List of public keys used to sign binary caches

If enabled (the default), Nix will only download binaries from binary caches if they are cryptographically signed with any of the keys listed in nix.settings.trusted-public-keys

A list of SSH public keys allowed to access the binary cache via SSH.

Path to the file containing the KSK public key

List of public key files that will be imported by gpg.

A list of verbatim OpenSSH public keys that should be added to the user's authorized keys

A list of public keys of upstream caches in the format host[-[0-9]*]:public-key

The path to the public key file for the host

A list of verbatim OpenSSH public keys that should be added to the user's authorized keys

A list of public keys of upstream caches in the format host[-[0-9]*]:public-key

The path to the public key file for the host

Path to the file containing the ZSK public key

Whether to enable exposing OpenSSH public keys defined in userdb

Whether to add nix-ssh to the nix.settings.trusted-users

Public key for Stripe

List of raw public key candidates to use for authentication

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Path to a file containing the public key of the local Rosenpass peer

Directory for the ACME challenge, which is public

List of raw public keys to accept for authentication

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the acme challenge which is PUBLIC, don't put certs or keys in here

Directory for the acme challenge which is PUBLIC, don't put certs or keys in here

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

Directory for the acme challenge which is PUBLIC, don't put certs or keys in here

Directory for the ACME challenge, which is public

Directory for the ACME challenge, which is public

A list of files each containing one OpenSSH public key that should be added to the user's authorized keys

Directory for the ACME challenge, which is public

List of public signing keys of users that can access the admin panel

A list of files each containing one OpenSSH public key that should be added to the user's authorized keys

Directory for the acme challenge which is PUBLIC, don't put certs or keys in here

Directory for the ACME challenge, which is public

Directory for the acme challenge which is PUBLIC, don't put certs or keys in here

Installing a public key allows firmware signed with a matching private key to be recognized as trusted, which may require less authentication to install than for untrusted files

Public SSH keys that are given full write access to this repository

Whether to generate signing keys in /etc/guix which are required to initialize a substitute server

Directory for the ACME challenge, which is public

Serve BorgBackup repositories to given public SSH keys, restricting their access to the repository only

Allows the generation of a private key and associated self-signed certificate

Directory for the acme challenge which is PUBLIC, don't put certs or keys in here

Path-prefrix for the CA-certificate to be used for cfssl signing

Directory for the acme challenge which is PUBLIC, don't put certs or keys in here

Directory for the acme challenge which is PUBLIC, don't put certs or keys in here

Directory for the acme challenge which is PUBLIC, don't put certs or keys in here

Directory for the ACME challenge, which is public

Specifies a program to be used to look up the user's public keys

List of peer public keys to allow incoming peering connections from

File containing PEM-encoded x509 RSA or ECDSA private or public keys, used to verify ServiceAccount tokens

Filesystem location where Nexus should store the bank public keys.

Directory for the ACME challenge, which is public

Define your TSIG keys here.

Path to file with trusted public keys in OpenSSH's authorized_keys format

A list of names of users (separated by whitespace) that are allowed to connect to the Nix daemon

The username to log in as on the remote host

Servers listed here will be used to gather public keys of other servers (notary trusted key servers)

Public SSH keys that can only be used to append new data (archives) to the repository

The (base64-encoded) public host key of this builder

Additional packages to place in the path of public-inbox-mda, public-inbox-watch, etc.

Servers listed here will be used to gather public keys of other servers (notary trusted key servers)

Settings for the public-inbox config file.

The public key data for the host

Path to the file where DHT keys are stored.

File to persist HTTPPROXY keys.

Path to store SSH host & client keys.

File to persist SOCKSPROXY keys.

The public key data for the host

Command-line arguments to pass to public-inbox-mda(1).

Whether to enable the public-inbox mail archiver.

public inboxes

Path to TLS key to use for connections to public-inbox-nntpd(1).

Path to TLS key to use for connections to public-inbox-imapd(1).

Command-line arguments to pass to public-inbox-nntpd(1).

Command-line arguments to pass to public-inbox-httpd(1).

Command-line arguments to pass to public-inbox-imapd(1).

Path to TLS certificate to use for connections to public-inbox-imapd(1).

Path to TLS certificate to use for connections to public-inbox-nntpd(1).

The public-inbox package to use.

Whether to enable the public-inbox Mail Delivery Agent.

Game will be published on the official Factorio matching server.

Maximum number of returned keys in keys command. keys is a dangerous command

An SSH public key (as an absolute file path or directly as a string), usually generated by rad auth.

Whether to enable the public-inbox NNTP server.

Whether to enable the public-inbox HTTP server.

Whether to enable the public-inbox IMAP server.

Directory containing ssh keys, defaulting to auto-generation

If you're running a self hosted instance and wish to serve public links, set this to the URL where your albums web app is running.

Keyset used for tunnel identity.

Path to the Public Key.

Make your The Lounge instance public

Whether to enable Immich Public Proxy.

Keyset used for tunnel identity.

Path to the file which contains the actual base64 encoded key

Root paths or URLs that public-inbox will be served on

Listening port

Listening port

Public http server binding [address]:port.

The public ipv4 address of this relay

The public ipv6 address of this relay

The immich-public-proxy package to use.

Allows loading of public environment variables, these are emitted to the log so it shouldn't contain secrets.

Remote public key in hexadecimal form.

List of keycodes to match.

A comma-separated list of subnets that will be used as public networks in the cluster.

Configuration for IPP

Authentication algorithm for this key.

Paths for public-inbox-watch(1) to monitor for new mail.

The local path name of a CSS file for the PSGI web interface.

SpamAssassin configuration specific to public-inbox.

NNTP URLs to this public-inbox instance

POP3 URLs to this public-inbox instance

IMAP URLs to this public-inbox instance

Controls which lists (if any) are listed for when the root public-inbox URL is accessed over HTTP.

Path to the file containing the KSK private key.

The email addresses of the public-inbox.

The fully qualified, publicly accessible URL

code repositories

Path to the file containing the ZSK private key.

Specify SSH host keys to import into the initrd

The port that IPP will listen on.

IP accessible by other nodes for inter-host communication

Whether this is a public client (enforces PKCE, doesn't use a basic secret)

The absolute path to the directory which hosts the public-inbox.

Inboxes to configure, where attribute names are inbox names.

Path to a git repository

If set to spamc, public-inbox-watch(1) will filter spam using SpamAssassin.

Whether to enable access from anywhere (rather than just localhost).

A key list specifying a host switch combination.

A list of key names is available in https://github.com/htrefil/rkvm/blob/master/switch-keys.md.

URL of a cgit instance

URL of the Immich instance

List of keys to match

URL where this inbox can be accessed over HTTP.

Listening port or systemd's ListenStream= entry to be used as a reverse proxy, eg. in nginx: locations."/inbox".proxyPass = "http://unix:${config.services.public-inbox.http.port}:/inbox"; Set to null and use systemd.sockets.public-inbox-httpd.listenStreams if you need a more advanced listening.

Public key at the opposite end of the tunnel.

Public key at the opposite end of the tunnel.

Whether to enable opening the firewall when using a port option.

Whether to enable the integration into Postfix.

If set to spamc, public-inbox-watch(1) will filter spam using SpamAssassin.

Public address to assume when running behind NAT.

The name of public X.509 certificate (chain) file in PEM format for this policy to be found in the baseDirectory, or the absolute path to the certificate file

The base64 public key to the peer.

Whether to use sign the limine binary with sbctl.

Set name to shared memory zone.

Set size to shared memory zone.

If specified, public-inbox-watch(1) will only process mail containing a matching header.

Whether to enable public mode.

Whether to open the IPP port in the firewall

Public base URL where the server is visible.

Node key file.

Nicknames of a 'coderepo' section associated with the inbox.

The base64 public key of the peer.

If set, mail in this maildir will be trained as spam and deleted from all watched inboxes

NNTP group name for the inbox.

Path to a file containing the public key of the remote Rosenpass peer.

URL under which the media proxy is publicly acccessible.

The hosts config to be merged with the settings

Key server from which to fetch and update keys

Configuration options to set in the GitLab Pages config file

Public-facing endpoint that can receive webhooks.

Initial administrative public key for Gitolite

User-visible description for the repository.

Publicly visible IP address of the process

The public-facing base URL for the client API (not including _matrix/...)

The key sequence that should be remapped

Controls whether the server will be publicly listed.

If set, the calling user's SSH agent is used to authenticate against the configured keys

A file for storing secrets

Your role in Tor network

Whether to generate SSH host keys

The key sequence that should be output when the input sequence is entered

Whether to enable logkeys, a keylogger service.

The frp consists of client and server

Configuration for yggdrasil, as a structured Nix attribute set

Whether to enable brightness control with keyboard keys

Enable automatic generation of account keys

This is a small wrapper over systemd's LoadCredential

Alternative path to storage of i2pd data (RI, keys, peer profiles, ...)

The selector to use for DKIM key identification

Skydns path of TLS client certificate - public key.

The string to prefix to keys.

Use the given device as keyboard input event device instead of /dev/input/eventX default.

Skydns path of TLS certificate authority public key.

The key sequence that should be output when the input key is tapped

The length of time to ensure that keys will be correct; no action will be taken to create new keys to be activated after this time.

The key that should be remapped

The key sequence that should be output when the input key is held

Whether to enable automatic generation and persistence of keys

Whether to enable Lightweight selfhosted Firefox Send alternative without public upload.

The group under which NNCP files shall be owned

The path to the file used for signing derivation data

The config directory, for the access keys and other settings.

SSH public key allowed to login as user btrbk to run remote backups.

Legacy RSA public key of the host in PEM format, including start and end markers

By default pam-ussh reads the trusted user CA keys from /etc/ssh/trusted_user_ca

SSH keys that should be able to make or push snapshots on this system remotely with btrbk

The wshowkeys package to use.

Defines new command keys.

The location of the system persistent storage file

If enabled, pam_gnupg will attempt to automatically unlock the user's GPG keys with the login password via gpg-agent

JSON file containing secret keys

Select whether rathole needs to be run as a client or a server

Web interface root public URL, including scheme and port (if non-default).

Email domains handled by this instance

Public network interface

Path to the server's public key.

The path to load the secretKey for signing narinfos

Content of the Stubby configuration file

Build veilid-server.conf with nix expression

Defines new line-editing keys.

Java KeyStore file containing the certificates.

Whether to run searx in uWSGI as a "vassal", instead of using its built-in HTTP server

Authorized clients for a v3 onion service, as a list of public key, in the format:

descriptor:x25519:<base32-public-key>

See torrc manual.

config.yaml for evdevremapkeys

Configure nginx as a reverse proxy for mastodon

Enables P11 PAM (pam_p11) module

How long to keep the private keys in memory

Full public URL of gitea server.

Path to directory of X.509 certificates in PEM format for trusted parties

Whether to enable wshowkeys (displays keypresses on screen on supported Wayland compositors)

Settings for MaryTTS

Public address for p2p connections from peers (if TCP is used)

List of peers to connect to, in the formats:

• quic://[2001:0db8::1]:9651
• quic://192.0.2.1:9651
• tcp://[2001:0db8::1]:9651
• tcp://192.0.2.1:9651

If addHostedPublicNodes is set to true, the hosted public nodes will also be added.

If using a Cloudfront/Cloudflare distribution or similar it can be set using this option

The public URL of the server, for password reset links.

Configuration files to load besides the immutable one defined by the NixOS module

Key type to use for private keys

Whether to enable nginx or not

The public websocket URL for livekit

Public URL of the API address of the reverse proxy/tls terminator

Wait for a keystroke before hiding the cursor

Files containing SSH host keys to set as global known hosts. /etc/ssh/ssh_known_hosts (which is generated by programs.ssh.knownHosts) is always included.

Whether to start the OpenSSH agent when you log in

Use Tailscale Funnel to make tsidp available on the public internet so it works with SaaS products.

Load public posts

Paths to the signing keys to use for signing the cache

The path that opendkim should put its generated private keys into

Specifies the key lib.types that will be used for public key authentication.

Full public URL of Forgejo server.

The path to the TLS key.

  nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"

Public server registration name, and also the name of the Root channel

Public domain of the API address of the reverse proxy/tls terminator.

The public-facing port that PeerTube will be accessible at (likely 80 or 443 if running behind a reverse proxy)

The public host name to serve.

Public facing base URL of the service

This setting is required for any of the following features:

• attachments (to return a download URL)
• e-mail sending (for the topic URL in the email footer)
• iOS push notifications for self-hosted servers (to calculate the Firebase poll_request topic)
• Matrix Push Gateway (to validate that the pushkey is correct)

Configuration options for the Default Terminal Execution Specification

Path to the SSH host public key.

Whether to enable Seahorse, a GNOME application for managing encryption keys and passwords in the GNOME Keyring.

The path to the TLS certificate.

  nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"

Path to TLS certificate

Addresses of public STUN services to use to automatically find the public and local addresses of this Jitsi-Videobridge instance without the need for manual configuration

Your factorio.com login credentials

Your factorio.com login credentials

A list of files containing additional configuration to be included using the include directive

NixOS can automatically generate SSH host keys

Public GitLab server URL.

Set a specific keyfile for this archive

If set, the MUC rooms will be public by default.

Whether to enable authenticating using a signature performed by the ssh-agent

Prefix for all Redis lock keys (only used when Redis is configured).

Key policy for zone signing keys

Key policy for key signing keys

Which port the sks-keyserver is listening on.

Public URL where plausible is available

Servers trusted with signing server keys.

WireGuard public key corresponding to the remote Rosenpass peer.

Public URL of the API address of the reverse proxy/tls terminator

Key type to use for private keys

Key size in bits to use when generating new keys.

Passkeys required to access the periphery API

The frp consists of client and server

Configuration for one or more device IDs

OpenPGP public key.

Enable Git daemon, which allows public hosting of git repositories without any access controls

Kafka broker configuration server.properties

List of peers to exchange keys with.

Whether to filter IPv6 traffic with 6to4 destination addresses that correspond to IPv4 addresses that should not be routed over the public internet.

Whether the server registers as a public server in the global server list

If set, the MUC rooms will display the public JIDs by default.

Allow leaving config.boot.initrd.network.ssh.hostKeys empty, to deploy ssh host keys out of band.

This public key is an SSH certificate authority, rather than an individual host's key.

If set, keys listed in ~/.ssh/authorized_keys and ~/.eid/authorized_certificates can be used to log in with the associated PKCS#11 tokens.

The hostname part of the public URL used as base for all frontend requests

Attribute set of environment variables.

https://github.com/Glimesh/broadcast-box#environment-variables

Whether to enable pgpkeyserver-lite on a nginx vHost proxying to a gpg keyserver.

The public IP address to which packets from the local network are to be rewritten

The pgpkeyserver-lite package to use.

The path where the settings and keys will exist.

Secret keys used for signing and verification.

The public facing domain name used to access grafana from a browser

The maximum expiry delay in seconds to force in public mode.

Whether to enable Kanidm SSH keys login.

your public network interface (wlp3s0, wlan0, eth0, ...)

Automatically setup x509 certificates and keys for the entire cluster.

The public IPv6 address to which packets from the local network are to be rewritten

Which IP address the sks-keyserver is listening on.

Public server registry password, used authenticate your server to the registry to prevent impersonation; required for subsequent registry updates.

Whether to run searx in uWSGI as a "vassal", instead of using its built-in HTTP server

Wireguard public key of this peer.

List of paths that should be mounted before this one

The public URIs of the TURN server to give to clients

This key must be set to enable the Active Record Encryption feature within Rails that Mastodon uses to encrypt and decrypt some database attributes

List of list addresses that should be handled by Schleuder

LiveKit key file holding one or multiple application secrets

Influences logging

Do minification on public static files which reduces the size of assets — saving data for the server & users as well as offering a performance improvement

systemd-boot orders the menu entries by their sort keys, so if you want something to appear after all the NixOS entries, it should start with o or onwards

Which hostname to set the vHost to that is proxying to sks.

Where to bind the PostgREST web server.

The order of the sections in programs.rust-motd.settings

The state directory where keys and data are stored.

If set, the rooms will display the public JIDs by default.

How frequently to change keys

How frequently to change keys

Enables or disables the laptop keyboard's Function (Fn) lock at boot

Public IPs for NAT reflection; for connections to loopbackip:sourcePort from the host itself and from other hosts behind NAT

The changes the principal is allowed to make.

If set, the calling user's SSH agent is used to authenticate against the keys in the calling user's ~/.ssh/authorized_keys

Whether X authentication keys should be passed from the calling user to the target user (e.g. for su)

Settings serialized into config.yml before build

Whether to enable the actkbd key mapping daemon

Commands that should be run right before we try to mount our LUKS device

systemd-boot orders the menu entries by their sort keys, so if you want something to appear after all the NixOS entries, it should start with o or onwards

Prefix for all PostgreSQL advisory lock keys (only used when PostgreSQL is configured as lock backend).

This public key is an SSH certificate authority, rather than an individual host's key.

ActivityPub public key

Method for the initial state transfer (wsrep_sst_method) when a node joins the cluster

Enable the cloud-init service

Authorized keys for the root user on initrd

A list of host names and/or IP numbers used for accessing the host's ssh service

How long in advance to publish new keys

How long in advance to publish new keys

The bit size for generated keys.

Configuration for filebeat

Opens up firewall port for communication between NetBird peers directly over LAN or public IP, without using (internet-hosted) TURN servers as intermediaries.

Opens up firewall port for communication between NetBird peers directly over LAN or public IP, without using (internet-hosted) TURN servers as intermediaries.

Path to the file containing the secret keys.

Snipe-IT configuration options to set in the .env file

Path to keystore (combined PEM with cert/key, or PKCS12 keystore)

Secret key of the onion service

The trusted servers to download signing keys from.

Whether to enable evdevremapkeys, a daemon to remap events on linux input devices.

Path to file containing the public key used for Web Push Voluntary Application Server Identification

Routes that Stargazer should server

Configuration, except ids section, that is written to /etc/keyd/.conf

Base URL of the Matrix homeserver that provides the Client-Server API.

This key must be set to enable the Active Record Encryption feature within Rails that Mastodon uses to encrypt and decrypt some database attributes

Pleroma public configuration

Whether to enable The tuxedo-drivers driver enables access to the following on TUXEDO notebooks:

• Driver for Fn-keys
• SysFS control of brightness/color/mode for most TUXEDO keyboards
• Hardware I/O driver for TUXEDO Control Center

For more inforation it is best to check at the source code description: https://gitlab.com/tuxedocomputers/development/packages/tuxedo-drivers .

Seahub public URL.

Environment variables for configuring the beszel-agent service

systemd-boot orders the menu entries by their sort keys, so if you want something to appear after all the NixOS entries, it should start with o or onwards

The environment the ECS agent should run with

Unless enabled, encryption keys can be easily recovered by an attacker with physical access to any machine with PCMCIA, ExpressCard, ThunderBolt or FireWire port

A file containing the secret used to encrypt session keys

Authorized keys taken from files for the root user on initrd

YAML file to merge into the schleuder config at runtime

Environment file (see systemd.exec(5) "EnvironmentFile=" section for the syntax) to define variables for dex

Public base URL of the Matrix homeserver that provides the Client-Server API when using the Draupnir's Report forwarding feature.

Configuration options corresponding to parameters set in conf/keycloak.conf

TLS certificates are obtained by modules called "certificate loaders"

Timeout for detecting the public IP address.

Whether to enable basic access authentication for Suwayomi-Server

Extra options to be added under production in config/gitlab.yml, as a nix attribute set

Environment file (see systemd.exec(5) "EnvironmentFile=" section for the syntax) to define variables for Searx

monica configuration options to set in the .env file

The path to the xkb types file

Configure nginx as a reverse proxy for dawarich

By default pam-u2f module reads the keys from $XDG_CONFIG_HOME/Yubico/u2f_keys (or $HOME/.config/Yubico/u2f_keys if XDG variable is not set)

List of paths that should be mounted before this one

Extra config files to include

An attribute set that will be used to substitute variables when building the dashboard

If set the URL specified in bitcoin.rpc.url will get the content of this file added as an URL password, so http://user@example.com will turn into http://user:SOMESECRET@example.com

A list of host names and/or IP numbers used for accessing the host's ssh service

LiveKit key file holding one or multiple application secrets

Path to the private key file on the host system

systemd-boot orders the menu entries by their sort keys, so if you want something to appear after all the NixOS entries, it should start with o or onwards

The public client ID of your Spotify application

Path to a JSON file containing binary cache secret keys

A list of attribute sets containing paths to TLS certificates and keys

Configuration parameters to set in parsedmarc.ini

Set the 'all targets ports' flag when registering keys with mpathpersist

config.yaml configuration as a Nix attribute set

This key must be set to enable the Active Record Encryption feature within Rails that Mastodon uses to encrypt and decrypt some database attributes

Whether to enable Google OS Login

Path to a file containing the secret key of the local Rosenpass peer

base64-encoded public ECDH key.

An optional path to an environment file that will be used in the web and workers services

Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint

Configuration for all Datadog checks

List of FIDO2 credential IDs

BookStack configuration options to set in the .env file

If enabled srun will accept the option "--x11" to allow for X11 forwarding from within an interactive session or a batch job

When opening a new LUKS device try reusing last successful passphrase

Agorakit configuration options to set in the .env file

geoipupdate configuration options

An absolute file path (which should be outside the Nix-store) to a key used for encrypting session cookies

An absolute file path (which should be outside the Nix-store) to a secret key for Stripe

IP address on which nebula lighthouse should serve DNS. 'localhost' is a good default to ensure the service does not listen on public interfaces; use a Nebula address like 10.0.0.5 to make DNS resolution available to nebula hosts only.

Group under which the postfix exporter shall be run

Specifies the user under whose account the AuthorizedKeysCommand is run

Enables the use of the ~/.ssh/authorized_keys file

Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint

Whether to enable public registration.

Whether to enable keys to run shell commands.

Additional Munin plugins to activate

Filesystem location where Nexus should store the subscriber private keys.

Options to be added to config.php, as a nix attribute set

Whether to enable the API keys database.

Configuration options to add to Workhorse's configuration file

The path to the signing private key file, used to sign requests and events.

  nix-shell -p dendrite --command "generate-keys --private-key matrix_key.pem"

Specify the rules for which files to read on the host

The hash algorithm to use for passwords and API keys

Defines the path to the data directory

Base64-encoded public key for the node, used as the node's ID.

Whether to make sshd look up authorized keys from SSS

The realm(s) to serve keys for.

Path to keystore (combined PEM with cert/key, or PKCS12 keystore)

Whether to enable provisioning functionality in the agent

Path to the file with your personal ecoflow app login email address

When set to true, attempts to discover the host's public IP via STUN

If true on import encryption keys or passwords for all encrypted datasets are requested

File pointing to preshared key as generated by wg genpsk

An attribute set where the keys name the organisation and the values are a set of lists of users and groups.

Path to the file with your personal api secret string from the Ecoflow development website https://developer-eu.ecoflow.com

Path to the file with your personal api access string from the Ecoflow development website https://developer-eu.ecoflow.com

The availability of the endpoint to connect to

A list of signing keys for each substitute server to be authorized as a source of substitutes

Map of incoming traffic patterns to local targets

A list of paths to files in OpenSSH's authorized_keys format, containing the keys that will be trusted by the pam_ssh_agent_auth module

Base64 preshared key generated by wg genpsk

Path to the service's config file

Path to the file with your personal ecoflow app login email password

Allow localhost redirects

Discourse site settings

Disable PKCE on this oauth2 resource server to work around insecure clients that may not support it

Authentication to perform locally.

• The default pubkey uses public key authentication using a private key associated to a usable certificate.
• psk uses pre-shared key authentication.
• The IKEv1 specific xauth is used for XAuth or Hybrid authentication,
• while the IKEv2 specific eap keyword defines EAP authentication.
• For xauth, a specific backend name may be appended, separated by a dash

File pointing to preshared key as generated by wg genpsk

If provided this is the full path to a file that contains the key to enable [server-side encryption with customer-provided keys][1] (SSE-C)

File must contain one line, example: R3300000,R3400000,NC430000,...

The sort key used for the NixOS bootloader entries

List of paths that should be mounted before this one

Base64 preshared key generated by wg genpsk

The port to scrape metrics from

The port to scrape metrics from

File mapping user names to pre-shared keys (passwords).

Slightly higher value for typing keys, to prevent unexpected hold effect.

Path to the service's environment file

When set to true, attempts to discover the host's public IP via STUN

File must contain one line, example: {"R3300000":"Delta 2","R3400000":"Delta Pro",...} The key/value map of custom names for your devices

Note: when using ntfy.sh and other public instances it is recommended to set this option to an empty string and set the actual topic via services.prometheus.alertmanager-ntfy.extraConfigFiles since the topic in ntfy.sh is essentially a password

Specifies the (clear text) password for the user

Path of the PEM-encoded private key for this account

The port to scrape metrics from

Specifies the (clear text) password for the user

Configures the syscall filter for postgresql.service

If this attribute is given, SAE-PK will be enabled for this connection

AWS Role ARN, an alternative to using AWS API keys.

Path to the service's config file

Web Push Notifications configuration

List of paths to the server private keys and certificates.

https://www.postfix.org/postconf.5.html#smtpd_tls_chain_files

Learn more at https://docs.stashapp.cc/networking/authentication-required-when-accessing-stash-from-the-internet/

The port to scrape metrics from

The port to scrape metrics from

Set of accepted cipher suites (encryption algorithms) for pairwise keys (unicast packets)

Authentication to expect from remote

AWS Role ARN, an alternative to using AWS API keys.

Public port number to try to redirect to this machine's Wireguard daemon using UPnP IGD.

The AWS API keys

The AWS API keys

Learn more at https://docs.stashapp.cc/networking/authentication-required-when-accessing-stash-from-the-internet/

ESP proposals to offer for the CHILD_SA