| services.autorandr.matchEdid | Match displays based on edid instead of name
|
| systemd.network.links.<name>.matchConfig | Each attribute in this set specifies an option in the
[Match] section of the unit
|
| systemd.network.netdevs.<name>.matchConfig | Each attribute in this set specifies an option in the
[Match] section of the unit
|
| systemd.network.networks.<name>.matchConfig | Each attribute in this set specifies an option in the
[Match] section of the unit
|
| services.journalwatch.filterBlocks.*.match | Syntax: field = value
Specifies the log entry field this block should apply to
|
| nix.registry.<name>.exact | Whether the from reference needs to match exactly
|
| boot.binfmt.registrations.<name>.matchCredentials | Whether to launch with the credentials and security
token of the binary, not the interpreter (e.g. setuid
bit)
|
| services.thinkfan.fans.*.query | The query string used to match one or more fans: can be
a fullpath to the temperature file (single fan) or a fullpath
to a driver directory (multiple fans).
When multiple fans match, the query can be restricted using the
name or indices options.
|
| boot.loader.limine.panicOnChecksumMismatch | Whether or not checksum validation failure should be a fatal
error at boot time.
|
| users.users.<name>.createHome | Whether to create the home directory and ensure ownership as well as
permissions to match the user.
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchIface | interface name of the NetworkManager connection
|
| services.thinkfan.sensors.*.query | The query string used to match one or more sensors: can be
a fullpath to the temperature file (single sensor) or a fullpath
to a driver directory (multiple sensors).
When multiple sensors match, the query can be restricted using the
name or indices options.
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchUuid | UUID of the connection profile
UUIDs are assigned once on connection creation and should never change as long as the connection still applies to the same network.
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchId | connection id used by NetworkManager
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchType | NetworkManager connection type
The NetworkManager configuration settings reference roughly corresponds to connection types
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchSetting | name of the setting section for which secrets are requested
|
| users.extraUsers.<name>.createHome | Whether to create the home directory and ensure ownership as well as
permissions to match the user.
|
| services.nghttpx.frontends.*.params.sni-fwd | When performing a match to select a backend server, SNI host
name received from the client is used instead of the request
host
|
| networking.nat.dmzHost | The local IP address to which all traffic that does not match any
forwarding rule is forwarded.
|
| services.system76-scheduler.assignments.<name>.matchers | Process matchers.
|
| services.actkbd.bindings.*.keys | List of keycodes to match.
|
| systemd.network.networks.<name>.name | The name of the network interface to match against.
|
| services.matrix-appservice-discord.settings | config.yaml configuration as a Nix attribute set
|
| services.journalwatch.filterBlocks.*.filters | The filters to apply on all messages which satisfy match
|
| services.actkbd.bindings.*.events | List of events to match.
|
| services.ndppd.proxies.<name>.rules | This is a rule that the target address is to match against
|
| services.thinkfan.fans.*.indices | A list of fans to pick in case multiple fans match the query.
|
| programs.captive-browser.dhcp-dns | The shell (/bin/sh) command executed to obtain the DHCP
DNS server address
|
| services.firewalld.zones.<name>.target | Action for packets that doesn't match any rules.
|
| nixpkgs.buildPlatform | Specifies the platform on which NixOS should be built
|
| services.oauth2-proxy.cookie.domain | Optional cookie domains to force cookies to (ie: .yourcompany.com)
|
| services.gemstash.settings | Configuration for Gemstash
|
| services.misskey.settings.url | The final user-facing URL
|
| services.spice-autorandr.enable | Whether to enable spice-autorandr service that will automatically resize display to match SPICE client window size.
|
| services.mx-puppet-discord.settings | config.yaml configuration as a Nix attribute set
|
| services.multipath.devices.*.vendor | Regular expression to match the vendor name
|
| services.libreswan.policies | A set of policies to apply to the IPsec connections.
The policy name must match the one of connection it needs to apply to.
|
| programs.zsh.autosuggestions.strategy | ZSH_AUTOSUGGEST_STRATEGY is an array that specifies how suggestions should be generated
|
| services.prometheus.remoteRead.*.required_matchers | An optional list of equality matchers which have to be
present in a selector to query the remote read endpoint.
|
| services.mautrix-discord.settings | config.yaml configuration as a Nix attribute set
|
| services.thinkfan.sensors.*.indices | A list of sensors to pick in case multiple sensors match the query.
|
| services.multipath.devices.*.product | Regular expression to match the product name
|
| services.openafsClient.packages.module | OpenAFS kernel module package
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.matchers | Process matchers.
|
| services.graphite.carbon.blacklist | Any metrics received which match one of the expressions will be dropped.
|
| services.graphite.carbon.whitelist | Only metrics received which match one of the expressions will be persisted.
|
| services.ndppd.proxies.<name>.rules.<name>.network | This is the target address is to match against
|
| services.multipath.devices.*.revision | Regular expression to match the product revision
|
| virtualisation.oci-containers.containers.<name>.imageFile | Path to an image file to load before running the image
|
| services.openssh.settings.UseDns | Specifies whether sshd(8) should look up the remote host name, and to check that the resolved host name for
the remote IP address maps back to the very same IP address
|
| services.openafsClient.packages.programs | OpenAFS programs package
|
| services.usbguard.implicitPolicyTarget | How to treat USB devices that don't match any rule in the policy
|
| services.mautrix-signal.settings | config.yaml configuration as a Nix attribute set
|
| services.mautrix-telegram.settings | config.yaml configuration as a Nix attribute set
|
| services.slskd.settings.filters.search.request | Incoming search requests which match this filter are ignored.
|
| security.pam.services.<name>.kwallet.enable | If enabled, pam_wallet will attempt to automatically unlock the
user's default KDE wallet upon login
|
| services.ndppd.proxies.<name>.rules.<name>.method | static: Immediately answer any Neighbor Solicitation Messages
(if they match the IP rule).
iface: Forward the Neighbor Solicitation Message through the specified
interface and only respond if a matching Neighbor Advertisement
Message is received.
auto: Same as iface, but instead of manually specifying the outgoing
interface, check for a matching route in /proc/net/ipv6_route.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.background.matchers | Process matchers.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.foreground.matchers | Process matchers.
|
| security.pam.services.<name>.enableGnomeKeyring | If enabled, pam_gnome_keyring will attempt to automatically unlock the
user's default Gnome keyring upon login
|
| services.triggerhappy.bindings.*.event | Event to match.
|
| services.prometheus.exporters.rtl_433.ids.*.id | ID to match.
|
| services.cyrus-imap.imapdSettings.lmtpsocket | Unix socket that lmtpd listens on, used by deliver(8)
|
| services.grafana.settings.users.home_page | Path to a custom home page
|
| services.syncthing.settings | Extra configuration options for Syncthing
|
| services.triggerhappy.bindings.*.keys | List of keys to match
|
| services.mautrix-whatsapp.settings | config.yaml configuration as a Nix attribute set
|
| services.prometheus.exporters.rtl_433.ids.*.name | Name to match.
|
| services.mautrix-meta.instances.<name>.settings | config.yaml configuration as a Nix attribute set
|
| services.kanidm.provision.systems.oauth2.<name>.originUrl | The redirect URL of the service
|
| system.forbiddenDependenciesRegexes | POSIX Extended Regular Expressions that match store paths that
should not appear in the system closure, with the exception of system.extraDependencies, which is not checked.
|
| boot.binfmt.registrations.<name>.magicOrExtension | The magic number or extension to match on.
|
| nixpkgs.pkgs | If set, the pkgs argument to all NixOS modules is the value of
this option, extended with nixpkgs.overlays, if
that is also set
|
| services.angrr.settings.temporary-root-policies.<name>.path-regex | Regex pattern to match the GC root path.
|
| services.prometheus.exporters.postfix.group | Group under which the postfix exporter shall be run
|
| services.prometheus.exporters.rtl_433.ids.*.location | Location to match.
|
| services.prometheus.exporters.rtl_433.channels.*.name | Name to match.
|
| hardware.display.edid.linuxhw | Exposes EDID files from users-sourced database at https://github.com/linuxhw/EDID
Attribute names will be mapped to EDID filenames <NAME>.bin
|
| services.dendrite.settings.sync_api.search.language | The language most likely to be used on the server - used when indexing, to
ensure the returned results match expectations
|
| services.prometheus.exporters.rtl_433.channels.*.channel | Channel to match.
|
| services.prometheus.exporters.rtl_433.channels.*.location | Location to match.
|
| services.nghttpx.backends.*.params.redirect-if-not-tls | If true, a backend match requires the frontend connection be
TLS encrypted
|
| boot.initrd.availableKernelModules | The set of kernel modules in the initial ramdisk used during the
boot process
|
| services.grafana.settings.server.enforce_domain | Redirect to correct domain if the host header does not match the domain
|
| services.matrix-synapse.settings.dynamic_thumbnails | Whether to generate new thumbnails on the fly to precisely match
the resolution requested by the client
|
| services.strongswan-swanctl.swanctl.connections.<name>.local_addrs | Local address(es) to use for IKE communication
|
| virtualisation.oci-containers.containers.<name>.ports | Network ports to publish from the container to the outer host
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswordsFile | Sets the password for WPA3-SAE
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.mark_out | Netfilter mark and mask for output traffic
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.mark_in_sa | Whether to set mark_in on the inbound SA
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.mark_in | Netfilter mark and mask for input traffic
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote_addrs | Remote address(es) to use for IKE communication
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.set_mark_in | Netfilter mark applied to packets after the inbound IPsec SA processed
them
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.policies_fwd_out | Whether to install outbound FWD IPsec policies or not
|
| services.journalwatch.filterBlocks | filterBlocks can be defined to blacklist journal messages which are not errors
|
| hardware.block.scheduler | Assign block I/O scheduler by device name pattern
|
| networking.dhcpcd.allowInterfaces | Enable the DHCP client for any interface whose name matches
any of the shell glob patterns in this list
|
| services.borgbackup.jobs.<name>.patterns | Include/exclude paths matching the given patterns
|
| services.docuum.keep | Prevents deletion of images for which repository:tag matches the specified regex.
|
| systemd.network.networks.<name>.DHCP | Whether to enable DHCP on the interfaces matched.
|
| services.postfix.headerChecks.*.action | The action to be executed when the pattern is matched
|
| security.duosec.groups | If specified, Duo authentication is required only for users
whose primary group or supplementary group list matches one
of the space-separated pattern lists
|
| xdg.terminal-exec.settings | Configuration options for the Default Terminal Execution Specification
|
| services.fail2ban.ignoreIP | "ignoreIP" can be a list of IP addresses, CIDR masks or DNS hosts
|
| services.redsocks.redsocks.*.doNotRedirect | Iptables filters that if matched will get the packet off of
redsocks.
|
| services.taskserver.allowedClientIDs | A list of regular expressions that are matched against the reported
client id (such as task 2.3.0)
|
| services.firefly-iii.settings.APP_URL | The APP_URL used by firefly-iii internally
|
| services.prometheus.exporters.rtl_433.ids | List of ID matchers to export.
|
| services.waagent.settings.OS.EnableRDMA | If enabled, the agent attempts to install and then load an RDMA kernel driver
that matches the version of the firmware on the underlying hardware.
|
| services.rkvm.client.settings.password | Shared secret token to authenticate the client
|
| services.rkvm.server.settings.password | Shared secret token to authenticate the client
|
| security.tpm2.fapi.ekFingerprint | The fingerprint of the endorsement key
|
| services.taskserver.disallowedClientIDs | A list of regular expressions that are matched against the reported
client id (such as task 2.3.0)
|
| system.replaceDependencies.cutoffPackages | Packages to which no replacements should be applied
|
| services.angrr.settings.temporary-root-policies.<name>.period | Retention period for the GC roots matched by this policy.
|
| services.angrr.settings.temporary-root-policies.<name>.filter | External filter program to further filter GC roots matched by this policy.
|
| services.prometheus.exporters.rtl_433.channels | List of channel matchers to export.
|
| networking.dhcpcd.denyInterfaces | Disable the DHCP client for any interface whose name matches
any of the shell glob patterns in this list
|
| services.cloudflared.tunnels.<name>.default | Catch-all service if no ingress matches
|
| fonts.fontconfig.defaultFonts.emoji | System-wide default emoji font(s)
|
| networking.wireless.networks.<name>.priority | By default, all networks will get same priority group (0)
|
| security.acme.certs.<name>.csrKey | Path to the private key to the matching certificate signing request.
|
| services.tinc.networks.<name>.hostSettings.<name>.subnets | The subnets which this tinc daemon will serve
|
| services.yggdrasil.denyDhcpcdInterfaces | Disable the DHCP client for any interface whose name matches
any of the shell glob patterns in this list
|
| services.redsocks.redsocks.*.redirectCondition | Conditions to make outbound packets go through this redsocks
instance
|
| services.ebusd.logs.bus | Only write log for matching AREAs (all|main|network|bus|device|update|other) below or equal to LEVEL (none|error|notice|info|debug)
|
| hardware.deviceTree.filter | Only include .dtb files matching glob expression.
|
| services.ebusd.logs.all | Only write log for matching AREAs (all|main|network|bus|device|update|other) below or equal to LEVEL (none|error|notice|info|debug)
|
| services.ebusd.logs.main | Only write log for matching AREAs (all|main|network|bus|device|update|other) below or equal to LEVEL (none|error|notice|info|debug)
|
| services.grafana.settings.users.default_theme | Sets the default UI theme. system matches the user's system theme.
|
| programs.dsearch.enable | Whether to enable dsearch, a fast filesystem search service with fuzzy matching.
|
| services.ebusd.logs.other | Only write log for matching AREAs (all|main|network|bus|device|update|other) below or equal to LEVEL (none|error|notice|info|debug)
|
| services.below.cgroupFilterOut | A regexp matching the full paths of cgroups whose data shouldn't be collected
|
| services.factorio.public | Game will be published on the official Factorio matching server.
|
| services.ebusd.logs.device | Only write log for matching AREAs (all|main|network|bus|device|update|other) below or equal to LEVEL (none|error|notice|info|debug)
|
| services.ebusd.logs.update | Only write log for matching AREAs (all|main|network|bus|device|update|other) below or equal to LEVEL (none|error|notice|info|debug)
|
| services.prometheus.scrapeConfigs.*.relabel_configs.*.regex | Regular expression against which the extracted value is matched
|
| services.ebusd.logs.network | Only write log for matching AREAs (all|main|network|bus|device|update|other) below or equal to LEVEL (none|error|notice|info|debug)
|
| networking.wg-quick.interfaces.<name>.peers.*.allowedIPs | List of IP (v4 or v6) addresses with CIDR masks from
which this peer is allowed to send incoming traffic and to which
outgoing traffic for this peer is directed
|
| services.oauth2-proxy.skipAuthRegexes | Skip authentication for requests matching any of these regular
expressions.
|
| hardware.deviceTree.overlays.*.dtsText | Literal DTS contents, overlay is applied to
each .dtb file matching "compatible" of the overlay.
|
| hardware.deviceTree.overlays.*.dtsFile | Path to .dts overlay file, overlay is applied to
each .dtb file matching "compatible" of the overlay.
|
| hardware.deviceTree.overlays.*.filter | Only apply to .dtb files matching glob expression.
|
| networking.wireguard.interfaces.<name>.peers.*.allowedIPs | List of IP (v4 or v6) addresses with CIDR masks from
which this peer is allowed to send incoming traffic and to which
outgoing traffic for this peer is directed
|
| services.postfix.headerChecks.*.pattern | A regexp pattern matching the header
|
| services.traefik.dynamic.dir | Path to the directory Traefik should watch for configuration files.
Files in this directory matching the glob _nixos-* (reserved for Nix-managed dynamic configurations) will be deleted as part of
systemd-tmpfiles-resetup.service, regardless of their origin..
|
| services.prometheus.scrapeConfigs.*.relabel_configs.*.source_labels | The source labels select values from existing labels
|
| services.cross-seed.settings.dataDirs | Paths to be searched for matching data
|
| hardware.block.defaultScheduler | Default block I/O scheduler
|
| services.fwupd.extraTrustedKeys | Installing a public key allows firmware signed with a matching private key to be recognized as trusted, which may require less authentication to install than for untrusted files
|
| power.ups.mode | The MODE determines which part of the NUT is to be started, and
which configuration files must be modified
|
| services.kubernetes.kubelet.tlsKeyFile | File containing x509 private key matching tlsCertFile.
|
| services.tarsnap.archives.<name>.excludes | Exclude files and directories matching these patterns.
|
| services.prometheus.remoteWrite.*.write_relabel_configs.*.regex | Regular expression against which the extracted value is matched
|
| services.prometheus.scrapeConfigs.*.relabel_configs.*.replacement | Replacement value against which a regex replace is performed if the
regular expression matches
|
| services.borgbackup.jobs.<name>.prune.keep | Prune a repository by deleting all archives not matching any of the
specified retention options
|
| boot.binfmt.registrations.<name>.mask | A mask to be ANDed with the byte sequence of the file before matching
|
| security.pam.services.<name>.ttyAudit.enablePattern | For each user matching one of comma-separated
glob patterns, enable TTY auditing
|
| services.tarsnap.archives.<name>.includes | Include only files and directories matching these
patterns (the empty list includes everything)
|
| programs.command-not-found.enable | Whether interactive shells should show which Nix package (if
any) provides a missing command
|
| boot.kernel.sysfs | sysfs attributes to be set as soon as they become available
|
| services.borgbackup.jobs.<name>.exclude | Exclude paths matching any of the given patterns
|
| services.prometheus.scrapeConfigs.*.metric_relabel_configs.*.regex | Regular expression against which the extracted value is matched
|
| security.pam.services.<name>.ttyAudit.disablePattern | For each user matching one of comma-separated
glob patterns, disable TTY auditing
|
| services.ebusd.scanconfig | Pick CSV config files matching initial scan ("none" or empty for no initial scan message, "full" for full scan, or a single hex address to scan, default is to send a broadcast ident message)
|
| services.prometheus.remoteWrite.*.write_relabel_configs.*.source_labels | The source labels select values from existing labels
|
| programs.gnupg.agent.pinentryPackage | Which pinentry package to use
|
| services.public-inbox.inboxes.<name>.watchheader | If specified, public-inbox-watch(1) will only process
mail containing a matching header.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.local_ts | List of local traffic selectors to include in CHILD_SA
|
| services.mpdscribble.passwordFile | File containing the password for the mpd daemon
|
| services.prometheus.scrapeConfigs.*.metric_relabel_configs.*.source_labels | The source labels select values from existing labels
|
| services.dovecot2.imapsieve.mailbox.*.name | This setting configures the name of a mailbox for which administrator scripts are configured
|
| services.prometheus.exporters.node-cert.excludeGlobs | List files matching a pattern to include
|
| services.prometheus.exporters.node-cert.includeGlobs | List files matching a pattern to include
|
| services.prometheus.remoteWrite.*.write_relabel_configs.*.replacement | Replacement value against which a regex replace is performed if the
regular expression matches
|
| hardware.block.defaultSchedulerRotational | Default block I/O scheduler for rotational drives (e.g. hard disks)
|
| security.pam.ussh.authorizedPrincipals | Comma-separated list of authorized principals to permit; if the user
presents a certificate with one of these principals, then they will be
authorized
|
| security.pam.ussh.authorizedPrincipalsFile | Path to a list of principals; if the user presents a certificate with
one of these principals, then they will be authorized
|
| services.xserver.displayManager.lightdm.greeter.package | The LightDM greeter to login via
|
| services.matrix-synapse.settings.url_preview_url_blacklist | Optional list of URL matches that the URL preview spider is
denied from accessing.
|
| services.prometheus.scrapeConfigs.*.metric_relabel_configs.*.replacement | Replacement value against which a regex replace is performed if the
regular expression matches
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.auth | Authentication to perform locally.
- The default
pubkey uses public key authentication
using a private key associated to a usable certificate.
psk uses pre-shared key authentication.
- The IKEv1 specific
xauth is used for XAuth or Hybrid
authentication,
- while the IKEv2 specific
eap keyword defines EAP
authentication.
- For
xauth, a specific backend name may be appended,
separated by a dash
|
| services.hddfancontrol.settings.<drive-bay-name>.disks | Drive(s) to get temperature from
Can also use command substitution to automatically grab all matching drives; such as all scsi (sas) drives
|
| services.multipath.devices.*.product_blacklist | Products with the given vendor matching this string are blacklisted
|
| services.prometheus.scrapeConfigs.*.relabel_configs.*.action | Action to perform based on regex matching
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords | Sets allowed passwords for WPA3-SAE
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.dpd_action | Action to perform for this CHILD_SA on DPD timeout
|
| services.hostapd.radios.<name>.networks.<name>.authentication.wpaPskFile | Sets the password(s) for WPA-PSK
|
| services.prometheus.remoteWrite.*.write_relabel_configs.*.action | Action to perform based on regex matching
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.start_action | Action to perform after loading the configuration.
- The default of
none loads the connection only, which
then can be manually initiated or used as a responder configuration.
- The value
trap installs a trap policy, which triggers
the tunnel as soon as matching traffic has been detected.
- The value
start initiates the connection actively.
- Since version 5.9.6 two modes above can be combined with
trap|start,
to immediately initiate a connection for which trap policies have been installed
|
| services.prometheus.scrapeConfigs.*.metric_relabel_configs.*.action | Action to perform based on regex matching
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.selectors | Optional label and field selectors to limit the discovery process to a subset of available resources
|