were launched from inetd.

The maximum number of simultaneous processes for this user id

The maximum number of simultaneous processes for this user id

The presence of this key specifies that the daemon expects to be run as if it were launched from inetd.

Extra packages to add to PATH for the docker daemon process.

Absolute path to the certificate to load

To enforce UDP encapsulation of ESP packets, the IKE daemon can fake the NAT detection payloads

Directory for storing certificates to be used by Neo4j for TLS connections

Absolute path to the certificate to load

This optional key is used to specify launch on demand sockets that can be used to let launchd know when to run the job

This optional key is used to specify launch on demand sockets that can be used to let launchd know when to run the job

Absolute path to the certificate to load

The maximum number of simultaneous processes for this user id

The maximum number of simultaneous processes for this user id

The maximum number of simultaneous processes for this user id

The maximum number of simultaneous processes for this user id

Send certificate payloads when using certificate authentication.

• With the default of ifasked the daemon sends certificate payloads only if certificate requests have been received.
• never disables sending of certificate payloads altogether,
• always causes certificate payloads to be sent unconditionally whenever certificate authentication is used

If not null, is used as the permissions set by system.activationScripts.transmission-daemon on the directories services.transmission.settings.download-dir, services.transmission.settings.incomplete-dir. and services.transmission.settings.watch-dir

Whether to install IPsec policies or not

Address of the Docker daemon.

XFRM interface ID set on outbound policies/SA

Use IKE fragmentation (proprietary IKEv1 extension or RFC 7383 IKEv2 fragmentation)

Address of the Docker daemon.

List of local traffic selectors to include in CHILD_SA

Public port number to try to redirect to this machine's Wireguard daemon using UPnP IGD.